Merge pull request #48 from Curabis/setup/stable-release-channel

Hardening: stable-udrulningskanal + Ishikawa v2 (dynamisk regelopslag)

CONSUMPTION.md

@@ -38,6 +38,31 @@ future CI/PR-review integration:
   currently consumed by nothing. Keep it — but do not mistake it for active
   configuration of the session model.
 
+## Release channel: `stable`
+
+Merging to `main` is **not** a deployment. All consumers — the machine
+CLAUDE.md auto-update, `sync-bcquality-knowledge.ps1`, the setup agent's
+fetch URLs, and the agent templates' knowledge references — read from the
+**`stable`** branch, never from `main`. `main` is where PRs land and CI runs;
+`stable` is what every developer machine actually executes.
+
+Deploying is a deliberate act (Michael only):
+
+    git checkout stable
+    git merge --ff-only main
+    git push origin stable
+    git checkout main
+
+Optionally cut a version tag at the same commit (`git tag vX.Y.Z && git push
+origin vX.Y.Z`) for a historical record. If a bad change reaches `stable`,
+roll back by force-moving `stable` to the previous good commit — consumers
+follow the branch, so recovery is one push.
+
+Rationale: `main` used to be the live deploy channel — any merge silently
+overwrote `bc-mcp-bridge.js` (which handles S2S credentials) on every
+developer machine at next session start. The `stable` gate separates "CI
+accepted it" from "the organization runs it".
+
 ## Known deltas to close before activating the Entry flow
 
 1. **`custom/skills/` is empty.** The CURABIS review pass lives in the

custom/agents/francis.agent.md

@@ -78,7 +78,7 @@ reviews what happened. He asks one question about every significant event:
 
 He compares against the full BCQuality knowledge base:
 ```
-BASE = https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge
+BASE = https://raw.githubusercontent.com/Curabis/BCQuality/stable/custom/knowledge
 ```
 Domains: `architecture/`, `testing/`, `mcp/`
 

custom/scripts/Invoke-CurabisEvidence.ps1

@@ -29,7 +29,7 @@ param(
     [string]$BCQualityHome,
 
     # Bruges naar der ikke er en lokal klon: knowledge-filer HTTP-tjekkes herfra.
-    [string]$RawBase = 'https://raw.githubusercontent.com/Curabis/BCQuality/main',
+    [string]$RawBase = 'https://raw.githubusercontent.com/Curabis/BCQuality/stable',
 
     [switch]$Quiet
 )

custom/setup/curabis-standard.agent.md

@@ -1,7 +1,7 @@
 ---
 kind: action-skill
 id: curabis-standard-setup
-version: 9
+version: 10
 title: CURABIS Standard — Project Setup
 description: >
   Configures a new or existing repository to the CURABIS Standard development
@@ -37,8 +37,8 @@ Detect which mode based on the trigger phrase and proceed accordingly.
 ## Source URLs (BCQuality — always fetch fresh)
 
 ```
-BASE        = https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/setup
+BASE        = https://raw.githubusercontent.com/Curabis/BCQuality/stable/custom/setup
-AGENTS_BASE = https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/agents
+AGENTS_BASE = https://raw.githubusercontent.com/Curabis/BCQuality/stable/custom/agents
 ```
 
 | Artefakt | URL |
@@ -168,7 +168,7 @@ If `~/.claude/bcquality-knowledge/` is missing or empty, self-heal before contin
 
 If the sync script itself is missing, first download it AS RAW BYTES (do not
 decode/re-encode — use `Invoke-WebRequest -OutFile`) from
-`https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/setup/sync-bcquality-knowledge.ps1`
+`https://raw.githubusercontent.com/Curabis/BCQuality/stable/custom/setup/sync-bcquality-knowledge.ps1`
 to `~/.claude/sync-bcquality-knowledge.ps1`, then run it.
 
 These rules are always active.

custom/setup/machine/CLAUDE.md

@@ -8,11 +8,11 @@ These instructions apply to every Claude Code session, regardless of project.
 If the current project has `.github/.agents/bcquality.agent.md`:
 
 1. Fetch the latest commit SHA for `custom/setup/` in BCQuality:
-   `https://api.github.com/repos/Curabis/BCQuality/commits?path=custom/setup&per_page=1`
+   `https://api.github.com/repos/Curabis/BCQuality/commits?path=custom/setup&sha=stable&per_page=1`
 2. Read stored SHA from `~/.claude/.bcquality-version` (may not exist yet)
 3. If SHA is different (or file missing):
    a. Fetch and execute Mode B from:
-      `https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/setup/curabis-standard.agent.md`
+      `https://raw.githubusercontent.com/Curabis/BCQuality/stable/custom/setup/curabis-standard.agent.md`
    b. Write new SHA to `~/.claude/.bcquality-version`
    c. Report: "BCQuality opdateret til [short-sha] — [antal] filer tjekket"
 4. If SHA is unchanged: continue silently
@@ -25,7 +25,7 @@ unless something actually changed.
 When the user says either of these commands, fetch and follow the setup agent:
 
 ```
-https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/setup/curabis-standard.agent.md
+https://raw.githubusercontent.com/Curabis/BCQuality/stable/custom/setup/curabis-standard.agent.md
 ```
 
 - **"Konfigurer dette projekt til CURABIS Standard"** → fuld setup af nyt repo

custom/setup/sync-bcquality-knowledge.ps1

@@ -20,7 +20,7 @@
 $ErrorActionPreference = 'Stop'
 
