@yagni-app/code-staging 1.2.4-staging.1809.1 → 1.2.4-staging.1821.1

package/dist/extension/pipeline/headlessGo.d.ts

@@ -60,6 +60,7 @@
  */
 import { type TreeSnapshotDeps } from "./treeSnapshot.js";
 import { runPipeline as defaultRunPipeline } from "./orchestrator.js";
+import { makeRunVerify } from "./verify.js";
 import { type RunBudget } from "./budget.js";
 import type { Finding, JsonEvent, ModelTier, PipelineStage, StageId, StageTag, StageUsage, StopReason } from "./types.js";
 /** One-line usage copy, shared by every argument error. */
@@ -152,6 +153,11 @@ export interface HeadlessGoDeps {
     now?: () => number;
     runPipeline?: typeof defaultRunPipeline;
     readFile?: (path: string) => string;
+    /**
+     * The verify gate a mission run uses, given its `checks.json` (null when
+     * there is none). Defaults to the real gate; injected in tests.
+     */
+    makeRunVerify?: typeof makeRunVerify;
     /** stdout sink; one call per NDJSON line, newline added by the caller. */
     write?: (line: string) => void;
     /** stderr sink for human-readable problems. */

package/dist/extension/pipeline/headlessGo.js

@@ -59,12 +59,15 @@
  * ceilings (`SANDBOX_RUN_BUDGET`), not interactive /go's.
  */
 import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
 import { continuationResumePlan, parseContinuation } from "./continuation.js";
 import { resolveFanoutMode } from "./fanout.js";
 import { makeFanoutBeats } from "./fanoutBeats.js";
 import { normalizeMission } from "./mission.js";
+import { MISSION_CHECKS_FILE_NAME, readMissionChecksFile } from "./missionChecks.js";
 import { startTreeSnapshots } from "./treeSnapshot.js";
 import { runPipeline as defaultRunPipeline } from "./orchestrator.js";
+import { makeRunVerify } from "./verify.js";
 import { loadGroundingEnabled } from "../grounding.js";
 import { codeStateHome } from "../stateHome.js";
 import { parseTierCap, TIER_CAP_ENV } from "./tierCap.js";
@@ -319,6 +322,22 @@ export async function runHeadlessGo(argv, deps = {}) {
     // NDJSON stream as `pipeline_fanout` records, and the mission collector
     // folds them onto the Run.
     const fanoutBeats = makeFanoutBeats();
+    // A mission's approved checks and its pull request's CI jobs, written by the
+    // host beside the ticket: the verify gate runs them inside the loop. No file
+    // (a host that predates it) leaves the gate as it was.
+    let runVerify;
+    if (mission && args.ticketFile) {
+        const checksPath = join(dirname(args.ticketFile), MISSION_CHECKS_FILE_NAME);
+        const read = readMissionChecksFile(checksPath, readFile);
+        if (read.file) {
+            const checks = read.file;
+            runVerify = (deps.makeRunVerify ?? makeRunVerify)({ repoChecks: () => checks });
+        }
+        else if (read.problem !== "missing") {
+            const why = read.problem === "malformed" ? "not a version 1 checks file" : "it could not be read";
+            writeErr(`Ignoring ${checksPath}: ${why}. The verify gate runs its own checks only.`);
+        }
+    }
     const pipelineDeps = {
         cwd,
         childEnv,
@@ -337,6 +356,7 @@ export async function runHeadlessGo(argv, deps = {}) {
         ...(deps.stages ? { stages: deps.stages } : {}),
         grounded: deps.grounded ?? grounding,
         ...(mission ? { mission } : {}),
+        ...(runVerify ? { runVerify } : {}),
         ...(continuation ? { continuation: { stageAtStop: continuation.stageAtStop } } : {}),
         ...(resumeFrom ? { resumeFrom } : {}),
         onEvent: (ev, tag) => {

package/dist/extension/pipeline/missionChecks.d.ts

@@ -0,0 +1,66 @@
+/**
+ * `checks.json`, the mission file that hands the build's verify gate what to
+ * run besides its own detected scripts: the plan's approved checks (each with
+ * what the host already knows: it fails on the unchanged code, or the sandbox
+ * cannot start it) and the pull request's CI jobs, read from the repository's
+ * workflows at build time.
+ *
+ * The format's producer is `renderMissionChecksJson` in
+ * `packages/backend/src/integrations/e2b/missionFiles.ts`; this package does
+ * not depend on the backend, so it reads the same version 1 with its own
+ * parser. A change there is a change here. A file that is missing or does not
+ * read as version 1 means no repository checks, never a stopped build.
