feature-factory 0.10.7 → 0.10.8

package/README.md

@@ -152,7 +152,7 @@ truncation, redaction, timeout, retry, cache, payload transport, or session beha
 
 ### Sandbox bootstrap
 
-Only the CLI executes configured `bootstrap`: once during fresh init after clone, containment, and PR-base observation but before manifest publication, and again on every explicit resume while the run remains parked. The exact configured string runs unchanged with `shell: true`, inherited environment and stdin, cwd exactly the selected sandbox, and child stdout and stderr both routed to CLI stderr. Init JSON stdout therefore remains exactly one response object. Bootstrap has its own configured timeout or independent `900000` millisecond default, with no retry and no use of the verify budget.
+Only the CLI executes configured `bootstrap`: once during fresh init after clone, containment, and PR-base observation but before manifest publication, and again on every explicit resume while the run remains parked. It also runs immediately before every configured `verify` execution, in the slice or integration worktree that verify runs in, so `verify` always sees bootstrap output installed from the tree it checks. The exact configured string runs unchanged with `shell: true`, inherited environment and stdin, cwd exactly the selected sandbox, and child stdout and stderr both routed to CLI stderr. Init JSON stdout therefore remains exactly one response object. Bootstrap has its own configured timeout or independent `900000` millisecond default, with no retry and no use of the verify budget.
 
 After every attempt, the CLI checks tracked worktree and index paths only and ignores untracked dependency output. Unobservable tracked state refuses before dirty tracked paths; dirty paths refuse before unavailable or nonzero exit, and diagnostics name exact repository-relative paths. A clean numeric zero stores paired `bootstrap_command` and `bootstrap_exit` manifest evidence. The command is exact; the exit is a non-negative integer or `null`. Ordinary transitions preserve the pair, and status output does not expose it.
 

package/WORKFLOW.md

@@ -723,8 +723,8 @@ Effective push-target capture and comparison are active through the package-owne
 
 | Entry | Declared input | Return shape | Failure meaning | Current behavior |
 |---|---|---|---|---|
-| `bootstrap` | Exact configured string as one shell command with `shell: true`, inherited environment and stdin, cwd exactly the selected sandbox, and child stdout and stderr both routed to CLI stderr. Each execution receives its own `bootstrap_timeout_ms`, independently `900000` when omitted. | Numeric exit status or unavailable `null`; output is visible on CLI stderr and never parsed | Clean zero succeeds; dirty or unobservable tracked state outranks unavailable or nonzero exit | Invoked by the CLI once during configured fresh init and again on every explicit configured resume; never invoked by resolver, merge verification or replay, direct repository verification, slice or Gate 3 observation, effective push, or publication. |
-| `verify` | Ordinary shell step in the exact integration-worktree cwd with inherited environment; no structured stdin or factory-specific payload is defined. Each attempt receives the full configured `verify_timeout_ms`, silently `900000` when omitted. | Exit status is authoritative; stdout and stderr are inherited, informational, and unparsed | Zero means success; non-zero means repository verification failed; no numeric child status means unavailable | Invoked after each newly recorded merge through `observe --repository-verify`, with at most two executions in that merge invocation. The timeout and retry never apply to resolver, slice, or Gate 3 commands. |
+| `bootstrap` | Exact configured string as one shell command with `shell: true`, inherited environment and stdin, cwd exactly the selected sandbox, and child stdout and stderr both routed to CLI stderr. Each execution receives its own `bootstrap_timeout_ms`, independently `900000` when omitted. | Numeric exit status or unavailable `null`; output is visible on CLI stderr and never parsed | Clean zero succeeds; dirty or unobservable tracked state outranks unavailable or nonzero exit | Invoked by the CLI once during configured fresh init, again on every explicit configured resume, and immediately before every configured `verify` execution in the tree that verify runs in: the slice worktree during slice observation, and the integration worktree for post-merge verify, its replay, and direct repository verification. Never invoked by the resolver, effective push, publication, or a replay that reuses recorded verify evidence. |
+| `verify` | Ordinary shell step in the exact integration-worktree cwd with inherited environment; no structured stdin or factory-specific payload is defined. Each attempt receives the full configured `verify_timeout_ms`, silently `900000` when omitted. | Exit status is authoritative; stdout and stderr are routed to CLI stderr, informational, and unparsed | Zero means success; non-zero means repository verification failed; no numeric child status means unavailable | Invoked after each newly recorded merge through `observe --repository-verify`, with at most two executions in that merge invocation. The timeout and retry never apply to resolver, slice, or Gate 3 commands. |
 | `publish` | Optional file candidate for the one Step 6 publishing selection. A nonblank inherited `FACTORY_PUBLISHING_COMMAND` selects its exact string; the same variable set empty or to whitespace selects the default; when the variable is unset this entry is selected if present, otherwise the default. A selected nondefault command runs as one shell step in `RUN_REPO` cwd, with no stdin or positional arguments and inherited environment plus exact `PR_BASE`, `FEATURE_BRANCH`, `PR_DRAFT`, `PR_TITLE`, and absolute `PR_BODY_FILE`. | Exit status is authoritative; the last nonempty stdout line must be an absolute HTTPS URL and becomes `PR_URL` | Zero plus that URL is recordable; any other result is indeterminate and parks before `factory pr` | The resolved selection replaces only `gh pr create`, after the factory-owned exact push and post-push identity guard. `factory pr` is unchanged and still records the URL. |
 | `publishing_identity` | No runtime input; read the value `status` reports for the run, recorded at init from `--publishing-identity` or the inherited `FACTORY_PUBLISHING_IDENTITY` | Exact case-sensitive string compared with the observed login | Absent at init refuses before any sandbox exists; mismatch or unobservable identity parks the run | Active at the three mandatory guards below; only a manifest written before 0.8.0 can report `null` and skip them. |
 
