gentle-pi 1.2.0 → 2.0.0

package/scripts/build-git-commit-transaction-runner.mjs

@@ -8,7 +8,7 @@ import { fileURLToPath } from "node:url";
 const root = fileURLToPath(new URL("..", import.meta.url));
 const sources = [
 	"gentle-ai-binary",
-	"review-integration-v1",
+	"review-integration-v2",
 	"native-review-cli",
 	"git-commit-transaction",
 ];

package/scripts/gentle-ai-installer.mjs

@@ -19,31 +19,36 @@ import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 
 const execFileAsync = promisify(execFile);
-const RELEASE_BASE_URL = "https://github.com/Gentleman-Programming/gentle-ai/releases/download/v2.1.11/";
+const RELEASE_BASE_URL = "https://github.com/Gentleman-Programming/gentle-ai/releases/download/v2.2.2/";
 const MAX_DOWNLOAD_BYTES = 100 * 1024 * 1024;
 const MAX_REDIRECTS = 3;
 const DOWNLOAD_TIMEOUTS = { headers: 10_000, body: 30_000, attempts: 2, retryDelay: 100 };
-const INSTALLER_VERSION = "2.1.11";
+export const INSTALLER_VERSION = "2.2.2";
 
 // Sentinel used while a re-pinned gentle-ai release is not yet published. A
 // sentinel digest can never match a real SHA-256, so installation fails closed,
 // and verify-package-files.mjs refuses to pack/publish while any digest below
-// still holds it. The v2.1.11 digests are pinned from the published release:
-// archive sha256 values verified against checksums.txt and freshly computed
-// hashes; binary sha256 values computed from the extracted executables.
+// still holds it. The v2.2.2 digests are pinned from the published release:
+// archive sha256 values verified against the minisign-signed checksums.txt and
+// freshly computed hashes; binary sha256 values computed from the extracted
+// executables.
 export const GENTLE_AI_PENDING_DIGEST = "PENDING-GENTLE-AI-RELEASE-DIGEST";
 
 function asset(name, sha256, binarySha256, executable) {
 	return Object.freeze({ name, sha256, binarySha256, executable, url: `${RELEASE_BASE_URL}${name}` });
 }
 
+// Windows is absent on purpose. gentle-ai stopped distributing Windows builds
+// in c4b764d0 ("omit unsigned Windows distribution"), so v2.2.2 publishes only
+// darwin and linux archives and there is nothing to pin. A Windows caller now
+// gets resolveGentleAiReleaseAsset's unsupported-platform error, which is the
+// truth: Pi cannot install a binary that upstream does not publish. Restore
+// both rows the moment gentle-ai ships signed Windows assets again.
 export const GENTLE_AI_RELEASE_ASSETS = Object.freeze({
-	"darwin/amd64": asset("gentle-ai_2.1.11_darwin_amd64.tar.gz", "80c2a6bba981fd0ec1fdc9b21d9b80c03853cacc644b307ca7baf1faa6b376d2", "bffca50cb51b07cc1c428e21616ea1cf7d25970643fed13ab0aa10fd359bbd02", "gentle-ai"),
-	"darwin/arm64": asset("gentle-ai_2.1.11_darwin_arm64.tar.gz", "27e49a5104ff1ab156276e191b845f266135afe9339f111689ddf340b562c926", "4e39e520abf116a53ff5e36a0cd65756b6fadfa528489f21e9c722bfa00af620", "gentle-ai"),
-	"linux/amd64": asset("gentle-ai_2.1.11_linux_amd64.tar.gz", "d115aaf5724a71503150ebf740769e7aa52e41e673ac39bf5b0ff1be4e3324b0", "45788ac6cf37a6165f50aca3503d4af4e7e375e518fc67010064dccf78f98d2d", "gentle-ai"),
-	"linux/arm64": asset("gentle-ai_2.1.11_linux_arm64.tar.gz", "aea3a4b0064b57df5f831fdf6b27b29e9898a8f9393fd648dea4a8ba563e477e", "2bf929993ba03dd02401a3c35d8b0bff7801717e43d17b39e29f3cd389894e63", "gentle-ai"),
-	"windows/amd64": asset("gentle-ai_2.1.11_windows_amd64.zip", "43fb4e66cf36a7f01d2d343f59fe8ff37396fc0e98fb24abcd95bc79c2450e9a", "1c92cdcaf826d4bec6a6560770e5a0edefc09997364a664a5033abc6ab932b2b", "gentle-ai.exe"),
-	"windows/arm64": asset("gentle-ai_2.1.11_windows_arm64.zip", "9c2884075161715f0efac1ce55cd08f2d9313068f125443ade8de3a83645258a", "a903bface64af274a28cfdd08b5c55c67fc554bac9279d7d466fc3f99020bd89", "gentle-ai.exe"),
+	"darwin/amd64": asset("gentle-ai_2.2.2_darwin_amd64.tar.gz", "5ca67829903bf4c6b14665664f80f9d8216c84b10c8e50870d297f452cefb9dc", "9b239423450562d026384f482bbd2f1e3f2820431a84f0921743ac3df9d632de", "gentle-ai"),
+	"darwin/arm64": asset("gentle-ai_2.2.2_darwin_arm64.tar.gz", "0193e1a284444dccee2863d31b8dbb76a982e8f9111955908d6a9131c1a5490e", "149b97248552c5e03ebc4d991f86b1360fb847a40fc315555a8aa256f95baca0", "gentle-ai"),
+	"linux/amd64": asset("gentle-ai_2.2.2_linux_amd64.tar.gz", "b85bbb20eb2236de97b261df16cfc8d8394dfd07a137e885c4889b62d0c20fa1", "00d5732e8dd3945956800217a4f60213c2d9ca63351092a2cb7f4e5f9ece54f9", "gentle-ai"),
+	"linux/arm64": asset("gentle-ai_2.2.2_linux_arm64.tar.gz", "61e7077342448273f0c43af49ce4d182594bab5e4f86f812975af2fbe69e3b0b", "a92685aa7dbea0cc4297d016569b3defe9bb30a7374a620021e245b74f50eb68", "gentle-ai"),
 });
 
