@renzrollon/interlock 1.4.1 → 1.5.0

package/lib/run.mjs

@@ -56,7 +56,14 @@ import {
 import { detectUnarchived } from './drift.mjs'
 import { projectSlug } from './project-slug.mjs'
 import { composeCloseMessage, postNtfy, readNotifyConfig } from './notify.mjs'
-import { BANNERS as VERIFY_BANNERS, SKIP_REASONS, foldCheckTimings, planVerification, judgeVerification } from './verify.mjs'
+import {
+  BANNERS as VERIFY_BANNERS,
+  SKIP_REASONS,
+  foldCheckTimings,
+  interWaveVerifyBudget,
+  planVerification,
+  judgeVerification
+} from './verify.mjs'
 import { resolveReview, readReviewPolicy } from './review-core.mjs'
 import { writeReviewMetrics } from './metrics.mjs'
 import { planRemediation } from './remediate.mjs'
@@ -76,7 +83,8 @@ import {
   nextStep,
   planWaves,
   recordBatchResult,
-  recordVerifyResult
+  recordVerifyResult,
+  runRejectedReports
 } from './waves.mjs'
 import {
   assembleCommitPrompt,
@@ -1120,6 +1128,7 @@ const PASS_THROUGH = Object.freeze([
   'batchCount',
   'remainingBatches',
   'previousHandoffs',
+  'previousRejectedReports',
   'changed',
   'mode',
   'runMode',
@@ -1191,6 +1200,9 @@ export function decorate(ctx, step, manifest, extra = {}) {
     // add` itself. Both fold through the same `run record-batch`.
     const driverWorktrees = isolate && hostCapability(manifest, 'worktree') === 'driver'
     const previousHandoffs = Array.isArray(step.previousHandoffs) ? step.previousHandoffs : []
+    const previousRejectedReports = Array.isArray(step.previousRejectedReports)
+      ? step.previousRejectedReports
+      : []
     // The stage line rides on the batch's briefings rather than on a step of its
     // own: the agent doing the work is the one with a filesystem, and a marker
     // written by anyone else would carry the wrong pid.
@@ -1217,6 +1229,7 @@ export function decorate(ctx, step, manifest, extra = {}) {
             change,
             lane,
             previousHandoffs,
+            previousRejectedReports,
             isolateWaves: isolate,
             solo: step.mode === 'solo'
           })
@@ -1338,12 +1351,18 @@ function verifyStep(ctx, manifest, { context, label, changed, carried, action =
     opts.e2e = manifest.flags.skipE2e !== true
     opts.coverage = manifest.flags.skipCoverage !== true
   } else {
-    // The budget's input (`interWaveVerifyBudgetMs`). Accumulated across
-    // invocations on the manifest, because this process runs BETWEEN agent turns
-    // and never sees the interval a verify agent spends; without it the
-    // comparison would be `0 >= budget` forever and the published cap would
-    // bound nothing.
+    // The budget's input: time already spent verifying, compared against the
+    // run's inter-wave budget. Accumulated across invocations on the manifest,
+    // because this process runs BETWEEN agent turns and never sees the interval
+    // a verify agent spends; without it the comparison would be `0 >= budget`
+    // forever and the budget would bound nothing.
     opts.elapsedMs = numberOrUndefined(manifest.verifyElapsedMs) || 0
+    // The budget fixed when the run started (`settleStateHome`), never re-derived
+    // from a profile an agent in the tree may have edited since. A manifest
+    // written before the field existed carries none and gets the published
+    // default, and says nothing about its absence.
+    const fixed = manifest.verifyBudget && manifest.verifyBudget.ms
+    if (Number.isSafeInteger(fixed) && fixed > 0) opts.budgetMs = fixed
   }
   const plan = planVerification(profile, opts)
   writeWork(root, `vplan-${context}.json`, plan)
@@ -1351,6 +1370,32 @@ function verifyStep(ctx, manifest, { context, label, changed, carried, action =
   // cannot tell them apart — so the slate is cleared where the checks are named.
   clearVerifyTimings(root)
 
