@oneie/claude 0.8.0 → 0.9.0

package/scripts/gc-content-check.sh

@@ -0,0 +1,140 @@
+#!/bin/bash
+# gc-content-check.sh — the red proof for lib/gc-finished.sh.
+#
+# manifest: portable
+#
+# Builds a sandbox repo carrying the branch shapes the sweep meets, drives the
+# REAL predicate (sourced, never re-implemented), and then proves the OLD
+# commit-count predicate gets the important one wrong. A checker that only shows
+# the new code passing would not tell you the change was worth making.
+#
+# NOT reproduced here: `git cherry`'s blind spot on a merge commit. That was
+# measured on this repo (merge/trunk-reconcile, 2026-09-07: cherry reported
+# 0-new for a branch holding 24 files and 3416 lines dev had never seen) and the
+# reasoning lives in lib/gc-finished.sh. Faking a multi-merge-base history to
+# re-stage it would be asserting a claim this sandbox does not actually show —
+# the fourth case below covers the same risk directly: a merge carrying unique
+# content must read NOT finished.
+#
+#   bash .claude/scripts/gc-content-check.sh    # exits non-zero on failure
+set -uo pipefail
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+. "$HERE/lib/gc-finished.sh"
+
+SANDBOX="$(mktemp -d)"; trap 'rm -rf "$SANDBOX"' EXIT
+fails=0
+EXPECT_RED=0   # set while driving the neutered predicate, so an INTENDED failure
+               # does not print the word FAIL and read as a broken checker.
+ok()  { printf '  ok    %s\n' "$1"; }
+bad() {
+  if [ "$EXPECT_RED" = 1 ]; then printf '  red   %s — as intended\n' "$1"
+  else printf '  FAIL  %s\n' "$1"; fi
+  fails=$((fails+1))
+}
+want() { # <expected 0|1> <branch> <what>
+  gc_finished trunk "$2"; local got=$?
+  [ "$got" -eq "$1" ] && ok "$3" || bad "$3 (wanted finished=$1, got $got)"
+}
+
+cd "$SANDBOX"
+git init -q -b trunk .
+git config user.email t@e.st; git config user.name t
+git config commit.gpgsign false
+echo base > a.txt; git add a.txt; git commit -qm base
+echo one  > c.txt; git add c.txt; git commit -qm second
+B1="$(git rev-parse HEAD)"
+
+# 1 — REBASED DUPLICATE: the branch's patch reaches trunk under a DIFFERENT sha.
+#     This is the case the commit count gets wrong, and the reason for this file.
+git checkout -q -b dup "$B1"
+echo fixed > a.txt; git commit -qam "fix a"
+git checkout -q trunk
+git cherry-pick dup >/dev/null 2>&1 || { bad "sandbox: cherry-pick failed"; exit 1; }
+# Re-message it. A cherry-pick onto the same parent, in the same second, with the
+# same author and message, produces a byte-identical commit OBJECT — trunk then
+# fast-forwards onto the branch and there is no divergence left to detect. That
+# is a sandbox artifact, not the real world, where a re-landed patch always
+# arrives with a different sha. The amend forces the sha apart while leaving the
+# patch identical, which is precisely the case under test.
+git commit -q --amend -m "fix a (relanded under a different sha)"
+
+# 2 — ORDINARY UNLANDED BRANCH.
+git checkout -q -b ahead trunk
+echo new > b.txt; git add b.txt; git commit -qm "adds b"
+
+# 3 — FULLY CONTAINED: tip is an ancestor of trunk.
+git checkout -q -b behind "$B1"
+
+# 4 — MERGE COMMIT CARRYING UNIQUE CONTENT. The shape that makes a
+#     patch-counting test (git cherry) unsafe on its own.
