agentera 3.0.0-dev.51 → 3.0.0-dev.69

package/README.md

@@ -56,11 +56,11 @@ npx -y agentera@next state todo repair --effect-sha256 EFFECT_SHA256 --yes --for
 
 Unsafe inactive evidence (unmatched projections, duplicate public work, stale
 entity status, or prospective resurrection) reports a bounded, content-private
-diagnosis but no effect digest or apply command. It has no repair path before
-activation. Correct the Markdown-owned public rows and Agentera-owned entity
-state, then replan any required mutation. `check validate state` reports the
-same read-only diagnosis. Healthy active TODO projections keep the existing
-output.
+diagnosis and an owner-correction preview. Supply a complete `id` and
+one-based `source_line` mapping for every managed row, then confirm the exact
+effect-bound apply command. The correction preserves Markdown-owned public
+state and Agentera-owned operational fields without an intermediate activation.
+`check validate state` reports the same read-only diagnosis. Healthy active TODO projections keep the existing output.
 
 ## Shared-skill integration
 

package/bundle/CHANGELOG.md

@@ -18,9 +18,17 @@
 
 ### Changed
 
+- Serialized `feat/v3` integrations now allocate one committed
+  `3.0.0-dev.N+1` version locally, then automatically qualify and publish that
+  exact build to npm `@next`. Stable publication from `main` remains protected
+  by review.
+- Local staged verification now gives ordinary source changes targeted tests
+  and typecheck with two workers in at most 60 seconds. State and documentation
+  checks stay under 10 seconds, while specialized and global owners defer to
+  their authoritative CI conjunction instead of running a local release lane.
 - `agentera prime` now returns TODO state only through the canonical `todo`
-  field. Requests for the retired `issues` field fail with one structured
-  correction to `todo` instead of emitting a duplicate alias and warning.
+  field. Requests for the retired `issues` field fail with one structured correction to `todo` instead of emitting a duplicate alias and warning.
+- Build progress logging now retains durable project outcomes, while release receipts remain authoritative for attempt evidence.
 - `agentera prime --context <capability> --format json` now returns one bounded
   startup availability projection with an `ok`, `degraded`, or `blocked`
   outcome. Deferred detail names its exact read command; writer payloads are
@@ -30,17 +38,17 @@
   `agentera route request --input - --format json` and `agentera route receipt
   --help` expose the exact `agentera.route_receipt.v1` schema, valid outcomes,
   nullability, compound and UTF-8 span rules, plus a runnable stdin round trip.
-- Development releases now separate explicit metadata preparation, source and
-  candidate qualification, candidate-bound approval, staged exact-version
-  publication, and forward-only tag promotion. Preparation is registry-free;
-  qualification retains one immutable artifact with content-addressed receipts
-  and cold-state smoke evidence; ordinary CI pushes cannot publish it.
+- Development releases now run source checks once before explicit metadata review,
+  reuse valid evidence on resume, and construct or reuse one candidate before
+  separate approval, staged exact-version publication, and forward-only tag
+  promotion. Invalid or stale evidence fails before release effects, while the
+  review pause performs no metadata, approval, rebuild, or registry action.
 - State record families now use canonical bounded `list` and exact `get` reads,
   with predictable summary counts, selectors, queue ordering, omission metadata,
   and exact-detail recovery generated from the retrieval authority.
 - TODO state now reconciles repository-first `TODO.md` edits with operational
   entity state and publishes requested mutations through one recoverable atomic
-  transaction.
+  transaction, including effect-bound unsafe owner correction before activation.
 - State mutation behavior now comes from one code-owned 25-operation registry,
   with declarative discovery in `references/artifacts/state-storage-authority.yaml`
   required to match it before commands run. `state <family> explain --all`,
@@ -84,6 +92,8 @@
 
