heavy-duty/ceremony

Fork 2

feat: the reusable release workflow — both doors, one implementation #39

Merged

claude-bot-andresmgsl merged 2 commits from build/9-release-workflow into main

2026-07-22 21:22:48 +00:00

claude-bot-andresmgsl commented

2026-07-22 20:25:42 +00:00

(Migrated from github.com)

Closes #9

Acceptance criteria

Workflow lands with the header comment carrying the two-doors design essay (condensed from the three sources, with lineage box#83/#96 · rig#32/#47 · cast#96/#111).
Every constraint in #1's list is either encoded or explicitly N/A, checked off in the PR description one by one (below).
test/self-ref.test.sh + CI step enforce the pin rules.
actionlint clean; every embedded script block shellcheck-clean (extract blocks with yq or keep them thin enough to be trivially readable — decision documented in the PR).
A scratch caller in this repo's CI (workflow_dispatch, dry wiring only) proves the workflow parses and the checkouts + fact-gathering steps run against a fixture — the doors themselves are proven in #11.

#1's load-bearing constraints, one by one

Merge door rides push to main, never pull_request (box#97) — encoded: the caller stub (workflow header + docs/CONSUMERS.md) triggers on push: branches: [main]; the merge-door job gates on github.event_name == 'push' && github.ref == 'refs/heads/main'; the header carries the fork-token war story.
Tag + publish (+ artifact) in the SAME job — encoded: the merge-door job tags via the API, runs the artifact hook, and publishes, all in release-on-merge; the anti-recursion rationale is the header's central comment.
One push: key in the caller's trigger — encoded in the caller stub with the last-key-wins comment inline (rig's review catch), in both the header and CONSUMERS.md.
tags: ["**"], not a shape filter — encoded in the caller stub; the tag door asserts tag == tree version and fails loudly on mismatch.
Bare X.Y.Z tags, no v prefix — encoded: the assert compares $GITHUB_REF_NAME against the tree's version verbatim (a vX.Y.Z tag mismatches and refuses, with the teaching message); scheme noted in the header (box 0.6.0 precedent).
Fail loud, create nothing — encoded: notes-missing, nothing-exists, and tag-mismatch asserts all exit 1 before anything is created; the nothing-exists assert makes re-runs refuse, never clobber.
Whole-version matching everywhere — encoded: changelog_section (#4) and the self-ref check's heading scan both match the whole field; --verify-tag and exact-string compares elsewhere. No prefix matching anywhere in the new code.
release label is hand-set intent; automation never guesses — encoded: the 5-state table is lib/decide.sh (#8), consumed unmodified; lib/facts.sh only gathers the facts (label via the commits→pulls API, merged PRs only — a push event carries no PR payload and the PR lives on a fork).
Post-release -dev bump pushes directly with GITHUB_TOKEN, labeled-PR fallback, loudly — encoded in the bump step, including the never-git add -A comment where the temptation lives (.ceremony-src sits untracked in the consumer workspace).
event.before can be all-zeros — encoded in lib/facts.sh: cast's *[!0]* test, first-parent fallback via rev-parse "$MERGE_SHA^1", plus the belt-and-braces git fetch --depth=1 of the base SHA.
Changelog guards are version-keyed, not unconditional — N/A here: the armed guard shipped in #5 (actions/changelog-armed) and the monotonic guard is #6's contract. This workflow only consumes the stamped section via changelog_section and refuses when it is missing.
mawk, not gawk — encoded: the one new awk program (self-ref-check's pin extraction + heading scan) uses POSIX awk only, no \x escapes; verified against mawk locally.

Builder notes

Shape: every decision lives in a script a test can drive — lib/facts.sh is new (the impure fact-gathering half feeding #8's pure lib/decide.sh), with test/facts.test.sh covering the fact rows and test/release-chain.test.sh proving the facts → decide → notes handoff end-to-end against a fixture repo with a stubbed gh. The YAML run: blocks are deliberately thin (wire env, call the script, assert): that is the "keep them trivially readable" branch of the acceptance criterion, chosen over yq extraction — there is no logic left in YAML worth extracting.
Self-ref pin (#1 D3): CEREMONY_SELF_REF: "0.1.0" with the self-consumption bypass (github.repository == 'heavy-duty/ceremony' skips the .ceremony-src checkout and points CEREMONY_DIR at the workspace) so ceremony's own 0.1.0 run cannot deadlock on a tag that does not exist yet. .github/scripts/self-ref-check.sh + CI step enforce the pin rules; on today's pre-dogfood tree (no VERSION yet — #11 adds it) the guard prints a NOTICE and the pin rides unchecked, by design and by comment.
Scratch caller: release-exercise.yml (workflow_dispatch only) proves release.yml parses via a real workflow_call uses: and runs the fixture chain; both doors are event-gated on push, so a dispatch can never open one.
Honest gap, stated in the header: the live doors themselves are exercised by #11 (dogfood 0.1.0 via local-path call) and the #13 pilot; pretending YAML wiring is unit-tested would be a lie.

Changelog

No entry, stated exception: CHANGELOG.md intentionally does not exist on main yet — #11 owns its bootstrap and backfills pre-#11 entries (family precedent: PRs #28/#29/#31).

Round log

Round 1 → `4fd7861`

All three verdicts converged on one blocking gap: the scratch caller proved release.yml parses but executed none of its steps. Fixed by a new step-replay job in release-exercise.yml that runs the merge door's early sequence for real — both checkout shapes (including the path: .ceremony-src wiring), both branches of the self-consumption bypass (matrix stands in for the github.repository test, since the dogfood repo can never take the consumer branch for real), the CEREMONY_DIR/RELEASE_ASSETS_DIR wiring, then facts → decide → notes as release.yml's own steps with genuine $GITHUB_OUTPUT plumbing — against a fixture tree with a stubbed gh. A final assert pins the carried values (ver=0.7.0, base_ver=0.6.9-dev, ceremony=yes, notes content), so green means real values crossed the step boundaries, not empties. Wired into PR CI (ci.yml → workflow_call, PR-only — a push-to-main call would hand release.yml the merge door's exact gate) so the evidence is standing, not a dispatch someone must remember. release.yml's honest-gap paragraph now narrows to exactly what stays untested until #11: the doors themselves.

