@norskvideo/ctl-dev-kit 0.2.63 → 0.2.65

package/conventions/quarantine.ts

@@ -0,0 +1,209 @@
+#!/usr/bin/env bun
+
+// Known-flaky tests, kept out of the gate but not out of the run (ci-fragility
+// proposal E). A test that fails one run in three on a loaded runner turns the
+// whole checks job red; a person re-runs it, and a real red hides among the
+// flaky ones. Quarantine takes it out of the gating run, runs it on its own
+// straight after, and reports the result without failing the job.
+//
+// The list is the repo's `.github/quarantine.json`, product-owned (not a
+// drift-checked copy), so a reader on GitHub, the dashboard and the job all see
+// the same thing. Every entry carries an owner, the date it went in and the
+// condition for taking it out, and an entry older than STALE_DAYS is flagged on
+// every run: quarantine is a holding pen, not a way to skip a test for ever.
+//
+//   {"tests": [{"file": "tests/unit/x.test.ts", "name": "<test name>",
+//               "owner": "<who>", "since": "YYYY-MM-DD",
+//               "reason": "<what fails>", "exit": "<when it comes out>"}]}
+//
+// Run by its node_modules path from the checks quality job (conventions/
+// checks.yml), like zod-singleton.ts:
+//   quarantine.ts check        validate the list; exit 1 if it is malformed
+//   quarantine.ts bun-options  the BUN_OPTIONS that leave the listed tests out
+//   quarantine.ts run          run each listed test alone and report; exit 0
+
+import { appendFileSync, existsSync, readFileSync } from "node:fs";
+
+export const QUARANTINE_FILE = ".github/quarantine.json";
+export const STALE_DAYS = 30;
+
+export interface QuarantineEntry {
+  file: string;
+  name: string;
+  owner: string;
+  since: string;
+  reason: string;
+  exit: string;
+  issue?: string;
+}
+
+const REQUIRED = ["file", "name", "owner", "since", "reason", "exit"] as const;
+
+export interface ParsedQuarantine {
+  entries: QuarantineEntry[];
+  errors: string[];
+  warnings: string[];
+}
+
+const DAY_MS = 86_400_000;
+const isDate = (s: string) => /^\d{4}-\d{2}-\d{2}$/.test(s) && !Number.isNaN(Date.parse(`${s}T00:00:00Z`));
+
+/** `text` is the file's contents, undefined when the repo has none. */
+export function parseQuarantine(
+  text: string | undefined,
+  opts: { today: string; exists: (file: string) => boolean },
+): ParsedQuarantine {
+  const out: ParsedQuarantine = { entries: [], errors: [], warnings: [] };
+  if (text === undefined) return out;
+  let doc: unknown;
+  try {
+    doc = JSON.parse(text);
+  } catch (e) {
+    out.errors.push(`${QUARANTINE_FILE} is not JSON: ${e instanceof Error ? e.message : String(e)}`);
+    return out;
+  }
+  const tests = (doc as { tests?: unknown } | null)?.tests;
+  if (!Array.isArray(tests)) {
+    out.errors.push(`${QUARANTINE_FILE} has no "tests" array`);
+    return out;
+  }
+  const seen = new Set<string>();
+  tests.forEach((raw, i) => {
+    const e = (raw ?? {}) as Record<string, unknown>;
+    const at = `${QUARANTINE_FILE} tests[${i}]`;
+    const missing = REQUIRED.filter((f) => typeof e[f] !== "string" || (e[f] as string).trim() === "");
+    if (missing.length > 0) {
+      out.errors.push(
+        `${at}: missing ${missing.join(", ")} (every entry needs an owner, a date and an exit condition)`,
+      );
+      return;
+    }
+    const entry = e as unknown as QuarantineEntry;
+    if (!isDate(entry.since)) {
+      out.errors.push(`${at}: since "${entry.since}" is not a YYYY-MM-DD date`);
+      return;
+    }
+    const age = Math.round((Date.parse(`${opts.today}T00:00:00Z`) - Date.parse(`${entry.since}T00:00:00Z`)) / DAY_MS);
+    if (age < 0) {
+      out.errors.push(`${at}: since ${entry.since} is in the future`);
+      return;
+    }
+    if (!opts.exists(entry.file)) {
+      out.errors.push(`${at}: ${entry.file} is not in the repo; drop the entry or fix the path`);
+      return;
+    }
+    const key = `${entry.file}\0${entry.name}`;
+    if (seen.has(key)) {
+      out.errors.push(`${at}: "${entry.name}" is listed twice`);
+      return;
+    }
+    seen.add(key);
+    if (age > STALE_DAYS) {
+      out.warnings.push(
+        `"${entry.name}" has been quarantined since ${entry.since} (${age} days, owner ${entry.owner}): fix it and take it out, or delete it`,
+      );
+    }
+    out.entries.push(entry);
