canary-test-cli 7.2.0 → 8.0.0

package/dist/engine/analysis/batwoman/text.js

@@ -0,0 +1,84 @@
+/**
+ * Text layout for the batwoman report.
+ *
+ * These are the report's typographic primitives -- how prose is broken to a
+ * width and how an assembled row is fitted to one. They are separated from
+ * `render.ts` because they know nothing about verdicts, registers or sections:
+ * they take strings and widths and return strings. Composition lives next
+ * door; measuring and breaking lines lives here.
+ */
+/** `2026-08-22 17:34 UTC`, stable across the runner's timezone. */
+export function stamp(when) {
+    return `${when.toISOString().slice(0, 16).replace('T', ' ')} UTC`;
+}
+/** The report's column limit. Header and body wrap to the same width. */
+export const WIDTH = 78;
+/**
+ * Greedy word wrap with a fixed indent. A too-long word gets its own line.
+ *
+ * **Explanations are single-paragraph prose.** `split(/\s+/)` normalises all
+ * internal whitespace, so a newline becomes a space and a run of spaces becomes
+ * one. That is a decision, not an accident, and it is recorded here because
+ * the probes compose explanations out of evidence, and the temptation
+ * to embed a command, a YAML fragment or an indented log line is real. A verdict
+ * sentence is a sentence: the thing a probe wants to quote belongs in
+ * `evidence`, which {@link fitLine} wraps without reflowing it, or in a future
+ * field that declares itself preformatted. Reflowing a YAML fragment silently
+ * would be worse than refusing it, so if that need arrives, add the field --
+ * do not relax this.
+ */
+export function wrap(text, width, indent) {
+    const lines = [];
+    let current = '';
+    for (const word of text.split(/\s+/).filter((w) => w !== '')) {
+        const candidate = current === '' ? word : `${current} ${word}`;
+        if (indent.length + candidate.length <= width || current === '') {
+            current = candidate;
+        }
+        else {
+            lines.push(indent + current);
+            current = word;
+        }
+    }
+    if (current !== '')
+        lines.push(indent + current);
+    return lines;
+}
+/**
+ * Fit an already-assembled line to the width, breaking it only if it overflows.
+ *
+ * `wrap` cannot do this job: a file path is a single whitespace-free token, so
+ * `wrap` would faithfully put all 86 columns of it on one line. This breaks at a
+ * space when there is one inside the remaining room and chops the token when
+ * there is not, which is the only way a path fits at all.
+ *
+ * A line that already fits is returned untouched, so every short row keeps its
+ * exact spacing -- including the two spaces the terse register puts between a
+ * path and its status.
+ */
+export function fitLine(line, width, continuation) {
+    if (line.length <= width)
+        return [line];
+    const lines = [];
+    let rest = line;
+    let indent = '';
+    while (indent.length + rest.length > width && rest !== '') {
+        const room = width - indent.length;
+        const space = rest.lastIndexOf(' ', room);
+        // A space break is only taken when it fills at least half the line. Every
+        // row here starts with a marker -- two spaces of indent, `  - `, `    1. `
+        // -- and the last space *within the room* of a long path is the one right
+        // after that marker. Breaking there emitted `  -` and `    1.` alone on a
+        // line, and for a plain indented path an empty one. A path with no spaces
+        // in it has to be chopped somewhere; chopping it at the width reads better
+        // than orphaning its bullet.
+        const cut = space * 2 >= room ? space : room;
+        lines.push((indent + rest.slice(0, cut)).trimEnd());
+        rest = rest.slice(cut).trimStart();
+        indent = continuation;
+    }
+    if (rest !== '')
+        lines.push(indent + rest);
+    return lines;
+}
+//# sourceMappingURL=text.js.map

package/dist/engine/analysis/batwoman/triggers.js

@@ -0,0 +1,122 @@
+/**
+ * Turning a workflow's `on:` block into the clause that explains its dormancy.
+ *
+ * This exists because of the founding case. #749 fixed
+ * `refresh-arch-baseline.yml`, and that workflow had not run in twelve days --
+ * not because anything was broken, but because it is gated on a label nobody
+ * had applied. A report that says only "has not run" sends its reader to look
+ * for a break that is not there, and the time they lose is time batwoman
+ * caused. The trigger is the difference between a fact and an explanation.
