code-foundry 1.18.0 → 1.19.0

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.19.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.18.0...v1.19.0) (2026-09-09)
+
+
+### Features
+
+* **fleet:** gate upgrades on verified release qualification ([#548](https://github.com/0xPlayerOne/code-foundry/issues/548)) ([3247cc6](https://github.com/0xPlayerOne/code-foundry/commit/3247cc6f2295c65c42bb43e4ec8f87a08f3dd02d))
+
 ## [1.18.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.17.0...v1.18.0) (2026-09-09)
 
 

package/docs/PERFORMANCE.md

@@ -23,17 +23,11 @@ The performance workflow disables build-cache reads and writes for this task.
 That makes timing comparisons independent of a warm protected-branch cache and
 prevents benchmark code from populating shared cache entries.
 
-The consumer qualification workflow adds the installed-package harness and
-workflow contract to the distributable. The merged candidate measured 221,495
-packed bytes, 853,573 unpacked bytes, and 100 files on Node 24.18.0; the updated
-budgets leave a small margin while continuing to bound package growth. The
-product-quality profiles and consumer qualification workflow measured 232,650
-packed bytes, 890,418 unpacked bytes, and 103 files on Node 24.18.0, so the
-limits remain intentionally bounded while covering both opt-in feature sets.
-The qualified-publication workflow adds the release staging and publication
-contract to the distributable. This candidate measured 238,816 packed bytes,
-915,957 unpacked bytes, and 106 files on Node 24.18.0; the 250 kB and 930 kB
-limits retain a measured margin while covering the required release path.
+The merged candidate includes the release-integrity verifier, fleet eligibility,
+consumer qualification harness, product-quality profiles, and qualified
+publication workflow. It measured 243,466 packed bytes, 930,389 unpacked bytes,
+and 109 files on Node 24.18.0; the 250 kB, 945 kB, and 110-file limits retain a
+small margin while continuing to bound package growth.
 
 ## v1.6.1 baseline
 
@@ -67,4 +61,6 @@ pull request, run the complete validation gate, and merge only when the new
 result artifact is available. A Release Please PR then carries the change into
 the next version. Never raise a budget solely to clear CI; include before/after
 measurements and the expected effect on local feedback, hosted runner time,
-package transfer, or installed footprint.
+package transfer, or installed footprint. The current budget covers the measured
+combined release-integrity, fleet, consumer-qualification, and product-quality
+package footprint described above.

