@mindlace/chreode 0.1.0 → 0.3.0

package/dist/flakes/report.js

@@ -0,0 +1,45 @@
+import { resolveFlakes } from '../config/types.js';
+import { defaultExec } from '../run/exec.js';
+import { ghLedgerDeps } from './gh.js';
+import { flakeLogPath } from './log.js';
+import { escalationFailure, runFlakePhase } from './phase.js';
+/** `chreode flake-report`: the signoff flake phase on its own, for hosted CI or by hand.
+ *  Without a `flakes` block it uses the defaults: running it is the opt-in. */
+export function runFlakeReport(config, overrides = {}) {
+    const d = {
+        exec: defaultExec,
+        ledger: ghLedgerDeps(),
+        logPath: flakeLogPath(),
+        log: (m) => console.log(m),
+        warn: (m) => console.warn(m),
+        error: (m) => console.error(m),
+        ...overrides
+    };
+    const flakes = config.flakes ?? resolveFlakes({});
+    const sha = d.exec('git', ['rev-parse', 'HEAD']).trim();
+    let branch = 'HEAD';
+    try {
+        branch = d.exec('git', ['symbolic-ref', '-q', '--short', 'HEAD']).trim();
+    }
+    catch {
+        // Detached, e.g. a CI checkout of a sha.
+    }
+    const outcome = runFlakePhase({
+        logPath: d.logPath,
+        ctx: { branch, sha },
+        config: flakes,
+        ledger: d.ledger,
+        log: d.log,
+        warn: d.warn
+    });
+    if (outcome.kind === 'none') {
+        d.log('[chreode] flakes: no flakes recorded');
+        return 0;
+    }
+    const failure = escalationFailure(outcome, flakes);
+    if (failure !== undefined) {
+        d.error(failure);
+        return 1;
+    }
+    return 0;
+}

package/dist/git/version-only.d.ts

@@ -0,0 +1,11 @@
+import { type Exec } from '../run/exec.js';
+/**
+ * True when `path` is a package.json or package-lock.json (at any depth) present on both
+ * sides whose only difference between base and head is its version field(s) (for the
+ * lockfile, the top-level `version` and `packages[""].version`). Anything else, including
+ * an added or deleted file or unparseable JSON, is false: the caller falls back to treating
+ * the path as an ordinary change.
+ */
+export declare function isVersionOnlyChange(base: string, head: string, path: string, exec?: Exec): boolean;
+/** The subset of `paths` that are version-only changes between base and head. */
+export declare function versionOnlyPaths(base: string, head: string, paths: readonly string[], exec?: Exec): string[];

package/dist/git/version-only.js

@@ -0,0 +1,56 @@
+import { posix } from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
+import { defaultExec } from '../run/exec.js';
+function isObject(v) {
+    return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+/** Each version-bearing file: the version fields it carries, read and blanked. */
+const VERSIONED = {
+    'package.json': (doc) => {
+        const { version, ...rest } = doc;
+        return { versions: [version], rest };
+    },
+    'package-lock.json': (doc) => {
+        const { version, ...rest } = doc;
+        const packages = rest.packages;
+        if (!isObject(packages) || !isObject(packages['']))
+            return { versions: [version], rest };
+        const { version: rootVersion, ...root } = packages[''];
+        return {
+            versions: [version, rootVersion],
+            rest: { ...rest, packages: { ...packages, '': root } }
+        };
+    }
+};
+function readJson(rev, path, exec) {
+    try {
+        const doc = JSON.parse(exec('git', ['show', `${rev}:${path}`]));
+        return isObject(doc) ? doc : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * True when `path` is a package.json or package-lock.json (at any depth) present on both
+ * sides whose only difference between base and head is its version field(s) (for the
+ * lockfile, the top-level `version` and `packages[""].version`). Anything else, including
+ * an added or deleted file or unparseable JSON, is false: the caller falls back to treating
+ * the path as an ordinary change.
+ */
+export function isVersionOnlyChange(base, head, path, exec = defaultExec) {
+    const strip = VERSIONED[posix.basename(path)];
+    if (strip === undefined)
+        return false;
+    const before = readJson(base, path, exec);
+    const after = readJson(head, path, exec);
+    if (before === null || after === null)
+        return false;
+    const a = strip(before);
+    const b = strip(after);
+    return isDeepStrictEqual(a.rest, b.rest) && !isDeepStrictEqual(a.versions, b.versions);
+}
+/** The subset of `paths` that are version-only changes between base and head. */
+export function versionOnlyPaths(base, head, paths, exec = defaultExec) {
+    return paths.filter((p) => isVersionOnlyChange(base, head, p, exec));
+}