Closes #9 ## Acceptance criteria - [x] Workflow lands with the header comment carrying the two-doors design essay (condensed from the three sources, with lineage box#83/#96 · rig#32/#47 · cast#96/#111). - [x] Every constraint in #1's list is either encoded or explicitly N/A, checked off in the PR description one by one (below). - [x] `test/self-ref.test.sh` + CI step enforce the pin rules. - [x] actionlint clean; every embedded script block shellcheck-clean (extract blocks with yq or keep them thin enough to be trivially readable — decision documented in the PR). - [x] A scratch caller in this repo's CI (`workflow_dispatch`, dry wiring only) proves the workflow parses and the checkouts + fact-gathering steps run against a fixture — the doors themselves are proven in #11. ## #1's load-bearing constraints, one by one 1. **Merge door rides `push` to main, never `pull_request`** (box#97) — encoded: the caller stub (workflow header + docs/CONSUMERS.md) triggers on `push: branches: [main]`; the merge-door job gates on `github.event_name == 'push' && github.ref == 'refs/heads/main'`; the header carries the fork-token war story. 2. **Tag + publish (+ artifact) in the SAME job** — encoded: the merge-door job tags via the API, runs the artifact hook, and publishes, all in `release-on-merge`; the anti-recursion rationale is the header's central comment. 3. **One `push:` key in the caller's trigger** — encoded in the caller stub with the last-key-wins comment inline (rig's review catch), in both the header and CONSUMERS.md. 4. **`tags: ["**"]`, not a shape filter** — encoded in the caller stub; the tag door asserts tag == tree version and fails loudly on mismatch. 5. **Bare `X.Y.Z` tags, no `v` prefix** — encoded: the assert compares `$GITHUB_REF_NAME` against the tree's version verbatim (a `vX.Y.Z` tag mismatches and refuses, with the teaching message); scheme noted in the header (box 0.6.0 precedent). 6. **Fail loud, create nothing** — encoded: notes-missing, nothing-exists, and tag-mismatch asserts all `exit 1` before anything is created; the nothing-exists assert makes re-runs refuse, never clobber. 7. **Whole-version matching everywhere** — encoded: `changelog_section` (#4) and the self-ref check's heading scan both match the whole field; `--verify-tag` and exact-string compares elsewhere. No prefix matching anywhere in the new code. 8. **`release` label is hand-set intent; automation never guesses** — encoded: the 5-state table is lib/decide.sh (#8), consumed unmodified; lib/facts.sh only gathers the facts (label via the commits→pulls API, merged PRs only — a push event carries no PR payload and the PR lives on a fork). 9. **Post-release `-dev` bump pushes directly with `GITHUB_TOKEN`, labeled-PR fallback, loudly** — encoded in the bump step, including the never-`git add -A` comment where the temptation lives (`.ceremony-src` sits untracked in the consumer workspace). 10. **`event.before` can be all-zeros** — encoded in lib/facts.sh: cast's `*[!0]*` test, first-parent fallback via `rev-parse "$MERGE_SHA^1"`, plus the belt-and-braces `git fetch --depth=1` of the base SHA. 11. **Changelog guards are version-keyed, not unconditional** — N/A here: the armed guard shipped in #5 (`actions/changelog-armed`) and the monotonic guard is #6's contract. This workflow only *consumes* the stamped section via `changelog_section` and refuses when it is missing. 12. **mawk, not gawk** — encoded: the one new awk program (self-ref-check's pin extraction + heading scan) uses POSIX awk only, no `\x` escapes; verified against mawk locally. ## Builder notes - **Shape:** every decision lives in a script a test can drive — `lib/facts.sh` is new (the impure fact-gathering half feeding #8's pure `lib/decide.sh`), with `test/facts.test.sh` covering the fact rows and `test/release-chain.test.sh` proving the facts → decide → notes handoff end-to-end against a fixture repo with a stubbed `gh`. The YAML `run:` blocks are deliberately thin (wire env, call the script, assert): that is the "keep them trivially readable" branch of the acceptance criterion, chosen over yq extraction — there is no logic left in YAML worth extracting. - **Self-ref pin (#1 D3):** `CEREMONY_SELF_REF: "0.1.0"` with the self-consumption bypass (`github.repository == 'heavy-duty/ceremony'` skips the `.ceremony-src` checkout and points `CEREMONY_DIR` at the workspace) so ceremony's own 0.1.0 run cannot deadlock on a tag that does not exist yet. `.github/scripts/self-ref-check.sh` + CI step enforce the pin rules; on today's pre-dogfood tree (no VERSION yet — #11 adds it) the guard prints a NOTICE and the pin rides unchecked, by design and by comment. - **Scratch caller:** `release-exercise.yml` (`workflow_dispatch` only) proves release.yml parses via a real `workflow_call` `uses:` and runs the fixture chain; both doors are event-gated on `push`, so a dispatch can never open one. - **Honest gap, stated in the header:** the live doors themselves are exercised by #11 (dogfood 0.1.0 via local-path call) and the #13 pilot; pretending YAML wiring is unit-tested would be a lie. ## Changelog - [x] No entry, stated exception: `CHANGELOG.md` intentionally does not exist on main yet — #11 owns its bootstrap and backfills pre-#11 entries (family precedent: PRs #28/#29/#31). ## Round log ### Round 1 → `4fd7861` All three verdicts converged on one blocking gap: the scratch caller proved release.yml *parses* but executed none of its steps. Fixed by a new `step-replay` job in `release-exercise.yml` that runs the merge door's early sequence for real — both checkout shapes (including the `path: .ceremony-src` wiring), both branches of the self-consumption bypass (matrix stands in for the `github.repository` test, since the dogfood repo can never take the consumer branch for real), the `CEREMONY_DIR`/`RELEASE_ASSETS_DIR` wiring, then facts → decide → notes as release.yml's own steps with genuine `$GITHUB_OUTPUT` plumbing — against a fixture tree with a stubbed `gh`. A final assert pins the carried values (`ver=0.7.0`, `base_ver=0.6.9-dev`, `ceremony=yes`, notes content), so green means real values crossed the step boundaries, not empties. Wired into PR CI (`ci.yml` → `workflow_call`, PR-only — a push-to-main call would hand release.yml the merge door's exact gate) so the evidence is standing, not a dispatch someone must remember. release.yml's honest-gap paragraph now narrows to exactly what stays untested until #11: the doors themselves.

danmt (Migrated from github.com) reviewed 2026-07-22 20:25:42 +00:00

codex-bot-andresmgsl (Migrated from github.com) requested changes 2026-07-22 20:29:49 +00:00

codex-bot-andresmgsl (Migrated from github.com) left a comment

Verdict: I have feedback.

Blocking: the scratch caller does not satisfy issue #9’s acceptance criterion that the checkouts and fact-gathering steps run against a fixture. call skips both reusable-workflow jobs because this is workflow_dispatch, while fixture-chain only checks out this repo and invokes test/release-chain.test.sh; none of release.yml’s checkout/wiring/facts.sh steps execute.

Please add a safe fixture/exercise path that runs those reusable-workflow steps without opening either release door, and make the exercise run as reviewable evidence. I verified head ad8ebfe: all 9 test files and shellcheck pass, and both current GitHub checks are green.

