pumuki 6.3.142 → 6.3.144

package/CHANGELOG.md

@@ -6,6 +6,13 @@ This project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [6.3.143] - 2026-05-05
+
+### Fixed
+
+- **PUMUKI-INC-060 baseline TDD/BDD fresco:** los cambios in-scope bloquean si la evidencia de baseline TDD/BDD está caducada, obligando a reejecutar los tests baseline del componente antes de editar código relacionado.
+- **Ventana configurable de evidencia:** `PUMUKI_TDD_BDD_EVIDENCE_MAX_AGE_SECONDS` permite ajustar la frescura máxima; por defecto son 900 segundos y los valores inválidos mantienen el modo estricto.
+
 ## [6.3.142] - 2026-05-05
 
 ### Fixed

package/docs/operations/RELEASE_NOTES.md

@@ -4,6 +4,18 @@ This file tracks the active deterministic framework line used in this repository
 Canonical release chronology lives in `CHANGELOG.md`.
 This file keeps only the operational highlights and rollout notes that matter while running the framework.
 
+### 2026-05-05 (v6.3.144)
+
+- **RuralGo PUMUKI-INC-122:** `pumuki sdd evidence` serializa escrituras concurrentes del artefacto `.pumuki/artifacts/pumuki-evidence-v1.json` con lock local y rename atómico.
+- **Sin pérdida de slices:** dos ejecuciones paralelas fusionan slices existentes/nuevas en lugar de pisar el JSON compartido; además el scaffold genera baseline TDD/BDD válido desde la evidencia PRE_WRITE.
+- **Rollout:** publicar `pumuki@6.3.144`, repinear primero RuralGo y revalidar `status`, `doctor` y una ráfaga concurrente de `pumuki sdd evidence`.
+
+### 2026-05-05 (v6.3.143)
+
+- **RuralGo PUMUKI-INC-060:** PRE_WRITE deja de aceptar evidencia TDD/BDD de baseline caducada para cambios in-scope.
+- **Baseline antes de editar:** si el componente tocado requiere TDD/BDD, la evidencia debe ser reciente y pasada; si no, Pumuki bloquea y pide reejecutar baseline tests.
+- **Rollout:** publicar `pumuki@6.3.143`, repinear primero RuralGo y revalidar `status`, `doctor` y el bloqueo por evidencia stale.
+
 ### 2026-05-05 (v6.3.142)
 
 - **RuralGo PUMUKI-INC-059:** PRE_WRITE vuelve a pedir hechos AST para iOS SOLID aunque el flag experimental de heurísticas esté apagado.

package/integrations/sdd/evidenceScaffold.ts

@@ -1,5 +1,14 @@
-import { createHash } from 'node:crypto';
-import { mkdirSync, writeFileSync } from 'node:fs';
+import { createHash, randomUUID } from 'node:crypto';
+import {
+  closeSync,
+  existsSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  writeFileSync,
+} from 'node:fs';
 import { basename, dirname, isAbsolute, relative, resolve } from 'node:path';
 import { readEvidenceResult, type EvidenceReadResult } from '../evidence/readEvidence';
 
@@ -27,6 +36,11 @@ export type SddEvidenceScaffoldResult = {
     slices: Array<{
       id: string;
       scenario_ref: string;
+      baseline: {
+        status: 'passed';
+        timestamp: string;
+        test_ref: string;
+      };
       red: {
         status: 'failed';
         timestamp: string;
@@ -62,9 +76,100 @@ export type SddEvidenceScaffoldResult = {
   };
 };
 
+type SddEvidenceArtifact = SddEvidenceScaffoldResult['artifact'];
+
+const LOCK_WAIT_BUFFER_BYTES = 4;
+const EVIDENCE_ARTIFACT_LOCK_TIMEOUT_MS = 5000;
+const EVIDENCE_ARTIFACT_LOCK_RETRY_DELAY_MS = 25;
+const EVIDENCE_ARTIFACT_JSON_INDENT_SPACES = 2;
+
 const computeDigest = (value: string): string =>
   `sha256:${createHash('sha256').update(value, 'utf8').digest('hex')}`;
 
