testguard-cli 0.16.0 → 0.17.0

package/src/init/templates/SKILL.md

@@ -54,6 +54,21 @@ sections already listing this project.
 
 ## The one source of truth
 
+Missing source-link advisories in claims/status never replace `next`, change
+verdicts or prove intent. Exact anchors remain checked without annotations.
+Origin summaries are likewise informational: status counts current declared
+claims; evidence/briefs count recorded declarations and records, including
+mixed sources. Source kinds are not authenticated independence. Never use an
+origin label to waive a survivor.
+Optional source links: `testguard claims --annotate --claim <ID>` is a read-only
+file-header preview. Only with explicit permission to edit source, rerun with
+`--apply`; each invocation recomputes its plan. Review refusals and partial
+failures, and retain the reported private recovery originals. Never automatically
+remove an existing lock or roll back over user edits. Placement is file-level,
+not symbol ownership, verified behavior or authenticated intent. Missing links
+do not disable exact fault-anchor checks. Authoring never replaces the status
+operating loop or writes canonical claims/evidence/baselines.
+
 ```bash
 testguard status --json
 ```
@@ -76,6 +91,18 @@ Exit codes: `0` clean · `1` unproven claims (or drift, or unclaimed changes) ·
 
 ## Every change needs a claim
 
+Scaffold proposes mechanical faults, not intended behavior. New drafts declare
+`source.kind: inferred` even when grouped by an annotation. Before adopting a
+draft, ask for the intended observable behavior from a requirement, ADR, bug or
+incident independently of the implementation: inputs, expected outcome and
+forbidden outcome. Record the supplied source kind/ref; when unavailable, keep
+inferred and say the intent remains unestablished. Do not promote origin because
+an annotation exists or tests pass. References are opaque, not authenticated;
+verification commands never fetch them. Preserve existing supplied metadata.
+Review each proposal against that intent, then probe. Do not paraphrase the code
+and call that independent intent, or automatically move drafts into canonical
+claims.
+
 `probe` verifies only the claims that exist; it is silent about unclaimed
 code by construction. So, for every source file you create or change:
 
@@ -108,6 +135,14 @@ code by construction. So, for every source file you create or change:
 
 ## The fix loop
 
+For independently supplied intent in an existing disposable draft, use
+`testguard scaffold <source...> --into <draft.json> --claim <existing-ID> --json`
+to preview appended faults without writes. Omit `--json` only when explicitly
+authorized to update that draft; private recovery is retained. Never use a
+canonical claims/evidence/baseline path. Preserve intended behavior and declared
+origin; generated faults are not independent intent or verification. Review the
+faults and probe the selected draft before promoting it to canonical claims.
+
 1. `testguard status --json` → take `next.target`.
 2. Write the test. It must **fail when the fault is applied and pass on HEAD**. To check the first half by hand: apply `find` → `replace` in the target file, run the defender, restore.
 3. `testguard admit <test-file> --claim <ID>` — the two gates as one verb, on your uncommitted test, without touching the tree: `ADMITTED` (exit 0) means the test is green on HEAD and fails on every fault of the claim, 3/3; `NOT ADMITTED` (exit 1) names the first blocking fault and what to do. `--fault <FID>` judges one fault; `--confirm 1` gives a fast **provisional** `ADMITTED?` that must be confirmed at 3 before you commit. (`testguard probe --claim <ID> --include-dirty` is the same run with the full report.)

package/src/probe/attribution.mjs

@@ -11,8 +11,17 @@
  * worktree is. Everything it needs is passed in.
  */
 
+import { isDeepStrictEqual } from 'node:util';
+
 const isKill = (r) => r.outcome === 'fail' && (r.assertionFailures ?? 0) > 0;
 
+/** Compare only the claim metadata actually recorded in evidence. */
+export function sameClaimMetadata(recorded, current) {
+  if (!recorded || !current) return false;
+  const metadata = ({ id, statement, severity, source, producedBy }) => ({ id, statement, severity, source, producedBy });
+  return isDeepStrictEqual(metadata(recorded), metadata(current));
+}
+
 /**
  * Fold one escalation run into the running attribution state.
  *
@@ -118,6 +127,7 @@ export function defenderSelection(claim, fault) {
 
 export function isReusable(prior, current) {
   if (!prior || !prior.subject?.contentHash) return false;
+  if (current.claim && !sameClaimMetadata(prior.claim, current.claim)) return false;
   // A record that exists because the probe threw is a statement about the run,
   // not about the code. Reusing it would make one disturbed run permanent.
   if (prior.detail?.reason === 'probe-error') return false;

