create-cmp-cli 0.18.0 → 0.20.0

package/packages/harness/src/lib/walk.mjs

@@ -145,7 +145,7 @@ function walkOfFeature(root, f, lane = null) {
     // recorded history (the lane journals every run), so it says what it
     // costs — measured, never the agent's memory of it.
     if (s.key === "prove" && lane)
-      return { ...s, state, note: `${humanDuration(lane.durationMs)} last full run` };
+      return { ...s, state, note: laneCostPhrase(lane) };
     return { ...s, state };
   });
 
@@ -224,20 +224,54 @@ export function laneTiming(root) {
   } catch {
     return null;
   }
-  const lines = text.split("\n");
-  for (let i = lines.length - 1; i >= 0; i--) {
-    const line = lines[i].trim();
-    if (line === "") continue;
+  // EVERY recorded full run, not just the last one. A single "last run" figure
+  // is dominated by Gradle's cache state: a run that changed nothing reports the
+  // no-op cost (a 2s releaseBuild cache hit), and the operator plans a real
+  // change around it. Observed spread on one project: last 25s, median 140s,
+  // worst 558s. The distribution is the honest answer to "what will this cost";
+  // `durationMs` stays the last run so existing callers keep their meaning.
+  const full = [];
+  for (const line of text.split("\n")) {
+    if (line.trim() === "") continue;
     let e;
     try {
       e = JSON.parse(line);
     } catch {
       continue;
     }
-    if (e && e.mode !== "fast" && typeof e.durationMs === "number" && e.durationMs > 0)
-      return { durationMs: e.durationMs, verdict: e.verdict ?? null };
+    if (e && e.mode !== "fast" && typeof e.durationMs === "number" && e.durationMs > 0) full.push(e);
   }
-  return null;
+  if (full.length === 0) return null;
+  const sorted = full.map((e) => e.durationMs).sort((a, b) => a - b);
+  const last = full[full.length - 1];
+  return {
+    durationMs: last.durationMs,
+    verdict: last.verdict ?? null,
+    runs: sorted.length,
+    // Median over an even count takes the lower of the two middles — a measured
+    // run rather than an average of two, so every figure quoted is one that
+    // actually happened.
+    medianMs: sorted[Math.floor((sorted.length - 1) / 2)],
+    maxMs: sorted[sorted.length - 1],
+  };
+}
+
+/**
+ * What a full check costs, said honestly: the last run when that is all there
+ * is, and last + typical + worst once the journal can support a spread. Never
+ * an estimate — every number here is a run that happened (walk-legibility L4).
+ * @param {{durationMs: number, medianMs?: number, maxMs?: number, runs?: number}|null} lane
+ * @returns {string|null} null when nothing was ever recorded
+ */
+export function laneCostPhrase(lane) {
+  if (!lane || !(lane.durationMs > 0)) return null;
+  const last = `${humanDuration(lane.durationMs)} last full run`;
+  // One or two runs is not a distribution; saying "typical" over them would be
+  // the same overclaim in a new costume.
+  if (!(lane.runs > 2) || !(lane.medianMs > 0)) return `${last} (measured)`;
+  const spread =
+    lane.maxMs > lane.medianMs ? `, typically ${humanDuration(lane.medianMs)}, worst ${humanDuration(lane.maxMs)}` : `, typically ${humanDuration(lane.medianMs)}`;
+  return `${last}${spread} (measured over ${lane.runs} full runs)`;
 }
 
