kettle-family 1.3.35 → 1.3.37

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: df70ef40b82ccb54155fc57a43a1137d620d3cbd78cd74643d050b9056f3ecdb
-  data.tar.gz: aff84d0529ac6ef7b78a3248160eb72b4077f51609362c887837b1cd390a9a10
+  metadata.gz: b5f2d0bb8696a55925ff46bffa665da140b2f861e47eab151769c9522d160385
+  data.tar.gz: e64870163a6fa68862654f72c68ba492382fb8e637d9d1b91c9fb92f4c73dfb5
 SHA512:
-  metadata.gz: e3ba12f341362839b45835afda346efa79c49aa886cf5d731980e0d9a2090ffe0297abb752bf72a293135e6ab4fa64c1f132210c882edfef2583c56204fb8355
-  data.tar.gz: 7cd500810f8b034e00be64dc03574d957c578be29ef1df6d17ca4bf73999c1c47a381d57799e445f1f4c0cabae3622c0ad44152b1152175c1a4b252e0800a034
+  metadata.gz: 940c6a65b81be4855325eae21951069520d5ac8ae0e1385e5f31d0060256ce4aed0a81c2baa2e9ec335f010119d0ebdb211d113297c6b7620a5884da637acac5
+  data.tar.gz: 896a7fed86b1e22518425858c99720c93ae1740b5b1cc32eb7639212fc691313ae9e619dfb3c7c60186454f32ff4624f02427feda30137e860b6545a40e05666

data/CHANGELOG.md

@@ -30,6 +30,50 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [1.3.37] - 2026-10-30
+
+- TAG: [v1.3.37][1.3.37t]
+- COVERAGE: 93.13% -- 7665/8230 lines in 45 files
+- BRANCH COVERAGE: 77.52% -- 3076/3968 branches in 45 files
+- 39.41% documented
+
+### Added
+
+- Release preflight now blocks on bootstrap dependency drift: a new `bootstrap dependency drift` phase compares each selected member's committed Gemfile.lock against the newest published version satisfying the member's declared floor for bootstrap-managed gems (`release.drift_check.gems`, default `[nomono]`), failing with a `bundle update <gem>` / family template sweep remediation hint; registry lookup failures skip non-fatally instead of blocking.
+
+- New family config release.version_series.independent_members: members that keep their own monotonic version series in a shared-version family. They are skipped by lockstep shared-version raises and exempt from the aggregate GitHub Release same-version invariant, while their built artifacts still attach to the aggregate release.
+
+### Fixed
+
+- kettle-family bump now raises shared-changelog members to the family's next shared version when their release is pending, including a misaligned cohort that previously only aligned to the current maximum and reported ok, leaving the unreleased-entries bump gate uncleared with no documented command able to clear it (#17).
+
+- Independently versioned members (release.version_series.independent_members) can no longer be captured by the lockstep shared-version raise: they bump on their own series, are never force-marked pending by the shared cohort, their higher own-series version no longer drags the cohort line, and the aggregate GitHub Release no longer fails its same-version check on them (#18).
+
+### Security
+
+- Generated resume commands no longer embed secret env values: secret-shaped keys (at minimum `KETTLE_RELEASE_GEM_SIGNING_PASSPHRASE`) are redacted to the shell-safe placeholder `<redacted-reauthorize>`; re-authorize the secret through the release secrets provider (1Password or the `KETTLE_RELEASE_SECRETS_BROKER` cache), or paste the real value over the placeholder, before resuming.
+
+## [1.3.36] - 2026-10-28
+
+- TAG: [v1.3.36][1.3.36t]
+- COVERAGE: 93.12% -- 7601/8163 lines in 45 files
+- BRANCH COVERAGE: 77.34% -- 3041/3932 branches in 45 files
+- 38.89% documented
+
+### Changed
+
+- [kc] template-family-resume-hints: Template failures now produce one combined retry hint for failed and pending members, preserving member@branch selectors for branch-stack templates.
+
+- [kc] kettle-jem/prepare: updated 7 project files:
+  - configuration (1)
+  - dependencies (6)
+
+- [kc] kettle-jem/template: updated 5 project files:
+  - code and tests (1)
+  - documentation (1)
+  - other (2)
+  - workflows (1)
+
 ## [1.3.35] - 2026-10-26
 
 - TAG: [v1.3.35][1.3.35t]
@@ -3299,7 +3343,11 @@ Please file a bug if you notice a violation of semantic versioning.
 - Fixed CI load failures on engines without compatible `pty` support by falling back to Open3 for interactive release commands.
 - Fixed Ruby 3.2 version-bump support by loading Prism lazily and wiring the Prism gem only for MRI versions that need it.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-family/compare/v1.3.35...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-family/compare/v1.3.37...HEAD
+[1.3.37]: https://github.com/kettle-dev/kettle-family/compare/v1.3.36...v1.3.37
+[1.3.37t]: https://github.com/kettle-dev/kettle-family/releases/tag/v1.3.37
+[1.3.36]: https://github.com/kettle-dev/kettle-family/compare/v1.3.35...v1.3.36
+[1.3.36t]: https://github.com/kettle-dev/kettle-family/releases/tag/v1.3.36
 [1.3.35]: https://github.com/kettle-dev/kettle-family/compare/v1.3.34...v1.3.35
 [1.3.35t]: https://github.com/kettle-dev/kettle-family/releases/tag/v1.3.35
 [1.3.34]: https://github.com/kettle-dev/kettle-family/compare/v1.3.33...v1.3.34

data/README.md

@@ -64,12 +64,12 @@ configuration, create their own GitHub Release through `kettle-release`.
 
