@1aboveio/skills 0.0.0-stage → 1.0.0

package/skills/engineering/resolve-release/scripts/plan.test.mjs

@@ -0,0 +1,428 @@
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { createHash } from 'node:crypto'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { spawnSync } from 'node:child_process'
+import {
+  bumpFor,
+  classifySubject,
+  latestReleaseTag,
+  nextReleaseCandidateTag,
+  nextVersion,
+  parseSemver,
+  planRelease,
+  renderChangelog,
+} from './plan.mjs'
+
+function git(cwd, args) {
+  const result = spawnSync('git', args, { cwd, encoding: 'utf8' })
+  assert.equal(result.status, 0, result.stderr)
+  return result.stdout
+}
+
+function repo() {
+  const cwd = mkdtempSync(join(tmpdir(), 'rush-release-plan-'))
+  git(cwd, ['init', '-b', 'main'])
+  git(cwd, ['config', 'user.email', 'dev@example.com'])
+  git(cwd, ['config', 'user.name', 'Dev'])
+  git(cwd, ['config', 'commit.gpgsign', 'false'])
+  writeFileSync(join(cwd, 'package.json'), `${JSON.stringify({ name: 'demo', version: '1.2.0' }, null, 2)}\n`)
+  git(cwd, ['add', 'package.json'])
+  git(cwd, ['commit', '-m', 'chore: init'])
+  git(cwd, ['tag', 'v1.2.0'])
+  return cwd
+}
+
+test('semver helpers', () => {
+  assert.deepEqual(parseSemver('v1.2.3'), { major: 1, minor: 2, patch: 3 })
+  assert.equal(parseSemver('v1.2.3-rc.1'), null)
+  assert.equal(latestReleaseTag(['v1.2.0', 'v1.10.0', 'v1.2.3-rc.1']).tag, 'v1.10.0')
+  assert.deepEqual(nextVersion({ major: 1, minor: 2, patch: 3 }, 'minor'), { major: 1, minor: 3, patch: 0 })
+  assert.equal(nextReleaseCandidateTag('v1.3.0', []), 'v1.3.0-rc.1')
+  assert.equal(nextReleaseCandidateTag('v1.3.0', ['v1.3.0-rc.1', 'v1.3.0-rc.3']), 'v1.3.0-rc.4')
+})
+
+test('conventional commits drive the bump, with 0.x breaking as minor', () => {
+  const feat = [classifySubject('feat(api): list invoices')]
+  const fix = [classifySubject('fix: null guard')]
+  const breaking = [classifySubject('feat!: drop v1')]
+  assert.equal(bumpFor(feat, { major: 1, minor: 2, patch: 0 }).bump, 'minor')
+  assert.equal(bumpFor(fix, { major: 1, minor: 2, patch: 0 }).bump, 'patch')
+  assert.equal(bumpFor(breaking, { major: 1, minor: 2, patch: 0 }).bump, 'major')
+  assert.equal(bumpFor(breaking, { major: 0, minor: 9, patch: 0 }).bump, 'minor')
+  assert.equal(bumpFor(breaking, { major: 0, minor: 9, patch: 0 }, { strict: true }).bump, 'major')
+})
+
+test('changelog groups notable commits and skips internals', () => {
+  const md = renderChangelog({
+    version: '1.3.0',
+    date: '2026-08-24',
+    changes: [
+      classifySubject('feat: add export'),
+      classifySubject('fix: timezone'),
+      classifySubject('chore: ignore me'),
+    ],
+  })
+  assert.match(md, /## \[1\.3\.0\] - 2026-08-24/)
+  assert.match(md, /### Added\n- add export/)
+  assert.match(md, /### Fixed\n- timezone/)
+  assert.doesNotMatch(md, /ignore me/)
+})
+
+test('planRelease reads git history from the frozen SHA', () => {
+  const cwd = repo()
+  writeFileSync(join(cwd, 'a.txt'), 'a\n')
+  git(cwd, ['add', 'a.txt'])
+  git(cwd, ['commit', '-m', 'feat: export csv'])
+  const sha = git(cwd, ['rev-parse', 'HEAD']).trim()
+  writeFileSync(join(cwd, 'package.json'), `${JSON.stringify({ name: 'demo', version: '9.0.0' }, null, 2)}\n`)
+  git(cwd, ['add', 'package.json'])
+  git(cwd, ['commit', '-m', 'feat!: should not count if SHA is frozen earlier'])
+  const plan = planRelease({ sha, cwd, now: new Date('2026-08-24T00:00:00Z') })
+  assert.equal(plan.baselineTag, 'v1.2.0')
+  assert.equal(plan.currentVersion, '1.2.0')
+  assert.equal(plan.bump, 'minor')
+  assert.equal(plan.nextVersion, '1.3.0')
+  assert.equal(plan.tag, 'v1.3.0')
+  assert.deepEqual(plan.versionFiles, ['package.json'])
+  assert.match(plan.changelogMarkdown, /export csv/)
+  assert.doesNotMatch(plan.changelogMarkdown, /should not count/)
