@a11ign/screenreader-fleet 0.4.1 → 0.5.0

package/dist/check-worker-code.mjs

@@ -5,7 +5,7 @@ import { execFileSync } from "node:child_process";
 import { errorText } from "@a11ign/screenreader-worker/error-text";
 import { fleetScriptPaths } from "./src_fleet-scripts_mjs.mjs";
 import { inventoryWorkerUrls, configuredWorkers, resolveWorkerPool } from "./fleet-env.mjs";
-import { expectedWorkerCode, remedyLines, codeDrift } from "./worker-code-check.mjs";
+import { remedyLines, codeDrift, resolveExpectedWorkerCode } from "./worker-code-check.mjs";
 import { refuseUnknownFlags } from "./cli-flags.mjs";
 import { requestJson } from "./worker-http.mjs";
 refuseUnknownFlags([], {
@@ -42,9 +42,9 @@ async function versionOf(url) {
     return response.json.code ?? "absent";
 }
 async function main() {
-    const expected = expectedWorkerCode();
+    const { code: expected, note } = await resolveExpectedWorkerCode();
     const { urls, source } = workerUrls();
-    console.log(`this checkout: ${expected}`);
+    console.log(`this checkout: ${expected}  (from ${note})`);
     if (!urls.length) {
         console.log("no worker configured, running locally, or listed in inventory.yml — nothing to compare");
         process.exit(0);

package/dist/doctor.d.mts

@@ -31,6 +31,45 @@ export function workerControlFix(observed: string): {
     fix: string | null;
     note: string | null;
 };
+/**
+ * IS THE FLEET KEY SITTING NEXT TO 100 MB OF PACKAGES NOBODY AUDITED? — ADR 0012, checked rather than
+ * asserted.
+ *
+ * Found on 2026-08-29 to be violated on BOTH machines the ADR is about: the control plane carried 56 MB
+ * and 121 packages beside the key, and this laptop carries 103 MB beside the same key plus the lab key.
+ * The document was accurate about the intent and described a system that did not exist — which is worse
+ * than no document, because it is read as a guarantee.
+ *
+ * Reported by `doctor` because that is the command whose whole promise is that every check names its own
+ * fix, and because a check nobody runs is one this repo has learned not to write.
+ */
+/**
+ * IS THIS CHECKOUT MARKED AS THE PRIMARY, and does that match what it looks like?
+ *
+ * The primary-checkout guards (`pre-commit`, `post-checkout`) are OPT-IN as of #198: they fire only where
+ * `git config --local a11y.primaryCheckout` is `true`. That is the correct default — inferring it from
+ * `.git` being a directory made the hook fire on the lab, which is an ordinary clone, and broke every
+ * `lab:job -e ref=<branch>`.
+ *
+ * But an opt-in guard nobody can find the switch for is an OFF guard, and "unmarked" must not read the
+ * same as "safe". So this reports the state on every run rather than only when something is wrong — the
+ * `isolation` check above takes the same shape for the same reason: a debt that is reported every run is
+ * a known one, and a debt reported never is a forgotten one.
+ *
+ * ADVISORY, never a hard failure. `doctor` exits 0 when a RUN can proceed, and an unmarked checkout can
+ * run perfectly well — it is the fleet-driving machine's protection that is missing, not its capability.
+ * A doctor that refused READY over this would be ignored, which is how a guard gets switched off.
+ *
+ * It does not GUESS which machine deserves the mark. `doctor` runs on laptops, worktrees, the lab and CI,
+ * and telling four of those five to mark themselves would be the #198 defect wearing an advisory's
+ * clothes. It states what is true and names the command; the operator decides.
+ */
+export function checkPrimaryCheckoutMark({ baseDir }?: {
+    baseDir?: string | undefined;
+}): void;
+export function checkControlPlaneIsolation({ baseDir }?: {
+    baseDir?: string | undefined;
+}): void;
 /**
  * Pure: does `resolvedRealPath` (already realpath'd) live under `thisCheckoutRoot` (also realpath'd)?
  * Both must be realpath'd BEFORE calling this, never inside it -- comparing a symlinked path against a
@@ -76,6 +115,40 @@ export function checkoutRootFor(resolvedRealPath: string): string | null;
 export function tscProjectUpToDate(tsconfigPath: string, { run }?: {
     run?: (cmd: string, args: string[]) => string;
 }): boolean | null;
+/**
+ * WHOSE dist a cross-package import actually resolves to, and is IT stale (#256) -- both computed from
+ * the exact SPECIFIER a real import site in this repo uses, never the bare package name. CLAUDE.md's own
+ * recorded lesson: "resolving @a11ign/judge does not prove @a11ign/judge/rules came from your
+ * tree" -- a package can export subpaths from elsewhere, so resolving the root proves nothing about a
+ * subpath. `@a11ign/judge/rules` is a real specifier this repo imports
+ * (`packages/lab/scripts/score-rules.ts` and others), not a synthetic probe.
+ *
+ * ADVISORY, never a hard failure -- same reasoning as `isolation` above: a worktree resolving to the
+ * primary's dist can still run every command correctly today, and a doctor that refused READY over an
+ * environmental fact would be ignored, which is how a guard gets switched off. It is reported every run
+ * so a stale answer is a known condition, not a silent one.
+ */
+export function checkCrossPackageDist({ baseDir }?: {
+    baseDir?: string | undefined;
+}): number | void;
+/**
+ * Where the trained scorer's weights are, asked of `@a11ign/scorer` itself (a11ign/a11ign#3784).
+ *
+ * This was `../../scorer/models/...` from this module: the monorepo layout, which from an installed package points into
+ * `node_modules/@a11ign/` and answers "missing" under pnpm, where the scorer sits beside `@a11ign/judge` in the store and
+ * not beside this package. The scorer is a PEER of the judge, so it is resolved FROM the judge's real path, the one place
+ * both layouts agree it is reachable, and its own `scorerPaths()` says where its weights are ("the weights are the API").
+ * `from` is INJECTED so a test can stand in for either layout.
+ *
+ * @param {{ from?: string }} [options] a path or file URL to resolve `@a11ign/judge` from
+ * @returns {Promise<string>}
+ */
+export function scorerWeightsFor({ from }?: {
+    from?: string;
+}): Promise<string>;
+export function checkJudge({ from }?: {
+    from?: string | undefined;
+}): Promise<void>;
 /**
  * The agreement sentence, with WHICH FIELDS AGREED DERIVED rather than retyped — #1997.
  *
@@ -225,6 +298,15 @@ export function doctorRun(deps?: {
     err?: (line: string) => void;
     runsDir?: () => string;
 }): Promise<number>;
+export function recordedChecks(): {
+    name: string;
+    id: string;
+    ok: boolean;
+    detail: string;
+    fix: string | null;
+    note?: string | null;
+    advisory?: boolean;
+}[];
 export function addCheck(name: string, ok: boolean, detail: string, remedy?: string | null | {
     fix: string | null;
     note?: string | null;

