@afokapu/atdd-bun 0.10.65 → 0.10.67

package/README.md

@@ -155,7 +155,7 @@ bun run atdd-bun coder tester --ratchet --base <40-character-reviewed-main-sha>
 
 The command runs the same installed detectors against an isolated exact base and the clean candidate, emits a redacted JSON `carried`/`new`/`resolved` fingerprint report, and never writes or accepts a baseline. `report` records debt without changing command success; `reject-new` exits non-zero only when the candidate adds a finding absent from the equivalent base. The declared `ratchet.profiles` must exactly match the command's effective profiles. Base and candidate profile/context digests must match or comparison fails closed; profile/config adoption is separately governed. Use debt-remediation branches to remove carried findings. Direct implementation profiles can opt in only through this explicit policy and do not alter configured merge profiles or `profiles:`.
 
-Fingerprints are SHA-256 of a versioned rule, normalized repository-relative path, and semantic subject where supplied; line/column, rendered evidence, source text, absolute paths, and runtime data are excluded. Ratchet findings are unrelated to Bun `test.failing()` or JUnit/behavioral-test baselines.
+Fingerprints are SHA-256 of a versioned rule, normalized repository-relative path, and semantic subject where supplied; line/column, rendered evidence, source text, absolute paths, and runtime data are excluded. Ratchet findings are unrelated to Bun `test.failing()` or JUnit/behavioral-test baselines. Generated Provider CI uses this exact command when the generated policy is `reject-new`, against the pull request base object, pre-push tip, or merge-queue target, with full-history checkout; it rejects an absent, zero, invalid, unavailable, or non-ancestor base. Without that policy, generated CI retains strict `all` enforcement.
 
