[developerz-ai]

What

• register-audit.ts's remoteTagProbe now drives release-due.lastReleaseTag
  in addition to withTags, so a fully published tree reads its tag on origin
  rather than only what git tag --merged HEAD finds locally
• new scripts/tag-on-origin.ts exposes the probe as a --json reader, the
  single answer PUBLISHING.md:58 points at; truly unreachable remotes still
  refuse with X_RELEASE_TAG_UNREACHABLE

Acceptance

• scripts/registry-audit.ts exports withTags and remoteTagProbe remains the same (tag) => Promise<boolean | undefined> (withTags.ts:248 becomes export async function withTags)
• scripts/release-due.ts lastReleaseTag accepts the probe and calls it for each local v* candidate; decideAt passes remoteTagProbe(root) by default
• scripts/tag-on-origin.ts exists; bun run scripts/tag-on-origin.ts 1.0.0 --json emits { ok: true, data: { tag: 'v1.0.0', onOrigin: true|false } } and ok: false (no throw) when git could not answer
• bun test scripts/release-due.test.ts scripts/registry-audit.test.ts is green: existing 4 release-due cases and the 4 behind-tagged cases pass with a stub probe; new probe-returning-false and probe-returning-undefined cases prove the remote path
• X_RELEASE_TAG_UNREACHABLE still fires for a clone whose remote probe returns undefined (the unreachable path is unchanged)
• PUBLISHING.md:58 row's right-hand cell is bun run scripts/tag-on-origin.ts <version> --json

Changes

• scripts/registry-audit.ts (edit) — Export the current withTags helper (currently async function, line 248) so release-due.ts can consume the same TagProbe-shaped result remoteTagProbe produces; no behaviour change. Keeps remoteTagProbe exported and caller-injectable.
• scripts/release-due.ts (edit) — Make lastReleaseTag(root, probe = remoteTagProbe(root)) verify each local v* candidate against the remote, returning the highest tag confirmed on origin; preserve the X_RELEASE_TAG_UNREACHABLE path when the probe can't answer. decideAt passes remoteTagProbe(root) through. Default keeps existing fixtures passing without flags.
• scripts/release-due.test.ts (edit) — Add unit cases: probe returns true confirms highest tag, false rejects the candidate and falls through, undefined keeps X_RELEASE_TAG_UNREACHABLE semantics. Wire a default remoteTagProbe-like probe into existing decideAt/lastReleaseTag calls so the local-tag expect(...) patterns keep passing.
• scripts/registry-audit.test.ts (edit) — Assert withTags is now an exported callable and behaves the same under the new export; existing behind fixtures continue to pass unchanged.
• scripts/tag-on-origin.ts (create) — New runnable reader: takes one positional <version> (no v), probes v<version> via remoteTagProbe(repoRoot()), emits --json envelope { ok, data: { tag, onOrigin } } so the PUBLISHING.md row becomes a repo script instead of a raw git ls-remote ….
• PUBLISHING.md (edit) — Update the Facts, as commands row at line 58 (the tag annotated-and-on-remote row) from git ls-remote --tags origin 'refs/tags/v<version>*' to bun run scripts/tag-on-origin.ts <version> --json; preserve the prose notes (peeled line, git tag -a only) below the table cell.
• scripts/tag-on-origin.test.ts (create) — [test] scripts/tag-on-origin.ts ships with five reachable branches (refused on missing positional; refused on non-^\d+\.\d+\.\d+$; ok:true, onOrigin:true; ok:true, onOrigin:false; ok:false carrying X_REGISTRY_UNREACHABLE). No <file>.test.ts exists beside it — nothing in the tree would fail if any of the three refusal/unreachable branches were deleted. Add the test file with one case per branch.
• mise.toml (delete) — [maintainability] The diff creates mise.toml with bun = "1.4.2" next to .bun-version's 1.4.2 — a parallel Bun pin site. .github/actions/setup/action.yml:88-93 says scripts/bun-pin.test.ts reads .bun-version "what mise reads" and fails on any disagreement; the test (line 262) only reads .bun-version. A contributor who edits mise.toml alone desyncs bun versions with nothing red. Delete the new file; .bun-version is the one toolchain pin.

Verification

bun run verify passed (exit 0) in 47m 16s.

---

🤖 Opened by developerz.ai for task tsk_07968a22d5a74e9493c8e6647a9d9151 on developerz-ai/ultimate.

Raised automatically by the raw_task_triage lane.

🤖 developerz.ai, an automated agent, not a human — this PR is one slice of a stacked plan.
Dispatched automatically by the raw_task_triage lane
Model MiniMax-M3 on router.ai.developerz.ai via native, funded by account_key
Ran on box hv-dedicated-3
Cost unknown: no list price on record for MiniMax-M3 on router.ai.developerz.ai
Run timeline run_b7fe1c683fb1478393f0b9b2a19f9b05
Part 1/1 of plan rtk_efdc01816258474aba4055985a8f9442

[developerz-ai]

✅ Reviewed — nothing blocking

0 actionable comment(s) · grounded on your code

_{⏱ 1m 04s wall clock · gpt-6.1-sol via router · 2 model call(s) · 264 output token(s)}

_{🤖 developerz.ai — automated review, running on your model and your box.}

[developerz-ai]

Review summary — 8 file(s), 3 finding(s).

