create-cmp-cli 0.11.0 → 0.13.0

package/template/manifest.json

@@ -30,6 +30,7 @@
     "composeApp/src/androidMain/kotlin",
     "composeApp/src/androidDebug/kotlin",
     "composeApp/src/androidRelease/kotlin",
+    "composeApp/src/androidInstrumentedTest/kotlin",
     "composeApp/src/iosMain/kotlin",
     "composeApp/src/desktopMain/kotlin"
   ],

package/template/qa/evidence/schema.json

@@ -6,7 +6,11 @@
   "required": ["schema", "profile", "verdict", "commit", "steps", "artifacts", "toolVersions", "generatedAt"],
   "properties": {
     "schema": { "const": "cmp-evidence/1" },
-    "profile": { "enum": ["scaffold", "local", "ci"] },
+    "profile": { "enum": ["scaffold", "local", "ci", "release"] },
+    "mode": {
+      "enum": ["full", "fast"],
+      "description": "How the lane was run. \"full\" is the done-gate. \"fast\" (verify --fast) excluded the device/release tier (releaseBuild, tokenDrift, e2eSmoke, androidChecks, releaseSmoke): an inner-loop signal whose receipt derives no evidence rung and is REFUSED by qa/receipt-check.mjs — it can never satisfy done. Absent on receipts predating the flag — treated as full."
+    },
     "verdict": { "enum": ["PASS", "FAIL"] },
     "commit": {
       "type": "object",
@@ -32,13 +36,27 @@
         "required": ["name", "verdict", "durationMs"],
         "properties": {
           "name": { "type": "string" },
-          "verdict": { "enum": ["PASS", "FAIL", "SKIP"] },
+          "verdict": {
+            "enum": ["PASS", "FAIL", "SKIP", "CACHED"],
+            "description": "CACHED appears ONLY on mode:\"fast\" receipts: a pure-Node step's last PASS reused because its content-hashed input set is unchanged (qa/lib/step-cache.mjs). Counts as PASS for the lane verdict but stays visibly distinct — the full lane never consults the cache, so a full receipt never carries it."
+          },
           "reason": { "type": "string" },
+          "note": { "type": "string", "description": "Honest fine print on a non-FAIL step (fast mode): which unit-test filter ran, or when a CACHED verdict was originally earned." },
           "durationMs": { "type": "number" },
           "details": { "type": "object" }
         }
       }
     },
+    "evidenceLevel": {
+      "type": ["object", "null"],
+      "description": "The evidence ladder rung (qa/lib/evidence-level.mjs), DERIVED from which steps actually ran and PASSed — never declared. L0 scaffold / L1 desktop / L2 device / L3 release; a SKIPped step never upgrades a rung. null when the lane FAILed (a failed lane has no rung). Absent on receipts predating the ladder.",
+      "required": ["rung", "name", "satisfiedBy"],
+      "properties": {
+        "rung": { "enum": ["L0", "L1", "L2", "L3"] },
+        "name": { "enum": ["scaffold", "desktop", "device", "release"] },
+        "satisfiedBy": { "type": "array", "items": { "type": "string" }, "description": "The PASSed step names the rung counts as its evidence, in lane order" }
+      }
+    },
     "artifacts": {
       "type": "array",
       "items": {

package/template/qa/lib/affected-tests.mjs

@@ -0,0 +1,147 @@
+// affected-tests.mjs — FAST-MODE-ONLY scoping of the unit-test suite to the
+// tests plausibly affected by the working-tree change.
+//
+// The full lane always runs the whole suite; this module exists so the inner
+// loop (`verify --fast`) doesn't pay for every test on a one-file edit. Its
+// honesty contract:
+//
+//   - FALSE NEGATIVES ARE ACCEPTABLE HERE — AND ONLY HERE. A filtered fast
+//     run can miss a cross-feature regression; that is tolerable purely
+//     because the full, unfiltered suite runs at the checkpoint (the full
+//     lane), where done is actually decided. No other gate gets this license.
+//   - FAIL OPEN, NEVER FAIL SILENT. No git, a failed git command, an unmapped
+//     change, a broad-impact change — every uncertain case runs EVERYTHING,
+//     and the caller reports which case it was in the step's output and the
+//     receipt, so a filtered run can never be mistaken for the full suite.
