atris 3.70.0 → 3.71.1

package/lib/fleet.js

@@ -27,6 +27,7 @@ const { setEngineHealth, recordEngineRunHealth, engineStallReason, engineFailure
 const { appendRosterAttempts, parseRunUsage } = require('./roster-runs');
 const { engineRunsView } = require('./roster-models');
 const { resolveDefaultVerifier } = require('./default-verifier');
+const { taskCheck } = require('./member-task-pick');
 const { rankEnginesDetailed } = require('./router-brain');
 const {
   buildOneLapValidatorPrompt,
@@ -50,6 +51,7 @@ const {
   PROXY_ENV_KEYS: SECRET_GATEWAY_PROXY_ENV_KEYS,
 } = require('./secret-gateway');
 const { appendEngineLiveLogChunk, createEngineLiveLog, engineTerminalReason } = require('./engine-job-lifecycle');
+const { recordEngineResource } = require('./engine-resource');
 
 // Lanes a fleet may never staff on its own: the human keeps irreversible
 // calls. Mirrors the autoland denied lanes.
@@ -86,28 +88,50 @@ const METHOD_KERNEL = [
 const ATRIS_BUILD_PROCESS_PREAMBLE = [
   'you are set up to do this well.',
   'use the atris process:',
-  'claim the task, read the map, and work only the named contract.',
+  'this task is already claimed for you and its record is kept for you.',
+  'run no atris command except `atris worktree guard` and the landing step below; skip any boot step the repo agent files ask for.',
+  'read the map, and work only the named contract.',
   'run every gate bare and read its real exit code.',
   'report honestly, including failures, and stop at the named stop point.',
   'if a git hook blocks your commit, stop and report it; never use --no-verify.',
 ].join('\n');
 