 /** "98s" under two minutes, "~5 min" above — for humans deciding whether to wait. */
@@ -251,10 +285,17 @@ export function humanDuration(ms) {
  * record the console itself writes — a CROSS-PACKAGE CONTRACT with the
  * inspector's preview-service.mjs (consoleRegistryPath): sha1(resolved
  * root).slice(0,12), `cmp-console-<key>.json` in os.tmpdir(), fields
- * {pid, port, url}. pid-liveness only, no HTTP — this runs inside a
+ * {pid, port, url, buildStale}. pid-liveness only, no HTTP — this runs inside a
  * statusline with a <300ms budget.
- * @returns {{url: string} | {stale: true} | null} null = no record at all
- *   (never started, or stopped cleanly — silence, not an alarm)
+ *
+ * `buildStale` is the console's OWN verdict on itself (studio-self-renewal R5):
+ * a console serving code that is no longer the code on disk. It is carried on
+ * the record rather than recomputed here on purpose — the harness cannot hash
+ * the inspector's sources (in a scaffolded app the inspector is an npm package
+ * elsewhere), and a per-prompt hook must not make an HTTP call. The process
+ * that owns the fact publishes it; every consumer stays dumb.
+ * @returns {{url: string, buildStale: boolean} | {stale: true} | null} null = no
+ *   record at all (never started, or stopped cleanly — silence, not an alarm)
  */
 export function consoleState(root) {
   try {
@@ -266,7 +307,10 @@ export function consoleState(root) {
     } catch (err) {
       if (!(err && err.code === "EPERM")) return { stale: true }; // record left by a crashed console
     }
-    return { url: typeof rec.url === "string" ? rec.url : `http://127.0.0.1:${rec.port}/` };
+    return {
+      url: typeof rec.url === "string" ? rec.url : `http://127.0.0.1:${rec.port}/`,
+      buildStale: rec.buildStale === true,
+    };
   } catch {
     return null;
   }
@@ -376,7 +420,7 @@ export function renderStatusline({ available, walks, arrivals, console: consoleR
   // L6: the always-visible surface reports the other surface's death. A stale
   // record means the console CRASHED (a clean stop removes it) — the failure
   // mode was silence, and silence is the one thing this line never does.
-  const down = consoleRec && consoleRec.stale ? " · console down" : "";
+  const down = consoleRec && consoleRec.stale ? " · console down" : consoleRec && consoleRec.buildStale ? " · console stale" : "";
   if (w.you.turn === "you") return `■ YOUR TURN — ${w.name}: ${w.you.act}${extra}${arrived}${down}`;
   const now =
     w.currentStage === "build" && w.promises.total > 0
@@ -397,7 +441,7 @@ export function renderCard(w, ctx = {}) {
     .join("  ");
   const gloss = STAGE_GLOSS[w.currentStage] ? ` — ${STAGE_GLOSS[w.currentStage]}` : "";
   const laneNote =
-    w.currentStage === "prove" && ctx.lane ? ` (takes ${humanDuration(ctx.lane.durationMs)} here, measured)` : "";
+    w.currentStage === "prove" && ctx.lane ? ` (${laneCostPhrase(ctx.lane)} here)` : "";
   const nowLine =
     w.currentStage === "build" && w.promises.current
       ? `Now: keeping promise ${Math.min(w.promises.kept + 1, w.promises.total)} of ${w.promises.total} — “${w.promises.current.title || w.promises.current.id}”`
@@ -426,6 +470,12 @@ export function renderCard(w, ctx = {}) {
  * standing instruction, not a discovery).
  */
 function studioLine(consoleRec) {
+  // Order matters: a console that is UP but drawing from old code is not
+  // healthy, and reporting it as "running" is the clean bill of health that
+  // let this go unnoticed for a whole session. It heals itself (the worker
+  // renews on quiescence), so say what is true and why it may be waiting.
+  if (consoleRec && consoleRec.url && consoleRec.buildStale)
+    return `[studio: running at ${consoleRec.url} but STALE — it is serving code older than the tree, and everything it shows was drawn by that older code. It renews itself once no render or lane is in flight; if it stays stale, say so rather than citing what it shows.]`;
