release-skill 0.9.37 → 0.9.38

package/skills-src/release-reconcile/SKILL.md

@@ -77,3 +77,17 @@ PUBLISHED 后立即用新 `runPath` 运行 verify。VERIFIED 后发布完成。P
 纯问询或转交时短答：写明实际回答、适用范围或理由、必要限制和下一步。建议保持为建议。
 
 执行路径说明本轮实际阶段、范围、退出码和结构化结果，引用源 run、计划和命令返回的新 `runPath`。保留 `PARTIAL`、`BLOCKED`、远端冲突和人工后续。仅当退出码为 0 且状态为 `PUBLISHED` 时，把恢复写为外写检查点已齐；随后用新 `runPath` 进入 verify。`PUBLISHED` 与 `VERIFIED` 按各自既有通过条件分别报告。已有 run 文件按原合同呈现。栏目只收录当前命令已经返回的事实。
+
+## 0.9.38：替代未发布计划
+
+本功能适用于同一项目、相同发布单元ID集合、目标版本及外部目标下，旧正式计划处于 `PREPARED` 状态且未产生任何发布运行权威的场景。仅在生产环境的 `testIntake` 入口启用，用于显式替代尚未发布的正式计划。已有首个运行状态，或处于 `PARTIAL`、`PUBLISHED`、`VERIFIED` 的计划，不属于这一例外。替代不代表发布成功或独立验收。
+
+发布零外写诊断须独立于目标归属判断。仅当已核实 producer 版本为 0.9.3、0.9.14、0.9.17、0.9.33、0.9.37 或本版 0.9.38 时，且满足单一版本、完整连续事件、相符封口、完整必要前置门禁顺序，同时无 `release-run.json`、任何 `state` 权威、执行或检查点活动，方可作为零外写诊断依据。三类失败情形在满足上述完整条件时仍可作为诊断：来源门禁失败；0.9.17 在只读 `global-preflight` 仲裁后直接失败；0.9.33 在 `approval-load` 后 `DIAGNOSE` 且无独立 `gate-failed` 事件。诊断不取得计划、恢复、替代、发布或 `TEST` 权威，不基于目录结构、时间戳、错误文本或非权威状态推断归属。
+
+针对 reconcile 失败，仅核实 0.9.22 与 0.9.27 两个 writer 的两条旧记录，分别归属于 0.22.0 与 0.25.0 目标；其 `sourceRunId` 与 `sourceRunDigest` 必须与当前项目原父运行一致，子事件流须符合已审 writer 的完整必要前缀，且 `source-run-load passed` 与 `reconcile started` 必须指向同一父运行，每个 `actionId`/`actionType` 必须对应父计划原动作。仅在完整核验后，方可确认其真实目标并排除替代阻断，失败状态本身不构成零外写，也不赋予恢复、替代或 TEST 权威。
+
+针对 verify 失败，仅 0.9.7 与 0.9.12 两条记录可被用于核实真实目标归属，其唯一父引用取自真实 `source-run-load passed` 的 `sourceRunId`，不接受补造 `sourceRunDigest`，仅接受已核实 writer 的完整有限前后缀。通过当前项目原 `runs` 内父文件，复用 `loadRun`、现行计划 Schema、不可变计划路径、完整谱系与检查点映射，确认父运行 `PUBLISHED`，再根据父计划核实其为 `foundation-adoption-review@0.1.0`，与 0.28.0 不同。每个动作身份必须对应父计划；同目标、不完整父权威、未知阶段、关系冲突或矛盾仍拒。其中 0.9.7 实际执行过隔离消费者安装，包含 `execute` 及本地写入，不能声称“零 execute”或“零本地写入”，亦不得由此授予发布外写权限。verify 失败不构成 publish 零外写证明，不赋予发布、恢复、替代或 TEST 权威。
+
+所有未知、损坏、矛盾、不连续、封口不符或关系冲突的历史记录一律不可用。原件不得删除、搬移、补字段或重建。自引用、环、多有效后继或坏后继均不得使旧计划复活。
+
+替代操作不放宽来源提交与远端 main 的精确相等要求、`TEST` 状态、远端冲突或批准门限制。继续精确执行 Foundation 0.25.0 机制，目标归属由 Release Skill 领域责任判断，不依赖目录名、时间或错误文本推断。本轮未删除或重命名产品能力，替代仅作用于符合条件的运行计划。未发布候选或本地自测不代表发布成功，亦不构成独立验收。所有操作均基于 0.9.38 支持入口，不能撤销任意旧软件或绕过现有协议。

