chore: promote next to main

.claude-plugin/marketplace.json

@@ -31,7 +31,7 @@
     {
       "name": "aidd-pm",
       "source": "./plugins/aidd-pm",
-      "description": "Product management: ticket-info, user-stories, prd, spec",
+      "description": "Product management: ticket-info, user-stories, product-brief, prd, spec, spike",
       "strict": true,
       "recommended": true
     },

.github/CODEOWNERS

@@ -1,5 +1,5 @@
 # Default reviewers for every change in this repository.
 # GitHub assigns these reviewers automatically when a pull request is opened.
-# Only Habilité AIDD maintainers can approve and merge - see GOVERNANCE.md.
+# Only AIDD Maintainers can approve and merge - see GOVERNANCE.md.
 # See https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
-*       @ai-driven-dev/habilitated
+*       @ai-driven-dev/trusted-partners

.github/ISSUE_TEMPLATE/config.yml

@@ -6,9 +6,3 @@ contact_links:
   - name: Discord community
     url: https://discord.gg/EWySJSpjWs
     about: Ask questions, get help, or chat with the AI-Driven Dev community in real time.
-  - name: Website
-    url: https://www.ai-driven-dev.fr/
-    about: Read the AI-Driven Dev methodology, guides, and announcements.
-  - name: Report a security vulnerability
-    url: https://github.com/ai-driven-dev/framework/security/advisories/new
-    about: Disclose a vulnerability privately via GitHub Security Advisories. Do not open a public issue.

.github/ISSUE_TEMPLATE/roadmap.yml → .github/ISSUE_TEMPLATE/detailed_contribution.yml

@@ -1,13 +1,13 @@
-name: 🗺️ Roadmap item
-description: "Maintainer-authored work: a skill, a refactor, a rule to enforce"
+name: 📋 Detailed Contribution
+description: "Propose a scoped change: a skill, a refactor, a rule to enforce"
 title: "<type>(<scope>): "
 type: Task
 body:
   - type: markdown
     attributes:
       value: |
-        For maintainers planning framework work. Reporting a bug or asking for a feature as a user?
-        Use the **Bug Report** or **Feature Request** form instead.
+        Issue-first: a maintainer validates this before any PR is opened (see [CONTRIBUTING.md](https://github.com/ai-driven-dev/framework/blob/main/CONTRIBUTING.md)).
+        Reporting a bug? Use the **Bug Report** form instead.
 
         The title carries its own scope, matching `commitlint.config.cjs`: `feat(aidd-pm):`, `fix(framework):`, `refactor(aidd-context):`.
   - type: textarea

.github/ISSUE_TEMPLATE/feature_request.yml → .github/ISSUE_TEMPLATE/quick_contribution.yml

@@ -1,14 +1,13 @@
-name: ✨ Feature Request
-description: Propose new content or an improvement to the framework
+name: 🌱 Quick Contribution
+description: Propose a change or new content for the framework, minimal form
 title: "feat(<scope>): "
 type: Feature
 body:
   - type: markdown
     attributes:
       value: |
-        Have an idea? You can also post and upvote it in
-        [Discussions](https://github.com/ai-driven-dev/framework/discussions) -
-        popular ideas get promoted to a roadmap vote (see [ROADMAP.md](https://github.com/ai-driven-dev/framework/blob/main/ROADMAP.md)).
+        Issue-first: a maintainer validates this before any PR is opened (see [CONTRIBUTING.md](https://github.com/ai-driven-dev/framework/blob/main/CONTRIBUTING.md)).
+        Want to discuss an idea first? Post it in [Discussions](https://github.com/ai-driven-dev/framework/discussions).
   - type: textarea
     id: problem
     attributes:

.github/workflows/back-merge.yml

@@ -28,7 +28,7 @@ jobs:
           app-id: ${{ secrets.AIDD_BOT_APP_ID }}
           private-key: ${{ secrets.AIDD_BOT_PRIVATE_KEY }}
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: next
           fetch-depth: 0
@@ -58,6 +58,10 @@ jobs:
             BRANCH="back-merge/main-to-next-${{ github.run_id }}"
             git checkout -b "$BRANCH" origin/main
             git push origin "$BRANCH"
+            # promote.yml matches this exact title prefix to recognize a
+            # squash-merged conflict resolution as a sync boundary (this repo
+            # disallows merge-commit PRs, so this can't land as a real merge
+            # commit). Keep both in sync if you change it.
             gh pr create --base next --head "$BRANCH" \
               --title "chore: back-merge main into next (conflicts)" \
               --body "Automated back-merge hit conflicts (CHANGELOG / manifest / version files). Resolve manually, then merge into next." \

.github/workflows/ci.yml

@@ -24,7 +24,7 @@ jobs:
       contents: read
       pull-requests: read
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - uses: wagoid/commitlint-github-action@b948419dd99f3fd78a6548d48f94e3df7f6bf3ed # v6.2.1
@@ -112,7 +112,7 @@ jobs:
     if: needs.release-please.outputs.release_created == 'true'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Build clean marketplace bundle
         # A self-contained marketplace a user can extract and register with
@@ -159,9 +159,9 @@ jobs:
           - { tool: codex, mode: flat, flag: "--flat" }
           - { tool: opencode, mode: flat, flag: "--flat" }
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
 
@@ -211,7 +211,7 @@ jobs:
             echo "released=false" >> $GITHUB_OUTPUT
           fi
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         if: steps.check.outputs.released == 'true'
 