 ### Fixed
 
+- Fixed large unsafe inactive TODO status startup to fit its 22,500-byte JSON limit with bounded recovery details.
+- Fixed fresh projects so they can initialize Plan entity state without a legacy upgrade route.
 - Fixed `agentera doctor --format json` to report bounded, read-only retirement
   diagnostics for stale native resources. Each candidate now names its exact ID,
   path-only evidence, and a `doctor --retired-resource ID` preview command;
@@ -122,9 +132,9 @@
   actual source deadline, reserves bounded cleanup and parent-reconciliation
   time, and removes its generated state after failure. Source receipts now mark
   and validate all nine successful gate outcomes and reject semantic tampering.
-  The read-only `source-check` command now lets explicitly configured
-  version/gitRef-only pre-commits reuse matching source evidence without
-  skipping build, compact, parity, or later release qualification.
+  The read-only `source-check` command validates matching source evidence for
+  development preparation and direct diagnosis without running qualification
+  gates or changing repository, candidate, receipt, or registry state.
   Candidate qualification timing now closes construction before exact-artifact
   smoke and reconciles non-overlapping gate intervals with explicit overhead.
   Staging now rejects an absent exact version when the public tag already names

package/bundle/UPGRADE.md

@@ -52,10 +52,26 @@ npx -y agentera@next doctor --format json
 ```
 
 Before stable promotion, `prime --context status --format json` is the one-call
-bootstrap for clean, v2, partially migrated, and v3 projects. Marker-absent
-clean, v2, and partial projects return bounded `blocked` output with the exact
-full entity-upgrade recovery; v3 returns `ok` unless health is degraded. No
-recovery resolves `@latest`, and healthy v3 needs no second dashboard call.
+bootstrap for fresh, v2, partially migrated, and v3 projects. A Git-root project
+with no `.agentera` state is `fresh_uninitialized`: `prime --context plan` stays
+read-only and operable, and the first `state plan create` is its sole initializer.
+Recognized v2 remains on the full upgrade route; partial, corrupt, and unknown
+marker-absent state stays bounded and blocked behind read-only recovery. No fresh
+startup response recommends `upgrade --yes`, no recovery resolves `@latest`, and
+healthy v3 needs no second dashboard call.
+
+### Fresh Plan initialization
+
+For a fresh Git project, use the typed Plan writer. Its dry run previews the
+marker, plan, and task publication without changing the project; apply publishes
+the complete plan graph and then the entity-state marker, rolling back ordinary
+publication failures. Other state writers never initialize fresh state.
+
+```bash
+npx -y agentera@next prime --context plan --format json
+npx -y agentera@next state plan create --input PLAN.yaml --dry-run --format json
+npx -y agentera@next state plan create --input PLAN.yaml --format json
+```
 
 `doctor --format json` also reports bounded `retired_resources` candidates. Each
 entry has an exact retired resource ID, a path-only or fingerprint-safe
@@ -192,9 +208,9 @@ create dual authority, or add a repair or import command.
 
 ## Unsupported legacy state
 
-Pending v1 Markdown state and unknown marker-absent state are not automatic
-mutation inputs. `state migrate`, `state backfill`, projection repair, v1
-conversion, restore, and downgrade are unsupported. Only
+Pending v1 Markdown, partial, corrupt, and unknown marker-absent state are not
+automatic mutation inputs. `state migrate`, `state backfill`, projection repair,
+v1 conversion, restore, and downgrade are unsupported. Only
 `npx -y agentera@next upgrade --channel development --project "$PWD" --dry-run`
 may inventory cutover input; it cannot publish it.
 

package/bundle/references/adapters/package-publication.json

@@ -2,11 +2,11 @@
   "schemaVersion": "agentera.packagePublication.v2",
   "owner": "repository/package scripts",
   "invariants": {
-    "preparation": "Preparation is pure and registry-independent. It accepts an explicit target version and source commit, changes only package version and agentera.gitRef, and leaves the diff for review and commit.",
+    "preparation": "Preparation is pure and registry-independent. Serialized feat/v3 integration preparation requires a clean committed source tree, allocates exactly dev.N+1 locally, sets agentera.gitRef to that source HEAD, and changes only the development manifest for a final metadata commit. The manual readiness preparation path first validates a current normalized source receipt, then accepts an explicit target version and source commit. Stable preparation retains its separate source-provenance contract.",
