@arjunkhera/atlas 0.3.48 → 0.3.50

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "atlas",
-  "version": "0.3.48",
+  "version": "0.3.50",
   "description": "Atlas: the delivery lifecycle, its crews and the Atlas tools, for any repository.",
   "author": {
     "name": "Arjun Khera"

package/door/cli.mjs

@@ -17,7 +17,7 @@ import { readFileSync, existsSync, realpathSync } from 'node:fs';
 import { spawnSync } from 'node:child_process';
 import { open } from './lib/pull-request.mjs';
 import { write as writeTooling, changes as toolingChanges, ToolingRefusal, CHECK_PATH, WORKFLOW_PATH } from './lib/tooling.mjs';
-import { status, statusMany } from './lib/status.mjs';
+import { statusMany, copies } from './lib/status.mjs';
 import { drift, kindsFromRegistry, fileKind } from './lib/kind-drift.mjs';
 import { scan, toText, verdict, CHECK_VERSION, SPECS } from '../shape/check.mjs';
 import { packagePackageVersion } from './lib/releases.mjs';
@@ -35,6 +35,7 @@ import { sweepCommand as testsSweep, coversCommand as testsCovers } from '../tes
 import { issuesCommand as testsIssues } from './lib/issues.mjs';
 import { changedCommand as testsChanged } from './lib/changed-tests.mjs';
 import { beforeCommand as testsBefore } from './lib/fails-before.mjs';
+import { afterCommand as testsAfter } from './lib/passes-after.mjs';
 import { upkeepCommand } from './lib/upkeep.mjs';
 import { gateCommand } from './lib/gate.mjs';
 import { judgeCommand } from './lib/judge.mjs';
@@ -49,6 +50,8 @@ const HELP = `atlas — the door into a repo's Atlas files
       --replace-unknown                also replace a copy that is in no release
       --workflow                       rewrite only the workflow, for a repo whose check is current
   atlas status --root <repo>           is the repo's check current, behind, unknown or missing
+      --all                            every Atlas copy in the repo: the check, its workflow, each test kit, each pinned Atlas version
+      --json                           print the rows as JSON: type, path, state, have, want, why
   atlas kind-drift --root <repo> --record-kind <kinds>
                                        does atlas.yaml agree with the repo record
   atlas check --root <repo>            run the repo shape check here
@@ -95,6 +98,11 @@ const HELP = `atlas — the door into a repo's Atlas files
       --old <file> --new <file>        read the two run files and give the answer; runs nothing
       --out <file>                     write the JSON here; default the terminal
       --text                           print a short table instead of the JSON
+  atlas tests after --root <repo> --base <ref>   the old version of each changed or removed test case must pass on the new code; exit 1 when one goes to the owner
+      --head <ref>                     the head of the pull request; default HEAD
+      --list <file>                    a changed-test list from atlas tests changed; default the command makes it
+      --out <file>                     write the JSON here; default the terminal
+      --text                           print a short table instead of the JSON
   atlas tests named --root <area>      list the assertions that a pull request names
       --base <ref>                     the base: an assertion is named when its words changed or it is new
       --covers                         also name the assertions of a scenario whose covers path the change touches
@@ -161,7 +169,7 @@ A person merges every file the tooling writer writes.
 // skipped the privacy filter and printed GREEN (review of PR #107).
 export const FLAGS = Object.freeze({
   tooling: { root: 'optional', branch: 'optional', 'replace-unknown': 'switch', workflow: 'switch', 'dry-run': 'switch' },
-  status: { root: 'optional' },
+  status: { root: 'optional', all: 'switch', json: 'switch' },
   'kind-drift': { root: 'optional', 'record-kind': 'value', registry: 'value', repo: 'value' },
   check: { root: 'optional', repo: 'value', 'fail-on': 'value' },
   ste: { share: 'switch', terms: 'value' },
@@ -244,6 +252,7 @@ function toolingCommand(chosen) {
 
 function statusCommand(chosen) {
   const roots = chosen._.slice(1).length ? chosen._.slice(1).map((one) => resolve(one)) : [rootOf(chosen)];
+  if (chosen.all || chosen.json) return copiesCommand(roots, { all: Boolean(chosen.all), json: Boolean(chosen.json) });
   const rows = statusMany(roots, PACKAGE_ROOT);
   for (const row of rows) {
     line(`${row.state.toUpperCase().padEnd(8)} ${row.root}`);
@@ -256,6 +265,29 @@ function statusCommand(chosen) {
   return rows.some((row) => row.state === 'behind') ? 1 : 0;
 }
 
