@popovych.co/witness 0.5.0 → 0.6.0

package/README.md

@@ -149,7 +149,8 @@ the wrong file refuses. There are no `WITNESS_*` env vars for configuration.
 | `sync` | pull --rebase + push state commits |
 | `calibrate <model>` | run the reviewer calibration battery |
 | `recover [--complete\|--rollback]` | resolve a crashed write transaction |
-| *(no verb)* | dashboard |
+| `status` | orientation: flows, blocked docs, reconcile rows, pending gates, calibration state |
+| *(no verb)* | the same screen as `status` |
 
 ## Exit codes
 

package/dist/calibrate.js

@@ -547,6 +547,13 @@ export async function runImplementSeed(ctx, harness, seed, agent) {
     if (!planDoc)
         return refuse([v('plan', 'seed-plan-missing', planId, 'the plan just written by the seed')]);
     const report = evidenceForDiff(wt.value.path, root, planDoc, base.value);
+    // Row 97 narrowed `required` to the parent tag, so an empty list no longer means "nothing
+    // was owed" — it means the agent never wrote a test tagged for the spec it was given, and
+    // `.every()` would pass that vacuously. The seed's whole question is whether the parent's
+    // red→green pair got witnessed.
+    if (report.required.length === 0) {
+        return ok({ ok: false, why: 'no test tagged for the parent spec — nothing was witnessed' });
+    }
     return ok({ ok: report.satisfied, why: report.satisfied ? 'evidence satisfied' : JSON.stringify(report.required) });
 }
 export async function runSkillSuites(ctx, harness, model, samples, opts = {}) {

package/dist/cli.js

@@ -21,6 +21,10 @@ const VERBS = {
     decide: () => import('./verbs/decide.js'),
     design: () => import('./verbs/design.js'),
     start: () => import('./verbs/start.js'),
+    // The orientation screen has a name (D101). Bare `witness` stays as its alias, but
+    // an unnamed command cannot be referenced — commands/witness.md instructs the
+    // operator to read "the dashboard" and nothing said which command prints it.
+    status: () => import('./verbs/dashboard.js'),
     clean: () => import('./verbs/clean.js'),
     ship: () => import('./verbs/ship.js'),
     next: () => import('./verbs/next.js'),
@@ -52,6 +56,7 @@ const VERB_USAGE = {
     satisfy: 'witness satisfy <doc-id> --need <text | index>',
     ship: 'witness ship <plan-id>',
     start: 'witness start <plan-id>',
+    status: 'witness status — flows · blocked docs · reconcile rows · pending gates (bare `witness` is the same screen)',
     sync: 'witness sync',
     'test-evidence': 'witness test-evidence <plan-id> --phase red|green',
     'verify-red': 'witness verify-red <plan-id> [--base <ref>]',

