@yagni-app/code-staging 1.2.7-staging.2056.1 → 1.2.7-staging.2062.1

package/dist/extension/pipeline/changeScan.d.ts

@@ -52,11 +52,18 @@ export interface ChangeScanOpts {
     /** This session's own credentials, matched by value. */
     sessionSecrets?: readonly string[];
     readFile?: (path: string) => Buffer;
+    /**
+     * The commit the run started from: what it committed past it is scanned
+     * too, since a model that commits leaves nothing on top of HEAD (YAG-1039).
+     * Absent: HEAD.
+     */
+    base?: string;
 }
 /**
- * Scan what this run added on top of HEAD: tracked files' added lines, new
- * files whole, minus `skip` (the tree's pre-run dirt). Null when git could
- * not say what changed: the gate then notes the scan did not run.
+ * Scan what this run added on top of its base (HEAD, unless `opts.base`):
+ * tracked files' added lines, new files whole, minus `skip` (the tree's
+ * pre-run dirt). Null when git could not say what changed: the gate then
+ * notes the scan did not run.
  */
 export declare function scanChange(cwd: string, opts: ChangeScanOpts, skip?: readonly string[], signal?: AbortSignal): Promise<Finding[] | null>;
 //# sourceMappingURL=changeScan.d.ts.map

package/dist/extension/pipeline/changeScan.js

@@ -253,9 +253,10 @@ function bytesAreBinary(bytes) {
 /** How much of one new file is scanned: a credential sits in source, not past the first megabyte. */
 const MAX_SCANNED_FILE_BYTES = 1024 * 1024;
 /**
- * Scan what this run added on top of HEAD: tracked files' added lines, new
- * files whole, minus `skip` (the tree's pre-run dirt). Null when git could
- * not say what changed: the gate then notes the scan did not run.
+ * Scan what this run added on top of its base (HEAD, unless `opts.base`):
+ * tracked files' added lines, new files whole, minus `skip` (the tree's
+ * pre-run dirt). Null when git could not say what changed: the gate then
+ * notes the scan did not run.
  */
 export async function scanChange(cwd, opts, skip = [], signal) {
     // `git status --porcelain` lists an untracked folder as `dir/`, so a skip
@@ -267,10 +268,11 @@ export async function scanChange(cwd, opts, skip = [], signal) {
         has: (path) => skipFiles.has(path) || skipDirs.some((dir) => path.startsWith(dir)),
     };
     const git = (args) => opts.exec(["git", "-c", "core.quotepath=off", ...args], cwd, signal);
+    const base = opts.base ?? "HEAD";
     // A deleted binary is no binary in the change: the host lets it through.
     const [numstat, diff, others] = await Promise.all([
-        git(["diff", "HEAD", "--numstat", "--no-renames", "--no-ext-diff", "--diff-filter=d"]),
-        git(["diff", "HEAD", "-U0", "--no-color", "--no-renames", "--no-ext-diff"]),
+        git(["diff", base, "--numstat", "--no-renames", "--no-ext-diff", "--diff-filter=d"]),
+        git(["diff", base, "-U0", "--no-color", "--no-renames", "--no-ext-diff"]),
         git(["ls-files", "--others", "--exclude-standard"]),
     ]);
     if (numstat.code !== 0 || diff.code !== 0 || others.code !== 0)

package/dist/extension/pipeline/cloud.d.ts

@@ -190,8 +190,10 @@ export interface CloudCompletion {
  * commits its work locally on the branch the host checked out, so nothing is
  * lost when the sandbox goes. `result.json` is written last; the caller mirrors
  * it on the stream. `ok` is a written plan, or a clean candidate whose branch
- * carries this attempt's committed work, from this execution or an earlier
- * one: a clean stop with nothing committed at all delivered nothing.
+ * carries this attempt's committed work: a commit past the execution's base,
+ * whoever wrote it (a model that ran `git commit` too, YAG-1039), or an
+ * earlier execution's. A clean stop with nothing committed at all delivered
+ * nothing.
  */
 export declare function completeCloudSession(c: CloudCompletion, ran: {
     result: PipelineResult;

