@event4u/agent-config 16.5.0 → 17.1.0

package/src/scripts/release_drill.ts

@@ -22,11 +22,13 @@
  *     runs them all and prints one ✅/❌ line per scenario.
  *
  * The drill never touches git, gh, npm, or the filesystem outside reading
- * package.json (execute()'s own resume-mode bump-skip probe).
+ * package.json (execute()'s own resume-mode bump-skip probe); step 2's bump
+ * writes land in memory (`_install_step_2_overlay`).
  */
 
 import * as fs from 'node:fs';
 import * as os from 'node:os';
+import { createRequire, syncBuiltinESMExports } from 'node:module';
 import * as path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
@@ -39,6 +41,7 @@ import {
     SystemExitError,
 } from './release.js';
 import { releaseHoldPreflight } from './_lib/release_holds.js';
+import { SETTINGS_SURFACE_FIXTURE } from './_lib/release_settings_surface.js';
 import { die } from './release_publication.js';
 import { DERIVED_MARKER } from './_lib/release_highlights.js';
 import {
@@ -52,7 +55,7 @@ import {
 } from './release_env.js';
 
 /**
- * The files step 2 mutates on disk, snapshotted around every scenario.
+ * The files step 2 mutates on disk, diverted into memory for every scenario.
  *
  * The FakeWorld intercepts COMMANDS, not `fs` writes, and step 2's bump is
  * seven direct writes. Every scenario before 2026-09-03 passed `--resume` with
@@ -61,10 +64,17 @@ import {
  * reached the writing arm. The first `resume: false` scenario appended twelve
  * `## 14.15.0` headings to the REAL `CHANGELOG.md`.
  *
- * Snapshot-and-restore rather than a writer seam: a seam means threading an
- * injection point through seven call sites in `release.ts`, which sits past the
- * 1500-line cap where every line is charged. This is contained to the runner
- * and covers any future scenario without further thought.
+ * Snapshot-and-restore fixed the end state and not the window: `writeFileSync`
+ * truncates before it writes, so every other vitest worker could read these
+ * files empty or bumped mid-scenario. CI run 38555715168 (job 115824218308)
+ * failed to collect an unrelated suite on `package.json: File is empty`, 160 ms
+ * before this drill finished in the same shard. So the writes never reach the
+ * disk: reads and writes of exactly these paths go to an in-memory overlay.
+ *
+ * Patched on the CJS `fs` object and pushed to the ESM namespace with
+ * `syncBuiltinESMExports`, rather than through a writer seam: a seam means
+ * threading an injection point through seven call sites in `release.ts`, which
+ * sits past the 1500-line cap where every line is charged.
  */
 const _MUTATED_BY_STEP_2: readonly string[] = [
     CHANGELOG,
@@ -74,24 +84,43 @@ const _MUTATED_BY_STEP_2: readonly string[] = [
     AUGMENT_PLUGIN_JSON,
     AUGMENT_MARKETPLACE_JSON,
     PROJECT_TEMPLATE,
+    SETTINGS_SURFACE_FIXTURE,
 ];
 
-function _snapshot_step_2_files(): Map<string, string> {
-    const snap = new Map<string, string>();
-    for (const f of _MUTATED_BY_STEP_2) {
-        if (fs.existsSync(f)) {
-            snap.set(f, fs.readFileSync(f, 'utf-8'));
-        }
-    }
-    return snap;
-}
+const _fs_cjs = createRequire(import.meta.url)('node:fs') as typeof fs;
 
