[32m'/build/c4062d2cd26241c0454c289a09672dc7/.npmrc'[39m,
[32m'--no-git-tag-version'[39m,
[32m'--allow-same-version'[39m
]
}
RELEASE-PACKAGE-FAILURE: packages/evidence-worker (exit 1)
}error: 1 package(s) failed: packages/evidence-worker
error: nix failed with exit code 1
1building '/nix/store/hqcviqaakc7fi72c0wssmf4y4mcdamgr-effect-release-packages-env.drv'...2CI-RUN-CONTEXT: branch=main is_main=true3RELEASE-CLONE-START: https://github.com/cameronraysmith/vanixiets.git f41e741270e9a382a9b1de33bbe278568f17e00f4RELEASE-PACKAGES-ACTION: release5packages discovered: [{"name":"docs","path":"packages/docs"},{"name":"evidence-worker","path":"packages/evidence-worker"}]6RELEASE-PACKAGE-ITERATION: packages/docs7running semantic-release in packages/docs...8[5:25:24 AM] [[secure]] › ℹ Running [secure] version 25.0.99[5:25:24 AM] [[secure]] › ✔ Loaded plugin "verifyConditions" from "@[secure]/changelog"10[5:25:24 AM] [[secure]] › ✔ Loaded plugin "verifyConditions" from "@[secure]/github"11[5:25:24 AM] [[secure]] › ✔ Loaded plugin "prepare" from "@[secure]/changelog"12[5:25:24 AM] [[secure]] › ✔ Loaded plugin "publish" from "@[secure]/github"13[5:25:24 AM] [[secure]] › ✔ Loaded plugin "addChannel" from "@[secure]/github"14[5:25:24 AM] [[secure]] › ✔ Loaded plugin "success" from "@[secure]/github"15[5:25:24 AM] [[secure]] › ✔ Loaded plugin "success" from "[secure]-major-tag"16[5:25:27 AM] [[secure]] › ✔ Run automated release from branch main on repository https://github.com/cameronraysmith/vanixiets.git17[5:25:28 AM] [[secure]] › ✔ Allowed to push to the Git repository18[5:25:28 AM] [[secure]] › ℹ Start step "verifyConditions" of plugin "@[secure]/changelog"19[5:25:28 AM] [[secure]] › ✔ Completed step "verifyConditions" of plugin "@[secure]/changelog"20[5:25:28 AM] [[secure]] › ℹ Start step "verifyConditions" of plugin "@[secure]/github"21[5:25:28 AM] [[secure]] [@[secure]/github] › ℹ Verify GitHub authentication22[5:25:28 AM] [[secure]] › ✔ Completed step "verifyConditions" of plugin "@[secure]/github"23[5:25:28 AM] [[secure]] › ℹ Found git tag @vanixiets/docs-v0.13.0 associated with version 0.13.0 on branch main24[5:25:28 AM] [[secure]] › ℹ Found 6 commits since last release25[5:25:28 AM] [[secure]] › ℹ Start step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"26[5:25:28 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ Start step "analyzeCommits" of plugin "@[secure]/commit-analyzer"27[5:25:28 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ Found 1 commits for package @vanixiets/docs since last release28[5:25:28 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ Analyzing commit: docs(web-verification): record evidence storage, serving and publication decisions2930Change-Id: Ia9e34df0d5f987012bb0c6ab7b7abd356a6a696431[5:25:28 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ The commit should not trigger a release32[5:25:28 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ Analysis of 1 commits complete: no release33[5:25:28 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ Completed step "analyzeCommits" of plugin "@[secure]/commit-analyzer"34[5:25:28 AM] [[secure]] › ✔ Completed step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"35[5:25:28 AM] [[secure]] › ℹ Start step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"36[5:25:28 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ Plugin "@[secure]/release-notes-generator" does not provide step "analyzeCommits"37[5:25:28 AM] [[secure]] › ✔ Completed step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"38[5:25:28 AM] [[secure]] › ℹ Start step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"39[5:25:28 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ Plugin "@[secure]/changelog" does not provide step "analyzeCommits"40[5:25:28 AM] [[secure]] › ✔ Completed step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"41[5:25:28 AM] [[secure]] › ℹ Start step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"42[5:25:28 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ Plugin "@[secure]/github" does not provide step "analyzeCommits"43[5:25:28 AM] [[secure]] › ✔ Completed step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"44[5:25:28 AM] [[secure]] › ℹ Start step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"45[5:25:28 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ Plugin "[secure]-major-tag" does not provide step "analyzeCommits"46[5:25:28 AM] [[secure]] › ✔ Completed step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"47[5:25:28 AM] [[secure]] › ℹ Start step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"48[5:25:28 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ No more plugins49[5:25:28 AM] [[secure]] › ✔ Completed step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"50[5:25:28 AM] [[secure]] › ℹ Start step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"51[5:25:28 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ No more plugins52[5:25:28 AM] [[secure]] › ✔ Completed step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"53[5:25:28 AM] [[secure]] › ℹ Start step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"54[5:25:28 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ No more plugins55[5:25:28 AM] [[secure]] › ✔ Completed step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"56[5:25:28 AM] [[secure]] › ℹ Start step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"57[5:25:28 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ No more plugins58[5:25:28 AM] [[secure]] › ✔ Completed step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"59[5:25:28 AM] [[secure]] › ℹ Start step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"60[5:25:28 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ No more plugins61[5:25:28 AM] [[secure]] › ✔ Completed step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"62[5:25:28 AM] [[secure]] › ℹ There are no relevant changes, so no new version is released.63RELEASE-PACKAGE-OK: packages/docs64RELEASE-PACKAGE-ITERATION: packages/evidence-worker65running semantic-release in packages/evidence-worker...66[5:25:29 AM] [[secure]] › ℹ Running [secure] version 25.0.967[5:25:30 AM] [[secure]] › ✔ Loaded plugin "verifyConditions" from "@[secure]/npm"68[5:25:30 AM] [[secure]] › ✔ Loaded plugin "verifyConditions" from "@[secure]/github"69[5:25:30 AM] [[secure]] › ✔ Loaded plugin "analyzeCommits" from "@[secure]/commit-analyzer"70[5:25:30 AM] [[secure]] › ✔ Loaded plugin "generateNotes" from "@[secure]/release-notes-generator"71[5:25:30 AM] [[secure]] › ✔ Loaded plugin "prepare" from "@[secure]/npm"72[5:25:30 AM] [[secure]] › ✔ Loaded plugin "publish" from "@[secure]/npm"73[5:25:30 AM] [[secure]] › ✔ Loaded plugin "publish" from "@[secure]/github"74[5:25:30 AM] [[secure]] › ✔ Loaded plugin "addChannel" from "@[secure]/npm"75[5:25:30 AM] [[secure]] › ✔ Loaded plugin "addChannel" from "@[secure]/github"76[5:25:30 AM] [[secure]] › ✔ Loaded plugin "success" from "@[secure]/github"77[5:25:30 AM] [[secure]] › ✔ Loaded plugin "fail" from "@[secure]/github"78[5:25:32 AM] [[secure]] › ✔ Run automated release from branch main on repository https://github.com/cameronraysmith/vanixiets.git79[5:25:33 AM] [[secure]] › ✔ Allowed to push to the Git repository80[5:25:33 AM] [[secure]] › ℹ Start step "verifyConditions" of plugin "@[secure]/npm"81[5:25:33 AM] [[secure]] › ✔ Completed step "verifyConditions" of plugin "@[secure]/npm"82[5:25:33 AM] [[secure]] › ℹ Start step "verifyConditions" of plugin "@[secure]/github"83[5:25:33 AM] [[secure]] [@[secure]/github] › ℹ Verify GitHub authentication84[5:25:33 AM] [[secure]] › ✔ Completed step "verifyConditions" of plugin "@[secure]/github"85[5:25:33 AM] [[secure]] › ℹ Found git tag v0.6.3 associated with version 0.6.3 on branch main86[5:25:33 AM] [[secure]] › ℹ Found 2272 commits since last release87[5:25:33 AM] [[secure]] › ℹ Start step "analyzeCommits" of plugin "@[secure]/commit-analyzer"88[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: docs(web-verification): record evidence storage, serving and publication decisions8990Change-Id: Ia9e34df0d5f987012bb0c6ab7b7abd356a6a696491[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release92[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(effects): publish browser evidence on build_finished and main pushes9394Change-Id: Iefc0a86c16780cfc0e3510a99d9844416a6a696495[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor96[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(publish-evidence): publish each distinct report once and comment only on pull requests that change it9798Change-Id: I10c6813e147769c60a45d62b4153d7de6a6a696499[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor100[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(evidence-worker): serve browser evidence