package/src/commands/approve.mjs

@@ -1,3 +1,5 @@
+import { acquireProjectLock } from '../artifacts/project-lock.mjs';
+import { assertPlanNotReplaced } from '../core/plan-replacement.mjs';
 /**
  * Approve command: record approval for a frozen release plan.
  *
@@ -14,7 +16,7 @@
  */
 
 import { readFile, writeFile } from 'node:fs/promises';
-import { resolve, dirname, basename } from 'node:path';
+import { resolve, dirname, basename, sep } from 'node:path';
 
 import {
   assertAuthorityFileTarget,
@@ -276,33 +278,40 @@ export async function approvePlan(options) {
     actualDigest,
     `${approvalDigest}.json`,
   );
-  await prepareAuthorityDirectory(dirname(immutableApprovalPath));
-  await assertAuthorityFileTarget(immutableApprovalPath);
+  const replacementRoot = options.root ?? (plan.production || plan.testAcceptance || Object.hasOwn(plan, 'replacesPlanDigest')
+    || resolve(planPath).split(sep).includes('.release-skill') ? projectRootFromPlanPath(planPath) : null);
+  const replacementLock = replacementRoot
+    ? await acquireProjectLock({ root: replacementRoot, command: 'approve', mode: 'exclusive' }) : null;
   try {
-    await writeFile(immutableApprovalPath, json, { encoding: 'utf8', flag: 'wx', mode: 0o600 });
-  } catch (error) {
-    if (error.code !== 'EEXIST') throw error;
-    const existing = await readFile(immutableApprovalPath, 'utf8');
-    if (existing !== json) {
-      throw new ReleaseError(
-        GATE_FAILED,
-        'approval authority digest collision: existing bytes differ',
-        { planDigest: actualDigest, approvalDigest, immutableApprovalPath },
-      );
+    if (replacementRoot) await assertPlanNotReplaced(replacementRoot, { ...plan, digest: actualDigest }, planPath);
+    await prepareAuthorityDirectory(dirname(immutableApprovalPath));
+    await assertAuthorityFileTarget(immutableApprovalPath);
+    try {
+      await writeFile(immutableApprovalPath, json, { encoding: 'utf8', flag: 'wx', mode: 0o600 });
+    } catch (error) {
+      if (error.code !== 'EEXIST') throw error;
+      const existing = await readFile(immutableApprovalPath, 'utf8');
+      if (existing !== json) {
+        throw new ReleaseError(
+          GATE_FAILED,
+          'approval authority digest collision: existing bytes differ',
+          { planDigest: actualDigest, approvalDigest, immutableApprovalPath },
+        );
+      }
     }
-  }
 
-  const writePath = outputPath ?? resolve(releaseDir, 'approval-record.json');
-  await prepareAuthorityDirectory(dirname(writePath));
-  await assertAuthorityFileTarget(writePath);
-  await writeFile(writePath, json, 'utf8');
+    const writePath = outputPath ?? resolve(releaseDir, 'approval-record.json');
+    await prepareAuthorityDirectory(dirname(writePath));
+    await assertAuthorityFileTarget(writePath);
+    await writeFile(writePath, json, 'utf8');
 
