tickmarkr 1.37.0 → 1.40.0

package/dist/config/config.js

@@ -9,6 +9,7 @@ const TierEnum = z.enum(TIERS, {
     error: (iss) => `Invalid option: expected one of "cheap"|"mid"|"frontier" (got ${JSON.stringify(iss.input)})`,
 });
 export const TIER_RANK = { cheap: 0, mid: 1, frontier: 2 };
+export const DEFAULT_DIFF_CAP = 60_000;
 export const MapEntrySchema = z.object({
     pin: z.object({ via: z.string(), model: z.string() }).optional(),
     tier: TierEnum.optional(),
@@ -63,7 +64,7 @@ const ShapeGateParticipationSchema = z
         });
     }
 });
-export const DrovrConfigSchema = z.object({
+export const TickmarkrConfigSchema = z.object({
     concurrency: z.number().int().positive(),
     driver: z.enum(["auto", "herdr", "subprocess"]),
     integrationBranchPrefix: z
@@ -86,13 +87,15 @@ export const DrovrConfigSchema = z.object({
             halfLifeRuns: z.number().positive().optional(),
             availWeight: z.number().nonnegative().optional(),
         }).optional(),
+        // Pre-v1.21 doctor.json lacks per-model verdicts. Keep legacy unknown-is-routable behavior opt-in.
+        allowUnverifiedModels: z.boolean(),
         allow: PrefBlockSchema.optional(),
         deny: PrefBlockSchema.optional(),
     }),
     tiers: z.record(z.string(), TierEntrySchema),
     pricing: z.record(z.string(), z.number()),
     // v1.20 REC-02: optional detailed price table for cost estimation. Distinct from `pricing` above
-    // (the coarse per-task tier estimate `drovr plan` shows) — this one drives the usage/cost report.
+    // (the coarse per-task tier estimate `tickmarkr plan` shows) — this one drives the usage/cost report.
     // Absent ⇒ every channel reports "not measurable" (never $0). models keyed by model id (LiteLLM
     // convention); subs keyed by adapter id (subscription plans are per-account, not per-token).
     cost: z
@@ -105,6 +108,7 @@ export const DrovrConfigSchema = z.object({
         build: z.string(),
         test: z.string(),
         lint: z.string(),
+        diffCap: z.number().int().positive(),
         byShape: z.partialRecord(z.enum(SHAPES), ShapeGateParticipationSchema).optional(),
     }).partial(),
     scope: z.object({
@@ -136,7 +140,7 @@ export class ConfigError extends Error {
 export const DEFAULT_CONFIG = {
     concurrency: 3,
     driver: "auto",
-    integrationBranchPrefix: "drovr/",
+    integrationBranchPrefix: "tickmarkr/",
     taskTimeoutMinutes: 30,
     contextWarnTokens: 170_000, // v1.23 T2: overseer ctx-watch.sh proven threshold
     routing: {
@@ -154,12 +158,13 @@ export const DEFAULT_CONFIG = {
         },
         // ROUTE-14 (2026-07-11, operator-adopted): learned reordering ON by default. Shipped OFF through v1.6/v1.7
         // as a preview-then-adopt trust ramp (ROUTE-09); the operator adopts it here after v1.8 made learning
-        // auditable (VIS-05 `drovr report` learning section) and matured (decay ROUTE-11, scored utilization
+        // auditable (VIS-05 `tickmarkr report` learning section) and matured (decay ROUTE-11, scored utilization
         // ROUTE-12, escalation tiebreak ROUTE-13). SAFE BY CONSTRUCTION: an empty/cold profile ⇒ every
         // learnedScore returns exactly NEUTRAL ⇒ byte-identical v1.5 static routing, so ON only changes routing in
         // a workspace that has accumulated ≥MIN_SAMPLES warm telemetry per cell. Preview any workspace's effect
-        // first with `drovr plan` / `drovr report`; flip to "off" to pin exact static routing (the kill switch stands).
+        // first with `tickmarkr plan` / `tickmarkr report`; flip to "off" to pin exact static routing (the kill switch stands).
         learned: "on",
+        allowUnverifiedModels: false,
     },
     // Seed table (spec §13). New models = edit this (or your config.yaml), never code.
     tiers: {
@@ -185,7 +190,7 @@ export const DEFAULT_CONFIG = {
         // promoted from overlay 2026-07-11 (MODEL-10).
         // grok-4.5-fast → cheap: speed-optimized variant, no independent benchmark scores yet → floor tier.
         // RETIRED 2026-07-13: cursor-agent seeds grok-4.5-xhigh / grok-4.5-fast-xhigh — CLI no longer reports
-        // either id (drovr plan lint, 2026-07-13). Tombstoned here; re-seed if cursor re-exposes them.
+        // either id (tickmarkr plan lint, 2026-07-13). Tombstoned here; re-seed if cursor re-exposes them.
         // (Benchmark provenance above still informs the native grok adapter seeds below.)
         "cursor-agent": {
             vendor: "cursor", channel: "sub",
@@ -230,7 +235,7 @@ export const DEFAULT_CONFIG = {
         },
     },
     pricing: { cheap: 0.1, mid: 0.5, frontier: 2.5 },
-    gates: {},
+    gates: { diffCap: DEFAULT_DIFF_CAP },
     judge: { adapter: "claude-code", model: "fable" },
     review: { complexityThreshold: 7, required: true },
     consult: { adapter: "claude-code", model: "fable", stallMinutes: 15 },
@@ -260,12 +265,8 @@ function readYaml(path) {
     return parse(readFileSync(path, "utf8"));
 }
 export function globalConfigDir() {
-    // read-old/write-new (operator-ordered rename 2026-07-15): prefer ~/.config/tickmarkr; an
-    // existing ~/.config/drovr keeps working until the operator moves it. New scaffolds use tickmarkr.
     const base = process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config");
-    const next = join(base, "tickmarkr");
-    const legacy = join(base, "drovr");
-    return existsSync(join(next, "config.yaml")) || !existsSync(join(legacy, "config.yaml")) ? next : legacy;
+    return join(base, "tickmarkr");
 }
 export function overlayPreferShapes(repoRoot, opts = {}) {
     const shapes = new Set();
@@ -284,7 +285,7 @@ export function loadConfig(repoRoot, opts = {}) {
     const globalCfg = readYaml(join(opts.globalDir ?? globalConfigDir(), "config.yaml"));
     const repoCfg = readYaml(join(repoRoot, stateDirName(repoRoot), "config.yaml"));
     const merged = deepMerge(deepMerge(structuredClone(DEFAULT_CONFIG), globalCfg), repoCfg);
-    const r = DrovrConfigSchema.safeParse(merged);
+    const r = TickmarkrConfigSchema.safeParse(merged);
     if (!r.success)
         throw new ConfigError(z.prettifyError(r.error));
     return r.data;
@@ -320,6 +321,7 @@ export function configTemplate(overlay) {
 # scope:
 #   allowDeviations: []    # globs an operator permits out-of-scope edits into, e.g. ["package-lock.json"]
 # gates:                  # override auto-detected commands; per-shape participation may only skip LLM gates
+#   diffCap: 60000         # fail closed before an LLM gate; split the task or raise this positive integer
 #   test: npm test
 #   byShape:
 #     docs: { acceptance: false, review: false }  # baseline, evidence, and scope are mandatory