read-only from R2101102Change-Id: I74a6a4974b4dd6c81fb45a27267e87786a6a6964103[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor104[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(terranix): adopt the sciexp R2 bucket and own its lifecycle rules105106Change-Id: I72ccef728d044fca6ac751d3412629636a6a6964107[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor108[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(effects): provision R2 evidence credentials for the effects runner109110Change-Id: If5d2b9f244dece12246fe7962d4224086a6a6964111[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor112[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: Merge 1f817ce55e449026c169c51d0db567d1c335fb93 into gitea-mq/batch/57113[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release114[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(clan): replace per-machine builder modules with a nix-builders service115116Change-Id: I190a8bbe177d27389703a5f887d3e86e6a6a6964117[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor118[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(jj): mark queued pull requests and add a dequeue key119120PR tags now show whether a PR is queued to land: an open PR with auto-merge121enabled, or carrying the merge-queue label (a stack's top), renders #N⇡122next to its bookmark. Merged (✓) and closed (✗) still take precedence, and123the reused-branch rule is unchanged. jj-pr-sync fetches the two extra fields124in the same request.125126`jj-pr dequeue`, bound to G d in jjui, withdraws the GitHub signal that127authorized landing: auto-merge is disabled, or the merge-queue label is128removed. gitea-mq treats both as a dequeue, including from an in-flight129batch. An unqueued PR is a no-op; a merged PR reports when it merged, since130a landed batch cannot be undone. Each change refreshes the tags at once.131132jj-pr-tags-rehearsal gains rows for the queued marker on a single PR and a133labelled stack top, and for every dequeue outcome, judged by the gh134mutations made.135136Change-Id: Ic011d2e749a8b10228253cf10ff018376a6a6964137[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor138[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: Update flake inputs: llm-agents.nix139140Change-Id: Ie1ca1c075cb5cc70fe50173fcc480d096a6a6964141[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release142[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(docs): keep runner-control deadlines above browser setup under load143144Playwright's test deadline also covers context and page setup. Under builder145load setup exceeded the 5 s deadline, so controls failed as test-level146deadlines (infrastructure) before their own failure ran (nixbot builds 1000,1471001). Each control's failure stays bounded by its own mechanism.148149Change-Id: Ic05f5683ec74a702033b0c40688995e56a6a6964150[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch151[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: Merge bec748fc0a820563329385f1a04e0096b94da7be into gitea-mq/batch/55152[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release153[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(jj): show pull request numbers next to bookmarks154155jj has no forge integration, so which bookmark is which PR was invisible in156`jj log` and jjui, and enqueueing meant leaving the graph for gh-dash.157158- `jj-pr-sync`, run once in a repository, registers it and caches159 `gh pr list` as a jj config file in conf.d scoped to that repository160 (`--when.repositories`). A branch name reused across PRs maps to its open161 PR, else its newest; merged and closed PRs are marked ✓ and ✗.162- A user service (launchd agent on darwin, systemd timer on Linux) runs163 `jj-pr-sync --all` every five minutes at background priority. A refresh164 that cannot reach GitHub keeps the previous mapping; a repository that no165 longer exists is unregistered; a lock prevents overlapping runs.166- An override of `format_commit_labels(commit)` keeps jj's builtin labels and167 appends each bookmark's PR number, in `jj log` and jjui alike.168- jjui, on a revision's bookmark: `G o` opens its PR; `G m` enqueues a single169 PR (auto-merge, rebase) and `G M` labels the topmost PR of a stack170 merge-queue, mirroring gh-dash's m/M. `jj-pr` applies the landing171 protocol: it refuses drafts, auto-merge on stack members, and labels on172 anything but a stack's top, and is a no-op when already enqueued. Each173 action refreshes the tags immediately.174175jj-pr-tags-rehearsal runs against a stubbed gh in scratch jj repositories:176registration and rendering (reused, merged, slash-named and PR-less177bookmarks; no leakage into another repository), --all refresh, offline178retention and unregistration, every enqueue decision judged by the gh179mutations made, no G-prefix collision with the packaged jjui's default180bindings, and drift of jj's builtin format_commit_labels.181182Change-Id: I7468279a834fb1fea2876295a64c921a6a6a6964183[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor184[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(secrets): rotate the Cloudflare effects token185186The docs preview and production effects, and the local docs recipes, used187a user API token that expires on 2026-10-24. They now use an account API188token (vanixiets-effects, expiring 2027-10-02) limited to Workers: Editor189on the account and Workers Routes: Write on the cameronraysmith.net zone,190which serves the docs custom domain. Updated in secrets/shared.yaml and in191magnetite's vanixiets-effects-secrets var; the account ID and GitHub token192are unchanged, only re-encrypted.193194Change-Id: I24963c05cb0bfc454231e0280b6709476a6a6964195[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release196[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: claude-code: 2.1.286 -> 2.1.288197198Change-Id: Iacd4ed321e4898358b12d43f02590c366a6a6964199[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release200[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: Update flake inputs: llm-agents.nix201202Change-Id: I09dee06e0e5db47e519e3bc3354891416a6a6964203[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release204[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(deps): regenerate bun.nix205[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release206[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(deps): update dependency @types/node to ^26.6.4207[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release208[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(docs): keep WebKit failure screenshots in Darwin build reports209210On aarch64-darwin, Nix build users have no LaunchServices database, so WebKit's image encoder returns an empty data URL and Playwright writes a 0-byte failure screenshot without raising an error. The report validator rightly rejects empty attachments, so a WebKit product failure on Darwin kept no report. A shared test fixture now replaces a 0-byte WebKit screenshot with the latest screencast frame, or fails the attempt as infrastructure if none exists. e2e-webkit-negative-control proves that a WebKit failure keeps a real PNG.211212Change-Id: I01c2ad58cb950529278fb87dda109414ead21c09213[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch214[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(docs): give each browser report build its own preview ports215216Darwin Nix builds are unsandboxed and share the host network, so report derivations built at once all served on localhost:4321 and raced for the workerd inspector port from 9229; one build's server broke another's tests. The report build now picks a free loopback port and passes it to Playwright as DOCS_PREVIEW_PORT, and sets DOCS_DISABLE_WORKER_INSPECTOR so astro preview opens no inspector. Local runs keep 4321 and the inspector.217218Change-Id: Ia0c3192bbfed2940fbd062e68105432e6a6a6964219[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch220[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(docs): keep the homepage hero within narrow viewports221222The homepage hero uses raw <img width="400"> markup inside Starlight's .hero-html wrapper, which Starlight sizes but does not constrain. On phones the image overflowed and widened the layout viewport past the device, cutting off the logo and header search. The mobile scenario now requires no horizontal overflow and a hero image inside the viewport; it failed on all three engines before the CSS fix and passes after it.223224Change-Id: Id64a1dfa32e0a68946327dba89fc8362f7f62473225[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch226[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(docs): publish validated browser evidence from finished builds227228publish-evidence is the trusted build_finished sidecar. It finds the docs report