crewforth 3.2.0-rc.5 → 3.2.0-rc.7

package/CHANGELOG.md

@@ -220,6 +220,18 @@ versioning follows [SemVer](https://semver.org/).
 
 ### Fixed
 
+- **A push approval covers a tag on the approved commit.** `git push <remote> <tag>` had no way to be approved: the
+  click and `/crew-approve push` both record a push of the branch, and the tag push of a release was refused after
+  either, so the session handed the user the command to run. It now passes when the tag points at the commit the
+  approval covers (after a commit + push, the new one) and no branch has its name; a tag on another commit, a full
+  ref, a refspec and `--tags` are still refused.
+- **`change: review` is read as `audit`.** The model table of the working rules names review with audit, and
+  `crew-review-agent` cards that said `change: review` were refused. It now takes the audit floor, on a critical path
+  too; a kind that is not on the list is still refused.
+- **`above:` is read anywhere among a task card's three lines.** A card with `above: <why>` between `change:` and
+  `verify:` was refused ("line 3 of the task is not one of files:, change:, verify:") and the call was sent again
+  with the line moved down. It is now read in any position and keeps the model as it does after the three; the three
+  are still all required.
 - **A click on the approval question is recorded whatever order its keys come back in.** Claude Code hands the
   answered question back either as it was asked or with its keys sorted, and the answer side matched it byte for
   byte: in real `auto` sessions 30 of 30 answers in the asked order were recorded and 7 of 7 sorted ones refused

package/VERSION

@@ -1 +1 @@
-3.2.0-rc.5
+3.2.0-rc.7

package/kit/eval/smoke-test.sh

@@ -7689,6 +7689,25 @@ _pa_say auto 'approve: push' >/dev/null; ( cd "$_paw" && git checkout -q -b othe
 _pa_run auto 'git push origin feat/x'; [ "$_par" = 2 ] || _pabad="$_pabad other-branch-checked-out:rc=$_par"
 [ -z "$_pabad" ] && pass "a push approval is for the commit HEAD was on and the branch that was checked out: one more commit, or another branch, and it is refused" \
                  || fail "push binding:$_pabad"
+# A tag on the approved commit is part of that push (a release: `/crew-approve push`, then `git push origin v2.0.0`
+# was refused on a real project). A tag elsewhere, a name that is also a branch, or a full ref is not.
+_pa_new; _pabad=""; ( cd "$_paw" && git commit -qm second && git tag old HEAD^ && git tag v1 && git tag -a v1a -m v1a && git tag both && git branch both ) >/dev/null 2>&1
+_pa_say auto 'approve: commit' >/dev/null
+_pa_run auto 'git push origin v1'; [ "$_par" = 2 ] || _pabad="$_pabad [a commit approval pushed a tag: rc=$_par]"
+_pa_say auto 'approve: push' >/dev/null
+for _pc in 'git push origin v1' 'git push origin v1a' 'git push -q origin v1'; do
+  _pa_run auto "$_pc"; [ "$_par" = 0 ] || _pabad="$_pabad [$_pc → $_par $(head -c 120 "$_PA/err")]"
+done
+_pa_run auto 'git push origin old'; { [ "$_par" = 2 ] && grep -q 'the tag old is on' "$_PA/err"; } || _pabad="$_pabad [a tag on another commit → $_par]"
+for _pc in 'git push origin both' 'git push origin refs/tags/v1' 'git push origin nosuch' 'git push origin v1:v2' 'git push other v1'; do
+  _pa_run auto "$_pc"; [ "$_par" = 2 ] || _pabad="$_pabad [$_pc → $_par]"
+done
+_pa_new; ( cd "$_paw" && git tag before ) >/dev/null 2>&1; _pa_say auto 'approve: commit+push' >/dev/null
+_pa_run auto 'git commit -m x' >/dev/null; ( cd "$_paw" && git commit -qm approved && git tag after ) >/dev/null 2>&1
+_pa_run auto 'git push origin after'; [ "$_par" = 0 ] || _pabad="$_pabad [commit+push: a tag on the new commit → $_par $(head -c 120 "$_PA/err")]"
+_pa_run auto 'git push origin before'; { [ "$_par" = 2 ] && grep -q 'the tag before is on' "$_PA/err"; } || _pabad="$_pabad [commit+push: a tag on the old commit → $_par]"
+[ -z "$_pabad" ] && pass "a push approval covers a tag on the approved commit (lightweight or annotated; after commit+push, on the new commit): a tag on another commit, a name that is also a branch, a full ref, a refspec, another remote or a commit-only approval is refused" \
+                 || fail "tag push:$_pabad"
 
