ruvnet-brain 4.7.21 → 4.7.23

package/scripts/issue-autofix-release-ship.mjs

@@ -0,0 +1,226 @@
+// S7-S12 of the autofix pipeline (ADR-107): push the release branch, wait for preflight on the EXACT SHA, open the PR
+// for its required checks, re-check the corpus generation, move main by fast-forward only, dispatch the protected
+// release, watch every job, then check the terminal state. Every external call goes through ctx.exec.
+//
+// RESUMABLE. Each step records itself in a journal (ctx.saveJournal) and first looks for its own effect on GitHub, so a
+// run killed by a network drop, Mac sleep or the job's wall clock is finished by the next run without a second push,
+// a second PR or a second dispatch. The kill switch is re-read (ctx.checkpoint) immediately before every irreversible
+// step: push, PR create, main fast-forward, dispatch, recovery dispatch.
+//
+// HALT only on a definite red once main has moved (a concluded red release run, a terminal check that fails after the
+// run concluded green). A transient failure (gh or network unreachable, a watch that timed out, the kill switch
+// unreadable or off) keeps the journal and returns phase 'paused': the next armed run resumes it.
+import path from 'node:path';
+import { AutofixAbort } from './issue-autofix-policy.mjs';
+import {
+  MIN, SHA_RE, tail, must, git, mustGit, gh, ghJson, ghBin, assertCleanText, assertVersion,
+  poll, queryNpmLatest, queryReleasesLatest, queryRemoteMain, resolveRuntime,
+} from './issue-autofix-release-util.mjs';
+
+const POLL_MS = 30_000;
+const PREFLIGHT_WORKFLOW = 'release-candidate-preflight.yml';
+const RELEASE_WORKFLOW = 'protected-release.yml';
+const OK_JOB = new Set(['success', 'skipped']);
+const TRANSIENT = new Set(['transient', 'kill-switch-off', 'halted', 'preflight-timeout', 'window-closed']);
+
+/** Terminal install-verified check; also used by S13b for an already-published tag. */
+export async function verifyTerminal(ctx, { version, sha }) {
+  const out = path.join(ctx.runDir || '.', `approved-runtime-${version}.json`);
+  const runtimeResolved = await resolveRuntime(ctx, version, out);
+  const npmLatest = await queryNpmLatest(ctx);
+  const releasesLatest = await queryReleasesLatest(ctx);
+  const mainSha = await queryRemoteMain(ctx);
+  const installVerified = runtimeResolved && npmLatest === version && releasesLatest === `v${version}` && mainSha === sha;
+  return { installVerified, npmLatest, releasesLatest, mainSha, runtimeResolved };
+}
+
+const transient = (stage, detail) => new AutofixAbort(stage, 'transient', detail);
+
+async function remoteBranchSha(ctx, branch) {
+  const r = await git(ctx, ctx.clone, ['ls-remote', '--heads', 'origin', `refs/heads/${branch}`]);
+  if (r.status !== 0 || r.timedOut) throw transient('S7', `cannot read remote ${branch}`);
+  return r.stdout.trim().split(/\s+/)[0] || null;
+}
+
+async function stepPush(ctx, j, rwt) {
+  const there = await remoteBranchSha(ctx, j.branch);
+  if (there === j.sha) return;
+  if (there) throw new AutofixAbort('S7', 'branch-exists', `${j.branch} is at ${there} on the remote, not ${j.sha}`);
+  await ctx.checkpoint('S7');
+  const r = await git(ctx, rwt, ['push', 'origin', j.branch]);
+  if (r.status !== 0 || r.timedOut) {
+    if (await remoteBranchSha(ctx, j.branch) === j.sha) return; // the push landed; only the reply was lost
+    throw transient('S7', `push: ${tail(r.stderr || r.stdout, 300)}`);
+  }
+}
+
+async function stepPreflight(ctx, j) {
+  const list = ['run', 'list', '--repo', ctx.repo, '--workflow', PREFLIGHT_WORKFLOW, '--branch', j.branch,
+    '--json', 'databaseId,headSha,status,conclusion', '--limit', '20'];
+  const found = await poll(ctx, { limitMs: 10 * MIN, intervalMs: POLL_MS, fn: async () => {
+    const r = await ghJson(ctx, list);
+    return Array.isArray(r.value) ? r.value.find((x) => x.headSha === j.sha) || null : null;
+  } });
+  if (!found) throw new AutofixAbort('S8', 'preflight-timeout', `no preflight run for ${j.sha} within 10 minutes`);
+  j.preflightRunId = found.databaseId; ctx.saveJournal(j);
+  if (found.status !== 'completed') {
+    const w = await gh(ctx, ['run', 'watch', String(found.databaseId), '--repo', ctx.repo, '--exit-status'], { timeoutMs: 60 * MIN });
+    if (w.timedOut) throw transient('S8', `preflight ${found.databaseId} still running after 60 minutes`);
+  }
+  const v = await ghJson(ctx, ['run', 'view', String(found.databaseId), '--repo', ctx.repo, '--json', 'status,conclusion,headSha']);
+  if (!v.ok) throw transient('S8', `cannot read preflight ${found.databaseId}`);
+  if (v.value.status !== 'completed') throw transient('S8', `preflight ${found.databaseId} not finished`);
+  if (v.value.conclusion !== 'success' || v.value.headSha !== j.sha) {
+    throw new AutofixAbort('S8', 'preflight-failed', `run ${found.databaseId}: conclusion ${v.value.conclusion}, sha ${v.value.headSha}`);
