@bluewombat/slots 0.1.2 → 0.3.0

package/README.md

@@ -3,37 +3,35 @@
 The Planner, Builder, and Gate commands that ship with mason. A Project points
 its config at one of these paths; nothing here is imported.
 
-```json
-"planner": ["node", "./node_modules/@bluewombat/slots/planners/one-subtask.mjs"],
-"builder": {
-  "producer": {
-    "cmd": [
-      "node", "./node_modules/@bluewombat/slots/builders/producer.mjs",
-      "--prompt-file", "./build.md",
-      "--",
-      "node", "./node_modules/@bluewombat/slots/agents/claude.mjs"
-    ],
-    "timeoutMs": 600000
-  },
-  "repair": {
-    "cmd": [
-      "node", "./node_modules/@bluewombat/slots/builders/repair.mjs",
-      "--prompt-file", "./repair.md",
-      "--",
-      "node", "./node_modules/@bluewombat/slots/agents/claude.mjs"
-    ],
-    "timeoutMs": 600000
-  },
-  "gates": {
-    "defaultTimeoutMs": 120000,
-    "gates": [
-      {
-        "id": "workspace-changed",
-        "argv": ["node", "./node_modules/@bluewombat/slots/gates/workspace-changed.mjs"]
-      }
-    ]
-  }
-}
+```yaml
+planner:
+  cmd: [node, ./node_modules/@bluewombat/slots/planners/one-subtask.mjs]
+builder:
+  producer:
+    cmd:
+      - node
+      - ./node_modules/@bluewombat/slots/builders/producer.mjs
+      - --prompt-file
+      - ./build.md
+      - --
+      - node
+      - ./node_modules/@bluewombat/slots/agents/claude.mjs
+    timeoutMs: 600000
+  repair:
+    cmd:
+      - node
+      - ./node_modules/@bluewombat/slots/builders/repair.mjs
+      - --prompt-file
+      - ./repair.md
+      - --
+      - node
+      - ./node_modules/@bluewombat/slots/agents/claude.mjs
+    timeoutMs: 600000
+  gates:
+    defaultTimeoutMs: 120000
+    gates:
+      - id: workspace-changed
+        argv: [node, ./node_modules/@bluewombat/slots/gates/workspace-changed.mjs]
 ```
 
 A slot is an opaque command: it reads argv and writes one JSON line on stdout.
@@ -65,9 +63,11 @@ these all use it. How Host wires a slot into a run:
 | `builders/producer.mjs`       | Builder   | First pass of a Subtask: fill `{{task}}`, then spawn the agent                             |
 | `builders/repair.mjs`         | Builder   | A Gate refused the Subtask: fill `{{task}}` and `{{report}}`                               |
 | `assembly/fix.mjs`            | Builder   | A judgement refused the assembled feature: fill `{{task}}` and `{{report}}`                |
+| `assembly/validate.mjs`       | Builder   | Read-only review of the assembled feature: fill `{{task}}`; answers `MASON_VERDICT: VALIDATED` or `MASON_VERDICT: REFUSED: …` |
 | `gates/workspace-changed.mjs` | Gate      | The Attempt left an uncommitted change                                                     |
 | `gates/parent-clean.mjs`      | Gate      | Isolator's Parent working files did not move                                               |
 | `gates/sensitive-path.mjs`    | Gate      | No path matching a glob was touched                                                        |
+| `gates/gitignore-leak.mjs`    | Gate      | The feature's commits add nothing its own `.gitignore` excludes                            |
 | `gates/ci-green.mjs`          | Gate      | The work line's own checks came back green                                                 |
 | `planners/one-subtask.mjs`    | Planner   | Bootstrap: one Subtask that is the FeatureStandard itself                                  |
 | `publishers/git.mjs`          | Publisher | Pushes the feature's branch to the work line's own remote                                  |
@@ -80,13 +80,16 @@ these all use it. How Host wires a slot into a run:
 
 A vendor CLI is not a Builder. `agents/cursor.mjs` and `agents/claude.mjs` take
 a prompt that is **already filled**, run the vendor, write a transcript if asked,
-and print the serialized run on stdout. They do not know `--intention` or
-`--report`. A role slot after `--` is what names one:
-
-```json
-"--",
-"node", "./node_modules/@bluewombat/slots/agents/cursor.mjs",
-"--transcript-dir", "./.mason/transcripts"
+and print the serialized run on stdout with `writeContract` (so a large
+stream-json transcript survives `process.exit`). They do not know `--intention`
+or `--report`. A role slot after `--` is what names one:
+
+```yaml
+- --
+- node
+- ./node_modules/@bluewombat/slots/agents/cursor.mjs
+- --transcript-dir
+- ./.mason/transcripts
 ```
 
 `cursor.mjs` needs `cursor-agent` on PATH (`cursor-agent login`); `claude.mjs`
@@ -154,18 +157,18 @@ in: it names no part of mason, because none of it is visible from there. What
 changes from one Project to the next is that text, not the agent, so it is a
 template file on the role:
 
-```json
-"builder": {
-  "producer": {
-    "cmd": [
-      "node", "./node_modules/@bluewombat/slots/builders/producer.mjs",
-      "--prompt-file", "./mason-prompt.md",
-      "--",
-      "node", "./node_modules/@bluewombat/slots/agents/cursor.mjs"
-    ],
-    "timeoutMs": 600000
-  }
-}
+```yaml
+builder:
+  producer:
+    cmd:
+      - node
+      - ./node_modules/@bluewombat/slots/builders/producer.mjs
+      - --prompt-file
+      - ./mason-prompt.md
+      - --
+      - node
+      - ./node_modules/@bluewombat/slots/agents/cursor.mjs
+    timeoutMs: 600000
 ```
 
 A path that names a file next to the config resolves against the config; any
@@ -182,6 +185,7 @@ assembly, so `assembly/fix` does not fill it at all.
