@deftai/directive-core 0.79.2 → 0.79.4

package/dist/pr-watch/types.d.ts

@@ -13,6 +13,8 @@ export interface WatchProbe {
     readonly hasBlocking: boolean;
     readonly errored: boolean;
     readonly ciFailures: number;
+    /** Failed required check identities (name + conclusion), when CI was probed. */
+    readonly ciFailedChecks: readonly string[];
     /** All required CI check-runs have a terminal conclusion (none pending). */
     readonly terminalCheckRun: boolean;
     readonly isClean: boolean;

package/dist/pr-watch/watch.js

@@ -1,5 +1,5 @@
 import { defaultRunGh } from "../pr-merge-readiness/gh.js";
-import { DEFAULT_MAX_WAIT_MINUTES, DEFAULT_POLL_SECONDS, DEFAULT_STALL_THRESHOLD, EXIT_CLEAN, EXIT_NEW_P0_P1, EXIT_TERMINAL_ERROR, VERDICT_CLEAN, VERDICT_CONFIG, VERDICT_ERRORED, VERDICT_NEW_P0_P1, VERDICT_PENDING, VERDICT_STALL, VERDICT_TIMEOUT, } from "./constants.js";
+import { DEFAULT_CI_BLOCKED_THRESHOLD, DEFAULT_MAX_WAIT_MINUTES, DEFAULT_POLL_SECONDS, DEFAULT_STALL_THRESHOLD, EXIT_CLEAN, EXIT_NEW_P0_P1, EXIT_TERMINAL_ERROR, VERDICT_CI_BLOCKED, VERDICT_CLEAN, VERDICT_CONFIG, VERDICT_ERRORED, VERDICT_NEW_P0_P1, VERDICT_PENDING, VERDICT_STALL, VERDICT_TIMEOUT, } from "./constants.js";
 import { probeOnce } from "./probe.js";
 const systemMonotonicClock = {
     now() {
@@ -52,6 +52,7 @@ export function watch(prNumber, repo, options = {}) {
     const startedAt = clockFn.now();
     let lastProbe = null;
     let stallStreak = 0;
+    let ciBlockedStreak = 0;
     const build = (verdict, exitCode, probe, poll) => ({
         verdict,
         exitCode,
@@ -79,6 +80,20 @@ export function watch(prNumber, repo, options = {}) {
         if (probe.errored) {
             return build(VERDICT_ERRORED, EXIT_TERMINAL_ERROR, probe, poll);
         }
+        // #2688: Greptile side satisfied on HEAD but CI red — fail loud toward a
+        // fix loop instead of burning max-wait-minutes on idle Greptile polls.
+        if (probe.cleanGateHoldout === "ci_failures") {
+            ciBlockedStreak += 1;
+        }
+        else {
+            ciBlockedStreak = 0;
+        }
+        if (oneShot && probe.cleanGateHoldout === "ci_failures") {
+            return build(VERDICT_CI_BLOCKED, EXIT_TERMINAL_ERROR, probe, poll);
+        }
+        if (!oneShot && ciBlockedStreak >= DEFAULT_CI_BLOCKED_THRESHOLD) {
+            return build(VERDICT_CI_BLOCKED, EXIT_TERMINAL_ERROR, probe, poll);
+        }
         // Stall = a review IS present but stuck on a non-HEAD commit; surface it
         // rather than burning the whole cap waiting for a re-review that isn't coming.
         if (probe.found && !probe.shaMatch) {
@@ -112,6 +127,7 @@ export function watch(prNumber, repo, options = {}) {
         hasBlocking: false,
         errored: false,
         ciFailures: 0,
+        ciFailedChecks: [],
         terminalCheckRun: false,
         isClean: false,
         cleanGateHoldout: null,

package/dist/release/constants.d.ts

@@ -20,6 +20,11 @@ export declare const DESTRUCTIVE_GH_GATE_BYPASS_ENV = "DEFT_ALLOW_DESTRUCTIVE_GH
 export declare const RELEASE_PREFLIGHT_ENV = "DEFT_RELEASE_PREFLIGHT";
 /** Set only by release Step-5 preflight when --allow-coverage-debt=#N is supplied (#2573). */
 export declare const COVERAGE_DEBT_ENV = "DEFT_ALLOW_COVERAGE_DEBT";
+/** Hard wall-clock cap for release Step 5 `task check` / vitest coverage (#2652). */
+export declare const RELEASE_CHECK_TIMEOUT_MS: number;
+export declare const RELEASE_CHECK_TIMEOUT_MINUTES = 20;
+/** Vitest coverage step cap in GHA CI (mirrors release Step 5 budget, #2652). */
+export declare const CI_VITEST_COVERAGE_TIMEOUT_MINUTES = 20;
 export declare const PYPROJECT_VERSION_LINE_RE: RegExp;
 /** Byte-identical argparse --help from scripts/release.py (Python 3.12). */
 export declare const RELEASE_HELP: string;

