@treeseed/sdk 0.6.36 → 0.6.38

package/dist/workflow/operations.js

@@ -57,7 +57,6 @@ import {
   headCommit,
   listTaskBranches,
   mergeBranchIntoTarget,
-  mergeStagingIntoMain,
   prepareReleaseBranches,
   PRODUCTION_BRANCH,
   pushBranch,
@@ -68,7 +67,7 @@ import {
   squashMergeBranchIntoStaging,
   syncBranchWithOrigin
 } from "../operations/services/git-workflow.js";
-import { getGitHubAutomationMode, resolveGitHubRepositorySlug } from "../operations/services/github-automation.js";
+import { resolveGitHubRepositorySlug } from "../operations/services/github-automation.js";
 import {
   formatGitHubActionsGateFailure,
   inspectGitHubActionsVerification,
@@ -78,6 +77,11 @@ import {
 import {
   runReleaseCandidateGate
 } from "../operations/services/release-candidate.js";
+import {
+  collectReleaseHistoryCommits,
+  renderAdministrativeCommitMessage,
+  upsertReleaseChangelog
+} from "../operations/services/release-history.js";
 import { loadCliDeployConfig, packageScriptPath, resolveWranglerBin } from "../operations/services/runtime-tools.js";
 import { runTenantDeployPreflight, runWorkspaceReleasePreflight, runWorkspaceSavePreflight } from "../operations/services/save-deploy-preflight.js";
 import { collectCliPreflight } from "../operations/services/workspace-preflight.js";
@@ -338,9 +342,6 @@ function shouldDispatchSwitchToManagedWorktree(root, input, env) {
   return !isManagedWorkflowWorktree(root) && effectiveWorkflowWorktreeMode(input.worktreeMode, env) === "on";
 }
 function assertHostedGitHubWorkflowAuthReady(operation, root) {
-  if (getGitHubAutomationMode() === "stub") {
-    return null;
-  }
   const tools = collectTreeseedToolStatus({
     tenantRoot: root,
     env: process.env
@@ -372,7 +373,7 @@ function assertHostedGitHubWorkflowAuthReady(operation, root) {
 }
 async function waitForWorkflowGates(operation, gates, ciMode, options = {}) {
   if (ciMode === "off" || process.env.TREESEED_STAGE_WAIT_MODE === "skip") {
-    return gates.map((gate) => skippedGitHubActionsGate(gate, ciMode === "off" ? "disabled" : "stubbed"));
+    return gates.map((gate) => skippedGitHubActionsGate(gate, "disabled"));
   }
   if (gates.length === 0) {
     return [];
@@ -405,7 +406,9 @@ async function waitForWorkflowGates(operation, gates, ciMode, options = {}) {
       ...result,
       workflow: String(result.workflow ?? gate.workflow),
       branch: String(result.branch ?? gate.branch),
-      headSha: String(result.headSha ?? gate.headSha)
+      headSha: String(result.headSha ?? gate.headSha),
+      timeoutSeconds: gate.timeoutSeconds ?? null,
+      cached: false
     };
     if (normalized.status === "completed" && normalized.conclusion !== "success") {
       workflowError(operation, "github_workflow_failed", formatGitHubActionsGateFailure(gate, normalized), {
@@ -419,13 +422,21 @@ async function waitForWorkflowGates(operation, gates, ciMode, options = {}) {
   }
   return results;
 }
+const RELEASE_DEPLOY_GATE_TIMEOUT_SECONDS = 45 * 60;
+function releaseDeployGate(gate) {
+  return {
+    ...gate,
+    timeoutSeconds: gate.timeoutSeconds ?? RELEASE_DEPLOY_GATE_TIMEOUT_SECONDS
+  };
+}
 function recordHostedDeploymentStatesFromRootGates(root, rootRelease, workflowGates) {
   const gates = Array.isArray(workflowGates) ? workflowGates.map((gate) => stringRecord(gate)).filter((gate) => Boolean(gate)) : [];
   const releaseRecord = stringRecord(rootRelease) ?? {};
   const reports = [];
+  const releaseTag = typeof releaseRecord.rootVersion === "string" ? releaseRecord.rootVersion : null;
   for (const target of [
     { scope: "staging", branch: STAGING_BRANCH, commit: releaseRecord.stagingCommit },
-    { scope: "prod", branch: PRODUCTION_BRANCH, commit: releaseRecord.releasedCommit }
+    { scope: "prod", branch: releaseTag ?? PRODUCTION_BRANCH, commit: releaseRecord.releasedCommit }
   ]) {
     const gate = gates.find((candidate) => candidate.workflow === "deploy.yml" && candidate.branch === target.branch && candidate.status === "completed" && candidate.conclusion === "success");
     const timestamp = typeof gate?.updatedAt === "string" && gate.updatedAt.trim() ? gate.updatedAt : null;
@@ -452,10 +463,10 @@ function recordHostedDeploymentStatesFromRootGates(root, rootRelease, workflowGa
   return reports;
 }
 function ensureTreeseedCommandReadiness(root) {
-  if (getGitHubAutomationMode() === "stub") {
+  if (process.env.TREESEED_COMMAND_READINESS_MODE === "skip") {
     return {
       status: "skipped",
-      reason: "stubbed",
+      reason: "disabled",
       checks: [],
       missing: []
     };
@@ -705,13 +716,13 @@ function remoteTagCommit(repoDir, tagName) {
   const direct = output.split("\n").find((line) => line.endsWith(`refs/tags/${tagName}`));
