Enforce T3 sign-off records for --allow-t3 (default on, private record path, no opt-out)

.gitattributes

@@ -12,3 +12,6 @@
 *.webp binary
 # Generated SVGs are hashed into docs/images/.showcase.json; keep their bytes identical on every OS
 *.svg text eol=lf
+# Docs and the changelog stay LF: a CRLF commit rewrites every line and conflicts every branch (CHANGELOG Unreleased)
+CHANGELOG.md text eol=lf
+references/*.md text eol=lf

.github/workflows/quality.yml

@@ -24,7 +24,7 @@ jobs:
       - name: Install Python quality dependencies
         run: |
           python -m pip install --upgrade pip
-          python -m pip install -r requirements.txt ruff==0.17.2 pyyaml==6.0.3 pytest==9.1.1
+          python -m pip install -r requirements.txt ruff==0.17.2 pyyaml==6.0.3 pytest==9.1.1 jsonschema==4.25.1
       - name: Install diagram and type-check tools
         run: npm install -g @mermaid-js/mermaid-cli pyright
       - name: Verify the bundled OFL fonts

.github/workflows/test-portability.yml

@@ -21,6 +21,6 @@ jobs:
         with:
           python-version: '3.12'
       - name: Install test dependencies
-        run: python -m pip install -r requirements.txt pytest==9.1.1
+        run: python -m pip install -r requirements.txt pytest==9.1.1 jsonschema==4.25.1
       - name: Run the full test suite
         run: python -m pytest -q

CONTRIBUTING.md

@@ -28,7 +28,7 @@ Use synthetic fixtures and new output paths instead of overwriting committed pre
 The full gate for this repository adds the test suite and the showcase quality gates to the package baseline:
 
 ```bash
-python -m pip install -r requirements.txt ruff==0.17.2 pytest==9.1.1
+python -m pip install -r requirements.txt ruff==0.17.2 pytest==9.1.1 jsonschema==4.25.1
 python -m pytest -q
 python scripts/validate_quality.py
 ```

ONBOARDING.md

@@ -68,7 +68,7 @@ For a multi-skill handoff, preserve the source facts, artifact paths, `logs[]` c
 
 ## Safety and permissions
 
-The documented generation workflow is local. Installation may contact GitHub and package indexes. `meta --from-gh` and the opt-in `org labels ORG --repos-from-gh` mode make read-only `gh api` GETs. `fonts --fetch` downloads the pinned fonts. Org-wide label planning emits proposed jobs for review; it never applies them. Generation does not push commits, change descriptions, topics, labels or settings, publish documents, grant approval or install background services. Review the boundaries in [SKILL.md](SKILL.md) before using real repositories.
+The documented generation workflow is local. Installation may contact GitHub and package indexes. `meta --from-gh` and the opt-in `org labels ORG --repos-from-gh` mode make read-only `gh api` GETs. `fonts --fetch` downloads the pinned fonts. Org-wide label planning emits proposed jobs for review; it never applies them. Generation does not push commits, change descriptions, topics, labels or settings, publish documents, grant approval or install background services. T3 (co-owned) owners are refused unless `--allow-t3` is passed for one approved invocation; the claim is checked by default against a sign-off record in the private estate bundle (`decisions/t3-signoffs.yaml`, or `--t3-signoff-file PATH`; there is no opt-out) ([references/t3-signoff.md](references/t3-signoff.md)). Keep real sign-off records in the private estate bundle; never copy them into a repository. Review the boundaries in [SKILL.md](SKILL.md) before using real repositories.
 
 ## Troubleshooting and verification
 

SKILL.md

@@ -55,7 +55,7 @@ Every surface uses one **dark** design on both GitHub themes (decision 21): navy
 | A set must be reviewed the way GitHub shows it | `contact-sheet` |
 | Coverage must be reported or a repository verified as done | `lint all`, then `doctor` |
 
-Do not use it for accounts outside the estate. Excluded owners (BunsDev, GoZippy, h-mascot, lmvdz, GalaxyRuler, and per decisions 1 and 2 MetatronAngelAgent and PrompDev) and T3 owners before co-owner sign-off (Pick-Your-AI, Jevelopers-neatHack-2026) are refused with exit 2.
+Do not use it for accounts outside the estate. Excluded owners (BunsDev, GoZippy, h-mascot, lmvdz, GalaxyRuler, and per decisions 1 and 2 MetatronAngelAgent and PrompDev) are refused with exit 2, and T3 owners before co-owner sign-off (Pick-Your-AI, Jevelopers-neatHack-2026) are refused with exit 2 unless the global `--allow-t3` is passed for that run.
 
