kettle-family 1.3.36 → 1.3.38

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 90c20dc69493246554befc819ed36f9e5c1bc81ef54f44257c7c8e2347bbe457
-  data.tar.gz: 410f4b020a832c51c372ab3230b859c8ec7b1e8829c26c595582a22f27d6901d
+  metadata.gz: 6f6f4ceee082895db3eb6f2b0c90735263adbcf3e8693640edd5d7b929a01244
+  data.tar.gz: 9a1c2c5c05bea72ade7f755329bec2e361aac45b171b92bdb76fa6812209a632
 SHA512:
-  metadata.gz: 9268ee8a2ee002ca7394d0c67c55a579f2eeb2621bf2b09362b3ca8f776ff02ab98a39923b343b5c805f7c42276ed25fe34e35efc2b605cb282ae704140ad45b
-  data.tar.gz: bf88cb60646c3adbe20b397ea8e4e2e6829435b078ad9841e75623090233c5575682dc1f8695192b92706b34fa9635e07de1e0abd2f8d833d2ec1447bd1511d1
+  metadata.gz: 4571f37dfb76b652fbd65cf68eeeda058e43b35a82879c2760937e0ec4f65cb76d7b9264bb5d0859ea631b927649a92e640c087eb964a19c7974d3d2e89bf9d0
+  data.tar.gz: 1ec331486c79ae31f99b8ef9d0937fda86b25db2dc350ded8a553c721bb056b25f01e185630fd683aa3c4ac87c61699f23b470badd571a0550b5a69eacc5af5a

data/CHANGELOG.md

@@ -30,6 +30,52 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [1.3.38] - 2026-11-07
+
+- TAG: [v1.3.38][1.3.38t]
+- COVERAGE: 93.15% -- 7697/8263 lines in 45 files
+- BRANCH COVERAGE: 77.57% -- 3089/3982 branches in 45 files
+- 39.53% documented
+
+### Added
+
+- [kc] template-root-outputs: Monorepo template runs can now update explicitly configured repository-root output paths through the template.root_outputs setting, alongside the nested member being templated. Those outputs are isolated, validated, synchronized, and committed with the template changes.
+
+### Changed
+
+- [kc] kettle-jem/prepare: updated 13 project files:
+  - configuration (2)
+  - dependencies (11)
+
+- [kc] kettle-jem/template: updated 7 project files:
+  - code and tests (2)
+  - dependencies (3)
+  - documentation (1)
+  - other (1)
+
+## [1.3.37] - 2026-10-30
+
+- TAG: [v1.3.37][1.3.37t]
+- COVERAGE: 93.13% -- 7665/8230 lines in 45 files
+- BRANCH COVERAGE: 77.52% -- 3076/3968 branches in 45 files
+- 39.41% documented
+
+### Added
+
+- Release preflight now blocks on bootstrap dependency drift: a new `bootstrap dependency drift` phase compares each selected member's committed Gemfile.lock against the newest published version satisfying the member's declared floor for bootstrap-managed gems (`release.drift_check.gems`, default `[nomono]`), failing with a `bundle update <gem>` / family template sweep remediation hint; registry lookup failures skip non-fatally instead of blocking.
+
+- New family config release.version_series.independent_members: members that keep their own monotonic version series in a shared-version family. They are skipped by lockstep shared-version raises and exempt from the aggregate GitHub Release same-version invariant, while their built artifacts still attach to the aggregate release.
+
+### Fixed
+
+- kettle-family bump now raises shared-changelog members to the family's next shared version when their release is pending, including a misaligned cohort that previously only aligned to the current maximum and reported ok, leaving the unreleased-entries bump gate uncleared with no documented command able to clear it (#17).
+
+- Independently versioned members (release.version_series.independent_members) can no longer be captured by the lockstep shared-version raise: they bump on their own series, are never force-marked pending by the shared cohort, their higher own-series version no longer drags the cohort line, and the aggregate GitHub Release no longer fails its same-version check on them (#18).
+
+### Security
+
+- Generated resume commands no longer embed secret env values: secret-shaped keys (at minimum `KETTLE_RELEASE_GEM_SIGNING_PASSPHRASE`) are redacted to the shell-safe placeholder `<redacted-reauthorize>`; re-authorize the secret through the release secrets provider (1Password or the `KETTLE_RELEASE_SECRETS_BROKER` cache), or paste the real value over the placeholder, before resuming.
+
 ## [1.3.36] - 2026-10-28
 
 - TAG: [v1.3.36][1.3.36t]
@@ -3320,7 +3366,11 @@ Please file a bug if you notice a violation of semantic versioning.
 - Fixed CI load failures on engines without compatible `pty` support by falling back to Open3 for interactive release commands.
 - Fixed Ruby 3.2 version-bump support by loading Prism lazily and wiring the Prism gem only for MRI versions that need it.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-family/compare/v1.3.36...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-family/compare/v1.3.38...HEAD
+[1.3.38]: https://github.com/kettle-dev/kettle-family/compare/v1.3.37...v1.3.38
+[1.3.38t]: https://github.com/kettle-dev/kettle-family/releases/tag/v1.3.38
+[1.3.37]: https://github.com/kettle-dev/kettle-family/compare/v1.3.36...v1.3.37
+[1.3.37t]: https://github.com/kettle-dev/kettle-family/releases/tag/v1.3.37
 [1.3.36]: https://github.com/kettle-dev/kettle-family/compare/v1.3.35...v1.3.36
 [1.3.36t]: https://github.com/kettle-dev/kettle-family/releases/tag/v1.3.36
 [1.3.35]: https://github.com/kettle-dev/kettle-family/compare/v1.3.34...v1.3.35

data/README.md

@@ -10,7 +10,7 @@
 
 `if ci_badges.map(&:color).all? { it == "green"}` 👇️ send money so I can do more of this. FLOSS maintenance is now my full-time job.
 
