jules-orchestrator-kit 0.74.0 → 0.75.1

package/src/engine.mjs

@@ -1,4 +1,4 @@
-import { loadConfig, resolveTrustedPolicy } from "./config.mjs";
+import { loadConfig, resolveTrustedPolicy, normalizePath } from "./config.mjs";
 import { isTestPath } from "./test-paths.mjs";
 import { isPlaceholderTestScript, isSrcLayout } from "./stack-detector.mjs";
 import { checkCollectionFloor } from "./ops/test-collection.mjs";
@@ -10,9 +10,9 @@ import { withBudget, appendLedger, getQueueDir, ensureDir, rollbackBudgetReserva
 import { resolveDailyLimit, recordObservedCeiling, isDailyQuotaRejection, resolveAmbientIdentity } from "./budget.mjs";
 import { sanitizeUntrustedData, buildAgentEnvelope } from "./prompt-guard.mjs";
 import { recordVerifyRun, readVerifyRuns, flakyVerdict } from "./flaky-ledger.mjs";
-import fs, { readdirSync, readFileSync, renameSync, existsSync } from "node:fs";
+import fs, { readdirSync, readFileSync, writeFileSync, renameSync, existsSync } from "node:fs";
 import { join, basename } from "node:path";
-import { createHash } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { appendTelemetryBestEffort as appendTelemetry } from "./telemetry.mjs";
 
 import { spawn } from "node:child_process";
@@ -207,6 +207,7 @@ export async function gate(opts = {}) {
       process.env.JULES_ALLOW_COMMAND_FILE_CHANGES === "1" ||
       process.env.AGENT_ALLOW_COMMAND_FILE_CHANGES === "true" ||
       process.env.AGENT_ALLOW_COMMAND_FILE_CHANGES === "1",
+    protectedPatterns: trustedScope.protectedPatterns,
   });
   // Report the violation against the link the change actually introduced, not
   // against a path the diff never names — the operator has to be able to find it.
@@ -336,8 +337,18 @@ export async function gate(opts = {}) {
   // failures stop reaching the exit code — the gate then sees exit 0 and
   // approves a change whose tests failed. src/perf.mjs already strips these for
   // the same reason; the gate, which is the one that decides, did not.
+  // Ambient PR waiver labels and HEAD_SHA must also be stripped so verification
+  // suites and child audits run hermetically without inherited waivers.
   for (const key of Object.keys(testEnv)) {
-    if (key.startsWith("NODE_TEST_") || key.startsWith("NODE_CHANNEL_")) delete testEnv[key];
+    if (
+      key.startsWith("NODE_TEST_") ||
+      key.startsWith("NODE_CHANNEL_") ||
+      key === "PR_LABELS" ||
+      key === "HEAD_SHA" ||
+      key.startsWith("JULES_ALLOW_")
+    ) {
+      delete testEnv[key];
+    }
   }
 
   let flakyVerdictResult = null;
@@ -815,12 +826,69 @@ export async function repair(failure, opts = {}) {
     threshold: 2,
   });
 
+  const repairId = `repair-${Date.now()}-${randomUUID().slice(0, 8)}`;
+  let repairDir = null;
+
   let currentFailure = failure;
   const initialFingerprint = fingerprintFailureState(currentFailure, root);
   breaker.observe(initialFingerprint);
   whackAMole.recordTestOutcome(currentFailure.stderr || currentFailure.message);
   let extraPromptDirective = null;
 
