@cleocode/core 2026.10.27 → 2026.11.1-canary.3

package/templates/CLEO-INJECTION.md

@@ -1,6 +1,6 @@
 # CLEO Protocol
 
-Version: 2.24.24 | CLI-only dispatch | `cleo <command> [args]`
+Version: 2.25.1 | CLI-only dispatch | `cleo <command> [args]`
 
 <!-- CLEO-INJECTION:section=session-start -->
 ## Universal protocol
@@ -40,7 +40,7 @@ Everything else is one command away — print a section with `cleo briefing inje
 1. `cleo current` or `cleo next` → pick task
 2. `cleo focus {id}` → orient: identity + blockers + ready wave + docs + brain context
 3. Check authority, coverage, and source evidence; do the work
-4. Record verification evidence, then `cleo complete {id}` → mark done
+4. Close it. PR work: work on a branch, open a PR whose body has `Closes: T#### AC1,AC2` (`Refs:` for partial delivery), get a non-author per-AC verdict (`cleo review verdict`), merge on green `CI`; the merge sweep closes the task (ADR-099). No-PR work: `cleo done {id} --plan`, record what it names, then `cleo complete {id}`
 5. `cleo next` → continue or end session
 
 Discovery: `cleo find "query"` to search (default page 20; `--limit 0` for all), `cleo list --parent <id>` for direct children only — never bare `cleo list` for browsing. Create: `cleo add --type task --parent <epicId> --title "..." --acceptance "..."` (`--acceptance` is required on every task). Before editing a symbol: `cleo nexus impact <symbol>`; an empty footprint alone never establishes `NONE`.
@@ -55,8 +55,9 @@ Discovery: `cleo find "query"` to search (default page 20; `--limit 0` for all),
 | Task acceptance criterion contains "test" | Propose an `AcceptanceGate` with `kind:"test"` via `cleo req add` |
 | Session token budget ≈ 80% consumed | Run `cleo session end --note "..."` and hand off |
 | Multiple related tasks ready in parallel | Run `cleo orchestrate ready <epicId>` for the wave set |
-| About to call `cleo complete` | `cleo done <id> --plan`, record what it names, then complete |
-| Writing a canonical doc (spec/adr/research/handoff/note/llm-readme) | Use `cleo docs add --type <kind> --slug <kebab-handle>` — NEVER raw fs write to `.cleo/adrs/`, `.cleo/research/`, `.cleo/agent-outputs/`, or `docs/` |
+| Before merging a PR | `cleo done --from-merge <pr> --dry-run` checks its `Closes:`/`Refs:` lines against the store |
+| No-PR work, about to call `cleo complete` | `cleo done <id> --plan`, record what it names, then complete |
+| Writing a canonical doc (spec/adr/research/handoff/note/llm-readme) | Update the existing doc first (`cleo docs update <slug>`); else `cleo docs add --type <kind> --slug <kebab-handle>` — NEVER raw fs write to `.cleo/adrs/`, `.cleo/research/`, `.cleo/agent-outputs/`, or `docs/` |
 | Reading an ADR/spec/research note/handoff | `cleo docs fetch <slug>` — never grep the filesystem for canonical docs |
 | New device, restore or migration; known repo "Not inside a CLEO project"; unreachable registry path; nexus `ENOENT` | `cleo doctor global-delivery` (hub + skills resolve; `--repair`), `cleo doctor projects` (dry run; `--apply`/`--rollback <id>`), `cleo doctor project-identity`, `cleo doctor --all-projects`, `cleo nexus projects clean --orphans --dry-run` (`--dry-run` mandatory: it deletes moved projects), `cleo doctor credentials`; report. Never delete rows of projects that may have moved |
 <!-- /CLEO-INJECTION:section=triggers -->
@@ -121,18 +122,7 @@ Missing output is equally inconclusive; teardown may hang after commit. **Never
 <!-- CLEO-INJECTION:section=pre-complete-gate -->
 ## Pre-Complete Gate Ritual (ADR-051 — evidence required)
 
