kettle-family 1.2.65 → 1.2.67

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 91689a2523f60872d8bf698271affca29c3a9149510543f87b3df956300527a2
-  data.tar.gz: cab4664fe55f396532f46d0f808398d43880830baa824d41da9ffeb55a3d2659
+  metadata.gz: b6cce9c43c8db0ddb5984da9e0656dd3790a47dc718fa28195716a73d7b84a68
+  data.tar.gz: accd2cad6a1265c9c954e9908e6ab22ed02282bd0258c8116da295a9e6bf725f
 SHA512:
-  metadata.gz: 1efb4bbb117cba0494d53461f06b3921eef031dec347f905ada977116335c1f65d980e0909906f8d6bcf78e42a4902332fa4f28ab57d0c8a5634f5310d5c3a93
-  data.tar.gz: d3098d0dbe835bd746a7b0e93f524d22bf2007e19cb6968ef09a3a0f34486893edb84385fb6deaf8d8eb1984d0d8974ec273ea2f3b2d99fccb08e6e05f19497b
+  metadata.gz: f9bb56dbb8b43e418441588cd45c904d874086a7f9af349e097aa78a738779e86cef91dadf41e3f5ca0ae99737f717ccda23f0be250944646c247e24a0b3a99a
+  data.tar.gz: 45ea1c723af5437ec77d50961d3c0deca340358b2a904961addd8396ec47c28592faeaf68a94badbad8eb69da92b8124db7ad15fdf904fb91b29234830c6481e

data/CHANGELOG.md

@@ -30,6 +30,34 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [1.2.67] - 2026-08-30
+
+- TAG: [v1.2.67][1.2.67t]
+- COVERAGE: 93.17% -- 5453/5853 lines in 33 files
+- BRANCH COVERAGE: 76.13% -- 2210/2903 branches in 33 files
+- 30.32% documented
+
+### Changed
+
+- Add configurable aggregate release validation that runs shared changelog coverage and one monitored CI validation while preserving excluded independent members.
+
+- [kc] release-recovery-docs: Clarify direct release recovery from later steps.
+
+### Fixed
+
+- Emit member-scoped family release recovery commands from failed child release steps.
+
+## [1.2.66] - 2026-08-30
+
+- TAG: [v1.2.66][1.2.66t]
+- COVERAGE: 93.11% -- 5404/5804 lines in 33 files
+- BRANCH COVERAGE: 76.06% -- 2179/2865 branches in 33 files
+- 30.03% documented
+
+### Fixed
+
+- Derive monorepo release lockfile path policy from family configuration and keep sibling tool paths opt-in.
+
 ## [1.2.65] - 2026-08-30
 
 - TAG: [v1.2.65][1.2.65t]
@@ -2279,7 +2307,11 @@ Please file a bug if you notice a violation of semantic versioning.
 - Fixed CI load failures on engines without compatible `pty` support by falling back to Open3 for interactive release commands.
 - Fixed Ruby 3.2 version-bump support by loading Prism lazily and wiring the Prism gem only for MRI versions that need it.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-family/compare/v1.2.65...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-family/compare/v1.2.67...HEAD
+[1.2.67]: https://github.com/kettle-dev/kettle-family/compare/v1.2.66...v1.2.67
+[1.2.67t]: https://github.com/kettle-dev/kettle-family/releases/tag/v1.2.67
+[1.2.66]: https://github.com/kettle-dev/kettle-family/compare/v1.2.65...v1.2.66
+[1.2.66t]: https://github.com/kettle-dev/kettle-family/releases/tag/v1.2.66
 [1.2.65]: https://github.com/kettle-dev/kettle-family/compare/v1.2.64...v1.2.65
 [1.2.65t]: https://github.com/kettle-dev/kettle-family/releases/tag/v1.2.65
 [1.2.64]: https://github.com/kettle-dev/kettle-family/compare/v1.2.63...v1.2.64

data/README.md

@@ -249,24 +249,37 @@ release:
   family_changelog:
     enabled: true
     command: bundle exec kettle-changelog
+  aggregate_validation:
+    enabled: true
+    exclude_members:
+      - kettle-jem
 ```
 
 `family.local_path_env` names the environment variable that activates local
-path dependencies for this family. It is the family identity used by other
-families when they scan lockfile `PATH` remotes and need to disable local
-resolution before writing CI-facing release lockfiles. Configure it when the
-env name is not the default derived from `family.name`.