+ */
+export declare const MISSION_CHECKS_FILE_NAME = "checks.json";
+export type MissionCheckStatus = "runnable" | "fails_on_base" | "cannot_run";
+export interface MissionCheck {
+    command: string;
+    status: MissionCheckStatus;
+    cause?: string;
+}
+export interface MissionCiStep {
+    name: string;
+    run: string;
+    workingDirectory?: string;
+    env?: Record<string, string>;
+}
+export interface MissionCiJob {
+    workflow: string;
+    job: string;
+    name: string;
+    paths?: string[];
+    pathsIgnore?: string[];
+    steps: MissionCiStep[];
+    cannotRun: Array<{
+        step: string;
+        reason: string;
+    }>;
+}
+export interface MissionChecksFile {
+    version: 1;
+    checks: MissionCheck[];
+    ciJobs: MissionCiJob[];
+}
+/** The file, or null when the text is not a well-formed version 1 file. */
+export declare function parseMissionChecksFile(text: string): MissionChecksFile | null;
+/**
+ * Read the file. `missing` (no such file: a host that predates it, or a run
+ * with no mission) is silent; `unreadable` and `malformed` are the caller's to
+ * report once.
+ */
+export declare function readMissionChecksFile(path: string, readFile?: (path: string) => string): {
+    file: MissionChecksFile;
+} | {
+    file: null;
+    problem: "missing" | "unreadable" | "malformed";
+};
+/** GitHub's filter glob: `*` within one path segment, `**` across segments, `?` one character. */
+export declare function globToRegExp(pattern: string): RegExp;
+/**
+ * Whether a change to `changedPaths` runs this job on its pull request, by
+ * GitHub's rules: with `paths`, when any changed path matches; with
+ * `paths-ignore`, unless every changed path is ignored (a new folder is never
+ * taken as ignored). No filter: always. No changed paths: never.
+ */
+export declare function ciJobInScope(job: Pick<MissionCiJob, "paths" | "pathsIgnore">, changedPaths: readonly string[]): boolean;
+//# sourceMappingURL=missionChecks.d.ts.map

package/dist/extension/pipeline/missionChecks.js

@@ -0,0 +1,197 @@
+/**
+ * `checks.json`, the mission file that hands the build's verify gate what to
+ * run besides its own detected scripts: the plan's approved checks (each with
+ * what the host already knows: it fails on the unchanged code, or the sandbox
+ * cannot start it) and the pull request's CI jobs, read from the repository's
+ * workflows at build time.
+ *
+ * The format's producer is `renderMissionChecksJson` in
+ * `packages/backend/src/integrations/e2b/missionFiles.ts`; this package does
+ * not depend on the backend, so it reads the same version 1 with its own
+ * parser. A change there is a change here. A file that is missing or does not
+ * read as version 1 means no repository checks, never a stopped build.
+ */
+import { readFileSync } from "node:fs";
+export const MISSION_CHECKS_FILE_NAME = "checks.json";
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const isString = (value) => typeof value === "string";
+function stringList(value) {
+    return Array.isArray(value) && value.every(isString) ? value : null;
+}
+function stringRecord(value) {
+    if (!isRecord(value))
+        return null;
+    return Object.values(value).every(isString) ? value : null;
+}
+function parseStep(value) {
+    if (!isRecord(value) || !isString(value.name) || !isString(value.run))
+        return null;
+    const step = { name: value.name, run: value.run };
+    if (value.workingDirectory !== undefined) {
+        if (!isString(value.workingDirectory))
+            return null;
+        step.workingDirectory = value.workingDirectory;
+    }
+    if (value.env !== undefined) {
+        const env = stringRecord(value.env);
+        if (!env)
+            return null;
+        step.env = env;
+    }
+    return step;
+}
+function parseJob(value) {
+    if (!isRecord(value) ||
+        !isString(value.workflow) ||
+        !isString(value.job) ||
+        !isString(value.name))
+        return null;
+    if (!Array.isArray(value.steps) || !Array.isArray(value.cannotRun))
+        return null;
+    const steps = [];
+    for (const raw of value.steps) {
+        const step = parseStep(raw);
+        if (!step)
+            return null;
+        steps.push(step);
+    }
+    const cannotRun = [];
+    for (const raw of value.cannotRun) {
+        if (!isRecord(raw) || !isString(raw.step) || !isString(raw.reason))
+            return null;
+        cannotRun.push({ step: raw.step, reason: raw.reason });
+    }
+    const job = {
+        workflow: value.workflow,
+        job: value.job,
+        name: value.name,
+        steps,
+        cannotRun,
+    };
+    for (const key of ["paths", "pathsIgnore"]) {
+        if (value[key] === undefined)
+            continue;
+        const list = stringList(value[key]);
+        if (!list)
+            return null;
+        job[key] = list;
+    }
+    return job;
+}
+/** The file, or null when the text is not a well-formed version 1 file. */
+export function parseMissionChecksFile(text) {
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        // Not JSON: the caller reports the null.
