Release v1.6.0: CI gate, release tail, plugin manifests, org YAML, review-upgrade

.claude-plugin/marketplace.json

@@ -0,0 +1,29 @@
+{
+  "name": "pkgreview",
+  "owner": {
+    "name": "openwashdata"
+  },
+  "metadata": {
+    "description": "The openwashdata package review skills: review-package, review-issue, create-next-issue, review-status, review-complete, review-upgrade, create-release, add-doi.",
+    "version": "1.6.0"
+  },
+  "plugins": [
+    {
+      "name": "pkgreview",
+      "description": "Review workflow for R data packages in registered organizations: issue-per-area review on dev, release and DOI skills, standard upgrades. The skills read shared references from skills/pkgreview-core.",
+      "version": "1.6.0",
+      "source": "./",
+      "strict": false,
+      "skills": [
+        "./skills/review-package",
+        "./skills/review-issue",
+        "./skills/create-next-issue",
+        "./skills/review-status",
+        "./skills/review-complete",
+        "./skills/review-upgrade",
+        "./skills/create-release",
+        "./skills/add-doi"
+      ]
+    }
+  ]
+}

.claude-plugin/plugin.json

@@ -0,0 +1,5 @@
+{
+  "name": "pkgreview",
+  "version": "1.6.0",
+  "description": "Review workflow for R data packages in registered organizations (openwashdata, Global Health Engineering): issue-per-area review on dev, release and DOI skills, standard upgrades."
+}

.github/ISSUE_TEMPLATE/proposal.md

@@ -0,0 +1,26 @@
+---
+name: Proposal
+about: A change to the tooling or the standard, decided by an objection window unless the choice is open
+title: ""
+labels: enhancement
+---
+
+## Problem
+
+What is wrong or missing today, with the evidence (a release, a review, a file).
+
+## Proposal
+
+The change, concretely: which files, which skills, which check lines. Add an Options section only when the choice is genuinely open; otherwise this section is the decision unless an objection arrives.
+
+## Tasks
+
+- [ ]
+
+## Acceptance
+
+What must be true afterwards; for standard changes, the fixture gate outcome.
+
+## Objection window
+
+Until [date, two weeks out]. Without an objection recorded here by then, the proposal stands and is implemented in the next release; an objection turns this into a decision issue with options.

.github/workflows/gate.yaml

@@ -0,0 +1,36 @@
+# Mechanical fixture gate, check-script case suite, and repository lint
+# (openwashdata/pkgreview#72). The gate diffs the check script's report on the
+# fixtures against fixtures/expected/; a changed FAIL, FLAG, or NOT RUN line
+# fails here until the expected report is updated in the same change.
+name: gate
+
+on:
+  push:
+    branches: [main, dev]
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  fixture-gate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: r-lib/actions/setup-r@v2
+        with:
+          use-public-rspm: true
+      - name: Fixture gate against the expected reports
+        run: bash fixtures/run_gate.sh
+      - name: Check-script case suite
+        run: bash fixtures/run_cases.sh
+
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Repository lint
+        run: bash scripts/lint.sh
+      - name: Newest tag matches VERSION (main only)
+        if: github.ref == 'refs/heads/main'
+        run: LINT_CHECK_TAG=1 bash scripts/lint.sh

.github/workflows/release.yaml

@@ -0,0 +1,28 @@
+# Release verification on every tag push (openwashdata/pkgreview#73): the
+# files the skills fetch by stamped version must resolve at the tag, and the
+# GitHub release exists with the NEWS.md section as its notes.
+name: release
+
+on:
+  push:
+    tags: ["v*"]
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    env:
+      GH_TOKEN: ${{ github.token }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Pinned raw URLs resolve at the tag
+        run: bash scripts/verify_release.sh "${GITHUB_REF_NAME}"
+      - name: GitHub release from NEWS.md
+        run: |
+          v="${GITHUB_REF_NAME#v}"
+          if gh release view "${GITHUB_REF_NAME}" >/dev/null 2>&1; then
+            echo "release exists"
+          else
+            gh release create "${GITHUB_REF_NAME}" --title "${GITHUB_REF_NAME}" --notes-file <(bash scripts/news_section.sh "$v")
+          fi