   return (peeled ?? direct)?.split(/\s+/u)[0] ?? null;
 }
-function ensureReleaseTag(repoDir, tagName, commitSha) {
+function ensureReleaseTag(repoDir, tagName, commitSha, message) {
   const localCommit = gitObjectCommit(repoDir, tagName);
   if (localCommit && localCommit !== commitSha) {
     throw new Error(`Release tag ${tagName} already exists locally at ${localCommit}, expected ${commitSha}.`);
   }
   if (!localCommit) {
-    run("git", ["tag", "-a", tagName, commitSha, "-m", `release: ${tagName}`], { cwd: repoDir });
+    run("git", ["tag", "-a", tagName, commitSha, "-m", message ?? `release: ${tagName}`], { cwd: repoDir });
   }
   const remoteCommit = remoteTagCommit(repoDir, tagName);
   if (remoteCommit && remoteCommit !== commitSha) {
@@ -734,6 +745,51 @@ function commitAllIfChanged(repoDir, message) {
   run("git", ["commit", "-m", message], { cwd: repoDir });
   return { committed: true, commitSha: headCommit(repoDir) };
 }
+function releaseHistoryCommits(repoDir, sourceRef = `origin/${PRODUCTION_BRANCH}`, targetRef = "HEAD") {
+  try {
+    return collectReleaseHistoryCommits(repoDir, sourceRef, targetRef);
+  } catch {
+    return [];
+  }
+}
+function versionLines(versions) {
+  return [...(versions ?? /* @__PURE__ */ new Map()).entries()].sort(([left], [right]) => left.localeCompare(right)).map(([name, version]) => `${name}: ${version}`);
+}
+function updateReleaseChangelog(repoDir, input) {
+  const sourceRef = input.sourceRef ?? `origin/${PRODUCTION_BRANCH}`;
+  const targetRef = input.targetRef ?? "HEAD";
+  const commits = input.commits ?? releaseHistoryCommits(repoDir, sourceRef, targetRef);
+  return upsertReleaseChangelog(repoDir, {
+    version: input.version,
+    sourceRef,
+    targetRef,
+    commits,
+    extraBullets: input.extraDependencyBullets?.length ? { Dependencies: input.extraDependencyBullets } : void 0
+  });
+}
+function releaseAdminMessage(input) {
+  return renderAdministrativeCommitMessage({
+    subject: input.subject,
+    version: input.version,
+    tagName: input.tagName,
+    sourceRef: input.sourceRef ?? STAGING_BRANCH,
+    targetRef: input.targetRef ?? PRODUCTION_BRANCH,
+    commits: input.commits ?? [],
+    changelog: input.changelog ?? null,
+    extraLines: input.extraLines
+  });
+}
+function completedJournalStepData(root, runId, stepId) {
+  const journal = readWorkflowRunJournal(root, runId);
+  return stringRecord(journal?.steps.find((step) => step.id === stepId && step.status === "completed")?.data);
+}
+function shouldResumeReleaseAtRootGates(root, runId) {
+  const journal = readWorkflowRunJournal(root, runId);
+  if (!journal || journal.command !== "release") return false;
+  const rootStep = journal.steps.find((step) => step.id === "release-root");
+  const gateStep = journal.steps.find((step) => step.id === "release-root-gates");
+  return rootStep?.status === "completed" && gateStep?.status !== "completed";
+}
 function createNextSteps(steps) {
   return steps.map(renderWorkflowStep);
 }
@@ -1368,9 +1424,6 @@ function failWorkflowRun(root, runId, error, recovery) {
   releaseWorkflowLock(root, runId);
 }
 function validatePackageReleaseWorkflows(root, packageNames) {
-  if (process.env.TREESEED_GITHUB_AUTOMATION_MODE === "stub") {
-    return;
-  }
   const missing = checkedOutWorkspacePackageRepos(root).filter((pkg) => packageNames.includes(pkg.name)).filter((pkg) => !existsSync(resolve(pkg.dir, ".github", "workflows", "publish.yml"))).map((pkg) => pkg.name);
   if (missing.length > 0) {
     workflowError("release", "workflow_contract_missing", `Treeseed release requires .github/workflows/publish.yml in: ${missing.join(", ")}.`, {
@@ -1381,7 +1434,7 @@ function validatePackageReleaseWorkflows(root, packageNames) {
   }
 }
 function validateStagingWorkflowContracts(root) {
-  if (process.env.TREESEED_GITHUB_AUTOMATION_MODE === "stub" || process.env.TREESEED_STAGE_WAIT_MODE === "skip") {
+  if (process.env.TREESEED_STAGE_WAIT_MODE === "skip") {
     return;
   }
   const missing = [];
@@ -1397,14 +1450,31 @@ function validateStagingWorkflowContracts(root) {
   }
 }
 function shouldSkipReleaseInstall() {
-  return process.env.TREESEED_GITHUB_AUTOMATION_MODE === "stub" || process.env.TREESEED_SAVE_NPM_INSTALL_MODE === "skip";
+  return process.env.TREESEED_SAVE_NPM_INSTALL_MODE === "skip";
 }
 function runReleaseNpmInstall(repoDir, options = {}) {
   if (shouldSkipReleaseInstall()) {
-    return { status: "skipped", reason: "stubbed" };
+    return { status: "skipped", reason: "disabled" };
+  }
+  const args = repoDir === options.workspaceRoot ? ["install", "--package-lock-only", "--ignore-scripts", "--no-audit", "--no-fund"] : ["install", "--package-lock-only", "--ignore-scripts", "--workspaces=false", "--no-audit", "--no-fund"];
