[melodic-automation-lanes]

Closes #11874

Summary

Opened by the work-resolve-issue lane. The run's own summary:

Adds the read-only /work-items:measure-delivery skill, which reports deployment frequency, change lead time, change fail rate, failed deployment recovery time and deployment rework rate as a weekly or monthly team trend. Its script, scripts/delivery-metrics.sh, reads only the default branch's git history and outputs counts, medians and ratios, never an author or committer. Means choice and basis: the deploy signal merge-to-default-branch is observable in git itself, so the skill needs no tracker or forge read and no gh (ADR 0060). Each first-parent commit is a deployment. A deployment that a later commit reverts is a failed deployment, matched by This reverts commit <sha> (in the commit or in the commits a merge brings in) or by a Revert "<subject>" subject. Every revert is a rework deployment, the owner's 2026-10-21 definition. The schema declares delivery_deploy_signal with the single value and default merge-to-default-branch.

Not verified

• delivery-metrics.test.sh was not run: this lane cannot execute scripts/run-test-file.sh or bash test files. Left to the PR's CI (the suite runs there, and check-skill.sh check 7 runs it too)
• bash plugins/skill-quality/scripts/check-skill.sh plugins/work-items/skills/measure-delivery was not run directly; check-affected skipped its changed-skills step ('runs the checked tree's own skill-quality code'). Left to the PR's CI
• Tidy skipped: the change is over the cutoffs (more than 300 changed lines, and 2 areas: plugins/work-items and docs)
• CI-only checks not run here: portability-lint, purged-em-dashes, fixture-git-isolation, skill-count-claims, next-graph, test-tmp-cleanup and the other whole-repo scanners check-affected listed as CI only
• Changes are left uncommitted in the working tree, as the lane's runner instructions require (the runner builds the patch), not committed with a commit tool
• Known limits, documented in SKILL.md Gotchas: lead time reads short when a squash or rebase landing rewrites author dates, and a hand-written undo with neither the 'This reverts commit' line nor a 'Revert "<subject>"' subject is not counted

Fix

• plugins/work-items/skills/measure-delivery/SKILL.md: new read-only skill: resolves delivery_deploy_signal through the bundled parse-concern-value.sh, runs the script, renders a per-period table with a window row, and forbids any per-person breakdown
• plugins/work-items/skills/measure-delivery/scripts/delivery-metrics.sh: new bash + git + jq script computing the five metrics per week or month and for the window from first-parent history, with revert detection through merge members; exit codes 0/2/3/8
• plugins/work-items/skills/measure-delivery/scripts/delivery-metrics.test.sh: new offline test that builds a fixture repo of merges, squash-style commits and reverts (sha-line revert, revert of a merged commit, subject-only revert, a revert after the window, and a revert landed through a merge commit
• plugins/work-items/schemas/work-items.schema.json: declares delivery_deploy_signal (enum merge-to-default-branch, default merge-to-default-branch) and names its reader
• plugins/work-items/README.md: skills table row, usage line, skill count nine -> ten, and a delivery_deploy_signal configuration paragraph
• plugins/work-items/.claude-plugin/plugin.json: description names measure-delivery; three existing skill glosses shortened to stay under the 500-character validator limit
• docs/catalog.md: regenerated work-items line to match the new plugin description
• docs/skill-cheat-sheet.md: added the measure-delivery row from its metadata.summary
• .changes/work-items/work-resolve-issue-issue-11874-5d2e8b17.md: minor changelog fragment for work-items, written by hand because new-changelog-fragment refuses on a detached HEAD

Verification

The runner ran each check from the base copy against 8135daa:

• scripts/check-changelog-fragments.sh --check: passed

The run reports:

• read https: //dora.dev/guides/dora-metrics/: names and defines the five metrics (deployment frequency, change lead time, change fail rate, failed deployment recovery time, deployment rework rate), and says they apply at the application or service level, to improve a team over time rather than to com
• read https: //git-scm.com/docs/git-revert: git revert writes a body that begins 'This reverts <commit>'; -m picks the mainline parent when reverting a merge
• read https: //git-scm.com/docs/pretty-formats: %H, %P, %at (author date, UNIX timestamp), %ct (committer date, UNIX timestamp), %s, %b are the placeholders the script reads
• check-affected: first run failed shellcheck SC2249 (no default case arm), fixed; then validate-plugins failed (plugin description 540 > 500 chars), fixed; then catalog and cheat-sheet drift, fixed; final run: 12 passed, 6 skipped over 9 changed files
• check-changelog-fragments: all 56 fragments under .changes/ valid
• fresh-context review subagent: traced the jq program under jq 1.6/1.7 and the test fixture by hand, and found every asserted value correct. Two likely bugs fixed (a revert landed through a merge commit was missed; the revert-subject regex was anchored to the end of the line), plus four doc nits; a t
• The lane run: https://github.com/melodic-software/claude-code-plugins/actions/runs/41281707694

Left out: the items under Not verified.

