PR Workflow

Deliver an authorized change as a PR on sbluemin/fleet-harness. Start new changes at commit/publication, open PRs at review, and review-complete PRs at final audit. Do not repeat completed phases ceremonially.

Scope and authority

Run for the standing PR-to-canary delivery authorization in the root CLAUDE.md, or when the user requests this lifecycle or explicitly authorizes publication/merge. The standing authorization is sufficient; do not request a new publication/merge decision per Objective. Honor local-only requests, explicit stops, and narrower delivery scopes. Automatic skill loading alone grants no authority. Do not ask again between ordinary steps within an authorized full lifecycle.

Defaults: base canary, merge squash, auto_merge=true. The base is always canary: the PR Target Guard workflow closes every pull request aimed elsewhere, and a request to target main/master belongs to release-version-update, not a PR. Reject head=base. With auto_merge=false, stop at review completion and preserve branch/worktree. Read Inputs when options need resolving.

Phase-specific loading

Core contracts

• Confirm head worktree/branch/PR identity and stage only relevant files. Use English Conventional Commits without amend or hook bypass, including commits an Objective's Commander or member makes directly. Run checks for affected workspaces and disclose unavailable/unrun scripts; diagnose a GitHub API failure or limit only with read requests (GET, gh api rate_limit), never a comment or other write.
• Write changelogs only for feature-level product changes. .changelog.d/CLAUDE.md owns the authoring contract. A new branch fragment and amendment of an existing unreleased fragment are mutually exclusive. Do not add unnecessary fragments or no-changelog declarations for docs/prompts.
• When the diff deletes, rewrites, or adds beside existing text in any CLAUDE.md, docs/**, or .claude/skills/**, read each such fragment in git diff --word-diff origin/canary...HEAD after a fetch, before creating the PR and again at the final audit. For each, name where its meaning still stands and check for losses no link or skill validator detects: a referent such as "that skill" separated from the sentence or bullet that named it; an enumerated condition, example, or clause deleted as a duplicate with no surviving copy; an existing step still bound to its old trigger after the change added another path to the same outcome. Record each verdict in the PR Test Plan; restore a fragment with no surviving location or justify its removal there.
• Before the first review fix, freeze the Product Context Record and pushed REVIEW_BASE_HEAD: request, acceptance criteria, exclusions, trade-offs, supported behavior, decision evidence. If these cannot be reconstructed on resume, stop edits/merge.
• Review is a hypothesis, not authority. FIX requires a reproduced supported path, original scope alignment, preserved supported functionality, and proportional value. Do not make unreproduced defensive fixes. Post evidence-backed DECLINE / DEFER dispositions too; ask only when product intent is genuinely unresolved.
• After every pass and before merge, audit the cumulative review-fix diff against frozen context. Revert only review-induced drift while preserving later user-directed changes. The reviewer cannot expand product scope.

Waiting and termination

For an Objective with completed measured verification, default to skipping Codex under the measured-verification route, without another human confirmation. Record REVIEW_BYPASS_REASON=measured_verification and its evidence; this is not Codex approval or a waiver of the final audit, required checks, or the review-fix re-check gate.

Otherwise, when no activation signal (Review wait step 1) exists yet, apply Codex request authority, then explicitly request review when authorized and check for a default 60 seconds. Still no activation signal becomes codex_activation_timeout and may proceed through normal merge gates, but is not approval and never bypasses required checks.

Use signal-driven background waiting. Launch a wait (the review poll or a CI watch) as late in its turn as you can, after any progress report such as an objective member's report to its Commander. A wait that ends while its turn is still running is folded into that turn instead of starting a new one, so before ending any turn that launched a wait, read the wait's output file and act on any signal already there. Do not treat stale +1, eyes, or re-anchored inline comments as fresh approval/feedback. A usage-limit notice means that request is not shown to have produced a review; it does not mean no review ever ran, and it does not approve the head; classify it as Review wait describes and record codex_usage_limit. End the review loop on a pass with no FIX findings, with a default maximum of 3 passes. Continuing requires a named reproduced defect. Disclose timeouts, omissions, and failures.

Merge and delivery

Record FINAL_AUDIT_BASE; check base advancement and PR-file overlap again immediately before merging. Conflicts or overlapping advancement require head integration through rebase-on-canary, validation, and head-only --force-with-lease, then repeated audit/remote checks. Do not rewrite history in the ordinary path.

Merge also requires the re-check evidence when the gate in Merge and cleanup applies. Inside an objective, line up that gate's independent re-checker as soon as a review FIX commit or codex_usage_limit appears: a member that wrote none of the changes in scope, enlisted by the Commander when none exists. Ask for its record in English, the PR comment language, so the verbatim post needs no translation. Merge only through gh pr merge. Never use --admin, protected-branch direct pushes, or required-check bypasses. Green PR checks do not cover jobs that run only on a canary push: cover them locally before merge, and after merge watch the merge commit's canary runs to completion, as Merge and cleanup describes. Confirm actual MERGED state before cleaning the owned head worktree through git-worktree. Preserve draft/blocked/unmerged work.

Report PR URL/head/base, frozen SHAs/final audit, FIX/DECLINE/DEFER, commits/push targets, validation, review termination basis, merge SHA or unmerged reason, stopped waits, and cleanup. The host owns title/body/changelog/final-report synthesis.