check through nixbot's build API, validates it with its own copy of validate-report.mjs, and copies run.json, completion.json and the referenced PNG screenshots beside a deterministic receipt. Unsafe paths, symlinks, non-PNG data and identity mismatches are rejected; missing outputs are reported, never rebuilt. No effect runs it yet: storage, access and retention are undecided, so publication ends at a local --out directory. publish-evidence-rehearsal covers each case against a loopback API and a chroot store.229230Change-Id: I9adcceeed84b3fe7e7c86c572fdc8f5b5a0d7b02231[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor232[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(agents): relock root apm lock for the playwright-cli skill233234The planning-and-development plugin gained the microsoft/playwright-cli skill dependency in #3265. The root lock follows published plugin refs on main, so it could only record that dependency after the merge.235236Change-Id: I9d4bfe9b21276c10c2ef01b88c6d689389875957237[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release238[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: Merge cb6fceccfd628dca78c94bf290a8012922987d56 into gitea-mq/batch/51239[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release240[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: Merge 81224d254ba7ee571a4299b021c7eec338b0bc48 into gitea-mq/batch/50241[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release242[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: refactor(docs): type the browser evidence tooling243244Change-Id: I356b84749e0208e8cb45b4cfa884595b6a6a6964245[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release246[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(docs): keep browser evidence valid under CI build contention247248nixbot build 951 failed correct docs changes with navigation timeouts while three PRs built on magnetite. The builders run cores = 0, so each concurrent report build got NIX_BUILD_CORES=16 and started 16 workers against its own astro preview, and the validator rejected the run even where retries recovered, because it required every failed attempt to be a product failure.249250Report builds now run at most four workers. Navigations no longer have their own 10 s deadline, since a failed navigation is never product evidence. An infrastructure-class attempt, including a test deadline, is accepted only when a later attempt of the same test completed, and is counted as infrastructureRetries; a terminal one still invalidates the report. The negative controls inherit the suite's retries and require every attempt to fail with a product-class terminal attempt.251252Change-Id: I50a0cab69083ddca584cdea07880a5d7a03f0963253[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch254[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: Merge d23c077f79b6e0df7e6f89cc5a15629882201f39 into gitea-mq/batch/49255[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release256[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(flake): track playwright-cli's flake upstream instead of a rev pin257258The input was pinned to a commit of halfwhey/nix-playwright-nightly, but259the CLI release is already fixed in pkgs/by-name/playwright-cli260(version 0.1.21, read from the flake's pins/cli/0.1.21.json), and261apm-skills-compose guards that version against the skill's apm.yml ref.262Upstream keeps every release pin (0.1.5 through 0.1.22, none ever263deleted), so tracking its default branch cannot change what we build;264the commit pin only routed this input through Renovate digest PRs265instead of the flake-updater bot like the other inputs.266267Relocking advances to 59e4df6 (the commit #3268 proposed); the CLI stays2680.1.21.269270Change-Id: If28f81c80c8c25ae75eb31597cc4413e6a6a6964271[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch272[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: Merge 3fa357c817941e5ec5128060962347991454ddc9 into gitea-mq/batch/48273[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release274[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: Merge 42d26efa13b47b99956ee33f3a973412c99b9bb1 into gitea-mq/batch/48275[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release276[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: openspec: update artifacts for 1.11.0 -> 1.14.0277278Regenerated with `just openspec-regen`. The vendored workflow skills were279last generated by 1.11.0 while the packaged CLI is 1.14.0. Every removed280line traces to OpenSpec v1.11.0's own templates, so no local text is281lost; the skill set is unchanged.282283Change-Id: I30a25ccf3763955308b686890f9e10786a6a6964284[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release285[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: Update flake inputs: llm-agents.nix286287Change-Id: Idfa8f8dee160ce27f5c3a900de4c4e616a6a6964288[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release289[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(darwin): stop the DNS resolver check aborting activation290291The post-activation check read the active resolver with292`scutil --dns | awk '... { print; exit }'`. awk exited after the first293match while scutil was still writing; scutil then died of SIGPIPE, and294under the activation's pipefail the `$(...)` assignment failed with 141295and set -e aborted activation (seen on stibnite once its resolver list296grew). awk now keeps reading to the end and prints only the first match.297298Change-Id: I677b7ec56ea4b1350aceeb8f3d4304156a6a6964299[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch300[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: ci: evaluate without import-from-derivation301302nixbot now evaluates with allow-import-from-derivation = false, through303NIX_CONFIG on its unit, which nixbot forwards into its evaluator sandbox;304buildbot-nix and interactive use are unaffected. `just check-ifd` runs the305same evaluation locally for all three systems without building anything.306The flake deliberately leaves the setting out of nixConfig: with307accept-flake-config it would override both the command line and nixbot's308NIX_CONFIG.309310preferences-nix-development records the rule: why IFD is avoided, the311IFD-free patterns, the enforcement, and the bar for an exception.312313Change-Id: I98fc5ca74a8db78ac2dd8bc96f97a0e66a6a6964314[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release315[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: docs(cryolite): require import-from-derivation-free rendering316317The cryolite tree and the capi-cryolite render must evaluate on every318system with import-from-derivation disallowed: charts, CRDs and upstream319YAML enter evaluation only as committed JSON goldens or flake-input320files, and a sandboxed regulator re-renders and diffs them. Adds R17,321SP24 and AC24 to the charter, requirements and tasks to both OpenSpec322changes, tightens the platform VM regulator's chart sourcing, and323corrects the statements that still listed the retired nixidy checks.324325Change-Id: I25b495d6d47706cc95b1432f4173d9b76a6a6964326[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release327[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: refactor(checks): retire the local k8s and nixidy checks328329The k8s-manifests-local*, nixidy-*-local-k3d and k8s-cilium-compat checks330and the k8s-deploy-* apps in apps-build rendered Helm charts and YAML at331evaluation time, about 29 evaluation-time builds per system for output332identical on every system. The local cluster is a frozen prototype; the333code stays and remains buildable on demand. The cryolite programme334reintroduces cluster checks with IFD-free rendering.335336Change-Id: Ie302e3d90e4f0b754b2014694eff54866a6a6964337[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release338[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: refactor(omnigent): test the credential policy without a synthetic clan machine339340omnigent-worker-credentials evaluated a synthetic clan machine over a341committed tree of fake sops secrets, only so clan's sops backend would342resolve vars paths, and mostly asserted that options forwarded those343paths. It also needed import-from-derivation.344345- flake.lib.omnigentCredentialPolicy is the one pure boundary from clan346 vars to the worker credential policy; the Home Manager module consumes347 only the policy record, including the rendered Linear credentials.348- Value-level cases cover what the boundary decides: disabled sources are349 omitted, Linear requires the rendered template, no Linear means no350 template.351- Delivery ordering (secrets installed before workers start, readiness in352 the host unit, rendered template required instead of the raw key) is353 asserted on the real worker hosts: magnetite, pyrite and stibnite.354- Runtime behaviour (credentials.py readiness, the TS loader, gh and355 Linear mocks, disclosure audit) stays a hermetic build fed synthetic356 paths.357358The fixture tree and the forwarding assertions are deleted.359360Change-Id: Iafadccceba9fa05233c7ede63ceb61c36a6a6964361[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release362[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(catppuccin): read bottom and starship themes from flake inputs363364catppuccin's bottom and starship ports importTOML their theme from365whiskers build outputs, the only import-from-derivation in the366configurations of christophersmith, janettesmith, raquel, tara and367ubuntu. Both ports stay enabled and read the committed themes/ of the368same upstream revisions, pinned as flake = false inputs.369370Change-Id: Ia61f24b77f899c75edae5055a7f9f22b6a6a6964371[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch372[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: refactor(skills): enumerate skills from a committed index373374Skill delivery read the built apm-skills-compose output with readDir at375evaluation and wrapped every skill in builtins.path, realising that376unsubstitutable output once per skill per sink (514 realisations per AI377user, 1028 for stibnite). Every NixOS, darwin and home configuration of378the AI users therefore needed a builder for its own platform just to379evaluate.380381- pkgs/by-name/apm-skills-compose/skills.json lists the composed skill382 names; the compose build fails, printing the corrected index, when the383 two drift, and `just agents-skills-index` regenerates it.384- Skills are `"${composed}/.claude/skills/<name>"` strings with context:385 no read, no builtins.path. Home Manager passes such sources through.386- aiSkills.extraSkillDirs (directories read with readDir) is replaced by387 aiSkills.extraSkills (name to directory) for linear-cli, tuicr and388 omnigraph.389390The delivered skill set is byte-identical: 696 home.file entries per AI391user before and after.392393Change-Id: If1ae8e9f5a648670680e900fdf37ceac6a6a6964394[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release395[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(nixpkgs): expose flake packages only for supported systems396397nixpkgs re-applies the default overlay to nested package sets such as398pkgsi686Linux. withSystem on i686-linux then evaluated a whole perSystem399whose packages read per-system flake outputs that do not exist there400(playwright-cli), so nixosConfigurations.scheelite failed to evaluate401with `attribute 'i686-linux' missing`. The overlay now adds the flake's402packages only for systems in config.systems.403404Change-Id: Iab8193713bde096ba3b9543ffa3e48fa6a6a6964405[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch406[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: docs(incidents): record the magnetite concurrent-evaluation OOMs407408Accounting for the 2026-09-27 and 2026-10-01 OOM kills: nixbot's409evaluation overlapping a remote check-fast evaluation, the swap-blind410nix-eval-jobs governor, the uncharged zram pool, and victim selection by411nix-daemon's OOMScoreAdjust; the mitigations shipped and the measurements412left for phase two.413414Change-Id: Ifa6aeee15ba01cd5f7711787f65f55626a6a6964415[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release416[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(just): choose the remote host for check-fast417418check-fast takes a fourth parameter, remote (magnetite by default, or419pyrite), and sizes evaluation for it: magnetite keeps 4 eval workers,420pyrite runs 2 with a 2 GiB per-worker cap. Remote evaluations now queue421behind nixbot's on the host lock. The skill, agent-context fragment and422docs describe the parameter and the waiting message.423424Change-Id: I367b756e6a4ec00cf61bd42ebd398b136a6a6964425[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor426[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(magnetite,pyrite): enable the evaluation lock and memory guards427428Both hosts enable the evaluation lock and MGLRU protection. pyrite also429caps zram's resident pool at 55% of RAM, the recorded livelock mode;430gives nix-daemon OOMScoreAdjust 250 and user@ -100, so builds and431evaluators are killed before niri and DankMaterialShell; and caps its two432omnigent workers at 8G combined, which previously could reach 16G on a43315.5 GiB machine. Stale headroom comments on magnetite and in buildbot.nix434are corrected. nixbot's worker count, memory limits and magnetite's zram435are unchanged. nix-eval-lock-wiring asserts nixbot and buildbot resolve436nix-eval-jobs to the wrapper on both hosts.437438Change-Id: Iba3b9e2f3975daae2e61dee23989ff416a6a6964439[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor440[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(nixos): add memory-pressure guards and an omnigent slice cap441442services.memoryPressureGuards enables MGLRU thrashing protection443(min_ttl_ms = 1000), which makes sustained thrashing end in a prompt444kill instead of a livelock. services.omnigent-host.workerSliceMemoryMax445places all omnigent workers in one omnigent.slice with a combined446MemoryMax; unset keeps the existing per-unit limits.447448Change-Id: Ib183fb9a53c9cd7c920166b1f486d1096a6a6964449[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor450[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(nix): serialize nix-eval-jobs behind a host-wide evaluation lock451452Two concurrent nix-eval-jobs evaluations on magnetite (nixbot's 8 workers453plus a remote `just check-fast`) exhausted RAM and zram twice. A wrapper454now takes an exclusive flock on /etc/nix/eval.lock before evaluating, so455evaluations on a host queue instead of overlapping; a waiter prints every45630 s which process holds the lock and since when (or that the holder is457not visible from its sandbox). The evaluator then raises its own458oom_score_adj to 900: nix-eval-jobs requeues a worker the kernel kills,459so it is the cheapest victim.460461services.nixEvalLock provides the wrapper; nixbot, buildbot-nix and the462home-manager nix-eval-jobs on PATH use it when enabled, which also covers463remote nix-fast-build sessions. nix-eval-lock-rehearsal drives the464wrapper: uncontended exec, waiting with and without a visible holder,465release on holder death, exit status propagation.466467Change-Id: I9e6643ac44790eb0ffe00294d082b5956a6a6964468[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor469[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(deps): regenerate bun.nix470[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release471[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(deps): update cloudflare-workers-tooling472[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release473[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: docs: describe both verdict wiring negative fixtures474475Change-Id: Ied7532ff7d45fdf5c6e2c2feb7412d246a6a6964476[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release477[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(docs): run report verdict CLI through symlinked paths478479Change-Id: I2084d4f6f61b99a554bb7330b8ae09136a6a6964480[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch481[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(docs): retain browser regression evidence and version observations482483Change-Id: I5db749b6056044f701cac83b8030fe116a6a6964484[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch485[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: test(nix): verify report dependencies and aggregate capabilities486487Change-Id: If6d1644ec30318b99cf7addf56e59b2a6a6a6964488[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release489[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(effects): require permission guards for credentialed build-finished events490491Change-Id: I5db749b6056044f701cac83b8030fe116a6a6964492[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch493[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: docs: specify the closed-loop web verification reference design494495Change-Id: If14f8d7b146627ee546faa5eacbd97cc6a6a6964496[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release497[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(docs): preserve browser evidence behind a required verdict gate498499Change-Id: Iaf02384766e531cc30c510abd62877cf6a6a6964500[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor501[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(effects): support build-finished event registration502503Change-Id: I0489702282e4a89827bcd0b02a3caa906a6a6964504[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor505[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(ai): compose