rvlib-shipkit 0.38.0 → 1.0.0

package/src/core/repair-contract-dirs.ts

@@ -1,136 +0,0 @@
-// A contract folder typed without its leading dot is INVISIBLE, in every
-// direction at once: the scanner that harvests it looks for the dotted name,
-// the gitignore policy covers the dotted name, and the repo that filed
-// something into it gets silence rather than an error. Files sat unread for a
-// day that way, and nothing anywhere was red.
-//
-// One character, no ambiguity, and nothing about it is a decision: it is a
-// typo, so the fix pass renames it and lands it, and no agent is told. A WARN a
-// machine can repair is a design bug, and an attention surface carries only
-// what needs taste or hands.
-//
-// The names come from the SK004 policy block, which is the one table that
-// already lists the `.rv-*` contract folders. The TRACKED contract dirs
-// (`.rv-identity`, `.rv-assets`) are not in it, and a rename that untracks a
-// tracked folder is not a repair, so the ignore is checked against THIS REPO
-// before anything moves: the venue names in that block carry "ignored until the
-// listing is live, override below the block", so a repo with a live listing
-// tracks `.rv-itch/` on purpose and a rename there would delete its files from
-// the index. `git check-ignore` answers for the repo instead of a regex
-// answering for a comment.
-import { readdirSync, renameSync, rmdirSync } from 'fs'
-import { join } from 'path'
-import { POLICY_LINES } from '../rules/SK004-gitignore-policy.ts'
-import { machineCommit } from './machine-commit.ts'
-import { nestedIn } from './nesting.ts'
-
-/** the always-ignored `.rv-*` contract folders, from the policy that owns them */
-export const contractDirNames = (): string[] =>
-    POLICY_LINES.filter((l) => /^\.rv-[a-z-]+\/$/.test(l)).map((l) => l.slice(0, -1))
-
-/** the shape of a name, ignoring the leading dot, the separators, the case and
- *  a trailing plural. Tight on purpose: `rv-reflections`, `rv_reflection` and
- *  `RV-Reflections` are the same intent, `reflections` and `docs` are not */
-const shapeOf = (s: string): string => s.toLowerCase().replace(/^\.+/, '').replace(/[-_.]/g, '').replace(/s$/, '')
-
-export type DirRepair = { from: string; to: string }
-export type DirRefusal = { from: string; to: string; reason: string }
-export type DirRepairPlan = { repairs: DirRepair[]; refusals: DirRefusal[] }
-
-/**
- * PURE: what to rename, given the names sitting in a repo root.
- *
- * BOTH names present is the one case worth refusing out loud: two folders can
- * hold two files of the same name, and merging them is a choice about which
- * one survives. Nothing else here is a choice.
- */
-export function planContractDirRepairs(entries: string[], names: string[] = contractDirNames()): DirRepairPlan {
-    const present = new Set(entries)
-    const repairs: DirRepair[] = []
-    const refusals: DirRefusal[] = []
-    for (const dotted of names) {
-        const shape = shapeOf(dotted)
-        for (const entry of entries) {
-            if (entry === dotted || shapeOf(entry) !== shape) continue
-            if (present.has(dotted)) refusals.push({ from: entry, to: dotted, reason: 'both names exist, and merging them decides which file wins' })
-            else repairs.push({ from: entry, to: dotted })
-        }
-    }
-    return { repairs, refusals }
-}
-
-const isEmptyDir = (path: string): boolean => {
-    try { return readdirSync(path).length === 0 } catch { return false }
-}
-
-const dirsIn = (root: string): string[] => {
-    try { return readdirSync(root, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name) } catch { return [] }
-}
-
-export type DirRepairResult = { renamed: DirRepair[]; removed: string[]; refusals: DirRefusal[]; uncommitted: DirRepair[] }
-
-/** does THIS repo's ignore policy cover the dotted name (the index is not
- *  consulted: the question is about the patterns, and the path does not exist yet) */
-const isIgnoredHere = (root: string, name: string): boolean =>
-    Bun.spawnSync(['git', 'check-ignore', '-q', '--no-index', `${name}/`], { cwd: root }).exitCode === 0
-
-/** does git track anything under this folder today */
-const isTracked = (root: string, name: string): boolean => {
-    const r = Bun.spawnSync(['git', 'ls-files', '--', name], { cwd: root })
-    return r.exitCode === 0 && r.stdout.toString().trim() !== ''
-}
-
-/**
- * Apply the plan. An EMPTY undotted folder is removed rather than renamed:
- * there is nothing to carry over, git never tracked it, and the dotted name is
- * created by whoever files the first note.
