@telora/daemon 0.22.245 → 0.22.290

package/dist/verify/attribution/misattributed-commits.js

@@ -0,0 +1,123 @@
+// PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)
+// Pinned by: packages/daemon/src/verify/attribution/misattributed-commits.test.ts
+// PINNED-BY-END
+/**
+ * Commits in a focus's recorded batches that may hold a held delivery's work
+ * without being attributed to it.
+ *
+ * Verify judges a delivery on its OWN commits: those whose Telora-Delivery
+ * trailer names it. A commit trailered `none` (housekeeping), `unattributed` (a
+ * daemon capture whose delivery was unknown) or not trailered at all belongs to
+ * no delivery's evidence. When such a commit holds a delivery's implementation,
+ * verify reports "the diff lacks the work" on every pass while the work sits one
+ * commit away. This module finds those commits so a shortfall hold can name
+ * them, making misattributed work distinguishable from missing work.
+ *
+ * Scope -- "the files a held node concerns" -- is the union of the shortfall's
+ * cited diff file, the delivery's issues' completion-artifact files and tests,
+ * and its Context Groups' relevantFiles. When none of those name a file the
+ * scope is `unscoped` and every candidate commit is named, labelled unscoped --
+ * never silently nothing. An unattributed capture is named whatever it touches:
+ * it is delivery work by declaration.
+ *
+ * History: docs/daemon/history-verify.md (verify/attribution/misattributed-commits.ts).
+ */
+import { runGitSync } from '../../git/index.js';
+import { classifyTrailerValue, DELIVERY_TRAILER_KEY } from '../../git/delivery-trailer.js';
+import { compilePathPattern } from '../../worktree/capture-attribution.js';
+import { completionFilesOf } from '../../worktree/capture-attribution-read.js';
+/** Bound on commits named, and files listed per commit, in a hold. */
+const MAX_NAMED_COMMITS = 20;
+const MAX_FILES_PER_COMMIT = 10;
+/** Commits per `git show` invocation when reading the batch. */
+const READ_CHUNK = 100;
+const FIELD = '\x1f';
+const RECORD = '\x1e';
+/**
+ * Read and classify every distinct commit in the focus's recorded batches. A
+ * commit git cannot read is skipped. `overrides` (sha -> delivery id) replaces a
+ * commit's trailer classification with a delivery attribution.
+ */
+export function readFocusCommitRecords(cwd, batches, overrides = new Map()) {
+    const shas = [...new Set(batches.flatMap((b) => b ?? []).map((s) => s.trim()).filter((s) => /^[0-9a-f]{7,64}$/i.test(s)))];
+    const records = [];
+    for (let i = 0; i < shas.length; i += READ_CHUNK) {
+        const chunk = shas.slice(i, i + READ_CHUNK);
+        const res = runGitSync(['show', '-s', '--ignore-missing',
+            `--format=%H${FIELD}%P${FIELD}%s${FIELD}%(trailers:key=${DELIVERY_TRAILER_KEY},valueonly,separator=%x2c)${RECORD}`,
+            ...chunk], cwd);
+        if (!res.success)
+            continue;
+        for (const raw of res.output.split(RECORD)) {
+            const [sha = '', parents = '', subject = '', trailers = ''] = raw.trim().split(FIELD);
+            if (!/^[0-9a-f]{40,64}$/i.test(sha))
+                continue;
+            const override = overrides.get(sha);
+            const firstTrailer = trailers.split(',').map((t) => t.trim()).find((t) => t !== '') ?? '';
+            records.push({
+                sha,
+                subject,
+                isMerge: parents.trim().split(/\s+/).filter(Boolean).length > 1,
+                attribution: override ? { kind: 'delivery', deliveryId: override } : classifyTrailerValue(firstTrailer),
+            });
+        }
+    }
+    return records;
+}
+/** The files a commit changed (renames split), or null when git cannot read it. */
+export function readCommitChangedFiles(cwd, sha) {
+    const res = runGitSync(['show', '--name-only', '--no-renames', '--format=', sha, '--'], cwd);
+    if (!res.success)
+        return null;
+    return res.output.split('\n').map((l) => l.trim()).filter((l) => l !== '');
+}
+/** The file named by a shortfall's diff citation ("path:line", "path @@ ..."), or null. */
+export function citedFile(diffCitation) {
+    const token = (diffCitation ?? '').trim().split(/[\s:@(]/)[0] ?? '';
+    return /[./]/.test(token) ? token.replace(/^[ab]\//, '') : null;
+}
+/** Pure: the node's file scope from its shortfall citations and the delivery's issues. */
+export function resolveNodeFileScope(diffCitations, deliveryIssues) {
+    const patterns = new Set();
+    for (const c of diffCitations) {
+        const f = citedFile(c);
+        if (f)
+            patterns.add(f);
+    }
+    for (const issue of deliveryIssues) {
+        for (const f of completionFilesOf(issue.completionArtifacts))
+            patterns.add(f);
+        for (const line of (issue.relevantFiles ?? '').split('\n')) {
+            if (line.trim() !== '')
+                patterns.add(line.trim());
+        }
+    }
+    return patterns.size === 0 ? { kind: 'unscoped' } : { kind: 'files', patterns: [...patterns] };
+}
+/**
+ * Pure: the commits a held node's work may live in -- every non-merge commit in
+ * the batches trailered `none`, `unattributed` or not at all whose changed files
+ * meet the node's scope (any, when unscoped). An unattributed capture is named
+ * whatever it touches. Commits attributed to a delivery -- this one or another --
+ * never are. Newest-batch order is kept; the list and each file list are bounded.
