@fuzdev/fuz_gitops 0.75.0 → 0.77.0

package/dist/ci_reconcile.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Reconciles each repo's declared `ci` flag against whether it actually has
+ * GitHub Actions workflow files on disk.
+ *
+ * The gitops config derives `ci` from visibility (on for public repos, off for
+ * private) with per-repo overrides; this check catches drift between that
+ * declaration and reality —
+ * a repo that claims CI but ships no workflow, or one that disclaims CI yet
+ * still carries one. Repos that aren't checked out locally can't be judged, so
+ * the caller marks them uncheckable and they're skipped. Archived repos are
+ * frozen on their host, so their CI state is intentionally left alone and they're
+ * skipped too.
+ *
+ * @module
+ */
+/** How a repo's declared `ci` diverges from its workflow files on disk. */
+export type CiDriftKind = 
+/** `ci` is `true` but the repo has no workflow files. */
+'missing_ci'
+/** `ci` is `false` but the repo has workflow files. */
+ | 'stray_ci';
+export interface CiDrift {
+    repo_url: string;
+    /** The declared/derived `ci` value. */
+    ci: boolean;
+    has_workflows: boolean;
+    kind: CiDriftKind;
+}
+export interface CiReconcileInput {
+    repo_url: string;
+    /** The declared/derived `ci` value from the gitops config. */
+    ci: boolean;
+    /** Whether the repo has at least one workflow file on disk. */
+    has_workflows: boolean;
+    /** Whether the repo is checked out locally; uncheckable repos are skipped. */
+    checkable: boolean;
+    /** Whether the repo is archived (frozen) on its host; archived repos are skipped. */
+    archived: boolean;
+}
+/**
+ * Compares each repo's declared `ci` against its actual workflow presence.
+ * @returns one `CiDrift` per repo whose declaration and reality disagree
+ */
+export declare const reconcile_ci: (repos: Array<CiReconcileInput>) => Array<CiDrift>;
+/**
+ * Whether a local repo directory contains at least one GitHub Actions workflow.
+ * @param repo_dir - absolute or cwd-relative path to the repo's local directory
+ */
+export declare const repo_has_workflows: (repo_dir: string) => boolean;
+//# sourceMappingURL=ci_reconcile.d.ts.map

package/dist/ci_reconcile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci_reconcile.d.ts","sourceRoot":"../src/lib/","sources":["../src/lib/ci_reconcile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAKH,2EAA2E;AAC3E,MAAM,MAAM,WAAW;AACtB,yDAAyD;AACvD,YAAY;AACd,uDAAuD;GACrD,UAAU,CAAC;AAEd,MAAM,WAAW,OAAO;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,uCAAuC;IACvC,EAAE,EAAE,OAAO,CAAC;IACZ,aAAa,EAAE,OAAO,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,8DAA8D;IAC9D,EAAE,EAAE,OAAO,CAAC;IACZ,+DAA+D;IAC/D,aAAa,EAAE,OAAO,CAAC;IACvB,8EAA8E;IAC9E,SAAS,EAAE,OAAO,CAAC;IACnB,qFAAqF;IACrF,QAAQ,EAAE,OAAO,CAAC;CAClB;AAED;;;GAGG;AACH,eAAO,MAAM,YAAY,GAAI,OAAO,KAAK,CAAC,gBAAgB,CAAC,KAAG,KAAK,CAAC,OAAO,CAY1E,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,kBAAkB,GAAI,UAAU,MAAM,KAAG,OAIrD,CAAC"}

package/dist/ci_reconcile.js

@@ -0,0 +1,46 @@
+/**
+ * Reconciles each repo's declared `ci` flag against whether it actually has
+ * GitHub Actions workflow files on disk.
+ *
+ * The gitops config derives `ci` from visibility (on for public repos, off for
+ * private) with per-repo overrides; this check catches drift between that
+ * declaration and reality —
+ * a repo that claims CI but ships no workflow, or one that disclaims CI yet
+ * still carries one. Repos that aren't checked out locally can't be judged, so
+ * the caller marks them uncheckable and they're skipped. Archived repos are
+ * frozen on their host, so their CI state is intentionally left alone and they're
+ * skipped too.
+ *
+ * @module
+ */
+import { existsSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+/**
+ * Compares each repo's declared `ci` against its actual workflow presence.
+ * @returns one `CiDrift` per repo whose declaration and reality disagree
+ */
+export const reconcile_ci = (repos) => {
+    const drift = [];
+    for (const repo of repos) {
+        if (!repo.checkable || repo.archived)
+            continue;
+        const { repo_url, ci, has_workflows } = repo;
+        if (ci && !has_workflows) {
+            drift.push({ repo_url, ci, has_workflows, kind: 'missing_ci' });
+        }
+        else if (!ci && has_workflows) {
+            drift.push({ repo_url, ci, has_workflows, kind: 'stray_ci' });
+        }
+    }
+    return drift;
+};
+/**
+ * Whether a local repo directory contains at least one GitHub Actions workflow.
+ * @param repo_dir - absolute or cwd-relative path to the repo's local directory
+ */
+export const repo_has_workflows = (repo_dir) => {
+    const workflows_dir = join(repo_dir, '.github', 'workflows');
+    if (!existsSync(workflows_dir))
+        return false;
+    return readdirSync(workflows_dir).some((file) => file.endsWith('.yml') || file.endsWith('.yaml'));
+};