+  const persistFailedAttempt = (n, diff, diagnostics) => {
+    const relDir = normalizePath(join(".agent/state/repairs", repairId));
+    const absDir = join(root, relDir);
+    ensureDir(absDir);
+    const patchName = `attempt-${n}.patch`;
+    const diagName = `attempt-${n}-diagnostics.json`;
+    const patchRel = normalizePath(join(relDir, patchName));
+    const diagRel = normalizePath(join(relDir, diagName));
+    writeFileSync(join(absDir, patchName), redactSecrets(String(diff || "")), "utf-8");
+    const payload = {
+      ...diagnostics,
+      patchPath: patchRel,
+      diagnosticsPath: diagRel,
+    };
+    writeFileSync(join(absDir, diagName), JSON.stringify(payload, null, 2) + "\n", "utf-8");
+    repairDir = relDir;
+    return payload;
+  };
+
+  const captureAttemptDiff = () => {
+    try {
+      // Working-tree mode retains what the repair attempt left on disk; the
+      // default committed mode only shows the last commit and would hide
+      // uncommitted agent edits that operators need to review.
+      const base = config.baseBranch || config.base || "main";
+      return diffText(root, base, "working-tree") || "";
+    } catch (_) {
+      return "";
+    }
+  };
+
+  const buildGateDiagnostics = (gateRes) => {
+    const failingPhase = (gateRes.phases || []).find((p) => p && p.ok === false) || null;
+    const verifyPhase = (gateRes.phases || []).find((p) => p && p.phase === "verify") || null;
+    const failureInfo = verifyPhase?.failure || null;
+    const testResult = verifyPhase?.testResult || null;
+    const stderr = failureInfo?.stderr || testResult?.stderr || gateRes.error || "";
+    const stdout = failureInfo?.stdout || testResult?.stdout || "";
+    return {
+      code: gateRes.code ?? null,
+      phase: failingPhase?.phase || "verify",
+      command: failureInfo?.command || testResult?.command || null,
+      exitCode: failureInfo?.exitCode ?? testResult?.status ?? null,
+      stderr: redactSecrets(String(stderr).slice(0, 8000)),
+      stdout: redactSecrets(String(stdout).slice(0, 4000)),
+      messages: Array.isArray(failureInfo?.diagnostics) ? failureInfo.diagnostics.map((d) => redactSecrets(String(d))) : [],
+      error: redactSecrets(
+        String(gateRes.error || failureInfo?.stderr || testResult?.stderr || "Gate re-verification failed")
+          .split("\n")[0]
+          .slice(0, 500)
+      ),
+    };
+  };
+
   for (let n = 1; n <= maxRetries; n++) {
     if (progressBus && progressToken) {
       progressBus.reportProgress(progressToken, Math.round((n / maxRetries) * 100), 100, `OODA Repair attempt ${n}/${maxRetries}`);
@@ -847,7 +915,14 @@ export async function repair(failure, opts = {}) {
         const retryAfterMs = err.retryAfterMs || 60000;
         const backoffSec = Math.ceil(retryAfterMs / 1000);
         console.warn(`[PROVIDER_INFRASTRUCTURE_FAILURE] ${err.name}: ${err.message}. Recommended backoff: ${backoffSec}s.`);
-        attempts.push({ n, ok: false, error: err.message, providerError: true, retryAfterMs });
+        attempts.push({
+          n,
+          ok: false,
+          phase: "dispatch",
+          error: err.message,
+          providerError: true,
+          retryAfterMs,
+        });
         appendTelemetry(root, "ooda_repair_attempt", { attempt: n, ok: false, error: err.message, providerError: true });
         return {
           ok: false,
@@ -856,9 +931,10 @@ export async function repair(failure, opts = {}) {
           error: err.message,
           retryAfterMs,
           providerError: true,
+          repairDir,
         };
       }
-      attempts.push({ n, ok: false, error: err.message });
+      attempts.push({ n, ok: false, phase: "dispatch", error: err.message });
       appendTelemetry(root, "ooda_repair_attempt", { attempt: n, ok: false, error: err.message });
       break;
     }
@@ -871,6 +947,11 @@ export async function repair(failure, opts = {}) {
         dryRun: opts.dryRun,
         pollIntervalMs: opts.pollIntervalMs,
         maxPollAttempts: opts.maxPollAttempts,
+        autoApprovePlan: opts.autoApprovePlan || opts.autoApprove,
+        autoReply: opts.autoReply,
+        maxAutoReplies: opts.maxAutoReplies,
+        autoReplyFn: opts.autoReplyFn,
+        task: opts.task || { id: `repair-${n}`, title: `OODA Auto-Repair Attempt ${n}`, prompt: repairPrompt },
       });
 
       // The gate below is the authority on whether the change works, so it runs
@@ -898,17 +979,21 @@ export async function repair(failure, opts = {}) {
       }
     }
 