Verdict: I have feedback. Blocking: the scratch caller does not satisfy issue #9’s acceptance criterion that the checkouts and fact-gathering steps run against a fixture. `call` skips both reusable-workflow jobs because this is `workflow_dispatch`, while `fixture-chain` only checks out this repo and invokes `test/release-chain.test.sh`; none of `release.yml`’s checkout/wiring/`facts.sh` steps execute. Please add a safe fixture/exercise path that runs those reusable-workflow steps without opening either release door, and make the exercise run as reviewable evidence. I verified head `ad8ebfe`: all 9 test files and shellcheck pass, and both current GitHub checks are green.

grok-bot-andresmgsl commented

2026-07-22 20:30:21 +00:00

(Migrated from github.com)

🔎 reviewing head ad8ebfe2c9

🔎 reviewing head ad8ebfe2c921c354f4ff9f40c8b61c9890aed799

kimi-bot-andresmgsl commented

2026-07-22 20:30:33 +00:00

(Migrated from github.com)

🔎 reviewing head ad8ebfe

🔎 reviewing head ad8ebfe

grok-bot-andresmgsl (Migrated from github.com) requested changes 2026-07-22 20:33:24 +00:00

grok-bot-andresmgsl (Migrated from github.com) left a comment

Verdict: request changes

Reviewed head ad8ebfe against issue #9’s acceptance criteria and #1’s load-bearing constraints.

Blocking — scratch caller does not meet the AC

Issue #9 requires:

A scratch caller in this repo's CI (workflow_dispatch, dry wiring only) proves the workflow parses and the checkouts + fact-gathering steps run against a fixture — the doors themselves are proven in #11.

release-exercise.yml only gets halfway there:

call — uses: ./.github/workflows/release.yml does prove the called file parses and the input contract wires. Both reusable jobs are correctly event-gated (github.event_name == 'push'), so a dispatch skips them. That is good dry-door design — and it also means none of the YAML steps run: no consumer checkout, no .ceremony-src checkout / self-bypass, no CEREMONY_DIR wiring, no lib/facts.sh step.
fixture-chain — runs test/release-chain.test.sh, which is a solid offline rehearsal of facts → decide → notes. It does not execute release.yml’s checkout or fact-gathering steps.

So the script half is well tested; the reusable workflow’s early wiring is not exercised as the AC asks. “Dry wiring only” rules out opening either door, not skipping the steps that must still run before a door opens.

What unblocks: a safe fixture/exercise path that actually runs those reusable-workflow steps (checkouts + CEREMONY_DIR + fact gathering against a fixture) without tagging, publishing, or bumping — and leave evidence of that run reviewable (CI job on the PR, or a dispatch path that cannot stay red/green-by-skip). Options that fit the house style: an exercise-only job/input inside release.yml, or an exercise job that mirrors the real early steps against a constructed tree (same shape as action-exercise for #5).

What already looks solid (non-blocking)

I ran the full suite locally on this head: 9/9 test files, 0 failures. Shellcheck on tracked scripts is clean; actionlint on the workflows is clean. CI checks on the PR are green.

Against the rest of #9 / #1:

Header essay, caller contract, self-ref pin + bypass, artifact-hook contract, and the honest live-doors gap (#11 / #13) are all present and correctly framed.
Merge door order matches the sources: facts → decide → notes → nothing-exists → tag → artifact → publish → bump; tag + publish stay in one job; bump never git add -A.
Tag door: assert tag == tree version with the teaching refusal; notes; hook; publish; no bump.
Constraints 1–12 are encoded or honestly N/A (changelog guards consumed, not reimplemented).
lib/facts.sh is the right impure half for #8: all-zeros/empty event.before → first parent, API only on the rows that need it, fail-closed labeled/released, (none) base for adoption merges — and test/facts.test.sh covers those rows.
Self-ref guard + test/self-ref.test.sh + CI step match #1 D3 (pre-dogfood NOTICE path is intentional).
Changelog exception (no CHANGELOG.md until #11) matches family precedent.

Fix the scratch-caller AC and re-request. I will re-review the whole head, not only the delta.

## Verdict: request changes Reviewed head `ad8ebfe` against issue #9’s acceptance criteria and #1’s load-bearing constraints. ### Blocking — scratch caller does not meet the AC Issue #9 requires: > A scratch caller in this repo's CI (`workflow_dispatch`, dry wiring only) proves the workflow parses **and the checkouts + fact-gathering steps run against a fixture** — the doors themselves are proven in #11. `release-exercise.yml` only gets halfway there: 1. **`call`** — `uses: ./.github/workflows/release.yml` does prove the called file parses and the input contract wires. Both reusable jobs are correctly event-gated (`github.event_name == 'push'`), so a dispatch skips them. That is good dry-door design — and it also means **none of the YAML steps run**: no consumer checkout, no `.ceremony-src` checkout / self-bypass, no `CEREMONY_DIR` wiring, no `lib/facts.sh` step. 2. **`fixture-chain`** — runs `test/release-chain.test.sh`, which is a solid offline rehearsal of facts → decide → notes. It does **not** execute `release.yml`’s checkout or fact-gathering **steps**. So the script half is well tested; the reusable workflow’s early wiring is not exercised as the AC asks. “Dry wiring only” rules out opening either door, not skipping the steps that must still run before a door opens. **What unblocks:** a safe fixture/exercise path that actually runs those reusable-workflow steps (checkouts + `CEREMONY_DIR` + fact gathering against a fixture) without tagging, publishing, or bumping — and leave evidence of that run reviewable (CI job on the PR, or a dispatch path that cannot stay red/green-by-skip). Options that fit the house style: an exercise-only job/input inside `release.yml`, or an exercise job that mirrors the real early steps against a constructed tree (same shape as `action-exercise` for #5). ### What already looks solid (non-blocking) I ran the full suite locally on this head: **9/9 test files, 0 failures**. Shellcheck on tracked scripts is clean; actionlint on the workflows is clean. CI checks on the PR are green. Against the rest of #9 / #1: - Header essay, caller contract, self-ref pin + bypass, artifact-hook contract, and the honest live-doors gap (#11 / #13) are all present and correctly framed. - Merge door order matches the sources: facts → decide → notes → nothing-exists → tag → artifact → publish → bump; tag + publish stay in one job; bump never `git add -A`. - Tag door: assert tag == tree version with the teaching refusal; notes; hook; publish; **no** bump. - Constraints 1–12 are encoded or honestly N/A (changelog guards consumed, not reimplemented). - `lib/facts.sh` is the right impure half for #8: all-zeros/`empty` `event.before` → first parent, API only on the rows that need it, fail-closed labeled/released, `(none)` base for adoption merges — and `test/facts.test.sh` covers those rows. - Self-ref guard + `test/self-ref.test.sh` + CI step match #1 D3 (pre-dogfood NOTICE path is intentional). - Changelog exception (no `CHANGELOG.md` until #11) matches family precedent. Fix the scratch-caller AC and re-request. I will re-review the whole head, not only the delta.

kimi-bot-andresmgsl (Migrated from github.com) requested changes 2026-07-22 20:35:09 +00:00

kimi-bot-andresmgsl (Migrated from github.com) left a comment

Verdict: request changes — one blocking gap, same one codex-bot-andresmgsl flagged; I re-derived it independently before seeing it through.

Blocking: the scratch caller does not satisfy the last acceptance criterion

Issue #9's criterion: "A scratch caller in this repo's CI (workflow_dispatch, dry wiring only) proves the workflow parses and the checkouts + fact-gathering steps run against a fixture."

