@appchy/jarvis 0.1.77 → 0.1.79

package/harness/harness/gate.py

@@ -384,12 +384,19 @@ def _results_out(data) -> list:
             for r in (data.get("results") or [])]
 
 
-def _verify_async(root, name) -> int:
-    """Start the gates, or say where the run already in flight has got to.
-
-    One call with three answers, because a verify takes minutes and a relayed tool
-    call cannot. Which answer comes back is never the caller's to choose: it is
-    whatever is true about this checkout right now.
+def _verify_report(root, name) -> int:
+    """Say where the run stands. **Never starts one.**
+
+    ASKING AND STARTING ARE TWO OPERATIONS, and they used to be one call whose
+    meaning depended on timing: it attached when a run was in flight and started
+    one when none was. So a session checking whether the gates had finished set a
+    four-minute build going by asking — which is how a repo with a shared build
+    directory raced itself, and the resulting corruption was read as a flaky gate
+    for three sessions.
+
+    The split is on this side rather than the other because THIS is the call that
+    gets repeated. Polling is the loop; starting happens once and is said out
+    loud. A caller that repeats itself must be unable to cause anything.
     """
     running = live_run(root)
     if running:
@@ -424,6 +431,31 @@ def _verify_async(root, name) -> int:
              "done": done.get("done") or [], "passed": bool(done.get("passed")),
              "commit": done.get("sha") or "", "results": _results_out(done)})
 
+    return _answer(
+        "idle",
+        f"No gates have run for '{name or 'no task'}' at this commit. Start them "
+        f"explicitly — asking never starts a run.",
+        {"gates": sorted(VERIFY)})
+
+
+def _verify_start(root, name) -> int:
+    """Start the gates in the background. **Never reports on somebody else's run.**
+
+    Refuses when a run is in flight rather than quietly attaching to it. Attaching
+    is what let one call report a run started for a DIFFERENT task, whose verdict
+    would then have been read against this one's commit — measured 2026-09-09.
+    A refusal that names the task holding the checkout is the honest answer, and
+    the report door is one call away.
+    """
+    running = live_run(root)
+    if running:
+        return _answer(
+            "running", _busy(running),
+            {"gate": running.get("current") or "starting",
+             "elapsedSeconds": _elapsed(running),
+             "gates": running.get("gates") or [], "done": running.get("done") or [],
+             "results": _results_out(running)})
+
     child = subprocess.Popen(
         [sys.executable, os.path.abspath(sys.argv[0]), "verify", "--task", name,
          "--detached"],
@@ -432,17 +464,24 @@ def _verify_async(root, name) -> int:
     return _answer(
         "started",
         f"Gates started ({len(VERIFY)}): {', '.join(sorted(VERIFY))}. They take "
-        f"minutes, not seconds — ask again for progress, and again for the result.",
+        f"minutes, not seconds — ask for progress, which never starts another.",
         {"gates": sorted(VERIFY)})
 
 
 def cmd_verify(args) -> int:
     """Execute the verify commands and RECORD the result against the task.
 
-    Three doors onto one run. Blocking is the person's and is unchanged. `--async`
-    is the tool surface's, because a call that takes 174 seconds cannot be a relayed
-    round trip. `--detached` is the child the second one starts and is nobody's to
-    type.
+    Four doors, and **asking is not one of the ones that starts anything.**
+    Blocking is the person's: typing the command is the explicit act, so it runs
+    the gates and prints the table. `--async` starts a background run for the tool
+    surface, because a call that takes 174 seconds cannot be a relayed round trip.
+    `--status` only reports, and is what a caller waiting for a result uses.
+    `--detached` is the child `--async` spawns and is nobody's to type.
+
+    The two used to be one call that started or attached depending on timing, and
+    the ambiguity cost more than it saved: a session polling for a result started
+    the run it was waiting for, and one call attached to a run belonging to
+    another task and would have reported that verdict here.
     """
     root = find_work_root()
     name = (args.get("task") or "").strip()
@@ -456,16 +495,17 @@ def cmd_verify(args) -> int:
         _execute(root, name)
         return 0
 
