faberun 0.25.0 → 0.26.0

package/src/repo/source-identity.mjs

@@ -112,7 +112,9 @@ function validateHashMap(value, label) {
 }
 /**
  * The pathspec that scopes a source-identity read: everything, minus the
- * factory's own run tree, minus the machine-managed AGENTS.md signal, minus
+ * factory's own run tree, minus `AGENTS.md` (whose managed signal block git
+ * cannot tell apart from a human edit; `agentGuidanceDirty` and
+ * `agentGuidanceIdentity` check its content directly instead), minus
  * whatever the caller declared out of scope.
  *
  * @param {{ignorePaths?: string[], ignoreRoots?: string[]}} options
@@ -180,9 +182,14 @@ function resolveGitHead(cwd, baseRef) {
 
 /**
  * The paths the working tree has modified, added or left untracked, ignoring
- * the factory's own `.runs` tree and the machine-managed AGENTS.md signal. A
- * clean tree is `[]`; an unreadable tree is treated as clean because the
- * caller has no dirt to name.
+ * the factory's own `.runs` tree. `AGENTS.md` is git-excluded from that scan
+ * (its managed block would otherwise flag every launch) and checked on its
+ * own instead: it counts as dirty exactly when its content differs from
+ * `gitHead`'s once both are normalized with `normalizeManagedSignalBlock`, so
+ * a human edit outside the block is refused — including one that sits
+ * alongside a block change in the same file (R17) — while a block-only
+ * change is not. A clean tree is `[]`; an unreadable tree is treated as clean
+ * because the caller has no dirt to name.
  *
  * @param {string} cwd
  * @param {{ignorePaths?: string[], ignoreRoots?: string[]}} [options]
@@ -194,13 +201,46 @@ export function dirtyTreePaths(cwd, options = {}) {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"],
     }));
-    return status.split("\0").filter(Boolean);
+    const paths = status.split("\0").filter(Boolean);
+    if (agentGuidanceDirty(cwd, resolveGitHead(cwd, undefined))) paths.push("AGENTS.md");
+    return paths;
   } catch {
     // Not a repository, or git absent: there is no dirt the launch can name.
     return [];
   }
 }
 
+/**
+ * Whether `AGENTS.md` itself counts as a dirty path: its working-tree content
+ * differs from `gitHead`'s once both are normalized with
+ * `normalizeManagedSignalBlock`. A change confined to the managed block does
+ * not count, so the block the runner itself rewrites never blocks a launch;
+ * any other edit does. `gitHead` null (no commit to compare against) is never
+ * dirty.
+ *
+ * @param {string} cwd
+ * @param {string|null} gitHead
+ * @returns {boolean}
+ */
+function agentGuidanceDirty(cwd, gitHead) {
+  if (!gitHead) return false;
+  let working = null;
+  try { working = readFileSync(resolve(cwd, "AGENTS.md"), "utf8"); }
+  catch (error) { if (errorCode(error) !== "ENOENT") throw error; }
+  let committed = null;
+  try {
+    committed = String(gitSyncOrThrow(["-C", cwd, "show", `${gitHead}:AGENTS.md`], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+    }));
+  } catch {
+    // AGENTS.md does not exist at gitHead: committed stays null.
+  }
+  if (working === null && committed === null) return false;
+  const normalize = (/** @type {string|null} */ text) => (text === null ? null : normalizeManagedSignalBlock(text));
+  return normalize(working) !== normalize(committed);
+}
+
 /**
  * Refuse a launch whose base is the checked-out HEAD and whose tree is dirty.
  * The base is what every worktree is cut from, so a dirty tree only matters

