rollout-cli 0.5.0__tar.gz → 0.5.1__tar.gz

{rollout_cli-0.5.0 → rollout_cli-0.5.1}/.claude/skills/ask-colleague/SKILL.md

@@ -10,6 +10,7 @@ description: >
   hands off a small implementation, `ask-colleague feedback` grades a finished
   work item (the ROI loop), and `ask-colleague clean` reaps stale/corrupt
   `colleague/*` branches a crashed run left behind (which can break `git fetch`).
+  Pilot a running work item with `monitor`/`guide`/`stop`.
   Reach for it REFLEXIVELY, the way you'd lean over to the
   teammate at the next desk — not only when asked: before you present or open a PR
   on a non-trivial committed diff, run `review` for a diverse second opinion; for a
@@ -154,6 +155,18 @@ keeping stdout valid JSON for a machine consumer while diagnostics stay on stder
   (or `colleague clean`) to reap it — start with `--dry-run` to see what it would
   remove. It only ever touches `colleague/*` refs and `.colleague/` artifacts.
 
+## Piloting a flight
+
+Dispatch a drive with `--watch` (on `explore`, `review`, or `write`) to make the
+work item watchable. While it runs you can:
+
+- **`ask-colleague monitor <task-id>`** — watch the flight's live feed
+- **`ask-colleague guide <task-id> "<message>"`** — send mid-flight guidance
+- **`ask-colleague stop <task-id>`** — cooperatively ask the flight to stop
+
+Control is applied at the running loop's next turn boundary, so guidance and
+stop requests take effect on the next iteration rather than interrupting mid-step.
+
 ## Hard rules (do not violate)
 
 - **explore and review are read-only.** They run in a throwaway `git worktree`

{rollout_cli-0.5.0 → rollout_cli-0.5.1}/.claude/skills/ask-colleague/scripts/ask-colleague.sh

@@ -84,6 +84,9 @@ Usage:
   ask-colleague feedback <id|last> [--rating N]  Grade a past drive (ROI loop); with --rating records, without shows
   ask-colleague feedback list                    List every recorded drive by request + grade (find one by its request)
   ask-colleague clean [--dry-run]                Reap stale/corrupt colleague/* branches + orphaned .colleague/ artifacts (#162)
+  ask-colleague monitor <task-id>                Watch a running flight's live feed
+  ask-colleague guide   <task-id> "<msg>"         Send mid-flight guidance to a running flight
+  ask-colleague stop    <task-id>                Ask a running flight to stop (cooperative)
 
 Options:
   --repo PATH        Target repo (default: .)
@@ -100,6 +103,7 @@ Options:
   --rating N         (feedback) record a 1-5 quality rating for the drive
   --notes "..."      (feedback) free-text notes to store with the rating
   --by NAME          (feedback) who is grading (default: colleague's resolved identity)
+  --watch            (explore/review/write) arm a flight so you can monitor/guide/stop it
   --json             Machine-readable output: stdout carries only the result JSON,
                      every diagnostic/digest line goes to stderr (any verb)
 