package/dist/release/constants.js

@@ -28,10 +28,16 @@ export const DESTRUCTIVE_GH_GATE_BYPASS_ENV = "DEFT_ALLOW_DESTRUCTIVE_GH_VERBS";
 export const RELEASE_PREFLIGHT_ENV = "DEFT_RELEASE_PREFLIGHT";
 /** Set only by release Step-5 preflight when --allow-coverage-debt=#N is supplied (#2573). */
 export const COVERAGE_DEBT_ENV = "DEFT_ALLOW_COVERAGE_DEBT";
+/** Hard wall-clock cap for release Step 5 `task check` / vitest coverage (#2652). */
+export const RELEASE_CHECK_TIMEOUT_MS = 20 * 60 * 1000;
+export const RELEASE_CHECK_TIMEOUT_MINUTES = 20;
+/** Vitest coverage step cap in GHA CI (mirrors release Step 5 budget, #2652). */
+export const CI_VITEST_COVERAGE_TIMEOUT_MINUTES = 20;
 export const PYPROJECT_VERSION_LINE_RE = /version\s*=\s*"[^"]*"/;
 /** Byte-identical argparse --help from scripts/release.py (Python 3.12). */
 export const RELEASE_HELP = "usage: release [-h] [--dry-run] [--skip-tag] [--skip-release] [--allow-dirty]\n" +
     "               [--allow-vbrief-drift] [--allow-coverage-debt #N]\n" +
+    "               [--allow-skip-ci #N]\n" +
     "               [--skip-ci] [--skip-build] [--no-draft]\n" +
     "               [--repo OWNER/REPO] [--base-branch BRANCH]\n" +
     "               [--project-root PATH] [--summary TEXT]\n" +
@@ -66,11 +72,17 @@ export const RELEASE_HELP = "usage: release [-h] [--dry-run] [--skip-tag] [--ski
     "                        flag cites an operator-owned issue number (#2573).\n" +
     "                        PowerShell: use --allow-coverage-debt=N (no bare #)\n" +
     '                        or quote "#N"; unquoted # starts a comment (#2621).\n' +
-    "  --skip-ci             Skip Step 3 (task ci:local / task check fallback).\n" +
+    "  --skip-ci             Skip Step 5 (task ci:local / task check fallback).\n" +
     "                        Used by `task release:e2e` to keep wall-clock\n" +
     "                        manageable inside the auto-created temp repo (CI\n" +
     "                        semantics are covered by the unit-test suite, not the\n" +
-    "                        e2e rehearsal).\n" +
+    "                        e2e rehearsal). Production cuts MUST pass\n" +
+    "                        --allow-skip-ci=#N citing the tracked incident (#2652);\n" +
+    "                        otherwise Step 5 runs with a hard timeout.\n" +
+    "  --allow-skip-ci #N    Acknowledge skipping Step 5 on a production cut (#2652).\n" +
+    "                        Emits a loud WARN — npm ships without vitest coverage.\n" +
+    "                        PowerShell: use --allow-skip-ci=N (no bare #) or quote\n" +
+    '                        "#N"; unquoted # starts a comment (#2621).\n' +
     "  --skip-build          Skip Step 6 (task build). Used by `task release:e2e`\n" +
     "                        to keep wall-clock manageable; build artefacts are not\n" +
     "                        needed for the draft-release verification step.\n" +

package/dist/release/flags.js

@@ -1,5 +1,6 @@
 import { parseCoverageDebtIssueNumber } from "../vitest-runner/coverage-debt.js";
 import { DEFAULT_BASE_BRANCH, RELEASE_HELP } from "./constants.js";
+import { parseSkipCiIncidentArgv } from "./skip-ci-incident.js";
 export function parseReleaseFlags(args) {
     let help = false;
     let dryRun = false;
@@ -8,6 +9,8 @@ export function parseReleaseFlags(args) {
     let allowDirty = false;
     let allowVbriefDrift = false;
     let allowCoverageDebtIssue = null;
+    const skipCiIncident = parseSkipCiIncidentArgv(args);
+    const allowSkipCiIssue = skipCiIncident.kind === "valid" ? skipCiIncident.issue : null;
     let skipCi = false;
     let skipBuild = false;
     let draft = true;
@@ -71,6 +74,15 @@ export function parseReleaseFlags(args) {
         else if (token === "--skip-ci") {
             skipCi = true;
         }
+        else if (token === "--allow-skip-ci") {
+            // Value consumed by parseSkipCiIncidentArgv above; advance past it here.
+            const value = takeValue(token, i);
+            if (value !== null)
+                i += 1;
+        }
+        else if (token.startsWith("--allow-skip-ci=")) {
+            // Value consumed by parseSkipCiIncidentArgv above.
+        }
         else if (token === "--skip-build") {
             skipBuild = true;
         }
@@ -132,6 +144,9 @@ export function parseReleaseFlags(args) {
         }
         i += 1;
     }
+    if (skipCiIncident.kind === "invalid") {
+        unknown.push(`--allow-skip-ci (${skipCiIncident.reason})`);
+    }
     return {
         help,
         version,
@@ -144,6 +159,7 @@ export function parseReleaseFlags(args) {
         allowDirty,
         allowVbriefDrift,
         allowCoverageDebtIssue,
+        allowSkipCiIssue,
         skipCi,
         skipBuild,
         draft,

