\\n>

⌛ How to resolve this issue?

\\n> \\n> After more reviews become available, a review can be triggered using the `@coderabbitai review` command as a PR comment. Alternatively, push new commits to this PR.\\n> \\n> To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.\\n> \\n>

\\n> \\n> \\n>

\\n>

🚦 How do rate limits work?

\\n> \\n> CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.\\n> \\n> \\tFor paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.\\n> \\n> Please see our [Fair Usage Limits Policy](https://docs.coderabbit.ai/management/plans#fair-usage-limits-policy) for further information.\\n> \\n>

\\n> \\n>

\\n>

ℹ️ Review info

\\n> \\n>

\\n>

⚙️ Run configuration

\\n> \\n> **Configuration used**: Organization UI\\n> \\n> **Review profile**: ASSERTIVE\\n> \\n> **Plan**: Pro\\n> \\n> **Run ID**: `684743d7-f5bc-43ab-85f2-c90f6cde8cee`\\n> \\n>

\\n> \\n>

\\n>

📥 Commits

\\n> \\n> Reviewing files that changed from the base of the PR and between f5e0c10d5d5e6070b5718e08c3578d630a40f340 and 855f60f8f951b6ed6ab2bcac42263cef786e39ac.\\n> \\n>

\\n> \\n>

\\n>

📒 Files selected for processing (5)

\\n> \\n> * `.github/workflows/auto-release-tag.yml`\\n> * `docs/topics/release-process/policy.toml`\\n> * `docs/topics/release-process/runbook.md`\\n> * `docs/topics/release-process/test-plan.md`\\n> * `xtask/src/main.rs`\\n> \\n>

\\n> \\n>

\\n\\n\\n\\n\\n\\n## Walkthrough\\n\\nThe release-tag workflow now supports manual dispatch alongside the existing CI-triggered path, validates the supplied commit against main, and publishes tags through an authenticated Git remote. Related policy, runbook, and test updates describe and verify the manual recovery path.\\n\\n## Changes\\n\\n**Manual release tag recovery**\\n\\n|Layer / File(s)|Summary|\\n|---|---|\\n|**Manual dispatch contract**
`.github/workflows/auto-release-tag.yml`, `docs/topics/release-process/*`, `xtask/src/main.rs`|`workflow_dispatch` adds tag and SHA inputs, release-policy settings record the manual recovery trigger and SHA rule, the runbook describes the dispatch fallback, and the workflow-guard test checks the new trigger and inputs.|\\n|**Manual recovery validation**
`.github/workflows/auto-release-tag.yml`, `xtask/src/main.rs`|The `identify-release-pr` job now branches on manual dispatch, validates tag and SHA formats, checks SHA reachability from `origin/main`, verifies the release notes file, and emits `release=true`, `tag`, `pr=manual`, and `sha`; the new test asserts that contract.|\\n|**Authenticated tag publishing**
`.github/workflows/auto-release-tag.yml`, `xtask/src/main.rs`|`create-release-tag` now builds `AUTHENTICATED_ORIGIN` and uses it for tag lookup, fetch, and push, replacing the extraheader-based Git setup; the credential test was updated to match the new command flow.|\\n\\n## Sequence Diagram(s)\\n\\n```mermaid\\nsequenceDiagram\\n participant workflow_dispatch as \\\"workflow_dispatch\\\"\\n participant identify_release_pr as \\\"identify-release-pr\\\"\\n participant create_release_tag as \\\"create-release-tag\\\"\\n participant origin_main as \\\"origin/main\\\"\\n\\n workflow_dispatch->>identify_release_pr: tag, sha inputs\\n identify_release_pr->>origin_main: fetch tags and verify SHA ancestry\\n identify_release_pr-->>create_release_tag: release=true, tag, pr=manual, sha\\n create_release_tag->>origin_main: ls-remote, fetch, push tag via AUTHENTICATED_ORIGIN\\n```\\n\\n## Estimated code review effort\\n\\n🎯 3 (Moderate) | ⏱️ ~25 minutes\\n\\n## Possibly related PRs\\n\\n- [flyingrobots/edict#43](https://github.com/flyingrobots/edict/pull/43): Introduced the `auto-release-tag` workflow and `xtask` checks that this PR extends with manual dispatch recovery and authenticated tag publishing.\\n\\n## Poem\\n\\n> A tag woke up with SHA in hand ✨ \\n> It walked `main`’s path and stayed on land. \\n> It fetched, it checked, it would not stray, \\n> Then pushed its crown the proper way. \\n> Release notes smiled: “All clear today.”\\n\\n\\n\\n\\n

\\n

🚥 Pre-merge checks | ✅ 5

\\n\\n

\\n

✅ Passed checks (5 passed)

\\n\\n_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}\\n\\n

\\n\\n\\n\\n\\n---\\n\\nThanks for using [CodeRabbit](https://coderabbit.ai?utm_source=oss&utm_medium=github&utm_campaign=flyingrobots/edict&utm_content=44)! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.\\n\\n

\\n

❤️ Share

\\n\\n- [X](https://twitter.com/intent/tweet?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A&url=https%3A//coderabbit.ai)\\n- [Mastodon](https://mastodon.social/share?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A%20https%3A%2F%2Fcoderabbit.ai)\\n- [Reddit](https://www.reddit.com/submit?title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&text=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code.%20Check%20it%20out%3A%20https%3A//coderabbit.ai)\\n- [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fcoderabbit.ai&mini=true&title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&summary=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code)\\n\\n

\\n\\n\\n_{Comment `@coderabbitai help` to get the list of available commands.}\\n\\n\",\"path\":null,\"side\":null,\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Require successful CI for manual recovery**\\n\\nWhen this is manually dispatched, the left side lets the job run without the `github.event.workflow_run.conclusion == 'success'` guard, and the manual block only checks SHA shape, `origin/main` reachability, and release notes. For a release-prep merge whose main CI failed or never completed, an operator can still create the immutable tag and dispatch publication for that SHA, even though `docs/topics/release-process/policy.toml` keeps `main_ci_success` as a required release check; require a successful CI run/check for `inputs.sha` before setting `release=true`.\\n\\nUseful? React with 👍 / 👎.\",\"path\":\".github/workflows/auto-release-tag.yml\",\"side\":\"RIGHT\",\"line\":30}{\"type\":\"pull_request_comment\",\"body\":\"**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Verify the manual SHA came from the release-prep PR**\\n\\nIn the `workflow_dispatch` path, these outputs trust the operator-provided tag after only reachability and notes checks, without querying `/commits/${SHA}/pulls` or confirming that the commit came from a merged `release/vX.Y.Z-alpha.N-prep` PR that derives the same tag. Even after adding a CI-success check, a mistyped reachable `main` SHA with a matching release-notes file and zero-open milestone would be tagged and published, bypassing the release-prep PR contract still listed in `policy.toml` as `merged_release_pr`.\\n\\nUseful? React with 👍 / 👎.\",\"path\":\".github/workflows/auto-release-tag.yml\",\"side\":\"RIGHT\",\"line\":131}{\"type\":\"pull_request_comment\",\"body\":\"**_{_{![P1 Badge](https://img.shields.io/badge/P1-orange?style=flat)}} Add manual recovery to the topic test plan**\\n\\nThis adds a new manual recovery workflow contract, but `docs/topics/release-process/test-plan.md` still has no requirement or case for `workflow_dispatch` recovery; its automation case only describes successful main-CI release-prep merges. `/workspace/edict/AGENTS.md` requires workflow and contract changes to update the owning topic `test-plan.md` before or alongside tests, so the durable contract graph omits the new behavior and future drift checks do not state what manual recovery must prove.\\n\\nUseful? React with 👍 / 👎.\",\"path\":\"docs/topics/release-process/policy.toml\",\"side\":\"RIGHT\",\"line\":14}{\"type\":\"pull_request_comment\",\"body\":\"\\n### 💡 Codex Review\\n\\nHere are some automated review suggestions for this pull request.\\n\\n**Reviewed commit:** `f5e0c10d5d`\\n \\n\\n

ℹ️ About Codex in GitHub

\\n
\\n\\n[Your team has set up Codex to review pull requests in this repo](https://chatgpt.com/codex/cloud/settings/general). Reviews are triggered when you\\n- Open a pull request for review\\n- Mark a draft as ready\\n- Comment \\\"@codex review\\\".\\n\\nIf Codex has suggestions, it will comment; otherwise it will react with 👍.\\n\\n\\n\\n\\nCodex can also answer questions or update the PR. Try commenting \\\"@codex address that feedback\\\".\\n \\n

\",\"path\":null,\"side\":null,\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"_🗄️ Data Integrity & Integration_ | _🟠 Major_ | _⚡ Quick win_\\n\\n**Do not let manual dispatch mint arbitrary release tags.**\\n\\nLines 65-88 currently trust `INPUT_TAG` after only a broad SemVer check, so any `docs/releases/.md` file can be paired with any `origin/main`-reachable SHA. That bypasses the alpha-only `release/v…-prep -> v…-alpha.N` contract used on the automatic path, and because this workflow later refuses tag mutation, one operator typo can permanently create the wrong immutable release tag on the wrong commit. Reuse the existing `/commits/${SHA}/pulls` lookup here and require the derived release-prep tag to match `INPUT_TAG` (or derive `TAG` from the PR outright). \\n \\n\\n

\\n

Suggested direction

\\n\\n```diff\\n if [[ \\\"${EVENT_NAME}\\\" == \\\"workflow_dispatch\\\" ]]; then\\n- TAG=\\\"${INPUT_TAG}\\\"\\n-\\n if [[ ! \\\"${SHA}\\\" =~ ^[0-9a-f]{40}$ ]]; then\\n echo \\\"::error::Manual recovery SHA must be a full 40-character commit SHA: ${SHA}\\\"\\n exit 1\\n fi\\n-\\n- if [[ ! \\\"${TAG}\\\" =~ ^v[0-9]+\\\\.[0-9]+\\\\.[0-9]+(-[0-9A-Za-z.]+)?$ ]]; then\\n- echo \\\"::error::Manual recovery tag must look like a SemVer v* tag: ${TAG}\\\"\\n- exit 1\\n- fi\\n\\n git fetch origin main:refs/remotes/origin/main --tags\\n\\n if ! git merge-base --is-ancestor \\\"${SHA}\\\" origin/main; then\\n echo \\\"::error::Manual recovery SHA must be reachable from origin/main.\\\"\\n exit 1\\n fi\\n+\\n+ PRS_JSON=\\\"$(gh api \\\\\\n+ -H \\\"Accept: application/vnd.github+json\\\" \\\\\\n+ \\\"/repos/${GITHUB_REPOSITORY}/commits/${SHA}/pulls\\\")\\\"\\n+ MATCHES=\\\"$(jq '[.[] | select(\\n+ .merged_at != null and\\n+ .base.ref == \\\"main\\\" and\\n+ (.head.ref | test(\\\"^release/v[0-9]+\\\\\\\\.[0-9]+\\\\\\\\.[0-9]+-alpha\\\\\\\\.[0-9]+-prep$\\\"))\\n+ )]' <<<\\\"${PRS_JSON}\\\")\\\"\\n+ if [[ \\\"$(jq 'length' <<<\\\"${MATCHES}\\\")\\\" != \\\"1\\\" ]]; then\\n+ echo \\\"::error::Manual recovery SHA must resolve to exactly one merged release-prep PR.\\\"\\n+ exit 1\\n+ fi\\n+\\n+ HEAD_REF=\\\"$(jq -r '.[0].head.ref' <<<\\\"${MATCHES}\\\")\\\"\\n+ RELEASE_BRANCH_REGEX='^release/(v[0-9]+\\\\.[0-9]+\\\\.[0-9]+-alpha\\\\.[0-9]+)-prep$'\\n+ if [[ ! \\\"${HEAD_REF}\\\" =~ ${RELEASE_BRANCH_REGEX} ]]; then\\n+ echo \\\"::error::Release branch did not match expected pattern: ${HEAD_REF}\\\"\\n+ exit 1\\n+ fi\\n+\\n+ TAG=\\\"${BASH_REMATCH[1]}\\\"\\n+ if [[ \\\"${TAG}\\\" != \\\"${INPUT_TAG}\\\" ]]; then\\n+ echo \\\"::error::Manual recovery tag ${INPUT_TAG} does not match the merged release-prep PR tag ${TAG}.\\\"\\n+ exit 1\\n+ fi\\n\\n NOTES=\\\"docs/releases/${TAG}.md\\\"\\n```\\n

\\n\\n\\n\\n

\\n

📝 Committable suggestion

\\n\\n> ‼️ **IMPORTANT**\\n> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.\\n\\n```suggestion\\n if [[ \\\"${EVENT_NAME}\\\" == \\\"workflow_dispatch\\\" ]]; then\\n if [[ ! \\\"${SHA}\\\" =~ ^[0-9a-f]{40}$ ]]; then\\n echo \\\"::error::Manual recovery SHA must be a full 40-character commit SHA: ${SHA}\\\"\\n exit 1\\n fi\\n\\n git fetch origin main:refs/remotes/origin/main --tags\\n\\n if ! git merge-base --is-ancestor \\\"${SHA}\\\" origin/main; then\\n echo \\\"::error::Manual recovery SHA must be reachable from origin/main.\\\"\\n exit 1\\n fi\\n\\n PRS_JSON=\\\"$(gh api \\\\\\n -H \\\"Accept: application/vnd.github+json\\\" \\\\\\n \\\"/repos/${GITHUB_REPOSITORY}/commits/${SHA}/pulls\\\")\\\"\\n MATCHES=\\\"$(jq '[.[] | select(\\n .merged_at != null and\\n .base.ref == \\\"main\\\" and\\n (.head.ref | test(\\\"^release/v[0-9]+\\\\\\\\.[0-9]+\\\\\\\\.[0-9]+-alpha\\\\\\\\.[0-9]+-prep$\\\"))\\n )]' <<<\\\"${PRS_JSON}\\\")\\\"\\n if [[ \\\"$(jq 'length' <<<\\\"${MATCHES}\\\")\\\" != \\\"1\\\" ]]; then\\n echo \\\"::error::Manual recovery SHA must resolve to exactly one merged release-prep PR.\\\"\\n exit 1\\n fi\\n\\n HEAD_REF=\\\"$(jq -r '.[0].head.ref' <<<\\\"${MATCHES}\\\")\\\"\\n RELEASE_BRANCH_REGEX='^release/(v[0-9]+\\\\.[0-9]+\\\\.[0-9]+-alpha\\\\.[0-9]+)-prep$'\\n if [[ ! \\\"${HEAD_REF}\\\" =~ ${RELEASE_BRANCH_REGEX} ]]; then\\n echo \\\"::error::Release branch did not match expected pattern: ${HEAD_REF}\\\"\\n exit 1\\n fi\\n\\n TAG=\\\"${BASH_REMATCH[1]}\\\"\\n if [[ \\\"${TAG}\\\" != \\\"${INPUT_TAG}\\\" ]]; then\\n echo \\\"::error::Manual recovery tag ${INPUT_TAG} does not match the merged release-prep PR tag ${TAG}.\\\"\\n exit 1\\n fi\\n\\n NOTES=\\\"docs/releases/${TAG}.md\\\"\\n\\n if [[ ! -f \\\"${NOTES}\\\" ]]; then\\n echo \\\"::error::Missing release notes file: ${NOTES}\\\"\\n exit 1\\n fi\\n\\n {\\n echo \\\"release=true\\\"\\n echo \\\"tag=${TAG}\\\"\\n echo \\\"pr=manual\\\"\\n echo \\\"sha=${SHA}\\\"\\n } >>\\\"${GITHUB_OUTPUT}\\\"\\n```\\n\\n

\\n\\n\\n\\n

\\n

🤖 Prompt for AI Agents

\\n\\n```\\nVerify each finding against current code. Fix only still-valid issues, skip the\\nrest with a brief reason, keep changes minimal, and validate.\\n\\nIn @.github/workflows/auto-release-tag.yml around lines 57 - 89, The manual\\ndispatch path in the auto-release workflow is too permissive because it trusts\\nINPUT_TAG after only a SemVer check, allowing arbitrary release tags to be\\nminted for any origin/main-reachable SHA. Update the workflow logic around the\\nworkflow_dispatch branch to reuse the existing commit-to-PR lookup used\\nelsewhere in this job, derive the expected release-prep tag from that PR, and\\nrequire it to match INPUT_TAG (or set TAG directly from the PR data). Keep the\\nrelease notes file check, but ensure the TAG/sha pairing cannot be manually\\nmismatched before writing to GITHUB_OUTPUT.\\n```\\n\\n

\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n✅ Addressed in commit 855f60f\",\"path\":\".github/workflows/auto-release-tag.yml\",\"side\":\"RIGHT\",\"line\":131}{\"type\":\"pull_request_comment\",\"body\":\"**Actionable comments posted: 1**\\n\\n

\\n

🤖 Prompt for all review comments with AI agents

\\n\\n```\\nVerify each finding against current code. Fix only still-valid issues, skip the\\nrest with a brief reason, keep changes minimal, and validate.\\n\\nInline comments:\\nIn @.github/workflows/auto-release-tag.yml:\\n- Around line 57-89: The manual dispatch path in the auto-release workflow is\\ntoo permissive because it trusts INPUT_TAG after only a SemVer check, allowing\\narbitrary release tags to be minted for any origin/main-reachable SHA. Update\\nthe workflow logic around the workflow_dispatch branch to reuse the existing\\ncommit-to-PR lookup used elsewhere in this job, derive the expected release-prep\\ntag from that PR, and require it to match INPUT_TAG (or set TAG directly from\\nthe PR data). Keep the release notes file check, but ensure the TAG/sha pairing\\ncannot be manually mismatched before writing to GITHUB_OUTPUT.\\n```\\n\\n

\\n\\n

\\n

🪄 Autofix (Beta)

\\n\\nFix all unresolved CodeRabbit comments on this PR:\\n\\n- [ ] Push a commit to this branch (recommended)\\n- [ ] Create a new PR with the fixes\\n\\n

\\n\\n---\\n\\n

\\n

ℹ️ Review info

\\n\\n

\\n

⚙️ Run configuration

\\n\\n**Configuration used**: Organization UI\\n\\n**Review profile**: ASSERTIVE\\n\\n**Plan**: Pro\\n\\n**Run ID**: `5120a2b7-38e3-4b7f-b967-67baff0eb34f`\\n\\n

\\n\\n

\\n

📥 Commits

\\n\\nReviewing files that changed from the base of the PR and between e680adf0a3ccc72559d1c4710e81010738918532 and f5e0c10d5d5e6070b5718e08c3578d630a40f340.\\n\\n

\\n\\n

\\n

📒 Files selected for processing (4)

\\n\\n* `.github/workflows/auto-release-tag.yml`\\n* `docs/topics/release-process/policy.toml`\\n* `docs/topics/release-process/runbook.md`\\n* `xtask/src/main.rs`\\n\\n

\\n\\n

\\n

📜 Review details

\\n\\n

\\n

🧰 Additional context used

\\n\\n

\\n

📓 Path-based instructions (1)

\\n\\n

\\n

\\n\\n\\n**⚙️ CodeRabbit configuration file**\\n\\n> `**`: # AGENTS\\n> \\n> ## Git Rules\\n> \\n> NEVER amend git commits. Make a new commit instead.\\n> \\n> NEVER use `git rebase` unless the user explicitly approves a rare exception.\\n> Use regular merge commits.\\n> \\n> NEVER force any git operation. If a force operation appears necessary, stop and\\n> explain what happened and what options remain.\\n> \\n> NEVER create draft pull requests.\\n> \\n> NEVER use a `codex` prefix in branch names, PR titles, or commit messages.\\n> \\n> Pull request bodies for issue work MUST include GitHub auto-close text such as\\n> `Closes `#123`` for every issue the PR is intended to close.\\n> \\n> ## Think\\n> \\n> Think is durable memory for cross-session coordination.\\n> \\n> - Use `codex-think --remember --json` when starting a new session, changing into\\n> this repository, or regaining context after a context shift.\\n> - Use `codex-think \\\"...\\\" --json` when a cycle closes or a significant event\\n> should survive across turns.\\n> - Treat Think as memory, not repo truth. Anchor strong claims back to files,\\n> commits, commands, issues, or pull requests.\\n> - Claude memories are read-only. Use `claude-think --remember --json` only for\\n> additional context.\\n> \\n> ## Topic Shelves\\n> \\n> `docs/topics/` contains the living contract graph for landed behavior. Topic\\n> shelves are not proposals, retrospectives, or design archaeology.\\n> \\n> Each shelf may contain:\\n> \\n> - `README.md`: what is true in HEAD.\\n> - `test-plan.md`: how those truths are verified, including requirements, cases,\\n> fixtures, oracles, implemented evidence, planned cases, and known gaps.\\n> - `architecture.md`: optional structure or dataflow notes when the machinery\\n> earns a separate page.\\n> - `rationale.md`: optional still-relevant tradeoffs and rejected approaches.\\n> \\n> ### When To Update Topic Shelves\\n> \\n> For every nontrivial behavior, contract, workflow, release, schema, validation,\\n> or public-surface change:\\n> \\n> 1. Identify the owning topic shelf before editing code.\\n> 2. If no shelf owns durable behavior, create one.\\n> 3. Update `test-plan.md` before or alongside tests with requirement IDs, case\\n> IDs,...\\n\\nFiles:\\n- `docs/topics/release-process/policy.toml`\\n- `docs/topics/release-process/runbook.md`\\n- `xtask/src/main.rs`\\n\\n

