catherd-cli 1.5.0 → 2.0.0-beta.20261022113309

package/src/services/daemon.ts

@@ -0,0 +1,181 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { z } from "zod";
+import { errorMessage } from "../domain/errors.ts";
+import { launchDaemon } from "../infra/launch.ts";
+import type { SuperviseClock } from "../infra/supervisor.ts";
+import { lockHeld, tryLock } from "../infra/filelock.ts";
+import { log } from "../infra/log.ts";
+import { processStartTime } from "../infra/proc.ts";
+import { readVersioned, writeJsonAtomic } from "../infra/store.ts";
+import type { Deps } from "./ports.ts";
+import type { RunEvent } from "../domain/run-events.ts";
+import { type Action, actionKey, confirms, failKey, next } from "../domain/run-machine.ts";
+import { reduce, replay, type RunState } from "../domain/run-state.ts";
+import { type Effects, realEffects } from "./run-effects.ts";
+import { appendEvent, eventsFile, isDaemonRun, readEvents } from "./run-events-store.ts";
+import { findRun, type Run } from "./run-store.ts";
+
+/** The daemon holds this lock for its whole life: a second holder gets none, a dead one's is reclaimed. */
+export const daemonLockTarget = (run: Run): string => join(run.dir, "daemon");
+export const heartbeatFile = (run: Run): string => join(run.dir, "daemon.json");
+
+/** `beatMs`: how often the heartbeat is written; `pollMs`: how often the loop reads the events. Tests shorten them. */
+export const daemonLimits = { beatMs: 5_000, pollMs: 500 };
+
+export interface Heartbeat {
+  schema: 1;
+  pid: number;
+  startTime: string | null;
+  beatAt: string;
+  seq: number;
+  version: string;
+}
+
+const HeartbeatSchema = z.looseObject({
+  schema: z.literal(1),
+  pid: z.number().int(),
+  startTime: z.string().nullable(),
+  beatAt: z.string(),
+  seq: z.number().int(),
+  version: z.string(),
+});
+
+/** The daemon's last beat, or null when it never wrote one or the file cannot be read. */
+export function readHeartbeat(run: Run): Heartbeat | null {
+  try {
+    return readVersioned(heartbeatFile(run), HeartbeatSchema, 1);
+  } catch {
+    return null;
+  }
+}
+
+/** Whether a live process holds the run's daemon lock: its pid and start time, never the heartbeat. */
+export const daemonAlive = (run: Run): boolean => lockHeld(daemonLockTarget(run));
+
+/** How the daemon is started; tests replace it so no process is spawned. */
+export const daemonLauncher = { launch: launchDaemon };
+
+/** Whether the run's events say it ended (`run.ended`). A `"type":"run.ended"` never occurs inside a JSON string. */
+function hasEnded(run: Run): boolean {
+  try {
+    return readFileSync(eventsFile(run), "utf8").includes('"type":"run.ended"');
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Makes sure a 2.0 run that has not ended has a daemon: one that is alive is left alone, a dead one is
+ * started again (two callers at once start two processes, and the lock lets one run). A 1.5 run has none.
+ */
+export function ensureDaemon(run: Run): "alive" | "revived" | "ended" | "1.5" {
+  if (!isDaemonRun(run)) return "1.5";
+  if (hasEnded(run)) return "ended";
+  if (daemonAlive(run)) return "alive";
+  daemonLauncher.launch(run.id, run.dir);
+  return "revived";
+}
+
+/** Writes the heartbeat: who holds the lock, since when, and how far it has read. */
+export function beat(run: Run, deps: Deps, seq: number): void {
+  const pid = process.pid;
+  writeJsonAtomic(heartbeatFile(run), {
+    schema: 1,
+    pid,
+    startTime: processStartTime(pid),
+    beatAt: new Date(deps.now()).toISOString(),
+    seq,
+    version: deps.version,
+  } satisfies Heartbeat);
+}
+
