@galda/cli 0.10.34 → 0.10.35

package/bin/manager-for-ai.mjs

@@ -118,8 +118,18 @@ await import(pathToFileURL(join(ROOT, 'engine', 'server.mjs')).href);
 // public build will default it to the deployed relay. See relay/DEPLOY.md.
 if (process.env.RELAY_URL) {
   const { spawn } = await import('node:child_process');
-  const relay = spawn(process.execPath, [join(ROOT, 'engine', 'relay-client.mjs')], { stdio: 'inherit', env: process.env });
-  const stop = () => { try { relay.kill(); } catch { /* already gone */ } };
+  const { superviseRelay } = await import(pathToFileURL(join(ROOT, 'engine', 'relay-supervisor.mjs')).href);
+  // Supervise the relay-client: if the CHILD exits (uncaught throw, single-
+  // instance lock refuse) we bring it back with backoff, otherwise the app goes
+  // silently offline ("Unsent"). A tight crash loop (a config/lock error) trips a
+  // circuit breaker so we stop hammering and say why. relay-client heals its own
+  // dropped socket; this heals the whole process dying. See engine/relay-supervisor.mjs.
+  const sup = superviseRelay({
+    spawn: () => spawn(process.execPath, [join(ROOT, 'engine', 'relay-client.mjs')], { stdio: 'inherit', env: process.env }),
+    log: ({ code, signal, delayMs }) => say(`relay-client exited (code ${code ?? 'n/a'}${signal ? `, ${signal}` : ''}) — restarting in ${Math.round(delayMs / 1000)}s`),
+    onGiveUp: () => say('relay-client keeps exiting immediately — giving up; run `npx @galda/cli --signin` or check RELAY_URL'),
+  });
+  const stop = () => sup.stop();
   process.on('exit', stop);
   for (const sig of ['SIGINT', 'SIGTERM']) process.on(sig, () => { stop(); process.exit(0); });
   say(`relay: connecting to ${process.env.RELAY_URL} — your fixed URL goes live once you sign in`);

package/engine/lib.mjs

@@ -906,6 +906,73 @@ export function hasTestRelevantChanges(changedFiles) {
   return files.some((f) => !DOC_ONLY_RE.test(f));
 }
 
