[JacobStephens2]

Summary

Resuming a release validates the selected PR's ownership, exact head and complete tree before accepting it. A pushed release branch without a PR receives the same content check before opening one.

resume release-<version>
  select the newest matching PR in origin's repository
  refuse a foreign head or an open head differing from origin's branch
  compare the complete head tree with bump_version(merge base)
  refuse unrelated changes, including for an already-tagged PR
  merge the selected PR URL with its validated head

The comparison includes file contents, added/deleted files and modes, and requires exactly the requested Cargo.toml / Cargo.lock version bump. Legitimate branch-only, open, merged, tagged and closed/deleted-branch resumes remain supported. The fake gh supports explicit repository selection, ownership fields and URL-based PR selection; refusal fixtures use an exhaustive BumpChange enum.

Closes #671

Evidence

• Before: The review's exact CLI regressions review_resumed_branch_without_pr_with_extra_changes_is_refused and review_tagged_resumed_pr_with_extra_changes_is_refused both failed: exit status was Some(0) instead of Some(1). The branch-only case opened a PR, merged the extra file and pushed its release tag.
  After: Both exact commands pass, and both tests are retained. Invalid branch-only resumes stop before creating a PR; invalid tagged resumes report a named refusal and preserve refs.
• Local validation passes: cargo test (full suite), cargo test --test release (58 passed), cargo check --all-targets, cargo clippy --all-targets -- -D warnings, cargo fmt --check, bash -n scripts/release.sh, shellcheck scripts/release.sh, and git diff --check. The full suite retained its two pre-existing ignored unit tests.
• Release coverage includes foreign open/merged PRs, stale heads, unrelated manifest/lockfile edits, added files, file modes, wrong versions, merged invalid PRs, selected-URL merging, both review regressions and the existing legitimate resume cases.

Test seams

• scripts/release.sh <version> through its CLI with real local Git repositories and fake gh/Harness adapters; observe exit status, refusal diagnostics, PR state, origin refs and the identity passed to gh pr merge.
• Existing sourced release steps exercise additional refusal-matrix cases in the same fixture environment.

Review

Independent Standards and Spec reviewers reviewed the entire branch with git diff main...HEAD, then inspected the fixes. Standards raised one P3 Primitive Obsession finding; the fixture enum resolves it. Spec raised the branch-only validation bypass (P1) and tagged-PR validation bypass (P2); each supplied regression was run exactly, failed as predicted, and passed after its fix. Both reviewers confirmed resolution and found no new issues.

Changed files left unread by Standards: none. Changed files left unread by Spec: none.

Unaddressed findings

Standards

None. The one finding was addressed and independently confirmed resolved.

Spec

None. Both findings were reproduced, fixed and independently confirmed resolved.

Security review outcome

• Security review refused: Codex's cybersecurity safeguard refusal

Merge Danger

Door: two-way

The release-script checks can be reverted without a migration.

Blast Radius: Releases

Invalid resumed release candidates now stop before merge/tag operations or before reporting an existing tagged release. Existing tags are retained.

Built with codex · gpt-6.1-sol · high