@tachikomagundam/abathur 0.2.5 → 0.2.7

package/dist/test/promote.test.js

@@ -11,13 +11,13 @@
 // real seals via todo-3 worktree APIs, commands driven through the real CLI.
 import assert from "node:assert/strict";
 import { spawnSync } from "node:child_process";
-import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync, chmodSync } from "node:fs";
+import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync, chmodSync } from "node:fs";
 import { mkdtemp } from "node:fs/promises";
 import * as os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import test, {} from "node:test";
-import { Ledger } from "../core/ledger.js";
+import { acquireGenomeLock, acquireLock, Ledger } from "../core/ledger.js";
 import { fingerprint, genId } from "../core/ids.js";
 import { newGeneration, openGenome, sealGeneration } from "../core/worktree.js";
 import { manifestPathFor, readManifestFile } from "../core/kernel.js";
@@ -315,6 +315,196 @@ test("tombstone fail-closed + prompt_injection hygiene", async (t) => {
     const tombPromoted = cli(f, "tombstone", "toy-smoke", promoted.genId, "--reason", "too late");
     assert.equal(tombPromoted.status, 1, "promoted gens cannot be tombstoned");
 });
+// -------------------------------------------------------------------- retract
+test("AC(r1): retract undoes a fresh promote — ref deleted, manifest cleared, ledger append-only", async (t) => {
+    const f = await gateFixture(t);
+    const gen = await handSeal(f, "retract-happy", CLEAN_MUTATION, "nominated");
+    assert.equal(cli(f, "promote", "toy-smoke", gen.genId).status, 0);
+    assert.equal(incumbentSha(f), gen.commitSha);
+    const manifestFile = manifestPathFor(f.configDir, f.entry.fingerprint);
+    assert.ok(existsSync(manifestFile), "manifest exists after promote");
+    const before = readFileSync(path.join(f.repo, ".state", "abathur", "ledger.jsonl"), "utf8");
+    const run = cli(f, "retract", "toy-smoke", gen.genId, "--reason", "zero-gain change, human-ordered rollback");
+    assert.equal(run.status, 0, `retract: ${run.stderr}`);
+    assert.equal(incumbentSha(f), null, "incumbent ref deleted");
+    assert.ok(!existsSync(manifestFile), "kernel manifest cleared");
+    const retractRows = rowsOfKind(f, "retract");
+    assert.equal(retractRows.length, 1);
+    const data = retractRows[0]?.data;
+    assert.equal(data.genId, gen.genId);
+    assert.equal(data.retractedTo, gen.commitSha);
+    assert.equal(data.reason, "zero-gain change, human-ordered rollback");
+    assert.equal(rowsOfKind(f, "promote").length, 1, "promote row remains (history never rewritten)");
+    const after = readFileSync(path.join(f.repo, ".state", "abathur", "ledger.jsonl"), "utf8");
+    assert.ok(after.startsWith(before), "ledger stays append-only");
+    const cat = spawnSync("git", ["-C", f.repo, "cat-file", "-e", `${gen.commitSha}^{commit}`], { encoding: "utf8" });
+    assert.equal(cat.status, 0, "candidate commit preserved (retract ≠ delete)");
+    const st = cli(f, "status", "toy-smoke");
+    assert.equal(st.status, 0);
+    assert.match(st.stdout, /incumbent: none/);
+    assert.match(st.stdout, /ref is missing/, "status honestly warns about the retracted target");
+});
+test("retract fail-closed: missing reason, unknown gen, never-promoted, double retract", async (t) => {
+    const f = await gateFixture(t);
+    const gen = await handSeal(f, "retract-guards", CLEAN_MUTATION, "nominated");
+    assert.equal(cli(f, "retract", "toy-smoke", gen.genId).status, 2, "--reason is required");
+    assert.equal(cli(f, "retract", "toy-smoke", "g-nope", "--reason", "x").status, 1);
+    const neverPromoted = cli(f, "retract", "toy-smoke", gen.genId, "--reason", "not promoted yet");
+    assert.equal(neverPromoted.status, 1);
+    assert.match(neverPromoted.stderr + neverPromoted.stdout, /no promote ledger row/);
+    assert.equal(cli(f, "promote", "toy-smoke", gen.genId).status, 0);
+    assert.equal(cli(f, "retract", "toy-smoke", gen.genId, "--reason", "undo").status, 0);
+    const twice = cli(f, "retract", "toy-smoke", gen.genId, "--reason", "again");
+    assert.equal(twice.status, 1);
+    assert.match(twice.stderr + twice.stdout, /already retracted/);
+});
+test("retract LIFO + descendant guard: live descendant blocks, released descendant frees", async (t) => {
+    const f = await gateFixture(t);
+    const genA = await handSeal(f, "retract-A", { file: "units/mul.mjs", append: "\n// A\n" }, "nominated");
+    assert.equal(cli(f, "promote", "toy-smoke", genA.genId).status, 0);
+    // handSeal forks from the repo HEAD, so fast-forward main onto the new
+    // incumbent first — the child must be a descendant of A or its own promote
+    // would hit the not-an-ancestor stale_state guard.