+  }
+}
+
+async function stepPr(ctx, j) {
+  if (!j.prNumber) {
+    const open = await ghJson(ctx, ['pr', 'list', '--repo', ctx.repo, '--head', j.branch, '--state', 'open', '--json', 'number', '--limit', '5']);
+    if (!open.ok) throw transient('S9', 'cannot list pull requests');
+    if (open.value.length) j.prNumber = open.value[0].number;
+    else {
+      const title = `release ${j.version}: autofix issues ${j.issues.join(', ')}`;
+      const body = `Refs issues ${j.issues.join(', ')} (ADR-107 autofix). No merge button is used; main moves by fast-forward.`;
+      assertCleanText('S9', `${title}\n${body}`);
+      await ctx.checkpoint('S9');
+      const created = await gh(ctx, ['pr', 'create', '--repo', ctx.repo, '--base', 'main', '--head', j.branch, '--title', title, '--body', body]);
+      const m = String(created.stdout).match(/\/pull\/(\d+)/);
+      if (created.status !== 0 || !m) throw transient('S9', `pr create: ${tail(created.stderr || created.stdout, 300)}`);
+      j.prNumber = Number(m[1]);
+    }
+    ctx.saveJournal(j);
+  }
+  const c = await gh(ctx, ['pr', 'checks', String(j.prNumber), '--repo', ctx.repo, '--required', '--watch', '--fail-fast'], { timeoutMs: 30 * MIN });
+  if (c.timedOut) throw transient('S9', 'required checks not finished in 30 minutes');
+  if (c.status !== 0) throw new AutofixAbort('S9', 'checks-failed', tail(c.stdout || c.stderr, 400));
+}
+
+/** release:prepush --pre-dispatch: the sealed corpus generation must still be the newest one, BEFORE main moves. */
+async function stepPreDispatch(ctx, j, rwt) {
+  if (ctx.gates?.['release-prepush-dispatch']) {
+    const g = await ctx.gates['release-prepush-dispatch'](rwt);
+    if (g.exitCode !== 0) throw new AutofixAbort('S9', 'prepush-failed', tail(g.output, 600));
+    return;
+  }
+  const r = await ctx.exec('npm', ['run', 'release:prepush', '--', '--pre-dispatch', '--sha', j.sha], { cwd: rwt, timeoutMs: 20 * MIN });
+  if (r.timedOut) throw transient('S9', 'release:prepush --pre-dispatch timed out');
+  if (r.status !== 0) throw new AutofixAbort('S9', 'prepush-failed', tail(`${r.stdout}${r.stderr}`, 600));
+}
+
+async function stepPromote(ctx, j, rwt) {
+  const remote = await queryRemoteMain(ctx, rwt);
+  if (!remote) throw transient('S10', 'cannot read remote main');
+  if (remote === j.sha) { j.moved = true; ctx.saveJournal(j); return; }
+  await mustGit(ctx, 'S10', 'transient', rwt, ['fetch', 'origin', 'main']);
+  const anc = await git(ctx, rwt, ['merge-base', '--is-ancestor', 'origin/main', j.sha]);
+  if (anc.status === 1) throw new AutofixAbort('S10', 'not-ancestor', 'origin/main is not an ancestor of the candidate; main moved');
+  if (anc.status !== 0) throw transient('S10', tail(anc.stderr, 300));
+  await ctx.checkpoint('S10'); // kill switch + release window, immediately before the irreversible step
+  const push = await git(ctx, rwt, ['push', 'origin', `${j.sha}:refs/heads/main`]);
+  const after = await queryRemoteMain(ctx, rwt);
+  if (after === j.sha) { j.moved = true; j.movedAt = ctx.now(); ctx.saveJournal(j); return; }
+  // The push said yes but the remote names another commit: main may have moved under us. Treat it as moved (halt).
+  if (push.status === 0) { j.moved = true; j.movedAt = ctx.now(); ctx.saveJournal(j); throw new AutofixAbort('S10', 'main-moved', `remote main is ${after} after a successful push`); }
+  throw transient('S10', `push exit ${push.status}: ${tail(push.stderr, 300)}`);
+}
+
+async function findReleaseRun(ctx, j) {
+  const r = await ghJson(ctx, ['run', 'list', '--repo', ctx.repo, '--workflow', RELEASE_WORKFLOW,
+    '--json', 'databaseId,displayTitle,createdAt,status,conclusion,headSha', '--limit', '30']);
+  if (!r.ok) throw transient('S11', 'cannot list protected-release runs');
+  const title = `protected-release code ${j.version}`;
+  return r.value.find((x) => x.displayTitle === title && Date.parse(x.createdAt) >= (j.dispatchedAt || j.movedAt || 0) - 120_000) || null;
+}
+
+async function stepDispatch(ctx, j) {
+  let run = j.releaseRunId ? { databaseId: j.releaseRunId } : await findReleaseRun(ctx, j);
+  if (!run) {
+    if (!j.dispatchedAt) {
+      await ctx.checkpoint('S11');
+      j.dispatchedAt = ctx.now(); ctx.saveJournal(j);
+      const d = await gh(ctx, ['workflow', 'run', RELEASE_WORKFLOW, '--repo', ctx.repo,
+        '--raw-field', 'mode=code', '--raw-field', `candidate_sha=${j.sha}`, '--raw-field', `version=${j.version}`]);
+      if (d.status !== 0) { j.dispatchedAt = null; ctx.saveJournal(j); throw transient('S11', `dispatch: ${tail(d.stderr, 300)}`); }
+    }
+    run = await poll(ctx, { limitMs: 5 * MIN, intervalMs: 15_000, fn: () => findReleaseRun(ctx, j) });
+    // Never dispatch twice: a run that has not appeared yet is looked for again next run; after 30 min it needs a person.