+path dependencies for this family. For an explicitly configured
+`family.mode: monorepo`, `kettle-family` derives a release-lock policy that
+allows only `family.members_root` (or the configured member root) and passes
+that policy to each `kettle-release` child. Those paths are valid because the
+same monorepo checkout exists in CI. The tracked `Gemfile.lock` remains a
+development lockfile and may retain those member `PATH` sources.
+
+Sibling-repository families do not receive this exception. Their canonical
+lockfiles must use released dependencies: a local Kettle Dev workspace, or
+any other sibling workspace, is never allowed merely because its `*_DEV`
+variable is set. Use `release.allowed_local_path_roots` together with
+`release.allowed_local_path_env` only for an intentionally CI-available path
+layout that cannot be inferred from a monorepo configuration.
 
 `release.disable_local_path_env` is different: it is an extra release-lockfile
 normalization shutoff list for path-injecting env vars that are not themselves
 discoverable as family roots, such as vendored parser/tooling paths.
 
-`release.local_path_strategy: waves` allows a release task to provide the
-family local-path environment as its default. Member release commands keep
-that path only while they have a selected sibling dependency that has not
-completed an earlier release wave; once the dependency is available, the
-member resolves it from the registry. Release lockfile normalization always
-disables local paths regardless of this strategy.
+`release.local_path_strategy: waves` is for sibling families that explicitly
+choose wave-local development resolution. An explicit monorepo instead keeps
+its configured member-root path available throughout its waves, because its
+canonical development lockfile and CI checkout share that path graph. In both
+cases, release normalization rejects every path outside the configured allow
+list.
 
 ### Release waves and dependency refresh
 
@@ -314,6 +327,29 @@ configured family name and `K_CHANGELOG_VERSION_FILE` when `version_file` is
 configured, so `kettle-changelog` can operate from a repository root without a
 root gemspec.
 
+### Aggregate release validation
+
+Set `release.aggregate_validation.enabled: true` only for a shared-changelog
+family whose root suite validates the release graph. `kettle-family` then:
+
+1. Runs `family_changelog` once, which runs the root coverage suite once.
+2. Marks the first selected non-excluded member's release-prep commit as the
+   aggregate CI validation and waits for that one CI run.
+3. Skips member changelog generation, the duplicate `bin/rake` test task, and
+   remote CI monitoring for the remaining aggregate members.
+
+The marker is explicit (`[kettle-family:aggregate-ci]` for the validation
+commit and `[kettle-family:aggregate-member]` for later members), allowing the
+repository workflow to run one root suite for the validation commit and skip
+redundant jobs for later release-only commits. Configure that workflow behavior
+before enabling this policy.
+
+Use `release.aggregate_validation.exclude_members` for a member that remains
+independently releasable. Excluded members keep their own changelog coverage,
+local test task, and monitored CI release flow. This is appropriate for a tool
+such as `kettle-jem`, whose independent releases must not rely on a coordinated
+family release having run first.
+
 For a flat repository that releases from multiple long-lived branches, list the
 release branches under `release.target_branches`. The branch list is processed
 in order. Each branch must be clean enough for `git checkout`, and each branch
@@ -346,6 +382,12 @@ metadata fix requires a new full release run from step 0:
 kettle-family release --publish --start-step 10 --local-ci
 ```
 
+`--skip-changelog` skips only `kettle-changelog`; `--skip-appraisals` skips
+only the Appraisal generation portion of release step 5 and still runs
+`bin/rake yard`; and `--skip-ci` skips only remote CI monitoring. The generic
+`--skip-steps LIST` remains available when a numbered release step is the
+intended boundary.
+
 Executed publish runs skip versions that are already published. CI failures
 abort by default; pass `--continue-ci-failures` to set
 `K_RELEASE_CI_CONTINUE=true` for the underlying `kettle-release` process.
@@ -639,9 +681,12 @@ Executed family resets fail if the resulting lockfiles still contain sibling
 path remotes or checksum gaps.
