@a11ign/screenreader-fleet 0.4.1 → 0.4.2

package/dist/doctor.d.mts

@@ -31,6 +31,45 @@ export function workerControlFix(observed: string): {
     fix: string | null;
     note: string | null;
 };
+/**
+ * IS THE FLEET KEY SITTING NEXT TO 100 MB OF PACKAGES NOBODY AUDITED? — ADR 0012, checked rather than
+ * asserted.
+ *
+ * Found on 2026-08-29 to be violated on BOTH machines the ADR is about: the control plane carried 56 MB
+ * and 121 packages beside the key, and this laptop carries 103 MB beside the same key plus the lab key.
+ * The document was accurate about the intent and described a system that did not exist — which is worse
+ * than no document, because it is read as a guarantee.
+ *
+ * Reported by `doctor` because that is the command whose whole promise is that every check names its own
+ * fix, and because a check nobody runs is one this repo has learned not to write.
+ */
+/**
+ * IS THIS CHECKOUT MARKED AS THE PRIMARY, and does that match what it looks like?
+ *
+ * The primary-checkout guards (`pre-commit`, `post-checkout`) are OPT-IN as of #198: they fire only where
+ * `git config --local a11y.primaryCheckout` is `true`. That is the correct default — inferring it from
+ * `.git` being a directory made the hook fire on the lab, which is an ordinary clone, and broke every
+ * `lab:job -e ref=<branch>`.
+ *
+ * But an opt-in guard nobody can find the switch for is an OFF guard, and "unmarked" must not read the
+ * same as "safe". So this reports the state on every run rather than only when something is wrong — the
+ * `isolation` check above takes the same shape for the same reason: a debt that is reported every run is
+ * a known one, and a debt reported never is a forgotten one.
+ *
+ * ADVISORY, never a hard failure. `doctor` exits 0 when a RUN can proceed, and an unmarked checkout can
+ * run perfectly well — it is the fleet-driving machine's protection that is missing, not its capability.
+ * A doctor that refused READY over this would be ignored, which is how a guard gets switched off.
+ *
+ * It does not GUESS which machine deserves the mark. `doctor` runs on laptops, worktrees, the lab and CI,
+ * and telling four of those five to mark themselves would be the #198 defect wearing an advisory's
+ * clothes. It states what is true and names the command; the operator decides.
+ */
+export function checkPrimaryCheckoutMark({ baseDir }?: {
+    baseDir?: string | undefined;
+}): void;
+export function checkControlPlaneIsolation({ baseDir }?: {
+    baseDir?: string | undefined;
+}): void;
 /**
  * Pure: does `resolvedRealPath` (already realpath'd) live under `thisCheckoutRoot` (also realpath'd)?
  * Both must be realpath'd BEFORE calling this, never inside it -- comparing a symlinked path against a
@@ -76,6 +115,40 @@ export function checkoutRootFor(resolvedRealPath: string): string | null;
 export function tscProjectUpToDate(tsconfigPath: string, { run }?: {
     run?: (cmd: string, args: string[]) => string;
 }): boolean | null;
+/**
+ * WHOSE dist a cross-package import actually resolves to, and is IT stale (#256) -- both computed from
+ * the exact SPECIFIER a real import site in this repo uses, never the bare package name. CLAUDE.md's own
+ * recorded lesson: "resolving @a11ign/judge does not prove @a11ign/judge/rules came from your
+ * tree" -- a package can export subpaths from elsewhere, so resolving the root proves nothing about a
+ * subpath. `@a11ign/judge/rules` is a real specifier this repo imports
+ * (`packages/lab/scripts/score-rules.ts` and others), not a synthetic probe.
+ *
+ * ADVISORY, never a hard failure -- same reasoning as `isolation` above: a worktree resolving to the
+ * primary's dist can still run every command correctly today, and a doctor that refused READY over an
+ * environmental fact would be ignored, which is how a guard gets switched off. It is reported every run
+ * so a stale answer is a known condition, not a silent one.
+ */
+export function checkCrossPackageDist({ baseDir }?: {
+    baseDir?: string | undefined;
+}): number | void;
+/**
+ * Where the trained scorer's weights are, asked of `@a11ign/scorer` itself (a11ign/a11ign#3784).
+ *
+ * This was `../../scorer/models/...` from this module: the monorepo layout, which from an installed package points into
+ * `node_modules/@a11ign/` and answers "missing" under pnpm, where the scorer sits beside `@a11ign/judge` in the store and
+ * not beside this package. The scorer is a PEER of the judge, so it is resolved FROM the judge's real path, the one place
+ * both layouts agree it is reachable, and its own `scorerPaths()` says where its weights are ("the weights are the API").