+})
+
+test('Cloud Run plan reserves the next unused immutable candidate tag', () => {
+  const cwd = repo()
+  writeFileSync(join(cwd, 'a.txt'), 'a\n')
+  git(cwd, ['add', 'a.txt'])
+  git(cwd, ['commit', '-m', 'feat: export csv'])
+  const sha = git(cwd, ['rev-parse', 'HEAD']).trim()
+  git(cwd, ['tag', 'v1.3.0-rc.1'])
+  git(cwd, ['tag', 'v1.3.0-rc.2'])
+
+  const plan = planRelease({ sha, cloudRun: true, cwd, now: new Date('2026-08-24T00:00:00Z') })
+
+  assert.equal(plan.tag, 'v1.3.0')
+  assert.equal(plan.candidateTag, 'v1.3.0-rc.3')
+})
+
+test('planRelease ignores higher tags that are not reachable from the frozen SHA', () => {
+  const cwd = repo()
+  const candidate = git(cwd, ['rev-parse', 'HEAD']).trim()
+  git(cwd, ['switch', '-c', 'unrelated'])
+  writeFileSync(join(cwd, 'side.txt'), 'side\n')
+  git(cwd, ['add', 'side.txt'])
+  git(cwd, ['commit', '-m', 'feat: unrelated branch'])
+  git(cwd, ['tag', 'v9.0.0'])
+  git(cwd, ['switch', 'main'])
+
+  const plan = planRelease({ sha: candidate, cwd, now: new Date('2026-08-24T00:00:00Z') })
+  assert.equal(plan.baselineTag, 'v1.2.0')
+  assert.equal(plan.currentVersion, '1.2.0')
+  assert.equal(plan.nextVersion, '1.2.1')
+})
+
+test('planRelease uses the repository release identity when the private root package has no version', () => {
+  const cwd = mkdtempSync(join(tmpdir(), 'rush-release-distribution-plan-'))
+  git(cwd, ['init', '-b', 'main'])
+  git(cwd, ['config', 'user.email', 'dev@example.com'])
+  git(cwd, ['config', 'user.name', 'Dev'])
+  git(cwd, ['config', 'commit.gpgsign', 'false'])
+  mkdirSync(join(cwd, 'skills/distribution'), { recursive: true })
+  writeFileSync(join(cwd, 'package.json'), `${JSON.stringify({ name: 'private-root', private: true }, null, 2)}\n`)
+  writeFileSync(join(cwd, 'skills/distribution/manifest.json'), `${JSON.stringify({
+    releaseVersion: '0.19.0',
+    sources: [{
+      id: 'first-party',
+      renderTargets: [
+        { id: 'private-checkout', revision: 'main' },
+      ],
+    }],
+  }, null, 2)}\n`)
+  git(cwd, ['add', '.'])
+  git(cwd, ['commit', '-m', 'chore: release 0.19.0'])
+  git(cwd, ['tag', 'v0.19.0'])
+  writeFileSync(join(cwd, 'change.txt'), 'manual trigger only\n')
+  git(cwd, ['add', 'change.txt'])
+  git(cwd, ['commit', '-m', 'fix: make coverage skills manual only'])
+
+  const plan = planRelease({
+    sha: git(cwd, ['rev-parse', 'HEAD']).trim(),
+    cwd,
+    now: new Date('2026-08-30T00:00:00Z'),
+  })
+
+  assert.equal(plan.currentVersion, '0.19.0')
+  assert.equal(plan.nextVersion, '0.19.1')
+  assert.deepEqual(plan.versionFiles, ['skills/distribution/manifest.json'])
+})
+
+// rush-release never passes --dark-flags, so its plan must be exactly what it was before
+// dark launch existed: no darkFlags key and an unchanged changelog.
+test('a plan without dark flags carries no dark-launch trace', () => {
+  const cwd = repo()
+  git(cwd, ['commit', '--allow-empty', '-m', 'feat: export csv'])
+  const plan = planRelease({ sha: 'HEAD', cwd, now: new Date('2026-08-24T00:00:00Z') })
+  assert.equal('darkFlags' in plan, false)
+  assert.equal(plan.changelogMarkdown, '## [1.3.0] - 2026-08-24\n\n### Added\n- export csv\n')
+})
+
+test('dark flags add a Shipped dark changelog section and keep the bump', () => {
+  const cwd = repo()
+  git(cwd, ['commit', '--allow-empty', '-m', 'feat: bulk refunds'])
+  const darkFlags = [{ name: 'bulk-refunds', summary: 'Bulk refunds' }]
+  const plan = planRelease({ sha: 'HEAD', cwd, darkFlags, now: new Date('2026-08-24T00:00:00Z') })
+  assert.equal(plan.bump, 'minor')
+  assert.deepEqual(plan.darkFlags, darkFlags)
+  assert.equal(plan.changelogMarkdown,
+    '## [1.3.0] - 2026-08-24\n\n### Added\n- bulk refunds\n\n### Shipped dark\n- Bulk refunds (flag `bulk-refunds`, off)\n')