 ### Compatibility
 
-Compatible with MRI Ruby 4.0.0+.
+The gem's declared runtime compatibility floor is MRI Ruby 4.0.0+, with concordant releases of JRuby and TruffleRuby.
 CI workflows and Appraisals are generated for MRI Ruby 4.0.0+.
 The current MRI CI lane runs on Linux and macOS.
-This test floor is configured by `ruby.test_minimum` in `.kettle-jem.yml` and
-may be higher than the gem's runtime compatibility floor when legacy Rubies are
-not practical for the current toolchain.
+The test floor is configured by `ruby.test_minimum` in `.kettle-jem.yml`.
+When it is higher than the runtime floor, older runtime-compatible Rubies are
+not covered by the generated CI or Appraisal matrix.
 
 <a href="https://github.com/kettle-dev"><img alt="kettle-dev Logo by Aboling0, CC BY-SA 4.0" src="https://logos.galtzo.com/assets/images/kettle-dev/avatar-128px.svg" width="14%" align="right"/></a>
 
@@ -1191,7 +1191,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-8.121-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-8.230-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-family/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/lib/kettle/family/cli.rb

@@ -1475,19 +1475,29 @@ module Kettle
       def shared_bump_member_names(config:, members:)
         return [] unless config.shared_changelog?
 
-        members.reject { |member| config.member_local_changelog?(member) }.map(&:name)
+        members
+          .reject { |member| config.member_local_changelog?(member) }
+          .reject { |member| config.independent_version_series_member?(member) }
+          .map(&:name)
       end
 
       def shared_bump_target_version(config:, members:, options:, release_state_results: nil)
         return unless config.shared_changelog?
         return unless Kettle::Dev::VersionBump::BUMP_TYPES.include?(options[:target_version].to_s)
 
+        # The lockstep raise cohort excludes members carrying their own
+        # changelog AND independently versioned members: an independent
+        # series must never be captured by (or drag) the shared version
+        # line, in either direction.
         shared_members = members.reject { |member| config.member_local_changelog?(member) }
+          .reject { |member| config.independent_version_series_member?(member) }
         return if shared_members.empty?
 
         versions = shared_members.map { |member| Gem::Version.new(member.version.to_s) }.uniq
         current = versions.max
-        return current.to_s if versions.length > 1
+        # Without release-state results (explicit member selection) a
+        # misaligned cohort still aligns to its maximum, as before.
+        return current.to_s if versions.length > 1 && release_state_results.nil?
 
         released_versions = Array(release_state_results).filter_map do |result|
           next unless shared_members.any? { |member| member.name == result.member_name }
@@ -1502,8 +1512,15 @@ module Kettle
         rescue ArgumentError
           nil
         end
+        # Mid-prep (the cohort line already moved past the last release):
+        # laggards align up to the in-flight version and nothing increments.
         return current.to_s if released_versions.any? && current > released_versions.max
 
+        # Otherwise the cohort owes a release: every shared member is raised
+        # to the family's NEXT shared version — including a misaligned
+        # cohort, which previously aligned to the current maximum and then
+        # reported ok, leaving the unreleased-entries bump gate uncleared
+        # with no documented command able to clear it (#17).
         Kettle::Dev::VersionBump.resolve_target_version(options[:target_version].to_s, current.to_s)
       end
 

data/lib/kettle/family/config.rb

@@ -308,6 +308,17 @@ module Kettle
         end.compact
       end
 
+      # Bootstrap-managed gems whose committed member locks must not lag the
+      # newest published version satisfying the member's declared requirement
+      # (release.drift_check.gems; default: nomono, the bootstrap gem whose
+      # lock/registry drift killed the SM-ruby wave on 2026-10-30). An empty
+      # list disables the drift preflight phase entirely.
+      def release_drift_check_gems
+        configured = fetch_path("release", "drift_check", "gems")
+        gems = configured.nil? ? [NomonoBootstrap::GEM_NAME] : Array(configured)
+        gems.map(&:to_s).map(&:strip).reject(&:empty?).uniq
+      end
+
       def release_required_remotes
         fetch_path("release", "required_remotes")
       end
@@ -405,6 +416,24 @@ module Kettle
         fetch_path("release", "aggregate_validation", "enabled") == true
       end
 