+export interface DaemonOptions {
+  /** what carries the machine's actions out; the real services when absent */
+  effects?: Effects;
+  /** the loop's time; the real clock when absent */
+  clock?: SuperviseClock;
+  /** ends the loop early (tests) */
+  until?: () => boolean;
+}
+
+const REAL_CLOCK: SuperviseClock = { now: () => Date.now(), sleep: (ms) => Bun.sleep(ms) };
+
+/**
+ * Drives one run: takes its lock (`"lost-lock"` without it), returns `"ended"` at once for a run that ended,
+ * else replays the events, announces itself, and then feeds each new event to the machine: it clears the keys
+ * the event confirms, runs each action of `next` it has not issued (not awaited), appends one `tick` when a
+ * hold or wait has passed and beats. It leaves, releasing the lock, once the run has ended and every effect
+ * is done. The effects append the events, so a crash loses nothing: a new daemon replays and issues again
+ * what never got its event.
+ */
+export async function runDaemon(
+  deps: Deps,
+  runId: string,
+  o: DaemonOptions = {},
+): Promise<"ended" | "lost-lock"> {
+  const run = findRun(runId);
+  const release = tryLock(daemonLockTarget(run));
+  if (!release) return "lost-lock";
+  try {
+    if (!isDaemonRun(run) || hasEnded(run)) return "ended";
+    const clock = o.clock ?? REAL_CLOCK;
+    const effects = o.effects ?? realEffects(deps, run);
+    let state: RunState = replay(readEvents(run), run.id);
+    const hello = await appendEvent(
+      run,
+      { type: "daemon.started", pid: process.pid, version: deps.version },
+      new Date(clock.now()),
+    );
+    log("info", "daemon", { run: run.id, pid: process.pid, seq: hello.seq });
+    beat(run, deps, hello.seq);
+    /** action key → the key `effect.failed` frees it by */
+    const issued = new Map<string, string>();
+    const inFlight = new Set<Promise<void>>();
+    const issue = (a: Action): void => {
+      const key = actionKey(a);
+      if (issued.has(key)) return;
+      issued.set(key, failKey(a, state));
+      const p: Promise<void> = effects
+        .run(a, state)
+        .catch((e: unknown) =>
+          log("error", "daemon", { run: run.id, action: a.type, error: errorMessage(e) }),
+        )
+        .finally(() => {
+          inFlight.delete(p);
+          // a notice, and a merge check that found nothing, leave no event behind: nothing else would free their key
+          if (a.type === "notify" || a.type === "checkMerged") issued.delete(key);
+        });
+      inFlight.add(p);
+    };
+    const take = (e: RunEvent): void => {
+      state = reduce(state, e);
+      for (const k of confirms(e))
+        for (const [key, fk] of issued) if (key === k || fk === k) issued.delete(key);
+      for (const a of next(state, e)) issue(a);
+    };
+    let beatAt = clock.now();
+    while (!o.until?.()) {
+      const fresh = readEvents(run, state.seq + 1);
+      for (const e of fresh) take(e);
+      if (fresh.length > 0) continue;
+      if (state.wakeAt !== null && Date.parse(state.wakeAt) <= clock.now()) {
+        await appendEvent(run, { type: "tick" }, new Date(clock.now()));
+        continue;
+      }
+      if (clock.now() - beatAt >= daemonLimits.beatMs) {
+        beat(run, deps, state.seq);
+        beatAt = clock.now();
+      }
+      if (state.phase === "ended" && inFlight.size === 0) break;
+      await clock.sleep(daemonLimits.pollMs);
+    }
+    beat(run, deps, Math.max(state.seq, hello.seq));
+    return "ended";
+  } catch (e) {
+    log("error", "daemon", { run: runId, error: errorMessage(e) });
+    throw e;
+  } finally {
+    release();
+  }
+}

