fix: align story lifecycle QA ownership

[rafaelscosta]

Summary

• Aligns .claude/rules/story-lifecycle.md with the procedural task files merged in fix(tasks): enforce story status transitions after QA #656: @dev owns Ready -> InProgress and InProgress -> InReview; @qa owns InReview -> Done and InReview -> InProgress; @devops only acts after QA status is already reflected.
• Updates scripts/validate-package-completeness.js to match the current publish contract: pro/license/license-api.js is required instead of treating all pro/ files as a leak.
• Bumps @aiox-squads/core to 5.1.10 and adds two story records under Epic 123.

Validation

• git diff --check PASS
• lifecycle rule assertion script PASS
• node -c scripts/validate-package-completeness.js PASS
• node scripts/validate-package-completeness.js PASS, 30/30 checks
• npm run validate:manifest PASS
• npm run validate:semantic-lint PASS
• npm run validate:publish PASS
• npm run lint -- --quiet PASS
• npm run typecheck PASS
• npm test -- tests/synapse/generate-constitution.test.js --runInBand --forceExit PASS, 1 suite / 29 tests
• npm run test:ci PASS, 315 suites / 7,846 tests, 149 skipped

Notes

• Completes the unique lifecycle-rule portion of stale PR fix(qa-gate): add mandatory story status update after gate verdict #543 after fix(tasks): enforce story status transitions after QA #656 already merged the procedural task-file enforcement for [Bug]: After QA passes successfuly, user story status is not updated #636.
• Supersedes stale PRs fix(qa-gate): add mandatory story status update after gate verdict #543 and fix: add mandatory post-verdict status update steps to task workflows #550 for merge purposes once this lands.

Summary by CodeRabbit

• Chores
  • Released package version 5.1.10.
  • Enhanced package validation requirements and documented QA gate ownership to clarify internal process workflows.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
aiox-core	Ready	Preview, Comment	May 7, 2026 3:37pm

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 2a61dda2-ddda-4e0c-889a-463542aa99e1

📥 Commits

Reviewing files that changed from the base of the PR and between 29ff84e and 204a603.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (5)

• .claude/rules/story-lifecycle.md
• docs/stories/epic-123/STORY-123.14-story-lifecycle-qa-ownership.md
• docs/stories/epic-123/STORY-123.15-package-completeness-pro-contract.md
• package.json
• scripts/validate-package-completeness.js

---

Walkthrough

This PR clarifies story lifecycle status transition ownership by mandating that QA (@qa) controls InReview → Done and InReview → InProgress outcomes, updates the package validator to explicitly require pro/license/license-api.js, documents both changes through story records, and releases version 5.1.10.

Changes

Story Lifecycle & Package Validation Release

Layer / File(s)	Summary
Story Lifecycle Rules .claude/rules/story-lifecycle.md	Status progression table expanded to require @dev change log updates for Ready → InProgress and InProgress → InReview; @qa now owns InReview → Done (PASS/CONCERNS/WAIVED) and InReview → InProgress (FAIL) outcomes; @devops confirmed to only act after QA status is reflected.
Package Validator Script scripts/validate-package-completeness.js	pro/license/license-api.js added to REQUIRED_PATHS as an explicitly shipped file in the npm tarball, aligning with Pro entitlement contract.
Story Documentation docs/stories/epic-123/STORY-123.14-story-lifecycle-qa-ownership.md, docs/stories/epic-123/STORY-123.15-package-completeness-pro-contract.md	STORY-123.14 records QA ownership rules with acceptance criteria and validation checklist (markdown/rules/package checks passing). STORY-123.15 records validator update tasks with results showing package validation and publish checks passing.
Release Metadata package.json	Package version bumped from 5.1.9 to 5.1.10.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• SynkraAI/aiox-core#656: Prior PR that modified story lifecycle and QA handoff rules to enforce QA-driven status transitions; this PR extends those changes with explicit agent ownership boundaries and validator alignment.

Suggested labels

area: workflows, area: docs, area: core, area: pro, area: devops

Suggested reviewers

• Pedrovaleriolopez
• oalanicolas

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'fix: align story lifecycle QA ownership' directly and clearly summarizes the main change—aligning QA ownership in the story lifecycle rules, which is the primary focus of the PR.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/story-lifecycle-qa-ownership-20260507

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

📊 Coverage Report

Coverage report not available

📈 Full coverage report available in Codecov

---

Generated by PR Automation (Story 6.1)