tewip-ai 0.27.0 → 0.28.0

package/README.md

@@ -78,6 +78,13 @@ On every run, the action:
   when one of them cannot fail. Needs `fetch-depth: 0` on `actions/checkout` so the diff can be read;
   without it the section is skipped rather than guessed at. Any such test also enters the attestation
   as a refusal, so a release decision taken from the bundle cannot rest on a test that proves nothing.
+- **What the change would slip past (`prove: true`):** breaks the source files the pull request touched
+  in small deliberate ways, runs the tests that cover them, and reports every change none of them
+  noticed - "these 2 changes to your code would have slipped past your tests", with the lines. Off by
+  default because each change costs a real test run; `prove-budget` (default 300s) caps the whole
+  thing, and it says which files it did not reach rather than implying they were clean. Every file is
+  put back exactly as it was. Each unnoticed change also enters the attestation as a refusal: a line
+  nothing checks is not a line this bundle can claim was verified.
 - **Evidence, every run:** the Action writes an attestation into its artifact - the claims with
   their evidence and which layer decided each, what Tewip **refused** to decide, and what it did
   not check at all. Nothing enters it that Tewip did not verify itself, so a release decision can
@@ -503,6 +510,48 @@ Joins the test plans Tewip wrote to the tests that cover them and the runs that
 scenario counts as covered only when a real test can be named, and passing only when a real run
 attempted it; everything else says what is missing. No model, no cost.
 
+## Is this work actually done? (Phase 24)
+
+```bash
+tewip done --diff main...HEAD            # one verdict
+tewip done --prove --strict              # also break the code, and fail the build unless ready
+tewip done --json done.json              # a sealed verdict that can be checked later
+```
+
+Tewip can answer six questions about a change. A team reviewing an agent's pull request has to run six
+commands and assemble the answer themselves - which in practice means they run none and merge on a
+green tick. `done` is the assembled answer:
+
+```
+# Is this work done? Not ready
+
+| Question                                   | Answer      |
+| Is anything failing?                       | not checked |
+| Is the changed code tested?                | yes         |
+| Can the tests in this change fail?         | no          |
+| Would the tests catch a bug in this code?  | no          |
+| Is what was asked for covered?             | not checked |
+```
+
+That is a real run on a change where **all three tests passed**. One of them was `assert.ok(true)`, and
+three deliberate changes to the new code went unnoticed by the suite. CI was green; the work was not
+done.
+
+Nothing is judged here. Every answer comes from a layer with its own measured accuracy — the triage
+rules, `vouch`, `prove`, `trace` — and this only puts them in a fixed, published order: what is broken,
+then what cannot be believed, then what is missing. The same change always gets the same verdict.
+
+**"Cannot say" is a real answer, and it is never rounded up to ready.** A verdict needs the two questions
+nothing can substitute for — is anything failing, and does anything actually test this code — to have
+been answered. If Tewip has never seen a test result for the project, it says so and refuses to approve;
+the first version of this answered "Ready, with 3 not checked", which is an approval assembled out of
+shrugs. Every verdict also ends with what it says nothing about, including the one thing no tool here
+can know: whether the change does what was intended.
+
+With `--json` the verdict is **sealed**: editing `not-ready` to `ready` in the file makes verification
+fail, so a verdict that travels into a ticket or a release note can be checked rather than trusted. It is
+also an MCP tool, so an agent can ask whether its own work is done before saying that it is.
+
 ## Would your tests catch a bug? (Phase 23)
 
 ```bash

package/dist/cli/help.js

@@ -111,6 +111,13 @@ Usage:
                                     or attesting a green goal - by running the command that already
                                     proves them. It will not touch a real bug, and it writes what it
                                     did or refused to .tewip/actions.jsonl.