+//   - The BLAST-RADIUS ESCAPE HATCH is mandatory: some paths fan out too
+//     widely to subset safely (build files rewire compilation, DI rewires
+//     object graphs, theme/tokens and shared components render into every
+//     screen, qa/ is the harness judging itself, and anything outside
+//     composeApp/src is by definition not a scoped source edit). Any one such
+//     change disables filtering for the run.
+//
+// Pure functions over path lists — git access is injected/separate so the
+// engine suite can test every branch with no repo state.
+
+import { execSync } from "node:child_process";
+import path from "node:path";
+
+/**
+ * Lane OUTPUTS, excluded from the changed-set before any classification.
+ * The receipt (qa/evidence/) and hashed artifacts (qa-artifacts/) change on
+ * every lane run by design; counting them as "changes" would make the qa/**
+ * escape hatch self-triggering forever — run N's receipt forcing run N+1 to
+ * the full suite, permanently. They cannot affect a test outcome (the same
+ * principle as inputs-hash.mjs's EXCLUDED_PREFIXES: lane outputs are not
+ * verdict inputs).
+ */
+export const LANE_OUTPUT_PREFIXES = ["qa/evidence", "qa-artifacts"];
+
+function isLaneOutput(p) {
+  return LANE_OUTPUT_PREFIXES.some((prefix) => p === prefix || p.startsWith(`${prefix}/`));
+}
+
+/**
+ * The mandatory blast-radius escape hatch: paths whose change fans out too
+ * widely to subset the suite safely. Returns the human-readable category when
+ * `p` is broad-impact, else null. Checked in order; the first match names the
+ * reason.
+ * @param {string} p POSIX relpath from the project root
+ * @returns {string|null}
+ */
+export function broadImpactReason(p) {
+  if (p.endsWith(".gradle.kts") || p === "gradle.properties" || p === "gradle/libs.versions.toml") {
+    return "build files rewire compilation";
+  }
+  if (/(^|\/)di\//.test(p)) return "DI rewires the object graph";
+  if (/(^|\/)theme\//.test(p)) return "theme/tokens render into every screen";
+  if (p.includes("presentation/components/")) return "shared components render into every screen";
+  if (p === "qa" || p.startsWith("qa/")) return "qa/ is the harness itself";
+  if (!p.startsWith("composeApp/src/")) return "outside composeApp/src";
+  return null;
+}
+
+/**
+ * Derive the fast-mode unit-test filter from a list of changed paths.
+ *
+ * Mapping (deliberately simple and defensible): each changed `.kt` file under
+ * composeApp/src contributes its package's last segment — the parent
+ * directory name (`…/presentation/home/HomeViewModel.kt` → `home`, which the
+ * template's package-mirrors-path conformance makes a package segment) — and
+ * the union becomes Gradle `--tests "*<seg>*"` patterns matched against test
+ * class FQNs. Coarse on purpose: `*home*` runs every test whose FQN mentions
+ * the feature, which over-selects a little and under-maintains nothing.
+ *
+ * @param {string[]} changedPaths relpaths (either separator style) — tracked
+ *   diffs plus untracked files, as from changedWorkingTreePaths()
+ * @returns {{mode: "filtered", patterns: string[], sourcePaths: string[]} |
+ *   {mode: "all", reason: string, patterns: [], sourcePaths: string[]}}
+ *   mode "all" ALWAYS carries the honest reason to report.
+ */
+export function deriveAffectedFilter(changedPaths) {
+  const paths = [...new Set((changedPaths ?? [])
+    .filter((p) => typeof p === "string" && p.length > 0)
+    .map((p) => p.split(path.sep).join("/")))]
+    .filter((p) => !isLaneOutput(p))
+    .sort();
+
+  if (paths.length === 0) {
+    return { mode: "all", reason: "no working-tree changes to scope by", patterns: [], sourcePaths: [] };
+  }
+
+  for (const p of paths) {
+    const broad = broadImpactReason(p);
+    if (broad) {
+      return { mode: "all", reason: `broad-impact change — ${broad} (${p})`, patterns: [], sourcePaths: paths };
+    }
+  }
+
+  // Every remaining path is a scoped file under composeApp/src. Only .kt
+  // files map to test patterns; a change that maps to nothing (resources,
+  // manifests) falls open to the full suite below.