\\n\\n

\\n\\n\",\"path\":null,\"side\":null,\"line\":null}","text_elements",[],{"_419":679,"_400":401,"_421":407},{"_422":680,"_424":-5,"_42":-5,"_425":-5,"_426":-5,"_96":330,"_92":428},[681],{"_46":675,"_92":682},"input_text",{"_419":684,"_400":401,"_421":407},{"_422":685,"_424":-5,"_42":-5,"_425":-5,"_426":-5,"_96":330,"_92":428},[686,687],{"_46":689,"_92":682},{"_46":688,"_92":682},"\n /workspace/edict\n bash\n 2026-06-25\n Etc/UTC\n","# AGENTS.md instructions for /workspace/edict\n\n\n# AGENTS\n\n## Git Rules\n\nNEVER amend git commits. Make a new commit instead.\n\nNEVER use `git rebase` unless the user explicitly approves a rare exception.\nUse regular merge commits.\n\nNEVER force any git operation. If a force operation appears necessary, stop and\nexplain what happened and what options remain.\n\nNEVER create draft pull requests.\n\nNEVER use a `codex` prefix in branch names, PR titles, or commit messages.\n\nPull request bodies for issue work MUST include GitHub auto-close text such as\n`Closes #123` for every issue the PR is intended to close.\n\n## Think\n\nThink is durable memory for cross-session coordination.\n\n- Use `codex-think --remember --json` when starting a new session, changing into\n this repository, or regaining context after a context shift.\n- Use `codex-think \"...\" --json` when a cycle closes or a significant event\n should survive across turns.\n- Treat Think as memory, not repo truth. Anchor strong claims back to files,\n commits, commands, issues, or pull requests.\n- Claude memories are read-only. Use `claude-think --remember --json` only for\n additional context.\n\n## Topic Shelves\n\n`docs/topics/` contains the living contract graph for landed behavior. Topic\nshelves are not proposals, retrospectives, or design archaeology.\n\nEach shelf may contain:\n\n- `README.md`: what is true in HEAD.\n- `test-plan.md`: how those truths are verified, including requirements, cases,\n fixtures, oracles, implemented evidence, planned cases, and known gaps.\n- `architecture.md`: optional structure or dataflow notes when the machinery\n earns a separate page.\n- `rationale.md`: optional still-relevant tradeoffs and rejected approaches.\n\n### When To Update Topic Shelves\n\nFor every nontrivial behavior, contract, workflow, release, schema, validation,\nor public-surface change:\n\n1. Identify the owning topic shelf before editing code.\n2. If no shelf owns durable behavior, create one.\n3. Update `test-plan.md` before or alongside tests with requirement IDs, case\n IDs, fixtures, and oracles.\n4. Write executable evidence: deterministic tests, fixtures, doctests, or\n contract checks as appropriate.\n5. Update the topic `README.md` only after behavior exists in the branch. The\n README describes current branch truth, not intended future behavior.\n6. Mark planned cases as implemented only when executable evidence exists.\n7. Run `cargo xtask verify` before claiming the shelf is current.\n\n### When Not To Update Topic Shelves\n\nDo not churn topic shelves for purely mechanical edits that do not change a\ncontract, such as formatting, typo fixes, dependency pin updates with no\nobservable behavior change, or internal refactors whose existing tests and topic\nclaims remain accurate.\n\nWhen a change intentionally does not update a topic shelf, state why in the pull\nrequest body or final report.\n\n### Topic Shelf Discipline\n\n- Topic `README.md` files must not describe intended behavior before it lands.\n- `test-plan.md` may include planned cases and known gaps.\n- `policy` rows are for human-review workflow contracts. They must not be used\n to avoid writing behavior tests for software behavior.\n- Tests assert code behavior and stable contract artifacts, not prose.\n- Negative tests should assert stable error kinds or structured artifacts, not\n merely `is_err()` or diagnostic text.\n- Release, CI, and publication workflows count as behavior when they define a\n project contract.\n- Avoid ceremonial documentation. Update shelves because the contract changed,\n not because a path changed.\n\n## RED/GREEN Testing Discipline\n\nEdict uses RED/GREEN test-driven development for nontrivial changes. The shared\ncontract lives in [docs/topics/tests/](docs/topics/tests/README.md).\n\nFor behavior, contract, workflow, release, schema, validation, or public-surface\nchanges:\n\n1. Update the owning topic `test-plan.md` with planned requirement and case rows\n before or alongside the first test.\n2. Write the deterministic test, fixture, doctest, or contract check before the\n implementation that makes it pass.\n3. Run the narrowest relevant command and observe the RED failure.\n4. Implement the smallest coherent change that turns that test GREEN.\n5. Mark planned rows as implemented only after executable evidence exists.\n6. Report the RED command and GREEN command in the final report or pull request\n body.\n\nTests must assert software behavior. Do not write tests that assert\nimplementation detail, documentation detail, or repository structure. Tests may\nexercise documentation tooling behavior, such as a validator rejecting invalid\ninput, but they must not pass merely because prose contains a phrase or a file\nappears at a particular path.\n\nDo not use after-the-fact tests as a substitute for RED/GREEN. If a change is a\npurely mechanical edit with no contract impact, state that no RED/GREEN cycle\nwas required.\n\n## Documentation Standards\n\nDocumentation is a product interface, not a Markdown inventory. The shared\ndocumentation policy lives in\n[docs/topics/documentation/](docs/topics/documentation/README.md).\n\nWhen creating or changing documentation:\n\n- Give each page one primary reader job: tutorial, how-to, reference,\n explanation, troubleshooting, or contributor guidance.\n- Keep user-facing task help separate from contributor architecture and evidence\n maps.\n- Use concrete, valid examples and show expected results when the result matters.\n- Put exact public facts in reference material and validate or generate them\n from authoritative sources when practical.\n- Update affected documentation in the same change as behavior, schema, release,\n workflow, or public-surface changes, or state `docs-impact: none` with a\n concise rationale.\n\n## Local Verification\n\nUse the local gate before claiming a branch is ready:\n\n```text\ncargo xtask verify\n```\n\n",{"_419":691,"_400":401,"_421":407},{"_422":692,"_424":-5,"_42":-5,"_425":-5,"_426":-5,"_96":693,"_92":428},[694,695],"developer",{"_46":697,"_92":682},{"_46":696,"_92":682},"\n## Skills\nA skill is a set of local instructions to follow that is stored in a `SKILL.md` file. Below is the list of skills that can be used. Each entry includes a name, description, and file path so you can open the source for full instructions when using a specific skill.\n### Available skills\n- imagegen: Generate or edit raster images when the task benefits from AI-created bitmap visuals such as photos, illustrations, textures, sprites, mockups, or transparent-background cutouts. Use when Codex should create a brand-new image, transform an existing image, or derive visual variants from references, and the output should be a bitmap asset rather than repo-native code or vector. Do not use when the task is better handled by editing existing SVG/vector/code-native assets, extending an established icon or logo system, or building the visual directly in HTML/CSS/canvas. (file: /opt/codex/skills/.system/imagegen/SKILL.md)\n- openai-docs: Use when the user asks how to build with OpenAI products or APIs and needs up-to-date official documentation with citations, help choosing the latest model for a use case, or model upgrade and prompt-upgrade guidance; prioritize OpenAI docs MCP tools, use bundled references only as helper context, and restrict any fallback browsing to official OpenAI domains. (file: /opt/codex/skills/.system/openai-docs/SKILL.md)\n- plugin-creator: Create and scaffold plugin directories for Codex with a required `.codex-plugin/plugin.json`, optional plugin folders/files, and baseline placeholders you can edit before publishing or testing. Use when Codex needs to create a new local plugin, add optional plugin structure, or generate or update repo-root `.agents/plugins/marketplace.json` entries for plugin ordering and availability metadata. (file: /opt/codex/skills/.system/plugin-creator/SKILL.md)\n- skill-creator: Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends Codex's capabilities with specialized knowledge, workflows, or tool integrations. (file: /opt/codex/skills/.system/skill-creator/SKILL.md)\n- skill-installer: Install Codex skills into $CODEX_HOME/skills from a curated list or a GitHub repo path. Use when a user asks to list installable skills, install a curated skill, or install a skill from another repo (including private repos). (file: /opt/codex/skills/.system/skill-installer/SKILL.md)\n### How to use skills\n- Discovery: The list above is the skills available in this session (name + description + file path). Skill bodies live on disk at the listed paths.\n- Trigger rules: If the user names a skill (with `$SkillName` or plain text) OR the task clearly matches a skill's description shown above, you must use that skill for that turn. Multiple mentions mean use them all. Do not carry skills across turns unless re-mentioned.\n- Missing/blocked: If a named skill isn't in the list or the path can't be read, say so briefly and continue with the best fallback.\n- How to use a skill (progressive disclosure):\n 1) After deciding to use a skill, open its `SKILL.md`. Read only enough to follow the workflow.\n 2) When `SKILL.md` references relative paths (e.g., `scripts/foo.py`), resolve them relative to the skill directory listed above first, and only consider other paths if needed.\n 3) If `SKILL.md` points to extra folders such as `references/`, load only the specific files needed for the request; don't bulk-load everything.\n 4) If `scripts/` exist, prefer running or patching them instead of retyping large code blocks.\n 5) If `assets/` or templates exist, reuse them instead of recreating from scratch.\n- Coordination and sequencing:\n - If multiple skills apply, choose the minimal set that covers the request and state the order you'll use them.\n - Announce which skill(s) you're using and why (one short line). If you skip an obvious skill, say why.\n- Context hygiene:\n - Keep context small: summarize long sections instead of pasting them; only load extra files when needed.\n - Avoid deep reference-chasing: prefer opening only files directly linked from `SKILL.md` unless you're blocked.\n - When variants exist (frameworks, providers, domains), pick only the relevant reference file(s) and note that choice.\n- Safety and fallback: If a skill can't be applied cleanly (missing files, unclear instructions), state the issue, pick the next-best approach, and continue.\n","\nFilesystem sandboxing defines which files can be read or written. `sandbox_mode` is `danger-full-access`: No filesystem sandboxing - all commands are permitted. Network access is enabled.\nApproval policy is currently never. Do not provide the `sandbox_permissions` for any reason, commands will be rejected.\n","turn/started",{"_400":401,"_87":700},{"_103":-5,"_42":407,"_408":701,"_410":411,"_412":702},[],"inProgress",{"_412":704,"_400":401},{"_705":706,"_92":707},"activeFlags",[],"active","thread/started",{"_710":711},"thread",{"_712":-5,"_713":-5,"_714":715,"_716":411,"_469":470,"_717":15,"_718":-5,"_719":-5,"_720":-5,"_721":722,"_42":401,"_723":724,"_186":-5,"_725":-5,"_163":726,"_727":204,"_728":-5,"_474":729,"_412":730,"_731":-5,"_77":732,"_733":411},"agentNickname","agentRole","cliVersion","0.128.0","createdAt","ephemeral","extra","forkedFromId","gitInfo","historyMode","legacy","modelProvider","openai","parentThreadId","/opt/codex/sessions/2026/06/25/rollout-2026-06-25T21-00-10-019f0095-4609-77c3-934b-163252aa20aa.jsonl","preview","recencyAt","vscode",{"_92":416},"threadSource",[],"updatedAt",[],"messages",[737],{"_42":738,"_739":740,"_741":742,"_743":742,"_422":744,"_412":745,"_424":-5,"_746":32,"_747":748,"_749":750,"_751":-5},"56cdb14c-98fe-41f1-932c-27ae088fe2a9","author",{"_96":330,"_186":-5,"_747":760},"create_time",1782421209.737853,"update_time",{"_756":46,"_757":758},"finished_successfully","weight","metadata",{"_752":753},"recipient","all","channel","l1239dk1",{"_754":755},"inline_comments",[],"content_type","parts",[759],"@codex please confirm this review-response pass.\n\n## Activity Summary\n\n| Source | Severity | File | Commit | Outcome |\n| --- | --- | --- | --- | --- |\n| Codex | P2 | `.github/workflows/auto-release-tag.yml` | `855f60f` | Manual recovery now requires a successful `main` CI run for the requested SHA before release outputs are written. |\n| Codex | P2 | `.github/workflows/auto-release-tag.yml` | `855f60f` | Manual recovery now requires exactly one merged `release/*-prep` PR for the SHA and derives the release tag from that PR. |\n| Codex | P1 | `docs/topics/release-process/test-plan.md` | `855f60f` | Added `RELEASE-REQ-015` and `RELEASE-TP-010` for the manual recovery contract. |\n| CodeRabbit | Major | `.github/workflows/auto-release-tag.yml` | `855f60f` | Operator `INPUT_TAG` must match the tag derived from the merged release-prep PR before the workflow can create or reuse a release tag. |\n\n## RED/GREEN Evidence\n\nRED observed before the fix:\n\n- `cargo test -p xtask auto_release_tag_manual_dispatch_checks_verified_main_sha`\n- `cargo test -p xtask auto_release_tag_workflow_is_guarded`\n- `cargo test -p xtask auto_release_tag_workflow_scopes_job_permissions`\n\nGREEN after the fix:\n\n- `cargo test -p xtask auto_release_tag_manual_dispatch_checks_verified_main_sha`\n- `cargo test -p xtask auto_release_tag_workflow_is_guarded`\n- `cargo test -p xtask auto_release_tag_workflow_scopes_job_permissions`\n- `actionlint .github/workflows/auto-release-tag.yml`\n- `npx markdownlint-cli2 docs/topics/release-process/runbook.md docs/topics/release-process/test-plan.md`\n- `cargo test -p xtask release_`\n- `cargo xtask verify`\n\nThe actual recovery inputs were also probed against GitHub: merge commit `e680adf0a3ccc72559d1c4710e81010738918532` has a successful `main` CI run and maps to merged PR #43 from `release/v0.5.0-alpha.1-prep`.\nFix auto-release recovery workflow\n\n## Summary\n\nFixes the release automation failure observed after PR #43 merged by making the Auto Release Tag workflow manually recoverable and idempotent for a verified `tag + sha`.\n\nChanges:\n\n- Add `workflow_dispatch` inputs to `.github/workflows/auto-release-tag.yml` for explicit `tag` and verified main `sha` recovery.\n- Validate manual recovery SHA shape, SemVer tag shape, release notes presence, and reachability from `origin/main` before tag creation.\n- Replace the failed Git `extraheader` auth path with an explicit authenticated remote used only for `ls-remote`, `fetch`, and `push`.\n- Keep existing idempotent behavior: existing same-target tags are accepted; different-target tags still fail without mutation.\n- Update release-process policy and runbook to document the preferred idempotent workflow-dispatch recovery path.\n\n## RED\n\n- `cargo test -p xtask auto_release_tag_manual_dispatch_checks_verified_main_sha` failed before `workflow_dispatch` recovery existed.\n- `cargo test -p xtask auto_release_tag_uses_ephemeral_push_credentials` failed before the workflow used an authenticated remote for Git network operations.\n- `cargo test -p xtask auto_release_tag_workflow_is_guarded` failed before manual recovery was represented in the workflow/policy contract.\n\n## GREEN / VERIFY\n\n- `cargo test -p xtask auto_release_tag_manual_dispatch_checks_verified_main_sha`\n- `cargo test -p xtask auto_release_tag_uses_ephemeral_push_credentials`\n- `cargo test -p xtask auto_release_tag_workflow_is_guarded`\n- `cargo test -p xtask release_`\n- `actionlint .github/workflows/auto-release-tag.yml`\n- `npx markdownlint-cli2 docs/topics/release-process/runbook.md`\n- `cargo xtask verify`\n\n## Release Recovery\n\nAfter this PR lands, run:\n\n```bash\ngh workflow run auto-release-tag.yml \\\n -f tag=v0.5.0-alpha.1 \\\n -f sha=e680adf0a3ccc72559d1c4710e81010738918532\n```\n\nThen watch Auto Release Tag and Release workflows.\n\n\n\n\n[![Review Change Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/flyingrobots/edict/pull/44?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)\n\n\n\n\n> [!WARNING]\n> ## Review limit reached\n> \n> `@flyingrobots`, we couldn't start this review because you've reached your PR review rate limit.\n> \n> More reviews will be available in 28 minutes and 31 seconds. [Learn how PR review limits work](https://docs.coderabbit.ai/management/plans#fair-usage-limits-policy).\n> \n> Your organization has run out of usage credits. Purchase more credits in the [billing tab](https://app.coderabbit.ai/settings/billing?tab=usage&orgId=4252c417-78a1-49cd-a607-68d1e6bdacc4) to continue.\n> \n>

\n>

⌛ How to resolve this issue?

\n> \n> After more reviews become available, a review can be triggered using the `@coderabbitai review` command as a PR comment. Alternatively, push new commits to this PR.\n> \n> To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.\n> \n>

\n> \n> \n>

\n>

🚦 How do rate limits work?

\n> \n> CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.\n> \n> \tFor paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.\n> \n> Please see our [Fair Usage Limits Policy](https://docs.coderabbit.ai/management/plans#fair-usage-limits-policy) for further information.\n> \n>

\n> \n>

\n>

ℹ️ Review info

\n> \n>

\n>

⚙️ Run configuration

\n> \n> **Configuration used**: Organization UI\n> \n> **Review profile**: ASSERTIVE\n> \n> **Plan**: Pro\n> \n> **Run ID**: `684743d7-f5bc-43ab-85f2-c90f6cde8cee`\n> \n>

\n> \n>

\n>

📥 Commits

\n> \n> Reviewing files that changed from the base of the PR and between f5e0c10d5d5e6070b5718e08c3578d630a40f340 and 855f60f8f951b6ed6ab2bcac42263cef786e39ac.\n> \n>

\n> \n>

\n>

📒 Files selected for processing (5)

\n> \n> * `.github/workflows/auto-release-tag.yml`\n> * `docs/topics/release-process/policy.toml`\n> * `docs/topics/release-process/runbook.md`\n> * `docs/topics/release-process/test-plan.md`\n> * `xtask/src/main.rs`\n> \n>

\n> \n>

\n\n\n\n\n\n## Walkthrough\n\nThe release-tag workflow now supports manual dispatch alongside the existing CI-triggered path, validates the supplied commit against main, and publishes tags through an authenticated Git remote. Related policy, runbook, and test updates describe and verify the manual recovery path.\n\n## Changes\n\n**Manual release tag recovery**\n\n|Layer / File(s)|Summary|\n|---|---|\n|**Manual dispatch contract**
`.github/workflows/auto-release-tag.yml`, `docs/topics/release-process/*`, `xtask/src/main.rs`|`workflow_dispatch` adds tag and SHA inputs, release-policy settings record the manual recovery trigger and SHA rule, the runbook describes the dispatch fallback, and the workflow-guard test checks the new trigger and inputs.|\n|**Manual recovery validation**
`.github/workflows/auto-release-tag.yml`, `xtask/src/main.rs`|The `identify-release-pr` job now branches on manual dispatch, validates tag and SHA formats, checks SHA reachability from `origin/main`, verifies the release notes file, and emits `release=true`, `tag`, `pr=manual`, and `sha`; the new test asserts that contract.|\n|**Authenticated tag publishing**
`.github/workflows/auto-release-tag.yml`, `xtask/src/main.rs`|`create-release-tag` now builds `AUTHENTICATED_ORIGIN` and uses it for tag lookup, fetch, and push, replacing the extraheader-based Git setup; the credential test was updated to match the new command flow.|\n\n## Sequence Diagram(s)\n\n```mermaid\nsequenceDiagram\n participant workflow_dispatch as \"workflow_dispatch\"\n participant identify_release_pr as \"identify-release-pr\"\n participant create_release_tag as \"create-release-tag\"\n participant origin_main as \"origin/main\"\n\n workflow_dispatch->>identify_release_pr: tag, sha inputs\n identify_release_pr->>origin_main: fetch tags and verify SHA ancestry\n identify_release_pr-->>create_release_tag: release=true, tag, pr=manual, sha\n create_release_tag->>origin_main: ls-remote, fetch, push tag via AUTHENTICATED_ORIGIN\n```\n\n## Estimated code review effort\n\n🎯 3 (Moderate) | ⏱️ ~25 minutes\n\n## Possibly related PRs\n\n- [flyingrobots/edict#43](https://github.com/flyingrobots/edict/pull/43): Introduced the `auto-release-tag` workflow and `xtask` checks that this PR extends with manual dispatch recovery and authenticated tag publishing.\n\n## Poem\n\n> A tag woke up with SHA in hand ✨ \n> It walked `main`’s path and stayed on land. \n> It fetched, it checked, it would not stray, \n> Then pushed its crown the proper way. \n> Release notes smiled: “All clear today.”\n\n\n\n\n

🚥 Pre-merge checks | ✅ 5

\n\n

✅ Passed checks (5 passed)

\n\n_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}\n\n

\n\n\n\n\n---\n\nThanks for using [CodeRabbit](https://coderabbit.ai?utm_source=oss&utm_medium=github&utm_campaign=flyingrobots/edict&utm_content=44)! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.\n\n

❤️ Share

\n\n- [X](https://twitter.com/intent/tweet?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A&url=https%3A//coderabbit.ai)\n- [Mastodon](https://mastodon.social/share?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A%20https%3A%2F%2Fcoderabbit.ai)\n- [Reddit](https://www.reddit.com/submit?title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&text=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code.%20Check%20it%20out%3A%20https%3A//coderabbit.ai)\n- [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fcoderabbit.ai&mini=true&title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&summary=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code)\n\n

\n\n\n_{Comment `@coderabbitai help` to get the list of available commands.}\n\n\n**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Require successful CI for manual recovery**\n\nWhen this is manually dispatched, the left side lets the job run without the `github.event.workflow_run.conclusion == 'success'` guard, and the manual block only checks SHA shape, `origin/main` reachability, and release notes. For a release-prep merge whose main CI failed or never completed, an operator can still create the immutable tag and dispatch publication for that SHA, even though `docs/topics/release-process/policy.toml` keeps `main_ci_success` as a required release check; require a successful CI run/check for `inputs.sha` before setting `release=true`.\n\nUseful? React with 👍 / 👎.\n**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Verify the manual SHA came from the release-prep PR**\n\nIn the `workflow_dispatch` path, these outputs trust the operator-provided tag after only reachability and notes checks, without querying `/commits/${SHA}/pulls` or confirming that the commit came from a merged `release/vX.Y.Z-alpha.N-prep` PR that derives the same tag. Even after adding a CI-success check, a mistyped reachable `main` SHA with a matching release-notes file and zero-open milestone would be tagged and published, bypassing the release-prep PR contract still listed in `policy.toml` as `merged_release_pr`.\n\nUseful? React with 👍 / 👎.\n**_{_{![P1 Badge](https://img.shields.io/badge/P1-orange?style=flat)}} Add manual recovery to the topic test plan**\n\nThis adds a new manual recovery workflow contract, but `docs/topics/release-process/test-plan.md` still has no requirement or case for `workflow_dispatch` recovery; its automation case only describes successful main-CI release-prep merges. `/workspace/edict/AGENTS.md` requires workflow and contract changes to update the owning topic `test-plan.md` before or alongside tests, so the durable contract graph omits the new behavior and future drift checks do not state what manual recovery must prove.\n\nUseful? React with 👍 / 👎.\n\n### 💡 Codex Review\n\nHere are some automated review suggestions for this pull request.\n\n**Reviewed commit:** `f5e0c10d5d`\n \n\n