package/dist/index.d.ts

@@ -1,2 +1,4 @@
 export { defineConfig } from './config/types.js';
-export type { AllowlistEntry, ChreodeConfig, Matcher, ProtectionConfig, RuleConfig, StepConfig, StepContext } from './config/types.js';
+export { burnInStep, type BurnInStepOptions } from './burn-in/step.js';
+export type { AllowlistEntry, BurnInConfig, BurnInRunner, ChreodeConfig, FlakesConfig, Matcher, ProtectionConfig, RuleConfig, StepConfig, StepContext } from './config/types.js';
+export type { FlakeEvent } from './flakes/log.js';

package/dist/index.js

@@ -1 +1,2 @@
 export { defineConfig } from './config/types.js';
+export { burnInStep } from './burn-in/step.js';

package/dist/reporters/options.d.ts

@@ -0,0 +1,17 @@
+import { type FlakeEvent } from '../flakes/log.js';
+export interface FlakeReporterOptions {
+    /** Issue-title bucket: fixed, or derived from the runner project name. */
+    kind?: string | ((project: string) => string);
+    /** Record only these runner projects (default: all). */
+    projects?: string[];
+    /** Where events go (default: appended to the flake log). A seam for tests. */
+    append?: (event: FlakeEvent) => void;
+}
+export declare function resolveKind(kind: FlakeReporterOptions['kind'], project: string, fallback: string): string;
+export declare function wants(projects: readonly string[] | undefined, project: string): boolean;
+/** The sha under test when running under signoff. */
+export declare function headSha(env?: NodeJS.ProcessEnv): {
+    sha?: string;
+};
+/** Resolved at write time, so CHREODE_FLAKE_LOG set by signoff is honoured. */
+export declare function defaultAppend(event: FlakeEvent): void;

package/dist/reporters/options.js

@@ -0,0 +1,18 @@
+import { appendFlakeEvent, flakeLogPath } from '../flakes/log.js';
+export function resolveKind(kind, project, fallback) {
+    if (typeof kind === 'function')
+        return kind(project);
+    return kind ?? fallback;
+}
+export function wants(projects, project) {
+    return projects === undefined || projects.includes(project);
+}
+/** The sha under test when running under signoff. */
+export function headSha(env = process.env) {
+    const sha = env.CHREODE_HEAD;
+    return sha ? { sha } : {};
+}
+/** Resolved at write time, so CHREODE_FLAKE_LOG set by signoff is honoured. */
+export function defaultAppend(event) {
+    appendFlakeEvent(event, flakeLogPath());
+}

package/dist/reporters/playwright.d.ts

@@ -0,0 +1,15 @@
+import type { Reporter, TestCase, TestResult } from 'playwright/types/testReporter';
+import { type FlakeReporterOptions } from './options.js';
+/**
+ * Records every test that failed (or timed out) and then passed on a retry. Playwright loads
+ * reporters by module specifier, hence the default export. Imports Playwright's types only.
+ */
+export default class PlaywrightFlakeReporter implements Reporter {
+    private readonly options;
+    private readonly append;
+    /** The first failed attempt of each test that has not passed yet. */
+    private readonly failed;
+    constructor(options?: FlakeReporterOptions);
+    onTestEnd(test: TestCase, result: TestResult): void;
+    printsToStdio(): boolean;
+}

