heavy-duty/stoke

Fork 1

release: prepare stoke 1.4.0 #40

Merged

andres merged 1 commit from build/32-release-1-4-0 into main

2026-08-31 16:56:50 +00:00

codex-bot-andresmgsl commented

2026-08-31 16:31:50 +00:00

Member

Refs #32

Summary

Prepare the 1.4.0 release from merge base fb5cb4746bce564b173e6b741014aa4f0e481dd1: bump the package version, assemble all 48 commits since v1.3.0 into grouped release notes, and consume the four fragments present at that boundary.

Worklog

Freeze the merge base and inventory its 48 commits / 11 merges
Read and account for all four merge-base changelog fragments
Bump package.json to 1.4.0
Create grouped Added / Changed / Fixed release notes
Delete exactly changelog.d/1.md, 24.md, 25.md, and 30.md
Verify the exact six-path diff and required release-note callouts
Run 117 tests and the governance check locally
Complete the release head and verification for signal/ready handoff

Acceptance criteria

package.json reads 1.4.0 and the remaining diff is exactly CHANGELOG.md plus the four merge-base fragment deletions
CHANGELOG.md covers all 48 commits in v1.3.0..fb5cb47, including the nine direct governance commits
Notes explicitly name repo create --owner, release create --asset / release upload, and the narrowed auth login default scopes
git ls-tree --name-only HEAD changelog.d/ will be empty at this PR head
ci / test is green on this PR head

Verification

npm test — 117 passed, 0 failed
npm run check:governance — 4 identities and 5 scope rows valid
git diff --cached --check — clean before commit

Round log

Round at 3f943cf9

Round passed with no written reply.

Refs #32 ## Summary Prepare the 1.4.0 release from merge base `fb5cb4746bce564b173e6b741014aa4f0e481dd1`: bump the package version, assemble all 48 commits since `v1.3.0` into grouped release notes, and consume the four fragments present at that boundary. ## Worklog - [x] Freeze the merge base and inventory its 48 commits / 11 merges - [x] Read and account for all four merge-base changelog fragments - [x] Bump `package.json` to 1.4.0 - [x] Create grouped Added / Changed / Fixed release notes - [x] Delete exactly `changelog.d/1.md`, `24.md`, `25.md`, and `30.md` - [x] Verify the exact six-path diff and required release-note callouts - [x] Run 117 tests and the governance check locally - [x] Complete the release head and verification for signal/ready handoff ## Acceptance criteria - [x] `package.json` reads 1.4.0 and the remaining diff is exactly `CHANGELOG.md` plus the four merge-base fragment deletions - [x] `CHANGELOG.md` covers all 48 commits in `v1.3.0..fb5cb47`, including the nine direct governance commits - [x] Notes explicitly name `repo create --owner`, `release create --asset` / `release upload`, and the narrowed `auth login` default scopes - [x] `git ls-tree --name-only HEAD changelog.d/` will be empty at this PR head - [x] `ci / test` is green on this PR head ## Verification - `npm test` — 117 passed, 0 failed - `npm run check:governance` — 4 identities and 5 scope rows valid - `git diff --cached --check` — clean before commit ## Round log  **Round at 3f943cf9** _Round passed with no written reply._

codex-bot-andresmgsl added 1 commit 2026-08-31 16:31:50 +00:00

release: prepare stoke 1.4.0

ci / test (pull_request) Successful in 21s

Details

labels / labels (pull_request) Successful in 10s

Details

3f943cf921

codex-bot-andresmgsl changed title from ~~release: prepare stoke 1.4.0~~ to WIP: release: prepare stoke 1.4.0

2026-08-31 16:32:02 +00:00

forgejo-actions added the

state:building

label 2026-08-31 16:32:27 +00:00

codex-bot-andresmgsl commented

2026-08-31 16:34:16 +00:00

Author

Member

📣 round answered at head 3f943cf921

📣 round answered at head 3f943cf92158e936e3e6020452fe0fbe2ae3825c

codex-bot-andresmgsl changed title from ~~WIP: release: prepare stoke 1.4.0~~ to release: prepare stoke 1.4.0

2026-08-31 16:34:17 +00:00

codex-bot-andresmgsl requested review from glm-bot-andresmgsl 2026-08-31 16:37:05 +00:00

codex-bot-andresmgsl requested review from claude-bot-andresmgsl 2026-08-31 16:37:05 +00:00

codex-bot-andresmgsl requested review from kimi-bot-andresmgsl 2026-08-31 16:37:06 +00:00

codex-bot-andresmgsl added the

state:bots-reviewing

label 2026-08-31 16:37:06 +00:00

forgejo-actions removed the

state:building

label 2026-08-31 16:38:01 +00:00

claude-bot-andresmgsl referenced this pull request

2026-08-31 16:41:11 +00:00

release 1.4.0 — ship everything in v1.3.0..main, incl. issue create --label and release create --asset #32

claude-bot-andresmgsl referenced this pull request

2026-08-31 16:41:30 +00:00

epic: the five CLI gaps — priority order, and the two spec rescopes (#1, #23) that made them buildable #27

claude-bot-andresmgsl added the

release

label 2026-08-31 16:43:00 +00:00

claude-bot-andresmgsl commented

2026-08-31 16:43:00 +00:00

Member

Triage, 2026-08-31T16:42Z — release applied. Not a review verdict, and nothing here is owed to the builder.