+    git(f, "merge", "--ff-only", "-q", genA.commitSha);
+    const genChild = await handSeal(f, "retract-child", { file: "units/add.mjs", append: "\n// child\n" }, "nominated");
+    const blockedByChild = cli(f, "retract", "toy-smoke", genA.genId, "--reason", "too late");
+    assert.equal(blockedByChild.status, 1);
+    assert.match(blockedByChild.stderr + blockedByChild.stdout, /orphan/);
+    assert.equal(incumbentSha(f), genA.commitSha, "refusal leaves the ref where it was");
+    assert.equal(cli(f, "promote", "toy-smoke", genChild.genId).status, 0);
+    const lifo = cli(f, "retract", "toy-smoke", genA.genId, "--reason", "out of order");
+    assert.equal(lifo.status, 1);
+    assert.match(lifo.stderr + lifo.stdout, /LIFO/);
+    assert.equal(cli(f, "retract", "toy-smoke", genChild.genId, "--reason", "child first").status, 0);
+    assert.equal(incumbentSha(f), null);
+    // child retracted ⇒ its lineage released ⇒ A retracts without a tombstone
+    assert.equal(cli(f, "retract", "toy-smoke", genA.genId, "--reason", "now clear").status, 0);
+    assert.equal(incumbentSha(f), null);
+});
+test("retract ref-absent: sole live promote records refState=absent; two live promotes refuse", async (t) => {
+    const f = await gateFixture(t);
+    const genA = await handSeal(f, "absent-A", CLEAN_MUTATION, "nominated");
+    assert.equal(cli(f, "promote", "toy-smoke", genA.genId).status, 0);
+    // documented manual-rollback shape: ref deleted out-of-band, sole live promote
+    git(f, "update-ref", "-d", `refs/heads/${INCUMBENT_BRANCH}`);
+    const ok = cli(f, "retract", "toy-smoke", genA.genId, "--reason", "manual rollback already done");
+    assert.equal(ok.status, 0, `retract: ${ok.stderr}`);
+    const row = rowsOfKind(f, "retract")[0]?.data;
+    assert.equal(row.refState, "absent", "row honestly marks the ref was already gone");
+});
+test("retract ref-absent with two live promotes refuses (no laundering of divergence)", async (t) => {
+    const f = await gateFixture(t);
+    const genA = await handSeal(f, "absent2-A", { file: "units/mul.mjs", append: "\n// A\n" }, "nominated");
+    assert.equal(cli(f, "promote", "toy-smoke", genA.genId).status, 0);
+    git(f, "merge", "--ff-only", "-q", genA.commitSha);
+    const genB = await handSeal(f, "absent2-B", { file: "units/add.mjs", append: "\n// B\n" }, "nominated");
+    assert.equal(cli(f, "promote", "toy-smoke", genB.genId).status, 0);
+    git(f, "update-ref", "-d", `refs/heads/${INCUMBENT_BRANCH}`); // out-of-band divergence
+    const run = cli(f, "retract", "toy-smoke", genB.genId, "--reason", "try to launder");
+    assert.equal(run.status, 1);
+    assert.match(run.stderr + run.stdout, /cannot verify what the retract undoes/);
+    assert.equal(rowsOfKind(f, "retract").length, 0, "no row written on refusal");
+});
+test("retract refuses while a LINKED worktree has the incumbent branch checked out", async (t) => {
+    const f = await gateFixture(t);
+    const gen = await handSeal(f, "retract-wt", CLEAN_MUTATION, "nominated");
+    assert.equal(cli(f, "promote", "toy-smoke", gen.genId).status, 0);
+    const wt2 = path.join(f.root, "wt2");
+    git(f, "worktree", "add", "-q", wt2, INCUMBENT_BRANCH);
+    const run = cli(f, "retract", "toy-smoke", gen.genId, "--reason", "x");
+    assert.equal(run.status, 1);
+    assert.match(run.stderr + run.stdout, /checked out/);
+    assert.equal(incumbentSha(f), gen.commitSha, "ref untouched while a linked worktree holds the branch");
+});
+test("retract echo hygiene: control bytes never reach stdout or the ledger file", async (t) => {
+    const f = await gateFixture(t);
+    const gen = await handSeal(f, "retract-evil", CLEAN_MUTATION, "nominated");
+    assert.equal(cli(f, "promote", "toy-smoke", gen.genId).status, 0);
+    const evil = cli(f, "retract", "toy-smoke", gen.genId, "--reason", "evil\n\u001b[31mred\u001b[0m reason");
+    assert.equal(evil.status, 0, `evil reason: ${evil.stderr}`);
+    assert.ok(!evil.stdout.includes("\u001b"), "raw ANSI never reaches stdout");
+    const raw = readFileSync(path.join(f.repo, ".state", "abathur", "ledger.jsonl"), "utf8");
+    assert.ok(!raw.includes("\u001b"), "no raw ESC byte in ledger text");
+    const stored = rowsOfKind(f, "retract")[0]?.data;
+    assert.equal(stored.reason, "evil\n\u001b[31mred\u001b[0m reason", "ledger stores verbatim (JSON-escaped on disk)");