+      # Members that keep their own monotonic version series even in a
+      # shared-version family (release.version_series.independent_members;
+      # default empty). An independent-series member is skipped by lockstep
+      # shared-version raises — its bumps stay on its own series — and is
+      # exempt from the aggregate GitHub Release same-version invariant,
+      # while its built artifacts still attach to the aggregate release.
+      def release_version_series_independent_members
+        Array(fetch_path("release", "version_series", "independent_members"))
+          .map(&:to_s)
+          .map(&:strip)
+          .reject(&:empty?)
+          .uniq
+      end
+
+      def independent_version_series_member?(member)
+        release_version_series_independent_members.include?(member.name.to_s)
+      end
+
       def release_aggregate_validation_excluded_members
         Array(fetch_path("release", "aggregate_validation", "exclude_members"))
           .map(&:to_s)

data/lib/kettle/family/release_state_check.rb

@@ -113,7 +113,7 @@ module Kettle
 
       def check_member(member, branch: nil, event_handler: nil)
         started = Process.clock_gettime(Process::CLOCK_MONOTONIC)
-        command = release_state_command
+        command = release_state_command(member)
         emit_event(event_handler, member: member, branch: branch, action: "member_start", status: "running", command: command)
         emit_event(event_handler, member: member, branch: branch, action: "changelog_command", status: "running", command: command)
         stdout, stderr, status = capture_release_state(
@@ -142,15 +142,16 @@ module Kettle
         emit_event(event_handler, member: member, branch: branch, action: "member_complete", status: success ? "ok" : "failed", elapsed_seconds: elapsed, status_code: status.exitstatus)
         result
       rescue JSON::ParserError => error
-        result = result(member: member, command: command || release_state_command, stdout: stdout, stderr: stderr, status: 1, elapsed: elapsed || 0.0, success: false, state: {}, reason: "invalid release-state JSON: #{error.message}", branch: branch)
+        result = result(member: member, command: command || release_state_command(member), stdout: stdout, stderr: stderr, status: 1, elapsed: elapsed || 0.0, success: false, state: {}, reason: "invalid release-state JSON: #{error.message}", branch: branch)
         emit_event(event_handler, member: member, branch: branch, action: "member_complete", status: "failed", elapsed_seconds: elapsed || 0.0, status_code: 1, reason: result.reason)
         result
       end
 
-      def release_state_command
-        [RbConfig.ruby, kettle_changelog_executable, "--release-state", "--json"]
+      def release_state_command(member = nil)
+        version_args = member&.version ? ["--version", member.version.to_s] : []
+        [RbConfig.ruby, kettle_changelog_executable, *version_args, "--release-state", "--json"]
       rescue Gem::Exception
-        [RbConfig.ruby, "-S", "kettle-changelog", "--release-state", "--json"]
+        [RbConfig.ruby, "-S", "kettle-changelog", *version_args, "--release-state", "--json"]
       end
 
       def kettle_changelog_executable
@@ -176,7 +177,7 @@ module Kettle
 
       def check_shared_changelog_member(member, branch: nil, event_handler: nil)
         started = Process.clock_gettime(Process::CLOCK_MONOTONIC)
-        command = release_state_command
+        command = release_state_command(member)
         emit_event(event_handler, member: member, branch: branch, action: "member_start", status: "running", command: command)
         emit_event(event_handler, member: member, branch: branch, action: "changelog_command", status: "running", command: command)
         stdout, stderr, status = capture_release_state(
@@ -216,13 +217,13 @@ module Kettle
         emit_event(event_handler, member: member, branch: branch, action: "member_complete", status: success ? "ok" : "failed", elapsed_seconds: elapsed, status_code: status.exitstatus)
         result
       rescue JSON::ParserError => error
-        result = result(member: member, command: command || release_state_command, stdout: stdout, stderr: stderr, status: 1, elapsed: elapsed || 0.0, success: false, state: {}, reason: "invalid release-state JSON: #{error.message}", branch: branch)
+        result = result(member: member, command: command || release_state_command(member), stdout: stdout, stderr: stderr, status: 1, elapsed: elapsed || 0.0, success: false, state: {}, reason: "invalid release-state JSON: #{error.message}", branch: branch)
         emit_event(event_handler, member: member, branch: branch, action: "member_complete", status: "failed", elapsed_seconds: elapsed || 0.0, status_code: 1, reason: result.reason)
         result
       rescue Error => error
         result = result(
           member: member,
-          command: command || release_state_command,
+          command: command || release_state_command(member),
           stdout: "",
           stderr: error.message,
           status: 1,
@@ -804,8 +805,6 @@ module Kettle
         return unless member_config
 
         current_result = check_member(member, event_handler: event_handler)
-        return [current_result] unless current_result.ok?
-
         [current_result, *self.class.new(config: member_config, members: [member]).results(event_handler: event_handler)]
       end
 
