tickmarkr 1.44.0 → 1.45.0

package/dist/cli/commands/compile.js

@@ -2,7 +2,7 @@ import { isAbsolute, join } from "node:path";
 import { parseArgs } from "node:util";
 import { compileSource } from "../../compile/index.js";
 import { saveGraph, stateDirName } from "../../graph/graph.js";
-import { isRunLockLive } from "../../run/lock.js";
+import { acquireRunLock, releaseRunLock } from "../../run/lock.js";
 export async function compile(argv, cwd = process.cwd()) {
     const { values, positionals } = parseArgs({
         args: argv,
@@ -14,11 +14,15 @@ export async function compile(argv, cwd = process.cwd()) {
         throw new Error("usage: tickmarkr compile <spec-dir-or-md> [--type speckit|prd|gsd|native]");
     // resolve against the target repo, not the process cwd (the CLI test passes a tmp repo)
     const g = compileSource(isAbsolute(src) ? src : join(cwd, src), values.type, cwd);
-    // HARD-01: a compile clobbering a running daemon's graph.json is the same last-write-wins race
-    // as a second daemon. Read-only check — compile never acquires/holds (it's instantaneous).
+    // HARD-01 / Sol #3: hold the same link(2) run lock as the daemon around saveGraph so compile
+    // cannot swap graph.json under an active run between the daemon's read and act.
     const stateDir = stateDirName(cwd);
-    if (isRunLockLive(cwd))
-        throw new Error(`${stateDir}/graph.lock is held by another tickmarkr run, or is a stale/garbage lock — refusing to overwrite graph.json. If no run is active, run \`tickmarkr unlock\`.`);
-    saveGraph(cwd, g);
+    acquireRunLock(cwd, "compile");
+    try {
+        saveGraph(cwd, g);
+    }
+    finally {
+        releaseRunLock(cwd);
+    }
     return `compiled ${src} → ${stateDir}/graph.json (${g.tasks.length} tasks, source ${g.spec.source}, hash ${g.spec.hash.slice(0, 12)})`;
 }

package/dist/cli/commands/resume.js

@@ -8,7 +8,11 @@ export async function resume(argv, cwd = process.cwd()) {
     const runId = argv[0];
     if (!runId)
         throw new Error("usage: tickmarkr resume <run-id>");
-    const s = await runDaemon(cwd, { runId, resume: true, driver: pickDriver(loadConfig(cwd)), narrate: (event) => console.log(formatJournalNarration(event)) });
+    // T3: --graph-changed is the operator's audited release of the engagement-identity guard (Sol #2 /
+    // Fable F2) — the daemon refuses a mismatched/unbound journal unless this is set, then journals a
+    // graph-rehash event naming both hashes. Strip the flag before runId resolution so a bare id still wins.
+    const graphChanged = argv.includes("--graph-changed");
+    const s = await runDaemon(cwd, { runId, resume: true, graphChanged, driver: pickDriver(loadConfig(cwd)), narrate: (event) => console.log(formatJournalNarration(event)) });
     const out = `resumed ${s.runId} — ${formatSummary(s)}`;
     return { out, code: summaryGreen(s) ? 0 : 2 };
 }

package/dist/cli/commands/status.js

@@ -1,7 +1,7 @@
 import { BANNER } from "../../brand.js";
-import { blockedTasks, loadGraph, pendingTasks } from "../../graph/graph.js";
+import { blockedTasks, graphDefinitionHash, loadGraph, pendingTasks } from "../../graph/graph.js";
 import { GATE_NAMES } from "../../graph/schema.js";
-import { Journal, journalComparable } from "../../run/journal.js";
+import { Journal, engagementComparable } from "../../run/journal.js";
 // ponytail: fixed 2s refresh; promote to config.visibility.* only when an operator asks.
 const REFRESH_MS = 2000;
 const NOT_COMPARABLE_NOTICE = "graph recompiled since this run — task states not comparable; run `tickmarkr run` to execute";
@@ -127,8 +127,10 @@ const renderFrame = (cwd) => {
     if (runId) {
         const j = Journal.open(cwd, runId);
         events = j.read();
-        // OBS-52: refuse journal join when the run's recorded graphHash ≠ loaded graph — bare task-id replay lied after recompile.
-        comparable = journalComparable(events, g.spec.hash);
+        // T3 (Sol #2 / Fable F2): the SAME comparator resume uses (engagementComparable) — one decision,
+        // two consumers. graphDefinitionHash (compiled task definitions only) survives status/evidence
+        // mutation but changes when a task definition changes, so a recompiled graph is detected here too.
+        comparable = engagementComparable(events, graphDefinitionHash(g)).comparable;
         if (comparable) {
             replayed = j.replayStatuses();
             for (const e of events) {