+        return null;
+    }
+    if (!isRecord(parsed) ||
+        parsed.version !== 1 ||
+        !Array.isArray(parsed.checks) ||
+        !Array.isArray(parsed.ciJobs)) {
+        return null;
+    }
+    const checks = [];
+    for (const raw of parsed.checks) {
+        if (!isRecord(raw) || !isString(raw.command))
+            return null;
+        if (raw.status !== "runnable" && raw.status !== "fails_on_base" && raw.status !== "cannot_run")
+            return null;
+        const check = { command: raw.command, status: raw.status };
+        if (isString(raw.cause))
+            check.cause = raw.cause;
+        checks.push(check);
+    }
+    const ciJobs = [];
+    for (const raw of parsed.ciJobs) {
+        const job = parseJob(raw);
+        if (!job)
+            return null;
+        ciJobs.push(job);
+    }
+    return { version: 1, checks, ciJobs };
+}
+/**
+ * Read the file. `missing` (no such file: a host that predates it, or a run
+ * with no mission) is silent; `unreadable` and `malformed` are the caller's to
+ * report once.
+ */
+export function readMissionChecksFile(path, readFile = (p) => readFileSync(p, "utf8")) {
+    let text;
+    try {
+        text = readFile(path);
+    }
+    catch (err) {
+        const code = isRecord(err) && typeof err.code === "string" ? err.code : null;
+        return { file: null, problem: code === "ENOENT" ? "missing" : "unreadable" };
+    }
+    const file = parseMissionChecksFile(text);
+    return file ? { file } : { file: null, problem: "malformed" };
+}
+/** GitHub's filter glob: `*` within one path segment, `**` across segments, `?` one character. */
+export function globToRegExp(pattern) {
+    let source = "";
+    for (let index = 0; index < pattern.length; index += 1) {
+        const char = pattern[index];
+        if (char === "*" && pattern[index + 1] === "*") {
+            source += ".*";
+            index += 1;
+        }
+        else if (char === "*") {
+            source += "[^/]*";
+        }
+        else if (char === "?") {
+            source += "[^/]";
+        }
+        else {
+            source += char.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+        }
+    }
+    return new RegExp(`^${source}$`);
+}
+/** The part of a pattern before its first glob character. */
+function literalPrefix(pattern) {
+    const at = pattern.search(/[*?[]/);
+    return at < 0 ? pattern : pattern.slice(0, at);
+}
+/**
+ * Whether one changed path matches a pattern. Porcelain reports a new
+ * untracked folder as `dir/`, not its files: it matches when the pattern's
+ * literal start and the folder overlap, so a doubt runs the job.
+ */
+function pathMatches(pattern, path) {
+    if (!path.endsWith("/"))
+        return globToRegExp(pattern).test(path);
+    const prefix = literalPrefix(pattern);
+    return prefix.startsWith(path) || path.startsWith(prefix);
+}
+/** An ordered list with `!` exclusions: the last pattern that matches decides. */
+function listMatches(patterns, path) {
+    let matched = false;
+    for (const raw of patterns) {
+        const negated = raw.startsWith("!");
+        if (pathMatches(negated ? raw.slice(1) : raw, path))
+            matched = !negated;
+    }
+    return matched;
+}
+/**
+ * Whether a change to `changedPaths` runs this job on its pull request, by
+ * GitHub's rules: with `paths`, when any changed path matches; with
+ * `paths-ignore`, unless every changed path is ignored (a new folder is never
+ * taken as ignored). No filter: always. No changed paths: never.
+ */
+export function ciJobInScope(job, changedPaths) {
+    if (changedPaths.length === 0)
+        return false;
+    if (job.paths)
+        return changedPaths.some((path) => listMatches(job.paths, path));
+    if (job.pathsIgnore) {
+        return changedPaths.some((path) => path.endsWith("/") || !listMatches(job.pathsIgnore, path));
+    }
+    return true;
+}
+//# sourceMappingURL=missionChecks.js.map

package/dist/extension/pipeline/verify.d.ts

@@ -46,6 +46,8 @@
  * command output passes through {@link scrubSecrets} before it can enter
  * findings, handoffs, or run records (§0.9).
  */
+import { type ToolchainFile } from "../toolchain/spawnHook.js";
+import { type MissionChecksFile } from "./missionChecks.js";
 import type { Finding } from "./types.js";
 /**
  * Total wall-clock budget for a single verify run before it is abandoned
@@ -55,6 +57,17 @@ import type { Finding } from "./types.js";
 export declare const VERIFY_TIMEOUT_MS: number;
 /** Per-PACKAGE wall-clock budget for the test half (spec §3d); overrun fails open. Ten minutes until 2026-10-09. */
 export declare const VERIFY_TEST_TIMEOUT_MS: number;
+/**
+ * The repository-checks half (the plan's approved checks and the pull
+ * request's CI steps) across a whole build: the gate runs after implement,
+ * after each fix turn and every review round, so a cap per call alone could
+ * add an hour to a build.
+ */
+export declare const REPO_CHECKS_BUILD_BUDGET_MS: number;
+/** The same half's cap in one gate call, inside the run budget's verify allowance. */
+export declare const REPO_CHECKS_CALL_BUDGET_MS: number;
+/** One approved check's or CI step's cap. */
+export declare const REPO_CHECK_TIMEOUT_MS: number;
 /** A resolved verify command plus how it was found. */
 export interface VerifyCommand {
     /** Shell-free command + args, e.g. ["pnpm", "run", "typecheck"]. */
@@ -116,7 +129,10 @@ export declare function isFannedOutScript(body: string): boolean;
  * Parse `git status --porcelain` into repo-relative changed paths. Each line is
  * `XY <path>`; we drop the 2-char XY status + its separating space, and for a
  * rename/copy (`R  old -> new`) take the destination. Pure; the impure git
- * shell-out is {@link snapshotWorkspace}.
