@yagni-app/code-staging 0.3.2-staging.1114.1 → 0.3.2-staging.1119.1

package/dist/cli.js

@@ -22,6 +22,7 @@ import { claudeCompatArgs } from "./claudeCompat.js";
 import { agentDir, credentialsDir, piPackageDir } from "./credentials.js";
 import { DISTRIBUTION } from "./distribution.js";
 import { connectCommand } from "./connectClaudeCode.js";
+import { goCommand } from "./goHeadless.js";
 import { login } from "./login.js";
 import { logout } from "./logout.js";
 import { tokenCommand } from "./token.js";
@@ -288,6 +289,10 @@ export const HELP_TEXT = [
     "  yagni login              Authorize the active environment (device-code flow).",
     "  yagni logout             Revoke and clear the active environment's token.",
     "  yagni doctor             Check that everything is ready (green/red checklist).",
+    "  yagni go --headless      Run the /go pipeline without a session, for scripts",
+    "                           and CI: --ticket-file <path> [--plan-file <path>]",
+    "                           [--memo-file <path>] [--run-id <id>] [--json].",
+    "                           Exits 0 only on a reviewed, verified candidate.",
     "  yagni connect claude-code  Route Claude Code through the YAGNI model proxy",
     "                           (--project scopes to this repo; --off disconnects).",
     "  yagni connect codex      Route Codex CLI through the YAGNI model proxy.",
@@ -313,6 +318,8 @@ export const HELP_TEXT = [
     "The active environment is sticky; `use` switches it (prod is the default).",
     "Set YAGNI_BASE_URL to override the base URL for a single run.",
     "Set YAGNI_DISABLE_UPDATE_CHECK=1 to silence the new-version notice.",
+    "Set YAGNI_GO_TIER_CAP=<tier> to cap every pipeline stage at that tier",
+    "  (peak, advanced, standard, efficient). For eval and smoke lanes only.",
     "Set YAGNI_DISABLE_CLAUDE_COMPAT=1 to skip loading .claude assets.",
     "Set YAGNI_DISABLE_BRANDING=1 to pass the system prompt through unmodified.",
     "Set YAGNI_DISABLE_CRASH_REPORTS=1 to turn off sanitized crash reports.",
@@ -424,6 +431,12 @@ export async function main(argv) {
     if (command === "connect") {
         return connectCommand(rest);
     }
+    // The headless pipeline entry. `go` is a real subcommand, not passthrough:
+    // the interactive run stays `/go` inside a session, and a `yagni go` without
+    // --headless is refused with usage rather than launched as an agent prompt.
+    if (command === "go") {
+        return goCommand(rest, {}, cliVersion());
+    }
     if (command === "token") {
         return tokenCommand();
     }

package/dist/extension/index.d.ts

@@ -149,6 +149,11 @@ export { registerGoCommand } from "./pipeline/goCommand.js";
 export type { RegisterGoDeps } from "./pipeline/goCommand.js";
 export { runPipeline } from "./pipeline/orchestrator.js";
 export type { RunPipelineDeps } from "./pipeline/orchestrator.js";
+export { HEADLESS_GO_EXIT, HEADLESS_GO_USAGE, parseHeadlessGoArgs, runHeadlessGo, validateHeadlessGoArgs, } from "./pipeline/headlessGo.js";
+export type { HeadlessGoArgs, HeadlessGoDeps, HeadlessGoOutcome, HeadlessGoResult, HeadlessStageRow, } from "./pipeline/headlessGo.js";
+export { isMissionMode, missionSeed, missionSkippedStages, normalizeMission } from "./pipeline/mission.js";
+export type { MissionInputs } from "./pipeline/mission.js";
+export { clampTier, parseTierCap, resolveTierCap, TIER_CAP_ENV } from "./pipeline/tierCap.js";
 export { withResilience, classifyTransient, composeAbortSignal } from "./pipeline/resilience.js";
 export type { ResilienceAttemptRecord, ResilienceSeams, RunStageFn } from "./pipeline/resilience.js";
 export { DEFAULT_RESILIENCE_POLICY } from "./pipeline/types.js";

package/dist/extension/index.js

@@ -140,7 +140,12 @@ export async function registerYagni(pi, deps = {}) {
     // `yagni` provider, so /model and Ctrl+P show a single entry. Child
     // processes (/go, subagents, advisor) fetch their own catalog and register
     // their own provider, so they are unaffected by this filter.
