@starterculture/devkeep-actions 0.4.0 → 0.5.0

package/dist/consolidate-release.js

@@ -127,6 +127,157 @@ function defaultModelFor(tier) {
   return current.id;
 }
 
+// ../../modules/core/dist/redactSecrets.js
+var REDACTED = "[REDACTED]";
+var KNOWN_SECRET_PATTERNS = [
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
+  /gh[pousr]_[A-Za-z0-9]{36,}/g,
+  /github_pat_[A-Za-z0-9_]{20,}/g,
+  /sk-ant-[A-Za-z0-9_-]{20,}/g,
+  /sk-[A-Za-z0-9]{20,}/g,
+  /AKIA[0-9A-Z]{16}/g,
+  /xox[baprs]-[A-Za-z0-9-]{10,}/g,
+  /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g
+];
+var SECRET_KEYWORD = "(?:API[_-]?KEY|SECRET|TOKEN|PASSWORD|PASSWD|PRIVATE[_-]?KEY|CREDENTIAL)";
+var ASSIGNMENT_PATTERN = new RegExp(`((?:[A-Za-z0-9]+[_-])*${SECRET_KEYWORD}(?:[_-][A-Za-z0-9]+)*\\s*[:=]\\s*)(["']?)([^"'\`\\s]+)\\2`, "gi");
+function redactText(text) {
+  let result = text;
+  for (const pattern of KNOWN_SECRET_PATTERNS) {
+    result = result.replace(pattern, REDACTED);
+  }
+  result = result.replace(ASSIGNMENT_PATTERN, (_match, prefix, quote) => `${prefix}${quote}${REDACTED}${quote}`);
+  return result;
+}
+
+// ../../modules/core/dist/ciHealth.js
+var EMPTY_ACTION_HEALTH = {
+  lastSuccessAt: null,
+  lastFailureAt: null,
+  lastFailureMessage: null,
+  lastFailureRunUrl: null,
+  consecutiveFailures: 0
+};
+var MAX_MESSAGE_CHARS = 2e3;
+function healthPath(projectName) {
+  return `projects/${projectName}/health.json`;
+}
+function describeError(error) {
+  const raw = error instanceof Error ? `${error.name}: ${error.message}` : typeof error === "string" ? error : JSON.stringify(error);
+  const text = raw ?? "Unknown error";
+  return redactText(text.length > MAX_MESSAGE_CHARS ? `${text.slice(0, MAX_MESSAGE_CHARS)}\u2026` : text);
+}
+function applySuccess(current, source, now) {
+  const previous = current[source] ?? EMPTY_ACTION_HEALTH;
+  return {
+    ...current,
+    // The failure details are deliberately kept, not cleared: "it failed
+    // on Tuesday and has worked since" is worth being able to read.
+    [source]: { ...previous, lastSuccessAt: now.toISOString(), consecutiveFailures: 0 }
+  };
+}
+function applyFailure(current, source, error, runUrl, now) {
+  const previous = current[source] ?? EMPTY_ACTION_HEALTH;
+  return {
+    ...current,
+    [source]: {
+      ...previous,
+      lastFailureAt: now.toISOString(),
+      lastFailureMessage: describeError(error),
+      lastFailureRunUrl: runUrl,
+      consecutiveFailures: previous.consecutiveFailures + 1
+    }
+  };
+}
+async function getHealthFile(octokit, { owner, repo, projectName }) {
+  try {
+    const { data } = await octokit.rest.repos.getContent({ owner, repo, path: healthPath(projectName) });
+    if (Array.isArray(data) || data.type !== "file") {
+      return { health: {} };
+    }
+    return { health: JSON.parse(Buffer.from(data.content, "base64").toString("utf-8")), sha: data.sha };
+  } catch {
+    return { health: {} };
+  }
+}
+async function writeHealth(octokit, params, update, message) {
+  const { owner, repo, projectName, branch } = params;
+  await retryOnConflict(async () => {
+    const { health, sha } = await getHealthFile(octokit, params);
+    await octokit.rest.repos.createOrUpdateFileContents({
+      owner,
+      repo,
+      path: healthPath(projectName),
+      message,
+      content: Buffer.from(JSON.stringify(update(health), null, 2), "utf-8").toString("base64"),
+      branch,
+      sha
+    });
+  });
+}
+async function recordSuccess(octokit, params, source, now = /* @__PURE__ */ new Date()) {
+  await writeHealth(octokit, params, (h) => applySuccess(h, source, now), `Record ${source} success: ${params.projectName}`);
+}
+async function recordFailure(octokit, params, source, error, runUrl, now = /* @__PURE__ */ new Date()) {
+  await writeHealth(octokit, params, (h) => applyFailure(h, source, error, runUrl, now), `Record ${source} failure: ${params.projectName}`);
+}
+function currentRunUrl(env) {
+  const { GITHUB_SERVER_URL, GITHUB_REPOSITORY, GITHUB_RUN_ID } = env;
+  if (!GITHUB_SERVER_URL || !GITHUB_REPOSITORY || !GITHUB_RUN_ID) {
+    return null;
+  }
+  return `${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}`;
+}
+
+// ../../modules/core/dist/ciEntrypoint.js
+var VAULT_BRANCH = "main";
+function healthParams(env) {
+  const projectName = env.PROJECT_NAME;
+  const vaultRepo = env.VAULT_REPO;
+  const token = env.DEVKEEP_GITHUB_TOKEN;
+  if (!projectName || !vaultRepo || !token) {
+    return null;
+  }
+  const [owner, repo] = vaultRepo.split("/");
+  if (!owner || !repo) {
+    return null;
+  }
+  return { owner, repo, projectName, branch: VAULT_BRANCH };
+}
+var defaultDeps = {
+  env: process.env,
+  createGithubClient,
+  recordSuccess,
+  recordFailure,
+  logError: console.error,
+  exit: (code) => process.exit(code)
+};
+async function runCiEntrypoint(source, main2, deps = defaultDeps) {
+  const params = healthParams(deps.env);
+  const octokit = params ? deps.createGithubClient(deps.env.DEVKEEP_GITHUB_TOKEN) : null;
+  try {
+    await main2();
+  } catch (error) {
+    deps.logError(error);
+    if (params && octokit) {
+      try {
+        await deps.recordFailure(octokit, params, source, error, currentRunUrl(deps.env));
+      } catch (recordingError) {
+        deps.logError(`Could not record the failure to the vault: ${String(recordingError)}`);
+      }
+    }
+    deps.exit(1);
+    return;
+  }
+  if (params && octokit) {
+    try {
+      await deps.recordSuccess(octokit, params, source);
+    } catch (recordingError) {
+      deps.logError(`Ran successfully, but could not record it to the vault: ${String(recordingError)}`);
+    }
+  }
+}
+
 // ../../modules/devlore/dist/ciUsage.js
 var EMPTY_PROJECT_USAGE = {
   draftLogEntry: ZERO_USAGE,
@@ -190,22 +341,22 @@ function isNotFound(error) {
   return typeof error === "object" && error !== null && "status" in error && error.status === 404;
 }
 
