@cleocode/core 2026.9.20 → 2026.9.22

package/dist/tasks/evidence.js

@@ -29,10 +29,12 @@ import { CleoError } from '../errors.js';
 import { describeUnusableEvidenceGitRoot, E_EVIDENCE_GIT_ROOT, findNestedGitWorkTrees, findWorkTreeContainingCommit, gitToplevel, isGitWorkTree, resolveDeclaredEvidenceGitRoot, } from '../git/work-tree.js';
 import { pushWarning } from '../output.js';
 import { getEffectiveHead } from '../worktree/effective-head.js';
+import { loadRecordedProjectRoots, rebaseLegacyEvidencePath } from './evidence-paths.js';
 import { DISABLE_ENV, describeMemoryLimit } from './heavy-tool-limit.js';
 import { computeCommitRevalidationKey, readCommitRevalidationEntry, writeCommitRevalidationEntry, } from './revalidation-cache.js';
 import { resolveSpawnTimeoutMs, runToolCached } from './tool-cache.js';
 import { CANONICAL_TOOLS, listValidToolNames, resolveToolCommand, } from './tool-resolver.js';
+import { detectStaticVacuity, probeTscFileCount, VACUOUS_TOOL_FIX } from './tool-vacuity.js';
 /**
  * Valid tool names recognised by the `tool:<name>` evidence atom.
  *
@@ -217,7 +219,25 @@ siblingCommitSha, context) {
             // db, which is CLEO's own record, not the repository's.
             return validateDecision(parsed.decisionId, roots);
         case 'pr':
-            return validatePrAtom(parsed.prNumber, roots, context);
+            return validatePrAtom(parsed.prNumber, roots, context, parsed.componentPrNumber);
+        case 'ci': {
+            // T12634 (D11149): `gh` runs in the repo (executionRoot); the opt-in,
+            // required-check list and PR cache are CLEO's own records (storeRoot).
+            const { resolveCiEvidenceAtom } = await import('../release/ci-evidence.js');
+            const { loadProjectContext } = await import('../agents/variable-substitution.js');
+            const ctx = loadProjectContext(roots.storeRoot);
+            const result = await resolveCiEvidenceAtom(parsed.prNumber, roots, {
+                projectContext: ctx.loaded ? ctx.context : null,
+                ...(context ? { context } : {}),
+                ...(parsed.componentPrNumber !== undefined
+                    ? { componentPrNumber: parsed.componentPrNumber }
+                    : {}),
+                ...(context?.readOnly ? { readOnly: true } : {}),
+            });
+            return result.ok
+                ? { ok: true, atom: result.atom }
+                : { ok: false, reason: result.reason, codeName: result.codeName };
+        }
         case 'satisfies': {
             // ADR-079-r2: 5-check validator pipeline shipped by T10507.
             // Delegates to the dedicated validator module to keep the dispatch
@@ -1012,6 +1032,14 @@ async function gitShowFileContent(relPath, taskId, projectRoot) {
     // Normalise the path: strip leading "./" so git:show works correctly.
     const norm = relPath.replace(/^\.\//, '');
     // Try task/<taskId> first, then main, then master, then HEAD.
+    //
+    // Ref order is unchanged since T11959 and is identical at verify and at
+    // re-validation. This fallback runs only when the file is absent from disk,
+    // so it answers "does the branch the work was verified on still carry these
+    // bytes?". A tamper committed to main while task/<id> stays pristine is NOT
+    // detected here: that is a change to a different ref, and it surfaces on
+    // disk (checked first) wherever main is checked out. API callers passing a
+    // taskId get this order; `cleo complete` passes none.
     const refs = [`task/${taskId}`, 'main', 'master', 'HEAD'];
     for (const ref of refs) {
         const r = await runCommand('git', ['show', `${ref}:${norm}`], projectRoot);
@@ -1116,6 +1144,7 @@ async function validateFiles(paths, roots, taskId, commitSha, requireCommitArtif
                 reason: `Cannot inspect ${p} at PR merge ${commitSha}; fetch that commit before recording evidence. Current checkout bytes cannot substitute.`,
             };
         }
+        let readFromDisk = false;
         if (content === null && existsSync(abs)) {
             // Happy path — file exists on disk.
             const st = await stat(abs);
@@ -1127,6 +1156,7 @@ async function validateFiles(paths, roots, taskId, commitSha, requireCommitArtif
                 };
             }
             content = await readFile(abs);
+            readFromDisk = true;
         }
         if (content === null && taskId) {
             // T11959: Git-show fallback for branch-only files (worktree context).
