@1aboveio/skills 0.19.3 → 0.20.2

package/runtime/skills/engineering/engineering-runtime/scripts/workflow-policy.mjs

@@ -11,9 +11,7 @@ export const WORKFLOW_OWNED_MEMBERS = deepFreeze([
   'ensure-coverage',
   'implement-and-pr',
   'rush-issues',
-  'resolve-issues',
   'rush-release',
-  'resolve-release',
   'review-pr',
   'smoke',
   'engineering-runtime',
@@ -66,23 +64,7 @@ export const WORKFLOW_TRUSTED_DEPENDENCY_CLOSURES = deepFreeze([
     ],
     generatedIdentities: [],
   },
-  {
-    invokedSkill: 'resolve-issues',
-    members: [
-      'tdd',
-      'harness-runtime',
-      'e2e-test',
-      'ensure-coverage',
-      'implement-and-pr',
-      'resolve-issues',
-      'review-pr',
-      'smoke',
-      'engineering-runtime',
-    ],
-    generatedIdentities: [
-      { member: 'resolve-issues', path: 'generated/workflow-repair-policy.json' },
-    ],
-  },
+
   {
     invokedSkill: 'rush-release',
     members: [
@@ -91,22 +73,7 @@ export const WORKFLOW_TRUSTED_DEPENDENCY_CLOSURES = deepFreeze([
     ],
     generatedIdentities: [],
   },
-  {
-    invokedSkill: 'resolve-release',
-    members: [
-      'harness-runtime',
-      'e2e-test',
-      'ensure-coverage',
-      'resolve-issues',
-      'resolve-release',
-      'review-pr',
-      'smoke',
-      'engineering-runtime',
-    ],
-    generatedIdentities: [
-      { member: 'resolve-issues', path: 'generated/workflow-repair-policy.json' },
-    ],
-  },
+
 ]);
 
 // First-party content is distributed as an exact public npm release, so its identity is the package
@@ -119,7 +86,7 @@ export const WORKFLOW_TRUSTED_SOURCES = deepFreeze({
     id: 'first-party',
     type: 'first-party',
     package: '@1aboveio/skills',
-    version: '0.19.3',
+    version: '0.20.2',
   },
   matt: {
     id: 'matt-pocock',

package/skills/cicd-pipeline/cloud-build/SKILL.md

@@ -361,7 +361,7 @@ gcloud builds triggers create github --name="{service}-prod" \
 
 So under GitHub Flow the SHA-keyed staging verdict is a **pre-filter, not the release gate**. The gate is the prod candidate at 0% traffic, which validates the *exact shipped SHA* on real infrastructure before any user reaches it. That is sound precisely because of the 0%-candidate design — under a deploy-then-smoke pipeline the same topology would ship unvalidated commits straight to users.
 
-**Order is forced: merge first, then tag.** `version.mjs tag` refuses a SHA that is not an ancestor of the production branch, so the release branch cannot be rc-tagged before it lands on `main`. Merge the release PR, then mint the rc on the merge commit. Release-lane sequencing: `resolve-release` step 1.
+**Order is forced: merge first, then tag.** The release tag must name a SHA on the production branch, so the release branch cannot be rc-tagged before it lands on `main`. Merge the release PR, then mint the rc on the merge commit. `rush-release` owns this sequencing.
 
 ## Build Notifications
 
@@ -377,8 +377,8 @@ A "deploy SUCCESS" only proves the revision is `Ready` — not that the real bui
 
 **Where it blocks depends on who the environment serves.** The blocking placement protects *users*, so it belongs on the **production** path. An integration environment (`dev`) has no users to protect — there, a blocking smoke only converts small bugs and infra flakes into failed builds and full rebuild cycles. So the same seam cuts differently per fork, and each fork's contract output is different:
 
-- **`dev` output: a SHA-keyed verdict.** Deploy at 100%, smoke as a non-blocking recorder, publish the verdict as a commit status. Nothing is gated here; the verdict blocks later, at the dev→main promotion, where the release lane pins its candidate to a validated SHA (`resolve-release` principle 11).
-- **prod output: a 0%-traffic candidate revision.** Deploy with `--no-traffic`, surface the revision name and candidate URL, and **stop**. The build does not smoke it and does not shift traffic — `resolve-release` does both.
+- **`dev` output: a SHA-keyed verdict.** Deploy at 100%, smoke as a non-blocking recorder, and publish the verdict as a commit status. When configured as required CI, it helps `rush-release` select the newest green trunk SHA; the production candidate smoke remains the definitive release gate.
+- **prod output: a 0%-traffic candidate revision.** Deploy with `--no-traffic`, surface the revision name and candidate URL, and **stop**. The build does not smoke it and does not shift traffic — `rush-release` does both.
 