-// ../../modules/devlore/dist/masterDocs.js
-function masterDocsPath(projectName) {
-  return `projects/${projectName}/master/README.md`;
+// ../../modules/devlore/dist/canonicalDocs.js
+function canonicalDocsPath(projectName) {
+  return `projects/${projectName}/canonical/README.md`;
 }
-async function getMasterDocs(octokit, params) {
-  return (await getMasterDocsFile(octokit, params)).content;
+async function getCanonicalDocs(octokit, params) {
+  return (await getCanonicalDocsFile(octokit, params)).content;
 }
-async function getMasterDocsSha(octokit, params) {
-  return (await getMasterDocsFile(octokit, params)).sha;
+async function getCanonicalDocsSha(octokit, params) {
+  return (await getCanonicalDocsFile(octokit, params)).sha;
 }
-async function getMasterDocsFile(octokit, { owner, repo, projectName }) {
+async function getCanonicalDocsFile(octokit, { owner, repo, projectName }) {
   try {
     const { data } = await octokit.rest.repos.getContent({
       owner,
       repo,
-      path: masterDocsPath(projectName)
+      path: canonicalDocsPath(projectName)
     });
     if (Array.isArray(data) || data.type !== "file") {
       return { content: "" };
@@ -232,13 +383,13 @@ ${entry.content}`).join("\n\n");
     `Previous release: ${input.previousTag ?? "(none \u2014 this is the first release)"}`,
     `Date: ${input.date}`,
     "",
-    "Current master docs (may be empty if none exist yet):",
-    input.masterDocs || "(none yet)",
+    "Current canonical docs (may be empty if none exist yet):",
+    input.canonicalDocs || "(none yet)",
     "",
     "Log entries since the previous release:",
     entriesText || "(none)",
     "",
-    `Draft the updated master docs for ${input.projectName} as of ${input.tag}, folding in what changed across the log entries above into the current master docs. This is the official record, reviewed by a human before merging, so write it as durable reference documentation, not a changelog.`
+    `Draft the updated canonical docs for ${input.projectName} as of ${input.tag}, folding in what changed across the log entries above into the current canonical docs. This is the official record, reviewed by a human before merging, so write it as durable reference documentation, not a changelog.`
   ].join("\n");
 }
 
@@ -351,7 +502,7 @@ function releaseBranchName(projectName, tag) {
   return `devkeep/${projectName}/${tag}`;
 }
 async function consolidateRelease({ projectOctokit, vaultOctokit, claude, projectOwner, projectRepoName, vaultOwner, vaultRepoName, projectName, tag }) {
-  const [{ logEntries, previousTag }, masterDocs, masterDocsSha] = await Promise.all([
+  const [{ logEntries, previousTag }, canonicalDocs, canonicalDocsSha] = await Promise.all([
     selectLogEntriesSincePreviousRelease({
       vaultOctokit,
       projectOctokit,
@@ -362,8 +513,8 @@ async function consolidateRelease({ projectOctokit, vaultOctokit, claude, projec
       projectRepoName,
       tag
     }),
-    getMasterDocs(vaultOctokit, { owner: vaultOwner, repo: vaultRepoName, projectName }),
-    getMasterDocsSha(vaultOctokit, { owner: vaultOwner, repo: vaultRepoName, projectName })
+    getCanonicalDocs(vaultOctokit, { owner: vaultOwner, repo: vaultRepoName, projectName }),
+    getCanonicalDocsSha(vaultOctokit, { owner: vaultOwner, repo: vaultRepoName, projectName })
   ]);
   const prompt = buildConsolidationPrompt({
     projectName,
@@ -371,7 +522,7 @@ async function consolidateRelease({ projectOctokit, vaultOctokit, claude, projec
     previousTag,
     date: (/* @__PURE__ */ new Date()).toISOString().slice(0, 10),
     logEntries,
-    masterDocs
+    canonicalDocs
   });
   const { text: draftedDocs, usage } = await createCompleteMessage(claude, {
     model: defaultModelFor(MODEL_TIER),
@@ -399,13 +550,13 @@ async function consolidateRelease({ projectOctokit, vaultOctokit, claude, projec
   await vaultOctokit.rest.repos.createOrUpdateFileContents({
     owner: vaultOwner,
     repo: vaultRepoName,
-    path: masterDocsPath(projectName),
+    path: canonicalDocsPath(projectName),
     message: `Consolidate release: ${projectName}@${tag}`,
     content: Buffer.from(draftedDocs, "utf-8").toString("base64"),
     branch,
-    sha: masterDocsSha
+    sha: canonicalDocsSha
   });
-  await recordUsage(vaultOctokit, { owner: vaultOwner, repo: vaultRepoName, projectName, branch }, "consolidateRelease", usage);
+  await recordUsage(vaultOctokit, { owner: vaultOwner, repo: vaultRepoName, projectName, branch: VAULT_BASE_BRANCH }, "consolidateRelease", usage);
   const openPrs = await vaultOctokit.rest.pulls.list({ owner: vaultOwner, repo: vaultRepoName, state: "open", head: `${vaultOwner}:${branch}` }).catch(() => ({ data: [] }));
   if (openPrs.data.length > 0) {
     return { branch, prNumber: openPrs.data[0].number, prUrl: openPrs.data[0].html_url, usage };
@@ -416,7 +567,7 @@ async function consolidateRelease({ projectOctokit, vaultOctokit, claude, projec
     title: `Consolidate release: ${projectName}@${tag}`,
     head: branch,
     base: VAULT_BASE_BRANCH,
-    body: `Drafted master doc update for \`${projectName}\` at \`${tag}\`, generated from the log entries since the last release. Review before merging \u2014 this updates the official docs.`
+    body: `Drafted canonical doc update for \`${projectName}\` at \`${tag}\`, generated from the log entries since the last release. Review before merging \u2014 this updates the official docs.`
   });
   return { branch, prNumber: pr.data.number, prUrl: pr.data.html_url, usage };
 }
@@ -429,14 +580,14 @@ function requireEnv(env, name) {
   }
   return value;
 }
-var defaultDeps = {
+var defaultDeps2 = {
   env: process.env,
   consolidateRelease,
   createGithubClient,
   createClaudeClient,
   log: console.log
 };
-async function main(deps = defaultDeps) {
+async function main(deps = defaultDeps2) {
   const { env } = deps;
   const projectName = requireEnv(env, "PROJECT_NAME");
   const [projectOwner, projectRepoName] = requireEnv(env, "PROJECT_REPO").split("/");
@@ -459,10 +610,7 @@ async function main(deps = defaultDeps) {
   deps.log(`Opened consolidation PR #${result.prNumber}: ${result.prUrl}`);
 }
 if (import.meta.url === `file://${process.argv[1]}`) {
-  main().catch((error) => {
-    console.error(error);
-    process.exit(1);
-  });
+  void runCiEntrypoint("consolidateRelease", main);
 }
 export {
   main,

package/dist/crypting-candidates-scan.js

@@ -24,6 +24,157 @@ async function retryOnConflict(attempt, maxAttempts = 3) {
   }
 }
 