   if (consoleRec && consoleRec.url) return `[studio: running at ${consoleRec.url}]`;
   if (consoleRec && consoleRec.stale)
     return "[studio: DOWN — it crashed (stale registry record). Restore it now: call the cmp-inspector `preview { projectDir }` tool (it starts a detached resident console), or tell the human it is down. Do not proceed silently.]";
@@ -452,8 +502,8 @@ export function renderInject(data) {
   const chainText = renderChain(chain);
   parts.push(
     chainText !== ""
-      ? `[the chain — the current request's steps. Keep it CURRENT: advance with \`node qa/plan.mjs --step N\` as steps land, \`--done\` when the request lands. A stale chain misleads the human watching the studio.]\n${chainText}`
-      : '[no chain declared. At kickoff, declare the request\'s steps so the human can watch position live: `node qa/plan.mjs --set "step | step | …" --title "<the ask, restated>"` — mirror the itinerary you print in chat.]',
+      ? `[the chain — the current request's steps. Keep it CURRENT: advance with \`node qa/plan.mjs --step N\` as steps land, \`--done\` when the request lands. If the human redirects, re-declare (\`--set\` again) — the chain is an offer they can reshape, not an announcement. A stale chain misleads the human watching the studio.]\n${chainText}`
+      : '[no chain declared. At kickoff, declare the request\'s steps and show them in your first reply AS AN OFFER — the human can reorder or redirect, and you re-declare without ceremony; work starts immediately either way: `node qa/plan.mjs --set "step | step | …" --title "<the ask, restated>"`.]',
   );
   if (walks.length > 0) {
     parts.push("[walk-status — derived from the ledgers; render this state, never your own memory of it]");
@@ -462,7 +512,7 @@ export function renderInject(data) {
   for (const a of arrivals)
     parts.push(`▲ ARRIVED, UNPLANNED — ${a.label} (${a.status}): ${a.reason ?? "no recorded reason"}. Offer: handle now, or after the current walk lands (recommended: after).`);
   parts.push(
-    "Protocol: open every reply with the chat header line above, verbatim. Speak stages as Decide·Design·Contract·Build·Prove·Sign-off — with their plain-words gloss on first mention — and clauses as promises. Declare the chain at kickoff and advance it as you go; if the studio line above says DOWN or not running, restore it (preview tool) or surface it before proceeding. Quiet between headers (one line per stage transition). At any human gate, render the full stop card: stage, what it is in plain words, then the easiest act first (the studio console when it is up; the CLI as fallback), then what comes after. Quote the lane's cost only from the measured figure in the card — never estimate it. Never open a second walk silently.",
+    "Protocol: open every reply with the chat header line above, verbatim. Speak stages as Decide·Design·Contract·Build·Prove·Sign-off — with their plain-words gloss on first mention — and clauses as promises. Declare the chain at kickoff and advance it as you go; if the studio line above says DOWN or not running, restore it (preview tool) or surface it before proceeding. Quiet between headers (one line per stage transition). At any human gate, render the full stop card: stage, what it is in plain words, then the easiest act first (the studio console when it is up; the CLI as fallback), then what comes after. Quote the lane's cost only from the measured figure in the card — never estimate it. Never open a second walk silently. Principles that bind THIS turn (docs/PRINCIPLES.md): derived, never claimed — name the command behind any claim; the layer you changed cannot certify itself — run its consumers, stamp a fresh app for a template or harness change; never wait on nothing — every wait is bounded, and if you are blocked, say on what and stop.",
   );
   return parts.join("\n\n");
 }