 function upstreamArchitecture(architecture) {

package/scripts/install-gentle-ai.mjs

@@ -1,14 +1,18 @@
 #!/usr/bin/env node
-import { installGentleAi } from "./gentle-ai-installer.mjs";
+// The version is read from the installer rather than written here. Two
+// hardcoded copies of it survived a pin bump once and reported installing
+// v2.1.11 while writing v2.2.0 to disk, which is the one moment an operator
+// most needs the number to be true.
+import { INSTALLER_VERSION, installGentleAi } from "./gentle-ai-installer.mjs";
 
 if (process.env.GENTLE_PI_SKIP_GENTLE_AI_INSTALL === "1") {
 	console.warn("GENTLE_PI_SKIP_GENTLE_AI_INSTALL=1: skipped package-local Gentle AI installation; native review operations will fail with package-local-binary-missing until gentle-pi is reinstalled.");
 } else {
 	try {
 		const result = await installGentleAi();
-		console.log(`Gentle AI v2.1.11 ${result.installed ? "installed" : "integrity-verified"} at ${result.binaryPath}`);
+		console.log(`Gentle AI v${INSTALLER_VERSION} ${result.installed ? "installed" : "integrity-verified"} at ${result.binaryPath}`);
 	} catch (error) {
-		console.error(`gentle-pi could not install its package-local Gentle AI v2.1.11 binary: ${error instanceof Error ? error.message : String(error)}`);
+		console.error(`gentle-pi could not install its package-local Gentle AI v${INSTALLER_VERSION} binary: ${error instanceof Error ? error.message : String(error)}`);
 		process.exitCode = 1;
 	}
 }

package/scripts/test-packed-runner.mjs

@@ -57,8 +57,8 @@ try {
 	const versions = readdirSync(join(packageRoot, ".gentle-ai"), { withFileTypes: true }).filter((entry) => entry.isDirectory() && /^v\d+\.\d+\.\d+$/.test(entry.name));
 	if (versions.length !== 1) throw new Error("packed install did not contain exactly one package-local Gentle AI version");
 	const executable = join(packageRoot, ".gentle-ai", versions[0].name, process.platform === "win32" ? "gentle-ai.exe" : "gentle-ai");
-	const capabilities = JSON.parse(execFileSync(executable, ["review", "capabilities", "--contract", "gentle-ai.review-integration/v1"], { cwd: installDirectory, encoding: "utf8" }));
-	if (!["gentle-ai.review-integration.capabilities/v1", "gentle-ai.review-integration.capabilities/v1.1"].includes(capabilities.schema) || capabilities.contract !== "gentle-ai.review-integration/v1" || capabilities.package?.version !== versions[0].name.slice(1)) throw new Error("package-local Gentle AI returned incompatible capabilities");
+	const capabilities = JSON.parse(execFileSync(executable, ["review", "capabilities", "--contract", "gentle-ai.review-integration/v2"], { cwd: installDirectory, encoding: "utf8" }));
+	if (!["gentle-ai.review-integration.capabilities/v2"].includes(capabilities.schema) || capabilities.contract !== "gentle-ai.review-integration/v2" || capabilities.package?.version !== versions[0].name.slice(1)) throw new Error("package-local Gentle AI returned incompatible capabilities");
 	const packageManifest = JSON.parse(readFileSync(join(packageRoot, "package.json"), "utf8"));
 	process.stdout.write(`packed runner E2E passed (gentle-pi ${packageManifest.version ?? "unknown"}; Gentle AI ${capabilities.package?.version ?? "unknown"}; ${result.states.length} states)\n`);
 } finally {

package/scripts/verify-package-files.mjs

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
-import { existsSync, readFileSync, statSync } from "node:fs";
-import { join } from "node:path";
-import { fileURLToPath } from "node:url";
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { join, relative, sep } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
 
 const root = join(fileURLToPath(new URL("..", import.meta.url)));
 
