code-foundry 1.19.0 → 1.20.2

package/.github/workflows/ci.yml

@@ -18,6 +18,11 @@ on:
         required: false
         type: string
         default: ubuntu-latest
+      artifact-prefix:
+        description: Prefix for task receipts; use a unique value when calling this workflow more than once.
+        required: false
+        type: string
+        default: task-result
     secrets:
       TURBO_TOKEN:
         required: false
@@ -86,8 +91,22 @@ jobs:
           cache-build: 'false'
           task: format
       - name: Format
+        id: execute
         if: steps.applicability.outputs.applicable == 'true'
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci format
+      - name: Retain task receipt
+        if: >-
+          always() &&
+          (steps.execute.outcome == 'success' || steps.execute.outcome == 'failure' ||
+          steps.applicability.outputs.applicable == 'false') &&
+          hashFiles('.code-foundry/results/format.json') != ''
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: ${{ inputs.artifact-prefix }}-${{ github.run_id }}-${{ github.run_attempt }}-format
+          path: .code-foundry/results/format.json
+          include-hidden-files: true
+          if-no-files-found: error
+          retention-days: 14
 
   lint:
     name: Lint
@@ -126,8 +145,22 @@ jobs:
           cache-lint: 'true'
           task: lint
       - name: Lint
+        id: execute
         if: steps.applicability.outputs.applicable == 'true'
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci lint
+      - name: Retain task receipt
+        if: >-
+          always() &&
+          (steps.execute.outcome == 'success' || steps.execute.outcome == 'failure' ||
+          steps.applicability.outputs.applicable == 'false') &&
+          hashFiles('.code-foundry/results/lint.json') != ''
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: ${{ inputs.artifact-prefix }}-${{ github.run_id }}-${{ github.run_attempt }}-lint
+          path: .code-foundry/results/lint.json
+          include-hidden-files: true
+          if-no-files-found: error
+          retention-days: 14
 
   type-check:
     name: Type-Check
@@ -166,8 +199,22 @@ jobs:
           cache-build: 'true'
           task: type_check
       - name: Type-Check
+        id: execute
         if: steps.applicability.outputs.applicable == 'true'
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci type_check
+      - name: Retain task receipt
+        if: >-
+          always() &&
+          (steps.execute.outcome == 'success' || steps.execute.outcome == 'failure' ||
+          steps.applicability.outputs.applicable == 'false') &&
+          hashFiles('.code-foundry/results/type_check.json') != ''
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: ${{ inputs.artifact-prefix }}-${{ github.run_id }}-${{ github.run_attempt }}-type_check
+          path: .code-foundry/results/type_check.json
+          include-hidden-files: true
+          if-no-files-found: error
+          retention-days: 14
 
   build:
     name: Build
@@ -211,5 +258,19 @@ jobs:
           cache-build: 'true'
           task: build
       - name: Build
+        id: execute
         if: steps.applicability.outputs.applicable == 'true'
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci build
+      - name: Retain task receipt
+        if: >-
+          always() &&
+          (steps.execute.outcome == 'success' || steps.execute.outcome == 'failure' ||
+          steps.applicability.outputs.applicable == 'false') &&
+          hashFiles('.code-foundry/results/build.json') != ''
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: ${{ inputs.artifact-prefix }}-${{ github.run_id }}-${{ github.run_attempt }}-build
+          path: .code-foundry/results/build.json
+          include-hidden-files: true
+          if-no-files-found: error
+          retention-days: 14

package/.github/workflows/consumer-qualification.yml

@@ -8,6 +8,19 @@ on:
         required: false
         type: boolean
         default: false
+    outputs:
+      filename:
+        description: Exact qualified npm archive name.
+        value: ${{ jobs.pack.outputs.filename }}
+      source-sha:
+        description: Commit whose archive passed the complete qualification matrix.
+        value: ${{ jobs.gate.outputs.source-sha }}
+      sha256:
+        description: SHA-256 of the qualified archive, without an algorithm prefix.
+        value: ${{ jobs.gate.outputs.sha256 }}
+      candidate-artifact:
+        description: Candidate artifact scoped to this workflow run and attempt.
+        value: ${{ jobs.gate.outputs.candidate-artifact }}
 
 permissions:
   actions: read
@@ -21,6 +34,9 @@ jobs:
     timeout-minutes: 10
     outputs:
       filename: ${{ steps.pack.outputs.filename }}
+      source-sha: ${{ steps.pack.outputs.source-sha }}
+      sha256: ${{ steps.pack.outputs.sha256 }}
+      run-attempt: ${{ steps.pack.outputs.run-attempt }}
     steps:
       - name: Checkout candidate
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -37,14 +53,18 @@ jobs:
           mkdir -p "$RUNNER_TEMP/candidate"
           npm pack --ignore-scripts --json --pack-destination "$RUNNER_TEMP/candidate" > "$RUNNER_TEMP/candidate/pack.json"
           PACKAGE=$(node -e 'const p=require(process.argv[1]); if(p.length!==1 || !/^[A-Za-z0-9._-]+\.tgz$/.test(p[0].filename)) process.exit(1); console.log(p[0].filename)' "$RUNNER_TEMP/candidate/pack.json")
-          echo "filename=$PACKAGE" >> "$GITHUB_OUTPUT"
+          {
+            echo "filename=$PACKAGE"
+            echo "source-sha=$(git rev-parse HEAD)"
+            echo "sha256=$(sha256sum "$RUNNER_TEMP/candidate/$PACKAGE" | cut -d' ' -f1)"
+            echo "run-attempt=$GITHUB_RUN_ATTEMPT"
+          } >> "$GITHUB_OUTPUT"
       - name: Retain the shared candidate
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
-          name: qualification-candidate-${{ github.run_id }}
+          name: qualification-candidate-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ runner.temp }}/candidate/*
           if-no-files-found: error
-          overwrite: true
           retention-days: 14
 