+ */
+export function findMisattributedCommits(commits, changedFilesOf, scope) {
+    const matchers = scope.kind === 'files'
+        ? scope.patterns.map(compilePathPattern).filter((m) => m !== null)
+        : [];
+    const named = [];
+    for (const c of commits) {
+        if (named.length >= MAX_NAMED_COMMITS)
+            break;
+        const trailer = c.attribution.kind;
+        if (trailer === 'delivery' || c.isMerge)
+            continue;
+        const changed = changedFilesOf(c.sha) ?? [];
+        const inScope = scope.kind === 'unscoped' ? changed : changed.filter((f) => matchers.some((m) => m(f)));
+        if (inScope.length === 0 && trailer !== 'unattributed_capture')
+            continue;
+        named.push({ sha: c.sha, subject: c.subject, trailer, files: inScope.slice(0, MAX_FILES_PER_COMMIT) });
+    }
+    return { scope: scope.kind, commits: named };
+}
+//# sourceMappingURL=misattributed-commits.js.map

package/dist/verify/attribution/misattributed-commits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"misattributed-commits.js","sourceRoot":"","sources":["../../../src/verify/attribution/misattributed-commits.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,kFAAkF;AAClF,gBAAgB;AAEhB;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAA2B,MAAM,+BAA+B,CAAC;AACpH,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAE3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,4CAA4C,CAAC;AA+B/E,sEAAsE;AACtE,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAChC,gEAAgE;AAChE,MAAM,UAAU,GAAG,GAAG,CAAC;AAEvB,MAAM,KAAK,GAAG,MAAM,CAAC;AACrB,MAAM,MAAM,GAAG,MAAM,CAAC;AAEtB;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,GAAW,EACX,OAA0D,EAC1D,YAAyC,IAAI,GAAG,EAAE;IAElD,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3H,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,UAAU,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC;QAC5C,MAAM,GAAG,GAAG,UAAU,CACpB,CAAC,MAAM,EAAE,IAAI,EAAE,kBAAkB;YAC/B,cAAc,KAAK,KAAK,KAAK,KAAK,KAAK,kBAAkB,oBAAoB,6BAA6B,MAAM,EAAE;YAClH,GAAG,KAAK,CAAC,EACX,GAAG,CACJ,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,OAAO;YAAE,SAAS;QAC3B,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3C,MAAM,CAAC,GAAG,GAAG,EAAE,EAAE,OAAO,GAAG,EAAE,EAAE,OAAO,GAAG,EAAE,EAAE,QAAQ,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACtF,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC9C,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACpC,MAAM,YAAY,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;YAC1F,OAAO,CAAC,IAAI,CAAC;gBACX,GAAG;gBACH,OAAO;gBACP,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC;gBAC/D,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,YAAY,CAAC;aACxG,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,sBAAsB,CAAC,GAAW,EAAE,GAAW;IAC7D,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;IAC7F,IAAI,CAAC,GAAG,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC9B,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,SAAS,CAAC,YAAgC;IACxD,MAAM,KAAK,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpE,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAClE,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,oBAAoB,CAClC,aAA8C,EAC9C,cAAoG;IAEpG,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,CAAC;YAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,iBAAiB,CAAC,KAAK,CAAC,mBAAmB,CAAC;YAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC9E,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3D,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;gBAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC;AACjG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAqC,EACrC,cAAgD,EAChD,KAAoB;IAEpB,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,KAAK,OAAO;QACrC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAkC,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;QAClG,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,KAAK,GAA0B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,MAAM,IAAI,iBAAiB;YAAE,MAAM;QAC7C,MAAM,OAAO,GAAG,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC;QACnC,IAAI,OAAO,KAAK,UAAU,IAAI,CAAC,CAAC,OAAO;YAAE,SAAS;QAClD,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxG,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,KAAK,sBAAsB;YAAE,SAAS;QACzE,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,oBAAoB,CAAC,EAAE,CAAC,CAAC;IACzG,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC/C,CAAC"}

package/dist/verify/attribution/rework-attribution.d.ts

@@ -0,0 +1,166 @@
+/**
+ * Whose commits caused a failed gate verdict -- the delivery a rework Bug belongs on.
+ *
+ * Every delivery on a focus is judged on the same focus-branch HEAD, and one gate
+ * run's verdict is SHARED by all of them (verify/engine/verification-commit-sharing.ts).
+ * Sharing the verdict is sound: the gate ran on one tree and would render the same
+ * answer for each. Fanning out the REWORK is not: one rework Bug PER delivery
+ * sitting in verify would name a gate run most of those deliveries never made,
+ * cost each a verify_failed re-entry, and spend a review cycle out of the focus's
+ * arm budget (completion/review-cycle-budget/review-cycle-cap.ts) on a delivery that carries no
+ * defect of its own.
+ *
+ * ONE branch-level red is ONE piece of open work. This module names its owner.
+ *
+ * THE RANGE. The suspects are the commits the failure could have come from: those
+ * between the newest ancestor this gate judged GREEN (verify/gate-verdicts/judged-ancestor.ts --
+ * the same bound the gate's own stages diff against) and the failed commit.
+ * Everything at or before the green ancestor was covered by a run that PASSED on a
+ * tree containing it. The gate that judged the failure is read off the failure's own
+ * recorded verdict, so no caller has to resolve it.
+ *
+ * THE OWNER. Each commit in that range is attributed by its `Telora-Delivery`
+ * trailer, through git's own trailer parse (git/review-window-commits.ts),
+ * the same read the verify gate partitions evidence with. A sentinel, an
+ * unattributed capture and a commit naming a delivery outside the focus own nothing.
+ *
+ * SEVERAL DELIVERIES MAY HAVE COMMITTED IN THAT RANGE, and one red is still one
+ * work item, so the range names ONE owner: the delivery of the NEWEST commit in it.
