feat(governance): harden governance rules, hook guards, and CI pipeline for epic branching

🎯 Context & User Stories (P1 — Product Planner)

Context & Problem Statement

With scripts/seal-issue.sh and scripts/sync-project-metadata.mjs established in Child 1, and templates purged of narrative metadata in Child 2, the delivery kernel now requires authoritative rule hardening and runtime safeguards:

1. Rule Ambiguity: Current governance documents (AGENTS.md, agent-lifecycle.md, backlog-planner.md, git-workflow.md) describe the legacy upfront issue creation and Trunk-Only merge models.
2. Hook Protection Gaps: Local hooks (branch-guard.mjs, plan-guard.mjs, pre-invocation-anchor.sh) only protect main and lack awareness of epic/** integration branches.
3. CI Diff Distortion: delivery-pipeline.yml compares PR diffs statically against origin/main...HEAD, producing distorted diff sets for PRs targeting epic/**.
4. Post-Merge Desynchronization: post-merge-dual-sync.sh lacks target base branch detection, leaving working trees on main instead of the Epic integration branch.
5. Metadata Sync Robustness: GraphQL mutations for single-select options in sync-project-metadata.mjs require raw string inlining to avoid GitHub CLI type coercion issues.

User Story 1 (Developer / System Orchestrator)

Feature: Autonomous Governance & Epic Isolation
  As a System Orchestrator and Engineer on the Agentic Android Delivery Kernel
  I want governance rules, personas, and skills to enforce Just-In-Time sealing and Epic branch isolation
  So that specifications remain immutable, project metadata is natively maintained, and epics land atomically without polluting trunk CI.

User Story 2 (CI Engine & Airbag)

Feature: Dynamic Diff & Integration Safeguards
  As the Delivery CI Engine and Local Git Airbag
  I want CI diffs and hook checks to evaluate against the dynamic base branch (${{ github.base_ref }})
  So that intermediate child PRs are inspected strictly for their own delta while protecting epic integration branches from direct mutation.

Access & Operational Matrix

Pillar 1 · Design Spec (P2 — Design Lead)

Conditional Design Gate: N/A — No visual/UI changes
Pure governance, rule consolidation, hook safeguards, and CI/CD automation. No @Composable, UI tokens, or visual layouts are modified.

Pillar 2 · Data & Privacy Spec (P3 — Privacy & Data Lead)

• Zero-PII Compliance: No end-user data or credentials handled.
• Audit Logging: Local hook rejections emit structured console alerts with rule violation IDs ([Rule 0 Violation S-04], [Rule 0.1 Violation E-01]).
• Telemetry Taxonomy: No runtime analytics events emitted.

Pillar 3 · Technical Architecture & System Implementation (P4 — System Architect)

1. Governance Rules & Persona Alignment

• AGENTS.md & agent.md:
  • Update Phase 1 state machine to reflect local Inception $\to$ Gate 1.4 Approval $\to$ JIT Sealing via scripts/seal-issue.sh.
  • Formalize Rule 0 (JIT Issue-First) and Rule 0.1 (Epic Branch Isolation Protocol).
  • Update Sequential Persona State Machine diagram.
• .agent/rules/backlog-planner.md:
  • Document JIT Sealing lifecycle and sequential child decomposition DAG.
  • Detail native GitHub Projects v2 field separation (Priority, Size, Estimate, Status).
  • Maintain strict byte budget under 9,500 bytes.
• .agent/rules/agent-lifecycle.md:
  • Update 3-Phase Lifecycle with JIT Sealing at Gate 1.4.
  • Formalize estimation consolidation in Pillar 3 before scellement.
• .agent/rules/git-workflow.md:
  • Document epic/issue-<id>-<slug> branching convention.
  • Specify child PR base targeting (--base epic/...) and final consolidated squash merge to main.
• .agent/personas/p1-product-planner.md & .agent/personas/p4-system-architect.md:
  • Clarify sizing ownership and collaborative estimation in Pillar 3.
• .agent/skills/plan-issue/SKILL.md & .agent/skills/open-pr/SKILL.md:
  • Adapt recipes for JIT sealing execution and dynamic PR base targeting.

2. Local Hooks & Automation Safeguards

• .agent/hooks/branch-guard.mjs:
  • Add epic/* pattern to blocked write branches (getBlockedBranches()).
  • Prevent direct file modification on epic/** without a dedicated child feature branch.
• .agent/hooks/plan-guard.mjs:
  • Block direct commits and merges on epic/* while permitting branch creation and initial upstream tracking push.
• .agent/hooks/post-merge-dual-sync.sh:
  • Dynamically detect base branch: TARGET_BASE=$(gh pr view "$PR_NUMBER" --json baseRefName --jq '.baseRefName' 2>/dev/null || echo "main").
  • Automatically check out and pull TARGET_BASE upon merge, deleting the merged child branch locally and remotely.
• .agent/hooks/pre-invocation-anchor.sh:
  • Distinguish between leaf feature branches and epic/* integration branches, suppressing the blocking PR review reminder on integration branches during child inception.
• scripts/sync-project-metadata.mjs:
  • Update updateSelect to use direct query interpolation for singleSelectOptionId: "${opt.id}" (eliminating gh api graphql String! parsing errors).

3. CI/CD Dynamic Diffing (.github/workflows/delivery-pipeline.yml)

• Update PR trigger to include epic/**:

  pull_request:
    branches: [main, 'epic/**']

• Replace static origin/main...HEAD diffing with dynamic base reference:

  BASE_REF="${{ github.base_ref || 'main' }}"
  CHANGED_FILES=$(git diff --name-only "origin/${BASE_REF}...HEAD")

Pillar 4 · Release Engineering & Verification Plan (P6 — Release Manager)

Quality Airbag & Verification Table

Definition of Done (Child Task 3)

• All 13 governance files and hooks updated and verified.
• All documentation contracts strictly comply with byte budget caps.
• ./scripts/quality-check.sh and ./scripts/validate-docs.sh pass cleanly.
• PR opened targeting epic/issue-12-jit-sealing-epic-protocol with skip-release.
• Gate 3.5 halt observed before squash-merging into the Epic branch.