@zaip-ai/cli 6.3.0 → 7.5.0

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/deploy-contract.test.mjs

@@ -1,9 +1,30 @@
 import assert from "node:assert/strict";
-import { execFileSync } from "node:child_process";
-import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { mkdtemp, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import test from "node:test";
+import { it, onTestFinished, vi } from "vitest";
+
+const test = (name, body) => it(name, () => body({ after: onTestFinished }));
+const unitAuthority = vi.hoisted(() => ({ read: null }));
+// Algorithm-only fixtures: the native publication boundary has separate,
+// unmocked hook/receipt/readers/local-bare integration coverage.
+vi.mock("./deploy-contract.mjs", async (load) => ({
+  ...(await load()),
+  readDeploymentInput: (...args) => unitAuthority.read(...args),
+}));
+vi.mock("./deploy-auth.mjs", async (load) => ({
+  ...(await load()),
+  assertBoundedGitPush: vi.fn(() => {}),
+}));
+vi.mock("./git-push-target.mjs", () => ({
+  publicationPushArguments: vi.fn((_root, target) => [
+    "push",
+    target.url,
+    `${target.sha}:${target.ref}`,
+  ]),
+  assertPublicationPushTarget: vi.fn((_root, target) => target),
+}));
+
 import {
   DEFAULT_POLICY,
   nextRelease,
@@ -12,7 +33,13 @@ import {
   verifyContract,
 } from "./deploy-contract.mjs";
 import { assertPatchManifestVersions } from "./deploy-contract-patch.test-support.mjs";
-import { criticalTaskInRange, guardedCommits } from "./guarded-commits.mjs";
+import { registerCriticalTaskRange } from "./deploy-contract-range.test-support.mjs";
+import { guardedCommits as guardedCommitsSource } from "./guarded-commits.mjs";
+
+const guardedCommits = (value, operations) => {
+  unitAuthority.read = operations.readInput;
+  return guardedCommitsSource(value, operations);
+};
 
 const builder = {
   origin: "git@github.com:zaip-ai/zaip-aios.git",
@@ -23,6 +50,16 @@ const builder = {
   workspaceVersion: "4.5.0",
 };
 const consumer = { origin: "git@github.com:example/app.git", rootName: "app" };
+function assertUnsupportedPlan(current) {
+  const plan = resolveDeployment(current);
+  assert.deepEqual(plan, {
+    schema_version: 1,
+    mode: "none",
+    phase: "none",
+    reason: "publication-condition-unsupported",
+  });
+  assert.throws(() => verifyContract(plan, current, "release"), /does not authorize/);
+}
 const input = (request, identity = consumer, policy = DEFAULT_POLICY) => ({
   request,
   identity,
@@ -45,13 +82,13 @@ test("literal SPEC continuation binds only its explicit version and optional rel
     `"${base}"`,
     `o usuário disse '${base}'`,
     `${base}?`,
-    `${base} se eu confirmar`,
     `${base} não publique`,
     `${base} e faça outra coisa`,
     `${base} com npm publicado`,
     base.replace("v5.0", "v05.0"),
   ])
     assert.equal(resolveDeployment(input(request, builder)).mode, "none", request);
+  assertUnsupportedPlan(input(`${base} se eu confirmar`, builder));
 });
 
