chore(release): one-shot deterministic release automation (plan) — #147

[rickylabs]

One-shot deterministic release automation (#147)

Planning-only PR. Run artifacts (research.md + plan.md) for a single gated release command +
a release skill, so future cuts stop costing supervisor tokens and trial-and-error.

Folds four release defects:

• fix(publish): JSR first-publish package provisioning + one-shot e2e CI + deterministic release tool #122 — version:bump is not workspace-coordinated. New release:cut bumps root deno.json,
  every packages/* + plugins/* deno.json, and deno.lock @netscript/* ranges, with a residue
  check. No more manual root/lock edits per cut.
• fix(database): make CLI db-init deterministically reliable (eliminate scaffold.runtime flake) #146 — deps:prod-install passes --frozen, which Deno 2.9 deno ci rejects
  (unexpected argument '--frozen', dies in 7ms). deno ci is already frozen; drop the flag.
• fix(publish): atomic whole-workspace JSR publish from root #123 — publish.yml and e2e-cli-prod.yml both fire on release: published concurrently, so
  e2e resolves jsr:@netscript/cli@<ver> before publish uploads → fail. Gate e2e behind publish via
  workflow_run so it runs only after publish succeeds.
• fix(cli): gate maintainer plugin source copy #133 — no static gate catches bundled-asset reads via Deno.readTextFile/fromFileUrl/
  import.meta.resolve (the recurring prod-CLI break). New release:preflight text-import scan,
  wired into both cut.ts and publish.yml.

Design decisions D1–D6 + the slice plan (S1–S5) + gates are in
.llm/tmp/run/chore-release-one-shot--tooling/plan.md.

Status

• research.md + plan.md authored
• PLAN-EVAL (OpenHands minimax-M3) — hard gate, no implementation before PASS
• Implementation (WSL Codex daemon-attached slices S1–S5)
• IMPL-EVAL (OpenHands qwen3.7-max)

🤖 Generated with Claude Code

[rickylabs]

@openhands-agent model=openrouter/minimax/minimax-m3 output=pr-comment iterations=600

use harness

Run PLAN-EVAL (Plan-Gate hard stop) for the release-automation plan on this PR branch
chore/release-one-shot. You are a SEPARATE evaluator session from the plan author — do NOT
implement anything. Read the plan, judge it against the Plan-Gate, write the verdict artifact, and
post a pr-comment summary. Emit exactly one verdict: PASS or FAIL_PLAN.

SKILL

• netscript-harness — you are running PLAN-EVAL; load .llm/harness/evaluator/plan-protocol.md +
  .llm/harness/gates/plan-gate.md and follow evaluator separation. This is the controlling skill.
• netscript-tools — the plan changes .llm/tools/ (release tooling) + CI workflows; judge the
  validation/gate-evidence approach and the scoped check/lint/fmt wrapper usage.
• netscript-deno-toolchain — the plan touches deno bump-version, deno ci --prod,
  deno publish --dry-run, the catalog law, and the .llm/tools/deps/ wrappers; verify the
  toolchain claims (esp. that Deno 2.9 deno ci rejects --frozen, and that deps:latest not
  outdated --latest is the version authority).
• netscript-pr — the plan creates a branch/PR/commit flow; sanity-check that mechanics.
• jsr-audit — the plan's text-import preflight (fix(cli): gate maintainer plugin source copy #133) encodes JSR-safe asset embedding; check it
  against the publish surface and the locked "text imports, never readTextFile" rule.

What to read

• .llm/tmp/run/chore-release-one-shot--tooling/research.md
• .llm/tmp/run/chore-release-one-shot--tooling/plan.md (esp. the ## Design (LOCKED decisions)
  D1–D6 and the S1–S5 slice plan)
• Ground-truth the claims against current main: .llm/tools/deps/bump-version.ts,
  .llm/tools/deps/prod-install.ts, .llm/tools/run-publish-dry-run.ts,
  .github/workflows/publish.yml, .github/workflows/e2e-cli-prod.yml, root deno.json release
  tasks. (The plan was authored noting a stale Explore worktree — verify the workflow facts against
  real main, not stale line numbers.)

Judge specifically

1. fix(publish): JSR first-publish package provisioning + one-shot e2e CI + deterministic release tool #122 bump coordinator (D1): Is "bump root + every packages/* + every plugins/* + deno.lock
   @netscript ranges + residue check" complete and correct? Any member it would miss? Is the
   lock-rewrite approach safe without deno cache --reload / lock deletion (a repo constraint)?
2. fix(database): make CLI db-init deterministically reliable (eliminate scaffold.runtime flake) #146 (D2): Confirm Deno 2.9 deno ci rejects --frozen and that removing it is the right
   fix (ci is already frozen). Flag if --frozen is load-bearing anywhere.
3. fix(publish): atomic whole-workspace JSR publish from root #123 (D4): Is workflow_run: workflows:["publish"], types:[completed] + the success guard +
   version-resolution-from-the-publish-run a correct, race-free gate? Does it correctly preserve the
   workflow_dispatch manual path? Any edge (publish failure, re-run, tag resolution) it mishandles?
4. fix(cli): gate maintainer plugin source copy #133 (D3): Is the text-import scan's pattern set sufficient and not over-broad (the allowlist
   for legitimate CLI scaffold FS I/O)? Will it actually catch the historical prod-CLI break class?
5. Scope/lane: .llm/tools/ + workflows + a new skill is repo/harness tooling (not
   packages/plugins source) → WSL Codex implementation lane is correct. Slices S1–S5 independently
   committable? Gates sufficient (incl. the --dry-run proof of the bump path)?
6. Non-goals (D6): Is keeping the GitHub-Release-triggered OIDC publish (not local deno publish) the right call?