package/src/repo/worktree-prune.mjs

@@ -0,0 +1,72 @@
+/**
+ * Releasing the attempt worktrees of runs whose work has already landed.
+ * `campaign close` releases a campaign's worktrees, but a long campaign
+ * integrates run after run long before it closes. Measured 2026-09-25 on
+ * `planner-and-routing`: 19 registered worktrees from five finished runs, all
+ * already merged into the campaign branch. Separate from `worktree.mjs`
+ * because deciding which runs are finished and integrated reads run state
+ * (`run/disk-gc.mjs`) and every branch of the repository, while `worktree.mjs`
+ * only acts on one run it is handed.
+ */
+import { basename, join } from "node:path";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
+import { SETTLED } from "../engine/prompts.mjs";
+import { describeRuns } from "../run/disk-gc.mjs";
+import { worktreeRoot } from "../run/paths.mjs";
+import { git, gitHead, releaseRunWorktrees, runRefName } from "./worktree.mjs";
+
+/** @typedef {{runId: string, removed: number, archived: string[]}} PrunedRun */
+
+/**
+ * Is the run's integrated head already on a branch of the operator's? An
+ * attempt branch (`refs/heads/faberun/…`) holds the run's own commits and
+ * does not count; a run with no run ref has nothing integrated to check.
+ *
+ * @param {string} repo
+ * @param {string} runId
+ * @returns {boolean}
+ */
+function runRefLanded(repo, runId) {
+  const ref = runRefName(runId);
+  if (!gitHead(repo, ref)) return false;
+  return git(repo, ["for-each-ref", "--contains", ref, "--format=%(refname)", "refs/heads"])
+    .split("\n")
+    .some((name) => name && !name.startsWith("refs/heads/faberun/"));
+}
+
+/**
+ * @param {string} runDir
+ * @returns {boolean}
+ */
+function allNodesSettled(runDir) {
+  const names = readdirSync(join(runDir, "nodes")).filter((name) => name.endsWith(".json"));
+  return names.length > 0 && names.every((name) => SETTLED.has(JSON.parse(readFileSync(join(runDir, "nodes", name), "utf8")).status));
+}
+
+/**
+ * Release the attempt worktrees of every run that no controller holds, whose
+ * nodes are all terminal, and whose run ref a local branch already contains.
+ * `releaseRunWorktrees` keeps each attempt's HEAD and uncommitted delta under
+ * `refs/faberun-archive/`, so a released attempt can still be recovered.
+ * `parked` also takes a run with a blocked or exhausted node: only on the
+ * operator's word, because a resume that re-judges an attempt reads its
+ * worktree, and only the operator knows the run was superseded.
+ *
+ * @param {string} repo
+ * @param {string} runsDir
+ * @param {{parked?: boolean}} [options]
+ * @returns {PrunedRun[]}
+ */
+export function pruneIntegratedRunWorktrees(repo, runsDir, options = {}) {
+  /** @type {PrunedRun[]} */
+  const pruned = [];
+  for (const run of describeRuns(runsDir)) {
+    if (run.hasActiveController) continue;
+    if (!run.allNodesTerminal && !(options.parked === true && allNodesSettled(run.path))) continue;
+    const runId = basename(run.path);
+    if (!existsSync(worktreeRoot(join(runsDir, runId), runId))) continue;
+    if (!runRefLanded(repo, runId)) continue;
+    pruned.push({ runId, ...releaseRunWorktrees(repo, join(runsDir, runId), runId) });
+  }
+  return pruned;
+}

package/src/report/campaign-brief-estimate.mjs

@@ -20,7 +20,7 @@
  */
 import { collectCompletedExecutionNodes } from "../run/usage.mjs";
 import { asArray, unique } from "../campaign/brief-text.mjs";
-import { scheduleUnderCapacity } from "../campaign/campaign-brief.mjs";
+import { scheduleUnderCapacity } from "../campaign/campaign-brief-graph.mjs";
 
 /** @typedef {import("../run/usage.mjs").CompletedExecutionNode} CompletedExecutionNode */
 /** @typedef {import("../run/usage.mjs").CompletedExecutionPool} CompletedExecutionPool */

package/src/report/campaign-brief.mjs

@@ -231,6 +231,7 @@ function renderWorkGraph(model) {
   const concurrent = Object.entries(graph.maxConcurrent)
     .map(([runtimeId, limit]) => `\`${runtimeId}\` ${limit}`)
     .join(", ");
+  const sameProviderReview = graph.nodes.filter((node) => node.sameProviderReview).map((node) => `\`${node.id}\``);
   return [
     "## Work graph",
     ...edgeLines,
@@ -240,6 +241,9 @@ function renderWorkGraph(model) {
     `- maxConcurrent: ${concurrent || "none"}`,
     `- Effective concurrency: ${graph.effectiveConcurrency}`,
     `- ${renderDispatchable(graph)}`,
+    // R20: same-vendor mode admits a worker/judge pair sharing a vendor, and
+    // every human-facing surface names which nodes that applies to.
+    `- Same-provider review: ${sameProviderReview.length > 0 ? sameProviderReview.join(", ") : "none"}`,
   ].join("\n");
 }
 