 test("fixed defaults, explicit intent and preparation: Portuguese/English decision matrix", () => {
@@ -131,6 +168,7 @@ test("final adjustments with an explicit publication goal preserve the actual hu
   for (const request of [
     "ativei o hook faça as validações finais e os ajustes necessários pra publicar v4.8",
     "faça os ajustes necessários para publicar v4.8",
+    "Faça todos os ajustes necessários para publicar v4.8",
   ]) {
     const plan = resolveDeployment(input(request, builder));
     assert.equal(plan.mode, "release");
@@ -141,11 +179,18 @@ test("final adjustments with an explicit publication goal preserve the actual hu
     "explique os ajustes necessários para publicar v4.8",
     "não faça os ajustes necessários para publicar v4.8",
     "faça os ajustes necessários para publicar v4.8?",
-    "faça os ajustes necessários para publicar v4.8 quando eu autorizar",
     "o usuário disse 'faça os ajustes necessários para publicar v4.8'",
+    "não faça todos os ajustes necessários para publicar v4.8",
+    "Faça todos os ajustes necessários para publicar v4.8?",
+    '"Faça todos os ajustes necessários para publicar v4.8"',
   ]) {
     assert.equal(resolveDeployment(input(request, builder)).mode, "none", request);
   }
+  for (const request of [
+    "faça os ajustes necessários para publicar v4.8 quando eu autorizar",
+    "Faça todos os ajustes necessários para publicar v4.8 quando eu autorizar",
+  ])
+    assertUnsupportedPlan(input(request, builder));
   const prepare = resolveDeployment(
     input("faça os ajustes necessários para publicar v4.8, mas não publique ainda", builder),
   );
@@ -168,11 +213,14 @@ test("short positive publication statements bind their stated version without pr
   for (const unsafe of [
     `${request}?`,
     "Boa, boa. Eu não quero publicar quatro ponto nove, sim",
-    `Se estiver pronto, ${request}`,
     `O usuário disse '${request}'`,
-    "Eu quero publicar quatro ponto nove se vocês aprovarem",
   ])
     assert.equal(resolveDeployment(input(unsafe, builder)).mode, "none", unsafe);
+  for (const unsafe of [
+    `Se estiver pronto, ${request}`,
+    "Eu quero publicar quatro ponto nove se vocês aprovarem",
+  ])
+    assertUnsupportedPlan(input(unsafe, builder));
 });
 test("preferences are project-owned; one-shot overrides, scope and invalid config are explicit", () => {
   const preference = { ...DEFAULT_POLICY, default_mode: "release" };
@@ -252,6 +300,7 @@ test("commits route checks before push, sends the exact SHA and never creates re
   };
   const operations = {
     readInput: async () => current,
+    destination: () => {},
     identity: () => events.push("identity"),
     branchFor: async () => "main",
     checks: async () => events.push("checks"),
@@ -268,7 +317,7 @@ test("commits route checks before push, sends the exact SHA and never creates re
   assert.equal((await guardedCommits({ ...value, dryRun: true }, operations)).pushed, false);
   assert.ok(!events.includes("preflight"));
 });
-test("critical builder commit uses portable injected gates and fails closed if either is missing", async (t) => {
+test("builder commit cannot substitute two injected legacy gates for its policy resolver", async (t) => {
   const root = await mkdtemp(join(tmpdir(), "zaip-critical-portable-"));
   t.after(() => rm(root, { recursive: true, force: true }));
   const current = input("faça deploy apenas commits", builder);
