What is wrong
Step 2 of create-dev-loop.md ("Explore the repository") lists the PR-template
file to read as:
- `.github/pull_request_template.md` — PR body requirements
Only the lowercase spelling is named. GitHub itself accepts several spellings and
locations for this file — pull_request_template.md and PULL_REQUEST_TEMPLATE.md,
in the repo root, in .github/, or in docs/, plus a .github/PULL_REQUEST_TEMPLATE/
directory when multiple templates are used.
On a case-sensitive filesystem, a repo that uses the uppercase spelling will have its
PR template skipped silently by Step 2's "read the following files if they exist (skip
silently if absent)" instruction. This repository is itself such a case: the template
lives at .github/PULL_REQUEST_TEMPLATE.md.
Why it matters
SECURITY.md's trust model states that "the PR template" is among the target-repo
content Step 2 reads and that the reading shapes the generated skill. When the
template is silently missed, the generated skill's Phase 4 "PR body must include"
guidance is derived without it, and the miss leaves no trace — the instruction is to
skip silently.
Suggested fix
Broaden the Step 2 bullet to name the accepted spellings and locations, for example:
- `.github/PULL_REQUEST_TEMPLATE.md` / `.github/pull_request_template.md` (also
accepted at the repo root or under `docs/`, and as a
`.github/PULL_REQUEST_TEMPLATE/` directory) — PR body requirements
Provenance
The gap was found during a Stage A documentation-accuracy sweep. Because Step 2's file
list is behavior rather than a documentation claim, it was filed here rather than
changed under a docs-only cycle, per the Stage A rule that code defects are filed and
left for an implementation cycle.
This issue body was drafted during a Gardener session (https://github.com/Stephenson-Software/gardener).
What is wrong
Step 2 of
create-dev-loop.md("Explore the repository") lists the PR-templatefile to read as:
Only the lowercase spelling is named. GitHub itself accepts several spellings and
locations for this file —
pull_request_template.mdandPULL_REQUEST_TEMPLATE.md,in the repo root, in
.github/, or indocs/, plus a.github/PULL_REQUEST_TEMPLATE/directory when multiple templates are used.
On a case-sensitive filesystem, a repo that uses the uppercase spelling will have its
PR template skipped silently by Step 2's "read the following files if they exist (skip
silently if absent)" instruction. This repository is itself such a case: the template
lives at
.github/PULL_REQUEST_TEMPLATE.md.Why it matters
SECURITY.md's trust model states that "the PR template" is among the target-repocontent Step 2 reads and that the reading shapes the generated skill. When the
template is silently missed, the generated skill's Phase 4 "PR body must include"
guidance is derived without it, and the miss leaves no trace — the instruction is to
skip silently.
Suggested fix
Broaden the Step 2 bullet to name the accepted spellings and locations, for example:
Provenance
The gap was found during a Stage A documentation-accuracy sweep. Because Step 2's file
list is behavior rather than a documentation claim, it was filed here rather than
changed under a docs-only cycle, per the Stage A rule that code defects are filed and
left for an implementation cycle.
This issue body was drafted during a Gardener session (https://github.com/Stephenson-Software/gardener).