package/dist/extension/pipeline/cloud.js

@@ -247,8 +247,10 @@ function findingKey(finding) {
  * commits its work locally on the branch the host checked out, so nothing is
  * lost when the sandbox goes. `result.json` is written last; the caller mirrors
  * it on the stream. `ok` is a written plan, or a clean candidate whose branch
- * carries this attempt's committed work, from this execution or an earlier
- * one: a clean stop with nothing committed at all delivered nothing.
+ * carries this attempt's committed work: a commit past the execution's base,
+ * whoever wrote it (a model that ran `git commit` too, YAG-1039), or an
+ * earlier execution's. A clean stop with nothing committed at all delivered
+ * nothing.
  */
 export async function completeCloudSession(c, ran) {
     const notes = "error" in ran ? [ran.error] : [];
@@ -334,21 +336,25 @@ export async function completeCloudSession(c, ran) {
             rounds: result?.rounds.length ?? 0,
             openPr: false,
             ...(c.preRunDirt.length > 0 ? { baselinePaths: c.preRunDirt } : {}),
+            ...(c.baseSha ? { baseSha: c.baseSha } : {}),
             exec: c.exec,
         });
         committed = finish.committed;
         notes.push(...finish.notes);
     }
+    const facts = await gitFacts(c.cwd, c.exec, c.baseSha);
+    notes.push(...facts.notes);
     let delivered = outputsWritten;
     if (c.stage !== "plan") {
-        const onBranch = committed || (await attemptCommitted(c.cwd, c.exec, c.identity.attemptId));
+        // A commit past the base is this execution's work, whoever wrote it.
+        const onBranch = committed ||
+            facts.commits.length > 0 ||
+            (await attemptCommitted(c.cwd, c.exec, c.identity.attemptId));
         if (onBranch === null) {
             notes.push("git log failed, so the result cannot say whether the branch carries this attempt's work.");
         }
         delivered = onBranch === true;
     }
-    const facts = await gitFacts(c.cwd, c.exec, c.baseSha);
-    notes.push(...facts.notes);
     // What the final scan and checks found beside the last round's findings; a
     // finding both report is listed once.
     const seen = new Set((result?.findings ?? []).map(findingKey));

package/dist/extension/pipeline/finish.d.ts

@@ -7,7 +7,8 @@
  *    branch (the tree started clean, so everything is the run's own). In --here
  *    mode it commits ONLY when the pre-run baseline was verifiably clean;
  *    otherwise it skips with an honest note (never mixing user dirt into an
- *    agent commit).
+ *    agent commit). A run given its base commit (the cloud session) whose work
+ *    is already committed past it gets the trailer on an empty commit instead.
  *  - Commit message: `<type>(<scope>): <title>` + a 2-3 sentence plan summary +
  *    the exact provenance trailer (YAGNI-Run / YAGNI-Ticket / YAGNI-Verify /
  *    YAGNI-Decisions / YAGNI-Rounds / Co-Authored-By: YAGNI Code).
@@ -72,6 +73,13 @@ export interface RunFinishOpts extends TrailerInputs {
      * lands in the run's provenance commit. Absent ⇒ the whole diff is the run's.
      */
     baselinePaths?: string[];
+    /**
+     * The commit the run started from (a cloud session's). When the tree holds
+     * nothing of the run's own because the run already committed its work past
+     * it (the model ran `git commit`), FINISH puts the trailer on an empty
+     * commit on top, so the branch still carries the run's `YAGNI-Run` line.
+     */
+    baseSha?: string;
     signal?: AbortSignal;
     exec?: WorktreeExec;
 }

