@event4u/agent-config 16.4.0 → 17.0.0

package/src/scripts/ratification_subject.ts

@@ -0,0 +1,176 @@
+#!/usr/bin/env tsx
+/**
+ * ratification_subject — print the `subject:` digest a ratification record must
+ * carry to answer for a given change.
+ *
+ * The record's six original fields say WHO reviewed and never WHAT, so a gated
+ * file edited after its review still landed under that review's record. The
+ * `subject` digest is what closes that, and it has to be the SAME digest the
+ * gate recomputes — which is why this prints it by calling
+ * `check_kernel_edit_ratified.expectedSubjectFor` rather than by re-deriving a
+ * second reading of which files are gated. A writer with its own list would
+ * disagree with the gate exactly on the changes that widen the gated set, which
+ * are the changes a record most needs to be right about.
+ *
+ * Usage: ratification_subject --files <path> [<path> …] [--root DIR] [--rev REV]
+ *        [--base-ref REF] [--quiet]
+ *
+ * `--base-ref` names the base the gate's local run reads the dispatcher closure
+ * from (default: the gate's own default, `origin/main` first). It matters only
+ * when `--root` is this checkout; pass the same ref the gate is given.
+ *
+ * `--files` takes the change's WHOLE changed-file list, not its gated subset:
+ * which of them are gated is the gate's decision, not the caller's, and passing
+ * a pre-filtered list is how a caller silently substitutes its own classifier.
+ * Ungated paths are ignored, so `git diff --name-only <base>...HEAD` is the
+ * intended input.
+ *
+ * `--rev` names the commit the digest is taken at (default `HEAD`). The content
+ * is read from Git objects at that commit, never from the working tree, so the
+ * digest is of what is committed — commit first, then print the digest, and
+ * name the same commit the reviewers were shown.
+ *
+ * `--quiet` prints the digest alone; over an empty gated set it also warns on
+ * stderr that the digest covers nothing.
+ *
+ * Exit codes: 0 = digest printed · 1 = refused: the revision does not resolve,
+ * git cannot run or read it, or a gated path escapes the tree or is not absent
+ * or a regular file in that commit (nothing on stdout) · 2 = usage error.
+ */
+
+import * as path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+import { expectedSubjectFor } from './check_kernel_edit_ratified.js';
+import { DEFAULT_REVISION, GatedSubjectRefusal, optionValue } from './_lib/ratification_subject.js';
+
+const _HERE = fileURLToPath(import.meta.url);
+const REPO = path.resolve(path.dirname(_HERE), '..', '..');
+
+export function main(argv: readonly string[] = process.argv.slice(2)): number {
+    const files: string[] = [];
+    let root = REPO;
+    let revision = DEFAULT_REVISION;
+    let baseRef: string | null = null;
+    let collecting = false;
+    let quiet = false;
+
+    for (let i = 0; i < argv.length; i += 1) {
+        const a = argv[i] ?? '';
+        if (a === '--files') {
+            collecting = true;
+            continue;
+        }
+        if (a === '--root') {
+            // A missing value used to resolve `.` silently. For a command whose
+            // output is copied into a governance record, "it quietly used the
+            // current directory" is the wrong failure: the digest would be
+            // taken over a tree the caller never named.
+            const value = optionValue(argv, i);
+            if (value === null) {
+                process.stderr.write('error: --root takes a directory\n');
+                return 2;
+            }
+            root = path.resolve(value);
+            i += 1;
+            collecting = false;
+            continue;
+        }
+        if (a === '--rev') {
+            const value = optionValue(argv, i);
+            if (value === null) {
+                process.stderr.write('error: --rev takes a revision\n');
+                return 2;
+            }
+            revision = value;
+            i += 1;
+            collecting = false;
+            continue;
+        }
+        if (a === '--base-ref') {
+            const value = optionValue(argv, i);
+            if (value === null) {
+                process.stderr.write('error: --base-ref takes a revision\n');
+                return 2;
+            }
+            baseRef = value;
+            i += 1;
+            collecting = false;
+            continue;
+        }
+        if (a === '--quiet') {
+            quiet = true;
+            collecting = false;
+            continue;
+        }
+        if (a.startsWith('--')) {
+            process.stderr.write(`error: unknown argument ${a}\n`);
+            return 2;
+        }
+        if (!collecting) {
+            process.stderr.write(`error: stray argument ${a} — paths follow --files\n`);
+            return 2;
+        }
+        files.push(a);
+    }
+
+    if (files.length === 0) {
+        process.stderr.write(
+            'usage: ratification_subject --files <path> [<path> …] [--root DIR] [--rev REV] ' +
+                '[--base-ref REF] [--quiet]\n' +
+                '       pass the whole changed-file list; the gated subset is this gate’s decision\n',
+        );
+        return 2;
+    }
+
+    // ONE call for both halves, so the printed list is the list the digest
+    // covers. Every refusal of the subject computation is one class and is
+    // caught here as it is in the gate; anything else is a defect in this
+    // file and stays a crash.
+    let digest: string;
+    let gated: readonly string[];
+    let commit: string | null;
+    try {
+        ({ digest, gatedFiles: gated, revision: commit } = expectedSubjectFor(files, root, revision, baseRef));
+    } catch (err) {
+        if (!(err instanceof GatedSubjectRefusal)) {
+            throw err;
+        }
+        process.stderr.write(`error: ${err.message}\n`);
+        return 1;
+    }
+
+    // A digest over an empty list is a well-formed 64 hex characters and says
+    // nothing, so a caller who mistyped a path would otherwise copy a
+    // confident-looking answer about no files at all. The full output lists
+    // the coverage; `--quiet` drops the list, so it says so on stderr instead.
+    if (quiet) {
+        if (gated.length === 0) {
+            process.stderr.write(
+                'warning: no gated file in this change — this digest covers nothing, ' +
+                    'and no record is owed\n',
+            );
+        }
+        process.stdout.write(`${digest}\n`);
+        return 0;
+    }
+
+    process.stdout.write(`subject: ${digest}\n`);
+    process.stdout.write(
+        `revision: ${commit ?? '(none read — nothing in this change is gated)'}\n`,
+    );
+    process.stdout.write(`\ngated files covered (${String(gated.length)}):\n`);
+    if (gated.length === 0) {
+        process.stdout.write(
+            '  (none — nothing in this change is gated, so no record is owed)\n',
+        );
+    }
+    for (const g of gated) {
+        process.stdout.write(`  · ${g}\n`);
+    }
+    return 0;
+}
+
+if (process.argv[1] !== undefined && import.meta.url === pathToFileURL(process.argv[1]).href) {
+    process.exit(main());
+}

