refactor(git-agent): split tracker mechanics into generated GitHub references

CHANGELOG.md

@@ -9,7 +9,23 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
-- **The Git agent is now compiled from an MDS generator host** — before: `src/assets/agents/git.md` was a hand-authored file the installer copied verbatim; the build owned command files only. After: `src/assets/agents/git.mds` declares `output-dir: dist/agents` in a leading steering block and compiles to `dist/agents/git.md`, which is byte-identical to the file it replaces (66,180 bytes, unchanged SHA-256). Both agent readers take their directory order from one owner, `agentSourceDirs()` in `src/core/assets.ts` — `dist/agents/`, then `src/assets/agents/`. The installer resolves each declared agent against that list and copies the first hit, throwing with both candidate paths and `npm run build:mds` named when neither directory has it; `loadShippedDefaults()` walks the same list first-wins and warns through its `onWarning` channel when a registry-declared agent has no shipped default in either. The compiled artifact wins for a generated agent and the other 15 agents install exactly as before. The 13 compiled command outputs in `dist/commands/` are byte-unchanged, and the hand-authored `release.md` beside them is untouched — 14 deployed command files in all. Zero user-visible change.
+- **The Git agent's GitHub mechanics now live in generated skill references** — before: `git.md` was 65,677 characters re-sent on every Git spawn, roughly 9,400 of them GitHub-specific mechanics (`gh` invocations, header names, rate-limit thresholds) interleaved with the provider-independent contract — each operation's `**Input:**`, `**Output:**` template and `**Degradation (D4):**` clause. There was no single place a tracker provider was resolved, so a provider token would have had to be threaded through roughly thirty filename-composition sinks. After: the compiled agent is 55,664 characters (56,075 bytes), against the `BUDGET_GIT_MD` ceiling of 55,750 characters that `tests/tracker/byte-budget.test.ts` asserts on every run — the ceiling is the number that must hold; the measurement is what it holds against today. A ≤40-line provider-resolution preamble resolves the provider **once per spawn** and states the **one** load instruction that composes a mechanics path; thirteen generated references carry what moved — ten per-operation GitHub files under `references/tracker/github/`, plus `learn-conventions.md`, `publication-gate.md` and `decision-markers.md`. Every move is byte-identical unless it is one of 63 named, individually justified exemptions, and a containment oracle compares the pre-split tree against the post-split one line by line to prove it — over the whole branch diff, 150 of the 160 content lines the golden lost are byte-present elsewhere in the loadable set and the remaining 10 fall inside a named exemption range, with none unaccounted. Zero user-visible change: `Tracked = #{n}`, `Depends on: #{n}`, `42-jwt-auth.{ts}.md` and `issue: 42` all render exactly as before. This entry is an internal refactor — it adds no new prompt and no new file to any user's project tree.
+
+- **The D4 and D11 cross-cutting contracts are provider-independent in fact, not only in claim** — before: the always-loaded degradation contract named `gh` as the thing that can be unauthenticated and stated GitHub's own rate-limit signals (a 403/429 body, `X-RateLimit-Remaining < 10`, the `< 50` backpressure rung) in the same sentences as the provider-independent STOP/THROTTLED rules; the comment-sink scrub said it applied to bodies posted "to GitHub". Two authorities on the redaction path. After: the invariants stay inline and unchanged — the scrub is still unconditional, still fail-closed, still `&&` and never a pipeline, and the scrubber invocation itself is never made loadable — while the cross-cutting blocks themselves name no provider. D11's shell recipe now posts through a `<the resolved provider's post command>` placeholder that the operation's own generated reference resolves. D4's GitHub-specific detail — the 403/429 rate-limit body, the `X-RateLimit-Remaining < 10` STOP threshold and the `< 50` backpressure rung — left the cross-cutting block entirely and is *explained* once, in the GitHub reference of `backlink-shipped-issues`, the operation that owns the fan-out. It is not *stated* only there, and deliberately so: `skills/git/SKILL.md` is preloaded on every Git spawn and keeps the `< 10` STOP threshold, which is the mitigation that makes the move safe, and each fan-out operation's own `**Degradation (D4):**` clause still names the signal it acts on inline beside the `THROTTLED` report it triggers — in the agent and in the generated references alike. A threshold an agent must recognise before it acts is worth restating at the point of use; a header name, a status code and a shell command are not.
+
+- **`skills/git/SKILL.md` no longer contradicts the agent it is preloaded with** — before: 9,205 characters preloaded on every Git spawn, carrying two live safety contradictions — `if [ "$REMAINING" -lt 10 ]; then sleep 60; fi`, which tells the agent to wait out exactly the secondary rate limit D4 tells it to STOP for (waiting extends the provider's penalty window), and `gh release create … --notes "$NOTES"`, an inline-body recipe where the release operation mandates `--notes-file` after a scrub whose failure is a hard stop. Both were invisible to every guard. After: 6,581 characters, both contradictions removed, and the inline-body guard widened to see `gh release … --notes` and rescoped to the skill files. Three `sleep 60` sites in all — the third in `references/github-api.md` — are gone.
+
