@zaip-ai/cli 4.5.0 → 4.7.0

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/deploy-contract.mjs

@@ -0,0 +1,307 @@
+import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { readFile, realpath, writeFile } from "node:fs/promises";
+import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { parseArgs } from "node:util";
+
+export const POLICY_PATH = ".agents/config/deploy-policy.json";
+export const DEFAULT_POLICY = Object.freeze({
+  schema_version: 1,
+  default_mode: "auto",
+  default_scope: "current-work",
+});
+const digest = (value) => createHash("sha256").update(JSON.stringify(value)).digest("hex");
+const git = (root, args) =>
+  execFileSync("git", args, {
+    cwd: root,
+    encoding: "utf8",
+    windowsHide: true,
+    timeout: 15000,
+  }).trim();
+function assert(ok, message) {
+  if (!ok) throw new Error(message);
+}
+export function validatePolicy(policy = DEFAULT_POLICY) {
+  assert(policy && typeof policy === "object" && !Array.isArray(policy), "Invalid deploy policy");
+  assert(
+    Object.keys(policy).every((k) =>
+      ["schema_version", "default_mode", "default_scope"].includes(k),
+    ),
+    "Unsupported deploy policy field",
+  );
+  assert(
+    policy.schema_version === 1 &&
+      ["auto", "commits", "release"].includes(policy.default_mode) &&
+      policy.default_scope === "current-work",
+    "Invalid deploy policy; scope must be current-work",
+  );
+  return { ...policy };
+}
+export function repositoryKind({
+  origin,
+  rootName,
+  cliName,
+  workspaceVersion,
+  rootVersion,
+  cliVersion,
+}) {
+  const canonicalOrigin =
+    /^(?:git@github\.com:|https:\/\/github\.com\/|ssh:\/\/git@github\.com\/)zaip-ai\/zaip-aios(?:\.git)?\/?$/.test(
+      origin ?? "",
+    );
+  const canonicalRoot = rootName === "@zaip-ai/aios";
+  if (!canonicalOrigin && !canonicalRoot) return "consumer";
+  assert(
+    canonicalOrigin && canonicalRoot && cliName === "@zaip-ai/cli",
+    "Conflicting builder identity; repository and package manifests must agree",
+  );
+  assert(
+    /^\d+\.\d+\.0$/.test(rootVersion ?? "") &&
+      rootVersion === cliVersion &&
+      rootVersion === workspaceVersion,
+    "Builder manifest versions must agree",
+  );
+  return "builder";
+}
+const normalize = (value) =>
+  value
+    .normalize("NFKD")
+    .replace(/[\u0300-\u036f]/g, "")
+    .toLowerCase()
+    .replace(/\s+/g, " ")
+    .trim();
+export function requestedDeployment(request) {
+  assert(
+    typeof request === "string" && request.length > 0 && request.length <= 8192,
+    "A bounded current human request is required",
+  );
+  const text = normalize(request);
+  // Only a direct publication imperative is executable. References, questions and quoted
+  // historical instructions are not authority; unknown wording never upgrades the mode.
