@appchy/jarvis 0.1.39 → 0.1.40

package/harness/harness/gate.py

@@ -485,8 +485,14 @@ def gate(root, task, accept: str = "", owner: str = "") -> list:
                            f"`jarvis work verify --task {task.name}`")
         else:
             head = _head(root.parent)
+            # WHAT MOVED, not merely THAT it moved. A board write cannot change what a
+            # test proved, and neither can a commit inside a system this task does not
+            # own (`M-86`, and `git.moved_only_elsewhere` for the measurement and for
+            # why a path nothing claims stays strict).
             if (head and sha not in ("no-git", "") and not head.startswith(sha)
-                    and not git.only_board_moved(root.parent, sha)):
+                    and not git.only_board_moved(root.parent, sha)
+                    and not git.moved_only_elsewhere(
+                        root.parent, sha, root, list(task.code or []))):
                 reasons.append(f"code moved since verify passed (proven at {sha}, "
                                f"HEAD is {head[:12]}) — re-run `jarvis work verify "
                                f"--task {task.name}`")

package/harness/harness/git.py

@@ -423,6 +423,57 @@ def only_board_moved(repo, sha: str) -> bool:
                for f in out.splitlines() if f.strip())
 
 
+def moved_only_elsewhere(repo, sha: str, root, regions: list) -> bool:
+    """Is everything between `sha` and HEAD outside the systems that own `regions`?
+
+    **The completion gate is a race, and this is what makes it winnable.** It refuses
+    unless the verify sha IS HEAD, which is right in spirit — evidence is about the
+    tree it was taken on. On a tree several sessions share it is close to unwinnable:
+    MEASURED on mixbrix 2026-09-07, the median gap between commits that touch code is
+    284s and a gate run is 287s, so about half of all attempts finish their run only to
+    be told the code moved. A session that stops there leaves finished work sitting in
+    `in-progress` for good — `the-benches-become-sessions` sat there a fortnight with
+    every criterion ticked and its own handoff saying exactly why.
+
+    **This is not a new licence; it is `M-86` applied one step earlier.** That rule
+    already says a suite failure OUTSIDE your `code:` regions warns rather than
+    refuses. If a failure over there cannot refuse you, a COMMIT over there cannot
+    invalidate you either — holding both at once was the inconsistency.
+
+    **A path no system claims counts as the code moving, and that is the whole safety
+    of it.** `system_for_path` answers `None` both for a file nothing declares and for
+    a repo whose systems declare nothing, and the two are indistinguishable from here.
+    Reading either as *outside your regions* would turn every repo that never filled in
+    `paths:` into one where the gate silently passes anything — a vacuous green, which
+    is worse than the race it replaces. So unknown is always strict, and a repo earns
+    this only by declaring where its code lives.
+    """
+    if not enabled() or not sha or not regions:
+        return False
+    code, out, _ = _git(repo, "diff", "--name-only", f"{sha}..HEAD")
+    if code != 0:
+        return False
+    from .registry import scan_systems, system_for_path
+    systems = scan_systems(root)
+    if not systems:
+        return False
+    mine = {r for r in regions if r}
+    board = [r.rstrip("/") for r in (GIT.get("paths") or [])]
+    moved = False
+    for name in out.splitlines():
+        name = name.strip()
+        if not name:
+            continue
+        if any(name == r or name.startswith(f"{r}/") for r in board):
+            continue
+        owner = system_for_path(root, name, systems)
+        # Nothing claims it, or one of MY systems does -> the evidence is stale.
+        if owner is None or (mine & set(owner.code)):
+            return False
+        moved = True
+    return moved
+
+
 def land(repo, item: str, rows: list) -> tuple:
     """Commit what changed and push it. Returns (committed, pushed, note).
 

package/harness/test_work.py

@@ -3140,6 +3140,53 @@ def test_a_board_commit_does_not_count_as_the_code_moving():
             config.apply(config.DEFAULTS)
 
 
+def test_a_commit_in_another_system_does_not_invalidate_your_verify():
+    # The completion gate refused unless the verify sha WAS head, which on a tree
+    # several sessions share is close to unwinnable — measured on mixbrix, the median
+    # gap between code commits is about as long as a gate run, so half of all attempts
+    # lose. `M-86` already says a suite failure outside your `code:` regions warns
+    # rather than refuses; a COMMIT outside them cannot invalidate you either.
+    with tempfile.TemporaryDirectory() as tmp:
+        try:
+            repo = _git_repo(tmp)
+            arch = repo / "work" / "architecture"
+            arch.mkdir(parents=True, exist_ok=True)
+            (arch / "backoffice.md").write_text(
+                "---\ntype: system\ncode: [backoffice]\npaths: [apps/backoffice]\n"
+                "depends_on: []\n---\n\n# Backoffice\n")
+            (arch / "engine.md").write_text(
+                "---\ntype: system\ncode: [runtime]\npaths: [packages/engine]\n"
+                "depends_on: []\n---\n\n# Engine\n")
+            for f in ("apps/backoffice/page.tsx", "packages/engine/run.cpp",
+                      "scripts/loose.py"):
+                (repo / f).parent.mkdir(parents=True, exist_ok=True)
+                (repo / f).write_text("first\n")
+            _git(repo, "add", "-A")
+            _git(repo, "commit", "-qm", "the code under test")
+            proven_at = _git(repo, "rev-parse", "HEAD").stdout.strip()[:12]
+            root = repo / "work"
+
+            # A PEER MOVES ANOTHER SYSTEM. Your evidence still stands.
+            (repo / "packages/engine/run.cpp").write_text("a peer's change\n")
+            _git(repo, "add", "-A")
+            _git(repo, "commit", "-qm", "somebody else's system")
+            assert git.moved_only_elsewhere(repo, proven_at, root, ["backoffice"]), \
+                "a commit in a system you do not own cannot invalidate your run"
+            assert not git.moved_only_elsewhere(repo, proven_at, root, ["runtime"]), \
+                "and the very same commit DOES invalidate the task that owns it"
+
+            # A PATH NOTHING CLAIMS IS ALWAYS STRICT. This is the safety property: a
+            # repo that never filled in `paths:` must not get a gate that passes
+            # everything, which is a worse failure than the race it replaces.
+            (repo / "scripts/loose.py").write_text("claimed by no system\n")
+            _git(repo, "add", "-A")
+            _git(repo, "commit", "-qm", "a file under no system at all")
+            assert not git.moved_only_elsewhere(repo, proven_at, root, ["backoffice"]), \
+                "a path no system declares must count as the code moving"
+        finally:
+            config.apply(config.DEFAULTS)
+
+
 def test_a_repo_that_asked_for_git_and_HAS_none_is_told_so():
     # The silent case, and the worst one: `git.commit` is set, there is no repository
     # under the tree, and the write reaches the disk with nothing said. That is the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@appchy/jarvis",
-  "version": "0.1.39",
+  "version": "0.1.40",
   "description": "Jarvis \u2014 local AI coding assistant CLI",
   "private": false,
   "type": "module",