package/src/report/metrics-report.mjs

@@ -41,7 +41,7 @@ const HOURS_PRECISION = 10_000;
 export function renderMetricsReport(sources, metrics) {
   const missingSources = sources.missingSources ?? [];
   const lines = [
-    `[metrics] ${sources.campaignId} · ${sources.runIds.length} runs · ${sources.events.length} events · ${Object.keys(metrics).length} indicators`,
+    `[metrics] ${sources.campaignId} · ${sources.runIds.length} runs · ${sources.events.length} events · ${Object.keys(metrics).length} indicators · ${sameProviderReviewSummary(sources)}`,
   ];
   if (missingSources.length > 0) lines.push(`missing sources: ${missingSources.join(", ")}`);
   for (const [name, indicator] of Object.entries(metrics)) {
@@ -78,10 +78,43 @@ export function renderMetricsJson(sources, metrics) {
     runs: sources.runIds.length,
     events: sources.events.length,
     missingSources,
+    sameProviderReviewNodeCount: sameProviderReviewNodeIds(sources).length,
+    sameProviderReviewNodeIds: sameProviderReviewNodeIds(sources),
     indicators: metrics,
   })}\n`;
 }
 
+/**
+ * Which recorded nodes had their judge review the same vendor's own output
+ * under same-vendor mode (R20), `runId/id` so a node id repeated across runs
+ * still names a specific one — metadata about the sources, like `runs` and
+ * `events`, not a TECH-SPEC section 6 indicator, so it sits beside the
+ * indicator set rather than inside it.
+ *
+ * @param {MetricsSources} sources
+ * @returns {string[]}
+ */
+function sameProviderReviewNodeIds(sources) {
+  return (sources.nodes ?? [])
+    .filter((node) => node.sameProviderReview === true)
+    .map((node) => `${node.runId}/${node.id}`);
+}
+
+/**
+ * The bounded human summary of `sameProviderReviewNodeIds`, eliding past
+ * `MAX_GROUPS` like every other grouped indicator this report prints.
+ *
+ * @param {MetricsSources} sources
+ * @returns {string}
+ */
+function sameProviderReviewSummary(sources) {
+  const ids = sameProviderReviewNodeIds(sources);
+  if (ids.length === 0) return "0 same-provider review nodes";
+  const shown = ids.slice(0, MAX_GROUPS);
+  const elided = ids.length > shown.length ? `, +${ids.length - shown.length} more` : "";
+  return `${ids.length} same-provider review nodes (${shown.join(", ")}${elided})`;
+}
+
 /**
  * @param {string} name
  * @param {number|Record<string, number>|null} value

