@christang/keel 5.71.0 → 5.73.0

package/README.md

@@ -271,8 +271,11 @@ designed to — resist widening the policy until it stops happening.
 ### Who merges
 
 Keel never lets the agent merge — an unattended run opens a pull request and stops. A repository can
-still merge without a person, on a rule of its own: GitHub auto-merge behind a required status check.
-If yours does, say so:
+still merge without a person, on a rule of its own: GitHub auto-merge behind a required status check,
+or a workflow job that merges what passed. Keel's own repository does the second — the `land` job in
+`.github/workflows/publish.yml` merges the owner's pull request once `full-gate` passed on its head
+commit, then publishes and releases the version in the same run, with no stored secret. If your
+repository merges on its own, say so:
 
 ```yaml
 merge: repository:full-gate
@@ -284,8 +287,8 @@ because the only thing the protocol says about merging is that the agent may not
 
 `merge: human` says the opposite. A bare `repository` is refused — "nobody reviews this" is only honest
 beside what replaced the reviewer. It is not a permission: `authorize:` has no `merge` entry and should
-not gain one. Keel reads the declaration and never GitHub, so it cannot check that auto-merge is really
-on; it reports what you declared.
+not gain one. Keel reads the declaration and never GitHub, so it cannot check that your repository really
+merges that way; it reports what you declared.
 
 ### Full vs Lite
 

package/assets/bootstrap/AGENTS.md

@@ -1,4 +1,4 @@
-<!-- keel:start version=5.71.0 -->
+<!-- keel:start version=5.73.0 -->
 ## Keel Bootstrap
 
 - Start every session with `keel context`; OpenSpec artifacts and Git are the only durable authority — never native memory, goals, or transcripts.

package/package.json

@@ -2,7 +2,7 @@
   "name": "@christang/keel",
   "displayName": "Keel",
   "description": "Keel OpenSpec execution discipline CLI for Claude Code, Codex, and OpenCode.",
-  "version": "5.71.0",
+  "version": "5.73.0",
   "license": "MIT",
   "repository": {
     "type": "git",

package/plugins/keel/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "keel",
-  "version": "5.71.0",
+  "version": "5.73.0",
   "description": "Keel OpenSpec execution discipline: stateless continuity, task capsules, deterministic gates, and expectation alignment for Codex and Claude Code.",
   "author": {
     "name": "TanglmChris",

package/plugins/keel/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "keel",
-  "version": "5.71.0",
+  "version": "5.73.0",
   "description": "Keel OpenSpec execution discipline: stateless continuity, task capsules, deterministic gates, and expectation alignment for Codex and Claude Code.",
   "author": {
     "name": "TanglmChris",

package/scripts/validate_plugin.py

@@ -38,8 +38,8 @@ REQUIRED_SCRIPTS = [
     "scripts/validate_plugin.py",
 ]
 
-PACKAGE_VERSION = "5.71.0"
-PROTOCOL_VERSION = "5.71.0"
+PACKAGE_VERSION = "5.73.0"
+PROTOCOL_VERSION = "5.73.0"
 LEGACY_MANAGED_START = "<!-- keel:start version=2.1 -->"
 OPENSPEC_SCHEMA_NAME = "keel-spec-driven"
 # Mirrors KEEL_PACKAGE_NAME in scripts/install_to_repo.py, one of the two
@@ -5031,6 +5031,71 @@ def validate_section_boundary_scenario() -> int:
             report(repr(problems_of(unstarted["tail"])))
             return 1
 
+        # Cells 5 and 6: the heading half of the boundary, in the tail, where
+        # it is the only half that applies. An indented `##` line inside the
+        # section's own body is not a heading, and the entry after it must still
+        # be judged. The tolerant spelling `parseTasks()` uses for task bodies
+        # ends the section there and drops that entry without a word — issue
+        # #160, measured on the abandoned first attempt at #71 as `7bd6448`.
+        # Both readers are covered because each slices its own section.