-Before `cleo complete <id>`, every gate requires programmatic evidence validated against git, files or tools: `cleo verify T### --gate <gate> --evidence "<atoms>"`. Bare `cleo verify --all` rejects with `E_EVIDENCE_MISSING`.
-
-| gate | evidence that satisfies it |
-|------|----------------------------|
-| `implemented` | `commit:<sha>;files:path/a.ts,path/b.ts` — or `pr:<number>` with `files:<changed-paths>`, or `decision:<id>` for decision-only tasks |
-| `testsPassed` | `ci:<pr>` if merged and `evidence.ciSatisfies`; else `tool:test-affected` (needs `testing.affectedCommand`), changed-file `test-run:<json>`, or `tool:test` |
-| `qaPassed` | `ci:<pr>` likewise, else `tool:lint;tool:typecheck` or a `qa-run:<json>` per check |
-| `documented` | `files:docs/spec.md` |
-| `securityPassed` | `tool:security-scan` |
-| `cleanupDone` | `note:removed dead branches` |
-
-Name the acceptance criteria each result proves: `cleo verify T1234 --gate implemented --evidence "commit:abc123;files:src/fix.ts;satisfies:T1234#AC1"`. Record `testsPassed` and `qaPassed` separately with actual verification results and explicit criterion links. Documentation-only PRs cannot implement a code-fix task; changed criteria require fresh evidence, and a child waiver does not waive parent criteria. Then `cleo complete T###` re-validates every hard atom (commit reachable, file sha256, test-run hash); tampering → `E_EVIDENCE_STALE`. Typed gates, `pr:` rules, tool timeouts and the audited owner override: `cleo briefing inject --section evidence`. Typed gates execute only via `cleo verify --run`.
+PR work: the merge sweep records `pr:`, `ci:` and reviewer-bound `satisfies:` when it closes a PR's `Closes:` tasks, so no agent step follows the merge (ADR-099). No-PR work, typed gates no CI job runs, and PRs merged before the sweep: `cleo done <id> --plan`, then record each gate it names with `cleo verify T### --gate <gate> --evidence "<atoms>;satisfies:T####AC1"` (bare `cleo verify --all` rejects with `E_EVIDENCE_MISSING`), then `cleo complete T###`, which re-validates every hard atom (tampering → `E_EVIDENCE_STALE`). Record `testsPassed` and `qaPassed` separately with actual verification results and explicit criterion links. Documentation-only PRs cannot implement a code-fix task; changed criteria require fresh evidence, and a child waiver does not waive parent criteria. Atoms per gate, typed gates (`cleo verify --run`), `pr:` rules and the audited owner override: `cleo briefing inject --section evidence`.
 
 Anti-patterns: completing without running tests · self-attesting without programmatic proof · running tests by hand, then again via `tool:test` · modifying files between `cleo verify` and `cleo complete`.
 <!-- /CLEO-INJECTION:section=pre-complete-gate -->

package/templates/CLEO-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLEO Protocol — on-demand reference
 
-Version: 2.24.24 | Companion to the always-loaded `CLEO-INJECTION.md` core
+Version: 2.25.1 | Companion to the always-loaded `CLEO-INJECTION.md` core
 
 Not injected into agent context. Print one section with `cleo briefing inject --section <name>`; tier-2 spawn prompts embed this whole file. Section names are the `CLEO-INJECTION:section` markers below.
 
@@ -264,7 +264,18 @@ Before dispatch, assert these required sections: `## Task Identity` · `## File
 <!-- CLEO-INJECTION:section=evidence -->
 ## Evidence reference (ADR-051 · ADR-061)
 