+    if (!run && ctx.now() - j.dispatchedAt < 30 * MIN) throw transient('S11', `no "protected-release code ${j.version}" run yet`);
+    if (!run) throw new AutofixAbort('S11', 'dispatch-not-found', `no "protected-release code ${j.version}" run 30 minutes after the dispatch`);
+  }
+  j.releaseRunId = run.databaseId; ctx.saveJournal(j);
+  const w = await gh(ctx, ['run', 'watch', String(run.databaseId), '--repo', ctx.repo, '--exit-status'], { timeoutMs: 150 * MIN });
+  if (w.timedOut) throw transient('S11', 'protected-release still running after 150 minutes');
+  const v = await ghJson(ctx, ['run', 'view', String(run.databaseId), '--repo', ctx.repo, '--json', 'status,jobs,conclusion']);
+  if (!v.ok) throw transient('S11', `cannot read run ${run.databaseId}`);
+  if (v.value.status !== 'completed') throw transient('S11', `run ${run.databaseId} not finished`);
+  const jobs = Array.isArray(v.value.jobs) ? v.value.jobs : [];
+  const bad = jobs.filter((x) => !OK_JOB.has(x.conclusion)).map((x) => `${x.name}=${x.conclusion}`);
+  const fin = jobs.find((x) => x.name === 'finalize-public-verification');
+  if (!jobs.length || bad.length || !fin || fin.conclusion !== 'success') {
+    throw new AutofixAbort('S11', 'release-failed', `run ${run.databaseId}: ${bad.join(', ') || 'none red'}; finalize=${fin?.conclusion}`);
+  }
+}
+
+/** Once per release (journal-guarded): ask the recovery rail to re-run public verification on a published tag. */
+async function recoverOnce(ctx, j) {
+  if (j.recoveryDispatched || !j.releaseRunId) return false;
+  const a = await ghJson(ctx, ['api', `repos/${ctx.repo}/actions/runs/${j.releaseRunId}/artifacts`]);
+  const art = (a.value?.artifacts || []).find((x) => x.name === `publication-evidence-${j.sha}` && x.expired === false);
+  if (!art) return false;
+  await ctx.checkpoint('S12');
+  const payload = { event_type: 'recover-public-verification',
+    client_payload: { candidate_sha: j.sha, version: j.version, publication_run_id: String(j.releaseRunId), artifact_id: String(art.id) } };
+  j.recoveryDispatched = true; ctx.saveJournal(j);
+  const r = await gh(ctx, ['api', `repos/${ctx.repo}/dispatches`, '--method', 'POST', '--input', '-'], { input: JSON.stringify(payload) });
+  return r.status === 0;
+}
+
+/**
+ * Drive the journal `j` ({version, branch, sha, issues, ...}) to a terminal phase:
+ * 'shipped' | 'published-unverified' (halt) | 'aborted' (red before main moved; nothing public changed) |
+ * 'halted' (red after main moved) | 'paused' (transient; resume next run).
+ */
+export async function shipRelease(ctx, { rwt, journal: j }) {
+  const res = () => ({ version: j.version, sha: j.sha, branch: j.branch, prNumber: j.prNumber || null,
+    preflightRunId: j.preflightRunId || null, releaseRunId: j.releaseRunId || null, terminal: j.terminal || null,
+    recoveryDispatched: !!j.recoveryDispatched });
+  let stage = 'S7';
+  try {
+    assertVersion('S7', j.version);
+    if (!SHA_RE.test(String(j.sha))) throw new AutofixAbort('S7', 'push-failed', `bad candidate sha ${j.sha}`);
+    if (!j.moved) {
+      stage = 'S7'; await stepPush(ctx, j, rwt);
+      stage = 'S8'; await stepPreflight(ctx, j);
+      stage = 'S9'; await stepPr(ctx, j);
+      await stepPreDispatch(ctx, j, rwt);
+      stage = 'S10'; await stepPromote(ctx, j, rwt);
+    }
+    stage = 'S11'; await stepDispatch(ctx, j);
+    stage = 'S12';
+    j.terminal = await verifyTerminal(ctx, { version: j.version, sha: j.sha }); ctx.saveJournal(j);
+    if (!j.terminal.installVerified) throw new AutofixAbort('S12', 'terminal-unverified', `npm ${j.terminal.npmLatest}, release ${j.terminal.releasesLatest}, main ${j.terminal.mainSha}`);
+    j.phase = 'shipped'; ctx.saveJournal(j);
+    return { ...res(), phase: 'shipped', abort: null };
+  } catch (e) {
+    const a = e instanceof AutofixAbort ? e : transient(stage, e?.message || String(e));
+    const abort = { stage: a.stage || stage, code: a.code, detail: a.detail, halt: false };
+    if (!j.moved) {
+      if (TRANSIENT.has(a.code)) { j.phase = 'paused'; ctx.saveJournal(j); return { ...res(), phase: 'paused', abort }; }
+      if (j.prNumber) await gh(ctx, ['pr', 'close', String(j.prNumber), '--repo', ctx.repo]); // best effort; the branch is kept
+      j.phase = 'aborted'; ctx.saveJournal(j);
+      return { ...res(), phase: 'aborted', abort };
+    }
+    if (TRANSIENT.has(a.code)) { j.phase = 'paused'; ctx.saveJournal(j); return { ...res(), phase: 'paused', abort }; }
+    abort.halt = true;
+    j.terminal = j.terminal || await verifyTerminal(ctx, { version: j.version, sha: j.sha }).catch(() => null);
+    if (j.terminal?.npmLatest === j.version) {
+      try { await recoverOnce(ctx, j); } catch { /* the recovery rail is best effort; the halt page carries the state */ }
+      j.phase = 'published-unverified'; ctx.saveJournal(j);
+      return { ...res(), phase: 'published-unverified', abort };
+    }
+    j.phase = 'halted'; ctx.saveJournal(j);
+    return { ...res(), phase: 'halted', abort };
+  }
+}

package/scripts/issue-autofix-release-util.mjs

@@ -0,0 +1,141 @@
+// Shared helpers for the autofix release path (ADR-107, batch A3). No child_process here: every
+// external command goes through the injected `ctx.exec` (see FROZEN INTERFACES).