+  const withoutCourtesy = text.replace(/^(?:(?:ok|por favor|agora|please)[, ]+)+/, "");
+  const sequencedDirect =
+    /^primeiro passo entao e corrigir\b[^\n?]*\bfazer merge\b[^\n?]*,\s*fazer deploy\b/.test(
+      withoutCourtesy,
+    ) && !/\b(?:nao|sem)\s+fazer deploy\b/.test(withoutCourtesy);
+  const releaseDirective = /\bpreciso que crie (?:uma |a )?nova versao\s+v?\d+\.\d+\b/.test(
+    withoutCourtesy,
+  );
+  const proceedToVersion =
+    /^(?:pode\s+)?(?:seguir|continue|avancar)\s+para\s+(?:a\s+)?v\d+\.\d+\b/.test(withoutCourtesy);
+  const direct =
+    /^(?:(?:pode|podemos)\s+)?(?:(?:faca|fazer|faz|realize|execute|do)\s+)?(?:deploy|dpeloy|depoly|push|commit|publique|publicar|publish|envie|release|prepare|preparar)\b/.test(
+      withoutCourtesy,
+    ) ||
+    sequencedDirect ||
+    releaseDirective ||
+    proceedToVersion;
+  if (!direct || /\?/.test(text))
+    return { authorized: false, reason: "not-a-direct-deployment-request" };
+  const noRelease =
+    /\b(?:sem|nao)\s+(?:(?:quero|criar|fazer|publicar|publique|crie|faca)\s+)?(?:(?:um|uma|o|a|novo|nova)\s+)*(?:release|nova versao|proxima versao|versao)\b/.test(
+      text,
+    ) ||
+    /\b(?:apenas|somente|so)\s+(?:(?:os|dos|o)\s+)?(?:commits?|push)\b/.test(text) ||
+    /\bdeploy\s+dos?\s+com{1,2}its?\s+na\s+versao\s+atual\b/.test(text);
+  const releaseTarget =
+    "(?:(?:do|da|de|um|uma|o|a|novo|nova|proximo|proxima|the|new|next)\\s+)*(?:release|versao|version|v\\d+\\.\\d+)";
+  const releaseMention =
+    new RegExp(
+      `\\b(?:deploy|dpeloy|depoly|publique|publicar|publish|release|prepare|preparar)\\s+(?:com\\s+)?${releaseTarget}\\b`,
+    ).test(text) ||
+    /^release\b/.test(withoutCourtesy) ||
+    releaseDirective ||
+    proceedToVersion;
+  const nonPublication = text.replace(
+    /\bnao\s+(?:publique|publicar)\s+(?:(?:um|uma|o|a|novo|nova)\s+)*release\b/g,
+    "",
+  );
+  const preparation =
+    /^(?:(?:pode)\s+)?(?:prepare|preparar)\b/.test(withoutCourtesy) ||
+    /\b(?:apenas|somente|so)\s+prepar/.test(text) ||
+    /\b(?:sem publicar|nao publique|nao publicar)\b/.test(nonPublication);
+  const contradictory =
+    noRelease && /\be\s+(?:publique|crie|faca)\s+(?:(?:um|o|novo)\s+)*release\b/.test(text);
+  assert(!contradictory, "Conflicting publication instructions; no action is authorized");
+  const pushOnly =
+    /^(?:(?:pode|podemos)\s+)?(?:(?:faca|fazer|faz|realize|execute|do)\s+)?(?:push|commit)\b/.test(
+      withoutCourtesy,
+    );
+  const versions = [...text.matchAll(/\bv((?:0|[1-9]\d*)\.(?:0|[1-9]\d*))(?![.\d])/g)].map(
+    (x) => x[1],
+  );
+  if (releaseDirective)
+    versions.push(/\bpreciso que crie (?:uma |a )?nova versao\s+v?(\d+\.\d+)\b/.exec(text)[1]);
+  assert(new Set(versions).size <= 1, "Conflicting explicit release versions");
+  return {
+    authorized: true,
+    override: noRelease ? "commits" : releaseMention ? "release" : pushOnly ? "commits" : null,
+    version: !noRelease && releaseMention ? (versions[0] ?? null) : null,
+    phase: preparation ? "prepare" : "publish",
+    scope: /\b(?:deploy|push|publicar|publique)\s+(?:de\s+)?tudo\b/.test(text)
+      ? "all-worktree"
+      : "current-work",
+  };
+}
+export function resolveDeployment({ request, policy, identity }) {
+  const preference = validatePolicy(policy);
+  const kind = repositoryKind(identity);
+  const intent = requestedDeployment(request);
+  if (!intent.authorized)
+    return { schema_version: 1, mode: "none", phase: "none", reason: intent.reason };
+  const configuredMode =
+    preference.default_mode === "auto"
+      ? kind === "builder"
+        ? "release"
+        : "commits"
+      : preference.default_mode;
+  const mode = intent.override ?? configuredMode;
+  const authorization = {
+    schema_version: 1,
+    kind,
+    mode,