- *
- * A rename UNTRACKS whatever the undotted folder held, and that is the intended
- * end state rather than a side effect: the dotted name is gitignored by
- * contract, so the repo was only tracking those files by accident of the
- * missing dot. Hence a plain rename plus a commit of the OLD path: the commit
- * records the files leaving the index, the files themselves stay on disk under
- * the name every scanner reads, and `git commit -- <old>` matches nothing when
- * git never tracked them, which lands no commit and is the right answer there.
- */
-export function repairContractDirs(root: string): DirRepairResult {
-    const plan = planContractDirRepairs(dirsIn(root))
-    const renamed: DirRepair[] = []
-    const removed: string[] = []
-    const uncommitted: DirRepair[] = []
-    // a nested repo never untracks: the index and the commit are the parent's
-    const nested = plan.repairs.length === 0 ? null : nestedIn(root)
-    for (const r of plan.repairs) {
-        const from = join(root, r.from)
-        const to = join(root, r.to)
-        try {
-            if (isEmptyDir(from)) {
-                rmdirSync(from)
-                removed.push(r.from)
-                continue
-            }
-            // renaming TRACKED files into an ignored path takes them out of the
-            // index, which is the contract for a reflections folder and data
-            // loss for a live venue folder the repo tracks on purpose. So the
-            // untracking half only happens where the repo's own ignore policy
-            // says those files are local. Untracked files rename freely: there
-            // is nothing to lose and nothing to commit
-            const tracked = isTracked(root, r.from)
-            if (tracked && (nested != null || !isIgnoredHere(root, r.to))) continue
-            renameSync(from, to)
-            renamed.push(r)
-            // a repair that half happened is not the silence that was asked
-            // for. the hooks can refuse, SHIPKIT_NO_AUTOCOMMIT can be set, a
-            // merge can be in progress: the rename is still the right end
-            // state, and the dirt it leaves has to be traceable to this run
-            // rather than surfacing as an unexplained refusal in the next bump
-            if (tracked && !machineCommit({ anchor: root, message: `chore(machine): rename ${r.from} to ${r.to}`, paths: [from] })) {
-                uncommitted.push(r)
-            }
-        } catch {
-            // a permission error or a race is not worth a red gate: the folder
-            // stays where it is and the next run tries again
-        }
-    }
-    return { renamed, removed, refusals: plan.refusals, uncommitted }
-}

package/src/core/task-runner.ts

@@ -1,339 +0,0 @@
-// Task runner — dep-DAG scheduler with wire-protocol output (wire.ts).
-// Plain mode only by design: one `ok:`/`FAIL:` line per finished task +
-// final summary; greppable by humans and agents alike. Semantics:
-// - a dep must PASS to unblock; a filtered-out dep counts as satisfied;
-//   a failed/skipped dep skips dependents transitively (note says why).
-//   Deps double as serialization guards (document racy edges at the def).
-// - subprocess tasks: full log streamed to <logDir>/run-<pid>-<ts>/<id>.log, last non-empty
-//   line kept for the FAIL summary; SIGTERM at timeoutMs, SIGKILL +2s.
-// - logic tasks run in-process against a CheckCtx: WARN never flips the
-//   exit code, FAIL does. Their lines print under the task line.
