@ashlr/hub 3.5.1 → 3.8.0

package/dist/core/daemon/overnight-status.d.ts

@@ -0,0 +1,152 @@
+/**
+ * overnight-status.ts — the engine half of the `GET /api/verse/overnight`
+ * contract. The route (owned elsewhere, under src/web-ui / verse) reads this;
+ * this module never serves HTTP and never imports a web module.
+ *
+ * ── THE TRI-STATE RULE, WHICH IS THE WHOLE POINT ───────────────────────────
+ * Every field except `armed` is tri-state: `null` means "the engine did not
+ * say", and the client renders that differently from zero. So nothing here
+ * ever defaults an unknown to 0. `iterationsDone: null` is "no run has
+ * reported yet"; `iterationsDone: 0` is "a run is going and has finished no
+ * iteration". Those are different facts and the operator can tell them apart.
+ *
+ * ── WHERE `merged[]` COMES FROM ────────────────────────────────────────────
+ * From the repositories, not from a counter. `daemon/post-merge-halt` detects
+ * landings by comparing each ENROLLED repo's head across a tick, so every row
+ * carries a real commit OID and the real subject line. A count can drift from
+ * what actually landed; a commit OID cannot.
+ *
+ * ── WHERE `discarded[].reason` COMES FROM ──────────────────────────────────
+ * Whoever discarded it says why, in their own words, and this module passes
+ * the sentence through untouched. "post-merge suite failed on <repo>" and
+ * "typecheck failed" are answers; "rejected" is not. A quiet night has to be
+ * legible in the morning or the run window is not worth having.
+ *
+ * KNOWN GAP — `discarded[]` currently carries POST-merge halts only.
+ * Pre-merge discards already have specific per-proposal reasons: the pass
+ * returns them as `AutoMergePassResult.skipped[]`
+ * (`{ proposalId, check, reason }`, e.g. "verify-before-judge: known failed
+ * verification: typecheck") and as rejection details on `results[]`. They are
+ * lost on the way out: `autoMergeTickSummary` (daemon/loop.ts:1817) folds the
+ * pass result into `DaemonTick['autoMerge']` as COUNTS only, so by the time
+ * runDaemon can see it the reasons are gone.
+ *
+ * The fix, deliberately NOT made here because it edits a shared type while
+ * another agent is changing budget types in the same file:
+ *   1. add `skipped?: Array<{ proposalId: string; check: string; reason: string }>`
+ *      to `DaemonTick['autoMerge']` (src/core/types.ts:4678-4692);
+ *   2. stop dropping it in `autoMergeTickSummary` (daemon/loop.ts:1817-1847),
+ *      bounded to a sane number of entries so the tick record stays small;
+ *   3. in runDaemon's post-tick block, feed each entry to
+ *      {@link recordOvernightDiscard} with `reason` = the pass's own sentence.
+ * That is the whole change; nothing else needs to move.
+ *
+ * `~/.ashlr/run-window/status.json`, written durably (exclusive tmp + atomic
+ * rename). Metadata only — never a diff, a token, or command output.
+ *
+ * No new runtime deps; node builtins only. Never throws out of a public API.
+ */
+import type { RunWindowStopRule } from './run-window.js';
+import type { PostMergeGateResult } from './post-merge-halt.js';
+export interface OvernightMergedItem {
+    readonly id: string;
+    readonly repo: string;
+    readonly title: string;
+    readonly at: string | null;
+    readonly commit: string | null;
+}
+export interface OvernightDiscardedItem {
+    readonly id: string;
+    readonly repo: string;
+    readonly title: string;
+    readonly at: string | null;
+    /** A SPECIFIC sentence. Never a bare 'rejected'. */
+    readonly reason: string;
+}
+export interface OvernightRun {
+    readonly runId: string;
+    readonly startedAt: string | null;
+    readonly stopRule: RunWindowStopRule | null;
+    /** null means "did not say" — NOT zero. */
+    readonly iterationsDone: number | null;
+    readonly repo: string | null;
+    /** Free text in the engine's own words, rendered verbatim. */
+    readonly activity: string | null;
+    readonly merged: OvernightMergedItem[];
+    readonly discarded: OvernightDiscardedItem[];
+}
+export interface OvernightGate {
+    readonly tests: boolean;
+    readonly lint: boolean;
+    readonly typecheck: boolean;
+    readonly autoMerge: boolean | null;
+    readonly branch: string | null;
+}
+export interface OvernightStatus {
+    /** The one field that may never be absent. */
+    readonly armed: boolean;
+    readonly repos: number | null;
+    readonly gate: OvernightGate | null;
+    readonly run: OvernightRun | null;
+}
+export declare function overnightStatusDir(): string;
+export declare function overnightStatusPath(): string;
+/** The safe empty answer. Disarmed, and honest that it knows nothing else. */
+export declare function emptyOvernightStatus(): OvernightStatus;
+/**
+ * Read the current status. A missing or unreadable file answers
+ * {@link emptyOvernightStatus} — DISARMED. That is the fail-safe direction:
+ * an engine that cannot prove it armed a run must never claim it did.
