feat(skills): the detectors audit the workflow discipline itself

What a frontier model assumes, an open model must be told — the detector
skills now verify the executors' rules held, mechanically (run the command,
never infer): audit-docs 1.5.0 adds workflow-discipline checks 10-13 (phase
naming, per-phase docs, branch/PR discipline vs the forge, commit format +
dependency closures); product-audit 1.6.0 adds an explicit Workflow
discipline dimension composing them; review-change 1.7.0 runs a mechanical
discipline check at every checkpoint (axis workflow); audit-pr 1.5.0 blocks
on a done row missing its PR link. Changelogs EN/ES.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: gtrabanco

CHANGELOG.es.md

@@ -141,6 +141,7 @@ Cómo funciona el pinning realmente, **verificado** contra el CLI `skills`:
 #### `review-change`
 | Versión | Fecha | Tipo | Qué cambió |
 |---|---|---|---|
+| 1.7.0 | 2026-07-03 | menor | Check mecánico de disciplina del workflow en cada revisión (eje `workflow`): formato de commits, etiquetas de fase, docs por fase, sin commits en la rama por defecto, idioma de artefactos. |
 | 1.6.0 | 2026-07-03 | menor | Contrato de turno al inicio (informe en formato fijo + PASS|FAIL + todo hallazgo enrutado + → Next: impreso al final). |
 | 1.5.0 | 2026-07-02 | menor | Compone el pack de revisión interno propio (`review-*`) — las skills externas pasan a extras opcionales, nunca dependencias; contrato de salida fijo "Return exactly" que termina en PASS|FAIL; nota de equivalencia de modelos en la descripción. |
 | 1.4.0 | 2026-07-02 | minor | Añadida la sección Portability; "componer in-turn" definido genéricamente como ejecutar dentro de la misma conversación. |
@@ -153,6 +154,7 @@ Cómo funciona el pinning realmente, **verificado** contra el CLI `skills`:
 #### `audit-pr`
 | Versión | Fecha | Tipo | Qué cambió |
 |---|---|---|---|
+| 1.5.0 | 2026-07-03 | menor | El gate de Traceability también bloquea si la fila done no lleva su referencia de PR enlazada. |
 | 1.4.0 | 2026-07-03 | menor | Contrato de turno al inicio (bloque de veredicto fijo; nada fusionado/editado; → Next: impreso al final). |
 | 1.3.1 | 2026-07-02 | parche | Nota de equivalencia de modelos en la descripción (edita model:/effort: para modelos no-Claude / de libre inferencia). |
 | 1.3.0 | 2026-07-02 | minor | Añadida la sección Portability con los fallbacks estándar para agentes distintos de Claude Code. |
@@ -166,6 +168,7 @@ Cómo funciona el pinning realmente, **verificado** contra el CLI `skills`:
 #### `product-audit`
 | Versión | Fecha | Tipo | Qué cambió |
 |---|---|---|---|
+| 1.6.0 | 2026-07-03 | menor | Dimensión explícita de disciplina del workflow — compone los checks 1-13 de audit-docs mecánicamente; nunca asume que una regla se cumplió. |
 | 1.5.0 | 2026-07-03 | menor | Contrato de turno al inicio (informe completo en formato fijo; solo informe; → Next: impreso al final). |
 | 1.4.0 | 2026-07-02 | menor | Barre todos los ejes con el pack de revisión interno (sin dependencias de skills externas); nota de equivalencia de modelos en la descripción. |
 | 1.3.0 | 2026-07-02 | minor | Añadida la sección Portability; el tip de ultracode ahora indica el fallback secuencial para agentes sin él. |
@@ -181,6 +184,7 @@ Cómo funciona el pinning realmente, **verificado** contra el CLI `skills`:
 #### `audit-docs`
 | Versión | Fecha | Tipo | Qué cambió |
 |---|---|---|---|
+| 1.5.0 | 2026-07-03 | menor | Checks de disciplina del workflow 10-13 (comandos mecánicos, no inferencia): nombrado de fases, disciplina de docs por fase, disciplina de rama/PR contra el forge, formato de commits + cierres de dependencias. |
 | 1.4.0 | 2026-07-03 | menor | Nuevo check 9: integridad de enlaces de PR en filas `done` — toda fila done del roadmap/índice lleva `done · [#<pr>](url)`; un done sin PR localizable es severidad alta. product-audit lo hereda al componer esta skill. |
 | 1.3.0 | 2026-07-03 | menor | Contrato de turno al inicio (informe fijo + PASS|FAIL; sin reescrituras no pedidas; → Next: impreso al final). |
 | 1.2.0 | 2026-07-02 | menor | Formato de informe fijo (tabla de hallazgos + conteo de checks + decisión PASS|FAIL); nota de equivalencia de modelos. |
@@ -248,6 +252,18 @@ Cómo funciona el pinning realmente, **verificado** contra el CLI `skills`:
 