package/src/scripts/rdp_gate_classify.ts

@@ -1,4 +1,5 @@
 #!/usr/bin/env tsx
+// egress-content: fixed-corpus — sends the labelled classification corpus named by --corpus, never session content
 /**
  * RDP gate-time classification validation (road-to-rdp-frontier-polish Phase 1).
  *

package/src/scripts/rdp_quality_eval.ts

@@ -1,4 +1,5 @@
 #!/usr/bin/env tsx
+// egress-content: fixed-corpus — sends the RDP quality corpus (corpus-prompts.json or --corpus), never session content
 /**
  * RDP quality-layer + L6-isolation eval runner (TypeScript).
  *

package/src/scripts/release.ts

@@ -125,6 +125,8 @@ import {
     derive_head_prefill,
 } from './_lib/release_highlights.js';
 import { canPrompt, promptLine } from './_lib/tty_prompt.js';
+import type { CommitRecord, ImpactTrailers } from './_lib/consumer_impact.js';
+import { COMMIT_LOG_FORMAT, NO_IMPACT_TRAILERS, is_breaking_commit, parse_commit_log, parse_impact_trailers, write_impact_map } from './_lib/consumer_impact.js';
 import { preflightPosition } from './_lib/release_position.js';
 import { settleFindingsLedger } from './_lib/release_findings_ingest.js';
 import { TAG_TRIGGERED_WORKFLOWS, dispatchTagWorkflows } from './_lib/release_tag_dispatch.js';
@@ -140,6 +142,7 @@ import {
     assert_scheduled_deprecations_clear,
 } from './_lib/release_migration_gate.js';
 import { releaseHoldPreflight } from './_lib/release_holds.js';
+import { assert_settings_surface_delta, writeReleasedSurface } from './_lib/release_settings_surface.js';
 