package/src/services/dispatch-service.ts

@@ -35,6 +35,7 @@ import {
 } from "./dispatches.ts";
 import { finalizeDispatch, finalizingElsewhere, waitForFinish } from "./finalize.ts";
 import type { Deps } from "./ports.ts";
+import { isDaemonRun } from "./run-events-store.ts";
 import { route } from "./lane-service.ts";
 import { currentRoute } from "../domain/route.ts";
 import { appendRoute, findRun, readRecords, readRoleRoutes, readRoutes, type Run } from "./run-store.ts";
@@ -223,6 +224,8 @@ function limitIsMine(deps: Deps, run: Run, origin: SessionRef | null): boolean {
  * to their new owner (a second settle of a dispatch is harmless: finalize and failover run once).
  */
 export function adopt(deps: Deps, run: Run): void {
+  // a 2.0 run's daemon watches its roles and fails them over itself
+  if (isDaemonRun(run)) return;
   for (const d of liveDispatches(run, deps.now())) if (!watching.has(d.admit.dispatchId)) watch(deps, run, d);
 }
 
@@ -252,6 +255,7 @@ export async function claim(deps: Deps, run: Run, o: { background?: boolean } =
  * away has no live process to watch and no record to scan).
  */
 export async function recoverOwned(deps: Deps, run: Run, o: { background?: boolean } = {}): Promise<void> {
+  if (isDaemonRun(run)) return;
   adopt(deps, run);
   let r = recovering.get(run.id);
   if (!r) {
@@ -786,7 +790,7 @@ async function stopOrphan(deps: Deps, d: Dispatch): Promise<void> {
 /**
  * Spec §4.7: stop a live dispatch (interrupt, SIGTERM, SIGKILL) and record it as cancelled. With `read` (the MCP
  * `cancel` tool, whose caller holds the record it returns) the record is marked read, so `peek` no longer lists
- * it. Without it (the dashboard, `catherd runs cancel`) the record stays unread and catherd announces it to the
+ * it. Without it (the panel, `catherd runs cancel`) the record stays unread and catherd announces it to the
  * run's owner at `later` (spec §3.6).
  */
 export async function cancel(

package/src/services/doctor-backends.ts

@@ -151,7 +151,7 @@ export async function backendChecks(
             }
           : { id: `backend:${id}`, label: id, state: "ok", word: "ready", detail },
       );
-      // spec 1.3 §6.6: asked only of a logged-in CLI (a logged-out agy -p would open a browser)
+      // spec 1.3 §6.6: asked only of a logged-in CLI (a logged-out CLI may open a browser)
       const quota = probe.loggedIn && a.quota ? await a.quota().catch(() => null) : null;
       if (quota)
         checks.push({ id: `quota:${id}`, label: `${id} quota`, state: "info", word: "quota", detail: quota });

package/src/services/doctor-checks.ts

@@ -7,6 +7,7 @@ import { claudeHome, locksDir } from "../infra/paths.ts";
 import { ensurePrivateDir, PRIVATE_FILE } from "../infra/store.ts";
 import { agentLinkState } from "./agent-links.ts";
 import type { Handshake } from "./doctor.ts";
+import { type IndexStatus, indexStatus } from "./catalog-service.ts";
 import { activeName } from "./profile-store.ts";
 
 // The rows of `catherd doctor` and the checks that stand alone; doctor.ts assembles the report.
@@ -40,6 +41,52 @@ export function guarded(id: string, label: string, fallbackFix: string, check: (
   }
 }
 
