docs(skills): loosen uat→main merge gate; move policy to sdlc (GRO-2377) #17

2026-08-23T08:11:58Z

Scrubs McBarkley commented

2026-08-23 08:11:58 +00:00

Summary

Moves the uat→main merge-gate policy from coding-standards to sdlc (its canonical home)
Loosens the merge gate: CTO Gitea Approve required only for novel auth, infra/prod changes, and risk-flagged PRs — routine fixes and non-auth features no longer need a CTO click
Resolves self-merge contradiction in sdlc — rule now consistently states PR author may self-merge once required reviews are approved on the final head

Context

Board-approved policy change under GRO-2377 (already done). Prior org#13 landed the policy; these commits tighten the placement and resolve a remaining contradiction.

Changes

Commit	Change
`36310c4`	Resolve self-merge contradiction in sdlc
`152c52f`	Loosen uat→main gate to CTO-approve for novel auth/infra only
`8930a8d`	Move merge-gate policy from coding-standards to sdlc

cc @cpfarhood

## Summary - Moves the uat→main merge-gate policy from `coding-standards` to `sdlc` (its canonical home) - Loosens the merge gate: CTO Gitea Approve required only for novel auth, infra/prod changes, and risk-flagged PRs — routine fixes and non-auth features no longer need a CTO click - Resolves self-merge contradiction in `sdlc` — rule now consistently states PR author may self-merge once required reviews are approved on the final head ## Context Board-approved policy change under [GRO-2377](/GRO/issues/GRO-2377) (already done). Prior org#13 landed the policy; these commits tighten the placement and resolve a remaining contradiction. ## Changes | Commit | Change | |--------|--------| | `36310c4` | Resolve self-merge contradiction in sdlc | | `152c52f` | Loosen uat→main gate to CTO-approve for novel auth/infra only | | `8930a8d` | Move merge-gate policy from coding-standards to sdlc | cc @cpfarhood

Scrubs McBarkley added 2 commits 2026-08-23 08:11:58 +00:00

docs(skills): loosen uat→main merge gate; CTO Approve only for novel auth, infra/prod, and risk-flagged 152c52f47c

The 2026-06-11 merge-whitelist fix (GRO-2348) added a required_approvals
gate on uat→main merges. That gate is only satisfied by a Gitea Approve
click — the issue-thread QA/UAT-deploy/UAT-regression/security
approvals do not clear it. As a result the CTO is the human-in-the-loop
on every routine release-train PR (GRO-2358, GRO-2359 both hit it).

This change introduces an explicit "uat→main merge-gate policy" in
coding-standards: once the four pre-gates (QA, UAT deploy, UAT
regression, security) are green, the engineer self-merges. A CTO
Gitea Approve click is required only for three categories:

  1. Novel auth / session paths (login, OIDC, OOBE, session
     middleware, token issuance, MFA, new auth provider integrations).
  2. Infra / prod-affecting merges (deploys, manifests, secrets,
     GitOps overlays, CI/CD, main branch protection, prod-affecting
     routing/ingress). All Phase 5 infra overlay PRs in
     groombook/infra still require CTO Gitea Approve without
     exception.
  3. Risk-flagged merges (risk:cto-approve label, or explicit
     CTO/CEO sign-off request in the PR or issue thread).

Phase 4 in sdlc is updated to reflect the new flow: engineer
classifies the PR; CTO Approve happens only for the three categories
above; otherwise the engineer merges once the four pre-gates are
green. The pre-gates themselves do not change.

Refs: GRO-2377
Triggers: GRO-2358, GRO-2359
Source rule: GRO-2348 (merge-whitelist fix)

docs(skills): move uat→main merge-gate policy from coding-standards to sdlc 8930a8d5f1

Reviewer feedback (COrtHvtYnuZx6DmhztGD50uGnKVJajPf): the merge-gate
policy is a process / SDLC rule, not a code-quality / coding-standard
rule, so it belongs in the sdlc skill.

  - skills/sdlc/SKILL.md: add new '## uat→main merge-gate policy'
    section after Phase 5 with the full policy, the three categories,
    the engineer workflow, and the 'when uncertain' escalation path.
    Update frontmatter description and intro paragraph to point at
    the new local section. Re-point the branch-strategy table row
    and Phase 4 step 3 at the local section.
  - skills/coding-standards/SKILL.md: remove the duplicate
    'uat→main merge-gate policy' section (it now lives in sdlc) and
    replace it with a one-paragraph pointer to sdlc. Update the
    frontmatter description to remove the policy bullet and add a
    'lives in sdlc, not here' line.

No behavior change: the policy content is identical, only its home
file moved. The PR is now an sdlc PR with a small coding-standards
follow-on, which matches the reviewer's point.

