contract: every Getzilla defect goes to a GitHub issue

.agents/skills/getzilla-delivery/SKILL.md

@@ -26,6 +26,7 @@ For an admitted small change, keep scope and acceptance in the task or PR. Do no
 5. Run one final `python3 scripts/getzilla_verify.py --mode pr`, or the existing focused landing mode when its closed inventory qualifies. Do not shorten the comparison range. Record skips as skips. No report-only or workflow-state freeze commit is needed.
 6. After the gate passes, record each passing report with `python3 scripts/getzilla_review.py <kind> --status pass --report <runtime-report> --reviewed-commit <exact-full-sha>`. Runtime reports must be ignored, regular, non-executable UTF-8 Markdown using the conventional review names. The receipt binds route/change, exact reviewed HEAD/tree and content hash; consumption rechecks them. Any source commit or report-content change stales the receipt.
 7. Run `python3 scripts/getzilla_status.py`; completion requires zero evidence gaps. Runtime state may transition to ready without changing source. Deliver through a PR with the required external exact-head checks. Local evidence never replaces merge authority, branch protection or human security approvals.
+8. Before you end the task, record every Getzilla defect you met (a bug, a wrong refusal, a broken check, a doc that does not match the code, costly friction), also the ones you worked around. Follow the "Getzilla defects" rule in `AGENTS.md`: an issue in `Dimkox/Getzilla` when that is allowed, otherwise a ready issue text for the owner.
 
 ## Evidence and handoff
 

.claude/skills/getzilla-delivery/SKILL.md

@@ -26,6 +26,7 @@ For an admitted small change, keep scope and acceptance in the task or PR. Do no
 5. Run one final `python3 scripts/getzilla_verify.py --mode pr`, or the existing focused landing mode when its closed inventory qualifies. Do not shorten the comparison range. Record skips as skips. No report-only or workflow-state freeze commit is needed.
 6. After the gate passes, record each passing report with `python3 scripts/getzilla_review.py <kind> --status pass --report <runtime-report> --reviewed-commit <exact-full-sha>`. Runtime reports must be ignored, regular, non-executable UTF-8 Markdown using the conventional review names. The receipt binds route/change, exact reviewed HEAD/tree and content hash; consumption rechecks them. Any source commit or report-content change stales the receipt.
 7. Run `python3 scripts/getzilla_status.py`; completion requires zero evidence gaps. Runtime state may transition to ready without changing source. Deliver through a PR with the required external exact-head checks. Local evidence never replaces merge authority, branch protection or human security approvals.
+8. Before you end the task, record every Getzilla defect you met (a bug, a wrong refusal, a broken check, a doc that does not match the code, costly friction), also the ones you worked around. Follow the "Getzilla defects" rule in `AGENTS.md`: an issue in `Dimkox/Getzilla` when that is allowed, otherwise a ready issue text for the owner.
 
 ## Evidence and handoff
 

.gemini/skills/getzilla-delivery/SKILL.md

@@ -26,6 +26,7 @@ For an admitted small change, keep scope and acceptance in the task or PR. Do no
 5. Run one final `python3 scripts/getzilla_verify.py --mode pr`, or the existing focused landing mode when its closed inventory qualifies. Do not shorten the comparison range. Record skips as skips. No report-only or workflow-state freeze commit is needed.
 6. After the gate passes, record each passing report with `python3 scripts/getzilla_review.py <kind> --status pass --report <runtime-report> --reviewed-commit <exact-full-sha>`. Runtime reports must be ignored, regular, non-executable UTF-8 Markdown using the conventional review names. The receipt binds route/change, exact reviewed HEAD/tree and content hash; consumption rechecks them. Any source commit or report-content change stales the receipt.
 7. Run `python3 scripts/getzilla_status.py`; completion requires zero evidence gaps. Runtime state may transition to ready without changing source. Deliver through a PR with the required external exact-head checks. Local evidence never replaces merge authority, branch protection or human security approvals.
+8. Before you end the task, record every Getzilla defect you met (a bug, a wrong refusal, a broken check, a doc that does not match the code, costly friction), also the ones you worked around. Follow the "Getzilla defects" rule in `AGENTS.md`: an issue in `Dimkox/Getzilla` when that is allowed, otherwise a ready issue text for the owner.
 