ℹ️ About Codex in GitHub

\n
\n\n[Your team has set up Codex to review pull requests in this repo](https://chatgpt.com/codex/cloud/settings/general). Reviews are triggered when you\n- Open a pull request for review\n- Mark a draft as ready\n- Comment \"@codex review\".\n\nIf Codex has suggestions, it will comment; otherwise it will react with 👍.\n\n\n\n\nCodex can also answer questions or update the PR. Try commenting \"@codex address that feedback\".\n \n

\n_🗄️ Data Integrity & Integration_ | _🟠 Major_ | _⚡ Quick win_\n\n**Do not let manual dispatch mint arbitrary release tags.**\n\nLines 65-88 currently trust `INPUT_TAG` after only a broad SemVer check, so any `docs/releases/.md` file can be paired with any `origin/main`-reachable SHA. That bypasses the alpha-only `release/v…-prep -> v…-alpha.N` contract used on the automatic path, and because this workflow later refuses tag mutation, one operator typo can permanently create the wrong immutable release tag on the wrong commit. Reuse the existing `/commits/${SHA}/pulls` lookup here and require the derived release-prep tag to match `INPUT_TAG` (or derive `TAG` from the PR outright). \n \n\n

Suggested direction

\n\n```diff\n if [[ \"${EVENT_NAME}\" == \"workflow_dispatch\" ]]; then\n- TAG=\"${INPUT_TAG}\"\n-\n if [[ ! \"${SHA}\" =~ ^[0-9a-f]{40}$ ]]; then\n echo \"::error::Manual recovery SHA must be a full 40-character commit SHA: ${SHA}\"\n exit 1\n fi\n-\n- if [[ ! \"${TAG}\" =~ ^v[0-9]+\\.[0-9]+\\.[0-9]+(-[0-9A-Za-z.]+)?$ ]]; then\n- echo \"::error::Manual recovery tag must look like a SemVer v* tag: ${TAG}\"\n- exit 1\n- fi\n\n git fetch origin main:refs/remotes/origin/main --tags\n\n if ! git merge-base --is-ancestor \"${SHA}\" origin/main; then\n echo \"::error::Manual recovery SHA must be reachable from origin/main.\"\n exit 1\n fi\n+\n+ PRS_JSON=\"$(gh api \\\n+ -H \"Accept: application/vnd.github+json\" \\\n+ \"/repos/${GITHUB_REPOSITORY}/commits/${SHA}/pulls\")\"\n+ MATCHES=\"$(jq '[.[] | select(\n+ .merged_at != null and\n+ .base.ref == \"main\" and\n+ (.head.ref | test(\"^release/v[0-9]+\\\\.[0-9]+\\\\.[0-9]+-alpha\\\\.[0-9]+-prep$\"))\n+ )]' <<<\"${PRS_JSON}\")\"\n+ if [[ \"$(jq 'length' <<<\"${MATCHES}\")\" != \"1\" ]]; then\n+ echo \"::error::Manual recovery SHA must resolve to exactly one merged release-prep PR.\"\n+ exit 1\n+ fi\n+\n+ HEAD_REF=\"$(jq -r '.[0].head.ref' <<<\"${MATCHES}\")\"\n+ RELEASE_BRANCH_REGEX='^release/(v[0-9]+\\.[0-9]+\\.[0-9]+-alpha\\.[0-9]+)-prep$'\n+ if [[ ! \"${HEAD_REF}\" =~ ${RELEASE_BRANCH_REGEX} ]]; then\n+ echo \"::error::Release branch did not match expected pattern: ${HEAD_REF}\"\n+ exit 1\n+ fi\n+\n+ TAG=\"${BASH_REMATCH[1]}\"\n+ if [[ \"${TAG}\" != \"${INPUT_TAG}\" ]]; then\n+ echo \"::error::Manual recovery tag ${INPUT_TAG} does not match the merged release-prep PR tag ${TAG}.\"\n+ exit 1\n+ fi\n\n NOTES=\"docs/releases/${TAG}.md\"\n```\n

\n\n\n\n

📝 Committable suggestion

\n\n> ‼️ **IMPORTANT**\n> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.\n\n```suggestion\n if [[ \"${EVENT_NAME}\" == \"workflow_dispatch\" ]]; then\n if [[ ! \"${SHA}\" =~ ^[0-9a-f]{40}$ ]]; then\n echo \"::error::Manual recovery SHA must be a full 40-character commit SHA: ${SHA}\"\n exit 1\n fi\n\n git fetch origin main:refs/remotes/origin/main --tags\n\n if ! git merge-base --is-ancestor \"${SHA}\" origin/main; then\n echo \"::error::Manual recovery SHA must be reachable from origin/main.\"\n exit 1\n fi\n\n PRS_JSON=\"$(gh api \\\n -H \"Accept: application/vnd.github+json\" \\\n \"/repos/${GITHUB_REPOSITORY}/commits/${SHA}/pulls\")\"\n MATCHES=\"$(jq '[.[] | select(\n .merged_at != null and\n .base.ref == \"main\" and\n (.head.ref | test(\"^release/v[0-9]+\\\\.[0-9]+\\\\.[0-9]+-alpha\\\\.[0-9]+-prep$\"))\n )]' <<<\"${PRS_JSON}\")\"\n if [[ \"$(jq 'length' <<<\"${MATCHES}\")\" != \"1\" ]]; then\n echo \"::error::Manual recovery SHA must resolve to exactly one merged release-prep PR.\"\n exit 1\n fi\n\n HEAD_REF=\"$(jq -r '.[0].head.ref' <<<\"${MATCHES}\")\"\n RELEASE_BRANCH_REGEX='^release/(v[0-9]+\\.[0-9]+\\.[0-9]+-alpha\\.[0-9]+)-prep$'\n if [[ ! \"${HEAD_REF}\" =~ ${RELEASE_BRANCH_REGEX} ]]; then\n echo \"::error::Release branch did not match expected pattern: ${HEAD_REF}\"\n exit 1\n fi\n\n TAG=\"${BASH_REMATCH[1]}\"\n if [[ \"${TAG}\" != \"${INPUT_TAG}\" ]]; then\n echo \"::error::Manual recovery tag ${INPUT_TAG} does not match the merged release-prep PR tag ${TAG}.\"\n exit 1\n fi\n\n NOTES=\"docs/releases/${TAG}.md\"\n\n if [[ ! -f \"${NOTES}\" ]]; then\n echo \"::error::Missing release notes file: ${NOTES}\"\n exit 1\n fi\n\n {\n echo \"release=true\"\n echo \"tag=${TAG}\"\n echo \"pr=manual\"\n echo \"sha=${SHA}\"\n } >>\"${GITHUB_OUTPUT}\"\n```\n\n

\n\n\n\n

🤖 Prompt for AI Agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nIn @.github/workflows/auto-release-tag.yml around lines 57 - 89, The manual\ndispatch path in the auto-release workflow is too permissive because it trusts\nINPUT_TAG after only a SemVer check, allowing arbitrary release tags to be\nminted for any origin/main-reachable SHA. Update the workflow logic around the\nworkflow_dispatch branch to reuse the existing commit-to-PR lookup used\nelsewhere in this job, derive the expected release-prep tag from that PR, and\nrequire it to match INPUT_TAG (or set TAG directly from the PR data). Keep the\nrelease notes file check, but ensure the TAG/sha pairing cannot be manually\nmismatched before writing to GITHUB_OUTPUT.\n```\n\n

\n\n\n\n\n\n\n\n\n\n✅ Addressed in commit 855f60f\n**Actionable comments posted: 1**\n\n

🤖 Prompt for all review comments with AI agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nInline comments:\nIn @.github/workflows/auto-release-tag.yml:\n- Around line 57-89: The manual dispatch path in the auto-release workflow is\ntoo permissive because it trusts INPUT_TAG after only a SemVer check, allowing\narbitrary release tags to be minted for any origin/main-reachable SHA. Update\nthe workflow logic around the workflow_dispatch branch to reuse the existing\ncommit-to-PR lookup used elsewhere in this job, derive the expected release-prep\ntag from that PR, and require it to match INPUT_TAG (or set TAG directly from\nthe PR data). Keep the release notes file check, but ensure the TAG/sha pairing\ncannot be manually mismatched before writing to GITHUB_OUTPUT.\n```\n\n

\n\n

🪄 Autofix (Beta)

\n\nFix all unresolved CodeRabbit comments on this PR:\n\n- [ ] Push a commit to this branch (recommended)\n- [ ] Create a new PR with the fixes\n\n

\n\n---\n\n

ℹ️ Review info

\n\n

⚙️ Run configuration

\n\n**Configuration used**: Organization UI\n\n**Review profile**: ASSERTIVE\n\n**Plan**: Pro\n\n**Run ID**: `5120a2b7-38e3-4b7f-b967-67baff0eb34f`\n\n

\n\n

📥 Commits

\n\nReviewing files that changed from the base of the PR and between e680adf0a3ccc72559d1c4710e81010738918532 and f5e0c10d5d5e6070b5718e08c3578d630a40f340.\n\n

\n\n

📒 Files selected for processing (4)

\n\n* `.github/workflows/auto-release-tag.yml`\n* `docs/topics/release-process/policy.toml`\n* `docs/topics/release-process/runbook.md`\n* `xtask/src/main.rs`\n\n

\n\n

📜 Review details

\n\n

🧰 Additional context used

\n\n

📓 Path-based instructions (1)

\n\n

\n\n\n**⚙️ CodeRabbit configuration file**\n\n> `**`: # AGENTS\n> \n> ## Git Rules\n> \n> NEVER amend git commits. Make a new commit instead.\n> \n> NEVER use `git rebase` unless the user explicitly approves a rare exception.\n> Use regular merge commits.\n> \n> NEVER force any git operation. If a force operation appears necessary, stop and\n> explain what happened and what options remain.\n> \n> NEVER create draft pull requests.\n> \n> NEVER use a `codex` prefix in branch names, PR titles, or commit messages.\n> \n> Pull request bodies for issue work MUST include GitHub auto-close text such as\n> `Closes `#123`` for every issue the PR is intended to close.\n> \n> ## Think\n> \n> Think is durable memory for cross-session coordination.\n> \n> - Use `codex-think --remember --json` when starting a new session, changing into\n> this repository, or regaining context after a context shift.\n> - Use `codex-think \"...\" --json` when a cycle closes or a significant event\n> should survive across turns.\n> - Treat Think as memory, not repo truth. Anchor strong claims back to files,\n> commits, commands, issues, or pull requests.\n> - Claude memories are read-only. Use `claude-think --remember --json` only for\n> additional context.\n> \n> ## Topic Shelves\n> \n> `docs/topics/` contains the living contract graph for landed behavior. Topic\n> shelves are not proposals, retrospectives, or design archaeology.\n> \n> Each shelf may contain:\n> \n> - `README.md`: what is true in HEAD.\n> - `test-plan.md`: how those truths are verified, including requirements, cases,\n> fixtures, oracles, implemented evidence, planned cases, and known gaps.\n> - `architecture.md`: optional structure or dataflow notes when the machinery\n> earns a separate page.\n> - `rationale.md`: optional still-relevant tradeoffs and rejected approaches.\n> \n> ### When To Update Topic Shelves\n> \n> For every nontrivial behavior, contract, workflow, release, schema, validation,\n> or public-surface change:\n> \n> 1. Identify the owning topic shelf before editing code.\n> 2. If no shelf owns durable behavior, create one.\n> 3. Update `test-plan.md` before or alongside tests with requirement IDs, case\n> IDs,...\n\nFiles:\n- `docs/topics/release-process/policy.toml`\n- `docs/topics/release-process/runbook.md`\n- `xtask/src/main.rs`\n\n