package/dist/doctor.mjs

@@ -84,9 +84,18 @@ const REFUSED = 2;
 const WORKERS_ENV = configuredWorkers();
 const PAGES_PORT = Number(process.env.DATASET_PAGES_PORT || 5050);
 const CTL = fleetScriptPaths().workerCtl;
-const SCORER_MODEL_DIR = fileURLToPath(new URL("../../scorer/models/screenreader-scorer/", import.meta.url));
 const MODULE_DIR = fileURLToPath(new URL(".", import.meta.url));
 const isMonorepoRoot = (root)=>external_node_fs_existsSync(resolve(root, "packages")) && external_node_fs_existsSync(resolve(root, "package.json"));
+function checkoutLayout(baseDir = MODULE_DIR) {
+    const root = resolve(baseDir, "..", "..", "..");
+    return {
+        root,
+        checkout: isMonorepoRoot(root)
+    };
+}
+const notACheckout = (names, root)=>{
+    for (const name of names)advise(name, `n/a: installed package -- ${root} is not a checkout, so there is nothing here for this check to read`);
+};
 function runsDirFor({ argv = process.argv.slice(2), baseDir = MODULE_DIR } = {}) {
     const supplied = flagValue(argv, "runs-dir");
     if (void 0 !== supplied) {
@@ -100,6 +109,7 @@ function runsDirFor({ argv = process.argv.slice(2), baseDir = MODULE_DIR } = {})
 const datasetDir = ()=>resolve(runsDirFor(), "screenreader-dataset");
 const PROBE_TIMEOUT_MS = 8000;
 const checks = [];
+const recordedChecks = ()=>checks;
 const GATES = Object.freeze({
     worker: true,
     fleet: true,
@@ -182,8 +192,11 @@ async function httpJson(url) {
     if (void 0 === response.json) throw new Error(`invalid JSON from ${url}`);
     return response.json;
 }
-function checkPrimaryCheckoutMark() {
-    const root = resolve(fileURLToPath(new URL(".", import.meta.url)), "..", "..", "..");
+function checkPrimaryCheckoutMark({ baseDir = MODULE_DIR } = {}) {
+    const { root, checkout } = checkoutLayout(baseDir);
+    if (!checkout) return notACheckout([
+        "primary checkout"
+    ], root);
     let linked;
     try {
         linked = !statSync(resolve(root, ".git")).isDirectory();
@@ -209,17 +222,19 @@ function checkPrimaryCheckoutMark() {
     if (marked) return add("primary checkout", true, "MARKED — pre-commit refuses commits here and post-checkout keeps it detached at origin/main");
     advise("primary checkout", "not marked, so the primary-checkout guards are INERT here. Correct for the lab, a worker or a colleague's clone; wrong for the machine that drives the fleet.", "pnpm run primary:mark -- --set   (only on the fleet-driving checkout — see docs/primary-checkout.md)");
 }
-function checkControlPlaneIsolation() {
+function checkControlPlaneIsolation({ baseDir = MODULE_DIR } = {}) {
+    const { root, checkout } = checkoutLayout(baseDir);
+    if (!checkout) return notACheckout([
+        "isolation"
+    ], root);
     const raw = process.env.A11Y_SSH_KEY || "~/.ssh/a11y-witness_ed25519";
     const keyPath = raw.startsWith("~/") ? resolve(homedir(), raw.slice(2)) : raw;
     const hasFleetKey = external_node_fs_existsSync(keyPath);
-    const root = resolve(fileURLToPath(new URL(".", import.meta.url)), "..", "..", "..");
     const hasNodeModules = external_node_fs_existsSync(resolve(root, "node_modules"));
-    const isWorkspace = external_node_fs_existsSync(resolve(root, "packages")) && external_node_fs_existsSync(resolve(root, "package.json"));
     const verdict = controlPlaneIsolation({
         hasNodeModules,
         hasFleetKey,
-        isWorkspace
+        isWorkspace: checkout
     });
     if (!verdict.violated) return add("isolation", true, verdict.why);
     advise("isolation", verdict.why, "docs/control-plane-plan.md L3 — drive the control plane rather than holding its keys");