-// The bounded prompt every engine gets. Same contract the manual flight used:
-// isolated worktree, commit never push, MAP first, focused verify, report.
+// The check a dispatched task must pass, best source first: the task's own
+// verify field (`atris task new --verify`), then a "Check:" written in the
+// title, then the repo's default. The verify field used to be ignored, so a
+// task that named its check got `git diff --check` instead.
+function taskDispatchCheck(task, root = process.cwd()) {
+  const own = taskCheck(task).command;
+  if (own) return own;
+  const { check } = parseDoneCheck(task && task.title);
+  return check || resolveDefaultVerifier(root);
+}
+
+// One shell word, so a check with quotes or spaces survives being pasted
+// into `atris worktree ship --verify <check>`.
+function shellQuote(value) {
+  return `'${String(value).replace(/'/g, `'\\''`)}'`;
+}
+
+// The bounded prompt every engine gets: isolated worktree, MAP first, the
+// task's own check, one landing order per mode. Yolo: the engine lands it
+// itself with worktree ship. Otherwise: commit only, the conductor lands it.
 function buildFleetPrompt(task, { worktreePath, yolo = false } = {}) {
   const ref = task.display_id || task.id || 'TASK';
   const title = String(task.title || '').trim();
-  const { done, check: declaredCheck } = parseDoneCheck(title);
-  const check = declaredCheck || resolveDefaultVerifier(worktreePath || process.cwd());
+  const { done: titleDone } = parseDoneCheck(title);
+  const done = titleDone || String((task.metadata && task.metadata.done_looks_like) || '').trim();
+  const check = taskDispatchCheck(task, worktreePath || process.cwd());
+  const shipMessage = title.split(/[.:](?:\s|$)/)[0].replace(/"/g, "'").slice(0, 90) || ref;
   const commitRule = yolo
-    ? 'Commit on the current branch with a plain-English message, then land it yourself: run atris worktree ship --message "<msg>" --verify "npm run test:fast && node --test <focused files>" --merge and report the PR URL. If ship reports a rebase conflict or the verify fails, stop and report; never resolve conflicts yourself.'
-    : 'Commit on the current branch with a clear message. Do not push. Do not create branches.';
+    ? `Land it yourself. Commit on the current branch with a plain-English message, then run: atris worktree ship --message "${shipMessage} (${ref})" --verify ${shellQuote(check)} --merge, and report the PR URL. That ship command is the only push allowed. If it reports a conflict or a failed check, stop and report; never resolve conflicts yourself.`
+    : 'Commit on the current branch with a clear message. Do not push and do not create branches; the conductor lands your commit.';
   const lines = [
     'First, run `atris worktree guard`; if it fails, stop immediately, report back, and do not edit anything. Do this before any file edit.',
     '',
     ATRIS_BUILD_PROCESS_PREAMBLE,
     '',
-    `You are working task ${ref} in this repo checkout (an isolated git worktree${worktreePath ? ` at ${worktreePath}` : ''}, commit here, NEVER push).`,
+    `You are working task ${ref} in its own git worktree${worktreePath ? ` at ${worktreePath}` : ''}.`,
     '',
     `Task: ${title}`,
     '',
@@ -121,11 +145,13 @@ function buildFleetPrompt(task, { worktreePath, yolo = false } = {}) {
       : '- Read atris/MAP.md first to locate the code; never guess file locations.',
     ...SHARED_BRIEF_RULES,
     '- Run git status first. Stage ONLY files you changed. Never revert or touch files another agent modified.',
-    '- Include or update a focused regression test; run it with npm run test:fast && node --test <focused files> before committing.',
+    '- Never stage or commit anything under .atris/ or atris/TODO.md; atris rewrites those itself and they clash between parallel tasks.',
+    '- If the task changes how code behaves, add or update a focused regression test for it. A text, docs, or config edit needs no new test.',
+    `- Run the check bare before committing: ${check}`,
     `- ${commitRule}`,
     ...METHOD_KERNEL.map((rule) => `- ${rule}`),
     '',
-    'Final report (plain text): files changed, test command + result, commit sha (or say the commit failed and why).'
+    `Final report (plain text): files changed, check command + result, commit sha${yolo ? ', PR URL' : ''} (or say what failed and why).`
   );
   const lessonFiles = [
     ...(Array.isArray(task.files) ? task.files : []),
@@ -1248,8 +1274,32 @@ function dispatchToEngine({ task, engine, worktreePath, root = process.cwd(), ti
       if (!deferredCleanup) cleanup();
     }
   });
-  const result = exec(command, { timeoutMs: dispatchTimeoutMs });
+  // Machine memory and load at both ends of the run, so a SIGKILL that leaves
+  // no report of its own still says whether the machine was short on memory.
+  const resourceTask = dispatchTaskId(task);
+  const resourceRunId = crypto.randomUUID();
+  recordEngineResource(root, { phase: 'start', engine, task: resourceTask, run_id: resourceRunId });
+  const resourceStartedAt = process.hrtime.bigint();
+  const recordResourceEnd = (run) => recordEngineResource(root, {
+    phase: 'end', engine, task: resourceTask, run_id: resourceRunId,
+    signal: dispatchResultSignal(run),
+    timed_out: Boolean(run && run.error && run.error.code === 'ETIMEDOUT'),
+    // Why a run failed to start, whether the runner threw it or returned it.
+    error: run instanceof Error ? run.message : (run && run.error instanceof Error ? run.error.message : ''),
+    duration_ms: Math.round(Number(process.hrtime.bigint() - resourceStartedAt) / 1e6),
+  });
+  const runnerFailed = (error) => {
+    recordResourceEnd(error);
+    throw error;
+  };
+  let result;
+  try {
+    result = exec(command, { timeoutMs: dispatchTimeoutMs });
+  } catch (error) {
+    return runnerFailed(error);
+  }
   const toDispatch = (run) => {
+    const resourceEnd = recordResourceEnd(run);
     let watchdogReceipt = null;
     if (watchdogArtifact && fs.existsSync(watchdogArtifact)) {
       try { watchdogReceipt = JSON.parse(fs.readFileSync(watchdogArtifact, 'utf8')); } catch {}
@@ -1277,11 +1327,12 @@ function dispatchToEngine({ task, engine, worktreePath, root = process.cwd(), ti
       cancelled: Boolean(run.cancelled),
       report: stdout.slice(-8000),
       stderr: String(run.stderr || '').slice(-2000),
+      ...(resourceEnd.cause ? { kill_cause: resourceEnd.cause } : {}),
       ...(unwrapped && unwrapped.usage ? { usage: unwrapped.usage } : {}),
       ...(unwrapped && unwrapped.cost_usd !== undefined ? { cost_usd: unwrapped.cost_usd } : {}),
     };
   };
-  if (result && typeof result.then === 'function') return result.then(toDispatch);
+  if (result && typeof result.then === 'function') return result.then(toDispatch, runnerFailed);
   return toDispatch(result);
 }
 
