@cleocode/core 2026.10.17 → 2026.10.18

package/migrations/drizzle-cleo-project/20261015100000_t12914-lifecycle-release-row-uids/migration.sql

@@ -0,0 +1,88 @@
+-- T12914 (epic T12323) — row uids for the lifecycle, release, PR and commit
+-- tables (project store).
+--
+-- Adds a nullable `uid` column and a unique index on it to each of the 16
+-- tables (the two minted ones, `tasks_lifecycle_evidence` and
+-- `tasks_lifecycle_transitions`, also get `birth_fp`). Without a uid none of
+-- them had capture triggers, so a release, a lifecycle stage or a commit
+-- recorded on one device never reached another, and the typed release merge
+-- rule (release.status.absorbing, T12943) never fired across devices (Stage C
+-- gate, T13549). Spec: `cleo docs fetch t12341-uid-scheme`.
+--
+-- The columns are filled by TypeScript at open (store/row-identity.ts, inside
+-- the cold-open lease), and rows inserted by this build get theirs from the
+-- per-connection TEMP trigger. Nothing here rebuilds a table or touches a row
+-- (only ADD COLUMN and CREATE INDEX), so the T12541 rebuild probe and the
+-- gate 36 DML rules do not apply; a probe-stamped store gets its columns and
+-- indexes from the open's heal.
+--
+-- @task T12914
+-- @epic T12323
+
+ALTER TABLE `tasks_lifecycle_pipelines` ADD COLUMN `uid` text;
+--> statement-breakpoint
+ALTER TABLE `tasks_lifecycle_stages` ADD COLUMN `uid` text;
+--> statement-breakpoint
+ALTER TABLE `tasks_lifecycle_gate_results` ADD COLUMN `uid` text;
+--> statement-breakpoint
+ALTER TABLE `tasks_lifecycle_evidence` ADD COLUMN `uid` text;
+--> statement-breakpoint
+ALTER TABLE `tasks_lifecycle_evidence` ADD COLUMN `birth_fp` text;
+--> statement-breakpoint
+ALTER TABLE `tasks_lifecycle_transitions` ADD COLUMN `uid` text;
+--> statement-breakpoint
+ALTER TABLE `tasks_lifecycle_transitions` ADD COLUMN `birth_fp` text;
+--> statement-breakpoint
+ALTER TABLE `tasks_releases` ADD COLUMN `uid` text;
+--> statement-breakpoint
+ALTER TABLE `tasks_release_commits` ADD COLUMN `uid` text;
+--> statement-breakpoint
+ALTER TABLE `tasks_release_changes` ADD COLUMN `uid` text;
+--> statement-breakpoint
+ALTER TABLE `tasks_release_changesets` ADD COLUMN `uid` text;
+--> statement-breakpoint
+ALTER TABLE `tasks_release_artifacts` ADD COLUMN `uid` text;
+--> statement-breakpoint
+ALTER TABLE `tasks_pull_requests` ADD COLUMN `uid` text;
+--> statement-breakpoint
+ALTER TABLE `tasks_pr_commits` ADD COLUMN `uid` text;
+--> statement-breakpoint
+ALTER TABLE `tasks_pr_tasks` ADD COLUMN `uid` text;
+--> statement-breakpoint
+ALTER TABLE `tasks_commits` ADD COLUMN `uid` text;
+--> statement-breakpoint
+ALTER TABLE `tasks_commit_files` ADD COLUMN `uid` text;
+--> statement-breakpoint
+ALTER TABLE `tasks_task_commits` ADD COLUMN `uid` text;
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS `uq_tasks_lifecycle_pipelines_uid` ON `tasks_lifecycle_pipelines` (`uid`);
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS `uq_tasks_lifecycle_stages_uid` ON `tasks_lifecycle_stages` (`uid`);
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS `uq_tasks_lifecycle_gate_results_uid` ON `tasks_lifecycle_gate_results` (`uid`);
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS `uq_tasks_lifecycle_evidence_uid` ON `tasks_lifecycle_evidence` (`uid`);
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS `uq_tasks_lifecycle_transitions_uid` ON `tasks_lifecycle_transitions` (`uid`);
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS `uq_tasks_releases_uid` ON `tasks_releases` (`uid`);
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS `uq_tasks_release_commits_uid` ON `tasks_release_commits` (`uid`);
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS `uq_tasks_release_changes_uid` ON `tasks_release_changes` (`uid`);
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS `uq_tasks_release_changesets_uid` ON `tasks_release_changesets` (`uid`);
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS `uq_tasks_release_artifacts_uid` ON `tasks_release_artifacts` (`uid`);
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS `uq_tasks_pull_requests_uid` ON `tasks_pull_requests` (`uid`);
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS `uq_tasks_pr_commits_uid` ON `tasks_pr_commits` (`uid`);
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS `uq_tasks_pr_tasks_uid` ON `tasks_pr_tasks` (`uid`);
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS `uq_tasks_commits_uid` ON `tasks_commits` (`uid`);
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS `uq_tasks_commit_files_uid` ON `tasks_commit_files` (`uid`);
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS `uq_tasks_task_commits_uid` ON `tasks_task_commits` (`uid`);

