@ngockhoale/ukit 3.4.72 → 3.4.73

package/CHANGELOG.md

@@ -2,6 +2,11 @@
 
 All notable changes to UKit are documented here.
 
+## 3.4.73 - 2026-10-28
+
+- Git history proof tolerates unrelated untracked files; tracked/staged drift and explicit whole-tree clean obligations remain strict. No filename exemptions.
+- Native ledger-to-Stop fixtures cover Claude Code/Codex/omp, repeated Stop and untracked shipped-source publication drift; not live-host certification.
+
 ## 3.4.72 - 2026-10-28
 
 - Native evidence: reject background, masked and test-expression exits as operation/verification proof; retain supported foreground controls across shared Claude Code/Codex/OMP fixtures. No live-host certification.

package/manifests/documentation.yaml

@@ -4,6 +4,7 @@ description: >-
   Machine-readable ownership/source registry for every documentation surface.
   Hand-authored per SPEC §7; enforced by tests/consistency/docRegistry.test.js.
 entries:
+  - {id: post-3472-git, path: docs/analysis/POST-3472-GIT-OPERATION-VERIFICATION.md, class: canonical, audience: [maintainer], owner: release, source_of_truth: docs/analysis/POST-3472-GIT-OPERATION-VERIFICATION.md, merge_strategy: none, load_policy: on-demand, validation: [manual], archive_policy: never}
   - {id: release-3472, path: docs/analysis/RELEASE-3472-EVIDENCE-INTEGRITY.md, class: canonical, audience: [maintainer, agent], owner: release, source_of_truth: docs/analysis/RELEASE-3472-EVIDENCE-INTEGRITY.md, merge_strategy: none, load_policy: on-demand, validation: [manual], archive_policy: never}
   - id: systematic-loop-audit-2026-10-26
     path: docs/analysis/SYSTEMATIC-LOOP-AUDIT-2026-10-26.md

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ngockhoale/ukit",
-  "version": "3.4.72",
+  "version": "3.4.73",
   "description": "Install/update an index-first AI workspace for Claude Code, OpenAI Codex and omp (Oh My Pi).",
   "license": "MIT",
   "type": "module",