 **Why the prod gate moved out of the build.** The gate did not disappear; it moved to where it can be operated:
 
@@ -397,7 +397,7 @@ The prod fork's entire contract is three facts:
 ```
 tag v*-rc.* → build → deploy --no-traffic --tag candidate → publish {revision, url} → END
                                                                     │
-        resolve-release: smoke --profile prod-preview (read-only) ──┤
+          rush-release: smoke --profile prod-preview (read-only) ──┤
                                         ALIVE → update-traffic 100%, tag v<version>
                                         DEAD  → delete the 0% revision (traffic never moved)
 ```
@@ -468,7 +468,7 @@ Because traffic never moved, a DEAD verdict is not a rollback and has no user im
         cat /workspace/candidate.json
 ```
 
-**The `candidate` tag moves; the revision name does not.** Each prod build re-points `--tag=candidate` at its own new revision, so the tag URL always means "the newest candidate," not "the candidate I built." That is why the published JSON carries the **revision name** and why the release lane deletes a failed candidate **by name** — and it is a second reason `resolve-release` principle 7 serializes releases: two candidates in flight would leave the earlier one addressable only by revision, its URL silently repointed at the later build.
+**The `candidate` tag moves; the revision name does not.** Each prod build re-points `--tag=candidate` at its own new revision, so the tag URL always means "the newest candidate," not "the candidate I built." That is why the published JSON carries the **revision name** and why the release lane deletes a failed candidate **by name**. `rush-release` therefore refuses a second release in flight: its moving URL would silently point the earlier release at the later build.
 
 **Surface the coordinates as a GCS object keyed by the RC tag, not as log output.** The release lane already knows the tag it pushed, so it can fetch `candidates/{service}-<rc-tag>.json` without knowing the build ID — no build lookup, no log scraping, and the object outlives log retention. The `cat` at the end is a convenience for humans reading the build, not the interface. Derive the URL from `gcloud run services describe` rather than from `gcloud run deploy` output: the tag URL lives in `status.traffic[]`, and describing the service after the deploy also proves the tag actually landed (the guard above fails the build if it did not).
 
@@ -535,7 +535,7 @@ availableSecrets:
 ```
 
 - After traffic shifts, **confirm the serving revision is running this commit's image**, then run smoke against the live service URL. Capture the exit code instead of letting it fail the step. Compare **images, not revision names** — Cloud Run names revisions from its own counter, so a name-based check silently never matches and degrades to no check at all. On a mismatch, publish `failure` and **run no smoke**: traffic is on older code, so any verdict it produced would be a green light keyed to a SHA that never served.
-- **Publish the verdict as a commit status on the SHA** (context `dev-smoke`, state `success`/`failure`, description naming the broken path on DEAD). This is the artifact the release lane reads: `resolve-release` pins its release candidate to a SHA with green CI **and** `dev-smoke` ALIVE. The image for a SHA is immutable, so the recorded verdict stays valid after `dev` moves on — no re-run at release time.
+- **Publish the verdict as a commit status on the SHA** (context `dev-smoke`, state `success`/`failure`, description naming the broken path on DEAD). When branch protection requires that status, it is part of the green CI set from which `rush-release` selects its trunk SHA. The image for a SHA is immutable, so the recorded verdict stays useful after `dev` moves on; production still gets its own `prod-preview` gate.
 - The step then **exits 0 regardless of verdict**: a DEAD verdict marks the SHA unpromotable; it must not block the next dev iteration.
 - **Non-blocking must not mean silent.** On DEAD, still notify (a Pub/Sub message from the step, or a webhook on the `dev-smoke` status change) so a broken dev is known in minutes, not discovered at release time.
 