package/docs/fleet-release-eligibility.md

@@ -0,0 +1,80 @@
+# Fleet Release Eligibility
+
+Require a verified, qualified runtime before any fleet upgrade mutates repositories.
+
+**Dependency:** Installed release-integrity verifier (#537).
+**Activation:** Consumer-owned `.code-foundry-release-policy.json` at the fleet root.
+
+The public `upgradeFleet` entrypoint now applies an optional release eligibility
+guard before delegating to the unchanged legacy/manifest rollout implementation.
+The implementation was moved verbatim to `fleet-core.mjs`; discovery exports and
+existing callers retain their interface. No policy file means existing behavior.
+A malformed or symlinked policy is an error, not an opt-out. Dry runs use the same
+guard, and `--force` cannot bypass source identity or qualification.
+
+```json
+{
+  "schema_version": 1,
+  "repository": "owner/code-foundry",
+  "workflow": ".github/workflows/release_self-ci.yml",
+  "branch": "main",
+  "required_jobs": [
+    "Qualify consumers / Node 20",
+    "Qualify consumers / Node 22",
+    "Qualify consumers / Node 24"
+  ]
+}
+```
+
+This is a shape example, not a completed fleet policy. Populate canonical repository
+identity, actual workflow path, and exact job names from the qualified release
+caller's Actions API results. Include the publication job when successful registry
+publication is required before adoption. Require every relevant job: a workflow's
+aggregate success alone can conceal skipped jobs. The qualification gate in #544
+and verified publisher in #547 provide the producer side of this policy.
+
+Keep the policy alongside the **consumer workspace's** fleet inventory. Do not put
+private repository names, local layouts, or deployment credentials into this
+reusable baseline. Commit policy changes for review; the guard does not secretly
+change branch protection, environments, rollout cohorts, or required capabilities.
+
+## What is verified
+
+The proposed runtime must be a clean Git source checkout. Its exact HEAD must
+match the cryptographically verified immutable release tag. An installed npm
+package without Git metadata cannot substitute for a verifiable source checkout;
+use the existing `--source` option with the checked-out release. The verifier comes
+from the trusted running Foundry installation, not the unverified candidate.
+
+The guard resolves the configured workflow's identity, retrieves every page of
+runs for the exact source, and selects the latest matching protected-branch push
+or manual run. It rejects pending/failed/cancelled runs, fork provenance, disabled
+workflows, missing/ambiguous/skipped jobs, and incomplete pagination. An older
+success does not override a newer failed run. Job evidence comes from the precise
+run attempt; that attempt is rechecked before proceeding. Source HEAD, cleanliness,
+and the policy's bytes are rechecked before the upgrade callback executes.
+
+Successful eligibility emits JSON to stderr with source SHA, policy digest,
+workflow/run/attempt identifiers, and required job names. It does not write an
+approval into the source or silently make PRs ready. Existing resumable rollouts,
+canary validation, draft creation, and provenance markers stay in the original
+fleet engine. The guard is policy enforcement in the supported public entrypoint,
+not a sandbox against someone intentionally importing private implementation files
+or using Git directly. Normal credentials still determine what remote mutations
+are possible after eligibility passes.
+
+## Activation and validation
+
+First release and validate the qualification/verification producer and confirm
+real workflow/job identities. Then opt a consumer workspace into this policy and
+exercise `fleet upgrade --dry-run --root <fleet-root> --source <clean-release-checkout>`.
+When `--source` is omitted, the installed package is used and an enabled policy
+will reject it unless that installation is itself a clean Git checkout. Older mutable
+releases or unavailable permissions should fail; do not weaken the policy just to
+make an old release eligible. No real fleet inventory is fabricated by this PR.
+
+The focused suite verifies guard ordering and failure propagation with GitHub/CLI
+fixtures. Live authenticated verification, exact production job naming, and the
+full existing fleet-engine suite must pass before activation. The original fleet
+engine's Git blob is retained byte-for-byte; the source move still needs full
+repository import/type-check/packaging validation in CI.

package/docs/fleet-rollouts.md

@@ -55,11 +55,12 @@ Adopt those requirements in consumer repositories before requiring them here.
 
 ```sh
 code-foundry fleet status --root /path/to/fleet
-code-foundry fleet upgrade --root /path/to/fleet --dry-run
-code-foundry fleet upgrade --root /path/to/fleet --create-pr
+code-foundry fleet upgrade --root /path/to/fleet --source /path/to/release-checkout --dry-run
+code-foundry fleet upgrade --root /path/to/fleet --source /path/to/release-checkout --create-pr
 ```
 
-Run from the intended released Code Foundry installation/checkout. The existing
+Use `--source` to provide the clean Code Foundry release checkout used for the
+upgrade; when omitted, the installed Code Foundry package is used. The existing
 source-version guard still rejects mismatched `--version` requests. Manifest mode
 requires `--create-pr` or `--dry-run` and never syncs original checkouts in place.
 `--force` does not bypass dirty-tree safety in manifest mode. Dry-run reports

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.18.0",
+  "version": "1.19.0",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/cli.mjs

@@ -7,7 +7,7 @@ import { fileURLToPath } from 'node:url'
 
 const packageRoot = resolve(fileURLToPath(new URL('..', import.meta.url)))
 