@@ -1403,6 +1454,19 @@ function dispatchResultToTerminal(entry = {}, result = {}) {
 // always surfaces the missing-module line from either stream instead of
 // letting head/tail clipping truncate it away (cost measured live: CLI-1185
 // receipts kept only a loader stack tail and the module name was lost).
+// True when the worktree's current branch already exists on origin.
+function branchOnOrigin(worktreePath) {
+  const branch = spawnSync('git', ['-C', worktreePath, 'symbolic-ref', '--quiet', '--short', 'HEAD'], { encoding: 'utf8' });
+  const name = String(branch.stdout || '').trim();
+  if (branch.status !== 0 || !name) return false;
+  const remote = spawnSync('git', ['-C', worktreePath, 'ls-remote', '--exit-code', '--heads', 'origin', name], {
+    encoding: 'utf8',
+    env: gitNetworkEnvironment(process.env, worktreePath),
+    timeout: 15000,
+  });
+  return remote.status === 0;
+}
+
 function shipWithRetry(cli, args, cwd) {
   let shipped = cli(args, cwd);
   if (shipped.status !== 0 && /MODULE_NOT_FOUND|Cannot find module/.test(`${shipped.stderr}${shipped.stdout}`)) {
@@ -1603,6 +1667,7 @@ module.exports = {
   clipHeadTail,
   guardGlobalCliLink,
   defaultSelfLandCheck,
+  defaultDispatchStartCommit,
 };
 
 // ---------------------------------------------------------------------------
@@ -2867,6 +2932,8 @@ function focusedCheck(task) {
 // does not apply: fall back to the task's whole Check: text so the operator's
 // actual check command is what gets re-run as verification.
 function dispatchCheck(task) {
+  const own = taskCheck(task).command;
+  if (own) return own;
   const narrow = focusedCheck(task);
   if (narrow) return narrow;
   const { check } = parseDoneCheck(task.title);
@@ -2947,8 +3014,19 @@ function defaultTrustedVerifyRunner(command, cwd) {
   };
 }
 
