amsd-pipeline-shared 0.5.6 → 0.5.8

package/orchestrations/config/doctor-signatures.json

@@ -3,7 +3,8 @@
   "node": {
     "runtimeNames": ["TypeError", "ReferenceError", "SyntaxError", "RangeError"],
     "runtimeMessage": "Unexpected token|is not valid JSON|Unexpected end of JSON|Cannot read propert|Cannot set propert|is not a function|is not defined|is not iterable|Cannot destructure|is not a constructor|Invalid array length|Maximum call stack",
-    "external": "\\bE(NOSPC|ACCES|PERM|MFILE|NOMEM|CONNRESET|CONNREFUSED|TIMEDOUT|NOTFOUND|AI_AGAIN|PIPE)\\b|bounded: cap|exited (137|143)\\b|\\b(401|403|429|500|502|503|529)\\b|overloaded|rate.?limit|credit|quota|<!DOCTYPE|<html|out of memory|killed",
+    "external": "\\bE(NOSPC|ACCES|PERM|MFILE|NOMEM|CONNRESET|CONNREFUSED|TIMEDOUT|NOTFOUND|AI_AGAIN|PIPE)\\b|bounded: REFUSED|exited (137|143)\\b|\\b(401|403|429|500|502|503|529)\\b|overloaded|rate.?limit|credit|quota|<!DOCTYPE|<html|out of memory|killed",
+    "ownBudget": "bounded: cap=\\d+MB",
     "generalRefusal": "refused|usage:",
     "internalFrame": "^node:",
     "dependencyDir": "node_modules"

package/orchestrations/scripts/lib/doctor/classify.js

@@ -19,12 +19,16 @@ function signaturesFor(runtime, injected) {
   const all = injected || JSON.parse(fs.readFileSync(path.join(__dirname, '..', '..', '..', 'config', 'doctor-signatures.json'), 'utf8'));
   const s = all[runtime];
   if (!s) throw new Error(`no signatures for runtime "${runtime}" (config/doctor-signatures.json knows: ${Object.keys(all).filter((k) => !k.startsWith('$')).join(', ')})`);
-  return { runtimeNames: new Set(s.runtimeNames), runtimeMessage: rxOf(s.runtimeMessage), external: rxOf(s.external), generalRefusal: rxOf(s.generalRefusal),
+  return { runtimeNames: new Set(s.runtimeNames), runtimeMessage: rxOf(s.runtimeMessage), external: rxOf(s.external), ownBudget: s.ownBudget ? rxOf(s.ownBudget) : /$^/, generalRefusal: rxOf(s.generalRefusal),
     internalFrame: rxOf(s.internalFrame), dependencyDir: s.dependencyDir };
 }
 
