elanous 0.2.40 → 0.2.42

package/scripts/release-loop/gate-pod-image-sticky-plan.ts

@@ -0,0 +1,99 @@
+interface StickyGatePool { id?: string | null; available: boolean; imageDigest: string | null }
+interface StickyGateShard { id?: string | null; files?: string[] | null }
+interface StickyGateReceipt { shardId: string; status: 'complete' | 'stalled'; pool?: string | null; imageDigest: string }
+interface StickyGateShardAction {
+  shardId: string; files: string[]; kind: 'reuse' | 'run' | 'unmeasured'; pool?: string; imageDigest?: string;
+}
+interface StickyGatePlan {
+  mode: 'full' | 'partial' | 'HOLD'; pinnedDigest: string | null; excludedPools: string[];
+  shards: StickyGateShardAction[]; reason?: string;
+}
+interface StickyGatePlanInput {
+  phase: 'start' | 'resume'; pools: readonly StickyGatePool[]; shards: readonly StickyGateShard[];
+  pinnedDigest?: string | null; receipts?: readonly StickyGateReceipt[];
+}
+
+const DIGEST = /^sha256:[a-f0-9]{64}$/i;
+const validDigest = (value: string | null | undefined): value is string => typeof value === 'string' && DIGEST.test(value);
+const normalizeDigest = (value: string | null | undefined): string | null => validDigest(value) ? value.toLowerCase() : null;
+const validPoolIdentity = (value: string | null | undefined): value is string => typeof value === 'string' && value.trim().length > 0;
+
+function hold(input: StickyGatePlanInput, pinnedDigest: string | null, reason: string, excludedPools: string[] = []): StickyGatePlan {
+  return { mode: 'HOLD', pinnedDigest, excludedPools, reason,
+    shards: input.shards.map((shard, index) => ({
+      shardId: validPoolIdentity(shard?.id) ? shard.id : `unmeasured-${index}`,
+      files: Array.isArray(shard?.files) ? [...shard.files] : [], kind: 'unmeasured',
+    })) };
+}
+
+function isValidPool(pool: StickyGatePool | null | undefined): pool is StickyGatePool & { id: string } {
+  return !!pool && validPoolIdentity(pool.id);
+}
+
+function isValidShard(shard: StickyGateShard | null | undefined): shard is StickyGateShard & { id: string; files: string[] } {
+  return !!shard && validPoolIdentity(shard.id) && Array.isArray(shard.files) && shard.files.length > 0
+    && shard.files.every((file) => typeof file === 'string') && new Set(shard.files).size === shard.files.length;
+}
+
+/**
+ * Deterministic E4 planning simulation. A production caller must persist the chosen digest at run start
+ * and pass it unchanged on resume; this module itself never runs a host command or pulls an image.
+ */
+export function planStickyGateImages(input: StickyGatePlanInput): StickyGatePlan {
+  if (!input.shards.length || !input.pools.length) return hold(input, null, 'empty pool or shard inventory');
+  const pools = input.pools.filter(isValidPool);
+  const validShards = input.shards.filter(isValidShard);
+  if (pools.length !== input.pools.length || new Set(pools.map((pool) => pool.id)).size !== pools.length
+    || validShards.length !== input.shards.length || new Set(validShards.map((shard) => shard.id)).size !== validShards.length)
+    return hold(input, null, 'invalid pool or shard identity');
+
+  let pinnedDigest: string | null = null;
+  if (input.phase === 'resume') {
+    pinnedDigest = normalizeDigest(input.pinnedDigest);
+    if (!pinnedDigest) return hold(input, null, 'run image digest missing');
+  } else if (input.pinnedDigest !== undefined && input.pinnedDigest !== null) {
+    pinnedDigest = normalizeDigest(input.pinnedDigest);
+    if (!pinnedDigest) return hold(input, null, 'invalid pinned image digest');
+  } else {
+    pinnedDigest = pools.map((pool) => pool.available ? normalizeDigest(pool.imageDigest) : null)
+      .find((digest): digest is string => digest !== null) ?? null;
+    if (!pinnedDigest) return hold(input, null, 'no available pool has a valid image digest');
+  }
+
+  const excludedPools = pools.filter((pool) => !pool.available || normalizeDigest(pool.imageDigest) !== pinnedDigest)
+    .map((pool) => pool.id);
+  const eligiblePools = pools.filter((pool) => pool.available && normalizeDigest(pool.imageDigest) === pinnedDigest);
+  if (!eligiblePools.length) return hold(input, pinnedDigest, 'no available pool has the pinned digest', excludedPools);
+
+  const receipts = input.receipts ?? [];
+  const shardIds = new Set(validShards.map((shard) => shard.id));
+  if (receipts.some((receipt) => !shardIds.has(receipt.shardId))