+- **Every shipped recipe that posts a body posts the scrubber's output** — before: sixteen recipes across `references/github-api.md`, `references/patterns.md`, the generated tracker references and the review-methodology skill built a body inline — `--body "$(cat <<'EOF' …)"`, `-f body="$BODY"`, `--notes "$changelog"`, `--notes-file CHANGELOG.md` — so the text reached GitHub without passing `redact-secrets.cjs` at all, in the same files that tell an agent the scrub is unconditional. After: each one composes to `$DEVFLOW_BODY_RAW` (release notes to `$DEVFLOW_NOTES_RAW`, or `CHANGELOG.md` read as raw input), runs the scrubber, and posts the scrubbed file through `--body-file` / `-F body=@` / `--notes-file`, chained with `&&` so a non-zero scrubber exit means the post does not happen. The tech-debt archive closes its predecessor with **no comment body**: before, it closed with a `--comment` placeholder reading `(see linked issue)` and then posted the real number in a second comment; after, it creates the successor first and posts one scrubbed archive comment carrying that number, so the close is a close. Reviews write reports and only the Git agent publishes — the review-methodology skill's own comment-creation recipe is replaced by a pointer to `post-review-summary`, where the repo-visibility gate (D10) and the comment-sink scrub (D11) already live, so there is one publication path instead of two. The inline-body guard that polices this folds shell line-continuations before matching (a `--body` four lines below its `gh` verb is one command, not four lines), names its five posting shapes separately so each is proven live by its own known-bad probe, and scans **every installed agent, command, rule and skill** rather than the Git agent's own neighbourhood; the pre-split baseline tree is kept as a permanent known-bad corpus so the widening is proven against text that really did post unscrubbed bodies. Two `gh … --json number` flags that neither `gh issue create` nor `gh pr create` accepts are replaced by deriving the number from the URL each command prints. Every recipe renders the same text it always did; what changes is what reaches the tracker when a body carries a secret — before, a shipped recipe posted it, and after, the post does not happen (#340, #341).
+
+- **The installer converges the generated references rather than merging into them** — before: nothing installed generated skill references, because none existed. After: `devflow init` overlays them onto the installed `devflow:git` skill directory with a **converge-not-merge** contract — a shadow-supplied file under `references/tracker/**` that the build manifest does not name is removed, and a shadowed `devflow:git` still receives the canonical GitHub references. The swap is **atomic per unit**: each provider directory (and the flat cross-cutting set) is built under a `.tmp` sibling and promoted by rename, so a per-file failure aborts that unit and leaves the previously installed files byte-unchanged instead of promoting a partial tree. Two new install-time failure modes come with it, both reported rather than silent: a unit that could not be refreshed is named in the install summary (`Could not refresh the generated references for "{provider}" …`), and a **declared reference missing from the build** fails loudly with a `npm run build:mds` hint rather than installing an agent instructed to read a file that is not there.
+
+- **The command layer speaks one issue-reference vocabulary** — before: five command hosts each carried their own inline `#N` parsing rule, and the design-artifact naming convention used a `{issue}` placeholder. After: one partial, `_partials/_tracker.mds`, states the grammar and the capture contract once and is imported by `plan`, `implement`, `debug`, `dynamic-build` and `dynamic-plan`; the placeholder vocabulary is `{ISSUE_REF}` (the rendered reference) and `{ISSUE_ID}` (the filesystem-safe form), each site also stating its GitHub rendering so the rendered bytes are pinned. `ISSUE_NUMBER` is kept at all fourteen Code-agent spawn sites. Commands no longer restate a dedup marker literal — the operation owns its marker.
+
+- **Byte budgets for the Git spawn are now constants with derivations, asserted as a four-shape table** — `chars(dist/agents/git.md) ≤ 55,750`, `chars(skills/git/SKILL.md) ≤ 6,600`, and the worst-case tracker spawn's loaded set `≤ 77,824` characters (the pre-split preloaded set, so the split cannot be "satisfied" while the total gets worse). The formula counts every reference a single operation's load instructions can name, checked bidirectionally against what the compiled agent can actually name, and the four candidate file shapes are recorded as computed rows so the shape decision is not re-litigated from memory.
+
+- **`tests/fixtures/golden/github-status-lines.txt` was re-captured twice** — the frozen fixture samples prompt-internal process steps, which is precisely the text this refactor relocates. The first re-capture followed the D4 invariant/detector cut, which split two of its sampled sentences, so preserving the fixture and making the split were mutually exclusive; the second followed the review-wave condensing of the `**Mechanics:**` pointer lines it samples, and moved only the two byte-count lines that shift when the agent is regenerated. Each was a single fixture-only commit under its own explicit authorisation, and the fixture is frozen again from the second. The four user-visible byte-identity claims have their own assertions and are untouched.
+
+- **The Git agent is now compiled from an MDS generator host** — before: `src/assets/agents/git.md` was a hand-authored file the installer copied verbatim; the build owned command files only. After: `src/assets/agents/git.mds` declares `output-dir: dist/agents` in a leading steering block and compiles to `dist/agents/git.md`, which was byte-identical to the hand-authored file it replaced at the conversion (66,180 bytes, unchanged SHA-256); the contract/mechanics split is what changes its size. Both agent readers take their directory order from one owner, `agentSourceDirs()` in `src/core/assets.ts` — `dist/agents/`, then `src/assets/agents/`. The installer resolves each declared agent against that list and copies the first hit, throwing with both candidate paths and `npm run build:mds` named when neither directory has it; `loadShippedDefaults()` walks the same list first-wins and warns through its `onWarning` channel when a registry-declared agent has no shipped default in either. The compiled artifact wins for a generated agent and the other 15 agents install exactly as before. The 13 compiled command outputs in `dist/commands/` are byte-unchanged, and the hand-authored `release.md` beside them is untouched — 14 deployed command files in all. Zero user-visible change.
 
