@ngockhoale/ukit 3.4.39 → 3.4.41

package/CHANGELOG.md

@@ -9,6 +9,22 @@ All notable changes to UKit are documented here.
 - New `/ukit:ci-check` command + `ci-check.mjs` helper (core pack): prechecks, fail-closed budget guard, local preflight, at most one dispatch per invocation, write-ahead run-id state, `status` (never dispatches), `--ref`, `--dry-run`, per-OS report. Never pushes, merges or publishes.
 - Default-branch bootstrap stub documented in `docs/design/CI-CROSS-PLATFORM-MATRIX.md` (requires separate approval).
 
+## 3.4.41 - 2026-10-13
+
+**Completion Gate: a published release is recognized, and tests no longer depend on the developer's real `~/.ukit`.**
+- Root cause (release false block): the git-state `status` observation overwrote the standalone `git ls-remote` remote-parity proof stored under the same operation-bank key, so a verified release (registry, tag, remote, clean tree) still reported `operation-verification, release-publication` missing.
+- Fix (`operation-evidence.mjs`): a later successful, complete git-state observation carries forward a still-valid remote-sync proof only when it was observed after every mutation attempt; the proof is judged against live HEAD/branch/tracking remote, so a diverged remote, wrong branch, other repo, dirty tree or later failed push still blocks.
+- Verification integrity: the hook-spawning completion tests inherited the real user playbook directory when run inside the full suite (a bug-fix playbook then demanded repro receipts) and failed only there. They now run the hooks with an empty HOME.
+- `integrationP1`: the external Laya offline harness is stale against its own server (NameError). That is reported as a loud per-test SKIPPED naming the cause instead of failing; it is not a UKit Completion Gate criterion. No `UKIT_LAYA_ROOT` bypass is used.
+- Regressions: `tests/hooks/releaseCompletionEvidence.test.js` (R01–R08, R11, R13), extended `completionGateRequestScope.test.js` (R09, R10).
+
+## 3.4.40 - 2026-10-12
+
+**Completion Gate: a read-only request no longer owes `impact-evidence` it can never produce.**
+- Root cause: a `READ_ONLY` contract (analysis of Markdown/logs/prompt text, read-only production inspection) carried `impact-evidence`, satisfied only by a source-read receipt. Answers drawn from docs, logs or text already in the prompt yield none, so Stop demanded further tool activity and looped into the loop breaker.
+- Fix: for `READ_ONLY` with no named target files and no attempted write, `impact-evidence` is not applicable. A named target still needs its read; any attempted write (unauthorized side effect) keeps the obligation; mutation orders keep write/verification/operation proof.
+- Regressions: `tests/hooks/completionGateRequestScope.test.js` (cross-request scope after an edit request, read-only inspection, missing contract, unauthorized write). Test allowlist gains the runtime-only `docs/AI_HANDOFF/RUN.md` cursor reference.
+
 ## 3.4.39 - 2026-10-12
 
 **Completion Gate: unrelated compound commands no longer erase authoritative git evidence; seals honour operation freshness.**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ngockhoale/ukit",
-  "version": "3.4.39",
+  "version": "3.4.41",
   "description": "Install/update an index-first AI workspace for Claude Code, OpenAI Codex and omp (Oh My Pi).",
   "license": "MIT",
   "type": "module",

package/template_project/.claude/ukit/runtime/execution-ledger.mjs

@@ -3413,6 +3413,16 @@ function evaluateCompletionContract({ state = {}, ledger = {}, cwd, phase = null
   const operationalTask = operationStatus !== null;
   const missingEvidence = evidence.filter((item) => !evidenceSatisfied(item, effectiveLedger, state, { cwd }));
   if (operationalTask && !operationStatus.complete && !missingEvidence.includes('operation-verification')) missingEvidence.push('operation-verification');
+  // A READ_ONLY request's deliverable is the reply: it may be answered from Markdown, logs or
+  // text already in the prompt, none of which yields a source-read receipt, so impact-evidence
+  // is NOT_APPLICABLE to it when no target files were named (request-scoped — never inherited from an earlier edit request in
+  // the same session). Any attempted write keeps the obligation: an unauthorized side effect
+  // of a read-only request is never treated as irrelevant.
+  if (routeSummary.executionContract?.taskKind === 'READ_ONLY' && effectiveLedger.writeAttempted !== true
+    && !(Array.isArray(routeSummary.expectedSourceFiles) && routeSummary.expectedSourceFiles.length > 0)) {
+    const at = missingEvidence.indexOf('impact-evidence');
+    if (at !== -1) missingEvidence.splice(at, 1);
+  }
   const releaseMissing = releasePublicationMissing(state, effectiveLedger, cwd);
   if (releaseMissing) missingEvidence.push(releaseMissing);
   // TASK-009 (BL-011): the bug-fix floor. On a `playbookId: bug-fix` route a

