@appchy/jarvis 0.1.78 → 0.1.79

package/dist/bin.js

@@ -10110,7 +10110,7 @@ import { createRequire as createRequire2 } from "module";
 var _require = createRequire2(import.meta.url);
 var VERSION2 = _require("../package.json").version ?? "0.0.0";
 var IS_DEV = String(_require("../package.json").name ?? "").endsWith("-dev");
-var SHA = "8edf530";
+var SHA = "8992daf";
 var BUILT = "2026-09-10";
 var BUILD = SHA ?? "source";
 var BUILD_LABEL = `${SHA ? `${VERSION2} (${SHA}${BUILT ? ` ${BUILT}` : ""})` : `${VERSION2} (source)`}${IS_DEV ? " \u2014 development build" : ""}`;

package/harness/harness/gate.py

@@ -608,6 +608,33 @@ def gate(root, task, accept: str = "", owner: str = "") -> list:
             elif not head and when != date.today().isoformat():
                 reasons.append(f"verify last passed on {when}, not today, and there "
                                f"is no git sha to pin it to — re-run it")
+
+        # …and that the code ARRIVED, which is the other half and was missing.
+        # Everything above reads COMMITTED history, so it proves the code moved
+        # FORWARD PAST the evidence and never that it got there at all. A task can
+        # be green with its whole implementation in one working tree; three were,
+        # for as long as ten days, and the only commits around them were
+        # `docs(work):` ones, which look exactly like a healthy board.
+        #
+        # It refuses rather than warns because the gates RAN AGAINST THE WORKING
+        # TREE. If that tree is not what is in git, the evidence and the commit it
+        # is pinned to describe different code, and calling that shipped is the
+        # false claim this whole file exists to prevent.
+        #
+        # The harness names the files and stops there: committing somebody's source
+        # is a far larger claim on their repo than committing the board, and a board
+        # write deliberately leaves a session's own code alone (founder, 2026-09-10).
+        loose = git.uncommitted_code(root.parent) if git.enabled() else []
+        if loose:
+            shown = ", ".join(loose[:5])
+            more = f" and {len(loose) - 5} more" if len(loose) > 5 else ""
+            reasons.append(
+                f"{len(loose)} uncommitted change(s) outside the board — the gates "
+                f"ran against this working tree, so completing now would record "
+                f"shipped for code no commit contains: {shown}{more}. Commit them "
+                f"(or stash or gitignore what is not this task's), then re-run "
+                f"`jarvis work verify --task {task.name}` — committing moves HEAD, "
+                f"so the evidence has to be taken on the tree that shipped.")
     else:
         reasons.append("no `verify` commands configured — an unconfigured repo "
                        "cannot prove anything, so nothing in it can complete. Set "

package/harness/harness/git.py

@@ -95,6 +95,47 @@ def enabled() -> bool:
     return bool(GIT.get("commit"))
 
 
+def uncommitted_code(repo) -> list:
+    """Everything outside the board that is not in git yet, sorted.
+
+    The mirror of `changed`, and the completion gate's half of it. `changed` asks
+    what a board write would CARRY; this asks what a completion would LEAVE BEHIND.
+
+    **Why this is accuracy rather than caution.** A verify run executes the
+    configured commands against the WORKING TREE, so a pass means "these gates pass
+    here, now". It is then recorded against HEAD. If anything outside the board
+    differs from HEAD, those two are statements about different trees, and the
+    board ends up saying shipped about code no commit contains. Measured three
+    times, once on the task whose entire subject was the harness losing what it is
+    trusted to keep — it completed with 7/7 gates recorded twice and none of its
+    fix in HEAD.
+
+    Untracked files count, and they are the important half: the lost work's own
+    shape was NEW files git had never heard of. Anything gitignored never appears
+    here, so a scratch directory somebody has already told git to ignore is not
+    this check's business.
+
+    Claims and the run file are excluded for the reason they are never committed —
+    they are one machine's coordination, true for minutes.
+    """
+    board = [r.rstrip("/") for r in (GIT.get("paths") or [])]
+    code, out, _ = _git(repo, "status", "--porcelain", "-z",
+                        "--untracked-files=all", "--no-renames")
+    if code != 0:
+        return []
+    found = []
+    for entry in out.split("\0"):
+        if len(entry) <= 3:
+            continue
+        p = entry[3:]
+        if Path(p).name in LOCAL:
+            continue
+        if any(p == r or p.startswith(f"{r}/") for r in board):
+            continue
+        found.append(p)
+    return sorted(found)
+
+
 def machine() -> str:
     """Which machine acted. `WORK_MACHINE` where something knows a better name for
     this box than its hostname — a daemon that already has an identity for it —