 # ---- commit+push: the push is for the commit the approved diff became -----------------------------------------
 _pa_new; _pabad=""
@@ -8598,6 +8617,26 @@ for _pr in 'files: a · change: archi (planning only) · verify: none' 'files: a
 done
 [ -z "$_v2b" ] && pass "a card on one line (· ; | separators, a Card: lead, above: on the line) is read by its labels and held to the three-line rules: a critical path still needs opus; a kind with a note in parentheses is the kind, on one line or three; a bad change, labels out of order, a missing verify or prose first are refused" \
                || fail "the one-line card:$_v2b"
+# `above:` among the three lines, not only after them (2026-10-19: 2 of 19 line refusals had it between change: and
+# verify:; the retry moved it down and passed). It keeps the model the same way; the three are still all required.
+_v2b=""
+for _pr in 'files: src/ui/a.ts\nchange: feature\nabove: the parser is subtle\nverify: true' 'above: the parser is subtle\nfiles: src/ui/a.ts\nchange: feature\nverify: true'; do
+  _v2one "$_pr" opus; { [ "$_rc" = 0 ] && [ ! -s "$_v2/oneout" ]; } || _v2b="$_v2b [above: among the three did not keep opus: $_pr → $_rc $(head -c 100 "$_v2/oneout")]"
+done
+_v2one 'files: src/ui/c.ts\nchange: feature\nverify: true' opus
+grep -q '"updatedInput":' "$_v2/oneout" || _v2b="$_v2b [without above: opus was not lowered (rc $_rc)]"
+for _pr in 'files: src/ui/a.ts\nchange: feature\nabove: x\nDo it.' 'files: src/ui/a.ts\nabove: x\nabove: y\nverify: true'; do
+  _v2one "$_pr" sonnet; { [ "$_rc" = 2 ] && grep -q 'opens with its task card' "$_v2/err"; } || _v2b="$_v2b [passed: $_pr → $_rc]"
+done
+# `change: review` is an audit (the discipline's table lists it with them): same floor, a near miss still refused.
+_v2one 'files: src/ui/a.ts\nchange: review\nverify: none' haiku; { [ "$_rc" = 2 ] && grep -q 'runs on sonnet' "$_v2/err"; } || _v2b="$_v2b [review on haiku was not held to sonnet as audit (rc $_rc)]"
+for _pr in 'files: src/ui/a.ts\nchange: review\nverify: none' 'files: src/ui/a.ts · change: review (the staged diff) · verify: none'; do
+  _v2one "$_pr" sonnet; [ "$_rc" = 0 ] || _v2b="$_v2b [refused: $_pr → $_rc $(head -c 100 "$_v2/err")]"
+done
+_v2one 'files: src/payments/p.ts\nchange: review\nverify: none' sonnet; { [ "$_rc" = 2 ] && grep -q 'runs on opus' "$_v2/err"; } || _v2b="$_v2b [review on a critical path was not held to opus (rc $_rc)]"
+_v2one 'files: src/ui/a.ts\nchange: reviews\nverify: none' sonnet; { [ "$_rc" = 2 ] && grep -q 'opens with its task card' "$_v2/err"; } || _v2b="$_v2b [change: reviews passed (rc $_rc)]"
+[ -z "$_v2b" ] && pass "above: may stand anywhere among the three card lines and keeps the model; without it the model is lowered; above: does not stand in for files:, change: or verify:; change: review is an audit, held to the same floors, and a near miss is still refused" \
+               || fail "above: in the card:$_v2b"
 
 # ---- at write time: the card can leave a file out --------------------------------------------------------------
 _v2new; _v2b=""

