create-cmp-cli 0.24.0 → 0.25.0

package/packages/harness/src/lib/inputs-hash.mjs

@@ -5,7 +5,7 @@
 // there is exactly one definition of the surface and the algorithm.
 //
 // SINGLE SOURCE OF TRUTH: packages/receipts/src/inputs-hash.mjs in the
-// create-cmp repo (the `@create-cmp/receipts` package). The copy in a generated
+// create-cmp repo (the `prooflane-receipts` package). The copy in a generated
 // project's qa/lib/ is vendored byte-identical at scaffold time and pinned by
 // test/receipts-parity.test.mjs — edit the package source, then run
 // `node scripts/sync-harness.mjs`.
@@ -30,15 +30,46 @@ import path from "node:path";
 // looking the same is the worst failure this harness can have, so the surface
 // is now resolved per project (see resolveVerifiedSurface) and an empty one is
 // refused rather than hashed.
-export const VERIFIED_SURFACE = [
-  "composeApp",
-  "specs",
-  "qa",
-  "gradle/libs.versions.toml",
-  "build.gradle.kts",
-  "settings.gradle.kts",
-  "gradle.properties",
-];
+/**
+ * The surface a project gets when it has NOT declared one.
+ *
+ * This used to be a constant: `composeApp`, `specs`, `qa`, and the Gradle files
+ * — one stack's directory names, in the module every adopter's receipt is
+ * computed by. Vendored into a repo whose code lives under `services/`, it
+ * matched `qa/` and `specs/` and nothing else, so the lane produced a valid,
+ * confident, SMALLER hash: a receipt attesting a fraction of a project while
+ * looking complete. The file's own header calls that the worst failure this
+ * harness can have, and then shipped it as the default.
+ *
+ * Derived from the tree instead, and deliberately WIDE. Over-attesting costs a
+ * hash that moves more often than it needs to; under-attesting silently drops
+ * files from what a receipt claims. Only one of those is a lie, so the error is
+ * taken in the safe direction. Build output and dependency directories are
+ * excluded because they are outputs, not the thing being attested.
+ *
+ * A project that wants a narrower or pinned surface DECLARES one — `harness
+ * init` writes it, and the template ships one, so this fallback is for repos
+ * that predate the declaration rather than the normal path.
+ *
+ * @param {string} root
+ * @returns {string[]}
+ */
+export function defaultSurface(root) {
+  // The same construction as the walk — the universal floor plus what this
+  // repo's own .gitignore says — so the two agree by construction. qa-artifacts
+  // is the lane's own output and stays named.
+  const skip = new Set([...WALK_FLOOR, "qa-artifacts", ...gitignoredDirs(root), ...declaredIgnore(root)]);
+  let entries;
+  try {
+    entries = fs.readdirSync(root, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  return entries
+    .filter((e) => !e.name.startsWith(".") && !skip.has(e.name))
+    .map((e) => e.name)
+    .sort();
+}
 
