@appchy/jarvis 0.1.120 → 0.1.122

package/harness/harness/git.py

@@ -590,6 +590,21 @@ def _left_alone(theirs) -> str:
             "to land.")
 
 
+def has_commit(repo, sha: str) -> bool:
+    """Is `sha` still a commit this repo holds?
+
+    A push that rebases rewrites the commits it moves, so a sha a gate run recorded
+    can stop existing while the code it measured is untouched. Everything that reads
+    a recorded sha needs to tell that apart from the code having changed: they are
+    opposite situations and the first one cannot be diagnosed from a hash a reader
+    cannot open.
+    """
+    if not sha or sha == "no-git":
+        return False
+    code, _, _ = _git(repo, "cat-file", "-e", f"{sha}^{{commit}}")
+    return code == 0
+
+
 def only_board_moved(repo, sha: str) -> bool:
     """Is everything between `sha` and HEAD a board file?
 

package/harness/harness/peers.py

@@ -46,6 +46,37 @@ def here() -> str:
     return git.machine()
 
 
+def alive(pid) -> bool:
+    """Whether a process is still there. **One answer to this, for every caller.**
+
+    Signal 0 asks the kernel without touching the process. Strictly positive, because
+    signal 0 to pid 0 asks about the whole process group and to a negative pid about
+    another one — either would answer "alive" about something that is not the process
+    in question at all.
+
+    **A pid somebody else owns answers `PermissionError`, and that is ALIVE**: the
+    kernel refused to signal a process it just confirmed exists. The verify lock read
+    the same refusal as *dead* while this read it as alive, so a second run could
+    start over a live one — two readings of one pid, which is the disagreement every
+    shared answer in this module exists to prevent. It lives here rather than beside
+    either caller because a pid is a machine fact and this file is where those are.
+
+    **Known limit: a recycled pid reads as alive.** A process killed hard leaves its
+    artifacts behind, so nothing on the machine can corroborate the number, and
+    reading a start time needs a child process this module is deliberately not
+    allowed to spawn. What bounds it is where the answer is used.
+    """
+    try:
+        if int(pid) <= 0:
+            return False
+        os.kill(int(pid), 0)
+    except PermissionError:
+        return True
+    except (OSError, TypeError, ValueError):
+        return False
+    return True
+
+
 #: Where an agent client publishes the sessions it currently has running. Claude
 #: Code is the only one that publishes anything today; the shape is one JSON file
 #: per process carrying its own session id, its addressable name and its pid.
@@ -76,20 +107,15 @@ def _live():
     different and much stronger claim: something published a list and this session
     was not on it.
 
-    A pid is checked rather than trusted. The directory is cleaned up on exit, so in
-    practice it holds only live runs, but a process killed hard leaves its file
-    behind — and a stale entry here would resurrect exactly the ghost this exists to
-    catch. Signal 0 asks the kernel whether the pid is there without touching it.
-
-    **Known limit: a recycled pid reads as alive.** If a session is killed hard AND
-    the operating system later hands its number to some unrelated program, this says
-    running about a session that is gone. It is not closed here, and the alternatives
-    were worse: every artifact that could corroborate the pid — the messaging socket
-    included — is left behind by the same hard kill, so pairing two stale files
-    proves nothing, and reading a process's start time needs a child process this
-    module is deliberately not allowed to spawn. What bounds it instead is where the answer is used: one
-    row on a status screen reading "running" instead of "ended", never a board write,
-    which is the constraint the rule about a client's facts already sets.
+    A pid is checked rather than trusted, through `alive()` — the one answer this
+    module gives to that question, shared with the verify lock. The directory is
+    cleaned up on exit, so in practice it holds only live runs, but a process killed
+    hard leaves its file behind, and a stale entry here would resurrect exactly the
+    ghost this exists to catch.
+
+    `alive()` carries the recycled-pid limit. What bounds it is where the answer is
+    used: one row on a status screen reading "running" instead of "ended", never a
+    board write, which is the constraint the rule about a client's facts already sets.
 