+    if args.get("status"):
+        return _verify_report(root, name)
+
+    if args.get("async"):
+        return _verify_start(root, name)
+
     running = live_run(root)
     if running:
-        if args.get("async"):
-            return _verify_async(root, name)
         print(f"error: {_busy(running)}", file=sys.stderr)
         return 1
 
-    if args.get("async"):
-        return _verify_async(root, name)
-
     results, ok, sha = _execute(root, name)
     _print_report(results, sha)
     if name:
@@ -568,6 +608,33 @@ def gate(root, task, accept: str = "", owner: str = "") -> list:
             elif not head and when != date.today().isoformat():
                 reasons.append(f"verify last passed on {when}, not today, and there "
                                f"is no git sha to pin it to — re-run it")
+
+        # …and that the code ARRIVED, which is the other half and was missing.
+        # Everything above reads COMMITTED history, so it proves the code moved
+        # FORWARD PAST the evidence and never that it got there at all. A task can
+        # be green with its whole implementation in one working tree; three were,
+        # for as long as ten days, and the only commits around them were
+        # `docs(work):` ones, which look exactly like a healthy board.
+        #
+        # It refuses rather than warns because the gates RAN AGAINST THE WORKING
+        # TREE. If that tree is not what is in git, the evidence and the commit it
+        # is pinned to describe different code, and calling that shipped is the
+        # false claim this whole file exists to prevent.
+        #
+        # The harness names the files and stops there: committing somebody's source
+        # is a far larger claim on their repo than committing the board, and a board
+        # write deliberately leaves a session's own code alone (founder, 2026-09-10).
+        loose = git.uncommitted_code(root.parent) if git.enabled() else []
+        if loose:
+            shown = ", ".join(loose[:5])
+            more = f" and {len(loose) - 5} more" if len(loose) > 5 else ""
+            reasons.append(
+                f"{len(loose)} uncommitted change(s) outside the board — the gates "
+                f"ran against this working tree, so completing now would record "
+                f"shipped for code no commit contains: {shown}{more}. Commit them "
+                f"(or stash or gitignore what is not this task's), then re-run "
+                f"`jarvis work verify --task {task.name}` — committing moves HEAD, "
+                f"so the evidence has to be taken on the tree that shipped.")
     else:
         reasons.append("no `verify` commands configured — an unconfigured repo "
                        "cannot prove anything, so nothing in it can complete. Set "

package/harness/harness/git.py

@@ -95,6 +95,47 @@ def enabled() -> bool:
     return bool(GIT.get("commit"))
 
 
+def uncommitted_code(repo) -> list:
+    """Everything outside the board that is not in git yet, sorted.
+
+    The mirror of `changed`, and the completion gate's half of it. `changed` asks
+    what a board write would CARRY; this asks what a completion would LEAVE BEHIND.
+
+    **Why this is accuracy rather than caution.** A verify run executes the
+    configured commands against the WORKING TREE, so a pass means "these gates pass
+    here, now". It is then recorded against HEAD. If anything outside the board
+    differs from HEAD, those two are statements about different trees, and the
+    board ends up saying shipped about code no commit contains. Measured three
+    times, once on the task whose entire subject was the harness losing what it is
+    trusted to keep — it completed with 7/7 gates recorded twice and none of its
+    fix in HEAD.
+
+    Untracked files count, and they are the important half: the lost work's own
+    shape was NEW files git had never heard of. Anything gitignored never appears
+    here, so a scratch directory somebody has already told git to ignore is not
+    this check's business.
+
+    Claims and the run file are excluded for the reason they are never committed —
+    they are one machine's coordination, true for minutes.
+    """
+    board = [r.rstrip("/") for r in (GIT.get("paths") or [])]
+    code, out, _ = _git(repo, "status", "--porcelain", "-z",
+                        "--untracked-files=all", "--no-renames")
+    if code != 0:
+        return []
+    found = []
+    for entry in out.split("\0"):
+        if len(entry) <= 3:
+            continue
+        p = entry[3:]
+        if Path(p).name in LOCAL:
+            continue
+        if any(p == r or p.startswith(f"{r}/") for r in board):
+            continue
+        found.append(p)
+    return sorted(found)
+
+
 def machine() -> str:
     """Which machine acted. `WORK_MACHINE` where something knows a better name for
     this box than its hostname — a daemon that already has an identity for it —

package/harness/test_work.py

@@ -2799,6 +2799,83 @@ def test_a_verify_run_is_visible_to_the_next_caller():
                 gate.VERIFY = old
 
