## Summary
`scripts/ci-local-release.sh` default run takes ~78min (4657s) — a full
release rehearsal (multi-platform cross-build + SBOM cyclonedx/spdx +
syft/grype/trivy vuln scan + race tests +
eval/HIL/digital-twin/readiness gates). Too heavy for iterative pre-tag
use.
This adds a `--quick` (alias `--sanity`) mode: the fast code-correctness
subset, skipping the slow release-rehearsal lane. Target <5min.
## What --quick KEEPS
- current-platform `make build` + `go vet` + `go test` (no `-race`)
- manifest version-consistency check
- `release-smoke-test.sh` + `ao init`/`ao rpi` smoke
- the cheap correctness gates (CLI snippets, shellcheck, doc/manifest
gates) in Phases 2/3/3b
- agents-hub content-hash isolation gate (cheap, real protection)
## What --quick SKIPS (prints a clear note)
- SBOM generation (cyclonedx/spdx)
- multi-platform release-binary validation (cross-build rehearsal)
- vuln-scan security gate (syft/grype/trivy)
- AgentOps contract canaries + Go race tests
- eval / digital-twin / HIL / release-readiness rehearsal gates
- release-provenance artifacts (manifest + tag-index) — `--quick` is
explicitly not a rehearsal
## What --quick treats as ADVISORY (run, but does NOT gate the verdict)
- worktree-disposition gate + MemRL feedback health — these reflect
**local machine state**, not committed code. New `run_step_advisory()`
helper warns instead of failing.
## Unchanged
- Default (no flag) behavior is the full rehearsal for the real tag.
`--fast` is untouched.
## Verification
- `bash -n` + `shellcheck --severity=error` (repo gate severity): clean
- `bats tests/scripts/ci-local-release.bats`: 30/30 pass (6 new
`--quick` tests added)
- `--quick` ran end-to-end and exercised the correct lane (built binary,
ran smoke + hash gate, skipped rehearsal/eval/HIL/readiness, advisory
worktree/MemRL)
- Quick `make build + vet + go test ./...` step verified rc=0 (60
packages) in 238s with real HOME
- Diff stat: 129/+ 12/- in the script, all intentional control-flow
restructure (no collateral)
Closes-scenario: ag-gm2#quick-mode
Bounded-context: BC5-Runtime
Evidence: scripts/ci-local-release.sh
The existing scripts/check-home-isolation.sh grep-checks test files for
t.Setenv("HOME", ...) patterns but cannot detect:
- Tests that explicitly unset HOME after setup
- Tests that write to ~/.agents and then use os.Chtimes to restore
the mtime (the same API recovery_test.go:285 uses legitimately
can hide test-side poisoning)
This adds a post-hoc content-hash gate that:
1. Captures SHA-256 of ~/.agents/{learnings,patterns,findings,rpi/next-work.jsonl}
BEFORE the test phase.
2. Re-captures and diffs AFTER the test phase.
3. Fails the gate on any content change — mtime restoration cannot
hide it because the hash depends on file content, not stat metadata.
Wired into both local gates:
- scripts/pre-push-gate.sh — capture right after check-home-isolation,
diff as the final phase before the summary.
- scripts/ci-local-release.sh — capture after check_required_cmds,
diff as Phase 6 before Summary via the existing run_step helper.
The remote CI surface (.github/workflows/validate.yml) is deferred to a
follow-up micro-epic so the blast radius of this change stays local.
Script skips gracefully on minimal containers without shasum via an
explicit command-exists check at the top.
Verified via 6-judge pre-mortem council. Part of Micro-epic 1.
- Exclude .gc/ dir and Getenv/DOLT_PASSWORD lines from secret pattern scan
- Regenerate codex hashes for forge, post-mortem, scenario after SKILL.md fixes
Remove coverage-ratchet job, cmd/ao coverage floor check, and all
associated scripts/tests/baseline. Coverage percentages are noisy
during test migrations and architectural refactors — they block CI
without catching real bugs.
Deleted: .coverage-baseline.json, scripts/check-cmdao-coverage-floor.sh,
scripts/coverage-ratchet.sh, tests/scripts/check-cmdao-coverage-floor.bats
Updated: validate.yml, pre-push-gate.sh, ci-local-release.sh, pre-push-gate.bats
Epic D: Add pre-spawn worker detection to git-worker-guard (blocks worktree-add
and agent-spawn from workers). Enhance check-file-manifest-overlap.sh edge cases.
Wire validate-swarm-evidence.sh into CI. Fix .agents/retros→retro in index.go
and init.go. Add grep-for-existing-functions to swarm worker template.