+});
+test("gate locks: a live genome-lock holder blocks promote with a named pid (exit 2)", async (t) => {
+    const f = await gateFixture(t);
+    const gen = await handSeal(f, "lock-holder", CLEAN_MUTATION, "nominated");
+    const lease = acquireGenomeLock({ ledger: Ledger.open(f.repo), configDir: f.configDir, genomeFp: f.entry.fingerprint });
+    t.after(() => lease.release());
+    const run = cli(f, "promote", "toy-smoke", gen.genId);
+    assert.equal(run.status, 2, `promote while locked: ${run.stderr}`);
+    assert.match(run.stderr + run.stdout, /held by live pid/);
+    assert.equal(incumbentSha(f), null, "no ref movement while locked out");
+});
+test("gate locks: the repo-scoped gate lock contends across config homes", async (t) => {
+    const f = await gateFixture(t);
+    const gen = await handSeal(f, "repo-lock", CLEAN_MUTATION, "nominated");
+    assert.equal(cli(f, "promote", "toy-smoke", gen.genId).status, 0);
+    // a second config home registering the SAME repo (different genome lock, same gate lock)
+    const configDir2 = path.join(f.root, "config2");
+    mkdirSync(configDir2, { recursive: true });
+    writeFileSync(path.join(configDir2, "config.jsonc"), '{ "opencodeBin": null }\n', "utf8");
+    const doc = JSON.parse(readFileSync(path.join(f.repo, "genome.jsonc"), "utf8"));
+    doc["label"] = "toy-smoke";
+    const spec2 = path.join(f.root, "private2.jsonc");
+    writeFileSync(spec2, `${JSON.stringify(doc, null, 2)}\n`, "utf8");
+    registerGenome(configDir2, spec2);
+    const repoLease = acquireLock({ configDir: path.join(f.repo, ".state", "abathur"), key: "gate", label: "gate lock" });
+    t.after(() => repoLease.release());
+    const run = spawnSync(process.execPath, [CLI, "retract", "toy-smoke", gen.genId, "--reason", "x"], {
+        env: { ...process.env, ABATHUR_CONFIG: path.join(configDir2, "config.jsonc"), HOME: path.join(f.root, "home") },
+        encoding: "utf8",
+        cwd: f.root,
+    });
+    assert.equal(run.status, 2, `retract via second config while gate-locked: ${run.stderr}`);
+    assert.match(run.stderr + run.stdout, /gate lock 'gate' is held by live pid/);
+    assert.equal(incumbentSha(f), gen.commitSha, "ref untouched while gate-locked");
+    assert.equal(rowsOfKind(f, "retract").length, 0, "no row appended by the locked-out process");
+});
+test("retract refuses when the incumbent ref moved out-of-band after the promote", async (t) => {
+    const f = await gateFixture(t);
+    const gen = await handSeal(f, "diverge", CLEAN_MUTATION, "nominated");
+    assert.equal(cli(f, "promote", "toy-smoke", gen.genId).status, 0);
+    git(f, "update-ref", `refs/heads/${INCUMBENT_BRANCH}`, gen.parent); // rewind out-of-band
+    const run = cli(f, "retract", "toy-smoke", gen.genId, "--reason", "x");
+    assert.equal(run.status, 1);
+    assert.match(run.stderr + run.stdout, /state diverged/);
+    assert.equal(incumbentSha(f), gen.parent, "the moved ref is NOT deleted");
+});
+test("promote after retract refuses — a retracted gen stays dead (no re-promote lockup)", async (t) => {
+    const f = await gateFixture(t);
+    const gen = await handSeal(f, "re-promote", CLEAN_MUTATION, "nominated");
+    assert.equal(cli(f, "promote", "toy-smoke", gen.genId).status, 0);
+    assert.equal(cli(f, "retract", "toy-smoke", gen.genId, "--reason", "undo").status, 0);
+    const again = cli(f, "promote", "toy-smoke", gen.genId);
+    assert.equal(again.status, 1);
+    assert.match(again.stderr + again.stdout, /already promoted/);
+});
+test("retract: a PRUNABLE worktree (deleted directory) does not block the rollback valve", async (t) => {
+    const f = await gateFixture(t);
+    const gen = await handSeal(f, "retract-prunable", CLEAN_MUTATION, "nominated");
+    assert.equal(cli(f, "promote", "toy-smoke", gen.genId).status, 0);
+    const wt2 = path.join(f.root, "wt-stale");
+    git(f, "worktree", "add", "-q", wt2, INCUMBENT_BRANCH);
+    rmSync(wt2, { recursive: true, force: true }); // directory gone, metadata stale ⇒ porcelain marks it prunable
+    const list = spawnSync("git", ["-C", f.repo, "worktree", "list", "--porcelain"], { encoding: "utf8" });
+    assert.match(list.stdout, /prunable/, "fixture sanity: git itself marks the stale worktree prunable");
+    const run = cli(f, "retract", "toy-smoke", gen.genId, "--reason", "stale worktree must not block");