 // `__doc__.splitlines()[0]` in `_parse_args` — the argparse description. Kept
 // as a referenceable constant so the first docstring line is preserved exactly.
@@ -168,6 +171,7 @@ import {
     SystemExitError,
     set_augment_manifest_version,
     set_marketplace_version,
+    set_template_pin,
     _rstrip,
     _splitlines,
 } from './release_env.js';
@@ -302,9 +306,9 @@ export { RELEASE_HEAD_CAP_LINES } from './_lib/release_material.js';
  * same shared classifier — so a degraded run surfaces as the gate's ordinary
  * "fill the head" message instead of a crash mid-release.
  */
-function _derive_head_prefill(prev: string | null): Record<string, string> {
+function _derive_head_prefill(prev: string | null, version?: string): Record<string, string> {
     try {
-        return derive_head_prefill(prev, 'HEAD', REPO_ROOT);
+        return derive_head_prefill(prev, 'HEAD', REPO_ROOT, version);
     } catch (err) {
         process.stderr.write(
             `warning: could not derive release-head highlights (${(err as Error).message}); ` +
@@ -384,6 +388,7 @@ class Commit {
         public readonly scope: string | null,
         public readonly subject: string,
         public readonly breaking: boolean,
+        public readonly trailers: ImpactTrailers = NO_IMPACT_TRAILERS,
     ) {}
 }
 
@@ -443,33 +448,18 @@ function bump_version(current: string, kind: string): string {
 /** Return non-merge commits after `tag` (or all of history if tag is null). */
 function commits_since(tag: string | null): Commit[] {
     const rev = tag ? `${tag}..HEAD` : 'HEAD';
-    const raw = git(['log', rev, '--no-merges', '--format=%H%x1f%s'], { capture: true });
-    const out: Commit[] = [];
-    for (const line of raw.split('\n')) {
-        if (!line.includes('\x1f')) {
-            continue;
-        }
-        // str.split("\x1f", 1) — maxsplit=1: head + remainder.
-        const idx = line.indexOf('\x1f');
-        const sha = line.slice(0, idx);
-        const subject = line.slice(idx + 1);
-        const m = CONVENTIONAL_RE.exec(subject);
-        if (!m) {
-            out.push(new Commit(sha, 'other', null, subject, false));
-            continue;
-        }
-        const breaking = Boolean(m.groups!['bang']) || subject.includes('BREAKING CHANGE');
-        out.push(
-            new Commit(
-                sha,
-                m.groups!['type'] as string,
-                (m.groups!['scope'] ?? null) as string | null,
-                m.groups!['subject'] as string,
-                breaking,
-            ),
-        );
-    }
-    return out;
+    const raw = git(['log', rev, '--no-merges', `--format=${COMMIT_LOG_FORMAT}`], { capture: true });
+    return parse_commit_log(raw).map(commit_from_record);
+}
+
+/** One log record → `Commit`, with its `Consumer-Impact:` trailer read in the same pass. */
+function commit_from_record({ sha, subject, body }: CommitRecord): Commit {
+    const trailers = parse_impact_trailers(body);
+    const m = CONVENTIONAL_RE.exec(subject);
+    if (!m) return new Commit(sha, 'other', null, subject, is_breaking_commit(subject, body), trailers);
+    const breaking = is_breaking_commit(subject, body, Boolean(m.groups!['bang']));
+    const scope = (m.groups!['scope'] ?? null) as string | null;
+    return new Commit(sha, m.groups!['type'] as string, scope, m.groups!['subject'] as string, breaking, trailers);
 }
 
 /** Derive the semver bump from commit types (for preview only). */
@@ -640,9 +630,10 @@ function prepend_changelog(p: string, entry: string): void {
 // ─── file mutations ───────────────────────────────────────────────────────────
 
 /** Update the top-level `version` field; preserve 4-space indentation. */
-function set_package_version(p: string, version: string): void {
+function set_package_version(p: string, version: string, commits: readonly Commit[] = []): void {
     const data = JSON.parse(fs.readFileSync(p, 'utf-8')) as Record<string, unknown>;
     data['version'] = version;
+    write_impact_map(data, version, commits);
     fs.writeFileSync(p, jsonDumpsIndent(data, 4) + '\n', 'utf-8');
 }
 
@@ -674,29 +665,6 @@ function set_lockfile_version(p: string, version: string): void {
     fs.writeFileSync(p, jsonDumpsIndent(data, 4) + '\n', 'utf-8');
 }
 