+})
+
+test('the CLI reads dark flags from a dark-flags.mjs list file and rejects malformed ones', () => {
+  const cwd = repo()
+  git(cwd, ['commit', '--allow-empty', '-m', 'fix: rounding'])
+  const good = join(cwd, 'flags.json')
+  writeFileSync(good, JSON.stringify({ flags: [{ name: 'new-checkout', summary: 'New checkout', default: false }], errors: [] }))
+  const script = join(import.meta.dirname, 'plan.mjs')
+  const ok = spawnSync('node', [script, '--sha', 'HEAD', '--json', '--dark-flags', good], { cwd, encoding: 'utf8' })
+  assert.equal(ok.status, 0, ok.stderr)
+  assert.deepEqual(JSON.parse(ok.stdout).darkFlags, [{ name: 'new-checkout', summary: 'New checkout' }])
+  const bad = join(cwd, 'bad.json')
+  writeFileSync(bad, JSON.stringify([{ name: 'no-summary' }]))
+  const refused = spawnSync('node', [script, '--sha', 'HEAD', '--dark-flags', bad], { cwd, encoding: 'utf8' })
+  assert.equal(refused.status, 2)
+  assert.match(refused.stderr, /name, summary/)
+})
+
+function preparedRepo(t, { productCut = false, badLockCut = false, python = false, badPackageCut = false } = {}) {
+  const cwd = repo()
+  const remote = mkdtempSync(join(tmpdir(), 'prepared-release-origin-'))
+  t.after(() => { rmSync(cwd, { recursive: true, force: true }); rmSync(remote, { recursive: true, force: true }) })
+  git(remote, ['init', '--bare'])
+  // Exercise git's real transport while keeping the canonical origin identity offline.
+  git(cwd, ['remote', 'add', 'origin', 'https://github.com/example/demo.git'])
+  git(cwd, ['config', `url.${remote}.insteadOf`, 'https://github.com/example/demo.git'])
+  const lock = (version) => ({ name: 'demo', version, lockfileVersion: 3, packages: { '': { name: 'demo', version } } })
+  writeFileSync(join(cwd, 'package-lock.json'), JSON.stringify(lock('1.2.0')))
+  writeFileSync(join(cwd, 'VERSION'), '1.2.0\n')
+  if (python) writeFileSync(join(cwd, 'pyproject.toml'), '[project]\nname = "demo"\nversion = "1.2.0"\n\n[tool.other]\nversion = "not-a-release"\n')
+  writeFileSync(join(cwd, 'CHANGELOG.md'), '# Changelog\n\n## [1.2.0] - 2026-08-01\n\n- Previous release.\n')
+  git(cwd, ['add', '.'])
+  git(cwd, ['commit', '-m', 'chore: existing identities'])
+  git(cwd, ['switch', '-c', 'old-metadata'])
+  writeFileSync(join(cwd, 'package.json'), JSON.stringify({ name: 'demo', version: '1.3.0', ...(badPackageCut ? { scripts: { build: 'execute-unreviewed-code' } } : {}) }))
+  const cutLock = lock('1.3.0')
+  if (badLockCut) cutLock.packages['node_modules/unsafe'] = { version: '9.0.0' }
+  writeFileSync(join(cwd, 'package-lock.json'), JSON.stringify(cutLock))
+  writeFileSync(join(cwd, 'VERSION'), '1.3.0\n')
+  if (python) writeFileSync(join(cwd, 'pyproject.toml'), '[project]\nname = "demo"\nversion = "1.3.0"\n\n[tool.other]\nversion = "not-a-release"\n')
+  const original = '## [1.3.0] - 2026-08-24\n\n### Added\n- Original notes.\n'
+  writeFileSync(join(cwd, 'CHANGELOG.md'), `# Changelog\n\n${original}\n## [1.2.0] - 2026-08-01\n\n- Previous release.\n`)
+  if (productCut) writeFileSync(join(cwd, 'product.js'), 'unreviewed code\n')
+  git(cwd, ['add', '.'])
+  git(cwd, ['commit', '-m', 'chore(release): 1.3.0'])
+  const cutSha = git(cwd, ['rev-parse', 'HEAD']).trim()
+  git(cwd, ['switch', 'main'])
+  git(cwd, ['merge', '--no-ff', 'old-metadata', '-m', 'Merge reviewed metadata'])
+  const mergeSha = git(cwd, ['rev-parse', 'HEAD']).trim()
+  git(cwd, ['tag', '-a', 'v1.3.0-rc.1', '-m', 'Failed candidate'])
+  git(cwd, ['push', 'origin', 'main', '--tags'])
+  const reviewed = '## [1.3.0] - 2026-08-24\n\n### Added\n- Reviewed corrected notes.\n\n### Fixed\n- Candidate failure.\n'
+  writeFileSync(join(cwd, 'CHANGELOG.md'), `# Changelog\n\n${reviewed}\n## [1.2.0] - 2026-08-01\n\n- Previous release.\n`)
