@cleocode/core 2026.9.4 → 2026.9.6

package/dist/tasks/evidence.d.ts

@@ -248,6 +248,42 @@ export type AtomValidation = {
  * @task T12107
  * @adr ADR-051 §3
  */
+/**
+ * The two roots an evidence atom may be about, named so an arm cannot inherit
+ * the wrong one.
+ *
+ * gh#1365 was fixed once by threading a single `executionRoot` parameter, and
+ * the fix reached two of the switch's arms. The reason a single parameter could
+ * not close it is that **"root" is one word for two things**: the tree the
+ * evidence is ABOUT, and the store CLEO keeps its own records in. A parameter
+ * called `root` relocates that ambiguity into a signature rather than removing
+ * it, so the next arm silently picks whichever the author had in mind.
+ *
+ * With both fields named, every arm DECLARES what it is about by which field it
+ * reads. `decision:` reading {@link storeRoot} is self-documenting rather than
+ * an exception needing a comment; `pr:` reading both is obviously correct
+ * rather than obviously odd; and a new arm cannot inherit a default, because
+ * there is no default.
+ *
+ * The rule, stated once: **use the root that matches what the atom is about.**
+ * Evidence about the repository under test → {@link executionRoot}. Evidence
+ * about CLEO's own records → {@link storeRoot}.
+ *
+ * @task T12238 (gh#1365)
+ */
+export interface EvidenceRoots {
+    /**
+     * Where CLEO keeps its own state — `.cleo/`, the BRAIN db, project context,
+     * the evidence caches. NOT necessarily a git repository.
+     */
+    readonly storeRoot: string;
+    /**
+     * The repository the evidence is about. Differs from {@link storeRoot}
+     * whenever the CLEO root is a parent of, or a worktree sibling of, the git
+     * checkout — which is this fleet's normal multi-project layout.
+     */
+    readonly executionRoot: string;
+}
 export declare function validateAtom(parsed: ParsedAtom, projectRoot: string, 
 /** T9178: When provided, validates commit is on task/<taskId> branch. */
 taskId?: string, 

package/dist/tasks/evidence.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evidence.d.ts","sourceRoot":"","sources":["../../src/tasks/evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAQH,OAAO,KAAK,EACV,YAAY,EACZ,YAAY,EAEZ,gBAAgB,EACjB,MAAM,qBAAqB,CAAC;AAmB7B,OAAO,EACL,eAAe,EACf,KAAK,aAAa,EAGnB,MAAM,oBAAoB,CAAC;AAE5B;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,EAAE,SAAS,MAAM,EAAwC,CAAC;AAElF;;;;;;;;;GASG;AACH,MAAM,MAAM,YAAY,GAAG,aAAa,GAAG,MAAM,CAAC;AAElD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAAqB,CAAC;AAEhG;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,gBAAgB,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,EAAE,CAS7B,CAAC;AAE1D;;;;;;;;GAQG;AACH,eAAO,MAAM,kCAAkC,KAAK,CAAC;AAMrD;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,UAAU,EAAE,CAAC;CACrB;AAED;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC5B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACxD;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAE,GAC7E;IACE;;;;;;OAMG;IACH,IAAI,EAAE,UAAU,CAAC;IACjB,mEAAmE;IACnE,UAAU,EAAE,MAAM,CAAC;CACpB,GACD;IACE;;;;;;;;OAQG;IACH,IAAI,EAAE,IAAI,CAAC;IACX,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAC;CAClB,GACD;IACE;;;;;;;;;;;;;;OAcG;IACH,IAAI,EAAE,WAAW,CAAC;IAClB,4DAA4D;IAC5D,YAAY,EAAE,MAAM,CAAC;IACrB,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kFAAkF;IAClF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEN;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAUzD;AAMD;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,YAAY,CAAA;CAAE,GAChC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,UAAU,EAClB,WAAW,EAAE,MAAM;AACnB,yEAAyE;AACzE,MAAM,CAAC,EAAE,MAAM;AACf,2EAA2E;AAC3E,gBAAgB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC,cAAc,CAAC,CAoDzB;AAyQD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AAqGvD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAWrD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACvC,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,UAAU,CAAC,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;CAC5C,GAAG,MAAM,EAAE,GAAG,IAAI,CAElB;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,SAAS,CAAC;AAsCvD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,gCAAgC,CAAC,IAAI,EAAE;IACrD,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,UAAU,CAAC,