+// Extract the set of FAILING test titles from a `node --test` (or TAP) run.
+// The gate needs NAMES, not just a count, so it can tell a NEW failure (this
+// change's fault) from one that was ALREADY red on the base (e.g. a known-red
+// like persist-failure that fails even on clean origin/main — CLAUDE.md).
+// node --test prints `✖ <title> (1234.5ms)` (both inline and again under the
+// `✖ failing tests:` summary header, which carries no title and is skipped);
+// TAP prints `not ok N - <title>` (a `# SKIP`/`# TODO` directive is not a
+// failure). Titles are de-duplicated and sorted for a stable set-diff.
+export function parseFailingTestNames(text) {
+  const out = new Set();
+  const stripMs = (s) => s.replace(/\s*\(\d[\d.]*m?s\)\s*$/i, '').trim();
+  for (const raw of String(text ?? '').split('\n')) {
+    const line = raw.trim();
+    if (!line) continue;
+    let m = line.match(/^[✖✗✘×]\s+(.*)$/);
+    if (m) {
+      const title = stripMs(m[1].trim());
+      if (!title || /^failing tests:?$/i.test(title)) continue; // summary header
+      out.add(title);
+      continue;
+    }
+    m = line.match(/^not ok\s+\d+\s*-?\s*(.*)$/i);
+    if (m) {
+      if (/#\s*(SKIP|TODO)\b/i.test(line)) continue; // directive, not a real failure
+      const title = stripMs(m[1].replace(/\s+#.*$/, '').trim());
+      if (title) out.add(title);
+    }
+  }
+  return [...out].sort();
+}
+
+// Compare the CURRENT run's failing tests against the BASE (pre-change) run's
+// so the review gate blocks ONLY on failures this change introduced. A test
+// that was already red on the base is pre-existing noise (unrelated to the
+// goal) — it must not knock a proof-verified goal back to blocked/Failed.
+// Callers should treat an EMPTY baseline as "unknown" and fall back to the old
+// block-on-any-red behaviour (fail closed) — see verifyGate.
+export function classifyTestGate({ current = [], baseline = [] } = {}) {
+  const base = new Set(baseline);
+  const cur = [...new Set((current ?? []).filter(Boolean))];
+  const newFailures = cur.filter((t) => !base.has(t)).sort();
+  const preExisting = cur.filter((t) => base.has(t)).sort();
+  return { newFailures, preExisting, blocked: newFailures.length > 0 };
+}
+
+// The verification-gate decision (Masa 2026-07-19: "検証/proof は Failed を作らない").
+// PROOF IS ADVISORY: a UI goal whose screenshot could not be captured
+// (proofMissing) or whose pixel heuristic could not auto-confirm the target
+// (proofFailing) is NOT blocked — the work is done and reaches Review with a
+// note; proof adds confidence, it never subtracts a correct result. What still
+// blocks a goal from Review: newly-failing tests (testsFailing — the caller has
+// already made this baseline-aware via classifyTestGate), a promised-but-undone
+// task (nothingVerifiable = a passCondition with no file change and no proof),
+// and the opt-in requireVerifyPass gate (verifyFail, off by default). Pure so
+// the whole gate decision is unit-tested rather than living only inside the
+// server's big async verifyGate.
+export function classifyVerifyGate({
+  testsFailing = false, proofMissing = false, proofFailing = false,
+  nothingVerifiable = false, verifyFail = false,
+} = {}) {
+  const blocked = Boolean(testsFailing || nothingVerifiable || verifyFail);
+  const kind = testsFailing ? 'test' : nothingVerifiable ? 'noop' : verifyFail ? 'verify' : null;
+  // Advisory note surfaced on the review even when the goal is NOT blocked.
+  const proofAdvisory = proofMissing ? 'missing' : proofFailing ? 'unconfirmed' : null;
+  return { blocked, kind, proofAdvisory };
+}
+
 // Whether to ALSO capture a BASELINE ("before") shot for a before/after
 // comparison. Only worth attempting when the baseline is a genuinely
 // different checkout of the code than the one just captured as "after" — a
@@ -1907,7 +1974,42 @@ export const WORKFLOW_BUCKETS = ['todo', 'doing', 'review', 'done'];
 // Tools a `claude -p` worker may call (--allowedTools). TodoWrite must stay
 // in this list — it's how the UI's To-do section (sendTodos / SSE 'todos')
 // gets any data at all; without it workers can never emit {kind:'todos'}.
-export const WORKER_TOOLS = 'Edit,Write,Read,Glob,Grep,Skill,TodoWrite,Bash(node:*),Bash(npm:*),Bash(npx:*)';
+//
+// Bash was locked to node/npm/npx, which produced the "works in Claude Code,
+// fails here" class: a goal that legitimately needs python, a build tool, or
+// even a read-only `git log` would just fail — an error a plain Claude Code
+// session never hits. Widened here to the common legitimate commands.
+//
+// Honest note on what this list does and does NOT buy: it is friction control,
+// not a security boundary. Bash(node:*) already permits arbitrary execution
+// (`node -e "..."` can touch the network, delete files, anything), so the old
+// narrow list contained nothing — it only blocked honest direct commands.
+// Real isolation would need an OS sandbox (codex runs with --sandbox; the
+// claude-code worker does not). Given that, the exclusions below are posture,
+// not a wall:
+//   - git WRITE ops (commit/push/reset/checkout) are left off the fast path so
+//     the worker does not fight the Manager, which owns git in the worktree
+//     (the worker prompt already says "do not commit"). Read-only git is on.
+//   - rm / curl / wget stay off the fast path. (They are reachable via node
+//     anyway; keeping them non-first-class is a stated-posture choice. Whether
+//     to simplify to a blanket `Bash` — technically equivalent risk — is a
+//     customer-safety decision for Masa, not a silent flip here.)
+const WORKER_BASH = [
+  // JS/TS runtimes and package managers
+  'node', 'npm', 'npx', 'pnpm', 'yarn', 'bun', 'deno',
+  // other languages a task might actually need
+  'python', 'python3', 'pip', 'pip3', 'pytest', 'go', 'cargo', 'rustc',
+  'ruby', 'bundle', 'make',
+  // build/test/lint runners invoked directly
+  'tsc', 'jest', 'vitest', 'eslint', 'prettier',
+  // read-only git — inspect history/diffs like you would locally
+  'git status', 'git log', 'git diff', 'git show', 'git branch',
+  'git blame', 'git ls-files', 'git rev-parse',
+  // read/inspect shell utilities (file EDITS still go through Edit/Write)
+  'cat', 'ls', 'head', 'tail', 'wc', 'find', 'grep', 'rg',
+  'sed', 'awk', 'sort', 'uniq', 'diff', 'echo', 'which', 'env', 'pwd', 'date',
+].map((c) => `Bash(${c}:*)`).join(',');
+export const WORKER_TOOLS = `Edit,Write,Read,Glob,Grep,Skill,TodoWrite,${WORKER_BASH}`;
 
 // ---- SKILL picker ----------------------------------------------------------
 // Parse the YAML frontmatter of a SKILL.md / command .md and pull out `name`

