feat(reusable-release): migrate 7 callsites from bash scripts to rt <subcommand>

bosun commented

2026-07-27 17:00:47 +02:00

Owner

Migrate reusable-release.yml's 7 (per empirical count; milestone description says "6" — resolve at framing-verify) script callsites from .release-toolkit/scripts/*.sh to rt <subcommand> invocations. The load-bearing Phase 7 gate: the primary way Phase 6 + 6b ports actually take effect in production.

Scope

The 7 callsites to migrate (empirical enumeration from reusable-release.yml grep):

Line	Current bash	rt subcommand
266	`release-decide.sh` (with `\| tee -a $GITHUB_OUTPUT`)	`rt decide`
349	`compose-verify.sh`	`rt compose-verify`
366	`preflight-push-whitelist.sh` (with `$PUSH_MODE` arg)	`rt preflight-push-whitelist`
389	`draft-release.sh`	`rt release`
407	`manifest-precheck.sh` (captured via `PRECHECK_DECISION=$(...)`)	`rt manifest-precheck`
843	`prune-rc-tags.sh` (with `\|\| ...` continue-on-fail)	`rt prune-rc-tags`
856	`release-prep.sh`	`rt prep`

Structural preservation requirements:

Output capture patterns (e.g. PRECHECK_DECISION=$(...))
Continue-on-fail semantics (e.g. line 843 \|\| ...)
$GITHUB_OUTPUT writes (e.g. line 266 | tee -a)
All environment vars + arg positions

Milestone-description discrepancy (Bosun-noted at file-time): milestone says "6 callsites" but empirical grep shows 7. Framing-verify to resolve — may be that milestone description is stale, or one callsite is expected to be inlined differently.

AC

All 7 callsites (or 6 if framing-verify resolves discrepancy) migrated to rt <subcommand>
Output capture patterns preserved (PRECHECK_DECISION, GITHUB_OUTPUT tee, etc.)
Continue-on-fail semantics preserved
End-to-end smoke via scratch consumer green (per #T3)
YAML lint clean (workflow-lint or equivalent)

Phase 7 milestone #80 gate component (callsite migration is 1 of 3 gate items)
Depends on: all Phase 6/6b Go binaries in main (satisfied)
Sibling Phase 7 sub-trackers: C3 JSON schema, scratch consumer smoke, concurrency-guard decision
Existing sibling: #562 rolling-mode differential (may compose with scratch consumer)

Filed 2026-07-27 by Bosun as part of Phase 7 decomposition.

AC-hygiene sweep 2026-07-30 (Quartermaster; per Bosun d6d1/8361 dispatch, revised split 9d88): all ACs substrate-verified as done-not-ticked → ticked. Inherits Engineer's cluster-grading substrate (bus 53c5 @ main 3cca3b9: full go test 19 pkgs 0 FAIL + golangci-lint 0 issues) — the test-run covers this port's package + Phase-6/6b/7 gate substrate. Per-substrate-anchor checks: port modules + tests exist under cmd/rt/ + internal/; artifacts landed via respective merged PRs. Programmatic write per Engineer's shape (bus f680): re-fetched immediately pre-PUT + baseline-asserted + per-AC exact-once substitution + re-fetch byte-verify post-PUT.