+    || new Set(receipts.map((receipt) => receipt.shardId)).size !== receipts.length)
+    return hold(input, pinnedDigest, 'receipt inventory does not match the shard plan', excludedPools);
+
+  const receiptByShard = new Map(receipts.map((receipt) => [receipt.shardId, receipt]));
+  const completedReceipts = input.phase === 'resume' ? receipts.filter((receipt) => receipt.status === 'complete') : [];
+  const mismatchedCompleteDigest = completedReceipts.some((receipt) => normalizeDigest(receipt.imageDigest) !== pinnedDigest);
+  const missingCompletePool = completedReceipts.some((receipt) => !validPoolIdentity(receipt.pool));
+  const mixedCompleteReceipt = mismatchedCompleteDigest || missingCompletePool;
+  const fullSweep = input.phase === 'start' || mixedCompleteReceipt
+    || !validShards.some((shard) => receiptByShard.get(shard.id)?.status === 'complete');
+  const mode: StickyGatePlan['mode'] = fullSweep ? 'full' : 'partial';
+  const shards: StickyGateShardAction[] = [];
+  let nextPool = 0;
+  for (const shard of validShards) {
+    const receipt = receiptByShard.get(shard.id);
+    const canReuse = input.phase === 'resume' && !fullSweep && receipt?.status === 'complete'
+      && normalizeDigest(receipt.imageDigest) === pinnedDigest && validPoolIdentity(receipt.pool);
+    if (canReuse) {
+      shards.push({ shardId: shard.id, files: [...shard.files], kind: 'reuse', pool: receipt.pool ?? undefined, imageDigest: pinnedDigest });
+      continue;
+    }
+    const pool = eligiblePools[nextPool++ % eligiblePools.length]!;
+    shards.push({ shardId: shard.id, files: [...shard.files], kind: 'run', pool: pool.id, imageDigest: pinnedDigest });
+  }
+
+  return { mode, pinnedDigest, excludedPools, shards,
+    ...(mixedCompleteReceipt ? { reason: mismatchedCompleteDigest
+      ? 'completed receipts contain a different image digest' : 'completed receipt is missing pool identity' } : {}) };
+}

package/scripts/release-loop/gate-radius-live.ts

@@ -5,9 +5,10 @@ import { join } from 'node:path';
 import { changedFilesBetween, planPartialRegate, testFileOfId, type PartialPlan } from './gate-partial.js';
 import { CODE_FILE, gitClosureTree, testsReachingChanged } from './gate-closure.js';
 import { versionOnlyBumps } from './gate-radius-shadow.js';
-import { gateAssignableTestsAtCommit, gateBaselineReceipt, type GateBaselineReceipt } from './gate-baseline-receipt.js';
-import { parsePodPool, remoteImageId } from '../../src/task-orchestrator/surfaces/pod-pool.js';
+import { gateAssignableTestsAtCommit, gateBaselineReceipt, gateEnvFingerprint, type GateBaselineReceipt, type GatePodRuntimeIdentity } from './gate-baseline-receipt.js';
+import { defaultRemoteRun, NODE_REGISTRY, parsePodPool } from '../../src/task-orchestrator/surfaces/pod-pool.js';
 import { podCommandImageFor } from '../../src/task-orchestrator/surfaces/pod-command-job.js';
+import { gateTestBaseline } from '../lib/gate-test-env.js';
 import { SPAWN_SYNC_MAX_BUFFER } from '../../src/util/spawn-sync-output.js';
 
 const SHA = /^[0-9a-f]{40}$/i;
@@ -27,18 +28,91 @@ export function hardRehearsalGateArgs(version: string, runId: string, commit: st
 
 export interface LiveRadiusDecision { plan: PartialPlan | null; reason: string; rehearsalRunId?: string }
 
-/** Read the image ID on every candidate host before deciding. A later Job must still prove its actual image. */
-export function preflightGateImageDigest(pool: string): string | null {
+export interface GatePodExecutionIdentity extends GatePodRuntimeIdentity { imageDigest: string }
+
+const shellQuote = (value: string) => `'${value.replace(/'/g, `'\\''`)}'`;
+
+/** Registry v2 manifest digest is the identity Kubernetes reports in containerStatuses.imageID. */
+export function parseGateRepoDigestResponse(headers: string): string | null {
+  const match = /^docker-content-digest:\s*(sha256:[0-9a-f]{64})\s*$/im.exec(headers);
+  return match?.[1]?.toLowerCase() ?? null;
+}
+
+export interface GateRepoDigestProbeRequest { url: string; acceptHeader: string; command: string }
+
+export function gateRepoDigestProbeRequest(registry: string, image: string, commit: string): GateRepoDigestProbeRequest | null {
+  const port = /:(\d+)$/.exec(registry)?.[1];
+  if (!port || !SHA.test(commit)) return null;
+  const imageName = image.startsWith('elanous-harness-lite:') ? 'elanous-harness-lite' : 'elanous-harness';
+  const tag = commit.slice(0, 12);
+  const url = `http://localhost:${port}/v2/${imageName}/manifests/${tag}`;