-[![OpenCollective Backers][🖇osc-backers-i]][🖇osc-backers] [![OpenCollective Sponsors][🖇osc-sponsors-i]][🖇osc-sponsors] [![Sponsor Me on Github][🖇sponsor-img]][🖇sponsor] [![Liberapay Goal Progress][⛳liberapay-img]][⛳liberapay] [![Donate on PayPal][🖇paypal-img]][🖇paypal] [![Buy me a coffee][🖇buyme-small-img]][🖇buyme] [![Donate at ko-fi.com][🖇kofi-img]][🖇kofi]
+[![Sponsor Me on Github][🖇sponsor-img]][🖇sponsor] [![Liberapay Goal Progress][⛳liberapay-img]][⛳liberapay] [![Donate on PayPal][🖇paypal-img]][🖇paypal] [![Buy me a coffee][🖇buyme-small-img]][🖇buyme] [![Donate at ko-fi.com][🖇kofi-img]][🖇kofi]
 
 <details markdown="1">
  <summary>👣 How will this project approach the September 2025 hostile takeover of RubyGems? 🚑️</summary>
@@ -91,28 +91,6 @@ The _amazing_ test matrix is powered by the kettle-dev stack.
 
 </details>
 
-### Federated DVCS
-
-<details markdown="1">
- <summary>Find this repo on federated forges (Coming soon!)</summary>
-
-| Federated [DVCS][💎d-in-dvcs] Repository | Status | Issues | PRs | Wiki | CI |
-|-------------------------------------------------|-------------------------------------------|-------------------|------------------|-----------------|----------------|
-| 🧪 [kettle-dev/kettle-family on GitLab][📜src-gl] | The Truth | [💚][🤝gl-issues] | [💚][🤝gl-pulls] | [💚][📜gl-wiki] | 🐭 Tiny Matrix |
-| 🧊 [kettle-dev/kettle-family on CodeBerg][📜src-cb] | An Ethical Mirror ([Donate][🤝cb-donate]) | [💚][🤝cb-issues] | [💚][🤝cb-pulls] | ➖ | ⭕️ No Matrix |
-| 🐙 [kettle-dev/kettle-family on GitHub][📜src-gh] | Another Mirror | [💚][🤝gh-issues] | [💚][🤝gh-pulls] | [💚][📜gh-wiki] | 💯 Full Matrix |
-
-</details>
-
-### Enterprise Support
-
-For enterprise support from the maintainer, use [Upwork][👨🏼‍🏫expsup-upwork] or [CodeMentor][👨🏼‍🏫expsup-codementor].
-
-Other support channels:
-
-- [![Ruby Users Forum][✉️ruby-forum-img]][✉️ruby-forum]
-- [![Live Chat on Discord][✉️discord-invite-img-ftb]][✉️discord-invite]
-
 ## ✨ Installation
 
 Install the gem and add to the application's Gemfile by executing:
@@ -955,36 +933,6 @@ We [![Keep A Changelog][📗keep-changelog-img]][📗keep-changelog] so if you m
 
 See [CONTRIBUTING.md][🤝contributing] for more detailed instructions.
 
-### 🚀 Release Instructions
-
-See [CONTRIBUTING.md][🤝contributing].
-
-### Code Coverage
-
-<details markdown="1">
-<summary>Coverage service badges</summary>
-
-[![Coverage Graph][🏀codecov-g]][🏀codecov]
-
-[![Coveralls Test Coverage][🏀coveralls-img]][🏀coveralls]
-
-[![QLTY Test Coverage][🏀qlty-covi]][🏀qlty-cov]
-
-</details>
-
-### 🪇 Code of Conduct
-
-Everyone interacting with this project's codebases, issue trackers,
-chat rooms and mailing lists agrees to follow the [![Contributor Covenant 2.1][🪇conduct-img]][🪇conduct].
-
-## 🌈 Contributors
-
-[![Contributors][🖐contributors-img]][🖐contributors]
-
-Made with [contributors-img][🖐contrib-rocks].
-
-Also see GitLab Contributors: [https://gitlab.com/kettle-dev/kettle-family/-/graphs/main][🚎contributors-gl]
-
 ## 📌 Versioning
 
 This library follows [![Semantic Versioning 2.0.0][📌semver-img]][📌semver] for its public API where practical.
@@ -1018,55 +966,9 @@ See [LICENSE.md][📄license] for details.
 
 If none of the available licenses suit your use case, please [contact us](mailto:floss@galtzo.com) to discuss a custom commercial license.
 