 ## Boundaries
 
@@ -73,7 +73,7 @@ Run every command **from inside the target repository's checkout**, with the ski
 
 | Step | Command | Gate |
 |---|---|---|
-| 1 | `meta --from-gh OWNER/REPO --out meta.json`, or pass an existing `--meta` file. It also records `pushed_at` and `last_substantive_commit` (CQ-16: the newest default-branch commit whose message does not match `ct-std-v1\|showcase banner and card\|\[skip ci\]`) | Refused owners stop here (exit 2); T3 owners pass only with `--allow-t3`, after an approved `t3-metadata` or `t3-signoff` row. Watching-org forks get metadata only. Archived repositories are in scope (decision 6): the orchestrator unarchives, polishes and re-archives them. |
+| 1 | `meta --from-gh OWNER/REPO --out meta.json`, or pass an existing `--meta` file. It also records `pushed_at` and `last_substantive_commit` (CQ-16: the newest default-branch commit whose message does not match `ct-std-v1\|showcase banner and card\|\[skip ci\]`) | Refused owners stop here (exit 2); T3 owners pass only with `--allow-t3`, after an approved `t3-metadata` or `t3-signoff` row. `--allow-t3` also needs, by default, a valid, unexpired record in the private estate file `<estate root>/decisions/t3-signoffs.yaml` (or the file named by the global `--t3-signoff-file PATH` / `SHOWCASE_T3_SIGNOFF_FILE`, which overrides it), in the format of [references/t3-signoff.md](references/t3-signoff.md) (`id`, `owner`, `repos`, `approved`, `approver`, `approved_on`, `expires`, optional `note`), else exit 2 with `t3-signoff:no-file|missing|invalid|expired|scope|revoked` (`no-file` names the resolved path; the tool never creates the file). Watching-org forks get metadata only. Archived repositories are in scope (decision 6): the orchestrator unarchives, polishes and re-archives them. |
 | 2 | `describe` | `keep`, `edit` (smallest passing edit, in `proposed`) or `needs-writer`. On `needs-writer`, write the sentence yourself from the template in [references/descriptions.md](references/descriptions.md) and the repository's facts, then re-run `describe --text "..."` until it answers `keep`. The tool never composes it. |
 | 3 | `topics`, `labels --plan` | Proposals only. Add `--records FILE` to emit change records, `--gh` to print the exact `gh` commands. |
 | 4 | Apply the approved description and topics on GitHub (the writer), or write them into `meta.json` | Before any art: the banner subtitle, the card and the README tagline come from the description, so rendering first breaks R2 (tagline equals description) the moment the writer applies the new one. |
@@ -111,6 +111,8 @@ python3 $S --meta /tmp/meta.json doctor --header
 
 Checks (`describe`, `topics`, `labels`, `readme`, `footer`, `meta`, `fingerprint`, `config`) print one JSON object with `command`, `owner`, `repo`, `result` and `logs[]`; `lint` prints one JSON line per file; `org`, `project`, `enterprise` and `content` print one JSON object with `action` (`org doctor --doctor-format tsv|md` prints a row). Generators (`banner`, `card`, `org-banner`, `org-tile`, `intro`, `contact-sheet`) print a short text summary by default; pass the global `--format json` (before the command) for the same JSON object. `doctor` prints a TSV row (`--format json|md` after `doctor`). In text mode a refusal goes to stderr. Log codes are the standard's: `needs-input:<detail>`, `art-fail`, `topics-short`, `label-conflict`, `label-referenced`, `label-rewrite-first`, `needs-input:label-references` (a rename held because §6.4 rule 0 needs a checkout: re-plan with `--repo-dir`), `readme-shrink`, `dead-link`, `exempt`, `hold`, `t3-signoff`, `archived`, plus `needs-input:metadata` (a failed metadata capture, exit 4), `needs-input:file-tree` (no checkout and no tree in the metadata, so the type is provisional), `needs-input:visibility`, `needs-input:banner-chips` (fewer than two chips), `needs-input:key-chip` (no gold chip: the type category would repeat the eyebrow), `needs-input:subtitle` (no one-line subtitle: add `subtitle:`), `type-override:<type>`, `type-config:<type>` (from `.github/showcase.yml`) and `bootstrap:edited`.
 
