phase5-D: schema-version policing gate (TDD)

.github/workflows/ci.yml

@@ -18,6 +18,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          # Phase-5 Track D needs origin/main reachable so
+          # check-schema-compat can diff against the PR base. Default
+          # checkout fetches only HEAD; full history is cheap on this
+          # repo (mostly markdown + small Python).
+          fetch-depth: 0
 
       - uses: actions/setup-python@v5
         with:
@@ -92,6 +98,15 @@ jobs:
         if: github.event_name != 'schedule'
         run: make check-licenses
 
+      - name: Schema-version policing (Phase-5 Track D — per-PR only)
+        # Per phase5-plan.md §5 D3: this gate fires per-PR only — a
+        # weekly cron firing wouldn't add signal because schema_compat
+        # bumps land via PRs by definition. Diffs against origin/main
+        # so the gate has a stable base ref regardless of which branch
+        # opened the PR.
+        if: github.event_name != 'schedule'
+        run: make check-schema-compat
+
   handshake:
     # Phase-3 Track D — discovery-protocol handshake. Runs the 8-step
     # external-agent walk-through end-to-end. On push/PR uses bundled

Makefile

@@ -1,4 +1,4 @@
-.PHONY: catalog validate-catalog check-catalog check-repo-meta phase0-smoke check-docs-prose recipes-check handshake check-freshness check-links check-licenses
+.PHONY: catalog validate-catalog check-catalog check-repo-meta phase0-smoke check-docs-prose recipes-check handshake check-freshness check-links check-licenses check-schema-compat
 
 # Phase-1 Track B's generator. Fetches each TIER_1+TIER_2+TIER_3 repo's
 # dist/repo.meta.json, validates it, translates it into a `tools.<key>`
@@ -124,3 +124,12 @@ check-links:
 # substring signature (≥ 2 markers per license).
 check-licenses:
 	python3 profile/build/check-licenses.py --offline
+
+# Phase-5 Track D: schema-version policing gate. Per-PR only — diffs
+# tools.schema.json + task_index.schema.json between the PR base and
+# HEAD; fails if schema_compat bumped without a matching
+# schema-changelog.md edit, or if a non-additive change (removed
+# required field, removed enum value, additionalProperties tightened
+# true→false) landed without a schema_compat bump.
+check-schema-compat:
+	python3 profile/build/check-schema-compat.py