@telora/daemon 0.24.16 → 0.24.25

package/dist/verify/escaped-tests/escaped-test-run.js

@@ -0,0 +1,156 @@
+// PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)
+// Pinned by: packages/daemon/src/verify/ci-gate/ci-gate-dispatch.test.ts,
+//   packages/daemon/src/verify/escaped-tests/escaped-gate-run.test.ts,
+//   packages/daemon/src/verify/escaped-tests/escaped-test-run.test.ts,
+//   packages/daemon/src/verify/escaped-tests/escaped-tests-source.test.ts
+// PINNED-BY-END
+/**
+ * How escaped test files run INSIDE a gate run, and what the gate log then says
+ * about them. Pure.
+ *
+ * The gate run executes the gate command and THEN the product's declared re-run
+ * command over the escaped files (verify/failing-test-rerun/rerun-command.ts
+ * renderRerunCommand), in the same checkout and environment, as one POSIX shell
+ * script ({@link composeGateWithEscapedTests}). The local runner spawns it
+ * (`sh -c`); a CI-run gate ships it as the spec's command (scripts/ci-gate-run.sh
+ * runs it with bash). Either way the added run's output lands in the gate log
+ * after a marker block:
+ *
+ *   (escaped tests: 2 file(s) a gate escape recorded)
+ *   (escaped test: <first file>)
+ *   (escaped test: <second file>)
+ *   ...the re-run command's output...
+ *   (escaped tests exit: 1; gate exit: 0)
+ *
+ * EXIT RULE: the script exits with the gate's own code when the gate failed,
+ * else with the added run's code -- so a failing escaped test fails the run, and
+ * every downstream reader (the failure parser, the same-commit flake retry,
+ * per-file base attribution, the rework Bug) sees its failures in the log with
+ * no path of its own. One exception is settled by the daemon after the run
+ * ({@link settleEscapedRun}): an added run that exited non-zero while naming NO
+ * failing test could not run the files (a file the re-run command's runner does
+ * not include, a crashed command). That is not evidence about the change, so it
+ * does not fail a gate that passed -- the stance per-file base attribution takes
+ * on an inconclusive run (verify/attribution/verification-baseline-files.ts).
+ *
+ * The gate's IDENTITY is untouched by any of this: the run applies and records
+ * the ORIGINAL gate command (appliedConfig, the per-commit verdict key, the CI
+ * spec key), so a verdict rendered with added files is read back under the
+ * gate's normal key.
+ *
+ * @module verify/escaped-tests/escaped-test-run
+ */
+import { parseFailingTests } from '../deterministic-gate/verification-failure-parser.js';
+import { logRoots, renderRerunCommand, testFileOfId } from '../failing-test-rerun/rerun-command.js';
+/** The marker line opening the added run's section of a gate log. */
+export function escapedTestsMarker(count) {
+    return `(escaped tests: ${count} file(s) a gate escape recorded)`;
+}
+const MARKER_RE = /^\(escaped tests: (\d+) file\(s\) a gate escape recorded\)$/;
+const FILE_RE = /^\(escaped test: (.+)\)$/;
+const EXIT_RE = /^\(escaped tests exit: (\d+); gate exit: (\d+)\)$/;
+// eslint-disable-next-line no-control-regex -- strips terminal colour codes from the log
+const ANSI_RE = /\u001b\[[0-9;]*m/g;
+/** POSIX single-quote one shell word, always. */
+function quote(word) {
+    return `'${word.replace(/'/g, `'\\''`)}'`;
+}
+/**
+ * The script that runs `gateCommand`, then the re-run command over `files`, and
+ * exits by the module's exit rule. Each command runs in its own subshell, on its
+ * own lines, so neither can end the other (an `exit`, a trailing comment). The
+ * added run's stderr joins its stdout, so its whole output lands in the log
+ * between the marker block and the exit line, in order, however the two streams
+ * of the run are read. Pure.
+ */
+export function composeGateWithEscapedTests(gateCommand, rerunTemplate, files) {
+    const markers = [escapedTestsMarker(files.length), ...files.map((f) => `(escaped test: ${f})`)].map(quote).join(' ');
+    return [
+        '(',
+        gateCommand,
+        ')',
+        '__telora_gate_rc=$?',
+        `printf '%s\\n' ${markers}`,
+        '(',
+        renderRerunCommand(rerunTemplate, files),
+        ') 2>&1',
+        '__telora_escaped_rc=$?',
+        `printf '(escaped tests exit: %s; gate exit: %s)\\n' "$__telora_escaped_rc" "$__telora_gate_rc"`,
+        'if [ "$__telora_gate_rc" -ne 0 ]; then exit "$__telora_gate_rc"; fi',
+        'exit "$__telora_escaped_rc"',
+    ].join('\n');
+}
+/** The escaped-run section of a gate log, or null when the run added no files. Pure. */
+export function readEscapedRun(logText) {
+    const lines = (typeof logText === 'string' ? logText : '').replace(ANSI_RE, '').split(/\r?\n/);
+    const start = lines.findIndex((line) => MARKER_RE.test(line.trim()));
+    if (start < 0)
+        return null;
+    const count = Number(MARKER_RE.exec(lines[start].trim())[1]);
+    const files = [];
+    let at = start + 1;
+    while (files.length < count && at < lines.length) {
+        const match = FILE_RE.exec(lines[at].trim());
+        if (!match)
+            break;
+        files.push(match[1]);
+        at++;
+    }
+    const end = lines.findIndex((line, index) => index >= at && EXIT_RE.test(line.trim()));
+    const exit = end >= 0 ? EXIT_RE.exec(lines[end].trim()) : null;
+    return {
+        files,
+        output: lines.slice(at, end >= 0 ? end : lines.length).join('\n'),
+        escapedExit: exit ? Number(exit[1]) : null,
+        gateExit: exit ? Number(exit[2]) : null,
+    };
+}
+/** True when the added run exited non-zero while naming no failing test (module doc). Pure. */
+function isInconclusive(run) {
+    return run.escapedExit !== null && run.escapedExit !== 0 && parseFailingTests(run.output).size === 0;
+}
+/**
+ * The files the added run PASSED: every file when it exited 0; else every file
+ * none of whose failing tests is in its output -- provided each failing test
+ * names its file. No file when the run was cut short, could not run the files,
+ * or named a failure no file can be told from. Pure.
+ */
+export function passedEscapedFiles(logText) {
+    const run = readEscapedRun(logText);
+    if (run === null || run.escapedExit === null)
+        return [];
+    if (run.escapedExit === 0)
+        return [...run.files];
+    const ids = parseFailingTests(run.output);
+    if (ids.size === 0)
+        return [];
+    const roots = logRoots(logText);
+    const failing = new Set();
+    for (const id of ids) {
+        const file = testFileOfId(id, roots);
+        if (file === null)
+            return [];
+        failing.add(file);
+    }
+    return run.files.filter((file) => !failing.has(file));
+}
+/**
+ * The run's result with the one exception of the exit rule applied (module
+ * doc): a run whose gate passed and whose added run only failed INCONCLUSIVELY
+ * is the gate's pass. Every other result is returned unchanged. Pure.
+ */
+export function settleEscapedRun(result, logText) {
+    if (result.outcome !== 'failed' || result.timedOut)
+        return result;
+    const run = readEscapedRun(logText);
+    if (run === null || run.gateExit !== 0 || !isInconclusive(run))
+        return result;
+    return {
+        ...result,
+        outcome: 'passed',
+        exitCode: 0,
+        rationale: `deterministic check passed (exit 0); the ${run.files.length} escaped test file(s) it added could not be run by the `
+            + `declared re-run command (exit ${run.escapedExit}, no failing test named) -- not charged to the change`,
+    };
+}
+//# sourceMappingURL=escaped-test-run.js.map

