release-skill 0.1.10 → 0.2.0

package/src/commands/publish.mjs

@@ -41,6 +41,12 @@ import {
   reObservePreviousPublicBaseline,
 } from '../core/previous-public-baseline.mjs';
 import { createEvidenceWriter } from '../core/evidence.mjs';
+import {
+  ADAPTER_ACTION_TYPE_MAP,
+  TIER_TABLE,
+  groupActionsByTier,
+  sortActionsByCheckpointOrder,
+} from '../core/checkpoints.mjs';
 import { appendRunState, createProductionRunDir, writeRunAtomic, resolveDefaultRunDir } from '../core/run.mjs';
 import {
   ReleaseError,
@@ -50,6 +56,7 @@ import {
 } from '../core/errors.mjs';
 import { assertTransition, PUBLISHING, PUBLISHED, PARTIAL } from '../core/state-machine.mjs';
 import { matchObservation } from '../adapters/contract.mjs';
+import { observeWithRetry, clampPolicyToTimeout, DEFAULT_OBSERVE_RETRY_POLICY, isPropagatingMissing } from '../core/observe-retry.mjs';
 import {
   resolveFrozenPath,
   verifyFrozenFile,
@@ -71,37 +78,8 @@ function assertInsideAssetRoot(assetRoot, candidate, label) {
 
 const ACTION_NOT_ALLOWED = 'ACTION_NOT_ALLOWED';
 
-/** Checkpoint order for the publish saga. */
-const CHECKPOINT_ORDER = [
-  'push-commit',
-  'push-snapshot',
-  'set-default-branch',
-  'create-tag',
-  'npm-publish',
-  'github-release',
-  'claude-marketplace-install',
-  'codex-marketplace-install',
-  'kimi-marketplace-install',
-];
-
-/**
- * Map plan action type to adapter ActionType.
- *
- * Plan uses `push-commit`, `push-snapshot`, `create-tag`, `npm-publish`,
- * `github-release`. The adapter contract uses `git-push`, `git-tag`,
- * `npm-publish`, `github-release`.
- */
-const ADAPTER_ACTION_TYPE_MAP = {
-  'push-commit': 'git-push',
-  'push-snapshot': 'push-snapshot',
-  'set-default-branch': 'set-default-branch',
-  'create-tag': 'git-tag',
-  'npm-publish': 'npm-publish',
-  'github-release': 'github-release',
-  'claude-marketplace-install': 'claude-marketplace-install',
-  'codex-marketplace-install': 'codex-marketplace-install',
-  'kimi-marketplace-install': 'kimi-marketplace-install',
-};
+// CHECKPOINT_ORDER, ADAPTER_ACTION_TYPE_MAP and TIER_TABLE live in
+// ../core/checkpoints.mjs (single source shared with reconcile.mjs; T3.1 §4.7).
 
 const MARKETPLACE_TYPES = new Set([
   'claude-marketplace-install',
@@ -124,6 +102,112 @@ function deepClone(obj) {
   return JSON.parse(JSON.stringify(obj));
 }
 