+ */
+export declare function readOvernightStatus(): OvernightStatus;
+/** Merge a partial update into the stored status. Never throws. */
+export declare function updateOvernightStatus(patch: Partial<OvernightStatus>): OvernightStatus;
+/**
+ * Arm a run. `disarm` stops the NEXT run, not this one — halting a LIVE run is
+ * the existing pause (`POST /api/verse/daemon {action:'pause'}`), and this
+ * module deliberately offers no second way to do it.
+ */
+export declare function armOvernightRun(stopRule: RunWindowStopRule, opts?: {
+    repos?: number | null;
+    gate?: OvernightGate | null;
+    runId?: string;
+    now?: () => number;
+}): OvernightStatus;
+/** Disarm the NEXT run. Leaves the last run's record intact for the morning. */
+export declare function disarmOvernightRun(): OvernightStatus;
+/**
+ * Recover the proposal id a landed commit came from, so `merged[].id` is the
+ * id the inbox knows rather than an invented one. Returns null when the
+ * subject is not one the merge path writes — a hand-made commit is reported
+ * honestly as having no proposal id, never given a fabricated one.
+ */
+export declare function proposalIdFromCommitSubject(subject: string): string | null;
+/**
+ * Fold one iteration's post-merge gate result into the live run record.
+ *
+ * A CLEAN landing appends to `merged[]`; a HALT appends to `discarded[]` with
+ * the gate's own specific sentence. Both come from repository truth.
+ */
+export declare function recordOvernightIteration(result: PostMergeGateResult, opts?: {
+    iterationsDone?: number;
+    activity?: string | null;
+    now?: () => number;
+}): OvernightStatus;
+/** Append a discard the engine decided outside the post-merge gate. */
+export declare function recordOvernightDiscard(item: Omit<OvernightDiscardedItem, 'at'> & {
+    at?: string | null;
+}, opts?: {
+    now?: () => number;
+}): OvernightStatus;
+/** Update the live "what is it doing right now" fields. Cheap; called per tick. */
+export declare function recordOvernightActivity(patch: {
+    iterationsDone?: number | null;
+    repo?: string | null;
+    activity?: string | null;
+}): OvernightStatus;
+/**
+ * Mark the run concluded. The record is KEPT, not cleared: the morning's first
+ * question is "what happened last night", and a status that erases itself on
+ * exit cannot answer it.
+ */
+export declare function concludeOvernightRun(summary: string): OvernightStatus;

package/dist/core/daemon/overnight-status.js

@@ -0,0 +1,275 @@
+/**
+ * overnight-status.ts — the engine half of the `GET /api/verse/overnight`
+ * contract. The route (owned elsewhere, under src/web-ui / verse) reads this;
+ * this module never serves HTTP and never imports a web module.
+ *
+ * ── THE TRI-STATE RULE, WHICH IS THE WHOLE POINT ───────────────────────────
+ * Every field except `armed` is tri-state: `null` means "the engine did not
+ * say", and the client renders that differently from zero. So nothing here
+ * ever defaults an unknown to 0. `iterationsDone: null` is "no run has
+ * reported yet"; `iterationsDone: 0` is "a run is going and has finished no
+ * iteration". Those are different facts and the operator can tell them apart.
+ *
+ * ── WHERE `merged[]` COMES FROM ────────────────────────────────────────────
+ * From the repositories, not from a counter. `daemon/post-merge-halt` detects
+ * landings by comparing each ENROLLED repo's head across a tick, so every row
+ * carries a real commit OID and the real subject line. A count can drift from
+ * what actually landed; a commit OID cannot.
+ *
+ * ── WHERE `discarded[].reason` COMES FROM ──────────────────────────────────
+ * Whoever discarded it says why, in their own words, and this module passes
+ * the sentence through untouched. "post-merge suite failed on <repo>" and
+ * "typecheck failed" are answers; "rejected" is not. A quiet night has to be
+ * legible in the morning or the run window is not worth having.
+ *
+ * KNOWN GAP — `discarded[]` currently carries POST-merge halts only.