     "sourceQualification": "Source qualification never repairs source. It issues a content-addressed receipt only after every declared source gate succeeds against a clean committed tree. A matching receipt is a deterministic local cache, not an authorization boundary.",
     "candidateQualification": "Candidate qualification validates a current source receipt, constructs one retained immutable tarball with the contract-required retained mode, proves dry-pack observation equivalence, and runs a local exact-artifact smoke in an empty isolated npm state before any registry effect.",
     "publication": "Registry publication consumes the retained candidate bytes through one measured stage, independent exact-version L2, and promote envelope. Stage and promotion include their required registry convergence and observational checks. The envelope never reconstructs an artifact, reruns source qualification, or rolls a tag back.",
-    "approval": "Registry mutation requires an explicit approval bound to the candidate receipt digest, target version, integrity, package, registry, and tag. A branch push is never approval.",
+    "approval": "Registry mutation requires an approval bound to the candidate receipt digest, target version, integrity, package, registry, and tag. A serialized push to feat/v3 may issue the development approval automatically only after the committed dev.N increment, source qualification, candidate qualification, and CI attestation pass. Stable publication retains explicit protected-environment review on main. A push never substitutes for candidate binding.",
     "replay": "A matching exact version, integrity, and required tag state is a successful no-upload replay. Conflicting integrity, an escaped artifact, a stale tag, or any unrecognized registry state fails before mutation.",
     "credentials": "Registry inspection runs before credentials are required. Only the npm mutation child receives a mode-0600 temporary user config. Tool probes and every npm, pnpm, and npx child, including receipt validation during stage and promotion, use isolated user/global config, home, cache, and sanitized npm/pnpm environments.",
     "output": "Every transaction phase emits a bounded start and end result with package, version, phase, outcome, elapsedMs, executed, reused, and nextAction. The qualified-publication coordinator emits one content-bound timing receipt in JSON or equivalent human output with measured component and total durations, strict budget status, first failure, reconciliation, and replay state. Diagnostics redact credentials and private absolute paths."
@@ -50,6 +50,23 @@
       "path": ".github/workflows/qualify-candidate.yml",
       "ref": "refs/heads/feat/v3"
     },
+    "developmentPush": {
+      "trigger": "push to refs/heads/feat/v3",
+      "versionAuthority": "packages/cli/package.json committed by the serialized local feat/v3 integrator",
+      "preparationCommand": "pnpm cli:prepare:dev-push -- --json",
+      "validationCommand": "pnpm cli:validate:dev-push -- --before-commit BEFORE --metadata-commit HEAD --json",
+      "rules": [
+        "BEFORE must be an ancestor of the source commit",
+        "HEAD must be one non-merge metadata-only commit after the source commit",
+        "source must retain the BEFORE development version",
+        "HEAD must increment dev.N exactly once and set agentera.gitRef to the source commit",
+        "routine CI defers its duplicate release conjunction on direct feat/v3 pushes",
+        "CI never allocates a version or uses github.run_number",
+        "reruns reuse the same version, candidate, and source run identity"
+      ],
+      "approval": "After exact candidate qualification and CI attestation, the workflow issues a machine candidate-bound development approval and publishes to next without a review environment.",
+      "concurrency": "The local integrator waits for the prior development workflow to finish before another push. One non-cancelling workflow group protects the active run; it is not used as an unbounded queue."
+    },
     "publicationRunBinding": {
       "beforeArtifactDownload": [
         "run.id",
@@ -69,6 +86,7 @@
   "qualification": {
     "source": {
       "component": "release-source",
+      "issuanceAuthority": "A new source receipt can be issued only by the contracted GitHub Actions qualification workflow at the committed checkout SHA. Existing valid receipts remain reusable through the read-only source check.",