+  // The one case where the run can name the cause and the remedy: a check was
+  // dropped because the budget ran out while sitting at the published floor,
+  // and it sat there because the profile carried no usable `unit.timeout_ms`.
+  // A budget at the floor because the profile's own allowance is small raises
+  // nothing — that profile had its say. Decided before the branch below, because
+  // a checkpoint cut to typecheck alone is reduced exactly as one cut to nothing
+  // is: a profile with a typecheck command never produces an empty plan, and
+  // would otherwise never be told. Once per run, so the second reduced
+  // checkpoint is not the same line again.
+  let floor = null
+  if (
+    interWave &&
+    plan.budgetExceeded &&
+    plan.skipped.some(s => s && s.reason === SKIP_REASONS.BUDGET_EXCEEDED) &&
+    manifest.verifyBudget &&
+    manifest.verifyBudget.timeoutMs === null &&
+    !manifest.verifyBudgetFloorSpoken
+  ) {
+    floor =
+      'VERIFY BUDGET AT THE PUBLISHED FLOOR: the test profile carries no unit.timeout_ms, so the ' +
+      'inter-wave budget was not raised to fit this suite — run /interlock:fix-tests --reconfigure ' +
+      'to record one'
+    manifest.banners.push(floor)
+    manifest.verifyBudgetFloorSpoken = true
+  }
+
   if (!plan.steps.length) {
     // A spent budget is the reason, not whichever kind happens to sit first in
     // `skipped` — typecheck is skipped for its own missing command and would
@@ -1358,13 +1403,15 @@ function verifyStep(ctx, manifest, { context, label, changed, carried, action =
     const reason = plan.budgetExceeded
       ? SKIP_REASONS.BUDGET_EXCEEDED
       : (plan.skipped[0] && plan.skipped[0].reason) || 'no detectable commands'
+    const banners = [...(carried.banners || []), `VERIFICATION SKIPPED: reason=${reason}`]
+    if (floor) banners.push(floor)
     return makeStep({
       action,
       ...carried,
       context,
       skipped: true,
       reason,
-      banners: [...(carried.banners || []), `VERIFICATION SKIPPED: reason=${reason}`],
+      banners,
       then: { argv: ['run', 'judge', '--context', context] },
       spawns: []
     })
@@ -1378,6 +1425,9 @@ function verifyStep(ctx, manifest, { context, label, changed, carried, action =
   return makeStep({
     action,
     ...carried,
+    // Only when it was raised, so a checkpoint that raised nothing is the step
+    // it always was.
+    ...(floor ? { banners: [...(carried.banners || []), floor] } : {}),
     context,
     skipped: false,
     then: { argv: ['run', 'judge', '--context', context] },
@@ -1456,6 +1506,19 @@ function resolveDimensionRubrics(names) {
   return (Array.isArray(names) ? names : []).map(name => ({ name, rubric: readDimensionRubric(name) }))
 }
 
+/**
+ * The run's rejected handoff reports, for the review briefing. A run with no
+ * readable wave state has recorded none it can name, and the review is briefed
+ * exactly as it was before the list existed.
+ */
+function rejectedReportsOfRun(root) {
+  try {
+    return runRejectedReports(readState(root))
+  } catch {
+    return []
+  }
+}
+
 /**
  * The review step: one worker, every selected dimension fanned out inside it,
  * two skeptics per finding (design D1, D3, D4, D8).
@@ -1485,6 +1548,11 @@ function reviewStep(ctx, manifest, carried = {}) {
   // added dimension can be told apart from one the CLI asked for (design D4).
   manifest.reviewDimensions = { selected: names, reasons }
 
+  // Tasks recorded as done whose handoff packet was rejected. A later wave was
+  // told about its predecessor's; the last wave's had nobody to tell. The review
+  // reads the whole diff, so it is told about every one the run recorded.
+  const rejectedReports = rejectedReportsOfRun(root)
+
   const stageLine = publishStageLine('review', change, ++manifest.stageIndex)
   return makeStep({
     action: 'review',
@@ -1506,6 +1574,7 @@ function reviewStep(ctx, manifest, carried = {}) {
           change,
           dimensions,
           policyProse: policy.prose,
+          rejectedReports,
           findingsPath: FINDINGS_PATH,
           verdictsPath: VERDICTS_PATH,
           stageLine
@@ -1793,6 +1862,15 @@ export function runRemediated(ctx, { round, results, hostRecords }) {
 