 
 Resume a failed family publish after fixing the failure. Already published
-versions are skipped automatically; `start_step` is passed to `kettle-release`
-for unreleased members that still need work. Use `--start-step` only after the
-pre-release gate already passed or the failure was intentionally handled:
+versions are skipped automatically. A release report gives a member-scoped
+resume command for each failed child, including the recorded `--start-step`
+when the child emitted a failed release-step event. Run those commands one at a
+time. If any members were never started, the report also gives a separate
+normal-flow command for exactly those members. Use `--start-step` only after
+the pre-release gate already passed or the failure was intentionally handled:
 
 ```console
 kettle-family release --publish --execute --start-step 10
@@ -986,7 +1031,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-5.782-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-5.853-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-family/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/lib/kettle/family/cli.rb

@@ -164,6 +164,7 @@ module Kettle
             release_fast_recovery_members: nil,
             release_skip_ci: false,
             release_skip_changelog: false,
+            release_skip_appraisals: false,
             release_local_ci: false,
             release_continue_ci_failures: false,
             release_ci_workflows: nil,
@@ -537,6 +538,7 @@ module Kettle
         option :fast_recovery_members, long: "--fast-recovery-members", value: {type: String, usage: "MEMBERS"}, desc: "Limit fast recovery to selected comma-separated members; defaults to all selected members"
         option :skip_ci, long: "--skip-ci", desc: "Run every selected member from step 0 while skipping only remote CI monitoring; requires --publish"
         option :skip_changelog, long: "--skip-changelog", desc: "Run release checks and child releases while skipping kettle-changelog"
+        option :skip_appraisals, long: "--skip-appraisals", desc: "Skip appraisal generation while retaining documentation generation"
         option :local_ci, long: "--local-ci", desc: "Pass --local-ci through to kettle-release commands"
         option :continue_ci_failures, long: "--continue-ci-failures", desc: "Set K_RELEASE_CI_CONTINUE=true for release commands"
         option :ci_workflows, long: "--ci-workflows", value: {type: String, usage: "LIST"}, desc: "Pass a comma-separated CI workflow monitor subset through to kettle-release commands"
@@ -566,6 +568,7 @@ module Kettle
             release_fast_recovery_members: options[:fast_recovery_members],
             release_skip_ci: truthy_option?(:skip_ci),
             release_skip_changelog: truthy_option?(:skip_changelog),
+            release_skip_appraisals: truthy_option?(:skip_appraisals),
             release_local_ci: truthy_option?(:local_ci),
             release_continue_ci_failures: truthy_option?(:continue_ci_failures),
             release_ci_workflows: options[:ci_workflows],
@@ -844,6 +847,7 @@ module Kettle
           fast_recovery_members: options[:release_fast_recovery_members],
           skip_ci: options[:release_skip_ci],
           skip_changelog: options[:release_skip_changelog],
+          skip_appraisals: options[:release_skip_appraisals],
           local_ci: options[:release_local_ci],
           continue_ci_failures: options[:release_continue_ci_failures],
           ci_workflows: options[:release_ci_workflows],

data/lib/kettle/family/command_result.rb

@@ -16,7 +16,8 @@ module Kettle
       :reason,
       :branch,
       :output_streamed,
-      :log_path
+      :log_path,
+      :resume_step
     ) do
       def to_h
         {
@@ -33,7 +34,8 @@ module Kettle
           "skipped" => skipped,
           "reason" => reason,
           "output_streamed" => output_streamed?,
-          "log_path" => log_path
+          "log_path" => log_path,
+          "resume_step" => resume_step
         }
       end
 

data/lib/kettle/family/config.rb

@@ -266,6 +266,23 @@ module Kettle
         fetch_path("release", "local_path_strategy").to_s
       end
 
+      def release_allowed_local_path_roots
+        inferred = configured_monorepo_release? ? [family_local_path_root] : []
+        configured = Array(fetch_path("release", "allowed_local_path_roots"))
+          .map { |path| expand_config_relative_path(path) }
+        (inferred + configured).uniq
+      end
+
+      def release_allowed_local_path_env_names
+        inferred = configured_monorepo_release? ? [family_local_path_env_name] : []
+        configured = Array(fetch_path("release", "allowed_local_path_env"))
+        (inferred + configured).compact.map(&:to_s).reject(&:empty?).uniq
+      end
+
+      def configured_monorepo_release?