 // Paths EXCLUDED even though they fall under an included surface dir above.
 // qa/evidence and qa-artifacts are lane OUTPUTS — including them would make
@@ -74,6 +105,10 @@ const EXCLUDED_PREFIXES = [
   // un-proves the tree — the exact inversion this family of exclusions exists
   // to prevent.
   "qa/.agent-hold.json",
+  // The lane's own in-flight marker (qa/lib/lane-markers.mjs): stamped for a
+  // run's duration, rewritten at every step. Hashing it would make the lane
+  // invalidate its own receipt mid-run.
+  "qa/.lane-in-progress",
   "qa/evidence",
   "qa-artifacts",
   "qa/comments.json",
@@ -139,7 +174,111 @@ function tryGitLsFiles(root) {
 // "INVALID — source changed" the moment the user runs `git init`, even though
 // no source changed. Pre-git and post-git hashes must agree for identical
 // source; that is the invariant the regression test pins.
-const WALK_EXCLUDED_DIRS = new Set(["build", ".gradle", ".kotlin", ".git", ".idea", "node_modules"]);
+// A FLOOR, not the rule. This used to BE the rule, and it was one ecosystem's:
+// it knew build/.gradle/.kotlin/.idea/node_modules and nothing of __pycache__,
+// venv, target (Rust, Maven), bin and obj (.NET), vendor (Go, PHP), Pods or
+// DerivedData. So a Python tree hashed one set of bytes before `git init` and a
+// different set after, and the stamp-time PASS receipt read "source changed
+// since the receipt" the instant a user ran `git init` — with no source change.
+// That is the exact invariant the constant was written to hold, broken for
+// every ecosystem but the first.
+// THE FLOOR IS UNIVERSAL; EVERYTHING ELSE IS DECLARED. `.git` is git's, and
+// `node_modules` is this lane's own runtime. Until 2026-09-08 this set also
+// carried `build`, `.gradle`, `.kotlin`, `.idea` — one ecosystem's build output,
+// applied to every tree. PATTERN: the repo's own ignore file is the truth
+// (ripgrep, watchman and git itself all read .gitignore rather than a table);
+// beneath it, the profile declares `layout.ignore` and `layout.buildDir`,
+// written into qa/verified-surface.json as `ignore` so THIS package — the
+// notary's, which must know no profile — reads a project fact, not a stack.
+// WHY IT WORKS: the people who know the stack maintain the list, in the file
+// they already maintain. HOW IT FAILS: a tree with no git, no .gitignore and no
+// declaration hashes its build output — a hash that moves too often, which is
+// the safe direction. WHAT WE DO: that case is the walk, and the walk prints
+// its rules. Q5 (NORTH-STAR §10): git-mode hashing is untouched, and a cmp
+// tree's .gitignore already lists these directories, so no receipt moves.
+const WALK_FLOOR = new Set([".git", "node_modules"]);
+const WALK_EXCLUDED_DIRS = WALK_FLOOR;
+
+/**
+ * Directories the project DECLARED unhashable — qa/verified-surface.json's
+ * optional `ignore` list, written by `harness init` from `layout.ignore` and
+ * `layout.buildDir`, so the notary reads a project fact rather than a profile.
+ * @param {string} root
+ * @returns {Set<string>}
+ */
+export function declaredIgnore(root) {
+  try {
+    const parsed = JSON.parse(fs.readFileSync(path.join(root, SURFACE_CONFIG_REL), "utf8"));
+    const list = Array.isArray(parsed?.ignore) ? parsed.ignore : [];
+    return new Set(list.filter((x) => typeof x === "string" && x.trim() && !x.includes("..")).map((x) => x.replace(/^\.\//, "").replace(/\/$/, "")));
+  } catch {
+    return new Set();
+  }
+}
+
+/**
+ * The directories THIS repo ignores, read from its own `.gitignore`.
+ *
+ * Walk mode exists only before `git init`, and its whole job is to agree with
+ * what `git ls-files --exclude-standard` will say afterwards. Maintaining a
+ * hand-written list of every ecosystem's build directory is a losing game and
+ * was already lost; reading the file git reads makes the two modes agree BY
+ * CONSTRUCTION rather than by vigilance.
+ *
+ * Deliberately a small subset of gitignore syntax — bare directory names, with
+ * or without a leading or trailing slash. Globs, negations and nested paths are
+ * left to git, which is running in every case that matters. Missing one costs a
+ * hash that moves too often; that is the safe direction, and the same one
+ * `defaultSurface` errs in.
+ *
+ * @param {string} root
+ * @returns {Set<string>}
+ */
+export function gitignoredDirs(root) {
+  let text;
+  try {
+    text = fs.readFileSync(path.join(root, ".gitignore"), "utf8");
+  } catch {
+    return new Set();
+  }
+  const out = new Set();
+  for (const raw of text.split("\n")) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#") || line.startsWith("!")) continue;
+    if (line.includes("*") || line.includes("?") || line.includes("[")) continue;
+    const name = line.replace(/^\//, "").replace(/\/$/, "");
+    if (name && !name.includes("/")) out.add(name);
+  }
+  return out;
+}
+/**
+ * Files that are INPUTS TO THE RESOLUTION rather than members of the surface.
+ *
+ * `.gitignore` decides what is attested: `git ls-files --exclude-standard`
+ * honours it, and `gitignoredDirs` above makes the walk fallback honour it too.
+ * A file that decides the attested set and is not itself attested is a hole —
+ * edit one line and a directory silently leaves every future receipt, with
+ * nothing in the chain saying the coverage moved. That is the narrowing failure
+ * this module's header calls the worst one it can have, arriving through the
+ * side door.
+ *
+ * Attested STRUCTURALLY, outside `surfaceEntries`, because a declaration that
+ * could omit it would reopen exactly the hole: `defaultSurface` skips dotfiles,
+ * the shipped template surface lists none, and no adopter writing
+ * `qa/verified-surface.json` by hand would think to add it. It is not the
+ * adopter's to declare — it is the resolver's own input.
+ *
+ * Not locked: adopters edit `.gitignore` legitimately and often. Attestation is
+ * the right instrument — a change makes the receipt say "source changed", which
+ * is true, and re-running mints a valid one.
+ */
+const RESOLUTION_INPUTS = Object.freeze([".gitignore"]);
+
+/** @param {string} relPath @returns {boolean} */
+function isResolutionInput(relPath) {
+  return RESOLUTION_INPUTS.includes(relPath);
+}
+
 // File-level mirror of the same principle (OS/editor junk the .gitignore covers).
 const WALK_EXCLUDED_FILES = new Set([".DS_Store"]);
 const WALK_EXCLUDED_SUFFIXES = [".iml", ".log"];
@@ -150,14 +289,16 @@ function walkIncludesFile(name) {
 }
 