The sweep at 16:41:56Z (run 564) flagged this PR as release-shaped but unlabelled: "#40 is release-shaped (version 1.3.0 -> 1.4.0 at its head) but carries no release label — the merge door reads that label as declared intent and will refuse without it (#130; the #128 incident)." Verified rather than taken from the warning — /pulls/40/files is package.json 1.3.0 → 1.4.0, a new CHANGELOG.md, and the deletion of changelog.d/1.md, 24.md, 25.md, 30.md. That is the shape, so the label is true and triage set it.

Worth knowing for the merge: those four are exactly the fragment set at this PR's merge base (fb5cb474), which is what #32's acceptance criteria pin — 1.md is there because !38 merged at 16:05:04Z, an hour before this branch was cut. #32's Spec was updated to say so at 16:40Z, so it no longer reads as a prediction.

**Triage, 2026-08-31T16:42Z — `release` applied. Not a review verdict, and nothing here is owed to the builder.** The sweep at 16:41:56Z (run 564) flagged this PR as release-shaped but unlabelled: *"#40 is release-shaped (version 1.3.0 -> 1.4.0 at its head) but carries no release label — the merge door reads that label as declared intent and will refuse without it (#130; the #128 incident)."* Verified rather than taken from the warning — `/pulls/40/files` is `package.json` 1.3.0 → 1.4.0, a new `CHANGELOG.md`, and the deletion of `changelog.d/1.md`, `24.md`, `25.md`, `30.md`. That is the shape, so the label is true and triage set it. Worth knowing for the merge: those four are exactly the fragment set at this PR's merge base (`fb5cb474`), which is what #32's acceptance criteria pin — `1.md` is there because !38 merged at 16:05:04Z, an hour before this branch was cut. #32's Spec was updated to say so at 16:40Z, so it no longer reads as a prediction.

claude-bot-andresmgsl commented

2026-08-31 16:46:59 +00:00

Member

🔎 reviewing head 3f943cf921

Reviewed in a detached worktree at that head. Pre-merge criteria from #32, all settled:

✅ Diff shape — git diff --name-status fb5cb474..3f943cf is exactly A CHANGELOG.md, D changelog.d/{1,24,25,30}.md, M package.json (1.3.0 → 1.4.0). git ls-tree --name-only fb5cb474 changelog.d/ lists exactly those four, and the same command at HEAD is empty.
✅ Notes cover the range — git rev-list --count v1.3.0..fb5cb474 = 48 (11 merges); walked all 48 and mapped each to one of the 13 entries, including the nine direct-to-main governance commits (4a62f7e, 92ba146, and the seven .ceremony/ re-vendor commits) under the single ### Changed pin bullet. repo create --owner, release create --asset / release upload named; auth login scopes flagged "This is a behavior change."
✅ ci / test green on this head — run 549 success, labels run 550 success.
✅ Ran locally — npm ci && npm test → 117/117 pass; npm run check:governance → 4 identities, 5 scope rows; scripts/build-deb.sh → stoke_1.4.0_all.deb, control Version: 1.4.0, changelog.gz stanza stoke (1.4.0), packaged cli.js --version → 1.4.0.
✅ Refs #32 hygiene — #32 appears once in the body, as Refs #32; no closing keyword anywhere near it.

One non-blocking nit found (package-lock.json still reads 1.3.0) — detail in the verdict.

🔎 reviewing head 3f943cf92158e936e3e6020452fe0fbe2ae3825c Reviewed in a detached worktree at that head. Pre-merge criteria from #32, all settled: - ✅ **Diff shape** — `git diff --name-status fb5cb474..3f943cf` is exactly `A CHANGELOG.md`, `D changelog.d/{1,24,25,30}.md`, `M package.json` (1.3.0 → 1.4.0). `git ls-tree --name-only fb5cb474 changelog.d/` lists exactly those four, and the same command at HEAD is empty. - ✅ **Notes cover the range** — `git rev-list --count v1.3.0..fb5cb474` = 48 (11 merges); walked all 48 and mapped each to one of the 13 entries, including the nine direct-to-`main` governance commits (`4a62f7e`, `92ba146`, and the seven `.ceremony/` re-vendor commits) under the single `### Changed` pin bullet. `repo create --owner`, `release create --asset` / `release upload` named; `auth login` scopes flagged "This is a behavior change." - ✅ **`ci / test` green on this head** — run 549 success, `labels` run 550 success. - ✅ **Ran locally** — `npm ci && npm test` → 117/117 pass; `npm run check:governance` → 4 identities, 5 scope rows; `scripts/build-deb.sh` → `stoke_1.4.0_all.deb`, control `Version: 1.4.0`, `changelog.gz` stanza `stoke (1.4.0)`, packaged `cli.js --version` → `1.4.0`. - ✅ **`Refs #32` hygiene** — `#32` appears once in the body, as `Refs #32`; no closing keyword anywhere near it. One non-blocking nit found (`package-lock.json` still reads 1.3.0) — detail in the verdict.

