@yagni-app/code-staging 1.2.7-staging.2022.1 → 1.2.7-staging.2031.1

package/dist/extension/pipeline/headlessGo.d.ts

@@ -74,7 +74,7 @@ import { snapshotWorkspace } from "./workspace.js";
 import type { WorktreeExec } from "./worktree.js";
 import { type TreeSnapshotDeps } from "./treeSnapshot.js";
 import { runPipeline as defaultRunPipeline } from "./orchestrator.js";
-import { makeRunVerify, type VerifyBaselineResult } from "./verify.js";
+import { makeMeasureChecksOnBase, makeRunVerify, type VerifyBaselineResult } from "./verify.js";
 import { type RunBudget } from "./budget.js";
 import type { Finding, JsonEvent, ModelTier, PipelineStage, StageId, StageTag, StageUsage, StopReason } from "./types.js";
 /** One-line usage copy, shared by every argument error. */
@@ -181,6 +181,8 @@ export interface HeadlessGoDeps {
      * there is none). Defaults to the real gate; injected in tests.
      */
     makeRunVerify?: typeof makeRunVerify;
+    /** The approved checks' run on the unchanged code (`measureOnBase`). Defaults to the real one; injected in tests. */
+    measureChecksOnBase?: ReturnType<typeof makeMeasureChecksOnBase>;
     /** The verify gate's clean-tree baseline run (YAG-1003). Defaults to the real one; injected in tests. */
     takeVerifyBaseline?: (cwd: string, dirs: string[], signal?: AbortSignal, budgetMs?: number) => Promise<VerifyBaselineResult>;
     /** stdout sink; one call per NDJSON line, newline added by the caller. */

package/dist/extension/pipeline/headlessGo.js

@@ -85,7 +85,7 @@ import { normalizeMission } from "./mission.js";
 import { MISSION_CHECKS_FILE_NAME, MISSION_CI_RESULTS_FILE_NAME, readMissionChecksFile, renderCiResults, } from "./missionChecks.js";
 import { startTreeSnapshots } from "./treeSnapshot.js";
 import { PipelineStageError, runPipeline as defaultRunPipeline, } from "./orchestrator.js";
-import { baselineDirs, makeRunVerify, makeTakeVerifyBaseline, makeWorkstreamCheck, parseChangedPaths, planPaths, } from "./verify.js";
+import { baselineDirs, makeMeasureChecksOnBase, makeRunVerify, makeTakeVerifyBaseline, makeWorkstreamCheck, parseChangedPaths, planPaths, } from "./verify.js";
 import { loadGroundingEnabled } from "../grounding.js";
 import { codeStateHome } from "../stateHome.js";
 import { parseTierCap, TIER_CAP_ENV } from "./tierCap.js";
@@ -451,42 +451,91 @@ export async function runHeadlessGo(argv, deps = {}) {
     // the baseline there would excuse the attempt's own breakage). It then leans
     // on `checks.json`, whose base standing the host took on the real base.
     let baseline;
-    const logBaseline = (data) => {
-        deps.logger?.("verify_baseline", data);
+    const logPipeline = (event, data) => {
+        deps.logger?.(event, data);
         if (stream)
-            emit({ type: "pipeline_log", event: "verify_baseline", data });
+            emit({ type: "pipeline_log", event, data });
+    };
+    // A measurement before the build (the baseline, the plan's checks on the
+    // base) gets at most a sixth of the run's time left when it starts, and
+    // none below a minute: the build itself must still fit. No deadline, no cap.
+    const preBuildShare = () => {
+        const leftMs = budget?.deadlineMs === undefined ? undefined : budget.deadlineMs - (deps.now ?? Date.now)();
+        const shareMs = leftMs === undefined ? undefined : Math.floor(leftMs / BASELINE_SHARE_OF_TIME_LEFT);
+        return {
+            leftMs,
+            shareMs,
+            tooLittle: shareMs !== undefined && shareMs < MIN_BASELINE_BUDGET_MS,
+        };
     };
-    // With a deadline, the baseline gets at most a sixth of the run's time left,
-    // and none below a minute: the build itself must still fit.
-    const deadlineLeftMs = budget?.deadlineMs === undefined ? undefined : budget.deadlineMs - (deps.now ?? Date.now)();
-    const baselineBudgetMs = deadlineLeftMs === undefined
-        ? undefined
-        : Math.floor(deadlineLeftMs / BASELINE_SHARE_OF_TIME_LEFT);
     if (mission?.plan && !continuation && !fixRound && !deps.signal?.aborted) {
         const dirs = baselineDirs(cwd, planPaths(mission.plan), readFile);
-        if (dirs.length > 0 &&
-            baselineBudgetMs !== undefined &&
-            baselineBudgetMs < MIN_BASELINE_BUDGET_MS) {
-            logBaseline({
+        const share = preBuildShare();
+        if (dirs.length > 0 && share.tooLittle) {
+            logPipeline("verify_baseline", {
                 skipped: "too little of the run's time left",
-                deadlineLeftMs,
-                baselineBudgetMs,
+                deadlineLeftMs: share.leftMs,
+                baselineBudgetMs: share.shareMs,
             });
         }
         else if (dirs.length > 0) {
             try {
-                const taken = await (deps.takeVerifyBaseline ?? makeTakeVerifyBaseline())(cwd, dirs, deps.signal, baselineBudgetMs);
-                logBaseline({ ran: taken.ran, failures: taken.failures, notes: taken.notes });
+                const taken = await (deps.takeVerifyBaseline ?? makeTakeVerifyBaseline())(cwd, dirs, deps.signal, share.shareMs);
+                logPipeline("verify_baseline", {
+                    ran: taken.ran,
+                    failures: taken.failures,
+                    notes: taken.notes,
+                });
                 if (taken.baseline.size > 0)
                     baseline = taken.baseline;
             }
             catch (err) {
                 const message = err instanceof Error ? err.message : String(err);
-                logBaseline({ error: message });
+                logPipeline("verify_baseline", { error: message });
                 writeErr(`The verify baseline could not run (every failure counts): ${message}`);
             }
         }
     }
+    // The approved checks the host has not seen pass on the unchanged code
+    // (`measureOnBase`: the plan's, and CI's when the repository's record has
+    // none of its own), each run once there before the build, on the same
+    // fresh tree the baseline above reads: a check that already failed there is
+    // not this change's to fix. A continuation or a fix round carries a change,
+    // so it measures nothing; its host hands it what an earlier session found.
+    let checksOnBase;
+    const measureFile = gateOpts?.repoChecks?.() ?? null;
+    if (measureFile?.checks.some((check) => check.measureOnBase) &&
+        !continuation &&
+        !fixRound &&
+        !deps.signal?.aborted) {
+        const share = preBuildShare();
+        if (share.tooLittle) {
+            logPipeline("verify_checks_on_base", {
+                skipped: "too little of the run's time left",
+                leftMs: share.leftMs,
+                shareMs: share.shareMs,
+            });
+        }
+        else {
+            try {
+                const measured = await (deps.measureChecksOnBase ?? makeMeasureChecksOnBase())(cwd, measureFile, deps.signal, share.shareMs);
+                logPipeline("verify_checks_on_base", {
+                    ran: measured.ran,
+                    passed: [...measured.passed],
+                    failed: [...measured.failed.keys()],
+                    notes: measured.notes,
+                    treeUndone: measured.treeUndone,
+                });
+                if (measured.passed.size > 0 || measured.failed.size > 0)
+                    checksOnBase = measured;
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : String(err);
+                logPipeline("verify_checks_on_base", { error: message });
+                writeErr(`The approved checks could not run on the unchanged code (each keeps its checks.json standing): ${message}`);
+            }
+        }
+    }
     // The last gate verdict's count of failures the clean tree already had, for the result.
     let preexistingFailures = 0;
     let runVerify;
@@ -506,6 +555,7 @@ export async function runHeadlessGo(argv, deps = {}) {
         const made = (deps.makeRunVerify ?? makeRunVerify)({
             ...gateOpts,
             ...(baseline ? { baseline } : {}),
+            ...(checksOnBase ? { checksOnBase } : {}),
             ...(scan ? { scanChange: scan } : {}),
             ...(cloud ? { unreadTestFailureIsFinding: true } : {}),
         });

package/dist/extension/pipeline/missionChecks.d.ts

@@ -21,6 +21,13 @@ export interface MissionCheck {
     command: string;
     status: MissionCheckStatus;
     cause?: string;
+    /**
+     * The host has not seen it pass on the unchanged code (an approved plan's
+     * check, or one CI runs that has no baseline): the session runs it there
+     * once before the build, and what that
+     * measures stands over `status` (`makeMeasureChecksOnBase` in verify.ts).
