feat(ri-050): bind next publication to exact-commit terminal verification (#1275)

.woodpecker/ci.yml

@@ -30,6 +30,19 @@ steps:
       # the baked pnpm store.
       - pnpm install --frozen-lockfile --prefer-offline
 
+  # ---------------------------------------------------------------------------
+  # The steps below (sanitization, upgrade-guard, typecheck, lint, format,
+  # test) are the COMPLETE mandatory verification set. SDLC-D-034 mirrors them
+  # one-for-one in the canonical terminal verification command — root
+  # `pnpm verify:release` (scripts/verify-release.mjs) — which the publish
+  # pipeline (.woodpecker/publish.yml `verify` step) runs before ANY publish
+  # effect. These lines stay direct (not routed through the runner) because the
+  # #1017 test-enumeration guard audits framework tool paths through THIS
+  # surface; scripts/verify-release.test.mjs enforces that the runner's stage
+  # table keeps matching these commands exactly, so the two cannot drift.
+  # ---------------------------------------------------------------------------
+
+  # Canonical verify:release stage `sanitization`.
   # Blocking gate: public framework package must contain no operator-specific
   # personal data or private $HOME defaults. Runs early (no node_modules needed).
   sanitization:
@@ -47,6 +60,7 @@ steps:
       # with everything it guards; this direct line keeps one instrument running.
       - bash packages/mosaic/framework/tools/quality/scripts/check-test-enumeration.sh
 
+  # Canonical verify:release stage `upgrade-guard`.
   # Blocking gate (#791): a framework upgrade must never write or delete an
   # operator-owned path. The HARD GATE proves an unanticipated operator sentinel
   # survives a keep-mode reseed byte-identical (with rsync present AND absent —
@@ -68,6 +82,8 @@ steps:
       - bash packages/mosaic/framework/tools/quality/scripts/test-upgrade-durable-snapshot.sh
       - bash packages/mosaic/framework/tools/quality/scripts/test-install-migration.sh
 
+  # Canonical verify:release stage `typecheck` — the same `pnpm typecheck`
+  # invocation (which runs the checkout preflight first, then turbo).
   typecheck:
     image: *node_image
     commands:
@@ -78,7 +94,8 @@ steps:
       - sanitization
       - upgrade-guard
 
-  # lint, format, and test are independent — run in parallel after typecheck
+  # lint, format, and test are independent — run in parallel after typecheck.
+  # Each runs exactly its canonical verify:release stage command.
   lint:
     image: *node_image
     commands:
@@ -95,6 +112,12 @@ steps:
     depends_on:
       - typecheck
 
+  # Canonical verify:release stage `test` — the `pnpm test` line below is the
+  # shared command; everything else in this step is PIPELINE-LEVEL
+  # prerequisite the canonical command expects its caller to provide (SDLC-D-034):
+  # the ci-postgres service + pg_isready wait + db:migrate (postgres path),
+  # `apk add openssl`, and the pinned pi install. None of those can move into
+  # the runner (it must also work locally on the PGlite path with no database).
   test:
     image: *node_image
     environment:

.woodpecker/publish.yml

@@ -1,5 +1,19 @@
 # Build, publish npm packages, and push Docker images
 # Runs on main for stable publishes and on next for integration-line prereleases/images
+#
+# SDLC-D-034 publish gate: every publish effect (publish-npm, publish-next-npm,
+# and every image build/push step) depends DIRECTLY on the `verify` step below.
+# `verify` (a) asserts the provider's commit identity matches the actual
+# checkout (CI_COMMIT_SHA == git rev-parse HEAD, fail closed on mismatch or
+# emptiness) and (b) runs the canonical terminal verification command
+# (`pnpm verify:release`), which mirrors the PR CI pipeline's complete
+# mandatory set (sanitization, upgrade-guard, preflight+typecheck, lint,
+# format:check, test, build) — see scripts/verify-release.mjs. A missing,
+# failed, skipped, cancelled, or inconclusive verification therefore skips the
+# dependent publish effects (fail closed). Path-filtered short-circuits may
+# skip publish EFFECTS (e.g. docs-only merges) but never bypass `verify` for a
+# publish that does run: `verify` itself carries no path filter.
+# scripts/verify-release.test.mjs enforces this DAG invariant at checkout time.
 
 variables:
   # Pre-baked CI base (see .woodpecker/ci-image.yml): node:24-alpine +
@@ -48,6 +62,45 @@ steps:
       # Resolve from the baked pnpm store instead of a cold network fetch.
       - pnpm install --frozen-lockfile --prefer-offline
 
+  # SDLC-D-034 exact-commit publish gate. No `when`/path filter on purpose: it
+  # runs for every event this pipeline serves so no publish effect can ever
+  # start without it. Fails closed on commit-identity mismatch (or either SHA
+  # being empty) and on any incomplete verification.
+  verify:
+    image: *node_image
+    commands:
+      - *enable_pnpm
+      # (a) Commit identity: the provider's claimed SHA must equal the actual
+      # checkout HEAD — verification of anything else must never authorize a
+      # publish of this commit.
+      - |
+        if [ -z "$CI_COMMIT_SHA" ]; then
+          echo "[verify] FATAL: CI_COMMIT_SHA is empty — cannot certify commit identity" >&2
+          exit 1
+        fi
+        CHECKOUT_SHA="$(git rev-parse HEAD 2>/dev/null || true)"
+        if [ -z "$CHECKOUT_SHA" ]; then
+          echo "[verify] FATAL: git rev-parse HEAD returned nothing — cannot certify commit identity" >&2
+          exit 1
+        fi
+        if [ "$CI_COMMIT_SHA" != "$CHECKOUT_SHA" ]; then
+          echo "[verify] FATAL: provider commit ($CI_COMMIT_SHA) != checkout HEAD ($CHECKOUT_SHA)" >&2
+          exit 1
+        fi
+        echo "[verify] commit identity confirmed: $CHECKOUT_SHA"
+      # (b) Canonical terminal verification. Caller-provided prerequisites the
+      # runner expects (see .woodpecker/ci.yml comments): bash/rsync for the
+      # guard stages, openssl + the pinned pi binary for the test stage. git is
+      # baked into ci-base but re-asserted here so the identity check above can
+      # never silently depend on a stale baked image. DATABASE_URL is
+      # deliberately NOT set: the canonical command must hold on the PGlite
+      # path too and never sets or requires a database itself.
+      - apk add --no-cache bash rsync openssl git
+      - npm install -g @earendil-works/[email protected]
+      - pnpm verify:release
+    depends_on:
+      - install
+
   build:
     image: *node_image
     commands:
@@ -55,6 +108,7 @@ steps:
       - pnpm build
     depends_on:
       - install
+      - verify
 
   publish-npm:
     image: *node_image
@@ -114,6 +168,7 @@ steps:
         exit 1
     depends_on:
       - build
+      - verify
 
   publish-next-npm:
     image: *node_image
@@ -192,6 +247,7 @@ steps:
         echo "[publish-next] @mosaicstack/mosaic@next resolves to $RESOLVED_VERSION"
     depends_on:
       - build
+      - verify
 
   # TODO: Uncomment when ready to publish to npmjs.org
   # publish-npmjs:
@@ -205,6 +261,7 @@ steps:
   #     - bash scripts/publish-npmjs.sh
   #   depends_on:
   #     - build
+  #     - verify
   #   when:
   #     - event: [tag]
 
@@ -242,6 +299,7 @@ steps:
         /kaniko/executor --context . --dockerfile docker/gateway.Dockerfile $DESTINATIONS
     depends_on:
       - build
+      - verify
 
   build-appservice:
     image: gcr.io/kaniko-project/executor:debug
@@ -268,6 +326,7 @@ steps:
         /kaniko/executor --context . --dockerfile docker/appservice.Dockerfile $DESTINATIONS
     depends_on:
       - build
+      - verify
 
   build-web:
     image: gcr.io/kaniko-project/executor:debug
@@ -294,3 +353,4 @@ steps:
         /kaniko/executor --context . --dockerfile docker/web.Dockerfile $DESTINATIONS
     depends_on:
       - build
+      - verify

package.json

@@ -9,6 +9,7 @@
     "preflight": "node scripts/preflight.mjs",
     "clean:generated": "node scripts/clean-generated.mjs",
     "typecheck": "pnpm preflight && turbo run typecheck",
+    "verify:release": "node scripts/verify-release.mjs",
     "test:checkout": "node --test scripts/*.test.mjs",
     "test": "pnpm test:checkout && turbo run test && pnpm run test:installer",
     "test:installer": "bash tools/install-next-lane.test.sh",

