release-skill 0.2.3 → 0.2.4

package/src/commands/reconcile.mjs

@@ -39,7 +39,7 @@ import {
   reObservePreviousPublicBaseline,
 } from '../core/previous-public-baseline.mjs';
 import { createEvidenceWriter } from '../core/evidence.mjs';
-import { CHECKPOINT_ORDER, ADAPTER_ACTION_TYPE_MAP } from '../core/checkpoints.mjs';
+import { CHECKPOINT_ORDER, ADAPTER_ACTION_TYPE_MAP, isRemoteWriteAction, isMarketplaceAction } from '../core/checkpoints.mjs';
 import {
   loadRun,
   validateRunPlanDigest,
@@ -56,7 +56,7 @@ import {
   GATE_FAILED,
   BASELINE_CHANGED,
   REMOTE_CONFLICT,
-  POST_PUBLISH_VERIFY_FAILED,
+  CONSUMER_VERIFICATION_DEFERRED,
 } from '../core/errors.mjs';
 import { assertTransition, PARTIAL, PUBLISHED, BLOCKED } from '../core/state-machine.mjs';
 import { matchObservation } from '../adapters/contract.mjs';
@@ -70,18 +70,6 @@ import { observeWithRetry, clampPolicyToTimeout, DEFAULT_OBSERVE_RETRY_POLICY }
 // (single source shared with publish.mjs; T3.1 §4.7). The historical
 // `Must match publish.mjs` double-write is removed.
 
-/**
- * Marketplace action types that are reconstructable isolated consumer checks,
- * not permanent remote writes. These use isolatedConsumerWritesAuthorized
- * and don't require externalWritesAuthorized even during retry.
- */
-const MARKETPLACE_TYPES = new Set([
-  'claude-marketplace-install',
-  'codex-marketplace-install',
-  'kimi-marketplace-install',
-  'codebuddy-marketplace-install',
-]);
-
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
@@ -301,7 +289,7 @@ export async function reconcileRelease(options) {
     const hasNonMarketplaceRetryCandidate = sourceRun.checkpoints.some((checkpoint) => {
       if (checkpoint.status === 'succeeded') return false;
       const action = planActionsById.get(checkpoint.actionId);
-      return action && !MARKETPLACE_TYPES.has(action.type);
+      return action && !isMarketplaceAction(action.type);
     });
     if (
       plan.production?.mode === 'github-npm-v1' &&
@@ -407,7 +395,6 @@ export async function reconcileRelease(options) {
 
     // Re-observe every unit's frozen public baseline before any adapter
     // observation, preflight, or execute call.
-    const isProductionPlan = plan.production?.mode === 'github-npm-v1';
     const defaultPpbObserveFn = async (repo, ref, expectedCommit, { githubHost = 'github.com' } = {}) => {
       try {
         const { execFile } = await import('node:child_process');
@@ -574,13 +561,8 @@ export async function reconcileRelease(options) {
     // Non-marketplace actions use observe-based consistency checks.
     // =======================================================================
     const actionsToRetry = [];
-    const marketplaceRetriesToRetry = [];
     const actionResults = new Map(); // actionId -> final status
-    // Remote-write retries and marketplace recovery are independent failure
-    // groups: neither group's failure blocks the other group's retries, and
-    // either failure keeps the run PARTIAL.
     let remoteWriteRetryFailed = false;
-    let marketplaceRetryFailed = false;
 
     for (const action of planActions) {
       const sourceCp = sourceCpMap.get(action.id);
@@ -595,11 +577,13 @@ export async function reconcileRelease(options) {
       const adapter = adapterRegistry.getAdapter(adapterActionType);
 
       // -------------------------------------------------------------------
-      // Marketplace actions: deferred to the dedicated recovery phase that
-      // runs AFTER the non-marketplace remote-write retry loop (phase 4).
+      // Marketplace actions are deferred to the verify phase. They are
+      // recorded as 'deferred' with CONSUMER_VERIFICATION_DEFERRED reason
+      // and never participate in reconcile's observe/retry loop.
       // A marketplace failure must never block pending remote-write retries.
       // -------------------------------------------------------------------
-      if (MARKETPLACE_TYPES.has(action.type)) {
+      if (isMarketplaceAction(action.type)) {
+        actionResults.set(action.id, 'deferred');
         continue;
       }
 