-/** @typedef {{ target: string, root: string, dryRun: boolean, force: boolean, github: boolean, createPr: boolean, exclude: string[], base: string, head: string, tag: string, workflow: string, mode: string, version: string, repository: string, expectedSha: string, assets: string[], rootProvided: boolean, releaseSubcommand?: string, fleetSubcommand?: string, integritySubcommand?: 'settings'|'release'|'manifest', ciSubcommand?: 'pause'|'resume'|'status' }} Options */
+/** @typedef {{ target: string, root: string, source: string, dryRun: boolean, force: boolean, github: boolean, createPr: boolean, exclude: string[], base: string, head: string, tag: string, workflow: string, mode: string, version: string, versionExplicit: boolean, repository: string, expectedSha: string, assets: string[], rootProvided: boolean, releaseSubcommand?: string, fleetSubcommand?: string, integritySubcommand?: 'settings'|'release'|'manifest', ciSubcommand?: 'pause'|'resume'|'status' }} Options */
 /** @typedef {{ command: string, options: Options }} ParsedArgs */
 
 const usage = `code-foundry — initialize and maintain agent-ready repositories
@@ -25,7 +25,7 @@ Usage:
   npx code-foundry release-integrity release --repo OWNER/REPO --tag TAG
   npx code-foundry release-integrity manifest --asset PATH [--root PATH]
   npx code-foundry fleet status [--root PATH]
-  npx code-foundry fleet upgrade [--root PATH] [--dry-run] [--create-pr]
+  npx code-foundry fleet upgrade [--root PATH] [--source PATH] [--dry-run] [--create-pr]
 
 The repository configuration lives in .github/code-foundry.yml.
 init detects the repository, creates that file, and renders the baseline.
@@ -45,6 +45,7 @@ Options:
   --expected-sha SHA  Expected source commit for release-integrity verification
   --asset PATH    Selected release-integrity artifact (repeatable)
   --root PATH     Fleet root containing repositories (default: current directory)
+  --source PATH   Clean Code Foundry release checkout used for fleet upgrades
   --create-pr     Create isolated upgrade branches and pull requests
   --version TAG   Runtime tag to report in fleet upgrade branches
   --exclude NAME  Skip a repository path or owner/name in fleet operations
@@ -66,6 +67,7 @@ function parseArgs(argv) {
   const options = {
     target: process.cwd(),
     root: process.cwd(),
+    source: packageRoot,
     dryRun: false,
     force: false,
     github: false,
@@ -77,6 +79,7 @@ function parseArgs(argv) {
     workflow: '',
     mode: 'auto',
     version: `v${readPackageVersion(packageRoot)}`,
+    versionExplicit: false,
     repository: '',
     expectedSha: '',
     assets: [],
@@ -146,9 +149,17 @@ function parseArgs(argv) {
     else if (arg === '--root') {
       options.root = argv.shift() ?? fail('--root requires a path')
       options.rootProvided = true
+    } else if (arg === '--source') {
+      if (command !== 'fleet' || options.fleetSubcommand !== 'upgrade')
+        fail('--source is only supported by fleet upgrade')
+      const value = argv.shift()
+      if (!value || value.startsWith('-')) fail('--source requires a path')
+      options.source = value
     } else if (arg === '--create-pr') options.createPr = true
-    else if (arg === '--version') options.version = argv.shift() ?? fail('--version requires a tag')
-    else if (arg === '--exclude')
+    else if (arg === '--version') {
+      options.version = argv.shift() ?? fail('--version requires a tag')
+      options.versionExplicit = true
+    } else if (arg === '--exclude')
       options.exclude.push(argv.shift() ?? fail('--exclude requires a name'))
     else fail(`unknown option: ${arg}; run --help for the supported options`)
   }
@@ -241,11 +252,13 @@ async function main() {
       if (options.fleetSubcommand === 'status')
         console.log(JSON.stringify(discoverRepositories(root), null, 2))
       else
-        upgradeFleet(root, packageRoot, {
+        upgradeFleet(root, resolve(options.source), {
           createPr: options.createPr,
           dryRun: options.dryRun,
           force: options.force,
-          version: options.version,
+          version: options.versionExplicit
+            ? options.version
+            : `v${readPackageVersion(resolve(options.source))}`,
           exclude: options.exclude,
         })
     } catch (error) {