ace-handbook 0.31.0 → 0.31.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 837b9e5d5edbfab28596d94f6e53d3b0a4641451cf43da81899591736a3352ed
-  data.tar.gz: d99a5b04b59b095d60575aac6adc4a7e7bf8009071b0fe42ba7bdb6d342bee3c
+  metadata.gz: 358264b1f225530c26fd23fcb8528d7e665b927daaa452350536a18c90148e9a
+  data.tar.gz: 776f9919aa44963a4f779ea662d8741e826436aed7ab23c7698a511190dab8ea
 SHA512:
-  metadata.gz: 90654bdde3d8faec5d009c9991091db20aa2f7033615959f82aeec5d7fdaab8a3a38865468f4b5d16c5f3331bbc582ab1fd9ead74f97fba798589cef9ab9a1d1
-  data.tar.gz: fc9dad5f9987207a3ff1c00782df8a4a663d8cba5296d06c3125ce8e0ab17d83506ba06186f91ae1d34f0033c3ef3362cfb80f927d67153edf6b01a5ca9d55b2
+  metadata.gz: 90c8229c6064db0967a97d999138395f57b7570c56d5742e31d717a0ccfbbef83e7127d771c095c960017c3ba021bd661196337e445d365821deb6ee01eee7ba
+  data.tar.gz: e30d53307d64883ff5d89a46aab6f4592559f72d1f6014ed4bc174f1554bd7f53a86cde03be5ade43afb85c1ead270b52094085b7dbd6a44fc1bdca632c014f0

data/CHANGELOG.md

@@ -7,6 +7,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+- Tightened `wfi://release/rubygems-publish` baseline guidance with an OTP-burst publication contract (build all artifacts before OTP; push in ≤5 concurrent waves; defer metadata verification) for project overlays.
+
+
+## [0.31.1] - 2026-09-02
+
+### Technical
+- Included in the coordinated all-package patch release preparation for ACE monorepo review.
 ## [0.31.0] - 2026-08-12
 
 ### Added

data/handbook/skills/as-release-rubygems-publish/SKILL.md

@@ -10,7 +10,7 @@ allowed-tools:
   - Bash(ace-bundle:*)
   - Read
 argument-hint: "[gem-name...] [--dry-run]"
-last_modified: 2026-04-10
+last_modified: 2026-08-12
 source: ace-handbook
 integration:
   targets:
@@ -46,5 +46,6 @@ None
 - Follow the workflow as the source of truth.
 - Do the work described by the workflow instead of only summarizing it.
 - When the workflow requires edits, tests, or commits, perform them in this project.
+- OTP timing: build every pending `.gem` first, then ask for one OTP (~30–45s), then push in ≤5-concurrent dependency waves aiming to finish within ~30s; verify metadata only after the burst.
 
 - After live publishing, recommend running `ace-test-e2e ace-monorepo-e2e TS-MONO-001` for installation verification.

data/handbook/workflow-instructions/release/rubygems-publish.wf.md

@@ -72,6 +72,7 @@ Publish plan (dry):
 echo "${GEM_HOST_API_KEY:+GEM_HOST_API_KEY is set}"
 ```
 
+If unset, try loading tooling env (for example `mise env`) without printing secrets, then re-check.
 Do not print secret values.
 
 ### 4. Publication gate
@@ -87,11 +88,23 @@ Only if a higher-priority project workflow authorizes pushes **and** the operato
 real publish (not merely prep/dry-run) may `gem build` + `gem push` proceed under that
 project contract's steps and verification gates.
 
-Suggested placeholders for a project overlay (not executed by this baseline):
+### 5. OTP-burst contract for project overlays (do not run from this baseline)
+
+When a project overlay authorizes live `gem push`, use this timing contract so one OTP can cover a large queue:
+
+1. Resolve credentials and the pending queue first
+2. **Build every pending `.gem` artifact** before asking for OTP
+3. Show the final queue (order, versions, artifact paths, count)
+4. Prompt once for OTP — codes are short-lived (**~30–45s**)
+5. Push immediately in dependency-respecting waves of **up to 5 concurrent** `gem push --otp` calls; aim to finish the burst in **≤30s**
+6. Verify RubyGems metadata **after** the burst (not between pushes)
+7. On expired/incorrect OTP: stop, list remaining gems, request a fresh OTP, resume without rebuilding unless an artifact is missing
+
+Suggested overlay commands (executed only under a project publication contract):
 
 ```bash
-# gem build <gemspec>
-# gem push <built-gem>   # only under project publication contract
+# gem build <gemspec>   # all pending artifacts first
+# gem push <built-gem> --otp <OTP>   # waves of ≤5 concurrent
 ```
 
 ## Override
@@ -105,8 +118,10 @@ WFI source). Keep URI `wfi://release/rubygems-publish` stable for the distribute
 - [ ] Ordered publish plan produced for requested gems
 - [ ] Credential presence reported without leaking secrets
 - [ ] No `gem push` / registry mutation from this baseline alone
+- [ ] Overlay guidance documents build-all → OTP → ≤5 concurrent wave publish → deferred verify
 
 ## Common Issues
 
 - ACE monorepo operators may use a specialized overlay; plain projects must not depend on it.
 - Missing credentials should block publish contracts, not local planning.
+- Asking for OTP before builds complete wastes the short OTP window on slow work.

data/lib/ace/handbook/version.rb

@@ -2,6 +2,6 @@
 
 module Ace
   module Handbook
-    VERSION = "0.31.0"
+    VERSION = "0.31.1"
   end
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: ace-handbook
 version: !ruby/object:Gem::Version
-  version: 0.31.0
+  version: 0.31.1
 platform: ruby
 authors:
 - Michal Czyz
 bindir: exe
 cert_chain: []
-date: 2026-08-12 00:00:00.000000000 Z
+date: 2026-09-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ace-support-config
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.17'
+        version: '0.18'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.17'
+        version: '0.18'
 - !ruby/object:Gem::Dependency
   name: ace-support-core
   requirement: !ruby/object:Gem::Requirement