+git checkout -q -b side "$B1"
+echo unique > only-here.txt; git add only-here.txt; git commit -qm "unique file"
+git checkout -q -b mergey trunk
+git merge --no-edit side >/dev/null 2>&1 || { bad "sandbox: merge failed"; exit 1; }
+
+echo "== the predicate the sweep runs"
+want 0 dup    "a rebased duplicate reads FINISHED — its content is already on the platform"
+want 1 ahead  "an ordinary unlanded branch reads NOT finished"
+want 0 behind "a branch fully contained in the base reads FINISHED"
+want 1 mergey "a merge carrying a file the base lacks reads NOT finished"
+
+echo "== what the OLD commit-count predicate would have said"
+old_finished() { [ "$(git rev-list --count "trunk..$1" 2>/dev/null || echo 1)" -eq 0 ]; }
+if old_finished dup
+then bad "the count predicate should MISS the duplicate — this proof is broken"
+else ok  "the count predicate hoards the duplicate for ever — the ~120MB this fixes"; fi
+if old_finished ahead
+then bad "the count predicate wrongly sweeps an unlanded branch"
+else ok  "the count predicate keeps an unlanded branch (both agree here)"; fi
+
+echo "== the clean-worktree path survives set -e"
+# The sweep runs under `set -euo pipefail`, and `grep -v` exits 1 when it filters
+# EVERYTHING out — the clean-worktree case. Inline, that killed the sweep at the
+# first worktree it was meant to remove: four keep lines, exit 1, no summary, and
+# invisible behind a `| cat`. Drive the real function in a real subshell under
+# the real flags, because that is the only way this comes back red.
+git checkout -q trunk
+if out="$(bash -c '
+      set -euo pipefail
+      . "'"$HERE"'/lib/gc-finished.sh"
+      d="$(gc_real_dirt "'"$SANDBOX"'")"
+      [ -z "$d" ] && echo CLEAN-AND-ALIVE
+    ' 2>&1)" && [ "$out" = "CLEAN-AND-ALIVE" ]; then
+  ok "a clean worktree reports no dirt AND the shell survives it"
+else
+  bad "the clean-tree path died under set -e (got: ${out:-<nothing>})"
+fi
+# And it still SEES real work, or the fix would be a mute button.
+echo scratch > "$SANDBOX/uncommitted.txt"
+if [ -n "$(gc_real_dirt "$SANDBOX")" ]
+then ok "uncommitted work is still reported — the guard did not silence it"
+else bad "gc_real_dirt missed an uncommitted file"; fi
+rm -f "$SANDBOX/uncommitted.txt"
+# Ephemera alone must NOT read as work, or nothing is ever swept.
+# The tracked file is required, not decoration: git COLLAPSES a wholly-untracked
+# directory to its top level, so an unrepresentative sandbox reports `?? one.ie/`
+# and no path pattern can match. A real worktree has one.ie/web/ tracked, so git
+# descends and reports `?? one.ie/web/.astro` — which is what the filter is
+# written against. Committing one file reproduces that.
+mkdir -p "$SANDBOX/one.ie/web"; echo keep > "$SANDBOX/one.ie/web/keep.txt"
+git add one.ie/web/keep.txt; git commit -qm "tracked file under one.ie/web"
+mkdir -p "$SANDBOX/one.ie/web/.astro"; echo x > "$SANDBOX/one.ie/web/.astro/gen.d.ts"
+if [ -z "$(gc_real_dirt "$SANDBOX")" ]
+then ok "build output alone does not count as work"
+else bad "ephemeral dirt was reported as work — nothing would ever be swept"; fi
+rm -rf "$SANDBOX/one.ie/web/.astro"
+
+echo "== red proof: neuter the predicate and the checks must fail"
+gc_finished() { return 0; }   # claim every branch is finished
+before=$fails; EXPECT_RED=1
+want 1 ahead  "(neutered) an unlanded branch must NOT read finished"
+want 1 mergey "(neutered) a unique-content merge must NOT read finished"
+if [ "$fails" -eq $((before+2)) ]; then
+  fails=$before; EXPECT_RED=0; ok "both checks bite when the predicate is gutted"
+else
+  fails=$((before+1)); EXPECT_RED=0; printf '  FAIL  a gutted predicate still passed — this checker proves nothing\n'
+fi
+
+echo
+[ "$fails" -eq 0 ] && { echo "gc-content-check: PASS"; exit 0; }
+echo "gc-content-check: FAIL ($fails)"; exit 1

package/scripts/governor-doors-check.sh