+  writeFileSync(join(cwd, 'product.js'), 'reviewed fix\n')
+  git(cwd, ['add', '.'])
+  git(cwd, ['commit', '-m', 'fix: candidate failure and release notes'])
+  const sha = git(cwd, ['rev-parse', 'HEAD']).trim()
+  git(cwd, ['push', 'origin', 'main'])
+  const preparedMetadata = {
+    schema: 'prepared-release-metadata/v1', repository: 'example/demo', version: '1.3.0', metadataPr: 42,
+    cutSha, mergeSha,
+    previousAttempt: { receiptId: 'failed-attempt-1', receiptSha256: 'a'.repeat(64), candidateTag: 'v1.3.0-rc.1', candidateSha: mergeSha },
+  }
+  return { cwd, remote, sha, preparedMetadata, original, reviewed }
+}
+
+function preparedPlan(fixture, opts = {}) {
+  return planRelease({ ...fixture, cloudRun: true, now: new Date('2026-08-25T00:00:00Z'), ...opts })
+}
+
+const digest = (text) => createHash('sha256').update(text).digest('hex')
+
+test('prepared reuse preserves version and binds reviewed target notes separately from historical metadata', (t) => {
+  const f = preparedRepo(t)
+  const oldReceipt = join(f.cwd, '.git', 'resolve-release-authorization.json')
+  writeFileSync(oldReceipt, 'historical receipt: must not be read or changed')
+  const before = git(f.cwd, ['status', '--porcelain'])
+  const plan = preparedPlan(f)
+  assert.equal(plan.nextVersion, '1.3.0')
+  assert.equal(plan.currentVersion, '1.3.0')
+  assert.equal(plan.bump, 'none')
+  assert.equal(plan.tag, 'v1.3.0')
+  assert.equal(plan.candidateTag, 'v1.3.0-rc.2')
+  assert.equal(plan.sha, f.sha)
+  assert.equal(plan.releaseSourceSha, f.sha)
+  assert.equal(plan.changelogMarkdown, f.reviewed)
+  assert.equal(plan.date, '2026-08-24')
+  assert.equal(plan.metadata.mode, 'reuse-prepared')
+  assert.equal(plan.metadata.cutSha, f.preparedMetadata.cutSha)
+  assert.equal(plan.metadata.mergeSha, f.preparedMetadata.mergeSha)
+  assert.equal(plan.metadata.preparedSectionSha256, digest(f.reviewed))
+  assert.equal(plan.metadata.originalSectionSha256, digest(f.original))
+  assert.deepEqual(plan.metadata.previousAttempt, f.preparedMetadata.previousAttempt)
+  assert.notEqual(plan.receiptId, f.preparedMetadata.previousAttempt.receiptId)
+  assert.notEqual(preparedPlan(f).receiptId, plan.receiptId)
+  assert.equal('permissions' in plan, false)
+  assert.equal(readFileSync(oldReceipt, 'utf8'), 'historical receipt: must not be read or changed')
+  assert.equal(git(f.cwd, ['status', '--porcelain']), before)
+  // Neither a dirty worktree nor a later commit can replace the frozen source or notes.
+  writeFileSync(join(f.cwd, 'VERSION'), '9.0.0\n')
+  git(f.cwd, ['add', 'VERSION'])
+  git(f.cwd, ['commit', '-m', 'feat!: unrelated later change'])
+  assert.equal(preparedPlan(f).metadata.preparedSectionSha256, digest(f.reviewed))
+})
+
+test('prepared reuse uses remote ordinals even with stale local tags and never recycles the historical ordinal', (t) => {
+  const f = preparedRepo(t)
+  git(f.cwd, ['tag', 'v1.3.0-rc.4'])
+  git(f.cwd, ['push', 'origin', 'refs/tags/v1.3.0-rc.4'])
+  git(f.cwd, ['tag', '-d', 'v1.3.0-rc.4', 'v1.3.0-rc.1'])
+  assert.equal(preparedPlan(f).candidateTag, 'v1.3.0-rc.5')
+  git(f.remote, ['update-ref', '-d', 'refs/tags/v1.3.0-rc.4'])
+  git(f.remote, ['update-ref', '-d', 'refs/tags/v1.3.0-rc.1'])
+  assert.equal(preparedPlan(f).candidateTag, 'v1.3.0-rc.2')
+})
+
+test('prepared reuse blocks a remote final tag, inspection errors and noncanonical or wrong repository identity', (t) => {
+  const f = preparedRepo(t)
+  git(f.cwd, ['tag', '-a', 'v1.3.0', '-m', 'Already used'])
+  git(f.cwd, ['push', 'origin', 'refs/tags/v1.3.0'])
+  git(f.cwd, ['tag', '-d', 'v1.3.0'])
+  assert.throws(() => preparedPlan(f), /final tag.*already exists/)
+  git(f.remote, ['update-ref', '-d', 'refs/tags/v1.3.0'])
+  git(f.cwd, ['config', '--unset', `url.${f.remote}.insteadOf`])