+     */
+    measureOnBase?: boolean;
 }
 export interface MissionCiStep {
     name: string;

package/dist/extension/pipeline/missionChecks.js

@@ -91,7 +91,10 @@ function parseJob(value) {
             return null;
         if (failed.step !== undefined && !isString(failed.step))
             return null;
-        job.failedCheck = { name: failed.name, ...(isString(failed.step) ? { step: failed.step } : {}) };
+        job.failedCheck = {
+            name: failed.name,
+            ...(isString(failed.step) ? { step: failed.step } : {}),
+        };
     }
     return job;
 }
@@ -131,6 +134,8 @@ export function parseMissionChecksFile(text) {
         const check = { command: raw.command, status: raw.status };
         if (isString(raw.cause))
             check.cause = raw.cause;
+        if (raw.measureOnBase === true)
+            check.measureOnBase = true;
         checks.push(check);
     }
     const ciJobs = [];

package/dist/extension/pipeline/verify.d.ts

@@ -37,7 +37,10 @@
  * anything UNCERTAIN fail OPEN with an honest note, never a never-clearable
  * critical. A cloud session's gate (`unreadTestFailureIsFinding`) makes an
  * UNCERTAIN failure a finding carrying the output tail, unless the clean tree
- * failed the same command.
+ * failed the same command. On a build that named the repository's toolchain
+ * (`YAGNI_TOOLCHAIN_FILE`, a sandbox) both halves run on it, as the model's
+ * shell and the approved checks do ({@link buildGateVerifyEnv},
+ * {@link buildGateTestEnv}).
  *
  * Safe-by-default and FAIL-OPEN: if no scoped, non-fanned-out command is
  * detectable, or the command cannot be spawned, or it times out, the gate
@@ -108,6 +111,18 @@ export interface VerifyOutcome {
 }
 /** An approved check's name on the report: its command, cut at 80 characters. */
 export declare function checkLabel(command: string): string;
+/**
+ * A command as the gate compares two: the same words, whatever spaces sit
+ * between them, and a package manager's script named the one way it runs,
+ * so `yarn test` and `yarn run test`, `npm test` and `npm run test`, `pnpm
+ * lint` and `pnpm run lint` are one check, run once (staging bench
+ * 2026-10-25: the gate's own `test` script and two approved twins ran one
+ * suite three times). Only the leading form: a manager's flags before the
+ * script leave the command as it is. The same rule as
+ * `canonicalCheckCommand` in the backend's attempts/inputs.ts; both test
+ * files read one corpus, test/fixtures/equivalentCheckCommands.json. Pure.
+ */
+export declare function canonicalCheckCommand(command: string): string;
 /**
  * True when a command changes the checkout's git state: a commit, a branch
  * created or switched, a reset, a stash, a push. `git branch`, `git remote`
@@ -246,15 +261,36 @@ export declare function detectVerifyTestCommands(cwd: string, opts?: DetectOpts)
  * verify failure.
  */
 export declare function classifyVerifyInfraFailure(output: string, exitCode: number): string | null;
+/**
+ * What a run could not start without, when its output says so in a way the
+ * gate recognises: a credential or variable the environment lacks, or a
+ * prerequisite the sandbox has not installed. Null for anything else, which
+ * stays a real failure. Pure.
+ *
+ * Narrow on purpose, since a match makes the run "could not run" rather than
+ * the change's failure:
+ *  - a named variable counts only when `env` (the environment the command ran
+ *    under) does not have it set: one it has is not why the run failed, and
+ *    no unnamed phrase then stands in for it;
+ *  - a line that quotes a test's expectation or a diff never counts, nor
+ *    one a logger wrote below error level;
+ *  - a repository's own "`A_B` is missing" counts only on an error's line.
+ *
+ * Without `env`, a named variable is taken as unset.
+ */
+export declare function classifyMissingPrerequisite(output: string, env?: NodeJS.ProcessEnv): string | null;
 /** How the pure test classifier read one test run (spec §3d). */
 export type TestFailureClassification = {
     kind: "clean";
 } | {
     kind: "failures";
     findings: Finding[];
-} | {
+}
+/** `needs`: the credential or prerequisite the run lacked ({@link classifyMissingPrerequisite}). */
+ | {
     kind: "infra";
     reason: string;
+    needs?: string;
 } | {
     kind: "uncertain";
 };
@@ -269,7 +305,9 @@ export type TestFailureClassification = {
  *  - infra/env shapes (command not found, module resolution, connection
  *    refused, missing env var, DB/auth, connect timeout) → `infra` with a short
  *    cause; checked FIRST so a suite whose assertions failed only because its
- *    DB was down fails open rather than blocking.
+ *    DB was down fails open rather than blocking. A missing credential or
+ *    prerequisite ({@link classifyMissingPrerequisite}, given the `env` the
+ *    command ran under) is `infra` with `needs` and the cause "needs <it>".
  *  - recognisable failing-test lines (pnpm-wrapped vitest / jest / node:test
  *    TAP + spec reporters) → `failures` with located `critical` findings
  *    (capped at 25, deduped, locations attached when the runner printed them).
@@ -281,7 +319,7 @@ export type TestFailureClassification = {
  * Callers scrub the output through {@link scrubSecrets} BEFORE classification
  * so findings/notes never carry secrets (§0.9).
  */
-export declare function classifyTestFailure(output: string, exitCode: number, limit?: number): TestFailureClassification;
+export declare function classifyTestFailure(output: string, exitCode: number, limit?: number, env?: NodeJS.ProcessEnv): TestFailureClassification;
 /**
  * Turn a failing verify run into `critical` Findings. A clean (exit 0) run yields
  * none. Located diagnostics (TypeScript first, then a generic file:line form, then
@@ -382,6 +420,22 @@ export declare function buildTestEnv(source?: NodeJS.ProcessEnv): NodeJS.Process
  * own literal variables.
  */
 export declare function buildRepoCheckEnv(source?: NodeJS.ProcessEnv, toolchain?: ToolchainFile | null, stepEnv?: Record<string, string>): NodeJS.ProcessEnv;
+/**
+ * The environment the gate's own detected test script runs under. On a build
+ * that named a toolchain (a sandbox), an approved check's
+ * ({@link buildRepoCheckEnv}), so the suite runs on the repository's Node,
+ * Ruby or Go as the model's shell does, never the image's, and gives the same
+ * verdict it gives as an approved check. Without one (a developer's terminal),
+ * the user's own ({@link buildTestEnv}), as before.
+ */
+export declare function buildGateTestEnv(source?: NodeJS.ProcessEnv, toolchain?: ToolchainFile | null): NodeJS.ProcessEnv;
+/**
+ * The environment the gate's own detected typecheck or lint script runs
+ * under: the scrubbed {@link buildVerifyEnv} on the build's toolchain, when it
+ * named one. Undefined without one, so the exec seam's default applies, as
+ * before.