package/dist/extension/pipeline/finish.js

@@ -7,7 +7,8 @@
  *    branch (the tree started clean, so everything is the run's own). In --here
  *    mode it commits ONLY when the pre-run baseline was verifiably clean;
  *    otherwise it skips with an honest note (never mixing user dirt into an
- *    agent commit).
+ *    agent commit). A run given its base commit (the cloud session) whose work
+ *    is already committed past it gets the trailer on an empty commit instead.
  *  - Commit message: `<type>(<scope>): <title>` + a 2-3 sentence plan summary +
  *    the exact provenance trailer (YAGNI-Run / YAGNI-Ticket / YAGNI-Verify /
  *    YAGNI-Decisions / YAGNI-Rounds / Co-Authored-By: YAGNI Code).
@@ -238,6 +239,27 @@ function tail(output) {
         .trim();
     return t;
 }
+/**
+ * The paths the run's commits past `baseSha` changed: empty with no base, no
+ * commit past it, or a change that nets to nothing; `failed` when git could
+ * not say, so a note never reads that as nothing committed.
+ */
+async function committedSince(run, baseSha) {
+    if (!baseSha)
+        return [];
+    const commits = await run(["git", "rev-list", `${baseSha}..HEAD`]);
+    if (commits.code !== 0)
+        return { failed: tail(commits.output) || "git rev-list failed" };
+    if (!commits.output.trim())
+        return [];
+    const diff = await run(["git", "diff", "--name-only", baseSha, "HEAD"]);
+    if (diff.code !== 0)
+        return { failed: tail(diff.output) || "git diff failed" };
+    return diff.output
+        .split("\n")
+        .map((line) => line.trim())
+        .filter(Boolean);
+}
 /**
  * Run the FINISH stage. NEVER throws; every failure path returns an honest
  * {@link FinishResult} with notes. See the module docblock for the contract.
@@ -273,33 +295,42 @@ export async function runFinish(opts) {
         if (status.code !== 0) {
             return skipped(`FINISH could not read the git status (${tail(status.output) || "git failed"}); nothing was committed.`);
         }
-        if (!status.output.trim()) {
-            return skipped("FINISH found nothing to commit (the tree is already clean).");
-        }
         // The run's OWN paths = everything changed now, minus what was already dirty
         // at pipeline start (bootstrap lockfile churn, or a pre-existing edit). We
         // commit only these, so the provenance commit never folds in non-run work.
         const changed = parseChangedPaths(status.output);
         const baseline = new Set(opts.baselinePaths ?? []);
         const runOwned = baseline.size === 0 ? changed : changed.filter((p) => !baseline.has(p));
-        if (runOwned.length === 0) {
-            return skipped("FINISH found nothing of the run's own to commit (the only changes were already present before the run).");
+        // Nothing of the run's own left in the tree, but its work may already be
+        // committed past its base: the trailer then goes on an empty commit.
+        const committed = runOwned.length === 0 ? await committedSince(run, opts.baseSha) : [];
+        if (!Array.isArray(committed)) {
+            return skipped(`FINISH could not read what the run committed past its base (${committed.failed}); nothing was committed.`);
+        }
+        if (runOwned.length === 0 && committed.length === 0) {
+            return skipped(status.output.trim()
+                ? "FINISH found nothing of the run's own to commit (the only changes were already present before the run)."
+                : "FINISH found nothing to commit (the tree is already clean).");
         }
+        const trailerOnly = runOwned.length === 0;
         // Message derivation off the run's real diff.
-        const subject = commitSubject(commitType(opts.ticket, opts.ticketBrief), deriveCommitScope(runOwned), commitTitle(opts.ticket, opts.ticketBrief));
+        const subject = commitSubject(commitType(opts.ticket, opts.ticketBrief), deriveCommitScope(trailerOnly ? committed : runOwned), commitTitle(opts.ticket, opts.ticketBrief));
         const summary = summarizePlan(opts.planText, opts.ticket);
         const trailer = provenanceTrailer(opts);
         const message = buildCommitMessage(subject, summary, trailer);
         // No baseline dirt ⇒ everything is the run's own: `git add -A` (preserves
         // rename detection). With a baseline, stage only the run-owned paths so
         // bootstrap/pre-existing dirt never lands (`--` guards flag-like paths).
-        const add = baseline.size === 0
-            ? await run(["git", "add", "-A"])
-            : await run(["git", "add", "--", ...runOwned]);
-        if (add.code !== 0) {
-            return skipped(`FINISH could not stage the changes (git add failed: ${tail(add.output)}); nothing was committed.`);
+        if (!trailerOnly) {
+            const add = baseline.size === 0
+                ? await run(["git", "add", "-A"])
+                : await run(["git", "add", "--", ...runOwned]);
+            if (add.code !== 0) {
+                return skipped(`FINISH could not stage the changes (git add failed: ${tail(add.output)}); nothing was committed.`);
+            }
         }
-        let commit = await run(["git", "commit", "-m", message]);
+        const commitArgs = [...(trailerOnly ? ["--allow-empty"] : []), "-m", message];
+        let commit = await run(["git", "commit", ...commitArgs]);
         if (commit.code !== 0) {
             // Most likely a missing git identity in a fresh environment (mirrors
             // commitWip): retry once with an explicit YAGNI Code identity.
@@ -310,8 +341,7 @@ export async function runFinish(opts) {
                 "-c",
                 "user.email=code@yagni.app",
                 "commit",
-                "-m",
-                message,
+                ...commitArgs,
             ]);
         }
         if (commit.code !== 0) {