-### © Copyright
-
-See [LICENSE.md][📄license] for the official copyright notice.
-
-<details markdown="1">
-<summary>Copyright holders</summary>
-
-- Copyright (c) 2026 Peter H. Boling
-
-</details>
-
-## 🤑 A request for help
-
-Maintainers have teeth and need to pay their dentists.
-After getting laid off in an RIF in March, and encountering difficulty finding a new one,
-I began spending most of my time building open source tools.
-I'm hoping to be able to pay for my kids' health insurance this month,
-so if you value the work I am doing, I need your support.
-Please consider sponsoring me or the project.
-
-To join the community or get help, use the RubyForum or Discord.
-
-[![Ruby Users Forum][✉️ruby-forum-img]][✉️ruby-forum]
-[![Live Chat on Discord][✉️discord-invite-img-ftb]][✉️discord-invite]
-
-To say "thanks!" ☝️ Join the community or 👇️ send money.
-
-[![Sponsor kettle-dev/kettle-family on Open Source Collective][🖇osc-all-bottom-img]][🖇osc] 💌 [![Sponsor me on GitHub Sponsors][🖇sponsor-bottom-img]][🖇sponsor] 💌 [![Sponsor me on Liberapay][⛳liberapay-bottom-img]][⛳liberapay] 💌 [![Donate on PayPal][🖇paypal-bottom-img]][🖇paypal]
-
-### Please give the project a star ⭐ ♥.
-
-Many parts of this project are actively managed by a [kettle-jem](https://github.com/structuredmerge/structuredmerge-ruby/tree/main/gems/kettle-jem) smart template utilizing [StructuredMerge.org](https://structuredmerge.org) merge contracts.
-
-Thanks for RTFM. ☺️
-
 [⛳liberapay-img]: https://img.shields.io/liberapay/goal/pboling.svg?logo=liberapay&color=a51611&style=flat
 [⛳liberapay-bottom-img]: https://img.shields.io/liberapay/goal/pboling.svg?style=for-the-badge&logo=liberapay&color=a51611
 [⛳liberapay]: https://liberapay.com/pboling/donate
-[🖇osc-all-img]: https://img.shields.io/opencollective/all/kettle-dev
-[🖇osc-sponsors-img]: https://img.shields.io/opencollective/sponsors/kettle-dev
-[🖇osc-backers-img]: https://img.shields.io/opencollective/backers/kettle-dev
-[🖇osc-backers]: https://opencollective.com/kettle-dev#backer
-[🖇osc-backers-i]: https://opencollective.com/kettle-dev/backers/badge.svg?style=flat
-[🖇osc-sponsors]: https://opencollective.com/kettle-dev#sponsor
-[🖇osc-sponsors-i]: https://opencollective.com/kettle-dev/sponsors/badge.svg?style=flat
-[🖇osc-all-bottom-img]: https://img.shields.io/opencollective/all/kettle-dev?style=for-the-badge
-[🖇osc-sponsors-bottom-img]: https://img.shields.io/opencollective/sponsors/kettle-dev?style=for-the-badge
-[🖇osc-backers-bottom-img]: https://img.shields.io/opencollective/backers/kettle-dev?style=for-the-badge
-[🖇osc]: https://opencollective.com/kettle-dev
 [🖇sponsor-img]: https://img.shields.io/badge/Sponsor_Me!-pboling.svg?style=social&logo=github
 [🖇sponsor-bottom-img]: https://img.shields.io/badge/Sponsor_Me!-pboling-blue?style=for-the-badge&logo=github
 [🖇sponsor]: https://github.com/sponsors/pboling
@@ -1087,7 +989,6 @@ Thanks for RTFM. ☺️
 [✉️ruby-forum-top-img]: https://img.shields.io/discourse/topics?server=https%3A%2F%2Fwww.rubyforum.org&style=flat&logo=discourse&label=Ruby%20Users%20Forum
 [✉️ruby-forum-img]: https://img.shields.io/discourse/topics?server=https%3A%2F%2Fwww.rubyforum.org&style=for-the-badge&logo=discourse&label=Ruby%20Users%20Forum
 [✉️ruby-forum]: https://www.rubyforum.org/tag/kettle-dev
-
 [✇bundle-group-pattern]: https://gist.github.com/pboling/4564780
 [⛳️gem-namespace]: https://github.com/kettle-dev/kettle-family
 [⛳️namespace-img]: https://img.shields.io/badge/namespace-Kettle::Family-3C2D2D.svg?style=square&logo=ruby&logoColor=white
@@ -1177,7 +1078,6 @@ Thanks for RTFM. ☺️
 [🖐contrib-rocks]: https://contrib.rocks
 [🖐contributors]: https://github.com/kettle-dev/kettle-family/graphs/contributors
 [🖐contributors-img]: https://contrib.rocks/image?repo=kettle-dev/kettle-family
-[🚎contributors-gl]: https://gitlab.com/kettle-dev/kettle-family/-/graphs/main
 [🪇conduct]: https://github.com/kettle-dev/kettle-family/blob/main/CODE_OF_CONDUCT.md
 [🪇conduct-img]: https://img.shields.io/badge/Contributor_Covenant-2.1-259D6C.svg
 [📌pvc]: http://guides.rubygems.org/patterns/#pessimistic-version-constraint
@@ -1191,7 +1091,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-8.163-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-8.263-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-family/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year
@@ -1200,7 +1100,6 @@ Thanks for RTFM. ☺️
 [📄license-img]: https://img.shields.io/badge/License-AGPL--3.0--only-259D6C.svg
 [📄license-compat]: https://www.apache.org/legal/resolved.html#category-x
 [📄license-compat-img]: https://img.shields.io/badge/Apache_Incompatible:_Category_X-%E2%9C%97-C0392B.svg?style=flat&logo=Apache
-
 [📄ilo-declaration]: https://www.ilo.org/declaration/lang--en/index.htm
 [📄ilo-declaration-img]: https://img.shields.io/badge/ILO_Fundamental_Principles-✓-259D6C.svg?style=flat
 [🚎yard-current]: http://rubydoc.info/gems/kettle-family
@@ -1212,14 +1111,3 @@ Thanks for RTFM. ☺️
 [💎appraisal2]: https://github.com/appraisal-rb/appraisal2
 [💎appraisal2-img]: https://img.shields.io/badge/appraised_by-appraisal2-34495e.svg?plastic&logo=ruby&logoColor=white
 [💎d-in-dvcs]: https://railsbling.com/posts/dvcs/put_the_d_in_dvcs/
-
-<!-- kettle-jem:metadata:start -->
-| Field | Value |
-|---|---|
-| Package | kettle-family |
-| Description | 👩‍👩‍👧‍👧 Kettle::Family provides scripts and conventions for coordinating related Ruby gems as one family. |
-| Homepage | https://github.com/kettle-dev/kettle-family |
-| Source | https://github.com/kettle-dev/kettle-family |
-| License | `AGPL-3.0-only` |
-| Funding | https://github.com/sponsors/pboling, https://ko-fi.com/pboling, https://liberapay.com/pboling/donate, https://opencollective.com/kettle-dev, https://thanks.dev/u/gh/pboling, https://www.buymeacoffee.com/pboling |
-<!-- kettle-jem:metadata:end -->

data/lib/kettle/family/cli.rb

@@ -1475,19 +1475,29 @@ module Kettle
       def shared_bump_member_names(config:, members:)
         return [] unless config.shared_changelog?
 
-        members.reject { |member| config.member_local_changelog?(member) }.map(&:name)
+        members
+          .reject { |member| config.member_local_changelog?(member) }
+          .reject { |member| config.independent_version_series_member?(member) }
+          .map(&:name)
       end
 
       def shared_bump_target_version(config:, members:, options:, release_state_results: nil)
         return unless config.shared_changelog?
         return unless Kettle::Dev::VersionBump::BUMP_TYPES.include?(options[:target_version].to_s)
 
+        # The lockstep raise cohort excludes members carrying their own
+        # changelog AND independently versioned members: an independent
+        # series must never be captured by (or drag) the shared version
+        # line, in either direction.
         shared_members = members.reject { |member| config.member_local_changelog?(member) }
+          .reject { |member| config.independent_version_series_member?(member) }
         return if shared_members.empty?
 
         versions = shared_members.map { |member| Gem::Version.new(member.version.to_s) }.uniq
         current = versions.max
-        return current.to_s if versions.length > 1
+        # Without release-state results (explicit member selection) a
+        # misaligned cohort still aligns to its maximum, as before.
+        return current.to_s if versions.length > 1 && release_state_results.nil?
 