@@ -1528,12 +1528,16 @@ Per slice:
    unless its ratified `test_plan` is empty — the waiver comes from the plan, not from you.
 
    When `.factory.json` declares `verify`, this step also runs it on the slice's commit, after the
-   ratified test command and with `FACTORY_VERIFY_SCOPE=slice` in its environment, and records the
-   result as `repository_verify`. A failing repository verify makes the slice not `review_ready`, the
+   ratified test command, and records the result as `repository_verify`. A declared `bootstrap` runs in
+   the slice worktree, which never received init's bootstrap output, immediately before that verify and
+   only when it will run; a bootstrap refusal is the evidence's blocked reason and the verify does not run. A failing repository verify makes the slice not `review_ready`, the
    same as a failing test, so the review rejects and the slice retries; an empty `test_plan` does not
    waive it. Its output appears on stderr: give the failing part of it (the lint, format, or test
    failure) to the builder with the rejection, because otherwise the retry cannot see what to fix. This
    is what keeps a one-line lint failure from surfacing only after merge, where it cannot be repaired.
+   When a merge's tree is byte-identical to the slice commit whose repository verify passed, the
+   post-merge verify reuses that result instead of running again, and its evidence names the slice commit
+   in `reused_from`; any other merge, such as one after a sibling merged, runs the verify as before.
 
    `BUILDER_REPORT` is a path and not the report. Write the builder's returned report to
    `BUILDER_REPORT=".factory/$R/artifacts/$SLICE_ID-builder-attempt-$SLICE_ATTEMPT.json"` and pass that path,

package/bin/factory.js

@@ -394,16 +394,23 @@ function bootstrapOutcome(worktree, config, phase) {
 }
 
 
+// Enforcement (#376): verify runs on a tree bootstrap has just prepared, the same way in every place it runs.
+// Bootstrap output is untracked, so a slice worktree never had it and a merge that changes what bootstrap
+// installs was verified against the dependencies from init. A verify that does not execute runs no bootstrap.
+function bootstrapBeforeVerify(worktree, config, phase) {
+  return config?.bootstrapCommand ? bootstrapOutcome(worktree, config, phase).refusal : null;
+}
+
 function branchPoint(run) {
   const base = run.slices.find((slice) => Array.isArray(slice.depends_on) && slice.depends_on.length === 0)?.base_ref;
   if (!/^[0-9a-f]{40}$/u.test(base ?? "")) throw new CliError("first seeded root slice has no immutable 40-character base_ref");
   return base;
 }
 
