@brainervirus/workit-core 8.23.0 → 8.24.0

package/src/hooks/stop.ts

@@ -11,11 +11,15 @@
 //       or merged;
 //   (c) verdict: the session opened the PR (or verified delivery) but the
 //       head lacks the verdict the policy asks for, while the endpoint is
-//       green or merged (a PR opens without one): the author's own `--self`
-//       verdict at normal risk under `verification: self`, an accepted
-//       non-author verdict at high risk or under `verification: independent`.
-//       Not raised when the task's latest judgment records no behavior
-//       change at normal risk (policy/derive.ts asks for none either), nor while a verifier or reviewer this lead started still runs.
+//       green or merged (a PR opens without one). Under `verification:
+//       proportional` (the default) the review lane of the head decides
+//       (core/policy/lane.ts): none owes nothing, self the author's own
+//       `--self` verdict, focused and full an accepted non-author verdict.
+//       Under `self`: the author's own at normal risk; at high risk or under
+//       `independent`: a non-author one, and not raised when the task's
+//       latest judgment records no behavior change at normal risk
+//       (policy/derive.ts asks for none either). Never raised while a
+//       verifier or reviewer this lead started still runs.
 // Each obligation blocks once per head and session (a marker keyed by kind
 // and head), not once per turn.
 // A branch that landed owes nothing: a recorded merge (`workit pr merge`, or
@@ -29,10 +33,9 @@
 // the ledger and local git only (no forge call), and every failure allows
 // the stop.
 import { spawnSync } from "node:child_process";
-import { resolveAutonomy } from "../autonomy";
-import { latestJudgment } from "../core/policy/derive";
-import type { Judgment } from "../core/task-contract";
-import { TaskStore } from "../core/task-store";
+import { resolveAutonomy, type VerificationMode } from "../autonomy";
+import { currentJudgment } from "../core/policy/current-judgment";
+import { branchLane, laneNeed } from "../core/policy/lane";
 import { currentBranch, pushRemoteName } from "../git/rev";
 import { checkVerdicts, readLedger, type ReadRow } from "../ledger";
 import type { HostDescriptor } from "./descriptor";
@@ -237,43 +240,57 @@ const redChecks = (
   };
 };
 
-/** The open task's latest judgment (the one policy/derive.ts reads), or null when none is recorded. */
-const taskJudgment = (cwd: string): Judgment | null => {
-  try {
-    const store = new TaskStore(cwd);
-    const listed = store.listTaskIndex();
-    const key = store.currentKey();
-    if (!listed.ok || !key.ok) return null;
-    const entry = listed.data
-      .filter((item) => item.key === key.data.key && item.status !== "closed")
-      .toSorted((left, right) => right.updatedAt.localeCompare(left.updatedAt))[0];
-    const task = entry ? store.readTask(entry.id) : null;
-    return task?.ok === true ? latestJudgment(task.data) : null;
-  } catch {
-    return null;
-  }
+/**
+ * The base the branch's PR targets: the newest the forge reported (a
+ * `pr.status` row, so a PR retargeted on the forge is read against its
+ * current base), else the one it was opened with (`pr.created`), else null
+ * (the default base). Read from the ledger: the hook never calls the forge.
+ */
+const prBase = (rows: readonly ReadRow[]): string | null => {
+  const seen = rows.findLast(
+    (row) =>
+      (row.type === "pr.status" || row.type === "pr.created") &&
+      row.observer === "workit_cli" &&
+      typeof row.base === "string",
+  );
+  return typeof seen?.base === "string" ? seen.base : null;
 };
 