+ *
+ * **Unrecognised shapes return `null`, never a guess.** The probe degrades to
+ * the bare run-history sentence when that happens. Inventing a plausible
+ * trigger would put a fabricated cause into a human's report, which is a worse
+ * failure than saying less: a wrong cause is acted on, silence is asked about.
+ */
+/** Trigger names worth explaining, mapped to the clause each contributes. */
+const SIMPLE_CLAUSES = {
+    push: 'on push',
+    pull_request: 'on a pull request',
+    pull_request_target: 'on a pull request',
+    workflow_dispatch: 'manually',
+    workflow_call: 'when another workflow calls it',
+    schedule: 'on a schedule',
+    release: 'on a release',
+    issues: 'on issue activity',
+    issue_comment: 'on an issue comment',
+};
+/**
+ * Triggers that mean "this sits still until a human does something specific".
+ *
+ * Only these earn the word "only", and only when they stand alone: a workflow
+ * that also runs on push is not dormant, and calling it dormant would be the
+ * same fabrication this module refuses elsewhere.
+ */
+const DORMANT_ALONE = new Set(['workflow_dispatch', 'pull_request_labeled']);
+/** The `on:` block's keys, from either the mapping or the bare-list form. */
+function triggerNames(on) {
+    if (Array.isArray(on))
+        return on.filter((n) => typeof n === 'string');
+    if (typeof on === 'object' && on !== null)
+        return Object.keys(on);
+    return [];
+}
+/** The config a trigger carries, or undefined for the bare-list form. */
+function configFor(on, name) {
+    if (typeof on === 'object' && on !== null && !Array.isArray(on)) {
+        return on[name];
+    }
+    return undefined;
+}
+/** `{ types: ['labeled'] }` -> true. The shape #749's workflow uses. */
+function isLabelGated(config) {
+    if (typeof config !== 'object' || config === null)
+        return false;
+    const types = config.types;
+    return Array.isArray(types) && types.length === 1 && types[0] === 'labeled';
+}
+/** `{ branches: ['main'] }` -> 'main'. Multiple branches are not enumerated. */
+function branchClause(config) {
+    if (typeof config !== 'object' || config === null)
+        return '';
+    const branches = config.branches;
+    if (!Array.isArray(branches) || branches.length !== 1)
+        return '';
+    const only = branches[0];
+    return typeof only === 'string' ? ` to ${only}` : '';
+}
+/** One trigger's clause, or null when it is not one we explain. */
+function clauseFor(name, config) {
+    if (name === 'pull_request' && isLabelGated(config)) {
+        return 'when a label is added to a pull request';
+    }
+    const base = SIMPLE_CLAUSES[name];
+    if (base === undefined)
+        return null;
+    return name === 'push' ? `${base}${branchClause(config)}` : base;
+}
+/** The key a clause was derived from, for the dormancy test. */
+function dormancyKey(name, config) {
+    return name === 'pull_request' && isLabelGated(config)
+        ? 'pull_request_labeled'
+        : name;
+}
+/**
+ * A human clause naming why a workflow runs -- `triggered on push to main`,
+ * `triggered only when a label is added to a pull request`.
+ *
+ * Returns `null` when the block is absent, malformed, or names only events
+ * this module has no wording for. The caller must handle null by saying less,
+ * not by filling in.
+ */
+export function describeTriggers(on) {
+    const names = triggerNames(on);
+    if (names.length === 0)
+        return null;
+    const clauses = [];
+    const keys = [];
+    // Manual dispatch reads last regardless of where it sat in the YAML. Key
+    // order is an authoring accident -- the same workflow written two ways would
+    // otherwise produce two different sentences -- and "or manually" is the
+    // afterthought clause in English anyway.
+    const ordered = [...names].sort((a, b) => Number(a === 'workflow_dispatch') - Number(b === 'workflow_dispatch'));
+    for (const name of ordered) {
+        const config = configFor(on, name);
+        const clause = clauseFor(name, config);
+        // An unrecognised event is skipped rather than echoed: printing
+        // `triggered on some_future_event` would read as an explanation while
+        // telling the reader nothing they did not already see in the file.
+        if (clause === null)
+            continue;
+        clauses.push(clause);
+        keys.push(dormancyKey(name, config));
+    }
+    if (clauses.length === 0)
+        return null;
+    const only = clauses.length === 1 && keys[0] !== undefined && DORMANT_ALONE.has(keys[0]);
+    const joined = clauses.length === 1
+        ? clauses[0]
+        : `${clauses.slice(0, -1).join(', ')}, or ${clauses[clauses.length - 1]}`;
+    return `triggered ${only ? 'only ' : ''}${joined}`;
+}
+//# sourceMappingURL=triggers.js.map

package/dist/engine/analysis/batwoman/verdict.js

@@ -0,0 +1,64 @@
+/**
+ * canary-batwoman's verdict model (spec `docs/changes/canary-batwoman/`).