package/dist/config_reconcile.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Reconciles repo metadata across multiple gitops configs.
+ *
+ * The ecosystem keeps several gitops configs — a canonical superset plus
+ * narrower per-project subsets. They can't share one source of truth (the
+ * superset includes private repos that public configs may not reference), so the
+ * same repo is declared independently in each. This check flags when a subset's
+ * intrinsic fields drift from the canonical config, or when a subset lists a
+ * repo the canonical config doesn't. `repo_dir` is per-config and ignored.
+ *
+ * @module
+ */
+import type { GitopsRepoConfig } from './gitops_config.js';
+/** Repo fields that must agree across every config that lists the repo. */
+declare const INTRINSIC_FIELDS: readonly ["visibility", "ci", "archived", "branch"];
+export type IntrinsicField = (typeof INTRINSIC_FIELDS)[number];
+export type ConfigDriftKind = 
+/** The repo is in a subset config but absent from the canonical config. */
+'missing_from_canonical'
+/** An intrinsic field disagrees between the subset and the canonical config. */
+ | 'field_mismatch';
+export interface ConfigDrift {
+    repo_url: string;
+    /** Name of the subset config whose entry diverges. */
+    config: string;
+    kind: ConfigDriftKind;
+    /** The field that disagrees, set when `kind` is `'field_mismatch'`. */
+    field?: IntrinsicField;
+    /** The canonical config's value, set when `kind` is `'field_mismatch'`. */
+    canonical_value?: string;
+    /** The subset config's value, set when `kind` is `'field_mismatch'`. */
+    config_value?: string;
+}
+export interface NamedRepos {
+    name: string;
+    repos: Array<GitopsRepoConfig>;
+}
+/**
+ * Compares each subset config against the canonical config. Repos that live only
+ * in the canonical config are fine — the subsets are intentional partial views.
+ * @returns one `ConfigDrift` per subset entry that is missing from the canonical
+ * config or whose intrinsic fields disagree with it
+ */
+export declare const reconcile_configs: (canonical: NamedRepos, subsets: Array<NamedRepos>) => Array<ConfigDrift>;
+export {};
+//# sourceMappingURL=config_reconcile.d.ts.map

package/dist/config_reconcile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config_reconcile.d.ts","sourceRoot":"../src/lib/","sources":["../src/lib/config_reconcile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,oBAAoB,CAAC;AAEzD,2EAA2E;AAC3E,QAAA,MAAM,gBAAgB,qDAAsD,CAAC;AAE7E,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/D,MAAM,MAAM,eAAe;AAC1B,2EAA2E;AACzE,wBAAwB;AAC1B,gFAAgF;GAC9E,gBAAgB,CAAC;AAEpB,MAAM,WAAW,WAAW;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,eAAe,CAAC;IACtB,uEAAuE;IACvE,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB,2EAA2E;IAC3E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;CAC/B;AAeD;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,GAC7B,WAAW,UAAU,EACrB,SAAS,KAAK,CAAC,UAAU,CAAC,KACxB,KAAK,CAAC,WAAW,CA2BnB,CAAC"}