-    const catalog = fullCatalog.filter((m) => m.id === "advanced");
+    //
+    // Eval mode is exempt: a headless harness (scoping sessions, code evals)
+    // names its tier explicitly — the backend's scoping sessions run `--model
+    // standard` — and there is no /model picker to keep tidy. Filtering there
+    // turns a valid tier request into "no models match".
+    const catalog = evalMode ? fullCatalog : fullCatalog.filter((m) => m.id === "advanced");
     // YAG-471: the driver's own completions carry attribution headers read from
     // this process's env (YAGNI_SESSION_ID minted by the launcher; YAGNI_CALLER
     // defaults to "driver" when unset, i.e. every session that is not a /go
@@ -207,6 +212,10 @@ export async function registerYagni(pi, deps = {}) {
     // The grounded multi-agent pipeline entry point: /go <ticket> runs
     // map → plan → implement → review → fix, each child grounded by inheritance.
     registerGoCommand(pi, {
+        // /ultra is one dial for the whole session: the same holder the subagent
+        // tool reads widens the implement diamond's parallel ceiling (4 -> 8) for
+        // the fan and its fix turns. Read per run, so a toggle lands on the next /go.
+        isUltra: () => ultraHolder.get(),
         // Task 8: /go's end-of-run summary prefers the server-priced per-stage
         // breakdown for the ONE run that just finished (`?runId=`, aliasing the
         // spend endpoint's `sessionId` param — see the backend route), over
@@ -875,6 +884,14 @@ export { attributionHeaders, isDriverCaller, fetchCatalog, getToken, getWorkspac
 export { buildYagniProvider } from "./provider.js";
 export { registerGoCommand } from "./pipeline/goCommand.js";
 export { runPipeline } from "./pipeline/orchestrator.js";
+// The headless front door (`yagni go --headless`): the same pipeline, driven by
+// a script or the mission sandbox instead of a session.
+export { HEADLESS_GO_EXIT, HEADLESS_GO_USAGE, parseHeadlessGoArgs, runHeadlessGo, validateHeadlessGoArgs, } from "./pipeline/headlessGo.js";
+// Mission mode: the pure rules for entering the pipeline on an already-approved
+// plan (map/plan skipped, memo as the stand-in repo brief, FINISH not ours).
+export { isMissionMode, missionSeed, missionSkippedStages, normalizeMission } from "./pipeline/mission.js";
+// The eval/smoke tier ceiling (YAGNI_GO_TIER_CAP), clamped centrally in runStage.
+export { clampTier, parseTierCap, resolveTierCap, TIER_CAP_ENV } from "./pipeline/tierCap.js";
 // R1: the in-loop resilience HOF a dev can compose with (or replace at) the
 // `runStage` seam, plus its policy type and the default policy.
 export { withResilience, classifyTransient, composeAbortSignal } from "./pipeline/resilience.js";

package/dist/extension/pipeline/activityFeed.js

@@ -92,9 +92,10 @@ export class ActivityFeed {
     }
     /** Fold a structured progress signal into stage transitions + the header tally. */
     applyProgress(p) {
-        // A per-lens signal is a desktop concern: it must not steal the buffer from
-        // the review stage that owns it, nor reset it mid fan-out.
-        if (p.kind === "stage_start" && !p.lens && p.stageId !== this.bufferStageId) {
+        // A per-lens or per-workstream signal is a desktop concern: it must not steal
+        // the buffer from the stage that owns it, nor reset it mid fan-out. The
+        // implement diamond's builders get exactly the review lenses' treatment.