package/skills/cicd-pipeline/mergify/SKILL.md

@@ -128,7 +128,7 @@ conflict, never hold the batch window open. Mechanics and the grouping rule
 
 - [cloud-build](../cloud-build/SKILL.md) — the CI the queue gates on
 - [cloud-debug](../cloud-debug/SKILL.md) — when the CI job itself is failing
-- [resolve-issues](../../engineering/resolve-issues/SKILL.md) — consumes this skill's delivery
+- [rush-issues](../../engineering/rush-issues/SKILL.md) — consumes this skill's delivery
   watch contract when it delivers merge-ready PRs through Mergify
 - `mergify-config`, `mergify-merge-queue`, `mergify-merge-protections`, `mergify-ci`,
   `mergify-stack` (vendor plugin skills) — reference for raw CLI invocation. They document

package/skills/engineering/engineering-runtime/coherence/workflow.json

@@ -6,9 +6,7 @@
     "ensure-coverage",
     "implement-and-pr",
     "rush-issues",
-    "resolve-issues",
     "rush-release",
-    "resolve-release",
     "review-pr",
     "smoke",
     "engineering-runtime"
@@ -58,26 +56,6 @@
       ],
       "generatedIdentities": []
     },
-    {
-      "invokedSkill": "resolve-issues",
-      "members": [
-        "tdd",
-        "harness-runtime",
-        "e2e-test",
-        "ensure-coverage",
-        "implement-and-pr",
-        "resolve-issues",
-        "review-pr",
-        "smoke",
-        "engineering-runtime"
-      ],
-      "generatedIdentities": [
-        {
-          "member": "resolve-issues",
-          "path": "generated/workflow-repair-policy.json"
-        }
-      ]
-    },
     {
       "invokedSkill": "rush-release",
       "members": [
@@ -85,25 +63,6 @@
         "engineering-runtime"
       ],
       "generatedIdentities": []
-    },
-    {
-      "invokedSkill": "resolve-release",
-      "members": [
-        "harness-runtime",
-        "e2e-test",
-        "ensure-coverage",
-        "resolve-issues",
-        "resolve-release",
-        "review-pr",
-        "smoke",
-        "engineering-runtime"
-      ],
-      "generatedIdentities": [
-        {
-          "member": "resolve-issues",
-          "path": "generated/workflow-repair-policy.json"
-        }
-      ]
     }
   ],
   "digestAlgorithm": "sha256-path-content-v2",
@@ -383,7 +342,7 @@
         "id": "first-party",
         "type": "first-party",
         "package": "@1aboveio/skills",
-        "version": "0.19.3"
+        "version": "0.20.2"
       },
       "contentDigest": "eff6c7b5931bce5b2265a619bccddd371a89df6ce7bc2edc74f11d00060a71dd",
       "digestExcludes": []
@@ -396,7 +355,7 @@
         "id": "first-party",
         "type": "first-party",
         "package": "@1aboveio/skills",
-        "version": "0.19.3"
+        "version": "0.20.2"
       },
       "contentDigest": "d97abeff7bdc5ae2e4be2f631d09dba46d4753ce1e67334793364329af59f066",
       "digestExcludes": []
@@ -409,7 +368,7 @@
         "id": "first-party",
         "type": "first-party",
         "package": "@1aboveio/skills",
-        "version": "0.19.3"
+        "version": "0.20.2"
       },
       "contentDigest": "00cfdd3e5bfbc3e37b1369ad93aae91161e671829760a8867ea9be25047ba461",
       "digestExcludes": []
@@ -422,7 +381,7 @@
         "id": "first-party",
         "type": "first-party",
         "package": "@1aboveio/skills",
-        "version": "0.19.3"
+        "version": "0.20.2"
       },
       "contentDigest": "58b0556228a9271cf9e33727a05fc08a4fdfd29512ec0936b169f0a55d60e6ef",
       "digestExcludes": []
@@ -435,24 +394,11 @@
         "id": "first-party",
         "type": "first-party",
         "package": "@1aboveio/skills",
-        "version": "0.19.3"
+        "version": "0.20.2"
       },
       "contentDigest": "4664873230f22de2fcf46b7b529570cfedabdc850620031d8f96baf89fcdc5b4",