         released_versions = Array(release_state_results).filter_map do |result|
           next unless shared_members.any? { |member| member.name == result.member_name }
@@ -1502,8 +1512,15 @@ module Kettle
         rescue ArgumentError
           nil
         end
+        # Mid-prep (the cohort line already moved past the last release):
+        # laggards align up to the in-flight version and nothing increments.
         return current.to_s if released_versions.any? && current > released_versions.max
 
+        # Otherwise the cohort owes a release: every shared member is raised
+        # to the family's NEXT shared version — including a misaligned
+        # cohort, which previously aligned to the current maximum and then
+        # reported ok, leaving the unreleased-entries bump gate uncleared
+        # with no documented command able to clear it (#17).
         Kettle::Dev::VersionBump.resolve_target_version(options[:target_version].to_s, current.to_s)
       end
 

data/lib/kettle/family/command_runner.rb

@@ -232,19 +232,19 @@ module Kettle
         @mise_adapter = mise_adapter || Kettle::Family.mise_adapter
       end
 
-      def call(member:, phase:, command:, env: {}, interactive: false, raw: false, stdout_line_handler: nil, log_path: nil, passthrough_output: true)
+      def call(member:, phase:, command:, env: {}, interactive: false, raw: false, stdout_line_handler: nil, log_path: nil, passthrough_output: true, chdir: member.root, **options)
         argv = command_argv(member: member, command: command, env: env, raw: raw)
         process_env = process_env(member: member, env: env)
         spawn_options = process_options
         return skipped_result(member: member, phase: phase, argv: argv) unless execute
 
         started = Process.clock_gettime(Process::CLOCK_MONOTONIC)
-        stdout, stderr, status = with_transcript(log_path, argv: argv, chdir: member.root) do |log_io|
+        stdout, stderr, status = with_transcript(log_path, argv: argv, chdir: chdir) do |log_io|
           if interactive
             run_interactive(
               env: process_env,
               argv: argv,
-              chdir: member.root,
+              chdir: chdir,
               member_name: member.name,
               process_options: spawn_options,
               stdout_line_handler: stdout_line_handler,
@@ -252,9 +252,9 @@ module Kettle
               passthrough_output: passthrough_output
             )
           elsif stdout_line_handler
-            run_streaming(env: process_env, argv: argv, chdir: member.root, process_options: spawn_options, stdout_line_handler: stdout_line_handler, log_io: log_io)
+            run_streaming(env: process_env, argv: argv, chdir: chdir, process_options: spawn_options, stdout_line_handler: stdout_line_handler, log_io: log_io)
           else
-            result = Open3.capture3(process_env, *argv, chdir: member.root, **spawn_options)
+            result = Open3.capture3(process_env, *argv, chdir: chdir, **spawn_options)
             transcript_write(log_io, result[0])
             transcript_write(log_io, result[1])
             result
@@ -267,7 +267,7 @@ module Kettle
           member_name: member.name,
           phase: phase,
           command: argv,
-          workdir: member.root,
+          workdir: chdir,
           status: status.exitstatus,
           success: status.success?,
           stdout: stdout,

data/lib/kettle/family/config.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "yaml"
+require "pathname"
 
 module Kettle
   module Family
@@ -208,6 +209,21 @@ module Kettle
         fetch_path("template", "jobs")
       end
 
+      # Root paths that a nested monorepo member's Kettle Jem run may update.
+      # These are explicit repository-relative output paths, never globs.
+      def template_root_outputs
+        paths = Array(fetch_path("template", "root_outputs"))
+        paths.map do |path|
+          value = path.to_s
+          expanded = File.expand_path(value, root)
+          unless !value.empty? && !value.end_with?("/") && !Pathname.new(value).absolute? && Paths.within?(expanded, root) && expanded != root
+            raise Error, "template.root_outputs entries must be repository-relative paths below the family root: #{value.inspect}"
+          end
+
+          Pathname.new(expanded).relative_path_from(Pathname.new(root)).to_s
+        end.uniq
+      end
+
       # Additional local dependency selectors used by the generated
       # `local-template` task. Values may use Mise's `{{config_root}}` token.
       def template_local_env
@@ -308,6 +324,17 @@ module Kettle
         end.compact
       end
 
+      # Bootstrap-managed gems whose committed member locks must not lag the
+      # newest published version satisfying the member's declared requirement
+      # (release.drift_check.gems; default: nomono, the bootstrap gem whose
+      # lock/registry drift killed the SM-ruby wave on 2026-10-30). An empty
+      # list disables the drift preflight phase entirely.
+      def release_drift_check_gems
+        configured = fetch_path("release", "drift_check", "gems")
+        gems = configured.nil? ? [NomonoBootstrap::GEM_NAME] : Array(configured)
+        gems.map(&:to_s).map(&:strip).reject(&:empty?).uniq
+      end
+
       def release_required_remotes
         fetch_path("release", "required_remotes")
       end
@@ -405,6 +432,24 @@ module Kettle
         fetch_path("release", "aggregate_validation", "enabled") == true
       end
 
+      # Members that keep their own monotonic version series even in a
+      # shared-version family (release.version_series.independent_members;
+      # default empty). An independent-series member is skipped by lockstep
+      # shared-version raises — its bumps stay on its own series — and is
+      # exempt from the aggregate GitHub Release same-version invariant,
+      # while its built artifacts still attach to the aggregate release.
+      def release_version_series_independent_members
+        Array(fetch_path("release", "version_series", "independent_members"))
+          .map(&:to_s)
+          .map(&:strip)
+          .reject(&:empty?)
+          .uniq
+      end
+
+      def independent_version_series_member?(member)
+        release_version_series_independent_members.include?(member.name.to_s)
+      end
+
       def release_aggregate_validation_excluded_members
         Array(fetch_path("release", "aggregate_validation", "exclude_members"))
           .map(&:to_s)