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;CAC5C,GAAG;IAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAAC,UAAU,EAAE,iBAAiB,CAAA;CAAE,CA4B5D;AA2CD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CA2BhF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CA4BvE;AA2SD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,4BAA4B,CAC1C,WAAW,EAAE,MAAM,EASnB,GAAG,GAAE,MAAsB,GAC1B,MAAM,CA2BR;AA4ND,OAAO,EAAE,eAAe,EAAE,CAAC;AA+E3B;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,YAAY,EAAE,EACrB,eAAe,GAAE,MAA2C,GAC3D,MAAM,GAAG,IAAI,CAuBf;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,sBAAsB,CAAC;AAkQ3D;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,MAAM,GAAG,IAAI,CAU9E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,4BAA4B,CAC1C,mBAAmB,EAAE;IAAE,KAAK,CAAC,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GAClF,OAAO,CAOT;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,gCAAgC,EAAE,SAAS,gBAAgB,EAGtE,CAAC;AAMH;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,gBAAgB,EACtB,KAAK,EAAE,YAAY,EAAE,GACpB,MAAM,GAAG,IAAI,CAiBf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,gBAAgB,EACtB,KAAK,EAAE,YAAY,EAAE,GACpB;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAS1C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,YAAY,EAAE,EACrB,UAAU,EAAE,MAAM,EAClB,QAAQ,CAAC,EAAE,OAAO,EAClB,cAAc,CAAC,EAAE,MAAM,GACtB,YAAY,CAWd;AAMD;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,OAAO,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,YAAY,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC5D;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACxC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,0BAA0B,EAAE,SAAS,gBAAgB,EAGhE,CAAC;AAEH;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAEtD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,YAAY,EACtB,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE,gBAAgB,EACvB,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,kBAAkB,CAAC,CAiK7B"}
+{"version":3,"file":"evidence.d.ts","sourceRoot":"","sources":["../../src/tasks/evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAQH,OAAO,KAAK,EACV,YAAY,EACZ,YAAY,EAEZ,gBAAgB,EACjB,MAAM,qBAAqB,CAAC;AAmB7B,OAAO,EACL,eAAe,EACf,KAAK,aAAa,EAGnB,MAAM,oBAAoB,CAAC;AAE5B;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,EAAE,SAAS,MAAM,EAAwC,CAAC;AAElF;;;;;;;;;GASG;AACH,MAAM,MAAM,YAAY,GAAG,aAAa,GAAG,MAAM,CAAC;AAElD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAAqB,CAAC;AAEhG;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,gBAAgB,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,EAAE,CAS7B,CAAC;AAE1D;;;;;;;;GAQG;AACH,eAAO,MAAM,kCAAkC,KAAK,CAAC;AAMrD;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,UAAU,EAAE,CAAC;CACrB;AAED;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC5B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACxD;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAE,GAC7E;IACE;;;;;;OAMG;IACH,IAAI,EAAE,UAAU,CAAC;IACjB,mEAAmE;IACnE,UAAU,EAAE,MAAM,CAAC;CACpB,GACD;IACE;;;;;;;;OAQG;IACH,IAAI,EAAE,IAAI,CAAC;IACX,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAC;CAClB,GACD;IACE;;;;;;;;;;;;;;OAcG;IACH,IAAI,EAAE,WAAW,CAAC;IAClB,4DAA4D;IAC5D,YAAY,EAAE,MAAM,CAAC;IACrB,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kFAAkF;IAClF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEN;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAUzD;AAMD;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,YAAY,CAAA;CAAE,GAChC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,wBAAsB,YAAY,CAChC,MAAM,EAAE,UAAU,EAClB,WAAW,EAAE,MAAM;AACnB,yEAAyE;AACzE,MAAM,CAAC,EAAE,MAAM;AACf,2EAA2E;AAC3E,gBAAgB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC,cAAc,CAAC,CAqEzB;AA8QD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AAqGvD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAWrD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACvC,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,UAAU,CAAC,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;CAC5C,GAAG,MAAM,EAAE,GAAG,IAAI,CAElB;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,SAAS,CAAC;AAsCvD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,gCAAgC,CAAC,IAAI,EAAE;IACrD,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,UAAU,CAAC,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;CAC5C,GAAG;IAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAAC,UAAU,EAAE,iBAAiB,CAAA;CAAE,CA4B5D;AA2CD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CA2BhF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CA4BvE;AAsTD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,4BAA4B,CAC1C,WAAW,EAAE,MAAM,EASnB,GAAG,GAAE,MAAsB,GAC1B,MAAM,CA2BR;AAyPD,OAAO,EAAE,eAAe,EAAE,CAAC;AA+E3B;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,YAAY,EAAE,EACrB,eAAe,GAAE,MAA2C,GAC3D,MAAM,GAAG,IAAI,CAuBf;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,sBAAsB,CAAC;AAgR3D;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,MAAM,GAAG,IAAI,CAU9E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,4BAA4B,CAC1C,mBAAmB,EAAE;IAAE,KAAK,CAAC,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GAClF,OAAO,CAOT;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,gCAAgC,EAAE,SAAS,gBAAgB,EAGtE,CAAC;AAMH;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,gBAAgB,EACtB,KAAK,EAAE,YAAY,EAAE,GACpB,MAAM,GAAG,IAAI,CAiBf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,gBAAgB,EACtB,KAAK,EAAE,YAAY,EAAE,GACpB;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAS1C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,YAAY,EAAE,EACrB,UAAU,EAAE,MAAM,EAClB,QAAQ,CAAC,EAAE,OAAO,EAClB,cAAc,CAAC,EAAE,MAAM,GACtB,YAAY,CAWd;AAMD;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,OAAO,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,YAAY,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC5D;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACxC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,0BAA0B,EAAE,SAAS,gBAAgB,EAGhE,CAAC;AAEH;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAEtD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,YAAY,EACtB,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE,gBAAgB,EACvB,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,kBAAkB,CAAC,CAoK7B"}

package/dist/tasks/evidence.js

@@ -28,7 +28,7 @@ import { EvidenceParseError, ExitCode, GATE_EVIDENCE_REQUIREMENTS, parseEvidence
 import { CleoError } from '../errors.js';
 import { pushWarning } from '../output.js';
 import { getEffectiveHead } from '../worktree/effective-head.js';
-import { describeMemoryLimit } from './heavy-tool-limit.js';
+import { DISABLE_ENV, describeMemoryLimit } from './heavy-tool-limit.js';
 import { computeCommitRevalidationKey, readCommitRevalidationEntry, writeCommitRevalidationEntry, } from './revalidation-cache.js';
 import { resolveSpawnTimeoutMs, runToolCached } from './tool-cache.js';
 import { CANONICAL_TOOLS, listValidToolNames, resolveToolCommand, } from './tool-resolver.js';
@@ -132,41 +132,30 @@ export function parseEvidence(raw) {
         throw err;
     }
 }
-/**
- * Validate a single parsed atom against the filesystem / git / tools.
- *
- * @param parsed - Parsed atom from {@link parseEvidence}
- * @param projectRoot - Absolute path to project root (for resolving files, git)
- * @param taskId - Optional CLEO task ID. When provided, enables branch-scope
- *   check (T9178), content-intersect check (T9245), worktree-aware HEAD
- *   resolution (T-WT-3), and git-show file fallback for branch-only files
- *   (T11959).
- * @param siblingCommitSha - Optional sha of a sibling `commit:` atom from the
- *   same evidence string. When provided, `files:` paths are resolved against
- *   that commit's tree FIRST (T12107 / gh#1195) before falling back to the
- *   worktree and git refs — covers a merged commit whose files are not yet
- *   present in the local checkout.
- * @returns Validation outcome with canonicalised form on success
- *
- * @task T832
- * @task T11959
- * @task T12107
- * @adr ADR-051 §3
- */
 export async function validateAtom(parsed, projectRoot, 
 /** T9178: When provided, validates commit is on task/<taskId> branch. */
 taskId, 
 /** T12107: sha of a sibling `commit:` atom in the same evidence string. */
 siblingCommitSha) {
+    // gh#1365: resolve the tree under test ONCE, here, and pass it down as a
+    // required parameter. Resolving inside each validator would centralise the
+    // logic but still let two of them resolve independently and drift — which is
+    // exactly how gh#1419 happened (a revalidation key derived from one root
+    // while the validation answered about another). A required parameter makes
+    // that divergence unrepresentable rather than merely discouraged.