package/dist/config_reconcile.js

@@ -0,0 +1,60 @@
+/**
+ * Reconciles repo metadata across multiple gitops configs.
+ *
+ * The ecosystem keeps several gitops configs — a canonical superset plus
+ * narrower per-project subsets. They can't share one source of truth (the
+ * superset includes private repos that public configs may not reference), so the
+ * same repo is declared independently in each. This check flags when a subset's
+ * intrinsic fields drift from the canonical config, or when a subset lists a
+ * repo the canonical config doesn't. `repo_dir` is per-config and ignored.
+ *
+ * @module
+ */
+/** Repo fields that must agree across every config that lists the repo. */
+const INTRINSIC_FIELDS = ['visibility', 'ci', 'archived', 'branch'];
+const field_value = (repo, field) => {
+    switch (field) {
+        case 'visibility':
+            return repo.visibility;
+        case 'ci':
+            return String(repo.ci);
+        case 'archived':
+            return String(repo.archived);
+        case 'branch':
+            return repo.branch;
+    }
+};
+/**
+ * Compares each subset config against the canonical config. Repos that live only
+ * in the canonical config are fine — the subsets are intentional partial views.
+ * @returns one `ConfigDrift` per subset entry that is missing from the canonical
+ * config or whose intrinsic fields disagree with it
+ */
+export const reconcile_configs = (canonical, subsets) => {
+    const drift = [];
+    const canonical_by_url = new Map(canonical.repos.map((r) => [r.repo_url, r]));
+    for (const subset of subsets) {
+        for (const repo of subset.repos) {
+            const canon = canonical_by_url.get(repo.repo_url);
+            if (!canon) {
+                drift.push({ repo_url: repo.repo_url, config: subset.name, kind: 'missing_from_canonical' });
+                continue;
+            }
+            for (const field of INTRINSIC_FIELDS) {
+                const canonical_value = field_value(canon, field);
+                const config_value = field_value(repo, field);
+                if (canonical_value !== config_value) {
+                    drift.push({
+                        repo_url: repo.repo_url,
+                        config: subset.name,
+                        kind: 'field_mismatch',
+                        field,
+                        canonical_value,
+                        config_value,
+                    });
+                }
+            }
+        }
+    }
+    return drift;
+};

package/dist/gitops_config.d.ts

@@ -21,6 +21,12 @@ export interface RawGitopsConfig {
     repos?: Array<Url | RawGitopsRepoConfig>;
     repos_dir?: string;
 }
+/**
+ * Visibility of a repo on its host, mirroring the host's own model
+ * (e.g. GitHub's `visibility` field). Named to avoid confusion with the npm
+ * `package.json` `private` flag, which is a separate publishing concern.
+ */
+export type GitopsRepoVisibility = 'public' | 'private';
 export interface GitopsRepoConfig {
     /**
      * The HTTPS URL to the repo. Does not include a `.git` suffix.
@@ -47,11 +53,30 @@ export interface GitopsRepoConfig {
      * The branch name to use when fetching the repo. Defaults to `main`.
      */
     branch: GitBranch;
+    /**
+     * Visibility of the repo on its host. Defaults to `'public'`.
+     */
+    visibility: GitopsRepoVisibility;
+    /**
+     * Whether the repo runs CI. Defaults to `true` for public repos and `false`
+     * for private repos, unless set explicitly.
+     */
+    ci: boolean;
+    /**
+     * Whether the repo is archived (read-only) on its host. Defaults to `false`.
+     */
+    archived: boolean;
 }
 export interface RawGitopsRepoConfig {
     repo_url: Url;
     repo_dir?: string | null;
     branch?: GitBranch;
+    /** Visibility of the repo on its host. Defaults to `'public'`. */
+    visibility?: GitopsRepoVisibility;
+    /** Whether the repo runs CI. Defaults to `true` for public, `false` for private. */
+    ci?: boolean;
+    /** Whether the repo is archived (read-only) on its host. Defaults to `false`. */
+    archived?: boolean;
 }
 export declare const create_empty_gitops_config: () => GitopsConfig;
 /**