       "digestExcludes": []
     },
-    {
-      "installName": "resolve-issues",
-      "ownership": "owned",
-      "sourcePath": "skills/engineering/resolve-issues",
-      "expectedSource": {
-        "id": "first-party",
-        "type": "first-party",
-        "package": "@1aboveio/skills",
-        "version": "0.19.3"
-      },
-      "contentDigest": "3016f025b4acf3b7f61628ff3043ca55e680d0fabc7cf9fb4b4c46424d9b22ed",
-      "digestExcludes": []
-    },
     {
       "installName": "rush-release",
       "ownership": "owned",
@@ -461,22 +407,9 @@
         "id": "first-party",
         "type": "first-party",
         "package": "@1aboveio/skills",
-        "version": "0.19.3"
-      },
-      "contentDigest": "01c192d8b4fd416af4ea02e8000e5fce0cee723a6ac2f8c0c48372087e1a262e",
-      "digestExcludes": []
-    },
-    {
-      "installName": "resolve-release",
-      "ownership": "owned",
-      "sourcePath": "skills/engineering/resolve-release",
-      "expectedSource": {
-        "id": "first-party",
-        "type": "first-party",
-        "package": "@1aboveio/skills",
-        "version": "0.19.3"
+        "version": "0.20.2"
       },
-      "contentDigest": "ffba0c83491676794c74721f4c6dbae430f5bc186e5a55f0764e29eaeb13829b",
+      "contentDigest": "cd9f398f6d8d1df7c2d944d3bec014e788535638014f327783f074757bfb4f49",
       "digestExcludes": []
     },
     {
@@ -487,7 +420,7 @@
         "id": "first-party",
         "type": "first-party",
         "package": "@1aboveio/skills",
-        "version": "0.19.3"
+        "version": "0.20.2"
       },
       "contentDigest": "f048fd00c69f2dc666fc7a3096cfeee6dfba73933bfb69602f3f0e26159798cc",
       "digestExcludes": []
@@ -500,9 +433,9 @@
         "id": "first-party",
         "type": "first-party",
         "package": "@1aboveio/skills",
-        "version": "0.19.3"
+        "version": "0.20.2"
       },
-      "contentDigest": "90a7c4e1ad6da1e632ea2c5259e4967ffebb84353adccbca8dfc5d6bc50b60c1",
+      "contentDigest": "d533684db4483cfc90be2aa7161980b6548057ef18a4b54f0cdbcd53c79dd46d",
       "digestExcludes": []
     },
     {
@@ -513,15 +446,15 @@
         "id": "first-party",
         "type": "first-party",
         "package": "@1aboveio/skills",
-        "version": "0.19.3"
+        "version": "0.20.2"
       },
-      "contentDigest": "6ef7cf062d899835774d3010dbba511587b0d60835447417d4b74a5afe25b184",
+      "contentDigest": "f7f56f7e33b2b12c3043df0f4729447dfccd181daa79936ff62da38df91d5175",
       "digestExcludes": [
         "coherence/workflow.json"
       ]
     }
   ],
-  "releaseIdentity": "63593db8810d932c5774b375f3403578b821c9df6ca6e8a866f12f2b8fc4fd47",
+  "releaseIdentity": "455424f618fddc62d553f7c89282887d6b449b278eb0335b72bf415f760f1b34",
   "lifecycleAuthority": "native-skills-cli",
   "repairRecipe": {
     "id": "engineering-workflow-dependency-first",
@@ -579,7 +512,7 @@
         "sourceId": "first-party",
         "sourceType": "first-party",
         "package": "@1aboveio/skills",
-        "version": "0.19.3",
+        "version": "0.20.2",
         "installPath": null,
         "members": [
           "harness-runtime",
@@ -587,9 +520,7 @@
           "ensure-coverage",
           "implement-and-pr",
           "rush-issues",
-          "resolve-issues",
           "rush-release",
-          "resolve-release",
           "review-pr",
           "smoke",
           "engineering-runtime"
@@ -597,7 +528,7 @@
         "commands": [
           {
             "transport": "npm",
-            "command": "npx @1aboveio/skills@0.19.3 install --group engineering-workflow --yes"
+            "command": "npx @1aboveio/skills@0.20.2 install --group engineering-workflow --yes"
           }
         ],
         "onFailure": {