data/lib/kettle/family/release_state_check.rb

@@ -830,8 +830,9 @@ module Kettle
       end
 
       # Version-locked siblings move in lockstep. Members not declared
-      # independently releasable (release.aggregate_validation.exclude_members)
-      # share the family version line, so:
+      # independently releasable (release.aggregate_validation.exclude_members
+      # or release.version_series.independent_members) share the family
+      # version line, so:
       #   1. when any of them needs a version bump, all of them do — including
       #      members without unreleased changelog entries of their own and
       #      brand-new members that have never been released (empty
@@ -839,12 +840,13 @@ module Kettle
       #   2. a member whose checkout version sits behind the cohort's version
       #      line (e.g. a cohort that already bumped while it stayed put) needs
       #      a catch-up bump on its own.
-      # Independently releasable members keep per-member bump semantics: they
-      # bump only when their own unreleased entries require it. Members whose
-      # checkout version already moved past their last release are mid-prep
-      # and are never double-bumped.
+      # Independently versioned members keep per-member bump semantics: they
+      # bump only when their own unreleased entries require it, and their
+      # (possibly higher) own-series version never drags the cohort line.
+      # Members whose checkout version already moved past their last release
+      # are mid-prep and are never double-bumped.
       def normalize_lockstep_version_bump(results)
-        excluded = Array(config&.release_aggregate_validation_excluded_members).map(&:to_s)
+        excluded = independent_bump_member_names
         return results if excluded.empty?
 
         aggregate = results.select do |result|
@@ -894,6 +896,17 @@ module Kettle
         nil
       end
 
+      # Members exempt from lockstep bump semantics: aggregate-validation
+      # exclusions plus independently versioned members. Both keep per-member
+      # bump behavior; neither may be force-marked pending by the cohort, and
+      # an independent-series version never participates in the cohort line.
+      def independent_bump_member_names
+        Array(config&.release_aggregate_validation_excluded_members)
+          .concat(Array(config&.release_version_series_independent_members))
+          .map(&:to_s)
+          .uniq
+      end
+
       def normalize_shared_version_bump(results)
         shared_results = results.select { |result| result.ok? && shared_changelog_member_result?(result) }
         return results unless shared_results.any? { |result| result.state["bump_release_pending"] == true }
@@ -919,7 +932,11 @@ module Kettle
 
       def shared_changelog_member_result?(result)
         member = members.find { |candidate| candidate.name == result.member_name }
-        member && !member_local_changelog?(member)
+        member && !member_local_changelog?(member) && !independent_version_series_member?(member)
+      end
+
+      def independent_version_series_member?(member)
+        config&.independent_version_series_member?(member) || false
       end
 
       def git_root

data/lib/kettle/family/version.rb

@@ -5,7 +5,7 @@ module Kettle
     # Version namespace for this gem.
     module Version
       # Current gem version.
-      VERSION = "1.3.36"
+      VERSION = "1.3.38"
     end
     # Current gem version exposed at the traditional constant location.
     VERSION = Version::VERSION # Traditional Constant Location

data/lib/kettle/family/workflow.rb

@@ -108,6 +108,16 @@ module Kettle
       REGISTRY_WAIT_ATTEMPTS = 15
       REGISTRY_WAIT_INTERVAL_SECONDS = 15
       TEMPLATE_GEMSPEC_RETRY_DELAY_SECONDS = 0.25
+      # Placeholder substituted for secret-valued env keys in generated resume
+      # commands (see aggregate_github_release_resume_command).
+      RESUME_COMMAND_REDACTED_VALUE = "<redacted-reauthorize>"
+      # Env key names whose values must never appear in printed commands.
+      # Matches by name shape, not a fixed list, so future secrets plumbing
+      # (new passphrase/OTP/token transports) is scrubbed by default. The
+      # excluded suffixes are routing metadata an operator needs to
+      # re-authorize (source/provider/broker/field NAME), never a secret.
+      RESUME_COMMAND_SECRET_ENV_KEY_RE = /PASSPHRASE|PASSWORD|SECRET|TOKEN|OTP|CREDENTIAL/i
+      RESUME_COMMAND_SECRET_ENV_KEY_EXCLUDE_RE = /(?:_SOURCE|_PROVIDER|_BROKER|_FIELD)\z/i
 
       def initialize(command:, config:, members:, family_members: nil, execute: false, accept: true, commit: true, allow_dirty: false, autostash: true, template_cleanup: true, publish: false, push: false, tag: false, start_step: nil, skip_steps: nil, fast_recovery: nil, fast_recovery_members: nil, skip_ci: false, skip_changelog: false, skip_appraisals: false, local_ci: false, continue_ci_failures: false, ci_workflows: nil, skip_bundle_audit: false, skip_remotes: nil, required_remotes: nil, auto_dependency_floors: nil, validate_ci_bundles: nil, gha_sha_pins_upgrade: "patch", gha_sha_pins_check: false, gha_sha_pins_ttl_days: nil, env_overrides: {}, debug: false, verbose: false, gem_signing_password: nil, secrets_provider: nil, jobs: nil, progress_io: nil, reset_target: nil, bup_args: [], bex_args: [], start_member: nil, start_branch: nil, template_branch_selection: {}, release_state_results: nil, event_tape: nil, mise_adapter: nil, **options)
         @command = command
@@ -1119,7 +1129,15 @@ module Kettle
       end
 
       def monorepo_template_worktrees?(wave)
-        monorepo_template_worktrees_enabled? && wave.length > 1
+        (monorepo_template_worktrees_enabled? && wave.length > 1) || monorepo_nested_template_worktree?(wave)
+      end
+
+      def monorepo_nested_template_worktree?(wave)
+        return false unless execute && monorepo_template? && wave.length == 1
+
+        member = wave.first
+        nested = Paths.within?(member.root, config.root) && !Paths.same?(member.root, config.root)
+        nested && !config.template_root_outputs.empty? && kettle_jem_template_command?(config.template_command || DEFAULT_COMMANDS.fetch("template"))
       end
 
       def monorepo_template_worktrees_enabled?
@@ -1197,7 +1215,8 @@ module Kettle
                 progress: progress,
                 progress_started: true,
                 commit_changes: false,
-                wave_jobs: wave_jobs
+                wave_jobs: wave_jobs,
+                template_worktree_root: monorepo_template_allowed_paths(entry.fetch(:original_member)).empty? ? nil : entry.fetch(:worktree_root)
               )
               mutex.synchronize do
                 ordered_results[index] = member_results
@@ -1224,17 +1243,18 @@ module Kettle
         paths = monorepo_template_worktree_changed_paths(worktree_root)
         return template_worktree_failure_result(original_member, paths, phase: "template_worktree_materialize") if paths.is_a?(String)
 
