Fix versioned runtime inspection and release CLI 1.10.25

docs/swe-compliance/2026-08-27-github-auth-readiness.md

@@ -0,0 +1,125 @@
+## Phase 0: Baseline And Manual Lookup
+
+- Scope: make `rudi which github` recognize manifest-declared secrets stored in RUDI's canonical secret store.
+- Current state: `which` scans account token files and `.env` only, so it falsely reports GitHub auth as not configured.
+- Relevant SWE manual sections: Security F3/F6, Testing Doctrine, Agent Co-Pilot Standard, Horizontal Engineering Standard.
+- Horizontal scan: `@learnrudi/secrets` already owns secret lookup. Its existing
+  `hasSecret` path was found to create an absent store, so the shared presence
+  probe must become non-mutating before `which` can reuse it safely.
+- Initial risk tier: High because the command reports credential readiness, though the edit is narrow and read-only.
+- Exit criteria: current behavior reproduced in a focused test and isolated worktree.
+
+## Phase 1: Scope Lock
+
+- In scope: pass installed manifest metadata into `checkAuth`, check declared
+  secret names through a non-mutating `@learnrudi/secrets` presence probe,
+  retain file/account auth discovery, rebuild and validate stack source during
+  `rudi update`, refresh the installed stack/secret contract before indexing,
+  test value redaction and absent-store behavior, bump CLI version, and
+  regenerate the tracked bundle.
+- Non-goals: provider API verification in generic CLI lifecycle, secret migration, token mutation, merge.
+- Expected files touched: `packages/secrets/src/{index.js,__tests__/unit/secrets.test.js}`,
+  `packages/core/src/{rudi-config.js,__tests__/unit/rudi-config.test.js}`,
+  `src/commands/{install.js,update.js,which.js}`, their focused unit tests,
+  `package.json`, `dist/index.cjs`, and this checklist. The shared-secret files
+  were added after independent review proved that the existing provider mutated
+  an absent store and failed on a read-only home. The update/install files were
+  added after final distribution review proved that normal stack upgrades could
+  retain stale compiled code and secret requirements. The dedicated
+  `update-stack-snapshot.test.js` boundary was added after post-fix review found
+  that a failed in-place stack upgrade could otherwise destroy the accepted
+  installation.
+- Failure behavior: missing optional/required secrets remain unconfigured; secret values never appear in output.
+- Authorized actions: user authorized implementation, commits, feature-branch publication, and local CLI activation; merge is not authorized.
+- Commit strategy: source/test/version slice after green; generated bundle slice after full build.
+- Horizontal disposition: consolidate on existing `@learnrudi/secrets` contract.
+- Exit criteria: interface and rollback boundary recorded.
+
+## Phase 2: Red Tests
+
+- Observable behavior: an installed stack declaring `GITHUB_TOKEN` reports
+  configured when the presence probe succeeds, without returning that value;
+  checking an absent store does not create it; unrelated `.env` values and
+  incomplete optional multi-secret contracts do not produce false readiness;
+  padded secret names fail closed; stack updates force a rebuild, validate the
+  result, refresh persisted metadata, and do not index failed builds; quoted
+  empty `.env` values do not count as credentials.
+- Test files: `src/__tests__/unit/{stack-runtime-detection.test.js,update-command.test.js,install-stack-build.test.js}`,
+  `packages/secrets/src/__tests__/unit/secrets.test.js`, and
+  `packages/core/src/__tests__/unit/rudi-config.test.js`.
+- Red commands: `pnpm test -- src/__tests__/unit/stack-runtime-detection.test.js`
+  failed because `checkAuth` ignored the manifest; after independent review,
+  `pnpm test -- packages/secrets/src/__tests__/unit/secrets.test.js` failed with
+  `after: true` for an initially absent store. Subsequent review cases failed
+  on padded names, partial optional credentials, unrelated `.env` values, stale
+  compiled entries, and stale persisted required-secret metadata.
+  Final review cases then failed because `runUpdate` mutated the installed
+  stack before build/validation succeeded and did not restore its lockfile, and
+  because the installer's external state migration survived a failed rollback.