+// ../../modules/core/dist/redactSecrets.js
+var REDACTED = "[REDACTED]";
+var KNOWN_SECRET_PATTERNS = [
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
+  /gh[pousr]_[A-Za-z0-9]{36,}/g,
+  /github_pat_[A-Za-z0-9_]{20,}/g,
+  /sk-ant-[A-Za-z0-9_-]{20,}/g,
+  /sk-[A-Za-z0-9]{20,}/g,
+  /AKIA[0-9A-Z]{16}/g,
+  /xox[baprs]-[A-Za-z0-9-]{10,}/g,
+  /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g
+];
+var SECRET_KEYWORD = "(?:API[_-]?KEY|SECRET|TOKEN|PASSWORD|PASSWD|PRIVATE[_-]?KEY|CREDENTIAL)";
+var ASSIGNMENT_PATTERN = new RegExp(`((?:[A-Za-z0-9]+[_-])*${SECRET_KEYWORD}(?:[_-][A-Za-z0-9]+)*\\s*[:=]\\s*)(["']?)([^"'\`\\s]+)\\2`, "gi");
+function redactText(text) {
+  let result = text;
+  for (const pattern of KNOWN_SECRET_PATTERNS) {
+    result = result.replace(pattern, REDACTED);
+  }
+  result = result.replace(ASSIGNMENT_PATTERN, (_match, prefix, quote) => `${prefix}${quote}${REDACTED}${quote}`);
+  return result;
+}
+
+// ../../modules/core/dist/ciHealth.js
+var EMPTY_ACTION_HEALTH = {
+  lastSuccessAt: null,
+  lastFailureAt: null,
+  lastFailureMessage: null,
+  lastFailureRunUrl: null,
+  consecutiveFailures: 0
+};
+var MAX_MESSAGE_CHARS = 2e3;
+function healthPath(projectName) {
+  return `projects/${projectName}/health.json`;
+}
+function describeError(error) {
+  const raw = error instanceof Error ? `${error.name}: ${error.message}` : typeof error === "string" ? error : JSON.stringify(error);
+  const text = raw ?? "Unknown error";
+  return redactText(text.length > MAX_MESSAGE_CHARS ? `${text.slice(0, MAX_MESSAGE_CHARS)}\u2026` : text);
+}
+function applySuccess(current, source, now) {
+  const previous = current[source] ?? EMPTY_ACTION_HEALTH;
+  return {
+    ...current,
+    // The failure details are deliberately kept, not cleared: "it failed
+    // on Tuesday and has worked since" is worth being able to read.
+    [source]: { ...previous, lastSuccessAt: now.toISOString(), consecutiveFailures: 0 }
+  };
+}
+function applyFailure(current, source, error, runUrl, now) {
+  const previous = current[source] ?? EMPTY_ACTION_HEALTH;
+  return {
+    ...current,
+    [source]: {
+      ...previous,
+      lastFailureAt: now.toISOString(),
+      lastFailureMessage: describeError(error),
+      lastFailureRunUrl: runUrl,
+      consecutiveFailures: previous.consecutiveFailures + 1
+    }
+  };
+}
+async function getHealthFile(octokit, { owner, repo, projectName }) {
+  try {
+    const { data } = await octokit.rest.repos.getContent({ owner, repo, path: healthPath(projectName) });
+    if (Array.isArray(data) || data.type !== "file") {
+      return { health: {} };
+    }
+    return { health: JSON.parse(Buffer.from(data.content, "base64").toString("utf-8")), sha: data.sha };
+  } catch {
+    return { health: {} };
+  }
+}
+async function writeHealth(octokit, params, update, message) {
+  const { owner, repo, projectName, branch } = params;
+  await retryOnConflict(async () => {
+    const { health, sha } = await getHealthFile(octokit, params);
+    await octokit.rest.repos.createOrUpdateFileContents({
+      owner,
+      repo,
+      path: healthPath(projectName),
+      message,
+      content: Buffer.from(JSON.stringify(update(health), null, 2), "utf-8").toString("base64"),
+      branch,
+      sha
+    });
+  });
+}
+async function recordSuccess(octokit, params, source, now = /* @__PURE__ */ new Date()) {
+  await writeHealth(octokit, params, (h) => applySuccess(h, source, now), `Record ${source} success: ${params.projectName}`);
+}
+async function recordFailure(octokit, params, source, error, runUrl, now = /* @__PURE__ */ new Date()) {
+  await writeHealth(octokit, params, (h) => applyFailure(h, source, error, runUrl, now), `Record ${source} failure: ${params.projectName}`);
+}
+function currentRunUrl(env) {
+  const { GITHUB_SERVER_URL, GITHUB_REPOSITORY, GITHUB_RUN_ID } = env;
+  if (!GITHUB_SERVER_URL || !GITHUB_REPOSITORY || !GITHUB_RUN_ID) {
+    return null;
+  }
+  return `${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}`;
+}
+
+// ../../modules/core/dist/ciEntrypoint.js
+var VAULT_BRANCH = "main";
+function healthParams(env) {
+  const projectName = env.PROJECT_NAME;
+  const vaultRepo = env.VAULT_REPO;
+  const token = env.DEVKEEP_GITHUB_TOKEN;
+  if (!projectName || !vaultRepo || !token) {
+    return null;
+  }
+  const [owner, repo] = vaultRepo.split("/");
+  if (!owner || !repo) {
+    return null;
+  }
+  return { owner, repo, projectName, branch: VAULT_BRANCH };
+}
+var defaultDeps = {
+  env: process.env,
+  createGithubClient,
+  recordSuccess,
+  recordFailure,
+  logError: console.error,
+  exit: (code) => process.exit(code)
+};
+async function runCiEntrypoint(source, main2, deps = defaultDeps) {
+  const params = healthParams(deps.env);
+  const octokit = params ? deps.createGithubClient(deps.env.DEVKEEP_GITHUB_TOKEN) : null;
+  try {
+    await main2();
+  } catch (error) {
+    deps.logError(error);
+    if (params && octokit) {
+      try {
+        await deps.recordFailure(octokit, params, source, error, currentRunUrl(deps.env));
+      } catch (recordingError) {
+        deps.logError(`Could not record the failure to the vault: ${String(recordingError)}`);
+      }
+    }
+    deps.exit(1);
+    return;
+  }
+  if (params && octokit) {
+    try {
+      await deps.recordSuccess(octokit, params, source);
+    } catch (recordingError) {
+      deps.logError(`Ran successfully, but could not record it to the vault: ${String(recordingError)}`);
+    }
+  }
+}
+
 // ../../modules/devlore/dist/diff.js
 function toDiffFile(file) {
   return {
@@ -70,8 +221,8 @@ var SECRET_PREFIX_PATTERNS = [
   // JWT-shaped
 ];
 var PEM_BLOCK_PATTERN = /-----BEGIN [A-Z ]*PRIVATE KEY-----/;
-var SECRET_KEYWORD = "(?:API[_-]?KEY|SECRET|TOKEN|PASSWORD|PASSWD|PRIVATE[_-]?KEY|CREDENTIAL)";
-var SECRET_ASSIGNMENT_PATTERN = new RegExp(`(?:[A-Za-z0-9]+[_-])*${SECRET_KEYWORD}(?:[_-][A-Za-z0-9]+)*\\s*[:=]\\s*["']([^"'\`]+)["']`, "i");
+var SECRET_KEYWORD2 = "(?:API[_-]?KEY|SECRET|TOKEN|PASSWORD|PASSWD|PRIVATE[_-]?KEY|CREDENTIAL)";
+var SECRET_ASSIGNMENT_PATTERN = new RegExp(`(?:[A-Za-z0-9]+[_-])*${SECRET_KEYWORD2}(?:[_-][A-Za-z0-9]+)*\\s*[:=]\\s*["']([^"'\`]+)["']`, "i");
 
 // ../../modules/devcrypt/dist/candidateScan.js
 function addedLines(patch) {
@@ -332,13 +483,13 @@ function requireEnv(env, name) {
   }
   return value;
 }
-var defaultDeps = {
+var defaultDeps2 = {
   env: process.env,
   scanCryptingCandidates,
   createGithubClient,
   log: console.log
 };
-async function main(deps = defaultDeps) {
+async function main(deps = defaultDeps2) {
   const { env } = deps;
   const [projectOwner, projectRepoName] = requireEnv(env, "PROJECT_REPO").split("/");
   const [vaultOwner, vaultRepo] = requireEnv(env, "VAULT_REPO").split("/");
@@ -360,10 +511,7 @@ async function main(deps = defaultDeps) {
   deps.log(`Flagged ${result.candidatesFlagged} crypting candidate(s)`);
 }
 if (import.meta.url === `file://${process.argv[1]}`) {
-  main().catch((error) => {
-    console.error(error);
-    process.exit(1);
-  });
+  void runCiEntrypoint("cryptingCandidatesScan", main);
 }
 export {
   main,

