@yagni-app/code-staging 1.2.10-staging.2105.1 → 1.2.10-staging.2111.1

package/dist/extension/pipeline/verify.d.ts

@@ -36,8 +36,9 @@
  * failures (connection refused, missing env, DB/auth, command not found) and
  * anything UNCERTAIN fail OPEN with an honest note, never a never-clearable
  * critical. A cloud session's gate (`unreadTestFailureIsFinding`) makes an
- * UNCERTAIN failure a finding carrying the output tail, unless the clean tree
- * failed the same command. On a build that named the repository's toolchain
+ * UNCERTAIN failure a finding carrying the output tail: it names nothing the
+ * unchanged code could already have, so it is never excused. On a build that
+ * named the repository's toolchain
  * (`YAGNI_TOOLCHAIN_FILE`, a sandbox) both halves run on it, as the model's
  * shell and the approved checks do ({@link buildGateVerifyEnv},
  * {@link buildGateTestEnv}).
@@ -52,6 +53,7 @@
  * findings, handoffs, or run records (§0.9).
  */
 import { type ToolchainFile } from "../toolchain/spawnHook.js";
+import { canonicalCheckCommand, type BaseMeasurement, type FailureAttribution } from "./checkAttribution.js";
 import { type FailedCheckResult, type MissionChecksFile } from "./missionChecks.js";
 import type { Finding } from "./types.js";
 /**
@@ -112,17 +114,13 @@ export interface VerifyOutcome {
 /** An approved check's name on the report: its command, cut at 80 characters. */
 export declare function checkLabel(command: string): string;
 /**
- * A command as the gate compares two: the same words, whatever spaces sit
- * between them, and a package manager's script named the one way it runs,
- * so `yarn test` and `yarn run test`, `npm test` and `npm run test`, `pnpm
- * lint` and `pnpm run lint` are one check, run once (staging bench
- * 2026-10-25: the gate's own `test` script and two approved twins ran one
- * suite three times). Only the leading form: a manager's flags before the
- * script leave the command as it is. The same rule as
- * `canonicalCheckCommand` in the backend's attempts/inputs.ts; both test
- * files read one corpus, test/fixtures/equivalentCheckCommands.json. Pure.
+ * A command as the gate compares two (staging bench 2026-10-25: the gate's
+ * own `test` script and two approved twins ran one suite three times):
+ * `checkAttribution.ts`, the one rule the host's attempts/inputs.ts keeps
+ * too; both test files read one corpus,
+ * test/fixtures/equivalentCheckCommands.json.
  */
-export declare function canonicalCheckCommand(command: string): string;
+export { canonicalCheckCommand };
 /**
  * True when a command changes the checkout's git state: a commit, a branch
  * created or switched, a reset, a stash, a push. `git branch`, `git remote`
@@ -367,7 +365,8 @@ export type TestFailureClassification = {
  *    prerequisite ({@link classifyMissingPrerequisite}, given the `env` the
  *    command ran under) is `infra` with `needs` and the cause "needs <it>".
  *  - recognisable failing-test lines (pnpm-wrapped vitest / jest / node:test
- *    TAP + spec reporters) → `failures` with located `critical` findings
+ *    TAP + spec reporters, pytest, Pest, PHPUnit, go test) → `failures` with
+ *    located `critical` findings
  *    (capped at 25, deduped, locations attached when the runner printed them).
  *  - a failure summary with no parseable per-test lines → one capped tail
  *    finding (still real evidence tests ran and failed).
@@ -404,33 +403,36 @@ export declare function parseVerifyFailures(output: string, exitCode: number, la
  */
 export declare function toRepoRelativePath(file: string, repoRoot: string, commandCwd: string): string;
 /**
- * What the gate's own checks already failed on before the build changed
- * anything (YAG-1003): per command, how many times each failure key was seen
- * on the clean tree. A command with no entry was not run there (or could not
- * run), and its failures all count, as before.