+  const accept = 'application/vnd.oci.image.index.v1+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.docker.distribution.manifest.v2+json';
+  const acceptHeader = `Accept: ${accept}`;
+  return { url, acceptHeader, command: `curl -fsS --max-time 8 -D - -o /dev/null -H ${shellQuote(acceptHeader)} ${shellQuote(url)}` };
+}
+
+function probeGateRepoDigest(member: ReturnType<typeof parsePodPool>[number], image: string, commit: string): string | null {
+  const registry = member.registry ?? NODE_REGISTRY;
+  const request = gateRepoDigestProbeRequest(registry, image, commit);
+  if (!request) return null;
+  const result = member.sshHost
+    ? defaultRemoteRun(member.sshHost, request.command)
+    : spawnSync('curl', ['-fsS', '--max-time', '8', '-D', '-', '-o', '/dev/null', '-H', request.acceptHeader, request.url],
+      { encoding: 'utf8', timeout: 10_000, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
+  return result.status === 0 ? parseGateRepoDigestResponse(result.stdout) : null;
+}
+
+function gateRegistryHostImage(member: ReturnType<typeof parsePodPool>[number], image: string, commit: string): string | null {
+  const registry = member.registry ?? NODE_REGISTRY;
+  const port = /:(\d+)$/.exec(registry)?.[1];
+  if (!port) return null;
+  const imageName = image.startsWith('elanous-harness-lite:') ? 'elanous-harness-lite' : 'elanous-harness';
+  return `localhost:${port}/${imageName}:${commit.slice(0, 12)}`;
+}
+
+/** Read the immutable pushed image manifest on every candidate host. Local Docker Image IDs are diagnostic only. */
+export function preflightGateImageDigest(pool: string, commit?: string): string | null {
+  try {
+    if (!commit || !SHA.test(commit)) return null;
+    const image = podCommandImageFor([], true);
+    const members = parsePodPool(pool);
+    if (!members.length) return null;
+    const digests = members.map((member) => probeGateRepoDigest(member, image, commit));
+    return digests.every((digest) => digest && DIGEST.test(digest) && digest === digests[0]) ? digests[0]! : null;
+  } catch { return null; }
+}
+
+/** Probe each candidate's exact gate image/runtime and deterministic environment without a Kubernetes Job. */
+export function preflightGateExecutionIdentity(pool: string, env: NodeJS.ProcessEnv, commit?: string): GatePodExecutionIdentity | null {
   try {
+    if (!commit || !SHA.test(commit)) return null;
     const image = podCommandImageFor([], true);
     const members = parsePodPool(pool);
     if (!members.length) return null;
-    const ids = members.map((member) => {
-      if (member.sshHost) return remoteImageId(member, image);
-      const result = spawnSync('docker', ['image', 'inspect', image, '--format', '{{.Id}}'], { encoding: 'utf8', timeout: 30_000, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
-      return result.status === 0 ? result.stdout.trim() : null;
+    const baseline = gateTestBaseline(env);
+    const expectedEnvFingerprint = gateEnvFingerprint(env);
+    const script = "const {createHash}=require('node:crypto');const keys=['ELANOUS_TEST_FAKE_LLM','LANG','LC_ALL','TZ'];const e=Object.fromEntries(keys.sort().map(k=>[k,process.env[k]??'']));const envFingerprint=createHash('sha256').update(JSON.stringify(e)).digest('hex');console.log(JSON.stringify({bunVersion:Bun.version,platform:process.platform,architecture:process.arch,envFingerprint}));";
+    const rows = members.map((member): GatePodExecutionIdentity | null => {
+      const imageDigest = probeGateRepoDigest(member, image, commit);
+      if (!imageDigest || !DIGEST.test(imageDigest)) return null;
+      const hostImage = gateRegistryHostImage(member, image, commit);
+      if (!hostImage) return null;
+      const args = ['run', '--rm', '--pull=never', '--network=none', ...Object.entries(baseline).flatMap(([key, value]) => ['-e', `${key}=${value}`]), '--entrypoint', 'bun', hostImage, '-e', script];
+      const result = member.sshHost
+        ? defaultRemoteRun(member.sshHost, `docker ${args.map(shellQuote).join(' ')}`)
+        : spawnSync('docker', args, { encoding: 'utf8', timeout: 30_000, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
+      if (result.status !== 0) return null;
+      try {
+        const row = JSON.parse(result.stdout.trim()) as Partial<GatePodRuntimeIdentity>;
+        if (typeof row.bunVersion !== 'string' || typeof row.platform !== 'string' || typeof row.architecture !== 'string'