+import os from 'node:os';
+import path from 'node:path';
+import { AutofixAbort, findClosingKeywords } from './issue-autofix-policy.mjs';
+
+export const VERSION_RE = /^\d+\.\d+\.\d+$/;
+export const SHA_RE = /^[0-9a-f]{40}$/;
+export const MIN = 60_000;
+export const tail = (text, n = 1500) => String(text ?? '').slice(-n);
+export const ghBin = (ctx) => ctx.ghBin || 'gh';
+export const gitBin = (ctx) => ctx.gitBin || 'git';
+
+export async function run(ctx, cmd, args, opts = {}) {
+  return ctx.exec(cmd, args, opts);
+}
+export const describe = (cmd, args, r) =>
+  `${cmd} ${args.join(' ')} -> ${r.timedOut ? 'timed out' : r.status}: ${tail(r.stderr || r.stdout, 400)}`;
+
+/** Run and throw AutofixAbort(stage, code) on any non-zero exit or timeout. */
+export async function must(ctx, stage, code, cmd, args, opts = {}) {
+  const r = await run(ctx, cmd, args, opts);
+  if (r.status !== 0 || r.timedOut) throw new AutofixAbort(stage, code, describe(cmd, args, r));
+  return r;
+}
+export const git = (ctx, dir, args, opts) => run(ctx, gitBin(ctx), ['-C', dir, ...args], opts);
+export const mustGit = (ctx, stage, code, dir, args, opts) => must(ctx, stage, code, gitBin(ctx), ['-C', dir, ...args], opts);
+export const gh = (ctx, args, opts) => run(ctx, ghBin(ctx), args, opts);
+
+export async function ghJson(ctx, args, opts) {
+  const r = await gh(ctx, args, opts);
+  if (r.status !== 0 || r.timedOut) return { ok: false, value: null, result: r };
+  try { return { ok: true, value: JSON.parse(r.stdout || 'null'), result: r }; }
+  catch { return { ok: false, value: null, result: r }; }
+}
+
+/** Per-command identity (no repo or global git config is ever written). The env copy stops an ambient GIT_AUTHOR_* from winning. */
+export const identityArgs = (ctx) => ['-c', `user.name=${ctx.identity.name}`, '-c', `user.email=${ctx.identity.email}`,
+  '-c', 'commit.gpgsign=false'];
+export const identityEnv = (ctx) => ({ ...process.env, GIT_AUTHOR_NAME: ctx.identity.name, GIT_AUTHOR_EMAIL: ctx.identity.email,
+  GIT_COMMITTER_NAME: ctx.identity.name, GIT_COMMITTER_EMAIL: ctx.identity.email });
+/** git commit / cherry-pick as the autofix identity. */
+export const gitAs = (ctx, dir, args) => git(ctx, dir, [...identityArgs(ctx), ...args], { env: identityEnv(ctx) });
+export const mustGitAs = async (ctx, stage, code, dir, args) => {
+  const r = await gitAs(ctx, dir, args);
+  if (r.status !== 0 || r.timedOut) throw new AutofixAbort(stage, code, describe(gitBin(ctx), args, r));
+  return r;
+};
+
+/** Throws when text would auto-close an issue (closing keyword + #N) or credit a co-author. */
+export function assertCleanText(stage, text) {
+  const hits = findClosingKeywords(String(text));
+  if (hits.length) throw new AutofixAbort(stage, 'forbidden-command', `closing keyword in outgoing text: ${hits.join(', ')}`);
+  if (/co-authored-by/i.test(String(text))) throw new AutofixAbort(stage, 'forbidden-command', 'co-author trailer in outgoing text');
+}
+
+/** One printable line, no '#', no newlines, bounded. */
+export function sanitizeTitle(title, max = 72) {
+  return String(title ?? '').replace(/[\u0000-\u001f\u007f]/g, ' ').replace(/#/g, '').replace(/\s+/g, ' ').trim().slice(0, max).trim();
+}
+
+export function assertVersion(stage, version) {
+  if (!VERSION_RE.test(String(version))) throw new AutofixAbort(stage, 'branch-exists', `not a plain X.Y.Z version: ${version}`);
+}
+export function assertIssue(stage, n) {
+  if (!Number.isInteger(n) || n <= 0) throw new AutofixAbort(stage, 'diff-policy', `bad issue number: ${n}`);
+}
+
+export const worktreesDir = (ctx) => ctx.worktrees || path.join(path.dirname(ctx.clone), 'issue-fix-worktrees');
+export const holdFilePath = (ctx) => ctx.holdFile
+  || path.join(process.env.HOME || os.homedir(), '.config', 'ruvnet-brain', 'release-hold');
+
+/** Next 05:17 UTC strictly after `ms` (the corpus nightly dispatch). */
+export function nextCorpusDispatch(ms) {
+  const d = new Date(ms);
+  let t = Date.UTC(d.getUTCFullYear(), d.getUTCMonth(), d.getUTCDate(), 5, 17, 0);
+  if (t <= ms) t += 24 * 3_600_000;
+  return t;
+}
+
+/** Poll `fn` until truthy or the limit passes. Bounded by attempts too, so a frozen fake clock cannot hang. */
+export async function poll(ctx, { limitMs, intervalMs, fn }) {
+  const end = ctx.now() + limitMs;
+  const attempts = Math.ceil(limitMs / intervalMs) + 2;
+  for (let i = 0; i < attempts; i += 1) {
+    const value = await fn();
+    if (value) return value;
+    if (ctx.now() >= end) break;
+    await ctx.sleep(intervalMs);
+  }
+  return null;
+}
+
+/** Parse `git diff -U0` output into the DiffFile[] shape judgeDiff/judgeGovernedVersionOnly consume. */
+export function parseUnifiedDiff(text) {
+  const files = [];
+  let cur = null;
+  let inHunk = false;
+  for (const line of String(text).split('\n')) {
+    if (line.startsWith('diff --git ')) {
+      const m = line.match(/^diff --git a\/(.+) b\/(.+)$/);
+      cur = { path: m ? m[2] : '', status: 'M', added: [], removed: [], binary: false, symlink: false };
+      files.push(cur); inHunk = false; continue;
+    }
+    if (!cur) continue;
+    if (line.startsWith('@@')) { inHunk = true; continue; }
+    if (!inHunk) {
+      if (line.startsWith('new file mode')) cur.status = 'A';
+      else if (line.startsWith('deleted file mode')) cur.status = 'D';
+      else if (line.startsWith('rename to ')) { cur.status = 'R'; cur.path = line.slice('rename to '.length); }
+      if (/^(new file mode|deleted file mode|new mode|old mode) 120000$/.test(line) || /^index [0-9a-f.]+ 120000$/.test(line)) cur.symlink = true;
+      if (line.startsWith('Binary files') || line === 'GIT binary patch') cur.binary = true;