+  const result = spawnSync("npm", args, {
+    cwd: repoDir,
+    env: {
+      ...process.env,
+      npm_config_audit: "false",
+      npm_config_fund: "false"
+    },
+    stdio: "pipe",
+    encoding: "utf8"
+  });
+  if (result.status !== 0) {
+    const detail = [
+      result.error?.message,
+      result.stderr?.trim(),
+      result.stdout?.trim()
+    ].filter(Boolean).join("\n");
+    throw new Error(detail || `npm ${args.join(" ")} failed`);
   }
-  const args = repoDir === options.workspaceRoot ? ["install", "--package-lock-only", "--ignore-scripts"] : ["install", "--package-lock-only", "--ignore-scripts", "--workspaces=false"];
-  run("npm", args, { cwd: repoDir });
   return { status: "completed", reason: null };
 }
 function pathIsWithin(parent, candidate) {
@@ -1422,7 +1492,7 @@ function assertNoInternalDevReferencesForRepo(root, repoDir, packageNames) {
   throw new Error(`Stable release still contains internal Git/dev dependency references.
 ${rendered}`);
 }
-function backMergeProductionIntoStaging(repoDir, repoName) {
+function backMergeProductionIntoStaging(repoDir, repoName, message) {
   syncBranchWithOrigin(repoDir, PRODUCTION_BRANCH);
   syncBranchWithOrigin(repoDir, STAGING_BRANCH);
   checkoutBranch(repoDir, STAGING_BRANCH);
@@ -1439,7 +1509,7 @@ function backMergeProductionIntoStaging(repoDir, repoName) {
   } catch {
   }
   try {
-    run("git", ["merge", "--no-ff", `origin/${PRODUCTION_BRANCH}`, "-m", `release: back-merge ${PRODUCTION_BRANCH} into ${STAGING_BRANCH}`], { cwd: repoDir });
+    run("git", ["merge", "--no-ff", `origin/${PRODUCTION_BRANCH}`, "-m", message ?? `release: back-merge ${PRODUCTION_BRANCH} into ${STAGING_BRANCH}`], { cwd: repoDir });
   } catch (error) {
     const report = collectMergeConflictReport(repoDir);
     throw new TreeseedWorkflowError("release", "merge_conflict", formatMergeConflictReport(report, repoDir, STAGING_BRANCH), {
@@ -1457,14 +1527,32 @@ function backMergeProductionIntoStaging(repoDir, repoName) {
     commitSha: headCommit(repoDir)
   };
 }
-function backMergeRootProductionIntoStaging(root, syncPackageStagingHeads) {
+function backMergeRootProductionIntoStaging(root, syncPackageStagingHeads, options = {}) {
   const gitRoot = repoRoot(root);
-  const backMerge = backMergeProductionIntoStaging(gitRoot, "@treeseed/market");
+  const commits = releaseHistoryCommits(gitRoot, STAGING_BRANCH, `origin/${PRODUCTION_BRANCH}`);
+  const backMerge = backMergeProductionIntoStaging(gitRoot, "@treeseed/market", releaseAdminMessage({
+    subject: `release: back-merge ${PRODUCTION_BRANCH} into ${STAGING_BRANCH}`,
+    version: options.version,
+    sourceRef: PRODUCTION_BRANCH,
+    targetRef: STAGING_BRANCH,
+    commits,
+    changelog: options.changelog ?? null,
+    extraLines: versionLines(options.selectedVersions).map((line) => `Released package ${line}`)
+  }));
   if (!syncPackageStagingHeads) {
     return backMerge;
   }
   syncAllCheckedOutPackageRepos(root, STAGING_BRANCH);
-  const pointerSync = commitAllIfChanged(gitRoot, "release: sync package staging heads");
+  const pointerCommits = releaseHistoryCommits(gitRoot, `origin/${STAGING_BRANCH}`, "HEAD");
+  const pointerSync = commitAllIfChanged(gitRoot, releaseAdminMessage({
+    subject: "release: sync package staging heads",
+    version: options.version,
+    sourceRef: "package staging heads",
+    targetRef: STAGING_BRANCH,
+    commits: pointerCommits,
+    changelog: options.changelog ?? null,
+    extraLines: versionLines(options.selectedVersions).map((line) => `Staging package ${line}`)
+  }));
   if (pointerSync.committed) {
     pushBranch(gitRoot, STAGING_BRANCH);
   }
@@ -1590,8 +1678,8 @@ function collectReleasePlanBlockers(session, mode, selectedPackageNames) {
   }
   return blockers;
 }
-function assertReleaseGitHubAutomationReady(root, selectedPackageNames) {
-  if (process.env.TREESEED_GITHUB_AUTOMATION_MODE === "stub") {
+function assertReleaseGitHubAutomationReady(root, selectedPackageNames, ciMode) {
+  if (ciMode === "off") {
     return;
   }
   assertHostedGitHubWorkflowAuthReady("release", root);
@@ -3494,7 +3582,10 @@ async function workflowRelease(helpers, input) {
       const freshPreparation = freshRelease && executionMode === "execute" ? prepareFreshReleaseRun(root, session.branchName, rootRepo, packageReports) : { archived: [], blockers: [] };
       const autoResumeRun = executionMode === "execute" && !explicitResumeRunId && !freshRelease ? findAutoResumableReleaseRun(root, session.branchName, rootRepo, packageReports) : null;