+    phase: intent.phase,
+    scope: intent.scope,
+    version: intent.version,
+    policy_sha256: digest(preference),
+    request_sha256: digest(request),
+    identity_sha256: digest(identity),
+    changes_preference: false,
+    qualification: mode === "release" ? "release-essential" : "impact",
+    npm_publication: kind === "builder" && mode === "release" && intent.phase === "publish",
+    chat_output: "brief",
+    release_notes: mode === "release" ? "reviewed-full-range" : "none",
+  };
+  return { ...authorization, contract_sha256: digest(authorization) };
+}
+export function verifyContract(plan, input, expectedMode, expectedPhase = "publish") {
+  const actual = resolveDeployment(input);
+  assert(
+    actual.mode === expectedMode && actual.phase === expectedPhase,
+    "Deployment intent does not authorize this delivery route",
+  );
+  assert(
+    JSON.stringify(plan) === JSON.stringify(actual),
+    "Deployment contract changed; resolve again before any mutation",
+  );
+  return actual;
+}
+export function nextRelease(
+  tags = [],
+  {
+    major = false,
+    publishedSha = null,
+    candidateSha = null,
+    publishedTag = null,
+    existingTag = null,
+    existingTagSha = null,
+  } = {},
+) {
+  assert(
+    Array.isArray(tags) && tags.every((x) => typeof x === "string"),
+    "Verified tag list required",
+  );
+  const valid = tags
+    .map((tag) => /^v(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?$/.exec(tag))
+    .filter(Boolean);
+  valid.sort((a, b) =>
+    BigInt(a[1]) === BigInt(b[1])
+      ? BigInt(a[2]) < BigInt(b[2])
+        ? -1
+        : BigInt(a[2]) > BigInt(b[2])
+          ? 1
+          : 0
+      : BigInt(a[1]) < BigInt(b[1])
+        ? -1
+        : 1,
+  );
+  if (publishedSha && publishedSha === candidateSha) {
+    assert(
+      /^[a-f0-9]{40}$/i.test(candidateSha ?? "") &&
+        tags.includes(publishedTag) &&
+        /^v(0|[1-9]\d*)\.(0|[1-9]\d*)$/.test(publishedTag ?? ""),
+      "Published identity must include its verified tag and SHA",
+    );
+    return { action: "verify-existing", tag: publishedTag, create_release: false };
+  }
+  if (existingTag) {
+    assert(
+      /^v(0|[1-9]\d*)\.(0|[1-9]\d*)$/.test(existingTag) &&
+        /^[a-f0-9]{40}$/i.test(candidateSha ?? "") &&
+        existingTagSha === candidateSha,
+      "Retry requires the exact existing tag and candidate SHA",
+    );
+    return { action: "resume", tag: existingTag, create_release: false };
+  }
+  const last = valid.at(-1);
+  const version = !last
+    ? "1.0"
+    : major
+      ? `${BigInt(last[1]) + 1n}.0`
+      : `${last[1]}.${BigInt(last[2]) + 1n}`;
+  return { action: "new", tag: `v${version}`, version, create_release: true };
+}
+export async function readDeploymentInput(repository, request) {
+  const root = await realpath(resolve(repository));
+  assert(
+    (await realpath(git(root, ["rev-parse", "--show-toplevel"]))) === root,
+    "Use the exact Git workspace root",
+  );
+  const readJson = async (path, fallback = null) => {
+    try {
+      return JSON.parse(await readFile(resolve(root, path), "utf8"));
+    } catch (error) {
+      if (error.code === "ENOENT") return fallback;
+      throw error;
+    }
+  };
+  const [manifest, cli, workspace, policy] = await Promise.all([
+    readJson("package.json"),
+    readJson("public-cli/packages/cli/package.json"),
+    readJson("public-cli/package.json"),
+    readJson(POLICY_PATH, DEFAULT_POLICY),
+  ]);
+  let origin = null;
+  try {
+    origin = git(root, ["remote", "get-url", "--push", "origin"]);
+  } catch {}
+  return {
+    request,
+    policy,
+    identity: {
+      origin,
+      rootName: manifest?.name ?? null,
+      cliName: cli?.name ?? null,
+      rootVersion: manifest?.version ?? null,
+      cliVersion: cli?.version ?? null,
