ci: promote next to main

.claude-plugin/marketplace.json

@@ -78,6 +78,15 @@
       "metadata": {
         "recommended": false
       }
+    },
+    {
+      "name": "aidd-qa",
+      "source": "./plugins/aidd-qa",
+      "description": "Acceptance QA: validates observable behavior against acceptance criteria and records reviewer evidence. Browser is the only supported interface today.",
+      "strict": true,
+      "metadata": {
+        "recommended": false
+      }
     }
   ]
 }

.claude/hooks/check-written-file.js

@@ -0,0 +1,45 @@
+#!/usr/bin/env node
+// PostToolUse hook — checks a file an agent just wrote under `cli/` with the same Biome check
+// pre-commit runs, so a broken rule comes back in the same turn instead of at the next gate.
+//
+// Docs: https://code.claude.com/docs/en/hooks#posttooluse
+//   stdin : JSON { tool_input: { file_path } }
+//   exit 2: the Biome report on stderr, which Claude Code hands back to the agent
+//   exit 0: silence — a clean file, one outside `cli/`, or no Biome installed to ask
+
+const { spawnSync } = require("node:child_process");
+const { existsSync, lstatSync, readFileSync } = require("node:fs");
+const path = require("node:path");
+
+const CLI = path.resolve(__dirname, "..", "..", "cli");
+const WINDOWS = process.platform === "win32";
+const BIOME = path.join(CLI, "node_modules", ".bin", WINDOWS ? "biome.cmd" : "biome");
+const CHECKED = /\.(ts|mts|cts|js|mjs|cjs|json|jsonc)$/;
+
+function writtenFile() {
+  try {
+    return JSON.parse(readFileSync(0, "utf8")).tool_input?.file_path ?? "";
+  } catch {
+    return "";
+  }
+}
+
+function main() {
+  const file = writtenFile();
+  if (file === "" || !CHECKED.test(file) || !existsSync(file) || lstatSync(file).isSymbolicLink()) {
+    return 0;
+  }
+  const relative = path.relative(CLI, path.resolve(file));
+  if (relative.startsWith("..") || path.isAbsolute(relative)) return 0;
+  if (relative.split(path.sep).includes("node_modules") || !existsSync(BIOME)) return 0;
+  const result = spawnSync(BIOME, ["check", "--write", "--no-errors-on-unmatched", "--diagnostic-level=error", relative], {
+    cwd: CLI,
+    encoding: "utf8",
+    shell: WINDOWS,
+  });
+  if (result.status === 0) return 0;
+  process.stderr.write(`${result.stdout}${result.stderr}`);
+  return 2;
+}
+
+process.exitCode = main();

.claude/settings.json

@@ -10,6 +10,18 @@
           }
         ]
       }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": "Edit|Write|MultiEdit",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/hooks/check-written-file.js\"",
+            "timeout": 60
+          }
+        ]
+      }
     ]
   },
   "enabledPlugins": {

.github/rulesets/main.json

@@ -16,6 +16,7 @@
     {
       "type": "pull_request",
       "parameters": {
+        "allowed_merge_methods": ["merge"],
         "required_approving_review_count": 1,
         "dismiss_stale_reviews_on_push": false,
         "require_code_owner_review": true,

.github/workflows/ci.yml

@@ -53,6 +53,9 @@ jobs:
       always() &&
       github.event_name == 'push' &&
       (needs.commitlint.result == 'success' || needs.commitlint.result == 'skipped')
+    # contents: read for the credit step's checkout.
+    permissions:
+      contents: read
     outputs:
       release_created: ${{ steps.release.outputs.release_created }}
       tag_name: ${{ steps.release.outputs.tag_name }}
@@ -75,11 +78,12 @@ jobs:
       # bypass actor. The App token also re-fires the `push: main` and `release: published`
       # workflows a GITHUB_TOKEN merge would not. Guarded on prs_created, since
       # releases_created only fires on merge.
+      # `--merge`: main allows only merge commits. `--body ""`: a PR-title body is parsed as a 2nd commit.
       - name: Auto-merge the Release PR
         if: ${{ steps.release.outputs.prs_created == 'true' }}
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
-        run: gh pr merge "${{ fromJSON(steps.release.outputs.pr).number }}" --squash --admin --repo "${{ github.repository }}"
+        run: gh pr merge "${{ fromJSON(steps.release.outputs.pr).number }}" --merge --admin --body "" --repo "${{ github.repository }}"
 
