release-bump writes the primary manifest before reading the sibling #139

New issue

Closed

opened 2026-08-15 14:33:40 +00:00 by john · 1 comment

john commented

2026-08-15 14:33:40 +00:00

Owner

Source: deep dive F9
Verdict: AGREE - low

Claim as reviewed

The primary plugin manifest is written before the sibling manifest is read and validated, so a malformed sibling leaves a partially bumped release tree inside an ok:true envelope.

At HEAD `f354864` (v3.3.0)

cadence-core/bin/release-bump.mjs:138-141 writes .claude-plugin/plugin.json. The sibling read (readManifest(siblingPath)) does not happen until :146, and the changelog is handled later still at :172-193.

The implementation accepts this explicitly at :149-166: "The primary write already landed, so this records rather than aborts (D-08)". A sibling refusal surfaces as siblings[].action='refuse' inside a top-level ok:true.

Note

cadence-core/workflows/milestone.md halts the close on a siblings[] refusal, so this does not silently ship. It is still a partial mutation reported as success.

Fix shape is a reorder, not a transaction: read and validate every participating file, compute all outputs in memory, then write. A refusal should be able to mean "wrote nothing".

**Source:** deep dive F9 **Verdict:** AGREE - low ### Claim as reviewed The primary plugin manifest is written before the sibling manifest is read and validated, so a malformed sibling leaves a partially bumped release tree inside an `ok:true` envelope. ### At HEAD f354864 (v3.3.0) `cadence-core/bin/release-bump.mjs:138-141` writes `.claude-plugin/plugin.json`. The sibling read (`readManifest(siblingPath)`) does not happen until `:146`, and the changelog is handled later still at `:172-193`. The implementation accepts this explicitly at `:149-166`: "The primary write already landed, so this records rather than aborts (D-08)". A sibling refusal surfaces as `siblings[].action='refuse'` inside a top-level `ok:true`. ### Note `cadence-core/workflows/milestone.md` halts the close on a `siblings[]` refusal, so this does not silently ship. It is still a partial mutation reported as success. Fix shape is a reorder, not a transaction: read and validate every participating file, compute all outputs in memory, then write. A refusal should be able to mean "wrote nothing".

john added the

bug

external-review

labels

2026-08-15 14:33:40 +00:00

john added this to the v3.5.4 milestone

2026-08-15 15:09:28 +00:00

john referenced this issue

2026-08-15 15:14:18 +00:00

Add a journal/recovery primitive for multi-file state transitions #145

john modified the milestone from v3.5.4 to v3.5.6

2026-08-18 10:23:30 +00:00

john referenced this issue

2026-08-20 15:26:09 +00:00

v3.5.6: the machinery that records what a run did #226

john referenced this issue from a commit

2026-08-20 15:29:35 +00:00

docs: open v3.5.6 and add phase 1

john modified the milestone from v3.5.6 to v3.5.8

2026-08-20 15:34:10 +00:00

john referenced this issue

2026-08-22 17:55:08 +00:00

v3.5.8 - the transition that claims to be one #229

john commented

2026-08-22 19:41:47 +00:00

Author

Owner

Shipped in v3.5.8 as JRN-03, merged via #229.

release-bump now reads and decides its whole write set before the first write. The first atomicWrite( sits at line 361 against the last readManifest( at 280 and the changelog read at 329, so the ordering is structural rather than conventional. A malformed sibling leaves the primary manifest at the OLD version under an ok:false envelope, proven by a test in release-bump.test.mjs.

Two new refusal codes with their own identities: unreadable-sibling-manifest and unreadable-changelog. The existing siblings[] refusal arm still works for a sibling that is readable but not upgradeable, so the two outcomes are not collapsed.

Note: #231 files six further defects in this same seam, found by triaging the capture archive. They are separate from this issue's ordering defect and remain open.

Shipped in v3.5.8 as JRN-03, merged via #229. `release-bump` now reads and decides its whole write set before the first write. The first `atomicWrite(` sits at line 361 against the last `readManifest(` at 280 and the changelog read at 329, so the ordering is structural rather than conventional. A malformed sibling leaves the primary manifest at the OLD version under an `ok:false` envelope, proven by a test in `release-bump.test.mjs`. Two new refusal codes with their own identities: `unreadable-sibling-manifest` and `unreadable-changelog`. The existing `siblings[]` refusal arm still works for a sibling that is readable but not upgradeable, so the two outcomes are not collapsed. Note: #231 files six further defects in this same seam, found by triaging the capture archive. They are separate from this issue's ordering defect and remain open.

john closed this issue

2026-08-22 19:41:51 +00:00