+        fetch_path("family", "mode") == "monorepo"
+      end
+
       def release_secrets
         stringify_keys(fetch_path("release", "secrets") || {})
       end
@@ -296,6 +313,21 @@ module Kettle
         fetch_path("release", "family_changelog", "command") || "bundle exec kettle-changelog"
       end
 
+      # An aggregate validation release runs the shared changelog/coverage
+      # suite once locally, then validates that family state once in CI before
+      # publishing the remaining members. Excluded members retain their normal
+      # independent kettle-release test and CI lifecycle.
+      def release_aggregate_validation?
+        fetch_path("release", "aggregate_validation", "enabled") == true
+      end
+
+      def release_aggregate_validation_excluded_members
+        Array(fetch_path("release", "aggregate_validation", "exclude_members"))
+          .map(&:to_s)
+          .map(&:strip)
+          .reject(&:empty?)
+      end
+
       def release_tag_command
         fetch_path("release", "tag_command") || command_for("release_tag") || "git tag"
       end

data/lib/kettle/family/report.rb

@@ -67,7 +67,8 @@ module Kettle
           "command" => command,
           "results" => results.map(&:to_h),
           "summary" => summary,
-          "resume_hint" => resume_hint
+          "resume_hint" => resume_hint,
+          "resume_hints" => resume_hints
         }
       end
 
@@ -145,7 +146,13 @@ module Kettle
         lines << "  skipped: #{summary_list(data.fetch("skipped"))}"
         lines << "  failed: #{summary_list(data.fetch("failed").map { |entry| summary_entry(entry) })}"
         lines << "  pending: #{summary_list(data.fetch("pending").map { |entry| summary_entry(entry) })}"
-        lines << "  resume: #{data.fetch("resume_hint")}" if data.fetch("resume_hint")
+        hints = data.fetch("resume_hints")
+        if hints.one?
+          lines << "  resume: #{hints.first}"
+        elsif hints.any?
+          lines << "  resume:"
+          hints.each { |hint| lines << "    #{hint}" }
+        end
       end
 
       def report_context_lines
@@ -170,7 +177,8 @@ module Kettle
           "failed" => summary_failed,
           "pending" => summary_pending,
           "release_log_dirs" => release_log_dirs,
-          "resume_hint" => resume_hint
+          "resume_hint" => resume_hint,
+          "resume_hints" => resume_hints
         }
       end
 
@@ -661,21 +669,50 @@ module Kettle
       end
 
       def resume_hint
+        resume_hints.first
+      end
+
+      def resume_hints
+        return [] if success?
+        return non_release_resume_hints unless command == "release"
+
+        release_resume_hints
+      end
+
+      def non_release_resume_hints
         failed = results.find { |result| !result.ok? }
-        resume_hint_for(failed) if failed
+        failed ? [resume_hint_for(failed)] : []
+      end
+
+      def release_resume_hints
+        failed_hints = visible_results.reject(&:ok?).map { |result| resume_hint_for(result) }.uniq
+        pending_names = summary_pending.map { |entry| entry.fetch("member") }
+        return failed_hints if pending_names.empty?
+
+        [*failed_hints, release_resume_hint_for_pending(pending_names)]
       end
 
       def resume_hint_for(result)
-        return release_resume_hint if command == "release"
+        return release_resume_hint(result) if command == "release"
 
         "kettle-family #{command} --start-at #{result.member_name}"
       end
 
-      def release_resume_hint
-        hint = "kettle-family release --execute"
-        hint = "#{hint} --publish" if release_mode == "publish"
+      def release_resume_hint(result)
+        hint = release_resume_base
+        hint = "#{hint} --only #{result.member_name}" if result.member_name
+        hint = "#{hint} --start-step #{result.resume_step}" if result.respond_to?(:resume_step) && result.resume_step
         hint
       end
+
+      def release_resume_hint_for_pending(member_names)
+        "#{release_resume_base} --only #{member_names.join(",")}"
+      end
+
+      def release_resume_base
+        hint = "kettle-family release --execute"
+        (release_mode == "publish") ? "#{hint} --publish" : hint
+      end
     end
   end
 end

data/lib/kettle/family/version.rb

@@ -5,7 +5,7 @@ module Kettle
     # Version namespace for this gem.
     module Version
       # Current gem version.
-      VERSION = "1.2.65"
+      VERSION = "1.2.67"