+const HOUR = 3_600_000;
+const DAY = 24 * HOUR;
+
+/** An age as doctor prints it: minutes under an hour, hours under two days, else days. */
+export function ageText(ms: number): string {
+  if (ms < HOUR) return `${Math.max(1, Math.round(ms / 60_000))} min`;
+  if (ms < 2 * DAY) return `${Math.round(ms / HOUR)} h`;
+  return `${Math.round(ms / DAY)} d`;
+}
+
+/**
+ * The `catalog` row: the Slopalytics index's age and the last fetch's error. `info` before the first fetch;
+ * a warning when the last fetch failed, or the index has not been checked for a day, since the hourly refresh
+ * would have. It reads the cache file only: no request.
+ */
+export function indexCheck(now = Date.now(), s: IndexStatus = indexStatus()): Check {
+  const base = { id: "catalog", label: "catalog" };
+  if (s.checkedAt === null || (s.fetchedAt === null && s.error === null))
+    return {
+      ...base,
+      state: "info",
+      word: "not fetched",
+      detail: "no model is indexed yet",
+      fix: "catherd catalog sync",
+    };
+  const age = ageText(now - Date.parse(s.fetchedAt ?? s.checkedAt));
+  if (s.error !== null)
+    return {
+      ...base,
+      state: "warn",
+      word: "failing",
+      detail:
+        s.fetchedAt === null ? `${s.error}; no index` : `${s.error}; keeps the index fetched ${age} ago`,
+      fix: "catherd catalog sync --force",
+    };
+  if (now - Date.parse(s.checkedAt) > DAY)
+    return {
+      ...base,
+      state: "warn",
+      word: "stale",
+      detail: `${s.pairs} pairs, fetched ${age} ago`,
+      fix: "catherd catalog sync --force",
+    };
+  return { ...base, state: "ok", word: "fresh", detail: `${s.pairs} pairs, fetched ${age} ago` };
+}
+
 export function pluginCheck(version: string): Check {
   const base = { id: "plugin", label: "Claude Code plugin" };
   const file = join(claudeHome(), "plugins", "installed_plugins.json");

package/src/services/doctor.ts

@@ -12,12 +12,12 @@ import { linkedProfiles } from "./agent-links.ts";
 import { accessChecks } from "./doctor-access.ts";
 import { backendChecks, usedBackends } from "./doctor-backends.ts";
 import { type PushProbe, pushCheck, probePush } from "./doctor-push.ts";
-import { sourcesCheck, standInsToConfirmIn } from "./doctor-sources.ts";
 import { cachesCheck, dockerChecks } from "./doctor-docker.ts";
 import { roleMcpChecks } from "./doctor-role-mcp.ts";
 import {
   agentsCheck,
   hostFlag,
+  indexCheck,
   type Check,
   errText,
   fixOf,
@@ -176,7 +176,7 @@ export async function doctor(d: DoctorDeps): Promise<DoctorReport> {
     const named = (fix: string) =>
       fix.replaceAll("catherd profile set ", `catherd profile set --profile ${name}${onHost} `);
     const row = guarded(id, `profile ${name}`, validate, () => {
-      const v = validateNamed(name, d.repo, d.host.host);
+      const v = validateNamed(name, d.repo, d.host.host, { unindexed: "warning" });
       const first = v.errors[0] ?? v.warnings[0];
       return {
         id,
@@ -242,14 +242,9 @@ export async function doctor(d: DoctorDeps): Promise<DoctorReport> {
     }
   }
 
-  // spec 1.2 §9: the public sources' ages and errors, the Artificial Analysis key, and the active and linked
-  // profiles' stand-ins to confirm
   const mine = [...(active ? [active] : []), ...diagnostics.filter((p) => p.name !== active?.name)];
-  checks.push(
-    guarded("sources", "sources", "catherd catalog sync --force", () =>
-      sourcesCheck(Date.now(), standInsToConfirmIn(mine)),
-    ),
-  );
+  // the Slopalytics index: its age and the last fetch's error
+  checks.push(guarded("catalog", "catalog", "catherd catalog sync", () => indexCheck()));
 
   const native = used.get("claude");
   const plugin = pluginCheck(d.version);

