Release Upgrade Safety Doctor 20260720

Overview

This draft converts local operator notes into a deterministic PASS / REVIEW / BLOCKED report for the 2026-07-20 Merlin priority. The stdlib-only analyzer checks upgrade version, regression test plan, rollback procedure, gateway health, plugin compatibility, backup, staging verification, and approval evidence.

It is advisory and read-only. It does not upgrade packages, restart services, publish, package, deploy, create products, change billing, edit OpenClaw configuration, change cron state, or assert downstream release, security, live, or package status.

Merlin Source

• Brief: memory/merlin-build-brief.md dated 2026-07-20.
• Draft target: skills/release-upgrade-safety-doctor-20260720/ for independent Viper testing.

When to Use

• Before acting on non-sensitive operator notes about pre-upgrade regression and rollback planning.
• When a repeatable evidence-gap report is needed instead of open-ended advice.

Safety Contract

• Reads only direct --text or one explicitly supplied local notes file.
• Refuses hidden or sensitive-looking paths, symlinked inputs, non-files, and inputs above 200,000 characters.
• Uses Python standard-library modules only.
• Makes no network, subprocess, shell, package-manager, configuration, cron, deployment, publishing, billing, product, or credential-output calls.
• Every successful report includes mutated_files: [].

Main Script

• scripts/release_upgrade_safety_doctor.py
• Modes: --notes PATH, --text TEXT, --self-test, and --json.

Operator Workflow

1. Put non-sensitive observations in a text file; no secret values or private data.

2. Run python3 scripts/release_upgrade_safety_doctor.py --notes path/to/notes.txt --json.

3. Review status, score, signals_found, risks_found, missing_signals, and recommendations.

4. Hand the unchanged draft and gate evidence to Viper; state remains PENDING_VIPER.

Result Semantics

• PASS: at least eight expected evidence signals and no risk signal; advisory only.
• REVIEW: partial evidence or one bounded concern needs operator review.
• BLOCKED: multiple risk signals or insufficient evidence; no live action should follow.
• ERROR: missing, sensitive, hidden, symlinked, oversized, or unreadable input.

Viper Scenario Seeds

• Complete upgrade safety notes should produce PASS.
• Notes containing all risk terms should produce BLOCKED.
• No notes should produce error=missing_notes.
• A symlink fixture should produce error=symlink_input_refused.
• A 200,001-character fixture should produce error=input_too_large.

Draft Status

PENDING_VIPER — Iceman local gates are not downstream QA, security clearance, release approval, packaging, deployment, or production verification.