package/skills/engineering/engineering-runtime/scripts/workflow-coherence.mjs

@@ -288,7 +288,7 @@ function validateManifest(manifest) {
     add('digest-algorithm-invalid', 'engineering-runtime', 'The coherence digest algorithm is missing or unsupported.');
   }
   if (JSON.stringify(manifest.ownedMembers) !== JSON.stringify(WORKFLOW_OWNED_MEMBERS)) {
-    add('owned-census-invalid', 'engineering-runtime', 'The exact ten-member Workflow ownership census is missing or malformed.');
+    add('owned-census-invalid', 'engineering-runtime', 'The exact eight-member Workflow ownership census is missing or malformed.');
   }
   if (JSON.stringify(manifest.dependencies) !== JSON.stringify([
     { groupId: 'matt-pocock-toolkit', members: MATT_DEPENDENCY_MEMBERS },
@@ -297,11 +297,9 @@ function validateManifest(manifest) {
     add('dependency-census-invalid', 'engineering-runtime', 'The exact Matt and harness runtime dependency census is missing or malformed.');
   }
   if (!exactContract(manifest.dependencyClosures, WORKFLOW_TRUSTED_DEPENDENCY_CLOSURES)) {
-    const names = new Set(Array.isArray(manifest.dependencyClosures)
-      ? manifest.dependencyClosures.map((closure) => closure?.invokedSkill)
-      : []);
-    const member = WORKFLOW_TRUSTED_DEPENDENCY_CLOSURES.find((closure) => !names.has(closure.invokedSkill))?.invokedSkill
-      ?? 'resolve-issues';
+    const actual = Array.isArray(manifest.dependencyClosures) ? manifest.dependencyClosures : [];
+    const member = WORKFLOW_TRUSTED_DEPENDENCY_CLOSURES.find((closure, index) =>
+      !isDeepStrictEqual(actual[index], closure))?.invokedSkill ?? 'engineering-runtime';
     add('dependency-closure-invalid', member, 'The invoked-skill dependency closure is missing, weakened, reordered or malformed.');
   }
 

package/skills/engineering/engineering-runtime/scripts/workflow-policy.mjs

@@ -11,9 +11,7 @@ export const WORKFLOW_OWNED_MEMBERS = deepFreeze([
   'ensure-coverage',
   'implement-and-pr',
   'rush-issues',
-  'resolve-issues',
   'rush-release',
-  'resolve-release',
   'review-pr',
   'smoke',
   'engineering-runtime',
@@ -66,23 +64,7 @@ export const WORKFLOW_TRUSTED_DEPENDENCY_CLOSURES = deepFreeze([
     ],
     generatedIdentities: [],
   },
-  {
-    invokedSkill: 'resolve-issues',
-    members: [
-      'tdd',
-      'harness-runtime',
-      'e2e-test',
-      'ensure-coverage',
-      'implement-and-pr',
-      'resolve-issues',
-      'review-pr',
-      'smoke',
-      'engineering-runtime',
-    ],
-    generatedIdentities: [
-      { member: 'resolve-issues', path: 'generated/workflow-repair-policy.json' },
-    ],
-  },
+
   {
     invokedSkill: 'rush-release',
     members: [
@@ -91,22 +73,7 @@ export const WORKFLOW_TRUSTED_DEPENDENCY_CLOSURES = deepFreeze([
     ],
     generatedIdentities: [],
   },
-  {
-    invokedSkill: 'resolve-release',
-    members: [
-      'harness-runtime',
-      'e2e-test',
-      'ensure-coverage',
-      'resolve-issues',
-      'resolve-release',
-      'review-pr',
-      'smoke',
-      'engineering-runtime',
-    ],
-    generatedIdentities: [
-      { member: 'resolve-issues', path: 'generated/workflow-repair-policy.json' },
-    ],
-  },
+
 ]);
 