+  // Repoint only the transport rewrite; origin's canonical identity stays valid.
+  git(f.cwd, ['config', `url.${join(f.remote, 'missing')}.insteadOf`, 'https://github.com/example/demo.git'])
+  assert.throws(() => preparedPlan(f), /remote inspection failed/)
+  git(f.cwd, ['remote', 'set-url', 'origin', f.remote])
+  assert.throws(() => preparedPlan(f), /canonical GitHub origin/)
+  git(f.cwd, ['remote', 'set-url', 'origin', 'https://github.com/other/demo.git'])
+  assert.throws(() => preparedPlan(f), /repository.*does not match/)
+})
+
+test('prepared reuse refuses product changes hidden in the original metadata cut', (t) => {
+  for (const options of [{ productCut: true }, { badLockCut: true }, { badPackageCut: true }]) {
+    const f = preparedRepo(t, options)
+    assert.throws(() => preparedPlan(f), /metadata-only/)
+  }
+})
+
+test('prepared reuse validates schema, full identities, previous attempt binding and unchanged version identity', (t) => {
+  const f = preparedRepo(t)
+  const p = f.preparedMetadata
+  const cases = [
+    [{ ...p, schema: 'future/v2' }, /schema/],
+    [{ ...p, version: 'v1.3.0' }, /version/],
+    [{ ...p, version: '1.4.0', previousAttempt: { ...p.previousAttempt, candidateTag: 'v1.4.0-rc.1' } }, /version.*does not match/],
+    [{ ...p, metadataPr: 0 }, /metadataPr/],
+    [{ ...p, mergeSha: 'HEAD' }, /full.*SHA/],
+    [{ ...p, cutSha: p.cutSha.slice(0, 12) }, /full.*SHA/],
+    [{ ...p, extraPermission: true }, /unknown field/],
+    [{ ...p, previousAttempt: { ...p.previousAttempt, receiptSha256: '' } }, /receiptSha256/],
+    [{ ...p, previousAttempt: { ...p.previousAttempt, candidateSha: f.sha } }, /previous.*candidateSha/],
+    [{ ...p, previousAttempt: { ...p.previousAttempt, candidateTag: 'v1.4.0-rc.1' } }, /previous.*candidateTag/],
+  ]
+  for (const [preparedMetadata, error] of cases) assert.throws(() => preparedPlan(f, { preparedMetadata }), error)
+  assert.throws(() => preparedPlan(f, { sha: 'HEAD' }), /full.*SHA/)
+  assert.throws(() => preparedPlan(f, { trunk: 'release' }), /trunk.*main/)
+  assert.throws(() => preparedPlan(f, { darkFlags: [{ name: 'flag', summary: 'Unreviewed notes' }] }), /dark flags/)
+})
+
+test('prepared reuse rejects unequal merge trees, unrelated provenance and missing commit objects', (t) => {
+  const f = preparedRepo(t)
+  const p = f.preparedMetadata
+  const unequal = { ...p, mergeSha: f.sha, previousAttempt: { ...p.previousAttempt, candidateSha: f.sha } }
+  assert.throws(() => preparedPlan(f, { preparedMetadata: unequal }), /cut and merge trees/)
+  git(f.cwd, ['switch', '--orphan', 'unrelated'])
+  git(f.cwd, ['add', '.'])
+  git(f.cwd, ['commit', '--allow-empty', '-m', 'unrelated root'])
+  const unrelated = git(f.cwd, ['rev-parse', 'HEAD']).trim()
+  assert.throws(() => preparedPlan(f, { sha: unrelated }), /merge.*ancestor/)
+  assert.throws(() => preparedPlan(f, { sha: 'f'.repeat(40) }), /failed|object|revision/i)
+})
+
+test('prepared reuse rejects target identity drift, duplicate or absent release notes and a rebound old RC', (t) => {
+  const f = preparedRepo(t)
+  const checkChange = (file, text, error) => {
+    git(f.cwd, ['reset', '--hard', f.sha])
+    writeFileSync(join(f.cwd, file), text)
+    git(f.cwd, ['add', file])
+    git(f.cwd, ['commit', '-m', 'fix: invalid prepared identity'])
+    const sha = git(f.cwd, ['rev-parse', 'HEAD']).trim()
+    assert.throws(() => preparedPlan(f, { sha }), error)
+  }
+  checkChange('VERSION', '1.4.0\n', /version.*does not match/)
+  checkChange('package-lock.json', JSON.stringify({ name: 'demo', version: '1.3.0', packages: { '': { version: '1.2.0' } } }), /root lock.*version/)
+  checkChange('package-lock.json', JSON.stringify({ name: 'foreign', version: '1.3.0', packages: { '': { version: '1.3.0' } } }), /root lock.*name/)
