ci: los contratos de release y los presupuestos seguían en la era de upstream

Tras el commit de ayer, main seguía rojo en Version drift y Lint. Cada
puerta que fallaba tapaba a la siguiente, así que aquí van todas las que
salieron al correrlas localmente en orden:

- release-workflows.test.js leía scripts/release/install.sh, borrado a
  propósito en 5551d9d. Fuera esas tres aserciones.
- Exigía que nightly.yml no mencionara ghosty-tui, pero el alias
  ghosty-tui-* es intencional desde el rebase (antes codew-*) y el propio
  test pide el cmp primario/alias. Queda sólo la guardia contra compilar
  un segundo binario.
- Contaba 34 assets de release; el inventario es de 27 desde 75fe13c
  (dos familias, no tres). Test, mensaje final y runbook alineados.
- Pedía un job npm con trusted publishing que el rebase quitó: npm se
  publica a mano. Fuera ese bloque.
- Presupuesto de dead-code: 389 allow(dead_code) en tui contra 372. No
  vienen de los últimos commits; se fija el número actual para que la
  puerta vuelva a vigilar crecimiento desde aquí.
- Presupuesto del contrato de runtime: el prompt base normalizado mide
  6074 bytes (baseline 6089) y todas las identidades de stage cambiaron en
  cascada. Los nombres de tools no cambiaron y todo métrica baja salvo
  project.delta_bytes (255 -> 261). Rebaseline desde el recibo medido.
- web/data/latest-published-release.json decía v0.9.11 con v0.0.20
  publicado; refrescado a mano junto con su espejo en
  docs/public-surface-facts.json y facts.generated.ts, porque la API de
  GitHub no respondía desde aquí.

Aparte, y sin tocar código: Sync to CNB y Web Frontend quedan desactivados
en el fork con `gh workflow disable`. CNB necesita un secreto del espejo
Tencent de upstream que no tenemos; Web Frontend corre seis contratos del
sitio de ghosty.net, que ni es nuestro ni se despliega (ver 5551d9d).
Se reactivan con `gh workflow enable` si esa decisión cambia.

Corrido localmente: release-workflows.test.js, assemble-release-assets
.test.js, runtime_web_client.test.mjs (36), check-dead-code-budget.py,
check-runtime-contract-budget.py y sus dos harness, web check:facts y
check:latest-release.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T93Y7PFGs7ueC8Y7gyAizq

Author: blissito

.github/scripts/release-workflows.test.js

@@ -38,7 +38,6 @@ const republish = read(".github/workflows/release-republish.yml");
 const releaseDockerfile = read("packaging/docker/Dockerfile.release");
 const cnb = read(".cnb.yml");
 const bundles = read("scripts/release/create-release-bundles.sh");
-const archiveInstaller = read("scripts/release/install.sh");
 const cliDispatcher = read("crates/cli/src/lib.rs");
 const runbook = read("docs/RELEASE_RUNBOOK.md");
 
@@ -119,7 +118,10 @@ assert.match(
 assert.match(nightlyArmStaticSmoke, /readelf -l "\$\{bin_path\}"/);
 assert.match(nightlyArmStaticSmoke, /grep -Fq 'INTERP'/);
 assert.match(nightlyArmStaticSmoke, /"\$\{bin_path\}" --version/);
-assert.doesNotMatch(nightly, /ghosty-tui/);
+// The nightly alias artifact is named ghosty-tui-* on purpose: the rebase
+// onto 0.9.11 kept the legacy binary name as a byte-identical alias for
+// old consumers (it was codew-* upstream). What must not happen is the
+// nightly compiling a separate ghosty-tui binary, which the next line guards.
 assert.doesNotMatch(nightly, /target\/[^\n]*\/ghosty-tui(?:\.exe)?/);
 assert.match(nightly, /cp "\$\{bin_path\}" "\$\{dir\}\/\$\{artifact\}"/);
 assert.match(nightly, /cmp -s[\s\S]*nightly-primary[\s\S]*nightly-alias/);
@@ -320,7 +322,9 @@ const parityRustCache = [...parity[1].matchAll(/uses: Swatinem\/rust-cache@[\s\S
 assert.equal(parityRustCache.length, 1, "parity must pin exactly one rust-cache");
 assert.doesNotMatch(parityRustCache[0], /github\.(event|ref|sha)|inputs\./);
 