+        if (p.kind === "stage_start" && !p.lens && !p.workstream && p.stageId !== this.bufferStageId) {
             this.bufferStageId = p.stageId;
             this.actions = [];
         }
@@ -129,6 +130,10 @@ export class ActivityFeed {
             headerParts.push(elapsed);
         const header = theme.bold(clipRow(headerParts.join(" · "), ROW_MAX));
         const lines = [header];
+        // The implement diamond collapses to ONE row plus a compact summary, the same
+        // way the review fan-out collapses to one review row: per-child rows are the
+        // desktop's business and would break the 10-line cap here.
+        const fan = this.run.fanoutRow();
         // Only the lens-less stage rows: the review fan-out's per-lens children are
         // the desktop's business, and surfacing them here would break the 10-line cap.
         for (const s of this.run.stageAgents()) {
@@ -138,8 +143,17 @@ export class ActivityFeed {
             if (s.id === "finish" && s.status === "pending")
                 continue;
             const glyph = glyphForStatus(s.status, spinnerFrame);
-            const label = s.stageId.padEnd(9);
-            const row = clipRow(`${glyph} ${label}${s.summary}`.trimEnd(), ROW_MAX);
+            // Padded past the longest stage name ("implement", 9) so every row keeps a
+            // separator between the label and its note; at 9 the implement row ran its
+            // name straight into its own summary.
+            const label = s.stageId.padEnd(10);
+            // While the fan is live the implement row's note IS the fan summary; once
+            // the stage settles its own narration takes the row back (and the summary
+            // stands in when there is no narration to show).
+            const fanNote = s.stageId === "implement" && fan?.mode === "fan" && (s.status === "active" || !s.summary)
+                ? `fanned ${fan.total} ways · ${fan.done}/${fan.total} done`
+                : undefined;
+            const row = clipRow(`${glyph} ${label}${fanNote ?? s.summary}`.trimEnd(), ROW_MAX);
             lines.push(theme.fg(themeColorForStatus[s.status], row));
             // The ring buffer renders under its OWNING stage (see RunState), so a
             // just-finished stage's resolved actions stay briefly visible beneath its ✔

package/dist/extension/pipeline/checker.d.ts

@@ -0,0 +1,99 @@
+/**
+ * PURE checker-side helpers for the implement diamond (spec decisions 5-7).
+ *
+ * The checker itself is deterministic and lives in `verify.ts` (the per-workstream
+ * scoped typecheck plus the one full `makeRunVerify` on the merged tree). What is
+ * left is the reading of its verdict, and that is all pure text math:
+ *
+ *  - {@link checkerFindings} unions the scoped + full findings into one deduped list.
+ *  - {@link composeSynthesizerInput} turns the fan handoff plus the checker's
+ *    verdict into the synthesizer's `{previous}`.
+ *  - {@link attributeFindings} routes each finding to the workstream whose claims
+ *    cover its file; anything unattributable is the synthesizer's (or, on the
+ *    single-writer path, the one builder's).
+ *  - {@link parseOpenFindings} reads the synthesizer's own "## Open findings"
+ *    section, because decision 7 lets the summary report defects the deterministic
+ *    checker cannot see.
+ *  - {@link composeResidue} names what is still open when the fix cap is reached,
+ *    so `reviewInput` hands the review loop the truth rather than a clean-looking
+ *    summary.
+ *
+ * No I/O, no model calls: the orchestrator owns the children, this module owns the
+ * reading, exactly the split `findings.ts` and `fanout.ts` already use.