package/template_project/.claude/ukit/runtime/cron-operation-adapter.mjs

@@ -50,17 +50,12 @@ const SERVICE_MUTATION = /^(?:docker(?:\s+compose)?|docker-compose)\s+(?:restart
 // Remote authority, not stale tracking refs: gate binds sha to clean live HEAD/tracking
 // remote. Native mutation success remains a separate requirement.
 const GIT_LS_REMOTE = /^git\s+ls-remote\s+(\S+)\s+(refs\/heads\/\S+)\s*$/;
-// Native GitHub repository postcondition: `gh repo view [repo] --json url,visibility` asks GitHub itself
-// (like ls-remote asks the Git remote). Strict: unmasked single command, BOTH JSON fields present, enum
-// visibility — the gate then binds the observed url to the gate-time Git remote URL
-// (ledger.gitAuthority.remoteUrl), so a masked/public/wrong-repo reply never completes publication.
+// Native GitHub visibility needs both fields; the gate binds the observed URL to the live remote.
 const GH_REPO_VIEW = /^gh\s+repo\s+view(?:\s+(\S+))?\s+--json\s+([A-Za-z0-9_,]+)\s*$/;
 const GH_VISIBILITY = /^(?:PUBLIC|PRIVATE|INTERNAL)$/;
 const DRY_RUN = /(?:^|\s)(?:--dry-run|--check|--no-act|-n)(?:\s|=|$)/;
 const CURL = /^curl\s/;
-// A leading `cd <dir>;` / `cd <dir> &&` only selects the working directory: it prints nothing and the shell's
-// exit status is the next command's, so it must not turn an otherwise single, checked command into a "masked"
-// compound. Only ONE leading cd is dropped; any other `;`, `||`, pipe or extra segment still masks.
+// Drop one leading cd; remaining separators still mask native exit attribution.
 const LEADING_CD = /^\s*cd\s+(?:"[^"\n$`\\]*"|'[^'\n]*'|[^\s;&|<>$`()]+)\s*(?:;|&&)\s*(?=\S)/;
 export function stripLeadingCd(command) {
   return typeof command === 'string' ? command.replace(LEADING_CD, '') : command;
@@ -154,7 +149,10 @@ export function bashOperationReceipt(rawCommand, response, transportSuccess, goa
         const wholeTree = kind !== 'status' || !/\s--\s|\s--porcelain=\S*\s+\S|(?:--porcelain|-s|--short)\s+[^\s-]/.test(seg);
         if (!wholeTree || (wanted && kind !== wanted)) continue;
         role = 'state';
-        proven = kind === 'status' ? hasOutputField && text === '' : true;
+        const historyOnly = required.length > 0 && required.every((verb) => ['commit', 'push', 'tag'].includes(verb));
+        const untrackedOnly = /^git\s+status\s+--porcelain\s*$/.test(seg)
+          && text.split('\n').every((line) => !line || line.startsWith('?? '));
+        proven = kind === 'status' ? hasOutputField && (text === '' || (historyOnly && untrackedOnly)) : true;
       } else if (GIT_VERB.test(seg) && role !== 'state') {
         role = 'mutation';
         target = seg.match(GIT_VERB)[1];
@@ -177,15 +175,10 @@ export function bashOperationReceipt(rawCommand, response, transportSuccess, goa
     }
   }
   if (!role) return null;
-  // A git STATE observation is attributable only when it is one unmasked, transport-successful command: in a
-  // compound/masked chain the stdout of its parts is mixed, so it can neither prove nor refute the state and
-  // must not overwrite earlier authoritative evidence. (A standalone dirty status still records as failed.)
+  // Mixed/masked stdout cannot prove or refute state; standalone dirty status still fails.
   if (domain === 'git-integrity' && role === 'state'
     && (masked || real.filter((seg) => seg && !/^cd\s+\S+$/.test(seg)).length !== 1)) return null;
-  // A failed `gh repo view` (nonzero exit / unparseable JSON) IS an observation: it records as a FAILED
-  // state receipt (no github field) so it invalidates any earlier PRIVATE proof until a fresh successful
-  // view lands — the postcondition must hold at the LATEST check, not at some earlier one. Other git
-  // state commands keep the rule that a transport failure is unattributable and records nothing.
+  // Failed GitHub views invalidate prior visibility; other failed Git transports mint no state proof.
   if (domain === 'git-integrity' && role === 'state' && transportSuccess !== true && !ghObserved) return null;
   const ok = transportSuccess === true && !masked && Boolean(scope) && (role === 'mutation' || proven);
   return { kind: 'operation', success: ok, transportSuccess: transportSuccess === true, harness,

package/template_project/.claude/ukit/runtime/execution-ledger.mjs

@@ -3780,15 +3780,17 @@ function gitAuthority(cwd) {
   const remote = gitOutput(['config', `branch.${branch}.remote`], cwd);
   const remoteUrl = remote ? gitOutput(['config', `remote.${remote}.url`], cwd) : null;
   // gitOutput conflates empty output with failure; cleanliness needs an explicit successful status read.
-  let clean = false;
+  let clean = false; let trackedClean = false;
   try {
-    clean = execFileSync('git', ['status', '--porcelain'], {
+    const status = execFileSync('git', ['status', '--porcelain'], {
       cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 5000,
-    }).trim() === '';
+    });
+    clean = status.trim() === '';
+    trackedClean = status.split('\n').every((line) => !line || line.startsWith('?? '));
   } catch { /* an unreadable working tree is not clean */ }
   // Annotated tags are peeled by --points-at; this state corroborates successful native tag execution.
   const tagsAtHead = (gitOutput(['tag', '--points-at', 'HEAD'], cwd) || '').split('\n').map((t) => t.trim()).filter(Boolean).slice(0, 16);
-  return { head, branch, remote, remoteUrl, tagsAtHead, clean };
+  return { head, branch, remote, remoteUrl, tagsAtHead, clean, trackedClean };
 }
 function withGitAuthority(ledger, cwd) {
   const gitAuth = ledger && Object.keys(ledger).length ? gitAuthority(cwd) : null;

