chore(release): document tag-based workflow

.agents/skills/_shared/git-github-hard-stop.md

@@ -0,0 +1,20 @@
+<!-- SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -->
+<!-- SPDX-License-Identifier: Apache-2.0 -->
+
+# Git and GitHub Access Hard Stop
+
+Use this guardrail from any workflow that runs `git`, `ssh`, or `gh` commands.
+
+If a Git/GitHub command fails because of authentication, authorization, missing credentials, SSO, token scope, SSH key setup, remote access, or push permissions, stop and ask the user to resolve access.
+
+Do **not** work around access failures by:
+
+- switching remote protocols or remotes;
+- editing credentials, tokens, or SSH config;
+- generating new tokens or SSH keys;
+- rewriting remotes to bypass permissions;
+- force-pushing or bypassing branch protections/required checks.
+
+Report the exact command, the relevant error output, and the next action needed from the user, then wait.
+
+This hard stop is for access/authentication/authorization problems only. Normal Git workflow problems such as merge conflicts, stale branches, dirty worktrees, or mechanical rebase conflicts should be handled by the relevant workflow. Stop for user guidance only when conflict resolution would change behavior, alter contributor intent, or require a design decision.

.agents/skills/_shared/pr-follow-up.md

@@ -0,0 +1,42 @@
+<!-- SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -->
+<!-- SPDX-License-Identifier: Apache-2.0 -->
+
+# PR CI and Automated Review Follow-Up
+
+Use this workflow after creating a PR and after every push to an open PR.
+
+## Watch checks
+
+```bash
+PR_NUMBER=${PR_NUMBER:-$(gh pr view --json number -q .number)}
+gh pr checks "$PR_NUMBER" --watch
+```
+
+Then inspect the settled check state:
+
+```bash
+gh pr view "$PR_NUMBER" --json url,statusCheckRollup,comments,reviews,reviewDecision
+```
+
+## Inspect automated feedback
+
+Check sticky PR comments and inline review comments from CodeRabbit and the PR Review Advisor:
+
+```bash
+gh api "repos/NVIDIA/NemoClaw/issues/${PR_NUMBER}/comments" --paginate \
+  --jq '.[] | select((.body // "") | test("CodeRabbit|coderabbit|PR Review Advisor|nemoclaw-pr-review-advisor"; "i")) | {author: .user.login, updated_at, body}'
+
+gh api "repos/NVIDIA/NemoClaw/pulls/${PR_NUMBER}/comments" --paginate \
+  --jq '.[] | select((.body // "") | test("CodeRabbit|coderabbit|PR Review Advisor|nemoclaw-pr-review-advisor"; "i")) | {author: .user.login, path, line, updated_at, body}'
+```
+
+## Triage
+
+- **CI failure:** inspect the failing job logs, fix the root cause, rerun relevant local checks, commit, push, and monitor again.
+- **CodeRabbit or PR Review Advisor correctness/security/test-coverage finding:** address it when valid, rerun relevant checks, commit, push, and monitor again.
+- **Style nits or false positives:** avoid unnecessary churn. Note the rationale in your final report or comment on the PR when reviewer-visible context is useful.
+- **Ambiguous, risky, broad, or design-changing feedback:** stop and consult the user before changing code.
+
+Repeat until required CI is green and there are no unresolved actionable CodeRabbit or PR Review Advisor findings, or until the user tells you to stop.
+
+If any follow-up push or `gh`/GitHub query hits SSH, authentication, remote access, authorization, or permission problems, follow [Git and GitHub Access Hard Stop](git-github-hard-stop.md). Do not stop for ordinary merge conflicts or dirty-worktree state; resolve mechanical conflicts in the relevant workflow and ask the user only when resolution would change behavior or contributor intent.

