# 📦 WP-084 — `ci(repo): commit-time gates, split workflows, dev group`

> Engineering log · [Phase 6 — Evaluation, v0.1.0](https://borda.github.io/lucid-YOLO/engineering/phase-06-evaluation/)
>
> 🔗 Depends on [WP-004](https://borda.github.io/lucid-YOLO/work_packages/wp-004/) · Needed by none
>
> ⬅️ [WP-083](https://borda.github.io/lucid-YOLO/work_packages/wp-083/) · [Roadmap](https://borda.github.io/lucid-YOLO/ROADMAP/) · [WP-085](https://borda.github.io/lucid-YOLO/work_packages/wp-085/) ➡️


## WP-084 — commit-time gates

<a id="wp-084"></a>

Three checks were moved to where they can catch something, and the reasoning generalizes past this repository.

The **commit-trailer validator** was a CI job. Under a squash merge the per-commit messages CI validated are replaced by the squash message — so the job gated text that never lands. It belongs in a `commit-msg` hook or nowhere.

The **copyleft audit** went the other way: it stays a standalone always-run job rather than a diff-triggered one, because it scans the installed environment. A transitive copyleft bump touches no tracked file, so a diff-scoped trigger would never fire on the case it exists for.

The **`dev` extra** became a PEP 735 `[dependency-groups]` entry, which is what stops build/lint/test packages advertising themselves in the published wheel's metadata (`Provides-Extra: None` on the installed dist is the check).

Test-suite and docs-updated checks were deliberately left unhooked — a pre-commit hook that runs the suite trains the operator to pass `--no-verify`, which is worse than not having it.