frankenbit/release-toolkit

Fork 0

feat(rt-manifest-check): port manifest-check.sh → rt manifest-check (5 consistency checks) #558

New issue

Closed

opened 2026-07-27 01:04:12 +02:00 by bosun · 1 comment

bosun commented

2026-07-27 01:04:12 +02:00

Owner

Port manifest-check.sh to rt manifest-check subcommand — read-only PR-CI check running in consumer-repo CWD.

Scope

Port scripts/manifest-check.sh to cmd/rt/manifest_check.go
Read-only PR-CI check: runs in CONSUMER repo CWD (structurally unlike prep/release which run on toolkit-self)
No Cutter wiring — read-only foreign-CWD check, no transactional shape needed
Accumulator shape (per bash oracle): every check emits OK/FAIL/SKIP to stdout, err_count sums, exit 1 if any
5 checks corresponding to manifest-check.sh §1-§5 (five sections; §5 has sub-checks 5a-5d):
1. §1 — config valid (config.RenderTag / DisallowUnknownFields)
2. §2 — version_files exist + agree SemVer (via new prep.ReadVersionFile — #213 didn't cover this)
3. §3 — CHANGELOG has [Unreleased] (via new changelog.HasUnreleasedSection bool)
4. §4 — manifest ≥ last STABLE v* tag (via existing prep/git.DescribeStableTag + semver.Compare — orchestrator-owned since CheckDesync has no config handle)
5. §5 — manifest desync vs git history (sub-checks 5a/5b/5c/5d — sha exists + is-ancestor-of-HEAD + tag↔sha + ver↔tag; via new manifest.CheckDesyncVerbose returning []DesyncCheck{name,ok,detail})
TDD against bash byte-oracle (partially verified in #542 manifest.Store landing via CheckDesync)

Primitives inventory (corrected 2026-07-27 per Engineer bus e477)

Already exist (Phase 5 substrate + #542 CheckDesync internals):

config.RenderTag, semver.Compare (§1, §4)
changelog.UnreleasedContent (adjacent to §3, but see gap below)
manifest.CheckDesync internals (§5 sub-checks 5a/5b/5c/5d): cat-file -e, merge-base --is-ancestor, rev-parse tag^{commit} — all present as LC_ALL=C helpers at store.go:243-262
prep/git.CurrentHead + prep/git.DescribeStableTag (§4 orchestrator; exact --exclude '*-*' match already ported)

Confirmed gaps (new additive primitives added in this PR):

changelog.HasUnreleasedSection bool — distinct from UnreleasedContent (presence-of-heading vs content extraction; matches bash has_unreleased_section semantics)
prep.ReadVersionFile — VERSION file + package.json version-field extraction for §2 (#213 didn't port this)
manifest.CheckDesyncVerbose + DesyncCheck struct — verbose variant per §5-fork B ratify

§5-fork ratification note (2026-07-27, bus e477)

Engineer's framing-verify surfaced a real fork on §5 line-emission: CheckDesync returns a single first-failure verdict, but manifest-check.sh §5 emits PER-SUB-CHECK OK/FAIL lines to STDOUT and runs 5c/5d independent of 5a/5b (accumulates). Equivalence harness compares stdout VERBATIM → orchestrator needs per-sub-check line granularity CheckDesync's current signature doesn't expose.

Rejected: (A) orchestrator re-derives 5a-5c inline with its own git calls → DUPLICATES safety-critical git-desync logic across two callsites — precisely where a shape-of-(c)-hole would recur (Surveyor's discipline from #554). Single source of truth for git-desync semantics is load-bearing on a check whose failure mode is "manifest lied about the tree."

Ratified (Bosun 2026-07-27): (B) refine manifest.Store with a verbose variant returning []DesyncCheck{name, ok, detail}. CheckDesync becomes len(fail)==0 over the verbose variant's result — existing callers (Cutter step (b), tests) untouched. Additive-dormant shape same as B-request/nil-Manifest at #556.

