@popovych.co/witness 0.5.1 → 0.8.0

package/README.md

@@ -81,12 +81,42 @@ npx @popovych.co/witness init --agent pi
 `<cwd>/.pi/skills` with no upward walk, and the implement stage runs with its cwd inside
 `.witness/worktrees/<plan-id>` — a directory the installer never touched. A
 project-scope install therefore loses every skill in the stage that does the most work.
-Global (`~/.pi/agent/skills`) is cwd-independent. `witness check` warns when the
-resolved harness cannot see all six skills.
+Global (`~/.pi/agent/skills`) is cwd-independent. `witness check` warns when six skills
+are installed where a worktree cannot see them, and states which harnesses have none.
 
 A tarball URL is version-pinned, so `skills update` cannot resolve forward: re-run `add`
 with the new version URL to upgrade.
 
+### Upgrading: skills first, then `init --agent`
+
+Every surface that invokes witness pins the CLI — the engine prompt and all six skills
+carry `npx -y @popovych.co/witness@<version>` — so a repo installed at an older release
+only ever runs that release, which compares its payload against itself and reports clean.
+The freeze is self-concealing, and a repo frozen at **0.6.0 or earlier cannot detect it**,
+because the detection ships in a CLI that repo never invokes. Unstick it from outside, in
+this order:
+
+```bash
+npx skills@latest add https://registry.npmjs.org/@popovych.co/witness/-/witness-<new-version>.tgz
+npx -y @popovych.co/witness@latest init --agent <name>   # restamps the engine, guard and dashboard
+```
+
+Skills first: their fresh pins are what invoke a CLI new enough to see the outdated
+payload. Claude Code users on the marketplace plugin get both halves from
+`/plugin marketplace add` and need no second step.
+
+From **0.7.0** onward the order stops mattering: `witness check` asks the registry what
+the published `latest` is and reports both halves of the skew — a CLI behind `latest`
+(`cli-behind`) and any visible skill pinning something older (`skills-behind`). The query
+is best-effort and silent on failure, so an offline machine reports nothing rather than a
+complaint about the network.
+
+`witness init --agent <name>` overwrites payload files it did not write and names what it
+replaced (`payload-overwritten`); the previous content is one `git revert` away, because
+witness commits the payload. It refuses the whole run if a payload path carries an
+uncommitted change (`payload-dirty`) or if the CLI you are running is older than the
+payload already installed (`cli-behind-payload`).
+
 ### Support tiers
 
 | Tier | Agents | What they get |
@@ -101,11 +131,11 @@ either.
 
 | Key | Meaning |
 |---|---|
-| `harness: claude-code \| pi` | fallback used only when detection cannot answer. Order: `PI_CODING_AGENT` → `CLAUDECODE` → `harness:` → `claude-code` |
+| `harness: claude-code \| pi` | **the judge** — which harness runs this repo's gate reviewers, is measured by `calibrate`, and is probed by `check`. Judgment resolves `harness:` → `PI_CODING_AGENT` → `CLAUDECODE` → `claude-code`; session lines (`next`'s handoff, `dispatch`'s relay, `init --agent auto`) resolve detection first, because those name the CLI you are about to type at. Committed, so it binds every teammate's gates; `witness init --agent` writes it once and never re-points it. Undeclared repos are judged by whichever agent's session is open — `witness check` and `witness status` say so |
 | `gates.reviewerTimeoutMs` | milliseconds per reviewer invocation (default 600000) |
 
-There is no `provider:` key. `witness gate` spawns the RESOLVED harness's headless
-mode for every reviewer (Decision 88): claude-code renders bare Anthropic ids, pi
+There is no `provider:` key. `witness gate` spawns the DECLARED harness's headless
+mode for every reviewer (Decisions 88, 105): claude-code renders bare Anthropic ids, pi
 renders `provider/model[:thinking]` with the provider witness knows it needs. The pi
 reviewer runs hermetic (`--no-extensions --no-skills --no-context-files`); machine
 extensions it must keep — e.g. an OAuth adapter that supplies your Anthropic auth —
@@ -149,7 +179,8 @@ the wrong file refuses. There are no `WITNESS_*` env vars for configuration.
 | `sync` | pull --rebase + push state commits |
 | `calibrate <model>` | run the reviewer calibration battery |
 | `recover [--complete\|--rollback]` | resolve a crashed write transaction |
-| *(no verb)* | dashboard |
+| `status` | orientation: flows, blocked docs, reconcile rows, pending gates, calibration state |
+| *(no verb)* | the same screen as `status` |
 