@@ -831,8 +830,9 @@ module Kettle
       end
 
       # Version-locked siblings move in lockstep. Members not declared
-      # independently releasable (release.aggregate_validation.exclude_members)
-      # share the family version line, so:
+      # independently releasable (release.aggregate_validation.exclude_members
+      # or release.version_series.independent_members) share the family
+      # version line, so:
       #   1. when any of them needs a version bump, all of them do — including
       #      members without unreleased changelog entries of their own and
       #      brand-new members that have never been released (empty
@@ -840,12 +840,13 @@ module Kettle
       #   2. a member whose checkout version sits behind the cohort's version
       #      line (e.g. a cohort that already bumped while it stayed put) needs
       #      a catch-up bump on its own.
-      # Independently releasable members keep per-member bump semantics: they
-      # bump only when their own unreleased entries require it. Members whose
-      # checkout version already moved past their last release are mid-prep
-      # and are never double-bumped.
+      # Independently versioned members keep per-member bump semantics: they
+      # bump only when their own unreleased entries require it, and their
+      # (possibly higher) own-series version never drags the cohort line.
+      # Members whose checkout version already moved past their last release
+      # are mid-prep and are never double-bumped.
       def normalize_lockstep_version_bump(results)
-        excluded = Array(config&.release_aggregate_validation_excluded_members).map(&:to_s)
+        excluded = independent_bump_member_names
         return results if excluded.empty?
 
         aggregate = results.select do |result|
@@ -895,6 +896,17 @@ module Kettle
         nil
       end
 
+      # Members exempt from lockstep bump semantics: aggregate-validation
+      # exclusions plus independently versioned members. Both keep per-member
+      # bump behavior; neither may be force-marked pending by the cohort, and
+      # an independent-series version never participates in the cohort line.
+      def independent_bump_member_names
+        Array(config&.release_aggregate_validation_excluded_members)
+          .concat(Array(config&.release_version_series_independent_members))
+          .map(&:to_s)
+          .uniq
+      end
+
       def normalize_shared_version_bump(results)
         shared_results = results.select { |result| result.ok? && shared_changelog_member_result?(result) }
         return results unless shared_results.any? { |result| result.state["bump_release_pending"] == true }
@@ -920,7 +932,11 @@ module Kettle
 
       def shared_changelog_member_result?(result)
         member = members.find { |candidate| candidate.name == result.member_name }
-        member && !member_local_changelog?(member)
+        member && !member_local_changelog?(member) && !independent_version_series_member?(member)
+      end
+
+      def independent_version_series_member?(member)
+        config&.independent_version_series_member?(member) || false
       end
 
       def git_root

data/lib/kettle/family/report.rb

@@ -125,7 +125,7 @@ module Kettle
           lines << "  #{result_state(result)} #{result_identity(result)} #{result.phase} #{result.reason || ""}".rstrip
           append_result_stdout(lines, result)
           append_indented_output(lines, result.stderr) if !result.ok? && !result.stderr.to_s.empty?
-          resume_hint = resume_hint_for(result)
+          resume_hint = resume_hint_for(result) unless command == "template"
           lines << "    resume: #{resume_hint}" if !result.ok? && resume_hint
         end
         append_template_summary(lines) if command == "template"
@@ -764,11 +764,10 @@ module Kettle
         failed ? [resume_hint_for(failed)] : []
       end
 
-      # Mirrors release_resume_hints: one hint per failure, plus a single set-based
-      # hint naming every member that never ran. --only selects by name rather
-      # than position, so it resumes exactly the unfinished members regardless of
-      # how dispatch ordered them, and the wave grouping is re-derived from the
-      # selected subset.
+      # Test gets one hint per failure plus a set-based hint for members that never
+      # ran. --only selects by name rather than position, so it resumes exactly the
+      # unfinished members regardless of how dispatch ordered them. Template uses
+      # one combined hint because it is idempotent and family-lockstep.
       #
       # A family-root failure takes precedence and suppresses the set-based hint:
       # that phase aborts the entire run before member dispatch, so every member
@@ -776,6 +775,7 @@ module Kettle
       def non_positional_resume_hints
         root_failure = results.find { |result| !result.ok? && family_root_phase?(result.phase) }
         return [resume_hint_for(root_failure)] if root_failure
+        return template_resume_hints if command == "template"
 
         failed_hints = visible_results.reject(&:ok?).filter_map { |result| resume_hint_for(result) }.uniq
         pending_names = summary_pending.map { |entry| entry.fetch("member") }
@@ -784,6 +784,15 @@ module Kettle
         [*failed_hints, "kettle-family #{command} --only #{pending_names.join(",")}"]
       end
 