+ */
+import { type PartitionWorkstream } from "./fanout.js";
+import type { Finding } from "./types.js";
+import type { VerifyOutcome, WorkstreamCheckResult } from "./verify.js";
+/** Everything the deterministic checker produced for one pass over the tree. */
+export interface CheckerReport {
+    /** Per-workstream scoped typecheck verdicts (empty on the single-writer path). */
+    scoped: WorkstreamCheckResult[];
+    /** The one full verify on the merged tree; null when it could not be consulted. */
+    verify: VerifyOutcome | null;
+}
+/** Findings routed to one workstream's builder for a fix turn. */
+export interface FindingAssignment {
+    workstream: PartitionWorkstream;
+    findings: Finding[];
+}
+/** How the fix loop splits a checker verdict across the children that can fix it. */
+export interface FindingAttribution {
+    assigned: FindingAssignment[];
+    /** Findings no workstream's claims cover: the synthesizer's seam work. */
+    unassigned: Finding[];
+}
+/** Union findings in first-seen order, deduped by file + line + message. */
+export declare function mergeFindings(...groups: Finding[][]): Finding[];
+/** Every defect this checker pass found: the scoped typechecks plus the full verify. */
+export declare function checkerFindings(report: CheckerReport): Finding[];
+/** One finding as a line a builder can act on (mirrors the review loop's handoff shape). */
+export declare function renderFindings(findings: Finding[]): string;
+/**
+ * The synthesizer's `{previous}`: the fan's own handoff (which already names each
+ * workstream, its claims, and any out-of-claim edits) plus the checker's verdict,
+ * with a broken workstream attributed BY NAME so the reconciler knows where to look.
+ */
+export declare function composeSynthesizerInput(handoff: string, report: CheckerReport): string;
+/**
+ * Route findings to the builders that can fix them: a finding whose file sits under
+ * a workstream's claims goes to that workstream (at its original tier), and anything
+ * else - no file, a file outside every claim, a seam between two workstreams - is
+ * unattributable and belongs to the synthesizer. With no workstreams (the
+ * single-writer path) everything is unassigned, which is exactly right: there is one
+ * builder and it owns the whole tree.
+ */
+export declare function attributeFindings(findings: Finding[], workstreams: PartitionWorkstream[]): FindingAttribution;
+/**
+ * The synthesizer's own "## Open findings" section (its persona output contract),
+ * as findings the fix loop can act on. "none" is a real answer and returns nothing;
+ * an absent section returns nothing too, because a summary that never claimed a
+ * defect is not evidence of one. Deliberately forgiving about the prose: what the
+ * loop needs is the line and, where the synthesizer named one, the file.
+ */
+export declare function parseOpenFindings(summary: string): Finding[];
+/**
+ * The same "## Open findings" section {@link parseOpenFindings} reads, REMOVED
+ * from a summary (heading and body, up to the next heading of any depth).
+ *
+ * A fix turn that only re-engaged builders never re-runs the synthesizer, so its
+ * summary stays the handoff verbatim. Once those defects are answered and the
+ * re-check is clean, leaving the section in place would hand the review loop a
+ * document that names open defects in one paragraph and calls the final check
+ * clean in the next. Everything else the synthesizer wrote is untouched: this
+ * drops only the section the fix loop has since resolved.
+ */
+export declare function stripOpenFindings(summary: string): string;
+/**
+ * What `reviewInput` says when the fix loop ran and then came back clean: the
+ * reviewers should know the candidate was repaired inside the implement stage, not
+ * that it was right first time. Absent when no fix turn ran, which keeps a
+ * clean-on-the-first-check run byte-identical to today's handoff.
+ */
+export declare function composeFixNote(turns: number): string;
+/**
+ * What `reviewInput` says when the fix cap is reached with defects still open
+ * (spec decision 7): named, not hidden, so the review loop picks them up knowing
+ * the implement stage already spent its turns on them.
+ */
+export declare function composeResidue(findings: Finding[], turns: number): string;
+//# sourceMappingURL=checker.d.ts.map

package/dist/extension/pipeline/checker.js

@@ -0,0 +1,238 @@
+/**
+ * PURE checker-side helpers for the implement diamond (spec decisions 5-7).
+ *
+ * The checker itself is deterministic and lives in `verify.ts` (the per-workstream
+ * scoped typecheck plus the one full `makeRunVerify` on the merged tree). What is
+ * left is the reading of its verdict, and that is all pure text math:
+ *
+ *  - {@link checkerFindings} unions the scoped + full findings into one deduped list.