package/dist/verify/escaped-tests/escaped-test-run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"escaped-test-run.js","sourceRoot":"","sources":["../../../src/verify/escaped-tests/escaped-test-run.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,0EAA0E;AAC1E,uEAAuE;AACvE,uEAAuE;AACvE,0EAA0E;AAC1E,gBAAgB;AAEhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,sDAAsD,CAAC;AACzF,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AAGpG,qEAAqE;AACrE,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,OAAO,mBAAmB,KAAK,kCAAkC,CAAC;AACpE,CAAC;AAED,MAAM,SAAS,GAAG,6DAA6D,CAAC;AAChF,MAAM,OAAO,GAAG,0BAA0B,CAAC;AAC3C,MAAM,OAAO,GAAG,mDAAmD,CAAC;AACpE,yFAAyF;AACzF,MAAM,OAAO,GAAG,mBAAmB,CAAC;AAEpC,iDAAiD;AACjD,SAAS,KAAK,CAAC,IAAY;IACzB,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC5C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CAAC,WAAmB,EAAE,aAAqB,EAAE,KAAwB;IAC9G,MAAM,OAAO,GAAG,CAAC,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrH,OAAO;QACL,GAAG;QACH,WAAW;QACX,GAAG;QACH,qBAAqB;QACrB,kBAAkB,OAAO,EAAE;QAC3B,GAAG;QACH,kBAAkB,CAAC,aAAa,EAAE,KAAK,CAAC;QACxC,QAAQ;QACR,wBAAwB;QACxB,gGAAgG;QAChG,qEAAqE;QACrE,6BAA6B;KAC9B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAcD,wFAAwF;AACxF,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,MAAM,KAAK,GAAG,CAAC,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/F,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACrE,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAE,CAAC,IAAI,EAAE,CAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,EAAE,GAAG,KAAK,GAAG,CAAC,CAAC;IACnB,OAAO,KAAK,CAAC,MAAM,GAAG,KAAK,IAAI,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK;YAAE,MAAM;QAClB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;QACtB,EAAE,EAAE,CAAC;IACP,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACvF,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChE,OAAO;QACL,KAAK;QACL,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QACjE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;QAC1C,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;KACxC,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,SAAS,cAAc,CAAC,GAAmB;IACzC,OAAO,GAAG,CAAC,WAAW,KAAK,IAAI,IAAI,GAAG,CAAC,WAAW,KAAK,CAAC,IAAI,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC;AACvG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,WAAW,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACxD,IAAI,GAAG,CAAC,WAAW,KAAK,CAAC;QAAE,OAAO,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,YAAY,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACrC,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,EAAE,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAsB,EAAE,OAAe;IACtE,IAAI,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ;QAAE,OAAO,MAAM,CAAC;IAClE,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IAC9E,OAAO;QACL,GAAG,MAAM;QACT,OAAO,EAAE,QAAQ;QACjB,QAAQ,EAAE,CAAC;QACX,SAAS,EAAE,4CAA4C,GAAG,CAAC,KAAK,CAAC,MAAM,yDAAyD;cAC5H,iCAAiC,GAAG,CAAC,WAAW,uDAAuD;KAC5G,CAAC;AACJ,CAAC"}

