[upstream-cq] sdk/python 0.19.0 / sdk/go v0.15.0: mandatory VIBE-check + user-approval gate before every `propose` — fork plugin prompt layer must rebase

[dwinter3]

Triggering events

• https://github.com/mozilla-ai/cq/releases/tag/sdk/python/0.19.0
• https://github.com/mozilla-ai/cq/releases/tag/sdk/go/v0.15.0 (concurrent release wave)
• Merged PR: fix(plugin): require VIBE check and user approval before every propose mozilla-ai/cq#488

What changed upstream

PR mozilla-ai#488 (fix(plugin): require VIBE check and user approval before every propose) is a security-class protocol fix shipped simultaneously to both SDKs and the canonical plugin. Three files were rewritten:

File	Change
plugins/cq/skills/cq/SKILL.md	Canonical skill source
sdk/python/src/cq/prompts/SKILL.md	Python SDK copy
sdk/go/prompts/SKILL.md	Go SDK copy

Key behavioural changes (+52 / -25 lines across all three):

1. New mandatory precondition on every direct propose call: agent must present the draft and receive explicit user approval before calling propose. The previous clean-check branch fell through to an ungated call — now it must also wait for approval.
2. propose-immediately re-scoped: "immediately" now means "draft and surface to the user the moment the insight stabilises" — not "skip the approval gate". This fixes the urgency/gate tension introduced in sdk/python 0.13.0 ([upstream-cq] sdk/python 0.13.0: propose-immediately protocol + SKILL/reflect prompt rewrites — fork must rebase plugin prompt layer #329).
3. Headless / unattended rules added:
   • Hard VIBE findings → block the propose outright.
   • Soft concerns → must be acknowledged in the candidate's own text.
   • Uncertain candidates → held for the next interactive session (because a configured remote publishes to the shared store immediately).
4. Core Protocol steps 3 & 4, rationalization check, Examples 2 & 4, Post-Error Behaviour — all wired to the new draft → VIBE✓ → present → approve → propose sequence.

Prompts synced via make sync-prompts; make check-prompts-sync CI gate passes.

Why it matters for 8th-layer

• 8th-layer-agent operates as a cq plugin host. Any fork copy of SKILL.md / prompt layer that has not been rebased to this version will allow agents to call propose without user approval, bypassing the VIBE safety gate.
• This is a security regression vector: a clean-check path that was silently ungated is now explicitly gated. Running the older prompt against the current SDK means the agent's behaviour diverges from what upstream considers safe.
• The fix spans both Python and Go SDKs in the same wave, so forks maintaining either adapter must be updated together.
• The headless-mode rules are new protocol surface — any 8th-layer deployment that runs agents in headless/automated mode (e.g. CI pipelines, background workers) needs to implement the hard-finding block and soft-concern acknowledgement rules.
• This interacts with [upstream-cq] sdk/python 0.13.0: propose-immediately protocol + SKILL/reflect prompt rewrites — fork must rebase plugin prompt layer #329 (propose-immediately) and [upstream-cq] cli/v0.10.0: Go SDK + CLI plugin prompt layer rewrites for propose-immediately — untracked surface beyond #329 #331 (Go SDK + CLI propose-immediately rewrite) — the urgency framing from those releases is now corrected by this fix.

Recommended actions

1. Immediate: Diff the fork's in-tree SKILL.md / plugin prompt copies against sdk/python/src/cq/prompts/SKILL.md @ sdk/python/0.19.0. Rebase to the new draft → VIBE✓ → present → approve → propose sequence.
2. Headless audit: Identify all 8th-layer-agent deployment modes that run without an interactive user. Implement the three new headless rules (hard-block, soft-acknowledge, uncertain-hold).
3. Go adapter: Rebase sdk/go/prompts/SKILL.md fork copy in the same PR — it is byte-identical to the Python copy for this change.
4. Regression test: Add a prompt-sync check analogous to upstream's make check-prompts-sync so future upstream prompt fixes are caught automatically.
5. Cross-reference: Close or update [upstream-cq] sdk/python 0.13.0: propose-immediately protocol + SKILL/reflect prompt rewrites — fork must rebase plugin prompt layer #329 and [upstream-cq] cli/v0.10.0: Go SDK + CLI plugin prompt layer rewrites for propose-immediately — untracked surface beyond #329 #331 to note that the propose-immediately urgency framing has been corrected by this release.

Fork delta classification

FORK_DELTA — protocol behaviour change (propose gating). Security-class. Both SDKs affected in one wave.