package/src/report/render.mjs

@@ -5,6 +5,7 @@ import { readJson, writeJsonAtomic } from "../run/store.mjs";
 import { lockStale, pidAlive, readLock } from "../run/lock.mjs";
 import { scopeFindingsNote, verificationArtifactsNote } from "../contract/scope-findings.mjs";
 import { reviewNote } from "../contract/review-modes.mjs";
+import { SAME_PROVIDER_REVIEW_LABEL } from "../contract/judge-independence.mjs";
 import { validateNodeSnapshot, validateRunMetadata } from "../contract/snapshot.mjs";
 import { compactCost, compactTokens, truncateChars } from "../util.mjs";
 import { listNodeSnapshots, nodeSnapshotPath } from "../run/node-store.mjs";
@@ -32,7 +33,7 @@ const POINTER_ATTENTION_CHARS = 80;
 /** @typedef {{inputTokens: number|null, outputTokens: number|null, cacheReadInputTokens: number|null}} StatusPayloadUsage */
 /** @typedef {{index: number, total: number, argv: string}} VerificationProgress */
 /** @typedef {{verdict: string, maxSeverity: string, findingCount: number, summary: string|null}} StatusPayloadGate */
-/** @typedef {{id: string, status: NodeStatus, phase: string|null, executionPhase: string|null, runtime: string|null, workerRuntime: string|null, judgeRuntime: string|null, continuation: string, attempt: number, revisions: number, startedAt: string|null, updatedAt: string|null, usage: StatusPayloadUsage|null, costUsd: number|null, roleCostUsd: {worker: number|null, judge: number|null}, costProvenance: {worker: string, judge: string}, verdict: string|null, gate: StatusPayloadGate|null, gateOutcome: "passed"|"rejected"|null, pendingHandoff: {runtime: string, reason: string}|null, note: string|null, scopeFindings: string[]|null, verificationArtifacts: string[]|null, errorCode: string|null, blockedBy: string[], verificationProgress: VerificationProgress|null, declaredReadBytes: number|null}} StatusPayloadNode */
+/** @typedef {{id: string, status: NodeStatus, phase: string|null, executionPhase: string|null, runtime: string|null, workerRuntime: string|null, judgeRuntime: string|null, continuation: string, attempt: number, revisions: number, startedAt: string|null, updatedAt: string|null, usage: StatusPayloadUsage|null, costUsd: number|null, roleCostUsd: {worker: number|null, judge: number|null}, costProvenance: {worker: string, judge: string}, verdict: string|null, gate: StatusPayloadGate|null, gateOutcome: "passed"|"rejected"|null, pendingHandoff: {runtime: string, reason: string}|null, note: string|null, scopeFindings: string[]|null, verificationArtifacts: string[]|null, errorCode: string|null, blockedBy: string[], verificationProgress: VerificationProgress|null, declaredReadBytes: number|null, sameProviderReview: boolean}} StatusPayloadNode */
 /** @typedef {{schemaVersion: 1, run: string, contractId: string, campaignId: string, goal: string, usage: {inputTokens: number, outputTokens: number, cacheReadInputTokens: number, costUsd: number|null}, roles: {worker: RoleUsage, judge: RoleUsage}, controller: JsonObject, identityWarnings: string[], summary: string, nodes: StatusPayloadNode[]}} StatusPayload */
 