 // Dependency-free recursive walk, used when git is unavailable (non-git scaffold).
-function walkAllFiles(dir) {
+// `ignored` is the floor plus whatever this repo's own .gitignore names, so the
+// pre-git hash agrees with the post-git one for any ecosystem, not just the first.
+function walkAllFiles(dir, ignored = WALK_EXCLUDED_DIRS) {
   const out = [];
   if (!fs.existsSync(dir)) return out;
   for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
     const p = path.join(dir, entry.name);
     if (entry.isDirectory()) {
-      if (WALK_EXCLUDED_DIRS.has(entry.name)) continue; // non-source scratch — see note above
-      out.push(...walkAllFiles(p));
+      if (ignored.has(entry.name)) continue; // non-source scratch — see note above
+      out.push(...walkAllFiles(p, ignored));
     } else if (entry.isFile() && walkIncludesFile(entry.name)) out.push(p);
   }
   return out;
@@ -191,7 +332,7 @@ export function resolveVerifiedSurface(root) {
   try {
     raw = fs.readFileSync(p, "utf8");
   } catch {
-    return VERIFIED_SURFACE; // no declaration — the CMP default, unchanged
+    return defaultSurface(root); // no declaration — the tree's own top level
   }
   let parsed;
   try {
@@ -208,32 +349,41 @@ export function resolveVerifiedSurface(root) {
 
 // Resolve the verified surface to a flat, sorted list of paths (relative to
 // root, POSIX-style `/` separators) that currently exist on disk.
-function resolveSurfaceFiles(root, VERIFIED_SURFACE) {
+function resolveSurfaceFiles(root, surfaceEntries) {
   const gitFiles = tryGitLsFiles(root);
 
   if (gitFiles) {
     return gitFiles
       .map((p) => p.split(path.sep).join("/"))
-      .filter((relPath) => VERIFIED_SURFACE.some((surface) => relPath === surface || relPath.startsWith(`${surface}/`)))
+      .filter((relPath) => isResolutionInput(relPath) || surfaceEntries.some((surface) => relPath === surface || relPath.startsWith(`${surface}/`)))
       .filter((relPath) => !isExcluded(relPath))
       .filter((relPath) => fs.existsSync(path.join(root, relPath)) && fs.statSync(path.join(root, relPath)).isFile());
   }
 