 // --- small file helpers -----------------------------------------------------
 
+function readProfileAt(path) {
+  if (typeof path !== 'string' || !path) return null
+  try {
+    return JSON.parse(readFileSync(path, 'utf8'))
+  } catch {
+    return null
+  }
+}
+
 function readProfile(root, manifest) {
   // The path `run start` located, root first and the state home second (design
   // D16), so a worktree run reads the main checkout's profile without copying
@@ -2029,9 +2107,11 @@ function headCommit(ctx) {
 //
 // One authority for "what did this task do": the outcome `record-batch`
 // recorded, not the outcome the implementing agent reported for itself. The
-// claim is the input the state machine adjudicated — an invalid or over-budget
-// handoff packet fails its task — so where the two differ the recorded outcome
-// is the one a tick and a tally are built from.
+// claim is the input the state machine adjudicated — a lane result that omits an
+// outcome fails every task in the lane — so where the two differ the recorded
+// outcome is the one a tick and a tally are built from. (A rejected handoff
+// packet is not such a difference: the task stays done and the rejection travels
+// beside the outcome, as `reportRejected`.)
 //
 // Both hosts read this from one place now. A second copy of "which of two
 // disagreeing observations is the run's" would drift, and both hosts would
@@ -2055,10 +2135,17 @@ export function recordedOutcomes(raw) {
     if (!entry || typeof entry !== 'object') return null
     if (typeof entry.id !== 'string' || !entry.id.trim()) return null
     if (!RECORDED_OUTCOMES.includes(entry.outcome)) return null
+    const rejected =
+      typeof entry.reportRejected === 'string' && entry.reportRejected.trim()
+        ? entry.reportRejected.trim()
+        : null
     out.push({
       id: entry.id.trim(),
       outcome: entry.outcome,
-      reason: typeof entry.reason === 'string' && entry.reason.trim() ? entry.reason.trim() : ''
+      reason: typeof entry.reason === 'string' && entry.reason.trim() ? entry.reason.trim() : '',
+      // A whitelist rebuilds the object, so a field not named here is dropped
+      // without any caller noticing. Only a non-empty string is a rejection.
+      ...(rejected ? { reportRejected: rejected } : {})
     })
   }
   return out
@@ -2085,7 +2172,8 @@ export function adjudicateBatches(batches, recorded) {
       return {
         id: claim.id,
         outcome: found ? found.outcome : claim.ok ? 'ok' : 'failed',
-        reason: found ? found.reason : typeof claim.error === 'string' ? claim.error : ''
+        reason: found ? found.reason : typeof claim.error === 'string' ? claim.error : '',
+        ...(found && found.reportRejected ? { reportRejected: found.reportRejected } : {})
       }
     })
 
@@ -2094,21 +2182,32 @@ export function adjudicateBatches(batches, recorded) {
   return {
     claimDerived: !verdicts,
     tickIds: rows.filter(r => r.outcome === 'ok').map(r => r.id),
-    waves: perBatch.map(batchRows => ({
-      ok: batchRows.filter(r => r.outcome === 'ok').length,
-      failed: batchRows.filter(r => r.outcome === 'failed').length,
-      failedIds: batchRows.filter(r => r.outcome === 'failed').map(r => r.id),
-      recordedNotAttempted: batchRows.filter(r => r.outcome === 'not-attempted').map(r => r.id)
-    })),
+    waves: perBatch.map(batchRows => {
+      const rejectedIds = batchRows.filter(r => r.reportRejected).map(r => r.id)
+      return {
+        ok: batchRows.filter(r => r.outcome === 'ok').length,
+        failed: batchRows.filter(r => r.outcome === 'failed').length,
+        failedIds: batchRows.filter(r => r.outcome === 'failed').map(r => r.id),
+        recordedNotAttempted: batchRows.filter(r => r.outcome === 'not-attempted').map(r => r.id),
+        // Only a batch that held one carries the key, so a clean wave keeps the
+        // shape it always had.
+        ...(rejectedIds.length ? { reportRejected: rejectedIds } : {})
+      }
+    }),
+    // A rejected report is a task that did its work and lost its packet: it is
+    // recorded as done, so claim and record agree and `overrides` is left alone.
+    rejected: rows.filter(r => r.reportRejected).map(r => ({ id: r.id, reason: r.reportRejected })),
     overrides: rows.filter((row, i) => verdicts && (row.outcome === 'ok') !== claims[i].ok)
   }
 }
 
 /**
  * An overridden claim is a finding, not a silent correction. A run that quietly
- * fixed up five bad handoffs is indistinguishable from a clean one; a run that
- * says it overrode five claims tells its reader the implementer prompt or the
- * handoff contract needs attention.
+ * re-recorded five claimed successes is indistinguishable from a clean one; a
+ * run that says it overrode five claims tells its reader the implementer prompt
+ * or the result contract needs attention. A rejected handoff packet is not an
+ * override — claim and record agree there — and has its own banner
+ * (`rejectedBanner`).
  */
 export function overrideBanner(overrides) {
   const detail = overrides
@@ -2132,6 +2231,59 @@ export function claimDerivedBanner() {
   )
 }
 