+// ---------------------------------------------------------------------------
+// Pre-observe classification (T3.3 observe-before-execute)
+// ---------------------------------------------------------------------------
+
+/**
+ * Four-valued result of classifying a single read-only pre-observe.
+ *
+ * - CONSISTENT: the remote already satisfies the frozen plan -> SKIPPED.
+ * - MISSING: an explicit absence marker -> proceed to execute.
+ * - CONFLICTING: present but disagrees with the frozen plan -> fail closed.
+ * - UNOBSERVABLE: no usable observation -> proceed to execute (the mandatory
+ *   post-execute observe remains the safety net).
+ *
+ * @enum {string}
+ */
+export const PRE_OBSERVE = Object.freeze({
+  CONSISTENT: 'CONSISTENT',
+  MISSING: 'MISSING',
+  CONFLICTING: 'CONFLICTING',
+  UNOBSERVABLE: 'UNOBSERVABLE',
+});
+
+/** True when `expected` is a non-empty object (vacuous matches are rejected). */
+function hasExpected(expected) {
+  return !!expected && typeof expected === 'object' && Object.keys(expected).length > 0;
+}
+
+/**
+ * Classify a single read-only pre-observe result for one action.
+ *
+ * Shared single source for BOTH preflight layers (the per-checkpoint pre-observe
+ * inside executeCheckpoint and the Safety-Gate-10 global preflight arbitration);
+ * the two layers must never drift apart (T3.3 §4.6).
+ *
+ * Classification order is the semantics:
+ * 1. UNOBSERVABLE -- no observation, or an empty observation (a thrown observe
+ *    surfaces as an empty observation with `error`). Fail-safe: the caller
+ *    proceeds to execute.
+ * 2. Double-safe-state actions (push-snapshot, set-default-branch) mirror
+ *    reconcile's special templates: a "safe pre-state" (frozen predecessor /
+ *    still-old default branch) is MISSING (execute), NOT CONFLICTING, so a fresh
+ *    publish is not blown up by generic three-way classification.
+ * 3. Generic actions -- CONSISTENT when the observation matches a non-empty
+ *    expected; MISSING on an explicit absence marker (single-sourced from
+ *    isPropagatingMissing); otherwise CONFLICTING.
+ *
+ * Actions with no (or an empty) expected can never be CONSISTENT here; callers
+ * skip pre-observe for them entirely (matchObservation({}, obs) would vacuously
+ * match and wrongly SKIPPED).
+ *
+ * @param {{ type?: string, expected?: Object, parameters?: Object }} action
+ * @param {{ observation?: Object|null, error?: string|null }|null} observeResult
+ * @returns {string} One of PRE_OBSERVE values.
+ */
+export function classifyPreObservation(action, observeResult) {
+  const observation = observeResult?.observation;
+  // 1. UNOBSERVABLE: missing or empty observation (covers thrown observes, which
+  // adapters normalize to an empty observation + error).
+  if (!observation || Object.keys(observation).length === 0) {
+    return PRE_OBSERVE.UNOBSERVABLE;
+  }
+
+  const expected = action?.expected;
+  const parameters = action?.parameters ?? {};
+
+  // 2a. push-snapshot (mirrors reconcile.mjs advance-push template).
+  if (action?.type === 'push-snapshot') {
+    if (hasExpected(expected) && matchObservation(expected, observation).matches) {
+      return PRE_OBSERVE.CONSISTENT; // already at the planned successor
+    }
+    if (parameters.expectedBaselineCommit && observation.commit === parameters.expectedBaselineCommit) {
+      return PRE_OBSERVE.MISSING; // still at the frozen predecessor: safe to push
+    }
+    if (observation.exists === false) {
+      return PRE_OBSERVE.MISSING; // remote branch absent: safe to create
+    }
+    return PRE_OBSERVE.CONFLICTING; // a third-party tip
+  }
+
+  // 2b. set-default-branch (mirrors reconcile.mjs default-branch template).
+  if (action?.type === 'set-default-branch') {
+    // Safety floor first: the target branch tip must not have advanced past the
+    // frozen commit -- never switch the default branch onto a moved tip.
+    if (parameters.expectedNewBranchCommit && observation.newBranchCommit !== parameters.expectedNewBranchCommit) {
+      return PRE_OBSERVE.CONFLICTING;
+    }
+    if (observation.defaultBranch === parameters.newBranch
+      && hasExpected(expected) && matchObservation(expected, observation).matches) {
+      return PRE_OBSERVE.CONSISTENT; // already switched
+    }
+    if (observation.defaultBranch === parameters.oldBranch) {
+      return PRE_OBSERVE.MISSING; // not switched yet: safe to execute
+    }
+    return PRE_OBSERVE.CONFLICTING; // a third branch is the default
+  }
+
+  // 3. Generic actions (create-tag, npm-publish, github-release, git-push, ...).
+  if (hasExpected(expected) && matchObservation(expected, observation).matches) {
+    return PRE_OBSERVE.CONSISTENT;
+  }
+  if (isPropagatingMissing(observeResult)) {
+    return PRE_OBSERVE.MISSING;
+  }
+  return PRE_OBSERVE.CONFLICTING;
+}
+
 // ---------------------------------------------------------------------------
 // Checkpoint execution
 // ---------------------------------------------------------------------------
@@ -163,6 +247,61 @@ async function executeCheckpoint(action, adapterRegistry, context) {
     };
   }
 