Output

Write .llm/tmp/run/chore-release-one-shot--tooling/plan-eval.md with: verdict (PASS /
FAIL_PLAN), per-decision findings (D1–D6), any required corrections, and the evaluator
session/model/run id. Then post the pr-comment summary. Two FAIL_PLAN cycles max before
escalation. Do not commit source changes; this is plan evaluation only.

[rickylabs]

OpenHands Agent — Completed

Model: openrouter/minimax/minimax-m3
Provider: OPENROUTER
Job status: success
Trace: .llm/tmp/run/openhands/pr-164/run-28304587059-1 (committed to the PR branch)
Artifact: openhands-agent-28304587059-1

PLAN-EVAL — chore/release-one-shot (PR #164)

Verdict: FAIL_PLAN (cycle 1 of 2)

Evaluator session: openhands / openrouter/minimax/minimax-m3 / 2026-06-29
Run: chore-release-one-shot--tooling
Branch: chore/release-one-shot (off origin/main); baseline alpha.11
Surface: SCOPE-tools (.llm/tools/, .github/workflows/, new skill)
Verifier: I am a separate evaluator session from the plan author. This is PLAN-EVAL only — no
source was committed.

Summary

I read .llm/tmp/run/chore-release-one-shot--tooling/research.md (62 lines, re-baselined vs main),
the full plan.md (D1–D6 design + S1–S5 slice plan + gate set), and ground-truthed every claim
against current main and against a live copy of the repo.

D1, D2, D4, D5, D6 are sound; the scope/lane is correct (WSL Codex for harness tooling); the
slices are independently committable; the gate set is complete (run-deno-check,
run-deno-lint, run-deno-fmt, unit tests, release:cut --dry-run proof, actionlint). The single
blocker is D3 (text-import preflight, #133).

What I verified live

• deno bump-version prerelease at workspace root bumps 32 members (27 packages + 5 plugins)
  but does not update root deno.json "version" and does not update deno.lock. Both
  gaps D1 calls out are real.
• deno.lock v5 is JSON; after sed rewrite of the 43 @netscript/* refs from
  0.0.1-alpha.11 → 0.0.1-alpha.12, deno ci exits 0. Lock-rewrite is safe without
  deno cache --reload / lock deletion.
• deno ci --frozen on Deno 2.9.0 rejects with error: unexpected argument '--frozen' found.
  .llm/tools/deps/prod-install.ts:28 is the single source. D2's fix is correct.
• Both publish.yml and e2e-cli-prod.yml currently trigger on release: types:[published]
  concurrently — the JSR race D4 calls out is real.
• agentic:sync-claude regenerates .claude/skills/ from .agents/skills/; .claude/skills/ is
  generated, never hand-edited. The plan's S5 wording is a nit (see "Optional clarifications").

Per-decision verdicts

Decision	Issue	Verdict	Notes
D1	#122	PASS	Workspace bump + root deno.json write + lock sed-rewrite + residue check + deno ci proof — all correct.
D2	#146	PASS	Single-line fix at prod-install.ts:28; rationale survives in the doc comment; README at line 99 also touched.
D3	#133	FAIL_PLAN	Pattern set is over-broad and misses the cross-line case (see below).
D4	#123	PASS	workflow_run: completed + conclusion:success guard is race-free; workflow_dispatch preserved; no double-fire.
D5	(new)	PASS	Skill is correct; sync mechanism is the only nit (see "Optional clarifications").
D6	(non-goals)	PASS	OIDC publish stays in publish.yml; no auto-tag; no new casts.

D3 — the failure (the only blocker)

The plan's pattern set:

Deno.readTextFile(/Deno.readFile( + fromFileUrl(/import.meta.resolve(/new URL(..., import.meta.url) used to READ shipped asset files

Two independent defects:

(1) Over-broad — flags non-reads

fromFileUrl(, import.meta.resolve(, and bare new URL(..., import.meta.url) are URL/path
constructors, not reads. In the current tree:

• new URL(..., import.meta.url): 21 hits across packages/ + plugins/ source.
• Most are HTTP URL composition (openapi), fresh route module IDs, test-fixture path constants,
  and fromFileUrl(new URL(...)) chains — none of which are bundled-asset reads.

Including them turns a single false-positive into ~21+ flagged lines per run. The plan's "allowlist
legitimate runtime FS use via an explicit ignore list / annotation" mitigation is unbounded and
unpinned.