       "inputs": [
         "tracked_tree_except_package_version_gitRef",
         "verification_policy",
@@ -97,6 +115,12 @@
           "owner": "packages/cli/scripts/verify-lane.mjs#performance",
           "correction": "pnpm -C packages/cli run test:performance"
         },
+        {
+          "name": "capacity",
+          "command": ["pnpm", "-C", "packages/cli", "run", "test:capacity"],
+          "owner": "packages/cli/scripts/verify-lane.mjs#capacity",
+          "correction": "pnpm -C packages/cli run test:capacity"
+        },
         {
           "name": "package",
           "command": ["pnpm", "-C", "packages/cli", "run", "verify:package"],
@@ -158,7 +182,7 @@
       ],
       "performanceEvidenceSchema": "agentera.entityAuthorityPerformanceEvidence.v1",
       "overlapEvidenceSchema": "agentera.generatedOverlapEvidence.v1",
-      "gateEvidence": "A source receipt contains the exact ten governed gates in contract order. Every gate has its governed origin and phase, outcome passed, a finite non-negative duration, the exact executed/reused shape, and gate-relevant observations. Digest validation precedes semantic validation; either kind of one-field tampering fails closed.",
+      "gateEvidence": "A source receipt contains the exact eleven governed gates in contract order. Every gate has its governed origin and phase, outcome passed, a finite non-negative duration, the exact executed/reused shape, and gate-relevant observations. Digest validation precedes semantic validation; either kind of one-field tampering fails closed.",
       "activationConjunction": {
         "gateIdentity": "agentera.activationConjunction.v1",
         "classes": ["cli", "capability", "runtime", "reference", "state", "package", "bootstrap"],
@@ -284,8 +308,8 @@
               "sha256": "2b48c82bb7ee10388d9ebb4fa7ea3743ea82a7e9aaedfcd5a858eeedb9d891ae"
             },
             "state": {
-              "count": 37,
-              "sha256": "ca87acdb0fda04ba46a52163fc30ec6578c077e61fcb64597f861a36fdce1dc4"
+              "count": 38,
+              "sha256": "7ab0dd6ef1b1b1ce66bd9ea94d1de3d542528233e928a44102e289bf12416681"
             },
             "package": {
               "count": 66,
@@ -297,22 +321,22 @@
             }
           },
           "total": {
-            "count": 279,
-            "sha256": "b92cd469f858e9584682d05b4d9bb03c2fc4b905f3485475723786c0a978c138"
+            "count": 280,
+            "sha256": "051ed9a57857a39e11ed8fb583bff9d2a67a306c5ab897a0ee829212468bc23a"
           }
         }
       },
       "reuseCheck": {
         "command": "node packages/cli/scripts/release-qualification.mjs source-check --candidate-dir DIR [--json]",
-        "precommitEnvironment": "AGENTERA_PRECOMMIT_SOURCE_CANDIDATE_DIR",
         "authority": "The external path is input only. Reuse requires digest, full receipt semantics, exact governed gates, current toolchain, and matching current staged and working tracked-tree identities under the same package version and agentera.gitRef normalization used at source qualification.",
         "effects": "Runs no qualification gate and writes no repository, candidate, receipt, or registry state. Success emits executed none and reused true without receipt content or private paths.",
-        "fallback": "An absent environment variable preserves existing routing. A missing, invalid, ambiguous, or stale receipt never skips tests; pre-commit runs the existing broader policy.",
-        "scope": "Reused source evidence may skip only scripts/precommit-vitest.sh source/release policy execution. Build, compact, parity, candidate qualification, release metadata, approval, and publication remain mandatory at their owning stages."
+        "fallback": "A missing, invalid, ambiguous, or stale receipt fails before manual readiness metadata effects. Serialized integration preparation and the local staged-verification lane do not consume release receipts.",
+        "scope": "Manual readiness preparation uses the check as a source-readiness prerequisite. Direct diagnostics may inspect reuse without executing a gate. Build, compact, parity, candidate qualification, release metadata, approval, and publication remain mandatory at their owning stages."
       },
       "dag": {
         "batchA": ["generated-overlap", "stress", "typecheck"],
         "performanceBarrier": ["performance"],
+        "capacityBarrier": ["capacity"],