package/dist/reporters/playwright.js

@@ -0,0 +1,47 @@
+import { repoRelative, truncateError } from '../flakes/log.js';
+import { defaultAppend, headSha, resolveKind, wants } from './options.js';
+/**
+ * Records every test that failed (or timed out) and then passed on a retry. Playwright loads
+ * reporters by module specifier, hence the default export. Imports Playwright's types only.
+ */
+export default class PlaywrightFlakeReporter {
+    options;
+    append;
+    /** The first failed attempt of each test that has not passed yet. */
+    failed = new Map();
+    constructor(options = {}) {
+        this.options = options;
+        this.append = options.append ?? defaultAppend;
+    }
+    onTestEnd(test, result) {
+        if (result.status === 'failed' || result.status === 'timedOut') {
+            if (!this.failed.has(test.id))
+                this.failed.set(test.id, result);
+            return;
+        }
+        const first = this.failed.get(test.id);
+        if (result.status !== 'passed' || result.retry === 0 || first === undefined)
+            return;
+        this.failed.delete(test.id);
+        // ['', project, file, ...describes, title]
+        const titlePath = test.titlePath();
+        const project = titlePath[1] ?? '';
+        if (!wants(this.options.projects, project))
+            return;
+        const trace = first.attachments.find((a) => a.name === 'trace')?.path;
+        this.append({
+            kind: resolveKind(this.options.kind, project, 'e2e'),
+            runner: 'playwright',
+            project,
+            file: repoRelative(test.location.file),
+            title: titlePath.slice(3).join(' › '),
+            firstAttemptError: truncateError(first.error?.message),
+            ...(trace ? { tracePath: trace } : {}),
+            ...headSha(),
+            at: new Date().toISOString()
+        });
+    }
+    printsToStdio() {
+        return false;
+    }
+}

package/dist/reporters/vitest.d.ts

@@ -0,0 +1,15 @@
+import type { Reporter, TestModule } from 'vitest/node';
+import { type FlakeReporterOptions } from './options.js';
+/**
+ * Records every test that passed after at least one retry. vitest reporters are a root-level
+ * option, so instantiate this in the root config's `reporters`; it sees every project and
+ * filters with `projects`. Imports vitest's types only.
+ */
+export declare class VitestFlakeReporter implements Reporter {
+    private readonly options;
+    private readonly append;
+    constructor(options?: FlakeReporterOptions);
+    onTestRunEnd(testModules: ReadonlyArray<TestModule>): void;
+    private walk;
+}
+export default VitestFlakeReporter;

package/dist/reporters/vitest.js

@@ -0,0 +1,47 @@
+import { repoRelative, truncateError } from '../flakes/log.js';
+import { defaultAppend, headSha, resolveKind, wants } from './options.js';
+/**
+ * Records every test that passed after at least one retry. vitest reporters are a root-level
+ * option, so instantiate this in the root config's `reporters`; it sees every project and
+ * filters with `projects`. Imports vitest's types only.
+ */
+export class VitestFlakeReporter {
+    options;
+    append;
+    constructor(options = {}) {
+        this.options = options;
+        this.append = options.append ?? defaultAppend;
+    }
+    onTestRunEnd(testModules) {
+        for (const testModule of testModules) {
+            const project = testModule.project.name;
+            if (!wants(this.options.projects, project))
+                continue;
+            const where = { project, file: repoRelative(testModule.moduleId) };
+            this.walk(testModule.children.array(), [], where);
+        }
+    }
+    walk(entities, titles, where) {
+        for (const entity of entities) {
+            if (entity.type === 'suite') {
+                this.walk(entity.children.array(), [...titles, entity.name], where);
+                continue;
+            }
+            const result = entity.result();
+            if (result.state !== 'passed' || (entity.diagnostic()?.retryCount ?? 0) === 0)
+                continue;
+            this.append({
+                kind: resolveKind(this.options.kind, where.project, where.project || 'unit'),
+                runner: 'vitest',
+                project: where.project,
+                file: where.file,
+                title: [...titles, entity.name].join(' › '),
+                // A test that passed on retry still reports the errors of its failed attempts.
+                firstAttemptError: truncateError(result.errors?.[0]?.message),
+                ...headSha(),
+                at: new Date().toISOString()
+            });
+        }
+    }
+}
+export default VitestFlakeReporter;