+ *
+ * SAY WHAT THAT IS AND IS NOT. It is the newest SUSPECT, not a proof of cause. The
+ * gate was GREEN at the base and the red is rendered at the tip, so every commit
+ * between them is a candidate and the newest is the last change that could have
+ * introduced it -- but nothing here reads the failing stage's output, so an older
+ * commit in the range may well be the culprit. What the rule buys is that the choice
+ * is DETERMINISTIC (git's own topological order, one read) and SINGLE. Two
+ * alternatives lost: the failing stage's own files would be a stronger ground, but a
+ * verdict records a stage NAME (`lint:all > lint --prefix packages/daemon`) and test
+ * ids, which do not resolve to files in general; and "every delivery in the range" is
+ * what this module exists to stop -- it re-creates the N-Bugs fan-out one bound later.
+ * Being wrong here costs one delivery a re-entry it did not earn, while the branch is
+ * red for all of them either way; being wrong by filing on all of them costs every
+ * delivery one, plus a review cycle each out of the arm's budget.
+ *
+ * EVERY PATH ENDS AT EXACTLY ONE OWNER, including the ones that know least. The
+ * acceptance rule is unconditional -- one failed verdict, one piece of open work --
+ * so "we could not attribute this" is not licence to fan out again. The ladder, in
+ * {@link selectReworkOwner} for a pass that knows its candidate set:
+ *
+ *   1. the newest commit in the range whose delivery is a candidate;
+ *   2. the delivery whose dispatch RAN the gate (CommitVerdict.judgedDeliveryId) --
+ *      one delivery, and the one that actually paid for the run;
+ *   3. {@link unattributableOwner} of the candidates -- the lowest id, logged.
+ *
+ * Rung 3 is what makes the rule unconditional: an unreadable verdict, an unreadable
+ * range, a focus whose worktree the daemon no longer holds -- each still names one
+ * routable delivery, because a red must reach someone and every candidate is a
+ * delivery sitting in verify on the red branch. It is a PURE FUNCTION OF THE
+ * CANDIDATE SET, deliberately: an arbitrary owner is fine, an owner that depends on
+ * who asked first is not.
+ *
+ * A PASS THAT ASKS ONE DELIVERY AT A TIME (verify/outcome-routing/verification-feedback.ts routes each
+ * dispatch separately) therefore asks the SAME question rather than a weaker one: it
+ * reads the focus's verify deliveries and applies rung 3 to that set, so every asker
+ * -- this delivery, its siblings, the next poll, the first poll after a daemon
+ * restart, and the per-focus filer acting on the same commit -- computes the same
+ * single owner. It keeps no in-memory first-claim ledger, which would agree with
+ * nothing after a restart and with the per-focus filer never. When the candidate
+ * read itself fails, NOBODY files this poll: the filing is left owed and retried from
+ * the commit's record (verify/outcome-routing/verification-rework-issue.ts retryOwedReworkIssue)
+ * rather than guessed at, because a guess here is how one red becomes N Bugs.
+ *
+ * Direction of error: this module decides who is TOLD about a red, never whether the
+ * red gates. A delivery that shares a failed verdict still takes that verdict, still
+ * routes verify -> verify_failed, and still carries the failure on its gate_state.
+ * What it does not carry is a work item describing a run it never made.
+ *
+ * WHAT THIS MODULE DOES NOT PROMISE. Its answer is a function of LIVE state -- the
+ * focus's deliveries currently in verify -- and that set moves as deliveries are
+ * routed, so the same failed commit can name a different owner at a later poll. That
+ * is deliberate: a red whose first-named owner has already moved on must still reach
+ * someone. It does mean "one red, one Bug" cannot rest on this module alone, and it
+ * does not: the filing dedupes per COMMIT across the whole focus
+ * (verify/outcome-routing/verification-rework-issue.ts), so a re-selection RE-ROUTES a red rather
+ * than duplicating one.
+ *
+ * A leaf: git, the verdict record and the focus worktree map, nothing else.
+ *
+ * History: docs/daemon/history-verify.md (verify/attribution/rework-attribution.ts).
+ *
+ * @module verify/attribution/rework-attribution
+ */
+import type { ReviewWindowCommit } from '../../git/review-window-commits.js';
+import type { CommitVerdict, CommitVerdictGate, CommitVerdictReader } from '../gate-verdicts/commit-verdict-record.js';
+/**
+ * The attribution's collaborators, every one required; the production binding is
+ * composition/verify-rework-context.ts buildReworkAttributionDeps.
+ */
+export interface ReworkAttributionDeps {
+    /** The focus worktree the failed commit was judged in; null when the daemon holds none. */
+    resolveWorktreePath: (focusId: string) => string | null;
+    /** The verdict recorded for a commit; without a gate, the newest under any gate (which carries its own). */
+    readCommitVerdict: (productId: string, focusId: string, sha: string, gate?: CommitVerdictGate) => CommitVerdict | null;
+    /** The newest ancestor of `tip` this gate judged PASSING (verify/gate-verdicts/judged-ancestor.ts findGreenAncestor). */
+    findGreenAncestor: (productId: string, focusId: string, tip: string, gate: CommitVerdictGate, at: {
+        worktreePath: string;
+        readCommitVerdict: CommitVerdictReader;
+    }) => string | null;
+    /** The non-merge commits in base..tip with their trailer attribution; null when git could not answer. */
+    listWindow: (worktreePath: string, base: string, tip: string) => readonly ReviewWindowCommit[] | null;
+    /**
+     * The focus's deliveries sitting in verify -- the candidate set an unattributable
+     * failure is settled over, so a pass that was handed one delivery can still ask the
+     * focus-wide question (module doc).