+      workspaceVersion: workspace?.version ?? null,
+    },
+  };
+}
+async function main() {
+  const { values } = parseArgs({
+    options: {
+      repository: { type: "string", default: "." },
+      "request-file": { type: "string" },
+      "plan-file": { type: "string" },
+    },
+    strict: true,
+  });
+  assert(values["request-file"], "--request-file with the current human request is required");
+  const input = await readDeploymentInput(
+    values.repository,
+    await readFile(resolve(values["request-file"]), "utf8"),
+  );
+  const plan = resolveDeployment(input);
+  if (values["plan-file"])
+    await writeFile(resolve(values["plan-file"]), `${JSON.stringify(plan, null, 2)}\n`, {
+      flag: "wx",
+    });
+  process.stdout.write(`${JSON.stringify(plan)}\n`);
+}
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url))
+  main().catch((error) => {
+    process.stderr.write(`${error.message}\n`);
+    process.exitCode = 1;
+  });

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/deploy-contract.test.mjs

@@ -0,0 +1,337 @@
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import test from "node:test";
+import {
+  DEFAULT_POLICY,
+  nextRelease,
+  readDeploymentInput,
+  repositoryKind,
+  resolveDeployment,
+  verifyContract,
+} from "./deploy-contract.mjs";
+import { criticalTaskInRange, guardedCommits } from "./guarded-commits.mjs";
+
+const builder = {
+  origin: "git@github.com:zaip-ai/zaip-aios.git",
+  rootName: "@zaip-ai/aios",
+  cliName: "@zaip-ai/cli",
+  rootVersion: "4.5.0",
+  cliVersion: "4.5.0",
+  workspaceVersion: "4.5.0",
+};
+const consumer = { origin: "git@github.com:example/app.git", rootName: "app" };
+const input = (request, identity = consumer, policy = DEFAULT_POLICY) => ({
+  request,
+  identity,
+  policy,
+});
+
+test("fixed defaults, explicit intent and preparation: Portuguese/English decision matrix", () => {
+  const cases = [
+    ["faça deploy", null, "publish"],
+    ["pode fazer deploy", null, "publish"],
+    ["ok, agora faça deploy", null, "publish"],
+    ["faça dpeloy", null, "publish"],
+    ["faça deploy apenas dos commits", "commits", "publish"],
+    ["faça push", "commits", "publish"],
+    ["push", "commits", "publish"],
+    ["faça deploy sem release", "commits", "publish"],
+    ["faça deploy, não quero release", "commits", "publish"],
+    ["faça deploy, mas não publique release", "commits", "publish"],
+    ["faça deploy com release", "release", "publish"],
+    ["faça deploy da próxima versão", "release", "publish"],
+    ["faça deploy do novo release", "release", "publish"],
+    ["publique novo release", "release", "publish"],
+    ["publique a nova versão", "release", "publish"],
+    ["publish a release", "release", "publish"],
+    ["deploy release", "release", "publish"],
+    ["publish new release", "release", "publish"],
+    ["deploy next version", "release", "publish"],
+    ["faça deploy v4.6", "release", "publish"],
+    ["pode seguir para v4.7, mas garanta que o dashboard esteja correto", "release", "publish"],
+    ["prepare a próxima versão", "release", "prepare"],
+    ["faça deploy release sem publicar", "release", "prepare"],
+    ["faça deploy e explique quando devo pedir release", null, "publish"],
+  ];
+  for (const identity of [builder, consumer])
+    for (const [request, override, phase] of cases) {
+      const plan = resolveDeployment(input(request, identity));
+      assert.equal(plan.mode, override ?? (identity === builder ? "release" : "commits"), request);
+      assert.equal(plan.phase, phase, request);
+      assert.equal(
+        plan.npm_publication,
+        identity === builder && plan.mode === "release" && phase === "publish",
+      );
+      assert.equal(plan.scope, "current-work");
+      assert.equal(plan.changes_preference, false);
+    }
