@patronage/software-factory 0.20.0 → 0.25.0

package/CONTEXT.md

@@ -8,7 +8,7 @@ The shared Patronage software factory: typed lifecycle state, proof gates, and o
 
 ### Proof reuse
 
-**Proof gate**: A command that emits typed proof of readiness (`pr:verify`, `pr:review`, `pr:ready`). Typed proof files are the source of readiness truth; prose never substitutes.
+**Proof gate**: A command that emits a typed proof — the self-timed set is `pr:verify`, `pr:review`, `pr:ready`, `pr:merge-check`, `boundary:check`, and `factory:closeout`; one execution is a **gate run**. Typed proof files are the source of readiness truth; prose never substitutes.
 
 **Proof-reuse gate**: The decision that consumes trusted verification proof and determines whether hosted CI may skip work already performed. Refusing reuse runs the hosted suite; it does not fail the candidate. Defined by ADR 0022. _Avoid_: proof gate (that produces readiness proof rather than reusing it).
 
@@ -18,7 +18,7 @@ The shared Patronage software factory: typed lifecycle state, proof gates, and o
 
 **To-tickets child-issue shape**: The expected shape of a factory child issue emitted by `to-tickets` from a spec — a **tracer-bullet vertical slice**: the thinnest end-to-end change that proves one path, carrying explicit **blocking edges** and **verbatim acceptance criteria**. A well-shaped child is directly dispatchable as one lane. _Avoid_: task breakdown (understates the vertical-slice + edge contract).
 
-**Blocking edge**: A declared dependency link from one child issue to another it must wait on. On the tracker these become native blocking links; the set of edges defines the **frontier** — a ticket is on the frontier once all its blockers are closed, which is how multiple lanes run in parallel; frontier membership is necessary but not sufficient for dispatch (further readiness gating is an orchestrator-skill concern; the in-CLI `plan-child-readiness` planner was removed in the T3 orchestration cut). _Avoid_: dependency (ambiguous), sub-task.
+**Blocking edge**: A declared dependency link from one child issue to another it must wait on. On the tracker these become native blocking links; the set of edges defines the **frontier** — a ticket is on the frontier once all its blockers are closed, which is how multiple lanes run in parallel; frontier membership is necessary but not sufficient for dispatch (further readiness checks are an orchestrator-skill concern; the in-CLI `plan-child-readiness` planner was removed in the T3 orchestration cut). _Avoid_: dependency (ambiguous), sub-task.
 
 **Verbatim acceptance**: A child issue's acceptance criteria carried word-for-word so a lane's success is checkable without reinterpretation — the overseer copies AC straight from a to-tickets-shaped issue into the worker brief instead of re-authoring the success condition. _Avoid_: paraphrased acceptance, summarized criteria. (Note: the in-CLI dispatch-brief spine that enforced this was removed in the T3 orchestration cut; the convention now lives in orchestrator skill prose.)
 
@@ -30,7 +30,7 @@ The shared Patronage software factory: typed lifecycle state, proof gates, and o
 
 **DAG node**: A unit of plannable work in the epic DAG, identified by a stable **slug** independent of any issue number — so it can be depended-on during planning, before issues exist. A node carries a `status` (open / closed / satisfied-on-main / parked) and, from ratification, its issue number: every node's child issue is minted up front, so the number is known before any lane dispatches. _Avoid_: ticket (a node is the plan abstraction; its minted child issue is the ticket), task.
 
-**Wave**: The _derived_ dependency-layer projection of the epic DAG — the topological rank of a node (wave N holds every node whose dependencies sit in waves `< N`). A rendered view, never hand-maintained. For the current cut a wave is a **dependency layer only**; whether it is also a thermo-gating or human-checkpoint boundary is a per-epic planning-time policy call — the deep Oracle thermo defaults to epic closeout rather than per wave. _Avoid_: phase, sprint. (Note: "deep thermo per wave" means thermo _runs at_ wave boundaries — it does not _define_ the wave.)
+**Wave**: The _derived_ dependency-layer projection of the epic DAG — the topological rank of a node (wave N holds every node whose dependencies sit in waves `< N`). A rendered view, never hand-maintained. For the current cut a wave is a **dependency layer only**; whether it is also a thermo-checkpoint or human-checkpoint boundary is a per-epic planning-time policy call — the deep Oracle thermo defaults to epic closeout rather than per wave. _Avoid_: phase, sprint. (Note: "deep thermo per wave" means thermo _runs at_ wave boundaries — it does not _define_ the wave.)
 