package/dist/verify/escaped-tests/escaped-test-set.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Which escaped test files a product's next gate run adds: the pure rule.
+ *
+ * A GATE ESCAPE is a red integration candidate whose approved head the verify
+ * gate had passed (queries/candidate-ci-reds/). The test files CI named there
+ * are a gap in the product's own test selection -- not one focus's -- so the
+ * set is per product: every focus of the product runs them.
+ *
+ * The rule:
+ *   - A file is IN the set while it has passed fewer than
+ *     ESCAPED_FILE_REQUIRED_PASSES gate runs on distinct commits SINCE its
+ *     newest escape. A pass recorded before that escape does not count, so a
+ *     newer escape of the file restarts its count.
+ *   - The set is the newest-escaped files first, at most ESCAPED_SET_MAX_FILES.
+ *   - A path that is not a plain repo-relative path (absolute, `..`, a control
+ *     character) is never in it: it is handed to a shell command.
+ *
+ * Passes are kept per product, host-local ({@link EscapedPassState}; the durable
+ * store, which reads a missing or unreadable record as no passes, is
+ * escaped-pass-store.ts): the rule fails toward running a test, never toward
+ * dropping it. The record keeps EVERY file's passes -- at most
+ * ESCAPED_FILE_REQUIRED_PASSES each, so it grows only with the product's distinct
+ * escaped files -- and never evicts one, so a file that met the exit rule stays
+ * out of the set until a newer escape names it again.
+ *
+ * @module verify/escaped-tests/escaped-test-set
+ */
+/** Gate runs on distinct commits an escaped file must pass, since its newest escape, to leave the set. */
+export declare const ESCAPED_FILE_REQUIRED_PASSES = 3;
+/** The most escaped files one gate run adds. */
+export declare const ESCAPED_SET_MAX_FILES = 10;
+/** One escaped file as the product's escape record lists it. */
+export interface EscapedFile {
+    /** Repo-relative test file path. */
+    file: string;
+    /** When the newest escape naming the file was recorded (ISO 8601). */
+    lastEscapeAt: string;
+}
+/** One gate run an escaped file passed: the commit it judged, and when (epoch ms). */
+export interface EscapedPass {
+    sha: string;
+    at: number;
+}
+/** A product's recorded passes, per file. */
+export interface EscapedPassState {
+    files: Record<string, EscapedPass[]>;
+}
+/** A path safe to hand a re-run command as one test file: repo-relative, no `..`, no control characters. Pure. */
+export declare function isRunnableTestPath(file: string): boolean;
+/** Distinct-commit passes of `file` recorded after `lastEscapeAt` (an unparseable instant counts every pass as before it). Pure. */
+export declare function passesSinceEscape(state: EscapedPassState, file: string, lastEscapeAt: string): number;
+/**
+ * The files a gate run adds (module doc): runnable paths, newest escape first,
+ * fewer than the required passes since that escape, at most the cap. Pure.
+ */
+export declare function escapedTestSet(escapes: readonly EscapedFile[], state: EscapedPassState): string[];
+/**
+ * The state with one pass recorded for each of `files` at commit `sha`, at
+ * `now`. A commit already recorded for a file counts once (its instant moves to
+ * `now`). Each file keeps its newest ESCAPED_FILE_REQUIRED_PASSES passes -- only
+ * passes after the newest escape count, and no more are needed -- and every
+ * other file's record is kept as it was: none is ever evicted (module doc). Pure.
+ */
+export declare function recordEscapedPasses(state: EscapedPassState, files: readonly string[], sha: string, now: number): EscapedPassState;
+//# sourceMappingURL=escaped-test-set.d.ts.map

package/dist/verify/escaped-tests/escaped-test-set.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"escaped-test-set.d.ts","sourceRoot":"","sources":["../../../src/verify/escaped-tests/escaped-test-set.ts"],"names":[],"mappings":"AAQA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,0GAA0G;AAC1G,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAE9C,gDAAgD;AAChD,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAExC,gEAAgE;AAChE,MAAM,WAAW,WAAW;IAC1B,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,sFAAsF;AACtF,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,6CAA6C;AAC7C,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;CACtC;AAED,kHAAkH;AAClH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAMxD;AAED,oIAAoI;AACpI,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAKrG;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,EAAE,KAAK,EAAE,gBAAgB,GAAG,MAAM,EAAE,CAcjG;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,gBAAgB,CAOjI"}