     The result is cached per directory for the life of the process. The harness is a
     short-lived command, so re-globbing and re-signalling once per printed row is
@@ -110,20 +136,9 @@ def _live():
             continue  # a half-written file is not a dead session
         if not isinstance(entry, dict):
             continue
-        run, pid = str(entry.get("sessionId", "")), entry.get("pid")
-        if not run:
-            continue
-        try:
-            # Strictly positive: signal 0 to pid 0 asks about the whole process
-            # group and to a negative pid about another one, so either would answer
-            # "alive" about something that is not this session at all.
-            if int(pid) <= 0:
-                continue
-            os.kill(int(pid), 0)
-        except (TypeError, ValueError, ProcessLookupError):
+        run = str(entry.get("sessionId", ""))
+        if not run or not alive(entry.get("pid")):
             continue
-        except PermissionError:
-            pass  # alive and owned by somebody else, which is still alive
         out[run] = entry
     _RUNNING[key] = out
     return out

package/harness/presets/appchy/PRESET.md

@@ -441,7 +441,7 @@ the only way forward has hit a real gap: **park a question, do not shell out.**
 | Create a task | `jarvis work new <name> --epic <e> [--priority] [--depends] [--owner] [--code] [--covers]` | either — `work_create` is the tool |
 | List | `jarvis work list` | either — `work_list` is the tool |
 | Pick up / complete | `jarvis work move <name> in-progress\|complete --delivered "…" --not-included "…"` | either — `work_take` / `work_complete` |
-| Prove it | `jarvis work verify --task <name>` (blocks) · `--async` (what the tool uses) | either — `work_verify` |
+| Prove it | `jarvis work verify <name>` (blocks) · `--start` (what the tool uses) · `--status` (asks, starts nothing) | either — `work_verify` |
 | Record an approved plan | `jarvis work plan <name> [--file <path>]` | either |
 | Hand off | `jarvis work handoff <name>`, then fill it | either — **no tool yet**; the prose is judgement |
 | Open the NEXT session | `jarvis work kickoff <name>` — never hand-write the prompt | either — `work_wrap` embeds it |

package/harness/test_work.py

@@ -3248,13 +3248,101 @@ def test_starting_while_a_run_is_live_names_whose_it_is_rather_than_attaching():
                                        "machine": "here", "started": gate._now().isoformat(),
                                        "gates": ["tests"], "current": "tests", "done": [],
                                        "finished": None, "read": False})
-                out = _said(lambda: gate.cmd_verify({"task": "beta", "async": True}))
-                assert out["state"] == "running", out
+                out = _said(lambda: gate.cmd_verify({"task": "beta", "start": True}))
+                # `busy` and not `running`: the slot is taken and it is somebody
+                # else's. Reporting both as `running` is how a session read a held
+                # checkout as its own gates making progress.
+                assert out["state"] == "busy", out
+                assert out["run"]["task"] == "alpha", out
                 assert "alpha" in out["message"], out["message"]
+                # Not a queue, and it says so rather than letting a refused caller
+                # believe a call is coming.
+                assert "Nothing is holding your place" in out["message"], out["message"]
             finally:
                 gate.VERIFY = old
 