@@ -119,11 +123,11 @@ EOF
 # ── parse the verb ──────────────────────────────────────────────────────────
 VERB="${1:-}"
 case "$VERB" in
-    explore | review | write | feedback | clean) shift ;;
+    explore | review | write | feedback | clean | monitor | guide | stop) shift ;;
     -h | --help) usage; exit 0 ;;
     "") usage >&2; exit 1 ;;  # missing arg -> user-input error (#161)
     *)
-        echo "error: unknown verb '$VERB' (expected explore|review|write|feedback|clean)" >&2
+        echo "error: unknown verb '$VERB' (expected explore|review|write|feedback|clean|monitor|guide|stop)" >&2
         echo "hint: run 'ask-colleague --help'" >&2
         exit 1  # bad verb -> user-input error (#161)
         ;;
@@ -173,6 +177,7 @@ ALLOW_DIRTY=0
 APPLY=0
 OPEN_PR=0
 DRY_RUN=0
+WATCH=0
 RATING=""
 NOTES=""
 BY=""
@@ -189,6 +194,7 @@ while [[ $# -gt 0 ]]; do
         --max-steps) need_value "$#" "$1"; MAX_STEPS="$2"; shift 2 ;;
         --timeout) need_value "$#" "$1"; TIMEOUT="$2"; shift 2 ;;
         --apply) APPLY=1; shift ;;
+        --watch) WATCH=1; shift ;;
         --allow-dirty) ALLOW_DIRTY=1; shift ;;
         --pr) OPEN_PR=1; shift ;;
         --dry-run) DRY_RUN=1; shift ;;
@@ -211,6 +217,7 @@ done
 # throwaway worktree, so it needs no mktemp either.
 case "$VERB" in
     feedback | clean) require_tools git ;;
+    monitor | guide | stop) : ;;
     write)
         if [[ "$APPLY" -eq 1 || "$OPEN_PR" -eq 1 ]]; then
             require_tools git python3
@@ -235,8 +242,15 @@ REPO="$(cd "$REPO" && pwd)"
 # it must at least be a real git work tree. Fail fast with a clear message instead
 # of an opaque mid-drive error (read-only verbs add a worktree, write commits a
 # drive branch, clean reaps colleague/* refs).
-git -C "$REPO" rev-parse --is-inside-work-tree >/dev/null 2>&1 \
-    || { echo "error: --repo is not a git repository: $REPO" >&2; exit 1; }
+# The pilot verbs (monitor/guide/stop) are pure .colleague/flight/ file I/O — they
+# need no git work tree, so they are exempt from this fail-fast guard.
+case "$VERB" in
+    monitor | guide | stop) : ;;
+    *)
+        git -C "$REPO" rev-parse --is-inside-work-tree >/dev/null 2>&1 \
+            || { echo "error: --repo is not a git repository: $REPO" >&2; exit 1; }
+        ;;
+esac
 
 # review interpolates --base into the LLM instruction ("git diff $BASE...HEAD"),
 # so reject a value that is not a real commit/ref before it is rendered into the
@@ -252,6 +266,9 @@ resolve_colleague || exit 2
 # A local model can be slow on a growing context, so default generously.
 export COLLEAGUE_TIMEOUT="$TIMEOUT"
 COMMON_FLAGS=(--engine "$ENGINE" --model "$MODEL" --base-url "$BASE_URL" --max-steps "$MAX_STEPS" --json)
+# --watch arms a flight for EVERY drive verb (explore/review/write), so it lives on
+# the shared flag list — not inside one verb's path — so monitor/guide/stop work.
+[[ "${WATCH:-0}" -eq 1 ]] && COMMON_FLAGS+=(--watch)
 
 # ── render an instruction from a prompt template ────────────────────────────
 render_prompt() {
@@ -624,10 +641,35 @@ run_clean() {
     "${cmd[@]}"
 }
 
+# ── piloting verbs: thin passthroughs to the `colleague flight` noun ─────────
+_flight_json_flag() { [[ "$JSON_OUT" -eq 1 ]] && printf -- '--json'; }
+
+run_monitor() {
+    local fid="${ARG%% *}"
+    [[ -z "$fid" ]] && { echo "error: monitor needs a flight task-id" >&2; exit 1; }
+    "${COLLEAGUE[@]}" flight status "$fid" --repo "$REPO" $(_flight_json_flag)
+}
+
+run_stop() {
+    local fid="${ARG%% *}"
+    [[ -z "$fid" ]] && { echo "error: stop needs a flight task-id" >&2; exit 1; }
+    "${COLLEAGUE[@]}" flight stop "$fid" --repo "$REPO" $(_flight_json_flag)
+}
+
+run_guide() {
+    local fid="${ARG%% *}"
+    local msg="${ARG#* }"
+    [[ -z "$fid" || "$msg" == "$fid" ]] && { echo "error: guide needs <task-id> <message>" >&2; exit 1; }
+    "${COLLEAGUE[@]}" flight guide "$fid" "$msg" --repo "$REPO" $(_flight_json_flag)
+}
+
 case "$VERB" in
     explore) run_readonly "$(render_prompt explore)" ;;
     review) run_readonly "$(render_prompt review)" ;;
     write) run_write "$(render_prompt write)" ;;
     feedback) run_feedback "$ARG" ;;
     clean) run_clean ;;
+    monitor) run_monitor ;;
+    guide) run_guide ;;
+    stop) run_stop ;;
 esac