package/dist/drivers/herdr.js

@@ -74,7 +74,7 @@ export class HerdrDriver {
     }
     async slot(cwd, name, opts) {
         // T1 ownership contract: `opts.owned` (T2 call sites) names the pane canonically —
-        // drovr:<role>:<taskId>:<attempt>:<runId>. Without it, `name` passes through byte-identical
+        // tickmarkr:<role>:<taskId>:<attempt>:<runId>. Without it, `name` passes through byte-identical
         // (today's legacy daemon/gates/consult shapes) — canonicalizeLegacyName (types.ts) is what lets
         // reconcile.ts and this driver's own renameGroupTab/glyphFor decode role/taskId/attempt from
         // those shapes without a call-site migration; T2 retires this branch by always passing `owned`.
@@ -92,7 +92,7 @@ export class HerdrDriver {
     // named after a dead cursor worker and the operator read it as a mislabeled agent)
     async tabSlot(cwd, name, label = name) {
         // tab-per-slot: concurrent agents in one tab split it into sliver columns — TUIs exit or
-        // hard-wrap at COLUMNS≈2, shredding even the DROVR_RESULT marker (v1.4 phase-1 incident).
+        // hard-wrap at COLUMNS≈2, shredding even the TICKMARKR_RESULT marker (v1.4 phase-1 incident).
         // A dedicated named tab gives every agent a full-width pane; tab close() reaps it.
         // VIS-10 (operator ruling 2026-07-11): "pane placed by focus heuristic" is a DEFECT CLASS.
         // Fail closed at every step — env unset, tab-create non-zero, unparseable stdout, or a parsed
@@ -100,7 +100,7 @@ export class HerdrDriver {
         if (!this.ws)
             throw new Error("herdr placement requires HERDR_WORKSPACE_ID — refusing untargeted pane (VIS-10: fail closed, never place by focus)");
         // pin the tab to the RUN's workspace, UNCONDITIONALLY (inherited via HERDR_WORKSPACE_ID), never the
-        // operator's focused one (Intl-Dossier run-20260709-104447 incident: worker tabs opened in the drovr repo workspace)
+        // operator's focused one (Intl-Dossier run-20260709-104447 incident: worker tabs opened in the tickmarkr repo workspace)
         const t = await this.herdr(`tab create --label ${shq(label)} --no-focus --workspace ${shq(this.ws)}`);
         if (t.code !== 0)
             throw new Error(`herdr tab create failed (exit ${t.code}, refusing untargeted placement): ${t.stderr || t.stdout}`);
@@ -139,7 +139,7 @@ export class HerdrDriver {
         if (typeof id !== "string" || !id)
             throw new Error(`herdr agent start returned no pane id: ${r.stdout}`);
         // tab create auto-spawns a root shell pane and agent start --tab adds the agent as a SECOND
-        // pane — reap the idle shell so no tab shows a dead "drovr git:" prompt beside its agent
+        // pane — reap the idle shell so no tab shows a dead "tickmarkr git:" prompt beside its agent
         // (VIS-04 orphan fix). Best-effort: a failed reap costs cosmetics only.
         if (typeof rootPane === "string" && rootPane && rootPane !== id) {
             await this.herdr(`pane close ${shq(rootPane)}`);
@@ -444,7 +444,7 @@ export class HerdrDriver {
             return s;
         });
     }
-    // OBS-17 T2 / v1.22b T1: close every drovr-owned pane that should not exist (superseded attempts,
+    // OBS-17 T2 / v1.22b T1: close every tickmarkr-owned pane that should not exist (superseded attempts,
     // killed-daemon orphans, leftovers from OLDER runs) — in this run's workspace OR misplaced in any
     // other one — then reap the tabs those closes emptied. Ownership is decided ONLY by parseOwnedName
     // (drivers/types.ts panesToClose) — foreign names never become candidates, in any workspace; a pane