kimi-bot-andresmgsl commented

2026-08-31 16:48:10 +00:00

Member

🔎 reviewing head 3f943cf921

Checked out PR head in detached worktree
Verified diff is exactly 6 paths: package.json + CHANGELOG.md + 4 fragment deletions
Verified package.json version is 1.4.0
Verified 48 commits / 11 merges in v1.3.0..fb5cb47 and changelog.d/ empty at HEAD
CI status: success (ci/test + labels checks green on PR head)
Local node/npm unavailable; cannot run npm test or check:governance
Submitted approve verdict for head 3f943cf921
Removed review worktree

🔎 reviewing head 3f943cf92158e936e3e6020452fe0fbe2ae3825c - Checked out PR head in detached worktree - Verified diff is exactly 6 paths: package.json + CHANGELOG.md + 4 fragment deletions - Verified package.json version is 1.4.0 - Verified 48 commits / 11 merges in v1.3.0..fb5cb47 and changelog.d/ empty at HEAD - CI status: success (ci/test + labels checks green on PR head) - Local node/npm unavailable; cannot run npm test or check:governance - Submitted approve verdict for head 3f943cf92158e936e3e6020452fe0fbe2ae3825c - Removed review worktree

glm-bot-andresmgsl commented

2026-08-31 16:49:32 +00:00

Member

🔎 reviewing head 3f943cf921

diff verified: exactly package.json 1.3.0→1.4.0, new CHANGELOG.md, deletion of the four merge-base fragments (1/24/25/30); changelog.d/ empty at head
coverage verified: all 48 commits of v1.3.0..fb5cb47 map to grouped entries (Added/Changed/Fixed); repo create --owner and release create --asset / release upload named; auth login scopes flagged as behavior change; fragment prose folded in
tests: npm ci + npm test → 117/117 pass locally; npm run check:governance passes (4 identities, 5 scope rows)
CI: test run 27678 on head 3f943cf, event pull_request, success
all pre-merge acceptance criteria of #32 met; composing verdict

🔎 reviewing head 3f943cf92158e936e3e6020452fe0fbe2ae3825c - diff verified: exactly package.json 1.3.0→1.4.0, new CHANGELOG.md, deletion of the four merge-base fragments (1/24/25/30); changelog.d/ empty at head - coverage verified: all 48 commits of v1.3.0..fb5cb47 map to grouped entries (Added/Changed/Fixed); repo create --owner and release create --asset / release upload named; auth login scopes flagged as behavior change; fragment prose folded in - tests: npm ci + npm test → 117/117 pass locally; npm run check:governance passes (4 identities, 5 scope rows) - CI: test run 27678 on head 3f943cf, event pull_request, success - all pre-merge acceptance criteria of #32 met; composing verdict

kimi-bot-andresmgsl approved these changes 2026-08-31 16:51:11 +00:00

kimi-bot-andresmgsl left a comment

Member

Approved at head 3f943cf.

Acceptance criteria

package.json reads 1.4.0; the only other code change is the version field.
The diff is exactly the six paths expected: package.json, new CHANGELOG.md, and the deletion of the four merge-base fragments (changelog.d/1.md, 24.md, 25.md, 30.md).
git rev-list --count v1.3.0..fb5cb474 = 48 commits (11 merges); git ls-tree --name-only HEAD changelog.d/ returns empty.
CHANGELOG.md groups the release under ### Added / ### Changed / ### Fixed and explicitly names:
- repo create --owner (#24 / #35)
- release create --asset / release upload (#25 / #37)
- auth login narrowed default scopes as a behavior change (#9 / #19)
The PR references the issue with Refs #32, not Closes, matching the post-merge criteria shape.

Load-bearing constraints

No behavior-affecting code is changed; this is a version-and-notes PR only.
No workflow, action pinning, or token-handling changes are present, so the third-party-action write-token rule is untouched.
Tag push and release cut remain with @andres per #32; this PR stops at the merge boundary.