package/kit/hooks/guard-agent-model.sh

@@ -459,7 +459,7 @@ _am_card_line(){  # $1 = the first line of the task -> 0 and CARD_* set (uncheck
   return 0
 }
 _am_card(){  # $1 = a task text -> 0 and CARD_FILES, CARD_CHANGE, CARD_VERIFY (CARD_ABOVE); 1 and CARD_WHY
-  local s="$1" l k v n=0 seen="" one=0
+  local s="$1" l k v n=0 ln=0 seen="" one=0
   CARD_FILES=""; CARD_CHANGE=""; CARD_VERIFY=""; CARD_WHY=""; CARD_ABOVE=""
   s="${s//$'\r'/}"
   # One line first: the first line that is not empty, read by its labels; the three-line reading otherwise.
@@ -472,17 +472,20 @@ _am_card(){  # $1 = a task text -> 0 and CARD_FILES, CARD_CHANGE, CARD_VERIFY (C
     l="${s%%$'\n'*}"; if [ "$l" = "$s" ]; then s=""; else s="${s#*$'\n'}"; fi
     while :; do case "$l" in [$' \t']*) l="${l:1}" ;; *) break ;; esac; done
     [ -n "$l" ] || continue
-    n=$((n+1))
-    case "$l" in *:*) ;; *) CARD_WHY="line $n of the task is not one of files:, change:, verify:"; return 1 ;; esac
+    ln=$((ln+1))
+    case "$l" in *:*) ;; *) CARD_WHY="line $ln of the task is not one of files:, change:, verify:"; return 1 ;; esac
     k="${l%%:*}"; v="${l#*:}"
     while :; do case "$v" in [$' \t']*) v="${v:1}" ;; *) break ;; esac; done
     while :; do case "$v" in *[$' \t']) v="${v%?}" ;; *) break ;; esac; done
+    # `above:` may stand anywhere among the three (2 of 19 line refusals, 2026-10-19: between change: and verify:).
     case "$k" in
+      above)  [ -n "$CARD_ABOVE" ] || CARD_ABOVE="${v:0:200}"; continue ;;
       files)  CARD_FILES="$v" ;;
       change) CARD_CHANGE="$v" ;;
       verify) CARD_VERIFY="$v" ;;
-      *) CARD_WHY="line $n of the task is not one of files:, change:, verify:"; return 1 ;;
+      *) CARD_WHY="line $ln of the task is not one of files:, change:, verify:"; return 1 ;;
     esac
+    n=$((n+1))
     case "$seen" in *" $k "*) CARD_WHY="the card names $k twice"; return 1 ;; esac
     seen="$seen $k "
   done
@@ -491,6 +494,9 @@ _am_card(){  # $1 = a task text -> 0 and CARD_FILES, CARD_CHANGE, CARD_VERIFY (C
   # A note in parentheses after the kind is the session's own comment, as `none (…)` is for verify: `architecture
   # (planning only)` is architecture (4 of the cards refused on this machine, 2026-10-18). Only a kind on the list, and
   # only a note that is the whole rest of the value in parentheses.
+  # `review` is an audit: the discipline's model table names it with them, and 4 crew-review-agent cards were refused
+  # for it (2026-10-19).
+  case "$CARD_CHANGE" in review|'review ('*')') CARD_CHANGE=audit ;; esac
   case "$CARD_CHANGE" in *' ('*')') v="${CARD_CHANGE%% (*}"; case "$_AM_CHANGES" in *" $v "*) CARD_CHANGE="$v" ;; esac ;; esac
   case "$_AM_CHANGES" in *" $CARD_CHANGE "*) ;; *) CARD_WHY="change: is '${CARD_CHANGE:0:40}', not one of:$_AM_CHANGES"; return 1 ;; esac
   [ -n "$CARD_VERIFY" ] || { CARD_WHY="verify: is empty (a command, or none)"; return 1; }