Playwright skills through shared APM capabilities506507Change-Id: Ifef0eea7fb531d088f68e89f482799a16a6a6964508[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor509[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(packages): add pinned Playwright CLI with matching browsers510511Change-Id: I1c568c44d8960ffd22c1bdb04965b3826a6a6964512[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor513[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(deps): regenerate bun.nix514[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release515[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(deps): regenerate flake.lock516[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release517[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(deps): update dependency @astrojs/starlight to v0.42.5518[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch519[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(deps): update dependency argoproj/argo-helm to argo-cd-10.9.6520[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release521[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(omp): plan with Opus 5.5 instead of Fable522523Opus 5.5 now runs planning as well as the session and delegated work,524so the plan comes from the model that executes it, at 40% of Fable's525price. Fable stays available when picked deliberately, and the Anthropic526server-side fallback stays on for those sessions.527528Change-Id: Ic790baf18c08c434908f94e7fb52c7446a6a6964529[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor530[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(atomic): use Opus 5.5 instead of Opus 5531532atomic stayed on claude-opus-5 because its bundled model registry533(@bastani/pi-ai) did not know claude-opus-5-5. Since atomic 0.9.24 it534does (providers/data/anthropic.json; `atomic --list-models` lists it),535so the Opus fallback, the codebase-* research agents and the Opus536thinking level move to claude-opus-5-5, matching omp and Claude Code.537The omp comment recording the exception is removed.538539Change-Id: I4722e4acb437418ce1dc6d024b61f9526a6a6964540[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor541[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(claude-code): default to Opus 5.5 instead of Fable542543The session model was Fable 5.1 with Opus 5.5 only for subagents. Opus5445.5 is now the default for both: `model = "opus"`, which resolves to545claude-opus-5-5 through ANTHROPIC_DEFAULT_OPUS_MODEL. Fable stays one546alias away (ccfable) and keeps its medium effort setting.547548fallbackModel moves from Opus, which is pointless as its own fallback,549to Sonnet 5.550551Change-Id: Ic5cd168d981e22c119a154e8d41fa1796a6a6964552[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor553[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(moshi): reconcile hooks after managedConfigs554555moshi-hook install writes into every supported agent's config, devin's556included, which turned devin's store symlink into a regular file and557made every second activation block on a .before-home-manager backup558collision. The reconcile step was ordered after a hand-kept list of four559per-agent steps that did not include devin.560561It now runs after the single managedConfigs step, which rewrites every562file moshi touches, and managed-config-wiring asserts both halves: every563config moshi writes for an enabled agent is a managed config and none is564also a home.file target, and moshi orders after managedConfigs.565566Change-Id: I086a785cc40a31183d04eb0d4778ed426a6a6964567[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch568[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: refactor(ai): manage agent config files with managedConfigs569570Eleven agent configuration files moved from five mechanisms (install571copies behind mutableSettings toggles, a shallow jq merge, two deep yq572merges, and plain store symlinks) to managedConfigs:573574- replace (no app-owned keys): claude-code and its glm and cerebras575 wrappers, codex, pi, devin, openspec, omp WATCHDOG.yml;576- with app-owned keys: atomic (onboarding and changelog versions), omp577 config.yml (setupVersion, dev.autoqaConsent), omnigent (host identity578 and server, 0600).579580The mutableSettings options, six activation steps, the three merge581scripts and flake.lib.omnigentMergeConfig are removed. devin and582openspec no longer render store symlinks; openspec declares583completionTipSeen and atomic declares enableAnalytics = false so the584first activation keeps both. crs58 declares the omp UI preferences585(tui.vimMode, tui.vimModeDisplay, composer.shape) instead of relying on586runtime state. The atomic, omnigent-worker and pi-agent-environment587checks exercise the new program and wiring.588589Change-Id: Ie3e1e56e8b65f66e1df9bf289b3522046a6a6964590[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release591[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(home): add managedConfigs for files applications also write592593A configuration file that its application rewrites at runtime cannot be594a home-manager store symlink: the first runtime write replaces the link595with a regular file, the next activation backs it up, and the one after596collides with that backup and blocks.597598managedConfigs.<name> writes such a file as a real file on every599activation: the declared settings, plus the `appOwned` key paths copied600from the existing file. Every other key is dropped and reported by name,601never by value, so state that leaked in at runtime is either declared,602listed as app-owned, or removed, and keys Nix stops declaring are603retracted. `externalPaths` keeps subtrees that a later activation step604rewrites out of the report. Writes are atomic, honour `fileMode`, and a605target that cannot be read is left untouched when app-owned keys would606have to be preserved from it.607608The module lives in modules/home/modules beside agents-md because it is609not specific to any aggregate. managed-config-rehearsal drives the610program over json, yaml and toml targets, including preservation,611retraction, the name-only report, unreadable targets, file modes and612multi-spec failure.613614Change-Id: I989f1589b7c10542e045a9c4c88308c36a6a6964615[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor616[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: Update flake inputs: llm-agents.nix617618Change-Id: Id494be9893dc2095a1fe045d6b3d6e8a6a6a6964619[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release620[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(apm): relock apm.lock.yaml for the linear-cli dependency621622Records schpet/linear-cli at 196315343d2b (v2.6.0), added to623planning-and-development by #3262, with the ownership ledger for the 22624files its skill deploys, and moves the self-dependency entries to d5d75ca5.625apm 0.32.0; 173 skills deployed.626627Change-Id: I45b6531bef4542b526eb8373ffc445cd6a6a6964628[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release629[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: Merge 3fb87c3881da98fe3f2b18b60ffeeccd9953f25a into gitea-mq/batch/43630[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release631[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: Merge 19610a72e7d680cd426bdb52d58795935f22ac15 into gitea-mq/batch/43632[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release633[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(flake): track niri-flake and zen-browser upstream instead of rev pins634635The pyrite desktop check once asserted niri-flake's revision as a literal,636so every flake-updater lock bump failed by construction (#3101, #3102,637#3169). #3232 answered that by pinning the URL by revision and having the638check assert `pinnedToDeclaredRev`, which passes only when flake.nix names639a revision: the check enforced the pin it was meant to justify, and640niri-flake and zen-browser moved to Renovate digest PRs while every other641unpinned input goes through the flake-updater bot.642643Both inputs now track their upstream default branch like the rest, and644the two pinnedToDeclaredRev clauses and their helpers are gone. The645behavioural assertions stay: niri's options come from nixpkgs' module,646and the installed Zen package is the one zen-browser provides, built647against our nixpkgs. dms-src keeps its release-tag pin, which encodes a648real coupling to nixpkgs' dms-shell version.649650Relocking advances niri-flake to dd2f795 (the commit #3261 proposed);651zen-browser's upstream head is the commit it was pinned to.652nixos-pyrite and every pyrite-* check build on x86_64-linux.653654Change-Id: I16223a5ba0d1e1889c94f935d868a9aa6a6a6964655[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch656[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: docs(skills): list companion