- */
-export type VerifyBaseline = ReadonlyMap<string, ReadonlyMap<string, number>>;
-/** One command's identity across the baseline run and the build's runs: where it runs and what it runs. */
-export declare function verifyCommandKey(command: Pick<VerifyCommand, "cwd" | "argv">): string;
-/**
- * One failure's key, the shape #2601's `failureKeyOf` gives a CI failure: the
- * repo-relative file and the message, never the line, since a change above a
- * failure moves it. A failure that is only the output's tail names nothing
- * stable, so it has no key and is never excused. Pure.
- */
-export declare function verifyFailureKey(finding: Finding): string | null;
-/** How many times each failure key occurs. Pure. */
-export declare function failureKeyCounts(findings: readonly Finding[]): Map<string, number>;
-/**
- * The failures this change caused: each failure key is excused at most as many
- * times as the clean tree had it, so a second copy of an old error is new. A
- * failure in a file the build did not touch still counts when the baseline did
- * not have it, since a change can break another file's types. No baseline for
- * the command leaves every failure in place. Pure.
- */
-export declare function subtractBaseline(findings: readonly Finding[], baseline: ReadonlyMap<string, number> | undefined): {
+ * What the gate's checks did on the unchanged code before the build changed
+ * anything (YAG-1003), by check id (`checkId`: the command and the folder it
+ * runs in): each that passed there, and each that failed with its failure
+ * keys. A check with no entry was not measured there (or gave no verdict),
+ * and its failures all count. The session measures each check once per
+ * attempt and base commit ({@link makeMeasureOnBase}); `checks.json` carries
+ * what the attempt's earlier sessions measured.
+ */
+export type BaseMeasurements = ReadonlyMap<string, Omit<BaseMeasurement, "id">>;
+/** A detected command's id, as the base measurement and the gate both key it. */
+export declare function commandCheckId(repoRoot: string, command: Pick<VerifyCommand, "cwd" | "argv">): string;
+/**
+ * One finding's failure key, in `checkAttribution.ts`'s shapes: a failing
+ * test's name, or a located diagnostic's repo-relative file and message,
+ * never its line, since a change above a failure moves it. A finding that is
+ * only the output's tail names nothing stable: null, and never excused. Read
+ * before the finding is prefixed with what ran. Pure.
+ */
+export declare function findingKey(finding: Finding): string | null;
+/**
+ * The failures this change caused, by `attributeFailure`: each failure the
+ * unchanged code already had is excused once, so a second copy of an old
+ * error is new, and a failure that names nothing never is. No measurement on
+ * the base leaves every failure in place. `keys` is index for index with
+ * `findings`. Pure.
+ */
+export declare function attributeFindings(findings: readonly Finding[], keys: ReadonlyArray<string | null>, base: Omit<BaseMeasurement, "id"> | undefined): {
     findings: Finding[];
     excused: number;
+    verdict: FailureAttribution;
 };
 /** The note for failures the clean tree already had, by command label. Pure. */
 export declare function preexistingNote(byLabel: ReadonlyMap<string, number>): string | null;
@@ -579,23 +581,18 @@ export interface MakeRunVerifyOpts {
     /** Undo what the half wrote into the tree (default: `git clean` / `git checkout` of exactly those paths). */
     undoTreeWrites?: (cwd: string, entries: TreeEntry[]) => Promise<void>;
     /**
-     * What the typecheck and test halves already failed on before the build
-     * (YAG-1003, {@link makeTakeVerifyBaseline}). Those failures are a note, not
-     * findings. Absent: every failure is a finding, as before.
-     */
-    baseline?: VerifyBaseline | null;
-    /**
-     * What the approved checks `checks.json` marks `measureOnBase` did on the
-     * unchanged code ({@link makeMeasureChecksOnBase}). It stands over each
-     * one's `status`: one that passed there must pass, and one that failed
-     * there is the change's only where it fails anew. Absent: `status` alone.
+     * What the gate's checks did on the unchanged code ({@link makeMeasureOnBase},
+     * and what `checks.json` carried from the attempt's earlier sessions). A
+     * failure is the change's unless `attributeFailure` finds the base already
+     * had it; a check with no measurement counts every failure, whatever label
+     * `checks.json` gave it. Absent: every failure is a finding.