@@ -284,6 +333,7 @@ test("critical builder commit uses portable injected gates and fails closed if e
   };
   const operations = {
     readInput: async () => current,
+    destination: () => {},
     identity: () => {},
     branchFor: async () => "main",
     checks: async () => events.push("checks"),
@@ -294,54 +344,10 @@ test("critical builder commit uses portable injected gates and fails closed if e
     remoteSha: async () => sha,
     verifyMainCi: async () => events.push("main-ci"),
   };
-  await guardedCommits(value, operations);
-  assert.deepEqual(events, ["checks", "preflight", "qualify", "main", "main-ci"]);
-  for (const missing of ["qualifyPreMain", "verifyMainCi"]) {
-    events.length = 0;
-    await assert.rejects(
-      guardedCommits(value, { ...operations, [missing]: undefined }),
-      /remote-candidate-gate\.mjs/,
-    );
-    assert.ok(!events.includes("main"), `${missing} must fail before push`);
-  }
-});
-test("critical Task in an earlier candidate commit requires candidate-bound proof", async (t) => {
-  const root = await mkdtemp(join(tmpdir(), "zaip-critical-range-"));
-  t.after(() => rm(root, { recursive: true, force: true }));
-  const git = (...args) => execFileSync("git", args, { cwd: root, encoding: "utf8" }).trim();
-  git("init", "--quiet");
-  git("config", "user.name", "ZAIP Test");
-  git("config", "user.email", "zaip@example.invalid");
-  await writeFile(join(root, "base.txt"), "base\n");
-  git("add", "base.txt");
-  git("commit", "--quiet", "-m", "base");
-  git("branch", "-M", "main");
-  git("remote", "add", "origin", root);
-  git("checkout", "--quiet", "-b", "candidate");
-  const taskId = "TASK-2026-09-29-20-00-CRITICAL-ABCDE";
-  const path = join(root, ".agents", "records", "tasks", "2026", "09");
-  await mkdir(path, { recursive: true });
-  await writeFile(join(path, `${taskId}.md`), `---\nid: ${taskId}\nrisk: critical\n---\n`);
-  git("add", ".agents");
-  git("commit", "--quiet", "-m", "critical work", "-m", `ZAIP-Task: ${taskId}`);
-  await writeFile(join(root, "tail.txt"), "tail\n");
-  git("add", "tail.txt");
-  git("commit", "--quiet", "-m", "noncritical tail");
-  const candidate = git("rev-parse", "HEAD");
-  assert.equal(await criticalTaskInRange(root, candidate), true);
-  await writeFile(join(path, `${taskId}.md`), `---\nid: ${taskId}\nrisk: low\n---\n`);
-  assert.equal(await criticalTaskInRange(root, candidate), true);
-  git("add", ".agents");
-  git("commit", "--quiet", "-m", "downgrade record");
-  assert.equal(await criticalTaskInRange(root, git("rev-parse", "HEAD")), true);
-  await rm(join(path, `${taskId}.md`));
-  git("add", "-A");
-  git("commit", "--quiet", "-m", "remove proof");
-  await assert.rejects(
-    () => criticalTaskInRange(root, git("rev-parse", "HEAD")),
-    /cannot verify candidate Task record/,
-  );
+  await assert.rejects(guardedCommits(value, operations), /builder-commit-delivery\.mjs/);
+  assert.deepEqual(events, []);
 });
+registerCriticalTaskRange(test);
 test("wrong route, branch, changed preference and preparation stop before external writes", async () => {
   let writes = 0;
   const current = input("faça deploy");
@@ -355,6 +361,7 @@ test("wrong route, branch, changed preference and preparation stop before extern
   };
   const operations = {
     readInput: async () => current,
+    destination: () => {},
     identity: () => {},
     branchFor: async () => "main",
     checks: async () => {},

