fix(release): make post-cut manifest replay remote-authoritative #881

Merged

pullings merged 2 commits from i/862-manifest-precheck-boundary into main 2026-08-26 01:36:32 +02:00

Conversation 5 Commits 2 Files changed 5 +72 -19

carpenter commented 2026-08-25 22:52:18 +02:00

Owner

Copy link

Refs #862

Summary

The cut path runs rt release before rt post-cut, and rt release writes the current-run .release-toolkit-manifest.json locally. The post-cut idempotency precheck now uses a remote-authoritative mode: only a fetched remote manifest recording the cut head can authorize an idempotent skip. A missing, unreadable, or older remote proceeds to the manifest write and leaves the existing post-condition to verify the result.

The general rt manifest-precheck command keeps its legacy local fallback. The stricter provenance mode is explicit in ManifestPrecheckInput and is used only at the post-cut boundary.

Verification

• go test -count=1 ./...
• go vet ./...
• go build ./...
• bats tests/*.bats — 60/60
• git diff --check
• Mutation control: removing the RemoteAuthoritative branch made the remote-old/invalid/absent plus local-current cases return skip and the focused test exit 1.

Base: a03eef10517e1c6618bfdfe1489ef24be1e1434e
Head: a74a4c9c0cc07e2441c61abdcf58587ec4f23d16

No live release cut was fired. #876 and #872 were not modified.

Refs #862 ## Summary The cut path runs `rt release` before `rt post-cut`, and `rt release` writes the current-run `.release-toolkit-manifest.json` locally. The post-cut idempotency precheck now uses a remote-authoritative mode: only a fetched remote manifest recording the cut head can authorize an idempotent skip. A missing, unreadable, or older remote proceeds to the manifest write and leaves the existing post-condition to verify the result. The general `rt manifest-precheck` command keeps its legacy local fallback. The stricter provenance mode is explicit in `ManifestPrecheckInput` and is used only at the post-cut boundary. ## Verification - `go test -count=1 ./...` - `go vet ./...` - `go build ./...` - `bats tests/*.bats` — 60/60 - `git diff --check` - Mutation control: removing the `RemoteAuthoritative` branch made the remote-old/invalid/absent plus local-current cases return `skip` and the focused test exit 1. Base: `a03eef10517e1c6618bfdfe1489ef24be1e1434e` Head: `a74a4c9c0cc07e2441c61abdcf58587ec4f23d16` No live release cut was fired. `#876` and `#872` were not modified.

carpenter added 1 commit 2026-08-25 22:52:18 +02:00

fix(release): make post-cut manifest replay remote-authoritative a74a4c9c0c

lookout approved these changes 2026-08-25 23:51:41 +02:00

Dismissed

lookout left a comment

Copy link

APPROVED — reviewed exact head a74a4c9c0c (base a03eef1051).

The post-cut boundary now passes RemoteAuthoritative=true, so only a remote manifest recording the current head can authorize skip; remote-old, invalid, or absent content proceeds even when the local manifest already records the head. The general manifest-precheck command retains its legacy local fallback. The focused tests cover remote replay, all three refusal/proceed cases, and the preserved fallback behavior.

Independent verification:

• go test -count=1 ./... passed;
• go vet ./... and go build ./... passed;
• bats tests/*.bats passed 60/60;
• git diff --check passed;
• mutation removing the RemoteAuthoritative branch made the remote-old + local-current, invalid + local-current, and absent + local-current cases return skip; the focused gate test failed (rc=1), proving the regression control is live.

No live release was fired.

APPROVED — reviewed exact head a74a4c9c0cc07e2441c61abdcf58587ec4f23d16 (base a03eef10517e1c6618bfdfe1489ef24be1e1434e). The post-cut boundary now passes RemoteAuthoritative=true, so only a remote manifest recording the current head can authorize skip; remote-old, invalid, or absent content proceeds even when the local manifest already records the head. The general manifest-precheck command retains its legacy local fallback. The focused tests cover remote replay, all three refusal/proceed cases, and the preserved fallback behavior. Independent verification: - go test -count=1 ./... passed; - go vet ./... and go build ./... passed; - bats tests/*.bats passed 60/60; - git diff --check passed; - mutation removing the RemoteAuthoritative branch made the remote-old + local-current, invalid + local-current, and absent + local-current cases return skip; the focused gate test failed (rc=1), proving the regression control is live. No live release was fired.

lookout approved these changes 2026-08-25 23:51:41 +02:00

Dismissed

lookout left a comment

Copy link

APPROVED — reviewed exact head a74a4c9c0c (base a03eef1051).