-function set_template_pin(p: string, version: string): void {
-    // Rewrite the single `agent_config_version:` line in place, preserving the
-    // rest of the YAML byte-for-byte. Quoted value to match the existing pin
-    // style and check_template_pin_drift's tolerant parse.
-    const text = fs.readFileSync(p, 'utf-8');
-    const lines = text.split('\n');
-    let found = false;
-    for (let i = 0; i < lines.length; i += 1) {
-        if (/^\s*agent_config_version\s*:/.test(lines[i]!)) {
-            lines[i] = lines[i]!.replace(
-                /^(\s*agent_config_version\s*:\s*).*/,
-                `$1"${version}"`,
-            );
-            found = true;
-            break;
-        }
-    }
-    if (!found) {
-        die(`set_template_pin: no \`agent_config_version:\` line in ${p}`);
-    }
-    fs.writeFileSync(p, lines.join('\n'), 'utf-8');
-}
-
 // ─── preflight ────────────────────────────────────────────────────────────────
 
 /**
@@ -968,12 +936,13 @@ function execute(
                 total,
                 'Bump package.json + package-lock.json + marketplace manifests + template pin, prepend CHANGELOG',
             );
-            set_package_version(PACKAGE_JSON, plan.target);
+            set_package_version(PACKAGE_JSON, plan.target, plan.commits);
             set_lockfile_version(PACKAGE_LOCK_JSON, plan.target);
             set_marketplace_version(MARKETPLACE_JSON, plan.target);
             set_augment_manifest_version(AUGMENT_PLUGIN_JSON, plan.target);
             set_augment_manifest_version(AUGMENT_MARKETPLACE_JSON, plan.target);
             set_template_pin(PROJECT_TEMPLATE, plan.target);
+            writeReleasedSurface(plan.target);
             prepend_changelog(CHANGELOG, plan.changelog_entry);
         }
 
@@ -1583,10 +1552,11 @@ function main(argv: readonly string[] | null = null): number {
     // 120-commit span, paid 3-4× per release. Not the ~25 ms of the line above.
     const [full, body] = render_changelog_entry(target, prev, commits, today, {
         test_trend_line,
-        head: _derive_head_prefill(prev),
+        head: _derive_head_prefill(prev, target),
         mix: measure_mix_obligation(target, prev),
     });
     assert_major_migration_section(target, full, { previewOnly: args.dry_run });
+    assert_settings_surface_delta(target, { previewOnly: args.dry_run });
 
     // Era-split planning — gate on the POST-release view (2026-07-07 fix).
     // The drift test measures the era AFTER this release's section is
@@ -1690,6 +1660,7 @@ export {
     parse_version,
     bump_version,
     commits_since,
+    commit_from_record,
     infer_bump,
     assert_major_migration_section,
     assert_scheduled_deprecations_clear,

package/src/scripts/release_drill.ts

@@ -22,11 +22,13 @@
  *     runs them all and prints one ✅/❌ line per scenario.
  *
  * The drill never touches git, gh, npm, or the filesystem outside reading
- * package.json (execute()'s own resume-mode bump-skip probe).
+ * package.json (execute()'s own resume-mode bump-skip probe); step 2's bump
+ * writes land in memory (`_install_step_2_overlay`).
  */
 
 import * as fs from 'node:fs';
 import * as os from 'node:os';
+import { createRequire, syncBuiltinESMExports } from 'node:module';
 import * as path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
@@ -39,6 +41,7 @@ import {
     SystemExitError,
 } from './release.js';
 import { releaseHoldPreflight } from './_lib/release_holds.js';
+import { SETTINGS_SURFACE_FIXTURE } from './_lib/release_settings_surface.js';
 import { die } from './release_publication.js';
 import { DERIVED_MARKER } from './_lib/release_highlights.js';
 import {
@@ -52,7 +55,7 @@ import {
 } from './release_env.js';
 