 ## Exit codes
 

package/dist/calibrate.js

@@ -547,6 +547,13 @@ export async function runImplementSeed(ctx, harness, seed, agent) {
     if (!planDoc)
         return refuse([v('plan', 'seed-plan-missing', planId, 'the plan just written by the seed')]);
     const report = evidenceForDiff(wt.value.path, root, planDoc, base.value);
+    // Row 97 narrowed `required` to the parent tag, so an empty list no longer means "nothing
+    // was owed" — it means the agent never wrote a test tagged for the spec it was given, and
+    // `.every()` would pass that vacuously. The seed's whole question is whether the parent's
+    // red→green pair got witnessed.
+    if (report.required.length === 0) {
+        return ok({ ok: false, why: 'no test tagged for the parent spec — nothing was witnessed' });
+    }
     return ok({ ok: report.satisfied, why: report.satisfied ? 'evidence satisfied' : JSON.stringify(report.required) });
 }
 export async function runSkillSuites(ctx, harness, model, samples, opts = {}) {

package/dist/cli.js

@@ -21,6 +21,10 @@ const VERBS = {
     decide: () => import('./verbs/decide.js'),
     design: () => import('./verbs/design.js'),
     start: () => import('./verbs/start.js'),
+    // The orientation screen has a name (D101). Bare `witness` stays as its alias, but
+    // an unnamed command cannot be referenced — commands/witness.md instructs the
+    // operator to read "the dashboard" and nothing said which command prints it.
+    status: () => import('./verbs/dashboard.js'),
     clean: () => import('./verbs/clean.js'),
     ship: () => import('./verbs/ship.js'),
     next: () => import('./verbs/next.js'),
@@ -52,6 +56,7 @@ const VERB_USAGE = {
     satisfy: 'witness satisfy <doc-id> --need <text | index>',
     ship: 'witness ship <plan-id>',
     start: 'witness start <plan-id>',
+    status: 'witness status — flows · blocked docs · reconcile rows · pending gates (bare `witness` is the same screen)',
     sync: 'witness sync',
     'test-evidence': 'witness test-evidence <plan-id> --phase red|green',
     'verify-red': 'witness verify-red <plan-id> [--base <ref>]',

package/dist/drift.js

@@ -8,7 +8,7 @@ import { acquireLock } from './lock.js';
 import { appendEntry, entryLine, journalRel, readStream } from './journal.js';
 import { primaryRoot, stateCommit } from './gitio.js';
 import { renderRefusal, v, ok } from './refusal.js';
-import { resolveHarness } from './harness.js';
+import { resolveJudge } from './harness.js';
 import { invokeReviewer, parseVerdictText, resolvePrompt } from './reviewer.js';
 import { runFullSuite, runnerConfig } from './runner.js';
 import { findById, loadCanon } from './scan.js';
@@ -120,7 +120,7 @@ export async function deepDrift(root, ctx, canon, specId) {
     // like every other. A silent claude fallback here would swap the reviewer identity
     // for pure-pi users on the one check that judges live specs.
     const cfgR = loadConfig(root);
-    const hxR = resolveHarness(ctx.env, cfgR.ok ? cfgR.value.raw : {});
+    const hxR = resolveJudge(ctx.env, cfgR.ok ? cfgR.value.raw : {});
     if (!hxR.ok) {
         renderRefusal(hxR.violations).forEach(ctx.err);
         return EXIT.REFUSED;

