@ngockhoale/ukit 3.4.41 → 3.4.43

package/CHANGELOG.md

@@ -9,6 +9,20 @@ All notable changes to UKit are documented here.
 - New `/ukit:ci-check` command + `ci-check.mjs` helper (core pack): prechecks, fail-closed budget guard, local preflight, at most one dispatch per invocation, write-ahead run-id state, `status` (never dispatches), `--ref`, `--dry-run`, per-OS report. Never pushes, merges or publishes.
 - Default-branch bootstrap stub documented in `docs/design/CI-CROSS-PLATFORM-MATRIX.md` (requires separate approval).
 
+## 3.4.43 - 2026-10-13
+
+**Completion Gate: an ordered `git tag` is discharged by the tag itself, so the live release Stop is accepted.**
+- Live root cause (3.4.42 still blocked this session): the prompt ordered a tag, so the git-integrity goal required target `tag`. A real tag created inside a compound command (`... && git tag ...; echo $?`) is a masked mutation and records as failed, and the independent remote-parity recovery only accepted `commit`/`push` targets, so `operation-verification` stayed missing although the tag, remote and registry were all correct.
+- Fix: the gate-time git authority also lists the tags that dereference to live HEAD (`git tag --points-at HEAD`, peels annotated tags). When `tag` is a required target, a tag at HEAD plus the existing remote-parity proof (remote sha == HEAD on the tracking remote, clean tree, observed after every mutation attempt) recovers it. No tag at HEAD, a diverged remote, a dirty tree or a later mutation still blocks.
+- Regressions in `tests/hooks/stopHookRelease.test.js`: masked tag with an annotated tag at HEAD -> ACCEPT (fails without the fix); no tag at HEAD -> BLOCK.
+
+## 3.4.42 - 2026-10-13
+
+**Completion Gate: `cd <repo>; <command>` is a checked command, so a finished release is recognized by the live Stop hook.**
+- Live root cause (3.4.40/3.4.41 still blocked): agents run every Bash call as `cd <repo>; <cmd>`. The receipt classifier treated that `;` as shell masking, so `npm view`, `git ls-remote` and `git status --porcelain` minted no release/remote/clean-tree proof and Stop kept reporting `operation-verification, release-publication`. The runtime mirrors were byte-identical to the template; the evaluator was correct, the receipts never existed.
+- Fix (`cron-operation-adapter.mjs`): exactly one leading `cd <dir>` followed by `;`/`&&` is dropped before classification (it prints nothing; the exit status is the next command's). Any other `;`, `||`, pipe, `echo $?` or second `cd` still masks, mints no proof, and cannot produce a false ACCEPT. A masked `npm publish > log; echo $?` still mints no publish receipt; release completion never required one: registry view == package.json version plus a tag that dereferences to HEAD plus live remote parity is the proof, so an immutable version is never republished to manufacture a receipt.
+- Regressions: `tests/hooks/stopHookRelease.test.js` drives the real router, record and Stop hooks (bare, `cd ;`, `cd &&`; BLOCK then ACCEPT; wrong version, remote divergence, wrong tag, dirty tree, masked compounds, other session, runtime/template parity) and the adapter command shapes. Against the 3.4.41 adapter five of them fail.
+
 ## 3.4.41 - 2026-10-13
 
 **Completion Gate: a published release is recognized, and tests no longer depend on the developer's real `~/.ukit`.**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ngockhoale/ukit",
-  "version": "3.4.41",
+  "version": "3.4.43",
   "description": "Install/update an index-first AI workspace for Claude Code, OpenAI Codex and omp (Oh My Pi).",
   "license": "MIT",
   "type": "module",