-A merged PR and green CI provide provenance. For `implemented`, pair `pr:<number>` with `files:<changed-paths>`; CLEO checks task linkage, complete changed-file coverage, and the actual merge commit's bytes. Documentation and research tasks may use appropriate documentary artifacts. The receipt retains criterion hashes, artifact paths, and result references. A valid child completion leaves any parent with unproven criteria open.
+| gate | evidence that satisfies it |
+|------|----------------------------|
+| `implemented` | `commit:<sha>;files:path/a.ts,path/b.ts` — or `pr:<number>` with `files:<changed-paths>`, or `decision:<id>` for decision-only tasks |
+| `testsPassed` | `tool:test-affected` (needs `testing.affectedCommand`), changed-file `test-run:<json>`, `tool:test`, or `ci:<pr>` for a PR merged before the sweep (needs `evidence.ciSatisfies`) |
+| `qaPassed` | `tool:lint;tool:typecheck`, a `qa-run:<json>` per check, or `ci:<pr>` likewise |
+| `documented` | `files:docs/spec.md` |
+| `securityPassed` | `tool:security-scan` |
+| `cleanupDone` | `note:removed dead branches` |
+
+Name the acceptance criteria each result proves: `cleo verify T1234 --gate implemented --evidence "commit:abc123;files:src/fix.ts;satisfies:T1234#AC1"`.
+
+A merged PR closes the tasks its body names (`Closes: T#### AC1,AC2`; `Refs:` binds ACs without closing) once `CI` is green on its exact head and a non-author reviewer recorded `met` for each AC on that head (`cleo review verdict`). The merge sweep then records `pr:<n>;files:<changed paths>` and `ci:<n>` with those `satisfies:` links; the PR text never waives an AC (ADR-099). Preview with `cleo done --from-merge <pr> --dry-run`. For a hand-recorded `implemented`, pair `pr:<number>` with `files:<changed-paths>`; CLEO checks task linkage, complete changed-file coverage, and the actual merge commit's bytes. Documentation and research tasks may use appropriate documentary artifacts. The receipt retains criterion hashes, artifact paths, and result references. A valid child completion leaves any parent with unproven criteria open.
 
 | Exit | Code | Fix |
 |:----:|------|-----|
@@ -338,7 +349,7 @@ The evidence run is the one run. Start with `cleo done <id> --plan`, which picks
 
 ### `pr:<number>` retroactive atom (T9764)
 
-`pr:` proves merge provenance, not completion. CLEO checks actual `mergeCommit`, task linkage and changed files; incomplete inventories or unavailable merge artifacts remain unverified. Fetch the merge commit before `files:` evidence. Task `files` must intersect its diff; prose mentions cannot establish scope. Explicit research/spike and documentation scope retain documentary evidence. Such a task owes `verification.requiredGatesByKind` for its kind (default: the required gates without `testsPassed`/`qaPassed`, T14001), but any non-document path its work touches restores the full code gates: `files:` paths, a `pr:` atom's changed files (a legacy atom without them counts as code), a `commit:` diff, any branch whose name cites the task (`task/`, `feat/`, `fix/`, …), default-branch commits whose subject cites it (merges, squash merges, direct commits), and merged PRs from such a branch. Work CLEO cannot inspect (no origin default branch, a failed GitHub lookup, an unreadable commit) counts as code, and `cleo complete` and `cleo done --plan` say why. A README, LICENSE or CHANGELOG counts as a document only when bare or with a document extension, and a bare `.txt` never does.
+`pr:` proves merge provenance, not completion. Work that shipped under another task's PR is credited with that PR plus `satisfies:<id>#AC<n>` for the criteria it delivers (T14094): each named criterion must name files the PR changed and must predate its merge; a task another task fully covers is closed with `cleo cancel <id> --reason "covered by T<n>"` and `cleo relates add <id> T<n> duplicates "<reason>"`. CLEO checks actual `mergeCommit`, task linkage and changed files; incomplete inventories or unavailable merge artifacts remain unverified. Fetch the merge commit before `files:` evidence. Task `files` must intersect its diff; prose mentions cannot establish scope. Explicit research/spike and documentation scope retain documentary evidence. Such a task owes `verification.requiredGatesByKind` for its kind (default: the required gates without `testsPassed`/`qaPassed`, T14001), but any non-document path its work touches restores the full code gates: `files:` paths, a `pr:` atom's changed files (a legacy atom without them counts as code), a `commit:` diff, any branch whose name cites the task (`task/`, `feat/`, `fix/`, …), default-branch commits whose subject cites it (merges, squash merges, direct commits), and merged PRs from such a branch. Work CLEO cannot inspect (no origin default branch, a failed GitHub lookup, an unreadable commit) counts as code, and `cleo complete` and `cleo done --plan` say why. A README, LICENSE or CHANGELOG counts as a document only when bare or with a document extension, and a bare `.txt` never does.
 