package/dist/evidence.js

@@ -32,7 +32,7 @@ export function checkoutRoot(cwd) {
         return refuse([v('cwd', 'not-a-repo', cwd, 'run inside a git checkout')]);
     return ok(res.out.trim());
 }
-export async function runSpecTests(runRoot, ctx, parentId, trustRoot) {
+export async function runSpecTests(runRoot, ctx, parentId, trustRoot, opts = {}) {
     const cfg = loadConfig(runRoot);
     if (!cfg.ok)
         return cfg;
@@ -63,10 +63,20 @@ export async function runSpecTests(runRoot, ctx, parentId, trustRoot) {
         }
         return ok({ runner: 'filtered', tests, allOk: tests.every((t) => t.ok) });
     }
-    const suite = await runFullSuite(runRoot, ctx, rc, trustRoot);
-    if (!suite.ok)
-        return suite;
-    const tests = suite.value.tests
+    // A caller checking several specs at once runs the suite ONCE and hands it here. Without
+    // this the regression lane executes the whole suite per spec, which is the redundancy
+    // `runCriteria` already pays per CRITERION.
+    let all;
+    if (opts.suite !== undefined) {
+        all = opts.suite;
+    }
+    else {
+        const suite = await runFullSuite(runRoot, ctx, rc, trustRoot);
+        if (!suite.ok)
+            return suite;
+        all = suite.value.tests;
+    }
+    const tests = all
         .filter((t) => matchesTag(t.name, parentId))
         .map((t) => ({ name: t.name, ok: t.status === 'passed' }));
     if (tests.length === 0) {
@@ -183,11 +193,77 @@ export function diffTags(runRoot, base) {
     }
     return [...tags].sort();
 }
+// Row 97. Editing someone else's tests creates a REGRESSION obligation — those tests still
+// pass — never a red→green one: `red` means "I observed this behaviour missing before I
+// built it", and producing a red on a spec you do not own means deliberately breaking it and
+// journaling that as evidence. Detection reads the CURRENT CONTENT of every changed test
+// file rather than added lines, because the case this exists for (a shared fixture grown
+// from 3 to 24 respondents breaking a `@spec:report-view` e2e) touches no tagged line at all.
+export function changedTestSpecs(runRoot, base, parentId) {
+    const tags = new Set();
+    for (const rel of changedFiles(runRoot, base).filter(isTestPath)) {
+        const abs = join(runRoot, rel);
+        if (!existsSync(abs))
+            continue; // deleted: no content left to owe anything
+        for (const tag of extractCanonicalTags(readFileSync(abs, 'utf8')))
+            tags.add(tag);
+    }
+    tags.delete(parentId); // the parent's obligation is red→green
+    return [...tags].sort();
+}
+// Never a `Result` refusal: this runs inside a gate's resolve(), and a refusal there aborts
+// the whole gate — a fresh unescapable dead end, the exact class row 97 removes. Every
+// runner problem (filter-matched-nothing included) degrades to a failed check carrying its
+// detail, the shape `runCriteria` has always had.
+//
+// Nothing here journals. `journalEvidence`/`recordEvidence` are what write `test-evidence`
+// entries and neither is on this path — an entry under a tag this plan does not own is
+// exactly the false claim row 97 refuses to let anyone make.
+export async function runRegression(runRoot, ctx, trustRoot, specIds, known) {
+    const out = [];
+    const memo = new Map();
+    const runnable = specIds.filter(known);
+    let suite;
+    const cfg = loadConfig(runRoot);
+    const rc = cfg.ok ? runnerConfig(cfg.value) : undefined;
+    if (rc?.ok && rc.value.mode === 'full-suite' && runnable.length > 0) {
+        const first = await runFullSuite(runRoot, ctx, rc.value, trustRoot);
+        if (first.ok)
+            suite = first.value.tests; // one suite run for every spec below
+    }
+    for (const id of specIds) {
+        if (!known(id)) {
+            out.push({ spec: id, state: 'unknown', detail: 'no such spec in canon — reported, not run' });
+            continue;
+        }
+        let run = memo.get(id);
+        if (run === undefined) {
+            run = await runSpecTests(runRoot, ctx, id, trustRoot, { suite });
+            memo.set(id, run);
+        }
+        if (!run.ok) {
+            out.push({ spec: id, state: 'unrunnable', detail: run.violations.map((x) => x.rule).join(' · ') });
+            continue;
+        }
+        const failed = run.value.tests.filter((t) => !t.ok).length;
+        out.push({
+            spec: id, state: run.value.allOk ? 'green' : 'red',
+            detail: `${run.value.tests.length} tagged · ${failed} failed`,
+        });
+    }
+    return out;
+}
 export function evidenceForDiff(runRoot, stateRoot, plan, base) {
     const planId = String(plan.meta.id);
+    const parentId = String(plan.meta.parent);
     const entries = readStream(stateRoot, planId).filter((e) => e.t === 'test-evidence');
     const matching = (e, tag) => (Array.isArray(e.tests) ? e.tests : []).filter((t) => matchesTag(t.name, tag));
-    const required = diffTags(runRoot, base).map((tag) => {
+    // Row 97: red→green is a claim about the NEW BEHAVIOUR THIS PLAN BUILDS, so the only tag
+    // it can be made for is the plan's own parent — `test-evidence` interpolates
+    // `plan.meta.parent` and nothing else, which is why a foreign tag here was unsatisfiable
+    // AND (before row 93) unwaivable. Every other spec the diff's tests touched is a
+    // regression obligation, checked by `runRegression` at the gate.
+    const required = diffTags(runRoot, base).filter((tag) => tag === parentId).map((tag) => {
         // latest-cycle semantics: the newest red matching the tag is the verdict on
         // "was failure observed"; a green only counts if it post-dates that red.
         // One early vacuous red must not poison the tag forever (append-only journal).

