feat(gate): let an operator-forced release waive the local journal

Dependency advisories published during the two-hour local proof refused
three stable 0.6.4 dispatches in a row; each fix was a lockfile bump that
then needed its own full proof. The release commands' force argument now
waives the local `just test` journal as well as the clean-tree check. It
still runs the citadel guards, the release contracts and the live advisory
audit before dispatch, publishes under sandbox enforcement, and the hosted
lane qualifies its artifacts before publication.

Author: ebursztein

AGENTS.md

@@ -281,6 +281,9 @@ a release to find out what is broken: the hosted lane takes hours per attempt
 and stops at the first failure, so it finds one bug per attempt. The 0.6.4
 stable release spent four dispatches, one per bug, that a local run catches in
 minutes. Nothing runs in CI that `just test` has not run locally first.
+The one escape is the release command's `force` argument, which the user
+asks for explicitly: it waives the local journal, never the citadel guards,
+release contracts, live advisory audit or hosted qualification.
 
 A proof covers the tested commit and any commit with the identical Git tree.
 Fast-forward `main` to the tested commit (or merge only when the merge commit's

build_system/builder/gate/qualificationevidence.py

@@ -262,7 +262,7 @@ def missing(commit: SourceCommit) -> GateError:
         "branch head a pull request merged), because the hosted lane takes hours to "
         "find what the local glow-up and functional lanes find in minutes. Failed or "
         f'interrupted attempts do not count; an approved `just test {commit} force "<reason>"` '
-        "retry that passes does."
+        "retry that passes does. An operator-approved release may pass `force` instead."
     )
 
 

build_system/builder/gate/releasedispatch.py

@@ -43,14 +43,22 @@ class QualifiedRelease:
     machine lock, or any tag, push, or dispatch.
 
     The unattended nightly scheduler is the exception: it runs on a fresh
-    hosted runner with no journal and no way to make one. Declared as a class
-    default and narrowed per instance, because sandbox enforcement reads the
-    class before a command exists.
+    hosted runner with no journal and no way to make one. `--force` is the
+    operator's: a dependency advisory published during the two-hour proof
+    refused three stable dispatches in a row, each fixed by a lockfile bump
+    that then needed another full proof. A forced release still runs the
+    citadel guards, the release contracts and the live advisory audit here,
+    and the hosted lane qualifies its artifacts before publishing. Declared
+    as a class default and narrowed per instance, because sandbox enforcement
+    reads the class before a command exists.
     """
 
     def __init__(self, *args, **kwargs) -> None:
         super().__init__(*args, **kwargs)
-        if getattr(self._args, "channel", None) in self._config.release.unattended_channels:
+        if (
+            getattr(self._args, "channel", None) in self._config.release.unattended_channels
+            or self._forced()
+        ):
             self.qualification_policy = QualificationPolicy.NONE
 
     def _qualification_steps(self, plan: Plan, commit: SourceCommit, *, after: tuple) -> tuple:
@@ -108,8 +116,8 @@ def _forced(self) -> bool:
     def _forced_source_proof(self, plan: Plan, *, after: tuple) -> tuple:
         """The cheap proof a forced release still owes.
 
-        `--force` bypasses the developer checkout's clean-tree refusal; it does
-        not waive the local `just test` journal or the hosted lane's product
+        `--force` bypasses the developer checkout's clean-tree refusal and the
+        local `just test` journal; it does not waive the hosted lane's product
         qualification. It used to waive
         *everything*, so a forced release could dispatch source that fails a
         six-second guard -- and did, three times in one afternoon, each costing

build_system/tests/gate/test_gate_release_isolation.py

@@ -184,8 +184,8 @@ def test_only_networked_release_edges_cross_the_kernel_boundary(name, args) -> N
     )
 
 
-def test_force_does_not_invent_a_local_qualification_waiver() -> None:
-    """`--force` adds source guards; the local journal remains mandatory."""
+def test_force_waives_the_journal_without_a_waiver_step() -> None:
+    """`--force` drops the journal and the clean-tree check, and adds source guards."""
     from helpers.gate import built_command
 
     commit = "f" * 40
@@ -195,8 +195,9 @@ def test_force_does_not_invent_a_local_qualification_waiver() -> None:
         (("channel", "stable"), ("source_commit", commit), ("force", "true")),
         None,
     )._describe()
-    assert forced.labels[0] == "qualification.accept"
+    assert "qualification.accept" not in forced.labels
     assert "qualification.waived" not in forced.labels
+    assert "citadel" in forced.labels
     assert "source.worktree-clean" not in forced.labels
 
 

build_system/tests/gate/test_gate_release_requires_local_proof.py

@@ -196,9 +196,20 @@ def test_a_failed_local_test_is_not_proof(config, monkeypatch, name) -> None:
 
 
 @pytest.mark.parametrize("name", sorted(RELEASES))
-def test_force_does_not_waive_the_local_test(config, monkeypatch, name) -> None:
-    """`--force` excuses a dirty outer checkout, never a missing proof."""
-    _refused(_release(config, name, force="true"), monkeypatch, COMMIT)
+def test_force_waives_the_local_test(config, monkeypatch, name) -> None:
+    """`--force` is the operator's escape from the journal, not from the gate:
+    the forced source proof and the hosted lane still run."""
+    command = _release(config, name, force="true")
+
+    assert command.qualification_policy is QualificationPolicy.NONE
+    assert _execute(command, monkeypatch) == ["prefix"]
+
+
+@pytest.mark.parametrize("name", sorted(RELEASES))
+def test_a_forced_release_still_publishes_under_enforcement(config, name) -> None:
+    from capsem_builder.gate.enforcement import enforcement_required
+
+    assert enforcement_required(_release(config, name, force="true"))
 
 
 @pytest.mark.parametrize("name", sorted(RELEASES))

build_system/tests/release/test_release_refuses_a_dirty_tree.py

@@ -111,15 +111,15 @@ def test_the_check_gates_publication_and_force_replaces_it_with_source_proof(nam
 
     assert "source.worktree-clean" not in forced
 
-    # Force drops the clean-tree refusal, not every check. It still consumes
-    # the exact local journal, and proves the source it is about to publish
-    # with the Citadel and release contracts before the release lanes perform
-    # their artifact qualification.
-    assert forced[0] == "qualification.accept"
+    # Force drops the clean-tree refusal and the local journal, not every
+    # check: it proves the source it is about to publish with the Citadel and
+    # release contracts before the release lanes perform their artifact
+    # qualification.
+    assert "qualification.accept" not in forced
     assert "qualification.waived" not in forced
     for proof in ("citadel", "contracts.release"):
         assert proof in forced, f"a forced release skips {proof}"
         assert forced.index(proof) < forced.index("source.publish-ref"), (
             f"{proof} must run before anything is published"
         )
-    assert set(guarded) - set(forced) == {"source.worktree-clean"}
+    assert set(guarded) - set(forced) == {"source.worktree-clean", "qualification.accept"}