package/dist/draft-log-entry.js

@@ -127,6 +127,157 @@ function defaultModelFor(tier) {
   return current.id;
 }
 
+// ../../modules/core/dist/redactSecrets.js
+var REDACTED = "[REDACTED]";
+var KNOWN_SECRET_PATTERNS = [
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
+  /gh[pousr]_[A-Za-z0-9]{36,}/g,
+  /github_pat_[A-Za-z0-9_]{20,}/g,
+  /sk-ant-[A-Za-z0-9_-]{20,}/g,
+  /sk-[A-Za-z0-9]{20,}/g,
+  /AKIA[0-9A-Z]{16}/g,
+  /xox[baprs]-[A-Za-z0-9-]{10,}/g,
+  /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g
+];
+var SECRET_KEYWORD = "(?:API[_-]?KEY|SECRET|TOKEN|PASSWORD|PASSWD|PRIVATE[_-]?KEY|CREDENTIAL)";
+var ASSIGNMENT_PATTERN = new RegExp(`((?:[A-Za-z0-9]+[_-])*${SECRET_KEYWORD}(?:[_-][A-Za-z0-9]+)*\\s*[:=]\\s*)(["']?)([^"'\`\\s]+)\\2`, "gi");
+function redactText(text) {
+  let result = text;
+  for (const pattern of KNOWN_SECRET_PATTERNS) {
+    result = result.replace(pattern, REDACTED);
+  }
+  result = result.replace(ASSIGNMENT_PATTERN, (_match, prefix, quote) => `${prefix}${quote}${REDACTED}${quote}`);
+  return result;
+}
+
+// ../../modules/core/dist/ciHealth.js
+var EMPTY_ACTION_HEALTH = {
+  lastSuccessAt: null,
+  lastFailureAt: null,
+  lastFailureMessage: null,
+  lastFailureRunUrl: null,
+  consecutiveFailures: 0
+};
+var MAX_MESSAGE_CHARS = 2e3;
+function healthPath(projectName) {
+  return `projects/${projectName}/health.json`;
+}
+function describeError(error) {
+  const raw = error instanceof Error ? `${error.name}: ${error.message}` : typeof error === "string" ? error : JSON.stringify(error);
+  const text = raw ?? "Unknown error";
+  return redactText(text.length > MAX_MESSAGE_CHARS ? `${text.slice(0, MAX_MESSAGE_CHARS)}\u2026` : text);
+}
+function applySuccess(current, source, now) {
+  const previous = current[source] ?? EMPTY_ACTION_HEALTH;
+  return {
+    ...current,
+    // The failure details are deliberately kept, not cleared: "it failed
+    // on Tuesday and has worked since" is worth being able to read.
+    [source]: { ...previous, lastSuccessAt: now.toISOString(), consecutiveFailures: 0 }
+  };
+}
+function applyFailure(current, source, error, runUrl, now) {
+  const previous = current[source] ?? EMPTY_ACTION_HEALTH;
+  return {
+    ...current,
+    [source]: {
+      ...previous,
+      lastFailureAt: now.toISOString(),
+      lastFailureMessage: describeError(error),
+      lastFailureRunUrl: runUrl,
+      consecutiveFailures: previous.consecutiveFailures + 1
+    }
+  };
+}
+async function getHealthFile(octokit, { owner, repo, projectName }) {
+  try {
+    const { data } = await octokit.rest.repos.getContent({ owner, repo, path: healthPath(projectName) });
+    if (Array.isArray(data) || data.type !== "file") {
+      return { health: {} };
+    }
+    return { health: JSON.parse(Buffer.from(data.content, "base64").toString("utf-8")), sha: data.sha };
+  } catch {
+    return { health: {} };
+  }
+}
+async function writeHealth(octokit, params, update, message) {
+  const { owner, repo, projectName, branch } = params;
+  await retryOnConflict(async () => {
+    const { health, sha } = await getHealthFile(octokit, params);
+    await octokit.rest.repos.createOrUpdateFileContents({
+      owner,
+      repo,
+      path: healthPath(projectName),
+      message,
+      content: Buffer.from(JSON.stringify(update(health), null, 2), "utf-8").toString("base64"),
+      branch,
+      sha
+    });
+  });
+}
+async function recordSuccess(octokit, params, source, now = /* @__PURE__ */ new Date()) {
+  await writeHealth(octokit, params, (h) => applySuccess(h, source, now), `Record ${source} success: ${params.projectName}`);
+}
+async function recordFailure(octokit, params, source, error, runUrl, now = /* @__PURE__ */ new Date()) {
+  await writeHealth(octokit, params, (h) => applyFailure(h, source, error, runUrl, now), `Record ${source} failure: ${params.projectName}`);
+}
+function currentRunUrl(env) {
+  const { GITHUB_SERVER_URL, GITHUB_REPOSITORY, GITHUB_RUN_ID } = env;
+  if (!GITHUB_SERVER_URL || !GITHUB_REPOSITORY || !GITHUB_RUN_ID) {
+    return null;
+  }
+  return `${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}`;
+}
+
+// ../../modules/core/dist/ciEntrypoint.js
+var VAULT_BRANCH = "main";
+function healthParams(env) {
+  const projectName = env.PROJECT_NAME;
+  const vaultRepo = env.VAULT_REPO;
+  const token = env.DEVKEEP_GITHUB_TOKEN;
+  if (!projectName || !vaultRepo || !token) {
+    return null;
+  }
+  const [owner, repo] = vaultRepo.split("/");
+  if (!owner || !repo) {
+    return null;
+  }
+  return { owner, repo, projectName, branch: VAULT_BRANCH };
+}
+var defaultDeps = {
+  env: process.env,
+  createGithubClient,
+  recordSuccess,
+  recordFailure,
+  logError: console.error,
+  exit: (code) => process.exit(code)
+};
+async function runCiEntrypoint(source, main2, deps = defaultDeps) {
+  const params = healthParams(deps.env);
+  const octokit = params ? deps.createGithubClient(deps.env.DEVKEEP_GITHUB_TOKEN) : null;
+  try {
+    await main2();
+  } catch (error) {
+    deps.logError(error);
+    if (params && octokit) {
+      try {
+        await deps.recordFailure(octokit, params, source, error, currentRunUrl(deps.env));
+      } catch (recordingError) {
+        deps.logError(`Could not record the failure to the vault: ${String(recordingError)}`);
+      }
+    }
+    deps.exit(1);
+    return;
+  }
+  if (params && octokit) {
+    try {
+      await deps.recordSuccess(octokit, params, source);
+    } catch (recordingError) {
+      deps.logError(`Ran successfully, but could not record it to the vault: ${String(recordingError)}`);
+    }
+  }
+}
+
 // ../../modules/devlore/dist/ciUsage.js
 var EMPTY_PROJECT_USAGE = {
   draftLogEntry: ZERO_USAGE,
@@ -237,19 +388,19 @@ async function getProjectDiff(octokit, { owner, repo, base, head }) {
   }
 }
 
-// ../../modules/devlore/dist/masterDocs.js
-function masterDocsPath(projectName) {
-  return `projects/${projectName}/master/README.md`;
+// ../../modules/devlore/dist/canonicalDocs.js
+function canonicalDocsPath(projectName) {
+  return `projects/${projectName}/canonical/README.md`;
 }
-async function getMasterDocs(octokit, params) {
-  return (await getMasterDocsFile(octokit, params)).content;
+async function getCanonicalDocs(octokit, params) {
+  return (await getCanonicalDocsFile(octokit, params)).content;
 }
-async function getMasterDocsFile(octokit, { owner, repo, projectName }) {
+async function getCanonicalDocsFile(octokit, { owner, repo, projectName }) {
   try {
     const { data } = await octokit.rest.repos.getContent({
       owner,
       repo,
-      path: masterDocsPath(projectName)
+      path: canonicalDocsPath(projectName)
     });
     if (Array.isArray(data) || data.type !== "file") {
       return { content: "" };
@@ -367,8 +518,8 @@ ${file.patch}`).join("\n\n");
     "Commit messages:",
     input.commitMessages.map((message) => `- ${message}`).join("\n"),
     "",
-    "Current master docs (may be empty if none exist yet):",
-    input.masterDocs || "(none yet)",
+    "Current canonical docs (may be empty if none exist yet):",
+    input.canonicalDocs || "(none yet)",
     "",
     "Diff:",
     diff,
@@ -484,19 +635,6 @@ function routeDiffByModule(files, manifest) {
 }
 