 /**
  * (c) Delivered by this session, yet the head lacks the verdict the policy
- * asks for: the author's own at normal risk when the workspace's
- * verification is `self`, else an accepted non-author one.
+ * asks for. Under `verification: proportional` the review lane of the head
+ * decides (core/policy/lane.ts): none owes nothing, self the author's own,
+ * focused and full a non-author one. Under `self`, the author's own at
+ * normal risk; under `independent` or at high risk, a non-author one.
  */
 const unverified = (
   cwd: string,
   branch: string,
   all: readonly ReadRow[],
   descriptor: HostDescriptor,
-  verification: "self" | "independent",
+  verification: VerificationMode,
+  head: string | null,
 ): StopObligation | null => {
   const check = checkVerdicts(cwd, branch, all);
   if (check.accepted.accepted || check.accepted.reasons.includes("failing_verdict")) return null;
-  const judgment = taskJudgment(cwd);
+  const judgment = currentJudgment(cwd);
   const high = judgment?.riskTier === "high";
-  // Like policy/derive.ts: a verdict is asked for a behavior change or high
-  // risk. A recorded judgment with neither (docs only) owes none.
-  if (judgment && !judgment.behaviorChange && !high) return null;
-  const independent = verification === "independent" || high;
+  let independent: boolean;
+  if (verification === "proportional") {
+    const lane = branchLane(cwd, {
+      base: prBase(all.filter((row) => row.branch === branch)),
+      head,
+      judgment,
+    });
+    const need = laneNeed(lane.lane);
+    if (need === "none") return null;
+    independent = need === "non-author";
+  } else {
+    // Like policy/derive.ts: a verdict is asked for a behavior change or high
+    // risk. A recorded judgment with neither (docs only) owes none.
+    if (judgment && !judgment.behaviorChange && !high) return null;
+    independent = verification === "independent" || high;
+  }
   if (!independent && check.review === "self-reviewed") return null;
   const has = check.review === "self-reviewed" ? "only a self verdict" : "no current verdict";
   const verifier = `${descriptor.subagents.agentPrefix}verifier`;
@@ -332,7 +349,7 @@ export function stopObligation(
     }
     // A PR opens without a verdict: only green and merged need one.
     if (!delivered || (endpoint !== "green" && endpoint !== "merged")) return null;
-    const left = unverified(input.cwd, branch, all, descriptor, autonomy.verification);
+    const left = unverified(input.cwd, branch, all, descriptor, autonomy.verification, head);
     return left ? { ...left, head } : null;
   } catch {
     return null;

package/src/ledger.ts

@@ -1622,15 +1622,20 @@ export function checkVerdicts(
                 ? newestCurrent.reasons
                 : (["type_check_only"] as RejectReason[]),
         };
-  const selfEntry = failing
+  // The author's latest pass or failure on the current code wins, across
+  // kinds: a newer failure cancels an older pass (review finding mvkcoxgb).
+  const latestSelf = failing
     ? undefined
     : verdicts.findLast(
         (entry) =>
           entry.current &&
           !entry.independent &&
           !untrusted(entry.reasons) &&
-          STRONG_RESULTS.has(String(entry.verdict.result)),
+          (STRONG_RESULTS.has(String(entry.verdict.result)) ||
+            FAILING.has(String(entry.verdict.result))),
       );
+  const selfEntry =
+    latestSelf && STRONG_RESULTS.has(String(latestSelf.verdict.result)) ? latestSelf : undefined;
   return {
     branch,
     head,

package/src/stack.ts

@@ -73,6 +73,8 @@ import {
   type ReadRow,
   type VerdictBasis,
 } from "./ledger";
+import type { LaneNeed, ReviewLane } from "./core/policy/lane";
+import { prLaneGate } from "./core/policy/pr-lane";
 
 export const STACK_VERSION = 1;
 
@@ -1016,7 +1018,20 @@ export type BranchStatus = {
   next: NextAction | null;
   checks: ChecksState | null;
   blockers: string[];
-  verdict: { accepted: boolean; basis: VerdictBasis; reasons: string[]; verdictId: string | null };
+  /**
+   * `accepted`: an accepted independent verdict; `satisfied`: what the land
+   * gate reads, the verdict the PR's review lane asks for (an accepted
+   * independent one outside `verification: proportional`).
+   */
+  verdict: {
+    accepted: boolean;
+    satisfied: boolean;
+    basis: VerdictBasis;
+    reasons: string[];
+    verdictId: string | null;
+    lane: ReviewLane | null;
+    need: LaneNeed;
+  };
 };
 
 export type Qualification =
@@ -1081,16 +1096,27 @@ export function repoMismatch(ctx: Pick<Ctx, "resolved">, stack: StackFile): Stac
   return null;
 }
 