+ *
+ * Batwoman answers one question per changed file -- has this artifact executed
+ * since the fix merged -- and answers with one of five values, never with a
+ * confidence score. A score attached to a guess reads as evidence; "I have no
+ * probe for this" does not (spec D4).
+ *
+ * `abstain` and `no-probe` are deliberately separate. The first means a probe
+ * looked and could not tell: report it, investigate it. The second means
+ * nothing looked: a registry gap, fixable by adding a probe. Collapsing them
+ * would hide which of the two a given file suffers from (spec D3).
+ */
+/** The five statuses, in report order. */
+export const EXERCISE_STATUSES = [
+    'exercised',
+    'not-exercised',
+    'abstain',
+    'no-probe',
+    'not-applicable',
+];
+/** The two statuses that make a positive claim about whether the file ran. */
+export const CLAIMING_STATUSES = ['exercised', 'not-exercised'];
+/** Thrown by {@link explain}. Named so a probe's failure reads as its own. */
+export class EmptyExplanationError extends Error {
+    constructor() {
+        super('an ExerciseVerdict explanation must be a full sentence, never empty: ' +
+            'a row that names a file and says nothing about it is the silence ' +
+            'batwoman exists to remove');
+        this.name = 'EmptyExplanationError';
+    }
+}
+/** True when `text` could be an {@link Explanation}. Whitespace is not a sentence. */
+export function isExplanation(text) {
+    return typeof text === 'string' && text.trim() !== '';
+}
+/** The only constructor for an {@link Explanation}. Rejects the empty string. */
+export function explain(text) {
+    if (!isExplanation(text))
+        throw new EmptyExplanationError();
+    return text;
+}
+/**
+ * Count verdicts by status.
+ *
+ * There is deliberately no `assessed` field. A derived "files batwoman could
+ * decide about" figure is exactly the shape spec criterion 3 forbids: it makes
+ * `abstain` and `no-probe` disappear into a denominator that looks like
+ * coverage. A caller wanting a subtotal has to write the addition itself, in
+ * the open, where a reviewer can see which statuses it folded.
+ */
+export function tallyVerdicts(verdicts) {
+    const byStatus = {
+        exercised: 0,
+        'not-exercised': 0,
+        abstain: 0,
+        'no-probe': 0,
+        'not-applicable': 0,
+    };
+    for (const verdict of verdicts)
+        byStatus[verdict.status] += 1;
+    return { changed: verdicts.length, byStatus };
+}
+//# sourceMappingURL=verdict.js.map

package/dist/engine/analysis/cli.js

@@ -6,8 +6,10 @@
  *
  * Follows the guardian CLI conventions (see `../cli-common.ts`): a
  * {@link createAnalyzeCommand} factory wired to an injectable {@link AnalyzeDeps},
- * and `normalizeUsageExit` on every command so usage errors exit 2. No command
- * raises a business exit -- every analyze subcommand returns 0 (matching Python).
+ * and `normalizeUsageExit` on every command so usage errors exit 2. The
+ * history-backed subcommands raise no business exit and return 0 (matching
+ * Python). `gh-flaky` (#884) has no Python original and follows the CLI-wide
+ * gate contract: 1 for candidates, 3 when abstained or unverifiable.
  *
  * Python->TS fidelity notes:
  *   - `json.dumps(x, indent=2)` -> {@link jsonIndent2} (byte-exact + ensure_ascii).