{rollout_cli-0.5.0 → rollout_cli-0.5.1}/CHANGELOG.md

@@ -5,6 +5,17 @@ All notable changes to this project will be documented in this file.
 Format follows [Keep a Changelog](https://keepachangelog.com/). This project
 adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.5.1] - 2026-06-18
+
+### Changed
+
+- ask-colleague: re-vendor the wrapper + recipe snapshot to the canonical colleague source (colleague 1.7.0) — adds the `colleague flight` pilot verbs `monitor` / `guide` / `stop` plus the `--watch` flag that arms a drive (explore/review/write) so it can be watched, guided mid-flight, and cooperatively stopped. Updates the bundled `SKILL.md`, the recipe `SKILL.md.tmpl` + wrapper snapshot, the manifest changelog text, and the `docs/skill-sources.md` provenance row (sync date → 2026-06-14). Adds discord-bot-cli to the ask-colleague-revendor consumer ledger.
+
+### Fixed
+
+- rollout apply: date the prepended changelog entry the day the change lands (`date.today()`) instead of the frozen `2026-06-06` placeholder the apply CLI never overrode.
+- `rollout/core/bump.py` `prepend_changelog`: no longer emits consecutive blank lines (markdownlint MD012) when inserting before an existing entry — every cross-repo rollout target previously inherited a lint-failing CHANGELOG (caught on discord-bot-cli#6). Controls the blank lines at the insertion seams and guarantees a single trailing newline (MD047).
+
 ## [0.5.0] - 2026-06-13
 
 ### Added

{rollout_cli-0.5.0 → rollout_cli-0.5.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rollout-cli
-Version: 0.5.0
+Version: 0.5.1
 Summary: Cross-repo propagation workflow built on refactor-cli — apply a transformation across many repos at once.
 Project-URL: Homepage, https://github.com/agentculture/rollout-cli
 Project-URL: Issues, https://github.com/agentculture/rollout-cli/issues

{rollout_cli-0.5.0 → rollout_cli-0.5.1}/docs/skill-sources.md

@@ -33,7 +33,7 @@ is load-bearing, even where guildmaster's upstream copy omits it.
 | `think` | `../guildmaster/.claude/skills/think/` | **devague** (re-broadcast via guildmaster) | idea→spec leg of the devague workflow chain. Verbatim (already carried `type: command` at guildmaster). Origin/broadcast prose left verbatim. | 2026-05-26 (guildmaster 0.6.0) |
 | `spec-to-plan` | `../guildmaster/.claude/skills/spec-to-plan/` | **devague** (re-broadcast via guildmaster) | spec→plan leg of the devague workflow chain. Verbatim (already carried `type: command`). | 2026-05-26 (guildmaster 0.6.0) |
 | `assign-to-workforce` | `../guildmaster/.claude/skills/assign-to-workforce/` | **devague** (re-broadcast via guildmaster) | plan→parallel-implementation leg of the devague workflow chain. Verbatim (already carried `type: command`). | 2026-05-26 (guildmaster 0.6.0) |
-| `ask-colleague` | `../colleague/.claude/skills/ask-colleague/` | **colleague** (renamed from convertible; vendored directly — guildmaster re-broadcast pending) | The first-party front door to the `colleague` CLI: hand a scoped task to a *different* engine/mind via `explore` / `review` / `write`, and grade a finished work item via `feedback` (the ROI loop). `explore`/`review` run isolated in a throwaway `git worktree`; `write` **previews by default** (throwaway worktree, no side effects) and refuses a dirty tree only when applying (`--apply` / `--pr`). Verbatim except one consumer-identifying clause in the Provenance paragraph (`colleague vendors from guildmaster` → `rollout-cli vendors from guildmaster`); already carried `type: command`. Optional runtime dep: **`colleague`** on PATH. | 2026-06-06 (colleague 0.39.2, direct) |
+| `ask-colleague` | `../colleague/.claude/skills/ask-colleague/` | **colleague** (renamed from convertible; vendored directly — guildmaster re-broadcast pending) | The first-party front door to the `colleague` CLI: hand a scoped task to a *different* engine/mind via `explore` / `review` / `write`, and grade a finished work item via `feedback` (the ROI loop); pilot a running drive with `monitor` / `guide` / `stop` (arm it with `--watch`). `explore`/`review` run isolated in a throwaway `git worktree`; `write` **previews by default** (throwaway worktree, no side effects) and refuses a dirty tree only when applying (`--apply` / `--pr`). Verbatim except one consumer-identifying clause in the Provenance paragraph (`colleague vendors from guildmaster` → `rollout-cli vendors from guildmaster`); already carried `type: command`. Optional runtime dep: **`colleague`** on PATH. | 2026-06-14 (colleague 1.7.0, direct) |
 