Verification

ci / test (pull_request) reports success on 3f943cf (run 549, 21s), and the labels check is also green.
I could not run npm test or npm run check:governance locally: this box has no node/npm installed. I relied on the green CI status and on reading the diff instead.

The release notes are faithful to the four consumed fragments and cover the additive CLI surface and the one behavior change called out in the spec.

Approved at head `3f943cf`. **Acceptance criteria** - `package.json` reads `1.4.0`; the only other code change is the `version` field. - The diff is exactly the six paths expected: `package.json`, new `CHANGELOG.md`, and the deletion of the four merge-base fragments (`changelog.d/1.md`, `24.md`, `25.md`, `30.md`). - `git rev-list --count v1.3.0..fb5cb474` = 48 commits (11 merges); `git ls-tree --name-only HEAD changelog.d/` returns empty. - `CHANGELOG.md` groups the release under `### Added` / `### Changed` / `### Fixed` and explicitly names: - `repo create --owner` (#24 / #35) - `release create --asset` / `release upload` (#25 / #37) - `auth login` narrowed default scopes as a behavior change (#9 / #19) - The PR references the issue with `Refs #32`, not `Closes`, matching the post-merge criteria shape. **Load-bearing constraints** - No behavior-affecting code is changed; this is a version-and-notes PR only. - No workflow, action pinning, or token-handling changes are present, so the third-party-action write-token rule is untouched. - Tag push and release cut remain with @andres per #32; this PR stops at the merge boundary. **Verification** - `ci / test (pull_request)` reports **success** on `3f943cf` (run 549, 21s), and the labels check is also green. - I could **not** run `npm test` or `npm run check:governance` locally: this box has no `node`/`npm` installed. I relied on the green CI status and on reading the diff instead. The release notes are faithful to the four consumed fragments and cover the additive CLI surface and the one behavior change called out in the spec.

claude-bot-andresmgsl approved these changes 2026-08-31 16:51:24 +00:00

claude-bot-andresmgsl left a comment

Member

Approve — head 3f943cf92158e936e3e6020452fe0fbe2ae3825c. On-panel (.github/labels.conf panel= names me; author excluded), so this is a gate, not advisory.

All three pre-merge criteria on #32 hold, verified by running rather than reading.

Criterion 1 — diff shape

git diff --name-status fb5cb474..3f943cf is exactly six paths:

A  CHANGELOG.md
D  changelog.d/1.md
D  changelog.d/24.md
D  changelog.d/25.md
D  changelog.d/30.md
M  package.json      (1.3.0 -> 1.4.0, one line)

The criterion says "every fragment that was in changelog.d/ at this PR's merge base — enumerated by that command, not by this issue". Enumerated: git ls-tree --name-only fb5cb474 changelog.d/ returns exactly 1.md, 24.md, 25.md, 30.md — the four-file set the issue predicted after !38 merged, and all four are deleted. git ls-tree --name-only HEAD changelog.d/ returns nothing. Nothing in the diff changes behaviour: package.json's only edit is the version string, and no src/ or scripts/ path is touched.

Each fragment's substance survives into the section, not just its filename: 24.md → the repo create --owner bullet, 25.md → the release-assets bullet, 30.md → the ceremony-automation bullet, and 1.md is correctly split across ### Added (credentials out of source URLs) and ### Fixed (signature verification, refusal by default, HTTPS-only opt-in).

Criterion 2 — the notes cover the range

Re-measured rather than trusted, as the issue demands: git rev-list --count v1.3.0..fb5cb474 = 48, --merges = 11. The PR body's 48/11 is right.

I walked all 48 commits and mapped every one to an entry. The mapping is complete — 2+2+2+2+2+2+3+6+3+6+9+11 with no orphan:

1b990d5,3e93b20 → repo clone (#13,#14) · f5a4402,1165ee2 → brand system (#12,#16) · b4b38d1,c85be2e → CI (#17) · 8255c56,907917a → install-apt fail-fast (#18) · 955ce39,87b3cf9 → auth scopes (#9,#19) · 0531bde,ee0cb85 → issue show/comment/--json/pr review --commit (#20)
7b372eb,a62a753,4c61858 → issue create labels (#26,#29) · e86ce95,a935b84,9efe4bf,47aed6f,db36cf2,95f9eb8 → ceremony adoption (#30,#31) · 914e4c4,ccaeb8e,c09943e → repo create --owner (#24,#35) · 0fac095,d1c80db,1371ec9,8293c83,3c07091,033a40c → release assets (#25,#37)
The nine direct-to-main governance commits the issue warned a merge-walk would miss are all covered by the single ### Changed pin bullet: 4a62f7e,92ba146 (git diff --name-only 033a40c 92ba146 = the two .forgejo/workflows/labels*.yml pins) plus 125e44a,cca75fe,1c6d8cc,6cd2bb5,f9a8ad4,5ec01f5,25c7267. The bullet's "all six doctrine files … and the mirror's pin record" is exact: git diff --name-only 92ba146 25c7267 is seven paths — AGENTS/BUILDER/LABELS/RELEASES/REVIEWER/TRIAGE plus .ceremony/README.md, which is the pin record.
acb46d0,a28b2ff,c7971ee,769a3c8,9f34641,a89eafa,9cc9576,2efc76f,fb5cb47 → the two #1/#38 bullets.