+  tewip done [--diff main...HEAD] [--prove] [--strict] [--out done.md] [--json done.json]
+                                    Is this work actually done? One verdict, from the layers that each
+                                    have a measured accuracy: is anything failing, is the changed code
+                                    tested, can those tests fail, would they catch a bug (--prove), and
+                                    is what was asked for covered. Answers ready, not ready, or cannot
+                                    say - and cannot say is never rounded up to ready. --json writes a
+                                    sealed verdict that can be checked later. No model, no cost.
   tewip prove <file> [--diff main...HEAD] [--limit 6] [--budget 600] [--strict]
                                     What would your tests NOT catch? Breaks your code in small,
                                     deliberate ways - a boundary moved by one, a condition inverted,

package/dist/cli/tewip.js

@@ -185,6 +185,20 @@ async function main() {
             runPursue({ root: process.cwd(), goal, act: args.includes('--act'), name: flag(args, 'name'), out: flag(args, 'out') });
             return;
         }
+        case 'done': {
+            const { runDone } = await import('../engine/verdict/verdict-command.js');
+            runDone({
+                root: process.cwd(),
+                diff: flag(args, 'diff') ?? 'main...HEAD',
+                prove: args.includes('--prove'),
+                proveBudgetSeconds: Number(flag(args, 'budget') ?? '300'),
+                out: flag(args, 'out'),
+                json: flag(args, 'json'),
+                name: flag(args, 'name'),
+                strict: args.includes('--strict'),
+            });
+            return;
+        }
         case 'prove': {
             const paths = args.filter((a, i) => !a.startsWith('--') && !['--out', '--diff', '--limit', '--budget'].includes(args[i - 1] ?? ''));
             const { runProve } = await import('../engine/prove/prove-command.js');

package/dist/engine/prove/changed.js

@@ -0,0 +1,77 @@
+// Proving what a pull request's own changes would slip past, inside CI.
+//
+// `tewip prove` on a whole file is a thing somebody chooses to wait for. In CI nobody chooses, so this
+// is deliberately meaner: only source files the diff touched, a small number of them, a hard time
+// budget, and off unless the repository asks for it. A tool that silently adds six minutes to every
+// pull request is a tool that gets removed from the workflow, and then it checks nothing at all.
+//
+// It says nothing when nothing slipped past. A section that appears on every pull request to report
+// "all good" is one people stop reading, and then it is worth nothing on the day it matters.
+import { existsSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { chooseFramework, detectFrameworks } from '../quality/frameworks.js';
+import { coverageFor, testFiles } from '../review/coverage.js';
+import { importingTests, proveFile } from './prove.js';
+import { testsReaching } from './reaches.js';
+const SOURCE = /\.(js|jsx|mjs|cjs|ts|tsx|mts|cts|py|java|kt|go|cs|rb|php)$/i;
+const IS_TEST = /(^|[\\/])(tests?|spec|specs|__tests__|e2e)[\\/]|[._-](test|tests|spec|specs)\.[a-z]+$|(^|[\\/])test_[^\\/]+\.py$|_test\.(go|py|rb)$|Tests?\.(java|kt|cs)$/i;
+export function proveChanged(root, changed, budget = {}) {
+    const maxFiles = budget.maxFiles ?? 2;
+    const totalMs = (budget.budgetSeconds ?? 300) * 1000;
+    const say = budget.onStep ?? (() => { });
+    const files = changed.map((f) => f.split('\\').join('/')).filter((f) => SOURCE.test(f) && !IS_TEST.test(f) && existsSync(resolve(root, f)));
+    if (files.length === 0)
+        return { proofs: [], unnoticed: 0, notReached: [], skipped: 'this change touches no source file that could be proved' };
+    const framework = chooseFramework(detectFrameworks(root), undefined, false);
+    if (!framework)
+        return { proofs: [], unnoticed: 0, notReached: [], skipped: 'no unit test framework was found here, and proving works by running tests' };
+    const known = testFiles(root);
+    const started = Date.now();
+    const proofs = [];
+    const chosen = files.slice(0, maxFiles);
+    const notReached = files.slice(maxFiles);
+    for (const file of chosen) {
+        const left = totalMs - (Date.now() - started);
+        // Under half a minute is not enough for a baseline, a control and one change, and a run cut off
+        // half way would report survivors that were never really tried.