+// One row for each Atlas copy (roadmap item R19). Exit 1 when a copy is
+// behind or broken, so a watcher can act on the exit alone.
+function copiesCommand(roots, { all, json }) {
+  const repos = roots.map((root) => copies({ root, packageRoot: PACKAGE_ROOT, all }));
+  const decided = `Decided by the release lists in Atlas ${ATLAS_VERSION}, never by git history or the network.`;
+  if (json) {
+    line(JSON.stringify({ atlas: ATLAS_VERSION, decided_by: decided, repos }, null, 2));
+  } else {
+    for (const repo of repos) {
+      line(repo.root);
+      for (const one of repo.rows) {
+        line(`  ${one.state.toUpperCase().padEnd(8)} ${one.type.padEnd(8)} ${one.path}`);
+        line(`           have ${one.have ?? '—'} · want ${one.want}`);
+        if (one.state !== 'current' || one.have !== one.want) line(`           ${one.why}`);
+      }
+      line('');
+    }
+    line(decided);
+  }
+  const bad = all ? ['behind', 'broken'] : ['behind'];
+  return repos.some((repo) => repo.rows.some((one) => bad.includes(one.state))) ? 1 : 0;
+}
+
 function kindDriftCommand(chosen) {
   const root = rootOf(chosen);
   let recordKind = chosen['record-kind'] ?? null;
@@ -366,6 +398,7 @@ async function testsCommand(chosen) {
   if (what === 'proof') return testsProof({ run: chosen.run, own: chosen.own, evidence: chosen.evidence, base: chosen.base, covers: Boolean(chosen.covers) }, root, line);
   if (what === 'verdict') return testsVerdict({ run: chosen.run, base: chosen.base, evidence: chosen.evidence, covers: Boolean(chosen.covers) }, root, line);
   if (what === 'changed') return testsChanged({ base: chosen.base, head: chosen.head, out: chosen.out, text: Boolean(chosen.text) }, root, line);
+  if (what === 'after') return testsAfter({ base: chosen.base, head: chosen.head, list: chosen.list, out: chosen.out, text: Boolean(chosen.text) }, root, line);
   if (what === 'before') return testsBefore({ base: chosen.base, head: chosen.head, list: chosen.list, out: chosen.out, side: chosen.side, old: chosen.old, new: chosen.new, text: Boolean(chosen.text) }, root, line);
   if (what === 'named') return testsNamed({ base: chosen.base, covers: Boolean(chosen.covers) }, root, line);
   if (what === 'sweep') return testsSweep({ evidence: chosen.evidence, since: chosen.since, base: chosen.base, out: chosen.out, text: Boolean(chosen.text) }, root, line);
@@ -373,7 +406,7 @@ async function testsCommand(chosen) {
   if (what === 'kept') return (await runKept({ root, evidenceDir: chosen.evidence, only: chosen.scenario ?? null, write: (text) => process.stdout.write(text) })).exit;
   if (what === 'rerun') return testsRerun({ run: chosen.run, evidence: chosen.evidence, tests: chosen.tests, language: chosen.language ?? 'javascript' }, root, line);
   if (what === 'issues') return testsIssues({ findings: chosen.findings, repo: chosen.repo, max: chosen.max, bot: chosen.bot, dryRun: Boolean(chosen['dry-run']), args: [...chosen._, ...Object.values(chosen).filter((v) => typeof v === 'string')] }, line);
-  throw new Error(`there is no tests verb "${what ?? ''}". Use check, write, proof, verdict, named, changed, before, sweep, covers, kept, issues or rerun.`);
+  throw new Error(`there is no tests verb "${what ?? ''}". Use check, write, proof, verdict, named, changed, before, after, sweep, covers, kept, issues or rerun.`);
 }
 
 function upkeepVerb(chosen) {

package/door/lib/fails-before.mjs

@@ -19,7 +19,8 @@
 // Green does not mean proven: the gate counts only `proven` cases (proven_count).
 // The command runs head code. It holds no secret: each run gets a fixed environment and nothing else.
 // In CI each side runs in its own job on a fresh runner (--side old, --side new), and a third job
-// reads both run files (--old, --new) with the base copy of Atlas. Each tree comes from git archive.
+// reads both run files (--old, --new) with the base copy of Atlas. Each tree comes from git archive,
+// and then becomes a new git repo with one commit, so a test that needs git still runs.
 import { spawnSync } from 'node:child_process';
 import { existsSync, mkdirSync, readFileSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
@@ -50,11 +51,31 @@ export function runnerOf(path) {
   return null;
 }
 
-// Skips a string, a template string or a comment at `i`. Returns the index after it, or `i`.
+// A slash starts a regular expression when the code before it cannot end a value.
+function regexAt(src, i) {
+  let j = i - 1;
+  while (j >= 0 && /\s/.test(src[j])) j -= 1;
+  if (j < 0 || '(,=:[!&|?{};+-*%<>~^'.includes(src[j])) return true;
+  const word = /([A-Za-z_$][\w$]*)$/.exec(src.slice(Math.max(0, j - 10), j + 1));
+  return Boolean(word && ['return', 'typeof', 'case', 'in', 'of', 'void', 'delete', 'throw', 'yield', 'await'].includes(word[1]));
+}
+
+// Skips a string, a template string, a regular expression or a comment at `i`. Returns the index
+// after it, or `i`.
 function skip(src, i) {
   const c = src[i];
   if (c === '/' && src[i + 1] === '/') { const end = src.indexOf('\n', i); return end < 0 ? src.length : end; }
   if (c === '/' && src[i + 1] === '*') { const end = src.indexOf('*/', i + 2); if (end < 0) throw new Error('open comment'); return end + 2; }
+  if (c === '/' && regexAt(src, i)) {
+    let inClass = false;
+    for (let j = i + 1; j < src.length && src[j] !== '\n'; j += 1) {
+      if (src[j] === '\\') { j += 1; continue; }
+      if (src[j] === '[') inClass = true;
+      else if (src[j] === ']') inClass = false;
+      else if (src[j] === '/' && !inClass) { j += 1; while (/[a-z]/.test(src[j] ?? '')) j += 1; return j; }
+    }
+    throw new Error('open regular expression');
+  }
   if (c === '"' || c === "'" || c === '`') {
     for (let j = i + 1; j < src.length; j += 1) {
       if (src[j] === '\\') { j += 1; continue; }
@@ -67,8 +88,7 @@ function skip(src, i) {
   return i;
 }
 
-// The index after the bracket that closes the one at `open`. A regular expression is read as code,
-// so a bracket inside one can end a case early; then the text still differs where the case differs.
+// The index after the bracket that closes the one at `open`.
 function close(src, open) {
   const pair = { '(': ')', '{': '}', '[': ']' };
   const stack = [];
@@ -86,6 +106,19 @@ function close(src, open) {
   throw new Error('open bracket');
 }
 
