v1.6.0

What's in this release

v1.6.0 makes beads (bd) plus deterministic hook-rendered boards the platform's default work-item tracker layer, replacing the GitHub Projects dependency (epic #574, provenance: downstream report #562 from the reference fork). The architectural center is an inversion: Ready is now computed (bd ready = open + unblocked) rather than a column agents mutate, grooming completes Definition-of-Ready instead of moving cards, and roughly 420 lines of board-hygiene protocol are deleted rather than ported. Around that core ship a 7-condition agent-merge gate with a config-gated second-identity approval (REVIEWER_APPROVAL_LOGIN), a fork migrator with a one-release legacy.githubProjects compatibility flag, a beads-native bootstrap, and adoption docs that encode the reference fork's eight gotchas at point-of-use. The window also carries the Codespaces bootstrap chain, a provider-plugin deploy-status dispatcher for /drain, docs-only CI gating, and a batch of drain/report-issue/agent-loading fixes.

Added

• Board tooling layer (epic #574 E1, #582) — deterministic board renderer (scripts/render-boards.mjs, with --check freshness mode), hook-rendered board projections, permissions wiring, and the /board-refresh command.
• Pinned bd toolchain (epic #574 E2, #584) — bd pinned at 1.1.0 (scripts/lib/bd-version.sh), scripts/check-bd.sh pin enforcement, and scripts/init-beads.sh init sequence (install → init → hooks), with the known init gotchas (inert git hooks under core.hooksPath; --skip-agents boilerplate conflict) encoded in docs/BEADS.md.
• Canonical beads vocabulary and mapping (epic #574 E3/E6, #585/#591) — CLAUDE.md "Work-Item Tracking (Beads)" board-model mapping plus critical rules 9 and 10 (beads is the only tracker; bd mechanical hygiene), and the new docs/BEADS-CONVENTIONS.md as the single canonical reference for label vocabulary, branch/PR conventions, script conventions, and board semantics.
• Agent-merge gate + beads drain (epic #574 E4, #586) — 7-condition gate in .github/workflows/agent-merge.yml (bead citation, safety:* PR label, full green rollup, open-against-main, no do-not-merge, config-gated second-identity approval via REVIEWER_APPROVAL_LOGIN bound to the PR's current head commit, caller audit), conditions extracted into unit-tested scripts/check-merge-gate.sh; /drain rewritten bd ready-native with atomic bd update --claim, schema-validated drain state (scripts/write-drain-state.mjs), and the four autonomous-run findings codified. Validated live in PR #590 — the platform's first agent-merged PR.
• Fork migrator + GH-Projects compatibility flag (epic #574 E5, #588) — idempotent scripts/migrate-issues-to-beads.sh (--external-ref keyed, opt-in --close-github), beads-native bootstrap, and the legacy.githubProjects flag (config + GEMBAFLOW_LEGACY_GITHUB_PROJECTS Actions variable) to stay on GitHub Projects for exactly one release.
• Adoption docs (epic #574 E6, #591) — the reference fork's eight adoption gotchas placed at point-of-use, an honest-limits section (no human write UI, cross-repo federation untested, bd 1.x CLI churn countered by the pin), and a DISTRIBUTION sweep of all six epic PRs.
• Codespaces bootstrap chain (#531, #533, #534) — codespace-postcreate.sh + devcontainer permissions block + version-stamp lib, the /bootstrap orchestrator with .bootstrap-status interop and a token redactor, and docs/codespaces-secrets.md with the multi-bot preflight branch.
• Deploy-status provider dispatcher (#499) — scripts/deploy-status/interface.mjs routes /drain step 9 through per-plane adapters selected by DRAIN_DEPLOY_PLANE (default render; zero behavior change for existing forks), unblocking non-Render forks.
• /log-session upstream-feedback reflection (#543) — voluntary end-of-session reflection prompt that channels fork friction into upstream reports.