@@ -728,7 +712,7 @@ export async function reconcileRelease(options) {
 
       // FAILED or PENDING: observe remote state (PROPAGATING retry, T1.1)
       const observeInput = { actionType: adapterActionType, ...action.parameters };
-      const observePolicy = MARKETPLACE_TYPES.has(action.type)
+      const observePolicy = isMarketplaceAction(action.type)
         ? clampPolicyToTimeout(DEFAULT_OBSERVE_RETRY_POLICY, action.parameters?.timeoutMs)
         : DEFAULT_OBSERVE_RETRY_POLICY;
       const observeRetry = await observeWithRetry({
@@ -887,7 +871,7 @@ export async function reconcileRelease(options) {
     // retries require approval.
     // =======================================================================
     // Phase 1 only collects non-marketplace retry candidates.
-    const nonMarketplaceRetries = actionsToRetry.filter((a) => !MARKETPLACE_TYPES.has(a.type));
+    const nonMarketplaceRetries = actionsToRetry.filter((a) => !isMarketplaceAction(a.type));
 
     if (nonMarketplaceRetries.length > 0) {
       // Non-marketplace retries require approval and productionConfirmation
@@ -926,19 +910,13 @@ export async function reconcileRelease(options) {
         const adapterActionType = ADAPTER_ACTION_TYPE_MAP[action.type];
         const adapter = adapterRegistry.getAdapter(adapterActionType);
 
-        // Use appropriate context for each action type
-        const preflightCtx = MARKETPLACE_TYPES.has(action.type)
-          ? { ...context, externalWritesAuthorized: false, isolatedConsumerWritesAuthorized: true }
-          : context;
-
         const preflightResult = await adapter.preflight(
           { actionType: adapterActionType, ...action.parameters },
-          preflightCtx,
+          context,
         );
 
         if (preflightResult.status === 'PREFLIGHT_FAILED') {
-          // Mark all retry actions as failed, stop. This only poisons the
-          // remote-write group; marketplace recovery (phase 4) still runs.
+          // Mark all retry actions as failed, stop.
           for (const retryAction of actionsToRetry) {
             actionResults.set(retryAction.id, 'failed');
           }
@@ -980,14 +958,17 @@ export async function reconcileRelease(options) {
       status,
       checkpoints: planActions.map((action) => {
         const value = actionResults.get(action.id);
+        const normalized = value === 'deferred' ? 'deferred'
+          : value === 'succeeded' ? 'succeeded'
+          : value === 'skipped' ? 'skipped'
+          : value === 'failed' ? 'failed'
+          : value === 'uncertain' ? 'uncertain'
+          : 'pending';
         return {
           actionId: action.id,
           actionType: action.type,
-          status: value === 'succeeded' ? 'succeeded'
-            : value === 'skipped' ? 'skipped'
-            : value === 'failed' ? 'failed'
-            : value === 'uncertain' ? 'uncertain'
-            : 'pending',
+          status: normalized,
+          ...(normalized === 'deferred' ? { reason: CONSUMER_VERIFICATION_DEFERRED, phase: 'post-publish-verification' } : {}),
         };
       }),
       startedAt: reconcileStartedAt,
@@ -1015,11 +996,9 @@ export async function reconcileRelease(options) {
         const adapterActionType = ADAPTER_ACTION_TYPE_MAP[action.type];
         const adapter = adapterRegistry.getAdapter(adapterActionType);
 
-        // Use appropriate context: marketplace uses isolated consumer writes,
-        // non-marketplace uses external writes
-        const retryCtx = MARKETPLACE_TYPES.has(action.type)
-          ? { ...context, externalWritesAuthorized: false, isolatedConsumerWritesAuthorized: true }
-          : context;
+        // Only non-marketplace actions enter executeRetryGroup; marketplace
+        // actions are deferred in Phase 1 and never reach this path.
+        const retryCtx = context;
 
         await evidence.append({
           phase: 'reconcile-retry',
@@ -1045,60 +1024,12 @@ export async function reconcileRelease(options) {
         }
 