+  // T3.3 pre-observe (observe-before-execute): read the remote ONCE, before
+  // preflight. A remote already consistent with the frozen plan is SKIPPED
+  // (idempotent, zero side effects); an explicit conflict fails closed for human
+  // review. Order is the contract: pre-observe -> preflight -> execute, so an
+  // "already consistent" remote is never misread by preflight as "occupied".
+  // Single-shot on purpose (NOT observeWithRetry): a missing/unobservable
+  // pre-observe simply proceeds to execute, whose mandatory post-observe remains
+  // the safety net (T3.3 §4.4 asymmetry). Actions without a usable expected are
+  // skipped here and keep the legacy preflight -> execute behavior.
+  let preObserve;
+  if (hasExpected(action.expected)) {
+    const preObserveInput = {
+      actionType: adapterActionType,
+      ...action.parameters,
+      expected: action.expected,
+    };
+    let preObserveResult;
+    try {
+      preObserveResult = await adapter.observe(preObserveInput, context);
+    } catch (error) {
+      preObserveResult = { observation: null, error: error?.message ?? String(error) };
+    }
+    const classification = classifyPreObservation(action, preObserveResult);
+    await context.evidence?.append?.({
+      phase: 'checkpoint-pre-observe',
+      actionId,
+      actionType: planActionType,
+      status: 'pre-observe',
+      details: { preObserve: classification },
+    });
+    if (classification === PRE_OBSERVE.CONSISTENT) {
+      return {
+        actionId,
+        status: 'SKIPPED',
+        error: null,
+        observation: preObserveResult?.observation ?? null,
+        preObserve: PRE_OBSERVE.CONSISTENT,
+      };
+    }
+    if (classification === PRE_OBSERVE.CONFLICTING) {
+      const mismatches = matchObservation(action.expected, preObserveResult?.observation ?? {}).mismatches;
+      return {
+        actionId,
+        status: 'FAILED',
+        error: `pre-observe conflict: ${mismatches.join('; ') || 'remote state is present but does not match the frozen plan'}`,
+        observation: preObserveResult?.observation ?? null,
+        preObserve: PRE_OBSERVE.CONFLICTING,
+      };
+    }
+    if (classification === PRE_OBSERVE.MISSING) {
+      preObserve = PRE_OBSERVE.MISSING;
+    }
+    // UNOBSERVABLE: `preObserve` stays undefined (left empty, never MISSING).
+  }
+
   // Preflight (read-only, no authorization required)
   const preflightResult = await adapter.preflight(
     { actionType: adapterActionType, ...action.parameters },
@@ -191,18 +330,56 @@ async function executeCheckpoint(action, adapterRegistry, context) {
   // Once execute was attempted, its return value is not authoritative: the
   // remote may have accepted the write before the connection failed. Always
   // observe before classifying the checkpoint.
+  const observeInput = {
+    actionType: adapterActionType,
+    ...action.parameters,
+    expected: action.expected,
+  };
+
   let observeResult;
-  try {
-    observeResult = await adapter.observe(
-      { actionType: adapterActionType, ...action.parameters, expected: action.expected },
+  if (executeError) {
+    // execute threw: remote state is unknown. Keep the SINGLE observe
+    // path and never retry — retrying cannot resolve an unknown write
+    // outcome, and must not mask a real conflict. (T1.1 fail-closed.)
+    try {
+      observeResult = await adapter.observe(observeInput, context);
+    } catch (error) {
+      return {
+        actionId,
+        status: 'UNCERTAIN',
+        error: `execute outcome is uncertain; observe threw: ${error.message}`,
+        ...(preObserve ? { preObserve } : {}),
+      };
+    }
+  } else {
+    // execute did not throw: a missing/uncertain observe may be a
+    // transient propagation delay (e.g. npm registry eventual
+    // consistency). Retry the read-only observe with bounded backoff
+    // (T1.1 PROPAGATING handling). A present-but-mismatched
+    // observation (CONFLICTING) is never retried — it is an
+    // authoritative conflict that must fail closed for human review.
+    const observePolicy = MARKETPLACE_TYPES.has(planActionType)
+      ? clampPolicyToTimeout(DEFAULT_OBSERVE_RETRY_POLICY, action.parameters?.timeoutMs)
+      : DEFAULT_OBSERVE_RETRY_POLICY;
+    const retryOutcome = await observeWithRetry({
+      observe: (act, ctx) => adapter.observe(act, ctx),
+      action: observeInput,
       context,
-    );
-  } catch (error) {
-    return {
-      actionId,
-      status: 'UNCERTAIN',
-      error: `execute outcome is uncertain; observe threw: ${error.message}`,
-    };
+      policy: observePolicy,
+      sleep: context.observeRetrySleep,
+      onAttempt: (info) => context.evidence?.append?.({
+        phase: 'checkpoint-observe-retry',
+        actionId,
+        actionType: planActionType,
+        attempt: info.attempt,
+        maxAttempts: info.maxAttempts,
+        missing: info.missing,
+        delayMs: info.delayMs,
+        status: info.missing ? 'propagating' : 'resolved',
+        error: info.error ?? null,
+      }),
+    });
+    observeResult = retryOutcome.result;
   }
 
