@ngockhoale/ukit 3.4.36 → 3.4.37

package/CHANGELOG.md

@@ -9,6 +9,13 @@ All notable changes to UKit are documented here.
 - New `/ukit:ci-check` command + `ci-check.mjs` helper (core pack): prechecks, fail-closed budget guard, local preflight, at most one dispatch per invocation, write-ahead run-id state, `status` (never dispatches), `--ref`, `--dry-run`, per-OS report. Never pushes, merges or publishes.
 - Default-branch bootstrap stub documented in `docs/design/CI-CROSS-PLATFORM-MATRIX.md` (requires separate approval).
 
+## 3.4.37 - 2026-10-12
+
+**Completion Gate: a clean, in-sync branch observation discharges a masked commit+push.**
+- Root cause: commit/push run inside a heredoc/`;`/pipe chain correctly mint an exit-unproven (failed) mutation receipt, and no later independent observation could ever discharge the `git-integrity` goal, so a finished, published release kept blocking Stop with `operation-verification`.
+- Fix: a standalone whole-tree `git status -sb` that prints exactly one `## branch...upstream` line (clean, no ahead/behind/gone) after every recorded git mutation attempt is a trusted `synced-state` proof for commit/push goals. Piped/failed/dirty/ahead/behind/no-upstream/earlier/other-task observations never count.
+- Regression: `tests/hooks/gitSyncPostcondition.test.js` (RED on 3.4.36). No real Windows run.
+
 ## 3.4.36 - 2026-10-12
 
 **Completion Gate: a finished task (incl. a release) stays finished across wakeups, compaction and repeated Stops.**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ngockhoale/ukit",
-  "version": "3.4.36",
+  "version": "3.4.37",
   "description": "Install/update an index-first AI workspace for Claude Code, OpenAI Codex and omp (Oh My Pi).",
   "license": "MIT",
   "type": "module",

package/template_project/.claude/ukit/runtime/cron-operation-adapter.mjs

@@ -51,6 +51,9 @@ const GIT_MUTATION = /^git\s+(?:push|commit|clean|reset|merge|rebase|stash|tag|c
 const GIT_VERB = /^git\s+(push|commit|clean|reset|merge|rebase|stash|tag|checkout|restore|pull|cherry-pick|branch)\b/;
 const GIT_STATE = /^git\s+(?:fsck\b|diff\s+(?:--check|--exit-code|--quiet)\b|status\s+(?:--porcelain|-s|--short)\b)/;
 const SERVICE_MUTATION = /^(?:docker(?:\s+compose)?|docker-compose)\s+(?:restart|up|down|stop|start|build)\b|^(?:sudo\s+)?systemctl\s+(?:restart|start|stop|reload)\b|^pm2\s+(?:restart|reload|start)\b|^kubectl\s+(?:rollout|apply)\b|^launchctl\s+kickstart\b|^(?:\.\/)?(?:scripts\/)?deploy[\w.-]*(?:\s|$)|^(?:npm|yarn|pnpm)\s+(?:run\s+)?deploy\b/;
+// Whole-tree branch status: a clean tree whose branch line carries no [ahead]/[behind]/gone marker proves
+// commit + push landed regardless of how they were run (a masked heredoc chain mints no mutation receipt).
+const GIT_SYNC = /^git\s+status\s+(?:-sb|-bs|--short\s+--branch|--branch\s+--short)\s*$/;
 const DRY_RUN = /(?:^|\s)(?:--dry-run|--check|--no-act|-n)(?:\s|=|$)/;
 const CURL = /^curl\s/;
 function requiredTargetOf(segment, required) {
@@ -68,11 +71,15 @@ export function bashOperationReceipt(command, response, transportSuccess, goal,
   const real = command.split('&&').map((seg) => seg.trim());
   const text = responseText(response);
   const hasOutputField = typeof response === 'string' || typeof response?.stdout === 'string' || typeof response?.output === 'string';
-  let role = null; let proven = false; let target = null;
+  let role = null; let proven = false; let target = null; let synced = false;
   for (const seg of real) {
     if (!seg || /^cd\s+\S+$/.test(seg) || DRY_RUN.test(seg.replace(/'[^']*'|"[^"]*"/g, '""'))) continue;
     if (domain === 'git-integrity') {
-      if (GIT_STATE.test(seg)) {
+      if (GIT_SYNC.test(seg)) {
+        const lines = text.split('\n').map((l) => l.trimEnd()).filter(Boolean);
+        role = 'state'; synced = hasOutputField && lines.length === 1 && /^## [^\s.]\S*\.\.\.\S+$/.test(lines[0]);
+        proven = synced;
+      } else if (GIT_STATE.test(seg)) {
         const wanted = goal.check;
         const kind = /\bfsck\b/.test(seg) ? 'fsck' : /\bdiff\b/.test(seg) ? 'diff-check' : 'status';
         // `-- <pathspec>` / extra paths narrow the check; only a whole-tree status proves a clean tree.
@@ -106,7 +113,7 @@ export function bashOperationReceipt(command, response, transportSuccess, goal,
   return { kind: 'operation', success: ok, transportSuccess: transportSuccess === true, harness,
     ...(masked ? { exitStatusUnproven: true } : {}),
     operation: { domain, role, scope, target: role === 'state' ? null : target,
-      ...(role === 'state' ? { state: 'verified', complete: ok } : {}) } };
+      ...(role === 'state' ? { state: 'verified', complete: ok, ...(synced && ok ? { synced: true } : {}) } : {}) } };
 }
 