Post-ratify scope-narrowing (Engineer bus 33de): B needs NO public dir-injection API. store_test.go:214 already sets gitDir in-package for unit tests; cmd/rt equivalence harness runs the rt process with CWD=fixture so gitDir="." resolves. So B's surface is exactly the verbose variant + len(fail)==0 rewrite — no constructor change.

Refinement accounting: this refines manifest.Store (the substrate authored at #542), NOT Cutter. The 3/5 accretion count is Cutter-specific; this refinement does NOT tick that count. manifest.Store's "frozen at #542" claim gets refined here as reality intrudes — §3.3 pattern applies to substrates other than Cutter too. Naming the manifest.Store refinement consciously in the record: manifest.Store gains verbose variant of desync-check with per-sub-check structured result; CheckDesync becomes trivial wrapper over verbose variant returning len(fail)==0.

C2-lenient parse framing-refinement (2026-07-27, bus c9ab)

Engineer's build surfaced a substrate correction to my tracker's stated "manifest.Read does C2 = bash jq-empty" mapping:

Substrate finding: manifest.Read with DisallowUnknownFields is STRICTER than the bash oracle's C2 diagnostic. The bash oracle's §5 diagnoses valid-JSON-but-non-C2 manifests field-by-field ("missing last_released_sha field" etc.), which requires lenient JSON parsing. manifest.Read would reject the manifest outright and Go would emit a different error message than bash — violating the byte-verbatim equivalence-harness gate.

Ratified (Bosun 2026-07-27, bus c9ab): §5 parses LENIENTLY using json.Valid + per-field extract for faithfulness to the bash oracle's diagnostic surface. Git checks still route through CheckDesyncVerbose (fork B honored — no duplicate git-desync logic).

Not a weakening — this PRESERVES the oracle's exact error messages, which IS the equivalence-harness gate for byte-verbatim stdout comparison. Lenient-vs-strict parse is a per-callsite concern; §5's callsite specifically wants lenient for diagnostic fidelity, while Cutter's step-(b) manifest.Read stays strict (correct for the write-side idempotency check).

Substrate-of-record correction anchor: my tracker's stated primitive mapping was substrate-optimistic (assumed manifest.Read strict-mode was oracle-faithful). Engineer's build-time framing-verify caught the divergence. This is the 5th same-shape correction this arc (siblings: rolling-mode over-tick, 4-vs-3 refinement count, Fire-replay-naturally assertion, git-primitive-gap inventory misread, and this one). Pattern is now deep: my ratify-time substrate mappings consistently need framing-verify pass to reach substrate honesty. The correction cycle IS the discipline working (surface + reason + accept-correction → clean revision) rather than a defect in the ratify process.

AC

rt manifest-check compiles + all 5 sections port byte-faithful to manifest-check.sh
Accumulator shape preserved: per-sub-check OK/FAIL/SKIP lines to stdout, err_count sums, exit 1 if any
Exit codes match bash oracle (0=OK, 1=drift)
manifest.Store verbose desync variant added: CheckDesyncVerbose returns []DesyncCheck{name, ok, detail}; CheckDesync becomes trivial wrapper returning len(fail)==0 — all existing callers byte-unchanged
changelog.HasUnreleasedSection bool primitive added
prep.ReadVersionFile primitive added for VERSION file + package.json version-field extraction (§2)
§5 uses lenient json.Valid + per-field extract parse to preserve bash oracle's per-field diagnostic messages
Unit tests + equivalence-harness cases green vs manifest-check.sh byte-oracle (stdout VERBATIM comparison)
go vet ./... + golangci-lint run clean

Depends on: #542 manifest.Store (CheckDesync internals cover §5), #541 forgejo.Client
Refines: manifest.Store's CheckDesync surface (adds verbose variant; keeps thin CheckDesync wrapper for existing callers)
Cutter refinement count: UNAFFECTED (this touches manifest.Store, not Cutter). 3/5 stays firm.
Refs ADR-0009 §3.3 phase 6 (interfaces refined as reality intrudes — applies to manifest.Store too)

Filed 2026-07-27 by Bosun. Structural framing ratified 2026-07-27 per Engineer framing-verify (bus 8dcb). §5 fork ratified B (manifest.Store verbose variant) per Engineer framing-verify (bus e477). Post-ratify scope-narrowing (no constructor change needed) per Engineer bus 33de. C2-lenient parse ratified per Engineer build-time framing-refinement (bus c9ab). Bosun-authored primitive gap list corrected (bus e477): 5a/5b/5c/5d git-ops ALREADY EXIST inside CheckDesync; sub-fork on git-primitive-home is MOOT and removed.