(2) Under-broad — misses the historical prod-CLI break class

The actual violation pattern the locked rule was authored to prevent:

// packages/service/src/primitives/openapi.ts:29
const scalarJsUrl = new URL('../../assets/scalar.min.js', import.meta.url);
// ...
// packages/service/src/primitives/openapi.ts:155
const scalarJs = scalarJsCache ?? await Deno.readTextFile(scalarJsUrl);

A line-by-line scan cannot connect scalarJsUrl (assigned on line 29) to Deno.readTextFile( scalarJsUrl) (used on line 155). The plan's pattern set catches only the inline form on a
single line. The real production violation is not caught.

The only inline new URL(...)+readTextFile case in the tree is
packages/service/tests/_fixtures/readme-examples_test.ts:3, which is a test fixture, not a
publishable surface — so even the inline-positive case is wrong-class.

Required fixes (cycle 1)

1. D3 — narrow the pattern set. Scan only Deno.readTextFile(<arg>) and Deno.readFile(<arg>)
   calls. Drop fromFileUrl(, import.meta.resolve(, and bare new URL(..., import.meta.url) from
   the pattern list.
2. D3 — pin the cross-line detection. Specify a two-pass scan: pass 1 collects const <name> = new URL(..., import.meta.url) assignments; pass 2 flags Deno.readTextFile(<name>) /
   Deno.readFile(<name>) references. Add a positive fixture that mirrors openapi.ts:29 → 155
   (URL declared on one line, read on another).
3. D3 — add the risk to the risk register. "D3 cross-line miss class (e.g. openapi.ts:29 → 155);
   mitigation = two-pass scan + cross-line positive fixture."

Optional clarifications (non-blocking)

• D4 version resolution from workflow_run is workable but the API path isn't pinned. Pin in
  the plan or defer to IMPL. Recommend actions/upload-artifact (version.txt) in publish.yml
  • actions/download-artifact in e2e-cli-prod.yml for a non-racy lookup.
• D5 wording — replace "mirror to .claude/skills/" with "add to .agents/skills/, run
  deno task agentic:sync-claude, gate via deno task agentic:sync-claude:check".
• D2 file list — explicitly enumerate .llm/tools/README.md:99 and prod-install.ts:6–7 in
  S1 (the rationale survives, the flag doesn't).

Changes

• None to source. Plan evaluation only.
• Created .llm/tmp/run/chore-release-one-shot--tooling/plan-eval.md (this verdict artifact).
• This summary.md (consumed by the workflow to post the PR comment).

Validation

All spot-checks performed live against a copy of origin/main (post-main commit; pre-bump at
alpha.11) and against Deno 2.9.0 at /opt/hosted-toolchain/deno/2.9.0/x64/deno:

Check	Result
deno bump-version prerelease updates 32 members	✓
deno bump-version does NOT update root deno.json "version"	✓
deno bump-version does NOT update deno.lock @netscript/* ranges	✓
sed '0.0.1-alpha.11/0.0.1-alpha.12/' deno.lock + deno ci → exit 0	✓
deno ci --frozen on 2.9.0 → unexpected argument '--frozen' found	✓
publish.yml + e2e-cli-prod.yml both trigger on release: types:[published]	✓
new URL(..., import.meta.url) in packages/+plugins/	21 hits
Deno.readTextFile(new URL(...)) on a single line	1 hit (test fixture)
Cross-line new URL decl + readTextFile use (e.g. openapi.ts:29 → 155)	✓ found

Responses to PR comments

No PR comments were addressed by this evaluator pass. The verdict is directed at the plan author
for cycle 2.

Remaining risks

• D3 false-positives if the plan is not narrowed: ~21+ false positives per run on the current
  tree. CI noise → ignores → missed real violations.
• D3 false-negatives if the cross-line case is not addressed: the historical prod-CLI break
  class slips through. The preflight tool is then silently green on a real violation, defeating
  fix(cli): gate maintainer plugin source copy #133's purpose.
• D4 version lookup fragility (non-blocking at PLAN level; flag for IMPL ergonomics).

Run: https://github.com/rickylabs/netscript/actions/runs/28304587059

[rickylabs]

@openhands-agent model=openrouter/minimax/minimax-m3 output=pr-comment iterations=500

use harness

PLAN-EVAL cycle 2 for chore/release-one-shot (PR #164). You are a SEPARATE evaluator session
from the plan author — do NOT implement. Cycle 1 was FAIL_PLAN with a single blocker (D3); the plan
author has revised. Read the updated plan and emit exactly one verdict: PASS or FAIL_PLAN.

SKILL

• netscript-harness — controlling skill; load .llm/harness/evaluator/plan-protocol.md +
  gates/plan-gate.md; preserve evaluator separation. This is PLAN-EVAL only.
• netscript-tools — .llm/tools/ release tooling + gate-evidence approach.
• netscript-deno-toolchain — toolchain claims (deno ci, bump-version, dry-run, catalog law).
• jsr-audit — D3 encodes the "text imports, never readTextFile" locked rule against the publish surface.
• netscript-pr — branch/PR/commit mechanics.