+});
+test("explicit current-version sequence stays commits-only and a requested new version selects release", () => {
+  const earlier =
+    "ok, primeiro passo então é corrigir as branchs atuais e fazer merge de tudo pra main, fazer deploy dos comits na versão atual.";
+  assert.equal(resolveDeployment(input(earlier, builder)).mode, "commits");
+  const current =
+    "Resolva essas pendencias, preciso que crie uma nova versao 4.6 e faca mesclagem e arquivamentos de branchs.";
+  const plan = resolveDeployment(input(current, builder));
+  assert.equal(plan.mode, "release");
+  assert.equal(plan.version, "4.6");
+  assert.equal(plan.phase, "publish");
+});
+test("discussion, quoted history, negation and questions never authorize publication", () => {
+  for (const request of [
+    "não faça deploy",
+    "explique deploy com release",
+    "o usuário disse 'faça deploy'",
+    '"faça deploy"',
+    "seria melhor publicar um release?",
+    "pode fazer deploy?",
+    "implemente a regra de deploy",
+  ]) {
+    assert.equal(resolveDeployment(input(request, builder)).mode, "none", request);
+  }
+  assert.throws(
+    () => resolveDeployment(input("faça deploy sem release e publique release")),
+    /Conflicting/,
+  );
+  assert.throws(() => resolveDeployment(input("faça deploy release v4.6 e v4.7")), /versions/);
+  assert.equal(resolveDeployment(input("faça deploy v4.6")).version, "4.6");
+  assert.equal(resolveDeployment(input("pode seguir para v4.7", builder)).version, "4.7");
+  assert.equal(resolveDeployment(input("pode seguir para v4.7?", builder)).mode, "none");
+});
+test("preferences are project-owned; one-shot overrides, scope and invalid config are explicit", () => {
+  const preference = { ...DEFAULT_POLICY, default_mode: "release" };
+  assert.equal(resolveDeployment(input("faça deploy", consumer, preference)).mode, "release");
+  assert.equal(
+    resolveDeployment(input("faça deploy apenas commits", consumer, preference)).mode,
+    "commits",
+  );
+  assert.equal(preference.default_mode, "release");
+  assert.equal(resolveDeployment(input("faça deploy de tudo")).scope, "all-worktree");
+  for (const policy of [
+    null,
+    {},
+    { ...DEFAULT_POLICY, default_mode: "maybe" },
+    { ...DEFAULT_POLICY, default_scope: "all-worktree" },
+    { ...DEFAULT_POLICY, typo: true },
+  ])
+    assert.throws(() => resolveDeployment(input("faça deploy", consumer, policy)), /policy/);
+});
+test("builder identity requires origin plus all three agreeing manifests", () => {
+  assert.equal(repositoryKind(builder), "builder");
+  assert.equal(repositoryKind(consumer), "consumer");
+  for (const identity of [
+    { ...builder, origin: consumer.origin },
+    { ...builder, rootName: "app" },
+    { ...builder, cliName: "other" },
+    { ...builder, cliVersion: "4.6.0" },
+  ])
+    assert.throws(() => repositoryKind(identity), /identity|versions/);
+});
+test("frozen contract rejects changed policy, request, identity or route", () => {
+  const current = input("faça deploy");
+  const plan = resolveDeployment(current);
+  assert.deepEqual(verifyContract(plan, current, "commits"), plan);
+  for (const changed of [
+    { ...current, request: "faça deploy release" },
+    { ...current, policy: { ...DEFAULT_POLICY, default_mode: "commits" } },
+    { ...current, identity: { ...consumer, rootName: "renamed" } },
+  ])
+    assert.throws(() => verifyContract(plan, changed, "commits"), /intent|changed/);
+  assert.throws(() => verifyContract(plan, current, "release"), /intent/);
+});
+test("numeric version progression, explicit major, exact retry and no empty release", () => {
+  assert.equal(nextRelease().tag, "v1.0");
+  assert.equal(nextRelease(["v4.9", "v4.10", "v4.2", "junk"]).tag, "v4.11");
+  assert.equal(nextRelease(["v4.10"], { major: true }).tag, "v5.0");
