@brainervirus/workit-core 8.23.0 → 8.25.0

package/src/stack.ts

@@ -62,10 +62,10 @@ import {
   pushRemoteName,
   remoteRefTip,
   resolveRef,
+  sameOwnChange,
 } from "./git/rev";
 import {
   appendObserved,
-  checkVerdicts,
   diffHash,
   readLedger,
   storeRoot,
@@ -73,6 +73,9 @@ import {
   type ReadRow,
   type VerdictBasis,
 } from "./ledger";
+import type { LaneNeed, ReviewLane } from "./core/policy/lane";
+import { prLaneGate } from "./core/policy/pr-lane";
+import { checkVerdictsCovered, type StackCover } from "./verdict-cover";
 
 export const STACK_VERSION = 1;
 
@@ -1016,7 +1019,22 @@ export type BranchStatus = {
   next: NextAction | null;
   checks: ChecksState | null;
   blockers: string[];
-  verdict: { accepted: boolean; basis: VerdictBasis; reasons: string[]; verdictId: string | null };
+  /**
+   * `accepted`: an accepted independent verdict; `satisfied`: what the land
+   * gate reads, the verdict the PR's review lane asks for (an accepted
+   * independent one outside `verification: proportional`).
+   */
+  verdict: {
+    accepted: boolean;
+    satisfied: boolean;
+    basis: VerdictBasis;
+    reasons: string[];
+    verdictId: string | null;
+    lane: ReviewLane | null;
+    need: LaneNeed;
+    /** The verdict higher in the stack that covers this branch, when it has none of its own. */
+    cover: StackCover | null;
+  };
 };
 
 export type Qualification =
@@ -1081,16 +1099,29 @@ export function repoMismatch(ctx: Pick<Ctx, "resolved">, stack: StackFile): Stac
   return null;
 }
 
-const verdictOf = (cwd: string, branch: string, rows: readonly ReadRow[]) => {
-  const check = checkVerdicts(cwd, branch, rows);
+const verdictOf = (
+  cwd: string,
+  branch: string,
+  rows: readonly ReadRow[],
+  doc: PrStatusDoc | null,
+): BranchStatus["verdict"] => {
+  // A lower branch may be covered by the verdict at the top of the stack (#334).
+  const check = checkVerdictsCovered(cwd, branch, rows);
+  // Without a PR there is no base to diff against: the gate stays independent.
+  const gate = doc ? prLaneGate(cwd, check, { branch, base: doc.base, head: doc.head.sha }) : null;
   return {
     accepted: check.accepted.accepted,
+    satisfied: gate ? gate.satisfied : check.accepted.accepted,
     basis: check.current.basis,
-    reasons: check.accepted.reasons as string[],
-    verdictId:
-      typeof check.accepted.verdict?.id === "string" && check.accepted.accepted
+    reasons: check.accepted.reasons,
+    verdictId: gate
+      ? gate.verdictId
+      : typeof check.accepted.verdict?.id === "string" && check.accepted.accepted
         ? check.accepted.verdict.id
         : null,
+    lane: gate?.lane.lane ?? null,
+    need: gate?.need ?? "non-author",
+    cover: check.cover,
   };
 };
 