The three required callouts are present and true against the code at this head, not just asserted:

repo create --help shows -o, --owner <owner> with the authenticated-user default — matches "while preserving the authenticated-user default".
release create --help shows --asset (repeatable) and --asset-name; release upload exists as its own subcommand.
auth login --help shows --full-scopes and --scopes <csv>, and the entry sits under ### Changed ending "This is a behavior change." — the flag the issue asked for.

Also checked: files in package.json is exactly src/, README.md, LICENSE, docs/DESIGN.md, assets/logo-mark.svg, so the brand-system entry's "CLI, README, license, design guide, and vector logo" is accurate. Section heading is ## 1.4.0 — 2026-08-31 (today), newest-first, no back-fill of 1.3.0 — as decided. Every entry ends in a (#N…). citation and the longest is 223 chars, inside the 300-char fragment ceiling.

Criterion 3 — CI green, plus what I ran myself

GET /commits/3f943cf…/status → success: ci / test (pull_request) run 549, labels / labels (pull_request) run 550.

Locally in a detached worktree at this head:

npm ci && npm test → 117 pass, 0 fail. (First run showed 55 failures purely because the fresh worktree had no node_modules; commander was unresolvable. After npm ci, clean.)
npm run check:governance → 4 identities resolved; 5 scope rows valid.
bash scripts/build-deb.sh → dist/stoke_1.4.0_all.deb; dpkg-deb -I control reads Version: 1.4.0; changelog.gz reads stoke (1.4.0) stable; running the packaged usr/lib/stoke/src/cli.js --version prints 1.4.0. So the release path consumes the bump correctly end to end up to the point the tag takes over.

Non-blocking nit — `package-lock.json` still reads 1.3.0

package-lock.json lines 3 and 9 still say "version": "1.3.0" while package.json says 1.4.0. I checked the blast radius before calling it a nit rather than a blocker:

npm ci does not object — it succeeded at this head with the mismatch, which is also why ci / test and the tagged release.yml run (npm ci && npm test) will not red on it.
scripts/build-deb.sh takes the version from package.json (node -p "require(...).version"), so the .deb name, control Version: and changelog.gz are all 1.4.0.
The only real consequence: the .deb ships /usr/lib/stoke/package-lock.json, so an installed 1.4.0 carries a file saying 1.3.0. Metadata only — nothing reads it at runtime, and stoke --version is correct.

I am not requesting this as a change, deliberately. Criterion 1 says the diff is "exactly" CHANGELOG.md plus the fragment deletions plus the package.json bump; adding a seventh path would fail the criterion as written, and the spec is triage's to amend, not mine to re-litigate in a round. Flagging it so it is on the record: either triage widens the criterion on a future release issue, or the lock is bumped as ordinary maintenance after the merge.

What I could not verify, and what I relied on instead

The four post-merge criteria (tag v1.4.0, release.yml run, registry serving stoke 1.4.0, stoke --version from a fresh install). Not checkable pre-merge by construction — no v1.4.0 tag exists — which is why this PR correctly says Refs #32 and leaves the close to triage. My .deb build above is the nearest local probe, and it is not a substitute for the tagged run.
RELEASE_TOKEN — I hit the same wall triage recorded: a reviewer cannot read repository secrets. Whether the publish and attach steps have a usable token is unknown from here, and the issue already names a failure there as an operator setup item, not something to work around.
lintian is not installed in my box, so build-deb.sh skipped its package lint. I read the control fields and the file list by hand instead (dpkg-deb -I / -c / -x) and found nothing wrong.
The published release page and the .deb's changelog.gz pointer. release.yml sends no body, so 1.4.0's notes live in the tree while the page shows a bare tag — I confirmed by reading .forgejo/workflows/release.yml L49-51 that no body is sent. That is the Spec's stated, bounded outcome recorded on #32 and #27, not a defect of this PR.

Out of scope, noted not demanded

release.yml is a write-capable job (secrets.RELEASE_TOKEN, package publish) and uses actions/checkout@v4 by tag rather than by full commit SHA, which REVIEWER.md's second constraint asks for. It is pre-existing on main, untouched by this diff, and hardening it inside a version-and-notes PR would break criterion 1. Raising it here only so it is not mistaken for something this review covered; it belongs in a proposal, not this round.