@@ -43,12 +43,12 @@ const requiredPaths = [
   "lib/gentle-ai-binary.ts",
   "lib/git-commit-transaction.ts",
   "lib/native-review-cli.ts",
-  "lib/review-integration-v1.ts",
+  "lib/review-integration-v2.ts",
   "lib/sdd-preflight.ts",
 	"runtime/gentle-ai-binary.mjs",
 	"runtime/git-commit-transaction.mjs",
 	"runtime/native-review-cli.mjs",
-	"runtime/review-integration-v1.mjs",
+	"runtime/review-integration-v2.mjs",
 	"scripts/build-git-commit-transaction-runner.mjs",
   "scripts/gentle-ai-installer.mjs",
   "scripts/install-gentle-ai.mjs",
@@ -76,84 +76,236 @@ const requiredPaths = [
 ];
 
 const contractHashes = {
+  "contracts/review-integration/v1/fixtures/binding-revision-conflict.fixture.json": "c2e294843cee5185324cb7a41702574ef94852517239d99e7493a1414a60b363",
   "contracts/review-integration/v1/fixtures/capabilities-v1.1.fixture.json": "1b3dc40dce7bfb5d3ecc7e92af68d66e71b733ba0b0f71ba94d3c633adc48bcf",
+  "contracts/review-integration/v1/fixtures/capabilities-v1.2.fixture.json": "2970d21cd95a7fcaea6547c47a591a5151046e7ede658b3e8c5b9a9c5d106b65",
+  "contracts/review-integration/v1/fixtures/capabilities-v1.3.fixture.json": "0ec783ea13b4c82c0b002c5caa758f33e2b488537297cc2d0694ec92176ac0cb",
+  "contracts/review-integration/v1/fixtures/capabilities-v1.4.fixture.json": "84e0db457b76b97b35c2be772dfc647f9eab66810ea98f64fed85645c3c266ba",
+  "contracts/review-integration/v1/fixtures/capabilities-v1.5.fixture.json": "0cc952af3767c393bde9e4785e4071615a529fd672bc94da4fcc204780524a27",
   "contracts/review-integration/v1/fixtures/capabilities.fixture.json": "b3ca822189a236f2d891628c665ca23e308bf5185a1701e1f07231bd970461bb",
+  "contracts/review-integration/v1/fixtures/consent.fixture.json": "b2ff4809b9eb75a54206800dca13f96396976aca7387e45f765ac6ec98029cd1",
   "contracts/review-integration/v1/fixtures/failure.fixture.json": "e72b6ab5e3c529abac47bd324444f84ca90f67ef0a67189f5fd8d24d199a2759",
-  "contracts/review-integration/v1/fixtures/operation.fixture.json": "f867bead654d467319d85ff518b39f145996df6a9494fdbff798516928dacfcd",
-  "contracts/review-integration/v1/fixtures/start.fixture.json": "d61267ee2e0a5e4c64cf48f40b4882d2284bfdaad9942a09ee29d7e693012238",
-  "contracts/review-integration/v1/fixtures/status-ambiguous.fixture.json": "0f2737c2ed67bb2edb184faa8ac7006ef4f9172b9929aaa063432871c2aa945c",
-  "contracts/review-integration/v1/fixtures/status-corrupted.fixture.json": "a9c25d0d0eab2cc91ef095939c650deafadb112e75d0957a21aa8c60b51fdcda",
-  "contracts/review-integration/v1/fixtures/status-unrelated.fixture.json": "e8aa372dfa582e4bf78992757135bc902c28bd9fe946210e40c3edf4c6abfb0b",
-  "contracts/review-integration/v1/fixtures/status.fixture.json": "cf981c5fd715357f817fc9206523284dddd1ede8ceee99e7b4935847327e6adc",
+  "contracts/review-integration/v1/fixtures/final-verification-incident.fixture.json": "f8bc06549e62b0bee5cf2ecde625e18da178dd18c9d3023b7d7e8fd0ebbba646",
+  "contracts/review-integration/v1/fixtures/operation.fixture.json": "3547748a4df57382178064abbdb1cf12f1d58a75c0e9d6452fdd9beb3aaeac3a",
+  "contracts/review-integration/v1/fixtures/repair-preflight.fixture.json": "7168cb53ad470066d0b3edc3b7911d1aebff91abd41ecc3d822f8ffa5cea6cb1",
+  "contracts/review-integration/v1/fixtures/start-v2.fixture.json": "388c7c21374b89afe2d42d64bd1987d17ec0e2c7151cab1c56a08969ffb2ea0e",
+  "contracts/review-integration/v1/fixtures/start.fixture.json": "f369160ac26eb3427b57de2dd01c9d8c81e51c8a2bd546446780129d31b1945b",
+  "contracts/review-integration/v1/fixtures/status-ambiguous.fixture.json": "ee695fd58ba72adfb3b51dfd16432a177498173a45bfcb594d6bdc53bfa32e6e",
+  "contracts/review-integration/v1/fixtures/status-corrupted.fixture.json": "4cfc0048c28a39cec8a32fecfaad66e56e5c1248263ceb4ce66b6717981880b2",
+  "contracts/review-integration/v1/fixtures/status-recover.fixture.json": "714f762f72380ce93d567626cafbaa536ab3aae02af73d3d40ca123f1f30d8b0",
+  "contracts/review-integration/v1/fixtures/status-unrelated.fixture.json": "deab36c877ced3c9b480ca33724c10d88f75c761d6426fa14be850345122891d",
+  "contracts/review-integration/v1/fixtures/status-v2-ambiguous.fixture.json": "80a459a7a18d8d933dd42acb6a94a75ac19278e9a6c3b125e3017946768eaa47",
+  "contracts/review-integration/v1/fixtures/status-v2-corrupted.fixture.json": "466f1e28b101e95178630f26a90fff96ad3516e2aa6a17f5f357bab9bda2ab52",
+  "contracts/review-integration/v1/fixtures/status-v2-final-verification-retry.fixture.json": "889ede9a84bdbe561df2d2401adda95634582c44db9d1075ba839f33d65c7886",
+  "contracts/review-integration/v1/fixtures/status-v2-recover.fixture.json": "178331fc7177d2316fd4f56610ac295f7da2780be96b233b72935d5f476610f2",
+  "contracts/review-integration/v1/fixtures/status-v2-repair.fixture.json": "89083cad752fca38da09e919825d0b80641a8a029364ba1869e5b58ef2e59a1d",
+  "contracts/review-integration/v1/fixtures/status-v2-unrelated.fixture.json": "c178b338dcd5d30888acef37a9d752bd0932d6dedfffb61b0596a9cceabeb692",
+  "contracts/review-integration/v1/fixtures/status-v2.fixture.json": "5410d8bbae1b7152a43b3a5c4c880e9e98a5e47b76d910456f5ef13f19836f3a",
+  "contracts/review-integration/v1/fixtures/status.fixture.json": "555054d8046a896162995dcb117752f9cd1ef903fb9ebaad29af1b7e7f319bb3",
+  "contracts/review-integration/v1/fixtures/verification-evidence.fixture.json": "b30e3863548845b90e256d92193435d02da458bf8f15a4c33d023cd1f6894a5f",
+  "contracts/review-integration/v1/schemas/admitted-result.schema.json": "7796e8dbba331434594108c902dfab7ec46f691fa447a9259a78f2448111b0de",
+  "contracts/review-integration/v1/schemas/artifact-subject.schema.json": "f7dcd934e27e8f3735a37f3d0ec8048dd8ccc1811b9df61124a1dcbf8a03f40e",
