fix: unblock the publish pipeline and release 6.0.3 (restores the observer dashboard on npm) - #1695
fix: unblock the publish pipeline and release 6.0.3 (restores the observer dashboard on npm)#1695YoavMayer wants to merge 2 commits into
Conversation
The test setup imports @testing-library/dom but the package never declared it. Locally it resolves anyway, because npm hoists it to the monorepo root where Node's resolution finds it. CI's `npm ci` does not reproduce that hoist, so the module is simply absent there. Consequence, observed on the a5c-ai#1413 merge to main (run 31163538088, commit ca6e2ea): `Validate Observer And Compiler` failed with Error: Cannot find module '@testing-library/dom' across all 93 test files. `Prepare Publish` gates on that job together with seven others, so it was skipped -- and with it every `Publish Foundation` job. The run reported failure, nothing was published, and users still receive 6.0.0, an unrelated codebase: this dashboard has never reached npm. Declaring the dependency makes resolution independent of hoist layout. Verified by hiding the hoisted copy: vitest then fails with CI's exact error, and passes once declared.
The load-bearing line is the ROOT package.json. On main, publish.yml derives PUBLISH_VERSION from the root manifest (publish.yml:692) and then scripts/sync-workspace-versions.mjs rewrites every @a5c-ai/* workspace manifest and every internal dependency range to that exact version before the publish tarball is built. Workspace version fields are decorative at publish time; the observer bump here is kept only so the repo agrees with what actually ships. Publishing is therefore strictly lockstep: this bump releases all 39 @a5c-ai/* packages at 6.0.3 from current main. Verified free: `npm view <pkg>@6.0.3` returns E404 for every one of the 39 (the ~38 6.0.3-staging.<sha> prereleases do not collide with the exact stable version). 35 of the 39 sit at latest=6.0.0 today; four (genty, kradle, hooks-adapter-antigravity, hooks-adapter-hermes) already drifted to latest=6.0.2 -- a successful 6.0.3 also repairs that split. Why 6.0.2 cannot be reused: npm has held 6.0.2 since 2026-07-01 with different content for all 39 packages -- the observer's carries an unrelated "Compendium Edition" dashboard whose stylesheet has 40 --ground-void/--tkc-* tokens found nowhere in this repo. npm forbids republishing a used number, and the unpublish window closed in July. Why this commit must never land without the dependency fix (and vice versa): scripts/publish-package-from-tag.mjs, on finding a version already published, skips `npm publish` and runs `npm dist-tag add <pkg>@<ver> latest`. A green pipeline at root 6.0.2 would publish nothing and silently move latest onto the unvetted July-1 builds across the ecosystem. The two commits of this PR are one atomic change.
![a5c-ai[bot]](https://avatars.githubusercontent.com/in/1616094?s=60&v=4){kind=small}
There was a problem hiding this comment.
Adversarial review result: requesting changes because the required QA run did not execute successfully.
I did not find a code-level blocker in the manifest changes themselves. Adding @testing-library/dom to packages/observer-dashboard/package.json is consistent with @testing-library/react@16.3.2 requiring @testing-library/dom as a peer, and the root version bump matches the publish workflow's lockstep release model.
However, the review process requires rejection if QA failed or is inconclusive, and the dispatched QA run failed before running any QA scenarios:
- QA Dispatch run
31286656024failed inactions/checkout@v6. - The workflow attempted to check out
ref: fix/observer-publish-6.0.3fromrepository: a5c-ai/babysitter. - That branch is the PR head branch in the fork
YoavMayer/babysitter, not a branch ina5c-ai/babysitter. - Checkout failed with:
A branch or tag with the name 'fix/observer-publish-6.0.3' could not be found. - No QA trigger/scenario step ran.
Major concern:
- GitHub Actions / PR checks: PR branch CI is also inconclusive.
gh run listshows CI run31276352192completed withconclusion=action_requiredand no jobs. For a PR that intentionally causes a lockstep publish of all@a5c-ai/*packages, merge should wait for executed CI or an equivalent trusted validation run against the exact PR head or merge result.
What needs to happen before merge:
- Re-run QA from a trusted ref that can actually check out the PR head, for example by using the fork owner/repo or exact commit SHA instead of only the branch name in the base repository.
- Run or approve the normal PR CI so the branch has executed checks, not
action_required. - Immediately before merge, re-check that
6.0.3is still unpublished for all published@a5c-ai/*packages. I spot-checked representative packages and they returned E404 at review time, but I did not rerun the full 39-package sweep.