package/migrations/drizzle-cleo-project/20261016130000_t13777-log-row-uids/migration.sql

@@ -0,0 +1,42 @@
+-- T13777 (epic T12323) — row uids for the logs every command writes (project
+-- store): token usage and the session handoff entries.
+--
+-- Both tables are portable, so every vault snapshot lists them, but neither
+-- had row identity, so the change journal never carried them: a journal
+-- checkpoint could not account for their rows and `cleo cloud push` refused
+-- on every real store (T12999 staging, 2026-10-16). Adds a nullable `uid`
+-- column and a unique index on it to each. Spec: `cleo docs fetch t12341-uid-scheme`.
+--
+-- The write-once guard on the handoff entries was `BEFORE UPDATE` with no
+-- column list, so it aborted the uid fill and the per-connection uid trigger
+-- (journal spec §2.11 §7 note for T12341). It is re-created as `BEFORE UPDATE
+-- OF` the content columns: the handoff stays write-once, and its identity
+-- columns can be filled.
+--
+-- The columns are filled by TypeScript at open (store/row-identity.ts, inside
+-- the cold-open lease), and rows inserted by this build get theirs from the
+-- per-connection TEMP trigger. Nothing here rebuilds a table or touches a row.
+--
+-- @task T13777
+-- @epic T12323
+
+ALTER TABLE `tasks_token_usage` ADD COLUMN `uid` text;
+--> statement-breakpoint
+ALTER TABLE `tasks_session_handoff_entries` ADD COLUMN `uid` text;
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS `uq_tasks_token_usage_uid` ON `tasks_token_usage` (`uid`);
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS `uq_tasks_session_handoff_entries_uid` ON `tasks_session_handoff_entries` (`uid`);
+--> statement-breakpoint
+DROP TRIGGER IF EXISTS `trg_tasks_session_handoff_no_update`;
+--> statement-breakpoint
+CREATE TRIGGER `trg_tasks_session_handoff_no_update`
+BEFORE UPDATE OF `handoff_json`, `created_at` ON `tasks_session_handoff_entries`
+FOR EACH ROW
+WHEN NOT EXISTS (SELECT 1 FROM cleo_trigger_suspend WHERE scope IN ('guard', 'all'))
+BEGIN
+  SELECT RAISE(
+    ABORT,
+    'T1609_HANDOFF_IMMUTABLE: session_handoff_entries rows are write-once. Use persistHandoff() exactly once per session.'
+  );
+END;

package/migrations/drizzle-cleo-project/20261016140000_t13777-audit-collapse/migration.sql