package/dist/evidence.js

@@ -32,7 +32,7 @@ export function checkoutRoot(cwd) {
         return refuse([v('cwd', 'not-a-repo', cwd, 'run inside a git checkout')]);
     return ok(res.out.trim());
 }
-export async function runSpecTests(runRoot, ctx, parentId, trustRoot) {
+export async function runSpecTests(runRoot, ctx, parentId, trustRoot, opts = {}) {
     const cfg = loadConfig(runRoot);
     if (!cfg.ok)
         return cfg;
@@ -63,10 +63,20 @@ export async function runSpecTests(runRoot, ctx, parentId, trustRoot) {
         }
         return ok({ runner: 'filtered', tests, allOk: tests.every((t) => t.ok) });
     }
-    const suite = await runFullSuite(runRoot, ctx, rc, trustRoot);
-    if (!suite.ok)
-        return suite;
-    const tests = suite.value.tests
+    // A caller checking several specs at once runs the suite ONCE and hands it here. Without
+    // this the regression lane executes the whole suite per spec, which is the redundancy
+    // `runCriteria` already pays per CRITERION.
+    let all;
+    if (opts.suite !== undefined) {
+        all = opts.suite;
+    }
+    else {
+        const suite = await runFullSuite(runRoot, ctx, rc, trustRoot);
+        if (!suite.ok)
+            return suite;
+        all = suite.value.tests;
+    }
+    const tests = all
         .filter((t) => matchesTag(t.name, parentId))
         .map((t) => ({ name: t.name, ok: t.status === 'passed' }));
     if (tests.length === 0) {
@@ -183,11 +193,77 @@ export function diffTags(runRoot, base) {
     }
     return [...tags].sort();
 }
+// Row 97. Editing someone else's tests creates a REGRESSION obligation — those tests still
+// pass — never a red→green one: `red` means "I observed this behaviour missing before I
+// built it", and producing a red on a spec you do not own means deliberately breaking it and
+// journaling that as evidence. Detection reads the CURRENT CONTENT of every changed test
+// file rather than added lines, because the case this exists for (a shared fixture grown
+// from 3 to 24 respondents breaking a `@spec:report-view` e2e) touches no tagged line at all.
+export function changedTestSpecs(runRoot, base, parentId) {
+    const tags = new Set();
+    for (const rel of changedFiles(runRoot, base).filter(isTestPath)) {
+        const abs = join(runRoot, rel);
+        if (!existsSync(abs))
+            continue; // deleted: no content left to owe anything
+        for (const tag of extractCanonicalTags(readFileSync(abs, 'utf8')))
+            tags.add(tag);
+    }
+    tags.delete(parentId); // the parent's obligation is red→green
+    return [...tags].sort();
+}
+// Never a `Result` refusal: this runs inside a gate's resolve(), and a refusal there aborts
+// the whole gate — a fresh unescapable dead end, the exact class row 97 removes. Every
+// runner problem (filter-matched-nothing included) degrades to a failed check carrying its
+// detail, the shape `runCriteria` has always had.
+//
+// Nothing here journals. `journalEvidence`/`recordEvidence` are what write `test-evidence`
+// entries and neither is on this path — an entry under a tag this plan does not own is
+// exactly the false claim row 97 refuses to let anyone make.
+export async function runRegression(runRoot, ctx, trustRoot, specIds, known) {
+    const out = [];
+    const memo = new Map();
+    const runnable = specIds.filter(known);
+    let suite;
+    const cfg = loadConfig(runRoot);
+    const rc = cfg.ok ? runnerConfig(cfg.value) : undefined;
+    if (rc?.ok && rc.value.mode === 'full-suite' && runnable.length > 0) {
+        const first = await runFullSuite(runRoot, ctx, rc.value, trustRoot);
+        if (first.ok)
+            suite = first.value.tests; // one suite run for every spec below
+    }
+    for (const id of specIds) {
+        if (!known(id)) {
+            out.push({ spec: id, state: 'unknown', detail: 'no such spec in canon — reported, not run' });
+            continue;
+        }
+        let run = memo.get(id);
+        if (run === undefined) {
+            run = await runSpecTests(runRoot, ctx, id, trustRoot, { suite });
+            memo.set(id, run);
+        }
+        if (!run.ok) {
+            out.push({ spec: id, state: 'unrunnable', detail: run.violations.map((x) => x.rule).join(' · ') });
+            continue;
+        }
+        const failed = run.value.tests.filter((t) => !t.ok).length;
+        out.push({
+            spec: id, state: run.value.allOk ? 'green' : 'red',
+            detail: `${run.value.tests.length} tagged · ${failed} failed`,
+        });
+    }
+    return out;
+}
 export function evidenceForDiff(runRoot, stateRoot, plan, base) {
     const planId = String(plan.meta.id);
+    const parentId = String(plan.meta.parent);
     const entries = readStream(stateRoot, planId).filter((e) => e.t === 'test-evidence');
     const matching = (e, tag) => (Array.isArray(e.tests) ? e.tests : []).filter((t) => matchesTag(t.name, tag));
-    const required = diffTags(runRoot, base).map((tag) => {
+    // Row 97: red→green is a claim about the NEW BEHAVIOUR THIS PLAN BUILDS, so the only tag
+    // it can be made for is the plan's own parent — `test-evidence` interpolates
+    // `plan.meta.parent` and nothing else, which is why a foreign tag here was unsatisfiable
+    // AND (before row 93) unwaivable. Every other spec the diff's tests touched is a
+    // regression obligation, checked by `runRegression` at the gate.
+    const required = diffTags(runRoot, base).filter((tag) => tag === parentId).map((tag) => {
         // latest-cycle semantics: the newest red matching the tag is the verdict on
         // "was failure observed"; a green only counts if it post-dates that red.
         // One early vacuous red must not poison the tag forever (append-only journal).