         if (executeResult.status === 'EXECUTED') {
-          // Must verify after execute to check remote/install state
-          if (MARKETPLACE_TYPES.has(action.type)) {
-            // Marketplace: verify via adapter.verify (observe + matchObservation).
-            // Retry the read-only verify while remote state is information-
-            // insufficient (PROPAGATING, T1.1); a present mismatch is a
-            // real conflict and is never retried.
-            const verifyInput = {
-              actionType: adapterActionType,
-              ...action.parameters,
-              expected: action.expected,
-            };
-            const verifyPolicy = clampPolicyToTimeout(
-              DEFAULT_OBSERVE_RETRY_POLICY,
-              action.parameters?.timeoutMs,
-            );
-            const verifyRetry = await observeWithRetry({
-              observe: (act, ctx) => adapter.verify(act, ctx),
-              action: verifyInput,
-              context: retryCtx,
-              policy: verifyPolicy,
-              sleep: observeRetrySleep,
-              onAttempt: (info) => evidence.append({
-                phase: 'reconcile-retry-verify',
-                actionId: action.id,
-                actionType: action.type,
-                attempt: info.attempt,
-                maxAttempts: info.maxAttempts,
-                missing: info.missing,
-                delayMs: info.delayMs,
-                status: info.missing ? 'propagating' : 'resolved',
-                error: info.error ?? null,
-              }),
-            });
-            const verifyResult = verifyRetry.result;
-
-            if (verifyResult.status !== 'VERIFIED') {
-              actionResults.set(action.id, 'failed');
-              markGroupFailed();
-              await evidence.append({
-                phase: 'reconcile-retry',
-                actionId: action.id,
-                actionType: action.type,
-                status: 'verify-mismatch',
-                error: verifyResult.error,
-              });
-              await persistRetryState(PARTIAL);
-              break;
-            }
-          } else {
-            // Non-marketplace: observe after execute to verify remote state.
-            // execute succeeded, so a missing/uncertain observe may be a
-            // transient propagation delay — retry with bounded backoff
-            // (PROPAGATING, T1.1). A present mismatch is a real
-            // conflict and is never retried.
+          // Non-marketplace only: observe after execute to verify remote state.
+          // execute succeeded, so a missing/uncertain observe may be a
+          // transient propagation delay — retry with bounded backoff
+          // (PROPAGATING, T1.1). A present mismatch is a real
+          // conflict and is never retried.
+          {
             const observeInput = {
               actionType: adapterActionType,
               ...action.parameters,
@@ -1186,39 +1117,35 @@ export async function reconcileRelease(options) {
           // write. Non-marketplace actions must therefore be observed before
           // classifying the checkpoint; unknown remains uncertain and an
           // already-consistent remote is treated as succeeded.
-          if (!MARKETPLACE_TYPES.has(action.type)) {
-            let observeResult;
-            try {
-              observeResult = await adapter.observe(
-                { actionType: adapterActionType, ...action.parameters, expected: action.expected },
-                retryCtx,
-              );
-            } catch (error) {
-              observeResult = { observation: null, error: error.message };
-            }
-            const observation = observeResult?.observation;
-            const missing = observation?.exists === false
-              || observation?.remoteCommit === ''
-              || observation?.commit === ''
-              || observation?.published === false;
-            const matches = action.expected && observation
-              ? matchObservation(action.expected, observation).matches
-              : false;
-            if (matches) {
-              actionResults.set(action.id, 'succeeded');
-              await evidence.append({
-                phase: 'reconcile-retry',
-                actionId: action.id,
-                actionType: action.type,
-                status: 'completed-after-execute-failure-observe',
-              });
-              await persistRetryState(PARTIAL);
-              continue;
-            }
-            actionResults.set(action.id, missing ? 'failed' : 'uncertain');
-          } else {
-            actionResults.set(action.id, 'failed');
+          let observeResult;
+          try {
+            observeResult = await adapter.observe(
+              { actionType: adapterActionType, ...action.parameters, expected: action.expected },
+              retryCtx,
+            );
+          } catch (error) {
+            observeResult = { observation: null, error: error.message };
           }
+          const observation = observeResult?.observation;
+          const missing = observation?.exists === false
+            || observation?.remoteCommit === ''
+            || observation?.commit === ''
+            || observation?.published === false;
+          const matches = action.expected && observation
+            ? matchObservation(action.expected, observation).matches
+            : false;
+          if (matches) {
+            actionResults.set(action.id, 'succeeded');
+            await evidence.append({
+              phase: 'reconcile-retry',
+              actionId: action.id,
+              actionType: action.type,
+              status: 'completed-after-execute-failure-observe',
+            });
+            await persistRetryState(PARTIAL);
+            continue;
+          }
+          actionResults.set(action.id, missing ? 'failed' : 'uncertain');
           markGroupFailed();
 
           await evidence.append({
@@ -1244,174 +1171,6 @@ export async function reconcileRelease(options) {
       await executeRetryGroup(actionsToRetry, () => { remoteWriteRetryFailed = true; });
     }
 
