feat(safety): add board approval scope section

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.mcp.json

@@ -1,11 +0,0 @@
-{
-  "mcpServers": {
-    "gitea": {
-      "type": "http",
-      "url": "https://git-mcp.farh.net/mcp",
-      "headers": {
-        "Authorization": "Bearer ${GITEA_TOKEN}"
-      }
-    }
-  }
-}

CLAUDE.md

@@ -1,27 +0,0 @@
-# CLAUDE.md
-
-This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
-
-## Repository Purpose
-
-This is the GroomBook **agent skills repository** — it contains skill definitions that govern how AI agents operate within the GroomBook organization. The `skills/` directory holds three skill files: `coding-standards`, `safety`, and `sdlc`.
-
-## Skills Overview
-
-- **coding-standards** — Engineering quality bar: priority (correctness > clarity > maintainability > performance > elegance), PR discipline, test requirements, no-hardcoded-values rules, CalVer versioning, `git.farh.net` container registry policy.
-- **safety** — Non-negotiable rules: no plaintext secrets (use SealedSecrets), no `kubectl apply` to production (`groombook` namespace), no self-merging, no direct `tofu` runs, board approval for destructive actions, escalation protocol.
-- **sdlc** — Full development lifecycle: Gitea authentication via `tea` CLI, branch strategy (`dev`/`uat`/`main`), SDLC pipeline phases, delegation model, handoff protocol (explicit PATCH assignment + status=todo + release checkout), infrastructure layout, and canonical tools list.
-
-## Critical Operational Rules
-
-- All changes go through PRs targeting `dev`. Never push directly to `dev`, `uat`, or `main`.
-- No agent merges their own PR.
-- Always include `cc @cpfarhood` at the bottom of PR bodies.
-- Gitea-origin issues require board approval before work begins.
-- Kubernetes secrets go through Bitnami Sealed Secrets — never commit plaintext secrets.
-- Production (`groombook` namespace) is Flux-managed; never `kubectl apply` directly.
-- Infrastructure changes go through Flux OpenTofu Controller via PR to `groombook/infra`.
-
-## No Build/Test Commands
-
-This repository contains only markdown skill files. There are no build, lint, or test commands — it is not an application codebase.

skills/coding-standards/SKILL.md

@@ -55,7 +55,7 @@ All releases use CalVer (`YYYY.MMDD.PATCH`, e.g. `2026.0504.0`). No SemVer, no c
 
 ## Container images
 
-Push to `git.farh.net` only. Never Docker Hub for first-party images.
+Push to `ghcr.io` only. Never Docker Hub for first-party images.
 