package/dist/release/main.js

@@ -2,6 +2,7 @@ import { EXIT_CONFIG_ERROR } from "./constants.js";
 import { formatReleaseHelp, parseReleaseFlags } from "./flags.js";
 import { resolveProjectRoot, resolveRepo } from "./paths.js";
 import { runPipeline } from "./pipeline.js";
+import { validateSkipCiIncident } from "./skip-ci-incident.js";
 import { validateVersion } from "./version.js";
 export function cmdRelease(args, seams = {}) {
     const flags = parseReleaseFlags(args);
@@ -27,6 +28,11 @@ export function cmdRelease(args, seams = {}) {
     }
     const projectRoot = resolveProjectRoot(flags.projectRoot);
     const repo = resolveRepo(flags.repo, projectRoot, seams);
+    const skipCiGate = validateSkipCiIncident(flags.skipCi, flags.allowSkipCiIssue, process.env);
+    if (skipCiGate.kind === "invalid") {
+        process.stderr.write(`release: error: ${skipCiGate.reason}\n`);
+        return EXIT_CONFIG_ERROR;
+    }
     const config = {
         version: flags.version,
         repo,
@@ -42,6 +48,7 @@ export function cmdRelease(args, seams = {}) {
         summary: flags.summary,
         allowVbriefDrift: flags.allowVbriefDrift,
         allowCoverageDebtIssue: flags.allowCoverageDebtIssue,
+        allowSkipCiIssue: flags.allowSkipCiIssue,
     };
     return runPipeline(config, seams);
 }

package/dist/release/pipeline.js

@@ -2,12 +2,13 @@ import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { assertProjectionContained } from "../fs/projection-containment.js";
 import { prependUpgradeBanner, promoteChangelog, sectionForVersion } from "./changelog.js";
-import { EXIT_CONFIG_ERROR, EXIT_OK, EXIT_VIOLATION, RELEASE_ARTIFACTS, TOTAL_STEPS, VERIFY_DRAFT_INTERVAL_SECONDS, VERIFY_DRAFT_MAX_ATTEMPTS, } from "./constants.js";
+import { EXIT_CONFIG_ERROR, EXIT_OK, EXIT_VIOLATION, RELEASE_ARTIFACTS, RELEASE_CHECK_TIMEOUT_MINUTES, TOTAL_STEPS, VERIFY_DRAFT_INTERVAL_SECONDS, VERIFY_DRAFT_MAX_ATTEMPTS, } from "./constants.js";
 import { checkTagAvailable, createGithubRelease, readTextFile, verifyReleaseDraft } from "./gh.js";
 import { checkGitClean, commitReleaseArtifacts, createTag, currentBranch, pushRelease, releaseCommitSubject, } from "./git.js";
 import { checkVbriefLifecycleSyncNative, refreshRoadmapNative, runBuildNative, } from "./native-steps.js";
 import { todayIso } from "./paths.js";
 import { runReleaseCheck } from "./preflight.js";
+import { formatSkipCiIncidentWarning } from "./skip-ci-incident.js";
 import { isPrereleaseTag } from "./version.js";
 export function emit(step, label, status, target = process.stderr) {
     target.write(`[${step}/${TOTAL_STEPS}] ${label}... ${status}\n`);
@@ -108,13 +109,16 @@ export function runPipeline(config, seams = {}) {
     // golden-diff release-parity gate stays green until the oracle is retired.
     label = "Pre-flight CI (task ci:local | fallback task check)";
     if (config.skipCi) {
+        if (config.allowSkipCiIssue !== null && config.allowSkipCiIssue > 0) {
+            process.stderr.write(formatSkipCiIncidentWarning(config.allowSkipCiIssue));
+        }
         emit(5, label, "SKIP (--skip-ci)");
     }
     else if (config.dryRun) {
         const debtNote = config.allowCoverageDebtIssue !== null
             ? `; would pass --allow-coverage-debt=#${config.allowCoverageDebtIssue} to task check`
             : "";
-        emit(5, label, `DRYRUN (would run task ci:local with task check fallback${debtNote})`);
+        emit(5, label, `DRYRUN (would run task ci:local with task check fallback${debtNote}; hard timeout ${RELEASE_CHECK_TIMEOUT_MINUTES}m)`);
     }
     else {
         const [ok, reason] = runCiFn(projectRoot, config.allowCoverageDebtIssue);
@@ -128,7 +132,7 @@ export function runPipeline(config, seams = {}) {
             const debtHint = config.allowCoverageDebtIssue === null
                 ? "; pass --allow-coverage-debt=#N only after operator review"
                 : "";
-            emit(5, label, `FAIL (${reason}${debtHint})`);
+            emit(5, label, `FAIL (${reason}${debtHint}; Step 5 hard timeout is ${RELEASE_CHECK_TIMEOUT_MINUTES}m — cancel hung vitest and see docs/RELEASING.md § Vitest coverage hang recovery)`);
             return EXIT_VIOLATION;
         }
     }