+  checkChange('CHANGELOG.md', `${f.reviewed}\n${f.reviewed}`, /exactly one/)
+  checkChange('CHANGELOG.md', '# Changelog\n', /exactly one/)
+  git(f.remote, ['update-ref', 'refs/tags/v1.3.0-rc.1', f.sha])
+  assert.throws(() => preparedPlan(f), /previous.*remote.*SHA/)
+})
+
+test('prepared reuse validates Python project identity without confusing tool versions, and supports artifact-only plans', (t) => {
+  const f = preparedRepo(t, { python: true })
+  const plan = preparedPlan(f, { cloudRun: false })
+  assert.equal(plan.candidateTag, null)
+  assert.equal(plan.bump, 'none')
+  assert.deepEqual(plan.versionFiles, ['package.json', 'package-lock.json', 'pyproject.toml', 'VERSION'])
+  writeFileSync(join(f.cwd, 'pyproject.toml'), '[project]\nversion = "1.4.0"\n')
+  git(f.cwd, ['add', '.'])
+  git(f.cwd, ['commit', '-m', 'fix: mismatched python identity'])
+  assert.throws(() => preparedPlan(f, { sha: git(f.cwd, ['rev-parse', 'HEAD']).trim() }), /pyproject.toml version.*does not match/)
+})
+
+test('prepared reuse refuses distribution cuts instead of trusting a broad generated-file allowlist', (t) => {
+  const f = preparedRepo(t)
+  mkdirSync(join(f.cwd, 'skills/distribution'), { recursive: true })
+  writeFileSync(join(f.cwd, 'skills/distribution/manifest.json'), JSON.stringify({ releaseVersion: '1.3.0' }))
+  git(f.cwd, ['add', '.'])
+  git(f.cwd, ['commit', '-m', 'chore: distribution identity'])
+  const cutSha = git(f.cwd, ['rev-parse', 'HEAD']).trim()
+  const preparedMetadata = { ...f.preparedMetadata, cutSha, mergeSha: cutSha,
+    previousAttempt: { ...f.preparedMetadata.previousAttempt, candidateSha: cutSha } }
+  assert.throws(() => preparedPlan(f, { sha: cutSha, preparedMetadata }), /distribution-aware.*unsupported/)
+})
+
+test('prepared reuse blocks an RC collision introduced between remote discovery and the exact absence check', (t) => {
+  const f = preparedRepo(t)
+  const uploadPack = join(f.cwd, '.git', 'upload-pack.sh')
+  writeFileSync(uploadPack, `#!/bin/sh\ngit-upload-pack "$@"\nstatus=$?\ngit --git-dir='${f.remote}' update-ref refs/tags/v1.3.0-rc.2 ${f.sha}\nexit "$status"\n`, { mode: 0o755 })
+  git(f.cwd, ['config', 'remote.origin.uploadpack', uploadPack])
+  assert.throws(() => preparedPlan(f), /proposed candidate tag already exists remotely/)
+})
+
+test('prepared reuse blocks an exact remote inspection failure after successful discovery', (t) => {
+  const f = preparedRepo(t)
+  const uploadPack = join(f.cwd, '.git', 'upload-pack.sh')
+  const marker = join(f.cwd, '.git', 'inspected')
+  writeFileSync(uploadPack, `#!/bin/sh\nif test -e '${marker}'; then exit 1; fi\ntouch '${marker}'\nexec git-upload-pack "$@"\n`, { mode: 0o755 })
+  git(f.cwd, ['config', 'remote.origin.uploadpack', uploadPack])
+  assert.throws(() => preparedPlan(f), /remote inspection failed/)
+})
+
+test('CLI loads prepared metadata without applying it and rejects missing, malformed and unknown options', (t) => {
+  const f = preparedRepo(t)
+  const file = join(f.cwd, '.git', 'prepared.json')
+  writeFileSync(file, JSON.stringify(f.preparedMetadata))
+  const script = join(import.meta.dirname, 'plan.mjs')
+  const run = (...args) => spawnSync(process.execPath, [script, '--sha', f.sha, '--json', ...args], { cwd: f.cwd, encoding: 'utf8' })
+  const result = run('--prepared-metadata', file, '--cloud-run')
+  assert.equal(result.status, 0, result.stderr)
+  assert.equal(JSON.parse(result.stdout).sha, f.sha)
+  assert.equal(JSON.parse(result.stdout).bump, 'none')
+  assert.equal(JSON.parse(result.stdout).metadata.preparedSectionSha256, digest(f.reviewed))
+  assert.equal(run('--prepared-metadata').status, 2)
+  writeFileSync(file, '{')
+  assert.notEqual(run('--prepared-metadata', file).status, 0)
+  assert.equal(run('--version', '9.0.0').status, 2)
+})