 ## When uncertain
 

skills/devops/SKILL.md

@@ -1,76 +0,0 @@
----
-name: devops
-description: >
-  Infrastructure lifecycle for GroomBook. Governs work on the
-  groombook/infra repo: single-branch main strategy, the infra PR review
-  pipeline, Flux GitOps reconciliation, OpenTofu controller workflow,
-  cluster topology, and the Flux image-automation policy. For application
-  code, see the sdlc skill.
----
-
-# DevOps Practices
-
-This skill governs work on **`groombook/infra`**. For application code lifecycle, see the `sdlc` skill. For PR/test discipline and the `cc @cpfarhood` visibility rule, see `coding-standards`. For non-negotiable safety rules (no direct `tofu`, no `kubectl apply` to production, SealedSecrets), see `safety`.
-
-## Gitea authentication
-
-Use the `GITEA_TOKEN` environment variable for all Gitea operations — it is already set in the agent environment. Use the **`tea`** CLI for all Gitea/Git operations (e.g., `tea issue list`, `tea pr create`). Gitea is the primary source of truth.
-
-## Branch strategy
-
-`groombook/infra` uses a single long-lived branch: **`main`**. Engineers target `main` directly via feature branches named `<agent-name>/<short-description>`.
-
-## Pipeline
-
-1. **Engineer** branches from `main`, writes code.
-2. **Engineer** opens a PR against `main`.
-3. **CI** fail → back to **Engineer**.
-4. **CI** pass → **QA** performs code review.
-5. **QA** rejected → back to **Engineer**.
-6. **QA** approved → **CTO** performs code review.
-7. **CTO** rejected → back to **Engineer**.
-8. **CTO** approved → **Engineer** merges PR → **Flux** reconciles automatically.
-
-```bash
-tea pr create --base main --title "..." --body "... cc @cpfarhood"
-```
-
-Gitea branch protection requires CI checks to pass. See `coding-standards` for the no-self-merge contract and the `cc @cpfarhood` rule.
-
-## Infrastructure topology
-
-* **Production:** namespace `groombook`, FQDN `demo.groombook.dev`
-* **UAT:** namespace `groombook-uat`, FQDN `uat.groombook.dev`
-* **Dev:** namespace `groombook-dev`, FQDN `dev.groombook.dev`
-* **Cluster:** Kubernetes — cluster-wide read; read/write on `groombook-dev` and `groombook-uat`; read-only on `groombook` (production).
-* **Gateways:** `istio-external` (public) and `istio-internal` (internal) in `gateway-system`.
-* **Container registry:** `git.farh.net/groombook/<service>` only.
-
-## GitOps (Flux)
-
-Flux watches `groombook/infra` as the **target** GitRepository — it is **not** a Flux bootstrap/cluster repo and must never be treated as one.
-
-Reconciles Kustomize overlays:
-- `apps/overlays/dev` → `groombook-dev`
-- `apps/overlays/uat` → `groombook-uat`
-- `apps/overlays/prod` → `groombook`
-
-Images currently use `:latest` with `imagePullPolicy: Always`; pin to a CalVer tag in the infra overlay when stabilizing a release.
-
-**Policy — Flux Image Tag Automation is DENIED.** Do NOT use `ImageRepository`, `ImagePolicy`, or `ImageUpdateAutomation` Flux resources. Image tag updates must be made intentionally via a PR to `groombook/infra` — typically as the final step of the `sdlc` application pipeline (Phase 5).
-
-## Infrastructure as Code
-
-Terraform (OpenTofu) is deployed via the **Flux OpenTofu Controller** in a GitOps fashion. Submit Terraform configurations via a PR to `groombook/infra` — the tofu controller reconciles them on merge. See `safety` for the prohibition on running `tofu` directly and on `kubectl apply` against production.
-
-## Infra-only tools
-
-These are the operators and controllers the infra repo installs and manages. Alternatives are policy violations:
-
-* **GitOps:** Flux CD (managed externally; reconciles `groombook/infra`).
-* **IaC:** Flux OpenTofu Controller.
-* **Secret management:** Bitnami Sealed Secrets Controller — encrypt with `kubeseal`, commit `SealedSecret` resources to `groombook/infra`. No plain Kubernetes secrets.
-* **Database operator:** CloudNativePG (Postgres).
-* **Cache / pub-sub operator:** DragonflyDB.
-
-For application-level tool policy (Renovate, Playwright, registry, CalVer) see `coding-standards` and `sdlc`.

skills/sdlc/SKILL.md

@@ -1,109 +1,225 @@
 ---
 name: sdlc
 description: >
-  Software development lifecycle for GroomBook application repos. Covers
-  Gitea authentication, the 3-branch dev/uat/main strategy, the SDLC
-  pipeline phases 1-5, the Stage 1 CI image build, the authentication
-  framework, and application-tool policy. For infrastructure
-  (groombook/infra), see the devops skill.
+  Software development lifecycle for GroomBook. Covers GitHub authentication,
+  branch strategy across Dev/UAT/Prod, the four-phase SDLC pipeline with
+  product analysis intake, PR review and merge policy, the handoff protocol,
+  status semantics, infrastructure layout, the canonical tools list, the
+  GitHub-origin issue board-approval gate, the cc-cpfarhood visibility rule,
+  the scheduled penetration testing program, and delegation model tier policy.
 ---
 
