fix(ci): the suite was green only on the maintainer's Mac (#490)

.github/workflows/publish.yml

@@ -16,10 +16,14 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 22
           cache: npm
           registry-url: https://registry.npmjs.org
 
+      # The suite spawns `bun` (tests/fleet-sidebar.test.ts) and release.sh
+      # shells out to `bun run`. Without it this job fails on toolchain, not code.
+      - uses: oven-sh/setup-bun@v2
+
       - run: npm install --no-package-lock
       - run: npm run typecheck
       - run: npm test

scripts/release.sh

@@ -6,6 +6,7 @@
 #   scripts/release.sh 0.3.0 --yes               # no confirmation prompt
 #   scripts/release.sh 0.3.0 --dry-run           # print every step, change nothing
 #   scripts/release.sh 0.3.0 --require-contract  # a skipped real-cmux gate aborts the release
+#   scripts/release.sh 0.3.0 --require-ci        # a non-green CI on HEAD aborts the release
 #
 # Steps: clean-tree + green build/tests gate → bump package.json → commit +
 # push main → tag vX.Y.Z + push tag → update formula url+sha256 in the
@@ -30,11 +31,15 @@ VERSION="${1:-}"
 YES=0
 DRY=0
 REQUIRE_CONTRACT=0
+REQUIRE_CI=0
+CI_CONCLUSION="unknown"
+CI_COMMIT_LABEL="HEAD"
 for arg in "${@:2}"; do
   case "$arg" in
     --yes) YES=1 ;;
     --dry-run) DRY=1 ;;
     --require-contract) REQUIRE_CONTRACT=1 ;;
+    --require-ci) REQUIRE_CI=1 ;;
     *) echo "unknown flag: $arg" >&2; exit 2 ;;
   esac
 done
@@ -51,6 +56,19 @@ trap cleanup EXIT
 die() { echo "release: $*" >&2; exit 1; }
 run() { if [ "$DRY" -eq 1 ]; then printf 'DRY  %s\n' "$*"; else eval "$@"; fi; }
 
+# In-place sed that works on BSD *and* GNU. `sed -i ''` is BSD-only: GNU sed
+# reads the '' as the script and the expression as a filename, exits 2, and
+# takes this script down with it — which is why every Linux CI run of the
+# release-receipt tests failed while the same tests passed on a Mac.
+# Writes back through the ORIGINAL file rather than mv-ing the tmpfile over it:
+# mv would hand the target the tmpfile's 0600 and owner, a mode change `sed -i`
+# never makes.
+sed_inplace() {
+  local expression="$1" file="$2" tmp
+  tmp="$(mktemp)"
+  sed -E "$expression" "$file" >"$tmp" && cat "$tmp" >"$file" && rm -f "$tmp"
+}
+
 # Receipt writes are never allowed to fail a release: the ledger records the
 # release, it does not gate it.
 receipt() {
@@ -86,6 +104,37 @@ if [ "$DRY" -ne 1 ]; then
   receipt_record "gates.require_contract" "$([ "$REQUIRE_CONTRACT" -eq 1 ] && echo true || echo false)"
 fi
 