\n\n

\n\n",{},"created",1782421315.3652542,"Completing the task","event_type","info",{"_92":428,"_96":93,"_422":2004},{"_92":768,"_769":770},"partial_repo_snapshot","files",[771,772,773],{"_163":1832,"_775":-5,"_776":1833,"_778":-5},{"_163":1748,"_775":-5,"_776":1749,"_778":-5},{"_163":774,"_775":-5,"_776":777,"_778":-5},"xtask/src/main.rs","contents","line_range_contents",[779],"missing_reason",{"_780":611,"_781":782,"_422":783,"_784":59},"line_range_start","line_range_end",1667,[785,786,204,787,788,789,790,791,792,204,793,794,795,796,204,797,798,799,800,801,802,803,804,805,204,806,807,808,809,810,811,812,813,814,815,816,817,818,819,803,820,821,822,804,805,204,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,825,826,827,839,837,840,841,842,843,844,805,204,845,846,847,848,849,850,851,852,853,854,855,856,804,805,204,857,858,805,204,859,860,861,862,863,864,803,804,865,805,204,866,867,868,850,869,870,851,871,872,805,204,873,874,875,876,877,878,204,879,880,881,882,804,883,884,804,204,885,886,887,888,804,204,889,844,805,204,890,891,892,893,805,204,894,895,896,897,898,805,204,899,900,901,902,903,204,904,905,906,804,907,908,909,910,911,912,803,913,844,805,204,914,915,916,917,918,919,920,921,922,923,924,925,926,927,204,928,929,930,931,803,932,933,934,803,804,844,805,204,935,936,937,938,939,940,941,942,943,944,945,805,204,946,947,948,949,854,855,950,951,952,953,804,805,204,954,955,956,804,957,805,204,958,915,959,960,961,918,962,963,964,965,204,966,967,968,969,804,970,971,804,204,972,973,974,975,204,976,977,978,803,979,804,204,980,981,982,983,984,985,986,818,987,803,988,989,803,990,991,992,993,994,995,996,997,998,999,1000,1001,1002,994,1003,1004,994,818,1005,1006,803,1007,1008,1009,818,803,804,204,976,1010,1011,803,1012,1013,1014,1015,803,804,204,1016,1017,1018,1019,1020,1021,1022,803,1023,1024,803,804,204,1025,844,805,204,1026,1027,805,204,1028,1029,1030,1031,1032,1033,1034,818,1035,1036,1037,1038,815,1039,1040,818,803,804,1041,805,204,1042,1029,1030,1031,1043,1044,1045,818,1046,1036,1037,1047,1048,1049,1050,815,1039,1051,818,803,804,1041,805,204,1052,915,1053,1054,961,918,1055,1056,1057,803,1058,1059,1060,818,1061,1062,803,804,844,805,204,1063,1030,1031,1064,1065,1066,1067,1068,1069,803,804,844,805,204,1070,1071,1072,1073,1074,1075,1076,1077,1078,1079,1080,1081,1082,1083,1084,1085,1086,1087,1088,1068,1089,803,1090,1091,1089,803,1092,1093,1013,1094,1095,1015,803,1096,1097,1013,1098,1099,1100,1015,803,1101,1102,1103,1013,1104,1095,1015,803,804,844,805,204,1105,1106,1107,1108,1109,1110,1111,1112,1113,1114,818,1115,1116,1117,1118,1002,994,1119,818,803,804,1120,805,204,1121,1122,1123,1124,1125,1126,1081,1082,1127,1128,1129,803,1084,804,1130,805,204,1131,1132,1133,1134,805,204,1135,1136,1133,1134,805,204,1137,1138,1139,1140,1141,805,204,1142,1143,1144,1065,1145,1146,805,204,1147,1148,805,204,1149,1150,1151,1152,804,1153,1154,1155,1139,1156,1157,805,204,1158,1159,805,204,1160,1161,805,204,1162,1163,1164,1165,1166,803,854,1167,1041,805,204,1168,1163,1169,1170,1171,1172,1173,803,804,1174,1041,805,204,1175,1176,1177,1171,1172,1178,1179,1180,803,804,844,805,204,1181,1182,805,204,1183,1184,1185,1186,1187,803,1188,1189,803,804,805,204,894,1190,1191,1192,1193,805,204,894,1194,1191,1192,1195,1196,1197,1198,805,204,1199,1200,1201,1202,1203,204,1204,204,1205,1206,1207,804,204,1205,1208,1209,1210,1211,1212,1213,1214,1215,1216,1217,1218,1219,1220,1221,945,1222,204,1223,1224,1225,1226,1227,1228,1229,204,1230,804,204,1205,1231,1232,1210,1211,1213,1233,1234,945,1235,1213,1214,1215,1216,1217,1236,1219,1220,1221,945,1222,1237,1213,1238,1239,1240,1241,945,1242,204,1223,1243,1244,1226,1245,1228,1229,204,1230,804,204,1205,1246,1247,1210,1237,1211,1248,1212,1213,1214,1215,1216,1217,1236,1219,1220,1249,945,1222,204,1250,1224,1251,1226,1252,1228,1229,204,1230,804,204,1205,1253,1254,1210,1237,1211,1248,1212,1213,1214,1215,1216,1217,1255,1219,1220,1256,945,1222,204,1250,1257,204,1230,804,204,1205,1258,1259,1210,1237,1211,1248,1212,1213,1214,1215,1216,1217,1260,1219,1220,1261,945,1222,204,1250,1262,1263,1226,1264,1228,1229,204,1230,804,204,1205,1265,1266,1267,1268,1269,1270,1271,204,1272,1226,1273,1228,1229,204,1230,1274,1275,803,804,204,1205,1276,1277,1278,1279,1280,804,204,1205,1281,1282,1278,1283,1284,804,204,1285,1286,1287,1288,1289,1290,804,204,1291,1292,1293,1294,1295,804,204,1205,1296,1297,1298,1299,1300,1301,1302,1303,1304,1305,1306,1307,1308,1309,1310,1311,1312,1313,1314,1315,1316,803,1226,1317,1318,1229,1226,1319,1320,1229,804,204,1205,1321,1297,1298,1299,1322,1323,1300,1303,1324,1325,1326,1327,1328,1329,1330,1331,1332,1312,1313,1314,1333,1316,803,1226,1334,1335,1229,1336,1337,1338,1339,1340,1341,1226,1342,1343,1229,1226,1344,1345,1346,1347,1229,804,204,1205,1348,1297,1298,1299,1322,1323,1226,1349,1350,1229,1351,1352,1288,1353,1354,1226,1355,1356,1357,1229,804,204,1205,1358,1297,1322,1323,1359,1299,1360,1361,1226,1362,1363,1229,1364,1365,1366,1367,1229,1226,1368,1369,1229,1370,1371,1372,1373,1229,1226,1374,1375,1229,804,204,1205,1376,1377,1378,1226,1379,1380,1229,804,204,1205,1381,1297,1298,1299,1382,1383,1288,1384,1385,1386,1387,1226,1388,1389,1229,804,204,1205,1390,1297,1391,1361,1322,1323,1300,1392,1303,1393,1394,1395,1396,1325,1397,1398,1399,1307,1400,1401,1402,1403,1312,1313,1314,1404,1316,803,1226,1405,1406,1229,1226,1407,1408,1229,1226,1409,1410,1229,1226,1411,1412,1229,1413,1414,1415,1416,1312,1313,1417,1418,1316,803,804,204,1205,1419,1297,1391,1361,1420,1421,1422,1423,1424,1229,1413,1303,1425,1426,1427,1428,1429,1430,1431,1432,1433,1434,1435,1398,1436,1437,1438,1439,1440,1312,1313,1441,1442,1316,803,804,204,1205,1443,1297,1391,1361,1322,1323,1226,1444,1445,1229,1446,1447,1288,1448,1449,1226,1450,1451,1452,1229,1453,1454,1288,1455,1456,1226,1457,1458,1459,1460,1461,1229,1462,1463,1288,1464,1465,1226,1466,1467,1468,1469,1229,1470,1471,1288,1472,1226,1473,1474,1475,1476,1477,1229,804,204,1205,1478,1297,1391,1361,1462,1463,1288,1464,1465,1413,1479,1480,1481,1482,1483,1312,1313,1484,1485,1316,803,804,204,1205,1486,1297,1391,1361,1487,1488,1489,1490,1491,1492,1226,1493,1494,1229,804,204,1205,1495,1297,1391,1361,1226,1496,1497,1229,804,204,1205,1498,1297,1391,1361,1470,1471,1288,1472,1226,1499,1500,1501,1229,804,204,1205,1502,1297,1322,1323,1300,1503,1504,1505,1506,1507,1508,1312,1313,1509,1510,1316,803,804,204,1205,1511,1297,1322,1323,1413,1512,1513,1514,1515,1516,1517,1518,1519,1520,1521,1329,1312,1313,1417,1522,1316,803,804,204,1205,1523,1297,1322,1323,1413,1524,1525,1526,1527,1528,1529,1530,1531,1415,1532,1533,1312,1313,1417,1534,1316,803,804,204,1205,1535,1297,1322,1323,1413,1536,1537,1538,1539,1540,1541,1542,1543,1544,1545,1546,1312,1313,1417,1547,1316,803,804,204,1205,1548,1297,1322,1323,1413,1549,1550,1551,1539,1552,1553,1554,1555,1556,1557,1312,1313,1417,1558,1316,803,804,204,1205,1559,1297,1322,1323,1413,1560,1561,1562,1563,1564,1565,1566,1567,1568,1569,1570,1571,1572,1573,1574,1555,1575,1557,1312,1313,1417,1576,1316,803,804,204,1205,1577,1297,1578,1322,1323,1579,1580,1581,1582,1583,1312,1313,1584,1585,1316,1313,1586,1587,1316,1313,1588,1589,1316,803,804,204,1205,1590,1297,1322,1323,1413,1591,1592,1593,1594,1595,1596,1597,1598,1599,1545,1546,1312,1313,1417,1600,1316,803,804,204,1205,1601,1297,1602,1603,1300,1604,1605,1606,1607,1608,1609,1610,1611,1612,1613,1614,1615,1616,1312,1617,803,804,204,1205,1618,1297,1602,1603,1619,1620,1621,1622,1623,1624,1312,1313,1625,1626,1316,803,804,204,1205,1627,1297,1602,1603,1628,1629,204,1630,1631,1632,1633,1634,1635,1636,1637,1638,1639,1640,994,1641,1642,1643,1644,1645,1646,1647,1648,1649,1650,1651,1652,1653,1654,1655,1656,1652,1653,1657,1658,1659,1660,1661,1662,1663,1664,1665,1666,1667,1668,1669,1665,994,1670,818,803,204,1671,804,204,1672,1673,1674,1675,804,204,1672,1676,1677,1678,1679,804,204,1680,1681,1682,1683,804,204,1684,1685,1686,1687,1688,818,803,804,204,1689,1690,1691,1692,1693,1694,1082,1695,1696,1697,1698,1699,994,1114,818,1700,1701,818,1702,1703,1704,1705,1704,1706,1707,1114,815,1708,1709,1114,818,1710,1711,1712,818,803,1226,1713,1714,1229,1715,804,204,1716,1717,1718,1719,1720,1721,1110,1111,1722,1114,818,1723,1724,815,1725,1726,1727,1728,1729,1730,1731,994,1732,1733,994,1734,1735,994,1736,818,803,1737,1738,1739,1740,1741,803,804,204,1742,1743,1744,1745,1746,1747,804,805],"contains_end_of_file","#![allow(clippy::print_stderr)]","#![allow(clippy::print_stdout)]","use std::collections::{BTreeMap, BTreeSet};","use std::env;","use std::ffi::OsStr;","use std::fs;","use std::path::{Path, PathBuf};","use std::process::{Command, ExitCode, Stdio};","use edict_syntax::{"," compile_to_core, digest_core_module, encode_core_module, parse_module, CompilerContext,"," CoreBudget,","};","fn main() -> ExitCode {"," match run() {"," Ok(()) => ExitCode::SUCCESS,"," Err(err) => {"," eprintln!(\"xtask: {err}\");"," ExitCode::FAILURE"," }"," }","}","fn run() -> Result<(), String> {"," let mut args = env::args().skip(1);"," match args.next().as_deref() {"," Some(\"contract-check\") => contract_check(&repo_root()?),"," Some(\"core-goldens\") => {"," let mode = match args.next().as_deref() {"," Some(\"--write\") => CoreGoldenMode::Write,"," Some(\"--check\") | None => CoreGoldenMode::Check,"," Some(flag) => return Err(format!(\"unknown core-goldens flag `{flag}`\")),"," };"," if let Some(extra) = args.next() {"," return Err(format!(\"unexpected core-goldens argument `{extra}`\"));"," }"," core_goldens(&repo_root()?, mode)"," Some(\"verify\") => verify(&repo_root()?),"," Some(cmd) => Err(format!(\"unknown xtask command `{cmd}`\")),"," None => Err(\"usage: cargo xtask \".into()),","fn verify(root: &Path) -> Result<(), String> {"," run_cmd(root, \"cargo\", [\"fmt\", \"--all\", \"--check\"])?;"," run_cmd("," root,"," \"cargo\","," ["," \"clippy\","," \"--workspace\","," \"--all-targets\","," \"--all-features\","," \"--\","," \"-D\","," \"warnings\","," ],"," )?;"," run_cmd(root, \"cargo\", [\"test\", \"--workspace\", \"--all-features\"])?;"," [\"test\", \"--workspace\", \"--doc\", \"--all-features\"],"," core_goldens(root, CoreGoldenMode::Check)?;"," contract_check(root)?;"," let base = diff_check_base(root)?;"," run_cmd(root, \"git\", [\"diff\", \"--check\", &format!(\"{base}...HEAD\")])?;"," Ok(())","fn run_cmd(root: &Path, program: &str, args: [&str; N]) -> Result<(), String> {"," let rendered = args.join(\" \");"," println!(\"$ {program} {rendered}\");"," let status = Command::new(program)"," .args(args)"," .current_dir(root)"," .status()"," .map_err(|err| format!(\"failed to run `{program}`: {err}\"))?;"," if status.success() {"," Ok(())"," } else {"," Err(format!(\"command failed: {program} {rendered}\"))","fn diff_check_base(root: &Path) -> Result {"," choose_diff_check_base(|candidate| git_ref_exists(root, candidate))","fn choose_diff_check_base("," mut exists: impl FnMut(&str) -> Result,",") -> Result {"," for candidate in [\"origin/main\", \"main\", \"HEAD^\"] {"," if exists(candidate)? {"," return Ok(candidate.to_owned());"," Err(\"could not find diff-check base (tried origin/main, main, HEAD^)\".into())","fn git_ref_exists(root: &Path, candidate: &str) -> Result {"," let status = Command::new(\"git\")"," .args([\"rev-parse\", \"--verify\", \"--quiet\", candidate])"," .stdout(Stdio::null())"," .stderr(Stdio::null())"," .map_err(|err| format!(\"failed to inspect git ref `{candidate}`: {err}\"))?;"," Ok(status.success())","fn contract_check(root: &Path) -> Result<(), String> {"," let docs = root.join(\"docs\");"," let topics = docs.join(\"topics\");"," let requirement_registry = read_to_string(&docs.join(\"REQUIREMENTS.md\"))?;"," let mut tests = collect_rust_test_names(&root.join(\"crates\"))?;"," tests.extend(collect_rust_test_names(&root.join(\"xtask\"))?);"," let mut topic_count = 0usize;"," for topic in dirs(&topics)? {"," topic_count += 1;"," check_topic(root, &topic, &tests, &requirement_registry)?;"," if topic_count == 0 {"," return Err(\"docs/topics contains no topic shelves\".into());"," let mut docs_to_link = vec![docs.join(\"README.md\")];"," docs_to_link.extend(markdown_files(&topics)?);"," for doc in docs_to_link {"," check_links(root, &doc)?;"," println!(\"contract-check: {topic_count} topic shelf(s) validated\");","#[derive(Debug, Clone, Copy, PartialEq, Eq)]","enum CoreGoldenMode {"," Check,"," Write,","#[derive(Debug)]","struct CoreGoldenCase {"," source: &'static str,"," bytes: &'static str,"," digest: &'static str,","const CORE_GOLDEN_CASES: &[CoreGoldenCase] = &[CoreGoldenCase {"," source: \"fixtures/lang/bounds/bounded-hello.edict\","," bytes: \"fixtures/core/canonical/bounded-hello.core.cbor\","," digest: \"fixtures/core/canonical/bounded-hello.core.sha256\",","}];","fn core_goldens(root: &Path, mode: CoreGoldenMode) -> Result<(), String> {"," for case in CORE_GOLDEN_CASES {"," check_or_write_core_golden(root, case, mode)?;"," println!("," \"core-goldens: {} case(s) {}\","," CORE_GOLDEN_CASES.len(),"," match mode {"," CoreGoldenMode::Check => \"checked\","," CoreGoldenMode::Write => \"written\","," );","fn check_or_write_core_golden("," root: &Path,"," case: &CoreGoldenCase,"," mode: CoreGoldenMode,",") -> Result<(), String> {"," let source = read_to_string(&root.join(case.source))?;"," let module = parse_module(&source).map_err(|err| format!(\"parse {}: {err}\", case.source))?;"," let core = compile_to_core(&module, &core_golden_context())"," .map_err(|err| format!(\"compile {} to Core: {err:?}\", case.source))?;"," let bytes = encode_core_module(&core)"," .map_err(|err| format!(\"encode {} as canonical Core: {err}\", case.source))?;"," let digest = digest_core_module(&core)"," .map_err(|err| format!(\"digest {} as canonical Core: {err}\", case.source))?;"," let digest_text = format!(\"{digest}\\n\");"," match mode {"," CoreGoldenMode::Check => {"," check_core_golden_file(root, case.bytes, &bytes)?;"," check_core_golden_file(root, case.digest, digest_text.as_bytes())?;"," CoreGoldenMode::Write => {"," write_core_golden_file(&root.join(case.bytes), &bytes)?;"," write_core_golden_file(&root.join(case.digest), digest_text.as_bytes())?;","fn core_golden_context() -> CompilerContext {"," CompilerContext::new()"," .with_operation_profile(\"hello.readOnly\", \"continuum.profile.read-only/v1\")"," .with_budget("," \"hello.tinyBudget\","," CoreBudget {"," max_steps: 64,"," max_allocated_bytes: 4096,"," max_output_bytes: 1024,"," },"," )","fn check_core_golden_file(root: &Path, relative: &str, expected: &[u8]) -> Result<(), String> {"," let path = root.join(relative);"," let actual = fs::read(&path).map_err(|err| format!(\"read {}: {err}\", path.display()))?;"," if actual == expected {"," Err(format!("," \"{} does not match generated Core golden; run `cargo xtask core-goldens --write`\","," path.display()"," ))","fn write_core_golden_file(path: &Path, bytes: &[u8]) -> Result<(), String> {"," if let Some(parent) = path.parent() {"," fs::create_dir_all(parent).map_err(|err| format!(\"create {}: {err}\", parent.display()))?;"," fs::write(path, bytes).map_err(|err| format!(\"write {}: {err}\", path.display()))","fn check_topic("," topic: &Path,"," tests: &BTreeSet,"," requirement_registry: &str,"," let test_plan = topic.join(\"test-plan.md\");"," let readme = topic.join(\"README.md\");"," let plan = read_to_string(&test_plan)?;"," let chapter = read_to_string(&readme)?;"," let requirements = parse_requirement_rows(&plan)?;"," let cases = parse_case_rows(&plan)?;"," if requirements.is_empty() {"," return Err(format!(\"{} has no requirement rows\", test_plan.display()));"," if cases.is_empty() {"," return Err(format!(\"{} has no case rows\", test_plan.display()));"," let requirement_ids: BTreeSet<&str> = requirements.keys().map(String::as_str).collect();"," let case_ids: BTreeSet<&str> = cases.keys().map(String::as_str).collect();"," let mut covered_requirements = BTreeSet::new();"," let mut implemented_requirements = BTreeSet::new();"," for (id, requirement) in &requirements {"," if !is_known_test_plan_status(&requirement.status) {"," return Err(format!(\"{id} has invalid status `{}`\", requirement.status));"," check_requirement_sources(root, id, &requirement.source, requirement_registry)?;"," for case in cases.values() {"," for requirement in split_cell_list(&case.requirement) {"," if !requirement_ids.contains(requirement) {"," return Err(format!("," \"{} references unknown requirement {}\","," case.id, requirement"," ));"," covered_requirements.insert(requirement.to_owned());"," if case.oracle.trim().is_empty() || case.oracle.trim() == \"-\" {"," return Err(format!(\"{} is missing a mandatory oracle\", case.id));"," match case.status.as_str() {"," \"implemented\" => {"," if case.evidence.trim().is_empty() || case.evidence.trim() == \"-\" {"," return Err(format!(\"{} is implemented without evidence\", case.id));"," }"," for evidence in split_cell_list(&case.evidence) {"," let test_name = evidence.rsplit(\"::\").next().unwrap_or(evidence);"," if !tests.contains(test_name) {"," return Err(format!("," \"{} evidence `{}` does not match a Rust test function\","," case.id, evidence"," ));"," }"," for requirement in split_cell_list(&case.requirement) {"," implemented_requirements.insert(requirement.to_owned());"," status if is_known_test_plan_status(status) => {}"," other => return Err(format!(\"{} has invalid status `{other}`\", case.id)),"," for fixture in split_cell_list(&case.fixtures) {"," if fixture != \"-\" && !root.join(fixture).is_file() {"," return Err(format!(\"{} fixture `{fixture}` does not exist\", case.id));"," if !covered_requirements.contains(id) {"," return Err(format!(\"{id} has no case\"));"," if requirement.status == \"implemented\" && !implemented_requirements.contains(id) {"," return Err(format!("," \"implemented requirement {id} has no implemented case\""," ));"," let all_topic_ids = requirement_ids"," .union(&case_ids)"," .copied()"," .collect::>();"," for id in bracket_ids(&(chapter + \"\\n\" + &plan)) {"," if (is_requirement_id(&id) || is_case_id(&id)) && !all_topic_ids.contains(id.as_str()) {"," return Err(format!(\"topic references unknown ID `{id}`\"));"," if id.starts_with(\"EDICT-\") && !registry_has_id(requirement_registry, &id) {"," return Err(format!(\"topic references unknown registry ID `{id}`\"));"," check_fixture_table(root, &plan)?;","fn is_known_test_plan_status(status: &str) -> bool {"," matches!(status, \"implemented\" | \"planned\" | \"gap\" | \"policy\")","fn parse_requirement_rows(plan: &str) -> Result, String> {"," let mut out = BTreeMap::new();"," for line in plan.lines() {"," let cells = table_cells(line);"," if cells.first().is_some_and(|cell| is_requirement_id(cell)) {"," if cells.len() < 4 {"," return Err(format!(\"malformed requirement row: {line}\"));"," let row = RequirementRow {"," id: cells[0].clone(),"," status: cells[1].clone(),"," source: cells[3].clone(),"," if out.insert(row.id.clone(), row).is_some() {"," return Err(format!(\"duplicate requirement ID {}\", cells[0]));"," Ok(out)","fn parse_case_rows(plan: &str) -> Result, String> {"," if cells.first().is_some_and(|cell| is_case_id(cell)) {"," if cells.len() < 8 {"," return Err(format!(\"malformed case row: {line}\"));"," let row = CaseRow {"," requirement: cells[3].clone(),"," oracle: cells[4].clone(),"," evidence: cells[5].clone(),"," fixtures: cells[6].clone(),"," return Err(format!(\"duplicate case ID {}\", cells[0]));","fn check_requirement_sources("," id: &str,"," source_cell: &str,"," for source in split_cell_list(source_cell) {"," if source == \"-\" {"," return Err(format!(\"{id} has no requirement source\"));"," if source.starts_with(\"EDICT-\") {"," if !registry_has_id(requirement_registry, source) {"," return Err(format!(\"{id} unknown registry source ID `{source}`\"));"," } else if !is_external_requirement_source(source) && !root.join(source).is_file() {"," return Err(format!(\"{id} source `{source}` does not resolve\"));","fn check_fixture_table(root: &Path, plan: &str) -> Result<(), String> {"," if cells"," .first()"," .is_some_and(|cell| cell.starts_with(\"fixtures/\"))"," && !root.join(&cells[0]).is_file()"," {"," return Err(format!(\"fixture table path `{}` does not exist\", cells[0]));","fn check_links(root: &Path, doc: &Path) -> Result<(), String> {"," let text = read_to_string(doc)?;"," let base = doc"," .parent()"," .ok_or_else(|| format!(\"{} has no parent\", doc.display()))?;"," let canonical_root ="," fs::canonicalize(root).map_err(|err| format!(\"canonicalize {}: {err}\", root.display()))?;"," let mut rest = text.as_str();"," while let Some(start) = rest.find(\"](\") {"," rest = &rest[start + 2..];"," let Some(end) = rest.find(')') else {"," break;"," };"," let target = &rest[..end];"," rest = &rest[end + 1..];"," if target.starts_with(\"http://\")"," || target.starts_with(\"https://\")"," || target.starts_with(\"mailto:\")"," || target.starts_with('#')"," continue;"," let path_part = target.split_once('#').map_or(target, |(path, _)| path);"," if path_part.is_empty() {"," let path = Path::new(path_part);"," if path.is_absolute() {"," \"{} has absolute local link `{target}`\","," doc.display()"," let resolved = base.join(path);"," if !resolved.exists() {"," \"{} has broken link `{target}` resolved to {}\","," doc.display(),"," resolved.display()"," let canonical_resolved = fs::canonicalize(&resolved)"," .map_err(|err| format!(\"canonicalize {}: {err}\", resolved.display()))?;"," if !canonical_resolved.starts_with(&canonical_root) {"," \"{} link `{target}` escapes repository root\",","fn collect_rust_test_names(root: &Path) -> Result, String> {"," let mut names = BTreeSet::new();"," for path in rust_files(root)? {"," let text = read_to_string(&path)?;"," let mut previous_was_test = false;"," for raw in text.lines() {"," let line = raw.trim();"," if line == \"#[test]\" {"," previous_was_test = true;"," continue;"," if previous_was_test {"," if let Some(rest) = line.strip_prefix(\"fn \") {"," if let Some((name, _)) = rest.split_once('(') {"," names.insert(name.to_owned());"," previous_was_test = false;"," Ok(names)","fn bracket_ids(text: &str) -> BTreeSet {"," let mut out = BTreeSet::new();"," let mut rest = text;"," while let Some(start) = rest.find('[') {"," rest = &rest[start + 1..];"," let Some(end) = rest.find(']') else {"," let id = &rest[..end];"," if is_requirement_id(id) || is_case_id(id) || id.starts_with(\"EDICT-\") {"," out.insert(id.to_owned());"," out","fn is_requirement_id(s: &str) -> bool {"," s.contains(\"-REQ-\")"," && s.chars()"," .all(|ch| ch.is_ascii_uppercase() || ch.is_ascii_digit() || ch == '-')","fn is_case_id(s: &str) -> bool {"," s.contains(\"-TP-\")","fn split_cell_list(cell: &str) -> impl Iterator {"," cell.split(',')"," .map(str::trim)"," .map(|s| s.trim_matches('`'))"," .filter(|s| !s.is_empty())","fn registry_has_id(requirement_registry: &str, id: &str) -> bool {"," requirement_registry.lines().any(|line| {"," table_cells(line)"," .is_some_and(|cell| cell.as_str() == id)"," })","fn is_external_requirement_source(source: &str) -> bool {"," source.starts_with(\"issue #\") || source.starts_with(\"http://\") || source.starts_with(\"https://\")","fn table_cells(line: &str) -> Vec {"," let trimmed = line.trim();"," if !trimmed.starts_with('|') || !trimmed.ends_with('|') {"," return Vec::new();"," trimmed"," .trim_matches('|')"," .split('|')"," .map(ToOwned::to_owned)"," .collect()","fn markdown_files(root: &Path) -> Result, String> {"," files_with_extension(root, \"md\")","fn rust_files(root: &Path) -> Result, String> {"," files_with_extension(root, \"rs\")","fn files_with_extension(root: &Path, extension: &str) -> Result, String> {"," let mut out = Vec::new();"," visit(root, &mut |path| {"," if path.extension() == Some(OsStr::new(extension)) {"," out.push(path.to_owned());"," })?;","fn dirs(root: &Path) -> Result, String> {"," for entry in fs::read_dir(root).map_err(|err| format!(\"read {}: {err}\", root.display()))? {"," let entry = entry.map_err(|err| format!(\"read {} entry: {err}\", root.display()))?;"," let path = entry.path();"," if path.is_dir() {"," out.push(path);"," out.sort();","fn visit(dir: &Path, f: &mut impl FnMut(&Path) -> Result<(), String>) -> Result<(), String> {"," for entry in fs::read_dir(dir).map_err(|err| format!(\"read {}: {err}\", dir.display()))? {"," let entry = entry.map_err(|err| format!(\"read {} entry: {err}\", dir.display()))?;"," visit(&path, f)?;"," } else {"," f(&path)?;","fn read_to_string(path: &Path) -> Result {"," fs::read_to_string(path).map_err(|err| format!