package/template_project/.claude/ukit/runtime/operation-evidence.mjs

@@ -49,10 +49,7 @@ export function foldOperationEvidence(bank = {}, receipt, ledger) {
   if (receipt.toolUseId && (seen.includes(receipt.toolUseId) || Object.values(bank).some((entry) =>
     [entry?.mutation, entry?.state].some((proof) => proof?.toolUseId === receipt.toolUseId)))) return bank;
   if (receipt.toolUseId && (!bounded(receipt.toolUseId) || seen.length >= 256)) return { ...bank, overflow: true };
-  // A remote-parity observation (git ls-remote) must survive the clean-tree status check that normally follows
-  // it: both are `state` receipts under one key, so the later status used to overwrite the remote proof. The
-  // proof is stamped with the sequence it was observed at and carried over only while no mutation (failed or
-  // not) of this domain/scope was recorded after it; the gate still compares its sha to live HEAD.
+  // Carry remote parity across successful state checks only until the next mutation; gate checks live HEAD.
   const lastMutation = Object.values(bank).reduce((max, entry) => {
     const m = entry?.mutation;
     return m?.operation?.domain === op.domain && m.operation.scope === op.scope && Number.isSafeInteger(m.sequence) ? Math.max(max, m.sequence) : max;
@@ -127,15 +124,15 @@ export function operationEvidenceStatus(goal, ledger = {}) {
   if (goal.visibility === 'PRIVATE' && !(validGithubView(op?.github)
     && op.github.visibility === 'PRIVATE' && githubRepository(auth?.remoteUrl) !== null
     && githubRepository(op.github.url) === githubRepository(auth.remoteUrl))) return incomplete;
-  if (goal.domain === 'git-integrity' && executed && validRemoteSync(op.remoteSync) && auth && auth.clean === true
+  // Commit/push prove committed history; an explicit clean goal still owns the whole tree.
+  const cleanEnough = auth?.clean === true || (auth?.trackedClean === true && !requiredTargets.includes('clean'));
+  if (goal.domain === 'git-integrity' && executed && validRemoteSync(op.remoteSync) && cleanEnough
     && requiredTargets.every((t) => t === 'commit' || t === 'push' || t === 'clean' || (t === 'tag' && Array.isArray(auth.tagsAtHead) && auth.tagsAtHead.length > 0))
     && attempts.every((r) => (Number.isSafeInteger(op.remoteSync.observedSequence) ? op.remoteSync.observedSequence : observation.sequence) > r.sequence)
     && op.remoteSync.sha === auth.head && op.remoteSync.ref === `refs/heads/${auth.branch}`
     && op.remoteSync.remote === auth.remote) return { complete: true, operationProof: 'remote-parity' };
-  // Push promises remote publication. No local check or missing gate-time authority can discharge it.
+  // Push needs remote proof; divergent observations cannot fall back to local checks.
   if (goal.domain === 'git-integrity' && requiredTargets.includes('push')) return incomplete;
-  // A remote observation that disagrees with live local truth is divergence, not a verified state: it can never
-  // be discharged by the fallback below just because a push command exited 0.
   if (goal.domain === 'git-integrity' && validRemoteSync(op.remoteSync) && auth
     && (op.remoteSync.sha !== auth.head || op.remoteSync.ref !== `refs/heads/${auth.branch}`
       || (auth.remote && op.remoteSync.remote !== auth.remote))) return incomplete;