+const sleepSync = (milliseconds: number): void => {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(LOCK_WAIT_BUFFER_BYTES)), 0, 0, milliseconds);
+};
+
+const acquireFileLock = (lockPath: string): (() => void) => {
+  const startedAt = Date.now();
+  mkdirSync(dirname(lockPath), { recursive: true });
+  while (true) {
+    try {
+      const fd = openSync(lockPath, 'wx');
+      writeFileSync(fd, `${process.pid}:${new Date().toISOString()}\n`, 'utf8');
+      return () => {
+        closeSync(fd);
+        rmSync(lockPath, { force: true });
+      };
+    } catch (error) {
+      const code = error instanceof Error && 'code' in error
+        ? String((error as NodeJS.ErrnoException).code)
+        : '';
+      if (code !== 'EEXIST') {
+        throw error;
+      }
+      if (Date.now() - startedAt > EVIDENCE_ARTIFACT_LOCK_TIMEOUT_MS) {
+        throw new Error(
+          `[pumuki][sdd] evidence artifact is locked by another process: ${lockPath}. Retry when the current evidence write finishes.`
+        );
+      }
+      sleepSync(EVIDENCE_ARTIFACT_LOCK_RETRY_DELAY_MS);
+    }
+  }
+};
+
+const readExistingSddEvidenceArtifact = (path: string): SddEvidenceArtifact | null => {
+  if (!existsSync(path)) {
+    return null;
+  }
+  const parsed = JSON.parse(readFileSync(path, 'utf8')) as Partial<SddEvidenceArtifact>;
+  if (parsed.version !== '1' || !Array.isArray(parsed.slices)) {
+    return null;
+  }
+  return parsed as SddEvidenceArtifact;
+};
+
+const mergeSddEvidenceArtifacts = (params: {
+  existing: SddEvidenceArtifact | null;
+  next: SddEvidenceArtifact;
+}): SddEvidenceArtifact => {
+  if (!params.existing) {
+    return params.next;
+  }
+  const slices = params.existing.slices.filter(
+    (slice) => !params.next.slices.some((nextSlice) => nextSlice.id === slice.id)
+  );
+  return {
+    ...params.next,
+    slices: [...slices, ...params.next.slices],
+  };
+};
+
+const writeSddEvidenceArtifactAtomically = (params: {
+  outputPath: string;
+  artifact: SddEvidenceArtifact;
+}): {
+  artifact: SddEvidenceArtifact;
+  serialized: string;
+} => {
+  const lockPath = `${params.outputPath}.lock`;
+  const release = acquireFileLock(lockPath);
+  const tempPath = `${params.outputPath}.${process.pid}.${randomUUID()}.tmp`;
+  try {
+    const artifact = mergeSddEvidenceArtifacts({
+      existing: readExistingSddEvidenceArtifact(params.outputPath),
+      next: params.artifact,
+    });
+    const serialized = `${JSON.stringify(artifact, null, EVIDENCE_ARTIFACT_JSON_INDENT_SPACES)}\n`;
+    writeFileSync(tempPath, serialized, 'utf8');
+    renameSync(tempPath, params.outputPath);
+    return { artifact, serialized };
+  } finally {
+    rmSync(tempPath, { force: true });
+    release();
+  }
+};
+
 const resolveRepoBoundPath = (params: {
   repoRoot: string;
   candidatePath: string;
@@ -91,7 +196,7 @@ const resolveRepoBoundPath = (params: {
   return resolved;
 };
 
-const isPlaceholderToken = (value: string): boolean => {
+const isReservedInputValue = (value: string): boolean => {
   const normalized = value.trim().toLowerCase();
   return (
     normalized === 'todo' ||
@@ -110,7 +215,7 @@ const normalizeRequired = (value: string | undefined, flagName: string): string
   if (normalized.length === 0) {
     throw new Error(`[pumuki][sdd] evidence requires ${flagName}.`);
   }
-  if (isPlaceholderToken(normalized)) {
+  if (isReservedInputValue(normalized)) {
     throw new Error(`[pumuki][sdd] evidence ${flagName} must not be a placeholder value.`);
   }
   return normalized;
@@ -214,6 +319,11 @@ export const runSddEvidenceScaffold = (params?: {
       {
         id: scenarioId,
         scenario_ref: resolveScenarioReference(scenarioId),
+        baseline: {
+          status: 'passed',
+          timestamp: validEvidence.source_descriptor.generated_at ?? generatedAt,
+          test_ref: 'pumuki sdd validate --stage=PRE_WRITE --json',
+        },
         red: {
           status: 'failed',
           timestamp: generatedAt,
@@ -249,13 +359,19 @@ export const runSddEvidenceScaffold = (params?: {
       status: 'valid',
     },
   };
-  const serialized = `${JSON.stringify(artifact, null, 2)}\n`;
-  const digest = computeDigest(serialized);
+  let finalArtifact = artifact;
+  let serialized = `${JSON.stringify(finalArtifact, null, 2)}\n`;
 
