@brainervirus/workit-core 7.6.0 → 8.0.0

package/src/ledger.ts

@@ -130,8 +130,22 @@ export type VerdictRow = RowCommon & {
   evidenceRefs: string[];
 };
 export type HandoffRow = RowCommon & { type: "handoff"; note: string | null; next: string };
+/** A lead's standing order for every worker of a fanout ("no new dependencies"). */
+export type StandingRow = RowCommon & { type: "standing"; fanout: string; what: string };
+/** Ends one standing order (`target`), or every one recorded before it (null). */
+export type StandingClearedRow = RowCommon & {
+  type: "standing.cleared";
+  fanout: string;
+  target: string | null;
+};
 
-export type LedgerRow = DecisionRow | RulingRow | VerdictRow | HandoffRow;
+export type LedgerRow =
+  | DecisionRow
+  | RulingRow
+  | VerdictRow
+  | HandoffRow
+  | StandingRow
+  | StandingClearedRow;
 /** A row as read back: any known or future type, plus its position. */
 export type ReadRow = RowCommon &
   Record<string, unknown> & {
@@ -747,6 +761,8 @@ export type RejectReason =
   | "no_session"
   | "author_session"
   | "failing_verdict"
+  /** The only passing current verdict is `type-check-only`, which proves no behavior. */
+  | "type_check_only"
   | "no_verdict";
 