-    attempts.push({
-      n,
-      session,
-      ok: true,
-      poll: pollVerdict ? { status: pollVerdict.status, terminal: pollVerdict.terminal } : null,
-    });
-    appendTelemetry(root, "ooda_repair_attempt", { attempt: n, ok: true });
+    const poll = pollVerdict ? { status: pollVerdict.status, terminal: pollVerdict.terminal } : null;
 
     // Re-verify after repair attempt
     const gateRes = await gate({ root, config, fix: false, progressBus, progressToken });
+    const attemptDiff = captureAttemptDiff();
     if (gateRes.ok) {
+      attempts.push({
+        n,
+        session,
+        ok: true,
+        verified: true,
+        diff: attemptDiff,
+        poll,
+      });
+      appendTelemetry(root, "ooda_repair_attempt", { attempt: n, ok: true, verified: true });
       breaker.reset();
       whackAMole.reset();
       recordRemediation(root, {
@@ -917,9 +1002,27 @@ export async function repair(failure, opts = {}) {
         remediationHint: `Resolved on repair attempt #${n}`,
         targetFiles: currentFailure.targetFiles || [],
       });
-      return { ok: true, attempts, finalStatus: "PASSED" };
+      return { ok: true, attempts, finalStatus: "PASSED", repairDir };
     }
 
+    const diagnostics = persistFailedAttempt(n, attemptDiff, buildGateDiagnostics(gateRes));
+    attempts.push({
+      n,
+      session,
+      ok: false,
+      verified: false,
+      diff: attemptDiff,
+      diagnostics,
+      poll,
+    });
+    appendTelemetry(root, "ooda_repair_attempt", {
+      attempt: n,
+      ok: false,
+      verified: false,
+      code: gateRes.code ?? null,
+      phase: diagnostics.phase,
+    });
+
     currentFailure = gateRes.phases.find((p) => p.phase === "verify")?.testResult || failure;
     const currentFingerprint = fingerprintFailureState(currentFailure, root);
 
@@ -943,6 +1046,7 @@ export async function repair(failure, opts = {}) {
         finalStatus: "DETERMINISTIC_REGRESSION",
         reason: `Identical failure state fingerprint (${currentFingerprint}) observed during attempt #${n}`,
         fingerprint: currentFingerprint,
+        repairDir,
       };
     }
   }
@@ -963,39 +1067,66 @@ export async function repair(failure, opts = {}) {
     });
   } catch (_) {}
 
-  return { ok: false, attempts, finalStatus: "OODA_EXHAUSTED" };
+  return { ok: false, attempts, finalStatus: "OODA_EXHAUSTED", repairDir };
 
 }
 
 /**
- * Polls an async provider for terminal session state (COMPLETED / FAILED) before re-verification.
- */
-/**
- * Evaluates whether a task's verification oracle or goal is already satisfied on the current working tree.
- * Prevents redundant session dispatch and API budget burning.
+ * A passing generic test suite does not prove that a requested feature exists.
+ * Only an explicit goal-specific check may suppress dispatch. This is advisory:
+ * the supplied command must return 0 exactly when the requested state exists.
  */
 export async function checkTaskPremise(task = {}, opts = {}) {
   const root = opts.config?._root || opts.root || process.cwd();
-  const verifyCmd = task.verifyCmd || task.verify;
-  if (!verifyCmd) {
-    return { satisfied: false, reason: "No verification oracle specified for pre-flight premise check." };
+  const goalCheck = task.goalCheck ?? opts.goalCheck;
+  const evidence = { revision: null, goalCheckSha256: null, exitCode: null, durationMs: null };
+  const unknown = (reasonCode, reason) => ({ satisfied: false, status: "UNKNOWN", reasonCode, reason, evidence });
+  if (typeof goalCheck !== "string" || !goalCheck.trim()) {
+    return unknown("NO_GOAL_CHECK", "No explicit goal-specific check supplied; a passing verification suite is not proof that the task is complete.");
   }
-
-  const { runVerificationProbe } = await import("./wizard-oracle.mjs");
-  const probe = await runVerificationProbe(verifyCmd, root, { timeoutMs: opts.timeoutMs || 30_000 });
-  if (probe.ok) {
-    return {
-      satisfied: true,
-      reason: `Verification oracle '${verifyCmd}' already passes cleanly with exit code 0 on base branch.`,
-      durationMs: probe.durationMs,
-    };
+  const command = goalCheck.trim();
+  evidence.goalCheckSha256 = sha256(command);
+  if (isPlaceholderTestScript(command)) {
+    return unknown("PLACEHOLDER_GOAL_CHECK", "Goal check is a no-op or incapable of establishing the requested state.");
+  }
+  const genericCommands = [
+    task.verifyCmd, task.verify,
+    opts.config?.verify?.test, opts.config?.verify?.unit,
+    opts.config?.verify?.lint, opts.config?.verify?.build,
+  ].filter((value) => typeof value === "string").map((value) => value.trim());
+  if (genericCommands.includes(command)) {
+    return unknown("GENERIC_VERIFY_IS_NOT_GOAL_PROOF", "Goal check matches the generic verification command; provide a separate objective-specific condition.");
   }
 
