pi-aia-asf 0.17.11 → 0.17.13

package/CHANGELOG.md

@@ -7,6 +7,59 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.17.13] - 2026-11-10
+
+### Changed — no scale means small (PO policy)
+
+PO decision: "If no scale, assume small." `currentScale()` used to judge a run with no
+recorded scale as **standard**, unless an earlier `/asf small` in the same process had
+flipped a global flag. That meant two things. First, the same unscaled run got a
+different verdict depending on what a previous run had done. Second, the run card
+printed the raw field ("unset", or "small") while the gate demanded standard's
+`/asf health` and full suite. The stuck sessions this produced were unreadable from the
+card alone.
+
+- `currentScale()` now returns small for an unset scale. Explicit `large` still judges
+  major and explicit `standard` still judges standard, so the change cannot widen.
+- The default in `sessionFacts` and `decideSettlement` is small too, so a caller that
+  forgets to pass a scale gets the floor rather than a ceremony nobody chose. The floor
+  itself still holds: changed source still needs a real test run.
+- The run card, `/asf status` and `/asf verify` print the scale the gate judges by.
+  Unset reads "unset — judged small", never a bare "unset".
+- `runtime.lastScaleWasSmall` and `markSmallScale()` are deleted. With small as the
+  default the flag decided nothing, and a field that reads as load-bearing but is not
+  is how this disagreement started.
+
+The reachable scale-less path is pinned: `/asf verify` calls `setPhase` without a scale,
+and `setPhase` only writes the field when given one. `test/test-scale-policy.mjs` covers
+that path end to end, along with the judged scale, settlement and the card. Five
+mutations, one per layer, are each caught.
+
+## [0.17.12] - 2026-11-10
+
+### Fixed — the health gate measured the wrong project
+
+`runRoot()` is the git root of the session's cwd. That is right for where run state
+lives and wrong for what to measure, and a session launched from a home directory that
+is itself a git repo (common: `pi` started from $HOME with checkouts underneath) had
+every health gate measure the parent. It did: `asf_health` reported 363 model findings
+from an unrelated project checked out under $HOME, and eslint, madge and jscpd each
+timed out at 120s scanning a tree nobody was working in — a verdict of NOT healthy on a
+repository that is, in fact, healthy.
+
+A gate that measures the wrong directory is worse than no gate: it blocks on findings
+in code the run must not touch, or waves through the one project that is actually
+unhealthy. `measureRoot()` now answers from what the run already knows — the git root of
+the most recently touched file — and is used by the three paths that measure
+(`asf_health`, `/asf health`, `/asf verify` Gate 8). It is deliberately **not** used to
+locate state: a root that moved mid-run would orphan the run's own ledger, so
+`runRoot()` still follows the session for that.
+
+A touched path outside the workspace (a scratch dir, an unrelated checkout) does not
+move the measurement either — the session root is the safe answer. `test/test-measure-root.mjs`
+pins both on throwaway repos rather than this machine's $HOME, and both guards are
+mutation-caught.
+
 ## [0.17.11] - 2026-11-10
 
 ### Added — the coverage invariant is checkable from the installed package

package/lib/extension/commands/index.ts

@@ -9,7 +9,7 @@ import type { ExtensionAPI, ExtensionCommandContext } from "@earendil-works/pi-c
 import { setPhase, runApprove } from "./session.ts";
 import { cmdVerify } from "./verify.ts";
 import { cmdStatus, cmdHealth, cmdRules, cmdConfig, cmdReport, cmdGates, cmdCard } from "./inspect.ts";
-import { cmdPassive, cmdAbort, helpText, markSmallScale } from "./run-control.ts";
+import { cmdPassive, cmdAbort, helpText } from "./run-control.ts";
 
 type Command = (args: string[], ctx: ExtensionCommandContext) => Promise<string> | string;
 
