@remits/remits-cli 0.1.127 → 0.1.128

package/README.md

@@ -28,7 +28,7 @@ remits-cli components stage                   # FULL SNAPSHOT of the repo into t
 remits-cli components status
 remits-cli components clear
 remits-cli test run --test 45
-remits-cli test run --test "My New Test" --names "test case 1,test case 2"
+remits-cli test run --test "My New Test" --names "test case 1|test case 2"
 git add -A
 git commit -m "sync passing changes"
 git push
@@ -98,7 +98,8 @@ remits-cli install --skills --overwrite true
 - Branch defaults to the current local git branch.
 - Data mode defaults to `test`. For `remits-cli test run`, that default is now enforced even if the most-recent authenticated session for the account is `prod`; a production test run therefore requires an explicit `--data-mode prod` on the command line. Use `remits-cli data-mode set prod` only for production investigation.
 - If the same account is authenticated against more than one host and you omit `--base-url`, the CLI auto-resolves the best matching session and now prints the resolved host. Pass `--base-url` explicitly whenever the target host matters.
-- Avoid commas in individual test names. The `--names` filter is comma-delimited, so a single test case whose name contains commas cannot be targeted cleanly through `remits-cli test run --names ...`.
+- `--names` is `|`-delimited and may be repeated. A comma still splits a single value for compatibility,
+  so a case name containing a comma should be passed with `|` or by repeating `--names`.
 - Nested help is available before required-argument validation, including `remits-cli test run --help`, `remits-cli components sync --help`, and `remits-cli tool --help`.
 - `components sync --safe` is the recommended agent path on a variant branch. It expands to `--summary --changed-only --fail-on-errors --fail-on-removed`, resolves `--changed-since` from the branch's merge base with trunk when you did not name one (local refs only; it never runs an implicit `git fetch`), and prints the planned writes before mutating unless `--yes` is passed. On trunk there is no plan to gate, so it states what a trunk reconcile does and requires `--yes`.
 - `components sync` has fail-closed safety gates for unattended/agent use. Each exits non-zero instead of printing a wall of JSON: `--changed-only` (fail unless every planned write is a component this checkout edited), `--names-only` (print only `BUCKET type:id name` lines), `--fail-on-removed`, `--fail-on-errors`, and `--expected-removed <type:id>` (repeatable or comma-delimited; implies `--fail-on-removed`, so any removal you did not name fails). `--changed-only` also fails closed when the checkout is not a git working tree, because "git could not answer" must never be read as "nothing changed".

package/index.js

@@ -6,16 +6,16 @@
 - L22  Runtime Bootstrap And Shared State
 - L116  Sessions, Account Resolution, And Production Guards
 - L595  Local State, Workspaces, And Verification Evidence
-- L1296  Account Repos, Guide Sync, And Platform Repo
-- L1954  Component Discovery And HTTP Logging
-- L2444  Skill Delivery And TOC Resolution
-- L2754  Auth And Component Staging
-- L3352  Component Summaries, Status, And Sync Gates
-- L5107  Branches, Promotion, Commit, And Test Runs
-- L6231  Tokens, Tools, Verification, And Config
-- L7141  Service Dashboard And WebSocket Listener
-- L9236  Agent And Ticket Workflows
-- L12294  Help, Auto Update, And Command Dispatch
+- L1399  Account Repos, Guide Sync, And Platform Repo
+- L2057  Component Discovery And HTTP Logging
+- L2549  Skill Delivery And TOC Resolution
+- L2859  Auth And Component Staging
+- L3457  Component Summaries, Status, And Sync Gates
+- L5323  Branches, Promotion, Commit, And Test Runs
+- L6562  Tokens, Tools, Verification, And Config
+- L7478  Service Dashboard And WebSocket Listener
+- L9573  Agent And Ticket Workflows
+- L12631  Help, Auto Update, And Command Dispatch
 */
 
 /*
@@ -821,6 +821,22 @@ function fileEvidence(pathname) {
   };
 }
 
+const LARGE_TOOL_RESPONSE_BYTES = 200 * 1024;
+
+function formatToolResponseFile(pathname) {
+  const evidence = fileEvidence(pathname);
+  if (!evidence.bytes) return String(pathname || '');
+  return pathname + ' (' + evidence.bytes + ' bytes, sha256 ' + evidence.sha256.slice(0, 12) + ')';
+}
+
+function printToolResponseFileLine(label, pathname) {
+  console.log(label + ':', formatToolResponseFile(pathname));
+  const evidence = fileEvidence(pathname);
+  if (evidence.bytes && evidence.bytes >= LARGE_TOOL_RESPONSE_BYTES) {
+    console.log('Large response: inspect selectively with jq or targeted offset reads instead of opening the whole file.');
+  }
+}
+
 function boundedToolExcerpt(data = {}) {
   const result = data.result && typeof data.result === 'object' ? data.result : {};
   const candidates = [
@@ -982,6 +998,35 @@ function readLocalVerificationEnvelope(cwd, envelopeId) {
   }
 }
 