   // Fallback: no git available — walk the surface directories directly so a
-  // non-git scaffold still produces a stable hash.
+  // non-git scaffold still produces a stable hash. The ignore set is the floor
+  // PLUS this repo's own .gitignore, which is what `git ls-files
+  // --exclude-standard` will honour the moment the tree becomes a repo. Reading
+  // the same file is what makes the two modes agree by construction.
+  const ignored = new Set([...WALK_FLOOR, ...gitignoredDirs(root), ...declaredIgnore(root)]);
   const collected = [];
-  for (const surface of VERIFIED_SURFACE) {
+  for (const surface of surfaceEntries) {
     const abs = path.join(root, surface);
     if (!fs.existsSync(abs)) continue;
     const stat = fs.statSync(abs);
     if (stat.isFile()) {
       collected.push(surface);
     } else if (stat.isDirectory()) {
-      for (const file of walkAllFiles(abs)) {
+      for (const file of walkAllFiles(abs, ignored)) {
         collected.push(path.relative(root, file).split(path.sep).join("/"));
       }
     }
   }
+  // The resolver's own inputs, attested whatever the surface declares.
+  for (const rel of RESOLUTION_INPUTS) {
+    const abs = path.join(root, rel);
+    if (!collected.includes(rel) && fs.existsSync(abs) && fs.statSync(abs).isFile()) collected.push(rel);
+  }
   return collected.filter((relPath) => !isExcluded(relPath));
 }
 
@@ -246,7 +396,9 @@ function resolveSurfaceFiles(root, VERIFIED_SURFACE) {
  * it belongs in qa/verified-surface.json. Sorted; [] when git is unavailable
  * (the walk fallback has no notion of "what git sees") or everything is
  * covered. Lane outputs (EXCLUDED_PREFIXES) are not "undeclared" — they are
- * excluded by decision.
+ * excluded by decision, and RESOLUTION_INPUTS are not undeclared either: they
+ * are attested structurally, so naming them here would report a file as
+ * unattested that the very same hash attests.
  * @param {string} root
  * @param {string[]} [surface] defaults to resolveVerifiedSurface(root)
  * @returns {string[]}
@@ -254,7 +406,8 @@ function resolveSurfaceFiles(root, VERIFIED_SURFACE) {
 export function undeclaredTopLevel(root, surface = resolveVerifiedSurface(root)) {
   const gitFiles = tryGitLsFiles(root);
   if (!gitFiles) return [];
-  const covered = (relPath) => surface.some((entry) => relPath === entry || relPath.startsWith(`${entry}/`)) || isExcluded(relPath);
+  const covered = (relPath) =>
+    surface.some((entry) => relPath === entry || relPath.startsWith(`${entry}/`)) || isExcluded(relPath) || isResolutionInput(relPath);
   const out = new Set();
   for (const raw of gitFiles) {
     const relPath = raw.split(path.sep).join("/");