+  });
+  return out;
+}
+
+const escapeRegex = (s: string) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+
+/** A regex matching the one test, wherever its describe blocks put it. */
+export function namePattern(name: string): string {
+  return `${escapeRegex(name)}$`;
+}
+
+/** BUN_OPTIONS for the gating run: every test except the listed ones. Bun
+ *  splits BUN_OPTIONS on whitespace and has no exclude-by-name flag, so it is
+ *  one negative lookahead with each space written as \s. */
+export function bunOptions(entries: readonly QuarantineEntry[]): string {
+  if (entries.length === 0) return "";
+  const names = entries.map((e) => namePattern(e.name).replace(/\s/g, "\\s")).join("|");
+  return `--test-name-pattern=^(?!.*(?:${names})).*`;
+}
+
+export type RunResult = "passed" | "failed" | "missing";
+
+/** A run that matched nothing means the test was renamed or deleted, and the
+ *  entry is stale; that is not a pass, whatever the exit code. */
+export function classifyRun(exitCode: number, output: string): RunResult {
+  if (/matched 0 tests/.test(output) || /Ran 0 tests/.test(output)) return "missing";
+  return exitCode === 0 ? "passed" : "failed";
+}
+
+export function summary(results: readonly { entry: QuarantineEntry; result: RunResult }[]): string {
+  const lines = [
+    `### Quarantined tests (run and reported, not gating)`,
+    "",
+    `From \`${QUARANTINE_FILE}\`. A failure here does not fail the job; it is the flake the entry is waiting on.`,
+    "",
+    "| Result | Test | File | Owner | Since | Exit condition |",
+    "|---|---|---|---|---|---|",
+  ];
+  for (const { entry, result } of results) {
+    const cell = (s: string) => s.replace(/\|/g, "\\|");
+    lines.push(
+      `| ${result} | ${cell(entry.name)} | \`${entry.file}\` | ${cell(entry.owner)} | ${entry.since} | ${cell(entry.exit)} |`,
+    );
+  }
+  return `${lines.join("\n")}\n`;
+}
+
+function load(): ParsedQuarantine {
+  const text = existsSync(QUARANTINE_FILE) ? readFileSync(QUARANTINE_FILE, "utf8") : undefined;
+  return parseQuarantine(text, { today: new Date().toISOString().slice(0, 10), exists: existsSync });
+}
+
+function report(parsed: ParsedQuarantine): void {
+  for (const w of parsed.warnings) console.log(`::warning title=quarantine::${w}`);
+  for (const e of parsed.errors) console.log(`::error title=quarantine::${e}`);
+}
+
+async function main(cmd: string | undefined): Promise<number> {
+  const parsed = load();
+  if (cmd === "check") {
+    report(parsed);
+    console.log(`${parsed.entries.length} quarantined test(s) in ${QUARANTINE_FILE}`);
+    return parsed.errors.length > 0 ? 1 : 0;
+  }
+  if (cmd === "bun-options") {
+    if (parsed.errors.length > 0) return 1;
+    process.stdout.write(bunOptions(parsed.entries));
+    return 0;
+  }
+  if (cmd === "run") {
+    report(parsed);
+    const results: { entry: QuarantineEntry; result: RunResult }[] = [];
+    for (const entry of parsed.entries) {
+      console.log(`== quarantined: ${entry.name} (${entry.file})`);
+      const proc = Bun.spawn(["bun", "test", entry.file, `--test-name-pattern=${namePattern(entry.name)}`], {
+        stdout: "pipe",
+        stderr: "pipe",
+      });
+      const [out, err] = await Promise.all([new Response(proc.stdout).text(), new Response(proc.stderr).text()]);
+      const code = await proc.exited;
+      process.stdout.write(out);
+      process.stdout.write(err);
+      const result = classifyRun(code, `${out}${err}`);
+      results.push({ entry, result });
+      if (result !== "passed") {
+        console.log(`::warning title=quarantined test ${result} (not gating)::${entry.name} (${entry.file})`);
+      }
+    }
+    const failed = results.filter((r) => r.result !== "passed").length;
+    if (process.env.GITHUB_STEP_SUMMARY && results.length > 0) {
+      appendFileSync(process.env.GITHUB_STEP_SUMMARY, summary(results));
+    }
+    if (process.env.GITHUB_OUTPUT) {
+      appendFileSync(process.env.GITHUB_OUTPUT, `quarantined=${results.length}\nquarantine_failed=${failed}\n`);
+    }
+    console.log(`${results.length} quarantined test(s) run, ${failed} not passing (not gating)`);
+    return 0;
+  }
+  console.error("usage: quarantine.ts check | bun-options | run");
+  return 2;
+}
+
+if (import.meta.main) process.exit(await main(process.argv[2]));