+**Co-owner sign-off (`--allow-t3`).** `--allow-t3` is a global option placed before the command (`python3 $S --allow-t3 --meta meta.json banner`). It applies to every repository command, generator, `lint` and the `org`, `project` and `content` groups, not only `meta`; `meta`, `org` and `project` also accept it after the command name. Pass it only for one explicitly approved invocation, after an approved `t3-metadata` or `t3-signoff` row. Without it a T3 owner (Pick-Your-AI, Jevelopers-neatHack-2026) is refused: exit 2, result `refused`, log `t3-signoff`. Three commands never refuse a T3 owner and need no flag: repository `doctor` always admits T3 owners (the code passes `allow_t3=True`; it still refuses excluded owners, log `exempt`, and HOLD owners, log `hold`) and holds the R7 cell unless `--allow-t3` is passed and a valid sign-off record covers the owner and repository (then R7 is evaluated normally; otherwise it stays `hold`, and `doctor` is read-only so it logs no `t3-signoff` code); `meta` without `--from-gh` only normalizes a local file (only `--from-gh` is gated, and it never checks eligibility); and `fingerprint` never checks the owner. With the flag, excluded owners (log `exempt`) and HOLD owners (log `hold`) are still refused by repository commands and generators; the flag lifts only the T3 refusal. The org actions `about`, `pins`, `health` and `doctor` admit a HOLD org with or without the flag (they pass `allow_hold`), so the HOLD refusal does not apply to them. It holds for that one invocation only and is off again afterwards; the flag itself is never read from a config file or environment (only the record-file path `SHOWCASE_T3_SIGNOFF_FILE` is). Sign-off enforcement is on by default and cannot be turned off: `--allow-t3` is honoured only while a valid, unexpired sign-off record covers the owner and repository (step 1 above), otherwise exit 2 with log `t3-signoff:missing`, `t3-signoff:expired`, `t3-signoff:scope` or `t3-signoff:revoked` (a later or same-day `approved: false` record vetoes the grant for every repository the withdrawal covers, so a co-owner can withdraw one repository from a `*` or multi-repository grant, whether repositories are written as a bare name or `OWNER/NAME` under the owner or any alias; a malformed withdrawal that could cover the request is `t3-signoff:invalid`, never ignored; owner-wide `org profile` and `org pins` repeat the check per repository, so a repository withdrawn from a `*` grant is omitted or held (log `t3-signoff:<code>:<login>/<repo>`) while the org's other repositories stay authorized; `org profile` additionally requires the sign-off of the org's own `.github` repository, the profile's destination, so a `.github`-scoped withdrawal holds the profile (log `t3-signoff:<code>:OWNER/.github`, nothing built or written, existing README and data.json untouched) while the individual repository checks still apply inside it; and `project estate-plan` also holds the Org option update and README when the board's captured Org options name a T3 org without a valid record; `project estate-plan --allow-t3` logs `t3-signoff:<code>:<login>` for every T3 org it omits for lack of a valid record; a malformed `repos` is always `t3-signoff:invalid`, even beside a valid unrelated grant; `expires` is optional and absent means no expiry; also `t3-signoff:no-file` when the resolved record file does not exist or no estate root resolves, and `t3-signoff:invalid` when the owner's records break [the schema](references/t3-signoff.schema.json)). There is no opt-out: no flag or environment variable turns the check off. A record dated in the future, or expiring before its approval date, is `t3-signoff:invalid`. Writer jobs carry the granting record as `signoff_id` only (`approval_id` stays untouched: it names the decisions/APPROVED_ACTIONS.yaml row), change records carry `signoff_id`, and repository `doctor` (read-only) adds a trailing `signoff_id` column only when `--allow-t3` is passed, so the documented row shape is unchanged otherwise. Record ids must be unique within the file (a repeated id refuses `t3-signoff:invalid`). Transfer-target holds (an approved pending transfer into a T3 org) apply only when `--allow-t3` is passed. The record file is read, never copied or created; its canonical private path is `<estate root>/decisions/t3-signoffs.yaml` (estate root: `SHOWCASE_ESTATE_ROOT`, else the skill's parent bundle), resolved in the order `--t3-signoff-file`, `SHOWCASE_T3_SIGNOFF_FILE`, then that default. Sign-off ids already on a job are merged, not replaced, when an Org or association grant is stamped, and direct `project copy-plan --role estate` stamps captured T3 Org options exactly as `project estate-plan` does: the README job of a copied Estate board carries the granting ids of every retained captured T3 Org option directly (not rediscovered from the rendered text), so an option kept under a former login and a different captured label still names its record. A captured Org option is recognized by its description (`T3: <login>`) and by its option name independently: an unresolved or empty description (for example `T3: obsolete-login` or `T3: `) never hides an option name that is a known T3 org's display name, so that option is checked for a valid record and the Org option update and README are held (`t3-signoff:<code>:<login>`) when there is none. The Org-options mutation of a retained option carries the option's `signoff_id` (merged with ids already on the job), also when the captured label differs from the org's current names.
+
 ## Orgs, Projects, the Enterprise and Content
 