.github/workflows/washr-drift.yaml

@@ -0,0 +1,24 @@
+# washr API drift check (openwashdata/pkgreview#77): installs CRAN washr and
+# verifies every washr:: call the skills execute or instruct still exports, and
+# reports the CRAN version against skills/pkgreview-core/WASHR_FLOOR.
+name: washr-drift
+
+on:
+  schedule:
+    - cron: "0 6 * * 1"
+  push:
+    branches: [main, dev]
+  workflow_dispatch:
+
+jobs:
+  drift:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: r-lib/actions/setup-r@v2
+        with:
+          use-public-rspm: true
+      - name: Install washr from CRAN
+        run: Rscript -e 'install.packages("washr")'
+      - name: Drift check
+        run: Rscript scripts/washr_drift.R

CLAUDE.md

@@ -43,22 +43,39 @@ ships as Claude Code skills.
   builds a throwaway repo with a planted add-then-remove history for the
   scan to catch.
 - `docs/checklist-reconciliation.md` - the record of how the previously
-  diverging checklist copies were merged (issue #5)
+  diverging checklist copies were merged (issue #5) and, per release
+  section keyed by version, every checklist item reworded since;
+  `/review-upgrade` reads those sections to build a package's delta
+- `NEWS.md` - release notes for everything that is not a checklist item
+- `scripts/` - `release.sh` (release tail), `verify_release.sh`,
+  `news_section.sh`, `lint.sh`, `washr_drift.R`
+- `.github/workflows/` - `gate.yaml` (fixture gate, case suite, lint),
+  `washr-drift.yaml`, `release.yaml`
+- `.claude-plugin/` - plugin manifests; the version there mirrors
+  `skills/pkgreview-core/VERSION` (lint checks they agree)
 
 ## Rules for changing the review standard
 
 1. Checklist or template changes get a version bump: update
-   `skills/pkgreview-core/VERSION` and tag the release commit
-   (`v[version]`). In-flight reviews finish on the version stamped into
-   their first review issue; skills fetch stamped-version checklists and
-   org profiles from raw.githubusercontent.com when they detect a
-   mismatch.
-2. After any significant change to checklists or skills, run the review
-   workflow against `fixtures/pkgreviewtest/` and confirm every planted
-   defect in `fixtures/SCORECARD.md` is caught. A missed defect means the
-   change weakened the standard and must not merge.
+   `skills/pkgreview-core/VERSION` (and the matching version in
+   `.claude-plugin/`), then release with `scripts/release.sh [version]`
+   after the dev-to-main PR merges (it tags, verifies the pinned raw
+   URLs, creates the GitHub release from NEWS.md, and syncs `dev`).
+   In-flight reviews finish on the version stamped into their first
+   review issue; skills fetch stamped-version checklists and org
+   profiles from raw.githubusercontent.com when they detect a mismatch.
+2. The mechanical fixture gate runs in CI (`.github/workflows/gate.yaml`:
+   the check script against `fixtures/pkgreviewtest/` and the history
+   fixture diffed against `fixtures/expected/`, plus the case suite in
+   `fixtures/cases/`). A change that alters a FAIL, FLAG, or NOT RUN
+   line must update the expected report in the same PR, with the
+   scorecard mapping re-checked. A missed defect means the change
+   weakened the standard and must not merge. The interactive run
+   through the skills is issue #17 (#80 decides its future).
 3. If a checklist item is added, dropped, or reworded, record the decision
-   in `docs/checklist-reconciliation.md`.
+   in `docs/checklist-reconciliation.md`, one row per item. Everything
+   else (skills, scripts, templates, fixtures, process) is recorded in
+   `NEWS.md` under the release version.
 4. Never let checklist content be duplicated again: issue bodies quote the
    canonical files verbatim; commands, docs, and skills reference them by
    path.
@@ -71,4 +88,12 @@ ships as Claude Code skills.
 
