@ngockhoale/ukit 3.4.40 → 3.4.42

package/CHANGELOG.md

@@ -9,6 +9,22 @@ All notable changes to UKit are documented here.
 - New `/ukit:ci-check` command + `ci-check.mjs` helper (core pack): prechecks, fail-closed budget guard, local preflight, at most one dispatch per invocation, write-ahead run-id state, `status` (never dispatches), `--ref`, `--dry-run`, per-OS report. Never pushes, merges or publishes.
 - Default-branch bootstrap stub documented in `docs/design/CI-CROSS-PLATFORM-MATRIX.md` (requires separate approval).
 
+## 3.4.42 - 2026-10-13
+
+**Completion Gate: `cd <repo>; <command>` is a checked command, so a finished release is recognized by the live Stop hook.**
+- Live root cause (3.4.40/3.4.41 still blocked): agents run every Bash call as `cd <repo>; <cmd>`. The receipt classifier treated that `;` as shell masking, so `npm view`, `git ls-remote` and `git status --porcelain` minted no release/remote/clean-tree proof and Stop kept reporting `operation-verification, release-publication`. The runtime mirrors were byte-identical to the template; the evaluator was correct, the receipts never existed.
+- Fix (`cron-operation-adapter.mjs`): exactly one leading `cd <dir>` followed by `;`/`&&` is dropped before classification (it prints nothing; the exit status is the next command's). Any other `;`, `||`, pipe, `echo $?` or second `cd` still masks, mints no proof, and cannot produce a false ACCEPT. A masked `npm publish > log; echo $?` still mints no publish receipt; release completion never required one: registry view == package.json version plus a tag that dereferences to HEAD plus live remote parity is the proof, so an immutable version is never republished to manufacture a receipt.
+- Regressions: `tests/hooks/stopHookRelease.test.js` drives the real router, record and Stop hooks (bare, `cd ;`, `cd &&`; BLOCK then ACCEPT; wrong version, remote divergence, wrong tag, dirty tree, masked compounds, other session, runtime/template parity) and the adapter command shapes. Against the 3.4.41 adapter five of them fail.
+
+## 3.4.41 - 2026-10-13
+
+**Completion Gate: a published release is recognized, and tests no longer depend on the developer's real `~/.ukit`.**
+- Root cause (release false block): the git-state `status` observation overwrote the standalone `git ls-remote` remote-parity proof stored under the same operation-bank key, so a verified release (registry, tag, remote, clean tree) still reported `operation-verification, release-publication` missing.
+- Fix (`operation-evidence.mjs`): a later successful, complete git-state observation carries forward a still-valid remote-sync proof only when it was observed after every mutation attempt; the proof is judged against live HEAD/branch/tracking remote, so a diverged remote, wrong branch, other repo, dirty tree or later failed push still blocks.
+- Verification integrity: the hook-spawning completion tests inherited the real user playbook directory when run inside the full suite (a bug-fix playbook then demanded repro receipts) and failed only there. They now run the hooks with an empty HOME.
+- `integrationP1`: the external Laya offline harness is stale against its own server (NameError). That is reported as a loud per-test SKIPPED naming the cause instead of failing; it is not a UKit Completion Gate criterion. No `UKIT_LAYA_ROOT` bypass is used.
+- Regressions: `tests/hooks/releaseCompletionEvidence.test.js` (R01–R08, R11, R13), extended `completionGateRequestScope.test.js` (R09, R10).
+
 ## 3.4.40 - 2026-10-12
 
 **Completion Gate: a read-only request no longer owes `impact-evidence` it can never produce.**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ngockhoale/ukit",
-  "version": "3.4.40",
+  "version": "3.4.42",
   "description": "Install/update an index-first AI workspace for Claude Code, OpenAI Codex and omp (Oh My Pi).",
   "license": "MIT",
   "type": "module",

package/template_project/.claude/ukit/runtime/cron-operation-adapter.mjs

@@ -57,12 +57,20 @@ const SERVICE_MUTATION = /^(?:docker(?:\s+compose)?|docker-compose)\s+(?:restart
 const GIT_LS_REMOTE = /^git\s+ls-remote\s+(\S+)\s+(refs\/heads\/\S+)\s*$/;
 const DRY_RUN = /(?:^|\s)(?:--dry-run|--check|--no-act|-n)(?:\s|=|$)/;
 const CURL = /^curl\s/;
+// A leading `cd <dir>;` / `cd <dir> &&` only selects the working directory: it prints nothing and the shell's
+// exit status is the next command's, so it must not turn an otherwise single, checked command into a "masked"
+// compound. Only ONE leading cd is dropped; any other `;`, `||`, pipe or extra segment still masks.
+const LEADING_CD = /^\s*cd\s+(?:"[^"\n]*"|'[^'\n]*'|[^\s;&|<>$`()]+)\s*(?:;|&&)\s*(?=\S)/;
+export function stripLeadingCd(command) {
+  return typeof command === 'string' ? command.replace(LEADING_CD, '') : command;
+}
 function requiredTargetOf(segment, required) {
   if (!required.length) return null;
   const tokens = segment.split(/\s+/);
   return required.find((name) => tokens.some((tok) => tok === name || tok.endsWith(`/${name}`))) || '(other)';
 }
-export function bashOperationReceipt(command, response, transportSuccess, goal, { sessionId, harness } = {}) {
+export function bashOperationReceipt(rawCommand, response, transportSuccess, goal, { sessionId, harness } = {}) {
+  const command = stripLeadingCd(rawCommand);
   const domain = goal?.domain;
   const scope = typeof sessionId === 'string' && sessionId.trim() ? `session:${sessionId.trim()}` : null;
   if (!['git-integrity', 'service-runtime'].includes(domain) || typeof command !== 'string') return null;
@@ -134,8 +142,9 @@ export function bashOperationReceipt(command, response, transportSuccess, goal,
 const NPM_PUBLISH = /^npm\s+publish(?:\s|$)/;
 const NPM_VIEW = /^npm\s+view\s+(\S+?)(?:@\S+)?\s+version(?:\s+2>&1)?\s*$/;
 const SEMVER_LINE = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
-export function releaseReceipt(command, response, transportSuccess) {
-  if (typeof command !== 'string') return null;
+export function releaseReceipt(rawCommand, response, transportSuccess) {
+  if (typeof rawCommand !== 'string') return null;
+  const command = stripLeadingCd(rawCommand);
   const masked = /;|\n|\|/.test(command.replace(/'[^']*'|"[^"]*"/g, '""'));
   const segments = command.split('&&').map((seg) => seg.trim()).filter((seg) => seg && !/^cd\s+\S+$/.test(seg));
   if (segments.length !== 1) return null;