+      continue;
+    }
+    if (line.startsWith('+')) cur.added.push(line.slice(1));
+    else if (line.startsWith('-')) cur.removed.push(line.slice(1));
+  }
+  return files;
+}
+
+// ---- shared remote-state queries (window facts, terminal check) ----
+
+export async function queryNpmLatest(ctx) {
+  const r = await run(ctx, 'npm', ['view', 'ruvnet-brain', 'dist-tags.latest']);
+  const v = String(r.stdout || '').trim();
+  return r.status === 0 && VERSION_RE.test(v) ? v : null;
+}
+export async function queryReleasesLatest(ctx) {
+  const j = await ghJson(ctx, ['release', 'view', '--repo', ctx.repo, '--json', 'tagName']);
+  return j.ok && j.value && typeof j.value.tagName === 'string' ? j.value.tagName : null;
+}
+export async function queryRemoteMain(ctx, dir = ctx.clone) {
+  const r = await git(ctx, dir, ['ls-remote', 'origin', 'refs/heads/main']);
+  const sha = String(r.stdout || '').trim().split(/\s+/)[0];
+  return r.status === 0 && SHA_RE.test(sha) ? sha : null;
+}
+export async function resolveRuntime(ctx, version, outFile) {
+  const r = await run(ctx, 'node', ['scripts/approved-runtime.mjs', '--resolve', '--repo', ctx.repo, '--tag', `v${version}`, '--out', outFile],
+    { cwd: ctx.clone });
+  return r.status === 0 && !r.timedOut;
+}

package/scripts/issue-autofix-release.mjs

@@ -0,0 +1,272 @@
+// Release path for the unattended issue autofix (ADR-107, batch A3): S6 release branch, census stamp,
+// the mechanical ADR-0103 review row, local gates, and (in issue-autofix-release-ship.mjs) S7-S12.
+// Follows CONTRIBUTING.md "Releasing code (step by step)". Every external command goes through ctx.exec.
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { AutofixAbort, nextPatchVersion, judgeGovernedVersionOnly } from './issue-autofix-policy.mjs';
+import { evaluateDoc } from '../plugin/scripts/doc-currency.mjs';
+import { GOVERNING_ADR, evaluateArchitectureReview } from './architecture-review-lock.mjs';
+import {
+  MIN, VERSION_RE, SHA_RE, tail, run, must, git, mustGit, mustGitAs, gitAs, ghJson, ghBin, assertCleanText,
+  assertVersion, assertIssue, worktreesDir, holdFilePath, nextCorpusDispatch, parseUnifiedDiff,
+  queryNpmLatest, queryReleasesLatest, resolveRuntime,
+} from './issue-autofix-release-util.mjs';
+
+export { shipRelease, verifyTerminal } from './issue-autofix-release-ship.mjs';
+export { parseUnifiedDiff } from './issue-autofix-release-util.mjs';
+
+// release:prepush (CONTRIBUTING "before the first push", 4.7.23) runs first: it catches a stale census against the
+// newest corpus generation, a stale ADR-0103 digest, stray artifacts and anchored text tests in seconds.
+export const LOCAL_GATES = Object.freeze([
+  ['release-prepush', 'npm', ['run', 'release:prepush', '--', '--receipt', '<RUN>/prepush-<TS>.json']],
+  ['release-qualify-source', 'npm', ['run', 'release:qualify', '--', '--suite', 'source', '--report', '<RUN>/source-<TS>.json']],
+  ['release-qualify-integration', 'npm', ['run', 'release:qualify', '--', '--suite', 'integration', '--report', '<RUN>/integration-<TS>.json']],
+  ['npm-test', 'npm', ['test']],
+  ['single-source', 'npm', ['run', 'single-source:check']],
+  ['release-syntax', 'node', ['--check', 'scripts/release.mjs']],
+  ['version-check', 'npm', ['run', 'version:check']],
+  ['release-authority', 'npm', ['run', 'release:authority']],
+  ['architecture-review-lock', 'node', ['scripts/architecture-review-lock.mjs']],
+  ['doc-currency', 'npm', ['run', 'doc:currency']],
+]);
+const GATED_WORKFLOWS = ['protected-release.yml', 'release-candidate-preflight.yml', 'corpus-nightly-dispatch.yml'];
+const GATE_TIMEOUT_MS = { 'release-qualify-integration': 120 * MIN, 'release-qualify-source': 60 * MIN, 'npm-test': 60 * MIN };
+const MANIFEST = 'plugin/.claude-plugin/plugin.json';
+
+async function mainVersion(ctx, stage) {
+  const r = await mustGit(ctx, stage, 'main-moved', ctx.clone, ['show', `origin/main:${MANIFEST}`]);
+  try { return JSON.parse(r.stdout).version; } catch { throw new AutofixAbort(stage, 'main-moved', 'origin/main manifest unreadable'); }
+}
+
+export async function gatherWindowFacts(ctx) {
+  const facts = { openReleaseBlockers: [], activeRuns: [], remoteReleaseBranches: [], openReleasePrs: [], holdFile: false,
+    mainVersion: '', mainSha: '', npmLatest: null, releasesLatestTag: null, mainVersionInstallVerified: false,
+    nextCorpusDispatchAt: nextCorpusDispatch(ctx.now()) };
+  const issues = await ghJson(ctx, ['issue', 'list', '--repo', ctx.repo, '--state', 'open', '--label', 'release-blocker', '--json', 'number', '--limit', '100']);
+  if (!issues.ok) throw new AutofixAbort('S0', 'window-closed', 'cannot list release-blocker issues');
+  facts.openReleaseBlockers = issues.value.map((i) => i.number);
+  for (const wf of GATED_WORKFLOWS) {
+    for (const status of ['queued', 'in_progress']) {
+      const j = await ghJson(ctx, ['run', 'list', '--repo', ctx.repo, '--workflow', wf, '--status', status, '--json', 'databaseId,status', '--limit', '20']);
+      if (!j.ok) throw new AutofixAbort('S0', 'window-closed', `cannot list ${status} runs of ${wf}`);
+      for (const x of j.value) facts.activeRuns.push({ workflow: wf, status: x.status || status, id: x.databaseId });
+    }
+  }
+  await mustGit(ctx, 'S0', 'window-closed', ctx.clone, ['fetch', 'origin', 'main']);
+  const heads = await mustGit(ctx, 'S0', 'window-closed', ctx.clone, ['ls-remote', '--heads', 'origin', 'refs/heads/release/*']);
+  for (const line of heads.stdout.split('\n').filter(Boolean)) {
+    const name = line.split(/\s+/)[1]?.replace(/^refs\/heads\//, '') || '';
+    // release/4.5.15-stop is a 4.5.15 work branch: its leading version decides whether it is ahead of main.
