@ashlr/hub 3.2.7 → 3.3.2

package/dist/core/inbox/merge.js

@@ -159,6 +159,20 @@ function decisionReadIsHealthy(decisions) {
 const MERGE_BRANCH_PREFIX = 'ashlr/merge/';
 /** Timeout for git operations (ms). */
 const GIT_TIMEOUT = 30_000;
+/**
+ * Gate 6.5 (self-eval parity, M54/M86): how many times to run test:invariants
+ * per flag state before declaring it red. >1 tolerates a one-off transient
+ * blip (lock timing, momentary contention) without weakening the gate — a
+ * genuinely broken invariant still fails every attempt. Kept small (one
+ * retry, short delay): sustained multi-minute contention from a concurrent
+ * test run can't be "waited out" here anyway — cross-tick retry (the
+ * proposal simply stays pending and is re-evaluated next pass, see
+ * automerge-pass.ts) is what actually absorbs that, and this must stay
+ * short enough to never turn a fast fail-closed refusal into a slow one.
+ */
+const SELF_EVAL_PARITY_RETRY_ATTEMPTS = 2;
+/** Delay between self-eval parity retry attempts (ms). */
+const SELF_EVAL_PARITY_RETRY_DELAY_MS = 500;
 // ---------------------------------------------------------------------------
 // git helpers — arg arrays, no shell
 // ---------------------------------------------------------------------------
@@ -612,7 +626,23 @@ export function evaluateAutoMergeReadinessPreflight(proposal, cfg) {
             return block('proposal has no repo');
         if (proposal.verifyResult?.passed === false) {
             const failed = proposal.verifyResult.failed?.filter(Boolean).join('; ');
-            return block(`known verification failure: proposal.verifyResult.passed is false${failed ? ` (${failed})` : ''}`);
+            const category = proposal.verifyResult.failureCategory;
+            // A verifier that could NOT be executed (missing binary, exit 127, spawn
+            // ENOENT) or that hit a bounded timeout/infra hiccup is a DIFFERENT
+            // outcome from a verifier that ran and found the diff broken. Both stay
+            // fail-closed (ready:false — this NEVER makes an unverified change
+            // eligible to merge), but only a real 'code' failure (or an
+            // unclassified/legacy record) may accrue toward stuckPassCount/
+            // autoArchive. An infra-flavored failure must not permanently kill a
+            // proposal whose only crime was that the verifier was momentarily
+            // unavailable — it stays pending and is retried next pass.
+            const explicitCodeFailure = category === 'code';
+            const advisories = !explicitCodeFailure
+                ? [
+                    `verifier-unavailable: verification could not run to completion (${category}) — not counted toward auto-archive; will retry`,
+                ]
+                : [];
+            return block(`known verification failure: proposal.verifyResult.passed is false${failed ? ` (${failed})` : ''}`, advisories, explicitCodeFailure);
         }
         const trustBasis = cfg.foundry?.['autoMerge']
             ? cfg.foundry['autoMerge']?.['trustBasis'] ?? 'tier'
@@ -1417,6 +1447,7 @@ export function verifyResultFromProposalResult(result, source = 'auto-merge', ve
     return {
         passed: result.ok,
         ...(result.ok ? {} : { failed: [result.detail] }),
+        ...(result.ok || result.failureCategory === undefined ? {} : { failureCategory: result.failureCategory }),
         detail: result.detail,
         ran: [...result.ran],
         ...(result.browser ? { browser: result.browser } : {}),
@@ -1534,6 +1565,7 @@ function verifyResultFromStored(result) {
         ...(result.browser ? { browser: result.browser } : {}),
         ...(result.baseBranch ? { baseBranch: result.baseBranch } : {}),
         ...(result.baseHead ? { baseHead: result.baseHead } : {}),
+        ...(result.failureCategory ? { failureCategory: result.failureCategory } : {}),
     };
 }
 function truncateEvidenceText(text, limit = 500) {
@@ -1685,6 +1717,8 @@ export async function verifyProposal(proposal, cfg) {
         }
         // Apply the diff to the worktree ONLY AFTER capturing the base-derived
         // command list, then run those (immutable) commands against the patched tree.