package/engine/relay-supervisor.mjs

@@ -0,0 +1,113 @@
+// Launcher-side supervisor for the relay-client CHILD process.
+//
+// Why this exists (2026-07-18 incident): the launcher (bin/manager-for-ai.mjs)
+// spawns engine/relay-client.mjs exactly ONCE and only kills it when the parent
+// goes down — there was no path the other way (child dies -> bring it back).
+// relay-client already self-heals a dropped SOCKET (backoff reconnect, capped at
+// 15s), but when the whole PROCESS exits — an uncaught throw, or the single-
+// instance lock refusing to start — nothing respawns it, so the user's app
+// silently goes offline and every new goal shows "Unsent – tap to resend". This
+// is the customer-facing half of the fix (the operator's own box is now kept up
+// by a launchd KeepAlive job; npx users have no launchd, only this launcher).
+//
+// Split into a PURE policy reducer (relayRespawnDecision) and an impure driver
+// (superviseRelay) that owns spawn()/timers/clock — same shape as
+// relayReconnectDecision in engine/lib.mjs. The policy is unit-tested without any
+// real process; the driver is integration-tested with a fake child.
+
+// Fresh supervisor state. `delayMs` is the last backoff used; `quickExits` counts
+// consecutive exits that happened inside the "quick-crash" window; `gaveUp` latches
+// once the circuit breaker trips.
+export const relaySupervisorInit = { delayMs: 0, quickExits: 0, gaveUp: false };
+
+// Decide what to do when the supervised child exits. Pure — no clock, no I/O.
+//
+//   state : previous supervisor state (start from relaySupervisorInit)
+//   event : { uptimeMs } — how long the child that just exited had been alive
+//   opts  : tunables (defaults match the relay socket backoff feel)
+//     minMs   floor delay for the first / a reset respawn        (1s)
+//     maxMs   ceiling the exponential backoff saturates at       (15s)
+//     quickMs a child that lived less than this "crash-looped"   (10s)
+//     limit   consecutive quick exits before we give up          (5)
+//
+// Returns { restart, delayMs, gaveUp, state }.
+// - A child that lived past `quickMs` is treated as having made progress: the
+//   backoff and the quick-exit counter both reset (a healthy long run should not
+//   inherit a punishing delay from an earlier bad patch).
+// - Consecutive quick exits escalate the delay (min, 2x, 4x, ... capped at max)
+//   and, once they reach `limit`, trip the circuit breaker so we stop hammering a
+//   config/lock error forever. The caller logs why and stands down.
+export function relayRespawnDecision(state, event, opts = {}) {
+  const { minMs = 1000, maxMs = 15000, quickMs = 10000, limit = 5 } = opts;
+  const prev = Number(state?.delayMs);
+  const lastDelay = Number.isFinite(prev) ? prev : 0;
+  const uptimeMs = Number(event?.uptimeMs) || 0;
+  const quick = uptimeMs < quickMs;
+  const quickExits = quick ? (Number(state?.quickExits) || 0) + 1 : 0;
+
+  if (quickExits >= limit) {
+    return { restart: false, delayMs: 0, gaveUp: true, state: { delayMs: lastDelay, quickExits, gaveUp: true } };
+  }
+
+  const delayMs = quick
+    ? (lastDelay < minMs ? minMs : Math.min(lastDelay * 2, maxMs))
+    : minMs;
+  return { restart: true, delayMs, gaveUp: false, state: { delayMs, quickExits, gaveUp: false } };
+}
+
+// Drive a respawning child. Impure: owns spawn()/timers/clock, all injectable so
+// the loop is testable with a fake child and fast delays.
+//
+//   spawn     () => ChildProcess-like (must emit 'exit' and have .kill())
+//   now       () => ms clock (default Date.now)
+//   setTimer/clearTimer  timer fns (default global setTimeout/clearTimeout)
+//   log       ({ code, signal, delayMs }) => void  — a respawn was scheduled
+//   onGiveUp  () => void                           — circuit breaker tripped
+//   opts      passed through to relayRespawnDecision
+//
+// Returns { stop, child, state } — stop() suppresses further respawns (normal
+// shutdown) and kills the current child.
+export function superviseRelay({
+  spawn,
+  now = () => Date.now(),
+  setTimer = setTimeout,
+  clearTimer = clearTimeout,
+  log = () => {},
+  onGiveUp = () => {},
+  opts,
+} = {}) {
+  let shuttingDown = false;
+  let state = { ...relaySupervisorInit };
+  let child = null;
+  let startedAt = 0;
+  let timer = null;
+
+  const start = () => {
+    startedAt = now();
+    child = spawn();
+    child.on('exit', (code, signal) => {
+      child = null;
+      if (shuttingDown) return; // parent asked us to stop — don't fight it
+      const uptimeMs = now() - startedAt;
+      const decision = relayRespawnDecision(state, { uptimeMs }, opts);
+      state = decision.state;
+      if (!decision.restart) { onGiveUp(); return; }
+      log({ code, signal, delayMs: decision.delayMs });
+      timer = setTimer(start, decision.delayMs);
+      if (timer && typeof timer.unref === 'function') timer.unref();
+    });
+  };
+
+  const stop = () => {
+    shuttingDown = true;
+    if (timer) { clearTimer(timer); timer = null; }
+    try { child?.kill(); } catch { /* already gone */ }
+  };
+
+  start();
+  return {
+    stop,
+    get child() { return child; },
+    get state() { return state; },
+  };
+}