   const observation = observeResult?.observation;
@@ -211,14 +388,15 @@ async function executeCheckpoint(action, adapterRegistry, context) {
       actionId,
       status: 'UNCERTAIN',
       error: `execute outcome is uncertain; observe failed: ${observeResult?.error ?? 'empty observation'}`,
+      ...(preObserve ? { preObserve } : {}),
     };
   }
 
   if (action.expected && matchObservation(action.expected, observation).matches) {
-    return { actionId, status: 'SUCCEEDED', error: null, observation };
+    return { actionId, status: 'SUCCEEDED', error: null, observation, postObserve: PRE_OBSERVE.CONSISTENT, ...(preObserve ? { preObserve } : {}) };
   }
   if (!action.expected && !observation.mismatched && executeResult?.status === 'EXECUTED') {
-    return { actionId, status: 'SUCCEEDED', error: null, observation };
+    return { actionId, status: 'SUCCEEDED', error: null, observation, postObserve: PRE_OBSERVE.CONSISTENT, ...(preObserve ? { preObserve } : {}) };
   }
 
   const explicitlyMissing = observation.exists === false
@@ -231,6 +409,8 @@ async function executeCheckpoint(action, adapterRegistry, context) {
       status: 'FAILED',
       error: executeError?.message ?? executeResult?.error ?? 'remote state is explicitly missing after execute',
       observation,
+      postObserve: PRE_OBSERVE.MISSING,
+      ...(preObserve ? { preObserve } : {}),
     };
   }
 
@@ -241,6 +421,8 @@ async function executeCheckpoint(action, adapterRegistry, context) {
       ?? executeResult?.error
       ?? 'observation does not match expected state from frozen plan',
     observation,
+    postObserve: PRE_OBSERVE.CONFLICTING,
+    ...(preObserve ? { preObserve } : {}),
   };
 }
 
@@ -277,6 +459,7 @@ export async function publishRelease(options) {
     productionMode = false,
     productionConfirmation,
     observePreviousPublicBaselineFn,
+    observeRetrySleep,
   } = options ?? {};
 
   const clockFn = typeof clockOpt === 'function' ? clockOpt : defaultClock;
@@ -497,40 +680,71 @@ export async function publishRelease(options) {
 
     const currentBaseline = await captureBaselineActual(root);
 