package/skills/engineering/rush-issues/LICENSE

@@ -0,0 +1,3 @@
+MIT License
+
+Copyright (c) 2026 1AboveIO

package/skills/engineering/rush-issues/SKILL.md

@@ -0,0 +1,58 @@
+---
+name: rush-issues
+description: "Slash/explicit-only (/rush-issues). No-questions shortcut of /resolve-issues: drive an issue, epic, or feature spec to reviewed, green PRs, one per issue, and merge each (through the queue when there is one). Takes every preflight default (recommended implementer unless the invocation pins one, the default branch, autonomous merge with blocker fixes, full scheduler mode unless scheduler= says otherwise, the drafted plan) and asks nothing, even at preflight; invoking it is the authorization. Like resolve-issues, never blocks on the human: it takes the automatic answer (the recommendation, formed if none; filed splits) and defers what only a human can do (a looser required check, shared-environment changes, missing access) on its owning issue while the rest ships. Posts the dropbox, then completes the goal. Do not auto-select. NOT for choosing the implementer, target branch, supervised merge, or trimming a plan or moving units to later (resolve-issues), and NOT for release work (rush-release)."
+disable-model-invocation: true
+metadata:
+  workflow-role: coordinator
+dependencies:
+  - resolve-issues
+release-version: 0.36.0
+---
+**Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
+# Rush issues (shortcut of resolve-issues)
+
+## Goal
+
+**Resolve the spec's issues autonomously, in the shortest wall-clock time,
+at the bar the spec already sets: every PR reviewed and green on required
+CI.** Make the decisions that get there. `resolve-issues`'
+[Goal](../resolve-issues/SKILL.md#goal) and
+[Principles](../resolve-issues/SKILL.md#principles) apply: the principles
+are guidelines, and every rule serves the goal rather than restricting you.
+
+`/rush-issues` runs the `resolve-issues` workflow in **shortcut mode**: the
+recommended implementer (or the one `implementer=<id[@effort]>` pins; the run
+stops if it is unavailable, never swapping in another), the repository's
+default branch, `autonomous` merge, the `full` scheduler mode (or the one
+`scheduler=narrow|off` names), and the drafted plan, with
+no questions at any point. Invoking it is the
+authorization for the whole run, including blocker fixes outside the plan; the board is shown as a record, never as a
+question.
+
+1. Read `resolve-issues`'s `SKILL.md` in full: `<skill-base-dir>/../resolve-issues/SKILL.md`
+   in an installed skills directory, or `skills/engineering/resolve-issues/SKILL.md`
+   in the skills source checkout. If neither exists, stop and say
+   `resolve-issues` is not installed; do not improvise its workflow. After
+   every context compaction, read it and this file in full again before your
+   next step: the summary keeps the run's state, not the rules; its
+   constraints and "do not" lists are notes, and only the plan's
+   `standingOrders` bind.
+2. Follow it as the only workflow for this invocation, in shortcut mode
+   ([preflight.md](../resolve-issues/references/preflight.md#shortcut-mode)):
+   run every preflight step, record `skill: rush-issues` in the plan and its defaults as one `decisions` entry,
+   and never ask a question; wherever the run could ask or wait, take the
+   [automatic answer](../resolve-issues/references/preflight.md#never-block-on-the-human).
+   Rush adds only this:
+   - warn on the board about a missing compaction hook or `ready-for-agent`
+     label; never install the hook or add the label yourself;
+   - at the end, post the dropbox
+     ([dropbox.md](../resolve-issues/references/dropbox.md#post-at-the-end))
+     and complete the goal
+     ([done.md](../resolve-issues/references/done.md#close-the-run)).
+3. Everything else — run rules, stages, scripts, review, CI and merge, and the
+   done criteria — applies exactly as `resolve-issues` states it.
+   The shared [task-plan checkpoints](../resolve-issues/references/task-plan.md#checkpoints)
+   apply too: on Pi, bind or reload through `update_plan` with the absolute
+   workflow path and persisted revision (no event means read-only), then
+   save transitions through its `workflow` payload. The TUI refreshes
+   automatically; never edit the bound plan directly.

package/skills/engineering/rush-issues/agents/openai.yaml

@@ -0,0 +1,8 @@
+interface:
+  display_name: "Rush Issues"
+  short_description: "Slash/explicit-only no-questions shortcut of resolve-issues"
+
+policy:
+  # Codex counterpart to SKILL.md disable-model-invocation: true.
+  # Keeps $rush-issues / explicit invoke while blocking description-based selection.
+  allow_implicit_invocation: false

package/skills/engineering/rush-issues/rehydrate.mjs

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+// rush-issues runs the resolve-issues workflow, so its compaction re-read is resolve-issues':
+// a harness that runs the owner skill's rehydrate.mjs after a compaction (Pi's workflow
+// extension) gets the same message as the Claude Code and Codex hooks.
+//
+//   rehydrate.mjs [--cwd <dir>] [--hook]
+
+import { main } from '../resolve-issues/scripts/rehydrate.mjs'
+
+main(process.argv.slice(2))