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/deploy-idempotent-intent.test.mjs

@@ -0,0 +1,130 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { resolveDeployment } from "./deploy-contract.mjs";
+
+const builder = {
+  origin: "git@github.com:zaip-ai/zaip-aios.git",
+  rootName: "@zaip-ai/aios",
+  cliName: "@zaip-ai/cli",
+  rootVersion: "7.4.0",
+  cliVersion: "7.4.0",
+  workspaceVersion: "7.4.0",
+};
+const consumer = { origin: "git@github.com:example/app.git", rootName: "app" };
+const plan = (request, identity = builder, policy) =>
+  resolveDeployment({ request, identity, policy });
+const checkedAdjustments =
+  "verifique se foi feito deploy da v7.5. Se ainda não, faça os ajustes necessários para realizar o deploy corretamente. Garanta que o deploy seja feito.";
+
+test("complete only missing GitHub or npm delivery of the same explicit release", () => {
+  const request =
+    "se a v8.2 ainda não foi publicada no github ou no npm, faça os ajustes necessários, remova os bloqueios, mude o que for necessário para corrigir problemas de deploy e garanta que seja finalizado o deploy da v8.2";
+  assert.equal(plan(request).completion_only, "github-and-npm");
+  assert.equal(plan(request).version, "8.2");
+  assert.equal(plan(request, consumer).mode, "none");
+  for (const changed of [
+    request.replace("deploy da v8.2", "deploy da v8.3"),
+    request + " se eu aprovar",
+    request + "?",
+    "Não execute: " + request,
+  ]) {
+    assert.equal(plan(changed).mode, "none");
+  }
+});
+
+test("complete check-adjust-deploy request retains its exact minor and current scope", () => {
+  const resolved = plan(checkedAdjustments);
+  assert.equal(resolved.mode, "release");
+  assert.equal(resolved.phase, "publish");
+  assert.equal(resolved.version, "7.5");
+  assert.equal(resolved.scope, "current-work");
+  assert.equal(resolved.npm_publication, true);
+});
+
+test("check-and-deploy follows project policy and retains current-work scope", () => {
+  for (const request of [
+    "revise se foi feito deploy, caso contrário faça deploy",
+    "Verifique se já foi feito o deploy, caso contrário faça deploy.",
+    "Confira se foi feito deploy, caso contrário faça deploy!",
+  ]) {
+    const resolved = plan(request);
+    assert.equal(resolved.mode, "release");
+    assert.equal(resolved.phase, "publish");
+    assert.equal(resolved.version, null);
+    assert.equal(resolved.scope, "current-work");
+    assert.equal(resolved.npm_publication, true);
+    assert.equal(plan(request, consumer).mode, "commits");
+    assert.equal(plan(request, consumer).npm_publication, false);
+    assert.equal(
+      plan(request, builder, {
+        schema_version: 1,
+        default_mode: "commits",
+        default_scope: "current-work",
+      }).mode,
+      "commits",
+    );
+  }
+});
+
+test("repair-and-deploy and explicit idempotent deploy retain the exact minor", () => {
+  for (const request of [
+    "Corrija isso e faça deploy da 7.4",
+    "Corrija isso e faça deploy da v7.4.",
+    "revise se foi feito deploy, caso contrário faça deploy da 7.4",
+  ]) {
+    const resolved = plan(request);
+    assert.equal(resolved.mode, "release");
+    assert.equal(resolved.phase, "publish");
+    assert.equal(resolved.version, "7.4");
+    assert.equal(resolved.scope, "current-work");
+  }
+});
+
+test("idempotency and repair wording never bypass provenance or human holds", () => {
+  for (const directive of [
+    checkedAdjustments,
+    "revise se foi feito deploy, caso contrário faça deploy",
+    "Corrija isso e faça deploy da 7.4",
+  ]) {
+    for (const request of [
+      `Não ${directive}`,
+      `Ele disse: ${directive}`,
+      `Exemplo: ${directive}`,
+      `"${directive}"`,
+      `${directive}?`,
+      `${directive} se eu aprovar`,
+      `${directive}. Aguarde minha confirmação.`,
+      `${directive}. Só publique com minha autorização.`,
+      `Quando eu confirmar, ${directive}`,
+      `Prepare apenas: ${directive}`,
+      directive.includes("faça deploy")
+        ? directive.replace("faça deploy", "não faça deploy")
+        : directive.replace("Garanta que o deploy seja feito.", "Não faça deploy."),
+      `${directive} de tudo`,
+      `${directive} e publique a v7.5`,
+    ]) {
+      const resolved = plan(request);
+      assert.notEqual(resolved.phase, "publish", request);
+      assert.notEqual(resolved.npm_publication, true, request);
+    }
+  }
+});
+
+test("new bounded directives reject malformed or ambiguous version identities", () => {
+  for (const version of ["7.4.1", "v7.4.1", "7.4-rc1", "7.4+build", "07.4", "7.04", "7.4 e 7.5"]) {
+    for (const prefix of [
+      "Corrija isso e faça deploy da ",
+      "revise se foi feito deploy, caso contrário faça deploy da ",
+    ])
+      assert.equal(plan(`${prefix}${version}`).mode, "none");
+  }
+  for (const request of [
+    "revise se foi feito deploy",
+    "Se eu aprovar, faça deploy",
+    "revise se foi feito deploy, caso contrário aguarde",
+    "Corrija isso sem fazer deploy da 7.4",
+  ])
+    assert.notEqual(plan(request).phase, "publish");
+  for (const version of ["v7.5.1", "v7.5-rc1", "v7.5+build", "v07.5", "v7.05", "v7.5 e v7.6"])
+    assert.equal(plan(checkedAdjustments.replace("v7.5", version)).mode, "none", version);
+});

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/deploy-publication-intent.test.mjs

@@ -1,6 +1,6 @@
 import assert from "node:assert/strict";
 import test from "node:test";
-import { resolveDeployment } from "./deploy-contract.mjs";
+import { resolveDeployment, verifyContract } from "./deploy-contract.mjs";
 