+// A retry's worktree starts on the last run's unlanded commits. Measuring
+// from that HEAD made a retry that landed those commits read "no work
+// landed", so a resumed worktree measures from where it left the mainline.
 function defaultDispatchStartCommit({ worktreePath, git = null } = {}) {
   const run = git || ((args) => spawnSync('git', args, { cwd: worktreePath, encoding: 'utf8' }));
+  let sidecar = null;
+  try {
+    sidecar = JSON.parse(fs.readFileSync(path.join(worktreePath, '.atris', 'agent-worktree.json'), 'utf8'));
+  } catch {}
+  if (sidecar && sidecar.resumed_from && sidecar.checkout_base) {
+    const base = run(['merge-base', 'HEAD', sidecar.checkout_base]);
+    if (base && base.status === 0 && String(base.stdout || '').trim()) return String(base.stdout).trim();
+  }
   const head = run(['rev-parse', '--verify', 'HEAD^{commit}']);
   if (!head || head.status !== 0) return '';
   return String(head.stdout || '').trim();
@@ -3278,7 +3356,12 @@ function releaseUnstartedDispatchClaim(cli, { taskId, actor, detail }) {
 // paused task whose worktree holds no commits past base and nothing but
 // conductor litter gets its claim released; a paused task WITH work keeps the
 // claim so takeover stays attributed.
-function releasePausedClaimsWithoutWork(cli, { paused, worktreeByTask, actorByTask, baseRef = '', log = () => {} }) {
+//
+// keepClaimsWithWork=false is for one-shot dispatch: when its flight ends
+// nothing is working the task any more, and a kept claim made the retry
+// fail at "claim failed". The work stays on its branch and the retry's
+// worktree start resumes from it.
+function releasePausedClaimsWithoutWork(cli, { paused, worktreeByTask, actorByTask, baseRef = '', log = () => {}, keepClaimsWithWork = true }) {
   for (const row of paused || []) {
     if (row.stage === 'claim' || row.stage === 'task_lookup' || row.landed === true) continue; // no claim, or work already landed
     if (row.claim_released !== undefined) continue;
@@ -3286,6 +3369,12 @@ function releasePausedClaimsWithoutWork(cli, { paused, worktreeByTask, actorByTa
     const actor = actorByTask.get(taskId);
     if (!taskId || !actor) continue;
     const worktreePath = row.worktree || worktreeByTask.get(taskId) || '';
+    if (!keepClaimsWithWork) {
+      const released = cli(['task', 'release', taskId, '--as', actor]);
+      row.claim_released = Boolean(released && released.status === 0);
+      if (row.claim_released) log(`    released claim on ${taskId} so a retry can pick it up${worktreePath ? `; any work stays in ${path.basename(worktreePath)}` : ''}`);
+      continue;
+    }
     if (worktreePath && fs.existsSync(worktreePath)) {
       const resolvedBase = baseRef || defaultMainlineBase(worktreePath);
       if (!baseRef && resolvedBase === 'HEAD') continue; // no known start point: preserve the claim
@@ -3438,7 +3527,11 @@ async function runDispatchFlight({
       if (enforceRemoteBoundary) {
         remoteBoundary = prepareReviewSandbox({ root, taskId, engine, baseRef: landTarget });
       } else {
-        const started = cli(['worktree', 'start', '--agent', engine, '--task', `dispatch-${taskId.toLowerCase()}`, ...startBaseArgs]);
+        // The claim just taken is the lock against a second live flight, so an
+        // earlier finished run's branch must not refuse the retry. Worktree
+        // start resumes that branch's commits, or starts fresh when they no
+        // longer merge cleanly (the member-path retry fix).
+        const started = cli(['worktree', 'start', '--agent', engine, '--task', `dispatch-${taskId.toLowerCase()}`, '--force', ...startBaseArgs]);
         const wt = (started.stdout.match(/next: cd (.+)/) || [])[1];
         if (!wt) {
           const released = releaseUnstartedDispatchClaim(cli, {
@@ -3486,6 +3579,9 @@ async function runDispatchFlight({
         remoteBoundary,
         remoteMasterBefore: remoteBoundary ? remoteBoundary.protectedMaster : '',
         startCommit,
+        // The attempt loop rebuilds the brief from this flag. Without it every
+        // yolo engine got the commit-only brief and could never land.
+        yolo: yolo && !localOnly,
         ...(maxSeconds ? { maxSeconds } : {}),
         ...(trustedPrompt ? { prompt: trustedPrompt } : {}),
       });
@@ -3583,7 +3679,7 @@ async function runDispatchFlight({
   const rebaseArrival = rebase || landArrival;
   const checkSelfLand = selfLandCheck || defaultSelfLandCheck;
   const land = lander || (({ entry }) => {
-    const rebased = enforceRemoteBoundary || localOnly
+    const rebased = enforceRemoteBoundary || localOnly || entry.alreadyPushed
       ? { ok: true, stage: 'frozen_base' }
       : rebaseArrival({ worktreePath: entry.worktreePath, targetRef: landTarget });
     if (!rebased.ok) return rebased;
@@ -3740,6 +3836,18 @@ async function runDispatchFlight({
         });
         stampDispatchBrief(root, result.brief_id, 'pass', `self-landed ${entry.taskId}`);
         log(`    ✓ self-landed ${entry.taskId}`);
+        continue;
+      }
+      // The engine committed real work but did not land it (no ship run, or
+      // ship failed on its own). Land it here the same way a plain dispatch
+      // does: rebase, re-run the task's check, ship. A conflict or failed
+      // check still pauses below.
+      if (selfLanded.stage === 'self_land_missing') {
+        // An engine whose own ship pushed but failed to merge left a PR open.
+        // Rebasing would make that branch impossible to push again, so ship
+        // the pushed branch as it is; ship's merge check still stops a clash.
+        landingEntry.alreadyPushed = branchOnOrigin(entry.worktreePath);
+        log(`    ${entry.taskId} is committed but not landed; landing it now`);
       } else {
         const stage = selfLanded.stage || 'self_land_missing';
         flight.paused.push({
@@ -3755,8 +3863,8 @@ async function runDispatchFlight({
         log(stage === 'no_work_landed'
           ? `    ⏸ no work landed for ${entry.taskId}`
           : `    ⏸ paused ${entry.taskId} at ${stage}`);
+        continue;
       }
-      continue;
     }
     log(`    ${proofOnly ? 'checking' : 'landing'} ${entry.taskId}...`);
     const landed = land({ entry: landingEntry, result });
@@ -4070,6 +4178,7 @@ async function runDispatchFlight({
     actorByTask: new Map(ids.map((taskId) => [String(taskId), taskActor])),
     baseRef: landTarget,
     log,
+    keepClaimsWithWork: proofOnly,
   });
 