packages/macp/__tests__/gate-runner.test.ts

@@ -0,0 +1,253 @@
+import { mkdirSync, readFileSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { randomUUID } from 'node:crypto';
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { normalizeGate, countAIFindings, runGate, runGates } from '../src/gate-runner.js';
+
+function makeTmpDir(): string {
+  const dir = join(tmpdir(), `macp-gate-${randomUUID()}`);
+  mkdirSync(dir, { recursive: true });
+  return dir;
+}
+
+describe('normalizeGate', () => {
+  it('normalizes a string to mechanical gate', () => {
+    expect(normalizeGate('echo test')).toEqual({
+      command: 'echo test',
+      type: 'mechanical',
+      fail_on: 'blocker',
+    });
+  });
+
+  it('normalizes an object gate with defaults', () => {
+    expect(normalizeGate({ command: 'lint' })).toEqual({
+      command: 'lint',
+      type: 'mechanical',
+      fail_on: 'blocker',
+    });
+  });
+
+  it('preserves explicit type and fail_on', () => {
+    expect(normalizeGate({ command: 'review', type: 'ai-review', fail_on: 'any' })).toEqual({
+      command: 'review',
+      type: 'ai-review',
+      fail_on: 'any',
+    });
+  });
+
+  it('handles non-string/non-object input', () => {
+    expect(normalizeGate(42)).toEqual({ command: '', type: 'mechanical', fail_on: 'blocker' });
+    expect(normalizeGate(null)).toEqual({ command: '', type: 'mechanical', fail_on: 'blocker' });
+  });
+});
+
+describe('countAIFindings', () => {
+  it('returns zeros for non-object', () => {
+    expect(countAIFindings(null)).toEqual({ blockers: 0, total: 0 });
+    expect(countAIFindings('string')).toEqual({ blockers: 0, total: 0 });
+    expect(countAIFindings([])).toEqual({ blockers: 0, total: 0 });
+  });
+
+  it('counts from stats block', () => {
+    const output = { stats: { blockers: 2, should_fix: 3, suggestions: 1 } };
+    expect(countAIFindings(output)).toEqual({ blockers: 2, total: 6 });
+  });
+
+  it('counts from findings array when stats has no blockers', () => {
+    const output = {
+      stats: { blockers: 0 },
+      findings: [{ severity: 'blocker' }, { severity: 'warning' }, { severity: 'blocker' }],
+    };
+    expect(countAIFindings(output)).toEqual({ blockers: 2, total: 3 });
+  });
+
+  it('uses stats blockers over findings array when stats has blockers', () => {
+    const output = {
+      stats: { blockers: 5 },
+      findings: [{ severity: 'blocker' }, { severity: 'warning' }],
+    };
+    // stats.blockers = 5, total from stats = 5+0+0 = 5, findings not used for total since stats total is non-zero
+    expect(countAIFindings(output)).toEqual({ blockers: 5, total: 5 });
+  });
+
+  it('counts findings length as total when stats has zero total', () => {
+    const output = {
+      findings: [{ severity: 'warning' }, { severity: 'info' }],
+    };
+    expect(countAIFindings(output)).toEqual({ blockers: 0, total: 2 });
+  });
+});
+
+describe('runGate', () => {
+  let tmp: string;
+  let logPath: string;
+
+  beforeEach(() => {
+    tmp = makeTmpDir();
+    logPath = join(tmp, 'gate.log');
+  });
+
+  afterEach(() => {
+    rmSync(tmp, { recursive: true, force: true });
+  });
+
+  it('passes mechanical gate on exit 0', () => {
+    const result = runGate('echo hello', tmp, logPath, 30);
+    expect(result.passed).toBe(true);
+    expect(result.exit_code).toBe(0);
+    expect(result.type).toBe('mechanical');
+    expect(result.output).toContain('hello');
+  });
+
+  it('fails mechanical gate on non-zero exit', () => {
+    const result = runGate('exit 1', tmp, logPath, 30);
+    expect(result.passed).toBe(false);
+    expect(result.exit_code).toBe(1);
+  });
+
+  it('ci-pipeline always passes', () => {
+    const result = runGate({ command: 'anything', type: 'ci-pipeline' }, tmp, logPath, 30);
+    expect(result.passed).toBe(true);
+    expect(result.type).toBe('ci-pipeline');
+    expect(result.output).toBe('CI pipeline gate placeholder');
+  });
+
+  it('empty command passes', () => {
+    const result = runGate({ command: '' }, tmp, logPath, 30);
+    expect(result.passed).toBe(true);
+  });
+
+  it('ai-review gate parses JSON output', () => {
+    const json = JSON.stringify({ stats: { blockers: 0, should_fix: 1 } });
+    const result = runGate({ command: `echo '${json}'`, type: 'ai-review' }, tmp, logPath, 30);
+    expect(result.passed).toBe(true);
+    expect(result.blockers).toBe(0);
+    expect(result.findings).toBe(1);
+  });
+
+  it('ai-review gate fails on blockers', () => {
+    const json = JSON.stringify({ stats: { blockers: 2 } });
+    const result = runGate({ command: `echo '${json}'`, type: 'ai-review' }, tmp, logPath, 30);
+    expect(result.passed).toBe(false);
+    expect(result.blockers).toBe(2);
+  });
+
+  it('ai-review gate with fail_on=any fails on any findings', () => {
+    const json = JSON.stringify({ stats: { blockers: 0, should_fix: 1 } });
+    const result = runGate(
+      { command: `echo '${json}'`, type: 'ai-review', fail_on: 'any' },
+      tmp,
+      logPath,
+      30,
+    );
+    expect(result.passed).toBe(false);
+    expect(result.fail_on).toBe('any');
+  });
+
+  it('ai-review gate fails on invalid JSON output', () => {
+    const result = runGate({ command: 'echo "not json"', type: 'ai-review' }, tmp, logPath, 30);
+    expect(result.passed).toBe(false);
+    expect(result.parse_error).toBeDefined();
+  });
+
+  it('writes to log file', () => {
+    runGate('echo logged', tmp, logPath, 30);
+    const log = readFileSync(logPath, 'utf-8');
+    expect(log).toContain('COMMAND: echo logged');
+    expect(log).toContain('logged');
+    expect(log).toContain('EXIT:');
+  });
+});
+
+describe('runGates', () => {
+  let tmp: string;
+  let logPath: string;
+  let eventsPath: string;
+
+  beforeEach(() => {
+    tmp = makeTmpDir();
+    logPath = join(tmp, 'gates.log');
+    eventsPath = join(tmp, 'events.ndjson');
+  });
+
+  afterEach(() => {
+    rmSync(tmp, { recursive: true, force: true });
+  });
+
+  it('runs multiple gates and returns results', () => {
+    const { allPassed, gateResults } = runGates(
+      ['echo one', 'echo two'],
+      tmp,
+      logPath,
+      30,
+      eventsPath,
+      'task-1',
+    );
+    expect(allPassed).toBe(true);
+    expect(gateResults).toHaveLength(2);
+  });
+
+  it('reports failure when any gate fails', () => {
+    const { allPassed, gateResults } = runGates(
+      ['echo ok', 'exit 1'],
+      tmp,
+      logPath,
+      30,
+      eventsPath,
+      'task-2',
+    );
+    expect(allPassed).toBe(false);
+    expect(gateResults[0]!.passed).toBe(true);
+    expect(gateResults[1]!.passed).toBe(false);
+  });
+
+  it('emits events for each gate', () => {
+    runGates(['echo test'], tmp, logPath, 30, eventsPath, 'task-3');
+    const events = readFileSync(eventsPath, 'utf-8')
+      .trim()
+      .split('\n')
+      .map((l) => JSON.parse(l));
+    expect(events).toHaveLength(2); // started + passed
+    expect(events[0].event_type).toBe('rail.check.started');
+    expect(events[1].event_type).toBe('rail.check.passed');
+  });
+
+  it('skips gates with empty command (non ci-pipeline)', () => {
+    const { gateResults } = runGates(
+      [{ command: '', type: 'mechanical' }, 'echo real'],
+      tmp,
+      logPath,
+      30,
+      eventsPath,
+      'task-4',
+    );
+    expect(gateResults).toHaveLength(1);
+  });
+
+  it('does not skip ci-pipeline even with empty command', () => {
+    const { gateResults } = runGates(
+      [{ command: '', type: 'ci-pipeline' }],
+      tmp,
+      logPath,
+      30,
+      eventsPath,
+      'task-5',
+    );
+    expect(gateResults).toHaveLength(1);
+    expect(gateResults[0]!.passed).toBe(true);
+  });
+
+  it('emits failed event with correct message', () => {
+    runGates(['exit 42'], tmp, logPath, 30, eventsPath, 'task-6');
+    const events = readFileSync(eventsPath, 'utf-8')
+      .trim()
+      .split('\n')
+      .map((l) => JSON.parse(l));
+    const failEvent = events.find(
+      (e: Record<string, unknown>) => e.event_type === 'rail.check.failed',
+    );
+    expect(failEvent).toBeDefined();
+    expect(failEvent.message).toContain('Gate failed (');
+  });
+});

packages/macp/src/cli.spec.ts

@@ -1,8 +1,5 @@
-import { describe, it, expect, afterEach, beforeEach, vi } from 'vitest';
+import { describe, it, expect } from 'vitest';
 import { Command } from 'commander';
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
 import { registerMacpCommand } from './cli.js';
 
 describe('registerMacpCommand', () => {
@@ -78,162 +75,3 @@ describe('registerMacpCommand', () => {
     expect(topLevel).toContain('events');
   });
 });
-
-/**
- * RI-N2 fail-closed CLI behavior: an unimplemented capability is a failure,
- * never a success. Every stub exits nonzero with a typed message, and the
- * implemented `macp gate` mirrors the typed gate-runner states.
- */
-describe('registerMacpCommand fail-closed (RI-N2)', () => {
-  let tmpDir: string;
-
-  function buildProgram(): Command {
-    const program = new Command();
-    program.exitOverride();
-    program.configureOutput({ writeErr: () => {} });
-    registerMacpCommand(program);
-    return program;
-  }
-
-  beforeEach(() => {
-    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'macp-cli-failclosed-'));
-    process.exitCode = 0;
-  });
-
-  afterEach(() => {
-    process.exitCode = 0;
-    fs.rmSync(tmpDir, { recursive: true, force: true });
-  });
-
-  it('macp tasks list exits nonzero (unimplemented capability)', async () => {
-    const program = buildProgram();
-    await program.parseAsync(['macp', 'tasks', 'list'], { from: 'user' });
-    expect(process.exitCode).not.toBe(0);
-  });
-
-  it('macp submit exits nonzero with a typed MACP_NOT_IMPLEMENTED message', async () => {
-    const program = buildProgram();
-    const errSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
-    try {
-      await program.parseAsync(['macp', 'submit', 'spec.json'], { from: 'user' });
-      expect(process.exitCode).not.toBe(0);
-      const errText = errSpy.mock.calls.map((c) => String(c[0])).join('\n');
-      expect(errText).toContain('MACP_NOT_IMPLEMENTED');
-    } finally {
-      errSpy.mockRestore();
-    }
-  });
-
-  it('macp events tail exits nonzero (unimplemented capability)', async () => {
-    const program = buildProgram();
-    await program.parseAsync(['macp', 'events', 'tail'], { from: 'user' });
-    expect(process.exitCode).not.toBe(0);
-  });
-
-  it('macp gate runs a green inline command and exits 0', async () => {
-    const program = buildProgram();
-    await program.parseAsync(
-      [
-        'macp',
-        'gate',
-        'exit 0',
-        '--cwd',
-        tmpDir,
-        '--log',
-        path.join(tmpDir, 'g.log'),
-        '--timeout',
-        '10',
-      ],
-      { from: 'user' },
-    );
-    expect(process.exitCode).toBe(0);
-  });
-
-  it('macp gate exits nonzero on a failing command', async () => {
-    const program = buildProgram();
-    await program.parseAsync(
-      [
-        'macp',
-        'gate',
-        'exit 9',
-        '--cwd',
-        tmpDir,
-        '--log',
-        path.join(tmpDir, 'g.log'),
-        '--timeout',
-        '10',
-      ],
-      { from: 'user' },
-    );
-    expect(process.exitCode).not.toBe(0);
-  });
-
-  it('macp gate with an unimplemented ci-pipeline capability exits nonzero', async () => {
-    const program = buildProgram();
-    const specPath = path.join(tmpDir, 'gates.json');
-    fs.writeFileSync(specPath, JSON.stringify([{ type: 'ci-pipeline' }]));
-    await program.parseAsync(
-      [
-        'macp',
-        'gate',
-        specPath,
-        '--cwd',
-        tmpDir,
-        '--log',
-        path.join(tmpDir, 'g.log'),
-        '--timeout',
-        '10',
-      ],
-      { from: 'user' },
-    );
-    expect(process.exitCode).not.toBe(0);
-  });
-
-  it('macp gate --simulate completes (exit 0) but reports simulated results', async () => {
-    const program = buildProgram();
-    const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-    try {
-      await program.parseAsync(
-        [
-          'macp',
-          'gate',
-          'exit 0',
-          '--simulate',
-          '--cwd',
-          tmpDir,
-          '--log',
-          path.join(tmpDir, 'g.log'),
-          '--timeout',
-          '10',
-        ],
-        { from: 'user' },
-      );
-      // completes only because the caller explicitly asked to simulate
-      expect(process.exitCode).toBe(0);
-      const outText = logSpy.mock.calls.map((c) => String(c[0])).join('\n');
-      expect(outText).toContain('simulated');
-      expect(outText).toContain('SIMULATED');
-    } finally {
-      logSpy.mockRestore();
-    }
-  });
-
-  it('macp gate with an empty spec exits nonzero with a typed error', async () => {
-    const program = buildProgram();
-    await program.parseAsync(
-      [
-        'macp',
-        'gate',
-        '   ',
-        '--cwd',
-        tmpDir,
-        '--log',
-        path.join(tmpDir, 'g.log'),
-        '--timeout',
-        '10',
-      ],
-      { from: 'user' },
-    );
-    expect(process.exitCode).not.toBe(0);
-  });
-});

packages/macp/src/cli.ts

@@ -1,73 +1,5 @@
-import { existsSync, readFileSync } from 'node:fs';
-
 import type { Command } from 'commander';
 