 // First-party content is distributed as an exact public npm release, so its identity is the package
@@ -119,7 +86,7 @@ export const WORKFLOW_TRUSTED_SOURCES = deepFreeze({
     id: 'first-party',
     type: 'first-party',
     package: '@1aboveio/skills',
-    version: '0.19.3',
+    version: '0.20.2',
   },
   matt: {
     id: 'matt-pocock',

package/skills/engineering/rush-release/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: rush-release
-description: "Slash/explicit-only (/rush-release). Cut a GitHub Flow release from main: freeze the latest CI-green trunk SHA, write the changelog, choose SemVer, merge the metadata cut through a verified PR, tag the exact merged main SHA, and watch Cloud Build or npm publish. Do not auto-select. Use only on explicit user/orchestrator invoke. NOT for GitFlow/release-branch/0%-traffic promotion (resolve-release) and NOT for implementing a spec (rush-issues)."
+description: "Slash/explicit-only (/rush-release). Cut a GitHub Flow release from main: freeze the latest CI-green trunk SHA, write the changelog, choose SemVer, merge the metadata cut through a verified PR, publish npm artifacts, or validate a Cloud Run candidate at 0% before shifting it to 100%. One complete-plan confirmation covers the conditional release. Do not auto-select. Use only on explicit user/orchestrator invoke. NOT for GitFlow/release-branch promotion and NOT for implementing a spec (rush-issues)."
 disable-model-invocation: true
 ---
 
@@ -10,9 +10,10 @@ Cut a **GitHub Flow** release from **main**. Freeze one already-green trunk
 SHA, write a metadata-only version cut on that parent, merge it through a
 verified PR, tag the exact merged SHA on `main`, and watch the publisher.
 
-The orchestrator sequences local programs and one confirmation. It does not
-assemble a release branch, shift traffic, or verify production like
-`resolve-release`.
+The orchestrator sequences local programs and exactly one user confirmation per
+release plan. It does not assemble a long-lived release branch. For Cloud Run,
+it owns one bounded candidate-at-0% -> validate -> shift-to-100% -> verify-live
+sequence; the confirmation conditionally authorizes that whole sequence.
 
 ```text
 preflight (main + publisher)
@@ -21,8 +22,9 @@ preflight (main + publisher)
   -> confirm
   -> bump version files + commit the cut
   -> merge metadata PR + verify merged main SHA
-  -> annotated tag on the merged SHA
-  -> push tag -> watch Cloud Build or npm
+  -> npm: final tag -> watch publish
+  -> Cloud Run: rc tag -> candidate at 0% -> validate -> shift to 100%
+     -> verify live -> final tag
 ```
 
 This file is the workflow and index. Read the linked procedure immediately
@@ -33,7 +35,8 @@ before its stage; do not invent an unlinked substitute.
 | Trunk, publisher, version files | [references/preflight.md](references/preflight.md) |
 | Latest CI-green HEAD | [references/candidate.md](references/candidate.md) |
 | Changelog, SemVer, file bump, commit | [references/cut.md](references/cut.md) |
-| Tag, push, watch deploy | [references/publish.md](references/publish.md) |
+| Tag, push, watch publisher | [references/publish.md](references/publish.md) |
+| Cloud Run 0% -> 100%, verification, rollback | [references/promotion.md](references/promotion.md) |
 
 Run every script as
 `node <skillsRoot>/rush-release/scripts/<name>.mjs …` with the absolute skill
@@ -54,8 +57,22 @@ target repo and will not find these files.
   release tree's CI evidence.
 - Tags are immutable annotated `vMAJOR.MINOR.PATCH` names. Do not move, delete,
   or force-push a tag that reached a remote.
-- Show the plan and wait for confirmation before any git mutation or push.
-- A failed watch is a hand-back. This lane does not roll back production.
+- A Cloud Run release uses one immutable `vMAJOR.MINOR.PATCH-rc.N` tag to build
+  the candidate at 0%. The final tag is created only after that exact candidate
+  serves 100% and passes live verification; it must not trigger another deploy.
+- Ask once, on the complete plan, before any git mutation or push. That answer
+  authorizes the listed branch/commit, metadata PR delivery, candidate build,
+  conditional traffic shift, rollback, final tag, optional GitHub Release, and
+  publisher watch as one operation. Do not ask separate cut, merge, RC,
+  exposure, tag, finalization, or publish questions.
+- Preflight facts are detected, not confirmed by the user. Fold any genuinely
+  missing choice into the one plan question instead of asking a preliminary
+  question. If the plan's frozen SHA, version/tag, metadata diff, publisher, or
+  outward actions later change, stop and present one replacement plan; otherwise
+  continue without re-confirming.
+- A pre-exposure failure is a hand-back with production untouched. A known
+  post-exposure failure automatically restores and verifies the recorded
+  incumbent. Ambiguous production state is a stop for operator recovery.
 - The cut is metadata only (changelog + version identity files). Refuse a
   cut that changes product code.
 