 ## Registro cronológico (más reciente primero)
 
+- **2026-07-03 (5) — los detectores auditan la disciplina.** Las skills
+  ejecutoras imponen las reglas del workflow al escribir; ahora las detectoras
+  verifican que de verdad se cumplieron, mecánicamente (ejecuta el comando,
+  nunca infieras — lo que un modelo frontier asume, a un modelo abierto hay que
+  decírselo): `audit-docs` 1.5.0 gana los checks de disciplina 10-13 (nombrado
+  de fases, docs por fase, disciplina de rama/PR contra el forge, formato de
+  commits + cierres de dependencias); `product-audit` 1.6.0 estrena la
+  dimensión explícita de disciplina del workflow componiéndolos;
+  `review-change` 1.7.0 corre un check mecánico de disciplina en cada
+  checkpoint (eje `workflow`); `audit-pr` 1.5.0 bloquea si una fila done no
+  lleva su enlace de PR.
+
 - **2026-07-03 (4) — cierre de PR explícito.** Evidencia de campo (runs de
   Hermes dejaban filas del roadmap como `done` a secas mientras Claude producía
   `done · #51`): abrir el PR tiene ahora un cierre deletreado — **imprimir la

CHANGELOG.md

@@ -139,6 +139,7 @@ How pinning actually works, verified against the `skills` CLI:
 #### `review-change`
 | Version | Date | Type | What changed |
 |---|---|---|---|
+| 1.7.0 | 2026-07-03 | minor | Mechanical workflow-discipline check at every review (axis `workflow`): commit format, phase labels, per-phase docs, no default-branch commits, artifact language. |
 | 1.6.0 | 2026-07-03 | minor | Turn contract at the top (fixed-format report + PASS|FAIL + every finding routed + → Next: printed last). |
 | 1.5.0 | 2026-07-02 | minor | Composes the workflow's own internal review pack (`review-*`) — external skills are now optional extras, never dependencies; fixed "Return exactly" output contract ending in PASS|FAIL; model-equivalence note in the description. |
 | 1.4.0 | 2026-07-02 | minor | Added the Portability section; "compose in-turn" defined generically as running within the same conversation. |
@@ -151,6 +152,7 @@ How pinning actually works, verified against the `skills` CLI:
 #### `audit-pr`
 | Version | Date | Type | What changed |
 |---|---|---|---|
+| 1.5.0 | 2026-07-03 | minor | Traceability gate also blocks on a done row missing its linked PR reference. |
 | 1.4.0 | 2026-07-03 | minor | Turn contract at the top (fixed verdict block; nothing merged/edited; → Next: printed last). |
 | 1.3.1 | 2026-07-02 | patch | Model-equivalence note in the description (edit model:/effort: for non-Claude / free-inference models). |
 | 1.3.0 | 2026-07-02 | minor | Added the Portability section with the standard non-Claude-Code fallbacks. |
@@ -164,6 +166,7 @@ How pinning actually works, verified against the `skills` CLI:
 #### `product-audit`
 | Version | Date | Type | What changed |
 |---|---|---|---|
+| 1.6.0 | 2026-07-03 | minor | Explicit Workflow discipline dimension — composes audit-docs checks 1-13 mechanically; never assumes a rule held. |
 | 1.5.0 | 2026-07-03 | minor | Turn contract at the top (full fixed-format report; report-only; → Next: printed last). |
 | 1.4.0 | 2026-07-02 | minor | Sweeps every axis via the internal review pack (no external skill dependencies); model-equivalence note in the description. |
 | 1.3.0 | 2026-07-02 | minor | Added the Portability section; the ultracode tip now states the sequential fallback for agents without it. |
@@ -179,6 +182,7 @@ How pinning actually works, verified against the `skills` CLI:
 #### `audit-docs`
 | Version | Date | Type | What changed |
 |---|---|---|---|
+| 1.5.0 | 2026-07-03 | minor | Workflow-discipline checks 10-13 (mechanical commands, not inference): phase naming, per-phase doc discipline, branch/PR discipline vs the forge, commit format + dependency closures. |
 | 1.4.0 | 2026-07-03 | minor | New check 9: PR-link integrity on `done` rows — every done roadmap/fix-index row carries `done · [#<pr>](url)`; a done with no findable PR is high severity. product-audit inherits it by composing this skill. |
 | 1.3.0 | 2026-07-03 | minor | Turn contract at the top (fixed report + PASS|FAIL; no unrequested rewrites; → Next: printed last). |
 | 1.2.0 | 2026-07-02 | minor | Fixed report format (findings table + checks-run count + PASS|FAIL decision); model-equivalence note. |
@@ -246,6 +250,17 @@ How pinning actually works, verified against the `skills` CLI:
 