+ *  - {@link composeSynthesizerInput} turns the fan handoff plus the checker's
+ *    verdict into the synthesizer's `{previous}`.
+ *  - {@link attributeFindings} routes each finding to the workstream whose claims
+ *    cover its file; anything unattributable is the synthesizer's (or, on the
+ *    single-writer path, the one builder's).
+ *  - {@link parseOpenFindings} reads the synthesizer's own "## Open findings"
+ *    section, because decision 7 lets the summary report defects the deterministic
+ *    checker cannot see.
+ *  - {@link composeResidue} names what is still open when the fix cap is reached,
+ *    so `reviewInput` hands the review loop the truth rather than a clean-looking
+ *    summary.
+ *
+ * No I/O, no model calls: the orchestrator owns the children, this module owns the
+ * reading, exactly the split `findings.ts` and `fanout.ts` already use.
+ */
+import { claimCovers } from "./fanout.js";
+/** Cap on how many open findings are ever carried into a prompt or the residue. */
+const MAX_CARRIED_FINDINGS = 25;
+const key = (f) => `${f.file ?? ""}:${f.line ?? ""}:${f.message}`;
+/** Union findings in first-seen order, deduped by file + line + message. */
+export function mergeFindings(...groups) {
+    const seen = new Set();
+    const out = [];
+    for (const group of groups) {
+        for (const f of group) {
+            const k = key(f);
+            if (seen.has(k))
+                continue;
+            seen.add(k);
+            out.push(f);
+        }
+    }
+    return out;
+}
+/** Every defect this checker pass found: the scoped typechecks plus the full verify. */
+export function checkerFindings(report) {
+    return mergeFindings(report.scoped.flatMap((s) => s.findings), report.verify?.findings ?? []);
+}
+/** One finding as a line a builder can act on (mirrors the review loop's handoff shape). */
+export function renderFindings(findings) {
+    return findings
+        .slice(0, MAX_CARRIED_FINDINGS)
+        .map((f) => {
+        const loc = f.file ? `${f.file}${f.line != null ? `:${f.line}` : ""}` : "";
+        return `${f.severity} | ${loc} | ${f.message}`;
+    })
+        .join("\n");
+}
+/** One workstream's scoped-typecheck line, stating honestly whether it ran. */
+function scopedLine(s) {
+    if (!s.ran)
+        return `- ${s.name}: not checked (${s.reason ?? "no scoped build check"})`;
+    if (s.findings.length === 0)
+        return `- ${s.name}: clean (${s.command ?? "check"})`;
+    return `- ${s.name}: ${s.findings.length} finding${s.findings.length === 1 ? "" : "s"} (${s.command ?? "check"})`;
+}
+/** The full verify's one-line verdict, including the fail-open case. */
+function verifyLine(verify) {
+    if (!verify)
+        return "The full verify did not run on this pass.";
+    if (!verify.ran)
+        return `The full verify did not produce a verdict: ${verify.reason ?? "it could not run"}.`;
+    const label = verify.command ? ` (${verify.command})` : "";
+    if (verify.ok)
+        return `The full verify passed${label}.`;
+    return `The full verify failed${label}: ${verify.findings.length} finding${verify.findings.length === 1 ? "" : "s"}.`;
+}
+/**
+ * The synthesizer's `{previous}`: the fan's own handoff (which already names each
+ * workstream, its claims, and any out-of-claim edits) plus the checker's verdict,
+ * with a broken workstream attributed BY NAME so the reconciler knows where to look.