 // Release evidence: `npm publish` and `npm view <pkg> version` as REAL Bash tool results. The command must

package/template_project/.claude/ukit/runtime/operation-evidence.mjs

@@ -12,7 +12,7 @@ export function compactOperation(operation) {
   return { domain: operation.domain, scope: operation.scope, role: operation.role, target: operation.target,
     ...(operation.state !== undefined ? { state: operation.state } : {}),
     ...(operation.presentTargets !== undefined ? { presentTargets: operation.presentTargets === null ? null : [...operation.presentTargets] } : {}),
-    complete: operation.complete === true };
+    complete: operation.complete === true, ...(operation.synced === true ? { synced: true } : {}) };
 }
 export function foldOperationEvidence(bank = {}, receipt, ledger) {
   const raw = receipt?.operation;
@@ -46,6 +46,7 @@ export function foldOperationEvidence(bank = {}, receipt, ledger) {
       ...(op.state !== undefined ? { state: op.state } : {}),
       ...(op.presentTargets !== undefined ? { presentTargets: [...op.presentTargets] } : {}),
       complete: op.complete === true,
+      ...(op.synced === true ? { synced: true } : {}),
     } };
   return { ...bank, seenToolUseIds: receipt.toolUseId ? [...seen, receipt.toolUseId] : seen,
     [key]: { ...prior, [op.role]: proof } };
@@ -75,6 +76,10 @@ export function operationEvidenceStatus(goal, ledger = {}) {
     && (absent || (!Object.hasOwn(op || {}, 'presentTargets') && op?.target === goal.target));
   if (!observation?.success || !observation.toolUseId || !Number.isSafeInteger(observation.sequence)
     || op.complete !== true || !stateMatches) return incomplete;
+  // Independent postcondition: a trusted clean+in-sync branch observation made AFTER every recorded git
+  // mutation attempt (failed or masked ones included) proves commit/push landed. Never for other targets.
+  if (goal.domain === 'git-integrity' && op.synced === true && requiredTargets.every((t) => t === 'commit' || t === 'push')
+    && attempts.every((r) => observation.sequence > r.sequence)) return { complete: true, operationProof: 'synced-state' };
   if (goal.completionSemantics === 'ensure-state' && attempts.length === 0) {
     return { complete: true, operationProof: 'desired-state-only' };
   }