-assert.equal(allReleaseAssetNames().length, 34);
+// 27, not upstream's 34: GhostyCode ships two asset families (ghosty-* and the
+// byte-identical ghosty-tui-* compat copies), not three. See 75fe13c2a.
+assert.equal(allReleaseAssetNames().length, 27);
 assert.match(release, /^  artifacts:\n/m);
 assert.match(release, /uses: \.\/\.github\/workflows\/release-artifacts\.yml/);
 assert.doesNotMatch(release, /^  (build|bundle|windows-installer):/m);
@@ -375,33 +379,9 @@ assert.match(releaseDockerSmoke, /linux\/arm64/);
 assert.match(releaseDockerSmoke, /--entrypoint ghosty/);
 assert.match(releaseDockerSmoke, /--entrypoint ghosty-tui/);
 
-const npmJob = release.match(/\n  npm:\n([\s\S]*?)\n  homebrew:\n/);
-assert.ok(npmJob, "public release must retain a dedicated npm publication job");
-assert.match(npmJob[1], /^    needs: \[release, resolve\]$/m);
-assert.match(npmJob[1], /needs\.release\.result == 'success'/);
-assert.match(npmJob[1], /^      contents: read$/m);
-assert.match(npmJob[1], /^      id-token: write$/m);
-assert.match(npmJob[1], /ref: \$\{\{ needs\.resolve\.outputs\.sha \}\}/);
-assert.match(npmJob[1], /fetch-depth: 0/);
-assert.match(npmJob[1], /node-version: 24/);
-assert.match(npmJob[1], /registry-url: https:\/\/registry\.npmjs\.org/);
-assert.match(npmJob[1], /package-manager-cache: false/);
-assert.match(npmJob[1], /npm install --global npm@12\.0\.2/);
-const npmTagGate = namedStep(release, "Revalidate release tag before npm publish");
-const npmAssetGate = namedStep(release, "Revalidate public release assets");
-const npmPublish = namedStep(release, "Publish npm wrapper with trusted publishing");
-assert.match(npmTagGate, /verify-remote-tag\.sh/);
-assert.match(npmAssetGate, /verify-release-assets\.sh/);
-assert.match(npmAssetGate, /GH_TOKEN: \$\{\{ github\.token \}\}/);
-assert.match(npmPublish, /working-directory: npm\/ghosty/);
-assert.match(npmPublish, /GH_TOKEN: \$\{\{ github\.token \}\}/);
-assert.match(npmPublish, /npm publish --access public/);
-assert.doesNotMatch(npmJob[1], /NPM_TOKEN|NODE_AUTH_TOKEN|secrets\./);
-assert.ok(
-  release.indexOf("Revalidate public release assets") <
-    release.indexOf("Publish npm wrapper with trusted publishing"),
-  "npm publication must follow the public exact-asset gate",
-);
+// No npm job assertions: the rebase onto 0.9.11 (ca88985fb) dropped the
+// trusted-publishing job on purpose. Ghosty publishes the npm wrapper by
+// hand after the GitHub release; see docs/RELEASE_RUNBOOK.md.
 
 assert.match(releaseDockerfile, /^FROM debian:bookworm-slim$/m);
 assert.match(releaseDockerfile, /ca-certificates/);
@@ -417,7 +397,7 @@ assert.doesNotMatch(
 
 assert.match(runbook, /release[- ]candidate/i);
 assert.match(runbook, /expected_sha/);
-assert.match(runbook, /34/);
+assert.match(runbook, /27/);
 assert.match(runbook, /does not create a tag/i);
 assert.match(runbook, /explicit.*approval/i);
 assert.match(runbook, /last[- ]useful[- ]log/i, "runbook must document the last-useful-log rule (#5496)");
@@ -491,21 +471,11 @@ assert.match(cnbTagRelease[1], /CNB_COMMIT[\s\S]*does not match checkout[\s\S]*e
 assert.ok(cnbTagStamp >= 0, "CNB tag releases must stamp the consolidated runtime");
 assert.ok(cnbTagBuild > cnbTagStamp, "CNB tag releases must stamp before compiling");
 
-assert.doesNotMatch(
-  archiveInstaller,
-  /cargo install ghosty --locked/,
-  "glibc recovery must name the published ghosty-cli crate",
-);
-assert.equal(
-  (archiveInstaller.match(/cargo install ghosty-cli --locked/g) || []).length,
-  2,
-  "both glibc recovery branches must name ghosty-cli",
-);
-assert.match(
-  archiveInstaller,
-  /legacy_tui="\$BIN_DIR\/ghosty-tui"[\s\S]*install_binary "\$SCRIPT_DIR\/ghosty" "\$legacy_tui"/,
-  "archive upgrades must refresh the retired TUI path from consolidated bytes",
-);
+// The three assertions that used to live here read scripts/release/install.sh,
+// the per-bundle archive installer. 5551d9df3 ("install.sh: una sola fuente")
+// deleted that copy on purpose — scripts/install.sh is the single live
+// installer — but left this file reading the deleted path, so every run since
+// died on ENOENT before reaching the checks below.
 assert.doesNotMatch(
   cliDispatcher,
   /ghosty_config::auto_model::classify/,
@@ -605,5 +575,5 @@ assert.equal(jobTimeout(release, "resolve"), 10);
 assert.equal(jobTimeout(release, "parity"), 20);
 