+ * Pre-merge discards already have specific per-proposal reasons: the pass
+ * returns them as `AutoMergePassResult.skipped[]`
+ * (`{ proposalId, check, reason }`, e.g. "verify-before-judge: known failed
+ * verification: typecheck") and as rejection details on `results[]`. They are
+ * lost on the way out: `autoMergeTickSummary` (daemon/loop.ts:1817) folds the
+ * pass result into `DaemonTick['autoMerge']` as COUNTS only, so by the time
+ * runDaemon can see it the reasons are gone.
+ *
+ * The fix, deliberately NOT made here because it edits a shared type while
+ * another agent is changing budget types in the same file:
+ *   1. add `skipped?: Array<{ proposalId: string; check: string; reason: string }>`
+ *      to `DaemonTick['autoMerge']` (src/core/types.ts:4678-4692);
+ *   2. stop dropping it in `autoMergeTickSummary` (daemon/loop.ts:1817-1847),
+ *      bounded to a sane number of entries so the tick record stays small;
+ *   3. in runDaemon's post-tick block, feed each entry to
+ *      {@link recordOvernightDiscard} with `reason` = the pass's own sentence.
+ * That is the whole change; nothing else needs to move.
+ *
+ * `~/.ashlr/run-window/status.json`, written durably (exclusive tmp + atomic
+ * rename). Metadata only — never a diff, a token, or command output.
+ *
+ * No new runtime deps; node builtins only. Never throws out of a public API.
+ */
+import { mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+// ---------------------------------------------------------------------------
+// Storage
+// ---------------------------------------------------------------------------
+export function overnightStatusDir() {
+    return join(homedir(), '.ashlr', 'run-window');
+}
+export function overnightStatusPath() {
+    return join(overnightStatusDir(), 'status.json');
+}
+/** The safe empty answer. Disarmed, and honest that it knows nothing else. */
+export function emptyOvernightStatus() {
+    return { armed: false, repos: null, gate: null, run: null };
+}
+function writeStatus(status) {
+    try {
+        const dir = overnightStatusDir();
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+        const path = overnightStatusPath();
+        const tmp = `${path}.${process.pid}.${randomUUID()}.tmp`;
+        try {
+            writeFileSync(tmp, JSON.stringify(status, null, 2) + '\n', { mode: 0o600, flag: 'wx' });
+            renameSync(tmp, path);
+        }
+        catch (error) {
+            try {
+                unlinkSync(tmp);
+            }
+            catch { /* the rename already consumed it */ }
+            throw error;
+        }
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Read the current status. A missing or unreadable file answers
+ * {@link emptyOvernightStatus} — DISARMED. That is the fail-safe direction:
+ * an engine that cannot prove it armed a run must never claim it did.
+ */
+export function readOvernightStatus() {
+    try {
+        const parsed = JSON.parse(readFileSync(overnightStatusPath(), 'utf8'));
+        if (parsed?.recordType !== 'daemon-overnight-status')
+            return emptyOvernightStatus();
+        return {
+            armed: parsed.armed === true,
+            repos: typeof parsed.repos === 'number' ? parsed.repos : null,
+            gate: parsed.gate ?? null,
+            run: parsed.run ?? null,
+        };
+    }
+    catch {
+        return emptyOvernightStatus();
+    }
+}
+/** Merge a partial update into the stored status. Never throws. */
+export function updateOvernightStatus(patch) {
+    const current = readOvernightStatus();
+    const next = {
+        armed: patch.armed ?? current.armed,
+        repos: patch.repos !== undefined ? patch.repos : current.repos,
+        gate: patch.gate !== undefined ? patch.gate : current.gate,
+        run: patch.run !== undefined ? patch.run : current.run,
+    };
+    writeStatus({ recordType: 'daemon-overnight-status', ...next });
+    return next;
+}
+/**
+ * Arm a run. `disarm` stops the NEXT run, not this one — halting a LIVE run is
+ * the existing pause (`POST /api/verse/daemon {action:'pause'}`), and this
+ * module deliberately offers no second way to do it.
+ */
+export function armOvernightRun(stopRule, opts = {}) {
+    const nowMs = (opts.now ?? Date.now)();
+    return updateOvernightStatus({
+        armed: true,
+        repos: opts.repos ?? null,
+        gate: opts.gate ?? null,
+        run: {
+            runId: opts.runId ?? randomUUID(),
+            startedAt: new Date(nowMs).toISOString(),
+            stopRule,
+            // A freshly armed run HAS done zero iterations — that is a fact it can
+            // state, so it is 0 and not null.