package/dist/drivers/index.d.ts

@@ -1,3 +1,3 @@
-import type { DrovrConfig } from "../config/config.js";
+import type { TickmarkrConfig } from "../config/config.js";
 import type { ExecutorDriver } from "./types.js";
-export declare function pickDriver(cfg: DrovrConfig, override?: "auto" | "herdr" | "subprocess"): ExecutorDriver;
+export declare function pickDriver(cfg: TickmarkrConfig, override?: "auto" | "herdr" | "subprocess"): ExecutorDriver;

package/dist/drivers/subprocess.js

@@ -1,8 +1,8 @@
 import { spawn } from "node:child_process";
 import { createWorktree } from "../run/git.js";
-// HARD-03: cap retained worker output so a chatty worker can't grow drovr's heap unbounded.
+// HARD-03: cap retained worker output so a chatty worker can't grow tickmarkr's heap unbounded.
 // 2MB is safe against BOTH consumers: the largest read() call site asks for 1000 lines
-// (daemon.ts:217/247), and every marker (DROVR_RESULT, DROVR_EXIT_<nonce>) is emitted at the
+// (daemon.ts:217/247), and every marker (TICKMARKR_RESULT, TICKMARKR_EXIT_<nonce>) is emitted at the
 // END of output — a trailer would only be evicted if >2MB arrived AFTER it inside one 200ms
 // waitOutput poll (~10MB/s sustained, far beyond agent-CLI rates). Tail-truncate, never head:
 // consumers only ever tail-read.
@@ -43,7 +43,7 @@ export class SubprocessDriver {
     }
     async run(slot, cmd) {
         const s = this.state(slot);
-        // HARD-05: interactive=false — no operator, so an open stdin pipe is a promise drovr can never
+        // HARD-05: interactive=false — no operator, so an open stdin pipe is a promise tickmarkr can never
         // keep; codex exec appends a piped stdin as a <stdin> block (`codex exec --help`) and blocks on a
         // read that never EOFs. One spawn site covers every adapter (D-06).
         // v1.22 T3: seal herdr control vars so worker/judge/review/consult children cannot reach the
@@ -52,6 +52,7 @@ export class SubprocessDriver {
             cwd: slot.cwd,
             stdio: ["ignore", "pipe", "pipe"],
             env: sealHerdrEnv(process.env),
+            detached: true,
         });
         s.proc = p;
         p.stdout.on("data", (d) => (s.buf = (s.buf + d).slice(-MAX_BUF)));
@@ -96,8 +97,14 @@ export class SubprocessDriver {
     }
     async close(slot) {
         const s = this.slots.get(slot.id);
-        if (s?.proc && !s.exited)
-            s.proc.kill("SIGKILL");
+        if (s?.proc && !s.exited) {
+            try {
+                process.kill(-s.proc.pid, "SIGKILL");
+            }
+            catch {
+                s.proc.kill("SIGKILL");
+            }
+        }
         this.slots.delete(slot.id);
     }
     worktree(repo, branch, baseRef) {

package/dist/drivers/types.js

@@ -1,15 +1,13 @@
 // ---- Ownership contract (T1: OBS-17 pane-hygiene) --------------------------------------------
-// Every pane/tab drovr creates is identified by exactly one parseable token:
-//   drovr:<role>:<taskId>:<attempt>:<runId>
+// Every pane/tab tickmarkr creates is identified by exactly one parseable token:
+//   tickmarkr:<role>:<taskId>:<attempt>:<runId>
 // role ∈ OWNED_ROLES; attempt is a non-negative integer; taskId/runId never contain ":" (task and
 // run ids are alphanumeric/dash by construction elsewhere). formatOwnedName/parseOwnedName round-trip
 // exactly. parseOwnedName (or isForeignName) is the ONLY way reconcile.ts may decide a live pane name
-// is drovr-owned — anything that doesn't parse is foreign and is never a candidate for closing.
+// is tickmarkr-owned — anything that doesn't parse is foreign and is never a candidate for closing.
 export const OWNED_ROLES = ["worker", "judge", "review", "consult", "watch", "other"];
-// read-old/write-new: new panes are named tickmarkr:*, but reconcile still recognizes (and may
-// close/reuse) drovr:* panes left by pre-rename runs — resumed old runs keep working.
 const OWNED_PREFIX = "tickmarkr";
-const OWNED_RE = new RegExp(`^(?:${OWNED_PREFIX}|drovr):(${OWNED_ROLES.join("|")}):([^:]+):(\\d+):([^:]+)$`);
+const OWNED_RE = new RegExp(`^${OWNED_PREFIX}:(${OWNED_ROLES.join("|")}):([^:]+):(\\d+):([^:]+)$`);
 export function formatOwnedName(o) {
     return `${OWNED_PREFIX}:${o.role}:${o.taskId}:${o.attempt}:${o.runId}`;
 }