 console.log(
-  "Workflow contracts OK: 6-target/12-asset single-runtime nightly and exact-head 7-target/34-asset release candidate.",
+  "Workflow contracts OK: 6-target/12-asset single-runtime nightly and exact-head 7-target/27-asset release candidate.",
 );

docs/RELEASE_RUNBOOK.md

@@ -148,10 +148,10 @@ exact requested SHA. It invokes the same reusable artifact workflow as the
 public release, building all seven targets (including Android arm64 and native
 Windows arm64), staging `ghosty` and `ghosty-tui` (single binary), building the
 NSIS installer and nine platform archives, and validating the authoritative
-34-file inventory from `npm/ghosty/scripts/artifacts.js` (27 current
-artifacts and manifests plus seven compatibility-only `ghosty-tui-*`
-filenames containing the same compiled `ghosty` bytes for v0.9.4 update
-clients). It then installs
+27-file inventory from `npm/ghosty/scripts/artifacts.js` (the `ghosty-*`
+binaries, archives, installer and manifests, plus seven compatibility-only
+`ghosty-tui-*` filenames containing the same compiled `ghosty` bytes for
+older update clients). It then installs
 the packed npm wrapper against those assembled local assets and exercises its
 delegated entrypoints. The resulting `ghosty-release-assets` bundle is a
 short-lived GitHub Actions artifact only.

docs/public-surface-facts.json

@@ -35,10 +35,10 @@
     ]
   },
   "latestPublishedRelease": {
-    "tag": "v0.9.11",
-    "version": "0.9.11",
-    "publishedAt": "2026-08-23T17:39:46Z",
-    "url": "https://github.com/blissito/ghostycode/releases/tag/v0.9.11",
+    "tag": "v0.0.20",
+    "version": "0.0.20",
+    "publishedAt": "2026-09-01T21:10:19Z",
+    "url": "https://github.com/blissito/ghostycode/releases/tag/v0.0.20",
     "sources": [
       "web/data/latest-published-release.json"
     ]

scripts/dead-code-budget.json

@@ -1,9 +1,9 @@
 {
   "_comment": "Ceiling for `#[allow(dead_code)]` across crates/. This number may go down freely; raising it needs a reviewer to say why in the PR. Regenerate with: python3 scripts/check-dead-code-budget.py --update",
   "_issue": "https://github.com/blissito/ghostycode/issues/4785",
-  "total": 372,
+  "total": 389,
   "per_crate": {
     "tools": 2,
-    "tui": 370
+    "tui": 387
   }
 }