@@ -270,9 +285,13 @@ function behindOriginMainNote(otherRoot) {
         return "";
     }
 }
-function checkCrossPackageDist() {
+function checkCrossPackageDist({ baseDir = MODULE_DIR } = {}) {
     const specifier = "@a11ign/judge/rules";
-    const thisCheckoutRoot = resolve(fileURLToPath(new URL(".", import.meta.url)), "..", "..", "..");
+    const { root: thisCheckoutRoot, checkout } = checkoutLayout(baseDir);
+    if (!checkout) return notACheckout([
+        "dist-resolution",
+        "dist-freshness"
+    ], thisCheckoutRoot);
     let resolvedRealPath;
     try {
         resolvedRealPath = external_node_fs_realpathSync(createRequire(import.meta.url).resolve(specifier));
@@ -291,11 +310,24 @@ function checkCrossPackageDist() {
     if (upToDate) return add("dist-freshness", true, `packages/judge under ${distRoot} is up to date (tsc --build --dry)`);
     advise("dist-freshness", `packages/judge under ${distRoot} is NOT up to date (tsc --build --dry) -- a build compiled before the source it now reflects`, "pnpm run build   # in that checkout");
 }
-async function checkJudge() {
+async function scorerWeightsFor({ from = import.meta.url } = {}) {
+    const judgeEntry = external_node_fs_realpathSync(createRequire(from).resolve("@a11ign/judge"));
+    const scorerEntry = external_node_fs_realpathSync(createRequire(judgeEntry).resolve("@a11ign/scorer"));
+    const { scorerPaths } = await import(pathToFileURL(scorerEntry).href);
+    return scorerPaths().weights;
+}
+async function checkJudge({ from = import.meta.url } = {}) {
     const backend = (process.env.JUDGE_BACKEND || "local").toLowerCase();
     if ("local" === backend) {
-        const weights = resolve(SCORER_MODEL_DIR, "model.safetensors");
-        return add("judge", external_node_fs_existsSync(weights), external_node_fs_existsSync(weights) ? "backend=local, trained scorer present" : "backend=local, but the trained scorer is missing", `expected weights at ${weights} — they ship in the repo, so this means an incomplete checkout`);
+        let weights;
+        try {
+            weights = await scorerWeightsFor({
+                from
+            });
+        } catch (error) {
+            return add("judge", false, `backend=local, but @a11ign/scorer could not be resolved from @a11ign/judge: ${error.message}`, "install @a11ign/scorer (a peer dependency of @a11ign/judge) beside @a11ign/judge");
+        }
+        return add("judge", external_node_fs_existsSync(weights), external_node_fs_existsSync(weights) ? "backend=local, trained scorer present" : "backend=local, but the trained scorer is missing", `expected weights at ${weights} (where @a11ign/scorer says they are) — reinstall @a11ign/scorer`);
     }
     if ("anthropic" === backend || "openai" === backend) {
         const key = "anthropic" === backend ? "ANTHROPIC_API_KEY" : "JUDGE_BASE_URL";
@@ -532,4 +564,4 @@ async function main() {
     process.exit(await doctorRun());
 }
 if (import.meta.url === pathToFileURL(process.argv[1] ? external_node_fs_realpathSync(process.argv[1]) : "").href) await main();
-export { addCheck, allChecks, checkoutRootFor, doctorRun, errorDocument, fleetAgreementLine, gatingChecks, isRunnableCommand, nextCommand, readyFrom, resolvesToThisCheckout, runsDirFor, tscProjectUpToDate, workerControlFix };
+export { addCheck, allChecks, checkControlPlaneIsolation, checkCrossPackageDist, checkJudge, checkPrimaryCheckoutMark, checkoutRootFor, doctorRun, errorDocument, fleetAgreementLine, gatingChecks, isRunnableCommand, nextCommand, readyFrom, recordedChecks, resolvesToThisCheckout, runsDirFor, scorerWeightsFor, tscProjectUpToDate, workerControlFix };