 const builder = {
   origin: "git@github.com:zaip-ai/zaip-aios.git",
@@ -11,6 +11,105 @@ const builder = {
   workspaceVersion: "4.5.0",
 };
 const input = (request, identity) => ({ request, identity });
+const assertUnsupportedCondition = (request) => {
+  const current = input(request, builder),
+    plan = resolveDeployment(current);
+  assert.deepEqual(plan, {
+    schema_version: 1,
+    mode: "none",
+    phase: "none",
+    reason: "publication-condition-unsupported",
+  });
+  assert.throws(() => verifyContract(plan, current, "release"), /does not authorize/);
+};
+
+test("finish pending work and deploy follows policy without widening scope", () => {
+  const request = "execute tudo que falta e faça deploy";
+  const plan = resolveDeployment(input(request, builder));
+  assert.equal(plan.mode, "release");
+  assert.equal(plan.phase, "publish");
+  assert.equal(plan.scope, "current-work");
+  assert.equal(plan.version, null);
+  const consumer = { origin: "git@github.com:example/app.git", rootName: "app" };
+  assert.equal(resolveDeployment(input(request, consumer)).mode, "commits");
+  for (const negative of [
+    `Não ${request}`,
+    `Ele disse: ${request}`,
+    `"${request}"`,
+    `${request}?`,
+    `${request} se eu aprovar`,
+    `${request}. Aguarde minha confirmação.`,
+    request.replace("faça deploy", "não faça deploy"),
+  ])
+    assert.equal(resolveDeployment(input(negative, builder)).mode, "none", negative);
+});
+
+test("the actual final-review and whole-SPEC requests retain explicit minor publication", () => {
+  const directives = [
+    "revise se todos os ajustes foram realizados corretamente, faça os ajustes finais e publique na versao 6.4",
+    "Execute a SPEC inteira até publicar a v6.4",
+  ];
+  for (const request of directives) {
+    assert.deepEqual(
+      Object.fromEntries(
+        ["mode", "phase", "scope", "version"].map((key) => [
+          key,
+          resolveDeployment(input(request, builder))[key],
+        ]),
+      ),
+      { mode: "release", phase: "publish", scope: "current-work", version: "6.4" },
+    );
+    for (const negative of [
+      `Não ${request}`,
+      `Ele disse: ${request}`,
+      `"${request}"`,
+      `${request}?`,
+      `${request} se eu aprovar`,
+      `${request}. Aguarde minha confirmação.`,
+      request.replace(/publique|publicar/, "não publique"),
+      `${request}.1`,
+      `${request}-rc1`,
+      `${request} e publique a v6.5`,
+    ])
+      assert.equal(resolveDeployment(input(negative, builder)).mode, "none", negative);
+    const prepared = resolveDeployment(input(`Prepare apenas: ${request}`, builder));
+    assert.notEqual(prepared.phase, "publish");
+    assert.notEqual(prepared.npm_publication, true);
+  }
+});
+
+test("current pending-task continuation sentence authorizes the exact minor while holds remain closed", () => {
+  const directive = "Continue todas as tarefas pendentes até a publicação da v6.4";
+  const request =
+    "ok, preciso que melhore essa cobertura de extração ara pelo menos 80 ou 90. De preferência nota 100. Mas faça o que for possivel, só achei a nota muito baixa. Tente melhorar isso tambem. Continue todas as tarefas pendentes até a publicação da v6.4. Mas tome cuidado com teste excessivos principalmente relacionado ao design system maker. Encontre o meio do caminho para otimizar execução de maneira mais rápida com validações menores e mais rapidas.\n";
+  for (const value of [directive, request]) {
+    const plan = resolveDeployment(input(value, builder));
+    assert.equal(plan.mode, "release");
+    assert.equal(plan.phase, "publish");
+    assert.equal(plan.version, "6.4");
+    assert.equal(plan.scope, "current-work");
+    assert.equal(plan.npm_publication, true);
+  }
+  for (const negative of [
+    `Não ${directive}`,
+    `Ele disse: ${request}`,
+    `"${request}"`,
+    `${directive}?`,
+    `${directive} se eu aprovar`,
+    `${request} Aguarde minha confirmação.`,
+    `Não publique. ${request}`,
+    `Se os testes passarem. ${directive}`,
+    `Quando eu confirmar. ${directive}`,
+    directive.replace("publicação", "não publicação"),
+    `${directive}.1`,
+    `${directive}-rc1`,
+    `${directive} e publique v6.5`,
+  ])
+    assert.equal(resolveDeployment(input(negative, builder)).mode, "none", negative);
+  const prepared = resolveDeployment(input(`Prepare apenas: ${directive}`, builder));
+  assert.notEqual(prepared.phase, "publish");
+  assert.notEqual(prepared.npm_publication, true);
+});
 
 test("pending documentation and approved adjustments preserve explicit publication authority", () => {
   const directives = [
@@ -133,10 +232,17 @@ test("execution and next-version publication remain bounded to a direct human re
     assert.equal(resolveDeployment(input(rejected, builder)).mode, "none", rejected);
 });
 