+          || row.envFingerprint !== expectedEnvFingerprint) return null;
+        return { imageDigest, bunVersion: row.bunVersion, platform: row.platform, architecture: row.architecture,
+          envFingerprint: row.envFingerprint };
+      } catch { return null; }
     });
-    return ids.every((id) => id && DIGEST.test(id) && id === ids[0]) ? ids[0]! : null;
+    if (rows.some((row) => row === null)) return null;
+    const first = rows[0]!;
+    return rows.every((row) => JSON.stringify(row) === JSON.stringify(first)) ? first : null;
   } catch { return null; }
 }
 
@@ -82,10 +156,15 @@ export function partialGateImagesMatch(root: string, version: string, digest: st
 /** Every missing or mismatched proof returns a full gate. The caller uses this only when no explicit resume plan exists. */
 export function planHardRehearsalRadius(input: { root: string; repo: string; version: string; forCommit: string;
   graphPins: { graphSha: string; recipeSha: string } | null; envFingerprint: string;
-  imageDigest: string | null }): LiveRadiusDecision {
+  imageDigest: string | null; executionIdentity: GatePodExecutionIdentity | null }): LiveRadiusDecision {
   const full = (reason: string): LiveRadiusDecision => ({ plan: null, reason });
   if (!/^\d+\.\d+\.\d+$/.test(input.version) || !SHA.test(input.forCommit)) return full('invalid release identity');
-  if (!input.graphPins || !/^[0-9a-f]{64}$/i.test(input.envFingerprint) || !input.imageDigest || !DIGEST.test(input.imageDigest))
+  if (!input.graphPins || !/^[0-9a-f]{64}$/i.test(input.envFingerprint) || !input.imageDigest || !DIGEST.test(input.imageDigest)
+    || !input.executionIdentity || input.executionIdentity.imageDigest !== input.imageDigest.toLowerCase()
+    || input.executionIdentity.envFingerprint !== input.envFingerprint
+    || !/^\d+\.\d+\.\d+(?:[-+][\w.-]+)?$/.test(input.executionIdentity.bunVersion)
+    || !/^[a-z0-9_-]{1,32}$/.test(input.executionIdentity.platform)
+    || !/^[a-z0-9_-]{1,32}$/.test(input.executionIdentity.architecture))
     return full('current graph, environment or Pod image identity unmeasured');
   try {
     const stamps = ['hard-5h', 'hard-mid'].map((step) => {
@@ -118,14 +197,19 @@ export function planHardRehearsalRadius(input: { root: string; repo: string; ver
       if (verdict.commit !== stamp.sha || verdict.outcome !== 'ok' || failures.commit !== stamp.sha
         || !Array.isArray(failures.failures) || failures.failures.length !== 0
         || !Array.isArray(failures.errors) || failures.errors.length !== 0
-        || !receipt || receipt.schema !== 1 || !receipt.valid || receipt.version !== gateVersion || receipt.commit !== stamp.sha
+        || !receipt || receipt.schema !== 2 || !receipt.valid || receipt.version !== gateVersion || receipt.commit !== stamp.sha
         || receipt.graphSha !== input.graphPins.graphSha || receipt.recipeSha !== input.graphPins.recipeSha
         || receipt.envFingerprint !== input.envFingerprint || receipt.imageDigest !== input.imageDigest.toLowerCase()
+        || !receipt.executionIdentity
+        || JSON.stringify(receipt.executionIdentity) !== JSON.stringify({ bunVersion: input.executionIdentity.bunVersion,
+          platform: input.executionIdentity.platform, architecture: input.executionIdentity.architecture,
+          envFingerprint: input.executionIdentity.envFingerprint })
         || !Number.isSafeInteger(receipt.files) || receipt.files < 1 || !Number.isSafeInteger(receipt.shards) || receipt.shards < 1)
         return full('hard rehearsal receipt or current execution identity differs');
       const recomputed = gateBaselineReceipt({ root: input.root, version: gateVersion, commit: stamp.sha,
         fullSweep: true, graphPins: input.graphPins, envFingerprint: input.envFingerprint });
-      if (!recomputed.valid || recomputed.imageDigest !== receipt.imageDigest || recomputed.files !== receipt.files
+      if (!recomputed.valid || recomputed.imageDigest !== receipt.imageDigest
+        || JSON.stringify(recomputed.executionIdentity) !== JSON.stringify(receipt.executionIdentity) || recomputed.files !== receipt.files
         || recomputed.shards !== receipt.shards) return full(`hard rehearsal Pod proof differs: ${recomputed.reason}`);
       const ancestor = spawnSync('git', ['merge-base', '--is-ancestor', stamp.sha, input.forCommit], { cwd: input.repo, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
