@dougharness/cli 1.3.0 → 1.5.0

package/node_modules/@dougharness/gates/scripts/stop-gate.mjs

@@ -85,16 +85,16 @@ import { runCommand, failureSummary } from "../lib/run.mjs";
 import { loadScopePlan, scopeViolations, describeViolations, PLAN_RELPATH } from "../lib/scope.mjs";
 import { checkpoint, describeCheckpoint } from "../lib/checkpoint.mjs";
 import { verificationEvidence, describeMissingEvidence } from "../lib/evidence.mjs";
-import { changedFiles, captureBaseline, sinceBaseline, headAt, committedSince, walkProposalPathFiles, fileIdentity, treeFingerprint, sameTree, readAgentStart, readTurnStart, turnTreeStatus, onlyNoTestPathsChanged, movedSinceVerified } from "../lib/baseline.mjs";
+import { changedFiles, captureBaseline, sinceBaseline, headAt, committedSince, walkProposalPathFiles, fileIdentity, treeFingerprint, sameTree, readAgentStart, readTurnStart, turnTreeStatus, turnTreeStatusHeadMoved, onlyNoTestPathsChanged, movedSinceVerified } from "../lib/baseline.mjs";
 import { tracePath, readTrace, traceLine, appendTrace, agentLabel } from "../lib/trace.mjs";
 import { isAppliedContent } from "../lib/proposals.mjs";
 import { gitHead, mergeSnapshot, readDecisions, readPlanSummary, readPlanSummaries, snapshotSection } from "../lib/anchor.mjs";
 import { contextReading, recordAgentContext } from "../lib/agent-context.mjs";
 import { parseTotals, readSummaries, sumTotals, compareTotals, deltaTotals, waiverCovers } from "../lib/test-totals.mjs";
-import { failingTestFilesFrom, nonTestTscPathsFrom, classifyFinalBlock, appendBlockLine } from "../lib/block-ledger.mjs";
+import { failingTestFilesFrom, nonTestTscPathsFrom, classifyFinalBlock, appendBlockLine, outputTail, redactText } from "../lib/block-ledger.mjs";
 import { docsGateDecision } from "../lib/docs-gate.mjs";
 import { gateLockPath, readGateLock, pidIsLive, writeGateLock, takeOverGateLock, resolveHookTimeoutSec, lockStaleByAge, normalizedTimeoutMs, lockWaitBoundMs } from "../lib/gate-lock.mjs";
-import { resolveCommands, computeTree, readRecord, writeRecord as writeTreeRecord, removeRecord as removeTreeRecord, creditable } from "../lib/verified-tree.mjs";
+import { resolveCommands, computeTree, readRecord, writeRecord as writeTreeRecord, removeRecord as removeTreeRecord, creditable, totalsUsable, exitCreditUsable } from "../lib/verified-tree.mjs";
 
 // Only the last this many characters of last_assistant_message are ever scanned for a partial claim
 // (review, scan cost): a structured result lives at the end of a worker's message, and the balanced-span
@@ -311,14 +311,14 @@ function stripLeadingDotSlash(f) {
 // failed command's output names at least one test file, every named file is in the claim, and every
 // claimed file is changed or untracked in the working tree (`changed`, from changedFiles(dir) above);
 // otherwise `{ covered: false, reasonLine }` — one line, no newline, saying why.