.agents/skills/nemoclaw-contributor-create-pr/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: nemoclaw-contributor-create-pr
-description: Create GitHub pull requests that follow the NemoClaw PR template. Use when the user wants to create a new PR, submit code for review, open a pull request, or push changes for review. Trigger keywords - create PR, pull request, new PR, submit for review, open PR, push for review.
+description: Create GitHub pull requests that follow the NemoClaw PR template, then monitor CI and automated review feedback. Use when the user wants to create a new PR, submit code for review, open a pull request, or push changes for review. Trigger keywords - create PR, pull request, new PR, submit for review, open PR, push for review.
 ---
 
 # Create GitHub Pull Request
@@ -14,6 +14,10 @@ Create pull requests on the NemoClaw GitHub repository using the `gh` CLI. This
 - You must have commits on a branch that is pushed to the remote.
 - The PR description must include a valid DCO `Signed-off-by:` declaration, and every commit that will appear in the PR must appear as `Verified` in GitHub.
 
+## Hard Stop: Git, SSH, and Authentication Problems
+
+Follow the shared [Git and GitHub Access Hard Stop](../_shared/git-github-hard-stop.md) guardrail for SSH, authentication, remote access, authorization, or permission failures. Resolve ordinary Git workflow problems such as merge conflicts or dirty worktrees in the current workflow.
+
 ## Step 1: Verify Branch State
 
 Before creating a PR, verify the branch.
@@ -86,6 +90,8 @@ Ensure the branch is pushed to the remote.
 git push -u origin HEAD
 ```
 
+If the push fails because of SSH, authentication, remote access, authorization, or permission problems, follow [Git and GitHub Access Hard Stop](../_shared/git-github-hard-stop.md). Resolve ordinary non-access Git failures, such as merge conflicts or dirty worktrees, in the current workflow.
+
 ## Step 4: Prepare DCO Declaration and Verify GitHub Commits
 
 Before creating the PR, prepare the DCO declaration for the PR body and verify every commit in `main..HEAD`.
@@ -215,7 +221,7 @@ gh pr create \
   --title "<type>(<scope>): <description>" \
   --assignee "@me" \
   --body "$(cat <<'EOF'
-<full PR body from Step 5>
+<full PR body from Step 6>
 EOF
 )"
 ```
@@ -237,17 +243,23 @@ For work-in-progress that is not ready for review:
 gh pr create --draft --title "..." --assignee "@me" --body "..."
 ```
 
-## Step 8: Report the Result
+## Step 8: Monitor CI and Review Feedback
+
+After creating the PR, do not stop at the URL. Follow the shared [PR CI and Automated Review Follow-Up](../_shared/pr-follow-up.md) workflow: watch required CI, inspect CodeRabbit and PR Review Advisor feedback, address valid findings, and consult the user when feedback is ambiguous or design-changing.
+
+## Step 9: Report the Result
 
-After the PR is created, display the PR URL as a clickable markdown link:
+After the PR is created and the initial CI/reviewer follow-up is handled, display the PR URL as a clickable markdown link and summarize the status:
 