   qualify:
@@ -57,6 +77,11 @@ jobs:
       fail-fast: false
       matrix:
         node: ['20', '22', '24']
+    env:
+      PACKAGE: ${{ needs.pack.outputs.filename }}
+      SOURCE_SHA: ${{ needs.pack.outputs.source-sha }}
+      CANDIDATE_SHA256: ${{ needs.pack.outputs.sha256 }}
+      PACK_ATTEMPT: ${{ needs.pack.outputs.run-attempt }}
     steps:
       - name: Checkout qualification runtime
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -70,26 +95,103 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
+          set -euo pipefail
+          test "$PACK_ATTEMPT" = "$GITHUB_RUN_ATTEMPT" || { echo 'Rerun all jobs: qualification cannot mix run attempts.' >&2; exit 1; }
+          test "$(git rev-parse HEAD)" = "$SOURCE_SHA"
           gh run download "$GITHUB_RUN_ID" --repo "$GITHUB_REPOSITORY" \
-            --name "qualification-candidate-$GITHUB_RUN_ID" \
+            --name "qualification-candidate-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT" \
             --dir "$RUNNER_TEMP/candidate"
+          test "$(sha256sum "$RUNNER_TEMP/candidate/$PACKAGE" | cut -d' ' -f1)" = "$CANDIDATE_SHA256"
       - name: Install pinned workflow validator
         run: go install github.com/rhysd/actionlint/cmd/actionlint@v1.7.12
       - name: Qualify the exact shared distributable
-        env:
-          PACKAGE: ${{ needs.pack.outputs.filename }}
         run: |
           set -euo pipefail
           node src/lib/consumer-qualification.mjs \
-            "$RUNNER_TEMP/candidate/$PACKAGE" \
-            "$(git rev-parse HEAD)" \
-            "$RUNNER_TEMP/report.json" \
-            "$(go env GOPATH)/bin/actionlint"
+            "$RUNNER_TEMP/candidate/$PACKAGE" "$SOURCE_SHA" \
+            "$RUNNER_TEMP/report.json" "$(go env GOPATH)/bin/actionlint"
       - name: Retain qualification evidence
         if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: consumer-qualification-${{ github.run_attempt }}-node-${{ matrix.node }}
           path: ${{ runner.temp }}/report.json
-          if-no-files-found: warn
+          if-no-files-found: error
+          retention-days: 14
+
+  gate:
+    name: Gate
+    needs: [pack, qualify]
+    if: >-
+      always() && !cancelled() &&
+      (vars.CI_BILLING_PAUSED != 'true' || inputs['billing-pause-bypass'] == true)
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    outputs:
+      source-sha: ${{ steps.verify.outputs.source-sha }}
+      sha256: ${{ steps.verify.outputs.sha256 }}
+      candidate-artifact: ${{ steps.verify.outputs.candidate-artifact }}
+    env:
+      PACKAGE: ${{ needs.pack.outputs.filename }}
+      SOURCE_SHA: ${{ needs.pack.outputs.source-sha }}
+      CANDIDATE_SHA256: ${{ needs.pack.outputs.sha256 }}
+      PACK_ATTEMPT: ${{ needs.pack.outputs.run-attempt }}
+      PACK_RESULT: ${{ needs.pack.result }}
+      QUALIFY_RESULT: ${{ needs.qualify.result }}
+    steps:
+      - name: Require the complete successful matrix
+        run: |
+          set -euo pipefail
+          test "$PACK_RESULT" = success
+          test "$QUALIFY_RESULT" = success
+          test "$PACK_ATTEMPT" = "$GITHUB_RUN_ATTEMPT" || { echo 'Rerun all jobs: qualification cannot mix run attempts.' >&2; exit 1; }
+      - name: Checkout qualification policy
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Setup Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        with:
+          node-version: '24'
+      - name: Retrieve this attempt's candidate and reports
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          test "$(git rev-parse HEAD)" = "$SOURCE_SHA"
+          gh run download "$GITHUB_RUN_ID" --repo "$GITHUB_REPOSITORY" \
+            --name "qualification-candidate-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT" \
+            --dir "$RUNNER_TEMP/candidate"
+          for node in 20 22 24; do
+            gh run download "$GITHUB_RUN_ID" --repo "$GITHUB_REPOSITORY" \
+              --name "consumer-qualification-$GITHUB_RUN_ATTEMPT-node-$node" \
+              --dir "$RUNNER_TEMP/reports/$node"
+          done
+      - name: Verify source, archive and every fixture before handing off
+        id: verify
+        run: |
+          node --input-type=module <<'NODE'
+          import assert from 'node:assert/strict'
+          import { appendFileSync, readFileSync, writeFileSync } from 'node:fs'
+          import { join } from 'node:path'
+          import { qualifyArchive } from './src/commands/qualified-publication.mjs'
+          const env = process.env
+          const version = JSON.parse(readFileSync('package.json', 'utf8')).version
+          const candidate = {
+            repository: env.GITHUB_REPOSITORY, tag: `v${version}`,
+            sourceSha: env.SOURCE_SHA, asset: env.PACKAGE,
+            directory: join(env.RUNNER_TEMP, 'candidate'),
+          }
+          const result = qualifyArchive(candidate, ['20', '22', '24'].map(node => join(env.RUNNER_TEMP, 'reports', node, 'report.json')))
+          assert.equal(result.digest, `sha256:${env.CANDIDATE_SHA256}`)
+          const artifact = `qualification-candidate-${env.GITHUB_RUN_ID}-${env.GITHUB_RUN_ATTEMPT}`
+          writeFileSync(join(env.RUNNER_TEMP, 'qualification.json'), JSON.stringify({ ...result, run_id: env.GITHUB_RUN_ID, run_attempt: env.GITHUB_RUN_ATTEMPT }, null, 2) + '\n')
+          appendFileSync(env.GITHUB_OUTPUT, `source-sha=${result.sourceSha}\nsha256=${env.CANDIDATE_SHA256}\ncandidate-artifact=${artifact}\n`)
+          NODE
+      - name: Retain the qualified handoff
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: qualification-handoff-${{ github.run_id }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/qualification.json
+          if-no-files-found: error
           retention-days: 14