+    const roots = {
+        storeRoot: projectRoot,
+        executionRoot: resolveEvidenceExecutionRoot(projectRoot),
+    };
     switch (parsed.kind) {
         case 'commit':
-            return validateCommit(parsed.sha, projectRoot, taskId);
+            return validateCommit(parsed.sha, roots, taskId);
         case 'files':
-            return validateFiles(parsed.paths, projectRoot, taskId, siblingCommitSha);
+            return validateFiles(parsed.paths, roots, taskId, siblingCommitSha);
         case 'test-run':
-            return validateTestRun(parsed.path, projectRoot);
+            return validateTestRun(parsed.path, roots);
         case 'tool':
-            return validateTool(parsed.tool, projectRoot);
+            return validateTool(parsed.tool, roots);
         case 'url':
             return validateUrl(parsed.url);
         case 'note':
@@ -174,11 +163,17 @@ siblingCommitSha) {
         case 'loc-drop':
             return validateLocDrop(parsed.fromLines, parsed.toLines);
         case 'callsite-coverage':
-            return validateCallsiteCoverage(parsed.symbolName, parsed.relativeSourcePath, projectRoot);
+            // gh#1365 (T12238): `rg` searches the SOURCE tree. Resolved from the
+            // store root it searched the wrong directory and reported a symbol
+            // UNCOVERED when it was covered — a false negative, which fails closed
+            // and looks like diligence, so it would have been chased as a real gap.
+            return validateCallsiteCoverage(parsed.symbolName, parsed.relativeSourcePath, roots);
         case 'decision':
-            return validateDecision(parsed.decisionId, projectRoot);
+            // storeRoot is CORRECT here and must stay: a decision lives in the BRAIN
+            // db, which is CLEO's own record, not the repository's.
+            return validateDecision(parsed.decisionId, roots);
         case 'pr':
-            return validatePrAtom(parsed.prNumber, projectRoot);
+            return validatePrAtom(parsed.prNumber, roots);
         case 'satisfies': {
             // ADR-079-r2: 5-check validator pipeline shipped by T10507.
             // Delegates to the dedicated validator module to keep the dispatch
@@ -192,7 +187,9 @@ siblingCommitSha) {
                 targetAcId: parsed.targetAcId,
                 targetAcAlias: parsed.targetAcAlias,
                 versionPin: parsed.versionPin,
-            }, taskId, projectRoot);
+            }, taskId, 
+            // A task/AC lookup is CLEO's own record — storeRoot.
+            roots.storeRoot);
             if (!result.ok) {
                 return { ok: false, reason: result.reason, codeName: result.codeName };
             }
@@ -327,7 +324,8 @@ async function findReachableIntegrationBranch(sha, branches, projectRoot) {
     }
     return null;
 }
-async function validateCommit(sha, projectRoot, taskId) {
+async function validateCommit(sha, roots, taskId) {
+    const { storeRoot: projectRoot, executionRoot } = roots;
     if (!/^[0-9a-f]{7,40}$/i.test(sha)) {
         return {
             ok: false,
@@ -335,7 +333,7 @@ async function validateCommit(sha, projectRoot, taskId) {
             codeName: 'E_EVIDENCE_INVALID',
         };
     }
-    const exists = await runCommand('git', ['cat-file', '-e', `${sha}^{commit}`], projectRoot);
+    const exists = await runCommand('git', ['cat-file', '-e', `${sha}^{commit}`], executionRoot);
     if (exists.exitCode !== 0) {
         return {
             ok: false,
@@ -346,7 +344,7 @@ async function validateCommit(sha, projectRoot, taskId) {
     // T-WT-3: resolve effective HEAD — uses task/<taskId> branch when it exists,
     // falls back to "HEAD" when taskId is absent or the branch does not yet exist.
     // This is env-var-independent: it does not rely on CLEO_WORKTREE_ROOT / ALS.
-    const effectiveHead = await getEffectiveHead(projectRoot, taskId);
+    const effectiveHead = await getEffectiveHead(executionRoot, taskId);
     // T12028 / gh#1116: resolve integration branches for reachability fallbacks.