   if (!dryRun) {
     mkdirSync(dirname(outputAbsolutePath), { recursive: true });
-    writeFileSync(outputAbsolutePath, serialized, 'utf8');
+    const writeResult = writeSddEvidenceArtifactAtomically({
+      outputPath: outputAbsolutePath,
+      artifact,
+    });
+    finalArtifact = writeResult.artifact;
+    serialized = writeResult.serialized;
   }
+  const digest = computeDigest(serialized);
 
   return {
     command: 'pumuki sdd evidence',
@@ -273,6 +389,6 @@ export const runSddEvidenceScaffold = (params?: {
       written: !dryRun,
       digest,
     },
-    artifact,
+    artifact: finalArtifact,
   };
 };

package/integrations/tdd/enforcement.ts

@@ -76,10 +76,33 @@ const isTimelineOrdered = (timestamps: ReadonlyArray<string | undefined>): boole
   return true;
 };
 
+const DEFAULT_EVIDENCE_MAX_AGE_SECONDS = 900;
+
+const resolveEvidenceMaxAgeSeconds = (): number => {
+  const raw = process.env.PUMUKI_TDD_BDD_EVIDENCE_MAX_AGE_SECONDS?.trim();
+  if (!raw) {
+    return DEFAULT_EVIDENCE_MAX_AGE_SECONDS;
+  }
+  const parsed = Number.parseInt(raw, 10);
+  if (!Number.isFinite(parsed) || parsed <= 0) {
+    return DEFAULT_EVIDENCE_MAX_AGE_SECONDS;
+  }
+  return parsed;
+};
+
+const resolveEvidenceAgeSeconds = (generatedAt: string, nowMs: number): number | null => {
+  const generatedAtMs = new Date(generatedAt).getTime();
+  if (Number.isNaN(generatedAtMs)) {
+    return null;
+  }
+  return Math.max(0, Math.floor((nowMs - generatedAtMs) / 1000));
+};
+
 export const enforceTddBddPolicy = (params: {
   facts: ReadonlyArray<Fact>;
   repoRoot: string;
   branch: string | null;
+  now?: () => number;
 }): TddBddEnforcementResult => {
   const scope = classifyTddBddScope(params.facts);
   const baseSnapshot: TddBddSnapshot = {
@@ -210,6 +233,46 @@ export const enforceTddBddPolicy = (params: {
     };
   }
 
+  const maxAgeSeconds = resolveEvidenceMaxAgeSeconds();
+  const ageSeconds = resolveEvidenceAgeSeconds(
+    evidenceRead.evidence.generated_at,
+    params.now?.() ?? Date.now()
+  );
+  if (ageSeconds === null || ageSeconds > maxAgeSeconds) {
+    const messageAge =
+      ageSeconds === null ? 'unknown' : `${ageSeconds}s`;
+    const finding = buildFinding({
+      ruleId: 'generic_tdd_baseline_required',
+      code: 'TDD_BDD_EVIDENCE_STALE',
+      message:
+        `TDD/BDD evidence is stale for this PRE_WRITE baseline: age=${messageAge}, max=${maxAgeSeconds}s. Re-run the baseline tests for the touched component and refresh evidence before editing related code.`,
+      filePath: evidenceRead.path,
+    });
+    return {
+      findings: [finding],
+      snapshot: {
+        ...baseSnapshot,
+        status: 'blocked',
+        evidence: {
+          ...baseSnapshot.evidence,
+          state: 'valid',
+          version: evidenceRead.evidence.version,
+          slices_total: evidenceRead.evidence.slices.length,
+          slices_valid: 0,
+          slices_invalid: evidenceRead.evidence.slices.length,
+          integrity_ok: evidenceRead.integrity.valid,
+          errors: ['TDD_BDD_EVIDENCE_STALE'],
+          baseline: {
+            required: true,
+            passed: 0,
+            missing: 0,
+            failed: 0,
+          },
+        },
+      },
+    };
+  }
+
   const sliceFindings: Finding[] = [];
   const seenSliceIds = new Set<string>();
   let validSlices = 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pumuki",
-  "version": "6.3.142",
+  "version": "6.3.144",
   "description": "Enterprise-grade AST Intelligence System with multi-platform support (iOS, Android, Backend, Frontend) and Feature-First + DDD + Clean Architecture enforcement. Includes dynamic violations API for intelligent querying.",
   "main": "index.js",
   "bin": {