 
+def _said(capsys_free_call) -> dict:
+    """The JSON one of the async doors printed, as a dict."""
+    import io
+    from contextlib import redirect_stdout
+
+    buf = io.StringIO()
+    with redirect_stdout(buf):
+        capsys_free_call()
+    for line in reversed(buf.getvalue().splitlines()):
+        if line.strip().startswith("{"):
+            return json.loads(line)
+    raise AssertionError(f"no JSON on stdout: {buf.getvalue()!r}")
+
+
+def test_asking_where_the_gates_stand_never_starts_them():
+    # Asking and starting used to be ONE call whose meaning depended on timing, so a
+    # session polling for a result set off the four-minute run it was waiting for.
+    # Polling is the loop and starting happens once, so the repeatable call is the
+    # one that has to be unable to cause anything.
+    with tempfile.TemporaryDirectory() as tmp:
+        v = _tree(tmp)
+        e = _epic(v, "an-epic")
+        _task(e / "in-progress", "alpha", body="# T\n")
+        with _work_dir(tmp) as root:
+            old, gate.VERIFY = gate.VERIFY, {"tests": "true"}
+            try:
+                out = _said(lambda: gate.cmd_verify({"task": "alpha", "status": True}))
+                assert out["state"] == "idle", out
+                # The real assertion: nothing ran, and nothing is running.
+                assert gate.read_run(root) is None, "asking wrote a run file"
+                assert gate.live_run(root) is None
+            finally:
+                gate.VERIFY = old
+
+
+def test_starting_while_a_run_is_live_names_whose_it_is_rather_than_attaching():
+    # Attaching is what let one call report a run started for a DIFFERENT task,
+    # whose verdict would then have been read against this one's commit.
+    with tempfile.TemporaryDirectory() as tmp:
+        v = _tree(tmp)
+        e = _epic(v, "an-epic")
+        _task(e / "in-progress", "alpha", body="# T\n")
+        _task(e / "in-progress", "beta", body="# T\n")
+        with _work_dir(tmp) as root:
+            old, gate.VERIFY = gate.VERIFY, {"tests": "true"}
+            try:
+                gate._write_run(root, {"task": "alpha", "pid": os.getpid(),
+                                       "machine": "here", "started": gate._now().isoformat(),
+                                       "gates": ["tests"], "current": "tests", "done": [],
+                                       "finished": None, "read": False})
+                out = _said(lambda: gate.cmd_verify({"task": "beta", "async": True}))
+                assert out["state"] == "running", out
+                assert "alpha" in out["message"], out["message"]
+            finally:
+                gate.VERIFY = old
+
+
+def test_a_finished_run_for_another_task_is_not_handed_over_as_this_ones():
+    # The wrong-verdict half. A result proven for one item says nothing about
+    # another, and reporting it would put a green gate on work nobody ran.
+    with tempfile.TemporaryDirectory() as tmp:
+        v = _tree(tmp)
+        e = _epic(v, "an-epic")
+        _task(e / "in-progress", "alpha", body="# T\n")
+        _task(e / "in-progress", "beta", body="# T\n")
+        with _work_dir(tmp) as root:
+            old, gate.VERIFY = gate.VERIFY, {"tests": "true"}
+            try:
+                gate.cmd_verify({"task": "alpha"})
+                assert gate.read_run(root)["passed"] is True
+                out = _said(lambda: gate.cmd_verify({"task": "beta", "status": True}))
+                assert out["state"] == "idle", out
+                assert out["passed"] is False, out
+            finally:
+                gate.VERIFY = old
+
+
 def test_a_second_verify_is_refused_while_one_is_running():
     with tempfile.TemporaryDirectory() as tmp:
         v = _tree(tmp)
@@ -3367,6 +3444,145 @@ def test_a_board_write_reaches_the_ORIGIN_not_just_the_disk():
             config.apply(config.DEFAULTS)
 