+        // Apply exactly to the verified index. Context drift is a refusal, not
+        // authority to synthesize a three-way result that was never proposed.
         patchFile = writeTmpFile(diff);
         try {
             gitRun(tmpDir, ['apply', '--index', patchFile]);
@@ -1711,6 +1745,7 @@ export async function verifyProposal(proposal, cfg) {
                         detail: `required verify '${vc.kind}' failed (exit ${res.exitCode}): ${res.command}`,
                         baseBranch: base,
                         baseHead,
+                        ...(res.failureCategory ? { failureCategory: res.failureCategory } : {}),
                     };
                 }
                 // M281: for test commands, only block if NEW failures were introduced.
@@ -1788,6 +1823,7 @@ export async function verifyProposal(proposal, cfg) {
                     detail: `verify '${vc.kind}' failed (exit ${res.exitCode}): ${res.command}`,
                     baseBranch: base,
                     baseHead,
+                    ...(res.failureCategory ? { failureCategory: res.failureCategory } : {}),
                 };
             }
         }
@@ -2467,11 +2503,12 @@ export async function autoMergeProposal(id, cfg, invocation = {}) {
         let maxLinesForEvidence = 0;
         // ── Gate 5.5 (M86): scope cap — only small, fully-bounded diffs auto-merge
         // to main. Defaults are conservative; bounded config keys allow opt-in relaxation.
-        // We require risk==='low' here (Gate 5 already enforces ≤maxRisk, but
-        // maxRisk could be raised to 'medium' — scope cap applies ONLY when risk is
-        // strictly 'low', so even a cfg.maxRisk='medium' run is scoped to low-risk
-        // diffs for the size check). File + line counts reuse the same diff parser
-        // as classifyRisk so the two gates are consistent.
+        // NOTE (was stale): this used to hard-require risk==='low' regardless of
+        // cfg.maxRisk, silently overriding an operator's higher maxRisk for the
+        // scope check even though Gate 5 above had already cleared it. M295 (below)
+        // fixed that — the size cap now applies up to the CONFIGURED maxRisk, so
+        // the two gates agree. File + line counts reuse the same diff parser as
+        // classifyRisk so the two gates are consistent.
         {
             const autoMergeCfg = cfg.foundry
                 ?.autoMerge;
@@ -2593,12 +2630,32 @@ export async function autoMergeProposal(id, cfg, invocation = {}) {
                             : 'npm';
                 if (scriptsForParity['test:invariants']) {
                     // Fast path: run only the invariant suite.
+                    //
+                    // Bounded retry (merge-pipeline reliability): test:invariants
+                    // includes concurrency/timing/disk-cap tests (h3/h5) that are
+                    // legitimately flaky under host contention — a second live daemon
+                    // tick, another sandboxed agent's test run, or transient disk
+                    // pressure can make ONE pass momentarily red for reasons that have
+                    // nothing to do with the proposal's diff. Unlike the main verify
+                    // path (Gate 6, M281/M293) there is no per-proposal baseline to
+                    // diff against here — this check runs against the UNPATCHED repo
+                    // tree, so a single flaky run previously meant 3 non-parity
+                    // refusals permanently auto-archived an otherwise-good proposal.
+                    // A genuinely broken invariant fails EVERY attempt and is still
+                    // refused — this only tolerates transient noise, never a real break.
                     const invariantCmd = {
                         kind: 'test',
                         cmd: [pm, 'run', 'test:invariants'],
                     };
-                    const res = await runVerifyCommandAsync(invariantCmd, repo, parityCfg);
-                    return res.ok;
+                    for (let attempt = 1; attempt <= SELF_EVAL_PARITY_RETRY_ATTEMPTS; attempt++) {
+                        const res = await runVerifyCommandAsync(invariantCmd, repo, parityCfg);
+                        if (res.ok)
+                            return true;
+                        if (attempt < SELF_EVAL_PARITY_RETRY_ATTEMPTS) {
+                            await new Promise((resolveDelay) => setTimeout(resolveDelay, SELF_EVAL_PARITY_RETRY_DELAY_MS));
+                        }
+                    }
+                    return false;
                 }
                 // Fallback: no targeted script — run all detected verify commands.