+  const ktPaths = paths.filter((p) => p.endsWith(".kt"));
+  const segments = new Set();
+  for (const p of ktPaths) {
+    const seg = path.posix.basename(path.posix.dirname(p));
+    if (/^[A-Za-z_][A-Za-z0-9_]*$/.test(seg)) segments.add(seg);
+  }
+
+  if (segments.size === 0) {
+    return { mode: "all", reason: "changed files map to no test filter", patterns: [], sourcePaths: paths };
+  }
+
+  return {
+    mode: "filtered",
+    patterns: [...segments].sort().map((s) => `*${s}*`),
+    sourcePaths: ktPaths,
+  };
+}
+
+function defaultRunGit(args, root) {
+  try {
+    return execSync(`git ${args}`, { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * The working-tree change: tracked files differing from HEAD (staged or not)
+ * plus untracked-but-not-ignored files — the same "what will this commit
+ * touch" surface inputs-hash.mjs hashes.
+ *
+ * Returns null when git is unavailable or either command fails — the caller
+ * MUST treat null as "run everything" (fail open) and say so (never fail
+ * silent).
+ *
+ * @param {string} root project root
+ * @param {(args: string, root: string) => string|null} [runGit] injectable for tests
+ * @returns {string[]|null}
+ */
+export function changedWorkingTreePaths(root, runGit = defaultRunGit) {
+  const diff = runGit("diff --name-only HEAD", root);
+  const untracked = runGit("ls-files --others --exclude-standard", root);
+  if (diff === null || untracked === null) return null;
+  const lines = (out) => out.replace(/\n+$/, "").split("\n").filter(Boolean);
+  return [...new Set([...lines(diff), ...lines(untracked)])];
+}

package/template/qa/lib/audit-cadence.mjs

@@ -0,0 +1,290 @@
+// audit-cadence.mjs — the mechanical nudge that keeps cmp-audit from
+// depending on someone remembering.
+//
+// The adversarial platform-semantics audit (the cmp-audit skill) found six
+// latent defects on its first real outing — and it only ran because a human
+// happened to ask. This module is the cheapest honest replacement for that
+// memory: the release profile's receipt lists which androidMain subsystems
+// changed since their last RECORDED audit, so the ship-time surface itself
+// says "these platform seams moved and nobody has interrogated them since".
+//
+// It is a REPORT, never a gate. Audit debt is a judgment call (a one-line
+// rename is not six latent defects), so this file computes facts and the
+// human decides — a FAIL here would train people to game the ledger, which
+// would destroy the only thing it has: honesty.
+//
+// The ledger (qa/audits.jsonl) is append-only, one JSON object per line:
+// subsystem, the commit sha the audit ran against, an ISO timestamp, and who
+// or what recorded it. Recording is a CLAIM — "this subsystem, as of this
+// commit, was audited" — so recordAudit() derives the sha from HEAD itself
+// and refuses to record when the subsystem's files differ from HEAD: a
+// record claiming a commit the audited bytes did not match would be the
+// exact dishonesty the whole harness exists to prevent.
+//
+// "Subsystem" is DERIVED, never configured: the immediate package directory
+// under the app's androidMain Kotlin source root (the root is resolved from
+// the android namespace in composeApp/build.gradle.kts). This template is
+// stamped into apps whose package names it cannot know; deriving from the
+// tree is the only definition that survives that. Kotlin files sitting
+// directly at the package root belong to no package directory and are
+// reported under the literal name "(root)" rather than invented into one.
+
+import { execSync } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+
+export const AUDITS_REL_PATH = "qa/audits.jsonl";
+export const AUDIT_RECORD_SCHEMA = "cmp-audit-record/1";
+
+/** The pseudo-subsystem for Kotlin files directly at the androidMain package root. */
+export const ROOT_SUBSYSTEM = "(root)";
+
+function tryGit(root, cmd) {
+  try {
+    return execSync(`git ${cmd}`, { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+  } catch {
+    return null;
+  }
+}
+
+function tryGitLines(root, cmd) {
+  try {
+    const out = execSync(`git ${cmd}`, { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+    return out.replace(/\n+$/, "").split("\n").filter(Boolean);
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Resolve the androidMain Kotlin package root for this app, relative to the
+ * project root — derived from the android `namespace` (falling back to
+ * `applicationId`) in composeApp/build.gradle.kts, never hardcoded.