package/src/services/failover-rungs.ts

@@ -0,0 +1,109 @@
+import {
+  catalogPairs,
+  claudeBilled,
+  downgrade,
+  intelligenceOf,
+  quotaOf,
+  rankStandIns,
+} from "../domain/failover.ts";
+import { pairOf } from "../domain/catalog.ts";
+import { tryParseRung } from "../domain/ids.ts";
+import type { Role } from "../domain/roles.ts";
+import { effortAllowed } from "../domain/select.ts";
+import { standInFor } from "./backends.ts";
+import { loadCatalog } from "./catalog-service.ts";
+import type { Deps, ProfileView } from "./ports.ts";
+import { listProfiles, readProfileDoc } from "./profile-store.ts";
+import { runProfile } from "./run-pin.ts";
+import type { Run } from "./run-store.ts";
+
+/** The headless twin of a native Claude rung is what the daemon runs: one backend name for both. */
+const backendOf = (rung: string): string | null => {
+  const b = tryParseRung(rung)?.backend ?? null;
+  return b === "claude" ? "claude-code" : b;
+};
+
+/**
+ * Every backend the user configured (spec 2.0 decision 6): those of every rung in every saved profile, and of
+ * every stand-in a profile's `failover` names, not only the profiles a run uses.
+ */
+export function configuredBackends(): string[] {
+  const out = new Set<string>();
+  for (const name of listProfiles()) {
+    let doc: ReturnType<typeof readProfileDoc>;
+    try {
+      doc = readProfileDoc(name);
+    } catch {
+      continue;
+    }
+    const rungs = [
+      ...Object.values(doc.roles ?? {}).flatMap((r) => r?.rungs ?? []),
+      ...Object.values(doc.failover ?? {}),
+    ];
+    for (const r of rungs) {
+      const b = backendOf(r);
+      if (b) out.add(b);
+    }
+  }
+  return [...out].sort();
+}
+
+/** The backends a limit may move work to: every configured one, and those of the run's own profile. */
+export function failoverBackends(profile: ProfileView): Set<string> {
+  const backends = new Set(configuredBackends());
+  for (const r of [
+    ...Object.values(profile.roles).flatMap((x) => x?.rungs ?? []),
+    ...Object.values(profile.failover),
+  ]) {
+    const b = backendOf(r);
+    if (b) backends.add(b);
+  }
+  return backends;
+}
+
+const pairsOf = (c: ReturnType<typeof loadCatalog>): { rung: string; intelligence: number }[] =>
+  catalogPairs(c).map((rung) => ({
+    rung,
+    intelligence: (pairOf(c, rung) as { intelligence: number }).intelligence,
+  }));
+
+/** Plan 29's index through one adapter, so plan 33 may rank on something else: every indexed rung and its index. */
+export function indexedPairs(
+  _deps: Deps,
+  o: { repo?: string; runDir?: string } = {},
+): { rung: string; intelligence: number }[] {
+  return pairsOf(loadCatalog(o));
+}
+
+/**
+ * Where a unit goes when `rung`'s quota hit a limit (spec 2.0 decision 6): the profile's stand-in when its quota
+ * is free and it is not weaker; else the nearest indexed rung of any configured backend on a free quota that is
+ * not weaker, a Claude rung last. Never a step down: a rung with no index fails over only to its stand-in, and
+ * null means every candidate is held or weaker, so the caller waits for the hold. Plan 33: a stand-in above
+ * its model's `maxEffort`, or below medium for a coding worker, is never taken, whatever its quota or cost.
+ */
+export function failoverRung(deps: Deps, run: Run, role: Role, rung: string, held: string[]): string | null {
+  const from = tryParseRung(rung);
+  if (!from) return null;
+  const profile = runProfile(deps, run);
+  const c = loadCatalog({ repo: run.meta.repo, runDir: run.dir });
+  const free = (r: string): boolean => {
+    const p = tryParseRung(r);
+    return (
+      p !== null &&
+      quotaOf(p) !== quotaOf(from) &&
+      !held.includes(quotaOf(p)) &&
+      effortAllowed(profile.maxEffort ?? {}, role, r)
+    );
+  };
+  const stand = standInFor(profile.failover, rung, run.meta.repo);
+  const explicit = stand !== null && free(stand) && !downgrade(c, rung, stand) ? stand : null;
+  if (explicit && !claudeBilled(explicit)) return explicit;
+  if (intelligenceOf(c, rung) === null) return explicit;
+  const backends = failoverBackends(profile);
+  const pool = pairsOf(c)
+    .map((p) => p.rung)
+    .filter((r) => backends.has(backendOf(r) ?? ""));
+  const ranked = rankStandIns(c, profile.billing, rung, pool).filter(free);
+  return ranked.find((r) => !claudeBilled(r)) ?? explicit ?? ranked[0] ?? null;
+}