package/dist/extension/pipeline/headlessGo.js

@@ -549,6 +549,23 @@ export async function runHeadlessGo(argv, deps = {}) {
     // A cloud session reports the checks of the tree it commits: the gate's last
     // verdict, with the tree it judged.
     const snapshot = deps.snapshotWorkspace ?? snapshotWorkspace;
+    // A cloud session's start: the commit it builds on (its result's `baseSha`,
+    // which its gate and scan read its change against, since a model may commit
+    // its own work) and the tree's pre-run dirt (an install's lockfile churn),
+    // which never lands in its commit.
+    const startTree = cloud ? await snapshot(cwd, deps.signal) : undefined;
+    const baseSha = startTree?.head ?? "";
+    const preRunDirt = startTree ? parseChangedPaths(startTree.status) : [];
+    const onBase = baseSha ? { base: baseSha } : {};
+    // Its reviewer reads the change from that commit too (YAG-1041). A
+    // continuation starts past the attempt's earlier commits, so its start is
+    // not where the change begins: its reviewer keeps the bare `git diff`.
+    const reviewLane = lane && baseSha && !continuation
+        ? {
+            ...lane,
+            stages: lane.stages.map((s) => (s.id === "review" ? { ...s, diffBase: baseSha } : s)),
+        }
+        : lane;
     let gate;
     let lastVerify;
     // A cloud session's gate also runs the host's secret and binary scans on
@@ -556,7 +573,7 @@ export async function runHeadlessGo(argv, deps = {}) {
     const exec = deps.exec ?? finishExec;
     const sessionSecrets = [env.YAGNI_TOKEN, env.GH_ENTERPRISE_TOKEN].filter((value) => Boolean(value));
     const scan = cloud
-        ? (scanCwd, signal, skip) => scanChange(scanCwd, { exec, sessionSecrets }, skip, signal)
+        ? (scanCwd, signal, skip) => scanChange(scanCwd, { exec, sessionSecrets, ...onBase }, skip, signal)
         : undefined;
     if (gateOpts || baseline || cloud) {
         const made = (deps.makeRunVerify ?? makeRunVerify)({
@@ -564,7 +581,10 @@ export async function runHeadlessGo(argv, deps = {}) {
             ...(baseline ? { baseline } : {}),
             ...(checksOnBase ? { checksOnBase } : {}),
             ...(scan ? { scanChange: scan } : {}),
-            ...(cloud ? { unreadTestFailureIsFinding: true } : {}),
+            // The one-attempt lane's host runs no checks after the build.
+            ...(cloud
+                ? { unreadTestFailureIsFinding: true, hostRechecks: false, ...(baseSha ? { baseSha } : {}) }
+                : {}),
             ...heard,
         });
         gate = made;
@@ -595,7 +615,7 @@ export async function runHeadlessGo(argv, deps = {}) {
         ...(budget ? { budget } : {}),
         ...(deps.stages ? { stages: deps.stages } : {}),
         grounded: deps.grounded ?? grounding,
-        ...(lane ? { lane } : {}),
+        ...(reviewLane ? { lane: reviewLane } : {}),
         ...(mission ? { mission } : {}),
         ...(runVerify ? { runVerify } : {}),
         ...(baseline ? { runWorkstreamCheck: makeWorkstreamCheck({ baseline }) } : {}),
@@ -634,12 +654,6 @@ export async function runHeadlessGo(argv, deps = {}) {
                 emit({ type: "pipeline_log", event, ...(data === undefined ? {} : { data }) });
         },
     };
-    // A cloud session's start: the commit it builds on (its result's `baseSha`)
-    // and the tree's pre-run dirt (an install's lockfile churn), which never
-    // lands in its commit.
-    const startTree = cloud ? await snapshot(cwd, deps.signal) : undefined;
-    const baseSha = startTree?.head ?? "";
-    const preRunDirt = startTree ? parseChangedPaths(startTree.status) : [];
     /** The cloud session's last act (cloud.ts `completeCloudSession`), mirrored on the stream. */
     const completeCloud = async (session, ran) => {
         const verifyGate = gate;
@@ -668,7 +682,7 @@ export async function runHeadlessGo(argv, deps = {}) {
                     },
                 }
                 : {}),
-            scan: () => scanChange(cwd, { exec, sessionSecrets }, preRunDirt),
+            scan: () => scanChange(cwd, { exec, sessionSecrets, ...onBase }, preRunDirt),
             planPaths: (planText) => baselineDirs(cwd, planPaths(planText), readFile).map((dir) => relative(cwd, dir) || "."),
             exec,
             writeFile: deps.writeFile ?? writeFileSync,

