faberun 0.9.0 → 0.11.0

package/src/harnesses/protocol.mjs

@@ -498,6 +498,50 @@ export function isVerdictCandidate(text) {
   }
 }
 
+/**
+ * A judge's final message can carry its whole verdict on one line with no
+ * newline before the JSON: `Confirmed. Now write the verdict JSON.{"verdict":
+ * "fail", ...}`, measured 2026-09-17 at 5662 characters. A line-boundary-only
+ * suffix scan never finds it, extractJson returns null, isVerdictCandidate
+ * returns false, and a correct, evidenced verdict is discarded as
+ * `judge_unavailable`. The candidate starts tried here are every `{` and `[`
+ * offset, not just line starts, so a JSON object glued directly to prose is
+ * still reachable.
+ */
+const SUFFIX_CANDIDATE_LIMIT = 200;
+
+/**
+ * The last parseable suffix of `trimmed`, trying every `{`/`[` offset from the
+ * end backwards. Bounded to the last `SUFFIX_CANDIDATE_LIMIT` offsets: without
+ * a cap this is one `JSON.parse` per bracket character, quadratic on a
+ * pathological message built mostly of brackets. 200 is comfortably above the
+ * bracket count of any real verdict object (the measured 5662-character
+ * message resolves on one of its first few tries, since its outermost `{` is
+ * also its first) and keeps every call to at most 200 parses regardless of
+ * message length.
+ *
+ * @param {string} trimmed
+ * @returns {string|null}
+ */
+function suffixJsonCandidate(trimmed) {
+  const offsets = [];
+  for (let index = 0; index < trimmed.length; index += 1) {
+    const char = trimmed[index];
+    if (char === "{" || char === "[") offsets.push(index);
+  }
+  const floor = Math.max(0, offsets.length - SUFFIX_CANDIDATE_LIMIT);
+  for (let index = offsets.length - 1; index >= floor; index -= 1) {
+    const candidate = trimmed.slice(offsets[index]);
+    try {
+      JSON.parse(candidate);
+      return candidate;
+    } catch {
+      // This suffix is not JSON; keep trying earlier bracket offsets.
+    }
+  }
+  return null;
+}
+
 /**
  * Extract a JSON value from a provider response that may carry prose, taking
  * the last parseable suffix or fenced JSON block.
@@ -514,16 +558,8 @@ export function extractJson(value) {
   } catch {
     // Not JSON as a whole: fall through to the suffix and fenced-block scans below.
   }
-  const lines = trimmed.split(/\r?\n/u);
-  for (let index = lines.length - 1; index > 0; index -= 1) {
-    const candidate = lines.slice(index).join("\n").trim();
-    try {
-      JSON.parse(candidate);
-      return candidate;
-    } catch {
-      // This suffix is not JSON; keep trying earlier line boundaries.
-    }
-  }
+  const suffix = suffixJsonCandidate(trimmed);
+  if (suffix !== null) return suffix;
   const blocks = [...value.matchAll(/```json\s*([\s\S]*?)```/giu)];
   for (const block of blocks.reverse()) {
     const candidate = block[1].trim();

package/src/host/preflight.mjs

@@ -254,6 +254,22 @@ export function declaredVerificationCommands(contract) {
   return [...commands.values()];
 }
 