 A task PR merged into an integration branch is a component: `pr:<component>@<integration>` (and `ci:<component>@<integration>`) takes the merge commit and CI from the integration PR that landed it, and the task linkage and changed files from the component PR — only its files that survive the integration merge, never the whole integration diff (T12671). `cleo done` derives this from either PR number. A file a later change also edited still counts while the component's own hunks apply to the landed version. A component that only deleted files implements with `pr:<component>@<integration>;note:<deleted paths>`, because a deletion has no bytes for `files:`. A PR merged directly into the default branch that only deleted files implements with `pr:<number>;note:<deleted paths>` (T14024). Its note is a comma-separated list of the deleted paths, optionally after a label ending at the first `:` — `note:dropped old schema: db/schema.ts, db/relations.ts`; there is no other prose in it. Every listed path must be one the PR deleted (absent from its merged tree) that is still absent at HEAD; a path it did not delete, or one that exists again at HEAD, is refused by name, and the refusal quotes the paths it parsed. Every `note:` atom in that evidence write is read as such a list, so do not add a second, explanatory note: its words are refused as paths the PR did not delete. Put the explanation in the label instead. The component form's note stays free-form.
 
@@ -350,9 +361,21 @@ With `evidence.ciSatisfies: true`, `ci:<number>` attests `testsPassed`/`qaPassed
 
 Required checks: explicit configuration or target repository protection. `release.prRequiredWorkflows: []` requires no checks; it proves neither testing nor review. `.cleo/cache/evidence/pr-<num>.json` retains provenance and changed files; obsolete versions reject. Use `tool:test-affected` when `testing.affectedCommand` is configured (a full `tool:test` then only for root-config changes, which affected planning refuses), otherwise a targeted `test-run:<json>` or `tool:test`, plus appropriate QA tools, linking each result to verified criteria.
 
+**Merged work with no required CI (T14163).** `pr:<n>` proves provenance only: it never satisfies `testsPassed` or `qaPassed`, with or without required workflows; tests need a run. A change whose only paths outside every workspace package are the root `package.json` (dependency fields only) and `pnpm-lock.yaml` is otherwise workspace-wide, so with no `ci:` route only the whole suite would speak for it. After the merge it is scoped instead: a targeted `test-run:` recorded on the default branch after the merge (the T13673 stand-in) covers it when it passes a test file in every package whose lockfile importer the merge changed, the root importer counting as every package, plus their dependents and the change's own packages. The stand-in names the importers (`manifestScoped`). Anything the lockfile diff cannot attribute to a changed importer (settings, overrides, catalogs, a package no changed importer reaches), any other root `package.json` field such as `scripts`, and other lockfiles keep the change workspace-wide.
+
+### `deploy:` probed-deployment atom (T14083)
+
+`deploy:<provider>/<deploymentId>@<sha>|<probe-url>` proves a deployment of `<sha>` (e.g. `deploy:railway/dpl_9f3c@1a2b3c4d|https://api.example.com/health`). At verify CLEO itself runs one bounded GET of the probe URL (10 s, first 64 KiB of the body): it must return 2xx and name the deployed SHA (full or a 7+ character prefix) in an `X-Commit` or `X-Version` response header or in the body. A probe naming no SHA is refused with that fix, and a bare 2xx never stands in. A probe URL whose path or query names the SHA is refused before it is sent, since an endpoint that echoes its request would name it without proving which build is live; a 5xx, a timeout, an unreachable host or a probe naming another commit is refused too. The atom records the status, probe time and a sha256 of the body read, and the deployed SHA resolved in git. That SHA must contain the task's implemented commits (an ancestor or a patch-equivalent copy, the T13003 rule); `cleo complete` re-checks that containment only and never re-probes. For `railway`, CLEO also asks Railway's API, with the user's own token from the environment (`RAILWAY_API_TOKEN`, sent as Bearer, or `RAILWAY_TOKEN`, a project token; read at verify, never stored), that the deployment exists, is the live one, and was built from exactly that commit; any mismatch refuses and names the deployment and both commits (T14091). For other providers, or without a credential, the probe alone stands and the atom records `providerCheck: { verified: false, reason }`.
+
+The atom satisfies only the gates the project lists in `evidence.deploySatisfies` (e.g. `"evidence": { "deploySatisfies": ["documented"] }`). There is no default mapping: unset or empty, `deploy:` is refused and satisfies nothing, and it never stands for `testsPassed` unless that gate is listed.
+
+### `ci-run:` repeated run in CI (T14149)
+
+A criterion that needs a heavy or repeated run (e.g. "50 consecutive runs pass") is proven in CI, never waived or run on the owner's machine. Dispatch `gh workflow run repeat-run.yml -f test=<repo-relative test file> -f runs=50` on the default branch; it runs that file N times and fails on the first failing run. Then record `ci-run:<runId>` in the same write as the gate's other evidence, e.g. `cleo verify T### --gate testsPassed --evidence "ci:<pr>;ci-run:<runId>;satisfies:T####AC2"`. CLEO reads the run from GitHub: it must be `repeat-run.yml`, dispatched on the default branch, with its latest attempt green. Its uploaded report must match its title (same test file, count and commit, every run green). Its commit must contain the task's implemented work. The repeated test must be a file the task changed, or one a linked criterion names. `ci-run:` links criteria; it never satisfies `testsPassed` on its own. `cleo complete` re-reads the run and refuses a newer attempt that is not green.
+
 ### CLEO config and generated clients in targeted test evidence (T13778 · T13783)
 