 | `builders/producer` | `{{task}}`, `{{rules}}`               | `{{done_when}}`, `{{id}}`, `{{attempt}}`                   |
 | `builders/repair`   | `{{task}}`, `{{report}}`, `{{rules}}` | `{{refused_by}}`, `{{done_when}}`, `{{id}}`, `{{attempt}}` |
 | `assembly/fix`      | `{{task}}`, `{{report}}`, `{{rules}}` | `{{refused_by}}`, `{{id}}`, `{{attempt}}`                  |
+| `assembly/validate` | `{{task}}`, `{{rules}}`               | `{{id}}`, `{{attempt}}`                                    |
 
 A first-pass command that receives `--report` is `fail-blocking`: that report
 belongs to the repair command. A repair or fix command without `--report` is the same.
@@ -203,6 +207,27 @@ The units already passed. `assembly/fix.mjs` tells the agent to change what the
 refusal names and leave the rest. Same placeholders as repair except
 `{{done_when}}`, which an assembly has nothing to fill.
 
+### The validate prompt
+
+`assembly/validate.mjs` is a different kind of Builder: it never writes. It
+fills only `{{task}}` and `{{rules}}` — there is nothing to fix yet, so no
+`{{report}}` — and asks the agent to end its final message with one line:
+`MASON_VERDICT: VALIDATED` or `MASON_VERDICT: REFUSED: <one paragraph>`. Its
+own `{{rules}}` default is not `PROMPT_RULES`: a review has no work to leave
+uncommitted and nothing to push, so it says "read-only" instead of "do not
+commit, do not push".
+
+The slot does not trust the CLI's exit code alone — a review can complete
+cleanly and still find a problem. It reads the agent's own final answer
+(`readResult(run.stdout)?.result`) for the **last** line starting with
+`MASON_VERDICT:` — not a bare search for "VALIDATED" or "REFUSED" anywhere in
+the text, which a model's own reasoning can contain by accident ("the units
+were already validated on their own"). It maps a `REFUSED:` verdict through
+`emitFailure("fail-retryable", …)` itself, the report being what followed
+`REFUSED:` on that line. No `MASON_VERDICT:` line, or one that is neither
+form, is treated the same way, naming what the agent said: a review that did
+not answer as asked is not a silent pass.
+
 ### The rules
 
 `{{rules}}` holds the bounds of the slot: one directory, work left uncommitted,
@@ -229,18 +254,18 @@ them — `skills` and `usage` (`unknown`, `(none)`, or the values). Files are
 filed under the Feature the Task belongs to, named for the Subtask and the
 Attempt. It belongs on the **agent** command, after `--`.
 
-```json
-"builder": {
-  "producer": {
-    "cmd": [
-      "node", "./node_modules/@bluewombat/slots/builders/producer.mjs",
-      "--",
-      "node", "./node_modules/@bluewombat/slots/agents/cursor.mjs",
-      "--transcript-dir", "./.mason/transcripts"
-    ],
-    "timeoutMs": 600000
-  }
-}
+```yaml
+builder:
+  producer:
+    cmd:
+      - node
+      - ./node_modules/@bluewombat/slots/builders/producer.mjs
+      - --
+      - node
+      - ./node_modules/@bluewombat/slots/agents/cursor.mjs
+      - --transcript-dir
+      - ./.mason/transcripts
+    timeoutMs: 600000
 ```
 
 ```
@@ -263,29 +288,21 @@ Every Gate answers with one JSON object on stdout — `{"verdict":"pass"}`, or
 in, and what mason appends to its argv, is in
 [`@bluewombat/runtime`](../../host/runtime/README.md).
 
-```json
-"builder": { "gates": {
-  "defaultTimeoutMs": 120000,
-  "gates": [
-    {
-      "id": "workspace-changed",
-      "argv": ["node", "./node_modules/@bluewombat/slots/gates/workspace-changed.mjs"]
-    },
-    {
-      "id": "parent-clean",
-      "argv": ["node", "./node_modules/@bluewombat/slots/gates/parent-clean.mjs"]
-    },
-    {
-      "id": "sensitive-path",
-      "argv": [
-        "node",
-        "./node_modules/@bluewombat/slots/gates/sensitive-path.mjs",
-        "**/.env",
-        "**/secrets/**"
-      ]
-    }
-  ]
-} }
+```yaml
+builder:
+  gates:
+    defaultTimeoutMs: 120000
+    gates:
+      - id: workspace-changed
+        argv: [node, ./node_modules/@bluewombat/slots/gates/workspace-changed.mjs]
+      - id: parent-clean
+        argv: [node, ./node_modules/@bluewombat/slots/gates/parent-clean.mjs]
+      - id: sensitive-path
+        argv:
+          - node
+          - ./node_modules/@bluewombat/slots/gates/sensitive-path.mjs
+          - "**/.env"
+          - "**/secrets/**"
 ```
 
 `workspace-changed` fail-retries when the workspace has no uncommitted change —
@@ -298,31 +315,52 @@ producer to send back.