package/dist/release/preflight.js

@@ -8,7 +8,7 @@
  * dispatches `check:framework-source`.
  */
 import { dispatchTaskCheck } from "../check/orchestrator.js";
-import { COVERAGE_DEBT_ENV, RELEASE_PREFLIGHT_ENV } from "./constants.js";
+import { COVERAGE_DEBT_ENV, RELEASE_CHECK_TIMEOUT_MS, RELEASE_PREFLIGHT_ENV } from "./constants.js";
 import { releaseSubprocessEnv } from "./git.js";
 /** Step-5-only env: branch bypass plus release pre-flight cache staleness tolerance (#2386). */
 export function releaseCheckEnv(options = {}) {
@@ -40,6 +40,7 @@ export function runReleaseCheck(projectRoot, seams = {}, allowCoverageDebtIssue
     const dispatch = seams.dispatchCheck ?? dispatchTaskCheck;
     const checkSeams = {
         ...seams.checkSeams,
+        timeoutMs: seams.checkSeams?.timeoutMs ?? RELEASE_CHECK_TIMEOUT_MS,
         env: releaseCheckEnv({
             base: seams.checkSeams?.env ?? process.env,
             allowCoverageDebtIssue,
@@ -49,6 +50,12 @@ export function runReleaseCheck(projectRoot, seams = {}, allowCoverageDebtIssue
     if (code === 0) {
         return [true, "ran native TypeScript task check"];
     }
+    if (code === 124) {
+        return [
+            false,
+            `task check timed out after ${RELEASE_CHECK_TIMEOUT_MS / 60_000}m (vitest coverage hang — see docs/RELEASING.md)`,
+        ];
+    }
     return [false, `task check failed (exit ${code})`];
 }
 //# sourceMappingURL=preflight.js.map

package/dist/release/skip-ci-incident.d.ts

@@ -0,0 +1,22 @@
+/** Parse `#2652`, `2652`, or bare numeric strings for skip-ci incident citation. */
+export declare function parseSkipCiIncidentIssueNumber(raw: string): number | null;
+export type SkipCiIncidentResolution = {
+    readonly kind: "none";
+} | {
+    readonly kind: "valid";
+    readonly issue: number;
+} | {
+    readonly kind: "invalid";
+    readonly reason: string;
+};
+/** Set by `task release:e2e` worker subprocesses — permits `--skip-ci` without issue citation. */
+export declare const RELEASE_E2E_ENV = "DEFT_RELEASE_E2E";
+export declare function parseSkipCiIncidentArgv(argv: readonly string[]): SkipCiIncidentResolution;
+/**
+ * Production `--skip-ci` is an incident (#2652): require `--allow-skip-ci=#N` or
+ * run inside `task release:e2e` (`DEFT_RELEASE_E2E=1`).
+ */
+export declare function validateSkipCiIncident(skipCi: boolean, allowSkipCiIssue: number | null, env?: NodeJS.ProcessEnv): SkipCiIncidentResolution;
+/** Loud stderr banner when Step 5 is skipped with operator acknowledgment (#2652). */
+export declare function formatSkipCiIncidentWarning(issue: number): string;
+//# sourceMappingURL=skip-ci-incident.d.ts.map