+    const m = name.replace(/^release\//, '').match(/^(\d+\.\d+\.\d+)(?:[-_.+][\w.-]*)?$/);
+    facts.remoteReleaseBranches.push({ name, version: m ? m[1] : '' });
+  }
+  const prs = await ghJson(ctx, ['pr', 'list', '--repo', ctx.repo, '--state', 'open', '--json', 'number,headRefName', '--limit', '100']);
+  if (!prs.ok) throw new AutofixAbort('S0', 'window-closed', 'cannot list open pull requests');
+  const releasePrs = prs.value.filter((p) => String(p.headRefName).startsWith('release/'));
+  facts.openReleasePrs = releasePrs.map((p) => p.number);
+  facts.openReleasePrHeads = Object.fromEntries(releasePrs.map((p) => [p.number, p.headRefName]));
+  facts.holdFile = fs.existsSync(holdFilePath(ctx));
+  facts.mainVersion = await mainVersion(ctx, 'S0');
+  facts.mainSha = (await mustGit(ctx, 'S0', 'window-closed', ctx.clone, ['rev-parse', 'origin/main'])).stdout.trim();
+  facts.npmLatest = await queryNpmLatest(ctx);
+  facts.releasesLatestTag = await queryReleasesLatest(ctx);
+  facts.mainVersionInstallVerified = await resolveRuntime(ctx, facts.mainVersion, path.join(ctx.runDir || '.', `window-runtime-${facts.mainVersion}.json`));
+  return facts;
+}
+
+// The message names only the issue number: a stranger's title never enters git history (no @mentions, links or
+// injection text in commits that ship), and no closing keyword can auto-close anything.
+export async function commitFix(ctx, { wt, issueNumber }) {
+  assertIssue('S6', issueNumber);
+  const subject = `autofix: issue ${issueNumber}`;
+  const body = `Refs issue ${issueNumber} (ADR-107 autofix).`;
+  assertCleanText('S6', `${subject}\n${body}`);
+  await mustGit(ctx, 'S6', 'diff-policy', wt, ['add', '-A']);
+  const staged = await git(ctx, wt, ['diff', '--cached', '--quiet']);
+  if (staged.status === 0) throw new AutofixAbort('S6', 'diff-policy', 'nothing to commit in the fix worktree');
+  await mustGitAs(ctx, 'S6', 'diff-policy', wt, ['commit', '-m', subject, '-m', body]);
+  const fixSha = (await mustGit(ctx, 'S6', 'diff-policy', wt, ['rev-parse', 'HEAD'])).stdout.trim();
+  return { fixSha };
+}
+
+/**
+ * S6: one release branch for the night. Version commit first, then every ready fix cherry-picked in issue order; a fix
+ * that does not apply cleanly on top of the others is dropped (and reported), never hand-merged. Returns the version
+ * commit (fixBase) and the last fix commit (fixHead) so the batch gate can scan exactly the model-written code.
+ */
+export async function prepareReleaseBranch(ctx, { version, fixes }) {
+  assertVersion('S6', version);
+  if (!Array.isArray(fixes) || !fixes.length) throw new AutofixAbort('S6', 'diff-policy', 'no fixes to release');
+  for (const f of fixes) {
+    assertIssue('S6', f.issueNumber);
+    if (!SHA_RE.test(String(f.fixSha))) throw new AutofixAbort('S6', 'diff-policy', `not a commit sha: ${f.fixSha}`);
+  }
+  const branch = `release/${version}`;
+  await mustGit(ctx, 'S6', 'main-moved', ctx.clone, ['fetch', 'origin', 'main']);
+  const current = await mainVersion(ctx, 'S6');
+  if (nextPatchVersion(current) !== version) {
+    throw new AutofixAbort('S6', 'main-moved', `origin/main is ${current}; the next patch is ${nextPatchVersion(current)}, not ${version}`);
+  }
+  const remote = await git(ctx, ctx.clone, ['ls-remote', '--heads', 'origin', `refs/heads/${branch}`]);
+  if (remote.status !== 0) throw new AutofixAbort('S6', 'branch-exists', `cannot tell whether ${branch} exists on the remote`);
+  if (remote.stdout.trim()) throw new AutofixAbort('S6', 'branch-exists', `${branch} already exists on the remote`);
+  const local = await git(ctx, ctx.clone, ['rev-parse', '--verify', '--quiet', `refs/heads/${branch}`]);
+  if (local.status === 0) throw new AutofixAbort('S6', 'branch-exists', `${branch} already exists locally`);
+
+  const rwt = path.join(worktreesDir(ctx), `release-${version}`);
+  fs.mkdirSync(path.dirname(rwt), { recursive: true });
+  await mustGit(ctx, 'S6', 'branch-exists', ctx.clone, ['worktree', 'add', '-b', branch, rwt, 'origin/main']);
+  await must(ctx, 'S6', 'gate-failed', 'npm', ['ci', '--no-audit', '--no-fund'], { cwd: rwt });
+  await must(ctx, 'S6', 'gate-failed', 'npm', ['run', 'version:set', '--', version], { cwd: rwt });
+  await must(ctx, 'S6', 'gate-failed', 'npm', ['run', 'convergence:write'], { cwd: rwt });
+  const issues = fixes.map((f) => f.issueNumber);
+  const msg = `chore(release): ${version} (autofix, issues ${issues.join(', ')})`;
+  assertCleanText('S6', msg);
+  await mustGit(ctx, 'S6', 'gate-failed', rwt, ['add', '-A']);
+  await mustGitAs(ctx, 'S6', 'gate-failed', rwt, ['commit', '-m', msg]);
+  const fixBase = (await mustGit(ctx, 'S6', 'gate-failed', rwt, ['rev-parse', 'HEAD'])).stdout.trim();
+  const applied = []; const dropped = [];
+  for (const f of fixes) {
+    const pick = await gitAs(ctx, rwt, ['cherry-pick', f.fixSha]);