 ```text
 Created PR [#NNN](https://github.com/NVIDIA/NemoClaw/pull/NNN)
+CI: passing/pending/failing
+Automated review: no actionable findings / addressed findings / waiting on user
 ```
 
 ## Common Mistakes to Avoid
 
-- **Do not invent your own PR body format.** Use the template from Step 5 exactly.
+- **Do not invent your own PR body format.** Use the template from Step 6 exactly.
 - **Do not omit sections.** Even if a section is not applicable, keep it with the "Skip if..." comment.
 - **Do not check boxes for steps you did not run.** If you did not run `npm run docs`, leave that box unchecked.
 - **Do not rerun hook-covered checks by default.** Normal commit and push hooks are valid verification. Use `npx prek run --from-ref main --to-ref HEAD` as the fallback when hooks were skipped, missing, or uncertain.
@@ -257,3 +269,5 @@ Created PR [#NNN](https://github.com/NVIDIA/NemoClaw/pull/NNN)
 - **Do not rely on maintainers to repair contributor signature history.** If force-push is not allowed and the branch contains an unverified commit, use a fresh branch and fresh PR.
 - **Do not forget `--assignee @me`.** Every PR must be assigned to its creator.
 - **Do not create PRs from main.** Always use a feature branch.
+- **Do not troubleshoot Git/GitHub access in-agent.** If SSH, `gh`, authentication, remote access, authorization, or push permissions fail, stop and ask the user to fix access. Do resolve ordinary merge conflicts and dirty-worktree state when the workflow calls for it.
+- **Do not abandon the PR immediately after creation.** Watch CI and automated feedback from CodeRabbit and the PR Review Advisor, address valid findings, and consult the user when feedback is ambiguous.

.agents/skills/nemoclaw-contributor-update-docs/SKILL.md

@@ -239,6 +239,7 @@ Commit changes and open a pull request with a concise summary of the doc updates
 Apply the `area: docs`, `area: skills`, and next-patch release label so reviewers can identify doc-only changes for the next train and generated skill updates.
 When creating the PR with `gh pr create`, pass all labels, for example a post-release docs refresh for `0.0.63` uses `--label "area: docs" --label "area: skills" --label v0.0.64`.
 If the release label does not exist, report that instead of substituting another label.
+Follow `nemoclaw-contributor-create-pr` for the PR mechanics, including [Git and GitHub Access Hard Stop](../_shared/git-github-hard-stop.md) and [PR CI and Automated Review Follow-Up](../_shared/pr-follow-up.md).
 
 ## Tips
 
@@ -270,3 +271,4 @@ User says: "Catch up the docs for everything merged since v0.1.0."
    ```
 
    If the next-patch release label does not exist, report that the PR was created without the release label or that PR creation failed because the label was missing.
+   Follow up after PR creation using [PR CI and Automated Review Follow-Up](../_shared/pr-follow-up.md); use [Git and GitHub Access Hard Stop](../_shared/git-github-hard-stop.md) if access or authentication blocks progress.

.agents/skills/nemoclaw-maintainer-cut-release-tag/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: nemoclaw-maintainer-cut-release-tag
-description: Creates deterministic NemoClaw semver release tags on origin/main and drafts release notes. Use when cutting a release, tagging a version, shipping a build, creating vX.Y.Z tags, or preparing release announcements.
+description: Creates deterministic NemoClaw semver release tags on origin/main, handles release housekeeping, and drafts release notes. Use when cutting a release, tagging a version, shipping a build, creating vX.Y.Z tags, or preparing release announcements.
 user_invocable: true
 ---
 
@@ -9,9 +9,9 @@ user_invocable: true
 
 # Cut Release Tag
 
-Use the release scripts only. Do not run raw `git tag`, `git push`, `gh api`, or version-bump commands by hand for the normal release flow.
+Use the release scripts for normal release operations. Do not run raw `git tag`, `git push`, `gh api`, or version-bump commands by hand for the normal release flow.
 
-The release is one annotated semver tag on an already-merged `origin/main` commit. The GitHub workflow moves `latest`; release admins promote `lkg` manually after validation.
+The release is one annotated semver tag on an already-merged `origin/main` commit. The GitHub workflow moves `latest`; release admins promote `lkg` manually after validation. After the tag is cut, finish version-label housekeeping for remaining open issues/PRs and draft release notes for the maintainer to post.
 
 ## Hard Rules
 
@@ -21,6 +21,7 @@ The release is one annotated semver tag on an already-merged `origin/main` commi
 - Never push `latest` or `lkg` from this skill.
 - Never move, delete, or force-push an existing remote semver tag unless the maintainer explicitly starts protected-tag remediation.
 - Draft release notes locally. Do not create the GitHub Discussion; the maintainer does that.
+- Follow the shared [Git and GitHub Access Hard Stop](../_shared/git-github-hard-stop.md) for SSH, authentication, remote access, authorization, or permission failures.
 
 ## Workflow
 
@@ -32,8 +33,9 @@ Release Progress:
 - [ ] Step 2: Show plan and exact confirmation phrase
 - [ ] Step 3: Cut the semver tag from the confirmed plan
 - [ ] Step 4: Wait for workflow-managed latest
-- [ ] Step 5: Generate release-note data and draft Markdown
-- [ ] Step 6: Hand off announcement steps
+- [ ] Step 5: Housekeep remaining open issues/PRs
+- [ ] Step 6: Generate release-note data and draft Markdown
+- [ ] Step 7: Hand off announcement steps
 ```
 
 ### Step 1: Generate Release Plan
@@ -63,7 +65,8 @@ Read the generated `plan.json` and show the maintainer:
 - target `origin/main` commit and headline,
 - plan hash,
 - forbidden operations,
-- exact confirmation phrase.
+- exact confirmation phrase,
+- open issue/PR housekeeping plan for the release label.
 
