Release process must advance the next edge line (reconcile + calendar bump) on every release, not just stable (#455)

* release: advance the `next` edge line on every tag, not just stable

release.yml's hyphenated-tag carve-out advanced neither `stable` (correctly)
nor `next`, so a prerelease cut left the edge marketplace serving a stale
plugin — the 0.24.0-pre1 cut drifted `next` 40 commits behind `main` and
hard-blocked `spacedock codex` on a binary/plugin version-compat check.

Add an `edge-advance` job (`needs: goreleaser`, a sibling so a reconcile
conflict can't unwind the published release) that reconciles `next` to the
tagged commit via `git merge -X theirs` on both tag paths, then bumps the
marketplace calendar key. On a stable tag it also stamps `next` PAST the
release to the post-release dev pre-version (X.(Y+1).0-pre1) so the edge line
never masquerades as the stable version it just shipped. The reconcile is a
fast-forward merge, never a reset or force-push.

Add release.DevPreVersion + the `spacedock-release dev-preversion` subcommand
(reusing stamp-version/bump-calendar unchanged), a temp-repo fixture proving
the reconcile closes the divergence force-free on both paths, a never-forces
workflow guard with adversarial twins, and the docs/releasing.md edge-line
section.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* release: couple edge-advance fixture + wiring to the on-disk release.yml

Close the two coupling holes the detached adversarial audit found: flipping
release.yml's reconcile steps to `-X ours` (the 0.24.0-pre1 incident) or
widening the stable step's `if:` to `always()` both stayed green.

- The divergence fixture now reads its merge `-X <strategy>` from the parsed
  edge-advance reconcile step for the tag's path instead of hardcoding
  `-X theirs`, so a workflow drift to `-X ours` reds the tree-match assertion
  directly. Corrected the overclaiming doc-comment (it reconstructs the
  sequence; it does not run release.yml's steps).
- Add TestReleaseWorkflowEdgeAdvanceWiring + assertEdgeAdvanceWiring in the same
  readWorkflow harness, asserting both reconcile steps merge `-X theirs`, the
  `if:` guards are complementary (exactly one fires per tag), and bump-calendar
  carries no `if:`. Adversarial twins (-X ours, always(), copy-paste guard,
  gated bump) each red. Consolidated on a shared edgeAdvanceJob lookup.

The never-force and DevPreVersion lenses are unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Spike Test <spike@example.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: 3 people