package/kit/hooks/guard-bash.sh

@@ -2437,7 +2437,7 @@ _p44_scan(){  # $1 = the collapsed `git push …` -> 0 when it is `git push [-u]
   return 0
 }
 _approval_ok(){  # 0 = the user's recorded approval covers THIS call. Otherwise _APW says why not, for the message.
-  local k v op="" tr="" h="" b="" r="" u="" sid="" ts="" now age dir="${_CWD:-.}" hc=1 hp=1 cur tool
+  local k v op="" tr="" h="" b="" r="" u="" sid="" ts="" now age dir="${_CWD:-.}" hc=1 hp=1 cur tool tag _h2
   _APW="no approval from the user is on record"
   git_has "$CMD_SEEN" 'commit' && hc=0; git_has "$CMD_SEEN" 'push' && hp=0
   if [ "$hc" = 0 ] && [ "$hp" = 0 ]; then
@@ -2478,7 +2478,17 @@ _approval_ok(){  # 0 = the user's recorded approval covers THIS call. Otherwise
   _p44_scan "$_A44_S" || { _APW="the push is not in the one form an approval covers, git push <remote> <branch> ($_P44_WHY)"; return 1; }
   [ -n "$b" ] && [ -n "$r" ] && [ -n "$u" ] || { _APW="the approval record could not be read"; return 1; }
   if [ "$_P44_REMOTE" != "$r" ]; then _APW="the user approved a push to $r, not to $_P44_REMOTE"; return 1; fi
-  case "$_P44_REF" in "$b"|HEAD) ;; *) _APW="the user approved a push of $b, not of $_P44_REF"; return 1 ;; esac
+  # A TAG ON THE APPROVED COMMIT is part of that push (a release is tagged on what was approved): `git push <remote>
+  # <tag>` passes when <tag> is a tag and not also a branch, and it points at the commit the approval covers. A tag
+  # on any other commit, --tags, and a refspec are refused as before.
+  tag=""
+  case "$_P44_REF" in
+    "$b"|HEAD) ;;
+    *[!A-Za-z0-9._/-]*|-*|*..*|*/) _APW="the user approved a push of $b, not of $_P44_REF"; return 1 ;;
+    *) if git -C "$dir" show-ref --verify --quiet "refs/tags/$_P44_REF" 2>/dev/null \
+          && ! git -C "$dir" show-ref --verify --quiet "refs/heads/$_P44_REF" 2>/dev/null; then tag="$_P44_REF"
+       else _APW="the user approved a push of $b, not of $_P44_REF"; return 1; fi ;;
+  esac
   cur="$(git -C "$dir" symbolic-ref --short -q HEAD 2>/dev/null || true)"
   [ "$cur" = "$b" ] || { _APW="the user approved a push of $b, and the branch checked out now is ${cur:-<detached>}"; return 1; }
   # Where the remote pushes TO, with pushurl and pushInsteadOf applied: the name alone can be pointed elsewhere.
@@ -2491,8 +2501,16 @@ _approval_ok(){  # 0 = the user's recorded approval covers THIS call. Otherwise
   cur="$(git -C "$dir" rev-parse --verify --quiet HEAD 2>/dev/null || echo NONE)"
   if [ "$op" = push ]; then
     [ "$cur" = "$h" ] || { _APW="HEAD moved after the user approved the push (approved ${h:0:7}, now ${cur:0:7})"; return 1; }
+    if [ -n "$tag" ]; then
+      cur="$(git -C "$dir" rev-parse --verify --quiet "refs/tags/$tag^{commit}" 2>/dev/null || echo NONE)"
+      [ "$cur" = "$h" ] || { _APW="the tag $tag is on ${cur:0:7}, not on the commit the user approved for push (${h:0:7})"; return 1; }
+    fi
     return 0
   fi
+  if [ -n "$tag" ]; then
+    _h2="$cur"; cur="$(git -C "$dir" rev-parse --verify --quiet "refs/tags/$tag^{commit}" 2>/dev/null || echo NONE)"
+    [ "$cur" = "$_h2" ] || { _APW="the tag $tag is on ${cur:0:7}, not on the commit the user approved for push (${_h2:0:7})"; return 1; }
+  fi
   # commit+push: HEAD has to be the commit the approved index became.
   cur="$(git -C "$dir" rev-parse --verify --quiet 'HEAD^' 2>/dev/null || echo NONE)"
   if [ "$h" = NONE ] || [ "$cur" != "$h" ]; then

package/kit/hooks/prompt-approval.sh

@@ -707,9 +707,9 @@ _pa_record(){
     commit)      WHAT="commit of what is staged now (tree $_d) on HEAD $_h"
                  HOW="Run git commit -m with the message, alone in its call: no other option than -q, -s or -v, no paths, no cd, no pipe, nothing chained. Single-quote the message, or read it from a here-document with a quoted delimiter. The review record of §4.6 is still required." ;;
     push)        WHAT="push of $BR at $_h to $RM"
-                 HOW="Run exactly: git push $RM $BR (alone in its call: the remote and the branch written out, no cd, no pipe, nothing chained)." ;;
+                 HOW="Run exactly: git push $RM $BR (alone in its call: the remote and the branch written out, no cd, no pipe, nothing chained). A tag on that commit goes the same way: git push $RM <tag>." ;;
     commit+push) WHAT="commit of what is staged now (tree $_d) on HEAD $_h, then push of that commit on $BR to $RM"
-                 HOW="Run git commit -m with the message, alone in its call (no other option than -q, -s or -v, no paths, no cd, no pipe, nothing chained; single-quote the message; §4.6 still applies), then in a separate call exactly: git push $RM $BR" ;;
+                 HOW="Run git commit -m with the message, alone in its call (no other option than -q, -s or -v, no paths, no cd, no pipe, nothing chained; single-quote the message; §4.6 still applies), then in a separate call exactly: git push $RM $BR (a tag on the new commit: git push $RM <tag>)" ;;
   esac
   [ -n "$_u" ] && _u=" ($RM pushes to $_u)"
   _bw=""; [ "$BARE" = 1 ] && _bw="approved: $OP (what this session was refused). "

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "crewforth",
-  "version": "3.2.0-rc.5",
+  "version": "3.2.0-rc.7",
   "description": "Crewforth — your engineering crew for Claude Code: agents, skills and tool-level gates, in any stack.",
   "bin": {
     "crewforth": "bin/cli.js"