     // Loaded once and reused by both the effective-head fallback and the
     // branch-scope fallback below. Resolution follows the same 3-tier precedence
@@ -369,7 +367,7 @@ async function validateCommit(sha, projectRoot, taskId) {
         // that merge through a non-main branch can use commits on that branch
         // as evidence without synthetic task-branch scaffolding.
         const reachableIntegrationBranch = taskId
-            ? await findReachableIntegrationBranch(sha, integrationBranches, projectRoot)
+            ? await findReachableIntegrationBranch(sha, integrationBranches, executionRoot)
             : null;
         if (reachableIntegrationBranch === null) {
             const branchList = integrationBranches.join(', ');
@@ -398,7 +396,7 @@ async function validateCommit(sha, projectRoot, taskId) {
     // commit (early-init edge case handled by the HEAD ancestry check above).
     if (taskId) {
         const branchRef = `task/${taskId}`;
-        const branchExists = await runCommand('git', ['rev-parse', '--verify', branchRef], projectRoot);
+        const branchExists = await runCommand('git', ['rev-parse', '--verify', branchRef], executionRoot);
         if (branchExists.exitCode === 0) {
             const onBranch = await runCommand('git', ['merge-base', '--is-ancestor', sha, branchRef], projectRoot);
             if (onBranch.exitCode !== 0) {
@@ -1028,7 +1026,8 @@ async function gitShowFileContentAtCommit(relPath, sha, projectRoot) {
  * @task T11959
  * @task T12107
  */
-async function validateFiles(paths, projectRoot, taskId, commitSha) {
+async function validateFiles(paths, roots, taskId, commitSha) {
+    const { storeRoot: projectRoot, executionRoot } = roots;
     if (paths.length === 0) {
         return {
             ok: false,
@@ -1038,13 +1037,19 @@ async function validateFiles(paths, projectRoot, taskId, commitSha) {
     }
     const files = [];
     for (const p of paths) {
-        const abs = isAbsolute(p) ? p : resolvePath(projectRoot, p);
+        // gh#1365: the file belongs to the repo under test. Resolving it against
+        // the CLEO store root reported "File removed since verify" for a file that
+        // was present, 5,176 bytes, in the project — a false negative that then
+        // surfaced as E_EVIDENCE_STALE. Execution root first, store root second so
+        // an absolute or store-relative path keeps working.
+        const fromExecution = isAbsolute(p) ? p : resolvePath(executionRoot, p);
+        const abs = existsSync(fromExecution) ? fromExecution : resolvePath(projectRoot, p);
         let content = null;
         // T12107 (gh#1195): the sibling commit is the evidence anchor — check its
         // tree FIRST. A file merged remotely but not yet present locally validates
         // here without waiting for a fast-forward.
         if (commitSha) {
-            content = await gitShowFileContentAtCommit(p, commitSha, projectRoot);
+            content = await gitShowFileContentAtCommit(p, commitSha, executionRoot);
         }
         if (content === null && existsSync(abs)) {
             // Happy path — file exists on disk.
@@ -1061,7 +1066,7 @@ async function validateFiles(paths, projectRoot, taskId, commitSha) {
         if (content === null && taskId) {
             // T11959: Git-show fallback for branch-only files (worktree context).
             // The file exists on the task branch but not yet at the canonical root.
-            content = await gitShowFileContent(p, taskId, projectRoot);
+            content = await gitShowFileContent(p, taskId, executionRoot);
         }
         if (content === null) {
             // Honest failure: enumerate every location that was checked so the
@@ -1069,7 +1074,9 @@ async function validateFiles(paths, projectRoot, taskId, commitSha) {
             const looked = [];
             if (commitSha)
                 looked.push(`commit ${commitSha} tree`);
-            looked.push(`filesystem at ${projectRoot}`);
+            looked.push(executionRoot === projectRoot
+                ? `filesystem at ${projectRoot}`
+                : `filesystem at ${executionRoot} and ${projectRoot}`);
             if (taskId)
                 looked.push(`git refs task/${taskId}, main, HEAD`);
             return {
@@ -1147,13 +1154,14 @@ cwd = process.cwd()) {
         return toplevel;
     return projectRoot;
 }
-async function validateTestRun(path, projectRoot) {
+async function validateTestRun(path, roots) {
+    const { storeRoot: projectRoot, executionRoot } = roots;
     // gh#1226: a relative test-run path names a report the caller just wrote,
     // in the caller's tree. Resolving it against the shared store root made a
     // report written in a worktree report "file does not exist". Try the
     // execution root first, then fall back to the store root so an absolute or
-    // store-relative path keeps working.