+/**
+ * Who reads a rejected report next, said in the banner's last clause. A later
+ * wave is briefed with it. The last wave has none, and a banner that claimed
+ * one would be a degradation spoken falsely — so it names what does stand
+ * between that work and the commit instead, or says that nothing does.
+ */
+const REJECTED_REPORT_TOLD = Object.freeze({
+  'next-wave': 'the next wave is told these tasks filed no usable report',
+  review:
+    'no later wave remains to be told, so the review is told instead; final verification still ' +
+    'gates the commit',
+  'final-verify':
+    'no later wave remains to be told, so final verification is the only check on this work',
+  none:
+    'no later wave remains to be told and --apply-only ends the run here, so nothing in this run ' +
+    'checks this work'
+})
+
+/**
+ * Which of those applies to a batch recorded against `state` (the state BEFORE
+ * the batch was recorded, whose cursor still names the batch's own wave).
+ * Earlier batches of the same wave are not told either way: only a later wave is.
+ */
+export function rejectedReportReader(state, flags = {}) {
+  const waveIndex = state && state.cursor ? state.cursor.waveIndex : -1
+  if (state && Array.isArray(state.waves) && state.waves[waveIndex + 1]) return 'next-wave'
+  if (flags.applyOnly === true) return 'none'
+  return flags.review === true ? 'review' : 'final-verify'
+}
+
+/**
+ * A report that could not be used, said out loud once per batch that held any.
+ * The tasks are recorded as done, so the banner is the only place a reader learns
+ * that no packet was kept for them, and who was told so.
+ *
+ * @param {string[]} ids      the batch's rejected task ids
+ * @param {Array<{id: string, reason: string}>} rejected the adjudication's list
+ * @param {keyof typeof REJECTED_REPORT_TOLD} [reader] `rejectedReportReader`'s answer
+ */
+export function rejectedBanner(ids, rejected, reader = 'next-wave') {
+  const detail = ids
+    .map(id => {
+      const found = rejected.find(r => r.id === id)
+      return found && found.reason ? `${id} — ${found.reason}` : id
+    })
+    .join('; ')
+  const told = REJECTED_REPORT_TOLD[reader] || REJECTED_REPORT_TOLD['next-wave']
+  return (
+    `HANDOFF REJECTED: ${detail} — recorded as done and not counted toward the task-failure cap; ` +
+    told
+  )
+}
+
 /**
  * Turn one lane's agent result into an outcome per task it was given.
  *
@@ -2414,6 +2566,11 @@ function settleStateHome(ctx, manifest, given) {
   const profile = locateInput(root, home, TEST_PROFILE_PATH)
   manifest.testProfilePath = profile.path
   manifest.testProfileSource = profile.source
+  // The inter-wave verify budget, fixed here and read from the manifest from now
+  // on (design D16): a profile an agent in the tree rewrites mid-run moves
+  // nothing, in either direction. An unreadable profile derives the published
+  // budget, the same as an absent one.
+  manifest.verifyBudget = interWaveVerifyBudget(readProfileAt(profile.path))
   if (profile.source === 'state-home') banners.push(`TEST PROFILE FROM MAIN CHECKOUT: ${profile.path}`)
   else if (profile.source === 'none') banners.push(VERIFY_BANNERS.noProfile)
 
@@ -3049,6 +3206,17 @@ export function runRecordBatch(ctx, { results, hostRecords }) {
   const verdict = adjudicateBatches([reported], recordedOutcomes(batchOutcomes(state, after)))
   if (verdict.claimDerived) banners.push(claimDerivedBanner())
   if (verdict.overrides.length) banners.push(overrideBanner(verdict.overrides))
+  for (const counts of verdict.waves) {
+    if (counts.reportRejected) {
+      banners.push(
+        rejectedBanner(
+          counts.reportRejected,
+          verdict.rejected,
+          rejectedReportReader(state, manifest.flags)
+        )
+      )
+    }
+  }
 