+        if (left < 30_000) {
+            notReached.push(file);
+            continue;
+        }
+        const direct = importingTests(root, coverageFor(root, [file], known), file);
+        const covering = direct.length > 0 ? direct : testsReaching(root, file, known.map((t) => t.split('\\').join('/'))).map((r) => r.testFile);
+        say(`proving ${file} against ${covering.length} test file(s)`);
+        proofs.push(proveFile(root, file, covering, framework, { limit: budget.limit ?? 4, budgetSeconds: Math.floor(left / 1000), onStep: say }));
+    }
+    return {
+        proofs,
+        unnoticed: proofs.flatMap((p) => p.tried).filter((t) => t.fate === 'unnoticed').length,
+        notReached,
+        skipped: '',
+    };
+}
+/** The section for the pull request comment. Empty when nothing slipped past. */
+export function provedChangeLines(proved) {
+    const gaps = proved.proofs.flatMap((p) => p.tried.filter((t) => t.fate === 'unnoticed').map((t) => ({ file: p.file, tried: t })));
+    if (gaps.length === 0)
+        return [];
+    const lines = [
+        `## ${gaps.length} change(s) to this code would have slipped past the tests`,
+        '',
+        'Tewip made each of these changes to your own code and ran the tests that cover it. They all still',
+        'passed. The lines are covered; they are not checked.',
+        '',
+    ];
+    for (const gap of gaps.slice(0, 8)) {
+        lines.push(`- **\`${gap.file}:${gap.tried.mutant.line}\`** — ${gap.tried.mutant.kind}`);
+        lines.push(`  - was: \`${gap.tried.mutant.was.slice(0, 110).replace(/`/g, "'")}\``);
+        lines.push(`  - became: \`${gap.tried.mutant.now.slice(0, 110).replace(/`/g, "'")}\``);
+    }
+    if (gaps.length > 8)
+        lines.push(`- …and ${gaps.length - 8} more`);
+    lines.push('', 'Every file was put back exactly as it was. Nothing here is necessarily a bug: it is a place where a mistake would go unnoticed.', '');
+    if (proved.notReached.length > 0) {
+        lines.push(`Not proved in the time allowed: ${proved.notReached.slice(0, 6).join(', ')}${proved.notReached.length > 6 ? `, and ${proved.notReached.length - 6} more` : ''}.`, '');
+    }
+    return lines;
+}

package/dist/engine/verdict/verdict-command.js

@@ -0,0 +1,140 @@
+// `tewip done --diff main...HEAD`: gathering the evidence for the verdict.
+//
+// Every number here comes from a layer that already exists and has its own measured accuracy. This file
+// only collects: what changed, what covers it, whether those tests can fail, whether they would catch a
+// bug, what is failing now, and what a kept plan says is still uncovered. Where a layer has nothing to
+// say, it is left as "not checked" rather than filled in with a guess.
+import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { seal } from '../attest/seal.js';
+import { proveChanged } from '../prove/changed.js';
+import { changeSummary } from '../quality/grounding.js';
+import { coverageFor, testFiles } from '../review/coverage.js';
+import { importingTests } from '../prove/prove.js';
+import { testsReaching } from '../prove/reaches.js';
+import { vouchChanged } from '../vouch/changed.js';
+import { datasetFiles, readJsonl, readTriageRecords } from '../../reporters/store.js';
+import { decide, renderDecision } from './verdict.js';
+const SOURCE = /\.(js|jsx|mjs|cjs|ts|tsx|mts|cts|py|java|kt|go|cs|rb|php)$/i;
+const IS_TEST = /(^|[\\/])(tests?|spec|specs|__tests__|e2e)[\\/]|[._-](test|tests|spec|specs)\.[a-z]+$|(^|[\\/])test_[^\\/]+\.py$|_test\.(go|py|rb)$|Tests?\.(java|kt|cs)$/i;
+/** Every failure Tewip has kept for this project, and every run. */
+function history(root, only) {
+    const dir = join(root, '.tewip', 'history');
+    if (!existsSync(dir))
+        return { runs: [], records: [] };
+    const runs = [];
+    const records = [];
+    for (const project of only ? [only] : readdirSync(dir)) {
+        const where = join(dir, project);
+        if (!existsSync(where))
+            continue;
+        runs.push(...readJsonl(datasetFiles(where).runs));
+        records.push(...readTriageRecords(datasetFiles(where).triage));
+    }
+    runs.sort((a, b) => (a.finishedAt > b.finishedAt ? 1 : -1));
+    return { runs, records };
+}
+/** Scenarios of kept plans that this change relates to and nothing covers. Null when no plans exist. */
+function uncoveredFor(root, changed, attempted) {
+    const dir = join(root, '.tewip', 'plans');
+    if (!existsSync(dir))
+        return null;
+    const words = new Set(changed.flatMap((f) => (f.toLowerCase().match(/[a-z][a-z0-9]{3,}/g) ?? [])));
+    const clean = (s) => s.toLowerCase().replace(/[^a-z0-9]+/g, '');
+    const out = [];
+    for (const file of readdirSync(dir).filter((f) => f.endsWith('.json'))) {
+        try {
+            const saved = JSON.parse(readFileSync(join(dir, file), 'utf8'));
+            const plan = saved.plan ?? saved;
+            if (!Array.isArray(plan.scenarios))
+                continue;
+            // Only plans this change has something to do with: a verdict about an unrelated feature's gaps
+            // would block every pull request in the project forever.