package/dist/gates/acceptance.d.ts

@@ -12,6 +12,7 @@ export interface JudgeVerdict {
 }
 export interface AcceptanceGateOpts {
     testCmd?: string;
+    diffCap?: number;
 }
 export declare function acceptanceGate(task: Task, worktree: string, baseRef: string, judge: {
     adapter: WorkerAdapter;

package/dist/gates/acceptance.js

@@ -1,8 +1,8 @@
 import { channelKey, shq } from "../adapters/types.js";
+import { DEFAULT_DIFF_CAP } from "../config/config.js";
 import { renderAcceptanceItem } from "../graph/schema.js";
 import { sh, shOk } from "../run/git.js";
 import { extractJson, runLlm } from "./llm.js";
-const DIFF_CAP = 60_000; // judge sees diff + criteria only, and not unboundedly (spec §12)
 const isCommand = (a) => typeof a === "object" && a.oracle === "command";
 const isTest = (a) => typeof a === "object" && a.oracle === "test";
 const isJudge = (a) => typeof a === "string" || (typeof a === "object" && a.oracle === "judge");
@@ -57,8 +57,13 @@ export async function acceptanceGate(task, worktree, baseRef, judge, via, opts =
     const warn = onlyJudge
         ? "WARNING: only judge oracles — no deterministic command/test oracle guards this task (deterministic preferred, spec §2).\n"
         : "";
-    const diff = (await shOk(`git diff '${baseRef}..HEAD'`, worktree)).slice(0, DIFF_CAP);
-    const prompt = `DROVR-JUDGE
+    const diff = await shOk(`git diff '${baseRef}..HEAD'`, worktree);
+    const diffCap = opts.diffCap ?? DEFAULT_DIFF_CAP;
+    if (diff.length > diffCap) {
+        return { gate: "acceptance", pass: false,
+            details: warn + detBlock + `diff exceeds verifiable cap (${diff.length} > ${diffCap}) — split the task, or raise gates.diffCap` };
+    }
+    const prompt = `TICKMARKR-JUDGE
 You are a strict acceptance judge. Decide whether the diff satisfies EVERY acceptance criterion.
 Judge only what the diff proves — plausible-but-wrong must fail. Do not award partial credit.
 Deterministic command/test oracles have already passed mechanically; judge ONLY the rubric items below.
@@ -87,6 +92,21 @@ Respond with ONLY this JSON (no prose before or after):
             details: warn + detBlock + "judge output unparseable — failing closed",
             meta: { unparseable: true, judge: channelKey({ adapter: judge.adapter.id, model: judge.model }) } };
     }
-    const lines = v.criteria.map((c) => `${c.met ? "✓" : "✗"} ${c.criterion}: ${c.reason}`);
-    return { gate: "acceptance", pass: v.pass, details: warn + detBlock + (lines.join("\n") || (v.pass ? "judge passed" : "judge failed")) };
+    const inconsistencies = [];
+    if (v.criteria.length !== judgeItems.length) {
+        inconsistencies.push(`judge verdict inconsistent: criteria count mismatch — expected ${judgeItems.length}, received ${v.criteria.length}`);
+    }
+    v.criteria.forEach((c, i) => {
+        if (!c || typeof c !== "object" || c.met !== true) {
+            inconsistencies.push(`judge verdict inconsistent: criteria[${i}].met must be true`);
+        }
+    });
+    const pass = v.pass === true && inconsistencies.length === 0;
+    const lines = v.criteria.map((c, i) => c && typeof c === "object"
+        ? `${c.met ? "✓" : "✗"} ${c.criterion}: ${c.reason}`
+        : `✗ criteria[${i}]: invalid criterion`);
+    if (!v.pass)
+        lines.push("judge verdict pass=false");
+    lines.push(...inconsistencies);
+    return { gate: "acceptance", pass, details: warn + detBlock + (lines.join("\n") || "judge passed") };
 }

