@event4u/agent-config 14.14.0 → 14.14.1

package/src/scripts/lint_code_comments.ts

@@ -353,6 +353,107 @@ function changedFiles(root: string, base: string): string[] {
     return [...new Set([...tracked, ...untracked, ...dirty])].filter((f) => f.trim().length > 0);
 }
 
+/**
+ * Line numbers this diff ADDED, per file. `'all'` for an untracked file, whose
+ * every line is new.
+ *
+ * The gate is described in `.github/workflows/rule-backstops.yml` as
+ * *"diff-scoped, so a pre-existing tree does not turn red"*, and selecting the
+ * FILE set from the diff while scanning each file WHOLE only delivers that for
+ * files nobody touches. Measured 2026-09-02 on PR #1813, which added no
+ * flagged comment at all and was refused on eleven legacy lines — four
+ * provenance paths and seven box rules — in four files it edited for unrelated
+ * reasons. A gate that reds on debt in any file you open makes every edit to an
+ * old file carry an unbounded comment sweep, and the escape it offers per line
+ * turns into exactly the allowlist growth `autonomous-execution` forbids.
+ *
+ * Teeth are unchanged where they belong: a comment the diff writes is scanned
+ * on the line it writes. The explicit-path mode (`--files`) stays whole-file,
+ * because a caller naming a path is asking for that file, not for a diff.
+ *
+ * Parsed from `--unified=0` hunk headers rather than from a patch body: the
+ * header carries the post-image start and count directly, so no line of added
+ * content has to be counted by hand.
+ */
+export function addedLineMap(root: string, base: string): Map<string, Set<number> | 'all'> {
+    const out = new Map<string, Set<number> | 'all'>();
+    const u = spawnSync('git', ['ls-files', '--others', '--exclude-standard'], {
+        cwd: root, encoding: 'utf-8',
+    });
+    if (u.status === 0) {
+        for (const f of u.stdout.split('\n')) {
+            if (f.trim()) out.set(f.trim(), 'all');
+        }
+    }
+    for (const argv of [
+        ['diff', '--unified=0', '--diff-filter=ACMR', `${base}...HEAD`],
+        ['diff', '--unified=0', '--diff-filter=ACMR'],
+    ]) {
+        const r = spawnSync('git', argv, { cwd: root, encoding: 'utf-8' });
+        if (r.status !== 0) continue;
+        mergeAddedLines(out, parseAddedLines(r.stdout));
+    }
+    return out;
+}
+
+/**
+ * Added line numbers per file, from a `git diff --unified=0` patch.
+ *
+ * Split out from the git call so the parse is testable without a repository
+ * whose diff the test would have to manufacture. A `@@` header with no count
+ * means one line — `@@ -4 +4 @@` — and a `+++ /dev/null` header is a deletion,
+ * which adds nothing.
+ */
+export function parseAddedLines(diffText: string): Map<string, Set<number>> {
+    const out = new Map<string, Set<number>>();
+    let file: string | null = null;
+    for (const line of diffText.split('\n')) {
+        if (line.startsWith('+++ ')) {
+            const p = line.slice(4).trim();
+            file = p === '/dev/null' ? null : p.replace(/^b\//, '');
+            continue;
+        }
+        if (!file || !line.startsWith('@@')) continue;
+        const m = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,(\d+))? @@/.exec(line);
+        if (!m) continue;
+        const start = Number.parseInt(m[1] as string, 10);
+        const count = m[2] === undefined ? 1 : Number.parseInt(m[2], 10);
+        const set = out.get(file) ?? new Set<number>();
+        for (let n = start; n < start + count; n += 1) set.add(n);
+        out.set(file, set);
+    }
+    return out;
+}
+
+/** Fold one parsed patch into the accumulator; `'all'` always wins. */
+function mergeAddedLines(
+    into: Map<string, Set<number> | 'all'>,
+    from: Map<string, Set<number>>,
+): void {
+    for (const [file, lines] of from) {
+        const prev = into.get(file);
+        if (prev === 'all') continue;
+        const set = prev ?? new Set<number>();
+        for (const n of lines) set.add(n);
+        into.set(file, set);
+    }
+}
+
+/**
+ * Findings the diff is answerable for: those sitting on a line it added.
+ *
+ * `'all'` (an untracked file) keeps everything, `undefined` (a file the diff
+ * did not touch) keeps nothing — the two ends of the same rule.
+ */
+export function findingsOnAddedLines(
+    findings: readonly CommentFinding[],
+    lines: Set<number> | 'all' | undefined,
+): CommentFinding[] {
+    if (lines === undefined) return [];
+    if (lines === 'all') return [...findings];
+    return findings.filter((f) => lines.has(f.line));
+}
+
 /** One fixture: a file body and the classes the gate must report on it. */
 export interface CommentCase {
     /** Printed by both consumers, so it reads as the assertion it makes. */
@@ -575,12 +676,16 @@ export function main(argv: string[]): number {
     if (!base && explicit.length === 0) { process.stderr.write('--base needs a ref\n'); return 1; }
 