package/packages/harness/src/lib/lane-markers.mjs

@@ -0,0 +1,78 @@
+// lane-markers.mjs — where the lane says "I am running", and where the eyes say
+// "I am building". One place, so no reader ever looks in the wrong directory.
+//
+// THE LANE MARKER IS CORE STATE (Stage 0 PR 6a). It used to live at
+// composeApp/build/.cmp-lane-in-progress — inside a Compose app's Gradle
+// build directory — and every reader (the Stop hook, the narrator, the
+// watcher, the chain view, the console) carried that path as a constant. A
+// backend has no composeApp/build; a lane there stamped a marker nobody read.
+// The marker is the lane's, not the stack's, so it lives beside the lane's
+// other transient state (qa/.agent-hold.json, qa/.plan.json): gitignored,
+// excluded from the inputs hash, never a lane OUTPUT for the fast filter,
+// outside the lock region (the region is .mjs files and the two declarations).
+//
+// THE RENDER MARKER IS THE PROVIDER'S. The preview daemon (mobile's eyes)
+// stamps <buildDir>/.cmp-render-in-progress around its Gradle builds so the
+// lane can defer and self-heal around it. Which directory that is comes from
+// the profile's `layout.buildDir`; a profile with none has no render marker,
+// and every reader takes `null` as "nothing to wait for".
+//
+// SINGLE SOURCE OF TRUTH: packages/harness/src/lib/lane-markers.mjs in the
+// create-cmp repo. Vendored byte-identical into qa/lib/ — edit the package
+// source, then run `node scripts/sync-harness.mjs`.
+
+import fs from "node:fs";
+import path from "node:path";
+
+import { resolveHarnessManifest } from "./harness-manifest.mjs";
+import { loadProfileSync } from "./profile-loader.mjs";
+
+/** The lane's in-flight marker, project-relative. Stamped by qa/verify.mjs for a run's duration. */
+export const LANE_MARKER_REL = "qa/.lane-in-progress";
+/** The eyes' in-flight marker's file name, under the profile's `layout.buildDir`. */
+export const RENDER_MARKER_NAME = ".cmp-render-in-progress";
+
+/** Past this, a lane marker is a crashed lane's leftover, not a lane. */
+export const LANE_MARKER_STALE_MS = 30 * 60 * 1000;
+/** Past this, a render marker is a crashed daemon's leftover, not a build. */
+export const RENDER_MARKER_FRESH_MS = 5 * 60 * 1000;
+
+/**
+ * @param {string} root project root
+ * @returns {string} absolute path of the lane marker
+ */
+export function laneMarkerPath(root) {
+  return path.join(root, ...LANE_MARKER_REL.split("/"));
+}
+
+/**
+ * The render marker's absolute path for this project, or null when the
+ * profile declares no build directory (no eyes, nothing to wait for). Resolved
+ * through the manifest and the profile, synchronously; an unusable manifest or
+ * profile also yields null — a coordination courtesy must never refuse a lane.
+ * @param {string} root
+ * @returns {string|null}
+ */
+export function renderMarkerPath(root) {
+  const manifest = resolveHarnessManifest(root);
+  if (!manifest.ok) return null;
+  const loaded = loadProfileSync(root, manifest.manifest.profile);
+  if (!loaded.ok) return null;
+  const buildDir = loaded.profile.layout && typeof loaded.profile.layout.buildDir === "string" ? loaded.profile.layout.buildDir : null;
+  if (!buildDir) return null;
+  return path.join(root, ...buildDir.split("/"), RENDER_MARKER_NAME);
+}
+
+/**
+ * A marker's mtime in ms, or null when absent/unreadable.
+ * @param {string|null} markerPath
+ * @returns {number|null}
+ */
+export function markerMtimeMs(markerPath) {
+  if (!markerPath) return null;
+  try {
+    return fs.statSync(markerPath).mtimeMs;
+  } catch {
+    return null;
+  }
+}

package/packages/harness/src/lib/lane-narrator.mjs

@@ -12,7 +12,7 @@
 // that can take minutes must emit a heartbeat, or the operator's only signal is
 // silence, and silence is exactly what a crash looks like.
 //
-// The marker verify.mjs already rewrites at each step start (.cmp-lane-in-progress,
+// The marker verify.mjs already rewrites at each step start (qa/.lane-in-progress,
 // JSON: step, index, total, stepStartedAt, expectedStepMs, expectedLaneMs) carries
 // everything a pulse needs, so this narrator INVENTS NOTHING — it reads what the
 // lane declared about itself and says it out loud on a timer the lane cannot run.
@@ -24,8 +24,10 @@
 import fs from "node:fs";
 import path from "node:path";
 
+import { laneMarkerPath } from "./lane-markers.mjs";
+
 const ROOT = process.argv[2];
-const MARKER = path.join(ROOT ?? ".", "composeApp", "build", ".cmp-lane-in-progress");
+const MARKER = laneMarkerPath(ROOT ?? ".");
 
 // A step under this is not a wait — saying anything about it is noise.
 const FIRST_AFTER_MS = 20_000;

package/packages/harness/src/lib/lane-runner.mjs

@@ -17,7 +17,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { spawn } from "node:child_process";
 
-import { stepDeadlineMs, stepErrorResult } from "./step-outcomes.mjs";
+import { stepDeadlineMs, stepErrorResult, resolveStepDeadlines } from "./step-outcomes.mjs";
 
 /**
  * Per-step expected durations from the journal's LAST FULL run — the source
@@ -62,6 +62,53 @@ export function verdictMark(verdict) {
   return verdict === "PASS" ? "✓" : verdict === "CACHED" ? "⚡" : verdict === "SKIP" ? "→" : verdict === "ERROR" ? "⊘" : "✗";
 }
 