   recordFlightRosterRuns(root, flight, results, {

package/lib/init-commit.js

@@ -0,0 +1,80 @@
+'use strict';
+
+const path = require('path');
+const { runGit } = require('./git-spawn');
+
+// Member work copies are cut from committed history, so in a brand new repo
+// with no commits yet there is nothing for a member's first run to start from.
+// Init snapshots what was already dirty, then commits only the paths it touched
+// itself. The person's own uncommitted work and anything they had staged stay
+// exactly as they were. A repo that already has history is left alone: a
+// surprise commit on someone's branch is theirs to make, and members cut from
+// the shared mainline would not see it until it lands there anyway.
+
+const FALLBACK_IDENTITY = ['-c', 'user.name=Atris', '-c', 'user.email=299057014+atris-builder[bot]@users.noreply.github.com'];
+
+function repoRootFor(cwd) {
+  const result = runGit(['rev-parse', '--show-toplevel'], { cwd, check: false });
+  if (result.status !== 0) return null;
+  return result.stdout.trim() || null;
+}
+
+// Paths git reports as changed or untracked, relative to the repo root.
+function dirtyPaths(root) {
+  const result = runGit(['status', '--porcelain', '-z', '--untracked-files=all'], { cwd: root, check: false, maxBuffer: 64 * 1024 * 1024 });
+  if (result.status !== 0) return null;
+  const entries = result.stdout.split('\0');
+  const paths = new Set();
+  for (let i = 0; i < entries.length; i++) {
+    const entry = entries[i];
+    if (!entry) continue;
+    const code = entry.slice(0, 2);
+    paths.add(entry.slice(3));
+    // Renames and copies carry the old path as the next entry.
+    if (code[0] === 'R' || code[0] === 'C') i++;
+  }
+  return paths;
+}
+
+// Machine-local config (for example .devin/config.local.json) never belongs in history.
+function isLocalOnly(relPath) {
+  return /\.local(\.|$)/.test(path.basename(relPath));
+}
+
+function hasCommits(root) {
+  return runGit(['rev-parse', '--verify', '-q', 'HEAD'], { cwd: root, check: false }).status === 0;
+}
+
+function snapshotBeforeInit(cwd = process.cwd()) {
+  const root = repoRootFor(cwd);
+  if (!root) return null;
+  const before = dirtyPaths(root);
+  if (!before) return null;
+  return { root, before, fresh: !hasCommits(root) };
+}
+
+function commitInitFiles(snapshot, { message = 'Set up Atris' } = {}) {
+  if (!snapshot) return { committed: false, reason: 'not_git' };
+  if (!snapshot.fresh) return { committed: false, reason: 'has_history' };
+  const after = dirtyPaths(snapshot.root);
+  if (!after) return { committed: false, reason: 'status_failed' };
+  const paths = [...after].filter((p) => !snapshot.before.has(p) && !isLocalOnly(p)).sort();
+  if (paths.length === 0) return { committed: false, reason: 'nothing_new', paths };
+
+  const add = runGit(['add', '--', ...paths], { cwd: snapshot.root, check: false });
+  if (add.status !== 0) return { committed: false, reason: 'add_failed', detail: (add.stderr || '').trim(), paths };
+
+  const commitArgs = ['commit', '-q', '-m', message, '--only', '--', ...paths];
+  let commit = runGit(commitArgs, { cwd: snapshot.root, check: false });
+  if (commit.status !== 0 && /tell me who you are|unable to auto-detect email/i.test(commit.stderr || '')) {
+    commit = runGit([...FALLBACK_IDENTITY, ...commitArgs], { cwd: snapshot.root, check: false });
+  }
+  if (commit.status !== 0) {
+    // Leave the index as we found it so a blocked commit stays easy to redo by hand.
+    runGit(['reset', '-q', '--', ...paths], { cwd: snapshot.root, check: false });
+    return { committed: false, reason: 'commit_failed', detail: (commit.stderr || commit.stdout || '').trim(), paths };
+  }
+  return { committed: true, paths };
+}
+
+module.exports = { snapshotBeforeInit, commitInitFiles, dirtyPaths, isLocalOnly };