+  const sha = "a".repeat(40);
+  assert.equal(
+    nextRelease(["v4.10"], { existingTag: "v4.10", candidateSha: sha, existingTagSha: sha }).action,
+    "resume",
+  );
+  assert.equal(
+    nextRelease(["v4.10"], { candidateSha: sha, publishedSha: sha, publishedTag: "v4.10" }).action,
+    "verify-existing",
+  );
+  assert.throws(
+    () =>
+      nextRelease([], { existingTag: "v4.10", candidateSha: sha, existingTagSha: "b".repeat(40) }),
+    /Retry/,
+  );
+  assert.throws(
+    () => nextRelease(["v4.10"], { publishedSha: "x", candidateSha: "x", publishedTag: "v4.10" }),
+    /SHA/,
+  );
+});
+test("commits route checks before push, sends the exact SHA and never creates release", async () => {
+  const current = input("faça deploy");
+  const events = [];
+  const value = {
+    repository: process.cwd(),
+    request: current.request,
+    plan: resolveDeployment(current),
+    sha: "a".repeat(40),
+    branch: "main",
+    checks: [{ command: "node", args: ["--test", "fixture.test.mjs"] }],
+  };
+  const operations = {
+    readInput: async () => current,
+    identity: () => events.push("identity"),
+    branchFor: async () => "main",
+    checks: async () => events.push("checks"),
+    preflight: async () => events.push("preflight"),
+    push: async ({ refspec }) => events.push(refspec),
+    remoteSha: async () => value.sha,
+  };
+  const result = await guardedCommits(value, operations);
+  assert.equal(result.pushed, true);
+  assert.equal(result.release, false);
+  assert.ok(events.indexOf("checks") < events.indexOf("preflight"));
+  assert.ok(events.includes(`${value.sha}:refs/heads/main`));
+  events.length = 0;
+  assert.equal((await guardedCommits({ ...value, dryRun: true }, operations)).pushed, false);
+  assert.ok(!events.includes("preflight"));
+});
+test("critical builder commit qualifies locally and waits for exact main CI", async () => {
+  const current = input("faça deploy apenas commits", builder);
+  const sha = "a".repeat(40);
+  const events = [];
+  const value = {
+    repository: process.cwd(),
+    request: current.request,
+    plan: resolveDeployment(current),
+    sha,
+    branch: "main",
+    checks: [{ command: "node", args: ["--test", "fixture.test.mjs"] }],
+  };
+  await guardedCommits(value, {
+    readInput: async () => current,
+    identity: () => {},
+    branchFor: async () => "main",
+    checks: async () => events.push("checks"),
+    preflight: async () => events.push("preflight"),
+    isCritical: async () => true,
+    qualifyPreMain: async () => events.push("qualify"),
+    push: async () => events.push("main"),
+    remoteSha: async () => sha,
+    verifyMainCi: async () => events.push("main-ci"),
+  });
+  assert.deepEqual(events, ["checks", "preflight", "qualify", "main", "main-ci"]);
+});
+test("critical Task in an earlier candidate commit requires candidate-bound proof", async (t) => {
+  const root = await mkdtemp(join(tmpdir(), "zaip-critical-range-"));
+  t.after(() => rm(root, { recursive: true, force: true }));
+  const git = (...args) => execFileSync("git", args, { cwd: root, encoding: "utf8" }).trim();
+  git("init", "--quiet");
+  git("config", "user.name", "ZAIP Test");
+  git("config", "user.email", "zaip@example.invalid");
+  await writeFile(join(root, "base.txt"), "base\n");
+  git("add", "base.txt");
+  git("commit", "--quiet", "-m", "base");
+  git("branch", "-M", "main");
+  git("remote", "add", "origin", root);
+  git("checkout", "--quiet", "-b", "candidate");
+  const taskId = "TASK-2026-09-29-20-00-CRITICAL-ABCDE";
+  const path = join(root, ".agents", "records", "tasks", "2026", "09");
+  await mkdir(path, { recursive: true });
+  await writeFile(join(path, `${taskId}.md`), `---\nid: ${taskId}\nrisk: critical\n---\n`);
+  git("add", ".agents");