@@ -18,10 +18,7 @@ const COMMANDS: Record<string, Command> = {
   feature: (_a, ctx) => setPhase(ctx, { phase: "intake", workType: "feature", scale: "large" }),
   bugfix: (_a, ctx) => setPhase(ctx, { phase: "intake", workType: "major-bugfix", scale: "large" }),
   refactor: (_a, ctx) => setPhase(ctx, { phase: "intake", workType: "refactor", scale: "large" }),
-  small: (_a, ctx) => {
-    markSmallScale();
-    return setPhase(ctx, { phase: "implementation", scale: "small" });
-  },
+  small: (_a, ctx) => setPhase(ctx, { phase: "implementation", scale: "small" }),
   status: () => cmdStatus(),
   verify: (_a, ctx) => cmdVerify(ctx),
   health: (a) => cmdHealth(a),

package/lib/extension/commands/inspect.ts

@@ -7,7 +7,7 @@ import { projectName, runRoot } from "../paths.ts";
 import { loadState } from "../state.ts";
 import { ledger, authority, gateStats } from "../gate-state.ts";
 import { runtime } from "../runtime.ts";
-import { cardFor, collectMeasurements, extensionDir } from "../run.ts";
+import { cardFor, collectMeasurements, currentScale, extensionDir, measureRoot } from "../run.ts";
 import { renderLedger } from "../../gates/ledger.mjs";
 import { renderAuthority } from "../../gates/authority.mjs";
 import { renderCompletionGate } from "../../gates/settle.mjs";
@@ -22,12 +22,12 @@ export async function cmdStatus(): Promise<string> {
   if (!state.current) return "No active ASF session.";
   const cur = state.current;
   const floor =
-    cur.scale === "small" ? " (floor: a real test run and evidence; no plan/approval gates)" : "";
+    currentScale(cur) === "small" ? " (floor: a real test run and evidence; no plan/approval gates)" : "";
   const auto = cur.auto ? " — opened automatically by software work" : "";
   return (
     `ASF status (${project}):\n` +
     `  work type: ${cur.workType || "unset"}\n` +
-    `  scale: ${cur.scale || "unset"}${floor}${auto}\n` +
+    `  scale: ${cur.scale ? cur.scale : `unset — judged ${currentScale(cur)}`}${floor}${auto}\n` +
     `  phase: ${cur.phase}\n` +
     `  plan approved: ${cur.planApproved ? "yes" : "no"}\n` +
     (cur.passiveRunId && cur.passiveRunId === cur.runId ? `  passive: this run only\n` : "") +
@@ -41,7 +41,7 @@ export async function cmdStatus(): Promise<string> {
 export async function cmdHealth(args: string[]): Promise<string> {
   const { runHealth } = await import("../../code-health/index.mjs");
   const { recordHealthVerdict, recordLine } = await import("../health-record.ts");
-  const res = await runHealth(runRoot(), args.slice(1));
+  const res = await runHealth(await measureRoot(), args.slice(1));
   // The command records what it measured. Before this, only the asf_health TOOL
   // recorded: a human could run /asf health, read HEALTHY, and leave the
   // completion gate's health gap open with no trace that anything was measured.

package/lib/extension/commands/run-control.ts

@@ -10,7 +10,6 @@ import { newRunId } from "../run.ts";
 import { dependencySummary } from "../deps.ts";
 import { setPhase } from "./session.ts";
 import type { ExtensionCommandContext } from "@earendil-works/pi-coding-agent";
-import { runtime } from "../runtime.ts";
 
 export async function cmdPassive(): Promise<string> {
   const project = projectName();
@@ -52,7 +51,3 @@ export function helpText(): string {
   );
 }
 
-/** `small` is a scale the next run inherits; recorded here, not in the switch. */
-export function markSmallScale(): void {
-  runtime.lastScaleWasSmall = true;
-}

package/lib/extension/commands/verify.ts

@@ -6,6 +6,7 @@
  */
 
 import { projectName, runRoot } from "../paths.ts";
+import { measureRoot } from "../run.ts";
 import { loadState } from "../state.ts";
 import { loadProjectSpecs, validateTrace } from "../specs.ts";
 import { QA_CHECKLIST, type SpecItem } from "../types.ts";
@@ -56,7 +57,7 @@ async function traceabilitySection(): Promise<string[]> {
 async function healthSection(): Promise<string[]> {
   const { runHealth } = await import("../../code-health/index.mjs");
   const { recordHealthVerdict, recordLine } = await import("../health-record.ts");
-  const health = await runHealth(runRoot(), []);
+  const health = await runHealth(await measureRoot(), []);
   // Same rule as the tool and the slash command: a measurement that is produced
   // is a measurement that is recorded.
   const rec = recordHealthVerdict(health, { by: "verify" });
@@ -88,10 +89,9 @@ function scaleLine(scale: string | undefined): string {
   const suffix =
     scale === "large"
       ? " — mechanical traceability gate ACTIVE"
-      : scale === "small"
-        ? " (floor only — no mechanical traceability gate)"
-        : "";
-  return `Scale: ${scale || "unset"}${suffix}`;
+      : " (floor only — no mechanical traceability gate)";
+  // Unset is judged small (PO policy); say so instead of printing a bare "unset".
+  return `Scale: ${scale || "unset — judged small"}${suffix}`;
 }
 