 **Park**: To hold a DAG node whose scope is still moving _out_ of the dispatch frontier — relabel its issue off `ready-for-agent` (never close it — history and linkage are preserved), so a moving plan costs zero issue churn. The issue already exists (minted at ratification); parking and un-parking are label changes, and the node returns to `ready-for-agent` when its lane finally dispatches. _Avoid_: close, defer (ambiguous).
 

package/README.md

@@ -4,7 +4,7 @@
 
 The factory admits a pull request from evidence bound to its candidate. It validates policy and proof; it does not schedule workers, choose models, or run reviews. Those are jobs for the harness or operator.
 
-Admission is fail closed. A clean-session review and required verification produce typed proof, then readiness decides whether the candidate may proceed. Evidence stays current when the candidate patch is unchanged; a post-merge canary covers integration risk. Epic policy, including review minimums and auto-merge authority, lives in the boundary manifest. HQ observes this work; it never blocks a gate.
+Admission is fail closed. A clean-session review and required verification produce typed proof, then readiness decides whether the candidate may proceed. Evidence stays current when the candidate patch is unchanged; the main-push verify workflow covers integration risk and freezes further merges when main goes red. Epic policy, including review minimums and auto-merge authority, lives in the boundary manifest. HQ observes this work; it never blocks a gate.
 
 ## Develop the package
 
@@ -26,14 +26,22 @@ Internal architectural packages live under `src/packages/`. Read the package roo
 
 ## Releases
 
-Every epic or close-out sweep ends in an attended release; do not let merged work accumulate untagged.
+This is the release checklist. It lives here and nowhere else; the repository runbook links to it rather than restating it. Every epic or close-out sweep ends in an attended release — do not let merged work accumulate untagged.
 
-1. Bump `package.json` and keep its version, the `software-factory-vX.Y.Z` tag, the GitHub release, and the npm publish in agreement.
-2. Cut the tag and GitHub release with notes covering features, deletions, breaking changes, and closed issues. When the release changes the profile `schemaVersion`, state it in the notes — the profile schema version is a separate axis from the package version.
-3. Publish to npm per the repository operations runbook (attended, hand-cut).
-4. Update affected `software-factory-docs/` pages in the same change and confirm the docs version matches the release.
+Releases are attended and hand-cut. Nothing in the factory publishes, tags, or releases on its own, and no step below may be automated as a drive-by.
 
-A release whose docs still describe the previous doctrine is not complete.
+1. Bump `package.json`. Its version is the release version every other fact must agree with.
+2. Publish to npm per the [repository operations runbook](../docs/repository-operations.md#publishing) (attended, hand-cut, `pnpm publish` only).
+3. Cut the `software-factory-vX.Y.Z` tag and push it.
+4. Cut the GitHub release for that tag, with notes covering features, deletions, breaking changes, and closed issues. When the release changes the profile `schemaVersion`, state it in the notes — the profile schema version is a separate axis from the package version.
+5. Update affected `software-factory-docs/` pages so the docs state the version they now describe. A release whose docs still describe the previous doctrine is not complete.
+6. Confirm the five facts converge:
+
+   ```bash
+   pnpm --filter @patronage/software-factory exec tsx scripts/assert-publish-manifest.ts --release .
+   ```
+
+   It reads what you just did — manifest version, registry versions, git tags, the published GitHub release, and the docs version statements — and throws naming the first fact that disagrees. It publishes nothing. Step 6 is the only step a machine performs, and it performs it after you.
 
 ## Use it in a project