+/**
+ * Environment names removed before spawning a timing candidate. The probe
+ * only measures how long a command takes; a subtraction of a named few, not
+ * an allowlist, so PATH, HOME and every ordinary variable the command needs
+ * to run at all still pass through unchanged.
+ */
+const SIDE_EFFECT_ENV_KEYS = [
+  NOTIFY_BIN_ENV, // a measurement must not notify a human
+  "FABERUN_CODEX_BIN", // could redirect the timed command at a live, paid codex binary instead of this repository's own fixtures
+  "FABERUN_CLAUDE_BIN", // same, for the claude harness
+  "FABERUN_AGY_BIN", // same, for the agy harness
+  "FABERUN_DSH_BIN", // same, for the dsh harness
+  "FABERUN_ZCODE_BIN", // same, for the zcode harness
+  "FABERUN_EXEC_JSONL_BIN", // same, for the exec-jsonl harness
+];
+
 /**
  * Run every declared verification command once and report what it actually
  * costs against the timeout the contract gives it.
@@ -275,6 +291,8 @@ export function declaredVerificationCommands(contract) {
 export function timeVerificationCommands(contract, probes = {}) {
   const now = probes.now ?? (() => Date.now());
   const run = probes.run ?? spawnSync;
+  const env = { ...process.env };
+  for (const key of SIDE_EFFECT_ENV_KEYS) delete env[key];
   return declaredVerificationCommands(contract).map((command) => {
     const label = command.argv.join(" ");
     const name = `verification timing · ${label}`;
@@ -288,6 +306,7 @@ export function timeVerificationCommands(contract, probes = {}) {
       timeout: ceilingSec * 1_000,
       stdio: "ignore",
       encoding: "utf8",
+      env,
     });
     const seconds = (now() - startedAt) / 1_000;
     const measured = `${seconds.toFixed(1)}s measured against ${command.timeoutSec}s declared`;

package/src/repo/integrate.mjs

@@ -503,7 +503,7 @@ export function promoteRun({ repo, runId, landBranch, runHead, baseSha, finalVer
   if (!head) throw refusal(`refusing to promote ${runId}: the run ref is unavailable`, "run_ref_missing");
   const checkedOutAt = worktreeCheckedOutAt(repo, landBranch);
   if (checkedOutAt) {
-    throw refusal(`refusing to promote ${landBranch}: it is checked out in ${checkedOutAt}`, "land_branch_checked_out");
+    throw refusal(`refusing to promote ${landBranch}: it is checked out in ${checkedOutAt}; ${landBranchCheckedOutRemedy(checkedOutAt)}`, "land_branch_checked_out");
   }
   const branchRef = `refs/heads/${landBranch}`;
   const current = gitHead(repo, branchRef);
@@ -540,6 +540,11 @@ function refusal(message, code) {
   return Object.assign(new Error(message), { code });
 }
 
+/** @param {string} checkedOutAt @returns {string} */
+function landBranchCheckedOutRemedy(checkedOutAt) {
+  return `detach the checkout at ${checkedOutAt} or run the coordinator from a worktree`;
+}
+
 /** @param {string} path @returns {string} */
 function readTextFile(path) {
   return readFileSync(path, "utf8");

package/src/report/render.mjs

@@ -26,7 +26,7 @@ const POINTER_ATTENTION_CHARS = 80;
 /** @typedef {{costUsd: number|null, costProvenance: CostProvenance, inputTokens: number, outputTokens: number, cacheReadInputTokens: number, pricedInvocations: number, unpricedInvocations: number}} RoleUsage */
 /** @typedef {{inputTokens: number|null, outputTokens: number|null, cacheReadInputTokens: number|null}} StatusPayloadUsage */
 /** @typedef {{index: number, total: number, argv: string}} VerificationProgress */
-/** @typedef {{id: string, status: NodeStatus, phase: string|null, executionPhase: string|null, runtime: string|null, workerRuntime: string|null, continuation: string, attempt: number, revisions: number, startedAt: string|null, updatedAt: string|null, usage: StatusPayloadUsage|null, costUsd: number|null, verdict: string|null, pendingHandoff: {runtime: string, reason: string}|null, note: string|null, scopeFindings: string[]|null, errorCode: string|null, blockedBy: string[], verificationProgress: VerificationProgress|null, declaredReadBytes: number|null}} StatusPayloadNode */
+/** @typedef {{id: string, status: NodeStatus, phase: string|null, executionPhase: string|null, runtime: string|null, workerRuntime: string|null, continuation: string, attempt: number, revisions: number, startedAt: string|null, updatedAt: string|null, usage: StatusPayloadUsage|null, costUsd: number|null, verdict: string|null, gateOutcome: "passed"|"rejected"|null, pendingHandoff: {runtime: string, reason: string}|null, note: string|null, scopeFindings: string[]|null, errorCode: string|null, blockedBy: string[], verificationProgress: VerificationProgress|null, declaredReadBytes: number|null}} StatusPayloadNode */
 /** @typedef {{schemaVersion: 1, run: string, contractId: string, campaignId: string, goal: string, usage: {inputTokens: number, outputTokens: number, cacheReadInputTokens: number, costUsd: number|null}, roles: {worker: RoleUsage, judge: RoleUsage}, controller: JsonObject, identityWarnings: string[], summary: string, nodes: StatusPayloadNode[]}} StatusPayload */
 