package/dist/gates/baseline.d.ts

@@ -1,4 +1,4 @@
-import type { DrovrConfig } from "../config/config.js";
+import type { TickmarkrConfig } from "../config/config.js";
 import type { GateResult } from "./types.js";
 export interface Baseline {
     commands: Record<string, {
@@ -7,6 +7,6 @@ export interface Baseline {
     }>;
 }
 export declare function fingerprint(output: string): string[];
-export declare function detectGateCommands(repoRoot: string, cfg: DrovrConfig): Record<string, string>;
+export declare function detectGateCommands(repoRoot: string, cfg: TickmarkrConfig): Record<string, string>;
 export declare function captureBaseline(cwd: string, commands: Record<string, string>): Promise<Baseline>;
 export declare function compareToBaseline(cwd: string, commands: Record<string, string>, baseline: Baseline, enabled: string[]): Promise<GateResult[]>;

package/dist/gates/llm.js

@@ -2,6 +2,7 @@ import { mkdtempSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { formatOwnedName, parseOwnedName } from "../drivers/types.js";
+import { bannerShell } from "../brand.js";
 import { sh } from "../run/git.js";
 export const GATE_PANE_SEP = " · ";
 /** T8: role-first pane name for fleet visibility — judge · T4, review · T3, consult · T2. */
@@ -12,7 +13,7 @@ export function gatePaneName(role, taskId, suffix = "") {
 // via.name remains the fallback for non-gate runViaDriver callers and carries -r1 retry suffixes.
 // T2 ownership contract: a canonical owned fallback (the daemon's nameFor now emits one) passes
 // through untouched; run-gates' "-r1" judge-retry suffix becomes attempt+1 so the retry pane's name
-// stays contract-parseable (drovr:judge:<task>:1:<runId>) instead of a corrupted-runId shape.
+// stays contract-parseable (tickmarkr:judge:<task>:1:<runId>) instead of a corrupted-runId shape.
 export function rolePaneNameFromPrompt(prompt, fallback) {
     const retry = fallback.endsWith("-r1");
     const base = retry ? fallback.slice(0, -3) : fallback;
@@ -22,14 +23,14 @@ export function rolePaneNameFromPrompt(prompt, fallback) {
     const id = prompt.match(/## Task ([^\n:]+):/)?.[1];
     if (!id)
         return fallback;
-    if (prompt.startsWith("DROVR-JUDGE"))
+    if (prompt.startsWith("TICKMARKR-JUDGE"))
         return gatePaneName("judge", id, retry ? "-r1" : "");
-    if (prompt.startsWith("DROVR-REVIEW"))
+    if (prompt.startsWith("TICKMARKR-REVIEW"))
         return gatePaneName("review", id, retry ? "-r1" : "");
     return fallback;
 }
 export async function runHeadless(adapter, model, prompt, cwd, timeoutMs = 300000) {
-    const pf = join(mkdtempSync(join(tmpdir(), "drovr-llm-")), "prompt.md");
+    const pf = join(mkdtempSync(join(tmpdir(), "tickmarkr-llm-")), "prompt.md");
     writeFileSync(pf, prompt);
     const r = await sh(adapter.headlessCommand(pf, model), cwd, timeoutMs);
     return r.stdout + "\n" + r.stderr;
@@ -37,15 +38,17 @@ export async function runHeadless(adapter, model, prompt, cwd, timeoutMs = 30000
 // v1.1 default path: the same headless CLI call, but dispatched through the driver
 // as a visible named agent (herdr pane), with the quote-split completion wrapper.
 export async function runViaDriver(adapter, model, prompt, cwd, via, timeoutMs = 300000) {
-    const pf = join(mkdtempSync(join(tmpdir(), "drovr-llm-")), "prompt.md");
+    const pf = join(mkdtempSync(join(tmpdir(), "tickmarkr-llm-")), "prompt.md");
     writeFileSync(pf, prompt);
     const slot = await via.driver.slot(cwd, rolePaneNameFromPrompt(prompt, via.name), via.label ? { label: via.label } : undefined);
     via.onSlot?.(slot);
-    await via.driver.run(slot, `${adapter.headlessCommand(pf, model)}; printf '\\nDROVR_''EXIT:%s\\n' $?`);
-    // wait for the digit-suffixed marker (a real $? exit code), never a bare "DROVR_EXIT:" that a
+    // brand banner at pane top — gate panes run headless-print (no alt screen), so it stays visible;
+    // extractJson is anchored to JSON braces and the exit marker to TICKMARKR_EXIT:\d, neither matches banner text
+    await via.driver.run(slot, `${bannerShell()}; ${adapter.headlessCommand(pf, model)}; printf '\\nTICKMARKR_''EXIT:%s\\n' $?`);
+    // wait for the digit-suffixed marker (a real $? exit code), never a bare "TICKMARKR_EXIT:" that a
     // self-referential diff under review merely DISPLAYS — same guard the worker path uses (daemon.ts:193).
-    // Without it, a judge/review pane echoing drovr's own source false-completes before its verdict lands.
-    await via.driver.waitOutput(slot, "DROVR_EXIT:\\d", timeoutMs, { regex: true });
+    // Without it, a judge/review pane echoing tickmarkr's own source false-completes before its verdict lands.
+    await via.driver.waitOutput(slot, "TICKMARKR_EXIT:\\d", timeoutMs, { regex: true });
     const out = await via.driver.read(slot, 400);
     if (!via.keep)
         await via.driver.close(slot);