Epic E: Replace partial embedded check in pre-push-gate with full
validate-embedded-sync. Lazy-init git rev-parse in research-loop-detector.
Add retag idempotency guard (skip if tag already at HEAD). Add git_sha to
release-artifacts.json manifest. Empty stdin guard in go-test-precommit.
Adds write_tag_index() that appends a tag→run_id mapping to
.agents/releases/local-ci/tag-index.txt when --release-version is
passed (or a semver is resolvable from plugin.json). Each entry is
one line: "<vX.Y.Z> <RUN_ID> <generated_at>". Skips gracefully when
no semver version is available (e.g. bare git-describe hash runs).
The sync-codex-native-skills.sh script is unreliable and overwrites manual
edits to skills-codex/. Codex skills are now manually maintained.
- Remove validate-codex-skill-parity step from validate.yml
- Comment out from ci-local-release.sh
- Skip in pre-push-gate.sh
- Keep codex-runtime-sections and install-bundle checks (structural, not parity)
- Fix frontmatter-only learning file, wire validate-learning-coherence
into local CI gate (scripts/ci-local-release.sh)
- Add 4 BATS tests: no-jq fallback for write_failure and
write_memory_packet, newline injection guard, tab/newline escaping
- Document count-verification conformance and vibe language filter
patterns in .agents/patterns/
Integrate mind knowledge graph tool as `ao mind` subcommand (scan,
normalize, link, index, all, graph) wrapping python3 -m mind. Update
all 9 skill output templates to emit standardized YAML frontmatter
(id, type, date) with source wikilinks for RPI chain skills. Mirror
all changes to skills-codex/ for parity.
Also includes: hooks coverage test updates, go-complexity precommit
guard, ci-local-release allowlist fix, and new integration/lint tests.
- update ci-local smoke commands to current ao CLI surface
- harden shell/danger scans against .claude worktree noise
- update AGENTS CI parity docs for codex-runtime-sections
Doctor was reporting 3 false warnings after the Codex-native migration:
- Plugin check missed ~/.codex/skills/ (only searched ~/.claude/, ~/.agents/)
- Search index hint referenced old flat "ao store rebuild" command
- Version display showed "vv2.18.2" (double v prefix from ldflags)
Also:
- Add check-doctor-health.sh to ci-local-release.sh Phase 2
- Fix make install to run build first (ensures embedded sync)
- Add formatVersion unit test
1. Remove dead anti-pattern-only functions from close-loop (tech-debt)
2. Extend ao dedup to scan .agents/patterns/ (improvement)
3. Add --merge flag to ao dedup for automated cleanup (improvement)
4. Add ao contradict command for contradiction detection (improvement)
5. Add MemRL feedback loop health check to CI (process-improvement)
6. Reduce updateMarkdownFrontMatter complexity 15→≤5 (tech-debt)
Background processes leaked on Ctrl+C — added trap handlers for INT/TERM/EXIT
that kill all spawned PIDs and remove temp dirs. Capped parallel jobs at half
CPU cores (min 4) with a throttle loop to prevent CPU saturation. Added --jobs
flag to override. Removed -v from background go test -race (noise in bg jobs).
Post-mortem council flagged 6 items. All resolved:
1. Clean dead code in measure_test.go — removed longOutput variable,
order variable, fixed byte-vs-rune assertion to use len([]rune())
2. Add goleak for goroutine leak detection — replaces fragile
runtime.NumGoroutine + sleep heuristic with deterministic check
3. Assert AntiStars values in goals_init_test.go — not just count
4. Fix ci-local-release.sh invocation: ./scripts/ not bash scripts/
5. Add MigrateV1ToV2 and killAllChildren package-level tests —
previously at 0% coverage in internal/goals
6. Fix goroutine leak in rpi_status.go — same signal.Stop-without-close
pattern found by audit of all signal.Notify sites (1/3 leaking)
TDD approach: wrote tests first proving 2 bugs (goroutine leak in
runGoals signal handler, nil pointer panic in configureProcGroup Cancel
closure), then fixed them. Added 15 new test cases covering detectGates,
buildInteractiveGoalFile, directivesFromPillars, and multi-byte rune
truncation. Wired check-skill-flag-refs.sh into release gate. Deleted
untracked cli/AGENTS.md (redundant with ~/gt/AGENTS.md).
Secret scan was matching `secretFile` in _test.go files and .claude/worktrees/.
Security gate was failing on missing hadolint (no Dockerfiles in repo).
Bo