[okcodes]

Four backlog items, each reproduced before being fixed, plus the deterministic
coverage that makes checking a format by hand unnecessary.

The e2e gap came first

Four of the ten supported layouts had no end-to-end coverage at all —
pyproject.toml, uv.lock, Directory.Build.props and .targets were proven
only by unit tests, which is why the newest formats were the ones being checked
by hand.

One table now drives two tests: a stable bump and a pre-release, each asserting
every declared file moved and that check agrees in both directions. Adding a
format is a row. Verified by breaking one writer and watching both go red.

1 · npm workspaces

Reproduced: a project declaring a member's package.json with the shared
package-lock.json was told its files disagreed — when they agreed exactly.
vump was reading the root entry.

This looked like it needed a path mapping, which is the inference the entry
refused to guess at. It doesn't: npm records the name inside each
packages entry, so a member is selected by name like Cargo and uv.
package.json joins the manifests read for that name.

The root's two records belong to the project only when the lock's own name is
one the project declares — that is what stops a member rewriting the root above
it.

2 · Inputs on the check action

Two gaps, treated differently:

• project input — added. A repository declaring several projects and
  verifying a bare version could not use the action at all. A tag needs
  nothing: it selects its own project through tag_pattern, which is why this
  went unnoticed.
• allow-nested input — deliberately refused, and the description now says
  so. A nested vump.toml answers about the wrong project, and check is the
  command whose verdict gets believed. Adding it would weigh the convenience of
  a layout [[project]] exists to prevent.

Found while in the run step: inputs were expanded straight into bash, where
${{ }} is substituted before bash parses the line, so a version carrying
shell syntax would have executed. They now arrive through the environment.

3 · vump push

git push --follow-tags pushes every annotated tag reachable from HEAD.
Reproduced against a bare remote: it published other-project-v9.9.9, which
had nothing to do with the release.

vump push names one ref, derived from the version the files record and the
project's pattern — no stored state, and it cannot name a tag other than the
one that exists. It refuses when that tag is absent rather than pushing the
branch alone. The branch policy is checked here too, since a bump stopping at
tag was never checked against it.

The hint printed after tagging now says vump push.

4 · A Rust workspace sandbox — the entry was wrong

The entry claimed a crate in this tree needs excluding from the workspace, and
that a mistake breaks cargo build for vump itself. Neither holds: this
repository's Cargo.toml declares no [workspace], so a nested one is simply
separate. cargo metadata still reports one member with the sandbox in place.

What it was right about is that the shape worth showing had no worked example.
Two crates sharing one lock now show it, with --locked asserting cargo
accepts what vump wrote.

The manual pass, automated

./scripts/sandbox-smoke.sh bumps every sandbox and asks node, dotnet, uv and
cargo what version they build — the one thing the suite cannot answer.

Deliberately not in cargo test: that would put four toolchains and a
network on three runners to test somebody else's tool, and the formats are
already covered deterministically above. Missing toolchains skip; everything
reverts on the way out.

Backlog

	Before	After
Ideas	7	3
Lines	257	199

The three left are open product questions with no reproduction: declarative
formats, commit-message bumps, changelog generation.

🤖 Generated with Claude Code