+ * @param {string} root project root (absolute)
+ * @returns {{ok: true, rel: string}|{ok: false, reason: string}}
+ */
+export function androidMainPackageRoot(root) {
+  let gradle;
+  try {
+    gradle = fs.readFileSync(path.join(root, "composeApp", "build.gradle.kts"), "utf8");
+  } catch {
+    return { ok: false, reason: "composeApp/build.gradle.kts not readable — cannot derive the app package" };
+  }
+  const pkg = gradle.match(/namespace\s*=\s*"([^"]+)"/)?.[1] ?? gradle.match(/applicationId\s*=\s*"([^"]+)"/)?.[1];
+  if (!pkg) {
+    return { ok: false, reason: "no android namespace/applicationId in composeApp/build.gradle.kts — cannot derive the app package" };
+  }
+  const rel = path.posix.join("composeApp/src/androidMain/kotlin", ...pkg.split("."));
+  if (!fs.existsSync(path.join(root, rel))) {
+    return { ok: false, reason: `androidMain has no Kotlin sources under the app package (${rel} absent)` };
+  }
+  return { ok: true, rel };
+}
+
+/**
+ * List this app's androidMain subsystems: the immediate directories under
+ * the package root (sorted), plus ROOT_SUBSYSTEM when Kotlin files sit
+ * directly at the root.
+ * @param {string} root project root (absolute)
+ * @param {string} pkgRootRel from androidMainPackageRoot()
+ * @returns {string[]}
+ */
+export function listSubsystems(root, pkgRootRel) {
+  const abs = path.join(root, pkgRootRel);
+  let entries;
+  try {
+    entries = fs.readdirSync(abs, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  const names = entries.filter((e) => e.isDirectory()).map((e) => e.name).sort();
+  if (entries.some((e) => e.isFile() && e.name.endsWith(".kt"))) names.push(ROOT_SUBSYSTEM);
+  return names;
+}
+
+/**
+ * Read the audit ledger. Absent is the honest "no audit ever recorded"
+ * state; malformed lines are counted, never silently dropped — the report
+ * says how many records it could not read instead of under-counting audits.
+ * @param {string} root project root (absolute)
+ * @returns {{entries: Array<{subsystem: string, sha: string, at: string, by: string}>, malformed: number}}
+ */
+export function readAuditLedger(root) {
+  const p = path.join(root, AUDITS_REL_PATH);
+  if (!fs.existsSync(p)) return { entries: [], malformed: 0 };
+  let raw;
+  try {
+    raw = fs.readFileSync(p, "utf8");
+  } catch {
+    return { entries: [], malformed: 0 };
+  }
+  const entries = [];
+  let malformed = 0;
+  for (const line of raw.split("\n")) {
+    if (!line.trim()) continue;
+    try {
+      const e = JSON.parse(line);
+      if (e && typeof e === "object" && typeof e.subsystem === "string" && typeof e.sha === "string") entries.push(e);
+      else malformed += 1;
+    } catch {
+      malformed += 1;
+    }
+  }
+  return { entries, malformed };
+}
+
+/**
+ * Record an audit claim: append {subsystem, sha: HEAD, at, by} to the
+ * ledger. Honesty guards, each a refusal rather than a fabrication:
+ *   - no git HEAD → refused (a claim about no commit is not a claim);
+ *   - unknown subsystem → refused, naming the derived ones;
+ *   - the subsystem's files differ from HEAD → refused (the record would
+ *     claim HEAD while the audited bytes are something else — commit first).