       if (ancestor.status !== 0 || ancestor.error) return full('hard rehearsal commit is not an ancestor');

package/scripts/release-loop/gate-shard-dispatch.ts

@@ -29,6 +29,49 @@ export interface GateShardHost {
   reserved: boolean;
 }
 
+export type GateProgressState = 'pending' | 'running' | 'done' | 'failed' | 'timeout' | 'unmeasured';
+
+/** A host group or planned Pod shard as seen by the release gate's live progress observer. */
+export interface GateProgressGroup {
+  id: string;
+  state: GateProgressState;
+  host?: string;
+  startedAtMs?: number;
+  endedAtMs?: number;
+}
+
+export interface GateProgressSummary {
+  executor: 'host' | 'pod';
+  host: string | null;
+  completed: number;
+  total: number;
+  failed: number;
+  groups: Array<{ id: string; state: GateProgressState; host: string | null; elapsedMs: number | null }>;
+}
+
+/** Keep the progress event shape identical for serial host groups and parallel Pod shards. */
+export function summarizeGateProgress(input: {
+  executor: 'host' | 'pod';
+  groups: readonly GateProgressGroup[];
+  nowMs: number;
+}): GateProgressSummary {
+  const terminal = new Set<GateProgressState>(['done', 'failed', 'timeout', 'unmeasured']);
+  const hosts = [...new Set(input.groups.flatMap((group) => group.host?.trim() ? [group.host.trim()] : []))].sort();
+  return {
+    executor: input.executor,
+    host: hosts.length ? hosts.join(',') : null,
+    completed: input.groups.filter((group) => terminal.has(group.state)).length,
+    total: input.groups.length,
+    failed: input.groups.filter((group) => group.state === 'failed' || group.state === 'timeout').length,
+    groups: input.groups.map((group) => {
+      const end = group.endedAtMs ?? input.nowMs;
+      const elapsedMs = Number.isFinite(group.startedAtMs) && Number.isFinite(end)
+        ? Math.max(0, end - group.startedAtMs!) : null;
+      return { id: group.id, state: group.state, host: group.host?.trim() || null, elapsedMs };
+    }),
+  };
+}
+
 export interface GateShardDispatchInput {
   head40: string;
   base40: string;

package/scripts/release-loop/gate-shard-load-flaky.ts

@@ -0,0 +1,256 @@
+#!/usr/bin/env bun
+import { readFileSync, writeFileSync } from 'node:fs';
+
+function decodeXml(value: string): string {
+  return value.replace(/&quot;/g, '"').replace(/&apos;/g, "'").replace(/&lt;/g, '<')
+    .replace(/&gt;/g, '>').replace(/&amp;/g, '&');
+}
+
+/** Remove legal comments and reduce CDATA before tag parsing, without accepting markup inside tags. */
+function stripCommentsAndCdata(xml: string): string | null {
+  let source = '';
+  let inMarkup = false;
+  let quote: '"' | "'" | undefined;
+  const offset = xml.startsWith('\uFEFF') ? 1 : 0;
+  for (let index = offset; index < xml.length;) {
+    if (xml.startsWith('<!--', index)) {
+      if (inMarkup) return null;
+      const end = xml.indexOf('-->', index + 4);
+      if (end < 0 || xml.slice(index + 4, end).includes('--')) return null;
+      index = end + 3;
+      continue;
+    }
+    if (xml.startsWith('<?', index)) {
+      const end = xml.indexOf('?>', index + 2);
+      if (inMarkup || index !== offset || end < 0) return null;
+      const declaration = xml.slice(index, end + 2);
+      if (!/^<\?xml\s+version=["']1\.0["'](?:\s+encoding=["'][A-Za-z][A-Za-z0-9._-]*["'])?(?:\s+standalone=["'](?:yes|no)["'])?\s*\?>$/.test(declaration)) return null;
+      index = end + 2;
+      continue;
+    }
+    if (xml.startsWith('<![CDATA[', index)) {
+      if (inMarkup) return null;
+      const end = xml.indexOf(']]>', index + 9);
+      if (end < 0) return null;
+      source += xml.slice(index + 9, end).trim() ? '__CDATA_TEXT__' : ' ';
+      index = end + 3;
+      continue;
+    }
+    const character = xml[index]!;
+    if (inMarkup) {
+      if (quote) {
+        if (character === quote) quote = undefined;
+        else if (character === '<') return null;
+      } else if (character === '"' || character === "'") quote = character;
+      else if (character === '>') inMarkup = false;
+      else if (character === '<') return null;
+    } else if (character === '<') inMarkup = true;
+    source += character;
+    index++;
+  }
+  return source;
+}
+
+type JunitCase = { file?: string; id?: string; failures: number; errors: number; skipped: number };
+type JunitDocument = { cases: JunitCase[]; suiteFailed: boolean; unattributedSuiteFailure: boolean };