 ## Re-sync procedure
 

{rollout_cli-0.5.0 → rollout_cli-0.5.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "rollout-cli"
-version = "0.5.0"
+version = "0.5.1"
 description = "Cross-repo propagation workflow built on refactor-cli — apply a transformation across many repos at once."
 readme = "README.md"
 license = "Apache-2.0"

{rollout_cli-0.5.0 → rollout_cli-0.5.1}/recipes/ask-colleague-revendor/README.md

@@ -44,6 +44,7 @@ Origin: **colleague** (`agentculture/colleague`,
 | rollout-cli | `agentculture/rollout-cli` | re-vendor wrapper | this repo ("self"); carries `which rollout-cli …` token |
 | dgx-spark-cli | `agentculture/dgx-spark-cli` | fresh add | skill was absent |
 | reterminal-cli | `agentculture/reterminal-cli` | re-vendor wrapper | merged at pre-#183 |
+| discord-bot-cli | `agentculture/discord-bot-cli` | fresh add | skill was absent; carries `which discord-bot-cli …` token; landed at flight-verbs snapshot (discord-bot-cli#6) |
 
 Keep this table current when a consumer is added or dropped.
 

{rollout_cli-0.5.0 → rollout_cli-0.5.1}/recipes/ask-colleague-revendor/files/SKILL.md.tmpl

@@ -10,6 +10,7 @@ description: >
   hands off a small implementation, `ask-colleague feedback` grades a finished
   work item (the ROI loop), and `ask-colleague clean` reaps stale/corrupt
   `colleague/*` branches a crashed run left behind (which can break `git fetch`).
+  Pilot a running work item with `monitor`/`guide`/`stop`.
   Reach for it REFLEXIVELY, the way you'd lean over to the
   teammate at the next desk — not only when asked: before you present or open a PR
   on a non-trivial committed diff, run `review` for a diverse second opinion; for a
@@ -154,6 +155,18 @@ keeping stdout valid JSON for a machine consumer while diagnostics stay on stder
   (or `colleague clean`) to reap it — start with `--dry-run` to see what it would
   remove. It only ever touches `colleague/*` refs and `.colleague/` artifacts.
 
+## Piloting a flight
+
+Dispatch a drive with `--watch` (on `explore`, `review`, or `write`) to make the
+work item watchable. While it runs you can:
+
+- **`ask-colleague monitor <task-id>`** — watch the flight's live feed
+- **`ask-colleague guide <task-id> "<message>"`** — send mid-flight guidance
+- **`ask-colleague stop <task-id>`** — cooperatively ask the flight to stop
+
+Control is applied at the running loop's next turn boundary, so guidance and
+stop requests take effect on the next iteration rather than interrupting mid-step.
+
 ## Hard rules (do not violate)
 
 - **explore and review are read-only.** They run in a throwaway `git worktree`

{rollout_cli-0.5.0 → rollout_cli-0.5.1}/recipes/ask-colleague-revendor/files/scripts/ask-colleague.sh

@@ -84,6 +84,9 @@ Usage:
   ask-colleague feedback <id|last> [--rating N]  Grade a past drive (ROI loop); with --rating records, without shows
   ask-colleague feedback list                    List every recorded drive by request + grade (find one by its request)
   ask-colleague clean [--dry-run]                Reap stale/corrupt colleague/* branches + orphaned .colleague/ artifacts (#162)
+  ask-colleague monitor <task-id>                Watch a running flight's live feed
+  ask-colleague guide   <task-id> "<msg>"         Send mid-flight guidance to a running flight
+  ask-colleague stop    <task-id>                Ask a running flight to stop (cooperative)
 
 Options:
   --repo PATH        Target repo (default: .)
@@ -100,6 +103,7 @@ Options:
   --rating N         (feedback) record a 1-5 quality rating for the drive
   --notes "..."      (feedback) free-text notes to store with the rating
   --by NAME          (feedback) who is grading (default: colleague's resolved identity)
+  --watch            (explore/review/write) arm a flight so you can monitor/guide/stop it
   --json             Machine-readable output: stdout carries only the result JSON,
                      every diagnostic/digest line goes to stderr (any verb)
 