+    assert.equal(run.status, 0, `retract: ${run.stderr}`);
+    assert.equal(incumbentSha(f), null);
+});
+test("retract refuses while the incumbent branch is checked out", async (t) => {
+    const f = await gateFixture(t);
+    const gen = await handSeal(f, "retract-checkout", CLEAN_MUTATION, "nominated");
+    assert.equal(cli(f, "promote", "toy-smoke", gen.genId).status, 0);
+    git(f, "checkout", "-q", INCUMBENT_BRANCH);
+    const run = cli(f, "retract", "toy-smoke", gen.genId, "--reason", "x");
+    assert.equal(run.status, 1);
+    assert.match(run.stderr + run.stdout, /checked out/i);
+    assert.equal(incumbentSha(f), gen.commitSha, "ref untouched while checked out");
+});
 // -------------------------------------------------------------------- status
 test("AC(d): status renders incumbent, generations, quarantine depth, budget; never fabricates", async (t) => {
     const f = await gateFixture(t);
@@ -368,7 +558,7 @@ test("genome rm: ledgerless genomes unregister (manifest stays), ledger history
     assert.equal(empty.status, 0, "no ledger rows ⇒ still removable");
 });
 // -------------------------------------------------------------- structural
-test("structural: promote core is CLI-only; no auto-promote import path; no --force anywhere", () => {
+test("structural: promote/retract cores are CLI-only; no auto-gate import path; no --force anywhere", () => {
     const importers = [];
     const scan = (dir) => {
         for (const ent of readdirSync(dir, { withFileTypes: true })) {
@@ -386,9 +576,36 @@ test("structural: promote core is CLI-only; no auto-promote import path; no --fo
     scan(path.join(REPO_ROOT, "src"));
     const relative = importers.map((p) => path.relative(REPO_ROOT, p).split(path.sep).join("/")).sort();
     assert.deepEqual(relative, ["src/commands/promote.ts"], "core/promote imported ONLY by commands/promote");
+    const retractImporters = [];
+    const scanRetract = (dir) => {
+        for (const ent of readdirSync(dir, { withFileTypes: true })) {
+            const p = path.join(dir, ent.name);
+            if (ent.isDirectory()) {
+                if (ent.name !== "node_modules")
+                    scanRetract(p);
+            }
+            else if (ent.name.endsWith(".ts")) {
+                const src = readFileSync(p, "utf8");
+                if (/(?:from\s+|import\(\s*)["'](?:[^"']*\/)?core\/retract\.js["']|from\s+["']\.\/retract\.js["']/.test(src))
+                    retractImporters.push(p);
+            }
+        }
+    };
+    scanRetract(path.join(REPO_ROOT, "src"));
+    const relRetract = retractImporters.map((p) => path.relative(REPO_ROOT, p).split(path.sep).join("/")).sort();
+    assert.deepEqual(relRetract, ["src/commands/retract.ts"], "core/retract imported ONLY by commands/retract");
     for (const rel of ["src/core/evolve/run-loop.ts", "src/core/evolve/reflect.ts", "src/core/evolve/candidate.ts"]) {
         assert.doesNotMatch(readFileSync(path.join(REPO_ROOT, rel), "utf8"), /from\s+"[^"]*promote\.js"/, `${rel} must not import promote`);
+        assert.doesNotMatch(readFileSync(path.join(REPO_ROOT, rel), "utf8"), /from\s+"[^"]*retract\.js"/, `${rel} must not import retract`);
+    }
+    for (const gateFile of ["src/core/promote.ts", "src/core/retract.ts"]) {
+        assert.doesNotMatch(readFileSync(path.join(REPO_ROOT, gateFile), "utf8"), /--force/, `no force flag in ${gateFile}`);
+    }
+    // the plugin tool allowlist must never grow a human gate (terminal-only class)
+    const pluginSrc = readFileSync(path.join(REPO_ROOT, "plugin", "abathur.ts"), "utf8");
+    const allowBlock = pluginSrc.match(/const ALLOWED_COMMANDS[\s\S]*?;/)?.[0] ?? "";
+    assert.ok(allowBlock.length > 0, "ALLOWED_COMMANDS block must be found — a vacuous match tests nothing");
+    for (const gate of ['"promote"', '"tombstone"', '"retract"']) {
+        assert.ok(!allowBlock.includes(gate), `${gate} must NOT be plugin-reachable`);
     }
-    const gate = readFileSync(path.join(REPO_ROOT, "src/core/promote.ts"), "utf8");
-    assert.doesNotMatch(gate, /--force/, "no force flag in the gate");
 });

package/dist/test/readjudicate.test.js

@@ -0,0 +1,212 @@
+// re-adjudicate (core) tests. The mechanism under test: replay the CURRENT gate over
+// archived generation rows and append a corrected verdict with provenance, files immutable.