 # Software Development Lifecycle
 
-This skill governs **application code repos**. For infrastructure (`groombook/infra`), see the `devops` skill. For PR/test discipline and the `cc @cpfarhood` visibility rule, see `coding-standards`. For non-negotiable safety rules, see `safety`.
+## GitHub authentication
 
-## Gitea authentication
+**Invoke the `github-app-token` skill** before any GitHub operation. It generates a short-lived installation token and sets `GH_TOKEN`. **Never** run `gh auth login` — it hangs headless agents. Token expires after ~1 hour; re-invoke to regenerate.
 
-**Use the `GITEA_TOKEN`** environment variable for all Gitea operations. It is already set in the agent environment. Use the **`tea`** CLI for all Gitea/Git operations (e.g., `tea issue list`, `tea pr create`). The token expires when the environment variable is rotated — re-invoke any Gitea operation if you get a 401.
+GitHub is the **primary source of truth**. Every Paperclip issue should have a corresponding GitHub issue (create one if missing). Both stay open until the work is completed, reviewed, approved, merged, and QA-verified.
 
-Gitea is the **primary source of truth**. Every Paperclip issue must have a corresponding Gitea issue (create one if missing). Both stay open until the work is completed, reviewed, approved, merged, and QA-verified.
+## GitHub-origin issue policy — board approval required
+
+If a task originated from GitHub (`originKind: "github"`), **do not begin work**. Immediately create a board approval:
+
+```
+POST /api/companies/{companyId}/approvals
+{
+  "type": "request_board_approval",
+  "requestedByAgentId": "{your-agent-id}",
+  "issueIds": ["{issueId}"],
+  "payload": {
+    "title": "Board approval required: GitHub issue",
+    "summary": "Summarize what the GitHub issue requests.",
+    "recommendedAction": "Approve to begin work.",
+    "risks": ["Work begins without board review if approved."]
+  }
+}
+```
+
+Set the issue to `blocked` with a comment linking to the approval. Only proceed once `PAPERCLIP_APPROVAL_ID` is set and `PAPERCLIP_APPROVAL_STATUS` indicates approval.
 
 ## Branch strategy
 
 Three long-lived branches map to the three deployment environments:
 
-| Branch | Environment | Who merges | Prerequisites for merge |
-|--------|-------------|-----------|-----------|
-| `dev`  | Dev         | Engineer | CI passes |
-| `uat`  | UAT         | Engineer | QA code review approval |
-| `main` | Production  | Engineer | UAT validation & CTO code review |
+| Branch | Environment | Who merges |
+|--------|-------------|-----------|
+| `dev`  | Dev         | CTO (after QA approval)            |
+| `uat`  | UAT         | CTO (promotes `dev` → `uat`)        |
+| `main` | Production  | CEO (promotes `uat` → `main`)       |
 
-**Engineers always target `dev` first** — never `uat` or `main` directly.
-- Feature branches: `<agent-name>/<short-description>`.
+**Engineers always target `dev`** — never `uat` or `main` directly. Feature branches: `<agent-name>/<short-description>`.
 
 ## Pull requests
 
-All changes happen via pull request. Gitea branch protection requires CI checks to pass. See `coding-standards` for the no-self-merge contract and the `cc @cpfarhood` visibility rule.
+All changes happen via pull request. Always include `cc @cpfarhood` at the bottom of the PR body for visibility — never as a reviewer.
 
 ```bash
-tea pr create --base dev --title "..." --body "... cc @cpfarhood"
+gh pr create --base dev --title "..." --body "... cc @cpfarhood"
 ```
 