@@ -26,9 +28,11 @@
 import { mkdirSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { Command, InvalidArgumentError, Option } from 'commander';
-import { jsonIndent2, normalizeUsageExit } from '../cli-common.js';
+import { CliExitError, jsonIndent2, normalizeUsageExit, } from '../cli-common.js';
 import { gateOutcome } from '../core/gate-result.js';
+import { defaultSubprocess, } from '../core/workflow-discovery.js';
 import { AnalysisEngine } from './engine.js';
+import { GH_FLAKY_RUN_LIMIT, ghFlakyExitCode, renderGhFlaky, scanGhFlaky, } from './gh-flaky/gh-run-attempts.js';
 import { buildCommonFailuresReport, buildFlakyTestsReport, buildRegressionCandidatesReport, buildFailureSpikesReport, } from './reports.js';
 import { makeStore } from '../history/store.js';
 const DEFAULT_HISTORY_PATH = 'test-results/reports/history-v2.jsonl';
@@ -45,6 +49,7 @@ export function defaultAnalyzeDeps() {
         // Where a remote backend cannot answer a given section, the command says so
         // by name (see `cannotVerifyRawRecords`) rather than rendering an empty one.
         makeStore: (dbUrl) => makeStore(dbUrl, DEFAULT_HISTORY_PATH),
+        runGh: defaultSubprocess,
     };
 }
 /**
@@ -296,17 +301,7 @@ async function commonFailuresCmd(opts, deps) {
     for (const record of await store.readAll()) {
         if (opts.since && (record.timestamp ?? '') < opts.since)
             continue;
-        for (const t of record.tests ?? []) {
-            if ((t.status === 'failed' || t.status === 'flaky') && t.error_text) {
-                rows.push({
-                    test_name: t.test_name,
-                    suite: record.suite ?? '',
-                    failure_category: t.failure_category ?? 'other',
-                    error_text: t.error_text ?? '',
-                    run_count: 1,
-                });
-            }
-        }
+        rows.push(...failureRowsOf(record));
     }
     if (opts.json) {
         deps.out(jsonIndent2(rows));
@@ -315,6 +310,32 @@ async function commonFailuresCmd(opts, deps) {
         deps.out(buildCommonFailuresReport(rows, opts.minSuites));
     }
 }
+/** One run record's failed/flaky tests as rows (split out for perf, #884). */
+function failureRowsOf(record) {
+    const suite = record.suite ?? '';
+    return (record.tests ?? [])
+        .filter((t) => (t.status === 'failed' || t.status === 'flaky') && t.error_text)
+        .map((t) => ({
+        test_name: t.test_name,
+        suite,
+        failure_category: t.failure_category ?? 'other',
+        error_text: t.error_text ?? '',
+        run_count: 1,
+    }));
+}
+/** Gate-shaped: exit 1 on candidates, 3 when abstained or unverifiable. */
+function ghFlakyCmd(opts, deps) {
+    const report = scanGhFlaky(opts.repo, opts.limitRuns, deps.runGh);
+    if (opts.json) {
+        deps.out(jsonIndent2(report));
+    }
+    else {
+        deps.out(renderGhFlaky(report).join('\n'));
+    }
+    const code = ghFlakyExitCode(report);
+    if (code !== 0)
+        throw new CliExitError(code);
+}
 async function regressionCandidatesCmd(opts, deps) {
     const store = deps.makeStore(opts.dbUrl);
     if (await abstainOnEmptyHistory(store, deps, opts.json === true, 'regression candidates')) {
@@ -433,6 +454,18 @@ export function createAnalyzeCommand(depsInit = {}) {
         .action(async (opts, cmd) => {
         await spikesCmd(resolveUnitFlags(opts, cmd, deps, [DELTA_ALIAS]), deps);
     });
+    program
+        .command('gh-flaky')
+        .description('Flake signals from GitHub Actions runs: same-SHA outcome flips and ' +
+        'reruns to green. Exits 3 when a signature could not be verified.')
+        .requiredOption('--repo <owner/name>', 'GitHub repository to scan.')
+        .addOption(new Option('--limit-runs <runs>', 'How many recent RUNS to scan.')
+        .default(GH_FLAKY_RUN_LIMIT)
+        .argParser(parseRuns('--limit-runs')))
+        .option('--json', 'Emit the full report as JSON.')
+        .action((opts) => {
+        ghFlakyCmd(opts, deps);
+    });
     program
         .command('area-health')
         .description('Area degradation trends over time.')