package/dist/gates/acceptance.d.ts

@@ -10,6 +10,8 @@ export interface JudgeVerdict {
         reason: string;
     }>;
 }
+export declare function judgeCriterionId(index: number): string;
+export declare function testFiltered(testCmd: string, name: string): string;
 export interface AcceptanceGateOpts {
     testCmd?: string;
     diffCap?: number;

package/dist/gates/acceptance.js

@@ -1,18 +1,93 @@
+import { z } from "zod";
 import { channelKey, shq } from "../adapters/types.js";
 import { DEFAULT_DIFF_CAP } from "../config/config.js";
 import { renderAcceptanceItem } from "../graph/schema.js";
 import { sh } from "../run/git.js";
 import { checkDiffCap, fetchTaskDiff } from "./review.js";
-import { extractJson, runLlm } from "./llm.js";
+import { extractVerdictJson, generateVerdictNonce, runLlm, verdictNonceLine } from "./llm.js";
+// Fable F4: acceptance judge shares review's 900s timeout — 300s default killed frontier judges on cap-sized diffs.
+const JUDGE_TIMEOUT_MS = 900_000;
+const JudgeVerdictRowSchema = z.object({
+    criterion: z.string(),
+    met: z.boolean(),
+    reason: z.string(),
+});
+const JudgeVerdictSchema = z.object({
+    pass: z.boolean(),
+    criteria: z.array(JudgeVerdictRowSchema),
+});
+export function judgeCriterionId(index) {
+    return `c${index + 1}`;
+}
+function renderJudgeCriterion(item, index) {
+    return `[${judgeCriterionId(index)}] ${renderAcceptanceItem(item)}`;
+}
+function checkJudgeVerdict(raw, expectedIds) {
+    const parsed = JudgeVerdictSchema.safeParse(raw);
+    if (!parsed.success) {
+        return {
+            verdict: { pass: false, criteria: [] },
+            inconsistencies: ["judge verdict inconsistent: malformed verdict shape"],
+        };
+    }
+    const v = parsed.data;
+    const inconsistencies = [];
+    const counts = new Map();
+    for (const row of v.criteria) {
+        counts.set(row.criterion, (counts.get(row.criterion) ?? 0) + 1);
+    }
+    for (const [id, n] of counts) {
+        if (n > 1)
+            inconsistencies.push(`judge verdict inconsistent: duplicate criterion id ${id}`);
+        if (!expectedIds.includes(id))
+            inconsistencies.push(`judge verdict inconsistent: unknown criterion id ${id}`);
+    }
+    for (const id of expectedIds) {
+        if (!counts.has(id))
+            inconsistencies.push(`judge verdict inconsistent: missing criterion id ${id}`);
+    }
+    for (const row of v.criteria) {
+        if (!row.met && v.pass) {
+            inconsistencies.push(`judge verdict inconsistent: pass=true contradicts unmet criterion ${row.criterion}`);
+        }
+    }
+    if (!v.pass && v.criteria.every((row) => row.met) && inconsistencies.length === 0 && v.criteria.length === expectedIds.length) {
+        inconsistencies.push("judge verdict inconsistent: pass=false contradicts all criteria met");
+    }
+    return { verdict: v, inconsistencies };
+}
 const isCommand = (a) => typeof a === "object" && a.oracle === "command";
 const isTest = (a) => typeof a === "object" && a.oracle === "test";
 const isJudge = (a) => typeof a === "string" || (typeof a === "object" && a.oracle === "judge");
 // npm/yarn/pnpm/npx script wrappers need `--` to forward -t to the underlying vitest/jest runner; a bare
 // runner (vitest/jest) takes -t directly. -t is the shared testNamePattern shorthand both honor.
-function testFiltered(testCmd, name) {
-    const fwd = /^\s*(npm|yarn|pnpm|npx)\b/.test(testCmd) ? "-- " : "";
+// OBS-55: when the base command already contains `--`, append -t after forwarded args — a second `--`
+// makes vitest treat -t as a positional file filter and the name filter is dropped.
+export function testFiltered(testCmd, name) {
+    const wrapped = /^\s*(npm|yarn|pnpm|npx)\b/.test(testCmd);
+    if (wrapped && /\s--\s/.test(testCmd))
+        return `${testCmd} -t ${shq(name)}`;
+    const fwd = wrapped ? "-- " : "";
     return `${testCmd} ${fwd}-t ${shq(name)}`;
 }
+// vitest/jest summary: "Tests  N passed | M skipped (T)" — count passed+failed as actually ran.
+function testsRan(output) {
+    const lines = output.replace(/\x1b\[[\d;#]*[A-Za-z]/g, "").split("\n");
+    for (let i = lines.length - 1; i >= 0; i--) {
+        const line = lines[i].trim();
+        const m = line.match(/^Tests\s+(.+?)\s*\(\d+\)\s*$/);
+        if (!m)
+            continue;
+        let ran = 0;
+        for (const chunk of m[1].split("|").map((s) => s.trim())) {
+            const n = chunk.match(/^(\d+)\s+(passed|failed)\b/);
+            if (n)
+                ran += Number(n[1]);
+        }
+        return ran;
+    }
+    return null;
+}
 // last few non-empty output lines, for context on a failing oracle (capped so details stay readable)
 function tail(out, n = 8) {
     const t = out.trim();
@@ -39,10 +114,17 @@ export async function acceptanceGate(task, worktree, baseRef, judge, via, opts =
                     details: `oracle failed: test "${a.test}" — no test command configured to run it (failing closed)` };
             }
             const r = await sh(testFiltered(opts.testCmd, a.test), worktree);
+            const out = (r.stderr || "") + "\n" + (r.stdout || "");
             if (r.code !== 0) {
                 return { gate: "acceptance", pass: false,
                     details: `oracle failed: test "${a.test}" (exit ${r.code})${tail(r.stderr || r.stdout)}` };
             }
+            // OBS-55: exit 0 alone is vacuous when the name filter matched zero tests — fail closed.
+            const ran = testsRan(out);
+            if (ran === null || ran < 1) {
+                return { gate: "acceptance", pass: false,
+                    details: `oracle failed: test "${a.test}" — name filter matched zero tests (filter: ${a.test})${tail(out)}` };
+            }
             passedDet.push(`✓ test: ${a.test} (exit 0)`);
         }
     }
@@ -63,6 +145,8 @@ export async function acceptanceGate(task, worktree, baseRef, judge, via, opts =
     const capFail = checkDiffCap("acceptance", forCap.length, diffCap, warn + detBlock);
     if (capFail)
         return capFail;
+    const expectedIds = judgeItems.map((_, index) => judgeCriterionId(index));
+    const nonce = generateVerdictNonce();
     const prompt = `TICKMARKR-JUDGE
 You are a strict acceptance judge. Decide whether the diff satisfies EVERY acceptance criterion.
 Judge only what the diff proves — plausible-but-wrong must fail. Do not award partial credit.
@@ -72,19 +156,22 @@ Deterministic command/test oracles have already passed mechanically; judge ONLY
 Goal: ${task.goal}
 
