toolroll 0.9.79 → 0.9.81

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## 0.9.81 — 2026-10-30
+
+- **The release proof works after the merge.** GitHub empties a CI run's
+  pull-request link once the pull request merges and its branch is deleted,
+  so 0.9.80's tag could never prove its checks and wasn't published. A run
+  with no link now stands only when its branch has had exactly one pull
+  request, ever, and that pull request merged into main. 0.9.80's changes
+  ship in this release.
+
+## 0.9.80 — 2026-10-30
+
+- **Each test runs once, where it adds something** (docs/plans/test-matrix.md).
+  Pull requests run the unit suite on Node 24 (Linux and macOS) and every
+  area lane (Windows, Linux fence and cgroup, git 2.41 and 2.47); a pull
+  request that only changes Markdown under `docs/`, the changelog or the
+  README skips the area lanes. Node 22 runs on Linux and macOS once per
+  release, on the `release-*` branch's pull request, in the new
+  Release candidate workflow. Release tags no longer rerun the macOS suites:
+  a release proof reads GitHub's record that the tagged tree passed every
+  required check on its pull request before npm publication. A push to main
+  typechecks and builds, and runs the full CI only when it can't prove the
+  merge commit was tested. The nightly runs everything. A release now needs
+  every required check executed, never skipped, and refuses to merge while
+  main's branch protection doesn't require all of them. Hosted unit shards
+  require their platform's native fence attacks to run.
+
 ## 0.9.79 — 2026-10-29
 
 - **`toolroll release` rides out a short network failure instead of

package/dist/guides.js

@@ -473,20 +473,23 @@ with a time limit.
    saved first; if either name doesn't answer as the new build, both go
    back. It goes on only when the console, worker and both names run the
    gated commit. A rerun relinks without deploying again.
-8. **ci**: waits for every pull-request check on the gated commit:
-   Ubuntu on Node 22 and 24, Linux and Windows containment. Pending,
-   missing, skipped, cancelled or failed never merges.
+8. **ci**: waits for every pull-request check on the gated commit: Node 24
+   on Ubuntu and macOS, the area lanes (Linux cgroup and fence, Windows,
+   git 2.41 and 2.47), and Node 22 on Ubuntu and macOS, which runs on a
+   release-* branch's pull request.
+   Pending, missing, skipped, cancelled or failed never merges, and main's
+   protection must require every one of them.
 9. **merge**: squash-merges with the head pinned to the gated commit,
    once main has nothing the branch lacks, then deletes the remote branch
    only if its head still matches. A resumed merge also finishes this cleanup.
 10. **tree**: main's merge commit must have exactly the gated tree, or
    nothing is tagged.
-11. **tag**: pushes \`v<version>\` on that merge commit. In publish.yml,
-    macOS Node 22 and 24 must both pass before npm and GitHub publication
-    (the candidate's macOS checks already passed in ci.yml before the merge).
-    macos.yml keeps the nightly matrix.
-12. **publish**: waits for npm, the GitHub release and the tag's publish
-    job (which needs the macOS legs); not main's own CI on the merge commit.
+11. **tag**: pushes \`v<version>\` on that merge commit. The tag runs no
+    tests again: publish.yml's release proof reads GitHub's record that the
+    tagged tree is the merged pull request's head tree and passed every
+    required check there, and npm and GitHub publication need it.
+12. **publish**: waits for npm, the GitHub release and the tag's release
+    proof and publish jobs; not main's own push run on the merge commit.
 13. **homebrew**: the release is published once npm and the GitHub release
     are verified. It proposes the tap's formula change (checksum from npm's
     tarball) and looks at its checks once: \`Published; Homebrew pending\`

package/dist/release-adapters.js

@@ -1290,7 +1290,7 @@ export async function readMainProtection(run, gh, repo, branch = "main") {
         else {
             const lacking = PROTECTION_MINIMUM_CHECKS.filter(name => !checks.includes(name));
             if (lacking.length > 0)
-                own.push(`${where}: required checks lack ${lacking.join(", ")}`);
+                own.push(`${where}: required checks lack ${lacking.join(", ")} (add ${lacking.length === 1 ? "it" : "them"} to main's required status checks: a release's proof trusts what main required)`);
             const unbound = PROTECTION_MINIMUM_CHECKS.filter(name => checks.includes(name) && !bound.includes(name));
             if (unbound.length > 0)
                 own.push(`${where}: required checks must require GitHub Actions (app 15368) as their source: ${unbound.join(", ")}`);