package/dist/gate.js

@@ -14,12 +14,13 @@ import { kv, rows } from './toon.js';
 import { loadMatrix, resolveModel, SESSION_DEFAULT } from './model.js';
 import { docKeysFor, docsBlock, invokeReviewer, loadLensDocs, parseVerdictText, pinsBlock, promptsSha, resolvePrompt } from './reviewer.js';
 import { anchorMenu, parseVerdict, verdictViolations } from './verdict.js';
-import { ROUND_BOUND, appendKind, boundReached, gateRuns, roundsSinceApprove, } from './rounds.js';
+import { ROUND_BOUND, appendKind, boundReached, gateRuns, lastGateRun, roundsSinceApprove, } from './rounds.js';
+import { gateSettled } from './verbs/next.js';
 import { prepareStamp, writeStamp } from './stamp.js';
 const GATES = new Map();
 export function registerGate(spec) { GATES.set(spec.gate, spec); }
 export function gateSpec(name) { return GATES.get(name); }
-export const DEFAULT_BATTERIES = {
+const DEFAULT_BATTERIES = {
     decompose: ['slicing-critic'],
     plan: ['plan-critic'],
     implement: {
@@ -43,11 +44,17 @@ export function batteryFor(cfg, gate, cls) {
 // where the state is. Skills used to recite a fixed triple, which is wrong at the bound
 // (D67's endgame set) — and now wrong in three more states.
 export function liveExits(gate, target, entries, stale) {
-    if (stale)
-        return `witness gate ${gate} ${target}`;
+    // The bound outranks staleness: at the bound the gate short-circuits and will not run
+    // again (:227), so "re-gate" is the D67 lie whatever the sha says. Stale content only
+    // removes APPROVE from the endgame — a human cannot honestly stamp bytes no battery
+    // read — which is the same set decide's stale-verdict refusal names.
     if (boundReached(entries, gate)) {
-        return `witness decide ${gate} ${target} --approve --override | --revise --upstream <id> | --stop`;
+        return stale
+            ? `witness decide ${gate} ${target} --revise --upstream <id> | --stop`
+            : `witness decide ${gate} ${target} --approve --override | --revise --upstream <id> | --stop`;
     }
+    if (stale)
+        return `witness gate ${gate} ${target}`;
     return `witness decide ${gate} ${target} --approve | --revise --note "<why>" | --revise --upstream <id> | --stop`;
 }
 export function renderGateRun(ctx, entry, mode) {
@@ -183,15 +190,35 @@ export async function runGate(ctx, gateName, target, flags) {
         renderRefusal(modelR.violations).forEach((l) => ctx.err(l));
         return EXIT.REFUSED;
     }
-    const { chain, calibrationOf, warning } = modelR.value;
-    if (warning)
+    const { chain, calibrationOf, warning, warningKind } = modelR.value;
+    // matrix-empty is a fact about this witness build, reported once by `status`/`check`
+    // (D98a). Only the caller's own pin being below the floor is news at run time.
+    if (warning && warningKind === 'below-floor')
         ctx.err(`warning: ${warning}`);
     const key = {
         reviewed_sha: input.reviewedSha, gate: spec.gate,
         prompts_sha: promptsSha(lenses, pinsText === '' ? undefined : pinsText), model: chain[0], witness: version(),
         harness: harness.name,
     };
+    // D99: `gateSettled` reads only the last run, so any new run un-settles the gate.
+    // Content moving is a legitimate, self-explaining reason. A flag is not — `--fresh`
+    // discarded a human decision with nothing printed and nothing journaled about it, and
+    // row 94 removed its other job (escaping the changed-nothing deadlock), so it can
+    // refuse and send the human through the verb that states a retraction and its reason.
+    const settledBefore = gateSettled(entries, spec.gate);
+    if (flags.fresh && settledBefore) {
+        renderRefusal([v('gate', 'settled-approve', `${spec.gate} ${target} is settled`, `witness decide ${spec.gate} ${target} --revise --note "<why>" — retract the approval, then re-gate`)])
+            .forEach((l) => ctx.err(l));
+        return EXIT.REFUSED;
+    }
     const kind = flags.fresh ? { kind: 'fresh' } : appendKind(entries, spec.gate, key);
+    // A key that moved for a NON-content reason — edited prompt, re-pinned model, new
+    // witness version — un-settles just as quietly as --fresh did. Content moving explains
+    // itself; this does not.
+    const lastRun = lastGateRun(entries, spec.gate);
+    if (settledBefore && kind.kind === 'fresh' && lastRun && lastRun.reviewed_sha === input.reviewedSha) {
+        ctx.err(`warning: reviewer setup changed — this run discards the settled approve on ${spec.gate} ${target}`);
+    }
     if (kind.kind === 'resume') {
         renderGateRun(ctx, kind.entry, 'resume');
         printDispatchArithmetic(ctx, root, spec.gate, target);