       # GitHub marks whichever release is created last as "Latest", and release-please
       # creates the umbrella and every plugin release in one unordered run — so a plugin
@@ -91,6 +95,22 @@ jobs:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
         run: gh release edit "${{ steps.release.outputs.tag_name }}" --latest --repo "${{ github.repository }}"
 
+      # Credits commit authors; native `include-commit-authors` is broken (release-please#2761).
+      # Remove with the script once #2892 ships. continue-on-error: never blocks the publish jobs.
+      - name: Checkout
+        if: ${{ steps.release.outputs.releases_created == 'true' }}
+        continue-on-error: true
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Credit contributors on the created release(s)
+        if: ${{ steps.release.outputs.releases_created == 'true' }}
+        continue-on-error: true
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          RELEASE_OUTPUTS: ${{ toJSON(steps.release.outputs) }}
+        run: node scripts/credit-release-authors.cjs "${{ github.repository }}"
+
   build-and-attach:
     name: Build and attach marketplace
     needs: [release-please]
@@ -134,7 +154,7 @@ jobs:
       contents: write
     strategy:
       fail-fast: false
-      # Four marketplace plus five flat — opencode is flat-only. Mirrors the CLI golden
+      # Four marketplace plus six flat — opencode and kilo are flat-only. Mirrors the CLI golden
       # snapshot matrix.
       matrix:
         include:
@@ -147,6 +167,7 @@ jobs:
           - { tool: copilot, mode: flat }
           - { tool: codex, mode: flat }
           - { tool: opencode, mode: flat }
+          - { tool: kilo, mode: flat }
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
@@ -211,6 +232,7 @@ jobs:
             aidd-refine,
             aidd-ui,
             aidd-telemetry,
+            aidd-qa,
           ]
     steps:
       - name: Check if this plugin was released

.github/workflows/cli-ci.yml

@@ -21,14 +21,20 @@ concurrency:
   cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
   changes:
     name: cli / changes
+    permissions:
+      actions: read
+      contents: read
+      pull-requests: read
     runs-on: ubuntu-latest
     outputs:
       relevant: ${{ steps.filter.outputs.relevant }}
+      trusted_promotion: ${{ steps.promotion.outputs.trusted }}
       mutation_scopes: ${{ steps.mutation.outputs.scopes }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -81,25 +87,120 @@ jobs:
 
           echo "relevant=$relevant" >> "$GITHUB_OUTPUT"
 