 /** The glyph each terminal state prints in a status table. */
@@ -43,13 +43,11 @@ export const MARK = {
 };
 
 /**
- * `status <run-dir>`: everything the operator needs, in the same order as
- * the dashboard page (TECH-SPEC lean, section 4's last paragraph) —
- * needs-you, now, nodes, cost. Every cell comes from the same payload
- * `status --json` and the per-run `status.json` file emit
- * (`buildStatusPayload`); `nodes` and `identityWarnings` from `loadRun` are
- * used only for the two facts the payload does not carry: throwing on an
- * invalid persisted snapshot, and `controllerStatus`'s lock read.
+ * `status <run-dir>`: needs-you, now, nodes, cost, in the dashboard's order
+ * (TECH-SPEC lean, section 4's last paragraph). Every cell comes from the same
+ * payload `status --json` emits (`buildStatusPayload`); `nodes` and
+ * `identityWarnings` from `loadRun` cover only what the payload does not:
+ * throwing on an invalid snapshot, and `controllerStatus`'s lock read.
  *
  * @param {string} runDir
  * @returns {string}
@@ -75,7 +73,7 @@ export function renderStatus(runDir) {
   const widths = [3, 24, 9, 3, 28, 8, 6, 6, 6, 10, 9, MAX_NOTE_LENGTH];
   /** @type {(cells: unknown[]) => string} */
   const row = (cells) => cells.map((cell, i) => fit(String(cell ?? ""), widths[i])).join(" ");
-  lines.push("```", row(["", "NODE", "STATE", "TRY", "RUNTIME", "ELAPSED", "IN", "CACHE", "OUT", "USD", "VERDICT", "NOTE"]), row(widths.map((width) => "-".repeat(width))));
+  lines.push("```", row(["", "NODE", "STATE", "TRY", "RUNTIME", "ELAPSED", "IN", "CACHE", "OUT", "USD", "GATE", "NOTE"]), row(widths.map((width) => "-".repeat(width))));
   for (const node of payload.nodes) {
     lines.push(row([
       MARK[node.status] ?? "[?]",
@@ -88,7 +86,7 @@ export function renderStatus(runDir) {
       compactTokens(node.usage?.cacheReadInputTokens),
       compactTokens(node.usage?.outputTokens),
       compactCost(node.costUsd),
-      node.verdict ?? "-",
+      node.gateOutcome ?? "-",
       node.note ?? "-",
     ]));
   }
@@ -98,12 +96,10 @@ export function renderStatus(runDir) {
 }
 
 /**
- * The node the operator should look at right now, formatted the same way
- * the dashboard's now strip is (TECH-SPEC lean, section 4, item 1): the
- * active node's elapsed time and cost so far, or an idle line once every
- * node has settled. A node awaiting a controller verification command
- * appends which one, `k/n`, and its argv, so a minutes-long suite is not
- * silent between ticks.
+ * The node the operator should look at right now, formatted like the
+ * dashboard's now strip (TECH-SPEC lean, section 4, item 1): elapsed time and
+ * cost so far, or idle once every node has settled. A node awaiting a
+ * controller verification command appends which one, `k/n`, and its argv.
  *
  * @param {StatusPayload} payload
  * @param {number} now epoch ms
@@ -114,7 +110,8 @@ function nowLine(payload, now) {
   if (active) {
     const progress = active.verificationProgress;
     const verification = progress ? ` · verification ${progress.index}/${progress.total} · ${progress.argv}` : "";
-    return `now: ${active.id} ${active.status} (${formatElapsed(active, now)}) · ${active.runtime ?? "-"} · ${compactCost(active.costUsd)}${verification}`;
+    const candidate = !progress && active.executionPhase === "candidate" ? " · candidate verification" : "";
+    return `now: ${active.id} ${active.status} (${formatElapsed(active, now)}) · ${active.runtime ?? "-"} · ${compactCost(active.costUsd)}${verification}${candidate}`;
   }
   const allTerminal = payload.nodes.every((node) => SUCCESS.has(node.status));
   return allTerminal ? `now: idle · run done · ${compactCost(payload.usage.costUsd)}` : "now: idle";
@@ -134,6 +131,27 @@ function verificationProgress(node) {
   return verification?.progress ?? null;
 }
 