         "generatedOverlapOrigins": ["source", "package", "build", "generated-overlap"],
         "barrierB": ["compact", "capability-contract", "activation-conjunction"],
         "generatedOutputWriter": "generated-overlap",
@@ -323,10 +347,29 @@
           "capability-contract": 3000,
           "activation-conjunction": 6000
         },
-        "failure": "The coordinator passes generated-overlap and the solo performance barrier the actual source deadline. Overlap stops owned work 10000ms before that deadline, settles and cleans its generated state, and returns at least 4000ms before the deadline for parent reconciliation. The first observed owner failure cancels only cancellable process groups. generated-overlap is cooperatively stopped and never force-killed; performance, barrier B, and receipt issuance remain blocked after any batch failure, and barrier B and receipt issuance remain blocked after any performance failure.",
-        "isolation": "Every child receives a distinct HOME, cache, user config, global config, and report output. Batch A provides output isolation. Performance additionally runs alone after batch A settles to provide resource isolation for machine-sensitive evidence."
+        "failure": "The coordinator passes generated-overlap, the solo performance barrier, and the serial capacity barrier the actual source deadline. Overlap stops owned work 10000ms before that deadline, settles and cleans its generated state, and returns at least 4000ms before the deadline for parent reconciliation. The first observed owner failure cancels only cancellable process groups. generated-overlap is cooperatively stopped and never force-killed; performance, capacity, barrier B, and receipt issuance remain blocked after any batch failure, capacity, barrier B, and receipt issuance remain blocked after any performance failure, and barrier B and receipt issuance remain blocked after any capacity failure.",
+        "isolation": "Every child receives a distinct HOME, cache, user config, global config, and report output. Batch A provides output isolation. Performance runs alone with one worker on the policy-declared authoritative runner after batch A settles. Capacity then runs serially before the reader barrier."
       },
-      "parallelism": "Batch A runs generated-overlap, stress, and typecheck concurrently. generated-overlap is the sole checkout generated-output writer and sole execution origin for source, package, build, and overlap evidence. After batch A settles and passes, performance runs alone in fresh isolated state. After performance passes, compact, capability-contract, and activation-conjunction run concurrently as readers of the settled generation."
+      "parallelism": "Batch A runs generated-overlap, stress, and typecheck concurrently. generated-overlap is the sole checkout generated-output writer and sole execution origin for source, package, build, and overlap evidence. After batch A settles and passes, performance runs alone in fresh isolated state with one worker. Capacity runs alone after performance. After capacity passes, compact, capability-contract, and activation-conjunction run concurrently as readers of the settled generation."
+    },
+    "readiness": {
+      "schemaVersion": "agentera.releaseReadiness.v1",
+      "component": "release-readiness",
+      "adapter": "development",
+      "command": "node packages/cli/scripts/release-readiness.mjs development --candidate-dir DIR --target-version VERSION --source-commit COMMIT [--metadata-commit COMMIT] [--json]",
+      "phases": ["source-readiness", "metadata-review", "candidate-readiness"],
+      "receipts": {
+        "source": "source-receipt.json",
+        "candidate": "candidate-receipt.json"
+      },
+      "reuse": "A present source receipt is validated with the source reuse check instead of invoking source qualification. A present candidate receipt and retained artifact are validated instead of invoking candidate qualification. Invalid, stale, incomplete, or mismatched evidence rejects the run before an issuance owner starts.",
+      "metadataReview": "A successful source qualification or source-receipt reuse pauses before candidate construction until the caller supplies the explicit reviewed metadata commit. The coordinator never prepares metadata, changes a version, commits, approves, rebuilds a valid candidate, stages bytes, or mutates registry state.",
+      "outcomes": ["paused", "ready", "rejected"],
+      "exitCodes": {
+        "paused": 0,
+        "ready": 0,
+        "rejected": 1
+      }
     },
     "candidate": {