      */
-    checksOnBase?: ChecksOnBase | null;
+    onBase?: BaseMeasurements | null;
     /**
      * The cloud session's rule (spec decision 3): a test run that exits
      * non-zero with output no parser reads is a finding carrying its output
-     * tail, unless the baseline saw the clean tree fail the same command, which
-     * is a note. Absent (mission mode): it fails open with a note, as before.
+     * tail. It names nothing the base could already have, so it is never
+     * excused. Absent (mission mode): it fails open with a note, as before.
      */
     unreadTestFailureIsFinding?: boolean;
     /**
@@ -646,8 +643,8 @@ export interface MakeWorkstreamCheckOpts {
     detect?: (cwd: string, claimDirs: string[]) => VerifyCommand[];
     exec?: VerifyExec;
     timeoutMs?: number;
-    /** What the clean tree already failed on (YAG-1003): those failures are not a workstream's. */
-    baseline?: VerifyBaseline | null;
+    /** What the unchanged code already failed on (YAG-1003): those failures are not a workstream's. */
+    onBase?: BaseMeasurements | null;
     /**
      * The toolchain the checks run on, as the full gate's do (default:
      * `YAGNI_TOOLCHAIN_FILE`, when it reads).
@@ -680,6 +677,27 @@ export interface MakeWorkstreamCheckOpts {
  * and produces no findings.
  */
 export declare function makeWorkstreamCheck(opts?: MakeWorkstreamCheckOpts): (cwd: string, targets: WorkstreamCheckTarget[], signal?: AbortSignal) => Promise<WorkstreamCheckResult[]>;
+/**
+ * A failing repository command's findings, located from the folder it ran in
+ * and prefixed with what ran, each with its failure key ({@link findingKey},
+ * index for index): the gate's on the build's tree, and the unchanged code's
+ * measurement ({@link makeMeasureOnBase}), so a failure keys the same on
+ * both. Pure.
+ */
+export declare function repoCommandFindings(failure: {
+    output: string;
+    code: number;
+    env?: NodeJS.ProcessEnv;
+}, at: {
+    label: string;
+    prefix: string;
+    repoRoot: string;
+    dir: string;
+    limit?: number;
+}): {
+    findings: Finding[];
+    keys: Array<string | null>;
+};
 /**
  * Build the runVerify function injected into the orchestrator. It discovers the
  * changed package(s) (scoped to this run's diff via `baselinePaths`), detects a
@@ -690,109 +708,90 @@ export declare function makeWorkstreamCheck(opts?: MakeWorkstreamCheckOpts): (cw
  * blocks a real change on its own failure.
  */
 export declare function makeRunVerify(opts?: MakeRunVerifyOpts): (cwd: string, signal?: AbortSignal, baselinePaths?: string[]) => Promise<VerifyOutcome>;
-/** The whole baseline run's cap, before the build starts: it costs minutes at most. */
-export declare const VERIFY_BASELINE_BUDGET_MS: number;
-export interface MakeTakeVerifyBaselineOpts {
-    detect?: (cwd: string, dirs: string[]) => VerifyCommand[];
-    detectTests?: (cwd: string, dirs: string[]) => VerifyCommand[];
+/** The whole base measurement's cap, before the build starts: it costs minutes at most. */
+export declare const BASE_MEASUREMENT_BUDGET_MS: number;
+/**
+ * One check to run once on the unchanged code: an approved check from
+ * `checks.json` (at the repository root, as the gate runs it), or one of the
+ * gate's own typecheck and test commands in a package the build will
+ * change, keyed (`id`) as the gate keys its run.
+ */
+export interface BaseTarget {
+    id: string;
+    label: string;
+    kind: "check" | "typecheck" | "test";
+    /** The command line, as the stream hears it. */
+    command: string;
+    argv: string[];
+    /** Where it runs (absolute). */
+    dir: string;
+}
+/**
+ * What the gate will judge, in the order it is measured: the approved
+ * checks `checks.json` marks `measureOnBase` (every one it can run with
+ * `allChecks`, a resumed session's rule: the record's green is what went
+ * stale), then the gate's own typecheck and test commands in `dirs`, the
+ * packages the build will change. Each once, by id; a check that changes the
+ * checkout's git state or that the sandbox cannot run is never one. Read on
+ * the tree as it is: the gate detects its commands on the build's tree, so
+ * these are the ids it will look up.