-function redByDesignCoverage(claimFiles, commandFailures, changed, dir) {
+function redByDesignCoverage(claimFiles, commandFailures, changed, dir, secrets) {
   const changedSet = new Set(Array.isArray(changed) ? changed : []);
   for (const cf of commandFailures) {
     const bad = nonTestTscPathsFrom(cf.output, dir);
     if (bad.length > 0) {
       return {
         covered: false,
-        reasonLine: `The tests_red_by_design claim does not cover this: \`${cf.command}\` reported a type error in ${bad.join(", ")}, which is not a test file.`,
+        reasonLine: `The tests_red_by_design claim does not cover this: \`${redactText(cf.command, secrets)}\` reported a type error in ${bad.join(", ")}, which is not a test file.`,
       };
     }
   }
@@ -327,7 +327,7 @@ function redByDesignCoverage(claimFiles, commandFailures, changed, dir) {
   if (noFile.length > 0) {
     return {
       covered: false,
-      reasonLine: `The tests_red_by_design claim does not cover this: ${noFile.map((c) => `\`${c.command}\``).join(", ")} named no test file in its output.`,
+      reasonLine: `The tests_red_by_design claim does not cover this: ${noFile.map((c) => `\`${redactText(c.command, secrets)}\``).join(", ")} named no test file in its output.`,
     };
   }
   const allNamed = [...new Set(namedByCommand.flatMap((c) => c.files))];
@@ -468,6 +468,21 @@ function countingInFlight(dir, cfg, sessionId, inFlight) {
 // and whose ok is not exactly false (a null ok counts as success — conservative). No change found -> true.
 //
 // Without trace evidence, true only when subagent.type is in READ_ONLY_AGENT_TYPES.
+// card ratchet-stale-session-baseline: true only when the trace vouches for the agent's whole life (its
+// SubagentStart line is there) and shows no successful Edit-type PostToolUse of its own. Bash does not count.
+function agentMadeNoEditCalls(dir, cfg, sessionId, subagent) {
+  try {
+    if (!subagent || !cfg.trace || cfg.trace.enabled === false) return false;
+    const file = tracePath(dir, sessionId);
+    if (!existsSync(file)) return false;
+    const lines = readTrace(file);
+    if (!lines.some((l) => l.event === "SubagentStart" && l.agent === subagent.id)) return false;
+    return !lines.some((l) => l.agent === subagent.id && l.event === "PostToolUse" && CHANGE_TOOLS.has(l.tool) && l.ok !== false);
+  } catch {
+    return false;
+  }
+}
+
 function agentMadeNoChanges(dir, cfg, sessionId, subagent) {
   try {
     if (!subagent) return false;
@@ -495,7 +510,7 @@ function agentMadeNoChanges(dir, cfg, sessionId, subagent) {
 // card stop-gate-worktree-agent-fingerprint: the start record is a fingerprint of the main checkout (the trace
 // hook runs there), so for a worktree verification dir it is compared like with like instead: unchanged only if
 // the record exists, every verification dir has no changed files, and every one's HEAD carries no commit of its
-// own: it equals or is an ancestor of the record's HEAD, or of the main checkout's refs/remotes/origin/HEAD (Claude
+// own: it equals or is an ancestor of the record's HEAD, or of the origin/HEAD sha the record holds, taken at start, never the live ref (Claude
 // Code branches a fresh isolation worktree from the remote default branch, which local main may be ahead of or
 // behind). Any git failure reads as changed. A verification set that mixes a worktree with `dir` reads as
 // changed. A main-checkout agent keeps the fingerprint comparison.
@@ -524,12 +539,7 @@ function treeUnchangedSinceStart(dir, cfg, sessionId, subagent, input, currentFi
       if (!start || typeof start !== "object" || !start.head) return false;
       const dirs = forced ? [vdir] : verifyDirs(dir, cfg, sessionId, input, subagent);
       if (!dirs.includes(vdir) || dirs.includes(dir)) return false;
-      let remoteHead;
-      try {
-        remoteHead = execFileSync("git", ["rev-parse", "--verify", "-q", "refs/remotes/origin/HEAD^{commit}"], { cwd: dir, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 5000 }).trim() || null;
-      } catch {
-        remoteHead = null;
-      }
+      const remoteHead = typeof start.originHead === "string" && start.originHead ? start.originHead : null;
       return dirs.every((d) => {
         const h = headAt(d);
         if (!h) return false;
@@ -812,14 +822,36 @@ function readLastGreen(dir) {
   }
 }
 
+// card ratchet-credit-reads-record: one baseline for the count check and both credit paths. In a worktree
+// (vdir !== dir) it is the worktree's own last-green record. On the main checkout (card
+// ratchet-stale-session-baseline) it is the main last-green record when that has a readable entry for the
+// command, else the session-start copy state.testTotals. Returns (command) => baseline object or null. Never throws.