package/template_project/.claude/ukit/runtime/cron-operation-adapter.mjs

@@ -57,12 +57,20 @@ const SERVICE_MUTATION = /^(?:docker(?:\s+compose)?|docker-compose)\s+(?:restart
 const GIT_LS_REMOTE = /^git\s+ls-remote\s+(\S+)\s+(refs\/heads\/\S+)\s*$/;
 const DRY_RUN = /(?:^|\s)(?:--dry-run|--check|--no-act|-n)(?:\s|=|$)/;
 const CURL = /^curl\s/;
+// A leading `cd <dir>;` / `cd <dir> &&` only selects the working directory: it prints nothing and the shell's
+// exit status is the next command's, so it must not turn an otherwise single, checked command into a "masked"
+// compound. Only ONE leading cd is dropped; any other `;`, `||`, pipe or extra segment still masks.
+const LEADING_CD = /^\s*cd\s+(?:"[^"\n]*"|'[^'\n]*'|[^\s;&|<>$`()]+)\s*(?:;|&&)\s*(?=\S)/;
+export function stripLeadingCd(command) {
+  return typeof command === 'string' ? command.replace(LEADING_CD, '') : command;
+}
 function requiredTargetOf(segment, required) {
   if (!required.length) return null;
   const tokens = segment.split(/\s+/);
   return required.find((name) => tokens.some((tok) => tok === name || tok.endsWith(`/${name}`))) || '(other)';
 }
-export function bashOperationReceipt(command, response, transportSuccess, goal, { sessionId, harness } = {}) {
+export function bashOperationReceipt(rawCommand, response, transportSuccess, goal, { sessionId, harness } = {}) {
+  const command = stripLeadingCd(rawCommand);
   const domain = goal?.domain;
   const scope = typeof sessionId === 'string' && sessionId.trim() ? `session:${sessionId.trim()}` : null;
   if (!['git-integrity', 'service-runtime'].includes(domain) || typeof command !== 'string') return null;
@@ -134,8 +142,9 @@ export function bashOperationReceipt(command, response, transportSuccess, goal,
 const NPM_PUBLISH = /^npm\s+publish(?:\s|$)/;
 const NPM_VIEW = /^npm\s+view\s+(\S+?)(?:@\S+)?\s+version(?:\s+2>&1)?\s*$/;
 const SEMVER_LINE = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
-export function releaseReceipt(command, response, transportSuccess) {
-  if (typeof command !== 'string') return null;
+export function releaseReceipt(rawCommand, response, transportSuccess) {
+  if (typeof rawCommand !== 'string') return null;
+  const command = stripLeadingCd(rawCommand);
   const masked = /;|\n|\|/.test(command.replace(/'[^']*'|"[^"]*"/g, '""'));
   const segments = command.split('&&').map((seg) => seg.trim()).filter((seg) => seg && !/^cd\s+\S+$/.test(seg));
   if (segments.length !== 1) return null;

package/template_project/.claude/ukit/runtime/execution-ledger.mjs

@@ -3280,7 +3280,10 @@ function gitAuthority(cwd) {
   if (!head || !branch) return null;
   const remote = gitOutput(['config', `branch.${branch}.remote`], cwd);
   const dirty = gitOutput(['status', '--porcelain'], cwd);
-  return { head, branch, remote, clean: dirty === null && gitOutput(['rev-parse', '--git-dir'], cwd) !== null };
+  // Tags that dereference (`--points-at` peels annotated tags) to live HEAD: a masked `git tag` is recovered by
+  // this independent local state, exactly like a masked push is recovered by remote parity.
+  const tagsAtHead = (gitOutput(['tag', '--points-at', 'HEAD'], cwd) || '').split('\n').map((t) => t.trim()).filter(Boolean).slice(0, 16);
+  return { head, branch, remote, tagsAtHead, clean: dirty === null && gitOutput(['rev-parse', '--git-dir'], cwd) !== null };
 }
 function withGitAuthority(ledger, cwd) {
   const gitAuth = ledger && Object.keys(ledger).length ? gitAuthority(cwd) : null;

package/template_project/.claude/ukit/runtime/operation-evidence.mjs

@@ -95,7 +95,7 @@ export function operationEvidenceStatus(goal, ledger = {}) {
   // `ledger.gitAuthority` is the gate-time local truth; without it (or on any mismatch) nothing is proven.
   const auth = ledger.gitAuthority;
   if (goal.domain === 'git-integrity' && validRemoteSync(op.remoteSync) && auth && auth.clean === true
-    && requiredTargets.every((t) => t === 'commit' || t === 'push')
+    && requiredTargets.every((t) => t === 'commit' || t === 'push' || (t === 'tag' && Array.isArray(auth.tagsAtHead) && auth.tagsAtHead.length > 0))
     && attempts.every((r) => (Number.isSafeInteger(op.remoteSync.observedSequence) ? op.remoteSync.observedSequence : observation.sequence) > r.sequence)
     && op.remoteSync.sha === auth.head && op.remoteSync.ref === `refs/heads/${auth.branch}`
     && op.remoteSync.remote === auth.remote) return { complete: true, operationProof: 'remote-parity' };