-function _restore_step_2_files(snap: ReadonlyMap<string, string>): void {
-    for (const [f, content] of snap) {
-        if (fs.readFileSync(f, 'utf-8') !== content) {
-            fs.writeFileSync(f, content);
-        }
-    }
+/** Divert step 2's reads and writes of `_MUTATED_BY_STEP_2` into memory; returns the uninstaller. */
+function _install_step_2_overlay(): () => void {
+    const watched = new Set(_MUTATED_BY_STEP_2.map((f) => path.resolve(f)));
+    const overlay = new Map<string, string>();
+    const real_read = _fs_cjs.readFileSync;
+    const real_write = _fs_cjs.writeFileSync;
+    const watched_key = (p: unknown): string | null => {
+        if (typeof p !== 'string' && !(p instanceof URL)) return null;
+        const abs = path.resolve(p instanceof URL ? fileURLToPath(p) : p);
+        return watched.has(abs) ? abs : null;
+    };
+    _fs_cjs.readFileSync = ((p: fs.PathOrFileDescriptor, opts?: unknown) => {
+        const k = watched_key(p);
+        const body = k === null ? undefined : overlay.get(k);
+        if (body === undefined) return real_read(p, opts as fs.ObjectEncodingOptions);
+        const enc = typeof opts === 'string' ? opts : (opts as { encoding?: unknown } | undefined)?.encoding;
+        return enc ? body : Buffer.from(body, 'utf-8');
+    }) as typeof fs.readFileSync;
+    _fs_cjs.writeFileSync = ((p: fs.PathOrFileDescriptor, data: string | NodeJS.ArrayBufferView, opts?: fs.WriteFileOptions) => {
+        const k = watched_key(p);
+        if (k === null) return real_write(p, data, opts);
+        overlay.set(
+            k,
+            typeof data === 'string' ? data : Buffer.from(data.buffer, data.byteOffset, data.byteLength).toString('utf-8'),
+        );
+    }) as typeof fs.writeFileSync;
+    syncBuiltinESMExports();
+    return () => {
+        _fs_cjs.readFileSync = real_read;
+        _fs_cjs.writeFileSync = real_write;
+        syncBuiltinESMExports();
+    };
 }
 
 const _HERE = fileURLToPath(import.meta.url);
@@ -173,27 +202,6 @@ interface WorldConfig {
     merge_fails_hard?: boolean;
     /** PR checks fail (watch exits non-zero) — the release must die. */
     checks_fail?: boolean;
-    /**
-     * Step 7's world — two knobs, because the step asks two questions.
-     *
-     * It VERIFIES: the ledger is produced by the self-review workflow, so the
-     * only things a scenario can vary are whether the file is on the remote
-     * branch and what the disposition gate answers. An earlier version of this
-     * step ingested, and carried four more knobs for run discovery and artifact
-     * download; those went with it when the owner moved the ingest into CI.
-     */
-    ledger_on_branch?: boolean;
-    /**
-     * Whether the ledger is on the TRUNK — the ref the merged path asks.
-     *
-     * Separate from `ledger_on_branch` because the two states worth testing are
-     * exactly the ones a single boolean cannot express: present on the branch
-     * and not on the trunk, and the reverse. Defaults to `ledger_on_branch`, so
-     * every scenario written before this knob keeps its answer.
-     */
-    ledger_on_trunk?: boolean;
-    /** Exit code + streams the disposition gate answers with. */
-    disposition_verdict?: { status: number; stdout: string; stderr: string };
     /**
      * Content `git show <target>:CHANGELOG.md` returns.
      *
@@ -248,8 +256,7 @@ interface WorldConfig {
     tag_already_remote?: boolean;
     /**
      * The release PR is ALREADY merged when the run starts — the real
-     * resume-after-merge state, in which steps 1 through 6 skip, step 7 still
-     * verifies the ledger (on the trunk, since the branch is gone) and step 8
+     * resume-after-merge state, in which steps 1 through 7 skip and step 8
      * is the first step that does work.
      *
      * Added 2026-09-02 with `guard_release_branch_push`. Before that guard, a
@@ -354,9 +361,6 @@ class FakeWorld {
     private merge_races_once: boolean;
     private merge_fails_hard: boolean;
     private checks_fail: boolean;
-    private readonly ledger_on_branch: boolean;
-    private readonly ledger_on_trunk: boolean | undefined;
-    private readonly disposition_verdict: { status: number; stdout: string; stderr: string };
     private readonly changelog: string;
     /** Working-tree content; see `WorldConfig.changelog_file`. */
     readonly changelog_file: string;
@@ -381,12 +385,6 @@ class FakeWorld {
         this.checks_fail = cfg.checks_fail ?? false;
         this.pr_merged = cfg.pr_already_merged ?? false;
         this.release_verify_fails = cfg.release_verify_fails ?? false;
-        // Defaults keep every pre-2026-09-11 scenario green: the ledger is
-        // already on the branch and the gate is happy, so step 7 is a two-call
-        // no-op and the sequencing scenarios stay about sequencing.
-        this.ledger_on_branch = cfg.ledger_on_branch ?? true;
-        this.ledger_on_trunk = cfg.ledger_on_trunk;
-        this.disposition_verdict = cfg.disposition_verdict ?? { status: 0, stdout: '', stderr: '' };
     }
 
     exec(args: readonly string[]): ExecResult {
@@ -561,21 +559,6 @@ class FakeWorld {
             return OK;
         }
 