 ## Release log (chronological, newest first)
 
+- **2026-07-03 (5) — the detectors audit the discipline.** The executor skills
+  enforce the workflow's rules at write time; now the detector skills verify
+  they actually held, mechanically (run the command, never infer — what a
+  frontier model assumes, an open model must be told): `audit-docs` 1.5.0 gains
+  workflow-discipline checks 10-13 (phase naming, per-phase docs, branch/PR
+  discipline vs the forge, commit format + dependency closures);
+  `product-audit` 1.6.0 gets an explicit Workflow-discipline dimension
+  composing them; `review-change` 1.7.0 runs a mechanical discipline check at
+  every checkpoint (axis `workflow`); `audit-pr` 1.5.0 blocks on a done row
+  missing its PR link.
+
 - **2026-07-03 (4) — explicit PR close-out.** Field evidence (Hermes runs left
   roadmap rows as bare `done` while Claude runs produced `done · #51`): opening
   the PR now has a spelled-out close-out — **print the PR URL in the chat**

skills/audit-docs/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: audit-docs
 user-invocable: true
-version: 1.4.0
+version: 1.5.0
 model: sonnet
 effort: medium
 author: "Gabriel Trabanco <gtrabanco@users.noreply.github.com>"
@@ -74,6 +74,31 @@ Run these and collect findings (cite paths/lines/issue numbers each):
    the row update; a `done` with no PR found at all is HIGH severity (the unit
    may never have been closed out).
 
+**Workflow discipline (checks 10–13)** — the executor skills enforce these at
+write time; this audit verifies they actually held. Each check is mechanical:
+run the command shown, don't infer.
+
+10. **Phase naming.** `grep -rnE '\bS[0-9]+\b|\bStep [0-9]' docs/features/*/{PLAN,TASKS,progress}.md`
+    must return nothing — plans use `P1, P2, …` ("phases") only. Any hit: LOW
+    (rename), plus check the executor argument still resolves.
+11. **Per-phase doc discipline.** For every M/L feature `in-progress`/`done`:
+    completed phases are ticked in `TASKS.md`, `progress.md` has one entry per
+    completed phase, and (features planned under the current template) the
+    final phase ends with the literal close-out tasks (open PR + print URL,
+    link roadmap row, push the link commit). A `done` feature with unticked
+    tasks or a phase missing from `progress.md`: HIGH.
+12. **Branch & PR discipline vs the forge.** For every `done` unit: its PR
+    exists, targets the default branch, has a non-empty body, and carries
+    `Closes #<n>` when the unit is issue-born (SPEC references an issue).
+    Also scan recent default-branch history (`git log --first-parent`) for
+    feature/fix-scoped changes committed directly without a PR: HIGH.
+13. **Commit format & dependency discipline.** Sample the unit branches'
+    commits: `<type>(<scope>): <summary>` conventional format (violations:
+    LOW). Every `in-progress`/`done` row's `Depends on:` closure was merged —
+    a unit built on unmerged deps is HIGH unless `decisions.md` records a
+    user-forced override (`--force`), which downgrades it to LOW (documented
+    risk).
+
 Adapt the list to what the project has; skip checks for absent structures and
 say so.
 
