@cratis/pi 7.84.0 → 7.84.2

package/package/corpus/harnesses/copilot/instructions/specs.typescript.instructions.md

@@ -126,6 +126,10 @@ array.should.have.lengthOf(3);
 (() => throwingFn()).should.throw(ErrorType);
 ```
 
+### Comparing JSON
+
+Never assert JSON equality by comparing `JSON.stringify` output: object key order is insertion order, so two equal documents can serialize differently and a spec fails, or passes, for the wrong reason. Compare parsed values with `should.deep.equal`. When a helper must compare serialized JSON (a snapshot, a file on disk, a request body), canonicalize first: sort object keys recursively at every level and keep array order, because array order is data. Review flags raw `JSON.stringify(a) === JSON.stringify(b)` equality in specs and spec helpers.
+
 ## Mocking with Sinon
 
 ```typescript

package/package/corpus/hooks/README.md

@@ -230,8 +230,8 @@ inside the command (`CRATIS_HOOKS_ALLOW_STORE_MUTATIONS=1 cratis …`) changes n
 
 The Bash guard is a no-op unless **both** target-repository opt-in conditions hold: the target is under
 `github.com/Cratis/`, and its `.github/workflows` contains a reusable Cratis/Workflows
-`verify-release-notes` or `verify-semver-label` caller (including the renamed
-`verify-release-intent` caller). Installing the corpus or `@cratis/pi` alone does not opt in a
+`verify-pull-request-policy` caller. The legacy `verify-release-notes`, `verify-semver-label` and
+`verify-release-intent` callers it replaced are still recognized. Installing the corpus or `@cratis/pi` alone does not opt in a
 consumer or personal repository. This scope applies to both Claude Code and Pi; the direct checker
 remains available explicitly in any repository. As in `gh`, an edit's PR URL takes priority over
 `--repo` / `-R`, then literal leading or inherited `GH_REPO`, then the current directory's `origin`.
@@ -258,14 +258,17 @@ node .cratis/ai/hooks/scripts/cratis-check-pr.mjs --body-file .ai-work/pr-body.m
 node .cratis/ai/hooks/scripts/cratis-check-pr.mjs --body-file .ai-work/pr-body.md --pr 123 --strict
 ```
 
-The checker fetches both marked programs from Cratis/Workflows' `verify-release-notes.yml` at
-the immutable commit SHA in the repository's own release-notes caller. If there is no such caller,
+The checker fetches both marked programs (`release-notes` and `release-notes-drift`) from
+Cratis/Workflows' `verify-pull-request-policy.yml` at the ref in the repository's own policy caller,
+and ignores the other programs marked in that file. Without a policy caller it fetches them from
+`verify-release-notes.yml` at the ref in a legacy release-notes caller. If there is neither,
 it uses the reviewed pin `40125b4fcae388e62ed9471edfffd0e991422f0a`. Floating callers such as `@main`
 fetch the programs at that ref; if the fetch fails, they use the bundled programs from the reviewed
 pin with a warning, so body validation is never silently skipped. Programs receive only the proposed PR
 metadata and `PATH`, `HOME`, and `LANG`, not inherited credentials or Node runtime options.
 The exact programs are cached by workflow blob SHA under
-`${XDG_CACHE_HOME:-~/.cache}/cratis/release-notes/<ref>/<sha>.cjs`. Offline, the newest complete
+`${XDG_CACHE_HOME:-~/.cache}/cratis/verify-pull-request-policy/<ref>/<sha>.cjs` for a policy caller and
+`${XDG_CACHE_HOME:-~/.cache}/cratis/release-notes/<ref>/<sha>.cjs` otherwise. Offline, the newest complete
 cached copy for that same pin is used with a warning. With no cache it reports **unchecked** and
 exits **3**; the hook passes through with that warning. Successful checks are silent in hook mode;
 real warnings go to Pi's context or Claude Code's JSON `systemMessage` and `additionalContext`. Exit **0** means no violations; **1** means invalid notes or

package/package/corpus/hooks/scripts/cratis-check-pr.mjs

@@ -53,8 +53,9 @@ const git = (args, cwd = process.cwd()) => {
     return result.status === 0 ? result.stdout.trim() : '';
 };
 
+// The combined pull-request policy caller opts in, as do the legacy per-check callers it replaced.
 function workflowCallers(source) {
-    return [...source.matchAll(/^\s*uses:\s*['"]?Cratis\/Workflows\/\.github\/workflows\/(verify-(?:release-notes|semver-label|release-intent))\.yml@([^\s'"#]+)/gmi)]
+    return [...source.matchAll(/^\s*uses:\s*['"]?Cratis\/Workflows\/\.github\/workflows\/(verify-(?:pull-request-policy|release-notes|semver-label|release-intent))\.yml@([^\s'"#]+)/gmi)]
         .map(match => ({ name: match[1], ref: match[2] }));
 }
 
@@ -117,12 +118,27 @@ function programs(workflow) {
     return bundle;
 }
 
+// Workflows that carry the marked release-note programs, in order of preference. Each has its own
+// cache root so a bundle from one file is never offered for the other at the same ref.
+const ruleSources = [
+    { caller: 'verify-pull-request-policy', file: 'verify-pull-request-policy.yml', cache: 'verify-pull-request-policy' },