+      def template_resume_hints
+        member_names = visible_results.reject(&:ok?).map { |result| result_identity(result) }
+        member_names.concat(summary_pending.map { |entry| entry.fetch("member") })
+        member_names = member_names.compact.uniq.sort
+        return ["kettle-family template"] if member_names.empty?
+
+        ["kettle-family template --only #{member_names.join(",")}"]
+      end
+
       def release_resume_hints
         failed_hints = visible_results.reject(&:ok?).filter_map { |result| resume_hint_for(result) }.uniq
         pending_names = summary_pending.map { |entry| entry.fetch("member") }

data/lib/kettle/family/version.rb

@@ -5,7 +5,7 @@ module Kettle
     # Version namespace for this gem.
     module Version
       # Current gem version.
-      VERSION = "1.3.35"
+      VERSION = "1.3.37"
     end
     # Current gem version exposed at the traditional constant location.
     VERSION = Version::VERSION # Traditional Constant Location

data/lib/kettle/family/version_bump.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "kettle/dev"
+require "ast/crispr/ruby/prism"
 
 module Kettle
   module Family
@@ -74,12 +75,20 @@ module Kettle
       end
 
       def collect_edits(member, member_target_version)
-        version_edits = with_dev_errors do
-          Kettle::Dev::VersionBump.new(
-            root: member.root,
-            current_version: member.version,
-            target_version: member_target_version
-          ).edits
+        begin
+          version_edits = with_dev_errors do
+            Kettle::Dev::VersionBump.new(
+              root: member.root,
+              current_version: member.version,
+              target_version: member_target_version
+            ).edits
+          end
+        rescue Error => error
+          bump = Kettle::Dev::VersionBump.new(root: member.root, current_version: member.version, target_version: member_target_version)
+          computed_version_edits = prism_computed_version_edits(member, member_target_version)
+          raise error if computed_version_edits.empty?
+
+          version_edits = computed_version_edits + bump.send(:gemspec_version_edits)
         end
         version_edits = version_edits.map do |edit|
           if same_file?(edit.fetch(:path), member.gemspec_path)
@@ -91,6 +100,33 @@ module Kettle
         version_edits + gemspec_dependency_edits(member)
       end
 
+      def prism_computed_version_edits(member, target_version)
+        version = Gem::Version.new(target_version)
+        replacements = {major: version.segments[0] || 0, minor: version.segments[1] || 0, patch: version.segments[2] || 0}
+        Kettle::Dev::Versioning.version_file_candidates(member.root).flat_map do |path|
+          source = File.read(path)
+          analysis = Ast::Crispr::Ruby::Prism.document_context(content: source, source_label: path).ast
+          root = analysis.parse_result.value
+          nodes = Kettle::Dev::VersionBump.each_node(root).to_a
+          version_constant = nodes.find do |node|
+            node.is_a?(Prism::ConstantWriteNode) && node.name == :VERSION && node.value.is_a?(Prism::CallNode) && node.value.name == :to_s
+          end
+          next [] unless version_constant
+
+          replacements.filter_map do |method_name, replacement_value|
+            method = nodes.find { |node| node.is_a?(Prism::DefNode) && node.name == method_name }
+            literal = method&.body&.body&.last
+            next unless literal.is_a?(Prism::IntegerNode) || literal.is_a?(Prism::StringNode)
+
+            next if literal.is_a?(Prism::IntegerNode) && literal.value == replacement_value
+            next if literal.is_a?(Prism::StringNode) && literal.unescaped == replacement_value.to_s
+
+            replacement = literal.is_a?(Prism::StringNode) ? Kettle::Dev::VersionBump.quote_like(literal.location.slice, replacement_value.to_s) : replacement_value.to_s
+            Kettle::Dev::VersionBump.file_edit(path, source, literal.location.start_offset, literal.location.end_offset, replacement)
+          end
+        end
+      end
+
       def same_file?(left, right)
         right && File.identical?(left, right)
       rescue SystemCallError

data/lib/kettle/family/workflow.rb

@@ -108,6 +108,16 @@ module Kettle
       REGISTRY_WAIT_ATTEMPTS = 15
       REGISTRY_WAIT_INTERVAL_SECONDS = 15
       TEMPLATE_GEMSPEC_RETRY_DELAY_SECONDS = 0.25
+      # Placeholder substituted for secret-valued env keys in generated resume
+      # commands (see aggregate_github_release_resume_command).
+      RESUME_COMMAND_REDACTED_VALUE = "<redacted-reauthorize>"
+      # Env key names whose values must never appear in printed commands.
+      # Matches by name shape, not a fixed list, so future secrets plumbing
+      # (new passphrase/OTP/token transports) is scrubbed by default. The
+      # excluded suffixes are routing metadata an operator needs to
+      # re-authorize (source/provider/broker/field NAME), never a secret.
+      RESUME_COMMAND_SECRET_ENV_KEY_RE = /PASSPHRASE|PASSWORD|SECRET|TOKEN|OTP|CREDENTIAL/i
+      RESUME_COMMAND_SECRET_ENV_KEY_EXCLUDE_RE = /(?:_SOURCE|_PROVIDER|_BROKER|_FIELD)\z/i
 