-import { runGates } from './gate-runner.js';
-import { MACPCapabilityError, type MacpErrorCode } from './errors.js';
-
-/**
- * Load gates from a spec: an existing file (JSON gates array, a JSON object
- * with `quality_gates`, a JSON gate object, or one command per line) or an
- * inline command string. Fails closed with a typed capability error when the
- * spec contains no executable gate definition.
- */
-function loadGateSpec(spec: string): unknown[] {
-  if (existsSync(spec)) {
-    const raw = readFileSync(spec, 'utf-8');
-    try {
-      const parsed = JSON.parse(raw) as unknown;
-      if (Array.isArray(parsed)) {
-        if (parsed.length === 0) {
-          throw new MACPCapabilityError(
-            'MACP_NO_COMMAND',
-            'gate-spec',
-            `gate spec file '${spec}' contains an empty gates array`,
-          );
-        }
-        return parsed;
-      }
-      if (typeof parsed === 'object' && parsed !== null) {
-        const obj = parsed as Record<string, unknown>;
-        if (Array.isArray(obj['quality_gates'])) {
-          return obj['quality_gates'];
-        }
-        return [parsed];
-      }
-      throw new MACPCapabilityError(
-        'MACP_NO_COMMAND',
-        'gate-spec',
-        `gate spec file '${spec}' parsed to ${typeof parsed} — expected a gates array, a task with quality_gates, or a gate object`,
-      );
-    } catch (exc) {
-      if (exc instanceof MACPCapabilityError) throw exc;
-      // Not JSON — treat each non-empty line as a command gate.
-      const lines = raw
-        .split('\n')
-        .map((l) => l.trim())
-        .filter((l) => l.length > 0);
-      if (lines.length > 0) return lines;
-      throw new MACPCapabilityError(
-        'MACP_NO_COMMAND',
-        'gate-spec',
-        `gate spec file '${spec}' contains no gates`,
-      );
-    }
-  }
-  if (spec.trim().length > 0) return [spec];
-  throw new MACPCapabilityError('MACP_NO_COMMAND', 'gate-spec', 'gate spec is empty');
-}
-
-/** Print a typed not-implemented failure and exit nonzero (RI-N2 fail-closed). */
-function notImplemented(subcommand: string, capability: string, hint: string): void {
-  const err = new MACPCapabilityError(
-    'MACP_NOT_IMPLEMENTED',
-    capability,
-    `${subcommand} is not implemented in @mosaicstack/macp yet (${capability} capability absent) — ${hint}`,
-  );
-  console.error(`[macp] ${subcommand}: ${err.message} [${err.code}]`);
-  process.exitCode = 1;
-}
-
 /**
  * Register macp subcommands on an existing Commander program.
  * This avoids cross-package Commander version mismatches by using the
@@ -92,14 +24,15 @@ export function registerMacpCommand(parent: Command): void {
       'Filter by task type (coding|deploy|research|review|documentation|infrastructure)',
     )
     .action((opts: { status?: string; type?: string }) => {
-      // unimplemented capability — a failure, never a success (RI-N2)
+      // not yet wired — task persistence layer is not present in @mosaicstack/macp
+      console.log('[macp] tasks list: not yet wired — use macp package programmatically');
       if (opts.status) {
         console.log(`  status filter: ${opts.status}`);
       }
       if (opts.type) {
         console.log(`  type filter: ${opts.type}`);
       }
-      notImplemented('tasks list', 'task-persistence', 'use the macp package programmatically');
+      process.exitCode = 0;
     });
 
   // ─── submit ──────────────────────────────────────────────────────────────
@@ -108,11 +41,12 @@ export function registerMacpCommand(parent: Command): void {
     .command('submit <path>')
     .description('Submit a task from a JSON/YAML spec file')
     .action((specPath: string) => {
-      // unimplemented capability — a failure, never a success (RI-N2)
+      // not yet wired — task submission requires a running MACP server
+      console.log('[macp] submit: not yet wired — use macp package programmatically');
       console.log(`  spec path: ${specPath}`);
       console.log('  task id:   (unavailable — no MACP server connected)');
       console.log('  status:    (unavailable — no MACP server connected)');
-      notImplemented('submit', 'macp-server', 'use the macp package programmatically');
+      process.exitCode = 0;
     });
 
   // ─── gate ────────────────────────────────────────────────────────────────
@@ -124,58 +58,16 @@ export function registerMacpCommand(parent: Command): void {
     .option('--cwd <path>', 'Working directory for gate execution', process.cwd())
     .option('--log <path>', 'Path to write gate log output', '/tmp/macp-gate.log')
     .option('--timeout <seconds>', 'Gate timeout in seconds', '60')
-    .option(
-      '--simulate',
-      'Simulate gates instead of executing them; results are typed simulated and never satisfy a check',
-    )
-    .action(
-      (
-        spec: string,
-        opts: { failOn: string; cwd: string; log: string; timeout: string; simulate?: boolean },
-      ) => {
-        let gates: unknown[];
-        try {
-          gates = loadGateSpec(spec);
-        } catch (exc) {
-          if (exc instanceof MACPCapabilityError) {
-            console.error(`[macp] gate: ${exc.message} [${exc.code}]`);
-          } else {
-            console.error(`[macp] gate: ${String(exc)}`);
-          }
-          process.exitCode = 1;
-          return;
-        }
-
-        const timeoutSec = Number.parseInt(opts.timeout, 10) || 60;
-        const eventsPath = `${opts.log}.events.ndjson`;
-        const { state, gateResults } = runGates(
-          gates,
-          opts.cwd,
-          opts.log,
-          timeoutSec,
-          eventsPath,
-          'macp-cli-gate',
-          {
-            simulate: opts.simulate,
-          },
-        );
-
-        for (const r of gateResults) {
-          const label = r.command || r.type;
-          const reason = r.reason ? ` — ${r.reason}` : '';
-          console.log(`[macp] gate ${r.status}: ${label}${reason}`);
-        }
-        if (opts.simulate) {
-          console.log(
-            '[macp] SIMULATED run — every result is typed simulated and can never satisfy a gate, dependency, or release check',
-          );
-        }
-
-        // Simulated runs may complete (exit 0) only because the caller
-        // explicitly passed --simulate; the typed state stays 'simulated'.
-        process.exitCode = state === 'passed' || state === 'simulated' ? 0 : 1;
-      },
-    );
+    .action((spec: string, opts: { failOn: string; cwd: string; log: string; timeout: string }) => {
+      // not yet wired — gate execution requires a task context and event sink
+      console.log('[macp] gate: not yet wired — use macp package programmatically');
+      console.log(`  spec:     ${spec}`);
+      console.log(`  fail-on:  ${opts.failOn}`);
+      console.log(`  cwd:      ${opts.cwd}`);
+      console.log(`  log:      ${opts.log}`);
+      console.log(`  timeout:  ${opts.timeout}s`);
+      process.exitCode = 0;
+    });
 
   // ─── events ──────────────────────────────────────────────────────────────
 
@@ -187,16 +79,14 @@ export function registerMacpCommand(parent: Command): void {
     .option('--file <path>', 'Path to the MACP events NDJSON file')
     .option('--follow', 'Follow the file for new events (like tail -f)')
     .action((opts: { file?: string; follow?: boolean }) => {
-      // unimplemented capability — a failure, never a success (RI-N2)
+      // not yet wired — event streaming requires a live event source
+      console.log('[macp] events tail: not yet wired — use macp package programmatically');
       if (opts.file) {
         console.log(`  file:   ${opts.file}`);
       }
       if (opts.follow) {
         console.log('  mode:   follow');
       }
-      notImplemented('events tail', 'event-source', 'use the macp package programmatically');
+      process.exitCode = 0;
     });
 }
-
-// Re-export so CLI consumers can surface typed capability codes.
-export type { MacpErrorCode };

packages/macp/src/errors.ts

@@ -1,35 +0,0 @@
-/** Typed error code from the closed MACP_ERROR_CODES set. */
-export type MacpErrorCode = (typeof MACP_ERROR_CODES)[number];
-/**
- * Typed fail-closed capability errors (RI-N2, SDLC-D-035).
- *
- * MACP must fail closed when a required capability (executor, reviewer,
- * command, CI provider, human authority) is absent. These typed codes mirror
- * the Forge failure vocabulary (FORGE_NO_*) so both packages speak the same
- * language: an unimplemented capability is a failure, never a stub success.
- */
-
-/** Closed set of typed MACP capability error codes. */
-export const MACP_ERROR_CODES = [
-  'MACP_NOT_IMPLEMENTED',
-  'MACP_NO_COMMAND',
-  'MACP_NO_REVIEWER',
-  'MACP_NO_CI_PIPELINE',
-  'MACP_NO_PROVIDER',
-  'MACP_AUTHORITY_REQUIRED',
-] as const;
-
-/** Raised when a required capability is missing and execution must fail closed. */
-export class MACPCapabilityError extends Error {
-  /** Typed error code from the closed MACP_ERROR_CODES set. */
-  readonly code: MacpErrorCode;
-  /** The missing capability, e.g. `ci-provider`, `task-persistence`, `command`. */
-  readonly capability: string;
-
-  constructor(code: MacpErrorCode, capability: string, message: string) {
-    super(message);
-    this.name = 'MACPCapabilityError';
-    this.code = code;
-    this.capability = capability;
-  }
-}