+function readLocalVerificationPackets(cwd, envelopeId, filters = {}) {
+  const paths = verificationPaths(cwd, envelopeId);
+  const packets = [];
+  if (fs.existsSync(paths.packetsDir)) {
+    fs.readdirSync(paths.packetsDir)
+      .filter((name) => name.endsWith('.json'))
+      .forEach((name) => {
+        try {
+          const parsed = JSON.parse(fs.readFileSync(path.join(paths.packetsDir, name), 'utf8'));
+          if (parsed && typeof parsed === 'object') packets.push(parsed);
+        } catch (_) {
+          // Ignore one malformed local packet; the rest of the envelope remains useful.
+        }
+      });
+  }
+  if (!packets.length) {
+    const envelope = readLocalVerificationEnvelope(cwd, envelopeId);
+    if (envelope && Array.isArray(envelope.packets)) packets.push(...envelope.packets);
+  }
+  const type = filters.type || filters.packetType;
+  const suite = filters.suite || filters.testName;
+  const max = parsePositiveInt(filters.max, 50);
+  const filtered = packets
+    .filter((packet) => !type || packet.type === type)
+    .filter((packet) => !suite || testRunSuiteNameFromPacket(packet) === String(suite))
+    .sort((a, b) => Number(a.createdAt || 0) - Number(b.createdAt || 0));
+  return filtered.slice(Math.max(0, filtered.length - max));
+}
+
 function writeLocalVerificationPacket(cwd, envelopeId, packet) {
   if (!envelopeId || !packet) return null;
   const paths = verificationPaths(cwd, envelopeId);
@@ -1103,11 +1148,13 @@ function printVerificationSummaryLine(env) {
   const failures = env.currentFailureCount ? ' currentFailures=' + env.currentFailureCount : (env.failedCount ? ' failed=' + env.failedCount : '');
   const required = ' required=' + (env.satisfiedCount || 0) + '/' + (env.requiredCount || 0);
   const noManifest = env.noRequiredEvidence ? ' no-manifest' : '';
+  const stale = env.staleCount ? ' stale=' + env.staleCount : '';
+  const changed = env.requirementsChangedAfterEvidence ? ' requirements-changed' : '';
   const lane = [env.branchName || 'unknown-branch', env.workspace ? 'ws:' + env.workspace : 'shared', env.dataMode || null, env.sourceLayer || null]
     .filter(Boolean).join(' | ');
-  console.log('- ' + (env.envelopeId || '(no id)') + '  ' + (env.status || 'unknown') + health + failures + required + noManifest);
+  console.log('- ' + (env.envelopeId || '(no id)') + '  ' + (env.status || 'unknown') + health + failures + required + stale + noManifest + changed);
   if (env.summary) console.log('  ' + env.summary);
-  console.log('  ' + lane + '  packets=' + (env.packetCount || 0) + '  updated=' + formatTime(env.updatedAtMs || env.latestPacketAtMs));
+  console.log('  ' + lane + '  packets=' + (env.packetCount || 0) + '  lastPacket=' + formatTime(env.lastPacketAtMs || env.latestPacketAtMs) + '  updated=' + formatTime(env.updatedAtMs || env.latestPacketAtMs));
 }
 
 function printVerificationEnvelope(envelope, fallbackEnvelopeId) {
@@ -1124,6 +1171,12 @@ function printVerificationEnvelope(envelope, fallbackEnvelopeId) {
   if (evaluation.failedCount) {
     console.log('Failed packets:', evaluation.failedCount, 'current failures:', evaluation.currentFailureCount || 0);
   }
+  if (evaluation.requirementsChangedAfterEvidence) {
+    console.log('Requirements changed after evidence was collected.');
+  }
+  if (Array.isArray(evaluation.stale) && evaluation.stale.length) {
+    console.log('Stale packets:', evaluation.stale.length);
+  }
   const packets = Array.isArray(envelope.packets) ? envelope.packets : [];
   console.log('Packets:', packets.length);
   packets.slice(-20).forEach((packet) => {
@@ -1147,6 +1200,56 @@ function printAcceptanceWarnings(envelope) {
   });
 }
 
+function printEnvelopeWarnings(envelope) {
+  const warnings = envelope && Array.isArray(envelope.warnings) ? envelope.warnings : [];
+  if (!warnings.length) return;
+  console.log('Envelope warnings:');
+  warnings.forEach((warning) => {
+    console.log('- ' + (warning.message || warning.code || JSON.stringify(warning)));
+    if (Array.isArray(warning.envelopes) && warning.envelopes.length) {
+      warning.envelopes.forEach((env) => {
+        console.log('  ' + (env.envelopeId || '(no id)') + (env.status ? ' ' + env.status : ''));
+      });
+    }
+  });
+}
+
+function manifestRequiredEvidence(manifest = {}) {
+  const required = [];
+  if (Array.isArray(manifest.requiredEvidence)) required.push(...manifest.requiredEvidence);
+  const journeys = Array.isArray(manifest.journeys) ? manifest.journeys :
+    (Array.isArray(manifest.requestedJourneys) ? manifest.requestedJourneys : []);
+  journeys.forEach((journey) => {
+    if (journey && Array.isArray(journey.requiredEvidence)) required.push(...journey.requiredEvidence);
+  });
+  return required;
+}
+
+async function readVerificationEnvelopeForDiagnostics(api, cwd, session, accountId, envelopeId) {
+  if (!envelopeId) return null;
+  try {
+    const response = await postVerificationCommand(api, cwd, session, accountId, 'show', { envelopeId });
+    if (response.envelope) {
+      writeLocalVerificationEnvelope(cwd, response.envelope);
+      return response.envelope;
+    }
+  } catch (_) {
+    // Local evidence is still useful for diagnostics when the platform read fails.
+  }
+  return readLocalVerificationEnvelope(cwd, envelopeId);
+}
+
+async function readVerificationPacketsForDiagnostics(api, cwd, session, accountId, envelopeId, filters = {}) {
+  if (!envelopeId) return [];
+  try {
+    const response = await postVerificationCommand(api, cwd, session, accountId, 'packets', Object.assign({ envelopeId }, filters));
+    if (Array.isArray(response.packets)) return response.packets;
+  } catch (_) {
+    // Local full-fidelity packet files remain the fallback when the platform read is unavailable.
+  }
+  return readLocalVerificationPackets(cwd, envelopeId, filters);
+}
+
 function buildCommandWorld(response, fallback = {}) {
   const source = (response && response.staging) || {};
   const resolution = (response && response.resolution) || {};
@@ -2395,21 +2498,23 @@ async function loggedPost(api, cwd, endpoint, payload, options = {}) {
     error = err;
     throw err;
   } finally {
-    const status = error ? 'error' : 'success';
-    const responseForLog = responseFile
-      ? { responseFile, note: 'Tool response stored externally' }
-      : sanitizeForLog(responseData);
-    appendSessionLog(cwd, {
-      ts: new Date().toISOString(),
-      requestId,
-      endpoint,
-      method: 'POST',
-      status,
-      durationMs: Date.now() - started,
-      request: sanitizeForLog(payload),
-      response: responseForLog,
-      error: error ? describeError(error) : null
-    });
+    if (!options.skipSessionLog) {
+      const status = error ? 'error' : 'success';
+      const responseForLog = responseFile
+        ? { responseFile, note: 'Tool response stored externally' }
+        : sanitizeForLog(responseData);
+      appendSessionLog(cwd, {
+        ts: new Date().toISOString(),
+        requestId,
+        endpoint,
+        method: 'POST',
+        status,
+        durationMs: Date.now() - started,
+        request: sanitizeForLog(payload),
+        response: responseForLog,
+        error: error ? describeError(error) : null
+      });
+    }
   }
 }
 