+ */
+export declare function buildGateVerifyEnv(source?: NodeJS.ProcessEnv, toolchain?: ToolchainFile | null): NodeJS.ProcessEnv | undefined;
 /** One porcelain line's path, and whether it is untracked. */
 interface TreeEntry {
     path: string;
@@ -419,7 +473,7 @@ export interface MakeRunVerifyOpts {
     detectTests?: (cwd: string, changedDirs: string[]) => VerifyCommand[];
     /** Per-package wall-clock cap for the test half (default VERIFY_TEST_TIMEOUT_MS). */
     testTimeoutMs?: number;
-    /** Test-half env override for determinism in tests (default: buildTestEnv() per run). */
+    /** Test-half env override for determinism in tests (default: buildGateTestEnv() per run). */
     testEnv?: NodeJS.ProcessEnv;
     /**
      * The mission's `checks.json` (the approved checks and the pull request's CI
@@ -439,7 +493,11 @@ export interface MakeRunVerifyOpts {
     changedPaths?: (cwd: string, signal?: AbortSignal, baselinePaths?: string[]) => Promise<string[]>;
     /** Repository-checks env override for determinism in tests (default: buildRepoCheckEnv() per run). */
     repoChecksEnv?: NodeJS.ProcessEnv;
-    /** The toolchain the repository checks run on (default: `YAGNI_TOOLCHAIN_FILE`, when it reads). */
+    /**
+     * The toolchain every command the gate runs is on: the repository checks,
+     * and its own detected typecheck and test scripts (default:
+     * `YAGNI_TOOLCHAIN_FILE`, when it reads).
+     */
     toolchain?: () => ToolchainFile | null;
     repoChecksBuildBudgetMs?: number;
     repoChecksCallBudgetMs?: number;
@@ -455,6 +513,13 @@ export interface MakeRunVerifyOpts {
      * findings. Absent: every failure is a finding, as before.
      */
     baseline?: VerifyBaseline | null;
+    /**
+     * What the approved checks `checks.json` marks `measureOnBase` did on the
+     * unchanged code ({@link makeMeasureChecksOnBase}). It stands over each
+     * one's `status`: one that passed there must pass, and one that failed
+     * there is the change's only where it fails anew. Absent: `status` alone.
+     */
+    checksOnBase?: ChecksOnBase | null;
     /**
      * The cloud session's rule (spec decision 3): a test run that exits
      * non-zero with output no parser reads is a finding carrying its output
@@ -510,6 +575,11 @@ export interface MakeWorkstreamCheckOpts {
     timeoutMs?: number;
     /** What the clean tree already failed on (YAG-1003): those failures are not a workstream's. */
     baseline?: VerifyBaseline | null;
+    /**
+     * The toolchain the checks run on, as the full gate's do (default:
+     * `YAGNI_TOOLCHAIN_FILE`, when it reads).
+     */
+    toolchain?: () => ToolchainFile | null;
 }
 /**
  * The per-workstream scoped check the implement diamond runs right after the fan
@@ -556,6 +626,11 @@ export interface MakeTakeVerifyBaselineOpts {
     timeoutMs?: number;
     testTimeoutMs?: number;
     testEnv?: NodeJS.ProcessEnv;
+    /**
+     * The toolchain the commands run on, as the gate's do (default:
+     * `YAGNI_TOOLCHAIN_FILE`, when it reads).
+     */
+    toolchain?: () => ToolchainFile | null;
     budgetMs?: number;
     now?: () => number;
     treeStatus?: (cwd: string, signal?: AbortSignal) => Promise<string>;
@@ -584,5 +659,63 @@ export interface VerifyBaselineResult {
  * write into the tree is undone, so none of it reaches the candidate.
  */
 export declare function makeTakeVerifyBaseline(opts?: MakeTakeVerifyBaselineOpts): (cwd: string, dirs: string[], signal?: AbortSignal, budgetOverrideMs?: number) => Promise<VerifyBaselineResult>;
+/**
+ * What the approved checks marked `measureOnBase` did on the unchanged code,
+ * by command (trimmed): each that passed there, and each that failed there
+ * with failures the gate reads, with how often each failure key was seen
+ * (none for a failure only a summary line names). A command in neither gave
+ * no verdict there, and keeps the status `checks.json` gave it.
+ */
+export interface ChecksOnBase {
+    passed: ReadonlySet<string>;
+    failed: ReadonlyMap<string, ReadonlyMap<string, number>>;
+}
+/** {@link ChecksOnBase}, with what ran and why the rest gave no verdict, for the run's log. */
+export interface ChecksOnBaseResult extends ChecksOnBase {
+    ran: string[];
+    notes: string[];
+    /**
+     * What the checks wrote into the tree was undone (or they wrote nothing).
+     * False when the tree could not be read before them or the undo failed:
+     * the build then starts on a tree the checks may have dirtied.
+     */
+    treeUndone: boolean;
+}
+/**
+ * The whole measurement's cap, before the build starts: each check marked to
+ * measure, once, the plan's first.
+ */
+export declare const CHECKS_ON_BASE_BUDGET_MS: number;
+export interface MakeMeasureChecksOnBaseOpts {
+    exec?: VerifyExec;
+    /** Repository-checks env override for determinism in tests (default: the gate's own). */
+    repoChecksEnv?: NodeJS.ProcessEnv;
+    toolchain?: () => ToolchainFile | null;
+    /** One check's cap (default {@link REPO_CHECK_TIMEOUT_MS}). */
+    timeoutMs?: number;
+    budgetMs?: number;
+    now?: () => number;
+    treeStatus?: (cwd: string, signal?: AbortSignal) => Promise<string>;
+    undoTreeWrites?: (cwd: string, entries: TreeEntry[]) => Promise<void>;
+}
+/**
+ * Run each approved check `checks.json` marks `measureOnBase` once on the
+ * unchanged code, before the build changes anything: a plan's check the
+ * host has not seen pass there (none of the record's, or a red one the
+ * record may hold from long ago), and a command the repository's CI runs
+ * when the record names no check of its own. A check the plan wrote for the
+ * change often fails there by design (its test file is not written yet), and a
+ * failure that says only that (a file not found, no tests to run, output no
+ * parser reads) is no verdict: its failures all count after the build, as
+ * before. A failure the gate reads (failing tests, located diagnostics, a
+ * test runner's failure summary) is one the unchanged code already has.
+ *
+ * Run as the gate runs the check ({@link makeRunVerify}): the same command
+ * line, environment and toolchain, from the repository root, so a failure
+ * keys the same on both trees. Bounded: each check by its cap, the whole by
+ * the budget, and one not reached in it has no verdict. What the checks
+ * write into the tree is undone.
+ */
+export declare function makeMeasureChecksOnBase(opts?: MakeMeasureChecksOnBaseOpts): (cwd: string, file: MissionChecksFile, signal?: AbortSignal, budgetOverrideMs?: number) => Promise<ChecksOnBaseResult>;
 export {};
 //# sourceMappingURL=verify.d.ts.map

package/dist/extension/pipeline/verify.js

@@ -37,7 +37,10 @@
  * anything UNCERTAIN fail OPEN with an honest note, never a never-clearable
  * critical. A cloud session's gate (`unreadTestFailureIsFinding`) makes an
  * UNCERTAIN failure a finding carrying the output tail, unless the clean tree
- * failed the same command.
+ * failed the same command. On a build that named the repository's toolchain
+ * (`YAGNI_TOOLCHAIN_FILE`, a sandbox) both halves run on it, as the model's
+ * shell and the approved checks do ({@link buildGateVerifyEnv},
+ * {@link buildGateTestEnv}).