 ## Evidence and handoff
 

.getzilla/templates/consumer-AGENTS.md.tmpl

@@ -67,6 +67,10 @@ New runtime workflow state can move to `ready` without changing source. Reports
 Saved report-only deltas use exactly `code-review.md`, `test-review.md`, `bitrix-review.md`, `security-review.md`, `data-review.md` or `release-review.md` directly under `engineering/reviews/` or the valid active change evidence directory. Low-risk micro routes may use `engineering/reviews/` without a durable package; other routes require their selected package. Malformed or unsafe selected package metadata fails closed. Analysis, README/index, checkpoint and arbitrary custom Markdown files are source changes, not saved review reports.
 
 
+## Getzilla defects
+
+A defect in the installed Getzilla workflow (hooks, scripts, routing, verification, its documentation) belongs in an issue of the upstream repository https://github.com/Dimkox/Getzilla. A defect is a bug, a wrong or confusing refusal, a missing or broken check, a doc that does not match the code, or workflow friction that costs more than the change it guards. Record it when you find it, also when you work around it. Filing there is an external write to another repository: file it only when the owner explicitly allows that, and record the consent as an exact external-write grant with `scripts/getzilla_approve.py` before the call. Otherwise give the owner a ready issue text (observed, expected, trigger, command or path) in your final report. Search the open and closed issues first; add to a matching issue instead of opening a duplicate. Never include secrets, customer data, proprietary code of this repository or copy-paste exploit commands.
+
 ## Task workspace
 
 Put agent working files (bundles, drafts, intermediate output) in `.getzilla/runtime/scratch/`; it needs no grant. A shell command that runs inline interpreter code (`python3 -c`, `php -r`, `node -e`, a heredoc into `python3`) is denied, because the hook cannot see which paths it touches. Write the program to `.getzilla/runtime/scratch/<name>.py` and run it as a file.

.grok/skills/getzilla-delivery/SKILL.md

@@ -26,6 +26,7 @@ For an admitted small change, keep scope and acceptance in the task or PR. Do no
 5. Run one final `python3 scripts/getzilla_verify.py --mode pr`, or the existing focused landing mode when its closed inventory qualifies. Do not shorten the comparison range. Record skips as skips. No report-only or workflow-state freeze commit is needed.
 6. After the gate passes, record each passing report with `python3 scripts/getzilla_review.py <kind> --status pass --report <runtime-report> --reviewed-commit <exact-full-sha>`. Runtime reports must be ignored, regular, non-executable UTF-8 Markdown using the conventional review names. The receipt binds route/change, exact reviewed HEAD/tree and content hash; consumption rechecks them. Any source commit or report-content change stales the receipt.
 7. Run `python3 scripts/getzilla_status.py`; completion requires zero evidence gaps. Runtime state may transition to ready without changing source. Deliver through a PR with the required external exact-head checks. Local evidence never replaces merge authority, branch protection or human security approvals.
+8. Before you end the task, record every Getzilla defect you met (a bug, a wrong refusal, a broken check, a doc that does not match the code, costly friction), also the ones you worked around. Follow the "Getzilla defects" rule in `AGENTS.md`: an issue in `Dimkox/Getzilla` when that is allowed, otherwise a ready issue text for the owner.
 