 Ask the maintainer to paste the exact phrase:
 
@@ -87,7 +90,7 @@ The script verifies a clean worktree, unchanged `origin/main`, tag availability,
 <release-dir>/cut-result.json
 ```
 
-If the script fails, stop and report the error. Do not improvise git commands.
+If the script fails because of SSH, authentication, remote access, authorization, or permissions, follow [Git and GitHub Access Hard Stop](../_shared/git-github-hard-stop.md). For other precondition failures, report the failed precondition and use the recovery guidance below. Do not improvise git commands.
 
 ### Step 4: Wait for Workflow-Managed `latest`
 
@@ -105,7 +108,28 @@ The script waits until `vX.Y.Z^{}` and `latest^{}` both peel to the planned comm
 
 If it fails, report the failed workflow/status. Do not manually move `latest`.
 
-### Step 5: Generate Release-Note Data and Draft Markdown
+### Step 5: Housekeep Remaining Open Issues/PRs
+
+Move any remaining open issues or PRs labeled with the released version to the next patch label:
+
+```bash
+node --experimental-strip-types --no-warnings .agents/skills/nemoclaw-maintainer-day/scripts/bump-stragglers.ts <released-version> <next-version>
+```
+
+Then verify the released version has no open stragglers:
+
+```bash
+gh issue list --repo NVIDIA/NemoClaw --state open --label <released-version> --limit 100
+gh pr list --repo NVIDIA/NemoClaw --state open --label <released-version> --limit 100
+```
+
+Summarize:
+
+- shipped/closed items that remain associated with `<released-version>`;
+- open issues/PRs bumped to `<next-version>`;
+- any items that need manual maintainer attention.
+
+### Step 6: Generate Release-Note Data and Draft Markdown
 
 Collect deterministic release-note input:
 
@@ -129,7 +153,7 @@ Draft release notes from `notes-data.json` using the style from `nemoclaw-mainta
 
 Do not create or update a GitHub Discussion.
 
-### Step 6: Hand Off Announcement
+### Step 7: Hand Off Announcement
 
 Return:
 
@@ -138,6 +162,7 @@ Return:
 - plan path and plan hash,
 - `cut-result.json`, `latest-result.json`, and `notes-data.json` paths,
 - Markdown draft path,
+- issue/PR housekeeping summary,
 - suggested discussion title: `NemoClaw <new-version> is out`,
 - reminder: maintainer creates the Announcement discussion and shares its link in external channels.
 
@@ -149,3 +174,4 @@ Return:
 - `latest` workflow fails or times out: report the workflow/status; do not move `latest` manually.
 - `latest` workflow rejects a rollback: keep `latest` unchanged, inspect the plan target commit, and regenerate the plan for the current `origin/main` tip if appropriate.
 - `lkg` changed: stop and escalate to a release admin.
+- Housekeeping finds open items that should still ship in the released version: stop and ask the maintainer whether to leave the label or bump them.

.agents/skills/nemoclaw-maintainer-day/MERGE-GATE.md

@@ -9,15 +9,16 @@ For the full priority list see [PR-REVIEW-PRIORITIES.md](PR-REVIEW-PRIORITIES.md
 1. **CI green** — all required checks in `statusCheckRollup`.
 2. **No conflicts** — `mergeStateStatus` clean.
 3. **No major CodeRabbit** — ignore style nits; block on correctness/security bugs.
-4. **Risky code tested** — see [RISKY-AREAS.md](RISKY-AREAS.md). Confirm tests exist (added or pre-existing).
+4. **No unresolved actionable PR Review Advisor findings** — correctness, security, acceptance, and test-depth findings block until addressed or explicitly judged false-positive.
+5. **Risky code tested** — see [RISKY-AREAS.md](RISKY-AREAS.md). Confirm tests exist (added or pre-existing).
 
 ## Step 1: Run the Gate Checker
 