+ */
+export function composeSynthesizerInput(handoff, report) {
+    const parts = [handoff];
+    if (report.scoped.length > 0) {
+        parts.push(["## Checker: scoped typecheck per workstream", ...report.scoped.map(scopedLine)].join("\n"));
+    }
+    parts.push(`## Checker: full verify on the merged tree\n${verifyLine(report.verify)}`);
+    const findings = checkerFindings(report);
+    if (findings.length > 0) {
+        parts.push(`## Checker findings\n${renderFindings(findings)}`);
+    }
+    return parts.join("\n\n");
+}
+/** The workstream whose claims cover this finding's file, if exactly one does. */
+function ownerOf(finding, workstreams) {
+    const file = finding.file?.trim();
+    if (!file)
+        return undefined;
+    return workstreams.find((w) => w.files.some((claim) => claimCovers(claim, file)));
+}
+/**
+ * Route findings to the builders that can fix them: a finding whose file sits under
+ * a workstream's claims goes to that workstream (at its original tier), and anything
+ * else - no file, a file outside every claim, a seam between two workstreams - is
+ * unattributable and belongs to the synthesizer. With no workstreams (the
+ * single-writer path) everything is unassigned, which is exactly right: there is one
+ * builder and it owns the whole tree.
+ */
+export function attributeFindings(findings, workstreams) {
+    const assigned = [];
+    const unassigned = [];
+    for (const finding of findings) {
+        const owner = ownerOf(finding, workstreams);
+        if (!owner) {
+            unassigned.push(finding);
+            continue;
+        }
+        const existing = assigned.find((a) => a.workstream.name === owner.name);
+        if (existing)
+            existing.findings.push(finding);
+        else
+            assigned.push({ workstream: owner, findings: [finding] });
+    }
+    return { assigned, unassigned };
+}
+/** A heading line, at any depth: `## Open findings`. */
+const HEADING = /^#{1,6}\s+(.*)$/;
+/** `path/to/file.ts` or `path/to/file.ts:42` — a path token, not prose. */
+const PATH_SHAPE = /^[\w./@-]+\.[A-Za-z]{1,5}(?::\d+)?$/;
+/**
+ * The first path-shaped token in a synthesizer's finding line (backticked first,
+ * since that is how the persona writes paths), with any `:line` suffix dropped so
+ * it compares against claim prefixes. Undefined when the line names no file, which
+ * makes the finding unattributable and therefore the synthesizer's own.
+ */
+function pathIn(line) {
+    const quoted = [...line.matchAll(/`([^`]+)`/g)].map((m) => m[1].trim());
+    for (const token of [...quoted, ...line.split(/[\s,;()[\]]+/)]) {
+        const clean = token.replace(/[.,;:]+$/, "");
+        if (clean.includes("/") && PATH_SHAPE.test(clean))
+            return clean.replace(/:\d+$/, "");
+    }
+    return undefined;
+}
+/**
+ * The synthesizer's own "## Open findings" section (its persona output contract),
+ * as findings the fix loop can act on. "none" is a real answer and returns nothing;
+ * an absent section returns nothing too, because a summary that never claimed a
+ * defect is not evidence of one. Deliberately forgiving about the prose: what the
+ * loop needs is the line and, where the synthesizer named one, the file.
+ */
+export function parseOpenFindings(summary) {
+    const lines = summary.split("\n");
+    const start = lines.findIndex((l) => {
+        const m = l.trim().match(HEADING);
+        return m ? /^open findings\b/i.test(m[1].trim()) : false;
+    });
+    if (start < 0)
+        return [];
+    const body = [];
+    for (const raw of lines.slice(start + 1)) {
+        if (HEADING.test(raw.trim()))
+            break;
+        const line = raw.trim().replace(/^[-*]\s+/, "").trim();
+        if (line)
+            body.push(line);
+    }
+    if (body.length === 0)
+        return [];
+    if (body.length === 1 && /^none\b/i.test(body[0].replace(/[.*_`]/g, "")))
+        return [];
+    return body.slice(0, MAX_CARRIED_FINDINGS).map((line) => {
+        const file = pathIn(line);
+        const finding = {
+            severity: "critical",
+            lens: "does_it_hold",
+            message: `synthesizer: ${line}`,
+        };
+        if (file)
+            finding.file = file;
+        return finding;
+    });
+}
+/**
+ * The same "## Open findings" section {@link parseOpenFindings} reads, REMOVED
+ * from a summary (heading and body, up to the next heading of any depth).