-        invalid_paths = paths.reject { |path| path == relative_root || path.start_with?("#{relative_root}/") }
+        allowed_paths = monorepo_template_allowed_paths(original_member)
+        invalid_paths = paths.reject { |path| monorepo_template_path_allowed?(path, relative_root, allowed_paths) }
         unless invalid_paths.empty?
           return template_worktree_failure_result(
             original_member,
-            "isolated template worker modified shared path(s): #{invalid_paths.sort.join(", ")}; only #{relative_root}/ may be materialized",
+            "isolated template worker modified shared path(s): #{invalid_paths.sort.join(", ")}; only #{([relative_root] + allowed_paths).join(", ")} may be materialized",
             phase: "template_worktree_materialize"
           )
         end
 
-        initial_state = entry.fetch(:primary_member_state)
-        current_state = monorepo_template_member_state(config.root, relative_root)
+        initial_state = entry[:primary_allowed_state] || entry.fetch(:primary_member_state)
+        current_state = monorepo_template_allowed_state(config.root, relative_root, allowed_paths)
         changed_primary_paths = changed_monorepo_template_state_paths(initial_state, current_state)
         unless changed_primary_paths.empty?
           return template_worktree_failure_result(
@@ -1261,19 +1281,40 @@ module Kettle
         changed_paths = monorepo_template_worktree_changed_paths(config.root)
         raise Error, changed_paths if changed_paths.is_a?(String)
 
-        member_changed_paths = changed_paths.select do |path|
-          path == relative_root || path.start_with?("#{relative_root}/")
-        end
+        allowed_paths = monorepo_template_allowed_paths(original_member)
+        member_changed_paths = changed_paths.select { |path| monorepo_template_path_allowed?(path, relative_root, allowed_paths) }
         sync_monorepo_template_paths(config.root, entry.fetch(:worktree_root), member_changed_paths)
-        primary_state = monorepo_template_member_state(config.root, relative_root)
-        worktree_state = monorepo_template_member_state(entry.fetch(:worktree_root), relative_root)
+        primary_state = monorepo_template_allowed_state(config.root, relative_root, allowed_paths)
+        worktree_state = monorepo_template_allowed_state(entry.fetch(:worktree_root), relative_root, allowed_paths)
         unless primary_state == worktree_state
           changed = changed_monorepo_template_state_paths(primary_state, worktree_state)
-          raise Error, "isolated template worker seed differs from primary member: #{changed.join(", ")}"
+          raise Error, "isolated template worker seed differs from primary allowed paths: #{changed.join(", ")}"
         end
 
         entry[:primary_changed_paths] = member_changed_paths
-        entry[:primary_member_state] = primary_state
+        entry[:primary_allowed_state] = primary_state
+        entry[:primary_member_state] = primary_state if allowed_paths.empty?
+      end
+
+      def monorepo_template_allowed_paths(member)
+        return [] unless Paths.within?(member.root, config.root) && !Paths.same?(member.root, config.root)
+
+        config.template_root_outputs
+      end
+
+      def monorepo_template_path_allowed?(path, relative_root, allowed_paths)
+        path == relative_root || path.start_with?("#{relative_root}/") || allowed_paths.include?(path)
+      end
+
+      def monorepo_template_allowed_state(root, relative_root, allowed_paths)
+        member_state = monorepo_template_member_state(root, relative_root)
+        shared_state = allowed_paths.each_with_object({}) do |allowed, state|
+          paths = git_worktree_paths(root, ["ls-files", "--cached", "--others", "--exclude-standard", "-z", "--", allowed])
+          raise Error, paths if paths.is_a?(String)
+
+          paths.each { |path| state[path] = monorepo_template_path_signature(root, path) }
+        end
+        member_state.merge(shared_state)
       end
 
       def monorepo_template_relative_root(member)
@@ -1546,7 +1587,7 @@ module Kettle
         )
       end
 
-      def template_results_for_member(member, progress: nil, progress_key: nil, progress_label: nil, progress_started: false, commit_changes: true, wave_jobs: 1)
+      def template_results_for_member(member, progress: nil, progress_key: nil, progress_label: nil, progress_started: false, commit_changes: true, wave_jobs: 1, template_worktree_root: nil)
         progress_key ||= member.name
         progress_label ||= member.name
         start_template_member_progress(progress, member, progress_key: progress_key, progress_label: progress_label) unless progress_started
@@ -1573,6 +1614,7 @@ module Kettle
             phase: command,
             command: workflow_command(member),
             env: template_command_env(wave_jobs: wave_jobs, member: member),
+            chdir: template_worktree_root || member.root,
             stdout_line_handler: template_event_line_handler(member, progress: progress, progress_key: progress_key, progress_label: progress_label)
           )
           emit_member_result_progress(member, memo.last, progress: progress, progress_key: progress_key, progress_label: progress_label)
@@ -2024,12 +2066,13 @@ module Kettle
       def release_preflight_phases
         maintenance_phase = {label: "pre-release maintenance", method: :release_preflight_maintenance_results} unless config.release_preflight_commands.empty?
         bump_phase = {label: "release version bump", method: :release_preflight_version_bump_results} unless release_state_results.empty?
+        drift_phase = {label: "bootstrap dependency drift", method: :release_preflight_bootstrap_drift_results} unless config.release_drift_check_gems.empty?
         dirty_phase = {label: "branch checkout readiness", method: :release_preflight_branch_checkout_dirty_results}
         signing_phase = {label: "gem signing password", method: :release_preflight_signing_password_results}
         secrets_phase = release_secrets_authorization_required? ? {label: "secrets provider authorization", method: :release_preflight_secrets_authorization_results} : nil
         gha_sha_pins_phase = release_gha_sha_pins_review_required? ? {label: "GitHub Actions SHA pins", method: :release_preflight_gha_sha_pins_results} : nil
 
-        [maintenance_phase, bump_phase, secrets_phase, gha_sha_pins_phase, dirty_phase, signing_phase].compact
+        [maintenance_phase, bump_phase, drift_phase, secrets_phase, gha_sha_pins_phase, dirty_phase, signing_phase].compact
       end
 