+# --- CI status of the commit being released (#490) -------------------------
+# Six tagged releases shipped while publish.yml failed on every single run and
+# cmuxlayer never reached npm at all. Nothing in the release said so. The receipt
+# now carries CI's verdict on the released commit, and the banner prints it, so
+# "the release looked clean" can never again mean "nobody opened the log".
+if [ "$DRY" -eq 1 ]; then
+  printf 'DRY  %s\n' "read CI status for HEAD"
+else
+  # `gh run list --commit` needs the FULL sha; an abbreviated one matches nothing
+  # and would read as `unknown`. Never loosen this to a short sha.
+  RELEASE_COMMIT="$(git rev-parse HEAD)"
+  CI_COMMIT_LABEL="$RELEASE_COMMIT"
+  # An unusable gh -- absent, unauthenticated, offline -- reads as unknown.
+  # Only a real `success` from a real run is allowed to look green.
+  CI_CONCLUSION="$(gh run list --commit "$RELEASE_COMMIT" --workflow ci.yml \
+    --limit 1 --json conclusion --jq '.[0].conclusion' 2>/dev/null || true)"
+  [ -n "$CI_CONCLUSION" ] || CI_CONCLUSION="unknown"
+  receipt_record "gates.ci" "$CI_CONCLUSION"
+  # Name the commit the verdict is ABOUT. The read happens before the version
+  # bump, so this is the commit the release was cut from -- not the tag's commit.
+  # In the one file whose purpose is that a release cannot look cleaner than it
+  # is, "which commit" cannot be left to inference.
+  receipt_record "gates.ci_commit" "$RELEASE_COMMIT"
+  if [ "$CI_CONCLUSION" != "success" ]; then
+    if [ "$REQUIRE_CI" -eq 1 ]; then
+      die "--require-ci: CI for $RELEASE_COMMIT is $CI_CONCLUSION, not success"
+    fi
+    echo "release: WARNING — CI for $RELEASE_COMMIT is $CI_CONCLUSION; recorded in the receipt"
+  fi
+fi
+
 echo "release: gating on typecheck + tests…"
 run "bun run typecheck"
 receipt_record "gates.typecheck" "pass"
@@ -159,7 +208,7 @@ if [ "$YES" -ne 1 ] && [ "$DRY" -ne 1 ]; then
 fi
 
 # --- bump + commit + tag (cmuxlayer) --------------------------------------
-run "sed -i '' -E 's/^(  \"version\": \")[^\"]+(\",)\$/\\1$VERSION\\2/' package.json"
+run "sed_inplace 's/^(  \"version\": \")[^\"]+(\",)\$/\\1$VERSION\\2/' package.json"
 run "git commit -aqm 'chore: release $TAG'"
 run "git push origin main"
 run "git tag -a '$TAG' -m 'cmuxlayer $TAG'"
@@ -189,8 +238,8 @@ receipt_record "artifact.url" "$URL"
 receipt_record "artifact.sha256" "$SHA"
 
 # --- bump formula (homebrew-layers) ---------------------------------------
-run "sed -i '' -E 's|archive/refs/tags/v[0-9]+\.[0-9]+\.[0-9]+\.tar\.gz|archive/refs/tags/$TAG.tar.gz|' '$FORMULA'"
-run "sed -i '' -E 's|^  sha256 \"[0-9a-f]{64}\"|  sha256 \"$SHA\"|' '$FORMULA'"
+run "sed_inplace 's|archive/refs/tags/v[0-9]+\.[0-9]+\.[0-9]+\.tar\.gz|archive/refs/tags/$TAG.tar.gz|' '$FORMULA'"
+run "sed_inplace 's|^  sha256 \"[0-9a-f]{64}\"|  sha256 \"$SHA\"|' '$FORMULA'"
 run "brew audit etanhey/layers/cmuxlayer || true"
 run "git -C '$TAP_DIR' commit -aqm 'cmuxlayer $TAG'"
 run "git -C '$TAP_DIR' push origin main"
@@ -246,6 +295,7 @@ fi
 cat <<EOF
 
 release: done — cmuxlayer $TAG is tagged and the formula is bumped.
+CI: $CI_CONCLUSION (ci.yml on $CI_COMMIT_LABEL — the commit this release was cut from)
 Receipt: $RECEIPT_LABEL
 Next (on EACH Mac — each run appends its own install evidence to the receipt):
   $REPO_DIR/scripts/release-verify.sh "$VERSION"

src/seat-identity.ts

@@ -112,7 +112,16 @@ export function parseSeatRegistryConfig(raw: string): SeatRegistry {
   );
 }
 
