Deploy convention at M.Video: a release-* branch push deploys to stage and a
v* tag push deploys to PROD. The old guard only matched release/* (slash) and
never caught tag pushes, so a prod deploy could run unconfirmed.
- permission-gate: match main/master, release-[-/], --tags/--follow-tags, and
whitespace-preceded v<digit> tags; false-positive-safe (space discriminator)
- create-mr.sh: refuse source branch release-* (not just release/*)
- jira-workflow doc updated to release-*
Verified with a behavioral test suite (10 cases incl. v2, false-positive checks).
- commit format: Conventional Commits (all six *-standards)
- branches/deploy: feature branches from main; release-* -> stage, tag v* -> prod (all six *-standards)
- jira-workflow: statuses To Do -> In Progress -> Review -> Done; who moves status when; MR link + status transition policy; comment guidance
- key-prefix list stays TODO (unknown project prefixes)
Verified: no leftover commit-format TODOs, deploy convention in all 6, skills still load via pi.
- creates a merge request via GitLab API (curl + GITLAB_TOKEN, PRIVATE-TOKEN header)
- derives host + project path from git remote origin (or GITLAB_HOST); no hardcoded URLs
- refuses to open an MR from a protected source branch; MR_PUSH/MR_DRY_RUN toggles
- optionally attaches the MR link to a Jira ticket via link-mr.sh
- verified parsing for ssh (scp-form) and https remotes incl. nested namespaces
- descriptions state WHEN each skill applies
- jira-workflow ships curl scripts reading TRACKER_URL/JIRA_TOKEN from env, no hardcoded secrets/URLs
- repo-map/docs-map defer values to session corporate context; company specifics left as TODO
- go-standards uses realistic Go defaults, company-specific bits marked TODO