     const candidates = (explicit.length > 0 ? explicit : changedFiles(root, base)).filter(isScannable);
+    // Whole file when a caller named the path; only the lines the diff added
+    // when the scope IS the diff — see `addedLineMap` for the measured reason.
+    const added = explicit.length > 0 ? null : addedLineMap(root, base);
     const findings: CommentFinding[] = [];
     for (const rel of candidates) {
         const abs = path.isAbsolute(rel) ? rel : path.join(root, rel);
         let text: string;
         try { text = fs.readFileSync(abs, 'utf-8'); } catch { continue; }
-        findings.push(...scanText(rel, text));
+        const all = scanText(rel, text);
+        findings.push(...(added ? findingsOnAddedLines(all, added.get(rel)) : all));
     }
 
     try {

package/src/scripts/release_drill.ts

@@ -122,6 +122,20 @@ interface WorldConfig {
      * its own, because a marker otherwise stops the run at step 8.
      */
     tag_already_remote?: boolean;
+    /**
+     * The release PR is ALREADY merged when the run starts — the real
+     * resume-after-merge state, in which steps 1 through 7 skip and step 8 is
+     * the first step that does work.
+     *
+     * Added 2026-09-02 with `guard_release_branch_push`. Before that guard, a
+     * marker scenario could start from scratch and still reach step 8, because
+     * nothing between the changelog write and the tag looked at the section.
+     * The push guard now stops such a run at step 4 — correctly, and that is
+     * the point of it — which makes this knob the only way left to exercise
+     * the tag and Release guards on their own. It is not a bypass: the state
+     * it fakes is one every resumed release actually passes through.
+     */
+    pr_already_merged?: boolean;
 }
 
 /**
@@ -206,6 +220,7 @@ class FakeWorld {
         this.merge_races_once = cfg.merge_races_once ?? false;
         this.merge_fails_hard = cfg.merge_fails_hard ?? false;
         this.checks_fail = cfg.checks_fail ?? false;
+        this.pr_merged = cfg.pr_already_merged ?? false;
     }
 
     exec(args: readonly string[]): ExecResult {
@@ -375,10 +390,49 @@ function _count(world: FakeWorld, needle: string): number {
 }
 
 const SCENARIOS: Record<string, Scenario> = {
+    'marker-refuses-before-branch-push': {
+        summary:
+            'step 4: a draft marker refuses the branch push — the first remote state — so no PR is ever opened',
+        config: { changelog_file: markedChangelogFixture(current_version()) },
+        expect_success: false,
+        verify: (w, err) => {
+            const f: string[] = [];
+            _expect(
+                (err ?? '').includes(`refusing to push ${w.branch}`),
+                `died for the wrong reason: ${err ?? '(no error)'}`,
+                f,
+            );
+            // The load-bearing assertions are about what did NOT happen. Each
+            // one is a remote side effect the 14.14.0 run actually produced
+            // before this guard existed: a pushed branch, an open PR, and a
+            // check watch on a check that could not pass.
+            _expect(
+                !w.calls.includes(`git push -u origin ${w.branch}`),
+                'the branch was pushed after the refusal',
+                f,
+            );
+            _expect(
+                !w.calls.some((c) => c.startsWith('gh pr create')),
+                'a pull request was opened after the refusal',
+                f,
+            );
+            _expect(
+                !w.calls.some((c) => c.includes('--watch')),
+                'CI was waited on after the refusal',
+                f,
+            );
+            _expect(!w.tag_local && !w.tag_remote, 'a tag exists after the refusal', f);
+            _expect(!w.release_created, 'a GitHub Release was created after the refusal', f);
+            return f;
+        },
+    },
     'marker-refuses-before-tag': {
         summary:
             'step 8: a draft marker in the merged section refuses BEFORE the annotated tag is created',
-        config: { changelog_file: markedChangelogFixture(current_version()) },
+        config: {
+            pr_already_merged: true,
+            changelog_file: markedChangelogFixture(current_version()),
+        },
         expect_success: false,
         verify: (w, err) => {
             const f: string[] = [];
@@ -403,6 +457,7 @@ const SCENARIOS: Record<string, Scenario> = {
         summary:
             'step 8 (§ 3.2): a tag created but never pushed is NOT pushed when its section carries the marker',
         config: {
+            pr_already_merged: true,
             tag_created_unpushed: true,
             changelog_file: markedChangelogFixture(current_version()),
         },
@@ -431,6 +486,7 @@ const SCENARIOS: Record<string, Scenario> = {
         summary:
             'step 9: with the tag already pushed, a marker in the TAGGED section refuses before the Release is created',
         config: {
+            pr_already_merged: true,
             tag_already_remote: true,
             changelog: markedChangelogFixture(current_version()),
             changelog_file: markedChangelogFixture(current_version()),

package/src/scripts/release_publication.ts

@@ -422,7 +422,65 @@ export function _is_non_fast_forward(stderr: string, stdout: string): boolean {
     return /(non-fast-forward|fetch first|behind its remote counterpart)/i.test(text);
 }
 