@@ -3598,6 +3703,7 @@ function describeStageMode(mode) {
 function printStatusSummary(response, flags) {
   printBranchContext(response);
   printStagingLane(response.branchName, response.workspace, null);
+  printStagingLaneOwnerNotice(response);
   printLaneSummary(response);
   printOrphanedWorkspaceWarning(response);
   printStagingFreshness(response.freshness);
@@ -3625,6 +3731,28 @@ function printStatusSummary(response, flags) {
   printComponentCommandResponse('Components staging', response, flags);
 }
 
+function stagingLaneOwnerNotice(response = {}) {
+  const owner = response.laneOwnerAccountId != null ? response.laneOwnerAccountId :
+    (response.staging && response.staging.laneOwnerAccountId);
+  const checkout = response.checkoutAccountId != null ? response.checkoutAccountId :
+    (response.accountId != null ? response.accountId : (response.staging && response.staging.checkoutAccountId));
+  const stagedCount = Number(response.stagedCount != null ? response.stagedCount :
+    (response.laneSummary && response.laneSummary.stagedCount != null ? response.laneSummary.stagedCount :
+      (response.staging && response.staging.stagedCount != null ? response.staging.stagedCount :
+        (response.staging && response.staging.laneSummary && response.staging.laneSummary.stagedCount))));
+  if (owner == null || checkout == null || String(owner) === String(checkout) || !(stagedCount > 0)) {
+    return [];
+  }
+  return [
+    'WARNING: staged entries shown here are under account ' + owner + ', not checkout account ' + checkout + '.',
+    '  clear with: remits-cli components clear --all --account-id ' + owner
+  ];
+}
+
+function printStagingLaneOwnerNotice(response = {}) {
+  stagingLaneOwnerNotice(response).forEach((line) => console.log(line));
+}
+
 function printLanesSummary(response, flags) {
   printBranchContext(response);
   const lanes = Array.isArray(response.lanes) ? response.lanes : (Array.isArray(response.accountLanes) ? response.accountLanes : []);
@@ -3999,19 +4127,25 @@ async function lanesComponentsCommand(flags) {
   const dataMode = resolveDataMode(flags, session);
   const api = buildAxios(baseUrl, session.token);
 
-  const response = await loggedPost(api, cwd, '/cli/components', {
+  const requestPayload = {
     token: session.token,
     accountId,
     branchName,
     workspace,
     dataMode,
     mode: 'lanes'
-  }).then((r) => r.data);
+  };
+
+  let response = await loggedPost(api, cwd, '/cli/components', requestPayload).then((r) => r.data);
 
   if (!response.success) {
     throw new Error(response.message || 'Staging lanes failed');
   }
 
+  if (flagEnabled(flags['wait-change']) || flagEnabled(flags.waitChange)) {
+    response = await waitForLaneChange(api, cwd, requestPayload, response, flags);
+  }
+
   if (flagEnabled(flags.json)) {
     console.log(JSON.stringify(response, null, 2));
     return response;
@@ -4024,6 +4158,55 @@ async function lanesComponentsCommand(flags) {
   return response;
 }
 