@@ -1151,10 +1181,51 @@ async function validateFiles(paths, roots, taskId, commitSha, requireCommitArtif
             };
         }
         const sha256 = createHash('sha256').update(content).digest('hex');
-        files.push({ path: p, sha256 });
+        // T12476: `path` stays exactly as supplied (consumers match it against
+        // repo-relative PR paths). When the bytes came from disk, the absolute
+        // file that was hashed is recorded too, so re-validation reads THAT file
+        // whatever directory `cleo complete` runs from. `resolvedPath` is a
+        // DEVICE-LOCAL hint (an absolute path on this device) and is never
+        // authoritative across devices; re-validation falls back when it is gone.
+        files.push(readFromDisk ? { path: p, sha256, resolvedPath: abs } : { path: p, sha256 });
     }
     return { ok: true, atom: { kind: 'files', files } };
 }
+/**
+ * `tool:test-affected` (D11150, T12635): run `testing.affectedCommand` over the
+ * packages the branch diff touches plus their dependents, through the same
+ * ADR-061 cache and heavy-tool caps as `tool:test` (canonical `test`, so the
+ * memory and timeout limits apply). The atom records `scope: 'affected'` and
+ * the packages, so a receipt never passes for a full run.
+ */
+async function validateAffectedTests(roots) {
+    const { storeRoot, executionRoot } = roots;
+    const { planAffectedTestRun } = await import('./affected-packages.js');
+    const run = await planAffectedTestRun(storeRoot, executionRoot, { wait: true });
+    if (!run.ok)
+        return { ok: false, codeName: run.codeName, reason: run.reason };
+    const result = await runToolCached(run.command, storeRoot, { executionRoot });
+    if (result.exitCode !== 0) {
+        return {
+            ok: false,
+            codeName: result.timedOut ? 'E_EVIDENCE_TOOL_TIMEOUT' : 'E_EVIDENCE_TOOL_FAILED',
+            reason: `tool:test-affected (${[run.command.cmd, ...run.command.args].join(' ')}) exited ${result.exitCode}: ${(result.stderrTail || result.stdoutTail).trim().slice(-300)}`,
+        };
+    }
+    return {
+        ok: true,
+        atom: {
+            kind: 'tool',
+            tool: 'test-affected',
+            exitCode: 0,
+            stdoutTail: result.stdoutTail,
+            scope: 'affected',
+            affectedPackages: run.packages,
+            affectedProjects: run.projects,
+            ...(run.untested.length > 0 ? { untestedPackages: run.untested } : {}),
+        },
+    };
+}
 /**
  * Resolve the tree that evidence tools should RUN in, given the CLEO store
  * root.
@@ -1351,7 +1422,11 @@ async function validateTestRun(path, roots) {
         ok: true,
         atom: {
             kind: 'test-run',
+            // T12476: `path` exactly as supplied; `resolvedPath` is the report that
+            // was hashed, which re-validation reads regardless of cwd. DEVICE-LOCAL:
+            // an absolute path on this device, never authoritative cross-device.
             path,
+            resolvedPath: abs,
             sha256,
             passCount: passed,
             failCount: failed,
@@ -1360,8 +1435,12 @@ async function validateTestRun(path, roots) {
     };
 }
 async function validateTool(tool, roots) {
+    if (tool === 'test-affected')
+        return validateAffectedTests(roots);
     const { storeRoot: projectRoot, executionRoot } = roots;
-    const resolution = resolveToolCommand(tool, projectRoot);
+    // T12633: project-context lives in the store; package.json scripts and
+    // tsconfig describe the code under test, so they are read where it runs.
+    const resolution = resolveToolCommand(tool, projectRoot, { executionRoot });
     // T12083: the project has no such toolchain. This is a fact about the
     // project, not a failure of the work — a plain JavaScript project cannot
     // typecheck, and demanding it means no task in that project can ever be
@@ -1388,6 +1467,18 @@ async function validateTool(tool, roots) {
                 : 'E_EVIDENCE_TOOL_UNAVAILABLE',
         };
     }
+    // T12633: a checker that provably checks nothing is not evidence. Decided
+    // BEFORE the cache lookup, so a pass cached for the vacuous command (every
+    // `npx tsc --noEmit` against a references-only tsconfig) is never served.