package/src/services/finalize.ts

@@ -8,7 +8,11 @@ import { isCatherdError } from "../domain/errors.ts";
 import { parseRung } from "../domain/ids.ts";
 import {
   type ExitInfo,
+  parseReplyDesign,
   parseReplyEnvironment,
+  parseReplyExtras,
+  parseReplyHead,
+  parseReplyRejections,
   parseReplyStatus,
   type RunRecord,
   THREAD_HEAVY_INPUT,
@@ -202,6 +206,10 @@ async function compute(run: Run, d: Dispatch): Promise<RunRecord> {
     : { changedOwned: [], violations: [] };
   const reported = parseReplyStatus(replyText);
   const environment = parseReplyEnvironment(replyText);
+  const head = parseReplyHead(replyText);
+  const extras = parseReplyExtras(replyText);
+  const rejected = parseReplyRejections(replyText);
+  const design = parseReplyDesign(replyText);
   return {
     schema: 1,
     runId: run.id,
@@ -229,6 +237,10 @@ async function compute(run: Run, d: Dispatch): Promise<RunRecord> {
     replyStatus: reported.status,
     replyWhy: reported.why,
     ...(environment ? { environment } : {}),
+    ...(head ? { head } : {}),
+    ...(extras.length ? { extras } : {}),
+    ...(rejected.length ? { rejected } : {}),
+    ...(design.length ? { design } : {}),
     threadHeavy: o.tokens.input >= THREAD_HEAVY_INPUT,
     access: a.access,
     isolated: a.isolated,

package/src/services/gate-env.ts

@@ -61,7 +61,7 @@ const SECRET_NAME = /KEY|SECRET|TOKEN|PASSWORD|PASSWD|CREDENTIAL|AUTH/i;
 /**
  * The names catherd sets in a dispatch itself: the role's identity, dispatch id, testcontainers session, scratch
  * and working dir, the process basics, catherd's own dirs, and the homes an isolated CLI is moved to (codex,
- * grok, cursor, agy, opencode, claude). A gate env entry under one would take the role's identity or isolation.
+ * cursor, opencode, claude). A gate env entry under one would take the role's identity or isolation.
  */
 const RESERVED = new Set([
   ROLE_ENV,
@@ -75,7 +75,6 @@ const RESERVED = new Set([
   "CATHERD_CONFIG_DIR",
   "CATHERD_DATA_DIR",
   "CODEX_HOME",
-  "GROK_HOME",
   "CLAUDE_CONFIG_DIR",
   "CURSOR_CONFIG_DIR",
   "CURSOR_DATA_DIR",

package/src/services/gate-service.ts

@@ -9,6 +9,7 @@ import { appendJsonl, ensureJsonlHeader, readJsonl } from "../infra/store.ts";
 import { gateEnvLines, readGateEnv } from "./gate-env.ts";
 import type { Deps } from "./ports.ts";
 import { findRun, type Run } from "./run-store.ts";
+import { treeOf } from "./tree-path.ts";
 
 // Spec 1.1 §7: the verifier's gate ledger. A gate item that passed on the same content, with the same
 // command, is carried over instead of run again; every check is a verifier step `peek` and `status` show.
@@ -316,8 +317,13 @@ const lastSteps = (steps: VerifierStep[]): VerifierStep[] =>
   );
 
 /** The pass gate_check carries for `command` on `paths` as the tree is now, if any. */
-async function carryingPass(repo: string, command: string, paths: string[]): Promise<GatePass | undefined> {
-  const { hash } = await contentHash(repo, paths);
+async function carryingPass(
+  repo: string,
+  command: string,
+  paths: string[],
+  cwd: string = repo,
+): Promise<GatePass | undefined> {
+  const { hash } = await contentHash(cwd, paths);
   return readPasses(repo).findLast((p) => p.command === command && p.hash === hash);
 }
 