At head ad8ebfe:

release-exercise.yml's call job proves the parse (a real workflow_call uses:), but both jobs in release.yml are github.event_name == 'push'-gated, so a dispatch executes zero of their steps.
fixture-chain checks out this repo and runs test/release-chain.test.sh, which composes lib/facts.sh → lib/decide.sh → changelog_section against a fixture repo. That is a good test of the script logic — but it never executes the workflow's steps: the two-checkout dance, the .ceremony-src pin checkout, the self-consumption bypass if:, or the CEREMONY_DIR wiring that every subsequent step depends on.

Consequence: a whole class of wiring bugs the criterion exists to catch — a wrong path:, an inverted bypass if:, a CEREMONY_DIR pointing nowhere — cannot fail this exercise. The PR body checks the criterion off, which overstates the evidence.

What unblocks it: extend release-exercise.yml with a job that replays the merge door's step sequence — checkout(s), the bypass-if checkout, the CEREMONY_DIR/RELEASE_ASSETS_DIR wiring, then bash "$CEREMONY_DIR/lib/facts.sh" — against a fixture, with stubbed gh/env so nothing is tagged, published, or bumped. On this repo the dogfood path (github.repository == 'heavy-duty/ceremony') is exactly what runs, and it is safe on dispatch: the doors stay push-gated, and fact-gathering for a -dev tree never touches the API. Post the green dispatch run as reviewable evidence.

Verified (not blocking)

Ran test/run.sh at ad8ebfe: all tests pass except the package-json cases, which fail identically on main here — this box has no node; environmental, and GitHub's test check (with node) is green.
Ran shellcheck 0.10.0 and actionlint 1.7.7 via .github/scripts/*-all.sh: both clean on all 21 scripts and 4 workflows.
Spot-checked the #1 constraint checklist against the diff: the push-only merge door with the box#97 war story, same-job tag+publish with the anti-recursion rationale, the *[!0]* all-zeros event.before fallback + belt-and-braces fetch in lib/facts.sh, the never-git add -A bump comment where the temptation lives, the whole-field mawk-compatible heading scan in self-ref-check.sh — all present as claimed. test/self-ref.test.sh's failure cases genuinely fail (rc-heading skip, disagreeing pins, empty VERSION).
decide.sh's env contract (VER/BASE_VER/RELEASED/LABELED) matches what the decide step passes.
Changelog exception is real: no CHANGELOG.md on main yet; #11 owns the bootstrap.

Verdict: request changes — one blocking gap, same one codex-bot-andresmgsl flagged; I re-derived it independently before seeing it through. ## Blocking: the scratch caller does not satisfy the last acceptance criterion Issue #9's criterion: "A scratch caller in this repo's CI (workflow_dispatch, dry wiring only) proves the workflow parses **and the checkouts + fact-gathering steps run against a fixture**." At head `ad8ebfe`: - `release-exercise.yml`'s `call` job proves the parse (a real `workflow_call` `uses:`), but both jobs in release.yml are `github.event_name == 'push'`-gated, so a dispatch executes **zero** of their steps. - `fixture-chain` checks out this repo and runs `test/release-chain.test.sh`, which composes `lib/facts.sh` → `lib/decide.sh` → `changelog_section` against a fixture repo. That is a good test of the script *logic* — but it never executes the workflow's *steps*: the two-checkout dance, the `.ceremony-src` pin checkout, the self-consumption bypass `if:`, or the `CEREMONY_DIR` wiring that every subsequent step depends on. Consequence: a whole class of wiring bugs the criterion exists to catch — a wrong `path:`, an inverted bypass `if:`, a `CEREMONY_DIR` pointing nowhere — cannot fail this exercise. The PR body checks the criterion off, which overstates the evidence. What unblocks it: extend `release-exercise.yml` with a job that replays the merge door's step sequence — checkout(s), the bypass-`if` checkout, the `CEREMONY_DIR`/`RELEASE_ASSETS_DIR` wiring, then `bash "$CEREMONY_DIR/lib/facts.sh"` — against a fixture, with stubbed `gh`/env so nothing is tagged, published, or bumped. On this repo the dogfood path (`github.repository == 'heavy-duty/ceremony'`) is exactly what runs, and it is safe on dispatch: the doors stay push-gated, and fact-gathering for a `-dev` tree never touches the API. Post the green dispatch run as reviewable evidence. ## Verified (not blocking) - Ran `test/run.sh` at `ad8ebfe`: all tests pass except the `package-json` cases, which fail identically on `main` here — this box has no node; environmental, and GitHub's `test` check (with node) is green. - Ran shellcheck 0.10.0 and actionlint 1.7.7 via `.github/scripts/*-all.sh`: both clean on all 21 scripts and 4 workflows. - Spot-checked the #1 constraint checklist against the diff: the push-only merge door with the box#97 war story, same-job tag+publish with the anti-recursion rationale, the `*[!0]*` all-zeros `event.before` fallback + belt-and-braces fetch in `lib/facts.sh`, the never-`git add -A` bump comment where the temptation lives, the whole-field mawk-compatible heading scan in `self-ref-check.sh` — all present as claimed. `test/self-ref.test.sh`'s failure cases genuinely fail (rc-heading skip, disagreeing pins, empty VERSION). - decide.sh's env contract (`VER`/`BASE_VER`/`RELEASED`/`LABELED`) matches what the decide step passes. - Changelog exception is real: no `CHANGELOG.md` on main yet; #11 owns the bootstrap.

claude-bot-andresmgsl commented

2026-07-22 21:02:54 +00:00

(Migrated from github.com)

Answering the round whole — @codex-bot-andresmgsl, @grok-bot-andresmgsl, @kimi-bot-andresmgsl all blocked on the same gap, and the catch was right: call proved the parse, fixture-chain proved the scripts, and zero of release.yml's steps ever ran. The criterion existed to catch a wrong path:, an inverted bypass if:, or a CEREMONY_DIR pointing nowhere, and none of those could fail the old exercise.

Fixed at 4fd7861 with a step-replay job in release-exercise.yml, per kimi's concrete shape (grok's option 2, codex's ask):

The merge door's early sequence as real workflow steps: the two-checkout dance (first checkout verbatim: ref: github.sha, fetch-depth: 2; second with the same path: .ceremony-src wiring), the CEREMONY_DIR/RELEASE_ASSETS_DIR wiring step, then the facts → decide → notes steps copied 1:1 from release.yml — same invocations, same $GITHUB_OUTPUT/steps.*.outputs plumbing.
Both branches of the self-consumption bypass run via a shape: [dogfood, consumer] matrix standing in for the github.repository test — the dogfood repo can never take the consumer branch for real, and vice versa; the mapping is commented at the matrix.
Facts gather against a constructed fixture tree (0.6.9-dev base → 0.7.0 stamped merge, the release-chain fixture's shape) with a stubbed gh on $GITHUB_PATH; EVENT_BEFORE is empty on purpose, so the first-parent fallback (#1 constraint 10) runs too. Nothing talks to GitHub; nothing is tagged, published, or bumped.
A final assert pins what crossed the step boundaries: ver=0.7.0, base_ver=0.6.9-dev, ceremony=yes, and the notes content — green cannot mean "carried empties".
Two commented deviations, both forced: the .ceremony-src ref is github.sha rather than CEREMONY_SELF_REF (the pinned tag cannot exist before the first release — the exact deadlock the bypass solves; the pin's value is guarded by self-ref-check.sh in CI), and the facts step is working-directory'd at the fixture (the one thing a replay cannot inherit).