package/engine/server.mjs

@@ -21,7 +21,7 @@ import { homedir } from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { pathToFileURL } from 'node:url';
 import { needsProjectFolder, folderLabel, buildFolderQuestion, resolveFolderAnswer, classifyFolderTarget, buildFolderInitConfirm, isFolderInitConfirmed, needsReviewPreference, buildReviewPreferenceQuestion, resolveReviewPreferenceAnswer, routeQuestionAnswer, notUnderstoodNote, parseRelocalizedQuestion, classifyAuthProbe, authBannerText, makeSigninChallenge, parseClaimResponse } from './lib.mjs';
-import { parseStreamEvents, parsePlan, refinePlanTasks, findOverlappingGoal, canEditGoal, canDeleteGoal, shouldAskClarification, workerExitReason, isForcedStop, workerResultText, taskCountsAsComplete, resolveWantsPR, resolveGoalSource, buildGoalSummary, buildGoalProofMd, buildGoalPrBody, buildReviewRuleSection, nextGoalStatus, isPrMerged, isPrApproved, reviewToDoneStatus, advanceReviewGoal, revertReviewGoal, approveGoal, dismissGoal, permissionModeFor, isPlanReview, nextAfterPlanApprove, GOAL_MODES, parseSkillFrontmatter, collectSkills, retestGoal, cancelRetestGoal, computeRetestOutcome, revertGoal, planRevertActions, archiveGoal, unarchiveGoal, undismissGoal, parseNumstat, truncateDiffText, sumUsage, resolveEntryUrl, parseGitLog, diffNewCommits, replayQueueLog, reconcileOrphanGoals, reorderQueue, sortQueueByPriority, TASK_PRIORITIES, validateWorkflowColumns, DEFAULT_WORKFLOW_COLUMNS, validateReviewDefinition, DEFAULT_REVIEW_DEFINITION, buildEphemeralSeedLog, buildEphemeralSeedProjects, trimTaskActivityForState, buildAskContext, WORKER_TOOLS, verifyCfAccessJwt, resolveIdentity, goalVisibleTo, clampParallelLimit, canStartMore, nextRunnableTasks, goalsConflict, detectConflicts, pickFoldTarget, isUiChange, shouldCaptureProof, shouldCaptureBaseline, hasTestRelevantChanges, buildExecutionPlan, buildContextHandoffSummary, buildFailurePostmortem, appendFailureMemory, latestFailurePolicy, classifyChangeRisk, checkRunBudget, usageBudgetTokens, isRateLimited, nextResumeDelay, checkFreeTierLimit, resolveEntitlement, resolveCachedEntitlement, FREE_TIER_LIMITS, QUEUED_GOAL_STATUSES, verifyLicenseToken, shouldEmitSetupCompleted, pickAnalyticsUid, shouldEmitFreeExhausted, detectRequestLanguage, isNothingVerifiable, classifyComposerIntentHeuristic, buildIntentPrompt, parseIntentResponse, buildBoardSnapshot, validateBoardSnapshot, boardIsEmpty, decideBoardPull, resolveConnectedAgents, pickAvailableAgent, pickUtilityAgent, utilityModel, liveTakeoverDecision, shouldOpenBrowserOnBoot } from './lib.mjs';
+import { parseStreamEvents, parsePlan, refinePlanTasks, findOverlappingGoal, canEditGoal, canDeleteGoal, shouldAskClarification, workerExitReason, isForcedStop, workerResultText, taskCountsAsComplete, resolveWantsPR, resolveGoalSource, buildGoalSummary, buildGoalProofMd, buildGoalPrBody, buildReviewRuleSection, nextGoalStatus, isPrMerged, isPrApproved, reviewToDoneStatus, advanceReviewGoal, revertReviewGoal, approveGoal, dismissGoal, permissionModeFor, isPlanReview, nextAfterPlanApprove, GOAL_MODES, parseSkillFrontmatter, collectSkills, retestGoal, cancelRetestGoal, computeRetestOutcome, revertGoal, planRevertActions, archiveGoal, unarchiveGoal, undismissGoal, parseNumstat, truncateDiffText, sumUsage, resolveEntryUrl, parseGitLog, diffNewCommits, replayQueueLog, reconcileOrphanGoals, reorderQueue, sortQueueByPriority, TASK_PRIORITIES, validateWorkflowColumns, DEFAULT_WORKFLOW_COLUMNS, validateReviewDefinition, DEFAULT_REVIEW_DEFINITION, buildEphemeralSeedLog, buildEphemeralSeedProjects, trimTaskActivityForState, buildAskContext, WORKER_TOOLS, verifyCfAccessJwt, resolveIdentity, goalVisibleTo, clampParallelLimit, canStartMore, nextRunnableTasks, goalsConflict, detectConflicts, pickFoldTarget, isUiChange, shouldCaptureProof, shouldCaptureBaseline, hasTestRelevantChanges, parseFailingTestNames, classifyTestGate, classifyVerifyGate, buildExecutionPlan, buildContextHandoffSummary, buildFailurePostmortem, appendFailureMemory, latestFailurePolicy, classifyChangeRisk, checkRunBudget, usageBudgetTokens, isRateLimited, nextResumeDelay, checkFreeTierLimit, resolveEntitlement, resolveCachedEntitlement, FREE_TIER_LIMITS, QUEUED_GOAL_STATUSES, verifyLicenseToken, shouldEmitSetupCompleted, pickAnalyticsUid, shouldEmitFreeExhausted, detectRequestLanguage, isNothingVerifiable, classifyComposerIntentHeuristic, buildIntentPrompt, parseIntentResponse, buildBoardSnapshot, validateBoardSnapshot, boardIsEmpty, decideBoardPull, resolveConnectedAgents, pickAvailableAgent, pickUtilityAgent, utilityModel, liveTakeoverDecision, shouldOpenBrowserOnBoot } from './lib.mjs';
 import { openPR } from './pr.mjs';
 import { runVerification, exerciseUi } from './verify.mjs';
 