@@ -1161,12 +1192,20 @@ export function qualify(
       `${label} has a current independent failed verdict for ${doc.head.sha.slice(0, 12)}; --unverified never lands over a rejection`,
       "a new independent verdict on the head supersedes it",
     );
-  if (!(bypass && allowUnverified) && !verdict.accepted)
+  if (!(bypass && allowUnverified) && !verdict.satisfied) {
+    const bypassHint = allowUnverified
+      ? `; or, only if the user asks to land unverified: workit stack land --unverified --reason "<why>"`
+      : "";
     return stop(
       verdict.reasons.includes("no_verdict") ? "no_verdict" : "needs_verdict",
-      `${label} has no accepted independent verdict for ${doc.head.sha.slice(0, 12)} (${verdict.reasons.join(", ") || "none"})`,
-      `an independent session verifies ${entry.branch} and runs: workit ledger verdict verified --how "<what was exercised>" --branch ${entry.branch}${allowUnverified ? `; or, only if the user asks to land unverified: workit stack land --unverified --reason "<why>"` : ""}`,
+      verdict.need === "self"
+        ? `${label} has no verdict for ${doc.head.sha.slice(0, 12)} (lane self: the author's own --self verdict is enough; ${verdict.reasons.join(", ") || "none"})`
+        : `${label} has no accepted independent verdict for ${doc.head.sha.slice(0, 12)}${verdict.lane && verdict.lane !== "none" ? ` (lane ${verdict.lane})` : ""} (${verdict.reasons.join(", ") || "none"})`,
+      verdict.need === "self"
+        ? `after an observed passing \`workit check test\`, the author runs: workit ledger verdict tests-verified --self --how "<what you ran>" --branch ${entry.branch}${bypassHint}`
+        : `an independent session verifies ${entry.branch} and runs: workit ledger verdict verified --how "<what was exercised>" --branch ${entry.branch}${bypassHint}`,
     );
+  }
   if (!grant.allowed)
     return stop(
       "grant_required",
@@ -1215,8 +1254,17 @@ export function stackStatus(ctx: Ctx, stack: StackFile): StackResult<StatusOutco
       checks: doc?.checks.state ?? null,
       blockers: doc?.blockers ?? [],
       verdict: merged
-        ? { accepted: true, basis: "none", reasons: [], verdictId: null }
-        : verdictOf(ctx.cwd, entry.branch, ledger.value.rows),
+        ? {
+            accepted: true,
+            satisfied: true,
+            basis: "none",
+            reasons: [],
+            verdictId: null,
+            lane: null,
+            need: "non-author",
+            cover: null,
+          }
+        : verdictOf(ctx.cwd, entry.branch, ledger.value.rows, doc),
     };
     branches.push(row);
     if (merged) {
@@ -1494,7 +1542,7 @@ export function syncStack(
           return stackFail(
             "blocked",
             `a rebase is in progress in ${owner}`,
-            `git -C ${owner} rebase --continue  # or --abort; then workit --cwd ${owner} stack sync`,
+            `git -C ${owner} rebase --continue  # or --abort; then workit stack --cwd ${owner} sync`,
             { conflict: entry.branch, worktree: owner, progress: outcome },
           );
         if (owner && trackedDirt(owner))
@@ -1624,7 +1672,11 @@ export function syncStack(
         };
         const after = { p: patchId(cwd, parentTip, newTip), d: diffHash(cwd, parentTip, newTip) };
         const equal =
-          before.d !== null && before.d === after.d && before.p !== null && before.p === after.p;
+          before.d !== null &&
+          before.d === after.d &&
+          before.p !== null &&
+          before.p === after.p &&
+          sameOwnChange(cwd, { from: fromHead, to: newTip, fromBase, toBase: parentTip });
         appendObserved(cwd, {
           type: "stack.restacked",
           actor,
@@ -1866,7 +1918,7 @@ export async function landStack(
       }
     }
     const grant = requireGrant(ctx.cwd, "merge");
-    const verdict = verdictOf(ctx.cwd, entry.branch, ledgerRows());
+    const verdict = verdictOf(ctx.cwd, entry.branch, ledgerRows(), doc);
     // A dry run predicts the retarget the real run would do first.
     const effective =
       options.dryRun && simulated.size > 0 && doc ? { ...doc, base: stack.trunk } : doc;
@@ -1906,7 +1958,7 @@ export async function landStack(
         deleteBranch: false,
         actor: ctx.actor,
         expect: { base: stack.trunk, branch: entry.branch },
-        ...(bypass && !verdict.accepted ? { unverified: bypass } : {}),
+        ...(bypass && !verdict.satisfied ? { unverified: bypass } : {}),
       },
       ctx.sleep,
     );