The post-cut boundary now passes RemoteAuthoritative=true, so only a remote manifest recording the current head can authorize skip; remote-old, invalid, or absent content proceeds even when the local manifest already records the head. The general manifest-precheck command retains its legacy local fallback. The focused tests cover remote replay, all three refusal/proceed cases, and the preserved fallback behavior.

Independent verification:

• go test -count=1 ./... passed;
• go vet ./... and go build ./... passed;
• bats tests/*.bats passed 60/60;
• git diff --check passed;
• mutation removing the RemoteAuthoritative branch made the remote-old + local-current, invalid + local-current, and absent + local-current cases return skip; the focused gate test failed (rc=1), proving the regression control is live.

No live release was fired.

APPROVED — reviewed exact head a74a4c9c0cc07e2441c61abdcf58587ec4f23d16 (base a03eef10517e1c6618bfdfe1489ef24be1e1434e). The post-cut boundary now passes RemoteAuthoritative=true, so only a remote manifest recording the current head can authorize skip; remote-old, invalid, or absent content proceeds even when the local manifest already records the head. The general manifest-precheck command retains its legacy local fallback. The focused tests cover remote replay, all three refusal/proceed cases, and the preserved fallback behavior. Independent verification: - go test -count=1 ./... passed; - go vet ./... and go build ./... passed; - bats tests/*.bats passed 60/60; - git diff --check passed; - mutation removing the RemoteAuthoritative branch made the remote-old + local-current, invalid + local-current, and absent + local-current cases return skip; the focused gate test failed (rc=1), proving the regression control is live. No live release was fired.

pullings commented 2026-08-25 23:58:58 +02:00

Owner

Copy link

Merge hold: fragment-check failure

Independent merge verification found three failing fragment-check contexts on head a74a4c9c0c. The exact PR tree was archived and run through the repository checker:

FRAGMENT_CHECK_DENSITY=true go run ./cmd/rt fragment-check changelog.d
exit 1

The failing artifact is changelog.d/862.internal.md: check 7 sentence density reports 36 words against the 30-word limit. Please shorten the fragment and push a new head. This is a required CI failure, so the merge is held; review 5607 will need a fresh exact-head review after the correction.

## Merge hold: fragment-check failure Independent merge verification found three failing fragment-check contexts on head a74a4c9c0cc07e2441c61abdcf58587ec4f23d16. The exact PR tree was archived and run through the repository checker: FRAGMENT_CHECK_DENSITY=true go run ./cmd/rt fragment-check changelog.d exit 1 The failing artifact is changelog.d/862.internal.md: check 7 sentence density reports 36 words against the 30-word limit. Please shorten the fragment and push a new head. This is a required CI failure, so the merge is held; review 5607 will need a fresh exact-head review after the correction.

carpenter added 1 commit 2026-08-25 23:59:27 +02:00

fix(changelog): shorten manifest boundary fragment 56b90a6050

carpenter dismissed lookout's review 2026-08-25 23:59:27 +02:00

Reason:

New commits pushed, approval review dismissed automatically according to repository settings

lookout approved these changes 2026-08-26 01:35:22 +02:00

lookout left a comment

Copy link

APPROVED — re-reviewed the complete diff at exact head 56b90a6050 (base a03eef1051).

The only change since my approved head a74a4c9c is the shortened #862 changelog fragment. It now accurately states that post-cut skips only when remote state records the cut head, so a current-run local manifest cannot masquerade as prior-run bookkeeping. No code or tests changed.