 export type VerdictEntry = {
@@ -769,7 +785,10 @@ export type VerdictCheck = {
   patchId: string | null;
   /** Newest current verdict (else newest verdict): does it still apply? */
   current: { basis: VerdictBasis; verdict: ReadRow | null };
-  /** What merge gates read: an accepted verdict and no current independent failure. */
+  /**
+   * What merge gates read: an accepted strong (`verified`/`tests-verified`)
+   * verdict and no current independent failure. `type-check-only` never counts.
+   */
   accepted: { accepted: boolean; verdict: ReadRow | null; reasons: RejectReason[] };
   review: ReviewLabel;
   /** The newest current, strong, self verdict when `review` is self-reviewed. */
@@ -829,10 +848,17 @@ const independenceReasons = (row: ReadRow, authors: Set<string>): RejectReason[]
 /**
  * The effective verdict of one kind, walking rows in order: a self verdict
  * never displaces an independent one, and an independent failed/blocked
- * verdict sticks until an independent verdict from a different session (or
- * its own session's supersede) replaces it.
+ * verdict sticks, for the code it judged, until an independent verdict from a
+ * different session (or its own session's supersede) replaces it. A verdict
+ * from the same session on different code (`sameCode` false: a real change,
+ * not a carry or restack of the failed code) is a re-review of the fix and
+ * replaces it.
  */
-function effectiveOf(rows: readonly ReadRow[], authors: Set<string>): ReadRow | null {
+function effectiveOf(
+  rows: readonly ReadRow[],
+  authors: Set<string>,
+  sameCode: (failed: ReadRow, row: ReadRow) => boolean,
+): ReadRow | null {
   let effective: ReadRow | null = null;
   for (const row of rows) {
     if (!effective) {
@@ -845,7 +871,8 @@ function effectiveOf(rows: readonly ReadRow[], authors: Set<string>): ReadRow |
     if (
       effIndependent &&
       FAILING.has(String(effective.result)) &&
-      row.actor.session === effective.actor.session
+      row.actor.session === effective.actor.session &&
+      sameCode(effective, row)
     )
       continue;
     effective = row;
@@ -899,15 +926,24 @@ export function checkVerdicts(cwd: string, branch: string, rows: readonly ReadRo
   const head = branchHead(cwd, branch);
   const fallbackBase = defaultBase(cwd);
   const keyCache = new Map<string, { patchId: string | null; diffHash: string | null }>();
-  const keyFor = (base: string | null) => {
-    if (!base || !head) return { patchId: null, diffHash: null };
-    let key = keyCache.get(base);
+  const keysAt = (base: string | null, at: string | null) => {
+    if (!base || !at) return { patchId: null, diffHash: null };
+    const cacheKey = `${base}\0${at}`;
+    let key = keyCache.get(cacheKey);
     if (!key) {
-      key = { patchId: patchId(cwd, base, head), diffHash: diffHash(cwd, base, head) };
-      keyCache.set(base, key);
+      key = { patchId: patchId(cwd, base, at), diffHash: diffHash(cwd, base, at) };
+      keyCache.set(cacheKey, key);
     }
     return key;
   };
+  const keyFor = (base: string | null) => keysAt(base, head);
+  // A newer row is judged under the failure's own base, so a row recorded
+  // with a different --base cannot make unchanged code look changed.
+  const sameCode = (failed: ReadRow, row: ReadRow): boolean =>
+    verdictBasis(failed, {
+      head: row.head,
+      ...keysAt(failed.base ?? fallbackBase, row.head),
+    }) !== "stale" || restackCarries(rows, branch, failed.head, row.head);
   const authors = authorSessions(cwd, rows, branch, { base: fallbackBase, head });
   const byKind = new Map<string, ReadRow[]>();
   for (const row of rows)
@@ -917,7 +953,7 @@ export function checkVerdicts(cwd: string, branch: string, rows: readonly ReadRo
     }
   const verdicts: VerdictEntry[] = [];
   for (const [kind, list] of byKind) {
-    const row = effectiveOf(list, authors);
+    const row = effectiveOf(list, authors, sameCode);
     if (!row) continue;
     let basis = verdictBasis(row, { head, ...keyFor(row.base ?? fallbackBase) });
     if (basis === "stale" && restackCarries(rows, branch, row.head, head)) basis = "carried";
@@ -943,7 +979,10 @@ export function checkVerdicts(cwd: string, branch: string, rows: readonly ReadRo
   const failing = verdicts.find(
     (entry) => entry.current && entry.independent && FAILING.has(String(entry.verdict.result)),
   );
-  const newestAccepted = verdicts.findLast((entry) => entry.accepted) ?? null;
+  const newestAccepted =
+    verdicts.findLast(
+      (entry) => entry.accepted && STRONG_RESULTS.has(String(entry.verdict.result)),
+    ) ?? null;
   const accepted =
     newestAccepted && !failing
       ? { accepted: true, verdict: newestAccepted.verdict, reasons: [] }
@@ -952,7 +991,11 @@ export function checkVerdicts(cwd: string, branch: string, rows: readonly ReadRo
           verdict: failing?.verdict ?? null,
           reasons: failing
             ? (["failing_verdict"] as RejectReason[])
-            : (newestCurrent?.reasons ?? (["no_verdict"] as RejectReason[])),
+            : !newestCurrent
+              ? (["no_verdict"] as RejectReason[])
+              : newestCurrent.reasons.length
+                ? newestCurrent.reasons
+                : (["type_check_only"] as RejectReason[]),
         };
   const selfEntry = failing
     ? undefined
@@ -1076,6 +1119,142 @@ export function recordRuling(
   );
 }
 