+ * shell-out is {@link snapshotWorkspace}, whose status is trimmed as a whole:
+ * a first line ` M path` arrives as `M path`. A whole line always has a space
+ * third, so a line without one lost its leading space and its path starts one
+ * column earlier.
  */
 export declare function parseChangedPaths(status: string): string[];
 /**
@@ -261,6 +277,25 @@ export declare function buildVerifyEnv(source?: NodeJS.ProcessEnv): NodeJS.Proce
  * once instead of parking in watch mode until the 10-min cap kills it.
  */
 export declare function buildTestEnv(source?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+/**
+ * The environment an approved check or CI step runs under: the test half's
+ * (no `YAGNI_*`, no NODE_OPTIONS, CI on) minus the secrets the host strips
+ * from its own check runs, on the repository's toolchain when the build named
+ * one (the same PATH and variables the model's shell gets), then the step's
+ * own literal variables.
+ */
+export declare function buildRepoCheckEnv(source?: NodeJS.ProcessEnv, toolchain?: ToolchainFile | null, stepEnv?: Record<string, string>): NodeJS.ProcessEnv;
+/** One porcelain line's path, and whether it is untracked. */
+interface TreeEntry {
+    path: string;
+    untracked: boolean;
+}
+/**
+ * The porcelain entries in `after` that `before` did not have: what the
+ * repository checks wrote into the tree. A path that was already dirty is the
+ * build's, and is not listed. Pure.
+ */
+export declare function newTreeEntries(before: string, after: string): TreeEntry[];
 export declare function makeDefaultExec(opts?: {
     graceMs?: number;
     killTree?: (pid: number) => void;
@@ -289,6 +324,29 @@ export interface MakeRunVerifyOpts {
     testTimeoutMs?: number;
     /** Test-half env override for determinism in tests (default: buildTestEnv() per run). */
     testEnv?: NodeJS.ProcessEnv;
+    /**
+     * The mission's `checks.json` (the approved checks and the pull request's CI
+     * jobs). Absent or null: no repository-checks half, as before.
+     */
+    repoChecks?: () => MissionChecksFile | null;
+    /**
+     * This run's own changed paths (repo-relative), which scope the CI jobs by
+     * their `paths` filters. Default: the same `git status` the scope reads,
+     * minus the pre-run dirt.
+     */
+    changedPaths?: (cwd: string, signal?: AbortSignal, baselinePaths?: string[]) => Promise<string[]>;
+    /** Repository-checks env override for determinism in tests (default: buildRepoCheckEnv() per run). */
+    repoChecksEnv?: NodeJS.ProcessEnv;
+    /** The toolchain the repository checks run on (default: `YAGNI_TOOLCHAIN_FILE`, when it reads). */
+    toolchain?: () => ToolchainFile | null;
+    repoChecksBuildBudgetMs?: number;
+    repoChecksCallBudgetMs?: number;
+    repoCheckTimeoutMs?: number;
+    now?: () => number;
+    /** The tree's porcelain status before and after the half (default: `git status`). */
+    treeStatus?: (cwd: string, signal?: AbortSignal) => Promise<string>;
+    /** Undo what the half wrote into the tree (default: `git clean` / `git checkout` of exactly those paths). */
+    undoTreeWrites?: (cwd: string, entries: TreeEntry[]) => Promise<void>;
 }
 /**
  * One workstream as the scoped checker sees it: the name its findings are
@@ -365,4 +423,5 @@ export declare function makeWorkstreamCheck(opts?: MakeWorkstreamCheckOpts): (cw
  * blocks a real change on its own failure.
  */
 export declare function makeRunVerify(opts?: MakeRunVerifyOpts): (cwd: string, signal?: AbortSignal, baselinePaths?: string[]) => Promise<VerifyOutcome>;
+export {};
 //# sourceMappingURL=verify.d.ts.map

package/dist/extension/pipeline/verify.js

@@ -54,8 +54,10 @@ import { readFileSync } from "node:fs";
 // backslashed strings that no longer compare equal to the git-derived repoRoot
 // and would break the walk-up termination check.
 import { basename, dirname, join } from "node:path/posix";
+import { readToolchainFile } from "../toolchain/spawnHook.js";
 import { killTreeSync, trackChild } from "./childRegistry.js";
 import { claimCovers } from "./fanout.js";
+import { ciJobInScope } from "./missionChecks.js";
 import { composeAbortSignal } from "./resilience.js";
 import { scrubSecrets } from "./scrubSecrets.js";
 import { snapshotWorkspace } from "./workspace.js";
@@ -67,6 +69,21 @@ import { snapshotWorkspace } from "./workspace.js";
 export const VERIFY_TIMEOUT_MS = 20 * 60_000;
 /** Per-PACKAGE wall-clock budget for the test half (spec §3d); overrun fails open. Ten minutes until 2026-10-09. */
 export const VERIFY_TEST_TIMEOUT_MS = 20 * 60_000;
+/**
+ * The repository-checks half (the plan's approved checks and the pull
+ * request's CI steps) across a whole build: the gate runs after implement,
+ * after each fix turn and every review round, so a cap per call alone could
+ * add an hour to a build.