 ## Acceptance criteria (judge)
-${judgeItems.map((a) => `- ${renderAcceptanceItem(a)}`).join("\n")}
+${judgeItems.map((a, index) => `- ${renderJudgeCriterion(a, index)}`).join("\n")}
 
 ## Diff (vs base)
 \`\`\`diff
 ${diff}
 \`\`\`
 
+${verdictNonceLine(nonce)}
+
 Respond with ONLY this JSON (no prose before or after):
-{"pass": true|false, "criteria": [{"criterion": "...", "met": true|false, "reason": "..."}]}
+{"nonce": "${nonce}", "pass": true|false, "criteria": [{"criterion": "c1", "met": true|false, "reason": "..."}]}
+Each criteria[].criterion MUST be the stable id from the rubric (c1, c2, ...) exactly once.
 `;
-    const raw = await runLlm(judge.adapter, judge.model, prompt, worktree, via);
-    const v = extractJson(raw);
-    if (!v || typeof v.pass !== "boolean" || !Array.isArray(v.criteria)) {
+    const raw = await runLlm(judge.adapter, judge.model, prompt, worktree, via, JUDGE_TIMEOUT_MS);
+    const extracted = extractVerdictJson(raw, nonce);
+    if (!extracted) {
         // GATE-09: structured meta names the flaked judge channel (mirrors review.ts:99 meta precedent) so
         // run-gates can retry the judge on a failover channel without string-matching details (D-03).
         // The parsed-verdict paths below are untouched — the flake signal is exactly extractJson→null here.
@@ -92,25 +179,9 @@ Respond with ONLY this JSON (no prose before or after):
             details: warn + detBlock + "judge output unparseable — failing closed",
             meta: { unparseable: true, judge: channelKey({ adapter: judge.adapter.id, model: judge.model }) } };
     }
-    const inconsistencies = [];
-    const expected = judgeItems.length;
-    const received = v.criteria.length;
-    // OBS-51: judges sometimes split one semicolon-joined criterion into multiple verdict items.
-    const clauseSplitAllPass = received > expected
-        && v.criteria.every((c) => c && typeof c === "object" && c.met === true);
-    if (received !== expected && !clauseSplitAllPass) {
-        inconsistencies.push(`judge verdict inconsistent: criteria count mismatch — expected ${expected}, received ${received}`);
-    }
-    v.criteria.forEach((c, i) => {
-        if (!c || typeof c !== "object" || c.met !== true) {
-            const unmet = c && typeof c === "object" && c.criterion ? ` — unmet clause: ${c.criterion}` : "";
-            inconsistencies.push(`judge verdict inconsistent: criteria[${i}].met must be true${unmet}`);
-        }
-    });
-    const pass = v.pass === true && inconsistencies.length === 0;
-    const lines = v.criteria.map((c, i) => c && typeof c === "object"
-        ? `${c.met ? "✓" : "✗"} ${c.criterion}: ${c.reason}`
-        : `✗ criteria[${i}]: invalid criterion`);
+    const { verdict: v, inconsistencies } = checkJudgeVerdict(extracted, expectedIds);
+    const pass = v.pass === true && inconsistencies.length === 0 && v.criteria.every((row) => row.met);
+    const lines = v.criteria.map((row) => `${row.met ? "✓" : "✗"} ${row.criterion}: ${row.reason}`);
     if (!v.pass)
         lines.push("judge verdict pass=false");
     lines.push(...inconsistencies);