.github/workflows/release.yml

@@ -247,3 +247,77 @@ jobs:
           # push, so the default GITHUB_TOKEN suffices (no cross-repo PAT, unlike the
           # homebrew-tap push).
           git push origin "$RELEASE_COMMIT:refs/heads/stable"
+
+  # Advances `next` — the branch `spacedock-edge` resolves — on EVERY tag, not
+  # just stable. A SIBLING of goreleaser (`needs: goreleaser`, mirroring the
+  # journey-ledger job's isolation): a rare conflict here must not block or unwind
+  # a release that already published. See docs/releasing.md "Advancing the Edge
+  # Line". The reconcile is a merge favoring the release, never a reset or force —
+  # the pre-merge `next` tip stays a first-parent ancestor of the pushed commit,
+  # so `git push edge-advance:next` is a plain fast-forward.
+  edge-advance:
+    needs: goreleaser
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          # Full history + tags so `git rev-list -1 "$GITHUB_REF_NAME"` resolves
+          # the tagged commit the reconcile merges into `next`.
+          fetch-depth: 0
+          fetch-tags: true
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: "1.22"
+
+      # Prerelease (`-pre`) tag: reconcile `next` to the tagged commit's content,
+      # favoring the release over whatever `next` drifted to. The manifests inherit
+      # the tag's version; the calendar bump below makes installers re-pull.
+      - name: Reconcile the edge line to the prerelease commit
+        if: "contains(github.ref, '-')"
+        run: |
+          set -euo pipefail
+          RELEASE_COMMIT="$(git rev-list -1 "$GITHUB_REF_NAME")"
+          git fetch origin next
+          git switch -c edge-advance origin/next
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git merge -X theirs --no-edit "$RELEASE_COMMIT" \
+            -m "next: reconcile edge line to $GITHUB_REF_NAME"
+
+      # Stable (`vX.Y.Z`) tag: reconcile the same way, then stamp the manifests
+      # PAST the release to the post-release dev pre-version (X.(Y+1).0-pre1), so
+      # the edge line never masquerades as the stable version it just shipped.
+      - name: Reconcile the edge line past the stable release
+        if: "!contains(github.ref, '-')"
+        run: |
+          set -euo pipefail
+          RELEASE_COMMIT="$(git rev-list -1 "$GITHUB_REF_NAME")"
+          RELEASE_VERSION="${GITHUB_REF_NAME#v}"
+          DEV_VERSION="$(go run ./cmd/spacedock-release dev-preversion "$RELEASE_VERSION")"
+          git fetch origin next
+          git switch -c edge-advance origin/next
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git merge -X theirs --no-edit "$RELEASE_COMMIT" \
+            -m "next: reconcile edge line to $GITHUB_REF_NAME"
+          go run ./cmd/spacedock-release stamp-version "$DEV_VERSION" \
+            .claude-plugin/plugin.json .codex-plugin/plugin.json
+          git commit -m "next: bump dev pre-version to $DEV_VERSION" \
+            -- .claude-plugin/plugin.json .codex-plugin/plugin.json
+
+      # Both paths end here: bump the marketplace calendar key (the moving-branch
+      # re-pull key `claude plugin update` / `codex` read) and fast-forward `next`.
+      # Exactly one reconcile step above ran, so `edge-advance` already carries the
+      # merge (plus, on a stable tag, the dev-preversion stamp).
+      - name: Bump the marketplace calendar key and push the edge line
+        run: |
+          set -euo pipefail
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          go run ./cmd/spacedock-release bump-calendar .claude-plugin/marketplace.json
+          git commit -m "next: bump marketplace calendar version" \
+            -- .claude-plugin/marketplace.json
+          git push origin edge-advance:next

cmd/spacedock-release/dev_preversion_test.go

@@ -0,0 +1,70 @@
+package main
+
+import (
+	"io"
+	"os"
+	"strings"
+	"testing"
+)
+
+// TestDevPreversionCommandPrintsComputedVersion — the subcommand prints exactly
+// the post-release dev pre-version (X.(Y+1).0-pre1) to stdout, so release.yml's
+// `DEV_VERSION="$(... dev-preversion "$RELEASE_VERSION")"` capture stamps `next`
+// PAST the just-released stable version rather than re-stamping it.
+func TestDevPreversionCommandPrintsComputedVersion(t *testing.T) {
+	out, code := captureStdout(t, func() int { return devPreversion([]string{"0.24.0"}) })
+	if code != 0 {
+		t.Fatalf("dev-preversion exit = %d, want 0 on a bare stable semver", code)
+	}
+	if got := strings.TrimSpace(out); got != "0.25.0-pre1" {
+		t.Fatalf("dev-preversion stdout = %q, want 0.25.0-pre1", got)
+	}
+}
+
+// TestDevPreversionCommandRejectsMissingArg — with no version argument the
+// subcommand exits with a usage error and prints nothing consumable.
+func TestDevPreversionCommandRejectsMissingArg(t *testing.T) {
+	if code := devPreversion(nil); code == 0 {
+		t.Fatalf("dev-preversion exit = 0 with no argument; want non-zero")
+	}
+}
+
+// TestDevPreversionCommandRejectsExtraArg — the subcommand takes exactly one
+// version; a second argument is a usage error, so a release.yml miswiring fails
+// loud rather than silently ignoring the extra token.
+func TestDevPreversionCommandRejectsExtraArg(t *testing.T) {
+	if code := devPreversion([]string{"0.24.0", "0.25.0"}); code == 0 {
+		t.Fatalf("dev-preversion exit = 0 with two arguments; want non-zero")
+	}
+}
+
+// TestDevPreversionCommandRejectsHyphenatedInput — a pre-release (hyphenated)
+// input is malformed for this subcommand (it runs only on the stable branch),
+// so it exits non-zero instead of emitting a doubly-suffixed version.
+func TestDevPreversionCommandRejectsHyphenatedInput(t *testing.T) {
+	if code := devPreversion([]string{"0.24.0-pre1"}); code == 0 {
+		t.Fatalf("dev-preversion exit = 0 on a hyphenated input; want non-zero")
+	}
+}
+
+// captureStdout runs fn with os.Stdout redirected to a pipe and returns what fn
+// printed plus fn's return code, so a subcommand whose contract IS its stdout
+// (release.yml captures it via $()) is verified on the real bytes it emits.
+func captureStdout(t *testing.T, fn func() int) (string, int) {
+	t.Helper()
+	r, w, err := os.Pipe()
+	if err != nil {
+		t.Fatalf("os.Pipe: %v", err)
+	}
+	orig := os.Stdout
+	os.Stdout = w
+	defer func() { os.Stdout = orig }()
+
+	code := fn()
+	w.Close()
+	data, err := io.ReadAll(r)
+	if err != nil {
+		t.Fatalf("read captured stdout: %v", err)
+	}
+	return string(data), code
+}