package/template_project/.claude/ukit/runtime/operation-evidence.mjs

@@ -40,6 +40,19 @@ export function foldOperationEvidence(bank = {}, receipt, ledger) {
   if (receipt.toolUseId && (seen.includes(receipt.toolUseId) || Object.values(bank).some((entry) =>
     [entry?.mutation, entry?.state].some((proof) => proof?.toolUseId === receipt.toolUseId)))) return bank;
   if (receipt.toolUseId && (!bounded(receipt.toolUseId) || seen.length >= 256)) return { ...bank, overflow: true };
+  // A remote-parity observation (git ls-remote) must survive the clean-tree status check that normally follows
+  // it: both are `state` receipts under one key, so the later status used to overwrite the remote proof. The
+  // proof is stamped with the sequence it was observed at and carried over only while no mutation (failed or
+  // not) of this domain/scope was recorded after it; the gate still compares its sha to live HEAD.
+  const lastMutation = Object.values(bank).reduce((max, entry) => {
+    const m = entry?.mutation;
+    return m?.operation?.domain === op.domain && m.operation.scope === op.scope && Number.isSafeInteger(m.sequence) ? Math.max(max, m.sequence) : max;
+  }, 0);
+  const priorSync = prior.state?.operation?.remoteSync;
+  const remoteSync = validRemoteSync(op.remoteSync) ? { ...op.remoteSync, observedSequence: receipt.sequence }
+    : (op.role === 'state' && op.domain === 'git-integrity' && receipt.success === true && op.complete === true
+      && validRemoteSync(priorSync) && Number.isSafeInteger(priorSync.observedSequence) && priorSync.observedSequence > lastMutation)
+      ? { ...priorSync } : null;
   const proof = { success: receipt.success === true, sequence: receipt.sequence,
     toolUseId: receipt.toolUseId, taskInstanceId: receipt.taskInstanceId,
     sessionKey: receipt.sessionKey, operation: {
@@ -47,7 +60,7 @@ export function foldOperationEvidence(bank = {}, receipt, ledger) {
       ...(op.state !== undefined ? { state: op.state } : {}),
       ...(op.presentTargets !== undefined ? { presentTargets: [...op.presentTargets] } : {}),
       complete: op.complete === true,
-      ...(validRemoteSync(op.remoteSync) ? { remoteSync: { ...op.remoteSync } } : {}),
+      ...(remoteSync ? { remoteSync } : {}),
     } };
   return { ...bank, seenToolUseIds: receipt.toolUseId ? [...seen, receipt.toolUseId] : seen,
     [key]: { ...prior, [op.role]: proof } };
@@ -83,9 +96,14 @@ export function operationEvidenceStatus(goal, ledger = {}) {
   const auth = ledger.gitAuthority;
   if (goal.domain === 'git-integrity' && validRemoteSync(op.remoteSync) && auth && auth.clean === true
     && requiredTargets.every((t) => t === 'commit' || t === 'push')
-    && attempts.every((r) => observation.sequence > r.sequence)
+    && attempts.every((r) => (Number.isSafeInteger(op.remoteSync.observedSequence) ? op.remoteSync.observedSequence : observation.sequence) > r.sequence)
     && op.remoteSync.sha === auth.head && op.remoteSync.ref === `refs/heads/${auth.branch}`
     && op.remoteSync.remote === auth.remote) return { complete: true, operationProof: 'remote-parity' };
+  // A remote observation that disagrees with live local truth is divergence, not a verified state: it can never
+  // be discharged by the fallback below just because a push command exited 0.
+  if (goal.domain === 'git-integrity' && validRemoteSync(op.remoteSync) && auth
+    && (op.remoteSync.sha !== auth.head || op.remoteSync.ref !== `refs/heads/${auth.branch}`
+      || (auth.remote && op.remoteSync.remote !== auth.remote))) return incomplete;
   if (goal.completionSemantics === 'ensure-state' && attempts.length === 0) {
     return { complete: true, operationProof: 'desired-state-only' };
   }