package/dist/run/stderr.d.ts

@@ -1,4 +1,5 @@
 import type { AllowlistEntry } from '../config/types.js';
+export declare function stripAnsi(s: string): string;
 /** Classify captured stderr line by line: blank and allowlisted lines are benign,
  *  everything else is returned ANSI-stripped. */
 export declare function policeStderr(buffer: string, allowlist: readonly AllowlistEntry[]): {

package/dist/run/stderr.js

@@ -1,12 +1,15 @@
 // ANSI SGR color codes must not defeat allowlist matching. The escape character is built at
 // runtime so no control character appears in source (keeps no-control-regex quiet).
 const ANSI_SGR = new RegExp(`${String.fromCharCode(27)}\\[[0-9;]*m`, 'g');
+export function stripAnsi(s) {
+    return s.replace(ANSI_SGR, '');
+}
 /** Classify captured stderr line by line: blank and allowlisted lines are benign,
  *  everything else is returned ANSI-stripped. */
 export function policeStderr(buffer, allowlist) {
     const offendingLines = buffer
         .split(/\r?\n/)
-        .map((line) => line.replace(ANSI_SGR, ''))
+        .map(stripAnsi)
         .filter((line) => line.trim() !== '')
         .filter((line) => !allowlist.some((entry) => {
         entry.pattern.lastIndex = 0;

package/dist/signoff/plan.d.ts

@@ -1,4 +1,4 @@
-import type { ResolvedConfig, ResolvedStep, RuleConfig } from '../config/types.js';
+import type { Matcher, ResolvedConfig, ResolvedStep, RuleConfig } from '../config/types.js';
 export declare class PlanError extends Error {
     constructor(message: string);
 }
@@ -9,6 +9,8 @@ export interface PlanInput {
     base: string;
     head: string;
     isWorktree: boolean;
+    /** Changed package.json / package-lock.json paths whose only change is the version. */
+    versionOnly: readonly string[];
 }
 export interface PlannedStep {
     label: string;
@@ -30,6 +32,9 @@ export interface Plan {
     triggers: string[];
     /** Changed paths no rule matched; each one fired every trigger. */
     unmatched: string[];
+    /** Changed paths no rule matched that were version-only bumps; each fired only the
+     *  config's versionBumpTriggers. */
+    versionOnly: string[];
     steps: PlannedStep[];
     skipped: {
         label: string;
@@ -38,12 +43,21 @@ export interface Plan {
     /** Steps that would have run but for --skip: these go in the status description. */
     skippedByFlag: string[];
 }
+export declare function matchesAny(path: string, matchers: Matcher | Matcher[]): boolean;
 export declare function matchRule(path: string, rules: readonly RuleConfig[]): RuleConfig | null;
 export declare function allTriggers(steps: readonly ResolvedStep[]): string[];
-/** Rules can only make a run smaller by matching: an unmatched path fires everything. */
-export declare function fireTriggers(paths: readonly string[], rules: readonly RuleConfig[], steps: readonly ResolvedStep[]): {
+export interface VersionBumps {
+    /** Paths whose only change is a version bump. */
+    versionOnly: readonly string[];
+    /** What such a path fires when no rule matched it. */
+    versionBumpTriggers: readonly string[];
+}
+/** Rules can only make a run smaller by matching: an unmatched path fires everything,
+ *  unless it is a version-only bump, which fires just the versionBumpTriggers. */
+export declare function fireTriggers(paths: readonly string[], rules: readonly RuleConfig[], steps: readonly ResolvedStep[], bumps?: VersionBumps): {
     triggers: string[];
     unmatched: string[];
+    versionOnly: string[];
 };
 export declare function planSignoff(config: ResolvedConfig, input: PlanInput): Plan;
 export declare function describeSkip(reason: SkipReason): string;