       def initialize(command:, config:, members:, family_members: nil, execute: false, accept: true, commit: true, allow_dirty: false, autostash: true, template_cleanup: true, publish: false, push: false, tag: false, start_step: nil, skip_steps: nil, fast_recovery: nil, fast_recovery_members: nil, skip_ci: false, skip_changelog: false, skip_appraisals: false, local_ci: false, continue_ci_failures: false, ci_workflows: nil, skip_bundle_audit: false, skip_remotes: nil, required_remotes: nil, auto_dependency_floors: nil, validate_ci_bundles: nil, gha_sha_pins_upgrade: "patch", gha_sha_pins_check: false, gha_sha_pins_ttl_days: nil, env_overrides: {}, debug: false, verbose: false, gem_signing_password: nil, secrets_provider: nil, jobs: nil, progress_io: nil, reset_target: nil, bup_args: [], bex_args: [], start_member: nil, start_branch: nil, template_branch_selection: {}, release_state_results: nil, event_tape: nil, mise_adapter: nil, **options)
         @command = command
@@ -2024,12 +2034,13 @@ module Kettle
       def release_preflight_phases
         maintenance_phase = {label: "pre-release maintenance", method: :release_preflight_maintenance_results} unless config.release_preflight_commands.empty?
         bump_phase = {label: "release version bump", method: :release_preflight_version_bump_results} unless release_state_results.empty?
+        drift_phase = {label: "bootstrap dependency drift", method: :release_preflight_bootstrap_drift_results} unless config.release_drift_check_gems.empty?
         dirty_phase = {label: "branch checkout readiness", method: :release_preflight_branch_checkout_dirty_results}
         signing_phase = {label: "gem signing password", method: :release_preflight_signing_password_results}
         secrets_phase = release_secrets_authorization_required? ? {label: "secrets provider authorization", method: :release_preflight_secrets_authorization_results} : nil
         gha_sha_pins_phase = release_gha_sha_pins_review_required? ? {label: "GitHub Actions SHA pins", method: :release_preflight_gha_sha_pins_results} : nil
 
-        [maintenance_phase, bump_phase, secrets_phase, gha_sha_pins_phase, dirty_phase, signing_phase].compact
+        [maintenance_phase, bump_phase, drift_phase, secrets_phase, gha_sha_pins_phase, dirty_phase, signing_phase].compact
       end
 
       # Family-declared pre-release maintenance hooks (release.preflight_commands
@@ -2075,6 +2086,108 @@ module Kettle
         results
       end
 
+      # Bootstrap-managed gems (config release.drift_check.gems, default:
+      # nomono) are activated by a member's own Gemfile bootstrap, while CI
+      # resolves fresh bundles from the registry. When a newer published
+      # version satisfies the member's declared floor but the committed lock
+      # pins an older one, CI activates the newer version while the member
+      # bootstrap activates the locked older one, and the wave dies mid-job
+      # with a Gem::LoadError deep in a cold-start (observed 2026-10-30:
+      # nomono locked 1.1.16 vs published 1.1.17 satisfying a ">= 1.1.16"
+      # floor, run 40998206316). Nothing compared locked vs
+      # published-satisfying versions pre-release, so this phase blocks early
+      # with the remediation instead of letting CI discover the drift.
+      def release_preflight_bootstrap_drift_results
+        config.release_drift_check_gems.flat_map do |gem|
+          members.filter_map { |member| bootstrap_dependency_drift_result(member, gem) }
+        end
+      end
+
+      def bootstrap_dependency_drift_result(member, gem)
+        locked = locked_bootstrap_gem_version(member, gem)
+        return nil if locked.nil?
+
+        requirement = declared_bootstrap_gem_requirement(member, gem)
+        newest = newest_published_satisfying_version(gem, requirement)
+        if newest.nil?
+          # A registry outage must never become a false release block: treat
+          # "could not consult the registry" as a skip with a diagnostic.
+          warn "[kettle-family] bootstrap dependency drift check skipped for #{gem}: registry could not be consulted"
+          return nil
+        end
+        return nil if locked >= newest
+
+        release_preflight_error_result(
+          "bootstrap_dependency_drift",
+          "Release blocked: bootstrap dependency drift: #{member.name} locks #{gem} #{locked} but #{newest} satisfies its floor; " \
+          "run the family template sweep or `bundle update #{gem}` in the member before releasing.",
+          member: member
+        )
+      end
+
+      # The version a member's committed lock pins for the gem, from the
+      # registry-sourced GEM section only: a PATH or GIT pin is local-only
+      # state that has no published counterpart to drift against.
+      def locked_bootstrap_gem_version(member, gem)
+        lockfile_path = File.join(member.root, "Gemfile.lock")
+        return nil unless File.file?(lockfile_path)
+
+        section = nil
+        File.foreach(lockfile_path) do |line|
+          section = line.strip unless line.match?(/\A\s/)
+          next unless section == "GEM"
+
+          match = line.match(/\A {4}#{Regexp.escape(gem)} \(([^)]+)\)\s*\z/)
+          next unless match
+
+          begin
+            return Gem::Version.new(match[1])
+          rescue ArgumentError
+            return nil
+          end
+        end
+        nil
+      end
+
+      # The requirement the member's Gemfile declared for the gem, read from
+      # the lock's DEPENDENCIES section (Bundler records the DSL requirement
+      # there verbatim). A bare declaration means "any version".
+      def declared_bootstrap_gem_requirement(member, gem)
+        lockfile_path = File.join(member.root, "Gemfile.lock")
+        return Gem::Requirement.default unless File.file?(lockfile_path)
+
+        section = nil
+        File.foreach(lockfile_path) do |line|
+          section = line.strip unless line.match?(/\A\s/)
+          next unless section == "DEPENDENCIES"
+
+          match = line.match(/\A {2}#{Regexp.escape(gem)}(?: \((.+)\))?\s*\z/)
+          next unless match
+
+          constraints = (match[1] || "").split(",").map(&:strip).reject(&:empty?)
+          return Gem::Requirement.new(constraints) unless constraints.empty?
+
+          return Gem::Requirement.default
+        end
+        Gem::Requirement.default
+      end
+
+      # Newest published (non-prerelease) version satisfying the requirement,
+      # via the ETag-cached registry lookup shared with the rest of the
+      # toolchain; nil when the registry could not be consulted.
+      def newest_published_satisfying_version(gem, requirement)
+        numbers = Kettle::Dev::RubyGemsVersions.published_version_numbers(gem)
+        return nil if numbers.nil?
+
+        numbers.filter_map do |number|
+          Gem::Version.new(number)
+        rescue ArgumentError
+          nil
+        end.select do |version|
+          !version.prerelease? && requirement.satisfied_by?(version)
+        end.max
+      end
+
       def release_gha_sha_pins_review_required?
         execute && kettle_release_command?(raw_release_command) && !release_gha_sha_pins_offline_requested?
       end
@@ -2119,11 +2232,14 @@ module Kettle
         @secrets_provider.is_a?(Secrets::OnePassword)
       end
 