-  return Object.freeze({
-    ...approvalRecord,
-    approvalDigest,
-    approvalPath: immutableApprovalPath,
-    latestApprovalPath: writePath,
-  });
+    return Object.freeze({
+      ...approvalRecord,
+      approvalDigest,
+      approvalPath: immutableApprovalPath,
+      latestApprovalPath: writePath,
+    });
+  } finally { if (replacementLock) await replacementLock.release(); }
 }
 
 /**

package/src/commands/prepare.mjs

@@ -1,3 +1,4 @@
+import { bindReplacement } from '../core/plan-replacement.mjs';
 /**
  * Prepare command: freeze a release plan with snapshots and gates.
  *
@@ -3448,6 +3449,7 @@ async function reattachTestCandidate({
     expectedSubjectDigest: options.expectedSubjectDigest,
     configDigest,
     extraDrifts,
+    replaceUnpublishedPlan: options.replaceUnpublishedPlan,
   });
   const savedPrepared = adoptedCandidate.candidate.prepared;
   await recheckCandidateClosure(realRoot, savedPrepared, config, savedOptions.unitIds);
@@ -3624,6 +3626,7 @@ async function reattachTestCandidate({
   const latestPlanPath = output ?? resolve(releaseDir, 'release-plan.json');
   const plannedDigest = computePlanDigest(plan);
   const immutablePlanPath = resolve(dirname(latestPlanPath), 'plans', `${plannedDigest}.json`);
+  await bindReplacement({ root: realRoot, prepared: decision.prepared, resultFile: requirements.resultFile });
   const { planPath: writtenPath, planDigest } = await writePlanImmutable(immutablePlanPath, plan);
   await writePlanAtomic(latestPlanPath, plan);
   await writeFrozenMarker(releaseDir, {
@@ -3781,6 +3784,9 @@ export async function prepareRelease(options) {
 
     const { config, configPath, configDigest } = await loadProjectConfig({ root: realRoot });
     assertTestIntakeDeclaration({ config, production });
+    if (options.replaceUnpublishedPlan !== undefined && (!production || !config.testIntake)) {
+      throw new ReleaseError(CONFIG_INVALID, 'unpublished replacement requires production testIntake');
+    }
     if (options?.candidatePath && !config.testIntake) {
       throw new ReleaseError(CONFIG_INVALID, 'candidate path requires testIntake', {
         reason: 'TEST_CANDIDATE_WITHOUT_INTAKE',
@@ -5424,10 +5430,11 @@ export async function prepareRelease(options) {
         config,
         selectedUnitIds: releaseSelection.selectedUnitIds,
       });
+      const boundPrepared = await bindReplacement({ root: realRoot, prepared: projectPrepared(plan), replaceUnpublishedPlan: options.replaceUnpublishedPlan, resultFile: requirementsNow.resultFile });
       const saved = await writeTestCandidate({
         root: realRoot,
         runDir,
-        prepared: projectPrepared(plan),
+        prepared: boundPrepared,
         requirements: requirementsNow,
         prepareOptions: {
           workflow,
@@ -5439,7 +5446,7 @@ export async function prepareRelease(options) {
           ),
         },
       });
-      const subjectDigest = subjectDigestOf(projectPrepared(plan));
+      const subjectDigest = subjectDigestOf(boundPrepared);
       await evidence.append({
         phase: 'test-candidate',
         status: 'saved',

package/src/commands/publish.mjs

@@ -1,3 +1,5 @@
+import { acquireProjectLock } from '../artifacts/project-lock.mjs';
+import { assertPlanNotReplaced } from '../core/plan-replacement.mjs';
 /**
  * Publish command: Saga-pattern checkpoint execution with safety gates.
  *
@@ -498,6 +500,7 @@ export async function publishRelease(options) {
   }
   validatePlan(plan);
   assertImmutablePlanAuthority(planPath, plan);
+  await assertPlanNotReplaced(root, plan, planPath);
   await verifyTestAcceptance({ root, plan });
   const isProductionPlan = plan.production?.mode === 'github-npm-v1';
 