+    // planVersion fork (design: t1-2-digest-decoupling.md §4.3): for v2
+    // plans the baseline is record-layer audit data. Drift is recorded as a
+    // warning and execution continues -- artifact integrity is sealed by the
+    // frozen-artifact re-verification above, never by workspace equality.
+    // v1 plans keep the BASELINE_CHANGED hard failure, byte for byte.
+    const planV2 = plan.planVersion === 2;
+
     if (currentBaseline.gitTreeHash !== plan.baseline.gitTreeHash) {
-      await evidence.append({
-        phase: 'safety-gate',
-        gate: 'baseline-check',
-        status: 'failed',
-        planTreeHash: plan.baseline.gitTreeHash,
-        currentTreeHash: currentBaseline.gitTreeHash,
-      });
+      if (planV2) {
+        await evidence.append({
+          phase: 'safety-gate',
+          gate: 'baseline-check',
+          status: 'warning',
+          severity: 'warning',
+          reason: 'planVersion 2: baseline drift is record-layer audit data; frozen-artifact re-verification remains the integrity authority',
+          planTreeHash: plan.baseline.gitTreeHash,
+          currentTreeHash: currentBaseline.gitTreeHash,
+        });
+      } else {
+        await evidence.append({
+          phase: 'safety-gate',
+          gate: 'baseline-check',
+          status: 'failed',
+          planTreeHash: plan.baseline.gitTreeHash,
+          currentTreeHash: currentBaseline.gitTreeHash,
+        });
 
-      // BASELINE_CHANGED: zero adapter execute calls guaranteed
-      throw new ReleaseError(
-        BASELINE_CHANGED,
-        `baseline has changed since plan freeze: plan=${plan.baseline.gitTreeHash}, current=${currentBaseline.gitTreeHash}`,
-        { planTreeHash: plan.baseline.gitTreeHash, currentTreeHash: currentBaseline.gitTreeHash },
-      );
+        // BASELINE_CHANGED: zero adapter execute calls guaranteed
+        throw new ReleaseError(
+          BASELINE_CHANGED,
+          `baseline has changed since plan freeze: plan=${plan.baseline.gitTreeHash}, current=${currentBaseline.gitTreeHash}`,
+          { planTreeHash: plan.baseline.gitTreeHash, currentTreeHash: currentBaseline.gitTreeHash },
+        );
+      }
     }
 
     if (
       plan.baseline.workspaceDigest &&
       currentBaseline.workspaceDigest !== plan.baseline.workspaceDigest
     ) {
-      await evidence.append({
-        phase: 'safety-gate',
-        gate: 'baseline-check',
-        status: 'failed',
-        planWorkspaceDigest: plan.baseline.workspaceDigest,
-        currentWorkspaceDigest: currentBaseline.workspaceDigest,
-      });
+      if (planV2) {
+        await evidence.append({
+          phase: 'safety-gate',
+          gate: 'baseline-check',
+          status: 'warning',
+          severity: 'warning',
+          reason: 'planVersion 2: workspace digest drift is record-layer audit data; frozen-artifact re-verification remains the integrity authority',
+          planWorkspaceDigest: plan.baseline.workspaceDigest,
+          currentWorkspaceDigest: currentBaseline.workspaceDigest,
+        });
+      } else {
+        await evidence.append({
+          phase: 'safety-gate',
+          gate: 'baseline-check',
+          status: 'failed',
+          planWorkspaceDigest: plan.baseline.workspaceDigest,
+          currentWorkspaceDigest: currentBaseline.workspaceDigest,
+        });
 
-      throw new ReleaseError(
-        BASELINE_CHANGED,
-        `workspace digest has changed since plan freeze: plan=${plan.baseline.workspaceDigest}, current=${currentBaseline.workspaceDigest}`,
-        { planWorkspaceDigest: plan.baseline.workspaceDigest, currentWorkspaceDigest: currentBaseline.workspaceDigest },
-      );
+        throw new ReleaseError(
+          BASELINE_CHANGED,
+          `workspace digest has changed since plan freeze: plan=${plan.baseline.workspaceDigest}, current=${currentBaseline.workspaceDigest}`,
+          { planWorkspaceDigest: plan.baseline.workspaceDigest, currentWorkspaceDigest: currentBaseline.workspaceDigest },
+        );
+      }
     }
 
     await evidence.append({
@@ -673,12 +887,8 @@ export async function publishRelease(options) {
     const publishingPlan = deepClone(plan);
     publishingPlan.status = PUBLISHING;
 