+/** Set by `verifyCandidateWorkspace` (engine/verify.mjs) for the run of the sealed candidate's own re-verification pass. @param {NodeSnapshot} node @returns {boolean} */
+function candidateVerificationActive(node) {
+  const verification = /** @type {{candidate?: boolean}|null|undefined} */ (node.verification);
+  return verification?.candidate === true;
+}
+
+/** `candidate` while re-verifying the sealed candidate, `verification` mid-attempt-verification, else the persisted phase; the two never overlap. @param {NodeSnapshot} node @returns {string|null} */
+function executionPhaseOf(node) {
+  if (candidateVerificationActive(node)) return "candidate";
+  if (verificationProgress(node)) return "verification";
+  return node.phase;
+}
+
+/** What the gate decided (independent of `verdict`: an advisory review or a below-threshold fail verdict still accepts the node, engine/review.mjs `applyJudgeResult`). @param {NodeSnapshot} node @returns {"passed"|"rejected"|null} */
+export function gateOutcome(node) {
+  if (!node.gate) return null;
+  if (SUCCESS.has(node.status)) return "passed";
+  if (node.status === "failed" || node.status === "exhausted") return "rejected";
+  return null;
+}
+
 /**
  * A node's wall-clock elapsed time: `startedAt` to `updatedAt` once it has
  * settled into a terminal state, `startedAt` to `now` while it is still
@@ -216,7 +234,7 @@ function buildStatusPayload(runDir, contract, nodes, identityWarnings, usage) {
         // A running controller verification command does not move
         // `node.phase` (it stays `worker`, the phase that dispatched it), so
         // the surface that shows it is computed here rather than persisted.
-        executionPhase: progress ? "verification" : node.phase,
+        executionPhase: executionPhaseOf(node),
         runtime: node.runtime ? `${node.runtime.harness}/${node.runtime.model}` : null,
         workerRuntime: workerRuntimeLabel(node),
         continuation: continuationMode(node),
@@ -227,6 +245,7 @@ function buildStatusPayload(runDir, contract, nodes, identityWarnings, usage) {
         usage: node.usage ? { inputTokens: node.usage.inputTokens ?? null, outputTokens: node.usage.outputTokens ?? null, cacheReadInputTokens: node.usage.cacheReadInputTokens ?? null } : null,
         costUsd: typeof node.costUsd === "number" ? node.costUsd : null,
         verdict: node.gate?.verdict ?? null,
+        gateOutcome: gateOutcome(node),
         pendingHandoff: pendingHandoff(node),
         note: statusNote(node),
         scopeFindings: node.scopeFindings?.unexpectedPaths ?? null,
@@ -256,16 +275,11 @@ function activeStatusNode(nodes) {
 }
 