+  "contracts/review-integration/v1/schemas/authority-repair-assessment.schema.json": "232591670009f99c53a68e91d1e7e60465c294f1721f493ab1e7ae182842cfb5",
   "contracts/review-integration/v1/schemas/capabilities-v1.1.schema.json": "2b14162284f375f8563e49d3a28caaa0aabb572094d8d290eb61844b1353af78",
+  "contracts/review-integration/v1/schemas/capabilities-v1.2.schema.json": "df1722adcd9c999edbef090bfd5d9a9713f6852a9bc9cb79684ef7c9c91c0d62",
+  "contracts/review-integration/v1/schemas/capabilities-v1.3.schema.json": "3401a062fa8a034ef7743f84adbfdd2ceadaf81bee8a7e62115fd4e18afacfcd",
+  "contracts/review-integration/v1/schemas/capabilities-v1.4.schema.json": "926b61c8ac0f870f09214f6bd8af1b035c5b72f14f0b83c0d4a7bdbb277f5447",
+  "contracts/review-integration/v1/schemas/capabilities-v1.5.schema.json": "abc783821524dcc33339495284805a85f79b3352efb7358c95016ed164bd7f24",
   "contracts/review-integration/v1/schemas/capabilities.schema.json": "ad333177494a251beac153f74bd751fa77126a9968aad69e64fc2abf15cff0f7",
-  "contracts/review-integration/v1/schemas/failure.schema.json": "11284601a00e0192c41b1f3aab0b153635e28ad57ec5f1e2e90a69d129296c44",
-  "contracts/review-integration/v1/schemas/operation.schema.json": "7673bb168b6df8cee68f4449a9b79f0a1fc349747e5b26009b41d649979f690d",
+  "contracts/review-integration/v1/schemas/consent.schema.json": "f8f2edec17568124488482c2aee399909111fe0cce2cba426fb29efd2c7c1cd0",
+  "contracts/review-integration/v1/schemas/failure.schema.json": "0ce29f61408fc21d72640fffdb215a608a820c29f3e5ff62d9cc295ed0451937",
+  "contracts/review-integration/v1/schemas/final-verification-incident.schema.json": "39b1ec178b1d3bc8da9a3d92dadd8092385000f2a6930b5bfcb4a84dbc6493ca",
+  "contracts/review-integration/v1/schemas/operation.schema.json": "6cf15b54977fea7301b9a5c766e709f8a912fda33560365de6dfcab4d2ecbce0",
   "contracts/review-integration/v1/schemas/projection.schema.json": "7168a3eba929dde2b8f0b7723ee51d5a5421102bdeefe892578c263debd08db2",
+  "contracts/review-integration/v1/schemas/repair.schema.json": "febb747dc68f8ded5974b6dd94051ec3cfdb5a886ccb853b1ce53aaf2e41efc0",
+  "contracts/review-integration/v1/schemas/result-artifact-v2.schema.json": "38895aae2f6ca4980b1a8e157fee8503920820d5f6be3c757c0fa04e8430cd6b",
   "contracts/review-integration/v1/schemas/result-artifact.schema.json": "91296bd2c261fd2fe03bffd63efe58badd4927e0d0d8480cd4213f651ecacdf6",
-  "contracts/review-integration/v1/schemas/start.schema.json": "f3390d09cccb5136392e247db780b9415ceba8c49971a1b1a84240fc66694d97",
-  "contracts/review-integration/v1/schemas/status.schema.json": "11ed3aae66e86534b696df3ed11536c4d1f648e2d33ee05a1cd48412903d5db2",
-  "contracts/review-integration/v1/fixtures/status-recover.fixture.json": "e50893555694944fc904f3c90442c2f4b2855fda1f36f55482c5a7eed884a75a",
-  "docs/review-integration.md": "4bead7c3e3cf7ecfac18941d96ece52a1d6eb263d410ef54f9422aa07eab131c",
+  "contracts/review-integration/v1/schemas/start-v2.schema.json": "ec8550cd93bbe84af1ce87dfd7abfa9e24692f42b20f8f0bf9cac1d4b88ea46c",
+  "contracts/review-integration/v1/schemas/start.schema.json": "4296aebbd4128ce51945a2f6d3228aa77ac7215c802978d559bff5279ec56229",
+  "contracts/review-integration/v1/schemas/status-v2.schema.json": "63e8988ce276d948ea8305008a3d27c4e26dff664cf54fffed9e188f465d92d1",
+  "contracts/review-integration/v1/schemas/status.schema.json": "67f3bddf5f5feeb3213bce489de8548546163b2e1d49a0e3965c0091dabc8c39",
+  "contracts/review-integration/v1/schemas/targeted-validation-request.schema.json": "52b91154693b4dd66983fc91ecf7197503555f2c9e85cac626cffd3035c53d65",
+  "contracts/review-integration/v1/schemas/verification-evidence.schema.json": "fd15890bf2ef1db95d771ee7f468e9e64014351d7940f65604eb24f41e68a22f",
+  "contracts/review-integration/v2/fixtures/capabilities.fixture.json": "17c150d851c15b3f0c20d18c2e2741eb2232ffa24f35aa71d6d30e90a85e42b7",
+  "contracts/review-integration/v2/fixtures/consent.fixture.json": "a6d3ddc979d3dba202e4bf4ea5ca468ade1284f564f9325c313f4f9a9796f0ad",
+  "contracts/review-integration/v2/fixtures/start.fixture.json": "34b21328fa910e03af2fac8e816c5b510ba146201da0cd4ef1693d39a6344ba0",
+  "contracts/review-integration/v2/fixtures/status.fixture.json": "d5438578f2969f17635fecea94c7ef46d14c78fa668e50df48c4254254d5e935",
+  "contracts/review-integration/v2/schemas/admitted-result.schema.json": "c6a9c880191d65c46d9cfc8a0812af16b636573a8f6e57ea34aa16d6f6bb9735",
+  "contracts/review-integration/v2/schemas/artifact-subject.schema.json": "3e71a81340ea6149b03afa71530d10ce654c415fa21d4e07f0c9c25b3d2d70a3",
+  "contracts/review-integration/v2/schemas/capabilities.schema.json": "7ab061ed27bd3b929d6033cc20f56097e851f4454ca14a815255748b50191248",
+  "contracts/review-integration/v2/schemas/consent.schema.json": "b2b4465338497f11927de91cb2e5da12b6cb4a1039afe05aebe1abbf53b21858",
+  "contracts/review-integration/v2/schemas/failure.schema.json": "1c53da8c543cc5e03fbbfc700d4fc80cadb3b0e5e72c6d77a7790008671d0962",
+  "contracts/review-integration/v2/schemas/operation.schema.json": "beee02046ec1d5b8c89e3d7de35f897c275830e43c67ecd162886bfd0138ace6",
+  "contracts/review-integration/v2/schemas/repair.schema.json": "9e842d1ded797a91ede16b2054a38708b2d1fc7a0d6217541f84c0f2f5a2e73e",
+  "contracts/review-integration/v2/schemas/start.schema.json": "86ddfcfe1912489abef7461613d692ea53a4d7d73d444d5f6dbbd7f9866a2c37",
+  "contracts/review-integration/v2/schemas/status.schema.json": "132b15dd7a0514aa451373bd4b3c02a1491b7b11cf5b9ce43bc300b549397ac9",
+  "docs/review-integration.md": "4ee3493303b03c7cb761f35865722b1691f164f72e6f94574512c42832ff04f2",
 };
 