       const planAutoResumeRun = executionMode === "plan" && input.fresh !== true ? findAutoResumableReleaseRun(root, session.branchName, rootRepo, packageReports) : null;
-      const effectiveInput = autoResumeRun ? autoResumeRun.input : input;
+      const effectiveInput = autoResumeRun ? {
+        ...autoResumeRun.input,
+        ciMode: input.ciMode ?? autoResumeRun.input.ciMode
+      } : input;
       const level = effectiveInput.bump ?? "patch";
       const ciMode = normalizeCiMode(effectiveInput.ciMode, "release");
       const isResume = Boolean(explicitResumeRunId || autoResumeRun);
@@ -3576,6 +3667,10 @@ async function workflowRelease(helpers, input) {
       if (autoResumeRun) {
         helpers.write(`[workflow][resume] Resuming interrupted release ${autoResumeRun.runId} on ${STAGING_BRANCH}.`);
       }
+      const resumeAtRootGates = workflowRun.resumed && shouldResumeReleaseAtRootGates(root, workflowRun.runId);
+      if (resumeAtRootGates) {
+        helpers.write(`[workflow][resume] Resuming release ${workflowRun.runId} directly at production deploy gates.`);
+      }
       let releaseCleanupSnapshot = null;
       try {
         const releasePlan = await executeJournalStep(root, workflowRun.runId, "release-plan", () => plannedRelease);
@@ -3584,31 +3679,68 @@ async function workflowRelease(helpers, input) {
         const effectiveVersions = releasePlanVersionMap(releasePlan.plannedVersions);
         const rootVersion = String(releasePlan.rootVersion);
         applyTreeseedEnvironmentToProcess({ tenantRoot: root, scope: "staging", override: true });
-        assertReleaseGitHubAutomationReady(root, effectiveSelectedPackageNames);
-        const releaseCandidate = await executeJournalStep(root, workflowRun.runId, "release-candidate", () => runReleaseCandidateForPlan("release", root, releasePlan, { allowReuse: true }));
-        if (!isResume) {
+        assertReleaseGitHubAutomationReady(root, effectiveSelectedPackageNames, ciMode);
+        const releaseCandidate = resumeAtRootGates ? completedJournalStepData(root, workflowRun.runId, "release-candidate") : await executeJournalStep(root, workflowRun.runId, "release-candidate", () => runReleaseCandidateForPlan("release", root, releasePlan, { allowReuse: true }));
+        if (!resumeAtRootGates && !isResume) {
           assertSessionBranchSafety("release", session, { requireCleanPackages: true, requireCurrentBranch: true });
           assertCleanWorktree(root);
         }
-        prepareReleaseBranches(root);
-        ensureWorkflowWorkspaceLinks(root, helpers, effectiveInput.workspaceLinks ?? "auto");
-        runWorkspaceReleasePreflight({ cwd: root });
-        await executeJournalStep(root, workflowRun.runId, "workspace-unlink", () => unlinkWorkflowWorkspaceLinks(root, helpers, effectiveInput.workspaceLinks ?? "auto"), { rerunCompleted: true });
+        if (!resumeAtRootGates) {
+          prepareReleaseBranches(root);
+          ensureWorkflowWorkspaceLinks(root, helpers, effectiveInput.workspaceLinks ?? "auto");
+          runWorkspaceReleasePreflight({ cwd: root });
+          await executeJournalStep(root, workflowRun.runId, "workspace-unlink", () => unlinkWorkflowWorkspaceLinks(root, helpers, effectiveInput.workspaceLinks ?? "auto"), { rerunCompleted: true });
+        }
         if (mode === "root-only") {
           const rootRelease2 = await executeJournalStep(root, workflowRun.runId, "release-root", () => {
             setRootPackageJsonVersion(root, rootVersion);
             run("git", ["checkout", STAGING_BRANCH], { cwd: gitRoot });
-            commitAllIfChanged(gitRoot, `release: ${level} bump`);
+            const rootCommitsBeforeChangelog = releaseHistoryCommits(gitRoot);
+            const changelog = updateReleaseChangelog(gitRoot, {
+              version: rootVersion,
+              commits: rootCommitsBeforeChangelog,
+              extraDependencyBullets: [`Release @treeseed/market ${rootVersion}.`]
+            });
+            commitAllIfChanged(gitRoot, releaseAdminMessage({
+              subject: `release: ${level} bump`,
+              version: rootVersion,
+              tagName: rootVersion,
+              commits: rootCommitsBeforeChangelog,
+              changelog
+            }));
             pushBranch(gitRoot, STAGING_BRANCH);
             const stagingCommit = headCommit(gitRoot);
-            const released = mergeStagingIntoMain(root);
-            const tag = ensureReleaseTag(gitRoot, rootVersion, released.commitSha);
+            const rootCommits = releaseHistoryCommits(gitRoot);
+            const released = mergeBranchIntoTarget(root, {
+              sourceBranch: STAGING_BRANCH,
+              targetBranch: PRODUCTION_BRANCH,
+              message: releaseAdminMessage({