-// - bail/SIGINT KILL in-flight children (SIGTERM, SIGKILL +2s); a killed
-//   task reports 'skipped (killed …)', never a fake fail.
-// - sharp edge, by design: `onlyIds` on a task whose race-guard dep is
-//   optIn/skipped-group drops that dep (filtered = satisfied) — explicit
-//   filters win over guards.
-import { createWriteStream, mkdirSync, readdirSync, rmSync, type WriteStream } from 'fs'
-import { basename, join } from 'path'
-import { CheckCtx } from './check-ctx.ts'
-import { spawnWithTimeout } from './spawn-timeout.ts'
-import { formatLine, type Line } from './wire.ts'
-
-export type TaskDef = {
-    id: string
-    cmd?: string[]
-    logic?: (t: CheckCtx) => unknown
-    deps?: string[]
-    env?: Record<string, string>
-    cwd?: string
-    group?: string
-    /** excluded unless listed in RunOpts.withIds */
-    optIn?: boolean
-    timeoutMs?: number
-    /** CONTENT population: the repo-relative paths this task reads. Declaring
-     *  them is what makes the task keyable (ledger/git-key.ts). Undeclared is
-     *  the DEFAULT and means never cached, so forgetting a whole task costs
-     *  speed and never correctness. A list MISSING a path the command reads is
-     *  the one that costs correctness: the key cannot move when that path
-     *  changes, so the answer replays over a tree it no longer describes. Over
-     *  declaring costs a re-run, under declaring is a false green. `['.']` is
-     *  the whole TRACKED tree, and it is NOT a catch-all: an ignored path
-     *  enters a key by name and never by content, so a task reading a
-     *  gitignored fixture, a built dir or a .env under declares with `['.']`
-     *  exactly as it would with a narrow list. A task that reads the network,
-     *  a keychain or the clock declares `ttl`, never `inputs`. A task carries no code
-     *  closure, so the script it runs belongs in here too.
-     *  Declaring both this and `ttl` is a registration failure. */
-    inputs?: string[]
-    /** WORLD population: this task reads the network, a keychain, $PATH or the
-     *  clock, so nothing on disk describes its answer and a clean pass is
-     *  remembered for this long (e.g. '24h'). */
-    ttl?: string
-    /** a DECIDED never-cacheable, with the reason. Says somebody looked and
-     *  nothing can describe this task, which takes it off the burn-down list
-     *  that undeclared units land on. */
-    never?: string
-}
-
-/** every field a `TaskDef` may carry. Declared as a value so `defineRepo` can
- *  refuse a typo inside a `defaults` slot: a slot with no `cmd` DECORATES the
- *  resolved task, so a misspelled field is not a type error at the call site
- *  and would land as a task that is quietly never cached. Add a field above,
- *  add it here. */
-export const TASK_DEF_KEYS = ['id', 'cmd', 'logic', 'deps', 'env', 'cwd', 'group', 'optIn', 'timeoutMs', 'inputs', 'ttl', 'never'] as const
-
-export type TaskResult = {
-    id: string
-    status: 'pass' | 'fail' | 'skipped'
-    exitCode: number | null
-    durationMs: number
-    logPath: string | null
-    lastLine: string
-    note: string
-    lines: Line[]
-}
-
-export type RunOpts = {
-    tasks: TaskDef[]
-    logDir: string
-    cwd?: string
-    maxParallel?: number
-    bail?: boolean
-    skipGroups?: string[]
-    onlyIds?: string[]
-    withIds?: string[]
-    /** ids `--only` may name that are NOT tasks: discovered checks and rules.