+function laneWaitSignature(response, laneId) {
+  const lanes = Array.isArray(response && response.lanes)
+    ? response.lanes
+    : (Array.isArray(response && response.accountLanes) ? response.accountLanes : []);
+  const selected = laneId ? lanes.filter((lane) => String(lane.laneId || '') === String(laneId)) : lanes;
+  return stableStringify(selected.map((lane) => ({
+    laneId: lane.laneId,
+    accountId: lane.accountId,
+    branchName: lane.branchName,
+    workspace: lane.workspace || null,
+    stagedCount: lane.stagedCountAsOf || lane.stagedCount || 0,
+    contentHash: lane.contentHash || (lane.laneSummary && lane.laneSummary.contentHash) || null,
+    updatedAtMs: lane.updatedAtMs || null
+  })));
+}
+
+async function waitForLaneChange(api, cwd, requestPayload, initialResponse, flags) {
+  const laneId = flags['lane-id'] || flags.laneId || flags.lane;
+  const timeoutSeconds = parsePositiveInt(flags.timeout || flags['timeout-seconds'] || flags.timeoutSeconds, 600);
+  const pollMs = parsePositiveInt(flags['poll-ms'] || flags.pollMs, 2000);
+  const started = Date.now();
+  const initialSignature = laneWaitSignature(initialResponse, laneId);
+  if (!flagEnabled(flags.json)) {
+    console.log('Waiting for staging lane change' + (laneId ? ' on ' + laneId : '') + ' for up to ' + timeoutSeconds + 's...');
+  }
+  while (Date.now() - started < timeoutSeconds * 1000) {
+    await new Promise((resolve) => setTimeout(resolve, pollMs));
+    const next = await loggedPost(api, cwd, '/cli/components', requestPayload, { skipSessionLog: true }).then((r) => r.data);
+    if (!next.success) {
+      throw new Error(next.message || 'Staging lanes failed while waiting for a change');
+    }
+    if (laneWaitSignature(next, laneId) !== initialSignature) {
+      next.waitChange = {
+        changed: true,
+        laneId: laneId || null,
+        waitedMs: Date.now() - started
+      };
+      return next;
+    }
+  }
+  initialResponse.waitChange = {
+    changed: false,
+    laneId: laneId || null,
+    waitedMs: Date.now() - started,
+    timeoutSeconds
+  };
+  return initialResponse;
+}
+
 async function entriesComponentsCommand(flags) {
   const cwd = process.cwd();
   ensureLocalState(cwd);
@@ -4219,6 +4402,30 @@ async function syncComponentsCommand(rawFlags) {
       }
       throw new Error(mismatch + ' Nothing was synced.');
     }
+    const featureRefusal = !namesOnly ? featureBranchSyncRefusal(branchContext, branchName, flags) : null;
+    if (featureRefusal) {
+      if (flagEnabled(flags.json)) {
+        const refusal = {
+          success: false,
+          mode: 'sync',
+          dataMode,
+          accountId,
+          branchName,
+          workspace,
+          dryRun,
+          safe,
+          branchContext,
+          repositoryCheck: preflightRepoCheck,
+          refusal: 'feature_branch_landing',
+          gateViolations: [featureRefusal],
+          message: featureRefusal
+        };
+        console.log(JSON.stringify(refusal, null, 2));
+        process.exitCode = 1;
+        return refusal;
+      }
+      throw new Error(featureRefusal + ' Nothing was synced.');
+    }
     if (branchContextIsTrunk(branchContext)) {
       // Trunk has no dry-run plan to gate on, and pretending otherwise would be worse than refusing:
       // an agent would read "safe" and get an ungated authoritative reconcile. Say what trunk sync is
@@ -4781,6 +4988,15 @@ function featureBranchCommitRefusal(branchContext, branchName, flags) {
     'deliberately creating a NEW variant branch, re-run with --create-variant-branch.';
 }
 
+function featureBranchSyncRefusal(branchContext, branchName, flags) {
+  if (!branchContext || branchContext.variantBranchSource !== 'subscription-fallback') return null;
+  if (flags && (flags['create-variant-branch'] === true || flags['create-variant-branch'] === 'true')) return null;
+  return 'components sync refused: \'' + branchName + '\' is not a variant branch (no committed variants, no ' +
+    'subscribers). ' + featureBranchLandingHint(branchContext) + ' Syncing here would write overlays for \'' +
+    branchName + '\' that nobody subscribes to, and flip every other lane on that branch to them. If you are ' +
+    'deliberately creating a NEW variant branch, re-run with --create-variant-branch.';
+}
+
 // What a verification envelope records as the world it verified. Taken from the platform's answer
 // (`variantWorld`, the same rule every run uses), never inferred from `onTrunk`: a feature branch cut from a
 // variant branch is not on trunk, yet resolves the SUBSCRIBED branch, and labelling it by its own name recorded
@@ -5916,6 +6132,94 @@ function testCompileSignatures(status = {}) {
     .filter(Boolean);
 }
 
