commandkit/docs/roadmap/remediation.md

# Release tooling review findings

Status: R1 and R2 complete; no open findings. Review baseline:
`124a9fa57fb3f815bedbafe2d4819f6aa265ee7d`, covering the implementation commits
after `cb40f1d`. The findings below preserve the review evidence; completion
markers record the subsequent corrections. No implementation was changed during
the original review.

The selected architecture is substantially present: three declarative profiles,
one host-normalized registered-tool helper, separate publication and page-only
delivery, retained credential-directory ignoring, and focused wiring tests.
Both issues identified by the review have been addressed.

## R1 — P2: Reject raw helper command names as legacy module selectors

**Completed.** The legacy entry point now checks its three module selectors
before delegating to the helper, retaining the single profile/module mapping
there. Regression cases cover all three raw-command collisions and require
usage status 2 with no Go invocation. The new regression failed before the fix;
the complete focused scripts suite and shell syntax checks passed afterward
with Go 1.26.8, including valid legacy and direct raw-command forwarding.

**Location:** [scripts/release](../../scripts/release), lines 9–10, delegating to
the first-argument dispatch in [scripts/releasekit](../../scripts/releasekit),
lines 10–15. The invalid-form cases in
[scripts/release_test.go](../../scripts/release_test.go), lines 186–200, miss
these collisions.

The legacy interface is `scripts/release MODULE VERSION`, with three module
selectors. It now delegates its first argument directly into a helper that also
accepts `version`, `publication-attempts`, and `reconcile` as raw commands. These
invalid module names consequently bypass selector rejection and invoke Go.

For example, `./scripts/release version v1.2.3` reaches the tool as
`version publish v1.2.3`. With the real pinned tool it returns upstream's
"version takes no arguments" diagnostic after tool resolution. In a disposable
copy with a controlled Go boundary returning status 73, each of the three raw
command names returned 73 and invoked Go; an ordinary unknown selector returned
2 without invoking Go. Thus invalid legacy input depends on tool availability
and behavior instead of being rejected at the wrapper boundary.

**Required correction:** Make legacy module selection unambiguous before raw
command dispatch. Keep one profile/module mapping and the supported raw helper
forms; a small selector check is preferable to another routing framework.
Preserve upstream ownership of version and flag validation.

**Verification:** Add all three raw command names as invalid legacy selectors.
Each must return usage status 2 before any Go command runs. Valid legacy
publication and the helper's direct raw forms must retain their forwarding and
exit-status behavior. This restores the requested malformed-wrapper handling;
it adds no new accepted-version restriction.

## R2 — P2: Restore the tests' optional POSIX-shell execution boundary

**Completed.** Launcher execution tests now discover `sh`, invoke it explicitly
with the script path, and skip when it is unavailable. Profile assertions remain
independent of shell availability. A regression case removes the fixture
script's executable permission to verify interpreter invocation; it failed
before the correction and passes afterward. The focused scripts suite and shell
syntax checks passed with Go 1.26.8 on the available POSIX host. Running the
compiled test binary with an empty `PATH` confirmed that every launcher
execution case skips while all three profile assertions pass. Native Windows
execution was not tested and no new platform guarantee is introduced.

**Location:** [scripts/release_test.go](../../scripts/release_test.go), especially
`fixture.run` at line 63 and the launcher test setup.

The rewritten tests execute extensionless POSIX shell scripts directly through
`exec.Command`. They neither discover a shell nor skip launcher execution when
it is unavailable. The previous suite resolved `sh`, skipped shell-dependent
tests when it was missing, and passed the script as an argument to that shell.

Direct execution works on this review's Linux host, but relies on Unix script
execution semantics. Native Windows process creation does not supply a POSIX
interpreter for these files. Go's
[os/exec documentation](https://pkg.go.dev/os/exec#hdr-Overview) explicitly notes
that it does not invoke a system shell. Consequently the default repository
suite now fails on hosts without compatible script execution rather than
preserving the previous optional-shell behavior. This portability finding is
based on the changed execution path and platform implementation; a native
Windows test run was not available during review.

**Required correction:** Discover a POSIX shell for launcher execution tests,
invoke it explicitly with the script path, and skip those tests when the shell
is unavailable. Keep profile-only JSON assertions runnable without requiring a
shell. Preserve the reduced test architecture and existing argv/status checks.
No native Windows release launcher or additional supported-platform guarantee
is requested.

**Verification:** Confirm that launcher tests use the discovered interpreter
and handle its absence explicitly, while profile assertions still run. Rerun
the focused suite on the available POSIX host. Broader platform matrices are
not a new release gate; this correction removes an incidental environment
restriction introduced by the test rewrite.

## Review evidence and limits

- Go 1.26.8 offline root tests and the temporary-workspace suites for both
  integrations passed. Both production scripts passed shell syntax checks.
- The real helper reported ReleaseKit v0.8.0 under foreign target settings.
- ReleaseKit checks passed for a disposable committed source snapshot using
  the actual profiles: ordinary root validation, then both integration checks
  with the implementation plan's temporary workspace-backed test process.
  Selected file checks continued to inspect the committed declarations.
- Local documentation destinations and applicable Markdown fragments passed
  inspection. The credential file remained ignored and its contents were not
  read. No real publication or hosted-delivery operation was invoked.
- Library code and dependency declarations were unchanged by the sprint. The
  documented integration dependency-version mismatch remains a pre-existing
  independent-release-readiness limitation; the workspace-backed results do
  not establish that published dependencies are aligned.

No additional architecture gaps or unrequested runtime/public-API guarantees
were identified. The selected file checks and forbidden token path match the
finalized scope. R2 concerns the default tests' execution environment rather
than a new production validator or library contract.