       # Family-declared pre-release maintenance hooks (release.preflight_commands
@@ -2075,6 +2118,108 @@ module Kettle
         results
       end
 
+      # Bootstrap-managed gems (config release.drift_check.gems, default:
+      # nomono) are activated by a member's own Gemfile bootstrap, while CI
+      # resolves fresh bundles from the registry. When a newer published
+      # version satisfies the member's declared floor but the committed lock
+      # pins an older one, CI activates the newer version while the member
+      # bootstrap activates the locked older one, and the wave dies mid-job
+      # with a Gem::LoadError deep in a cold-start (observed 2026-10-30:
+      # nomono locked 1.1.16 vs published 1.1.17 satisfying a ">= 1.1.16"
+      # floor, run 40998206316). Nothing compared locked vs
+      # published-satisfying versions pre-release, so this phase blocks early
+      # with the remediation instead of letting CI discover the drift.
+      def release_preflight_bootstrap_drift_results
+        config.release_drift_check_gems.flat_map do |gem|
+          members.filter_map { |member| bootstrap_dependency_drift_result(member, gem) }
+        end
+      end
+
+      def bootstrap_dependency_drift_result(member, gem)
+        locked = locked_bootstrap_gem_version(member, gem)
+        return nil if locked.nil?
+
+        requirement = declared_bootstrap_gem_requirement(member, gem)
+        newest = newest_published_satisfying_version(gem, requirement)
+        if newest.nil?
+          # A registry outage must never become a false release block: treat
+          # "could not consult the registry" as a skip with a diagnostic.
+          warn "[kettle-family] bootstrap dependency drift check skipped for #{gem}: registry could not be consulted"
+          return nil
+        end
+        return nil if locked >= newest
+
+        release_preflight_error_result(
+          "bootstrap_dependency_drift",
+          "Release blocked: bootstrap dependency drift: #{member.name} locks #{gem} #{locked} but #{newest} satisfies its floor; " \
+          "run the family template sweep or `bundle update #{gem}` in the member before releasing.",
+          member: member
+        )
+      end
+
+      # The version a member's committed lock pins for the gem, from the
+      # registry-sourced GEM section only: a PATH or GIT pin is local-only
+      # state that has no published counterpart to drift against.
+      def locked_bootstrap_gem_version(member, gem)
+        lockfile_path = File.join(member.root, "Gemfile.lock")
+        return nil unless File.file?(lockfile_path)
+
+        section = nil
+        File.foreach(lockfile_path) do |line|
+          section = line.strip unless line.match?(/\A\s/)
+          next unless section == "GEM"
+
+          match = line.match(/\A {4}#{Regexp.escape(gem)} \(([^)]+)\)\s*\z/)
+          next unless match
+
+          begin
+            return Gem::Version.new(match[1])
+          rescue ArgumentError
+            return nil
+          end
+        end
+        nil
+      end
+
+      # The requirement the member's Gemfile declared for the gem, read from
+      # the lock's DEPENDENCIES section (Bundler records the DSL requirement
+      # there verbatim). A bare declaration means "any version".
+      def declared_bootstrap_gem_requirement(member, gem)
+        lockfile_path = File.join(member.root, "Gemfile.lock")
+        return Gem::Requirement.default unless File.file?(lockfile_path)
+
+        section = nil
+        File.foreach(lockfile_path) do |line|
+          section = line.strip unless line.match?(/\A\s/)
+          next unless section == "DEPENDENCIES"
+
+          match = line.match(/\A {2}#{Regexp.escape(gem)}(?: \((.+)\))?\s*\z/)
+          next unless match
+
+          constraints = (match[1] || "").split(",").map(&:strip).reject(&:empty?)
+          return Gem::Requirement.new(constraints) unless constraints.empty?
+
+          return Gem::Requirement.default
+        end
+        Gem::Requirement.default
+      end
+
+      # Newest published (non-prerelease) version satisfying the requirement,
+      # via the ETag-cached registry lookup shared with the rest of the
+      # toolchain; nil when the registry could not be consulted.
+      def newest_published_satisfying_version(gem, requirement)
+        numbers = Kettle::Dev::RubyGemsVersions.published_version_numbers(gem)
+        return nil if numbers.nil?
+
+        numbers.filter_map do |number|
+          Gem::Version.new(number)
+        rescue ArgumentError
+          nil
+        end.select do |version|
+          !version.prerelease? && requirement.satisfied_by?(version)
+        end.max
+      end
+
       def release_gha_sha_pins_review_required?
         execute && kettle_release_command?(raw_release_command) && !release_gha_sha_pins_offline_requested?
       end
@@ -2119,11 +2264,14 @@ module Kettle
         @secrets_provider.is_a?(Secrets::OnePassword)
       end
 
-      def release_preflight_error_result(phase, message)
+      def release_preflight_error_result(phase, message, member: nil)
         # A preflight failure blocks the selected release invocation. Attribute
         # it to that invocation's first member so generated resume commands do
-        # not target the synthetic family name or an unselected sibling.
-        member = members.first || family_member
+        # not target the synthetic family name or an unselected sibling. Phases
+        # that identify a specific offending member (e.g. bootstrap dependency
+        # drift) override that attribution so the resume hint targets the
+        # member that needs the fix.
+        member ||= members.first || family_member
         CommandResult.new(
           member_name: member.name,
           phase: phase,
@@ -3889,6 +4037,16 @@ module Kettle
         aggregate_validation_members.include?(member)
       end
 
+      # An independently versioned member (release.version_series.
+      # independent_members) keeps its own monotonic series: it is exempt
+      # from lockstep raises and from the aggregate same-version invariant,
+      # but remains part of the aggregate release for artifact attachment.
+      def independent_version_series_member?(member)
+        return false unless member
+
+        config.independent_version_series_member?(member)
+      end
+
       def aggregate_validation_member_name?(member)
         member && member.name == (@aggregate_validation_member_name || aggregate_validation_members.first&.name)
       end
@@ -4109,12 +4267,19 @@ module Kettle
 