@@ -0,0 +1,31 @@
+-- T13777 part 2 (epic T12323) — the dispatch audit moves into `tasks_audit_log`,
+-- which gets a row uid and syncs.
+--
+-- Every command writes an audit row. The dispatch audit went to the bare
+-- `audit_log` and the task-mutation audit to `tasks_audit_log`; neither had
+-- row identity, so the change journal carried neither, and a journal
+-- checkpoint could not account for their rows (T12999 staging, 2026-10-16).
+-- This build writes the dispatch audit into the twin, the twin collapse drains
+-- the bare rows into it (store/twin-collapse.ts, lossless), and the twin is
+-- declared natural on `id`.
+--
+-- `dispatch_idempotency_key` holds a dispatch request's idempotency key. One
+-- key may record several rows (a failed attempt, then its retry), which
+-- UNIQUE(project_hash, domain, operation, idempotency_key) on the twin would
+-- refuse, so the key lives outside that constraint; the idempotent replay
+-- reads it through the index below.
+--
+-- The columns are filled by TypeScript at open (store/row-identity.ts, inside
+-- the cold-open lease), and rows inserted by this build get theirs from the
+-- per-connection TEMP trigger. Nothing here rebuilds a table or touches a row.
+--
+-- @task T13777
+-- @epic T12323
+
+ALTER TABLE `tasks_audit_log` ADD COLUMN `uid` text;
+--> statement-breakpoint
+ALTER TABLE `tasks_audit_log` ADD COLUMN `dispatch_idempotency_key` text;
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS `uq_tasks_audit_log_uid` ON `tasks_audit_log` (`uid`);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `idx_tasks_audit_log_dispatch_idempotency` ON `tasks_audit_log` (`project_hash`, `domain`, `operation`, `dispatch_idempotency_key`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cleocode/core",
-  "version": "2026.10.17",
+  "version": "2026.10.18",
   "description": "CLEO core business logic kernel — tasks, sessions, memory, orchestration, lifecycle, with bundled SQLite store",
   "type": "module",
   "main": "./dist/index.js",
@@ -371,6 +371,11 @@
       "import": "./dist/tasks/*.js",
       "require": "./dist/tasks/*.js"
     },
+    "./goal/*.js": {
+      "types": "./dist/goal/*.d.ts",
+      "import": "./dist/goal/*.js",
+      "require": "./dist/goal/*.js"
+    },
     "./verification/*.js": {
       "types": "./dist/verification/*.d.ts",
       "import": "./dist/verification/*.js",
@@ -496,16 +501,16 @@
     "write-file-atomic": "^7.0.1",
     "yaml": "^2.8.3",
     "zod": "^4.3.6",
-    "@cleocode/adapters": "2026.10.17",
-    "@cleocode/agents": "2026.10.17",
-    "@cleocode/caamp": "2026.10.17",
-    "@cleocode/contracts": "2026.10.17",
-    "@cleocode/git-shim": "2026.10.17",
-    "@cleocode/lafs": "2026.10.17",
-    "@cleocode/nexus": "2026.10.17",
-    "@cleocode/paths": "2026.10.17",
-    "@cleocode/skills": "2026.10.17",
-    "@cleocode/worktree": "2026.10.17"
+    "@cleocode/adapters": "2026.10.18",
+    "@cleocode/agents": "2026.10.18",
+    "@cleocode/caamp": "2026.10.18",
+    "@cleocode/contracts": "2026.10.18",
+    "@cleocode/git-shim": "2026.10.18",
+    "@cleocode/lafs": "2026.10.18",
+    "@cleocode/nexus": "2026.10.18",
+    "@cleocode/paths": "2026.10.18",
+    "@cleocode/skills": "2026.10.18",
+    "@cleocode/worktree": "2026.10.18"
   },
   "engines": {
     "node": ">=24.16.0"
@@ -531,7 +536,7 @@
     "@types/proper-lockfile": "^4.1.4",
     "@types/tar": "^6.1.13",
     "@types/write-file-atomic": "^4.0.3",
-    "@cleocode/utils": "2026.10.17"
+    "@cleocode/utils": "2026.10.18"
   },
   "repository": {
     "type": "git",
@@ -540,12 +545,7 @@
   },
   "optionalDependencies": {
     "llmtxt": "^2026.5.15",
-    "@cleocode/studio": "^2026.10.17"
-  },
-  "cleo": {
-    "releasedFeatures": [
-      "hooks-v1"
-    ]
+    "@cleocode/studio": "^2026.10.18"
   },
   "scripts": {
     "build": "tsc && node scripts/copy-selfimprove-fixtures.mjs && node scripts/write-build-provenance.mjs",

package/templates/CLEO-REFERENCE.md

@@ -301,7 +301,7 @@ All overrides append a line to `.cleo/audit/force-bypass.jsonl`. Use sparingly.
 
