@event4u/agent-config 17.0.0 → 17.1.0

package/src/scripts/release_drill.ts

@@ -202,27 +202,6 @@ interface WorldConfig {
     merge_fails_hard?: boolean;
     /** PR checks fail (watch exits non-zero) — the release must die. */
     checks_fail?: boolean;
-    /**
-     * Step 7's world — two knobs, because the step asks two questions.
-     *
-     * It VERIFIES: the ledger is produced by the self-review workflow, so the
-     * only things a scenario can vary are whether the file is on the remote
-     * branch and what the disposition gate answers. An earlier version of this
-     * step ingested, and carried four more knobs for run discovery and artifact
-     * download; those went with it when the owner moved the ingest into CI.
-     */
-    ledger_on_branch?: boolean;
-    /**
-     * Whether the ledger is on the TRUNK — the ref the merged path asks.
-     *
-     * Separate from `ledger_on_branch` because the two states worth testing are
-     * exactly the ones a single boolean cannot express: present on the branch
-     * and not on the trunk, and the reverse. Defaults to `ledger_on_branch`, so
-     * every scenario written before this knob keeps its answer.
-     */
-    ledger_on_trunk?: boolean;
-    /** Exit code + streams the disposition gate answers with. */
-    disposition_verdict?: { status: number; stdout: string; stderr: string };
     /**
      * Content `git show <target>:CHANGELOG.md` returns.
      *
@@ -277,8 +256,7 @@ interface WorldConfig {
     tag_already_remote?: boolean;
     /**
      * The release PR is ALREADY merged when the run starts — the real
-     * resume-after-merge state, in which steps 1 through 6 skip, step 7 still
-     * verifies the ledger (on the trunk, since the branch is gone) and step 8
+     * resume-after-merge state, in which steps 1 through 7 skip and step 8
      * is the first step that does work.
      *
      * Added 2026-09-02 with `guard_release_branch_push`. Before that guard, a
@@ -383,9 +361,6 @@ class FakeWorld {
     private merge_races_once: boolean;
     private merge_fails_hard: boolean;
     private checks_fail: boolean;
-    private readonly ledger_on_branch: boolean;
-    private readonly ledger_on_trunk: boolean | undefined;
-    private readonly disposition_verdict: { status: number; stdout: string; stderr: string };
     private readonly changelog: string;
     /** Working-tree content; see `WorldConfig.changelog_file`. */
     readonly changelog_file: string;
@@ -410,12 +385,6 @@ class FakeWorld {
         this.checks_fail = cfg.checks_fail ?? false;
         this.pr_merged = cfg.pr_already_merged ?? false;
         this.release_verify_fails = cfg.release_verify_fails ?? false;
-        // Defaults keep every pre-2026-09-11 scenario green: the ledger is
-        // already on the branch and the gate is happy, so step 7 is a two-call
-        // no-op and the sequencing scenarios stay about sequencing.
-        this.ledger_on_branch = cfg.ledger_on_branch ?? true;
-        this.ledger_on_trunk = cfg.ledger_on_trunk;
-        this.disposition_verdict = cfg.disposition_verdict ?? { status: 0, stdout: '', stderr: '' };
     }
 
     exec(args: readonly string[]): ExecResult {
@@ -590,21 +559,6 @@ class FakeWorld {
             return OK;
         }
 
-        // Step 7 — the findings ledger.
-        if (cmd.startsWith('git cat-file -e ')) {
-            // REF-AWARE, because one boolean for every ref made the two states
-            // that distinguish right from wrong inexpressible: on the branch
-            // but not the trunk, and the reverse. A fourth review named the
-            // merged-path scenario as asserting a string in the argv rather
-            // than the ref that was read.
-            const onTrunk = this.ledger_on_trunk ?? this.ledger_on_branch;
-            const present = cmd.includes('/main:') ? onTrunk : this.ledger_on_branch;
-            return present ? OK : { ...OK, status: 1 };
-        }
-        if (cmd.includes('check_finding_dispositions --release')) {
-            return { ...this.disposition_verdict };
-        }
-
         throw new Error(`FakeWorld: unscripted command: ${cmd}`);
     }
 }
@@ -777,48 +731,20 @@ const SCENARIOS: Record<string, Scenario> = {
         },
     },
 