 (`--parent DIR`, or the other git worktrees of this Child).
 
 `sensitive-path` fail-retries if the workspace changed a path matching a glob.
-`*` is one segment, `**` any depth.
+`*` is one segment, `**` any depth. It looks at what a fold can carry out of
+the workspace — tracked paths, and new ones `.gitignore` does not exclude — so
+what an install left under an ignored directory (a dependency's own `.github/`)
+is not a change to guard.
+
+`gitignore-leak --base REF` fail-retries if the feature's commits add a path the
+workspace's own `.gitignore` excludes — a Builder's `node_modules/`, a build's
+`dist/`, a generated file. `REF` is the work line the feature is offered to
+(`main`): only what the feature adds since it left that line is judged, and
+only what is committed, so a path tracked on purpose before the feature began
+is not blamed on it, and a removal staged but not committed does not pass. The
+report is written for `assembly.fix`: untrack the paths, or change `.gitignore`
+if tracking one is the point. It passes at `--stage unit`, where no commit
+holds a Subtask's work yet.
+
+It is a second line, not the first: the `isolation-git` fold already keeps an
+ignored path out of the commits it makes. It catches a leak that came some
+other way — another isolation strategy, an agent that committed. Like every
+assembly Gate, with an Authority it judges what was published, so it stops the
+fold into the work line, not the push.
+
+```yaml
+assembly:
+  gates:
+    defaultTimeoutMs: 900000
+    gates:
+      - id: gitignore-leak
+        argv: [node, ./node_modules/@bluewombat/slots/gates/gitignore-leak.mjs, --base, main]
+      - id: ci-green
+        argv:
+          - node
+          - ./node_modules/@bluewombat/slots/gates/ci-green.mjs
+          - --token-env
+          - MASON_GITHUB_TOKEN
+          - --require-checks
+```
 
 `ci-green` reads the work line's own checks on what this workspace published,
-and answers on them. It reads and nothing else — it does not push, does not open
-a pull request, does not merge. Whoever put the work in front of the checks did
-that before the Gate ran; a workspace with nothing published is `fail-blocking`,
-because no Attempt of that Task can change it.
-
-```json
-"assembly": { "gates": {
-  "defaultTimeoutMs": 900000,
-  "gates": [
-    {
-      "id": "ci-green",
-      "argv": [
-        "node",
-        "./node_modules/@bluewombat/slots/gates/ci-green.mjs",
-        "--token-env",
-        "MASON_GITHUB_TOKEN",
-        "--require-checks"
-      ]
-    }
-  ]
-} }
-```
+and answers on them: GitHub Actions' check runs and the commit statuses a CI
+outside Actions reports (Vercel, Netlify, Jenkins…) — the two lists GitHub
+shows on a pull request. A pending status is still running; a failed one's
+report is its context, what it said, and its link. It reads and nothing else —
+it does not push, does not open a pull request, does not merge. Whoever put
+the work in front of the checks did that before the Gate ran; a workspace
+with nothing published is `fail-blocking`, because no Attempt of that Task
+can change it.
 
 It waits while checks are running, so give it a ceiling of its own. On a red
 check the report carries the failing job's log, cut at the error the runner
@@ -334,11 +372,11 @@ the variable holding a token that can read the checks — the same one the
 manager's `tokenEnv` names. It has no default on purpose: `GITHUB_TOKEN` is
 what `gh` reads ahead of its own login, so an operator must not export it,
 and a Gate that fell back to it refused only at the first assembly of a real
-run. `--remote` and `--poll-ms` are there too. It talks to GitHub, and knows
+run. `--remote`, `--poll-ms` and `--api-base` (GitHub Enterprise) are there too. It talks to GitHub, and knows
 nothing about `@bluewombat/manager-github`: a Project may run either one
 without the other.
 
-`sensitive-path`, `workspace-changed` and `ci-green` need a git workspace, which
+`sensitive-path`, `workspace-changed`, `gitignore-leak` and `ci-green` need a git workspace, which
 is what Isolator makes when WorkLineStable is a git tree. They fail-block on a
 workspace Isolator had to copy.
 
@@ -352,16 +390,17 @@ it takes no option.
 before answering and writes nothing into it. `--prompt-file` and `--read` belong
 on the role; the vendor is named after `--`, the same way a Builder names it.
 
-```json
-"planner": {
-  "cmd": [
-    "node", "./node_modules/@bluewombat/slots/planners/producer.mjs",
-    "--read", "./work-line-stable",
-    "--",
-    "node", "./node_modules/@bluewombat/slots/agents/cursor.mjs"
-  ],
-  "timeoutMs": 600000
-}
+```yaml
+planner:
+  cmd:
+    - node
+    - ./node_modules/@bluewombat/slots/planners/producer.mjs
+    - --read
+    - ./work-line-stable
+    - --
+    - node
+    - ./node_modules/@bluewombat/slots/agents/cursor.mjs
+  timeoutMs: 600000
 ```
 
 | Option               | Meaning                                                       |
@@ -406,6 +445,9 @@ that places its work some other way writes its own Publisher and changes nothing
 else. A refusal stops the Submission and travels back to the tracker; a slot that
 could not run at all exits non-zero and says why on stderr.