packages/macp/src/gate-runner.spec.ts

@@ -1,429 +0,0 @@
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-
-import { countAIFindings, normalizeGate, runGate, runGates } from './gate-runner.js';
-
-function makeTmpDir(): string {
-  return fs.mkdtempSync(path.join(os.tmpdir(), 'macp-gate-'));
-}
-
-describe('normalizeGate', () => {
-  it('normalizes a string to mechanical gate', () => {
-    expect(normalizeGate('echo test')).toEqual({
-      command: 'echo test',
-      type: 'mechanical',
-      fail_on: 'blocker',
-    });
-  });
-
-  it('normalizes an object gate with defaults', () => {
-    expect(normalizeGate({ command: 'lint' })).toEqual({
-      command: 'lint',
-      type: 'mechanical',
-      fail_on: 'blocker',
-    });
-  });
-
-  it('preserves explicit type and fail_on', () => {
-    expect(normalizeGate({ command: 'review', type: 'ai-review', fail_on: 'any' })).toEqual({
-      command: 'review',
-      type: 'ai-review',
-      fail_on: 'any',
-    });
-  });
-
-  it('handles non-string/non-object input', () => {
-    expect(normalizeGate(42)).toEqual({ command: '', type: 'mechanical', fail_on: 'blocker' });
-    expect(normalizeGate(null)).toEqual({ command: '', type: 'mechanical', fail_on: 'blocker' });
-  });
-});
-
-describe('countAIFindings', () => {
-  it('returns zeros for non-object', () => {
-    expect(countAIFindings(null)).toEqual({ blockers: 0, total: 0 });
-    expect(countAIFindings('string')).toEqual({ blockers: 0, total: 0 });
-    expect(countAIFindings([])).toEqual({ blockers: 0, total: 0 });
-  });
-
-  it('counts from stats block', () => {
-    const output = { stats: { blockers: 2, should_fix: 3, suggestions: 1 } };
-    expect(countAIFindings(output)).toEqual({ blockers: 2, total: 6 });
-  });
-
-  it('counts from findings array when stats has no blockers', () => {
-    const output = {
-      stats: { blockers: 0 },
-      findings: [{ severity: 'blocker' }, { severity: 'warning' }, { severity: 'blocker' }],
-    };
-    expect(countAIFindings(output)).toEqual({ blockers: 2, total: 3 });
-  });
-
-  it('uses stats blockers over findings array when stats has blockers', () => {
-    const output = {
-      stats: { blockers: 5 },
-      findings: [{ severity: 'blocker' }, { severity: 'warning' }],
-    };
-    // stats.blockers = 5, total from stats = 5+0+0 = 5, findings not used for total since stats total is non-zero
-    expect(countAIFindings(output)).toEqual({ blockers: 5, total: 5 });
-  });
-
-  it('counts findings length as total when stats has zero total', () => {
-    const output = {
-      findings: [{ severity: 'warning' }, { severity: 'info' }],
-    };
-    expect(countAIFindings(output)).toEqual({ blockers: 0, total: 2 });
-  });
-});
-
-describe('runGate', () => {
-  let tmp: string;
-  let logPath: string;
-
-  beforeEach(() => {
-    tmp = makeTmpDir();
-    logPath = path.join(tmp, 'gate.log');
-  });
-
-  afterEach(() => {
-    fs.rmSync(tmp, { recursive: true, force: true });
-  });
-
-  it('passes mechanical gate on exit 0', () => {
-    const result = runGate('echo hello', tmp, logPath, 30);
-    expect(result.passed).toBe(true);
-    expect(result.exit_code).toBe(0);
-    expect(result.type).toBe('mechanical');
-    expect(result.output).toContain('hello');
-  });
-
-  it('fails mechanical gate on non-zero exit', () => {
-    const result = runGate('exit 1', tmp, logPath, 30);
-    expect(result.passed).toBe(false);
-    expect(result.exit_code).toBe(1);
-  });
-
-  it('ci-pipeline fails closed without a CI provider (no placeholder pass)', () => {
-    const result = runGate({ command: 'anything', type: 'ci-pipeline' }, tmp, logPath, 30);
-    expect(result.passed).toBe(false);
-    expect(result.status).toBe('capability_failure');
-    expect(result.capability_code).toBe('MACP_NO_CI_PIPELINE');
-    expect(result.type).toBe('ci-pipeline');
-    expect(result.output).not.toBe('CI pipeline gate placeholder');
-  });
-
-  it('empty command is a typed capability failure, never a pass', () => {
-    const result = runGate({ command: '' }, tmp, logPath, 30);
-    expect(result.passed).toBe(false);
-    expect(result.status).toBe('capability_failure');
-    expect(result.capability_code).toBe('MACP_NO_COMMAND');
-  });
-
-  it('ai-review gate parses JSON output', () => {
-    const json = JSON.stringify({ stats: { blockers: 0, should_fix: 1 } });
-    const result = runGate({ command: `echo '${json}'`, type: 'ai-review' }, tmp, logPath, 30);
-    expect(result.passed).toBe(true);
-    expect(result.blockers).toBe(0);
-    expect(result.findings).toBe(1);
-  });
-
-  it('ai-review gate fails on blockers', () => {
-    const json = JSON.stringify({ stats: { blockers: 2 } });
-    const result = runGate({ command: `echo '${json}'`, type: 'ai-review' }, tmp, logPath, 30);
-    expect(result.passed).toBe(false);
-    expect(result.blockers).toBe(2);
-  });
-
-  it('ai-review gate with fail_on=any fails on any findings', () => {
-    const json = JSON.stringify({ stats: { blockers: 0, should_fix: 1 } });
-    const result = runGate(
-      { command: `echo '${json}'`, type: 'ai-review', fail_on: 'any' },
-      tmp,
-      logPath,
-      30,
-    );
-    expect(result.passed).toBe(false);
-    expect(result.fail_on).toBe('any');
-  });
-
-  it('ai-review gate fails on invalid JSON output', () => {
-    const result = runGate({ command: 'echo "not json"', type: 'ai-review' }, tmp, logPath, 30);
-    expect(result.passed).toBe(false);
-    expect(result.parse_error).toBeDefined();
-  });
-
-  it('writes to log file', () => {
-    runGate('echo logged', tmp, logPath, 30);
-    const log = fs.readFileSync(logPath, 'utf-8');
-    expect(log).toContain('COMMAND: echo logged');
-    expect(log).toContain('logged');
-    expect(log).toContain('EXIT:');
-  });
-});
-
-describe('runGates', () => {
-  let tmp: string;
-  let logPath: string;
-  let eventsPath: string;
-
-  beforeEach(() => {
-    tmp = makeTmpDir();
-    logPath = path.join(tmp, 'gates.log');
-    eventsPath = path.join(tmp, 'events.ndjson');
-  });
-
-  afterEach(() => {
-    fs.rmSync(tmp, { recursive: true, force: true });
-  });
-
-  it('runs multiple gates and returns results', () => {
-    const { allPassed, gateResults } = runGates(
-      ['echo one', 'echo two'],
-      tmp,
-      logPath,
-      30,
-      eventsPath,
-      'task-1',
-    );
-    expect(allPassed).toBe(true);
-    expect(gateResults).toHaveLength(2);
-  });
-
-  it('reports failure when any gate fails', () => {
-    const { allPassed, gateResults } = runGates(
-      ['echo ok', 'exit 1'],
-      tmp,
-      logPath,
-      30,
-      eventsPath,
-      'task-2',
-    );
-    expect(allPassed).toBe(false);
-    expect(gateResults[0]!.passed).toBe(true);
-    expect(gateResults[1]!.passed).toBe(false);
-  });
-
-  it('emits events for each gate', () => {
-    runGates(['echo test'], tmp, logPath, 30, eventsPath, 'task-3');
-    const events = fs
-      .readFileSync(eventsPath, 'utf-8')
-      .trim()
-      .split('\n')
-      .map((l) => JSON.parse(l));
-    expect(events).toHaveLength(2); // started + passed
-    expect(events[0].event_type).toBe('rail.check.started');
-    expect(events[1].event_type).toBe('rail.check.passed');
-  });
-
-  it('does not silently skip gates with empty command — they become capability failures', () => {
-    const { gateResults, allPassed, state } = runGates(
-      [{ command: '', type: 'mechanical' }, 'echo real'],
-      tmp,
-      logPath,
-      30,
-      eventsPath,
-      'task-4',
-    );
-    expect(gateResults).toHaveLength(2);
-    expect(gateResults[0]!.status).toBe('capability_failure');
-    expect(gateResults[1]!.status).toBe('passed');
-    expect(allPassed).toBe(false);
-    expect(state).toBe('capability_failure');
-  });
-
-  it('does not skip ci-pipeline even with empty command — typed capability failure', () => {
-    const { gateResults, allPassed, state } = runGates(
-      [{ command: '', type: 'ci-pipeline' }],
-      tmp,
-      logPath,
-      30,
-      eventsPath,
-      'task-5',
-    );
-    expect(gateResults).toHaveLength(1);
-    expect(gateResults[0]!.passed).toBe(false);
-    expect(gateResults[0]!.status).toBe('capability_failure');
-    expect(allPassed).toBe(false);
-    expect(state).toBe('capability_failure');
-  });
-
-  it('emits failed event with correct message', () => {
-    runGates(['exit 42'], tmp, logPath, 30, eventsPath, 'task-6');
-    const events = fs
-      .readFileSync(eventsPath, 'utf-8')
-      .trim()
-      .split('\n')
-      .map((l) => JSON.parse(l));
-    const failEvent = events.find(
-      (e: Record<string, unknown>) => e.event_type === 'rail.check.failed',
-    );
-    expect(failEvent).toBeDefined();
-    expect(failEvent.message).toContain('Gate failed (');
-  });
-});
-
-/**
- * RI-N2 / SDLC-D-035 fail-closed controls for the MACP gate runner.
- *
- * Invariant under test: `passed: true` occurs ONLY when a gate really executed
- * and really exited green (`status === 'passed'`). Absent capabilities,
- * manual sign-offs, and simulated runs are typed distinctly and can never
- * make the aggregate `passed`.
- */
-describe('gate-runner fail-closed (RI-N2)', () => {
-  let tmpDir: string;
-  let logPath: string;
-  let eventsPath: string;
-
-  beforeEach(() => {
-    tmpDir = makeTmpDir();
-    logPath = path.join(tmpDir, 'gate.log');
-    eventsPath = path.join(tmpDir, 'events.ndjson');
-  });
-
-  afterEach(() => {
-    fs.rmSync(tmpDir, { recursive: true, force: true });
-  });
-
-  function run(gates: unknown[], options?: { simulate?: boolean }) {
-    return runGates(gates, tmpDir, logPath, 10, eventsPath, 'spec-task', options);
-  }
-
-  // ─── positive controls ───────────────────────────────────────────────────
-
-  it('a really-executed green command gate still passes', () => {
-    const result = run([{ command: 'exit 0', type: 'mechanical' }]);
-    expect(result.gateResults[0]!.status).toBe('passed');
-    expect(result.gateResults[0]!.passed).toBe(true);
-    expect(result.allPassed).toBe(true);
-    expect(result.state).toBe('passed');
-  });
-
-  it('explicit simulate completes and types every result simulated', () => {
-    const result = run([{ command: 'exit 0', type: 'mechanical' }, 'echo hello'], {
-      simulate: true,
-    });
-    expect(result.gateResults).toHaveLength(2);
-    for (const gate of result.gateResults) {
-      expect(gate.status).toBe('simulated');
-      expect(gate.passed).toBe(false);
-    }
-    expect(result.state).toBe('simulated');
-  });
-
-  it('a really-executed red command gate fails with typed status failed', () => {
-    const result = run([{ command: 'exit 3', type: 'mechanical' }]);
-    expect(result.gateResults[0]!.status).toBe('failed');
-    expect(result.gateResults[0]!.passed).toBe(false);
-    expect(result.allPassed).toBe(false);
-    expect(result.state).toBe('failed');
-  });
-
-  // ─── negative controls — each asserts typed status AND aggregate not passed ──
-
-  it('an empty-command gate is a capability_failure, not skipped and not passed', () => {
-    const result = run([{ command: '', type: 'mechanical' }]);
-    // runGates must not silently skip it — it produces a typed result
-    expect(result.gateResults).toHaveLength(1);
-    const gate = result.gateResults[0]!;
-    expect(gate.status).toBe('capability_failure');
-    expect(gate.capability_code).toBe('MACP_NO_COMMAND');
-    expect(gate.passed).toBe(false);
-    // aggregate is not passed
-    expect(result.allPassed).toBe(false);
-    expect(result.state).toBe('capability_failure');
-    expect(result.state).not.toBe('passed');
-  });
-
-  it('a commandless ai-review gate is a typed MACP_NO_REVIEWER capability_failure', () => {
-    const result = run([{ command: '', type: 'ai-review' }]);
-    expect(result.gateResults[0]!.status).toBe('capability_failure');
-    expect(result.gateResults[0]!.capability_code).toBe('MACP_NO_REVIEWER');
-    expect(result.allPassed).toBe(false);
-    expect(result.state).not.toBe('passed');
-  });
-
-  it('a ci-pipeline gate without a provider implementation is a capability_failure, never a placeholder pass', () => {
-    const result = run([{ command: '', type: 'ci-pipeline' }]);
-    const gate = result.gateResults[0]!;
-    expect(gate.status).toBe('capability_failure');
-    expect(gate.capability_code).toBe('MACP_NO_CI_PIPELINE');
-    expect(gate.passed).toBe(false);
-    // the old false-success placeholder must be gone
-    expect(gate.output).not.toBe('CI pipeline gate placeholder');
-    expect(result.allPassed).toBe(false);
-    expect(result.state).not.toBe('passed');
-  });
-
-  it('a ci-pipeline gate fails closed even alongside an otherwise green run', () => {
-    const result = run(['exit 0', { type: 'ci-pipeline', command: 'fake-ci' }]);
-    expect(result.gateResults[1]!.status).toBe('capability_failure');
-    expect(result.gateResults[0]!.status).toBe('passed');
-    expect(result.allPassed).toBe(false);
-    expect(result.state).toBe('capability_failure');
-  });
-
-  it('a manual gate with no automation enters typed waiting — neither pass nor fail', () => {
-    const result = run([{ type: 'manual' }]);
-    const gate = result.gateResults[0]!;
-    expect(gate.status).toBe('waiting');
-    expect(gate.passed).toBe(false);
-    expect(gate.exit_code).toBe(0);
-    // aggregate is not passed while any gate is waiting
-    expect(result.allPassed).toBe(false);
-    expect(result.state).toBe('waiting');
-    expect(result.state).not.toBe('passed');
-  });
-
-  it('a simulated result can never make the aggregate passed', () => {
-    const result = run(['exit 0', 'exit 0'], { simulate: true });
-    expect(result.gateResults.every((g) => g.status === 'simulated')).toBe(true);
-    expect(result.allPassed).toBe(false);
-    expect(result.state).toBe('simulated');
-    expect(result.state).not.toBe('passed');
-  });
-
-  it('waiting dominates an otherwise green aggregate', () => {
-    const result = run(['exit 0', { type: 'manual' }]);
-    expect(result.allPassed).toBe(false);
-    expect(result.state).toBe('waiting');
-  });
-});
-
-describe('runGate fail-closed (RI-N2)', () => {
-  let tmpDir: string;
-  let logPath: string;
-
-  beforeEach(() => {
-    tmpDir = makeTmpDir();
-    logPath = path.join(tmpDir, 'gate.log');
-  });
-
-  afterEach(() => {
-    fs.rmSync(tmpDir, { recursive: true, force: true });
-  });
-
-  it('simulate: true returns a typed simulated result without executing', () => {
-    const result = runGate('this-command-does-not-exist-xyz', tmpDir, logPath, 10, {
-      simulate: true,
-    });
-    expect(result.status).toBe('simulated');
-    expect(result.passed).toBe(false);
-    expect(result.exit_code).toBe(0);
-  });
-
-  it('normal mode executes for real and types a green gate passed', () => {
-    const result = runGate('echo ok', tmpDir, logPath, 10);
-    expect(result.status).toBe('passed');
-    expect(result.passed).toBe(true);
-    expect(result.output).toContain('ok');
-  });
-
-  it('a bare string gate normalizes to mechanical and executes', () => {
-    const result = runGate('exit 7', tmpDir, logPath, 10);
-    expect(result.type).toBe('mechanical');
-    expect(result.status).toBe('failed');
-    expect(result.passed).toBe(false);
-  });
-});