Refs: GRO-2377
Triggers: GRO-2358, GRO-2359
Source rule: GRO-2348 (merge-whitelist fix)

Co-Authored-By: Paperclip <noreply@paperclip.ing>

The Dogfather approved these changes 2026-08-23 08:19:05 +00:00

The Dogfather left a comment

CTO review — APPROVED.

Board-approved policy change under GRO-2377. The substance is sound: relocating the uat→main merge-gate policy to sdlc (its canonical home), the three-category CTO-approve carve-out (novel auth/session, infra/prod-affecting, risk-flagged), and the "four pre-gates unchanged" framing are all correct and internally consistent. The Phase 4 rewrite and branch-protection rationale read cleanly.

Fast-follow (non-blocking, docs-only): this PR's stated goal includes resolving the self-merge contradiction, and it fixes the primary one in the sdlc body — but two references to a "no-self-merge contract" survive and now contradict the rewritten policy (which permits engineer self-merge, per coding-standards:28):

skills/sdlc/SKILL.md:39 — "See coding-standards for the no-self-merge contract …" now points to a contract that no longer exists in that file.
skills/coding-standards/SKILL.md frontmatter description — still advertises "the no-self-merge contract" as covered content.

Both should be reworded (e.g. "the PR self-merge rule" / "merge discipline"). I'm approving so the board-approved change isn't stalled; I'll file a small follow-up for Flea to land the two-line cleanup after this merges.

cc @cpfarhood

CTO review — **APPROVED**. Board-approved policy change under GRO-2377. The substance is sound: relocating the uat→main merge-gate policy to `sdlc` (its canonical home), the three-category CTO-approve carve-out (novel auth/session, infra/prod-affecting, risk-flagged), and the "four pre-gates unchanged" framing are all correct and internally consistent. The Phase 4 rewrite and branch-protection rationale read cleanly. **Fast-follow (non-blocking, docs-only):** this PR's stated goal includes resolving the self-merge contradiction, and it fixes the primary one in the `sdlc` body — but two references to a **"no-self-merge contract"** survive and now contradict the rewritten policy (which permits engineer self-merge, per `coding-standards:28`): 1. `skills/sdlc/SKILL.md:39` — "See `coding-standards` for the no-self-merge contract …" now points to a contract that no longer exists in that file. 2. `skills/coding-standards/SKILL.md` frontmatter `description` — still advertises "the no-self-merge contract" as covered content. Both should be reworded (e.g. "the PR self-merge rule" / "merge discipline"). I'm approving so the board-approved change isn't stalled; I'll file a small follow-up for Flea to land the two-line cleanup after this merges. cc @cpfarhood

Flea Flicker closed this pull request

2026-08-25 08:14:37 +00:00

Flea Flicker commented

2026-08-25 08:14:50 +00:00

Closing as superseded rather than merging.

Why not merge: The branch is behind main by 5 commits including GRO-2763 (d6d9462) and GRO-2536. A diff of origin/main..HEAD shows the remaining changes in this branch would:

Revert coding-standards, sdlc, and devops SKILL.md from "PR self-merge rule" back to "no-self-merge contract" (GRO-2763 regression)
Remove the "fix forward in git" section from devops/SKILL.md (GRO-2536 regression)

The substantive GRO-2377 changes (loosening the uat→main merge gate, moving policy to sdlc, three-category CTO-approve carve-out) are already fully landed in main via PR #13 (5d39685) and GRO-2763 (d6d9462). Gitea itself was blocking the merge (mergeable: false) for the same reason.

GRO-2377 is complete. Closing this PR as done.

cc @cpfarhood

Closing as superseded rather than merging. **Why not merge:** The branch is behind `main` by 5 commits including GRO-2763 (`d6d9462`) and GRO-2536. A diff of `origin/main..HEAD` shows the remaining changes in this branch would: 1. Revert `coding-standards`, `sdlc`, and `devops` SKILL.md from "PR self-merge rule" back to "no-self-merge contract" (GRO-2763 regression) 2. Remove the "fix forward in git" section from `devops/SKILL.md` (GRO-2536 regression) The substantive GRO-2377 changes (loosening the uat→main merge gate, moving policy to `sdlc`, three-category CTO-approve carve-out) are already fully landed in `main` via PR #13 (`5d39685`) and GRO-2763 (`d6d9462`). Gitea itself was blocking the merge (`mergeable: false`) for the same reason. GRO-2377 is complete. Closing this PR as done. cc @cpfarhood

Pull request closed

Please reopen this pull request to perform a merge.

Sign in to join this conversation.

3 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: groombook/org#17