package/dist/gitops_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gitops_config.d.ts","sourceRoot":"../src/lib/","sources":["../src/lib/gitops_config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAC,GAAG,EAAC,MAAM,yBAAyB,CAAC;AAGjD,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,yBAAyB,CAAC;AAIvD,MAAM,WAAW,YAAY;IAC5B,KAAK,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,kBAAkB,GAAG,CAChC,WAAW,EAAE,YAAY,KACrB,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;AAEhD,MAAM,WAAW,eAAe;IAC/B,KAAK,CAAC,EAAE,KAAK,CAAC,GAAG,GAAG,mBAAmB,CAAC,CAAC;IACzC,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAChC;;;;;;OAMG;IACH,QAAQ,EAAE,GAAG,CAAC;IAEd;;;;;;;;;;;OAWG;IACH,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IAExB;;OAEG;IACH,MAAM,EAAE,SAAS,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IACnC,QAAQ,EAAE,GAAG,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,CAAC,EAAE,SAAS,CAAC;CACnB;AAED,eAAO,MAAM,0BAA0B,QAAO,YAG5C,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,uBAAuB,GAAI,YAAY,eAAe,KAAG,YAUrE,CAAC;AAaF,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,kBAAkB,CAAC;CACvD;AAED,eAAO,MAAM,kBAAkB,GAAU,aAAa,MAAM,KAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAazF,CAAC;AAEF,eAAO,MAAM,6BAA6B,EAAE,CAC3C,aAAa,EAAE,GAAG,EAClB,WAAW,EAAE,MAAM,KACf,OAAO,CAAC,aAAa,IAAI,kBAS7B,CAAC"}
+{"version":3,"file":"gitops_config.d.ts","sourceRoot":"../src/lib/","sources":["../src/lib/gitops_config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAC,GAAG,EAAC,MAAM,yBAAyB,CAAC;AAGjD,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,yBAAyB,CAAC;AAIvD,MAAM,WAAW,YAAY;IAC5B,KAAK,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,kBAAkB,GAAG,CAChC,WAAW,EAAE,YAAY,KACrB,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;AAEhD,MAAM,WAAW,eAAe;IAC/B,KAAK,CAAC,EAAE,KAAK,CAAC,GAAG,GAAG,mBAAmB,CAAC,CAAC;IACzC,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,SAAS,CAAC;AAExD,MAAM,WAAW,gBAAgB;IAChC;;;;;;OAMG;IACH,QAAQ,EAAE,GAAG,CAAC;IAEd;;;;;;;;;;;OAWG;IACH,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IAExB;;OAEG;IACH,MAAM,EAAE,SAAS,CAAC;IAElB;;OAEG;IACH,UAAU,EAAE,oBAAoB,CAAC;IAEjC;;;OAGG;IACH,EAAE,EAAE,OAAO,CAAC;IAEZ;;OAEG;IACH,QAAQ,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IACnC,QAAQ,EAAE,GAAG,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,kEAAkE;IAClE,UAAU,CAAC,EAAE,oBAAoB,CAAC;IAClC,oFAAoF;IACpF,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,iFAAiF;IACjF,QAAQ,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,eAAO,MAAM,0BAA0B,QAAO,YAG5C,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,uBAAuB,GAAI,YAAY,eAAe,KAAG,YAUrE,CAAC;AAwBF,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,kBAAkB,CAAC;CACvD;AAED,eAAO,MAAM,kBAAkB,GAAU,aAAa,MAAM,KAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAazF,CAAC;AAEF,eAAO,MAAM,6BAA6B,EAAE,CAC3C,aAAa,EAAE,GAAG,EAClB,WAAW,EAAE,MAAM,KACf,OAAO,CAAC,aAAa,IAAI,kBAS7B,CAAC"}

package/dist/gitops_config.js

@@ -34,12 +34,23 @@ export const normalize_gitops_config = (raw_config) => {
 };
 const parse_fuz_repo_config = (r) => {
     if (typeof r === 'string') {
-        return { repo_url: r, repo_dir: null, branch: 'main' }; // TODO @zts use flavored for GitBranch
+        return {
+            repo_url: r,
+            repo_dir: null,
+            branch: 'main', // TODO @zts use flavored for GitBranch
+            visibility: 'public',
+            ci: true,
+            archived: false,
+        };
     }
+    const visibility = r.visibility ?? 'public';
     return {
         repo_url: strip_end(r.repo_url, '.git'),
         repo_dir: r.repo_dir ?? null,
         branch: r.branch ?? 'main', // TODO @zts use flavored for GitBranch
+        visibility,
+        ci: r.ci ?? visibility === 'public',
+        archived: r.archived ?? false,
     };
 };
 export const load_gitops_config = async (config_path) => {

package/dist/gitops_validate.task.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gitops_validate.task.d.ts","sourceRoot":"../src/lib/","sources":["../src/lib/gitops_validate.task.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,aAAa,CAAC;AACtC,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AActB,cAAc;AACd,eAAO,MAAM,IAAI;;;;;kBAiBf,CAAC;AACH,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;AAExC,cAAc;AACd,eAAO,MAAM,IAAI,EAAE,IAAI,CAAC,IAAI,CA2N3B,CAAC"}
+{"version":3,"file":"gitops_validate.task.d.ts","sourceRoot":"../src/lib/","sources":["../src/lib/gitops_validate.task.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,aAAa,CAAC;AACtC,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAetB,cAAc;AACd,eAAO,MAAM,IAAI;;;;;kBAiBf,CAAC;AACH,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;AAExC,cAAc;AACd,eAAO,MAAM,IAAI,EAAE,IAAI,CAAC,IAAI,CA8Q3B,CAAC"}