package/dist/gate.js

@@ -8,18 +8,19 @@ import { appendEntry, entryLine, journalRel, policyPins, readStream } from './jo
 import { primaryRoot, stateCommit } from './gitio.js';
 import { loadCanon, findById } from './scan.js';
 import { newRunId } from './drift.js';
-import { resolveHarness } from './harness.js';
+import { resolveJudge } from './harness.js';
 import { ok, refuse, renderRefusal, v } from './refusal.js';
 import { kv, rows } from './toon.js';
 import { loadMatrix, resolveModel, SESSION_DEFAULT } from './model.js';
 import { docKeysFor, docsBlock, invokeReviewer, loadLensDocs, parseVerdictText, pinsBlock, promptsSha, resolvePrompt } from './reviewer.js';
 import { anchorMenu, parseVerdict, verdictViolations } from './verdict.js';
-import { ROUND_BOUND, appendKind, boundReached, gateRuns, roundsSinceApprove, } from './rounds.js';
+import { ROUND_BOUND, appendKind, boundReached, fellBack, lastGateRun, roundsSinceApprove, runsSinceReset, } from './rounds.js';
+import { gateSettled } from './verbs/next.js';
 import { prepareStamp, writeStamp } from './stamp.js';
 const GATES = new Map();
 export function registerGate(spec) { GATES.set(spec.gate, spec); }
 export function gateSpec(name) { return GATES.get(name); }
-export const DEFAULT_BATTERIES = {
+const DEFAULT_BATTERIES = {
     decompose: ['slicing-critic'],
     plan: ['plan-critic'],
     implement: {
@@ -43,11 +44,17 @@ export function batteryFor(cfg, gate, cls) {
 // where the state is. Skills used to recite a fixed triple, which is wrong at the bound
 // (D67's endgame set) — and now wrong in three more states.
 export function liveExits(gate, target, entries, stale) {
-    if (stale)
-        return `witness gate ${gate} ${target}`;
+    // The bound outranks staleness: at the bound the gate short-circuits and will not run
+    // again (:227), so "re-gate" is the D67 lie whatever the sha says. Stale content only
+    // removes APPROVE from the endgame — a human cannot honestly stamp bytes no battery
+    // read — which is the same set decide's stale-verdict refusal names.
     if (boundReached(entries, gate)) {
-        return `witness decide ${gate} ${target} --approve --override | --revise --upstream <id> | --stop`;
+        return stale
+            ? `witness decide ${gate} ${target} --revise --upstream <id> | --stop`
+            : `witness decide ${gate} ${target} --approve --override | --revise --upstream <id> | --stop`;
     }
+    if (stale)
+        return `witness gate ${gate} ${target}`;
     return `witness decide ${gate} ${target} --approve | --revise --note "<why>" | --revise --upstream <id> | --stop`;
 }
 export function renderGateRun(ctx, entry, mode) {
@@ -163,7 +170,7 @@ export async function runGate(ctx, gateName, target, flags) {
             lens.docs = docs;
         lenses.push(lens);
     }
-    const hxR = resolveHarness(ctx.env, cfgR.value.raw);
+    const hxR = resolveJudge(ctx.env, cfgR.value.raw);
     if (!hxR.ok) {
         renderRefusal(hxR.violations).forEach((l) => ctx.err(l));
         return EXIT.REFUSED;
@@ -183,15 +190,40 @@ export async function runGate(ctx, gateName, target, flags) {
         renderRefusal(modelR.violations).forEach((l) => ctx.err(l));
         return EXIT.REFUSED;
     }
-    const { chain, calibrationOf, warning } = modelR.value;
-    if (warning)
+    const { chain, calibrationOf, warning, warningKind } = modelR.value;
+    // matrix-empty is a fact about this witness build, reported once by `status`/`check`
+    // (D98a). Only the caller's own pin being below the floor is news at run time.
+    if (warning && warningKind === 'below-floor')
         ctx.err(`warning: ${warning}`);
+    // Row 106: the key is built BEFORE invoking, so the only model knowable here is the one
+    // being asked for. Naming it `pin` is what stops the entry's `model` — what actually
+    // answered — from being compared against it by accident, which is how the streak brake