-  return {
-    satisfied: false,
-    reason: `Verification oracle '${verifyCmd}' failed (exit ${probe.code}), proving task need.`,
-    durationMs: probe.durationMs,
+  // The check runs against the working tree. A clean tree and stable HEAD are
+  // prerequisites for attributing a successful result to a committed revision.
+  const snapshot = () => {
+    try {
+      const head = runCmd(["git", "rev-parse", "HEAD"], { cwd: root, ignoreError: true, timeout: 5000 });
+      const state = runCmd(["git", "status", "--porcelain", "--untracked-files=all"], { cwd: root, ignoreError: true, timeout: 5000 });
+      if (head.status !== 0 || state.status !== 0 || !/^[0-9a-f]{40,64}$/.test(head.stdout.trim())) return null;
+      return { revision: head.stdout.trim(), clean: !state.stdout.trim() };
+    } catch (_) {
+      return null;
+    }
   };
+  const before = snapshot();
+  if (!before) return unknown("GIT_STATE_UNAVAILABLE", "Cannot establish the Git revision and working-tree state.");
+  evidence.revision = before.revision;
+  if (!before.clean) return unknown("DIRTY_WORKTREE", "The working tree is not clean; goal proof cannot be attributed to the committed revision.");
+
+  const { runVerificationProbe } = await import("./wizard-oracle.mjs");
+  const probe = await runVerificationProbe(command, root, { timeoutMs: opts.timeoutMs || 30_000 });
+  evidence.exitCode = probe.code;
+  evidence.durationMs = probe.durationMs;
+  const after = snapshot();
+  if (!after || after.revision !== before.revision || !after.clean) {
+    return unknown("GIT_STATE_CHANGED", "The goal check changed the repository state or revision; its result cannot justify skipping dispatch.");
+  }
+  if (!probe.ok) {
+    return { satisfied: false, status: "NOT_PROVEN", reasonCode: "GOAL_CHECK_NOT_SATISFIED", reason: "The goal-specific check did not establish the requested state.", evidence };
+  }
+  return { satisfied: true, status: "PROVEN", reasonCode: "GOAL_CHECK_SATISFIED", reason: "Explicit goal-specific check passed on an unchanged, clean Git revision.", evidence };
 }
 
 /**
@@ -1013,6 +1144,54 @@ export const TERMINAL_SESSION_STATES = new Set(["COMPLETED", "FAILED"]);
  */
 export const BLOCKING_SESSION_STATES = new Set(["AWAITING_PLAN_APPROVAL", "AWAITING_USER_FEEDBACK", "PAUSED"]);
 