+    { caller: 'verify-release-notes', file: 'verify-release-notes.yml', cache: 'release-notes' },
+];
+
+function ruleSource(repositoryCallers) {
+    for (const source of ruleSources) {
+        const caller = repositoryCallers.find(candidate => candidate.name === source.caller);
+        if (caller) return { ...source, ref: caller.ref };
+    }
+    return { ...ruleSources.find(source => source.caller === 'verify-release-notes'), ref: reviewedRulesRef };
+}
+
 function rules(warn, repositoryCallers) {
-    const ref = repositoryCallers.find(caller => caller.name === 'verify-release-notes')?.ref || reviewedRulesRef;
+    const { file: workflowFile, cache: cacheName, ref } = ruleSource(repositoryCallers);
     const floating = !/^[a-f0-9]{40}$/i.test(ref);
-    const cache = join(process.env.XDG_CACHE_HOME || join(homedir(), '.cache'), 'cratis', 'release-notes', ref);
+    const cache = join(process.env.XDG_CACHE_HOME || join(homedir(), '.cache'), 'cratis', cacheName, ref);
     try {
-        const workflow = gh(['api', '-H', 'Accept: application/vnd.github.raw', `repos/Cratis/Workflows/contents/.github/workflows/verify-release-notes.yml?ref=${encodeURIComponent(ref)}`]);
+        const workflow = gh(['api', '-H', 'Accept: application/vnd.github.raw', `repos/Cratis/Workflows/contents/.github/workflows/${workflowFile}?ref=${encodeURIComponent(ref)}`]);
         const bundle = programs(workflow);
         const bytes = Buffer.from(workflow);
         const sha = createHash('sha1').update(`blob ${bytes.length}\0`).update(bytes).digest('hex');
@@ -136,7 +152,7 @@ function rules(warn, repositoryCallers) {
         if (floating || ref === reviewedRulesRef) {
             const bundled = fileURLToPath(new URL('./cratis-release-notes-reviewed.cjs', import.meta.url));
             new Script(readFileSync(bundled, 'utf8'));
-            warn(`Could not fetch release-note rules at ${ref}; using bundled reviewed ${reviewedRulesRef}. ${error.message}`);
+            warn(`Could not fetch release-note rules from ${workflowFile} at ${ref}; using bundled reviewed ${reviewedRulesRef}. ${error.message}`);
             return bundled;
         }
         try {
@@ -148,12 +164,12 @@ function rules(warn, repositoryCallers) {
                     const source = readFileSync(file, 'utf8');
                     if (!source.includes('// cratis:program release-notes\n') || !source.includes('// cratis:program release-notes-drift\n')) continue;
                     new Script(source);
-                    warn(`Could not fetch release-note rules; using cached ${file}. ${error.message}`);
+                    warn(`Could not fetch release-note rules from ${workflowFile}; using cached ${file}. ${error.message}`);
                     return file;
                 } catch { /* Try the next complete cache entry. */ }
             }
         } catch { /* No cache available. */ }
-        warn(`unchecked: could not fetch release-note rules and nothing is cached. ${error.message}`);
+        warn(`unchecked: could not fetch release-note rules from ${workflowFile} at ${ref} and nothing is cached. ${error.message}`);
         return undefined;
     }
 }

package/package/corpus/hooks/scripts/cratis-guard-pr-body.sh

@@ -24,7 +24,7 @@ if ! command -v node >/dev/null 2>&1; then
         exit 0
     fi
     root=$(git rev-parse --show-toplevel 2>/dev/null || true)
-    if ! grep -Eq "^[[:space:]]*uses:[[:space:]]*['\"]?Cratis/Workflows/\\.github/workflows/verify-(release-notes|semver-label|release-intent)\\.yml@" "$root"/.github/workflows/*.yml "$root"/.github/workflows/*.yaml 2>/dev/null; then
+    if ! grep -Eq "^[[:space:]]*uses:[[:space:]]*['\"]?Cratis/Workflows/\\.github/workflows/verify-(pull-request-policy|release-notes|semver-label|release-intent)\\.yml@" "$root"/.github/workflows/*.yml "$root"/.github/workflows/*.yaml 2>/dev/null; then
         exit 0
     fi
     # JSON makes fail-open warnings visible to Claude; stderr exposes the same warning to Pi.

package/package/corpus/rules/specs.typescript.md

@@ -125,6 +125,10 @@ array.should.have.lengthOf(3);
 (() => throwingFn()).should.throw(ErrorType);
 ```
 
+### Comparing JSON
+
+Never assert JSON equality by comparing `JSON.stringify` output: object key order is insertion order, so two equal documents can serialize differently and a spec fails, or passes, for the wrong reason. Compare parsed values with `should.deep.equal`. When a helper must compare serialized JSON (a snapshot, a file on disk, a request body), canonicalize first: sort object keys recursively at every level and keep array order, because array order is data. Review flags raw `JSON.stringify(a) === JSON.stringify(b)` equality in specs and spec helpers.
+
 ## Mocking with Sinon
 
 ```typescript

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cratis/pi",
-  "version": "7.84.0",
+  "version": "7.84.2",
   "description": "Configuration-aware Cratis AI integration for Pi",
   "type": "module",
   "files": [