package/dist/release/skip-ci-incident.js

@@ -0,0 +1,68 @@
+/** Parse `#2652`, `2652`, or bare numeric strings for skip-ci incident citation. */
+export function parseSkipCiIncidentIssueNumber(raw) {
+    const trimmed = raw.trim();
+    if (!trimmed)
+        return null;
+    const normalized = trimmed.startsWith("#") ? trimmed.slice(1) : trimmed;
+    if (!/^\d+$/.test(normalized))
+        return null;
+    const issue = Number.parseInt(normalized, 10);
+    return Number.isFinite(issue) && issue > 0 ? issue : null;
+}
+const SKIP_CI_FLAG = "--allow-skip-ci";
+/** Set by `task release:e2e` worker subprocesses — permits `--skip-ci` without issue citation. */
+export const RELEASE_E2E_ENV = "DEFT_RELEASE_E2E";
+export function parseSkipCiIncidentArgv(argv) {
+    for (let i = 0; i < argv.length; i += 1) {
+        const token = argv[i] ?? "";
+        if (token === SKIP_CI_FLAG) {
+            const next = argv[i + 1];
+            if (next === undefined || next.startsWith("-")) {
+                return { kind: "invalid", reason: `${SKIP_CI_FLAG} requires an issue number (#N)` };
+            }
+            const issue = parseSkipCiIncidentIssueNumber(next);
+            return issue === null
+                ? { kind: "invalid", reason: `${SKIP_CI_FLAG} value must be #N or N` }
+                : { kind: "valid", issue };
+        }
+        if (token.startsWith(`${SKIP_CI_FLAG}=`)) {
+            const value = token.slice(SKIP_CI_FLAG.length + 1);
+            const issue = parseSkipCiIncidentIssueNumber(value);
+            return issue === null
+                ? { kind: "invalid", reason: `${SKIP_CI_FLAG}= value must be #N or N` }
+                : { kind: "valid", issue };
+        }
+    }
+    return { kind: "none" };
+}
+/**
+ * Production `--skip-ci` is an incident (#2652): require `--allow-skip-ci=#N` or
+ * run inside `task release:e2e` (`DEFT_RELEASE_E2E=1`).
+ */
+export function validateSkipCiIncident(skipCi, allowSkipCiIssue, env = process.env) {
+    if (!skipCi) {
+        return { kind: "none" };
+    }
+    if (allowSkipCiIssue !== null) {
+        return { kind: "valid", issue: allowSkipCiIssue };
+    }
+    if (env[RELEASE_E2E_ENV] === "1") {
+        return { kind: "valid", issue: 0 };
+    }
+    return {
+        kind: "invalid",
+        reason: "production --skip-ci skips Step 5 vitest coverage and ships untested npm builds (#2652). " +
+            "Pass --allow-skip-ci=#N citing the tracked incident after operator review, " +
+            "or use `task release:e2e` for rehearsal-only skips.",
+    };
+}
+/** Loud stderr banner when Step 5 is skipped with operator acknowledgment (#2652). */
+export function formatSkipCiIncidentWarning(issue) {
+    const cite = issue > 0 ? `#${issue}` : "release:e2e rehearsal";
+    return (`\n` +
+        `*** WARNING: release Step 5 CI/coverage SKIPPED (--skip-ci) ***\n` +
+        `*** This cut will NOT be validated by vitest coverage / task check. ***\n` +
+        `*** Incident citation: ${cite} — npm publish proceeds UNTESTED (#2652). ***\n` +
+        `*** Next production patch MUST cut without --skip-ci once the hang is fixed. ***\n\n`);
+}
+//# sourceMappingURL=skip-ci-incident.js.map

package/dist/release/types.d.ts

@@ -13,6 +13,7 @@ export interface ReleaseConfig {
     readonly summary: string | null;
     readonly allowVbriefDrift: boolean;
     readonly allowCoverageDebtIssue: number | null;
+    readonly allowSkipCiIssue: number | null;
 }
 export interface ReleaseFlags {
     readonly help: boolean;
@@ -30,6 +31,7 @@ export interface ReleaseFlags {
     readonly draft: boolean;
     readonly summary: string | null;
     readonly allowCoverageDebtIssue: number | null;
+    readonly allowSkipCiIssue: number | null;
     readonly unknown: readonly string[];
 }
 export interface SpawnResult {