-    const executionRoot = resolveEvidenceExecutionRoot(projectRoot);
+    // store-relative path keeps working. gh#1365: the root arrives as a
+    // parameter now; it is NOT re-resolved here.
     let abs;
     if (isAbsolute(path)) {
         abs = path;
@@ -1233,7 +1241,8 @@ async function validateTestRun(path, projectRoot) {
         },
     };
 }
-async function validateTool(tool, projectRoot) {
+async function validateTool(tool, roots) {
+    const { storeRoot: projectRoot, executionRoot } = roots;
     const resolution = resolveToolCommand(tool, projectRoot);
     // T12083: the project has no such toolchain. This is a fact about the
     // project, not a failure of the work — a plain JavaScript project cannot
@@ -1262,8 +1271,8 @@ async function validateTool(tool, projectRoot) {
         };
     }
     // gh#1220/#1226/#1230: spawn in — and fingerprint against — the tree the
-    // operator actually invoked from, not the shared store root.
-    const executionRoot = resolveEvidenceExecutionRoot(projectRoot);
+    // operator actually invoked from, not the shared store root. gh#1365: the
+    // root arrives as a parameter now; it is NOT re-resolved here.
     const result = await runToolCached(resolution.command, projectRoot, { executionRoot });
     // T12025: wall-clock child-process deadline exceeded — the tool was
     // terminated and the lock released. Signal retry; do NOT record a partially
@@ -1318,13 +1327,38 @@ async function validateTool(tool, projectRoot) {
             codeName: 'E_EVIDENCE_TOOL_KILLED',
         };
     }
+    // gh#1397: CLEO wraps `test` and `build` in a systemd scope of its own
+    // making (T12116). When that wrapper cannot start, `systemd-run` exits 1
+    // WITHOUT ever running the tool — and 1 is also what a suite with a failing
+    // test exits with, so the branch below reported "your tests failed" for a
+    // harness that never ran. Five occurrences of gh#1396 were diagnosed as a
+    // flaky suite for exactly this reason.
+    //
+    // The code this returns is not new: `E_EVIDENCE_TOOL_UNAVAILABLE` has always
+    // been the right answer. What was missing was a route into it, because the
+    // existing guard keys on `exitCode === null` and `systemd-run` itself starts
+    // perfectly well before failing.
+    if (result.harnessFailure !== null) {
+        return {
+            ok: false,
+            reason: `Tool "${tool}" did NOT run. CLEO's own memory-confinement wrapper failed to ` +
+                `start it in ${result.executionRoot}: ${result.harnessFailure} ` +
+                `This is a CLEO harness failure, not a verdict on the tool — the suite never ` +
+                `executed, so this says nothing about whether it passes. Nothing was cached. ` +
+                `Set ${DISABLE_ENV}=1 to run the tool unconfined and get a real result.`,
+            codeName: 'E_EVIDENCE_TOOL_UNAVAILABLE',
+        };
+    }
     if (result.exitCode === null) {
         return {
             ok: false,
             reason: `Tool "${tool}" → ${resolution.command.cmd} ${resolution.command.args.join(' ')} ` +
                 `could not be executed in ${result.executionRoot} — the process never started ` +
                 `(binary missing, not executable, or spawn error). No signal was delivered, so ` +
-                `it did not run and get killed.`,
+                `it did not run and get killed.` +
+                // gh#1397: `spawnCmd` used to discard Node's error object, so this
+                // message could only list the three possibilities. It now names which.
+                (result.stderrTail ? ` Reason: ${result.stderrTail}` : ''),
             codeName: 'E_EVIDENCE_TOOL_UNAVAILABLE',
         };
     }
@@ -1482,7 +1516,10 @@ export const CALLSITE_COVERAGE_LABEL = 'callsite-coverage';
  *
  * @task T1605
  */
-async function validateCallsiteCoverage(symbolName, relativeSourcePath, projectRoot) {
+async function validateCallsiteCoverage(symbolName, relativeSourcePath, roots) {
+    // gh#1365 (T12238): `rg` runs over the SOURCE tree, so this is evidence ABOUT
+    // the repository — executionRoot, not the store.