+/**
+ * Refuse the FIRST remote state of a release whose section is not publishable.
+ *
+ * The fourth guard site, and the one the other three structurally cannot cover.
+ * They sit at the irreversible transitions — annotated tag, resumed tag push,
+ * GitHub Release body — and every one of them is DOWNSTREAM of `gh pr create`
+ * and of `gh pr checks --watch`. `check_release_highlights` refuses the same
+ * section from the other side, on the release PR, so a run whose head is still
+ * the generator's draft pushed a branch, opened a PR, burned CI, waited on a
+ * check that could not pass, and died there — leaving a half-open release to
+ * clean up by hand.
+ *
+ * That is not a hypothetical: it is PR #1812 (14.14.0, 2026-09-02), and the
+ * 2026-09-01 flip's own risk register pre-registered it as Risk 1 — *"the flip
+ * reds the next release PR on its first run"*. Its stated mitigation was that
+ * the releaser edits prose before merge; nothing in the pipeline asked, so
+ * nothing did.
+ *
+ * The branch push is the first thing in the pipeline that leaves the machine,
+ * so a refusal here costs one local edit and no remote state at all: no branch
+ * on the remote, no pull request, no CI minutes, no tag. It sits at the push
+ * CALL SITE rather than in a formatter for the reason the publication guards
+ * already state — a formatter has no notion of whether it is publishing, and
+ * the call site is the one that can still stop. Deriving the version from
+ * `release/X.Y.Z` mirrors what `release-validation.yml` already does with
+ * `head_ref`.
+ *
+ * Two states pass unguarded, deliberately: a branch that is not
+ * `release/X.Y.Z` (nothing about a release to read), and a version with no
+ * changelog section (the missing-section refusal belongs to the publication
+ * sites, which need a section to publish; refusing here would break every
+ * non-release push through this helper).
+ */
+export function guard_release_branch_push(branch: string): void {
+    const prefix = 'release/';
+    if (!branch.startsWith(prefix)) {
+        return;
+    }
+    const version = branch.slice(prefix.length);
+    const section = extract_changelog_section(read_changelog_text(), version);
+    if (!section) {
+        return;
+    }
+    const blockers = publication_blockers(section.body, version, `\`${branch}\``);
+    if (blockers.length === 0) {
+        return;
+    }
+    die(
+        `refusing to push ${branch} — the ${version} changelog section is not publishable ` +
+            `(${String(blockers.length)} blocker(s)):\n` +
+            blockers.map((b) => `    - ${b}`).join('\n') +
+            `\n    Nothing has left this machine: no branch on ${REMOTE}, no pull request, no tag.\n` +
+            '    Curate the `### Release highlights` head in CHANGELOG.md under ' +
+            `\`## [${version}]\`, then re-run \`task release -- --resume\`.`,
+    );
+}
+
 function push_release_branch(branch: string): void {
+    guard_release_branch_push(branch);
     const first = run(['git', 'push', '-u', REMOTE, branch], { check: false, capture: true });
     if (first.returncode === 0) {
         process.stdout.write(first.stdout);

package/src/scripts/roadmap_context.ts

@@ -49,6 +49,7 @@ import { fileURLToPath } from 'node:url';
 import { gitEnv } from './_lib/git_env.js';
 import { read_live_records, register_dir } from './_lib/session_register.js';
 import { other_worktree_branches_detailed } from './sessions_cli.js';
+import { recordContextObservation } from './_lib/context_observation.js';
 
 /** One open pull request, with the file set it changes. */
 export interface PullRequestInfo {
@@ -746,6 +747,20 @@ export function main(argv: string[] = process.argv.slice(2)): number {
         roadmap: at('--roadmap'),
         ...(ownedFile !== null ? { ownedPaths: readOwnedPathsFile(ownedFile) } : {}),
     });
+    // `road-to-wired-instruments` 2.1 — this probe is the only thing in the tree
+    // that can OBSERVE the world (it costs a `gh` call), so it records what it
+    // saw where a Stop-path concern can read it without spawning anything. The
+    // continuation ladder's premise rung is the consumer; the resume checkpoint
+    // is the other.
+    //
+    // Only a LIVE reading is recorded. Offline, `contextFingerprint` still
+    // returns a digest — over a null base and an empty PR list — and that digest
+    // is a statement about the network, not about the repository. Recording it
+    // would make every offline probe look like a moved premise, which is a false
+    // halt manufactured out of a dropped connection.
+    if (ctx.network === 'live') {
+        recordContextObservation(root, ctx.roadmap ?? '', ctx.fingerprint);
+    }
     if (argv.includes('--fingerprint')) {
         // Just the digest, for the loop's phase-boundary comparison and for the
         // resume checkpoint's `context_fingerprint` (§ 5.6 — same value).