package/conventions/smoke.yml

@@ -193,12 +193,37 @@ jobs:
           NORSK_LICENSE_V2: ${{ secrets.NORSK_LICENSE_V2 }}
         run: printf '%s' "$NORSK_LICENSE_V2" > "$RUNNER_TEMP/norsk-license.json"
 
+      # Every norsk-ctl daemon starts the node MoQ relay (norsk-moq-relay) unless
+      # told not to, and nothing removes it: it is a node singleton, and the reap
+      # step only takes containers that mount this job's test-temp. So the first
+      # test daemon on a shared runner left one, and every later one adopted it
+      # (probe's smoke ran in relay mode on 2026-10-10; relay's smoke lost 4443
+      # to it). This job's daemons run without the node relay and discovery, so
+      # they neither start nor adopt one, and whatever is already on the host is
+      # named here. It reports and never fails: the leftover may be someone's.
+      - name: Isolate this job from node singletons other jobs left on this host
+        run: |
+          set -uo pipefail
+          echo "NORSK_CTL_MOQ_RELAY_ENABLE=0" >> "$GITHUB_ENV"
+          echo "NORSK_CTL_DISCOVERY_ENABLE=0" >> "$GITHUB_ENV"
+          left="$(docker ps -a --filter label=norsk-ctl.role --format '{{.Names}} {{.Label "norsk-ctl.role"}} {{.Status}} (created {{.CreatedAt}})' 2>/dev/null || true)"
+          if [ -z "$left" ]; then echo "no norsk-ctl containers on this host"; exit 0; fi
+          echo "norsk-ctl containers already on this host (other jobs' running instances are expected):"
+          echo "$left"
+          while IFS= read -r line; do
+            role="$(awk '{print $2}' <<<"$line")"
+            case "$role" in
+              moq-relay|discovery)
+                echo "::warning title=node singleton left on this host::$line -- left by an earlier job (a daemon's auto-start, or a run killed before its reap). This job's daemons run without it and will not adopt it; remove it with docker rm -f if nothing on this host needs it." ;;
+            esac
+          done <<<"$left"
+
       # Pick the binary for THIS runner's architecture: the GPU box is aarch64,
       # the x64 pool is x86_64, and the wrong one dies with "Exec format error"
       # deep in the suite. No `|| true` on --version: a bad binary must fail here.
       #
       # WHICH binary: the version this commit pins, flake.nix ctlVersion -- the
-      # daemon the dev shell launches, moved by upgrade-latest's bump PR. It used
+      # daemon the dev shell launches, moved by bump.yml's nightly PR. It used
       # to be S3's moving `latest`, read at run time, so a result could change
       # with no product commit and a re-run was never a real repeat (funke went
       # red and green again on 2026-10-09 without a commit either time;
@@ -221,7 +246,7 @@ jobs:
             echo "norsk-ctl $CTL_CHANNEL channel -> $ver ($arch), in place of the repo pin"
           else
             ver="$( { sed -nE 's/^[[:space:]]*ctlVersion = "([^"]+)";.*/\1/p' flake.nix 2>/dev/null || true; } | head -1)"
-            [ -n "$ver" ] || { echo "::error::flake.nix pins no ctlVersion. CI runs the norsk-ctl this commit pins (upgrade-latest moves it); add ctlVersion = \"<version>\"; to flake.nix."; exit 1; }
+            [ -n "$ver" ] || { echo "::error::flake.nix pins no ctlVersion. CI runs the norsk-ctl this commit pins (the nightly bump.yml moves it); add ctlVersion = \"<version>\"; to flake.nix."; exit 1; }
             echo "norsk-ctl pinned by flake.nix ctlVersion -> $ver ($arch)"
           fi
           curl -fsSL --retry 3 --retry-all-errors --retry-delay 2 "$S3/$ver/norsk-ctl-$ver-$arch" -o "$RUNNER_TEMP/norsk-ctl"