+            const about = (`${plan.title ?? ''} ${saved.feature ?? ''}`.toLowerCase().match(/[a-z][a-z0-9]{3,}/g) ?? []).some((w) => words.has(w));
+            if (!about)
+                continue;
+            for (const scenario of plan.scenarios) {
+                const covered = (scenario.covered_by ?? '').trim() || attempted.find((t) => clean(t).includes(clean(scenario.id)) && clean(scenario.id).length >= 4);
+                if (!covered)
+                    out.push({ id: scenario.id, title: scenario.title });
+            }
+        }
+        catch {
+            // Not a readable plan.
+        }
+    }
+    return out;
+}
+export function gather(cmd) {
+    const change = changeSummary(cmd.root, cmd.diff);
+    if (!change || change.files.length === 0)
+        return null;
+    const changed = change.files.map((f) => f.split('\\').join('/'));
+    const changedSource = changed.filter((f) => SOURCE.test(f) && !IS_TEST.test(f) && existsSync(resolve(cmd.root, f)));
+    const changedTests = changed.filter((f) => IS_TEST.test(f) && existsSync(resolve(cmd.root, f)));
+    const known = testFiles(cmd.root);
+    const covering = [];
+    for (const file of changedSource) {
+        const direct = importingTests(cmd.root, coverageFor(cmd.root, [file], known), file);
+        for (const test of direct)
+            if (!covering.some((c) => c.testFile === test))
+                covering.push({ testFile: test, how: 'imports it' });
+        if (direct.length > 0)
+            continue;
+        for (const reach of testsReaching(cmd.root, file, known.map((t) => t.split('\\').join('/')))) {
+            if (!covering.some((c) => c.testFile === reach.testFile))
+                covering.push({ testFile: reach.testFile, how: `reaches it through ${reach.steps} import(s)` });
+        }
+    }
+    const vouched = vouchChanged(cmd.root, changedTests);
+    const { runs, records } = history(cmd.root, cmd.name);
+    const newest = runs.at(-1);
+    const touched = new Set([...changedSource, ...changedTests, ...covering.map((c) => c.testFile)]);
+    const failingNow = records
+        .filter((r) => r.runId === newest?.runId)
+        .filter((r) => {
+        const where = String(r.file ?? '').split('\\').join('/');
+        return touched.has(where) || [...touched].some((t) => r.testId.includes(t.replace(/\.[a-z]+$/, '')));
+    })
+        .map((r) => ({ testId: r.testId, category: String(r.diagnosis?.category ?? 'UNKNOWN') }));
+    const proved = cmd.prove ? proveChanged(cmd.root, changedSource, { budgetSeconds: cmd.proveBudgetSeconds ?? 300, onStep: (m) => console.error(`  ${m}`) }) : null;
+    return {
+        changed,
+        evidence: {
+            changedSource,
+            changedTests,
+            covering,
+            cannotFail: vouched.cannotFail.map((j) => ({ name: j.name, file: j.file, line: j.line, why: j.why })),
+            crashOnly: vouched.crashOnly.length,
+            unnoticed: proved ? proved.proofs.flatMap((p) => p.tried.filter((t) => t.fate === 'unnoticed').map((t) => ({ file: p.file, line: t.mutant.line, kind: t.mutant.kind }))) : null,
+            failingNow,
+            noHistory: runs.length === 0,
+            uncovered: uncoveredFor(cmd.root, changed, Object.keys(newest?.attempts ?? {})),
+        },
+    };
+}
+export function runDone(cmd) {
+    const gathered = gather(cmd);
+    if (!gathered)
+        throw new Error(`nothing changed in "${cmd.diff}", or that range could not be read. Is this a git checkout? (try --diff main...HEAD)`);
+    const decision = decide(gathered.evidence);
+    const report = renderDecision(cmd.diff, decision);
+    console.log(report);
+    if (cmd.out) {
+        mkdirSync(dirname(resolve(cmd.out)), { recursive: true });
+        writeFileSync(resolve(cmd.out), report + String.fromCharCode(10), 'utf8');
+    }
+    if (cmd.json) {
+        // Sealed, so a verdict that travels - into a ticket, a release note, an audit - can be checked
+        // rather than trusted. The digest is of the content; a signature needs TEWIP_ATTEST_KEY.