       - name: Get plugin version
@@ -248,12 +248,12 @@ jobs:
     if: needs.release-please.outputs.paths_released != '' && contains(fromJSON(needs.release-please.outputs.paths_released), 'cli')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install pnpm
         run: |
           corepack enable
           corepack prepare pnpm@latest --activate
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
       - run: cd cli && pnpm install --frozen-lockfile
@@ -274,7 +274,7 @@ jobs:
       # `npm publish`, not `pnpm publish`: pnpm's OIDC support is unverified/
       # buggy as of this writing (pnpm/pnpm#9812, #11513) — npm's own CLI is
       # the reference implementation for its own feature.
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
           registry-url: "https://registry.npmjs.org"

.github/workflows/cli-ci.yml

@@ -24,12 +24,12 @@ jobs:
     name: cli / Typecheck
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install pnpm
         run: |
           corepack enable
           corepack prepare pnpm@latest --activate
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
       - run: cd cli && pnpm install --frozen-lockfile
@@ -39,12 +39,12 @@ jobs:
     name: cli / Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install pnpm
         run: |
           corepack enable
           corepack prepare pnpm@latest --activate
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
       - run: cd cli && pnpm install --frozen-lockfile
@@ -54,14 +54,14 @@ jobs:
     name: cli / Test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install expect (TTY persona tests)
         run: sudo apt-get update && sudo apt-get install -y expect
       - name: Install pnpm
         run: |
           corepack enable
           corepack prepare pnpm@latest --activate
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
       - run: cd cli && pnpm install --frozen-lockfile
@@ -71,12 +71,12 @@ jobs:
     name: cli / Build & Bundle Budget
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install pnpm
         run: |
           corepack enable
           corepack prepare pnpm@latest --activate
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
       - run: cd cli && pnpm install --frozen-lockfile
@@ -87,12 +87,12 @@ jobs:
     runs-on: ubuntu-latest
     continue-on-error: true
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install pnpm
         run: |
           corepack enable
           corepack prepare pnpm@latest --activate
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
       - run: cd cli && pnpm install --frozen-lockfile
@@ -103,12 +103,12 @@ jobs:
     runs-on: ubuntu-latest
     continue-on-error: true
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install pnpm
         run: |
           corepack enable
           corepack prepare pnpm@latest --activate
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
       - run: cd cli && pnpm install --frozen-lockfile

.github/workflows/codeql.yml

@@ -28,18 +28,18 @@ jobs:
         language: [javascript-typescript]
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
         with:
           languages: ${{ matrix.language }}
           queries: security-and-quality
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
+        uses: github/codeql-action/autobuild@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
+        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/promote.yml

@@ -30,7 +30,7 @@ jobs:
           app-id: ${{ secrets.AIDD_BOT_APP_ID }}
           private-key: ${{ secrets.AIDD_BOT_PRIVATE_KEY }}
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           token: ${{ steps.app-token.outputs.token }}
@@ -50,14 +50,42 @@ jobs:
           BRANCH="promote/next-to-main-linear"
           git switch -C "$BRANCH" origin/main
 
-          mapfile -t MERGES < <(git rev-list --first-parent --merges --reverse origin/main..origin/next)
-          if [ "${#MERGES[@]}" -ge 2 ]; then
-            START="${MERGES[$((${#MERGES[@]} - 2))]}"
+          # A "sync commit" marks a point where main's history was already
+          # folded into next by back-merge.yml, so it (and everything before
+          # it) must NOT be replayed onto main again. back-merge.yml lands a
+          # sync two ways:
+          #   - no conflicts: a direct-pushed real merge commit (2 parents)
+          #   - conflicts: a PR merged by squash (this repo disallows
+          #     merge-commit PRs), whose subject is stamped verbatim from
+          #     back-merge.yml's fixed PR title
+          # Both must count as boundaries, or a squash sync gets mistaken for
+          # genuine next-only work and cherry-picked back onto main, colliding
+          # with content main already has. Keep the title prefix below in
+          # sync with back-merge.yml's `gh pr create --title`.
+          is_sync_commit() {
+            git rev-parse --verify -q "$1^2" >/dev/null 2>&1 && return 0
+            local subject
+            subject="$(git log -1 --format=%s "$1")"
+            [[ "$subject" == "chore: back-merge main into next"* ]]
+          }
+
+          mapfile -t CANDIDATES < <(git rev-list --first-parent --reverse origin/main..origin/next)
+          SYNCS=()
+          for c in "${CANDIDATES[@]}"; do
+            is_sync_commit "$c" && SYNCS+=("$c")
+          done
+
+          if [ "${#SYNCS[@]}" -ge 2 ]; then
+            START="${SYNCS[$((${#SYNCS[@]} - 2))]}"
           else
             START="origin/main"
           fi
 
-          mapfile -t COMMITS < <(git rev-list --first-parent --reverse --no-merges "${START}..origin/next")
+          COMMITS=()
+          while IFS= read -r c; do
+            is_sync_commit "$c" || COMMITS+=("$c")
+          done < <(git rev-list --first-parent --reverse "${START}..origin/next")
+
           if [ "${#COMMITS[@]}" -eq 0 ]; then
             echo "No commits to promote."
             exit 0

.github/workflows/validate.yml

@@ -22,10 +22,10 @@ jobs:
       CI: "true"
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"