+function countBaselineFor(dir, state, vdir) {
+  try {
+    const inWorktree = typeof vdir === "string" && vdir !== dir;
+    const worktreeBaseline = inWorktree ? readLastGreen(vdir) : null;
+    const mainRecord = inWorktree ? null : readLastGreen(dir);
+    const fallback = state && state.testTotals && typeof state.testTotals === "object" ? state.testTotals : null;
+    return (command) => {
+      try {
+        if (inWorktree) return worktreeBaseline;
+        return mainRecord && readSummaries(mainRecord[command]) ? mainRecord : fallback;
+      } catch {
+        return null;
+      }
+    };
+  } catch {
+    return () => null;
+  }
+}
+
 // The count check for the commands that ran green by exit code. Returns { problems, parsed }: `problems` are
 // block reasons, `parsed` the per-command summary lists of every run that was counted (for the last-green
 // record). A missing or unparseable summary, or no baseline, is a trace line and no check.
 function countCheck(dir, cfg, state, input, ran, vdir) {
   // card worktree-count-baseline: a worktree run compares against its own earlier green runs, never main's record
   // (a worktree can lack the dist build main has, so its skipped count differs). No record yet means no check.
-  const inWorktree = typeof vdir === "string" && vdir !== dir;
-  const baseline = inWorktree ? readLastGreen(vdir) : state.testTotals;
+  const baselineFor = countBaselineFor(dir, state, vdir);
   const problems = [];
   const parsed = {};
   // The note carries its own event name, never the stop event's: a decision-less SubagentStop line would read to
@@ -843,6 +875,7 @@ function countCheck(dir, cfg, state, input, ran, vdir) {
         note(`count check did not run for \`${command}\`: no test summary in its output`);
         continue;
       }
+      const baseline = baselineFor(command);
       const all = baseline && typeof baseline === "object" ? baseline : null;
       const baseList = all ? readSummaries(all[command]) : null;
       if (!baseList) {
@@ -919,7 +952,7 @@ function readableRecordedTotals(t) {
 // one `{ name, command, ok: true, credited: "verified-tree", recorded? }` per resolveCommands entry in config
 // order. A command with a baseline in state.testTotals and no readable recorded totals returns null (the commands
 // run), the same rule as preCommitCredit. Never throws: any failure is null, and null runs the commands.
-function treeCredit(dir, cfg, state, tree) {
+function treeCredit(dir, cfg, state, tree, mainDir) {
   try {
     if (!tree) return null;
     const record = readRecord(dir);
@@ -927,11 +960,14 @@ function treeCredit(dir, cfg, state, tree) {
     const configured = resolveCommands(cfg);
     if (configured.length === 0) return null;
     if (!creditable(dir, cfg, record, tree, configured.map((c) => c.command)).ok) return null;
-    const all = state && state.testTotals && typeof state.testTotals === "object" ? state.testTotals : null;
+    if (!exitCreditUsable(record, dir)) return null;
+    // dir is the verify dir (a worktree for a worktree agent); mainDir the main checkout, as countCheck's dir.
+    const baselineFor = countBaselineFor(mainDir ?? dir, state, dir);
     const out = [];
     for (const { name, command } of configured) {
-      const recorded = readableRecordedTotals(record.totals[command]);
-      const hasBaseline = all ? readSummaries(all[command]) !== null : false;
+      const recorded = totalsUsable(record, dir) ? readableRecordedTotals(record.totals[command]) : null;
+      const base = baselineFor(command);
+      const hasBaseline = base ? readSummaries(base[command]) !== null : false;
       if (hasBaseline && (!recorded || recorded.status === "none")) return null;
       out.push({ name, command, ok: true, credited: "verified-tree", ...(recorded ? { recorded } : {}) });
     }
@@ -951,7 +987,7 @@ function treeCredit(dir, cfg, state, tree) {
 // wrong-shape, failing, stale-tree, or mismatched-commands record, or a dirty tree — fail closed to running,
 // never to passing. A reader must never throw: every path here is wrapped, so a corrupt record never crashes
 // the hook (`runHook` fails open on a throw, which here would mean passing without running — forbidden).