  *
  * Safe-by-default and FAIL-OPEN: if no scoped, non-fanned-out command is
  * detectable, or the command cannot be spawned, or it times out, the gate
@@ -111,6 +114,44 @@ const VERIFY_LENS = "does_it_hold";
 export function checkLabel(command) {
     return command.length > 80 ? `${command.slice(0, 77)}...` : command;
 }
+/**
+ * Package-manager words that are the manager's own command, never a script:
+ * `yarn add`, `pnpm install`. Any other word after `yarn` or `pnpm` runs the
+ * script of that name, as `run` does.
+ */
+const YARN_COMMANDS = new Set("add audit autoclean bin cache check config constraints create dedupe dlx exec explain generate-lock-entry global help import info init install licenses link list login logout node npm outdated owner pack patch patch-commit plugin policies publish rebuild remove run set stage tag team unlink unplug up upgrade upgrade-interactive version versions why workspace workspaces".split(" "));
+const PNPM_COMMANDS = new Set("add audit bin cache cat-file cat-index config create dedupe deploy dlx doctor env exec fetch find-hash i import init install install-test it licenses link list ln ls outdated pack patch patch-commit patch-remove prune publish rb rebuild recursive remove rm root run self-update server setup store un uninstall unlink up update why".split(" "));
+/** The scripts npm runs without `run`: its lifecycle shorthands. */
+const NPM_SCRIPT_SHORTHANDS = new Set(["test", "start", "stop", "restart"]);
+/**
+ * A command as the gate compares two: the same words, whatever spaces sit
+ * between them, and a package manager's script named the one way it runs,
+ * so `yarn test` and `yarn run test`, `npm test` and `npm run test`, `pnpm
+ * lint` and `pnpm run lint` are one check, run once (staging bench
+ * 2026-10-25: the gate's own `test` script and two approved twins ran one
+ * suite three times). Only the leading form: a manager's flags before the
+ * script leave the command as it is. The same rule as
+ * `canonicalCheckCommand` in the backend's attempts/inputs.ts; both test
+ * files read one corpus, test/fixtures/equivalentCheckCommands.json. Pure.
+ */
+export function canonicalCheckCommand(command) {
+    const words = command.trim().split(/\s+/).filter(Boolean);
+    const [manager, next, ...rest] = words;
+    const script = /^[A-Za-z0-9][\w:.@/-]*$/;
+    if (manager === "npm" || manager === "yarn" || manager === "pnpm") {
+        const runs = next === "run" || (manager === "npm" && next === "run-script");
+        if (runs && rest[0] && script.test(rest[0]))
+            return [manager, "run", ...rest].join(" ");
+        const shorthand = next !== undefined &&
+            script.test(next) &&
+            (manager === "npm"
+                ? NPM_SCRIPT_SHORTHANDS.has(next)
+                : !(manager === "yarn" ? YARN_COMMANDS : PNPM_COMMANDS).has(next));
+        if (shorthand)
+            return [manager, "run", next, ...rest].join(" ");
+    }
+    return words.join(" ");
+}
 /** Git subcommands that only read: a check may run them as often as it likes. */
 const READ_ONLY_GIT = new Set("status diff log show ls-files ls-tree rev-parse rev-list check-ignore grep blame describe cat-file shortlog diff-tree merge-base for-each-ref show-ref name-rev count-objects var version help".split(" "));
 /**
@@ -471,18 +512,6 @@ const TEST_INFRA_PATTERNS = [
     [/\bENOTFOUND\b|\bEAI_AGAIN\b/, "DNS/host resolution failed for a test dependency"],
     [/\bEADDRINUSE\b/, "a port the tests need is already in use"],
     [/\bETIMEDOUT\b|\bconnect(?:ion)? timed out\b/i, "connection to a test dependency timed out"],
-    [
-        /\bmissing (?:required )?env(?:ironment)? (?:var(?:iable)?s?)\b/i,
-        "missing environment variable",
-    ],
-    [
-        /\benvironment variable\b[^\n]{0,80}\b(?:is )?(?:not set|missing|required|must be set)\b/i,
-        "missing environment variable",
-    ],
-    [/\bprocess\.env\.[A-Z0-9_]+ is (?:undefined|not set)\b/, "missing environment variable"],
-    // Yarn Berry reading a `${TOKEN}` in .yarnrc.yml that the environment lacks
-    // (staging bench 2026-10-23: GITHUB_PACKAGES_TOKEN): the suite never started.
-    [/\bEnvironment variable not found \([A-Za-z0-9_]+\)/, "missing environment variable"],
     [/\bSASL\b|\bSCRAM-SERVER\b/, "database auth failed (missing DB credentials?)"],
     [/\bpassword authentication failed\b/i, "database auth failed"],
     [/\brole "[^"]*" does not exist\b/i, "database role does not exist"],
@@ -499,6 +528,126 @@ const TEST_INFRA_PATTERNS = [
     [/\bCannot connect to the Docker daemon\b/i, "Docker is not running"],
     [/\bno space left on device\b/i, "the disk is full"],
 ];
+/**
+ * A variable's name as an output names it: `SUPABASE_SECRET_KEY`, `PORT`.
+ * Two characters at least and upper case only, on purpose: a single letter or
+ * a lower-case word beside "is missing" is prose, and reading it as a
+ * variable would make a real failure "could not run".
+ */
+const VAR_NAME = "[A-Z][A-Z0-9_]*[A-Z0-9]";
+/** Words a missing variable is said with after its name. */
+const UNSET_WORDS = "(?:is |was )?(?:not set|not defined|missing|required|undefined|empty|must be set)";
+const ENV_VARIABLE = "[Ee]nv(?:ironment)?[ _-]?[Vv]ar(?:iable)?";
+/**
+ * The ways a run's output says it lacks an environment variable, each with the
+ * name in its first group. Each names the variable as one: a phrase about an
+ * environment variable around it, or `process.env.` before it.
+ */
+const NAMED_MISSING_VARIABLE = [
+    // "Missing required environment variable: SUPABASE_SECRET_KEY", "missing env var FOO"
+    new RegExp(`\\b[Mm]issing (?:[Rr]equired )?${ENV_VARIABLE}s?\\b[\\s:=\`'"([{]*(${VAR_NAME})\\b`, "g"),
+    // "Environment variable SUPABASE_URL is not set"
+    new RegExp(`\\b${ENV_VARIABLE} [\`'"]?(${VAR_NAME})[\`'"]? ${UNSET_WORDS}\\b`, "g"),
+    // "SUPABASE_URL environment variable is not set"
+    new RegExp(`\\b(${VAR_NAME}) ${ENV_VARIABLE} ${UNSET_WORDS}\\b`, "g"),
+    // "process.env.FOO is undefined"
+    new RegExp(`\\bprocess\\.env\\.(${VAR_NAME}) ${UNSET_WORDS}\\b`, "g"),
+    // Yarn Berry reading a `${TOKEN}` in .yarnrc.yml that the environment lacks
+    // (staging bench 2026-10-23: GITHUB_PACKAGES_TOKEN): the suite never started.
+    /\bEnvironment variable not found \(([A-Za-z_][A-Za-z0-9_]*)\)/g,
+    // django-environ: "ImproperlyConfigured: Set the SECRET_KEY environment variable"
+    new RegExp(`\\bSet the (${VAR_NAME}) environment variable\\b`, "g"),
+];
+/**
+ * A repository's own check of its environment, on a line that reads as the
+ * error the run stopped on (staging 2026-10-24, NearMyTown's e2e:
+ * "NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY is missing"). The name must look like
+ * a variable's (`A_B`), and the line an error's: a log line that a variable is
+ * missing is not why a run failed. Never "is not defined" or "is undefined":
+ * that is JavaScript's word for a name the code never declared.
