[JacobStephens2]

Summary

release <version>
  refuse Sessions, wrong origin, invalid versions and competing releases
  fetch main → newest green push CI → detached version bump
  recorded sandbox summary → release-<version> PR → checks
  tag validated head → release workflow → merge bump PR

Adds Release run records, logs, Activity log, Run metrics, Stop cleanup, Inbox settlement and notification policy. Cron jobs recognize the command; Console starts require admin. The running binary leaves the Launch directory's working tree alone and finishes after publication and merge.

Closes #2157

Evidence

Execution evidence

• CI sandbox repair (4e999a53) — Before: native::native_release_publishes_green_content_without_reading_the_launch_tree, new relative to issue-2054, failed at its expected-summary assertion in rust-x86 / run (3). Removing either bwrap or socat from the local test's PATH reproduced that failure and sandbox failed to start: <tool> is not on PATH; the Release run correctly fell back to generated notes.
  After: Rust CI installs the sandbox dependencies, grants /usr/bin/bwrap its scoped AppArmor namespace permission, and probes startup. cargo test --test release native:: passed all 12 tests, including the same summary and host-isolation assertions. The assertion now includes command stderr for diagnostics.

• Final repair validation: /usr/bin/time -p env NEXTEST_TEST_THREADS=3 scripts/affected-tests issue-2054 passed: 69 site checks, 206 Console checks, 4,537 Rust tests (199 inventory skips, unchanged), and 10 release-generator tests. Total wall time: 4,396.08 seconds; cargo nextest run: 3,974.59 seconds including compilation (3,907.789 seconds executing tests). All 72 Python tooling tests, cargo fmt --check, workflow shell syntax, AppArmor profile parsing, and the real sandbox namespace probe also passed.

• Before: cargo test --test release native::native_release_refuses_a_blocking_review_without_a_merge_attempt -- --exact --nocapture exited 101: REVIEW_REQUIRED in the fixture still ended with Release 0.2.0 published; PR https://github.com/JacobStephens2/thirdshift/pull/4 is merged.
  After: the same command passed: 1 passed; 0 failed, exercising both REVIEW_REQUIRED and CHANGES_REQUESTED.

• Before: cargo test --test release native::native_release_does_not_execute_launch_checkout_hooks -- --exact --nocapture exited 101: Release run executed a hook from the Launch directory working tree.
  After: the same command passed: 1 passed; 0 failed.

• cargo test --test release native::native_release_stop_releases_locks_reservation_and_live_label -- --exact --nocapture: 1 passed; 0 failed.

• cargo test --test release native::native_release_publishes_green_content_without_reading_the_launch_tree -- --exact --nocapture: 1 passed; 0 failed, including acceptance of the actual published tag by the incoming release tag guard.

• Before: cargo test --test packaging non_linux_compilation_reports_only_the_platform_error -- --exact --nocapture exited 101: the intended platform error was accompanied by method call on a diverging inference variable, no method named is_none found for type ! and unreachable arm because inserting Release displaced Triage's Linux gate.
  After: restoring that gate made the same command pass: 1 passed; 0 failed, checking both ordinary and test compilation.

• scripts/affected-tests refs/remotes/origin/issue-2054 passed on reconciled 65d5c348: 69 site checks, 206 Console checks and 4,536 Rust tests passed (199 Rust tests skipped). Local wrappers serialized browser test files and ran Nextest with eight workers and --no-fail-fast; the complete run finished in 3,586.88 seconds. Earlier parallel Console navigation/geometry failures passed in a focused serialized rerun and in the complete serialized suites.

• cargo fmt --check and cargo clippy --all-targets -- -D warnings passed on the reconciled source.

Test seams: installed CLI against real Git with external GitHub, Harness and email stand-ins; Console start API authorization and Cron inventory; retained Command Inbox/metrics/notification projections; rendered Console controls and public documentation.

Visual evidence

Documentation captures compare the pinned review baseline 4d24f79d with reconciled 65d5c348; the inherited safeguards are described below.

Console Start work · 1440×900

Mobile and documentation evidence

Console Start work · 390×844

Homepage release workflow · 1440×900

Homepage release workflow · 390×844

How it works · 1440×900

How it works · 390×844

Architecture · 1440×900

Architecture · 390×844

Release run manual · 1440×900

Release run manual · 390×844

Compiled Release summary prompt · 1440×900

Compiled Release summary prompt · 390×844

Unaddressed findings

Standards

None. The one raised policy-consistency finding was reproduced and fixed.

Spec

None. The one raised checkout-hook finding was reproduced and fixed.

Security

None. Launch-repository filter and fsmonitor execution during a Release run was reproduced and fixed.

Review fixed point: refs/remotes/origin/issue-2054, pinned at review start to 4d24f79d. Both independent axes read all 52 changed paths through 91933bac, including generated output; no output was excluded. Later hunks were not independently reread in src/main.rs (compact help and restored Triage platform gate), src/logs/owner.rs (Release trace ownership), docs/guide.md and site/docs/index.html (manual conflict resolution), and tests/release/native.rs (tag-guard compatibility assertion). Their focused checks pass: CLI surface 21 passed/2 ignored; non-Linux diagnostics 1 passed; Inbox/history/catalog 7 passed; native happy path with the incoming tag guard 1 passed; manual consistency passed.

Upstream advanced to 7889862e (#2161) during validation and is merged in 65d5c348. Its inherited changes were outside the independent review input and are excluded from the final 52-path PR diff against the updated base. Those base changes, not independently rereviewed here, touch .github/workflows/release.yml, README.md, docs/guide.md, scripts/generate-release.py, scripts/release-tag-guard.py, scripts/setup-release-tags.sh, scripts/test_generate_release.py, site/architecture/index.html, site/docs/index.html, site/how-it-works/index.html, site/index.html, src/github/review.rs, src/logs/session_signals/destructive.rs, tests/fix_pass.rs, tests/fixtures/destructive-commands.json and tests/review_pass.rs. All 10 release workflow/tag-guard Python tests pass.

Security review outcome

No unaddressed introduced findings.

Merge Danger

Door: two-way

The CLI change can be reverted; published versions remain published.

Blast Radius: Releases

Affects explicit thirdshift releases, their Command lifecycle and administrator start controls. Legacy release-script tests remain covered.

Built with codex codex-cli 0.167.1 · gpt-6.1-sol · xhigh