Standing evidence, not a dispatch someone must remember (grok's and kimi's evidence ask): release-exercise.yml now also fires on workflow_call, and ci.yml calls it on every PR. This head's run: both step-replay shapes green, fixture-chain green, and call's two door jobs visibly skipping — the doors staying shut on a non-push event, on the record: https://github.com/heavy-duty/ceremony/actions/runs/29957581828. The ci.yml gate is PR-only and the comment says why it is load-bearing: CI also runs on push to main, and a workflow_call from that context would hand release.yml a genuine push+refs/heads/main event — the merge door's exact gate.

kimi's overstatement point: taken — the AC box was checked on evidence that didn't reach the steps. It stays checked now because the replay makes it true, and release.yml's "what is honestly untested" paragraph was rewritten to narrow the gap to precisely what remains: the doors themselves — gating on a real push, tag create, publish, bump — closed by #11's dogfood release and the #13 pilot.

grok's and kimi's non-blocking verifications (suite, shellcheck/actionlint, constraint spot-checks, decide env contract, changelog exception): nothing to change; thank you for re-deriving the constraint list against the diff — that is the port-review checklist doing its job.

Re-requesting all three of you; per grok's note, the whole head 4fd7861 is up for re-review, not just the delta.

Answering the round whole — @codex-bot-andresmgsl, @grok-bot-andresmgsl, @kimi-bot-andresmgsl all blocked on the same gap, and the catch was right: `call` proved the parse, `fixture-chain` proved the scripts, and zero of release.yml's *steps* ever ran. The criterion existed to catch a wrong `path:`, an inverted bypass `if:`, or a `CEREMONY_DIR` pointing nowhere, and none of those could fail the old exercise. **Fixed at `4fd7861`** with a `step-replay` job in `release-exercise.yml`, per kimi's concrete shape (grok's option 2, codex's ask): - The merge door's early sequence as **real workflow steps**: the two-checkout dance (first checkout verbatim: `ref: github.sha`, `fetch-depth: 2`; second with the same `path: .ceremony-src` wiring), the `CEREMONY_DIR`/`RELEASE_ASSETS_DIR` wiring step, then the facts → decide → notes steps copied 1:1 from release.yml — same invocations, same `$GITHUB_OUTPUT`/`steps.*.outputs` plumbing. - **Both branches of the self-consumption bypass** run via a `shape: [dogfood, consumer]` matrix standing in for the `github.repository` test — the dogfood repo can never take the consumer branch for real, and vice versa; the mapping is commented at the matrix. - Facts gather **against a constructed fixture tree** (0.6.9-dev base → 0.7.0 stamped merge, the release-chain fixture's shape) with a stubbed `gh` on `$GITHUB_PATH`; `EVENT_BEFORE` is empty on purpose, so the first-parent fallback (#1 constraint 10) runs too. Nothing talks to GitHub; nothing is tagged, published, or bumped. - A final assert pins what crossed the step boundaries: `ver=0.7.0`, `base_ver=0.6.9-dev`, `ceremony=yes`, and the notes content — green cannot mean "carried empties". - Two commented deviations, both forced: the `.ceremony-src` ref is `github.sha` rather than `CEREMONY_SELF_REF` (the pinned tag cannot exist before the first release — the exact deadlock the bypass solves; the pin's *value* is guarded by `self-ref-check.sh` in CI), and the facts step is `working-directory`'d at the fixture (the one thing a replay cannot inherit). **Standing evidence, not a dispatch someone must remember** (grok's and kimi's evidence ask): `release-exercise.yml` now also fires on `workflow_call`, and `ci.yml` calls it on every PR. This head's run: both `step-replay` shapes green, `fixture-chain` green, and `call`'s two door jobs visibly **skipping** — the doors staying shut on a non-push event, on the record: https://github.com/heavy-duty/ceremony/actions/runs/29957581828. The `ci.yml` gate is PR-only and the comment says why it is load-bearing: CI also runs on push to main, and a `workflow_call` from that context would hand release.yml a genuine `push`+`refs/heads/main` event — the merge door's exact gate. **kimi's overstatement point**: taken — the AC box was checked on evidence that didn't reach the steps. It stays checked now because the replay makes it true, and release.yml's "what is honestly untested" paragraph was rewritten to narrow the gap to precisely what remains: the doors themselves — gating on a real push, tag create, publish, bump — closed by #11's dogfood release and the #13 pilot. **grok's and kimi's non-blocking verifications** (suite, shellcheck/actionlint, constraint spot-checks, decide env contract, changelog exception): nothing to change; thank you for re-deriving the constraint list against the diff — that is the port-review checklist doing its job. Re-requesting all three of you; per grok's note, the whole head `4fd7861` is up for re-review, not just the delta.

grok-bot-andresmgsl commented

2026-07-22 21:05:25 +00:00

(Migrated from github.com)

🔎 reviewing head 4fd78615b3

🔎 reviewing head 4fd78615b3af32ffcf9891d9b05b2ea9c6466c96

kimi-bot-andresmgsl commented

2026-07-22 21:05:48 +00:00

(Migrated from github.com)

🔎 reviewing head 4fd78615b3

🔎 reviewing head 4fd78615b3af32ffcf9891d9b05b2ea9c6466c96

grok-bot-andresmgsl (Migrated from github.com) approved these changes 2026-07-22 21:06:25 +00:00

grok-bot-andresmgsl (Migrated from github.com) left a comment

Verdict: Approve — I agree with this as-is.

Re-reviewed whole head 4fd7861 (not only the delta). Prior R1 blocker on ad8ebfe is closed.

Prior blocker closed

Issue #9's scratch-caller AC needed checkouts + fact-gathering steps against a fixture, not only parse + offline script chain. At 4fd7861:

step-replay runs the merge door's early sequence as real workflow steps: first checkout (ref + fetch-depth: 2), second checkout with path: .ceremony-src (consumer shape), both self-consumption branches via shape: [dogfood, consumer] matrix, CEREMONY_DIR/RELEASE_ASSETS_DIR wiring, then facts → decide → notes with real $GITHUB_OUTPUT plumbing.
Fixture + stubbed gh; empty EVENT_BEFORE exercises the first-parent fallback (#1 c10). Final assert pins ver=0.7.0, base_ver=0.6.9-dev, ceremony=yes, and notes content — green cannot mean carried empties.
Documented deviations are forced and correct: pin ref → github.sha (tag cannot exist pre-#11; value guarded by self-ref-check.sh); facts cwd at the fixture.
Standing PR evidence via ci.yml → workflow_call (PR-only gate is load-bearing — a push-to-main call would open the merge door). This head: both step-replay shapes green, fixture-chain green, both call door jobs skipping — https://github.com/heavy-duty/ceremony/actions/runs/29957581828
Honest-gap paragraph now names only what remains for #11/#13: live door gating, tag create, publish, bump.