package/dist/gates/implement.js

@@ -8,9 +8,9 @@ import { designRel } from '../design.js';
 import { git } from '../gitio.js';
 import { latestRecap, readStream } from '../journal.js';
 import { findById } from '../scan.js';
-import { changedFiles, diffBase, evidenceForDiff, screensDir } from '../evidence.js';
+import { changedFiles, changedTestSpecs, diffBase, evidenceForDiff, runRegression, screensDir } from '../evidence.js';
 import { runCriteria } from '../criteria.js';
-import { effortOf, worktreeTreeSha } from '../reviewed.js';
+import { effortOf, implementReviewedSha } from '../reviewed.js';
 import { worktreePath } from '../worktree.js';
 import { registerGate } from '../gate.js';
 export function codePromptBody(wt, base, files, header) {
@@ -113,8 +113,26 @@ registerGate({
         const missing = report.required.filter((r) => !(r.red && r.green && !r.vacuous));
         checks.push({ name: 'evidence', ok: report.satisfied,
             detail: report.satisfied
-                ? `${report.required.length} tags with red→green pairs`
+                ? (report.required.length > 0
+                    ? `${String(plan.meta.parent)}: red→green`
+                    : `no ${String(plan.meta.parent)} tests in the diff — nothing to witness`)
                 : missing.map((m) => `${m.tag}: red=${m.red} green=${m.green}${m.vacuous ? ' vacuous' : ''}`).join(' · ') });
+        // Row 97: the obligation created by editing someone's tests is that those tests still
+        // pass — not that their whole spec is satisfied, which is the out-of-band drift sweep's
+        // job. `runCriteria` is deliberately NOT used here: it executes the foreign spec's `cmd`
+        // criteria, arbitrary trust-gated commands, inside an unattended gate.
+        const foreign = changedTestSpecs(wt, base, String(plan.meta.parent));
+        const regression = await runRegression(wt, ctx, root, foreign, (id) => findById(canon, id) !== undefined);
+        checks.push({
+            name: 'regression',
+            // `unknown` does not fail: witness cannot judge an obligation for a spec it does not
+            // have, and failing it re-creates the unsatisfiable check this row deletes. It is
+            // named in the detail, which is where a typo'd tag surfaces.
+            ok: regression.every((r) => r.state === 'green' || r.state === 'unknown'),
+            detail: regression.length === 0
+                ? 'no foreign spec tests touched'
+                : regression.map((r) => `${r.spec}:${r.state}`).join(' · '),
+        });
         const lane = await runCriteria(wt, ctx, parent, { trustRoot: root });
         checks.push({
             name: 'drift-lane',
@@ -127,7 +145,7 @@ registerGate({
         const recap = effort ? latestRecap(root, effort) : undefined;
         return ok({
             class: (recap?.class ?? 'feature'),
-            reviewedSha: worktreeTreeSha(wt),
+            reviewedSha: implementReviewedSha(wt, base, plan),
             artifactSha: canonicalSha(plan.meta, plan.body),
             reviewed: { kind: 'tree', root: wt, files },
             promptBody: codePromptBody(wt, base, files, `### Plan under implementation: ${planId}\n${serializeDoc({ meta: plan.meta, body: plan.body })}`),
@@ -137,8 +155,14 @@ registerGate({
             skipLenses,
         });
     },
-    currentSha(root, _canon, _cfg, planId) {
+    currentSha(root, canon, cfg, planId) {
         const wt = worktreePath(root, planId);
-        return existsSync(wt) ? worktreeTreeSha(wt) : undefined;
+        const plan = findById(canon, planId);
+        if (!existsSync(wt) || !plan)
+            return undefined;
+        const baseR = diffBase(wt, cfg);
+        // undefined is "cannot compute", never "moved": an unresolvable base must not
+        // un-settle a gate or invert `decide --show`'s staleness line.
+        return baseR.ok ? implementReviewedSha(wt, baseR.value, plan) : undefined;
     },
 });