package/conventions/sync-drift.ts

@@ -7,8 +7,12 @@
 // It only touches copies whose convergent form is mechanical — there is no
 // judgement anywhere:
 //   - verbatim (biome.json, tsconfig.base.json)      -> overwrite with canonical
-//   - masked workflows (checks / upgrade / sync /    -> canonical, repo's product: key kept
+//   - masked workflows (checks / bump /              -> canonical, repo's product: key kept
 //     publish-docs)
+//   - bump.yml                                       -> CREATED where absent, under the key the
+//                                                       retired bump bots carried; then those
+//                                                       three (upgrade-latest / sync-dev-kit /
+//                                                       sync-ctl-packages) are DELETED
 //   - nix/ctl-shell.nix                              -> overwrite with canonical (created if absent)
 //   - flake.nix (legacy verbatim copy only)          -> the starter, repo's floating ctl pin kept
 //   - marker-block (CLAUDE core, dprint, .gitignore) -> replace the shared block, keep the rest
@@ -22,11 +26,12 @@
 // cannot mechanically converge (e.g. a workflow with no product key to preserve)
 // is left for check-drift to flag, and a convention that genuinely breaks the
 // product surfaces as a red lint/typecheck/test — not as a silent bad copy.
-import { chmodSync, existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { checkTheme, syncTheme } from "../docs-theme/sync.ts";
 import {
   BEGIN,
+  BUMP_WORKFLOW,
   type CanonicalBytes,
   CTL_HASH_LINE,
   CTL_SHELL_PATH,
@@ -43,6 +48,7 @@ import {
   PRODUCT_SENTINEL,
   type ProductShape,
   PUBLISH_IMAGE_LINE,
+  RETIRED_BUMP_WORKFLOWS,
   RUNNER_LINE,
   resolveRepoName,
   resolveShape,
@@ -69,7 +75,7 @@ function writeIfChanged(path: string, content: string, rel: string, written: str
   }
 }
 
-// checks.yml / upgrade-latest.yml / sync-dev-kit.yml: canonical byte-for-byte
+// checks.yml / publish-docs.yml: canonical byte-for-byte
 // except the one `product:` dispatch key, which the gate masks. Re-emit the
 // canonical with the repo's own key filled back in. A workflow with no key to
 // preserve (absent, or still the sentinel) is left for the gate to flag.
@@ -87,6 +93,48 @@ function syncWorkflow(repoRoot: string, rel: string, canonical: string, r: SyncR
   writeIfChanged(path, canonical.replace(PRODUCT_LINE, `$1${key}`), rel, r.written);
 }
 