+    const projectRoot = roots.executionRoot;
     if (!symbolName || typeof symbolName !== 'string') {
         return {
             ok: false,
@@ -1583,7 +1620,11 @@ async function validateCallsiteCoverage(symbolName, relativeSourcePath, projectR
  * @task T1875
  * @epic T1824
  */
-async function validateDecision(decisionId, projectRoot) {
+async function validateDecision(decisionId, roots) {
+    // A decision lives in the BRAIN db — CLEO's OWN record, not the repository's.
+    // storeRoot is correct here; threading the execution root would point this at
+    // the wrong database (gh#1365 / T12238).
+    const projectRoot = roots.storeRoot;
     if (!decisionId || typeof decisionId !== 'string') {
         return {
             ok: false,
@@ -1662,7 +1703,7 @@ async function validateDecision(decisionId, projectRoot) {
  *
  * @task T9764
  */
-async function validatePrAtom(prNumber, projectRoot) {
+async function validatePrAtom(prNumber, roots) {
     // Dynamic import keeps the verification module free of a static dependency
     // on the release subtree, mirroring the pattern used by validateDecision.
     const { resolvePrEvidenceAtom } = await import('../release/pr-evidence.js');
@@ -1672,8 +1713,15 @@ async function validatePrAtom(prNumber, projectRoot) {
     // one from agents/variable-substitution) is best-effort and non-throwing; on
     // a missing/malformed file `loaded` is false → pass null → cleocode default.
     const { loadProjectContext } = await import('../agents/variable-substitution.js');
-    const ctx = loadProjectContext(projectRoot);
-    const result = await resolvePrEvidenceAtom(prNumber, projectRoot, {
+    // `.cleo/project-context.json` is CLEO's own config — storeRoot.
+    const ctx = loadProjectContext(roots.storeRoot);
+    // gh#1365 (T12238): `pr:` is the only atom that shells out to a tool doing its
+    // OWN repo discovery. `gh` walks up from its cwd looking for a git repo; given
+    // the store root in a layout where the checkout is a subdirectory, it finds
+    // none before the mount point and fails with "not a git repository". No
+    // resolver threaded inside CLEO can reach that — only its cwd can. So this
+    // atom needs BOTH roots, and a swap would be as wrong as the original.
+    const result = await resolvePrEvidenceAtom(prNumber, roots, {
         projectContext: ctx.loaded ? ctx.context : null,
     });
     if (!result.ok) {
@@ -1954,7 +2002,10 @@ export async function revalidateEvidence(evidence, projectRoot, gate, taskId, op
                 // (commitSha, headSha), both immutable git facts, so a hit is exactly
                 // as sound as re-running the git spawns. See revalidation-cache.ts.
                 const startedAt = Date.now();
-                const cached = await revalidateCommitAtom(atom.sha, projectRoot);
+                const cached = await revalidateCommitAtom(atom.sha, {
+                    storeRoot: projectRoot,
+                    executionRoot: resolveEvidenceExecutionRoot(projectRoot),
+                });
                 if (!cached.check.ok)
                     failed.push({ atom, reason: cached.check.reason });
                 options?.onProgress?.(`commit:${atom.sha.slice(0, 7)} ${cached.check.ok ? 'ok' : 'FAILED'}` +
@@ -2085,11 +2136,12 @@ export async function revalidateEvidence(evidence, projectRoot, gate, taskId, op
  * @internal
  * @task T12102 (gh#1196)
  */
-async function revalidateCommitAtom(sha, projectRoot) {
-    const headResult = await runCommand('git', ['rev-parse', 'HEAD'], projectRoot);
+async function revalidateCommitAtom(sha, roots) {
+    const { storeRoot: projectRoot, executionRoot } = roots;
+    const headResult = await runCommand('git', ['rev-parse', 'HEAD'], executionRoot);
     const head = headResult.exitCode === 0 ? headResult.stdout.trim() : null;
     if (!head) {
-        return { check: await validateCommit(sha, projectRoot), fromCache: false };
+        return { check: await validateCommit(sha, roots), fromCache: false };
     }
     const key = computeCommitRevalidationKey(sha, head);
     const hit = readCommitRevalidationEntry(projectRoot, key);
@@ -2099,7 +2151,7 @@ async function revalidateCommitAtom(sha, projectRoot) {
             fromCache: true,
         };
     }
-    const check = await validateCommit(sha, projectRoot);
+    const check = await validateCommit(sha, roots);
     if (check.ok && check.atom.kind === 'commit') {
         try {
             writeCommitRevalidationEntry(projectRoot, {