package/dist/extension/pipeline/personas.d.ts

@@ -50,10 +50,11 @@ export declare function builderPersonaClause(workstream?: PartitionWorkstream, s
  * Resolve the system-prompt body for a stage. For non-review stages this is the
  * role body; for the review stage it appends the lens-specific clause (or, with
  * no lens, the one-reviewer clause covering all three) and the required
- * findings output contract so the reviewer's output parses. A stage carrying a
- * `personaClause` (the fan-out builders) gets it appended last, and one
- * carrying a `persona` (the cloud plan stage's host persona) runs with that in
- * place of its agent's body.
+ * findings output contract so the reviewer's output parses. A review carrying
+ * a `diffBase` (a cloud session's) diffs from that commit in its first step. A
+ * stage carrying a `personaClause` (the fan-out builders) gets it appended
+ * last, and one carrying a `persona` (the cloud plan stage's host persona)
+ * runs with that in place of its agent's body.
  *
  * `grounded` defaults true (every real /go stage). The M6 eval passes
  * `grounded: false` to select the grounding-free bodies + lens clauses for the

package/dist/extension/pipeline/personas.js

@@ -86,12 +86,22 @@ What was done.
 Any record_decision calls you made, and why.
 ## Notes
 Anything the reviewer should know (exact file paths, key functions touched).`;
+/** The reviewer's first step, which a stage's `diffBase` rewrites (see `personaBody`). */
+const REVIEWER_DIFF_STEP = "1. `git diff` to see the change.";
+/**
+ * The reviewer's first step on a change read from `base`, the commit a cloud
+ * session started on: its model may have committed its work, which a bare
+ * `git diff` no longer shows (YAG-1041).
+ */
+function reviewerDiffStepFrom(base) {
+    return `1. \`git diff ${base}\` to see the change: everything this session changed since its base commit ${base}, committed or not (a bare \`git diff\` shows only what is not committed yet). \`git log ${base}..HEAD\` lists its commits, and \`git status\` lists new files git does not track yet.`;
+}
 const REVIEWER_BODY = `You are a senior, adversarial code reviewer. Analyze the change for real problems, not style nits. Bash is read-only here (\`git diff\`, \`git log\`, \`git show\`); do NOT modify files or run builds.
 
 You are grounded in how THIS company works — that context is your edge over a repo-only reviewer.
 
 Strategy:
-1. \`git diff\` to see the change.
+${REVIEWER_DIFF_STEP}
 2. Read the modified files and their surroundings.
 3. Judge the change through your assigned lens (below).`;
 const ADVISOR_BODY = `You are a senior advisor, brought in on ONE hard call by an agent that is already working the problem. You are the strongest model in this system and you are expensive, so you are consulted, not driven — the caller does the work, you supply the judgment.
@@ -300,7 +310,7 @@ Anything the reviewer should know (exact file paths, key functions touched).`;
 const REVIEWER_BLIND = `You are a senior, adversarial code reviewer. Analyze the change for real problems, not style nits. Bash is read-only here (\`git diff\`, \`git log\`, \`git show\`); do NOT modify files or run builds.
 
 Strategy:
-1. \`git diff\` to see the change.
+${REVIEWER_DIFF_STEP}
 2. Read the modified files and their surroundings.
 3. Judge the change through your assigned lens (below).`;
 const ADVISOR_BLIND = `You are a senior advisor, brought in on ONE hard call by an agent that is already working the problem. You are the strongest model in this system and you are expensive, so you are consulted, not driven — the caller does the work, you supply the judgment.
@@ -428,10 +438,11 @@ export function builderPersonaClause(workstream, siblings = []) {
  * Resolve the system-prompt body for a stage. For non-review stages this is the
  * role body; for the review stage it appends the lens-specific clause (or, with
  * no lens, the one-reviewer clause covering all three) and the required
- * findings output contract so the reviewer's output parses. A stage carrying a
- * `personaClause` (the fan-out builders) gets it appended last, and one
- * carrying a `persona` (the cloud plan stage's host persona) runs with that in
- * place of its agent's body.
+ * findings output contract so the reviewer's output parses. A review carrying
+ * a `diffBase` (a cloud session's) diffs from that commit in its first step. A
+ * stage carrying a `personaClause` (the fan-out builders) gets it appended
+ * last, and one carrying a `persona` (the cloud plan stage's host persona)
+ * runs with that in place of its agent's body.
  *
  * `grounded` defaults true (every real /go stage). The M6 eval passes
  * `grounded: false` to select the grounding-free bodies + lens clauses for the
@@ -443,7 +454,10 @@ export function personaBody(stage, opts = {}) {
     const base = stage.persona?.trim() || bodies[stage.agent];
     if (!base)
         throw new Error(`No persona body for agent "${stage.agent}"`);
-    const parts = [base];
+    const diffBase = stage.diffBase;
+    const parts = [
+        diffBase ? base.replace(REVIEWER_DIFF_STEP, () => reviewerDiffStepFrom(diffBase)) : base,
+    ];
     if (stage.id === "review") {
         const clauses = grounded ? LENS_CLAUSES : BLIND_LENS_CLAUSES;
         if (stage.lens)