 /**
- * The bounded pointer record written to `.runs/status.json`: enough for a
- * quick ambient read (statusline, a stale watcher) without opening the
- * per-run status.json. Bounded the same way heartbeat.json used to be, so a
- * cheap bounded read stays valid for any reader still built that way.
- * `generatedAt` is unix seconds, not ISO: the statusline's no-jq fallback has
- * no clock and only jq's builtin `now` can compute an age from a live clock,
- * and neither path needs a `date` process to read an integer. `elapsedSec`
- * is likewise precomputed here (as of `generatedAt`, not live) so the
- * statusline never has to subtract two timestamps to show it — it just
- * prints the integer, whichever reader it is.
+ * The bounded pointer record written to `.runs/status.json`, for a quick
+ * ambient read without opening the per-run status.json (bounded like the old
+ * heartbeat.json). `generatedAt` is unix seconds, not ISO, and `elapsedSec` is
+ * precomputed from it, since the no-jq statusline fallback has no clock to
+ * subtract two timestamps with.
  *
  * @param {JsonObject} payload the per-run status.json payload
  * @param {NodeSnapshot[]} nodes
@@ -340,10 +354,7 @@ export function writeStatusArtifacts(runDir, runsDir, contract, states) {
  */
 export function controllerStatus(runDir, nodes) {
   const lock = readLock(runDir);
-  // The heartbeat's `at` is the live tick, so a working controller and a dead
-  // one are distinguishable on disk. Before this it was hard-coded null here
-  // and computed from node updates only once the lock was already stale, which
-  // is why all 47 recorded status.json files reported a null lastTick.
+  // The heartbeat's `at` distinguishes a working controller from a dead one on disk.
   const heartbeat = readHeartbeat(runDir);
   const lastTick = typeof heartbeat?.at === "string" ? heartbeat.at : null;
   if (!lock || /** @type {{invalid?: true}} */ (lock).invalid) {
@@ -473,14 +484,11 @@ export function renderFindings(runDir) {
 }
 
 /**
- * A node the worker itself stopped on, rendered as the repair it asks for.
- *
- * `findings` used to answer only gate exhaustion, and a run whose nodes all
- * stopped on `blocked_context` reported nothing to act on while the workers
- * had each named exactly what they needed — measured on a four-node campaign
- * where three nodes were blocked and the command printed one line saying so.
- * The question is already structured, so the repair is mechanical: put the
- * named paths in the packet's `readFiles` and take a new run id.
+ * A node the worker itself stopped on, rendered as the repair it asks for:
+ * `findings` used to answer only gate exhaustion, so a run whose nodes all
+ * stopped on `blocked_context` reported nothing to act on (measured on a
+ * four-node campaign with three nodes blocked). The repair is mechanical: put
+ * the named paths in the packet's `readFiles` and take a new run id.
  *
  * @param {NodeSnapshot} node
  * @returns {string|null}
@@ -553,16 +561,11 @@ function continuationMode(node) {
 }
 
 /**
- * Who produced this node's work, for the RUNTIME column of both tables.
- *
- * `state.runtime` is the last runtime *dispatched*, and the judge dispatch
- * overwrites the worker's: every gated node that reached its gate therefore
- * reported its judge as the runtime, and a six-node campaign whose workers
- * were five different harnesses rendered as though three of them had never
- * run (measured 2026-09-13). The invocation ledger keeps both roles, so the
- * label is derived from it: the worker that ran, falling back to the live
- * runtime for a node that has not dispatched one yet. The judge is not lost —
- * it owns the VERDICT column, and `nowLine` still names whatever is running.
+ * Who produced this node's work, for the RUNTIME column: `state.runtime` is
+ * the last runtime *dispatched*, and the judge dispatch overwrites the
+ * worker's (measured 2026-09-13: a six-harness campaign rendered as though
+ * three workers never ran), so this reads the invocation ledger for the
+ * worker that ran, falling back to the live runtime if none dispatched yet.
  *
  * @param {NodeSnapshot} node
  * @returns {string|null}
@@ -633,7 +636,7 @@ function boundedNote(segments, maxLength = MAX_NOTE_LENGTH) {
 export function statusNote(node) {
   const scope = scopeFindingsNote(node.scopeFindings);
   const review = reviewNote(node);
-  const detail = node.gate?.summary ?? node.error?.message ?? node.blockedBy?.join(", ") ?? node.phase;
+  const detail = node.gate?.summary ?? node.error?.message ?? node.blockedBy?.join(", ") ?? (candidateVerificationActive(node) ? "candidate" : node.phase);
   const note = boundedNote([review, detail]);
   if (!scope) return note;
   return boundedNote([scope, note]);
@@ -657,13 +660,10 @@ function nodeNote(node) {
 /** @typedef {{costUsd: number|null, status: "known"|"estimated"|"ambiguous"}} CostProjection */
 