+    const staticVacuity = detectStaticVacuity(resolution.command, executionRoot);
+    if (staticVacuity !== null) {
+        return {
+            ok: false,
+            reason: `Tool "${tool}" → ${resolution.command.cmd} ${resolution.command.args.join(' ')} ` +
+                `(${resolution.command.source}) is VACUOUS: ${staticVacuity} Fix: ${VACUOUS_TOOL_FIX}`,
+            codeName: 'E_EVIDENCE_TOOL_VACUOUS',
+        };
+    }
     // gh#1220/#1226/#1230: spawn in — and fingerprint against — the tree the
     // operator actually invoked from, not the shared store root. gh#1365: the
     // root arrives as a parameter now; it is NOT re-resolved here.
@@ -1489,6 +1580,17 @@ async function validateTool(tool, roots) {
             codeName: 'E_EVIDENCE_TOOL_FAILED',
         };
     }
+    // T12633: exit 0 from a direct `tsc` run is only a pass if it compiled
+    // something. `--listFilesOnly` answers that without re-checking.
+    if (probeTscFileCount(resolution.command, result.executionRoot) === 0) {
+        return {
+            ok: false,
+            reason: `Tool "${tool}" → ${resolution.command.cmd} ${resolution.command.args.join(' ')} ` +
+                `exited 0 but is VACUOUS: \`--listFilesOnly\` reports 0 project files in ` +
+                `${result.executionRoot}, so it checked nothing. Fix: ${VACUOUS_TOOL_FIX}`,
+            codeName: 'E_EVIDENCE_TOOL_VACUOUS',
+        };
+    }
     return {
         ok: true,
         atom: { kind: 'tool', tool, exitCode: 0, stdoutTail: result.stdoutTail },
@@ -1808,6 +1910,39 @@ async function validateDecision(decisionId, roots) {
 // ---------------------------------------------------------------------------
 // PR atom (T9764)
 // ---------------------------------------------------------------------------
+/**
+ * The task linkage `pr:` provenance requires, shared with `ci:<pr>` (T12634):
+ * the PR's changed-file inventory is complete, and the PR either cites the
+ * task in its title, body or head branch, or its diff intersects the task's
+ * declared files — and when files are declared, the diff MUST intersect them.
+ *
+ * @param prNumber - The PR being linked.
+ * @param pr - The verified PR (title, body, head branch, changed files).
+ * @param context - The task the evidence is being recorded for.
+ * @returns The refusal, or null when the PR is linked to the task.
+ * @task T12634
+ */
+export function checkPrTaskLinkage(prNumber, pr, context) {
+    if (pr.changedFileCount !== pr.changedPaths.length || pr.changedPaths.length === 0) {
+        return {
+            ok: false,
+            codeName: 'E_EVIDENCE_INSUFFICIENT',
+            reason: `PR #${prNumber} changed-file coverage is incomplete or empty (${pr.changedPaths.length}/${pr.changedFileCount})${pr.changedFilesError ? ` — ${pr.changedFilesError}` : ''}; inspect the full diff before recording evidence.`,
+        };
+    }
+    const declaredFiles = context.task.files ?? [];
+    const taskMention = new RegExp(`(^|[^A-Za-z0-9])${context.task.id}([^A-Za-z0-9]|$)`);
+    const explicitlyLinked = taskMention.test(`${pr.title}\n${pr.body}\n${pr.headRefName}`);
+    const scopeIntersects = declaredFiles.length > 0 && diffIntersectsAc(pr.changedPaths, declaredFiles);
+    if ((!explicitlyLinked && !scopeIntersects) || (declaredFiles.length > 0 && !scopeIntersects)) {
+        return {
+            ok: false,
+            codeName: 'E_EVIDENCE_CONTENT_MISMATCH',
+            reason: `PR #${prNumber} does not establish a relationship to task ${context.task.id}. Changed artifacts: ${pr.changedPaths.join(', ')}. Declare task files or cite the exact task in the PR; declared scope must intersect the diff.`,
+        };
+    }
+    return null;
+}
 /**
  * Validate a `pr:<number>` atom by resolving the PR via the `gh` CLI.