package/dist/gates/ship.js

@@ -7,10 +7,11 @@ import { changedFiles, diffBase } from '../evidence.js';
 import { runCriteria } from '../criteria.js';
 import { execCommand } from '../runner.js';
 import { ensureTrusted } from '../allowlist.js';
-import { effortOf, worktreeTreeSha } from '../reviewed.js';
+import { diffReviewedSha, effortOf } from '../reviewed.js';
 import { worktreePath } from '../worktree.js';
 import { codePromptBody } from './implement.js';
 import { registerGate } from '../gate.js';
+import { gateSettled } from '../verbs/next.js';
 import { lastGateRun } from '../rounds.js';
 import { serializeDoc } from '../fm.js';
 async function commandLane(wt, root, ctx, name, cmd) {
@@ -46,16 +47,21 @@ registerGate({
         const checks = [];
         const entries = readStream(root, planId);
         const lastImplement = lastGateRun(entries, 'implement');
-        const implementSettled = (() => {
-            if (!lastImplement)
-                return false;
-            if (lastImplement.outcome === 'passed')
-                return true;
-            const after = entries.slice(entries.lastIndexOf(lastImplement) + 1);
-            return after.some((e) => e.t === 'human-decision' &&
-                e.gate === 'implement' &&
-                e.decision === 'approve');
-        })();
+        // One settle predicate, not two. This block used to inline its own copy of
+        // gateSettled, which meant `ship` and `next` could answer "is implement settled?"
+        // differently for the same journal — the split-brain that reads as a deadlock when
+        // two sessions compare notes.
+        //
+        // The missing sha argument is still DELIBERATE, but row 96 killed one of its two
+        // reasons and the surviving one is now the whole reason. It used to rest on
+        // `worktreeTreeSha` hashing the entire worktree, so ship's own `pr #N` stamp — pulled
+        // in by the watch-phase rebase — moved the tree and lapsed the very gate ship was
+        // checking: approve → pr → lapse → gate, the D75/D77 livelock. Under the diff identity
+        // that reason is DEAD: the worktree never edits `plans/<id>.md`, so the stamp is always
+        // equal to base and can never enter the reviewed set. What remains: `next` re-arms on
+        // movement because authoring is what it routes to, while ship asks only whether
+        // implement was EVER settled. Passing a sha here re-opens the livelock — do not add one.
+        const implementSettled = gateSettled(entries, 'implement');
         checks.push({ name: 'implement-gate', ok: implementSettled,
             detail: lastImplement
                 ? `last implement round ${lastImplement.round}: ${lastImplement.outcome}`
@@ -81,7 +87,7 @@ registerGate({
         const recap = effort ? latestRecap(root, effort) : undefined;
         return ok({
             class: (recap?.class ?? 'feature'),
-            reviewedSha: worktreeTreeSha(wt),
+            reviewedSha: diffReviewedSha(wt, base),
             artifactSha: canonicalSha(plan.meta, plan.body),
             reviewed: { kind: 'tree', root: wt, files },
             promptBody: codePromptBody(wt, base, files, `### Parent spec (from main): ${String(parent.meta.id)}\n${serializeDoc({ meta: parent.meta, body: parent.body })}\n\n### Plan: ${planId}\n${serializeDoc({ meta: plan.meta, body: plan.body })}`),
@@ -91,8 +97,12 @@ registerGate({
             repin,
         });
     },
-    currentSha(root, _canon, _cfg, planId) {
+    currentSha(root, _canon, cfg, planId) {
         const wt = worktreePath(root, planId);
-        return existsSync(wt) ? worktreeTreeSha(wt) : undefined;
+        if (!existsSync(wt))
+            return undefined;
+        const baseR = diffBase(wt, cfg);
+        // undefined is "cannot compute", never "moved" — same doctrine as the implement gate.
+        return baseR.ok ? diffReviewedSha(wt, baseR.value) : undefined;
     },
 });