+## PR review & merge policy
+
+### Dev branch (`dev`)
+
+- **QA** (Lint Roller) reviews the PR. Approve → hand to CTO. Fail → back to engineer directly with exact details.
+- **CTO** (The Dogfather) reviews. Approve → CTO merges the `dev` PR. Fail → back to engineer.
+
+### UAT branch (`uat`)
+
+- **CTO** opens and merges a `dev` → `uat` PR.
+
+### Main branch (`main`)
+
+- **CEO** (Scrubs McBarkley) reviews and merges the `uat` → `main` PR.
+
+`@cpfarhood` is cc'd for visibility on all PRs — never as a reviewer.
+
 ## SDLC pipeline
 
+### Phase 0 — Product analysis (feature intake)
+
+* Feature requests arrive at the CEO via Paperclip or GitHub Issues.
+* CEO delegates to CMPO (Pawla Abdul) for review.
+* CMPO returns one of three decisions:
+  * **Accepted** → CEO routes to CTO for work breakdown.
+  * **Backlogged** → CEO handles prioritization.
+  * **Denied** → CEO closes as unplanned.
+* CTO breaks accepted work into atomic tasks and assigns to Engineering.
+
 ### Phase 1 — Dev
 
-1. **Engineer** branches from `dev`, writes code.
-2. **Engineer** opens a PR against `dev`.
-3. **CI** fail → back to **Engineer**.
-4. **CI** pass → **Engineer** merges PR.
-5. **CI** builds and deploys automatically to Dev (`https://dev.groombook.dev`).
+1. **Engineer** (Flea Flicker) branches from `dev`, writes code. GitOps deploys to dev on demand.
+2. **Engineer** opens a PR against `dev`. CI must pass.
+3. **QA (Lint Roller)** reviews the PR. Fail → back to engineer.
+4. QA approves and hands off to CTO.
+5. **CTO (The Dogfather)** reviews the PR. Fail → back to engineer.
+6. **CTO** merges the dev PR.
+7. **CI** builds and deploys automatically to Dev (`https://dev.groombook.dev`).
 
 ### Phase 2 — UAT promotion
 
-1. **Engineer** opens a PR from `dev` to `uat`.
-2. **CI** fail → back to **Engineer** (return to Phase 1).
-3. **CI** pass → **QA** performs code review.
-4. **QA** rejected → back to **Engineer** (return to Phase 1).
-5. **QA** approved → **Engineer** merges PR.
-6. **CI** builds and deploys automatically to UAT (`https://uat.groombook.dev`).
+8. **CTO** opens and merges a PR from `dev` to `uat`.
+9. **CI** builds and deploys automatically to UAT (`https://uat.groombook.dev`).
+10. **CTO** creates a UAT regression task for **Shedward Scissorhands** immediately after promoting.
 
-### Phase 3 — User Testing & Security Review
+### Phase 3 — UAT testing & security
 
-1. **UAT (Shedward Scissorhands)** runs full regression against UAT — every feature, old and new, no exceptions.
-2. **UAT** fail → back to **Engineer** (return to Phase 1).
-3. **UAT** pass → **Security Engineer** performs a security code review of the changes.
-4. **Security** fail → back to **Engineer** (return to Phase 1).
-5. **Security** pass → Begin Phase 4.
+11. **UAT (Shedward Scissorhands)** runs full regression against UAT — every feature, no exceptions.
+12. UAT fail → CTO redistributes to engineer (return to Phase 1).
+13. UAT pass → **Security Engineer (Barkley Trimsworth)** performs a security code review of the changes.
+14. Security fail → CTO redistributes to engineer (return to Phase 1).
 
-### Phase 4 — Production Promotion
+### Phase 4 — Production
 
-1. **Engineer** opens a PR from `uat` to `main`.
-2. **CI** fail → back to **Engineer** (return to Phase 1).
-3. **CI** pass → **CTO** performs code review.
-4. **CTO** rejected → back to **Engineer** (return to Phase 1).
-5. **CTO** approved → **Engineer** merges PR.
-6. **CI** fail → back to **Engineer** (return to Phase 1).
-7. **CI** pass → Begin Phase 5.
+15. Security pass → **CEO (Scrubs McBarkley)** reviews and merges the production PR (`uat → main`). Fail → back to CTO.
+16. **CI** deploys automatically to Production (`https://demo.groombook.dev`).
 