+function testRunSuiteNameFromStatus(status = {}) {
+  return status.test && status.test.name ? String(status.test.name) : null;
+}
+
+function testRunSuiteNameFromPacket(packet = {}) {
+  return packet.test && packet.test.testName
+    ? String(packet.test.testName)
+    : (packet.status && packet.status.test && packet.status.test.name ? String(packet.status.test.name) : null);
+}
+
+function testCaseOutcomesFromStatusLike(status = {}) {
+  const tests = status.result && Array.isArray(status.result.tests) ? status.result.tests :
+    (status.test && Array.isArray(status.test.tests) ? status.test.tests : []);
+  return tests
+    .filter((test) => test && test.name && typeof test.passed === 'boolean')
+    .map((test) => ({ name: String(test.name), passed: test.passed === true }));
+}
+
+function provenanceSignature(value) {
+  const rows = Array.isArray(value) ? value : [];
+  return sha256(stableStringify(rows.map((entry) => ({
+    type: entry && entry.type || null,
+    id: entry && entry.id || null,
+    name: entry && entry.name || null,
+    signature: entry && entry.signature || null,
+    source: entry && entry.source || null
+  }))));
+}
+
+function packetEvidenceIdentity(packet = {}) {
+  const world = packet.world || {};
+  const revision = packet.revision || {};
+  const laneSummary = packet.laneSummary || (packet.componentStatus && packet.componentStatus.laneSummary) || {};
+  return {
+    laneContentHash: world.laneContentHash || world.stagedOverlayHash || revision.laneContentHash ||
+      revision.stagedOverlayHash || laneSummary.contentHash || null,
+    gitHead: revision.gitHead || null
+  };
+}
+
+function sameNondeterminismIdentity(left = {}, right = {}) {
+  return !!(left.laneContentHash && right.laneContentHash && left.gitHead && right.gitHead &&
+    String(left.laneContentHash) === String(right.laneContentHash) &&
+    String(left.gitHead) === String(right.gitHead));
+}
+
+function detectNondeterministicTestRun(priorPackets, currentStatus, currentProvenance, currentIdentity = {}) {
+  const packets = Array.isArray(priorPackets) ? priorPackets : [];
+  const suiteName = testRunSuiteNameFromStatus(currentStatus);
+  const currentCases = testCaseOutcomesFromStatusLike(currentStatus);
+  if (!suiteName || !currentCases.length) return null;
+  if (!Array.isArray(currentProvenance) || !currentProvenance.length) return null;
+  if (!currentIdentity.laneContentHash || !currentIdentity.gitHead) return null;
+
+  const currentSignature = provenanceSignature(currentProvenance);
+  const currentByName = new Map(currentCases.map((outcome) => [outcome.name, outcome]));
+  for (let i = packets.length - 1; i >= 0; i -= 1) {
+    const packet = packets[i];
+    if (!packet || packet.type !== 'test_run') continue;
+    if (testRunSuiteNameFromPacket(packet) !== suiteName) continue;
+    const previousProvenance = packet.revision && packet.revision.componentProvenance;
+    if (!Array.isArray(previousProvenance) || !previousProvenance.length) continue;
+    if (!sameNondeterminismIdentity(currentIdentity, packetEvidenceIdentity(packet))) continue;
+    const previousSignature = provenanceSignature(previousProvenance);
+    if (previousSignature !== currentSignature) continue;
+    const previousCases = testCaseOutcomesFromStatusLike(packet.status || packet);
+    const flips = previousCases
+      .map((previous) => {
+        const current = currentByName.get(previous.name);
+        return current && current.passed !== previous.passed
+          ? { caseName: previous.name, previousPassed: previous.passed, currentPassed: current.passed, previousPacketId: packet.packetId }
+          : null;
+      })
+      .filter(Boolean);
+    if (flips.length) {
+      return {
+        nondeterministic: true,
+        message: 'Outcome changed with no source change - likely nondeterministic (AI/live data).',
+        suite: suiteName,
+        provenanceSignature: currentSignature,
+        previousPacketId: packet.packetId,
+        flips
+      };
+    }
+  }
+  return null;
+}
+
 function printTestRunPivots(status = {}) {
   const tests = status.result && Array.isArray(status.result.tests) ? status.result.tests : [];
   if (!tests.length) return;
@@ -6102,6 +6406,7 @@ async function testCommand(flags) {
     printSessionResolutionWarning(sessionContext);
     printResolvedBaseUrl(baseUrl);
     printStagingLane(branchName, workspace, workspaceSource(cwd, flags));
+    printStagingLaneOwnerNotice(start.staging || {});
     if (start.staging && Array.isArray(start.staging.accountLanes)) {
       printOrphanedWorkspaceWarning(start.staging);
       printAccountLanes({ accountLanes: start.staging.accountLanes, branchName, workspace });
@@ -6130,6 +6435,7 @@ async function testCommand(flags) {
     console.log(JSON.stringify(status, null, 2));
   } else {
     console.log('Final status:', JSON.stringify(status, null, 2));
+    printStagingLaneOwnerNotice(status.staging || {});
     printTestRunPivots(status);
   }
 
@@ -6155,15 +6461,38 @@ async function testCommand(flags) {
     process.exitCode = 1;
   }
 