+// The fixed name of a string at `i`, with its escapes read. null for a template with a ${…} in it.
+function nameAt(src, i) {
+  const raw = src.slice(i + 1, skip(src, i) - 1);
+  if (src[i] === '`' && /(^|[^\\])\$\{/.test(raw)) return null;
+  const named = { n: '\n', t: '\t', r: '\r', b: '\b', f: '\f', v: '\v', 0: '\0' };
+  return raw.replace(/\\(u\{[0-9a-fA-F]+\}|u[0-9a-fA-F]{4}|x[0-9a-fA-F]{2}|\n|.)/g, (_, e) => {
+    if (e[0] === 'u' && e.length > 1) return String.fromCodePoint(parseInt(e.replace(/[u{}]/g, ''), 16));
+    if (e[0] === 'x' && e.length === 3) return String.fromCharCode(parseInt(e.slice(1), 16));
+    if (e === '\n') return '';
+    return named[e] ?? e;
+  });
+}
+
 // The test cases of one file: { cases: Map of name to its text, rest, duplicates }. `rest` is the
 // text outside every case, so an edit there (a beforeEach, a shared value) can mark every case.
 // null when the file cannot be read to the end. JavaScript: each test(…) or it(…) call whose first
@@ -111,13 +144,24 @@ export function casesOf(text, path) {
         i = j - 1;
       }
     } else {
-      const call = /(?<![\w.$])(test|it)(\.(?:only|skip|todo))?\(\s*(["'`])([^"'`\n]*)\3/g;
+      const call = /(?<![\w.$])(test|it)(\.(?:only|skip|todo))?\(\s*(?=["'`])/g;
       let m;
       let from = 0;
+      // scan walks the code up to each match, so a test( inside a string or a comment is no case.
+      let scan = 0;
       while ((m = call.exec(src))) {
         if (m.index < from) continue;
+        if (scan < from) scan = from;
+        while (scan < m.index) {
+          const after = skip(src, scan);
+          if (after === scan) scan += 1;
+          else scan = after;
+        }
+        if (scan > m.index) { call.lastIndex = scan; continue; }
+        const name = nameAt(src, m.index + m[0].length);
+        if (name === null) continue;
         const end = close(src, src.indexOf('(', m.index));
-        add(m[4], src.slice(m.index, end));
+        add(name, src.slice(m.index, end));
         rest.push(src.slice(from, m.index));
         from = end;
         call.lastIndex = end;
@@ -217,12 +261,13 @@ export function runEnv(work) {
   return { PATH: process.env.PATH ?? '/usr/bin:/bin', HOME: join(work, 'home'), TMPDIR: join(work, 'tmp'), TZ: 'UTC', LANG: 'C.UTF-8', CI: 'true' };
 }
 
-const commandOf = (runner, file, report) => (runner === 'node'
+export const commandOf = (runner, file, report) => (runner === 'node'
   ? ['node', '--test', '--test-reporter=junit', `--test-reporter-destination=${report}`, file]
   : ['python3', '-B', '-m', 'pytest', '-p', 'no:cacheprovider', '-q', `--junitxml=${report}`, file]);
 
-// A fresh tree of `sha` at `tree`, from git archive: no .git, so a test cannot read which commit it is.
-function freshTree(top, tree, sha) {
+// A fresh tree of `sha` at `tree`, from git archive: no .git of the repo, so a test cannot read which
+// commit it is. gitTree then gives it a .git of its own.
+export function freshTree(top, tree, sha) {
   rmSync(tree, { recursive: true, force: true });
   mkdirSync(tree, { recursive: true });
   const archive = spawnSync('git', ['archive', '--format=tar', sha], { cwd: top, maxBuffer: 1024 * 1024 * 1024 });
@@ -232,6 +277,16 @@ function freshTree(top, tree, sha) {
   if (existsSync(join(top, 'node_modules')) && !existsSync(join(tree, 'node_modules'))) symlinkSync(join(top, 'node_modules'), join(tree, 'node_modules'), 'dir');
 }
 
+// Makes the tree a new git repo with one commit of its files, so a test that needs git runs. The
+// commit has a fixed author, date and message, so it holds no history and names neither real commit.
+export function gitTree(tree) {
+  const env = { PATH: process.env.PATH ?? '/usr/bin:/bin', HOME: tree, GIT_CONFIG_NOSYSTEM: '1', GIT_AUTHOR_NAME: 'atlas', GIT_AUTHOR_EMAIL: 'atlas@invalid', GIT_COMMITTER_NAME: 'atlas', GIT_COMMITTER_EMAIL: 'atlas@invalid', GIT_AUTHOR_DATE: '2000-01-01T00:00:00Z', GIT_COMMITTER_DATE: '2000-01-01T00:00:00Z' };
+  for (const args of [['init', '-q', '-b', 'main'], ['add', '-A'], ['commit', '-q', '--no-verify', '--no-gpg-sign', '-m', 'tree']]) {
+    const r = spawnSync('git', args, { cwd: tree, env, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
+    if (r.status !== 0) throw new Error(`git ${args[0]} in the run tree failed: ${String(r.stderr).trim().split('\n')[0]}`);
+  }
+}
+
 // Runs one side: `old` (the merge base with the head's test files) or `new` (the head).
 // Returns the run file: { side, merge_base, head, tree, report, env, files: { path: { command, cases, why } } }.
 export function runSide({ top, changed, plans, side, work = join(tmpdir(), 'atlas-before') }) {
@@ -255,6 +310,7 @@ export function runSide({ top, changed, plans, side, work = join(tmpdir(), 'atla
           writeFileSync(join(tree, r.path), bytes);
         }
       }
+      gitTree(tree);
       for (const dir of ['home', 'tmp', 'report']) { rmSync(join(work, dir), { recursive: true, force: true }); mkdirSync(join(work, dir), { recursive: true }); }
       const command = commandOf(p.runner, p.path, report);
       if (python && p.runner === 'pytest' && spawnSync('python3', ['-B', '-c', 'import pytest'], { cwd: tree, env }).status !== 0) {