cmd/spacedock-release/main.go

@@ -21,11 +21,14 @@ import (
 //
 //	spacedock-release stamp-version <release-version> <plugin.json> [<plugin.json> ...]
 //	spacedock-release bump-calendar <marketplace.json>
+//	spacedock-release dev-preversion <stable-version>
 //	spacedock-release e2e-gate <release-commit-sha>
 //
 // stamp-version rewrites each manifest's top-level `version` to the release
 // version (AC-4). bump-calendar advances the marketplace plugin entry's calendar
-// key to today's `0.0.YYYYMMDDNN` (AC-2d). Both rewrite in place. e2e-gate is the
+// key to today's `0.0.YYYYMMDDNN` (AC-2d). Both rewrite in place. dev-preversion
+// prints the post-release dev pre-version (X.(Y+1).0-pre1) the stable-tag edge
+// advance stamps onto `next`. e2e-gate is the
 // release-time precondition: it passes (exit 0) only when a conclusion:success
 // Runtime Live E2E run exists for the commit, or when SPACEDOCK_E2E_GATE_WAIVER
 // is set, and blocks the cut (exit 1) otherwise. manifest-tag-gate blocks the cut
@@ -44,6 +47,8 @@ func main() {
 		os.Exit(stampVersion(os.Args[2:]))
 	case "bump-calendar":
 		os.Exit(bumpCalendar(os.Args[2:]))
+	case "dev-preversion":
+		os.Exit(devPreversion(os.Args[2:]))
 	case "journey-costs":
 		os.Exit(journeyCosts(os.Args[2:]))
 	case "e2e-gate":
@@ -173,6 +178,26 @@ func bumpCalendar(args []string) int {
 	return 0
 }
 