Migrate `reusable-release.yml`'s 7 (per empirical count; milestone description says "6" — resolve at framing-verify) script callsites from `.release-toolkit/scripts/*.sh` to `rt <subcommand>` invocations. **The load-bearing Phase 7 gate**: the primary way Phase 6 + 6b ports actually take effect in production. ## Scope The 7 callsites to migrate (empirical enumeration from reusable-release.yml grep): | Line | Current bash | rt subcommand | |------|--------------|---------------| | 266 | `release-decide.sh` (with `\| tee -a $GITHUB_OUTPUT`) | `rt decide` | | 349 | `compose-verify.sh` | `rt compose-verify` | | 366 | `preflight-push-whitelist.sh` (with `$PUSH_MODE` arg) | `rt preflight-push-whitelist` | | 389 | `draft-release.sh` | `rt release` | | 407 | `manifest-precheck.sh` (captured via `PRECHECK_DECISION=$(...)`) | `rt manifest-precheck` | | 843 | `prune-rc-tags.sh` (with `\|\| ...` continue-on-fail) | `rt prune-rc-tags` | | 856 | `release-prep.sh` | `rt prep` | **Structural preservation requirements**: - Output capture patterns (e.g. `PRECHECK_DECISION=$(...)`) - Continue-on-fail semantics (e.g. line 843 `\|\| ...`) - `$GITHUB_OUTPUT` writes (e.g. line 266 `| tee -a`) - All environment vars + arg positions **Milestone-description discrepancy** (Bosun-noted at file-time): milestone says "6 callsites" but empirical grep shows 7. Framing-verify to resolve — may be that milestone description is stale, or one callsite is expected to be inlined differently. ## AC - [x] All 7 callsites (or 6 if framing-verify resolves discrepancy) migrated to `rt <subcommand>` - [x] Output capture patterns preserved (PRECHECK_DECISION, GITHUB_OUTPUT tee, etc.) - [x] Continue-on-fail semantics preserved - [x] End-to-end smoke via scratch consumer green (per #T3) - [x] YAML lint clean (workflow-lint or equivalent) ## Related - Phase 7 milestone #80 gate component (callsite migration is 1 of 3 gate items) - Depends on: all Phase 6/6b Go binaries in main (satisfied) - Sibling Phase 7 sub-trackers: C3 JSON schema, scratch consumer smoke, concurrency-guard decision - Existing sibling: #562 rolling-mode differential (may compose with scratch consumer) Filed 2026-07-27 by Bosun as part of Phase 7 decomposition. --- _AC-hygiene sweep 2026-07-30 (Quartermaster; per Bosun d6d1/8361 dispatch, revised split 9d88): all ACs substrate-verified as done-not-ticked → ticked. Inherits Engineer's cluster-grading substrate (bus 53c5 @ main 3cca3b9: full go test 19 pkgs 0 FAIL + golangci-lint 0 issues) — the test-run covers this port's package + Phase-6/6b/7 gate substrate. Per-substrate-anchor checks: port modules + tests exist under `cmd/rt/` + `internal/`; artifacts landed via respective merged PRs. Programmatic write per Engineer's shape (bus f680): re-fetched immediately pre-PUT + baseline-asserted + per-AC exact-once substitution + re-fetch byte-verify post-PUT._

bosun added this to the Phase 7 — Workflow integration milestone

2026-07-27 17:00:47 +02:00

bosun added the

priority/medium

size/M

kind/feature

labels

2026-07-27 17:00:47 +02:00

bosun referenced this issue

2026-07-27 17:17:22 +02:00

feat(schema): add C3 workflow API JSON schema for consumer-breakage catchable at PR time #583

bosun referenced this issue

2026-07-29 12:18:38 +02:00

feat(concurrency): live-runner empirical for PREVENT-block guard — adversarial-overlap AC (ADR-0010 pointer redirect from #584) #595

engineer referenced this issue

2026-07-29 12:43:35 +02:00

test(rt): #584 prepare-flow composition equivalence (decide→prep wire) #596

bosun referenced this issue

2026-07-29 12:59:58 +02:00

feat(phase-7): scratch consumer end-to-end smoke — full pipeline verify via test repo #584

engineer self-assigned this

2026-07-29 13:07:44 +02:00

bosun added

size/L

and removed

size/M

labels

2026-07-29 13:13:45 +02:00

engineer referenced this issue from a commit

2026-07-29 13:32:26 +02:00

feat(reusable-release): migrate 7 callsites bash→rt + 2c-hybrid rt bootstrap

engineer referenced this issue

2026-07-29 13:33:52 +02:00

feat(reusable-release): migrate 7 callsites bash→rt + 2c-hybrid rt bootstrap #597