+        const bundle = { range: cmd.diff, changed: gathered.changed, ...decision };
+        const sealed = { ...bundle, seal: seal(bundle, process.env.TEWIP_ATTEST_KEY?.includes('BEGIN') ? process.env.TEWIP_ATTEST_KEY : undefined) };
+        mkdirSync(dirname(resolve(cmd.json)), { recursive: true });
+        writeFileSync(resolve(cmd.json), JSON.stringify(sealed, null, 2), 'utf8');
+    }
+    if (cmd.strict && decision.verdict !== 'ready') {
+        console.error(String.fromCharCode(10) + decision.headline);
+        process.exitCode = 1;
+    }
+    return { verdict: decision.verdict };
+}

package/dist/engine/verdict/verdict.js

@@ -0,0 +1,138 @@
+/** The questions that cannot be skipped on the way to "ready". */
+const ESSENTIAL = ['Is anything failing?', 'Is the changed code tested?'];
+/**
+ * The verdict, in a fixed order: what is broken first, then what cannot be believed, then what is
+ * missing, and only then "ready".
+ */
+export function decide(evidence) {
+    const checks = [];
+    // 1. Is anything failing right now? Nothing else matters while it is.
+    if (evidence.noHistory) {
+        checks.push({ question: 'Is anything failing?', standing: 'not-checked', answer: 'no run has been kept for this project, so Tewip has not seen a test result here. Run `tewip explain <report>` in CI and it will know.', decidedBy: 'kept history' });
+    }
+    else if (evidence.failingNow.length > 0) {
+        checks.push({
+            question: 'Is anything failing?',
+            standing: 'not-met',
+            answer: `${evidence.failingNow.length} test(s) touching this change failed in the last run: ${evidence.failingNow.slice(0, 3).map((f) => `${f.testId} (${f.category})`).join(', ')}`,
+            decidedBy: 'the triage rules and model, measured on real CI data',
+        });
+    }
+    else {
+        checks.push({ question: 'Is anything failing?', standing: 'met', answer: 'nothing touching this change failed in the last kept run', decidedBy: 'kept history' });
+    }
+    // 2. Does anything test the change at all?
+    if (evidence.changedSource.length === 0) {
+        checks.push({ question: 'Is the changed code tested?', standing: 'not-applicable', answer: 'this change touches no source file', decidedBy: 'the diff' });
+    }
+    else if (evidence.covering.length === 0) {
+        checks.push({
+            question: 'Is the changed code tested?',
+            standing: 'not-met',
+            answer: `no test imports or reaches ${evidence.changedSource.slice(0, 3).join(', ')}, so nothing here could notice a mistake in it`,
+            decidedBy: 'imports followed through the source, which is a fact rather than a name match',
+        });
+    }
+    else {
+        checks.push({
+            question: 'Is the changed code tested?',
+            standing: 'met',
+            answer: `${evidence.covering.length} test file(s) reach it: ${evidence.covering.slice(0, 3).map((c) => c.testFile).join(', ')}`,
+            decidedBy: 'imports followed through the source',
+        });
+    }
+    // 3. Can the tests in this change fail at all? A test that cannot fail is worse than no test.