 CLI stdout and stderr use UTF-8, including redirected Windows output, raw footer markup,
@@ -166,7 +168,7 @@ python3 $S --meta meta.json content links --base-ref origin/main --diff     # in
 ## Command Reference
 
 ```text
-python3 <skill-dir>/scripts/showcase.py [--config PATH] [--repo-dir DIR | --no-repo-dir] [--meta FILE] [--type TYPE] [--format json|text] [--quiet] [--version] <command> [options]
+python3 <skill-dir>/scripts/showcase.py [--config PATH] [--repo-dir DIR | --no-repo-dir] [--meta FILE] [--type TYPE] [--format json|text] [--quiet] [--allow-t3] [--t3-signoff-file PATH] [--version] <command> [options]
 
 meta --from-gh OWNER/REPO [--out FILE] [--allow-t3]
 fingerprint [--out-dir docs/images] [--github-output]

references/constraints.md

@@ -26,7 +26,7 @@ Condensed from `ct-std-v1` §10 and §12. The skill proposes; a single serialize
 1. **One serialized writer queue** for every REST call, git push and UI write. Planners and this skill emit change records.
 2. **Change record:** `{std, owner, repo, kind: api|file|ui, target, before_sha256, after, rule}`. The writer rejects a record whose `before` no longer matches the live state. Commands that propose writes take `--records FILE`.
 3. **Diff first.** GET, compute the delta, write only the delta, GET again to verify. Never write a value that is already equal.
-4. **Log every write with its rule** and every skip with a code: `needs-input[:DETAIL]`, `license-review`, `label-conflict`, `label-referenced`, `label-rewrite-first`, `needs-input:label-references`, `hold`, `t3-signoff`, `archived`, `topics-short`, `dead-link`, `fork-parent-missing`, `pages-mismatch`, `pages-readme-index`, `homepage-review`, `readme-shrink`, `apache-notice-review`, `art-fail`, `exempt`, `deploy-relink`, `dns-update`, `ui-danger-dialog`.
+4. **Log every write with its rule** and every skip with a code: `needs-input[:DETAIL]`, `license-review`, `label-conflict`, `label-referenced`, `label-rewrite-first`, `needs-input:label-references`, `hold`, `t3-signoff` (always enforced: `t3-signoff:no-file|missing|invalid|expired|scope|revoked`, see [t3-signoff.md](t3-signoff.md)), `archived`, `topics-short`, `dead-link`, `fork-parent-missing`, `pages-mismatch`, `pages-readme-index`, `homepage-review`, `readme-shrink`, `apache-notice-review`, `art-fail`, `exempt`, `deploy-relink`, `dns-update`, `ui-danger-dialog`.
 5. **Never commit logs** or the moves list to a public repository: they name private repositories.
 
 ## Content commits

references/labels.md

@@ -15,7 +15,7 @@ GitHub limits: hex colours without `#`; descriptions at most 100 characters; ren
 - **`.github` repos** always get the standard set, whatever their `has_issues`.
 - **AI-Ascension:** keeps its `labels.yml` and color tokens. R6 there means only that `dependencies` exists (`0366d6`, the standard set description); its Dependabot configs use `labels: ["dependencies"]`.
 - **Don't apply** to T2-R, T3, HOLD, forks or archived repos.