       # simplecov:disable Covered by monorepo release integration, not sibling-repository suite.
       def aggregate_monorepo_github_release(members)
-        version = members.map { |member| member.version.to_s }.uniq
+        # The same-version invariant describes the shared-version cohort.
+        # Independently versioned members (release.version_series.
+        # independent_members) can never satisfy it by design, so they are
+        # exempt from the uniformity check while their artifacts still
+        # attach — at their own series version, not the cohort's.
+        shared_members = members.reject { |member| independent_version_series_member?(member) }
+        version = shared_members.map { |member| member.version.to_s }.uniq
         return aggregate_release_result("all selected members must have the same version") unless version.length == 1
 
         assets = members.flat_map do |member|
-          gem_path = Paths.glob(member.root, "pkg", "*.gem").select { |path| File.basename(path).end_with?("-#{version.first}.gem") }
-          checksum_paths = %w[sha256 sha512].map { |algorithm| File.join(member.root, "checksums", "#{member.name}-#{version.first}.gem.#{algorithm}") }
+          asset_version = independent_version_series_member?(member) ? member.version.to_s : version.first
+          gem_path = Paths.glob(member.root, "pkg", "*.gem").select { |path| File.basename(path).end_with?("-#{asset_version}.gem") }
+          checksum_paths = %w[sha256 sha512].map { |algorithm| File.join(member.root, "checksums", "#{member.name}-#{asset_version}.gem.#{algorithm}") }
           gem_path + checksum_paths.select { |path| File.file?(path) }
         end
         command = ["bundle", "exec", "kettle-gh-release", "--allow-unpublished", "--events", "--release-version", version.first]
@@ -4159,11 +4324,26 @@ module Kettle
 
       def aggregate_github_release_resume_command(env, command)
         assignments = env.sort_by { |key, _value| key }.filter_map do |key, value|
-          "#{key}=#{Shellwords.escape(value.to_s)}" unless value.nil?
+          next if value.nil?
+
+          # Resume commands land in terminal output, run summaries, and
+          # transcripts. Env built from the broker-cached secrets used to
+          # embed KETTLE_RELEASE_GEM_SIGNING_PASSPHRASE in plaintext here
+          # (2026-10-30 incident). Redact secret-valued keys instead: the
+          # printed command keeps its shape, and the operator re-authorizes
+          # the secret through the release secrets provider (1Password, or
+          # the KETTLE_RELEASE_SECRETS_BROKER cache) — or pastes the real
+          # passphrase in place of the placeholder — before resuming.
+          rendered_value = resume_command_secret_env_key?(key) ? Shellwords.escape(RESUME_COMMAND_REDACTED_VALUE) : Shellwords.escape(value.to_s)
+          "#{key}=#{rendered_value}"
         end
         (["env", *assignments].join(" ") + " " + Shellwords.join(command)).strip
       end
 
+      def resume_command_secret_env_key?(key)
+        key.match?(RESUME_COMMAND_SECRET_ENV_KEY_RE) && !key.match?(RESUME_COMMAND_SECRET_ENV_KEY_EXCLUDE_RE)
+      end
+
       def aggregate_github_release_event_line_handler(member)
         lambda do |line|
           event = parse_template_event(line)
@@ -5896,14 +6076,17 @@ module Kettle
         return unless memo.all?(&:ok?)
 
         synchronize_template_commit do
+          allowed_paths = monorepo_template_allowed_paths(member)
+          paths = allowed_paths.empty? ? ["."] : [monorepo_template_relative_root(member)] + allowed_paths
+          pathspec = paths.map { |path| Shellwords.escape(path) }.join(" ")
           memo << runner.call(
             member: member,
             phase: "commit_template",
             command: [
               "sh",
               "-lc",
-              "if [ -n \"$(git status --porcelain -- .)\" ]; then " \
-                "git add -A -- . && git commit -m #{Shellwords.escape(template_commit_message(member))}; " \
+              "if [ -n \"$(git status --porcelain -- #{pathspec})\" ]; then " \
+                "git add -A -- #{pathspec} && git commit -m #{Shellwords.escape(template_commit_message(member))} -- #{pathspec}; " \
                 "fi"
             ],
             env: workflow_env

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-family
 version: !ruby/object:Gem::Version
-  version: 1.3.36
+  version: 1.3.38
 platform: ruby
 authors:
 - Peter H. Boling
@@ -134,7 +134,7 @@ dependencies:
         version: '1.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.0.15
+        version: 1.0.16
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -144,7 +144,7 @@ dependencies:
         version: '1.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.0.15
+        version: 1.0.16
 - !ruby/object:Gem::Dependency
   name: kettle-deps-floor
   requirement: !ruby/object:Gem::Requirement
@@ -234,7 +234,7 @@ dependencies:
         version: '0.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.1.22
+        version: 0.1.23
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -244,7 +244,7 @@ dependencies:
         version: '0.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.1.22
+        version: 0.1.23
 - !ruby/object:Gem::Dependency
   name: kettle-test
   requirement: !ruby/object:Gem::Requirement
@@ -254,7 +254,7 @@ dependencies:
         version: '2.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.0.28
+        version: 2.0.29
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -264,7 +264,7 @@ dependencies:
         version: '2.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.0.28
+        version: 2.0.29
 - !ruby/object:Gem::Dependency
   name: psych-merge
   requirement: !ruby/object:Gem::Requirement
@@ -627,11 +627,11 @@ homepage: https://github.com/kettle-dev/kettle-family
 licenses:
 - AGPL-3.0-only
 metadata:
-  homepage_uri: https://kettle-family.galtzo.com
-  source_code_uri: https://github.com/kettle-dev/kettle-family/tree/v1.3.36
-  changelog_uri: https://github.com/kettle-dev/kettle-family/blob/v1.3.36/CHANGELOG.md
+  homepage_uri: https://structuredmerge.org
+  source_code_uri: https://github.com/kettle-dev/kettle-family/tree/v1.3.38
+  changelog_uri: https://github.com/kettle-dev/kettle-family/blob/v1.3.38/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-family/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-family/1.3.36
+  documentation_uri: https://www.rubydoc.info/gems/kettle-family/1.3.38
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-family/wiki
   news_uri: https://www.railsbling.com/tags/kettle-family
@@ -662,7 +662,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.20
+rubygems_version: 4.0.24
 specification_version: 4
 summary: "\U0001F469‍\U0001F469‍\U0001F467‍\U0001F467 CLI helpers for managing related
   Ruby gems as a family."