 ```bash
 node --experimental-strip-types --no-warnings .agents/skills/nemoclaw-maintainer-day/scripts/check-gates.ts <pr-number>
 ```
 
-This checks all 4 gates programmatically and returns structured JSON with `allPass` and per-gate `pass`/`details`.
+This checks the deterministic gates programmatically and returns structured JSON with `allPass` and per-gate `pass`/`details`. PR Review Advisor follow-up remains a manual review step; use [PR CI and Automated Review Follow-Up](../_shared/pr-follow-up.md) for the shared triage loop.
 
 ## Step 2: Interpret Results
 
@@ -28,15 +29,16 @@ The script handles the deterministic checks. You handle judgment calls:
 - **CI failing but narrow:** Follow the salvage workflow in [SALVAGE-PR.md](SALVAGE-PR.md).
 - **CI pending:** Wait and re-check. Do not approve while checks are still running.
 - **CodeRabbit:** Script flags unresolved major/critical threads. Review the `snippet` to confirm it's a real issue vs style nit. If doubt, leave unapproved.
+- **PR Review Advisor:** Read the latest sticky advisor comment and apply [PR CI and Automated Review Follow-Up](../_shared/pr-follow-up.md). Valid correctness, security, acceptance-coverage, and test-depth findings block approval unless explicitly judged false-positive.
 - **Tests:** If `riskyCodeTested.pass` is false, follow [TEST-GAPS.md](TEST-GAPS.md).
 
 ## Step 3: Approve or Report
 
-**Approve only when:** `allPass` is true AND `mergeStateStatus` is not DIRTY. Approving a PR with conflicts is wasted effort — the rebase will invalidate the approval.
+**Approve only when:** `allPass` is true, `mergeStateStatus` is not DIRTY, and the latest PR Review Advisor comment has no unresolved actionable findings. Approving a PR with conflicts is wasted effort — the rebase will invalidate the approval.
 
 The correct sequence for a conflicted PR: **salvage (rebase) → CI green → approve → report ready for merge.**
 
-**All pass + no conflicts:** Approve and summarize why.
+**All pass + no conflicts + no actionable PR Review Advisor findings:** Approve and summarize why.
 
 **Any fail:**
 

.agents/skills/nemoclaw-maintainer-day/PR-REVIEW-PRIORITIES.md

@@ -8,7 +8,8 @@ Ordered list of what NemoClaw maintainers look for in a pull request. Higher ite
 2. **CI green** — all required checks in `statusCheckRollup` must pass.
 3. **No merge conflicts** — `mergeStateStatus` must be clean.
 4. **No unresolved major/critical CodeRabbit findings** — correctness and safety findings block; style nits do not. Use judgment on borderline cases.
-5. **Tests for touched risky code** — risky areas must have test coverage, either added in the PR or pre-existing. No exceptions.
+5. **No unresolved actionable PR Review Advisor findings** — correctness, security, acceptance-coverage, and test-depth findings block unless explicitly judged false-positive. Ask the user before acting on ambiguous or design-changing advice.
+6. **Tests for touched risky code** — risky areas must have test coverage, either added in the PR or pre-existing. No exceptions.
 
 ## Quality expectations (block if violated, but fixable via salvage)
 
@@ -29,7 +30,7 @@ The team follows a daily ship cycle. All maintainer skills operate within this r
 
 1. **Morning** (`/nemoclaw-maintainer-morning`) — triage the backlog, pick items for the day, label them with the target version (e.g., `v0.0.8`).
 2. **During the day** (`/nemoclaw-maintainer-day`) — land PRs using the maintainer loop. Version labels make progress visible on dashboards.
-3. **Evening** (`/nemoclaw-maintainer-evening`) — check what shipped, bump open items to the next version (`v0.0.9`), generate a QA-focused summary, and cut the tag.
+3. **Evening** (`/nemoclaw-maintainer-evening`) — check what shipped, bump open items to the next version (`v0.0.9`), generate a QA-focused summary, cut the tag, and prepare release notes for posting.
 4. **Overnight** — QA team (different timezone) tests the tag. Any issues they file enter the next morning's triage like any other issue.
 
 Version labels are living markers: they always mean "ship in this version." If an item doesn't make the cut, the label moves to the next patch version.