package/dist/extension/pipeline/types.d.ts

@@ -72,6 +72,12 @@ export interface PipelineStage {
      * plan stage takes the host's `plan-persona.md` (Reeve's persona) here.
      */
     persona?: string;
+    /**
+     * The commit a review reads the change from (a cloud session's start,
+     * YAG-1041): its first step is `git diff <diffBase>`, since a model that
+     * commits its work leaves a bare `git diff` empty. Absent: `git diff`.
+     */
+    diffBase?: string;
     /**
      * The stage's own clock, in milliseconds (`stageClock.ts`). Past it the
      * child refuses every tool call, so the model writes its answer from what it

package/dist/extension/pipeline/verify.d.ts

@@ -244,13 +244,19 @@ export declare function parseChangedPaths(status: string): string[];
  */
 export declare function resolvePackageDirs(repoRoot: string, relPaths: string[], readFile: (path: string) => string): string[];
 /**
- * This run's OWN changed package dirs: the porcelain `status`'s packages MINUS the
- * packages touched only by `baselinePaths` (the tree's pre-run dirt). A package with
- * a NEW change stays in scope even if it also had pre-run dirt; a package whose every
- * changed path predates the run drops out. Pure (the `readFile` seam keeps it so), so
- * an unrelated dirty package can never retarget the gate off this run's real diff.
+ * This run's OWN changed paths: the porcelain `status`'s, plus `committed` (what
+ * the run already committed past its base, YAG-1039), MINUS `baselinePaths` (the
+ * tree's pre-run dirt). Pure, deduped.
  */
-export declare function ownChangedDirs(repoRoot: string, status: string, baselinePaths: string[], readFile: (path: string) => string): string[];
+export declare function ownChangedPaths(status: string, baselinePaths: string[], committed?: string[]): string[];
+/**
+ * This run's OWN changed package dirs: the packages of {@link ownChangedPaths}, so a
+ * package touched only by `baselinePaths` (the tree's pre-run dirt) drops out. A
+ * package with a NEW change stays in scope even if it also had pre-run dirt. Pure
+ * (the `readFile` seam keeps it so), so an unrelated dirty package can never
+ * retarget the gate off this run's real diff.
+ */
+export declare function ownChangedDirs(repoRoot: string, status: string, baselinePaths: string[], readFile: (path: string) => string, committed?: string[]): string[];
 /**
  * Resolve the verify command(s) for a repo. An explicitly allowed `.yagni-code/verify`
  * override wins (first non-comment, non-empty line, whitespace-split into argv; run
@@ -495,6 +501,19 @@ export interface MakeRunVerifyOpts {
      * Recomputed each round so the scope follows the growing diff.
      */
     changedDirs?: (cwd: string, signal?: AbortSignal, baselinePaths?: string[]) => Promise<string[]>;
+    /**
+     * The commit the run started from (the cloud session's): what the run
+     * committed past it counts as changed beside the uncommitted tree, in the
+     * default `changedDirs` and `changedPaths`, so a model that commits its own
+     * work keeps the gate's scope (YAG-1039). Absent: the tree alone.
+     */
+    baseSha?: string;
+    /**
+     * Whether the host runs the approved checks again after the build, which the
+     * gate's note of checks it left unrun says. Absent: it does (the mission
+     * lane). The one-attempt lane's host does not, so its session passes false.
+     */
+    hostRechecks?: boolean;
     exec?: VerifyExec;
     timeoutMs?: number;
     /**
@@ -520,8 +539,8 @@ export interface MakeRunVerifyOpts {
     onFailedChecks?: (results: FailedCheckResult[]) => void;
     /**
      * This run's own changed paths (repo-relative), which scope the CI jobs by
-     * their `paths` filters. Default: the same `git status` the scope reads,
-     * minus the pre-run dirt.
+     * their `paths` filters. Default: the same `git status` (and commits past
+     * `baseSha`) the scope reads, minus the pre-run dirt.
      */
     changedPaths?: (cwd: string, signal?: AbortSignal, baselinePaths?: string[]) => Promise<string[]>;
     /** Repository-checks env override for determinism in tests (default: buildRepoCheckEnv() per run). */

