@ngockhoale/ukit 3.4.51 → 3.4.52

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 All notable changes to UKit are documented here.
 
+## 3.4.52 - 2026-10-22
+
+**Verification-loop ledger integrity (post-3.4.51 follow-up).**
+- Fix: the fd number of a redirection (`2>&1`, `2>/dev/null`, `12>&1`) leaked into the verification-loop fingerprint as an argument, so `... .test.js 2>&1 | tail` was reported as `... .test.js 2`. Genuine numeric arguments and quoted text are untouched.
+- A masked-pipe exit (`exitStatusUnproven`) now carries its own non-satisfying `unproven` verdict kind and is no longer counted as a definite failure toward the verification-loop streak.
+- A later valid PASS of the same command on the same task/ledger clears its own sticky `verification-loop` blocker; evidence never crosses tasks or ledgers. Wrapper exit 0 still never becomes PASS.
+- Regressions: `tests/hooks/executionLedger*.test.js`, `verificationExitProof`. Verified offline on macOS/Node 22; live host (Claude Code/OMP) in-memory state unverified, reload/`ukit update` + restart needed to load the fix.
+
 ## 3.4.51 - 2026-10-21
 
 **Handoff orchestration integrity (CKit/OMP 18.12.5 incident audit).**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ngockhoale/ukit",
-  "version": "3.4.51",
+  "version": "3.4.52",
   "description": "Install/update an index-first AI workspace for Claude Code, OpenAI Codex and omp (Oh My Pi).",
   "license": "MIT",
   "type": "module",

package/template_project/.claude/ukit/runtime/execution-ledger.mjs

@@ -801,10 +801,13 @@ function compactReceipt(receipt) {
 
 // --- Typed verdicts (SPEC-typed-verdicts §2) -----------------------------------
 // One optional verdict record rides the ledger entry — additive, no new store.
-// kind: 'live-verified' | 'test-verified' | 'check-only' | 'blocked' | 'failed'.
-// Currency is proven by headSha + baseSha + patch-id, not by commit messages or a
-// green check from an older SHA.
-const VERDICT_KINDS = new Set(['live-verified', 'test-verified', 'check-only', 'blocked', 'failed']);
+// kind: 'live-verified' | 'test-verified' | 'check-only' | 'blocked' | 'failed'
+//     | 'unproven'.
+// 'unproven' is a masked wrapper exit 0 (pipe/`sh -c` consumer): the runner may have
+// passed or failed — the receipt proves NEITHER, so it is never a satisfying kind
+// (fail-closed) and never a definite 'failed'. Currency is proven by headSha + baseSha
+// + patch-id, not by commit messages or a green check from an older SHA.
+const VERDICT_KINDS = new Set(['live-verified', 'test-verified', 'check-only', 'blocked', 'failed', 'unproven']);
 const VERDICT_SATISFYING_KINDS = new Set(['test-verified', 'live-verified']);
 const MAX_VERDICT_HISTORY = 8;
 
@@ -1133,7 +1136,10 @@ function mintVerificationVerdict(receipt, payload, projectRoot, sessionRoot = pr
   }
   let kind = supplied.kind;
   if (!VERDICT_KINDS.has(kind)) {
-    if (receipt.success !== true) kind = 'failed';
+    // A masked wrapper exit 0 proves the runner's status neither way: its own kind,
+    // never 'failed' (the runner may have passed) and never a satisfying kind.
+    if (receipt.exitStatusUnproven === true) kind = 'unproven';
+    else if (receipt.success !== true) kind = 'failed';
     else kind = isTestGateCommand(receipt.command) ? 'test-verified' : 'check-only';
   }
   return {
@@ -1220,6 +1226,18 @@ function terminalShellCommandUnit(command) {
     ) next += 1;
     return next;
   };
+  // A redirection's leading IO number (`2>&1`, `2> err.log`, `3< in`) belongs to the stream
+  // operator, not to the command: drop a trailing digit run ONLY when it is the whole
+  // current shell word (preceded by whitespace or the start of the buffer). The scanner
+  // only reaches redirections outside quotes, so a quoted literal (`-t "2" > out`) ends in
+  // a quote character and is never stripped; an ordinary numeric argument separated from
+  // the operator by whitespace (`--testTimeout 2 > out`, `-n 2 > out`) keeps its digits.
+  const stripIoNumber = () => {
+    let end = pipeBuffer.length;
+    while (end > 0 && /\d/.test(pipeBuffer[end - 1])) end -= 1;
+    if (end === pipeBuffer.length || (end > 0 && !/\s/.test(pipeBuffer[end - 1]))) return;
+    pipeBuffer = pipeBuffer.slice(0, end);
+  };
 