+ * @param {string} root project root (absolute)
+ * @param {{subsystem: string, by?: string}} claim
+ * @returns {{ok: true, sha: string, entry: object}|{ok: false, reason: string}}
+ */
+export function recordAudit(root, { subsystem, by }) {
+  const sha = tryGit(root, "rev-parse HEAD");
+  if (!sha) {
+    return { ok: false, reason: "no git history — an audit record is a claim about a specific commit, and there is none to claim against. Commit first." };
+  }
+  const pkgRoot = androidMainPackageRoot(root);
+  if (!pkgRoot.ok) return { ok: false, reason: pkgRoot.reason };
+  const known = listSubsystems(root, pkgRoot.rel);
+  if (!known.includes(subsystem)) {
+    return { ok: false, reason: `unknown subsystem "${subsystem}" — derived subsystems under ${pkgRoot.rel}: ${known.join(", ") || "(none)"}` };
+  }
+  const scope = subsystem === ROOT_SUBSYSTEM ? pkgRoot.rel : path.posix.join(pkgRoot.rel, subsystem);
+  const dirty = tryGitLines(root, `status --porcelain -- "${scope}"`) ?? [];
+  // For "(root)" the porcelain scope is the whole package root; narrow to
+  // files directly at the root so a dirty subsystem dir doesn't block a
+  // root-level record it has nothing to do with.
+  const relevantDirty =
+    subsystem === ROOT_SUBSYSTEM
+      ? dirty.filter((l) => {
+          const rel = l.slice(3).trim();
+          return path.posix.dirname(rel) === pkgRoot.rel;
+        })
+      : dirty;
+  if (relevantDirty.length > 0) {
+    return {
+      ok: false,
+      reason: `uncommitted changes under ${scope} — the record would claim commit ${sha.slice(0, 7)} but the audited files are not that commit. Commit (or revert) first, then record.`,
+    };
+  }
+  const entry = {
+    schema: AUDIT_RECORD_SCHEMA,
+    subsystem,
+    sha,
+    at: new Date().toISOString(),
+    by: by || tryGit(root, "config user.name") || "unknown",
+  };
+  const p = path.join(root, AUDITS_REL_PATH);
+  fs.mkdirSync(path.dirname(p), { recursive: true });
+  fs.appendFileSync(p, `${JSON.stringify(entry)}\n`);
+  return { ok: true, sha, entry };
+}
+
+/**
+ * The report itself: for every derived subsystem, what the ledger claims
+ * and what git says moved since that claim.
+ *
+ * Statuses, each phrased so the receipt can print the line verbatim:
+ *   never-audited   no ledger entry — says exactly that, implies no staleness
+ *   changed         androidMain files under it changed between the audited
+ *                   sha and HEAD (committed changes only — sha vs HEAD is
+ *                   the honest comparison; the working tree is not history)
+ *   unchanged       no committed change since the audited sha
+ *   unknown-commit  the ledger names a sha this repo's history does not
+ *                   contain — drift cannot be measured, and the report says
+ *                   so instead of guessing
+ *
+ * @param {string} root project root (absolute)
+ * @returns {{ok: false, reason: string}|{ok: true, packageRoot: string,
+ *   subsystems: Array<{name: string, status: string, audit: object|null, changedFiles: number}>,
+ *   lines: string[], summary: string, malformed: number}}
+ */
+export function evaluateAuditCadence(root) {
+  if (!tryGit(root, "rev-parse HEAD")) {
+    // No git history: "changed since the last audit" has no meaning yet.
+    // Report NOTHING rather than guessing — an invented staleness signal
+    // would be worse than none.
+    return { ok: false, reason: "no git history — changed-since-audit cannot be measured" };
+  }
+  const pkgRoot = androidMainPackageRoot(root);
+  if (!pkgRoot.ok) return { ok: false, reason: pkgRoot.reason };
+  const subsystems = listSubsystems(root, pkgRoot.rel);
+  if (subsystems.length === 0) {
+    return { ok: false, reason: `no subsystems under ${pkgRoot.rel} — nothing to report` };
+  }
+
+  const { entries, malformed } = readAuditLedger(root);
+  // Last entry per subsystem wins: the ledger is append-only, so file order
+  // IS chronological order — trusted over the `at` timestamps, which are
+  // claims a machine's clock made, not facts git can vouch for.
+  const latest = new Map();
+  for (const e of entries) latest.set(e.subsystem, e);
+
+  const gitTop = tryGit(root, "rev-parse --show-toplevel");
+  // Realpath both sides before re-anchoring diff paths: git reports the
+  // toplevel with symlinks resolved (macOS: /var/… vs /private/var/…), and a
+  // mismatch here would silently mis-attribute every changed file.