-    // --- Phase 4: Marketplace recovery (isolated consumer checks) ---
-    //
-    // Deferred until after the remote-write retry loop. Marketplace actions
-    // are reconstructable isolated consumer checks, not permanent remote
-    // writes: each gets a fresh preflight -> execute -> verify cycle in an
-    // isolated directory, using isolatedConsumerWritesAuthorized instead of
-    // externalWritesAuthorized. A failed remote-write retry must not
-    // fabricate or suppress marketplace outcomes, and a marketplace failure
-    // never blocks the remote-write group above.
-    for (const action of planActions) {
-      if (!MARKETPLACE_TYPES.has(action.type)) continue;
-      const sourceCp = sourceCpMap.get(action.id);
-      const adapterActionType = ADAPTER_ACTION_TYPE_MAP[action.type];
-      const adapter = adapterRegistry.getAdapter(adapterActionType);
-
-      const marketplaceContext = {
-        externalWritesAuthorized: false,
-        isolatedConsumerWritesAuthorized: true,
-        plan,
-        baseline: plan.baseline,
-        root,
-        runDir,
-      };
-
-      const actionInput = {
-        actionType: adapterActionType,
-        ...action.parameters,
-      };
-
-      // Preflight (always runs — validates frozen snapshot)
-      const preflightResult = await adapter.preflight(actionInput, marketplaceContext);
-      if (preflightResult.status === 'PREFLIGHT_FAILED') {
-        actionResults.set(action.id, 'failed');
-        await evidence.append({
-          phase: 'reconcile-marketplace',
-          actionId: action.id,
-          actionType: action.type,
-          decision: 'preflight-failed',
-          error: preflightResult.error,
-        });
-        throw new ReleaseError(
-          POST_PUBLISH_VERIFY_FAILED,
-          `marketplace preflight failed for action "${action.id}": ${preflightResult.error}`,
-          { actionId: action.id },
-        );
-      }
-
-      // Execute (install to isolated consumer directory)
-      const executeResult = await adapter.execute(actionInput, marketplaceContext);
-      if (executeResult.status !== 'EXECUTED') {
-        actionResults.set(action.id, 'failed');
-        await evidence.append({
-          phase: 'reconcile-marketplace',
-          actionId: action.id,
-          actionType: action.type,
-          decision: 'execute-failed',
-          error: executeResult.error,
-        });
-        // Execute failed — if source was succeeded this is a conflict;
-        // if source was failed/pending, add to the marketplace retry list
-        if (sourceCp.status === 'succeeded') {
-          throw new ReleaseError(
-            REMOTE_CONFLICT,
-            `marketplace execute failed for SUCCEEDED action "${action.id}": ${executeResult.error}`,
-            { actionId: action.id },
-          );
-        }
-        marketplaceRetriesToRetry.push(action);
-        continue;
-      }
-
-      // Verify (observe + match against plan expected state).
-      // Retry the read-only verify while remote state is information-
-      // insufficient (PROPAGATING, T1.1); a present mismatch is a
-      // real conflict and is never retried.
-      const verifyPolicy = clampPolicyToTimeout(
-        DEFAULT_OBSERVE_RETRY_POLICY,
-        action.parameters?.timeoutMs,
-      );
-      const verifyRetry = await observeWithRetry({
-        observe: (act, ctx) => adapter.verify(act, ctx),
-        action: { ...actionInput, expected: action.expected },
-        context: marketplaceContext,
-        policy: verifyPolicy,
-        sleep: observeRetrySleep,
-        onAttempt: (info) => evidence.append({
-          phase: 'reconcile-marketplace-verify',
-          actionId: action.id,
-          actionType: action.type,
-          attempt: info.attempt,
-          maxAttempts: info.maxAttempts,
-          missing: info.missing,
-          delayMs: info.delayMs,
-          status: info.missing ? 'propagating' : 'resolved',
-          error: info.error ?? null,
-        }),
-      });
-      const verifyResult = verifyRetry.result;
-
-      if (verifyResult.status === 'VERIFIED') {
-        // Consistent: source succeeded => skipped, source failed => succeeded (recovered)
-        const resultStatus = sourceCp.status === 'succeeded' ? 'skipped' : 'succeeded';
-        actionResults.set(action.id, resultStatus);
-        await evidence.append({
-          phase: 'reconcile-marketplace',
-          actionId: action.id,
-          actionType: action.type,
-          decision: sourceCp.status === 'succeeded' ? 'skip-source-succeeded-consistent' : 'recovered',
-          sourceStatus: sourceCp.status,
-        });
-      } else {
-        // Verify mismatch
-        await evidence.append({
-          phase: 'reconcile-marketplace',
-          actionId: action.id,
-          actionType: action.type,
-          decision: 'verify-mismatch',
-          error: verifyResult.error,
-        });
-        if (sourceCp.status === 'succeeded') {
-          throw new ReleaseError(
-            REMOTE_CONFLICT,
-            `marketplace verify mismatch for SUCCEEDED action "${action.id}": ${verifyResult.error}`,
-            { actionId: action.id },
-          );
-        }
-        // Source was failed/pending and verify mismatched after recovery => failed.
-        // Poisons ONLY the marketplace group; remote-write retries already ran.
-        actionResults.set(action.id, 'failed');
-        marketplaceRetryFailed = true;
-        // Don't add to retry — this is a verify mismatch, not a missing state
-      }
-    }
-
-    // Marketplace retry candidates (isolated execute failed above) are
-    // preflighted, then retried once through the shared journaled retry
-    // loop. Gated ONLY on the marketplace group's own failure flag.
-    if (!marketplaceRetryFailed && marketplaceRetriesToRetry.length > 0) {
-      for (const action of marketplaceRetriesToRetry) {
-        const adapterActionType = ADAPTER_ACTION_TYPE_MAP[action.type];
-        const adapter = adapterRegistry.getAdapter(adapterActionType);
-        const preflightResult = await adapter.preflight(
-          { actionType: adapterActionType, ...action.parameters },
-          { ...context, externalWritesAuthorized: false, isolatedConsumerWritesAuthorized: true },
-        );
-        if (preflightResult.status === 'PREFLIGHT_FAILED') {
-          // Mark all marketplace retry actions as failed, stop
-          for (const retryAction of marketplaceRetriesToRetry) {
-            actionResults.set(retryAction.id, 'failed');
-          }
-          marketplaceRetryFailed = true;
-          await evidence.append({
-            phase: 'reconcile-preflight',
-            status: 'failed',
-            actionId: action.id,
-            error: preflightResult.error,
-          });
-          break;
-        }
-      }
-    }
-    if (!marketplaceRetryFailed && marketplaceRetriesToRetry.length > 0) {
-      if (retryStateSequence < 0) {
-        await persistRetryState('PUBLISHING');
-      }
-      await executeRetryGroup(marketplaceRetriesToRetry, () => { marketplaceRetryFailed = true; });
-    }
-
     // Mark remaining retry actions as pending if a group stopped early
     const markPendingAfterFailure = (groupActions) => {
       let foundFailed = false;
@@ -1428,14 +1187,11 @@ export async function reconcileRelease(options) {
     if (remoteWriteRetryFailed) {
       markPendingAfterFailure(actionsToRetry);
     }
-    if (marketplaceRetryFailed) {
-      markPendingAfterFailure(marketplaceRetriesToRetry);
-    }
 