+  const verificationContext = activeVerificationContext(cwd, flags, session, accountId);
+  const activeEnvelopeId = verificationEnvelopeIdForCommand(cwd, flags, verificationContext);
+  const componentProvenance = testComponentProvenance(status);
+  const sourceRevision = collectVerificationSource(cwd, flags);
+  const priorPackets = await readVerificationPacketsForDiagnostics(api, cwd, session, accountId, activeEnvelopeId, {
+    packetType: 'test_run',
+    suite: status.test && status.test.name,
+    max: 50
+  });
+  const nondeterminism = detectNondeterministicTestRun(priorPackets, status, componentProvenance, {
+    laneContentHash: status.staging && status.staging.laneSummary && status.staging.laneSummary.contentHash,
+    gitHead: sourceRevision.gitHead
+  });
+  if (nondeterminism && !jsonOutput) {
+    console.log('Nondeterministic signal:', nondeterminism.message);
+    nondeterminism.flips.slice(0, 6).forEach((flip) => {
+      console.log('  - ' + flip.caseName + ': ' + (flip.previousPassed ? 'passed' : 'failed') + ' -> ' + (flip.currentPassed ? 'passed' : 'failed') +
+        ' (previous packet ' + (flip.previousPacketId || 'unknown') + ')');
+    });
+  }
+
   await appendVerificationPacket(api, cwd, session, accountId, flags, {
     type: 'test_run',
     success: status.status === 'completed' && !(status.result && status.result.failed > 0) && !unmatched.length,
     claim: 'Test run ' + String(testRef),
     world: buildCommandWorld(status, { accountId, dataMode: status.dataMode || dataMode, dataModeSource, branchName, workspace, host: normalizeBaseUrl(baseUrl), sourceLayer: status.staging && status.staging.testComponentSource }),
-    revision: Object.assign(collectVerificationSource(cwd, flags), {
+    revision: Object.assign(sourceRevision, {
       compileSignatures: testCompileSignatures(status),
-      componentProvenance: testComponentProvenance(status)
+      componentProvenance
     }),
+    nondeterministic: nondeterminism ? true : undefined,
+    nondeterminism: nondeterminism || undefined,
     test: {
       taskId: start.taskId,
       testId: status.test && status.test.id,
@@ -6176,7 +6505,9 @@ async function testCommand(flags) {
       unmatchedTestNames: unmatched
     },
     evidenceCategories: testEvidenceCategories(status, names),
-    limitations: unmatched.length ? ['One or more requested test case selectors matched no case.'] : [],
+    limitations: []
+      .concat(unmatched.length ? ['One or more requested test case selectors matched no case.'] : [])
+      .concat(nondeterminism ? [nondeterminism.message] : []),
     rawRefs: { testStatusKey: start.taskId },
     status
   }, { quiet: jsonOutput });
@@ -6564,8 +6895,7 @@ async function toolCommand(flags) {
     console.log('Data mode:', data.dataMode || dataMode);
     if (data.threadGroupingId) console.log('Thread grouping ID:', data.threadGroupingId);
     console.log('Session log:', data.sessionLog);
-    const responseEvidence = fileEvidence(data.responseFile);
-    console.log('Tool response file:', data.responseFile + (responseEvidence.bytes ? ' (' + responseEvidence.bytes + ' bytes, sha256 ' + responseEvidence.sha256.slice(0, 12) + ')' : ''));
+    printToolResponseFileLine('Tool response file', data.responseFile);
     if (polledFailed) {
       console.log('Tool error:', data.toolMessage);
     }
@@ -6636,8 +6966,7 @@ async function toolCommand(flags) {
       console.log('Component:', `${data.componentSource}${sig}`);
     }
     console.log('Session log:', data.sessionLog);
-    const responseEvidence = fileEvidence(data.responseFile);
-    console.log('Tool response file:', data.responseFile + (responseEvidence.bytes ? ' (' + responseEvidence.bytes + ' bytes, sha256 ' + responseEvidence.sha256.slice(0, 12) + ')' : ''));
+    printToolResponseFileLine('Tool response file', data.responseFile);
   }
 
   // Non-zero exit so scripted/agent callers that check status notice the refusal too.
@@ -6661,8 +6990,7 @@ async function toolCommand(flags) {
     evidenceResponseFile = finalStatus.responseFile;
     if (!jsonOutput) {
       console.log('Final status:', finalStatus.data.status);
-      const finalEvidence = fileEvidence(finalStatus.responseFile);
-      console.log('Tool response file:', finalStatus.responseFile + (finalEvidence.bytes ? ' (' + finalEvidence.bytes + ' bytes, sha256 ' + finalEvidence.sha256.slice(0, 12) + ')' : ''));
+      printToolResponseFileLine('Tool response file', finalStatus.responseFile);
     }
     if (finalStatus.data.status !== 'completed') {
       process.exitCode = 1;
@@ -6673,6 +7001,7 @@ async function toolCommand(flags) {
   await appendVerificationPacket(api, cwd, session, accountId, flags, {
     type: 'tool_call',
     success: asyncMode && !waitForAsync ? null : (!toolFailed && (!asyncMode || process.exitCode !== 1)),
+    pending: asyncMode && !waitForAsync,
     claim: 'Tool call ' + String(toolName),
     world: buildCommandWorld(evidenceData, { accountId: evidenceData.accountId || accountId, dataMode: evidenceData.dataMode || dataMode, branchName: evidenceData.branchName || branchName, workspace: resolveWorkspace(cwd, flags), host: normalizeBaseUrl(baseUrl), sourceLayer: evidenceData.componentSource }),
     revision: Object.assign(collectVerificationSource(cwd, flags), {
@@ -6753,6 +7082,12 @@ async function verifyCommand(flags, subcommand) {
     if (flags.manifest || flags.file) {
       manifest = parseManifestFile(flags.manifest || flags.file);
     }
+    if (dataMode === 'prod' && !manifestRequiredEvidence(manifest).length && !flagEnabled(flags['no-contract'])) {
+      console.error('');
+      console.error('Warning: starting a prod-data verification envelope with no required evidence contract.');
+      console.error('Attach a manifest with requiredEvidence before destructive work, or pass --no-contract when this is intentionally evidence-only.');
+      console.error('');
+    }
     let statusResponse = null;
     try {
       statusResponse = await loggedPost(api, cwd, '/cli/components', {
@@ -6788,6 +7123,7 @@ async function verifyCommand(flags, subcommand) {
     console.log('Verification envelope started:', envelope.envelopeId);
     console.log('Target:', 'account=' + accountId + ', branch=' + branchName + ', workspace=' + (workspace || 'shared') + ', dataMode=' + dataMode);
     printAcceptanceWarnings(envelope);
+    printEnvelopeWarnings(envelope);
     console.log('Local mirror:', verificationPaths(cwd, envelope.envelopeId).base);
     return envelope;
   }
@@ -6829,6 +7165,7 @@ async function verifyCommand(flags, subcommand) {
     console.log('Manifest attached to envelope:', envelopeId);
     console.log('Required evidence:', (((response.envelope || {}).acceptance || {}).requiredEvidence || []).length);
     printAcceptanceWarnings(response.envelope);
+    printEnvelopeWarnings(response.envelope);
     return response.envelope;
   }
 