+    // below spent three releases never firing.
+    const pin = chain[0];
     const key = {
         reviewed_sha: input.reviewedSha, gate: spec.gate,
-        prompts_sha: promptsSha(lenses, pinsText === '' ? undefined : pinsText), model: chain[0], witness: version(),
+        prompts_sha: promptsSha(lenses, pinsText === '' ? undefined : pinsText), pin, witness: version(),
         harness: harness.name,
     };
+    // D99: `gateSettled` reads only the last run, so any new run un-settles the gate.
+    // Content moving is a legitimate, self-explaining reason. A flag is not — `--fresh`
+    // discarded a human decision with nothing printed and nothing journaled about it, and
+    // row 94 removed its other job (escaping the changed-nothing deadlock), so it can
+    // refuse and send the human through the verb that states a retraction and its reason.
+    const settledBefore = gateSettled(entries, spec.gate);
+    if (flags.fresh && settledBefore) {
+        renderRefusal([v('gate', 'settled-approve', `${spec.gate} ${target} is settled`, `witness decide ${spec.gate} ${target} --revise --note "<why>" — retract the approval, then re-gate`)])
+            .forEach((l) => ctx.err(l));
+        return EXIT.REFUSED;
+    }
     const kind = flags.fresh ? { kind: 'fresh' } : appendKind(entries, spec.gate, key);
+    // A key that moved for a NON-content reason — edited prompt, re-pinned model, new
+    // witness version — un-settles just as quietly as --fresh did. Content moving explains
+    // itself; this does not.
+    const lastRun = lastGateRun(entries, spec.gate);
+    if (settledBefore && kind.kind === 'fresh' && lastRun && lastRun.reviewed_sha === input.reviewedSha) {
+        ctx.err(`warning: reviewer setup changed — this run discards the settled approve on ${spec.gate} ${target}`);
+    }
     if (kind.kind === 'resume') {
         renderGateRun(ctx, kind.entry, 'resume');
         printDispatchArithmetic(ctx, root, spec.gate, target);
@@ -211,11 +243,30 @@ export async function runGate(ctx, gateName, target, flags) {
         return EXIT.BLOCKED;
     }
     if (!flags.fresh) {
-        // malformed rounds don't spend the bound (rounds.ts) — this brake is what
-        // stops an unreliable battery from re-running for free forever instead
-        const tail = gateRuns(entries, spec.gate).slice(-2);
-        const sameSetup = (r) => r.outcome === 'malformed' && r.model === key.model && r.prompts_sha === key.prompts_sha &&
-            (r.harness ?? 'claude-code') === key.harness;
+        // Both brakes guard the SAME window as the round budget (rounds.ts): exempt rounds
+        // could otherwise repeat for free, and a run on the far side of an approve was
+        // disposed of and can trip nothing.
+        const tail = runsSinceReset(entries, spec.gate).slice(-2);
+        const samePin = (r) => (r.pin ?? r.model) === key.pin && (r.harness ?? 'claude-code') === key.harness;
+        // Row 107. A fallen-back round does not spend the budget, and an exempt round that
+        // repeats forever is D67's livelock — the exemption and this trigger are one change.
+        // `prompts_sha` is deliberately NOT compared: a lens edit has nothing to do with
+        // whether a model answers, and comparing it would let an unrelated edit reset a brake
+        // on a dead pin. Checked first because when both hold, "the pinned model is not
+        // answering" is the true remedy and "your battery emits invalid verdicts" is not.
+        // No --fresh in the want: --fresh bypasses the brake and would spend a battery
+        // re-invoking the same dead pin. Fixing the pin moves key.pin, samePin goes false,
+        // and the battery runs — which is only reachable BECAUSE these rounds were exempt.
+        if (tail.length === 2 && tail.every((r) => fellBack(r) && samePin(r))) {
