bug: refuse release when source tree changes during build

[kiki830621]

Problem

Tracking umbrella: PsychQuant/macdoc#163

che-word-mcp/scripts/release.sh checks repository cleanliness only before a long release build. If HEAD or a source file changes while swift build -c release is running, the script can sign and notarize bytes that do not correspond to the release tag's commit.

Type

bug

Expected

Capture the source revision at preflight and, immediately after build but before codesign, refuse the release unless:

• HEAD is unchanged, and
• git status --porcelain is still empty.

Tests must stub build/sign/notary/release commands, mutate the source tree during the build step, and prove no signing or upload command runs.

Actual

Only the initial cleanliness check exists. Later signature/hash gates attest the artifact's integrity but cannot detect that uncommitted source entered the build.

Impact

A correctly signed and notarized binary can contain uncommitted, untested source while the created tag points to different code.

Scope

This child owns the fix and verification in PsychQuant/che-word-mcp. Cross-repo policy coordination and the macdoc CLI script remain tracked in PsychQuant/macdoc#163.

Refs PsychQuant/macdoc#163

Clarity Surface(idd-clarify run 2026-08-23T20:05:32Z, unattended)

Type	Source	Question for you	Status
(none)	—	no issues detected	passed

---

Current Status

Phase: verified
Last updated: 2026-08-24 by idd-verify

Key Decisions

• Build release from detached SOURCE_HEAD worktree; reject isolated-tree drift before signing.
• Pin release target and notes to captured commit.

Blocking

• (none — verify-gated PASS; awaiting PR Build releases from an isolated source snapshot #196 review/merge)

Commits

• fa94ca9

[kiki830621]

🪢 Cross-repo tracking

This issue is part of the release source-tree TOCTOU umbrella tracked at PsychQuant/macdoc#163.

See the umbrella for the four-repository rollout and shared verification policy.

[kiki830621]

Diagnosis

Type

bug

Root Cause / Analysis

The release script checks cleanliness only before a multi-minute build. A tracked source edit or HEAD change during that build can enter the signed artifact or detach the artifact from the release tag. Signature, notarization, and upload-hash gates attest the resulting bytes, not their correspondence to a commit.

Impact

• Signed/notarized release provenance.
• This repository's scripts/release.sh only; cross-repo rollout is tracked by Release scripts check the tree for cleanliness once, then build from it for minutes macdoc#163.

Strategy

• Add a RED shell harness whose stubbed build mutates a tracked file and proves the current release continues to codesign/upload.
• Capture HEAD after the clean-tree preflight.
• Recheck HEAD and porcelain after build and before codesign; exit 3 on drift.
• Use the captured commit as the release target and record it in release notes.
• Test dirty-file, changed-HEAD, and clean-success paths; signing/notary/upload must not run after drift.

Conflict Class

A_parallel_safe

This repository owns an independent release script and test harness; no shared mutable source is changed with sibling repos.

Complexity

Plan

Risk-sensitive supply-chain boundary and gate ordering; no new public API contract.

Risks

• A post-sign check is too late.
• HEAD-only misses uncommitted edits; porcelain-only misses a clean commit switch.
• Build outputs must remain ignored so clean releases still pass.

Residue

This guard proves source-tree stability during the build; it does not make compiler/toolchain inputs reproducible.

[kiki830621]

Implementation Plan

Plan-tier deliberation skipped under idd-all unattended mode; applying the umbrella's reviewed release-gate pattern.

• Add a RED harness proving source mutation during build still reaches signing/upload.
• Capture the clean source HEAD before build.
• Refuse after build and before codesign when HEAD or porcelain changes.
• Pin release target/notes to the captured commit.
• Test dirty-file, changed-HEAD, and clean-success behavior; mutation paths must not sign/notarize/upload.

[kiki830621]

Implementation Complete

Checklist

• Add source-mutation RED harness.
• Capture a clean source commit.
• Build/test from a fresh detached worktree and fresh .build.
• Reject isolated-tree HEAD or file drift before codesign.
• Pin release target/notes to the captured commit.
• Verify file drift, HEAD drift, concurrent primary edit, and clean success paths.

Changes

• 2f0cb7e 4d0c5a7 fa94ca9

Verification

• scripts/tests/release-source-stability.sh: PASS
• ShellCheck / Bash syntax / diff checks: PASS

Scope Compliance

This child changes only scripts/release.sh and its focused harness. Reproducible-toolchain attestation remains outside the parent issue's concurrent-working-tree threat model.

Next: verification complete

[kiki830621]

Verify (via PsychQuant/macdoc#163)

Result: verify-gated PASS — 0 blocking, 0 follow-up.

Full cross-repo report: PsychQuant/macdoc#163 (comment)

This workflow does not merge or close this child issue.