@mindexed/cfact 1.1.0 → 1.1.1

package/bin/claude-factory.js

@@ -648,7 +648,31 @@ function resolveSource(opts, pin) {
   }
   const base = channelBase(opts, pin);
   if (base) {
-    return { kind: 'url', via: 'studio', ref: `${base.replace(/\/+$/, '')}/${asset}`, bearerEnv: ENGINE_TOKEN_NAMES };
+    // THIS CHANNEL NOW CARRIES A FALLBACK TOO, AND IT USED TO BE ARGUED IT DID
+    // NOT NEED ONE (FF-278, ADR-0203). ADR-0194 reasoned that the studio is
+    // "STRUCTURAL — version-keyed end to end", so both prefixes reach the same
+    // stored object and no fallback is warranted. That reasoning was correct
+    // about the STORE and wrong about the SERVING PATH: a filename validator sits
+    // in FRONT of the version-keyed lookup, and until it was widened and
+    // DEPLOYED it rejected `cfact-engine-*` outright. Measured on a real
+    // consumer: every version 400ed under the new name while the legacy name
+    // returned a valid tarball, so the DEFAULT channel was dead for every
+    // consumer on installer 1.1.0+ with no override.
+    //
+    // The general form is the part worth keeping: a structural claim about
+    // another repo must name WHICH CODE PATH it is about. "The store is keyed on
+    // version" and "the endpoint accepts this name" are different statements
+    // about different code, and nothing in this repo can check either one
+    // (rules/narrative-drift.md class 1). Where the claim is unverifiable from
+    // here, the addressed site owes a fallback — which costs one extra request
+    // ONLY on a failure that is already fatal, and nothing at all on success.
+    return {
+      kind: 'url',
+      via: 'studio',
+      ref: `${base.replace(/\/+$/, '')}/${asset}`,
+      fallbackRef: `${base.replace(/\/+$/, '')}/${LEGACY_ASSET(version)}`,
+      bearerEnv: ENGINE_TOKEN_NAMES,
+    };
   }
 