+            renderRefusal([v(`gates.${spec.gate}.model`, 'fallback-streak', `${tail.length} consecutive rounds fell back from ${key.pin}`, 'a reachable gates.<gate>.model — the pinned model is not answering')])
+                .forEach((l) => ctx.err(l));
+            return EXIT.REFUSED;
+        }
+        // malformed rounds don't spend the bound either — this brake is what stops an
+        // unreliable battery from re-running for free forever instead. Row 106: "same setup"
+        // always meant the same PIN, and comparing the answering rung meant two malformed
+        // fallen-back rounds never matched, which is the one thing this exists to stop.
+        const sameSetup = (r) => r.outcome === 'malformed' && samePin(r) && r.prompts_sha === key.prompts_sha;
         if (tail.length === 2 && tail.every(sameSetup)) {
             renderRefusal([v('reviewers', 'malformed-streak', `${tail.length} consecutive malformed rounds on ${tail[1].model}`, `a changed gates.${spec.gate}.model pin or updated prompts — the battery is emitting invalid verdicts (or force with --fresh)`)]).forEach((l) => ctx.err(l));
             return EXIT.REFUSED;
@@ -231,7 +282,7 @@ export async function runGate(ctx, gateName, target, flags) {
     const fallback = [];
     const rerolled = [];
     let rung = 0;
-    let model = chain[0];
+    let model = pin;
     let cached = false;
     if (kind.kind === 'cached') {
         verdicts = kind.from.verdicts ?? [];
@@ -282,14 +333,22 @@ export async function runGate(ctx, gateName, target, flags) {
             }
         }
     }
-    if (fallback.length > 0 && chain[0] !== SESSION_DEFAULT && fallback.includes(chain[0])) {
-        ctx.err(`warning: head model ${chain[0]} failed to invoke — reviewers ran on ${model}; check gates.${spec.gate}.model`);
-    }
     const blocking = verdicts.flatMap((x) => x.findings).filter((f) => f.blocking).length;
     const pinConflicts = verdicts.flatMap((x) => x.findings).filter((f) => f.contradicts_pin !== undefined).length;
     const standing = [
         input.standingStop,
         pinConflicts > 0 ? 'contradicts-pin — a finding disputes a settled policy pin; the human decides which one dies' : undefined,
+        // Row 98c, specified by row 107. Composed HERE, after the battery, because whether a
+        // fallback happened is not knowable at resolve() time. Dismissed by a plain
+        // --approve: --override is reserved for the bound and this is a first-round event.
+        // The remedy is deliberately absent — on round one the honest statement is that a
+        // human decides whether the verdict counts; the remedy becomes true only once the pin
+        // proves persistently dead, which is what fallback-streak above prints. It REPLACES
+        // the stderr warning that fired on this same condition: unjournaled and non-blocking,
+        // it let a substituted verdict pass behind a line that scrolls by.
+        model !== pin
+            ? `fallback — reviewers ran on ${model}, not the pinned ${pin}; the human decides whether that verdict counts`
+            : undefined,
     ].filter((s) => s !== undefined).join(' · ') || undefined;
     const checksGreen = input.checks.every((c) => c.ok);
     const outcome = malformed.length > 0 ? 'malformed'
@@ -322,7 +381,7 @@ export async function runGate(ctx, gateName, target, flags) {
             v: 1, t: 'gate-run', gate: spec.gate, artifact: target,
             round: roundsSinceApprove(entriesNow, spec.gate) + 1, run_id: newRunId(),
             reviewed_sha: input.reviewedSha, prompts_sha: key.prompts_sha,
-            witness: key.witness, model, harness: harness.name, calibration: calibrationOf(model),
+            witness: key.witness, model, pin, harness: harness.name, calibration: calibrationOf(model),
             ...(localR.value.reviewerExtensions.length ? { reviewer_extensions: localR.value.reviewerExtensions } : {}),
             ...(cached ? { cached: true } : {}),
             ...(flags.manual ? { manual: true } : {}),