+     */
+    listVerifyCandidates: (focusId: string) => Promise<readonly string[]>;
+}
+/** The focus commit whose failure is being attributed. */
+export interface FailedCommit {
+    productId: string;
+    focusId: string;
+    /** The commit the gate failed on. */
+    sha: string;
+}
+/** Who owns a failed verdict, and how that was decided. */
+export interface FailureOwnership {
+    /** The deliveries whose own commits are in the judged range; empty when none is attributable. */
+    causingDeliveryIds: ReadonlySet<string>;
+    /** Those deliveries in range order, NEWEST COMMIT FIRST -- the ranking the owner is taken from. */
+    causingNewestFirst: readonly string[];
+    /** The delivery whose dispatch ran the gate -- the owner when nothing is attributable. */
+    judgedDeliveryId: string;
+    /** The ONE delivery this failure's rework belongs on: the newest causing commit's, else the judged one. */
+    owningDeliveryId: string;
+    /** False when the range could not be read at all (git or the green ancestor); the fallback then decides alone. */
+    rangeRead: boolean;
+}
+/**
+ * Who a failed verdict belongs to (module doc), or null when its verdict cannot be
+ * read -- the one answer that means "cannot tell". Never throws.
+ */
+export declare function resolveFailureOwnership(at: FailedCommit, deps: ReworkAttributionDeps): FailureOwnership | null;
+/**
+ * The ONE delivery a failed verdict's rework belongs on, chosen from the
+ * `candidates` a filing pass would otherwise fan out over (module doc). Null means
+ * "cannot tell" -- the verdict itself was unreadable or is not a failure -- and the
+ * caller files as it did before. Never throws.
+ */
+export declare function selectReworkOwner(candidates: readonly string[], at: FailedCommit, deps: ReworkAttributionDeps): string | null;
+/**
+ * Rung 3: the owner of a failure NOTHING attributes, over the candidates that could
+ * carry it. The lowest id -- arbitrary on purpose, and a pure function of the set, so
+ * a sibling, a later poll, a restarted daemon and the per-focus filer all name the
+ * same one delivery. Null only when there is no candidate at all.
+ */
+export declare function unattributableOwner(candidates: readonly string[]): string | null;
+/**
+ * Whether the rework Bug for `failedSha` belongs on `deliveryId` (module doc): it is
+ * the ONE owner the range names -- the delivery of the newest commit in it, or, with
+ * nothing attributable there, the delivery whose dispatch ran the gate. An unreadable
+ * verdict names no owner from the commit, so the question is asked of the FOCUS
+ * instead: the candidate set settles it by rung 3, identically for every asker and
+ * across a restart. A candidate read that fails files nothing this poll (the retry
+ * owns that case). Never throws.
+ */
+export declare function deliveryOwnsFailure(deliveryId: string, at: FailedCommit, deps: ReworkAttributionDeps): Promise<boolean>;
+//# sourceMappingURL=rework-attribution.d.ts.map

package/dist/verify/attribution/rework-attribution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rework-attribution.d.ts","sourceRoot":"","sources":["../../../src/verify/attribution/rework-attribution.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0FG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAKvH;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,2FAA2F;IAC3F,mBAAmB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACxD,4GAA4G;IAC5G,iBAAiB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,iBAAiB,KAAK,aAAa,GAAG,IAAI,CAAC;IACvH,yHAAyH;IACzH,iBAAiB,EAAE,CACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,iBAAiB,EACvB,EAAE,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,mBAAmB,CAAA;KAAE,KACjE,MAAM,GAAG,IAAI,CAAC;IACnB,yGAAyG;IACzG,UAAU,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,SAAS,kBAAkB,EAAE,GAAG,IAAI,CAAC;IACtG;;;;OAIG;IACH,oBAAoB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;CACvE;AAED,0DAA0D;AAC1D,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,qCAAqC;IACrC,GAAG,EAAE,MAAM,CAAC;CACb;AAED,2DAA2D;AAC3D,MAAM,WAAW,gBAAgB;IAC/B,iGAAiG;IACjG,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACxC,mGAAmG;IACnG,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,0FAA0F;IAC1F,gBAAgB,EAAE,MAAM,CAAC;IACzB,2GAA2G;IAC3G,gBAAgB,EAAE,MAAM,CAAC;IACzB,kHAAkH;IAClH,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,EAAE,EAAE,YAAY,EAChB,IAAI,EAAE,qBAAqB,GAC1B,gBAAgB,GAAG,IAAI,CAkBzB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,SAAS,MAAM,EAAE,EAC7B,EAAE,EAAE,YAAY,EAChB,IAAI,EAAE,qBAAqB,GAC1B,MAAM,GAAG,IAAI,CAoBf;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAIhF;AA4BD;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,YAAY,EAChB,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,OAAO,CAAC,CAiBlB"}

package/dist/verify/attribution/rework-attribution.js

@@ -0,0 +1,156 @@
+// PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)
+// Pinned by: packages/daemon/src/integration/failed-verdict-review-exit-respawn-regression.test.ts,
+//   packages/daemon/src/verify/attribution/rework-attribution.test.ts,
+//   packages/daemon/src/verify/outcome-routing/verification-rework-issue.test.ts
+// PINNED-BY-END
+import { createLogger } from '../../log/daemon-log.js';
+const log = createLogger({ module: 'verification' });
+/**
+ * Who a failed verdict belongs to (module doc), or null when its verdict cannot be
+ * read -- the one answer that means "cannot tell". Never throws.
+ */
+export function resolveFailureOwnership(at, deps) {
+    let verdict;
+    try {
+        verdict = deps.readCommitVerdict(at.productId, at.focusId, at.sha);
+    }
+    catch {
+        return null;
+    }
+    if (!verdict || verdict.outcome !== 'failed')
+        return null;
+    const causing = readCausingSet(at, verdict.gate, deps);
+    const newestFirst = causing ?? [];
+    return {
+        causingDeliveryIds: new Set(newestFirst),
+        causingNewestFirst: newestFirst,
+        judgedDeliveryId: verdict.judgedDeliveryId,
+        // ONE red, ONE work item: the newest commit in the range names the owner.