package/src/probe/contention.mjs

@@ -37,9 +37,13 @@ export function processList({ platform = process.platform, run = spawnSync } = {
   try {
     const r = platform === 'win32'
       ? run('wmic', ['process', 'get', 'ProcessId,CommandLine', '/format:csv'], { encoding: 'utf8', timeout: 5000 })
-      : run('ps', ['-Ao', 'pid=,args='], { encoding: 'utf8', timeout: 5000 });
+      : run('ps', ['-Ao', 'pid=,ppid=,stat=,args='], { encoding: 'utf8', timeout: 5000 });
     if (r.status !== 0 || !r.stdout) return [];
     return r.stdout.split('\n').map((line) => {
+      if (platform !== 'win32') {
+        const row = /^\s*(\d+)\s+(\d+)\s+(\S+)\s+(.*)$/.exec(line);
+        if (row) return { pid: Number(row[1]), ppid: Number(row[2]), stat: row[3], command: row[4].trim() };
+      }
       const m = platform === 'win32' ? /^[^,]*,(.*),(\d+)\s*$/.exec(line) : /^\s*(\d+)\s+(.*)$/.exec(line);
       if (!m) return null;
       const [pid, command] = platform === 'win32' ? [m[2], m[1]] : [m[1], m[2]];
@@ -57,8 +61,22 @@ export function processList({ platform = process.platform, run = spawnSync } = {
  */
 export function detectContention({ self = process.pid, alive = defaultAlive, ...opts } = {}) {
   const rows = processList(opts);
+  const owned = new Set([self]);
+  let changed = true;
+  while (changed) {
+    changed = false;
+    for (const row of rows) {
+      if (owned.has(row.ppid) && !owned.has(row.pid)) { owned.add(row.pid); changed = true; }
+    }
+  }
+  const ancestors = new Set();
+  let parent = rows.find((row) => row.pid === self)?.ppid;
+  while (parent && !ancestors.has(parent)) {
+    ancestors.add(parent);
+    parent = rows.find((row) => row.pid === parent)?.ppid;
+  }
   const runners = rows
-    .filter((p) => p.pid !== self && RUNNER_RE.test(p.command) && !SELF_RE.test(p.command))
+    .filter((p) => !owned.has(p.pid) && !ancestors.has(p.pid) && !p.stat?.startsWith('Z') && RUNNER_RE.test(p.command) && (p.ppid !== undefined || !SELF_RE.test(p.command)))
     // `ps` lists the grep/ps itself and any shell wrapper; a runner's command
     // line always names its own binary, so require it to look like an exec.
     .filter((p) => !/^\s*(ps|grep|wmic)\b/.test(p.command))

package/src/probe/cost.mjs

@@ -92,10 +92,11 @@ export function defenderCosts(records) {
  * turns a twenty-four-minute gate into a one-minute one, and until a report
  * names the file nobody knows which test to split.
  */
-export function costReport(records) {
+export function costReport(records, { run } = {}) {
   const claims = claimCosts(records);
   const defenders = defenderCosts(records);
   return {
+    ...(run?.measurements ? { measurements: { ...run.measurements } } : {}),
     totalMs: claims.reduce((a, c) => a + c.ms, 0),
     totalRuns: claims.reduce((a, c) => a + c.runs, 0),
     reusedRecords: records.filter((r) => r.reusedFrom).length,
@@ -118,6 +119,10 @@ export const formatMs = secs;
  */
 export function renderCost(report, { limit = 10 } = {}) {
   const out = [];
+  if (report.measurements) {
+    const m = report.measurements;
+    out.push(`actual elapsed ${secs(m.elapsedMs)}; fresh runners ${secs(m.runnerMs)} across ${m.runnerInvocations} invocations; setup/discovery/other overhead ${secs(m.overheadMs)}`);
+  }
   if (!report.records) return 'no evidence records — run `testguard probe` first; cost is read back from the runs it records.';
   out.push(`${report.records} fault record${report.records === 1 ? '' : 's'} cost ${secs(report.totalMs)} across ${report.totalRuns} defender runs${report.reusedRecords ? ` (${report.reusedRecords} reused; their runs are what they cost when reuse does not apply)` : ''}.`);
   out.push('');

package/src/probe/inject.mjs

@@ -1,3 +1,4 @@
+import { registerCleanup } from './runners/lifecycle.mjs';
 import { readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 
@@ -19,12 +20,7 @@ function restoreAll() {
 function installHandlers() {
   if (handlersInstalled) return;
   handlersInstalled = true;
-  for (const sig of ['SIGINT', 'SIGTERM', 'SIGHUP']) {
-    process.on(sig, () => {
-      restoreAll();
-      process.exit(130);
-    });
-  }
+  registerCleanup(restoreAll, { priority: 1 });
   process.on('uncaughtException', (err) => {
     restoreAll();
     throw err;