-export function defaultSeatRegistryPath(): string {
+/**
+ * The seat registry is a MACHINE file: it says which seats this operator runs.
+ * `CMUXLAYER_SEAT_REGISTRY_PATH` lets a caller — a test, a sandbox, a second
+ * fleet — state its own registry instead of inheriting whatever the host has.
+ */
+export function defaultSeatRegistryPath(
+  env: NodeJS.ProcessEnv = process.env,
+): string {
+  const override = env.CMUXLAYER_SEAT_REGISTRY_PATH?.trim();
+  if (override) return override;
   return join(homedir(), ".golems", "config.yaml");
 }
 

tests/global-setup.ts

@@ -0,0 +1,20 @@
+import { mkdirSync, rmSync } from "node:fs";
+import { join } from "node:path";
+
+/**
+ * One temp root per suite RUN, removed when the run ends.
+ *
+ * See tests/vitest.setup.ts for why. Isolating per run — not per worker — is
+ * exactly right: within a run vitest never executes one test file twice at once,
+ * so the fixed fixture names only collide ACROSS runs.
+ */
+const root = join("/tmp", `cmuxlayer-vitest-${process.pid}`);
+
+export function setup(): void {
+  mkdirSync(root, { recursive: true });
+  process.env.CMUXLAYER_TEST_TMP_ROOT = root;
+}
+
+export function teardown(): void {
+  rmSync(root, { recursive: true, force: true });
+}

tests/live-topology-restart.test.ts

@@ -23,12 +23,16 @@ const SERVERS = new Set<{
   sockets: Set<net.Socket>;
 }>();
 
+// This hook compiles the whole project so the live daemon under test is the
+// real build. That is a minute's work on a loaded CI runner and ~3s on a warm
+// Mac -- vitest's 10s hook default made the file pass locally and time out in
+// CI, which is the same green-only-on-one-machine failure this lane exists for.
 beforeAll(() => {
   execFileSync(resolve("node_modules", ".bin", "tsc"), ["-p", "tsconfig.json"], {
     cwd: process.cwd(),
     stdio: "pipe",
   });
-});
+}, 300_000);
 
 function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === "object" && value !== null;

tests/pre-pr-scripts.test.ts

@@ -124,3 +124,22 @@ describe("pre-PR script ladder", () => {
     expect(script).toContain("exec bun run pre-pr");
   });
 });
+
+describe("release scripts run where CI runs", () => {
+  // `sed -i ''` is BSD-only. GNU sed reads the '' as the script and the real
+  // expression as a filename, exits 2, and takes release.sh down with it — the
+  // reason every Linux run of the release-receipt tests failed while the same
+  // tests passed on the maintainer's Mac.
+  it("keeps release scripts free of the BSD-only in-place sed form", () => {
+    for (const script of ["release.sh", "release-verify.sh"]) {
+      const code = readFileSync(join(repoRoot, "scripts", script), "utf8")
+        .split("\n")
+        .filter((line) => !/^\s*#/.test(line))
+        .join("\n");
+
+      expect(code, `${script} uses BSD-only sed -i ''`).not.toMatch(
+        /sed\s+-i\s+(''|"")/,
+      );
+    }
+  });
+});

tests/ram-watchdog-warn-only.test.ts

@@ -176,7 +176,9 @@ done
   writeFileSync(join(root, "fixtures/memsize.fixture"), "1048576\n");
 }
 
-describe("cmux RAM watchdog warn-only regression", () => {
+// Each case runs a real bash script through spawnSync; vitest's 5s default is
+// the wrong budget for that and flakes under full-suite load.
+describe("cmux RAM watchdog warn-only regression", { timeout: 30_000 }, () => {
   it("turns a watchdog memory breach into notification/snapshot work without SIGKILLing cmux", () => {
     const root = makeRoot("cmux-watchdog-vitest-");
     const logDir = join(root, "logs");