 
+`git.mjs` runs git with `LC_ALL=C`: the refusal quotes git, and it is posted on a
+tracker a team reads, whatever language the machine that ran it speaks.
+
 ## Refreshers
 
 The other half of the Publisher's seam: what the Authority accepted has moved the
@@ -426,7 +468,8 @@ else, so it answers `ok` with nothing to do.
 A refusal stops the pass: nothing starts, and the next one tries again. The
 reason is written for the person who reads `mason run`'s trace: the copy is the
 system's, nothing in it is worth keeping, and the reason says the one command
-that puts it back.
+that puts it back. Git runs with `LC_ALL=C` here too, for the same reason as the
+Publisher.
 
 ## Stack
 

package/agents/claude.mjs

@@ -11,6 +11,7 @@ import {
   serializeRun,
   textOption,
   transcriptFor,
+  writeContract,
 } from "@bluewombat/slot-kit";
 import { extrasFromClaude } from "./claude-extras.mjs";
 
@@ -88,7 +89,7 @@ answer(run, bin, extras);
 
 /** @param {string} reason @returns {never} */
 function refuse(reason) {
-  process.stdout.write(`${JSON.stringify({ error: reason })}\n`);
+  writeContract(`${JSON.stringify({ error: reason })}\n`);
   process.exit(1);
 }
 
@@ -99,7 +100,7 @@ function refuse(reason) {
  * @returns {never}
  */
 function answer(run, binPath, extras) {
-  process.stdout.write(
+  writeContract(
     `${JSON.stringify(
       serializeRun(run, { name: NAME, bin: binPath, skills: extras.skills, usage: extras.usage }),
     )}\n`,

package/agents/cursor.mjs

@@ -11,6 +11,7 @@ import {
   serializeRun,
   textOption,
   transcriptFor,
+  writeContract,
 } from "@bluewombat/slot-kit";
 import { extrasFromCursor } from "./cursor-extras.mjs";
 
@@ -82,7 +83,7 @@ answer(run, bin, extras);
 
 /** @param {string} reason @returns {never} */
 function refuse(reason) {
-  process.stdout.write(`${JSON.stringify({ error: reason })}\n`);
+  writeContract(`${JSON.stringify({ error: reason })}\n`);
   process.exit(1);
 }
 
@@ -93,7 +94,7 @@ function refuse(reason) {
  * @returns {never}
  */
 function answer(run, binPath, extras) {
-  process.stdout.write(
+  writeContract(
     `${JSON.stringify(
       serializeRun(run, { name: NAME, bin: binPath, skills: extras.skills, usage: extras.usage }),
     )}\n`,

package/assembly/validate.mjs

@@ -0,0 +1,204 @@
+#!/usr/bin/env node
+import {
+  BUILDER_FLAGS,
+  emitFailure,
+  failureOf,
+  fillPrompt,
+  loadPrompt,
+  loadRules,
+  parseRole,
+  readResult,
+  spawnFilled,
+  take,
+  textOption,
+  transcriptArgs,
+} from "@bluewombat/slot-kit";
+import { attemptOf } from "../lib/fill.mjs";
+
+const NAME = "assembly validate";
+
+const DEFAULT_TEMPLATE = `You are a coding agent working unattended in a checkout of the project.
+
+This directory is the assembled feature. Every unit of work that makes it up
+has already been validated on its own. Your job now is different: read the
+diff this feature carries against the work line it will land on, and judge
+whether the WHOLE meets what was asked. Do not redo the units. Do not change
+anything — this is a read-only review, not a repair.
+
+## What was asked
+
+{{task}}
+
+## Your answer
+
+End your final message with exactly one line in this form, and nothing after
+it:
+
+- \`MASON_VERDICT: VALIDATED\` — the assembled feature meets what was asked.
+- \`MASON_VERDICT: REFUSED: <one paragraph>\` — it does not, and the paragraph
+  says what is wrong, specifically enough for another agent to fix it without
+  redoing your review. Keep the whole paragraph on that one line.
+
+Nothing else may start a line with \`MASON_VERDICT:\`. You may explain your
+reasoning before it, but that line is what is read — write it last.
+
+## Rules of this run
+
+{{rules}}
+`;
+
+/**
+ * A reviewer's bounds: read-only, and answer in the one shape the caller
+ * parses. `PROMPT_RULES` tells a producer to leave work uncommitted and push
+ * nothing — obligations a Task that writes nothing does not have.