package/door/lib/passes-after.mjs

@@ -0,0 +1,212 @@
+// `atlas tests after`: the base version of each changed, renamed or removed test case runs on the
+// head code (roadmap R73, tracker item 29e1f17d; design docs/design-docs/passes-after/).
+//
+// It reads the changed-test list (changed-tests.mjs) and takes each unit test file that the pull
+// request changes, renames or removes. It makes a tree of the head, puts in the base copy of each
+// such file and the base copy of the test helpers, runner configs and kit manifests, and runs the
+// old file there. So the old tests judge the new code.
+//
+//   the old case on the new code   the case in the PR   result
+//   pass                           changed or renamed   cleared
+//   any other                      changed or renamed   owner: changed test   (red)
+//   pass                           removed              removed, passes      (for the review job)
+//   any other                      removed              owner: removed test  (red)
+//   did not run or skipped         any                  not run              (not cleared)
+//
+// The command takes no card and no model verdict, so neither can clear a case. It runs head code
+// with the environment, the tree and the runners of fails-before, and it holds no secret.
+import { spawnSync } from 'node:child_process';
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { listChanged } from './changed-tests.mjs';
+import { casesOf, commandOf, freshTree, gitTree, readReport, runEnv, runnerOf } from './fails-before.mjs';
+
+export const VERSION = 1;
+
+const TEST_GROUPS = new Set(['unit-test', 'check-block', 'scenario-words', 'test-helper', 'runner-config', 'test-script', 'kit-manifest']);
+const SUPPORT = new Set(['test-helper', 'runner-config', 'kit-manifest']);
+const isProduct = (path) => !/^(docs|archive)\//.test(path) && !/^[^/]+\.md$/i.test(path);
+export const OWNER_RESULTS = Object.freeze(['owner: changed test', 'owner: removed test']);
+
+function git(cwd, args, { allowFail = false, buffer = false } = {}) {
+  const r = spawnSync('git', args, { cwd, encoding: buffer ? 'buffer' : 'utf8', maxBuffer: 256 * 1024 * 1024 });
+  if (r.error) throw new Error(`git cannot run: ${r.error.message}`);
+  if (r.status !== 0) {
+    if (allowFail) return null;
+    throw new Error(`git ${args.join(' ')} failed: ${String(r.stderr || r.stdout || '').trim().split('\n')[0]}`);
+  }
+  return r.stdout;
+}
+const usage = (message) => Object.assign(new Error(message), { usage: true });
+
+// The text of a case with its own name taken out, so a case renamed with the same body matches.
+const unnamed = (text, name) => text.split(name).join('\u0000');
+
+// The old cases of one file that the head changed, renamed or removed.
+export function oldCases(before, after) {
+  if (before === null) return { all: true, picked: [] };
+  if (after === null || before.rest !== after.rest) {
+    return { all: true, picked: [...before.cases.keys()].map((name) => ({ name, change: after?.cases.has(name) ? 'changed' : 'removed', to: null })) };
+  }
+  const picked = [];
+  const taken = new Set();
+  for (const [name, text] of before.cases) {
+    if (after.cases.has(name)) {
+      if (after.cases.get(name) !== text) picked.push({ name, change: 'changed', to: null });
+      continue;
+    }
+    const to = [...after.cases].find(([n, t]) => !before.cases.has(n) && !taken.has(n) && unnamed(t, n) === unnamed(text, name))?.[0];
+    if (to) { taken.add(to); picked.push({ name, change: 'renamed', to }); } else picked.push({ name, change: 'removed', to: null });
+  }
+  return { all: false, picked };
+}
+
+// What to run: for each changed, renamed or removed unit test file, the base path and its old cases.
+export function plan({ root, base, head = 'HEAD', list = null }) {
+  if (!base && !list) throw usage('give the base: --base <ref>');
+  const top = git(resolve(root), ['rev-parse', '--show-toplevel']).trim();
+  const changed = list ? JSON.parse(readFileSync(resolve(list), 'utf8')) : listChanged({ root: top, base, head });
+  if (changed.changed_tests !== 1) throw new Error(`the changed-test list has version ${changed.changed_tests}; this command reads version 1`);
+  const show = (sha, path) => git(top, ['show', `${sha}:${path}`], { allowFail: true });
+  const files = [];
+  const plans = [];
+  for (const r of changed.rows.filter((x) => x.group === 'check-block' && x.status !== 'added')) {
+    const path = r.from ?? r.path;
+    if (!files.some((f) => f.path === path)) files.push({ path, runner: null, result: 'not run', why: 'a scenario test needs its environment; the planted-fault procedure covers it' });
+  }
+  for (const r of changed.rows.filter((x) => x.group === 'unit-test' && x.status !== 'added')) {
+    const path = r.from ?? r.path;
+    const runner = runnerOf(path);
+    const before = casesOf(show(changed.merge_base, path), path);
+    const after = r.status === 'removed' ? { cases: new Map(), rest: before?.rest ?? '', duplicates: new Set() } : casesOf(show(changed.head, r.path), r.path);
+    const { all, picked } = oldCases(before, after);
+    if (!picked.length && !all) continue;
+    if (!runner) { files.push({ path, runner: null, result: 'not run', why: 'no runner for this file yet' }); plans.push({ path, runner: null, picked, all }); continue; }
+    files.push({ path, runner, result: 'ran', why: null });
+    plans.push({ path, runner, picked, all, head: r.status === 'removed' ? null : r.path });
+  }
+  files.sort((x, y) => (x.path < y.path ? -1 : 1));
+  return {
+    top, changed, files, plans,
+    productChanged: changed.other_paths.some(isProduct),
+    testsChanged: changed.rows.some((x) => TEST_GROUPS.has(x.group)),
+  };
+}
+
+// Puts the base copy of a path into the tree.
+function putBase(top, tree, sha, path) {
+  const bytes = git(top, ['show', `${sha}:${path}`], { allowFail: true, buffer: true });
+  if (bytes === null) return;
+  mkdirSync(dirname(join(tree, path)), { recursive: true });
+  writeFileSync(join(tree, path), bytes);
+}
+
+// Runs the old version of each planned file on a tree of the head. Returns { tree, report, env, files }.
+export function runOld({ top, changed, plans, work = join(tmpdir(), 'atlas-after') }) {
+  const tree = join(work, 'repo');
+  const report = join(work, 'report', 'report.xml');
+  const env = runEnv(work);