-A change to CLEO's own config (`.cleo/project-context.json`, `.cleo/config.json`) never makes a change workspace-wide. `tool:config-schema` validates those files against CLEO's schema, and a targeted run covers the rest, composed in one write: `--evidence "test-run:<report>;tool:config-schema"` (or `qa-run:` receipts for `qaPassed`). Neither stands alone. A test-run that left config to config-schema needs it, and a config-schema result on a change with other paths needs another result for them, so a config edit never hides an untested source change. For an already-merged change, name the task's own merge: `commit:<sha>;tool:config-schema` (a commit recorded on its `implemented` gate) or `pr:<n>;tool:config-schema`; any other commit is refused, and after the merge config-schema never carries the change's code files. When a change edits `.cleo/project-context.json`, evidence reads its test, lint and typecheck commands from the default branch's copy, so a change cannot relax its own checks. Untracked files under `.cleo/rcasd/` and `.claude/`, or matched by the default branch's `evidence.scopeExcludes`, are session state and not part of the change; every other untracked file counts.
+A change to CLEO's own config (`.cleo/project-context.json`, `.cleo/config.json`) never makes a change workspace-wide. `tool:config-schema` validates those files against CLEO's schema, and a targeted run covers the rest, composed in one write: `--evidence "test-run:<report>;tool:config-schema"` (or `qa-run:` receipts for `qaPassed`). Neither stands alone. A test-run that left config to config-schema needs it, and a config-schema result on a change with other paths needs another result for them, so a config edit never hides an untested source change. For an already-merged change, name the task's own merge: `commit:<sha>;tool:config-schema` (a commit recorded on its `implemented` gate) or `pr:<n>;tool:config-schema`; any other commit is refused, and after the merge config-schema never carries the change's code files. When a change edits `.cleo/project-context.json`, evidence reads its test, lint and typecheck commands from the default branch's copy, so a change cannot relax its own checks. A change is its commits against the default branch plus uncommitted tracked edits, including staged and `git add -N` files. An untracked file never widens it: `cleo done --plan` names each one under `untrackedSetAside`, the evidence records them, and `cleo complete` refuses that evidence once one is committed. Stage a new file the task created (`git add`, or `git add -N`) before the run so it counts.
 
 Generated clients and seed data (owner decision, T13783): `evidence.typecheckOnlyDependents` lists repo globs, read from the default branch only and never guessed from names (a generated client: `lib/api-zod/**`; seed or data files: `lib/db/src/seed-data/**`, T13786; a catch-all glob such as `**` is ignored with a warning). A changed package whose every changed path matches is typecheck-only (test files edited beside the data are left out of that judgement and must be run), and a package that depends on the change ONLY through typecheck-only packages owes a typecheck instead of a test file: a whole-project `tool:typecheck`, or a qa-run typecheck receipt whose roots hold it, in the same `testsPassed` write. The trust boundary: the typecheck proves the dependent still compiles against the regenerated code, not that its behaviour is unchanged. A dependent whose own source changed, or that also depends on another changed package, still owes tests, and the run must pass every changed package's tests and every edited test file. A typecheck or lint `tool:` result is never a test run: it neither carries `testsPassed` alone nor exempts scoped evidence from post-merge supersession.
 <!-- /CLEO-INJECTION:section=evidence -->