 requiredPaths.push(...Object.keys(contractHashes));
 
-const missing = requiredPaths.filter((relativePath) => {
-  const absolutePath = join(root, relativePath);
-  return !existsSync(absolutePath) || !statSync(absolutePath).isFile();
-});
-
-if (missing.length > 0) {
-  console.error("gentle-pi package is missing required Pi resources:");
-  for (const relativePath of missing) {
-    console.error(`- ${relativePath}`);
-  }
-  console.error("\nRefusing to pack/publish an incomplete npm package.");
-  process.exit(1);
+function listFilesRecursively(directory) {
+  return readdirSync(directory, { withFileTypes: true }).flatMap((entry) => {
+    const absolutePath = join(directory, entry.name);
+    if (entry.isDirectory()) return listFilesRecursively(absolutePath);
+    return entry.isFile() ? [absolutePath] : [];
+  });
 }
 
-const driftedContracts = Object.entries(contractHashes).flatMap(([relativePath, expected]) => {
-  const actual = createHash("sha256").update(readFileSync(join(root, relativePath))).digest("hex");
-  return actual === expected ? [] : [{ relativePath, expected, actual }];
-});
+// Walks `contracts/` on disk and reconciles it against `contractHashes`
+// (restricted to `contracts/**` keys — `docs/review-integration.md` is a
+// byte-pinned contract artifact but lives outside this walk root). Reports
+// the two drift directions separately so a new unlisted file and a stale
+// hash-map entry are both visible.
+export function reconcileContractsOnDisk(packageRoot, hashes) {
+  const contractsRoot = join(packageRoot, "contracts");
+  const walked = existsSync(contractsRoot)
+    ? listFilesRecursively(contractsRoot).map((absolutePath) =>
+        relative(packageRoot, absolutePath).split(sep).join("/"),
+      )
+    : [];
+  const listed = Object.keys(hashes).filter((relativePath) => relativePath.startsWith("contracts/"));
+  const walkedSet = new Set(walked);
+  const listedSet = new Set(listed);
 