Risk Assessment
Risk level: risk:high
- Lockstep publish blast radius:
publish.ymlderives the main-branch publish version from rootpackage.json, thenscripts/sync-workspace-versions.mjsstamps that version across@a5c-aiworkspaces. This PR therefore publishes much more than the observer package. Mitigation: require green CI/QA on the exact merge candidate and monitor every Publish Foundation matrix job after merge. - Existing-version/dist-tag risk:
scripts/publish-package-from-tag.mjsskips publish whennpm view <pkg>@<version>succeeds and may ensure the dist-tag for existing content. Mitigation: perform a fresh all-package6.0.3availability sweep immediately before merge. - Fork checkout gap: current QA dispatch cannot validate this fork branch by branch name. Mitigation: dispatch QA with a checkout target that resolves the fork PR head or exact SHA, then treat only that successful run as evidence.
Live-stack QAResult: blocked / unknown. A focused live-stack workflow was dispatched for adversarial QA against Run: https://github.com/a5c-ai/babysitter/actions/runs/31286846792
Matrix requested: [
{"agent":"claude","model":"foundry-gpt55","mode":"interactive","install":"bp","live":true,"process_mode":"predefined"},
{"agent":"codex","model":"google-gemini31","mode":"interactive","install":"bp","live":true,"process_mode":"create"},
{"agent":"claude","model":"foundry-gpt55","mode":"bridged-hooks","install":"bp","live":true,"process_mode":"predefined"},
{"agent":"codex","model":"google-gemini31","mode":"ni","install":"vanilla","live":true}
]Notes:
|
There was a problem hiding this comment.
I do not see a source-code blocker in this diff: the observer workspace now declares @testing-library/dom, the lockfile resolves it to 10.4.1, and the root/observer version bump to 6.0.3 matches the publish workflow's root-version release path.
I cannot approve/merge this run, though, because the adversarial review process requires QA to pass and QA did not produce a passing terminal result.
QA evidence:
- Dispatch
31286620191failed before tests becauseqa-dispatch.ymlchecked outfix/observer-publish-6.0.3ina5c-ai/babysitter, but that branch is in the contributor fork. - Retry
31286672814usedrefs/pull/1695/head; checkout succeeded and the QA action started, but polling hit the GitHub installation API rate limit before the run produced a terminal conclusion. - No QA test failure was observed in the retry, but it is still inconclusive from this review run's perspective.
Required before merge: get a successful QA/publish-gate run for this PR head, or otherwise provide a terminal passing result for the same effective checkout.
Risk Assessment
Risk level: risk:high.
- Risk: the root
package.jsonbump intentionally drives a lockstep release/retag across the package set, not just observer-dashboard. A bad publish affects the wider@a5c-ai/*ecosystem. Mitigation: require full publish-gating CI/QA before merge and verify the publish run completes end-to-end after merge. - Risk: if any package occupies
6.0.3between review and publish,publish-package-from-tag.mjscan take the existing-version retag path. Mitigation: re-check npm availability immediately before publish and verify representative dist-tags after publish. - Risk: a partial publish matrix could leave versions or
latesttags split. Mitigation: monitor the publish matrix, rerun failed legs as needed, and verifynpm view @a5c-ai/babysitter-observer-dashboard dist-tagsshowslatest: 6.0.3after completion.
Live-stack QAResult: blocked / not passed. The adversarial live-stack QA workflow was dispatched, but it remained queued throughout the polling window. Polling then hit the GitHub App installation API rate limit before job results were available. Run: https://github.com/a5c-ai/babysitter/actions/runs/31286793303
Matrix tested: [
{"agent":"codex","model":"foundry-gpt55","mode":"interactive","install":"bp","live":true,"process_mode":"predefined"},
{"agent":"codex","model":"google-gemini31","mode":"interactive","install":"bp","live":true,"process_mode":"create"},
{"agent":"claude","model":"foundry-gpt55","mode":"bridged-hooks","install":"bp","live":true,"process_mode":"predefined"},
{"agent":"claude","model":"anthropic-sonnet46","mode":"bridged-hooks","install":"bp","live":true,"process_mode":"create"}
]Overall verdict: not passed because the live-stack jobs did not complete within the polling window and no successful job conclusions were available. |
There was a problem hiding this comment.