+function parseJunit(xml: string): JunitDocument | null {
+  if (/<!DOCTYPE/i.test(xml)) return null;
+  for (const character of xml) {
+    const codepoint = character.codePointAt(0)!;
+    const xml10Character = codepoint === 0x9 || codepoint === 0xa || codepoint === 0xd
+      || (codepoint >= 0x20 && codepoint <= 0xd7ff) || (codepoint >= 0xe000 && codepoint <= 0xfffd)
+      || (codepoint >= 0x10000 && codepoint <= 0x10ffff);
+    if (!xml10Character) return null;
+  }
+  const source = stripCommentsAndCdata(xml);
+  if (source === null) return null;
+  if (/<\?|\?>/.test(source)) return null;
+  if (/<!--|-->|<!\[CDATA\[|\]\]>/.test(source)) return null;
+  const stack: Array<{
+    name: string;
+    file?: string;
+    suiteTitle?: string;
+    declaredTests?: number;
+    declaredFailures?: number;
+    declaredErrors?: number;
+    testCount: number;
+    caseStart: number;
+  }> = [];
+  const cases: JunitCase[] = [];
+  let roots = 0;
+  let sawSuite = false;
+  let suiteFailed = false;
+  let unattributedSuiteFailure = false;
+  let rootName: string | undefined;
+  let cursor = 0;
+  if (/&(?!(?:amp|lt|gt|quot|apos|#\d+|#x[\da-f]+);)/i.test(source)) return null;
+  for (const entity of source.matchAll(/&#(x[\da-f]+|\d+);/gi)) {
+    const codepoint = entity[1]!.startsWith('x') ? Number.parseInt(entity[1]!.slice(1), 16) : Number.parseInt(entity[1]!, 10);
+    const xml10Character = codepoint === 0x9 || codepoint === 0xa || codepoint === 0xd
+      || (codepoint >= 0x20 && codepoint <= 0xd7ff) || (codepoint >= 0xe000 && codepoint <= 0xfffd)
+      || (codepoint >= 0x10000 && codepoint <= 0x10ffff);
+    if (!Number.isInteger(codepoint) || !xml10Character) return null;
+  }
+  for (const match of source.matchAll(/<([^<>]+)>/g)) {
+    const between = source.slice(cursor, match.index);
+    if (between.includes('<') || between.includes(']]>') || (!stack.length && between.trim())) return null;
+    cursor = match.index! + match[0].length;
+    const body = match[1]!.trim();
+    // Comments and CDATA have already been stripped above, and the one XML declaration was
+    // removed before tokenization. Every other declaration is unsupported and invalid here.
+    if (!body || body.startsWith('!')) return null;
+    const close = body.startsWith('/');
+    const selfClose = body.endsWith('/');
+    const tagMatch = /^\/?([A-Za-z_:][\w:.-]*)/.exec(body);
+    if (!tagMatch) return null;
+    const name = tagMatch[1]!;
+    const attrsText = body.slice(tagMatch[0].length, body.length - (selfClose ? 1 : 0));
+    const attrs: Record<string, string> = {};
+    const attrPattern = /([A-Za-z_:][\w:.-]*)\s*=\s*(?:"([^"]*)"|'([^']*)')/g;
+    for (const attr of attrsText.matchAll(attrPattern)) {
+      if (attrs[attr[1]!] !== undefined) return null;
+      attrs[attr[1]!] = decodeXml(attr[2] ?? attr[3] ?? '');
+    }
+    if (!close && attrsText.replace(attrPattern, '').trim()) return null;
+    if (close && attrsText.trim()) return null;
+    if (close) {
+      if (selfClose) return null;
+      const closed = stack.pop();
+      if (!closed || closed.name !== name || (closed.declaredTests !== undefined && closed.declaredTests !== closed.testCount)) return null;
+      if (closed.declaredFailures !== undefined
+        && closed.declaredFailures !== cases.slice(closed.caseStart).reduce((count, testcase) => count + testcase.failures, 0)) return null;
+      if (closed.declaredErrors !== undefined
+        && closed.declaredErrors !== cases.slice(closed.caseStart).reduce((count, testcase) => count + testcase.errors, 0)) return null;
+      continue;
+    }
+    if (name === 'testcase' && stack.at(-1)?.name !== 'testsuite') return null;
+    if ((name === 'failure' || name === 'error') && stack.at(-1)?.name !== 'testcase') return null;
+    if (!stack.length) { roots++; rootName = name; }
+    let file = attrs.file;
+    let declaredTests: number | undefined;
+    let declaredFailures: number | undefined;
+    let declaredErrors: number | undefined;
+    if ((name === 'testsuite' || name === 'testsuites') && attrs.tests !== undefined) {
+      declaredTests = Number(attrs.tests);
+      if (!Number.isSafeInteger(declaredTests) || declaredTests < 0) return null;
+    }
+    if (name === 'testsuite' || name === 'testsuites') {
+      for (const [attribute, set] of [['failures', (value: number) => { declaredFailures = value; }], ['errors', (value: number) => { declaredErrors = value; }]] as const) {
