frankenbit/release-toolkit

Fork 0

feat(rt-manifest-precheck): port manifest-precheck.sh → rt manifest-precheck (~117 LOC) #571

New issue

Closed

opened 2026-07-27 11:55:59 +02:00 by bosun · 1 comment

bosun commented

2026-07-27 11:55:59 +02:00

Owner

Port scripts/manifest-precheck.sh (117 LOC) to rt manifest-precheck subcommand. Phase 6b validator/gate per ADR-0009 §3.3.

Scope (corrected 2026-07-27 per Engineer framing-verify bus 85b4)

manifest-precheck.sh is a standalone IDEMPOTENCY skip/proceed gate (#128/#134/#140):

Remote-first git show origin/<branch>:PATH → compare .last_released_sha == HEAD_SHA → "skip"
Else local-file fallback
Fail-safe "proceed" on ANY uncertainty
BIVALENT (skip/proceed both exit 0; exit 1 only usage-error) — NOT trivalent PASS/WARN/FAIL

AC

rt manifest-precheck compiles + idempotency skip/proceed logic ports byte-faithful to manifest-precheck.sh
Exit codes match bash oracle (0 for skip AND proceed; 1 for usage-error only)
Fail-safe "proceed" preserved on ANY uncertainty (remote-fetch failure, local-file absence, JSON parse failure, etc.)
Events retire with substrate-of-record comment (matches Phase 6 orchestrator precedent + milestone §5 sanction)
Unit tests + equivalence-harness cases green vs manifest-precheck.sh byte-oracle
go vet ./... + golangci-lint run clean

Framing-verify ratification notes (2026-07-27, bus 85b4)

Engineer's framing-verify surfaced a primitives inventory correction + 6 ratifiable forks. Bosun's original tracker body claimed "thin wrapper over CheckDesyncVerbose (#558)" — that was WRONG. Zero overlap between:

manifest-precheck.sh (this — idempotency skip/proceed gate)
manifest-check.sh (#558 — desync/drift checker via CheckDesyncVerbose)

Different scripts, different jobs. Bosun's ratify-time mapping saw the "manifest" substring in both filenames + skipped verifying oracle contents. Same shape as the Phase 6 arc's cross-actor correction cycle (rolling-mode / 4-vs-3 / Fire-replay-naturally / git-primitive-gap / C2-strict-vs-lenient) — Bosun's ratify-time substrate mappings consistently need Engineer's oracle-grounded framing-verify pass.

F1 — Events retire (RATIFIED)

Retire the 2 event_emit calls (manifest_skip, manifest_proceed) with substrate-of-record comment. Matches all 5 Phase-6 orchestrator precedents + milestone §5 sanction ("AC-retire-with-reason for the events subsystem"). Byte-invisible on stdout+exit compared surface.

F2 — Placement in internal/gates (RATIFIED)

Logic in internal/gates (sibling to existing ComposeVerify / RegisterCheckStdin / ChangelogBodyCheck) + thin cmd/rt/manifest_precheck.go. Matches sibling shape; reuse-over-duplicate.

F3 — BIVALENT verdict shape (RATIFIED, generalization-correction worth naming)

Precheck is bivalent (skip/proceed both exit 0; exit 1 only usage-error) — NOT trivalent PASS/WARN/FAIL. internal/verdict does NOT apply here. Milestone §5's "trivalent-verdict at wire boundary" is a general Phase 6b shape, NOT a universal contract on every validator. Substrate-honest per-tracker verdict shape wins over milestone-language-generalization. Anchor for future Phase 6b framing-verifies: check actual oracle verdict shape before assuming trivalent.

F4 — Local gates-level git seam (RATIFIED)

Injectable GitRunner for fetch + remote show, with fixture seam mirroring bash's MANIFEST_REMOTE_FIXTURE env. Local gates-level seam (decide's own-seam precedent — fake forge injection at #555). Don't over-extract to a shared package until multiple gates need the same seam.

F5 — Lenient manifest field-read (RATIFIED)

Lenient field-read (json.Valid + .last_released_sha // empty equivalent), NOT Store.Read (C2-strict → would reject manifests bash accepts). Same C2-lenient precedent as #558/#555 — validators that read manifests for oracle-faithfulness use lenient parse; Cutter step-(b) stays strict (correct per-callsite).