-    // Sort actions by checkpoint order
-    const orderedActions = (publishingPlan.externalActions ?? []).slice().sort((a, b) => {
-      const ai = CHECKPOINT_ORDER.indexOf(a.type);
-      const bi = CHECKPOINT_ORDER.indexOf(b.type);
-      return (ai === -1 ? 999 : ai) - (bi === -1 ? 999 : bi);
-    });
+    // Sort actions by checkpoint order (shared single source, T3.1 §4.7).
+    const orderedActions = sortActionsByCheckpointOrder(publishingPlan.externalActions);
 
     // =======================================================================
     // Safety Gate 10: Global preflight - validate all actions before any execute
@@ -706,6 +916,39 @@ export async function publishRelease(options) {
         preflightContext,
       );
       if (preflightResult.status === 'PREFLIGHT_FAILED') {
+        // T3.3 §4.6: an "occupied" preflight failure overlaps semantically with
+        // "already consistent". For NON-marketplace action types, arbitrate with
+        // a single read-only pre-observe using the SAME classifier as the
+        // per-checkpoint path: CONSISTENT means the remote already satisfies the
+        // frozen plan, so let the action through to its SKIPPED path instead of
+        // failing the whole gate. Anything else (MISSING/CONFLICTING/UNOBSERVABLE)
+        // keeps the fail-closed GATE_FAILED. Marketplace preflights are local
+        // integrity checks, never remote occupation, so they are NEVER arbitrated
+        // -- a CONSISTENT observation must not bypass their completeness gate.
+        if (!isMarketplace && hasExpected(action.expected)) {
+          let arbitration;
+          try {
+            arbitration = await adapter.observe(
+              { actionType: adapterActionType, ...action.parameters, expected: action.expected },
+              preflightContext,
+            );
+          } catch (error) {
+            arbitration = { observation: null, error: error?.message ?? String(error) };
+          }
+          const verdict = classifyPreObservation(action, arbitration);
+          await evidence.append({
+            phase: 'global-preflight-arbitration',
+            actionId: action.id,
+            actionType: action.type,
+            status: 'pre-observe',
+            details: { preObserve: verdict, preflightError: preflightResult.error ?? null },
+          });
+          if (verdict === PRE_OBSERVE.CONSISTENT) {
+            // Remote already consistent: the action takes the SKIPPED path inside
+            // executeCheckpoint; do not fail the gate.
+            continue;
+          }
+        }
         throw new ReleaseError(
           GATE_FAILED,
           `global preflight failed for action "${action.id}": ${preflightResult.error}`,
@@ -742,7 +985,10 @@ export async function publishRelease(options) {
         status: checkpoint.status === 'SUCCEEDED' ? 'succeeded'
           : checkpoint.status === 'FAILED' ? 'failed'
           : checkpoint.status === 'UNCERTAIN' ? 'uncertain'
+          : checkpoint.status === 'SKIPPED' ? 'skipped'
           : 'pending',
+        ...(checkpoint.preObserve ? { preObserve: checkpoint.preObserve } : {}),
+        ...(checkpoint.postObserve ? { postObserve: checkpoint.postObserve } : {}),
         ...(checkpoint.error ? { error: { code: 'GATE_FAILED', message: checkpoint.error } } : {}),
       })),
       startedAt,
@@ -759,70 +1005,137 @@ export async function publishRelease(options) {
     });
 
     // =======================================================================
-    // Execute checkpoints
+    // Execute checkpoints (dependency-tiered; T3.1).
+    //
+    // Tiers run strictly serially; the actions inside a tier are independent
+    // and run concurrently with Promise.allSettled semantics -- no fail-fast
+    // short-circuit, because a sibling's success and observation must never be
+    // dropped (observations are reconcile's recovery authority). State is
+    // snapshotted once per tier boundary instead of once per checkpoint:
+    //   * tier start: every action in the tier is set UNCERTAIN and one
+    //     appendRunState persists that durable pre-execute authority;
+    //   * tier end: all of the tier's results are folded in and one
+    //     appendRunState persists them.
+    // Crash-recovery semantics: a kill inside a tier leaves that tier's actions
+    // at UNCERTAIN in the last snapshot; reconcile rebuilds actual state per
+    // actionId from that snapshot plus observe (it never depended on execution
+    // order). appendRunState's seq chain (run.mjs) is unchanged.
     // =======================================================================
+    const checkpointByActionId = new Map(checkpoints.map((cp) => [cp.actionId, cp]));
+    const { tiers, unknown } = groupActionsByTier(orderedActions);
     let stopped = false;
 