tests/release-receipts.test.ts

@@ -7,6 +7,7 @@ import {
   mkdtempSync,
   readFileSync,
   rmSync,
+  statSync,
   writeFileSync,
 } from "node:fs";
 import { tmpdir } from "node:os";
@@ -74,6 +75,8 @@ function makeReleaseFixture(
     withBrew?: boolean;
     withBrewTapClone?: boolean;
     withNode?: boolean;
+    /** What the stubbed `gh` reports for the released commit; "" = no gh. */
+    ciConclusion?: string;
   } = {},
 ): Fixture {
   const {
@@ -82,6 +85,7 @@ function makeReleaseFixture(
     withBrew = true,
     withBrewTapClone = true,
     withNode = true,
+    ciConclusion = "success",
   } = opts;
 
   const root = makeRoot("cmuxlayer-release-receipts-");
@@ -208,6 +212,17 @@ exit 0
     );
   }
 
+  writeExecutable(
+    join(binDir, "gh"),
+    `#!/usr/bin/env bash
+printf 'gh %s\\n' "$*" >>"$STUB_LOG"
+# An unusable gh (absent, unauthenticated, offline) must read as "unknown",
+# never as "clean" -- so this stub fails the way the real one does.
+[ -n "$STUB_CI_CONCLUSION" ] || exit 1
+printf '%s\\n' "$STUB_CI_CONCLUSION"
+`,
+  );
+
   if (!withNode) {
     writeExecutable(
       join(binDir, "node"),
@@ -227,6 +242,7 @@ exit 127
     STUB_BREW_REPO: brewRepo,
     STUB_INSTALLED_VERSION: installedVersion ?? "",
     STUB_CONTRACT_OUTPUT: contractOutput,
+    STUB_CI_CONCLUSION: ciConclusion,
     CMUXLAYER_TAP_DIR: tapDir,
     CMUXLAYER_RELEASE_RECEIPTS_DIR: receiptsDir,
     CMUXLAYER_RECEIPT_HOST: "test-mac",
@@ -409,7 +425,9 @@ describe("release receipt ledger CLI", () => {
   });
 });
 
-describe("release.sh receipts", () => {
+// These run the real release scripts end to end through stubbed binaries, so
+// vitest's 5s default is the wrong budget and flakes under full-suite load.
+describe("release.sh receipts", { timeout: 30_000 }, () => {
   it("writes a release receipt with version, sha256, commit and gate results", () => {
     const fixture = makeReleaseFixture();
     const result = runScript(fixture, "release.sh", ["0.4.1", "--yes"]);
@@ -432,6 +450,70 @@ describe("release.sh receipts", () => {
     );
   });
 