@@ -1248,8 +1251,13 @@ export async function publishRelease(options) {
       ...(finishedAt ? { finishedAt } : {}),
     });
     let stateSequence = 0;
-    let latestState = await appendRunState(runDir, stateSequence, buildPersistedState());
-    recoveryRunPath = latestState.statePath;
+    const replacementLock = await acquireProjectLock({ root, command: 'publish', mode: 'exclusive' });
+    let latestState;
+    try {
+      await assertPlanNotReplaced(root, plan, planPath);
+      latestState = await appendRunState(runDir, stateSequence, buildPersistedState());
+      recoveryRunPath = latestState.statePath;
+    } finally { await replacementLock.release(); }
 
     await evidence.append({
       phase: 'publish',

package/src/commands/reconcile.mjs

@@ -1,3 +1,4 @@
+import { assertPlanNotReplaced } from '../core/plan-replacement.mjs';
 /**
  * Reconcile command: idempotent recovery from partial publish.
  *
@@ -149,6 +150,7 @@ export async function reconcileRelease(options) {
   }
   validatePlan(plan);
   assertImmutablePlanAuthority(planPath, plan);
+  await assertPlanNotReplaced(root, plan, planPath);
   await verifyTestAcceptance({ root, plan });
   const isProductionPlan = plan.production?.mode === 'github-npm-v1';
 

package/src/commands/route.mjs

@@ -1,3 +1,4 @@
+import { isProvenPreAuthorityFailure } from '../core/pre-authority-failure.mjs';
 /**
  * release-route command: Deterministic quickstart routing for workflow profiles.
  *
@@ -46,7 +47,6 @@ import {
   validateRunCheckpointMapping,
 } from '../core/run.mjs';
 import { computePlanDigest, validatePlan } from '../core/plan.mjs';
-import { resolveProducerVersion } from '../core/evidence.mjs';
 import { normalizePostPublishView, postPublishActionId } from '../core/postpublish.mjs';
 
 const WORKFLOW_KINDS = Object.freeze([
@@ -732,170 +732,13 @@ async function inspectStateDirectory(statesPath) {
   return { ok: true, entries };
 }
 