 - Work happens on `dev` (create off `main` if missing); PRs go from `dev`
   into `main`
-- No emojis and no em dashes in anything committed to this repo
+- Changes are proposed with `.github/ISSUE_TEMPLATE/proposal.md`: an
+  objection window decides unless the choice is open; the release issue
+  carries one decision table
+- The release PR body lists `Closes #N` for every issue it lands (PRs
+  here target `main`, so the keyword fires); no per-issue status or
+  closing comments
+- After the merge: `scripts/release.sh [version]` from `main`
+- No emojis and no em dashes in anything committed to this repo;
+  `scripts/lint.sh` enforces this and the skill path references

NEWS.md

@@ -0,0 +1,26 @@
+# pkgreview NEWS
+
+One section per release. Skill, script, template, fixture, and process changes are recorded here; checklist wording changes are recorded in `docs/checklist-reconciliation.md` (repo rule 3), one row per item. Releases before 1.5.0 are described by their reconciliation sections and tag messages.
+
+# pkgreview 1.6.0
+
+Development workflow release (issues #72 to #80, filed 2026-09-06). No checklist item changed.
+
+- CI: `.github/workflows/gate.yaml` runs the mechanical fixture gate as a golden-file test against `fixtures/expected/`, the check-script case suite under `fixtures/cases/`, and the repository lint (`scripts/lint.sh`); `.github/workflows/washr-drift.yaml` checks weekly that every `washr::` call the skills execute or instruct still exports from CRAN washr and reports the CRAN version against the recorded floor (#72, #77).
+- Release tail: `scripts/release.sh <version>` tags the merge commit, verifies the pinned raw URLs, creates the GitHub release from this file, and fast-forwards `dev`; `.github/workflows/release.yaml` repeats the verification on every tag push. The permission allowlist for the tail's commands is recorded on #73 for the maintainer to add to `.claude/settings.json` (a session cannot write permission rules) (#73).
+- Process: proposals use `.github/ISSUE_TEMPLATE/proposal.md` with an objection window; the release PR closes its issues through `Closes` lines; this NEWS file replaces the reconciliation prose for non-checklist changes (#74).
+- Plugin: `.claude-plugin/marketplace.json` and `plugin.json` package the skills as a Claude Code plugin; the copy install stays documented until the plugin path has served one release (#75).
+- `/review-status` and `/review-package` compare the installed VERSION with the newest tag and warn (status) or stop (package) when the install lags (#76).
+- The washr floor lives in `skills/pkgreview-core/WASHR_FLOOR`; both release preflights read it (#77).
+- Org profiles carry a YAML block; the check script takes `--org=<name>` (or `--org-file=`) and derives analytics, the site URL pattern, the funding text, the required keywords, and the brand rule from it; `--analytics` stays as a deprecated alias (#78).
+- New `/review-upgrade` skill: one issue listing the items that changed between a package's stamped standard and the installed one, worked through the normal flow; `pkgreview-upgrade` label; recovery.md failure mode 11 (#79).
+- `fixtures/make_review_fixture.sh create|delete` stands up and tears down the throwaway repository for the interactive gate in a registered org; an evals case for the intake screen under `evals/` (#80).
+
+# pkgreview 1.5.0
+
+Reconciliation with washr 1.1.0 and the owdata catalog (issues #56 to #68, released 2026-09-05). Checklist rows in the reconciliation section of the same name.
+
+- Release skills: washr >= 1.1.0 preflight, every 1.0.1 caveat deleted, version validated and set with `desc::desc_set_version()`, `update_citation(build = FALSE)`, conditional `update_metadata()`, badge and website steps reduced to verification, default branch check and dev sync.
+- Standard: keywords and coverage in the DESCRIPTION `X-schema.org` fields, dictionary schema advisory item, README export-link item reworded, Website required item means the pkgdown workflow deploys the site and `docs/` is not committed, tests trigger wording, brand as an org profile field.
+- Check script: keywords, coverage, dictionary schema, export-link, `docs/`-tracked, and dev-trigger lines; scope note freezing the metadata, docs, and tests sections pending washr's `check_publication_readiness()`.
+- Workflow skills never commit `docs/`; review-complete verifies the workflow and names the Pages setting. Guidebook reduced to intake, floor, dictionary, review, publication. Premortem files, `prompts/`, and `commands/` deleted.