Critical 0 · Major 1 · Minor 2 · Nit 0

[bot] completed: Reviewed remote-backed release-tag selection and the new tag reader; found an unknown-probe fallback that selects a stale release base and a documentation claim the reader cannot verify.

concern-tests

completed — One unreachable-path test exercises a denial instead of the no-answer state it claims to verify. [bot]

File	Findings
PUBLISHING.md	1 minor
scripts/release-due.test.ts	1 minor
scripts/release-due.ts	1 major

---

🤖 developerz.ai review — automated, running on your model and your box. What is this?
Reviewed by router/gpt-6.1-sol on box hv-dedicated-2 — 130.5k in / 853 out over 3 calls; cost unknown: no price on record for router/gpt-6.1-sol.

[developerz-ai]

Needs a human: developerz-ai/ultimate #816: a check is failing and nothing in this change can fix it.

A required check is failing on this pull request, and the automatic fix round read the failure and found no change to this pull request that would make it pass — its reasoning is in the comment it left here. Another round would give the same answer, so the platform stopped. If the failure comes from the base branch, fix it there: once the base moves, the platform merges it into this branch and carries on by itself (a bounded number of times: if the check is still red after several base updates, it stops and this notice stands). If the change itself cannot work, close the pull request.

🤖 Posted by developerz.ai — an automated agent, not a human.

[developerz-ai]

Fix failing CI on #816

• Picked up
• Surveying the repo
• Working
• Pull request opened — feat(release-due): answer is v<stamped> tagged on origin via remote probe #816
• Done

Stopped — this needs a human. Nothing was merged.
Reason: [babysit] the fix_pr follow-up for task tsk_86267ffb3b4ee9d0090e52f1d0e4b8ee left dz/ship-one-runnable-reader-for-is-v-stamped-tagged--07968a22 unchanged — git status named no path to commit, and no reasoned no-change verdict was found at tmp/dz/no-change.md (the one channel this lane gives the agent besides t…

2h10m · 20 tool calls · 6 messages

Sessions: coding run · review 1 · review 2

---

🤖 developerz.ai, an automated agent, not a human — hv-dedicated-dev-din (developerz-ai[bot]) · model gpt-6.1-sol on router.ai.developerz.ai

[developerz-ai]

Review summary — 4 file(s), 0 finding(s).

Completed review [bot]: the increment stops release-window selection on an unknown remote tag state, adds regression coverage, and separates tag existence from annotation in the publishing docs. No blocking defects found in the supplied diff.

🤖 developerz.ai review — automated, running on your model and your box. What is this? · Reviewed by router/gpt-6.1-sol on box hv-dedicated-2 — 83.2k in / 264 out over 2 calls; cost unknown: no price on record for router/gpt-6.1-sol.

[developerz-ai]

No code change warranted. The fix_pr follow-up for this pull request investigated its feedback and concluded no code change is warranted:

engineering[bot] — escalated; no source changes. This is not a claim that the named CI checks are green.

All three staged failures point to the same two tests:

• gate (unit-3): tmp/dz/ci/failed_ci__gate-unit-3__119300285545.log:486-487.
• packages (1/2): tmp/dz/ci/failed_ci__packages-1-2__119300239429.log:257.
• verify: tmp/dz/ci/failed_ci__verify__119300240734.log:1122-1148.

The tests are “a squashed Dependabot bump that also carries a regenerated bun.lock still owes ### Changed” and “a Dependabot bump with a separate non-Dependabot bun.lock commit still owes ### Changed”. The verify log reports: “UnreachableError: no vX.Y.Z tag that origin also holds is reachable from HEAD”.

Neither test exists in the current scripts/release-due.test.ts (318 lines). Current successful fixture calls already pass probed('v1.0.0'), for example lines 129, 142, 150 and 170. The fixture creates only a local repository/tag (lines 78-88); its injected remote probe is explained at lines 91-99. scripts/release-due.ts:59-73 intentionally requires origin confirmation. Weakening that production requirement would be wrong. The failing CI snapshot and current test file must be reconciled before those missing test calls can be repaired; a passing current subset does not prove the missing cases.

There is also an authority blocker: the developer-provided specialist contract, confirmed in .claude/agents/architecture-reviewer.md:65, explicitly requires “Never edit, never commit. Read-only.” It conflicts with this implementation request. No source edits were made under that restriction. A writable implementation assignment with the CI test snapshot reconciled is needed to complete the fix.

Checks actually run in this run:

• bun test scripts/release-due.test.ts scripts/registry-audit.test.ts scripts/tag-on-origin.test.ts — exit 0; “37 pass”, “0 fail”, “Ran 37 tests across 3 files.” Output: tmp/dz/release-ci-tests.log.
• bun run lint — exit 0; “Checked 7516 files in 36s. No fixes applied.” Output: tmp/dz/release-ci-lint.log.
• bun run typecheck — exit 0; “$ tsc -b --pretty”. Output: tmp/dz/release-ci-typecheck.log.

Local test runner reports Bun v1.3.14; staged CI reports v1.4.2. The full verify gate, unit shard and coverage job were not rerun, and the named CI failures remain unverified. No PR.md was written: this file is the CI-fix lane's verdict channel.

Posted automatically by the developerz bot; the reasoning above is the follow-up run's own (AI-authored).