(\"read {}: {err}\", path.display()))","fn repo_root() -> Result {"," let mut dir = env::current_dir().map_err(|err| format!(\"current dir: {err}\"))?;"," loop {"," if dir.join(\"Cargo.toml\").is_file() && dir.join(\"docs\").is_dir() {"," return Ok(dir);"," if !dir.pop() {"," return Err(\"could not find repository root\".into());","struct RequirementRow {"," id: String,"," status: String,"," source: String,","struct CaseRow {"," requirement: String,"," oracle: String,"," evidence: String,"," fixtures: String,","#[cfg(test)]","mod tests {"," use std::collections::BTreeSet;"," use std::fs;"," use std::path::{Path, PathBuf};"," use super::{check_topic, contract_check, repo_root};"," #[test]"," fn contract_graph_is_valid() {"," contract_check(&repo_root().expect(\"repo root\")).expect(\"contract graph is valid\");"," fn contract_graph_rejects_unknown_registry_source_ids() {"," let root = temp_root(\"unknown-registry-source\");"," let topic = root.join(\"docs/topics/example\");"," fs::create_dir_all(&topic).expect(\"topic directory\");"," fs::write(topic.join(\"README.md\"), \"# Example\\n\\n[EXAMPLE-REQ-001]\\n\").expect(\"chapter\");"," fs::write("," topic.join(\"test-plan.md\"),"," \"# Example Test Plan\\n\\n\\"," | ID | Status | Requirement | Source |\\n\\"," | --- | --- | --- | --- |\\n\\"," | EXAMPLE-REQ-001 | implemented | Example requirement. | EDICT-NOT-A-REAL-ID |\\n\\n\\"," | ID | Status | Category | Requirement | Oracle | Evidence | Fixtures | Notes |\\n\\"," | --- | --- | --- | --- | --- | --- | --- | --- |\\n\\"," | EXAMPLE-TP-001 | implemented | Golden path | EXAMPLE-REQ-001 | exact state | evidence_test | - | fixture-free |\\n\","," .expect(\"test plan\");"," let tests = BTreeSet::from([\"evidence_test\".to_owned()]);"," let err = check_topic(&root, &topic, &tests, \"EDICT-KNOWN-ID\")"," .expect_err(\"unknown registry Source ID must fail\");"," assert!("," err.contains(\"unknown registry source ID `EDICT-NOT-A-REAL-ID`\"),"," \"unexpected error: {err}\""," );"," fs::remove_dir_all(root).ok();"," fn contract_graph_rejects_truncated_registry_bracket_ids() {"," let root = temp_root(\"truncated-registry-bracket-id\");"," topic.join(\"README.md\"),"," \"# Example\\n\\n[EDICT-LANG-RECORD]\\n\","," .expect(\"chapter\");"," | EXAMPLE-REQ-001 | implemented | Example requirement. | docs/REQUIREMENTS.md |\\n\\n\\"," fs::create_dir_all(root.join(\"docs\")).expect(\"docs directory\");"," root.join(\"docs/REQUIREMENTS.md\"),"," \"| ID | Requirement |\\n\\"," | --- | --- |\\n\\"," | EDICT-LANG-RECORD-SHORTHAND-001 | exact longer ID |\\n\","," .expect(\"requirements\");"," let err = check_topic(&root, &topic, &tests, \"EDICT-LANG-RECORD-SHORTHAND-001\")"," .expect_err(\"truncated registry ID must fail\");"," err.contains(\"unknown registry ID `EDICT-LANG-RECORD`\"),"," fn contract_graph_requires_implemented_evidence_for_implemented_requirements() {"," let root = temp_root(\"implemented-requirement-without-evidence\");"," fs::write(root.join(\"docs/REQUIREMENTS.md\"), \"# Requirements\\n\").expect(\"requirements\");"," | EXAMPLE-TP-001 | planned | Golden path | EXAMPLE-REQ-001 | exact state | - | - | planned only |\\n\","," let tests = BTreeSet::new();"," .expect_err(\"implemented requirement without implemented case must fail\");"," err.contains(\"implemented requirement EXAMPLE-REQ-001 has no implemented case\"),"," fn contract_graph_accepts_policy_rows_without_rust_evidence() {"," let root = temp_root(\"policy-rows-without-rust-evidence\");"," | EXAMPLE-REQ-001 | policy | Example policy. | docs/REQUIREMENTS.md |\\n\\n\\"," | EXAMPLE-TP-001 | policy | Review policy | EXAMPLE-REQ-001 | human review records the policy decision | - | - | no executable software behavior |\\n\","," check_topic(&root, &topic, &tests, \"\").expect(\"policy rows require no Rust evidence\");"," fn contract_graph_rejects_unknown_requirement_status() {"," let root = temp_root(\"unknown-requirement-status\");"," | EXAMPLE-REQ-001 | maybe | Example requirement. | docs/REQUIREMENTS.md |\\n\\n\\"," | EXAMPLE-TP-001 | planned | Planned path | EXAMPLE-REQ-001 | exact state | - | - | planned only |\\n\","," let err = check_topic(&root, &topic, &tests, \"\")"," .expect_err(\"unknown requirement status must reject\");"," err.contains(\"EXAMPLE-REQ-001 has invalid status `maybe`\"),"," fn link_check_rejects_local_links_outside_repo() {"," let root = temp_root(\"repo-escaping-link\");"," let outside = temp_root(\"repo-escaping-link-outside\").join(\"outside.md\");"," fs::write(&outside, \"# Outside\\n\").expect(\"outside file\");"," let doc = root.join(\"docs/topics/example/README.md\");"," fs::create_dir_all(doc.parent().expect(\"doc parent\")).expect(\"doc directory\");"," fs::write(&doc, format!(\"# Example\\n\\n[bad]({})\\n\", outside.display())).expect(\"chapter\");"," let err = super::check_links(&root, &doc).expect_err(\"absolute local links must reject\");"," err.contains(\"absolute local link\"),"," if let Some(parent) = outside.parent() {"," fs::remove_dir_all(parent).ok();"," fn diff_check_base_selection_falls_back_without_origin_main() {"," let refs = BTreeSet::from([\"HEAD^\"]);"," let base = super::choose_diff_check_base(|candidate| Ok(refs.contains(candidate)))"," .expect(\"fallback diff base\");"," assert_eq!(base, \"HEAD^\");"," fn diff_check_base_selection_prefers_origin_main() {"," let refs = BTreeSet::from([\"origin/main\", \"main\", \"HEAD^\"]);"," .expect(\"preferred diff base\");"," assert_eq!(base, \"origin/main\");"," fn workflow_block<'a>(workflow: &'a str, start: &str, end: &str) -> &'a str {"," workflow"," .split(start)"," .nth(1)"," .and_then(|tail| tail.split(end).next())"," .unwrap_or_else(|| panic!(\"workflow block missing `{start}`\"))"," fn milestone_lookup_consumes_complete_stream(block: &str) -> bool {"," block.contains("," \"gh api --paginate \\\"repos/${GITHUB_REPOSITORY}/milestones?state=all&per_page=100\\\"\","," ) && block.contains(\"jq -s '.[0] // empty'\")"," && !block.contains(\"head -n 1\")"," fn release_workflow_publishes_only_main_reachable_tags() {"," let root = repo_root().expect(\"repo root\");"," let workflow ="," fs::read_to_string(root.join(\".github/workflows/release.yml\")).expect(\"workflow\");"," for needle in ["," \"tags:\","," \"\\\"v*\\\"\","," \"workflow_dispatch:\","," \"contents: write\","," \"git merge-base --is-ancestor\","," \"origin/main\","," \"docs/releases/${TAG}.md\","," \"release create\","," \"--verify-tag\","," \"--prerelease\","," \"prerelease=true\","," ] {"," assert!("," workflow.contains(needle),"," \"release workflow missing expected guard/action: {needle}\""," );"," !workflow.contains(\"cargo publish\"),"," \"release workflow must not publish crates\""," !workflow.contains(\"git fetch --force\"),"," \"release workflow must not force-fetch refs\""," fn release_workflow_supports_dispatch_and_milestone_closure() {"," let policy = fs::read_to_string(root.join(\"docs/topics/release-process/policy.toml\"))"," .expect(\"release policy\");"," \"RELEASE_TAG:\","," \"inputs.tag\","," \"issues: write\","," \"milestones?state=all\","," \"OPEN_ISSUES\","," \"gh release view\","," \"Close release milestone\","," \"--method PATCH\","," \"-f state=closed\","," \"release workflow missing dispatch/milestone guard: {needle}\""," policy.contains(\"publication_before_milestone_closure = true\"),"," \"release policy must require publication before milestone closure\""," let publish_step = workflow"," .find(\"name: Publish GitHub release\")"," .expect(\"release workflow must publish the GitHub Release\");"," let close_step = workflow"," .find(\"name: Close release milestone\")"," .expect(\"release workflow must close the milestone\");"," publish_step < close_step,"," \"release workflow must close the milestone only after publishing the release\""," workflow.contains(\"MILESTONE_NUMBER=\\\"${{ steps.release.outputs.milestone_number }}\\\"\")"," && workflow"," .contains(\"MILESTONE_STATE=\\\"${{ steps.release.outputs.milestone_state }}\\\"\",),"," \"milestone closure must be driven by release verification outputs\""," fn release_workflow_paginates_milestone_lookup() {"," policy.contains(\"milestone_lookup = \\\"paginated_all_states\\\"\"),"," \"release automation policy must require paginated all-state milestone lookup\""," let verification_step = workflow"," .split(\"name: Verify tag target, release notes, and milestone\")"," .and_then(|tail| tail.split(\"name: Publish GitHub release\").next())"," .expect(\"release verification step\");"," verification_step"," .contains(\"gh api --paginate \\\"repos/${GITHUB_REPOSITORY}/milestones?state=all&per_page=100\\\"\"),"," \"release workflow must paginate all-state milestone lookup\""," fn release_milestone_lookup_consumes_complete_paginated_stream() {"," let release_workflow ="," let auto_workflow = fs::read_to_string(root.join(\".github/workflows/auto-release-tag.yml\"))"," .expect(\"auto release workflow\");"," policy.contains(\"milestone_selection = \\\"complete_stream_first_match\\\"\"),"," \"release automation policy must require full-stream milestone selection\""," let release_verification = workflow_block("," &release_workflow,"," \"name: Verify tag target, release notes, and milestone\","," \"name: Publish GitHub release\","," milestone_lookup_consumes_complete_stream(release_verification),"," \"release workflow must consume the full paginated milestone stream\""," let auto_tag_job = workflow_block("," &auto_workflow,"," \"name: Create immutable release tag\","," \"dispatch-release-publication:\","," milestone_lookup_consumes_complete_stream(auto_tag_job),"," \"auto-release workflow must consume the full paginated milestone stream\""," fn milestone_lookup_contract_rejects_head_truncation() {"," let lookup = r#\"MILESTONE_JSON=\"$(gh api --paginate \"repos/${GITHUB_REPOSITORY}/milestones?state=all&per_page=100\" \\"," --jq \".[] | select(.title == \\\"${TAG}\\\")\" | head -n 1)\"\"#;"," !milestone_lookup_consumes_complete_stream(lookup),"," \"milestone lookup contract must reject head-based truncation\""," fn release_workflow_checks_out_release_tag_for_dispatch() {"," let checkout_step = workflow"," .split(\"actions/checkout@\")"," .and_then(|tail| tail.split(\"- name: Verify tag target\").next())"," .expect(\"release workflow checkout block\");"," let release_ref ="," \"${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}\";"," checkout_step.contains(&format!(\"ref: {release_ref}\")),"," \"release workflow must read release notes from the tag being published\""," fn auto_release_tag_workflow_is_guarded() {"," let workflow = fs::read_to_string(root.join(\".github/workflows/auto-release-tag.yml\"))"," \"workflow_run:\","," \"workflows: [\\\"CI\\\"]\","," \"branches: [main]\","," \"github.event.workflow_run.conclusion == 'success'\","," \"github.event.workflow_run.event == 'push'\","," \"inputs.sha\","," \"/commits/${SHA}/pulls\","," \"^release/v[0-9]+\","," \"git tag -a\","," \"refusing to move\","," \"gh workflow run release.yml\","," \"actions: write\","," \"auto release workflow missing guard/action: {needle}\""," !workflow.contains(\"--force\"),"," \"auto release workflow must not force any git operation\""," policy.contains(\"source_event = \\\"push\\\"\"),"," \"release automation policy must restrict auto-tagging to push CI runs\""," policy.contains(\"manual_recovery_trigger = \\\"workflow_dispatch\\\"\"),"," \"release automation policy must allow manual recovery dispatch\""," policy.contains(\"manual_recovery_requires = [\"),"," \"release automation policy must structure manual recovery requirements\""," for required in ["," \"main_ci_success\","," \"merged_release_pr\","," \"manual_tag_matches_release_prep_pr\","," policy.contains(required),"," \"release automation policy missing manual recovery requirement: {required}\""," fn auto_release_tag_manual_dispatch_checks_verified_main_sha() {"," let identify_job = workflow_block(&workflow, \"identify-release-pr:\", \"create-release-tag:\");"," let manual_recovery = workflow_block("," identify_job,"," \"if [[ \\\"${EVENT_NAME}\\\" == \\\"workflow_dispatch\\\" ]]; then\","," \"exit 0\","," \"tag:\","," \"sha:\","," \"github.event_name == 'workflow_dispatch'\","," \"INPUT_TAG:\","," \"INPUT_SHA:\","," \"git fetch origin main:refs/remotes/origin/main --tags\","," \"git merge-base --is-ancestor \\\"${SHA}\\\" origin/main\","," \"actions/workflows/ci.yml/runs\","," \"head_sha=${SHA}\","," \"status=success\","," \"Manual recovery SHA must have a successful main CI run\","," \"Manual recovery SHA must resolve to exactly one merged release-prep PR.\","," \"if [[ \\\"${TAG}\\\" != \\\"${INPUT_TAG}\\\" ]]\","," \"release=true\","," \"tag=${TAG}\","," \"sha=${SHA}\","," manual_recovery.contains(required) || workflow.contains(required),"," \"auto-release manual recovery missing verified-sha contract: {required}\""," fn auto_release_tag_workflow_scopes_job_permissions() {"," policy.contains(\"job_permissions = \\\"least_privilege\\\"\"),"," \"release automation policy must require least-privilege job permissions\""," let top_level_permissions = workflow"," .split(\"permissions:\")"," .and_then(|tail| tail.split(\"\\njobs:\").next())"," .expect(\"top-level permissions block\");"," top_level_permissions.contains(\"contents: read\")"," && !top_level_permissions.contains(\"write\"),"," \"top-level auto-release permissions must be read-only\""," let identify_job = workflow"," .split(\"identify-release-pr:\")"," .and_then(|tail| tail.split(\"create-release-tag:\").next())"," .expect(\"identify-release-pr job block\");"," identify_job.contains("," \"permissions:\\n actions: read\\n contents: read\\n pull-requests: read\","," )"," && !identify_job.contains(\"write\"),"," \"identify-release-pr must only read actions, contents, and pull requests\""," let tag_job = workflow"," .split(\"create-release-tag:\")"," .and_then(|tail| tail.split(\"dispatch-release-publication:\").next())"," .expect(\"create-release-tag job block\");"," tag_job.contains(\"permissions:\\n contents: write\\n issues: read\")"," && !tag_job.contains(\"actions: write\")"," && !tag_job.contains(\"pull-requests: write\"),"," \"create-release-tag must only write contents and read issues\""," let dispatch_job = workflow"," .split(\"dispatch-release-publication:\")"," .expect(\"dispatch-release-publication job block\");"," dispatch_job.contains(\"permissions:\\n actions: write\")"," && !dispatch_job.contains(\"contents: write\")"," && !dispatch_job.contains(\"issues: write\")"," && !dispatch_job.contains(\"pull-requests: write\"),"," \"dispatch-release-publication must only write actions\""," fn auto_release_tag_uses_ephemeral_push_credentials() {"," \"persist-credentials: false\","," \"AUTHENTICATED_ORIGIN=\\\"https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git\\\"\","," \"git ls-remote --exit-code --tags \\\"${AUTHENTICATED_ORIGIN}\\\"\","," \"git fetch \\\"${AUTHENTICATED_ORIGIN}\\\"\","," \"git push \\\"${AUTHENTICATED_ORIGIN}\\\"\","," tag_job.contains(required),"," \"create-release-tag job missing ephemeral credential guard: {required}\""," fn auto_release_tag_checks_milestone_before_tag_push() {"," let milestone_check = workflow"," .find(\"OPEN_ISSUES\")"," .expect(\"auto release workflow must check milestone open issue count\");"," let tag_creation = workflow"," .find(\"git tag -a\")"," .expect(\"auto release workflow must create an annotated tag\");"," milestone_check < tag_creation,"," \"auto release workflow must check milestone readiness before creating an immutable tag\""," fn auto_release_tag_dispatches_release_from_tag_ref() {"," workflow.contains(r#\"gh workflow run release.yml --ref \"${TAG}\" -f tag=\"${TAG}\"\"#),"," \"auto release workflow must dispatch release.yml from the created tag ref\""," fn auto_release_tag_dispatches_with_explicit_repo() {"," dispatch_job.contains(\"GH_REPO: ${{ github.repository }}\")"," || dispatch_job.contains(\"--repo \\\"${GITHUB_REPOSITORY}\\\"\"),"," \"release dispatch must name the repository explicitly\""," fn release_tag_recovery_policy_is_structured() {"," \"[release_tags]\","," \"mutation = \\\"forbidden\\\"\","," \"recovery = \\\"publish_existing_valid_tag\\\"\","," \"requires_main_reachable_target = true\","," \"normal_creation = \\\"auto_after_release_pr_main_ci\\\"\","," \"manual_creation = \\\"operator_fallback\\\"\","," policy.contains(needle),"," \"release policy missing structured field: {needle}\""," fn release_runbook_policy_is_structured() {"," \"[release_runbook]\","," \"prepare_branch\","," \"merge_gate\","," \"auto_tag_publish\","," \"watch_workflow\","," \"capture_evidence\","," \"manual_fallback_target = \\\"verified_main_merge_commit\\\"\","," \"post_release_milestone_lookup = \\\"all_states_paginated\\\"\","," \"cargo xtask verify\","," \"gh pr checks\","," \"release runbook policy missing structured field: {required}\""," fn release_automation_policy_is_structured() {"," \"[release_automation]\","," \"trigger = \\\"successful_main_ci_after_release_prep_merge\\\"\","," \"source_branch_pattern = \\\"release/vX.Y.Z-alpha.N-prep\\\"\","," \"tag_derivation = \\\"strip_release_prefix_and_prep_suffix\\\"\","," \"publication_trigger = \\\"workflow_dispatch\\\"\","," \"close_milestone = \\\"after_github_release_when_zero_open_issues\\\"\","," \"idempotency = \\\"existing_same_target_tag_ok\\\"\","," \"existing_different_target_tag = \\\"fail_without_mutation\\\"\","," \"tag_absent_or_same_target\","," \"zero_open_milestone_issues\","," \"release automation policy missing structured field: {required}\""," fn release_policy_tracks_v0_3_boundary() {"," \"[release_notes.v0_3_0_alpha_1]\","," \"tag = \\\"v0.3.0-alpha.1\\\"\","," \"target_date = \\\"2026-07-15\\\"\","," \"status = \\\"published\\\"\","," \"compiler_spine\","," \"surface_validation_split\","," \"canonical_core_encoder\","," \"reviewed_core_golden_fixture\","," \"exact_core_digest_fixture\","," \"no_target_lowering\","," \"no_bundle_admission\","," \"v0.3 release policy missing structured field: {required}\""," fn release_policy_tracks_v0_4_boundary() {"," \"[release_notes.v0_4_0_alpha_1]\","," \"tag = \\\"v0.4.0-alpha.1\\\"\","," \"target_date = \\\"2026-07-29\\\"\","," \"target_profile_conformance\","," \"lowerability_direct_adapter\","," \"contract_bundle_manifest_validation\","," \"no_target_lowerer_execution\","," \"no_admission_policy\","," \"no_crates_io_publish\","," \"v0.4 release policy missing structured field: {required}\""," fn release_policy_tracks_v0_5_boundary() {"," \"[release_notes.v0_5_0_alpha_1]\","," \"tag = \\\"v0.5.0-alpha.1\\\"\","," \"target_date = \\\"2026-08-12\\\"\","," \"status = \\\"publish_ready\\\"\","," \"edict_owned_continuum_participation_boundary\","," \"gate_c_admission_request_validation\","," \"gate_c_admission_receipt_validation\","," \"admission_request_digest_binding\","," \"policy_epoch_receipt_binding\","," \"invocation_capability_evidence_validation\","," \"release_automation_after_main_ci\","," \"no_participant_policy_evaluation\","," \"no_participant_identity_delegation_or_revocation\","," \"no_admission_ledger_persistence\","," \"no_signature_verification\","," \"no_bundle_digest_recomputation\","," \"v0.5 release policy missing structured field: {required}\""," fn alpha_changelog_dates_match_release_policy() {"," let changelog = fs::read_to_string(root.join(\"CHANGELOG.md\")).expect(\"changelog\");"," for (tag, target) in ["," (\"v0.2.0-alpha.1\", \"2026-07-01\"),"," (\"v0.3.0-alpha.1\", \"2026-07-15\"),"," (\"v0.4.0-alpha.1\", \"2026-07-29\"),"," (\"v0.5.0-alpha.1\", \"2026-08-12\"),"," policy.contains(&format!(\"tag = \\\"{tag}\\\"\")),"," \"release policy missing tag {tag}\""," policy.contains(&format!(\"target_date = \\\"{target}\\\"\")),"," \"release policy missing target date {target}\""," changelog.contains(&format!(\"## [{tag}] - {target}\")),"," \"{tag} changelog date must match release policy target date {target}\""," fn release_policy_tracks_v0_2_boundary() {"," \"[release_notes.v0_2_0_alpha_1]\","," \"tag = \\\"v0.2.0-alpha.1\\\"\","," \"target_date = \\\"2026-07-01\\\"\","," \"core_semantic_model\","," \"normative_core_schema\","," \"no_source_to_core_lowering\","," \"no_canonical_encoder\","," \"no_golden_core_bytes\","," \"no_exact_core_digests\","," \"v0.2 release policy missing structured field: {required}\""," fn core_cddl_declares_v1_semantic_model() {"," let cddl ="," fs::read_to_string(root.join(\"docs/abi/edict-core.cddl\")).expect(\"Core schema exists\");"," \"core-module =\","," \"apiVersion: \\\"edict.core/v1\\\"\","," \"core-type =\","," \"core-intent =\","," \"core-block =\","," \"core-node =\","," \"core-expr =\","," \"core-predicate =\","," \"core-fn-body =\","," \"input-constraint =\","," \"local-ref =\","," \"alphaName:\","," \"requiredOperationProfile:\","," assert!(cddl.contains(needle), \"Core CDDL missing {needle}\");"," fn core_cddl_has_no_digest_freeze_fields() {"," for forbidden in ["," \"coreDigest\","," \"canonicalCoreDigest\","," \"canonicalBytes\","," \"goldenBytes\","," \"exactDigest\","," !cddl.contains(forbidden),"," \"v0.2 Core schema must not freeze byte/hash field `{forbidden}`\""," fn core_schema_shape_fixtures_match_cddl() {"," let fixture_root = root.join(\"fixtures/core/schema\");"," let mut checked = 0usize;"," for expectation in [FixtureExpectation::Accept, FixtureExpectation::Reject] {"," let dir = fixture_root.join(expectation.dir_name());"," for entry in fs::read_dir(&dir).unwrap_or_else(|err| {"," panic!("," \"read Core schema fixture directory {}: {err}\","," dir.display()"," )"," }) {"," let path = entry.expect(\"fixture entry\").path();"," if path.extension().and_then(|ext| ext.to_str()) != Some(\"fields\") {"," continue;"," let fixture = parse_core_schema_fixture(&path);"," assert_eq!("," fixture.expectation,"," expectation,"," \"{} expectation disagrees with directory name\","," path.display()"," );"," let shape = core_shape_fields(&cddl, &fixture.shape);"," let missing = shape"," .required"," .difference(&fixture.fields)"," .cloned()"," .collect::>();"," let unknown = fixture"," .fields"," .difference(&shape.allowed)"," let valid = missing.is_empty() && unknown.is_empty();"," match expectation {"," FixtureExpectation::Accept => assert!("," valid,"," \"{} should be accepted; missing {:?}, unknown {:?}\","," path.display(),"," missing,"," unknown"," ),"," FixtureExpectation::Reject => assert!("," !valid,"," \"{} should be rejected by schema shape validation\","," path.display()"," checked += 1;"," assert!(checked >= 5, \"expected at least 5 Core schema fixtures\");"," #[derive(Debug)]"," struct CoreShapeFields {"," allowed: BTreeSet,"," required: BTreeSet,"," struct CoreSchemaFixture {"," expectation: FixtureExpectation,"," fields: BTreeSet,"," shape: String,"," #[derive(Copy, Clone, Debug, Eq, PartialEq)]"," enum FixtureExpectation {"," Accept,"," Reject,"," impl FixtureExpectation {"," fn dir_name(self) -> &'static str {"," match self {"," Self::Accept => \"accepted\","," Self::Reject => \"rejected\","," fn core_shape_fields(cddl: &str, shape: &str) -> CoreShapeFields {"," let start = format!(\"{shape} = {{\");"," let mut in_shape = false;"," let mut fields = CoreShapeFields {"," allowed: BTreeSet::new(),"," required: BTreeSet::new(),"," for raw in cddl.lines() {"," let line = raw.split_once(';').map_or(raw, |(before, _)| before).trim();"," if !in_shape {"," if line == start {"," in_shape = true;"," if line.starts_with('}') {"," break;"," let Some((field, _)) = line"," .strip_suffix(',')"," .unwrap_or(line)"," .strip_prefix(\"? \")"," .split_once(':')"," else {"," let field = field.trim();"," if field.is_empty() || field.contains(char::is_whitespace) {"," fields.allowed.insert(field.to_owned());"," if !line.starts_with(\"? \") {"," fields.required.insert(field.to_owned());"," !fields.allowed.is_empty(),"," \"no fields parsed for Core shape {shape}\""," fields"," fn parse_core_schema_fixture(path: &Path) -> CoreSchemaFixture {"," let text = fs::read_to_string(path)"," .unwrap_or_else(|err| panic!(\"read Core schema fixture {}: {err}\", path.display()));"," let mut expectation = None;"," let mut shape = None;"," let mut fields = BTreeSet::new();"," if line.is_empty() || line.starts_with('#') {"," let Some((key, value)) = line.split_once(' ') else {"," panic!(\"{} has malformed line `{line}`\", path.display());"," match key {"," \"expect\" => {"," expectation = Some(match value {"," \"accept\" => FixtureExpectation::Accept,"," \"reject\" => FixtureExpectation::Reject,"," other => panic!