What changed since cycle 1 (focus here)

Read .llm/tmp/run/chore-release-one-shot--tooling/plan.md — the revision banner + D3 (REVISED
cycle 2), plus the folded clarifications in D4 (artifact version handoff), D5 (agentic:sync-claude),
D2 (exact edit sites), S2 wording, and the Risks section. research.md is unchanged.

The cycle-1 verdict (D1/D2/D4/D5/D6 + scope/lane/slices/gates = PASS) stands unless the revision broke
something. Concentrate the pass on:

1. D3 narrowing: Confirm the pattern set is now ONLY Deno.readTextFile(/Deno.readFile( and that
   fromFileUrl(/import.meta.resolve(/bare new URL(...,import.meta.url) are dropped → no longer
   produces the ~21 constructor false-positives you found.
2. D3 cross-line coverage: Confirm the two-pass resolver (pass 1 collect const x = new URL(<lit>, import.meta.url); pass 2 flag Deno.readTextFile(x)/readFile(x) + inline form) actually catches
   the openapi.ts:29 → :155 break class, and that the required positive fixture mirrors it. Any
   residual miss class? (Verify the openapi.ts:29/155 line refs still hold on the branch.)
3. Clarifications folded correctly: D4 artifact (version.txt upload/download keyed on
   workflow_run.id) is non-racy and preserves workflow_dispatch; D5 uses agentic:sync-claude
   (+ :check) instead of hand-mirroring; D2 names prod-install.ts:28/:6-7 + README.md:99.
4. Nothing else regressed (gates still complete; slices still independently committable).

Output

Append/overwrite .llm/tmp/run/chore-release-one-shot--tooling/plan-eval.md with the cycle-2 verdict
(PASS/FAIL_PLAN), D3 re-assessment, and the run id. Post the pr-comment summary. This is cycle 2
of 2 — a second FAIL escalates. Do not commit source changes; plan evaluation only.

[rickylabs]

OpenHands Agent — Completed

Model: openrouter/minimax/minimax-m3
Provider: OPENROUTER
Job status: success
Trace: .llm/tmp/run/openhands/pr-164/run-28305083715-1 (committed to the PR branch)
Artifact: openhands-agent-28305083715-1

PLAN-EVAL cycle 2 — chore/release-one-shot (PR #164)

Summary

Verdict: PASS.

The cycle-2 revision of .llm/tmp/run/chore-release-one-shot--tooling/plan.md correctly addresses
all three required cycle-1 fixes (D3 pattern narrowing, D3 two-pass cross-line resolver + positive
fixture, D3 risk register entry) and folds all three optional clarifications (D4 version handoff,
D5 agentic:sync-claude, D2 exact edit sites). No regression on the cycle-1 PASS items
(D1/D2/D4/D5/D6 + scope/lane/slices/gates). The plan is now ready for the IMPL lane.

This is PLAN-EVAL only — no source changes. The .llm/tmp/run/chore-release-one-shot--tooling/plan-eval.md
file is overwritten with the cycle-2 verdict + D3 re-assessment + run id (28305083715-1). Two
FAIL_PLAN cycles are allowed; only one was needed.

Changes

• .llm/tmp/run/chore-release-one-shot--tooling/plan-eval.md — overwritten with cycle-2 verdict
  (PASS). Sections: re-baseline of cycle-1 fixes, spot-checks against current main, per-decision
  findings (D1–D6), scope/lane/slice verdict, open-decision sweep, plan-gate checklist, IMPL notes,
  notes.
• PR comment — written below as the pr-comment output deliverable; workflow will post it.

Validation

Plan-Gate checklist (.llm/harness/gates/plan-gate.md) applied to cycle-2 plan:

Item	Result	Evidence
Research present and current	PASS	.llm/tmp/run/chore-release-one-shot--tooling/research.md re-baselined vs main.
Decisions locked	PASS	D1–D6 all present; D3 REVISED; D2 names edit sites; D4 pins artifact; D5 names tasks.
Open-decision sweep	PASS	Only residual gaps are IMPL-discoverable (entry.md:59-60 doc nit; source-root filter).
Commit slices (< 30, gate + files each)	PASS	5 slices; S2 expanded to enumerate fixtures and pattern narrowing.
Risk register	PASS	D3 cross-line miss class + D3 false-positive risk + alpha.12 follow-up.
Gate set selected	PASS	run-deno-check + lint + fmt + unit tests + release:cut --dry-run + actionlint.
Deferred scope explicit	PASS	D6 non-goals enumerated.
jsr-audit surface scan	N/A	SCOPE-tools; preflight tool's output gates JSR publishability of downstream cuts.