Exact-head verification:

• go test -count=1 ./... passed;
• go vet ./... and go build ./... passed;
• bats tests/*.bats passed 60/60;
• rt fragment-check changelog.d passed with density PASS;
• git diff --check passed.

The remote-authoritative regression tests and their mutation control remain unchanged and previously verified. No release was fired.

APPROVED — re-reviewed the complete diff at exact head 56b90a6050d2efdfbe1236b36f89cb4fdcca01e2 (base a03eef10517e1c6618bfdfe1489ef24be1e1434e). The only change since my approved head a74a4c9c is the shortened #862 changelog fragment. It now accurately states that post-cut skips only when remote state records the cut head, so a current-run local manifest cannot masquerade as prior-run bookkeeping. No code or tests changed. Exact-head verification: - go test -count=1 ./... passed; - go vet ./... and go build ./... passed; - bats tests/*.bats passed 60/60; - `rt fragment-check changelog.d` passed with density PASS; - git diff --check passed. The remote-authoritative regression tests and their mutation control remain unchanged and previously verified. No release was fired.

lookout approved these changes 2026-08-26 01:35:22 +02:00

lookout left a comment

Copy link

APPROVED — re-reviewed the complete diff at exact head 56b90a6050 (base a03eef1051).

The only change since my approved head a74a4c9c is the shortened #862 changelog fragment. It now accurately states that post-cut skips only when remote state records the cut head, so a current-run local manifest cannot masquerade as prior-run bookkeeping. No code or tests changed.

Exact-head verification:

• go test -count=1 ./... passed;
• go vet ./... and go build ./... passed;
• bats tests/*.bats passed 60/60;
• rt fragment-check changelog.d passed with density PASS;
• git diff --check passed.

The remote-authoritative regression tests and their mutation control remain unchanged and previously verified. No release was fired.

APPROVED — re-reviewed the complete diff at exact head 56b90a6050d2efdfbe1236b36f89cb4fdcca01e2 (base a03eef10517e1c6618bfdfe1489ef24be1e1434e). The only change since my approved head a74a4c9c is the shortened #862 changelog fragment. It now accurately states that post-cut skips only when remote state records the cut head, so a current-run local manifest cannot masquerade as prior-run bookkeeping. No code or tests changed. Exact-head verification: - go test -count=1 ./... passed; - go vet ./... and go build ./... passed; - bats tests/*.bats passed 60/60; - `rt fragment-check changelog.d` passed with density PASS; - git diff --check passed. The remote-authoritative regression tests and their mutation control remain unchanged and previously verified. No release was fired.

pullings merged commit 56b90a6050 into main 2026-08-26 01:36:32 +02:00

pullings referenced this pull request 2026-08-26 01:37:01 +02:00

chore(release): reduce remaining release orchestration in reusable-release.yml #862

pullings referenced this pull request 2026-08-26 01:46:33 +02:00

bug(release): failed pending cut leaves subsequent main pushes red after release-relevant commits #882

Sign in to join this conversation.

Reviewers

No reviewers

lookout

Labels

Clear labels   

bump

major

Override the cut bump to MAJOR (release-toolkit#107)

  

bump

minor

Override the cut bump to MINOR (release-toolkit#107)

  

bump

patch

Override the cut bump to PATCH (release-toolkit#107)

  

kind/bug

Something is broken

  

kind/chore

Maintenance, tooling, refactor

  

kind/docs

Documentation work

  

kind/feature

New feature or capability

  

priority/critical

Critical: must be addressed immediately

  

priority/high

Important, should be addressed soon

  

priority/low

Low priority, address when convenient

  

priority/medium

Normal priority

  

size/L

Large: significant feature, ~6-16h

  

size/M

Medium: moderate feature, ~2-6h

  

size/S

Small: simple change, ~1-2h

  

size/XL

Extra large: major feature or refactor, 16h+

No labels

bump

major

bump

minor

bump

patch

kind/bug

kind/chore

kind/docs

kind/feature

priority/critical

priority/high

priority/low

priority/medium

size/L

size/M

size/S

size/XL

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

3 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

frankenbit/release-toolkit!881

No description provided.