package/dist/gitops_validate.task.js

@@ -6,6 +6,7 @@ import { generate_publishing_plan, log_publishing_plan, } from './publishing_pla
 import { execute_publishing_plan } from './multi_repo_publisher.js';
 import { log_dependency_analysis } from './log_helpers.js';
 import { GITOPS_CONFIG_PATH_DEFAULT } from './gitops_constants.js';
+import { reconcile_ci, repo_has_workflows } from './ci_reconcile.js';
 /** @nodocs */
 export const Args = z.strictObject({
     config: z
@@ -58,7 +59,7 @@ export const task = {
             const errors = analysis.production_cycles.length > 0 ? 1 : 0;
             results.push({
                 command: 'gitops_analyze',
-                success: true,
+                success: errors === 0,
                 warnings,
                 errors,
                 duration: analyze_duration,
@@ -96,7 +97,7 @@ export const task = {
             const errors = plan.errors.length;
             results.push({
                 command: 'gitops_plan',
-                success: true,
+                success: errors === 0,
                 warnings,
                 errors,
                 duration: plan_duration,
@@ -160,6 +161,53 @@ export const task = {
             });
             log.error(st('red', `  ✗ gitops_publish (dry run) failed: ${error}`));
         }
+        // 4. Reconcile each repo's declared `ci` against actual workflow files on disk.
+        log.info(st('yellow', 'Running ci_reconcile...'));
+        const ci_start = Date.now();
+        try {
+            const ci_drift = reconcile_ci(local_repos.map((r) => ({
+                repo_url: r.repo_config.repo_url,
+                ci: r.repo_config.ci,
+                has_workflows: repo_has_workflows(r.repo_dir),
+                // TODO: `local_repos` only ever holds checked-out repos — a missing repo
+                // throws in `local_repos_ensure` before we reach here — so `checkable` is
+                // always `true` today. The gate exists for a future caller that loads a
+                // partial set; until then the skip path is inert and untested.
+                checkable: true,
+                archived: r.repo_config.archived,
+            })));
+            const ci_duration = Date.now() - ci_start;
+            const drift_details = ci_drift.map((d) => d.kind === 'missing_ci'
+                ? `${d.repo_url}: ci=true but no workflow files`
+                : `${d.repo_url}: ci=false but workflow files present`);
+            results.push({
+                command: 'ci_reconcile',
+                success: ci_drift.length === 0,
+                warnings: 0,
+                errors: ci_drift.length,
+                duration: ci_duration,
+            });
+            if (ci_drift.length === 0) {
+                log.info(st('green', `  ✓ ci_reconcile completed in ${ci_duration}ms`));
+            }
+            else {
+                log.error(st('red', `  ❌ ci_reconcile found ${ci_drift.length} drift(s)`));
+                for (const detail of drift_details) {
+                    log.error(st('red', `    - ${detail}`));
+                }
+            }
+        }
+        catch (error) {
+            const ci_duration = Date.now() - ci_start;
+            results.push({
+                command: 'ci_reconcile',
+                success: false,
+                warnings: 0,
+                errors: 1,
+                duration: ci_duration,
+            });
+            log.error(st('red', `  ✗ ci_reconcile failed: ${error}`));
+        }
         // Summary
         const total_duration = Date.now() - start_time;
         const all_success = results.every((r) => r.success);
@@ -200,11 +248,11 @@ export const task = {
                 log.warn(st('yellow', `⚠️  Note: ${total_warnings} warning(s) found - review output above.`));
             }
         }
-        else if (all_success && total_errors > 0) {
-            log.warn(st('yellow', '⚠️  Validation completed but found errors - review output above.'));
-        }
         else {
-            log.error(st('red', '❌ Validation failed - one or more commands did not complete.'));
+            // Hard-fail on any error or failed command. These run manually (and
+            // increasingly via agents), so a clear problem should stop the pipeline
+            // rather than scroll past in the summary. Warnings stay non-fatal.
+            log.error(st('red', '❌ Validation failed - review the errors above.'));
             throw new Error('Validation failed');
         }
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fuzdev/fuz_gitops",
-  "version": "0.75.0",
+  "version": "0.77.0",
   "description": "a tool for managing many repos",
   "glyph": "🪄",
   "logo": "logo.svg",
@@ -30,7 +30,7 @@
   },
   "peerDependencies": {
     "@fuzdev/fuz_css": ">=0.62.0",
-    "@fuzdev/fuz_ui": "^0.203.0",
+    "@fuzdev/fuz_ui": ">=0.205.1",
     "@fuzdev/fuz_util": ">=0.65.1",
     "@fuzdev/gro": ">=0.204.0",
     "@sveltejs/kit": "^2",
@@ -40,11 +40,12 @@
   "devDependencies": {
     "@changesets/changelog-git": "^0.2.1",
     "@fuzdev/blake3_wasm": "^0.1.1",
-    "@fuzdev/fuz_code": "^0.46.0",
-    "@fuzdev/fuz_css": "^0.62.0",
-    "@fuzdev/fuz_ui": "^0.203.1",
+    "@fuzdev/fuz_code": "^0.46.1",
+    "@fuzdev/fuz_css": "^0.63.2",
+    "@fuzdev/fuz_ui": "^0.205.1",
     "@fuzdev/fuz_util": "^0.65.1",
     "@fuzdev/gro": "^0.204.0",
+    "@fuzdev/mdz": "^0.1.0",
     "@ryanatkn/eslint-config": "^0.12.1",
     "@sveltejs/acorn-typescript": "^1.0.9",
     "@sveltejs/adapter-static": "^3.0.10",