 function classify({ profile, portRoot, res, crash, aborted, since, signatures, evidence }) {
   const sig = signaturesFor(profile.classify.runtime, signatures);
+  const takesMost = profile.classify.policy === 'all-but-refusals';
+  // WHAT IS EXTERNAL: the machine, the network, the model service, a kill. Under "all-but-refusals" a kill that happened inside the pipeline's OWN memory budget (the bounded wrapper's start banner is in the text:
+  // the cap the pipeline chose, so what ran inside it is the pipeline's to bound — run 11, jest workers inside a Writer session's cap) is not external
+  const isExternal = (text) => sig.external.test(text) && !(takesMost && sig.ownBudget.test(text));
   if (!res || typeof res !== 'object') return no('no-result', 'the leg gave no result');
   if (aborted) return no('aborted', 'the operator or a watcher ended the leg');
   // AN AGENT-CAUSED ABORT (operator, 2026-10-20: look for the agentic solution first): a failed leg whose reason is one of the pipeline's own agent-caused
@@ -39,19 +43,30 @@ function classify({ profile, portRoot, res, crash, aborted, since, signatures, e
       // has a number and its reason and matches none. The marked line is still refused if it names the machine, the network, the model service or a kill.
       const line = evidence && profile.classify.faultMarks.length ? String(evidence).split('\n').find((l) => profile.classify.faultMarks.some((r) => r.test(l))) : null;
       if (line) {
-        if (sig.external.test(line)) return no('external', `the failing line also names the machine, the network, the model service or a kill — not the pipeline: ${line.slice(0, 160)}`);
+        if (isExternal(line)) return no('external', `the failing line also names the machine, the network, the model service or a kill — not the pipeline: ${line.slice(0, 160)}`);
         return { call: true, kind: 'fault', layer: 'undecided', why: `the leg failed without a verdict: ${line.trim().slice(0, 200)}` };
       }
+      // MOST FAILURES (profile classify.policy "all-but-refusals"): the pipeline's own refusals are its decision and what names the machine, the network, the model service or a kill is not the code —
+      // everything else, self-heal giving up included, goes to the doctor, which still needs a RED test and a GREEN fix to change anything. Judged on the reason and the END of the evidence.
+      if (profile.classify.policy === 'all-but-refusals') {
+        const lines = String(evidence || '').split('\n').filter((l) => l.trim());
+        const window = [reason, ...lines.slice(-25)].filter(Boolean).join('\n');
+        if (!window.trim()) return no('not-a-crash', 'the leg failed with no reason and no evidence — nothing to investigate');
+        if (isExternal(window)) return no('external', 'the end of the failure also names the machine, the network, the model service or a kill — not the pipeline');
+        if (profile.classify.refusals.some((r) => r.test(window))) return no('refusal', 'the pipeline stopped on purpose (its own refusal or pre-condition)');
+        const last = [...lines].reverse().find((l) => /fail|HALT|block|error/i.test(l)) || reason;
+        return { call: true, kind: 'failure', layer: 'undecided', why: `the leg failed (${reason || 'no reason'}): ${String(last).trim().slice(0, 200)}` };
+      }
       return no('not-a-crash', 'the leg failed on a verdict that names no agent-caused message — reported, not repaired');
     }
-    if (sig.external.test(reason)) return no('external', 'the agent-caused message also names the machine, the network, the model service or a kill — not the pipeline');
+    if (isExternal(reason)) return no('external', 'the agent-caused message also names the machine, the network, the model service or a kill — not the pipeline');
     return { call: true, kind: 'agentic-abort', layer: 'agentic', why: `an agent caused the abort: ${reason.slice(0, 200)}` };
   }
   if (res.status !== 'crashed') return no(res.status === 'no-answer' ? 'no-record' : 'not-a-crash', `the leg ended ${res.status}, not crashed — a kill, a verdict or a pause is reported, not repaired`);
   if (!crash || typeof crash !== 'object') return no('no-record', 'no crash record: nothing proves a defect in the code');
   if (!crash.at || !since || Date.parse(crash.at) < Date.parse(since)) return no('stale-record', 'the crash record is older than this leg');
   const text = `${crash.name || ''}: ${crash.message || ''}`;
-  if (sig.external.test(text)) return no('external', 'the failure names the machine, the network, the model service or a kill — not the code');
+  if (isExternal(text)) return no('external', 'the failure names the machine, the network, the model service or a kill — not the code');
   if (sig.generalRefusal.test(text) || profile.classify.refusals.some((r) => r.test(text))) return no('refusal', 'the pipeline stopped on purpose');
   const site = (crash.frames || []).find((f) => f && typeof f.file === 'string' && !sig.internalFrame.test(f.file)) || null;
   if (!site) return no('outside-port', 'no frame of the stack is in any file');
@@ -60,6 +75,8 @@ function classify({ profile, portRoot, res, crash, aborted, since, signatures, e
   const inPort = !!portRoot && !rel.startsWith('..') && !path.isAbsolute(rel) && profile.scope.repairDirs.includes(parts[0]) && !parts.includes(sig.dependencyDir);
   if (!inPort) return no('outside-port', `the throw site ${site.file}:${site.line} is not the component's own code`);
   if (crash.fault === true) return { call: true, kind: 'fault', layer: 'undecided', why: `a fault the component raised: ${String(crash.message).slice(0, 160)} — at ${rel}:${site.line}${crash.step ? ` (step: ${crash.step})` : ''}` };
+  // under "all-but-refusals" an Error thrown by the component's own code is the doctor's even without a runtime-exception mark (run 11: `the live session for writer exited null`)
+  if (takesMost && !sig.runtimeNames.has(crash.name) && !sig.runtimeMessage.test(crash.message || '')) return { call: true, kind: 'crash', layer: 'undecided', why: `${crash.name}: ${String(crash.message).slice(0, 160)} — thrown at ${rel}:${site.line}${crash.step ? ` (step: ${crash.step})` : ''}` };
   if (!sig.runtimeNames.has(crash.name) && !sig.runtimeMessage.test(crash.message || '')) return no('ambiguous', `an Error in ${rel}:${site.line} with no sign of a code defect — reported`);
   return { call: true, kind: 'port-defect', layer: 'code', why: `${crash.name}: ${String(crash.message).slice(0, 160)} — thrown at ${rel}:${site.line}${crash.step ? ` (step: ${crash.step})` : ''}` };
 }