 /**
- * The files step 2 mutates on disk, snapshotted around every scenario.
+ * The files step 2 mutates on disk, diverted into memory for every scenario.
  *
  * The FakeWorld intercepts COMMANDS, not `fs` writes, and step 2's bump is
  * seven direct writes. Every scenario before 2026-09-03 passed `--resume` with
@@ -61,10 +64,17 @@ import {
  * reached the writing arm. The first `resume: false` scenario appended twelve
  * `## 14.15.0` headings to the REAL `CHANGELOG.md`.
  *
- * Snapshot-and-restore rather than a writer seam: a seam means threading an
- * injection point through seven call sites in `release.ts`, which sits past the
- * 1500-line cap where every line is charged. This is contained to the runner
- * and covers any future scenario without further thought.
+ * Snapshot-and-restore fixed the end state and not the window: `writeFileSync`
+ * truncates before it writes, so every other vitest worker could read these
+ * files empty or bumped mid-scenario. CI run 38555715168 (job 115824218308)
+ * failed to collect an unrelated suite on `package.json: File is empty`, 160 ms
+ * before this drill finished in the same shard. So the writes never reach the
+ * disk: reads and writes of exactly these paths go to an in-memory overlay.
+ *
+ * Patched on the CJS `fs` object and pushed to the ESM namespace with
+ * `syncBuiltinESMExports`, rather than through a writer seam: a seam means
+ * threading an injection point through seven call sites in `release.ts`, which
+ * sits past the 1500-line cap where every line is charged.
  */
 const _MUTATED_BY_STEP_2: readonly string[] = [
     CHANGELOG,
@@ -74,24 +84,43 @@ const _MUTATED_BY_STEP_2: readonly string[] = [
     AUGMENT_PLUGIN_JSON,
     AUGMENT_MARKETPLACE_JSON,
     PROJECT_TEMPLATE,
+    SETTINGS_SURFACE_FIXTURE,
 ];
 
-function _snapshot_step_2_files(): Map<string, string> {
-    const snap = new Map<string, string>();
-    for (const f of _MUTATED_BY_STEP_2) {
-        if (fs.existsSync(f)) {
-            snap.set(f, fs.readFileSync(f, 'utf-8'));
-        }
-    }
-    return snap;
-}
+const _fs_cjs = createRequire(import.meta.url)('node:fs') as typeof fs;
 
-function _restore_step_2_files(snap: ReadonlyMap<string, string>): void {
-    for (const [f, content] of snap) {
-        if (fs.readFileSync(f, 'utf-8') !== content) {
-            fs.writeFileSync(f, content);
-        }
-    }
+/** Divert step 2's reads and writes of `_MUTATED_BY_STEP_2` into memory; returns the uninstaller. */
+function _install_step_2_overlay(): () => void {
+    const watched = new Set(_MUTATED_BY_STEP_2.map((f) => path.resolve(f)));
+    const overlay = new Map<string, string>();
+    const real_read = _fs_cjs.readFileSync;
+    const real_write = _fs_cjs.writeFileSync;
+    const watched_key = (p: unknown): string | null => {
+        if (typeof p !== 'string' && !(p instanceof URL)) return null;
+        const abs = path.resolve(p instanceof URL ? fileURLToPath(p) : p);
+        return watched.has(abs) ? abs : null;
+    };
+    _fs_cjs.readFileSync = ((p: fs.PathOrFileDescriptor, opts?: unknown) => {
+        const k = watched_key(p);
+        const body = k === null ? undefined : overlay.get(k);
+        if (body === undefined) return real_read(p, opts as fs.ObjectEncodingOptions);
+        const enc = typeof opts === 'string' ? opts : (opts as { encoding?: unknown } | undefined)?.encoding;
+        return enc ? body : Buffer.from(body, 'utf-8');
+    }) as typeof fs.readFileSync;
+    _fs_cjs.writeFileSync = ((p: fs.PathOrFileDescriptor, data: string | NodeJS.ArrayBufferView, opts?: fs.WriteFileOptions) => {
+        const k = watched_key(p);
+        if (k === null) return real_write(p, data, opts);
+        overlay.set(
+            k,
+            typeof data === 'string' ? data : Buffer.from(data.buffer, data.byteOffset, data.byteLength).toString('utf-8'),
+        );
+    }) as typeof fs.writeFileSync;
+    syncBuiltinESMExports();
+    return () => {
+        _fs_cjs.readFileSync = real_read;
+        _fs_cjs.writeFileSync = real_write;
+        syncBuiltinESMExports();
+    };
 }
 