@@ -63,8 +80,8 @@ target repo and will not find these files.
 
 ### 1. Preflight
 
-Confirm `main` is the trunk, detect whether the tag should fire Cloud Build,
-npm, or both, and list the files that carry the version. Details:
+Verify `main` is the trunk, detect npm and/or the staged Cloud Run contract,
+and list the files that carry the version. Details:
 [preflight.md](references/preflight.md).
 
 ### 2. Candidate
@@ -72,28 +89,32 @@ npm, or both, and list the files that carry the version. Details:
 Fetch `origin/main` and pick the newest green SHA. Freeze it. Details:
 [candidate.md](references/candidate.md).
 
-### 3. Plan and confirm
+### 3. Plan and confirm once
 
-Derive the changelog and SemVer bump from `baselineTag..frozenSHA`. Show SHA,
-bump, version, tag, files, publisher, and notes. Do not mutate until the human
-confirms. Details: [cut.md](references/cut.md).
+Derive the changelog and SemVer bump from `baselineTag..frozenSHA`. For Cloud
+Run, pass `--cloud-run` so the plan also reserves the next unused RC tag. Show
+SHA, bump, version, tags, files, publisher, notes, and every outward action. Ask one
+question that both settles any unresolved choice and authorizes the whole listed
+sequence. Do not mutate until the human confirms, and do not ask again while the
+approved plan remains unchanged. Details: [cut.md](references/cut.md).
 
 ### 4. Cut
 
 Branch from the frozen SHA, apply the changelog and version files, commit.
 Keep the diff metadata-only.
 
-### 5. Merge, tag, and watch
+### 5. Merge and publish
 
-Push the cut ref, merge its PR through the repository queue, verify the exact
-merged SHA on `main`, create the annotated tag on that SHA, push
-`refs/tags/<tag>` with hook-safe `--no-verify`, then watch Cloud Build and/or
-npm. Details: [publish.md](references/publish.md).
+Push the cut ref, merge its PR through the repository queue, and verify the
+exact merged SHA on `main`. An artifact-only release pushes the final tag and
+watches npm. A staged Cloud Run release pushes its RC tag, executes
+[promotion.md](references/promotion.md), and creates the final tag only after
+live verification. Details: [publish.md](references/publish.md).
 
 ## Done
 
-Success is the confirmed version tagged at the verified merged `main` SHA, the tag visible on the
-remote, and the chosen publisher reporting that version (Cloud Build SUCCESS
-and/or `npm view <pkg>@<version>`). Hand back the cut SHA, merged SHA, tag,
-changelog excerpt, publisher evidence, and the merged metadata PR. A publisher failure hands back the same identities without claiming
-the version shipped to users.
+Success is the confirmed version tagged at the verified merged `main` SHA and
+visible on the remote. npm must report the version when selected. Cloud Run
+must report the exact candidate serving 100%, the incumbent at 0%, and an ALIVE
+`prod-active` verdict. Hand back the cut SHA, merged SHA, RC/final tags,
+changelog excerpt, publisher and traffic evidence, and the merged metadata PR.