@@ -1755,7 +1755,17 @@ function queueReplyTask(goal, text) {
   tasks.push(task);
   saveTask(task);
   queues.get(goal.projectId).waiting.push(task);
-  pump(goal.projectId);
+  // Spawn the worker on the NEXT event-loop turn, not synchronously here. runTask() runs
+  // straight through to its first await — and that stretch includes goalWorkDir()'s
+  // `git worktree add` (measured 1.78s on a checkout with ~135 worktrees). Callers like
+  // POST /api/goals/:id/dismiss and /reply invoke queueReplyTask from inside their HTTP
+  // handler and send the 200 right after, so a synchronous pump() made the response wait on
+  // the worktree — the review UI looked stuck on "review" for seconds while the Ledger had
+  // already claimed "Feedback sent → back to To Do" (Masa 2026-07-19). setImmediate lets the
+  // response flush first; the task is already queued and persisted, so nothing is lost if the
+  // worker starts a turn later. (setImmediate, not nextTick/microtask: those run before the
+  // socket write flushes, so the blocking git call would still delay the response.)
+  setImmediate(() => pump(goal.projectId));
   return task;
 }
 
@@ -2192,8 +2202,12 @@ async function runTask(task) {
       } finally {
         eph?.kill();
       }
-      sendAct(task, `verify: ${verdict.pass ? 'PASS' : 'FAIL'} — ${verdict.detail.slice(0, 120)}`);
-      if (verdict.pass) break;
+      sendAct(task, `verify: ${verdict.pass ? 'PASS' : verdict.inconclusive ? 'INCONCLUSIVE (check could not run)' : 'FAIL'} — ${verdict.detail.slice(0, 120)}`);
+      // An inconclusive verdict = the check itself couldn't run (authored check
+      // referenced hooks the app doesn't expose — #487). Retrying will just
+      // throw again, so stop and let it route to human review rather than
+      // burning attempts and scoring the change as failed.
+      if (verdict.pass || verdict.inconclusive) break;
       lastFailure = verdict.detail;
     } catch (e) {
       sendAct(task, `verify: could not run — ${String(e.message ?? e).slice(0, 120)}`);
@@ -2212,11 +2226,19 @@ async function runTask(task) {
   //     FAIL verdict on a killed (incomplete) worker isn't authoritative either,
   //     so the stop reason takes precedence. (Mirrors the budget-breach path.)
   //  3. a verify that actually ran and FAILED = 'failed'.
-  //  4. no verify = the exit code decides.
+  //  4. an INCONCLUSIVE verify (the check threw / returned garbage — the
+  //     verifier is at fault, not necessarily the change, #487) is NOT
+  //     authoritative: fall through to the exit code so a cleanly-finished
+  //     worker still reaches review for a human, instead of a false 'failed'.
+  //  5. no verify = the exit code decides.
   const forcedStop = isForcedStop(code, timedOut);
+  // A verdict only counts as authoritative when the check actually judged the
+  // change. An inconclusive verdict (check threw / returned garbage) is treated
+  // like "no verdict" everywhere below — status, proof, and snapshot capture.
+  const conclusive = verdict && !verdict.inconclusive;
   task.status = verdict?.pass ? 'done'
     : forcedStop ? 'interrupted'
-    : verdict ? 'failed'
+    : conclusive ? 'failed'
     : (code === 0 ? 'done' : 'failed');
   // Never leave the reason as a bare "(no output)": if the worker produced no
   // report text, result already carries workerExitReason(); make doubly sure a
@@ -2225,19 +2247,26 @@ async function runTask(task) {
   task.result = result.slice(0, 4000);
   task.usage = sumUsage(usages);
   if (verdict) {
-    task.result = `検証${verdict.pass ? 'PASS' : 'FAIL'}: ${verdict.detail}\n\n${task.result}`.slice(0, 4000);
-    task.proof = {
-      pass: verdict.pass,
-      detail: verdict.detail.slice(0, 500),
-      gif: verdict.gifPath?.split('/').pop() ?? null,
-      png: verdict.shotPath?.split('/').pop() ?? null,
-      mp4: verdict.videoPath?.split('/').pop() ?? null,
-      // STRONG proof: this came from an independent passCondition verification,
-      // not a generic auto-snapshot. Only this flag lets a force-stopped (interrupted)
-      // task count toward goal completion (isProofVerified) — a weak "UI capture"
-      // snapshot never auto-promotes an interrupted goal past human review.
-      verified: true,
-    };
+    const label = verdict.pass ? 'PASS' : verdict.inconclusive ? 'INCONCLUSIVE (自動確認できず・要確認)' : 'FAIL';
+    task.result = `検証${label}: ${verdict.detail}\n\n${task.result}`.slice(0, 4000);
+    // Only attach an authoritative proof for a conclusive verdict. An
+    // inconclusive one must NOT leave a pass:false proof — that would trip
+    // verifyGate's proofFailing and re-block the goal through the back door