+/**
+ * Synthesizes an autonomous, envelope-grounded reply directive when Jules halts
+ * in AWAITING_USER_FEEDBACK during unattended execution.
+ *
+ * @param {object|null} task - Task envelope or task definition object.
+ * @param {string} [question] - Extracted question text from the agent.
+ * @returns {string} Deterministic directive for the agent to continue.
+ */
+export function buildAutoReplyPrompt(task = null, question = "") {
+  const parts = [];
+  parts.push("Autonomous execution directive:");
+
+  if (task && typeof task === "object") {
+    const scope = task.scope?.allow || task.allowedFiles || task.targetFiles;
+    if (Array.isArray(scope) && scope.length > 0) {
+      parts.push(`- Scope constraint: modify only files matching ${scope.join(", ")}.`);
+    }
+
+    const invariants = Array.isArray(task.invariants) ? task.invariants : [];
+    if (invariants.length > 0) {
+      parts.push(`- Invariants: ${invariants.slice(0, 5).join("; ")}.`);
+    }
+
+    if (task.title || task.objective) {
+      parts.push(`- Objective: ${task.title || task.objective}.`);
+    }
+
+    if (task.clarifications && typeof task.clarifications === "object") {
+      const entries = Object.entries(task.clarifications);
+      if (entries.length > 0) {
+        const qLower = String(question || "").toLowerCase();
+        for (const [k, v] of entries) {
+          if (qLower.includes(k.toLowerCase())) {
+            parts.push(`- Pre-approved clarification (${k}): ${v}`);
+          }
+        }
+      }
+    }
+  }
+
+  parts.push(
+    "- Decision rule: Make reasonable engineering assumptions that satisfy tests and maintain existing API contracts.",
+    "- Do not pause for human confirmation or additional feedback. Proceed with implementation, verification, and completion."
+  );
+
+  return parts.join("\n");
+}
+
 /**
  * Polls the provider until the session reaches a terminal state, blocks on an
  * actor, or the poll budget runs out.
@@ -1054,6 +1233,8 @@ export async function pollSessionState(provider, session, opts = {}) {
   const startTime = Date.now();
   let lastStatus = "";
   let polls = 0;
+  const repliedActivityIds = new Set();
+  let autoRepliesCount = 0;
 
   for (let attempt = 0; attempt < maxAttempts; attempt++) {
     if (Date.now() - startTime > timeoutMs) break;
@@ -1109,6 +1290,102 @@ export async function pollSessionState(provider, session, opts = {}) {
         }
       }
 
+      // Autonomously answer clarifying questions if requested
+      const isUserFeedback = status === "AWAITING_USER_FEEDBACK";
+      const wantsAutoReply = Boolean(opts.autoReply || session.autoReply);
+      const canSend = provider && (typeof provider.sendMessage === "function" || typeof provider.resume === "function");
+      if (isUserFeedback && wantsAutoReply && canSend) {
+        const maxAutoReplies = Number(opts.maxAutoReplies ?? session.maxAutoReplies ?? 3);
+        if (autoRepliesCount >= maxAutoReplies) {
+          return {
+            ...currentSession,
+            status,
+            terminal: false,
+            blockedOn: status,
+            autoReplyLimitExceeded: true,
+            autoReplies: autoRepliesCount,
+            polls,
+          };
+        }
+
+        let question = "";
+        let activityId = null;
+        if (typeof provider.listActivities === "function") {
+          try {
+            const actRes = await provider.listActivities(session.id, opts);
+            const activities = Array.isArray(actRes?.activities) ? actRes.activities : [];
+            for (let i = activities.length - 1; i >= 0; i--) {
+              const act = activities[i];
+              const msg = act.agentMessaged?.agentMessage || act.message;
+              if (msg) {
+                question = String(msg).trim();
+                activityId = act.name || act.id || null;
+                break;
+              }
+            }
+          } catch (_) {}
+        }
+
+        // Idempotency: If this activity was already answered, wait for the agent to advance rather than duplicate
+        if (activityId && repliedActivityIds.has(activityId)) {
+          await new Promise((resolve) => setTimeout(resolve, pollIntervalMs));
+          continue;
+        }
+
+        let reply = "";
+        const taskContext = opts.task || session.task || null;
+        if (typeof opts.autoReplyFn === "function") {
+          try {
+            reply = await opts.autoReplyFn({ session: currentSession, question, activityId, task: taskContext });
+          } catch (err) {
+            return {
+              ...currentSession,
+              status,
+              terminal: false,
+              blockedOn: status,
+              autoReplyError: `autoReplyFn failed: ${err.message}`,
+              autoReplies: autoRepliesCount,
+              polls,
+            };
+          }
+        } else {
+          reply = buildAutoReplyPrompt(taskContext, question);
+        }
+
+        if (activityId) {
+          repliedActivityIds.add(activityId);
+        }
+
+        try {
+          const sendFn = typeof provider.sendMessage === "function"
+            ? provider.sendMessage.bind(provider)
+            : provider.resume.bind(provider);
+          await sendFn(session.id, reply, opts);
+          autoRepliesCount += 1;
+          if (opts.root) {
+            appendTelemetry(opts.root, "session_auto_reply", {
+              sessionId: session.id,
+              question: question ? question.slice(0, 300) : null,
+              reply: reply ? reply.slice(0, 300) : null,
+              replyCount: autoRepliesCount,
+              activityId,
+            });
+          }
+          await new Promise((resolve) => setTimeout(resolve, pollIntervalMs));
+          continue;
+        } catch (err) {
+          return {
+            ...currentSession,
+            status,
+            terminal: false,
+            blockedOn: status,
+            autoReplyError: err && err.message ? err.message : String(err),
+            autoReplies: autoRepliesCount,
+            polls,
+          };
+        }
+      }
+
       return { ...currentSession, status, terminal: false, blockedOn: status, polls };
     }
 