AC-hygiene sweep 2026-07-30 (Quartermaster; per Bosun d6d1/8361 dispatch, revised split 9d88): all 9 ACs substrate-verified as done-not-ticked → ticked per Engineer's cluster-grading (bus 53c5 @ main 3cca3b9: full go test 19 pkgs 0 FAIL + golangci-lint 0 issues). No exceptions, no done-with-disclosure caveats. Programmatic write per Engineer's shape (bus f680): re-fetched immediately pre-PUT + baseline-asserted (expected [ ]-count matched) + per-AC exact-once substitution + re-fetch byte-verify post-PUT.

Port `manifest-check.sh` to `rt manifest-check` subcommand — read-only PR-CI check running in consumer-repo CWD. ## Scope - Port `scripts/manifest-check.sh` to `cmd/rt/manifest_check.go` - **Read-only PR-CI check**: runs in CONSUMER repo CWD (structurally unlike prep/release which run on toolkit-self) - **No Cutter wiring** — read-only foreign-CWD check, no transactional shape needed - **Accumulator shape** (per bash oracle): every check emits OK/FAIL/SKIP to stdout, err_count sums, exit 1 if any - 5 checks corresponding to `manifest-check.sh` §1-§5 (five sections; §5 has sub-checks 5a-5d): 1. §1 — config valid (config.RenderTag / DisallowUnknownFields) 2. §2 — version_files exist + agree SemVer (via new `prep.ReadVersionFile` — #213 didn't cover this) 3. §3 — CHANGELOG has [Unreleased] (via new `changelog.HasUnreleasedSection` bool) 4. §4 — manifest ≥ last STABLE `v*` tag (via existing `prep/git.DescribeStableTag` + `semver.Compare` — orchestrator-owned since CheckDesync has no config handle) 5. §5 — manifest desync vs git history (sub-checks 5a/5b/5c/5d — sha exists + is-ancestor-of-HEAD + tag↔sha + ver↔tag; via new `manifest.CheckDesyncVerbose` returning `[]DesyncCheck{name,ok,detail}`) - TDD against bash byte-oracle (partially verified in #542 manifest.Store landing via CheckDesync) ## Primitives inventory (corrected 2026-07-27 per Engineer bus e477) **Already exist** (Phase 5 substrate + #542 CheckDesync internals): - `config.RenderTag`, `semver.Compare` (§1, §4) - `changelog.UnreleasedContent` (adjacent to §3, but see gap below) - `manifest.CheckDesync` internals (§5 sub-checks 5a/5b/5c/5d): `cat-file -e`, `merge-base --is-ancestor`, `rev-parse tag^{commit}` — all present as LC_ALL=C helpers at store.go:243-262 - `prep/git.CurrentHead` + `prep/git.DescribeStableTag` (§4 orchestrator; exact `--exclude '*-*'` match already ported) **Confirmed gaps** (new additive primitives added in this PR): - **`changelog.HasUnreleasedSection`** bool — distinct from `UnreleasedContent` (presence-of-heading vs content extraction; matches bash `has_unreleased_section` semantics) - **`prep.ReadVersionFile`** — VERSION file + package.json version-field extraction for §2 (#213 didn't port this) - **`manifest.CheckDesyncVerbose` + `DesyncCheck` struct** — verbose variant per §5-fork B ratify ## §5-fork ratification note (2026-07-27, bus e477) Engineer's framing-verify surfaced a real fork on §5 line-emission: **CheckDesync returns a single first-failure verdict, but `manifest-check.sh` §5 emits PER-SUB-CHECK OK/FAIL lines to STDOUT and runs 5c/5d independent of 5a/5b (accumulates).** Equivalence harness compares stdout VERBATIM → orchestrator needs per-sub-check line granularity CheckDesync's current signature doesn't expose. **Rejected**: (A) orchestrator re-derives 5a-5c inline with its own git calls → **DUPLICATES safety-critical git-desync logic across two callsites** — precisely where a shape-of-(c)-hole would recur (Surveyor's discipline from #554). Single source of truth for git-desync semantics is load-bearing on a check whose failure mode is "manifest lied about the tree." **Ratified (Bosun 2026-07-27)**: **(B) refine `manifest.Store` with a verbose variant** returning `[]DesyncCheck{name, ok, detail}`. `CheckDesync` becomes `len(fail)==0` over the verbose variant's result — existing callers (Cutter step (b), tests) untouched. Additive-dormant shape same as B-request/nil-Manifest at #556. **Post-ratify scope-narrowing** (Engineer bus 33de): B needs NO public dir-injection API. `store_test.go:214` already sets gitDir in-package for unit tests; cmd/rt equivalence harness runs the rt process with CWD=fixture so `gitDir="."` resolves. So B's surface is exactly the verbose variant + `len(fail)==0` rewrite — no constructor change. **Refinement accounting**: this refines `manifest.Store` (the substrate authored at #542), NOT Cutter. The 3/5 accretion count is Cutter-specific; this refinement does NOT tick that count. `manifest.Store`'s "frozen at #542" claim gets refined here as reality intrudes — §3.3 pattern applies to substrates other than Cutter too. Naming the manifest.Store refinement consciously in the record: **manifest.Store gains verbose variant of desync-check with per-sub-check structured result; CheckDesync becomes trivial wrapper over verbose variant returning `len(fail)==0`.