+    // (#487). Fall through to the snapshot capture below instead.
+    if (conclusive) {
+      task.proof = {
+        pass: verdict.pass,
+        detail: verdict.detail.slice(0, 500),
+        gif: verdict.gifPath?.split('/').pop() ?? null,
+        png: verdict.shotPath?.split('/').pop() ?? null,
+        mp4: verdict.videoPath?.split('/').pop() ?? null,
+        // STRONG proof: this came from an independent passCondition verification,
+        // not a generic auto-snapshot. Only this flag lets a force-stopped (interrupted)
+        // task count toward goal completion (isProofVerified) — a weak "UI capture"
+        // snapshot never auto-promotes an interrupted goal past human review.
+        verified: true,
+      };
+    }
   }
   const after = await gitChanges(workDir);
   task.changedFiles = after.filter((l) => !before.includes(l)).map((l) => l.slice(3));
@@ -2250,7 +2279,7 @@ async function runTask(task) {
   // baselineDir = the user's real project dir (unmodified, pre-goal code) —
   // when it's genuinely different from wproject.dir (a real worktree, not
   // the shared-dir fallback), also attempt a before/after pair.
-  if (!verdict && task.status === 'done' && shouldCaptureProof({ changedFiles: task.changedFiles, hasProof: Boolean(task.proof), canCapture: canSnapshot(wproject) })) {
+  if (!conclusive && task.status === 'done' && shouldCaptureProof({ changedFiles: task.changedFiles, hasProof: Boolean(task.proof), canCapture: canSnapshot(wproject) })) {
     try {
       sendAct(task, 'proof: capturing UI change (screenshot + clip) of the edited app…');
       await captureSnapshotProof(task, wproject, { baselineDir: project.dir, goal });
@@ -2305,7 +2334,9 @@ function runTestsOnce(dir) {
       const timeoutFlakes = (text.match(/did not report ready in time/g) || []).length;
       const realAssertion = /AssertionError|Expected values to be|expected .+ (?:to |but )/i.test(text);
       const failed = realAssertion ? failedTotal : Math.max(0, failedTotal - timeoutFlakes);
-      res({ passed, failed, detail: testOutputExcerpt(text) });
+      // Capture the failing test NAMES too (not just the count) so the gate can
+      // diff them against the base's failures and block only on NEW ones.
+      res({ passed, failed, detail: testOutputExcerpt(text), failingNames: parseFailingTestNames(text) });
     });
   });
 }
@@ -2320,13 +2351,45 @@ async function runProjectTests(dir) {
   // never blocked on a flaky test.
   if (r.failed > 0) {
     const r2 = await runTestsOnce(dir);
+    const kept = r2.failed <= r.failed ? r2 : r; // the run that saw fewer failures
     r = {
       passed: Math.max(r.passed, r2.passed),
       failed: Math.min(r.failed, r2.failed),
-      detail: (r2.failed <= r.failed ? r2.detail : r.detail) || r.detail || r2.detail || '',
+      detail: kept.detail || r.detail || r2.detail || '',
+      failingNames: kept.failingNames ?? r.failingNames ?? [],
     };
   }
-  return { ran: true, passed: r.passed, failed: r.failed, ok: r.failed === 0, detail: r.detail ?? '' };
+  return { ran: true, passed: r.passed, failed: r.failed, ok: r.failed === 0, detail: r.detail ?? '', failingNames: r.failingNames ?? [] };
+}
+
+// Failing tests on the BASE (pre-change) checkout — the set the review gate
+// subtracts so a goal is blocked only on failures IT introduced, never on a
+// test that was already red (e.g. persist-failure on clean origin/main). Lazy
+// + cached by the base's HEAD sha in MANAGER_HOME: computed only when a goal's
+// own run is red, then reused across goals sharing the same base (main moves a
+// few times a day, so this is a handful of full runs a day, not one per goal).
+// Any failure to compute → [] = "unknown", and the caller falls back to the
+// old block-on-any-red behaviour (fail closed).
+const BASELINE_CACHE = join(DATA_DIR, 'test-baseline.json');
+async function getBaselineFailures(baseProject) {
+  const dir = baseProject?.dir;
+  if (!dir) return [];
+  let sha = '';
+  try {
+    const r = spawnSync('git', ['-C', dir, 'rev-parse', 'HEAD'], { encoding: 'utf8' });
+    if (r.status === 0) sha = String(r.stdout || '').trim();
+  } catch { return []; }
+  if (!sha) return [];
+  try {
+    const cached = JSON.parse(readFileSync(BASELINE_CACHE, 'utf8'));
+    if (cached && cached.sha === sha && Array.isArray(cached.failingNames)) return cached.failingNames;
+  } catch { /* no cache yet */ }
+  let base;
+  try { base = await runProjectTests(dir); } catch { return []; }
+  if (!base?.ran) return [];
+  const failingNames = base.failingNames ?? [];
+  try { writeFileSync(BASELINE_CACHE, JSON.stringify({ sha, failingNames, at: new Date().toISOString() })); } catch { /* best effort */ }
+  return failingNames;
 }
 