                 const cmds = detectVerifyCommands(repo, 'merge');
@@ -2608,8 +2665,18 @@ export async function autoMergeProposal(id, cfg, invocation = {}) {
                     return true;
                 }
                 for (const vc of cmds) {
-                    const res = await runVerifyCommandAsync(vc, repo, parityCfg);
-                    if (!res.ok && vc.required !== false)
+                    const attempts = vc.kind === 'test' ? SELF_EVAL_PARITY_RETRY_ATTEMPTS : 1;
+                    let ok = false;
+                    for (let attempt = 1; attempt <= attempts; attempt++) {
+                        const res = await runVerifyCommandAsync(vc, repo, parityCfg);
+                        ok = res.ok;
+                        if (ok)
+                            break;
+                        if (attempt < attempts) {
+                            await new Promise((resolveDelay) => setTimeout(resolveDelay, SELF_EVAL_PARITY_RETRY_DELAY_MS));
+                        }
+                    }
+                    if (!ok && vc.required !== false)
                         return false;
                 }
                 return true;
@@ -2741,7 +2808,7 @@ export async function autoMergeProposal(id, cfg, invocation = {}) {
                     let inlineAttestation;
                     const ts = new Date().toISOString();
                     const inlineReviewerIndependence = evaluateReviewerIndependence(proposal, inlineJudgeEngine);
-                    if (verdict.verdict === 'ship' && verdict.wouldMerge === true && isFrontierJudge(inlineJudgeEngine) &&
+                    if (verdict.considered === true && verdict.verdict === 'ship' && verdict.wouldMerge === true && isFrontierJudge(inlineJudgeEngine) &&
                         inlineReviewerIndependence.independent) {
                         try {
                             const { signJudgeAttestation: signAtt, hashDiff: hd } = await import('../foundry/provenance.js');
@@ -2772,22 +2839,31 @@ export async function autoMergeProposal(id, cfg, invocation = {}) {
                         action: 'judged',
                         engine: inlineJudgeEngine,
                         model: inlineJudgeEngine,
-                        verdict: verdict.verdict,
-                        detail: verdict.wouldMerge && inlineReviewerIndependence.independent ? 'would-merge' : '',
+                        verdict: verdict.considered === true ? verdict.verdict : 'review',
+                        // M507: a judgeFailure verdict is a synthetic fail-closed fallback, not
+                        // a considered judgment. It must be distinguishable in the ledger from a
+                        // real 'review' — conflating them is what made ~22% of judge calls look
+                        // like deliberate rejections. Mirrors automerge-pass.ts:243 so BOTH judge
+                        // paths record the same way. `wouldMerge` is always false on a failure,
+                        // so this never displaces the 'would-merge' marker.
+                        detail: verdict.judgeFailure || verdict.considered !== true
+                            ? (verdict.judgeFailure === 'network' ? 'judge-network-failure' : 'judge-parse-failure')
+                            : (verdict.wouldMerge && inlineReviewerIndependence.independent ? 'would-merge' : ''),
                         ...(verdict.semanticEvents ? { semanticEvents: verdict.semanticEvents } : {}),
                         ...(inlineAttestation !== undefined ? { judgeAttestation: inlineAttestation } : {}),
                         ...(inlineAttestation !== undefined
                             ? { judgeAttestationIssuedAt: ts, judgeAttestationIntent: 'would-merge' }
                             : {}),
                     });
-                    if (verdict.verdict === 'ship' && verdict.wouldMerge === true &&
+                    if (verdict.considered === true && verdict.verdict === 'ship' && verdict.wouldMerge === true &&
                         !inlineReviewerIndependence.independent) {
                         return refuse(`manager quality gate: ${inlineReviewerIndependence.reason}`, repo);
                     }
+                    const consideredVerdict = verdict.considered === true;
                     managerVerdict = {
-                        verdict: verdict.verdict,
-                        wouldMerge: verdict.wouldMerge,
-                        reasonCode: judgeDecisionReasonCode(verdict.verdict, verdict.wouldMerge && inlineReviewerIndependence.independent),
+                        verdict: consideredVerdict ? verdict.verdict : 'review',
+                        wouldMerge: consideredVerdict ? verdict.wouldMerge : false,
+                        reasonCode: judgeDecisionReasonCode(consideredVerdict ? verdict.verdict : 'review', consideredVerdict && verdict.wouldMerge && inlineReviewerIndependence.independent),
                     };
                 }
                 catch {
@@ -3385,7 +3461,10 @@ export async function autoMergeProposal(id, cfg, invocation = {}) {
                             mergeNote = 'PR opened; host auto-merge refused because canonical GitHub origin changed';
                         }
                         else {
-                            finalProtectedHandoffConfirmed = true;
+                            // Protected PR handoff is the terminal autonomous action. A host
+                            // merge requires separate authority and remains intentionally
+                            // unavailable in this release.
+                            finalProtectedHandoffConfirmed = Boolean(url);
                             mergeNote = 'PR opened; host auto-merge is disabled until durable revocation is available';
                         }
                     }