package/lib/intents.js

@@ -60,6 +60,14 @@ const INTENTS = Object.freeze([
     plain: 'your agent turns the idea into a clear job and starts once any gaps are answered.',
     offer: 'always',
   }),
+  Object.freeze({
+    id: 'run_a_campaign',
+    say: Object.freeze(['run a campaign', 'long goal', 'work on this until the check passes', 'big goal with a budget']),
+    do: 'atris campaign new "<their words>"',
+    plain: 'your agent writes a check that fails today, shows it to you, then works the goal under a budget until the check passes.',
+    offer: 'always',
+    confirm: true,
+  }),
   Object.freeze({
     id: 'catch_up',
     say: Object.freeze(['catch me up', 'what happened', 'what landed', 'show me recent progress']),

package/lib/known-commands.js

@@ -3,7 +3,7 @@
 const knownCommands = ['init', 'guide', 'doctor', 'doc-health', 'install', 'workspace', 'log', 'logs', 'later', 'done', 'wish', 'ask', 'approve', 'stop', 'ready', 'check', 'drill', 'dream', 'now', 'goal', 'wtf', 'founder', 'orb', 'radar', 'who', 'stream', 'ctop', 'launchpad', 'status', 'analytics', 'revisions', 'visualize', 'brain', 'brainstorm', 'autopilot', 'run', 'plan', 'do', 'review', 'release',
                        'activate', '_activate', 'agent', 'team', 'chat', 'fast', 'ax', 'console', 'serve', 'login', 'logout', 'whoami', 'switch', 'use', 'accounts', '_resolve', '_profile-email', '_switch-session', 'shell-init', 'update', 'upgrade', 'version', 'help', 'next', 'atris',
                        'clean', 'close', 'harvest', 'verify', 'recover', 'search', 'scout', 'skill', 'member', 'codex-goal', 'app', 'apps', 'learn', 'lesson', 'taste', 'teach', 'plugin', 'experiments', 'bench', 'router', 'tree', 'receipt', 'proof', 'openclaw', 'pull', 'push', 'watch', 'cloud', 'live', 'align', 'terminal', 'computer', 'diff', 'business', 'sync', 'youtube', 'x-search',
-                       'ingest', 'query', 'lint', 'loop', 'pulse', 'task', 'mission', 'decide', 'agents', 'probe', 'worktree', 'land', 'caretaker', 'autoland', 'drive', 'aeo', 'slop', 'voice', 'strings', 'write', 'security-review', 'secure', 'deck', 'site', 'theme', 'card', 'reel', 'improve', 'study', 'rainmaker', 'xp', 'play', 'gm', 'game', 'x', 'recap', 'report', 'signup', 'clarity', 'interview', 'meet', 'moves', 'unknowns', 'avail', 'scoreboard', 'sync-checkout',
+                       'ingest', 'query', 'lint', 'loop', 'pulse', 'task', 'mission', 'decide', 'campaign', 'agents', 'probe', 'worktree', 'land', 'caretaker', 'autoland', 'drive', 'aeo', 'slop', 'voice', 'strings', 'write', 'security-review', 'secure', 'deck', 'site', 'theme', 'card', 'reel', 'improve', 'study', 'rainmaker', 'xp', 'play', 'gm', 'game', 'x', 'recap', 'report', 'signup', 'clarity', 'interview', 'meet', 'moves', 'unknowns', 'avail', 'scoreboard', 'sync-checkout',
                        'ci', 'github', 'vercel', 'supabase', 'linear', 'stripe', 'balance', 'usage', 'api-key', 'agent-client', 'topup', 'buy', 'transactions', 'hire', 'hires', 'mail', 'design', 'mcp', 'gmail', 'calendar', 'twitter', 'slack', 'imessage', 'integrations', 'setup', 'clean-workspace', 'cw',
                        'fork', 'browse', 'publish', 'pack', 'sleep', 'wake', 'feedback', 'errors', 'wiki', 'code-review', 'cr', 'soul', 'fleet', 'fleet-report', 'loops', 'self-improve', 'compile', 'spaceship', 'truth', 'sign', 'engine', 'engines', 'link', 'playbook', 'feed', 'brief', 'social', 'host', 'people', 'follow', 'unfollow', 'friends', 'msg', 'inbox', 'invite', 'join', 'rsi'];
 