@@ -86,11 +111,11 @@ say so.
    ```
    AUDIT DOCS — scope: <docs tree / roadmap / fix index / issues checked>
 
-   | # | Check (1-9) | Finding | Sev | Evidence | Proposed fix |
+   | # | Check (1-13) | Finding | Sev | Evidence | Proposed fix |
    |---|-------------|---------|-----|----------|--------------|
    | 1 | <which>     | <what>  | high|low | <path:line / #issue> | <smallest action> |
 
-   Checks run: <n>/9 (skipped: <which + why — absent structures only>)
+   Checks run: <n>/13 (skipped: <which + why — absent structures only>)
    Summary: <1-2 sentences>
    Decision: PASS | FAIL   (FAIL if any high-severity finding is open)
    ```

skills/audit-pr/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: audit-pr
 user-invocable: true
-version: 1.4.0
+version: 1.5.0
 argument-hint: <pr-number> (optional — defaults to the current branch's PR)
 model: opus
 effort: high
@@ -84,7 +84,7 @@ A gate that can't be confirmed is a **blocker**, not a pass — never assume gre
 | **All phases complete** | Feature: every phase in `PLAN.md`/`TASKS.md` is done and logged in `progress.md`. Fix: the SPEC is fully implemented. | Any unchecked task or unimplemented phase without an explicit, tracked deferral. |
 | **Scope integrity** | The PR implements the SPEC and no more; out-of-scope work was split out. | Undocumented scope creep, or in-scope work missing. |
 | **Docs updated** | Every "Affected docs" criterion is satisfied; per-phase docs (`progress`/`testing`/`known-issues`/`decisions`) reflect reality; the doc map still resolves. **Never merge with documentation still pending.** | A doc the map or SPEC requires is stale, missing, pending, or contradicts the code. |
-| **Traceability** | `Closes #N` is in the PR body when the work is issue-born (from `plan-feature-from-issue` or `plan-fix`); the roadmap/fix-index entry matches and is **still present** (the issue/fix-index entry is removed only *after* merge, never before). | Issue-born work without `Closes #N`; a roadmap/index entry out of sync; or the issue/fix-index entry dropped before merge. |
+| **Traceability** | `Closes #N` is in the PR body when the work is issue-born (from `plan-feature-from-issue` or `plan-fix`); the roadmap/fix-index entry matches, is **still present** (removed only *after* merge, never before), and carries the linked PR reference (`done · [#<pr>](<pr-url>)`). | Issue-born work without `Closes #N`; a roadmap/index entry out of sync; the entry dropped before merge; or a `done` row without its PR link. |
 | **Tests** | New behavior is covered at the right layer (prefer integration); acceptance criteria map to tests; no regression-risk tests left red. | New behavior untested, or tests assert nothing meaningful. |
 | **Verification gate / CI** | The project's gate passes — type-check, tests, build — and `statusCheckRollup` is green. | Any required check failing, pending, or absent where the project requires one. |
 | **Mergeability** | Branch is off the default base, independently mergeable (no conflicts), not stacked on another PR, not draft. | Wrong base, conflicts, stacked dependency, or still draft. |

skills/product-audit/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: product-audit
 user-invocable: true
-version: 1.5.0
+version: 1.6.0
 argument-hint: <path-or-area> (optional — defaults to the whole product)
 model: opus
 effort: max
@@ -91,6 +91,7 @@ pack covers every axis).
 | **Brand / voice** | User-facing copy vs. the brand guide | surfaces with copy |
 | **Tech debt** | Accumulated shortcuts, TODO/FIXME, stale abstractions | all |
 | **Process & docs** | Incomplete phases, aging open issues, **solvable known-issues**, doc completeness, missing/optimizable workflow docs | all |
+| **Workflow discipline** | The workflow's own rules held: branch/PR discipline, `done · #<pr>` links, phase naming (`P1…`), per-phase docs, commit format, dependency closures, artifact language — **run `audit-docs` checks 1–13 mechanically** (compose it); never assume a rule held because it "should" | all |
 | **Roadmap coherence** | Stale/obsolete/superseded features, missing dependencies, gaps & opportunities | all |
 