package/dist/gitio.js

@@ -39,6 +39,39 @@ export function stateDirs(root) {
 export function isStatePath(root, rel) {
     return stateDirs(root).some((d) => rel === d || rel.startsWith(d + '/'));
 }
+// Row 96b. Witness's own state commits reach `origin/main` on every `sync`, and `shipPhase`
+// re-gates on ANY base advance — so the pipeline manufactured its own base movement (7 ship
+// runs for 3 rounds on the audited plan). An advance whose every commit touches only state
+// paths is bookkeeping, not base movement, and this is the ONE predicate both `baseMoved`
+// and `rebaseIfMoved` ask; two copies would let ship rebase in the phase that was just told
+// the base had not moved.
+//
+// Paths are primary and the trailer is secondary, and the conjunction is what keeps both
+// forgeries conservative: a forged trailer on a source commit still reads as real movement
+// (paths decide), and a hand-made commit that happens to touch only state paths reads as
+// real movement too (no trailer). A needless rebase costs a round; a skipped one merges a
+// tree no battery read.
+export function stateOnlyAdvance(wt, root, from, to) {
+    const range = tryGit(wt, 'log', '--format=%H', `${from}..${to}`);
+    if (!range.ok)
+        return false;
+    const shas = range.out.split('\n').filter(Boolean);
+    if (shas.length === 0)
+        return false;
+    return shas.every((sha) => {
+        const trailer = tryGit(wt, 'show', '--no-patch', '--format=%(trailers:key=Witness-State,valueonly=true)', sha);
+        if (!trailer.ok || trailer.out.trim() !== '1')
+            return false;
+        // Per COMMIT, never the range's union diff: a commit that adds and deletes a source
+        // file inside the range cancels out in a union and would read as state-only. An empty
+        // name list (a merge commit) is unjudgeable here and therefore not state-only.
+        const touched = tryGit(wt, 'show', '--pretty=format:', '--name-only', sha);
+        if (!touched.ok)
+            return false;
+        const paths = touched.out.split('\n').filter(Boolean);
+        return paths.length > 0 && paths.every((p) => isStatePath(root, p));
+    });
+}
 const LOCAL_STATE_FILES = new Set([
     '.witness/lock',
     '.witness/txn.json',
@@ -63,13 +96,35 @@ export function dirtyStatePaths(root) {
         .filter((p) => !LOCAL_STATE_FILES.has(p));
 }
 export const TRAILER = 'Witness-State: 1';
+// Row 87's rule: nothing to COMMIT is the same legal silent success as nothing to write.
+// It lives here, at the one choke point every state commit passes through, because git
+// rejects BOTH empty cases fatally and a caller cannot tell them apart in advance:
+//   • no paths at all → `commit --only ... --` dies "No paths with --include/--only"
+//     (a drift sweep with no live specs journals nothing and stamps nothing);
+//   • paths with no diff → `commit --only` exits non-zero (a restamp that restores a
+//     file to exactly its HEAD content, or a pathspec the repo gitignores).
+// Either way there is no state to record, so HEAD is already the answer. Implementing
+// this at init.ts's call site alone left every other caller throwing out of gitio and
+// surfacing through bin.ts as `unexpected-error` — "report a bug" on a healthy repo.
+function headSha(root) {
+    const head = tryGit(root, 'rev-parse', 'HEAD');
+    return head.ok ? head.out : ''; // unborn HEAD: no commit exists to name
+}
 export function commitWithTrailer(root, files, subject) {
+    if (files.length === 0)
+        return ok({ sha: headSha(root) });
     // tryGit, not git: a path already fully processed by a prior `git mv` (both sides
     // of a rename staged atomically) is absent from working tree AND index, so `add`
     // reports it unmatched — even though the rename itself is already staged. `commit
     // --only` resolves its pathspecs against the index-vs-HEAD diff, where the rename
     // is visible, so it still succeeds and is the real validation here.
     tryGit(root, 'add', '--', ...files);
+    // Ask git what actually changed rather than assuming every file we touched is dirty.
+    // Runs AFTER the add, so a freshly staged untracked path reads as `A ` and commits;
+    // a staged rename reads as `R ` on whichever side the pathspec names.
+    if (tryGit(root, 'status', '--porcelain', '--', ...files).out === '') {
+        return ok({ sha: headSha(root) });
+    }
     // --no-verify: state commits are machine-authored and scope-restricted to non-source
     // paths (isStatePath), so a host lint/test hook has nothing to validate here — while
     // its stash/restore step can destroy the human's unrelated dirty work, and a