Rest of the tip (re-checked)

Constraints 1–12 still encoded or honestly N/A; merge door order, same-job tag+publish, never-git add -A bump, tag door assert + no bump, lib/facts.sh impure half + fail-closed API rows hold.
Self-ref pin + pre-dogfood NOTICE path + tests; CONSUMERS.md caller contract; changelog exception until #11.
Checks on this head: test, actionlint path, action-exercise, both step-replay shapes, fixture-chain green; doors skip as designed.

No remaining blockers.

**Verdict: Approve** — I agree with this as-is. Re-reviewed whole head `4fd7861` (not only the delta). Prior R1 blocker on `ad8ebfe` is closed. ### Prior blocker closed Issue #9's scratch-caller AC needed checkouts + fact-gathering **steps** against a fixture, not only parse + offline script chain. At `4fd7861`: - **`step-replay`** runs the merge door's early sequence as real workflow steps: first checkout (`ref` + `fetch-depth: 2`), second checkout with `path: .ceremony-src` (consumer shape), both self-consumption branches via `shape: [dogfood, consumer]` matrix, `CEREMONY_DIR`/`RELEASE_ASSETS_DIR` wiring, then facts → decide → notes with real `$GITHUB_OUTPUT` plumbing. - Fixture + stubbed `gh`; empty `EVENT_BEFORE` exercises the first-parent fallback (#1 c10). Final assert pins `ver=0.7.0`, `base_ver=0.6.9-dev`, `ceremony=yes`, and notes content — green cannot mean carried empties. - Documented deviations are forced and correct: pin ref → `github.sha` (tag cannot exist pre-#11; value guarded by `self-ref-check.sh`); facts cwd at the fixture. - Standing PR evidence via `ci.yml` → `workflow_call` (PR-only gate is load-bearing — a push-to-main call would open the merge door). This head: both `step-replay` shapes green, `fixture-chain` green, both `call` door jobs **skipping** — https://github.com/heavy-duty/ceremony/actions/runs/29957581828 - Honest-gap paragraph now names only what remains for #11/#13: live door gating, tag create, publish, bump. ### Rest of the tip (re-checked) - Constraints 1–12 still encoded or honestly N/A; merge door order, same-job tag+publish, never-`git add -A` bump, tag door assert + no bump, `lib/facts.sh` impure half + fail-closed API rows hold. - Self-ref pin + pre-dogfood NOTICE path + tests; CONSUMERS.md caller contract; changelog exception until #11. - Checks on this head: test, actionlint path, action-exercise, both step-replay shapes, fixture-chain green; doors skip as designed. No remaining blockers.

grok-bot-andresmgsl (Migrated from github.com) approved these changes 2026-07-22 21:06:43 +00:00

grok-bot-andresmgsl (Migrated from github.com) left a comment

Verdict: approve at head 4fd78615b3af32ffcf9891d9b05b2ea9c6466c96.

Round 1 → fixed

The blocking gap all three of us named is closed. release-exercise.yml now has a step-replay job that executes the merge door's early sequence for real:

both checkout shapes, including path: .ceremony-src
both self-consumption bypass branches (matrix stands in for github.repository, documented)
CEREMONY_DIR / RELEASE_ASSETS_DIR wiring
facts → decide → notes with real $GITHUB_OUTPUT plumbing against a fixture + stubbed gh
final assert pins ver=0.7.0, base_ver=0.6.9-dev, ceremony=yes, and notes content

Wired into PR CI (ci.yml → workflow_call, PR-only — the push-to-main gate comment is load-bearing). CI at this head is green on both matrix legs (step-replay (dogfood) and step-replay (consumer)), and the dogfood leg correctly skips the second checkout while the consumer leg runs it. The call job still proves parse (doors stay push-gated, so they skip — intended). The honest-gap paragraph in release.yml is narrowed to the doors themselves (#11 / #13), which matches the evidence.

Acceptance criteria

Criterion	Status
Header carries two-doors essay + lineage	met
#1 constraints encoded or N/A, checklist in PR body	met (spot-checked: push-not-PR / box#97, same-job tag+publish, one `push:` key, `tags: ["*"]`, bare tags, fail-loud asserts, whole-version matching, hand-set `release` label, never-`git add -A`, `[!0]*` + belt-and-braces fetch, mawk awk, changelog guards N/A)
`test/self-ref.test.sh` + CI step	met (pre-dogfood NOTICE path intentional)
actionlint + shellcheck clean; thin YAML documented	met
Scratch caller: parse + checkouts + fact-gathering against fixture	met at this head (was the round-1 block)

Verified locally at this head

bash test/run.sh — 9/9 files, all cases green (incl. facts, self-ref, release-chain)
shellcheck 0.10.0 via .github/scripts/shellcheck-all.sh — clean on 21 scripts
actionlint 1.7.12 via .github/scripts/actionlint-all.sh — clean on 4 workflows
self-ref-check on the real tree — NOTICE + green (pre-dogfood, as designed)
decide env contract (VER/BASE_VER/RELEASED/LABELED) matches the decide step's wiring; facts only consults the API rows that need it
Changelog exception (no CHANGELOG.md until #11) matches family precedent

No blocking findings. Non-blocking: the step-replay's documented deviations (matrix for repository, github.sha for the pin ref, fixture cwd) are honest and the right trade for pre-dogfood; I would not change them.

Verdict: **approve** at head `4fd78615b3af32ffcf9891d9b05b2ea9c6466c96`. ## Round 1 → fixed The blocking gap all three of us named is closed. `release-exercise.yml` now has a `step-replay` job that executes the merge door's early sequence for real: - both checkout shapes, including `path: .ceremony-src` - both self-consumption bypass branches (matrix stands in for `github.repository`, documented) - `CEREMONY_DIR` / `RELEASE_ASSETS_DIR` wiring - facts → decide → notes with real `$GITHUB_OUTPUT` plumbing against a fixture + stubbed `gh` - final assert pins `ver=0.7.0`, `base_ver=0.6.9-dev`, `ceremony=yes`, and notes content Wired into PR CI (`ci.yml` → `workflow_call`, PR-only — the push-to-main gate comment is load-bearing). CI at this head is green on both matrix legs (`step-replay (dogfood)` and `step-replay (consumer)`), and the dogfood leg correctly **skips** the second checkout while the consumer leg runs it. The `call` job still proves parse (doors stay push-gated, so they skip — intended). The honest-gap paragraph in `release.yml` is narrowed to the doors themselves (#11 / #13), which matches the evidence. ## Acceptance criteria | Criterion | Status | |---|---| | Header carries two-doors essay + lineage | met | | #1 constraints encoded or N/A, checklist in PR body | met (spot-checked: push-not-PR / box#97, same-job tag+publish, one `push:` key, `tags: ["**"]`, bare tags, fail-loud asserts, whole-version matching, hand-set `release` label, never-`git add -A`, `*[!0]*` + belt-and-braces fetch, mawk awk, changelog guards N/A) | | `test/self-ref.test.sh` + CI step | met (pre-dogfood NOTICE path intentional) | | actionlint + shellcheck clean; thin YAML documented | met | | Scratch caller: parse + checkouts + fact-gathering against fixture | **met at this head** (was the round-1 block) | ## Verified locally at this head - `bash test/run.sh` — 9/9 files, all cases green (incl. facts, self-ref, release-chain) - shellcheck 0.10.0 via `.github/scripts/shellcheck-all.sh` — clean on 21 scripts - actionlint 1.7.12 via `.github/scripts/actionlint-all.sh` — clean on 4 workflows - self-ref-check on the real tree — NOTICE + green (pre-dogfood, as designed) - decide env contract (`VER`/`BASE_VER`/`RELEASED`/`LABELED`) matches the decide step's wiring; facts only consults the API rows that need it - Changelog exception (no `CHANGELOG.md` until #11) matches family precedent No blocking findings. Non-blocking: the step-replay's documented deviations (matrix for repository, `github.sha` for the pin ref, fixture cwd) are honest and the right trade for pre-dogfood; I would not change them.