+//
+// Coverage: verdict flip culled->nominated (synthetic), honest no-flip (culled stays
+// culled), idempotence after append, promote-row refusal, missing-incumbent refusal,
+// corrupt-archive notice (never a crash), and the historical anchor: a sandboxed COPY of
+// the real historian archives must reproduce the c17 re-adjudication (NOMINATED,
+// gain 0.2917) that the driver computed offline on 2026-09-26 — the engine's own replay
+// of the incident that born this command.
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync, copyFileSync } from "node:fs";
+import { mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { readjudicateGeneration } from "../core/readjudicate.js";
+import { ledgerRecordSchema, LEDGER_KIND_GENERATION_COMPLETE, LEDGER_KIND_PROMOTE } from "../core/ledger.js";
+import { decodeGenerationRecord } from "../core/evolve/run-rows.js";
+const STATS = { halfWidth: 0.15, minEffect: 0.1, nReps: { initial: 2, max: 3 } };
+const BUDGET = { maxCandidates: 1, maxModelCalls: 96, maxTokens: 25_000_000, maxWallS: 26_000 };
+function entryFor(repo) {
+    return {
+        fingerprint: "f".repeat(16),
+        label: "test-genome",
+        registryFile: "/dev/null",
+        storedText: "",
+        spec: {
+            label: "test-genome",
+            repoPath: repo,
+            bench: {
+                type: "opencode-fixture-scenarios",
+                units: [
+                    { id: "scenario-19", split: "train", path: "scenarios/19.md" },
+                    { id: "scenario-13", split: "val", path: "scenarios/13.md" },
+                ],
+                runCommand: "true",
+                graderCommand: "true",
+                timeoutS: 1800,
+                stats: STATS,
+            },
+            budget: BUDGET,
+            kernel: { immutableGlobs: ["scenarios/**"] },
+        },
+    };
+}
+function row(o) {
+    const data = {
+        source: o.source,
+        headCommit: "1".repeat(40),
+        complete: true,
+        reps: o.units[0]?.scores.length ?? 0,
+        units: o.units.map((u) => ({ unitId: u.unitId, split: u.split, scores: u.scores, runIds: u.scores.map((_, i) => `r-${u.unitId}-${String(i)}`), failures: u.scores.filter((s) => s < 1).map((s) => `${u.unitId}: scored ${String(s)}`) })),
+        counters: { candidates: o.source === "candidate" ? 1 : 0, modelCalls: 10, tokens: 1000, wallS: 100 },
+        manifest: [],
+        benchProvenance: { benchType: "opencode-fixture-scenarios", versions: [{ bin: "opencode", version: "test" }] },
+    };
+    if (o.source === "candidate") {
+        data.candidateId = "mutate-live";
+        data.commitSha = "2".repeat(40);
+        data.treeSha = o.treeSha ?? "3".repeat(64);
+    }
+    if (o.verdict !== undefined)
+        data.verdict = o.verdict;
+    if (o.gain !== undefined)
+        data.gain = o.gain;
+    return `${JSON.stringify({ v: 1, ts: o.ts, kind: LEDGER_KIND_GENERATION_COMPLETE, genId: o.genId, runId: o.runId, data })}\n`;
+}
+function sandbox(t) {
+    const dir = mkdtempSync(path.join(tmpdir(), "readjud-"));
+    const state = path.join(dir, ".state", "abathur");
+    mkdirSync(state, { recursive: true });
+    writeFileSync(path.join(state, "ledger.jsonl"), "");
+    t.after(() => rmSync(dir, { recursive: true, force: true }));
+    return { dir, state };
+}
+function cfg(t) {
+    const d = mkdtempSync(path.join(tmpdir(), "readjud-cfg-"));
+    t.after(() => rmSync(d, { recursive: true, force: true }));
+    return d;
+}
+function lastRows(stateDir) {
+    return readFileSync(path.join(stateDir, "ledger.jsonl"), "utf8")
+        .split("\n")
+        .filter((l) => l.trim().length > 0)
+        .map((l) => {
+        const parsed = ledgerRecordSchema.parse(JSON.parse(l));
+        return parsed;
+    })
+        .filter((r) => r.kind === LEDGER_KIND_GENERATION_COMPLETE)
+        .map((r) => {
+        try {
+            return decodeGenerationRecord(r);
+        }
+        catch {
+            return null;
+        }
+    })
+        .filter((d) => d !== null);
+}