+ */
+export const REPO_CHECKS_BUILD_BUDGET_MS = 30 * 60_000;
+/** The same half's cap in one gate call, inside the run budget's verify allowance. */
+export const REPO_CHECKS_CALL_BUDGET_MS = 15 * 60_000;
+/** One approved check's or CI step's cap. */
+export const REPO_CHECK_TIMEOUT_MS = 10 * 60_000;
+/** Below this much budget left, the next repository check is not started. */
+const REPO_CHECK_MIN_START_MS = 5_000;
+/** Cannot-run entries named in the note before "and N more". */
+const MAX_NAMED_CANNOT_RUN = 10;
 /** Cap on located findings parsed from one failing run, and on the opaque-tail message. */
 const MAX_LOCATED_FINDINGS = 25;
 const MAX_TAIL_CHARS = 1000;
@@ -129,14 +146,17 @@ export function isFannedOutScript(body) {
  * Parse `git status --porcelain` into repo-relative changed paths. Each line is
  * `XY <path>`; we drop the 2-char XY status + its separating space, and for a
  * rename/copy (`R  old -> new`) take the destination. Pure; the impure git
- * shell-out is {@link snapshotWorkspace}.
+ * shell-out is {@link snapshotWorkspace}, whose status is trimmed as a whole:
+ * a first line ` M path` arrives as `M path`. A whole line always has a space
+ * third, so a line without one lost its leading space and its path starts one
+ * column earlier.
  */
 export function parseChangedPaths(status) {
     const paths = [];
     for (const raw of status.split("\n")) {
-        if (raw.length < 4)
-            continue; // need at least "XY p"
-        const entry = raw.slice(3); // drop the 2-char XY status + its separating space
+        if (raw.length < 3)
+            continue; // need at least "X p"
+        const entry = raw[2] === " " ? raw.slice(3) : raw.slice(2);
         const arrow = entry.indexOf(" -> ");
         const path = (arrow >= 0 ? entry.slice(arrow + 4) : entry).trim();
         if (path)
@@ -640,6 +660,70 @@ export function buildTestEnv(source = process.env) {
     env.CI = "true";
     return env;
 }
+/**
+ * The secrets a repository check never sees: a copy of the host's
+ * `VERIFICATION_SECRET_ENV_VARS` in
+ * `packages/backend/src/integrations/e2b/supervisedCandidateSession.ts`
+ * (`YAGNI_*` goes with the test env). This package cannot import the backend:
+ * a change to either list is a change to both.
+ */
+const REPO_CHECK_SECRET_KEYS = [
+    "OPENAI_API_KEY",
+    "ANTHROPIC_API_KEY",
+    "FIREWORKS_API_KEY",
+    "BASETEN_API_KEY",
+    "GITHUB_TOKEN",
+    "GH_TOKEN",
+];
+/**
+ * The environment an approved check or CI step runs under: the test half's
+ * (no `YAGNI_*`, no NODE_OPTIONS, CI on) minus the secrets the host strips
+ * from its own check runs, on the repository's toolchain when the build named
+ * one (the same PATH and variables the model's shell gets), then the step's
+ * own literal variables.
+ */
+export function buildRepoCheckEnv(source = process.env, toolchain = null, stepEnv = {}) {
+    const env = buildTestEnv(source);
+    for (const key of REPO_CHECK_SECRET_KEYS)
+        delete env[key];
+    const withToolchain = toolchain ? { ...toolchain.env, ...env, PATH: toolchain.path } : env;
+    return { ...withToolchain, ...stepEnv, CI: "true" };
+}
+/** One repository command as the gate runs it: through bash, as Actions runs a `run:` step. */
+function repoCheckArgv(run) {
+    return ["bash", "--noprofile", "--norc", "-eo", "pipefail", "-c", run];
+}
+/**
+ * The porcelain entries in `after` that `before` did not have: what the
+ * repository checks wrote into the tree. A path that was already dirty is the
+ * build's, and is not listed. Pure.