+            iterationsDone: 0,
+            repo: null,
+            activity: 'armed; waiting for the first tick',
+            merged: [],
+            discarded: [],
+        },
+    });
+}
+/** Disarm the NEXT run. Leaves the last run's record intact for the morning. */
+export function disarmOvernightRun() {
+    return updateOvernightStatus({ armed: false });
+}
+// ---------------------------------------------------------------------------
+// Recording progress
+// ---------------------------------------------------------------------------
+/** `ashlr: auto-merge proposal <id>` / `ashlr: merge proposal branch ashlr/merge/<id>`. */
+const PROPOSAL_ID_PATTERNS = [
+    /^ashlr:\s*auto-merge proposal\s+(\S+)/,
+    /^ashlr:\s*merge proposal branch\s+ashlr\/merge\/(\S+)/,
+];
+/**
+ * Recover the proposal id a landed commit came from, so `merged[].id` is the
+ * id the inbox knows rather than an invented one. Returns null when the
+ * subject is not one the merge path writes — a hand-made commit is reported
+ * honestly as having no proposal id, never given a fabricated one.
+ */
+export function proposalIdFromCommitSubject(subject) {
+    for (const pattern of PROPOSAL_ID_PATTERNS) {
+        const match = pattern.exec(subject ?? '');
+        if (match?.[1])
+            return match[1];
+    }
+    return null;
+}
+/**
+ * Fold one iteration's post-merge gate result into the live run record.
+ *
+ * A CLEAN landing appends to `merged[]`; a HALT appends to `discarded[]` with
+ * the gate's own specific sentence. Both come from repository truth.
+ */
+export function recordOvernightIteration(result, opts = {}) {
+    const current = readOvernightStatus();
+    if (!current.run)
+        return current;
+    const nowMs = (opts.now ?? Date.now)();
+    const at = new Date(nowMs).toISOString();
+    const merged = [...current.run.merged];
+    const discarded = [...current.run.discarded];
+    if (!result.halt) {
+        for (const landing of result.landings) {
+            for (const commit of landing.commits) {
+                merged.push({
+                    id: proposalIdFromCommitSubject(commit.subject) ?? commit.sha.slice(0, 12),
+                    repo: landing.repo,
+                    title: commit.subject,
+                    at,
+                    commit: commit.sha,
+                });
+            }
+        }
+    }
+    else {
+        // A halted landing is not a merge that stuck — it is work the operator
+        // must back out, and it says exactly why and exactly how.
+        for (const landing of result.landings) {
+            const why = result.failures
+                .filter((f) => f.repo === landing.repo)
+                .map((f) => `${f.kind} ${f.detail}`)
+                .join('; ');
+            discarded.push({
+                id: landing.commits[0]
+                    ? proposalIdFromCommitSubject(landing.commits[0].subject) ?? landing.commits[0].sha.slice(0, 12)
+                    : landing.afterHead.slice(0, 12),
+                repo: landing.repo,
+                title: landing.commits[0]?.subject ?? `landing ${landing.beforeHead.slice(0, 8)}..${landing.afterHead.slice(0, 8)}`,
+                at,
+                reason: result.verdict === 'regressed'
+                    ? `post-merge suite failed on ${landing.repo}: ${why || 'a required check went red after the merge'}. ` +
+                        `Back it out with: ${landing.revertCommand}`
+                    : `the merge on ${landing.repo} could not be verified: ${why || 'no required verify command could be run'}. ` +
+                        `Back it out with: ${landing.revertCommand}`,
+            });
+        }
+    }
+    return updateOvernightStatus({
+        run: {
+            ...current.run,
+            iterationsDone: opts.iterationsDone ?? current.run.iterationsDone,
+            repo: result.landings[0]?.repo ?? current.run.repo,
+            activity: opts.activity !== undefined ? opts.activity : current.run.activity,
+            merged,
+            discarded,
+        },
+    });
+}
+/** Append a discard the engine decided outside the post-merge gate. */
+export function recordOvernightDiscard(item, opts = {}) {
+    const current = readOvernightStatus();
+    if (!current.run)
+        return current;
+    return updateOvernightStatus({
+        run: {
+            ...current.run,
+            discarded: [...current.run.discarded, {
+                    ...item,
+                    at: item.at ?? new Date((opts.now ?? Date.now)()).toISOString(),
+                }],
+        },
+    });
+}
+/** Update the live "what is it doing right now" fields. Cheap; called per tick. */
+export function recordOvernightActivity(patch) {
+    const current = readOvernightStatus();
+    if (!current.run)
+        return current;
+    return updateOvernightStatus({
+        run: {
+            ...current.run,
+            iterationsDone: patch.iterationsDone !== undefined ? patch.iterationsDone : current.run.iterationsDone,
+            repo: patch.repo !== undefined ? patch.repo : current.run.repo,
+            activity: patch.activity !== undefined ? patch.activity : current.run.activity,
+        },
+    });
+}
+/**
+ * Mark the run concluded. The record is KEPT, not cleared: the morning's first
+ * question is "what happened last night", and a status that erases itself on
+ * exit cannot answer it.