+        indented = "  ## an indented line is not a heading\n"
+        indented_invalidates = (
+            "## Invalidates\n\n"
+            '- I1: "the wording that is now wrong" — README.md. Updated by: 1.1\n'
+            + indented
+            + '- I2: "wording nothing updates" — README.md.\n'
+        )
+        payload = start(
+            "invalidates-indented-tail",
+            section_boundary_tasks_md(
+                section=indented_invalidates, task=start_task, position="tail"
+            ),
+        )
+        if not readable(payload, "invalidates-indented-tail", "task-start"):
+            return 1
+        if not [
+            message
+            for message in closure_problems(payload, "invalidation-closure")
+            if "I2" in message
+        ]:
+            report(
+                f"{label} accepted an invalidation that closes nothing because "
+                "it follows an indented `##` line; the section ended at a line "
+                "that is not a heading."
+            )
+            report(repr(payload.get("problems")))
+            return 1
+
+        indented_coverage = (
+            "## Invalidates\n\n- None.\n\n"
+            "## Expectation Coverage\n\n"
+            "- E1: The task owns its file. Covered by: 1.1\n"
+            + indented
+            + "- E3: Nothing closes this one.\n"
+        )
+        payload = close(
+            "coverage-indented-tail",
+            section_boundary_tasks_md(
+                section=indented_coverage,
+                task=section_boundary_task("1.1", checked=True),
+                position="tail",
+            ),
+        )
+        if not readable(payload, "coverage-indented-tail", "change-close"):
+            return 1
+        if not [
+            message
+            for message in closure_problems(payload, "expectation-closure")
+            if "E3" in message
+        ]:
+            report(
+                f"{label} accepted an expectation that closes nothing because "
+                "it follows an indented `##` line; the section ended at a line "
+                "that is not a heading."
+            )
+            report(repr(payload.get("problems")))
+            return 1
+
     report(f"{label} scenario passed.")
     return 0
 
@@ -10016,6 +10081,48 @@ def validate_task_body_ends_at_heading_scenario() -> int:
                 "preceding task's fields."
             )
             return 1
+        # An indented `##` line is not a heading — issue #160. The tolerant
+        # test ended the task there, and a field declared after it with a
+        # documented default was replaced by that default without a word: the
+        # stop rule below vanished and task-start still passed. The fields are
+        # ordered so the dropped one is exactly such a field.
+        write_text(
+            repo / "openspec/changes/indented/tasks.md",
+            header
+            + "- [ ] 1.1 Exercise task contract\n"
+            "  - Covers:\n"
+            "    - E1: Public behavior passes.\n"
+            "  - Touch:\n"
+            "    - src/feature.js\n"
+            "  - Verify:\n"
+            "    - Strategy: evidence-first\n"
+            "    - Reason: this is a gate fixture; it exercises contract structure and has no executable behavior that can fail first\n"
+            "    - M1: node test.js asserts the recorded feed status\n"
+            "  - Evidence:\n"
+            "    - Contract: pending\n"
+            "    - M1: pending\n"
+            "  - Acceptance:\n"
+            "    - Public behavior passes.\n"
+            "    ## an indented line is not a heading\n"
+            "  - Stop Rules:\n"
+            "    - Stop on the rule declared after the indented line.\n"
+            "\n## Invalidates\n\n- None.\n",
+        )
+        indented = json.loads(
+            run_keel(
+                repo, "gate", "task-start", "--change", "indented", "--task",
+                "1.1", "--no-guard", "--json",
+            ).stdout
+        )
+        if "Stop on the rule declared after the indented line." not in json.dumps(
+            indented
+        ):
+            report(
+                "task-body-ends-at-heading: task-start dropped the fields "
+                "declared after an indented `##` line; the task ended at a line "
+                f"that is not a heading (status {indented.get('status')!r})."
+            )
+            return 1
         # --record must anchor the last task's own Contract line, not the stray
         # one planted in the trailing section.
         recorded = run_keel(
@@ -29777,6 +29884,13 @@ def publish_serialization_problem(workflow: str) -> str | None:
             "release would cancel a publish still waiting to run, losing that "
             "version outright rather than appearing to."
         )
+    if not re.search(r"^[ \t]+queue:\s*max\s*$", body, re.M):
+        return (
+            "a pending publish would be cancelled by the next one — the group "
+            "declares no `queue: max`, and the default `queue: single` keeps one "
+            "pending run and cancels it when a newer one arrives, so a burst of "
+            "three releases drops the middle version (#157)."