  *
@@ -1821,7 +1956,7 @@ async function validateDecision(decisionId, roots) {
  *
  * @task T9764
  */
-async function validatePrAtom(prNumber, roots, context) {
+async function validatePrAtom(prNumber, roots, context, componentPrNumber) {
     if (!context) {
         return {
             ok: false,
@@ -1848,35 +1983,28 @@ async function validatePrAtom(prNumber, roots, context) {
     // atom needs BOTH roots, and a swap would be as wrong as the original.
     const result = await resolvePrEvidenceAtom(prNumber, roots, {
         projectContext: ctx.loaded ? ctx.context : null,
+        ...(context.readOnly ? { readOnly: true } : {}),
     });
     if (!result.ok) {
         return { ok: false, reason: result.reason, codeName: result.codeName };
     }
-    if (result.changedFileCount !== result.changedPaths.length || result.changedPaths.length === 0) {
-        return {
-            ok: false,
-            codeName: 'E_EVIDENCE_INSUFFICIENT',
-            reason: `PR #${prNumber} changed-file coverage is incomplete or empty (${result.changedPaths.length}/${result.changedFileCount})${result.changedFilesError ? ` — ${result.changedFilesError}` : ''}; inspect the full diff before recording evidence.`,
-        };
-    }
-    const declaredFiles = context.task.files ?? [];
-    const taskMention = new RegExp(`(^|[^A-Za-z0-9])${context.task.id}([^A-Za-z0-9]|$)`);
-    const explicitlyLinked = taskMention.test(`${result.title}\n${result.body}\n${result.headRefName}`);
-    const scopeIntersects = declaredFiles.length > 0 && diffIntersectsAc(result.changedPaths, declaredFiles);
-    if ((!explicitlyLinked && !scopeIntersects) || (declaredFiles.length > 0 && !scopeIntersects)) {
-        return {
-            ok: false,
-            codeName: 'E_EVIDENCE_CONTENT_MISMATCH',
-            reason: `PR #${prNumber} does not establish a relationship to task ${context.task.id}. Changed artifacts: ${result.changedPaths.join(', ')}. Declare task files or cite the exact task in the PR; declared scope must intersect the diff.`,
-        };
-    }
+    // T12671: `pr:<component>@<integration>` — the integration PR is the
+    // provenance (merge commit, required workflows); the component PR is the
+    // task's link and its change. Both are verified, both are recorded.
+    const linked = await linkedPrChange(prNumber, result, roots, componentPrNumber);
+    if (!linked.ok)
+        return linked;
+    const unlinked = checkPrTaskLinkage(linked.prNumber, linked.pr, context);
+    if (unlinked)
+        return unlinked;
+    const changedPaths = linked.pr.changedPaths;
     if (context.gates.includes('implemented') &&
         classifyEvidenceTask(context) === 'code' &&
-        result.changedPaths.every(isDocumentArtifact)) {
+        changedPaths.every(isDocumentArtifact)) {
         return {
             ok: false,
             codeName: 'E_EVIDENCE_CONTENT_MISMATCH',
-            reason: `PR #${prNumber} changes only documentation and cannot implement code task ${context.task.id}. Changed artifacts: ${result.changedPaths.join(', ')}.`,
+            reason: `PR #${linked.prNumber} changes only documentation and cannot implement code task ${context.task.id}. Changed artifacts: ${changedPaths.join(', ')}.`,
         };
     }
     return {
@@ -1888,16 +2016,73 @@ async function validatePrAtom(prNumber, roots, context) {
             mergedAt: result.mergedAt,
             successCount: result.successCount,
             totalChecks: result.totalChecks,
-            changedPaths: result.changedPaths,
+            changedPaths,
             taskId: context.task.id,
+            ...(componentPrNumber !== undefined ? { componentPrNumber } : {}),
+        },
+    };
+}
+/**
+ * For `pr:`/`ci:` evidence, the PR a task is linked through (T12671): the PR
+ * itself, or — with a component — the component PR verified as landed by the
+ * integration PR, carrying the component's surviving files only.
+ *
+ * @param prNumber - The (integration) PR the atom names.
+ * @param landing - Its verified resolution.
+ * @param roots - Evidence roots (git runs in the execution root).
+ * @param componentPrNumber - Component PR, when the atom names one.
+ * @param view - Component PR reader (tests inject; defaults to `gh pr view`).
+ * @returns The linkage subject, or the refusal.
+ * @task T12671
+ */
+export async function linkedPrChange(prNumber, landing, roots, componentPrNumber, view) {
+    if (componentPrNumber === undefined)
+        return { ok: true, prNumber, pr: landing };
+    const { resolveComponentPr } = await import('./component-pr.js');
+    const c = await resolveComponentPr(componentPrNumber, {
+        prNumber,
+        headRefName: landing.headRefName,
+        headRefOid: landing.headRefOid,
+        mergeCommitSha: landing.mergeCommitSha,
+    }, roots.executionRoot, view);
+    if (!c.ok)
+        return { ok: false, reason: c.reason, codeName: c.codeName };
+    return {
+        ok: true,
+        prNumber: componentPrNumber,
+        pr: {
+            title: c.title,
+            body: c.body,
+            headRefName: c.headRefName,
+            changedPaths: c.files,
+            changedFileCount: c.files.length,
         },
     };
 }
-function isDocumentArtifact(path) {
+/**
+ * Whether a path is a documentation artifact (`.md`/`.mdx`/`.rst`/`.adoc`/`.txt`,
+ * README, LICENSE, CHANGELOG) — the rule `pr:` uses to refuse a docs-only PR
+ * as implementation of a code task.