package/orchestrations/scripts/lib/doctor/handle.js

@@ -12,7 +12,7 @@ const path = require('path');
 const { spawnSync } = require('child_process');
 const { classify } = require('./classify.js');
 const { settings, open } = require('./state.js');
-const { verifyRepair, reinstall, installedMismatches, checkComponent, snapshotRepos, repoChanges } = require('./repair.js');
+const { verifyRepair, reinstall, installedMismatches, checkComponent, snapshotRepos, repoChanges, promote } = require('./repair.js');
 const { renderPrompt } = require('./agent.js');
 const { restart } = require('./restarter.js');
 
@@ -30,7 +30,9 @@ async function handle(a) {
   const portRoot = path.join(install, profile.install.dest);
 
   // the leg's evidence tail (the files the profile names), read BEFORE the decision: a failure that threw nothing is judged on what the run itself wrote
-  const evidence = profile.logs.evidence.map((f) => tail(path.join(runDir, f), profile.logs.evidenceTailLines)).join('\n');
+  // the logs are cumulative across legs: the decision reads only what follows the last leg-start line in each file (the whole tail when the profile names none or the tail holds none)
+  const thisLeg = (text) => { if (!profile.logs.legStart) return text; const ls = text.split('\n'); let at = -1; ls.forEach((l, i) => { if (profile.logs.legStart.test(l)) at = i; }); return at < 0 ? text : ls.slice(at).join('\n'); };
+  const evidence = profile.logs.evidence.map((f) => thisLeg(tail(path.join(runDir, f), profile.logs.evidenceTailLines))).join('\n');
   const c = classify({ profile, portRoot, res, crash, aborted, since, evidence });
   if (!c.call) { d.event('not-called', { kind: c.kind, why: c.why }); return { handled: false, kind: c.kind, why: c.why }; }
   d.event('trigger', { kind: c.kind, layer: c.layer, why: c.why, step: (crash && crash.step) || '' });
@@ -109,6 +111,10 @@ async function handle(a) {
     fs.writeFileSync(path.join(A, 'reinstall.txt'), `${ri.installer || ''}\n${ri.why}\n${(ri.mismatches || []).join('\n')}\n`);
     if (!ri.ok) return stop('reinstall-failed', ri.why);
     d.event('reinstalled', { layer, commit: ri.commit, files: v.files }, attempt.n);
+    // PROMOTE: the main line follows the install (local, never forced) — otherwise the next repair in this run would be refused as "repo-not-installed"
+    const pr = promote({ repo, commit: ri.commit });
+    if (pr.ok) d.event('promoted', { from: pr.from, to: pr.to, branch: pr.branch }, attempt.n);
+    else { d.event('promote-skipped', { why: pr.why }, attempt.n); alert(`repair installed but not promoted: ${pr.why} — the repository's HEAD is not what is installed, so the next repair would be refused until it is`); }
 