package/src/probe/origin-policy.mjs

@@ -0,0 +1,69 @@
+import { isDeepStrictEqual } from 'node:util';
+import { validate, methodOf } from '../../spec/lib/validate.mjs';
+import { CLAIM_SOURCE_KINDS } from '../../spec/lib/origins.mjs';
+import { sameClaimMetadata, subjectOf } from './attribution.mjs';
+import { sha256 } from '../util/hash.mjs';
+
+/** Admit the planned probe option before loading claims or executing/writing. */
+export function originPolicyRequest(values, command = 'probe') {
+  const raw = values['require-origin'];
+  if (raw === undefined) return undefined;
+  if (command !== 'probe') throw new TypeError('--require-origin is only valid on probe');
+  if (!Array.isArray(raw) || !raw.length || raw.some((v) => typeof v !== 'string')) {
+    throw new TypeError('--require-origin must name declared source kinds');
+  }
+  const kinds = raw.flatMap((v) => v.split(',').map((k) => k.trim()));
+  if (kinds.some((k) => !CLAIM_SOURCE_KINDS.includes(k))) throw new TypeError('--require-origin contains an empty or unsupported kind');
+  if (values.claim !== undefined || values['allow-empty'] || values.ref !== undefined || values['ignore-dirty']) {
+    throw new TypeError('--require-origin needs a complete current-project run without --claim, --allow-empty, --ref or --ignore-dirty');
+  }
+  const n = Number(values.confirm ?? 3);
+  if (!Number.isInteger(n) || n < 3) throw new TypeError('--require-origin requires --confirm of at least 3');
+  return [...new Set(kinds)].sort();
+}
+
+/** Internal policy only: fresh must come from the existing input-binding checker. */
+export function evaluateOriginPolicy({ claims, evidence, eligibleKinds, fresh }) {
+  if (eligibleKinds === undefined) return undefined;
+  if (!Array.isArray(eligibleKinds) || !eligibleKinds.length || eligibleKinds.some((k) => !CLAIM_SOURCE_KINDS.includes(k))) {
+    throw new TypeError('origin policy needs a nonempty set of declared source kinds');
+  }
+  const eligible = [...new Set(eligibleKinds)].sort();
+  const reasons = new Set();
+  const claimsValid = validate('claims', claims).ok;
+  const evidenceValid = validate('evidence', evidence).ok;
+  if (!claimsValid) reasons.add('invalid-claims');
+  if (!evidenceValid) reasons.add('invalid-evidence');
+  if (fresh !== true) reasons.add('stale-inputs');
+  const current = claimsValid ? claims.claims : [];
+  const records = evidenceValid ? evidence.records : [];
+  const key = (claimId, faultId) => JSON.stringify([claimId, faultId]);
+  const expected = new Map(current.flatMap((claim) => claim.faults.map((fault) => [key(claim.id, fault.id), { claim, fault }])));
+  if (!current.length || !expected.size) reasons.add('empty-universe');
+  if (evidenceValid && (evidence.run.provisional === true || evidence.run.confirmRuns < 3)) reasons.add('provisional-evidence');
+  if (evidenceValid && methodOf(evidence.run) !== 'fault-injection') reasons.add('incompatible-method');
+  if (current.some((c) => c.faults.some((f) => methodOf(f) !== 'fault-injection'))) reasons.add('incompatible-method');
+  const seen = new Set();
+  for (const record of records) {
+    const identity = key(record.claim.id, record.subject.id);
+    if (seen.has(identity)) reasons.add('duplicate-record');
+    seen.add(identity);
+    const pair = expected.get(identity);
+    if (!pair) { reasons.add('extra-record'); continue; }
+    if (!sameClaimMetadata(record.claim, pair.claim)) reasons.add('claim-metadata-mismatch');
+    if (methodOf(pair.fault) !== 'fault-injection') continue;
+    const subject = subjectOf(pair.fault, sha256);
+    if (['kind', 'id', 'file', 'faultClass', 'contentHash'].some((field) => record.subject[field] !== subject[field])
+      || !isDeepStrictEqual(record.subject.producedBy, subject.producedBy)) reasons.add('fault-mismatch');
+  }
+  if ([...expected.keys()].some((identity) => !seen.has(identity))) reasons.add('missing-record');
+  const ineligibleClaims = current.filter((c) => !eligible.includes(c.source.kind)).map((c) => c.id).sort();
+  const nonKilledFaults = [...new Map(records.filter((r) => r.verdict !== 'killed').map((r) =>
+    [key(r.claim.id, r.subject.id), { claimId: r.claim.id, faultId: r.subject.id }])).values()]
+    .sort((a, b) => a.claimId.localeCompare(b.claimId) || a.faultId.localeCompare(b.faultId));
+  return {
+    state: reasons.size ? 'unavailable' : ineligibleClaims.length || nonKilledFaults.length ? 'failed' : 'passed',
+    eligibleKinds: eligible, claims: current.length, faults: expected.size,
+    ineligibleClaims, nonKilledFaults, unavailableReasons: [...reasons].sort(),
+  };
+}