package/packages/harness/src/receipt-check.mjs

@@ -28,6 +28,39 @@ const args = process.argv.slice(2);
 const asHook = args.includes("--hook");
 const asJson = args.includes("--json");
 
+// The lane's own in-flight marker (verify.mjs stamps it, rewriting it at each
+// step start with the step name and index). Mirrors qa/watch.mjs's bound.
+const LANE_MARKER_REL = ["composeApp", "build", ".cmp-lane-in-progress"];
+const LANE_MARKER_STALE_MS = 30 * 60 * 1000;
+
+/**
+ * The full check running RIGHT NOW, or null. The gate must still refuse — a
+ * lane in flight has not produced a receipt yet — but it must not tell the
+ * agent to start one. Repeating "run the lane" at a session whose lane is
+ * already ten minutes into its release build is an instruction to do the wrong
+ * thing, and it fired ~8 times in one observed session.
+ * @returns {{step: string|null, index: number|null, total: number|null}|null}
+ */
+function laneInFlight() {
+  try {
+    const p = path.join(ROOT, ...LANE_MARKER_REL);
+    const st = fs.statSync(p);
+    if (Date.now() - st.mtimeMs >= LANE_MARKER_STALE_MS) return null;
+    // Content is a bonus, never a requirement: legacy markers hold "pid iso".
+    try {
+      const n = JSON.parse(fs.readFileSync(p, "utf8"));
+      if (n && typeof n === "object") {
+        return { step: n.step ?? null, index: n.index ?? null, total: n.total ?? null };
+      }
+    } catch {
+      /* legacy marker — its EXISTENCE is the fact that matters */
+    }
+    return { step: null, index: null, total: null };
+  } catch {
+    return null;
+  }
+}
+
 function readStdinJson() {
   try {
     const raw = fs.readFileSync(0, "utf8");
@@ -56,7 +89,40 @@ function evaluate() {
       profile: receipt.profile,
     };
   }
-  const result = evaluateReceipt(receipt, () => computeInputsHash(ROOT));
+  // A nightly receipt proves the HARNESS and the tree's invariants under a
+  // forced double-run — never a change. Refused as done-evidence for the same
+  // reason --fast is: the receipt's own stage says what it is allowed to mean.
+  if (receipt.stage === "nightly" || receipt.profile === "nightly") {
+    return {
+      valid: false,
+      reason: "the last verify run was the nightly stage (it proves the harness, not this change); run the change-stage lane (`node qa/verify.mjs`) before finishing",
+      profile: receipt.profile,
+    };
+  }
+  // smoke (GATE-RULES Rule 0) runs no Gradle: it proves the framework returns,
+  // never that the change is good. Refused like --fast, for the same reason.
+  if (receipt.stage === "smoke" || receipt.profile === "smoke") {
+    return {
+      valid: false,
+      reason: "the last verify run was the smoke profile (the framework check — no build, no tests; it proves the instrument, not this change); run the change-stage lane (`node qa/verify.mjs`) before finishing",
+      profile: receipt.profile,
+    };
+  }
+  // A surface this project cannot resolve is a REFUSAL with an explanation,
+  // never an unhandled stack trace: this runs as the Stop hook on every turn
+  // end, and a crash there reads as a broken harness rather than as the
+  // misconfiguration it is. (evidence-economics S8 follow-up: computeInputsHash
+  // now throws rather than returning a confident hash of the empty set.)
+  let result;
+  try {
+    result = evaluateReceipt(receipt, () => computeInputsHash(ROOT));
+  } catch (err) {
+    return {
+      valid: false,
+      reason: `cannot verify this receipt — ${err && err.message ? err.message : String(err)}`,
+      profile: receipt.profile,
+    };
+  }
   // Surface the receipt's evidence rung (the ladder — qa/lib/evidence-level.mjs)
   // alongside the verdict: the rung is the receipt's own derived field, read
   // verbatim, never recomputed here. Older receipts without it stay valid.
@@ -78,10 +144,20 @@ if (asHook) {
     // The walk's vocabulary (walk-legibility L3): this gate IS the Prove
     // stage refusing to close — same fact, same enforcement, words that match
     // every other surface. The precise reason stays verbatim beneath.
+    //
+    // The REFUSAL never changes with a lane in flight — no receipt yet means
+    // not done, and that is the whole point of the gate. What changes is the
+    // INSTRUCTION: "run the lane" is wrong advice when one is already running,
+    // and a gate that tells you to do the thing you are doing trains you to
+    // stop reading it.
+    const flight = laneInFlight();
+    const act = flight
+      ? `A full check is ALREADY RUNNING${flight.step ? ` (${flight.step}${flight.index && flight.total ? `, step ${flight.index} of ${flight.total}` : ""})` : ""} — ` +
+        `wait for it to finish and commit its receipt. Do NOT start a second one; two lanes fight over the same build directory.`
+      : "Run `node qa/verify.mjs` (it checks every promise and writes the receipt), " +
+        "commit the receipt, or see README §Verification enforcement to bypass.";
     process.stderr.write(
-      `■ Prove — not done: the promises are not yet checked against this tree. ` +
-        `${result.reason}. Run \`node qa/verify.mjs\` (it checks every promise and writes the receipt), ` +
-        `commit the receipt, or see README §Verification enforcement to bypass.\n`,
+      `■ Prove — not done: the promises are not yet checked against this tree. ${result.reason}. ${act}\n`,
     );
     process.exit(2);
   }