+ */
+export function concludeOvernightRun(summary) {
+    const current = readOvernightStatus();
+    return updateOvernightStatus({
+        armed: false,
+        run: current.run ? { ...current.run, activity: summary } : null,
+    });
+}
+//# sourceMappingURL=overnight-status.js.map

package/dist/core/daemon/overnight-status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"overnight-status.js","sourceRoot":"","sources":["../../../src/core/daemon/overnight-status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACzF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAuDzC,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,MAAM,UAAU,kBAAkB;IAChC,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,OAAO,IAAI,CAAC,kBAAkB,EAAE,EAAE,aAAa,CAAC,CAAC;AACnD,CAAC;AAUD,8EAA8E;AAC9E,MAAM,UAAU,oBAAoB;IAClC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AAC9D,CAAC;AAED,SAAS,WAAW,CAAC,MAAoB;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,kBAAkB,EAAE,CAAC;QACjC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,mBAAmB,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,MAAM,CAAC;QACzD,IAAI,CAAC;YACH,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACxF,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC;gBAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,oCAAoC,CAAC,CAAC;YACvE,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,mBAAmB,EAAE,EAAE,MAAM,CAAC,CAAiB,CAAC;QACvF,IAAI,MAAM,EAAE,UAAU,KAAK,yBAAyB;YAAE,OAAO,oBAAoB,EAAE,CAAC;QACpF,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,KAAK,KAAK,IAAI;YAC5B,KAAK,EAAE,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;YAC7D,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,IAAI;YACzB,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,IAAI;SACxB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,oBAAoB,EAAE,CAAC;IAChC,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,qBAAqB,CAAC,KAA+B;IACnE,MAAM,OAAO,GAAG,mBAAmB,EAAE,CAAC;IACtC,MAAM,IAAI,GAAoB;QAC5B,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK;QACnC,KAAK,EAAE,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK;QAC9D,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI;QAC1D,GAAG,EAAE,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG;KACvD,CAAC;IACF,WAAW,CAAC,EAAE,UAAU,EAAE,yBAAyB,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;IAChE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,QAA2B,EAC3B,OAAmG,EAAE;IAErG,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACvC,OAAO,qBAAqB,CAAC;QAC3B,KAAK,EAAE,IAAI;QACX,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI;QACzB,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI;QACvB,GAAG,EAAE;YACH,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,UAAU,EAAE;YACjC,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE;YACxC,QAAQ;YACR,uEAAuE;YACvE,kCAAkC;YAClC,cAAc,EAAE,CAAC;YACjB,IAAI,EAAE,IAAI;YACV,QAAQ,EAAE,mCAAmC;YAC7C,MAAM,EAAE,EAAE;YACV,SAAS,EAAE,EAAE;SACd;KACF,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,kBAAkB;IAChC,OAAO,qBAAqB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,2FAA2F;AAC3F,MAAM,oBAAoB,GAAa;IACrC,uCAAuC;IACvC,uDAAuD;CACxD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CAAC,OAAe;IACzD,KAAK,MAAM,OAAO,IAAI,oBAAoB,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAC1C,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACtC,MAA2B,EAC3B,OAAkF,EAAE;IAEpF,MAAM,OAAO,GAAG,mBAAmB,EAAE,CAAC;IACtC,IAAI,CAAC,OAAO,CAAC,GAAG;QAAE,OAAO,OAAO,CAAC;IACjC,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACvC,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAEzC,MAAM,MAAM,GAA0B,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9D,MAAM,SAAS,GAA6B,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAEvE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACjB,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtC,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBACrC,MAAM,CAAC,IAAI,CAAC;oBACV,EAAE,EAAE,2BAA2B,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;oBAC1E,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,KAAK,EAAE,MAAM,CAAC,OAAO;oBACrB,EAAE;oBACF,MAAM,EAAE,MAAM,CAAC,GAAG;iBACnB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,uEAAuE;QACvE,0DAA0D;QAC1D,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ;iBACxB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC;iBACtC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;iBACnC,IAAI,CAAC,IAAI,CAAC,CAAC;YACd,SAAS,CAAC,IAAI,CAAC;gBACb,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;oBACpB,CAAC,CAAC,2BAA2B,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;oBAChG,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;gBAClC,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,WAAW,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;gBACnH,EAAE;gBACF,MAAM,EAAE,MAAM,CAAC,OAAO,KAAK,WAAW;oBACpC,CAAC,CAAC,8BAA8B,OAAO,CAAC,IAAI,KAAK,GAAG,IAAI,2CAA2C,IAAI;wBACrG,qBAAqB,OAAO,CAAC,aAAa,EAAE;oBAC9C,CAAC,CAAC,gBAAgB,OAAO,CAAC,IAAI,2BAA2B,GAAG,IAAI,yCAAyC,IAAI;wBAC3G,qBAAqB,OAAO,CAAC,aAAa,EAAE;aACjD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,qBAAqB,CAAC;QAC3B,GAAG,EAAE;YACH,GAAG,OAAO,CAAC,GAAG;YACd,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc;YACjE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI;YAClD,QAAQ,EAAE,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ;YAC5E,MAAM;YACN,SAAS;SACV;KACF,CAAC,CAAC;AACL,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,sBAAsB,CACpC,IAAiE,EACjE,OAA+B,EAAE;IAEjC,MAAM,OAAO,GAAG,mBAAmB,EAAE,CAAC;IACtC,IAAI,CAAC,OAAO,CAAC,GAAG;QAAE,OAAO,OAAO,CAAC;IACjC,OAAO,qBAAqB,CAAC;QAC3B,GAAG,EAAE;YACH,GAAG,OAAO,CAAC,GAAG;YACd,SAAS,EAAE,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE;oBACpC,GAAG,IAAI;oBACP,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE;iBAChE,CAAC;SACH;KACF,CAAC,CAAC;AACL,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,uBAAuB,CACrC,KAAyF;IAEzF,MAAM,OAAO,GAAG,mBAAmB,EAAE,CAAC;IACtC,IAAI,CAAC,OAAO,CAAC,GAAG;QAAE,OAAO,OAAO,CAAC;IACjC,OAAO,qBAAqB,CAAC;QAC3B,GAAG,EAAE;YACH,GAAG,OAAO,CAAC,GAAG;YACd,cAAc,EAAE,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc;YACtG,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI;YAC9D,QAAQ,EAAE,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ;SAC/E;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,MAAM,OAAO,GAAG,mBAAmB,EAAE,CAAC;IACtC,OAAO,qBAAqB,CAAC;QAC3B,KAAK,EAAE,KAAK;QACZ,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI;KAChE,CAAC,CAAC;AACL,CAAC"}

package/dist/core/daemon/post-merge-halt.d.ts

@@ -0,0 +1,212 @@
+/**
+ * post-merge-halt.ts — the ONE gate that makes an unattended night survivable.
+ *
+ * ── WHAT WAS ALREADY THERE, AND WHAT WAS NOT ───────────────────────────────
+ * The PRE-merge gate is genuinely solid and this module does not duplicate a
+ * line of it. `fleet/automerge-pass` → `inbox/merge.autoMergeProposal` already
+ * runs the repo's OWN typecheck / tests / lint in a throwaway worktree branched
+ * off the default-branch head (`inbox/merge.verifyProposal`), with the verify
+ * commands detected from the BASE tree so a diff cannot rewrite which commands
+ * run; refuses any diff touching package.json / lockfiles / CI / Dockerfile /
+ * Makefile outright; caps scope (4 files / 150 lines) and risk; requires an
+ * independent frontier judge with an HMAC-signed attestation; calls
+ * `assertMayMutate` so only `listEnrolled()` repos are ever touched; and
+ * re-checks the kill switch at every write boundary. A proposal that cannot be
+ * verified is left PENDING or rejected — never merged — and every rejection is
+ * audited (`inbox:proposal-rejected`) with a decisions-ledger row. That is the
+ * pre-merge half of the contract, and it holds.
+ *
+ * What did NOT exist anywhere is the half that matters at 4am: NOTHING re-ran
+ * the suite AFTER a merge landed, and nothing could halt the run when it went
+ * red. The only post-merge machinery is observation-only by construction —
+ * `fleet/automerge-canary-observer` declares `authority: 'observation-only',
+ * enforceSupported: false` and merely writes an audit row, and the M189
+ * regression sentinel is default-OFF, needs two consecutive RED observations,
+ * and is explicitly "proposal-only — NEVER applies, merges, or pushes".
+ *
+ * So a regression merged at 01:00 was invisible to the gate, and iteration N+1
+ * was then built on top of it, and N+2 on top of that. By morning the bad
+ * commit is load-bearing and backing it out is archaeology. THIS module makes
+ * that impossible: the first red suite after a merge ENDS THE RUN. A bad night
+ * costs exactly one revert, which this module names precisely, instead of a
+ * tangled morning.