package/.github/workflows/test.yml

@@ -33,6 +33,11 @@ on:
         required: false
         type: boolean
         default: false
+      artifact-prefix:
+        description: Prefix for task receipts; use a unique value when calling this workflow more than once.
+        required: false
+        type: string
+        default: task-result
     secrets:
       TURBO_TOKEN:
         required: false
@@ -104,8 +109,22 @@ jobs:
           task-python: ${{ steps.applicability.outputs.python }}
           task-rust: ${{ steps.applicability.outputs.rust }}
       - name: Unit
+        id: execute
         if: steps.applicability.outputs.applicable == 'true'
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci unit
+      - name: Retain task receipt
+        if: >-
+          always() &&
+          (steps.execute.outcome == 'success' || steps.execute.outcome == 'failure' ||
+          steps.applicability.outputs.applicable == 'false') &&
+          hashFiles('.code-foundry/results/unit.json') != ''
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: ${{ inputs.artifact-prefix }}-${{ github.run_id }}-${{ github.run_attempt }}-unit
+          path: .code-foundry/results/unit.json
+          include-hidden-files: true
+          if-no-files-found: error
+          retention-days: 14
       - name: Upload coverage
         if: >-
           always() &&
@@ -171,8 +190,22 @@ jobs:
           task-python: ${{ steps.applicability.outputs.python }}
           task-rust: ${{ steps.applicability.outputs.rust }}
       - name: Performance
+        id: execute
         if: steps.applicability.outputs.applicable == 'true'
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci performance
+      - name: Retain task receipt
+        if: >-
+          always() &&
+          (steps.execute.outcome == 'success' || steps.execute.outcome == 'failure' ||
+          steps.applicability.outputs.applicable == 'false') &&
+          hashFiles('.code-foundry/results/performance.json') != ''
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: ${{ inputs.artifact-prefix }}-${{ github.run_id }}-${{ github.run_attempt }}-performance
+          path: .code-foundry/results/performance.json
+          include-hidden-files: true
+          if-no-files-found: error
+          retention-days: 14
       - name: Upload performance results
         if: >-
           always() &&
@@ -236,8 +269,22 @@ jobs:
           task-python: ${{ steps.applicability.outputs.python }}
           task-rust: ${{ steps.applicability.outputs.rust }}
       - name: Integration
+        id: execute
         if: steps.applicability.outputs.applicable == 'true'
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci integration
+      - name: Retain task receipt
+        if: >-
+          always() &&
+          (steps.execute.outcome == 'success' || steps.execute.outcome == 'failure' ||
+          steps.applicability.outputs.applicable == 'false') &&
+          hashFiles('.code-foundry/results/integration.json') != ''
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: ${{ inputs.artifact-prefix }}-${{ github.run_id }}-${{ github.run_attempt }}-integration
+          path: .code-foundry/results/integration.json
+          include-hidden-files: true
+          if-no-files-found: error
+          retention-days: 14
 
   e2e:
     name: E2E
@@ -298,8 +345,22 @@ jobs:
           task-python: ${{ steps.applicability.outputs.python }}
           task-rust: ${{ steps.applicability.outputs.rust }}
       - name: E2E
+        id: execute
         if: steps.applicability.outputs.applicable == 'true'
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci e2e
+      - name: Retain task receipt
+        if: >-
+          always() &&
+          (steps.execute.outcome == 'success' || steps.execute.outcome == 'failure' ||
+          steps.applicability.outputs.applicable == 'false') &&
+          hashFiles('.code-foundry/results/e2e.json') != ''
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: ${{ inputs.artifact-prefix }}-${{ github.run_id }}-${{ github.run_attempt }}-e2e
+          path: .code-foundry/results/e2e.json
+          include-hidden-files: true
+          if-no-files-found: error
+          retention-days: 14
 
   smoke:
     name: Smoke
@@ -348,5 +409,19 @@ jobs:
           task-python: ${{ steps.applicability.outputs.python }}
           task-rust: ${{ steps.applicability.outputs.rust }}
       - name: Smoke
+        id: execute
         if: steps.applicability.outputs.applicable == 'true'
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci smoke
+      - name: Retain task receipt
+        if: >-
+          always() &&
+          (steps.execute.outcome == 'success' || steps.execute.outcome == 'failure' ||
+          steps.applicability.outputs.applicable == 'false') &&
+          hashFiles('.code-foundry/results/smoke.json') != ''
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: ${{ inputs.artifact-prefix }}-${{ github.run_id }}-${{ github.run_attempt }}-smoke
+          path: .code-foundry/results/smoke.json
+          include-hidden-files: true
+          if-no-files-found: error
+          retention-days: 14