+      # A promotion branch is a snapshot of next, not the live next branch. Reuse only proves
+      # a tree already gated on next: every missing Git or API proof falls back to mutations.
+      - name: Check whether a promotion snapshot or main merge passed next
+        id: promotion
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          EVENT_NAME: ${{ github.event_name }}
+          GITHUB_REF: ${{ github.ref }}
+          CURRENT_SHA: ${{ github.sha }}
+          BASE_REF: ${{ github.event.pull_request.base.ref }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_REF: ${{ github.event.pull_request.head.ref }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
+        run: |
+          set -euo pipefail
+          trusted=false
+          reason="not a reusable promotion snapshot"
+
+          has_successful_next_gate() {
+            local run_ids run_id gate
+            reason="no successful cli CI push run found for the snapshot SHA"
+            if run_ids="$(gh api --paginate "/repos/$REPO/actions/workflows/cli-ci.yml/runs?branch=next&event=push&status=completed&head_sha=$HEAD_SHA&per_page=100" \
+              --jq '.workflow_runs[] | select(.conclusion == "success") | .id' 2>/dev/null)"; then
+              while IFS= read -r run_id; do
+                [[ -z "$run_id" ]] && continue
+                if gate="$(gh api "/repos/$REPO/actions/runs/$run_id/jobs?filter=latest&per_page=100" \
+                  --jq 'any(.jobs[]; .name == "cli / gate" and .conclusion == "success")' 2>/dev/null)"; then
+                  if [[ "$gate" == "true" ]]; then
+                    reason="reusing the successful cli CI gate from next run $run_id"
+                    return 0
+                  fi
+                  reason="cli / gate did not pass in next run $run_id"
+                else
+                  reason="could not inspect cli CI run $run_id"
+                fi
+              done <<< "$run_ids"
+            else
+              reason="could not list successful cli CI push runs"
+            fi
+            return 1
+          }
+
+          # GitHub tests pull requests at a synthetic merge ref. The source gate may be reused
+          # only if main is already in the snapshot and that merge ref has the same file tree.
+          if [[ "$EVENT_NAME" == "pull_request" && "$BASE_REF" == "main" && "$HEAD_REF" =~ ^promote/next-to-main-[0-9]+$ && "$HEAD_REPO" == "$REPO" ]]; then
+            if ! git merge-base --is-ancestor "$BASE_SHA" "$HEAD_SHA" 2>/dev/null; then
+              reason="main base is not an ancestor of the promotion snapshot"
+            elif ! snapshot_tree="$(git rev-parse "$HEAD_SHA^{tree}" 2>/dev/null)" || ! merge_tree="$(git rev-parse "$CURRENT_SHA^{tree}" 2>/dev/null)"; then
+              reason="could not prove the promotion merge tree"
+            elif [[ "$merge_tree" != "$snapshot_tree" ]]; then
+              reason="promotion merge tree differs from the snapshot"
+            elif has_successful_next_gate; then
+              trusted=true
+            fi
+          # A main push is reusable only for the exact merge of a numbered, same-repository
+          # promotion PR. Parent two is its source snapshot; neither a squash nor an unrelated
+          # merge can satisfy this proof.
+          elif [[ "$EVENT_NAME" == "push" && "$GITHUB_REF" == "refs/heads/main" ]]; then
+            if ! parents="$(git rev-list --parents -n 1 "$CURRENT_SHA" 2>/dev/null)" || ! read -r merge_sha first_parent snapshot_sha extra_parent <<< "$parents" || [[ "$merge_sha" != "$CURRENT_SHA" || -z "$first_parent" || -z "$snapshot_sha" || -n "${extra_parent:-}" ]]; then
+              reason="main commit is not a two-parent merge"
+            elif ! snapshot_tree="$(git rev-parse "$snapshot_sha^{tree}" 2>/dev/null)" || ! main_tree="$(git rev-parse "$CURRENT_SHA^{tree}" 2>/dev/null)"; then
+              reason="could not read the main merge or snapshot tree"
+            elif [[ "$main_tree" != "$snapshot_tree" ]]; then
+              reason="main merge tree differs from the promotion snapshot"
+            elif ! prs="$(gh api "/repos/$REPO/commits/$CURRENT_SHA/pulls" \
+              --jq '.[] | select(.base.ref == "main" and (.head.ref | test("^promote/next-to-main-[0-9]+$")) and .merged_at != null) | [.base.repo.full_name, .head.repo.full_name, .head.ref, .head.sha, .merged_at, .merge_commit_sha] | @tsv' 2>/dev/null)"; then
+              reason="could not inspect pull requests associated with the main commit"
+            else
+              matching_prs=0
+              while IFS=$'\t' read -r base_repo head_repo head_ref pr_head_sha merged_at merge_commit_sha; do
+                if [[ "$base_repo" == "$REPO" && "$head_repo" == "$REPO" && "$head_ref" =~ ^promote/next-to-main-[0-9]+$ && "$pr_head_sha" == "$snapshot_sha" && -n "$merged_at" && "$merge_commit_sha" == "$CURRENT_SHA" ]]; then
+                  ((matching_prs += 1))
+                fi
+              done <<< "$prs"
+
+              if [[ "$matching_prs" -ne 1 ]]; then
+                reason="no unique matching promotion pull request proved this main merge"
+              else
+                HEAD_SHA="$snapshot_sha"
+                if has_successful_next_gate; then
+                  trusted=true
+                fi
+              fi
+            fi
+          fi
+
+          echo "promotion mutation reuse: $reason"
+          echo "trusted=$trusted" >> "$GITHUB_OUTPUT"
+
       - name: Decide which mutation scopes a change can move
         id: mutation
         run: |
           set -euo pipefail
-          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
-            BASE="${{ github.event.pull_request.base.sha }}"
-            HEAD="${{ github.event.pull_request.head.sha }}"
-          else
-            BASE="${{ github.event.before }}"
-            HEAD="${{ github.sha }}"
-          fi
-          if [[ -z "$BASE" || "$BASE" =~ ^0+$ ]]; then
-            changed=""
-            all=true
+          if [[ "${{ steps.promotion.outputs.trusted }}" == "true" ]]; then
+            scopes='[]'
           else
-            changed="$(git diff --name-only "$BASE" "$HEAD")"
-            all=false
+            if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+              BASE="${{ github.event.pull_request.base.sha }}"
+              HEAD="${{ github.event.pull_request.head.sha }}"
+            else
+              BASE="${{ github.event.before }}"
+              HEAD="${{ github.sha }}"
+            fi
+            if [[ -z "$BASE" || "$BASE" =~ ^0+$ ]]; then
+              changed=""
+              all=true
+            else
+              changed="$(git diff --name-only "$BASE" "$HEAD")"
+              all=false
+            fi
+            scopes="$(ALL="$all" CHANGED="$changed" node cli/scripts/mutation-scopes-to-run.mjs)"
           fi
-          scopes="$(ALL="$all" CHANGED="$changed" node cli/scripts/mutation-scopes-to-run.mjs)"
           echo "mutation scopes: $scopes"
           echo "scopes=$scopes" >> "$GITHUB_OUTPUT"
 
