epic(governance): establish just-in-time issue sealing, native project metadata sync, and isolated epic branching protocol (#12)

[nicolasvd]

Closes #12
Closes #13
Closes #15
Closes #17

🏛️ Epic Architectural Delivery — Consolidated Walkthrough

Branch: epic/issue-12-jit-sealing-epic-protocol → main
Type: epic(governance)
Epic Issue: #12 epic(governance): establish just-in-time issue sealing, native project metadata sync, and isolated epic branching protocol
Parent Milestone: v1.0.0 · Project: Board #2 (Agentic Delivery Board)
Priority: P1 · Size: L · Estimate: 3.5d

---

📌 Epic Executive Summary

This Epic accomplishes the fundamental architectural transformation of the Agentic Android Delivery Kernel, establishing:

1. Just-In-Time (JIT) Issue Sealing Protocol: Completely eradicates upfront speculative tickets and unsealed scratchpad issues. Issues are elaborated locally via implementation_plan.md (issue: null), paused strictly at Gate 1.4 for human review, and sealed atomically once approved via ./scripts/seal-issue.sh --from-plan.
2. Native GitHub Projects v2 Custom Field Synchronization: Eliminates fragile narrative metadata blocks (**Metadata**: Milestone ... Priority ...) from issue bodies and comments. Custom fields (Priority, Size, Estimate, Status) are natively synchronized via GraphQL using scripts/sync-project-metadata.mjs.
3. Template Decoupling & Narrative Purge: Redesigns .agent/templates/4-pillar-spec.md (v2.1.0), epic-spec.md (v2.0.0), pr-walkthrough.md, and issue forms (feature_idea.yml, bug_report.yml) into pure, immutable technical contracts.
4. Epic Branch Isolation Protocol (epic/issue-<id>-<slug>): Epics establish an isolated integration container branch. Direct commits/merges on epic/** are prohibited by runtime hook guards. Child tasks branch from and merge sequentially into the Epic branch (skip-release) before a final release PR lands on main.
5. Dynamic CI Diff Detection & Base Synchronization: Replaces static origin/main...HEAD comparisons in .github/workflows/delivery-pipeline.yml with dynamic origin/${{ github.base_ref || 'main' }}...HEAD, and equips .agent/hooks/post-merge-dual-sync.sh with dynamic base checkout and automatic branch cleanup.

---

🗺️ Completed Sequential Child Tasks

Child Issue	Title	Type	LOC Diff	Status	PR
#13	feat(tooling): implement deterministic issue sealing script and project metadata sync	feat(tooling)	+355	✅ Merged	#14
#15	chore(templates): decouple issue forms and templates from narrative metadata	chore(templates)	+54 / -61	✅ Merged	#16
#17	feat(governance): harden governance rules, hook guards, and CI pipeline for epic branching	feat(governance)	+192 / -186	✅ Merged	#18

---

📂 Consolidated Affected Files

Component / Layer	Files Modified	Impact
Deterministic Tooling	scripts/seal-issue.sh, scripts/sync-project-metadata.mjs, scripts/install-hooks.sh	JIT sealing CLI, GraphQL Projects v2 sync, type mapping
Governance Specs	AGENTS.md, agent.md, .agent/rules/agent-lifecycle.md, backlog-planner.md, git-workflow.md	Rule 0 (JIT), Rule 0.1 (Epic Branch Isolation), strict WIP=1
Persona Manifests	.agent/personas/p1-product-planner.md, .agent/personas/p4-system-architect.md	Sizing ownership, JIT hand-off, DAG decomposition
Semantic Skills	.agent/skills/plan-issue/SKILL.md, .agent/skills/open-pr/SKILL.md	Operational recipes for JIT sealing & base branch targeting
Templates & Forms	.agent/templates/*.md, .github/ISSUE_TEMPLATE/*.yml	Decoupled pure specs, generalized kernel domains
Runtime Guardrails	.agent/hooks/branch-guard.mjs, plan-guard.mjs, post-merge-dual-sync.sh, pre-invocation-anchor.sh	Runtime protection on epic/*, dynamic sync, anchor contexts
Test Suites & CI	scripts/test-runtime-guardrails.mjs, .github/workflows/delivery-pipeline.yml	31 runtime assertions, epic/** PR trigger, dynamic diffs

---

✅ Quality Airbag & Verification Table

Verification Check	Target / Assert	Result
Contract Byte Budgets	./scripts/validate-docs.sh	✅ 40/40 contracts valid (100% compliant)
Runtime Guardrails Suite	node scripts/test-runtime-guardrails.mjs	✅ 31/31 assertions passed (PoLP, plan guard, branch guard)
Code Inspection & Tests	./scripts/quality-check.sh	✅ 0 compilation errors · 0 lint warnings · 100% tests green (518ms)
Pre-commit Airbag	.agent/hooks/pre-commit-airbag.sh	✅ Validated all commit boundaries and contracts
GraphQL Field Sync	node scripts/sync-project-metadata.mjs	✅ Verified atomic updates for Priority, Size, Estimate, Status

---

📸 UI Snapshots / Roborazzi Visual Diffs

N/A — No UI composables or visual assets touched. Pure multi-agent governance and delivery architecture.

---

Caution

Zero Auto-Merge Lock (Gate 3.5)
This is the final consolidated Epic Pull Request merging epic/issue-12-jit-sealing-epic-protocol into main.
It intentionally omits skip-release to trigger standard CI distribution upon merge.
Persona 6 presents this PR link and stops. Merge is a deliberate human confirmation.