README.md

@@ -17,7 +17,11 @@ Creating a data package for one of the registered organizations? Start with the
 git clone https://github.com/openwashdata/pkgreview.git
 cd pkgreview
 
-# Install the skills (copy; re-run after every git pull to update)
+# Install the skills. Either as the plugin (one command to update later):
+claude plugin marketplace add openwashdata/pkgreview
+claude plugin install pkgreview@pkgreview
+# or as copies (re-run after every git pull to update); not both, the two
+# would provide the same skill names:
 mkdir -p ~/.claude/skills
 cp -R skills/* ~/.claude/skills/
 
@@ -52,6 +56,7 @@ they run only when you type them, never on the model's own initiative.
 | `/review-issue [n]` | Work on a review issue (actual issue number) | `/review-issue 42` |
 | `/create-next-issue` | Create next review issue | `/create-next-issue` |
 | `/review-complete` | Create final PR to main | `/review-complete` |
+| `/review-upgrade` | Bring a reviewed package to the installed standard with one issue of changed items | `/review-upgrade` |
 | `/create-release` | Create a new release | `/create-release [version]` |
 | `/add-doi` | Integrate a Zenodo DOI after release (resume or repair path) | `/add-doi 10.5281/zenodo.XXXXXXX` |
 
@@ -79,6 +84,14 @@ Each review addresses 4 key areas:
 - Git
 - Claude Code (the workflow ships as skills; see Quick Start)
 
+Compatibility (the floor is recorded in `skills/pkgreview-core/WASHR_FLOOR`
+and checked weekly by CI):
+
+| pkgreview | washr |
+|-----------|-------|
+| 1.0.0 to 1.4.0 | 1.0.1, with the caveats the skills carried |
+| 1.5.0 and later | >= 1.1.0 |
+
 ## Repository Structure
 
 ```
@@ -89,24 +102,31 @@ pkgreview/
 │   ├── create-next-issue/
 │   ├── review-status/
 │   ├── review-complete/
+│   ├── review-upgrade/
 │   ├── create-release/
 │   ├── add-doi/
 │   └── pkgreview-core/        # Shared references (not a skill)
 │       ├── VERSION            # Review standard version
+│       ├── WASHR_FLOOR        # Lowest washr version the skills support
 │       ├── check/             # Deterministic check script
 │       └── references/
 │           ├── checklists/    # Canonical checklists, one per review area
 │           ├── templates/     # Issue body, PR body, _pkgdown.yml
 │           ├── orgs/          # Registered organization profiles
 │           ├── standards.md   # Package-resident standards file
 │           └── recovery.md    # State failure modes and recovery paths
-├── fixtures/                  # Defective test package, scorecard, history fixture
+├── fixtures/                  # Defective test package, scorecard, history fixture,
+│                              # expected reports, check-script cases, throwaway script
+├── scripts/                   # release.sh, verify_release.sh, lint.sh, washr_drift.R
 ├── hooks/                     # Optional PreToolUse hook (docs/guardrails.md)
 ├── docs/
 │   ├── guidebook.md           # Contributor guidebook
 │   ├── checklist-reconciliation.md
 │   ├── guardrails.md
 │   └── roadmap-v1.1.md
+├── .github/workflows/         # gate (fixture gate, cases, lint), washr-drift, release
+├── .claude-plugin/            # Plugin manifests (version mirrors VERSION)
+├── NEWS.md                    # Release notes for non-checklist changes
 ├── CLAUDE.md                  # Guide for Claude sessions in THIS repo
 ├── README.md                  # This file
 └── pkgreview.Rproj            # RStudio project file
@@ -153,10 +173,13 @@ previously diverging checklist copies were merged is in
 `docs/checklist-reconciliation.md`.
 
 Checklist and template changes get a version bump
-(`skills/pkgreview-core/VERSION` plus a git tag); in-flight reviews finish
-on the version stamped into their first review issue. After any significant
-change, run the review against `fixtures/pkgreviewtest/` and confirm every
-planted defect in `fixtures/SCORECARD.md` is caught.
+(`skills/pkgreview-core/VERSION` plus a git tag through
+`scripts/release.sh`); in-flight reviews finish on the version stamped into
+their first review issue, and `/review-upgrade` moves a published package
+to a newer standard with one issue of changed items. CI runs the check
+script against `fixtures/pkgreviewtest/` on every push and diffs the
+report against `fixtures/expected/`, so every planted defect in
+`fixtures/SCORECARD.md` stays caught.
 
 ## Contributing
 

docs/checklist-reconciliation.md

@@ -8,6 +8,12 @@ Date: 2026-07-08. Baseline: commit after the issue #4 fixes (the
 `washr::compile_citation()` typo and the missing CC BY 4.0 item were fixed
 before consolidation so that known bugs were not canonicalized).
 
+Sections added after the consolidation are keyed by the standard version
+in their heading (`(vX.Y.Z)`); `/review-upgrade` reads the sections
+between a package's stamped version and the installed one to build that
+package's upgrade issue, so a release that rewords, adds, or drops a
+checklist item must record it in a section that names the version.
+
 ## Sources
 
 | Key | File | Role before consolidation |

fixtures/SCORECARD.md

@@ -56,13 +56,13 @@ Note on the v1.5.0 lines (washr 1.1.0 and owdata reconciliation, issues #56 to #
 
 Run the full review workflow against `fixtures/pkgreviewtest` after every significant change to the checklists in `skills/pkgreview-core/references/checklists/` or to the review skills and commands.
 
-The mechanical layer of the gate is scripted: `Rscript skills/pkgreview-core/check/pkgreview-check.R fixtures/pkgreviewtest` runs the machine-checkable subset and must reproduce the defect mapping exactly (every FAIL/FLAG line maps to a defect ID, no unmapped lines; NOT RUN lines are not-applicable reports and map to nothing). Since v1.2.1 that is 19 FAIL + 1 FLAG lines for D1 to D17, with D4, D5, D7, and D15 as two-line spans. The judgment items, the intake conversation, and the guardrail behavior still require the workflow run.
+The mechanical layer of the gate is scripted and runs in CI (`bash fixtures/run_gate.sh`, which diffs against `fixtures/expected/`): `Rscript skills/pkgreview-core/check/pkgreview-check.R fixtures/pkgreviewtest --org=openwashdata` runs the machine-checkable subset and must reproduce the defect mapping exactly (every FAIL/FLAG line maps to a defect ID, no unmapped lines; NOT RUN lines are not-applicable reports and map to nothing). Since v1.2.1 that is 19 FAIL + 1 FLAG lines for D1 to D17, with D4, D5, D7, and D15 as two-line spans. The judgment items, the intake conversation, and the guardrail behavior still require the workflow run.
 
 The git-history defect D18 is exercised against its own repository, since `pkgreviewtest/` reports NOT RUN for history:
 