+ */
+const BARE_MISSING_VARIABLE = /\b([A-Z][A-Z0-9]*(?:_[A-Z0-9]+)+) (?:is |was )?(?:missing|not set|must be set)\b/g;
+const ERROR_LINE = /(?:Error|Exception)\b|^\s*(?:error|ERROR|fatal|FATAL)\b/;
+/** At most this many missing variables are named in one cause. */
+const MAX_NAMED_VARIABLES = 3;
+/**
+ * A line that quotes what a test expected or received, or a diff of it: a
+ * test of an environment check, never the run's own missing variable.
+ */
+const QUOTED_LINE = /^\s*[-+]\s|\b(?:[Ee]xpected|[Rr]eceived|toThrow|[Aa]ssert)/;
+/**
+ * A line a logger wrote below error level (`warn:`, `[info]`, `DEBUG`,
+ * Next.js's `⚠`): a variable it says is missing is one the run went on
+ * without, never why it failed.
+ */
+const LOG_LINE = /^\s*(?:⚠|[[(]?(?:warn(?:ing)?|info|debug|trace|notice)\b)/i;
+/** Frameworks that say which variable they lack only by what it is for. */
+const MISSING_FRAMEWORK_KEY = [
+    // Rails credentials: "Missing encryption key to decrypt file with. ... ENV["RAILS_MASTER_KEY"]"
+    [/\bMissing encryption key to decrypt file with\b/, "RAILS_MASTER_KEY"],
+    // Laravel's MissingAppKeyException
+    [/\bNo application encryption key has been specified\b/, "APP_KEY"],
+];
+/** Phrases that say a variable is missing without naming it. */
+const UNNAMED_MISSING_VARIABLE = [
+    /\bmissing (?:required )?env(?:ironment)? (?:var(?:iable)?s?)\b/i,
+    /\benvironment variable\b[^\n]{0,80}\b(?:is )?(?:not set|missing|required|must be set)\b/i,
+];
+/**
+ * What a run could not start without, when its output says so in a way the
+ * gate recognises: a credential or variable the environment lacks, or a
+ * prerequisite the sandbox has not installed. Null for anything else, which
+ * stays a real failure. Pure.
+ *
+ * Narrow on purpose, since a match makes the run "could not run" rather than
+ * the change's failure:
+ *  - a named variable counts only when `env` (the environment the command ran
+ *    under) does not have it set: one it has is not why the run failed, and
+ *    no unnamed phrase then stands in for it;
+ *  - a line that quotes a test's expectation or a diff never counts, nor
+ *    one a logger wrote below error level;
+ *  - a repository's own "`A_B` is missing" counts only on an error's line.
+ *
+ * Without `env`, a named variable is taken as unset.
+ */
+export function classifyMissingPrerequisite(output, env) {
+    const unset = (name) => !env?.[name];
+    const lines = output
+        .split("\n")
+        .filter((line) => !QUOTED_LINE.test(line) && !LOG_LINE.test(line));
+    const named = new Set(lines.flatMap((line) => [
+        ...NAMED_MISSING_VARIABLE.flatMap((re) => [...line.matchAll(re)]),
+        ...(ERROR_LINE.test(line) ? [...line.matchAll(BARE_MISSING_VARIABLE)] : []),
+    ].map((match) => match[1])));
+    const missing = [...named].filter(unset);
+    if (missing.length > 0) {
+        const more = missing.length - MAX_NAMED_VARIABLES;
+        return `${missing.slice(0, MAX_NAMED_VARIABLES).join(", ")}${more > 0 ? ` and ${more} more` : ""}`;
+    }
+    const text = lines.join("\n");
+    for (const [re, name] of MISSING_FRAMEWORK_KEY) {
+        if (re.test(text) && unset(name))
+            return name;
+    }
+    // supabase-js `createClient` with no URL or key: the variable it was read from is unset.
+    const supabase = text.match(/\bsupabase(Url|Key) is required\b/);
+    if (supabase) {
+        return `a Supabase ${supabase[1] === "Url" ? "URL" : "key"} (supabase${supabase[1]} is required)`;
+    }
+    // Playwright with no browser of its own version (a prepare installs one; #2758).
+    if (/\bExecutable doesn't exist at /.test(text) &&
+        /\bplaywright install\b|\bbrowserType\.launch\b|\bms-playwright\b/.test(text)) {
+        return "Playwright's browsers (npx playwright install)";
+    }
+    // A variable the output names that the environment has is not missing, and
+    // no unnamed phrase stands in for it. A log line is not read at all, so one
+    // that names a variable never stops an error's own unnamed phrase from
+    // counting: that error says the run lacked a variable, only not which.
+    if (named.size === 0 && UNNAMED_MISSING_VARIABLE.some((re) => re.test(text))) {
+        return "an environment variable the output does not name";
+    }
+    return null;
+}
 /** Strip a trailing `(4 ms)` / `(0.82ms)` duration off a failing-test name. */
 function stripDuration(name) {
     return name.replace(/\s*\(\d+(?:\.\d+)?\s*m?s\)\s*$/, "").trim();
@@ -530,7 +679,9 @@ const FAILURE_SUMMARY = [
  *  - infra/env shapes (command not found, module resolution, connection
  *    refused, missing env var, DB/auth, connect timeout) → `infra` with a short
  *    cause; checked FIRST so a suite whose assertions failed only because its
- *    DB was down fails open rather than blocking.
+ *    DB was down fails open rather than blocking. A missing credential or
+ *    prerequisite ({@link classifyMissingPrerequisite}, given the `env` the
+ *    command ran under) is `infra` with `needs` and the cause "needs <it>".
  *  - recognisable failing-test lines (pnpm-wrapped vitest / jest / node:test
  *    TAP + spec reporters) → `failures` with located `critical` findings
  *    (capped at 25, deduped, locations attached when the runner printed them).
@@ -542,12 +693,15 @@ const FAILURE_SUMMARY = [
  * Callers scrub the output through {@link scrubSecrets} BEFORE classification
  * so findings/notes never carry secrets (§0.9).
  */
-export function classifyTestFailure(output, exitCode, limit = MAX_LOCATED_FINDINGS) {
+export function classifyTestFailure(output, exitCode, limit = MAX_LOCATED_FINDINGS, env) {
     if (exitCode === 0)
         return { kind: "clean" };
     const spawnInfra = classifyVerifyInfraFailure(output, exitCode);
     if (spawnInfra)
         return { kind: "infra", reason: spawnInfra };
+    const needs = classifyMissingPrerequisite(output, env);
+    if (needs)
+        return { kind: "infra", reason: `needs ${needs}`, needs };
     for (const [re, reason] of TEST_INFRA_PATTERNS) {
         if (re.test(output))
             return { kind: "infra", reason };
@@ -913,8 +1067,40 @@ export function buildRepoCheckEnv(source = process.env, toolchain = null, stepEn
     const env = buildTestEnv(source);
     for (const key of REPO_CHECK_SECRET_KEYS)
         delete env[key];
-    const withToolchain = toolchain ? { ...toolchain.env, ...env, PATH: toolchain.path } : env;
-    return { ...withToolchain, ...stepEnv, CI: "true" };
+    return { ...onToolchain(env, toolchain), ...stepEnv, CI: "true" };
+}
+/**
+ * `env` on the build's toolchain, as the model's shell gets it
+ * (`makeToolchainSpawnHook`): the toolchain's PATH, and its other variables
+ * beneath `env`'s own. No toolchain: `env` as it is.
+ */
+function onToolchain(env, toolchain) {
+    return toolchain ? { ...toolchain.env, ...env, PATH: toolchain.path } : env;
+}
+/**
+ * The environment the gate's own detected test script runs under. On a build
+ * that named a toolchain (a sandbox), an approved check's
+ * ({@link buildRepoCheckEnv}), so the suite runs on the repository's Node,
+ * Ruby or Go as the model's shell does, never the image's, and gives the same
+ * verdict it gives as an approved check. Without one (a developer's terminal),
+ * the user's own ({@link buildTestEnv}), as before.