 export async function cmdVerify(ctx: ExtensionCommandContext): Promise<string> {

package/lib/extension/run.ts

@@ -4,16 +4,16 @@
  */
 
 import { execFileSync } from "node:child_process";
+import { runRoot, projectName } from "./paths.ts";
 import { fileURLToPath } from "node:url";
 import { dirname } from "node:path";
-import { runRoot } from "./paths.ts";
+import { projectRoot as projectRootOf } from "../project.mjs";
 import { ensureHome } from "../home.mjs";
 import { cpus, loadavg } from "node:os";
 import { renderRunCard, cardSummary, CARD_CEILING_BYTES } from "../run-card.mjs";
 import { ledger, suiteRuns, gateStats } from "./gate-state.ts";
 import { appendEvidence } from "./evidence.ts";
 import { loadState, saveState } from "./state.ts";
-import { projectName } from "./paths.ts";
 import { runtime } from "./runtime.ts";
 import { __resetRefusals } from "../gates/refusals.mjs";
 import { cardIndex, registerAt } from "../decisions/consult.mjs";
@@ -62,7 +62,10 @@ export function cardFor(state: AsfState | null, nextStep?: string, remedy?: stri
         : `advance the ${state.phase} phase`);
   const card = renderRunCard({
     phase: state.phase,
-    scale: state.scale,
+    // The scale the gate judges by, not the raw field: an unset scale is judged
+    // small, and a card that printed "unset" (or the raw value) while the gate held
+    // the run to another scale is how a stuck run became unreadable.
+    scale: currentScale(state),
     workType: state.workType,
     objective: state.objective,
     openDod,
@@ -118,6 +121,43 @@ export async function openAutoRun(trigger: string, path: string | null): Promise
   return state;
 }
 
+/**
+ * The project the gates should MEASURE.
+ *
+ * `runRoot()` is the git root of the session's cwd, which is right for where state
+ * lives and wrong for what to measure: a session started in a parent repository
+ * (a home directory that is itself a git repo is the common case) would have every
+ * gate measure that parent. It did — `asf_health` reported 363 model findings from an
+ * unrelated project checked out underneath $HOME, and every measurement tool then
+ * timed out scanning a tree nobody was working in. A gate that measures the wrong
+ * directory is worse than no gate: it blocks on findings in code the run must not
+ * touch, or waves through the one project that is actually unhealthy.
+ *
+ * The run already knows what it changed, so the answer is taken from there: the git
+ * root of the most recently touched file wins. It is deliberately NOT used to locate
+ * state — a root that moved mid-run would orphan the run's own ledger — only to
+ * decide what a measurement looks at.
+ */
+export async function measureRoot(): Promise<string> {
+  const fallback = runRoot();
+  try {
+    const state = await loadState(projectName());
+    const touched = (state?.current?.filesTouched || []) as string[];
+    for (let i = touched.length - 1; i >= 0; i--) {
+      const f = touched[i];
+      if (!f || !f.includes("/")) continue;
+      const root = projectRootOf(dirname(f));
+      // Only a root that CONTAINS the session root counts as a better answer: a
+      // stray touched path outside the workspace must not drag the measurement to
+      // someone's scratch directory.
+      if (root && (root === fallback || root.startsWith(fallback + "/"))) return root;
+    }
+  } catch {
+    /* measurement falls back to the session root; a broken guess is worse than none */
+  }
+  return fallback;
+}
+
 /** Where this extension is installed — the declaration file ships beside it. */
 
 export function extensionDir(): string {
@@ -166,10 +206,24 @@ export function numberConfig(config: Record<string, unknown>, key: string, fallb
   return typeof v === "number" && Number.isFinite(v) ? v : fallback;
 }
 