 /** The glyph each terminal state prints in a status table. */
@@ -126,7 +127,8 @@ function nowLine(payload, now) {
     const progress = active.verificationProgress;
     const verification = progress ? ` · verification ${progress.index}/${progress.total} · ${progress.argv}` : "";
     const candidate = !progress && active.executionPhase === "candidate" ? " · candidate verification" : "";
-    return `now: ${active.id} ${active.status} (${formatElapsed(active, now)}) · ${active.runtime ?? "-"} · ${compactCost(active.costUsd)}${verification}${candidate}`;
+    const sameProviderReview = active.sameProviderReview ? ` · ${SAME_PROVIDER_REVIEW_LABEL}` : "";
+    return `now: ${active.id} ${active.status} (${formatElapsed(active, now)}) · ${active.runtime ?? "-"} · ${compactCost(active.costUsd)}${verification}${candidate}${sameProviderReview}`;
   }
   const allTerminal = payload.nodes.every((node) => SUCCESS.has(node.status));
   return allTerminal ? `now: idle · run done · ${compactCost(payload.usage.costUsd)}` : "now: idle";
@@ -259,10 +261,11 @@ function buildStatusPayload(runDir, contract, nodes, identityWarnings, usage) {
     nodes: nodes.map((node) => {
       const progress = verificationProgress(node);
       const nodeRoles = roleUsage([node]);
+      const contractNode = contract.nodes.find((candidate) => candidate.id === node.id);
       return {
         id: node.id,
         status: node.status,
-        phase: contract.nodes.find((candidate) => candidate.id === node.id)?.phase ?? null,
+        phase: contractNode?.phase ?? null,
         // A running controller verification command does not move
         // `node.phase` (it stays `worker`, the phase that dispatched it), so
         // the surface that shows it is computed here rather than persisted.
@@ -301,6 +304,11 @@ function buildStatusPayload(runDir, contract, nodes, identityWarnings, usage) {
         blockedBy: node.blockedBy ?? [],
         verificationProgress: progress,
         declaredReadBytes: typeof node.declaredReadBytes === "number" ? node.declaredReadBytes : null,
+        // R20: the dynamic per-attempt fact `startJudge` stamped from the
+        // runtimes that actually ran (`engine/dispatch.mjs`) -- not the
+        // contract's static admission, which only says the pairing was
+        // possible (primary or fallback), not that this attempt hit it.
+        sameProviderReview: node.sameProviderReview === true,
       };
     }),
   };
@@ -446,6 +454,10 @@ export function renderReport(runDir) {
     for (const key of /** @type {("inputTokens"|"outputTokens"|"cacheReadInputTokens")[]} */ (Object.keys(totals).filter((key) => key !== "costUsd"))) totals[key] = (totals[key] ?? 0) + (usage[key] ?? 0);
     const runtime = workerRuntimeLabel(node) ?? "-";
     const planNode = contract.nodes.find((candidate) => candidate.id === node.id);
+    // `nodeNote` already carries the same-provider review mark (R20) through
+    // `statusNote`, in both branches below -- it is never conditioned on the
+    // scope-findings branch, unlike the phase/continuation prefix which only
+    // applies when there is no scope finding to report instead.
     const note = scopeFindingsNote(node.scopeFindings)
       ? nodeNote(node)
       : `phase ${planNode?.phase ?? "-"} · ${continuationMode(node)} · ${nodeNote(node)}`;
@@ -475,10 +487,15 @@ export function renderReportJson(runDir) {
     for (const key of /** @type {("inputTokens"|"outputTokens"|"cacheReadInputTokens")[]} */ (["inputTokens", "outputTokens", "cacheReadInputTokens"])) totals[key] = (totals[key] ?? 0) + (usage[key] ?? 0);
     const cost = costs[index];
     totals.declaredReadBytes += typeof node.declaredReadBytes === "number" ? node.declaredReadBytes : 0;
+    const planNode = contract.nodes.find((candidate) => candidate.id === node.id);
     return {
       id: node.id,
       status: node.status,
-      phase: contract.nodes.find((candidate) => candidate.id === node.id)?.phase ?? null,
+      phase: planNode?.phase ?? null,
+      // The dynamic per-attempt fact (see buildStatusPayload), not the
+      // contract's static admission: this is what actually ran, fallback
+      // included.
+      sameProviderReview: node.sameProviderReview === true,
       executionPhase: node.phase,
       runtime: node.runtime ? `${node.runtime.harness}/${node.runtime.model}` : null,
       attempt: node.attempt,
@@ -714,20 +731,24 @@ function boundedNote(segments, maxLength = MAX_NOTE_LENGTH) {
 
 /**
  * The note a status surface shows for a node: gate summary or error, led by
- * any advisory scope finding and by the review outcome, so a gated done node
- * cannot hide an advisory finding or an invalid verdict behind its gate
- * summary (TECH-SPEC lean, rules 1 and 2). The order is the stable format
- * every surface shares: `scope: N unexpected paths · <review note> · <gate
- * summary or error>`, bounded so the tables and the JSON cannot disagree.
+ * any advisory scope finding, the same-provider review mark (R20) and the
+ * review outcome, so a gated done node cannot hide an advisory finding or an
+ * invalid verdict behind its gate summary (TECH-SPEC lean, rules 1 and 2).
+ * The order is the stable format every surface shares: `scope: N unexpected
+ * paths · same-provider review · <review note> · <gate summary or error>`,
+ * bounded so the tables and the JSON cannot disagree. `sameProviderReview` is
+ * led with the other markers rather than appended, so `boundedNote`'s cut
+ * (it drops the trailing segment first) never silently loses the mark.
  *
  * @param {NodeSnapshot} node
  * @returns {string|null}
  */
 export function statusNote(node) {
   const scope = boundedNote([scopeFindingsNote(node.scopeFindings), verificationArtifactsNote(node.verificationArtifacts)]);
+  const sameProviderReview = node.sameProviderReview === true ? SAME_PROVIDER_REVIEW_LABEL : null;
   const review = reviewNote(node);
   const detail = node.gate?.summary ?? node.error?.message ?? node.blockedBy?.join(", ") ?? (candidateVerificationActive(node) ? "candidate" : node.phase);
-  const note = boundedNote([review, detail]);
+  const note = boundedNote([sameProviderReview, review, detail]);
   if (!scope) return note;
   return boundedNote([scope, note]);
 }