[Maxerns]

Why

Maintainers need a repeatable way to verify a published CLI release and prepare its formula change before GitHub automation is added. The planner produces a report and patch without writing to the checkout, GitHub branches, or pull requests.

What it does

• Discovers the highest published stable semantic version or accepts one explicit version, then verifies the signed checksum manifest and both Mac archives through the shared Cosign verifier.
• Produces a deterministic formula patch and structured report with a version-specific proposal branch.
• Reuses unchanged open proposals, suppresses closed proposals until an explicit exact-version retry, and fails closed when proposal contents or verified release inputs have changed.
• Applies reviewed held-version records and exact-pair rollback records with incident, compatibility evidence, reviewer, and date. The current-base version gate recognises only those declared rollback records.
• Runs formula version admission only when a pull request changes the formula. CI exercises a real dry run against the packaged release and controlled previous-version package lifecycle fixtures.

Validation

• All six required checks pass on head 5d730dea7625aff3d9e99af411f2fd583b3ac3db in run 38965655257.
• The macOS 26 Homebrew job created disposable v0.8.0 and v0.9.0 archives and a local tap, then installed, upgraded, and explicitly restored the older package fixture. A harmless data fixture outside the package prefix survived each step.
• CI verified the published v0.9.0 manifest signature and archive digests, ran the planner dry report, and passed Homebrew style/audit plus native install and preservation jobs on macOS 15/26 for Apple Silicon/Intel.
• 25 unit tests pass. Python compilation, actionlint, and git whitespace checks pass locally.
• The newer-version test was mutation-checked: temporarily reversing the version ordering made it fail, then the correct condition was restored.

Limits

The fixture checks Homebrew package lifecycle and external-file preservation; it does not establish that an older CLI can safely read real Sotto data. A rollback still requires specific compatibility evidence and maintainer review. The planner performs no GitHub writes.