 
+def test_a_held_slot_never_reports_as_the_callers_own_progress():
+    # The measured half of this: asking for progress answered `18s, 0 of 9` and then
+    # `322s, 8 of 9` two minutes apart, for two different runs, and a caller could
+    # tell neither a fresh start from somebody else's long one nor whether its own
+    # request had taken effect. Every gate-shaped field describes the CALLER's item,
+    # so on a slot that is not theirs they are empty and the run sits on its own.
+    with tempfile.TemporaryDirectory() as tmp:
+        v = _tree(tmp)
+        e = _epic(v, "an-epic")
+        _task(e / "in-progress", "alpha", body="# T\n")
+        _task(e / "in-progress", "beta", body="# T\n")
+        with _work_dir(tmp) as root:
+            old, gate.VERIFY = gate.VERIFY, {"tests": "true", "lint": "true"}
+            try:
+                gate._write_run(root, {"task": "alpha", "pid": os.getpid(),
+                                       "machine": "here", "session": peers.me(),
+                                       "started": gate._now().isoformat(),
+                                       "gates": ["lint", "tests"], "current": "tests",
+                                       "done": ["lint"], "finished": None, "read": False})
+                out = _said(lambda: gate.cmd_verify({"task": "beta", "status": True}))
+                assert out["state"] == "busy", out
+                assert out["gate"] == "" and out["done"] == [] and out["gates"] == [], \
+                    "another item's progress was reported as this caller's"
+                assert out["elapsedSeconds"] == 0 and out["passed"] is False, out
+                # …and what IS true about the checkout is said, in one place.
+                assert out["run"]["task"] == "alpha", out
+                assert out["run"]["gate"] == "tests" and out["run"]["done"] == ["lint"], out
+                assert "'beta'" in out["message"], out["message"]
+
+                # The same run, asked about by the item it IS proving, is progress.
+                mine = _said(lambda: gate.cmd_verify({"task": "alpha", "status": True}))
+                assert mine["state"] == "running", mine
+                assert mine["done"] == ["lint"], mine
+            finally:
+                gate.VERIFY = old
+
+
+def test_a_refused_verify_names_a_reachable_holder_when_there_is_one():
+    # The sibling refusal's join, made for the completion gate, applied to the one
+    # mechanism in this epic that actually refuses: the id was always in the run file
+    # and led nowhere, so the only move left was to ask again on a timer.
+    with tempfile.TemporaryDirectory() as tmp:
+        v = _tree(tmp)
+        e = _epic(v, "an-epic")
+        _task(e / "in-progress", "alpha", body="# T\n")
+        with _work_dir(tmp) as root, tempfile.TemporaryDirectory() as sess:
+            old, gate.VERIFY = gate.VERIFY, {"tests": "true"}
+            keep = os.environ.get(peers.SESSIONS)
+            os.environ[peers.SESSIONS] = sess
+            peers._RUNNING.clear()
+            try:
+                Path(sess, "1.json").write_text(json.dumps(
+                    {"sessionId": "aaaabbbb-0000-0000-0000-000000000000",
+                     "name": "jarvis-22", "pid": os.getpid(), "cwd": str(root.parent)}))
+                gate._write_run(root, {
+                    "task": "alpha", "pid": os.getpid(), "machine": peers.here(),
+                    "session": "aaaabbbb-0000-0000-0000-000000000000",
+                    "started": gate._now().isoformat(), "gates": ["tests"],
+                    "current": "tests", "done": [], "finished": None, "read": False})
+                said = gate._busy(gate.live_run(root))
+                assert "jarvis-22" in said, said
+                assert "SendMessage" in said, said
+                # How far through, because "started 190s ago" cannot answer whether
+                # this is nearly over or has just begun.
+                assert "gate 1 of 1" in said, said
+
+                # A run that recorded no session says nothing about who — an
+                # enrichment we can lose, never a guess we invent.
+                gate._write_run(root, {**gate.read_run(root), "session": ""})
+                quiet = gate._busy(gate.live_run(root))
+                assert "jarvis-22" not in quiet and "started by" not in quiet, quiet
+                assert "corrupt each other" in quiet, quiet
+            finally:
+                gate.VERIFY = old
+                peers._RUNNING.clear()
+                if keep is None:
+                    os.environ.pop(peers.SESSIONS, None)
+                else:
+                    os.environ[peers.SESSIONS] = keep
+
+
 def test_a_finished_run_for_another_task_is_not_handed_over_as_this_ones():
     # The wrong-verdict half. A result proven for one item says nothing about
     # another, and reporting it would put a green gate on work nobody ran.
@@ -3271,8 +3359,255 @@ def test_a_finished_run_for_another_task_is_not_handed_over_as_this_ones():
                 out = _said(lambda: gate.cmd_verify({"task": "beta", "status": True}))
                 assert out["state"] == "idle", out
                 assert out["passed"] is False, out
+                # …and it says WHICH kind of nothing this is. "No gates have run"
+                # covering both "nobody ran anything" and "the last run proved
+                # somebody else's item" is what a caller cannot act on.
+                assert out["reason"] == "other", out
+                assert "'alpha'" in out["message"], out["message"]
+            finally:
+                gate.VERIFY = old
+
+
+def test_a_run_that_stopped_without_recording_says_so_rather_than_reading_as_never_run():
+    # The half nobody could prove. A run whose process is gone leaves a file every
+    # door correctly treats as absent, and the next start OVERWRITES it — so the
+    # session that lost four minutes of gates learned it only by noticing the slot
+    # now named somebody else's item. Reported from the receiving end, 2026-09-12.
+    with tempfile.TemporaryDirectory() as tmp:
+        v = _tree(tmp)
+        e = _epic(v, "an-epic")
+        _task(e / "in-progress", "alpha", body="# T\n")
+        _task(e / "in-progress", "beta", body="# T\n")
+        with _work_dir(tmp) as root:
+            old, gate.VERIFY = gate.VERIFY, {"tests": "true"}
+            try:
+                dead = {"task": "alpha", "pid": 2 ** 31 - 1, "machine": "here",
+                        "session": "aaaabbbb-0000-0000-0000-000000000000",
+                        "started": gate._now().isoformat(),
+                        "gates": ["lint", "tests"], "current": "tests",
+                        "done": ["lint"], "finished": None, "read": False}
+                gate._write_run(root, dead)
+                out = _said(lambda: gate.cmd_verify({"task": "alpha", "status": True}))
+                assert out["state"] == "idle" and out["reason"] == "lost", out
+                assert "gate 2 of 2" in out["message"], out["message"]
+                assert "without recording" in out["message"], out["message"]
+
+                # And it survives the run that replaces it, which is the case that
+                # actually happened: the slot is claimed by another item, and the
+                # session whose gates vanished is still told — being behind a
+                # stranger's run and having lost your own are two facts, and the
+                # only thing it had to go on was the slot naming somebody else.
+                gate._write_run(root, gate._begin(root, "beta", os.getpid()))
+                assert gate.read_run(root)["lost"]["task"] == "alpha", gate.read_run(root)
+                still = _said(lambda: gate.cmd_verify({"task": "alpha", "status": True}))
+                assert still["state"] == "busy" and still["reason"] == "lost", still
+                assert still["run"]["task"] == "beta", still
+                assert "without recording" in still["message"], still["message"]
+
+                # A run that FINISHED is not a lost one, however long ago it was.
+                gate._write_run(root, {**dead, "finished": gate._now().isoformat(),
+                                       "passed": True, "sha": "", "results": []})
+                done = _said(lambda: gate.cmd_verify({"task": "alpha", "status": True}))
+                assert done["state"] == "finished", done
+            finally:
+                gate.VERIFY = old
+
+
+def test_a_result_the_code_moved_past_names_both_commits():
+    # `moved` and `no gates have run` were one sentence, and this is the mode that
+    # cost the most: a gate run only counted if nobody committed for four minutes,
+    # and three sessions were committing every few minutes. The result was recorded
+    # against a HEAD that no longer existed and read as never having run.
+    with tempfile.TemporaryDirectory() as tmp:
+        try:
+            repo = _git_repo(tmp, push=False)
+            ran = _git(repo, "rev-parse", "HEAD").stdout.strip()
+            (repo / "src.txt").write_text("the code moved\n")
+            _git(repo, "add", "-A"); _git(repo, "commit", "-qm", "somebody committed")
+            head = _git(repo, "rev-parse", "HEAD").stdout.strip()
+
+            old, gate.VERIFY = gate.VERIFY, {"tests": "true"}
+            with _work_dir(str(repo / "work")) as root:
+                try:
+                    gate._write_run(root, {
+                        "task": "alpha", "pid": os.getpid(), "machine": "here",
+                        "session": "", "started": gate._now().isoformat(),
+                        "head": ran, "gates": ["tests"], "current": "",
+                        "done": ["tests"], "finished": gate._now().isoformat(),
+                        "passed": True, "sha": ran, "read": False,
+                        "results": [{"name": "tests", "status": "PASS", "said": ""}]})
+                    out = _said(lambda: gate.cmd_verify({"task": "alpha", "status": True}))
+                    assert out["reason"] == "moved", out
+                    assert ran[:12] in out["message"], out["message"]
+                    assert head[:12] in out["message"], out["message"]
+                    assert out["passed"] is False, "a stale green must not read as proven"
+
+                    # A commit a push rebased away is a DIFFERENT answer: the code it
+                    # measured may be identical, and naming a hash nobody can open is
+                    # worse than saying it is gone.
+                    gate._write_run(root, {**gate.read_run(root), "read": False,
+                                           "sha": "0" * 40, "head": "0" * 40})
+                    gone = _said(lambda: gate.cmd_verify({"task": "alpha", "status": True}))
+                    assert gone["reason"] == "gone", gone
+                    assert "rebased" in gone["message"], gone["message"]
+                finally:
+                    gate.VERIFY = old
+        finally:
+            config.apply(config.DEFAULTS)
+
+
+def test_the_slot_is_held_from_before_the_child_starts():
+    # The check-then-spawn this replaces left the slot unheld for the whole of a
+    # Python interpreter's startup — hundreds of milliseconds, not an instant — so
+    # two sessions polling one board could both walk through it and the second run's
+    # build would delete the artifact the first one's log check was about to read.
+    with tempfile.TemporaryDirectory() as tmp:
+        v = _tree(tmp)
+        e = _epic(v, "an-epic")
+        _task(e / "in-progress", "alpha", body="# T\n")
+        with _work_dir(tmp) as root:
+            old, gate.VERIFY = gate.VERIFY, {"tests": "true"}
+            spawned = []
+            real = gate.subprocess.Popen
+            try:
+                # The claim has to be in place BEFORE anything is spawned, or a lost
+                # race still leaves a child running gates nothing is tracking. Only
+                # the verify child is intercepted — everything else here, `git`
+                # included, still runs for real.
+                class Sham:
+                    pid = os.getpid()
+
+                def watch(argv, **kw):
+                    if "--detached" not in argv:
+                        return real(argv, **kw)
+                    spawned.append(gate.live_run(root))
+                    return Sham()
+                gate.subprocess.Popen = watch
+                out = _said(lambda: gate.cmd_verify({"task": "alpha", "start": True}))
+                assert out["state"] == "started", out
+                assert spawned and spawned[0] and spawned[0]["task"] == "alpha", \
+                    "the slot was open while the child was being spawned"
+