+// ── The compile short-circuit ───────────────────────────────────────────────
+// Once the thing that turns source into a runnable artifact has FAILED, every
+// verdict behind it is meaningless: the tests are testing the last successful
+// artifact or nothing at all, and the lane would spend minutes producing rows
+// nobody can read. Stopping there is right.
+//
+// WHICH STEP THAT IS, IS THE PACK'S TO SAY. This predicate was written
+// `r.name === "build"`, which is Gradle's word twice over — the directory and
+// the task. Keyed to the literal it was wrong in both directions on any other
+// stack, and wrong SILENTLY, with a plausible-looking lane to show for it:
+//
+//   a pack that compiles in `py_build` never short-circuited, so its whole slow
+//   tier ran against a tree that does not compile
+//   a pack that compiles elsewhere but has SOME step named `build` — a
+//   packaging step, a container image, a docs build; the word is not reserved —
+//   had its lane truncated there, dropping real verdicts on the floor
+//
+// So the name arrives on `ctx.compileStepName`, declared by the step pack
+// (test/fixtures/profiles/py-alien/index.mjs declares "py_build";
+// profiles/cmp/steps-cmp.mjs declares "build"). Three cases, and the
+// distinction is the KEY's presence, not its value:
+//
+//   key absent      a caller written before the declaration existed. It keeps
+//                   the historical behaviour rather than silently losing its
+//                   short-circuit — a compatibility fallback, and the only
+//                   place this file still spells one stack's word.
+//   key present,    the pack has no compile phase (a lint-only lane, an
+//   no name         interpreted stack). Short-circuit on NOTHING: every step
+//                   runs and every verdict is taken. Never inherit someone
+//                   else's step name — that is how a lane loses rows.
+//   key present,    stop after that step FAILs, and only that step.
+//   a name
+//
+// FAIL and not ERROR, deliberately and unchanged: ERROR means "I could not
+// check this", which is not the same claim as "this does not compile", and
+// widening it here would change the shipped cmp lane's behaviour.
+export const LEGACY_COMPILE_STEP_NAME = "build";
+
+function compileShortCircuit(ctx) {
+  if (!Object.hasOwn(ctx, "compileStepName")) {
+    return (r) => r.name === LEGACY_COMPILE_STEP_NAME && r.verdict === "FAIL";
+  }
+  const declared = ctx.compileStepName;
+  if (typeof declared !== "string" || declared === "") return () => false;
+  return (r) => r.name === declared && r.verdict === "FAIL";
+}
+
 /**
  * Run the steps, in order, under the lane's own discipline.
  *
@@ -78,8 +125,12 @@ export function verdictMark(verdict) {
  * @param {{entry: string, root: string}|null} [ctx.narrator] the pulse process to spawn
  *   beside the loop (lane-narrator.mjs) — a separate process because the steps are
  *   synchronous and no timer in this process can fire while one runs
- * @param {(result: object) => boolean} [ctx.stopAfter] short-circuit predicate; default:
- *   stop after a FAILed "build" — nothing downstream is meaningful
+ * @param {string|null} [ctx.compileStepName] the PACK's name for the step whose failure
+ *   makes every later verdict meaningless (see compileShortCircuit above). Omit the key
+ *   entirely and the historical `"build"` short-circuit is kept; pass null/undefined and
+ *   the lane short-circuits on nothing
+ * @param {(result: object) => boolean} [ctx.stopAfter] short-circuit predicate — the
+ *   caller's own word, outranking ctx.compileStepName; default: compileShortCircuit(ctx)
  * @param {() => void} [ctx.onFinally] runs in the finally (the project releases its device lease here)
  * @param {number} [ctx.startedAt] the lane's start, for the marker's `at`
  * @returns {{steps: object[], verdict: "PASS"|"FAIL", durationMs: number}}
@@ -90,13 +141,23 @@ export function runLane(ctx) {
     markerPath,
     expected = { byName: new Map(), laneMs: null },
     setDeadline = () => {},
+    // HOW LONG a step may take before it is wedged is the pack's to say, the
+    // same way `compileStepName` and `timeoutHint` are. Absent, the spine's
+    // fallback applies AND the ERROR row says so, so an adopter whose cold
+    // toolchain was cut short learns the knob exists.
+    stepDeadlines = undefined,
     print = null,
     narrator = null,
-    stopAfter = (r) => r.name === "build" && r.verdict === "FAIL",
+    stopAfter = compileShortCircuit(ctx),
     onFinally = () => {},
     startedAt = Date.now(),
   } = ctx;
 