 ```
 HISTREPO=$(bash fixtures/make_history_fixture.sh)
-Rscript skills/pkgreview-core/check/pkgreview-check.R "$HISTREPO"   # expect the D18 history FLAG naming facilities.csv
+Rscript skills/pkgreview-core/check/pkgreview-check.R "$HISTREPO" --org=openwashdata   # expect the D18 history FLAG naming facilities.csv
 rm -rf "$HISTREPO"
 ```
 

fixtures/cases/ci-triggers-missing-dev/expected.txt

@@ -0,0 +1 @@
+- [FAIL] (required) R-CMD-check workflow triggers include dev (push and pull_request): branches: [main, master, dev] [main, master]

fixtures/cases/ci-triggers-missing-dev/overlay/.github/workflows/R-CMD-check.yaml

@@ -0,0 +1,6 @@
+on:
+  push:
+    branches: [main, master, dev]
+  pull_request:
+    branches: [main, master]
+name: R-CMD-check

fixtures/cases/ci-triggers-nested-dev/expected.txt

@@ -0,0 +1 @@
+- [PASS] (required) R-CMD-check workflow triggers include dev (push and pull_request): branches: [main, dev] [main, dev]

fixtures/cases/ci-triggers-nested-dev/overlay/.github/workflows/R-CMD-check.yaml

@@ -0,0 +1,10 @@
+on:
+  push:
+    branches:
+      - main
+      - dev
+  pull_request:
+    branches:
+      - main
+      - dev
+name: R-CMD-check