+  let rootReal = root;
+  try {
+    rootReal = fs.realpathSync(root);
+  } catch {
+    rootReal = root;
+  }
+  const results = [];
+  const lines = [];
+  for (const name of subsystems) {
+    const audit = latest.get(name) ?? null;
+    if (!audit) {
+      results.push({ name, status: "never-audited", audit: null, changedFiles: 0 });
+      lines.push(`no audit recorded for ${name} — when it gets one (cmp-audit ${name}), record it: node qa/record-audit.mjs ${JSON.stringify(name)}`);
+      continue;
+    }
+    // A ledger sha is a CLAIM read from a file — validate its shape before it
+    // touches a shell, and resolve it against history before trusting it.
+    const shaShapeOk = typeof audit.sha === "string" && /^[0-9a-f]{4,40}$/i.test(audit.sha);
+    const shaKnown = shaShapeOk && Boolean(tryGit(root, `rev-parse --verify --quiet "${audit.sha}^{commit}"`));
+    if (!shaKnown) {
+      results.push({ name, status: "unknown-commit", audit, changedFiles: 0 });
+      lines.push(`${name}: last audit (${fmtWhen(audit)}) was recorded against ${audit.sha.slice(0, 12)}, which is not in this repo's history — drift since it cannot be measured`);
+      continue;
+    }
+    const scope = name === ROOT_SUBSYSTEM ? pkgRoot.rel : path.posix.join(pkgRoot.rel, name);
+    const changedRaw = tryGitLines(root, `diff --name-only ${audit.sha} HEAD -- "${scope}"`) ?? [];
+    // Diff paths come back relative to the git toplevel, which may sit above
+    // the project root; re-anchor before subsystem attribution.
+    const changed = changedRaw
+      .map((rel) => (gitTop ? path.relative(rootReal, path.resolve(gitTop, rel)).split(path.sep).join("/") : rel))
+      .filter((rel) => (name === ROOT_SUBSYSTEM ? path.posix.dirname(rel) === pkgRoot.rel : true));
+    if (changed.length > 0) {
+      results.push({ name, status: "changed", audit, changedFiles: changed.length });
+      lines.push(
+        `${name}: ${changed.length} androidMain file(s) changed since its last recorded audit (${audit.sha.slice(0, 7)}, ${fmtWhen(audit)}) — audit it (cmp-audit ${name}), then record: node qa/record-audit.mjs ${JSON.stringify(name)}`,
+      );
+    } else {
+      results.push({ name, status: "unchanged", audit, changedFiles: 0 });
+    }
+  }
+
+  const changedCount = results.filter((r) => r.status === "changed").length;
+  const neverCount = results.filter((r) => r.status === "never-audited").length;
+  const unchangedCount = results.filter((r) => r.status === "unchanged").length;
+  if (unchangedCount > 0) {
+    lines.push(`${unchangedCount} subsystem(s) unchanged since their last recorded audit: ${results.filter((r) => r.status === "unchanged").map((r) => r.name).join(", ")}`);
+  }
+  if (malformed > 0) {
+    lines.push(`${malformed} ledger line(s) in ${AUDITS_REL_PATH} could not be parsed and are not counted`);
+  }
+  const summary = `${changedCount} changed since audit · ${neverCount} never audited · ${unchangedCount} unchanged`;
+
+  return { ok: true, packageRoot: pkgRoot.rel, subsystems: results, lines, summary, malformed };
+}
+
+function fmtWhen(audit) {
+  return typeof audit.at === "string" ? audit.at.slice(0, 10) : "undated";
+}

package/template/qa/lib/determinism.mjs

@@ -0,0 +1,179 @@
+// determinism.mjs — the comparison half of the lane's determinism probe.
+//
+// ARCH-13 statically bans ambient time reads (Clock.System, LocalDate.now,
+// TimeZone.currentSystemDefault) in APP code — but a library the app calls
+// can still read the wall clock, and a golden test can still depend on the
+// machine's timezone through a seam the static net cannot see. This project
+// family has already been bitten: a golden tree green at 23:00 and red by
+// morning, because a ViewModel was constructed without its injected clock.