+ */
+export declare function baseTargets(cwd: string, input: {
+    dirs: string[];
+    checks: MissionChecksFile | null;
+    allChecks?: boolean;
+}, opts?: Pick<MakeRunVerifyOpts, "detect" | "detectTests">): BaseTarget[];
+export interface MakeMeasureOnBaseOpts {
     exec?: VerifyExec;
+    /** One typecheck's cap (default {@link VERIFY_TIMEOUT_MS}). */
     timeoutMs?: number;
+    /** One test run's cap (default {@link VERIFY_TEST_TIMEOUT_MS}). */
     testTimeoutMs?: number;
+    /** One approved check's cap (default {@link REPO_CHECK_TIMEOUT_MS}). */
+    repoCheckTimeoutMs?: number;
+    /** Env overrides for determinism in tests (default: the gate's own, per kind). */
     testEnv?: NodeJS.ProcessEnv;
-    /**
-     * The toolchain the commands run on, as the gate's do (default:
-     * `YAGNI_TOOLCHAIN_FILE`, when it reads).
-     */
+    repoChecksEnv?: NodeJS.ProcessEnv;
+    /** The toolchain the commands run on, as the gate's do (default: `YAGNI_TOOLCHAIN_FILE`, when it reads). */
     toolchain?: () => ToolchainFile | null;
     budgetMs?: number;
     now?: () => number;
     treeStatus?: (cwd: string, signal?: AbortSignal) => Promise<string>;
     undoTreeWrites?: (cwd: string, entries: TreeEntry[]) => Promise<void>;
-    /** Told as each command starts and ends on the clean tree (the session's stream). */
+    /** Told as each command starts and ends on the unchanged code (the session's stream). */
     onCheck?: (event: VerifyCheckEvent) => void;
 }
-/** What the baseline run found, for the gate and for the run's log. */
-export interface VerifyBaselineResult {
-    baseline: VerifyBaseline;
-    /** Commands that gave a verdict on the clean tree, by label. */
+/** What one measurement found, for the gate and for the run's log. */
+export interface BaseMeasurementResult {
+    /** Each target that gave a verdict, by id: it passed, or failed with these keys. */
+    measured: Map<string, Omit<BaseMeasurement, "id">>;
+    /** The labels of the targets that gave a verdict. */
     ran: string[];
-    /** Keyed failures the clean tree already had, across those commands. */
+    /** Keyed failures the unchanged code had, across them. */
     failures: number;
-    /** Commands that gave no verdict, and why: their failures all count later. */
-    notes: string[];
-}
-/**
- * Run the gate's own typecheck and test commands ONCE on the clean tree,
- * before the build changes anything (YAG-1003), in the package dirs the
- * approved plan names, and keep each command's failure keys. The build's gate
- * then counts only the failures this change added ({@link subtractBaseline}).
- *
- * The same detection, exec seam and environments as {@link makeRunVerify}, so
- * a command's key and its failures' keys match the build's runs. Fail-open per
- * command: one that cannot run, times out, or is not reached in the budget
- * has no baseline, and its failures all count, as before. What the commands
- * write into the tree is undone, so none of it reaches the candidate.
- */
-export declare function makeTakeVerifyBaseline(opts?: MakeTakeVerifyBaselineOpts): (cwd: string, dirs: string[], signal?: AbortSignal, budgetOverrideMs?: number) => Promise<VerifyBaselineResult>;
-/**
- * What the approved checks marked `measureOnBase` did on the unchanged code,
- * by command (trimmed): each that passed there, and each that failed there
- * with failures the gate reads, with how often each failure key was seen
- * (none for a failure only a summary line names). A command in neither gave
- * no verdict there, and keeps the status `checks.json` gave it.