package/.github/workflows/validation-no-codeql.yml

@@ -62,6 +62,11 @@ on:
         required: false
         type: number
         default: 1
+      artifact-prefix:
+        description: Prefix for task receipts; use a unique value when calling this workflow more than once.
+        required: false
+        type: string
+        default: task-result
     secrets:
       TURBO_TOKEN:
         required: false
@@ -86,6 +91,7 @@ jobs:
       runtime-repository: ${{ inputs.runtime-repository }}
       runtime-ref: ${{ inputs.runtime-ref }}
       runner: ${{ inputs.ci-runner }}
+      artifact-prefix: ${{ inputs.artifact-prefix }}
     secrets:
       TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
       NEXTAUTH_SECRET: ${{ secrets.NEXTAUTH_SECRET }}
@@ -101,6 +107,7 @@ jobs:
       unit-runner: ${{ inputs.unit-runner }}
       performance-runner: ${{ inputs.performance-runner }}
       unit-only: ${{ inputs.mode == 'fast' }}
+      artifact-prefix: ${{ inputs.artifact-prefix }}
     secrets:
       TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
 

package/.github/workflows/validation.yml

@@ -62,6 +62,11 @@ on:
         required: false
         type: number
         default: 1
+      artifact-prefix:
+        description: Prefix for task receipts; use a unique value when calling this workflow more than once.
+        required: false
+        type: string
+        default: task-result
     secrets:
       TURBO_TOKEN:
         required: false
@@ -86,6 +91,7 @@ jobs:
       runtime-repository: ${{ inputs.runtime-repository }}
       runtime-ref: ${{ inputs.runtime-ref }}
       runner: ${{ inputs.ci-runner }}
+      artifact-prefix: ${{ inputs.artifact-prefix }}
     secrets:
       TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
       NEXTAUTH_SECRET: ${{ secrets.NEXTAUTH_SECRET }}
@@ -101,6 +107,7 @@ jobs:
       unit-runner: ${{ inputs.unit-runner }}
       performance-runner: ${{ inputs.performance-runner }}
       unit-only: ${{ inputs.mode == 'fast' }}
+      artifact-prefix: ${{ inputs.artifact-prefix }}
     secrets:
       TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
 

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## [1.20.2](https://github.com/0xPlayerOne/code-foundry/compare/v1.20.1...v1.20.2) (2026-09-09)
+
+
+### Bug Fixes
+
+* **ci:** retain scoped task receipts across success and failure ([#557](https://github.com/0xPlayerOne/code-foundry/issues/557)) ([ee0fe45](https://github.com/0xPlayerOne/code-foundry/commit/ee0fe45e821621e3193831d70a533077b7bcf8a9))
+
+## [1.20.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.20.0...v1.20.1) (2026-09-09)
+
+
+### Bug Fixes
+
+* **qualification:** isolate attempts and verify release handoff ([#556](https://github.com/0xPlayerOne/code-foundry/issues/556)) ([5fe7f42](https://github.com/0xPlayerOne/code-foundry/commit/5fe7f4203b8018fd3eb88bd68e2286c6feb3d3dc))
+
+## [1.20.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.19.0...v1.20.0) (2026-09-09)
+
+
+### Features
+
+* **ci:** add opt-in merge-group audit validation ([#549](https://github.com/0xPlayerOne/code-foundry/issues/549)) ([ae418a7](https://github.com/0xPlayerOne/code-foundry/commit/ae418a779ada2927bd391cc6cf54db16e342d921))
+
 ## [1.19.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.18.0...v1.19.0) (2026-09-09)
 
 

package/docs/PERFORMANCE.md

@@ -15,19 +15,19 @@ belong to the run that produced them, not the source tree.
 | Format, lint, type-check, and build |   15 s | Bound the local CI feedback loop                     |
 | Runtime dependencies                |      0 | Keep the installed CLI dependency-free               |
 | Development dependencies            |      4 | Prevent unreviewed toolchain growth                  |
-| Packed artifact                     | 250 kB | Bound registry transfer and install cost             |
-| Unpacked artifact                   | 930 kB | Bound installed footprint                            |
-| Packed files                        |    110 | Detect accidental release contents                   |
+| Packed artifact                     | 255 kB | Bound registry transfer and install cost             |
+| Unpacked artifact                   | 965 kB | Bound installed footprint                            |
+| Packed files                        |    115 | Detect accidental release contents                   |
 
 The performance workflow disables build-cache reads and writes for this task.
 That makes timing comparisons independent of a warm protected-branch cache and
 prevents benchmark code from populating shared cache entries.
 
 The merged candidate includes the release-integrity verifier, fleet eligibility,
-consumer qualification harness, product-quality profiles, and qualified
-publication workflow. It measured 243,466 packed bytes, 930,389 unpacked bytes,
-and 109 files on Node 24.18.0; the 250 kB, 945 kB, and 110-file limits retain a
-small margin while continuing to bound package growth.
+consumer qualification harness, product-quality profiles, qualified publication
+workflow, and opt-in merge-queue verifier. It measured 248,464 packed bytes,
+947,310 unpacked bytes, and 111 files on Node 24.18.0; the 255 kB, 965 kB, and
+115-file limits retain a small margin while continuing to bound package growth.
 
 ## v1.6.1 baseline
 

package/docs/consumer-qualification.md

@@ -6,7 +6,7 @@ Release-candidate compatibility checks against the distributable package.
 **Scope:** Package installation, CLI initialization/synchronization, generated workflow contracts.
 