+ */
+export function newTreeEntries(before, after) {
+    const known = new Set(parseChangedPaths(before));
+    return after
+        .split("\n")
+        .filter((line) => line.trim().length >= 3)
+        .flatMap((line) => {
+        const [path] = parseChangedPaths(line);
+        if (!path || known.has(path))
+            return [];
+        return [{ path, untracked: line.trimStart().startsWith("??") }];
+    });
+}
+function runGitQuiet(args, cwd) {
+    return new Promise((resolve, reject) => {
+        execFile("git", args, { cwd, maxBuffer: 1024 * 1024 }, (err) => (err ? reject(err) : resolve()));
+    });
+}
+/** Undo what the repository checks wrote: an untracked path is removed, a tracked one restored. */
+async function defaultUndoTreeWrites(cwd, entries) {
+    const untracked = entries.filter((entry) => entry.untracked).map((entry) => entry.path);
+    const tracked = entries.filter((entry) => !entry.untracked).map((entry) => entry.path);
+    if (untracked.length > 0)
+        await runGitQuiet(["clean", "-fdq", "--", ...untracked], cwd);
+    if (tracked.length > 0)
+        await runGitQuiet(["checkout", "-q", "--", ...tracked], cwd);
+}
 // `signal` is deliberately NOT passed into execFile: Node's built-in abort
 // handling kills via the child's pid, and when the spawn itself failed (missing
 // command, missing cwd) an abort landing in the same tick resolves that to pid 0
@@ -845,7 +929,213 @@ export function makeRunVerify(opts = {}) {
     const exec = opts.exec ?? defaultExec;
     const timeoutMs = opts.timeoutMs ?? VERIFY_TIMEOUT_MS;
     const testTimeoutMs = opts.testTimeoutMs ?? VERIFY_TEST_TIMEOUT_MS;
+    const now = opts.now ?? Date.now;
+    const changedPaths = opts.changedPaths ??
+        (async (cwd, signal, baselinePaths) => {
+            const snapshot = await snapshotWorkspace(cwd, signal);
+            if (!snapshot.tracked)
+                return [];
+            const baseline = new Set(baselinePaths ?? []);
+            return parseChangedPaths(snapshot.status).filter((p) => !baseline.has(p));
+        });
+    const toolchain = opts.toolchain ??
+        (() => {
+            const path = process.env.YAGNI_TOOLCHAIN_FILE?.trim();
+            return path ? readToolchainFile(path) : null;
+        });
+    const treeStatus = opts.treeStatus ?? (async (cwd, signal) => (await snapshotWorkspace(cwd, signal)).status);
+    const undoTreeWrites = opts.undoTreeWrites ?? defaultUndoTreeWrites;
+    // Across the whole build: the half's time spent, and each CI step's failure
+    // keys from the last call it failed in.
+    let repoChecksSpentMs = 0;
+    const lastCiFailure = new Map();
+    /**
+     * The repository-checks half: the plan's approved checks, then the pull
+     * request's CI steps its changed paths trigger. A failure becomes `critical`
+     * findings the fix turn works on, except where it can never clear: a check
+     * the sandbox cannot start, an infra failure, an approved check that already
+     * failed on the unchanged code (the host compares it after the build), and a
+     * CI step that fails exactly as it did before a fix turn (it may fail on the
+     * base too, and the pull request's CI shows it). Those are notes.
+     */
+    async function runRepoChecks(input) {
+        const { file, cwd, signal } = input;
+        const findings = [];
+        const reasons = [];
+        const labels = [];
+        const cannotRun = [];
+        for (const check of file.checks) {
+            if (check.status === "cannot_run")
+                cannotRun.push(`\`${check.command}\`${check.cause ? ` (${check.cause})` : ""}`);
+        }
+        const paths = await changedPaths(cwd, signal, input.baselinePaths);
+        const jobs = file.ciJobs.filter((job) => ciJobInScope(job, paths));
+        for (const job of jobs) {
+            for (const entry of job.cannotRun)
+                cannotRun.push(`CI ${job.name}, "${entry.step}" (${entry.reason})`);
+        }
+        if (cannotRun.length > 0) {
+            const named = cannotRun.slice(0, MAX_NAMED_CANNOT_RUN).join("; ");
+            const more = cannotRun.length > MAX_NAMED_CANNOT_RUN ? `; and ${cannotRun.length - MAX_NAMED_CANNOT_RUN} more` : "";
+            reasons.push(`could not run in the sandbox: ${named}${more}`);
+        }
+        const approved = file.checks.filter((check) => check.status !== "cannot_run");
+        const steps = jobs.flatMap((job) => job.steps.map((step) => ({ job, step })));
+        if (approved.length === 0 && steps.length === 0)
+            return { findings, reasons, labels };
+        const buildLeft = (opts.repoChecksBuildBudgetMs ?? REPO_CHECKS_BUILD_BUDGET_MS) - repoChecksSpentMs;
+        if (buildLeft < REPO_CHECK_MIN_START_MS) {
+            reasons.push("approved checks and CI steps not run again: the build's check budget is spent; the host still runs the approved checks after the build");
+            return { findings, reasons, labels };
+        }
+        const callBudget = Math.min(opts.repoChecksCallBudgetMs ?? REPO_CHECKS_CALL_BUDGET_MS, timeoutMs - (now() - input.callStartedAt), buildLeft);
+        const halfStartedAt = now();
+        const run = {
+            cwd,
+            signal,
+            left: () => callBudget - (now() - halfStartedAt),
+            toolchainFile: toolchain(),
+            findings,
+            reasons,
+            labels,
+            notReached: 0,
+        };
+        const before = await treeStatus(cwd, signal).catch((err) => {
+            const msg = err instanceof Error ? err.message : String(err);
+            reasons.push(`could not read the tree before the checks, so what they write is not undone: ${scrubSecrets(msg)}`);
+            return null;
+        });
+        try {
+            await runApprovedChecks(run, approved);
+            await runCiSteps(run, steps, new Set(file.checks.map((check) => check.command.trim())));
+        }
+        finally {
+            repoChecksSpentMs += now() - halfStartedAt;
+            // What the checks wrote into the tree (a coverage folder, an updated
+            // snapshot, a build output) is not the build's change: undone, so the
+            // candidate never carries it.