 ### Test evidence without churn (T12957)
 
-The evidence run is the one run. Start with `cleo done <id> --plan`, which picks affected → ci and shows each tool's cache state; it never plans a whole-suite `tool:test` it would have to run (owner decision 2026-10-12, T13647) and refuses with `test-run-needed` instead, naming the scoped evidence to record. When the PR has merged and the project sets `evidence.ciSatisfies`, record `testsPassed`/`qaPassed` with `ci:<pr>` and run nothing locally. Otherwise, when `testing.affectedCommand` is configured, use `tool:test-affected` (packages the diff touches plus dependents); a full `tool:test` is then only for changes to root config, which affected planning refuses. Without it, use a targeted `test-run:<json>` of the test files you changed, or `tool:test`. After the merge, a scoped run carries to the merge commit only when the change's files are byte-identical; otherwise a targeted `test-run:` recorded on a main HEAD that descends from the merge, on the current tree and covering the change's files, stands in whatever the merge commit's own CI concluded (owner decision 2026-10-13, T13673). The same rule holds for `qaPassed` (T13644): after the merge, `qa-run:` receipts (a typecheck and a lint) carry when the change's files are byte-identical, or stand in when recorded on such a main HEAD, on the current tree, with roots that together cover the change's files. While iterating, run only the failing or changed test files; never run the suite by hand and then again through `tool:test`. On macOS heavy `test`/`build` runs take one machine-wide slot by default (`CLEO_TOOL_CONCURRENCY_TEST=<n>` raises it).
+The evidence run is the one run. Start with `cleo done <id> --plan`, which picks affected → ci and shows each tool's cache state; it never plans a whole-suite `tool:test` it would have to run (owner decision 2026-10-12, T13647) and refuses with `test-run-needed` instead, naming the scoped evidence to record. When the PR has merged and the project sets `evidence.ciSatisfies`, record `testsPassed`/`qaPassed` with `ci:<pr>` and run nothing locally. Otherwise, when `testing.affectedCommand` is configured, use `tool:test-affected` (packages the diff touches plus dependents); a full `tool:test` is then only for changes to root config, which affected planning refuses. Without it, use a targeted `test-run:<json>` of the test files you changed, or `tool:test`. After the merge, a scoped run carries to the merge commit only when the change's files are byte-identical; otherwise a targeted `test-run:` recorded on a main HEAD that descends from the merge, on the current tree and covering the change's files, stands in whatever the merge commit's own CI concluded (owner decision 2026-10-13, T13673). Such a report goes stale only when the change's own files, the test files it ran or their test inputs (root configs and lockfile; the `package.json`, `tsconfig*.json`, runner configs and setup files of the directories above those files) move (T13784): unrelated commits landing on main after the run or after verify leave it standing, and a run followed by a pull of main records `runHeadSha` (HEAD as of the run) so those commits are judged the same way. The same rule holds for `qaPassed` (T13644): after the merge, `qa-run:` receipts (a typecheck and a lint) carry when the change's files are byte-identical, or stand in when recorded on such a main HEAD, on the current tree, with roots that together cover the change's files. A parent whose work was split across its children closes on their PRs (T13785): when several merged PRs cite the parent, those that also cite one of its done children are its own work, each recorded as an `implemented` attempt with the parent's criteria, instead of `pr-ambiguous`. While iterating, run only the failing or changed test files; never run the suite by hand and then again through `tool:test`. On macOS heavy `test`/`build` runs take one machine-wide slot by default (`CLEO_TOOL_CONCURRENCY_TEST=<n>` raises it).
 
 ### `pr:<number>` retroactive atom (T9764)