@@ -119,11 +123,11 @@ EOF
 # ── parse the verb ──────────────────────────────────────────────────────────
 VERB="${1:-}"
 case "$VERB" in
-    explore | review | write | feedback | clean) shift ;;
+    explore | review | write | feedback | clean | monitor | guide | stop) shift ;;
     -h | --help) usage; exit 0 ;;
     "") usage >&2; exit 1 ;;  # missing arg -> user-input error (#161)
     *)
-        echo "error: unknown verb '$VERB' (expected explore|review|write|feedback|clean)" >&2
+        echo "error: unknown verb '$VERB' (expected explore|review|write|feedback|clean|monitor|guide|stop)" >&2
         echo "hint: run 'ask-colleague --help'" >&2
         exit 1  # bad verb -> user-input error (#161)
         ;;
@@ -173,6 +177,7 @@ ALLOW_DIRTY=0
 APPLY=0
 OPEN_PR=0
 DRY_RUN=0
+WATCH=0
 RATING=""
 NOTES=""
 BY=""
@@ -189,6 +194,7 @@ while [[ $# -gt 0 ]]; do
         --max-steps) need_value "$#" "$1"; MAX_STEPS="$2"; shift 2 ;;
         --timeout) need_value "$#" "$1"; TIMEOUT="$2"; shift 2 ;;
         --apply) APPLY=1; shift ;;
+        --watch) WATCH=1; shift ;;
         --allow-dirty) ALLOW_DIRTY=1; shift ;;
         --pr) OPEN_PR=1; shift ;;
         --dry-run) DRY_RUN=1; shift ;;
@@ -211,6 +217,7 @@ done
 # throwaway worktree, so it needs no mktemp either.
 case "$VERB" in
     feedback | clean) require_tools git ;;
+    monitor | guide | stop) : ;;
     write)
         if [[ "$APPLY" -eq 1 || "$OPEN_PR" -eq 1 ]]; then
             require_tools git python3
@@ -235,8 +242,15 @@ REPO="$(cd "$REPO" && pwd)"
 # it must at least be a real git work tree. Fail fast with a clear message instead
 # of an opaque mid-drive error (read-only verbs add a worktree, write commits a
 # drive branch, clean reaps colleague/* refs).
-git -C "$REPO" rev-parse --is-inside-work-tree >/dev/null 2>&1 \
-    || { echo "error: --repo is not a git repository: $REPO" >&2; exit 1; }
+# The pilot verbs (monitor/guide/stop) are pure .colleague/flight/ file I/O — they
+# need no git work tree, so they are exempt from this fail-fast guard.
+case "$VERB" in
+    monitor | guide | stop) : ;;
+    *)
+        git -C "$REPO" rev-parse --is-inside-work-tree >/dev/null 2>&1 \
+            || { echo "error: --repo is not a git repository: $REPO" >&2; exit 1; }
+        ;;
+esac
 
 # review interpolates --base into the LLM instruction ("git diff $BASE...HEAD"),
 # so reject a value that is not a real commit/ref before it is rendered into the
@@ -252,6 +266,9 @@ resolve_colleague || exit 2
 # A local model can be slow on a growing context, so default generously.
 export COLLEAGUE_TIMEOUT="$TIMEOUT"
 COMMON_FLAGS=(--engine "$ENGINE" --model "$MODEL" --base-url "$BASE_URL" --max-steps "$MAX_STEPS" --json)
+# --watch arms a flight for EVERY drive verb (explore/review/write), so it lives on
+# the shared flag list — not inside one verb's path — so monitor/guide/stop work.
+[[ "${WATCH:-0}" -eq 1 ]] && COMMON_FLAGS+=(--watch)
 
 # ── render an instruction from a prompt template ────────────────────────────
 render_prompt() {
@@ -624,10 +641,35 @@ run_clean() {
     "${cmd[@]}"
 }
 