+  The last compensation review proved that copy-then-delete and reverse rename
+  still exposed exact recovery data to concurrent deletion or overwrite. Three
+  preservation tests were added with the fix; a separate red execution was
+  skipped because the prior `unlink`, recursive removal, and overwrite-capable
+  rename lines were the direct read-only failure evidence.
+- Exit criteria: deterministic behavioral red.
+
+## Phase 3: Implementation
+
+- Reuse `@learnrudi/secrets`; make its presence-only probe non-mutating; require
+  runtime-valid manifest names; dependency-inject lookup for tests; do not read
+  secret values directly from `which`.
+- Preserve existing account-token and declared `.env` compatibility. For an
+  all-optional multi-secret contract with no explicit alternative-group schema,
+  report readiness conservatively only when every declared field is present.
+- Force stack builds on update even when an old entry point exists, validate
+  before indexing, and re-register canonical runtime/command/secret/version
+  metadata from the installed manifest.
+- Snapshot the exact managed stack directory and lockfile before mutation;
+  include the exact external stack-state root in that transaction; reject
+  symlinked managed-path ancestors; preflight all components; verify external
+  state generation before rollback; compensate in reverse order if promotion
+  fails; and discard the owner-only backup only after the accepted update
+  succeeds.
+- On rollback-compensation failure, copy without overwrite, retain every exact
+  staged source, preserve promoted accepted data in the private recovery area,
+  and report both live and recovery paths rather than claiming atomic success.
+- Exit criteria: red command passes unchanged.
+
+## Phase 4: Green Tests And Refactor
+
+- Green command: the exact focused targets passed together (57 tests), then a
+  full `pnpm test` passed 690 tests across 43 suites.
+- Refactor constraints: no unrelated CLI auth/lifecycle changes; install helpers
+  were exported only to keep install and update build/validation semantics shared.
+- Commit checkpoint: source/test/version first; bundle after reproducible build.
+- Exit criteria: focused/full green and no secret output.
+
+## Phase 5: Full Verification
+
+- Completed: `pnpm test` (690/690), focused tests (57/57), `pnpm build`,
+  reproducible tracked bundle, edited-file debt scan (261 graph files, 9 edited
+  files reported, 0 findings), `git diff --check`, and
+  `npm pack --dry-run` (`@learnrudi/cli@1.10.23`, 6 files).
+- Live smoke: install CLI on Admin Mac and verify `rudi which github` reports configured while printing no value.
+- Independent review: review findings covered the mutating `hasSecret` path,
+  whitespace/malformed secret boundaries, optional multi-secret optimism,
+  unrelated `.env` fallback, stale compiled stack code, and stale persisted
+  secret requirements. Post-fix reviews additionally found non-transactional
+  update failure and an external migrated-state rollback leak; those findings
+  were reproduced red and resolved with exact stack, lockfile, and state-root
+  restoration. The final scoped review then found symlink-ancestor escape,
+  partial rollback, concurrent state-rewind, cleanup classification, and inline
+  `.env` comment edges; those were reproduced red and resolved with canonical
+  containment, full preflight/compensation, a state-generation guard, separate
+  cleanup reporting, and decoded value checks. Each finding was resolved at its
+  owning boundary. The final compensation review found three destructive race
+  windows and one recovery-path observability gap; preservation-only copying,
+  retained exact sources, explicit recovery paths, and three focused tests
+  closed them. The last independent read-only review returned no findings.
+- Exit criteria: no blocking findings.
+
+## Phase 6: Docs, Contracts, And Closure
+
+- Record commands/results, commit ledger, PR URL, Admin activation, primary-Mac update/readback, accepted debt, and proof gaps here.
+- Worktree closeout: create a non-mutating closeout receipt before cleanup eligibility is considered.
+- Definition of Done: source, package, installed CLI, and paired-Mac readback agree.

docs/swe-compliance/2026-08-29-cli-rollout-reconciliation.md

@@ -0,0 +1,75 @@
+# CLI Rollout Reconciliation — SWE Compliance Record
+
+## Phase 0: Baseline And Manual Lookup
+
+- Scope: reconcile merged suite-aware CLI main `664265cdcc0a1d407d31ee1648956d717bfd7c04` with readiness head `5b884e239886d0aa833d583ae1c60f11d6d714a8` in a fresh isolated worktree without committing or publishing.
