@mmerterden/multi-agent-pipeline 20.8.2 → 20.9.0

package/pipeline/scripts/review-decision-gate.mjs

@@ -13,8 +13,11 @@
  *   failing-test   its `verification` (Step 3.7, verify-by-test) is
  *                  `confirmed` and `evidencePath` is a non-empty log inside the
  *                  checkout that shows a failing test and no pass;
- *   test-integrity it is the finding test-integrity-gate.mjs produced for that
- *                  file, which is a command's output and not a model's.
+ *   test-integrity it is the finding test-integrity-gate.mjs produced: the
+ *                  same file and the same tag or fingerprint, a command's
+ *                  output and not a model's;
+ *   owned-path     it is the finding owned-path-gate.mjs produced, matched
+ *                  the same way, for the same reason.
  *
  * Anything else is lowered to `important`, stays in `accepted[]` (triage judged
  * it real and in scope, so the rework still fixes it) and is listed with its
@@ -40,14 +43,15 @@
  *
  * Usage:
  *   review-decision-gate.mjs <triage.json> [--state <agent-state.json>] [--iteration <n>]
- *                            [--source <reviewer-output.json>]... [--integrity <test-integrity.json>]
+ *                            [--source <reviewer-output.json>]... [--integrity <gate-findings.json>]...
  *                            [--repo <dir>] [--dry-run] [--json]
  *   review-decision-gate.mjs --rebuttal-allowed [--state <agent-state.json>] [--json]
  *
  * Exit (gates active): 0 decided · 1 a rebuttal round ran, or --rebuttal-allowed refused ·
  * 2 usage · 3 unreadable input, or an accepted blocker with no reviewer record (an empty
- * `reviewers: []` is no record). A missing or empty --integrity file is no findings,
- * and a missing or empty --source is an audit that did not run.
+ * `reviewers: []` is no record, and a declared --integrity file that does not exist). An
+ * empty --integrity file is no findings, and a missing or empty --source is an audit
+ * that did not run.
  * Attended: 0, and 2 on a usage error.
  *
  * @module pipeline/scripts/review-decision-gate
@@ -171,6 +175,9 @@ export function rebuttalRecorded(reviewers) {
   );
 }
 
+/** Tags of findings a deterministic gate produced, and the basis each one records. */
+const GATE_BASIS = { test_integrity: "test-integrity", owned_path: "owned-path" };
+
 /**
  * Apply the decision rule. Pure: the input is not mutated.
  *
@@ -181,7 +188,7 @@ export function decide({ triage, reviewers, integrity = [], root }) {
   const next = structuredClone(triage);
   const sources = (Array.isArray(reviewers) ? reviewers : []).map(blockingOf);
   const gateFindings = (Array.isArray(integrity) ? integrity : []).filter(
-    (f) => f && f.tag === "test_integrity",
+    (f) => f && GATE_BASIS[f.tag],
   );
   const kept = [];
   const downgraded = [];
@@ -198,8 +205,13 @@ export function decide({ triage, reviewers, integrity = [], root }) {
       kept.push({ ...id, basis: "corroborated", sources: count });
       continue;
     }
-    if (gateFindings.some((g) => normalizeFile(g.file) === normalizeFile(f.file))) {
-      kept.push({ ...id, basis: "test-integrity", sources: count });
+    const gate = gateFindings.find(
+      (g) =>
+        normalizeFile(g.file) === normalizeFile(f.file) &&
+        (f.tag === g.tag || fingerprintOf(f) === fingerprintOf(g)),
+    );
+    if (gate) {
+      kept.push({ ...id, basis: GATE_BASIS[gate.tag], sources: count });
       continue;
     }
     const v = f.verification;
@@ -236,38 +248,50 @@ function readJson(p, what) {
 }
 
 /**
- * Step 1.76's findings. No flag, no file or an empty file is the gate's own
- * "no findings" output; a file with content that is not JSON is unreadable.
+ * A deterministic gate's findings (Step 1.76 test-integrity, the owned-path
+ * gate). An empty file is the gate's own "no findings" output. Both gates
+ * always write their file, so a declared file that does not exist means the
+ * gate failed before writing, and that is an error rather than no findings;
+ * so is content that is not JSON.
  */
 function readIntegrity(p) {
-  if (!p || !existsSync(p)) return [];
+  if (!existsSync(p)) {
+    throw new Error(`gate findings ${p} do not exist: the gate did not run or failed`);
+  }
   let body;
   try {
     body = readFileSync(p, "utf8");
   } catch (err) {
-    throw new Error(`cannot read test-integrity output ${p}: ${err.message}`, { cause: err });
+    throw new Error(`cannot read gate findings ${p}: ${err.message}`, { cause: err });
   }
   if (!body.trim()) return [];
   try {
     const doc = JSON.parse(body);
     return Array.isArray(doc?.findings) ? doc.findings : [];
   } catch (err) {
-    throw new Error(`cannot read test-integrity output ${p}: ${err.message}`, { cause: err });
+    throw new Error(`cannot read gate findings ${p}: ${err.message}`, { cause: err });
   }
 }
 
 function parse(argv) {
-  const opts = { source: [], json: false, dryRun: false, rebuttalAllowed: false, triage: null };
-  const single = new Set(["--state", "--iteration", "--integrity", "--repo"]);
+  const opts = {
+    source: [],
+    integrity: [],
+    json: false,
+    dryRun: false,
+    rebuttalAllowed: false,
+    triage: null,
+  };
+  const single = new Set(["--state", "--iteration", "--repo"]);
   for (let i = 0; i < argv.length; i++) {
     const a = argv[i];
     if (a === "--json") opts.json = true;
     else if (a === "--dry-run") opts.dryRun = true;
     else if (a === "--rebuttal-allowed") opts.rebuttalAllowed = true;
-    else if (a === "--source" || single.has(a)) {
+    else if (a === "--source" || a === "--integrity" || single.has(a)) {
       const v = argv[++i];
       if (v === undefined) throw new Error(`${a} needs a value`);
-      if (a === "--source") opts.source.push(v);
+      if (a === "--source" || a === "--integrity") opts[a.slice(2)].push(v);
       else opts[a.slice(2)] = v;
     } else if (a.startsWith("--")) throw new Error(`unexpected argument ${a}`);
     else if (opts.triage) throw new Error(`one triage file only, got ${a} too`);
@@ -341,7 +365,7 @@ async function main(argv) {
       throw new Error(`${opts.triage} is not a triage output (no accepted[])`);
     }
     const reviewers = reviewerRecord(opts, state);
-    const integrity = readIntegrity(opts.integrity);
+    const integrity = opts.integrity.flatMap(readIntegrity);
     if (rebuttalRecorded(reviewers)) {
       result = {
         gate: GATE,