-function preCommitCredit(dir, cfg, changed, state) {
+function preCommitCredit(dir, cfg, changed, state, mainDir) {
   try {
     if (!Array.isArray(changed)) return null;
     const ignore = cfg.stopGate.ignoreChangedPaths || [];
@@ -977,12 +1013,14 @@ function preCommitCredit(dir, cfg, changed, state) {
     // card ratchet-pre-commit-credit: a command with a baseline in state.testTotals is credited only when the
     // record carries readable totals for it (a list of valid summaries, or an old ok or conflict shape);
     // otherwise null and the commands really run. `recorded` is the parseTotals-shaped result for the count check.
-    const all = state && state.testTotals && typeof state.testTotals === "object" ? state.testTotals : null;
+    // dir is the verify dir (a worktree for a worktree agent); mainDir the main checkout, as countCheck's dir.
+    const baselineFor = countBaselineFor(mainDir ?? dir, state, dir);
     const out = [];
     for (let i = 0; i < configured.length; i++) {
       const { name, command } = configured[i];
       const recorded = readableRecordedTotals(record.commands[i].totals);
-      const hasBaseline = all ? readSummaries(all[command]) !== null : false;
+      const base = baselineFor(command);
+      const hasBaseline = base ? readSummaries(base[command]) !== null : false;
       if (hasBaseline && (!recorded || recorded.status === "none")) return null;
       out.push({ name, command, ok: true, credited: "pre-commit", ...(recorded ? { recorded } : {}) });
     }
@@ -1209,8 +1247,8 @@ runHook("stop-gate", async (input) => {
     traceSubagentDecision("allow", traceReason, extra);
     return allow();
   };
-  const blockStopDecided = (reason) => {
-    traceSubagentDecision("block", null);
+  const blockStopDecided = (reason, extra) => {
+    traceSubagentDecision("block", null, extra);
     return blockStop(reason);
   };
   const systemMessageDecided = (message, traceReason, extra) => {
@@ -1220,8 +1258,19 @@ runHook("stop-gate", async (input) => {
   // Card stop-gate-block-ledger: one ledger line per block/stand-down below, written synchronously right
   // before the blockStop/systemMessage call it belongs to (those call process.exit(0) themselves, so
   // nothing queued after them ever runs). appendBlockLine never throws.
-  const logBlock = (reason, cls) =>
-    appendBlockLine(dir, { hook: subagent ? "subagent-stop" : "stop-gate", agent: subagent ? subagent.type : null, reason, class: cls, session: input.session_id });
+  const logBlock = (reason, cls, record) =>
+    appendBlockLine(dir, { hook: subagent ? "subagent-stop" : "stop-gate", agent: subagent ? subagent.type : null, reason, class: cls, session: input.session_id, record });
+  // card block-ledger-failing-output: a main Stop verification block has no decision trace line of its own;
+  // append one carrying the record. A SubagentStop's line comes from traceSubagentDecision. Never throws.
+  const traceMainBlock = (record) => {
+    if (subagent) return;
+    try {
+      if (!cfg.trace || cfg.trace.enabled === false) return;
+      appendTrace(dir, { ...traceLine(input, { now: new Date() }), event: "Stop", decision: "block", reason: null, ...record });
+    } catch {
+      // never block the real exit on a trace failure
+    }
+  };
   // Card block-ledger-stood-down-repeats: a stood-down line is written at most once per session per
   // cause, so a session standing down at its cap does not append a fresh identical line on every later
   // Stop/SubagentStop past it. Cause key: "turn-budget" (lead only), or "block-cap:<lead|agent id>" — the
@@ -1418,7 +1467,10 @@ runHook("stop-gate", async (input) => {
     let readOnly = null;
     try {
       const start = readTurnStart(dir, input.session_id);
-      const status = turnTreeStatus(cfg, start, treeFingerprint(dir, cfg, changed));
+      const currentFp = treeFingerprint(dir, cfg, changed);
+      let status = turnTreeStatus(cfg, start, currentFp);
+      // A turn that only committed noTestPaths files moved HEAD but changed no code (card stop-gate-read-only-turn-commits).