+  const out = { tree, report, env, files: {} };
+  try {
+    for (const p of plans.filter((x) => x.runner)) {
+      // A fresh tree, home and report folder for each file, so no file of one run reaches the next.
+      freshTree(top, tree, changed.head);
+      for (const r of changed.rows.filter((x) => SUPPORT.has(x.group) && x.status !== 'added')) putBase(top, tree, changed.merge_base, r.from ?? r.path);
+      for (const r of changed.rows.filter((x) => x.group === 'unit-test' && x.status !== 'added')) {
+        // A renamed file runs at its old path only, so no case runs twice.
+        if (r.status === 'renamed') rmSync(join(tree, r.path), { force: true });
+        putBase(top, tree, changed.merge_base, r.from ?? r.path);
+      }
+      gitTree(tree);
+      for (const dir of ['home', 'tmp', 'report']) { rmSync(join(work, dir), { recursive: true, force: true }); mkdirSync(join(work, dir), { recursive: true }); }
+      const command = commandOf(p.runner, p.path, report);
+      if (p.runner === 'pytest' && spawnSync('python3', ['-B', '-c', 'import pytest'], { cwd: tree, env }).status !== 0) {
+        out.files[p.path] = { command, cases: null, why: 'pytest is not installed', none: true };
+        continue;
+      }
+      const r = spawnSync(command[0] === 'node' ? process.execPath : command[0], command.slice(1), { cwd: tree, env, encoding: 'utf8', timeout: 10 * 60 * 1000, killSignal: 'SIGKILL', maxBuffer: 64 * 1024 * 1024 });
+      let cases = null;
+      let why = null;
+      if (r.error) why = `the runner did not finish: ${r.error.message}`;
+      else if (!existsSync(report)) why = `the runner wrote no report (exit ${r.status})`;
+      else {
+        try { cases = Object.fromEntries(readReport(readFileSync(report, 'utf8'))); } catch (error) { why = `the report does not read: ${error.message}`; }
+      }
+      out.files[p.path] = { command, cases, why };
+    }
+  } finally {
+    rmSync(tree, { recursive: true, force: true });
+  }
+  return out;
+}
+
+export function resultOf(change, after) {
+  if (after === 'skipped' || after === null) return 'not run';
+  if (change === 'removed') return after === 'pass' ? 'removed, passes' : 'owner: removed test';
+  return after === 'pass' ? 'cleared' : 'owner: changed test';
+}
+
+// The answer, from the plan and the run.
+export function answerOf(prepared, run) {
+  const { changed, files, plans, productChanged, testsChanged } = prepared;
+  const answer = { passes_after: VERSION, base: changed.base, merge_base: changed.merge_base, head: changed.head, product_changed: productChanged, tests_changed: testsChanged, red: false, owner_count: 0, files: files.map((f) => ({ ...f })), cases: [], env: run?.env ?? null };
+  for (const p of plans) {
+    const ran = run?.files[p.path];
+    const file = answer.files.find((f) => f.path === p.path);
+    if (ran?.none) Object.assign(file, { result: 'not run', why: ran.why });
+    else if (ran?.why) file.why = ran.why;
+    const results = ran && !ran.none ? (ran.cases ?? {}) : null;
+    const picked = [...p.picked];
+    // A file that cannot be read to the end: every case of its report counts as changed.
+    if (p.all && results) for (const name of Object.keys(results)) if (!picked.some((c) => c.name === name)) picked.push({ name, change: 'changed', to: null });
+    if (!picked.length) {
+      answer.cases.push({ path: p.path, name: null, change: 'changed', to: null, after: results ? 'missing' : null, result: results ? 'owner: changed test' : 'not run' });
+      continue;
+    }
+    for (const c of picked) {
+      const after = results ? (results[c.name] ?? 'missing') : null;
+      answer.cases.push({ path: p.path, name: c.name, change: c.change, to: c.to, after, result: resultOf(c.change, after) });
+    }
+  }
+  answer.cases.sort((x, y) => (x.path === y.path ? String(x.name).localeCompare(String(y.name)) : x.path < y.path ? -1 : 1));
+  answer.owner_count = answer.cases.filter((c) => OWNER_RESULTS.includes(c.result)).length;
+  answer.red = answer.owner_count > 0;
+  return answer;
+}
+
+export function passesAfter({ root, base, head = 'HEAD', list = null, work = join(tmpdir(), 'atlas-after') }) {
+  const prepared = plan({ root, base, head, list });
+  return answerOf(prepared, prepared.plans.length ? runOld({ ...prepared, work }) : null);
+}
+
+// ---------------------------------------------------------------- the command
+
+const oneLine = (text) => String(text ?? '').replace(/[\u0000-\u001f\u007f]/g, ' ');
+
+export function renderText(a) {
+  const ran = a.files.filter((f) => f.result === 'ran').length;
+  const out = [`passes-after against ${oneLine(a.base)} (merge base ${a.merge_base.slice(0, 7)}): ${a.cases.length} old case(s) in ${ran} file(s); ${a.owner_count} for the owner; tests changed: ${a.tests_changed ? 'yes' : 'no'}`];
+  for (const c of a.cases) out.push(`  ${c.result.padEnd(20)} ${oneLine(c.path)}  ${oneLine(c.name ?? '(the whole file)')}${c.to ? `  (renamed to: ${oneLine(c.to)})` : ''}`);
+  for (const f of a.files.filter((x) => x.result === 'not run')) out.push(`  ${'not run'.padEnd(20)} ${oneLine(f.path)}  ${oneLine(f.why)}`);
+  for (const f of a.files.filter((x) => x.result === 'ran' && x.why)) out.push(`  ${'note'.padEnd(20)} ${oneLine(f.path)}  ${oneLine(f.why)}`);
+  if (a.red) out.push(`RED: ${a.owner_count} case(s) for the owner. Only the owner clears a changed test that fails on the new code.`);
+  else if (!a.tests_changed) out.push('GREEN: the pull request changes no test.');
+  else if (a.cases.some((c) => c.result === 'not run')) out.push(`GREEN with gaps: ${a.cases.filter((c) => c.result === 'not run').length} old case(s) did not run, so they are not cleared.`);
+  else out.push('GREEN: each old case that the pull request changed still passes on the new code.');
+  return out;
+}
+
+export function afterCommand({ base, head, list, out, text = false }, root, line) {
+  try {
+    const answer = passesAfter({ root, base, head: head ?? 'HEAD', list });
+    const json = `${JSON.stringify(answer, null, 2)}\n`;
+    if (out) writeFileSync(resolve(out), json);
+    else if (!text) process.stdout.write(json);
+    if (text) for (const l of renderText(answer)) line(l);
+    return answer.red ? 1 : 0;
+  } catch (error) {
+    line(`after: ${error.message}`);
+    return error.usage ? 2 : 1;
+  }
+}

