[rucka]

PR Information

Story: #552 (third increment)
Type: Bug Fix

Summary

What Changed

• update backup/rollback now covers every non-symlink target of a registry (CLAUDE.md copy target of agents), keys <name>:<path>.
• KB 404 message keeps the prerelease: KB v0.5.0-pre.1 not found (404).
• Release CLI reads only tags present on origin (fetch tags, filter by ls-remote); tags deleted on origin no longer feed the plan, local-only tags kept.
• MT-CP323 step 4 asserts CLAUDE.md in backup; README + RELEASE.md: pre/rc packages private to foomakers by design.

Why This Change

pre.2 validation: O2 lost own CLAUDE.md on opt-in update, O3, stale tags.

Story Context

Acceptance Criteria: AC9, AC10, AC11, AC12, AC13

Changes Made

• apps/pair-cli/src/commands/update/handler.ts (performBackup, handler-only; BackupService untouched)
• apps/pair-cli/src/kb-manager/download-manager.ts (regex)
• packages/dev-tools/src/release/release-cli.ts (fetch flags)
• Tests: handler (darwin/linux persist-backup, rollback), download-manager, release-sandbox; kb-availability expectation updated to v0.0.404-test
• Docs: CP3, qa README, RELEASE.md; patch changeset

Testing

Full pnpm test, lint, ts:check, docs:staleness green; pre-push gate green.

🤖 Generated with Claude Code

https://claude.ai/code/session_016uFPtgh6WyrKFHVJYyRAdb

[rucka]

Verdict

risk:yellow · cost:green — CHANGES-REQUESTED — AC12 (prune stale tags) does not work with the fetch as written.

Open findings: 1.

PR: #555 · Story: US-552 · Type: bug · Head: 9081a0c · custody: none sealed (fresh card), verified · setup pnpm install --frozen-lockfile && pnpm build exit 0 · lint/unit (update, kb-manager, release) green.

Assessments

Per AC

• AC9 proven: update backup covers copy targets darwin/linux tests; reproduced on built CLI (own AGENTS.md+CLAUDE.md, install --skip-registries agents, skipRegistries: [], update --persist-backup): .pair/backups/<session>/ holds both originals.
• AC10 proven: rollback test; built CLI with unreadable source registry exits 1, own AGENTS.md and CLAUDE.md restored, backups removed.
• AC11 proven: download-manager 404 test. The edited kb-availability expectation (0.0.404-test) is legitimate: that test's version already was 0.0.404-test, the old regex truncated it, the old text asserted the bug.
• AC12 weak: test only matches flag strings, never prunes anything. See r0-1.
• AC13 proven by diff: README and RELEASE.md state the private-package note.
• Backup keys <name>:<path> only key a Map; the backup location derives from the path, so no collision with registry names; a shared path is idempotent.

Details

r0-1 Major — blocking

git fetch --tags --force --prune --prune-tags origin main (git 2.56) does NOT delete a tag removed on origin: with an explicit main refspec prune-tags is not applied. Repro: bare origin, push tag v1, delete it on origin, run the exact command: git tag still lists v1. Without the main refspec (--tags --force --prune --prune-tags origin) it prunes v1, but also local-only unpushed tags.

Fix: drop the refspec form, or delete via git ls-remote --tags diff; make the test run against a real throwaway repo. VERIFY: bare origin repro; ORACLE: stale tag absent after fetch, local-only tag policy stated; ASSERT: readTags omits the deleted tag.

[rucka]

Delivery workflow summary

1. Identity — pair-implement-batch 4.0.1 | run story-552 | models: not recorded (in-session) | reviewed head: 09da8492e15d0bf0d6987b114030aa143cd8dc14

2. Status — quality: converged · delivery: ready-for-merge · gate/custody: passed

3. Cycles — completed 1 / attempted 1 · review batches 2 · review executions 2 · retries 0 · redirects null · contract revisions 0 · preparation repairs 2 · invalidated remediations 0 · regression repairs 0 · active regression risks 0 · discharged regression risks 0 · admin/engine recoveries null

4. Cost / time — tokens not recorded (in-session: no host runtime supplied usage) · elapsed ≈ 52m (handoff timestamps, 9 handoffs; wall clock including waits)

5. Late defects (by origin) — preexisting-missed 0 · introduced-by-remediation 0 · unknown 0 · missedUpstream 0

Findings

id	severity	found	status	location	summary	resolution
r0-1	Major	r0	resolved	packages/dev-tools/src/release/release-cli.ts:21	Resolved: originTags fetches then intersects local v* with ls-remote; real bare-origin witnesses green; fetch…	resolved (see the re-review)

No scope proposals.

6. Machine-readable summary

{
  "schemaVersion": 1,
  "sourceDigest": "sha256:ca2e3038263b2ff039e0249123f7228996ec42fcc532c9af38c701fee2788fd7",
  "asOf": "2026-10-17T14:51:47.206Z",
  "metricsRevision": 1,
  "completeness": "partial",
  "missingSources": []
}