package/src/lib/ci_reconcile.ts

@@ -0,0 +1,73 @@
+/**
+ * Reconciles each repo's declared `ci` flag against whether it actually has
+ * GitHub Actions workflow files on disk.
+ *
+ * The gitops config derives `ci` from visibility (on for public repos, off for
+ * private) with per-repo overrides; this check catches drift between that
+ * declaration and reality —
+ * a repo that claims CI but ships no workflow, or one that disclaims CI yet
+ * still carries one. Repos that aren't checked out locally can't be judged, so
+ * the caller marks them uncheckable and they're skipped. Archived repos are
+ * frozen on their host, so their CI state is intentionally left alone and they're
+ * skipped too.
+ *
+ * @module
+ */
+
+import {existsSync, readdirSync} from 'node:fs';
+import {join} from 'node:path';
+
+/** How a repo's declared `ci` diverges from its workflow files on disk. */
+export type CiDriftKind =
+	/** `ci` is `true` but the repo has no workflow files. */
+	| 'missing_ci'
+	/** `ci` is `false` but the repo has workflow files. */
+	| 'stray_ci';
+
+export interface CiDrift {
+	repo_url: string;
+	/** The declared/derived `ci` value. */
+	ci: boolean;
+	has_workflows: boolean;
+	kind: CiDriftKind;
+}
+
+export interface CiReconcileInput {
+	repo_url: string;
+	/** The declared/derived `ci` value from the gitops config. */
+	ci: boolean;
+	/** Whether the repo has at least one workflow file on disk. */
+	has_workflows: boolean;
+	/** Whether the repo is checked out locally; uncheckable repos are skipped. */
+	checkable: boolean;
+	/** Whether the repo is archived (frozen) on its host; archived repos are skipped. */
+	archived: boolean;
+}
+
+/**
+ * Compares each repo's declared `ci` against its actual workflow presence.
+ * @returns one `CiDrift` per repo whose declaration and reality disagree
+ */
+export const reconcile_ci = (repos: Array<CiReconcileInput>): Array<CiDrift> => {
+	const drift: Array<CiDrift> = [];
+	for (const repo of repos) {
+		if (!repo.checkable || repo.archived) continue;
+		const {repo_url, ci, has_workflows} = repo;
+		if (ci && !has_workflows) {
+			drift.push({repo_url, ci, has_workflows, kind: 'missing_ci'});
+		} else if (!ci && has_workflows) {
+			drift.push({repo_url, ci, has_workflows, kind: 'stray_ci'});
+		}
+	}
+	return drift;
+};
+
+/**
+ * Whether a local repo directory contains at least one GitHub Actions workflow.
+ * @param repo_dir - absolute or cwd-relative path to the repo's local directory
+ */
+export const repo_has_workflows = (repo_dir: string): boolean => {
+	const workflows_dir = join(repo_dir, '.github', 'workflows');
+	if (!existsSync(workflows_dir)) return false;
+	return readdirSync(workflows_dir).some((file) => file.endsWith('.yml') || file.endsWith('.yaml'));
+};