package/skills/engineering/rush-release/evals/evals.json

@@ -11,20 +11,21 @@
         "Proposes a minor SemVer bump to 1.5.0 because of feat: export csv.",
         "Includes changelog entries derived from both the feat and the fix.",
         "Tags only the queue-verified merged main SHA whose tree exactly equals the version-cut tree.",
-        "Watches npm publish (npm view) and does not describe a 0% traffic candidate or GitFlow release branch."
+        "Watches npm publish (npm view) and does not describe a 0% traffic candidate or GitFlow release branch.",
+        "Presents one complete-plan confirmation covering cut, PR delivery, tag push, and publisher watch, with no staged confirmations."
       ]
     },
     {
       "id": 2,
-      "prompt": "Dry-run only. Main is protected. Latest green HEAD is 2222222. Plan says v2.0.0 from a breaking change. The metadata PR merges through the queue as 3333333 and its tree exactly equals the approved cut. After you would push tag v2.0.0, Cloud Build returns FAILURE. What do you tag, how do you push it, and what happens after the failed watch? Assume cloudbuild.yaml is present.",
-      "expected_output": "A dry-run that verifies 3333333 is on main and tree-identical to the cut, tags merged SHA 3333333 with annotated v2.0.0, pushes refs/tags/v2.0.0 with --no-verify, watches gcloud builds list, and on FAILURE leaves the tag in place, treats the version as burned, and hands back without deleting the tag or rolling back production.",
+      "prompt": "Dry-run only. Main is protected. Latest green HEAD is 2222222. Plan says v2.0.0 from a breaking change. The metadata PR merges through the queue as 3333333 and its tree exactly equals the approved cut. The repository has a verified Cloud Run staged contract: RC tags deploy immutable candidates with --no-traffic and final tags do not deploy. After you would push v2.0.0-rc.1, Cloud Build returns FAILURE. What do you tag, how do you push it, and what happens after the failed watch?",
+      "expected_output": "A dry-run that verifies 3333333 is on main and tree-identical to the cut, tags merged SHA 3333333 with annotated v2.0.0-rc.1, pushes that fully qualified ref with --no-verify, watches Cloud Build for the RC tag and exact SHA, then on FAILURE leaves the RC tag immutable, keeps v2.0.0 unused, and hands back with production untouched.",
       "files": [],
       "expectations": [
-        "Creates an annotated v2.0.0 tag on the verified merged main SHA 3333333.",
-        "Pushes the fully-qualified tag ref with --no-verify.",
-        "Watches Cloud Build filtered by that tag.",
-        "On FAILURE, does not move or delete the tag and does not roll back production.",
-        "States the next attempt takes a new patch from a new green HEAD."
+        "Creates an annotated v2.0.0-rc.1 tag on the verified merged main SHA 3333333.",
+        "Pushes the fully-qualified RC tag ref with --no-verify.",
+        "Watches Cloud Build filtered by the RC tag and exact merged SHA.",
+        "On FAILURE, leaves the RC tag immutable and production untouched.",
+        "Does not create the final v2.0.0 tag or claim the final version is burned."
       ]
     },
     {
@@ -39,6 +40,19 @@
         "Restarts the changelog and SemVer plan from a new eligible main state before watching Cloud Build and npm.",
         "Does not squash-merge the metadata PR onto moved main."
       ]
+    },
+    {
+      "id": 4,
+      "prompt": "Dry-run only. One complete Cloud Run release plan was already confirmed. Candidate v1.8.0-rc.1 for merged SHA aaaaaaa is at 0%, incumbent revision old-42 is at 100%, and prod-preview is fresh, read-only, and ALIVE. Describe the rest of the release if the shift reaches candidate revision new-43 at 100% but prod-active is DEAD. Do not ask another question.",
+      "expected_output": "A dry-run that rechecks candidate identity and the 0/100 split, shifts under the existing authorization, observes the failed live smoke, automatically restores old-42 to 100%, verifies the restored incumbent with prod-active, leaves v1.8.0 final unused and the RC tag immutable, and hands back without another confirmation.",
+      "files": [],
+      "expectations": [
+        "Does not request a second exposure, rollback, or finalization confirmation.",
+        "Rechecks fresh ALIVE evidence, candidate identity, and candidate 0% / incumbent 100% immediately before shifting.",
+        "Treats prod-active DEAD after the shift as a post-exposure failure.",
+        "Automatically restores old-42 and verifies it at 100% with a prod-active ALIVE result.",
+        "Leaves the final v1.8.0 tag unused and v1.8.0-rc.1 immutable."
+      ]
     }
   ]
 }