-        // Step 7 — the findings ledger.
-        if (cmd.startsWith('git cat-file -e ')) {
-            // REF-AWARE, because one boolean for every ref made the two states
-            // that distinguish right from wrong inexpressible: on the branch
-            // but not the trunk, and the reverse. A fourth review named the
-            // merged-path scenario as asserting a string in the argv rather
-            // than the ref that was read.
-            const onTrunk = this.ledger_on_trunk ?? this.ledger_on_branch;
-            const present = cmd.includes('/main:') ? onTrunk : this.ledger_on_branch;
-            return present ? OK : { ...OK, status: 1 };
-        }
-        if (cmd.includes('check_finding_dispositions --release')) {
-            return { ...this.disposition_verdict };
-        }
-
         throw new Error(`FakeWorld: unscripted command: ${cmd}`);
     }
 }
@@ -748,48 +731,20 @@ const SCENARIOS: Record<string, Scenario> = {
         },
     },
 
-    'findings-ledger-verified-on-the-remote-branch': {
+    'no-findings-ledger-does-not-stop-the-release': {
         summary:
-            'step 7: the ledger is on the remote branch and the gate passes — the release continues without producing anything',
-        // Step 7 VERIFIES. The ingest lives in the self-review workflow, which
-        // commits the ledger to the release branch; two review rounds showed no
-        // placement inside this script can produce it, because the gate it
-        // anticipates already reds the check step 6 waits on.
-        // `resume: false` is load-bearing, not tidiness. `resume` defaults to
-        // TRUE here, and on a resumed run the PR number is already in hand — so
-        // a scenario that kept the default could not see the `--pr` flag being
-        // dropped, which is exactly the hole this scenario asserts against.
-        config: { ledger_on_branch: true, resume: false },
+            'step 7: a release waits for no review ledger — everything on main is already reviewed and merged (owner, 2026-10-22)',
+        // The 17.0.0 cut stopped here for a day: a ledger the self-review never
+        // finished, on a branch whose every commit had been reviewed on main.
+        // The world scripts no ledger command, so reading one would throw;
+        // `resume: false` so a first run is covered, not only a resumed one.
+        config: { resume: false },
         expect_success: true,
         verify: (w) => {
             const f: string[] = [];
-            const probe = w.calls.find((c) => c.startsWith('git cat-file -e '));
-            _expect(probe !== undefined, 'the ledger presence was never probed', f);
-            _expect(
-                (probe ?? '').includes('origin/'),
-                `the probe read a local ref, which a failed push makes true: ${probe ?? '(none)'}`,
-                f,
-            );
-            _expect(
-                !w.calls.some((c) => c.includes('--ingest')),
-                'step 7 ingested — that belongs to the workflow now, not the release',
-                f,
-            );
-            _expect(
-                !w.calls.some((c) => c.startsWith('gh run download')),
-                'step 7 downloaded an artifact — the release no longer produces the ledger',
-                f,
-            );
-            // `--pr` is what makes the gate compare the review's own report
-            // against the committed ledger. The PR number used to come only
-            // from the resume-time probe, so on a FIRST run — this scenario —
-            // the flag was silently dropped and the release passed a strictly
-            // weaker check than the one it was trying to pre-satisfy.
             _expect(
-                w.calls.some(
-                    (c) => c.includes('check_finding_dispositions --release') && c.includes('--pr '),
-                ),
-                'the disposition gate ran without --pr, so an un-ingested finding would pass here',
+                !w.calls.some((c) => c.includes('check_finding_dispositions') || c.startsWith('git cat-file -e ')),
+                'the release read the findings ledger',
                 f,
             );
             _expect(
@@ -797,87 +752,7 @@ const SCENARIOS: Record<string, Scenario> = {
                 'the release never reached the merge',
                 f,
             );
-            return f;
-        },
-    },
-    'findings-ledger-absent-stops-the-release': {
-        summary:
-            'step 7: no ledger on the remote branch — the release STOPS rather than merging and tagging without one',
-        config: { ledger_on_branch: false },