+                subject: `release: ${STAGING_BRANCH} -> ${PRODUCTION_BRANCH}`,
+                version: rootVersion,
+                tagName: rootVersion,
+                commits: rootCommits,
+                changelog
+              }),
+              pushTarget: true
+            });
+            const tag = ensureReleaseTag(gitRoot, rootVersion, released.commitSha, releaseAdminMessage({
+              subject: `release: ${rootVersion}`,
+              version: rootVersion,
+              tagName: rootVersion,
+              commits: rootCommits,
+              changelog
+            }));
             syncBranchWithOrigin(gitRoot, STAGING_BRANCH);
             return {
               rootVersion,
               stagingCommit,
               releasedCommit: released.commitSha,
-              tag
+              tag,
+              changelog,
+              adminCommitSummary: {
+                commitCount: rootCommits.length,
+                notableCommits: rootCommits.slice(0, 12)
+              }
             };
           });
           rootRepo.committed = true;
@@ -3618,48 +3750,23 @@ async function workflowRelease(helpers, input) {
           rootRepo.commitSha = String(rootRelease2?.releasedCommit ?? headCommit(gitRoot));
           rootRepo.tagName = String(rootRelease2?.rootVersion ?? "");
           const rootWorkflowGateResult2 = await executeJournalStep(root, workflowRun.runId, "release-root-gates", () => waitForWorkflowGates("release", [
-            {
-              name: rootRepo.name,
-              repoPath: rootRepo.path,
-              workflow: "verify.yml",
-              branch: STAGING_BRANCH,
-              headSha: String(rootRelease2?.stagingCommit ?? "")
-            },
-            {
+            releaseDeployGate({
               name: rootRepo.name,
               repoPath: rootRepo.path,
               workflow: "deploy.yml",
-              branch: STAGING_BRANCH,
-              headSha: String(rootRelease2?.stagingCommit ?? "")
-            },
-            {
-              name: rootRepo.name,
-              repoPath: rootRepo.path,
-              workflow: "verify.yml",
               branch: rootVersion,
               headSha: String(rootRelease2?.releasedCommit ?? rootRepo.commitSha ?? "")
-            },
-            {
-              name: rootRepo.name,
-              repoPath: rootRepo.path,
-              workflow: "verify.yml",
-              branch: PRODUCTION_BRANCH,
-              headSha: String(rootRelease2?.releasedCommit ?? rootRepo.commitSha ?? "")
-            },
-            {
-              name: rootRepo.name,
-              repoPath: rootRepo.path,
-              workflow: "deploy.yml",
-              branch: PRODUCTION_BRANCH,
-              headSha: String(rootRelease2?.releasedCommit ?? rootRepo.commitSha ?? "")
-            }
+            })
           ].filter((gate) => gate.headSha), ciMode, {
             root,
             runId: workflowRun.runId,
             onProgress: (line, stream) => helpers.write(line, stream)
           }).then((workflowGates) => ({ workflowGates })));
           const hostedDeploymentState2 = recordHostedDeploymentStatesFromRootGates(root, rootRelease2, rootWorkflowGateResult2?.workflowGates);
-          const releaseBackMerge2 = await executeJournalStep(root, workflowRun.runId, "release-back-merge", () => backMergeRootProductionIntoStaging(root, false));
+          const releaseBackMerge2 = await executeJournalStep(root, workflowRun.runId, "release-back-merge", () => backMergeRootProductionIntoStaging(root, false, {
+            version: rootVersion,
+            changelog: rootRelease2?.changelog ?? null
+          }));
           const workspaceLinks2 = ensureWorkflowWorkspaceLinks(root, helpers, effectiveInput.workspaceLinks ?? "auto");
           const payload2 = {
             mode,
@@ -3698,13 +3805,15 @@ async function workflowRelease(helpers, input) {
             ])
           });
         }
-        validatePackageReleaseWorkflows(root, effectivePackageSelection.selected);
-        for (const pkg of checkedOutWorkspacePackageRepos(root)) {
-          if (effectiveSelectedPackageNames.has(pkg.name)) {
-            prepareReleaseBranches(pkg.dir);
+        if (!resumeAtRootGates) {
+          validatePackageReleaseWorkflows(root, effectivePackageSelection.selected);
+          for (const pkg of checkedOutWorkspacePackageRepos(root)) {
+            if (effectiveSelectedPackageNames.has(pkg.name)) {
+              prepareReleaseBranches(pkg.dir);
+            }
           }
         }
-        releaseCleanupSnapshot = collectReleaseCleanupSnapshot(root, effectiveSelectedPackageNames);
