valent-pipeline 0.19.44 → 0.19.46

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "valent-pipeline",
-  "version": "0.19.44",
+  "version": "0.19.46",
   "description": "v3 multi-agent AI pipeline for software development lifecycle",
   "type": "module",
   "bin": {

package/src/commands/evidence.js

@@ -16,7 +16,7 @@ import { dirname, join, isAbsolute } from 'path';
 import { randomBytes } from 'crypto';
 import { parse as parseYaml } from 'yaml';
 import {
-  runEvidence, pinGate, formatRunTrailer, formatRunDigest, resolveRoot, evidenceDir, latestRun, resolveRunForAssert, detectLabelMultiplex, latestPins,
+  runEvidence, pinGate, formatRunTrailer, formatRunDigest, resolveRoot, evidenceDir, latestRun, resolveRunForAssert, requiredCaseIdsForRun, detectLabelMultiplex, latestPins,
   verifyIntegrity, assertRules, assertRedRules, pinSourceDelta, snapshotFiles, buildProof, utcCompact,
   latestAssert, collectFailingCases, authenticateBaseline, verifyShipEvidence, sha256Hex,
   validStoryId, recordStageResults,
@@ -180,15 +180,18 @@ export async function evidenceAssertCmd(options) {
     process.exit(2);
   }
 
-  // Required acceptance case ids, read early so the run resolver can bind to the suite that actually
-  // carries them when a project multiplexes suites under one label (HARNESS-GAPS 2026-06-18 Gap 2).
+  // Required case ids, read early so the run resolver can bind to the suite that actually carries them
+  // when a project multiplexes suites under one label (HARNESS-GAPS 2026-06-18 Gap 2). Prefers
+  // acceptance-tagged cases (normal stories) but falls back to all required id'd cases for bug-fix
+  // manifests (regression cases carry no `kind`) — else requiredCaseIds is empty and the resolver
+  // binds to the newest full-suite run, false-rejecting a clean bug fix on the count check.
   // The full manifest is re-read below for the count/skips rules.
   let requiredCaseIds = [];
   try {
     const mp = options.manifest ? abs(options.manifest) : join(root, 'stories', story, 'output', 'qa-test-spec.manifest.json');
     if (existsSync(mp)) {
       const m = JSON.parse(readFileSync(mp, 'utf-8'));
-      if (Array.isArray(m?.cases)) requiredCaseIds = m.cases.filter((c) => c?.kind === 'acceptance' && c?.required !== false && c?.id).map((c) => c.id);
+      requiredCaseIds = requiredCaseIdsForRun(m?.cases);
     }
   } catch { requiredCaseIds = []; }
 

package/src/commands/init.js

@@ -2,7 +2,7 @@ import { fileURLToPath } from 'url';
 import { dirname, join, resolve } from 'path';
 import { existsSync, readFileSync, rmSync } from 'fs';
 import { defaults } from '../lib/config-schema.js';
-import { copyDir, writeFileSafe, appendToGitignore, fileExists } from '../lib/file-ops.js';
+import { copyDir, writeFileSafe, appendToGitignore, writeFrameworkGitignore, fileExists } from '../lib/file-ops.js';
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
@@ -225,12 +225,16 @@ export async function init(options = {}) {
   writeFileSafe(claudeSettingsPath, JSON.stringify(claudeSettings, null, 2) + '\n');
   console.log(`  Configured .claude/settings.json (agent teams; pre-approved MCP: ${[...approved].join(', ') || 'none'})`);
 
-  // 9. Update .gitignore
+  // 9. Update .gitignore. The vendored framework is an untracked INSTALL (see writeFrameworkGitignore):
+  // a `.valent-pipeline/.gitignore` keeps the framework code out of git so `upgrade` applies repo-wide
+  // and a reused story branch can never run a stale committed framework (M-52 Finding 1). The
+  // root-.gitignore lines below are belt-and-suspenders for the runtime artifacts.
+  writeFrameworkGitignore(projectRoot);
   appendToGitignore(projectRoot, '.valent-pipeline/pipeline.db');
   appendToGitignore(projectRoot, '.valent-pipeline/pipeline.db-*');
   if (usesChroma) appendToGitignore(projectRoot, '.valent-pipeline/chromadb-data/');
   appendToGitignore(projectRoot, '.valent-pipeline/node_modules/');
-  console.log('  Updated .gitignore');
+  console.log('  Updated .gitignore (framework vendored as an untracked install)');
 
