fix: tolerate malformed annotation entries; verify npm publication in its own job (2026-11-08 release blockers)

Merged
UN
4d ago
+855-77

Summary

This PR fixes the two defects behind the 2026-11-08 auto-release failures.

pm-30tjoh: malformed stored annotation entries crashed every read of their item

A comments, notes or learnings entry that is not a plain object with string fields made sortLogValues throw a TypeError (localeCompare of undefined). Examples are a bare string, a number, null, or an object without text. pm comments, pm notes, pm learnings and pm get then failed with unknown_error, and each failure reached Sentry as an unexpected fault. PM-CLI-3Y came from a sandbox reproduction and blocked today's morning cut at the Sentry telemetry gate (blocker #1686).

  • compareLogValues reads its keys through logSortFields, which treats a missing or non-string created_at, text or author as "". The comparator is total, and malformed entries are delivered as stored.
  • The --expect-at guard reads created_at null-safely. A guarded edit of a malformed entry is refused with the typed annotation_entry_mismatch (actual_created_at: null), not a TypeError.
  • New spec tests/unit/core/item/malformed-annotation-entries.spec.ts.

pm-0jzl5t: release verification shared the build job's timeout and gave up before npm's publish-time scan finished

After the blocker retry, Release run 42454411958 published @unbrained/pm-cli@2026.11.8 at 07:11:28Z. npm's publish-time malware scan (GitHub changelog 2026-07-28) kept the version invisible for over 20 minutes; 2026.11.7 took 5m12s. The verify step ran inside the 60-minute "Build, Test, Publish" job after a 45-minute pre-publish phase, so the job was cancelled at poll 59/60. Acceptance and the GitHub Release were skipped.

  • release.yml: a new publication job (needs: release, 50 min) runs the npm/npx/bunx verifier (35 min), the installed npm and Bun agent sessions and the previous-release control. It owns the version and previous outputs; installed-acceptance and advertise depend on it. A long npm hold is now recovered with gh run rerun <run-id> --failed without rebuilding or republishing. Publication admission still keys on the unchanged Build, Test, Publish job and its Publish to npm step.
  • verify-published-release.mjs: the default wait is 120 × 15 s (about 30 min). An exhausted wait names the version, the poll budget, npm's scan and the exact re-run command.
  • auto-release.yml: the parent limit is 230 minutes, the serial children (60 + 50 + 15 + 5) plus pm-29bwud's reserves (60/30/10).
  • gate-registry.json and docs/RELEASING.md are updated for the new job, the new budget and the recovery steps.
  • Contract specs pin the job split, the wait ≥ 30 min, the verify step outlasting the wait, the job outlasting its steps, and the parent covering every child. Both new specs fail against the previous workflow and the previous default.

Verification

  • node scripts/run-tests.mjs test -- tests/unit/core/item/malformed-annotation-entries.spec.ts tests/unit/scripts/release/verify-published-release.spec.ts tests/integration/registry-acceptance-workflow.spec.ts tests/integration/ci-workflow-contract.spec.ts
  • actionlint on both workflows; check-workflow-permissions, gate-registry, surface-replication-gate, the static quality gate (0 violations), docs/skills gate and jscpd (0 clones) all pass.
  • Assurances: graph-composition and record-integrity pass; the defect-evidence gate is ok.
  • CHANGELOG.md regenerated with pm-changelog.

Summary by Sourcery

Harden annotation handling and make npm publication verification resilient to delayed registry visibility.

Bug Fixes:

  • Make reads, searches, appends, edits, and guarded mutations tolerate malformed comments, notes, and learnings entries without crashing.
  • Prevent npm publication verification from timing out before delayed package visibility and provide actionable recovery guidance for scan-related delays.

Enhancements:

  • Separate post-publication registry and installed-package verification into a dedicated job so failed verification can be rerun without rebuilding or republishing.

CI:

  • Update release workflow budgets, dependencies, outputs, and contract coverage for the dedicated publication verification job.

Documentation:

  • Document the revised release verification timing and publication-only recovery procedure.

Tests:

  • Add coverage for malformed annotation handling, npm metadata wait behavior, release job composition, and workflow timeout contracts.

Chores:

  • Regenerate the changelog and update release tracking records.