packages/macp/src/gate-runner.ts

@@ -4,20 +4,7 @@ import { dirname } from 'node:path';
 
 import { emitEvent } from './event-emitter.js';
 import { nowISO } from './event-emitter.js';
-import type { GateResult, GateStatus, RunGatesResult } from './types.js';
-
-/** Typed reason stamped on every simulated gate result. */
-export const SIMULATED_GATE_REASON =
-  'simulated execution (explicit simulate opt-in): gate was not evaluated by a real implementation';
-
-/** Options for gate execution (RI-N2 fail-closed / explicit simulation). */
-export interface RunGateOptions {
-  /**
-   * Explicit caller opt-in to simulation. Simulated gates are NOT executed;
-   * every result is typed `simulated` and never satisfies anything.
-   */
-  simulate?: boolean;
-}
+import type { GateResult } from './types.js';
 
 export interface NormalizedGate {
   command: string;
@@ -116,91 +103,36 @@ export function countAIFindings(parsedOutput: unknown): { blockers: number; tota
   return { blockers, total };
 }
 
-function simulatedResult(gateEntry: NormalizedGate): GateResult {
-  return {
-    command: gateEntry.command,
-    exit_code: 0,
-    type: gateEntry.type,
-    output: SIMULATED_GATE_REASON,
-    timed_out: false,
-    passed: false,
-    status: 'simulated',
-    reason: SIMULATED_GATE_REASON,
-  };
-}
-
-function capabilityFailureResult(
-  gateEntry: NormalizedGate,
-  code: GateResult['capability_code'],
-  reason: string,
-): GateResult {
-  return {
-    command: gateEntry.command,
-    exit_code: 1,
-    type: gateEntry.type,
-    output: '',
-    timed_out: false,
-    passed: false,
-    status: 'capability_failure',
-    capability_code: code,
-    reason,
-  };
-}
-
-function waitingResult(gateEntry: NormalizedGate, reason: string): GateResult {
-  return {
-    command: gateEntry.command,
-    exit_code: 0,
-    type: gateEntry.type,
-    output: '',
-    timed_out: false,
-    passed: false,
-    status: 'waiting',
-    capability_code: 'MACP_AUTHORITY_REQUIRED',
-    reason,
-  };
-}
-
 export function runGate(
   gate: unknown,
   cwd: string,
   logPath: string,
   timeoutSec: number,
-  options: RunGateOptions = {},
 ): GateResult {
   const gateEntry = normalizeGate(gate);
   const gateType = gateEntry.type;
   const command = gateEntry.command;
 
-  // Explicit simulation only: never executes, typed simulated, never satisfying.
-  if (options.simulate) {
-    return simulatedResult(gateEntry);
-  }
-
-  // Fail closed: no CI provider implementation exists in @mosaicstack/macp,
-  // so a ci-pipeline gate is an absent capability — never a placeholder pass.
   if (gateType === 'ci-pipeline') {
-    return capabilityFailureResult(
-      gateEntry,
-      'MACP_NO_CI_PIPELINE',
-      `ci-pipeline gate '${gateEntry.command || gateType}' has no CI provider implementation wired — refusing placeholder pass`,
-    );
+    return {
+      command,
+      exit_code: 0,
+      type: gateType,
+      output: 'CI pipeline gate placeholder',
+      timed_out: false,
+      passed: true,
+    };
   }
 
   if (!command) {
-    // A manual gate with no automation waits for human sign-off: not pass, not fail.
-    if (gateType === 'manual') {
-      return waitingResult(
-        gateEntry,
-        `manual gate has no automation — waiting for human sign-off (type: ${gateType})`,
-      );
-    }
-    // Any other commandless gate is an absent capability — never a vacuous pass.
-    return capabilityFailureResult(
-      gateEntry,
-      gateType === 'ai-review' ? 'MACP_NO_REVIEWER' : 'MACP_NO_COMMAND',
-      `gate of type '${gateType}' has no command to execute — refusing empty-command pass`,
-    );
+    return {
+      command: '',
+      exit_code: 0,
+      type: gateType,
+      output: '',
+      timed_out: false,
+      passed: true,
+    };
   }
 
   const { exitCode, output, timedOut } = runShell(command, cwd, logPath, timeoutSec);
@@ -211,12 +143,10 @@ export function runGate(
     output,
     timed_out: timedOut,
     passed: false,
-    status: 'failed',
   };
 
   if (gateType !== 'ai-review') {
     result.passed = exitCode === 0;
-    result.status = result.passed ? 'passed' : 'failed';
     return result;
   }
 
@@ -240,7 +170,6 @@ export function runGate(
   } else {
     result.passed = exitCode === 0 && blockers === 0 && !timedOut && parseError === undefined;
   }
-  result.status = result.passed ? 'passed' : 'failed';
 
   result.fail_on = failOn;
   result.blockers = blockers;
@@ -262,19 +191,16 @@ export function runGates(
   timeoutSec: number,
   eventsPath: string,
   taskId: string,
-  options: RunGateOptions = {},
-): RunGatesResult {
+): { allPassed: boolean; gateResults: GateResult[] } {
+  let allPassed = true;
   const gateResults: GateResult[] = [];
-  let hasCapabilityFailure = false;
-  let hasSimulated = false;
-  let hasFailed = false;
-  let hasWaiting = false;
 
   for (const gate of gates) {
     const gateEntry = normalizeGate(gate);
     const gateCmd = gateEntry.command;
+    if (!gateCmd && gateEntry.type !== 'ci-pipeline') continue;
+
     const label = gateCmd || gateEntry.type;
-    // NOTE: no silent skip — every gate produces a typed result (RI-N2).
     emitEvent(
       eventsPath,
       'rail.check.started',
@@ -283,10 +209,10 @@ export function runGates(
       'quality-gate',
       `Running gate: ${label}`,
     );
-    const result = runGate(gate, cwd, logPath, timeoutSec, options);
+    const result = runGate(gate, cwd, logPath, timeoutSec);
     gateResults.push(result);
 