@@ -12521,11 +12858,12 @@ function printComponentsHelp(subcommand) {
     return;
   }
   if (subcommand === 'lanes' || subcommand === 'lane') {
-    console.log('Usage: remits-cli components lanes [--base-url URL] [--account-id ID] [--branch BRANCH] [--workspace NAME] [--json]');
+    console.log('Usage: remits-cli components lanes [--base-url URL] [--account-id ID] [--branch BRANCH] [--workspace NAME] [--wait-change [--lane-id ID] [--timeout 600]] [--json]');
     console.log('');
     console.log('Lists every indexed staging lane on the account, across users, branches, and workspaces.');
     console.log('This is read-only and uses the same lane registry that powers the admin Platforms view.');
     console.log('Use `components entries --lane-id <id>` to inspect the actual staged files in a lane.');
+    console.log('Use --wait-change to wait until the lane registry changes instead of polling in a loop.');
     return;
   }
   if (subcommand === 'entries' || subcommand === 'entry' || subcommand === 'staged') {
@@ -12564,7 +12902,7 @@ function printComponentsHelp(subcommand) {
   console.log('so several agents can iterate at once. See: remits-cli workspace --help');
   console.log('  remits-cli components stage [--workset|--changed-only] [--base-url URL] [--account-id ID] [--branch BRANCH] [--data-mode test|prod] [--json|--verbose]');
   console.log('  remits-cli components status [--base-url URL] [--account-id ID] [--branch BRANCH] [--component-type TYPE --component-id ID] [--json|--verbose]');
-  console.log('  remits-cli components lanes [--base-url URL] [--account-id ID] [--json]');
+  console.log('  remits-cli components lanes [--base-url URL] [--account-id ID] [--wait-change [--lane-id ID] [--timeout 600]] [--json]');
   console.log('  remits-cli components entries --lane-id ID [--base-url URL] [--account-id ID] [--json|--verbose]');
   console.log('  remits-cli components clear [--base-url URL] [--account-id ID] [--branch BRANCH] [--component-type TYPE] [--component-id ID] [--all] [--json|--verbose]');
   console.log('  remits-cli components sync [--safe] [--base-url URL] [--account-id ID] [--branch BRANCH] [--data-mode test|prod] [--force-tombstones] [--dry-run] [--summary]');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remits/remits-cli",
-  "version": "0.1.127",
+  "version": "0.1.128",
   "description": "Local CLI for auth, component sync, and live test execution against Remits",
   "license": "MIT",
   "private": false,

package/skills/remits-cli/references/cli-state.md

@@ -72,6 +72,11 @@ Think about remits-cli as two cooperating layers:
      - where a large tool response was written
      - which tool schemas were most recently cached here
 
+Tool response files under `./.remits-cli/tool-responses/` are the full CLI results. The CLI may print a
+size/hash hint for large files so you can inspect them selectively with `jq`, `rg`, or byte-range reads,
+but it does not truncate the local JSON file. Do not confuse this with the in-platform OpenRouter client,
+which can offload large tool results inside the model conversation and inject a read-back tool for the AI.
+
 When a user asks an indirect question, map it to the right layer first:
 
 - "Why did this ticket open in the wrong repo?" → start in global state.

package/skills/remits-cli/references/command-reference.md

@@ -85,7 +85,10 @@ deterministically:
 remits-cli tool --name "mcp_run_action" --input '{"accountId":49,"actionId":200,"executionMode":"async","actionRunId":"my-stable-run-id","actionInput":{"sourceDocumentId":"..."}}' --data-mode prod
 ```
 
-Every tool response is saved to `./.remits-cli/tool-responses/<callId>.json`.
+Every tool response is saved in full to `./.remits-cli/tool-responses/<callId>.json`. Large responses may
+print an early size/hash line and a selective-read hint before any preview text, but the saved CLI file is
+not truncated or offloaded. That is separate from the platform's OpenRouter model loop, where the AI
+client may offload large tool results before feeding context back to the model.
 
 ### Hierarchy-scoped tool reads
 
@@ -272,7 +275,10 @@ Existing commands also accept `--verify-envelope <id>` to attach to a specific e
 Failed `remits-cli test run` output includes compact pivots per failed case: duration, trace id,
 bounded `report(...)` diagnostics, live HTTP signals, and resolved component provenance when the
 platform returns it. Re-read an existing run with `remits-cli test status --task-id <taskId>` before
-rerunning a long suite.
+rerunning a long suite. If the same suite/case flips pass/fail while the resolved component provenance
+signature is unchanged, the CLI prints a nondeterministic signal and records `nondeterministic:true` on
+the `test_run` packet. Treat that as an AI/live-data/flaky-fixture investigation cue, not as proof that
+source changed.
 
 Test-run requirements must name the suite/cases they mean:
 
@@ -281,23 +287,28 @@ Test-run requirements must name the suite/cases they mean:
 {"id":"one_case", "packetType":"test_run", "suite":"Statement API Flow", "cases":["rejects duplicated fee evidence"]}
 ```
 
-`verify start` and `verify manifest` warn when a requirement has a `packetType` but no discriminator.
-The evaluator treats pending async tool packets as pending, not passing; a later `tool status` packet is
-the proof. Tool packets store the response file path, byte size and hash rather than copying the whole
-tool payload into the envelope.
-
-Use `remits-cli verify list` to review open envelopes for the account without SQL. If a newer envelope
-replaces an older one, use `verify supersede`; if a duplicate or abandoned attempt should no longer read
-as live work, use `verify abandon`. Both keep the evidence history.
+A suite-only Test requirement is treated as `allCases:true`. A category-only Test requirement matches only
+a run carrying that exact evidence category, or the case whose name the category names; unrelated Test
+runs cannot replace it. `verify start` and `verify manifest` warn when a requirement has a `packetType` but
+no discriminator. The evaluator treats pending async tool packets as pending, not passing; a later
+`tool status` packet is the proof. Tool packets store the response file path, byte size and hash rather
+than copying the whole tool payload into the envelope.
+
+Use `remits-cli verify list` to review open envelopes for the account without SQL. The list shows stale
+counts, requirements-changed markers, and last packet time. `verify start` warns when another open envelope
+with the same summary/account/world exists; use `verify use <id>` to continue that contract or
+`verify supersede` when a newer envelope replaces it. If a duplicate or abandoned attempt should no longer
+read as live work, use `verify abandon`. Both keep the evidence history. Starting a prod-data envelope
+without required evidence prints a loud no-contract warning; add a manifest unless the envelope is
+intentionally evidence-only.
 