+    if (pick.status === 0) { applied.push(f.issueNumber); continue; }
+    await git(ctx, rwt, ['cherry-pick', '--abort']);
+    dropped.push({ issueNumber: f.issueNumber, reason: `does not apply on top of the other fixes: ${tail(pick.stderr, 200)}` });
+  }
+  if (!applied.length) throw new AutofixAbort('S6', 'gate-failed', 'no fix applied cleanly to the release branch');
+  const fixHead = (await mustGit(ctx, 'S6', 'gate-failed', rwt, ['rev-parse', 'HEAD'])).stdout.trim();
+  const log = await mustGit(ctx, 'S6', 'gate-failed', rwt, ['rev-list', '--reverse', 'origin/main..HEAD']);
+  return { branch, rwt, fixBase, fixHead, applied, dropped, commits: log.stdout.split('\n').filter(Boolean) };
+}
+
+const sha256File = (file) => crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
+function findAssetDirs(root) {
+  const dirs = new Set();
+  const walk = (d) => {
+    for (const e of fs.readdirSync(d, { withFileTypes: true })) {
+      const p = path.join(d, e.name);
+      if (e.isDirectory()) { if (e.name !== '__MACOSX') walk(p); }
+      else if (e.name.endsWith('.big.rvf') && !e.name.startsWith('._')) dirs.add(d);
+    }
+  };
+  walk(root);
+  return [...dirs];
+}
+
+/** Census stamp, assembled exactly as ci.yml release-qe does (CONTRIBUTING rule 1). */
+export async function stampCensus(ctx, { rwt }) {
+  const work = path.join(ctx.runDir || path.dirname(rwt), `census-${ctx.now()}`);
+  const evidence = path.join(work, 'release-evidence');
+  const seedDir = path.join(work, 'release-seed');
+  const extracted = path.join(seedDir, 'extracted');
+  fs.mkdirSync(evidence, { recursive: true });
+  fs.mkdirSync(extracted, { recursive: true });
+  const descriptor = path.join(evidence, 'corpus-seed.json');
+  const opts = { cwd: rwt, timeoutMs: 30 * MIN };
+  await must(ctx, 'S6', 'gate-failed', 'node', ['scripts/corpus-next-seed.mjs', '--repo', ctx.repo, '--require-coverage', '--out', descriptor], opts);
+  const d = JSON.parse(fs.readFileSync(descriptor, 'utf8'));
+  const patterns = ['--pattern', d.asset];
+  const cov = d.origin === 'published-generation';
+  if (cov) patterns.push('--pattern', 'CORPUS-COVERAGE.json', '--pattern', 'coverage-receipt.json', '--pattern', `${d.asset}.recall.json`);
+  await must(ctx, 'S6', 'gate-failed', ghBin(ctx), ['release', 'download', d.tag, '--repo', ctx.repo, ...patterns, '--dir', seedDir], opts);
+  const seed = path.join(seedDir, d.asset);
+  if (sha256File(seed) !== d.sha256 || fs.statSync(seed).size !== Number(d.bytes)) {
+    throw new AutofixAbort('S6', 'gate-failed', 'the downloaded corpus seed does not match its descriptor');
+  }
+  await must(ctx, 'S6', 'gate-failed', 'unzip', ['-q', seed, '-d', extracted], opts);
+  const assetDirs = findAssetDirs(extracted);
+  if (assetDirs.length !== 1) throw new AutofixAbort('S6', 'gate-failed', `expected one asset directory in the seed, found ${assetDirs.length}`);
+  const covArgs = cov ? ['--coverage', path.join(seedDir, 'CORPUS-COVERAGE.json'), '--coverage-receipt', path.join(seedDir, 'coverage-receipt.json')] : [];
+  await must(ctx, 'S6', 'gate-failed', 'node', ['scripts/code-release-corpus.mjs', 'assemble', '--descriptor', descriptor, '--seed-bundle', seed,
+    '--assets', assetDirs[0], '--evidence-dir', evidence, ...covArgs], opts);
+  await must(ctx, 'S6', 'gate-failed', 'node', ['scripts/sync-census.mjs'],
+    { ...opts, env: { ...process.env, RUVNET_BRAIN_KB: path.join(rwt, 'dist', 'ruvnet-brain') } });
+  const changed = (await mustGit(ctx, 'S6', 'gate-failed', rwt, ['diff', '--name-only'])).stdout.split('\n').filter(Boolean);
+  if (!changed.length) return { changed: false, files: [] };
+  const version = JSON.parse(fs.readFileSync(path.join(rwt, MANIFEST), 'utf8')).version;
+  await mustGit(ctx, 'S6', 'gate-failed', rwt, ['add', '--', ...changed]);
+  await mustGitAs(ctx, 'S6', 'gate-failed', rwt, ['commit', '-m', `chore(release): stamp the census for ${version} (autofix)`]);
+  return { changed: true, files: changed };
+}
+
+function writeReview(rwt, { digest, version, issues, date, contractTouched, anchor }) {
+  const file = path.join(rwt, GOVERNING_ADR);
+  const lines = fs.readFileSync(file, 'utf8').split('\n');
+  const fmEnd = lines.indexOf('---', 1);
+  const fi = lines.findIndex((l, i) => i > 0 && i < fmEnd && l.startsWith('reviewed_digest:'));
+  if (fi >= 0) lines[fi] = `reviewed_digest: ${digest}`;
+  else lines.splice(fmEnd, 0, `reviewed_digest: ${digest}`);
+  const ui = lines.findIndex((l, i) => i > 0 && i < fmEnd + 1 && l.startsWith('updated:'));
+  if (ui >= 0) lines[ui] = `updated: ${date}`;
+  const extra = contractTouched ? ' and append-only inventory lines in `scripts/release-qualification-contract.mjs`' : '';