   for (let index = 0; index < text.length; index += 1) {
     const char = text[index];
@@ -1252,6 +1270,7 @@ function terminalShellCommandUnit(command) {
     }
     if (char === '$' && text[index + 1] === '(') return null;
     if (char === '>' || char === '<') {
+      stripIoNumber();
       let next = index + 1;
       if (text[next] === '>' && char === '>') next += 1;
       if (text[next] === '&') next += 1;
@@ -2479,7 +2498,13 @@ function applyReceiptCore(ledger, receipt, { vibecode = false } = {}) {
     }
     next.verificationAttempted = true;
     next.verificationSucceeded = next.verificationSucceeded || receipt.success;
-    next.verificationFailed = next.verificationFailed || !receipt.success;
+    // SPEC-typed-verdicts §2: an UNPROVEN run (masked wrapper exit 0) is neither a pass
+    // nor a definite failure — it must not grow failure counts, the loop streak or a
+    // blocker, and it never moves `verificationFailed`. Only a PROVEN non-zero exit is a
+    // definite failure; fail-closed acceptance is unchanged (only a current
+    // test-verified/live-verified verdict ever satisfies the gate).
+    const unproven = receipt.exitStatusUnproven === true;
+    next.verificationFailed = next.verificationFailed || (!receipt.success && !unproven);
     // TASK-026 fix round 1: bank the FIRST successful run of this command (same
     // terminal-shell identity the loop tracker uses), so rerunning a banked check is a
     // replay — never progress — regardless of receipt-window eviction.
@@ -2510,7 +2535,8 @@ function applyReceiptCore(ledger, receipt, { vibecode = false } = {}) {
 
     // Verification-loop tracking. `terminalShellCommandUnit` gives the loop identity:
     // the same failing check rerun — `setup && yarn test` and `yarn test 2>&1 | tail`
-    // both count as the same command, while a different check resets the streak.
+    // both count as the same command (redirection IO numbers are stripped), while a
+    // different check resets the streak.
     const fingerprint = terminalShellCommandUnit(receipt.command) || receipt.command;
     const counts = { ...(next.verificationFailureCounts || {}) };
     if (receipt.success) {
@@ -2519,7 +2545,18 @@ function applyReceiptCore(ledger, receipt, { vibecode = false } = {}) {
       if (next.failedVerificationStreak?.fingerprint === fingerprint) {
         next.failedVerificationStreak = null;
       }
-    } else {
+      // A valid, newer pass of the SAME check clears its OWN verification-loop blocker:
+      // same terminal-shell identity the tracker minted it with, applied to this task's
+      // ledger in receive order (a replayed older event is deduped by journalSeen, and a
+      // foreign task never reaches this ledger — recordLedgerEvent rejects
+      // receipt-task-mismatch and a new task re-keys to a fresh ledger). Unrelated
+      // command evidence never clears another check's blocker; an unproven or failed
+      // run (success:false) never clears anything, so the exhausted-retry blocker still
+      // ends the run instead of inviting an automatic recovery loop.
+      if (next.blocker?.kind === 'verification-loop' && next.blocker.command === fingerprint) {
+        next.blocker = null;
+      }
+    } else if (!unproven) {
       const streakFingerprint = next.failedVerificationStreak?.fingerprint;
       const streakCount = streakFingerprint === fingerprint
         ? Number(next.failedVerificationStreak.count || 0) + 1
@@ -3459,8 +3496,9 @@ function recoveryInstruction(missingEvidence, ledger = {}, routeSummary = {}, {
     }
     // A pipe-masked run is UNPROVEN, not failed: name the real gap (no provable exit status)
     // instead of telling the model to "fix the failure" of a run that may have passed.
+    // Unproven never sets `verificationFailed`, so this must not key off that flag.
     const lastVerification = [...(ledger.receipts || [])].reverse().find((r) => r?.kind === 'verification');
-    if (!instruction && ledger.verificationFailed && lastVerification?.exitStatusUnproven === true) {
+    if (!instruction && lastVerification?.exitStatusUnproven === true) {
       instruction = `The last verification (\`${String(lastVerification.command || '').slice(0, 80)}\`) ran in a pipeline, so its exit status is unproven. Re-run it without the pipe, or with \`set -o pipefail\`, and inspect the exit code.`;
     }
     if (!instruction && ledger.verificationFailed) {