+    if (evidence.changedTests.length === 0) {
+        checks.push({ question: 'Can the tests in this change fail?', standing: 'not-applicable', answer: 'this change adds or edits no test', decidedBy: 'the diff' });
+    }
+    else if (evidence.cannotFail.length > 0) {
+        checks.push({
+            question: 'Can the tests in this change fail?',
+            standing: 'not-met',
+            answer: `${evidence.cannotFail.length} of them cannot: ${evidence.cannotFail.slice(0, 2).map((t) => `${t.name} (${t.file}:${t.line})`).join(', ')}`,
+            decidedBy: 'tewip vouch, 19 of 19 correct on 5,448 tests in 8 public projects',
+        });
+    }
+    else {
+        checks.push({
+            question: 'Can the tests in this change fail?',
+            standing: 'met',
+            answer: `every test in this change asserts something${evidence.crashOnly > 0 ? `, though ${evidence.crashOnly} compare no value and would only fail on a crash` : ''}`,
+            decidedBy: 'tewip vouch',
+        });
+    }
+    // 4. Would they catch a bug? The strongest check, and the one that costs the most, so often skipped.
+    if (evidence.unnoticed === null) {
+        checks.push({ question: 'Would the tests catch a bug in this code?', standing: 'not-checked', answer: 'not run: this means breaking the code on purpose and running the tests, which costs minutes. Ask for it with `--prove`.', decidedBy: 'tewip prove' });
+    }
+    else if (evidence.unnoticed.length > 0) {
+        checks.push({
+            question: 'Would the tests catch a bug in this code?',
+            standing: 'not-met',
+            answer: `${evidence.unnoticed.length} deliberate change(s) went unnoticed, including ${evidence.unnoticed[0].file}:${evidence.unnoticed[0].line} (${evidence.unnoticed[0].kind})`,
+            decidedBy: 'tewip prove, by running the tests against a broken copy of the code',
+        });
+    }
+    else {
+        checks.push({ question: 'Would the tests catch a bug in this code?', standing: 'met', answer: 'every deliberate change made to this code was caught by a covering test', decidedBy: 'tewip prove' });
+    }
+    // 5. Is what was asked for covered? Only where the project keeps plans to compare against.
+    if (evidence.uncovered === null) {
+        checks.push({ question: 'Is what was asked for covered?', standing: 'not-checked', answer: 'this project keeps no test plan Tewip can read, so there is nothing to compare the change against', decidedBy: 'tewip trace' });
+    }
+    else if (evidence.uncovered.length > 0) {
+        checks.push({
+            question: 'Is what was asked for covered?',
+            standing: 'not-met',
+            answer: `${evidence.uncovered.length} scenario(s) related to this change have no test: ${evidence.uncovered.slice(0, 2).map((u) => `${u.id} ${u.title}`).join('; ')}`,
+            decidedBy: 'tewip trace, which counts a scenario covered only when a real test can be named',
+        });
+    }
+    else {
+        checks.push({ question: 'Is what was asked for covered?', standing: 'met', answer: 'every scenario this change relates to has a test that can be named', decidedBy: 'tewip trace' });
+    }
+    const broken = checks.filter((c) => c.standing === 'not-met');
+    const unknown = checks.filter((c) => c.standing === 'not-checked');
+    // "Ready" requires that the two questions nothing can substitute for were actually answered: is
+    // anything failing, and does anything test the changed code. Without those, "ready" would rest on
+    // the checks that happened to be cheap - the first version said Ready on a project with no history
+    // at all, which is an approval built out of three shrugs.
+    const essential = checks.filter((c) => ESSENTIAL.includes(c.question));
+    const verdict = broken.length > 0 ? 'not-ready' : essential.some((c) => c.standing === 'not-checked') ? 'cannot-say' : 'ready';
+    return {
+        verdict,
+        headline: broken.length > 0
+            ? `Not ready: ${broken[0].answer}`
+            : verdict === 'cannot-say'
+                ? `Cannot say: ${essential.filter((c) => c.standing === 'not-checked').map((c) => c.question.toLowerCase().replace(/\?$/, '')).join(' and ')} could not be checked, so this is not an approval`
+                : `Ready as far as ${checks.filter((c) => c.standing === 'met').length} check(s) can show${unknown.length > 0 ? `, with ${unknown.length} not checked` : ''}`,
+        checks,
+        notChecked: [
+            ...unknown.map((c) => `${c.question.toLowerCase().replace(/\?$/, '')} - ${c.answer}`),
+            'whether the change does what was intended, which no tool here can know',