+ *
+ * @param path - Repo-relative path.
+ * @returns True for a documentation artifact.
+ */
+export function isDocumentArtifact(path) {
     return (/\.(md|mdx|rst|adoc|txt)$/i.test(path) ||
         /(?:^|\/)(README|LICENSE|CHANGELOG)(?:\.[^/]*)?$/i.test(path));
 }
-function classifyEvidenceTask(context) {
+/**
+ * Classify a task for evidence purposes: `research` (research/spike kind),
+ * `documentation` (docs-only declared files or a docs label) or `code`.
+ *
+ * Exported so the read-only `cleo done --plan` planner chooses the same
+ * documentary path the validators accept — one classification, not two.
+ *
+ * @param context - Task context; only `task` is read.
+ * @returns The evidence classification.
+ * @task T12624
+ */
+export function classifyEvidenceTask(context) {
     if (context.task.kind === 'research' || context.task.kind === 'spike')
         return 'research';
     if (context.task.files?.length && context.task.files.every(isDocumentArtifact))
@@ -1922,6 +2107,9 @@ function classifyEvidenceTask(context) {
  */
 export function checkTaskEvidenceContext(context, gate, atoms) {
     const filePaths = atoms.flatMap((atom) => atom.kind === 'files' ? atom.files.map((file) => file.path) : []);
+    // T12634: a `ci:` result is bound to the task it was validated for, like `pr:`.
+    if (atoms.some((atom) => atom.kind === 'ci' && atom.taskId !== context.task.id))
+        return 'CI evidence lacks verified task linkage; re-verify with current task context.';
     const prAtoms = atoms.filter((atom) => atom.kind === 'pr');
     if (prAtoms.length > 1)
         return 'Record one PR and its merge-pinned artifacts per verification attempt; multiple merge identities are ambiguous.';
@@ -1939,7 +2127,9 @@ export function checkTaskEvidenceContext(context, gate, atoms) {
         return null;
     if (classifyEvidenceTask(context) === 'code' &&
         (gate === 'testsPassed' || gate === 'qaPassed') &&
-        !atoms.some((atom) => atom.kind === 'test-run' || (atom.kind === 'tool' && !atom.notApplicable))) {
+        !atoms.some((atom) => atom.kind === 'test-run' ||
+            atom.kind === 'ci' ||
+            (atom.kind === 'tool' && !atom.notApplicable))) {
         return `Code task ${context.task.id} requires an actual verification result for ${gate}; absence of a toolchain is not a passing result.`;
     }
     const linked = atoms.filter((atom) => atom.kind === 'satisfies' && atom.targetTaskId === context.task.id);
@@ -2130,7 +2320,7 @@ export function composeGateEvidence(atoms, capturedBy, override, overrideReason,
                 return atom.kind === 'commit' || atom.kind === 'pr' || atom.kind === 'decision'
                     ? [index]
                     : [];
-            return atom.kind === 'tool' || atom.kind === 'test-run' ? [index] : [];
+            return atom.kind === 'tool' || atom.kind === 'test-run' || atom.kind === 'ci' ? [index] : [];
         });
         result.scope = {
             taskId: context.task.id,
@@ -2187,6 +2377,46 @@ export const CRITICAL_GATES_NO_OVERRIDE = Object.freeze([
 export function isHardAtom(atom) {
     return atom.kind !== 'override' && atom.kind !== 'note' && atom.kind !== 'url';
 }
+/**
+ * The on-disk file re-validation should hash for a `files:` / `test-run:`
+ * entry.
+ *
+ * 1. `resolvedPath`, when it still exists. It pins the file attested at verify
+ *    time, independent of the completing process's cwd.
+ * 2. The first candidate that is gone (`resolvedPath`, else `mainResolution`),
+ *    rebased through a vanished, recorded checkout root of this project.
+ * 3. `mainResolution`: how the atom resolved before T12476. It covers a
+ *    verified worktree that was removed after merge.