-async function writeObservedEvidence({ repo, runDir, runId, subject, attempt, branch, baseRef, worktree, status, blockedReason, claim, testCommand, skipReason, shellCommand, testTimeoutMs, repositoryVerify = null }) {
+async function writeObservedEvidence({ repo, runDir, runId, subject, attempt, branch, baseRef, worktree, status, blockedReason, claim, testCommand, skipReason, shellCommand, testTimeoutMs, repositoryVerify = null, reused = null }) {
   const evidence = buildEvidence({
     subject, attempt, branch, baseRef, worktree, status, blockedReason, claim, runId,
-    testCommand, skipReason, shellCommand, testTimeoutMs, repositoryVerify,
+    testCommand, skipReason, shellCommand, testTimeoutMs, repositoryVerify, reused,
   });
   const ancestry = observeAncestry(worktree, baseRef, "HEAD");
   if (ancestry !== "ancestor") {
@@ -421,7 +428,7 @@ async function writeObservedEvidence({ repo, runDir, runId, subject, attempt, br
 function canonicalRepositoryVerifyEvidence(evidence, { runId, run, integration, verifyCommand }) {
   const baseRef = branchPoint(run);
   // `repository_verify` is slice-only: null on test-verifier evidence, absent on evidence written before #372.
-  const keys = Object.keys(evidence).filter((key) => key !== "repository_verify").sort();
+  const keys = Object.keys(evidence).filter((key) => !["repository_verify", "reused_from"].includes(key)).sort();
   const commandNames = [
     "git rev-parse HEAD",
     `git --literal-pathspecs diff --name-only -z ${baseRef}...HEAD`,
@@ -439,8 +446,9 @@ function canonicalRepositoryVerifyEvidence(evidence, { runId, run, integration,
     && ((tests.observed === true && Number.isInteger(tests.exit))
       || (tests.observed === false && tests.exit === null));
   const reconciliation = evidence.claim_reconciliation;
-  return JSON.stringify(keys) === JSON.stringify(EVIDENCE_KEYS.filter((key) => key !== "repository_verify").sort())
+  return JSON.stringify(keys) === JSON.stringify(EVIDENCE_KEYS.filter((key) => !["repository_verify", "reused_from"].includes(key)).sort())
     && (evidence.repository_verify ?? null) === null
+    && (evidence.reused_from === undefined || sameTree(integration.worktree, evidence.reused_from, evidence.commit))
     && evidence.subject === "test-verifier" && evidence.run_id === runId
     && Number.isSafeInteger(evidence.attempt) && evidence.attempt >= 1
     && evidence.branch === run.branch && evidence.base_ref === baseRef
@@ -523,16 +531,37 @@ function repositoryVerifyRetrySafety(repo, run, mergeCommit) {
   return integration;
 }
 
-async function runRepositoryVerifyAttempts({ repo, runDir, runId, run, mergeCommit, verify, integration }) {
+// Enforcement (#374): a post-merge verify is skipped only when the merge's tree is byte-identical to a slice
+// commit whose own repository verify ran the same command green -- the same bytes already passed. A tree
+// equality also implies the same committed `.factory.json`, so command and timeout cannot differ.
+function sameTree(worktree, left, right) {
+  const tree = (sha) => git(worktree, ["rev-parse", "--verify", `${sha}^{tree}`]);
+  const [a, b] = [tree(left), tree(right)];
+  return a.ok && b.ok && a.stdout.trim() === b.stdout.trim();
+}
+
+function reusableSliceVerify({ runDir, runId, ref, worktree, mergeCommit, command }) {
+  let evidence;
+  try { evidence = readEvidence(runDir, ref, { runId }); } catch { return null; }
+  const verified = evidence.repository_verify;
+  if (!verified || verified.observed !== true || verified.exit !== 0 || verified.cmd !== command) return null;
+  if (!sameTree(worktree, evidence.commit, mergeCommit)) return null;
+  return { commit: evidence.commit, tests: { cmd: command, exit: 0, observed: true, skipped_reason: null } };
+}
+
+async function runRepositoryVerifyAttempts({ repo, runDir, runId, run, mergeCommit, verify, integration, reused = null }) {
   const baseRef = branchPoint(run);
   let attemptIntegration = integration;
   // False-green enforcement: one invocation gets at most two executions, never an unbounded recovery loop.
   for (let attempt = 1; attempt <= 2; attempt += 1) {
+    // Every execution is freshly bootstrapped, the retry included; a reused result executes nothing (#376).
+    const refusal = attempt === 1 && reused ? null : bootstrapBeforeVerify(attemptIntegration.worktree, verify, "post-merge verify");
+    if (refusal) throw new CliError(`${refusal} after recorded merge ${mergeCommit}; merged slice remains recorded; stop before advancing.`);
     const { evidence } = await writeObservedEvidence({
       repo, runDir, runId, subject: "test-verifier", attempt, branch: run.branch,
       baseRef, worktree: attemptIntegration.worktree, status: "completed", blockedReason: null,
       claim: null, testCommand: verify.command, skipReason: null, shellCommand: true,
-      testTimeoutMs: verify.timeoutMs,
+      testTimeoutMs: verify.timeoutMs, reused: attempt === 1 ? reused : null,
     });
     const classified = classifyRepositoryVerifyEvidence(runDir, {
       runId, run, integration: attemptIntegration, verifyCommand: verify.command,
@@ -546,7 +575,7 @@ async function runRepositoryVerifyAttempts({ repo, runDir, runId, run, mergeComm
   return null;
 }
 