     // Final branch/default-branch consistency closes late drift after a retry
     // or after the first observation pass. The set-default action expectation
     // includes both the branch name and its exact planned commit.
-    if (!remoteWriteRetryFailed && !marketplaceRetryFailed && planActions.every((action) => ['succeeded', 'skipped'].includes(actionResults.get(action.id)))) {
+    if (!remoteWriteRetryFailed && planActions.filter((a) => isRemoteWriteAction(a.type)).every((action) => ['succeeded', 'skipped'].includes(actionResults.get(action.id)))) {
       await evidence.append({ phase: 'safety-gate', gate: 'final-branch-consistency', status: 'started' });
       for (const action of planActions) {
         if (!['push-snapshot', 'set-default-branch'].includes(action.type)) continue;
@@ -1474,30 +1230,33 @@ export async function reconcileRelease(options) {
     // =======================================================================
     // Determine final status
     // =======================================================================
-    const allSucceeded = planActions.every(
-      (a) => {
+    // 远端写入动作的状态决定整体发布状态
+    // 市场安装动作的结果记录在 run 中，但不阻止 PUBLISHED
+    const remoteWriteAllSucceeded = planActions
+      .filter((a) => isRemoteWriteAction(a.type))
+      .every((a) => {
         const result = actionResults.get(a.id);
         return result === 'succeeded' || result === 'skipped';
-      },
-    );
+      });
 