-    if (result.status === 'passed') {
+    if (result.passed) {
       emitEvent(
         eventsPath,
         'rail.check.passed',
@@ -298,46 +224,7 @@ export function runGates(
       continue;
     }
 
-    if (result.status === 'waiting') {
-      hasWaiting = true;
-      emitEvent(
-        eventsPath,
-        'rail.check.waiting',
-        taskId,
-        'gated',
-        'quality-gate',
-        `Gate waiting: ${label} — ${result.reason ?? 'manual gate awaits sign-off'}`,
-      );
-      continue;
-    }
-
-    if (result.status === 'simulated') {
-      hasSimulated = true;
-      emitEvent(
-        eventsPath,
-        'rail.check.simulated',
-        taskId,
-        'gated',
-        'quality-gate',
-        `Gate simulated (non-satisfying): ${label}`,
-      );
-      continue;
-    }
-
-    if (result.status === 'capability_failure') {
-      hasCapabilityFailure = true;
-      emitEvent(
-        eventsPath,
-        'rail.check.failed',
-        taskId,
-        'gated',
-        'quality-gate',
-        `Gate capability failure (${result.capability_code ?? 'MACP_NO_PROVIDER'}): ${label} — ${result.reason ?? 'required capability is absent'}`,
-      );
-      continue;
-    }
-
-    hasFailed = true;
+    allPassed = false;
     let message: string;
     if (result.timed_out) {
       message = `Gate timed out after ${timeoutSec}s: ${label}`;
@@ -349,15 +236,5 @@ export function runGates(
     emitEvent(eventsPath, 'rail.check.failed', taskId, 'gated', 'quality-gate', message);
   }
 
-  const state: GateStatus = hasCapabilityFailure
-    ? 'capability_failure'
-    : hasSimulated
-      ? 'simulated'
-      : hasFailed
-        ? 'failed'
-        : hasWaiting
-          ? 'waiting'
-          : 'passed';
-
-  return { allPassed: state === 'passed', gateResults, state };
+  return { allPassed, gateResults };
 }

packages/macp/src/index.ts

@@ -6,13 +6,11 @@ export type {
   DependsOnPolicy,
   GateType,
   GateFailOn,
-  GateStatus,
   GateEntry,
   Task,
   EventType,
   MACPEvent,
   GateResult,
-  RunGatesResult,
   TaskResult,
   ProviderMeta,
   ProviderRegistry,
@@ -20,11 +18,6 @@ export type {
 
 export { CredentialError } from './types.js';
 
-// Typed fail-closed capability errors (RI-N2, SDLC-D-035)
-export { MACP_ERROR_CODES, MACPCapabilityError } from './errors.js';
-
-export type { MacpErrorCode } from './errors.js';
-
 // Credential resolver
 export {
   DEFAULT_CREDENTIALS_DIR,
@@ -42,16 +35,9 @@ export {
 export type { ResolveCredentialsOptions } from './credential-resolver.js';
 
 // Gate runner
-export {
-  normalizeGate,
-  runShell,
-  countAIFindings,
-  runGate,
-  runGates,
-  SIMULATED_GATE_REASON,
-} from './gate-runner.js';
+export { normalizeGate, runShell, countAIFindings, runGate, runGates } from './gate-runner.js';
 
-export type { NormalizedGate, RunGateOptions } from './gate-runner.js';
+export type { NormalizedGate } from './gate-runner.js';
 
 // Risk-floor (agent reflection loop — diff review classifier)
 export { evaluateRiskFloor, DEFAULT_RISK_THRESHOLD } from './risk-floor.js';

packages/macp/src/types.ts

@@ -1,5 +1,3 @@
-import type { MacpErrorCode } from './errors.js';
-
 /** Task status values. */
 export type TaskStatus = 'pending' | 'running' | 'gated' | 'completed' | 'failed' | 'escalated';
 
@@ -19,17 +17,7 @@ export type DispatchMode = 'yolo' | 'acp' | 'exec';
 export type DependsOnPolicy = 'all' | 'any' | 'all_terminal';
 
 /** Quality gate type. */
-export type GateType = 'mechanical' | 'ai-review' | 'ci-pipeline' | 'manual';
-
-/**
- * Typed execution state of a gate — closed set (RI-N2, SDLC-D-035).
- *
- * Only `passed` means "really executed and green". `simulated` is produced
- * exclusively under an explicit simulate opt-in and never satisfies anything.
- * `capability_failure` means a required executor/provider/command was absent.
- * `waiting` means a manual gate awaits human sign-off (neither pass nor fail).
- */
-export type GateStatus = 'passed' | 'failed' | 'simulated' | 'waiting' | 'capability_failure';
+export type GateType = 'mechanical' | 'ai-review' | 'ci-pipeline';
 
 /** Gate fail_on mode. */
 export type GateFailOn = 'blocker' | 'any';
@@ -79,9 +67,7 @@ export type EventType =
   | 'task.retry.scheduled'
   | 'rail.check.started'
   | 'rail.check.passed'
-  | 'rail.check.failed'
-  | 'rail.check.waiting'
-  | 'rail.check.simulated';
+  | 'rail.check.failed';
 
 /** Structured event record. */
 export interface MACPEvent {
@@ -102,14 +88,7 @@ export interface GateResult {
   type: string;
   output: string;
   timed_out: boolean;
-  /** Back-compat boolean view — true ONLY when `status === 'passed'`. */
   passed: boolean;
-  /** Typed discriminator — the authoritative gate outcome (RI-N2). */
-  status: GateStatus;
-  /** Typed capability error code, set when `status === 'capability_failure'`. */
-  capability_code?: MacpErrorCode;
-  /** Why a non-executed state (simulated/waiting/capability_failure) was reached. */
-  reason?: string;
   fail_on?: string;
   blockers?: number;
   findings?: number;
@@ -117,22 +96,6 @@ export interface GateResult {
   parse_error?: string;
 }
 
-/**
- * Aggregate outcome of `runGates` (RI-N2).
- *
- * `state` is the typed aggregate: it is `passed` only when every gate really
- * executed green. A `simulated` result makes the aggregate `simulated` (never
- * `passed`); a `waiting` manual gate keeps the aggregate `waiting`; a missing
- * capability makes it `capability_failure`. `allPassed` is exactly
- * `state === 'passed'`, so a simulated or waiting result can never satisfy a
- * dependency, acceptance criterion, gate, merge, or release check.
- */
-export interface RunGatesResult {
-  allPassed: boolean;
-  gateResults: GateResult[];
-  state: GateStatus;
-}
-
 /** Result from a completed task. */
 export interface TaskResult {
   task_id: string;

packages/mosaic/framework/tools/quality/test-enumeration-exclusions.txt

@@ -39,20 +39,3 @@ packages/mosaic/framework/tools/tmux/test-send-message-verdict.sh | requires rea
 # recorded judgement. These lines ARE that judgement, signed.)
 packages/mosaic/framework/tools/orchestrator/smoke-test.sh | behavior smoke checks for coord continue/run workflows, run manually by orchestrator seats; unmeasured in CI; #1017 burndown
 packages/mosaic/framework/tools/wake/validate-973/microtest-wake-assert.sh | #973 instrument self-test, run as a precondition of the validate-973 evidence procedure rather than as a standing CI suite; #1017 burndown candidate
-
-# --- tools/fleet: precondition is unsatisfiable in the CI image (#1271) ---
-# Signed by fred (sb-it-1-dt, 2026-08-16) at origin/next 476db12.
-# This suite asserts the launcher's behaviour when `mosaic` and `pi` are MISSING.
-# It shims fakes into $FAKE_BIN, but the constructed PANE_PATH always ends in the
-# real system path, so on a host that installs those binaries the missing-binary
-# cases cannot be measured at all. The suite's own guard (line 103) says so and
-# fails rather than reporting a pass it cannot back. That guard is correct.
-# The error was wiring the suite into CI: #1017 (c56483eb) enumerated it and
-# dropped this exclusion, and the CI image provides `pi` in the system path, so
-# it has failed on every pipeline since. Measured 2026-08-16 across pipelines
-# 2444 (#1256), 2438 (#1240) and 2441 (#1017-quality): exactly one FAIL line in
-# each full log, identical, this assertion; control `zzz-not-present-zzz` -> 0.
-# Burn-down and the full measurement are tracked in #1271; unwired by PR #1270.
-# Because test:framework-shell is one && chain and this sat at position 44 of 48,
-# the four suites after it had not run at all since the merge.
-packages/mosaic/framework/tools/fleet/test-start-agent-session.sh | precondition unsatisfiable in the CI image: asserts missing-binary behaviour, but PANE_PATH always ends in the system path and the image provides `pi` there; guard at line 103 fails by design rather than passing unmeasured. Burn down by controlling the tail of PANE_PATH inside the test. NOT by removing `pi` from the image: the CI image installs @earendil-works/[email protected] deliberately (measured in pipeline 2444's test-step log), and other suites depend on that pin. Burn-down tracked in #1271