-async function verifyRecordedMerge({ repo, runDir, runId, mergeCommit }) {
+async function verifyRecordedMerge({ repo, runDir, runId, mergeCommit, sliceEvidenceRef = null }) {
   const run = readRun(runDir);
   const integration = requireIntegrationWorktree(repo, run, run.worktree);
   if (integration.head !== mergeCommit) {
@@ -562,7 +591,9 @@ async function verifyRecordedMerge({ repo, runDir, runId, mergeCommit }) {
     throw error;
   }
   if (verify === null) return null;
-  return runRepositoryVerifyAttempts({ repo, runDir, runId, run, mergeCommit, verify, integration });
+  const reused = sliceEvidenceRef && reusableSliceVerify({ runDir, runId, ref: sliceEvidenceRef,
+    worktree: integration.worktree, mergeCommit, command: verify.command });
+  return runRepositoryVerifyAttempts({ repo, runDir, runId, run, mergeCommit, verify, integration, reused });
 }
 
 const HANDLERS = {
@@ -1092,7 +1123,7 @@ const HANDLERS = {
     // step needs it: `observe --base` is compared for exact equality against this value at
     // merge time. The skill previously said to read it from `factory status`, which does not
     // expose it — so the documented path could not be followed at all.
-    if (status === "merged") await verifyRecordedMerge({ repo, runDir, runId, mergeCommit: row.merge_commit });
+    if (status === "merged") await verifyRecordedMerge({ repo, runDir, runId, mergeCommit: row.merge_commit, sliceEvidenceRef: row.evidence_ref });
     // Slice attempts are budgeted the same way, so their rejected verdicts vanish the same way.
     const sliceReviewArchive = await archiveReviewAttempt(runDir, retryReviewRef ?? row.review_ref);
     await archiveReviewAttempt(runDir, retryEvidenceRef ?? row.evidence_ref);
@@ -1126,6 +1157,8 @@ const HANDLERS = {
         if (error instanceof RepositoryConfigError) throw new CliError(error.message);
         throw error;
       }
+      const refusal = bootstrapBeforeVerify(worktree, repositoryVerify, "repository verification");
+      if (refusal) throw new CliError(refusal);
     }
 
     let claim = null;
@@ -1189,7 +1222,8 @@ const HANDLERS = {
       testCommand: flags.repositoryVerify ? repositoryVerify.command : flags.testCmd ? flags.testCmd.split(" ").filter(Boolean) : null,
       skipReason, shellCommand: flags.repositoryVerify === true,
       testTimeoutMs: flags.repositoryVerify ? repositoryVerify.timeoutMs : undefined,
-      repositoryVerify: sliceVerify && { command: sliceVerify.command, timeoutMs: sliceVerify.timeoutMs },
+      repositoryVerify: sliceVerify && { command: sliceVerify.command, timeoutMs: sliceVerify.timeoutMs,
+        prepare: () => bootstrapBeforeVerify(worktree, sliceVerify, "slice observation") },
     });
     return emit(flags, {
       run_id: runId, subject, evidence_ref: evidenceRef(subject),

package/observe/index.js

@@ -14,7 +14,7 @@ export const EVIDENCE_KEYS = Object.freeze([
   "subject", "run_id", "attempt", "branch", "base_ref", "worktree", "status", "blocked_reason",
   "worktree_clean",
   "files_changed", "diff_stat", "diff_observed", "commands", "tests", "commit",
-  "observed_by", "review_ready", "claim_reconciliation", "repository_verify",
+  "observed_by", "review_ready", "claim_reconciliation", "repository_verify", "reused_from",
 ]);
 
 export function git(cwd, args, { runner = spawnSync } = {}) {
@@ -204,7 +204,7 @@ export function privilegedPaths(filesChanged) {
     || PRIVILEGED_EXACT.includes(file));
 }
 