package/src/probe/policy-freshness.mjs

@@ -0,0 +1,74 @@
+import { closeSync, constants, fstatSync, openSync, readFileSync, realpathSync } from 'node:fs';
+import { isAbsolute, join, relative, sep } from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
+import { validate, methodOf } from '../../spec/lib/validate.mjs';
+import { sha256 } from '../util/hash.mjs';
+import { defenderSelection, isReusable, subjectOf } from './attribution.mjs';
+import { discoverDefendersDetailed } from './discover.mjs';
+import { resolveDefenders } from './runners/shared.mjs';
+import { hashNativeTestUniverse } from './universe.mjs';
+
+// Point-in-time reads, not a transaction over the whole project. Never turn a
+// missing file into the empty-file hash that diagnostic probe records can use.
+function currentHash(projectDir, file) {
+  if (typeof file !== 'string' || isAbsolute(file) || file.split(/[\\/]/).includes('..')) throw new Error('unsafe input path');
+  const path = join(projectDir, file);
+  const resolved = realpathSync(path);
+  const inside = relative(realpathSync(projectDir), resolved);
+  if (isAbsolute(inside) || inside === '..' || inside.startsWith(`..${sep}`)) throw new Error('input escaped project');
+  const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+  try {
+    const before = fstatSync(fd);
+    if (!before.isFile()) throw new Error('input is not a regular file');
+    const hash = sha256(readFileSync(fd));
+    const after = fstatSync(fd);
+    if (before.size !== after.size || before.mtimeMs !== after.mtimeMs || before.ctimeMs !== after.ctimeMs || realpathSync(path) !== resolved) throw new Error('input changed during read');
+    return hash;
+  } finally { closeSync(fd); }
+}
+
+/** Internal policy boundary: native listing plus current per-fault bindings.
+ * Legacy/static universes and any uncertainty refuse; verdicts remain intact.
+ */
+export function originPolicyInputsFresh({ projectDir, claims, evidence, universe }) {
+  try {
+    if (!validate('claims', claims).ok || !validate('evidence', evidence).ok) return false;
+    if (methodOf(evidence.run) !== 'fault-injection' || evidence.run.provisional || evidence.run.confirmRuns < 3) return false;
+    const testUniverseHash = hashNativeTestUniverse(universe.manifests);
+    if (universe.testUniverseHash !== testUniverseHash) return false;
+    const matchesRunner = (recorded, current) => recorded?.name === current?.name && recorded?.version === current?.version;
+    if (!universe.primaryRunner || !matchesRunner(evidence.run.runner, universe.primaryRunner)) return false;
+    if ((evidence.run.runners ?? []).some((recorded) => !universe.runners?.some((current) => matchesRunner(recorded, current)))) return false;
+    const allTests = Object.freeze([...new Set([...universe.manifests.values()].flatMap((m) => m.files))].sort());
+    const expected = new Map();
+    for (const claim of claims.claims) for (const fault of claim.faults) {
+      if (methodOf(fault) !== 'fault-injection') return false;
+      expected.set(JSON.stringify([claim.id, fault.id]), { claim, fault });
+    }
+    if (!expected.size || evidence.records.length !== expected.size) return false;
+    const seen = new Set();
+    for (const record of evidence.records) {
+      const key = JSON.stringify([record.claim.id, record.subject.id]);
+      const current = expected.get(key);
+      if (!current || seen.has(key)) return false;
+      seen.add(key);
+      const { claim, fault } = current;
+      const subject = subjectOf(fault, sha256);
+      if (['kind', 'id', 'file', 'faultClass', 'contentHash', 'producedBy'].some((field) => !isDeepStrictEqual(record.subject[field], subject[field]))) return false;
+      const { requested, selectionSource } = defenderSelection(claim, fault);
+      const discovery = requested.length ? null : discoverDefendersDetailed(projectDir, fault.file, allTests);
+      if (discovery?.indeterminate.length) return false;
+      const resolved = requested.length ? resolveDefenders(projectDir, requested) : discovery.canDetect;
+      if (resolved.some((file) => !allTests.includes(file))) return false;
+      const hashes = (files) => Object.fromEntries(files.map((file) => [file, currentHash(projectDir, file)]));
+      const inputs = {
+        targetHash: currentHash(projectDir, fault.file),
+        defenderHashes: hashes(resolved),
+        testUniverseHash,
+        discoveryHashes: hashes(discovery?.dependencies ?? []),
+      };
+      if (!isReusable(record, { claim, requested, resolved, selectionSource, contentHash: subject.contentHash, inputs })) return false;
+    }
+    return true;
+  } catch { return false; }
+}