package/dist/release/version.js

@@ -1,4 +1,3 @@
-const PEP440_TAG_RE = /^v?(?<major>\d+)\.(?<minor>\d+)\.(?<patch>\d+)(?:-(?<kind>rc|alpha|beta|test)\.(?<num>\d+))?$/;
 const PRE_KIND_MAP = {
     alpha: "a",
     beta: "b",
@@ -17,6 +16,55 @@ export class NonPublishableVersionError extends Error {
         this.name = "NonPublishableVersionError";
     }
 }
+/** Parse `[v]X.Y.Z[-(rc|alpha|beta|test).N]` via linear scan. */
+function parseReleaseTag(version) {
+    let i = 0;
+    if (version[i] === "v" || version[i] === "V")
+        i += 1;
+    const readInt = () => {
+        const ch = version[i] ?? "";
+        if (i >= version.length || ch < "0" || ch > "9")
+            return null;
+        let n = 0;
+        while (i < version.length) {
+            const digit = version[i] ?? "";
+            if (digit < "0" || digit > "9")
+                break;
+            n = n * 10 + Number(digit);
+            i += 1;
+        }
+        return n;
+    };
+    const major = readInt();
+    if (major === null || version[i] !== ".")
+        return null;
+    i += 1;
+    const minor = readInt();
+    if (minor === null || version[i] !== ".")
+        return null;
+    i += 1;
+    const patch = readInt();
+    if (patch === null)
+        return null;
+    if (i >= version.length)
+        return { major, minor, patch, kind: null, num: null };
+    if (version[i] !== "-")
+        return null;
+    i += 1;
+    const kindStart = i;
+    while (i < version.length && version[i] !== ".")
+        i += 1;
+    if (i >= version.length || version[i] !== ".")
+        return null;
+    const kind = version.slice(kindStart, i);
+    if (!["rc", "alpha", "beta", "test"].includes(kind))
+        return null;
+    i += 1;
+    const num = readInt();
+    if (num === null || i !== version.length)
+        return null;
+    return { major, minor, patch, kind, num };
+}
 /** Raise Error when version does not match strict X.Y.Z semver. */
 export function validateVersion(version) {
     if (!/^\d+\.\d+\.\d+$/.test(version)) {
@@ -27,7 +75,7 @@ export function validateVersion(version) {
 /** Return true when version carries a SemVer pre-release suffix (#425). */
 export function isPrereleaseTag(version) {
     let candidate = version.trim();
-    if (candidate.startsWith("v")) {
+    if (candidate.startsWith("v") || candidate.startsWith("V")) {
         candidate = candidate.slice(1);
     }
     return candidate.includes("-");
@@ -41,32 +89,26 @@ export function toPep440(version) {
     if (!candidate) {
         throw new Error("version must be a non-empty string");
     }
-    const match = PEP440_TAG_RE.exec(candidate);
-    if (match?.groups === undefined) {
+    const parsed = parseReleaseTag(candidate);
+    if (parsed === null) {
         throw new Error(`Cannot normalize '${candidate}' to PEP 440: expected ` +
             "[v]X.Y.Z or [v]X.Y.Z-(rc|alpha|beta|test).N");
     }
-    const major = Number(match.groups.major);
-    const minor = Number(match.groups.minor);
-    const patch = Number(match.groups.patch);
-    const base = `${major}.${minor}.${patch}`;
-    const kind = match.groups.kind;
-    if (kind === undefined) {
+    const base = `${parsed.major}.${parsed.minor}.${parsed.patch}`;
+    if (parsed.kind === null)
         return base;
-    }
-    if (NON_PUBLISHABLE_KINDS.has(kind)) {
+    if (NON_PUBLISHABLE_KINDS.has(parsed.kind)) {
         throw new NonPublishableVersionError(`Version '${candidate}' carries non-publishable pre-release ` +
-            `tag '${kind}'.${match.groups.num} -- release pipeline MUST ` +
+            `tag '${parsed.kind}'.${parsed.num} -- release pipeline MUST ` +
             "skip pyproject.toml [project].version sync for this tag.");
     }
-    const pepKind = PRE_KIND_MAP[kind];
+    const pepKind = PRE_KIND_MAP[parsed.kind];
     if (pepKind === undefined) {
-        throw new Error(`Unmapped pre-release kind '${kind}' for version '${candidate}'; ` +
-            "add it to _PRE_KIND_MAP or _NON_PUBLISHABLE_KINDS to keep " +
-            "_PEP440_TAG_RE in lockstep with the publishability classifier.");
+        throw new Error(`Unmapped pre-release kind '${parsed.kind}' for version '${candidate}'; ` +
+            "add it to PRE_KIND_MAP or NON_PUBLISHABLE_KINDS to keep the parser " +
+            "in lockstep with the publishability classifier.");
     }
-    const pepNum = Number(match.groups.num);
-    return `${base}${pepKind}${pepNum}`;
+    return `${base}${pepKind}${parsed.num}`;
 }
 export function isPublishable(version) {
     try {
@@ -79,25 +121,19 @@ export function isPublishable(version) {
 }
 function publishableVersionSortKey(version) {
     const candidate = version.trim();
-    const match = PEP440_TAG_RE.exec(candidate);
-    if (match?.groups === undefined) {
-        throw new Error(`Cannot compare '${candidate}': expected ` + "[v]X.Y.Z or [v]X.Y.Z-(rc|alpha|beta).N");
+    const parsed = parseReleaseTag(candidate);
+    if (parsed === null) {
+        throw new Error(`Cannot compare '${candidate}': expected [v]X.Y.Z or [v]X.Y.Z-(rc|alpha|beta).N`);
     }
-    const kind = match.groups.kind ?? "";
-    if (NON_PUBLISHABLE_KINDS.has(kind)) {
-        throw new NonPublishableVersionError(`Version '${candidate}' carries non-publishable pre-release tag '${kind}'.${match.groups.num}.`);
+    if (parsed.kind !== null && NON_PUBLISHABLE_KINDS.has(parsed.kind)) {
+        throw new NonPublishableVersionError(`Version '${candidate}' carries non-publishable pre-release tag '${parsed.kind}'.${parsed.num}.`);
     }
+    const kind = parsed.kind ?? "";
     const rank = PRERELEASE_RANK[kind];
     if (rank === undefined) {
         throw new Error(`Cannot compare '${candidate}': unsupported pre-release kind '${kind}'.`);
     }
-    return [
-        Number(match.groups.major),
-        Number(match.groups.minor),
-        Number(match.groups.patch),
-        rank,
-        Number(match.groups.num ?? 0),
-    ];
+    return [parsed.major, parsed.minor, parsed.patch, rank, parsed.num ?? 0];
 }
 /** Compare two publishable Deft release versions using stable/prerelease ordering. */
 export function comparePublishableVersions(left, right) {