package/dist/signoff/plan.js

@@ -14,10 +14,12 @@ function tester(m) {
         return m.test(path);
     };
 }
+export function matchesAny(path, matchers) {
+    return (Array.isArray(matchers) ? matchers : [matchers]).some((m) => tester(m)(path));
+}
 export function matchRule(path, rules) {
     for (const rule of rules) {
-        const matchers = Array.isArray(rule.match) ? rule.match : [rule.match];
-        if (matchers.some((m) => tester(m)(path)))
+        if (matchesAny(path, rule.match))
             return rule;
     }
     return null;
@@ -25,19 +27,31 @@ export function matchRule(path, rules) {
 export function allTriggers(steps) {
     return [...new Set(steps.flatMap((s) => s.when))].sort();
 }
-/** Rules can only make a run smaller by matching: an unmatched path fires everything. */
-export function fireTriggers(paths, rules, steps) {
+/** Rules can only make a run smaller by matching: an unmatched path fires everything,
+ *  unless it is a version-only bump, which fires just the versionBumpTriggers. */
+export function fireTriggers(paths, rules, steps, bumps = { versionOnly: [], versionBumpTriggers: [] }) {
     const fired = new Set();
     const unmatched = [];
+    const versionOnly = [];
+    const bumped = new Set(bumps.versionOnly);
     for (const path of paths) {
         const rule = matchRule(path, rules);
-        const triggers = rule === null ? allTriggers(steps) : rule.triggers;
-        if (rule === null)
+        let triggers;
+        if (rule !== null) {
+            triggers = rule.triggers;
+        }
+        else if (bumped.has(path)) {
+            versionOnly.push(path);
+            triggers = bumps.versionBumpTriggers;
+        }
+        else {
             unmatched.push(path);
+            triggers = allTriggers(steps);
+        }
         for (const t of triggers)
             fired.add(t);
     }
-    return { triggers: [...fired].sort(), unmatched };
+    return { triggers: [...fired].sort(), unmatched, versionOnly };
 }
 export function planSignoff(config, input) {
     const known = config.steps.map((s) => s.label);
@@ -45,9 +59,12 @@ export function planSignoff(config, input) {
     if (unknownSkips.length > 0) {
         throw new PlanError(`--skip names unknown step(s): ${unknownSkips.join(', ')} (known: ${known.join(', ')})`);
     }
-    const { triggers, unmatched } = input.full
-        ? { triggers: allTriggers(config.steps), unmatched: [] }
-        : fireTriggers(input.paths, config.rules, config.steps);
+    const { triggers, unmatched, versionOnly } = input.full
+        ? { triggers: allTriggers(config.steps), unmatched: [], versionOnly: [] }
+        : fireTriggers(input.paths, config.rules, config.steps, {
+            versionOnly: input.versionOnly,
+            versionBumpTriggers: config.versionBumpTriggers
+        });
     const ctx = {
         base: input.base,
         head: input.head,
@@ -94,7 +111,7 @@ export function planSignoff(config, input) {
             timeoutMs: step.timeoutMs
         });
     }
-    return { triggers, unmatched, steps, skipped, skippedByFlag };
+    return { triggers, unmatched, versionOnly, steps, skipped, skippedByFlag };
 }
 export function describeSkip(reason) {
     switch (reason.kind) {

package/dist/signoff/preconditions.d.ts

@@ -7,4 +7,6 @@ export interface Preconditions {
     /** git user.email: named in the status description. */
     signer: string;
 }
-export declare function checkPreconditions(baseBranch: string, exec?: Exec): Preconditions;
+export declare function checkPreconditions(baseBranch: string, exec?: Exec, opts?: {
+    flakes: boolean;
+}): Preconditions;