-const verdictOf = (cwd: string, branch: string, rows: readonly ReadRow[]) => {
+const verdictOf = (
+  cwd: string,
+  branch: string,
+  rows: readonly ReadRow[],
+  doc: PrStatusDoc | null,
+): BranchStatus["verdict"] => {
   const check = checkVerdicts(cwd, branch, rows);
+  // Without a PR there is no base to diff against: the gate stays independent.
+  const gate = doc ? prLaneGate(cwd, check, { branch, base: doc.base, head: doc.head.sha }) : null;
   return {
     accepted: check.accepted.accepted,
+    satisfied: gate ? gate.satisfied : check.accepted.accepted,
     basis: check.current.basis,
-    reasons: check.accepted.reasons as string[],
-    verdictId:
-      typeof check.accepted.verdict?.id === "string" && check.accepted.accepted
+    reasons: check.accepted.reasons,
+    verdictId: gate
+      ? gate.verdictId
+      : typeof check.accepted.verdict?.id === "string" && check.accepted.accepted
         ? check.accepted.verdict.id
         : null,
+    lane: gate?.lane.lane ?? null,
+    need: gate?.need ?? "non-author",
   };
 };
 
@@ -1161,12 +1187,20 @@ export function qualify(
       `${label} has a current independent failed verdict for ${doc.head.sha.slice(0, 12)}; --unverified never lands over a rejection`,
       "a new independent verdict on the head supersedes it",
     );
-  if (!(bypass && allowUnverified) && !verdict.accepted)
+  if (!(bypass && allowUnverified) && !verdict.satisfied) {
+    const bypassHint = allowUnverified
+      ? `; or, only if the user asks to land unverified: workit stack land --unverified --reason "<why>"`
+      : "";
     return stop(
       verdict.reasons.includes("no_verdict") ? "no_verdict" : "needs_verdict",
-      `${label} has no accepted independent verdict for ${doc.head.sha.slice(0, 12)} (${verdict.reasons.join(", ") || "none"})`,
-      `an independent session verifies ${entry.branch} and runs: workit ledger verdict verified --how "<what was exercised>" --branch ${entry.branch}${allowUnverified ? `; or, only if the user asks to land unverified: workit stack land --unverified --reason "<why>"` : ""}`,
+      verdict.need === "self"
+        ? `${label} has no verdict for ${doc.head.sha.slice(0, 12)} (lane self: the author's own --self verdict is enough; ${verdict.reasons.join(", ") || "none"})`
+        : `${label} has no accepted independent verdict for ${doc.head.sha.slice(0, 12)}${verdict.lane && verdict.lane !== "none" ? ` (lane ${verdict.lane})` : ""} (${verdict.reasons.join(", ") || "none"})`,
+      verdict.need === "self"
+        ? `after an observed passing \`workit check test\`, the author runs: workit ledger verdict tests-verified --self --how "<what you ran>" --branch ${entry.branch}${bypassHint}`
+        : `an independent session verifies ${entry.branch} and runs: workit ledger verdict verified --how "<what was exercised>" --branch ${entry.branch}${bypassHint}`,
     );
+  }
   if (!grant.allowed)
     return stop(
       "grant_required",
@@ -1215,8 +1249,16 @@ export function stackStatus(ctx: Ctx, stack: StackFile): StackResult<StatusOutco
       checks: doc?.checks.state ?? null,
       blockers: doc?.blockers ?? [],
       verdict: merged
-        ? { accepted: true, basis: "none", reasons: [], verdictId: null }
-        : verdictOf(ctx.cwd, entry.branch, ledger.value.rows),
+        ? {
+            accepted: true,
+            satisfied: true,
+            basis: "none",
+            reasons: [],
+            verdictId: null,
+            lane: null,
+            need: "non-author",
+          }
+        : verdictOf(ctx.cwd, entry.branch, ledger.value.rows, doc),
     };
     branches.push(row);
     if (merged) {
@@ -1866,7 +1908,7 @@ export async function landStack(
       }
     }
     const grant = requireGrant(ctx.cwd, "merge");
-    const verdict = verdictOf(ctx.cwd, entry.branch, ledgerRows());
+    const verdict = verdictOf(ctx.cwd, entry.branch, ledgerRows(), doc);
     // A dry run predicts the retarget the real run would do first.
     const effective =
       options.dryRun && simulated.size > 0 && doc ? { ...doc, base: stack.trunk } : doc;
@@ -1906,7 +1948,7 @@ export async function landStack(
         deleteBranch: false,
         actor: ctx.actor,
         expect: { base: stack.trunk, branch: entry.branch },
-        ...(bypass && !verdict.accepted ? { unverified: bypass } : {}),
+        ...(bypass && !verdict.satisfied ? { unverified: bypass } : {}),
       },
       ctx.sleep,
     );