package/src/probe/probe.mjs

@@ -1,3 +1,6 @@
+import { resetInterpreterCache } from './runners/python.mjs';
+import { assertNotCancelled } from './runners/lifecycle.mjs';
+import { performance } from 'node:perf_hooks';
 import { existsSync, readFileSync, realpathSync as fsRealpathSync } from 'node:fs';
 import { gitRaw } from '../git.mjs';
 import { createRequire } from 'node:module';
@@ -16,7 +19,9 @@ import { classifyIndependence } from './independence.mjs';
 import { escalationStart, foldEscalationRun, escalationResult, flakeRate, killersFromRuns, subjectOf, isReusable, defenderSelection } from './attribution.mjs';
 import { hashFile, sha256 } from '../util/hash.mjs';
 import { fingerprint } from '../../spec/lib/fingerprint.mjs';
+import { recordedOriginSummary } from '../../spec/lib/origins.mjs';
 import { persistenceSignalsFor } from '../supply/persistence.mjs';
+import { collectOwnedManifests, hashNativeTestUniverse } from './universe.mjs';
 
 
 /** Is `child` the same file as `root`, or under it? Both must already be real paths. */
@@ -51,6 +56,12 @@ export function selectClaims(claims, only) {
   return only.map((id) => byId.get(id));
 }
 
+/** Reuse cannot stand in for a measurement under a different worker policy. */
+export function sameWorkerPolicy(previousRun, { workers = 1, serial = workers === 1, runnerCommand } = {}) {
+  if (runnerCommand) return previousRun?.workers === undefined && !previousRun?.serial;
+  return previousRun?.workers === (serial ? 1 : workers) && Boolean(previousRun?.serial) === serial;
+}
+
 /**
  * Probe every fault of every claim. Returns a spec-conformant evidence
  * document; writing it is the caller's job.
@@ -63,7 +74,8 @@ export async function probe({
   ref = 'HEAD',
   refExplicit = false,
   ignoreDirty = false,
-  serial = false,
+  workers = 1,
+  serial = workers === 1,
   onWarn = () => {},
   budgetMs = 120_000,
   commandBudget,
@@ -80,6 +92,18 @@ export async function probe({
   previous,
   onProgress = () => {},
 }) {
+  if (!Number.isSafeInteger(workers) || workers < 1) throw new PreconditionError('workers must be a positive safe integer');
+  resetInterpreterCache(); // Cache only within this measurement, never across commands.
+  const measuredStart = performance.now();
+  const startedAt = new Date().toISOString();
+  const measurements = { elapsedMs: 0, runnerMs: 0, overheadMs: 0, runnerInvocations: 0 };
+  const timedRun = async (runner, opts) => {
+    assertNotCancelled();
+    const start = performance.now();
+    measurements.runnerInvocations++;
+    try { return await runner.run(opts); }
+    finally { measurements.runnerMs += performance.now() - start; }
+  };
   commandBudget?.assertOpen();
   // realpath: git reports the repository root by its real path (/private/var
   // on macOS, not /var); every relative() below must start from the same place.
@@ -183,7 +207,6 @@ export async function probe({
   const contention = detectContention();
   if (contention.detected) onWarn(contentionWarning(contention));
 