-     *  The flag addresses all three surfaces, so a check name must not come
-     *  back as `unknown task id` from the one surface that does not own it. */
-    otherIds?: string[]
-    /** print sink — tests capture, production defaults to console.log */
-    print?: (line: string) => void
-    color?: boolean
-    /** per-task completion tap (the TUI streams results in as they land) —
-     *  fires for pass/fail/dep-skip; bail/interrupt leftovers never finish,
-     *  callers sweep their own pending state after runTasks resolves */
-    onTaskFinish?: (r: TaskResult) => void
-}
-
-export type RunSummary = { ok: boolean; results: TaskResult[]; interrupted: boolean }
-
-type Live = TaskDef & TaskResult & { startedAt: number }
-
-const stripAnsi = (s: string): string => s.replace(/\x1b\[[0-9;]*m/g, '').replace(/\r/g, '')
-
-// only-mode keeps the transitive dep closure — running `--only typecheck`
-// with a lint race-guard dep must still run lint first
-function closure(tasks: TaskDef[], ids: string[]): Set<string> {
-    const byId = new Map(tasks.map((t) => [t.id, t]))
-    const keep = new Set<string>()
-    const visit = (id: string): void => {
-        if (keep.has(id)) return
-        keep.add(id)
-        for (const d of byId.get(id)?.deps ?? []) visit(d)
-    }
-    for (const id of ids) visit(id)
-    return keep
-}
-
-export function selectTasks(o: RunOpts): { selected: TaskDef[]; errors: string[] } {
-    const errors: string[] = []
-    const ids = new Set(o.tasks.map((t) => t.id))
-    if (ids.size !== o.tasks.length) errors.push('duplicate task ids')
-    for (const t of o.tasks) {
-        if ((t.cmd == null) === (t.logic == null)) errors.push(`task ${t.id}: exactly one of cmd/logic required`)
-        for (const d of t.deps ?? []) if (!ids.has(d)) errors.push(`task ${t.id}: unknown dep '${d}'`)
-    }
-    const elsewhere = new Set((o.otherIds ?? []).map((i) => i.toLowerCase()))
-    for (const id of [...(o.onlyIds ?? []), ...(o.withIds ?? [])])
-        if (!ids.has(id) && !elsewhere.has(id.toLowerCase())) errors.push(`unknown task id '${id}'`)
-    // cycle check — a dep cycle must die loud at select time, not hang the loop
-    const state = new Map<string, 0 | 1>()
-    const byId = new Map(o.tasks.map((t) => [t.id, t]))
-    const walk = (id: string, trail: string[]): void => {
-        if (state.get(id) === 1) return
-        if (state.get(id) === 0) { errors.push(`dep cycle: ${[...trail, id].join(' → ')}`); return }
-        state.set(id, 0)
-        for (const d of byId.get(id)?.deps ?? []) walk(d, [...trail, id])
-        state.set(id, 1)
-    }
-    for (const t of o.tasks) walk(t.id, [])
-    if (errors.length > 0) return { selected: [], errors }
-
-    const withSet = new Set(o.withIds ?? [])
-    const skipGroups = new Set(o.skipGroups ?? [])
-    let selected = o.tasks.filter((t) => !(t.optIn === true && !withSet.has(t.id)) && !(t.group != null && skipGroups.has(t.group)))
-    if (o.onlyIds != null && o.onlyIds.length > 0) {
-        const keep = closure(o.tasks, o.onlyIds)
-        selected = selected.filter((t) => keep.has(t.id))
-    }
-    return { selected, errors }
-}
-
-/** THIS run's log dir. It used to be `logDir` itself, wiped with rmSync at the
- *  top of every run: a second agent starting a gate deleted the log files the
- *  first was still streaming into, so the surviving FAIL line pointed at a
- *  path that no longer existed. Now each run owns `run-<pid>-<started>/` and
- *  writes nowhere else.