-test("accepts publication after technical adjustments and tests, preserving human approval conditions", () => {
+test("publication after adjustments and tests requires typed proof, preserving human approval holds", () => {
   const directive = "Após os ajustes e testes publique uma nova versão";
   const request = `A nota ficou pior? Faça os ajustes necessários. ${directive}`;
-  assert.equal(resolveDeployment(input(request, builder)).mode, "release");
+  // v7.5 no longer interprets a temporal prerequisite as already satisfied.
+  assertUnsupportedCondition(request);
+  assertUnsupportedCondition(directive);
+  assert.equal(
+    resolveDeployment(input("Faça os ajustes necessários e publique em uma nova versao", builder))
+      .mode,
+    "release",
+  );
   for (const rejected of [
     `Ele disse: ${directive}`,
     `"${directive}"`,
@@ -149,10 +255,11 @@ test("accepts publication after technical adjustments and tests, preserving huma
   ])
     assert.equal(resolveDeployment(input(rejected, builder)).mode, "none", rejected);
 });
-test("recognizes a separate publication sentence and preserves approval conditions", () => {
+test("a separate deferred publication sentence remains blocked without proof of prerequisites", () => {
   const request =
     "Pode executar tudo e dê uma atenção especial sobre eficiência e prevençao de retrabalho. Quero nota 9. Depois publique a nova versão";
-  assert.equal(resolveDeployment(input(request, builder)).mode, "release");
+  assertUnsupportedCondition(request);
+  assert.equal(resolveDeployment(input("Publique uma nova versão", builder)).mode, "release");
   for (const rejected of [
     `Ele disse: ${request}`,
     `Exemplo: ${request}`,

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/deployment-request-conditions.test.mjs

@@ -0,0 +1,117 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { resolveDeployment, verifyContract } from "./deploy-contract.mjs";
+import { provenPublicationAction, resolvePublicationCondition } from "./publication-conditions.mjs";
+import { inspectPublicationIntent } from "./publication-intent.mjs";
+
+const identity = { origin: "git@github.com:fixture/app.git", rootName: "fixture" };
+const input = (request, extra = {}) => ({ request, identity, ...extra });
+const refused = {
+  schema_version: 1,
+  mode: "none",
+  phase: "none",
+  reason: "publication-condition-unsupported",
+};
+const forged = { action: "faça deploy", passed: true, commit_sha: "a".repeat(40) };
+
+test("reports an optional maintenance sentence without granting publication", async () => {
+  const suffix = ". Pode entrar em modo de manutenção se for necessário";
+  for (const directive of [
+    "Corrija tudo que for necessário para realizar o deploy da v7.5",
+    "Faça o deploy da v7.5",
+  ]) {
+    const request = directive + suffix;
+    assert.deepEqual(resolveDeployment(input(request)), {
+      ...refused,
+      reason: "publication-maintenance-clause-requires-separate-directive",
+    });
+    const reason = /maintenance_clause_requires_separate_directive/;
+    await assert.rejects(resolvePublicationCondition("unused", request), reason);
+    assert.throws(() => provenPublicationAction(request, forged), reason);
+  }
+  assert.deepEqual(resolveDeployment(input("Faça deploy se eu aprovar" + suffix)), refused);
+});
+
+test("planning returns a non-executable refusal while strict condition APIs retain errors", async () => {
+  for (const request of [
+    "Se eu autorizar, faça deploy",
+    "Faça deploy quando eu aprovar",
+    "Faça deploy after tests pass",
+    "Faça deploy desde que os testes passem",
+    "Faça deploy se estiver pronto",
+    "Não faça deploy se eu aprovar",
+    '"Faça deploy quando eu aprovar"',
+    "Faça deploy se eu aprovar?",
+  ]) {
+    for (const conditionProof of [undefined, forged]) {
+      const current = input(request, { conditionProof });
+      assert.deepEqual(resolveDeployment(current), refused, request);
+      for (const mode of ["commits", "release"])
+        assert.throws(() => verifyContract(refused, current, mode), /does not authorize/);
+    }
+    assert.throws(
+      () => provenPublicationAction(request, forged),
+      /publication_condition_unsupported/,
+    );
+    // The unsupported condition is rejected before any filesystem or Git access.
+    await assert.rejects(
+      resolvePublicationCondition("unused", request, undefined),
+      /publication_condition_unsupported/,
+    );
+  }
+});
+
+test("supported test conditions still require canonical proof and never accept a JSON boolean", () => {
+  for (const request of ["Se os testes passarem, faça deploy", "Faça deploy se os testes passarem"])
+    for (const conditionProof of [
+      undefined,
+      forged,
+      { ...forged, request_sha256: "a".repeat(64) },
+    ]) {
+      assert.equal(inspectPublicationIntent(request).condition, "tests_passed");
+      assert.throws(
+        () => resolveDeployment(input(request, { conditionProof })),
+        /publication_condition_proof_required/,
+      );
+    }
+  assert.throws(
+    () => resolveDeployment(input("Faça deploy", { conditionProof: forged })),
+    /publication_condition_unexpected/,
+  );
+});
+
+test("literal review wording is a question under review, never a conditional approval bypass", () => {
+  const request =
+    "revise se todos os ajustes foram realizados corretamente, faça os ajustes finais e publique na versao 6.4";
+  assert.equal(inspectPublicationIntent(request).condition, null);
+  const plan = resolveDeployment(input(request));
+  assert.equal(plan.phase, "publish");
+  assert.equal(plan.version, "6.4");
+  for (const suffix of [
+    " se eu aprovar",
+    " quando eu confirmar",
+    ". Aguarde minha confirmação",
+    "?",
+    " sem publicar",
+  ])
+    assert.notEqual(resolveDeployment(input(request + suffix)).phase, "publish", suffix);
+  for (const prefix of ["Não ", "Ele disse: ", '"'])
+    assert.equal(resolveDeployment(input(prefix + request)).mode, "none", prefix);
+  assert.equal(
+    inspectPublicationIntent("Revise se está pronto e publique a v6.4").condition,
+    "unsupported",
+  );
+});
+
+test("ordinary imperatives and idempotent instructions preserve scope and strict authority checks", () => {
+  for (const request of ["Faça deploy", "revise se foi feito deploy, caso contrário faça deploy"]) {
+    const current = input(request),
+      plan = resolveDeployment(current);
+    assert.equal(plan.mode, "commits");
+    assert.equal(plan.scope, "current-work");
+    assert.equal(plan.npm_publication, false);
+    assert.throws(() => resolveDeployment(input(request, { nativeAuthority: {} })));
+  }
+  for (const request of ["Não faça deploy", "Faça deploy?", '"Faça deploy"', "Talvez faça deploy"])
+    assert.equal(resolveDeployment(input(request)).mode, "none", request);
+});