+// devPreversion prints the post-release dev pre-version for the `next` edge line
+// (X.(Y+1).0-pre1) computed from a just-released stable version. release.yml's
+// stable-tag path captures this stdout to stamp `next` PAST the released stable
+// version. It takes exactly one <stable-version> arg and errors on a hyphenated
+// or malformed input, since it runs only on the `!contains(github.ref, '-')`
+// branch that already guarantees a bare X.Y.Z.
+func devPreversion(args []string) int {
+	if len(args) != 1 {
+		fmt.Fprintln(os.Stderr, "spacedock-release dev-preversion: need exactly one <stable-version> (e.g. 0.24.0)")
+		return 2
+	}
+	version, err := release.DevPreVersion(args[0])
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "dev-preversion: %v\n", err)
+		return 1
+	}
+	fmt.Println(version)
+	return 0
+}
+
 // notes summarizes the commits since the last tag into clean release notes and,
 // on the captain's confirmation, cuts an annotated tag whose body IS those
 // notes. The tag is created locally only — pushing it (which fires the release
@@ -323,6 +348,7 @@ func usage() {
 Usage:
   spacedock-release stamp-version <release-version> <plugin.json> [<plugin.json> ...]
   spacedock-release bump-calendar <marketplace.json>
+  spacedock-release dev-preversion <stable-version>
   spacedock-release journey-costs <release-version> --metrics-dir <dir> --out <path>
   spacedock-release e2e-gate <release-commit-sha>
   spacedock-release manifest-tag-gate <tag> <plugin.json> [<plugin.json> ...]

docs/releasing.md

@@ -16,6 +16,9 @@ marketplace source.
   `spacedock@next` edge) via `HOMEBREW_TAP_TOKEN`;
 - stamps the plugin manifests' `version` on `main`, then advances the stable
   channel ref (see below).
+- advances the `next` edge line to match the release — reconciled on a
+  prerelease tag, reconciled plus bumped to the post-release dev pre-version on
+  a stable tag (see "Advancing the Edge Line" below).
 
 The marketplace manifest no longer lives in the plugin branch. It is the
 standalone `spacedock-dev/marketplace` repo, where each channel is a branch with
@@ -148,13 +151,43 @@ green Runtime Live E2E run for its exact SHA. Stamp and push the release commit
    git branch -d release/X.Y.Z
    ```
 
+## Advancing the Edge Line (`next`)
+
+Every tag push also advances `next` — the branch the `spacedock-edge`
+marketplace resolves — in a job that `needs: goreleaser` (a sibling job, so a
+rare conflict here cannot unwind or block the release that already published):
+
+- **Prerelease (`-pre`) tag:** `next` is reconciled to the tagged commit's
+  content — `git merge -X theirs "$RELEASE_COMMIT"`, favoring the release over
+  whatever `next` had drifted to — then the marketplace calendar key is bumped
+  (`spacedock-release bump-calendar`) so `claude plugin update` / `codex`
+  re-pull. This is the automated form of the manual reconcile the 0.24.0-pre1
+  cut required (`next` had drifted 40 commits behind `main`, hard-blocking
+  `spacedock codex` on a binary/plugin version-compat check).
+- **Stable (`vX.Y.Z`) tag:** `next` is reconciled the same way, then stamped
+  PAST the release to the post-release dev pre-version
+  (`spacedock-release dev-preversion X.Y.Z` → `X.(Y+1).0-pre1`), so the edge
+  line never masquerades as the stable version it just shipped, then the
+  calendar key is bumped.
+
+The reconcile is a merge, never a reset or force-push: the previous `next` tip
+is always a first-parent ancestor of the new commit, so `git push origin
+<sha>:next` is a plain fast-forward. A real conflict (two sides changing the
+same file in incompatible, non-superseded ways) fails the step loudly instead
+of guessing — the same manual reconciliation this replaces remains the escape
+hatch.
+
 ## Dev-Only `next` Publishing
 
 Keep `next` for development. Source builds may use
 `go install github.com/spacedock-dev/spacedock/cmd/spacedock@next`, local
 checkouts may use `--plugin-dir`, and the deliberate `next-publish` workflow may
 bump the marketplace calendar key for dev testers.
 
+Every release tag now advances `next` and bumps its calendar key automatically
+(see "Advancing the Edge Line" above); `next-publish` stays for an out-of-band
+re-pull between releases (e.g. a `next`-only fix that isn't worth a full cut).
+
 Do not send stable users to `next`. If a command or manifest uses `@next`, it is
 a dev-only path.