+      if (status && !status.same) status = turnTreeStatusHeadMoved(dir, cfg, start, currentFp) || status;
       if (status && status.same) {
         let editedThisTurn = false;
         if (cfg.trace && cfg.trace.enabled !== false) {
@@ -1683,8 +1735,8 @@ runHook("stop-gate", async (input) => {
         currentFingerprint &&
         (sameTree(rec.fingerprint, currentFingerprint) || (rec.scope === scopeNow && (redViaNoTestPaths = onlyNoTestPathsChanged(vdir, cfg, rec.fingerprint, vchanged)))) &&
         !(subagent && (redByDesignClaim(input.last_assistant_message) ?? redByDesignClaim(lastHandbackMessage(input.agent_transcript_path)))) &&
-        !preCommitCredit(vdir, cfg, vchanged, state) &&
-        !treeCredit(vdir, cfg, state, computeTree(vdir))
+        !preCommitCredit(vdir, cfg, vchanged, state, dir) &&
+        !treeCredit(vdir, cfg, state, computeTree(vdir), dir)
       ) {
         lastRed = rec;
       }
@@ -1723,8 +1775,14 @@ runHook("stop-gate", async (input) => {
         [...treeProblems, lastRed.summary].join("\n\n");
       const reuseClass = typeof lastRed.class === "string" ? lastRed.class : "real";
       const capped = deferralCapNote && !subagent ? `${deferralCapNote}\n\n${reason}` : reason;
-      logBlock(reason, reuseClass);
-      return blockStopDecided(capped);
+      const reuseRecord = {
+        failures: Array.isArray(lastRed.failures) ? lastRed.failures : [],
+        cwd: typeof lastRed.cwd === "string" ? lastRed.cwd : null,
+        tree: typeof lastRed.tree === "string" ? lastRed.tree : null,
+      };
+      logBlock(reason, reuseClass, reuseRecord);
+      traceMainBlock(reuseRecord);
+      return blockStopDecided(capped, reuseRecord);
     }
   }
 
@@ -1869,9 +1927,9 @@ runHook("stop-gate", async (input) => {
     if (deferralCapNote && !subagent) return systemMessageDecided(deferralCapNote, traceReason, extra);
     return allowDecided(traceReason, extra);
   };
-  const blockStopReleasing = (reason) => {
+  const blockStopReleasing = (reason, extra) => {
     releaseLock();
-    return blockStopDecided(deferralCapNote && !subagent ? `${deferralCapNote}\n\n${reason}` : reason);
+    return blockStopDecided(deferralCapNote && !subagent ? `${deferralCapNote}\n\n${reason}` : reason, extra);
   };
   const systemMessageReleasing = (message, traceReason, extra) => {
     releaseLock();
@@ -1906,6 +1964,19 @@ runHook("stop-gate", async (input) => {
   // One entry per failed command, `{ command, output }` (stderr + stdout, untruncated), for the
   // tests_red_by_design coverage check below (design point 2, card subagent-stop-gate-tester-red).
   const commandFailures = [];
+  // card block-ledger-failing-output: the failing commands, the directory and the tree this block verified.