package/src/lib/config_reconcile.ts

@@ -0,0 +1,94 @@
+/**
+ * Reconciles repo metadata across multiple gitops configs.
+ *
+ * The ecosystem keeps several gitops configs — a canonical superset plus
+ * narrower per-project subsets. They can't share one source of truth (the
+ * superset includes private repos that public configs may not reference), so the
+ * same repo is declared independently in each. This check flags when a subset's
+ * intrinsic fields drift from the canonical config, or when a subset lists a
+ * repo the canonical config doesn't. `repo_dir` is per-config and ignored.
+ *
+ * @module
+ */
+
+import type {GitopsRepoConfig} from './gitops_config.js';
+
+/** Repo fields that must agree across every config that lists the repo. */
+const INTRINSIC_FIELDS = ['visibility', 'ci', 'archived', 'branch'] as const;
+
+export type IntrinsicField = (typeof INTRINSIC_FIELDS)[number];
+
+export type ConfigDriftKind =
+	/** The repo is in a subset config but absent from the canonical config. */
+	| 'missing_from_canonical'
+	/** An intrinsic field disagrees between the subset and the canonical config. */
+	| 'field_mismatch';
+
+export interface ConfigDrift {
+	repo_url: string;
+	/** Name of the subset config whose entry diverges. */
+	config: string;
+	kind: ConfigDriftKind;
+	/** The field that disagrees, set when `kind` is `'field_mismatch'`. */
+	field?: IntrinsicField;
+	/** The canonical config's value, set when `kind` is `'field_mismatch'`. */
+	canonical_value?: string;
+	/** The subset config's value, set when `kind` is `'field_mismatch'`. */
+	config_value?: string;
+}
+
+export interface NamedRepos {
+	name: string;
+	repos: Array<GitopsRepoConfig>;
+}
+
+const field_value = (repo: GitopsRepoConfig, field: IntrinsicField): string => {
+	switch (field) {
+		case 'visibility':
+			return repo.visibility;
+		case 'ci':
+			return String(repo.ci);
+		case 'archived':
+			return String(repo.archived);
+		case 'branch':
+			return repo.branch;
+	}
+};
+
+/**
+ * Compares each subset config against the canonical config. Repos that live only
+ * in the canonical config are fine — the subsets are intentional partial views.
+ * @returns one `ConfigDrift` per subset entry that is missing from the canonical
+ * config or whose intrinsic fields disagree with it
+ */
+export const reconcile_configs = (
+	canonical: NamedRepos,
+	subsets: Array<NamedRepos>,
+): Array<ConfigDrift> => {
+	const drift: Array<ConfigDrift> = [];
+	const canonical_by_url = new Map(canonical.repos.map((r) => [r.repo_url, r] as const));
+	for (const subset of subsets) {
+		for (const repo of subset.repos) {
+			const canon = canonical_by_url.get(repo.repo_url);
+			if (!canon) {
+				drift.push({repo_url: repo.repo_url, config: subset.name, kind: 'missing_from_canonical'});
+				continue;
+			}
+			for (const field of INTRINSIC_FIELDS) {
+				const canonical_value = field_value(canon, field);
+				const config_value = field_value(repo, field);
+				if (canonical_value !== config_value) {
+					drift.push({
+						repo_url: repo.repo_url,
+						config: subset.name,
+						kind: 'field_mismatch',
+						field,
+						canonical_value,
+						config_value,
+					});
+				}
+			}
+		}
+	}
+	return drift;
+};

package/src/lib/gitops_config.ts

@@ -32,6 +32,13 @@ export interface RawGitopsConfig {
 	repos_dir?: string;
 }
 
+/**
+ * Visibility of a repo on its host, mirroring the host's own model
+ * (e.g. GitHub's `visibility` field). Named to avoid confusion with the npm
+ * `package.json` `private` flag, which is a separate publishing concern.
+ */
+export type GitopsRepoVisibility = 'public' | 'private';
+
 export interface GitopsRepoConfig {
 	/**
 	 * The HTTPS URL to the repo. Does not include a `.git` suffix.
@@ -60,12 +67,34 @@ export interface GitopsRepoConfig {
 	 * The branch name to use when fetching the repo. Defaults to `main`.
 	 */
 	branch: GitBranch;
+
+	/**
+	 * Visibility of the repo on its host. Defaults to `'public'`.
+	 */
+	visibility: GitopsRepoVisibility;
+
+	/**
+	 * Whether the repo runs CI. Defaults to `true` for public repos and `false`
+	 * for private repos, unless set explicitly.
+	 */
+	ci: boolean;
+
+	/**
+	 * Whether the repo is archived (read-only) on its host. Defaults to `false`.
+	 */
+	archived: boolean;
 }
 
 export interface RawGitopsRepoConfig {
 	repo_url: Url;
 	repo_dir?: string | null;
 	branch?: GitBranch;
+	/** Visibility of the repo on its host. Defaults to `'public'`. */
+	visibility?: GitopsRepoVisibility;
+	/** Whether the repo runs CI. Defaults to `true` for public, `false` for private. */
+	ci?: boolean;
+	/** Whether the repo is archived (read-only) on its host. Defaults to `false`. */
+	archived?: boolean;
 }
 
 export const create_empty_gitops_config = (): GitopsConfig => ({
@@ -91,12 +120,23 @@ export const normalize_gitops_config = (raw_config: RawGitopsConfig): GitopsConf
 