package/dist/worker-code-check.d.mts

@@ -1,3 +1,29 @@
+/**
+ * The hash every worker is expected to be serving, and WHERE IT CAME FROM. ONE function, asked by `a11ign-worker-code` and by
+ * `assertFleetRunsThisCheckout` alike, so the two cannot be given different hashers again (a11ign/a11ign#3781).
+ *
+ * With a layer clone present it is the CLONE's: the clone's own `code-version.mjs` over the clone's `src/`, which is what
+ * `layerCodeVersion("nvda-worker")` computes for the deploy and the lab, and what a guest is told to be on (`--layer-ref`). Asking the
+ * installed package instead made every worker read stale the first time a guest was deployed at a sha whose `.mjs` differed from the
+ * release, with a remedy ("redeploy") that could not clear it.
+ *
+ * With none it is the installed package's (a11ign/a11ign#3740: the one the package was RELEASED with, `codeVersion()` and no
+ * directory, because the built package's `workerSourceDir()` is `dist/` and holds none of the files a guest runs), and `source` and
+ * `note` say so, so a reading is never silent about which it was.
+ *
+ * ASYNC because the clone's hasher can only be imported dynamically, as `layerCodeVersion` does.
+ *
+ * @param {{ checkoutRoot?: string }} [options]
+ * @returns {Promise<{ code: string, source: "clone" | "installed", sourceDir: string, note: string }>}
+ */
+export function resolveExpectedWorkerCode({ checkoutRoot }?: {
+    checkoutRoot?: string;
+}): Promise<{
+    code: string;
+    source: "clone" | "installed";
+    sourceDir: string;
+    note: string;
+}>;
 /**
  * Refuse to capture with a fleet that is not running this checkout.
  *
@@ -10,15 +36,15 @@
  * A thin wrapper over `assertWorkersServe`, supplying the one thing only this file can compute: the hash.
  *
  * @param {string[]} workers
- * @param {{when?: string, allow?: boolean, read?: (url: string) => Promise<string|null>, bareMetalUrls?: string[]}} options
+ * @param {{when?: string, allow?: boolean, read?: (url: string) => Promise<string|null>, bareMetalUrls?: string[], checkoutRoot?: string}} options
  */
 export function assertFleetRunsThisCheckout(workers: string[], options?: {
     when?: string;
     allow?: boolean;
     read?: (url: string) => Promise<string | null>;
     bareMetalUrls?: string[];
+    checkoutRoot?: string;
 }): Promise<void>;
-export function expectedWorkerCode(): string;
 import { codeDrift } from "./code-drift.mjs";
 import { describeCodeDrift } from "./code-drift.mjs";
 import { describeEmptyPool } from "./code-drift.mjs";