-    'findings-ledger-verified-on-the-remote-branch': {
+    'no-findings-ledger-does-not-stop-the-release': {
         summary:
-            'step 7: the ledger is on the remote branch and the gate passes — the release continues without producing anything',
-        // Step 7 VERIFIES. The ingest lives in the self-review workflow, which
-        // commits the ledger to the release branch; two review rounds showed no
-        // placement inside this script can produce it, because the gate it
-        // anticipates already reds the check step 6 waits on.
-        // `resume: false` is load-bearing, not tidiness. `resume` defaults to
-        // TRUE here, and on a resumed run the PR number is already in hand — so
-        // a scenario that kept the default could not see the `--pr` flag being
-        // dropped, which is exactly the hole this scenario asserts against.
-        config: { ledger_on_branch: true, resume: false },
+            'step 7: a release waits for no review ledger — everything on main is already reviewed and merged (owner, 2026-10-22)',
+        // The 17.0.0 cut stopped here for a day: a ledger the self-review never
+        // finished, on a branch whose every commit had been reviewed on main.
+        // The world scripts no ledger command, so reading one would throw;
+        // `resume: false` so a first run is covered, not only a resumed one.
+        config: { resume: false },
         expect_success: true,
         verify: (w) => {
             const f: string[] = [];
-            const probe = w.calls.find((c) => c.startsWith('git cat-file -e '));
-            _expect(probe !== undefined, 'the ledger presence was never probed', f);
             _expect(
-                (probe ?? '').includes('origin/'),
-                `the probe read a local ref, which a failed push makes true: ${probe ?? '(none)'}`,
-                f,
-            );
-            _expect(
-                !w.calls.some((c) => c.includes('--ingest')),
-                'step 7 ingested — that belongs to the workflow now, not the release',
-                f,
-            );
-            _expect(
-                !w.calls.some((c) => c.startsWith('gh run download')),
-                'step 7 downloaded an artifact — the release no longer produces the ledger',
-                f,
-            );
-            // `--pr` is what makes the gate compare the review's own report
-            // against the committed ledger. The PR number used to come only
-            // from the resume-time probe, so on a FIRST run — this scenario —
-            // the flag was silently dropped and the release passed a strictly
-            // weaker check than the one it was trying to pre-satisfy.
-            _expect(
-                w.calls.some(
-                    (c) => c.includes('check_finding_dispositions --release') && c.includes('--pr '),
-                ),
-                'the disposition gate ran without --pr, so an un-ingested finding would pass here',
+                !w.calls.some((c) => c.includes('check_finding_dispositions') || c.startsWith('git cat-file -e ')),
+                'the release read the findings ledger',
                 f,
             );
             _expect(
@@ -826,87 +752,7 @@ const SCENARIOS: Record<string, Scenario> = {
                 'the release never reached the merge',
                 f,
             );
-            return f;
-        },
-    },
-    'findings-ledger-absent-stops-the-release': {
-        summary:
-            'step 7: no ledger on the remote branch — the release STOPS rather than merging and tagging without one',
-        config: { ledger_on_branch: false },
-        expect_success: false,
-        verify: (w, error) => {
-            const f: string[] = [];
-            _expect(
-                (error ?? '').includes('is not on origin/'),
-                `the stop did not name the ref it checked: ${error ?? '(no error)'}`,
-                f,
-            );
-            _expect(
-                !w.calls.includes(`gh pr merge ${w.branch} --merge --delete-branch`),
-                'merged with no ledger — the failure this step exists to end',
-                f,
-            );
-            _expect(!w.tag_remote, 'tagged with no ledger', f);
-            return f;
-        },
-    },
-    'findings-ledger-absent-after-a-hand-merge-still-stops': {
-        summary:
-            'step 7: the PR is already merged and no ledger reached the trunk — the release STOPS instead of tagging a version whose ledger does not exist',
-        // The reachable path to a shipped version with no ledger, and the one
-        // the old code asserted away: the ingest produces nothing, step 7
-        // stops, a human merges the PR, and the resumed run used to print "the
-        // ledger rode in with it" without reading anything.
-        // The two knobs differ on purpose: the ledger IS on the release branch
-        // and is NOT on the trunk. A run that read the branch ref would pass
-        // here, which is the wrong answer — the branch is deleted and the merge
-        // is what decides whether the ledger shipped.
-        config: { pr_already_merged: true, ledger_on_branch: true, ledger_on_trunk: false },
-        expect_success: false,
-        verify: (w, error) => {
-            const f: string[] = [];
-            _expect(
-                (error ?? '').includes('already merged'),
-                `the stop did not name the merged state: ${error ?? '(no error)'}`,
-                f,
-            );
-            _expect(
-                w.calls.some((c) => c.startsWith('git cat-file -e ') && c.includes('/main:')),
-                'the merged path never asked the trunk whether the ledger is there',
-                f,
-            );
-            _expect(!w.tag_remote, 'tagged a version whose findings ledger does not exist', f);
-            return f;
-        },
-    },
-    'findings-ledger-undispositioned-stops-and-shows-why': {
-        summary:
-            'step 7: the disposition gate refuses — the release stops and the operator is shown the gate report, not just its scan line',
-        config: {
-            ledger_on_branch: true,
-            disposition_verdict: {
-                status: 1,
-                stdout: 'scanned: 1',
-                stderr: '- `a1` (critical security: x): no disposition status',
-            },
-        },
-        expect_success: false,
-        verify: (w, error) => {
-            const f: string[] = [];
-            // The defect an independent review reproduced: the stop message
-            // preferred stdout, so the operator saw `scanned: 1` and the entire
-            // per-finding diagnosis — which the gate writes to stderr — was
-            // discarded on the one path where the message has to carry content.
-            _expect(
-                (error ?? '').includes('no disposition status'),
-                `the gate's own diagnosis was swallowed: ${error ?? '(no error)'}`,
-                f,
-            );
-            _expect(
-                !w.calls.includes(`gh pr merge ${w.branch} --merge --delete-branch`),
-                'merged over an undispositioned ledger',
-                f,
-            );
+            _expect(w.tag_remote, 'the release never pushed its tag', f);
             return f;
         },
     },