 // ../../modules/devlore/dist/redact.js
-var REDACTED = "[REDACTED]";
-var KNOWN_SECRET_PATTERNS = [
-  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
-  /gh[pousr]_[A-Za-z0-9]{36,}/g,
-  /github_pat_[A-Za-z0-9_]{20,}/g,
-  /sk-ant-[A-Za-z0-9_-]{20,}/g,
-  /sk-[A-Za-z0-9]{20,}/g,
-  /AKIA[0-9A-Z]{16}/g,
-  /xox[baprs]-[A-Za-z0-9-]{10,}/g,
-  /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g
-];
-var SECRET_KEYWORD = "(?:API[_-]?KEY|SECRET|TOKEN|PASSWORD|PASSWD|PRIVATE[_-]?KEY|CREDENTIAL)";
-var ASSIGNMENT_PATTERN = new RegExp(`((?:[A-Za-z0-9]+[_-])*${SECRET_KEYWORD}(?:[_-][A-Za-z0-9]+)*\\s*[:=]\\s*)(["']?)([^"'\`\\s]+)\\2`, "gi");
 var SENSITIVE_FILENAME_PATTERNS = [
   /(^|\/)\.env(\..+)?$/,
   /\.pem$/,
@@ -508,14 +646,6 @@ var SENSITIVE_FILENAME_PATTERNS = [
   /credentials\.json$/,
   /secrets?\.(json|ya?ml|toml)$/
 ];
-function redactText(text) {
-  let result = text;
-  for (const pattern of KNOWN_SECRET_PATTERNS) {
-    result = result.replace(pattern, REDACTED);
-  }
-  result = result.replace(ASSIGNMENT_PATTERN, (_match, prefix, quote) => `${prefix}${quote}${REDACTED}${quote}`);
-  return result;
-}
 function isSensitiveFilename(filename) {
   return SENSITIVE_FILENAME_PATTERNS.some((pattern) => pattern.test(filename));
 }
@@ -533,7 +663,7 @@ function redactProjectDiff(diff) {
 }
 
 // ../../modules/devlore/dist/actions/draftLogEntry.js
-var VAULT_BRANCH = "main";
+var VAULT_BRANCH2 = "main";
 var MODEL_TIER = "balanced";
 var MAX_TOKENS = 2048;
 function logEntryPath(projectName, commitSha, moduleId) {
@@ -567,18 +697,18 @@ async function syncProductDoc(projectOctokit, vaultOctokit, { projectOwner, proj
       path: productDocPath(projectName, moduleId),
       message: `Sync PRODUCT.md: ${projectName}@${headSha.slice(0, 7)}`,
       content: Buffer.from(redactedDoc, "utf-8").toString("base64"),
-      branch: VAULT_BRANCH,
+      branch: VAULT_BRANCH2,
       sha: existing.sha
     });
   });
 }
-async function draftBucketLogEntry({ vaultOctokit, claude, vaultOwner, vaultRepoName, projectName, headSha, date, commitMessages, files, masterDocs, moduleId, moduleName }) {
+async function draftBucketLogEntry({ vaultOctokit, claude, vaultOwner, vaultRepoName, projectName, headSha, date, commitMessages, files, canonicalDocs, moduleId, moduleName }) {
   const prompt = buildLogEntryPrompt({
     projectName,
     date,
     commitMessages,
     files,
-    masterDocs,
+    canonicalDocs,
     moduleName: moduleName ?? void 0
   });
   const { text, usage } = await createCompleteMessage(claude, {
@@ -600,7 +730,7 @@ ${entryBody}
     path: entryPath,
     message: `Draft log entry: ${projectName}@${shortSha}${moduleName ? ` (${moduleName})` : ""}`,
     content: Buffer.from(entryContent, "utf-8").toString("base64"),
-    branch: VAULT_BRANCH
+    branch: VAULT_BRANCH2
   }));
   let decisionPath = null;
   if (decisionEntry) {
@@ -615,7 +745,7 @@ ${decisionEntry}
       path: decisionPath,
       message: `Draft decision entry: ${projectName}@${shortSha}${moduleName ? ` (${moduleName})` : ""}`,
       content: Buffer.from(decisionContent, "utf-8").toString("base64"),
-      branch: VAULT_BRANCH
+      branch: VAULT_BRANCH2
     }));
   }
   return { moduleId, logEntryPath: entryPath, decisionEntryPath: decisionPath, usage };
@@ -633,7 +763,7 @@ async function draftLogEntry({ projectOctokit, vaultOctokit, claude, projectOwne
     ref: headSha
   });
   const buckets = routeDiffByModule(diff.files, manifest);
-  const masterDocs = await getMasterDocs(vaultOctokit, {
+  const canonicalDocs = await getCanonicalDocs(vaultOctokit, {
     owner: vaultOwner,
     repo: vaultRepoName,
     projectName
@@ -651,7 +781,7 @@ async function draftLogEntry({ projectOctokit, vaultOctokit, claude, projectOwne
       date,
       commitMessages: diff.commitMessages,
       files: bucket.files,
-      masterDocs,
+      canonicalDocs,
       moduleId: bucket.moduleId,
       moduleName: bucket.moduleName
     });
@@ -668,7 +798,7 @@ async function draftLogEntry({ projectOctokit, vaultOctokit, claude, projectOwne
     });
   }
   const totalUsage = results.reduce((total, r) => addTokenUsage(total, r.usage), ZERO_USAGE);
-  await recordUsage(vaultOctokit, { owner: vaultOwner, repo: vaultRepoName, projectName, branch: VAULT_BRANCH }, "draftLogEntry", totalUsage);
+  await recordUsage(vaultOctokit, { owner: vaultOwner, repo: vaultRepoName, projectName, branch: VAULT_BRANCH2 }, "draftLogEntry", totalUsage);
   return results;
 }
 
@@ -680,14 +810,14 @@ function requireEnv(env, name) {
   }
   return value;
 }
-var defaultDeps = {
+var defaultDeps2 = {
   env: process.env,
   draftLogEntry,
   createGithubClient,
   createClaudeClient,
   log: console.log
 };
-async function main(deps = defaultDeps) {
+async function main(deps = defaultDeps2) {
   const { env } = deps;
   const projectName = requireEnv(env, "PROJECT_NAME");
   const [projectOwner, projectRepoName] = requireEnv(env, "PROJECT_REPO").split("/");
@@ -717,10 +847,7 @@ async function main(deps = defaultDeps) {
   }
 }
 if (import.meta.url === `file://${process.argv[1]}`) {
-  main().catch((error) => {
-    console.error(error);
-    process.exit(1);
-  });
+  void runCiEntrypoint("draftLogEntry", main);
 }
 export {
   main,