-    for (let actionIndex = 0; actionIndex < orderedActions.length; actionIndex += 1) {
-      const action = orderedActions[actionIndex];
-      const checkpoint = checkpoints[actionIndex];
-      if (stopped) {
-        action.status = 'PENDING';
-        continue;
+    // Fail closed on any action type the tier table does not recognize. Such a
+    // type is never silently appended to the last tier: an unrecognized external
+    // write must stop the saga for human review. (Validated plans cannot contain
+    // such a type -- the plan schema enumerates exactly the tier-table types --
+    // so this is defense in depth, not a reachable path.)
+    if (unknown.length > 0) {
+      for (const action of unknown) {
+        const checkpoint = checkpointByActionId.get(action.id);
+        checkpoint.status = 'FAILED';
+        checkpoint.error = `Unknown action type not present in the dependency tier table: ${action.type}`;
+        action.status = 'FAILED';
+        await evidence.append({
+          phase: 'checkpoint',
+          actionId: action.id,
+          actionType: action.type,
+          status: 'failed',
+          error: checkpoint.error,
+        });
       }
-
-      // The durable UNCERTAIN state must exist before execute is authorized.
-      checkpoint.status = 'UNCERTAIN';
+      stopped = true;
       stateSequence += 1;
-      // Once an execute is about to start, this snapshot is itself a
-      // reconcile-consumable recovery authority. A process kill after the
-      // adapter accepts the write must never leave only PUBLISHING state.
       latestState = await appendRunState(runDir, stateSequence, buildPersistedState(PARTIAL));
+    }
 
-      await evidence.append({
-        phase: 'checkpoint',
-        actionId: action.id,
-        actionType: action.type,
-        status: 'started',
-      });
-
-      const isMarketplace = MARKETPLACE_TYPES.has(action.type);
-      const actionContext = {
-        externalWritesAuthorized: !isMarketplace,
-        isolatedConsumerWritesAuthorized: isMarketplace,
-        plan: publishingPlan,
-        baseline: plan.baseline,
-        root,
-        runDir,
-      };
-      const result = await executeCheckpoint(action, adapterRegistry, actionContext);
-      checkpoint.status = result.status;
-      checkpoint.error = result.error;
-
-      // Update plan action status
-      action.status = result.status;
-
-      await evidence.append({
-        phase: 'checkpoint',
-        actionId: action.id,
-        actionType: action.type,
-        status: result.status === 'SUCCEEDED' ? 'completed' : 'failed',
-        error: result.error,
-      });
+    for (let tierIndex = 0; tierIndex < tiers.length && !stopped; tierIndex += 1) {
+      const tierActions = tiers[tierIndex];
+      if (tierActions.length === 0) continue;
+      const tierCheckpoints = tierActions.map((action) => checkpointByActionId.get(action.id));
+
+      // --- Tier start: persist every action in this tier as UNCERTAIN in a
+      // single snapshot BEFORE any execute is authorized. Once an execute is
+      // about to start, this snapshot is itself a reconcile-consumable recovery
+      // authority; a process kill after an adapter accepts a write must never
+      // leave only PUBLISHING state.
+      for (let i = 0; i < tierActions.length; i += 1) {
+        tierCheckpoints[i].status = 'UNCERTAIN';
+        await evidence.append({
+          phase: 'checkpoint',
+          actionId: tierActions[i].id,
+          actionType: tierActions[i].type,
+          status: 'started',
+          details: { tier: tierIndex },
+        });
+      }
+      stateSequence += 1;
+      latestState = await appendRunState(runDir, stateSequence, buildPersistedState(PARTIAL));
 