@@ -1181,17 +1458,28 @@ export async function dispatch(task = {}, opts = {}) {
     throw new Error(`Task prompt exceeds maximum payload limit of ${config.limits.promptKb} KB`);
   }
 
-  // Pre-flight idempotency premise check
-  if (opts.checkPremise || task.checkPremise) {
-    const premise = await checkTaskPremise(task, { root, config });
-    if (premise.satisfied) {
-      return {
-        id: "premise-already-satisfied",
-        status: "ALREADY_SATISFIED",
-        skipped: true,
-        reason: premise.reason,
-      };
-    }
+  // Record both positive and negative decisions. A generic green test suite
+  // must never be mistaken for proof that a requested task is complete.
+  const premiseRequested = Boolean(opts.checkPremise || task.checkPremise);
+  const premise = premiseRequested
+    ? (opts.dryRun
+        ? { satisfied: false, reasonCode: "DRY_RUN", reason: "Preview does not execute the goal check.", evidence: { revision: null, goalCheckSha256: null, exitCode: null, durationMs: null } }
+        : await checkTaskPremise(task, { root, config }))
+    : { satisfied: false, reasonCode: "PREMISE_CHECK_NOT_REQUESTED", evidence: null };
+  appendTelemetry(root, "dispatch_decision", {
+    taskId: task.id || task.taskId || null,
+    decision: premise.satisfied ? "SKIP" : "DISPATCH",
+    reasonCode: premise.reasonCode,
+    evidence: premise.evidence,
+  });
+  if (premise.satisfied) {
+    return {
+      id: "premise-already-satisfied",
+      status: "ALREADY_SATISFIED",
+      skipped: true,
+      reason: premise.reason,
+      evidence: premise.evidence,
+    };
   }
 
   // Redact secrets in prompt before dispatching
@@ -1608,7 +1896,13 @@ export async function probeDevServer(serverConfig = {}, root = process.cwd()) {
         if (isWin) {
           spawn("taskkill", ["/pid", String(child.pid), "/T", "/F"], { stdio: "ignore" });
         } else {
-          process.kill(-child.pid, "SIGTERM");
+          const pgid = -child.pid;
+          process.kill(pgid, "SIGTERM");
+          setTimeout(() => {
+            try {
+              process.kill(pgid, "SIGKILL");
+            } catch (_) {}
+          }, 2000).unref();
         }
       } catch (_) {}
     }