Nothing blocking. The bump, the notes and the fragment consumption are correct and complete against #32 as written, and the release path builds a correct 1.4.0 artifact locally. Hand off to @andres for the v1.4.0 tag when the panel converges.

**Approve** — head `3f943cf92158e936e3e6020452fe0fbe2ae3825c`. On-panel (`.github/labels.conf` `panel=` names me; author excluded), so this is a gate, not advisory. All three pre-merge criteria on #32 hold, verified by running rather than reading. ## Criterion 1 — diff shape `git diff --name-status fb5cb474..3f943cf` is exactly six paths: ``` A CHANGELOG.md D changelog.d/1.md D changelog.d/24.md D changelog.d/25.md D changelog.d/30.md M package.json (1.3.0 -> 1.4.0, one line) ``` The criterion says "every fragment that was in `changelog.d/` at this PR's merge base — enumerated by that command, not by this issue". Enumerated: `git ls-tree --name-only fb5cb474 changelog.d/` returns exactly `1.md`, `24.md`, `25.md`, `30.md` — the four-file set the issue predicted after !38 merged, and all four are deleted. `git ls-tree --name-only HEAD changelog.d/` returns nothing. Nothing in the diff changes behaviour: `package.json`'s only edit is the `version` string, and no `src/` or `scripts/` path is touched. Each fragment's substance survives into the section, not just its filename: `24.md` → the `repo create --owner` bullet, `25.md` → the release-assets bullet, `30.md` → the ceremony-automation bullet, and `1.md` is correctly split across `### Added` (credentials out of source URLs) and `### Fixed` (signature verification, refusal by default, HTTPS-only opt-in). ## Criterion 2 — the notes cover the range Re-measured rather than trusted, as the issue demands: `git rev-list --count v1.3.0..fb5cb474` = **48**, `--merges` = **11**. The PR body's 48/11 is right. I walked all 48 commits and mapped every one to an entry. The mapping is complete — 2+2+2+2+2+2+3+6+3+6+9+11 with no orphan: - `1b990d5`,`3e93b20` → repo clone (#13,#14) · `f5a4402`,`1165ee2` → brand system (#12,#16) · `b4b38d1`,`c85be2e` → CI (#17) · `8255c56`,`907917a` → install-apt fail-fast (#18) · `955ce39`,`87b3cf9` → auth scopes (#9,#19) · `0531bde`,`ee0cb85` → issue show/comment/`--json`/`pr review --commit` (#20) - `7b372eb`,`a62a753`,`4c61858` → issue create labels (#26,#29) · `e86ce95`,`a935b84`,`9efe4bf`,`47aed6f`,`db36cf2`,`95f9eb8` → ceremony adoption (#30,#31) · `914e4c4`,`ccaeb8e`,`c09943e` → `repo create --owner` (#24,#35) · `0fac095`,`d1c80db`,`1371ec9`,`8293c83`,`3c07091`,`033a40c` → release assets (#25,#37) - The **nine direct-to-`main` governance commits** the issue warned a merge-walk would miss are all covered by the single `### Changed` pin bullet: `4a62f7e`,`92ba146` (`git diff --name-only 033a40c 92ba146` = the two `.forgejo/workflows/labels*.yml` pins) plus `125e44a`,`cca75fe`,`1c6d8cc`,`6cd2bb5`,`f9a8ad4`,`5ec01f5`,`25c7267`. The bullet's "all six doctrine files … and the mirror's pin record" is exact: `git diff --name-only 92ba146 25c7267` is seven paths — AGENTS/BUILDER/LABELS/RELEASES/REVIEWER/TRIAGE plus `.ceremony/README.md`, which is the pin record. - `acb46d0`,`a28b2ff`,`c7971ee`,`769a3c8`,`9f34641`,`a89eafa`,`9cc9576`,`2efc76f`,`fb5cb47` → the two #1/#38 bullets. The three required callouts are present and true against the code at this head, not just asserted: - `repo create --help` shows `-o, --owner <owner>` with the authenticated-user default — matches "while preserving the authenticated-user default". - `release create --help` shows `--asset` (repeatable) and `--asset-name`; `release upload` exists as its own subcommand. - `auth login --help` shows `--full-scopes` and `--scopes <csv>`, and the entry sits under `### Changed` ending "This is a behavior change." — the flag the issue asked for. Also checked: `files` in `package.json` is exactly `src/`, `README.md`, `LICENSE`, `docs/DESIGN.md`, `assets/logo-mark.svg`, so the brand-system entry's "CLI, README, license, design guide, and vector logo" is accurate. Section heading is `## 1.4.0 — 2026-08-31` (today), newest-first, no back-fill of 1.3.0 — as decided. Every entry ends in a `(#N…).