 $repo    = 'Curabis/BCQuality'
-$branch  = 'main'
+$branch  = 'stable'
 $dest    = Join-Path $env:USERPROFILE '.claude\bcquality-knowledge'
 $staging = "$dest.tmp"
 $rawBase = "https://raw.githubusercontent.com/$repo/$branch"

custom/setup/templates/al-triage.agent.md

@@ -57,13 +57,13 @@ Loop: **reproduce -> root-cause -> minimal-fix recommendation.**
 Layer 1 - Microsoft BCQuality: https://github.com/microsoft/BCQuality
 
 Layer 2 - CURABIS custom knowledge (fetch before citing a finding):
-- https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/architecture/pages-must-not-contain-business-logic.md
+- https://raw.githubusercontent.com/Curabis/BCQuality/stable/custom/knowledge/architecture/pages-must-not-contain-business-logic.md
-- https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/architecture/namespace-must-be-verified-from-source.md
+- https://raw.githubusercontent.com/Curabis/BCQuality/stable/custom/knowledge/architecture/namespace-must-be-verified-from-source.md
-- https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/architecture/al-identifiers-must-be-english.md
+- https://raw.githubusercontent.com/Curabis/BCQuality/stable/custom/knowledge/architecture/al-identifiers-must-be-english.md
-- https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/architecture/clarify-before-building.md
+- https://raw.githubusercontent.com/Curabis/BCQuality/stable/custom/knowledge/architecture/clarify-before-building.md
-- https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/testing/test-setup-must-use-library-codeunit.md
+- https://raw.githubusercontent.com/Curabis/BCQuality/stable/custom/knowledge/testing/test-setup-must-use-library-codeunit.md
-- https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/testing/test-data-must-be-random-and-complete.md
+- https://raw.githubusercontent.com/Curabis/BCQuality/stable/custom/knowledge/testing/test-data-must-be-random-and-complete.md
-- https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/testing/tests-must-adapt-to-existing-code.md
+- https://raw.githubusercontent.com/Curabis/BCQuality/stable/custom/knowledge/testing/tests-must-adapt-to-existing-code.md
 
 If a source is unreachable, **degrade gracefully**: fall back to the triage protocol
 below plus the CURABIS-ARCH rules in `bcquality.agent.md`, note that BCQuality was

custom/setup/templates/bcquality.agent.md

@@ -1,7 +1,7 @@
 ---
 kind: action-skill
 id: curabis-al-code-review
-version: 1
+version: 2
 title: CURABIS AL code review
 description: Reviews AL source changes against BCQuality knowledge and CURABIS-specific architecture rules.
 inputs: [pr-diff, file-path]
@@ -46,29 +46,22 @@ of the quality in the code they write.
 
 Layer 1 - Microsoft BCQuality: https://github.com/microsoft/BCQuality
 
-Layer 2 - CURABIS custom knowledge (fetch before applying rules):
+Layer 2 - CURABIS custom knowledge. Never a hardcoded file list — the rulebook
-- https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/architecture/pages-must-not-contain-business-logic.md
+grows, and a frozen list silently drops every rule added after it was written.
-- https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/architecture/namespace-must-be-verified-from-source.md
+Resolve the current rule set at review time, in this order:
-- https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/architecture/al-identifiers-must-be-english.md
+
-- https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/architecture/clarify-before-building.md
+1. **Machine mirror (preferred — Claude Code sessions):** read ALL files under
-- https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/architecture/xliff-translation-workflow.md
+   `~/.claude/bcquality-knowledge/custom/` (Windows:
-- https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/architecture/new-file-requires-vscode-refresh.md
+   `%USERPROFILE%\.claude\bcquality-knowledge\custom\`). The mirror is synced
-- https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/architecture/exposed-objects-must-be-in-a-permission-set.md
+   from the `stable` release channel and is always the complete custom layer.
-- https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/architecture/shared-project-memory-must-be-in-repo.md
+2. **Fallback (no mirror — Copilot, fresh machine, CI):** list the tree via
-- https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/architecture/commit-message-must-include-bc-task-id.md
+   `https://api.github.com/repos/Curabis/BCQuality/git/trees/stable?recursive=1`
-- https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/architecture/branch-merge-to-main-workflow.md
+   filtered to `custom/knowledge/**/*.md`, and fetch each file from
-- https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/testing/test-setup-must-use-library-codeunit.md
+   `https://raw.githubusercontent.com/Curabis/BCQuality/stable/<path>`.
-- https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/testing/test-data-must-be-random-and-complete.md
+
-- https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/testing/tests-must-adapt-to-existing-code.md
+Relevance filtering: `custom/` rules are always active in CURABIS repos — read
-- https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/testing/test-one-when-per-test.md
+them all; use each file's frontmatter `domain`/`keywords` only to prioritize,
-- https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/testing/ui-test-codeunit-naming.md
+never to skip.
-- https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/testing/test-feature-scenario-tags.md
-- https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/mcp/api-page-flowfields-must-be-calcfields.md
-- https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/mcp/stored-derived-fields-must-not-be-exposed-directly.md
-- https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/mcp/api-page-key-fields-must-be-editable-on-insert.md
-- https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/mcp/api-page-least-privilege-write-access.md
-- https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/mcp/agent-must-not-write-business-process-status.md
-- https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/mcp/bc-mcp-find-active-task-for-branch.md
 
 ## Action