 ## Evidence and handoff
 

.qwen/skills/getzilla-delivery/SKILL.md

@@ -26,6 +26,7 @@ For an admitted small change, keep scope and acceptance in the task or PR. Do no
 5. Run one final `python3 scripts/getzilla_verify.py --mode pr`, or the existing focused landing mode when its closed inventory qualifies. Do not shorten the comparison range. Record skips as skips. No report-only or workflow-state freeze commit is needed.
 6. After the gate passes, record each passing report with `python3 scripts/getzilla_review.py <kind> --status pass --report <runtime-report> --reviewed-commit <exact-full-sha>`. Runtime reports must be ignored, regular, non-executable UTF-8 Markdown using the conventional review names. The receipt binds route/change, exact reviewed HEAD/tree and content hash; consumption rechecks them. Any source commit or report-content change stales the receipt.
 7. Run `python3 scripts/getzilla_status.py`; completion requires zero evidence gaps. Runtime state may transition to ready without changing source. Deliver through a PR with the required external exact-head checks. Local evidence never replaces merge authority, branch protection or human security approvals.
+8. Before you end the task, record every Getzilla defect you met (a bug, a wrong refusal, a broken check, a doc that does not match the code, costly friction), also the ones you worked around. Follow the "Getzilla defects" rule in `AGENTS.md`: an issue in `Dimkox/Getzilla` when that is allowed, otherwise a ready issue text for the owner.
 
 ## Evidence and handoff
 

AGENTS.md

@@ -20,10 +20,10 @@ Process calls include merging a PR that improves the repository, deferring revie
 The agent asks the human only for real risk decisions or for steps that only a human can do.
 Real risk decisions are production writes, secrets, security exposure and human security approvals.
 Steps that only a human can do include authentication and 2FA.
-Under L5, the owner's standing consent covers merge, tag and release of the project's own repository.
-That consent applies only when required checks are green on the exact head SHA, all review threads are resolved, and an independent review passed.
+Under L5, the owner's standing consent covers merge, tag and release of the project's own repository, and creating, updating, commenting on and closing its own GitHub issues.
+For merge, tag and release, that consent applies only when required checks are green on the exact head SHA, all review threads are resolved, and an independent review passed.
 The agent records that standing consent with `scripts/getzilla_approve.py` as an exact action and resource. The wildcard scope stays forbidden.
-Production mutation, deploy, external writes and security approvals still need an explicit human decision.
+Production mutation, deploy, other external writes and security approvals still need an explicit human decision.
 
 ## Manual override
 
@@ -44,6 +44,19 @@ Collect Low-severity findings into one issue.
 Fix them together in one later PR.
 Low-severity findings do not block a merge.
 
+## Getzilla defects go to issues
+
+Every defect in Getzilla itself goes to a GitHub issue in `Dimkox/Getzilla`.
+A defect is a bug, a wrong or confusing refusal, a missing or broken check, a doc that does not match the code, or workflow friction that costs more than the change it guards.
+
+- Record the defect when you find it. A workaround is not a fix, so record it also when you work around it.
+- Search the open and closed issues first. Add to a matching open issue, or reopen or link a closed one; do not open a duplicate.
+- State what you observed, what you expected, what triggers it and the exact command or path.
+- Put a Low-severity finding into the open issue that collects Low findings.
+- Put a real finding that is outside the current task into an issue, not into the current pull request.
+- Never put secrets, private data or copy-paste exploit commands into an issue. Describe the hole, not the weapon.
+- Filing, updating or commenting on an issue in this repository is a process call under the L5 standing consent above. Record one exact external-write grant per GitHub tool before its first call, for example `python3 scripts/getzilla_approve.py external-write --reason "<defect>" --action external-write --resource mcp__github__issue_write` (or `mcp__github__add_issue_comment`). Like every external-write grant, it stays bound to the route, change, exact HEAD and tree, so a new commit or a new route needs a fresh grant.
+
 ## Merge discipline
 