-### Phase 5 — Production Deployment
+### Hierarchy rules
 
-The **Engineer** opens a PR against `groombook/infra` to update the relevant Kustomize overlay with the new image tag. From this point the work follows the **`devops` skill pipeline** end-to-end — review, merge, and Flux reconciliation are all owned there. On merge, Flux rolls out the updated pods to production (`https://demo.groombook.dev`).
+* CTO rejections at Dev go directly to the engineer (not back through QA).
+* UAT failures (Shedward) go to CTO — CTO cascades to engineer.
+* Security failures (Barkley) go to CTO — CTO cascades to engineer.
+* CEO rejections at Prod go to CTO.
 
-## Stage 1 CI — Image build
+> **Penetration testing.** Barkley performs scheduled penetration testing against Production (`demo.groombook.dev`) and Demo independently of the PR workflow. Board-authorized; not triggered per-PR. Findings get filed as Paperclip issues with severity (`CRITICAL` / `HIGH` / `MEDIUM` / `LOW`) and routed to CTO for engineer redistribution.
 
-Triggered automatically on every merge to `main` in an application repo:
-- Builds and tags the Docker image: CalVer (`YYYY.MM.DD[.N]`), `latest`, and `sha-<hash>`
-- Pushes tagged images to `git.farh.net/groombook/<service>` (see `coding-standards` for the registry and CalVer policy)
-- Creates a CalVer git tag in the source repo
+## Delegation model tier
 
-Stage 2 (Flux GitOps deployment) is owned by `devops`.
+When creating subtasks for other agents, set `modelProfile: "cheap"` only for:
+- Mechanical refactors or repetitive operations
+- Basic information lookups
+- Well-specified, bounded updates
+
+Leave `modelProfile` unset for anything requiring judgment, reasoning, or QA review.
+
+When in doubt, leave it unset.
+
+## Handoff protocol — mandatory
+
+Every handoff to another agent requires ALL THREE steps:
+
+### 1. Explicit assignment
+
+`PATCH /api/issues/{id}` with `assigneeAgentId: "<target-agent-uuid>"`. Mentioning is NOT a handoff — the agent won't wake without explicit assignment.
+
+### 2. Status = `todo`
+
+Every handoff sets `status: "todo"`. Never `in_review`, never `backlog` — both are invisible in inbox-lite and the receiver won't wake.
+
+### 3. Release checkout
+
+```
+POST /api/issues/{issueId}/release
+Headers: Authorization: Bearer $PAPERCLIP_API_KEY, X-Paperclip-Run-Id: $PAPERCLIP_RUN_ID
+```
+
+Without this release, the receiving agent cannot check out the issue.
+
+**Saying you are reassigning a task is NOT the same as reassigning it.** Verify the PATCH succeeded (200) before posting a comment claiming the handoff is done.
+
+## Infrastructure
+
+* **Production / Demo:** namespace `groombook`, FQDN `demo.groombook.dev`
+* **UAT:** namespace `groombook-uat`, FQDN `uat.groombook.dev`
+* **Dev:** namespace `groombook-dev`, FQDN `dev.groombook.dev`
+* **Cluster:** Kubernetes — cluster-wide read; read/write on `groombook-dev` and `groombook-uat`; read-only on `groombook` (production).
+* **Gateways:** `istio-external` (publicly accessible) and `istio-internal` (internal only) in `gateway-system`.
+* **Container registry:** `ghcr.io/groombook/<service>` only.
 