-- `labels --plan` (one repository) applies the same gates as `org labels`: a family on hold is refused (exit 2) unless `--allow-hold`; a T3 owner is refused (exit 2, `t3-signoff`) until co-owner sign-off, as `org labels` refuses it without `--allow-t3`; AI-Ascension gets only the `dependencies` create or patch; a repository with `has_issues: false` other than `.github`, forks, archived repositories (`archived`), T2-R and romgenie repositories answer `n/a`. Metadata without labels (a missing key, or `[]`, which is also what a failed capture records) is never planned against: whenever argv, writer jobs (`--jobs`), records (`--records`) or `gh` lines leave, `labels` reads the live labels first (read-only GET) and exits 4 (`needs-input:gh`) when it cannot. Writer job ids come from the operation (`p3.2-OWNER__REPO-label-<create|edit>-<name>[-to-<new>]-<hash8>` for `labels --plan` and `org labels`, `p3:label:OWNER__REPO:<create|edit>:<name>[-to-<new>]:<hash8>` for `adopt`), so a re-plan never reuses an id for other content.
+- `labels --plan` (one repository) applies the same gates as `org labels`: a family on hold is refused (exit 2) unless `--allow-hold`; a T3 owner is refused (exit 2, `t3-signoff`) until co-owner sign-off, as `org labels` refuses it without `--allow-t3` (and, with it, without a valid record in the estate sign-off file, `t3-signoff:<why>`; [t3-signoff.md](t3-signoff.md)); AI-Ascension gets only the `dependencies` create or patch; a repository with `has_issues: false` other than `.github`, forks, archived repositories (`archived`), T2-R and romgenie repositories answer `n/a`. Metadata without labels (a missing key, or `[]`, which is also what a failed capture records) is never planned against: whenever argv, writer jobs (`--jobs`), records (`--records`) or `gh` lines leave, `labels` reads the live labels first (read-only GET) and exits 4 (`needs-input:gh`) when it cannot. Writer job ids come from the operation (`p3.2-OWNER__REPO-label-<create|edit>-<name>[-to-<new>]-<hash8>` for `labels --plan` and `org labels`, `p3:label:OWNER__REPO:<create|edit>:<name>[-to-<new>]:<hash8>` for `adopt`), so a re-plan never reuses an id for other content.
 - **Org default labels** [UI]: all T1 orgs and the T2 product orgs except AI-Ascension, which uses its own `labels.yml`. None for the romgenie orgs or CompleteDotTech. Removing GitHub's default entries from org defaults is exempt from the approval list.
 
 ## The standard set: 23 labels

references/org.md

@@ -14,7 +14,7 @@ python3 $S org health  ORG [--dot-github CHECKOUT]                  # O4: §8.1
 python3 $S org doctor  ORG --snapshot org-snapshot.json [--dot-github CHECKOUT] [--avatar avatar.png] [--doctor-format tsv|json|md] [--header]
 ```
 
-Every action takes `ORG` (any former login resolves, see below), `--registry`, `--meta-dir`, `--decisions`, `--approved`, `--approved-yaml`, `--actions`, `--allow-t3` and `--jobs FILE` (append the writer jobs as JSON lines).
+Every action takes `ORG` (any former login resolves, see below), `--registry`, `--meta-dir`, `--decisions`, `--approved`, `--approved-yaml`, `--actions`, `--allow-t3` and `--jobs FILE` (append the writer jobs as JSON lines). The global `--allow-t3` (before the command) is equivalent. Either needs a valid sign-off record by default (`<estate root>/decisions/t3-signoffs.yaml` or `--t3-signoff-file`; `t3-signoff:no-file|missing|invalid|expired|scope|revoked` otherwise, see [t3-signoff.md](t3-signoff.md)); there is no opt-out.
 
 | Action | Reads | Emits | Writes |
 |---|---|---|---|