+            if (before !== null) {
+                try {
+                    const written = newTreeEntries(before, await treeStatus(cwd));
+                    if (written.length > 0)
+                        await undoTreeWrites(cwd, written);
+                }
+                catch (err) {
+                    const msg = err instanceof Error ? err.message : String(err);
+                    reasons.push(`could not undo what the checks wrote into the tree: ${scrubSecrets(msg)}`);
+                }
+            }
+        }
+        if (run.notReached > 0) {
+            reasons.push(`${run.notReached} approved check(s) or CI step(s) not reached in the gate's time budget; the host still runs the approved checks after the build`);
+        }
+        return { findings, reasons, labels };
+    }
+    /** One repository command's verdict: passed, a note (it could not run), or a failure with its output. */
+    async function runRepoCommand(run, command, dir, stepEnv) {
+        const capMs = Math.min(opts.repoCheckTimeoutMs ?? REPO_CHECK_TIMEOUT_MS, run.left());
+        const composed = composeAbortSignal(run.signal, AbortSignal.timeout(Math.max(1, capMs)));
+        const env = opts.repoChecksEnv
+            ? { ...opts.repoChecksEnv, ...(stepEnv ?? {}) }
+            : buildRepoCheckEnv(process.env, run.toolchainFile, stepEnv);
+        try {
+            const { code, output: rawOutput } = await exec(repoCheckArgv(command), dir, composed, env);
+            if (code === 0)
+                return { kind: "passed" };
+            const output = scrubSecrets(rawOutput);
+            const cls = classifyTestFailure(output, code);
+            if (cls.kind === "infra")
+                return { kind: "note", reason: `could not run: ${cls.reason}` };
+            return { kind: "failed", output, code };
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            return { kind: "note", reason: `could not run: ${scrubSecrets(msg)}` };
+        }
+    }
+    /** A failure's findings, located from the folder the command ran in and prefixed with what ran. */
+    function repoFailureFindings(run, failure, label, prefix, dir) {
+        const cls = classifyTestFailure(failure.output, failure.code);
+        const parsed = cls.kind === "failures" ? cls.findings : parseVerifyFailures(failure.output, failure.code, label);
+        return parsed.map((f) => ({ ...liftFinding(f, run.cwd, dir), message: `${prefix}: ${f.message}` }));
+    }
+    const findingRoom = (run) => Math.max(0, MAX_LOCATED_FINDINGS - run.findings.length);
+    /**
+     * The plan's approved checks, at the repository root as the host runs them.
+     * One that already failed on the unchanged code is a note: the host compares
+     * the two after the build.
+     */
+    async function runApprovedChecks(run, approved) {
+        for (const check of approved) {
+            if (run.signal?.aborted)
+                return;
+            if (run.left() < REPO_CHECK_MIN_START_MS) {
+                run.notReached += 1;
+                continue;
+            }
+            const label = check.command.length > 80 ? `${check.command.slice(0, 77)}...` : check.command;
+            const verdict = await runRepoCommand(run, check.command, run.cwd, undefined);
+            if (verdict.kind === "note") {
+                run.reasons.push(`approved check \`${label}\` ${verdict.reason}`);
+            }
+            else if (verdict.kind === "failed" && check.status === "fails_on_base") {
+                run.reasons.push(`approved check \`${label}\` failed, and it already failed on the unchanged code; the host compares the two after the build`);
+            }
+            else {
+                run.labels.push(label);
+                if (verdict.kind === "failed") {
+                    const found = repoFailureFindings(run, verdict, label, `approved check \`${label}\``, run.cwd);
+                    run.findings.push(...found.slice(0, findingRoom(run)));
+                }
+            }
+        }
+    }
+    /**
+     * The pull request's CI steps, job by job. A job stops at its first failing
+     * step, as it does on the runner; a step that is one of the approved checks
+     * already ran. A step that fails with the same findings it failed with on
+     * the previous call (so after a fix turn) is a note: it may fail on the base
+     * too, and the pull request's CI shows it.