 Merge only through required checks on the exact head SHA, with `gh pr merge --match-head-commit`.
@@ -272,13 +285,13 @@ For each report with probes, list the claims probed, exact commands and concise
 - `scripts/getzilla_approve.py` does not originate authority. It materializes explicit or standing user consent already present in the working context.
 - Every grant names explicit actions and exact resources. Protected-path grants bind repository, session, change, full branch ref, anchor ancestry, unchanged files outside the exact grant set and TTL; a new route of the same session (every prompt starts one) keeps them, and another session never gets them. The session is the caller's own (hook payload, or `CLAUDE_CODE_SESSION_ID` for `getzilla_approve.py`); unless the caller, its route and the grant name the same session, they bind the exact route. Commits within the approved file set retain the grant. A branch change or out-of-scope edit invalidates it. Production/external grants retain exact HEAD/tree binding. Legacy records retain their original validation.
 - An agent may invoke `getzilla_approve.py` only when the user has explicitly delegated the named operation. The wildcard scope is forbidden.
-- Under L5 autonomy, the owner's standing consent is that explicit delegation for merge, tag and release of the project's own repository. It applies only with green required checks on the exact head SHA, resolved review threads and a passed independent review. The agent still records an exact action and resource for each operation.
+- Under L5 autonomy, the owner's standing consent is that explicit delegation for merge, tag and release of the project's own repository, and for its own GitHub issues (create, update, comment, close). For merge, tag and release it applies only with green required checks on the exact head SHA, resolved review threads and a passed independent review. The agent still records an exact action and resource for each operation.
 - Trust CI security approvals use Ed25519 envelopes generated by `adaptive-trust-ci approval-create` on a human-controlled machine and submitted to the external API. Local grants are never accepted by Trust CI.
 
 ## Prohibited routine actions
 
 - Direct push to a protected/shared branch.
-- Merge, publish, tag, deploy, production mutation or external write without an exact delegated local grant naming that operation and resource. Under L5 autonomy, the owner's standing consent supplies that grant only for merge, tag and release of the project's own repository; production mutation, deploy, external writes and security approvals still need an explicit human decision.
+- Merge, publish, tag, deploy, production mutation or external write without an exact delegated local grant naming that operation and resource. Under L5 autonomy, the owner's standing consent supplies that grant only for merge, tag and release of the project's own repository and for its own GitHub issues; production mutation, deploy, other external writes and security approvals still need an explicit human decision.
 - `gh pr merge --admin`, a merge without `--match-head-commit`, or any bypass of branch protection.
 - Copy-paste exploit commands in a public issue or PR.
 - Creating or submitting a human security approval, using a human private key, or editing the deployed trust store/policy/holdout/GitHub App configuration.

tests/test_structure.py

@@ -1207,6 +1207,19 @@ def test_ste100_rule_precedes_every_other_rule_in_agents_md(self) -> None:
         ):
             self.assertIn(sentence, text)
 
+    def test_getzilla_defects_go_to_issues_here_and_in_consumers(self) -> None:
+        agents = (ROOT / "AGENTS.md").read_text(encoding="utf-8")
+        self.assertIn("## Getzilla defects go to issues", agents)
+        self.assertIn("Every defect in Getzilla itself goes to a GitHub issue in `Dimkox/Getzilla`.", agents)
+        self.assertIn("and creating, updating, commenting on and closing its own GitHub issues.", agents)
+        self.assertIn("- Never put secrets, private data or copy-paste exploit commands into an issue.", agents)
+        consumer = (ROOT / ".getzilla/templates/consumer-AGENTS.md.tmpl").read_text(encoding="utf-8")
+        self.assertIn("## Getzilla defects", consumer)
+        self.assertIn("file it only when the owner explicitly allows that", consumer)
+        self.assertIn("Never include secrets, customer data, proprietary code of this repository", consumer)
+        skill = (ROOT / ".agents/skills/getzilla-delivery/SKILL.md").read_text(encoding="utf-8")
+        self.assertIn('Follow the "Getzilla defects" rule in `AGENTS.md`', skill)
+
     def test_agent_pool_scales_to_one_worker_per_logical_cpu(self) -> None:
         text = (ROOT / "AGENTS.md").read_text(encoding="utf-8")
         self.assertIn("up to one per verified effective logical CPU", text)
@@ -1220,7 +1233,7 @@ def test_l5_autonomy_keeps_exact_grants_and_human_risk_decisions(self) -> None:
             "standing consent covers merge, tag and release of the project's own repository",
             "green on the exact head SHA",
             "The wildcard scope stays forbidden.",
-            "Production mutation, deploy, external writes and security approvals still need an explicit human decision.",
+            "Production mutation, deploy, other external writes and security approvals still need an explicit human decision.",
             "## Local delegated grants",
         ):
             self.assertIn(phrase, text)