+test("flip: culled row re-judged nominated by the current gate; corrected row appended with provenance", (t) => {
+    const { dir, state } = sandbox(t);
+    // one rotated archive with the whole epoch (activation law: bank needs an archive)
+    const lines = [
+        // historical incumbent groups that price a small-ish sigma on both units
+        row({ genId: "g-old-a", runId: "r-old", ts: "2026-09-20T00:00:00.000Z", source: "incumbent", units: [{ unitId: "scenario-19", split: "train", scores: [0.875, 1, 0.875, 1] }, { unitId: "scenario-13", split: "val", scores: [1, 1, 1, 1] }] }),
+        // the epoch under re-adjudication
+        row({ genId: "g-epoch", runId: "run-1", ts: "2026-09-21T00:00:00.000Z", source: "incumbent", units: [{ unitId: "scenario-19", split: "train", scores: [0.75, 0.875] }, { unitId: "scenario-13", split: "val", scores: [1, 1] }], verdict: undefined }),
+        row({ genId: "g-epoch-cand", runId: "run-1", ts: "2026-09-21T01:00:00.000Z", source: "candidate", units: [{ unitId: "scenario-19", split: "train", scores: [1, 1] }, { unitId: "scenario-13", split: "val", scores: [1, 1] }], verdict: "culled", gain: 0.1 }),
+    ];
+    writeFileSync(path.join(state, "ledger.campaign1-2026-09-21.jsonl"), lines.join(""));
+    const out = readjudicateGeneration({ entry: entryFor(dir), configDir: cfg(t), genId: "g-epoch-cand", now: () => new Date("2026-09-22T00:00:00Z") });
+    assert.equal(out.appended, true, out.lines.join("\n"));
+    assert.equal(out.verdict, "nominated", out.lines.join("\n"));
+    const appended = lastRows(state).at(-1);
+    assert.ok(appended !== undefined);
+    assert.equal(appended.verdict, "nominated");
+    assert.ok(appended.readjudication !== undefined, "provenance must be present");
+    assert.equal(appended.readjudication.replacedVerdict, "culled");
+    assert.equal(appended.readjudication.gate, "acceptance");
+    assert.equal(appended.readjudication.sourceRows.candidate.file, "ledger.campaign1-2026-09-21.jsonl");
+    // archive untouched: still exactly 3 rows, original culled row intact
+    assert.equal(readFileSync(path.join(state, "ledger.campaign1-2026-09-21.jsonl"), "utf8").trim().split("\n").length, 3);
+    // idempotence: second pass sees the corrected last row -> no-op
+    const again = readjudicateGeneration({ entry: entryFor(dir), configDir: cfg(t), genId: "g-epoch-cand", now: () => new Date("2026-09-22T00:00:00Z") });
+    assert.equal(again.appended, false, again.lines.join("\n"));
+    assert.match(again.lines.join("\n"), /no-op/);
+});
+test("honest replay: a weak candidate stays culled — the tool re-judges, it never flips", (t) => {
+    const { dir, state } = sandbox(t);
+    const lines = [
+        row({ genId: "g-old-a", runId: "r-old", ts: "2026-09-20T00:00:00.000Z", source: "incumbent", units: [{ unitId: "scenario-19", split: "train", scores: [1, 1, 1, 1] }, { unitId: "scenario-13", split: "val", scores: [1, 1, 1, 1] }] }),
+        row({ genId: "g-epoch", runId: "run-1", ts: "2026-09-21T00:00:00.000Z", source: "incumbent", units: [{ unitId: "scenario-19", split: "train", scores: [1, 1] }, { unitId: "scenario-13", split: "val", scores: [1, 1] }] }),
+        row({ genId: "g-epoch-cand", runId: "run-1", ts: "2026-09-21T01:00:00.000Z", source: "candidate", units: [{ unitId: "scenario-19", split: "train", scores: [1, 1] }, { unitId: "scenario-13", split: "val", scores: [1, 1] }], verdict: "culled", gain: 0 }),
+    ];
+    writeFileSync(path.join(state, "ledger.campaign1-2026-09-21.jsonl"), lines.join(""));
+    const out = readjudicateGeneration({ entry: entryFor(dir), configDir: cfg(t), genId: "g-epoch-cand", now: () => new Date() });
+    assert.equal(out.verdict, "culled", out.lines.join("\n"));
+    assert.equal(out.appended, false, "already-agreeing row must not append");
+});
+test("refusals: promoted gen, missing incumbent, unknown gen — all block before any append", (t) => {
+    const { dir, state } = sandbox(t);
+    const epoch = [
+        row({ genId: "g-epoch", runId: "run-9", ts: "2026-09-21T00:00:00.000Z", source: "incumbent", units: [{ unitId: "scenario-19", split: "train", scores: [0.75, 1] }, { unitId: "scenario-13", split: "val", scores: [1, 1] }] }),
