⛔ This skill MUST be read in full — not skimmed. Formal review gates depend on its workflow.
Skipping steps silently bypasses quality checks. Missing gates = undetected breakages.

AI review gate (merge): merge proceeds when the review APPROPRIATE TO THE ISSUE
CONTENT is clean (zero blocking findings — the disposition rule is code-review §"Finding
disposition": a finding blocks only when it is attributable to this change AND names the wrong outcome
it can produce; a non-blocking finding is filed as an owned follow-up, not resolved here) AND pre-flight tests passed (per 01-preflight.md risk tier —
regression check for code PRs) AND the verification gate verified the staged files. code-review
Step 3.6 resolves the risk class (which caps the reviewer count per proportional-gates
§Review Cycles) and the PR diff surface (which selects WHAT is examined, never how many
reviewers run); test-routing dispatches the verification domain. The merged reviewers are:
always-on A (Guidance & History) and B (Correctness & Security — bug scan as two ORDERED
passes, blind diff scan first then deep caller/callee, plus the security-review discipline,
HIGH-confidence findings only, research-before-report); surface-matched C (Architecture &
Data) and D (Surface & Config — UX consistency/coverage/realism + config validation); and
E (Infrastructure — Skill Infrastructure / Ontology & Templates / Extension Safety) only when
INFRA_RISK is set. Low risk class → the panel is B alone (one reviewer round, both of B's
bug-scan passes, no re-review loop); reviewer E still fires whenever INFRA_RISK is set, at
every class. UX verification
additionally routes through ux-verification (test-routing); research/docs → proportional review.
No human approval required for technical merges.
Human escalation (only): P0 findings requiring an architectural or security decision
(irreversible ops, data loss, security breach) — and only after the code-review fixer loop
escalation is exhausted (per the code-review skill, Step 6.5 Orchestrator Escalation).
Verifier gate: dispatches AI reviewers. Pipeline auto-advances when clean.

⛔ When you don't follow this skill fully, push will stall and commit will fail. That's the guard we designed. You must follow the skill.

Commit Workflow

Ontology: tortoise/docs/ONTOLOGY.md (v3.1, canonical) — fetch: gh api repos/daniel-ospina/tortoise/contents/docs/ONTOLOGY.md --jq .content | base64 -d (§5 = controlled vocabulary).

⛔ This file is an index — it describes WHAT the skill does, not HOW to execute it.
The actual workflow with mandatory quality gates (pre-flight checks, code review, migration safety, verification) is in the workflow/*.md files below.
Why: This skill gates operations that mutate production state or bypass quality checks. Skipping the workflow files means those gates are silently skipped — commits may bypass tests, PRs may lack review, migrations may deploy unsafely.
What to do: Read every file listed under "What you are missing" below before performing any operation this skill covers.

Extension-Enforced Gates (per-gate scoping)

Two Pi extensions enforce the quality gates below. Neither is a blanket tier rule — each has its own scoping mechanism, and neither is bypassed for code-bearing sets:

Review Enforcer (review-enforcer)

Blocks git commit/push and gh pr create/merge unless ≥1 sub-agent was dispatched this session (the task tool or the specialized-agent subagent tool — any dispatch counts).

• Scope: uniform ≥1-dispatch block — every tier (micro, standard, complex, unknown/unlabeled) blocks at 0 dispatches (#485) — see the REVIEW-ENFORCER-TIER-RULE fence in workflow/01-preflight.md (machine-read; drift-pinned to TIER_RULE in extensions/review-enforcer/index.ts)
• What it wants: ≥1 sub-agent dispatch before any git op
• What to do: Dispatch a reviewer sub-agent that returns a verdict on the diff — even a one-line reviewer must state whether the diff is sound ("NO ISSUES FOUND" or a list of issues), however small the diff. The ≥1-dispatch floor is content-free by design (#485 F2) — it counts the dispatch, not the verdict — but the reviewer you dispatch is expected to review, not to rubber-stamp. Code-bearing sets satisfy the floor via VGATE's own [VGATE] verification dispatch, whose PASS is the code-set equivalent of a returned verdict; docs-only sets dispatch a lightweight reviewer naming the diff and returning its verdict.
• Bypass: AGENT_SKIP_REVIEW_GATE=1 (emergency only)

Verification Gate (verification-gate)

Blocks git commit unless every file the commit records has been verified by a [VGATE] sub-agent — content-SHAPE gated, not tier-gated.

• Content-shape exemption: docs/CSS/static-only file sets (no build-output path segment) skip VGATE at ANY tier; code-bearing or mixed sets are NEVER exempt — see the VGATE-SHAPE-RULE fence in workflow/01-preflight.md (machine-read; drift-pinned to SHAPE_EXEMPT_EXTENSIONS + BUILD_OUTPUT_SEGMENTS in extensions/verification-gate/index.ts)
• What it wants: A task dispatch with [VGATE] verify files:<paths> in the prompt
• Response format: Must include PASS on its own line, or valid JSON: {"status": "PASS", "failures": [], "verified_files": [{"path": "...", "hash": "..."}]}
• Gotcha: Prompt must say verify files: (plural), not verify file: (singular) — the regex won't match singular.
• Bypass: ELDATO_SKIP_VGATE=1 at session start (disables the gate entirely). AGENT_ALLOW_MAIN_EDITS=1 no longer disables VGATE — it is the worktree-guard bypass only (#7470). Scope subtraction (ELDATO_VGATE_NO_SUBTRACT=1, #755) is a separate, always-on-narrowing opt-out documented in workflow/01-preflight.md — it makes the gate stricter, not weaker.

What you are missing

• workflow/01-preflight.md — git lock check, integration tests, typecheck, build, pgTAP, issue/branch/tier detection
• workflow/02-commit-pr.md — staging, commit message, draft PR, tier fallback classification
• workflow/03-code-review.md — code review gate, fix loop, NVIDIA pattern scan, tier scaling
• workflow/04-merge-deploy.md — merge, edge function deploy, migration safety verification
• workflow/05-cleanup.md — branch cleanup, worktree teardown, post-merge documentation & memory verification (read-only)

What fails if you skip

Continue following the workflow as mandated by this skill. Do not skip steps.