       "component": "release-candidate",
@@ -359,7 +402,7 @@
   },
   "trust": {
     "local": "A same-principal source receipt is a deterministic cache only. It cannot authorize registry mutation.",
-    "ci": "CI registry mutation requires the transferred exact artifact and receipts, a CI attestation bound to the candidate receipt and source run, and an explicit candidate-bound approval. OIDC provenance is deferred."
+    "ci": "CI registry mutation requires the transferred exact artifact and receipts, a CI attestation bound to the candidate receipt and source run, and a candidate-bound approval. The feat/v3 push workflow may issue development approval automatically after every prior bound check passes; stable main publication requires protected-environment review. OIDC provenance is deferred."
   },
   "registryStateTable": [
     {
@@ -400,7 +443,7 @@
     "fixture": "clean committed checkout and an external empty candidate directory; no tracked or checkout-local generated candidate files.",
     "cacheNetwork": "Preflight uses no registry call. Every qualification DAG child and each smoke use a distinct empty HOME, npm cache, user config, global config, and report output; public npm dependency network access is allowed and recorded as cold-cache. Publication reads the registry before credentials.",
     "repetitions": 3,
-    "statistic": "Qualification reports median wall milliseconds over exactly three cold-cache repetitions. Concurrent owner-duration totals are reported separately; only owners in the same parallel phase overlap, while the solo performance barrier contributes ordered wall time. Phase timing reconciles through measured DAG wall time rather than by summing nested owner durations. Qualified publication reports one actual approved transaction because registry mutation is not a benchmark repetition; replays run the same measured envelope and report reused registry phases.",
+    "statistic": "Qualification reports median wall milliseconds over exactly three cold-cache repetitions. Concurrent owner-duration totals are reported separately; only owners in the same parallel phase overlap, while the solo performance and serial capacity barriers contribute ordered wall time. Phase timing reconciles through measured DAG wall time rather than by summing nested owner durations. Qualified publication reports one actual approved transaction because registry mutation is not a benchmark repetition; replays run the same measured envelope and report reused registry phases.",
     "coordinator": "packages/cli/scripts/release-benchmark.mjs has separate qualification and publication commands. qualification runs only preflight and source-plus-candidate qualification and never receives npm credentials. publication runs only the approved stage, independent exact-version L2, and promote commands, measures them with one monotonic deadline, and never runs source qualification.",
     "qualifiedPublication": {
       "command": "node packages/cli/scripts/release-benchmark.mjs publication --adapter ADAPTER --candidate-dir DIR --receipt-file FILE",
@@ -423,10 +466,18 @@
     },
     "timeouts": {
       "preflightMs": 30000,
-      "sourceQualificationMs": 420000,
+      "sourceQualificationMs": 2400000,
       "qualifiedPublicationMs": 120000
     },
-    "failureRule": "The first observed failing owner remains the reported label. Cancellable peers are stopped, generated-overlap is allowed to settle without forced termination, barrier B and receipt issuance are blocked, and completed/cancelled failures are reported. No timeout or failure authorizes repair, candidate work, or registry mutation."
+    "failureRule": "The first observed failing owner remains the reported label. Cancellable peers are stopped, generated-overlap is allowed to settle without forced termination, barrier B and receipt issuance are blocked, and completed/cancelled failures are reported. No timeout or failure authorizes repair, candidate work, or registry mutation.",
+    "workflow": {
+      "path": ".github/workflows/qualification-benchmark.yml",
+      "trigger": "workflow_dispatch only until default-branch scheduling is explicitly authorized",
+      "checkoutRef": "refs/heads/feat/v3",
+      "command": "pnpm cli:benchmark:qualification -- --adapter development --candidate-root DIR --json",
+      "retainedReport": "qualification-benchmark-${{ github.run_id }}",
+      "credentials": "No npm token, approval, publication, stage, promote, or registry mutation path is present."
+    }
   },
   "bounds": {
     "registryAttempts": 6,