package/dist/extension/pipeline/verify.js

@@ -65,7 +65,7 @@ import { claimCovers } from "./fanout.js";
 import { ciJobInScope } from "./missionChecks.js";
 import { composeAbortSignal } from "./resilience.js";
 import { scrubSecrets } from "./scrubSecrets.js";
-import { snapshotWorkspace } from "./workspace.js";
+import { committedPaths, snapshotWorkspace } from "./workspace.js";
 /**
  * Total wall-clock budget for a single verify run before it is abandoned
  * (fail-open). Ten minutes until 2026-10-09; twenty now, matching the run
@@ -355,16 +355,23 @@ export function resolvePackageDirs(repoRoot, relPaths, readFile) {
     return [...dirs].sort();
 }
 /**
- * This run's OWN changed package dirs: the porcelain `status`'s packages MINUS the
- * packages touched only by `baselinePaths` (the tree's pre-run dirt). A package with
- * a NEW change stays in scope even if it also had pre-run dirt; a package whose every
- * changed path predates the run drops out. Pure (the `readFile` seam keeps it so), so
- * an unrelated dirty package can never retarget the gate off this run's real diff.
+ * This run's OWN changed paths: the porcelain `status`'s, plus `committed` (what
+ * the run already committed past its base, YAG-1039), MINUS `baselinePaths` (the
+ * tree's pre-run dirt). Pure, deduped.
  */
-export function ownChangedDirs(repoRoot, status, baselinePaths, readFile) {
+export function ownChangedPaths(status, baselinePaths, committed = []) {
     const baseline = new Set(baselinePaths);
-    const own = parseChangedPaths(status).filter((p) => !baseline.has(p));
-    return resolvePackageDirs(repoRoot, own, readFile);
+    return [...new Set([...parseChangedPaths(status), ...committed])].filter((p) => !baseline.has(p));
+}
+/**
+ * This run's OWN changed package dirs: the packages of {@link ownChangedPaths}, so a
+ * package touched only by `baselinePaths` (the tree's pre-run dirt) drops out. A
+ * package with a NEW change stays in scope even if it also had pre-run dirt. Pure
+ * (the `readFile` seam keeps it so), so an unrelated dirty package can never
+ * retarget the gate off this run's real diff.
+ */
+export function ownChangedDirs(repoRoot, status, baselinePaths, readFile, committed = []) {
+    return resolvePackageDirs(repoRoot, ownChangedPaths(status, baselinePaths, committed), readFile);
 }
 /**
  * The highest-priority package.json script at `pkgDir` that is a string AND not a
@@ -1409,6 +1416,10 @@ function measuredBaseline(onBase, check) {
 export function makeRunVerify(opts = {}) {
     const detect = opts.detect ?? defaultDetect;
     const detectTests = opts.detectTests ?? defaultDetectTests;
+    // What the run committed past its base: a model that commits leaves the tree clean.
+    const committedOf = (cwd, head, signal) => opts.baseSha && head !== opts.baseSha
+        ? committedPaths(cwd, opts.baseSha, signal)
+        : Promise.resolve([]);
     const changedDirs = opts.changedDirs ??
         (async (cwd, signal, baselinePaths) => {
             const snapshot = await snapshotWorkspace(cwd, signal);
@@ -1417,7 +1428,7 @@ export function makeRunVerify(opts = {}) {
             // This run's OWN changed packages = the current diff minus the pre-run dirt, so
             // a stray pre-existing file (or an unrelated dirty package) never pulls its dir
             // into scope and the gate verifies what THIS run actually touched.
-            return ownChangedDirs(cwd, snapshot.status, baselinePaths ?? [], (p) => readFileSync(p, "utf8"));
+            return ownChangedDirs(cwd, snapshot.status, baselinePaths ?? [], (p) => readFileSync(p, "utf8"), await committedOf(cwd, snapshot.head, signal));
         });
     const exec = opts.exec ?? defaultExec;
     const timeoutMs = opts.timeoutMs ?? VERIFY_TIMEOUT_MS;
@@ -1428,8 +1439,7 @@ export function makeRunVerify(opts = {}) {
             const snapshot = await snapshotWorkspace(cwd, signal);
             if (!snapshot.tracked)
                 return [];
-            const baseline = new Set(baselinePaths ?? []);
-            return parseChangedPaths(snapshot.status).filter((p) => !baseline.has(p));
+            return ownChangedPaths(snapshot.status, baselinePaths ?? [], await committedOf(cwd, snapshot.head, signal));
         });
     const toolchain = opts.toolchain ?? sessionToolchain;
     const treeStatus = opts.treeStatus ??
@@ -1439,6 +1449,7 @@ export function makeRunVerify(opts = {}) {
     // keys from the last call it failed in.
     let repoChecksSpentMs = 0;
     const lastCiFailure = new Map();
+    const hostRechecks = opts.hostRechecks === false ? "" : "; the host still runs the approved checks after the build";
     // Each approved check's last run in this build, by command (trimmed).
     const lastApproved = new Map();
     /**
@@ -1565,7 +1576,7 @@ export function makeRunVerify(opts = {}) {
         }
         const buildLeft = (opts.repoChecksBuildBudgetMs ?? REPO_CHECKS_BUILD_BUDGET_MS) - repoChecksSpentMs;
         if (buildLeft < REPO_CHECK_MIN_START_MS) {
-            reasons.push("approved checks and CI steps not run again: the build's check budget is spent; the host still runs the approved checks after the build");
+            reasons.push(`approved checks and CI steps not run again: the build's check budget is spent${hostRechecks}`);
             return {
                 findings,
                 reasons,
@@ -1619,7 +1630,7 @@ export function makeRunVerify(opts = {}) {
             }
         }
         if (run.notReached > 0) {
-            reasons.push(`${run.notReached} approved check(s) or CI step(s) not reached in the gate's time budget; the host still runs the approved checks after the build`);
+            reasons.push(`${run.notReached} approved check(s) or CI step(s) not reached in the gate's time budget${hostRechecks}`);
         }
         const approvedRan = new Set(run.approvedRuns.values());
         const whyNotRun = signal?.aborted