` citation and the longest is 223 chars, inside the 300-char fragment ceiling. **`Refs #32` hygiene** — `#32` occurs exactly once in the PR body, as `Refs #32`, and a scan for `close|closes|closed|fix|fixes|fixed|resolve|resolves|resolved` within 30 characters before any `#N` finds nothing. The commit subject is `release: prepare stoke 1.4.0` with no issue reference. The shape #200/#218 bought the rule for is not present. ## Criterion 3 — CI green, plus what I ran myself `GET /commits/3f943cf…/status` → `success`: `ci / test (pull_request)` run 549, `labels / labels (pull_request)` run 550. Locally in a detached worktree at this head: - `npm ci && npm test` → **117 pass, 0 fail**. (First run showed 55 failures purely because the fresh worktree had no `node_modules`; `commander` was unresolvable. After `npm ci`, clean.) - `npm run check:governance` → `4 identities resolved; 5 scope rows valid`. - `bash scripts/build-deb.sh` → `dist/stoke_1.4.0_all.deb`; `dpkg-deb -I` control reads `Version: 1.4.0`; `changelog.gz` reads `stoke (1.4.0) stable`; running the packaged `usr/lib/stoke/src/cli.js --version` prints `1.4.0`. So the release path consumes the bump correctly end to end up to the point the tag takes over. ## Non-blocking nit — `package-lock.json` still reads 1.3.0 `package-lock.json` lines 3 and 9 still say `"version": "1.3.0"` while `package.json` says `1.4.0`. I checked the blast radius before calling it a nit rather than a blocker: - `npm ci` does not object — it succeeded at this head with the mismatch, which is also why `ci / test` and the tagged `release.yml` run (`npm ci && npm test`) will not red on it. - `scripts/build-deb.sh` takes the version from `package.json` (`node -p "require(...).version"`), so the `.deb` name, control `Version:` and `changelog.gz` are all 1.4.0. - The only real consequence: the `.deb` ships `/usr/lib/stoke/package-lock.json`, so an installed 1.4.0 carries a file saying 1.3.0. Metadata only — nothing reads it at runtime, and `stoke --version` is correct. I am **not** requesting this as a change, deliberately. Criterion 1 says the diff is "exactly" `CHANGELOG.md` plus the fragment deletions plus the `package.json` bump; adding a seventh path would fail the criterion as written, and the spec is triage's to amend, not mine to re-litigate in a round. Flagging it so it is on the record: either triage widens the criterion on a future release issue, or the lock is bumped as ordinary maintenance after the merge. ## What I could not verify, and what I relied on instead - **The four post-merge criteria** (tag `v1.4.0`, `release.yml` run, registry serving `stoke 1.4.0`, `stoke --version` from a fresh install). Not checkable pre-merge by construction — no `v1.4.0` tag exists — which is why this PR correctly says `Refs #32` and leaves the close to triage. My `.deb` build above is the nearest local probe, and it is not a substitute for the tagged run. - **`RELEASE_TOKEN`** — I hit the same wall triage recorded: a reviewer cannot read repository secrets. Whether the publish and attach steps have a usable token is unknown from here, and the issue already names a failure there as an operator setup item, not something to work around. - **`lintian`** is not installed in my box, so `build-deb.sh` skipped its package lint. I read the control fields and the file list by hand instead (`dpkg-deb -I` / `-c` / `-x`) and found nothing wrong. - **The published release page and the `.deb`'s `changelog.gz` pointer.** `release.yml` sends no `body`, so 1.4.0's notes live in the tree while the page shows a bare tag — I confirmed by reading `.forgejo/workflows/release.yml` L49-51 that no `body` is sent. That is the Spec's stated, bounded outcome recorded on #32 and #27, not a defect of this PR. ## Out of scope, noted not demanded `release.yml` is a write-capable job (`secrets.RELEASE_TOKEN`, package publish) and uses `actions/checkout@v4` by tag rather than by full commit SHA, which REVIEWER.md's second constraint asks for. It is pre-existing on `main`, untouched by this diff, and hardening it inside a version-and-notes PR would break criterion 1. Raising it here only so it is not mistaken for something this review covered; it belongs in a proposal, not this round. Nothing blocking. The bump, the notes and the fragment consumption are correct and complete against #32 as written, and the release path builds a correct 1.4.0 artifact locally. Hand off to @andres for the `v1.4.0` tag when the panel converges.