+/**
+ * May this row speak for the fanout's lead? With recorded leads (the current
+ * one and any it took over from) only their rows count; a plan from before
+ * leads (null) takes any session.
+ */
+const fromLead = (row: ReadRow, leads: readonly string[] | null): boolean =>
+  leads === null || (row.actor.session !== null && leads.includes(row.actor.session));
+
+/**
+ * The standing orders in force for `fanout`, oldest first (D17: odd rows are
+ * skipped). Given the plan's lead session, orders and clears recorded by any
+ * other session are ignored, so a worker can neither add nor clear one.
+ */
+export function activeStanding(
+  rows: readonly ReadRow[],
+  fanout: string,
+  leads: readonly string[] | null = null,
+): ReadRow[] {
+  const active: ReadRow[] = [];
+  for (const row of rows) {
+    if (row.fanout !== fanout || !fromLead(row, leads)) continue;
+    if (row.type === "standing" && typeof row.what === "string" && row.what.trim()) {
+      if (!row.superseded) active.push(row);
+    } else if (row.type === "standing.cleared") {
+      const target = str(row.target);
+      if (target === null) active.length = 0;
+      else {
+        const index = active.findIndex((order) => order.id === target);
+        if (index >= 0) active.splice(index, 1);
+      }
+    }
+  }
+  return active;
+}
+
+/**
+ * A worker or verifier session by the ids workit hands out: `fanout brief`'s
+ * `<lead>-w-<slice>[+try<n>]`, a verifier's `<lead>-v<n>`, the Claude Code
+ * hook's `<lead>:<agent id>` and `--as` ids (`<session>:<role>:<hex>`). Host
+ * session ids carry no colon. Used where no recorded lead decides: plans that
+ * predate `leadSession`, and `fanout plan --take-lead`.
+ */
+export const isDelegateSession = (session: string | null): boolean =>
+  session !== null &&
+  (/-w-[a-z0-9._-]+(?:\+try\d)?$/u.test(session) ||
+    /-v\d+$/u.test(session) ||
+    session.includes(":"));
+
+/**
+ * Standing orders come from the fanout's lead: the session that first made
+ * the plan (`lead`). A plan without one falls back to refusing the session
+ * ids handed to workers and verifiers.
+ */
+function leadOnly(context: RecordContext, lead: string | null): LedgerResult<void> {
+  const session = context.actor.session;
+  if (lead !== null ? session === lead : !isDelegateSession(session))
+    return { ok: true, value: undefined };
+  return err(
+    "blocked",
+    lead !== null
+      ? `session ${session ?? "(none)"} is not the fanout's lead (${lead}): standing orders come from the lead`
+      : `session ${session} is a worker or verifier: standing orders come from the lead`,
+    lead !== null
+      ? `the lead in a new session? workit fanout plan <plan.json> --take-lead from this session; a worker or verifier reports the order to the lead instead`
+      : "a worker or verifier reports the order to the lead instead",
+  );
+}
+
+export function recordStanding(
+  context: RecordContext,
+  input: { fanout: string; lead: string | null; what?: string },
+): LedgerResult<StandingRow> {
+  const what = required(input.what, "<order>");
+  if (!what.ok) return what;
+  // One order per line of every brief: a newline or control character would
+  // let an order forge other brief fields.
+  if (/\p{Cc}/u.test(what.value))
+    return err(
+      "invalid_input",
+      "a standing order is one line: no newlines or control characters",
+      'add each order separately: workit ledger standing add "<order>"',
+    );
+  const lead = leadOnly(context, input.lead);
+  if (!lead.ok) return lead;
+  const link = checkSupersede(context, "standing");
+  if (!link.ok) return link;
+  return appendRow<StandingRow>(
+    context.cwd,
+    {
+      ...common(context, noteKey(context)),
+      type: "standing",
+      fanout: input.fanout,
+      what: what.value,
+    },
+    { now: context.now },
+  );
+}
+
+/** Clear one standing order by id (it must be in force), or all of them; lead only. */
+export function clearStanding(
+  context: RecordContext,
+  input: {
+    fanout: string;
+    lead: string | null;
+    leads?: readonly string[] | null;
+    target: string | null;
+  },
+): LedgerResult<StandingClearedRow> {
+  const lead = leadOnly(context, input.lead);
+  if (!lead.ok) return lead;
+  if (input.target !== null) {
+    const ledger = readLedger(context.cwd);
+    if (!ledger.ok) return ledger;
+    if (
+      !activeStanding(ledger.value.rows, input.fanout, input.leads ?? null).some(
+        (row) => row.id === input.target,
+      )
+    )
+      return err(
+        "not_found",
+        `no standing order ${input.target} in force for fanout ${input.fanout}`,
+        `workit ledger standing list --fanout ${input.fanout}`,
+      );
+  }
+  return appendRow<StandingClearedRow>(
+    context.cwd,
+    {
+      ...common(context, noteKey(context)),
+      type: "standing.cleared",
+      fanout: input.fanout,
+      target: input.target,
+    },
+    { now: context.now },
+  );
+}
+
 /**
  * Record an agent-asserted verdict on a branch's committed head. Refused on a
  * dirty worktree (the head would not be what was judged) and, for an author
@@ -1194,7 +1373,7 @@ export type RowSummary = {
 };
 