package/dist/engine/analysis/gh-flaky/gh-run-attempts.js

@@ -0,0 +1,206 @@
+import { EXIT_ABSTAINED, gateOutcome } from '../../core/gate-result.js';
+/** Default window, stated explicitly: gh's own default is silent about it. */
+export const GH_FLAKY_RUN_LIMIT = 100;
+const GH_TIMEOUT_SECONDS = 30;
+/** Conclusions that are not a completed outcome ("" is still in progress). */
+const NON_OUTCOME_NAMES = 'action_required neutral skipped stale';
+const NON_OUTCOMES = new Set(['', ...NON_OUTCOME_NAMES.split(' ')]);
+const isOutcome = (c) => c !== null && !NON_OUTCOMES.has(c);
+const SIGNATURES = ['same-sha-flip', 'rerun-attempt'];
+const label = (s) => (s === 'same-sha-flip' ? 'same-SHA flip' : s);
+function ghJson(run, cmd) {
+    const result = run(cmd, { timeout: GH_TIMEOUT_SECONDS });
+    if (result.returncode !== 0) {
+        throw new Error(`exit ${result.returncode}: ${result.stderr.trim()}`);
+    }
+    return JSON.parse(result.stdout);
+}
+function toRunRow(raw) {
+    const r = (raw ?? {});
+    if (typeof r.databaseId !== 'number' || typeof r.headSha !== 'string') {
+        return null;
+    }
+    return {
+        id: r.databaseId,
+        headSha: r.headSha,
+        workflow: typeof r.workflowName === 'string' ? r.workflowName : '',
+        conclusion: typeof r.conclusion === 'string' ? r.conclusion : null,
+        // Never defaulted to 1: that would verify a rerun signature never read.
+        attempt: typeof r.attempt === 'number' ? r.attempt : null,
+    };
+}
+function listRuns(repo, limit, run) {
+    const cmd = ['gh', 'run', 'list', '--repo', repo, '--limit', String(limit)];
+    cmd.push('--json', 'databaseId,headSha,workflowName,conclusion,attempt');
+    const parsed = ghJson(run, cmd);
+    if (!Array.isArray(parsed))
+        throw new Error('output was not a list');
+    const rows = parsed.map(toRunRow).filter((r) => r !== null);
+    return { rows, rawCount: parsed.length };
+}
+function sameShaFlips(rows) {
+    const groups = new Map();
+    for (const { workflow, headSha, conclusion } of rows) {
+        if (!isOutcome(conclusion))
+            continue;
+        const key = JSON.stringify([workflow, headSha]);
+        groups.set(key, [...(groups.get(key) ?? []), conclusion]);
+    }
+    const flips = [];
+    for (const [key, all] of groups) {
+        const conclusions = [...new Set(all)];
+        if (!conclusions.includes('success') || conclusions.length < 2)
+            continue;
+        const [workflow, headSha] = JSON.parse(key);
+        flips.push({ signature: 'same-sha-flip', headSha, workflow, conclusions });
+    }
+    return flips;
+}
+/** Read every earlier attempt of every green rerun. */
+function rerunSignals(repo, rows, run) {
+    const read = { candidates: [], unverifiable: [], nonOutcome: 0 };
+    for (const row of rows) {
+        if (row.conclusion !== 'success')
+            continue;
+        for (let n = 1; n < (row.attempt ?? 1); n++) {
+            readAttempt(repo, row, n, run, read);
+        }
+    }
+    return read;
+}
+function readAttempt(repo, row, attempt, run, read) {
+    const source = `/repos/${repo}/actions/runs/${row.id}/attempts/${attempt}`;
+    try {
+        const body = ghJson(run, ['gh', 'api', source.slice(1)]);
+        const c = typeof body?.conclusion === 'string' ? body.conclusion : null;
+        if (!isOutcome(c))
+            read.nonOutcome++;
+        if (!isOutcome(c) || c === 'success')
+            return;
+        const { headSha, workflow, id: runId } = row;
+        const hit = { headSha, workflow, runId, earlierConclusion: c };
+        read.candidates.push({ signature: 'rerun-attempt', ...hit });
+    }
+    catch (e) {
+        const reason = e instanceof Error ? e.message : String(e);
+        read.unverifiable.push({ runId: row.id, attempt, source, reason });
+    }
+}
+function abstained(repo, reason) {
+    return {
+        repo,
+        verdict: 'abstained',
+        runsChecked: 0,
+        verifiedAgainst: [],
+        candidates: [],
+        unverifiable: [],
+        complete: false,
+        window: 'no runs read',
+        skippedRows: 0,
+        missingAttemptRows: 0,
+        nonOutcomeRows: 0,
+        notes: [],
+        reason,
+    };
+}
+function verdictOf(candidates, unverified) {