+        )
     group = re.search(r"^[ \t]+group:\s*(\S.*?)\s*$", body, re.M)
     if not group:
         return (
@@ -29835,6 +29949,25 @@ def validate_a_publish_waits_for_the_one_before_it_scenario() -> int:
         )
         return 1
 
+    # The pending half (#157). `cancel-in-progress: false` protects the running
+    # publish; the default `queue: single` still cancels a pending one when a
+    # newer run arrives, so a burst of three releases drops the middle version.
+    # A copy without `queue: max` is exactly what 5.70.0 shipped.
+    unqueued = workflow.replace("  queue: max\n", "")
+    if unqueued == workflow:
+        report(
+            f"{label}: a pending publish would be cancelled by the next one — "
+            "`queue: max` could not be located to remove, so the real file keeps "
+            "at most one pending run and cancels the rest."
+        )
+        return 1
+    if not publish_serialization_problem(unqueued):
+        report(
+            f"{label}: a pending publish would be cancelled by the next one — a "
+            "group without `queue: max` was accepted."
+        )
+        return 1
+
     # M2 — the option whose default is wrong for this job. A check satisfied by
     # the block alone would pass on the configuration that loses a version
     # outright, which is worse than the one being fixed here.
@@ -30002,6 +30135,172 @@ def validate_a_merge_names_who_makes_it_scenario() -> int:
     return 0
 
 
+def workflow_job_block(workflow: str, job: str) -> str:
+    """The text of one job under `jobs:`, up to the next job at the same indent."""
+    match = re.search(
+        r"^  " + re.escape(job) + r":\n((?:(?:    [^\n]*|[ \t]*)\n)*)",
+        workflow,
+        re.M,
+    )
+    return match.group(1) if match else ""
+
+
+def landing_problem(workflow: str) -> str | None:
+    """Return the problem the landing path in `publish.yml` has, or None.
+
+    Takes text so each broken shape can be planted. The workflow runs only on
+    GitHub from the default branch; the repository's copy is the one input
+    guaranteed to be correct, so a rule that only read it would never be seen to
+    fire.
+    """
+    land = workflow_job_block(workflow, "land")
+    if not land:
+        return (
+            f"merges without confirming full-gate — {PUBLISH_WORKFLOW} has no "
+            "`land` job."
+        )
+    if "check_name=full-gate" not in land:
+        return (
+            "merges without confirming full-gate — the `land` job never reads "
+            "the `full-gate` check-run on the head commit before merging."
+        )
+    if "--match-head-commit" not in land:
+        return (
+            "merges without confirming full-gate — the merge is not pinned to the "
+            "tested head commit, so a push after the check could land untested."
+        )
+    if "actions/checkout" in land:
+        return (
+            "pull request code could run with a write token — the `land` job "
+            "checks out code, and it runs in the base repository's context with "
+            "write permission."
+        )
+    if '.user.login == \\"$OWNER\\"' not in land:
+        return (
+            "pull request code could run with a write token — the `land` job "
+            "does not restrict itself to the repository owner's pull requests."
+        )
+    if '.head.repo.full_name == \\"$REPO\\"' not in land:
+        return (
+            "pull request code could run with a write token — the `land` job "
+            "does not refuse pull requests from forks."
+        )
+    publish = workflow_job_block(workflow, "publish")
+    published_at = publish.find("npm publish")
+    released_at = publish.find("gh release create")
+    if published_at < 0 or released_at < 0:
+        return (
+            "a failed publish would be left tagged and never retried — the "
+            "`publish` job lacks `npm publish` or `gh release create`."
+        )
+    if released_at < published_at:
+        return (
+            "a failed publish would be left tagged and never retried — the "
+            "`publish` job creates the tag and release before `npm publish`, and "
+            "a tag is what tells the next run the version is already released."
+        )
+    return None
+
+
+def validate_the_repository_lands_what_passed_scenario() -> int:
+    """#155 follow-up: the repository merges, not the agent, with no stored secret.