+# ── piloting verbs: thin passthroughs to the `colleague flight` noun ─────────
+_flight_json_flag() { [[ "$JSON_OUT" -eq 1 ]] && printf -- '--json'; }
+
+run_monitor() {
+    local fid="${ARG%% *}"
+    [[ -z "$fid" ]] && { echo "error: monitor needs a flight task-id" >&2; exit 1; }
+    "${COLLEAGUE[@]}" flight status "$fid" --repo "$REPO" $(_flight_json_flag)
+}
+
+run_stop() {
+    local fid="${ARG%% *}"
+    [[ -z "$fid" ]] && { echo "error: stop needs a flight task-id" >&2; exit 1; }
+    "${COLLEAGUE[@]}" flight stop "$fid" --repo "$REPO" $(_flight_json_flag)
+}
+
+run_guide() {
+    local fid="${ARG%% *}"
+    local msg="${ARG#* }"
+    [[ -z "$fid" || "$msg" == "$fid" ]] && { echo "error: guide needs <task-id> <message>" >&2; exit 1; }
+    "${COLLEAGUE[@]}" flight guide "$fid" "$msg" --repo "$REPO" $(_flight_json_flag)
+}
+
 case "$VERB" in
     explore) run_readonly "$(render_prompt explore)" ;;
     review) run_readonly "$(render_prompt review)" ;;
     write) run_write "$(render_prompt write)" ;;
     feedback) run_feedback "$ARG" ;;
     clean) run_clean ;;
+    monitor) run_monitor ;;
+    guide) run_guide ;;
+    stop) run_stop ;;
 esac

{rollout_cli-0.5.0 → rollout_cli-0.5.1}/recipes/ask-colleague-revendor/manifest.toml

@@ -15,12 +15,14 @@ changelog_text = """\
 
 - **Re-vendored the `ask-colleague` skill wrapper from its canonical colleague
   source** (`.claude/skills/ask-colleague/scripts/ask-colleague.sh`): the wrapper
-  now supports `--json` machine-readable output — stdout carries **only** the
-  result JSON (the drive verbs emit the normalized `TaskResult`; `feedback` /
-  `clean` forward `--json` to colleague) while every diagnostic/digest line goes
-  to stderr, keeping stdout valid JSON for a machine consumer. This supersedes the
-  earlier wrapper-only colleague#183 snapshot (which predated `--json`). The
-  bundled `SKILL.md` template documents the new verb/flag; an existing downstream
+  now drives the `colleague flight` pilot verbs — `monitor` / `guide` / `stop`
+  plus the `--watch` flag that arms a drive (`explore` / `review` / `write`) so it
+  can be watched, guided mid-flight, and cooperatively stopped. This supersedes the
+  earlier colleague#186 snapshot (which predated flights). It keeps the `--json`
+  machine-readable output added then — stdout carries **only** the result JSON (the
+  drive verbs emit the normalized `TaskResult`; `feedback` / `clean` forward
+  `--json` to colleague) while every diagnostic/digest line goes to stderr. The
+  bundled `SKILL.md` template documents the new verbs/flag; an existing downstream
   `SKILL.md` is left untouched (it carries a repo-specific provenance token and
   may diverge). Where the skill was absent, it is added fresh (wrapper +
   `SKILL.md` + prompts).

{rollout_cli-0.5.0 → rollout_cli-0.5.1}/rollout/cli/_commands/apply.py

@@ -9,6 +9,7 @@ as "needs-attention").  Never force-apply or merge.
 from __future__ import annotations
 
 import argparse
+import datetime
 import pathlib
 
 from rollout.cli._output import emit_result
@@ -53,13 +54,16 @@ def cmd_apply(args: argparse.Namespace) -> int:
         return 0
 
     # --- classify and apply ----------------------------------------------
+    # Date the changelog entry the day the change actually lands (not the
+    # apply_one frozen-default placeholder, which is only for hermetic tests).
+    today = datetime.date.today().isoformat()
     report = Report()
     for name in targets_list:
         repo_path = pathlib.Path(base) / pathlib.Path(name).name
         try:
             status = preflight.classify(repo_path, recipe)
             if status == preflight.Status.CLEAN:
-                row = orchestrate.apply_one(repo_path, recipe, repo_slug=name)
+                row = orchestrate.apply_one(repo_path, recipe, repo_slug=name, date=today)
                 report.add_row(name, row.status, row.pr_url)
             else:
                 report.add_row(name, _STATUS_MAP[status])

{rollout_cli-0.5.0 → rollout_cli-0.5.1}/rollout/core/bump.py

@@ -103,16 +103,28 @@ def prepend_changelog(
     if f"## [{version}]" in text:
         return
 