package/dist/signoff/preconditions.js

@@ -1,3 +1,4 @@
+import { FLAKE_LOG_FILE } from '../flakes/log.js';
 import { defaultExec } from '../run/exec.js';
 export class PreconditionError extends Error {
     constructor(message) {
@@ -5,7 +6,7 @@ export class PreconditionError extends Error {
         this.name = 'PreconditionError';
     }
 }
-export function checkPreconditions(baseBranch, exec = defaultExec) {
+export function checkPreconditions(baseBranch, exec = defaultExec, opts = { flakes: false }) {
     if (exec('git', ['status', '--porcelain']).trim() !== '') {
         throw new PreconditionError('working tree is dirty; commit or stash before signing off');
     }
@@ -29,6 +30,15 @@ export function checkPreconditions(baseBranch, exec = defaultExec) {
     if (behind !== '') {
         throw new PreconditionError('HEAD is behind its upstream; pull before signing off');
     }
+    if (opts.flakes) {
+        try {
+            exec('git', ['check-ignore', '-q', FLAKE_LOG_FILE]);
+        }
+        catch {
+            throw new PreconditionError('`flakes` is configured but .chreode/ is not gitignored (the flake log would dirty ' +
+                'the tree); add the line `.chreode/` to .gitignore');
+        }
+    }
     try {
         exec('gh', ['auth', 'status']);
     }

package/dist/signoff/run.d.ts

@@ -1,4 +1,5 @@
 import type { ResolvedConfig } from '../config/types.js';
+import type { FlakeLedgerDeps } from '../flakes/ledger.js';
 import { type MachineLock } from '../lock/machine-lock.js';
 import { type Exec, type Run } from '../run/exec.js';
 import { type StepOutcome } from '../run/step.js';
@@ -19,6 +20,10 @@ export interface SignoffDeps {
     lock: MachineLock;
     runStep: (step: PlannedStep) => Promise<StepOutcome>;
     tail: TailEffects;
+    /** Files, bumps and lists flake issues. */
+    ledger: FlakeLedgerDeps;
+    /** Absolute path of the flake log; steps see it as CHREODE_FLAKE_LOG. */
+    flakeLog: string;
     log: (m: string) => void;
     warn: (m: string) => void;
     error: (m: string) => void;