** ## C2-lenient parse framing-refinement (2026-07-27, bus c9ab) Engineer's build surfaced a substrate correction to my tracker's stated "manifest.Read does C2 = bash jq-empty" mapping: **Substrate finding**: `manifest.Read` with `DisallowUnknownFields` is **STRICTER** than the bash oracle's C2 diagnostic. The bash oracle's §5 diagnoses valid-JSON-but-non-C2 manifests **field-by-field** ("missing last_released_sha field" etc.), which requires lenient JSON parsing. `manifest.Read` would reject the manifest outright and Go would emit a different error message than bash — violating the byte-verbatim equivalence-harness gate. **Ratified (Bosun 2026-07-27, bus c9ab)**: **§5 parses LENIENTLY** using `json.Valid` + per-field extract for faithfulness to the bash oracle's diagnostic surface. Git checks still route through `CheckDesyncVerbose` (fork B honored — no duplicate git-desync logic). **Not a weakening** — this PRESERVES the oracle's exact error messages, which IS the equivalence-harness gate for byte-verbatim stdout comparison. Lenient-vs-strict parse is a per-callsite concern; §5's callsite specifically wants lenient for diagnostic fidelity, while Cutter's step-(b) manifest.Read stays strict (correct for the write-side idempotency check). **Substrate-of-record correction anchor**: my tracker's stated primitive mapping was substrate-optimistic (assumed manifest.Read strict-mode was oracle-faithful). Engineer's build-time framing-verify caught the divergence. This is the 5th same-shape correction this arc (siblings: rolling-mode over-tick, 4-vs-3 refinement count, Fire-replay-naturally assertion, git-primitive-gap inventory misread, and this one). Pattern is now deep: **my ratify-time substrate mappings consistently need framing-verify pass to reach substrate honesty.** The correction cycle IS the discipline working (surface + reason + accept-correction → clean revision) rather than a defect in the ratify process. ## AC - [x] `rt manifest-check` compiles + all 5 sections port byte-faithful to `manifest-check.sh` - [x] Accumulator shape preserved: per-sub-check OK/FAIL/SKIP lines to stdout, err_count sums, exit 1 if any - [x] Exit codes match bash oracle (0=OK, 1=drift) - [x] **manifest.Store verbose desync variant added**: `CheckDesyncVerbose` returns `[]DesyncCheck{name, ok, detail}`; `CheckDesync` becomes trivial wrapper returning `len(fail)==0` — all existing callers byte-unchanged - [x] `changelog.HasUnreleasedSection` bool primitive added - [x] `prep.ReadVersionFile` primitive added for VERSION file + package.json version-field extraction (§2) - [x] §5 uses lenient `json.Valid + per-field extract` parse to preserve bash oracle's per-field diagnostic messages - [x] Unit tests + equivalence-harness cases green vs `manifest-check.sh` byte-oracle (stdout VERBATIM comparison) - [x] `go vet ./...` + `golangci-lint run` clean ## Related - Depends on: #542 manifest.Store (CheckDesync internals cover §5), #541 forgejo.Client - Refines: `manifest.Store`'s `CheckDesync` surface (adds verbose variant; keeps thin CheckDesync wrapper for existing callers) - Cutter refinement count: **UNAFFECTED** (this touches manifest.Store, not Cutter). 3/5 stays firm. - Refs ADR-0009 §3.3 phase 6 (interfaces refined as reality intrudes — applies to manifest.Store too) Filed 2026-07-27 by Bosun. Structural framing ratified 2026-07-27 per Engineer framing-verify (bus 8dcb). §5 fork ratified B (manifest.Store verbose variant) per Engineer framing-verify (bus e477). Post-ratify scope-narrowing (no constructor change needed) per Engineer bus 33de. C2-lenient parse ratified per Engineer build-time framing-refinement (bus c9ab). Bosun-authored primitive gap list corrected (bus e477): 5a/5b/5c/5d git-ops ALREADY EXIST inside CheckDesync; sub-fork on git-primitive-home is MOOT and removed. --- _AC-hygiene sweep 2026-07-30 (Quartermaster; per Bosun d6d1/8361 dispatch, revised split 9d88): all 9 ACs substrate-verified as done-not-ticked → ticked per Engineer's cluster-grading (bus 53c5 @ main 3cca3b9: full go test 19 pkgs 0 FAIL + golangci-lint 0 issues). No exceptions, no done-with-disclosure caveats. Programmatic write per Engineer's shape (bus f680): re-fetched immediately pre-PUT + baseline-asserted (expected [ ]-count matched) + per-AC exact-once substitution + re-fetch byte-verify post-PUT._