package/dist/model.js

@@ -64,10 +64,28 @@ export function resolveModel(cfg, matrix, gate) {
     const head = chain[0];
     const headLabel = head === SESSION_DEFAULT ? '(session default)' : head;
     const matrixEmpty = matrix.shipped.length === 0 && matrix.local.length === 0;
-    const warning = calibrationOf(head) !== 'none'
+    const warningKind = calibrationOf(head) !== 'none'
         ? undefined
-        : matrixEmpty
+        : matrixEmpty ? 'matrix-empty' : 'below-floor';
+    const warning = warningKind === undefined
+        ? undefined
+        : warningKind === 'matrix-empty'
             ? `calibration matrix is empty — no calibrated model exists yet; ${headLabel} runs uncalibrated`
             : `reviewer model ${headLabel} is below the model floor — no calibration matrix entry covers it`;
-    return ok({ chain, calibrationOf, warning });
+    return ok({ chain, calibrationOf, warning, warningKind });
+}
+// One renderer for both orientation surfaces (`status` and `check`). Lives here because
+// the grouping rule — one line per distinct warning, labelled with the gates it covers —
+// is a property of the resolution, not of either screen. Returns `[]` when every gate's
+// model is calibrated.
+export function modelFloorLines(root, cfg, harness) {
+    const matrix = loadMatrix(root, harness);
+    const byWarning = new Map();
+    for (const gate of ['decompose', 'plan', 'implement', 'ship', 'design']) {
+        const r = resolveModel(cfg, matrix, gate);
+        if (r.ok && r.value.warning) {
+            byWarning.set(r.value.warning, [...(byWarning.get(r.value.warning) ?? []), gate]);
+        }
+    }
+    return [...byWarning].map(([warning, gates]) => `${gates.join(' · ')}: ${warning}`);
 }