package/dist/release-e2e/entrypoint-worker.js

@@ -2,6 +2,7 @@ import { cmdRelease } from "../release/main.js";
 import { rollbackMain } from "./rollback-bridge.js";
 export function runWorkerEntrypoint(data) {
     process.env.DEFT_PROJECT_ROOT = data.cloneDir;
+    process.env.DEFT_RELEASE_E2E = "1";
     const stdoutChunks = [];
     const stderrChunks = [];
     const prevStdout = process.stdout.write.bind(process.stdout);

package/dist/release-e2e/entrypoint.js

@@ -3,9 +3,11 @@ import { sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { MessageChannel, receiveMessageOnPort, Worker } from "node:worker_threads";
 import { cmdRelease } from "../release/main.js";
+import { RELEASE_E2E_ENV } from "../release/skip-ci-incident.js";
 import { ENTRYPOINT_TIMEOUT_EXIT_CODE, EXIT_VIOLATION, RELEASE_ENTRYPOINT_TIMEOUT_SECONDS, ROLLBACK_ENTRYPOINT_TIMEOUT_SECONDS, } from "./constants.js";
 import { rollbackMain } from "./rollback-bridge.js";
 let activeRestoreOwner = null;
+let priorReleaseE2eEnv;
 /** @internal Test hook for restore-owner branch coverage. */
 export function restoreProcessStateForTest(restoreOwner, oldCwd, oldProjectRoot) {
     restoreProcessState(restoreOwner, oldCwd, oldProjectRoot);
@@ -22,9 +24,18 @@ function restoreProcessState(restoreOwner, oldCwd, oldProjectRoot) {
     else {
         process.env.DEFT_PROJECT_ROOT = oldProjectRoot;
     }
+    if (priorReleaseE2eEnv === undefined) {
+        delete process.env[RELEASE_E2E_ENV];
+    }
+    else {
+        process.env[RELEASE_E2E_ENV] = priorReleaseE2eEnv;
+    }
+    priorReleaseE2eEnv = undefined;
 }
 function activateProcessState(restoreOwner, cloneDir) {
     activeRestoreOwner = restoreOwner;
+    priorReleaseE2eEnv = process.env[RELEASE_E2E_ENV];
+    process.env[RELEASE_E2E_ENV] = "1";
     process.env.DEFT_PROJECT_ROOT = cloneDir;
     mkdirSync(cloneDir, { recursive: true });
     process.chdir(cloneDir);
@@ -223,6 +234,8 @@ export function defaultRollbackEntrypoint(argv) {
     return rollbackMain(argv);
 }
 export function dispatchTaskRelease(cloneDir, version, repo, seams = {}) {
+    // Rehearsal --skip-ci is permitted via DEFT_RELEASE_E2E (set in activateProcessState /
+    // worker), not a fake production --allow-skip-ci citation (#2652 Greptile).
     const argv = [version, "--repo", repo, "--skip-ci", "--skip-build", "--allow-vbrief-drift"];
     if (seams.releaseEntrypoint) {
         const code = seams.releaseEntrypoint(argv);