+        const count = attrs[attribute];
+        if (count === undefined) continue;
+        if (!/^\d+$/.test(count) || !Number.isSafeInteger(Number(count))) return null;
+        set(Number(count));
+      }
+    }
+    if (name === 'testsuite') {
+      file ??= attrs.name;
+      sawSuite = true;
+      if ((declaredFailures ?? 0) > 0 || (declaredErrors ?? 0) > 0) suiteFailed = true;
+      const inherited = [...stack].reverse().find((entry) => entry.name === 'testsuite')?.file;
+      if (!file && inherited) file = inherited;
+    } else {
+      const inherited = [...stack].reverse().find((entry) => entry.name === 'testsuite')?.file;
+      if (!file && inherited) file = inherited;
+      if (name === 'testsuites' && ((declaredFailures ?? 0) > 0 || (declaredErrors ?? 0) > 0)) suiteFailed = true;
+    }
+    if (name === 'testcase') {
+      for (const ancestor of stack) if (ancestor.name === 'testsuite' || ancestor.name === 'testsuites') ancestor.testCount++;
+      const suiteEntries = stack.filter((entry) => entry.name === 'testsuite');
+      // Some JUnit writers repeat the file path as the outer suite name. Keep the
+      // remaining hierarchy so sibling suites with the same testcase name stay distinct.
+      const identitySuites = suiteEntries[0]?.suiteTitle === file ? suiteEntries.slice(1) : suiteEntries;
+      const suiteNames = identitySuites.map((entry) => entry.suiteTitle ?? '').filter(Boolean);
+      const testcaseName = attrs.name;
+      const idName = [...suiteNames, ...(testcaseName ? [testcaseName] : [])].filter(Boolean).join(' > ');
+      cases.push({ file, ...(file && idName ? { id: `${file} > ${idName}` } : {}), failures: 0, errors: 0, skipped: 0 });
+    }
+    if (name === 'failure' || name === 'error' || name === 'skipped') {
+      if (stack.some((entry) => entry.name === 'testcase')) {
+        const current = cases.at(-1);
+        if (current) current[name === 'failure' ? 'failures' : name === 'error' ? 'errors' : 'skipped']++;
+      } else if (stack.some((entry) => entry.name === 'testsuite')) { suiteFailed = true; unattributedSuiteFailure = true; }
+    }
+    if (!selfClose) stack.push({ name, file, ...(name === 'testsuite' && attrs.name ? { suiteTitle: attrs.name } : {}), ...(declaredTests !== undefined ? { declaredTests } : {}),
+      ...(declaredFailures !== undefined ? { declaredFailures } : {}), ...(declaredErrors !== undefined ? { declaredErrors } : {}),
+      testCount: 0, caseStart: cases.length });
+    else if ((declaredTests !== undefined && declaredTests !== 0) || (declaredFailures !== undefined && declaredFailures !== 0)
+      || (declaredErrors !== undefined && declaredErrors !== 0)) return null;
+  }
+  const trailingText = source.slice(cursor);
+  if (trailingText.includes('<') || trailingText.includes(']]>') || trailingText.trim() || stack.length || roots !== 1
+    || !['testsuite', 'testsuites'].includes(rootName ?? '') || !sawSuite || cases.length === 0) return null;
+  return { cases, suiteFailed, unattributedSuiteFailure };
+}
+
+/** A null count means the XML was malformed or incomplete. */
+export function junitTestcaseCount(xml: string): number | null {
+  return parseJunit(xml)?.cases.length ?? null;
+}
+
+/** Unique file attribution for every testcase; null means malformed, incomplete, or unattributed evidence. */
+export function junitTestcaseFiles(xml: string): string[] | null {
+  const parsed = parseJunit(xml);
+  if (!parsed || parsed.unattributedSuiteFailure || parsed.cases.some((testcase) => !testcase.file)) return null;
+  return [...new Set(parsed.cases.map((testcase) => testcase.file!))].sort();
+}
+
+/** Named failing/error cases, preserving duplicate identities so a retry must rerun each occurrence. */
+export function junitFailedCaseIds(xml: string): string[] | null {
+  const parsed = parseJunit(xml);
+  if (!parsed || parsed.unattributedSuiteFailure) return null;
+  const failed = parsed.cases.filter((testcase) => testcase.failures > 0 || testcase.errors > 0);
+  if (failed.some((testcase) => !testcase.id)) return null;
+  const identityCounts = new Map<string, number>();
+  for (const testcase of parsed.cases) if (testcase.id) identityCounts.set(testcase.id, (identityCounts.get(testcase.id) ?? 0) + 1);
+  // A duplicate testcase identity cannot show which occurrence failed. Treat it as
+  // ambiguous evidence instead of allowing a passing sibling to clear the failure.