+                # A second start over a live claim is refused, and starts nothing.
+                spawned.clear()
+                again = _said(lambda: gate.cmd_verify({"task": "alpha", "start": True}))
+                assert again["state"] == "busy", again
+                assert spawned == [], "a refused start spawned a run anyway"
+
+                # A slot whose process is gone is taken over rather than waited for:
+                # a lock that outlives its holder strands every future verify.
+                gate._write_run(root, {**gate.read_run(root), "pid": 2 ** 31 - 1})
+                free = _said(lambda: gate.cmd_verify({"task": "alpha", "start": True}))
+                assert free["state"] == "started", free
+            finally:
+                gate.subprocess.Popen = real
+                gate.VERIFY = old
+
+
+def test_a_lost_run_is_retired_by_the_run_that_records_one():
+    # The carried note outlived what it was about: a run for this item died, the next
+    # run for the same item passed and was reported, and every ask after the first
+    # went back to saying nothing had been written — about gates that had just gone
+    # green. A note that survives its own subject is the failure class this whole
+    # item exists to remove, so it must not be reintroduced by the fix.
+    with tempfile.TemporaryDirectory() as tmp:
+        v = _tree(tmp)
+        e = _epic(v, "an-epic")
+        _task(e / "in-progress", "alpha", body="# T\n")
+        with _work_dir(tmp) as root:
+            old, gate.VERIFY = gate.VERIFY, {"tests": "true"}
+            try:
+                gate._write_run(root, {"task": "alpha", "pid": 2 ** 31 - 1,
+                                       "started": gate._now().isoformat(),
+                                       "gates": ["tests"], "done": [],
+                                       "finished": None, "read": False})
+                # A real run for the same item, which picks the note up and then
+                # RECORDS — so the note is spent, and the record must not be left
+                # saying both "passed for alpha" and "alpha's run wrote nothing".
+                # Cleared where it stops being true rather than stepped around by
+                # whoever reads it next.
+                gate.cmd_verify({"task": "alpha"})
+                assert gate.read_run(root)["passed"] is True
+                assert gate.read_run(root)["lost"] is None, gate.read_run(root)
+
+                first = _said(lambda: gate.cmd_verify({"task": "alpha", "status": True}))
+                assert first["state"] == "finished" and first["passed"] is True, first
+                again = _said(lambda: gate.cmd_verify({"task": "alpha", "status": True}))
+                assert again["reason"] == "read", again
+                assert "without recording" not in again["message"], again["message"]
+            finally:
+                gate.VERIFY = old
+
+
+def test_a_slot_the_harness_cannot_write_is_not_reported_as_somebody_elses_run():
+    # Only "the file is already there" means somebody holds it. Any other failure to
+    # write is the harness's own, and a caller told `a verify is already running here
+    # (pid None)` goes looking for a session that does not exist — a door reporting
+    # its own failure as the caller's situation.
+    with tempfile.TemporaryDirectory() as tmp:
+        v = _tree(tmp)
+        _epic(v, "an-epic")
+        with _work_dir(tmp) as root:
+            old, gate.VERIFY = gate.VERIFY, {"tests": "true"}
+            real = gate.os.open
+            try:
+                def refuse(path, flags, *rest):
+                    if str(path).endswith(gate.RUN):
+                        raise PermissionError(13, "Permission denied")
+                    return real(path, flags, *rest)
+                gate.os.open = refuse
+                out = _said(lambda: gate.cmd_verify({"task": "alpha", "start": True}))
+                assert out["state"] != "busy", out
+                assert out["run"] is None, out
+                assert "Permission denied" in out["message"], out["message"]
+                assert "not another session" in out["message"], out["message"]
+            finally:
+                gate.os.open = real
+                gate.VERIFY = old
+
+
+def test_a_pid_somebody_else_owns_is_alive_not_dead():
+    # Two readings of one pid: `peers._live` treats a kernel refusal as alive and
+    # this treated it as dead, so a run owned by another user read as over and a
+    # second run could start over a live one. One question, one answer.
+    real = gate.os.kill
+    try:
+        def refuse(pid, sig):
+            raise PermissionError(1, "Operation not permitted")
+        gate.os.kill = refuse
+        assert gate._alive(4242) is True
+    finally:
+        gate.os.kill = real
+    # pid 0 asks about the whole process group and a negative one about another
+    # group, so either would answer "alive" about something that is not this run.
+    assert gate._alive(0) is False and gate._alive(-1) is False
+
+
+def test_the_doors_that_start_are_told_apart_from_the_one_that_asks():
+    # `--async` only ever started a run, and it READ like "ask me in the background":
+    # a session polling with it set a fresh nine-gate run going every time the
+    # previous one ended. The parser turns any `--word` into a flag, so an unread one
+    # fell through to the BLOCKING door — the caller waiting minutes for a run it
+    # never asked to start. A typo and a renamed flag both say so now.
+    with tempfile.TemporaryDirectory() as tmp:
+        v = _tree(tmp)
+        _epic(v, "an-epic")
+        with _work_dir(tmp):
+            old, gate.VERIFY = gate.VERIFY, {"tests": "true"}
+            try:
+                for flag in ("async", "stat", "wait"):
+                    try:
+                        gate.cmd_verify({"task": "alpha", flag: True})
+                    except SystemExit as e:
+                        assert e.code, f"--{flag} exited 0"
+                    else:
+                        raise AssertionError(f"--{flag} was accepted and ignored")
             finally:
                 gate.VERIFY = old
+    # The help names each door by whether it STARTS, which is the only distinction
+    # that matters when one of them costs four minutes.
+    help_ = entry.__doc__ or ""
+    assert "--start" in help_ and "--status   only SAYS" in help_, help_
 