(\"{} has invalid expectation `{other}`\", path.display()),"," });"," \"field\" => {"," fields.insert(value.to_owned());"," \"shape\" => {"," shape = Some(value.to_owned());"," other => panic!(\"{} has unknown directive `{other}`\", path.display()),"," CoreSchemaFixture {"," expectation: expectation"," .unwrap_or_else(|| panic!(\"{} missing expectation\", path.display())),"," fields,"," shape: shape.unwrap_or_else(|| panic!(\"{} missing shape\", path.display())),"," fn temp_root(name: &str) -> PathBuf {"," let mut dir = std::env::temp_dir();"," dir.push(format!(\"edict-xtask-{name}-{}\", std::process::id()));"," fs::remove_dir_all(&dir).ok();"," fs::create_dir_all(&dir).expect(\"temp root\");"," dir","docs/topics/release-process/test-plan.md",[1750],{"_780":611,"_781":1751,"_422":1752,"_784":59},95,[1753,204,1754,204,1755,204,1756,204,1757,1758,1759,1760,1761,1762,1763,1764,1765,1766,1767,204,1768,204,1769,1770,1771,1772,204,1773,204,1774,1775,1776,1777,1778,1779,1780,1781,1782,1783,1784,1785,1786,1787,1788,1789,1790,204,1791,204,1792,1793,1794,1795,1796,1797,1798,1799,1800,1801,1802,204,1803,204,1804,1805,1806,1807,1808,1809,1810,1811,1812,1813,1814,1815,204,1816,204,1817,1818,1819,1820,1821,1822,1823,1824,1825,1826,204,1827,204,1828,1829,1830,1831],"# Release Process Test Plan","Status: current verification design for Edict release automation.","## Scope","In scope:","- tag-triggered GitHub Release publication;","- main-branch reachability checks for release tag targets;","- release notes lookup by full tag name;","- prerelease classification for SemVer prerelease versions;","- no crates.io publication in the current release workflow;","- operator runbook phases and required release checks;","- release-prep PR auto-tagging after successful `main` CI;","- manual recovery dispatch for verified release-prep merge commits;","- milestone closure after successful release publication;","- structured release metadata for alpha scope and non-goal boundaries;","- deterministic local checks for workflow contract drift.","Out of scope:","- crates.io publication;","- binary asset signing;","- artifact upload beyond GitHub Release notes;","- automatic retry of failed historical tag events.","## Requirements","| ID | Status | Requirement | Source |","| --- | --- | --- | --- |","| RELEASE-REQ-001 | implemented | Release publication is triggered by pushed `v*` tags. | .github/workflows/release.yml |","| RELEASE-REQ-002 | implemented | Release tags must target commits reachable from `origin/main`. | .github/workflows/release.yml |","| RELEASE-REQ-003 | implemented | Release notes are loaded by full tag name from `docs/releases/${TAG}.md`. | .github/workflows/release.yml |","| RELEASE-REQ-004 | implemented | SemVer prerelease tags publish as GitHub prereleases. | .github/workflows/release.yml |","| RELEASE-REQ-005 | implemented | The current release workflow does not publish crates or other package artifacts. | .github/workflows/release.yml |","| RELEASE-REQ-006 | implemented | Pushed release tags are durable; recovery must not move, delete, or recreate release tags. | docs/topics/release-process/policy.toml |","| RELEASE-REQ-007 | implemented | Structured release policy captures the `v0.2.0-alpha.1` Core schema scope and explicit non-goals. | docs/topics/release-process/policy.toml |","| RELEASE-REQ-008 | implemented | Scheduled alpha release changelog dates match their structured release policy target dates. | CHANGELOG.md, docs/topics/release-process/policy.toml |","| RELEASE-REQ-009 | implemented | Release preparation follows a documented runbook with branch prep, local verification, PR merge gate, tag publication, workflow watch, evidence capture, and non-mutating recovery phases. | docs/topics/release-process/runbook.md, docs/topics/release-process/policy.toml |","| RELEASE-REQ-010 | implemented | Structured release policy captures the `v0.3.0-alpha.1` compiler-spine, canonical encoder, reviewed golden fixture, exact digest, and explicit non-goal boundaries. | docs/topics/release-process/policy.toml |","| RELEASE-REQ-011 | implemented | Structured release policy captures the `v0.4.0-alpha.1` target-profile, lowerability, contract-bundle validation, and explicit non-goal boundaries. | docs/topics/release-process/policy.toml |","| RELEASE-REQ-012 | implemented | Successful `main` CI on a merged `release/vX.Y.Z-alpha.N-prep` pull request creates an immutable `vX.Y.Z-alpha.N` tag and dispatches release publication. | .github/workflows/auto-release-tag.yml, docs/topics/release-process/policy.toml |","| RELEASE-REQ-013 | implemented | Release publication closes the matching GitHub milestone only after the release exists and the milestone has zero open issues. | .github/workflows/release.yml, docs/topics/release-process/policy.toml |","| RELEASE-REQ-014 | implemented | Structured release policy captures the `v0.5.0-alpha.1` Gate C admission-boundary scope, release automation, and explicit Continuum-owned non-goal boundaries. | docs/topics/release-process/policy.toml |","| RELEASE-REQ-015 | implemented | Manual auto-release recovery must only tag a requested `v*` release when the provided SHA is reachable from `origin/main`, has successful `main` CI, came from exactly one merged `release/*-prep` pull request, and derives the requested tag. | .github/workflows/auto-release-tag.yml, docs/topics/release-process/policy.toml |","## Fixtures","| Fixture | Purpose | Oracle |","| --- | --- | --- |","| docs/releases/v0.1.0-alpha.1.md | Published release notes for the first front-end alpha. | The release workflow looks up this file by full tag name. |","| docs/releases/v0.2.0-alpha.1.md | Published release notes for the Core semantic model and schema alpha. | The release workflow looks up this file by full tag name. |","| docs/releases/v0.3.0-alpha.1.md | Published release notes for the compiler-spine and canonical Core alpha. | The release workflow looks up this file by full tag name. |","| docs/releases/v0.4.0-alpha.1.md | Published release notes for the target-profile, lowerability, and contract-bundle validation alpha. | The release workflow looks up this file by full tag name. |","| docs/releases/v0.5.0-alpha.1.md | Release notes for the Gate C admission-boundary alpha. | The release workflow looks up this file by full tag name after auto-tagging. |","| .github/workflows/auto-release-tag.yml | Successful main-CI release-prep merges create immutable release tags and dispatch publication. | The workflow derives tags only from merged `release/*-prep` branches and refuses tag mutation. |","| CHANGELOG.md | Release history for published and publish-ready alpha releases. | Scheduled alpha release sections use the matching release target date. |","| docs/topics/release-process/policy.toml | Structured release-tag, runbook, and alpha boundary policy. | Tag mutation is forbidden, runbook phases are named, and release scope/non-goals are structured. |","| docs/topics/release-process/runbook.md | Operator steps for preparing, tagging, publishing, and recovering releases. | The structured policy names the phases and checks the runbook must cover. |","## Test Cases","| ID | Status | Category | Requirement | Oracle | Evidence | Fixtures | Notes |","| --- | --- | --- | --- | --- | --- | --- | --- |","| RELEASE-TP-001 | implemented | Golden path | RELEASE-REQ-001, RELEASE-REQ-002, RELEASE-REQ-003, RELEASE-REQ-004, RELEASE-REQ-005 | The workflow contains the tag trigger, main reachability guard, full-tag release-notes path, verified GitHub Release creation, prerelease flag, and no package publish command. | release_workflow_publishes_only_main_reachable_tags | docs/releases/v0.1.0-alpha.1.md | Static workflow contract regression. |","| RELEASE-TP-002 | implemented | Policy guard | RELEASE-REQ-006 | Structured policy forbids tag mutation and names existing-valid-tag publication as recovery. | release_tag_recovery_policy_is_structured | docs/topics/release-process/policy.toml | Policy evidence is structured, not prose. |","| RELEASE-TP-003 | implemented | Boundary guard | RELEASE-REQ-007 | Structured policy captures the v0.2 Core schema scope and non-goals for lowering, encoder, bytes, digests, targets, and admission. | release_policy_tracks_v0_2_boundary | docs/topics/release-process/policy.toml | Prevents the release metadata from overclaiming the Core milestone. |","| RELEASE-TP-004 | implemented | Consistency guard | RELEASE-REQ-008 | The v0.2 and v0.3 changelog section dates equal their target dates in structured release policy. | alpha_changelog_dates_match_release_policy | CHANGELOG.md, docs/topics/release-process/policy.toml | Prevents release chronology drift across release prep and publication. |","| RELEASE-TP-005 | implemented | Runbook guard | RELEASE-REQ-009 | Structured policy names the release-prep phases and required checks for local verification, PR checks, and release existence. | release_runbook_policy_is_structured | docs/topics/release-process/policy.toml, docs/topics/release-process/runbook.md | Keeps the human runbook tied to a stable release contract. |","| RELEASE-TP-006 | implemented | Boundary guard | RELEASE-REQ-010 | Structured policy captures the v0.3 compiler-spine, canonical encoder, reviewed golden fixture, exact digest, target-lowering, and admission boundaries. | release_policy_tracks_v0_3_boundary | docs/topics/release-process/policy.toml | Prevents the release metadata from overclaiming the compiler-spine milestone. |","| RELEASE-TP-007 | implemented | Boundary guard | RELEASE-REQ-011 | Structured policy captures the v0.4 target-profile, lowerability, contract-bundle validation, target-lowering, admission, and publication boundaries. | release_policy_tracks_v0_4_boundary | docs/topics/release-process/policy.toml | Prevents the release metadata from overclaiming the target-profile and lowerability milestone. |","| RELEASE-TP-008 | implemented | Automation guard | RELEASE-REQ-012, RELEASE-REQ-013 | The auto-release workflow watches successful `main` CI, derives tags from merged release-prep PRs, refuses tag moves, dispatches release publication, and the Release workflow closes zero-open milestones after publication. | release_automation_policy_is_structured, auto_release_tag_workflow_is_guarded, release_workflow_supports_dispatch_and_milestone_closure | .github/workflows/auto-release-tag.yml, .github/workflows/release.yml, docs/topics/release-process/policy.toml | Keeps release automation deterministic and non-mutating. |","| RELEASE-TP-009 | implemented | Boundary guard | RELEASE-REQ-014 | Structured policy captures the v0.5 admission-boundary scope and explicit non-goals for Continuum-owned policy, identity, delegation, revocation, ledger persistence, signature verification, target lowering, and crates.io publication. | release_policy_tracks_v0_5_boundary | docs/topics/release-process/policy.toml | Prevents the release metadata from overclaiming the Gate C admission milestone. |","| RELEASE-TP-010 | implemented | Recovery guard | RELEASE-REQ-015 | The manual auto-release recovery path requires a successful main-CI release-prep merge, derives the tag from the merged release-prep PR, and rejects mismatched operator tag input before writing release outputs. | auto_release_tag_manual_dispatch_checks_verified_main_sha, auto_release_tag_workflow_is_guarded | .github/workflows/auto-release-tag.yml, docs/topics/release-process/policy.toml | Keeps manual recovery idempotent without allowing arbitrary tag/SHA pairing. |","## Determinism Obligations","- Release workflow contract tests inspect checked-in workflow text, not live"," GitHub state.","- Release tags must be explicit automation or operator actions; no test creates"," or pushes live tags.","- Recovery documentation must distinguish workflow fixes from tag mutation.","- Tests do not scrape human diagnostic prose from Actions logs.","- Release metadata tests assert structured policy artifacts rather than rendered"," prose or live GitHub state.","- Automation tests inspect checked-in workflows and policy, not live GitHub PR,"," tag, release, or milestone state.","## Open Gaps","- The release workflow does not yet have a local end-to-end dry run harness.","- The current checker proves workflow contract structure, not GitHub API"," availability.","- No crates.io policy exists; package publication remains intentionally absent.",".github/workflows/auto-release-tag.yml",[1834],{"_780":611,"_781":1835,"_422":1836,"_784":59},263,[1837,204,1838,1839,1840,1841,1842,1843,1844,1845,1846,1847,1848,1849,1850,1847,1848,204,1851,1852,204,1853,1854,1855,204,1856,1857,1858,1859,1860,1861,1862,1863,1864,1865,1866,1867,1868,1869,1870,1871,1872,1873,1874,204,1875,1876,1877,1878,1879,1880,1881,1882,1883,1884,1885,204,1886,1887,204,1888,1889,1890,1891,204,1892,1893,1890,1891,204,1894,204,1895,1896,1890,1891,204,1897,1898,1899,204,1900,1901,1890,1891,204,1902,1903,1904,204,1905,1906,1907,1908,1909,1910,204,1911,1912,1890,1891,204,1913,1914,1915,204,1916,1917,1890,1891,204,1918,204,1919,1920,1890,1891,204,1921,204,1922,1923,1890,1891,204,1924,1925,1926,1927,1928,1929,1930,1931,204,1932,1933,1934,204,1935,1936,1937,1938,1939,1940,204,1941,1942,1943,1930,1931,204,1944,1945,1946,1931,204,1947,1948,1949,204,1950,1951,1946,1931,204,1952,1953,204,1954,1955,1946,1931,204,1956,1957,1958,1959,1960,1961,204,1962,1963,1964,1859,1965,1861,1966,1967,1870,1871,1872,1968,1874,1969,204,1970,1971,1877,1879,1972,1973,1883,1884,1885,204,1974,1975,1976,204,1977,1978,1979,204,1980,1981,1946,1931,204,1982,204,1983,1984,1946,1931,204,1985,1986,1987,204,1988,1989,1890,1891,204,1990,1991,1930,1931,204,1992,1993,1994,204,1995,1996,1997,1998,1999,1859,1965,1861,2000,1870,2001,1877,1879,2002,1972,1883,1884,1885,204,2003],"name: Auto Release Tag","on:"," workflow_run:"," workflows: [\"CI\"]"," types: [completed]"," branches: [main]"," workflow_dispatch:"," inputs:"," tag:"," description: \"v* release tag to create or verify\""," required: true"," type: string"," sha:"," description: \"Verified main commit SHA to tag\"","permissions:"," contents: read","concurrency:"," group: auto-release-tag-${{ github.event_name == 'workflow_dispatch' && inputs.sha || github.event.workflow_run.head_sha }}"," cancel-in-progress: false","jobs:"," identify-release-pr:"," name: identify merged release PR"," runs-on: ubuntu-latest"," if: github.event_name == 'workflow_dispatch' || (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push')"," permissions:"," actions: read"," contents: read"," pull-requests: read"," outputs:"," release: ${{ steps.release_pr.outputs.release }}"," tag: ${{ steps.release_pr.outputs.tag }}"," pr: ${{ steps.release_pr.outputs.pr }}"," sha: ${{ steps.release_pr.outputs.sha }}"," steps:"," - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0"," with:"," ref: ${{ github.event_name == 'workflow_dispatch' && inputs.sha || github.event.workflow_run.head_sha }}"," fetch-depth: 0"," - name: Identify merged release PR"," id: release_pr"," env:"," EVENT_NAME: ${{ github.event_name }}"," GH_TOKEN: ${{ github.token }}"," INPUT_SHA: ${{ inputs.sha }}"," INPUT_TAG: ${{ inputs.tag }}"," SHA: ${{ github.event_name == 'workflow_dispatch' && inputs.sha || github.event.workflow_run.head_sha }}"," shell: bash"," run: |"," set -euo pipefail"," if [[ \"${EVENT_NAME}\" == \"workflow_dispatch\" ]]; then"," TAG=\"${INPUT_TAG}\""," if [[ ! \"${SHA}\" =~ ^[0-9a-f]{40}$ ]]; then"," echo \"::error::Manual recovery SHA must be a full 40-character commit SHA: ${SHA}\""," exit 1"," fi"," if [[ ! \"${TAG}\" =~ ^v[0-9]+\\.[0-9]+\\.[0-9]+(-[0-9A-Za-z.]+)?$ ]]; then"," echo \"::error::Manual recovery tag must look like a SemVer v* tag: ${TAG}\""," git fetch origin main:refs/remotes/origin/main --tags"," if ! git merge-base --is-ancestor \"${SHA}\" origin/main; then"," echo \"::error::Manual recovery SHA must be reachable from origin/main.\""," CI_RUN_JSON=\"$(gh api \\"," \"repos/${GITHUB_REPOSITORY}/actions/workflows/ci.yml/runs?branch=main&event=push&head_sha=${SHA}&status=success&per_page=1\" \\"," --jq '.workflow_runs[0] // empty')\""," if [[ -z \"${CI_RUN_JSON}\" ]]; then"," echo \"::error::Manual recovery SHA must have a successful main CI run.\""," PRS_JSON=\"$(gh api \\"," -H \"Accept: application/vnd.github+json\" \\"," \"/repos/${GITHUB_REPOSITORY}/commits/${SHA}/pulls\")\""," MATCHES=\"$(jq '[.[] | select("," .merged_at != null and"," .base.ref == \"main\" and"," (.head.ref | test(\"^release/v[0-9]+\\\\.[0-9]+\\\\.[0-9]+-alpha\\\\.[0-9]+-prep$\"))"," )]' <<<\"${PRS_JSON}\")\""," COUNT=\"$(jq 'length' <<<\"${MATCHES}\")\""," if [[ \"${COUNT}\" != \"1\" ]]; then"," echo \"::error::Manual recovery SHA must resolve to exactly one merged release-prep PR.\""," HEAD_REF=\"$(jq -r '.[0].head.ref' <<<\"${MATCHES}\")\""," PR_NUMBER=\"$(jq -r '.[0].number' <<<\"${MATCHES}\")\""," RELEASE_BRANCH_REGEX='^release/(v[0-9]+\\.[0-9]+\\.[0-9]+-alpha\\.[0-9]+)-prep$'"," if [[ ! \"${HEAD_REF}\" =~ ${RELEASE_BRANCH_REGEX} ]]; then"," echo \"::error::Release branch did not match expected pattern: ${HEAD_REF}\""," TAG=\"${BASH_REMATCH[1]}\""," if [[ \"${TAG}\" != \"${INPUT_TAG}\" ]]; then"," echo \"::error::Manual recovery tag ${INPUT_TAG} does not match merged release-prep PR tag ${TAG}.\""," NOTES=\"docs/releases/${TAG}.md\""," if [[ ! -f \"${NOTES}\" ]]; then"," echo \"::error::Missing release notes file: ${NOTES}\""," {"," echo \"release=true\""," echo \"tag=${TAG}\""," echo \"pr=${PR_NUMBER}\""," echo \"sha=${SHA}\""," } >>\"${GITHUB_OUTPUT}\""," exit 0"," fi"," PRS_JSON=\"$(gh api \\"," -H \"Accept: application/vnd.github+json\" \\"," \"/repos/${GITHUB_REPOSITORY}/commits/${SHA}/pulls\")\""," MATCHES=\"$(jq '[.[] | select("," .merged_at != null and"," .base.ref == \"main\" and"," (.head.ref | test(\"^release/v[0-9]+\\\\.[0-9]+\\\\.[0-9]+-alpha\\\\.[0-9]+-prep$\"))"," )]' <<<\"${PRS_JSON}\")\""," COUNT=\"$(jq 'length' <<<\"${MATCHES}\")\""," if [[ \"${COUNT}\" == \"0\" ]]; then"," echo \"::notice::Successful main CI did not come from a release-prep PR.\""," echo \"release=false\" >>\"${GITHUB_OUTPUT}\""," if [[ \"${COUNT}\" != \"1\" ]]; then"," echo \"::error::Expected exactly one release-prep PR for ${SHA}; found ${COUNT}.\""," exit 1"," HEAD_REF=\"$(jq -r '.[0].head.ref' <<<\"${MATCHES}\")\""," PR_NUMBER=\"$(jq -r '.[0].number' <<<\"${MATCHES}\")\""," RELEASE_BRANCH_REGEX='^release/(v[0-9]+\\.[0-9]+\\.[0-9]+-alpha\\.[0-9]+)-prep$'"," if [[ ! \"${HEAD_REF}\" =~ ${RELEASE_BRANCH_REGEX} ]]; then"," echo \"::error::Release branch did not match expected pattern: ${HEAD_REF}\""," TAG=\"${BASH_REMATCH[1]}\""," NOTES=\"docs/releases/${TAG}.md\""," if [[ ! -f \"${NOTES}\" ]]; then"," echo \"::error::Missing release notes file: ${NOTES}\""," {"," echo \"release=true\""," echo \"tag=${TAG}\""," echo \"pr=${PR_NUMBER}\""," echo \"sha=${SHA}\""," } >>\"${GITHUB_OUTPUT}\""," create-release-tag:"," name: create immutable release tag"," needs: identify-release-pr"," if: needs.identify-release-pr.outputs.release == 'true'"," contents: write"," issues: read"," ref: ${{ needs.identify-release-pr.outputs.sha }}"," persist-credentials: false"," - name: Create immutable release tag"," id: tag"," TAG: ${{ needs.identify-release-pr.outputs.tag }}"," SHA: ${{ needs.identify-release-pr.outputs.sha }}"," git config user.name \"github-actions[bot]\""," git config user.email \"41898282+github-actions[bot]@users.noreply.github.com\""," AUTHENTICATED_ORIGIN=\"https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git\""," MILESTONE_JSON=\"$(gh api --paginate \"repos/${GITHUB_REPOSITORY}/milestones?state=all&per_page=100\" \\"," --jq \".[] | select(.title == \\\"${TAG}\\\")\" |"," jq -s '.[0] // empty')\""," if [[ -z \"${MILESTONE_JSON}\" ]]; then"," echo \"::error::Missing release milestone matching ${TAG}.\""," OPEN_ISSUES=\"$(jq -r '.open_issues' <<<\"${MILESTONE_JSON}\")\""," if [[ \"${OPEN_ISSUES}\" != \"0\" ]]; then"," echo \"::error::Milestone ${TAG} still has ${OPEN_ISSUES} open issue(s).\""," if git ls-remote --exit-code --tags \"${AUTHENTICATED_ORIGIN}\" \"refs/tags/${TAG}\" >/dev/null 2>&1; then"," git fetch \"${AUTHENTICATED_ORIGIN}\" \"refs/tags/${TAG}:refs/tags/${TAG}\""," TAG_COMMIT=\"$(git rev-parse \"${TAG}^{commit}\")\""," if [[ \"${TAG_COMMIT}\" != \"${SHA}\" ]]; then"," echo \"::error::Tag ${TAG} already targets ${TAG_COMMIT}; refusing to move it to ${SHA}.\""," echo \"::notice::Tag ${TAG} already targets ${SHA}.\""," echo \"created=false\" >>\"${GITHUB_OUTPUT}\""," git tag -a \"${TAG}\" \"${SHA}\" -m \"${TAG}\""," git push \"${AUTHENTICATED_ORIGIN}\" \"refs/tags/${TAG}\""," echo \"created=true\" >>\"${GITHUB_OUTPUT}\""," dispatch-release-publication:"," name: dispatch release publication"," needs:"," - identify-release-pr"," - create-release-tag"," actions: write"," - name: Dispatch release publication"," GH_REPO: ${{ github.repository }}"," gh workflow run release.yml --ref \"${TAG}\" -f tag=\"${TAG}\"",[2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016],{"_756":46,"_46":2033},{"_756":2018,"_163":1832,"_780":2031,"_781":2032},{"_756":46,"_46":2030},{"_756":2018,"_163":1832,"_780":2028,"_781":2029},{"_756":46,"_46":2027},{"_756":2018,"_163":1832,"_780":2025,"_781":2026},{"_756":46,"_46":2024},{"_756":2018,"_163":1748,"_780":2023,"_781":2023},{"_756":2018,"_163":1748,"_780":2022,"_781":2022},{"_756":46,"_46":2021},{"_756":2018,"_163":774,"_780":2019,"_781":2020},{"_756":46,"_46":2017},"\n\n**Testing**\n* ✅ `cargo test -p xtask auto_release_tag_manual_dispatch_checks_verified_main_sha`\n* ✅ `cargo test -p xtask auto_release_tag_workflow_is_guarded`\n* ✅ `cargo test -p xtask auto_release_tag_workflow_scopes_job_permissions`\n* ⚠️ `actionlint .github/workflows/auto-release-tag.yml` — `actionlint` is not installed in this environment.\n* ⚠️ `npx markdownlint-cli2 docs/topics/release-process/runbook.md docs/topics/release-process/test-plan.md` — npm registry access returned `403 Forbidden`.\n* ✅ `cargo test -p xtask release_`\n* ✅ `cargo xtask verify`","repo_file_citation",1082,1117,"\n* The xtask regression test asserts the manual recovery contract, including workflow dispatch inputs, main reachability, successful CI, commit-to-PR lookup, exact release-prep PR resolution, and tag/input matching. ",75,46,"\n* The release-process topic test plan now includes `RELEASE-REQ-015` for the manual recovery contract and `RELEASE-TP-010` for the recovery guard evidence. ",103,117,"\n* Manual recovery derives the release tag from the merged release-prep branch and rejects a mismatched operator-provided `INPUT_TAG`. ",87,100,"\n* Manual recovery now queries the PRs associated with the SHA and requires exactly one merged `release/*-prep` PR targeting `main`. ",78,84,"### Review-response confirmation\n\nConfirmed: the review-response pass is valid on the current branch. I did not make any code changes, so I did **not** create a commit or PR.\n\n**Findings checked**\n* Manual recovery now requires a successful `main` CI run for the requested SHA via the `ci.yml` workflow-runs lookup and hard failure when no successful run exists. ",{"_92":330,"_42":84,"_96":330,"_2036":2037,"_2038":2039,"_2040":2041,"_132":-5,"_119":2042},[83],"input_items",[2061,2062,2063,2064,2065,2066,2067,2068,2069],"external_post_config",{"_2043":2044,"_268":201,"_2045":310,"_279":-5,"_2046":262,"_2047":-5,"_2048":-5,"_2049":2050,"_2051":2052,"_2053":-5,"_2054":-5,"_2055":2056,"_2057":15,"_2058":59,"_2059":54,"_2060":15},"user_model_slug","slug",1782421200.096266,"installation_id",89912914,"pr_number","repo_id","gitlab_service_account_project_id","review_trigger","comment_id",4804097942,"comment_type","issue","pr_write_guard_token","pending_pr_reaction_id","pending_comment_reaction_id",374873240,"comment_if_no_findings","comment_on_error","share_url","is_parallel_review",{"_92":428,"_96":330,"_422":2088},{"_317":318,"_319":320,"_2085":324,"_2086":129,"_326":-5,"_92":2087},{"_92":2070,"_319":2084,"_163":-5,"_2072":-5,"_2073":-5},{"_92":2070,"_319":2082,"_163":1832,"_2072":2075,"_2073":2083},{"_92":2070,"_319":2081,"_163":1832,"_2072":2075,"_2073":2076},{"_92":2070,"_319":2078,"_163":2079,"_2072":2075,"_2073":2080},{"_92":2070,"_319":2077,"_163":-5,"_2072":-5,"_2073":-5},{"_92":2070,"_319":2074,"_163":1832,"_2072":2075,"_2073":2076},{"_92":2070,"_319":2071,"_163":-5,"_2072":-5,"_2073":-5},"pull_request_comment","**Actionable comments posted: 1**\n\n