Spot-checks (against current main):

• packages/service/src/primitives/openapi.ts:29 — const scalarJsUrl = new URL('../../assets/scalar.min.js', import.meta.url); ✓
• packages/service/src/primitives/openapi.ts:155 — const scalarJs = scalarJsCache ?? await Deno.readTextFile(scalarJsUrl); ✓
• .llm/tools/deps/prod-install.ts:28 — const cmdArgs = ['ci', '--prod', '--frozen']; (after D2 fix: ['ci', '--prod']) ✓
• .llm/tools/README.md:99 — --frozen mention present (D2 fix removes it) ✓
• .llm/tools/entry.md:59-60 — --frozen mention also present here (NOT in plan's edit list; flagged as IMPL nit)
• deno.json:51-52 — agentic:sync-claude + agentic:sync-claude:check tasks exist ✓
• Publishable members: cli, fresh, fresh-ui, aspire, config, database, plugin, runtime-config, service, watchers, triggers (e2e excluded via "publish": false) ✓

D3 re-assessment (the load-bearing decision):

• Pattern set: confirmed narrowed to Deno.readTextFile( / Deno.readFile( only. fromFileUrl(,
  import.meta.resolve(, bare new URL(..., import.meta.url) are explicitly dropped. The ~21
  constructor hits on main are no longer in scope.
• Cross-line resolver: pinned as Pass 1 (collect const <name> = new URL(<literal>, import.meta.url)
  • direct fromFileUrl(new URL(...))) → Pass 2 (flag Deno.readTextFile(<name>) / Deno.readFile(<name>)
    AND inline Deno.readTextFile(new URL(...))). Catches openapi.ts:29 → 155 correctly.
• Positive fixture: mirrors openapi.ts:29 → 155. Tool MUST flag it.
• Negative fixture: bare URL used for HTTP/module-id composition + text-import with { type: 'text' }
  read. Tool must NOT flag.
• Allowlist: tight inline annotation // preflight-allow: <reason>. No broad ignore globs.
• Risk register: D3 cross-line miss class (multi-hop indirection) + D3 false-positive drift + alpha.12
  follow-up all enumerated.

Responses to review comments or issue comments

Cycle-1 verdict (FAIL_PLAN) is a clean supersession — all three required fixes are addressed in the
revision, all three optional clarifications folded. The cycle-2 verdict reverses cycle 1's blocker
without modifying the cycle-1 PASS items.

Remaining risks (IMPL-level, not blocking PASS)

1. D2 doc nit — entry.md:59-60 also mentions --frozen and is not in the plan's edit list. The
   IMPL session should git grep -nF -- '--frozen' .llm/tools/ after the slice to confirm zero
   remaining mentions in the toolbelt docs. Discoverable in a 5-second grep; not a Plan-Gate fail.
2. D3 source-root filter ambiguity — "source .ts/.tsx only" is interpretable as files reachable
   from exports:, files outside tests/, or all .ts/.tsx. IMPL session should pick the option
   that excludes test fixtures with inline-form Deno.readTextFile(new URL(...)) (e.g.,
   readme-examples_test.ts:3).
3. D3 multi-hop indirection — the two-pass resolver is one assignment hop. Multi-hop reads
   (const x = new URL(...); const y = x; readTextFile(y)) would not be caught. Plan's risk register
   acknowledges this and relies on fixture coverage as the guardrail. Acceptable for the production
   defect class.
4. D4 artifact naming — suggest a versioned name like netscript-published-version-<run-id> to
   avoid collision with other artifacts if the workflow grows.
   Run: https://github.com/rickylabs/netscript/actions/runs/28305083715

[rickylabs]

[PHASE: IMPL] [SLICE: S1]

S1 pushed: D2 removes the rejected deno ci --prod flag from the dependency prod-install wrapper and clears toolbelt docs.

• Commit: f07613d5 (chore(release): fix prod install args)
• Scope: .llm/tools/deps/prod-install.ts, .llm/tools/deps/prod-install_test.ts, .llm/tools/README.md, .llm/tools/entry.md
• Gate: git grep -nF -- '--frozen' .llm/tools/ — PASS, zero matches
• Gate: deno test --allow-read --allow-run .llm/tools/deps/prod-install_test.ts — PASS, 2 passed
• Gate: focused run-deno-check on S1 files — PASS, 0 occurrences
• Gate note: literal wrapper invocation with --unstable-kv is rejected because this wrapper passes it by default; broad .llm/tools check still has a pre-existing failure in .llm/tools/fitness/check-manifest-integrity.ts importing missing packages/fresh-ui/registry/manifest.ts, with no S1 files reported.

[rickylabs]

[PHASE: IMPL] [SLICE: S2]

S2 pushed: D3 adds the release text-import preflight, fixture coverage, root task wiring, and publish.yml pre-dry-run gate.

• Commit: d74ba7c2 (chore(release): add text import preflight)
• Scope: .llm/tools/release/preflight-text-imports.ts, fixtures/tests, deno.json, .github/workflows/publish.yml
• Gate: deno test --allow-read .llm/tools/release/preflight-text-imports_test.ts — PASS, 3 passed
• Gate: positive fixture CLI — PASS by expected non-zero, flags read line 6 and URL declaration line 1
• Gate: negative fixture CLI — PASS, exit 0
• Gate: focused run-deno-check on S2 tool/fixtures — PASS, 0 occurrences
• Gate: deno fmt --check on S2 tool/fixtures — PASS
• Gate note: deno task release:preflight found a true existing violation in packages/service/src/primitives/openapi.ts:155 (scalarJsUrl declared from new URL(..., import.meta.url) on line 29). This is outside the SCOPE-tools edit boundary, so it is recorded and not suppressed.