package/src/verdict-cover.ts

@@ -0,0 +1,151 @@
+// Stack-wide verdicts (#334, decision mvk5q3io): one verifier at the top of
+// a stack, after its last push, covers the lower PRs it judged. A branch with
+// no accepted verdict of its own is covered by a branch above it in a cached
+// stack (`<store>/stacks/*.json`, S12) when:
+//
+//   - that branch has an accepted independent verdict now (fresh or carried);
+//   - the verdict's session is not an author of the lower branch either;
+//   - every commit of the lower branch since its fork from the trunk has a
+//     verbatim patch-id (whitespace counts) among the commits of the judged
+//     head (the verdict's own head, not the upper branch's current tip): the
+//     lower change was judged unchanged. No merge commits, at least one
+//     non-empty commit;
+//   - the judged head holds exactly the lower branch's resulting files (no
+//     `<lower>..<judged>` difference in any file the lower branch changed):
+//     an upper commit that reverts or rewrites a lower file means the lower
+//     PR's own code was never judged;
+//   - the lower branch's own review lane is below full (decision B3): a risk
+//     path or a large change needs its own verdict.
+//
+// A lower branch that changed after the verdict (a new commit, an amend, a
+// conflict resolved differently) holds a patch-id the judged head lacks and
+// is not covered. When git cannot read any of this, nothing is covered. A current independent failure or a tampered ledger on the
+// lower branch is never covered over. `pr merge`, `stack land`, `stack
+// status`, `pr status` and `ledger check` read this; the Stop hook does not.
+import fs from "node:fs";
+import path from "node:path";
+import { branchLane } from "./core/policy/lane";
+import { commitPatchIds, diffRaw, mergeBase } from "./git/rev";
+import {
+  authorSessions,
+  authoredBy,
+  checkVerdicts,
+  defaultBase,
+  resolveCommit,
+  storeRoot,
+  type ReadRow,
+  type VerdictCheck,
+} from "./ledger";
+
+/** The verdict above `branch` in a stack that covers it. */
+export type StackCover = {
+  stack: string;
+  /** The upper branch the verdict was recorded on. */
+  branch: string;
+  verdictId: string;
+  /** The head that verdict judged. */
+  head: string;
+};
+
+export type CoveredCheck = VerdictCheck & { cover: StackCover | null };
+
+type Chain = { name: string; trunk: string; above: string[] };
+
+const isRecord = (value: unknown): value is Record<string, unknown> =>
+  typeof value === "object" && value !== null && !Array.isArray(value);
+
+/** The open branches above `branch` in each cached stack holding it, top first. */
+function chainsAbove(cwd: string, branch: string): Chain[] {
+  const root = storeRoot(cwd);
+  if (!root.ok) return [];
+  const dir = path.join(root.value.root, "stacks");
+  let names: string[] = [];
+  try {
+    names = fs.readdirSync(dir).filter((name) => name.endsWith(".json"));
+  } catch {
+    return [];
+  }
+  const chains: Chain[] = [];
+  for (const name of names.toSorted()) {
+    let parsed: unknown;
+    try {
+      parsed = JSON.parse(fs.readFileSync(path.join(dir, name), "utf8"));
+    } catch {
+      continue;
+    }
+    if (!isRecord(parsed) || !Array.isArray(parsed.branches) || typeof parsed.trunk !== "string")
+      continue;
+    const entries = parsed.branches.filter(isRecord);
+    const index = entries.findIndex((entry) => entry.branch === branch && !entry.merged);
+    if (index < 0) continue;
+    chains.push({
+      name: typeof parsed.name === "string" ? parsed.name : name,
+      trunk: parsed.trunk,
+      above: entries
+        .slice(index + 1)
+        .filter((entry) => typeof entry.branch === "string" && !entry.merged)
+        .map((entry) => entry.branch as string)
+        .toReversed(),
+    });
+  }
+  return chains;
+}
+
+/**
+ * Whether the verdict on `judged` covers the lower branch at `head` (see the
+ * header). Anything git cannot read is not covered.
+ */
+function covers(cwd: string, trunk: string, head: string, judged: string): boolean {
+  const trunkSha = [`origin/${trunk}`, trunk].map((ref) => resolveCommit(cwd, ref)).find(Boolean);
+  const ownFork = trunkSha ? mergeBase(cwd, trunkSha, head) : null;
+  const judgedFork = trunkSha ? mergeBase(cwd, trunkSha, judged) : null;
+  if (!ownFork || !judgedFork) return false;
+  const own = commitPatchIds(cwd, ownFork, head);
+  const top = commitPatchIds(cwd, judgedFork, judged);
+  if (!own || !top || own.merges > 0 || own.patchIds.length === 0) return false;
+  const judgedIds = new Set(top.patchIds);
+  if (!own.patchIds.every((id) => judgedIds.has(id))) return false;
+  // The judged tree holds exactly the lower branch's resulting files.
+  const changed = diffRaw(cwd, ownFork, head);
+  const between = changed ? diffRaw(cwd, head, judged) : null;
+  if (!changed || !between) return false;
+  const files = new Set(changed.map((entry) => entry.path));
+  if (between.some((entry) => files.has(entry.path))) return false;
+  return branchLane(cwd, { base: trunk, head }).lane !== "full";
+}
+
+/**
+ * `checkVerdicts` for `branch`, and when it has no accepted verdict of its
+ * own, the stack verdict that covers it (see the header): then `accepted`
+ * names that verdict and `cover` says where it came from.
+ */
+export function checkVerdictsCovered(
+  cwd: string,
+  branch: string,
+  rows: readonly ReadRow[],
+): CoveredCheck {
+  const check = checkVerdicts(cwd, branch, rows);
+  const blocked = check.accepted.reasons.some(
+    (reason) => reason === "failing_verdict" || reason === "ledger_tampered",
+  );
+  if (check.accepted.accepted || blocked || !check.head) return { ...check, cover: null };
+  let authors: Set<string> | null = null;
+  for (const chain of chainsAbove(cwd, branch))
+    for (const upper of chain.above) {
+      const verdict = checkVerdicts(cwd, upper, rows).accepted;
+      const row = verdict.accepted ? verdict.verdict : null;
+      const session = row?.actor.session;
+      if (!row?.head || !session || typeof row.id !== "string") continue;
+      authors ??= authorSessions(cwd, rows, branch, { base: defaultBase(cwd), head: check.head });
+      if (authoredBy(authors, session)) continue;
+      if (!covers(cwd, chain.trunk, check.head, row.head)) continue;
+      return {
+        ...check,
+        accepted: { accepted: true, verdict: row, reasons: [] },
+        review: "verified",
+        selfVerdict: null,
+        cover: { stack: chain.name, branch: upper, verdictId: row.id, head: row.head },
+      };
+    }
+  return { ...check, cover: null };
+}