package/dist/worker-code-check.mjs

@@ -1,5 +1,8 @@
 import { execFileSync } from "node:child_process";
 import { codeVersion, workerSourceDir } from "@a11ign/screenreader-worker/code-version";
+import { existsSync, readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
 import { requestJson } from "./worker-http.mjs";
 import { sandboxGitEnv } from "./src_git-safe-env_mjs.mjs";
 const HEALTH_TIMEOUT_MS = 15000;
@@ -119,11 +122,49 @@ async function assertWorkersServe(expected, workers, options) {
     process.stderr.write(refusal);
     process.exit(3);
 }
-const expectedWorkerCode = ()=>codeVersion();
+const NVDA_WORKER_LAYER = "nvda-worker";
+function layerClone(checkoutRoot) {
+    const manifestPath = join(checkoutRoot, "packages", "control", "layers.json");
+    if (!existsSync(manifestPath)) return {
+        absent: `no packages/control/layers.json under ${checkoutRoot}`
+    };
+    const layer = JSON.parse(readFileSync(manifestPath, "utf8")).layers?.[NVDA_WORKER_LAYER];
+    if (!layer?.path) return {
+        absent: `${manifestPath} does not declare "${NVDA_WORKER_LAYER}"`
+    };
+    const dir = resolve(checkoutRoot, layer.path);
+    return existsSync(dir) ? {
+        dir
+    } : {
+        absent: `no layer clone at ${dir}`
+    };
+}
+async function resolveExpectedWorkerCode({ checkoutRoot = process.cwd() } = {}) {
+    const clone = layerClone(checkoutRoot);
+    if ("absent" in clone) return {
+        code: codeVersion(),
+        source: "installed",
+        sourceDir: workerSourceDir(),
+        note: `the installed @a11ign/screenreader-worker (${clone.absent})`
+    };
+    const sourceDir = `${join(clone.dir, "src")}/`;
+    const hasher = await import(pathToFileURL(join(sourceDir, "code-version.mjs")).href);
+    return {
+        code: hasher.codeVersion(sourceDir),
+        source: "clone",
+        sourceDir,
+        note: `the layer clone at ${clone.dir}`
+    };
+}
 async function assertFleetRunsThisCheckout(workers, options = {}) {
-    return assertWorkersServe(expectedWorkerCode(), workers, {
-        ...options,
-        sourceDir: workerSourceDir()
+    const { checkoutRoot, ...rest } = options;
+    const expected = await resolveExpectedWorkerCode({
+        checkoutRoot
+    });
+    if (!options.allow) process.stdout.write(`Expected worker code ${expected.code}, from ${expected.note}.\n`);
+    return assertWorkersServe(expected.code, workers, {
+        ...rest,
+        sourceDir: expected.sourceDir
     });
 }
-export { assertFleetRunsThisCheckout, codeDrift, describeCodeDrift, describeEmptyPool, expectedWorkerCode, readWorkerCode, remedyLines, workerSourceDirty };
+export { assertFleetRunsThisCheckout, codeDrift, describeCodeDrift, describeEmptyPool, readWorkerCode, remedyLines, resolveExpectedWorkerCode, workerSourceDirty };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@a11ign/screenreader-fleet",
-  "version": "0.4.1",
+  "version": "0.5.0",
   "description": "Host-side lifecycle, health and capacity for a fleet of Windows NVDA capture workers: lease one, judge whether it is degrading, and know how many the host can afford.",
   "license": "AGPL-3.0-or-later",
   "type": "module",