package/templates/git-hooks/legacy-hashes.json

@@ -11,7 +11,8 @@
     "52046b0d489bf6f3ef00e5a4c4b09a4cc1a25531ee70ae07dfad55ff6e2d26dc",
     "5ad02ab6d7f5b515a219af8f7d058b6e1a0d4e3f1d730b9147bce64b7a96a7b4",
     "dfec66f4d0a420dfce49d142995b3554a2af44b25b140f2cb6acc739a3fde89e",
-    "f809a52be3f180c6d6913597460b480f12307f7036f87cdf7a42a0010ade7013"
+    "f809a52be3f180c6d6913597460b480f12307f7036f87cdf7a42a0010ade7013",
+    "9bf703257c82b714bf1e861558a3ab9aed0522f89036a30c249258e12f17e792"
   ],
   "pre-push": [
     "8a48d9672f27ae1ea9ebc40d7181ab737a1889e32b451594ba30ac7c2558c07c",

package/templates/git-hooks/pre-commit

@@ -3,6 +3,7 @@
 # Pre-commit guardrails:
 #   1. Reject SQLite WAL/SHM files (data corruption risk).
 #   2. Block commits when core CLEO files are gitignored (data integrity).
+#   3. Refuse CLEO runtime state staged at ANY path (T14189).
 #
 # Installation: Automatically installed via `cleo init`
 
@@ -44,18 +45,49 @@ if [ -n "$IGNORED_CORE" ]; then
   exit 1
 fi
 
-# ── 3. Block staging of T5158/ADR-013 §9 data-safety files ────────────
-# tasks.db / brain.db / config.json / project-info.json must NEVER be
-# staged — risks data loss on branch switch (SQLite WAL/JSON sync).
-DATA_SAFETY_STAGED=$(git diff --cached --name-only | grep -E '^\.cleo/(tasks\.db|brain\.db|config\.json|project-info\.json)$' || true)
+# ── 3. Block staging of CLEO runtime state at ANY path (T14189) ─────
+# cleo.db / brain.db / tasks.db (and their WAL files), project-info.json
+# carrying a "projectId", and a config.json byte-identical to
+# .cleo/config.json must NEVER be committed: ADR-013 §9 (T5158 data-loss
+# vector), and T14189 (a cleo call inside a git hook once staged .cleo state
+# files into this index as ROOT paths). `cleo doctor` runs the same rule.
+LEAKED=""
+CLEO_CONFIG_BLOB=""
+if [ -f .cleo/config.json ]; then
+  CLEO_CONFIG_BLOB=$(git hash-object .cleo/config.json 2>/dev/null || true)
+fi
+STAGED_RAW=$(git -c core.quotePath=false diff --cached --raw --no-abbrev --no-renames --diff-filter=d)
+TAB=$(printf '\t')
+while IFS= read -r line; do
+  [ -n "$line" ] || continue
+  meta=${line%%"$TAB"*}
+  path=${line#*"$TAB"}
+  blob=$(echo "$meta" | awk '{print $4}')
+  case "${path##*/}" in
+    cleo.db|cleo.db-wal|cleo.db-shm|cleo.db-journal|\
+    brain.db|brain.db-wal|brain.db-shm|brain.db-journal|\
+    tasks.db|tasks.db-wal|tasks.db-shm|tasks.db-journal)
+      LEAKED="$LEAKED $path" ;;
+    project-info.json)
+      if git cat-file -p "$blob" 2>/dev/null | grep -q '"projectId"'; then
+        LEAKED="$LEAKED $path"
+      fi ;;
+    config.json)
+      if [ "$path" = ".cleo/config.json" ] || { [ -n "$CLEO_CONFIG_BLOB" ] && [ "$blob" = "$CLEO_CONFIG_BLOB" ]; }; then
+        LEAKED="$LEAKED $path"
+      fi ;;
+  esac
+done <<EOF_STAGED
+$STAGED_RAW
+EOF_STAGED
 