+        releaseCleanupSnapshot = resumeAtRootGates ? null : collectReleaseCleanupSnapshot(root, effectiveSelectedPackageNames);
         const metadata = await executeJournalStep(root, workflowRun.runId, "prepare-release-metadata", () => {
           const releasedPackageDevTags2 = Object.fromEntries(
             checkedOutWorkspacePackageRepos(root).filter((pkg) => effectiveSelectedPackageNames.has(pkg.name)).map((pkg) => {
@@ -3724,7 +3833,7 @@ async function workflowRelease(helpers, input) {
             replacedDevReferences: replacedDevReferences2,
             releaseInstalls: releaseInstalls2
           };
-        }, { rerunCompleted: workflowRun.resumed });
+        }, { rerunCompleted: workflowRun.resumed && !resumeAtRootGates });
         const replacedDevReferences = Array.isArray(metadata?.replacedDevReferences) ? metadata.replacedDevReferences : [];
         const releaseInstalls = Array.isArray(metadata?.releaseInstalls) ? metadata.releaseInstalls : [];
         const releasedPackageDevTags = new Map(Object.entries(metadata?.releasedPackageDevTags ?? {}).map(([name, version]) => [name, String(version)]));
@@ -3739,24 +3848,52 @@ async function workflowRelease(helpers, input) {
           }
           const releasedPackage = await executeJournalStep(root, workflowRun.runId, `release-${report.name}`, async () => {
             checkoutBranch(pkg.dir, STAGING_BRANCH);
+            const tagName = String(effectiveVersions.get(pkg.name));
             releaseInstalls.push({
               name: pkg.name,
               ...runReleaseNpmInstall(pkg.dir, { workspaceRoot: root })
             });
             assertNoInternalDevReferencesForRepo(root, pkg.dir, effectiveSelectedPackageNames);
+            const packageCommitsBeforeChangelog = releaseHistoryCommits(pkg.dir);
+            const changelog = updateReleaseChangelog(pkg.dir, {
+              version: tagName,
+              commits: packageCommitsBeforeChangelog,
+              extraDependencyBullets: [`Release ${pkg.name} ${tagName}.`]
+            });
             if (hasMeaningfulChanges(pkg.dir)) {
               run("git", ["add", "-A"], { cwd: pkg.dir });
-              run("git", ["commit", "-m", `release: ${effectiveVersions.get(pkg.name)}`], { cwd: pkg.dir });
+              run("git", ["commit", "-m", releaseAdminMessage({
+                subject: `release: ${tagName}`,
+                version: tagName,
+                tagName,
+                commits: packageCommitsBeforeChangelog,
+                changelog,
+                extraLines: [`Package: ${pkg.name}`]
+              })], { cwd: pkg.dir });
             }
             pushBranch(pkg.dir, STAGING_BRANCH);
+            const packageCommits = releaseHistoryCommits(pkg.dir);
             const mergeResult = mergeBranchIntoTarget(pkg.dir, {
               sourceBranch: STAGING_BRANCH,
               targetBranch: PRODUCTION_BRANCH,
-              message: `release: ${STAGING_BRANCH} -> ${PRODUCTION_BRANCH}`,
+              message: releaseAdminMessage({
+                subject: `release: ${STAGING_BRANCH} -> ${PRODUCTION_BRANCH}`,
+                version: tagName,
+                tagName,
+                commits: packageCommits,
+                changelog,
+                extraLines: [`Package: ${pkg.name}`]
+              }),
               pushTarget: true
             });
-            const tagName = String(effectiveVersions.get(pkg.name));
-            const tag = ensureReleaseTag(pkg.dir, tagName, mergeResult.commitSha);
+            const tag = ensureReleaseTag(pkg.dir, tagName, mergeResult.commitSha, releaseAdminMessage({
+              subject: `release: ${tagName}`,
+              version: tagName,
+              tagName,
+              commits: packageCommits,
+              changelog,
+              extraLines: [`Package: ${pkg.name}`]
+            }));
             const workflowGates = await waitForWorkflowGates("release", [
               {
                 name: pkg.name,
@@ -3764,20 +3901,6 @@ async function workflowRelease(helpers, input) {
                 workflow: "publish.yml",
                 headSha: mergeResult.commitSha,
                 branch: tagName
-              },
-              {
-                name: pkg.name,
-                repoPath: pkg.dir,
-                workflow: "verify.yml",
-                headSha: mergeResult.commitSha,
-                branch: tagName
-              },
-              {
-                name: pkg.name,
-                repoPath: pkg.dir,
-                workflow: "verify.yml",
-                headSha: mergeResult.commitSha,
-                branch: PRODUCTION_BRANCH
               }
             ], ciMode, {
               root,
@@ -3786,12 +3909,26 @@ async function workflowRelease(helpers, input) {