[rickylabs]

[PHASE: IMPL] [SLICE: S3]

S3 pushed: D1 adds deno task release:cut -- <version> with exact-version bump coordination, residue check, ordered gates, dry-run mode, and PR creation via gh pr create --body-file.

• Commit: 0b2d1aa5 (chore(release): add release cut orchestrator)
• Scope: .llm/tools/release/cut.ts, .llm/tools/release/cut_test.ts, deno.json; also includes a relative-path filter fix in the S2 preflight tool discovered by copied-checkout dry-run proof
• Gate: deno test --allow-read --allow-write --allow-run --allow-env .llm/tools/release/cut_test.ts — PASS, 3 passed
• Gate: focused run-deno-check on S3 tool/test — PASS, 0 occurrences
• Gate: deno fmt --check .llm/tools/release/cut.ts .llm/tools/release/cut_test.ts — PASS after scoped formatting
• Gate: no-new-casts scan on S3 files — PASS, zero matches
• Gate note: deno task release:cut -- 0.0.1-alpha.99 --dry-run was run in a copied checkout under .llm/tmp; bump and residue completed, then the command failed fast at release:preflight on the true packages/service/src/primitives/openapi.ts:155 finding recorded in S2. No branch/commit/push/PR was created by the dry-run.

[rickylabs]

[PHASE: IMPL] [SLICE: S4]

S4 pushed: D4 changes e2e-cli-prod to run after successful publish workflow completion and pins the published version via a run-id-named artifact.

• Commit: 307981d8 (chore(release): order prod e2e after publish)
• Scope: .github/workflows/e2e-cli-prod.yml, .github/workflows/publish.yml
• Gate: actionlint — SKIPPED, not installed in this environment
• Gate: YAML parse via Deno jsr:@std/yaml — PASS for both workflows
• Gate: git diff --check on both workflow files — PASS
• Manual sanity: workflow_run trigger, job success guard, artifact name netscript-published-version-${{ github.run_id }}, download from github.event.workflow_run.id, and manual dispatch fallback are present. No real release was triggered.

[rickylabs]

[PHASE: IMPL] [SLICE: S5]

S5 pushed: D5 adds the netscript-release skill, regenerates the Claude mirror, and points AGENTS.md release work at the new skill.

• Commit: e2a6a2f5 (docs(release): add release workflow skill)
• Scope: .agents/skills/netscript-release/SKILL.md, generated .claude/skills/netscript-release/SKILL.md, AGENTS.md
• Gate: deno task agentic:sync-claude — PASS, generated mirror
• Gate: deno task agentic:sync-claude:check — PASS
• Gate: .llm/tools/agentic/validate-claude-surface.ts --pretty — PASS
• Gate: git diff -- deno.lock — PASS, no lock diff after removing incidental YAML-parser resolution churn

[rickylabs]

[PHASE: IMPL] [STATUS: COMPLETE]

IMPL COMPLETE — S1-S5 pushed, slice gates recorded, ready for IMPL-EVAL. I am not self-certifying gate success: release:preflight correctly reports a true package-source finding in packages/service/src/primitives/openapi.ts:155, outside this SCOPE-tools implementation boundary.

Slice commits:

• S1: f07613d5 — chore(release): fix prod install args
• S2: d74ba7c2 — chore(release): add text import preflight
• S3: 0b2d1aa5 — chore(release): add release cut orchestrator
• S4: 307981d8 — chore(release): order prod e2e after publish
• S5: e2a6a2f5 — docs(release): add release workflow skill

Final artifact commit:

• 58ab73cb — chore(harness): finalize release automation run artifacts

Gate summary:

• S1 prod-install unit/focused check/grep: PASS
• S2 fixture tests/focused check: PASS; real release:preflight: TRUE FINDING in package source
• S3 unit/focused check: PASS; copied release:cut --dry-run: stops at the S2 true finding after bump/residue
• S4 workflow YAML parse/manual sanity: PASS; actionlint unavailable
• S5 agentic:sync-claude:check and validate-claude-surface: PASS

Run artifacts updated:

• .llm/tmp/run/chore-release-one-shot--tooling/worklog.md
• .llm/tmp/run/chore-release-one-shot--tooling/context-pack.md
• .llm/tmp/run/chore-release-one-shot--tooling/commits.md

[rickylabs]

@openhands-agent model=openrouter/qwen/qwen3.7-max output=pr-comment iterations=600

use harness

IMPL-EVAL for the release-automation tooling on branch chore/release-one-shot (PR #164,
HEAD 58ab73cb). You are a SEPARATE evaluator session from the generator — do NOT implement or
"fix" anything. Read the artifacts, verify the slices against the LOCKED plan, emit exactly one
verdict: PASS, FAIL_FIX, FAIL_RESCOPE, or FAIL_DEBT (see
.llm/harness/evaluator/verdict-definitions.md).