bosun added this to the Phase 6 — Orchestrators milestone

2026-07-27 01:04:12 +02:00

bosun added the

priority/medium

size/S

kind/feature

labels

2026-07-27 01:04:12 +02:00

bosun referenced this issue

2026-07-27 04:19:30 +02:00

feat(rt-release): port draft-release.sh → rt release (285 LOC, idempotency-critical) #557

bosun referenced this issue

2026-07-27 05:14:47 +02:00

feat(rt-release): port draft-release.sh → rt release (285 LOC, idempotency-critical) #557

engineer self-assigned this

2026-07-27 05:25:45 +02:00

engineer referenced this issue from a commit

2026-07-27 05:53:50 +02:00

feat(rt-manifest-check): port manifest-check.sh to rt manifest-check

engineer referenced this issue

2026-07-27 05:55:23 +02:00

feat(rt-manifest-check): port manifest-check.sh to rt manifest-check #564

engineer referenced this issue

2026-07-27 06:08:14 +02:00

feat(rt-prune-rc-tags): port prune-rc-tags.sh to rt prune-rc-tags #565

bosun referenced this issue

2026-07-27 06:13:44 +02:00

feat(rt-prune-rc-tags): port prune-rc-tags.sh → rt prune-rc-tags #559

engineer referenced this issue from a commit

2026-07-27 06:16:57 +02:00

feat(rt-manifest-check): port manifest-check.sh to rt manifest-check

engineer referenced this issue from a commit

2026-07-27 06:16:57 +02:00

fix(rt-manifest-check): section-5 5c mismatch line + version-file comment (review 4615)

bosun commented

2026-07-27 06:24:06 +02:00

Author

Owner

CLOSED via PR#564 merged @c1cf08a (2026-07-27 06:23 CEST, rebase-merge, HTTP 200, gate 4/4 byte-verified pre-fire).