-  const startedAt = new Date().toISOString();
   const iso = mode === 'worktree' ? createScratch({ repoRoot: root, projectDir, ref: snapshot ?? ref, scratchBase, nodeModules }) : inPlace({ repoRoot: root, projectDir });
   const isoReal = realpathSync(iso.projectDir);
   const records = [];
@@ -218,20 +241,16 @@ export async function probe({
     // project runner is; it must resolve before the first such defender runs.
     const owned = OWNED_RUNNERS.filter((r) => r !== runner
       && !(r.name === 'python' && ['python', 'pytest', 'unittest'].includes(runner.name)));
-    const ownedChecked = new Map();
-    const manifests = new Map(primaryManifest ? [[runner, primaryManifest]] : []);
+    let ownedChecked = new Map();
+    let manifests = new Map(primaryManifest ? [[runner, primaryManifest]] : []);
     if (!commandTemplate) {
-      for (const r of owned) {
-        const check = await r.check({ projectDir: iso.projectDir, sourceDir: projectDir, python, budgetMs: commandBudget?.runBudget(budgetMs) ?? budgetMs, budgetFor: () => commandBudget?.runBudget(budgetMs) ?? budgetMs });
-        commandBudget?.assertOpen();
-        ownedChecked.set(r, check);
-        if (!check.ok) continue;
-        try {
-          manifests.set(r, await discoverRunnerManifest(r, check, iso.projectDir, commandBudget?.runBudget(budgetMs) ?? budgetMs));
-        } catch (error) {
-          throw new PreconditionError(`${r.name}: test discovery failed: ${error.message}`);
-        }
-      }
+      try {
+        ({ ownedChecked, manifests } = await collectOwnedManifests(runner, primaryManifest, {
+          projectDir: iso.projectDir, sourceDir: projectDir, python, budgetMs,
+          budgetFor: () => commandBudget?.runBudget(budgetMs) ?? budgetMs,
+          assertOpen: () => commandBudget?.assertOpen(),
+        }));
+      } catch (error) { throw new PreconditionError(`test discovery failed: ${error.message}`); }
     }
     const ensureOwned = async (r, file) => {
       if (!ownedChecked.has(r)) {
@@ -265,9 +284,7 @@ export async function probe({
       : [...ownerByFile.keys()]).sort());
     const testUniverseHash = commandTemplate
       ? sha256(JSON.stringify({ schemaVersion: 1, source: 'custom-command-static', files: allTests }))
-      : sha256(JSON.stringify([...manifests]
-        .map(([r, manifest]) => ({ runner: r.name, hash: manifest.testUniverseHash }))
-        .sort((a, b) => a.runner.localeCompare(b.runner))));
+      : hashNativeTestUniverse(manifests);
     const baselineCache = new Map();
     const discoveryHashCache = new Map();
     // The negative control is charged per (target file, defender set): two
@@ -277,6 +294,7 @@ export async function probe({
     // runner — a `.py` source file is Python's whatever the project runs.
     const fatalEditFor = (file) => runnerFor(iso.projectDir, file, runner).fatalEdit?.();
     const prior = previous && previous.run.confirmRuns === confirmRuns
+      && sameWorkerPolicy(previous.run, { workers, serial, runnerCommand })
       ? new Map(previous.records.map((r) => [`${r.claim.id}/${r.subject.id}`, r]))
       : new Map();
     const partitionConfigured = (files) => {
@@ -295,7 +313,7 @@ export async function probe({
     // file the interpreter actually loaded (Python) reports it back.
     const runDefenders = async (files, targets = []) => {
       if (commandTemplate) {
-        const result = await runner.run({ projectDir: iso.projectDir, sourceDir: projectDir, python, files, budgetMs: commandBudget?.runBudget(budgetMs) ?? budgetMs, commandTemplate, serial, targets });
+        const result = await timedRun(runner, { projectDir: iso.projectDir, sourceDir: projectDir, python, files, budgetMs: commandBudget?.runBudget(budgetMs) ?? budgetMs, commandTemplate, serial, workers, targets });
         commandBudget?.assertOpen();
         return result;
       }
@@ -304,7 +322,7 @@ export async function probe({
       for (const [r, group] of groups) {
         commandBudget?.assertOpen();
         if (r !== runner) await ensureOwned(r, group[0]);
-        parts.push(await r.run({ projectDir: iso.projectDir, sourceDir: projectDir, python, files: group, budgetMs: commandBudget?.runBudget(budgetMs) ?? budgetMs, serial, targets }));
+        parts.push(await timedRun(r, { projectDir: iso.projectDir, sourceDir: projectDir, python, files: group, budgetMs: commandBudget?.runBudget(budgetMs) ?? budgetMs, serial, workers, targets }));
         commandBudget?.assertOpen();
       }
       return mergeRuns(parts);
@@ -373,6 +391,10 @@ export async function probe({
 
   commandBudget?.assertOpen();
 
+  assertNotCancelled();
+  const dirty = isDirty(root);
+  measurements.elapsedMs = performance.now() - measuredStart;
+  measurements.overheadMs = measurements.elapsedMs - measurements.runnerMs;
   return {
     schemaVersion: 1,
     tool: { name: 'testguard', version: toolVersion },
@@ -380,11 +402,13 @@ export async function probe({
       id: `run-${startedAt.replace(/[-:.]/g, '').slice(0, 15)}`,
       startedAt,
       finishedAt: new Date().toISOString(),
-      repo: { head, dirty: isDirty(root), ...(snapshot ? { snapshot } : {}), ...(ignoredDirty.length ? { ignoredDirty } : {}) },
+      repo: { head, dirty, ...(snapshot ? { snapshot } : {}), ...(ignoredDirty.length ? { ignoredDirty } : {}) },
       runner: { name: labelOf(runner), ...((runnerVersion ?? readRunnerVersion(projectDir, runner.name)) ? { version: runnerVersion ?? readRunnerVersion(projectDir, runner.name) } : {}) },
       ...(runnersUsed.size > 1 ? { runners: [...runnersUsed].map(([n, v]) => ({ name: n, ...(v ? { version: v } : {}) })) } : {}),
       confirmRuns,
-      ...(serial ? { serial: true } : {}),
+      measurements,
+      ...(!runnerCommand ? { workers: serial ? 1 : workers } : {}),
+      ...(serial && !runnerCommand ? { serial: true } : {}),
       ...(contention.detected ? { contention } : {}),
       ...(confirmRuns < 3 ? { provisional: true } : {}),
       // The isolation that was actually created, not the mode that was asked
@@ -394,6 +418,7 @@ export async function probe({
       mode: iso.mode,
     },
     records,
+    origins: recordedOriginSummary(records),
   };
 }
 