-if (driftedContracts.length > 0) {
-  console.error("gentle-pi packaged review-integration/v1 bytes drifted from the byte-identical Gentle AI v2.1.11 contract:");
-  for (const drift of driftedContracts) console.error(`- ${drift.relativePath}: expected ${drift.expected}, got ${drift.actual}`);
-  process.exit(1);
+  return {
+    unlistedOnDisk: walked.filter((relativePath) => !listedSet.has(relativePath)).sort(),
+    listedButMissing: listed.filter((relativePath) => !walkedSet.has(relativePath)).sort(),
+  };
 }
 
-// Release guard: refuse to pack/publish while any installer digest is not a real
-// pinned SHA-256 (for example the pre-release pending sentinel).
-const { GENTLE_AI_RELEASE_ASSETS } = await import(new URL("./gentle-ai-installer.mjs", import.meta.url));
-const unpinnedDigests = Object.entries(GENTLE_AI_RELEASE_ASSETS).flatMap(([target, asset]) =>
-  [["sha256", asset.sha256], ["binarySha256", asset.binarySha256]]
-    .filter(([, digest]) => !/^[0-9a-f]{64}$/.test(digest))
-    .map(([field]) => `${target}.${field}`));
-if (unpinnedDigests.length > 0) {
-  console.error("gentle-pi Gentle AI release digests are not pinned SHA-256 values:");
-  for (const entry of unpinnedDigests) console.error(`- ${entry}`);
-  console.error("Refusing to pack/publish until scripts/gentle-ai-installer.mjs pins the published checksums.txt archive digests and extracted binary digests.");
-  process.exit(1);
+// Reads the generator's `sources` array by regex rather than importing it,
+// so this script never needs the generator to export anything it doesn't
+// already export for its own `--write`/`--check` CLI use.
+export function extractGeneratedRuntimeSources(packageRoot) {
+  const generatorPath = join(packageRoot, "scripts/build-git-commit-transaction-runner.mjs");
+  const generatorSource = readFileSync(generatorPath, "utf8");
+  const sourcesMatch = generatorSource.match(/const sources = \[([\s\S]*?)\];/);
+  if (!sourcesMatch) {
+    throw new Error(`${generatorPath} does not declare a "sources" array`);
+  }
+  return [...sourcesMatch[1].matchAll(/"([^"]+)"/g)].map((match) => match[1]);
 }
 
-const generatedRuntimeCheck = spawnSync(process.execPath, [join(root, "scripts/build-git-commit-transaction-runner.mjs"), "--check"], {
-  cwd: root,
-  encoding: "utf8",
-  env: { ...process.env, NODE_NO_WARNINGS: "1" },
-});
-if (generatedRuntimeCheck.status !== 0) {
-  console.error("gentle-pi generated commit transaction runtime does not match its TypeScript sources:");
-  console.error((generatedRuntimeCheck.stderr || generatedRuntimeCheck.stdout || "unknown generator failure").trim());
-  process.exit(1);
+// Three-way reconciliation: the generator's `sources` names must equal the
+// `.mjs` basenames on disk in `runtime/`, which must equal the `runtime/`
+// entries in `requiredPaths`. Deliberately not a `lib/`-driven walk: most
+// `lib/` modules are intentionally unpaired with a generated runtime file.
+export function reconcileGeneratedRuntimeSources(packageRoot, sources, paths) {
+  const runtimeRoot = join(packageRoot, "runtime");
+  const runtimeBasenames = existsSync(runtimeRoot)
+    ? readdirSync(runtimeRoot)
+        .filter((name) => name.endsWith(".mjs"))
+        .map((name) => name.slice(0, -".mjs".length))
+    : [];
+  const requiredRuntimeBasenames = paths
+    .filter((relativePath) => relativePath.startsWith("runtime/") && relativePath.endsWith(".mjs"))
+    .map((relativePath) => relativePath.slice("runtime/".length, -".mjs".length));
+
+  const sourceSet = new Set(sources);
+  const runtimeSet = new Set(runtimeBasenames);
+  const requiredSet = new Set(requiredRuntimeBasenames);
+  const names = new Set([...sourceSet, ...runtimeSet, ...requiredSet]);
+
+  const drifted = [...names]
+    .filter((name) => !(sourceSet.has(name) && runtimeSet.has(name) && requiredSet.has(name)))
+    .sort()
+    .map((name) => ({
+      name,
+      inSources: sourceSet.has(name),
+      inRuntimeDir: runtimeSet.has(name),
+      inRequiredPaths: requiredSet.has(name),
+    }));
+
+  return { drifted };
 }
 