package/dist/release-auto.d.ts

@@ -19,7 +19,7 @@ export type ObservedCheckRun = {
     suite?: number | null;
     head?: string | null;
     workflow?: number | null;
-    /** The workflow's file (GitHub's workflow-run `path`): a required check counts only from ci.yml. */
+    /** The workflow's file (GitHub's workflow-run `path`): a required check counts only from its own (REQUIRED_PR_CHECKS_WORKFLOW). */
     workflowPath?: string | null;
     /** GitHub's job record shows this unsuccessful attempt ended before any workflow step ran (release-adapters.ts). */
     beforeTests?: boolean | null;

package/dist/release.d.ts

@@ -32,16 +32,18 @@
  * Everything outside this module is an adapter (release-adapters.ts), so the state machine is tested without git,
  * GitHub, npm or a running Toolroll.
  */
-/** The pull-request checks a release waits for, by exact job name (.github/workflows/ci.yml). Every one must have
- * concluded `success` on the gated commit; src/ci-workflow.test.ts holds the workflow to this list. */
-export declare const REQUIRED_PR_CHECKS: readonly ["node 22 · ubuntu-latest", "node 24 · ubuntu-latest", "linux native containment · delegated cgroup v2", "linux fence · sandbox-runtime", "Windows Job Object containment", "git 2.41 · debian trixie", "git 2.47 · debian trixie", "node 22 · macos-latest", "node 24 · macos-latest"];
-/** The workflow file every REQUIRED_PR_CHECKS job belongs to: a job of that name from any other workflow (a lookalike
+/** The pull-request checks a release waits for, by exact job name (docs/plans/test-matrix.md). Every one must have
+ * concluded `success` — executed, never skipped — on the gated commit; src/ci-workflow.test.ts holds the workflows to
+ * this list, and publish.yml's release proof to the same list. */
+export declare const REQUIRED_PR_CHECKS: readonly ["node 24 · ubuntu-latest", "linux native containment · delegated cgroup v2", "linux fence · sandbox-runtime", "Windows Job Object containment", "git 2.41 · debian trixie", "git 2.47 · debian trixie", "node 24 · macos-latest", "node 22 · ubuntu-latest", "node 22 · macos-latest"];
+/** The workflow file each REQUIRED_PR_CHECKS job belongs to: a job of that name from any other workflow (a lookalike
  * added beside it) never stands for it (Codex review round 1, inherited CI limitation). */
-export declare const REQUIRED_PR_CHECKS_WORKFLOW = ".github/workflows/ci.yml";
+export declare const REQUIRED_PR_CHECKS_WORKFLOW: Readonly<Record<typeof REQUIRED_PR_CHECKS[number], string>>;
 /**
- * The pull-request checks main's GitHub protection is not yet required to name (eval-harness review 2, finding 1): the
- * git lanes join main's protection once they have run there, so a protection without them is reported, never refused.
- * A later release empties this list; from then on main's protection must name every REQUIRED_PR_CHECKS check.
+ * The pull-request checks main's GitHub protection is not yet required to name (eval-harness review 2, finding 1).
+ * Empty since the test matrix (docs/plans/test-matrix.md): publication's release proof trusts what main's protection