 `consumer-qualification.yml` packs the checked-out candidate once, shares that archive across all supported
-Node majors using an artifact scoped to the same workflow run (including failed-job reruns), installs it offline with lifecycle scripts disabled,
+Node majors using an artifact scoped to the same workflow run **and attempt**, installs it offline with lifecycle scripts disabled,
 and executes its public CLI from the installed package. The harness does not
 import the source checkout's initializer as a substitute for package testing.
 
@@ -39,10 +39,26 @@ member. Reports are evidence, not signatures or a substitute for release identit
 verification.
 
 The self release caller cannot start Release Please or npm publication until all
-qualification jobs succeed. An explicit `release-while-paused` dispatch is passed
+qualification jobs and the aggregate `Gate` succeed. An explicit `release-while-paused` dispatch is passed
 through to the reusable workflow; ordinary calls remain blocked by the billing pause.
 Consumer-generated release callers do not inherit this Code Foundry-specific
 qualification job. This does not yet guarantee that its legacy publishing job uses
 this same archive; the verified-publication workflow handles that separate
 requirement. No branch protections, repository settings, credentials, or consumer
 runtimes are changed by this feature.
+
+## Verified handoff and reruns
+
+The reusable workflow exports `filename`, `source-sha`, `sha256`, and
+`candidate-artifact`. Only the gate exports the verified source, digest, and
+artifact identity. It requires a successful pack and complete Node matrix,
+retrieves every report from the current attempt, and checks all fixture results
+against the same source and archive through the publication eligibility policy.
+Its retained `qualification-handoff-RUN_ID-ATTEMPT` receipt records that identity.
+A green matrix without valid matching reports cannot authorize a release.
+
+Artifacts are never overwritten. On a failed or cancelled qualification, use
+**Re-run all jobs**, not a failed-job-only rerun: a later attempt cannot reuse
+an earlier pack or silently combine old and new reports. Missing/expired artifacts
+fail closed; start a fresh complete run. This stricter retry policy also applies
+when qualification is nested in a release workflow. No release settings change.

package/docs/merge-queues.md

@@ -0,0 +1,89 @@
+# Merge Queue Validation
+
+Opt-in validation of the combined commit produced by GitHub's merge queue.
+
+**Activation:** `merge_queue: true` in the consumer's `.github/code-foundry.yml`, followed by normal sync.
+**Required check:** Existing canonical `Validation / Gate`.
+
+The synchronizer adds `.github/workflows/validation-merge-queue.yml` only when
+explicitly enabled. The ordinary PR readiness workflow is unchanged: this feature
+does not turn draft pushes into CI, mark PRs ready, enqueue PRs, or change release
+behavior. Queue events receive the full audit even when staging PRs normally use
+fast validation. Release Please branch detection is deliberately not reused for
+a merge group containing several PRs; the group's combined tree is audited, not
+treated as a generated version-only diff.
+
+```yaml
+merge_queue: true
+```
+
+Normal `code-foundry sync` updates the generated queue caller alongside the other
+runtime pins. Explicit fleet runtime overrides are honored. The installed runtime
+must contain this feature, and queues require an exact commit or released version
+pin rather than a moving branch. Direct topology enables main; staging-release
+enables main and staging. Existing runner choices, Rust CodeQL sharding, and an
+explicit `codeql: false` policy select the same appropriate validation orchestrator
+as ordinary PRs. No CodeQL policy or runtime default is relaxed.
+
+## Event identity and checks
+
+The generated caller accepts only `merge_group` / `checks_requested`. A pinned,
+trusted verifier checks the payload's repository, allowed base branch, queue ref,
+base SHA, and head SHA against the actual workflow context before validation can
+start. The existing reusable orchestrator then checks out the merge-group commit
+through its normal GitHub context and runs CI, tests (including non-unit lanes),
+security, and the configured CodeQL policy with `mode: audit`.
+
+The caller job is named `Validation`, so the existing orchestrator still emits
+`Validation / Gate`. That gate's audit truth table requires successful results;
+skipped or failed required jobs cannot satisfy it. A failed identity job prevents
+validation from starting and cannot manufacture a successful aggregate check.
+The standard PR classifier remains PR/scheduled/manual-specific; merge groups
+have their own strict classifier rather than weakening its event whitelist.
+
+Concurrency is scoped to the actual queue ref and has a different prefix from PR,
+release, and scheduled workflows. New groups do not cancel unrelated groups or
+PR readiness runs. Replaced attempts for the same queue ref can supersede each
+other. The billing-pause switch is preserved; paused validation does not produce
+a success that authorizes a merge.
+
+The caller forwards no secrets and grants no deployment or OIDC publication
+permission. Its permission union matches the existing audit chain (including
+CodeQL security-event uploads). Applications requiring secret-backed tests must
+provide safe queue-compatible fixtures or a separately reviewed explicit caller;
+this feature does not introduce `secrets: inherit`. Native test commands remain
+repository-owned code, not a sandbox.
+
+## Preservation and disabling
+
+Setting `merge_queue: false` or removing the key removes only a caller bearing the
+exact Foundry management marker. A custom file at that path is preserved when
+disabled; enabling over it fails before synchronization writes, even with force.
+Symlinked workflow paths are rejected. Dry runs report changes without creating,
+updating, or deleting the caller. The original synchronizer is retained verbatim
+in `sync-core.mjs`; its public exports are preserved through the thin wrapper.
+
+Disable the repository's queue rule before removing its required queue workflow.
+Otherwise queued PRs will correctly wait for checks that no longer run.
+
+## Repository activation remains separate
+
+A repository administrator must verify GitHub plan/repository eligibility,
+review queue merge-method compatibility with the chosen branch topology, and
+configure required checks. Register the aggregate check, not PR-only mode or
+readiness checks that have no merge-group equivalent. An existing rule requiring
+individual checks needs those exact contexts reviewed as well. Do not enable the
+queue rule before the workflow is merged and a disposable queue exercise passes.
+No repository rule, branch protection, secret, merge setting, or queue is changed
+by this PR.
+
+Focused tests cover event identity and rejection, generated audit wiring,
+configured CodeQL policy, pin evolution, idempotence, dry runs, and ownership
+preservation. They do not establish a live merge-group run or full sync integration.
+Before readiness, run the existing complete sync/fleet tests, locked formatter,
+linter, TypeScript and package budgets, and Actionlint against rendered callers
+and their pinned/local reusable workflow contracts. Exercise two queued PRs and
+one deliberately failing check in an eligible disposable repository.
+
+References: [GitHub merge-queue CI configuration](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/configuring-pull-request-merges/managing-a-merge-queue),
+[merge-group event](https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#merge_group).