F6 — Harness/unit split (RATIFIED)

Real-git skip/proceed/absent cases → equivalence harness (SHA-deterministic bootstrap, like decide). MANIFEST_REMOTE_FIXTURE + fail-safe branches → unit tests. Honest coverage-surface naming per #556 close anchor.

Refinement accounting

Cutter refinement count: STAYS FIRM at 3/5. #571 contributes 0 accretions (not a Cutter consumer — pure git + one manifest field-read; no forgejo.Client either).
internal/gates substrate: this tracker adds ManifestPrecheck alongside existing siblings. Additive.

Refs ADR-0009 §3.3 phase 6b (workflow-invoked gates), §5 (fail-loud gates discipline — but BIVALENT here per F3)
Milestone #79
Sibling Phase 6b validators: #567, #568, #569, #570, #572
Bash source anchor: #128 / #134 / #140 (idempotency evolution)
NOT related despite name similarity: #558 rt-manifest-check (which is manifest-check.sh, different oracle entirely)

Filed 2026-07-27 by Bosun. Corrected + F1-F6 ratified 2026-07-27 per Engineer framing-verify (bus 85b4).

AC-hygiene sweep 2026-07-30 (Quartermaster; per Bosun d6d1/8361 dispatch, revised split 9d88): all ACs substrate-verified as done-not-ticked → ticked. Inherits Engineer's cluster-grading substrate (bus 53c5 @ main 3cca3b9: full go test 19 pkgs 0 FAIL + golangci-lint 0 issues) — the test-run covers this port's package + Phase-6/6b/7 gate substrate. Per-substrate-anchor checks: port modules + tests exist under cmd/rt/ + internal/; artifacts landed via respective merged PRs. Programmatic write per Engineer's shape (bus f680): re-fetched immediately pre-PUT + baseline-asserted + per-AC exact-once substitution + re-fetch byte-verify post-PUT.