+ */
+const DEFAULT_RULES = [
+  "- Work only inside this directory. Do not read or edit anything outside it.",
+  "- This is a review, not a repair: do not change, stage, commit, or stash any file.",
+  "- Judge the diff against the intention above, not the style of the units that made it.",
+  "- Nobody is watching this run and nobody will answer a question. Where the intention is",
+  "  ambiguous, take the reading most consistent with the existing code, and say which one",
+  "  you took in your answer.",
+  "- End your final message with one line: MASON_VERDICT: VALIDATED, or",
+  "  MASON_VERDICT: REFUSED: <one paragraph, on that one line>.",
+].join("\n");
+
+const report = (take(process.argv, "--report") ?? "").trim();
+if (report.length > 0) {
+  emitFailure(
+    "fail-blocking",
+    "assembly.validate is a read-only review; it does not take --report — that is assembly.fix's job.",
+  );
+  process.exit(1);
+}
+
+const intention = (take(process.argv, "--intention") ?? "").trim();
+if (intention.length === 0) {
+  emitFailure("fail-blocking", "The Builder received no --intention.");
+  process.exit(1);
+}
+
+const parsed = parseRole(process.argv, BUILDER_FLAGS, NAME);
+if (!parsed.ok) {
+  emitFailure("fail-blocking", parsed.reason);
+  process.exit(1);
+}
+
+const template = loadPrompt(parsed.options, DEFAULT_TEMPLATE);
+if (!template.ok) {
+  emitFailure("fail-blocking", template.reason);
+  process.exit(1);
+}
+const rules = loadRules(parsed.options, DEFAULT_RULES);
+if (!rules.ok) {
+  emitFailure("fail-blocking", rules.reason);
+  process.exit(1);
+}
+
+const rendered = fillPrompt(
+  template.value,
+  {
+    task: intention,
+    rules: rules.value.trim(),
+    id: take(process.argv, "--id") ?? "",
+    attempt: String(attemptOf(process.argv)),
+  },
+  ["task", "rules"],
+  textOption(parsed.options, "promptFile") ?? "built-in template",
+);
+if (!rendered.ok) {
+  emitFailure("fail-blocking", rendered.reason);
+  process.exit(1);
+}
+
+const spawned = await spawnFilled(parsed.runner, rendered.prompt, transcriptArgs(process.argv));
+if (!spawned.ok) {
+  emitFailure("fail-blocking", spawned.reason);
+  process.exit(1);
+}
+
+answer(spawned.run, spawned.about.bin, spawned.about.name);
+
+/**
+ * Read the agent's own verdict and map it through `emitFailure` — never
+ * through exit 0 alone. A review that completes cleanly still has to answer
+ * whether the work is right; the CLI exiting 0 only says the review ran.
+ *
+ * @param {import("@bluewombat/slot-kit").AgentRun} run
+ * @param {string} bin
+ * @param {string} name
+ * @returns {never}
+ */
+function answer(run, bin, name) {
+  if (run.error !== undefined || run.code !== 0) {
+    const failure = failureOf(run, bin, name);
+    emitFailure(failure.outcome, failure.report);
+    process.exit(1);
+  }
+  const result = readResult(run.stdout);
+  if (result?.is_error === true) {
+    const failure = failureOf(run, bin, name);
+    emitFailure(failure.outcome, failure.report);
+    process.exit(1);
+  }
+  const said = typeof result?.result === "string" ? result.result.trim() : "";
+  const verdict = lastVerdictLine(said);
+  if (verdict === undefined) {
+    // No `MASON_VERDICT:` line at all is not a pass on the strength of exit 0.
+    // Treated as retryable, the same as any other malformed Attempt — the
+    // next round gets the same prompt again.
+    emitFailure(
+      "fail-retryable",
+      `assembly.validate found no MASON_VERDICT: line in the answer: ${
+        said.length > 0 ? said.slice(0, 500) : "(no answer)"
+      }`,
+    );
+    process.exit(1);
+  }
+  const refused = /^REFUSED:?\s*/i.exec(verdict);
+  if (refused !== null) {
+    const why = verdict.slice(refused[0].length).trim();
+    emitFailure(
+      "fail-retryable",
+      why.length > 0
+        ? why
+        : "assembly.validate refused the assembled feature, with no reason given.",
+    );
+    process.exit(1);
+  }
+  if (/^VALIDATED\b/i.test(verdict)) {
+    process.exit(0);
+  }
+  emitFailure(
+    "fail-retryable",
+    `assembly.validate's MASON_VERDICT: line was neither VALIDATED nor REFUSED: ${verdict.slice(0, 500)}`,
+  );
+  process.exit(1);
+}
+
+/**
+ * The text after the last line that starts with `MASON_VERDICT:`, or
+ * `undefined` when no such line exists.
+ *
+ * A distinctive, unlikely-to-collide marker, anchored to the start of a line
+ * — not a bare search for "VALIDATED" or "REFUSED" anywhere in the answer,
+ * which a model's own reasoning can contain by accident ("the units were
+ * already validated on their own"). The *last* such line wins: a model that
+ * restates its conclusion, or that is shown an example in the prompt, still
+ * means its final one.
+ *
+ * @param {string} text
+ * @returns {string | undefined}
+ */
+function lastVerdictLine(text) {
+  const marker = /^MASON_VERDICT:\s*/i;
+  const lines = text.split("\n");
+  for (let i = lines.length - 1; i >= 0; i -= 1) {
+    const line = (lines[i] ?? "").trim();
+    const match = marker.exec(line);
+    if (match !== null) {
+      return line.slice(match[0].length).trim();
+    }
+  }
+  return undefined;
+}

package/gates/ci-green.mjs

@@ -2,13 +2,16 @@
 import { spawnSync } from "node:child_process";
 import { emitVerdict, GATE_FLAGS, ownArgv } from "@bluewombat/slot-kit";
 
-// The work line's own checks, on the work this workspace published.
+// The work line's own checks, on the work this workspace published: GitHub
+// Actions' check runs, and the commit statuses CI outside Actions reports
+// (Vercel, Netlify, Jenkins…), the two lists GitHub itself shows on a PR.