- *
- *  Old run dirs are swept on the way in, and only ones nothing can be using:
- *  the pid must not be running AND the dir must be older than the grace
- *  window, so a recycled pid cannot cost a live run its logs. */
-function openRunDir(base: string): string {
-    // the pid plus the millisecond separates two PROCESSES; the counter
-    // separates two runTasks calls inside one (the TUI can start a second
-    // before the clock ticks), so no run ever writes into another's dir
-    const dir = join(base, `run-${process.pid}-${Date.now()}-${runSeq++}`)
-    mkdirSync(dir, { recursive: true })
-    const cutoff = Date.now() - RUN_DIR_KEEP_MS
-    try {
-        for (const name of readdirSync(base)) {
-            // run dirs AND the per-run release survey files, which a killed
-            // run leaves behind: both carry the pid and the start time, so one
-            // sweep covers both rather than one path leaking forever
-            const m = /^(?:run|releases)-(\d+)-(\d+)(?:-\d+)?(?:\.json(?:\.lock)?)?$/.exec(name)
-            if (m == null || name === basename(dir)) continue
-            if (Number(m[2]) > cutoff) continue
-            try { process.kill(Number(m[1]), 0); continue } catch (e) { if ((e as { code?: string }).code === 'EPERM') continue }
-            rmSync(join(base, name), { recursive: true, force: true })
-        }
-    } catch {
-        // an unreadable log base is a housekeeping miss, never a gate failure
-    }
-    return dir
-}
-
-/** how long a finished run's logs stay readable, and the pid-reuse guard */
-const RUN_DIR_KEEP_MS = 6 * 60 * 60 * 1000
-let runSeq = 0
-
-export async function runTasks(o: RunOpts): Promise<RunSummary> {
-    const print = o.print ?? ((l: string) => console.log(l))
-    const color = o.color ?? (process.stdout.isTTY && process.env.NO_COLOR == null)
-    const sel = selectTasks(o)
-    if (sel.errors.length > 0) {
-        for (const e of sel.errors) print(formatLine({ kind: 'fail', text: e }, color))
-        return { ok: false, results: [], interrupted: false }
-    }
-    const selectedIds = new Set(sel.selected.map((t) => t.id))
-    const runDir = openRunDir(o.logDir)
-
-    const tasks: Live[] = sel.selected.map((t) => ({
-        ...t,
-        status: 'skipped', exitCode: null, durationMs: 0, startedAt: 0,
-        logPath: t.cmd != null ? join(runDir, `${t.id.replace(/[^a-zA-Z0-9-]/g, '_')}.log`) : null,
-        lastLine: '', note: '', lines: [],
-    }))
-    const byId = new Map(tasks.map((t) => [t.id, t]))
-    const queued = new Set(tasks.map((t) => t.id))
-    const done = new Map<string, Live>()
-    const running = new Map<string, Promise<void>>()
-    const cap = o.maxParallel ?? Math.max(2, Math.floor((navigator.hardwareConcurrency || 4) / 2))
-    let interrupted = false
-    let bailed = false
-    const procs = new Map<string, ReturnType<typeof Bun.spawn>>()
-    const killed = new Map<string, string>() // task id → reason
-    const killAll = (reason: string): void => {
-        for (const [id, proc] of procs) {
-            killed.set(id, reason)
-            try { proc.kill() } catch {}
-            setTimeout(() => { try { proc.kill('SIGKILL') } catch {} }, 2000)
-        }
-    }
-
-    const depState = (t: Live): 'ready' | 'blocked' | 'dead' => {
-        for (const d of t.deps ?? []) {
-            if (!selectedIds.has(d)) continue // filtered dep = satisfied
-            const dep = done.get(d)
-            if (dep == null) return 'blocked'
-            if (dep.status !== 'pass') { t.note = `dep ${d} ${dep.status}`; return 'dead' }
-        }
-        return 'ready'
-    }
-
-    const finish = (t: Live, status: Live['status'], code: number | null): void => {
-        t.status = status
-        t.exitCode = code
-        t.durationMs = t.startedAt > 0 ? Date.now() - t.startedAt : 0
-        done.set(t.id, t)
-        o.onTaskFinish?.({ id: t.id, status: t.status, exitCode: t.exitCode, durationMs: t.durationMs, logPath: t.logPath, lastLine: t.lastLine, note: t.note, lines: t.lines })
-        const dur = ` (${(t.durationMs / 1000).toFixed(1)}s)`