package/dist/gates/review.d.ts

@@ -1,5 +1,5 @@
 import { type Assignment, type BillingChannel, type WorkerAdapter } from "../adapters/types.js";
-import { type DrovrConfig } from "../config/config.js";
+import { type TickmarkrConfig } from "../config/config.js";
 import { type Task } from "../graph/schema.js";
 import { type GateVia } from "./llm.js";
 import type { GateResult } from "./types.js";
@@ -9,4 +9,4 @@ export interface ReviewVerdict {
 }
 export declare function modelId(model: string): string;
 export declare function pickReviewer(author: Assignment, channels: BillingChannel[], exclude?: string[]): BillingChannel | null;
-export declare function reviewGate(task: Task, worktree: string, baseRef: string, author: Assignment, channels: BillingChannel[], adapters: WorkerAdapter[], cfg: DrovrConfig, via?: GateVia, excludeReviewers?: string[]): Promise<GateResult>;
+export declare function reviewGate(task: Task, worktree: string, baseRef: string, author: Assignment, channels: BillingChannel[], adapters: WorkerAdapter[], cfg: TickmarkrConfig, via?: GateVia, excludeReviewers?: string[]): Promise<GateResult>;

package/dist/gates/review.js

@@ -1,5 +1,5 @@
 import { channelKey } from "../adapters/types.js";
-import { TIER_RANK } from "../config/config.js";
+import { DEFAULT_DIFF_CAP, TIER_RANK } from "../config/config.js";
 import { renderAcceptanceItem } from "../graph/schema.js";
 import { getAdapter } from "../adapters/registry.js";
 import { shOk } from "../run/git.js";
@@ -27,7 +27,6 @@ export function pickReviewer(author, channels, exclude = []) {
         .filter((c) => c.vendor !== authorChannel.vendor && modelId(c.model) !== modelId(author.model) && !exclude.includes(channelKey(c)))
         .sort((a, b) => TIER_RANK[b.tier] - TIER_RANK[a.tier] || marginalCostRank(a) - marginalCostRank(b))[0] ?? null);
 }
-const DIFF_CAP = 60_000;
 export async function reviewGate(task, worktree, baseRef, author, channels, adapters, cfg, via, excludeReviewers) {
     if (task.complexity < cfg.review.complexityThreshold) {
         return { gate: "review", pass: true, details: `skipped — complexity ${task.complexity} < threshold ${cfg.review.complexityThreshold}`, meta: { skipped: true } };
@@ -38,8 +37,13 @@ export async function reviewGate(task, worktree, baseRef, author, channels, adap
             ? { gate: "review", pass: false, details: "no cross-vendor reviewer available (diversity rule); set review.required:false to waive" }
             : { gate: "review", pass: true, details: "WARNING: no cross-vendor reviewer available — review waived by config" };
     }
-    const diff = (await shOk(`git diff '${baseRef}..HEAD'`, worktree)).slice(0, DIFF_CAP);
-    const prompt = `DROVR-REVIEW
+    const diff = await shOk(`git diff '${baseRef}..HEAD'`, worktree);
+    const diffCap = cfg.gates.diffCap ?? DEFAULT_DIFF_CAP;
+    if (diff.length > diffCap) {
+        return { gate: "review", pass: false,
+            details: `diff exceeds verifiable cap (${diff.length} > ${diffCap}) — split the task, or raise gates.diffCap` };
+    }
+    const prompt = `TICKMARKR-REVIEW
 You are a skeptical cross-vendor code reviewer. Another agent (vendor: ${author.adapter}) authored this diff.
 Look for correctness bugs, security issues, and acceptance-criteria gaps. Approve only if you would merge it.
 
@@ -56,14 +60,14 @@ Respond with ONLY this JSON:
 {"approve": true|false, "issues": ["..."]}
 `;
     const raw = await runLlm(getAdapter(reviewer.adapter, adapters), reviewer.model, prompt, worktree, via ? { driver: via.driver, keep: via.keep, onSlot: via.onSlot, name: via.nameFor("review", reviewer.adapter), label: via.labelFor("review") } : undefined, 
-    // frontier reviewers routinely need >5min on a DIFF_CAP-sized diff, and `claude -p` buffers all
+    // frontier reviewers routinely need >5min on a configured-cap-sized diff, and `claude -p` buffers all
     // output until completion — runLlm's 300s default killed reviews mid-flight, returning empty
     // stdout that read as "unparseable" and escalated to re-implementation of green code
     // (run-20260709-104447 P87-09). ponytail: literal 15min; make it cfg.review.timeoutMs if a
     // second knob-turner appears.
     900_000);
     const v = extractJson(raw);
-    if (!v || typeof v.approve !== "boolean") {
+    if (!v || typeof v.approve !== "boolean" || !Array.isArray(v.issues)) {
         return {
             gate: "review",
             pass: false,
@@ -71,10 +75,25 @@ Respond with ONLY this JSON:
             meta: { reviewer: channelKey(reviewer) },
         };
     }
+    const issues = v.issues;
+    const inconsistencies = [];
+    issues.forEach((issue, i) => {
+        if (typeof issue !== "string")
+            inconsistencies.push(`review verdict inconsistent: issues[${i}] must be a string`);
+    });
+    if (v.approve && issues.length) {
+        inconsistencies.push("review verdict inconsistent: approve=true requires issues to be empty");
+    }
+    else if (!v.approve && !issues.length) {
+        inconsistencies.push("review verdict inconsistent: approve=false requires at least one issue");
+    }
+    const pass = v.approve === true && inconsistencies.length === 0;
+    const lines = issues.map((issue) => `- ${typeof issue === "string" ? issue : JSON.stringify(issue)}`);
+    lines.push(...inconsistencies);
     return {
         gate: "review",
-        pass: v.approve,
-        details: `reviewer ${reviewer.adapter}:${reviewer.model} (${reviewer.vendor}): ${v.approve ? "approved" : "requested changes"}${v.issues?.length ? "\n" + v.issues.map((i) => `- ${i}`).join("\n") : ""}`,
+        pass,
+        details: `reviewer ${reviewer.adapter}:${reviewer.model} (${reviewer.vendor}): ${pass ? "approved" : v.approve ? "approval rejected" : "requested changes"}${lines.length ? "\n" + lines.join("\n") : ""}`,
         meta: { reviewer: channelKey(reviewer) },
     };
 }