package/lib/land-green.js

@@ -20,6 +20,7 @@ const os = require('os');
 const path = require('path');
 const { spawnSync } = require('child_process');
 const { runGit } = require('./git-spawn');
+const { proveCheckBeforePublish, proveLanding } = require('./landing-proof');
 
 const DEFAULT_VERIFY = 'npm test';
 const DEFAULT_VERIFY_TIMEOUT_MS = 20 * 60 * 1000;
@@ -239,8 +240,15 @@ function landOneBranch(root, base, branch, {
   if (!scratch.ok) return verdictFor(branch, base, { action: 'error', reason: 'scratch_checkout_failed', detail: scratch.error });
   try {
     // Verify the merged state, not the branch tip: base may have moved since.
+    const before = gitOut(['rev-parse', target.target], scratch.dir);
     const merged = gitOut(['merge', '--no-edit', '--no-ff', target.target, '-m', `land: ${branch} onto ${base} after a green verify`], scratch.dir);
     if (!merged.ok) return verdictFor(branch, base, { action: 'error', reason: 'merge_failed', detail: merged.err || merged.out });
+    // A branch of empty commits (a "Start flight" marker, a change already on
+    // base) merges clean and passes every check. Landing it would record a
+    // landing over nothing, so it is named a no-op and never pushed.
+    if (gitOut(['diff', '--quiet', target.target, 'HEAD'], scratch.dir).ok) {
+      return verdictFor(branch, base, { action: 'no_op', reason: 'empty_diff', detail: `${branch} changes nothing on ${base}` });
+    }
     const deps = installDeps(scratch.dir);
     if (!deps.ok) return verdictFor(branch, base, { action: 'error', reason: 'install_failed', detail: deps.detail });
     const verify = runVerifyFn(verifyCommand, scratch.dir, { timeoutMs: verifyTimeoutMs, env });
@@ -254,6 +262,18 @@ function landOneBranch(root, base, branch, {
     }
     const sha = gitOut(['rev-parse', 'HEAD'], scratch.dir);
     if (!sha.ok) return verdictFor(branch, base, { action: 'error', reason: 'merged_sha_unreadable' });
+    const checkCommand = verify.command || verifyCommand;
+    // Nothing is published on a check that could not have caught a break: it
+    // must be one that can fail, and it must have run on this merged commit
+    // with every changed file committed and tracked. Otherwise hold.
+    const unbacked = proveCheckBeforePublish(scratch.dir, {
+      commit: sha.out,
+      base: before.ok ? before.out : target.target,
+      verify: checkCommand,
+    });
+    if (unbacked) {
+      return verdictFor(branch, base, { action: 'skipped', reason: unbacked.reason, detail: unbacked.detail, verify });
+    }
     const local = localBaseName(base);
     const pushed = push ? pushBase(root, local, sha.out) : { attempted: false, ok: false, reason: 'push_disabled' };
     if (pushed.attempted && !pushed.ok) {
@@ -262,8 +282,35 @@ function landOneBranch(root, base, branch, {
       return verdictFor(branch, base, { action: 'skipped', reason: 'push_rejected', detail: pushed.detail, verify });
     }
     const advanced = advanceBase(root, local, sha.out);
-    if (!advanced.ok) return verdictFor(branch, base, { action: 'landed', sha: sha.out, verify, push: pushed, local_base: advanced.reason });
-    return verdictFor(branch, base, { action: 'landed', sha: sha.out, verify, push: pushed });
+    // "landed" is a fact about the target branch, checked after the fact by
+    // the same rule every receipt uses: the commit must be on origin's copy.
+    // A local branch only counts in a repo with no remote at all; with a