package/dist/gates/implement.js

@@ -8,9 +8,9 @@ import { designRel } from '../design.js';
 import { git } from '../gitio.js';
 import { latestRecap, readStream } from '../journal.js';
 import { findById } from '../scan.js';
-import { changedFiles, diffBase, evidenceForDiff, screensDir } from '../evidence.js';
+import { changedFiles, changedTestSpecs, diffBase, evidenceForDiff, runRegression, screensDir } from '../evidence.js';
 import { runCriteria } from '../criteria.js';
-import { effortOf, worktreeTreeSha } from '../reviewed.js';
+import { effortOf, implementReviewedSha } from '../reviewed.js';
 import { worktreePath } from '../worktree.js';
 import { registerGate } from '../gate.js';
 export function codePromptBody(wt, base, files, header) {
@@ -113,8 +113,26 @@ registerGate({
         const missing = report.required.filter((r) => !(r.red && r.green && !r.vacuous));
         checks.push({ name: 'evidence', ok: report.satisfied,
             detail: report.satisfied
-                ? `${report.required.length} tags with red→green pairs`
+                ? (report.required.length > 0
+                    ? `${String(plan.meta.parent)}: red→green`
+                    : `no ${String(plan.meta.parent)} tests in the diff — nothing to witness`)
                 : missing.map((m) => `${m.tag}: red=${m.red} green=${m.green}${m.vacuous ? ' vacuous' : ''}`).join(' · ') });
+        // Row 97: the obligation created by editing someone's tests is that those tests still
+        // pass — not that their whole spec is satisfied, which is the out-of-band drift sweep's
+        // job. `runCriteria` is deliberately NOT used here: it executes the foreign spec's `cmd`
+        // criteria, arbitrary trust-gated commands, inside an unattended gate.
+        const foreign = changedTestSpecs(wt, base, String(plan.meta.parent));
+        const regression = await runRegression(wt, ctx, root, foreign, (id) => findById(canon, id) !== undefined);
+        checks.push({
+            name: 'regression',
+            // `unknown` does not fail: witness cannot judge an obligation for a spec it does not
+            // have, and failing it re-creates the unsatisfiable check this row deletes. It is
+            // named in the detail, which is where a typo'd tag surfaces.
+            ok: regression.every((r) => r.state === 'green' || r.state === 'unknown'),
+            detail: regression.length === 0
+                ? 'no foreign spec tests touched'
+                : regression.map((r) => `${r.spec}:${r.state}`).join(' · '),
+        });
         const lane = await runCriteria(wt, ctx, parent, { trustRoot: root });
         checks.push({
             name: 'drift-lane',
@@ -127,7 +145,7 @@ registerGate({
         const recap = effort ? latestRecap(root, effort) : undefined;
         return ok({
             class: (recap?.class ?? 'feature'),
-            reviewedSha: worktreeTreeSha(wt),
+            reviewedSha: implementReviewedSha(wt, base, plan),
             artifactSha: canonicalSha(plan.meta, plan.body),
             reviewed: { kind: 'tree', root: wt, files },
             promptBody: codePromptBody(wt, base, files, `### Plan under implementation: ${planId}\n${serializeDoc({ meta: plan.meta, body: plan.body })}`),
@@ -137,8 +155,14 @@ registerGate({
             skipLenses,
         });
     },
-    currentSha(root, _canon, _cfg, planId) {
+    currentSha(root, canon, cfg, planId) {
         const wt = worktreePath(root, planId);
-        return existsSync(wt) ? worktreeTreeSha(wt) : undefined;
+        const plan = findById(canon, planId);
+        if (!existsSync(wt) || !plan)
+            return undefined;
+        const baseR = diffBase(wt, cfg);
+        // undefined is "cannot compute", never "moved": an unresolvable base must not
+        // un-settle a gate or invert `decide --show`'s staleness line.
+        return baseR.ok ? implementReviewedSha(wt, baseR.value, plan) : undefined;
     },
 });