package/skills/engineering/rush-issues/release-check.mjs

@@ -0,0 +1,93 @@
+#!/usr/bin/env node
+import { spawnSync } from 'node:child_process';
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const DAY_MS = 24 * 60 * 60 * 1000;
+const WEEK_MS = 7 * DAY_MS;
+const here = dirname(fileURLToPath(import.meta.url));
+
+function readJson(path, fallback = {}) {
+  try { return JSON.parse(readFileSync(path, 'utf8')); } catch { return fallback; }
+}
+
+function frontmatterValue(text, key) {
+  const frontmatter = /^---\n([\s\S]*?)\n---/.exec(text)?.[1] ?? '';
+  const match = new RegExp('^' + key + ':\\s*([^\\n]+)$', 'm').exec(frontmatter);
+  return match?.[1].trim().replace(/^['"]|['"]$/g, '') ?? null;
+}
+
+function repositoryOf(source) {
+  const value = String(source ?? '').trim();
+  const match = /^(?:git@github\.com:|https:\/\/github\.com\/)?([A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+?)(?:\.git)?$/.exec(value);
+  return match?.[1] ?? null;
+}
+
+function stableVersion(value) {
+  const match = /^v?(\d+)\.(\d+)\.(\d+)$/.exec(String(value ?? '').trim());
+  return match ? match.slice(1).map(Number) : null;
+}
+
+function newer(left, right) {
+  for (let index = 0; index < 3; index += 1) {
+    if (left[index] !== right[index]) return left[index] > right[index];
+  }
+  return false;
+}
+
+function writeCache(path, value) {
+  try {
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, JSON.stringify(value));
+  } catch { /* A read-only cache must not block skill use. */ }
+}
+
+function main(now = Date.now()) {
+  if (process.env.ONEABOVEIO_NO_UPDATE_CHECK) return;
+  const skill = readFileSync(join(here, 'SKILL.md'), 'utf8');
+  const name = frontmatterValue(skill, 'name');
+  const localVersion = stableVersion(frontmatterValue(skill, 'release-version'));
+  if (!name || !localVersion) return;
+
+  const lock = readJson(join(process.env.HOME || homedir(), '.agents', '.skill-lock.json'));
+  const entry = lock.skills?.[name];
+  const repository = repositoryOf(entry?.sourceUrl || entry?.source);
+  if (!repository) return;
+
+  const cacheRoot = process.env.XDG_CACHE_HOME || join(process.env.HOME || homedir(), '.cache');
+  const cachePath = join(cacheRoot, '1aboveio-skills', 'release-check.json');
+  const all = readJson(cachePath);
+  const cache = all[repository] && typeof all[repository] === 'object' ? all[repository] : {};
+
+  if (!cache.lastCheck || now - cache.lastCheck >= DAY_MS) {
+    const result = spawnSync('gh', ['api', 'repos/' + repository + '/releases/latest', '--jq', '.tag_name'], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+      timeout: 1500,
+    });
+    cache.lastCheck = now;
+    if (result.status === 0 && stableVersion(result.stdout)) cache.latestTag = result.stdout.trim();
+    else delete cache.latestTag;
+    all[repository] = cache;
+    writeCache(cachePath, all);
+  }
+
+  const latestVersion = stableVersion(cache.latestTag);
+  if (!latestVersion || !newer(latestVersion, localVersion)) return;
+  if (cache.notifiedTag === cache.latestTag && cache.notifiedAt && now - cache.notifiedAt < WEEK_MS) return;
+
+  cache.notifiedTag = cache.latestTag;
+  cache.notifiedAt = now;
+  all[repository] = cache;
+  writeCache(cachePath, all);
+  const command = `npx skills@1.5.23 add '${repository}#${cache.latestTag}' --global --agent universal claude-code --skill ${name} --yes`;
+  process.stdout.write(
+    `UPDATE_AVAILABLE: A newer 1AboveIO skills release (${cache.latestTag}) is available; this skill is `
+      + `v${localVersion.join('.')}. Ask once whether to refresh ${name}. On approval run \`${command}\`. `
+      + 'The refreshed instructions apply next session. Either way, continue the current task and do not ask again this session.\n',
+  );
+}
+
+try { main(); } catch { /* Update checks are advisory and always fail silent. */ }

package/skills/engineering/rush-release/LICENSE

@@ -0,0 +1,3 @@
+MIT License
+
+Copyright (c) 2026 1AboveIO

package/skills/engineering/rush-release/SKILL.md

@@ -0,0 +1,35 @@
+---
+name: rush-release
+description: "Slash/explicit-only (/rush-release). The no-questions shortcut of /resolve-release: cut a GitHub Flow release from main — freeze the latest CI-green trunk SHA, write the changelog, choose SemVer, merge the metadata cut through a verified PR, publish npm artifacts, or validate a Cloud Run candidate at 0% before shifting it to 100%. Always full exposure, dark launch off. Invoking the skill is the authorization: the complete plan is shown as a record, never as a question. Do not auto-select. Use only on explicit user/orchestrator invoke. NOT for canary exposure or dark launch (resolve-release), GitFlow/release-branch promotion, or implementing a spec (resolve-issues)."
+disable-model-invocation: true
+metadata:
+  workflow-role: coordinator
+dependencies:
+  - resolve-release
+release-version: 0.36.0
+---
+**Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
+# Rush release (shortcut of resolve-release)
+
+`/rush-release` runs the `resolve-release` workflow in **shortcut mode**:
+exposure `full` (Cloud Run: validate at 0%, then shift to 100%), dark launch
+`off`, and no questions at any point. Invoking it is the authorization for the
+whole release; the plan is shown as a record, never as a question.
+
+1. Read `resolve-release`'s `SKILL.md` in full: `<skill-base-dir>/../resolve-release/SKILL.md`
+   in an installed skills directory, or `skills/engineering/resolve-release/SKILL.md`
+   in the skills source checkout. If neither exists, stop and say
+   `resolve-release` is not installed; do not improvise its workflow.
+2. Follow it as the only workflow for this invocation, in shortcut mode:
+   - resolve choices with `flow.mjs resolve --mode shortcut` (plus `--flow <name>`
+     when invoked with one); never ask a question, including a release flow's
+     `ask:` items (their defaults answer);
+   - if it refuses (an exposure/dark/canary option was passed, the release flow
+     requires canary or dark, or a flow question has no default), hand back and
+     point the user to `/resolve-release`; do not ask instead;
+   - write the normal cut receipt as `.git/rush-release-authorization.json`;
+     an explicitly human-approved prepared-metadata reuse follows the shared
+     workflow's distinct fresh receipt path instead, with no old permissions
+     or metadata writes. Do not infer reuse approval from shortcut defaults.
+3. Everything else — invariants, stages, scripts, rollback, and the done
+   criteria — applies exactly as `resolve-release` states it.