Changed

• The architectural inversion (epic #574 E3, #585) — grooming completes Definition-of-Ready, sets priorities, and wires dependencies; a healthy ready queue is the outcome, and the board is a projection, never a target (anti-Goodhart guardrails in /groom-backlog). GitHub Issues become an inbox that grooming imports and closes.
• Agents and commands rewritten to bd idioms (#585) — /work-ticket, /groom-backlog, /create-ticket, /doctor, /sprint-status, /check-milestone, /review-pr, /review-to-tickets, /swarm, /log-session, /validate-memory, plus github-ticket-worker, agile-backlog-prioritizer, pr-reviewer, and swarm-planner — all inside FRAMEWORK:START/END markers.
• Label authority inverts (#585) — the bead's safety:* label is the source of truth; the worker copies it onto the PR at creation. Closes #N is retired in favor of Bead: <id> citations.
• Reviewer verdict becomes gate-qualifying (#586) — on repos where the gate's REVIEWER_APPROVAL_LOGIN is set, /review-pr records GO as a real gh pr review --approve from the reviewer identity (verdict recording on the bead is unchanged either way).
• CI skips the full fleet on docs-only PRs (#485) — new _detect-changes.yml reusable workflow gates json-validate, version-parity, build, test, and friends; lint stays deliberately ungated. Skipped jobs still satisfy required status checks.
• README trimmed (#550) — promotional video embed removed.
• Housekeeping: v1.5.0 CHANGELOG backfill landed in-window (#487).

Fixed

• Project-level agents load again (#489) — repaired YAML frontmatter that prevented agent registration.
• /report-issue accepts the bare-slug upstream form (#496) — owner/repo shorthand no longer rejected.
• /drain pre-flight Step 0 detects unsubstituted placeholders (#497) — template tokens left in config fail closed before a run starts.
• /drain pre-flight step 4 detects all manual-install artifacts (#498) — every gate/bridge artifact is checked, with a new setup-safety-labels helper.

Removed

• Board-hygiene protocol (~420 lines, deleted not ported; #585/#586) — the board-columns spec in docs/AGENT-WORKFLOW-SUMMARY.md (now a short pointer to the CLAUDE.md mapping), board pre-flight checks from six rewritten commands, the hand-rolled Depends on: topo-sort in /drain (bd ready is blocker-aware, so the queue cannot contain blocked work), and the project-board remote checks in /doctor.
• project PAT scope requirement (#585) — including the reviewer-PAT remediation walkthrough (kept as a short historical note) and the gh project list scope probes in scripts/setup-accounts.sh.

Migration notes

For fork maintainers, in order:

1. Run /upgrade — this brings the beads tooling (scripts, commands, agents, hooks, docs) via the normal sync.
2. Install the pinned bd toolchain: run the bootstrap init, or manually npm install -g "@beads/bd@1.1.0" then scripts/init-beads.sh. scripts/check-bd.sh enforces the pin.
3. Migrate your open GitHub issues: scripts/migrate-issues-to-beads.sh — idempotent (keyed on --external-ref, safe to re-run), and GitHub issues stay open unless you opt in with --close-github.
4. Or defer for one release: set legacy.githubProjects: true in .gembaflow-config.json and the GEMBAFLOW_LEGACY_GITHUB_PROJECTS=true Actions repository variable to keep the GitHub-Projects path. This path is deprecated on arrival — removal ticket #587 lands next release.
5. Gate activation is opt-in manual install (workflow files do not sync): copy .github/workflows/agent-merge.yml and drain-merge-bridge.yml onto your fork's main following docs/agent-merge-gate.md, including the REVIEWER_APPROVAL_LOGIN decision (set your reviewer bot's login for the two-identity merge path, or empty string to knowingly skip condition 6 with a loud per-run warning).

Fork-maintained files you must update

• Workflow files are never synced — forks wanting this release's gate, bridge, docs-only CI gating, or board-status behavior must update their own copies of .github/workflows/agent-merge.yml, drain-merge-bridge.yml, _detect-changes.yml/ci.yml, and auto-board-status.yml manually.
• auto-board-status.yml now no-ops by default — it only runs when the GEMBAFLOW_LEGACY_GITHUB_PROJECTS Actions variable is true (plus the board config variables). Forks staying on GitHub Projects for this release must set the variable or PR-merge board automation silently stops.
• Agent frontmatter descriptions changed to beads phrasing (#591) — frontmatter lives outside the FRAMEWORK:START/END markers, so existing forks keep their own text (the new phrasing appears only on fresh forks). No action required; listed for awareness.
• Required CI check names: unchanged. lint, json-validate, version-parity, build, and test all keep their names (they only gained needs: detect gating, and skipped jobs still count as passing). The new detect job is not a required check, and the gate workflow's display name is still Agent Merge Gate. No ruleset changes needed.

Propagation note

scripts/template-sync.sh and scripts/lib/overrides.sh were not modified in this window (re-verified with git log v1.5.0..main over both paths, matching every epic review). Existing forks pick up everything in this release via /upgrade, with two standing exceptions: workflow files (never synced — see the fork-maintained list above) and agent regions outside the FRAMEWORK:START/END markers (fork-owned by design).