+  // Resolved once per lane, not once per step: the bounds cannot change mid-run
+  // and `isDefault` must be the same answer in the deadline and in the ERROR row
+  // that explains it.
+  const DEADLINES = resolveStepDeadlines(stepDeadlines);
+
   const stamp = (stepFn, index, total) => {
     try {
       const name = stepFn ? stepDisplayName(stepFn) : null;
@@ -137,13 +198,18 @@ export function runLane(ctx) {
       // S4: every step under a deadline from its own history (×3, floor 5 min,
       // ceiling 30). A deadline or a throw is ONE ERROR row — the lane keeps
       // going, because the other verdicts are still worth having.
-      setDeadline(stepDeadlineMs(expected.byName.get(name)));
+      setDeadline(stepDeadlineMs(expected.byName.get(name), DEADLINES));
       const stepStarted = Date.now();
       let result;
       try {
         result = step();
       } catch (err) {
-        result = stepErrorResult(name, err, Date.now() - stepStarted);
+        // `step.timeoutHint` is the pack's where-to-look sentence, marked on the
+        // step function like `step.layer`. The spine carries it; it never writes one.
+        result = stepErrorResult(name, err, Date.now() - stepStarted, {
+          hint: typeof step.timeoutHint === "string" ? step.timeoutHint : undefined,
+          deadlineWasDefault: DEADLINES.isDefault,
+        });
       }
       // Layer tag: a pack may mark a step function with the layer of the
       // stack it proves (`fn.layer = "backend"`). The runner stamps it onto

package/packages/harness/src/lib/plan.mjs

@@ -14,7 +14,7 @@
 //      rendering carries the declaration's age — a stale plan reads as
 //      stale, never as true.
 //   3. The CORROBORATION is derived and overrides: the lane/render markers
-//      (composeApp/build/.cmp-lane-in-progress / .cmp-render-in-progress,
+//      (qa/.lane-in-progress / the profile's <buildDir>/.cmp-render-in-progress,
 //      mtime-bounded like every other consumer) say what is ACTUALLY running
 //      right now, regardless of what was declared.
 //
@@ -29,8 +29,12 @@
 // status surface never breaks the work it reports on.
 
 import fs from "node:fs";
+import { gitignoredDirs, declaredIgnore } from "./inputs-hash.mjs";
 import path from "node:path";
 
+import { laneMarkerPath, renderMarkerPath } from "./lane-markers.mjs";
+import { resolveSpecModel } from "./spec-model.mjs";
+
 export const PLAN_REL = "qa/.plan.json";
 export const REQUEST_REL = "qa/.request.json";
 // N5 (docs/features/drive-narration.md): closed chains leave a LOCAL trail —
@@ -146,11 +150,20 @@ export function markStep(root, n) {
   return { ok: true, plan };
 }
 