 Skip inapplicable axes (no a11y/SEO/brand for a CLI/library/infra product) and

skills/review-change/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: review-change
 user-invocable: true
-version: 1.6.0
+version: 1.7.0
 argument-hint: <path-or-glob>
 model: opus
 effort: high
@@ -95,51 +95,58 @@ Every axis maps to a skill of the workflow's **own internal review pack**
    Findings get axis `spec-drift` in the table. Catching drift at a phase
    checkpoint is far cheaper than at the `audit-pr` merge gate. (No SPEC found →
    note it and skip.)
-3. **Applicable pack passes.** For each axis the matrix + footprint mark as
+3. **Workflow-discipline check (mechanical, every review).** On the branch
+   under review, verify and file findings under axis `workflow`:
+   commits follow `<type>(<scope>): <summary>`; phase labels in touched
+   planning docs are `P1, P2, …` (never `S1`/"Steps"); the phase's per-phase
+   docs were updated (TASKS ticks, progress entry); no commit landed on the
+   default branch; artifacts are in the project's declared docs language.
+   Run the greps/`git log` — don't infer compliance.
+4. **Applicable pack passes.** For each axis the matrix + footprint mark as
    relevant, run the workflow's own internal skill for it (`review-code`,
    `review-security`, `review-verify`, `review-debt`, `review-design`,
    `review-a11y`, `review-brand`, `review-perf`, `review-seo`) — composed in-turn
    (this same conversation), each returning its fixed-format table + PASS|FAIL.
    **Skip the rest** and say which you skipped and why. The pack ships with the
    workflow, so an applicable pass can never be "missing".
-4. **Optional extras.** If the project recorded additional platform review skills
+5. **Optional extras.** If the project recorded additional platform review skills
    (stack-specific linters, framework skills) and they are installed, run them
    **in addition** — their findings merge into the same table. Never treat an
    absent extra as a gap; the pack already covered the axis.
-5. **Synthesize.** Merge all findings into **one** decision table, deduped by
+6. **Synthesize.** Merge all findings into **one** decision table, deduped by
    `file:line`. Keep `review-implementation`'s columns (Sev, Class, WHY, impl risk,
    long-term impact, premature-opt?, route) and add an **Axis** column.
-6. **Manual-verification checklist.** List what automated review **cannot** confirm
+7. **Manual-verification checklist.** List what automated review **cannot** confirm
    and a human must check — visual correctness, real-device/locale behavior, UX
    feel, perf under load, anything marked *verify*. Be explicit so the dev has zero
    doubt about what to eyeball.
-7. **Triage everything not fixed now.** For **every** finding you don't route to
+8. **Triage everything not fixed now.** For **every** finding you don't route to
    `fix-now` (postpone / ignore / intentional-tradeoff), run it through
    `triage-issue` (compose in-turn — i.e. within this same conversation/run; equal
    tier) to decide and record its home: a
    tracked issue with a trigger, a documented decision (`decisions.md` / a comment),
    or a justified drop. **No non-fix-now finding may end without a destination** — the
    point is to never silently lose one, and to catch the few that actually deserve an
    issue or a doc note.
-8. **Report — return exactly this structure** (fixed output contract; nothing
+9. **Report — return exactly this structure** (fixed output contract; nothing
    more, nothing less):
 
    ```
    REVIEW CHANGE — scope: <scope>
    Axes run: <list>   Skipped: <list + why>
 
-   <the synthesized decision table (step 5)>
+   <the synthesized decision table (step 6)>
 
    Manual verification (a human must check):
    - <item> …
 
-   Non-fix-now destinations (step 7): <n> triaged — <issue #s / decisions / drops>
+   Non-fix-now destinations (step 8): <n> triaged — <issue #s / decisions / drops>
 
    Summary: <1-2 sentences>
    Decision: PASS | FAIL   (FAIL while any fix-now finding is open)
    ```
 
-9. **Next step.** Close with the `→ Next:` block:
+10. **Next step.** Close with the `→ Next:` block:
 
    ```
    → Next: /audit-pr — merge gate (when the table is clean)
@@ -171,7 +178,7 @@ For a change to a backend export module (no UI surface):
 
 ## Routing
 
-Every non-`fix-now` finding is routed **through `triage-issue`** (step 7) so its
+Every non-`fix-now` finding is routed **through `triage-issue`** (step 8) so its
 disposition is a decision, not a default:
 
 - **fix-now** → `plan-fix` → `execute-phase --fix`, or fold into the current phase