package/dist/signoff/run.js

@@ -1,5 +1,10 @@
+import { resolve } from 'node:path';
+import { ghLedgerDeps } from '../flakes/gh.js';
+import { FLAKE_LOG_FILE } from '../flakes/log.js';
+import { escalationFailure, runFlakePhase } from '../flakes/phase.js';
 import { committedPaths, isWorktree, resolveBase, resolveRef } from '../git/change-set.js';
 import { mergeBaseBranch } from '../git/merge.js';
+import { versionOnlyPaths } from '../git/version-only.js';
 import { repoInfo } from '../github/status.js';
 import { signoffLock } from '../lock/machine-lock.js';
 import { defaultExec, defaultRun } from '../run/exec.js';
@@ -7,9 +12,9 @@ import { StepFailure, runStep, runSteps } from '../run/step.js';
 import { PlanError, describeSkip, planSignoff } from './plan.js';
 import { PreconditionError, checkPreconditions } from './preconditions.js';
 import { defaultTailEffects, runTail } from './tail.js';
-function defaultDeps(config, opts) {
+function defaultDeps(config, opts, stepEnv = {}) {
     // Children can detect the gate (e.g. to quiet build-tool stderr) via CHREODE_SIGNOFF=1.
-    const env = { ...process.env, CHREODE_SIGNOFF: '1' };
+    const env = { ...process.env, CHREODE_SIGNOFF: '1', ...stepEnv };
     let repo = null;
     const getRepo = () => (repo ??= repoInfo(defaultExec));
     return {
@@ -18,6 +23,9 @@ function defaultDeps(config, opts) {
         lock: signoffLock(),
         runStep: (step) => runStep(step, { allowStderr: opts.allowStderr, allowlist: config.stderrAllowlist, env }),
         tail: defaultTailEffects(getRepo, config.statusContext),
+        ledger: ghLedgerDeps(defaultExec),
+        // The CLI has already chdir'd to the repo root.
+        flakeLog: resolve(FLAKE_LOG_FILE),
         log: (m) => console.log(m),
         warn: (m) => console.warn(m),
         error: (m) => console.error(m)
@@ -41,6 +49,9 @@ export function printPlan(plan, where, log) {
     if (plan.unmatched.length > 0) {
         log(`[chreode] matched no rule, so every trigger fired: ${plan.unmatched.join(', ')}`);
     }
+    if (plan.versionOnly.length > 0) {
+        log(`[chreode] version-only: ${plan.versionOnly.join(', ')}`);
+    }
     log(`[chreode] triggers: ${plan.triggers.length > 0 ? plan.triggers.join(', ') : '(none)'}`);
     log(`[chreode] plan: ${plan.steps.length > 0 ? plan.steps.map((s) => s.label).join(', ') : '(no steps: a no-op signoff)'}`);
     for (const { label, reason } of plan.skipped) {
@@ -58,7 +69,7 @@ export async function runSignoff(loadConfig, opts, overrides = {}) {
     // 1. Preconditions
     let pre;
     try {
-        pre = checkPreconditions(baseBranch, d.exec);
+        pre = checkPreconditions(baseBranch, d.exec, { flakes: config.flakes !== null });
     }
     catch (err) {
         if (err instanceof PreconditionError) {
@@ -141,7 +152,8 @@ export async function runSignoff(loadConfig, opts, overrides = {}) {
             skip: opts.skip,
             base,
             head,
-            isWorktree: isWorktree(d.exec)
+            isWorktree: isWorktree(d.exec),
+            versionOnly: opts.full ? [] : versionOnlyPaths(base, head, paths, d.exec)
         });
     }
     catch (err) {
@@ -156,16 +168,41 @@ export async function runSignoff(loadConfig, opts, overrides = {}) {
         d.log('[chreode] --dry-run: stopping before the run');
         return 0;
     }
-    // 5. Run
-    let allowedStderr;
+    // 5. Run. Steps learn the sha under test and where reporters record flakes.
+    d = {
+        ...defaultDeps(config, opts, { CHREODE_HEAD: head, CHREODE_FLAKE_LOG: d.flakeLog }),
+        ...overrides
+    };
+    let allowedStderr = [];
+    let stepsFailed = false;
     try {
         allowedStderr = await runSteps(plan.steps, d.lock, d.runStep);
     }
     catch (err) {
         if (!(err instanceof StepFailure))
             d.error(`[chreode] ${message(err)}`);
-        return 1;
+        stepsFailed = true;
+    }
+    // 6. Flakes: after the steps, passed or failed, so a flake is charged to the run that saw
+    //    it. Network, not machine load: the lock is already released.
+    let escalated = false;
+    if (config.flakes !== null) {
+        const outcome = runFlakePhase({
+            logPath: d.flakeLog,
+            ctx: { branch: pre.branch, sha: head },
+            config: config.flakes,
+            ledger: d.ledger,
+            log: d.log,
+            warn: d.warn
+        });
+        const failure = escalationFailure(outcome, config.flakes);
+        if (failure !== undefined) {
+            d.error(failure);
+            escalated = true;
+        }
     }
+    if (stepsFailed || escalated)
+        return 1;
     // What was tested must be exactly HEAD.
     const changed = checkoutChange(head, d.exec);
     if (changed) {
@@ -173,7 +210,7 @@ export async function runSignoff(loadConfig, opts, overrides = {}) {
             `commit the change and re-run signoff. Nothing was posted.`);
         return 1;
     }
-    // 6. Tail
+    // 7. Tail
     try {
         runTail({
             sha: head,