pumuki 6.3.85 → 6.3.87

package/docs/operations/RELEASE_NOTES.md

@@ -1,3 +1,7 @@
+## 2026-04-20 (v6.3.87)
+- Cierra el segundo tramo de PUM-026: si PRE_WRITE solo arregla el receipt MCP y el gate pasa a verde, fuerza un refresh de paridad contra PRE_COMMIT antes del veredicto final.
+- Rollout recomendado: actualizar Flux_training y repetir la repro mínima de validate/pre-commit/.ai_evidence.
+
 # Release Notes (v2.x line)
 
 This file tracks the active deterministic framework line used in this repository.
@@ -6,6 +10,12 @@ This file keeps only the operational highlights and rollout notes that matter wh
 
 ## 2026-04 (CLI stability and macOS notifications)
 
+### 2026-04-20 (v6.3.86)
+
+- **Paridad de gate real**: `pumuki sdd validate --stage=PRE_WRITE --json` deja de devolver verde falso cuando el hook real bloquearía por evidencia o findings staged; ahora fuerza refresh de evidencia incluso si el `aiGate` inicial llega en `ALLOWED`.
+- **Evidencia consistente**: el envelope final de `validate` usa el resultado refrescado y `.ai_evidence.json` queda en `BLOCK` cuando el rojo real del consumer persiste.
+- **Rollout recomendado**: publicar `pumuki@6.3.86`, repin inmediato en `Flux_training` y revalidar con un rojo frontend staged (`validate PRE_WRITE`, `pre-commit`, `.ai_evidence.json`, `status`, `doctor`).
+
 ### 2026-04-20 (v6.3.85)
 
 - **Tracking con viñeta reconocido**: el enforcement ya cuenta correctamente `- [🚧] - tarea` como única tarea activa válida en el MD canónico, eliminando falsos `count=0` en consumers que usan ese formato.

package/integrations/lifecycle/cliSdd.ts

@@ -35,7 +35,6 @@ import {
   type PreWriteOpenSpecBootstrapTrace,
   buildPreWriteExperimentalDisabledResult,
   buildSddExperimentalEnableAdvisoryCommand,
-  runRawPreWriteAiGateCheck,
   PRE_WRITE_ENABLE_STRICT_COMMAND,
 } from './cli';
 
@@ -196,15 +195,9 @@ export const runSddCommand = async (parsed: ParsedArgs, activeDependencies: Life
             automationTrace.attempted = auto.trace.attempted;
             automationTrace.actions = auto.trace.actions;
           }
-          const rawPreWriteAiGate = result.stage === 'PRE_WRITE' && aiGate
-            ? runRawPreWriteAiGateCheck({
-              repoRoot: process.cwd(),
-              requireMcpReceipt: true,
-            })
-            : null;
           const nextAction = resolvePreWriteNextAction({
             sdd: result,
-            aiGate: rawPreWriteAiGate ?? aiGate,
+            aiGate,
           });
           const sddExperimentalNextAction =
             !aiGate && result.decision.code === 'SDD_EXPERIMENTAL_DISABLED'
@@ -216,10 +209,10 @@ export const runSddCommand = async (parsed: ParsedArgs, activeDependencies: Life
           if (parsed.json) {
             writeInfo(
               JSON.stringify(
-                (rawPreWriteAiGate ?? aiGate)
+                (aiGate)
                   ? buildPreWriteValidationEnvelope(
                     result,
-                    rawPreWriteAiGate ?? aiGate!,
+                    aiGate!,
                     preWriteEnforcement,
                     experimentalFeatures,
                     policyValidation,

package/integrations/lifecycle/preWriteAutomation.ts

@@ -98,7 +98,7 @@ export const buildPreWriteAutomationTrace = async (params: {
     attempted: false,
     actions: [],
   };
-  if (params.sdd.stage !== 'PRE_WRITE' || params.aiGate.allowed) {
+  if (params.sdd.stage !== 'PRE_WRITE') {
     return {
       aiGate: params.aiGate,
       trace,
@@ -106,6 +106,42 @@ export const buildPreWriteAutomationTrace = async (params: {
   }
 
   let aiGate = params.aiGate;
+  if (aiGate.allowed) {
+    trace.attempted = true;
+    try {
+      const gateExitCode = await params.runPlatformGate({
+        policy: {
+          stage: 'PRE_COMMIT',
+          blockOnOrAbove: 'ERROR',
+          warnOnOrAbove: 'WARN',
+        },
+        scope: {
+          kind: 'workingTree',
+        },
+        auditMode: 'gate',
+        dependencies: {
+          printGateFindings: () => {},
+        },
+      });
+      trace.actions.push({
+        action: 'refresh_evidence',
+        status: 'OK',
+        details: `stage=PRE_COMMIT runPlatformGate exit_code=${gateExitCode} parity_probe=allowed_initial`,
+      });
+      aiGate = activeDependencies.runEnterpriseAiGateCheck({
+        repoRoot: params.repoRoot,
+        stage: 'PRE_WRITE',
+        requireMcpReceipt: true,
+      }).result;
+    } catch (error) {
+      trace.actions.push({
+        action: 'refresh_evidence',
+        status: 'FAILED',
+        details: error instanceof Error ? error.message : 'Unknown PRE_COMMIT parity refresh error',
+      });
+    }
+  }
+
   if (hasAutoFixableEvidenceViolation(aiGate)) {
     trace.attempted = true;
     try {
@@ -202,6 +238,32 @@ export const buildPreWriteAutomationTrace = async (params: {
         stage: 'PRE_WRITE',
         requireMcpReceipt: true,
       }).result;
+      if (aiGate.allowed) {
+        const gateExitCode = await params.runPlatformGate({
+          policy: {
+            stage: 'PRE_COMMIT',
+            blockOnOrAbove: 'ERROR',
+            warnOnOrAbove: 'WARN',
+          },
+          scope: {
+            kind: 'workingTree',
+          },
+          auditMode: 'gate',
+          dependencies: {
+            printGateFindings: () => {},
+          },
+        });
+        trace.actions.push({
+          action: 'refresh_evidence',
+          status: 'OK',
+          details: `stage=PRE_COMMIT runPlatformGate exit_code=${gateExitCode} parity_probe=allowed_after_mcp_receipt_refresh`,
+        });
+        aiGate = activeDependencies.runEnterpriseAiGateCheck({
+          repoRoot: params.repoRoot,
+          stage: 'PRE_WRITE',
+          requireMcpReceipt: true,
+        }).result;
+      }
     } catch (error) {
       trace.actions.push({
         action: 'refresh_mcp_receipt',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pumuki",
-  "version": "6.3.85",
+  "version": "6.3.87",
   "description": "Enterprise-grade AST Intelligence System with multi-platform support (iOS, Android, Backend, Frontend) and Feature-First + DDD + Clean Architecture enforcement. Includes dynamic violations API for intelligent querying.",
   "main": "index.js",
   "bin": {