 
 def test_a_second_verify_is_refused_while_one_is_running():

package/harness/work.py

@@ -91,10 +91,13 @@ cannot finish has somewhere to put the reason instead of stalling or guessing:
     status                             what shipped · what waits on you · what is at risk
     method                             the METHOD in full — how work is done here. The session
                                        block names it; this is the body, on request.
-    verify [--task <name>] [--async]   RUN verify.* (shell=False) and record the result;
-                                       --async starts them and returns, then reports
-                                       progress and finally the result. One at a time
-                                       per checkout: two corrupt each other.
+    verify <name> [--start | --status]  RUN verify.* (shell=False) and record the result.
+                                       Which door you pick decides whether a run STARTS:
+                                         (no flag)  starts them here and waits for the table
+                                         --start    starts them in the background, answers at once
+                                         --status   only SAYS where the run stands — starts nothing
+                                       One run at a time per checkout: two corrupt each
+                                       other. Refused while one is going, and told whose.
     observed <task> --ac AC-01 --saw "…"   an eyes-on, for what a test cannot prove
     ask <task> --question "…" [--options "a | b"] [--owner who] [--durable]
                                        park a question, move on — exits 0, never blocks
@@ -326,7 +329,7 @@ def _writes(cmd: str, flags: dict) -> bool:
     """Does THIS invocation change the board?
 
     The command name answers it for all but one. `verify` writes the result of a run
-    it EXECUTES, and two of its four doors execute nothing: `--async` starts a
+    it EXECUTES, and two of its four doors execute nothing: `--start` starts a
     detached child that commits its own result, and `--status` only reports. Both
     write to `work/.verify`, which is gitignored, so neither has anything of its own
     to land — and both were driving a commit that swept up whatever the person had
@@ -336,7 +339,7 @@ def _writes(cmd: str, flags: dict) -> bool:
     """
     if cmd not in git.WRITES:
         return False
-    if cmd == "verify" and (flags.get("async") or flags.get("status")):
+    if cmd == "verify" and (flags.get("start") or flags.get("status")):
         return False
     return True
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@appchy/jarvis",
-  "version": "0.1.120",
+  "version": "0.1.122",
   "description": "Jarvis — local AI coding assistant CLI",
   "private": false,
   "type": "module",