+ *
+ * This only chooses bytes; the caller's sha256 comparison is the verdict.
+ *
+ * @internal
+ * @task T12476
+ */
+async function resolveAttestedPath(resolvedPath, mainResolution, executionRoot, storeRoot) {
+    if (resolvedPath !== undefined && existsSync(resolvedPath))
+        return resolvedPath;
+    const pinned = resolvedPath ?? mainResolution;
+    const rebased = await rebaseForRevalidation(pinned, executionRoot, storeRoot);
+    if (rebased !== null)
+        return rebased;
+    return mainResolution;
+}
+/**
+ * Rebase a legacy absolute evidence path whose checkout moved onto the live
+ * root. Returns the absolute rebased path, or `null` when the path is
+ * relative, still exists, or cannot be mapped safely (see
+ * {@link rebaseLegacyEvidencePath} for the guards).
+ *
+ * @internal
+ * @task T12476
+ */
+async function rebaseForRevalidation(path, executionRoot, storeRoot) {
+    if (!isAbsolute(path) || existsSync(path))
+        return null;
+    const recordedRoots = await loadRecordedProjectRoots(storeRoot);
+    return rebaseLegacyEvidencePath(path, [executionRoot, storeRoot], recordedRoots);
+}
 /**
  * Re-validate stored evidence to detect tampering between verify and complete.
  *
@@ -2318,7 +2548,17 @@ export async function revalidateEvidence(evidence, projectRoot, gate, taskId, op
                 const siblingCommitSha = siblingPr?.mergeCommitSha ?? siblingCommit?.sha;
                 const executionRoot = resolveEvidenceExecutionRoot(projectRoot, undefined, siblingCommitSha === undefined ? {} : { commitSha: siblingCommitSha });
                 for (const f of atom.files) {
-                    const abs = isAbsolute(f.path) ? f.path : resolvePath(executionRoot, f.path);
+                    // T12476: read the file hashed at verify time, in this order:
+                    //   1. `resolvedPath` — pins the attested file regardless of cwd;
+                    //   2. that path rebased through a vanished recorded project root;
+                    //   3. main's resolution of `path` (execution root). This covers the
+                    //      ADR-055 lifecycle — verify in a worktree, remove it after
+                    //      merge, complete from main — where the pinned file is gone but
+                    //      the merged copy is present.
+                    // Every step only chooses which bytes to hash; the sha256 comparison
+                    // below decides, so none of them can pass a modified file.
+                    const mainResolution = isAbsolute(f.path) ? f.path : resolvePath(executionRoot, f.path);
+                    const abs = await resolveAttestedPath(f.resolvedPath, mainResolution, executionRoot, projectRoot);
                     let content = null;
                     if (siblingCommitSha) {
                         content = await gitShowFileContentAtCommit(f.path, siblingCommitSha, executionRoot);
@@ -2360,7 +2600,10 @@ export async function revalidateEvidence(evidence, projectRoot, gate, taskId, op
                 // Deliberately NOT cached (T12102): same reasoning as files: — the
                 // content hash comparison IS the staleness guarantee.
                 const startedAt = Date.now();
-                const abs = isAbsolute(atom.path) ? atom.path : resolvePath(projectRoot, atom.path);
+                // T12476: same order as `files:` — pinned `resolvedPath`, then a
+                // rebase through a vanished recorded root, then main's store-root
+                // resolution of `path`. The sha256 comparison below decides.
+                const abs = await resolveAttestedPath(atom.resolvedPath, isAbsolute(atom.path) ? atom.path : resolvePath(projectRoot, atom.path), resolveEvidenceExecutionRoot(projectRoot), projectRoot);
                 if (!existsSync(abs)) {
                     failed.push({ atom, reason: `test-run file removed since verify: ${atom.path}` });
                     options?.onProgress?.(`test-run:${atom.path} FAILED ${Date.now() - startedAt}ms`);
@@ -2394,6 +2637,10 @@ export async function revalidateEvidence(evidence, projectRoot, gate, taskId, op
                 // once accepted/proposed. Re-validation is not performed at complete
                 // time — the DB row is trusted as captured at verify time.
                 break;
+            case 'ci':
+                // T12634: check conclusions on a merge commit are immutable once
+                // completed; the atom is trusted as captured, like `pr:`.
+                break;
             case 'pr':
                 // PR atoms capture (prNumber, mergedAt, mergeCommitSha) at verify
                 // time. A merged PR's mergedAt is immutable, so the atom is trusted