+const productKey = (path: string): string | undefined => {
+  if (!existsSync(path)) return undefined;
+  const key = readFileSync(path, "utf8").match(/^\s*product:\s*(\S+)/m)?.[1];
+  return key && key !== PRODUCT_SENTINEL ? key : undefined;
+};
+
+// bump.yml, the one nightly bump (ci-fragility proposal B2), and the end of
+// the three bots it replaced. This is how it reaches a product: the old
+// sync-dev-kit.yml installs a dev-kit that has it and runs this writer, which
+// creates bump.yml under the dashboard key the old bots reported under and
+// deletes them -- sync-dev-kit.yml included, in the very PR it is opening. The
+// old bot-prs on main still triages that PR (its branch is sync-dev-kit/*),
+// and the new integration and build-image it brings still run on that branch,
+// so the transition lands like any other bump. Once landed, bump.yml owns the
+// night and the old three are gone.
+//
+// The key comes from bump.yml itself once it has one; before that from
+// upgrade-latest.yml (the nightly column's reporter), sync-dev-kit.yml, and
+// last checks.yml (required, always filled). With no key at all nothing is
+// created and nothing removed: deleting the old bots before their replacement
+// exists would leave the product with no nightly bump, silently. The gate then
+// names the missing bump.yml.
+function syncBump(repoRoot: string, canonical: string, r: SyncReport): void {
+  const wf = (rel: string) => join(repoRoot, rel);
+  const key =
+    productKey(wf(BUMP_WORKFLOW)) ??
+    productKey(wf(".github/workflows/upgrade-latest.yml")) ??
+    productKey(wf(".github/workflows/sync-dev-kit.yml")) ??
+    productKey(wf(".github/workflows/checks.yml"));
+  if (key === undefined) {
+    r.skipped.push(`${BUMP_WORKFLOW} (no product: key to give it; the retired bump workflows are left in place)`);
+    return;
+  }
+  mkdirSync(dirname(wf(BUMP_WORKFLOW)), { recursive: true });
+  writeIfChanged(wf(BUMP_WORKFLOW), canonical.replace(PRODUCT_LINE, `$1${key}`), BUMP_WORKFLOW, r.written);
+  for (const rel of RETIRED_BUMP_WORKFLOWS) {
+    if (!existsSync(wf(rel))) continue;
+    rmSync(wf(rel));
+    r.written.push(rel);
+  }
+}
+
 // publish-docs.yml: optional, and masked like checks.yml (only re-synced where
 // the repo already carries it). Every copy predating the mask was written
 // verbatim with the sentinel, so a copy with no key of its own takes the one
@@ -307,7 +355,7 @@ function syncWithDisplay(repoRoot: string, canonical: string, r: SyncReport): vo
 // carry one. It is CREATED only where the gate would accept it: a repo with a
 // site (there is something to publish), named, and not a turnkey (a turnkey has
 // no public site, ADR-0012). That is how a product that grows a site acquires
-// its publish: the next sync-dev-kit run installs it, green until the Pages
+// its publish: the next nightly bump installs it, green until the Pages
 // project exists. A name this writer cannot determine creates nothing, since
 // the gate could only refuse the result.
 const TURNKEY_REPO = /^norsk-ctl-turnkey-/;
@@ -338,7 +386,7 @@ function syncPublishDocsSite(repoRoot: string, canonical: string, repoName: stri
 // Only for a repo that HAS a site: sync never creates one (a site is a nested
 // standalone package with its own install, not a file this writer can conjure),
 // it only keeps an existing one's copies in step. That is what makes a theme
-// change roll out through sync-dev-kit.yml like any other convention.
+// change roll out through bump.yml like any other convention.
 function syncDocsTheme(repoRoot: string, r: SyncReport): void {
   if (!hasDocsSite(repoRoot)) {
     r.skipped.push(`${DOCS_SITE_DIR}/ docs theme (no docs site)`);
@@ -372,21 +420,12 @@ export function syncDrift(
   writeIfChanged(join(repoRoot, "tsconfig.base.json"), canonical.tsconfigBase, "tsconfig.base.json", r.written);
 