+ * required at the merge, so main's protection must name every REQUIRED_PR_CHECKS check, and a release refuses to merge
+ * (and so to publish) until it does.
  */
 export declare const PROTECTION_REPORT_ONLY_CHECKS: readonly string[];
 /** The checks main's protection must require at minimum: every required check that isn't report-only. */
@@ -57,10 +59,11 @@ export type MainProtection = {
     missing: string[];
     notYetRequired: string[];
 };
-/** The checks a release's publication waits for on its tag (.github/workflows/publish.yml, pipeline-speed.md item 3):
- * the publish job and the macOS legs it needs, each named. Nothing else reported on the merge commit (main's own CI push
- * run) holds publication. */
-export declare const RELEASE_TAG_CHECKS: readonly ["publish", "tag macOS · node 22", "tag macOS · node 24"];
+/** The checks a release's publication waits for on its tag (.github/workflows/publish.yml, docs/plans/test-matrix.md):
+ * the release proof (the tagged tree passed every REQUIRED_PR_CHECKS check on its pull request, read from GitHub) and
+ * the publish job that needs it. The tag runs no tests again. Nothing else reported on the merge commit (main-push.yml)
+ * holds publication. */
+export declare const RELEASE_TAG_CHECKS: readonly ["release proof", "publish"];
 export declare const RELEASE_TAG_WORKFLOW = ".github/workflows/publish.yml";
 export declare const RELEASE_STEPS: readonly ["gate", "approval", "check", "complete", "quiet", "deploy", "link", "ci", "merge", "tree", "tag", "publish", "homebrew", "done"];
 export type ReleaseStep = typeof RELEASE_STEPS[number];
@@ -662,10 +665,10 @@ export declare function checksVerdict(runs: readonly CheckRun[], required: reado
     failed: string[];
 };
 /**
- * Publication's verdict on the tag commit (pipeline-speed.md, item 3): only RELEASE_TAG_CHECKS, from GitHub Actions
- * runs of publish.yml bound to the tag's push, each by its newest attempt. Every other check on the merge commit — main's
- * own CI run — is not waited for: the candidate's checks already passed on its exact head before the merge, and the
- * merged tree was proved equal to it.
+ * Publication's verdict on the tag commit (test-matrix.md): only RELEASE_TAG_CHECKS, from GitHub Actions runs of
+ * publish.yml bound to the tag's push, each by its newest attempt. Every other check on the merge commit — main's own
+ * push run — is not waited for: the candidate's checks already passed on its exact head before the merge, the merged
+ * tree was proved equal to it, and publish.yml's release proof checks both again from GitHub's record.
  */
 export declare function tagChecksVerdict(runs: readonly CheckRun[]): ReturnType<typeof checksVerdict>;
 /** Run the release from wherever its journal stopped. */
@@ -686,7 +689,7 @@ export declare function transientNetworkError(error: unknown): boolean;
  */
 export declare function prChecksVerdict(runs: readonly CheckRun[], head: string, required: readonly string[], options?: {
     auto?: true;
-    workflow?: string;
+    workflow?: string | Readonly<Record<string, string>>;
 }): {
     state: "passed";
     failures: CheckFailure[];