+ */
+export function buildGateTestEnv(source = process.env, toolchain = null) {
+    return toolchain ? buildRepoCheckEnv(source, toolchain) : buildTestEnv(source);
+}
+/**
+ * The environment the gate's own detected typecheck or lint script runs
+ * under: the scrubbed {@link buildVerifyEnv} on the build's toolchain, when it
+ * named one. Undefined without one, so the exec seam's default applies, as
+ * before.
+ */
+export function buildGateVerifyEnv(source = process.env, toolchain = null) {
+    return toolchain ? onToolchain(buildVerifyEnv(source), toolchain) : undefined;
+}
+/** The toolchain the session's harness named (`YAGNI_TOOLCHAIN_FILE`), when it reads. */
+function sessionToolchain() {
+    const path = process.env.YAGNI_TOOLCHAIN_FILE?.trim();
+    return path ? readToolchainFile(path) : null;
 }
 /** One repository command as the gate runs it: through bash, as Actions runs a `run:` step. */
 function repoCheckArgv(run) {
@@ -1073,6 +1259,7 @@ export function makeWorkstreamCheck(opts = {}) {
         // command, untagged, by whichever target reaches the command first.
         const uncoveredEmitted = new Set();
         const results = [];
+        const env = buildGateVerifyEnv(process.env, (opts.toolchain ?? sessionToolchain)());
         for (const target of targets) {
             const dirs = claimDirs(cwd, target.files);
             const commands = dirs.length > 0 ? detect(cwd, dirs).filter((c) => dirs.includes(c.cwd)) : [];
@@ -1096,7 +1283,7 @@ export function makeWorkstreamCheck(opts = {}) {
                 if (!run) {
                     const composed = composeAbortSignal(signal, AbortSignal.timeout(timeoutMs));
                     try {
-                        const { code, output } = await exec(command.argv, command.cwd, composed);
+                        const { code, output } = await exec(command.argv, command.cwd, composed, env);
                         run = { code, output: scrubSecrets(output) };
                     }
                     catch (err) {
@@ -1139,6 +1326,38 @@ export function makeWorkstreamCheck(opts = {}) {
         return results;
     };
 }
+/**
+ * A failing repository command's findings, located from the folder it ran in
+ * and prefixed with what ran: the gate's on the build's tree, and the
+ * unchanged code's measurement ({@link makeMeasureChecksOnBase}), so a failure
+ * keys the same on both. Pure.
+ */
+function repoCommandFindings(failure, at) {
+    const limit = at.limit ?? MAX_LOCATED_FINDINGS;
+    const cls = classifyTestFailure(failure.output, failure.code, limit, failure.env);
+    const parsed = cls.kind === "failures"
+        ? cls.findings
+        : parseVerifyFailures(failure.output, failure.code, at.label, limit);
+    return parsed.map((f) => ({
+        ...liftFinding(f, at.repoRoot, at.dir),
+        message: `${at.prefix}: ${f.message}`,
+    }));
+}
+/** What an approved check's failure is prefixed with, on the build's tree and on the unchanged code. */
+const approvedPrefix = (label) => `approved check \`${label}\``;
+/**
+ * An approved check's standing on the unchanged code. What the session
+ * measured there stands over what the host handed it: a red the record kept
+ * may be stale.
+ */
+function measuredBaseline(onBase, check) {
+    const command = check.command.trim();
+    if (onBase?.failed.has(command))
+        return "fails_on_base";
+    if (onBase?.passed.has(command))
+        return "runnable";
+    return check.status;
+}
 /**
  * Build the runVerify function injected into the orchestrator. It discovers the
  * changed package(s) (scoped to this run's diff via `baselinePaths`), detects a
@@ -1173,11 +1392,7 @@ export function makeRunVerify(opts = {}) {
             const baseline = new Set(baselinePaths ?? []);
             return parseChangedPaths(snapshot.status).filter((p) => !baseline.has(p));
         });
-    const toolchain = opts.toolchain ??
-        (() => {
-            const path = process.env.YAGNI_TOOLCHAIN_FILE?.trim();
-            return path ? readToolchainFile(path) : null;
-        });
+    const toolchain = opts.toolchain ?? sessionToolchain;
     const treeStatus = opts.treeStatus ??
         (async (cwd, signal) => (await snapshotWorkspace(cwd, signal)).status);
     const undoTreeWrites = opts.undoTreeWrites ?? defaultUndoTreeWrites;
@@ -1276,7 +1491,7 @@ export function makeRunVerify(opts = {}) {
             cwd,
             signal,
             left: () => callBudget - (now() - halfStartedAt),
-            toolchainFile: toolchain(),
+            toolchainFile: input.toolchainFile,
             findings,
             reasons,
             labels,
@@ -1292,7 +1507,7 @@ export function makeRunVerify(opts = {}) {
         });
         try {
             await runApprovedChecks(run, approved);
-            await runCiSteps(run, steps, new Set(file.checks.map((check) => check.command.trim())));
+            await runCiSteps(run, steps, new Set(file.checks.map((check) => canonicalCheckCommand(check.command))));
         }
         finally {
             // Whatever ran (an aborted half included) is what the host reads. A half
@@ -1319,7 +1534,15 @@ export function makeRunVerify(opts = {}) {
         }
         return { findings, reasons, labels, checks: [...unrunnable, ...run.checks] };
     }
-    /** One repository command's verdict: passed, a note (it could not run), or a failure with its output. */
+    /**
+     * One repository command's verdict: passed, a note (it could not run), or a
+     * failure with its output. A check that passed on the unchanged code
+     * (`passedOnBase`, measured in this environment) and now says it lacks a
+     * credential failed: the change made it need one, and that is the change's
+     * (`needs` says what). Only the session that measured knows it passed: a
+     * resumed session's host carries forward what failed on the base, never
+     * what passed, so there the same check is could not run, failing open.
+     */
     async function runRepoCommand(run, command, dir, stepEnv, check) {
         const capMs = Math.min(opts.repoCheckTimeoutMs ?? REPO_CHECK_TIMEOUT_MS, run.left());
         const composed = composeAbortSignal(run.signal, AbortSignal.timeout(Math.max(1, capMs)));
@@ -1329,28 +1552,38 @@ export function makeRunVerify(opts = {}) {
         const startedAt = now();
         try {
             const { code, output: rawOutput } = await exec(repoCheckArgv(command), dir, composed, env);
-            const record = (baseline, note) => run.checks.push({
-                name: check.name,
-                command,
-                cwd: relative(run.cwd, dir) || ".",
-                exitCode: note ? null : code,
-                durationMs: now() - startedAt,
-                baseline,
-                ...(note ? { note } : {}),
-            });
+            const record = (baseline, note) => {
+                const entry = {
+                    name: check.name,
+                    command,
+                    cwd: relative(run.cwd, dir) || ".",
+                    exitCode: note ? null : code,
+                    durationMs: now() - startedAt,
+                    baseline,
+                    ...(note ? { note } : {}),
+                };
+                run.checks.push(entry);
+                return entry;
+            };
             if (code === 0) {
                 record(check.baseline);
                 return { kind: "passed" };
             }
             const output = scrubSecrets(rawOutput);
-            const cls = classifyTestFailure(output, code);
-            if (cls.kind === "infra") {
+            const cls = classifyTestFailure(output, code, MAX_LOCATED_FINDINGS, env);
+            if (cls.kind === "infra" && !(cls.needs && check.passedOnBase)) {
                 const reason = `could not run: ${cls.reason}`;
                 record("cannot_run", `${reason}; ${exitSummary(check.name, code, output)}`);
                 return { kind: "note", reason };
             }
-            record(check.baseline);
-            return { kind: "failed", output, code };
+            return {
+                kind: "failed",
+                output,
+                code,
+                env,
+                record: record(check.baseline),
+                ...(cls.kind === "infra" && cls.needs ? { needs: cls.needs } : {}),
+            };
         }
         catch (err) {
             run.checks.push({
@@ -1368,14 +1601,7 @@ export function makeRunVerify(opts = {}) {
     }
     /** A failure's findings, located from the folder the command ran in and prefixed with what ran. */
     function repoFailureFindings(run, failure, label, prefix, dir) {
-        const cls = classifyTestFailure(failure.output, failure.code);
-        const parsed = cls.kind === "failures"
-            ? cls.findings
-            : parseVerifyFailures(failure.output, failure.code, label);
-        return parsed.map((f) => ({
-            ...liftFinding(f, run.cwd, dir),
-            message: `${prefix}: ${f.message}`,
-        }));
+        return repoCommandFindings(failure, { label, prefix, repoRoot: run.cwd, dir });
     }
     const findingRoom = (run) => Math.max(0, MAX_LOCATED_FINDINGS - run.findings.length);
     /**
@@ -1398,22 +1624,46 @@ export function makeRunVerify(opts = {}) {
                 run.reasons.push(`approved check \`${label}\` not run: it changes the checkout's git state (a branch, a commit or a reset), which a check must never do`);
                 continue;
             }
+            // The failures it had there, when the session measured it failing.