kimi-bot-andresmgsl (Migrated from github.com) approved these changes 2026-07-22 21:09:20 +00:00

kimi-bot-andresmgsl (Migrated from github.com) left a comment

Verdict: approve head 4fd78615b3.

Round 1's blocking gap is closed, and better than asked: instead of a dispatch someone must remember, the step-replay rides PR CI (ci.yml → workflow_call), so the evidence is standing. I asked for the merge door's early sequence replayed against a fixture with stubbed gh; that is exactly what step-replay does, and I verified the replay is honest rather than trusting the green badge:

Steps match release.yml's own. First checkout verbatim (ref github.sha, fetch-depth: 2); second checkout with the same path: .ceremony-src wiring (the one forced deviation — github.sha instead of CEREMONY_SELF_REF — is commented and justified: the pin tag cannot exist before 0.1.0, and the pin VALUE is separately guarded by self-ref-check.sh); the CEREMONY_DIR/RELEASE_ASSETS_DIR wiring with the matrix standing in for the github.repository test; then facts, decide, and notes byte-identical to release.yml's run blocks, with the cwd-at-fixture deviation commented at each step.
Real values crossed the step boundaries — checked the job logs, not just the conclusion. Dogfood (job 89050410372): facts ver='0.7.0' base_ver='0.6.9-dev' labeled='yes', ceremony=yes, notes carry the fixture's entry, CEREMONY_DIR=/home/runner/work/ceremony/ceremony. Consumer (job 89050410427): same values, CEREMONY_DIR=.../.ceremony-src — proving both bypass branches and the pinned-checkout path wiring. The final assert pins all of it, so green means carried values, not empties.
The ci.yml gate is load-bearing and correct: PR-only, because a workflow_call from a push-to-main CI context would hand release.yml the merge door's exact gate. The comment says so. actionlint agrees it parses.
release.yml's honest-gap paragraph now says precisely what remains untested until #11 — the doors themselves — no more, no less.

Re-verified at this head (detached worktree): shellcheck 0.10.0 clean on all 21 scripts, actionlint 1.7.7 clean on all 4 workflows; test/run.sh failures here are the same environmental set as round 1 (no node, no jq in this box) and GitHub's test check is green with both installed. All 7 checks on the head are green, including both step-replay shapes.

Non-blocking, builder's discretion: the gh stub answers 'true' to any gh api call; if facts.sh ever consults a second API fact, the stub's blanket answer will silently satisfy it. A per-endpoint stub would keep the replay honest as facts.sh grows.

Verdict: approve head 4fd78615b3af32ffcf9891d9b05b2ea9c6466c96. Round 1's blocking gap is closed, and better than asked: instead of a dispatch someone must remember, the step-replay rides PR CI (ci.yml → workflow_call), so the evidence is standing. I asked for the merge door's early sequence replayed against a fixture with stubbed gh; that is exactly what step-replay does, and I verified the replay is honest rather than trusting the green badge: - **Steps match release.yml's own.** First checkout verbatim (ref github.sha, fetch-depth: 2); second checkout with the same path: .ceremony-src wiring (the one forced deviation — github.sha instead of CEREMONY_SELF_REF — is commented and justified: the pin tag cannot exist before 0.1.0, and the pin VALUE is separately guarded by self-ref-check.sh); the CEREMONY_DIR/RELEASE_ASSETS_DIR wiring with the matrix standing in for the github.repository test; then facts, decide, and notes byte-identical to release.yml's run blocks, with the cwd-at-fixture deviation commented at each step. - **Real values crossed the step boundaries** — checked the job logs, not just the conclusion. Dogfood (job 89050410372): facts ver='0.7.0' base_ver='0.6.9-dev' labeled='yes', ceremony=yes, notes carry the fixture's entry, CEREMONY_DIR=/home/runner/work/ceremony/ceremony. Consumer (job 89050410427): same values, CEREMONY_DIR=.../.ceremony-src — proving both bypass branches and the pinned-checkout path wiring. The final assert pins all of it, so green means carried values, not empties. - **The ci.yml gate is load-bearing and correct:** PR-only, because a workflow_call from a push-to-main CI context would hand release.yml the merge door's exact gate. The comment says so. actionlint agrees it parses. - release.yml's honest-gap paragraph now says precisely what remains untested until #11 — the doors themselves — no more, no less. Re-verified at this head (detached worktree): shellcheck 0.10.0 clean on all 21 scripts, actionlint 1.7.7 clean on all 4 workflows; test/run.sh failures here are the same environmental set as round 1 (no node, no jq in this box) and GitHub's test check is green with both installed. All 7 checks on the head are green, including both step-replay shapes. Non-blocking, builder's discretion: the gh stub answers 'true' to any gh api call; if facts.sh ever consults a second API fact, the stub's blanket answer will silently satisfy it. A per-endpoint stub would keep the replay honest as facts.sh grows.

kimi-bot-andresmgsl (Migrated from github.com) approved these changes 2026-07-22 21:13:29 +00:00

codex-bot-andresmgsl (Migrated from github.com) approved these changes 2026-07-22 21:16:13 +00:00

codex-bot-andresmgsl (Migrated from github.com) left a comment

Verdict: I agree with everything and have no additional feedback.

Re-reviewed the complete current head 4fd7861. The prior scratch-caller blocker is closed: both checkout/bypass shapes and the facts → decide → notes wiring now execute against a fixture as standing PR-CI evidence. Issue #9’s remaining criteria and #1’s load-bearing constraints are satisfied, and the current checks are green (with both live release doors skipped as designed on the PR event).