-        if (status === 'pass') {
-            // WARNs nag and skips stay visible (exempt contracts) even on pass
-            const surfaced = t.lines.filter((l) => l.kind === 'warn' || l.kind === 'fix-warn' || l.kind === 'skip')
-            print(formatLine({ kind: 'ok', text: `${t.id}${dur}` }, color))
-            for (const l of surfaced) print(formatLine(l, color))
-        } else if (status === 'fail') {
-            print(formatLine({ kind: 'fail', text: `${t.id}${dur}${t.lastLine !== '' ? ` — ${t.lastLine}` : ''}` }, color))
-            for (const l of t.lines.filter((l) => l.kind !== 'ok' && l.kind !== 'note')) print(formatLine(l, color))
-            if (t.logPath != null) print(formatLine({ kind: 'fix-fail', text: `full log: ${t.logPath}` }, color))
-            if (o.bail && !bailed) { bailed = true; killAll('bail') }
-        }
-        // skipped tasks report only in the summary — dep noise stays low
-    }
-
-    const startTask = (t: Live): void => {
-        queued.delete(t.id)
-        t.startedAt = Date.now()
-        const p = (async (): Promise<void> => {
-            if (t.logic != null) {
-                const ctx = new CheckCtx(new Map())
-                try { await t.logic(ctx) } catch (e) { ctx.fail(`${t.id} threw: ${String(e).slice(0, 200)}`) }
-                t.lines = ctx.lines
-                // headline prefers the last FAIL — an exempt/skip line landing
-                // last must not masquerade as the failure
-                const last = ctx.lines.filter((l) => l.kind === 'fail').at(-1) ?? ctx.lines.at(-1)
-                t.lastLine = last != null ? last.text.slice(0, 200) : ''
-                finish(t, ctx.failed ? 'fail' : 'pass', ctx.failed ? 1 : 0)
-                return
-            }
-            const cmd = t.cmd!
-            const ms = t.timeoutMs ?? 600_000
-            // log stream opens only once the child actually spawned — a
-            // missing binary must not leave a dangling open on the log dir
-            let out: WriteStream | null = null
-            const r = await spawnWithTimeout(cmd, {
-                timeoutMs: ms,
-                env: { ...process.env, ...t.env },
-                cwd: t.cwd ?? o.cwd,
-                onSpawn: (proc) => {
-                    out = createWriteStream(t.logPath!, { flags: 'a' })
-                    procs.set(t.id, proc)
-                },
-                onChunk: (text) => {
-                    out?.write(text)
-                    for (const raw of text.split(/\r?\n/)) {
-                        const s = stripAnsi(raw).trim()
-                        if (s !== '') t.lastLine = s.slice(0, 200)
-                    }
-                },
-            })
-            procs.delete(t.id)
-            // TS narrows `out` to its initializer across the await (assignment
-            // happens in the onSpawn closure) — widen explicitly
-            ;(out as WriteStream | null)?.end()
-            // missing binary / spawn throw surface as a wire FAIL, never a crash
-            if (r.spawnFailed) { t.lastLine = r.out; finish(t, 'fail', -1); return }
-            const killReason = killed.get(t.id)
-            if (killReason != null) { t.note = `killed (${killReason})`; finish(t, 'skipped', r.code); return }
-            if (r.timedOut) t.lastLine = `timeout after ${ms}ms — ${t.lastLine}`
-            finish(t, r.code === 0 ? 'pass' : 'fail', r.code)
-        })().finally(() => running.delete(t.id))
-        running.set(t.id, p)
-    }
-
-    const onSigint = (): void => { interrupted = true; killAll('interrupt') }
-    process.on('SIGINT', onSigint)
-    try {
-        while (queued.size > 0 || running.size > 0) {
-            if (interrupted || bailed) {
-                for (const id of [...queued]) { const t = byId.get(id)!; t.note = bailed ? 'bailed' : 'interrupted'; queued.delete(id); done.set(id, t) }
-                await Promise.all(running.values())
-                break
-            }
-            let started = false
-            for (const id of [...queued]) {
-                if (running.size >= cap) break
-                const t = byId.get(id)!