package/dist/gates/run-gates.d.ts

@@ -1,5 +1,5 @@
 import { type Assignment, type BillingChannel, type WorkerAdapter, type WorkerResult } from "../adapters/types.js";
-import { type DrovrConfig } from "../config/config.js";
+import { type TickmarkrConfig } from "../config/config.js";
 import { type GateName, type Task } from "../graph/schema.js";
 import { type Baseline } from "./baseline.js";
 import type { GateVia } from "./llm.js";
@@ -23,7 +23,7 @@ export interface GateContext {
     baseline: Baseline;
     channels: BillingChannel[];
     adapters: WorkerAdapter[];
-    cfg: DrovrConfig;
+    cfg: TickmarkrConfig;
     via?: GateVia;
     excludeReviewers?: string[];
     onGate?: (e: GateEvent) => void | Promise<void>;

package/dist/gates/run-gates.js

@@ -63,7 +63,7 @@ export async function runGates(task, ctx) {
             : undefined;
         // v1.19 (T2): testCmd threads the detected test runner to the gate so named-test oracles run
         // deterministically (filtered via -t) before any LLM judge dispatch.
-        let a = await acceptanceGate(task, ctx.worktree, ctx.baseRef, { adapter: judgeAdapter, model: ctx.cfg.judge.model }, jvia, { testCmd: ctx.commands.test });
+        let a = await acceptanceGate(task, ctx.worktree, ctx.baseRef, { adapter: judgeAdapter, model: ctx.cfg.judge.model }, jvia, { testCmd: ctx.commands.test, diffCap: ctx.cfg.gates.diffCap });
         // GATE-09: an unparseable judge verdict retries the JUDGE exactly once on a failover channel — never
         // the worker (run-20260711-185020 P43-03 L70-72 billed a judge flake as a worker attempt). The flaked
         // first verdict NEVER enters results (no false gate-result journal event, no operator notify, no stale
@@ -89,7 +89,7 @@ export async function runGates(task, ctx) {
                 ? { driver: ctx.via.driver, keep: ctx.via.keep, onSlot: ctx.via.onSlot, name: ctx.via.nameFor("judge", retryAdapter.id) + "-r1", label: ctx.via.labelFor("judge") }
                 : undefined;
             // the retry IS a second acceptanceGate call: one code path, one parser, zero new parse leniency.
-            a = await acceptanceGate(task, ctx.worktree, ctx.baseRef, { adapter: retryAdapter, model: retry.model }, retryJvia, { testCmd: ctx.commands.test });
+            a = await acceptanceGate(task, ctx.worktree, ctx.baseRef, { adapter: retryAdapter, model: retry.model }, retryJvia, { testCmd: ctx.commands.test, diffCap: ctx.cfg.gates.diffCap });
             a = { ...a, meta: { ...a.meta, judgeRetry: { flaked: flakedKey, retried: channelKey({ adapter: retry.adapter, model: retry.model }) } } };
         }
         await record(a);

package/dist/graph/graph.d.ts

@@ -1,7 +1,7 @@
 import { type RunGraph, type Task, type TaskStatus } from "./schema.js";
-export declare function stateDirName(repoRoot: string): string;
+export declare function stateDirName(_repoRoot: string): string;
 export declare function graphPath(repoRoot: string): string;
-export declare function drovrDir(repoRoot: string): string;
+export declare function tickmarkrDir(repoRoot: string): string;
 export declare function loadGraph(repoRoot: string): RunGraph;
 export declare function saveGraph(repoRoot: string, g: RunGraph): void;
 export declare function getTask(g: RunGraph, id: string): Task;