@@ -520,7 +545,7 @@ async function probeOne({ claim, fault, defenders, discovered, allTests, iso, is
   const subject = subjectOf(fault, sha256);
 
   // Same source, same defenders, same N, same fault: the verdict cannot have changed.
-  if (isReusable(prior, { inputs, ...defenderSelection(claim, fault), resolved: defenders, contentHash: subject.contentHash })) {
+  if (isReusable(prior, { claim, inputs, ...defenderSelection(claim, fault), resolved: defenders, contentHash: subject.contentHash })) {
     return { ...prior, defenders: { ...prior.defenders, ...defenderSelection(claim, fault) }, reusedFrom: prior.reusedFrom ?? priorRunId };
   }
 

package/src/probe/runners/discovery.mjs

@@ -1,3 +1,4 @@
+import { registerChild } from './lifecycle.mjs';
 import { spawn } from 'node:child_process';
 import { randomBytes } from 'node:crypto';
 import { closeSync, constants, fstatSync, lstatSync, openSync, readSync, realpathSync, rmSync, statSync } from 'node:fs';
@@ -177,6 +178,7 @@ export function runDiscoveryProcess({
       return;
     }
 
+    registerChild(child, () => terminateProcessTree(child));
     const started = Date.now();
     const stdout = [];
     const stderr = [];

package/src/probe/runners/jest.mjs

@@ -38,8 +38,8 @@ export async function discoverTests({ projectDir, version, timeoutMs, maxOutputB
 }
 // --runTestsByPath: positionals are exact paths, not regexes — a path with `+` or `(` would otherwise silently match nothing.
 /** The command line, as data. Exported so it is falsifiable without spawning anything. */
-export const argvFor = (projectDir, files, outFile, { serial = false } = {}) =>
-  [...runnerArgv(projectDir, 'jest', 'jest'), '--ci', '--json', `--outputFile=${outFile}`, ...(serial ? ['--runInBand'] : []), '--runTestsByPath', ...files];
+export const argvFor = (projectDir, files, outFile, { serial = false, workers = 1 } = {}) =>
+  [...runnerArgv(projectDir, 'jest', 'jest'), '--ci', '--json', `--outputFile=${outFile}`, ...(serial || workers === 1 ? ['--runInBand'] : [`--maxWorkers=${workers}`]), '--runTestsByPath', ...files];
 export const run = (opts) => runProcess({ ...opts, argv: (files, outFile) => argvFor(opts.projectDir, files, outFile, opts) });
 
 /**

package/src/probe/runners/lifecycle.mjs

@@ -0,0 +1,58 @@
+/** Own only children and cleanups registered by this TestGuard process. */
+const children = new Map();
+const cleanups = new Map();
+let installed = false;
+let cancelling = false;
+
+function cleanup() {
+  // Restore mutations before removing isolation, even across successive probes.
+  for (const [fn] of [...cleanups].reverse().sort((a, b) => b[1] - a[1])) {
+    try { fn(); } catch (error) { process.stderr.write(`cleanup failed: ${error.message}\n`); }
+  }
+  cleanups.clear();
+}
+
+function install() {
+  if (installed) return;
+  installed = true;
+  for (const signal of ['SIGINT', 'SIGTERM', 'SIGHUP']) {
+    process.on(signal, async () => {
+      if (cancelling) return;
+      cancelling = true;
+      const waits = [...children].map(([child, stop]) => {
+        const closed = new Promise((resolve) => child.once('close', resolve));
+        stop();
+        return closed;
+      });
+      let timer;
+      await Promise.race([
+        Promise.allSettled(waits),
+        new Promise((resolve) => { timer = setTimeout(resolve, 1000); }),
+      ]);
+      clearTimeout(timer);
+      cleanup();
+      process.exit(130);
+    });
+  }
+  process.on('exit', () => {
+    for (const stop of children.values()) stop();
+    cleanup();
+  });
+}
+
+export function registerChild(child, stop) {
+  install();
+  children.set(child, stop);
+  child.once('close', () => children.delete(child));
+  if (cancelling) stop();
+}
+
+export function registerCleanup(fn, { priority = 0 } = {}) {
+  install();
+  cleanups.set(fn, priority);
+  return () => cleanups.delete(fn);
+}
+
+export function assertNotCancelled() {
+  if (cancelling) throw new Error('TestGuard command cancelled; no partial result may be published');
+}