     end
     # Current gem version exposed at the traditional constant location.
     VERSION = Version::VERSION # Traditional Constant Location

data/lib/kettle/family/workflow.rb

@@ -106,7 +106,7 @@ module Kettle
       REGISTRY_WAIT_ATTEMPTS = 15
       REGISTRY_WAIT_INTERVAL_SECONDS = 15
 
-      def initialize(command:, config:, members:, family_members: nil, execute: false, accept: true, commit: true, allow_dirty: false, autostash: true, template_cleanup: true, publish: false, push: false, tag: false, start_step: nil, skip_steps: nil, fast_recovery: nil, fast_recovery_members: nil, skip_ci: false, skip_changelog: false, local_ci: false, continue_ci_failures: false, ci_workflows: nil, skip_bundle_audit: false, skip_remotes: nil, required_remotes: nil, auto_dependency_floors: nil, validate_ci_bundles: nil, gha_sha_pins_upgrade: "patch", gha_sha_pins_check: false, gha_sha_pins_ttl_days: nil, env_overrides: {}, debug: false, verbose: false, gem_signing_password: nil, secrets_provider: nil, jobs: nil, progress_io: nil, reset_target: nil, bup_args: [], bex_args: [], start_member: nil, start_branch: nil, **options)
+      def initialize(command:, config:, members:, family_members: nil, execute: false, accept: true, commit: true, allow_dirty: false, autostash: true, template_cleanup: true, publish: false, push: false, tag: false, start_step: nil, skip_steps: nil, fast_recovery: nil, fast_recovery_members: nil, skip_ci: false, skip_changelog: false, skip_appraisals: false, local_ci: false, continue_ci_failures: false, ci_workflows: nil, skip_bundle_audit: false, skip_remotes: nil, required_remotes: nil, auto_dependency_floors: nil, validate_ci_bundles: nil, gha_sha_pins_upgrade: "patch", gha_sha_pins_check: false, gha_sha_pins_ttl_days: nil, env_overrides: {}, debug: false, verbose: false, gem_signing_password: nil, secrets_provider: nil, jobs: nil, progress_io: nil, reset_target: nil, bup_args: [], bex_args: [], start_member: nil, start_branch: nil, **options)
         @command = command
         @config = config
         @members = members
@@ -136,6 +136,7 @@ module Kettle
         @fast_recovery_members = normalize_fast_recovery_members(fast_recovery_members)
         @skip_ci = !!skip_ci
         @skip_changelog = !!skip_changelog
+        @skip_appraisals = !!skip_appraisals
         @local_ci = local_ci
         @continue_ci_failures = continue_ci_failures
         @ci_workflows = validate_ci_workflows(ci_workflows)
@@ -205,7 +206,7 @@ module Kettle
         execute && release_command_delegates_secrets_to_kettle_release?
       end
 
-      attr_reader :command, :config, :members, :family_members, :execute, :accept, :commit, :allow_dirty, :autostash, :template_cleanup, :publish, :push, :tag, :start_step, :skip_steps, :fast_recovery, :fast_recovery_members, :skip_ci, :skip_changelog, :local_ci, :continue_ci_failures, :ci_workflows, :skip_bundle_audit, :skip_remotes, :required_remotes, :auto_dependency_floors, :validate_ci_bundles, :gha_sha_pins_upgrade, :gha_sha_pins_check, :gha_sha_pins_ttl_days, :env_overrides, :debug, :verbose, :jobs, :progress_io, :reset_target, :bup_args, :bex_args, :start_member, :start_branch
+      attr_reader :command, :config, :members, :family_members, :execute, :accept, :commit, :allow_dirty, :autostash, :template_cleanup, :publish, :push, :tag, :start_step, :skip_steps, :fast_recovery, :fast_recovery_members, :skip_ci, :skip_changelog, :skip_appraisals, :local_ci, :continue_ci_failures, :ci_workflows, :skip_bundle_audit, :skip_remotes, :required_remotes, :auto_dependency_floors, :validate_ci_bundles, :gha_sha_pins_upgrade, :gha_sha_pins_check, :gha_sha_pins_ttl_days, :env_overrides, :debug, :verbose, :jobs, :progress_io, :reset_target, :bup_args, :bex_args, :start_member, :start_branch
 
       def template_with_worktree_sync_results
         runner = command_runner
@@ -1219,6 +1220,7 @@ module Kettle
         runner = release_command_runner
         results = []
         @release_completed_member_names = []
+        @aggregate_validation_member_name = aggregate_validation_members(release_members).first&.name
         append_family_changelog_result(runner: runner, memo: results) if include_family_changelog
         return results unless results.all?(&:ok?)
         return parallel_release_member_results(release_members, results) if parallel_release_members?(release_members)
@@ -1376,16 +1378,18 @@ module Kettle
           memo.last(2).each { |result| emit_member_result_progress(member, result, progress: progress) }
           return memo unless memo.last(2).all?(&:ok?)