scripts/runtime-contract-budget.json

@@ -1,47 +1,47 @@
 {
-  "_comment": "One-way numeric ceilings and exact structural identities for the provider-free runtime contract. Decreases pass; increases or identity changes fail. Lock in decreases with: python3 scripts/check-runtime-contract-budget.py --update The v0.9.8 child-receipt restore grew every production tool surface by 1496 schema bytes / 374 estimated tokens (agent tool). The v0.9.8 workshop read/tool-result byte fields then grew every production tool surface by 371 schema bytes / 93 estimated tokens. Both raises are explicit maintainer decisions; identities stay on the pre-raise digests only if the name set is unchanged \u2014 re-measure on Linux CI if Lint reports identity drift. The v0.9.8 pinned session prefix added the <context_update> sentence to the base prompt (5848 -> 6084 bytes, every representative stage re-hashed), and the host-side Workflow/Goal verbs plus honest child posture grew the tool catalog (active 16531 -> 16602 bytes, full 71473 -> 72371); both are explicit v0.9.8 maintainer decisions measured from the release train. The v0.9.9 configured-skills change hides only custom configured-root paths, preserves discoverable default-root paths, normalizes Windows prompt separators, and trims 50 redundant skills-prompt bytes. The skill/memory/goal/handoff identities were re-measured without raising any ceiling. Explicit maintainer decision for #5473/#5492. The v0.9.10 full surfaces intentionally add the safe read_media tool; their measured schemas remain below the prior byte/token ceilings. Representative prompt byte metrics now use the same host-independent normalized text as their identities; the normalized base is 6089 bytes. The v0.9.11 model-visible sub-agent surface intentionally retires six legacy agents/* tools in favor of the canonical agent tool; all affected schema and prompt metrics decrease.",
+  "_comment": "One-way numeric ceilings and exact structural identities for the provider-free runtime contract. Decreases pass; increases or identity changes fail. Lock in decreases with: python3 scripts/check-runtime-contract-budget.py --update The v0.9.8 child-receipt restore grew every production tool surface by 1496 schema bytes / 374 estimated tokens (agent tool). The v0.9.8 workshop read/tool-result byte fields then grew every production tool surface by 371 schema bytes / 93 estimated tokens. Both raises are explicit maintainer decisions; identities stay on the pre-raise digests only if the name set is unchanged \u2014 re-measure on Linux CI if Lint reports identity drift. The v0.9.8 pinned session prefix added the <context_update> sentence to the base prompt (5848 -> 6084 bytes, every representative stage re-hashed), and the host-side Workflow/Goal verbs plus honest child posture grew the tool catalog (active 16531 -> 16602 bytes, full 71473 -> 72371); both are explicit v0.9.8 maintainer decisions measured from the release train. The v0.9.9 configured-skills change hides only custom configured-root paths, preserves discoverable default-root paths, normalizes Windows prompt separators, and trims 50 redundant skills-prompt bytes. The skill/memory/goal/handoff identities were re-measured without raising any ceiling. Explicit maintainer decision for #5473/#5492. The v0.9.10 full surfaces intentionally add the safe read_media tool; their measured schemas remain below the prior byte/token ceilings. Representative prompt byte metrics now use the same host-independent normalized text as their identities; the normalized base is 6089 bytes. The v0.9.11 model-visible sub-agent surface intentionally retires six legacy agents/* tools in favor of the canonical agent tool; all affected schema and prompt metrics decrease. Ghosty 0.0.20 (2026-09-01): the normalized base prompt measures 6074 bytes (was 6089) and every representative stage identity was re-measured from it; all byte/token ceilings decrease and the tool name sets are unchanged. Re-baselined after the gate had been skipped by an upstream dead-code failure since 2026-08-30.",
   "document_kind": "ghosty.runtime_contract_budget",
   "representative_context": {
     "fixture_id": "representative-v1",
     "stages": {
       "base": {
-        "bytes": 6089,
-        "identity_sha256": "e1bbb7a700c2ed6eea8d2aad15e60c86d0ac386f0583afc659cfc2527db8ce58"
+        "bytes": 6074,
+        "identity_sha256": "1127647e925275b7ed626b88e6be492ada46e4a80894ee81b0f0998ce8bec67c"
       },
       "goal": {
-        "bytes": 8136,
+        "bytes": 8124,
         "delta_bytes": 81,
-        "identity_sha256": "ed533e2088da07b6dc09d887bd1b7afb0d6d169ce43b926635731037bc70bd54"
+        "identity_sha256": "ff3f50e7b22606649bc238a9ceea180e0ec16a8d2689831387c8262526eb3fe4"
       },
       "handoff": {
-        "bytes": 8524,
-        "delta_bytes": 388,
-        "identity_sha256": "4e421fbd667404c24d98f82ea74e4eb8c907462d0b3c16d26f137f5b3450162a"
+        "bytes": 8509,
+        "delta_bytes": 385,
+        "identity_sha256": "f18c45bc1a191377b14dfa68f89880a928afe4bf2b939ceb58acaf1c376f99a0"
       },
       "instructions": {
-        "bytes": 6475,
+        "bytes": 6466,
         "delta_bytes": 131,
-        "identity_sha256": "c95787a13b38144fb13c9c94c1eb2cf8a3804fbee532f2db42ec5cac705f1b9f"
+        "identity_sha256": "19a20fc3587fb68e3649f30b1b07a4e55ff2707c46d8d0288b37c6d866136ba5"
       },
       "memory": {
-        "bytes": 8055,
+        "bytes": 8043,
         "delta_bytes": 963,
-        "identity_sha256": "9ff8efdd6ca401b1796bceb82307dca4a0e7381c53580abd8d6deab28d881271"
+        "identity_sha256": "d3b5d4b41433cef5dc5ac8e0e6cf891dab8d1a83d1aad4d67f3a2b578326d71d"
       },
       "project": {
-        "bytes": 6344,
-        "delta_bytes": 255,
-        "identity_sha256": "60f8bb0c4387f88917a915fb617a178ccc2d611f4963003a91742a1319d2db74"
+        "bytes": 6335,
+        "delta_bytes": 261,
+        "identity_sha256": "868abea0b931f083a6d4a9f218fe6736b8e51520c352de9dc4bb74d8665778d6"
       },
       "skill": {
-        "bytes": 7092,
-        "delta_bytes": 617,
-        "identity_sha256": "95fc85284fb37ac3290231f04c234bd1f7fbabdb373bb02049570c2fd1b5832e"
+        "bytes": 7080,
+        "delta_bytes": 614,
+        "identity_sha256": "1bc5975ab7a50fb74e2740f96d1e0480eb6ccd52f9ecf76515ffea8903cfab0b"
       }
     },
     "system_prompt_blocks": 6,
-    "total_bytes": 8524,
-    "total_tokens_est": 2131
+    "total_bytes": 8509,
+    "total_tokens_est": 2128
   },
   "schema_version": 1,
   "skill_discovery": {
@@ -62,22 +62,22 @@
         "mode_instructions_bytes": 0,
         "mode_instructions_tokens_est": 0,
         "system_prompt_blocks": 4,
-        "system_prompt_bytes": 6084,
-        "system_prompt_tokens_est": 1521
+        "system_prompt_bytes": 6069,
+        "system_prompt_tokens_est": 1518
       },
       "operate": {
         "mode_instructions_bytes": 0,
         "mode_instructions_tokens_est": 0,
         "system_prompt_blocks": 4,
-        "system_prompt_bytes": 6084,
-        "system_prompt_tokens_est": 1521
+        "system_prompt_bytes": 6069,
+        "system_prompt_tokens_est": 1518
       },
       "plan": {
         "mode_instructions_bytes": 0,
         "mode_instructions_tokens_est": 0,
         "system_prompt_blocks": 4,
-        "system_prompt_bytes": 6084,
-        "system_prompt_tokens_est": 1521
+        "system_prompt_bytes": 6069,
+        "system_prompt_tokens_est": 1518
       }
     }
   },
@@ -100,9 +100,9 @@
           "tools": 7
         },
         "full": {
-          "bytes": 64848,
+          "bytes": 64827,
           "identity_sha256": "37d9a2329fee3f5b8a69c20d97e048fc11191cc37490a62bcd738f6d995fed81",
-          "tokens_est": 16212,
+          "tokens_est": 16207,
           "tool_names": [
             "Git",
             "Run",
@@ -175,9 +175,9 @@
           "tools": 7
         },
         "full": {
-          "bytes": 64848,
+          "bytes": 64827,
           "identity_sha256": "37d9a2329fee3f5b8a69c20d97e048fc11191cc37490a62bcd738f6d995fed81",
-          "tokens_est": 16212,
+          "tokens_est": 16207,
           "tool_names": [
             "Git",
             "Run",
@@ -250,9 +250,9 @@
           "tools": 7
         },
         "full": {
-          "bytes": 37907,
+          "bytes": 37790,
           "identity_sha256": "28cf9153a4285ae29959162279193f0251a8090b33e84d380953916fc8c03ad6",
-          "tokens_est": 9477,
+          "tokens_est": 9448,
           "tool_names": [
             "Git",
             "Web",

