Fix #16: Add release doctor preflight command

[tizerluo]

Summary

• Adds read-only agent-loop release doctor preflight with JSON and human pass/warn/fail reports.
• Checks git/GitHub/npm/version metadata/generated dist/release workflow/required release entrypoints.
• Extends hook policy only for release doctor and narrow read-only release preflight queries.
• Updates the packaged HOLO-Codex skill with hook command discipline and release preflight guidance.

Run

• agent-loop run id: a744ae53-b391-4fc1-8aa3-361b67e6df81

Verification

• pnpm exec vitest run plugins/autonomous-pr-loop/tests/release-doctor.test.ts plugins/autonomous-pr-loop/tests/hook-policy.test.ts plugins/autonomous-pr-loop/tests/cli-run.test.ts --no-file-parallelism --maxWorkers=1 passed: 3 files, 86 tests.
• pnpm lint passed.
• pnpm test passed: 36 files, 417 tests.
• pnpm build:hooks passed.
• npx gitnexus detect_changes --repo HOLO-Codex --scope staged passed: 8 files, 82 symbols, 19 flows, critical risk expected for CLI/hook policy.
• pnpm agent-loop release doctor --json produced expected fail on this feature branch because checkout is not main/clean and 0.1.2 already exists on GitHub/npm.

Reviews

• Internal tester: PASS after fixes; no unresolved P0/P1/P2.
• Internal reviewer: PASS after P1/P2 fixes; no unresolved P0/P1/P2.
• Claude ACP code/security review required after PR opens.
• AGY/Gemini UI review not required; no dashboard/UI changes.

Notes

• Local global skill /Users/mac-mini/.agents/skills/pr-delivery-loop/SKILL.md was updated as local operator guidance and is intentionally not part of this PR diff.
• Browser validation not required; this PR does not change dashboard UI.

Fixes #16

[tizerluo]

Delivery owner report

Run id: a744ae53-b391-4fc1-8aa3-361b67e6df81

Summary

• Added read-only agent-loop release doctor with JSON and human pass/warn/fail output.
• Checks git baseline, GitHub default branch/open issues/open PRs/release, git tag, npm version, version metadata, generated dist, release workflow markers, and required release entrypoints.
• Added narrow hook allowlist entries for release doctor and read-only release preflight queries.
• Updated packaged HOLO-Codex skill with hook command discipline and release preflight guidance.

Hook doctor

• Router installed: yes.
• Router points to expected dist: yes.
• Legacy commands: none.
• Unexpected router commands: none.
• Current repo active binding: yes.
• Note: hook capture initially showed a previous run id in the latest event, but binding for this session was updated to this run.

GitNexus

• Impact: runAgentLoopCli LOW, commandHelpUsage CRITICAL help surface, matchesAgentLoopAllowlist LOW, runDoctor LOW.
• Detect: npx gitnexus detect_changes --repo HOLO-Codex --scope staged passed; 8 files, 82 symbols, 19 flows, critical risk expected for CLI/hook policy.

Verification

• Focused tests passed: release-doctor, hook-policy, cli-run; 86 tests.
• pnpm lint passed.
• pnpm test passed: 36 files, 417 tests. One earlier delivery-bind test failure passed on single rerun and final full rerun.
• pnpm build:hooks passed.
• pnpm agent-loop release doctor --json produced expected fail on this feature branch because checkout is not main/clean and 0.1.2 already exists on GitHub/npm.
• Browser validation: not required; no dashboard/UI changes.

Review status

• Internal tester: PASS after fixes; no unresolved P0/P1/P2.
• Internal reviewer: PASS after P1/P2 fixes; no unresolved P0/P1/P2.
• Claude ACP code/security review is required next.
• AGY/Gemini UI review is not required.

Local-only note

• Local global skill /Users/mac-mini/.agents/skills/pr-delivery-loop/SKILL.md was updated as operator guidance and is intentionally not part of this PR diff.

[tizerluo]

Internal reviewer report

Run id: a744ae53-b391-4fc1-8aa3-361b67e6df81

Role: internal reviewer
Conclusion: PASS

Review focus

• Release doctor command safety and report design.
• CLI argument parsing and exit-code behavior.
• Hook policy allowlist boundaries.
• Secret/token redaction in diagnostics.
• Release-blocking issue detection.
• Generated dist freshness handling.

Findings and resolution

• P0: none.
• P1: fixed. Raw command stderr could enter JSON report. Added diagnostic redaction for GitHub tokens, Bearer tokens, API keys, and token/auth/password/secret key-value forms; added tests.
• P2: fixed. release doctor ignored extra positional args. Added strict parser and tests.
• P2: fixed. mtime-based stale generated dist could false-fail. Missing dist remains fail; stale dist is now warn.
• P2: fixed. Release-blocking issue detection now checks labels, title, and body, including release blocker, release-blocker, blocker, P0, and P1; added body and label tests.
• P3: accepted follow-up. Release workflow validation is marker-based; future YAML structural parsing could improve precision.

No unresolved P0/P1/P2.

[tizerluo]

Internal tester report

Run id: a744ae53-b391-4fc1-8aa3-361b67e6df81

Role: internal tester
Conclusion: PASS

Checks performed

• Reviewed current diff, release doctor behavior, hook allowlist, packaged skill update, and local global skill update.
• Ran pnpm agent-loop release doctor --json: expected fail because current checkout is a dirty feature branch and 0.1.2 already exists.
• Ran human output smoke: release doctor: fail with readable per-check status.
• Verified read-only queries: git ls-remote origin refs/tags/v0.1.2, gh release view v0.1.2 ..., and gh release list --json tagName,publishedAt.
• Verified pnpm agent-loop release doctor --help works with hook enabled.
• Focused tests passed.

Findings

• P0: none.
• P1: none.
• P2: fixed. Initial issue: gh release list --json tagName,publishedAt,url used unsupported url field. Fixed by using tagName,publishedAt.
• P3: fixed. release doctor --help was initially blocked by hook allowlist; now allowed.

No unresolved P0/P1/P2.

[tizerluo]

Claude ACP code/security review

External read-only review completed via Claude ACP.

Conclusion: PASS

No P0/P1/P2 findings.

Notes:

• Hook allowlist safety was reviewed with focus on gh release view/list, repo scoping, semantic tag limits, and exact --json fields.
• Claude classified the narrow gh release view/list forms as fail-closed safety behavior, not a defect.
• Optional future follow-up: add a test for npm returning an E404-style JSON error body on stdout, though current stderr E404 and non-404 warn behavior are acceptable and non-blocking.
• Claude also ran focused checks: hook-policy.test.ts + release-doctor.test.ts (27 passed), and cli-run.test.ts -t release (3 passed, 56 skipped).

No edits or external GitHub actions were attempted by Claude ACP.