package/src/evidence.mjs

@@ -135,14 +135,21 @@ export function computeDirectoryHash(root, options = {}) {
     // The named directories stay as a fast path; when they yield nothing, walk
     // the repository and let the shared predicate decide. The walk already
     // skips node_modules, vendor, target and the build caches.
-    const targetDirs = options.directories || ["test", "tests", "__tests__", "spec", "specs", "src"];
+    const targetDirs = options.directories || ["test", "tests", "__tests__", "spec", "specs", "src", "scripts", "bin"];
     for (const dirName of targetDirs) {
       const dirPath = join(root, dirName);
       if (existsSync(dirPath)) {
-        const found = findFilesRecursively(dirPath, root);
-        fileList.push(...found);
+        if (statSync(dirPath).isFile()) {
+          fileList.push(normalizePath(dirName));
+        } else {
+          const found = findFilesRecursively(dirPath, root);
+          fileList.push(...found);
+        }
       }
     }
+    if (existsSync(join(root, "package.json"))) {
+      fileList.push("package.json");
+    }
     if (options.testOnly && !fileList.some((f) => isTestPath(f))) {
       for (const f of findFilesRecursively(root, root)) {
         if (isTestPath(f)) fileList.push(f);
@@ -191,7 +198,8 @@ export function computeDirectoryHash(root, options = {}) {
     }
   }
 
-  const treeHash = "sha256:" + sha256(hashLines.join("\n"));
+  // Join with null byte to prevent path delimiter injection (F-03)
+  const treeHash = "sha256:" + sha256(hashLines.join("\0"));
   return {
     treeHash,
     fileCount: hashLines.length,
@@ -511,9 +519,18 @@ export function verifyEvidenceManifest(root = process.cwd(), manifestOrPath = "m
     return { ok: false, reason: "Evidence manifest hash signature mismatch (tampered file)" };
   }
 
+  // 1.5 Verify recorded execution outcome (F-08)
+  if (manifest.status && !["passed", "success", "ok"].includes(manifest.status)) {
+    return { ok: false, reason: `Evidence manifest records failed execution outcome: ${manifest.status}` };
+  }
+
   // 2. Verify test integrity / No test weakening
   const currentTestState = computeDirectoryHash(root, { testOnly: true });
-  if (manifest.testIntegrity?.tamperDetected) {
+  if (!manifest.testIntegrity?.postTestHash) {
+    return { ok: false, reason: "Evidence manifest is missing test integrity baseline (empty shell)" };
+  }
+
+  if (manifest.testIntegrity.tamperDetected) {
     return {
       ok: false,
       reason: "Test suite tampering detected in evidence manifest",

package/src/git.mjs

@@ -1,4 +1,5 @@
 import { execFileSync, spawnSync } from "node:child_process";
+import { killProcessTree } from "./process-tree.mjs";
 import { readFileSync, existsSync, statSync, lstatSync, readlinkSync, mkdtempSync, rmSync, symlinkSync } from "node:fs";
 import { join, delimiter } from "node:path";
 import { tmpdir } from "node:os";
@@ -215,6 +216,13 @@ export function runCmd(command, opts = {}) {
     throw new GateError("Empty command provided");
   }
 
+  // On POSIX, detach so the child becomes its own process-group leader. Then a
+  // timed-out kill can signal the whole group (`kill(-pid)`) and reap workers
+  // spawned by the command. Windows omits detached: taskkill /T walks the tree
+  // without a separate group, and detached consoles behave differently under
+  // cmd.exe / CreateProcess.
+  const posixDetach = process.platform !== "win32";
+
   try {
     const ret = useShell
       ? spawnSync(shellCmd, {
@@ -225,6 +233,7 @@ export function runCmd(command, opts = {}) {
           env: childEnv,
           timeout,
           maxBuffer,
+          ...(posixDetach ? { detached: true } : {}),
         })
       : spawnSync(winSpawn ? winSpawn.file : binary, winSpawn ? winSpawn.args : args, {
           cwd,
@@ -235,9 +244,15 @@ export function runCmd(command, opts = {}) {
           env: childEnv,
           timeout,
           maxBuffer,
+          ...(posixDetach ? { detached: true } : {}),
         });
 
     const isTimeout = Boolean(ret.error && (ret.error.code === "ETIMEDOUT" || (ret.signal === "SIGTERM" && ret.error.killed)));
+    // Node's spawnSync timeout kills only the direct child; reap the tree so
+    // background workers do not linger (ROADMAP_V1 reliability item).
+    if (isTimeout && ret.pid) {
+      killProcessTree(ret.pid);
+    }
     const isNobufs = Boolean(ret.error && (ret.error.code === "ENOBUFS" || (ret.error.message && ret.error.message.includes("maxBuffer"))));
 
     const status = typeof ret.status === "number" ? ret.status : (isTimeout ? 124 : 1);