package/dist/release.js

@@ -38,37 +38,54 @@ import { dirname, join } from "node:path";
 import { personProof } from "./person-proof.js";
 import { RELEASE_CI_RUNNING_WORDS as CI_RUNNING_WORDS } from "./release-ci-hold.js";
 import { transientFailure } from "./release-net.js";
-/** The pull-request checks a release waits for, by exact job name (.github/workflows/ci.yml). Every one must have
- * concluded `success` on the gated commit; src/ci-workflow.test.ts holds the workflow to this list. */
+/** The pull-request checks a release waits for, by exact job name (docs/plans/test-matrix.md). Every one must have
+ * concluded `success` — executed, never skipped — on the gated commit; src/ci-workflow.test.ts holds the workflows to
+ * this list, and publish.yml's release proof to the same list. */
 export const REQUIRED_PR_CHECKS = [
-    "node 22 · ubuntu-latest",
+    // The unit suite on Node 24 (ci.yml "test-shard" and "test"), on every pull request.
     "node 24 · ubuntu-latest",
+    // The area lanes (ci.yml), on every pull request except a documentation-only one (scripts/ci-scope.mjs), where they
+    // are skipped; a release's pull request runs them.
     "linux native containment · delegated cgroup v2",
     "linux fence · sandbox-runtime",
     "Windows Job Object containment",
     // The git lanes (ci.yml job "git"): the declared floor (git-floor.ts) and Debian trixie's 2.47.
     "git 2.41 · debian trixie",
     "git 2.47 · debian trixie",
-    // The unit suite on macOS (ci.yml jobs "macos-shard" and "macos"; pipeline-speed.md, item 3a): tested on the candidate
-    // before it merges, no longer only on the tag after.
-    "node 22 · macos-latest",
+    // The unit suite on macOS (ci.yml jobs "macos-shard" and "macos"; pipeline-speed.md, item 3a), Node 24.
     "node 24 · macos-latest",
+    // Node 22, the engines floor, on Linux and macOS (release-candidate.yml): on a release-* branch's pull request,
+    // skipped on every other pull request.
+    "node 22 · ubuntu-latest",
+    "node 22 · macos-latest",
 ];
-/** The workflow file every REQUIRED_PR_CHECKS job belongs to: a job of that name from any other workflow (a lookalike
+/** The workflow file each REQUIRED_PR_CHECKS job belongs to: a job of that name from any other workflow (a lookalike
  * added beside it) never stands for it (Codex review round 1, inherited CI limitation). */
-export const REQUIRED_PR_CHECKS_WORKFLOW = ".github/workflows/ci.yml";
+export const REQUIRED_PR_CHECKS_WORKFLOW = {
+    "node 24 · ubuntu-latest": ".github/workflows/ci.yml",
+    "linux native containment · delegated cgroup v2": ".github/workflows/ci.yml",
+    "linux fence · sandbox-runtime": ".github/workflows/ci.yml",
+    "Windows Job Object containment": ".github/workflows/ci.yml",
+    "git 2.41 · debian trixie": ".github/workflows/ci.yml",
+    "git 2.47 · debian trixie": ".github/workflows/ci.yml",
+    "node 24 · macos-latest": ".github/workflows/ci.yml",
+    "node 22 · ubuntu-latest": ".github/workflows/release-candidate.yml",
+    "node 22 · macos-latest": ".github/workflows/release-candidate.yml",
+};
 /**
- * The pull-request checks main's GitHub protection is not yet required to name (eval-harness review 2, finding 1): the
- * git lanes join main's protection once they have run there, so a protection without them is reported, never refused.
- * A later release empties this list; from then on main's protection must name every REQUIRED_PR_CHECKS check.
+ * The pull-request checks main's GitHub protection is not yet required to name (eval-harness review 2, finding 1).
+ * Empty since the test matrix (docs/plans/test-matrix.md): publication's release proof trusts what main's protection
+ * required at the merge, so main's protection must name every REQUIRED_PR_CHECKS check, and a release refuses to merge
+ * (and so to publish) until it does.
  */
-export const PROTECTION_REPORT_ONLY_CHECKS = ["git 2.41 · debian trixie", "git 2.47 · debian trixie", "node 22 · macos-latest", "node 24 · macos-latest"];
+export const PROTECTION_REPORT_ONLY_CHECKS = [];
 /** The checks main's protection must require at minimum: every required check that isn't report-only. */
 export const PROTECTION_MINIMUM_CHECKS = REQUIRED_PR_CHECKS.filter(name => !PROTECTION_REPORT_ONLY_CHECKS.includes(name));
-/** The checks a release's publication waits for on its tag (.github/workflows/publish.yml, pipeline-speed.md item 3):
- * the publish job and the macOS legs it needs, each named. Nothing else reported on the merge commit (main's own CI push
- * run) holds publication. */
-export const RELEASE_TAG_CHECKS = ["publish", "tag macOS · node 22", "tag macOS · node 24"];
+/** The checks a release's publication waits for on its tag (.github/workflows/publish.yml, docs/plans/test-matrix.md):
+ * the release proof (the tagged tree passed every REQUIRED_PR_CHECKS check on its pull request, read from GitHub) and
+ * the publish job that needs it. The tag runs no tests again. Nothing else reported on the merge commit (main-push.yml)