package/dist/verify/escaped-tests/escaped-test-set.js

@@ -0,0 +1,95 @@
+// PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)
+// Pinned by: packages/daemon/src/verify/ci-gate/ci-gate-dispatch.test.ts,
+//   packages/daemon/src/verify/escaped-tests/escaped-gate-run.test.ts,
+//   packages/daemon/src/verify/escaped-tests/escaped-pass-store.test.ts,
+//   packages/daemon/src/verify/escaped-tests/escaped-test-set.test.ts,
+//   packages/daemon/src/verify/escaped-tests/escaped-tests-source.test.ts
+// PINNED-BY-END
+/**
+ * Which escaped test files a product's next gate run adds: the pure rule.
+ *
+ * A GATE ESCAPE is a red integration candidate whose approved head the verify
+ * gate had passed (queries/candidate-ci-reds/). The test files CI named there
+ * are a gap in the product's own test selection -- not one focus's -- so the
+ * set is per product: every focus of the product runs them.
+ *
+ * The rule:
+ *   - A file is IN the set while it has passed fewer than
+ *     ESCAPED_FILE_REQUIRED_PASSES gate runs on distinct commits SINCE its
+ *     newest escape. A pass recorded before that escape does not count, so a
+ *     newer escape of the file restarts its count.
+ *   - The set is the newest-escaped files first, at most ESCAPED_SET_MAX_FILES.
+ *   - A path that is not a plain repo-relative path (absolute, `..`, a control
+ *     character) is never in it: it is handed to a shell command.
+ *
+ * Passes are kept per product, host-local ({@link EscapedPassState}; the durable
+ * store, which reads a missing or unreadable record as no passes, is
+ * escaped-pass-store.ts): the rule fails toward running a test, never toward
+ * dropping it. The record keeps EVERY file's passes -- at most
+ * ESCAPED_FILE_REQUIRED_PASSES each, so it grows only with the product's distinct
+ * escaped files -- and never evicts one, so a file that met the exit rule stays
+ * out of the set until a newer escape names it again.
+ *
+ * @module verify/escaped-tests/escaped-test-set
+ */
+/** Gate runs on distinct commits an escaped file must pass, since its newest escape, to leave the set. */
+export const ESCAPED_FILE_REQUIRED_PASSES = 3;
+/** The most escaped files one gate run adds. */
+export const ESCAPED_SET_MAX_FILES = 10;
+/** A path safe to hand a re-run command as one test file: repo-relative, no `..`, no control characters. Pure. */
+export function isRunnableTestPath(file) {
+    if (file.length === 0 || file.length > 1000 || file.trim() !== file)
+        return false;
+    // eslint-disable-next-line no-control-regex -- a control character in a path handed to a shell is exactly what is refused.
+    if (/[\u0000-\u001f\u007f]/.test(file))
+        return false;
+    if (file.startsWith('/') || file.startsWith('-'))
+        return false;
+    return !file.split('/').some((segment) => segment === '..' || segment === '');
+}
+/** Distinct-commit passes of `file` recorded after `lastEscapeAt` (an unparseable instant counts every pass as before it). Pure. */
+export function passesSinceEscape(state, file, lastEscapeAt) {
+    const since = Date.parse(lastEscapeAt);
+    const passes = state.files[file] ?? [];
+    if (!Number.isFinite(since))
+        return 0;
+    return new Set(passes.filter((p) => p.at > since).map((p) => p.sha)).size;
+}
+/**
+ * The files a gate run adds (module doc): runnable paths, newest escape first,
+ * fewer than the required passes since that escape, at most the cap. Pure.
+ */
+export function escapedTestSet(escapes, state) {
+    const seen = new Set();
+    const ordered = escapes
+        .map((e, index) => ({ ...e, index, t: Date.parse(e.lastEscapeAt) }))
+        .sort((a, b) => (Number.isFinite(b.t) ? b.t : 0) - (Number.isFinite(a.t) ? a.t : 0) || a.index - b.index);
+    const out = [];
+    for (const escape of ordered) {
+        if (seen.has(escape.file) || !isRunnableTestPath(escape.file))
+            continue;
+        seen.add(escape.file);
+        if (passesSinceEscape(state, escape.file, escape.lastEscapeAt) >= ESCAPED_FILE_REQUIRED_PASSES)
+            continue;
+        out.push(escape.file);
+        if (out.length >= ESCAPED_SET_MAX_FILES)
+            break;
+    }
+    return out;
+}
+/**
+ * The state with one pass recorded for each of `files` at commit `sha`, at
+ * `now`. A commit already recorded for a file counts once (its instant moves to
+ * `now`). Each file keeps its newest ESCAPED_FILE_REQUIRED_PASSES passes -- only
+ * passes after the newest escape count, and no more are needed -- and every
+ * other file's record is kept as it was: none is ever evicted (module doc). Pure.
+ */
+export function recordEscapedPasses(state, files, sha, now) {
+    const next = { ...state.files };
+    for (const file of files) {
+        const kept = (next[file] ?? []).filter((p) => p.sha !== sha);
+        next[file] = [...kept, { sha, at: now }].sort((a, b) => b.at - a.at).slice(0, ESCAPED_FILE_REQUIRED_PASSES);
+    }
+    return { files: next };
+}
+//# sourceMappingURL=escaped-test-set.js.map

package/dist/verify/escaped-tests/escaped-test-set.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"escaped-test-set.js","sourceRoot":"","sources":["../../../src/verify/escaped-tests/escaped-test-set.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,0EAA0E;AAC1E,uEAAuE;AACvE,yEAAyE;AACzE,uEAAuE;AACvE,0EAA0E;AAC1E,gBAAgB;AAEhB;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,0GAA0G;AAC1G,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC;AAE9C,gDAAgD;AAChD,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAqBxC,kHAAkH;AAClH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAClF,2HAA2H;IAC3H,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/D,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,EAAE,CAAC,CAAC;AAChF,CAAC;AAED,oIAAoI;AACpI,MAAM,UAAU,iBAAiB,CAAC,KAAuB,EAAE,IAAY,EAAE,YAAoB;IAC3F,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACtC,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,OAA+B,EAAE,KAAuB;IACrF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,OAAO,GAAG,OAAO;SACpB,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;SACnE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IAC5G,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,SAAS;QACxE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,4BAA4B;YAAE,SAAS;QACzG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,GAAG,CAAC,MAAM,IAAI,qBAAqB;YAAE,MAAM;IACjD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAuB,EAAE,KAAwB,EAAE,GAAW,EAAE,GAAW;IAC7G,MAAM,IAAI,GAAkC,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;IAC/D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,4BAA4B,CAAC,CAAC;IAC9G,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC"}