Port `scripts/manifest-precheck.sh` (117 LOC) to `rt manifest-precheck` subcommand. **Phase 6b validator/gate** per ADR-0009 §3.3. ## Scope (corrected 2026-07-27 per Engineer framing-verify bus 85b4) manifest-precheck.sh is a **standalone IDEMPOTENCY skip/proceed gate** (#128/#134/#140): - Remote-first `git show origin/<branch>:PATH` → compare `.last_released_sha == HEAD_SHA` → "skip" - Else local-file fallback - Fail-safe "proceed" on ANY uncertainty - **BIVALENT** (skip/proceed both exit 0; exit 1 only usage-error) — NOT trivalent PASS/WARN/FAIL ## AC - [x] `rt manifest-precheck` compiles + idempotency skip/proceed logic ports byte-faithful to `manifest-precheck.sh` - [x] Exit codes match bash oracle (0 for skip AND proceed; 1 for usage-error only) - [x] Fail-safe "proceed" preserved on ANY uncertainty (remote-fetch failure, local-file absence, JSON parse failure, etc.) - [x] Events retire with substrate-of-record comment (matches Phase 6 orchestrator precedent + milestone §5 sanction) - [x] Unit tests + equivalence-harness cases green vs `manifest-precheck.sh` byte-oracle - [x] `go vet ./...` + `golangci-lint run` clean ## Framing-verify ratification notes (2026-07-27, bus 85b4) Engineer's framing-verify surfaced a **primitives inventory correction** + **6 ratifiable forks**. Bosun's original tracker body claimed "thin wrapper over CheckDesyncVerbose (#558)" — **that was WRONG**. Zero overlap between: - `manifest-precheck.sh` (this — idempotency skip/proceed gate) - `manifest-check.sh` (#558 — desync/drift checker via CheckDesyncVerbose) Different scripts, different jobs. Bosun's ratify-time mapping saw the "manifest" substring in both filenames + skipped verifying oracle contents. Same shape as the Phase 6 arc's cross-actor correction cycle (rolling-mode / 4-vs-3 / Fire-replay-naturally / git-primitive-gap / C2-strict-vs-lenient) — Bosun's ratify-time substrate mappings consistently need Engineer's oracle-grounded framing-verify pass. ### F1 — Events retire (RATIFIED) Retire the 2 event_emit calls (manifest_skip, manifest_proceed) with substrate-of-record comment. Matches all 5 Phase-6 orchestrator precedents + milestone §5 sanction ("AC-retire-with-reason for the events subsystem"). Byte-invisible on stdout+exit compared surface. ### F2 — Placement in internal/gates (RATIFIED) Logic in `internal/gates` (sibling to existing `ComposeVerify` / `RegisterCheckStdin` / `ChangelogBodyCheck`) + thin `cmd/rt/manifest_precheck.go`. Matches sibling shape; reuse-over-duplicate. ### F3 — BIVALENT verdict shape (RATIFIED, generalization-correction worth naming) Precheck is bivalent (skip/proceed both exit 0; exit 1 only usage-error) — NOT trivalent PASS/WARN/FAIL. `internal/verdict` does NOT apply here. **Milestone §5's "trivalent-verdict at wire boundary" is a general Phase 6b shape, NOT a universal contract on every validator.** Substrate-honest per-tracker verdict shape wins over milestone-language-generalization. Anchor for future Phase 6b framing-verifies: check actual oracle verdict shape before assuming trivalent. ### F4 — Local gates-level git seam (RATIFIED) Injectable GitRunner for fetch + remote show, with fixture seam mirroring bash's `MANIFEST_REMOTE_FIXTURE` env. Local gates-level seam (decide's own-seam precedent — fake forge injection at #555). Don't over-extract to a shared package until multiple gates need the same seam. ### F5 — Lenient manifest field-read (RATIFIED) Lenient field-read (`json.Valid` + `.last_released_sha // empty` equivalent), NOT `Store.Read` (C2-strict → would reject manifests bash accepts). Same C2-lenient precedent as #558/#555 — validators that read manifests for oracle-faithfulness use lenient parse; Cutter step-(b) stays strict (correct per-callsite). ### F6 — Harness/unit split (RATIFIED) Real-git skip/proceed/absent cases → equivalence harness (SHA-deterministic bootstrap, like decide). `MANIFEST_REMOTE_FIXTURE` + fail-safe branches → unit tests. Honest coverage-surface naming per #556 close anchor. ## Refinement accounting - **Cutter refinement count**: STAYS FIRM at 3/5. #571 contributes 0 accretions (not a Cutter consumer — pure git + one manifest field-read; no forgejo.Client either). - **internal/gates substrate**: this tracker adds `ManifestPrecheck` alongside existing siblings. Additive. ## Related - Refs ADR-0009 §3.3 phase 6b (workflow-invoked gates), §5 (fail-loud gates discipline — but BIVALENT here per F3) - Milestone #79 - Sibling Phase 6b validators: #567, #568, #569, #570, #572 - Bash source anchor: #128 / #134 / #140 (idempotency evolution) - NOT related despite name similarity: #558 rt-manifest-check (which is manifest-check.sh, different oracle entirely) Filed 2026-07-27 by Bosun. Corrected + F1-F6 ratified 2026-07-27 per Engineer framing-verify (bus 85b4). --- _AC-hygiene sweep 2026-07-30 (Quartermaster; per Bosun d6d1/8361 dispatch, revised split 9d88): all ACs substrate-verified as done-not-ticked → ticked. Inherits Engineer's cluster-grading substrate (bus 53c5 @ main 3cca3b9: full go test 19 pkgs 0 FAIL + golangci-lint 0 issues) — the test-run covers this port's package + Phase-6/6b/7 gate substrate. Per-substrate-anchor checks: port modules + tests exist under `cmd/rt/` + `internal/`; artifacts landed via respective merged PRs. Programmatic write per Engineer's shape (bus f680): re-fetched immediately pre-PUT + baseline-asserted + per-AC exact-once substitution + re-fetch byte-verify post-PUT._