+        owningDeliveryId: newestFirst[0] ?? verdict.judgedDeliveryId,
+        rangeRead: causing !== null,
+    };
+}
+/**
+ * The ONE delivery a failed verdict's rework belongs on, chosen from the
+ * `candidates` a filing pass would otherwise fan out over (module doc). Null means
+ * "cannot tell" -- the verdict itself was unreadable or is not a failure -- and the
+ * caller files as it did before. Never throws.
+ */
+export function selectReworkOwner(candidates, at, deps) {
+    const fallback = unattributableOwner(candidates);
+    // Nobody to tell: this pass has no verify delivery to carry the red.
+    if (fallback === null)
+        return null;
+    const eligible = new Set(candidates);
+    const ownership = resolveFailureOwnership(at, deps);
+    if (ownership !== null) {
+        // Rung 1 -- the newest suspect this pass can actually tell.
+        const attributed = ownership.causingNewestFirst.find((id) => eligible.has(id));
+        if (attributed !== undefined)
+            return attributed;
+        // Rung 2 -- the delivery that paid for the run.
+        if (eligible.has(ownership.judgedDeliveryId))
+            return ownership.judgedDeliveryId;
+    }
+    // Rung 3 -- unattributable, and still ONE owner: the rule does not relax here.
+    log.info(`[verification] rework issue: the failed verdict for ${at.sha.slice(0, 12)} could not be attributed`
+        + `${ownership === null ? ' (its verdict was unreadable)' : ` to a delivery this pass can tell (owner: ${ownership.owningDeliveryId})`}`
+        + ` -- it is carried by ${fallback} alone, not by every delivery on the red branch`);
+    return fallback;
+}
+/**
+ * Rung 3: the owner of a failure NOTHING attributes, over the candidates that could
+ * carry it. The lowest id -- arbitrary on purpose, and a pure function of the set, so
+ * a sibling, a later poll, a restarted daemon and the per-focus filer all name the
+ * same one delivery. Null only when there is no candidate at all.
+ */
+export function unattributableOwner(candidates) {
+    let lowest = null;
+    for (const id of candidates)
+        if (lowest === null || id < lowest)
+            lowest = id;
+    return lowest;
+}
+/** The deliveries with a trailered commit in greenAncestor..failedSha, NEWEST FIRST; null when the range is unreadable. */
+function readCausingSet(at, gate, deps) {
+    try {
+        const worktreePath = deps.resolveWorktreePath(at.focusId);
+        if (worktreePath === null)
+            return null;
+        const base = deps.findGreenAncestor(at.productId, at.focusId, at.sha, gate, {
+            worktreePath,
+            readCommitVerdict: (productId, focusId, sha, g) => deps.readCommitVerdict(productId, focusId, sha, g),
+        });
+        // No green ancestor in reach: nothing bounds the suspects, so the range says nothing.
+        if (base === null)
+            return null;
+        const commits = deps.listWindow(worktreePath, base, at.sha);
+        if (commits === null)
+            return null;
+        // listReviewWindowCommits answers newest first; the order IS the ranking.
+        const causing = [];
+        for (const c of commits) {
+            if (c.attribution.kind === 'delivery' && !causing.includes(c.attribution.deliveryId)) {
+                causing.push(c.attribution.deliveryId);
+            }
+        }
+        return causing;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Whether the rework Bug for `failedSha` belongs on `deliveryId` (module doc): it is
+ * the ONE owner the range names -- the delivery of the newest commit in it, or, with
+ * nothing attributable there, the delivery whose dispatch ran the gate. An unreadable
+ * verdict names no owner from the commit, so the question is asked of the FOCUS
+ * instead: the candidate set settles it by rung 3, identically for every asker and
+ * across a restart. A candidate read that fails files nothing this poll (the retry
+ * owns that case). Never throws.
+ */
+export async function deliveryOwnsFailure(deliveryId, at, deps) {
+    const ownership = resolveFailureOwnership(at, deps);
+    if (ownership === null)
+        return await ownsUnattributable(deliveryId, at, deps);
+    const owns = deliveryId === ownership.owningDeliveryId;
+    if (!owns) {
+        const why = ownership.causingNewestFirst.length > 0
+            ? `the newest commit in the judged range is ${ownership.owningDeliveryId}'s`
+            : `${ownership.rangeRead ? 'no delivery\'s commits explain it' : 'it could not be attributed'}, so it stays with the `
+                + `delivery whose run rendered it (${ownership.judgedDeliveryId})`;
+        const alsoIn = ownership.causingNewestFirst.filter((id) => id !== ownership.owningDeliveryId);
+        log.info(`[verification] rework issue: delivery ${deliveryId} shares the failed verdict for ${at.sha.slice(0, 12)} but does not `
+            + `carry it -- ${why}`
+            + (alsoIn.length > 0 ? ` (also committed in that range: ${alsoIn.join(', ')})` : ''));
+    }
+    return owns;
+}
+/**
+ * Rung 3 for a caller holding ONE delivery: read the focus's candidates and settle the
+ * failure over them, so the answer is the set's, not the asker's (module doc). A read
+ * that fails, or that does not list this delivery, DECLINES -- one poll of nobody,
+ * which retryOwedReworkIssue retries -- rather than letting a sibling reading a
+ * different set assume it owns the red too.