-if [ -n "$DATA_SAFETY_STAGED" ]; then
-  echo "ERROR: Refusing to commit T5158/ADR-013 §9 data-safety files:"
-  echo "$DATA_SAFETY_STAGED"
+if [ -n "$LEAKED" ]; then
+  echo "ERROR: Refusing to commit CLEO runtime state (ADR-013 §9, T14189):"
+  for f in $LEAKED; do echo "  $f"; done
   echo ""
-  echo "These files are runtime state that must never be tracked in git."
-  echo "Commiting them re-opens the T5158 data-loss vector (SQLite WAL/"
-  echo "JSON sync gets corrupted on branch switch)."
-  echo "To fix: git rm --cached <file>"
+  echo "These are .cleo runtime files (databases, project identity, config)"
+  echo "that must never be tracked; committing them re-opens the T5158"
+  echo "data-loss vector."
+  echo "To fix: git reset -q --$LEAKED"
   exit 1
 fi

package/templates/workflows/release-prepare.yml.tmpl

@@ -60,13 +60,8 @@ on:
         type: boolean
         required: false
         default: false
-      skip-macos-tests:
-        description: 'Skip the macOS test shards in Preflight (set by `cleo release open` only when the nightly macOS run for this exact commit is green).'
-        type: boolean
-        required: false
-        default: false
       verified-sha:
-        description: 'Commit the skip-tests / skip-macos-tests decisions were verified against. REQUIRED for any skip: when empty, or when the run checks out a different commit (main moved after the check), every skip is ignored and all tests run.'
+        description: 'Commit the skip-tests decision was verified against. REQUIRED for any skip: when empty, or when the run checks out a different commit (main moved after the check), every skip is ignored and all tests run.'
         type: string
         required: false
       skip-reason:
@@ -133,7 +128,6 @@ jobs:
     timeout-minutes: 3
     outputs:
       run-linux-tests: ${{ steps.tests.outputs.linux }}
-      run-macos-tests: ${{ steps.tests.outputs.macos }}
       reused-ci-run-url: ${{ steps.tests.outputs.reused_url }}
     steps:
       - uses: actions/checkout@v4
@@ -154,7 +148,6 @@ jobs:
         id: tests
         env:
           SKIP_TESTS: ${{ inputs.skip-tests }}
-          SKIP_MACOS_TESTS: ${{ inputs.skip-macos-tests }}
           VERIFIED_SHA: ${{ inputs.verified-sha }}
           SKIP_REASON: ${{ inputs.skip-reason }}
           REUSED_RUN: ${{ inputs.reused-ci-run }}
@@ -202,11 +195,10 @@ jobs:
             ' "$dir" "$HEAD_SHA" "$DEFAULT_BRANCH"
           }
           linux=true
-          macos=true
           note=""
           reused_url=""
           skip_requested=false
-          if [ "$SKIP_TESTS" = "true" ] || [ "$SKIP_MACOS_TESTS" = "true" ]; then skip_requested=true; fi
+          if [ "$SKIP_TESTS" = "true" ]; then skip_requested=true; fi
           if [ "$skip_requested" = "true" ] && [ -z "$VERIFIED_SHA" ]; then
             # A skip is a claim that CI already tested THIS tree. Without the
             # commit it was verified against, nothing ties the claim to what
@@ -225,10 +217,8 @@ jobs:
                 note="skip-tests was requested, but reused-ci-run does not prove this commit's Linux shards: $verdict. Ignoring it: the Linux shards run."
               fi
             fi
-            if [ "$SKIP_MACOS_TESTS" = "true" ]; then macos=false; fi
           fi
           echo "linux=$linux" >> "$GITHUB_OUTPUT"
-          echo "macos=$macos" >> "$GITHUB_OUTPUT"
           echo "reused_url=$reused_url" >> "$GITHUB_OUTPUT"
           describe() { if [ "$1" = "true" ]; then echo "runs"; else echo "skipped"; fi; }
           {
@@ -237,7 +227,6 @@ jobs:
             echo "| suite | decision |"
             echo "|---|---|"
             echo "| Linux test shards | $(describe "$linux") |"
-            echo "| macOS test shards | $(describe "$macos") |"
             echo ""
             echo "Commit: \`$HEAD_SHA\`"
             if [ -n "$VERIFIED_SHA" ]; then echo "Skips verified against: \`$VERIFIED_SHA\`"; fi
@@ -245,7 +234,7 @@ jobs:
             if [ -n "$SKIP_REASON" ]; then echo ""; echo "Reason: $SKIP_REASON"; fi
             if [ -n "$note" ]; then echo ""; echo "**$note**"; fi
           } >> "$GITHUB_STEP_SUMMARY"
-          echo "linux tests: $(describe "$linux"); macOS tests: $(describe "$macos")"
+          echo "linux tests: $(describe "$linux"); macOS tests: never on the release path (T14104)"
           if [ -n "$note" ]; then echo "::warning::$note"; fi
       - name: A scoped dispatch needs a committed plan
         run: |
@@ -399,76 +388,11 @@ jobs:
         # could not be prepared from a release-ready commit.
         timeout-minutes: 55
 