package/src/probe/runners/playwright.mjs

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { createRequire } from 'node:module';
 import { isAbsolute, join, relative, resolve, sep } from 'node:path';
-import { npx, runProcess, listTestFiles, firstInformativeLine, runnerArgv } from './shared.mjs';
+import { runProcess, listTestFiles, firstInformativeLine, runnerArgv } from './shared.mjs';
 import { createDiscoveryManifest, DiscoveryError, hashDiscoveryConfigs, normalizeDiscoveredFiles, runDiscoveryReportProcess } from './discovery.mjs';
 import { globToRegExp } from '../../util/glob.mjs';
 
@@ -185,7 +185,7 @@ export function parseReport(report, durationMs) {
 
 export const run = (opts) => {
   const env = { PLAYWRIGHT_JSON_OUTPUT_FILE: '{out}', PLAYWRIGHT_JSON_OUTPUT_NAME: '{out}' };
-  return runProcess({ ...opts, env, parse: parseReport, argv: (files) => [npx, 'playwright', 'test', '--reporter=json', ...(opts.serial ? ['--workers=1'] : []), ...files] });
+  return runProcess({ ...opts, env, parse: parseReport, argv: (files) => argvFor(opts.projectDir, files, opts) });
 };
 
 /**
@@ -196,3 +196,7 @@ export const run = (opts) => {
  * contained before.
  */
 export const fatalEdit = () => '/* testguard negative control: this file must not parse */\n(\n';
+
+/** Run the project-pinned CLI directly, avoiding an npm subprocess per confirmation. */
+export const argvFor = (projectDir, files, { serial = false, workers = 1 } = {}) =>
+  [...runnerArgv(projectDir, '@playwright/test', 'playwright'), 'test', '--reporter=json', `--workers=${serial ? 1 : workers}`, ...files];

package/src/probe/runners/python.mjs

@@ -1,4 +1,6 @@
+import { performance } from 'node:perf_hooks';
 import { existsSync, readFileSync } from 'node:fs';
+import { registerChild } from './lifecycle.mjs';
 import { spawn } from 'node:child_process';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -120,9 +122,10 @@ function ask(path, budgetMs) {
     } catch {
       return resolve(null);
     }
+    registerChild(child, () => terminateProcessTree(child));
     let out = '';
     child.on('error', () => resolve(null));
-    child.stdout.on('data', (d) => (out += d));
+    child.stdout.on('data', (d) => (out = (out + d).slice(-65536)));
     child.stderr.on('data', () => {});
     const timer = setTimeout(() => terminateProcessTree(child), budgetMs);
     child.on('close', (code) => {
@@ -276,10 +279,10 @@ export function environment(targets) {
  * the configured value; the rest of the project's `addopts` is left alone,
  * because TestGuard runs a project's tests the way the project runs them.
  */
-export function argvFor({ engine, interpreter, files, serial }) {
+export function argvFor({ engine, interpreter, files, serial = true }) {
   if (engine === 'pytest') {
     return [interpreter, '-m', 'pytest', '-p', '_testguard_pytest_plugin', '-p', 'no:cacheprovider',
-      '--maxfail=0', '-q', ...(serial ? ['-p', 'no:xdist'] : []), ...files];
+      '--maxfail=0', '-q', '-p', 'no:xdist', ...files];
   }
   return [interpreter, '-m', '_testguard_unittest_main', ...files];
 }
@@ -287,12 +290,15 @@ export function argvFor({ engine, interpreter, files, serial }) {
 export function makeRun(pinned) {
   const check = makeCheck(pinned);
   return async (opts) => {
-    const resolved = await check({ projectDir: opts.sourceDir ?? opts.projectDir, python: opts.python });
+    const deadline = performance.now() + (opts.budgetMs ?? 120_000);
+    const remaining = () => Math.max(1, Math.floor(deadline - performance.now()));
+    const resolved = await check({ projectDir: opts.sourceDir ?? opts.projectDir, python: opts.python, budgetMs: remaining(), budgetFor: remaining });
     if (!resolved.ok) {
       return { run: { outcome: 'error', tests: { total: 0, passed: 0, failed: 0 }, assertionFailures: 0, durationMs: 0 }, timeouts: 0, loadMessage: resolved.message, failedTests: [], provenance: {} };
     }
     return runProcess({
       ...opts,
+      budgetMs: remaining(),
       env: environment(opts.targets),
       parse: parseReport,
       argv: (files) => argvFor({ engine: resolved.engine, interpreter: resolved.interpreter, files, serial: opts.serial }),