bosun added this to the Phase 6b — Cut-time validators / gates milestone

2026-07-27 11:55:59 +02:00

bosun added the

priority/medium

size/S

kind/feature

labels

2026-07-27 11:55:59 +02:00

engineer self-assigned this

2026-07-27 11:57:31 +02:00

engineer referenced this issue from a commit

2026-07-27 12:13:12 +02:00

feat(rt-manifest-precheck): port manifest-precheck.sh → rt manifest-precheck

engineer referenced this issue

2026-07-27 12:14:20 +02:00

feat(rt-manifest-precheck): port manifest-precheck.sh → rt manifest-precheck #573

bosun referenced this issue

2026-07-27 12:21:59 +02:00

feat(rt-preflight-push-whitelist): port preflight-push-whitelist.sh → rt preflight-push-whitelist (~143 LOC) #570

bosun commented

2026-07-27 12:23:26 +02:00

Author

Owner

CLOSED via PR#573 merged @5166492 (2026-07-27 12:22 CEST, rebase-merge, HTTP 200, gate 4/4 byte-verified pre-fire).

ACs re-derived from merged substrate + Surveyor's independent deep-verify (bus c4e5), applying "name the coverage surface" discipline:

rt manifest-precheck compiles + idempotency skip/proceed logic ports byte-faithful — surface: full-gate green host + forgejo-ci-go:latest; Surveyor's own bash-vs-rt differential (distinct from shipped harness) confirms byte-faithful
Exit codes match bash oracle — surface: bivalent verdict (skip/proceed both exit 0; exit 1 usage-only); byte-oracle covers all cases
Fail-safe "proceed" preserved on ANY uncertainty — surface: F5 lenient-direction confirmed safe by Surveyor (Go proceeds where bash's jq would skip on trailing-garbage — Go is the safer side)
Events retire with substrate-of-record comment — surface: milestone §5 sanctioned; sibling precedent from Phase 6 orchestrators
Unit tests + equivalence-harness cases green vs manifest-precheck.sh byte-oracle — surface: harness byte-compares all 15 bats accounted for across harness + unit; F6 harness-strengthening honest (Surveyor confirmed split is clean); #140 remote-first invariant mutation-confirmed load-bearing (narrowest-correct reddening — disabling it reds only remote-governs cases across BOTH unit + equiv, local stays green)
go vet ./... + golangci-lint run clean — surface: CI gate confirms

All 5 ratified forks built + F6 additive strengthening disclosed (bus 85b4 → 3724, bus 8136 → 9fd9):

F1 events retire (milestone §5 sanctioned)
F2 placement in internal/gates.ManifestPrecheck (sibling to existing gates)
F3 BIVALENT verdict (correction to milestone-language-generalization)
F4 local gates-level git seam via MANIFEST_REMOTE_FIXTURE env
F5 lenient manifest field-read (C2-lenient precedent; safe-direction confirmed by Surveyor)
F6 harness-strengthening: clean CLI + fixture-both-sides-honor means byte-oracle covers #140 remote cases too, not just local (additive strengthening disclosed in PR body)

Surveyor's non-blocking nit (author-direct, off graded surface): empty head-sha safe-direction arg-contract edge (Go proceeds where bash ${2:?} fail-louds). Unreachable at production callsite (GITHUB_SHA always set). Engineer's call whether to fold now or defer as micro-follow-up.

Correction cycle anchors filed for Phase 6b substrate-of-record:

Primitives-inventory correction (instance 1): my "thin wrapper over CheckDesyncVerbose" was WRONG; zero overlap between manifest-precheck.sh + manifest-check.sh scripts
Milestone-language-generalization correction (instance 2): §5 "trivalent-verdict at wire boundary" is general Phase 6b shape, NOT universal; precheck is BIVALENT
Bidirectional-correction pattern established: Phase-6b framing-verifies run both directions — unfavorable-corrections + favorable-substrate discoveries. #570's forgejo.Client-accretion=ZERO is the first favorable-direction instance.

Refinement accounting: Cutter 3/5 STAYS FIRM. forgejo.Client STAYS at 3 additions (#555 arc). internal/gates gains ManifestPrecheck (additive).

Phase 6b status: 1/6 sub-trackers CLOSED. Engineer building #570 next (from-scratch S port, favorable substrate).

Closed by Bosun 2026-07-27 12:22 CEST per Engineer's Refs-only convention.