package/dist/draft-release-notes.js

@@ -127,6 +127,157 @@ function defaultModelFor(tier) {
   return current.id;
 }
 
+// ../../modules/core/dist/redactSecrets.js
+var REDACTED = "[REDACTED]";
+var KNOWN_SECRET_PATTERNS = [
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
+  /gh[pousr]_[A-Za-z0-9]{36,}/g,
+  /github_pat_[A-Za-z0-9_]{20,}/g,
+  /sk-ant-[A-Za-z0-9_-]{20,}/g,
+  /sk-[A-Za-z0-9]{20,}/g,
+  /AKIA[0-9A-Z]{16}/g,
+  /xox[baprs]-[A-Za-z0-9-]{10,}/g,
+  /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g
+];
+var SECRET_KEYWORD = "(?:API[_-]?KEY|SECRET|TOKEN|PASSWORD|PASSWD|PRIVATE[_-]?KEY|CREDENTIAL)";
+var ASSIGNMENT_PATTERN = new RegExp(`((?:[A-Za-z0-9]+[_-])*${SECRET_KEYWORD}(?:[_-][A-Za-z0-9]+)*\\s*[:=]\\s*)(["']?)([^"'\`\\s]+)\\2`, "gi");
+function redactText(text) {
+  let result = text;
+  for (const pattern of KNOWN_SECRET_PATTERNS) {
+    result = result.replace(pattern, REDACTED);
+  }
+  result = result.replace(ASSIGNMENT_PATTERN, (_match, prefix, quote) => `${prefix}${quote}${REDACTED}${quote}`);
+  return result;
+}
+
+// ../../modules/core/dist/ciHealth.js
+var EMPTY_ACTION_HEALTH = {
+  lastSuccessAt: null,
+  lastFailureAt: null,
+  lastFailureMessage: null,
+  lastFailureRunUrl: null,
+  consecutiveFailures: 0
+};
+var MAX_MESSAGE_CHARS = 2e3;
+function healthPath(projectName) {
+  return `projects/${projectName}/health.json`;
+}
+function describeError(error) {
+  const raw = error instanceof Error ? `${error.name}: ${error.message}` : typeof error === "string" ? error : JSON.stringify(error);
+  const text = raw ?? "Unknown error";
+  return redactText(text.length > MAX_MESSAGE_CHARS ? `${text.slice(0, MAX_MESSAGE_CHARS)}\u2026` : text);
+}
+function applySuccess(current, source, now) {
+  const previous = current[source] ?? EMPTY_ACTION_HEALTH;
+  return {
+    ...current,
+    // The failure details are deliberately kept, not cleared: "it failed
+    // on Tuesday and has worked since" is worth being able to read.
+    [source]: { ...previous, lastSuccessAt: now.toISOString(), consecutiveFailures: 0 }
+  };
+}
+function applyFailure(current, source, error, runUrl, now) {
+  const previous = current[source] ?? EMPTY_ACTION_HEALTH;
+  return {
+    ...current,
+    [source]: {
+      ...previous,
+      lastFailureAt: now.toISOString(),
+      lastFailureMessage: describeError(error),
+      lastFailureRunUrl: runUrl,
+      consecutiveFailures: previous.consecutiveFailures + 1
+    }
+  };
+}
+async function getHealthFile(octokit, { owner, repo, projectName }) {
+  try {
+    const { data } = await octokit.rest.repos.getContent({ owner, repo, path: healthPath(projectName) });
+    if (Array.isArray(data) || data.type !== "file") {
+      return { health: {} };
+    }
+    return { health: JSON.parse(Buffer.from(data.content, "base64").toString("utf-8")), sha: data.sha };
+  } catch {
+    return { health: {} };
+  }
+}
+async function writeHealth(octokit, params, update, message) {
+  const { owner, repo, projectName, branch } = params;
+  await retryOnConflict(async () => {
+    const { health, sha } = await getHealthFile(octokit, params);
+    await octokit.rest.repos.createOrUpdateFileContents({
+      owner,
+      repo,
+      path: healthPath(projectName),
+      message,
+      content: Buffer.from(JSON.stringify(update(health), null, 2), "utf-8").toString("base64"),
+      branch,
+      sha
+    });
+  });
+}
+async function recordSuccess(octokit, params, source, now = /* @__PURE__ */ new Date()) {
+  await writeHealth(octokit, params, (h) => applySuccess(h, source, now), `Record ${source} success: ${params.projectName}`);
+}
+async function recordFailure(octokit, params, source, error, runUrl, now = /* @__PURE__ */ new Date()) {
+  await writeHealth(octokit, params, (h) => applyFailure(h, source, error, runUrl, now), `Record ${source} failure: ${params.projectName}`);
+}
+function currentRunUrl(env) {
+  const { GITHUB_SERVER_URL, GITHUB_REPOSITORY, GITHUB_RUN_ID } = env;
+  if (!GITHUB_SERVER_URL || !GITHUB_REPOSITORY || !GITHUB_RUN_ID) {
+    return null;
+  }
+  return `${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}`;
+}
+
+// ../../modules/core/dist/ciEntrypoint.js
+var VAULT_BRANCH = "main";
+function healthParams(env) {
+  const projectName = env.PROJECT_NAME;
+  const vaultRepo = env.VAULT_REPO;
+  const token = env.DEVKEEP_GITHUB_TOKEN;
+  if (!projectName || !vaultRepo || !token) {
+    return null;
+  }
+  const [owner, repo] = vaultRepo.split("/");
+  if (!owner || !repo) {
+    return null;
+  }
+  return { owner, repo, projectName, branch: VAULT_BRANCH };
+}
+var defaultDeps = {
+  env: process.env,
+  createGithubClient,
+  recordSuccess,
+  recordFailure,
+  logError: console.error,
+  exit: (code) => process.exit(code)
+};
+async function runCiEntrypoint(source, main2, deps = defaultDeps) {
+  const params = healthParams(deps.env);
+  const octokit = params ? deps.createGithubClient(deps.env.DEVKEEP_GITHUB_TOKEN) : null;
+  try {
+    await main2();
+  } catch (error) {
+    deps.logError(error);
+    if (params && octokit) {
+      try {
+        await deps.recordFailure(octokit, params, source, error, currentRunUrl(deps.env));
+      } catch (recordingError) {
+        deps.logError(`Could not record the failure to the vault: ${String(recordingError)}`);
+      }
+    }
+    deps.exit(1);
+    return;
+  }
+  if (params && octokit) {
+    try {
+      await deps.recordSuccess(octokit, params, source);
+    } catch (recordingError) {
+      deps.logError(`Ran successfully, but could not record it to the vault: ${String(recordingError)}`);
+    }
+  }
+}
+
 // ../../modules/devlore/dist/prompt.js
 function buildReleaseNotesPrompt(input) {
   return [
@@ -150,29 +301,6 @@ function buildReleaseNotesPrompt(input) {
   ].join("\n");
 }
 
-// ../../modules/devlore/dist/redact.js
-var REDACTED = "[REDACTED]";
-var KNOWN_SECRET_PATTERNS = [
-  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
-  /gh[pousr]_[A-Za-z0-9]{36,}/g,
-  /github_pat_[A-Za-z0-9_]{20,}/g,
-  /sk-ant-[A-Za-z0-9_-]{20,}/g,
-  /sk-[A-Za-z0-9]{20,}/g,
-  /AKIA[0-9A-Z]{16}/g,
-  /xox[baprs]-[A-Za-z0-9-]{10,}/g,
-  /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g
-];
-var SECRET_KEYWORD = "(?:API[_-]?KEY|SECRET|TOKEN|PASSWORD|PASSWD|PRIVATE[_-]?KEY|CREDENTIAL)";
-var ASSIGNMENT_PATTERN = new RegExp(`((?:[A-Za-z0-9]+[_-])*${SECRET_KEYWORD}(?:[_-][A-Za-z0-9]+)*\\s*[:=]\\s*)(["']?)([^"'\`\\s]+)\\2`, "gi");
-function redactText(text) {
-  let result = text;
-  for (const pattern of KNOWN_SECRET_PATTERNS) {
-    result = result.replace(pattern, REDACTED);
-  }
-  result = result.replace(ASSIGNMENT_PATTERN, (_match, prefix, quote) => `${prefix}${quote}${REDACTED}${quote}`);
-  return result;
-}
-
 // ../../modules/devlore/dist/ciUsage.js
 var EMPTY_PROJECT_USAGE = {
   draftLogEntry: ZERO_USAGE,
@@ -354,7 +482,7 @@ function releaseNotesDir(projectName) {
 var MODEL_TIER = "balanced";
 var MAX_TOKENS = 2e4;
 var MAX_CONTINUATIONS = 8;
-var VAULT_BRANCH = "main";
+var VAULT_BRANCH2 = "main";
 async function draftReleaseNotes({ projectOctokit, vaultOctokit, claude, projectOwner, projectRepoName, vaultOwner, vaultRepoName, projectName, tag }) {
   const { logEntries, previousTag } = await selectLogEntriesSincePreviousRelease({
     vaultOctokit,
@@ -386,11 +514,11 @@ ${text.trim()}
     path,
     message: `Draft release notes: ${projectName} ${tag}`,
     content: Buffer.from(content, "utf-8").toString("base64"),
-    branch: VAULT_BRANCH,
+    branch: VAULT_BRANCH2,
     sha: await getExistingSha(vaultOctokit, vaultOwner, vaultRepoName, path)
   });
   if (usage.inputTokens > 0 || usage.outputTokens > 0) {
-    await recordUsage(vaultOctokit, { owner: vaultOwner, repo: vaultRepoName, projectName, branch: VAULT_BRANCH }, "releaseNotes", usage);
+    await recordUsage(vaultOctokit, { owner: vaultOwner, repo: vaultRepoName, projectName, branch: VAULT_BRANCH2 }, "releaseNotes", usage);
   }
   return { path, previousTag, entryCount: logEntries.length, content, usage };
 }
@@ -411,14 +539,14 @@ function requireEnv(env, name) {
   }
   return value;
 }
-var defaultDeps = {
+var defaultDeps2 = {
   env: process.env,
   draftReleaseNotes,
   createGithubClient,
   createClaudeClient,
   log: console.log
 };
-async function main(deps = defaultDeps) {
+async function main(deps = defaultDeps2) {
   const { env } = deps;
   const projectName = requireEnv(env, "PROJECT_NAME");
   const [projectOwner, projectRepoName] = requireEnv(env, "PROJECT_REPO").split("/");
@@ -440,10 +568,7 @@ async function main(deps = defaultDeps) {
   deps.log(`Drafted release notes: ${result.path} (previous tag: ${result.previousTag ?? "none"}, ${result.entryCount} entries)`);
 }
 if (import.meta.url === `file://${process.argv[1]}`) {
-  main().catch((error) => {
-    console.error(error);
-    process.exit(1);
-  });
+  void runCiEntrypoint("releaseNotes", main);
 }
 export {
   main,