+        row({ genId: "g-epoch-cand", runId: "run-9", ts: "2026-09-21T01:00:00.000Z", source: "candidate", units: [{ unitId: "scenario-19", split: "train", scores: [1, 1] }, { unitId: "scenario-13", split: "val", scores: [1, 1] }], verdict: "culled", gain: 0.1 }),
+    ];
+    writeFileSync(path.join(state, "ledger.campaign1-2026-09-21.jsonl"), epoch.join(""));
+    // promoted epoch is untouchable
+    const promotedRun = "run-p";
+    writeFileSync(path.join(state, "ledger.campaign2-2026-09-22.jsonl"), epoch.join("") + `${JSON.stringify({ v: 1, ts: "2026-09-22T00:00:00.000Z", kind: LEDGER_KIND_PROMOTE, genId: "g-epoch-cand", runId: promotedRun, data: { actor: "cli", genId: "g-epoch-cand", from: null, to: "2".repeat(40) } })}\n`);
+    assert.throws(() => readjudicateGeneration({ entry: entryFor(dir), configDir: cfg(t), genId: "g-epoch-cand", now: () => new Date() }), (e) => /already promoted/.test(String(e.message ?? e)));
+    // unknown gen
+    assert.throws(() => readjudicateGeneration({ entry: entryFor(dir), configDir: cfg(t), genId: "g-nope", now: () => new Date() }), (e) => /no candidate generation_complete row/.test(String(e.message ?? e)));
+    // candidate without its incumbent: run-1 incumbent exists here, so cut a state with candidate only
+    const { dir: d2, state: s2 } = sandbox(t);
+    writeFileSync(path.join(s2, "ledger.campaign1-2026-09-21.jsonl"), row({ genId: "g-solo", runId: "run-s", ts: "2026-09-21T01:00:00.000Z", source: "candidate", units: [{ unitId: "scenario-19", split: "train", scores: [1, 1] }, { unitId: "scenario-13", split: "val", scores: [1, 1] }], verdict: "culled", gain: 0.1 }));
+    assert.throws(() => readjudicateGeneration({ entry: entryFor(d2), configDir: cfg(t), genId: "g-solo", now: () => new Date() }), (e) => /no incumbent baseline row/.test(String(e.message ?? e)));
+});
+test("corrupt archive lines are notices, never a crash, and never poison the replay", (t) => {
+    const { dir, state } = sandbox(t);
+    const good = [
+        row({ genId: "g-old-a", runId: "r-old", ts: "2026-09-20T00:00:00.000Z", source: "incumbent", units: [{ unitId: "scenario-19", split: "train", scores: [0.875, 1, 0.875, 1] }, { unitId: "scenario-13", split: "val", scores: [1, 1, 1, 1] }] }),
+        row({ genId: "g-epoch", runId: "run-1", ts: "2026-09-21T00:00:00.000Z", source: "incumbent", units: [{ unitId: "scenario-19", split: "train", scores: [0.75, 0.875] }, { unitId: "scenario-13", split: "val", scores: [1, 1] }] }),
+        row({ genId: "g-epoch-cand", runId: "run-1", ts: "2026-09-21T01:00:00.000Z", source: "candidate", units: [{ unitId: "scenario-19", split: "train", scores: [1, 1] }, { unitId: "scenario-13", split: "val", scores: [1, 1] }], verdict: "culled", gain: 0.1 }),
+    ];
+    writeFileSync(path.join(state, "ledger.campaign1-2026-09-21.jsonl"), `not json at all\n${good.join("")}{"v":9,"kind":"broken-schema"}\n`);
+    const out = readjudicateGeneration({ entry: entryFor(dir), configDir: cfg(t), genId: "g-epoch-cand", now: () => new Date("2026-09-22T00:00:00Z") });
+    assert.equal(out.verdict, "nominated", out.lines.join("\n"));
+    assert.ok(out.lines.some((l) => l.includes("not JSON")), "skip notice must surface");
+});
+// ------------------------------------------------------------------ historical anchor
+// The incident replay: c17's real rows, judged first by the silently-downgraded engine
+// (culled), then re-adjudicated offline to NOMINATED gain 0.2917 (start-work L141).
+// A sandboxed copy of the real archives run through this command must reproduce that
+// verdict with the same numbers — the engine re-judging its own history correctly.
+// Skips (never fails) when the historian state files are absent (CI elsewhere).
+test("anchor: real c17 archives replay to NOMINATED 0.2917 (copy, no mutation)", (t) => {
+    // located via env, never a hardcoded homedir (release hygiene); skipped wherever the
+    // historian repo is not wired — this anchor guards the OPERATOR's machine, CI has no history.