package/harness/test_work.py

@@ -3444,6 +3444,145 @@ def test_a_board_write_reaches_the_ORIGIN_not_just_the_disk():
             config.apply(config.DEFAULTS)
 
 
+def _provable_task(repo, name="alpha"):
+    """A task in a git-mode repo with everything but the code committed: criteria
+    ticked and a passing verify recorded, so the ONLY thing a gate can hold on is
+    whether the implementation reached git."""
+    e = repo / "work" / "versions" / "01-a-cut" / "an-epic"
+    (e / "in-progress" / name).mkdir(parents=True)
+    (e / "epic.md").write_text("---\ntype: epic\n---\n\n# E\n")
+    (e.parent / "version.md").write_text(
+        "---\ncreated: 2026-08-01\norder: 1\noutcome: x\n---\n\n# Cut\n")
+    (e / "in-progress" / name / "task.md").write_text(
+        f"---\npriority: P0\n---\n\n# {name}\n\n## Acceptance criteria\n\n- [x] it works\n")
+    _git(repo, "add", "-A")
+    _git(repo, "commit", "-qm", "the board so far")
+    return e
+
+
+def test_completing_refuses_while_the_code_is_only_in_the_working_tree():
+    # Every other check in the gate reads COMMITTED history, so all of them prove
+    # the code moved FORWARD PAST the evidence and none proves it arrived. Three
+    # tasks completed green with their whole implementation in one working tree —
+    # one of them the task about the harness losing what it is trusted to keep,
+    # with 7/7 recorded twice and none of its fix in HEAD.
+    with tempfile.TemporaryDirectory() as tmp:
+        try:
+            repo = _git_repo(tmp, push=False)
+            e = _provable_task(repo)
+            with _work_dir(str(repo / "work")) as root:
+                old, gate.VERIFY = gate.VERIFY, {"tests": "true"}
+                try:
+                    assert gate.cmd_verify({"task": "alpha"}) == 0
+                    # Clean tree: nothing left to hold, so the gate is satisfied.
+                    assert gate.gate(root, model.locate(root, "alpha")) == []
+
+                    # Now the failure this exists for — the implementation exists
+                    # and is in no commit. An UNTRACKED file, because that is the
+                    # lost work's own shape: new files git had never heard of.
+                    (repo / "src").mkdir()
+                    (repo / "src" / "shipped.ts").write_text("export const it = 1;\n")
+                    reasons = gate.gate(root, model.locate(root, "alpha"))
+                    assert any("uncommitted" in r for r in reasons), reasons
+                    assert any("src/shipped.ts" in r for r in reasons), reasons
+
+                    # And the move itself refuses, leaving the task where it was —
+                    # warning after moving is what made the board say done anyway.
+                    assert task.cmd_move({"name": "alpha", "status": "complete",
+                                          "delivered": "it ships",
+                                          "not-included": "nothing"}) == 1
+                    assert (e / "in-progress" / "alpha").is_dir()
+
+                    # Committing satisfies THIS check and trips the older one, and
+                    # that is the flow rather than a snag: committing moves HEAD, so
+                    # evidence taken before it describes a different commit. The two
+                    # together mean commit, then verify, then complete — and the
+                    # refusal says so rather than leaving it to be discovered.
+                    _git(repo, "add", "-A")
+                    _git(repo, "commit", "-qm", "the code")
+                    reasons = gate.gate(root, model.locate(root, "alpha"))
+                    assert not any("uncommitted" in r for r in reasons), reasons
+                    assert any("code moved since verify" in r for r in reasons), reasons
+
+                    assert gate.cmd_verify({"task": "alpha"}) == 0
+                    assert gate.gate(root, model.locate(root, "alpha")) == []
+                finally:
+                    gate.VERIFY = old
+        finally:
+            config.apply(config.DEFAULTS)
+
+
+def test_partly_committed_code_is_still_uncommitted_code():