package/template_project/.claude/ukit/runtime/operation-evidence.mjs

@@ -40,6 +40,19 @@ export function foldOperationEvidence(bank = {}, receipt, ledger) {
   if (receipt.toolUseId && (seen.includes(receipt.toolUseId) || Object.values(bank).some((entry) =>
     [entry?.mutation, entry?.state].some((proof) => proof?.toolUseId === receipt.toolUseId)))) return bank;
   if (receipt.toolUseId && (!bounded(receipt.toolUseId) || seen.length >= 256)) return { ...bank, overflow: true };
+  // A remote-parity observation (git ls-remote) must survive the clean-tree status check that normally follows
+  // it: both are `state` receipts under one key, so the later status used to overwrite the remote proof. The
+  // proof is stamped with the sequence it was observed at and carried over only while no mutation (failed or
+  // not) of this domain/scope was recorded after it; the gate still compares its sha to live HEAD.
+  const lastMutation = Object.values(bank).reduce((max, entry) => {
+    const m = entry?.mutation;
+    return m?.operation?.domain === op.domain && m.operation.scope === op.scope && Number.isSafeInteger(m.sequence) ? Math.max(max, m.sequence) : max;
+  }, 0);
+  const priorSync = prior.state?.operation?.remoteSync;
+  const remoteSync = validRemoteSync(op.remoteSync) ? { ...op.remoteSync, observedSequence: receipt.sequence }
+    : (op.role === 'state' && op.domain === 'git-integrity' && receipt.success === true && op.complete === true
+      && validRemoteSync(priorSync) && Number.isSafeInteger(priorSync.observedSequence) && priorSync.observedSequence > lastMutation)
+      ? { ...priorSync } : null;
   const proof = { success: receipt.success === true, sequence: receipt.sequence,
     toolUseId: receipt.toolUseId, taskInstanceId: receipt.taskInstanceId,
     sessionKey: receipt.sessionKey, operation: {
@@ -47,7 +60,7 @@ export function foldOperationEvidence(bank = {}, receipt, ledger) {
       ...(op.state !== undefined ? { state: op.state } : {}),
       ...(op.presentTargets !== undefined ? { presentTargets: [...op.presentTargets] } : {}),
       complete: op.complete === true,
-      ...(validRemoteSync(op.remoteSync) ? { remoteSync: { ...op.remoteSync } } : {}),
+      ...(remoteSync ? { remoteSync } : {}),
     } };
   return { ...bank, seenToolUseIds: receipt.toolUseId ? [...seen, receipt.toolUseId] : seen,
     [key]: { ...prior, [op.role]: proof } };
@@ -83,9 +96,14 @@ export function operationEvidenceStatus(goal, ledger = {}) {
   const auth = ledger.gitAuthority;
   if (goal.domain === 'git-integrity' && validRemoteSync(op.remoteSync) && auth && auth.clean === true
     && requiredTargets.every((t) => t === 'commit' || t === 'push')
-    && attempts.every((r) => observation.sequence > r.sequence)
+    && attempts.every((r) => (Number.isSafeInteger(op.remoteSync.observedSequence) ? op.remoteSync.observedSequence : observation.sequence) > r.sequence)
     && op.remoteSync.sha === auth.head && op.remoteSync.ref === `refs/heads/${auth.branch}`
     && op.remoteSync.remote === auth.remote) return { complete: true, operationProof: 'remote-parity' };
+  // A remote observation that disagrees with live local truth is divergence, not a verified state: it can never
+  // be discharged by the fallback below just because a push command exited 0.
+  if (goal.domain === 'git-integrity' && validRemoteSync(op.remoteSync) && auth
+    && (op.remoteSync.sha !== auth.head || op.remoteSync.ref !== `refs/heads/${auth.branch}`
+      || (auth.remote && op.remoteSync.remote !== auth.remote))) return incomplete;
   if (goal.completionSemantics === 'ensure-state' && attempts.length === 0) {
     return { complete: true, operationProof: 'desired-state-only' };
   }