refactor: make ARNES external-repo based with ticket publish flow

harness/agents.matrix.yml

@@ -4,18 +4,19 @@ roles:
   leader:
     emoji: "🧭"
     can_edit: ["work/", "backlog/", "spec/", "harness/", "AGENTS.md", "CHECKPOINTS.md"]
-    cannot_edit: ["src/", "tests/"]
+    cannot_edit: ["project/", "tests/"]
     responsibilities:
       - plan
       - orchestrate
       - enforce_gates
+      - publish_ticket_changes
       - close_feature
       - issue_orders_in_english_caveman
 
   triager:
     emoji: "🧩"
     can_edit: ["backlog/", "work/artifacts/", "spec/"]
-    cannot_edit: ["src/", "tests/", "backlog/features.json:status=done"]
+    cannot_edit: ["project/", "tests/", "backlog/features.json:status=done"]
     responsibilities:
       - normalize_requests
       - create_tickets_in_english_caveman
@@ -24,20 +25,21 @@ roles:
   architect:
     emoji: "🏗️"
     can_edit: ["spec/", "harness/contracts/", "docs/"]
-    cannot_edit: ["src/", "tests/", "backlog/features.json:status"]
+    cannot_edit: ["project/", "tests/", "backlog/features.json:status"]
     responsibilities:
       - design
       - update_contracts
 
   implementer:
     emoji: "🛠️"
-    can_edit: ["src/", "tests/", "work/artifacts/"]
+    can_edit: ["project/", "tests/", "work/artifacts/"]
     cannot_edit:
       - "backlog/features.json:done"
       - "work/history.md"
       - "work/artifacts/*/reviewer.json"
       - "work/artifacts/*/security.json"
       - "work/artifacts/*/qa.json"
+      - "work/artifacts/*/publish.json"
       - "work/artifacts/*/leader-close.json"
     responsibilities:
       - implement_feature
@@ -47,7 +49,7 @@ roles:
   reviewer:
     emoji: "🔍"
     can_edit: ["work/artifacts/"]
-    cannot_edit: ["src/", "tests/", "backlog/"]
+    cannot_edit: ["project/", "tests/", "backlog/"]
     responsibilities:
       - technical_review
       - emit_reviewer_verdict
@@ -55,7 +57,7 @@ roles:
   security:
     emoji: "🔒"
     can_edit: ["work/artifacts/"]
-    cannot_edit: ["src/", "tests/", "backlog/"]
+    cannot_edit: ["project/", "tests/", "backlog/"]
     responsibilities:
       - sast
       - dependency_review
@@ -65,7 +67,7 @@ roles:
   qa:
     emoji: "🧪"
     can_edit: ["work/artifacts/"]
-    cannot_edit: ["src/", "tests/", "backlog/"]
+    cannot_edit: ["project/", "tests/", "backlog/"]
     responsibilities:
       - acceptance_traceability
       - integration_e2e_checks
@@ -75,7 +77,7 @@ roles:
   documenter:
     emoji: "📚"
     can_edit: ["docs/", "spec/", "README.md", "HOWTO.md", "work/artifacts/"]
-    cannot_edit: ["src/", "tests/", "backlog/features.json:status"]
+    cannot_edit: ["project/", "tests/", "backlog/features.json:status"]
     responsibilities:
       - document_feature_changes
       - update_user_docs

harness/workflow.stages.yml

@@ -63,9 +63,16 @@ stages:
       - work/artifacts/<feature_id>/leader-close.json
       - work/history.md
 
+  - name: publish
+    owner: leader
+    required: true
+    output:
+      - work/artifacts/<feature_id>/publish.json
+
 close_requirements:
   - reviewer.json.verdict == "APPROVED"
   - security.json.verdict == "APPROVED"
   - qa.json.verdict == "APPROVED"
   - documenter.md exists
+  - publish.json.verdict == "PUBLISHED"
   - scripts/verify.sh exit_code == 0