 /** Row types that count only when an observing verb wrote them. */
-const OBSERVED_ONLY: ReadonlySet<string> = new Set(["check", ...PR_ROW_TYPES]);
+const OBSERVED_ONLY: ReadonlySet<string> = new Set(["check", "merge.unverified", ...PR_ROW_TYPES]);
 
 export function rowLabels(row: ReadRow): RowSummary["labels"] {
   const labels: RowSummary["labels"] = [];
@@ -1221,6 +1400,12 @@ export function summarizeRow(row: ReadRow): RowSummary {
     case "handoff":
       summary = `next: ${text("next")}${text("note") ? ` (note: ${text("note")})` : ""}`;
       break;
+    case "standing":
+      summary = `${text("what")} (fanout ${text("fanout")})`;
+      break;
+    case "standing.cleared":
+      summary = `cleared ${text("target") || "every standing order"} (fanout ${text("fanout")})`;
+      break;
     case "commit.recorded":
       summary = `${(row.head ?? "?").slice(0, 12)} ${text("subject")}${row.actor.session ? "" : " (no session)"}`;
       break;
@@ -1234,6 +1419,9 @@ export function summarizeRow(row: ReadRow): RowSummary {
     case "pr.merged":
       summary = `#${row.pr ?? "?"} ${text("method")} at ${(row.head ?? "?").slice(0, 12)}${text("mergeSha") ? ` -> ${text("mergeSha").slice(0, 12)}` : ""}`;
       break;
+    case "merge.unverified":
+      summary = `#${row.pr ?? "?"} unverified merge requested at ${(row.head ?? "?").slice(0, 12)} (reason: ${text("reason")})`;
+      break;
     case "delivery.verified":
       summary = `${text("expect")} delivered at ${(row.head ?? "?").slice(0, 12)}`;
       break;