+- Worktree: `/Users/admin/RUDI/worktrees/cli/cli-rollout-reconcile-20260829`.
+- Branch: `codex/cli-rollout-reconcile-20260829`, created from live `origin/main`.
+- Merge base: `16f4c1fe12d96cc339dadd258ff6dae799e4144d`.
+- Relevant manual sections: Engineering Quick Reference, Agent Co-Pilot Operating Standard, Horizontal Engineering And Codebase Stewardship Standard, and RUDI Agentic Engineering Standard.
+- Horizontal scan: the two branches intentionally modify the same `install` and `update` ownership boundary. Reconciliation preserves one shared update flow; it does not add a third implementation or a new horizontal obligation.
+- Initial risk tier: medium, because package update/rollback and native projection behavior are user-visible and affect local package state in a later rollout.
+- Exit criteria: both lineages remain represented by `HEAD` and `MERGE_HEAD`, conflicts are resolved, version is greater than `1.10.23`, the generated bundle is current, and prescribed verification passes.
+
+## Phase 1: Scope Lock
+
+- In scope: no-commit merge reconciliation, conflict resolution, version `1.10.24`, tracked bundle regeneration, tests, build, debt scan, and dry-run package proof.
+- Non-goals: commit, push, PR, merge, tag, npm publication, CLI installation, skill synchronization, worktree cleanup, and sports/NFL changes.
+- Invariants:
+  - suite-aware `related.skills` planning and targeted native projection remain fail-closed;
+  - stack updates retain transactional snapshot, validation, registration, and rollback behavior;
+  - bare whole-inventory updates and force projections still require explicit scope;
+  - dry-run performs no package, stack-index, or native-wrapper mutation;
+  - package version increases above every currently installed/accepted CLI version.
+- Failure behavior: any update, build, validation, rollback, projection, or package verification failure blocks the later commit gate.
+- Authorized external actions: read-only fetch and local verification only.
+- Commit strategy: one later merge commit preserving first parent `664265cdcc0a1d407d31ee1648956d717bfd7c04` and second parent `5b884e239886d0aa833d583ae1c60f11d6d714a8`; committing is not authorized in this gate.
+- Horizontal disposition: no action; one update command continues to own both suite selection and transactional stack replacement.
+
+## Phase 2: Red Tests
+
+- The initial combined focused run retained both lineages' tests and exposed three semantic failures: explicit target-stack failures were being collected like `--all` or related-skill failures instead of rejecting after rollback, and suite test fixtures lacked the installed stack path required by the transactional snapshot contract.
+- Added one behavior-level reconciliation test: `runUpdate aborts related suite work when the target stack update rolls back`.
+- Red command: `pnpm test -- --test-concurrency=1 --test-name-pattern='aborts related suite work' src/__tests__/unit/update-command.test.js`.
+- Expected red result: `Missing expected rejection`, proving that the merged flow continued into related work after the requested target failed.
+- Existing tests from both accepted lineages remain the wider characterization and regression proof.
+
+## Phase 3: Implementation
+
+- Preserve the readiness branch's transactional stack snapshot/build/validation/rollback implementation.
+- Preserve main's exact package targeting, suite expansion through Registry `related.skills`, targeted host projection, truthful dry-run/JSON output, and whole-inventory safeguards.
+- Reconcile the failure boundary so a failed explicitly requested target is restored and rethrown before related work, while a later related-skill failure remains a structured partial failure and `--all` retains inventory-wide result collection.
+- Supply the real installed-stack `path` contract in suite update test fixtures; production inventory already supplies this field.
+- Resolve generated `dist/index.cjs` only by running `pnpm build`.
+- Do not add dependencies or broaden the command surface.
+
+## Phase 4: Green Tests And Refactor
+
+- Green command for the added behavior test: `pnpm test -- --test-concurrency=1 --test-name-pattern='aborts related suite work' src/__tests__/unit/update-command.test.js`; result: 1 passed, 20 skipped.