 
+def _provable_task(repo, name="alpha"):
+    """A task in a git-mode repo with everything but the code committed: criteria
+    ticked and a passing verify recorded, so the ONLY thing a gate can hold on is
+    whether the implementation reached git."""
+    e = repo / "work" / "versions" / "01-a-cut" / "an-epic"
+    (e / "in-progress" / name).mkdir(parents=True)
+    (e / "epic.md").write_text("---\ntype: epic\n---\n\n# E\n")
+    (e.parent / "version.md").write_text(
+        "---\ncreated: 2026-08-01\norder: 1\noutcome: x\n---\n\n# Cut\n")
+    (e / "in-progress" / name / "task.md").write_text(
+        f"---\npriority: P0\n---\n\n# {name}\n\n## Acceptance criteria\n\n- [x] it works\n")
+    _git(repo, "add", "-A")
+    _git(repo, "commit", "-qm", "the board so far")
+    return e
+
+
+def test_completing_refuses_while_the_code_is_only_in_the_working_tree():
+    # Every other check in the gate reads COMMITTED history, so all of them prove
+    # the code moved FORWARD PAST the evidence and none proves it arrived. Three
+    # tasks completed green with their whole implementation in one working tree —
+    # one of them the task about the harness losing what it is trusted to keep,
+    # with 7/7 recorded twice and none of its fix in HEAD.
+    with tempfile.TemporaryDirectory() as tmp:
+        try:
+            repo = _git_repo(tmp, push=False)
+            e = _provable_task(repo)
+            with _work_dir(str(repo / "work")) as root:
+                old, gate.VERIFY = gate.VERIFY, {"tests": "true"}
+                try:
+                    assert gate.cmd_verify({"task": "alpha"}) == 0
+                    # Clean tree: nothing left to hold, so the gate is satisfied.
+                    assert gate.gate(root, model.locate(root, "alpha")) == []
+
+                    # Now the failure this exists for — the implementation exists
+                    # and is in no commit. An UNTRACKED file, because that is the
+                    # lost work's own shape: new files git had never heard of.
+                    (repo / "src").mkdir()
+                    (repo / "src" / "shipped.ts").write_text("export const it = 1;\n")
+                    reasons = gate.gate(root, model.locate(root, "alpha"))
+                    assert any("uncommitted" in r for r in reasons), reasons
+                    assert any("src/shipped.ts" in r for r in reasons), reasons
+
+                    # And the move itself refuses, leaving the task where it was —
+                    # warning after moving is what made the board say done anyway.
+                    assert task.cmd_move({"name": "alpha", "status": "complete",
+                                          "delivered": "it ships",
+                                          "not-included": "nothing"}) == 1
+                    assert (e / "in-progress" / "alpha").is_dir()
+
+                    # Committing satisfies THIS check and trips the older one, and
+                    # that is the flow rather than a snag: committing moves HEAD, so
+                    # evidence taken before it describes a different commit. The two
+                    # together mean commit, then verify, then complete — and the
+                    # refusal says so rather than leaving it to be discovered.
+                    _git(repo, "add", "-A")
+                    _git(repo, "commit", "-qm", "the code")
+                    reasons = gate.gate(root, model.locate(root, "alpha"))
+                    assert not any("uncommitted" in r for r in reasons), reasons
+                    assert any("code moved since verify" in r for r in reasons), reasons
+
+                    assert gate.cmd_verify({"task": "alpha"}) == 0
+                    assert gate.gate(root, model.locate(root, "alpha")) == []
+                finally:
+                    gate.VERIFY = old
+        finally:
+            config.apply(config.DEFAULTS)
+
+
+def test_partly_committed_code_is_still_uncommitted_code():
+    # What `the-hub-says-why-a-write-failed` actually was: part of its work in HEAD
+    # and part not. A check that asked "did anything land" would have passed it.