-      if (result.status !== 'SUCCEEDED') {
-        stopped = true;
+      // --- Tier execute: concurrent, allSettled semantics (no fail-fast).
+      const results = await Promise.all(tierActions.map(async (action) => {
+        const isMarketplace = MARKETPLACE_TYPES.has(action.type);
+        const actionContext = {
+          externalWritesAuthorized: !isMarketplace,
+          isolatedConsumerWritesAuthorized: isMarketplace,
+          plan: publishingPlan,
+          baseline: plan.baseline,
+          root,
+          runDir,
+          evidence,
+          observeRetrySleep,
+        };
+        try {
+          return await executeCheckpoint(action, adapterRegistry, actionContext);
+        } catch (error) {
+          // executeCheckpoint classifies failures rather than throwing; a throw
+          // is still an uncertain outcome and must never drop the action from
+          // the tier snapshot.
+          return { actionId: action.id, status: 'UNCERTAIN', error: `checkpoint threw: ${error.message}` };
+        }
+      }));
+
+      // --- Tier settle: fold every result into the snapshot, successes and
+      // failures alike (a failed sibling must not discard a success).
+      let tierFailed = false;
+      for (let i = 0; i < tierActions.length; i += 1) {
+        const action = tierActions[i];
+        const checkpoint = tierCheckpoints[i];
+        const result = results[i];
+        checkpoint.status = result.status;
+        checkpoint.error = result.error;
+        if (result.preObserve) checkpoint.preObserve = result.preObserve;
+        if (result.postObserve) checkpoint.postObserve = result.postObserve;
+        action.status = result.status;
+        await evidence.append({
+          phase: 'checkpoint',
+          actionId: action.id,
+          actionType: action.type,
+          status: result.status === 'SUCCEEDED' || result.status === 'SKIPPED' ? 'completed' : 'failed',
+          error: result.error,
+          details: { tier: tierIndex, ...(result.status === 'SKIPPED' ? { skipped: true } : {}) },
+        });
+        // SKIPPED is a success (the remote was already consistent); it must not
+        // stop the saga. Only FAILED/UNCERTAIN fail the tier.
+        if (result.status !== 'SUCCEEDED' && result.status !== 'SKIPPED') {
+          tierFailed = true;
+        }
       }
 
+      // --- Tier end: one snapshot carrying the whole tier's results.
       stateSequence += 1;
       latestState = await appendRunState(runDir, stateSequence, buildPersistedState(PARTIAL));
+
+      if (tierFailed) {
+        stopped = true;
+      }
     }
 
     // Close the push -> default-branch TOCTOU window with a final read-only
     // consistency pass. Both the branch tip and default-branch name are bound
     // in the frozen action expectations. A late change keeps the saga PARTIAL
     // and must be resolved by reconcile/human review.
-    if (checkpoints.every((cp) => cp.status === 'SUCCEEDED')) {
+    if (checkpoints.every((cp) => cp.status === 'SUCCEEDED' || cp.status === 'SKIPPED')) {
       await evidence.append({ phase: 'safety-gate', gate: 'final-branch-consistency', status: 'started' });
       for (let index = 0; index < orderedActions.length; index += 1) {
         const action = orderedActions[index];
@@ -856,14 +1169,17 @@ export async function publishRelease(options) {
           break;
         }
       }
-      if (checkpoints.every((cp) => cp.status === 'SUCCEEDED')) {
+      if (checkpoints.every((cp) => cp.status === 'SUCCEEDED' || cp.status === 'SKIPPED')) {
         await evidence.append({ phase: 'safety-gate', gate: 'final-branch-consistency', status: 'passed' });
       }
     }
 
     // Determine overall status
     const hasFailure = checkpoints.some((cp) => cp.status === 'FAILED' || cp.status === 'UNCERTAIN');
-    const allSucceeded = checkpoints.every((cp) => cp.status === 'SUCCEEDED');
+    // SKIPPED counts as success: the remote was already consistent with the
+    // frozen plan, so an all-SKIPPED/SUCCEEDED run is a clean PUBLISHED (the
+    // idempotent ideal -- zero writes were even needed).
+    const allSucceeded = checkpoints.every((cp) => cp.status === 'SUCCEEDED' || cp.status === 'SKIPPED');
 
     let overallStatus;
     if (allSucceeded) {