-    const effectiveFromStatus = PARTIAL;
+    const remoteWriteFailed = planActions
+      .filter((a) => isRemoteWriteAction(a.type))
+      .some((a) => {
+        const result = actionResults.get(a.id);
+        return result === 'failed' || result === 'uncertain';
+      });
 
-    // A failure in either independent retry group keeps the run PARTIAL.
-    const retryFailed = remoteWriteRetryFailed || marketplaceRetryFailed;
+    const effectiveFromStatus = PARTIAL;
 
-    // Map reconcile outcome to state machine target
+    // 远端写入动作的状态决定 PUBLISHED
+    // 市场安装动作的失败不阻止 PUBLISHED
     let overallStatus;
-    if (allSucceeded && !retryFailed) {
+    if (remoteWriteAllSucceeded && !remoteWriteRetryFailed) {
       overallStatus = PUBLISHED;
-    } else if (retryFailed) {
-      // Once any retry execute was attempted, recovery must remain PARTIAL
-      // even when no success was observed. BLOCKED is only pre-execute.
+    } else if (remoteWriteFailed || remoteWriteRetryFailed) {
       overallStatus = PARTIAL;
     } else {
-      // All remote checkpoints are consistent, but installation smoke still
-      // belongs to the separate verify command.
-      overallStatus = PUBLISHED;
+      overallStatus = PARTIAL;
     }
 
     // Only validate state transition if status actually changes
@@ -1515,13 +1274,16 @@ export async function reconcileRelease(options) {
     // Build checkpoints for return value and run file
     const resultCheckpoints = planActions.map((a) => {
       const status = actionResults.get(a.id) ?? 'pending';
+      const normalized = status === 'deferred' ? 'deferred'
+        : status === 'succeeded' ? 'succeeded'
+        : status === 'failed' ? 'failed'
+        : status === 'skipped' ? 'skipped'
+        : status === 'uncertain' ? 'uncertain'
+        : 'pending';
       return {
         actionId: a.id,
-        status: status === 'succeeded' ? 'succeeded'
-          : status === 'failed' ? 'failed'
-          : status === 'skipped' ? 'skipped'
-          : status === 'uncertain' ? 'uncertain'
-          : 'pending',
+        status: normalized,
+        ...(normalized === 'deferred' ? { reason: CONSUMER_VERIFICATION_DEFERRED, phase: 'post-publish-verification' } : {}),
       };
     });
 
@@ -1543,14 +1305,17 @@ export async function reconcileRelease(options) {
       status: overallStatus,
       checkpoints: planActions.map((a) => {
         const status = actionResults.get(a.id) ?? 'pending';
+        const normalized = status === 'deferred' ? 'deferred'
+          : status === 'succeeded' ? 'succeeded'
+          : status === 'failed' ? 'failed'
+          : status === 'skipped' ? 'skipped'
+          : status === 'uncertain' ? 'uncertain'
+          : 'pending';
         return {
           actionId: a.id,
           actionType: a.type,
-          status: status === 'succeeded' ? 'succeeded'
-            : status === 'failed' ? 'failed'
-            : status === 'skipped' ? 'skipped'
-            : status === 'uncertain' ? 'uncertain'
-            : 'pending',
+          status: normalized,
+          ...(normalized === 'deferred' ? { reason: CONSUMER_VERIFICATION_DEFERRED, phase: 'post-publish-verification' } : {}),
         };
       }),
       startedAt: reconcileStartedAt,