+    with tempfile.TemporaryDirectory() as tmp:
+        try:
+            repo = _git_repo(tmp, push=False)
+            _provable_task(repo)
+            (repo / "src").mkdir()
+            (repo / "src" / "landed.ts").write_text("export const a = 1;\n")
+            _git(repo, "add", "-A")
+            _git(repo, "commit", "-qm", "half of it")
+            (repo / "src" / "left-behind.ts").write_text("export const b = 2;\n")
+            with _work_dir(str(repo / "work")) as root:
+                old, gate.VERIFY = gate.VERIFY, {"tests": "true"}
+                try:
+                    assert gate.cmd_verify({"task": "alpha"}) == 0
+                    reasons = gate.gate(root, model.locate(root, "alpha"))
+                    assert any("src/left-behind.ts" in r for r in reasons), reasons
+                finally:
+                    gate.VERIFY = old
+        finally:
+            config.apply(config.DEFAULTS)
+
+
+def test_a_repo_that_never_asked_for_git_completes_exactly_as_before():
+    # The harness is shared with repos that opted out of all of this. Refusing on
+    # their working tree would be a new claim on somebody who asked for none.
+    with tempfile.TemporaryDirectory() as tmp:
+        try:
+            repo = _git_repo(tmp, push=False)
+            _provable_task(repo)
+            (repo / "src").mkdir()
+            (repo / "src" / "shipped.ts").write_text("export const it = 1;\n")
+            config.apply({**config.DEFAULTS,
+                          "git": {"commit": False, "push": False,
+                                  "remote": "origin", "paths": ["work"]}})
+            with _work_dir(str(repo / "work")) as root:
+                old, gate.VERIFY = gate.VERIFY, {"tests": "true"}
+                try:
+                    assert gate.cmd_verify({"task": "alpha"}) == 0
+                    assert gate.gate(root, model.locate(root, "alpha")) == []
+                finally:
+                    gate.VERIFY = old
+        finally:
+            config.apply(config.DEFAULTS)
+
+
+def test_a_gitignored_scratch_file_is_not_this_gates_business():
+    # The cost of refusing is that loose files block completion, and the escape is
+    # the one people already use. A file git has been told to ignore never reaches
+    # the check at all.
+    with tempfile.TemporaryDirectory() as tmp:
+        try:
+            repo = _git_repo(tmp, push=False)
+            _provable_task(repo)
+            (repo / ".gitignore").write_text("scratch/\n")
+            _git(repo, "add", "-A")
+            _git(repo, "commit", "-qm", "ignore scratch")
+            (repo / "scratch").mkdir()
+            (repo / "scratch" / "notes.md").write_text("thinking out loud\n")
+            with _work_dir(str(repo / "work")) as root:
+                old, gate.VERIFY = gate.VERIFY, {"tests": "true"}
+                try:
+                    assert gate.cmd_verify({"task": "alpha"}) == 0
+                    assert gate.gate(root, model.locate(root, "alpha")) == []
+                finally:
+                    gate.VERIFY = old
+        finally:
+            config.apply(config.DEFAULTS)
+
+
 def test_the_commit_trailer_names_the_item_the_event_and_the_machine():
     # Four other pieces of work read this format, so it is asserted rather than
     # assumed. Who, when and which branch stay OUT of it — git knows them, and a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@appchy/jarvis",
-  "version": "0.1.77",
+  "version": "0.1.79",
   "description": "Jarvis — local AI coding assistant CLI",
   "private": false,
   "type": "module",
@@ -57,15 +57,15 @@
     "typescript": "^5.7.0",
     "vitest": "^2.1.0",
     "@jarvis/agents": "1.0.0",
+    "@jarvis/anthropic": "1.0.0",
+    "@jarvis/board": "0.1.0",
     "@jarvis/data": "0.1.0",
     "@jarvis/errors": "1.0.0",
-    "@jarvis/board": "0.1.0",
     "@jarvis/logger": "1.0.0",
     "@jarvis/rpc": "1.0.0",
     "@jarvis/types": "1.0.0",
     "@jarvis/typescript-config": "1.0.0",
     "@jarvis/ui": "0.1.0",
-    "@jarvis/anthropic": "1.0.0",
     "@jarvis/vitest-config": "1.0.0"
   },
   "scripts": {