🤖 Prompt for all review comments with AI agents

\n\n

🪄 Autofix (Beta)

\n\nFix all unresolved CodeRabbit comments on this PR:\n\n- [ ] Push a commit to this branch (recommended)\n- [ ] Create a new PR with the fixes\n\n

\n\n---\n\n

ℹ️ Review info

\n\n

⚙️ Run configuration

\n\n**Configuration used**: Organization UI\n\n**Review profile**: ASSERTIVE\n\n**Plan**: Pro\n\n**Run ID**: `5120a2b7-38e3-4b7f-b967-67baff0eb34f`\n\n

\n\n

📥 Commits

\n\nReviewing files that changed from the base of the PR and between e680adf0a3ccc72559d1c4710e81010738918532 and f5e0c10d5d5e6070b5718e08c3578d630a40f340.\n\n

\n\n

📒 Files selected for processing (4)

\n\n* `.github/workflows/auto-release-tag.yml`\n* `docs/topics/release-process/policy.toml`\n* `docs/topics/release-process/runbook.md`\n* `xtask/src/main.rs`\n\n

\n\n

📜 Review details

\n\n

🧰 Additional context used

\n\n

📓 Path-based instructions (1)

\n\n

\n\n","side","line","_🗄️ Data Integrity & Integration_ | _🟠 Major_ | _⚡ Quick win_\n\n**Do not let manual dispatch mint arbitrary release tags.**\n\nLines 65-88 currently trust `INPUT_TAG` after only a broad SemVer check, so any `docs/releases/.md` file can be paired with any `origin/main`-reachable SHA. That bypasses the alpha-only `release/v…-prep -> v…-alpha.N` contract used on the automatic path, and because this workflow later refuses tag mutation, one operator typo can permanently create the wrong immutable release tag on the wrong commit. Reuse the existing `/commits/${SHA}/pulls` lookup here and require the derived release-prep tag to match `INPUT_TAG` (or derive `TAG` from the PR outright). \n \n\n

Suggested direction

\n\n\n\n

📝 Committable suggestion

\n\n\n\n

🤖 Prompt for AI Agents

\n\n\n\n\n\n\n\n\n\n✅ Addressed in commit 855f60f","RIGHT",131,"\n### 💡 Codex Review\n\nHere are some automated review suggestions for this pull request.\n\n**Reviewed commit:** `f5e0c10d5d`\n \n\n

ℹ️ About Codex in GitHub

","**_{_{![P1 Badge](https://img.shields.io/badge/P1-orange?style=flat)}} Add manual recovery to the topic test plan**\n\nThis adds a new manual recovery workflow contract, but `docs/topics/release-process/test-plan.md` still has no requirement or case for `workflow_dispatch` recovery; its automation case only describes successful main-CI release-prep merges. `/workspace/edict/AGENTS.md` requires workflow and contract changes to update the owning topic `test-plan.md` before or alongside tests, so the durable contract graph omits the new behavior and future drift checks do not state what manual recovery must prove.\n\nUseful? React with 👍 / 👎.","docs/topics/release-process/policy.toml",14,"**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Verify the manual SHA came from the release-prep PR**\n\nIn the `workflow_dispatch` path, these outputs trust the operator-provided tag after only reachability and notes checks, without querying `/commits/${SHA}/pulls` or confirming that the commit came from a merged `release/vX.Y.Z-alpha.N-prep` PR that derives the same tag. Even after adding a CI-success check, a mistyped reachable `main` SHA with a matching release-notes file and zero-open milestone would be tagged and published, bypassing the release-prep PR contract still listed in `policy.toml` as `merged_release_pr`.\n\nUseful? React with 👍 / 👎.","**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Require successful CI for manual recovery**\n\nWhen this is manually dispatched, the left side lets the job run without the `github.event.workflow_run.conclusion == 'success'` guard, and the manual block only checks SHA shape, `origin/main` reachability, and release notes. For a release-prep merge whose main CI failed or never completed, an operator can still create the immutable tag and dispatch publication for that SHA, even though `docs/topics/release-process/policy.toml` keeps `main_ci_success` as a required release check; require a successful CI run/check for `inputs.sha` before setting `release=true`.\n\nUseful? React with 👍 / 👎.",30,"\n\n\n[![Review Change Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/flyingrobots/edict/pull/44?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)\n\n\n\n\n> [!WARNING]\n> ## Review limit reached\n> \n> `@flyingrobots`, we couldn't start this review because you've reached your PR review rate limit.\n> \n> More reviews will be available in 28 minutes and 31 seconds. [Learn how PR review limits work](https://docs.coderabbit.ai/management/plans#fair-usage-limits-policy).\n> \n> Your organization has run out of usage credits. Purchase more credits in the [billing tab](https://app.coderabbit.ai/settings/billing?tab=usage&orgId=4252c417-78a1-49cd-a607-68d1e6bdacc4) to continue.\n> \n>

\n>

⌛ How to resolve this issue?

\n> \n> \n>

\n>

🚦 How do rate limits work?

\n> \n>

\n>

ℹ️ Review info

\n> \n>

\n>

⚙️ Run configuration

\n> \n> **Configuration used**: Organization UI\n> \n> **Review profile**: ASSERTIVE\n> \n> **Plan**: Pro\n> \n> **Run ID**: `684743d7-f5bc-43ab-85f2-c90f6cde8cee`\n> \n>

\n> \n>

\n>

📥 Commits

\n> \n> Reviewing files that changed from the base of the PR and between f5e0c10d5d5e6070b5718e08c3578d630a40f340 and 855f60f8f951b6ed6ab2bcac42263cef786e39ac.\n> \n>

\n> \n>

\n>

📒 Files selected for processing (5)

\n> \n>

🚥 Pre-merge checks | ✅ 5

\n\n

✅ Passed checks (5 passed)