+ *
+ * ── HOW IT KNOWS A MERGE LANDED ────────────────────────────────────────────
+ * By reading the repos, not by trusting a return value. It snapshots each
+ * enrolled repo's HEAD before the tick and compares after. Anything that moved
+ * a default branch — `automerge-pass`, a future path, anything at all — is
+ * caught, because the evidence is the repository itself. A result object can be
+ * wrong about what it did; `git rev-parse HEAD` cannot.
+ *
+ * ── FAIL SAFE ──────────────────────────────────────────────────────────────
+ * A landing that cannot be verified HALTS. Not "continue and hope": if the
+ * repo declares no required verify command, or the command cannot be run, or
+ * git cannot be read, or THE WORKING TREE IS DIRTY, the run ends and says why.
+ * That is the same direction the pre-merge gate already fails
+ * (`allowWithoutVerification` defaults false) and the same direction
+ * `daemonPaused()` projects an unreadable sentinel.
+ *
+ * Those cases are reported as UNPROVABLE, never as a regression, and the
+ * distinction is deliberate. Not being overly critical governs how harshly a
+ * CHANGE is judged; it says nothing about whether the EVIDENCE is sound. A
+ * dirty tree means the post-merge run measured the operator's uncommitted
+ * edits instead of the merge — the gate is not being strict there, it is
+ * being honest that it proved nothing. That case matters more than the rest,
+ * because it is the only one where the gate would otherwise say GREEN and be
+ * wrong, and a false green is what the whole run window exists to prevent.
+ *
+ * ── FOLLOW-UP: THE MERGE COMMIT MESSAGE ────────────────────────────────────
+ * Each merge is already exactly one revertable commit, but its message names
+ * only the proposal: `ashlr: merge proposal branch ashlr/merge/<id>`
+ * (inbox/merge.ts:2843-2854) over `ashlr: auto-merge proposal <id>`
+ * (inbox/merge.ts:2690). It says WHAT, not WHY. Carrying the why into the
+ * commit means editing inbox/merge.ts, which 14 automerge suites pin; until
+ * that is worth doing, the why lives in the overnight status record
+ * (daemon/overnight-status.ts), keyed by the same proposal id, and in the
+ * halt record written below.
+ *
+ * ── HOW IT HALTS ───────────────────────────────────────────────────────────
+ * By PARKING, never by killing. `stopDaemon()` is `setKill(true)`, which writes
+ * the global `~/.ashlr/KILL` that `assertMayMutate` also reads — it would
+ * disable the operator's own MCP write tools on arrival. This module's halt is
+ * `pauseDaemon()` (`~/.ashlr/daemon.paused`, see daemon/pause.ts), which stops
+ * autonomous dispatch and nothing else, and which one click reverses.
+ *
+ * No new runtime deps; node builtins only. Never throws out of a public API.
+ */
+import type { AshlrConfig } from '../types.js';
+import { detectVerifyCommands, runVerifyCommandAsync, type VerifyCommand } from '../run/verify-commands.js';
+/** One enrolled repo's default-branch tip at a point in time. */
+export interface RepoHeadSnapshot {
+    readonly repo: string;
+    /** 40-char OID, or null when the repo could not be read at all. */
+    readonly head: string | null;
+    /** Set when `head` is null, so an unreadable repo is never silently skipped. */
+    readonly unreadable?: string;
+}
+/** One commit that appeared on an enrolled repo between two snapshots. */
+export interface LandedCommit {
+    readonly sha: string;
+    readonly subject: string;
+    /** True for a merge commit (2+ parents) — it reverts with `-m 1`. */
+    readonly isMerge: boolean;
+}
+/** A repo whose head moved while the daemon was ticking. */
+export interface PostMergeLanding {
+    readonly repo: string;
+    readonly beforeHead: string;
+    readonly afterHead: string;
+    readonly commits: LandedCommit[];
+    /** Exactly the command that backs this landing out. */
+    readonly revertCommand: string;
+}
+export type PostMergeVerdict = 
+/** No enrolled repo moved. The overwhelmingly common case; costs one git call per repo. */
+'no-landing'
+/** Something landed and the repo's own required suite is green on it. */
+ | 'clean'
+/** Something landed and the repo's own required suite is RED on it. HALT. */
+ | 'regressed'
+/** Something landed and could not be verified at all. HALT. */
+ | 'unverifiable';
+export interface PostMergeFailure {
+    readonly repo: string;
+    /**
+     * A VerifyCommand kind means the check RAN and came back red — a genuine
+     * regression. 'detection' / 'harness' / 'git' mean the check could not be
+     * run or read at all, which is UNVERIFIABLE, not a regression. Both halt;
+     * the distinction is what the operator reads at 07:00 to know whether they
+     * are looking at a bad diff or a broken toolchain.