@@ -218,6 +319,32 @@ jobs:
       # token and no network. `smoke:full` adds the remote-fetch section on demand.
       - run: cd cli && pnpm smoke
 
+  cli-kilo-runtime:
+    name: cli / Kilo runtime smoke
+    needs: [changes]
+    if: needs.changes.outputs.relevant == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install pnpm
+        run: corepack enable
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: "22"
+      - name: Cache pnpm store
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ~/.local/share/pnpm/store
+          key: pnpm-${{ runner.os }}-${{ hashFiles('cli/pnpm-lock.yaml') }}
+          restore-keys: pnpm-${{ runner.os }}-
+      - run: cd cli && pnpm install --frozen-lockfile
+      # The test starts Kilo's local server and asks it to load the generated project plugin.
+      # No model or account is needed for this protocol-level smoke.
+      - name: Install Kilo Code CLI
+        run: npm install -g @kilocode/cli@7.7.5
+      - run: cd cli && pnpm test:e2e:kilo
+
   cli-build:
     name: cli / Build & Bundle Budget
     needs: [changes]
@@ -490,6 +617,7 @@ jobs:
       - cli-architecture
       - cli-coverage
       - cli-smoke
+      - cli-kilo-runtime
       - cli-build
       - cli-knip
       - identifier-join
@@ -510,6 +638,7 @@ jobs:
             "${{ needs.cli-architecture.result }}" \
             "${{ needs.cli-coverage.result }}" \
             "${{ needs.cli-smoke.result }}" \
+            "${{ needs.cli-kilo-runtime.result }}" \
             "${{ needs.cli-build.result }}" \
             "${{ needs.cli-knip.result }}" \
             "${{ needs.identifier-join.result }}" \

.github/workflows/codeql.yml

@@ -30,15 +30,15 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
         with:
           languages: ${{ matrix.language }}
           queries: security-and-quality
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        uses: github/codeql-action/autobuild@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/promote.yml

@@ -67,8 +67,9 @@ jobs:
 
           # `ci:` on purpose: the type is absent from release-please's changelog-sections,
           # so this plumbing commit never surfaces in a changelog, and commitlint accepts it.
+          # `--body ""`: keeps the PR title out of the merge body, which release-please would re-parse.
           gh pr merge "$PR" --repo "$REPO" --merge --auto --delete-branch \
-            --subject "ci: promote next to main (#${PR})"
+            --subject "ci: promote next to main (#${PR})" --body ""
 
           # Without a recorded subject GitHub generates one that is not conventional, and
           # commitlint lints main's tip on push.