             });
             const publish = workflowGates.find((gate) => gate.workflow === "publish.yml") ?? workflowGates[0] ?? null;
             assertReleaseGitHubWorkflowSucceeded(pkg.name, publish);
-            const backMerge = backMergeProductionIntoStaging(pkg.dir, pkg.name);
+            const backMerge = backMergeProductionIntoStaging(pkg.dir, pkg.name, releaseAdminMessage({
+              subject: `release: back-merge ${PRODUCTION_BRANCH} into ${STAGING_BRANCH}`,
+              version: tagName,
+              tagName,
+              sourceRef: PRODUCTION_BRANCH,
+              targetRef: STAGING_BRANCH,
+              commits: packageCommits,
+              changelog,
+              extraLines: [`Package: ${pkg.name}`]
+            }));
             syncBranchWithOrigin(pkg.dir, STAGING_BRANCH);
             return {
               commitSha: mergeResult.commitSha,
               tagName,
               tag,
+              changelog,
+              adminCommitSummary: {
+                commitCount: packageCommits.length,
+                notableCommits: packageCommits.slice(0, 12)
+              },
               publish,
               workflowGates,
               backMerge
@@ -3805,6 +3942,8 @@ async function workflowRelease(helpers, input) {
           report.publishWait = releasedPackage?.publish ?? null;
           report.workflowGates = Array.isArray(releasedPackage?.workflowGates) ? releasedPackage.workflowGates : [];
           report.backMerge = releasedPackage?.backMerge ?? null;
+          report.changelog = releasedPackage?.changelog ?? null;
+          report.adminCommitSummary = releasedPackage?.adminCommitSummary ?? null;
           report.branch = STAGING_BRANCH;
           publishWait.push({
             name: report.name,
@@ -3815,16 +3954,41 @@ async function workflowRelease(helpers, input) {
         const rootRelease = await executeJournalStep(root, workflowRun.runId, "release-root", () => {
           setRootPackageJsonVersion(root, rootVersion);
           run("git", ["checkout", STAGING_BRANCH], { cwd: gitRoot });
-          commitAllIfChanged(gitRoot, `release: ${level} bump`);
+          const rootCommitsBeforeChangelog = releaseHistoryCommits(gitRoot);
+          const changelog = updateReleaseChangelog(gitRoot, {
+            version: rootVersion,
+            commits: rootCommitsBeforeChangelog,
+            extraDependencyBullets: [
+              `Release @treeseed/market ${rootVersion}.`,
+              ...versionLines(effectiveVersions).map((line) => `Release package ${line}.`)
+            ]
+          });
+          commitAllIfChanged(gitRoot, releaseAdminMessage({
+            subject: `release: ${level} bump`,
+            version: rootVersion,
+            tagName: rootVersion,
+            commits: rootCommitsBeforeChangelog,
+            changelog,
+            extraLines: versionLines(effectiveVersions).map((line) => `Package ${line}`)
+          }));
           pushBranch(gitRoot, STAGING_BRANCH);
           const stagingCommit = headCommit(gitRoot);
+          const rootCommits = releaseHistoryCommits(gitRoot);
           let released;
           let submoduleReconciliation = null;
+          const mergeMessage = releaseAdminMessage({
+            subject: `release: ${STAGING_BRANCH} -> ${PRODUCTION_BRANCH}`,
+            version: rootVersion,
+            tagName: rootVersion,
+            commits: rootCommits,
+            changelog,
+            extraLines: versionLines(effectiveVersions).map((line) => `Package ${line}`)
+          });
           try {
             released = mergeBranchIntoTarget(root, {
               sourceBranch: STAGING_BRANCH,
               targetBranch: PRODUCTION_BRANCH,
-              message: `release: ${STAGING_BRANCH} -> ${PRODUCTION_BRANCH}`,
+              message: mergeMessage,
               pushTarget: false,
               quietMerge: true
             });
@@ -3835,7 +3999,7 @@ async function workflowRelease(helpers, input) {
             }
             helpers.write(`[release][reconcile] Resolving generated package pointer reconciliation for ${reconciliation.entries.map((entry) => String(entry.path)).join(", ")}.`);
             submoduleReconciliation = reconciliation;
-            commitAllIfChanged(gitRoot, `release: ${STAGING_BRANCH} -> ${PRODUCTION_BRANCH}`);
+            commitAllIfChanged(gitRoot, mergeMessage);
             released = { commitSha: headCommit(gitRoot) };
           }
           for (const pkg of checkedOutWorkspacePackageRepos(root)) {
@@ -3843,9 +4007,26 @@ async function workflowRelease(helpers, input) {
               syncBranchWithOrigin(pkg.dir, PRODUCTION_BRANCH);
             }
           }