package/dist/verify/escaped-tests/escaped-tests-source.d.ts

@@ -0,0 +1,44 @@
+import type { DeclaredRerun, StrategyResult } from '../deterministic-gate/verification-deterministic.js';
+import { type EscapedFile } from './escaped-test-set.js';
+import type { EscapedPassStore } from './escaped-pass-store.js';
+/** How long a gate run waits for the product's escapes before it runs without them. */
+export declare const ESCAPED_SET_READ_TIMEOUT_MS = 10000;
+/** The collaborators, bound at the composition root (composition/verification-context.ts). */
+export interface EscapedTestsDeps {
+    /** The product's escaped files, newest escape first (product-api); throws on a failed read. */
+    listEscapes: (productId: string) => Promise<EscapedFile[]>;
+    passes: EscapedPassStore;
+    now: () => number;
+    /** How long the escape read may take before the run goes ahead with no added files. */
+    readTimeoutMs: number;
+    /** Which of `files` exist at commit `sha` of the repo at `repoPath` (a CI-run gate has no checkout here). */
+    filesAtCommit: (repoPath: string, sha: string, files: readonly string[]) => string[];
+}
+/** The gate a run applies, as far as adding files is concerned. */
+type GateToExtend = {
+    command: string;
+    rerun?: DeclaredRerun | undefined;
+};
+/** The product's escaped set (module doc); [] on any failed or slow read. */
+export declare function escapedFilesFor(productId: string | null, deps: EscapedTestsDeps): Promise<string[]>;
+/** The files of `files` present in the checkout at `checkoutPath` (never a path outside it). */
+export declare function filesInCheckout(checkoutPath: string, files: readonly string[]): string[];
+/** The command a LOCAL gate run of `productId` spawns in the checkout at `checkoutPath` (module doc). */
+export declare function localGateCommand(productId: string | null, gate: GateToExtend, checkoutPath: string, deps: EscapedTestsDeps): Promise<string>;
+/**
+ * The command a CI-run gate of `productId` at `sha` ships in its spec (module
+ * doc), and the escaped files it adds ([] when the command is the gate's own).
+ */
+export declare function ciGateCommand(productId: string | null, gate: GateToExtend, repoPath: string, sha: string, deps: EscapedTestsDeps): Promise<{
+    command: string;
+    files: string[];
+}>;
+/**
+ * A gate run's result with its escaped files judged (module doc): the exit
+ * rule's exception applied, and the files it passed counted. A product that
+ * declares no re-run command added no files, and its result is returned as is,
+ * with no log read.
+ */
+export declare function judgeEscapedTests(productId: string | null, result: StrategyResult, readLogText: (source: StrategyResult) => string, deps: EscapedTestsDeps): StrategyResult;
+export {};
+//# sourceMappingURL=escaped-tests-source.d.ts.map

package/dist/verify/escaped-tests/escaped-tests-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"escaped-tests-source.d.ts","sourceRoot":"","sources":["../../../src/verify/escaped-tests/escaped-tests-source.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,qDAAqD,CAAC;AAEzG,OAAO,EAAuC,KAAK,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAE9F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAIhE,uFAAuF;AACvF,eAAO,MAAM,2BAA2B,QAAS,CAAC;AAElD,8FAA8F;AAC9F,MAAM,WAAW,gBAAgB;IAC/B,+FAA+F;IAC/F,WAAW,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3D,MAAM,EAAE,gBAAgB,CAAC;IACzB,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,uFAAuF;IACvF,aAAa,EAAE,MAAM,CAAC;IACtB,6GAA6G;IAC7G,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,KAAK,MAAM,EAAE,CAAC;CACtF;AAED,mEAAmE;AACnE,KAAK,YAAY,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,aAAa,GAAG,SAAS,CAAA;CAAE,CAAC;AAY3E,6EAA6E;AAC7E,wBAAsB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAUzG;AAED,gGAAgG;AAChG,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAMxF;AASD,yGAAyG;AACzG,wBAAsB,gBAAgB,CACpC,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,IAAI,EAAE,YAAY,EAClB,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,MAAM,CAAC,CAIjB;AAED;;;GAGG;AACH,wBAAsB,aAAa,CACjC,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,IAAI,EAAE,YAAY,EAClB,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAc/C;AAoBD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,MAAM,EAAE,cAAc,EACtB,WAAW,EAAE,CAAC,MAAM,EAAE,cAAc,KAAK,MAAM,EAC/C,IAAI,EAAE,gBAAgB,GACrB,cAAc,CAOhB"}