+    # What `the-hub-says-why-a-write-failed` actually was: part of its work in HEAD
+    # and part not. A check that asked "did anything land" would have passed it.
+    with tempfile.TemporaryDirectory() as tmp:
+        try:
+            repo = _git_repo(tmp, push=False)
+            _provable_task(repo)
+            (repo / "src").mkdir()
+            (repo / "src" / "landed.ts").write_text("export const a = 1;\n")
+            _git(repo, "add", "-A")
+            _git(repo, "commit", "-qm", "half of it")
+            (repo / "src" / "left-behind.ts").write_text("export const b = 2;\n")
+            with _work_dir(str(repo / "work")) as root:
+                old, gate.VERIFY = gate.VERIFY, {"tests": "true"}
+                try:
+                    assert gate.cmd_verify({"task": "alpha"}) == 0
+                    reasons = gate.gate(root, model.locate(root, "alpha"))
+                    assert any("src/left-behind.ts" in r for r in reasons), reasons
+                finally:
+                    gate.VERIFY = old
+        finally:
+            config.apply(config.DEFAULTS)
+
+
+def test_a_repo_that_never_asked_for_git_completes_exactly_as_before():
+    # The harness is shared with repos that opted out of all of this. Refusing on
+    # their working tree would be a new claim on somebody who asked for none.
+    with tempfile.TemporaryDirectory() as tmp:
+        try:
+            repo = _git_repo(tmp, push=False)
+            _provable_task(repo)
+            (repo / "src").mkdir()
+            (repo / "src" / "shipped.ts").write_text("export const it = 1;\n")
+            config.apply({**config.DEFAULTS,
+                          "git": {"commit": False, "push": False,
+                                  "remote": "origin", "paths": ["work"]}})
+            with _work_dir(str(repo / "work")) as root:
+                old, gate.VERIFY = gate.VERIFY, {"tests": "true"}
+                try:
+                    assert gate.cmd_verify({"task": "alpha"}) == 0
+                    assert gate.gate(root, model.locate(root, "alpha")) == []
+                finally:
+                    gate.VERIFY = old
+        finally:
+            config.apply(config.DEFAULTS)
+
+
+def test_a_gitignored_scratch_file_is_not_this_gates_business():
+    # The cost of refusing is that loose files block completion, and the escape is
+    # the one people already use. A file git has been told to ignore never reaches
+    # the check at all.
+    with tempfile.TemporaryDirectory() as tmp:
+        try:
+            repo = _git_repo(tmp, push=False)
+            _provable_task(repo)
+            (repo / ".gitignore").write_text("scratch/\n")
+            _git(repo, "add", "-A")
+            _git(repo, "commit", "-qm", "ignore scratch")
+            (repo / "scratch").mkdir()
+            (repo / "scratch" / "notes.md").write_text("thinking out loud\n")
+            with _work_dir(str(repo / "work")) as root:
+                old, gate.VERIFY = gate.VERIFY, {"tests": "true"}
+                try:
+                    assert gate.cmd_verify({"task": "alpha"}) == 0
+                    assert gate.gate(root, model.locate(root, "alpha")) == []
+                finally:
+                    gate.VERIFY = old
+        finally:
+            config.apply(config.DEFAULTS)
+
+
 def test_the_commit_trailer_names_the_item_the_event_and_the_machine():
     # Four other pieces of work read this format, so it is asserted rather than
     # assumed. Who, when and which branch stay OUT of it — git knows them, and a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@appchy/jarvis",
-  "version": "0.1.78",
+  "version": "0.1.79",
   "description": "Jarvis — local AI coding assistant CLI",
   "private": false,
   "type": "module",
@@ -65,8 +65,8 @@
     "@jarvis/rpc": "1.0.0",
     "@jarvis/types": "1.0.0",
     "@jarvis/typescript-config": "1.0.0",
-    "@jarvis/vitest-config": "1.0.0",
-    "@jarvis/ui": "0.1.0"
+    "@jarvis/ui": "0.1.0",
+    "@jarvis/vitest-config": "1.0.0"
   },
   "scripts": {
     "dev": "tsx watch src/bin.ts start --foreground",