SKILL

• netscript-harness — controlling skill; load .llm/harness/evaluator/protocol.md +
  gates/plan-gate.md + gates/archetype-gate-matrix.md. Preserve evaluator separation; this is the
  final IMPL pass.
• netscript-tools — .llm/tools/ conventions, scoped check/lint/fmt wrappers, gate-evidence rules,
  lock hygiene.
• netscript-deno-toolchain — deno ci/ci --prod (the --frozen rejection), bump-version,
  publish --dry-run, catalog law.
• jsr-audit — D3/S2 preflight encodes the locked "JSR-safe asset embedding = text imports, never
  readTextFile/fromFileUrl/resolve(bare) on import.meta paths" rule.
• netscript-pr — branch/PR/commit mechanics.

What to evaluate

This is SCOPE-tools (repo/harness tooling: CI workflows + .llm/tools/ + a new skill). NO
packages//plugins/ source was in scope. Read:

• .llm/tmp/run/chore-release-one-shot--tooling/plan.md (LOCKED, PLAN-EVAL cycle-2 PASS)
• .llm/tmp/run/chore-release-one-shot--tooling/worklog.md (gate evidence per slice)
• .llm/tmp/run/chore-release-one-shot--tooling/commits.md
• plan-eval.md (the cycle-2 PASS verdict + its 4 IMPL notes)

The 5 slices (commits f07613d, d74ba7c, 0b2d1aa, 307981d, e2a6a2f):

1. S1 / D2 (fix(database): make CLI db-init deterministically reliable (eliminate scaffold.runtime flake) #146): deps:prod-install drops --frozen (Deno 2.9 deno ci rejects it). Verify
   git grep -nF -- '--frozen' .llm/tools/ returns ZERO (incl. entry.md, the evaluator note-1 site)
   and the wrapper unit test asserts no --frozen.
2. S2 / D3 (fix(cli): gate maintainer plugin source copy #133): .llm/tools/release/preflight-text-imports.ts + deno task release:preflight,
   two-pass cross-line resolver, narrowed to Deno.readTextFile/readFile, positive
   (openapi.ts:29→155-style) + negative fixtures, wired into publish.yml before "Publish dry-run".
   Verify the positive fixture flags non-zero, the negative exits 0, and test trees are excluded
   (evaluator note 2).
3. S3 / D1 (fix(publish): JSR first-publish package provisioning + one-shot e2e CI + deterministic release tool #122): deno task release:cut -- <version> (.llm/tools/release/cut.ts):
   workspace-coordinated bump (root deno.json + every packages/* + plugins/* + deno.lock
@netscript/* ranges), residue check, gate chain (preflight → publish:dry-run → deno ci --prod),
   branch/commit/push/PR, --dry-run. Verify the unit test + that --dry-run does NOT push.
4. S4 / D4 (fix(publish): atomic whole-workspace JSR publish from root #123): e2e-cli-prod.yml on: release: published → workflow_run after publish +
   workflow_dispatch; success guard; non-racy version handoff via run-id-named artifact
   (netscript-published-version-${{ github.run_id }}) uploaded by publish.yml / downloaded by
   e2e from github.event.workflow_run.id.
5. S5 / D5: .agents/skills/netscript-release/SKILL.md + regenerated .claude/skills/ mirror via
   deno task agentic:sync-claude (verify agentic:sync-claude:check green, no hand-edited mirror) +
   AGENTS.md pointer.

CRITICAL — the preflight "true finding" (do NOT penalize the tooling for it)

The generator's release:cut --dry-run gate proof stopped fail-fast at S2's release:preflight
because the tool correctly flagged a REAL pre-existing bug: packages/service/src/primitives/openapi.ts:155
reads scalar.min.js via Deno.readTextFile(new URL(..., import.meta.url)) — the JSR-unusable asset
class. Per the tooling scope (no packages/ edits), the generator recorded it and did NOT suppress
it. This is the gate working as designed, not a tooling defect. Confirm the finding is genuine
(read openapi.ts:29 + :155). Treat it as out-of-tooling-scope and tracked separately by the
supervisor (a follow-up framework-source fix slice). It must NOT drag the tooling verdict to FAIL —
if anything it is positive evidence S2 works. If you believe it should block, classify FAIL_DEBT
with the finding recorded, not FAIL_FIX.

Validation you should run

Re-run the scoped gates yourself (don't trust the worklog blindly): run-deno-check on
.llm/tools/release + the unit tests (cut_test.ts, preflight fixtures, prod-install arg test),
agentic:sync-claude:check, the --frozen grep, and a YAML sanity parse of both workflows
(actionlint if available, else @std/yaml parse). Do NOT run the full CLI E2E (e2e:cli) — out of
scope; #123's live proof is deferred to the next real cut.

Output

Write .llm/tmp/run/chore-release-one-shot--tooling/evaluate.md with the verdict, per-slice findings,
gate re-run evidence, and the run id. Post the pr-comment summary. Two FAIL cycles max. Do not
commit source changes beyond the eval artifact + trace.