+
+    Events made with `GITHUB_TOKEN` start no new workflow runs, so a chain of
+    workflows (merge, then release, then publish) needs a personal token at every
+    hand-off. One run that merges, publishes and releases has no hand-off. The
+    price is that the landing job runs with write permission in the base
+    repository's context — so it must run no pull-request code, land only the
+    owner's own pull requests, and merge only the commit `full-gate` passed.
+    """
+    label = "the-repository-lands-what-passed"
+    workflow = (ROOT / PUBLISH_WORKFLOW).read_text(encoding="utf-8")
+
+    problem = landing_problem(workflow)
+    if problem:
+        report(f"{label}: {problem}")
+        return 1
+    land = workflow_job_block(workflow, "land")
+    if not land:
+        report(
+            f"{label}: merges without confirming full-gate — {PUBLISH_WORKFLOW} "
+            "has no `land` job, so nothing lands a pull request that passed."
+        )
+        return 1
+
+    # M1 — the check is read and the tested commit is what merges.
+    for needle, why in (
+        ("check_name=full-gate", "without reading the `full-gate` check-run"),
+        ("--match-head-commit", "without pinning the merge to the tested head commit"),
+    ):
+        planted = workflow.replace(needle, "")
+        if planted == workflow:
+            report(f"{label}: merges without confirming full-gate — `{needle}` is absent.")
+            return 1
+        if not landing_problem(planted):
+            report(
+                f"{label}: merges without confirming full-gate — a landing job "
+                f"that merges {why} was accepted."
+            )
+            return 1
+
+    # M2 — no pull-request code under a write token, and only the owner's own
+    # pull requests from this repository. `workflow_run` and
+    # `pull_request_target` run in the base repository's context with the
+    # permissions the job asks for, so a checkout there hands the token to
+    # whatever the pull request contains.
+    checkout = workflow.replace(
+        "      - name: Land an owner's pull request whose head passed full-gate\n",
+        "      - uses: actions/checkout@v4\n"
+        "      - name: Land an owner's pull request whose head passed full-gate\n",
+    )
+    if checkout == workflow:
+        report(f"{label}: pull request code could run with a write token — the land step could not be located.")
+        return 1
+    if not landing_problem(checkout):
+        report(
+            f"{label}: pull request code could run with a write token — a "
+            "`land` job with a checkout step was accepted."
+        )
+        return 1
+    for needle, why in (
+        ('.user.login == \\"$OWNER\\"', "any author's pull request"),
+        ('.head.repo.full_name == \\"$REPO\\"', "a pull request from a fork"),
+    ):
+        planted = workflow.replace(" and " + needle, "")
+        if planted == workflow:
+            report(f"{label}: pull request code could run with a write token — `{needle}` is absent.")
+            return 1
+        if not landing_problem(planted):
+            report(
+                f"{label}: pull request code could run with a write token — a "
+                f"`land` job that would land {why} was accepted."
+            )
+            return 1
+
+    # M3 — publish before tagging. A tag is what tells the next run "already
+    # released", so a tag created before a publish that then fails marks a version
+    # released that never reached npm, and nothing would ever retry it.
+    publish_step = workflow[workflow.index("      - name: Publish\n"):workflow.index("      - name: Tag and release the landed version\n")]
+    tag_step = workflow[workflow.index("      - name: Tag and release the landed version\n"):]
+    swapped = workflow.replace(publish_step + tag_step, tag_step.rstrip("\n") + "\n\n" + publish_step.rstrip("\n") + "\n")
+    if swapped == workflow:
+        report(f"{label}: a failed publish would be left tagged and never retried — the two steps could not be swapped.")
+        return 1
+    if not landing_problem(swapped):
+        report(
+            f"{label}: a failed publish would be left tagged and never retried — "
+            "a `publish` job that creates the release before `npm publish` was "
+            "accepted."
+        )
+        return 1
+
+    if label not in {name for name, _ in SCENARIOS}:
+        report(f"{label}: the scenario registry does not include it.")
+        return 1
+    report(f"{label} scenario passed.")