+ * holds publication. */
+export const RELEASE_TAG_CHECKS = ["release proof", "publish"];
 export const RELEASE_TAG_WORKFLOW = ".github/workflows/publish.yml";
 export const RELEASE_STEPS = ["gate", "approval", "check", "complete", "quiet", "deploy", "link", "ci", "merge", "tree", "tag", "publish", "homebrew", "done"];
 /** How long each waiting step may take, in minutes, before the release stops there (rerunning continues from it). */
@@ -192,10 +209,10 @@ export function checksVerdict(runs, required) {
     return waiting.length > 0 ? { state: "pending", waiting } : { state: "passed" };
 }
 /**
- * Publication's verdict on the tag commit (pipeline-speed.md, item 3): only RELEASE_TAG_CHECKS, from GitHub Actions
- * runs of publish.yml bound to the tag's push, each by its newest attempt. Every other check on the merge commit — main's
- * own CI run — is not waited for: the candidate's checks already passed on its exact head before the merge, and the
- * merged tree was proved equal to it.
+ * Publication's verdict on the tag commit (test-matrix.md): only RELEASE_TAG_CHECKS, from GitHub Actions runs of
+ * publish.yml bound to the tag's push, each by its newest attempt. Every other check on the merge commit — main's own
+ * push run — is not waited for: the candidate's checks already passed on its exact head before the merge, the merged
+ * tree was proved equal to it, and publish.yml's release proof checks both again from GitHub's record.
  */
 export function tagChecksVerdict(runs) {
     const names = RELEASE_TAG_CHECKS;
@@ -1422,9 +1439,12 @@ export function prChecksVerdict(runs, head, required, options = {}) {
         }
         // A required name counts only from the workflow that defines it: a job of the same name in another workflow (or
         // one whose workflow GitHub doesn't name) fails the verdict rather than stand in for it.
-        if (options.workflow !== undefined && required.includes(run.name) && !workflowIs(run.workflowPath, options.workflow)) {
-            failed.push(`${run.name} (from ${run.workflowPath ?? "a workflow GitHub doesn't name"}, not ${options.workflow})`);
-            continue;
+        if (options.workflow !== undefined && required.includes(run.name)) {
+            const want = typeof options.workflow === "string" ? options.workflow : options.workflow[run.name];
+            if (want === undefined || !workflowIs(run.workflowPath, want)) {
+                failed.push(`${run.name} (from ${run.workflowPath ?? "a workflow GitHub doesn't name"}, not ${want ?? "a workflow this release knows for it"})`);
+                continue;
+            }
         }
         if (run.app === "github-actions" && (typeof run.suite !== "number" || !Number.isSafeInteger(run.suite))) {
             failed.push(`${run.name} (no workflow run)`);
@@ -1468,6 +1488,13 @@ export function prChecksVerdict(runs, head, required, options = {}) {
             waiting.push(`${name} (${latest.status})`);
             continue;
         }
+        // Skipped is never success (test-matrix.md): GitHub's protection reads a skipped job as passing a merge, a release
+        // never does. A documentation-only pull request skips the area lanes, and any pull request but a release-* branch's
+        // skips Node 22, so a release needs every lane executed on its exact head.
+        if (latest.conclusion === "skipped" && required.includes(name)) {
+            failed.push(`${name} (skipped: a release needs it run on this exact commit; release from a branch named release-*, whose pull request runs every lane)`);
+            continue;
+        }
         if (latest.conclusion !== "success") {
             failed.push(`${name} (${latest.conclusion ?? "no conclusion"})`);
             continue;
@@ -1525,5 +1552,12 @@ export function checkFailedWords(input) {
 }
 /** Whether GitHub's workflow-run `path` names exactly `file` (it may carry the ref it ran from, after an `@`). */
 export function workflowIs(path, file) {
-    return typeof path === "string" && (path === file || path.startsWith(`${file}@`));
+    if (typeof path !== "string")
+        return false;
+    if (path === file)
+        return true;
+    // GitHub may append @ref, but ci.yml@evil.yml is also a valid *different* workflow filename. Multiple @ signs
+    // likewise cannot distinguish that filename from a ref. Refuse ambiguous suffixes instead of granting its checks.
+    const ref = path.startsWith(`${file}@`) ? path.slice(file.length + 1) : "";
+    return /^[A-Za-z0-9._+/-]+$/.test(ref) && !/\.ya?ml$/i.test(ref);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolroll",
-  "version": "0.9.79",
+  "version": "0.9.81",
   "description": "A control plane for unattended coding agents — queue tasks, walk away, come back to pull requests. Agents build in leased worktrees, never touch your default branch, and interrupt you only for decisions that need a human.",
   "directories": {
     "doc": "docs"