package/dist/review-monitor/constants.d.ts

@@ -0,0 +1,14 @@
+/** Deterministic review-monitor gate (#2655). Three-state exit contract. */
+export declare const EXIT_READY = 0;
+export declare const EXIT_NOT_READY = 1;
+export declare const EXIT_CONFIG_ERROR = 2;
+export declare const SCHEMA_VERSION = 1;
+export declare const REVIEW_MONITOR_FILENAME = "review-monitor.json";
+export declare const REVIEW_MONITOR_RELPATH: readonly [".deft", "review-monitor.json"];
+export declare const MONITORING_TIER_1 = 1;
+export declare const MONITORING_TIER_2 = 2;
+export declare const MONITORING_TIER_3 = 3;
+export declare const DEFAULT_STALE_MINUTES = 30;
+export declare const REVIEW_MONITOR_HELP: string;
+export declare const REGISTER_HELP: string;
+//# sourceMappingURL=constants.d.ts.map

package/dist/review-monitor/constants.js

@@ -0,0 +1,55 @@
+/** Deterministic review-monitor gate (#2655). Three-state exit contract. */
+export const EXIT_READY = 0;
+export const EXIT_NOT_READY = 1;
+export const EXIT_CONFIG_ERROR = 2;
+export const SCHEMA_VERSION = 1;
+export const REVIEW_MONITOR_FILENAME = "review-monitor.json";
+export const REVIEW_MONITOR_RELPATH = [".deft", REVIEW_MONITOR_FILENAME];
+export const MONITORING_TIER_1 = 1;
+export const MONITORING_TIER_2 = 2;
+export const MONITORING_TIER_3 = 3;
+export const DEFAULT_STALE_MINUTES = 30;
+export const REVIEW_MONITOR_HELP = "usage: task verify:review-monitor -- --pr <N> [options]\n" +
+    "\n" +
+    "Fail-closed gate: when Tier 1 (sub-agent primitive available), require a\n" +
+    "recorded active review-monitor before the parent may yield, Approach-3\n" +
+    "sleep-poll, or claim review ownership (#2655).\n" +
+    "\n" +
+    "options:\n" +
+    "  -h, --help                 Show this help and exit 0\n" +
+    "  --pr N                     Pull request number (required unless --help)\n" +
+    "  --repo OWNER/REPO          Repository (optional audit field)\n" +
+    "  --head-sha SHA             Expected HEAD SHA (optional freshness check)\n" +
+    "  --project-root PATH        Project root (default: cwd)\n" +
+    "  --call-site SITE           solo | swarm-phase5-6 | swarm-phase6-cascade\n" +
+    "  --approach3                Assert Approach 3 (blocking poll) intent\n" +
+    "  --approach3-warned         User acknowledged Approach 3 warning (Tier 3 only)\n" +
+    "  --json                     Emit structured JSON on stdout\n" +
+    "\n" +
+    "exit codes:\n" +
+    "  0  READY       Tier 1 monitor recorded, or Tier 3 Approach 3 with warning ack\n" +
+    "  1  NOT READY   Tier 1 without monitor, or Approach 3 blocked on Tier 1\n" +
+    "  2  CONFIG      Usage / path / unreadable state error\n" +
+    "\n" +
+    "Register a monitor after spawning Approach 1:\n" +
+    "  task review-monitor:register -- --pr <N> --monitor-agent-id <id> \\\n" +
+    "    --platform-primitive cursor-task|spawn_subagent|start_agent \\\n" +
+    "    [--head-sha SHA] [--repo OWNER/REPO]\n";
+export const REGISTER_HELP = "usage: task review-monitor:register -- --pr <N> --monitor-agent-id <id> \\\n" +
+    "       --platform-primitive <primitive> [options]\n" +
+    "\n" +
+    "Record an active review-monitor after spawning an Approach 1 poller (#2655).\n" +
+    "\n" +
+    "required:\n" +
+    "  --pr N                     Pull request number\n" +
+    "  --monitor-agent-id ID      Stable poller agent id / Task handle\n" +
+    "  --platform-primitive P     start_agent | spawn_subagent | cursor-task\n" +
+    "\n" +
+    "options:\n" +
+    "  --repo OWNER/REPO          Repository\n" +
+    "  --head-sha SHA             HEAD SHA at monitor start\n" +
+    "  --project-root PATH        Project root (default: cwd)\n" +
+    "  --parent-session-id ID     Optional parent ritual / session id\n" +
+    "\n" +
+    "exit codes: 0 registered / 2 config error\n";
+//# sourceMappingURL=constants.js.map

package/dist/review-monitor/index.d.ts

@@ -0,0 +1,5 @@
+export * from "./constants.js";
+export * from "./record.js";
+export * from "./tier-detection.js";
+export * from "./verify.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/review-monitor/index.js

@@ -0,0 +1,5 @@
+export * from "./constants.js";
+export * from "./record.js";
+export * from "./tier-detection.js";
+export * from "./verify.js";
+//# sourceMappingURL=index.js.map