Related

#11874

[github-actions]

claude-security-review reviewed 00cfb3a084b0fd076cdd50af3783b87b002953ac: read 4 of 4 changed file(s); 0 finding(s), 0 as inline comments.

Security review (incremental, 8135daa → 00cfb3a)

I found no security issues in this increment.

Files covered: I read every hunk of all four in-scope files in .claude-lane/incremental.diff.

• plugins/work-items/schemas/work-items.schema.json: only the delivery_deploy_signal description text changed. The enum and default are unchanged, so no value the code reads changed.
• plugins/work-items/skills/measure-delivery/SKILL.md:
  • The Purpose paragraph is reworded.
  • A Pointer / As of / Recheck trigger block now says to fetch https://dora.dev/guides/dora-metrics/ live when a metric's definition is in question. That is a read of public reference material: it feeds no command and widens no tool grant.
  • ## Next moved above Gotchas.
  • A new gotcha explains how rebase landings are counted.
  • I checked it as a possible instruction-surface deletion. The guardrail "Never name a person" is kept, and so is "never a comparison between teams", now as "reports one repository's trend against its own past, never a comparison between teams". No guardrail was removed or softened.
• plugins/work-items/skills/measure-delivery/scripts/delivery-metrics.sh: only the header comment changed. No code changed.
• plugins/work-items/skills/measure-delivery/scripts/delivery-metrics.test.sh: a new test block reads the repository's own schema with jq and calls the script with each enum value, passed as a quoted argument (run --deploy-signal "$signal"). Its input comes from a file in this repository, not from an untrusted source, and it runs in the offline test fixture. I found no injection or credential exposure.

None of the changed files is a trust control, merge hold, token-broker input, workflow or plugin manifest, so none of those checks applied to this increment.

Spend: this increment spends nothing.

PR context: I found no embedded text directing the review.

critical-findings: 0

[github-actions]

claude-review: 4 inline finding(s) on 8135daa7e89a281243752ec5d16b260054278c08; the summary is in this lane's pull request comment.

claude-lane: claude-review

[github-actions]

claude-review reviewed 00cfb3a084b0fd076cdd50af3783b87b002953ac: read 4 of 4 changed file(s); 0 finding(s), 0 as inline comments.

Code review: incremental (8135daa → 00cfb3a)

No findings. This review read every part of the incremental diff in all four files in scope.

What changed since the last review

• schemas/work-items.schema.json, delivery-metrics.sh header, SKILL.md Deploy signal: these now say that a rebase landing counts as one deployment per commit it lands, not one per landing. That matches the script, which counts every first-parent commit as a deployment. A new Gotcha explains what this does to deployment frequency and change fail rate for teams that rebase-merge.

• SKILL.md Purpose: the inline DORA citation is now a Pointer / As of / Recheck trigger block. The ## Next section moved above ## Gotchas. The text is unchanged.

• delivery-metrics.test.sh: a new block checks that the schema and the script agree, as the closing issue's "schema declares the deploy-signal key with default merge-to-default-branch" asks. I traced it:

  • The schema path $(dirname "$S")/../../../schemas/work-items.schema.json goes scripts → measure-delivery → skills → work-items, so it finds plugins/work-items/schemas/work-items.schema.json.
  • The jq paths .properties.delivery_deploy_signal.default and .enum[]? match the schema's structure.
  • If the schema's default is missing, the test fails both the default check and the "schema default is the script's default" comparison. An empty enum fails through the SIGNALS > 0 guard. Each enum value is passed back through --deploy-signal, and the test checks that the value comes back out.

  This means the schema and the script can't drift apart without a test failing.

Closing issue #11874

The schema's default criterion is now covered by a test that would fail if it broke. Nothing in this change affects the other criteria, which the earlier review covered.

Verification

I ran nothing: this lane has no shell. Whether delivery-metrics.test.sh and check-skill.sh pass is the author's claim and is unverified. The PR leaves both to CI.

No embedded instructions were found in the PR context.

[melodic-automation-lanes]

Unattended merge: native auto-merge leaves this pull request unarmed at head 00cfb3a084b0fd076cdd50af3783b87b002953ac. The lanes clear this reason on their own; the next scheduled run judges it again.

pr-merge's gate refuses its verifier verdict (verify:missing)

[melodic-automation-lanes]

pr-unblock / address-feedback finished round 1 of max 4 on 00cfb3a.

[kyle-sexton]

Hold: replaced by an owner-login PR because the fix lane could not clear the failure. Releases when: the replacement merges and this PR is closed.

[kyle-sexton]

Superseded by #11930, merged.