+    if (candidates > 0)
+        return 'candidates';
+    return unverified > 0 ? 'flake-signal-unverifiable' : 'verified-zero';
+}
+/** Every disclosure, in words, for both the text and JSON output. */
+function notesFor(r) {
+    const kinds = `in progress, ${NON_OUTCOME_NAMES.split(' ').join(', ')}`;
+    const notes = [
+        [r.complete ? 0 : 1, r.window],
+        [
+            r.skippedRows,
+            `${r.skippedRows} malformed run row(s) from gh skipped; not checked`,
+        ],
+        [
+            r.missingAttemptRows,
+            `${r.missingAttemptRows} run row(s) carried no attempt number; rerun-attempt not verified`,
+        ],
+        [
+            r.nonOutcomeRows,
+            `${r.nonOutcomeRows} run row(s) had no completed outcome (${kinds}); never a flip or rerun candidate`,
+        ],
+    ];
+    return notes.filter(([n]) => n > 0).map(([, text]) => text);
+}
+/** Scan the last `limit` runs of `repo` for both flake signatures. */
+export function scanGhFlaky(repo, limit, run) {
+    let rows;
+    let rawCount;
+    try {
+        ({ rows, rawCount } = listRuns(repo, limit, run));
+    }
+    catch (e) {
+        const why = e instanceof Error ? e.message : String(e);
+        return abstained(repo, `gh run list could not be read (${why}).`);
+    }
+    if (rows.length === 0) {
+        return abstained(repo, 'gh run list returned zero runs.');
+    }
+    const reruns = rerunSignals(repo, rows, run);
+    const candidates = [...sameShaFlips(rows), ...reruns.candidates];
+    const missingAttemptRows = rows.filter((r) => r.attempt === null).length;
+    const unverified = reruns.unverifiable.length + missingAttemptRows;
+    const nonOutcomeRows = rows.filter((r) => !isOutcome(r.conclusion)).length + reruns.nonOutcome;
+    const complete = rawCount < limit; // disclosed; the verdict covers the window
+    const report = {
+        repo,
+        verdict: verdictOf(candidates.length, unverified),
+        runsChecked: rows.length,
+        verifiedAgainst: SIGNATURES.slice(0, unverified > 0 ? 1 : 2),
+        candidates,
+        unverifiable: reruns.unverifiable,
+        complete,
+        window: complete
+            ? `window complete: all ${rows.length} runs checked`
+            : `window truncated at ${limit} runs; older runs unchecked`,
+        skippedRows: rawCount - rows.length,
+        missingAttemptRows,
+        nonOutcomeRows,
+        notes: [],
+    };
+    report.notes = notesFor(report);
+    return report;
+}
+function describeCandidate(c) {
+    if (c.signature === 'rerun-attempt') {
+        return (`  rerun-attempt  run ${c.runId} (${c.workflow} @ ${c.headSha}): ` +
+            `an earlier attempt concluded ${c.earlierConclusion}, re-run to success`);
+    }
+    return (`  same-SHA flip  ${c.workflow} @ ${c.headSha}: ` +
+        `${(c.conclusions ?? []).join(' / ')}`);
+}
+/** Human-readable report. Never prints a zero without its signatures. */
+export function renderGhFlaky(report) {
+    if (report.verdict === 'abstained') {
+        const { summaryLine } = gateOutcome({ checked: 0, findings: [] }, 'gate');
+        return [`${summaryLine} gh-flaky for ${report.repo}: ${report.reason}`];
+    }
+    const lines = [`gh-flaky ${report.repo}: ${report.verdict}`];
+    lines.push(...report.candidates.map(describeCandidate));
+    for (const u of report.unverifiable) {
+        lines.push(`  unverifiable   run ${u.runId}: ${u.source} (${u.reason})`);
+    }
+    if (report.verdict === 'flake-signal-unverifiable') {
+        lines.push('flake-signal-unverifiable: rerun-attempt is NOT verified.');
+    }
+    else if (report.verdict === 'verified-zero') {
+        lines.push('0 candidates.');
+    }
+    const names = report.verifiedAgainst.map(label).join(', ');
+    lines.push(`Verified against: ${names} (${report.runsChecked} runs).`);
+    lines.push(...report.notes.map((n) => `Note: ${n}.`));
+    return lines;
+}
+/** Gate contract: 0 verified zero, 1 candidates, 3 abstained or unverifiable. */
+export function ghFlakyExitCode(report) {
+    if (report.verdict === 'verified-zero')
+        return 0;
+    return report.verdict === 'candidates' ? 1 : EXIT_ABSTAINED;
+}
+//# sourceMappingURL=gh-run-attempts.js.map