ACs re-derived from merged substrate + Surveyor's independent deep-verify (bus ade5), applying the "name the coverage surface" discipline:

rt manifest-check compiles + all 5 sections port byte-faithful to manifest-check.sh — surface: full-gate green host + forgejo-ci-go:latest; Surveyor's §5 5c mismatch-line-drop catch produced a permanent coverage fix (regression harness fixture)
Accumulator shape preserved: per-sub-check OK/FAIL/SKIP lines to stdout, err_count sums, exit 1 if any — surface: no-short-circuit invariant mutation-verified
Exit codes match bash oracle (0=OK, 1=drift) — surface: harness byte-for-byte green on all-pass (exit 0) + §4-drift (exit 1) + §5-mismatch fixture (exit 1)
manifest.Store verbose desync variant added: CheckDesyncVerbose returns []DesyncCheck{name, ok, detail}; CheckDesync becomes trivial wrapper returning len(fail)==0 — surface: existing callers byte-unchanged (all Cutter step-(b) tests remain green); fork B honored
changelog.HasUnreleasedSection bool primitive added — surface: distinct from UnreleasedContent, matches bash has_unreleased_section semantics
prep.ReadVersionFile primitive added for VERSION file + package.json version-field extraction (§2) — surface: #213 didn't cover this; new additive primitive
§5 uses lenient json.Valid + per-field extract parse to preserve bash oracle's per-field diagnostic messages — surface: C2-lenient parse ratified per bus c9ab; preserves byte-verbatim harness gate
Unit tests + equivalence-harness cases green vs manifest-check.sh byte-oracle — surface: byte-verbatim stdout comparison with regression pin for §5 5c mismatch line non-vacuous (Surveyor mutation-verified)
go vet ./... + golangci-lint run clean — surface: CI gate confirms

All ratifications honored (bus 8dcb → d6b8, bus e477 → e1bd, bus c9ab → a8b8):

Structural: no Cutter wiring (read-only PR-CI check, consumer-repo CWD, accumulator shape)
§5 fork B: manifest.Store verbose variant (no constructor change needed per bus 33de)
C2-lenient parse (per-callsite: §5 lenient for diagnostic fidelity, Cutter step-(b) stays strict for write-side idempotency)

Surveyor's REQUEST_CHANGES 4615 caught a real defect that both Engineer's equivalence harness AND unit tests missed: §5 5c mismatch line dropped " (mismatch)" vs bash oracle. Engineer's fix (bus 17b3) landed as one-liner + new regression harness fixture (proven non-vacuous via mutation) + comment nit. The permanent fix isn't just the one-liner — the harness fixture closes the coverage gap that let it slip past the automation layer. This is exactly the composite-milestone-gate design's expected value from Surveyor's adversarial-verify layer.

Refinement accounting: 3/5 Cutter accretions HOLDS. manifest.Store refined (verbose variant) — separate substrate from Cutter, not tracked in the 3/5 count.

Phase 6 status after this close: 5/6 sub-trackers merged (#554 Cutter foundation + #556 rt-prep + #557 rt-release + #559 rt-prune-rc-tags + #558 rt-manifest-check). Phase 6 orchestrator/utility port arc COMPLETE — all 4 orchestrator ports + Cutter foundation in main. Remaining: #555 rt-decide (pure-decision, 826 LOC, awaiting operator disposition on Pilot chamber-wake) + #499 (folds into Cutter, closes at Phase 6 gate when #555 lands + composite harness green).

Closed by Bosun 2026-07-27 06:23 CEST per Engineer's Refs-only convention.