package/src/scripts/release_publication.ts

@@ -229,15 +229,6 @@ export function _failed_checks_report(names: readonly string[]): string {
             'gate output lists the deriving commits (release-truth Phase 2).',
         );
     }
-    if (names.includes('Blocking review findings dispositioned')) {
-        lines.push(
-            '',
-            'Dispositions: a blocking/high self-review finding has no committed',
-            'disposition. Ingest + adjudicate it in',
-            'agents/evidence/release-findings/<version>.json (release-truth Phase 3):',
-            '  ./scripts-run src/scripts/check_finding_dispositions --ingest <findings.json>',
-        );
-    }
     lines.push('', 'After fixing, resume with: task release -- --resume --yes', '');
     return lines.join('\n');
 }

package/src/scripts/report_production_reach.ts

@@ -0,0 +1,35 @@
+#!/usr/bin/env tsx
+/**
+ * Print the production entries and the size and digest of their import closure
+ * (road-to-a-tick-the-shipped-path-earns 3.1). Two runs over one tree print the
+ * same digest; a moved entry or a new edge changes it.
+ *
+ * Usage: ./scripts-run src/scripts/report_production_reach [--entries]
+ */
+import { createHash } from 'node:crypto';
+import * as path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import { productionReach, worktreeOf } from './_lib/production_reach.js';
+
+const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
+
+export function main(argv: readonly string[]): number {
+    const reach = productionReach(worktreeOf(REPO_ROOT));
+    const digest = createHash('sha256')
+        .update([...reach.modules].sort().join('\n'))
+        .update('\0')
+        .update([...reach.symbols].sort().join('\n'))
+        .digest('hex')
+        .slice(0, 16);
+    if (argv.includes('--entries')) for (const e of reach.entries) process.stdout.write(`${e}\n`);
+    process.stdout.write(
+        `production reach: ${reach.entries.size} entries · ${reach.modules.size} modules · ` +
+            `${reach.symbols.size} reached symbols · digest ${digest}\n`,
+    );
+    return 0;
+}
+
+if (process.argv[1] !== undefined && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+    process.exit(main(process.argv.slice(2)));
+}