-async function isProvenPreAuthorityFailure(runDir, runName) {
-  if (!/^publish-/.test(runName)) return false;
-  const summaryPath = join(runDir, 'summary.json');
-  const evidencePath = join(runDir, 'evidence.jsonl');
-  let summary;
-  let events;
-  try {
-    summary = JSON.parse(await readFile(summaryPath, 'utf8'));
-    events = (await readFile(evidencePath, 'utf8')).trim().split('\n').filter(Boolean).map((line) => JSON.parse(line));
-  } catch {
-    return false;
-  }
-
-  // The v1 writer (used before the producer-bound v2 envelope) created the
-  // run directory and appended safety-gate events before its first
-  // `release-run.json` state. A failed global preflight then appended only a
-  // generic `publish` failure and sealed a summary. This branch deliberately
-  // accepts that historical shape only when every byte still proves the same
-  // pre-authority boundary. It never infers safety from a directory name,
-  // mtime, summary alone, or a loosely similar phase.
-  const legacyPreAuthorityPhases = new Set([
-    'safety-gate',
-    'global-preflight-arbitration',
-    're-observe-previous-public-baseline',
-  ]);
-  const legacyInputFailure = /(?:global preflight failed|source authority .*failed|cannot read (?:release plan|approval record)|production (?:publish|commands) require|plan (?:digest mismatch|action completeness gate failed|is not valid|requires)|baseline (?:changed|check failed)|previous-public-baseline|adapter .*failed)/i;
-  const legacyUnsafeFailure = /(?:remote (?:tag|branch|release) .*already exists|human intervention required|remote conflict|external write)/i;
-  const legacyPreAuthorityGates = new Set([
-    'plan-load',
-    'plan-schema',
-    'plan-digest',
-    'action-completeness',
-    'approval-load',
-    'adapter-availability',
-    'baseline-check',
-    'source-authority',
-  ]);
-  const validLegacyTimestamp = (value) => typeof value === 'string'
-    && /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/.test(value)
-    && Number.isFinite(Date.parse(value));
-  const validLegacyError = (error) => error && typeof error === 'object' && !Array.isArray(error)
-    && typeof error.code === 'string' && error.code.length > 0
-    && (error.message === undefined || typeof error.message === 'string');
-  const validLegacyEvent = (event, runId) => event && typeof event === 'object' && !Array.isArray(event)
-    && event.schemaVersion === 1
-    && !Object.hasOwn(event, 'producer')
-    && typeof event.runId === 'string' && event.runId === runId
-    && Number.isSafeInteger(event.sequence) && event.sequence >= 1
-    && validLegacyTimestamp(event.timestamp)
-    && event.command === 'publish'
-    && typeof event.phase === 'string'
-    && (legacyPreAuthorityPhases.has(event.phase) || event.phase === 'publish')
-    && typeof event.status === 'string' && event.status.length > 0
-    && (event.error === undefined || event.error === null || validLegacyError(event.error))
-    && (event.duration === undefined || Number.isSafeInteger(event.duration) && event.duration >= 0)
-    && (event.details === undefined || event.details !== null
-      && typeof event.details === 'object' && !Array.isArray(event.details));
-  const legacyRunId = basename(runDir);
-  const legacyTerminal = events.at(-1);
-  const legacyValid = summary && summary.status === 'FAILED'
-    && validLegacyError(summary.error)
-    && typeof summary.error.message === 'string' && legacyInputFailure.test(summary.error.message)
-    && !legacyUnsafeFailure.test(summary.error.message)
-    && (summary.recoveryActionCode === undefined || summary.recoveryActionCode === 'RETRY_COMMAND')
-    && summary.runPath === undefined
-    && summary.finalRunDigest === undefined
-    && summary.latestStatePath === undefined
-    && summary.checkpointStatuses === undefined
-    && Array.isArray(events) && events.length >= 2
-    && events.every((event, index) => validLegacyEvent(event, legacyRunId)
-      && event.sequence === index + 1)
-    && legacyTerminal.phase === 'publish'
-    && legacyTerminal.status === 'failed'
-    && validLegacyError(legacyTerminal.error)
-    && legacyTerminal.error.code === summary.error.code
-    && events.slice(0, -1).filter((event) => event.status === 'failed').every((event) =>
-      event.phase === 'safety-gate'
-      && legacyPreAuthorityGates.has(event.gate)
-      && validLegacyError(event.error))
-    && !events.some((event) => event.phase === 'global-preflight-arbitration'
-      && event.status !== 'pre-observe')
-    && !events.slice(0, -1).some((event) => event.phase === 'publish'
-      || /checkpoint|execute|postpublish/i.test(event.phase)