-  # macOS runs on nightly + release instead of on every push to main, so the
-  # release is where a macOS regression must be caught before it ships. Runs
-  # even when the Linux shards are skipped, unless the nightly macOS run for
-  # this exact commit is already green (skip-macos-tests, set and verified by
-  # `cleo release open`). macOS runners are ~2x slower than Linux, hence 4
-  # shards and a generous ceiling; retry=2 matches ci.yml's macOS shards.
-  preflight-test-macos:
-    name: Preflight (macOS test shard ${{ matrix.shard }}/8)
-    if: ${{ needs.dispatch-preconditions.outputs.run-macos-tests == 'true' }}
-    needs: [dispatch-preconditions]
-    runs-on: macos-latest
-    timeout-minutes: 90
-    strategy:
-      fail-fast: true
-      matrix:
-        shard: [1, 2, 3, 4, 5, 6, 7, 8]
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-        timeout-minutes: 5
-
-      - name: Set up pnpm
-        uses: pnpm/action-setup@v4
-        timeout-minutes: 2
-
-      - name: Set up Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '{{NODE_VERSION}}'
-        timeout-minutes: 3
-
-      - name: Build worktree-napi native addon BEFORE pnpm install (T9982)
-        # Same reason as the Linux shards: the file: link to crates/worktree-napi
-        # only copies .node artifacts that exist at install time.
-        shell: bash
-        run: |
-          cargo build --release -p worktree-napi
-          triple="darwin-x64"
-          if [[ "$(uname -m)" == "arm64" ]]; then
-            triple="darwin-arm64"
-          fi
-          cp target/release/libworktree_napi.dylib "crates/worktree-napi/worktree-napi.${triple}.node"
-        timeout-minutes: 20
-
-      - name: Install dependencies
-        run: {{INSTALL_CMD}}
-        timeout-minutes: 10
-
-      - name: Install ripgrep (required for T1605 callsite-coverage validator)
-        uses: ./.github/actions/install-ripgrep
-
-      - name: Build cant-napi native addon for CANT tests (T12382)
-        shell: bash
-        run: pnpm --filter @cleocode/cant run build:napi
-        timeout-minutes: 20
-
-      - name: Build packages (required for cross-package imports)
-        run: {{BUILD_CMD}}
-        timeout-minutes: 15
-
-      - name: Generate SvelteKit type stubs (required for studio tests)
-        run: pnpm --filter @cleocode/studio exec svelte-kit sync
-        timeout-minutes: 2
-
-      - name: Test macOS (shard ${{ matrix.shard }}/8)
-        run: pnpm exec vitest run --shard=${{ matrix.shard }}/8 --retry=2
-        timeout-minutes: 75
-
+  # T14104: no macOS job. Release never waits on GitHub macOS runners (five
+  # concurrent jobs on the free plan; ~75 min per release). macOS is validated
+  # on main by macos-main.yml (every push, nightly, on demand; a failure files a
+  # macos-regression issue) and on the owner's Mac by
+  # scripts/release-mac-smoke.mjs.
   preflight-build:
     name: Preflight (build)
     runs-on: ubuntu-latest
@@ -516,15 +440,13 @@ jobs:
       - dispatch-preconditions
       - preflight-lint-typecheck
       - preflight-test
-      - preflight-test-macos
       - preflight-build
     if: |
       always() &&
       needs.dispatch-preconditions.result == 'success' &&
       needs.preflight-lint-typecheck.result == 'success' &&
       needs.preflight-build.result == 'success' &&
-      (needs.preflight-test.result == 'success' || needs.preflight-test.result == 'skipped') &&
-      (needs.preflight-test-macos.result == 'success' || needs.preflight-test-macos.result == 'skipped')
+      (needs.preflight-test.result == 'success' || needs.preflight-test.result == 'skipped')
     timeout-minutes: 20
     outputs:
       branch: ${{ steps.branch.outputs.name }}
@@ -838,7 +760,6 @@ jobs:
     needs:
       - preflight-lint-typecheck
       - preflight-test
-      - preflight-test-macos
       - preflight-build
       - prepare
     if: failure()