-      def release_preflight_error_result(phase, message)
+      def release_preflight_error_result(phase, message, member: nil)
         # A preflight failure blocks the selected release invocation. Attribute
         # it to that invocation's first member so generated resume commands do
-        # not target the synthetic family name or an unselected sibling.
-        member = members.first || family_member
+        # not target the synthetic family name or an unselected sibling. Phases
+        # that identify a specific offending member (e.g. bootstrap dependency
+        # drift) override that attribution so the resume hint targets the
+        # member that needs the fix.
+        member ||= members.first || family_member
         CommandResult.new(
           member_name: member.name,
           phase: phase,
@@ -3789,6 +3905,7 @@ module Kettle
       def append_kettle_release_args(command, member: nil)
         command = replace_kettle_release_provider(command) if @release_secrets_broker
         args = []
+        args << "--version=#{member.version}" if member&.version && !command_includes_arg?(command, "--version")
         effective_start_step = release_start_step_for(member)
         command, configured_skip_steps = extract_kettle_release_skip_steps(command)
         effective_skip_steps = (configured_skip_steps + release_skip_steps_for(member).split(",")).uniq.join(",")
@@ -3888,6 +4005,16 @@ module Kettle
         aggregate_validation_members.include?(member)
       end
 
+      # An independently versioned member (release.version_series.
+      # independent_members) keeps its own monotonic series: it is exempt
+      # from lockstep raises and from the aggregate same-version invariant,
+      # but remains part of the aggregate release for artifact attachment.
+      def independent_version_series_member?(member)
+        return false unless member
+
+        config.independent_version_series_member?(member)
+      end
+
       def aggregate_validation_member_name?(member)
         member && member.name == (@aggregate_validation_member_name || aggregate_validation_members.first&.name)
       end
@@ -4108,12 +4235,19 @@ module Kettle
 
       # simplecov:disable Covered by monorepo release integration, not sibling-repository suite.
       def aggregate_monorepo_github_release(members)
-        version = members.map { |member| member.version.to_s }.uniq
+        # The same-version invariant describes the shared-version cohort.
+        # Independently versioned members (release.version_series.
+        # independent_members) can never satisfy it by design, so they are
+        # exempt from the uniformity check while their artifacts still
+        # attach — at their own series version, not the cohort's.
+        shared_members = members.reject { |member| independent_version_series_member?(member) }
+        version = shared_members.map { |member| member.version.to_s }.uniq
         return aggregate_release_result("all selected members must have the same version") unless version.length == 1
 
         assets = members.flat_map do |member|
-          gem_path = Paths.glob(member.root, "pkg", "*.gem").select { |path| File.basename(path).end_with?("-#{version.first}.gem") }
-          checksum_paths = %w[sha256 sha512].map { |algorithm| File.join(member.root, "checksums", "#{member.name}-#{version.first}.gem.#{algorithm}") }
+          asset_version = independent_version_series_member?(member) ? member.version.to_s : version.first
+          gem_path = Paths.glob(member.root, "pkg", "*.gem").select { |path| File.basename(path).end_with?("-#{asset_version}.gem") }
+          checksum_paths = %w[sha256 sha512].map { |algorithm| File.join(member.root, "checksums", "#{member.name}-#{asset_version}.gem.#{algorithm}") }
           gem_path + checksum_paths.select { |path| File.file?(path) }
         end
         command = ["bundle", "exec", "kettle-gh-release", "--allow-unpublished", "--events", "--release-version", version.first]
@@ -4158,11 +4292,26 @@ module Kettle
 