-        expect_success: false,
-        verify: (w, error) => {
-            const f: string[] = [];
-            _expect(
-                (error ?? '').includes('is not on origin/'),
-                `the stop did not name the ref it checked: ${error ?? '(no error)'}`,
-                f,
-            );
-            _expect(
-                !w.calls.includes(`gh pr merge ${w.branch} --merge --delete-branch`),
-                'merged with no ledger — the failure this step exists to end',
-                f,
-            );
-            _expect(!w.tag_remote, 'tagged with no ledger', f);
-            return f;
-        },
-    },
-    'findings-ledger-absent-after-a-hand-merge-still-stops': {
-        summary:
-            'step 7: the PR is already merged and no ledger reached the trunk — the release STOPS instead of tagging a version whose ledger does not exist',
-        // The reachable path to a shipped version with no ledger, and the one
-        // the old code asserted away: the ingest produces nothing, step 7
-        // stops, a human merges the PR, and the resumed run used to print "the
-        // ledger rode in with it" without reading anything.
-        // The two knobs differ on purpose: the ledger IS on the release branch
-        // and is NOT on the trunk. A run that read the branch ref would pass
-        // here, which is the wrong answer — the branch is deleted and the merge
-        // is what decides whether the ledger shipped.
-        config: { pr_already_merged: true, ledger_on_branch: true, ledger_on_trunk: false },
-        expect_success: false,
-        verify: (w, error) => {
-            const f: string[] = [];
-            _expect(
-                (error ?? '').includes('already merged'),
-                `the stop did not name the merged state: ${error ?? '(no error)'}`,
-                f,
-            );
-            _expect(
-                w.calls.some((c) => c.startsWith('git cat-file -e ') && c.includes('/main:')),
-                'the merged path never asked the trunk whether the ledger is there',
-                f,
-            );
-            _expect(!w.tag_remote, 'tagged a version whose findings ledger does not exist', f);
-            return f;
-        },
-    },
-    'findings-ledger-undispositioned-stops-and-shows-why': {
-        summary:
-            'step 7: the disposition gate refuses — the release stops and the operator is shown the gate report, not just its scan line',
-        config: {
-            ledger_on_branch: true,
-            disposition_verdict: {
-                status: 1,
-                stdout: 'scanned: 1',
-                stderr: '- `a1` (critical security: x): no disposition status',
-            },
-        },
-        expect_success: false,
-        verify: (w, error) => {
-            const f: string[] = [];
-            // The defect an independent review reproduced: the stop message
-            // preferred stdout, so the operator saw `scanned: 1` and the entire
-            // per-finding diagnosis — which the gate writes to stderr — was
-            // discarded on the one path where the message has to carry content.
-            _expect(
-                (error ?? '').includes('no disposition status'),
-                `the gate's own diagnosis was swallowed: ${error ?? '(no error)'}`,
-                f,
-            );
-            _expect(
-                !w.calls.includes(`gh pr merge ${w.branch} --merge --delete-branch`),
-                'merged over an undispositioned ledger',
-                f,
-            );
+            _expect(w.tag_remote, 'the release never pushed its tag', f);
             return f;
         },
     },
@@ -1343,7 +1218,7 @@ function run_scenario(name: string): ScenarioOutcome {
         captured.push(String(s));
         return true;
     };
-    const tree_snapshot = _snapshot_step_2_files();
+    const remove_overlay = _install_step_2_overlay();
     _set_exec_override((args) => world.exec(args));
     // The working-tree read, faked for the same reason the command layer is.
     // Without this the drill's step 9 reads the repository's real CHANGELOG.md.
@@ -1365,7 +1240,7 @@ function run_scenario(name: string): ScenarioOutcome {
         _set_changelog_reader(null);
         process.stdout.write = orig_out;
         process.stderr.write = orig_err;
-        _restore_step_2_files(tree_snapshot);
+        remove_overlay();
     }
 
     const failures: string[] = [];

package/src/scripts/release_env.ts

@@ -304,6 +304,42 @@ function set_marketplace_version(p: string, version: string): void {
     fs.writeFileSync(p, jsonDumpsIndent(data, 2) + '\n', 'utf-8');
 }
 