I reviewed the PR adversarially. I did not find a code-level blocker in the package metadata diff itself: the added @testing-library/dom devDependency is consistent with the observer test stack, the root 6.0.3 bump matches the publish workflow's version source, and sync-workspace-versions.mjs does stamp local workspace manifests/internal ranges during Prepare Publish.
I cannot approve or merge this yet because the required QA gate is not passing.
QA status:
- Initial
qa-dispatch.ymlrun31286633245failed during checkout because the workflow tried to check out fork branchfix/observer-publish-6.0.3ina5c-ai/babysitter, where that branch does not exist. - I retried with
branch=refs/pull/1695/headas run31286726814; checkout succeeded and the QA trigger action was still running at the last successful poll. - Further polling hit GitHub's installation API rate limit, so the repaired QA result is inconclusive, not passing.
Please get a green QA/validation signal on the PR head before merge. For this fork PR, dispatching QA with refs/pull/1695/head is the viable checkout ref.
Risk Assessment
Risk level: risk:medium.
Risks and mitigations:
- Full-package publish blast radius: this PR intentionally affects the publish version for the whole
@a5c-ai/*release train, not only observer-dashboard. Mitigation: require green publish validation/QA before merge and verify the publish run end-to-end after merge. - Fork checkout handling:
qa-dispatch.ymlfails when given only the fork branch name. Mitigation: userefs/pull/1695/heador otherwise make the branch available in the base repository for QA. - Publish-time manifest mutation: the static diff only bumps root and observer, relying on
sync-workspace-versions.mjsduringPrepare Publishfor the rest. Mitigation: verify the publish-source artifact and post-merge npm dist-tags, especially@a5c-ai/babysitter-observer-dashboard@latest.
Live-stack QAResult: not passed / inconclusive. The live-stack workflow was dispatched, but it did not complete within the polling window. Run: https://github.com/a5c-ai/babysitter/actions/runs/31286851386 Dispatch note: direct workflow dispatch with
Matrix tested: [{"agent":"codex","install":"bp","live":true,"mode":"interactive","model":"google-gemini31","process_mode":"predefined"},{"agent":"claude","install":"bp","live":true,"mode":"interactive","model":"foundry-gpt55","process_mode":"create"}]Overall verdict: failed to produce passing QA evidence; rerun or inspect the Actions run once GitHub schedules it. |
There was a problem hiding this comment.
Adversarial review completed for PR #1695.
I did not find a code-level blocker in the manifest/lockfile changes themselves:
package.jsonbumps the root version to6.0.3, which is the valuepublish.ymlreads onmainbefore runningscripts/sync-workspace-versions.mjsand preparing the publish artifact.packages/observer-dashboard/package.jsonbumps the observer package to6.0.3and adds@testing-library/domto the observer devDependencies.package-lock.jsonis consistent with those changes and includes@testing-library/dom@10.4.1.npm view @a5c-ai/babysitter-observer-dashboard@6.0.3returned E404/no match, and the publish-workflow workspaces I checked were also free at6.0.3.
Requesting changes because the required QA gate did not produce a conclusive pass.
QA evidence:
- Initial QA dispatch run
31286644398failed before tests becauseactions/checkout@v6tried to check outfix/observer-publish-6.0.3ina5c-ai/babysitter, but the PR head branch is on the contributor fork. - I retried with
branch=refs/pull/1695/headin run31286721582; checkout succeeded and the job entered the Babysitter trigger step. - The repaired run was still in progress through repeated polling, and subsequent polling hit the GitHub API rate limit before a terminal QA conclusion could be read.
- No actual QA test result was obtained, so this is QA inconclusive rather than QA passed.
To unblock this review, rerun QA with a checkout-able PR ref or otherwise provide a completed publish/observer validation result for this exact PR head.
Risk Assessment
Risk level: risk:high
- Risk: merging to
mainpublishes the unified6.0.3version across the monorepo publish matrix, not just the observer dashboard. Mitigation: require the publish validation gates to pass before merge; after merge, verify the publish run is green end-to-end and confirmnpm view @a5c-ai/babysitter-observer-dashboard dist-tagsshowslatest: 6.0.3. - Risk: npm package versions are immutable. If publish output is wrong, recovery is by retagging or publishing a newer version, not replacing
6.0.3. Mitigation: keep the root version bump and exact-version availability checks coupled with the dependency fix; run the documented post-merge smoke check withnpx -y @a5c-ai/babysitter-observer-dashboard@latest. - Risk: a partial publish matrix failure can leave packages split until rerun. Mitigation: rely on
publish-package-from-tag.mjsidempotency for already-published exact versions and rerun the workflow until all packages complete.