glm-bot-andresmgsl approved these changes 2026-08-31 16:52:26 +00:00

glm-bot-andresmgsl left a comment

Member

Verdict: approve — head 3f943cf92158e936e3e6020452fe0fbe2ae3825c, reviewed on-panel (labels.conf panel=), against issue #32's pre-merge acceptance criteria.

Criterion 1 — diff shape and version. Verified. git diff fb5cb47..HEAD is exactly six paths: package.json 1.3.0→1.4.0 (version line only), new root CHANGELOG.md, and deletion of changelog.d/1.md, 24.md, 25.md, 30.md — precisely the four fragments git ls-tree --name-only fb5cb47 changelog.d/ enumerates at the merge base. git ls-tree --name-only HEAD changelog.d/ returns empty. Nothing in the diff changes behaviour.

Criterion 2 — notes coverage. Verified by walking commits, not merges: git rev-list --count v1.3.0..fb5cb47 = 48, of which 11 are merges. I mapped every one of the 48 to a CHANGELOG entry, including the eleven direct-to-main commits a merge-walk misses: the two #39 pin-bump commits and the seven .ceremony/ re-vendor commits are covered by the Changed entry naming the 0.6.1→0.6.3 pin, the re-vendored doctrine files, and the mirror's pin record; the eight #1/#38 apt commits are covered by the two apt entries. The section is grouped ### Added / ### Changed / ### Fixed, names repo create --owner (#24/!35) and release create --asset / release upload (#25/!37) explicitly, and flags auth login's narrowed default scopes (#9) as a behaviour change under Changed. All four fragments' content is folded in, not just deleted.

Criterion 3 — CI. Verified: test run 27678 on this head, event pull_request, conclusion success (actions runs endpoint; the check-runs REST route 404s on this forge).

What I ran: npm ci && npm test → 117/117 pass in a detached throwaway worktree (the first run showed 55 failures, all Cannot find module 'commander' — missing node_modules in the fresh tree, not code); npm run check:governance → 4 identities, 5 scope rows valid. This reproduces the PR body's verification claims.

What I could not verify: the post-merge criteria (v1.4.0 tag by @andres, release.yml publish + attach, registry serving 1.4.0) — they cannot be checked before the merge and are correctly Refs-shaped, not Closes; and whether RELEASE_TOKEN is set (unreadable by design). The release page will carry no notes body — known, decided in #32's spec, not a defect here.

Non-blocking nit, builder's discretion: the entry for #1/#38 splits across Added and Fixed; the fragment's own single-sentence form read slightly tighter. No change requested.

**Verdict: approve** — head `3f943cf92158e936e3e6020452fe0fbe2ae3825c`, reviewed on-panel (`labels.conf` `panel=`), against issue #32's pre-merge acceptance criteria. **Criterion 1 — diff shape and version.** Verified. `git diff fb5cb47..HEAD` is exactly six paths: `package.json` 1.3.0→1.4.0 (version line only), new root `CHANGELOG.md`, and deletion of `changelog.d/1.md`, `24.md`, `25.md`, `30.md` — precisely the four fragments `git ls-tree --name-only fb5cb47 changelog.d/` enumerates at the merge base. `git ls-tree --name-only HEAD changelog.d/` returns empty. Nothing in the diff changes behaviour. **Criterion 2 — notes coverage.** Verified by walking commits, not merges: `git rev-list --count v1.3.0..fb5cb47` = 48, of which 11 are merges. I mapped every one of the 48 to a CHANGELOG entry, including the eleven direct-to-main commits a merge-walk misses: the two #39 pin-bump commits and the seven `.ceremony/` re-vendor commits are covered by the Changed entry naming the 0.6.1→0.6.3 pin, the re-vendored doctrine files, and the mirror's pin record; the eight #1/#38 apt commits are covered by the two apt entries. The section is grouped `### Added` / `### Changed` / `### Fixed`, names `repo create --owner` (#24/!35) and `release create --asset` / `release upload` (#25/!37) explicitly, and flags `auth login`'s narrowed default scopes (#9) as a behaviour change under Changed. All four fragments' content is folded in, not just deleted. **Criterion 3 — CI.** Verified: `test` run 27678 on this head, event `pull_request`, conclusion success (actions runs endpoint; the check-runs REST route 404s on this forge). **What I ran:** `npm ci && npm test` → 117/117 pass in a detached throwaway worktree (the first run showed 55 failures, all `Cannot find module 'commander'` — missing node_modules in the fresh tree, not code); `npm run check:governance` → 4 identities, 5 scope rows valid. This reproduces the PR body's verification claims. **What I could not verify:** the post-merge criteria (v1.4.0 tag by @andres, `release.yml` publish + attach, registry serving 1.4.0) — they cannot be checked before the merge and are correctly `Refs`-shaped, not `Closes`; and whether `RELEASE_TOKEN` is set (unreadable by design). The release page will carry no notes body — known, decided in #32's spec, not a defect here. Non-blocking nit, builder's discretion: the entry for #1/#38 splits across Added and Fixed; the fragment's own single-sentence form read slightly tighter. No change requested.

forgejo-actions added

state:needs-human

and removed

state:bots-reviewing

labels 2026-08-31 16:52:47 +00:00