package/docs/required-capabilities.md

@@ -60,9 +60,29 @@ appear in the GitHub job summary when `GITHUB_STEP_SUMMARY` is available.
 The recorded command is the delegated executor invocation, not a transcript of
 all nested package scripts. No environment variables or captured command output
 are copied into the report. Repository scripts remain responsible for sanitizing
-their own logs. Upload `.code-foundry/results/*.json` with `if: always()` and
-`include-hidden-files: true` to retain downloadable reports; only upload this
-specific directory, not arbitrary hidden files or the entire checkout.
+their own logs and command arguments. Receipts are diagnostics, not signatures,
+attestations, or authorization to publish or merge.
+
+The shared CI and Test workflows retain each executed task's receipt, including
+failure, and discovery receipts for explicitly skipped optional tasks. Each upload
+selects exactly `.code-foundry/results/<task>.json`, not the broader hidden
+directory. The artifact name is `task-result-RUN_ID-ATTEMPT-TASK` and retention is
+14 days. The optional `artifact-prefix` input is exposed by CI, Test, and both
+validation orchestrators; it disambiguates multiple invocations in the same run
+when forwarded to the leaf workflows. Use a different prefix for each such
+invocation. Existing coverage/performance artifact uploads are unchanged.
+
+Missing receipts from an older runtime, a discovery/setup failure, or termination
+before the runtime writes its report do not create an artifact. Missing evidence
+is not success: inspect the task's actual outcome and the validation gate. Uploads
+run after success or failure and do not suppress a failing task exit. When an
+existing receipt disappears during upload, the upload itself fails. A job skipped
+by the workflow's tier or billing policy cannot create a receipt.
+
+These files describe repository-controlled execution and can include paths and
+script-derived reasons. Do not put credentials in command arguments. Artifact
+access follows repository/Actions visibility; receipt retention does not provide
+a sandbox or independently validate repository-authored evidence.
 
 `node src/runtime.mjs ci plan` prints a JSON discovery plan without executing
 checks. Discovery validates every required task before reusable workflows select

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.19.0",
+  "version": "1.20.2",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {

package/src/commands/sync.mjs

@@ -18,6 +18,13 @@ import {
 } from '../lib/config.mjs'
 import { buildReleaseConfig, buildReleaseManifest } from '../lib/release-manifest.mjs'
 import { customWorkflowFiles, overlayPolicy } from '../lib/overlay.mjs'
+import {
+  inspectQueueCaller,
+  mergeQueueEnabled,
+  queueRuntimeRef,
+  renderMergeQueueCaller,
+  syncQueueCaller,
+} from '../lib/merge-queue.mjs'
 
 const standardFiles = [
   '.editorconfig',
@@ -109,7 +116,7 @@ const legacyFiles = [
 /** @typedef {{ target: string, source: string, dryRun?: boolean, force?: boolean, init?: boolean, runtimeRef?: string, configureHooks?: boolean }} SyncOptions */
 
 /** @param {SyncOptions} options */
-export function syncRepository(options) {
+function synchronize(options) {
   const target = resolve(options.target)
   const source = resolve(options.source)
   const dryRun = options.dryRun ?? false
@@ -441,6 +448,42 @@ export function syncRepository(options) {
   return { changed, config }
 }
 
+/** @param {Parameters<typeof synchronize>[0]} options */
+export function syncRepository(options) {
+  const target = resolve(options.target)
+  const source = resolve(options.source)
+  const existing = readConfig(join(target, '.github/code-foundry.yml'))
+  const enabled = mergeQueueEnabled(existing.merge_queue)
+  const ref = queueRuntimeRef(existing.runtime_ref, readPackageVersion(source), options.runtimeRef)
+  // Reject malformed opt-in settings or a user-owned destination before the
+  // original synchronizer changes any files. It remains the owner of defaults.
+  if (enabled) {
+    const preflight = renderMergeQueueCaller(
+      {
+        ...existing,
+        runtime_repository: configured(existing.runtime_repository, '0xPlayerOne/code-foundry'),
+      },
+      ref
+    )
+    inspectQueueCaller(target, preflight)
+  } else inspectQueueCaller(target, null)
+  const result = synchronize(options)
+  const content = enabled
+    ? renderMergeQueueCaller(
+        {
+          ...result.config,
+          runtime_repository: configured(
+            result.config.runtime_repository,
+            '0xPlayerOne/code-foundry'
+          ),
+        },
+        ref
+      )
+    : null
+  const changed = syncQueueCaller(target, content, options.dryRun ?? false)
+  return { ...result, changed: [...new Set([...result.changed, ...changed])] }
+}
+
 /**
  * Baseline keys that are safe to merge into a repository's release config.
  * Package and release-type policy is detected from the repository itself and