 ## Authentication
 
 * **Framework:** Better-Auth.
-* **OAuth Providers:** GroomBook (Authentik), Google, and Apple.
+* **Social login:** Google and Apple OAuth.
 * **SSO:** Authentik OIDC at `https://auth.farh.net` (credentials in `authentik-credentials` secret).
 * **Never build custom authentication.**
 
-## Application tools (canonical, not alternatives)
+## Deployment — 2-stage Flux GitOps
 
-These are application-level dependency choices. Alternatives are policy violations:
+**Stage 1 — CI (GitHub Actions, runs in each application repo):**
+- Triggered automatically on every merge to `main`
+- Builds and tags the Docker image
+- Pushes tagged images to `ghcr.io/groombook/<service>`
 
-* **Database:** CloudNativePG-managed Postgres — no SQLite, MariaDB, or MySQL.
-* **Cache / pub-sub:** DragonflyDB — no Redis.
-* **Authentication:** Better-Auth + Google + Apple + Authentik (see Authentication above).
-* **Dependency updates:** Mend Renovate. **Dependabot is not used and will not be used.** Do not configure it.
-* **Browser automation:** the `playwright` MCP server (`http://playwright:8931/mcp`). Target dev only — never test production.
+**Stage 2 — GitOps (Flux, managed externally):**
+- Flux watches `groombook/infra` as the **target** GitRepository — it is **not** a Flux bootstrap/cluster repo.
+- Reconciles Kustomize overlays: `apps/overlays/dev` → `groombook-dev`, `apps/overlays/uat` → `groombook-uat`, `apps/overlays/prod` → `groombook`.
 
-For the container registry, CalVer versioning, and general PR/test discipline, see `coding-standards`. For the operator install side (CNPG, Dragonfly, Sealed Secrets), see `devops`.
+**Policy — Flux Image Tag Automation is DENIED.** Do NOT use `ImageRepository`, `ImagePolicy`, or `ImageUpdateAutomation` Flux resources. Image tag updates must be made intentionally via a PR to `groombook/infra`.
+
+**To deploy a change:**
+1. Merge code to `main` in the app repo — CI builds and pushes a new image automatically.
+2. Open a PR against `groombook/infra` to update the relevant overlay; merge after kustomize CI passes.
+3. Flux reconciles `groombook/infra` on merge and rolls out the updated pods.
+
+**To force a rollout** (pick up new `:latest` on stuck pods):
+```bash
+kubectl rollout restart deployment/<name> -n <namespace>
+```
+
+## Infrastructure as Code
+
+Terraform / OpenTofu is deployed via the **Flux OpenTofu Controller** in a GitOps fashion. Submit configurations via a PR to `groombook/infra` — the tofu controller reconciles them on merge.
+
+**Never run `tofu` directly.** Never `kubectl apply` against production. Production changes go through Flux only.
+
+## Tools (canonical, not alternatives)
+
+These are the only acceptable choices — alternatives are policy violations:
+
+* **Secret management:** Bitnami Sealed Secrets Controller — no plain Kubernetes secrets.
+* **Database:** CloudNativePG Operator (Postgres) — no SQLite, MariaDB, or MySQL.
+* **Cache / pub-sub:** DragonflyDB Operator — no Redis.
+* **Authentication:** Better-Auth + Google + Apple + Authentik (see Authentication section). Never build custom auth.
+* **Dependency updates:** Mend Renovate. **Dependabot is not used and will not be used.**
+* **Container registry:** `ghcr.io/groombook/<service>` — no Docker Hub for first-party images.
+
+If a task requires deviating from any of the above, treat it as a destructive action: stop, file an issue with rationale, request board approval.
+
+## External communication
+
+When communicating in any context visible outside the GroomBook agent team (external users, human reviewers, non-agent entities), include `cc @cpfarhood` for visibility — never as a reviewer.
+
+## No self-merge
+
+No agent merges their own PR. The merger is always the next role up the SDLC ladder (CTO for `dev` and `uat`, CEO for `main`).