-const installer = readFileSync(join(root, "scripts/gentle-ai-installer.mjs"), "utf8");
-const binaryResolver = readFileSync(join(root, "lib/gentle-ai-binary.ts"), "utf8");
-if (!installer.includes('INSTALLER_VERSION = "2.1.11"') || !binaryResolver.includes('GENTLE_AI_VERSION = "2.1.11"')) {
-	console.error("gentle-pi package-local Gentle AI version pins are not both v2.1.11.");
-  process.exit(1);
+async function main() {
+  const missing = requiredPaths.filter((relativePath) => {
+    const absolutePath = join(root, relativePath);
+    return !existsSync(absolutePath) || !statSync(absolutePath).isFile();
+  });
+
+  if (missing.length > 0) {
+    console.error("gentle-pi package is missing required Pi resources:");
+    for (const relativePath of missing) {
+      console.error(`- ${relativePath}`);
+    }
+    console.error("\nRefusing to pack/publish an incomplete npm package.");
+    process.exit(1);
+  }
+
+  const { unlistedOnDisk, listedButMissing } = reconcileContractsOnDisk(root, contractHashes);
+  if (unlistedOnDisk.length > 0 || listedButMissing.length > 0) {
+    console.error("gentle-pi packaged contracts/ tree has drifted from contractHashes:");
+    for (const relativePath of unlistedOnDisk) console.error(`- unlisted-on-disk: ${relativePath}`);
+    for (const relativePath of listedButMissing) console.error(`- listed-but-missing: ${relativePath}`);
+    console.error("\nRefusing to pack/publish an unreconciled contracts/ tree.");
+    process.exit(1);
+  }
+
+  const generatedRuntimeSources = extractGeneratedRuntimeSources(root);
+  const { drifted } = reconcileGeneratedRuntimeSources(root, generatedRuntimeSources, requiredPaths);
+  if (drifted.length > 0) {
+    console.error("gentle-pi generated commit transaction runtime sources, runtime/*.mjs, and requiredPaths have drifted apart:");
+    for (const entry of drifted) {
+      const where = [];
+      if (!entry.inSources) where.push("missing from generator sources");
+      if (!entry.inRuntimeDir) where.push("missing from runtime/*.mjs");
+      if (!entry.inRequiredPaths) where.push("missing from requiredPaths");
+      console.error(`- ${entry.name}: ${where.join(", ")}`);
+    }
+    console.error("\nRefusing to pack/publish an unreconciled generated runtime.");
+    process.exit(1);
+  }
+
+  const driftedContracts = Object.entries(contractHashes).flatMap(([relativePath, expected]) => {
+    const actual = createHash("sha256").update(readFileSync(join(root, relativePath))).digest("hex");
+    return actual === expected ? [] : [{ relativePath, expected, actual }];
+  });
+
+  if (driftedContracts.length > 0) {
+    console.error("gentle-pi packaged review-integration/v1 and review-integration/v2 contract bytes drifted from the byte-identical Gentle AI v2.2.2 contract:");
+    for (const drift of driftedContracts) console.error(`- ${drift.relativePath}: expected ${drift.expected}, got ${drift.actual}`);
+    process.exit(1);
+  }
+
+  // Release guard: refuse to pack/publish while any installer digest is not a real
+  // pinned SHA-256 (for example the pre-release pending sentinel).
+  const { GENTLE_AI_RELEASE_ASSETS } = await import(new URL("./gentle-ai-installer.mjs", import.meta.url));
+  const unpinnedDigests = Object.entries(GENTLE_AI_RELEASE_ASSETS).flatMap(([target, asset]) =>
+    [["sha256", asset.sha256], ["binarySha256", asset.binarySha256]]
+      .filter(([, digest]) => !/^[0-9a-f]{64}$/.test(digest))
+      .map(([field]) => `${target}.${field}`));
+  if (unpinnedDigests.length > 0) {
+    console.error("gentle-pi Gentle AI release digests are not pinned SHA-256 values:");
+    for (const entry of unpinnedDigests) console.error(`- ${entry}`);
+    console.error("Refusing to pack/publish until scripts/gentle-ai-installer.mjs pins the published checksums.txt archive digests and extracted binary digests.");
+    process.exit(1);
+  }
+
+  const generatedRuntimeCheck = spawnSync(process.execPath, [join(root, "scripts/build-git-commit-transaction-runner.mjs"), "--check"], {
+    cwd: root,
+    encoding: "utf8",
+    env: { ...process.env, NODE_NO_WARNINGS: "1" },
+  });
+  if (generatedRuntimeCheck.status !== 0) {
+    console.error("gentle-pi generated commit transaction runtime does not match its TypeScript sources:");
+    console.error((generatedRuntimeCheck.stderr || generatedRuntimeCheck.stdout || "unknown generator failure").trim());
+    process.exit(1);
+  }
+
+  const installer = readFileSync(join(root, "scripts/gentle-ai-installer.mjs"), "utf8");
+  const binaryResolver = readFileSync(join(root, "lib/gentle-ai-binary.ts"), "utf8");
+  if (!installer.includes('INSTALLER_VERSION = "2.2.2"') || !binaryResolver.includes('GENTLE_AI_VERSION = "2.2.2"')) {
+    console.error("gentle-pi package-local Gentle AI version pins are not both v2.2.2.");
+    process.exit(1);
+  }
+
+  console.log(`gentle-pi package resource check passed (${requiredPaths.length} files; ${Object.keys(contractHashes).length} exact byte-identical v2.2.2 contract artifacts).`);
 }
 
-console.log(`gentle-pi package resource check passed (${requiredPaths.length} files; ${Object.keys(contractHashes).length} exact byte-identical v2.1.11 contract artifacts).`);
+const isMainModule = process.argv[1] !== undefined && import.meta.url === pathToFileURL(process.argv[1]).href;
+if (isMainModule) {
+  await main();
+}

package/skills/release/SKILL.md

@@ -4,7 +4,7 @@ description: "Release gentle-pi through GitHub and npm. Trigger: release, publis
 license: Apache-2.0
 metadata:
   author: gentleman-programming
-  version: "1.0"
+  version: "1.2"
 ---
 