+            'the running application, its dependencies and its secrets, unless `tewip secure` was run separately',
+        ],
+    };
+}
+export function renderDecision(range, decision) {
+    const mark = { met: 'yes', 'not-met': '**no**', 'not-applicable': 'n/a', 'not-checked': 'not checked' };
+    const title = decision.verdict === 'ready' ? 'Ready, as far as this can be shown' : decision.verdict === 'not-ready' ? 'Not ready' : 'Cannot say';
+    const lines = [
+        `# Is this work done? ${title}`,
+        '',
+        `For \`${range}\`. ${decision.headline}.`,
+        '',
+        '| Question | Answer |',
+        '| --- | --- |',
+        ...decision.checks.map((c) => `| ${c.question} | ${mark[c.standing]} |`),
+        '',
+    ];
+    for (const check of decision.checks) {
+        if (check.standing === 'not-applicable')
+            continue;
+        const said = `${mark[check.standing] === '**no**' ? 'No' : mark[check.standing] === 'yes' ? 'Yes' : 'Not checked'}: ${check.answer}`;
+        lines.push(`### ${check.question}`, '', /[.!?]$/.test(said) ? said : `${said}.`, '', `_Decided by ${check.decidedBy}._`, '');
+    }
+    lines.push('## What this says nothing about', '', ...decision.notChecked.map((n) => `- ${n}`), '', '---', '', 'Nothing above is judged here: each answer comes from a layer with its own measured accuracy, and', 'this only puts them in a fixed order - what is broken, then what cannot be believed, then what is', 'missing. "Cannot say" is a real answer and is never rounded up to ready.');
+    return lines.join(String.fromCharCode(10));
+}

package/dist/engine/vouch/assertions.js

@@ -125,6 +125,11 @@ export function tautologies(body) {
             if (left && right && left === right && !/^(true|false|null|undefined|None)$/.test(left))
                 found.push(line.trim());
         }
+        // `assert.ok(true)`, `assert(true)`, `assertTrue(true)`: a check whose subject is the answer. Found
+        // while writing a realistic fixture for the verdict - the commonest placeholder in Node's own test
+        // style, and the vocabulary did not have it.
+        if (/\b(assert(?:\.(?:ok|isTrue|isOk))?|assertTrue|expect)\s*\(\s*(?:true|1|!0)\s*[,)]/.test(line))
+            found.push(line.trim());
         // `assert True` / `assert 1`: a constant truth written as a statement.
         if (/^\s*assert\s+(True|true|1)\s*(,|$)/.test(line))
             found.push(line.trim());

package/dist/mcp/server.js

@@ -155,4 +155,25 @@ server.registerTool('prove_tests_catch_bugs', {
     const { proveOne } = await import('../engine/prove/prove-command.js');
     return proveOne(root, file, { limit, budgetSeconds });
 }));
+server.registerTool('is_the_work_done', {
+    title: 'Is this work actually done?',
+    description: "One verdict on a change, from the layers that each have their own measured accuracy: is anything failing, is the changed code tested by something that really reaches it, can the tests in the change fail at all, would they catch a bug (only when prove is asked for, because that costs minutes), and is what was asked for covered. Answers ready, not ready, or cannot say - and cannot say is never rounded up to ready. Use it before claiming a piece of work is finished, including your own: a green test run is not the same as work that is done.",
+    inputSchema: {
+        project,
+        diff: z.string().optional().describe('A git range, e.g. main...HEAD (the default)'),
+        prove: z.boolean().optional().describe('Also break the changed code and run the tests against it. Costs minutes.'),
+    },
+    annotations: readOnly,
+}, ({ project: root, diff, prove }) => answer(async () => {
+    if (!isAbsolute(root) || !existsSync(root))
+        throw new Error(`project must be an existing absolute path, got "${root}"`);
+    // gather/decide/render are pure; runDone prints, which would corrupt the protocol.
+    const { gather } = await import('../engine/verdict/verdict-command.js');
+    const { decide, renderDecision } = await import('../engine/verdict/verdict.js');
+    const range = diff ?? 'main...HEAD';
+    const gathered = gather({ root, diff: range, prove });
+    if (!gathered)
+        return `Nothing changed in ${range}, or that range could not be read here.`;
+    return renderDecision(range, decide(gathered.evidence));
+}));
 await server.connect(new StdioServerTransport());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tewip-ai",
-  "version": "0.27.0",
+  "version": "0.28.0",
   "description": "Tewip finds why each failing test failed - real bug, flaky test, environment, test data or changed selector - for any stack, from the command line, CI, or your editor.",
   "keywords": [
     "test-failures",