     fs.writeFileSync(path.join(A, 'verdict.json'), `${JSON.stringify({ status: 'repaired', layer, layerWhy: r.answer.layerWhy, summary: r.answer.summary, cause: r.answer.cause, files: v.files, branch, commit: ri.commit }, null, 2)}\n`);
     d.event('repaired', { layer, layerWhy: r.answer.layerWhy, summary: r.answer.summary, cause: r.answer.cause, branch, commit: ri.commit }, attempt.n);

package/orchestrations/scripts/lib/doctor/profile.js

@@ -79,14 +79,48 @@ function validate(input) {
     if (need('classify', cl, 'refusals')) out.classify.refusals = rxs('classify.refusals', cl.refusals);
     // THE LINES THAT MEAN "THE MACHINERY GAVE NO VERDICT" (optional; none = a failed leg is never taken for a fault): a pipeline's own knowledge, matched against the leg's evidence tail
     out.classify.faultMarks = cl.faultMarks === undefined ? [] : rxs('classify.faultMarks', cl.faultMarks);
+    // WHICH FAILED LEGS CALL THE DOCTOR (operator, 2026-10-20: "let the doctor fix most issues … unless the pipeline decides it"): "faults-only" (default) = a crash, an agentic abort or a marked
+    // fault; "all-but-refusals" = every failed leg except an operator abort, an external failure and the pipeline's own refusals (classify.refusals)
+    out.classify.policy = cl.policy === undefined ? 'faults-only' : cl.policy;
+    if (!['faults-only', 'all-but-refusals'].includes(out.classify.policy)) bad('classify.policy', 'must be "faults-only" or "all-but-refusals"');
   }
 
   const se = p.settings;
   if (se) {
     out.settings = {};
     for (const k of ['on', 'restarts', 'repo', 'budget']) if (need('settings', se, k)) { const v = str(`settings.${k}`, se[k]); if (v !== null && !ENV_NAME.test(v)) bad(`settings.${k}`, `"${v}" must be an environment variable name (A-Z, 0-9, _)`); else out.settings[k] = v; }
-    const names = ['on', 'restarts', 'repo', 'budget'].map((k) => se[k]).filter(Boolean);
-    if (new Set(names).size !== names.length) bad('settings', 'the four setting names must be different');
+    // the release setting is optional, and required by a release section: a pipeline that publishes says which launch setting is the operator's yes
+    if (has(se, 'release')) { const v = str('settings.release', se.release); if (v !== null && !ENV_NAME.test(v)) bad('settings.release', `"${v}" must be an environment variable name (capital letters, digits, underscores)`); else if (v !== null) out.settings.release = v; }
+    const names = ['on', 'restarts', 'repo', 'budget', 'release'].map((k) => se[k]).filter(Boolean);
+    if (new Set(names).size !== names.length) bad('settings', 'the setting names must be different');
+  }
+
+  // THE RELEASE (operator, 2026-10-20: "get doctor to commit and update npm and update install as well"): optional. The pipeline lists, as data, the commands that turn the promoted
+  // repairs into a published version and put it in the install; the doctor runs them in order, stops at the first failure, and runs them only when the operator's setting says yes.
+  if (has(p, 'release')) {
+    const r = p.release; out.release = {};
+    if (!r || typeof r !== 'object' || Array.isArray(r)) bad('release', 'an object is required');
+    else {
+      const TOKENS = new Set(['node', 'repo', 'worktree', 'install', 'run', 'package', 'version', 'tag']);
+      const cmd = (path, v) => {
+        const x = strs(path, v, { nonEmpty: true }); if (!x) return null;
+        for (const w of x) for (const m of w.matchAll(/\{([a-zA-Z]+)\}/g)) if (!TOKENS.has(m[1])) bad(path, `unknown token {${m[1]}} (known: ${[...TOKENS].map((t) => `{${t}}`).join(' ')})`);
+        return x;
+      };
+      if (need('release', r, 'versionFile')) out.release.versionFile = rel('release.versionFile', r.versionFile);
+      if (need('release', r, 'tag')) { out.release.tag = str('release.tag', r.tag); if (out.release.tag && !out.release.tag.includes('{version}')) bad('release.tag', 'must contain {version}'); }
+      if (need('release', r, 'steps')) {
+        if (!Array.isArray(r.steps) || !r.steps.length) bad('release.steps', 'a non-empty list of { name, command } is required');
+        else out.release.steps = r.steps.map((st, i) => ({ name: str(`release.steps[${i}].name`, st && st.name), command: cmd(`release.steps[${i}].command`, st && st.command) }));
+      }
+      if (need('release', r, 'reinstall')) {
+        const ri = r.reinstall || {};
+        out.release.reinstall = { command: cmd('release.reinstall.command', ri.command), retries: 0, delaySeconds: 0 };
+        if (!Number.isInteger(ri.retries) || ri.retries < 0) bad('release.reinstall.retries', 'a whole number, 0 or more, is required'); else out.release.reinstall.retries = ri.retries;
+        if (typeof ri.delaySeconds !== 'number' || ri.delaySeconds < 0) bad('release.reinstall.delaySeconds', 'a number of seconds, 0 or more, is required'); else out.release.reinstall.delaySeconds = ri.delaySeconds;
+      }
+      if (!has(se || {}, 'release')) bad('settings.release', 'a release section needs the launch setting that switches it on');
+    }
   }
 