package/dist/sync-onboarding.js

@@ -127,6 +127,157 @@ function defaultModelFor(tier) {
   return current.id;
 }
 
+// ../../modules/core/dist/redactSecrets.js
+var REDACTED = "[REDACTED]";
+var KNOWN_SECRET_PATTERNS = [
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
+  /gh[pousr]_[A-Za-z0-9]{36,}/g,
+  /github_pat_[A-Za-z0-9_]{20,}/g,
+  /sk-ant-[A-Za-z0-9_-]{20,}/g,
+  /sk-[A-Za-z0-9]{20,}/g,
+  /AKIA[0-9A-Z]{16}/g,
+  /xox[baprs]-[A-Za-z0-9-]{10,}/g,
+  /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g
+];
+var SECRET_KEYWORD = "(?:API[_-]?KEY|SECRET|TOKEN|PASSWORD|PASSWD|PRIVATE[_-]?KEY|CREDENTIAL)";
+var ASSIGNMENT_PATTERN = new RegExp(`((?:[A-Za-z0-9]+[_-])*${SECRET_KEYWORD}(?:[_-][A-Za-z0-9]+)*\\s*[:=]\\s*)(["']?)([^"'\`\\s]+)\\2`, "gi");
+function redactText(text) {
+  let result = text;
+  for (const pattern of KNOWN_SECRET_PATTERNS) {
+    result = result.replace(pattern, REDACTED);
+  }
+  result = result.replace(ASSIGNMENT_PATTERN, (_match, prefix, quote) => `${prefix}${quote}${REDACTED}${quote}`);
+  return result;
+}
+
+// ../../modules/core/dist/ciHealth.js
+var EMPTY_ACTION_HEALTH = {
+  lastSuccessAt: null,
+  lastFailureAt: null,
+  lastFailureMessage: null,
+  lastFailureRunUrl: null,
+  consecutiveFailures: 0
+};
+var MAX_MESSAGE_CHARS = 2e3;
+function healthPath(projectName) {
+  return `projects/${projectName}/health.json`;
+}
+function describeError(error) {
+  const raw = error instanceof Error ? `${error.name}: ${error.message}` : typeof error === "string" ? error : JSON.stringify(error);
+  const text = raw ?? "Unknown error";
+  return redactText(text.length > MAX_MESSAGE_CHARS ? `${text.slice(0, MAX_MESSAGE_CHARS)}\u2026` : text);
+}
+function applySuccess(current, source, now) {
+  const previous = current[source] ?? EMPTY_ACTION_HEALTH;
+  return {
+    ...current,
+    // The failure details are deliberately kept, not cleared: "it failed
+    // on Tuesday and has worked since" is worth being able to read.
+    [source]: { ...previous, lastSuccessAt: now.toISOString(), consecutiveFailures: 0 }
+  };
+}
+function applyFailure(current, source, error, runUrl, now) {
+  const previous = current[source] ?? EMPTY_ACTION_HEALTH;
+  return {
+    ...current,
+    [source]: {
+      ...previous,
+      lastFailureAt: now.toISOString(),
+      lastFailureMessage: describeError(error),
+      lastFailureRunUrl: runUrl,
+      consecutiveFailures: previous.consecutiveFailures + 1
+    }
+  };
+}
+async function getHealthFile(octokit, { owner, repo, projectName }) {
+  try {
+    const { data } = await octokit.rest.repos.getContent({ owner, repo, path: healthPath(projectName) });
+    if (Array.isArray(data) || data.type !== "file") {
+      return { health: {} };
+    }
+    return { health: JSON.parse(Buffer.from(data.content, "base64").toString("utf-8")), sha: data.sha };
+  } catch {
+    return { health: {} };
+  }
+}
+async function writeHealth(octokit, params, update, message) {
+  const { owner, repo, projectName, branch } = params;
+  await retryOnConflict(async () => {
+    const { health, sha } = await getHealthFile(octokit, params);
+    await octokit.rest.repos.createOrUpdateFileContents({
+      owner,
+      repo,
+      path: healthPath(projectName),
+      message,
+      content: Buffer.from(JSON.stringify(update(health), null, 2), "utf-8").toString("base64"),
+      branch,
+      sha
+    });
+  });
+}
+async function recordSuccess(octokit, params, source, now = /* @__PURE__ */ new Date()) {
+  await writeHealth(octokit, params, (h) => applySuccess(h, source, now), `Record ${source} success: ${params.projectName}`);
+}
+async function recordFailure(octokit, params, source, error, runUrl, now = /* @__PURE__ */ new Date()) {
+  await writeHealth(octokit, params, (h) => applyFailure(h, source, error, runUrl, now), `Record ${source} failure: ${params.projectName}`);
+}
+function currentRunUrl(env) {
+  const { GITHUB_SERVER_URL, GITHUB_REPOSITORY, GITHUB_RUN_ID } = env;
+  if (!GITHUB_SERVER_URL || !GITHUB_REPOSITORY || !GITHUB_RUN_ID) {
+    return null;
+  }
+  return `${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}`;
+}
+
+// ../../modules/core/dist/ciEntrypoint.js
+var VAULT_BRANCH = "main";
+function healthParams(env) {
+  const projectName = env.PROJECT_NAME;
+  const vaultRepo = env.VAULT_REPO;
+  const token = env.DEVKEEP_GITHUB_TOKEN;
+  if (!projectName || !vaultRepo || !token) {
+    return null;
+  }
+  const [owner, repo] = vaultRepo.split("/");
+  if (!owner || !repo) {
+    return null;
+  }
+  return { owner, repo, projectName, branch: VAULT_BRANCH };
+}
+var defaultDeps = {
+  env: process.env,
+  createGithubClient,
+  recordSuccess,
+  recordFailure,
+  logError: console.error,
+  exit: (code) => process.exit(code)
+};
+async function runCiEntrypoint(source, main2, deps = defaultDeps) {
+  const params = healthParams(deps.env);
+  const octokit = params ? deps.createGithubClient(deps.env.DEVKEEP_GITHUB_TOKEN) : null;
+  try {
+    await main2();
+  } catch (error) {
+    deps.logError(error);
+    if (params && octokit) {
+      try {
+        await deps.recordFailure(octokit, params, source, error, currentRunUrl(deps.env));
+      } catch (recordingError) {
+        deps.logError(`Could not record the failure to the vault: ${String(recordingError)}`);
+      }
+    }
+    deps.exit(1);
+    return;
+  }
+  if (params && octokit) {
+    try {
+      await deps.recordSuccess(octokit, params, source);
+    } catch (recordingError) {
+      deps.logError(`Ran successfully, but could not record it to the vault: ${String(recordingError)}`);
+    }
+  }
+}
+
 // ../../modules/devlore/dist/decisionEntries.js
 function decisionEntriesDir(projectName) {
   return `projects/${projectName}/decisions`;
@@ -168,8 +319,8 @@ function buildOnboardingGuidePrompt(input) {
     "",
     input.currentState ? `--- Current state ---
 ${input.currentState}` : "",
-    input.masterDocs ? `--- Master docs ---
-${input.masterDocs}` : "",
+    input.canonicalDocs ? `--- Canonical docs ---
+${input.canonicalDocs}` : "",
     input.decisions.length > 0 ? `--- Decisions ---
 ${input.decisions.join("\n\n")}` : "",
     "",
@@ -186,29 +337,6 @@ ${input.decisions.join("\n\n")}` : "",
   ].filter((line) => line !== "").join("\n");
 }
 