   // The lane that stopped early, plus anything the recorder found no result for
   // at all. Neither is ticked and neither is a failure. One expression for the
@@ -3065,7 +3233,8 @@ export function runRecordBatch(ctx, { results, hostRecords }) {
       ok: counts.ok,
       failed: counts.failed,
       failedIds: counts.failedIds,
-      notAttempted: notAttemptedOf(counts)
+      notAttempted: notAttemptedOf(counts),
+      ...(counts.reportRejected ? { reportRejected: counts.reportRejected } : {})
     })
   })
 
@@ -3091,10 +3260,12 @@ export function runRecordBatch(ctx, { results, hostRecords }) {
   // What this batch recorded, for the meter's board (design D2): set here, on
   // the step record-batch returns, so no other subcommand can emit it.
   if (recordedStep && typeof recordedStep === 'object') {
+    const rejectedIds = verdict.waves.flatMap(counts => counts.reportRejected || [])
     recordedStep.recorded = {
       ok: verdict.tickIds,
       failed: verdict.waves.flatMap(counts => counts.failedIds),
-      notAttempted: [...new Set(verdict.waves.flatMap(notAttemptedOf))]
+      notAttempted: [...new Set(verdict.waves.flatMap(notAttemptedOf))],
+      ...(rejectedIds.length ? { reportRejected: rejectedIds } : {})
     }
   }
   return finishStep(ctx, manifest, recordedStep)
@@ -3823,7 +3994,9 @@ export async function runClose(
     plan: manifest.plan,
     commit: manifest.commit,
     commitSkipped: manifest.commitSkipped === true,
-    paths: readPathSets(root, manifest)
+    paths: readPathSets(root, manifest),
+    // Absent on a run whose manifest predates the field: stays absent, never zero.
+    ...(manifest.verifyBudget ? { verifyBudget: manifest.verifyBudget } : {})
   }
   // The join's per-wave cache figures, where the host observed none (design D5).
   if (useJoin) summary.spend = fillJoinedCache(summary.spend, joined.cacheByWave)

package/lib/verify.mjs

@@ -87,7 +87,7 @@ export const SKIP_REASONS = {
   NO_COMMAND: 'no-detectable-command',
   /** The failures were already red before this change touched anything. */
   PRE_EXISTING: 'failures-are-pre-existing',
-  /** `LIMITS.interWaveVerifyBudgetMs` spent; only typecheck still runs. */
+  /** The inter-wave verify budget the caller passed is spent; only typecheck still runs. */
   BUDGET_EXCEEDED: 'verify-budget-exceeded',
   /** `e2e.enabled` is false in the profile. */
   E2E_DISABLED: 'e2e-not-enabled',
@@ -180,6 +180,37 @@ function step(kind, command, extra = {}) {
   }
 }
 
+
+/**
+ * The inter-wave verify budget for a run, derived from its test profile.
+ *
+ * `unit.timeout_ms` is the profile's allowance for one suite run; a run may
+ * spend at most `LIMITS.interWaveVerifications` checkpoints, so the allowance
+ * for the checkpoints the cap already permits is their product. The published
+ * `LIMITS.interWaveVerifyBudgetMs` is a floor: a profile can only raise the
+ * budget, never buy less verification with a small timeout. `source` says which
+ * one the budget came from, and `timeoutMs` is the profile's value when it was
+ * usable (null when it was not), so a budget left at the floor because the
+ * profile said nothing reads differently from one left there because the
+ * profile's own allowance is small.
+ *
+ * `planVerification` is deliberately untouched: its callers pass `budgetMs`.
+ *
+ * @param {object|null} profile parsed `.claude/testing/profile.json`, or null
+ * @returns {{ms: number, source: 'profile'|'published', timeoutMs: number|null}}
+ */
+export function interWaveVerifyBudget(profile) {
+  const unit = isObject(profile) && isObject(profile.unit) ? profile.unit : {}
+  const timeoutMs =
+    Number.isSafeInteger(unit.timeout_ms) && unit.timeout_ms > 0 ? unit.timeout_ms : null
+  if (timeoutMs === null) {
+    return { ms: LIMITS.interWaveVerifyBudgetMs, source: 'published', timeoutMs: null }
+  }
+  const derived = Math.min(LIMITS.interWaveVerifications * timeoutMs, Number.MAX_SAFE_INTEGER)
+  if (derived > LIMITS.interWaveVerifyBudgetMs) return { ms: derived, source: 'profile', timeoutMs }
+  return { ms: LIMITS.interWaveVerifyBudgetMs, source: 'published', timeoutMs }
+}
+
 /**
  * Decide which verification commands should run for this change.
  *