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/deployment-request-continuation.test.mjs

@@ -0,0 +1,44 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { DEFAULT_POLICY, resolveDeployment, verifyContract } from "./deploy-contract.mjs";
+
+const input = (request) => ({
+  request,
+  identity: {
+    origin: "git@github.com:zaip-ai/zaip-aios.git",
+    rootName: "@zaip-ai/aios",
+    cliName: "@zaip-ai/cli",
+    rootVersion: "7.3.0",
+    cliVersion: "7.3.0",
+    workspaceVersion: "7.3.0",
+  },
+  policy: DEFAULT_POLICY,
+});
+
+test("explicit publication continuation preserves version and consumer exclusion", () => {
+  const request =
+    "Pode seguir com a publicação da v7.3, fazendo as verificações finais necessárias e sem atualizar os projetos consumidores.";
+  for (const text of [request, "Pode prosseguir com a publicação da v7.3."]) {
+    const plan = resolveDeployment(input(text));
+    assert.equal(plan.mode, "release");
+    assert.equal(plan.phase, "publish");
+    assert.equal(plan.version, "7.3");
+    assert.equal(plan.scope, "current-work");
+    assert.equal(plan.npm_publication, true);
+    verifyContract(plan, input(text), "release");
+  }
+  for (const text of [
+    `Não ${request}`,
+    `O usuário disse: ${request}`,
+    `"${request}"`,
+    request.replace(/\.$/, "?"),
+    "Pode seguir com a publicação da v7.3 quando eu aprovar.",
+    "Pode seguir com a publicação da v7.3, mas não publique ainda.",
+    "Pode seguir com a publicação da v7.3, mas não autorizo a publicação.",
+    "Pode seguir com a publicação da v7.3, sem publicar.",
+    "Pode seguir com a publicação da v7.3-beta.",
+    "Pode seguir com a publicação da v7.3 e v7.4.",
+  ]) {
+    assert.equal(resolveDeployment(input(text)).mode, "none", text);
+  }
+});