       def aggregate_github_release_resume_command(env, command)
         assignments = env.sort_by { |key, _value| key }.filter_map do |key, value|
-          "#{key}=#{Shellwords.escape(value.to_s)}" unless value.nil?
+          next if value.nil?
+
+          # Resume commands land in terminal output, run summaries, and
+          # transcripts. Env built from the broker-cached secrets used to
+          # embed KETTLE_RELEASE_GEM_SIGNING_PASSPHRASE in plaintext here
+          # (2026-10-30 incident). Redact secret-valued keys instead: the
+          # printed command keeps its shape, and the operator re-authorizes
+          # the secret through the release secrets provider (1Password, or
+          # the KETTLE_RELEASE_SECRETS_BROKER cache) — or pastes the real
+          # passphrase in place of the placeholder — before resuming.
+          rendered_value = resume_command_secret_env_key?(key) ? Shellwords.escape(RESUME_COMMAND_REDACTED_VALUE) : Shellwords.escape(value.to_s)
+          "#{key}=#{rendered_value}"
         end
         (["env", *assignments].join(" ") + " " + Shellwords.join(command)).strip
       end
 
+      def resume_command_secret_env_key?(key)
+        key.match?(RESUME_COMMAND_SECRET_ENV_KEY_RE) && !key.match?(RESUME_COMMAND_SECRET_ENV_KEY_EXCLUDE_RE)
+      end
+
       def aggregate_github_release_event_line_handler(member)
         lambda do |line|
           event = parse_template_event(line)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-family
 version: !ruby/object:Gem::Version
-  version: 1.3.35
+  version: 1.3.37
 platform: ruby
 authors:
 - Peter H. Boling
@@ -57,6 +57,26 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 7.1.11
+- !ruby/object:Gem::Dependency
+  name: ast-crispr-ruby-prism
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '7.1'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 7.1.10
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '7.1'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 7.1.10
 - !ruby/object:Gem::Dependency
   name: ast-crispr-toml
   requirement: !ruby/object:Gem::Requirement
@@ -114,7 +134,7 @@ dependencies:
         version: '1.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.0.14
+        version: 1.0.15
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -124,7 +144,7 @@ dependencies:
         version: '1.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.0.14
+        version: 1.0.15
 - !ruby/object:Gem::Dependency
   name: kettle-deps-floor
   requirement: !ruby/object:Gem::Requirement
@@ -134,7 +154,7 @@ dependencies:
         version: '0.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.1.1
+        version: 0.1.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -144,7 +164,7 @@ dependencies:
         version: '0.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.1.1
+        version: 0.1.2
 - !ruby/object:Gem::Dependency
   name: kettle-dev
   requirement: !ruby/object:Gem::Requirement
@@ -154,7 +174,7 @@ dependencies:
         version: '3.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.1.25
+        version: 3.1.26
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -164,7 +184,7 @@ dependencies:
         version: '3.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.1.25
+        version: 3.1.26
 - !ruby/object:Gem::Dependency
   name: kettle-gha-pins
   requirement: !ruby/object:Gem::Requirement
@@ -174,7 +194,7 @@ dependencies:
         version: '0.3'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.3.19
+        version: 0.3.20
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -184,7 +204,7 @@ dependencies:
         version: '0.3'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.3.19
+        version: 0.3.20
 - !ruby/object:Gem::Dependency
   name: kettle-jem
   requirement: !ruby/object:Gem::Requirement
@@ -214,7 +234,7 @@ dependencies:
         version: '0.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.1.22
+        version: 0.1.23
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -224,7 +244,7 @@ dependencies:
         version: '0.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.1.22
+        version: 0.1.23
 - !ruby/object:Gem::Dependency
   name: kettle-test
   requirement: !ruby/object:Gem::Requirement
@@ -234,7 +254,7 @@ dependencies:
         version: '2.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.0.28
+        version: 2.0.29
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -244,7 +264,7 @@ dependencies:
         version: '2.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.0.28
+        version: 2.0.29
 - !ruby/object:Gem::Dependency
   name: psych-merge
   requirement: !ruby/object:Gem::Requirement
@@ -608,10 +628,10 @@ licenses:
 - AGPL-3.0-only
 metadata:
   homepage_uri: https://kettle-family.galtzo.com
-  source_code_uri: https://github.com/kettle-dev/kettle-family/tree/v1.3.35
-  changelog_uri: https://github.com/kettle-dev/kettle-family/blob/v1.3.35/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-family/tree/v1.3.37
+  changelog_uri: https://github.com/kettle-dev/kettle-family/blob/v1.3.37/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-family/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-family/1.3.35
+  documentation_uri: https://www.rubydoc.info/gems/kettle-family/1.3.37
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-family/wiki
   news_uri: https://www.railsbling.com/tags/kettle-family