+ * `from` is INJECTED so a test can stand in for either layout.
+ *
+ * @param {{ from?: string }} [options] a path or file URL to resolve `@a11ign/judge` from
+ * @returns {Promise<string>}
+ */
+export function scorerWeightsFor({ from }?: {
+    from?: string;
+}): Promise<string>;
+export function checkJudge({ from }?: {
+    from?: string | undefined;
+}): Promise<void>;
 /**
  * The agreement sentence, with WHICH FIELDS AGREED DERIVED rather than retyped — #1997.
  *
@@ -225,6 +298,15 @@ export function doctorRun(deps?: {
     err?: (line: string) => void;
     runsDir?: () => string;
 }): Promise<number>;
+export function recordedChecks(): {
+    name: string;
+    id: string;
+    ok: boolean;
+    detail: string;
+    fix: string | null;
+    note?: string | null;
+    advisory?: boolean;
+}[];
 export function addCheck(name: string, ok: boolean, detail: string, remedy?: string | null | {
     fix: string | null;
     note?: string | null;

package/dist/doctor.mjs

@@ -84,9 +84,18 @@ const REFUSED = 2;
 const WORKERS_ENV = configuredWorkers();
 const PAGES_PORT = Number(process.env.DATASET_PAGES_PORT || 5050);
 const CTL = fleetScriptPaths().workerCtl;
-const SCORER_MODEL_DIR = fileURLToPath(new URL("../../scorer/models/screenreader-scorer/", import.meta.url));
 const MODULE_DIR = fileURLToPath(new URL(".", import.meta.url));
 const isMonorepoRoot = (root)=>external_node_fs_existsSync(resolve(root, "packages")) && external_node_fs_existsSync(resolve(root, "package.json"));
+function checkoutLayout(baseDir = MODULE_DIR) {
+    const root = resolve(baseDir, "..", "..", "..");
+    return {
+        root,
+        checkout: isMonorepoRoot(root)
+    };
+}
+const notACheckout = (names, root)=>{
+    for (const name of names)advise(name, `n/a: installed package -- ${root} is not a checkout, so there is nothing here for this check to read`);
+};
 function runsDirFor({ argv = process.argv.slice(2), baseDir = MODULE_DIR } = {}) {
     const supplied = flagValue(argv, "runs-dir");
     if (void 0 !== supplied) {
@@ -100,6 +109,7 @@ function runsDirFor({ argv = process.argv.slice(2), baseDir = MODULE_DIR } = {})
 const datasetDir = ()=>resolve(runsDirFor(), "screenreader-dataset");
 const PROBE_TIMEOUT_MS = 8000;
 const checks = [];
+const recordedChecks = ()=>checks;
 const GATES = Object.freeze({
     worker: true,
     fleet: true,
@@ -182,8 +192,11 @@ async function httpJson(url) {
     if (void 0 === response.json) throw new Error(`invalid JSON from ${url}`);
     return response.json;
 }
-function checkPrimaryCheckoutMark() {
-    const root = resolve(fileURLToPath(new URL(".", import.meta.url)), "..", "..", "..");
+function checkPrimaryCheckoutMark({ baseDir = MODULE_DIR } = {}) {
+    const { root, checkout } = checkoutLayout(baseDir);
+    if (!checkout) return notACheckout([
+        "primary checkout"
+    ], root);
     let linked;
     try {
         linked = !statSync(resolve(root, ".git")).isDirectory();
@@ -209,17 +222,19 @@ function checkPrimaryCheckoutMark() {
     if (marked) return add("primary checkout", true, "MARKED — pre-commit refuses commits here and post-checkout keeps it detached at origin/main");
     advise("primary checkout", "not marked, so the primary-checkout guards are INERT here. Correct for the lab, a worker or a colleague's clone; wrong for the machine that drives the fleet.", "pnpm run primary:mark -- --set   (only on the fleet-driving checkout — see docs/primary-checkout.md)");
 }
-function checkControlPlaneIsolation() {
+function checkControlPlaneIsolation({ baseDir = MODULE_DIR } = {}) {
+    const { root, checkout } = checkoutLayout(baseDir);
+    if (!checkout) return notACheckout([
+        "isolation"
+    ], root);
     const raw = process.env.A11Y_SSH_KEY || "~/.ssh/a11y-witness_ed25519";
     const keyPath = raw.startsWith("~/") ? resolve(homedir(), raw.slice(2)) : raw;
     const hasFleetKey = external_node_fs_existsSync(keyPath);
-    const root = resolve(fileURLToPath(new URL(".", import.meta.url)), "..", "..", "..");
     const hasNodeModules = external_node_fs_existsSync(resolve(root, "node_modules"));
-    const isWorkspace = external_node_fs_existsSync(resolve(root, "packages")) && external_node_fs_existsSync(resolve(root, "package.json"));
     const verdict = controlPlaneIsolation({