-/** Small work is held to the reduced DoD — the scale rule is the trigger here. */
+/**
+ * The scale every gate judges a run by.
+ *
+ * PO policy: "If no scale, assume small." A run nobody scaled — auto-opened, or one
+ * whose scale was never written (`/asf verify` calls setPhase without one) — is held
+ * to the small floor: a real test run and evidence, not the health audit and full
+ * suite that standard demands. Only an explicit reading widens it. This used to fall
+ * back to standard unless an earlier `/asf small` had flipped a process-wide flag, so
+ * the same unscaled run was judged differently depending on what an earlier run in
+ * the same process had done — and the card, which printed the raw field, said "small"
+ * while the gate demanded standard's ceremony.
+ */
 export function currentScale(state?: AsfState | null): "small" | "standard" | "major" {
-  if (state?.scale === "small") return "small";
-  if (state?.scale === "large") return "major";
-  return runtime.lastScaleWasSmall ? "small" : "standard";
+  // Compared as strings: "standard" is not an AsfScale today, but a state file may
+  // carry it (hand-edited, or written by a newer ASF), and it must keep its meaning.
+  const raw = String(state?.scale ?? "");
+  if (raw === "large") return "major";
+  if (raw === "standard") return "standard";
+  return "small";
 }
 

package/lib/extension/runtime.ts

@@ -39,7 +39,6 @@ export interface RuntimeState {
    */
   lastMutationAt: number;
   passiveHeartbeatWritten: boolean;
-  lastScaleWasSmall: boolean;
   /** Re-anchoring is count-limited per run. */
   reanchorsThisRun: number;
   /**
@@ -81,7 +80,6 @@ export const runtime: RuntimeState = {
   blindNudged: false,
   lastMutationAt: 0,
   passiveHeartbeatWritten: false,
-  lastScaleWasSmall: false,
   reanchorsThisRun: 0,
   tracked: createTracked(),
   decisionsRead: [],

package/lib/extension/tools/health.ts

@@ -27,12 +27,12 @@ interface HealthResult {
 
 async function runHealthGate(scope: string): Promise<HealthResult> {
   const { runHealth } = await import("../../code-health/index.mjs");
-  const { runRoot } = await import("../paths.ts");
+  const { measureRoot } = await import("../run.ts");
   const args = scope ? [`--scope=${scope}`] : [];
-  // Measure the RUN's project, not process.cwd(): a session started in $HOME
-  // (or any parent) would otherwise measure everything under it — 960 phantom
-  // findings from site-packages, on a repo that is actually healthy.
-  return (await runHealth(runRoot(), args)) as HealthResult;
+  // Measure the project the RUN is about, not process.cwd() and not the session
+  // cwd's git root: a session started in $HOME (which is itself a repo here) would
+  // otherwise measure every checkout underneath it.
+  return (await runHealth(await measureRoot(), args)) as HealthResult;
 }
 
 /**

package/lib/gates/ledger.mjs

@@ -128,7 +128,9 @@ export function createLedger() {
  * The four session facts P41 checks. A spec says what the deliverable must
  * have; only the harness knows what actually happened this session.
  */
-export function sessionFacts(ledger, { scale = "standard", webTouched = false } = {}) {
+// No scale means small (PO policy) — at this layer too, so a caller that forgets to
+// pass one gets the floor rather than a ceremony nobody chose.
+export function sessionFacts(ledger, { scale = "small", webTouched = false } = {}) {
   const missing = [];
 
   // `/asf health` is a delivery-time check for standard/major runs. An

package/lib/gates/settle.mjs

@@ -211,7 +211,7 @@ function collectGaps(ledger, opts) {
 
 export function decideSettlement(ledger, opts = {}) {
   const { webTouched = false, continuationsSoFar = 0, seenSteers = [] } = opts;
-  const gaps = collectGaps(ledger, { scale: "standard", webTouched, untracedMet: [], reportFields: [], ...opts });
+  const gaps = collectGaps(ledger, { scale: "small", webTouched, untracedMet: [], reportFields: [], ...opts });
 
   const split = splitGaps(gaps);
   const missing = split.blocking;

package/lib/run-card.mjs

@@ -30,7 +30,7 @@ function clip(s, n) {
 /**
  * @param {object} o
  * @param {string} o.phase            the run's current phase
- * @param {string} o.scale            small | large
+ * @param {string} o.scale            the JUDGED scale: small | standard | major
  * @param {string} [o.workType]
  * @param {string} [o.objective]      one line: what this run is for
  * @param {string[]} [o.openDod]      DoD lines still unticked

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-aia-asf",
-  "version": "0.17.11",
+  "version": "0.17.13",
   "description": "Ai Applied Agentic Software Factory — codifies the full software development flow: intake, research, spec capture, adversarial analysis, planning with approval gates, test-first implementation, and release. Requires pi-vigilant, pi-smart-web-search, pi-smart-fetch, and pi-aia-browser.",
   "keywords": [
     "pi-package",