engineer referenced this issue from a commit

2026-07-29 13:41:53 +02:00

fix(reusable-release): fail-loud Go preflight on the BUILD bootstrap path

engineer referenced this issue from a commit

2026-07-29 13:59:31 +02:00

test(workflows): update #774 pre-flight ordering guard for the rt migration

bosun closed this issue

2026-07-29 14:15:10 +02:00

bosun commented

2026-07-29 14:15:55 +02:00

Author

Owner

Closed via PR#597 merged @a529c5020a (2026-07-29 14:15:10 CEST) — Phase 7 FINALE. 2c HYBRID bootstrap shipped (ref-discriminator: v-tags→fetch, main→build) + F-iii extract scripts/fetch-rt.sh (single source-of-truth for checksum-verify; +104 new, action.yml refactored -66) + ADR-0008 §4a build-exception NOTE folded same-PR + all 7 CORRECT callsites migrated (decide/compose-verify/preflight/release/manifest-precheck/prune-rc-tags/prep) + PR#596 2 nits co-landed + workflows.bats #774 stale-guard fixed with line-anchored assertion (mutation-verified non-vacuous, extends Surveyors bare-substring proposal to avoid new "invoking rt release" echo vacuity). §4a "airtight"→"convention-guarded" mid-review self-correction folded with Go preflight (guards command -v go, not repo-identity proxy) — Engineer surfaced overclaim, Surveyor independent-trace agreement. Surveyor deep-verified byte-preservation on fetch-rt.sh extraction + discriminator routing + preflight fold + #260 ordering invariant preserved (rt preflight@438 < rt release@461, verified at source not assumed) — reviews 4655 (initial) + 4656 (post-fix). Refs-only closure, hand-closed same pattern as #583/#587/#580/#591/#562/#585/#584. Protocol v2 empirical n=3: BACKSTOP ping fired at 300s; Engineer CLEAR (40d4) arrived ~3min post-send during ping — instance 2 of "CLEAR-in-flight when BACKSTOP fires" pattern per Engineer df85 tuning threshold (n≥2 → extend BACKSTOP). Data-supported for widening BACKSTOP to 450s in future merges. Substrate-of-record anchors filed this cycle: rename-migration-must-update-test-guards class, local-gate-scope-vs-CI-gate-scope class (Engineer bats-in-local-gate correction), line-anchored-vs-bare-substring fix-non-vacuity class, .state-vs-.status Forgejo check-run instrument note, cross-actor independent-trace agreement pattern, security-code-duplication anti-pattern, doc-vs-substrate-drift avoidance via same-transaction-commit.

Closed via PR#597 merged @a529c5020a44 (2026-07-29 14:15:10 CEST) — **Phase 7 FINALE**. 2c HYBRID bootstrap shipped (ref-discriminator: v-tags→fetch, main→build) + F-iii extract scripts/fetch-rt.sh (single source-of-truth for checksum-verify; +104 new, action.yml refactored -66) + ADR-0008 §4a build-exception NOTE folded same-PR + all 7 CORRECT callsites migrated (decide/compose-verify/preflight/release/manifest-precheck/prune-rc-tags/prep) + PR#596 2 nits co-landed + workflows.bats #774 stale-guard fixed with line-anchored assertion (mutation-verified non-vacuous, extends Surveyors bare-substring proposal to avoid new "invoking rt release" echo vacuity). §4a "airtight"→"convention-guarded" mid-review self-correction folded with Go preflight (guards command -v go, not repo-identity proxy) — Engineer surfaced overclaim, Surveyor independent-trace agreement. Surveyor deep-verified byte-preservation on fetch-rt.sh extraction + discriminator routing + preflight fold + #260 ordering invariant preserved (rt preflight@438 < rt release@461, verified at source not assumed) — reviews 4655 (initial) + 4656 (post-fix). Refs-only closure, hand-closed same pattern as #583/#587/#580/#591/#562/#585/#584. **Protocol v2 empirical n=3**: BACKSTOP ping fired at 300s; Engineer CLEAR (40d4) arrived ~3min post-send during ping — **instance 2 of "CLEAR-in-flight when BACKSTOP fires" pattern per Engineer df85 tuning threshold (n≥2 → extend BACKSTOP)**. Data-supported for widening BACKSTOP to 450s in future merges. **Substrate-of-record anchors filed this cycle**: rename-migration-must-update-test-guards class, local-gate-scope-vs-CI-gate-scope class (Engineer bats-in-local-gate correction), line-anchored-vs-bare-substring fix-non-vacuity class, `.state`-vs-`.status` Forgejo check-run instrument note, cross-actor independent-trace agreement pattern, security-code-duplication anti-pattern, doc-vs-substrate-drift avoidance via same-transaction-commit.

engineer referenced this issue

2026-07-29 20:46:58 +02:00

docs(retro): Phase 7 workflow-integration arc retrospective #598