+  const buildBlockRecord = () => {
+    try {
+      const failures = commandFailures.map((cf, i) => {
+        const r = failedRuns[i] || {};
+        return { command: redactText(cf.command, cfg.secrets), exit: typeof r.status === "number" ? r.status : null, timedOut: !!r.timedOut, tail: outputTail(cf.output, cfg.secrets) };
+      });
+      return { failures, cwd: vdir, tree: treeBefore ?? null };
+    } catch {
+      return { failures: [], cwd: vdir, tree: null }; // the line is written without the failures; the decision is unchanged
+    }
+  };
+  const failedRuns = []; // parallel to commandFailures: { status, timedOut } of each failed run (card block-ledger-failing-output)
   const ranGreen = []; // count check input: { command, stdout } of each command that really ran and exited 0, plus { command, result } of each credited pre-commit command whose recorded totals are readable
   // card stop-gate-credits-pre-commit: a passing pre-commit record for this exact tree and command set
   // stands in for actually running them — see preCommitCredit above. Every other check below (evidence,
@@ -1913,7 +1984,7 @@ runHook("stop-gate", async (input) => {
   // card verified-tree-record: treeBefore is the working tree immediately before the first command; a record of
   // it (any writer: Stop, verify.mjs, land, pre-commit) is tried before preCommitCredit's last-run.json.
   const treeBefore = skipVerification ? null : computeTree(vdir);
-  const credited = skipVerification ? null : (treeCredit(vdir, cfg, state, treeBefore) ?? preCommitCredit(vdir, cfg, vchanged, state));
+  const credited = skipVerification ? null : (treeCredit(vdir, cfg, state, treeBefore, dir) ?? preCommitCredit(vdir, cfg, vchanged, state, dir));
   // card gate-docs-skip-unless-named: a targeted run is never a full run (no record, no ratchet, no state.verified).
   const targeted = !credited && targetedFiles ? targetedFiles : null;
   if (!skipVerification && credited) {
@@ -1951,8 +2022,9 @@ runHook("stop-gate", async (input) => {
         const output = r.stderr + "\n" + r.stdout;
         // card gate-output-names-failures: the block reason leads with the failing test names (R1/R2);
         // commandFailures below keeps the untruncated output for the tests_red_by_design coverage check.
-        problems.push(`\`${command}\` failed (${why}):\n${failureSummary(output, 40)}`);
+        problems.push(`\`${redactText(command, cfg.secrets)}\` failed (${why}):\n${redactText(failureSummary(output, 40), cfg.secrets)}`);
         commandFailures.push({ command, output });
+        failedRuns.push({ status: r.status, timedOut: r.timedOut });
       }
     }
   }
@@ -1977,6 +2049,7 @@ runHook("stop-gate", async (input) => {
             node: process.version,
             at: new Date().toISOString(),
             by: subagent ? "subagent-stop" : "stop",
+            ranIn: realpathSync(vdir),
             commands: results.map((r) => ({ name: r.name, command: r.command, exit: 0, durationMs: typeof r.durationMs === "number" ? r.durationMs : 0 })),
             totals,
           });
@@ -2006,8 +2079,17 @@ runHook("stop-gate", async (input) => {
 
   // 3c. Test-count ratchet (card test-count-ratchet): its own kind of problem, not a failed command.
   const counted = countCheck(dir, cfg, state, input, ranGreen, vdir);
-  problems.push(...counted.problems);
-  const countProblemAdded = counted.problems.length > 0;
+  // card ratchet-stale-session-baseline: a seat with no Edit-type call is never blocked by a count change it did
+  // not cause. Its count problems become one trace note, and that stop writes neither the record nor state.verified.
+  const countExempt = counted.problems.length > 0 && !!subagent && agentMadeNoEditCalls(dir, cfg, input.session_id, subagent);
+  if (countExempt) {
+    try {
+      if (cfg.trace && cfg.trace.enabled !== false) appendTrace(dir, { ...traceLine(input, { now: new Date() }), event: "CountCheck", reason: `count change not blocking a seat that made no Edit-type call: ${counted.problems[0].split("\n")[0].slice(0, 300)}` });
+    } catch {
+      // logging must never fail the gate
+    }
+  } else problems.push(...counted.problems);
+  const countProblemAdded = !countExempt && counted.problems.length > 0;
 
   // A main Stop's skip has no decision-tagged exit line like a SubagentStop's (allowReleasing folds the reason
   // into that); record the reason here so the trace carries it (card stop-gate-no-test-paths).
