@ngockhoale/ukit 3.4.42 → 3.4.43

package/CHANGELOG.md

@@ -9,6 +9,13 @@ All notable changes to UKit are documented here.
 - New `/ukit:ci-check` command + `ci-check.mjs` helper (core pack): prechecks, fail-closed budget guard, local preflight, at most one dispatch per invocation, write-ahead run-id state, `status` (never dispatches), `--ref`, `--dry-run`, per-OS report. Never pushes, merges or publishes.
 - Default-branch bootstrap stub documented in `docs/design/CI-CROSS-PLATFORM-MATRIX.md` (requires separate approval).
 
+## 3.4.43 - 2026-10-13
+
+**Completion Gate: an ordered `git tag` is discharged by the tag itself, so the live release Stop is accepted.**
+- Live root cause (3.4.42 still blocked this session): the prompt ordered a tag, so the git-integrity goal required target `tag`. A real tag created inside a compound command (`... && git tag ...; echo $?`) is a masked mutation and records as failed, and the independent remote-parity recovery only accepted `commit`/`push` targets, so `operation-verification` stayed missing although the tag, remote and registry were all correct.
+- Fix: the gate-time git authority also lists the tags that dereference to live HEAD (`git tag --points-at HEAD`, peels annotated tags). When `tag` is a required target, a tag at HEAD plus the existing remote-parity proof (remote sha == HEAD on the tracking remote, clean tree, observed after every mutation attempt) recovers it. No tag at HEAD, a diverged remote, a dirty tree or a later mutation still blocks.
+- Regressions in `tests/hooks/stopHookRelease.test.js`: masked tag with an annotated tag at HEAD -> ACCEPT (fails without the fix); no tag at HEAD -> BLOCK.
+
 ## 3.4.42 - 2026-10-13
 
 **Completion Gate: `cd <repo>; <command>` is a checked command, so a finished release is recognized by the live Stop hook.**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ngockhoale/ukit",
-  "version": "3.4.42",
+  "version": "3.4.43",
   "description": "Install/update an index-first AI workspace for Claude Code, OpenAI Codex and omp (Oh My Pi).",
   "license": "MIT",
   "type": "module",

package/template_project/.claude/ukit/runtime/execution-ledger.mjs

@@ -3280,7 +3280,10 @@ function gitAuthority(cwd) {
   if (!head || !branch) return null;
   const remote = gitOutput(['config', `branch.${branch}.remote`], cwd);
   const dirty = gitOutput(['status', '--porcelain'], cwd);
-  return { head, branch, remote, clean: dirty === null && gitOutput(['rev-parse', '--git-dir'], cwd) !== null };
+  // Tags that dereference (`--points-at` peels annotated tags) to live HEAD: a masked `git tag` is recovered by
+  // this independent local state, exactly like a masked push is recovered by remote parity.
+  const tagsAtHead = (gitOutput(['tag', '--points-at', 'HEAD'], cwd) || '').split('\n').map((t) => t.trim()).filter(Boolean).slice(0, 16);
+  return { head, branch, remote, tagsAtHead, clean: dirty === null && gitOutput(['rev-parse', '--git-dir'], cwd) !== null };
 }
 function withGitAuthority(ledger, cwd) {
   const gitAuth = ledger && Object.keys(ledger).length ? gitAuthority(cwd) : null;

package/template_project/.claude/ukit/runtime/operation-evidence.mjs

@@ -95,7 +95,7 @@ export function operationEvidenceStatus(goal, ledger = {}) {
   // `ledger.gitAuthority` is the gate-time local truth; without it (or on any mismatch) nothing is proven.
   const auth = ledger.gitAuthority;
   if (goal.domain === 'git-integrity' && validRemoteSync(op.remoteSync) && auth && auth.clean === true
-    && requiredTargets.every((t) => t === 'commit' || t === 'push')
+    && requiredTargets.every((t) => t === 'commit' || t === 'push' || (t === 'tag' && Array.isArray(auth.tagsAtHead) && auth.tagsAtHead.length > 0))
     && attempts.every((r) => (Number.isSafeInteger(op.remoteSync.observedSequence) ? op.remoteSync.observedSequence : observation.sequence) > r.sequence)
     && op.remoteSync.sha === auth.head && op.remoteSync.ref === `refs/heads/${auth.branch}`
     && op.remoteSync.remote === auth.remote) return { complete: true, operationProof: 'remote-parity' };