 //
 // It reads and nothing else: it does not push, does not open anything, does not
 // merge. Whoever put the work in front of the checks did that before this Gate
 // ran; this Gate only says whether the answer came back green.
 //
 //   --remote NAME        default: origin
+//   --api-base URL       default: https://api.github.com (GitHub Enterprise)
 //   --poll-ms N          how often to ask again while checks are running
 //   --token-env NAME     required: the variable holding a token that can read
 //                        the checks. No default on purpose — GITHUB_TOKEN is the
@@ -18,7 +21,6 @@ import { emitVerdict, GATE_FLAGS, ownArgv } from "@bluewombat/slot-kit";
 //   --require-checks     wait for a check to appear; without it, a commit with no
 //                        check at all passes
 
-const API = "https://api.github.com";
 // What the runner writes at the top of every step it runs.
 const STEP_OPEN = "##[group]Run ";
 const COLOUR = new RegExp(`${String.fromCharCode(27)}\\[[0-9;]*m`, "g");
@@ -29,6 +31,7 @@ if (!options.ok) {
   emitVerdict("fail-blocking", options.reason);
   process.exit(0);
 }
+const apiBase = options.apiBase;
 
 if (git(["rev-parse", "--is-inside-work-tree"]).stdout.trim() !== "true") {
   emitVerdict("fail-blocking", "ci-green needs a git workspace.");
@@ -88,10 +91,11 @@ for (;;) {
 
 /**
  * @param {readonly string[]} tokens
- * @returns {{ ok: true; remote: string; pollMs: number; tokenEnv: string; requireChecks: boolean } | { ok: false; reason: string }}
+ * @returns {{ ok: true; remote: string; apiBase: string; pollMs: number; tokenEnv: string; requireChecks: boolean } | { ok: false; reason: string }}
  */
 function parseOwnArgv(tokens) {
   let remote = "origin";
+  let apiBase = "https://api.github.com";
   let pollMs = 15_000;
   let tokenEnv;
   let requireChecks = false;
@@ -108,6 +112,8 @@ function parseOwnArgv(tokens) {
     i += 1;
     if (token === "--remote") {
       remote = value;
+    } else if (token === "--api-base") {
+      apiBase = value.replace(/\/+$/, "");
     } else if (token === "--token-env") {
       tokenEnv = value;
     } else if (token === "--poll-ms") {
@@ -127,7 +133,7 @@ function parseOwnArgv(tokens) {
         "ci-green needs --token-env NAME: the environment variable holding a token that can read the checks (the same one @bluewombat/manager-github's tokenEnv names, never GITHUB_TOKEN).",
     };
   }
-  return { ok: true, remote, pollMs, tokenEnv, requireChecks };
+  return { ok: true, remote, apiBase, pollMs, tokenEnv, requireChecks };
 }
 
 /**
@@ -187,6 +193,12 @@ async function readChecks(sha) {
   if (!Array.isArray(checkRuns)) {
     return undefined;
   }
+  // A token that may read check runs but not statuses reads as no status at
+  // all: what this Gate did before it read them.
+  const combined = record(
+    await api(`/repos/${repo.owner}/${repo.name}/commits/${sha}/status?per_page=100`),
+  );
+  const statuses = Array.isArray(combined?.statuses) ? combined.statuses : [];
   /** @type {string[]} */
   const failed = [];
   // One workflow can run the same job for two events (push, pull_request)
@@ -213,7 +225,28 @@ async function readChecks(sha) {
     seen.add(heading);
     failed.push(`${heading}${typeof run.id === "number" ? await logOf(run.id) : ""}`);
   }
-  return { total: checkRuns.length, running, failed };
+  // The latest status per context. No log to cut here: what the reporter said
+  // and where it said more is all there is.
+  for (const entry of statuses) {
+    const status = record(entry) ?? {};
+    if (status.state === "pending") {
+      running += 1;
+      continue;
+    }
+    if (status.state === "success") {
+      continue;
+    }
+    const heading = `${status.context}: ${status.state ?? "failed"}`;
+    if (seen.has(heading)) {
+      continue;
+    }
+    seen.add(heading);
+    const more = [status.description, status.target_url].filter(
+      (text) => typeof text === "string" && text.length > 0,
+    );
+    failed.push([heading, ...more].join("\n"));
+  }
+  return { total: checkRuns.length + statuses.length, running, failed };
 }
 
 /**
@@ -279,7 +312,7 @@ async function logOf(jobId) {
  */
 async function api(path, as = "json") {
   try {
-    const response = await fetch(`${API}${path}`, {
+    const response = await fetch(`${apiBase}${path}`, {
       headers: {
         authorization: `Bearer ${token}`,
         accept: "application/vnd.github+json",

package/gates/gitignore-leak.mjs

@@ -0,0 +1,117 @@
+#!/usr/bin/env node
+import { spawnSync } from "node:child_process";
+import { emitVerdict, GATE_FLAGS, ownArgv, stageOf } from "@bluewombat/slot-kit";
+
+// Fail-retryable when the feature's commits add a path the workspace's own
+// .gitignore excludes — a Builder's node_modules/, a build's dist/, a generated
+// file — so it would ship in the Submission.
+//
+// --base REF (required): the work line the feature is offered to. Only what the
+// feature adds since it left that line is judged, in what is committed: a path
+// tracked on purpose before the feature began is not this feature's leak, and
+// a removal staged but not committed has not removed anything yet.