package/src/lib/merge-queue.mjs

@@ -0,0 +1,271 @@
+// @ts-check
+import { lstatSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { dirname, join, resolve } from 'node:path'
+import { pathToFileURL } from 'node:url'
+
+export const QUEUE_CALLER = '.github/workflows/validation-merge-queue.yml'
+export const QUEUE_MARKER = '# code-foundry-managed: merge-queue-v1\n'
+/** @param {unknown} value @param {string} message @returns {asserts value} */
+function ensure(value, message) {
+  if (!value) throw new Error(message)
+}
+
+/** @param {unknown} value */
+export function mergeQueueEnabled(value) {
+  if (value === undefined || value === '' || value === false || value === 'false') return false
+  if (value === true || value === 'true') return true
+  throw new Error('merge_queue must be true or false')
+}
+
+/** Same version-pin policy as normal sync: released semver pins advance while
+ * custom refs persist unless an explicit fleet runtime override is supplied.
+ * @param {string | undefined} current @param {string} sourceVersion @param {string | undefined} override
+ */
+export function queueRuntimeRef(current, sourceVersion, override) {
+  if (override !== undefined) return override
+  if (!current || current === 'auto' || /^v\d+\.\d+\.\d+$/.test(current)) return `v${sourceVersion}`
+  return current
+}
+
+/** @param {Record<string, string>} config @param {string} ref */
+export function renderMergeQueueCaller(config, ref) {
+  const repository = config.runtime_repository || '0xPlayerOne/code-foundry'
+  ensure(
+    /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(repository) &&
+      !repository.split('/').some((part) => ['.', '..'].includes(part)),
+    'Invalid queue runtime repository'
+  )
+  ensure(
+    /^(?:[a-f0-9]{40}|v\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?)$/.test(ref),
+    'Merge queues require a released version or exact commit pin, not a moving branch'
+  )
+  const topology = config.git_workflow || 'direct'
+  ensure(['direct', 'staging-release'].includes(topology), 'Unsupported queue topology')
+  const features = (config.features || 'all').split(/[\s,]+/)
+  ensure(
+    features.some((feature) =>
+      ['all', 'validation', 'ci', 'test', 'security', 'codeql'].includes(feature)
+    ),
+    'Merge queues require the canonical PR validation caller'
+  )
+  const branches = topology === 'direct' ? ['main'] : ['main', 'staging']
+  const workflow = config.codeql === 'false' ? 'validation-no-codeql.yml' : 'validation.yml'
+  const runner = (/** @type {string} */ key, fallback = 'ubuntu-latest') => {
+    const value = config[key] || config.runner || fallback
+    ensure(/^[A-Za-z0-9_.-]+$/.test(value), `Unsupported queue runner label: ${key}`)
+    return JSON.stringify(value)
+  }
+  const threads = config.codeql_rust_threads || '1'
+  const parallel = config.codeql_rust_max_parallel || '1'
+  ensure(
+    /^(?:[1-9]|[1-5][0-9]|6[0-4])$/.test(threads),
+    'Unsupported codeql_rust_threads; use an integer from 1 to 64.'
+  )
+  ensure(
+    /^(?:[1-8])$/.test(parallel),
+    'Unsupported codeql_rust_max_parallel; use an integer from 1 to 8.'
+  )
+
+  const rawShards = config.codeql_rust_shards || '["all"]'
+  let shards
+  try {
+    shards = JSON.parse(rawShards)
+  } catch {
+    throw new Error('Invalid codeql_rust_shards; use a JSON array of relative Rust source paths.')
+  }
+  ensure(
+    Array.isArray(shards) && shards.length > 0 && shards.length <= 8,
+    'Invalid codeql_rust_shards; configure between 1 and 8 shards.'
+  )
+  const seen = new Set()
+  for (const shard of shards) {
+    ensure(
+      typeof shard === 'string' && shard.length > 0 && shard.length <= 512 && !seen.has(shard),
+      'Invalid codeql_rust_shards; shards must be unique non-empty strings.'
+    )
+    seen.add(shard)
+    if (shard === 'all') continue
+    for (const candidate of shard.split(',')) {
+      const path = candidate.trim()
+      ensure(
+        Boolean(path) &&
+          !path.startsWith('/') &&
+          !path.split('/').includes('..') &&
+          /^[A-Za-z0-9._/@+ -]+$/.test(path),
+        `Invalid Rust CodeQL shard path: ${path || '(empty)'}`
+      )
+    }
+  }
+  ensure(
+    !(seen.has('all') && shards.length !== 1),
+    'Invalid codeql_rust_shards; "all" cannot be combined with scoped shards.'
+  )
+  return `${QUEUE_MARKER}name: Merge Queue
+
+on:
+  merge_group:
+    types: [checks_requested]
+    branches: [${branches.join(', ')}]
+
+permissions:
+  actions: read
+  contents: read
+  packages: read
+  security-events: write
+
+concurrency:
+  group: code-foundry-merge-queue-\${{ github.repository }}-\${{ github.event.merge_group.head_ref }}
+  cancel-in-progress: true
+
+jobs:
+  identity:
+    name: Merge group identity
+    if: vars.CI_BILLING_PAUSED != 'true'
+    runs-on: ${runner('runner')}
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout trusted identity verifier
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+          repository: ${JSON.stringify(repository)}