package/door/lib/status.mjs

@@ -13,10 +13,12 @@
 //
 // CI never makes this judgement. A check with no network cannot learn the
 // package's list. This runs in a session, with the package on disk.
-import { readFileSync, existsSync } from 'node:fs';
-import { join } from 'node:path';
-import { CHECK_PATH, checkStamps, sha256 } from '../../shape/check.mjs';
-import { packagedCheck, placeOf } from './releases.mjs';
+import { readFileSync, existsSync, readdirSync, lstatSync } from 'node:fs';
+import { join, relative, sep } from 'node:path';
+import { CHECK_PATH, WORKFLOW_PATH, WORKFLOW_TEMPLATE, checkStamps, sha256 } from '../../shape/check.mjs';
+import { packagedCheck, placeOf, packagePackageVersion } from './releases.mjs';
+import { currentKitHash, KIT_RELEASES_FILE, KIT_TARGET, MANIFEST } from './tests.mjs';
+import { kitHashOf } from '../../tests/link-check.mjs';
 
 export const STATES = Object.freeze(['current', 'behind', 'unknown', 'missing']);
 
@@ -45,3 +47,220 @@ export function status({ root, packageRoot }) {
 export function statusMany(roots, packageRoot) {
   return roots.map((root) => { try { return status({ root, packageRoot }); } catch (error) { return { root, state: 'unknown', why: error.message, packaged: null, copy: null }; } });
 }
+
+// ---------------------------------------------------------------------------
+// Every Atlas copy in a repository, and the age of each one (roadmap item
+// R19, slice 0 of the routines design). The check is one copy of four types:
+//
+//   check     .github/atlas/check.mjs, by the release list of the check
+//   workflow  .github/workflows/atlas-check.yml, by the workflow fingerprint
+//             in each row of that list
+//   kit       each <area>/test/atlas/, by its manifest and the kit list
+//   pin       an Atlas version written in a workflow, a script or package.json
+//
+// Each row has have, want and state. A copy that cannot be read is broken,
+// never missing. Like the check alone, every answer comes from the lists this
+// package carries, never from git history or the network.
+export const COPY_STATES = Object.freeze(['current', 'behind', 'unknown', 'missing', 'broken']);
+export const COPY_TYPES = Object.freeze(['check', 'workflow', 'kit', 'pin']);
+
+const posix = (path) => path.split(sep).join('/');
+const SKIP = new Set(['node_modules', '.git']);
+const MAX_DEPTH = 8;
+const MAX_PIN_FILE = 512 * 1024;
+
+const row = (type, path, state, have, want, why) => ({ type, path, state, have, want, why });
+const broken = (type, path, want, error) => row(type, path, 'broken', null, want, `it cannot be read: ${error.message}`);
+// A link is never read. A link at a copy's path, even one that points
+// nowhere, is a copy that cannot be read: broken, never missing.
+const linkAt = (full) => { try { return lstatSync(full).isSymbolicLink(); } catch { return false; } };
+const linked = (type, path, want) => row(type, path, 'broken', null, want, `${path} is a link. Atlas never reads a copy through a link. Replace it with a plain file or folder.`);
+
+function checkRow(root, packageRoot) {
+  const pkg = packagedCheck(packageRoot);
+  const want = `check version ${checkStamps(pkg.text).check_version}`;
+  if (linkAt(join(root, CHECK_PATH))) return linked('check', CHECK_PATH, want);
+  let answer;
+  try { answer = status({ root, packageRoot }); } catch (error) { return broken('check', CHECK_PATH, want, error); }
+  const have = answer.copy ? (answer.state === 'unknown' ? `sha256 ${answer.copy.sha256.slice(0, 12)}…` : `check version ${answer.copy.check_version}`) : null;
+  return row('check', CHECK_PATH, answer.state, have, want, answer.why);
+}
+
+// The workflow is written with the check, from the WORKFLOW_TEMPLATE of that
+// check. Each row of the release list keeps the fingerprint of its template.
+function workflowRow(root, packageRoot) {
+  const pkg = packagedCheck(packageRoot);
+  const version = checkStamps(pkg.text).check_version;
+  const want = `workflow of check version ${version}`;
+  const full = join(root, WORKFLOW_PATH);
+  if (linkAt(full)) return linked('workflow', WORKFLOW_PATH, want);
+  if (!existsSync(full)) return row('workflow', WORKFLOW_PATH, 'missing', null, want, `${WORKFLOW_PATH} does not exist in this repo, so its check never runs in CI. "atlas tooling pr" adds it.`);
+  let text;
+  try { text = readFileSync(full, 'utf8'); } catch (error) { return broken('workflow', WORKFLOW_PATH, want, error); }
+  const fingerprint = sha256(text);
+  if (fingerprint === sha256(WORKFLOW_TEMPLATE)) return row('workflow', WORKFLOW_PATH, 'current', want, want, 'the workflow is the one this package writes.');
+  const rows = pkg.releases.filter((one) => one.workflow_sha256 === fingerprint);
+  if (rows.length) {
+    const newest = rows.at(-1);
+    return row('workflow', WORKFLOW_PATH, 'behind', `workflow of check version ${newest.check_version}`, want, `the workflow was first written by Atlas ${rows[0].first_package}. "atlas tooling pr --workflow" refreshes it.`);
+  }
+  return row('workflow', WORKFLOW_PATH, 'unknown', `sha256 ${fingerprint.slice(0, 12)}…`, want, `the workflow is in no release. Someone edited it, or it came from an unreleased package. "atlas tooling pr" shows the difference.`);
+}
+
+// A walk never follows a link and never enters node_modules or .git. The
+// visit sees a link as a link, and says which other folders it enters: it
+// returns false to stop.
+function walk(dir, visit, depth = 0) {
+  if (depth > MAX_DEPTH) return;
+  let names;
+  try { names = readdirSync(dir).sort(); } catch { return; }
+  for (const name of names) {
+    if (SKIP.has(name)) continue;
+    const full = join(dir, name);
+    let stat;
+    try { stat = lstatSync(full); } catch { continue; }
+    if (visit(full, name, stat) === false) continue;
+    if (stat.isDirectory()) walk(full, visit, depth + 1);
+  }
+}
+
+// Each <area>/test/atlas/ folder, where "atlas tests write" puts the kit. A
+// dot folder holds no area: the check's base tree is one.
+function kitFolders(root) {
+  const found = [];
+  const [parent, leaf] = KIT_TARGET.split('/');
+  walk(root, (full, name, stat) => {
+    const isKit = name === leaf && full.split(sep).at(-2) === parent;
+    if (isKit && stat.isSymbolicLink()) { found.push(full); return false; }
+    if (!stat.isDirectory() || name.startsWith('.')) return false;
+    if (isKit) { found.push(full); return false; }
+    return true;
+  });
+  return found;
+}
+
+function kitFilesOnDisk(dir, prefix = '') {
