wraplisted

# /wrap ## Goal Move from "code written and tested locally" to "PR open on GitHub" in one skill invocation, with all the safety gates intact. ## Modes | Mode | What it does | Trigger | |---|---|---| | `/wrap` | Commit + open PR. **User pushes manually.** | Default. | | `/wrap --auto-push` | Commit + push + open PR. User merges. | Explicit. | | `/wrap --auto-merge` | Full chain via `core/infra/auto-ship.sh`. | Explicit. | `--auto-merge` requires all 4 trigger conditions from `rules/policy/actions-billing-admin-merge.md` to hold. ## Steps ### 1. Pre-flight checks (gates) Run in order; any failure aborts before the commit. a. **gitleaks** on staged diff: ```bash gitleaks protect --staged --redact -v --config=gitleaks.toml --no-banner ``` Before trusting a clean result, confirm the gate is actually *live* with the fire drill (W-3) — it plants a synthetic secret matching the repo's own rule and asserts gitleaks catches it, so a misconfigured allowlist can't give a false all-clear: ```bash bash core/infra/gitleaks-fire-test.sh # PASS = gate live; FAIL = misconfigured; exit 2 = gitleaks absent (SKIP) ``` a2. **Remote-URL credential scan** (W-3) — a token baked into the push remote's URL lives in `.git/config`, invisible to the content scanners above: ```bash git remote get-url origin | python3 core/git-hooks/scan-remote-url.py ``` Nonzero exit = the remote URL embeds a credential; strip it before pushing. (The pre-push hook