   if (p.restart) { if (need('restart', p.restart, 'args')) out.restart = { args: strs('restart.args', p.restart.args, { nonEmpty: true }) }; }
@@ -100,6 +134,8 @@ function validate(input) {
     if (need('logs', lg, 'dir')) out.logs.dir = rel('logs.dir', lg.dir);
     if (need('logs', lg, 'alerts')) out.logs.alerts = file('logs.alerts', lg.alerts);
     if (need('logs', lg, 'evidence')) { const v = strs('logs.evidence', lg.evidence, { nonEmpty: false }); if (v) { v.forEach((d, n) => rel(`logs.evidence[${n}]`, d)); out.logs.evidence = v; } }
+    // the line each leg of a run starts with (optional): the evidence the doctor DECIDES on is what follows its last occurrence — the logs are cumulative across legs
+    if (has(lg, 'legStart')) out.logs.legStart = rx('logs.legStart', lg.legStart);
     if (need('logs', lg, 'evidenceTailLines')) { if (!Number.isInteger(lg.evidenceTailLines) || lg.evidenceTailLines < 1) bad('logs.evidenceTailLines', 'a positive whole number is required'); else out.logs.evidenceTailLines = lg.evidenceTailLines; }
   }
 

package/orchestrations/scripts/lib/doctor/release.js

@@ -0,0 +1,78 @@
+'use strict';
+// THE DOCTOR'S RELEASE (operator, 2026-10-20: "get doctor to commit and update npm and update install as well"). A verified repair is in the install and, once promoted, at the repository's HEAD. A release makes
+// it a published version: the pipeline's profile lists the commands (a version bump, a commit, a tag, a push, a publish — whatever that pipeline's registry needs) and the command that puts the
+// published package in the install again. Nothing here knows npm, git hosting or any pipeline: the steps are the profile's data, the tokens are {node} {repo} {worktree} {install} {run} {package}
+// {version} {tag}, and the operator's launch setting (profile settings.release = yes) is the standing yes — without it nothing runs and nothing is written. It runs once, at the END of a leg, for
+// every repair of this run not yet released; stops at the first failing step (no rollback — it says how far it got); and never runs on a dirty checkout or an install that is not at HEAD.
+//   release({ profile, runDir, outDir, install, values, runId, deps? }) → { released, why?, stopped?, version?, tag? }
+const fs = require('fs');
+const path = require('path');
+const { spawnSync } = require('child_process');
+const { settings, open } = require('./state.js');
+const { installedMismatches, checkComponent } = require('./repair.js');
+
+const git = (repo, ...a) => spawnSync('git', ['-C', repo, ...a], { encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
+const readJson = (f, d) => { try { return JSON.parse(fs.readFileSync(f, 'utf8')); } catch { return d; } };
+const sleep = (s) => new Promise((r) => setTimeout(r, Math.round(s * 1000)));
+
+function fill(words, tokens) { return words.map((w) => w.replace(/\{([a-zA-Z]+)\}/g, (m, k) => (k in tokens ? tokens[k] : m))); }
+const tail = (r) => `${r.stderr || ''}${r.stdout || ''}`.trim().slice(-400);
+
+async function release({ profile, runDir, outDir, install, values, runId, deps }) {
+  const rc = profile.release; const cfg = settings(values, profile);
+  if (!rc || !cfg.release) return { released: false, why: 'the release is off' };
+  const alert = (text) => { try { fs.mkdirSync(outDir, { recursive: true }); fs.appendFileSync(path.join(outDir, profile.logs.alerts), `${new Date().toISOString()} DOCTOR ${text}\n`); } catch { /* the doctor's own log has it */ } };
+  if (!cfg.on) { alert(`release not run: ${cfg.problem || 'the doctor is off'}`); return { released: false, why: cfg.problem || 'the doctor is off' }; }
+  const d = open(runDir, cfg, profile);
+  const skip = (why) => { d.event('release-skipped', { why }); alert(`release skipped: ${why}`); return { released: false, why }; };