Live-stack QAResult: inconclusive. The workflow was dispatched but did not complete within the 20-minute QA wait window. Run: https://github.com/a5c-ai/babysitter/actions/runs/31286811748
Matrix requested: [
{"agent":"codex","model":"google-gemini31","mode":"interactive","install":"bp","live":true,"process_mode":"predefined"},
{"agent":"claude","model":"foundry-gpt55","mode":"interactive","install":"bp","live":true,"process_mode":"create"},
{"agent":"codex","model":"foundry-gpt55","mode":"bridged-hooks","install":"bp","live":true,"process_mode":"predefined"},
{"agent":"claude","model":"foundry-gpt55","mode":"ni","install":"vanilla","live":true,"process_mode":"predefined"}
]Notes:
|
Live-stack QAResult: blocked / not passed. The live-stack workflow was dispatched for adversarial QA, but the GitHub Actions run stayed queued beyond the predefined 20-minute wait window, so no job-level pass/fail evidence is available yet. Run: https://github.com/a5c-ai/babysitter/actions/runs/31286846958
Matrix requested:
Notes:
|
|
Thanks for the adversarial reviews — all four explicitly found no code-level blocker in the diff, and the blockers raised are all QA-infrastructure, so summarizing the evidence for a human decision: 1. The QA gate cannot currently pass for any PR. Five Live Stack dispatches were attempted against this PR overnight: two died on queue/rate-limits, and the three that ran failed on agent-matrix legs ( 2. PR CI is still 3. QA dispatch can't check out fork branches by name — dispatches against 4. Fresh 6.0.3 availability sweep (2026-08-09): every Why this matters beyond the observer: the last successful Publish run on Reminder from the review's own risk note: the two commits are atomic by design — the dep fix alone (root still 6.0.2) would make a green pipeline silently Recent Live Stack baseline (all failures, none from this PR): |
1 participant
Hotfix: restore the observer dashboard on npm (6.0.3)
Merging this PR triggers a lockstep npm publish of ALL @a5c-ai/ packages at 6.0.3* — not a scoped observer release.
publish.ymlderives the publish version from the rootpackage.jsonandscripts/sync-workspace-versions.mjsstamps it onto every workspace manifest before packing. That mechanism is why the root bump here is the load-bearing line.Why this is urgent
The last successful Publish run on main was 2026-07-03. Since #1413 merged (2026-08-07),
Validate Observer And Compilerfails on every main push, andPrepare Publishgates ALLPublish Foundationjobs on it — no package in the monorepo can publish at all until this lands. Every merge to main currently ships nothing, silently.What users see today
npx @a5c-ai/babysitter-observer-dashboard@latest(the/babysitter:observepath) serves 6.0.0, an old "Compendium Edition" codebase that renders unusably. The dashboard merged in #1413 has never reached npm: the Publish run on the merge commit (run 31163538088) failed inValidate Observer And Compiler—Cannot find module '@testing-library/dom'— which silently skipped the entire publish chain.The two commits (atomic — do not cherry-pick apart)
@testing-library/dom— the missing devDependency behind the CI failure. It resolves locally only via root hoisting, which CI'snpm cidoes not reproduce.6.0.2 → 6.0.3— 6.0.2 is burned: all 39 packages have different content under that number on npm since July 1. Critically, commit 1 alone would be dangerous: with root at 6.0.2, a green pipeline finds every version already published, skips publishing, anddist-tag addslatestonto the unvetted July-1 builds across the ecosystem.Verified
npm view <pkg>@6.0.3→ E404 for every one).latest=6.0.0; four (genty, kradle, hooks-adapter-antigravity, hooks-adapter-hermes) already drifted tolatest=6.0.2— a successful 6.0.3 repairs that split.--package-lock-only --workspaces --include-workspace-root), never hand-edited: 7 peer-flag removals + 3 version lines.Recovery if the matrix partially fails
Publish matrices are
fail-fast: falsewith exact-pinned internal deps. Re-running the workflow is safe: already-published packages hit the existing-version branch and no-op; the re-run completes the remainder.Post-merge checklist
npm view @a5c-ai/babysitter-observer-dashboard dist-tagsshowslatest: 6.0.3npx -y @a5c-ai/babysitter-observer-dashboard@latestrenders the kanban dashboard🤖 Generated with Claude Code