+  if (failed.some((testcase) => identityCounts.get(testcase.id!)! > 1)) return null;
+  return failed.map((testcase) => testcase.id!).sort();
+}
+
+/** Named cases that completed without failure, error, or skip. */
+export function junitPassedCaseIds(xml: string): string[] | null {
+  const parsed = parseJunit(xml);
+  if (!parsed) return null;
+  return parsed.cases.flatMap((testcase) => testcase.id && !testcase.failures && !testcase.errors && !testcase.skipped ? [testcase.id] : []).sort();
+}
+
+/** Attribute files for testcases that have a failure/error node; malformed XML returns null (fail closed). */
+export function failedJunitFiles(xml: string, allowed: readonly string[]): string[] | null {
+  const allow = new Set(allowed);
+  const parsed = parseJunit(xml);
+  if (!parsed || parsed.unattributedSuiteFailure || parsed.cases.some((testcase) => !testcase.file || !allow.has(testcase.file))) return null;
+  return [...new Set(parsed.cases.filter((testcase) => testcase.failures > 0 || testcase.errors > 0).map((testcase) => testcase.file!))].sort();
+}
+
+interface RetryVerdict { clean: boolean; tests: number; failures: number; errors: number; }
+export function cleanRetryVerdict(rc: number | undefined, log: string | undefined, junit: string | undefined, file: string, expectedFailureIds?: readonly string[]): RetryVerdict {
+  const summary = log?.match(/Ran (\d+) tests? across ([1-9]\d*) files?\.?/);
+  const pass = Number(log?.match(/^\s*(\d+)\s+pass\s*$/m)?.[1] ?? NaN);
+  const failures = Number(log?.match(/^\s*(\d+)\s+fail\s*$/m)?.[1] ?? NaN);
+  const errors = Number(log?.match(/^\s*(\d+)\s+errors?\s*$/m)?.[1] ?? 0);
+  const tests = Number(summary?.[1] ?? 0);
+  const parsed = junit ? parseJunit(junit) : null;
+  const cases = parsed?.cases;
+  const exactFile = cases?.every((testcase) => testcase.file === file) ?? false;
+  const hasFailure = parsed?.suiteFailed || (cases?.some((testcase) => testcase.failures > 0 || testcase.errors > 0 || testcase.skipped > 0) ?? true);
+  const rerunIds = junitPassedCaseIds(junit ?? '') ?? [];
+  const rerunCounts = new Map<string, number>();
+  for (const id of rerunIds) rerunCounts.set(id, (rerunCounts.get(id) ?? 0) + 1);
+  const expectedCounts = new Map<string, number>();
+  for (const id of expectedFailureIds ?? []) expectedCounts.set(id, (expectedCounts.get(id) ?? 0) + 1);
+  const reranOriginalFailures = expectedFailureIds === undefined
+    || (expectedFailureIds.length > 0 && [...expectedCounts].every(([id, count]) => (rerunCounts.get(id) ?? 0) >= count));
+  const clean = rc === 0 && tests > 0 && Number(summary?.[2]) === 1 && pass === tests && failures === 0 && errors === 0
+    && cases?.length === tests && exactFile && !hasFailure && reranOriginalFailures && !/^# Unhandled error between tests/m.test(log ?? '');
+  return { clean, tests, failures: Number.isFinite(failures) ? failures : -1, errors: Number.isFinite(errors) ? errors : -1 };
+}
+
+if (import.meta.main) {
+  const [xmlPath, outputPath, manifestPath] = process.argv.slice(2);
+  if (!xmlPath || !outputPath || !manifestPath) process.exit(2);
+  let result: string[] | null = null;
+  try { result = failedJunitFiles(readFileSync(xmlPath, 'utf8'), readFileSync(manifestPath, 'utf8').split(/\r?\n/).filter(Boolean)); } catch { /* fail closed */ }
+  if (!result) process.exit(1);
+  writeFileSync(outputPath, result.length ? `${result.join('\n')}\n` : '');
+}