+    const hist = process.env["ABATHUR_HISTORIAN_REPO"];
+    if (hist === undefined || hist.length === 0) {
+        t.skip("ABATHUR_HISTORIAN_REPO unset — anchor needs the real archives");
+        return;
+    }
+    const real = path.join(hist, ".state", "abathur");
+    let names;
+    try {
+        names = readdirSync(real);
+    }
+    catch {
+        t.skip("historian .state/abathur not present on this machine");
+        return;
+    }
+    const archives = names.filter((n) => n.startsWith("ledger.") && n.endsWith(".jsonl"));
+    if (!archives.some((n) => n.includes("campaign17"))) {
+        t.skip("campaign17 archive not present");
+        return;
+    }
+    const { dir, state } = sandbox(t);
+    for (const n of archives)
+        copyFileSync(path.join(real, n), path.join(state, n));
+    writeFileSync(path.join(state, "ledger.jsonl"), ""); // copy of live would carry future rows — start empty
+    // spec: mirror the historian constitution's anchors exactly (stats/budget as registered)
+    const spec = entryFor(dir);
+    spec.spec.bench.stats = STATS;
+    const out = readjudicateGeneration({ entry: spec, configDir: cfg(t), genId: "g-20260925T150918Z-9969e4b6", now: () => new Date("2026-09-28T00:00:00Z") });
+    assert.equal(out.verdict, "nominated", out.lines.join("\n"));
+    const appended = lastRows(state).at(-1);
+    assert.ok(appended?.readjudication !== undefined);
+    assert.ok(Math.abs((appended.gain ?? 0) - 0.2916666666666667) < 1e-9, `gain ${String(appended.gain)} must match the offline replay 0.2917`);
+    assert.equal(appended.readjudication.replacedVerdict, "culled");
+    assert.equal(appended.readjudication.sourceRows.candidate.file, "ledger.campaign17-2026-09-25.jsonl");
+});

package/dist/test/reflect.test.js

@@ -130,7 +130,7 @@ async function sessionFixture(t) {
     // plant the canary in the VAL unit and commit it, so it rides into worktrees
     const sub = path.join(repo, "units", "sub.mjs");
     writeFileSync(sub, `${readFileSync(sub, "utf8")}\n// ${CANARY}\n`, "utf8");
-    await gitIn(repo, "-c", "user.name=abathur", "-c", "user.email=abathur@harness.local", "commit", "-aqm", "plant val canary");
+    await gitIn(repo, "-c", "user.name=abathur", "-c", "user.email=agent@host.example", "commit", "-aqm", "plant val canary");
     const spec = loadGenomeSpecFile(path.join(repo, "genome.jsonc"));
     const env = {
         XDG_CACHE_HOME: path.join(root, "xdg-cache"),

package/dist/test/repopath-seams.test.js

@@ -0,0 +1,55 @@
+// Tripwire (postmortem 863e6c2): the env-literal repoPath defect class was
+// caused by per-call-site resolution being a CONVENTION — every new FS
+// consumer had to remember to call effectiveRepoPath, and promote/tombstone
+// forgot for 18 days. This test makes the convention mechanical: any line
+// on the command/human-gate surface that touches `spec.repoPath` must either
+// resolve it through effectiveRepoPath(...) on the same line, or carry an
+// inline waiver comment `raw-repoPath: <reason>` documenting WHY the raw
+// stored form is correct there (display strings, self-mode literal
+// detection, post-swap pipeline paths). A new command that forgets now
+// fails CI instead of failing a human gate 18 days later.
+//
+// Scope note: engine-internal pipeline modules (src/core/evolve/**,
+// src/core/graft*.ts, src/core/bundle-*.ts, src/bench/**) operate on
+// candidate-worktree-swapped absolute paths by design (run-loop.ts swaps
+// spec.repoPath before invoking them) and are out of scope here; the ledger
+// FS seam additionally resolves unconditionally in ledgerPath().
+import assert from "node:assert/strict";
+import { readdirSync, readFileSync, statSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { test } from "node:test";
+// dist/test/*.js -> repo src/ (tests run from the built tree but guard SOURCE).
+const SRC = fileURLToPath(new URL("../../src/", import.meta.url));
+const GUARDED_FILES = [
+    ...readdirSync(path.join(SRC, "commands"))
+        .filter((f) => f.endsWith(".ts"))
+        .map((f) => path.join(SRC, "commands", f)),
+    path.join(SRC, "core", "promote.ts"),
+    path.join(SRC, "core", "tombstone.ts"),
+    path.join(SRC, "core", "retract.ts"),
+];
+function collectHits(file) {
+    const hits = [];
+    const lines = readFileSync(file, "utf8").split("\n");
+    lines.forEach((line, i) => {
+        if (!line.includes("spec.repoPath"))
+            return;
+        if (line.includes("effectiveRepoPath("))
+            return;
+        if (line.includes("raw-repoPath:"))
+            return;
+        hits.push(`${path.relative(SRC, file)}:${String(i + 1)}: ${line.trim()}`);
+    });
+    return hits;
+}
+test("command/gate surface: every spec.repoPath use resolves via effectiveRepoPath or waives in writing", () => {
+    const violations = [];
+    for (const file of GUARDED_FILES) {
+        if (!statSync(file, { throwIfNoEntry: false }))
+            continue;
+        violations.push(...collectHits(file));
+    }
+    assert.deepEqual(violations, [], "raw spec.repoPath uses without effectiveRepoPath() or a `raw-repoPath:` waiver:\n" +
+        violations.join("\n"));
+});