+  git("commit", "--quiet", "-m", "critical work", "-m", `ZAIP-Task: ${taskId}`);
+  await writeFile(join(root, "tail.txt"), "tail\n");
+  git("add", "tail.txt");
+  git("commit", "--quiet", "-m", "noncritical tail");
+  const candidate = git("rev-parse", "HEAD");
+  assert.equal(await criticalTaskInRange(root, candidate), true);
+  await writeFile(join(path, `${taskId}.md`), `---\nid: ${taskId}\nrisk: low\n---\n`);
+  assert.equal(await criticalTaskInRange(root, candidate), true);
+  git("add", ".agents");
+  git("commit", "--quiet", "-m", "downgrade record");
+  assert.equal(await criticalTaskInRange(root, git("rev-parse", "HEAD")), true);
+  await rm(join(path, `${taskId}.md`));
+  git("add", "-A");
+  git("commit", "--quiet", "-m", "remove proof");
+  await assert.rejects(
+    () => criticalTaskInRange(root, git("rev-parse", "HEAD")),
+    /cannot verify candidate Task record/,
+  );
+});
+test("wrong route, branch, changed preference and preparation stop before external writes", async () => {
+  let writes = 0;
+  const current = input("faça deploy");
+  const value = {
+    repository: process.cwd(),
+    request: current.request,
+    plan: resolveDeployment(current),
+    sha: "a".repeat(40),
+    branch: "main",
+    checks: [{ command: "node", args: ["--test", "fixture.test.mjs"] }],
+  };
+  const operations = {
+    readInput: async () => current,
+    identity: () => {},
+    branchFor: async () => "main",
+    checks: async () => {},
+    preflight: async () => writes++,
+    push: async () => writes++,
+  };
+  const releaseInput = input("faça deploy release");
+  await assert.rejects(
+    () => guardedCommits({ ...value, plan: resolveDeployment(releaseInput) }, operations),
+    /changed/,
+  );
+  await assert.rejects(() => guardedCommits({ ...value, branch: "beta" }, operations), /branch/);
+  let reads = 0;
+  await assert.rejects(
+    () =>
+      guardedCommits(value, {
+        ...operations,
+        readInput: async () =>
+          ++reads === 1
+            ? current
+            : { ...current, policy: { ...DEFAULT_POLICY, default_mode: "release" } },
+      }),
+    /intent/,
+  );
+  const prepare = input("prepare deploy sem release");
+  await assert.rejects(
+    () =>
+      guardedCommits(
+        { ...value, plan: resolveDeployment(prepare) },
+        { ...operations, readInput: async () => prepare },
+      ),
+    /intent/,
+  );
+  assert.equal(writes, 0);
+});
+test("portable resolver CLI uses actual Git identity and preserves existing preferences", async (context) => {
+  const root = await mkdtemp(join(tmpdir(), "zaip-deploy-contract-"));
+  context.after(() => rm(root, { recursive: true, force: true }));
+  execFileSync("git", ["init", "--quiet"], { cwd: root });
+  execFileSync("git", ["remote", "add", "origin", consumer.origin], { cwd: root });
+  await mkdir(join(root, ".agents", "config"), { recursive: true });
+  const config = join(root, ".agents", "config", "deploy-policy.json");
+  const custom = `${JSON.stringify({ ...DEFAULT_POLICY, default_mode: "release" }, null, 2)}\n`;
+  await writeFile(config, custom);
+  await writeFile(join(root, "package.json"), JSON.stringify({ name: "consumer" }));
+  await writeFile(join(root, "request.txt"), "faça deploy apenas commits");
+  const plan = JSON.parse(
+    execFileSync(
+      process.execPath,
+      [
+        join(import.meta.dirname, "deploy-contract.mjs"),
+        "--repository",
+        root,
+        "--request-file",
+        join(root, "request.txt"),
+      ],
+      { encoding: "utf8" },
+    ),
+  );
+  assert.equal(plan.mode, "commits");
+  assert.equal(plan.kind, "consumer");
+  assert.equal(await readFile(config, "utf8"), custom);
+  await rm(config);
+  assert.equal(resolveDeployment(await readDeploymentInput(root, "faça deploy")).mode, "commits");
+});