@@ -340,7 +346,7 @@ export async function recordedItems(run: Run, m: string): Promise<RecordedItem[]
       let passed = false;
       if (command !== null && paths !== undefined) {
         try {
-          passed = (await carryingPass(repo, command, paths)) !== undefined;
+          passed = (await carryingPass(repo, command, paths, treeOf(run, m))) !== undefined;
         } catch (e) {
           // a path gone from the tree carries no pass
           if (!isCatherdError(e)) throw e;
@@ -379,7 +385,11 @@ export async function gateCheck(
 > {
   const run = findRun(i.run);
   const paths = cleanPaths(i.paths);
-  const pass = await carryingPass(run.meta.repo, i.command, paths);
+  if (run.meta.base && !i.milestone)
+    throw new CatherdError("E_INPUT_INVALID", "a base run's gate_check names its milestone", {
+      fix: "pass milestone",
+    });
+  const pass = await carryingPass(run.meta.repo, i.command, paths, treeOf(run, i.milestone ?? null));
   recordStep(run, {
     at: new Date(deps.now()).toISOString(),
     item: i.item,
@@ -440,8 +450,13 @@ export async function gatePass(
 ): Promise<{ recorded: true; hash: string; commit: string }> {
   const run = findRun(i.run);
   const paths = cleanPaths(i.paths);
-  const { hash, dirty } = await contentHash(run.meta.repo, paths);
-  const head = (await gitHead(run.meta.repo)) ?? "none";
+  // a base run's milestone has its own tree: the one of the latest step that checked this item with this command
+  const step = readJsonl<VerifierStep>(stepsFile(run)).rows.findLast(
+    (s) => s?.item === i.item && s.command === i.command,
+  );
+  const cwd = treeOf(run, step?.milestone ?? null);
+  const { hash, dirty } = await contentHash(cwd, paths);
+  const head = (await gitHead(cwd)) ?? "none";
   const commit = dirty ? `${head}+uncommitted` : head;
   const file = gatesFile(run.meta.repo);
   ensureJsonlHeader(file, "gates");

package/src/services/jev-service.ts

@@ -16,7 +16,7 @@ import { assetPath } from "../infra/assets.ts";
 import { type JevTransport, jevRequest } from "../infra/jev-client.ts";
 import { addSecret, log } from "../infra/log.ts";
 import { appendJsonl, ensureJsonlHeader, readJsonl, readVersioned } from "../infra/store.ts";
-import { aaKey, credentialsPath, saveCredential, savedCredential } from "./credentials.ts";
+import { credentialsPath, saveCredential, savedCredential } from "./credentials.ts";
 
 export { credentialsPath };
 
@@ -26,12 +26,10 @@ export const jevQuestions = (): JevFile =>
   (file ??= readVersioned(assetPath("catalog/jev.json"), JevFileSchema, 1));
 
 /**
- * Registers the saved keys (Jev's and Artificial Analysis's) with the redactor, for a process that reads
- * logs without ever using them.
+ * Registers the saved key (Jev's) with the redactor, for a process that reads logs without ever using it.
  */
 export function registerSavedSecrets(): void {
   addSecret(jevKey());
-  addSecret(aaKey());
 }
 
 /** The key saved in credentials.json, or why that file cannot be read (unparsable, newer schema). */