 
+          release_event_state = {}
           release_result = runner.call(
             member: member,
             phase: release_phase,
             command: release_command_for(member),
             env: release_env_for_member(member),
             interactive: release_command_interactive?,
-            stdout_line_handler: release_event_line_handler(member, progress: progress),
+            stdout_line_handler: release_event_line_handler(member, progress: progress, state: release_event_state),
             log_path: release_command_log_path(member, release_phase),
             passthrough_output: release_command_passthrough_output?
           )
+          release_result.resume_step = release_event_state[:failed_step] unless release_result.ok?
           memo << release_result
           emit_member_result_progress(member, memo.last, progress: progress)
           return memo unless memo.last.ok?
@@ -2222,7 +2226,8 @@ module Kettle
         effective_skip_steps = release_skip_steps_for(member)
         args << "start_step=#{effective_start_step}" if effective_start_step
         args << "skip_steps=#{effective_skip_steps}" unless effective_skip_steps.empty?
-        args << "--skip-changelog" if skip_changelog
+        args << "--skip-changelog" if skip_changelog || aggregate_validation_member?(member)
+        args << "--skip-appraisals" if skip_appraisals
         args << "--ci-workflows=#{ci_workflows}" if ci_workflows && !ci_workflows.to_s.empty?
         args << "--local-ci" if local_ci
         args << "--skip-bundle-audit" if skip_bundle_audit
@@ -2245,12 +2250,37 @@ module Kettle
         (fast_recovery == "retry-ci") ? 10 : 11
       end
 
-      def release_skip_steps_for(_member)
+      def release_skip_steps_for(member)
         steps = Array(skip_steps).flat_map { |entry| entry.to_s.split(",") }.map(&:strip).reject(&:empty?)
         steps << "10" if skip_ci
+        if aggregate_validation_member?(member)
+          # The shared family changelog already ran the full local suite. The
+          # validation member waits for the one aggregate CI run; all later
+          # aggregate members publish without duplicate test/monitor phases.
+          steps << "4"
+          steps << "10" unless aggregate_validation_member_name?(member)
+        end
         steps.uniq.join(",")
       end
 
+      def aggregate_validation_members(release_members = members)
+        return [] unless config.release_aggregate_validation?
+        return [] unless config.shared_changelog?
+
+        excluded = config.release_aggregate_validation_excluded_members
+        Array(release_members).reject { |member| excluded.include?(member.name) }
+      end
+
+      def aggregate_validation_member?(member)
+        return false unless member
+
+        aggregate_validation_members.include?(member)
+      end
+
+      def aggregate_validation_member_name?(member)
+        member && member.name == (@aggregate_validation_member_name || aggregate_validation_members.first&.name)
+      end
+
       def fast_recovery_for?(member)
         return false unless fast_recovery
         return false unless member
@@ -2349,6 +2379,7 @@ module Kettle
       def release_env_for_member(member)
         env = release_env
         env.merge!(release_wave_local_path_env_for(member))
+        env.merge!(release_local_path_policy_env)
         # Family release performs one live pin review before member releases.
         # Child kettle-release must consume that reviewed cache instead of
         # repeating the GitHub API lookup for every member.
@@ -2376,6 +2407,9 @@ module Kettle
           # GitHub Release.
           env["KETTLE_RELEASE_SKIP_GITHUB_RELEASE"] = "true" if aggregate_monorepo_github_release?
         end
+        if aggregate_validation_member?(member)
+          env["KETTLE_RELEASE_FAMILY_CI_MODE"] = aggregate_validation_member_name?(member) ? "validation" : "member"
+        end
         return env unless config.shared_changelog?
         if config.member_local_changelog?(member)
           return env.merge(
@@ -2412,6 +2446,14 @@ module Kettle
       # already treated as registry dependencies; this is what makes resume
       # runs work after an earlier wave has been published.
       def release_wave_local_path_env_for(member)
+        # Monorepo members and their sibling dependencies share the same CI
+        # checkout, so their canonical development lockfile may keep those
+        # paths throughout every release wave.