         hasNodeModules,
         hasFleetKey,
-        isWorkspace
+        isWorkspace: checkout
     });
     if (!verdict.violated) return add("isolation", true, verdict.why);
     advise("isolation", verdict.why, "docs/control-plane-plan.md L3 — drive the control plane rather than holding its keys");
@@ -270,9 +285,13 @@ function behindOriginMainNote(otherRoot) {
         return "";
     }
 }
-function checkCrossPackageDist() {
+function checkCrossPackageDist({ baseDir = MODULE_DIR } = {}) {
     const specifier = "@a11ign/judge/rules";
-    const thisCheckoutRoot = resolve(fileURLToPath(new URL(".", import.meta.url)), "..", "..", "..");
+    const { root: thisCheckoutRoot, checkout } = checkoutLayout(baseDir);
+    if (!checkout) return notACheckout([
+        "dist-resolution",
+        "dist-freshness"
+    ], thisCheckoutRoot);
     let resolvedRealPath;
     try {
         resolvedRealPath = external_node_fs_realpathSync(createRequire(import.meta.url).resolve(specifier));
@@ -291,11 +310,24 @@ function checkCrossPackageDist() {
     if (upToDate) return add("dist-freshness", true, `packages/judge under ${distRoot} is up to date (tsc --build --dry)`);
     advise("dist-freshness", `packages/judge under ${distRoot} is NOT up to date (tsc --build --dry) -- a build compiled before the source it now reflects`, "pnpm run build   # in that checkout");
 }
-async function checkJudge() {
+async function scorerWeightsFor({ from = import.meta.url } = {}) {
+    const judgeEntry = external_node_fs_realpathSync(createRequire(from).resolve("@a11ign/judge"));
+    const scorerEntry = external_node_fs_realpathSync(createRequire(judgeEntry).resolve("@a11ign/scorer"));
+    const { scorerPaths } = await import(pathToFileURL(scorerEntry).href);
+    return scorerPaths().weights;
+}
+async function checkJudge({ from = import.meta.url } = {}) {
     const backend = (process.env.JUDGE_BACKEND || "local").toLowerCase();
     if ("local" === backend) {
-        const weights = resolve(SCORER_MODEL_DIR, "model.safetensors");
-        return add("judge", external_node_fs_existsSync(weights), external_node_fs_existsSync(weights) ? "backend=local, trained scorer present" : "backend=local, but the trained scorer is missing", `expected weights at ${weights} — they ship in the repo, so this means an incomplete checkout`);
+        let weights;
+        try {
+            weights = await scorerWeightsFor({
+                from
+            });
+        } catch (error) {
+            return add("judge", false, `backend=local, but @a11ign/scorer could not be resolved from @a11ign/judge: ${error.message}`, "install @a11ign/scorer (a peer dependency of @a11ign/judge) beside @a11ign/judge");
+        }
+        return add("judge", external_node_fs_existsSync(weights), external_node_fs_existsSync(weights) ? "backend=local, trained scorer present" : "backend=local, but the trained scorer is missing", `expected weights at ${weights} (where @a11ign/scorer says they are) — reinstall @a11ign/scorer`);
     }
     if ("anthropic" === backend || "openai" === backend) {
         const key = "anthropic" === backend ? "ANTHROPIC_API_KEY" : "JUDGE_BASE_URL";
@@ -532,4 +564,4 @@ async function main() {
     process.exit(await doctorRun());
 }
 if (import.meta.url === pathToFileURL(process.argv[1] ? external_node_fs_realpathSync(process.argv[1]) : "").href) await main();
-export { addCheck, allChecks, checkoutRootFor, doctorRun, errorDocument, fleetAgreementLine, gatingChecks, isRunnableCommand, nextCommand, readyFrom, resolvesToThisCheckout, runsDirFor, tscProjectUpToDate, workerControlFix };
+export { addCheck, allChecks, checkControlPlaneIsolation, checkCrossPackageDist, checkJudge, checkPrimaryCheckoutMark, checkoutRootFor, doctorRun, errorDocument, fleetAgreementLine, gatingChecks, isRunnableCommand, nextCommand, readyFrom, recordedChecks, resolvesToThisCheckout, runsDirFor, scorerWeightsFor, tscProjectUpToDate, workerControlFix };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@a11ign/screenreader-fleet",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Host-side lifecycle, health and capacity for a fleet of Windows NVDA capture workers: lease one, judge whether it is degrading, and know how many the host can afford.",
   "license": "AGPL-3.0-or-later",
   "type": "module",