 /**
- * Per-role usage from the invocation ledger alone, with the provenance that
- * says whether the role's cost total is honest. A role whose invocations all
- * carry a provider cost is `priced` and its `costUsd` is the sum; a role with
- * any unpriced invocation is `partial` (some priced) or `unpriced` (none), and
- * its `costUsd` stays null rather than summing the known half and understating
- * it. A role with no invocation is `none`. Token totals are always carried, so
- * a role the provider would not price still reads as work.
+ * Per-role usage from the invocation ledger, with provenance for whether the
+ * cost total is honest: `priced` (all invocations costed), `partial`/`unpriced`
+ * (some/none costed, so `costUsd` stays null rather than understating), or
+ * `none` (no invocation). Token totals are always carried.
  *
  * @param {NodeSnapshot[]} nodes
  * @returns {{worker: RoleUsage, judge: RoleUsage}}

package/src/web/index.html

@@ -185,18 +185,18 @@ function tabBodyHtml(tab, detail) {
 function drawerHtml(drawer, tab) {
   if (!drawer) return `<section id="drawer"><h2>Run drawer</h2><div class="card" style="padding:16px 18px"><p class="empty">select a run above</p></div></section>`;
   const rows = drawer.nodes.map((node) => `<tr class="clickable ${node.id === drawer.selectedNodeId ? "selected" : ""}" data-node="${esc(node.id)}">
-    <td>${pill(node.status)}</td>
+    <td>${pill(node.status)}${node.executionPhase === "candidate" ? ` <span class="dim">· candidate verification</span>` : node.executionPhase === "verification" ? ` <span class="dim">· verification</span>` : ""}</td>
     <td class="mono">${esc(node.id)}</td>
     <td class="num">${node.attempt}</td>
     <td class="mono">${esc(node.model ?? "–")}</td>
     <td class="num">${fmtDur(node.elapsedMs)}</td>
     <td class="num">${fmtUsd(node.costUsd)}</td>
-    <td>${node.verdict ? pill(node.verdict) : ""}</td>
+    <td>${node.gateOutcome ? pill(node.gateOutcome) : ""}</td>
     <td class="goal" title="${esc(node.note ?? "")}">${esc(node.note ?? "")}</td>
   </tr>`).join("");
   const tabs = TABS.map(([key, label]) => `<button data-tab="${key}" class="${tab === key ? "active" : ""}">${esc(label)}</button>`).join("");
   return `<section id="drawer"><h2>Run drawer · ${esc(drawer.runId)}</h2><div class="card" style="padding:16px 18px">
-    <table><thead><tr><th>state</th><th>node</th><th>try</th><th>model</th><th>elapsed</th><th>USD</th><th>verdict</th><th>note</th></tr></thead>
+    <table><thead><tr><th>state</th><th>node</th><th>try</th><th>model</th><th>elapsed</th><th>USD</th><th>gate</th><th>note</th></tr></thead>
     <tbody>${rows}</tbody></table>
     <div class="tabs">${tabs}</div>
     <div id="tabbody">${tabBodyHtml(tab, drawer.detail)}</div>

package/src/web/server.mjs

@@ -294,7 +294,8 @@ function nodeRow(runDir, statusNode) {
     model: node.runtime?.model ?? null,
     elapsedMs: elapsedMsBetween(node.startedAt, closed ? node.updatedAt : null),
     costUsd: typeof node.costUsd === "number" ? node.costUsd : null,
-    verdict: node.gate?.verdict ?? null,
+    gateOutcome: statusNode.gateOutcome ?? null,
+    executionPhase: statusNode.executionPhase ?? null,
     note: statusNode.note ?? null,
     errorCode: statusNode.errorCode ?? null,
     blockedBy: statusNode.blockedBy ?? [],