@@ -22,9 +22,17 @@
 # hop is followed: its own file, not its package.json, holds the two runners.
 #
 # WHAT IS DELIBERATELY NOT A DOOR is in SKIP below, each with its reason. That
-# list is the argument, not an allowlist of convenience: a governed slot on a
-# 2-second typecheck is cost with no benefit, and `tsc` already has its own
-# lock via tsc-cached.sh -- nesting it would put two locks on one logical gate.
+# list is the argument, not an allowlist of convenience.
+#
+# A LOCK IS NOT A SLOT. Until 2026-09-07 the typecheck skip below read "tsc
+# already has its own lock via tsc-cached.sh", and that reasoning is wrong in a
+# way that cost the machine: gate_lock is keyed by FOLDER and dedupes identical
+# work, while a SLOT caps concurrent heavy work machine-wide. N worktrees are N
+# folders, so N locks are all uncontended while N typecheckers run. Measured that
+# day: three 2.5GB tsc processes at once, load 171, localhost at 8.4s a page, and
+# THIS CHECKER REPORTING "0 open". The "2-second typecheck" half was wrong too --
+# the measured runs were 2.5GB and 7+ minutes. The compute sites now take a slot
+# (see the `compute sites` section below, which is what would have caught it).
 # SHIPS (needs-env). In a generated factory clone this enumerates THAT repo
 # package.json files, while every line in the skip list names a monorepo path
 # that can never match there -- so it may report open doors it has no opinion
@@ -44,7 +52,7 @@ HEAVY_RE='vitest|tsc[[:space:]]+--noEmit|astro[[:space:]]+check|playwright[[:spa
 # <pkg-relpath>::<script>   why
 skips() {
   cat <<'SKIP'
-*::typecheck                a bare tsc, seconds not minutes, and verify-fast routes tsc through tsc-cached.sh which takes its OWN gate lock -- wrapping would be a second lock on one logical gate
+*::typecheck                routes through tsc-cached.sh, which since 2026-09-07 takes a real SLOT around its compute (gate-run.sh), not merely its dedupe lock -- enforced by the `compute sites` section, not asserted here
 *::test:watch               a watch never exits; a wall-clock bound would kill it
 *::test:raw                 an escape hatch by definition -- ungoverned is the whole point
 *::verify:raw               an escape hatch by definition
@@ -236,9 +244,82 @@ reentrancy() {
   else
     nope "unexpected red-half output. out=[$(cat "$o")] err=[$(cat "$e")]"
   fi
+  # RED PROOF for `compute sites`: a script that spawns a heavy compute with no
+  # gate-run.sh must turn compute_sites red. This is the exact shape tsc-cached.sh
+  # had before 2026-09-07 -- a gate_lock, and a bare bunx tsc inside it.
+  local probe_dir probe
+  probe_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  # NOT a dotfile: `for f in "$d"/*.sh` does not glob dotfiles, so a probe named
+  # .zz-*.sh is invisible to the very check it is supposed to drive red -- the
+  # proof would pass by never being seen. Named plainly, and rm'd below.