+ *
+ * A fix turn that only re-engaged builders never re-runs the synthesizer, so its
+ * summary stays the handoff verbatim. Once those defects are answered and the
+ * re-check is clean, leaving the section in place would hand the review loop a
+ * document that names open defects in one paragraph and calls the final check
+ * clean in the next. Everything else the synthesizer wrote is untouched: this
+ * drops only the section the fix loop has since resolved.
+ */
+export function stripOpenFindings(summary) {
+    const lines = summary.split("\n");
+    const start = lines.findIndex((l) => {
+        const m = l.trim().match(HEADING);
+        return m ? /^open findings\b/i.test(m[1].trim()) : false;
+    });
+    if (start < 0)
+        return summary;
+    let end = lines.length;
+    for (let i = start + 1; i < lines.length; i += 1) {
+        if (HEADING.test(lines[i].trim())) {
+            end = i;
+            break;
+        }
+    }
+    return [...lines.slice(0, start), ...lines.slice(end)].join("\n").replace(/\n{3,}/g, "\n\n").trimEnd();
+}
+/**
+ * What `reviewInput` says when the fix loop ran and then came back clean: the
+ * reviewers should know the candidate was repaired inside the implement stage, not
+ * that it was right first time. Absent when no fix turn ran, which keeps a
+ * clean-on-the-first-check run byte-identical to today's handoff.
+ */
+export function composeFixNote(turns) {
+    return [
+        "## Verification",
+        `${turns} fix pass${turns === 1 ? "" : "es"} ran inside the implement stage. The final check came back clean.`,
+    ].join("\n");
+}
+/**
+ * What `reviewInput` says when the fix cap is reached with defects still open
+ * (spec decision 7): named, not hidden, so the review loop picks them up knowing
+ * the implement stage already spent its turns on them.
+ */
+export function composeResidue(findings, turns) {
+    const header = turns === 0
+        ? "## Open findings from verification"
+        : `## Open findings after ${turns} fix pass${turns === 1 ? "" : "es"}`;
+    return [
+        header,
+        "Verification still reports these. They were not resolved inside the implement stage:",
+        renderFindings(findings),
+    ].join("\n");
+}
+//# sourceMappingURL=checker.js.map

package/dist/extension/pipeline/fanout.d.ts

@@ -0,0 +1,116 @@
+/**
+ * PURE partition contract for the implement diamond — the analogue of
+ * `findings.ts` for the fan-out orchestrator's output.
+ *
+ * `parsePartition` reads the orchestrator child's fenced ```partition JSON block
+ * and validates it against the contract (spec "Partition contract"): mode legal,
+ * width in {2,4,8} with a matching workstream count, per-workstream tier legal
+ * (absent defaults to `standard`), every workstream named + tasked with at least
+ * one file claim, and claims pairwise DISJOINT across workstreams.
+ *
+ * Two failure kinds, deliberately distinct because the pipeline treats them
+ * differently:
+ *  - SOFT (`hard: false`): malformed block, illegal field, missing reason. The
+ *    caller gets one cheap-tier format re-ask and then degrades to single-writer.
+ *    A partition is never guessed.
+ *  - HARD (`hard: true`): overlapping claims. Two writers on one file is the one
+ *    thing the design refuses to discover at merge time, so it fails the stage at
+ *    partition time with the colliding paths and workstreams named. The caller
+ *    (orchestrator) raises it as a `PipelineStageError`; keeping the throw out of
+ *    here keeps this module pure and free of an import cycle.
+ *
+ * `auditClaims` is the post-fan check: claims are path PREFIXES (a directory
+ * claims its whole subtree), so a file a builder legitimately created inside its
+ * claimed directory is in-claim, and anything else is named as a violation for
+ * the synthesizer to reconcile.