 ## When to Use
@@ -15,6 +15,7 @@ Use this skill when preparing, publishing, or verifying a `gentle-pi` release.
 
 - Do not publish `gentle-pi` to npm from a local machine.
 - npm publishing MUST go through the GitHub Actions workflow `.github/workflows/publish.yml` so provenance, environment protection, and registry credentials are controlled by GitHub.
+- Dispatch the trusted workflow definition from protected default `main`, never from a release tag. Its only caller input is the exact annotated version tag.
 - Use a clean worktree for release commits. Do not package unrelated local files or scratch artifacts.
 - Validate the approved receipt against the exact immutable release target with zero review actors before publication.
 - Release from protected `main` may bypass receipt validation only when the tag targets the current immutable `origin/main` SHA, required CI for that exact SHA is successful, the remote head is rechecked before tag push, and no fresh risk evidence exists; otherwise fail closed through native receipt validation. Never infer the tag target from local `HEAD`. Major and post-incident releases require explicit extraordinary review even when fast-path checks pass.
@@ -40,10 +41,11 @@ Use this skill when preparing, publishing, or verifying a `gentle-pi` release.
 
    ```bash
    pnpm test
-   pnpm publish --dry-run --no-git-checks
+   node scripts/verify-package-files.mjs
+   npm pack --dry-run
    ```
 
-   The dry run is allowed because it does not publish. It verifies package contents and lifecycle scripts.
+   `npm pack --dry-run` verifies package contents and lifecycle scripts without entering a publish path.
 
 4. **Commit and push**
 
@@ -51,28 +53,51 @@ Use this skill when preparing, publishing, or verifying a `gentle-pi` release.
    git add <intended-files>
    git commit -m "<type(scope): release-ready change>"
    git push origin HEAD:main
+   git fetch origin main --tags
    ```
 
-5. **Create the GitHub release**
+5. **Create and verify the exact version tag**
 
    ```bash
-   git tag -a v<version> -m "gentle-pi v<version>"
-   git push origin v<version>
-   gh release create v<version> \
+   version="$(node -p "require('./package.json').version")"
+   tag="v${version}"
+   release_sha="$(git rev-parse 'origin/main^{commit}')"
+
+   test "$(git rev-parse 'HEAD^{commit}')" = "${release_sha}"
+   test -z "$(git ls-remote --tags origin "refs/tags/${tag}")"
+
+   git tag -a "${tag}" "${release_sha}" -m "gentle-pi ${tag}"
+   test "$(git rev-parse "${tag}^{commit}")" = "${release_sha}"
+
+   git fetch origin main
+   test "$(git rev-parse 'origin/main^{commit}')" = "${release_sha}"
+   git push origin "refs/tags/${tag}"
+
+   git fetch --no-tags origin "refs/tags/${tag}"
+   test "$(git rev-parse 'FETCH_HEAD^{commit}')" = "${release_sha}"
+
+   gh release create "${tag}" \
      --repo Gentleman-Programming/gentle-pi \
-     --title "gentle-pi v<version>" \
+     --verify-tag \
+     --title "gentle-pi ${tag}" \
      --notes "<release notes>"
    ```
 
+   Do not retag or overwrite an existing version. The tag target comes from the freshly fetched immutable `origin/main` commit, not an ambient local branch.
+
 6. **Publish npm through GitHub Actions**
 
    ```bash
+   version="$(node -p "require('./package.json').version")"
+   tag="v${version}"
    gh workflow run publish.yml \
      --repo Gentleman-Programming/gentle-pi \
      --ref main \
-     -f dist-tag=latest
+     -f tag="${tag}"
    ```
 
+   The workflow definition always comes from protected default `main`. It accepts only one exact `vSemVer` tag, fetches the remote annotated tag and current remote `main`, and requires the peeled tag commit, dispatch/main workflow commit, checkout, and `package.json` version to match. It re-queries remote tag and `main` immediately before npm publication, derives the dist-tag internally, and uses trusted OIDC with provenance.
+
    Watch the run and fail the release if it fails:
 
    ```bash
@@ -90,7 +115,8 @@ Use this skill when preparing, publishing, or verifying a `gentle-pi` release.
 ## Failure Handling
 
 - A publication failure never reopens the closed review lineage. Diagnose and retry publication separately without resetting review counters.
-- If a local `npm publish` fails, do not retry locally. Use the GitHub workflow instead.
+- Never attempt or retry `npm publish` locally. Re-dispatch from trusted `main` only when the same tag still targets the current remote `main` and the failure was publication-only.
+- If remote `main` advances, do not move or recreate the existing tag. Prepare a new release commit/version and create a new annotated version tag.
 - If the workflow fails, inspect logs with:
 
   ```bash
@@ -104,7 +130,8 @@ Use this skill when preparing, publishing, or verifying a `gentle-pi` release.
 Report:
 
 - Commit SHA pushed to `main`.
+- Exact version tag and its peeled commit SHA.
 - GitHub release URL.
 - Publish workflow run URL and conclusion.
-- npm exact version and `latest` dist-tag.
+- npm exact version and the workflow-derived dist-tag (`latest`, `beta`, or `next`).
 - Any remaining follow-up or warnings.