package/dist/graph/graph.js

@@ -1,25 +1,13 @@
 import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { validateGraph } from "./schema.js";
-const stateDirs = new Map();
-export function stateDirName(repoRoot) {
-    const cached = stateDirs.get(repoRoot);
-    if (cached)
-        return cached;
-    const name = existsSync(join(repoRoot, ".tickmarkr"))
-        ? ".tickmarkr"
-        : existsSync(join(repoRoot, ".drovr"))
-            ? ".drovr"
-            : existsSync(join(repoRoot, ".drover"))
-                ? ".drover"
-                : ".tickmarkr";
-    stateDirs.set(repoRoot, name);
-    return name;
+export function stateDirName(_repoRoot) {
+    return ".tickmarkr";
 }
 export function graphPath(repoRoot) {
     return join(repoRoot, stateDirName(repoRoot), "graph.json");
 }
-export function drovrDir(repoRoot) {
+export function tickmarkrDir(repoRoot) {
     const dir = join(repoRoot, stateDirName(repoRoot));
     mkdirSync(dir, { recursive: true });
     const gi = join(dir, ".gitignore");
@@ -34,7 +22,7 @@ export function loadGraph(repoRoot) {
     return validateGraph(JSON.parse(readFileSync(p, "utf8")));
 }
 export function saveGraph(repoRoot, g) {
-    drovrDir(repoRoot);
+    tickmarkrDir(repoRoot);
     const p = graphPath(repoRoot);
     // Temp file MUST be a sibling of graph.json: rename(2) is atomic only within one filesystem
     // (never os.tmpdir()). pid-suffix so a racing writer can't clobber our in-flight temp (HARD-04).

package/dist/graph/schema.d.ts

@@ -77,6 +77,7 @@ export declare const TaskSchema: z.ZodObject<{
         escalate: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>;
     humanGate: z.ZodDefault<z.ZodBoolean>;
+    timeoutMinutes: z.ZodOptional<z.ZodNumber>;
     status: z.ZodDefault<z.ZodEnum<{
         pending: "pending";
         running: "running";
@@ -161,6 +162,7 @@ export declare const RunGraphSchema: z.ZodObject<{
             escalate: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>>;
         humanGate: z.ZodDefault<z.ZodBoolean>;
+        timeoutMinutes: z.ZodOptional<z.ZodNumber>;
         status: z.ZodDefault<z.ZodEnum<{
             pending: "pending";
             running: "running";

package/dist/graph/schema.js

@@ -2,6 +2,7 @@ import { z } from "zod";
 export const SHAPES = ["plan", "spec", "implement", "tests", "docs", "migration", "ui", "refactor", "chore"];
 export const STATUSES = ["pending", "running", "gated", "failed", "done", "human"];
 export const GATE_NAMES = ["build", "test", "lint", "evidence", "scope", "acceptance", "review"];
+const MANDATORY_GATES = ["build", "test", "lint", "evidence", "scope"];
 export const TIERS = ["cheap", "mid", "frontier"];
 // v1.19 acceptance oracles: command (exit code), test (named test), judge (LLM, free-text rubric).
 // A plain string is the read-old/write-new compat form — semantically a judge oracle (spec §2).
@@ -51,7 +52,19 @@ export const TaskSchema = z.object({
         reason: z.string().optional(),
     }))
         .optional(),
-    gates: z.array(z.enum(GATE_NAMES)).default(["build", "test", "lint", "evidence", "scope", "acceptance", "review"]),
+    gates: z
+        .array(z.enum(GATE_NAMES))
+        .default(["build", "test", "lint", "evidence", "scope", "acceptance", "review"])
+        .superRefine((gates, ctx) => {
+        for (const gate of MANDATORY_GATES) {
+            if (!gates.includes(gate)) {
+                ctx.addIssue({
+                    code: "custom",
+                    message: `${gate} is a mandatory fail-closed gate invariant and cannot be omitted from task gates`,
+                });
+            }
+        }
+    }),
     routingHints: z
         .object({
         pin: z.object({ via: z.string(), model: z.string() }).optional(),
@@ -61,6 +74,8 @@ export const TaskSchema = z.object({
     })
         .optional(),
     humanGate: z.boolean().default(false),
+    // v1.39 OBS-37b: per-task worker window override; absent ⇒ config taskTimeoutMinutes.
+    timeoutMinutes: z.number().positive().optional(),
     status: z.enum(STATUSES).default("pending"),
     evidence: z
         .object({

package/dist/plan/prompt.js

@@ -1,5 +1,5 @@
 export function scopePrompt(intent, repair) {
-    return `DROVR-JUDGE
+    return `TICKMARKR-JUDGE
 You are drafting a tickmarkr native spec from an answered intent. Return only the Markdown spec, with no commentary or code fence.
 
 The draft must:

package/dist/plan/scope.d.ts

@@ -1,9 +1,9 @@
 import type { WorkerAdapter } from "../adapters/types.js";
-import type { DrovrConfig } from "../config/config.js";
+import type { TickmarkrConfig } from "../config/config.js";
 import type { ExecutorDriver } from "../drivers/types.js";
 export declare function clarificationGate(intent: string): string[];
 export interface ScopeOptions {
-    cfg: DrovrConfig;
+    cfg: TickmarkrConfig;
     adapters: WorkerAdapter[];
     driver?: ExecutorDriver;
     force?: boolean;