 // ---- See all Ledger engine jobs (HANDOFF-v45 §5 / PRD §5.1) ----------------
@@ -2704,7 +2767,42 @@ async function verifyGate(goal, prProject, siblings, baseProject, activityTask =
   }
   const proofMissing = canCapture && uiTasks.length > 0 && !uiTasks.some((t) => t.proof);
   const proofFailing = canCapture && uiTasks.some((t) => t.proof && t.proof.pass === false);
-  const testsFailing = goal.testResult.ran && goal.testResult.failed > 0;
+  let testsFailing = goal.testResult.ran && goal.testResult.failed > 0;
+  // Baseline diff (Masa 2026-07-19): block ONLY on failures THIS change
+  // introduced. A test already red on the base — e.g. persist-failure on clean
+  // origin/main — is pre-existing noise and must not knock a proof-verified
+  // goal (#474/#494) or even a no-op goal (#465) back to blocked/Failed. Only
+  // consult the base when the goal's own run is red (keeps the green path free
+  // and pays the base run at most a few times a day, cached by base sha). An
+  // empty baseline = "unknown" → fall through to the old block-on-any-red.
+  // Only trust a baseline diff when the base is a genuinely SEPARATE checkout
+  // from the changed worktree. finishGoalIfComplete runs in the goal's own
+  // worktree (prProject.dir === the worktree), so the base must be the user's
+  // ORIGINAL project dir (on main ≈ origin/main, without this goal's change) —
+  // resolved from the registry, not the worktree-scoped project we were handed.
+  // When they'd be the same dir (shared-dir fallback, no isolated worktree) the
+  // "base" already contains this change, so fall back to the old block-on-any-
+  // red (fail closed).
+  const baseDir = projects.find((p) => p.id === goal.projectId)?.dir;
+  const canBaseline = baseDir && prProject?.dir && baseDir !== prProject.dir && existsSync(baseDir);
+  if (testsFailing && canBaseline) {
+    const baseline = await getBaselineFailures({ dir: baseDir });
+    if (baseline.length) {
+      const gate = classifyTestGate({ current: goal.testResult.failingNames ?? [], baseline });
+      goal.testResult.newFailures = gate.newFailures;
+      goal.testResult.preExisting = gate.preExisting;
+      if (!gate.blocked) {
+        testsFailing = false;
+        goal.testResult.preExistingOnly = true;
+        goalAct(`Project tests: ${gate.preExisting.length} failing test(s) were already red on the base (unrelated to this change), 0 new — not blocking. Pre-existing: ${gate.preExisting.slice(0, 3).join(' / ')}`);
+      } else {
+        goalAct(`Project tests: ${gate.newFailures.length} NEW failure(s) from this change (of ${goal.testResult.failed} total; ${gate.preExisting.length} pre-existing): ${gate.newFailures.slice(0, 3).join(' / ')}`);
+      }
+    }
+  }
+  // Count that drives the block message: the NEW failures when we could diff
+  // against the base, else the raw total (fail-closed when the base is unknown).
+  const blockingFailCount = goal.testResult.newFailures?.length ?? goal.testResult.failed;
   // §4補足: requireVerifyPass (opt-in, off by default) makes the gate strict —
   // EVERY task must carry a passing proof, not just UI tasks. Only ever tightens;
   // never conflicts with §6 (still can't reach Done without a human).
@@ -2722,16 +2820,19 @@ async function verifyGate(goal, prProject, siblings, baseProject, activityTask =
   if (testsFailing) {
     const failure = recordGoalFailure(goal, {
       kind: 'test',
-      reason: `テスト失敗 ${goal.testResult.failed} 件`,
+      reason: `テスト失敗 ${blockingFailCount} 件`,
       changedFiles,
       testResult: goal.testResult,
     });
+    const newFailList = goal.testResult.newFailures?.length
+      ? `Failures introduced by this change (fix ONLY these — pre-existing reds are not your fault):\n- ${goal.testResult.newFailures.join('\n- ')}`
+      : '';
     const used = Number(goal.autoRework?.testFailures ?? 0);
     if (used < MAX_AUTO_TEST_REWORKS) {
       goal.autoRework = {
         ...(goal.autoRework ?? {}),
         testFailures: used + 1,
-        lastReason: `テスト失敗 ${goal.testResult.failed} 件`,
+        lastReason: `テスト失敗 ${blockingFailCount} 件`,
         lastAt: new Date().toISOString(),
       };
       goal.blocked = null;
@@ -2739,7 +2840,8 @@ async function verifyGate(goal, prProject, siblings, baseProject, activityTask =
       saveGoal(goal);
       goalAct(`Tests failed; queued automatic worker feedback (${used + 1}/${MAX_AUTO_TEST_REWORKS}) with the failing output.`);
       queueReplyTask(goal, [
-        `Manager auto-feedback: npm test failed (${goal.testResult.failed} failing).`,
+        `Manager auto-feedback: npm test failed (${blockingFailCount} failing).`,
+        newFailList,
         failure?.whatHappened ? `What happened: ${failure.whatHappened}` : '',
         failure?.yourCall ?? 'Please inspect the failure output below, fix the regression, and rerun the project tests until they pass.',
         failure?.nextPolicy ? `Prevention policy: ${failure.nextPolicy}` : '',
@@ -2751,23 +2853,32 @@ async function verifyGate(goal, prProject, siblings, baseProject, activityTask =
       return;
     }
   }
-  if (testsFailing || proofMissing || proofFailing || verifyFail || nothingVerifiable) {
+  // Proof is advisory now (Masa 2026-07-19): proofMissing / proofFailing no
+  // longer block — the work is done; a screenshot that could not be captured or
+  // a pixel heuristic that could not auto-confirm the target is a NOTE on the
+  // review, not a Failed goal (audit false-failure #3/#2). The proof artifact
+  // (when there is one) is still attached for the human to look at. What still
+  // blocks: newly-failing tests, a promised-but-undone task, opt-in verifyFail.
+  const gate = classifyVerifyGate({ testsFailing, proofMissing, proofFailing, verifyFail, nothingVerifiable });
+  goal.proofNote = gate.proofAdvisory === 'missing'
+    ? 'UI変更ですが proof(スクショ/動画) を撮影できませんでした — 目視で確認してください'
+    : gate.proofAdvisory === 'unconfirmed'
+      ? 'proof は撮れましたが、依頼対象のUIを自動確認できませんでした — 目視で確認してください'
+      : null;
+  if (goal.proofNote) goalAct(`Proof advisory (not blocking): ${goal.proofNote}`);
+  if (gate.blocked) {
     if (!testsFailing) {
       recordGoalFailure(goal, {
-        kind: (proofMissing || proofFailing) ? 'proof' : nothingVerifiable ? 'noop' : 'verify',
-        reason: proofMissing ? 'UI変更なのに proof(スクショ/動画) が取れていない'
-          : proofFailing ? 'UI proof は撮れたが、依頼対象のUIを確認できていない'
-          : nothingVerifiable ? '検証条件つきのタスクなのに、ファイル変更も proof も無い（約束した検証が行われていない）'
+        kind: gate.kind,
+        reason: nothingVerifiable ? '検証条件つきのタスクなのに、ファイル変更も proof も無い（約束した検証が行われていない）'
           : '検証(proof)が全タスク分そろっていない（requireVerifyPass）',
         changedFiles,
         testResult: goal.testResult,
       });
     }
     goal.blocked = {
-      kind: testsFailing ? 'test' : (proofMissing || proofFailing) ? 'proof' : nothingVerifiable ? 'noop' : 'verify',
-      reason: testsFailing ? `テスト失敗 ${goal.testResult.failed} 件（自動修正 ${Number(goal.autoRework?.testFailures ?? 0)} 回後も失敗）`
-        : proofMissing ? 'UI変更なのに proof(スクショ/動画) が取れていない'
-        : proofFailing ? 'UI proof は撮れたが、依頼対象のUIを確認できていない'
+      kind: gate.kind,
+      reason: testsFailing ? `テスト失敗 ${blockingFailCount} 件（自動修正 ${Number(goal.autoRework?.testFailures ?? 0)} 回後も失敗）`
         : nothingVerifiable ? '検証条件つきのタスクなのに、ファイル変更も proof も無い（約束した検証が行われていない）'
         : '検証(proof)が全タスク分そろっていない（requireVerifyPass）',
     };
@@ -2777,7 +2888,10 @@ async function verifyGate(goal, prProject, siblings, baseProject, activityTask =
     goal.blocked = null;
     if (goal.autoRework?.testFailures) goal.autoRework = { ...goal.autoRework, resolvedAt: new Date().toISOString() };
     goal.status = nextGoalStatus({ allDone, wantsPR: goal.wantsPR, allVerified, reviewDefinition });
-    goalAct(`Verification gate passed; moving goal to ${goal.status}.`);
+    const preNote = goal.testResult?.preExistingOnly
+      ? ` (${goal.testResult.preExisting?.length ?? 0} pre-existing test failure(s) ignored as unrelated to this change)`
+      : '';
+    goalAct(`Verification gate passed; moving goal to ${goal.status}.${preNote}${goal.proofNote ? ` [proof advisory: ${goal.proofNote}]` : ''}`);
   }
 }
 