+  const out = [];
+  for (const name of readdirSync(dir).sort()) {
+    if (name === '__pycache__') continue;
+    const full = join(dir, name);
+    const stat = lstatSync(full);
+    if (stat.isDirectory()) out.push(...kitFilesOnDisk(full, `${prefix}${name}/`));
+    else out.push({ path: `${prefix}${name}`, full, link: stat.isSymbolicLink() });
+  }
+  return out;
+}
+
+function kitRow(root, dir, ctx) {
+  const path = `${posix(relative(root, dir))}/`;
+  const area = posix(relative(root, join(dir, '..', '..'))) || '.';
+  const want = `kit of Atlas ${ctx.version}`;
+  const refresh = `"atlas tests write --root ${area}" refreshes it.`;
+  if (linkAt(dir)) return linked('kit', path, want);
+  try {
+    const manifestPath = join(dir, MANIFEST);
+    if (!existsSync(manifestPath)) return row('kit', path, 'broken', null, want, `the kit has no ${MANIFEST}, so its age cannot be read. ${refresh}`);
+    let manifest;
+    try { manifest = JSON.parse(readFileSync(manifestPath, 'utf8')); } catch { return row('kit', path, 'broken', null, want, `${MANIFEST} is not JSON, so the kit's age cannot be read. ${refresh}`); }
+    const listed = manifest?.files;
+    if (!listed || typeof listed !== 'object' || Array.isArray(listed)) return row('kit', path, 'broken', null, want, `${MANIFEST} lists no files, so the kit's age cannot be read. ${refresh}`);
+    const have = `kit of Atlas ${typeof manifest.atlas === 'string' ? manifest.atlas : '?'}`;
+    const onDisk = kitFilesOnDisk(dir).filter((one) => one.path !== MANIFEST);
+    const edited = [];
+    for (const one of onDisk) {
+      if (one.link || !Object.hasOwn(listed, one.path) || sha256(readFileSync(one.full)) !== listed[one.path]) edited.push(one.path);
+    }
+    const present = new Set(onDisk.map((one) => one.path));
+    for (const listedPath of Object.keys(listed)) if (!present.has(listedPath)) edited.push(listedPath);
+    if (edited.length) return row('kit', path, 'unknown', have, want, `${edited.length} file(s) differ from ${MANIFEST}: ${edited.slice(0, 3).join(', ')}. Someone edited the kit. ${refresh}`);
+    const hash = kitHashOf(listed);
+    if (hash === ctx.kitHash) return row('kit', path, 'current', have, want, `the kit is the one this package ships${have === want ? '' : '; only its version label is older'}.`);
+    const first = ctx.kitReleases.get(hash);
+    if (first) return row('kit', path, 'behind', have, want, `the kit was first shipped in Atlas ${first}. ${refresh}`);
+    return row('kit', path, 'unknown', have, want, `the kit is in no release. It came from an unreleased package, or someone edited its ${MANIFEST}. ${refresh}`);
+  } catch (error) {
+    return broken('kit', path, want, error);
+  }
+}
+
+// A version number compared part by part: -1, 0 or 1.
+function compare(a, b) {
+  const [x, y] = [a, b].map((one) => one.split('.').map(Number));
+  for (let index = 0; index < 3; index += 1) if (x[index] !== y[index]) return x[index] < y[index] ? -1 : 1;
+  return 0;
+}
+
+const escape = (text) => text.replace(/[.*+?^${}()|[\]\\/]/g, '\\$&');
+
+// The places a repo writes an Atlas version: the workflows and actions under
+// .github/, the scripts under scripts/, and package.json. A tag such as
+// "latest", or a version held in a variable, is no pin.
+function pinFiles(root) {
+  const files = [];
+  for (const top of ['.github', 'scripts']) {
+    const dir = join(root, top);
+    if (!existsSync(dir)) continue;
+    walk(dir, (full, name, stat) => {
+      if (stat.isFile() && stat.size <= MAX_PIN_FILE && posix(relative(root, full)) !== CHECK_PATH) files.push(full);
+      return stat.isDirectory();
+    });
+  }
+  const manifest = join(root, 'package.json');
+  if (existsSync(manifest)) files.push(manifest);
+  return files;
+}
+
+function pinRows(root, ctx) {
+  const name = escape(ctx.name);
+  const patterns = [
+    new RegExp(`${name}@(\\d+\\.\\d+\\.\\d+)\\b`, 'g'),
+    new RegExp(`"${name}"\\s*:\\s*"[~^=]?(\\d+\\.\\d+\\.\\d+)"`, 'g'),
+    /\bATLAS_VERSION\s*[:=]\s*["']?(\d+\.\d+\.\d+)\b/g,
+  ];
+  const rows = [];
+  for (const full of pinFiles(root)) {
+    const file = posix(relative(root, full));
+    let text;
+    try { text = readFileSync(full, 'utf8'); } catch (error) { rows.push(broken('pin', file, ctx.version, error)); continue; }
+    text.split('\n').forEach((line, index) => {
+      const seen = new Set();
+      for (const pattern of patterns) {
+        for (const match of line.matchAll(pattern)) {
+          if (seen.has(match[1])) continue;
+          seen.add(match[1]);
+          const at = `${file}:${index + 1}`;
+          const order = compare(match[1], ctx.version);
+          if (order === 0) rows.push(row('pin', at, 'current', match[1], ctx.version, 'the pin names the version of this package.'));
+          else if (order < 0) rows.push(row('pin', at, 'behind', match[1], ctx.version, `the pin names Atlas ${match[1]}, and this package is ${ctx.version}. Move the pin in this line.`));
+          else rows.push(row('pin', at, 'unknown', match[1], ctx.version, `the pin names Atlas ${match[1]}, which is newer than this package. Upgrade Atlas to judge it.`));
+        }
+      }
+    });
+  }
+  return rows;
+}
+
+function kitReleases(packageRoot) {
+  const file = join(packageRoot, KIT_RELEASES_FILE);
+  if (!existsSync(file)) return new Map();
+  return new Map((JSON.parse(readFileSync(file, 'utf8')).releases ?? []).map((one) => [String(one.kit_sha256), String(one.first_package)]));
+}
+
+// One row for each Atlas copy in the repository. With all false, only the
+// check, which is what "atlas status" answered before --all.
+export function copies({ root, packageRoot, all = true }) {
+  const version = packagePackageVersion(packageRoot);
+  const rows = [checkRow(root, packageRoot)];
+  if (all) {
+    const ctx = {
+      version,
+      name: JSON.parse(readFileSync(join(packageRoot, 'package.json'), 'utf8')).name,
+      kitHash: currentKitHash(packageRoot),
+      kitReleases: kitReleases(packageRoot),
+    };
+    rows.push(workflowRow(root, packageRoot));
+    for (const dir of kitFolders(root)) rows.push(kitRow(root, dir, ctx));
+    rows.push(...pinRows(root, ctx));
+  }
+  return { root, atlas: version, rows };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arjunkhera/atlas",
-  "version": "0.3.48",
+  "version": "0.3.50",
   "description": "Atlas: the delivery lifecycle, its crews and the Atlas tools, as a Claude Code plugin for any repository.",
   "type": "module",
   "license": "UNLICENSED",