+    return 0
+
+
 SCENARIOS: tuple = (
     ("stateless-continuity", validate_stateless_continuity_scenario),
     ("core-gates", validate_core_gates_scenario),
@@ -30368,6 +30667,10 @@ SCENARIOS: tuple = (
         "an-equivalence-claim-names-its-base",
         validate_an_equivalence_claim_names_its_base_scenario,
     ),
+    (
+        "the-repository-lands-what-passed",
+        validate_the_repository_lands_what_passed_scenario,
+    ),
     (
         "a-merge-names-who-makes-it",
         validate_a_merge_names_who_makes_it_scenario,

package/src/core/gates.js

@@ -13,6 +13,7 @@ const {
   declaredCommandLabels,
   field,
   isConcrete,
+  isHeadingLine,
   isPassingReviewStatus,
   parseTasks,
   unfilledToken,
@@ -1597,10 +1598,11 @@ function taskComplete(repo, options) {
 //
 // The task half is the task list already parsed for this file rather than a
 // second checkbox pattern, so it cannot drift from the boundary `parseTasks()`
-// applies to a task's own body. The heading half stays as it was: the two
-// spellings are not interchangeable, and unifying them truncates a tail-position
-// section at an indented `##` line inside its own body, which is this same
-// defect pointed the other way.
+// applies to a task's own body. The heading half is `isHeadingLine()`, the same
+// test `parseTasks()` uses. It must stay the column-zero one: the tolerant
+// spelling truncates a tail-position section at an indented `##` line inside
+// its own body and drops every entry after it, which is this same defect
+// pointed the other way (#160).
 function sectionBody(content, headingOffset, tasks) {
   const lines = content.split(/\r?\n/);
   const headingLine = content.slice(0, headingOffset).split(/\r?\n/).length - 1;
@@ -1609,7 +1611,7 @@ function sectionBody(content, headingOffset, tasks) {
     if (task.line > headingLine && task.line < end) end = task.line;
   }
   for (let cursor = headingLine + 1; cursor < end; cursor += 1) {
-    if (/^##\s+/.test(lines[cursor])) {
+    if (isHeadingLine(lines[cursor])) {
       end = cursor;
       break;
     }

package/src/core/task-contract.js

@@ -59,6 +59,17 @@ function unfilledToken(value) {
   return match ? match[0] : null;
 }
 
+// A heading is a `##` line at column zero. An indented one is text: inside a
+// task it belongs to the field that is open, inside a change-level section it
+// is not an entry. Both readers decide through this one test — issue #160.
+// The tolerant spelling `/^\s*##\s/` ended a task at an indented line and
+// dropped every field after it, and a field with a documented default was
+// replaced by that default without a word; in a section it dropped the entries
+// after the line with no refusal at all.
+function isHeadingLine(line) {
+  return /^##\s/.test(line);
+}
+
 function parseTasks(content) {
   const lines = content.split(/\r?\n/);
   const tasks = [];
@@ -75,16 +86,17 @@ function parseTasks(content) {
     });
   }
   for (let index = 0; index < tasks.length; index += 1) {
-    // A task body ends at the next task or the next `##` heading, whichever
-    // comes first. Without the heading bound a change-level section such as
-    // `## Invalidates` was appended to whichever field was open last — the
-    // Evidence, in every shipped template — so a token quoted there made the
-    // Evidence non-concrete and the gate blamed a task that was fine.
+    // A task body ends at the next task or the next `##` heading (see
+    // `isHeadingLine`), whichever comes first. Without the heading bound a
+    // change-level section such as `## Invalidates` was appended to whichever
+    // field was open last — the Evidence, in every shipped template — so a
+    // token quoted there made the Evidence non-concrete and the gate blamed a
+    // task that was fine.
     const nextTask =
       index + 1 < tasks.length ? tasks[index + 1].line : lines.length;
     let end = nextTask;
     for (let cursor = tasks[index].line + 1; cursor < nextTask; cursor += 1) {
-      if (/^\s*##\s/.test(lines[cursor])) {
+      if (isHeadingLine(lines[cursor])) {
         end = cursor;
         break;
       }
@@ -1538,6 +1550,7 @@ module.exports = {
   isConcrete,
   isPassingReviewStatus,
   loadTaskContract,
+  isHeadingLine,
   parseTasks,
   taskStartContractProblems,
   unfilledToken,