package/dist/extension/pipeline/workspace.d.ts

@@ -29,4 +29,10 @@ export declare function workspaceChanged(before: WorkspaceSnapshot, after: Works
  * report `tracked: false` and skip the second call.
  */
 export declare function snapshotWorkspace(cwd: string, signal?: AbortSignal): Promise<WorkspaceSnapshot>;
+/**
+ * The repo-relative paths committed between `baseSha` and HEAD: what a run
+ * committed past its base. Empty on any git error, so a caller reads the
+ * uncommitted tree alone, as it did before.
+ */
+export declare function committedPaths(cwd: string, baseSha: string, signal?: AbortSignal): Promise<string[]>;
 //# sourceMappingURL=workspace.d.ts.map

package/dist/extension/pipeline/workspace.js

@@ -70,4 +70,16 @@ export async function snapshotWorkspace(cwd, signal) {
     const status = await runGit(["status", "--porcelain"], cwd, signal);
     return { tracked: true, head, status };
 }
+/**
+ * The repo-relative paths committed between `baseSha` and HEAD: what a run
+ * committed past its base. Empty on any git error, so a caller reads the
+ * uncommitted tree alone, as it did before.
+ */
+export async function committedPaths(cwd, baseSha, signal) {
+    const names = await runGit(["diff", "--name-only", baseSha, "HEAD"], cwd, signal);
+    return names
+        .split("\n")
+        .map((line) => line.trim())
+        .filter(Boolean);
+}
 //# sourceMappingURL=workspace.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "1.2.7-staging.2056.1",
+  "version": "1.2.7-staging.2062.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -58,5 +58,5 @@
     "turndown": "^7.2.4",
     "typebox": "^1.3.15"
   },
-  "yagniSourceSha": "76a36c6b94db739ea0fb0544cbe9a26279e6881c"
+  "yagniSourceSha": "a52f06325dd8542ceb7055b6fc9a7c965c8c77bd"
 }