+  probe="$probe_dir/zz-compute-probe.sh"
+  cat > "$probe" <<'PROBE'
+#!/usr/bin/env bash
+# a lock, and a heavy compute with no slot -- the 2026-09-07 defect, in miniature
+gate_lock "probe" 10 && bunx tsc --noEmit
+PROBE
+  local b0=$bad
+  compute_sites >/dev/null 2>&1
+  if [ "$bad" -gt "$b0" ]; then
+    ok "a lock-without-slot compute site turns the audit RED"
+    bad=$b0
+  else
+    nope "compute_sites stayed green against a bare 'bunx tsc --noEmit' with no gate-run"
+  fi
+  rm -f "$probe"
+
   rm -rf "$sandbox"
 }
 
+# ── compute sites — a gate_lock is not a slot ───────────────────────────────
+#
+# The `doors` section above audits PACKAGE SCRIPTS. It cannot see the defect
+# that actually cost the machine on 2026-09-07, because that one lived one layer
+# down: tsc-cached.sh held a per-folder gate_lock and spawned `bunx tsc` with no
+# slot at all. Every door was green, the skip list had a stated reason, and three
+# 2.5GB typecheckers ran concurrently while the governor reported 1 of 2 slots.
+#
+# The rule this enforces: ANY script here that spawns a heavy compute must also
+# reference gate-run.sh. Not "takes a lock" -- a lock dedupes identical work, a
+# slot bounds the machine, and only one of those is a concurrency cap.
+compute_sites() {
+  echo "== compute sites — a heavy compute behind a lock still needs a SLOT"
+  local d f n_ok=0 hits
+  d="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  for f in "$d"/*.sh; do
+    case "$(basename "$f")" in
+      gate-run.sh|governor-doors-check.sh|governor-escape-check.sh|machine-check.sh) continue ;;
+      # FIXTURES — these NAME a heavy command as test data and spawn nothing:
+      #   load-guard-check.sh   passes command STRINGS to the hook  ( check 1 "bunx ..." )
+      #   govern-mem-check.sh   embeds them in JSON tool_input payloads
+      #   deploy-gate-check.sh  greps deploy.sh for the command as a PATTERN
+      # Each was verified by reading the matching lines, not assumed.
+      load-guard-check.sh|govern-mem-check.sh|deploy-gate-check.sh) continue ;;
+    esac
+    # PRESENCE, not command-position. The first version of this asked "is the
+    # compute in command position", blanking quoted regions -- and it could not
+    # see the very defect it was written for: tsc-cached.sh spawned its tsc from
+    # inside a quoted `bash -c "... ${TSC_CACHE_CMD:-bunx tsc --noEmit} ..."`.
+    # Reverting tsc-cached.sh to its pre-fix state left that check GREEN, which
+    # is the only test of a checker that matters.
+    #
+    # So the rule is blunt on purpose: if a heavy token appears outside a comment,
+    # this file must reference gate-run.sh somewhere. Scripts that only NAME a
+    # command as a test fixture are handled by FIXTURES below, by name and with a
+    # reason -- the same "the skip list is the argument" doctrine as the doors.
+    hits=$(grep -nE '(bunx|npx|bun x) +(tsc +--noEmit|vitest +run)' "$f" 2>/dev/null \
+           | grep -vE '^[0-9]+:[[:space:]]*#' || true)
+    [ -n "$hits" ] || continue
+    if grep -q 'gate-run\.sh' "$f"; then
+      n_ok=$((n_ok+1))
+    else
+      nope "$(basename "$f") spawns a heavy compute with no gate-run.sh anywhere:
+$(printf '%s' "$hits" | head -3 | sed 's/^/          /')"
+    fi
+  done
+  [ "$bad" -eq 0 ] && ok "$n_ok script(s) spawn a heavy compute, every one routes through gate-run.sh"
+}
+
 # ── red proof ───────────────────────────────────────────────────────────────
 self_test() {
   echo "== self-test — plant an open door, the REAL audit must go RED"
@@ -273,7 +354,7 @@ case "${1:-}" in
   --list)      enumerate | sort | column -t -s$'\t' 2>/dev/null || enumerate | sort; exit 0 ;;
   --self-test) self_test ;;
   *)           if [ -n "${GOV_DOORS_INNER:-}" ]; then audit
-               else audit; echo; paths; echo; reentrancy; echo; self_test; fi ;;
+               else audit; echo; paths; echo; compute_sites; echo; reentrancy; echo; self_test; fi ;;
 esac
 
 echo