 const _HERE = fileURLToPath(import.meta.url);
@@ -1343,7 +1372,7 @@ function run_scenario(name: string): ScenarioOutcome {
         captured.push(String(s));
         return true;
     };
-    const tree_snapshot = _snapshot_step_2_files();
+    const remove_overlay = _install_step_2_overlay();
     _set_exec_override((args) => world.exec(args));
     // The working-tree read, faked for the same reason the command layer is.
     // Without this the drill's step 9 reads the repository's real CHANGELOG.md.
@@ -1365,7 +1394,7 @@ function run_scenario(name: string): ScenarioOutcome {
         _set_changelog_reader(null);
         process.stdout.write = orig_out;
         process.stderr.write = orig_err;
-        _restore_step_2_files(tree_snapshot);
+        remove_overlay();
     }
 
     const failures: string[] = [];

package/src/scripts/release_env.ts

@@ -304,6 +304,42 @@ function set_marketplace_version(p: string, version: string): void {
     fs.writeFileSync(p, jsonDumpsIndent(data, 2) + '\n', 'utf-8');
 }
 
+/**
+ * Rewrite the project-settings template's version pin.
+ *
+ * Here rather than in `release.ts` for the reason this module's header already
+ * gives for its two manifest-version siblings: that file is 211 lines over the
+ * 1,500-line source-size ratchet, so every line in it is charged and every line
+ * here is free. Moved in the change that added the settings-surface assertion,
+ * which needed the room — extraction, not a baseline bump.
+ *
+ * The exit is INLINED rather than calling `die`: `release_publication.ts`
+ * imports from this module, so reaching back for it would be a cycle.
+ */
+function set_template_pin(p: string, version: string): void {
+    // Rewrite the single `agent_config_version:` line in place, preserving the
+    // rest of the YAML byte-for-byte. Quoted value to match the existing pin
+    // style and check_template_pin_drift's tolerant parse.
+    const text = fs.readFileSync(p, 'utf-8');
+    const lines = text.split('\n');
+    let found = false;
+    for (let i = 0; i < lines.length; i += 1) {
+        if (/^\s*agent_config_version\s*:/.test(lines[i]!)) {
+            lines[i] = lines[i]!.replace(
+                /^(\s*agent_config_version\s*:\s*).*/,
+                `$1"${version}"`,
+            );
+            found = true;
+            break;
+        }
+    }
+    if (!found) {
+        process.stderr.write(`error: set_template_pin: no \`agent_config_version:\` line in ${p}\n`);
+        throw new SystemExitError(2);
+    }
+    fs.writeFileSync(p, lines.join('\n'), 'utf-8');
+}
+
 /**
  * Mirror of Python `str.splitlines()` — split on CR/LF/CRLF and drop a single
  * trailing empty element.
@@ -339,6 +375,7 @@ export {
     jsonDumpsIndent,
     set_augment_manifest_version,
     set_marketplace_version,
+    set_template_pin,
     pyLen,
     pySlice,
     reEscape,

package/src/scripts/release_publication.ts

@@ -488,15 +488,25 @@ export function measure_mix_obligation(
         const to_sha = _resolve_commit(toRef, cwd);
         const reading = measureRange(from_sha, to_sha, loadTaxonomy(), version, cwd);
         const o = reading.response_obligation;
+        // Every bucket the commit view holds, not the two that happened to be
+        // on the obligation. `mixed` was the largest bucket of 16.3.0..16.4.0
+        // — 41 against governance 42 and consumer 1 — and the line named
+        // neither it nor maintenance, so the published figure described under
+        // half the span while reading like the whole of it.
+        const mixed = reading.commit_view.mixed ?? 0;
+        const maintenance = reading.commit_view.maintenance ?? 0;
         return {
             level:
                 `governance-only ${String(o.governance_only)} vs consumer-only ` +
-                `${String(o.consumer_only)} (taxonomy ${reading.taxonomy_version}; ` +
+                `${String(o.consumer_only)} (mixed ${String(mixed)}, ` +
+                `maintenance ${String(maintenance)}; taxonomy ${reading.taxonomy_version}; ` +
                 `range ${from_sha.slice(0, 12)}..${to_sha.slice(0, 12)})`,
             from_sha,
             to_sha,
             governance_only: o.governance_only,
             consumer_only: o.consumer_only,
+            mixed,
+            maintenance,
         };
     } catch (err) {
         // Printed rather than swallowed. Nothing refuses over the reading any