   syncWorkflow(repoRoot, ".github/workflows/checks.yml", checksCanon, r);
-  // upgrade-latest too: an sdk-app has no Studio pair, so it has its own variant
-  const upgradeCanon = shape === "sdk-app" ? canonical.upgradeLatestSdkApp : canonical.upgradeLatest;
-  if (upgradeCanon === undefined) throw new Error(`syncDrift: shape "${shape}" requires canonical.upgradeLatestSdkApp`);
-  syncWorkflow(repoRoot, ".github/workflows/upgrade-latest.yml", upgradeCanon, r);
-  syncWorkflow(repoRoot, ".github/workflows/sync-dev-kit.yml", canonical.syncDevKit, r);
-  // No per-repo line to preserve, so it is written whole -- and CREATED where
-  // absent, unlike syncWorkflow's copies. That is how a repo acquires the
-  // workflow at all: its next sync run installs it.
-  writeIfChanged(
-    join(repoRoot, ".github/workflows/sync-ctl-packages.yml"),
-    canonical.syncCtlPackages,
-    ".github/workflows/sync-ctl-packages.yml",
-    r.written,
-  );
-  // bot-prs.yml likewise: verbatim, and created where absent.
+  // bump.yml: an sdk-app has no Studio pair, so it has its own variant.
+  const bumpCanon = shape === "sdk-app" ? canonical.bumpSdkApp : canonical.bump;
+  if (bumpCanon === undefined) throw new Error(`syncDrift: shape "${shape}" requires canonical.bumpSdkApp`);
+  syncBump(repoRoot, bumpCanon, r);
+  // bot-prs.yml: no per-repo line to preserve, so it is written whole -- and
+  // CREATED where absent. That is how a repo acquires it: its next sync installs it.
   writeIfChanged(
     join(repoRoot, ".github/workflows/bot-prs.yml"),
     canonical.botPrs,
@@ -428,9 +467,7 @@ if (import.meta.main) {
     core: readFileSync(join(dir, "CLAUDE.core.md"), "utf8"),
     flake: readFileSync(join(dir, "..", "build", "flake.nix"), "utf8"),
     ctlShell: readFileSync(join(dir, "..", "build", "ctl-shell.nix"), "utf8"),
-    upgradeLatest: readFileSync(join(dir, "upgrade-latest.yml"), "utf8"),
-    syncDevKit: readFileSync(join(dir, "sync-dev-kit.yml"), "utf8"),
-    syncCtlPackages: readFileSync(join(dir, "sync-ctl-packages.yml"), "utf8"),
+    bump: readFileSync(join(dir, "bump.yml"), "utf8"),
     botPrs: readFileSync(join(dir, "bot-prs.yml"), "utf8"),
     publishDocs: readFileSync(join(dir, "publish-docs.yml"), "utf8"),
     buildDocs: readFileSync(join(dir, "build-docs.yml"), "utf8"),
@@ -448,7 +485,7 @@ if (import.meta.main) {
     demoShim: readFileSync(join(dir, "demo.sh"), "utf8"),
     flakeSdkApp: readFileSync(join(dir, "..", "build", "flake.sdk-app.nix"), "utf8"),
     checksSdkApp: readFileSync(join(dir, "checks.sdk-app.yml"), "utf8"),
-    upgradeLatestSdkApp: readFileSync(join(dir, "upgrade-latest.sdk-app.yml"), "utf8"),
+    bumpSdkApp: readFileSync(join(dir, "bump.sdk-app.yml"), "utf8"),
   };
   const report = syncDrift(repoRoot, canonical, resolveShape(repoRoot), { repoName: resolveRepoName(repoRoot) });
   if (report.written.length === 0) {

package/create-product/canon.ts

@@ -18,9 +18,7 @@ export interface Canon {
   /** build/ctl-shell.nix, emitted as nix/ctl-shell.nix — the flake imports it. */
   ctlShell: string;
   flakeLock: string;
-  upgradeLatest: string;
-  syncDevKit: string;
-  syncCtlPackages: string;
+  bump: string;
   botPrs: string;
   checks: string;
   biome: string;
@@ -45,9 +43,7 @@ export function loadCanon(): Canon {
     flake: readFileSync(join(buildDir, "flake.nix"), "utf8"),
     ctlShell: readFileSync(join(buildDir, "ctl-shell.nix"), "utf8"),
     flakeLock: readFileSync(join(buildDir, "flake.lock"), "utf8"),
-    upgradeLatest: readFileSync(join(conventionsDir, "upgrade-latest.yml"), "utf8"),
-    syncDevKit: readFileSync(join(conventionsDir, "sync-dev-kit.yml"), "utf8"),
-    syncCtlPackages: readFileSync(join(conventionsDir, "sync-ctl-packages.yml"), "utf8"),
+    bump: readFileSync(join(conventionsDir, "bump.yml"), "utf8"),
     botPrs: readFileSync(join(conventionsDir, "bot-prs.yml"), "utf8"),
     checks: readFileSync(join(conventionsDir, "checks.yml"), "utf8"),
     buildDocs: readFileSync(join(conventionsDir, "build-docs.yml"), "utf8"),