@@ -2025,8 +2107,8 @@ runHook("stop-gate", async (input) => {
   // (card stop-gate-read-only-subagent-skip): nothing was actually verified.
   // A read-only-turn skip verified nothing: it leaves lastRed (and stopBlocks, below) as they were.
   if (skipReason !== "read-only-turn") state.lastRed = null; // card stop-gate-no-change-restop: re-set at the final block below when it qualifies
-  if (problems.length === 0 && !skipVerification && !targeted) state.verified = verifiedCandidate;
-  if (problems.length === 0 && !skipVerification) writeLastGreen(vdir || dir, counted.parsed); // empty when nothing really ran
+  if (problems.length === 0 && !skipVerification && !targeted && !countExempt) state.verified = verifiedCandidate;
+  if (problems.length === 0 && !skipVerification && !countExempt) writeLastGreen(vdir || dir, counted.parsed); // empty when nothing really ran
   if (problems.length === 0 && subagent) {
     // A subagent's green gate: its counter resets; the checkpoint, if any, belongs to the session's own Stop.
     state.agentBlocks = { ...(state.agentBlocks || {}), [subagent.id]: 0 };
@@ -2083,7 +2165,7 @@ runHook("stop-gate", async (input) => {
           // (none of them a dropped command) closes that gap.
           postCommandProblems - preVerificationProblems === commandFailures.length
         ) {
-          const coverage = redByDesignCoverage(claimFiles, commandFailures, changed, dir);
+          const coverage = redByDesignCoverage(claimFiles, commandFailures, changed, dir, cfg.secrets);
           if (coverage.covered) {
             // Same as a subagent's green gate: counter resets, no checkpoint, no turn.
             state.agentBlocks = { ...(state.agentBlocks || {}), [subagent.id]: 0 };
@@ -2126,6 +2208,7 @@ runHook("stop-gate", async (input) => {
                   summary: problems.slice(preVerificationProblems, postCommandProblems).join("\n\n"),
                   class: redClass,
                   who,
+                  ...buildBlockRecord(),
                 };
               }
             } catch {
@@ -2164,6 +2247,8 @@ runHook("stop-gate", async (input) => {
     let finalClass = "real";
     try {
       finalClass = classifyFinalBlock({
+        countProblems: countExempt ? 0 : counted.problems.length,
+        totalProblems: problems.length,
         preVerificationProblems,
         evidenceProblemAdded,
         commandFailures,
@@ -2177,6 +2262,7 @@ runHook("stop-gate", async (input) => {
     } catch {
       finalClass = "real";
     }
+    const blockRecord = buildBlockRecord();
     // card stop-gate-no-change-restop: record this red for reuse only when every configured command really
     // ran (not credited, none dropped for budget or timed out) and at least one failed, every failure by a
     // numeric non-zero exit outside 129..192 (a signal kill has status null, a shell-reported one 128+signal; both load-suspect). Stored with the block's ledger
@@ -2200,14 +2286,16 @@ runHook("stop-gate", async (input) => {
           summary: problems.slice(preVerificationProblems, postCommandProblems).join("\n\n"),
           class: finalClass,
           who,
+          ...blockRecord,
         };
         saveState(dir, input.session_id, state);
       }
     } catch {
       state.lastRed = null;
     }
-    logBlock(reason, finalClass);
-    return blockStopReleasing(reason);
+    logBlock(reason, finalClass, blockRecord);
+    traceMainBlock(blockRecord);
+    return blockStopReleasing(reason, blockRecord);
   };
 
   return runVerification();

package/node_modules/@dougharness/gates/scripts/verify.mjs

@@ -7,13 +7,13 @@
 // No count ratchet and no scans here (no session baseline); the Stop gate does those. Takes the Stop gate's gate.lock (under the git common dir, shared by every worktree) around the commands (card verify-takes-gate-lock).