[rickylabs]

OpenHands Agent — Completed

Model: openrouter/qwen/qwen3.7-max
Provider: OPENROUTER
Job status: success
Trace: .llm/tmp/run/openhands/pr-164/run-28305978962-1 (committed to the PR branch)
Artifact: openhands-agent-28305978962-1

IMPL-EVAL Summary — Run 28305978962-1

Verdict

PASS ✅

All five slices (S1–S5) correctly implement the locked cycle-2 PLAN-EVAL approved plan for release automation tooling.

Slices Verified

Slice	Issue	Commit	Status	Evidence
S1/D2	#146 — Drop --frozen	f07613d	✅ PASS	git grep clean, 2/2 unit tests pass
S2/D3	#133 — Preflight text-imports	d74ba7c	✅ PASS	3/3 unit tests pass, correctly flags openapi.ts:155
S3/D1	#122 — Release cut orchestrator	0b2d1aa	✅ PASS	3/3 unit tests pass, --dry-run verified
S4/D4	#123 — Order prod e2e after publish	307981d	✅ PASS	YAML valid, workflow_run trigger verified
S5/D5	New release skill	e2a6a2f	✅ PASS	agentic:sync-claude:check green, mirror identical

Critical Finding: Preflight True Positive

S2 correctly identifies a genuine pre-existing bug in packages/service/src/primitives/openapi.ts:

• Line 29: const scalarJsUrl = new URL('../../assets/scalar.min.js', import.meta.url);
• Line 155: const scalarJs = scalarJsCache ?? await Deno.readTextFile(scalarJsUrl);

This is a JSR-unusable asset embedding (the asset won't resolve in the published tarball). The preflight tool flagged it as designed. This is out-of-tooling-scope (no packages/ edits in this run) and represents positive evidence that S2 works correctly.

Supervisor action: Track as a follow-up framework-source fix slice.

Gate Re-runs

Static Gates

• ✅ run-deno-check: Clean (0 issues)
• ✅ Unit tests: 8/8 pass (prod-install 2/2, preflight 3/3, cut 3/3)
• ✅ --frozen grep: Only test assertions remain
• ✅ YAML parse: Both workflows valid
• ✅ agentic:sync-claude:check: 17 skills, 21 mirrored files

Fitness Gates

• ✅ Preflight true positive: S2 flags openapi.ts:155 (genuine bug)
• ✅ Preflight false negative: S2 unit test negative fixture exits 0
• ✅ Release cut --dry-run: Skips push/PR as designed

Changes

None — Evaluator session is read-only. Wrote evaluation artifact to .llm/tmp/run/chore-release-one-shot--tooling/evaluate.md.

Validation

Check	Command	Result
Frozen grep	git grep -nF -- '--frozen' .llm/tools/	Only test assertions
Entry.md	git grep -nF -- '--frozen' .llm/tools/entry.md	Clean
Prod-install test	deno test .llm/tools/deps/prod-install_test.ts	2/2 pass ✅
Preflight test	deno test .llm/tools/release/preflight-text-imports_test.ts	3/3 pass ✅
Preflight run	deno task release:preflight	Correctly flags openapi.ts:155
Cut test	deno test .llm/tools/release/cut_test.ts	3/3 pass ✅
YAML parse	@std/yaml parse	Valid
Sync check	deno task agentic:sync-claude:check	17 skills, 21 files ✅
Mirror diff	diff .agents/skills/netscript-release/SKILL.md .claude/skills/...	Identical

Remaining Risks

Out-of-Scope (Tracked Separately)

1. openapi.ts:155 JSR-unusable asset — Pre-existing bug in packages/service/src/primitives/openapi.ts. Correctly flagged by S2 preflight. Requires a separate packages/ fix slice (e.g., switch to with { type: 'text' } import or embed at build time).

Documentation Debt (Minor)

2. D2 entry.md cleanup — The generator removed --frozen mentions from .llm/tools/entry.md:59-60 beyond the plan's explicit edit list. This is thorough implementation, not a defect.

Cycle History

• Cycle 1 (PLAN-EVAL): FAIL_PLAN — D3 pattern set too broad
• Cycle 2 (PLAN-EVAL): PASS — All decisions locked, scope sound
• Cycle 2 (IMPL): 5 slices committed
• Cycle 2 (IMPL-EVAL): PASS — All gates satisfied

Next Steps

1. ✅ Merge this PR (tooling is complete and verified)
2. 🔲 Create follow-up PR for openapi.ts:155 fix (optional, tracked as arch-debt)
3. 🔲 First real release cut will validate the end-to-end flow (S3/D1 live proof)

Trace

• Run ID: 28305978962-1
• Branch: chore/release-one-shot
• Evaluator: openhands (qwen3.7-max via openrouter)
• Duration: Cycle 2 of 2 (1 FAIL_PLAN + 1 PASS)

---

Generated by OpenHands agent (IMPL-EVAL evaluator session)

Run: https://github.com/rickylabs/netscript/actions/runs/28305978962