packages/mosaic/package.json

@@ -25,7 +25,7 @@
     "lint": "eslint src",
     "typecheck": "tsc --noEmit",
     "test": "vitest run --passWithNoTests && pnpm run test:framework-shell",
-    "test:framework-shell": "bash framework/tools/quality/scripts/check-test-enumeration.sh && bash framework/tools/quality/scripts/test-check-test-enumeration.sh && python3 src/lease-broker/daemon_deadline_unittest.py && python3 src/lease-broker/normative_fragments_unittest.py && python3 src/lease-broker/promotion_binding_unittest.py && python3 src/lease-broker/promotion_trigger_unittest.py && python3 src/lease-broker/receipt_challenge_unittest.py && python3 src/lease-broker/context_recovery_unittest.py && python3 src/lease-broker/recovery_runtime_unittest.py && python3 src/lease-broker/recovery_b1_adversarial_unittest.py && python3 src/lease-broker/receipt_observer_client_unittest.py && python3 src/lease-broker/invariant_r_unittest.py && python3 src/lease-broker/framework_skill_portability_unittest.py && python3 src/mutator-gate/runtime_tools_unittest.py && python3 src/mutator-gate/runtime_launch_guard_unittest.py && python3 src/mutator-gate/version_coupling_unittest.py && python3 framework/tools/lease-broker/check-runtime-launches.py --root ../.. && bash framework/tools/codex/test-pr-diff-context.sh && bash framework/tools/qa/test-deps-preflight.sh && bash framework/tools/git/test-pr-review-gitea-comment.sh && bash framework/tools/git/test-pr-review-repo-host-override.sh && bash framework/tools/git/test-ci-queue-wait-branch-absent.sh && bash framework/tools/git/test-ci-queue-wait-tristate.sh && bash framework/tools/git/test-ci-queue-wait-github-checks.sh && bash framework/tools/git/test-pr-merge-queue-branch.sh && bash framework/tools/git/test-pr-merge-head-pin.sh && bash framework/tools/git/test-pr-merge-message-field.sh && bash framework/tools/git/test-git-credential-mosaic.sh && bash framework/tools/git/test-gitea-token-identity.sh && bash framework/tools/woodpecker/test-terminal-green-contract.sh && bash framework/tools/_scripts/test-install-ordering-guard.sh && bash framework/tools/_scripts/test-mosaic-init-rce.sh && bash framework/tools/tmux/agent-send.test.sh && bash framework/tools/wake/test-wake-store-ack.sh && bash framework/tools/wake/test-wake-store-enqueue-race.sh && bash framework/tools/wake/test-wake-digest-hmac.sh && bash framework/tools/wake/test-wake-digest-quarantine.sh && bash framework/tools/wake/test-wake-detector.sh && bash framework/tools/wake/test-wake-fn-oracle.sh && bash framework/tools/wake/test-wake-reconcile.sh && bash framework/tools/wake/test-wake-beacon.sh && bash framework/tools/wake/test-wake-preimage.sh && bash framework/tools/wake/test-wake-install.sh && bash framework/tools/glpi/test-list-http-status.sh && bash framework/tools/orchestrator/test-board-roll.sh && bash framework/tools/woodpecker/test-ci-wait-exit-matrix.sh && bash framework/tools/_scripts/test-fleet-transport-check.sh"
+    "test:framework-shell": "bash framework/tools/quality/scripts/check-test-enumeration.sh && bash framework/tools/quality/scripts/test-check-test-enumeration.sh && python3 src/lease-broker/daemon_deadline_unittest.py && python3 src/lease-broker/normative_fragments_unittest.py && python3 src/lease-broker/promotion_binding_unittest.py && python3 src/lease-broker/promotion_trigger_unittest.py && python3 src/lease-broker/receipt_challenge_unittest.py && python3 src/lease-broker/context_recovery_unittest.py && python3 src/lease-broker/recovery_runtime_unittest.py && python3 src/lease-broker/recovery_b1_adversarial_unittest.py && python3 src/lease-broker/receipt_observer_client_unittest.py && python3 src/lease-broker/invariant_r_unittest.py && python3 src/lease-broker/framework_skill_portability_unittest.py && python3 src/mutator-gate/runtime_tools_unittest.py && python3 src/mutator-gate/runtime_launch_guard_unittest.py && python3 src/mutator-gate/version_coupling_unittest.py && python3 framework/tools/lease-broker/check-runtime-launches.py --root ../.. && bash framework/tools/codex/test-pr-diff-context.sh && bash framework/tools/qa/test-deps-preflight.sh && bash framework/tools/git/test-pr-review-gitea-comment.sh && bash framework/tools/git/test-pr-review-repo-host-override.sh && bash framework/tools/git/test-ci-queue-wait-branch-absent.sh && bash framework/tools/git/test-ci-queue-wait-tristate.sh && bash framework/tools/git/test-ci-queue-wait-github-checks.sh && bash framework/tools/git/test-pr-merge-queue-branch.sh && bash framework/tools/git/test-pr-merge-head-pin.sh && bash framework/tools/git/test-pr-merge-message-field.sh && bash framework/tools/git/test-git-credential-mosaic.sh && bash framework/tools/git/test-gitea-token-identity.sh && bash framework/tools/woodpecker/test-terminal-green-contract.sh && bash framework/tools/_scripts/test-install-ordering-guard.sh && bash framework/tools/_scripts/test-mosaic-init-rce.sh && bash framework/tools/tmux/agent-send.test.sh && bash framework/tools/wake/test-wake-store-ack.sh && bash framework/tools/wake/test-wake-store-enqueue-race.sh && bash framework/tools/wake/test-wake-digest-hmac.sh && bash framework/tools/wake/test-wake-digest-quarantine.sh && bash framework/tools/wake/test-wake-detector.sh && bash framework/tools/wake/test-wake-fn-oracle.sh && bash framework/tools/wake/test-wake-reconcile.sh && bash framework/tools/wake/test-wake-beacon.sh && bash framework/tools/wake/test-wake-preimage.sh && bash framework/tools/wake/test-wake-install.sh && bash framework/tools/fleet/test-start-agent-session.sh && bash framework/tools/glpi/test-list-http-status.sh && bash framework/tools/orchestrator/test-board-roll.sh && bash framework/tools/woodpecker/test-ci-wait-exit-matrix.sh && bash framework/tools/_scripts/test-fleet-transport-check.sh"
   },
   "dependencies": {
     "@mosaicstack/brain": "workspace:*",

scripts/verify-release.mjs

@@ -0,0 +1,166 @@
+#!/usr/bin/env node
+// verify-release.mjs — the ONE canonical terminal verification command
+// (SDLC-D-034, `pnpm verify:release`).
+//
+// Publication (.woodpecker/publish.yml `verify` step) is bound to terminal
+// verification of the exact commit through this command, which is composed
+// from the SAME commands the PR CI pipeline (.woodpecker/ci.yml) runs — CI and
+// publish share one semantic checklist:
+//
+//   stage         | mirrors ci.yml step | commands
+//   --------------|---------------------|------------------------------------------
+//   sanitization  | sanitization        | verify-sanitized.sh, check-resident-
+//                |                     | budget.sh (--self-test + run),
+//                |                     | check-test-enumeration.sh
+//   upgrade-guard | upgrade-guard       | test-upgrade-manifest-guard.sh,
+//                |                     | test-upgrade-rollback.sh,
+//                |                     | test-upgrade-durable-snapshot.sh,
+//                |                     | test-install-migration.sh
+//   typecheck     | typecheck           | pnpm typecheck (runs the checkout
+//                |                     | preflight, then turbo typecheck)
+//   lint          | lint                | pnpm lint
+//   format        | format              | pnpm format:check
+//   test          | test                | pnpm test
+//   build         | publish.yml build   | pnpm build
+//
+// Caller-provided prerequisites (kept at the pipeline level — see the comments
+// in .woodpecker/ci.yml): `bash` + `rsync` for the guard stages, `openssl` and
+// the pinned @earendil-works/pi-coding-agent for the test stage, and — on the
+// postgres path only — the ci-postgres service plus
+// `pnpm --filter @mosaicstack/db run db:migrate` before the test stage.
+//
+// This command works with DATABASE_URL set (CI postgres path) or unset (local
+// PGlite path); it never sets, exports, or requires a database itself.
+//
+// scripts/verify-release.test.mjs enforces that this stage table keeps
+// matching .woodpecker/ci.yml step-for-step, so the two surfaces cannot drift
+// apart silently.
+
+import { spawnSync } from 'node:child_process';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+export const STAGES = [
+  {
+    name: 'sanitization',
+    // Mirror of the .woodpecker/ci.yml `sanitization` step (minus its
+    // `apk add` environment prep). Kept as direct command strings here: the
+    // #1017 test-enumeration guard audits these paths through the ci.yml
+    // surface, so indirection from ci.yml into this file is not possible.
+    commands: [
+      'bash packages/mosaic/framework/tools/quality/scripts/verify-sanitized.sh',
+      'bash packages/mosaic/framework/tools/quality/scripts/check-resident-budget.sh --self-test',
+      'bash packages/mosaic/framework/tools/quality/scripts/check-resident-budget.sh',
+      'bash packages/mosaic/framework/tools/quality/scripts/check-test-enumeration.sh',
+    ],
+  },
+  {
+    name: 'upgrade-guard',
+    // Mirror of the .woodpecker/ci.yml `upgrade-guard` step (minus its
+    // `apk add` environment prep).
+    commands: [
+      'bash packages/mosaic/framework/tools/quality/scripts/test-upgrade-manifest-guard.sh',
+      'bash packages/mosaic/framework/tools/quality/scripts/test-upgrade-rollback.sh',
+      'bash packages/mosaic/framework/tools/quality/scripts/test-upgrade-durable-snapshot.sh',
+      'bash packages/mosaic/framework/tools/quality/scripts/test-install-migration.sh',
+    ],
+  },
+  {
+    // `pnpm typecheck` is `pnpm preflight && turbo run typecheck`, so the
+    // checkout preflight (scripts/preflight.mjs) is part of this stage exactly
+    // as it is part of the ci.yml `typecheck` step.
+    name: 'typecheck',
+    commands: ['pnpm typecheck'],
+  },
+  {
+    name: 'lint',
+    commands: ['pnpm lint'],
+  },
+  {
+    name: 'format',
+    commands: ['pnpm format:check'],
+  },
+  {
+    // Requires `openssl` and the pinned `pi` binary on the pipeline path; see
+    // the caller-provided prerequisites above.
+    name: 'test',
+    commands: ['pnpm test'],
+  },
+  {
+    name: 'build',
+    commands: ['pnpm build'],
+  },
+];
+
+export function stageByName(name) {
+  return STAGES.find((stage) => stage.name === name);
+}
+
+function missingBinaries(bins) {
+  return bins.filter(
+    (bin) => spawnSync('sh', ['-c', `command -v ${bin} >/dev/null 2>&1`]).status !== 0,
+  );
+}
+
+function runCommand(command) {
+  const result = spawnSync(command, { shell: true, stdio: 'inherit' });
+  if (result.error) {
+    console.error(`[verify:release] failed to launch '${command}': ${result.error.message}`);
+    return false;
+  }
+  if (result.status !== 0) {
+    const reason = result.signal ? `terminated by ${result.signal}` : `exited ${result.status}`;
+    console.error(`[verify:release] command '${command}' ${reason}`);
+    return false;
+  }
+  return true;
+}
+
+// Runs the complete mandatory verification set (or, with --stage <name>, the
+// single named stage — used for wiring/smoke-testing, not for gating: only a
+// run of every stage is a terminal verification). Fails fast: the first
+// failing command aborts with a non-zero exit code. Returns the exit code.
+export function verifyRelease({ stages = STAGES } = {}) {
+  const missing = missingBinaries(['bash', 'rsync']);
+  if (missing.length > 0) {
+    console.error(
+      `[verify:release] FATAL: required binaries missing from PATH: ${missing.join(', ')}. ` +
+        'The caller provides them (ci-base bakes bash; pipelines apk add rsync).',
+    );
+    return 1;
+  }
+  for (const stage of stages) {
+    console.log(`\n[verify:release] === stage: ${stage.name} ===`);
+    for (const command of stage.commands) {
+      console.log(`[verify:release] $ ${command}`);
+      if (!runCommand(command)) {
+        console.error(
+          `[verify:release] FATAL: stage '${stage.name}' failed — verification inconclusive`,
+        );
+        return 1;
+      }
+    }
+  }
+  console.log(`\n[verify:release] all ${stages.length} stage(s) passed`);
+  return 0;
+}
+
+function main(argv) {
+  const stageFlagIndex = argv.indexOf('--stage');
+  if (stageFlagIndex !== -1) {
+    const name = argv[stageFlagIndex + 1];
+    const stage = stageByName(name);
+    if (!stage) {
+      console.error(
+        `[verify:release] unknown stage '${name ?? ''}' — expected one of: ${STAGES.map((entry) => entry.name).join(', ')}`,
+      );
+      process.exit(2);
+    }
+    process.exit(verifyRelease({ stages: [stage] }));
+  }
+  process.exit(verifyRelease());
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  main(process.argv.slice(2));
+}