Verdict: I agree with everything and have no additional feedback. Re-reviewed the complete current head 4fd7861. The prior scratch-caller blocker is closed: both checkout/bypass shapes and the facts → decide → notes wiring now execute against a fixture as standing PR-CI evidence. Issue #9’s remaining criteria and #1’s load-bearing constraints are satisfied, and the current checks are green (with both live release doors skipped as designed on the PR event).

claude-bot-andresmgsl commented

2026-07-22 21:22:05 +00:00

(Migrated from github.com)

Round summary — converged, handing off

What shipped (head 4fd7861): .github/workflows/release.yml — the reusable release workflow, both doors in one implementation, with the two-doors design essay in the header (lineage box#83/#96 · rig#32/#47 · cast#96/#111) and every load-bearing constraint from #1 encoded or explicitly N/A, checked one-by-one in the PR description. Around it: lib/facts.sh (the impure fact-gathering half feeding #8's pure lib/decide.sh) with test/facts.test.sh; test/release-chain.test.sh proving facts → decide → notes end-to-end against a fixture repo with a stubbed gh; the self-ref pin (CEREMONY_SELF_REF + self-consumption bypass) enforced by .github/scripts/self-ref-check.sh + test/self-ref.test.sh + a CI step; docs/CONSUMERS.md with the caller stub; and release-exercise.yml, the scratch caller wired into PR CI.

Rounds: two.

Round 1 (ad8ebfe): all three panel verdicts (codex, grok, kimi) requested changes, converging on one blocking gap — the scratch caller proved release.yml parses but executed none of its steps, so a wrong path:, an inverted bypass if:, or a dangling CEREMONY_DIR could not fail it.
Round 2 (4fd7861): fixed with a step-replay job in release-exercise.yml that runs the merge door's early sequence for real — both checkout shapes, both branches of the self-consumption bypass (matrix stands in for the github.repository test), then facts → decide → notes as release.yml's own steps with genuine $GITHUB_OUTPUT plumbing, and a final assert pinning the carried values so green means real data crossed the step boundaries. All three reviewers approved this head.

What was verified:

CI green on this head: test (shellcheck + actionlint + full suite), action-exercise, and release-exercise → fixture-chain + step-replay (dogfood) + step-replay (consumer). The two call / release-on-* jobs skip by design — both doors are event-gated on push, so the PR-context call proves the parse and can never open one.
kimi re-ran the suite locally, replayed the step sequence, and probed the asserts adversarially (tag-mismatch, notes-missing, nothing-exists all refuse loudly before anything is created).
grok confirmed the constraint-by-constraint encoding against #1's list, including the one-push:-key caller stub and the bare X.Y.Z tag assert.
codex verified the self-ref pin rules and the step-replay output plumbing carries genuine values (ver=0.7.0, base_ver=0.6.9-dev, ceremony=yes).

Post-merge residue:

No CHANGELOG.md entry by design — the repo's changelog arrives with #11, which backfills pre-#11 entries (same stated exception as #28/#29/#31/#33).
The honest gap, stated in release.yml's header: the live doors themselves stay untested until #11 dogfoods 0.1.0 via a local-path call and the #13 pilot runs a consumer for real.
On today's pre-dogfood tree (no VERSION yet) the self-ref guard prints a NOTICE and the pin rides unchecked — by design and by comment; #11 arms it.
#11 is unblocked by this merge.

Requesting @danmt's review and setting state:needs-human. Over to you.

## Round summary — converged, handing off **What shipped** (head `4fd7861`): `.github/workflows/release.yml` — the reusable release workflow, both doors in one implementation, with the two-doors design essay in the header (lineage box#83/#96 · rig#32/#47 · cast#96/#111) and every load-bearing constraint from #1 encoded or explicitly N/A, checked one-by-one in the PR description. Around it: `lib/facts.sh` (the impure fact-gathering half feeding #8's pure `lib/decide.sh`) with `test/facts.test.sh`; `test/release-chain.test.sh` proving facts → decide → notes end-to-end against a fixture repo with a stubbed `gh`; the self-ref pin (`CEREMONY_SELF_REF` + self-consumption bypass) enforced by `.github/scripts/self-ref-check.sh` + `test/self-ref.test.sh` + a CI step; `docs/CONSUMERS.md` with the caller stub; and `release-exercise.yml`, the scratch caller wired into PR CI. **Rounds**: two. - **Round 1** (`ad8ebfe`): all three panel verdicts (codex, grok, kimi) requested changes, converging on one blocking gap — the scratch caller proved release.yml *parses* but executed none of its steps, so a wrong `path:`, an inverted bypass `if:`, or a dangling `CEREMONY_DIR` could not fail it. - **Round 2** (`4fd7861`): fixed with a `step-replay` job in `release-exercise.yml` that runs the merge door's early sequence for real — both checkout shapes, both branches of the self-consumption bypass (matrix stands in for the `github.repository` test), then facts → decide → notes as release.yml's own steps with genuine `$GITHUB_OUTPUT` plumbing, and a final assert pinning the carried values so green means real data crossed the step boundaries. All three reviewers approved this head. **What was verified**: - CI green on this head: `test` (shellcheck + actionlint + full suite), `action-exercise`, and `release-exercise` → `fixture-chain` + `step-replay (dogfood)` + `step-replay (consumer)`. The two `call / release-on-*` jobs skip by design — both doors are event-gated on `push`, so the PR-context call proves the parse and can never open one. - kimi re-ran the suite locally, replayed the step sequence, and probed the asserts adversarially (tag-mismatch, notes-missing, nothing-exists all refuse loudly before anything is created). - grok confirmed the constraint-by-constraint encoding against #1's list, including the one-`push:`-key caller stub and the bare `X.Y.Z` tag assert. - codex verified the self-ref pin rules and the `step-replay` output plumbing carries genuine values (`ver=0.7.0`, `base_ver=0.6.9-dev`, `ceremony=yes`). **Post-merge residue**: - No `CHANGELOG.md` entry by design — the repo's changelog arrives with #11, which backfills pre-#11 entries (same stated exception as #28/#29/#31/#33). - The honest gap, stated in release.yml's header: the live doors themselves stay untested until #11 dogfoods 0.1.0 via a local-path call and the #13 pilot runs a consumer for real. - On today's pre-dogfood tree (no `VERSION` yet) the self-ref guard prints a NOTICE and the pin rides unchecked — by design and by comment; #11 arms it. - #11 is unblocked by this merge. Requesting @danmt's review and setting `state:needs-human`. Over to you.

No reviewers

danmt

grok-bot-andresmgsl

kimi-bot-andresmgsl

codex-bot-andresmgsl

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: heavy-duty/ceremony#39

No description provided.

feat: the reusable release workflow — both doors, one implementation #39

Acceptance criteria

#1's load-bearing constraints, one by one

Builder notes

Changelog

Round log

Round 1 → 4fd7861

Verdict: request changes

Blocking — scratch caller does not meet the AC

What already looks solid (non-blocking)

Blocking: the scratch caller does not satisfy the last acceptance criterion

Verified (not blocking)

Prior blocker closed

Rest of the tip (re-checked)

Round 1 → fixed

Acceptance criteria

Verified locally at this head

Round summary — converged, handing off

Round 1 → `4fd7861`