package/dist/verify/escaped-tests/escaped-tests-source.js

@@ -0,0 +1,142 @@
+// PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)
+// Pinned by: packages/daemon/src/verify/escaped-tests/escaped-gate-run.test.ts,
+//   packages/daemon/src/verify/escaped-tests/escaped-tests-source.test.ts
+// PINNED-BY-END
+/**
+ * Escaped test files in a product's gate runs: what a gate run adds, and what
+ * its verdict counts.
+ *
+ * ADDED, ONLY TO THE GATE RUN OF A FOCUS HEAD (the local strategy's run of a
+ * default-on candidate, verify/deterministic-gate/verification-checkout.ts, and
+ * the CI hand-over of one, verify/ci-gate/ci-gate-dispatch.ts) -- never to a
+ * re-run, a continuation, a base run or a rework re-check. A run adds files only
+ * when the judged commit's manifest declares a `rerunCommand` and the product's
+ * escaped set (escaped-test-set.ts) holds files that exist at the judged commit;
+ * the gate command it then spawns is escaped-test-run.ts
+ * composeGateWithEscapedTests. With no `rerunCommand`, or no such file, the run
+ * spawns exactly the gate command, as before.
+ *
+ * The set is read ONCE per gate run, fail-soft: a failed or slow read of the
+ * product's escapes (bounded by `readTimeoutMs`) adds no files and is logged --
+ * the gate is never blocked or failed by it.
+ *
+ * COUNTED, when a run rendered a verdict about its commit (verify/engine/
+ * verification-commit-sharing.ts judges every local and CI run through
+ * {@link judgeEscapedTests}): each added file the run passed
+ * (escaped-test-run.ts passedEscapedFiles) gets one pass for the judged commit
+ * in the product's host-local record (escaped-pass-store.ts); a commit counts
+ * once. The same step applies the exit rule's one exception
+ * (escaped-test-run.ts settleEscapedRun).
+ *
+ * @module verify/escaped-tests/escaped-tests-source
+ */
+import { existsSync } from 'node:fs';
+import { resolve, sep } from 'node:path';
+import { createLogger } from '../../log/daemon-log.js';
+import { escapedTestSet, recordEscapedPasses } from './escaped-test-set.js';
+import { composeGateWithEscapedTests, passedEscapedFiles, settleEscapedRun } from './escaped-test-run.js';
+const log = createLogger({ module: 'verification' });
+/** How long a gate run waits for the product's escapes before it runs without them. */
+export const ESCAPED_SET_READ_TIMEOUT_MS = 10_000;
+/** `promise`, or a rejection once `ms` has passed. */
+function withTimeout(promise, ms) {
+    let timer;
+    const timeout = new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new Error(`no answer within ${ms} ms`)), ms);
+        timer.unref?.();
+    });
+    return Promise.race([promise, timeout]).finally(() => clearTimeout(timer));
+}
+/** The product's escaped set (module doc); [] on any failed or slow read. */
+export async function escapedFilesFor(productId, deps) {
+    if (!productId)
+        return [];
+    try {
+        const escapes = await withTimeout(deps.listEscapes(productId), deps.readTimeoutMs);
+        return escapedTestSet(escapes, deps.passes.read(productId));
+    }
+    catch (err) {
+        log.warn(`[verification] escaped tests: the gate escapes of product ${productId} could not be read `
+            + `(${err.message}); this gate run adds no escaped test files`);
+        return [];
+    }
+}
+/** The files of `files` present in the checkout at `checkoutPath` (never a path outside it). */
+export function filesInCheckout(checkoutPath, files) {
+    const root = resolve(checkoutPath);
+    return files.filter((file) => {
+        const path = resolve(root, file);
+        return path.startsWith(root + sep) && existsSync(path);
+    });
+}
+/** The command a gate run spawns: the gate's own, plus the escaped `files` when there are any and a re-run command names them. */
+function extendGate(gate, files, where) {
+    if (!gate.rerun || files.length === 0)
+        return gate.command;
+    log.info(`[verification] escaped tests: ${where} adds ${files.length} test file(s) a gate escape recorded: ${files.join(', ')}`);
+    return composeGateWithEscapedTests(gate.command, gate.rerun.command, files);
+}
+/** The command a LOCAL gate run of `productId` spawns in the checkout at `checkoutPath` (module doc). */
+export async function localGateCommand(productId, gate, checkoutPath, deps) {
+    if (!gate.rerun)
+        return gate.command;
+    const files = filesInCheckout(checkoutPath, await escapedFilesFor(productId, deps));
+    return extendGate(gate, files, `the gate run in ${checkoutPath}`);
+}
+/**
+ * The command a CI-run gate of `productId` at `sha` ships in its spec (module
+ * doc), and the escaped files it adds ([] when the command is the gate's own).
+ */
+export async function ciGateCommand(productId, gate, repoPath, sha, deps) {
+    const unchanged = { command: gate.command, files: [] };
+    if (!gate.rerun)
+        return unchanged;
+    const wanted = await escapedFilesFor(productId, deps);
+    if (wanted.length === 0)
+        return unchanged;
+    let present;
+    try {
+        present = new Set(deps.filesAtCommit(repoPath, sha, wanted));
+    }
+    catch (err) {
+        log.warn(`[verification] escaped tests: could not list the escaped files at ${sha.slice(0, 8)} (${err.message}); none added`);
+        return unchanged;
+    }
+    const files = wanted.filter((f) => present.has(f));
+    return { command: extendGate(gate, files, `the CI gate run of ${sha.slice(0, 8)}`), files };
+}
+/** True when `result` is a gate run's verdict about its commit (no re-run, timeout or unavailable checkout). */
+function renderedGateVerdict(result) {
+    return (result.outcome === 'passed' || result.outcome === 'failed')
+        && typeof result.verifiedSha === 'string' && result.verifiedSha.length > 0
+        && result.timedOut !== true && result.renderedBeforeKill === undefined
+        && result.rerunOf === undefined && result.checkoutUnavailable !== true && result.configUnresolved !== true;
+}
+/** Record one pass at the judged commit for each added file the run passed (module doc). */
+function notePasses(productId, result, logText, deps) {
+    const passed = passedEscapedFiles(logText);
+    if (passed.length === 0)
+        return;
+    const next = recordEscapedPasses(deps.passes.read(productId), passed, result.verifiedSha, deps.now());
+    if (deps.passes.write(productId, next)) {
+        log.info(`[verification] escaped tests: ${passed.length} escaped test file(s) passed at ${result.verifiedSha.slice(0, 8)}: ${passed.join(', ')}`);
+    }
+}
+/**
+ * A gate run's result with its escaped files judged (module doc): the exit
+ * rule's exception applied, and the files it passed counted. A product that
+ * declares no re-run command added no files, and its result is returned as is,
+ * with no log read.
+ */
+export function judgeEscapedTests(productId, result, readLogText, deps) {
+    if (!result.appliedConfig?.rerun || !renderedGateVerdict(result))
+        return result;
+    const logText = readLogText(result);
+    const settled = settleEscapedRun(result, logText);
+    if (settled !== result)
+        log.info(`[verification] escaped tests: ${settled.rationale}`);
+    if (productId)
+        notePasses(productId, result, logText, deps);
+    return settled;
+}
+//# sourceMappingURL=escaped-tests-source.js.map