+  const row = `| ${date} | Review \`${digest}\` (${version}, autofix issues ${issues.join(', ')}, mechanical): the only governed bytes that moved since origin/main are the version fields of \`package.json\` and \`package-lock.json\`${extra}, proven by a diff of origin/main against this branch before the row was written; no routing behavior is added. | Written by scripts/issue-autofix-release.mjs under ADR-107 (the digest covers the governed path \`${anchor}\`); a mechanical stamp, not a person reading the code. |`;
+  const h = lines.findIndex((l) => /^##\s+currency log\b/i.test(l));
+  if (h < 0) throw new AutofixAbort('S6', 'governed-change-not-mechanical', 'ADR-0103 has no Currency log section');
+  let at = lines.findIndex((l, i) => i > h && /^\|\s*\d{4}-\d{2}-\d{2}\s*\|/.test(l));
+  if (at < 0) at = h + 1;
+  lines.splice(at, 0, row);
+  fs.writeFileSync(file, lines.join('\n'));
+}
+
+/** Mechanical ADR-0103 review row; refuses (governed-change-not-mechanical) unless the governed diff is version lines only. */
+export async function stamp0103Review(ctx, { rwt, version, issues, date }) {
+  if (!Array.isArray(issues) || !issues.length) throw new AutofixAbort('S6', 'governed-change-not-mechanical', 'no issues named');
+  for (const n of issues) assertIssue('S6', n);
+  const evaluate = ctx.evaluateDoc || evaluateDoc;
+  const doc = evaluate(rwt, GOVERNING_ADR, { checkWiring: false });
+  const governed = new Set((doc.governed || []).filter((g) => g.resolved).map((g) => g.path));
+  const diff = await mustGit(ctx, 'S6', 'governed-change-not-mechanical', rwt, ['diff', '-U0', '--no-color', '--no-ext-diff', 'origin/main', 'HEAD']);
+  const touched = parseUnifiedDiff(diff.stdout).filter((f) => governed.has(f.path));
+  const verdict = judgeGovernedVersionOnly(touched);
+  if (!verdict.mechanical) {
+    throw new AutofixAbort('S6', 'governed-change-not-mechanical', verdict.reason || 'governed bytes changed beyond version lines');
+  }
+  if (doc.review?.current === true) return { digest: doc.review.computed, rowAdded: false };
+  const digest = doc.review?.computed;
+  if (!digest) throw new AutofixAbort('S6', 'governed-change-not-mechanical', 'no review digest can be computed for ADR-0103');
+  // doc-currency only counts a path referent that has a directory part, so anchor the row on a governed path that does.
+  const anchor = ['scripts/release-qualification-contract.mjs', ...governed].find((p) => p.includes('/') && governed.has(p));
+  if (!anchor) throw new AutofixAbort('S6', 'gate-failed', 'ADR-0103 governs no path with a directory part to anchor the review row on');
+  writeReview(rwt, { digest, version, issues, date, anchor, contractTouched: touched.some((f) => f.path === 'scripts/release-qualification-contract.mjs') });
+  const after = (ctx.evaluateReview || evaluateArchitectureReview)(rwt);
+  if (!after.pass) throw new AutofixAbort('S6', 'gate-failed', `ADR-0103 review is still not current after the row: ${JSON.stringify(after.findings).slice(0, 1500)}`);
+  await mustGit(ctx, 'S6', 'gate-failed', rwt, ['add', '--', GOVERNING_ADR]);
+  await mustGitAs(ctx, 'S6', 'gate-failed', rwt, ['commit', '-m', `chore(release): ADR-0103 mechanical review row for ${version}`]);
+  return { digest, rowAdded: true };
+}
+
+const blocksOf = (stdout) => {
+  try { return new Set(JSON.parse(stdout).docs.flatMap((d) => (d.findings || []).filter((f) => f.level === 'block').map((f) => `${d.file}:${f.code}`))); }
+  catch { return null; }
+};
+/** doc:currency passes when the candidate adds no BLOCK that origin/main did not already have. */
+async function noNewDocBlocks(ctx, rwt) {
+  const mine = blocksOf((await run(ctx, 'node', ['scripts/doc-currency.mjs', '--json'], { cwd: rwt })).stdout);
+  const basePath = `${rwt}-base`;
+  await mustGit(ctx, 'S6', 'gate-failed', ctx.clone, ['worktree', 'add', '--detach', basePath, 'origin/main']);
+  const base = blocksOf((await run(ctx, 'node', ['scripts/doc-currency.mjs', '--json'], { cwd: basePath })).stdout);
+  if (!mine || !base) return false;
+  return [...mine].every((k) => base.has(k));
+}
+
+export async function runLocalGates(ctx, { rwt }) {
+  const ts = String(ctx.now());
+  const gates = [];
+  for (const [name, cmd, tmpl] of LOCAL_GATES) {
+    await ctx.checkpoint(`gate:${name}`);
+    const args = tmpl.map((a) => a.replace('<RUN>', ctx.runDir || rwt).replace('<TS>', ts));
+    const started = ctx.now();
+    let exitCode; let output;
+    if (ctx.gates?.[name]) {
+      ({ exitCode, output } = await ctx.gates[name](rwt));
+    } else {
+      const r = await run(ctx, cmd, args, { cwd: rwt, timeoutMs: GATE_TIMEOUT_MS[name] || 30 * MIN });
+      exitCode = r.timedOut ? 124 : r.status;
+      output = `${r.stdout || ''}${r.stderr || ''}`;
+      if (exitCode !== 0 && name === 'doc-currency' && await noNewDocBlocks(ctx, rwt)) exitCode = 0;
+    }
+    gates.push({ name, exitCode, durationMs: ctx.now() - started, outputTail: tail(output) });
+    if (exitCode !== 0) return { ok: false, gates };
+  }
+  return { ok: true, gates };
+}