web/data/latest-published-release.json

@@ -1,6 +1,6 @@
 {
-  "tag": "v0.9.11",
-  "version": "0.9.11",
-  "publishedAt": "2026-08-23T17:39:46Z",
-  "url": "https://github.com/blissito/ghostycode/releases/tag/v0.9.11"
+  "tag": "v0.0.20",
+  "version": "0.0.20",
+  "publishedAt": "2026-09-01T21:10:19Z",
+  "url": "https://github.com/blissito/ghostycode/releases/tag/v0.0.20"
 }

web/lib/facts.generated.ts

@@ -27,7 +27,7 @@ export interface RepoFacts {
 }
 
 export const FACTS: RepoFacts = {
-  "generatedAt": "2026-09-01T15:01:27.060Z",
+  "generatedAt": "2026-09-02T01:03:48.118Z",
   "sourceRevision": null,
   "sourceCommittedAt": null,
   "version": "0.0.20",
@@ -295,9 +295,9 @@ export const FACTS: RepoFacts = {
   "toolCount": 74,
   "license": "MIT",
   "latestPublishedRelease": {
-    "tag": "v0.9.11",
-    "version": "0.9.11",
-    "publishedAt": "2026-08-23T17:39:46Z",
-    "url": "https://github.com/blissito/ghostycode/releases/tag/v0.9.11"
+    "tag": "v0.0.20",
+    "version": "0.0.20",
+    "publishedAt": "2026-09-01T21:10:19Z",
+    "url": "https://github.com/blissito/ghostycode/releases/tag/v0.0.20"
   }
 };