skills for marketplace consumers657658Add a Companion skills section to the consuming-marketplace-plugins guide659with upstream `apm install` lines for omnigraph, tuicr, duckdb-skills,660dagster-expert, hf-cli and huggingface-datasets. They complement661plugins here but are deliberately not bundled: bundling would add their662descriptions to every consumer's sessions and hold them at our pins.663Each command was run with apm 0.32.0 and installs exactly the named664skills; tagged upstreams use release tags per the pinning policy, the665tagless ones carry commit SHAs with the policy's caveat.666667Transitive dependencies now names the linear-cli skill that668planning-and-development brings.669670Change-Id: I99457cfd1e89b6128737470e9d3a8ded6a6a6964671[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release672[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(omnigraph): deliver the upstream omnigraph skill with the client673674Wire `${programs.omnigraph.package.src}/skills` into aiSkills.extraSkillDirs,675as tuicr does, so the skill comes from the same pinned source the client676and server are built from and always describes the deployed version677(currently v0.11.0).678679The definition lives on the ai aggregate in the same file, guarded on the680omnigraph option existing and being enabled: tools reaches users without681ai (christophersmith, janettesmith, raquel, tara), where an aiSkills682definition would fail to evaluate.683684Change-Id: I4ae90fe76122ef1c0423bb07a4b917e66a6a6964685[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor686[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(skills): propagate the linear-cli skill through planning-and-development687688openspec-linear-sync, which planning-and-development ships to marketplace689consumers, drives the linear CLI, but the upstream linear-cli skill690reached only Nix users (flake.lib.linearSkillDirs). A consumer who691installed the plugin with apm got a skill whose dependency was missing.692693- apm.yml declares `git: schpet/linear-cli`, ref 196315343d2b (the v2.6.0694 tag commit), `skills: [linear-cli]`; a scratch-project695 `apm install schpet/linear-cli/skills/linear-cli#<sha>` with apm 0.32.0696 installs exactly that skill.697- pkgs.linear-cli.src pins that commit instead of the tag name, so one698 pin serves the package, apm's offline cache in apm-skills-compose, and699 the drift guard. update.sh resolves the tag commit and rewrites both700 package.nix and the apm.yml ref, and its platform map now lists only701 the two Darwin binaries package.nix pins (Linux builds from source; the702 Linux prefetches were downloads with no hash line to update).703- apm-skills-compose pre-seeds the cache from pkgs.linear-cli.src and704 guards the apm.yml ref against it; the composed tree goes from 172 to705 173 skills.706- Nix delivery is unchanged: linear-cli joins excludedUpstreamSkills, and707 Nix users keep receiving it from linearSkillDirs only where they opt in,708 from the same pin.709710Change-Id: I048122dca5256fb58cc503d4c19fd4b06a6a6964711[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor712[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(omnigraph): fail startup fast and bootstrap new storage roots once713714Deploying #3257 stalled magnetite's switch-to-configuration for the full715start timeout. omnigraph-server v0.11.0 loads the cluster ledger and opens716every graph before binding, and any boot failure (here717[cluster_state_missing] on the new, never-applied dev-graph-v9 root)718exits the process within seconds. The ExecStartPost readiness probe kept719polling /healthz until readinessTimeout because it never noticed the main720process had died.721722Readiness probe (flake.lib.omnigraphReadinessProbe):723- polls /readyz and exits 1 at once when $MAINPID is gone, naming the724 journal and the apply remedy;725- treats quarantined graphs and, under requireAllGraphs, fewer served726 graphs than declared as permanent: the server has no runtime graph727 registration, and an imported-but-never-applied root boots empty yet728 passes /healthz;729- keeps 503 and ready=false transient until the timeout.730731Create-once bootstrap (flake.lib.omnigraphBootstrap, unit732omnigraph-cluster-bootstrap, option cluster.bootstrap.enable, default on733with the cluster): `cluster status` decides whether the root has state,734and a marker at <parent>/_omnigraph-markers/<root>.initialized (outside735the root's key prefix, so deleting the root never deletes it) records736that it ever had state:737- state and marker: nothing;738- state, no marker: adopt the existing root by writing the marker;739- no state, no marker: first initialization, runs the existing740 converge program, then writes the marker;741- no state, marker: a lost root; refuse without applying.742That initializes a new storageUri on deploy while keeping the protection743that holds apply.auto off: a lost root is never recreated empty. S3744markers use curl SigV4 path-style requests with credentials passed on745stdin; local roots must sit under /var/lib/omnigraph, the only directory746the hardened units can write. The server Wants (not Requires) the747bootstrap, so a refusal stays visible and the server then fails fast.748749Checks: omnigraph-readiness-rehearsal and omnigraph-bootstrap-rehearsal750drive the real scripts against loopback HTTP/S3 stubs and a stub CLI751(every probe outcome; the truth table for both marker backends, apply752and status failures, S3 errors, missing endpoint, rejected roots,753SigV4 path-style signing). omnigraph-wiring asserts magnetite's unit754ordering and that the server's ExecStartPost is the new probe.755756Change-Id: I931bf6ff300ba859422474546798e1d96a6a6964757[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch758[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(apm): relock apm.lock.yaml against main and apm 0.32.0759760Follows #3257. The vanixiets self-dependency moves to 8aa5fb47; the761transitive worktrunk and mergify-cli entries move to the v0.80.0 and7622026.9.16.1 commits that version-control-and-forge/apm.yml now pins; the763comment-cleanup ledger records uncomment.toml instead of764uncommentrc.toml; content hashes follow the updated skills.765766Change-Id: I5a8c3678bf1382d0eaf1a42edb5a5b556a6a6964767[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release768[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(apm-skills-install): relock from an empty apm_modules cache769770apm 0.32.0 `install --update` re-fetches an already-materialized771dependency only when its ref is a semver range772(should_force_ref_recheck, src/apm_cli/drift.py:174-193). A literal773commit pin that changed in a dependency's own manifest reuses the cached774checkout and writes the old resolved_commit back into apm.lock.yaml.775Plain `apm install` does detect that drift; --update does not.776777Observed after #3257 moved the worktrunk and mergify-cli refs in778version-control-and-forge/apm.yml: the relock kept de0052d8 and779727ce50b. Relock now removes the git-ignored apm_modules/ cache first,780so every dependency is resolved from its declaring manifest. Ownership781of deployed files lives in the lockfile ledger, so the only cost is a782re-fetch.783784Reproduced and verified: with main's lock and the old worktrunk checkout785materialized, the patched relock resolves b49ca7ee/e7c1ebbc and matches786a cache-free relock byte for byte apart from generated_at.787788Change-Id: I802a23af0d15cbaa526857556f6eede06a6a6964789[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch790[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(omnigent): 0.15.0 -> 0.16.0791792Upstream: https://github.com/omnigent-ai/omnigent/compare/v0.15.0...v0.16.0793794omnigent, omnigent-client and omnigent-ui-sdk move together (wheel795hashes from the PyPI JSON digests). Only the version-locked pins change796in pyproject; the existing relaxations and overrides still hold.797798acp-readiness.patch is still needed (0.16.0 still reports acp readiness799only for the bare `acp` harness) and is rebased: the ACP branch moved800into _harness_availability_core behind a new Windows guard. The readiness801test passes in the build.802803Upstream breaking notes #8137/#8143 (65,535-byte caps on saved804preferences and inference snapshots) affect server-side data only. The805host CLI surface, config keys and environment variables our modules use806are unchanged.807808Change-Id: I242bf10d54e879d31acbef5573af65ed6a6a6964809[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release810[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(mergify-cli): 2026.8.31.1 -> 2026.9.16.1811812Upstream: https://github.com/Mergifyio/mergify-cli/compare/2026.8.31.1...2026.9.16.1813814Bumps mergify-cli-bin and, in lockstep, agent-plugins/mergify-cli815(version, releaseTag, tag