package/dist/verify/escaped-tests/escaped-tests-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"escaped-tests-source.js","sourceRoot":"","sources":["../../../src/verify/escaped-tests/escaped-tests-source.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,gFAAgF;AAChF,0EAA0E;AAC1E,gBAAgB;AAEhB;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAoB,MAAM,uBAAuB,CAAC;AAC9F,OAAO,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAG1G,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;AAErD,uFAAuF;AACvF,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAiBlD,sDAAsD;AACtD,SAAS,WAAW,CAAI,OAAmB,EAAE,EAAU;IACrD,IAAI,KAAgD,CAAC;IACrD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;QAC/C,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,SAAwB,EAAE,IAAsB;IACpF,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QACnF,OAAO,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,6DAA6D,SAAS,qBAAqB;cAChG,IAAK,GAAa,CAAC,OAAO,6CAA6C,CAAC,CAAC;QAC7E,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,eAAe,CAAC,YAAoB,EAAE,KAAwB;IAC5E,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACnC,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QAC3B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,kIAAkI;AAClI,SAAS,UAAU,CAAC,IAAkB,EAAE,KAAwB,EAAE,KAAa;IAC7E,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC;IAC3D,GAAG,CAAC,IAAI,CAAC,iCAAiC,KAAK,SAAS,KAAK,CAAC,MAAM,yCAAyC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjI,OAAO,2BAA2B,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,yGAAyG;AACzG,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,SAAwB,EACxB,IAAkB,EAClB,YAAoB,EACpB,IAAsB;IAEtB,IAAI,CAAC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC;IACrC,MAAM,KAAK,GAAG,eAAe,CAAC,YAAY,EAAE,MAAM,eAAe,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;IACpF,OAAO,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,mBAAmB,YAAY,EAAE,CAAC,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,SAAwB,EACxB,IAAkB,EAClB,QAAgB,EAChB,GAAW,EACX,IAAsB;IAEtB,MAAM,SAAS,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACvD,IAAI,CAAC,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACtD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,OAAoB,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,qEAAqE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAM,GAAa,CAAC,OAAO,eAAe,CAAC,CAAC;QACzI,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,sBAAsB,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;AAC9F,CAAC;AAED,gHAAgH;AAChH,SAAS,mBAAmB,CAAC,MAAsB;IACjD,OAAO,CAAC,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC;WAC9D,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;WACvE,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,kBAAkB,KAAK,SAAS;WACnE,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,mBAAmB,KAAK,IAAI,IAAI,MAAM,CAAC,gBAAgB,KAAK,IAAI,CAAC;AAC/G,CAAC;AAED,4FAA4F;AAC5F,SAAS,UAAU,CAAC,SAAiB,EAAE,MAAgD,EAAE,OAAe,EAAE,IAAsB;IAC9H,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAChC,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACtG,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,IAAI,CAAC,iCAAiC,MAAM,CAAC,MAAM,mCAAmC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,SAAwB,EACxB,MAAsB,EACtB,WAA+C,EAC/C,IAAsB;IAEtB,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAChF,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClD,IAAI,OAAO,KAAK,MAAM;QAAE,GAAG,CAAC,IAAI,CAAC,iCAAiC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACvF,IAAI,SAAS;QAAE,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC5D,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/verify/gate-config/verification-manifest.d.ts

@@ -74,6 +74,17 @@ export interface VerifyManifest {
      * docs/runbook-verify-gate-in-ci.md.
      */
     gateRunner?: GateRunnerName;
+    /**
+     * Optional: `true` declares that the product's CI publishes a FAILURE RECORD
+     * for a failed run (refs/ci-failures/<sha>/<run>/<job>, ci/candidate-failure-record.ts;
+     * contract: docs/runbook-ci-log-diagnosis.md, "The failure record"). Declared,
+     * a red integration candidate whose record has not landed yet waits a bounded
+     * window for it before its rework is routed, even on the first record the
+     * product ever publishes (merge/candidate-ci-failures.ts awaitsFailureRecord).
+     * Absent or `false` => no wait unless this host has held one of the product's
+     * records before.
+     */
+    ciFailureRecords?: boolean;
 }
 /** The completion judges a manifest may name. */
 export declare const COMPLETION_JUDGE_NAMES: readonly ["ci", "local"];
@@ -118,7 +129,7 @@ export declare function gateRunsOnCi(manifest: Pick<VerifyManifest, 'gateRunner'
  *          `rerunMaxFailures` / carries an unknown `completionJudge`, a
  *          `completionCommand` that is not a non-empty string, a non-positive
  *          `completionTimeoutMs`, or a completion command beside `"ci"` /
- *          carries an unknown `gateRunner`.
+ *          carries an unknown `gateRunner` / carries a non-boolean `ciFailureRecords`.
  */
 export declare function readVerifyManifestFrom(repoPath: string | undefined, fs: VerifyManifestFs): VerifyManifest | undefined;
 /** Read the repo's verification manifest from the working tree on disk (see readVerifyManifestFrom). */