-    # Build the new section.
-    new_section = f"\n## [{version}] - {date}\n\n{body}\n"
+    # Build the new entry. Normalise the body and control the surrounding
+    # blank lines here (exactly one before and after) rather than inheriting
+    # the caller's / file's trailing whitespace — otherwise the junction with
+    # the intro or an existing entry yields consecutive blank lines, which
+    # markdownlint rejects (MD012/no-multiple-blanks).
+    body_clean = re.sub(r"\n{3,}", "\n\n", body.strip())
+    entry = f"## [{version}] - {date}\n\n{body_clean}\n"
 
     # Find the first existing release entry (## [X.Y.Z] ...)
     first_entry = _ENTRY_RE.search(text)
     if first_entry:
-        # Insert just before the first existing entry.
-        new_text = text[: first_entry.start()] + new_section + text[first_entry.start() :]
+        # Insert just before the first existing entry, with exactly one blank
+        # line separating the intro from the new entry and the new entry from
+        # the existing one.
+        prefix = text[: first_entry.start()].rstrip()
+        suffix = text[first_entry.start() :].lstrip("\n")
+        new_text = f"{prefix}\n\n{entry}\n{suffix}"
     else:
         # No existing entries — append after the intro.
-        new_text = text.rstrip() + new_section
+        new_text = f"{text.rstrip()}\n\n{entry}"
+
+    # Exactly one trailing newline (MD047).
+    new_text = new_text.rstrip("\n") + "\n"
 
     path.write_text(new_text, encoding="utf-8")

{rollout_cli-0.5.0 → rollout_cli-0.5.1}/sonar-project.properties

@@ -16,6 +16,17 @@ sonar.python.version=3.12
 # Don't analyze noise.
 sonar.exclusions=**/__pycache__/**,**/.venv/**,uv.lock,.claude/skills/**
 
+# False positive: pythonsecurity:S2083 (path injection) fires on
+# prepend_changelog's `path.write_text` in rollout/core/bump.py because it traces
+# the changelog path back to the `--repos` slug. That slug is sanitized at the
+# boundary — apply.py derives the write dir as `<base>/<pathlib.Path(name).name>`,
+# and `.name` strips any traversal — and the sole caller (orchestrate.apply_one)
+# always passes `<repo_path>/CHANGELOG.md`. This is a local, operator-run devtool
+# writing a CHANGELOG, not an attacker-facing surface. Ignore S2083 in bump.py.
+sonar.issue.ignore.multicriteria=e1
+sonar.issue.ignore.multicriteria.e1.ruleKey=pythonsecurity:S2083
+sonar.issue.ignore.multicriteria.e1.resourceKey=**/bump.py
+
 # Block CI on a failing quality gate. The scanner polls SonarCloud and exits
 # non-zero on a red gate (coverage regression, new bugs/vulnerabilities). Only
 # takes effect when the SonarCloud Scan step runs — that step is guarded by

{rollout_cli-0.5.0 → rollout_cli-0.5.1}/tests/test_bump.py

@@ -152,6 +152,19 @@ def test_prepend_changelog_before_existing_entry(tmp_path: pathlib.Path) -> None
     assert new_pos < old_pos
 
 
+def test_prepend_changelog_no_consecutive_blank_lines(tmp_path: pathlib.Path) -> None:
+    """Inserting never produces MD012 double blanks at the intro/entry junctions."""
+    existing = "## [0.1.0] - 2025-01-01\n\n### Added\n\n- old thing\n"
+    path = _write_changelog(tmp_path, existing=existing)
+    # A body padded with stray blank lines must still normalise cleanly.
+    prepend_changelog(path, "0.2.0", "2026-01-01", "\n### Changed\n\n\n- new thing\n\n")
+    content = path.read_text()
+    assert "\n\n\n" not in content, "markdownlint MD012: consecutive blank lines"
+    assert content.endswith("\n") and not content.endswith("\n\n")
+    assert content.index("## [0.2.0]") < content.index("## [0.1.0]")
+    assert "- new thing" in content
+
+
 # ---------------------------------------------------------------------------
 # prepend_changelog — idempotency
 # ---------------------------------------------------------------------------

{rollout_cli-0.5.0 → rollout_cli-0.5.1}/uv.lock

@@ -430,7 +430,7 @@ wheels = [
 
 [[package]]
 name = "rollout-cli"
-version = "0.5.0"
+version = "0.5.1"
 source = { editable = "." }
 
 [package.dev-dependencies]