 const parse_fuz_repo_config = (r: Url | RawGitopsRepoConfig): GitopsRepoConfig => {
 	if (typeof r === 'string') {
-		return {repo_url: r, repo_dir: null, branch: 'main' as GitBranch}; // TODO @zts use flavored for GitBranch
+		return {
+			repo_url: r,
+			repo_dir: null,
+			branch: 'main' as GitBranch, // TODO @zts use flavored for GitBranch
+			visibility: 'public',
+			ci: true,
+			archived: false,
+		};
 	}
+	const visibility = r.visibility ?? 'public';
 	return {
 		repo_url: strip_end(r.repo_url, '.git'),
 		repo_dir: r.repo_dir ?? null,
 		branch: r.branch ?? ('main' as GitBranch), // TODO @zts use flavored for GitBranch
+		visibility,
+		ci: r.ci ?? visibility === 'public',
+		archived: r.archived ?? false,
 	};
 };
 

package/src/lib/gitops_validate.task.ts

@@ -12,6 +12,7 @@ import {
 import {execute_publishing_plan, type PublishingOptions} from './multi_repo_publisher.js';
 import {log_dependency_analysis} from './log_helpers.js';
 import {GITOPS_CONFIG_PATH_DEFAULT} from './gitops_constants.js';
+import {reconcile_ci, repo_has_workflows} from './ci_reconcile.js';
 
 /** @nodocs */
 export const Args = z.strictObject({
@@ -86,7 +87,7 @@ export const task: Task<Args> = {
 
 			results.push({
 				command: 'gitops_analyze',
-				success: true,
+				success: errors === 0,
 				warnings,
 				errors,
 				duration: analyze_duration,
@@ -129,7 +130,7 @@ export const task: Task<Args> = {
 
 			results.push({
 				command: 'gitops_plan',
-				success: true,
+				success: errors === 0,
 				warnings,
 				errors,
 				duration: plan_duration,
@@ -202,6 +203,56 @@ export const task: Task<Args> = {
 			log.error(st('red', `  ✗ gitops_publish (dry run) failed: ${error}`));
 		}
 
+		// 4. Reconcile each repo's declared `ci` against actual workflow files on disk.
+		log.info(st('yellow', 'Running ci_reconcile...'));
+		const ci_start = Date.now();
+		try {
+			const ci_drift = reconcile_ci(
+				local_repos.map((r) => ({
+					repo_url: r.repo_config.repo_url,
+					ci: r.repo_config.ci,
+					has_workflows: repo_has_workflows(r.repo_dir),
+					// TODO: `local_repos` only ever holds checked-out repos — a missing repo
+					// throws in `local_repos_ensure` before we reach here — so `checkable` is
+					// always `true` today. The gate exists for a future caller that loads a
+					// partial set; until then the skip path is inert and untested.
+					checkable: true,
+					archived: r.repo_config.archived,
+				})),
+			);
+			const ci_duration = Date.now() - ci_start;
+			const drift_details = ci_drift.map((d) =>
+				d.kind === 'missing_ci'
+					? `${d.repo_url}: ci=true but no workflow files`
+					: `${d.repo_url}: ci=false but workflow files present`,
+			);
+			results.push({
+				command: 'ci_reconcile',
+				success: ci_drift.length === 0,
+				warnings: 0,
+				errors: ci_drift.length,
+				duration: ci_duration,
+			});
+			if (ci_drift.length === 0) {
+				log.info(st('green', `  ✓ ci_reconcile completed in ${ci_duration}ms`));
+			} else {
+				log.error(st('red', `  ❌ ci_reconcile found ${ci_drift.length} drift(s)`));
+				for (const detail of drift_details) {
+					log.error(st('red', `    - ${detail}`));
+				}
+			}
+		} catch (error) {
+			const ci_duration = Date.now() - ci_start;
+			results.push({
+				command: 'ci_reconcile',
+				success: false,
+				warnings: 0,
+				errors: 1,
+				duration: ci_duration,
+			});
+			log.error(st('red', `  ✗ ci_reconcile failed: ${error}`));
+		}
+
 		// Summary
 		const total_duration = Date.now() - start_time;
 		const all_success = results.every((r) => r.success);
@@ -247,10 +298,11 @@ export const task: Task<Args> = {
 					st('yellow', `⚠️  Note: ${total_warnings} warning(s) found - review output above.`),
 				);
 			}
-		} else if (all_success && total_errors > 0) {
-			log.warn(st('yellow', '⚠️  Validation completed but found errors - review output above.'));
 		} else {
-			log.error(st('red', '❌ Validation failed - one or more commands did not complete.'));
+			// Hard-fail on any error or failed command. These run manually (and
+			// increasingly via agents), so a clear problem should stop the pipeline
+			// rather than scroll past in the summary. Warnings stay non-fatal.
+			log.error(st('red', '❌ Validation failed - review the errors above.'));
 			throw new Error('Validation failed');
 		}
 	},