-      || Object.hasOwn(event, 'prePersistedRunPath')
-      || Object.hasOwn(event, 'checkpointCount')
-      || Object.hasOwn(event, 'checkpointStatuses'));
-  if (legacyValid) return true;
-
-  const producerVersion = resolveProducerVersion();
-  const sameProducer = (value) => value && typeof value === 'object' && !Array.isArray(value)
-    && Object.keys(value).length === 2
-    && value.name === 'release-skill' && value.version === producerVersion;
-  const envelopeKeys = new Set([
-    'schemaVersion', 'runId', 'sequence', 'timestamp', 'command', 'producer',
-    'phase', 'status', 'error', 'duration', 'details',
-  ]);
-  const validTimestamp = (value) => typeof value === 'string'
-    && /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/.test(value)
-    && Number.isFinite(Date.parse(value));
-  const detailValidators = {
-    unitId: (value) => typeof value === 'string',
-    gate: (value) => typeof value === 'string',
-    hookName: (value) => typeof value === 'string',
-    actionId: (value) => typeof value === 'string',
-    step: (value) => typeof value === 'string',
-    hookId: (value) => typeof value === 'string',
-    tagCommit: (value) => typeof value === 'string',
-    cached: (value) => typeof value === 'boolean',
-    testSelection: (value) => typeof value === 'string',
-    cacheKey: (value) => typeof value === 'string',
-    durationMs: (value) => value === null || Number.isSafeInteger(value) && value >= 0,
-    exitCode: (value) => Number.isSafeInteger(value),
-    findingCount: (value) => Number.isSafeInteger(value) && value >= 0,
-  };
-  const validDetails = (value) => value === undefined
-    || value !== null && typeof value === 'object' && !Array.isArray(value)
-      && Object.entries(value).every(([key, detail]) => !detailValidators[key] || detailValidators[key](detail));
-  const validEnvelope = (event) => event && typeof event === 'object'
-    && Object.keys(event).every((key) => envelopeKeys.has(key))
-    && event.schemaVersion === 2
-    && typeof event.runId === 'string' && event.runId === basename(runDir)
-    && Number.isSafeInteger(event.sequence) && event.sequence >= 1
-    && validTimestamp(event.timestamp)
-    && event.command === 'publish'
-    && typeof event.phase === 'string' && event.phase.length > 0
-    && typeof event.status === 'string' && event.status.length > 0
-    && sameProducer(event.producer)
-    && (event.error === undefined || event.error === null
-      || (typeof event.error === 'object' && !Array.isArray(event.error)
-        && Object.keys(event.error).every((key) => key === 'code' || key === 'message')
-        && typeof event.error.code === 'string' && event.error.code.length > 0
-        && (event.error.message === undefined || typeof event.error.message === 'string')))
-    && (event.duration === undefined || Number.isSafeInteger(event.duration) && event.duration >= 0)
-    && validDetails(event.details);
-  if (summary.status !== 'FAILED' || summary.recoveryActionCode !== 'RETRY_COMMAND'
-    || summary.evidencePath !== 'evidence.jsonl' || !sameProducer(summary.producer)
-    || !Array.isArray(events) || events.length === 0) return false;
-  let previousSequence = 0;
-  let firstFailure = null;
-  let genericFailure = null;
-  for (const event of events) {
-    if (!validEnvelope(event) || event.sequence !== previousSequence + 1) return false;
-    previousSequence = event.sequence;
-    if (event.status === 'failed' && firstFailure === null) firstFailure = event;
-    if (event.phase === 'publish') {
-      if (event.status !== 'failed' || genericFailure !== null || event.details?.prePersistedRunPath
-        || event.details?.recoveryActionCode !== summary.recoveryActionCode) return false;
-      genericFailure = event;
-    } else if (!['safety-gate', 'global-preflight-arbitration'].includes(event.phase)) {
-      return false;
-    }
-  }
-  if (!firstFailure || !genericFailure || events.at(-1) !== genericFailure
-    || summary.evidenceSequence !== firstFailure.sequence
-    || summary.stablePhase !== firstFailure.phase) return false;
-  return !events.some((event) => event.details?.prePersistedRunPath);
-}
 
 /**
  * Postverify is a downstream run type that predates the generic recovery
  * reader. Its completed and open records are consumable only when the summary
  * agrees with the sealed status and the verify parent is fully lineage-valid.
  */
-async function readLegacyPostverifyRecovery(runPath) {
+export async function readLegacyPostverifyRecovery(runPath) {
   try {
     const run = await loadRun(runPath, { requireDigest: true });
     const acceptedStatuses = new Set(['DISTRIBUTED', 'PARTIAL', 'BLOCKED', 'NEEDS_INPUT']);