+//
+// The probe (verify.mjs stepDeterminism) runs the JVM test tier TWICE under
+// maximally-shifted timezones and fails iff the two runs' OUTCOMES differ.
+// This module owns the two judgments that make that comparison honest:
+//
+//   - WHAT COUNTS AS AN OUTCOME: a test's verdict (pass/fail/error/skip)
+//     and its failure output — never its duration. Durations are not parsed
+//     at all, so a timing wobble is structurally incapable of tripping the
+//     probe (the brief-level rule "duration is not a difference" is enforced
+//     by construction, not by filtering).
+//
+//   - WHAT THE FAILURE MESSAGE MUST SAY: which test, which lane step owns
+//     it, and the observable difference between the two runs — never a bare
+//     "nondeterministic". A probe whose red is unactionable just teaches
+//     people to turn it off.
+
+import fs from "node:fs";
+import path from "node:path";
+
+/**
+ * The two probe timezones — chosen so the two legs NEVER share a calendar
+ * date, at any instant:
+ *
+ *   Etc/GMT+12 = UTC-12  (POSIX sign convention: Etc/GMT+N means UTC-N)
+ *   Etc/GMT-14 = UTC+14  (the highest real-world offset, Line Islands)
+ *
+ * The offsets are 26 hours apart — more than a full day — so the two legs'
+ * local dates differ at EVERY moment of every day, and any date-derived
+ * value (a "today" default, a day-boundary bucket, a formatted date in a
+ * golden tree) is guaranteed to differ between the legs. A UTC-vs-UTC+14
+ * pair would NOT have this property: those legs share a date for ten hours
+ * of every day, so the probe's power would depend on what time you ran it —
+ * the exact class of flakiness it exists to hunt.
+ */
+export const DETERMINISM_TIMEZONES = [
+  { tz: "Etc/GMT+12", label: "UTC-12" },
+  { tz: "Etc/GMT-14", label: "UTC+14" },
+];
+
+const XML_ENTITIES = { "&lt;": "<", "&gt;": ">", "&quot;": '"', "&apos;": "'", "&amp;": "&" };
+
+function unescapeXml(s) {
+  return s
+    .replace(/&#x([0-9a-fA-F]+);/g, (_, hex) => String.fromCodePoint(parseInt(hex, 16)))
+    .replace(/&#(\d+);/g, (_, dec) => String.fromCodePoint(Number(dec)))
+    .replace(/&(lt|gt|quot|apos|amp);/g, (m) => XML_ENTITIES[m]);
+}
+
+function attr(attrs, name) {
+  const m = attrs.match(new RegExp(`${name}="([^"]*)"`));
+  return m ? unescapeXml(m[1]) : null;
+}
+
+/**
+ * Parse one Gradle JUnit results directory into per-test outcomes.
+ * DELIBERATELY parses only verdict-bearing content: testcase identity,
+ * status, and failure/error text. `time="…"` attributes are never read, so
+ * two runs that differ only in duration produce identical outcome maps.
+ *
+ * @param {string} dir a test-results directory (TEST-*.xml files, flat)
+ * @returns {Record<string, {status: "pass"|"fail"|"error"|"skip", messages: string[]}>}
+ *   keyed by `classname.name`; empty object when the directory is absent
+ *   (the caller decides what an empty leg means — this parser never guesses)
+ */
+export function parseJUnitOutcomes(dir) {
+  const outcomes = {};
+  if (!fs.existsSync(dir)) return outcomes;
+  for (const entry of fs.readdirSync(dir)) {
+    if (!entry.startsWith("TEST-") || !entry.endsWith(".xml")) continue;
+    const xml = fs.readFileSync(path.join(dir, entry), "utf8");
+    const caseRe = /<testcase\b([^>]*?)(?:\/>|>([\s\S]*?)<\/testcase>)/g;
+    for (const m of xml.matchAll(caseRe)) {
+      const attrs = m[1];
+      const body = m[2] ?? "";
+      const classname = attr(attrs, "classname") ?? "";
+      const name = attr(attrs, "name") ?? "";
+      if (!classname && !name) continue;
+      let status = "pass";
+      const messages = [];
+      const childRe = /<(failure|error)\b([^>]*?)(?:\/>|>([\s\S]*?)<\/\1>)/g;
+      for (const c of body.matchAll(childRe)) {
+        status = c[1] === "error" ? "error" : "fail";
+        const message = attr(c[2], "message");
+        const text = c[3] ? unescapeXml(c[3]).trim() : "";
+        messages.push(message ?? text.split("\n")[0] ?? "");
+      }
+      if (status === "pass" && /<skipped\b/.test(body)) status = "skip";
+      outcomes[`${classname}.${name}`] = { status, messages };
+    }
+  }
+  return outcomes;
+}
+
+/**
+ * Which lane step owns a test class — so the probe's failure message names
+ * the step a reader would re-run, not just a class name. The patterns are
+ * the same filters the lane's own gradleTestStep calls use.