package/dist/verify/gate-config/verification-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verification-manifest.d.ts","sourceRoot":"","sources":["../../../src/verify/gate-config/verification-manifest.ts"],"names":[],"mappings":"AA8DA;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,uBAAuB,CAAC;AAE7D;;;;;;;GAOG;AACH,MAAM,WAAW,cAAc;IAC7B,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,mBAAmB,CAAC;IACtC,+FAA+F;IAC/F,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,+EAA+E;IAC/E,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,cAAc,CAAC;CAC7B;AAED,iDAAiD;AACjD,eAAO,MAAM,sBAAsB,0BAA2B,CAAC;AAC/D,MAAM,MAAM,mBAAmB,GAAG,OAAO,sBAAsB,CAAC,MAAM,CAAC,CAAC;AAExE,uDAAuD;AACvD,eAAO,MAAM,iBAAiB,0BAA2B,CAAC;AAC1D,MAAM,MAAM,cAAc,GAAG,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC;AAE9D,0EAA0E;AAC1E,eAAO,MAAM,uBAAuB,YAAY,CAAC;AAEjD,wGAAwG;AACxG,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,qDAAqD;IACrD,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9B,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;CAChC;AAQD,qFAAqF;AACrF,MAAM,MAAM,oBAAoB,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,KAAK,cAAc,GAAG,SAAS,CAAC;AAEhG,0DAA0D;AAC1D,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAElE;AAsFD,8GAA8G;AAC9G,wBAAgB,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,YAAY,CAAC,GAAG,SAAS,GAAG,OAAO,CAE9F;AAYD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,EAAE,EAAE,gBAAgB,GAAG,cAAc,GAAG,SAAS,CAqDrH;AAED,wGAAwG;AACxG,eAAO,MAAM,kBAAkB,EAAE,oBAAoF,CAAC;AAEtH;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GAAG,MAAM,GAAG,SAAS,CAOzG"}
+{"version":3,"file":"verification-manifest.d.ts","sourceRoot":"","sources":["../../../src/verify/gate-config/verification-manifest.ts"],"names":[],"mappings":"AA8DA;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,uBAAuB,CAAC;AAE7D;;;;;;;GAOG;AACH,MAAM,WAAW,cAAc;IAC7B,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,mBAAmB,CAAC;IACtC,+FAA+F;IAC/F,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,+EAA+E;IAC/E,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,iDAAiD;AACjD,eAAO,MAAM,sBAAsB,0BAA2B,CAAC;AAC/D,MAAM,MAAM,mBAAmB,GAAG,OAAO,sBAAsB,CAAC,MAAM,CAAC,CAAC;AAExE,uDAAuD;AACvD,eAAO,MAAM,iBAAiB,0BAA2B,CAAC;AAC1D,MAAM,MAAM,cAAc,GAAG,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC;AAE9D,0EAA0E;AAC1E,eAAO,MAAM,uBAAuB,YAAY,CAAC;AAEjD,wGAAwG;AACxG,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,qDAAqD;IACrD,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9B,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;CAChC;AAQD,qFAAqF;AACrF,MAAM,MAAM,oBAAoB,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,KAAK,cAAc,GAAG,SAAS,CAAC;AAEhG,0DAA0D;AAC1D,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAElE;AAsFD,8GAA8G;AAC9G,wBAAgB,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,YAAY,CAAC,GAAG,SAAS,GAAG,OAAO,CAE9F;AAoBD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,EAAE,EAAE,gBAAgB,GAAG,cAAc,GAAG,SAAS,CAuDrH;AAED,wGAAwG;AACxG,eAAO,MAAM,kBAAkB,EAAE,oBAAoF,CAAC;AAEtH;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GAAG,MAAM,GAAG,SAAS,CAOzG"}

package/dist/verify/gate-config/verification-manifest.js

@@ -172,6 +172,15 @@ function optionalGateRunner(raw, path) {
     }
     return { gateRunner: runner };
 }
+/** Validate the optional failure-record declaration (present-but-not-boolean is malformed, like every key). */
+function optionalCiFailureRecords(raw, path) {
+    const value = raw.ciFailureRecords;
+    if (value === undefined)
+        return {};
+    if (typeof value !== 'boolean')
+        manifestError(path, `"ciFailureRecords" must be true or false (got ${JSON.stringify(value)})`);
+    return { ciFailureRecords: value };
+}
 /**
  * Read the repo's verification manifest through `fs`.
  *
@@ -187,7 +196,7 @@ function optionalGateRunner(raw, path) {
  *          `rerunMaxFailures` / carries an unknown `completionJudge`, a
  *          `completionCommand` that is not a non-empty string, a non-positive
  *          `completionTimeoutMs`, or a completion command beside `"ci"` /
- *          carries an unknown `gateRunner`.
+ *          carries an unknown `gateRunner` / carries a non-boolean `ciFailureRecords`.
  */
 export function readVerifyManifestFrom(repoPath, fs) {
     if (!repoPath)
@@ -228,6 +237,7 @@ export function readVerifyManifestFrom(repoPath, fs) {
     const rerun = optionalRerun(raw, path);
     const completion = optionalCompletion(raw, path);
     const gateRunner = optionalGateRunner(raw, path);
+    const ciFailureRecords = optionalCiFailureRecords(raw, path);
     return {
         command,
         ...(timeoutMs !== undefined ? { timeoutMs } : {}),
@@ -236,6 +246,7 @@ export function readVerifyManifestFrom(repoPath, fs) {
         ...rerun,
         ...completion,
         ...gateRunner,
+        ...ciFailureRecords,
     };
 }
 /** Read the repo's verification manifest from the working tree on disk (see readVerifyManifestFrom). */