+        if config.configured_monorepo_release?
+          env_name = config.family_local_path_env_name
+          return env_name ? {env_name => config.family_local_path_root} : {}
+        end
+
         return {} unless config.release_local_path_strategy == "waves"
 
         env_name = config.family_local_path_env_name
@@ -3232,11 +3274,15 @@ module Kettle
         end
       end
 
-      def release_event_line_handler(member, progress: nil)
+      def release_event_line_handler(member, progress: nil, state: nil)
         lambda do |line|
           event = parse_template_event(line)
           next false unless event
 
+          if event["type"] == "command_step" && event["phase"] == "release" && event["status"] == "failed"
+            state[:failed_step] = event["index"].to_i if state && event["index"].to_s.match?(/\A\d+\z/)
+          end
+
           if progress_io
             if suppress_release_secret_provider_event?(event, progress: progress)
               next true
@@ -4034,15 +4080,22 @@ module Kettle
       end
 
       def release_allowed_local_path_roots
-        # Release env disables are passed to Bundler normalization, but they
-        # must not hide the active workspace roots from readiness diagnostics.
-        release_local_path_env_detection_sources.filter_map do |key, value|
-          next unless key.end_with?("_LOCAL", "_DEV")
-          next unless local_path_env_value?(value)
-          next unless value.to_s.strip.start_with?("/", "./", "../", "~")
+        config.release_allowed_local_path_roots
+      end
 
-          value
-        end
+      def release_allowed_local_path_env_names
+        config.release_allowed_local_path_env_names
+      end
+
+      def release_local_path_policy_env
+        roots = release_allowed_local_path_roots
+        env_names = release_allowed_local_path_env_names
+        return {} if roots.empty? && env_names.empty?
+
+        {
+          "KETTLE_RELEASE_ALLOWED_LOCAL_PATH_ROOTS" => roots.join(File::PATH_SEPARATOR),
+          "KETTLE_RELEASE_ALLOWED_LOCAL_PATH_ENVS" => env_names.join(",")
+        }
       end
 
       def release_lockfile_local_path_env_overrides(member = nil)
@@ -4051,11 +4104,18 @@ module Kettle
           key = key.to_s
           next unless key.end_with?("_LOCAL", "_DEV")
           next unless local_path_env_value?(value)
+          next if release_allowed_local_path_env_names.include?(key)
 
           memo[key] = "false"
         end
         inferred = member ? release_lockfile_inferred_local_path_env(member).to_h { |key| [key, "false"] } : {}
-        explicit.merge(derived).merge(inferred)
+        explicit.merge(derived).merge(inferred).merge(release_member_local_path_env(member))
+      end
+
+      def release_member_local_path_env(member)
+        return {} unless config.configured_monorepo_release?
+
+        release_wave_local_path_env_for(member)
       end
 
       def release_lockfile_inferred_local_path_env(member)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-family
 version: !ruby/object:Gem::Version
-  version: 1.2.65
+  version: 1.2.67
 platform: ruby
 authors:
 - Peter H. Boling
@@ -74,7 +74,7 @@ dependencies:
         version: '1.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.0.6
+        version: 1.0.7
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -84,14 +84,14 @@ dependencies:
         version: '1.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.0.6
+        version: 1.0.7
 - !ruby/object:Gem::Dependency
   name: kettle-dev
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.0.18
+        version: 3.0.22
     - - "<"
       - !ruby/object:Gem::Version
         version: 4.0.0
@@ -101,7 +101,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.0.18
+        version: 3.0.22
     - - "<"
       - !ruby/object:Gem::Version
         version: 4.0.0
@@ -441,10 +441,10 @@ licenses:
 - AGPL-3.0-only
 metadata:
   homepage_uri: https://kettle-family.galtzo.com
-  source_code_uri: https://github.com/kettle-dev/kettle-family/tree/v1.2.65
-  changelog_uri: https://github.com/kettle-dev/kettle-family/blob/v1.2.65/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-family/tree/v1.2.67
+  changelog_uri: https://github.com/kettle-dev/kettle-family/blob/v1.2.67/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-family/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-family/1.2.65
+  documentation_uri: https://www.rubydoc.info/gems/kettle-family/1.2.67
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-family/wiki
   news_uri: https://www.railsbling.com/tags/kettle-family