Run D3 of manual-push mode (BDR-114). With every reader now failing
closed, the skill prose stops saying the lib and hooks still push on an
invalid value:
- capitalize STEP 5C / STEP 6: the invalid outcome is split on the ahead
count (nothing pushed vs pushed anyway by a stale fail-open hook or a
manual push); the verb's stderr line is quoted verbatim; neighbouring
closing lines carry push-mode qualifiers so none shadows the invalid
case; the --no-push lines follow the same rule.
- client-handover: "COMMIT + PUSH" labels become "COMMIT + PUSH STATE
READ"; the STEP 5 residual sentences no longer imply the pipeline
pushes; the invalid value is named as a case where the user pushes.
- release-executor: prep span checks the version format by reading the
string (never in a Bash command); manual mode and an invalid value
both leave main/develop local.
Run C2 of manual-push mode (BDR-111/BDR-112). The four flows that pushed
on their own, or claimed the branch was on origin, now read the truth
after the fact and hand the user the exact command:
- client-handover-writer: the "Push to origin now?" question and its
push block are gone (the hooks had already pushed in auto-push mode;
push-guard denies it in manual mode). A reusable PUSH STATE READ
(branch, origin probe, `git rev-list --count origin/<br>..<br>`, the
verb only to word the reason) runs after commit-change, at the top of
the deploy pause, after "Deployed" and before each end report. The
branch name is validated against an allowlist before it is placed in
any command or hint (a hostile branch name is otherwise a shell
injection). Pending → the user pushes BEFORE the deploy pause; the
deploy brief says "after your push". `Push:` line in both reports.
- release-candidate STEP 6: two ahead counts + the verb; anything other
than auto with both counts 0 prints one user command
`! git push --atomic origin main develop v<X.Y.Z>` and stops; the tag
gate stays for auto mode; `hold` notes --follow-tags; version regex.
- release-executor: push claims qualified (auto-push mode, best effort).
- tour: mode-agnostic rule; STEP 3 reads one `git -C <project>` fact per
project (suffix-aware branch, --remotes=origin, origin probe) and the
summary row says on origin / local only with the user command.
Root causes of the 2026-09-24 errors turned into mechanisms (BDR-100). hard_deny 'Routing around a guardrail': a refused command is never rerun through a wrapper, alias, heredoc, Makefile target, env file, other shell or other agent; the same clause in 14 agents and in the doctrine's sub-agent rule. make test suite=<file> runs one suite hermetically so the denied env-prefix form is never needed by hand. lib/tests/doctrine-citers.test.sh: every CLAUDE.md "Section" / § Label citation across skills, agents, lib, rules and hooks must resolve to a heading or bold label (flip-tested); its first run fixed rest-api-node.md. Doctrine 'After code changes' step 4: a changed rule, heading, label or threshold → grep every citer in the same commit.
One ask policy; mandated executors exempt from the delegation rule; skill plan satisfies the planning rule; journal line exempt from the approval gate; chore = maintenance without new behaviour; small fix on develop = bugfix; BDR-068 written as the one auto-finish exception; deploy routes to /deploy. Skills and agents follow: hotfix types by base + skips the design gate on trivial; capitalize/close create missing registries; commit-change asks the branch type; doc/seo/web-validate/refactor branch through the aiguillage; tour reports BREAKING fixes as needs-decision and runs doc-syncer two-mode; client-handover applies audit bundles from its main loop behind one gate; init-project/onboard use the 200-file graphify signal and bootstrap memory; release-candidate gates the tag push only; push wording aligned with the BDR-095 hooks; stale pointers fixed (§ Language, .gsd/ROADMAP.md, handover script path, design-gate lists).
bchanot