   // 9. Write version file (pkg was read in step 7)
   writeFileSafe(join(projectRoot, '.valent-pipeline', '.valent-version'), pkg.version);

package/src/commands/upgrade.js

@@ -1,7 +1,8 @@
 import { fileURLToPath } from 'url';
 import { dirname, join, resolve } from 'path';
 import { existsSync, readFileSync, readdirSync, statSync, mkdirSync, copyFileSync, rmSync } from 'fs';
-import { copyDir, writeFileSafe, fileExists, readFile } from '../lib/file-ops.js';
+import { execSync } from 'child_process';
+import { copyDir, writeFileSafe, writeFrameworkGitignore, fileExists, readFile } from '../lib/file-ops.js';
 import { obsoletePaths } from '../lib/obsolete-manifest.js';
 
 const __filename = fileURLToPath(import.meta.url);
@@ -215,6 +216,26 @@ export async function upgrade(options = {}) {
   writeFileSafe(versionFile, packageVersion);
   console.log(`Updated .valent-pipeline/.valent-version to ${packageVersion}`);
 
+  // Vendor the framework as an untracked INSTALL (M-52 Finding 1): write .valent-pipeline/.gitignore so
+  // the framework lives only in the working tree — `upgrade` then applies repo-wide and a reused story
+  // branch can never run a stale committed framework. If the framework is still git-TRACKED here, print
+  // the one-time untrack transition (we never touch the user's git index ourselves).
+  writeFrameworkGitignore(projectRoot);
+  let frameworkTracked = false;
+  try {
+    execSync('git ls-files --error-unmatch .valent-pipeline/.valent-version', { cwd: projectRoot, stdio: 'ignore' });
+    frameworkTracked = true;
+  } catch { /* not a git repo, or already untracked — no transition needed */ }
+  if (frameworkTracked) {
+    console.log('\n⚠ The vendored framework is still git-TRACKED, so a reused/old story branch will run its');
+    console.log('  STALE committed framework (not this upgrade). To finish the install→untracked transition');
+    console.log('  ONCE, at a clean boundary, run from the repo root:');
+    console.log('    git rm -r --cached --quiet .valent-pipeline && git add .valent-pipeline \\');
+    console.log('      && git commit -m "chore: untrack vendored framework — install not source"');
+    console.log('  (git add re-adds ONLY pipeline-config.yaml + knowledge/ + .gitignore per the new ignore;');
+    console.log('   old branches then need a fresh recut off the transitioned target to pick up the install.)');
+  }
+
   console.log('\nUpgrade complete.');
 }
 

package/src/lib/file-ops.js

@@ -43,6 +43,34 @@ export function appendToGitignore(projectRoot, line) {
   }
 }
 
+// The vendored framework is an INSTALL (re-vendored by `valent-pipeline upgrade`), not source. Keeping
+// it git-tracked meant a REUSED story branch ran whatever framework version it was last committed at
+// (a bug-fix re-run silently executed a stale framework — HARNESS-GAPS 2026-06-19 M-52 Finding 1).
+// This `.valent-pipeline/.gitignore` makes it untracked, so the install lives only in the working tree:
+// gitignored files persist across ALL branch checkouts, one `upgrade` applies repo-wide, and no branch
+// can revert it. `/*` is anchored (direct children only — future-proof to new framework dirs); only
+// project STATE is re-included. KEEP IN SYNC with upgrade.js PROTECTED_FILES.
+export const FRAMEWORK_GITIGNORE = `# valent-pipeline vendored framework — an INSTALL (re-vendored by \`valent-pipeline upgrade\`), not source.
+# Kept UNTRACKED so an upgrade applies repo-wide and a reused story branch never runs a stale committed
+# framework. Only project STATE stays tracked (pipeline-config.yaml, knowledge/).
+/*
+!/.gitignore
+!/pipeline-config.yaml
+!/knowledge/
+`;
+
+/**
+ * Write `.valent-pipeline/.gitignore` so the vendored framework is an untracked install. Idempotent —
+ * rewrites to the canonical content. Returns true if it created or changed the file.
+ */
+export function writeFrameworkGitignore(projectRoot) {
+  const p = join(projectRoot, '.valent-pipeline', '.gitignore');
+  const existing = existsSync(p) ? readFileSync(p, 'utf-8') : null;
+  if (existing === FRAMEWORK_GITIGNORE) return false;
+  writeFileSync(p, FRAMEWORK_GITIGNORE, 'utf-8');
+  return true;
+}
+
 /**
  * Check if a file exists.
  */