+
+  const recFile = path.join(install, profile.install.dest, profile.install.patchRecord);
+  const rec = readJson(recFile, null);
+  const mine = ((rec && rec.patches) || []).filter((p) => p.run === runId && !p.released);
+  if (!mine.length) return { released: false, why: 'nothing to release: no repair of this run in the install, or all are released already' };
+
+  const comp = checkComponent({ repo: cfg.repo, profile, protectedRepos: [] });
+  if (!comp.ok) return skip(comp.why);
+  const repo = comp.root;
+  if (git(repo, 'status', '--porcelain', '--untracked-files=no').stdout.trim()) return skip('the repository has uncommitted changes — a release needs a clean checkout');
+  const stale = installedMismatches({ repo, branch: 'HEAD', install, profile });
+  if (stale.length) return skip(`the install is not at the repository's HEAD (${stale.slice(0, 4).join(', ')}) — the repairs were not promoted`);
+  for (const p of mine) if (git(repo, 'merge-base', '--is-ancestor', p.commit, 'HEAD').status !== 0) return skip(`the repair ${String(p.commit).slice(0, 9)} is not part of HEAD`);
+
+  const version = () => { const j = readJson(path.join(repo, rc.versionFile), {}); return String(j.version || ''); };
+  const tokens = () => { const v = version(); return { node: process.execPath, repo, worktree: repo, install, run: runId, package: profile.component.package, version: v, tag: rc.tag.replace('{version}', v) }; };
+  const done = [];
+  const run = (words) => { const c = fill(words, tokens()); return (deps && deps.spawn ? deps.spawn : spawnSync)(c[0], c.slice(1), { cwd: repo, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 }); };
+  const stop = (step, r) => {
+    d.event('release-failed', { step, status: r.status, tail: tail(r), done });
+    alert(`release stopped at ${step} (exit ${r.status}): ${tail(r).slice(-200)} — done so far: ${done.length ? done.join(', ') : 'nothing'}; the repository is at ${git(repo, 'rev-parse', '--short', 'HEAD').stdout.trim()}; nothing is rolled back`);
+    return { released: false, stopped: step, why: `${step} failed`, done };
+  };
+  d.event('release-start', { repairs: mine.map((p) => p.commit), from: version() });
+  for (const st of rc.steps) {
+    const r = run(st.command);
+    if (r.status !== 0) return stop(st.name, r);
+    done.push(st.name);
+  }
+  const ver = version(); const tag = tokens().tag;
+  let last = null;
+  for (let n = 0; n <= rc.reinstall.retries; n += 1) {
+    last = run(rc.reinstall.command);
+    if (last.status === 0) break;
+    if (n < rc.reinstall.retries) await sleep(rc.reinstall.delaySeconds);
+  }
+  if (!last || last.status !== 0) return stop('reinstall', last || { status: null, stdout: '', stderr: 'not run' });
+  done.push('reinstall');
+  const left = installedMismatches({ repo, branch: 'HEAD', install, profile });
+  if (left.length) { d.event('release-failed', { step: 'verify', mismatches: left, done }); alert(`release stopped at verify: the install differs from HEAD after the reinstall (${left.slice(0, 4).join(', ')})`); return { released: false, stopped: 'verify', why: 'the install differs from HEAD after the reinstall', done }; }
+
+  const at = new Date().toISOString();
+  const fresh = readJson(recFile, rec) || rec;
+  fresh.patches = (fresh.patches || []).map((p) => (p.run === runId && !p.released ? { ...p, released: { version: ver, tag, at } } : p));
+  fs.writeFileSync(recFile, `${JSON.stringify(fresh, null, 2)}\n`);
+  d.event('released', { version: ver, tag, repairs: mine.length, done });
+  alert(`released ${profile.component.package}@${ver} (${tag}): ${mine.length} repair(s) of ${runId} — ${done.join(' → ')}; the install is the published package`);
+  return { released: true, version: ver, tag, done };
+}
+
+module.exports = { release };