-          commitAllIfChanged(gitRoot, "release: sync package main heads");
+          const mainPointerCommits = releaseHistoryCommits(gitRoot, released.commitSha, "HEAD");
+          commitAllIfChanged(gitRoot, releaseAdminMessage({
+            subject: "release: sync package main heads",
+            version: rootVersion,
+            tagName: rootVersion,
+            sourceRef: "package main heads",
+            targetRef: PRODUCTION_BRANCH,
+            commits: mainPointerCommits,
+            changelog,
+            extraLines: versionLines(effectiveVersions).map((line) => `Main package ${line}`)
+          }));
           const releasedCommit = headCommit(gitRoot);
-          const tag = ensureReleaseTag(gitRoot, rootVersion, releasedCommit);
+          const tag = ensureReleaseTag(gitRoot, rootVersion, releasedCommit, releaseAdminMessage({
+            subject: `release: ${rootVersion}`,
+            version: rootVersion,
+            tagName: rootVersion,
+            commits: rootCommits,
+            changelog,
+            extraLines: versionLines(effectiveVersions).map((line) => `Package ${line}`)
+          }));
           run("git", ["push", "origin", PRODUCTION_BRANCH], { cwd: gitRoot });
           syncAllCheckedOutPackageRepos(root, STAGING_BRANCH);
           syncBranchWithOrigin(gitRoot, STAGING_BRANCH);
@@ -3855,6 +4036,11 @@ async function workflowRelease(helpers, input) {
             releasedCommit,
             mergeCommit: released.commitSha,
             tag,
+            changelog,
+            adminCommitSummary: {
+              commitCount: rootCommits.length,
+              notableCommits: rootCommits.slice(0, 12)
+            },
             submoduleReconciliation
           };
         });
@@ -3865,48 +4051,24 @@ async function workflowRelease(helpers, input) {
         rootRepo.commitSha = String(rootRelease?.releasedCommit ?? headCommit(gitRoot));
         rootRepo.tagName = String(rootRelease?.rootVersion ?? "");
         const rootWorkflowGateResult = await executeJournalStep(root, workflowRun.runId, "release-root-gates", () => waitForWorkflowGates("release", [
-          {
-            name: rootRepo.name,
-            repoPath: rootRepo.path,
-            workflow: "verify.yml",
-            branch: STAGING_BRANCH,
-            headSha: String(rootRelease?.stagingCommit ?? "")
-          },
-          {
+          releaseDeployGate({
             name: rootRepo.name,
             repoPath: rootRepo.path,
             workflow: "deploy.yml",
-            branch: STAGING_BRANCH,
-            headSha: String(rootRelease?.stagingCommit ?? "")
-          },
-          {
-            name: rootRepo.name,
-            repoPath: rootRepo.path,
-            workflow: "verify.yml",
             branch: rootVersion,
             headSha: String(rootRelease?.releasedCommit ?? rootRepo.commitSha ?? "")
-          },
-          {
-            name: rootRepo.name,
-            repoPath: rootRepo.path,
-            workflow: "verify.yml",
-            branch: PRODUCTION_BRANCH,
-            headSha: String(rootRelease?.releasedCommit ?? rootRepo.commitSha ?? "")
-          },
-          {
-            name: rootRepo.name,
-            repoPath: rootRepo.path,
-            workflow: "deploy.yml",
-            branch: PRODUCTION_BRANCH,
-            headSha: String(rootRelease?.releasedCommit ?? rootRepo.commitSha ?? "")
-          }
+          })
         ].filter((gate) => gate.headSha), ciMode, {
           root,
           runId: workflowRun.runId,
           onProgress: (line, stream) => helpers.write(line, stream)
         }).then((workflowGates) => ({ workflowGates })));
         const hostedDeploymentState = recordHostedDeploymentStatesFromRootGates(root, rootRelease, rootWorkflowGateResult?.workflowGates);
-        const releaseBackMerge = await executeJournalStep(root, workflowRun.runId, "release-back-merge", () => backMergeRootProductionIntoStaging(root, true));
+        const releaseBackMerge = await executeJournalStep(root, workflowRun.runId, "release-back-merge", () => backMergeRootProductionIntoStaging(root, true, {
+          version: rootVersion,
+          changelog: rootRelease?.changelog ?? null,
+          selectedVersions: effectiveVersions
+        }));
         const devTagCleanupMode = effectiveInput.devTagCleanup ?? "safe-after-release";
         const devTagCleanup = devTagCleanupMode === "off" ? (skipJournalStep(root, workflowRun.runId, "cleanup-dev-tags", { status: "skipped", reason: "disabled" }), { status: "skipped", reason: "disabled" }) : await executeJournalStep(root, workflowRun.runId, "cleanup-dev-tags", () => {
           const activeDevTags = collectActiveDevTagReferences(root);