[kixelated]

Plans the pin-bumps epic: every merge to main that changes what ships becomes a release, and the watcher's bump pass moves every repository that pins quest to it, with no hand bumps.

Why: moq-dev/moq sat on 93c9c2ef past #646, so its spawns kept writing XS quests on Haiku 5.5 xhigh and hit rate limits until a hand bump (moq-dev/moq#8623). The bump pass from #550 never ran: the host watcher has no --bump flags, since that wiring is in the stale draft kixelated/nixos#36. Of the other consumers, moq and web-transport hard-code a revision that nothing moves, moq.pro's Dependabot excludes quest, and the rest move only on Dependabot's weekly run with its 7-day cooldown.

• [M] Release every merge that changes what ships: Release reconciles main with the latest published release and tags only after the binaries pass their checks. It replaces quest/m1/release.md and quest/m1/release-cut.md, which this deletes. No release has shipped since v0.1.0.
• [S] The bump pass finds its own targets: every repository moq-bot is installed on that locks quest.
• [S] The bump pass follows the latest release.

The host side, turning --bump on, is planned in kixelated/nixos's tree.

Decisions

• What do consumers pin? ✅ A release, cut on every merge that changes what ships (rejected: quest's main).
• Where does the version come from? ✅ The Release workflow cuts it from conventional commits and tags (rejected: each PR bumps package.json, which conflicts across PRs in the merge queue). This lifts CONTRIBUTING.md's maintainer-only tag rule and the biweekly cut decided on release: bump to 0.2.0 and caveat v0.1.0 #587.
• How does Release stay correct when a run fails? ✅ It reconciles main with the latest published release on every push and daily, and tags last (rejected: recovery steps for each failure mode, which review kept finding new cases of; semantic-release). Decided at the review's round-3 design checkpoint.
• What bumps consumers? ✅ The watcher's --bump, following releases (rejected: Renovate with a stale-stub check, because hosted Renovate can't run quest init or check --fix and 48 commits touched skills in 12 days; Renovate with a fixup workflow per consumer; Kixel Code, which runs no host jobs until its m1).
• Do bumps wait for a merge click? ✅ No, they land once checks pass (rejected: a click, which Kixel Code requires of dependency bumps; quest bumps are the exception).
• Targets? ✅ Discovered from moq-bot's installations (rejected: a --bump list in the host's config, which went stale within five days).
• Milestone? ✅ m0 (rejected: release automation in m1).

Validation

Quest-only change: quest check passes.

Models

Size: S
Implementer: Claude Code, claude-opus-5-5

🤖 Generated with Claude Code

(Written by Opus 5.5)

Review

Rewritten by quest review after each round.

• Head: 78a4107

• Base: origin/main at a888444

• Reviewer: Codex, gpt-6.1-sol, medium effort

• Session: 01a1d385-5bed-7f12-bb53-249ead96bb61, round 3

• Score: 10/10, The revised plan covers all binary and flake build inputs in a shared release predicate, and the incremental changes introduce no further findings.

• Rounds: 6; findings 1 (medium 1): fixed 1, refuted 0, open 0

• Findings: none

• The last round's findings, at a4d4a03:

  • Fixed: medium, quest/m0/pin-bumps/release.md:30: Include assets and Nix packaging inputs in the shared predicate; release.md now includes everything the binaries or flake package build from, explicitly names assets/ and nix/, and requires Release's pull request filter to use that same predicate.

• Reviewer: opencode, opencode-go/deepseek-v4.1-flash, high effort

• Session: ses_e2c7a9f65ffeEy1XAg0I7FCYXt, round 3

• Score: 10/10, The head fixes all three remaining findings: the release predicate now names assets/ and nix/, the flake passes the commit and accounts for the older quest-pinned package, and the epic attributes quest-pinned to Dependabot rather than quest check.

• Rounds: 6; findings 25 (high 2, medium 13, low 10): fixed 24, refuted 1, open 0

• Findings: none

• The last round's findings, at a4d4a03:

  • Fixed: medium, quest/m0/pin-bumps/release.md:31: The new what-ships predicate still omits assets and nix inputs; quest/m0/pin-bumps/release.md:31-35 now defines what ships as everything the binaries or flake package build from, explicitly includes assets/ (bundled at src/cli/skills.ts) and nix/, and says Release's pull-request filter moves to the same predicate.
  • Fixed: medium, quest/m0/pin-bumps/release.md:51: The version plan never updates the flake.nix call site that instantiates nix/package.nix; quest/m0/pin-bumps/release.md:55-58 now says flake.nix passes the commit to nix/package.nix and notes that quest-pinned builds from the older pinned package.nix, whose call the new argument must not break.
  • Fixed: low, quest/m0/pin-bumps/README.md:39: Quest check does not keep the quest-pinned input current; quest/m0/pin-bumps/README.md:39-40 now says quest-pinned stays on Dependabot's weekly nix update (flake.nix), matching .github/dependabot.yml and the flake.nix:11-15 comment.

• Reviewer: Codex, gpt-6.1-sol, low effort, shadow

• Session: 01a1d385-5bed-78a3-a42d-09d37ddc858a

• Rounds: 2; findings 0: fixed 0, refuted 0, open 0

[kixelated]

Design change: at the round-3 checkpoint, the release quest stops prescribing recovery steps for each way a run can fail. Release now reconciles main with the latest published release on every push and a daily schedule, cutting when the range touches what ships (by path, not commit type), and it tags and publishes only after the binaries pass their local checks. A cancelled or failed run needs no recovery, since the next run sees the same unreleased range, and the dead v0.2.0 and v0.2.1 tags are skipped because each new version exceeds every tag. Checks that need a published release fail loudly and ship their fix next, blocking no flake consumer. Rejected: per-failure recovery steps; semantic-release. discover.md also now requires exactly one root input locking quest, as the bump needs.

(Written by Opus 5.5)

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 37 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 486d4fdf-8251-48ac-bd88-a5721f3e9ab6

Commits

Reviewing files that changed from the base of the PR and between 8408fcf and 78a4107.

Files selected for processing: 7

• quest/m0/mistake-audit.md
• quest/m0/pin-bumps/README.md
• quest/m0/pin-bumps/discover.md
• quest/m0/pin-bumps/follow-release.md
• quest/m0/pin-bumps/release.md
• quest/m1/release-cut.md
• quest/m1/release.md

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[pullfrog]

✅ No new issues found.

Reviewed changes: the full diff of this quest-only planning PR, plus a search for dangling references to the deleted quests.

• pin-bumps epic: adds the README with its goal, decisions and ## Waiting item for the host wiring.
• release.md: plans a release per shipping merge, reconciling main with the latest release, tagging last, and keeping one predicate for what ships.
• discover.md and follow-release.md: plan target discovery from the App's installations, and bumps that follow the latest release.
• Deleted m1/release.md and m1/release-cut.md: nothing links to them any more. The one remaining mention is a pinned-commit permalink.
• mistake-audit.md: drops the link to the deleted release-cut.md.

  ^{｜ View workflow run ｜ Using claude-sonnet-5-5 ｜ 𝕏}