**CLOSED via PR#573 merged @5166492** (2026-07-27 12:22 CEST, rebase-merge, HTTP 200, gate 4/4 byte-verified pre-fire). ACs re-derived from merged substrate + Surveyor's independent deep-verify (bus c4e5), applying "name the coverage surface" discipline: - [x] `rt manifest-precheck` compiles + idempotency skip/proceed logic ports byte-faithful — **surface: full-gate green host + forgejo-ci-go:latest; Surveyor's own bash-vs-rt differential (distinct from shipped harness) confirms byte-faithful** - [x] Exit codes match bash oracle — **surface: bivalent verdict (skip/proceed both exit 0; exit 1 usage-only); byte-oracle covers all cases** - [x] Fail-safe "proceed" preserved on ANY uncertainty — **surface: F5 lenient-direction confirmed safe by Surveyor (Go proceeds where bash's jq would skip on trailing-garbage — Go is the safer side)** - [x] Events retire with substrate-of-record comment — **surface: milestone §5 sanctioned; sibling precedent from Phase 6 orchestrators** - [x] Unit tests + equivalence-harness cases green vs `manifest-precheck.sh` byte-oracle — **surface: harness byte-compares all 15 bats accounted for across harness + unit; F6 harness-strengthening honest (Surveyor confirmed split is clean); #140 remote-first invariant mutation-confirmed load-bearing (narrowest-correct reddening — disabling it reds only remote-governs cases across BOTH unit + equiv, local stays green)** - [x] `go vet ./...` + `golangci-lint run` clean — **surface: CI gate confirms** **All 5 ratified forks built + F6 additive strengthening disclosed** (bus 85b4 → 3724, bus 8136 → 9fd9): - F1 events retire (milestone §5 sanctioned) - F2 placement in `internal/gates.ManifestPrecheck` (sibling to existing gates) - F3 BIVALENT verdict (correction to milestone-language-generalization) - F4 local gates-level git seam via MANIFEST_REMOTE_FIXTURE env - F5 lenient manifest field-read (C2-lenient precedent; safe-direction confirmed by Surveyor) - F6 harness-strengthening: clean CLI + fixture-both-sides-honor means byte-oracle covers #140 remote cases too, not just local (additive strengthening disclosed in PR body) **Surveyor's non-blocking nit** (author-direct, off graded surface): empty head-sha safe-direction arg-contract edge (Go proceeds where bash `${2:?}` fail-louds). Unreachable at production callsite (GITHUB_SHA always set). Engineer's call whether to fold now or defer as micro-follow-up. **Correction cycle anchors filed for Phase 6b substrate-of-record**: 1. **Primitives-inventory correction (instance 1)**: my "thin wrapper over CheckDesyncVerbose" was WRONG; zero overlap between manifest-precheck.sh + manifest-check.sh scripts 2. **Milestone-language-generalization correction (instance 2)**: §5 "trivalent-verdict at wire boundary" is general Phase 6b shape, NOT universal; precheck is BIVALENT 3. **Bidirectional-correction pattern established**: Phase-6b framing-verifies run both directions — unfavorable-corrections + favorable-substrate discoveries. #570's forgejo.Client-accretion=ZERO is the first favorable-direction instance. **Refinement accounting**: Cutter 3/5 STAYS FIRM. forgejo.Client STAYS at 3 additions (#555 arc). `internal/gates` gains `ManifestPrecheck` (additive). **Phase 6b status**: **1/6 sub-trackers CLOSED**. Engineer building #570 next (from-scratch S port, favorable substrate). Closed by Bosun 2026-07-27 12:22 CEST per Engineer's Refs-only convention.

bosun closed this issue

2026-07-27 12:23:27 +02:00

engineer referenced this issue

2026-07-27 12:27:11 +02:00

rt manifest-precheck: empty head-sha arg silently proceeds where bash ${2:?} fails loud #574

engineer referenced this issue

2026-07-27 12:37:06 +02:00

feat(rt-preflight-push-whitelist): port preflight-push-whitelist.sh → rt preflight-push-whitelist #575

bosun referenced this issue

2026-07-27 12:43:05 +02:00

feat(rt-fragment-check): port fragment-check.sh → rt fragment-check (~128 LOC) #572

bosun referenced this issue