-export function buildEvidence({ subject, runId, attempt, branch, baseRef, worktree, status, blockedReason = null, claim = null, testCommand = null, skipReason = null, shellCommand = false, testTimeoutMs = DEFAULT_REPOSITORY_VERIFY_TIMEOUT_MS, repositoryVerify = null, options = {} }) {
+export function buildEvidence({ subject, runId, attempt, branch, baseRef, worktree, status, blockedReason = null, claim = null, testCommand = null, skipReason = null, shellCommand = false, testTimeoutMs = DEFAULT_REPOSITORY_VERIFY_TIMEOUT_MS, repositoryVerify = null, reused = null, options = {} }) {
   // Cleanliness is established before anything else is observed, because every later
   // fact - the diff, the commit, and above all the test result - is only about the
   // recorded commit if the tree has nothing uncommitted in it.
@@ -212,20 +212,26 @@ export function buildEvidence({ subject, runId, attempt, branch, baseRef, worktr
   const observation = observeWorktree(worktree, baseRef, options);
   // Tests are not run at all against a dirty tree: running them would produce a
   // result about bytes that are not going to merge.
-  const tests = cleanliness.clean
+  // `reused` carries a slice's green repository verify for a merge whose tree is byte-identical (#374).
+  const tests = cleanliness.clean && reused ? reused.tests : cleanliness.clean
     ? runTests(worktree, testCommand, { ...options, skipReason, shellCommand, timeoutMs: testTimeoutMs,
-      ...(shellCommand ? { env: { ...process.env, FACTORY_VERIFY_SCOPE: "integration" } } : {}) })
+      // Output to stderr, stdin inherited: `slice merged --json` and `observe --json` stay one JSON object.
+      ...(shellCommand ? { stdio: ["inherit", 2, 2] } : {}) })
     : { cmd: testCommand ? (shellCommand ? testCommand : testCommand.join(" ")) : null, exit: null, observed: false, skipped_reason: null };
   // Enforcement (false green, #372): a slice ran only its ratified test command, so the repository's
   // configured `verify` (lint, format, full suite) first ran after merge, where production repair is
   // forbidden and one Clippy warning parked a 13-slice run. The same suite now runs on the slice's commit.
   // Skipped after a failing test run, which is already not review-ready; its output goes to stderr so
-  // `observe --json` stays one JSON object. `FACTORY_VERIFY_SCOPE` tells the command which run this is.
-  const verifyRuns = repositoryVerify && cleanliness.clean && !(tests.observed && tests.exit !== 0);
+  // `observe --json` stays one JSON object. A bootstrap refusal (#376) means the tree is not prepared, so the
+  // verify does not run and the refusal is the evidence's blocked reason.
+  // Bootstrap is the verify's own first step (#376 review): it runs only when the verify will, and after the
+  // ratified test, so nothing the test does can remove its output before the verify reads it.
+  const eligible = repositoryVerify && cleanliness.clean && !(tests.observed && tests.exit !== 0);
+  const bootstrapRefusal = eligible ? repositoryVerify.prepare?.() ?? null : null;
+  const verifyRuns = eligible && !bootstrapRefusal;
   const verified = !repositoryVerify ? null : verifyRuns
     ? (({ cmd, exit, observed }) => ({ cmd, exit, observed }))(runTests(worktree, repositoryVerify.command,
-      { ...options, shellCommand: true, timeoutMs: repositoryVerify.timeoutMs, stdio: ["ignore", 2, 2],
-        env: { ...process.env, FACTORY_VERIFY_SCOPE: "slice" } }))
+      { ...options, shellCommand: true, timeoutMs: repositoryVerify.timeoutMs, stdio: ["ignore", 2, 2] }))
     : { cmd: repositoryVerify.command, exit: null, observed: false };
 
   // Third round, finding 1: cleanliness was a pre-test snapshot, so a test that wrote
@@ -257,7 +263,8 @@ export function buildEvidence({ subject, runId, attempt, branch, baseRef, worktr
     base_ref: baseRef,
     worktree,
     status,
-    blocked_reason: blockedReason ?? cleanliness.reason ?? (stableUnderTest ? null : "worktree changed while the tests ran"),
+    blocked_reason: blockedReason ?? cleanliness.reason ?? bootstrapRefusal
+      ?? (stableUnderTest ? null : "worktree changed while the tests ran"),
     // Named for what it asserts: clean before the run, still clean after, and HEAD did
     // not move. A pre-test snapshot alone was not enough.
     worktree_clean: stableUnderTest,
@@ -271,6 +278,7 @@ export function buildEvidence({ subject, runId, attempt, branch, baseRef, worktr
     review_ready: false,
     claim_reconciliation: { claimed: false, mismatches: [] },
     repository_verify: verified,
+    ...(reused ? { reused_from: reused.commit } : {}),
   };
   evidence.claim_reconciliation = reconcileClaim(claim, evidence);
   evidence.review_ready = deriveReviewReady(evidence);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "feature-factory",
-  "version": "0.10.7",
+  "version": "0.10.8",
   "description": "Durable, observed control plane for /feature runs. Host-agnostic: no opencode dependency.",
   "type": "module",
   "license": "MIT",