[quality] just clean is broken in two places — it never removes previous.manifest.json, changelog.md, output.env or output/

[kubestellar-hive]

Finding

The clean recipe in Justfile (lines 38-48) aborts before it finishes. Two independent defects, both reproducible with an unmodified checkout and just 1.36/1.58:

clean:
    #!/usr/bin/bash
    set -eoux pipefail
    touch _build
    find *_build* -exec rm -rf {} \;
    rm -f previous.manifest.json
    rm -f changelog.md
    rm -f output.env
    rm -f output/

1. find *_build* -exec rm -rf {} \; exits 1

find is handed the paths before it walks them. rm -rf deletes a matched directory, then find tries to descend into it, fails with No such file or directory, and exits 1. Under set -e the recipe dies there.

$ mkdir -p my_build/sub output && touch previous.manifest.json changelog.md output.env
$ just clean
+ touch _build
+ find _build my_build -exec rm -rf '{}' ';'
find: 'my_build': No such file or directory
error: Recipe `clean` failed with exit code 1

Nothing after the find runs — previous.manifest.json, changelog.md, output.env and output/ all survive.

2. rm -f output/ cannot remove a directory

Even when step 1 happens to succeed (no *_build* directory present), the last line fails:

$ mkdir -p output && just clean
...
+ rm -f output/
rm: cannot remove 'output/': Is a directory
error: Recipe `clean` failed with exit code 1

rm -f suppresses missing-file errors, not is-a-directory errors. output/ is created by the _build-bib recipe (--output ./output), so this is the normal post-build state.

Net effect: just clean has never actually cleaned a repo that had anything to clean, and always exits non-zero. just sudo-clean inherits both failures.

Recommendation

1. find . -maxdepth 1 -name '*_build*' -prune -exec rm -rf {} + — -prune stops the descent, -maxdepth 1 keeps it scoped to the repo root, + batches. Drop the touch _build placeholder, which only exists to keep the unquoted glob from failing.
2. rm -rf output/ for the output directory.
3. Add a regression test under tests/unit/ that runs the recipe in a sandbox seeded with output/, a *_build* directory and the three files, and asserts exit 0 plus an empty sandbox. I did not add one in this pass because the current recipe would have to be fixed first, and production changes are out of scope for the quality agent — happy to follow up with the test once the fix lands.

Priority

• Impact: medium — no data loss, but a documented developer workflow is broken and fails loudly on every invocation
• Effort: low — two one-line changes

---

Filed by quality agent (hold-gated mode)

🐝 Hive Agent: quality | Instance: hosted-projectbluefin-knuckle-gjvq | SHA: 25c29e9

— hive: agent=quality backend=copilot model=claude-opus-5

[github-actions]

The workflow labels were repaired to 2-discussing. Keep exactly one workflow state label; blocked and hold may be used as overlays.