 The manifest is the proof contract. It should name the world being exercised: repo account, host,
 git/component branch, workspace, data mode, source layer, user journeys, artifacts and hashes, and the
 evidence categories required before the final response may claim the work is done. If the manifest
 cannot be written because the workflow is ambiguous, ask before implementation. For machine-gated report
 requirements, prefer structured entries like `{"id":"actual_upload","packetType":"browser_step",
-"category":"browser_session.actual_upload"}`. Plain strings work when they match a packet type or an
-evidence category, but structured entries are clearer when several agents collect packets for one
-envelope.
+"category":"browser_session.actual_upload"}`. Plain strings work for evidence categories, but do not use
+plain `"test_run"` as acceptance: it cannot say which Test or case proved the behavior.
 
 Common packet meanings:
 
@@ -318,7 +329,13 @@ Final claims should come from `remits-cli verify report`. Treat `Verified` as th
 the report lists it under `Verified`. If the report says `partially_verified`, stale, or missing evidence,
 say that plainly instead of widening the claim. In particular, staged proof is not committed variant/trunk
 proof, a token is not browser proof, and a direct DOM or Alpine state mutation is not the same as a user
-click/upload/reload flow.
+action.
+
+Evidence from the wrong world is excluded before it can satisfy a requirement. When the manifest declares
+fields such as `repoAccountId`, `gitBranch`, `componentBranch`, `workspace`, or `dataMode`, the report names
+the mismatch (`expected X got Y`) under missing evidence. Later stage/sync/source facts can stale earlier
+packets; explicit invalidations stale only packets collected before the invalidation, so a fresh rerun can
+verify the same requirement again.
 
 For tests specifically:
 - If `--data-mode` is omitted, `remits-cli test run` uses `test` and sends `dataModeSource:"cliDefault"`.

package/skills/remits-cli/references/component-resolution.md

@@ -160,7 +160,10 @@ TestMode still uses the committed DB source. Staging remains a dev/verification
 - **Inspect another lane without impersonating it:** `remits-cli components lanes` lists every indexed
   lane on the account; `remits-cli components entries --lane-id <id>` reads the authoritative staged
   files for one lane. These are read-only review surfaces. They do not switch your workspace, clear
-  anything, or change what your own test/token/tool runs resolve.
+  anything, or change what your own test/token/tool runs resolve. Use
+  `remits-cli components lanes --wait-change [--lane-id ID] [--timeout 600]` when you need to wait for a
+  sibling lane to move; it watches the lane registry's `updatedAtMs`/content hash instead of making you
+  poll in a loop.
 - **Clear only your own lane:** `remits-cli components clear` removes entries when you intentionally want
   to fall back to DB source. `--all` is scoped to the command's account/user/branch/workspace lane, not
   every lane another agent may be using.
@@ -209,7 +212,9 @@ commit write `ComponentVariant` overlays for a branch nobody subscribes to).
   account's lane context in their responses. A shared current lane is printed loudly; sibling lanes are
   listed when they matter.
 - `remits-cli components lanes` is the review view across users/branches/workspaces, and
-  `remits-cli components entries --lane-id <id>` is the drill-down into actual staged files.
+  `remits-cli components entries --lane-id <id>` is the drill-down into actual staged files. When you are
+  coordinating with another agent, prefer `components lanes --wait-change --lane-id <id>` to repeated
+  status checks.
 - `remits-cli components clear --all` is scoped to YOUR lane and never touches another agent's.
 - In lane rows, `currentLane` (also `mine`) marks THIS command's lane; `ownedByCaller` marks every lane
   staged by your CLI user — your other clones' agents included.

package/skills/remits-cli/references/development-loop.md

@@ -104,9 +104,13 @@ For Test requirements, be specific enough for the evaluator to know what a pass
 {"id":"duplicate_fee_case", "packetType":"test_run", "suite":"Statement API Flow", "cases":["rejects duplicated fee evidence"]}
 ```
 
-A requirement that says only `{"packetType":"test_run"}` is intentionally only a warning-worthy sketch:
-it will not turn a random Test packet into acceptance. Full-suite runs emit suite and passed-case
-categories automatically, so case-level requirements can be satisfied by a real full run.
+A suite-only Test requirement is treated as `allCases:true`. A category-only Test requirement matches only
+a run carrying that exact evidence category, or the case whose name the category names. A requirement that
+says only `{"packetType":"test_run"}` is intentionally only a warning-worthy sketch: it will not turn a
+random Test packet into acceptance. Full-suite runs emit suite and passed-case categories automatically,
+so case-level requirements can be satisfied by a real full run. The evaluator excludes packets collected
+in the wrong account/data lane/git branch/component branch/workspace before satisfying requirements, and
+pending async packets do not count until a result packet arrives.
 
 ## Development Workflow