+ */
+import type { FanoutMode } from "./types.js";
+/** The tiers a workstream may run on: load-bearing work standard, mechanical work efficient. */
+export type WorkstreamTier = "standard" | "efficient";
+/**
+ * The `go.fanout` knob's environment surface (spec decision 8), named the way
+ * `YAGNI_GO_TIER_CAP` is (see tierCap.ts): a run-wide /go setting an eval or
+ * benchmark lane pins from the outside. `always` forces the diamond attempt;
+ * unset (everywhere else) leaves the partitioner's own conservative verdict as
+ * the only thing that decides.
+ */
+export declare const FANOUT_MODE_ENV = "YAGNI_GO_FANOUT";
+/**
+ * Parse a raw env value into a mode. Unset, empty, or unrecognized all yield
+ * undefined so a caller can warn about a typo; {@link resolveFanoutMode} is what
+ * turns that into the safe `auto` default. A typo must never pin a lane.
+ */
+export declare function parseFanoutMode(raw: string | undefined): FanoutMode | undefined;
+/** The run's fan-out mode from an environment. Defaults to `auto`. */
+export declare function resolveFanoutMode(env: NodeJS.ProcessEnv): FanoutMode;
+/** The only legal fan widths (execution concurrency is capped separately by the session). */
+export declare const PARTITION_WIDTHS: readonly [2, 4, 8];
+export type PartitionWidth = (typeof PARTITION_WIDTHS)[number];
+/** One workstream: a named, tasked builder with a disjoint set of prefix claims. */
+export interface PartitionWorkstream {
+    name: string;
+    task: string;
+    /** Normalized, deduped path prefixes; a directory claim covers its subtree. */
+    files: string[];
+    tier: WorkstreamTier;
+}
+/** The orchestrator's verdict: fan into workstreams, or run today's single writer. */
+export interface PartitionDecision {
+    mode: "fan" | "single";
+    /** Fan only; always equals `workstreams.length`. */
+    width?: PartitionWidth;
+    /** Always present: why this width, or why single-writer. */
+    reason: string;
+    /** Fan only. */
+    workstreams?: PartitionWorkstream[];
+}
+/** One pair of colliding claims across two workstreams. */
+export interface ClaimCollision {
+    path: string;
+    otherPath: string;
+    workstreams: [string, string];
+}
+/**
+ * Parse outcome. `ok: false` splits into the re-askable soft rejection and the
+ * hard overlap error (see the module comment).
+ */
+export type PartitionParse = {
+    ok: true;
+    decision: PartitionDecision;
+} | {
+    ok: false;
+    hard: false;
+    reason: string;
+} | {
+    ok: false;
+    hard: true;
+    reason: string;
+    collisions: ClaimCollision[];
+};
+/** Extract the inner text of a fenced ```partition block, if present. */
+export declare function extractPartitionBlock(raw: string): string | null;
+/**
+ * Normalize a claim or changed path for prefix comparison: trim, convert
+ * backslashes, collapse doubled slashes, drop interior `.` segments, a leading
+ * `./`, and trailing slashes. Purely lexical — no filesystem access. Without
+ * the collapse, `packages//backend` and `packages/./backend` pass disjointness
+ * against `packages/backend` while claiming the same directory — the exact
+ * two-writers-one-file outcome the partition-time hard error exists to prevent.
+ */
+export declare function normalizeClaimPath(path: string): string;
+/** True when `claim` is the path itself or a directory containing it. */
+export declare function claimCovers(claim: string, path: string): boolean;
+/**
+ * Parse the orchestrator's raw output into a {@link PartitionDecision}. Never
+ * throws: an unusable block is a soft rejection (re-ask, then single-writer) and
+ * overlapping claims are the hard rejection the caller turns into a stage error.
+ */
+export declare function parsePartition(raw: string): PartitionParse;
+/**
+ * Post-fan claim audit: the changed paths not covered by any workstream's claims,
+ * normalized, deduped, in first-seen order. Claims are prefixes, so a file created
+ * under a claimed directory is in-claim; anything else is a named violation the
+ * synthesizer reconciles.
+ */
+export declare function auditClaims(changedPaths: string[], workstreams: PartitionWorkstream[]): string[];
+//# sourceMappingURL=fanout.d.ts.map