-                const st = depState(t)
-                if (st === 'dead') { queued.delete(id); finish(t, 'skipped', null); started = true }
-                else if (st === 'ready') { startTask(t); started = true }
-            }
-            if (running.size > 0) await Promise.race(running.values())
-            else if (!started && queued.size > 0) {
-                // nothing running, nothing startable — impossible unless a bug: die loud
-                for (const id of [...queued]) print(formatLine({ kind: 'fail', text: `${id}: scheduler stuck (unsatisfiable deps?)` }, color))
-                break
-            }
-        }
-    } finally {
-        process.off('SIGINT', onSigint)
-    }
-
-    const results = tasks.map((t): TaskResult => ({ id: t.id, status: t.status, exitCode: t.exitCode, durationMs: t.durationMs, logPath: t.logPath, lastLine: t.lastLine, note: t.note, lines: t.lines }))
-    const failed = results.filter((r) => r.status === 'fail')
-    const skipped = results.filter((r) => r.status === 'skipped')
-    if (failed.length > 0) print(formatLine({ kind: 'fail', text: `${failed.length}/${results.length} failed: ${failed.map((r) => r.id).join(', ')}` }, color))
-    if (skipped.length > 0) print(formatLine({ kind: 'note', text: `skip: ${skipped.map((r) => `${r.id}${r.note !== '' ? ` (${r.note})` : ''}`).join(', ')}` }, color))
-    if (failed.length === 0 && !interrupted) print(formatLine({ kind: 'ok', text: `all ${results.filter((r) => r.status === 'pass').length} tasks green` }, color))
-    return { ok: failed.length === 0 && !interrupted, results, interrupted }
-}

package/src/ledger/gate-units.ts

@@ -1,138 +0,0 @@
-// EVERY UNIT THE GATE RUNS, with what it declared about its own cacheability.
-//
-// Three registries feed one list, because a key layer that can only see tasks
-// would leave the 25 checks and the 32 rules uncached forever, and those are
-// most of the wall time. The declaration lives with the unit (a `TaskDef`
-// field, a `Rule` field, an `export const inputs` in a check file), never in a
-// table over here: a table beside the registry is a second source of truth
-// that drifts the first time somebody adds a check.
-import { relative } from 'path'
-import { allTasks, type RepoConfig } from '../repo-config.ts'
-import type { TaskDef } from '../core/task-runner.ts'
-import { discoverChecks } from '../core/discover-checks.ts'
-import { RULES } from '../rules/rule-registry.ts'
-import { ruleCacheExtra } from '../rules/rule.ts'
-import type { UnitDecl } from './git-key.ts'
-
-/** the env var a repo's own suite reads to widen itself. It lives HERE because
- *  it rewrites every task's env, which is part of the key: a run that asked for
- *  the quick tier and one that asked for the full tier are different questions,
- *  and a surface that renders keys without applying it renders a tier nobody
- *  ran. */
-export const FULL_TESTS_ENV = 'SHIPKIT_TEST_FULL'
-
-export type TestTier = 'quick' | 'full'
-
-/** the tier this process is asking for, absent an explicit choice */
-export function envTier(): TestTier {
-    return process.env[FULL_TESTS_ENV] === '1' ? 'full' : 'quick'
-}
-
-/** the repo's tasks as the gate will actually run them at `tier`. */
-export function tieredTasks(c: RepoConfig, root: string, tier: TestTier): TaskDef[] {
-    const tasks = allTasks(c, root).tasks
-    return tier === 'full' ? tasks.map((t) => ({ ...t, env: { ...t.env, [FULL_TESTS_ENV]: '1' } })) : tasks
-}
-
-/** every task, rule and discovered check, in the order the gate meets them.