 - **`npm run build:cli` alone no longer produces installable agents** — before: `build:cli` (TypeScript) plus the shipped `src/assets/agents/*.md` were enough to install every agent. After: an agent authored as a generator host exists only as a `.mds` source until `npm run build:mds` compiles it, so a publish or install path that runs `build:cli` alone would ship without a Git agent. `npm run build` runs both and is unchanged; the packaging and pack-install guards now fail loudly if the compiled agent is missing from the tarball.
 
@@ -19,6 +35,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- **Shipped recipes posted bodies the scrubber had never seen** (#340, #341) — before: sixteen recipes across `references/github-api.md`, `references/patterns.md`, the generated tracker references and the review-methodology skill composed a body inline and handed it straight to `gh`, so an agent following the shipped text reached the tracker without `redact-secrets.cjs` running at all — in the same files that tell it the scrub is unconditional. The tech-debt archive was the same defect in a second shape: it closed its predecessor with a `--comment` placeholder and posted the real number in a separately-composed follow-up. After: each one composes to `$DEVFLOW_BODY_RAW` (release notes to `$DEVFLOW_NOTES_RAW`), runs the scrubber, and posts the scrubbed file through `--body-file` / `-F body=@` / `--notes-file`, `&&`-chained so a non-zero scrubber exit means the post does not happen. This sink has no erasure path — a comment lands at the repository's visibility, GitHub keeps edit history, and notifications have already fired — so anything that got through had to be answered by rotating the credential, not by editing the comment. The **Changed** entry above carries the full inventory and the guard that now polices it.
+
 - **`/debug #42` wrong Git-op spawn key** — before: `debug.mds` passed `ISSUE: {issue number}` to the `fetch-issue` Git operation, which declares `ISSUE_INPUT:`; the key mismatch meant no issue was ever fetched. After: `debug.mds` passes `ISSUE_INPUT: {issue reference}` — the key the op declares. (AC-0.1)
 
 - **`/plan` with issue references: issue body never fetched** — before: `/plan #42` parsed the issue reference but never retrieved it; the design was built without the issue content. After: `/plan #42` spawns the Git agent with `OPERATION: fetch-issue`; `/plan #12 #15 #18` uses `OPERATION: fetch-issues-batch` (≤50 issues, `TRUNCATED ({n} not processed)` beyond the cap). (AC-0.3)