package/engine/verify.mjs

@@ -129,10 +129,17 @@ export async function runVerification({ entryUrl, verify, outBase, record = true
     try {
       result = await verify(page, makeUiHelpers(page));
       if (!result || typeof result.pass !== 'boolean') {
-        result = { pass: false, detail: `verify script returned an invalid result: ${JSON.stringify(result).slice(0, 200)}` };
+        // The check did not produce a verdict — the VERIFIER is at fault, not
+        // necessarily the change. Mark inconclusive so the caller routes it to
+        // human review instead of scoring the worker's change as failed.
+        result = { pass: false, inconclusive: true, detail: `verify script returned an invalid result: ${JSON.stringify(result).slice(0, 200)}` };
       }
     } catch (e) {
-      result = { pass: false, detail: `verify script threw: ${String(e.message ?? e).slice(0, 300)}` };
+      // The check threw (e.g. an authored check referencing renderTasks/
+      // window.state that the booted app doesn't expose — goal #487). It never
+      // reached a real judgement, so this is inconclusive, NOT "the change is
+      // broken". The caller must not mark the task failed on this alone.
+      result = { pass: false, inconclusive: true, detail: `verify script threw: ${String(e.message ?? e).slice(0, 300)}` };
     }
     await sleep(1200); // keep the outcome on screen in the video
     if (recorder) await recorder.stop();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@galda/cli",
-  "version": "0.10.34",
+  "version": "0.10.35",
   "type": "module",
   "description": "Galda - hand off work to Claude Code or Codex, get proof back. Runs on your existing subscription, no extra API cost.",
   "scripts": {