package/orchestrations/scripts/lib/doctor/repair.js

@@ -163,4 +163,19 @@ function repoChanges(before, after) {
   return out;
 }
 
-module.exports = { verifyRepair, reinstall, installedMismatches, packaged, checkComponent, snapshotRepos, repoChanges, expand, hostWrap };
+/**
+ * PROMOTE (operator, 2026-10-20): after a verified repair is installed, the repository's main line is fast-forwarded to the repair commit, so HEAD equals what is installed — without it the next
+ * repair is refused (repo-not-installed). Local and reversible; never forced: a detached HEAD, uncommitted changes, or a main line that moved since the repair branched are said and left alone.
+ */
+function promote({ repo, commit }) {
+  const cur = git(repo, 'symbolic-ref', '-q', '--short', 'HEAD');
+  if (cur.status !== 0) return bad('the repository is on a detached HEAD — there is no main line to move');
+  if (git(repo, 'status', '--porcelain', '--untracked-files=no').stdout.trim()) return bad('the repository has uncommitted changes — a fast-forward would be merged over them');
+  const from = git(repo, 'rev-parse', 'HEAD').stdout.trim();
+  if (git(repo, 'merge-base', '--is-ancestor', 'HEAD', commit).status !== 0) return bad(`the main line (${cur.stdout.trim()}) moved since the repair branched — it is not an ancestor of the repair, so no fast-forward is possible`);
+  const m = git(repo, 'merge', '--ff-only', '-q', commit);
+  if (m.status !== 0) return bad(`the fast-forward failed: ${(m.stderr || m.stdout).trim().slice(-300)}`);
+  return { ok: true, from, to: commit, branch: cur.stdout.trim() };
+}
+
+module.exports = { promote, verifyRepair, reinstall, installedMismatches, packaged, checkComponent, snapshotRepos, repoChanges, expand, hostWrap };

package/orchestrations/scripts/lib/doctor/state.js

@@ -17,7 +17,7 @@ function settings(values, profile) {
   const wants = v[n.on] === 'on';
   const lacks = [!repo && `${n.repo} — the checkout of ${profile.component.package} it repairs`, !budget && `${n.budget} — a spending cap in dollars for one repair session (a positive number)`].filter(Boolean);
   const problem = wants && lacks.length ? `${n.on}=on needs ${lacks.join(' and ')}` : null;
-  return { on: wants && !!repo && !!budget, restarts, repo, budget, problem };
+  return { on: wants && !!repo && !!budget, restarts, repo, budget, problem, release: !!n.release && v[n.release] === 'yes' };
 }
 
 const readJson = (f, dflt) => { try { return JSON.parse(fs.readFileSync(f, 'utf8')); } catch { return dflt; } };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amsd-pipeline-shared",
-  "version": "0.5.6",
+  "version": "0.5.8",
   "description": "The AMSD pipeline's shared components, one source for the bash pipeline and its Claude workflows: the model-call gateway (llm-handler.sh — retry, ladder, self-heal, cost) and the libraries it runs.",
   "license": "UNLICENSED",
   "bin": {