scripts/verify-release.test.mjs

@@ -0,0 +1,277 @@
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import test from 'node:test';
+
+import { STAGES } from './verify-release.mjs';
+
+// SDLC-D-034 checkout invariant: publication in .woodpecker/publish.yml is
+// bound to exact-commit terminal verification. This suite parses the real
+// pipeline files and fails red when the gate is bypassed, weakened, or drifts
+// out of sync with the canonical `pnpm verify:release` command.
+
+// Reuse the monorepo's existing YAML parser (@mosaicstack/mosaic's direct
+// dependency) instead of adding a root dependency or vendoring a parser.
+const mosaicRequire = createRequire(
+  path.resolve(process.cwd(), 'packages', 'mosaic', 'package.json'),
+);
+const { parse: parseYaml } = mosaicRequire('yaml');
+
+const publishYmlPath = path.join(process.cwd(), '.woodpecker', 'publish.yml');
+const ciYmlPath = path.join(process.cwd(), '.woodpecker', 'ci.yml');
+
+async function readPublishPipeline() {
+  return parseYaml(await readFile(publishYmlPath, 'utf8'));
+}
+
+// A step has an external publication effect when its name starts with
+// `publish` or when any command pushes an image to a registry.
+function pushesImage(step) {
+  return (step.commands ?? []).some((command) =>
+    /(^|\s)(\/kaniko\/executor|docker push)\b|--destination/.test(command),
+  );
+}
+
+function publishEffectSteps(pipeline) {
+  return Object.entries(pipeline.steps ?? {})
+    .filter(([name, step]) => name.startsWith('publish') || pushesImage(step))
+    .map(([name]) => name);
+}
+
+// Transitive closure of a step's depends_on graph.
+function dependencyClosure(pipeline, stepName, seen = new Set()) {
+  const dependencies = pipeline.steps?.[stepName]?.depends_on ?? [];
+  for (const dependency of dependencies) {
+    if (seen.has(dependency)) continue;
+    seen.add(dependency);
+    dependencyClosure(pipeline, dependency, seen);
+  }
+  return seen;
+}
+
+function verifyCommands(pipeline) {
+  const verify = pipeline.steps?.verify;
+  assert.ok(verify, 'publish pipeline must define a `verify` step');
+  assert.ok(Array.isArray(verify.commands), '`verify` step must have commands');
+  return verify.commands;
+}
+
+function assertCommitIdentityAssertion(commands) {
+  const text = commands.join('\n');
+  assert.match(
+    text,
+    /CI_COMMIT_SHA/,
+    '`verify` must compare the provider commit identity (CI_COMMIT_SHA)',
+  );
+  assert.match(text, /git rev-parse HEAD/, '`verify` must compare against git rev-parse HEAD');
+  assert.match(
+    text,
+    /exit 1/,
+    '`verify` must fail closed (exit 1) on identity mismatch or emptiness',
+  );
+}
+
+function assertCanonicalCommand(commands) {
+  assert.ok(
+    commands.some((command) => /^pnpm verify:release\b/.test(command.trim())),
+    '`verify` must run the canonical terminal verification command `pnpm verify:release`',
+  );
+}
+
+function assertPublishGate(pipeline) {
+  assert.ok(pipeline.steps, 'publish pipeline must define steps');
+
+  const commands = verifyCommands(pipeline);
+  assertCommitIdentityAssertion(commands);
+  assertCanonicalCommand(commands);
+
+  const effects = publishEffectSteps(pipeline);
+  assert.ok(effects.length > 0, 'publish pipeline must contain publish effect steps to guard');
+
+  for (const stepName of effects) {
+    const step = pipeline.steps[stepName];
+    assert.ok(
+      Array.isArray(step.depends_on) && step.depends_on.includes('verify'),
+      `publish effect '${stepName}' must depend DIRECTLY on the verify step (SDLC-D-034: transitively through build is not enough)`,
+    );
+    assert.ok(
+      dependencyClosure(pipeline, stepName).has('verify'),
+      `publish effect '${stepName}' must depend on a chain that includes verify`,
+    );
+  }
+  return effects;
+}
+
+test('the publish pipeline gates every publish effect behind exact-commit verification', async () => {
+  const pipeline = await readPublishPipeline();
+  const effects = assertPublishGate(pipeline);
+  assert.deepEqual(effects.sort(), [
+    'build-appservice',
+    'build-gateway',
+    'build-web',
+    'publish-next-npm',
+    'publish-npm',
+  ]);
+});
+
+test('the verify step carries no path/event short-circuit of its own', async () => {
+  const pipeline = await readPublishPipeline();
+  // A `when` filter on `verify` would let a publish effect fire on an event
+  // class that skipped verification — the gate must be unconditional.
+  assert.equal(pipeline.steps.verify.when, undefined);
+});
+
+test('a publish step that bypasses verify fails the gate checker', () => {
+  // Negative fixture: a plausible publish pipeline where `publish-npm` hangs
+  // off `build` only and `build` never chains to `verify` — the exact bypass
+  // class SDLC-D-034 closes. The checker must go red on it.
+  const bypassingPipeline = `
+steps:
+  install:
+    image: node:24-alpine
+    commands:
+      - pnpm install --frozen-lockfile
+  verify:
+    image: node:24-alpine
+    commands:
+      - |
+        if [ -z "$CI_COMMIT_SHA" ] || [ "$CI_COMMIT_SHA" != "$(git rev-parse HEAD)" ]; then
+          echo "identity mismatch" >&2
+          exit 1
+        fi
+      - pnpm verify:release
+    depends_on:
+      - install
+  build:
+    image: node:24-alpine
+    commands:
+      - pnpm build
+    depends_on:
+      - install
+  publish-npm:
+    image: node:24-alpine
+    commands:
+      - pnpm publish
+    depends_on:
+      - build
+`;
+  assert.throws(
+    () => assertPublishGate(parseYaml(bypassingPipeline)),
+    /publish-npm.*DIRECTLY.*verify/s,
+  );
+});
+
+test('a publish step chained to verify only transitively fails the gate checker', () => {
+  // Negative fixture: `build` depends on verify but `publish-npm` does not
+  // carry the direct edge — weaker than SDLC-D-034 requires of the real DAG.
+  const transitiveOnlyPipeline = `
+steps:
+  install:
+    image: node:24-alpine
+    commands:
+      - pnpm install --frozen-lockfile
+  verify:
+    image: node:24-alpine
+    commands:
+      - |
+        if [ -z "$CI_COMMIT_SHA" ] || [ "$CI_COMMIT_SHA" != "$(git rev-parse HEAD)" ]; then
+          echo "identity mismatch" >&2
+          exit 1
+        fi
+      - pnpm verify:release
+    depends_on:
+      - install
+  build:
+    image: node:24-alpine
+    commands:
+      - pnpm build
+    depends_on:
+      - install
+      - verify
+  publish-npm:
+    image: node:24-alpine
+    commands:
+      - pnpm publish
+    depends_on:
+      - build
+`;
+  assert.throws(
+    () => assertPublishGate(parseYaml(transitiveOnlyPipeline)),
+    /publish-npm.*DIRECTLY.*verify/s,
+  );
+});
+
+test('a verify step without the commit-identity assertion fails the gate checker', () => {
+  const noIdentityPipeline = `
+steps:
+  verify:
+    image: node:24-alpine
+    commands:
+      - pnpm verify:release
+  publish-npm:
+    image: node:24-alpine
+    commands:
+      - pnpm publish
+    depends_on:
+      - verify
+`;
+  assert.throws(() => assertPublishGate(parseYaml(noIdentityPipeline)), /CI_COMMIT_SHA/);
+});
+
+test('the canonical verify:release stages mirror the PR CI pipeline one-for-one', async () => {
+  const ci = parseYaml(await readFile(ciYmlPath, 'utf8'));
+  const canonical = Object.fromEntries(STAGES.map((stage) => [stage.name, stage.commands]));
+
+  // The complete mandatory set, in gate order.
+  assert.deepEqual(
+    STAGES.map((stage) => stage.name),
+    ['sanitization', 'upgrade-guard', 'typecheck', 'lint', 'format', 'test', 'build'],
+  );
+
+  // Guard stages: ci.yml commands minus its `apk add` environment prep must be
+  // exactly the canonical stage commands (order included).
+  for (const stageName of ['sanitization', 'upgrade-guard']) {
+    assert.deepEqual(
+      ci.steps[stageName].commands.filter((command) => !command.startsWith('apk add')),
+      canonical[stageName],
+      `canonical '${stageName}' stage must match the ci.yml step`,
+    );
+  }
+
+  // pnpm stages: ci.yml commands minus `corepack enable` must be exactly the
+  // canonical stage commands.
+  for (const stepName of ['typecheck', 'lint', 'format']) {
+    assert.deepEqual(
+      ci.steps[stepName].commands.filter((command) => command !== 'corepack enable'),
+      canonical[stepName],
+      `canonical '${stepName}' stage must match the ci.yml step`,
+    );
+  }
+
+  // The test stage is shared, but ci.yml wraps it in pipeline-level
+  // prerequisites the canonical command expects its caller to provide
+  // (SDLC-D-034): the postgres service + readiness wait + db:migrate, openssl,
+  // and the pinned pi runtime. None of those may be dropped silently.
+  for (const command of canonical.test) {
+    assert.ok(
+      ci.steps.test.commands.includes(command),
+      `ci.yml test step must run the canonical test stage command '${command}'`,
+    );
+  }
+  for (const fragment of [
+    'pg_isready -h ci-postgres',
+    'pnpm --filter @mosaicstack/db run db:migrate',
+    'npm install -g @earendil-works/[email protected]',
+  ]) {
+    assert.ok(
+      ci.steps.test.commands.some((command) => command.includes(fragment)),
+      `ci.yml test step must keep its pipeline-level prerequisite '${fragment}'`,
+    );
+  }
+});
+
+test('the root package.json exposes verify:release as the canonical command', async () => {
+  const packageJson = JSON.parse(await readFile(path.join(process.cwd(), 'package.json'), 'utf8'));
+  assert.match(packageJson.scripts['verify:release'], /scripts\/verify-release\.mjs/);
+});