From 7eac3fea65f044f31df2ca76d7d8352089ec9999 Mon Sep 17 00:00:00 2001
From: Eric Rakestraw <eric@rakestraw.us>
Date: Wed, 4 Nov 2026 02:29:09 +0000
Subject: [PATCH] Reject invalid legacy release selectors

---
 docs/roadmap/remediation.md |  9 ++++++++-
 scripts/release             | 10 ++++++++--
 scripts/release_test.go     | 14 +++++++++++++-
 3 files changed, 29 insertions(+), 4 deletions(-)

diff --git a/docs/roadmap/remediation.md b/docs/roadmap/remediation.md
index dd80ed6..93a3fd1 100644
--- a/docs/roadmap/remediation.md
+++ b/docs/roadmap/remediation.md
@@ -1,6 +1,6 @@
 # Release tooling review findings
 
-Status: two open findings. Review baseline:
+Status: R1 complete; R2 open. Review baseline:
 `124a9fa57fb3f815bedbafe2d4819f6aa265ee7d`, covering the implementation commits
 after `cb40f1d`. This record requests corrections; no implementation was changed
 during review.
@@ -13,6 +13,13 @@ complete.
 
 ## R1 — P2: Reject raw helper command names as legacy module selectors
 
+**Completed.** The legacy entry point now checks its three module selectors
+before delegating to the helper, retaining the single profile/module mapping
+there. Regression cases cover all three raw-command collisions and require
+usage status 2 with no Go invocation. The new regression failed before the fix;
+the complete focused scripts suite and shell syntax checks passed afterward
+with Go 1.26.8, including valid legacy and direct raw-command forwarding.
+
 **Location:** [scripts/release](../../scripts/release), lines 9–10, delegating to
 the first-argument dispatch in [scripts/releasekit](../../scripts/releasekit),
 lines 10–15. The invalid-form cases in
diff --git a/scripts/release b/scripts/release
index 441e9c9..614aed2 100755
--- a/scripts/release
+++ b/scripts/release
@@ -1,10 +1,16 @@
 #!/bin/sh
 set -eu
 
-if [ "$#" -ne 2 ]; then
+usage() {
     printf '%s\n' 'usage: ./scripts/release MODULE VERSION' >&2
     exit 2
-fi
+}
+
+[ "$#" -eq 2 ] || usage
+case "$1" in
+    core|ckconfig|ckprompt) ;;
+    *) usage ;;
+esac
 
 script_dir=$(CDPATH= cd "$(dirname "$0")" && pwd)
 exec "$script_dir/releasekit" "$1" publish "$2"
diff --git a/scripts/release_test.go b/scripts/release_test.go
index 905611d..b70e92a 100644
--- a/scripts/release_test.go
+++ b/scripts/release_test.go
@@ -187,7 +187,19 @@ func TestInvalidForms(t *testing.T) {
 	for _, tc := range []struct {
 		script string
 		args   []string
-	}{{"releasekit", nil}, {"releasekit", []string{"unknown"}}, {"releasekit", []string{"core"}}, {"releasekit", []string{"core", "version"}}, {"release", nil}, {"release", []string{"core"}}, {"release", []string{"core", "v1", "extra"}}, {"release", []string{"unknown", "v1"}}} {
+	}{
+		{"releasekit", nil},
+		{"releasekit", []string{"unknown"}},
+		{"releasekit", []string{"core"}},
+		{"releasekit", []string{"core", "version"}},
+		{"release", nil},
+		{"release", []string{"core"}},
+		{"release", []string{"core", "v1", "extra"}},
+		{"release", []string{"unknown", "v1"}},
+		{"release", []string{"version", "v1.2.3"}},
+		{"release", []string{"publication-attempts", "v1.2.3"}},
+		{"release", []string{"reconcile", "v1.2.3"}},
+	} {
 		f := newFixture(t)
 		_, stderr, status := f.run(t, tc.script, 0, tc.args...)
 		if status != 2 || !strings.Contains(stderr, "usage:") {