   // OPT-IN FALLBACK channel (ADR-0093, narrowed by ADR-0168): a GitHub Release
@@ -662,7 +686,8 @@ function resolveSource(opts, pin) {
   // private repo, prefer the studio channel above, or --url with the exact asset.
   const repo = opts.repo || pin.repo || DEFAULT_REPO;
   const releaseBase = `https://github.com/${repo}/releases/download/engine-v${version}`;
-  // THIS CHANNEL NEEDS A FALLBACK AND THE STUDIO DOES NOT (ADR-0194). The
+  // WHY THIS CHANNEL NEEDS ITS FALLBACK (ADR-0194; the studio has one too as of
+  // ADR-0203 — see below, and do NOT "restore the asymmetry"). The
   // publisher attaches both asset names, but only to releases it publishes FROM
   // NOW ON — and a published release is immutable (ADR-0128: an existing tag is
   // an idempotent skip, never an asset re-upload). So on a NAME-keyed channel the
@@ -672,14 +697,19 @@ function resolveSource(opts, pin) {
   //
   // That is ADR-0192's read-vs-address proviso failing in the one direction the
   // ADR did not take it. Its test asks whether something outside this repo keeps
-  // the old value resolving; the answer is structural for the studio (version-
-  // keyed, so both names always reach the same object) and merely FORWARD-LOOKING
-  // here. Where the proviso holds in only one direction, the addressed site owes a
-  // fallback for the other.
+  // the old value resolving, and here the answer is merely FORWARD-LOOKING: every
+  // already-published release carries the legacy asset alone. Where the proviso
+  // holds in only one direction, the addressed site owes a fallback for the other.
   //
-  // Scoped to this branch on purpose: the studio needs no fallback, and giving it
-  // one would spend a wasted round-trip on the DEFAULT channel to paper over a
-  // problem it does not have.
+  // BOTH CHANNELS NOW CARRY ONE, and this comment used to say the opposite —
+  // "the studio needs no fallback, and giving it one would spend a wasted
+  // round-trip on the DEFAULT channel to paper over a problem it does not have."
+  // The studio DID have that problem (FF-278, ADR-0203): its serving-path
+  // validator rejected the new name for every version, and the round-trip is not
+  // wasted because a fallback costs a request only on a failure that is otherwise
+  // fatal. The two channels reach the same need by different routes — this one
+  // because published releases are immutable, the studio because a claim about
+  // another repo's code path could not be checked from here.
   return {
     kind: 'url',
     via: 'github-releases',
@@ -996,12 +1026,23 @@ async function fetchToFile(source, destFile) {
   } catch (e) {
     die(`download failed — ${e.message}`);
   }
-  // A 404 with a fallback is the pre-ADR-0194 release: retry ONCE on the legacy
-  // asset name. Deliberately narrow on all three axes — only 404 (a 401 means the
-  // token, and retrying would report the wrong cause), only when resolveSource set
-  // a fallbackRef (the github channel and no other), and only once (two names
-  // exist, so a loop could only re-request one of them).
-  if (res.status === 404 && source.fallbackRef) {
+  // A 404 or a 400 with a fallback means THE NAME DID NOT RESOLVE: retry ONCE on
+  // the legacy asset name. Still deliberately narrow — only when resolveSource
+  // set a fallbackRef, and only once (two names exist, so a loop could only
+  // re-request one of them).
+  //
+  // 400 joined 404 with ADR-0203. They are one condition stated by two servers:
+  // a name-keyed store answers "no such asset" with 404, and a server that
+  // VALIDATES the filename before looking anything up rejects it with 400 —
+  // measured, verbatim `{"error":"Invalid engine tarball filename."}` from the
+  // studio for every version under the new prefix. A 404-only trigger reads that
+  // as fatal and never tries the name that works.
+  //
+  // 401 STAYS EXCLUDED, and that exclusion is the load-bearing half: a 401 means
+  // the token, so retrying under a second name would burn a request and then
+  // report the wrong cause — and the stripped-bearer diagnosis below exists
+  // precisely because a 401 here is already hard to attribute.
+  if ((res.status === 404 || res.status === 400) && source.fallbackRef) {
     info(`  not found under the current asset name; retrying ${source.fallbackRef}`);
     try {
       res = await fetch(source.fallbackRef, { headers, redirect: 'follow' });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mindexed/cfact",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "Clean Orthogonal Architecture Software Factory Framework",
   "bin": {
     "claude-factory": "bin/claude-factory.js",
@@ -66,10 +66,13 @@
     "publish:release": "node maintainer-hooks/publish-release.js",
     "gate:consistency": "npm run gate:matrix-sync && npm run gate:compliance && npm run gate:doc-links && npm run gate:command-metadata && npm run gate:tracked-symlinks && npm run gate:agents-md-sync && npm run gate:ripple-coverage && npm run gate:profile-docs && npm run gate:registry && npm run gate:adr-template-edges && npm run gate:installer-publish-drift",
     "gate:boundaries": "bash hooks/check-matrix.sh domain && bash hooks/check-matrix.sh components && bash hooks/check-matrix.sh controllers && bash hooks/check-matrix.sh secrets",
-    "ci": "npm run gate:consistency && npm run gate:boundaries && npm run gate:profile-coverage && npm run gate:changelog && npm run test:dc-generator && npm run test:substance-generator && npm run test:json-flush && npm run test:installer-exit && npm run test:installer-channel && npm run test:installer-wiring && npm run test:tar-invocation && npm run test:framework-agents-mcp && npm run test:controller-gates && npm run test:git-tree-sweep && npm run test:secrets-two-stage && npm run test:profile-paths && npm run test:registry-gate && npm run test:adr-template-edges && npm run test:adr-path-constants && npm run test:graph-strip && npm run test:graph-registry && npm run test:frontmatter-readers && npm run test:tarball-reproducible && npm run test:release-version && npm run test:consumer-checklist && npm run test:workflow-spine && npm run test:command-shape && npm run test:change-record && npm run test:installer-publish-drift && npm run test:grants-authored && npm run test:test-capability && npm run test:installer-lifecycle && npm run test:gate-three-state && npm run test:refresh-compliance && npm run test:gate-coverage && npm run test:installer-shadowing && npm run test:feature-record",
+    "ci": "npm run gate:consistency && npm run gate:boundaries && npm run gate:profile-coverage && npm run gate:changelog && npm run test:dc-generator && npm run test:substance-generator && npm run test:json-flush && npm run test:installer-exit && npm run test:installer-channel && npm run test:installer-wiring && npm run test:tar-invocation && npm run test:framework-agents-mcp && npm run test:controller-gates && npm run test:git-tree-sweep && npm run test:secrets-two-stage && npm run test:profile-paths && npm run test:registry-gate && npm run test:adr-template-edges && npm run test:adr-path-constants && npm run test:graph-strip && npm run test:graph-registry && npm run test:frontmatter-readers && npm run test:tarball-reproducible && npm run test:release-version && npm run test:consumer-checklist && npm run test:workflow-spine && npm run test:command-shape && npm run test:change-record && npm run test:installer-publish-drift && npm run test:grants-authored && npm run test:test-capability && npm run test:installer-lifecycle && npm run test:gate-three-state && npm run test:refresh-compliance && npm run test:gate-coverage && npm run test:installer-shadowing && npm run test:feature-record && npm run test:consumer-docs-migration && npm run test:npm-deprecation",
     "test:gate-three-state": "node scripts/test-gate-three-state.js",
     "test:refresh-compliance": "node scripts/test-refresh-compliance.js",
-    "test:gate-coverage": "node scripts/test-gate-coverage.js"
+    "test:gate-coverage": "node scripts/test-gate-coverage.js",
+    "test:consumer-docs-migration": "node scripts/test-consumer-docs-migration.js",
+    "test:sot-templates-pointer": "node scripts/test-sot-templates-pointer.js",
+    "test:npm-deprecation": "node scripts/test-npm-deprecation.js"
   },
   "keywords": [],
   "author": "",