commit) and the version-control-and-forge816apm.yml ref.817818#1833 removes `mergify stack push --github-native`: native stack819registration is now the default (opt out with --no-github-native or820mergify-cli.stack-github-native=false). The git-stacked-pr-integration821skill and the adopt-queue-landing-protocol specs now publish with822`mergify stack push --trunk origin/main -R` and require the default to823stay on; the ADR note and its review keep their history with a dated824note.825826#1803/#1806/#1807 add `mergify auth login|logout|status`; the827mergify.nix comment now documents the non-stack credential chain.828829Change-Id: I323e343a51842dcf02a1a198766125796a6a6964830[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release831[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(nix-fast-build): do not propagate python into consumers832833The package's propagated build inputs put its site-packages on834PYTHONPATH in every devshell that includes it, which overrides the835wrapper of any other nix-fast-build binary run from that shell (a newly836built one loads the old module). Remove837$out/nix-support/propagated-build-inputs in postFixup, exactly as838upstream's default.nix does.839840Change-Id: I5ce01d321cdfe1770858b78250f573856a6a6964841[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch842[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(nix-fast-build): 1.6.0 -> 2.0.4843844Upstream: https://github.com/Mic92/nix-fast-build/compare/1.6.0...2.0.48458462.x renders build logs itself: nix-output-monitor is dropped from the847wrapper PATH, --no-nom now selects the non-interactive renderer, and848interactive mode turns itself off without a TTY. --no-link is a849deprecated no-op (no out-links is the default), so check-fast stops850passing it. Every other flag our recipes pass is unchanged; --option now851reaches every nix call. The CI/CD skill's --no-nom description follows.852853Change-Id: Icc74b794021b6725bbdc47cd2277bc356a6a6964854[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release855[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(worktrunk): 0.76.0 -> 0.80.0856857Upstream: https://github.com/max-sixty/worktrunk/compare/v0.76.0...v0.80.0858859Bumps worktrunk-bin and, in lockstep, the agent-plugins/worktrunk source860and the version-control-and-forge apm.yml ref (the apm-skills-compose861drift guard requires both to name the v0.80.0 commit).862863Breaking upstream changes (0.77-0.80): wt list --format=json defaults to864schema 2; hook JSON context keys renamed to worktree_path / repo_path /865repo / primary_worktree_path; `wt config update --print` removed;866oh-my-pi plugin moved to `wt config plugins omp`; `{{ branch }}` unset in a867detached worktree. None is used here: the only config is868programs.worktrunk enable + package.869870Change-Id: I08b82b5e98fec40122348980c3481fb76a6a6964871[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release872[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(uncomment): 3.6.0 -> 3.10.2873874Upstream: https://github.com/Goldziher/uncomment/compare/v3.6.0...v3.10.28758763.8.0 makes .uncomment.toml the preferred config name (.uncommentrc.toml877still loads with a deprecation warning) and makes unknown config keys a878load error; scan, keep and lint subcommands are new.879880Rename the repository-root config to .uncomment.toml and the881preferences-comment-cleanup template to uncomment.toml. The skill now882states behaviour measured against 3.10.2: census via `scan --only883removable --group-identical`, `keep --id` to write ~keep markers, and884`--check` as the completion gate. XXX and tflint-ignore are default-kept885now, so the template drops them.886887Change-Id: Ie379fdf60fa2c6e5650467189469dc856a6a6964888[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release889[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(ouroboros): 0.42.0 -> 0.55.3890891Upstream: https://github.com/Q00/ouroboros/compare/v0.42.0...v0.55.38928930.55 pins mcp==2.0.0 in the [mcp] extra and mcp==1.28.1 in894[claude]/[claude-sdk] and declares them conflicting, so the old895`ouroboros-ai[mcp,claude,tui]` spec no longer resolves. Following the896upstream README, the wrapper uses [mcp,claude-cli,tui] with897`uvx --isolated --python '>=3.12'`, and the claude-code MCP server entry898uses [mcp] with `--runtime claude-cli --llm-backend claude_code`, as899upstream's own .mcp.json does, keeping our exact version pin.900901agent-plugins/ouroboros moves to the v0.55.3 tag peel.902903Change-Id: I5ac2e15a511b418dc5fa5bb5cbad3f2b6a6a6964904[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release905[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(omnigraph): 0.9.0-unstable-2026-08-05 -> 0.11.0906907Upstream: https://github.com/ModernRelay/omnigraph/compare/12a8596626c80a7dceed0fd72182d421052ff8d1...v0.11.0908909The unstable pin existed only because upstream published no releases;910it now does, and v0.11.0 contains the old pin. rev stays a commit sha911(the v0.11.0 tag peel) because OMNIGRAPH_SOURCE_VERSION is read from912src.rev and upstream stamps it with a sha. update.sh now tracks the913latest stable vX.Y.Z release instead of main.914915The lance-linalg AVX-512 VNNI postPatch moves to lance-linalg-11.0.0;916the three deleted lines are still present verbatim there.917918Cluster config migrated to the v0.11.0 policy schema (strict since919v0.9.0):920- server.policy.yaml drops `kind`; a bundle's kind follows its921 `applies_to` in cluster.yaml, which already scopes it to `cluster`.922- dev.policy.yaml drops the `stream_ingest`/`stream_manage` rules and923 the `cluster` group: upstream removed the RFC-026 streaming-ingest924 path (e1cd395) before v0.9.0, loads go through `change`, which925 operators already hold, and cluster apply no longer evaluates policy.926- the omnigraph-cluster wrapper passes `--as` to `apply`/`approve` only;927 `cluster stream` no longer exists.928929Deploy note: the old pin wrote internal manifest schema v19, an930abandoned format that 0.11 refuses and that `omnigraph upgrade` cannot931migrate. magnetite's storageUri therefore moves to a parallel root932(clusters/dev-graph-v9), following upstream's upgrade.md "same graph ID933in a parallel cluster root" procedure; the old root is untouched as the934export source and rollback copy. Carrying data over is a manual935export (old binary) / load (new binary) on magnetite.936937Change-Id: I4db767af7224204fa83f52a56b7f96e86a6a6964938[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release939[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(buzz): 0.5.20 -> 0.5.26940941Upstream: https://github.com/block/buzz/compare/desktop-v0.5.20...desktop-v0.5.26942943Only the shared source changes (src hash, passthru.rev, vendored cargo944hash); buzz-cli, git-credential-nostr and git-sign-nostr inherit it. The945line references in their comments are unchanged at the new tag.946947Change-Id: If97c50c44e8c19db3d109f98c235b15d6a6a6964948[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release949[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(no-mistakes): 1.60.2 -> 1.84.0950951Upstream: https://github.com/kunchenguid/no-mistakes/compare/v1.60.2...v1.84.0952953No release in the range is marked breaking. The package's assumptions954hold: internal/buildinfo.Version, empty telemetry host defaults, and the955NO_MISTAKES_TELEMETRY / NO_MISTAKES_NO_UPDATE_CHECK variables.956957Change-Id: Ie2d6877297cee4239c1b0f66f3faf4936a6a6964958[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release959[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(treehouse): 2.1.1 -> 3.1.0960961Upstream: https://github.com/kunchenguid/treehouse/compare/v2.1.1...v3.1.09629633.0.0 makes `treehouse return` (and `treehouse get` when its subshell964leaves the worktree dirty) exit 3 instead of 0; callers need --force or965must treat 3 as not-returned. 3.0.1 adopts pre-3.0 pool state966automatically. The only consumer, modules/home/ai/firstmate, lists the967package without invoking it. The -X main.version ldflag and968TREEHOUSE_NO_UPDATE_CHECK still exist. vendorHash is unchanged.969970Change-Id: I9e8389a12507f0270db99e2fa9f03b616a6a6964971[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release972[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(atomic): 0.9.19 -> 0.9.24973974Upstream: https://github.com/bastani-inc/atomic/compare/0.9.19...0.9.24975976update.sh verified the npm tarball against the registry sha512,977regenerated npm-dist-repairs.patch and manifest.json, and learned the new978npmDepsHash from the build.9799800.9.20 renames TYPESAFE_AI_API_KEY to TYPESAFE_API_KEY and the Jev router981models from typesafe-ai/jev* to typesafe/jev-latest; nothing here uses982either. 