+//
+// A unit only: nothing. A Subtask's work is uncommitted until a fold records it,
+// so there is no commit of its own here to judge.
+
+const cwd = process.cwd();
+const tokens = ownArgv(process.argv, GATE_FLAGS);
+
+let base;
+for (let i = 0; i < tokens.length; i++) {
+  const token = tokens[i];
+  if (token === "--base") {
+    const value = tokens[i + 1];
+    if (value === undefined || value.startsWith("-")) {
+      emitVerdict("fail-blocking", "gitignore-leak needs a ref after --base.");
+      process.exit(0);
+    }
+    base = value;
+    i += 1;
+    continue;
+  }
+  emitVerdict("fail-blocking", `gitignore-leak does not take "${token}". Use --base <ref>.`);
+  process.exit(0);
+}
+
+if (base === undefined) {
+  emitVerdict(
+    "fail-blocking",
+    "gitignore-leak needs --base <ref>: the work line the feature is offered to.",
+  );
+  process.exit(0);
+}
+
+if (git(["rev-parse", "--is-inside-work-tree"]).stdout.trim() !== "true") {
+  emitVerdict("fail-blocking", "gitignore-leak needs a git workspace.");
+  process.exit(0);
+}
+
+if (stageOf(process.argv) !== "assembly") {
+  emitVerdict("pass");
+  process.exit(0);
+}
+
+if (git(["rev-parse", "--verify", "--quiet", `${base}^{commit}`]).status !== 0) {
+  emitVerdict("fail-blocking", `gitignore-leak cannot find --base "${base}" in this workspace.`);
+  process.exit(0);
+}
+
+// --no-renames: a path moved under an ignored directory shows as added there.
+const added = git([
+  "diff",
+  "--name-only",
+  "--no-renames",
+  "--diff-filter=A",
+  "-z",
+  `${base}...HEAD`,
+]);
+if (added.status !== 0) {
+  emitVerdict(
+    "fail-blocking",
+    `gitignore-leak cannot diff HEAD against "${base}": ${added.stderr.trim()}`,
+  );
+  process.exit(0);
+}
+if (added.stdout.length === 0) {
+  emitVerdict("pass");
+  process.exit(0);
+}
+
+// --no-index: these paths are tracked, and the question is whether the
+// patterns match them, not whether git would still pick them up.
+const ignored = spawnSync("git", ["-C", cwd, "check-ignore", "--no-index", "--stdin", "-z"], {
+  input: added.stdout,
+  encoding: "utf8",
+});
+// 0: some match; 1: none does; anything else is git failing.
+if (ignored.status === 1) {
+  emitVerdict("pass");
+  process.exit(0);
+}
+if (ignored.status !== 0) {
+  emitVerdict(
+    "fail-blocking",
+    `gitignore-leak cannot run git check-ignore: ${ignored.stderr.trim()}`,
+  );
+  process.exit(0);
+}
+
+const leaked = ignored.stdout.split("\0").filter(Boolean);
+const shown = leaked.slice(0, 50);
+const rest = leaked.length - shown.length;
+emitVerdict(
+  "fail-retryable",
+  [
+    `These paths are committed on top of ${base}, and this workspace's .gitignore excludes them.`,
+    "Take them out of the commit with git rm -r --cached <path> and keep the files. If the",
+    "feature does mean to track one, change .gitignore so it no longer excludes it:",
+    ...shown,
+    ...(rest > 0 ? [`… and ${rest} more`] : []),
+  ].join("\n"),
+);
+
+/** @param {string[]} args */
+function git(args) {
+  return spawnSync("git", ["-C", cwd, ...args], { encoding: "utf8" });
+}

package/gates/sensitive-path.mjs

@@ -1,11 +1,16 @@
 #!/usr/bin/env node
 import { spawnSync } from "node:child_process";
-import { readdirSync, readFileSync } from "node:fs";
-import { join, relative } from "node:path";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
 import { emitVerdict, GATE_FLAGS, ownArgv, pathMatchesGlob } from "@bluewombat/slot-kit";
 
 // Fail-retryable when the workspace changed a path matching a glob.
 // Remaining argv after Implementer's flags are the globs.
+//
+// Only paths a fold can carry out of the workspace: tracked ones, and new ones
+// .gitignore does not exclude. What a Builder's own install left under an
+// ignored directory (a dependency's own .github/) stays in the workspace, so
+// changing it is not a change to guard.
 
 const cwd = process.cwd();
 const globs = ownArgv(process.argv, GATE_FLAGS).filter((token) => token.length > 0);
@@ -22,17 +27,23 @@ if (git(cwd, ["rev-parse", "--is-inside-work-tree"]).stdout.trim() !== "true") {
 
 const hit = new Set();
 
-walkFiles(cwd, (file) => {
-  const posix = relative(cwd, file).replaceAll("\\", "/");
-  if (!matchesAny(posix, globs)) {
-    return;
+const listed = git(cwd, ["ls-files", "-z", "--cached", "--others", "--exclude-standard"]);
+if (listed.status !== 0) {
+  emitVerdict("fail-blocking", `sensitive-path cannot list the workspace: ${listed.stderr.trim()}`);
+  process.exit(0);
+}
+for (const posix of new Set(listed.stdout.split("\0").filter(Boolean))) {
+  const file = join(cwd, posix);
+  // A tracked path gone from disk is a deletion, read below.