- *
- *  `tasks` overrides what the repo resolves to, and the gate MUST pass what it
- *  is actually about to run: `--full` rewrites every task's env, and a key
- *  built from the unmodified list would let a quick run replay into a full one
- *  under one identity. */
-export function gateUnits(root: string, c: RepoConfig, tasks?: TaskDef[]): UnitDecl[] {
-    return gateInventory(root, c, tasks).map((r) => r.decl)
-}
-
-/** one gate unit with everything a reader asks about it, not only what the
- *  key layer asks. The cache half stays in `decl` so `UnitDecl` never grows
- *  fields the key layer must then decide to ignore. */
-export type UnitRow = {
-    decl: UnitDecl
-    /** the display name an operator reads (a rule's title, else the id) */
-    title: string
-    /** does `shipkit ci` run it? false = PROACTIVE: `shipkit check` reports it,
-     *  the gate never does, and it may sit red for months without anything
-     *  being wrong with the change in front of you. */
-    gate: boolean
-    /** can a failure stop you? null = the unit never said AND the repo set no
-     *  `checkDefaults.blocking`, which the check runner treats as fatal. */
-    blocking: boolean | null
-    /** where the answer is owned: a rule's wiki page, a check's file, a task's
-     *  command. Null when the unit names none. */
-    owner: string | null
-    /** the group a task was filed under, for the few that declare one */
-    group: string | null
-    /** excluded from a default run unless named with `--with` */
-    optIn: boolean
-}
-
-/** every unit the gate knows, with its metadata. `gateUnits` is this list
- *  narrowed to the cache declaration, so the three registries are walked in
- *  exactly one place and a surface can never enumerate a different set than
- *  the one the key layer keyed. */
-export function gateInventory(root: string, c: RepoConfig, tasks?: TaskDef[]): UnitRow[] {
-    const out: UnitRow[] = []
-    for (const t of tasks ?? allTasks(c, root).tasks) {
-        out.push({
-            decl: {
-                id: t.id,
-                kind: 'task',
-                inputs: t.inputs,
-                ttl: t.ttl,
-                never: t.never,
-                argv: t.cmd,
-                extra: t.env == null ? undefined : JSON.stringify(Object.entries(t.env).sort()),
-            },
-            title: t.id,
-            // an optIn task is off the default run, which is the same shape as
-            // a check that opted out of the gate
-            gate: t.optIn !== true,
-            // a task IS the build: it has no non-blocking mode to declare
-            blocking: true,
-            owner: t.cmd == null ? null : t.cmd.join(' '),
-            group: t.group ?? null,
-            optIn: t.optIn === true,
-        })
-    }
-    for (const r of [...RULES, ...(c.rules ?? [])]) {
-        out.push({
-            decl: {
-                id: r.id,
-                kind: 'rule',
-                inputs: r.inputs,
-                code: r.code,
-                ttl: r.ttl,
-                never: r.never,
-                extra: ruleCacheExtra(r, { root, config: c }),
-            },
-            title: r.title,
-            gate: true,
-            blocking: r.blocking,
-            owner: r.owner,
-            group: null,
-            optIn: false,
-        })
-    }
-    for (const d of discoverChecks(root)) {
-        const rel = relative(root, d.path).replace(/\\/g, '/')
-        out.push({
-            decl: {
-                id: d.name,
-                kind: 'check',
-                inputs: d.inputs ?? undefined,
-                ttl: d.ttl ?? undefined,
-                never: d.never ?? undefined,
-                code: [rel],
-                argv: ['bun', rel],
-            },
-            title: d.name,
-            gate: d.gate,
-            blocking: d.blocking ?? c.checkDefaults?.blocking ?? null,
-            owner: rel,
-            group: null,
-            optIn: false,
-        })
-    }
-    return out
-}