package/src/services/lane-service.ts

@@ -40,6 +40,7 @@ import {
   milestoneCommits,
   milestoneVerifier,
 } from "./milestones.ts";
+import { machineGate } from "./milestone-check.ts";
 import type { Deps, Verdict } from "./ports.ts";
 import {
   appendKnowledge,
@@ -339,7 +340,7 @@ export type LandSkip = (typeof LAND_SKIPS)[number];
  * Spec 1.1 §6: a milestone lands only with a reviewer record and a verifier verdict since its lanes
  * started, or with a `skip` the commit range bears out. Throws E_LAND_GATE naming what is missing.
  */
-async function gate(run: Run, m: string, commit: string, skip: LandSkip | undefined): Promise<void> {
+async function gate(run: Run, m: string, commit: string, skip: LandSkip | undefined): Promise<string[]> {
   // spec 1.1 §8: a parked milestone waits on the owner, whatever else it has
   const question = openQuestions(run).find((q) => q.milestone === m);
   if (question)
@@ -374,7 +375,7 @@ async function gate(run: Run, m: string, commit: string, skip: LandSkip | undefi
     }
     const against =
       skip === "docs-only" ? files.filter((f) => !isDocPath(f)) : files.filter((f) => isSourcePath(f));
-    if (against.length === 0) return;
+    if (against.length === 0) return [];
     const shown = `${against.slice(0, 5).join(", ")}${against.length > 5 ? `, and ${against.length - 5} more` : ""}`;
     throw new CatherdError(
       "E_LAND_GATE",
@@ -429,6 +430,35 @@ async function gate(run: Run, m: string, commit: string, skip: LandSkip | undefi
         fix: `${marked}run reviewer-${m} (a dispatch, or a Claude subagent recorded with record_agent_run(name: "reviewer-${m}")) and the verifier on ${m}, recording it with record_agent_run(name: "verifier-${m}") (a FAIL with status "failed"), then land again; a docs-only milestone passes skip: "docs-only"`,
       },
     );
+  // plan 30b: the verdict must be about the commit being landed, and catherd's own check must have run on it
+  const landed = await fullCommit(run, commit);
+  const checked = verdict?.head ?? null;
+  if (verdict && checked === null)
+    throw new CatherdError(
+      "E_LAND_GATE",
+      `land ${m}: ${verdict.name}'s PASS names no HEAD, so it cannot be told to cover ${landed.slice(0, 12)}`,
+      {
+        fix: `a headless verifier's reply ends with HEAD: <sha>; run a fresh verifier-${m} on the committed milestone (${landed.slice(0, 7)})`,
+      },
+    );
+  if (verdict && checked !== null && !landed.startsWith(checked))
+    throw new CatherdError(
+      "E_LAND_GATE",
+      `land ${m}: ${verdict.name} checked ${checked.slice(0, 12)}, and the commit being landed is ${landed.slice(0, 12)}: a PASS from before a later commit does not count`,
+      {
+        fix: `run a fresh ${verdict.name} on ${landed.slice(0, 7)}: what passed is carried over by gate_check`,
+      },
+    );
+  const machine = await machineGate(run, m, landed);
+  if (machine.missing.length)
+    throw new CatherdError(
+      "E_LAND_GATE",
+      `land ${m}: the machine gate on ${landed.slice(0, 12)}: ${machine.missing.join("; ")}`,
+      {
+        fix: `run the full check with gate_run(run, "${m}", <command>) on ${landed.slice(0, 7)}; fix what fails, commit, and verify again`,
+      },
+    );
+  return machine.audit;
 }
 
 /**
@@ -508,7 +538,7 @@ async function landRun(
     throw new CatherdError("E_RUN_COMMIT", `no commit ${i.commit} in ${run.meta.repo}`, {
       fix: "commit the milestone first, then pass its hash",
     });
-  await gate(run, i.milestone, i.commit, i.skip);
+  const audit = await gate(run, i.milestone, i.commit, i.skip);
   // read before the ledger row: the range runs from the previous landing to this commit
   const commits = await milestoneCommits(run, i.commit);
   const now = new Date(deps.now());
@@ -530,6 +560,7 @@ async function landRun(
   // the notes reach state.json first, with no git: the next landing counts its minutes from this one
   await critical(() => patchNotes(run, landRow));
   const { hints } = await refreshState(run);
+  hints.push(...audit);
   // spec §5.6: every routed lane of the milestone lands with it
   // under the routes lock, so a racing climb cannot slip between the read and the rows
   let routed: string[] = [];