package/dist/gates/ship.js

@@ -7,7 +7,7 @@ import { changedFiles, diffBase } from '../evidence.js';
 import { runCriteria } from '../criteria.js';
 import { execCommand } from '../runner.js';
 import { ensureTrusted } from '../allowlist.js';
-import { effortOf, worktreeTreeSha } from '../reviewed.js';
+import { diffReviewedSha, effortOf } from '../reviewed.js';
 import { worktreePath } from '../worktree.js';
 import { codePromptBody } from './implement.js';
 import { registerGate } from '../gate.js';
@@ -52,13 +52,15 @@ registerGate({
         // differently for the same journal — the split-brain that reads as a deadlock when
         // two sessions compare notes.
         //
-        // The missing sha argument is DELIBERATE and load-bearing, not an oversight. D75's
-        // `worktreeTreeSha` covers the whole worktree, so ship's own `pr #N` stamp — pulled
-        // into the worktree by the watch-phase rebase — moves the tree and would lapse the
-        // very gate ship is checking: approve → pr → lapse → gate, the livelock D75/D77
-        // record. `next` re-arms on tree movement because authoring is what it routes to;
-        // ship asks only whether implement was ever settled. Passing a sha here re-opens
-        // that livelock — do not "fix" this by adding one.
+        // The missing sha argument is still DELIBERATE, but row 96 killed one of its two
+        // reasons and the surviving one is now the whole reason. It used to rest on
+        // `worktreeTreeSha` hashing the entire worktree, so ship's own `pr #N` stamp — pulled
+        // in by the watch-phase rebase — moved the tree and lapsed the very gate ship was
+        // checking: approve → pr → lapse → gate, the D75/D77 livelock. Under the diff identity
+        // that reason is DEAD: the worktree never edits `plans/<id>.md`, so the stamp is always
+        // equal to base and can never enter the reviewed set. What remains: `next` re-arms on
+        // movement because authoring is what it routes to, while ship asks only whether
+        // implement was EVER settled. Passing a sha here re-opens the livelock — do not add one.
         const implementSettled = gateSettled(entries, 'implement');
         checks.push({ name: 'implement-gate', ok: implementSettled,
             detail: lastImplement
@@ -85,7 +87,7 @@ registerGate({
         const recap = effort ? latestRecap(root, effort) : undefined;
         return ok({
             class: (recap?.class ?? 'feature'),
-            reviewedSha: worktreeTreeSha(wt),
+            reviewedSha: diffReviewedSha(wt, base),
             artifactSha: canonicalSha(plan.meta, plan.body),
             reviewed: { kind: 'tree', root: wt, files },
             promptBody: codePromptBody(wt, base, files, `### Parent spec (from main): ${String(parent.meta.id)}\n${serializeDoc({ meta: parent.meta, body: parent.body })}\n\n### Plan: ${planId}\n${serializeDoc({ meta: plan.meta, body: plan.body })}`),
@@ -95,8 +97,12 @@ registerGate({
             repin,
         });
     },
-    currentSha(root, _canon, _cfg, planId) {
+    currentSha(root, _canon, cfg, planId) {
         const wt = worktreePath(root, planId);
-        return existsSync(wt) ? worktreeTreeSha(wt) : undefined;
+        if (!existsSync(wt))
+            return undefined;
+        const baseR = diffBase(wt, cfg);
+        // undefined is "cannot compute", never "moved" — same doctrine as the implement gate.
+        return baseR.ok ? diffReviewedSha(wt, baseR.value) : undefined;
     },
 });

package/dist/gitio.js

@@ -39,6 +39,39 @@ export function stateDirs(root) {
 export function isStatePath(root, rel) {
     return stateDirs(root).some((d) => rel === d || rel.startsWith(d + '/'));
 }
+// Row 96b. Witness's own state commits reach `origin/main` on every `sync`, and `shipPhase`
+// re-gates on ANY base advance — so the pipeline manufactured its own base movement (7 ship
+// runs for 3 rounds on the audited plan). An advance whose every commit touches only state
+// paths is bookkeeping, not base movement, and this is the ONE predicate both `baseMoved`
+// and `rebaseIfMoved` ask; two copies would let ship rebase in the phase that was just told
+// the base had not moved.
+//
+// Paths are primary and the trailer is secondary, and the conjunction is what keeps both
+// forgeries conservative: a forged trailer on a source commit still reads as real movement
+// (paths decide), and a hand-made commit that happens to touch only state paths reads as
+// real movement too (no trailer). A needless rebase costs a round; a skipped one merges a
+// tree no battery read.
+export function stateOnlyAdvance(wt, root, from, to) {
+    const range = tryGit(wt, 'log', '--format=%H', `${from}..${to}`);
+    if (!range.ok)
+        return false;
+    const shas = range.out.split('\n').filter(Boolean);
+    if (shas.length === 0)
+        return false;
+    return shas.every((sha) => {
+        const trailer = tryGit(wt, 'show', '--no-patch', '--format=%(trailers:key=Witness-State,valueonly=true)', sha);
+        if (!trailer.ok || trailer.out.trim() !== '1')
+            return false;
+        // Per COMMIT, never the range's union diff: a commit that adds and deletes a source
+        // file inside the range cancels out in a union and would read as state-only. An empty
+        // name list (a merge commit) is unjudgeable here and therefore not state-only.
+        const touched = tryGit(wt, 'show', '--pretty=format:', '--name-only', sha);
+        if (!touched.ok)
+            return false;
+        const paths = touched.out.split('\n').filter(Boolean);
+        return paths.length > 0 && paths.every((p) => isStatePath(root, p));
+    });
+}
 const LOCAL_STATE_FILES = new Set([
     '.witness/lock',
     '.witness/txn.json',