+- Focused reconciliation command: `pnpm test -- --test-concurrency=1 src/__tests__/unit/update-command.test.js src/__tests__/unit/update-stack-snapshot.test.js src/__tests__/unit/install-stack-build.test.js src/__tests__/unit/skills-sync.test.js src/__tests__/unit/install-related-skills.test.js src/__tests__/unit/command-surface-contract.test.js src/__tests__/unit/stack-runtime-detection.test.js packages/utils/src/__tests__/unit/args.test.js packages/core/src/__tests__/unit/rudi-config.test.js packages/secrets/src/__tests__/unit/secrets.test.js`; result: 134 passed, 0 failed.
+- No behavior was weakened and no dependency was added. The fresh worktree reused the existing canonical checkout's dependency store through ignored local links solely for verification; no package installation occurred.
+- Leave all reconciliation changes uncommitted pending a separate commit gate.
+
+## Phase 5: Full Verification
+
+- `pnpm test`: 715 passed, 0 failed across 566 top-level tests and 43 suites.
+- `pnpm build`: passed and regenerated the tracked bundle with `rudi v1.10.24`.
+- Generated-bundle proof: a second `pnpm build` produced the same SHA-256 values: `dist/index.cjs` `a78d7adab78cdf4c76fdf494ff242e49d0b4e8a634078a88e66bab5a5b963352`, `dist/router-mcp.js` `3c5f0d94fb4d44a8220c0331ba3b68f2918a56dfbebf0122fbdcdbdc2a6881f6`, and `dist/packages-manifest.json` `607aaf582c29aa92627e51823525fe43f38fa1db54a2874db457122771dbadc6`.
+- `node scripts/agent-debt-runner.mjs --changed-since origin/main --no-log`: passed with 0 findings.
+- Packaged `stack:swe-engineering` debt scan at warning severity: passed with 0 errors, warnings, or informational findings.
+- `npm pack --dry-run`: passed for `@learnrudi/cli@1.10.24`; the six-file payload contains `LICENSE`, `README.md`, `dist/index.cjs`, `dist/packages-manifest.json`, `dist/router-mcp.js`, and `package.json`. No tarball was written.
+- Built-artifact smoke proof: `node dist/index.cjs --version` reported `rudi v1.10.24`; `node dist/index.cjs update --help` documented exact targeting, suite expansion, projection, dry-run/JSON behavior, and the `--all` safeguard.
+- Fail-closed smoke proof: bare `node dist/index.cjs update --json` under a nonexistent isolated `RUDI_HOME` exited 1 with exactly one structured error requiring a package ID or `--all`, and did not create the isolated root.
+- Whole-inventory projection safeguard: `node dist/index.cjs skills sync codex --force --dry-run --json` under a second nonexistent isolated `RUDI_HOME` exited 1 with exactly one structured refusal requiring explicit `--all`, and did not create the isolated root.
+- Targeted skill projection and suite-aware dry-run mutation boundaries are covered by the 134-test focused command. A live installed-inventory dry-run was intentionally not used because Registry metadata may refresh, which is outside this source-only gate.
+- Independent review: a fresh-context independent agent is not authorized by this gate; perform bounded local diff review and record this as the remaining review proof gap for the commit gate.
+
+## Phase 6: Docs, Contracts, And Closure
+
+- Changed source groups: package version; stack update transaction and suite failure boundary; stack config/secret-readiness handling; install/which runtime readiness behavior; focused tests; inherited readiness compliance evidence; generated CLI bundle; this reconciliation record.
+- Accepted debt: none. Both debt gates report zero findings.
+- Review result: bounded self-review and Git hygiene checks found no unresolved entries, unstaged source changes, conflict markers, whitespace errors, unexpected paths, or lineage drift.
+- Proof gap: independent fresh-context review remains for the later commit gate because it was not authorized in this gate.
+- Publication status: local uncommitted merge only.
+- Worktree closeout receipt: deferred until the reconciliation is accepted and the receipt-writing gate is separately authorized.
+- Final verdict: verification complete; ready for a separately approved local merge-commit gate if final staged-diff and lineage checks remain clean.