+            const failedOnBase = opts.checksOnBase?.failed.get(check.command.trim());
+            const status = measuredBaseline(opts.checksOnBase, check);
             const verdict = await runRepoCommand(run, check.command, run.cwd, undefined, {
                 name: label,
-                baseline: check.status,
+                baseline: status,
+                passedOnBase: opts.checksOnBase?.passed.has(check.command.trim()) ?? false,
             });
             if (verdict.kind === "failed")
-                run.approvedFailed.add(check.command.trim());
+                run.approvedFailed.add(canonicalCheckCommand(check.command));
+            if (verdict.kind === "failed" && verdict.needs) {
+                run.reasons.push(`approved check \`${label}\` passed on the unchanged code and now needs ${verdict.needs}: the change's failure`);
+            }
             if (verdict.kind === "note") {
                 run.reasons.push(`approved check \`${label}\` ${verdict.reason}`);
             }
-            else if (verdict.kind === "failed" && check.status === "fails_on_base") {
+            else if (verdict.kind === "failed" && failedOnBase) {
+                // Only what the unchanged code did not already fail is this change's.
+                // A failure no parser reads is excused only when the unchanged code's
+                // was unread too (a summary line, as PHPUnit prints); after readable
+                // failures there, it says the change broke the run itself.
+                const found = repoFailureFindings(run, verdict, label, approvedPrefix(label), run.cwd);
+                const fresh = subtractBaseline(found, failedOnBase).findings.filter((finding) => failedOnBase.size > 0 || verifyFailureKey(finding) !== null);
+                if (fresh.length === 0) {
+                    run.reasons.push(`approved check \`${label}\` failed as it did on the unchanged code before the build; not this change's`);
+                }
+                else {
+                    // Its record reads as the change's failure, for the host too.
+                    verdict.record.baseline = "runnable";
+                    run.labels.push(label);
+                    run.findings.push(...fresh.slice(0, findingRoom(run)));
+                }
+            }
+            else if (verdict.kind === "failed" && status === "fails_on_base") {
                 run.reasons.push(`approved check \`${label}\` failed, and it already failed on the unchanged code; the host compares the two after the build`);
             }
             else {
                 run.labels.push(label);
                 if (verdict.kind === "failed") {
-                    const found = repoFailureFindings(run, verdict, label, `approved check \`${label}\``, run.cwd);
+                    const found = repoFailureFindings(run, verdict, label, approvedPrefix(label), run.cwd);
                     run.findings.push(...found.slice(0, findingRoom(run)));
                 }
             }
@@ -1450,8 +1700,8 @@ export function makeRunVerify(opts = {}) {
                 return;
             if (stoppedJobs.has(job))
                 continue;
-            if (approvedCommands.has(step.run.trim())) {
-                if (run.approvedFailed.has(step.run.trim()))
+            if (approvedCommands.has(canonicalCheckCommand(step.run))) {
+                if (run.approvedFailed.has(canonicalCheckCommand(step.run)))
                     settle(job, "failed");
                 else
                     stepPassed(job);
@@ -1526,6 +1776,8 @@ export function makeRunVerify(opts = {}) {
         const findings = [];
         const reasons = [];
         let anyRan = false;
+        // Every half runs on the build's toolchain, as the model's shell does.
+        const toolchainFile = toolchain();
         // Failures the clean tree already had, by command label (YAG-1003).
         const preexisting = new Map();
         const countPreexisting = (label, n) => {
@@ -1552,11 +1804,12 @@ export function makeRunVerify(opts = {}) {
         // recorded reason, no finding) without sinking the verdict for the packages
         // that did run. Output is scrubbed before it can enter a finding (§0.9).
         const typecheckLabels = [];
+        const typecheckEnv = buildGateVerifyEnv(process.env, toolchainFile);
         for (const command of commands) {
             const composed = composeAbortSignal(signal, AbortSignal.timeout(timeoutMs));
             const startedAt = now();
             try {
-                const { code, output: rawOutput } = await exec(command.argv, command.cwd, composed);
+                const { code, output: rawOutput } = await exec(command.argv, command.cwd, composed, typecheckEnv);
                 const output = scrubSecrets(rawOutput);
                 if (code !== 0) {
                     // Infra/env failure (command not found in a fresh worktree, Node loader
@@ -1600,16 +1853,28 @@ export function makeRunVerify(opts = {}) {
                 reasons.push("tests skipped: the typecheck half failed; 'clean' still requires a later round's tests");
             }
             else {
-                const testEnv = opts.testEnv ?? buildTestEnv();
+                const testEnv = opts.testEnv ?? buildGateTestEnv(process.env, toolchainFile);
                 let testFindingCount = 0;
+                // A root test script an approved check runs too (`yarn run test`
+                // beside `yarn test`) runs once, as that check, on the repository's
+                // toolchain: the staging bench (2026-10-25) ran one suite as both and
+                // read two verdicts of it.
+                const approvedTwins = new Set((repoFile?.checks ?? [])
+                    .filter((check) => check.status !== "cannot_run")
+                    .map((check) => canonicalCheckCommand(check.command)));
                 for (const command of testCommands) {
                     const where = basename(command.cwd) || command.cwd;
+                    const line = command.argv.join(" ");
+                    if (relative(cwd, command.cwd) === "" && approvedTwins.has(canonicalCheckCommand(line))) {
+                        reasons.push(`tests (${where}): \`${line}\` runs once, as the approved check it is`);
+                        continue;
+                    }
                     const composed = composeAbortSignal(signal, AbortSignal.timeout(testTimeoutMs));
                     const startedAt = now();
                     try {
                         const { code, output: rawOutput } = await exec(command.argv, command.cwd, composed, testEnv);
                         const output = scrubSecrets(rawOutput);
-                        const cls = classifyTestFailure(output, code, Number.POSITIVE_INFINITY);
+                        const cls = classifyTestFailure(output, code, Number.POSITIVE_INFINITY, testEnv);
                         if (cls.kind === "infra") {
                             recordCommand(command, null, startedAt, "cannot_run", `could not run: ${cls.reason}; ${exitSummary(command.label, code, output)}`);
                             reasons.push(`tests (${where}) could not run: ${cls.reason}; 'clean' reflects typecheck + review only`);
@@ -1674,6 +1939,7 @@ export function makeRunVerify(opts = {}) {
                     signal,
                     baselinePaths,
                     callStartedAt,
+                    toolchainFile,
                 });
                 reasons.push(...repo.reasons);
                 repoLabels.push(...repo.labels);
@@ -1781,6 +2047,10 @@ export function makeTakeVerifyBaseline(opts = {}) {
             ...commands.map((command) => ({ command, test: false })),
             ...tests.map((command) => ({ command, test: true })),
         ];
+        // The gate's environments, so a failure keys the same on the clean tree and the build's.