 
 import { spawnSync } from "node:child_process";
-import { unlinkSync } from "node:fs";
+import { unlinkSync, realpathSync } from "node:fs";
 import { resolve } from "node:path";
 import { loadConfig } from "../lib/config.mjs";
 import { gateLockPath, readGateLock, pidIsLive, writeGateLock, takeOverGateLock, resolveHookTimeoutSec, lockStaleByAge, normalizedTimeoutMs, lockWaitBoundMs } from "../lib/gate-lock.mjs";
 import { runCommand, tail } from "../lib/run.mjs";
 import { parseTotals, readSummaries, sumTotals } from "../lib/test-totals.mjs";
-import { computeTree, readRecord, writeRecord, removeRecord, creditable, resolveCommands } from "../lib/verified-tree.mjs";
+import { computeTree, readRecord, writeRecord, removeRecord, creditable, exitCreditUsable, resolveCommands } from "../lib/verified-tree.mjs";
 
 function parseArgs(argv) {
   const o = { noCredit: false, json: false, commands: [], creditDirs: [] };
@@ -51,6 +51,20 @@ function toplevel() {
   return process.cwd();
 }
 
+// True when dir is a main checkout (git dir equals the common dir), or when that cannot be told (fail closed). Never throws.
+function isMainCheckout(dir) {
+  try {
+    const env = {};
+    for (const [k, v] of Object.entries(process.env)) if (!k.startsWith("GIT_")) env[k] = v;
+    const r = spawnSync("git", ["rev-parse", "--git-dir", "--git-common-dir"], { cwd: dir, encoding: "utf8", env, timeout: 10000 });
+    const [a, b] = r.status === 0 ? r.stdout.trim().split("\n") : [];
+    if (!a || !b) return true;
+    return realpathSync(resolve(dir, a)) === realpathSync(resolve(dir, b));
+  } catch {
+    return true;
+  }
+}
+
 function passed(totals) {
   const s = totals && totals.status === "ok" ? readSummaries(totals) : null;
   if (!s) return null;
@@ -86,9 +100,11 @@ function main() {
     const wanted = commands.map((c) => c.command);
     let record = null;
     let fromOther = false;
+    // Card verify-credit-foreign-skipped: in a main checkout a record from another checkout that skipped tests is not evidence.
+    const mainCwd = isMainCheckout(cwd);
     for (const [i, d] of [recordDir, ...o.creditDirs.map((c) => resolve(c))].entries()) {
       const rec = readRecord(d);
-      if (rec && creditable(cwd, cfg, rec, treeBefore, wanted).ok) {
+      if (rec && creditable(cwd, cfg, rec, treeBefore, wanted).ok && (!mainCwd || exitCreditUsable(rec, cwd))) {
         record = rec;
         fromOther = i > 0;
         break;
@@ -185,7 +201,7 @@ function main() {
   if (ok) {
     const treeAfter = computeTree(cwd);
     if (treeBefore && treeAfter && treeBefore === treeAfter) {
-      writeRecord(recordDir, { version: 1, tree: treeAfter, node: process.version, at: new Date().toISOString(), by: o.by || "verify", commands: recCommands, totals });
+      writeRecord(recordDir, { version: 1, tree: treeAfter, node: process.version, at: new Date().toISOString(), by: o.by || "verify", ranIn: realpathSync(cwd), commands: recCommands, totals });
     }
   } else {
     removeRecord(recordDir);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dougharness/cli",
-  "version": "1.3.0",
+  "version": "1.5.0",
   "description": "doug: tailored, approval-gated harness install for Claude Code.",
   "type": "module",
   "license": "MIT",
@@ -23,8 +23,8 @@
     "node": ">=22.16"
   },
   "dependencies": {
-    "@dougharness/flow": "1.3.0",
-    "@dougharness/gates": "1.3.0"
+    "@dougharness/flow": "1.5.0",
+    "@dougharness/gates": "1.5.0"
   },
   "bundleDependencies": [
     "@dougharness/flow",