+ */
+async function ownsUnattributable(deliveryId, at, deps) {
+    let candidates;
+    try {
+        candidates = await deps.listVerifyCandidates(at.focusId);
+    }
+    catch (err) {
+        log.warn(`[verification] rework issue: the failed verdict for ${at.sha.slice(0, 12)} is unattributable and the focus's verify `
+            + `deliveries could not be read -- ${deliveryId} files nothing this poll (the owed filing is retried):`, err.message);
+        return false;
+    }
+    const owner = unattributableOwner(candidates);
+    if (owner !== deliveryId) {
+        log.info(`[verification] rework issue: delivery ${deliveryId} shares the failed verdict for ${at.sha.slice(0, 12)}, which `
+            + `nothing attributes -- the focus's verify set settles it on ${owner}`);
+        return false;
+    }
+    log.info(`[verification] rework issue: the failed verdict for ${at.sha.slice(0, 12)} is unattributable -- of the focus's verify `
+        + `deliveries (${candidates.join(', ')}) it is carried by ${deliveryId} alone`);
+    return true;
+}
+//# sourceMappingURL=rework-attribution.js.map

package/dist/verify/attribution/rework-attribution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rework-attribution.js","sourceRoot":"","sources":["../../../src/verify/attribution/rework-attribution.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,oGAAoG;AACpG,uEAAuE;AACvE,iFAAiF;AACjF,gBAAgB;AAgGhB,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEvD,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;AAmDrD;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CACrC,EAAgB,EAChB,IAA2B;IAE3B,IAAI,OAA6B,CAAC;IAClC,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1D,MAAM,OAAO,GAAG,cAAc,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACvD,MAAM,WAAW,GAAG,OAAO,IAAI,EAAE,CAAC;IAClC,OAAO;QACL,kBAAkB,EAAE,IAAI,GAAG,CAAC,WAAW,CAAC;QACxC,kBAAkB,EAAE,WAAW;QAC/B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,0EAA0E;QAC1E,gBAAgB,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,gBAAgB;QAC5D,SAAS,EAAE,OAAO,KAAK,IAAI;KAC5B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,UAA6B,EAC7B,EAAgB,EAChB,IAA2B;IAE3B,MAAM,QAAQ,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IACjD,qEAAqE;IACrE,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,uBAAuB,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,4DAA4D;QAC5D,MAAM,UAAU,GAAG,SAAS,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/E,IAAI,UAAU,KAAK,SAAS;YAAE,OAAO,UAAU,CAAC;QAChD,gDAAgD;QAChD,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC;YAAE,OAAO,SAAS,CAAC,gBAAgB,CAAC;IAClF,CAAC;IACD,+EAA+E;IAC/E,GAAG,CAAC,IAAI,CACN,uDAAuD,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,0BAA0B;UAClG,GAAG,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,6CAA6C,SAAS,CAAC,gBAAgB,GAAG,EAAE;UACtI,wBAAwB,QAAQ,iDAAiD,CACpF,CAAC;IACF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAA6B;IAC/D,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,KAAK,MAAM,EAAE,IAAI,UAAU;QAAE,IAAI,MAAM,KAAK,IAAI,IAAI,EAAE,GAAG,MAAM;YAAE,MAAM,GAAG,EAAE,CAAC;IAC7E,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,2HAA2H;AAC3H,SAAS,cAAc,CAAC,EAAgB,EAAE,IAAuB,EAAE,IAA2B;IAC5F,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,YAAY,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE;YAC1E,YAAY;YACZ,iBAAiB,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;SACtG,CAAC,CAAC;QACH,sFAAsF;QACtF,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;QAC5D,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAClC,0EAA0E;QAC1E,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,CAAC,WAAW,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;gBACrF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,UAAkB,EAClB,EAAgB,EAChB,IAA2B;IAE3B,MAAM,SAAS,GAAG,uBAAuB,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,MAAM,kBAAkB,CAAC,UAAU,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,UAAU,KAAK,SAAS,CAAC,gBAAgB,CAAC;IACvD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,GAAG,GAAG,SAAS,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC;YACjD,CAAC,CAAC,4CAA4C,SAAS,CAAC,gBAAgB,IAAI;YAC5E,CAAC,CAAC,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,4BAA4B,yBAAyB;kBAClH,mCAAmC,SAAS,CAAC,gBAAgB,GAAG,CAAC;QACvE,MAAM,MAAM,GAAG,SAAS,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAC9F,GAAG,CAAC,IAAI,CACN,yCAAyC,UAAU,kCAAkC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB;cACtH,eAAe,GAAG,EAAE;cACpB,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,mCAAmC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CACrF,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,kBAAkB,CAAC,UAAkB,EAAE,EAAgB,EAAE,IAA2B;IACjG,IAAI,UAA6B,CAAC;IAClC,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CACN,uDAAuD,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,4CAA4C;cACpH,mCAAmC,UAAU,wDAAwD,EACtG,GAAa,CAAC,OAAO,CACvB,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAC9C,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;QACzB,GAAG,CAAC,IAAI,CACN,yCAAyC,UAAU,kCAAkC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU;cAChH,8DAA8D,KAAK,EAAE,CACxE,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,GAAG,CAAC,IAAI,CACN,uDAAuD,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,8CAA8C;UACtH,eAAe,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB,UAAU,QAAQ,CAC/E,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/verify/attribution/verification-attribution-base.d.ts

@@ -0,0 +1,28 @@
+/** A resolved attribution base, or why none could be. */
+export type AttributionBase = {
+    sha: string;
+    kind: 'merge-base' | 'own-commits-reverted';
+    reverted: string[];
+} | {
+    sha: null;
+    reason: string;
+};
+/** The git the base resolution runs; production binds it at the composition root (composition/attribution-base-git.ts). */
+export interface AttributionBaseGit {
+    run: (args: string[], cwd: string) => {
+        success: boolean;
+        output: string;
+    };
+    /** Write a commit object with a fixed identity and date (so equal inputs give an equal SHA). */
+    commitTree: (tree: string, parent: string, message: string, cwd: string) => string | null;
+}
+/** `git commit-tree` under a fixed identity and date, so equal inputs give an equal SHA; null on failure. */
+export declare function commitTreeWithFixedIdentity(tree: string, parent: string, message: string, cwd: string): string | null;
+/**
+ * Resolve the attribution base for a judged HEAD. `headRef` is what the merge-base
+ * is taken against (the judged sha, or `HEAD`), `headSha` its resolved sha (null
+ * when unresolvable), and `ownCommitShas` the delivery's own recorded commits
+ * (empty when none are recorded). Pure over the git seam.