- */
-export interface ChecksOnBase {
-    passed: ReadonlySet<string>;
-    failed: ReadonlyMap<string, ReadonlyMap<string, number>>;
-}
-/** {@link ChecksOnBase}, with what ran and why the rest gave no verdict, for the run's log. */
-export interface ChecksOnBaseResult extends ChecksOnBase {
-    ran: string[];
+    /** Targets that gave no verdict, and why: their failures all count later. */
     notes: string[];
     /**
-     * What the checks wrote into the tree was undone (or they wrote nothing).
-     * False when the tree could not be read before them or the undo failed:
-     * the build then starts on a tree the checks may have dirtied.
+     * What the commands wrote into the tree was undone (or they wrote
+     * nothing). False when the tree could not be read before them or the undo
+     * failed: the build then starts on a tree they may have dirtied.
      */
     treeUndone: boolean;
 }
 /**
- * The whole measurement's cap, before the build starts: each check marked to
- * measure, once, the plan's first.
- */
-export declare const CHECKS_ON_BASE_BUDGET_MS: number;
-export interface MakeMeasureChecksOnBaseOpts {
-    exec?: VerifyExec;
-    /** Repository-checks env override for determinism in tests (default: the gate's own). */
-    repoChecksEnv?: NodeJS.ProcessEnv;
-    toolchain?: () => ToolchainFile | null;
-    /** One check's cap (default {@link REPO_CHECK_TIMEOUT_MS}). */
-    timeoutMs?: number;
-    budgetMs?: number;
-    now?: () => number;
-    treeStatus?: (cwd: string, signal?: AbortSignal) => Promise<string>;
-    undoTreeWrites?: (cwd: string, entries: TreeEntry[]) => Promise<void>;
-    /** Told as each check starts and ends on the unchanged code (the session's stream). */
-    onCheck?: (event: VerifyCheckEvent) => void;
-}
-/**
- * Run each approved check `checks.json` marks `measureOnBase` once on the
- * unchanged code, before the build changes anything: a plan's check the
- * host has not seen pass there (none of the record's, or a red one the
- * record may hold from long ago), and a command the repository's CI runs
- * when the record names no check of its own. A check the plan wrote for the
- * change often fails there by design (its test file is not written yet), and a
- * failure that says only that (a file not found, no tests to run, output no
- * parser reads) is no verdict: its failures all count after the build, as
- * before. A failure the gate reads (failing tests, located diagnostics, a
- * test runner's failure summary) is one the unchanged code already has.
+ * Run each target ({@link baseTargets}) once on the unchanged code, before
+ * the build changes anything (YAG-1003), and keep what it did: passed, or
+ * failed with its failure keys ({@link findingKey}). The build's gate then
+ * counts only the failures the change added ({@link attributeFindings}).
  *
- * Run as the gate runs the check ({@link makeRunVerify}): the same command
- * line, environment and toolchain, from the repository root, so a failure
- * keys the same on both trees. Bounded: each check by its cap, the whole by
- * the budget, and one not reached in it has no verdict. What the checks
- * write into the tree is undone.
- */
-export declare function makeMeasureChecksOnBase(opts?: MakeMeasureChecksOnBaseOpts): (cwd: string, file: MissionChecksFile, signal?: AbortSignal, budgetOverrideMs?: number) => Promise<ChecksOnBaseResult>;
-export {};
+ * Each runs as the gate runs it, with the same command line, environment
+ * and toolchain, so a failure keys the same on both trees. A run that says
+ * only that it could not run (an infra failure, a path it reads not there,
+ * a command not found) gives no verdict, and its failures all count after
+ * the build. A test run or check whose output no parser reads failed there
+ * with no keys: nothing after the build is excused by it. Bounded: each by
+ * its cap, the whole by the budget, and a target not reached in it gives no
+ * verdict. What the commands write into the tree is undone.
+ */
+export declare function makeMeasureOnBase(opts?: MakeMeasureOnBaseOpts): (cwd: string, targets: readonly BaseTarget[], signal?: AbortSignal, budgetOverrideMs?: number) => Promise<BaseMeasurementResult>;
 //# sourceMappingURL=verify.d.ts.map