+  if (!matchesAny(posix, globs) || !existsSync(file)) {
+    continue;
   }
   const onDisk = readFileSync(file);
   const atHead = blobAtHead(cwd, posix);
   if (atHead === null || Buffer.compare(onDisk, atHead) !== 0) {
     hit.add(posix);
   }
-});
+}
 
 const deleted = git(cwd, ["diff", "--name-only", "--diff-filter=D", "HEAD"]);
 if (deleted.status === 0) {
@@ -70,32 +81,6 @@ function blobAtHead(workspace, path) {
   return result.stdout;
 }
 
-/**
- * @param {string} dir
- * @param {(file: string) => void} visit
- */
-function walkFiles(dir, visit) {
-  let entries;
-  try {
-    entries = readdirSync(dir, { withFileTypes: true });
-  } catch {
-    return;
-  }
-  for (const entry of entries) {
-    if (entry.name === ".git") {
-      continue;
-    }
-    const full = join(dir, entry.name);
-    if (entry.isDirectory()) {
-      walkFiles(full, visit);
-      continue;
-    }
-    if (entry.isFile()) {
-      visit(full);
-    }
-  }
-}
-
 /**
  * @param {string} workspace
  * @param {string[]} args

package/messages/conventional.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { emitMessage, MESSAGE_FLAGS, ownArgv, take } from "@bluewombat/slot-kit";
+import { emitMessage, MESSAGE_FLAGS, ownArgv, take, writeDiagnostic } from "@bluewombat/slot-kit";
 
 // The feature's commit in the Conventional Commits shape, from the issue's
 // title and body and with no agent: `<type>: <title>`, the body as written.
@@ -27,7 +27,7 @@ const forcedType = take(own, "--type");
 const title = (take(process.argv, "--title") ?? "").trim();
 const intention = (take(process.argv, "--intention") ?? "").trim();
 if (title.length === 0) {
-  process.stderr.write("conventional: no --title.\n");
+  writeDiagnostic("conventional: no --title.\n");
   process.exit(1);
 }
 

package/messages/git-producer.mjs

@@ -13,6 +13,7 @@ import {
   take,
   textOption,
   transcriptArgs,
+  writeDiagnostic,
 } from "@bluewombat/slot-kit";
 
 // The feature's commit message — and the pull request's description with it
@@ -146,6 +147,6 @@ function readAnswer(path) {
 
 /** @param {string} reason @returns {never} */
 function fail(reason) {
-  process.stderr.write(`${reason}\n`);
+  writeDiagnostic(`${reason}\n`);
   process.exit(1);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bluewombat/slots",
-  "version": "0.1.2",
+  "version": "0.3.0",
   "type": "module",
   "description": "Shipped mason slots: Planners, Builders, Gates, publishers, and refreshers a Project names in its config.",
   "keywords": [
@@ -53,6 +53,6 @@
     "test": "tsx --test $(find test -name '*.test.ts')"
   },
   "dependencies": {
-    "@bluewombat/slot-kit": "^0.1.2"
+    "@bluewombat/slot-kit": "^0.3.0"
   }
 }

package/planners/producer.mjs

@@ -14,6 +14,7 @@ import {
   take,
   textOption,
   transcriptArgs,
+  writeDiagnostic,
 } from "@bluewombat/slot-kit";
 
 const NAME = "planner producer";
@@ -227,6 +228,6 @@ function tail(output) {
 
 /** @param {string} reason @returns {never} */
 function fail(reason) {
-  process.stderr.write(`${reason}\n`);
+  writeDiagnostic(`${reason}\n`);
   process.exit(1);
 }

package/publishers/git.mjs

@@ -8,6 +8,7 @@ import {
   ownArgv,
   PUBLISHER_FLAGS,
   take,
+  writeDiagnostic,
 } from "@bluewombat/slot-kit";
 
 // Put the feature's work where the Authority can read it, by pushing the name
@@ -45,11 +46,14 @@ if (!existsSync(join(cwd, ".git"))) {
   process.exit(0);
 }
 
+// C locale: git's words become the refusal a team reads on the tracker, and a
+// machine's own language would put French or German in an English thread.
 const pushed = spawnSync("git", ["-C", cwd, "push", remote, `${ref}:${ref}`], {
   encoding: "utf8",
+  env: { ...process.env, LC_ALL: "C" },
 });
 if (pushed.error !== undefined) {
-  process.stderr.write(`git publisher cannot run git: ${pushed.error.message}\n`);
+  writeDiagnostic(`git publisher cannot run git: ${pushed.error.message}\n`);
   process.exit(1);
 }
 if (pushed.status !== 0) {

package/refreshers/git.mjs

@@ -69,7 +69,13 @@ if (merged.status !== 0) {
 
 emitRefreshed();
 
-/** @param {string[]} args */
+/**
+ * C locale, as in the Publisher: what git says here ends up in a report.
+ * @param {string[]} args
+ */
 function git(args) {
-  return spawnSync("git", ["-C", cwd, ...args], { encoding: "utf8" });
+  return spawnSync("git", ["-C", cwd, ...args], {
+    encoding: "utf8",
+    env: { ...process.env, LC_ALL: "C" },
+  });
 }