+        const toolchainFile = (opts.toolchain ?? sessionToolchain)();
+        const verifyEnv = buildGateVerifyEnv(process.env, toolchainFile);
+        const testEnv = opts.testEnv ?? buildGateTestEnv(process.env, toolchainFile);
         try {
             for (const { command, test } of runs) {
                 if (signal?.aborted)
@@ -1795,13 +2065,11 @@ export function makeTakeVerifyBaseline(opts = {}) {
                     : (opts.timeoutMs ?? VERIFY_TIMEOUT_MS), left);
                 const composed = composeAbortSignal(signal, AbortSignal.timeout(cap));
                 try {
-                    const { code, output: rawOutput } = test
-                        ? await exec(command.argv, command.cwd, composed, opts.testEnv ?? buildTestEnv())
-                        : await exec(command.argv, command.cwd, composed);
+                    const { code, output: rawOutput } = await exec(command.argv, command.cwd, composed, test ? testEnv : verifyEnv);
                     const output = scrubSecrets(rawOutput);
                     let failed;
                     if (test) {
-                        const cls = classifyTestFailure(output, code, Number.POSITIVE_INFINITY);
+                        const cls = classifyTestFailure(output, code, Number.POSITIVE_INFINITY, testEnv);
                         if (cls.kind === "infra" || cls.kind === "uncertain") {
                             result.notes.push(`${command.label} (${command.cwd}): ${cls.kind === "infra" ? cls.reason : "output not interpretable"}`);
                             if (cls.kind === "uncertain") {
@@ -1847,4 +2115,115 @@ export function makeTakeVerifyBaseline(opts = {}) {
         return result;
     };
 }
+/**
+ * The whole measurement's cap, before the build starts: each check marked to
+ * measure, once, the plan's first.
+ */
+export const CHECKS_ON_BASE_BUDGET_MS = 10 * 60_000;
+/**
+ * Run each approved check `checks.json` marks `measureOnBase` once on the
+ * unchanged code, before the build changes anything: a plan's check the
+ * host has not seen pass there (none of the record's, or a red one the
+ * record may hold from long ago), and a command the repository's CI runs
+ * when the record names no check of its own. A check the plan wrote for the
+ * change often fails there by design (its test file is not written yet), and a
+ * failure that says only that (a file not found, no tests to run, output no
+ * parser reads) is no verdict: its failures all count after the build, as
+ * before. A failure the gate reads (failing tests, located diagnostics, a
+ * test runner's failure summary) is one the unchanged code already has.
+ *
+ * Run as the gate runs the check ({@link makeRunVerify}): the same command
+ * line, environment and toolchain, from the repository root, so a failure
+ * keys the same on both trees. Bounded: each check by its cap, the whole by
+ * the budget, and one not reached in it has no verdict. What the checks
+ * write into the tree is undone.
+ */
+export function makeMeasureChecksOnBase(opts = {}) {
+    const exec = opts.exec ?? defaultExec;
+    const now = opts.now ?? Date.now;
+    const toolchain = opts.toolchain ?? sessionToolchain;
+    const treeStatus = opts.treeStatus ??
+        (async (cwd, signal) => (await snapshotWorkspace(cwd, signal)).status);
+    const undoTreeWrites = opts.undoTreeWrites ?? defaultUndoTreeWrites;
+    return async function measureChecksOnBase(cwd, file, signal, budgetOverrideMs) {
+        const passed = new Set();
+        const failed = new Map();
+        const result = { passed, failed, ran: [], notes: [], treeUndone: true };
+        const targets = file.checks.filter((check) => check.measureOnBase === true &&
+            check.status !== "cannot_run" &&
+            !changesGitState(check.command));
+        if (targets.length === 0)
+            return result;
+        const startedAt = now();
+        const budgetMs = Math.min(opts.budgetMs ?? CHECKS_ON_BASE_BUDGET_MS, budgetOverrideMs ?? Number.POSITIVE_INFINITY);
+        const env = opts.repoChecksEnv ?? buildRepoCheckEnv(process.env, toolchain());
+        const before = await treeStatus(cwd, signal).catch((err) => {
+            const msg = err instanceof Error ? err.message : String(err);
+            result.treeUndone = false;
+            result.notes.push(`could not read the tree before the checks, so what they write is not undone: ${scrubSecrets(msg)}`);
+            return null;
+        });
+        try {
+            for (const check of targets) {
+                if (signal?.aborted)
+                    break;
+                const command = check.command.trim();
+                const label = checkLabel(check.command);
+                const left = budgetMs - (now() - startedAt);
+                if (left < REPO_CHECK_MIN_START_MS) {
+                    result.notes.push(`\`${label}\`: not reached in the budget`);
+                    continue;
+                }
+                const composed = composeAbortSignal(signal, AbortSignal.timeout(Math.min(opts.timeoutMs ?? REPO_CHECK_TIMEOUT_MS, left)));
+                try {
+                    const { code, output: rawOutput } = await exec(repoCheckArgv(check.command), cwd, composed, env);
+                    if (code === 0) {
+                        passed.add(command);
+                        result.ran.push(label);
+                        continue;
+                    }
+                    const output = scrubSecrets(rawOutput);
+                    const cls = classifyTestFailure(output, code, Number.POSITIVE_INFINITY, env);
+                    if (cls.kind === "infra") {
+                        result.notes.push(`\`${label}\`: could not run: ${cls.reason}`);
+                        continue;
+                    }
+                    const found = repoCommandFindings({ output, code, env }, {
+                        label,
+                        prefix: approvedPrefix(label),
+                        repoRoot: cwd,
+                        dir: cwd,
+                        limit: Number.POSITIVE_INFINITY,
+                    });
+                    // Output no parser reads says nothing of what failed (a test file
+                    // the change writes, not there yet): no verdict.
+                    if (cls.kind === "uncertain" && found.every((f) => verifyFailureKey(f) === null)) {
+                        result.notes.push(`\`${label}\`: exited ${code} with output no parser reads`);
+                        continue;
+                    }
+                    failed.set(command, failureKeyCounts(found));
+                    result.ran.push(label);
+                }
+                catch (err) {
+                    result.notes.push(`\`${label}\`: ${unexitedNote(err, signal, composed)}`);
+                }
+            }
+        }
+        finally {
+            if (before !== null) {
+                try {
+                    const written = newTreeEntries(before, await treeStatus(cwd));
+                    if (written.length > 0)
+                        await undoTreeWrites(cwd, written);
+                }
+                catch (err) {
+                    const msg = err instanceof Error ? err.message : String(err);
+                    result.treeUndone = false;
+                    result.notes.push(`could not undo what the checks wrote into the tree: ${scrubSecrets(msg)}`);
+                }
+            }
+        }
+        return result;
+    };
+}
 //# sourceMappingURL=verify.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "1.2.7-staging.2022.1",
+  "version": "1.2.7-staging.2031.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -58,5 +58,5 @@
     "turndown": "^7.2.4",
     "typebox": "^1.3.15"
   },
-  "yagniSourceSha": "a1987aec00c09173fc5632921272940eac896c8e"
+  "yagniSourceSha": "38e1c8e1dced29e7f90bc2502b9aaef9fa7415db"
 }