-/** The receipt's verdict + rung right now, for the trail — fail-soft glance. */
+/**
+ * The receipt's verdict + rung right now, for the trail — fail-soft glance.
+ *
+ * The pack rides along with the rung and is not optional decoration. This
+ * record is WRITTEN to the plan history and outlives the run that made it, so a
+ * bare rung here is worse than a bare rung printed to a terminal: nothing later
+ * can attribute it, and §8.9's rule that one pack's L2 and another's are
+ * different claims becomes unenforceable for every reader of the trail. `null`
+ * when the receipt names no pack, which is itself the honest answer.
+ */
 function receiptGlance(root) {
   try {
     const r = JSON.parse(fs.readFileSync(path.join(root, "qa/evidence/latest.json"), "utf8"));
-    return { verdict: r?.verdict ?? null, rung: r?.evidenceLevel?.rung ?? null };
+    return { verdict: r?.verdict ?? null, rung: r?.evidenceLevel?.rung ?? null, pack: r?.pack?.id ?? null };
   } catch {
     return null;
   }
@@ -235,8 +248,8 @@ export function clearPlan(root) {
  * reads as a bare truthy {} — busy, no narration. Stale/absent -> false.
  * @returns {object|false}
  */
-function markerInfo(root, name) {
-  const p = path.join(root, "composeApp", "build", name);
+function markerInfo(p) {
+  if (!p) return false;
   try {
     const st = fs.statSync(p);
     if (Date.now() - st.mtimeMs >= MARKER_FRESH_MS) return false;
@@ -262,8 +275,27 @@ function markerInfo(root, name) {
 // this corroborates the build stage the same way: writes in the working tree
 // since the current request began. No agent cooperation required — which is
 // the point.
-const ACTIVITY_ROOTS = ["composeApp/src", "specs", "qa", "docs"];
-const ACTIVITY_SKIP_DIRS = new Set(["build", ".gradle", ".kotlin", ".git", ".idea", "node_modules", "evidence"]);
+/**
+ * The trees whose writes count as observed agent activity: the profile's own
+ * source roots and specs directory, plus qa/ and docs/ (the harness and the
+ * governed prose — always core). Stage 0 PR 6b: this was a hardcoded
+ * ["composeApp/src", …], so on any other stack the build stage's observed tier
+ * saw nothing and the chain view reported an idle agent that was working.
+ * A project with no usable manifest gets the core roots alone — never a guess.
+ * @param {string} root
+ * @returns {string[]}
+ */
+function activityRoots(root) {
+  const model = resolveSpecModel(root);
+  if (!model.ok) return ["qa", "docs"];
+  return [...new Set([...model.model.sourceRoots, model.model.specsDir, "qa", "docs"])];
+}
+// Machinery and the repo's own ignored directories — never one stack's build
+// dirs by name (the 2026-09-08 language audit found .gradle and .kotlin here).
+const ACTIVITY_SKIP_FLOOR = new Set([".git", "node_modules", "evidence"]);
+function activitySkipDirs(root) {
+  return new Set([...ACTIVITY_SKIP_FLOOR, ...gitignoredDirs(root), ...declaredIgnore(root)]);
+}
 // Machinery, not work: the chain's own files and the lane's outputs must not
 // count as "the agent wrote something", or the pulse would corroborate itself.
 const ACTIVITY_SKIP_FILES = new Set([".plan.json", ".request.json", ".plan-history.jsonl", "flight-recorder.jsonl", "approvals.log.jsonl", ".DS_Store"]);
@@ -282,6 +314,7 @@ export const ACTIVITY_STALL_MS = 10 * 60 * 1000;
  *   null when there is no request to measure from
  */
 export function observeActivity(root, sinceIso, { now = Date.now() } = {}) {
+  const skipDirs = activitySkipDirs(root);
   const since = Date.parse(sinceIso ?? "");
   if (Number.isNaN(since)) return null;
   let filesChanged = 0;
@@ -295,7 +328,7 @@ export function observeActivity(root, sinceIso, { now = Date.now() } = {}) {
     }
     for (const e of entries) {
       if (e.isDirectory()) {
-        if (!ACTIVITY_SKIP_DIRS.has(e.name)) walk(path.join(dir, e.name));
+        if (!skipDirs.has(e.name)) walk(path.join(dir, e.name));
         continue;
       }
       if (!e.isFile() || ACTIVITY_SKIP_FILES.has(e.name)) continue;
@@ -311,7 +344,7 @@ export function observeActivity(root, sinceIso, { now = Date.now() } = {}) {
       }
     }
   };
-  for (const rel of ACTIVITY_ROOTS) walk(path.join(root, rel));
+  for (const rel of activityRoots(root)) walk(path.join(root, rel));
   return {
     filesChanged,
     lastWriteAgoMs: filesChanged > 0 ? Math.max(0, now - newest) : null,
@@ -333,8 +366,8 @@ export function deriveChain(root) {
   const plan = readPlan(root);
   const at = plan ? Date.parse(plan.updatedAt) : NaN;
   const busy = {
-    lane: markerInfo(root, ".cmp-lane-in-progress"),
-    render: markerInfo(root, ".cmp-render-in-progress"),
+    lane: markerInfo(laneMarkerPath(root)),
+    render: markerInfo(renderMarkerPath(root)),
   };
   const request = readRequest(root);
   // S3: the build stage's observed tier — writes since the request began.