+  // #490: publish.yml failed on 105 consecutive runs and cmuxlayer never reached
+  // npm, because a release's own receipt said nothing about CI. It does now.
+  it("records the CI verdict for the commit being released", () => {
+    const fixture = makeReleaseFixture();
+    const result = runScript(fixture, "release.sh", ["0.4.1", "--yes"]);
+
+    expect(result.status).toBe(0);
+    const receipt = readReceipt(fixture, "0.4.1");
+    expect(receipt.gates.ci).toBe("success");
+    // The verdict names the commit it is ABOUT. The read happens before the
+    // version bump, so it is the commit the release was cut from, not the tag's.
+    expect(receipt.gates.ci_commit).toBe("1".repeat(40));
+    // `gh run list --commit` matches nothing on an abbreviated sha, so a short
+    // one would silently read as "unknown". Keep the full form.
+    expect(result.log).toContain(`gh run list --commit ${"1".repeat(40)}`);
+    expect(result.stdout).toContain(
+      `CI: success (ci.yml on ${"1".repeat(40)} — the commit this release was cut from)`,
+    );
+  });
+
+  it("bumps package.json without changing its file mode", () => {
+    const fixture = makeReleaseFixture();
+    const manifest = join(fixture.repoDir, "package.json");
+    chmodSync(manifest, 0o640);
+
+    const result = runScript(fixture, "release.sh", ["0.4.1", "--yes"]);
+
+    expect(result.status).toBe(0);
+    expect(statSync(manifest).mode & 0o777).toBe(0o640);
+  });
+
+  it("never lets a release read as clean while its CI is red", () => {
+    const fixture = makeReleaseFixture({ ciConclusion: "failure" });
+    const result = runScript(fixture, "release.sh", ["0.4.1", "--yes"]);
+
+    expect(result.status).toBe(0);
+    expect(readReceipt(fixture, "0.4.1").gates.ci).toBe("failure");
+    expect(result.stdout).toContain("WARNING");
+    expect(result.stdout).toContain("CI: failure");
+  });
+
+  it("records an unusable gh as unknown rather than as a pass", () => {
+    const fixture = makeReleaseFixture({ ciConclusion: "" });
+    const result = runScript(fixture, "release.sh", ["0.4.1", "--yes"]);
+
+    expect(result.status).toBe(0);
+    expect(readReceipt(fixture, "0.4.1").gates.ci).toBe("unknown");
+    expect(result.stdout).toContain("WARNING");
+  });
+
+  it("refuses to release on a non-green CI under --require-ci", () => {
+    const fixture = makeReleaseFixture({ ciConclusion: "failure" });
+    const result = runScript(fixture, "release.sh", [
+      "0.4.1",
+      "--yes",
+      "--require-ci",
+    ]);
+
+    expect(result.status).not.toBe(0);
+    // The die message, not `unknown flag: --require-ci`.
+    expect(result.stderr).toContain("release: --require-ci");
+    expect(result.log).not.toContain("git push origin main");
+  });
+
   it("preserves the happy-path release commands (receipts stay additive)", () => {
     const fixture = makeReleaseFixture();
     const result = runScript(fixture, "release.sh", ["0.4.1", "--yes"]);
@@ -595,7 +677,7 @@ describe("release.sh receipts", () => {
   });
 });
 
-describe("release-verify.sh", () => {
+describe("release-verify.sh", { timeout: 30_000 }, () => {
   it("verify-only never upgrades and never resets Homebrew's tap clone", () => {
     const fixture = makeReleaseFixture({ installedVersion: "0.4.1" });
     const result = runScript(fixture, "release-verify.sh", [

tests/seat-identity.test.ts

@@ -1,6 +1,11 @@
+import { existsSync } from "node:fs";
+import { homedir, tmpdir } from "node:os";
+import { join } from "node:path";
 import { describe, expect, it } from "vitest";
 import {
   assertSeatIdentity,
+  defaultSeatRegistryPath,
+  loadSeatRegistryFromConfig,
   type SeatRegistry,
 } from "../src/seat-identity.js";
 
@@ -104,3 +109,27 @@ describe("seat identity uniqueness", () => {
     });
   });
 });
+
+describe("seat registry source", () => {
+  it("lets the caller point the seat registry away from the machine's ~/.golems", () => {
+    const pinned = join(tmpdir(), "cmuxlayer-seat-registry-fixture.yaml");
+
+    expect(
+      defaultSeatRegistryPath({ CMUXLAYER_SEAT_REGISTRY_PATH: pinned }),
+    ).toBe(pinned);
+    expect(defaultSeatRegistryPath({})).toBe(
+      join(homedir(), ".golems", "config.yaml"),
+    );
+  });
+
+  // The suite once asserted `brainClaude` — a seat that exists only in the
+  // maintainer's ~/.golems/config.yaml. It was green on that Mac and red on
+  // every CI runner for days. Tests state their own registry or get none.
+  it("never resolves the seat registry from the machine running the suite", () => {
+    const pinned = defaultSeatRegistryPath();
+
+    expect(pinned).not.toBe(join(homedir(), ".golems", "config.yaml"));
+    expect(existsSync(pinned)).toBe(false);
+    expect(loadSeatRegistryFromConfig()).toBeNull();
+  });
+});