+     */
+    async function runCiSteps(run, steps, approvedCommands) {
+        const stoppedJobs = new Set();
+        for (const { job, step } of steps) {
+            if (run.signal?.aborted)
+                return;
+            if (stoppedJobs.has(job) || approvedCommands.has(step.run.trim()))
+                continue;
+            if (run.left() < REPO_CHECK_MIN_START_MS) {
+                run.notReached += 1;
+                continue;
+            }
+            const where = `CI ${job.name}, step "${step.name}"`;
+            const key = `${job.workflow}\u0000${job.job}\u0000${step.name}\u0000${step.run}`;
+            const dir = step.workingDirectory ? join(run.cwd, step.workingDirectory.replace(/^\.\/+/, "")) : run.cwd;
+            const verdict = await runRepoCommand(run, step.run, dir, step.env);
+            if (verdict.kind === "passed") {
+                lastCiFailure.delete(key);
+                run.labels.push(`CI ${job.name}: ${step.name}`);
+                continue;
+            }
+            stoppedJobs.add(job);
+            if (verdict.kind === "note") {
+                run.reasons.push(`${where} ${verdict.reason}`);
+                continue;
+            }
+            const stepFindings = repoFailureFindings(run, verdict, step.name, where, dir);
+            const keys = new Set(stepFindings.map((f) => f.message));
+            const previous = lastCiFailure.get(key);
+            lastCiFailure.set(key, keys);
+            if (previous && keys.size > 0 && [...keys].every((k) => previous.has(k))) {
+                run.reasons.push(`${where} still fails the same way after a fix turn; it may fail on the base too, and the pull request's CI shows it`);
+                continue;
+            }
+            run.labels.push(`CI ${job.name}: ${step.name}`);
+            run.findings.push(...stepFindings.slice(0, findingRoom(run)));
+        }
+    }
     return async function runVerify(cwd, signal, baselinePaths) {
+        const callStartedAt = now();
         const dirs = await changedDirs(cwd, signal, baselinePaths);
         const commands = detect(cwd, dirs);
         // An explicitly-allowed .yagni-code/verify override IS the whole gate (spec
@@ -853,7 +1143,10 @@ export function makeRunVerify(opts = {}) {
         // alongside it — the repo already told us exactly how to verify.
         const overridden = commands.some((c) => c.source === "override");
         const testCommands = overridden ? [] : detectTests(cwd, dirs);
-        if (commands.length === 0 && testCommands.length === 0) {
+        // The approved checks carry the plan's approval, not the repository's own
+        // choice of how to verify, so an override never takes them out of the loop.
+        const repoFile = opts.repoChecks?.() ?? null;
+        if (commands.length === 0 && testCommands.length === 0 && !repoFile) {
             return { ran: false, ok: true, reason: "verify skipped: no verify command detected", findings: [] };
         }
         const findings = [];
@@ -898,6 +1191,7 @@ export function makeRunVerify(opts = {}) {
         // root cause, and the loop must fix the compile errors first anyway; the
         // round where typecheck goes green runs the tests, so `clean` is never
         // reached without the tests having run (or their absence honestly noted).
+        const typecheckFailed = findings.length > 0;
         const testLabels = [];
         if (testCommands.length > 0) {
             if (findings.length > 0) {
@@ -939,10 +1233,27 @@ export function makeRunVerify(opts = {}) {
                 }
             }
         }
-        // The command labels list only what produced a verdict — on BOTH the
-        // typecheck and test halves — so the FINISH trailer's `passed (<cmds>)`
-        // never claims a check that was infra-skipped or threw (invariant §0.1).
-        const command = [...new Set(typecheckLabels), ...new Set(testLabels)].join(", ");
+        // REPOSITORY-CHECKS HALF: the plan's approved checks and the pull
+        // request's CI steps (`checks.json`), after the test half, under the same
+        // rule: a tree that does not compile fails them for the same root cause.
+        const repoLabels = [];
+        if (repoFile) {
+            if (typecheckFailed) {
+                reasons.push("approved checks and CI steps skipped: the typecheck half failed; a later round runs them");
+            }
+            else {
+                const repo = await runRepoChecks({ file: repoFile, cwd, signal, baselinePaths, callStartedAt });
+                reasons.push(...repo.reasons);
+                repoLabels.push(...repo.labels);
+                if (repo.labels.length > 0)
+                    anyRan = true;
+                findings.push(...repo.findings);
+            }
+        }
+        // The command labels list only what produced a verdict — on every half —
+        // so the FINISH trailer's `passed (<cmds>)` never claims a check that was
+        // infra-skipped or threw (invariant §0.1).
+        const command = [...new Set(typecheckLabels), ...new Set(testLabels), ...new Set(repoLabels)].join(", ");
         if (!anyRan) {
             return { ran: false, ok: true, command, reason: reasons.join("; ") || "verify skipped", findings: [] };
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "1.2.4-staging.1809.1",
+  "version": "1.2.4-staging.1821.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -58,5 +58,5 @@
     "turndown": "^7.2.4",
     "typebox": "^1.3.15"
   },
-  "yagniSourceSha": "33de16e5a97a30639624793c8e9f9d5120b7aea8"
+  "yagniSourceSha": "60f51163d9b1184bea0c2dca85cf2b7d07d6d275"
 }