\n\n_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}\n\n

❤️ Share

\n\n\n_{Comment `@coderabbitai help` to get the list of available commands.}\n\n","base_ref","head_ref","pull_request_info",[2089],{"_756":46,"_46":2090},"@codex please confirm this review-response pass.\n\n## Activity Summary\n\n| Source | Severity | File | Commit | Outcome |\n| --- | --- | --- | --- | --- |\n| Codex | P2 | `.github/workflows/auto-release-tag.yml` | `855f60f` | Manual recovery now requires a successful `main` CI run for the requested SHA before release outputs are written. |\n| Codex | P2 | `.github/workflows/auto-release-tag.yml` | `855f60f` | Manual recovery now requires exactly one merged `release/*-prep` PR for the SHA and derives the release tag from that PR. |\n| Codex | P1 | `docs/topics/release-process/test-plan.md` | `855f60f` | Added `RELEASE-REQ-015` and `RELEASE-TP-010` for the manual recovery contract. |\n| CodeRabbit | Major | `.github/workflows/auto-release-tag.yml` | `855f60f` | Operator `INPUT_TAG` must match the tag derived from the merged release-prep PR before the workflow can create or reuse a release tag. |\n\n## RED/GREEN Evidence\n\nRED observed before the fix:\n\n- `cargo test -p xtask auto_release_tag_manual_dispatch_checks_verified_main_sha`\n- `cargo test -p xtask auto_release_tag_workflow_is_guarded`\n- `cargo test -p xtask auto_release_tag_workflow_scopes_job_permissions`\n\nGREEN after the fix:\n\n- `cargo test -p xtask auto_release_tag_manual_dispatch_checks_verified_main_sha`\n- `cargo test -p xtask auto_release_tag_workflow_is_guarded`\n- `cargo test -p xtask auto_release_tag_workflow_scopes_job_permissions`\n- `actionlint .github/workflows/auto-release-tag.yml`\n- `npx markdownlint-cli2 docs/topics/release-process/runbook.md docs/topics/release-process/test-plan.md`\n- `cargo test -p xtask release_`\n- `cargo xtask verify`\n\nThe actual recovery inputs were also probed against GitHub: merge commit `e680adf0a3ccc72559d1c4710e81010738918532` has a successful `main` CI run and maps to merged PR #43 from `release/v0.5.0-alpha.1-prep`.",[2351,2352],[],{"_761":762,"_46":763,"_764":765},{"_735":2342},{"_341":2341},{"_341":2128},{"_309":310,"_300":311,"_312":313,"_314":15,"_315":59,"_316":15,"_317":318,"_319":320,"_321":272,"_322":127,"_323":324,"_325":129,"_326":327,"_328":-5,"_329":-5,"_330":2127,"_332":333,"_334":335,"_336":337,"_338":339},{"_42":123,"_198":199,"_200":201,"_202":15,"_203":204,"_205":206,"_207":2116,"_209":-5,"_210":211,"_212":15,"_213":2117,"_215":204,"_216":204,"_217":2118,"_219":2119,"_221":2120,"_223":-5,"_224":225,"_226":227,"_228":229,"_230":2121,"_55":-5,"_119":232,"_233":2122,"_235":2123,"_237":238,"_239":15,"_240":15},{"_133":2109},[2101,2102,2103,2104,2105,2106,2107,2108],{"_150":176,"_152":153,"_154":155,"_156":157,"_158":177,"_160":161,"_162":32,"_163":-5},{"_150":175,"_152":153,"_154":155,"_156":157,"_158":172,"_160":161,"_162":32,"_163":-5},{"_150":173,"_152":153,"_154":155,"_156":157,"_158":174,"_160":161,"_162":32,"_163":-5},{"_150":171,"_152":153,"_154":155,"_156":157,"_158":172,"_160":161,"_162":32,"_163":-5},{"_150":170,"_152":166,"_154":167,"_156":157,"_158":169,"_160":161,"_162":32,"_163":-5},{"_150":165,"_152":166,"_154":167,"_156":168,"_158":169,"_160":161,"_162":32,"_163":-5},{"_150":164,"_152":153,"_154":155,"_156":157,"_158":159,"_160":161,"_162":32,"_163":-5},{"_150":151,"_152":153,"_154":155,"_156":157,"_158":159,"_160":161,"_162":32,"_163":-5},[2110,2111,2112],{"_182":2115,"_184":195},{"_182":2114,"_184":191},{"_182":2113,"_184":185},{"_186":187,"_92":188,"_119":189},{"_186":192,"_92":188,"_119":193},{"_186":196,"_92":188,"_119":197},{"_302":303,"_304":-5,"_305":-5,"_306":-5,"_307":-5,"_308":-5},[262],{"_262":2124},{"_244":245,"_246":247,"_248":249,"_250":251,"_252":253,"_254":255,"_256":257,"_258":259,"_260":261},{},[],{"_243":59},{"_241":59,"_242":204},{"_42":264,"_186":265,"_266":2125,"_268":201,"_269":270,"_271":272,"_273":274,"_275":276,"_277":278,"_279":64,"_280":15,"_281":-5,"_282":-5,"_283":-5,"_284":-5,"_285":-5,"_286":-5,"_162":287,"_288":-5,"_55":2126},{"_294":295,"_42":296,"_92":297,"_298":299,"_300":301},{"_290":15,"_291":15,"_292":15,"_293":15},{"_294":295,"_186":295,"_340":-5,"_298":299,"_42":296},[2129,2130,2131,2132,2133,2134,2135,2136,2137,2138,2139,2140,2141,2142,2143,2144,2145,2146,2147,2148,2149,2150,2151,2152,2153,2154,2155,2156,2157,2158,2159,2160,2161,2162,2163,2164,2165,2166,2167,2168,2169,2170,2171,2172,2173,2174,2175,2176,2177,2178,2179,2180,2181,2182],{"_156":708,"_398":2337},{"_156":413,"_398":2334},{"_156":698,"_398":2331},{"_156":417,"_398":2326},{"_156":417,"_398":2321},{"_156":417,"_398":2317},{"_156":432,"_398":2312},{"_156":432,"_398":2308},{"_156":417,"_398":2305},{"_156":417,"_398":2303},{"_156":432,"_398":2299},{"_156":417,"_398":2297},{"_156":432,"_398":2293},{"_156":417,"_398":2290},{"_156":417,"_398":2288},{"_156":432,"_398":2281},{"_156":417,"_398":2279},{"_156":432,"_398":2275},{"_156":417,"_398":2271},{"_156":417,"_398":2269},{"_156":417,"_398":2267},{"_156":417,"_398":2265},{"_156":417,"_398":2263},{"_156":417,"_398":2261},{"_156":417,"_398":2259},{"_156":432,"_398":2255},{"_156":417,"_398":2253},{"_156":417,"_398":2251},{"_156":432,"_398":2247},{"_156":417,"_398":2243},{"_156":417,"_398":2241},{"_156":417,"_398":2239},{"_156":417,"_398":2237},{"_156":417,"_398":2235},{"_156":417,"_398":2233},{"_156":417,"_398":2231},{"_156":417,"_398":2229},{"_156":417,"_398":2227},{"_156":417,"_398":2225},{"_156":417,"_398":2223},{"_156":417,"_398":2221},{"_156":417,"_398":2219},{"_156":417,"_398":2217},{"_156":417,"_398":2215},{"_156":432,"_398":2211},{"_156":417,"_398":2209},{"_156":432,"_398":2205},{"_156":417,"_398":2203},{"_156":432,"_398":2199},{"_156":417,"_398":2194},{"_156":432,"_398":2192},{"_156":417,"_398":2188},{"_156":413,"_398":2186},{"_156":397,"_398":2183},{"_400":401,"_87":2184},{"_403":404,"_405":406,"_103":-5,"_42":407,"_408":2185,"_410":411,"_412":113},[],{"_412":2187,"_400":401},{"_92":416},{"_419":2189,"_400":401,"_421":407},{"_422":2190,"_424":-5,"_42":-5,"_425":-5,"_426":427,"_96":93,"_92":428},[2191],{"_46":430,"_92":431},{"_419":2193,"_400":401,"_421":407},{"_42":435,"_426":427,"_46":430,"_92":436},{"_419":2195,"_400":401,"_421":407},{"_422":-5,"_439":440,"_42":-5,"_425":-5,"_441":2196,"_92":443},[2197,2198],{"_46":448,"_92":447},{"_46":446,"_92":447},{"_419":2200,"_400":401,"_421":407},{"_422":2201,"_42":452,"_441":2202,"_92":443},[],[448,446],{"_419":2204,"_400":401,"_421":407},{"_456":457,"_42":-5,"_425":-5,"_458":459,"_92":460},{"_419":2206,"_400":401,"_421":407},{"_463":464,"_465":466,"_467":2207,"_469":470,"_405":32,"_471":32,"_42":457,"_472":473,"_474":475,"_412":113,"_92":476},[2208],{"_465":478,"_92":479},{"_419":2210,"_400":401,"_421":407},{"_482":483,"_456":457,"_42":-5,"_425":-5,"_186":484,"_485":-5,"_92":486},{"_419":2212,"_400":401,"_421":407},{"_463":489,"_465":490,"_467":2213,"_469":470,"_405":492,"_471":32,"_42":493,"_472":494,"_474":475,"_412":113,"_92":476},[2214],{"_465":496,"_92":479},{"_419":2216,"_400":401,"_421":407},{"_456":499,"_42":-5,"_425":-5,"_458":500,"_92":460},{"_419":2218,"_400":401,"_421":407},{"_482":503,"_456":499,"_42":-5,"_425":-5,"_186":504,"_485":-5,"_92":486},{"_419":2220,"_400":401,"_421":407},{"_456":507,"_42":-5,"_425":-5,"_458":508,"_92":460},{"_419":2222,"_400":401,"_421":407},{"_482":503,"_456":507,"_42":-5,"_425":-5,"_186":504,"_485":-5,"_92":486},{"_419":2224,"_400":401,"_421":407},{"_456":513,"_42":-5,"_425":-5,"_458":514,"_92":460},{"_419":2226,"_400":401,"_421":407},{"_482":517,"_456":513,"_42":-5,"_425":-5,"_186":504,"_485":-5,"_92":486},{"_419":2228,"_400":401,"_421":407},{"_456":520,"_42":-5,"_425":-5,"_458":521,"_92":460},{"_419":2230,"_400":401,"_421":407},{"_482":517,"_456":520,"_42":-5,"_425":-5,"_186":504,"_485":-5,"_92":486},{"_419":2232,"_400":401,"_421":407},{"_456":526,"_42":-5,"_425":-5,"_458":527,"_92":460},{"_419":2234,"_400":401,"_421":407},{"_482":530,"_456":526,"_42":-5,"_425":-5,"_186":504,"_485":-5,"_92":486},{"_419":2236,"_400":401,"_421":407},{"_456":533,"_42":-5,"_425":-5,"_458":534,"_92":460},{"_419":2238,"_400":401,"_421":407},{"_482":530,"_456":533,"_42":-5,"_425":-5,"_186":504,"_485":-5,"_92":486},{"_419":2240,"_400":401,"_421":407},{"_456":493,"_42":-5,"_425":-5,"_458":539,"_92":460},{"_419":2242,"_400":401,"_421":407},{"_482":542,"_456":493,"_42":-5,"_425":-5,"_186":484,"_485":-5,"_92":486},{"_419":2244,"_400":401,"_421":407},{"_422":-5,"_439":545,"_42":-5,"_425":-5,"_441":2245,"_92":443},[2246],{"_46":548,"_92":447},{"_419":2248,"_400":401,"_421":407},{"_422":2249,"_42":552,"_441":2250,"_92":443},[],[548],{"_419":2252,"_400":401,"_421":407},{"_456":556,"_42":-5,"_425":-5,"_458":557,"_92":460},{"_419":2254,"_400":401,"_421":407},{"_482":560,"_456":556,"_42":-5,"_425":-5,"_186":504,"_485":-5,"_92":486},{"_419":2256,"_400":401,"_421":407},{"_463":563,"_465":564,"_467":2257,"_469":470,"_405":566,"_471":567,"_42":568,"_472":569,"_474":475,"_412":570,"_92":476},[2258],{"_465":572,"_92":479},{"_419":2260,"_400":401,"_421":407},{"_456":575,"_42":-5,"_425":-5,"_458":576,"_92":460},{"_419":2262,"_400":401,"_421":407},{"_482":560,"_456":575,"_42":-5,"_425":-5,"_186":504,"_485":-5,"_92":486},{"_419":2264,"_400":401,"_421":407},{"_456":581,"_42":-5,"_425":-5,"_458":582,"_92":460},{"_419":2266,"_400":401,"_421":407},{"_482":560,"_456":581,"_42":-5,"_425":-5,"_186":504,"_485":-5,"_92":486},{"_419":2268,"_400":401,"_421":407},{"_456":568,"_42":-5,"_425":-5,"_458":587,"_92":460},{"_419":2270,"_400":401,"_421":407},{"_482":590,"_456":568,"_42":-5,"_425":-5,"_186":484,"_485":-5,"_92":486},{"_419":2272,"_400":401,"_421":407},{"_422":-5,"_439":593,"_42":-5,"_425":-5,"_441":2273,"_92":443},[2274],{"_46":596,"_92":447},{"_419":2276,"_400":401,"_421":407},{"_422":2277,"_42":600,"_441":2278,"_92":443},[],[596],{"_419":2280,"_400":401,"_421":407},{"_456":604,"_42":-5,"_425":-5,"_458":605,"_92":460},{"_419":2282,"_400":401,"_421":407},{"_463":608,"_465":609,"_467":2283,"_469":470,"_405":611,"_471":32,"_42":604,"_472":612,"_474":475,"_412":113,"_92":476},[2284,2285,2286,2287],{"_465":629,"_163":630,"_619":631,"_92":621},{"_465":626,"_186":627,"_163":628,"_92":625},{"_465":622,"_186":623,"_163":624,"_92":625},{"_465":617,"_163":618,"_619":620,"_92":621},{"_419":2289,"_400":401,"_421":407},{"_482":634,"_456":604,"_42":-5,"_425":-5,"_186":484,"_485":-5,"_92":486},{"_419":2291,"_400":401,"_421":407},{"_422":-5,"_439":637,"_42":-5,"_425":-5,"_441":2292,"_92":443},[],{"_419":2294,"_400":401,"_421":407},{"_422":2295,"_42":642,"_441":2296,"_92":443},[],[],{"_419":2298,"_400":401,"_421":407},{"_456":646,"_42":-5,"_425":-5,"_458":647,"_92":460},{"_419":2300,"_400":401,"_421":407},{"_463":650,"_465":651,"_467":2301,"_469":470,"_405":32,"_471":32,"_42":646,"_472":653,"_474":475,"_412":113,"_92":476},[2302],{"_465":655,"_92":479},{"_419":2304,"_400":401,"_421":407},{"_482":658,"_456":646,"_42":-5,"_425":-5,"_186":484,"_485":-5,"_92":486},{"_419":2306,"_400":401,"_421":407},{"_422":-5,"_439":661,"_42":-5,"_425":-5,"_441":2307,"_92":443},[],{"_419":2309,"_400":401,"_421":407},{"_422":2310,"_42":666,"_441":2311,"_92":443},[],[],{"_419":2313,"_400":401,"_421":407},{"_670":-5,"_422":2314,"_42":672,"_92":673},[2315],{"_46":675,"_676":2316,"_92":46},[],{"_419":2318,"_400":401,"_421":407},{"_422":2319,"_424":-5,"_42":-5,"_425":-5,"_426":-5,"_96":330,"_92":428},[2320],{"_46":675,"_92":682},{"_419":2322,"_400":401,"_421":407},{"_422":2323,"_424":-5,"_42":-5,"_425":-5,"_426":-5,"_96":330,"_92":428},[2324,2325],{"_46":689,"_92":682},{"_46":688,"_92":682},{"_419":2327,"_400":401,"_421":407},{"_422":2328,"_424":-5,"_42":-5,"_425":-5,"_426":-5,"_96":693,"_92":428},[2329,2330],{"_46":697,"_92":682},{"_46":696,"_92":682},{"_400":401,"_87":2332},{"_103":-5,"_42":407,"_408":2333,"_410":411,"_412":702},[],{"_412":2335,"_400":401},{"_705":2336,"_92":707},[],{"_710":2338},{"_712":-5,"_713":-5,"_714":715,"_716":411,"_469":470,"_717":15,"_718":-5,"_719":-5,"_720":-5,"_721":722,"_42":401,"_723":724,"_186":-5,"_725":-5,"_163":726,"_727":204,"_728":-5,"_474":729,"_412":2339,"_731":-5,"_77":2340,"_733":411},{"_92":416},[],[],[2343],{"_42":738,"_739":2344,"_741":742,"_743":742,"_422":2345,"_412":745,"_424":-5,"_746":32,"_747":2346,"_749":750,"_751":-5},{"_96":330,"_186":-5,"_747":2350},{"_756":46,"_757":2349},{"_752":2347},{"_754":2348},[],[759],{},{"_92":428,"_96":93,"_422":2366},{"_92":768,"_769":2353},[2354,2355,2356],{"_163":1832,"_775":-5,"_776":2363,"_778":-5},{"_163":1748,"_775":-5,"_776":2360,"_778":-5},{"_163":774,"_775":-5,"_776":2357,"_778":-5},[2358],{"_780":611,"_781":782,"_422":2359,"_784":59},[785,786,204,787,788,789,790,791,792,204,793,794,795,796,204,797,798,799,800,801,802,803,804,805,204,806,807,808,809,810,811,812,813,814,815,816,817,818,819,803,820,821,822,804,805,204,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,825,826,827,839,837,840,841,842,843,844,805,204,845,846,847,848,849,850,851,852,853,854,855,856,804,805,204,857,858,805,204,859,860,861,862,863,864,803,804,865,805,204,866,867,868,850,869,870,851,871,872,805,204,873,874,875,876,877,878,204,879,880,881,882,804,883,884,804,204,885,886,887,888,804,204,889,844,805,204,890,891,892,893,805,204,894,895,896,897,898,805,204,899,900,901,902,903,204,904,905,906,804,907,908,909,910,911,912,803,913,844,805,204,914,915,916,917,918,919,920,921,922,923,924,925,926,927,204,928,929,930,931,803,932,933,934,803,804,844,805,204,935,936,937,938,939,940,941,942,943,944,945,805,204,946,947,948,949,854,855,950,951,952,953,804,805,204,954,955,956,804,957,805,204,958,915,959,960,961,918,962,963,964,965,204,966,967,968,969,804,970,971,804,204,972,973,974,975,204,976,977,978,803,979,804,204,980,981,982,983,984,985,986,818,987,803,988,989,803,990,991,992,993,994,995,996,997,998,999,1000,1001,1002,994,1003,1004,994,818,1005,1006,803,1007,1008,1009,818,803,804,204,976,1010,1011,803,1012,1013,1014,1015,803,804,204,1016,1017,1018,1019,1020,1021,1022,803,1023,1024,803,804,204,1025,844,805,204,1026,1027,805,204,1028,1029,1030,1031,1032,1033,1034,818,1035,1036,1037,1038,815,1039,1040,818,803,804,1041,805,204,1042,1029,1030,1031,1043,1044,1045,818,1046,1036,1037,1047,1048,1049,1050,815,1039,1051,818,803,804,1041,805,204,1052,915,1053,1054,961,918,1055,1056,1057,803,1058,1059,1060,818,1061,1062,803,804,844,805,204,1063,1030,1031,1064,1065,1066,1067,1068,1069,803,804,844,805,204,1070,1071,1072,1073,1074,1075,1076,1077,1078,1079,1080,1081,1082,1083,1084,1085,1086,1087,1088,1068,1089,803,1090,1091,1089,803,1092,1093,1013,1094,1095,1015,803,1096,1097,1013,1098,1099,1100,1015,803,1101,1102,1103,1013,1104,1095,1015,803,804,844,805,204,1105,1106,1107,1108,1109,1110,1111,1112,1113,1114,818,1115,1116,1117,1118,1002,994,1119,818,803,804,1120,805,204,1121,1122,1123,1124,1125,1126,1081,1082,1127,1128,1129,803,1084,804,1130,805,204,1131,1132,1133,1134,805,204,1135,1136,1133,1134,805,204,1137,1138,1139,1140,1141,805,204,1142,1143,1144,1065,1145,1146,805,204,1147,1148,805,204,1149,1150,1151,1152,804,1153,1154,1155,1139,1156,1157,805,204,1158,1159,805,204,1160,1161,805,204,1162,1163,1164,1165,1166,803,854,1167,1041,805,204,1168,1163,1169,1170,1171,1172,1173,803,804,1174,1041,805,204,1175,1176,1177,1171,1172,1178,1179,1180,803,804,844,805,204,1181,1182,805,204,1183,1184,1185,1186,1187,803,1188,1189,803,804,805,204,894,1190,1191,1192,1193,805,204,894,1194,1191,1192,1195,1196,1197,1198,805,204,1199,1200,1201,1202,1203,204,1204,204,1205,1206,1207,804,204,1205,1208,1209,1210,1211,1212,1213,1214,1215,1216,1217,1218,1219,1220,1221,945,1222,204,1223,1224,1225,1226,1227,1228,1229,204,1230,804,204,1205,1231,1232,1210,1211,1213,1233,1234,945,1235,1213,1214,1215,1216,1217,1236,1219,1220,1221,945,1222,1237,1213,1238,1239,1240,1241,945,1242,204,1223,1243,1244,1226,1245,1228,1229,204,1230,804,204,1205,1246,1247,1210,1237,1211,1248,1212,1213,1214,1215,1216,1217,1236,1219,1220,1249,945,1222,204,1250,1224,1251,1226,1252,1228,1229,204,1230,804,204,1205,1253,1254,1210,1237,1211,1248,1212,1213,1214,1215,1216,1217,1255,1219,1220,1256,945,1222,204,1250,1257,204,1230,804,204,1205,1258,1259,1210,1237,1211,1248,1212,1213,1214,1215,1216,1217,1260,1219,1220,1261,945,1222,204,1250,1262,1263,1226,1264,1228,1229,204,1230,804,204,1205,1265,1266,1267,1268,1269,1270,1271,204,1272,1226,1273,1228,1229,204,1230,1274,1275,803,804,204,1205,1276,1277,1278,1279,1280,804,204,1205,1281,1282,1278,1283,1284,804,204,1285,1286,1287,1288,1289,1290,804,204,1291,1292,1293,1294,1295,804,204,1205,1296,1297,1298,1299,1300,1301,1302,1303,1304,1305,1306,1307,1308,1309,1310,1311,1312,1313,1314,1315,1316,803,1226,1317,1318,1229,1226,1319,1320,1229,804,204,1205,1321,1297,1298,1299,1322,1323,1300,1303,1324,1325,1326,1327,1328,1329,1330,1331,1332,1312,1313,1314,1333,1316,803,1226,1334,1335,1229,1336,1337,1338,1339,1340,1341,1226,1342,1343,1229,1226,1344,1345,1346,1347,1229,804,204,1205,1348,1297,1298,1299,1322,1323,1226,1349,1350,1229,1351,1352,1288,1353,1354,1226,1355,1356,1357,1229,804,204,1205,1358,1297,1322,1323,1359,1299,1360,1361,1226,1362,1363,1229,1364,1365,1366,1367,1229,1226,1368,1369,1229,1370,1371,1372,1373,1229,1226,1374,1375,1229,804,204,1205,1376,1377,1378,1226,1379,1380,1229,804,204,1205,1381,1297,1298,1299,1382,1383,1288,1384,1385,1386,1387,1226,1388,1389,1229,804,204,1205,1390,1297,1391,1361,1322,1323,1300,1392,1303,1393,1394,1395,1396,1325,1397,1398,1399,1307,1400,1401,1402,1403,1312,1313,1314,1404,1316,803,1226,1405,1406,1229,1226,1407,1408,1229,1226,1409,1410,1229,1226,1411,1412,1229,1413,1414,1415,1416,1312,1313,1417,1418,1316,803,804,204,1205,1419,1297,1391,1361,1420,1421,1422,1423,1424,1229,1413,1303,1425,1426,1427,1428,1429,1430,1431,1432,1433,1434,1435,1398,1436,1437,1438,1439,1440,1312,1313,1441,1442,1316,803,804,204,1205,1443,1297,1391,1361,1322,1323,1226,1444,1445,1229,1446,1447,1288,1448,1449,1226,1450,1451,1452,1229,1453,1454,1288,1455,1456,1226,1457,1458,1459,1460,1461,1229,1462,1463,1288,1464,1465,1226,1466,1467,1468,1469,1229,1470,1471,1288,1472,1226,1473,1474,1475,1476,1477,1229,804,204,1205,1478,1297,1391,1361,1462,1463,1288,1464,1465,1413,1479,1480,1481,1482,1483,1312,1313,1484,1485,1316,803,804,204,1205,1486,1297,1391,1361,1487,1488,1489,1490,1491,1492,1226,1493,1494,1229,804,204,1205,1495,1297,1391,1361,1226,1496,1497,1229,804,204,1205,1498,1297,1391,1361,1470,1471,1288,1472,1226,1499,1500,1501,1229,804,204,1205,1502,1297,1322,1323,1300,1503,1504,1505,1506,1507,1508,1312,1313,1509,1510,1316,803,804,204,1205,1511,1297,1322,1323,1413,1512,1513,1514,1515,1516,1517,1518,1519,1520,1521,1329,1312,1313,1417,1522,1316,803,804,204,1205,1523,1297,1322,1323,1413,1524,1525,1526,1527,1528,1529,1530,1531,1415,1532,1533,1312,1313,1417,1534,1316,803,804,204,1205,1535,1297,1322,1323,1413,1536,1537,1538,1539,1540,1541,1542,1543,1544,1545,1546,1312,1313,1417,1547,1316,803,804,204,1205,1548,1297,1322,1323,1413,1549,1550,1551,1539,1552,1553,1554,1555,1556,1557,1312,1313,1417,1558,1316,803,804,204,1205,1559,1297,1322,1323,1413,1560,1561,1562,1563,1564,1565,1566,1567,1568,1569,1570,1571,1572,1573,1574,1555,1575,1557,1312,1313,1417,1576,1316,803,804,204,1205,1577,1297,1578,1322,1323,1579,1580,1581,1582,1583,1312,1313,1584,1585,1316,1313,1586,1587,1316,1313,1588,1589,1316,803,804,204,1205,1590,1297,1322,1323,1413,1591,1592,1593,1594,1595,1596,1597,1598,1599,1545,1546,1312,1313,1417,1600,1316,803,804,204,1205,1601,1297,1602,1603,1300,1604,1605,1606,1607,1608,1609,1610,1611,1612,1613,1614,1615,1616,1312,1617,803,804,204,1205,1618,1297,1602,1603,1619,1620,1621,1622,1623,1624,1312,1313,1625,1626,1316,803,804,204,1205,1627,1297,1602,1603,1628,1629,204,1630,1631,1632,1633,1634,1635,1636,1637,1638,1639,1640,994,1641,1642,1643,1644,1645,1646,1647,1648,1649,1650,1651,1652,1653,1654,1655,1656,1652,1653,1657,1658,1659,1660,1661,1662,1663,1664,1665,1666,1667,1668,1669,1665,994,1670,818,803,204,1671,804,204,1672,1673,1674,1675,804,204,1672,1676,1677,1678,1679,804,204,1680,1681,1682,1683,804,204,1684,1685,1686,1687,1688,818,803,804,204,1689,1690,1691,1692,1693,1694,1082,1695,1696,1697,1698,1699,994,1114,818,1700,1701,818,1702,1703,1704,1705,1704,1706,1707,1114,815,1708,1709,1114,818,1710,1711,1712,818,803,1226,1713,1714,1229,1715,804,204,1716,1717,1718,1719,1720,1721,1110,1111,1722,1114,818,1723,1724,815,1725,1726,1727,1728,1729,1730,1731,994,1732,1733,994,1734,1735,994,1736,818,803,1737,1738,1739,1740,1741,803,804,204,1742,1743,1744,1745,1746,1747,804,805],[2361],{"_780":611,"_781":1751,"_422":2362,"_784":59},[1753,204,1754,204,1755,204,1756,204,1757,1758,1759,1760,1761,1762,1763,1764,1765,1766,1767,204,1768,204,1769,1770,1771,1772,204,1773,204,1774,1775,1776,1777,1778,1779,1780,1781,1782,1783,1784,1785,1786,1787,1788,1789,1790,204,1791,204,1792,1793,1794,1795,1796,1797,1798,1799,1800,1801,1802,204,1803,204,1804,1805,1806,1807,1808,1809,1810,1811,1812,1813,1814,1815,204,1816,204,1817,1818,1819,1820,1821,1822,1823,1824,1825,1826,204,1827,204,1828,1829,1830,1831],[2364],{"_780":611,"_781":1835,"_422":2365,"_784":59},[1837,204,1838,1839,1840,1841,1842,1843,1844,1845,1846,1847,1848,1849,1850,1847,1848,204,1851,1852,204,1853,1854,1855,204,1856,1857,1858,1859,1860,1861,1862,1863,1864,1865,1866,1867,1868,1869,1870,1871,1872,1873,1874,204,1875,1876,1877,1878,1879,1880,1881,1882,1883,1884,1885,204,1886,1887,204,1888,1889,1890,1891,204,1892,1893,1890,1891,204,1894,204,1895,1896,1890,1891,204,1897,1898,1899,204,1900,1901,1890,1891,204,1902,1903,1904,204,1905,1906,1907,1908,1909,1910,204,1911,1912,1890,1891,204,1913,1914,1915,204,1916,1917,1890,1891,204,1918,204,1919,1920,1890,1891,204,1921,204,1922,1923,1890,1891,204,1924,1925,1926,1927,1928,1929,1930,1931,204,1932,1933,1934,204,1935,1936,1937,1938,1939,1940,204,1941,1942,1943,1930,1931,204,1944,1945,1946,1931,204,1947,1948,1949,204,1950,1951,1946,1931,204,1952,1953,204,1954,1955,1946,1931,204,1956,1957,1958,1959,1960,1961,204,1962,1963,1964,1859,1965,1861,1966,1967,1870,1871,1872,1968,1874,1969,204,1970,1971,1877,1879,1972,1973,1883,1884,1885,204,1974,1975,1976,204,1977,1978,1979,204,1980,1981,1946,1931,204,1982,204,1983,1984,1946,1931,204,1985,1986,1987,204,1988,1989,1890,1891,204,1990,1991,1930,1931,204,1992,1993,1994,204,1995,1996,1997,1998,1999,1859,1965,1861,2000,1870,2001,1877,1879,2002,1972,1883,1884,1885,204,2003],[2367,2368,2369,2370,2371,2372,2373,2374,2375,2376,2377,2378],{"_756":46,"_46":2033},{"_756":2018,"_163":1832,"_780":2031,"_781":2032},{"_756":46,"_46":2030},{"_756":2018,"_163":1832,"_780":2028,"_781":2029},{"_756":46,"_46":2027},{"_756":2018,"_163":1832,"_780":2025,"_781":2026},{"_756":46,"_46":2024},{"_756":2018,"_163":1748,"_780":2023,"_781":2023},{"_756":2018,"_163":1748,"_780":2022,"_781":2022},{"_756":46,"_46":2021},{"_756":2018,"_163":774,"_780":2019,"_781":2020},{"_756":46,"_46":2017},[2381,2382,2383,2384,2385,2386,2387,2388,2389],{"_2043":2044,"_268":201,"_2045":310,"_279":-5,"_2046":262,"_2047":-5,"_2048":-5,"_2049":2050,"_2051":2052,"_2053":-5,"_2054":-5,"_2055":2056,"_2057":15,"_2058":59,"_2059":54,"_2060":15},{"_92":428,"_96":330,"_422":2390},{"_317":318,"_319":320,"_2085":324,"_2086":129,"_326":-5,"_92":2087},{"_92":2070,"_319":2084,"_163":-5,"_2072":-5,"_2073":-5},{"_92":2070,"_319":2082,"_163":1832,"_2072":2075,"_2073":2083},{"_92":2070,"_319":2081,"_163":1832,"_2072":2075,"_2073":2076},{"_92":2070,"_319":2078,"_163":2079,"_2072":2075,"_2073":2080},{"_92":2070,"_319":2077,"_163":-5,"_2072":-5,"_2073":-5},{"_92":2070,"_319":2074,"_163":1832,"_2072":2075,"_2073":2076},{"_92":2070,"_319":2071,"_163":-5,"_2072":-5,"_2073":-5},[2391],{"_756":46,"_46":2090},"task_e_6a3d96ceb420832a851b43db9962d0ac",1782421198.703782,"GitHub Mention: Fix auto-release recovery workflow","has_generated_title","has_unread_turn","denormalized_metadata",{"_2423":32,"_2424":2425,"_2426":-5,"_2427":-5,"_2418":2428,"_2429":-5,"_2430":-5,"_2431":-5,"_2432":-5},"task_status_display",{"_2411":2412,"_2413":201,"_130":127,"_2414":-5,"_2415":2416},"creator_workspace","external_pull_requests",[2404],{"_42":2405,"_2406":83,"_2407":2408,"_2409":129},"github-1272888914-44","assistant_turn_id","pull_request",{"_309":310,"_300":311,"_312":313,"_314":15,"_315":59,"_316":15,"_317":318,"_319":320,"_321":272,"_322":127,"_323":324,"_325":129,"_326":327,"_328":-5,"_329":-5,"_330":2410,"_332":333,"_334":335,"_336":337,"_338":339},"codex_updated_sha",{"_294":295,"_186":295,"_340":-5,"_298":299,"_42":296},"latest_turn_status_display",{"_2417":83,"_112":113,"_2418":-5,"_94":2419,"_2420":-5,"_2421":-5,"_2422":2416,"_114":-5},"environment_label","fix_task_id","initial_intent","pr","turn_id","diff_stats",[],"image_asset_pointer_citations","issue_counts","intent","num_follow_ups","repo_name_map",{},"last_user_turn_created_at","last_turn_status",{"_2433":-5,"_2434":-5,"_2435":-5},"last_pushed_turn_id","start_branch_name","pushed_branch_name","cached_pull_request_data","files_modified","lines_added","lines_removed","dd",{"_2448":2449,"_2450":2451},"disablePrefetch","shouldPrefetchAccount","shouldPrefetchUser","shouldPrefetchSystemHints","promoteCss","disableSSR","stripModulepreloadImports","paidCampaignAppRedirect","statsigGateEvaluationsPromise",["P",2447],"traceId","2924737165131261875","traceTime",1786140659874]