+/**
+ * Rewrite the project-settings template's version pin.
+ *
+ * Here rather than in `release.ts` for the reason this module's header already
+ * gives for its two manifest-version siblings: that file is 211 lines over the
+ * 1,500-line source-size ratchet, so every line in it is charged and every line
+ * here is free. Moved in the change that added the settings-surface assertion,
+ * which needed the room — extraction, not a baseline bump.
+ *
+ * The exit is INLINED rather than calling `die`: `release_publication.ts`
+ * imports from this module, so reaching back for it would be a cycle.
+ */
+function set_template_pin(p: string, version: string): void {
+    // Rewrite the single `agent_config_version:` line in place, preserving the
+    // rest of the YAML byte-for-byte. Quoted value to match the existing pin
+    // style and check_template_pin_drift's tolerant parse.
+    const text = fs.readFileSync(p, 'utf-8');
+    const lines = text.split('\n');
+    let found = false;
+    for (let i = 0; i < lines.length; i += 1) {
+        if (/^\s*agent_config_version\s*:/.test(lines[i]!)) {
+            lines[i] = lines[i]!.replace(
+                /^(\s*agent_config_version\s*:\s*).*/,
+                `$1"${version}"`,
+            );
+            found = true;
+            break;
+        }
+    }
+    if (!found) {
+        process.stderr.write(`error: set_template_pin: no \`agent_config_version:\` line in ${p}\n`);
+        throw new SystemExitError(2);
+    }
+    fs.writeFileSync(p, lines.join('\n'), 'utf-8');
+}
+
 /**
  * Mirror of Python `str.splitlines()` — split on CR/LF/CRLF and drop a single
  * trailing empty element.
@@ -339,6 +375,7 @@ export {
     jsonDumpsIndent,
     set_augment_manifest_version,
     set_marketplace_version,
+    set_template_pin,
     pyLen,
     pySlice,
     reEscape,

package/src/scripts/release_publication.ts

@@ -229,15 +229,6 @@ export function _failed_checks_report(names: readonly string[]): string {
             'gate output lists the deriving commits (release-truth Phase 2).',
         );
     }
-    if (names.includes('Blocking review findings dispositioned')) {
-        lines.push(
-            '',
-            'Dispositions: a blocking/high self-review finding has no committed',
-            'disposition. Ingest + adjudicate it in',
-            'agents/evidence/release-findings/<version>.json (release-truth Phase 3):',
-            '  ./scripts-run src/scripts/check_finding_dispositions --ingest <findings.json>',
-        );
-    }
     lines.push('', 'After fixing, resume with: task release -- --resume --yes', '');
     return lines.join('\n');
 }
@@ -488,15 +479,25 @@ export function measure_mix_obligation(
         const to_sha = _resolve_commit(toRef, cwd);
         const reading = measureRange(from_sha, to_sha, loadTaxonomy(), version, cwd);
         const o = reading.response_obligation;
+        // Every bucket the commit view holds, not the two that happened to be
+        // on the obligation. `mixed` was the largest bucket of 16.3.0..16.4.0
+        // — 41 against governance 42 and consumer 1 — and the line named
+        // neither it nor maintenance, so the published figure described under
+        // half the span while reading like the whole of it.
+        const mixed = reading.commit_view.mixed ?? 0;
+        const maintenance = reading.commit_view.maintenance ?? 0;
         return {
             level:
                 `governance-only ${String(o.governance_only)} vs consumer-only ` +
-                `${String(o.consumer_only)} (taxonomy ${reading.taxonomy_version}; ` +
+                `${String(o.consumer_only)} (mixed ${String(mixed)}, ` +
+                `maintenance ${String(maintenance)}; taxonomy ${reading.taxonomy_version}; ` +
                 `range ${from_sha.slice(0, 12)}..${to_sha.slice(0, 12)})`,
             from_sha,
             to_sha,
             governance_only: o.governance_only,
             consumer_only: o.consumer_only,
+            mixed,
+            maintenance,
         };
     } catch (err) {
         // Printed rather than swallowed. Nothing refuses over the reading any