+          ref: ${JSON.stringify(ref)}
+          path: .github/.code-foundry
+          sparse-checkout: src/lib
+      - name: Verify the exact merge-group commit
+        env:
+          FOUNDRY_QUEUE_BRANCHES: '${JSON.stringify(branches)}'
+        run: node .github/.code-foundry/src/lib/merge-queue.mjs
+
+  validation:
+    name: Validation
+    needs: identity
+    if: vars.CI_BILLING_PAUSED != 'true'
+    uses: ${repository}/.github/workflows/${workflow}@${ref}
+    with:
+      mode: audit
+      runtime-repository: ${JSON.stringify(repository)}
+      runtime-ref: ${JSON.stringify(ref)}
+      ci-runner: ${runner('ci_runner')}
+      test-runner: ${runner('test_runner')}
+      unit-runner: ${runner('unit_runner', 'ubuntu-slim')}
+      performance-runner: ${runner('performance_runner')}
+      security-runner: ${runner('security_runner', 'ubuntu-slim')}
+      codeql-runner: ${runner('codeql_runner')}
+      rust-shards: '${JSON.stringify(shards)}'
+      rust-threads: '${threads}'
+      rust-max-parallel: ${parallel}
+`
+}
+
+/** @param {Record<string, any>} payload @param {Record<string, string | undefined>} environment @param {unknown} branches */
+export function validateMergeGroup(payload, environment, branches) {
+  ensure(
+    Array.isArray(branches) &&
+      branches.length > 0 &&
+      branches.every((branch) => ['main', 'staging'].includes(branch)) &&
+      new Set(branches).size === branches.length,
+    'Invalid allowed merge-queue branches'
+  )
+  ensure(
+    environment.GITHUB_EVENT_NAME === 'merge_group' && payload.action === 'checks_requested',
+    'Only merge_group checks_requested is accepted'
+  )
+  const group = payload.merge_group
+  ensure(
+    group &&
+      /^[a-f0-9]{40}$/.test(group.head_sha ?? '') &&
+      /^[a-f0-9]{40}$/.test(group.base_sha ?? ''),
+    'Merge-group SHA identity is incomplete'
+  )
+  ensure(
+    branches.some((branch) => group.base_ref === `refs/heads/${branch}`),
+    'Merge-group base branch is not enabled'
+  )
+  const branch = group.base_ref.slice('refs/heads/'.length)
+  ensure(
+    typeof group.head_ref === 'string' &&
+      group.head_ref.startsWith(`refs/heads/gh-readonly-queue/${branch}/`) &&
+      group.head_ref.length > `refs/heads/gh-readonly-queue/${branch}/`.length,
+    'Unexpected merge-group ref'
+  )
+  ensure(
+    environment.GITHUB_SHA === group.head_sha && environment.GITHUB_REF === group.head_ref,
+    'Workflow commit/ref differs from the merge group'
+  )
+  ensure(
+    typeof environment.GITHUB_REPOSITORY === 'string' &&
+      environment.GITHUB_REPOSITORY === payload.repository?.full_name,
+    'Merge-group repository identity mismatch'
+  )
+  return {
+    mode: 'audit',
+    head_sha: group.head_sha,
+    base_sha: group.base_sha,
+    base_ref: group.base_ref,
+  }
+}
+
+/** Refuse symlinked workflow paths and preserve unowned files, even with force.
+ * @param {string} root @param {string | null} content
+ */
+export function inspectQueueCaller(root, content) {
+  let current = resolve(root)
+  for (const part of QUEUE_CALLER.split('/')) {
+    current = join(current, part)
+    let entry
+    try {
+      entry = lstatSync(current)
+    } catch (error) {
+      if (/** @type {NodeJS.ErrnoException} */ (error).code !== 'ENOENT') throw error
+    }
+    ensure(!entry?.isSymbolicLink(), 'Merge-queue workflow paths must not contain symlinks')
+  }
+  let existing = null
+  try {
+    existing = readFileSync(current, 'utf8')
+  } catch (error) {
+    if (/** @type {NodeJS.ErrnoException} */ (error).code !== 'ENOENT') throw error
+  }
+  if (existing !== null && !existing.startsWith(QUEUE_MARKER)) {
+    ensure(
+      content === null,
+      'A repository-owned merge-queue caller already exists; refusing to overwrite it'
+    )
+    return { path: current, changed: false }
+  }
+  return { path: current, changed: existing !== content }
+}
+
+/** @param {string} root @param {string | null} content @param {boolean} [dryRun] */
+export function syncQueueCaller(root, content, dryRun = false) {
+  const plan = inspectQueueCaller(root, content)
+  if (!plan.changed) return []
+  if (dryRun) console.log(`Would ${content === null ? 'remove' : 'sync'} ${QUEUE_CALLER}`)
+  else if (content === null) rmSync(plan.path, { force: true })
+  else {
+    mkdirSync(dirname(plan.path), { recursive: true })
+    writeFileSync(plan.path, content)
+  }
+  return [QUEUE_CALLER]
+}
+
+if (process.argv[1] && pathToFileURL(resolve(process.argv[1])).href === import.meta.url) {
+  try {
+    ensure(process.env.GITHUB_EVENT_PATH, 'Missing GitHub event payload')
+    console.log(
+      JSON.stringify(
+        validateMergeGroup(
+          JSON.parse(readFileSync(process.env.GITHUB_EVENT_PATH, 'utf8')),
+          process.env,
+          JSON.parse(process.env.FOUNDRY_QUEUE_BRANCHES || '[]')
+        )
+      )
+    )
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error))
+    process.exitCode = 1
+  }
+}