package/src/stack.ts

@@ -996,6 +996,7 @@ export type StopReason =
   | "not_ready"
   | "no_verdict"
   | "needs_verdict"
+  | "failed_verdict"
   | "grant_required"
   | "max_reached"
   | "merge_refused"
@@ -1096,8 +1097,9 @@ const verdictOf = (cwd: string, branch: string, rows: readonly ReadRow[]) => {
 /**
  * Does the root-most open PR qualify to land? Order: a PR exists and is
  * open, it targets the trunk, the forge says READY, an accepted verdict
- * covers the head (unless the grant is `merge: true`), and the grant allows
- * merging. `ready` says everything but the grant holds ("verified, ready").
+ * covers the head (unless `bypass`: `--unverified` under `merge: true`), and
+ * the grant allows merging. `ready` says everything but the grant holds
+ * ("verified, ready").
  */
 export function qualify(
   ctx: Pick<Ctx, "cwd" | "resolved">,
@@ -1108,6 +1110,8 @@ export function qualify(
   grant: GrantDecision,
   /** Why the PR number no longer belongs to this branch (null: it does). */
   binding: string | null = null,
+  /** `stack land --unverified`: skip the verdict where the grant allows it. */
+  bypass = false,
 ): Qualification {
   const label = entry.pr ? noun(ctx.resolved, entry.pr) : entry.branch;
   const stop = (reason: StopReason, detail: string, unblock: string, ready = false) => ({
@@ -1149,12 +1153,19 @@ export function qualify(
         ? `workit ci wait --pr ${entry.pr}`
         : `workit pr status --pr ${entry.pr}`,
     );
-  const requireVerdict = grant.allowed ? grant.requireVerdict : true;
-  if (requireVerdict && !verdict.accepted)
+  const allowUnverified = grant.allowed && grant.allowUnverified;
+  // The bypass covers a missing verdict, never a rejection.
+  if (bypass && allowUnverified && verdict.reasons.includes("failing_verdict"))
+    return stop(
+      "failed_verdict",
+      `${label} has a current independent failed verdict for ${doc.head.sha.slice(0, 12)}; --unverified never lands over a rejection`,
+      "a new independent verdict on the head supersedes it",
+    );
+  if (!(bypass && allowUnverified) && !verdict.accepted)
     return stop(
       verdict.reasons.includes("no_verdict") ? "no_verdict" : "needs_verdict",
       `${label} has no accepted independent verdict for ${doc.head.sha.slice(0, 12)} (${verdict.reasons.join(", ") || "none"})`,
-      `an independent session verifies ${entry.branch} and runs: workit ledger verdict verified --how "<what was exercised>" --branch ${entry.branch}`,
+      `an independent session verifies ${entry.branch} and runs: workit ledger verdict verified --how "<what was exercised>" --branch ${entry.branch}${allowUnverified ? `; or, only if the user asks to land unverified: workit stack land --unverified --reason "<why>"` : ""}`,
     );
   if (!grant.allowed)
     return stop(
@@ -1701,6 +1712,8 @@ export type LandOptions = {
   dryRun: boolean;
   max: number | null;
   method: MergeMethod;
+  /** Land without verdicts (`merge: true` only); each bypass is recorded. */
+  unverified?: { reason: string } | null;
   /** How long to wait for CI on a PR that was just restacked. */
   timeoutMs: number;
   intervalMs: number;
@@ -1709,7 +1722,8 @@ export type LandOptions = {
 export type LandOutcome = {
   name: string;
   dryRun: boolean;
-  landed: Array<{ pr: number; branch: string; mergeSha: string | null }>;
+  /** `unverified`: the ledger row of an `--unverified` bypass, else null. */
+  landed: Array<{ pr: number; branch: string; mergeSha: string | null; unverified: string | null }>;
   /** Dry run: the PRs that qualify now, in order (later ones assume a clean restack). */
   wouldLand: Array<{ pr: number; branch: string }>;
   stoppedAt: {
@@ -1778,6 +1792,23 @@ export async function landStack(
   });
   const mismatch = repoMismatch(ctx, stack);
   if (mismatch) return failWith(mismatch);
+  const bypass = options.unverified ?? null;
+  if (bypass) {
+    const grant = requireGrant(ctx.cwd, "merge");
+    if (!grant.allowed)
+      return failWith(
+        stackFail("blocked", grant.error, grant.unblock, { reason: "grant_required" }),
+      );
+    if (!grant.allowUnverified)
+      return failWith(
+        stackFail(
+          "blocked",
+          `unverified_refused: workspace ${grant.workspace ? `"${grant.workspace}"` : "(none)"} grants merge: "verified", which never lands without an accepted independent verdict`,
+          "a non-author session verifies each head (workit-review), then land without --unverified",
+          { reason: "unverified_refused" },
+        ),
+      );
+  }
 
   // Catch up first: a parent merged elsewhere leaves the rest to restack.
   if (!options.dryRun) {
@@ -1847,6 +1878,7 @@ export async function landStack(
       verdict,
       grant,
       doc ? prBinding(ctx, entry, doc) : null,
+      bypass !== null,
     );
     if (!q.ok) {
       outcome.stoppedAt = {
@@ -1874,6 +1906,7 @@ export async function landStack(
         deleteBranch: false,
         actor: ctx.actor,
         expect: { base: stack.trunk, branch: entry.branch },
+        ...(bypass && !verdict.accepted ? { unverified: bypass } : {}),
       },
       ctx.sleep,
     );
@@ -1891,7 +1924,12 @@ export async function landStack(
       }
       return failWith(stackFail(merged.code, merged.error, merged.unblock));
     }
-    outcome.landed.push({ pr, branch: entry.branch, mergeSha: merged.data.mergeSha });
+    outcome.landed.push({
+      pr,
+      branch: entry.branch,
+      mergeSha: merged.data.mergeSha,
+      unverified: merged.data.unverified?.recorded ?? null,
+    });
     entry.merged = { pr, mergeSha: merged.data.mergeSha, at: new Date().toISOString() };
     const written = writeStack(ctx.cwd, stack);
     if (!written.ok) return failWith(written);