package/create-product/create-product.ts

@@ -220,9 +220,7 @@ function conventionFiles(ctx: ShapeContext, shape: ShapeModule): GeneratedFile[]
     },
     { path: ".gitignore", content: `${canon.gitignoreCore}\n${shape.gitignoreTail(ctx)}` },
     { path: ".github/workflows/checks.yml", content: fillProduct(canon.checks) },
-    { path: ".github/workflows/upgrade-latest.yml", content: fillProduct(canon.upgradeLatest) },
-    { path: ".github/workflows/sync-dev-kit.yml", content: fillProduct(canon.syncDevKit) },
-    { path: ".github/workflows/sync-ctl-packages.yml", content: canon.syncCtlPackages },
+    { path: ".github/workflows/bump.yml", content: fillProduct(canon.bump) },
     { path: ".github/workflows/bot-prs.yml", content: canon.botPrs },
     { path: ".github/workflows/build-image.yml", content: fillProduct(canon.buildImage) },
     { path: ".github/actions/ci-status-dispatch/action.yml", content: loadAsset("ci-status-dispatch.yml") },

package/create-product/turnkey.ts

@@ -228,7 +228,7 @@ machine-writable source of truth — RFC 0001 Workstream C) via
 \`shared/src/version.ts\`, which validates the seed through the SDK's
 \`parseManifestSeed\` at module load. \`version.test.ts\` fails if the seed and
 the \`norsk-sdk\`/\`norsk-studio*\` npm pins in \`shared/package.json\` drift
-apart — the shared \`upgrade-latest.yml\` bumps them all in lockstep nightly.
+apart — the shared \`bump.yml\` bumps them all in lockstep nightly.
 
 ## The stored-template trap
 
@@ -537,7 +537,7 @@ describe("npm pins stay coupled to the seed", () => {
   // the studio npm packages and the studio Docker image from different commits,
   // so the image rides the newest published Docker Hub tag on the same
   // major.minor.patch line as the npm nightly (exactly how the shared
-  // upgrade-latest.yml advances the pair).
+  // bump.yml advances the pair).
   it("studio image stays on the npm pin's major.minor.patch line", () => {
     expect(STUDIO_IMAGE_TAG.split("-")[0]).toBe(studioNpmPin.split("-")[0]);
   });

package/doc-guide/engine-verdict.js

@@ -5,9 +5,9 @@
  * product's scripts/doc-guide/regen-manual.sh asks this, from the tier's own
  * output, instead of "are the capture files on disk": that rule passed a
  * composition guide that hung after two captures (2026-10-03) and passed any
- * guide whose assertions failed after its captures were written. The engine
- * tier is also half of the publish gate (dev-kit conventions/build-image.yml),
- * so what it forgives, the gate forgives.
+ * guide whose assertions failed after its captures were written. The
+ * conventions' engine-tier step (build-image.yml guides-engine, publish-docs.yml)
+ * asks it the same way; that tier reports but does not gate (norsk-ctl task 57).
  *
  * Forgiven: every result line a test passed, apart from unnamed hook failures
  * in guides that also passed a test. Anything else -- a named test failing, a

package/docs-theme/README.md

@@ -85,7 +85,7 @@ a class attribute on every page of the site.
 site: `hasDocsSite()` tests for `website/astro.config.mjs`, and
 `docsThemeProblems()` routes this directory's `checkTheme` into the same report as
 `biome.json` and the shared workflows. `conventions/sync-drift.ts` is the writer
-half, so `sync-dev-kit.yml` rolls a theme change out to every product like any
+half, so `bump.yml` rolls a theme change out to every product like any
 other convention, through a bot PR that `bot-prs.yml` merges once its tiers pass. The site directory is `website/` across the fleet
 (`DOCS_SITE_DIR`).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@norskvideo/ctl-dev-kit",
-  "version": "0.2.63",
+  "version": "0.2.65",
   "type": "module",
   "exports": {
     "./create-product": "./create-product/create-product.ts",