package/shape/releases.json

@@ -1,30 +1,35 @@
 {
-  "note": "Every copy of shape/check.mjs a release of Atlas has shipped. The last row is the check this package ships. atlas status reads this list; git history is never read.",
+  "note": "Every copy of shape/check.mjs a release of Atlas has shipped. The last row is the check this package ships. workflow_sha256 is the fingerprint of the workflow that check writes (its WORKFLOW_TEMPLATE). atlas status reads this list; git history is never read.",
   "releases": [
     {
       "check_version": 1,
       "sha256": "3dfd659a7533c51dce11bd0e2d7a9312f041c5955d45ac3cc67d3e29d328b5d2",
-      "first_package": "0.1.1"
+      "first_package": "0.1.1",
+      "workflow_sha256": "a463b58c30d5d7b1de27b5c7c145dd86d6ea58356ab83d9e6ddc62705902299e"
     },
     {
       "check_version": 2,
       "sha256": "a4bc5ab8c75be8f216d460df9233670f5ba4ed9d853236f6b55a7f0d10dfe293",
-      "first_package": "0.2.0"
+      "first_package": "0.2.0",
+      "workflow_sha256": "b333b57c016791e2b77f983f6fe70c9aaf50f5f6fca28b7b9ca84c222dd7b7e1"
     },
     {
       "check_version": 3,
       "sha256": "0184db66fd5d5061c21ee7d2d88395b5bac64ab1308e02e06781e6015f3d7608",
-      "first_package": "0.3.0"
+      "first_package": "0.3.0",
+      "workflow_sha256": "b69efaac2a3e52368ae5e7d7a33e1c88c6c7a7efa6fc1846844f79f9432ecd7d"
     },
     {
       "check_version": 4,
       "sha256": "3357ea247694634c3535998368683eceffaf863221dee5fec9e43a03042afb95",
-      "first_package": "0.3.36"
+      "first_package": "0.3.36",
+      "workflow_sha256": "b69efaac2a3e52368ae5e7d7a33e1c88c6c7a7efa6fc1846844f79f9432ecd7d"
     },
     {
       "check_version": 5,
       "sha256": "8f36633fe693ebf7a7cc0f7237d49eb4720f67d371d4758d556bab51965ec334",
-      "first_package": "0.3.48"
+      "first_package": "0.3.48",
+      "workflow_sha256": "b69efaac2a3e52368ae5e7d7a33e1c88c6c7a7efa6fc1846844f79f9432ecd7d"
     }
   ]
 }

package/skills/lead/SKILL.md

@@ -96,12 +96,12 @@ set. A test keeps the two lists equal.
 | `atlas upgrade` | When the owner asks to upgrade Atlas. Call the `atlas_upgrade` tool instead: the Bash sandbox blocks this command. Run the command by hand only where that tool is missing. In a cloud session, call the tool with `check: true` at the first reply, as section 7 says |
 | `atlas doctor` | When Atlas seems missing or broken in a session |
 | `atlas check` | Before you ask for a merge in a repo that has the shape check |
-| `atlas status` | To learn whether a repo's check is current or behind |
+| `atlas status` | To learn whether a repo's check is current or behind. `atlas status --all --json <repo>` lists each Atlas copy in a repo, with have, want and state |
 | `atlas tooling` | When `atlas status` says behind; `pr` opens the pull request |
 | `atlas kind-drift` | When the repo record and `atlas.yaml` may disagree on the kind; this command retires in stage 2, the onboarding stage |
 | `atlas code-read` | To resolve the citations of a code digest |
 | `atlas ste` | Before each publish; `--share` before a page goes to anyone else |
-| `atlas tests` | `write` puts the test kit in an area. `check` runs before a merge. `kept` runs the kept tests of a path 1 area and writes their evidence. `proof`, `verdict`, `named`, `covers` and `rerun` read the results of a run. `changed` and `before` run test checks of the gate: the changed tests, and the proof that a new case fails on the old code. `sweep` and `issues` run the daily sweep |
+| `atlas tests` | `write` puts the test kit in an area. `check` runs before a merge. `kept` runs the kept tests of a path 1 area and writes their evidence. `proof`, `verdict`, `named`, `covers` and `rerun` read the results of a run. `changed`, `before` and `after` run the test checks of the gate: changed tests, new cases fail on old code, old cases pass on new code. `sweep` and `issues` run the daily sweep |
 | `atlas design` | `folder` to learn where designs live; `check` before you show a design; `build` to make its page |
 | `atlas view` | `build --product <id>` makes the project view page of one product, when the owner asks for it or after an Atlas release changes it. Publish it with only the grant the command prints |
 | `atlas upkeep` | `check` before you ask for a merge: the docs index, dead doc links, and the tracker item a pull request names. The daily upkeep run calls it on the main branch |