 ### One-time explicit profile activation
 
@@ -165,7 +165,7 @@ When an existing exact main has debt under a smaller explicit profile list, a se
 bun run atdd-bun --profile flow,traceability --ratchet --ratchet-activate-profiles --base <40-character-reviewed-main-sha>
 ```
 
-This is an activation-only exception to the ordinary equal-context rule, not a baseline migration. It requires an explicit candidate `profiles:` list, an explicit base list that is a strict subset of it, and identical non-profile policy/configuration. A removal, implicit/default-list adoption, unrelated configuration change, dirty tree, unavailable/non-ancestor base, or omission of `--ratchet-activate-profiles` fails closed. The command stores no activation state or accepted findings; after the governed expansion lands, use ordinary `--ratchet` with exact matching context. Strict non-ratchet enforcement remains unchanged.
+This is an activation-only exception to the ordinary equal-context rule, not a baseline migration. It requires an explicit candidate `profiles:` list, a base whose effective profile set (its explicit list, or the implicit default set when it has none) is a strict subset of it, and identical non-profile policy/configuration. An unchanged matching configuration may also carry the flag and follows the ordinary exact-context comparison, letting generated CI use one command for active and expanded policies. A removal, implicit/default-list candidate adoption, unrelated configuration change, dirty tree, unavailable/non-ancestor base, or omission of `--ratchet-activate-profiles` for an expansion fails closed. The command stores no activation state or accepted findings; after the governed expansion lands, use ordinary `--ratchet` with exact matching context. Strict non-ratchet enforcement remains unchanged.
 
 ### Generated exact-base commit gate
 

package/integrity.json

@@ -1,9 +1,9 @@
 {
-  "version": "0.10.65",
+  "version": "0.10.67",
   "files": {
     "HOOK_AUDIT.md": "5329d840db37671b1918f688ead26865473b87db73dbc75f7c8b2a8bbe8d6d43",
     "PLANNER_PORT.md": "fb5935bac8b7ac18994de21e43ace3a5ef8cd55f85b0e3349fca261280054f11",
-    "README.md": "207414ffc3947dcdc5fc778df63f3e870a5b6cca283e68751e439eed2c03fb0a",
+    "README.md": "8f0e45595fc10bb6f033b81b67246e57bb3f5bbaf62b35ba950beb5f9f82a938",
     "bunfig.toml": "b9fc65eca9014c5179380259d70e76385a6a80788fa9a2df5fb3eaa5554fd2fe",
     "conventions/_profiles/architecture.yaml": "f1808768b720a4e476047e4a0912002ca673946562cea9aeef5d0c214828d93a",
     "conventions/_profiles/coder.yaml": "3fb191556a64c9ebcf249516afa189afca24da9b22fd40b2fc66908196cdfb78",
@@ -1257,8 +1257,8 @@
     "planner-schemas/wmbt.schema.json": "7a3a5693bfcf01340667c2be4a3c48e74f34b1af7e8dc13372c0de06b7f4fe12",
     "relationships.yaml": "5860a308ebc3ee7fa8172fc2c6633984000ab3003f0ae4b6fa28db48879eda22",
     "src/agent.ts": "6d6c6e75908af8fbab13432f0001b0374bb25cf3dee46ba218dfd67e0090cb56",
-    "src/ci.ts": "646e72ff576d3921d85ecdd1d8c7821693832735be8949f5da254f3c345be032",
-    "src/cli.ts": "fc8a78b31d6630671bb2ebd51363741cb4cf786801a95b8da8c879144683a049",
+    "src/ci.ts": "c4bc0a92e30da3db384e5bc968c45dae7b9de567dcee0e6493eb45cbd8f85652",
+    "src/cli.ts": "995e41b3cb44c04f65f4d599f0fc51b93b17b7558b7c7dcfabed64de3d455250",
     "src/docs-capability.ts": "bdeeb414649049b1cd4fa8008cada3a576318be51c43bec91bfa46a8e250c270",
     "src/enforce.ts": "7e6b3a1fc7c90f8e1836ab3e4655778fb569a63be5e7c199de44024fc003e6be",
     "src/hooks.ts": "6b579c030bb4772f08806e802f4f814444b1878bbac0d6c62bc10b4ee184e449",
@@ -1279,6 +1279,6 @@
     "templates/agents/atdd-bun.integrity.test.ts": "dec6f6e5f65a08d9512fc703b367c163f8c9da1f6aa7fd466835c1ec30348a41",
     "templates/docs/site.css": "482b3427e3a3cb02a85dc85cfbeac80592dfd53abf42fc92d6ea7071f22afc95",
     "templates/github/atdd-bun-release.yml": "d9547e9e6ef3ae010d53d55314f6a54567f88bd900f7e50d994cd308601d2684",
-    "templates/github/atdd-bun.yml": "c267f47505eb7df2b73b279185f46912aac0f17dcd2c5a1c6c8e1a5834bdcb30"
+    "templates/github/atdd-bun.yml": "e67121bc42481906ceb298dd87c9ec70bce55dd59b31a79c1010e53053eec272"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@afokapu/atdd-bun",
-  "version": "0.10.65",
+  "version": "0.10.67",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/afokapu/atdd-bun.git"

package/src/ci.ts