+ */
+export declare function resolveAttributionBase(cwd: string, integrationBranch: string, headRef: string, headSha: string | null, ownCommitShas: readonly string[], git: AttributionBaseGit): AttributionBase;
+//# sourceMappingURL=verification-attribution-base.d.ts.map

package/dist/verify/attribution/verification-attribution-base.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification-attribution-base.d.ts","sourceRoot":"","sources":["../../../src/verify/attribution/verification-attribution-base.ts"],"names":[],"mappings":"AAmCA,yDAAyD;AACzD,MAAM,MAAM,eAAe,GACvB;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,YAAY,GAAG,sBAAsB,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,GAChF;IAAE,GAAG,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElC,2HAA2H;AAC3H,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,KAAK;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3E,gGAAgG;IAChG,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CAC3F;AAWD,6GAA6G;AAC7G,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAUrH;AAiBD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,MAAM,EACX,iBAAiB,EAAE,MAAM,EACzB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GAAG,IAAI,EACtB,aAAa,EAAE,SAAS,MAAM,EAAE,EAChC,GAAG,EAAE,kBAAkB,GACtB,eAAe,CAiDjB"}

package/dist/verify/attribution/verification-attribution-base.js

@@ -0,0 +1,122 @@
+// PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)
+// Pinned by: packages/daemon/src/verify/attribution/verification-attribution-base.test.ts
+// PINNED-BY-END
+/**
+ * The commit a failed verify run is attributed against: the integration commit
+ * the judged HEAD is based on, WITHOUT the delivery's own commits.
+ *
+ * The plain base is merge-base(integration, HEAD). Two shapes break it:
+ *
+ *   - HEAD is itself an integration commit (the focus was fast-forwarded or
+ *     rebased onto integration, or merged back into it): merge-base == HEAD. A
+ *     baseline there runs the delivery's own code, so its defects would demote to
+ *     pre-existing. Refusing the base instead would charge EVERY red on that
+ *     commit to the delivery -- including a sibling focus's failing test the
+ *     focus merely pulled in.
+ *   - The merge-base contains commits the delivery already merged back: its own
+ *     defects sit in the base and demote.
+ *
+ * Both are resolved the same way: the base is the merge-base with the delivery's
+ * own recorded commits REVERTED out of it (a three-way merge per commit, written
+ * as a deterministic commit object so the SHA-keyed baseline cache is reused).
+ * Every other commit -- a sibling's failing test included -- stays in the base
+ * and its failures are pre-existing; the delivery's own changes are absent from
+ * the base and their failures are new. When the delivery's own commits cannot be
+ * identified, cannot be reverted cleanly, or reverting leaves the HEAD tree
+ * unchanged, no base is returned and every HEAD red gates (fail-closed).
+ *
+ * History: docs/daemon/history-verify.md (verify/attribution/verification-attribution-base.ts).
+ *
+ * @module verify/attribution/verification-attribution-base
+ */
+import { execFileSync } from 'node:child_process';
+const FIXED_IDENTITY = {
+    GIT_AUTHOR_NAME: 'telora-verify',
+    GIT_AUTHOR_EMAIL: 'verify@telora.invalid',
+    GIT_AUTHOR_DATE: '@0 +0000',
+    GIT_COMMITTER_NAME: 'telora-verify',
+    GIT_COMMITTER_EMAIL: 'verify@telora.invalid',
+    GIT_COMMITTER_DATE: '@0 +0000',
+};
+/** `git commit-tree` under a fixed identity and date, so equal inputs give an equal SHA; null on failure. */
+export function commitTreeWithFixedIdentity(tree, parent, message, cwd) {
+    try {
+        return execFileSync('git', ['commit-tree', tree, '-p', parent, '-m', message], {
+            cwd,
+            env: { ...process.env, ...FIXED_IDENTITY },
+            stdio: ['ignore', 'pipe', 'pipe'],
+        }).toString().trim() || null;
+    }
+    catch {
+        return null;
+    }
+}
+function isAncestor(git, cwd, ancestor, of) {
+    return git.run(['merge-base', '--is-ancestor', ancestor, of], cwd).success;
+}
+function parentsOf(git, cwd, sha) {
+    const r = git.run(['rev-list', '--parents', '-n', '1', sha], cwd);
+    if (!r.success || !r.output)
+        return null;
+    return r.output.split(/\s+/).slice(1);
+}
+function treeOf(git, cwd, sha) {
+    const r = git.run(['rev-parse', `${sha}^{tree}`], cwd);
+    return r.success && r.output ? r.output : null;
+}
+/**
+ * Resolve the attribution base for a judged HEAD. `headRef` is what the merge-base
+ * is taken against (the judged sha, or `HEAD`), `headSha` its resolved sha (null
+ * when unresolvable), and `ownCommitShas` the delivery's own recorded commits
+ * (empty when none are recorded). Pure over the git seam.