-// ../../modules/devlore/dist/redact.js
-var REDACTED = "[REDACTED]";
-var KNOWN_SECRET_PATTERNS = [
-  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
-  /gh[pousr]_[A-Za-z0-9]{36,}/g,
-  /github_pat_[A-Za-z0-9_]{20,}/g,
-  /sk-ant-[A-Za-z0-9_-]{20,}/g,
-  /sk-[A-Za-z0-9]{20,}/g,
-  /AKIA[0-9A-Z]{16}/g,
-  /xox[baprs]-[A-Za-z0-9-]{10,}/g,
-  /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g
-];
-var SECRET_KEYWORD = "(?:API[_-]?KEY|SECRET|TOKEN|PASSWORD|PASSWD|PRIVATE[_-]?KEY|CREDENTIAL)";
-var ASSIGNMENT_PATTERN = new RegExp(`((?:[A-Za-z0-9]+[_-])*${SECRET_KEYWORD}(?:[_-][A-Za-z0-9]+)*\\s*[:=]\\s*)(["']?)([^"'\`\\s]+)\\2`, "gi");
-function redactText(text) {
-  let result = text;
-  for (const pattern of KNOWN_SECRET_PATTERNS) {
-    result = result.replace(pattern, REDACTED);
-  }
-  result = result.replace(ASSIGNMENT_PATTERN, (_match, prefix, quote) => `${prefix}${quote}${REDACTED}${quote}`);
-  return result;
-}
-
 // ../../modules/devlore/dist/ciUsage.js
 var EMPTY_PROJECT_USAGE = {
   draftLogEntry: ZERO_USAGE,
@@ -272,19 +400,19 @@ function isNotFound2(error) {
   return typeof error === "object" && error !== null && "status" in error && error.status === 404;
 }
 
-// ../../modules/devlore/dist/masterDocs.js
-function masterDocsPath(projectName) {
-  return `projects/${projectName}/master/README.md`;
+// ../../modules/devlore/dist/canonicalDocs.js
+function canonicalDocsPath(projectName) {
+  return `projects/${projectName}/canonical/README.md`;
 }
-async function getMasterDocs(octokit, params) {
-  return (await getMasterDocsFile(octokit, params)).content;
+async function getCanonicalDocs(octokit, params) {
+  return (await getCanonicalDocsFile(octokit, params)).content;
 }
-async function getMasterDocsFile(octokit, { owner, repo, projectName }) {
+async function getCanonicalDocsFile(octokit, { owner, repo, projectName }) {
   try {
     const { data } = await octokit.rest.repos.getContent({
       owner,
       repo,
-      path: masterDocsPath(projectName)
+      path: canonicalDocsPath(projectName)
     });
     if (Array.isArray(data) || data.type !== "file") {
       return { content: "" };
@@ -358,21 +486,21 @@ function isNotFound4(error) {
 var MODEL_TIER = "balanced";
 var MAX_TOKENS = 2e4;
 var MAX_CONTINUATIONS = 8;
-var VAULT_BRANCH = "main";
+var VAULT_BRANCH2 = "main";
 async function readVaultFile(octokit, owner, repo, path) {
   const { data } = await octokit.rest.repos.getContent({ owner, repo, path }).catch(() => ({ data: null }));
   return data && !Array.isArray(data) && data.type === "file" ? Buffer.from(data.content, "base64").toString("utf-8") : "";
 }
 async function syncOnboarding({ projectOctokit, vaultOctokit, claude, projectOwner, projectRepoName, vaultOwner, vaultRepoName, projectName }) {
-  const [currentState, masterDocs, entries] = await Promise.all([
+  const [currentState, canonicalDocs, entries] = await Promise.all([
     readVaultFile(vaultOctokit, vaultOwner, vaultRepoName, currentStatePath(projectName)),
-    getMasterDocs(vaultOctokit, { owner: vaultOwner, repo: vaultRepoName, projectName }).catch(() => ""),
+    getCanonicalDocs(vaultOctokit, { owner: vaultOwner, repo: vaultRepoName, projectName }).catch(() => ""),
     listDecisionEntries(vaultOctokit, { owner: vaultOwner, repo: vaultRepoName, projectName }).catch(() => [])
   ]);
   const prompt = buildOnboardingGuidePrompt({
     projectName,
     currentState: redactText(currentState),
-    masterDocs: redactText(masterDocs),
+    canonicalDocs: redactText(canonicalDocs),
     decisions: entries.map((entry) => redactText(entry.content))
   });
   const { text, usage } = await createCompleteMessage(claude, { model: defaultModelFor(MODEL_TIER), max_tokens: MAX_TOKENS, messages: [{ role: "user", content: prompt }] }, { maxContinuations: MAX_CONTINUATIONS });
@@ -403,12 +531,12 @@ ${text.trim()}
       path: vaultPath,
       message: `Mirror onboarding guide: ${projectName}`,
       content: Buffer.from(mirrored, "utf-8").toString("base64"),
-      branch: VAULT_BRANCH,
+      branch: VAULT_BRANCH2,
       sha: existingVault.sha
     });
   }
   if (usage.inputTokens > 0 || usage.outputTokens > 0) {
-    await recordUsage(vaultOctokit, { owner: vaultOwner, repo: vaultRepoName, projectName, branch: VAULT_BRANCH }, "syncOnboarding", usage);
+    await recordUsage(vaultOctokit, { owner: vaultOwner, repo: vaultRepoName, projectName, branch: VAULT_BRANCH2 }, "syncOnboarding", usage);
   }
   return { path: ONBOARDING_PATH, vaultPath, content, usage };
 }
@@ -421,14 +549,14 @@ function requireEnv(env, name) {
   }
   return value;
 }
-var defaultDeps = {
+var defaultDeps2 = {
   env: process.env,
   syncOnboarding,
   createGithubClient,
   createClaudeClient,
   log: console.log
 };
-async function main(deps = defaultDeps) {
+async function main(deps = defaultDeps2) {
   const { env } = deps;
   const projectName = requireEnv(env, "PROJECT_NAME");
   const [projectOwner, projectRepoName] = requireEnv(env, "PROJECT_REPO").split("/");
@@ -448,10 +576,7 @@ async function main(deps = defaultDeps) {
   deps.log(`Synced onboarding guide: ${result.path} (mirrored to ${result.vaultPath})`);
 }
 if (import.meta.url === `file://${process.argv[1]}`) {
-  main().catch((error) => {
-    console.error(error);
-    process.exit(1);
-  });
+  void runCiEntrypoint("syncOnboarding", main);
 }
 export {
   main,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starterculture/devkeep-actions",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Devkeep's GitHub Actions entrypoints, bundled for CI runners.",
   "license": "UNLICENSED",
   "type": "module",