@@ -10,7 +10,13 @@ const version = (await Bun.file(join(root, "package.json")).json() as { version:
  * whose base branch is not main or master is covered too. The integrity check compares against this same rendering.
  * Each branch is written as a JSON string, a YAML scalar a branch name can never break out of. */
 export async function renderWorkflow(repo = process.cwd()) {
-  return (await readFile(template, "utf8")).replace("{{VERSION}}", version).replace("{{PROTECTED_BRANCHES}}", (await policy(repo)).protected_branches.map(branch => JSON.stringify(branch)).join(", "));
+  const configPath = join(repo, "atdd-bun.yaml");
+  let rejectNew = false;
+  if (existsSync(configPath)) try {
+    const config = Bun.YAML.parse(await readFile(configPath, "utf8"));
+    rejectNew = Boolean(config && typeof config === "object" && !Array.isArray(config) && (config as { ratchet?: { mode?: unknown } }).ratchet?.mode === "reject-new");
+  } catch { /* policy(repo) below gives its existing parse diagnostic */ }
+  return (await readFile(template, "utf8")).replace("{{VERSION}}", version).replace("{{PROTECTED_BRANCHES}}", (await policy(repo)).protected_branches.map(branch => JSON.stringify(branch)).join(", ")).replace("{{ENFORCEMENT}}", rejectNew ? 'bun run atdd-bun all --ratchet --base "$ATDD_BASE_REF" --ratchet-activate-profiles' : "bun run atdd-bun all");
 }
 const githubPackagesRegistry = /^\s*@[\w.-]+:registry\s*=\s*https:\/\/npm\.pkg\.github\.com\/?\s*$/im;
 const githubPackagesAuth = /^\s*\/\/npm\.pkg\.github\.com\/:_authToken\s*=\s*(.*?)\s*$/gim;

package/src/cli.ts

@@ -170,7 +170,7 @@ if (!args.includes("--ratchet")) {
       else {
         const baseConfig = await configAt(scratch), baseProfiles = profileActivation ? await enabledProfiles(scratch) : normalizedRequested.includes("all") ? await enabledProfiles(scratch) : normalizedRequested;
         const ordinaryContextMatches = stable(baseProfiles).join(",") === stable(candidateProfiles).join(",") && contextDigest(baseConfig, baseProfiles) === contextDigest(candidateConfig, candidateProfiles);
-        const activationIsValid = isStrictProfileExpansion(baseProfiles, candidateProfiles) && activationContextDigest(baseConfig) === activationContextDigest(candidateConfig);
+        const activationIsValid = ordinaryContextMatches || (isStrictProfileExpansion(baseProfiles, candidateProfiles) && activationContextDigest(baseConfig) === activationContextDigest(candidateConfig));
         if (!(profileActivation ? activationIsValid : ordinaryContextMatches)) { console.error(profileActivation ? "ratchet profile activation requires an explicit monotonic profile expansion and identical non-profile context" : "ratchet base and candidate profile/context differ; use a separately governed adoption path"); process.exitCode = 1; }
         else {
           const [baseFindings, candidateFindings] = await Promise.all([enforce({ root: scratch, profiles: candidateProfiles as Profile[] }), enforce({ root: candidateRoot, profiles: candidateProfiles as Profile[] })]);

package/templates/github/atdd-bun.yml

@@ -15,10 +15,9 @@ jobs:
     name: atdd-bun
     runs-on: ubuntu-latest
     env:
-      # The policy baseline for every step (the integrity step and the generated integrity test alike): on a push, the
-      # pre-push tip, so a multi-commit push is judged as a whole; in the merge queue, the queue's target (GitHub sets
-      # no GITHUB_BASE_REF there); on a pull request, GITHUB_BASE_REF.
-      ATDD_BASE_REF: ${{ github.event_name == 'push' && github.event.before || github.event_name == 'merge_group' && github.event.merge_group.base_sha || '' }}
+      # The immutable policy/ratchet base: the PR target object (not its mutable branch name), the pre-push tip, or the
+      # merge-queue target. Reject-new refuses absent, zero, unresolved, or non-ancestor bases.
+      ATDD_BASE_REF: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event_name == 'push' && github.event.before || github.event_name == 'merge_group' && github.event.merge_group.base_sha || '' }}
     steps:
       - uses: actions/checkout@v4
         with:
@@ -31,7 +30,7 @@ jobs:
         env:
           NODE_AUTH_TOKEN: ${{ github.token }}
       - run: bun run atdd-bun integrity
-      - run: bun run atdd-bun all
+      - run: {{ENFORCEMENT}}
       - run: bun test
       - run: bun run atdd-bun release check
       - uses: actions/upload-artifact@v4