+     */
+    readonly kind: VerifyCommand['kind'] | 'detection' | 'harness' | 'git' | 'dirty-tree';
+    readonly command: string;
+    readonly detail: string;
+}
+export interface PostMergeGateResult {
+    readonly verdict: PostMergeVerdict;
+    /** True exactly when the run must end. Never true for 'clean'/'no-landing'. */
+    readonly halt: boolean;
+    readonly landings: PostMergeLanding[];
+    readonly failures: PostMergeFailure[];
+    /** Commands actually executed, for the audit line. */
+    readonly ranCommands: number;
+    /** One line, safe for an audit summary. Metadata only, never command output. */
+    readonly detail: string;
+    /** Every revert needed to undo this iteration, in the order to run them. */
+    readonly revertPlan: string[];
+    readonly durationMs: number;
+}
+/** A halt, written durably so the morning does not begin with guesswork. */
+export interface PostMergeHaltRecord {
+    readonly recordType: 'daemon-post-merge-halt';
+    readonly haltedAt: string;
+    readonly verdict: Exclude<PostMergeVerdict, 'clean' | 'no-landing'>;
+    readonly detail: string;
+    readonly landings: PostMergeLanding[];
+    readonly failures: PostMergeFailure[];
+    readonly revertPlan: string[];
+}
+export interface PostMergeGateSeams {
+    /** Enrolled repos. Defaults to `listEnrolled()` and is NEVER widened. */
+    readonly listEnrolledRepos?: () => string[];
+    readonly detect?: typeof detectVerifyCommands;
+    readonly run?: typeof runVerifyCommandAsync;
+    readonly now?: () => number;
+}
+/**
+ * Read every ENROLLED repo's HEAD. Enrollment is the only source of repos —
+ * a repo that is not enrolled is never read, never verified, and can never
+ * appear in a landing or a halt.
+ *
+ * Never throws; an unreadable repo is recorded as such, not dropped.
+ */
+export declare function snapshotEnrolledHeads(seams?: PostMergeGateSeams): RepoHeadSnapshot[];
+/**
+ * Which enrolled repos moved between two snapshots.
+ *
+ * A repo present in `before` but unreadable in `after` (or vice versa) is NOT
+ * treated as "nothing happened" — it is reported as a landing with an empty
+ * commit list so the caller fails safe rather than assuming quiet.
+ */
+export declare function detectLandings(before: RepoHeadSnapshot[], after: RepoHeadSnapshot[]): {
+    landings: PostMergeLanding[];
+    unreadable: PostMergeFailure[];
+};
+/**
+ * The exact command that backs a landing out.
+ *
+ * A single merge commit — which is what `inbox/merge.mergeLocally` produces,
+ * a two-parent `commit-tree` against the verified base — reverts with
+ * `git revert -m 1 <oid>`. Several commits revert newest-first. A landing whose
+ * commits could not be listed falls back to resetting the branch to the exact
+ * OID it had before the iteration, which is always correct for a local-only
+ * merge that was never pushed (and `inbox/merge` never pushes: host auto-merge
+ * is disabled and returns a handoff instead).
+ */
+export declare function revertCommandFor(beforeHead: string, afterHead: string, commits: LandedCommit[]): string;
+/**
+ * Re-run each landed-on repo's OWN required verify commands against the MERGED
+ * head, and decide whether the run may continue.
+ *
+ * Fast in the common case: when no enrolled repo moved, this is one
+ * `git rev-parse` per repo and returns `no-landing` without running anything.
+ * The expensive path only runs when something actually merged, which is exactly
+ * when it is worth paying for.
+ *
+ * `halt` is true for `regressed` and `unverifiable` and for nothing else.
+ * Never throws.
+ */
+export declare function runPostMergeGate(before: RepoHeadSnapshot[], after: RepoHeadSnapshot[], cfg: AshlrConfig, seams?: PostMergeGateSeams & {
+    signal?: AbortSignal;
+}): Promise<PostMergeGateResult>;
+export declare function postMergeHaltDir(): string;
+/**
+ * Persist the halt durably (exclusive tmp + atomic rename) and audit it.
+ * Returns the record path, or null when it could not be written — a write
+ * failure must never itself throw out of the loop's shutdown path.
+ */
+export declare function recordPostMergeHalt(result: PostMergeGateResult, opts?: {
+    now?: () => number;
+}): string | null;
+/** Read halt records back, newest first. Best-effort; never throws. */
+export declare function readPostMergeHalts(limit?: number): PostMergeHaltRecord[];