package/dist/reviewed.js

@@ -1,21 +1,44 @@
-import { execFileSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
-import { mkdtempSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
+import { existsSync } from 'node:fs';
 import { join } from 'node:path';
-import { canonicalJson, canonicalSha } from './sha.js';
+import { canonicalJson, canonicalSha, planContentSha } from './sha.js';
+import { changedFiles } from './evidence.js';
+import { git } from './gitio.js';
 import { effortAbandoned, effortStreams, latestRecap, readStream } from './journal.js';
 import { findById } from './scan.js';
-export function worktreeTreeSha(root) {
-    const tmp = mkdtempSync(join(tmpdir(), 'witness-idx-'));
-    const env = { ...process.env, GIT_INDEX_FILE: join(tmp, 'index') };
-    try {
-        execFileSync('git', ['add', '-A'], { cwd: root, env });
-        return execFileSync('git', ['write-tree'], { cwd: root, env, encoding: 'utf8' }).trim();
-    }
-    finally {
-        rmSync(tmp, { recursive: true, force: true });
-    }
+// Row 96a. The reviewed identity is the DIFF the battery read: the base commit plus the
+// content of every path `changedFiles` reports — exactly what `codePromptBody` renders as
+// `### Changed files`, `### Diff vs base <sha>` and the untracked blocks. `worktreeTreeSha`
+// hashed the WHOLE worktree via `add -A`, so witness's own journal entries and stamps —
+// pulled in by ship's pre-battery rebase — moved the identity the verdict was keyed to, and
+// the entry DESCRIBING a verdict invalidated it one hop later.
+//
+// The base term is required, not optional. A rebase can change the diff TEXT while every
+// blob stays byte-identical; drop the base and a cached verdict replays against a diff no
+// reviewer ever read, and implement loses the rebase re-arming it has today.
+//
+// Deleted paths carry an explicit marker: `hash-object` throws on a missing file, and
+// dropping the path silently would make "this file is gone" invisible to the identity.
+const DELETED_BLOB = '(deleted)';
+export function diffReviewedSha(runRoot, base) {
+    const pairs = changedFiles(runRoot, base).map((rel) => existsSync(join(runRoot, rel))
+        ? `${rel}\0${git(runRoot, 'hash-object', '--', rel)}`
+        : `${rel}\0${DELETED_BLOB}`);
+    return sha256([base, '\n', pairs.sort().join('\n')]);
+}
+// Row 95: implement's identity is the diff AND the plan, because the battery reads both —
+// `codePromptBody` serializes the plan into the prompt — so a re-authored plan re-arms the
+// gate. It lives here rather than in `gates/implement.ts` because there are THREE readers,
+// not two: the gate's `resolve`, the gate's `currentSha`, and `flowAction`, which derives
+// the sha itself instead of calling `currentSha`. Two of the three agreeing is the same
+// split-brain rows 93 and 95 are about — the gate keyed on one sha while `next` checked
+// another, and every settled gate read as lapsed one turn later.
+export function implementReviewedSha(runRoot, base, plan) {
+    return createHash('sha256')
+        .update(diffReviewedSha(runRoot, base))
+        .update('\0')
+        .update(planContentSha(plan.meta, plan.body))
+        .digest('hex');
 }
 export function effortWrites(root, effort) {
     const out = new Map();

package/dist/sha.js

@@ -22,6 +22,16 @@ export function canonicalSha(meta, body) {
         .update(body.replace(/\s+$/, '') + '\n')
         .digest('hex');
 }
+// Row 95: a re-authored plan re-arms the implement gate, so the plan's content joins that
+// gate's reviewed identity — the battery reads the plan (`codePromptBody` serializes it into
+// the prompt), so the identity should say so. `derives-from` is excluded ON TOP of
+// VOLATILE_FIELDS because ship's own `repin` rewrites it inside the same transaction as the
+// gate run: keep it and the entry invalidates itself the moment it is written, which is
+// row 96's self-invalidation in a second place.
+export function planContentSha(meta, body) {
+    const { 'derives-from': _repinned, ...rest } = meta;
+    return canonicalSha(rest, body);
+}
 export function short(sha) {
     return sha.slice(0, 7);
 }