0.9.21-0.9.24 are features and fixes.983984Change-Id: Ic89cc417078e62bf7f338e24d6bcd3e16a6a6964985[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release986[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(dbt-fusion)!: 2.0.0-preview.101 -> 2.0.6987988Upstream: https://public.cdn.getdbt.com/fs/versions.json (latest.tag v2.0.6)989Repository: https://github.com/dbt-labs/dbt-fusion990991dbt Fusion is out of preview. Upstream no longer publishes the standalone992dbt-lsp artifact (fs/lsp/fs-lsp-v2.0.6-* returns 404; install.sh says to993run `dbt lsp` instead), so the package builds one src per platform and no994longer installs bin/dbt-lsp. update.sh drops the LSP fetch and rewrites995the single per-platform hash.996997BREAKING CHANGE: pkgs.dbt-fusion no longer provides dbt-lsp; use998`dbtf lsp`. Nothing in this repository referenced dbt-lsp.9991000Change-Id: Ie5f4eb2d8ccb4a60c4648a3cb5719fa36a6a69641001[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is major1002[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analysis of 2272 commits complete: major release1003[5:25:38 AM] [[secure]] › ✔ Completed step "analyzeCommits" of plugin "@[secure]/commit-analyzer"1004[5:25:38 AM] [[secure]] › ℹ The next release version is 1.0.01005[5:25:38 AM] [[secure]] › ℹ Start step "generateNotes" of plugin "@[secure]/release-notes-generator"1006[5:25:42 AM] [[secure]] › ✔ Completed step "generateNotes" of plugin "@[secure]/release-notes-generator"1007[5:25:42 AM] [[secure]] › ℹ Start step "prepare" of plugin "@[secure]/npm"1008[5:25:42 AM] [[secure]] [@[secure]/npm] › ℹ Write version 1.0.0 to package.json in /build/release-packages-clone.aQz2N5/packages/evidence-worker1009[5:25:42 AM] [[secure]] › ✘ Failed step "prepare" of plugin "@[secure]/npm"1010[5:25:42 AM] [[secure]] › ✘ An error occurred while running [secure]: ExecaError: Command failed with ENOENT: npm version 1.0.0 --userconfig /build/c4062d2cd26241c0454c289a09672dc7/.npmrc --no-git-tag-version --allow-same-version1011spawn npm ENOENT1012 at getFinalError (file:///nix/store/6r5330pwwrfvf1jr3m349dx0ff1jai64-vanixiets-docs-deps-0.0.0/node_modules/.bun/execa@9.6.1/node_modules/execa/lib/return/final-error.js:6:9)1013 at makeError (file:///nix/store/6r5330pwwrfvf1jr3m349dx0ff1jai64-vanixiets-docs-deps-0.0.0/node_modules/.bun/execa@9.6.1/node_modules/execa/lib/return/result.js:108:16)1014 at getAsyncResult (file:///nix/store/6r5330pwwrfvf1jr3m349dx0ff1jai64-vanixiets-docs-deps-0.0.0/node_modules/.bun/execa@9.6.1/node_modules/execa/lib/methods/main-async.js:168:4)1015 at handlePromise (file:///nix/store/6r5330pwwrfvf1jr3m349dx0ff1jai64-vanixiets-docs-deps-0.0.0/node_modules/.bun/execa@9.6.1/node_modules/execa/lib/methods/main-async.js:151:17)1016 at process.processTicksAndRejections (node:internal/process/task_queues:104:5)1017 at async default (file:///nix/store/6r5330pwwrfvf1jr3m349dx0ff1jai64-vanixiets-docs-deps-0.0.0/node_modules/.bun/@[secure]+npm@13.2.0+7218cc91dc451707/node_modules/@[secure]/npm/lib/prepare.js:26:3)1018 at async prepare (file:///nix/store/6r5330pwwrfvf1jr3m349dx0ff1jai64-vanixiets-docs-deps-0.0.0/node_modules/.bun/@[secure]+npm@13.2.0+7218cc91dc451707/node_modules/@[secure]/npm/index.js:63:3)1019 at async validator (file:///nix/store/6r5330pwwrfvf1jr3m349dx0ff1jai64-vanixiets-docs-deps-0.0.0/node_modules/.bun/[secure]@25.0.9+5d9c14df9042c98f/node_modules/[secure]/lib/plugins/normalize.js:36:24)1020 at async file:///nix/store/6r5330pwwrfvf1jr3m349dx0ff1jai64-vanixiets-docs-deps-0.0.0/node_modules/.bun/[secure]@25.0.9+5d9c14df9042c98f/node_modules/[secure]/lib/plugins/pipeline.js:38:361021 at async file:///nix/store/6r5330pwwrfvf1jr3m349dx0ff1jai64-vanixiets-docs-deps-0.0.0/node_modules/.bun/[secure]@25.0.9+5d9c14df9042c98f/node_modules/[secure]/lib/plugins/pipeline.js:32:5 {1022 shortMessage: 'Command failed with ENOENT: npm version 1.0.0 --userconfig /build/c4062d2cd26241c0454c289a09672dc7/.npmrc --no-git-tag-version --allow-same-version\n' +1023 'spawn npm ENOENT',1024 originalMessage: 'spawn npm ENOENT',1025 command: 'npm version 1.0.0 --userconfig /build/c4062d2cd26241c0454c289a09672dc7/.npmrc --no-git-tag-version --allow-same-version',1026 escapedCommand: 'npm version 1.0.0 --userconfig /build/c4062d2cd26241c0454c289a09672dc7/.npmrc --no-git-tag-version --allow-same-version',1027 cwd: '/build/release-packages-clone.aQz2N5/packages/evidence-worker',1028 durationMs: 10.430134,1029 failed: true,1030 timedOut: false,1031 isCanceled: false,1032 isGracefullyCanceled: false,1033 isTerminated: false,1034 isMaxBuffer: false,1035 isForcefullyTerminated: false,1036 code: 'ENOENT',1037 stdout: '',1038 stderr: '',1039 stdio: [ undefined, '', '' ],1040 ipcOutput: [],1041 pipedFrom: [],1042 pluginName: '@[secure]/npm',1043 [cause]: Error: spawn npm ENOENT1044 at ChildProcess._handle.onexit (node:internal/child_process:287:19)1045 at onErrorNT (node:internal/child_process:525:16)1046 at process.processTicksAndRejections (node:internal/process/task_queues:90:21) {1047 errno: -2,1048 code: 'ENOENT',1049 syscall: 'spawn npm',1050 path: 'npm',1051 spawnargs: [1052 'version',1053 '1.0.0',1054 '--userconfig',1055 '/build/c4062d2cd26241c0454c289a09672dc7/.npmrc',1056 '--no-git-tag-version',1057 '--allow-same-version'1058 ]1059 }1060}1061ExecaError: Command failed with ENOENT: npm version 1.0.0 --userconfig /build/c4062d2cd26241c0454c289a09672dc7/.npmrc --no-git-tag-version --allow-same-version1062spawn npm ENOENT1063 at getFinalError (file:///nix/store/6r5330pwwrfvf1jr3m349dx0ff1jai64-vanixiets-docs-deps-0.0.0/node_modules/.bun/execa@9.6.1/node_modules/execa/lib/return/final-error.js:6:9)1064 at makeError (file:///nix/store/6r5330pwwrfvf1jr3m349dx0ff1jai64-vanixiets-docs-deps-0.0.0/node_modules/.bun/execa@9.6.1/node_modules/execa/lib/return/result.js:108:16)1065 at getAsyncResult (file:///nix/store/6r5330pwwrfvf1jr3m349dx0ff1jai64-vanixiets-docs-deps-0.0.0/node_modules/.bun/execa@9.6.1/node_modules/execa/lib/methods/main-async.js:168:4)1066 at handlePromise (file:///nix/store/6r5330pwwrfvf1jr3m349dx0ff1jai64-vanixiets-docs-deps-0.0.0/node_modules/.bun/execa@9.6.1/node_modules/execa/lib/methods/main-async.js:151:17)1067 at process.processTicksAndRejections (node:internal/process/task_queues:104:5)1068 at async default (file:///nix/store/6r5330pwwrfvf1jr3m349dx0ff1jai64-vanixiets-docs-deps-0.0.0/node_modules/.bun/@[secure]+npm@13.2.0+7218cc91dc451707/node_modules/@[secure]/npm/lib/prepare.js:26:3)1069 at async prepare (file:///nix/store/6r5330pwwrfvf1jr3m349dx0ff1jai64-vanixiets-docs-deps-0.0.0/node_modules/.bun/@[secure]+npm@13.2.0+7218cc91dc451707/node_modules/@[secure]/npm/index.js:63:3)1070 at async validator (file:///nix/store/6r5330pwwrfvf1jr3m349dx0ff1jai64-vanixiets-docs-deps-0.0.0/node_modules/.bun/[secure]@25.0.9+5d9c14df9042c98f/node_modules/[secure]/lib/plugins/normalize.js:36:24)1071 at async file:///nix/store/6r5330pwwrfvf1jr3m349dx0ff1jai64-vanixiets-docs-deps-0.0.0/node_modules/.bun/[secure]@25.0.9+5d9c14df9042c98f/node_modules/[secure]/lib/plugins/pipeline.js:38:361072 at async file:///nix/store/6r5330pwwrfvf1jr3m349dx0ff1jai64-vanixiets-docs-deps-0.0.0/node_modules/.bun/[secure]@25.0.9+5d9c14df9042c98f/node_modules/[secure]/lib/plugins/pipeline.js:32:5 {1073 shortMessage: 'Command failed with ENOENT: npm version 1.0.0 --userconfig /build/c4062d2cd26241c0454c289a09672dc7/.npmrc --no-git-tag-version --allow-same-version\n' +1074 'spawn npm ENOENT',1075 originalMessage: 'spawn npm ENOENT',1076 command: 'npm version 1.0.0 --userconfig /build/c4062d2cd26241c0454c289a09672dc7/.npmrc --no-git-tag-version --allow-same-version',1077 escapedCommand: 'npm version 1.0.0 --userconfig /build/c4062d2cd26241c0454c289a09672dc7/.npmrc --no-git-tag-version --allow-same-version',1078 cwd: '/build/release-packages-clone.aQz2N5/packages/evidence-worker',1079 durationMs: 10.430134,1080 failed: true,1081 timedOut: false,1082 isCanceled: false,1083 isGracefullyCanceled: false,1084 isTerminated: false,1085 isMaxBuffer: false,1086 isForcefullyTerminated: false,1087 code: 'ENOENT',1088 stdout: '',1089 stderr: '',1090 stdio: [ undefined, '', '' ],1091 ipcOutput: [],1092 pipedFrom: [],1093 pluginName: '@[secure]/npm',1094 [cause]: Error: spawn npm ENOENT1095 at ChildProcess._handle.onexit (node:internal/child_process:287:19)1096 at onErrorNT (node:internal/child_process:525:16)1097 at process.processTicksAndRejections (node:internal/process/task_queues:90:21) {1098 errno: -2,1099 code: 'ENOENT',1100 syscall: 'spawn npm',1101 path: 'npm',1102 spawnargs: [1103 'version',1104 '1.0.0',1105 '--userconfig',1106 '/build/c4062d2cd26241c0454c289a09672dc7/.npmrc',1107 '--no-git-tag-version',1108 '--allow-same-version'1109 ]1110 }1111RELEASE-PACKAGE-FAILURE: packages/evidence-worker (exit 1)1112}error: 1 package(s) failed: packages/evidence-worker1113error: nix failed with exit code 1