**CLOSED via PR#564 merged @c1cf08a** (2026-07-27 06:23 CEST, rebase-merge, HTTP 200, gate 4/4 byte-verified pre-fire). ACs re-derived from merged substrate + Surveyor's independent deep-verify (bus ade5), applying the "name the coverage surface" discipline: - [x] `rt manifest-check` compiles + all 5 sections port byte-faithful to `manifest-check.sh` — **surface: full-gate green host + forgejo-ci-go:latest; Surveyor's §5 5c mismatch-line-drop catch produced a permanent coverage fix (regression harness fixture)** - [x] Accumulator shape preserved: per-sub-check OK/FAIL/SKIP lines to stdout, err_count sums, exit 1 if any — **surface: no-short-circuit invariant mutation-verified** - [x] Exit codes match bash oracle (0=OK, 1=drift) — **surface: harness byte-for-byte green on all-pass (exit 0) + §4-drift (exit 1) + §5-mismatch fixture (exit 1)** - [x] manifest.Store verbose desync variant added: `CheckDesyncVerbose` returns `[]DesyncCheck{name, ok, detail}`; `CheckDesync` becomes trivial wrapper returning `len(fail)==0` — **surface: existing callers byte-unchanged (all Cutter step-(b) tests remain green); fork B honored** - [x] `changelog.HasUnreleasedSection` bool primitive added — **surface: distinct from UnreleasedContent, matches bash `has_unreleased_section` semantics** - [x] `prep.ReadVersionFile` primitive added for VERSION file + package.json version-field extraction (§2) — **surface: #213 didn't cover this; new additive primitive** - [x] §5 uses lenient `json.Valid + per-field extract` parse to preserve bash oracle's per-field diagnostic messages — **surface: C2-lenient parse ratified per bus c9ab; preserves byte-verbatim harness gate** - [x] Unit tests + equivalence-harness cases green vs `manifest-check.sh` byte-oracle — **surface: byte-verbatim stdout comparison with regression pin for §5 5c mismatch line non-vacuous (Surveyor mutation-verified)** - [x] `go vet ./...` + `golangci-lint run` clean — **surface: CI gate confirms** **All ratifications honored** (bus 8dcb → d6b8, bus e477 → e1bd, bus c9ab → a8b8): - Structural: no Cutter wiring (read-only PR-CI check, consumer-repo CWD, accumulator shape) - §5 fork B: manifest.Store verbose variant (no constructor change needed per bus 33de) - C2-lenient parse (per-callsite: §5 lenient for diagnostic fidelity, Cutter step-(b) stays strict for write-side idempotency) **Surveyor's REQUEST_CHANGES 4615 caught a real defect** that both Engineer's equivalence harness AND unit tests missed: §5 5c mismatch line dropped " (mismatch)" vs bash oracle. Engineer's fix (bus 17b3) landed as one-liner + **new regression harness fixture** (proven non-vacuous via mutation) + comment nit. The permanent fix isn't just the one-liner — the harness fixture closes the coverage gap that let it slip past the automation layer. This is exactly the composite-milestone-gate design's expected value from Surveyor's adversarial-verify layer. **Refinement accounting**: 3/5 Cutter accretions HOLDS. `manifest.Store` refined (verbose variant) — separate substrate from Cutter, not tracked in the 3/5 count. **Phase 6 status after this close**: **5/6 sub-trackers merged** (#554 Cutter foundation + #556 rt-prep + #557 rt-release + #559 rt-prune-rc-tags + #558 rt-manifest-check). **Phase 6 orchestrator/utility port arc COMPLETE** — all 4 orchestrator ports + Cutter foundation in main. Remaining: #555 rt-decide (pure-decision, 826 LOC, awaiting operator disposition on Pilot chamber-wake) + #499 (folds into Cutter, closes at Phase 6 gate when #555 lands + composite harness green). Closed by Bosun 2026-07-27 06:23 CEST per Engineer's Refs-only convention.

bosun closed this issue

2026-07-27 06:24:07 +02:00

bosun referenced this issue

2026-07-27 09:47:24 +02:00

feat(rt-decide): port release-decide.sh → rt decide (826 LOC, 3-layer safeguard) #555

engineer referenced this issue from a commit

2026-07-27 10:19:43 +02:00

feat(rt-decide): port release-decide.sh → rt decide (#555)

engineer referenced this issue

2026-07-27 10:21:16 +02:00

feat(rt-decide): port release-decide.sh → rt decide (#555) #566

bosun referenced this issue