+    // remote, an unpushed merge is not landed however the local ref moved.
+    const noRemote = !gitOut(['remote'], root).out;
+    const landing = proveLanding(root, {
+      commit: sha.out,
+      base: before.ok ? before.out : '',
+      target: noRemote ? `refs/heads/${local}` : `refs/remotes/origin/${local}`,
+      verify: checkCommand,
+      localTargetOk: noRemote,
+    });
+    if (landing.status !== 'landed') {
+      // Once pushed, the merge is on origin whatever the check says; the
+      // record names both facts instead of a bare "unverified".
+      return verdictFor(branch, base, {
+        action: pushed.ok ? 'pushed' : landing.status,
+        reason: landing.reason,
+        detail: landing.detail,
+        landing_check: landing.status,
+        sha: sha.out,
+        verify,
+        push: pushed,
+        local_base: advanced.ok ? undefined : advanced.reason,
+        landing,
+      });
+    }
+    if (!advanced.ok) return verdictFor(branch, base, { action: 'landed', sha: sha.out, verify, push: pushed, local_base: advanced.reason, landing });
+    return verdictFor(branch, base, { action: 'landed', sha: sha.out, verify, push: pushed, landing });
   } finally {
     dropScratch(root, scratch.dir);
   }
@@ -311,10 +358,12 @@ function landStaleGreenBranches(root, {
     .filter((b) => b.state === 'active' && b.stale)
     .sort((a, b) => b.activityHours - a.activityHours);
   const verdicts = [];
-  // Only landed and red verdicts spend the per-tick budget: an erroring or
-  // ineligible branch must not starve the rest of the queue. A bounded run of
-  // misses still stops the walk so a fully broken queue does not burn a
-  // scratch checkout per branch per tick.
+  // Any verdict that ran the verify suite spends the per-tick budget, landed
+  // or not: a run of pushed-but-unproven or no-landing verdicts must not run
+  // four 20-minute suites in one tick. An erroring or ineligible branch that
+  // never reached the suite does not starve the rest of the queue. A bounded
+  // run of misses still stops the walk so a fully broken queue does not burn
+  // a scratch checkout per branch per tick.
   let spent = 0;
   let misses = 0;
   for (const candidate of candidates) {
@@ -328,7 +377,7 @@ function landStaleGreenBranches(root, {
     } catch (err) {
       verdict = verdictFor(candidate.name, live.base, { action: 'error', reason: 'exception', detail: String((err && err.message) || err).slice(0, 300) });
     }
-    if (verdict.action === 'landed' || verdict.action === 'red') {
+    if (verdict.action === 'landed' || verdict.action === 'red' || verdict.verify) {
       spent += 1;
       misses = 0;
     } else {
@@ -362,6 +411,8 @@ function summaryLine(result) {
   for (const v of result.verdicts) {
     if (v.action === 'skipped' && v.reason !== 'per_tick_limit') parts.push(`${v.branch} held (${v.reason.replace(/_/g, ' ')}${v.detail ? `: ${v.detail}` : ''})`);
     if (v.action === 'error') parts.push(`${v.branch} error (${v.reason.replace(/_/g, ' ')})`);
+    if (v.action === 'pushed') parts.push(`${v.branch} pushed, landing check: ${String(v.landing_check).replace(/_/g, ' ')} (${v.reason.replace(/_/g, ' ')})`);
+    if (['no_op', 'not_landed', 'unverified'].includes(v.action)) parts.push(`${v.branch} not landed (${v.reason.replace(/_/g, ' ')})`);
   }
   const waiting = result.verdicts.filter((v) => v.reason === 'per_tick_limit').length;
   if (waiting) parts.push(`${waiting} more waiting for the next tick`);