+ * @param {string} classname fully-qualified test class
+ * @returns {"goldenTrees"|"conformance"|"a11y"|"unitTests"}
+ */
+export function laneStepForTestClass(classname) {
+  if (/GoldenTreeTest$/.test(classname)) return "goldenTrees";
+  if (/ArchitectureConformanceTest$/.test(classname)) return "conformance";
+  if (/A11yConformanceTest$/.test(classname)) return "a11y";
+  return "unitTests";
+}
+
+function classnameOf(testId) {
+  // testId is `classname.name`; the class is everything before the last dot
+  // segment that starts the (possibly backticked, space-bearing) test name.
+  // Kotlin test names contain dots rarely but spaces often — the classname
+  // never contains a space, so split at the first segment containing one,
+  // falling back to the last dot.
+  const spaceIdx = testId.indexOf(" ");
+  const scope = spaceIdx === -1 ? testId : testId.slice(0, spaceIdx);
+  const lastDot = scope.lastIndexOf(".");
+  return lastDot === -1 ? testId : testId.slice(0, lastDot);
+}
+
+/**
+ * Compare two legs' outcomes. Returns one entry per observable difference,
+ * each carrying everything the failure message must name: the test, the
+ * owning lane step, and what differed between the legs.
+ *
+ * Kinds:
+ *   verdict-flip           different status (pass/fail/error/skip)
+ *   only-in-one-leg        the test executed in one leg only
+ *   failure-text-changed   failed in BOTH legs, but with different output —
+ *                          a date-dependent assertion message is still a
+ *                          timezone leak even when both legs are red
+ *
+ * @param {Record<string, {status: string, messages: string[]}>} a leg A outcomes
+ * @param {Record<string, {status: string, messages: string[]}>} b leg B outcomes
+ * @param {string} labelA human label for leg A (e.g. "TZ=Etc/GMT+12 (UTC-12)")
+ * @param {string} labelB human label for leg B
+ * @returns {Array<{test: string, step: string, kind: string, detail: string}>}
+ */
+export function compareOutcomes(a, b, labelA, labelB) {
+  const diffs = [];
+  const ids = [...new Set([...Object.keys(a), ...Object.keys(b)])].sort();
+  for (const id of ids) {
+    const step = laneStepForTestClass(classnameOf(id));
+    const inA = a[id];
+    const inB = b[id];
+    if (!inA || !inB) {
+      const where = inA ? labelA : labelB;
+      const missing = inA ? labelB : labelA;
+      diffs.push({ test: id, step, kind: "only-in-one-leg", detail: `executed under ${where} but produced no result under ${missing}` });
+      continue;
+    }
+    if (inA.status !== inB.status) {
+      const firstLine = (inA.status === "pass" ? inB : inA).messages[0]?.split("\n")[0] ?? "";
+      diffs.push({
+        test: id,
+        step,
+        kind: "verdict-flip",
+        detail: `${inA.status.toUpperCase()} under ${labelA}, ${inB.status.toUpperCase()} under ${labelB}${firstLine ? `: ${firstLine}` : ""}`,
+      });
+      continue;
+    }
+    if (inA.status !== "pass" && inA.messages.join("\n") !== inB.messages.join("\n")) {
+      diffs.push({
+        test: id,
+        step,
+        kind: "failure-text-changed",
+        detail: `failed under both, with different output — ${labelA}: "${inA.messages[0]?.split("\n")[0] ?? ""}" vs ${labelB}: "${inB.messages[0]?.split("\n")[0] ?? ""}"`,
+      });
+    }
+  }
+  return diffs;
+}