+ */
+export function resolveAttributionBase(cwd, integrationBranch, headRef, headSha, ownCommitShas, git) {
+    const mb = git.run(['merge-base', integrationBranch, headRef], cwd);
+    if (!mb.success || !mb.output)
+        return { sha: null, reason: `no merge-base of ${integrationBranch} and ${headRef}` };
+    const mergeBase = mb.output;
+    // The delivery's own non-merge commits the merge-base carries. A merge commit is
+    // never reverted: it brings integration content in, not the delivery's change.
+    const ownInBase = [...new Set(ownCommitShas)].filter((sha) => {
+        if (!isAncestor(git, cwd, sha, mergeBase))
+            return false;
+        const parents = parentsOf(git, cwd, sha);
+        return parents !== null && parents.length === 1;
+    });
+    if (ownInBase.length === 0) {
+        if (mergeBase === headSha) {
+            return { sha: null, reason: `merge-base == HEAD ${mergeBase.slice(0, 8)} and none of the delivery's own commits are recorded in it` };
+        }
+        return { sha: mergeBase, kind: 'merge-base', reverted: [] };
+    }
+    // Revert newest first: the commit with the fewest commits after it on the base goes first.
+    const after = new Map();
+    for (const sha of ownInBase) {
+        const count = git.run(['rev-list', '--count', `${sha}..${mergeBase}`], cwd);
+        if (!count.success)
+            return { sha: null, reason: `could not order own commit ${sha.slice(0, 8)} on the base` };
+        after.set(sha, Number(count.output));
+    }
+    const newestFirst = [...ownInBase].sort((a, b) => (after.get(a) ?? 0) - (after.get(b) ?? 0));
+    let current = mergeBase;
+    for (const own of newestFirst) {
+        // Three-way merge with the own commit as base and its parent as "theirs": the
+        // result is `current` with exactly that commit's change taken back out.
+        const merged = git.run(['merge-tree', '--write-tree', `--merge-base=${own}`, current, `${own}^`], cwd);
+        const tree = merged.output.split('\n')[0]?.trim();
+        if (!merged.success || !tree) {
+            return { sha: null, reason: `own commit ${own.slice(0, 8)} does not revert cleanly out of ${mergeBase.slice(0, 8)}` };
+        }
+        const next = git.commitTree(tree, current, `telora verify base: ${mergeBase} without ${own}`, cwd);
+        if (!next)
+            return { sha: null, reason: `could not write the base commit reverting ${own.slice(0, 8)}` };
+        current = next;
+    }
+    const baseTree = treeOf(git, cwd, current);
+    const headTree = headSha ? treeOf(git, cwd, headSha) : null;
+    if (!baseTree || !headTree || baseTree === headTree) {
+        return { sha: null, reason: `reverting the delivery's own commits left the HEAD tree unchanged` };
+    }
+    return { sha: current, kind: 'own-commits-reverted', reverted: newestFirst };
+}
+//# sourceMappingURL=verification-attribution-base.js.map

package/dist/verify/attribution/verification-attribution-base.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification-attribution-base.js","sourceRoot":"","sources":["../../../src/verify/attribution/verification-attribution-base.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,0FAA0F;AAC1F,gBAAgB;AAEhB;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAclD,MAAM,cAAc,GAAG;IACrB,eAAe,EAAE,eAAe;IAChC,gBAAgB,EAAE,uBAAuB;IACzC,eAAe,EAAE,UAAU;IAC3B,kBAAkB,EAAE,eAAe;IACnC,mBAAmB,EAAE,uBAAuB;IAC5C,kBAAkB,EAAE,UAAU;CAC/B,CAAC;AAEF,6GAA6G;AAC7G,MAAM,UAAU,2BAA2B,CAAC,IAAY,EAAE,MAAc,EAAE,OAAe,EAAE,GAAW;IACpG,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,EAAE,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE;YAC7E,GAAG;YACH,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,cAAc,EAAE;YAC1C,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAuB,EAAE,GAAW,EAAE,QAAgB,EAAE,EAAU;IACpF,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,eAAe,EAAE,QAAQ,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC;AAC7E,CAAC;AAED,SAAS,SAAS,CAAC,GAAuB,EAAE,GAAW,EAAE,GAAW;IAClE,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IAClE,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,MAAM,CAAC,GAAuB,EAAE,GAAW,EAAE,GAAW;IAC/D,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,GAAG,GAAG,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC;IACvD,OAAO,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,GAAW,EACX,iBAAyB,EACzB,OAAe,EACf,OAAsB,EACtB,aAAgC,EAChC,GAAuB;IAEvB,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,iBAAiB,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;IACpE,IAAI,CAAC,EAAE,CAAC,OAAO,IAAI,CAAC,EAAE,CAAC,MAAM;QAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,oBAAoB,iBAAiB,QAAQ,OAAO,EAAE,EAAE,CAAC;IACpH,MAAM,SAAS,GAAG,EAAE,CAAC,MAAM,CAAC;IAE5B,iFAAiF;IACjF,+EAA+E;IAC/E,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;QAC3D,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;QACxD,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACzC,OAAO,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;YAC1B,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,sBAAsB,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,4DAA4D,EAAE,CAAC;QACxI,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC9D,CAAC;IAED,2FAA2F;IAC3F,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,GAAG,GAAG,KAAK,SAAS,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QAC5E,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,8BAA8B,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC;QAC9G,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,MAAM,WAAW,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAE7F,IAAI,OAAO,GAAG,SAAS,CAAC;IACxB,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,8EAA8E;QAC9E,wEAAwE;QACxE,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,cAAc,EAAE,gBAAgB,GAAG,EAAE,EAAE,OAAO,EAAE,GAAG,GAAG,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QACvG,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QAClD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;YAC7B,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,mCAAmC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;QACxH,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,uBAAuB,SAAS,YAAY,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;QACnG,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,6CAA6C,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;QACxG,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACpD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,mEAAmE,EAAE,CAAC;IACpG,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;AAC/E,CAAC"}