package/dist/gates/llm.d.ts

@@ -1,6 +1,12 @@
 import type { WorkerAdapter } from "../adapters/types.js";
 import { type ExecutorDriver, type Slot } from "../drivers/types.js";
 export declare const GATE_PANE_SEP = " \u00B7 ";
+/** Fable F3: per-call nonce echoed in verdict JSON and gate exit markers. */
+export declare function generateVerdictNonce(): string;
+export declare function verdictNonceLine(nonce: string): string;
+export declare function extractPromptNonce(prompt: string): string | null;
+export declare function gateExitTrailer(nonce: string): string;
+export declare function augmentFakeVerdictOutput(adapter: WorkerAdapter, out: string, nonce: string): string;
 export type GatePaneRole = "judge" | "review" | "consult";
 /** T8: role-first pane name for fleet visibility — judge · T4, review · T3, consult · T2. */
 export declare function gatePaneName(role: GatePaneRole, taskId: string, suffix?: string): string;
@@ -23,3 +29,5 @@ export declare function runHeadless(adapter: WorkerAdapter, model: string, promp
 export declare function runViaDriver(adapter: WorkerAdapter, model: string, prompt: string, cwd: string, via: LlmVia, timeoutMs?: number): Promise<string>;
 export declare function runLlm(adapter: WorkerAdapter, model: string, prompt: string, cwd: string, via?: LlmVia, timeoutMs?: number): Promise<string>;
 export declare function extractJson<T>(raw: string): T | null;
+/** Fable F3: verdict JSON must echo the call nonce — skip unbound or mismatched objects. */
+export declare function extractVerdictJson<T>(raw: string, nonce: string): T | null;

package/dist/gates/llm.js

@@ -1,10 +1,35 @@
+import { randomBytes } from "node:crypto";
 import { mkdtempSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { formatOwnedName, parseOwnedName } from "../drivers/types.js";
-import { bannerShell, paneDispatchCommand, paneDispatchScript } from "../brand.js";
+import { bannerShell, paneDispatchCommand } from "../brand.js";
 import { sh } from "../run/git.js";
 export const GATE_PANE_SEP = " · ";
+/** Fable F3: per-call nonce echoed in verdict JSON and gate exit markers. */
+export function generateVerdictNonce() {
+    return randomBytes(4).toString("hex");
+}
+export function verdictNonceLine(nonce) {
+    return `VERDICT_NONCE: ${nonce}`;
+}
+export function extractPromptNonce(prompt) {
+    return /VERDICT_NONCE:\s*([0-9a-f]+)/i.exec(prompt)?.[1] ?? null;
+}
+export function gateExitTrailer(nonce) {
+    return `printf '\\nTICKMARKR_''EXIT_${nonce}:%s\\n' $?`;
+}
+// ponytail: fake adapter serves static verdict JSON without nonce; append a bound copy for zero-token tests.
+export function augmentFakeVerdictOutput(adapter, out, nonce) {
+    if (adapter.id !== "fake")
+        return out;
+    const obj = extractJson(out);
+    if (!obj || typeof obj !== "object" || obj.nonce === nonce)
+        return out;
+    if (typeof obj.nonce === "string")
+        return out;
+    return `${out}\n${JSON.stringify({ ...obj, nonce })}`;
+}
 /** T8: role-first pane name for fleet visibility — judge · T4, review · T3, consult · T2. */
 export function gatePaneName(role, taskId, suffix = "") {
     return `${role}${GATE_PANE_SEP}${taskId}${suffix}`;
@@ -33,7 +58,11 @@ export async function runHeadless(adapter, model, prompt, cwd, timeoutMs = 30000
     const pf = join(mkdtempSync(join(tmpdir(), "tickmarkr-llm-")), "prompt.md");
     writeFileSync(pf, prompt);
     const r = await sh(adapter.headlessCommand(pf, model), cwd, timeoutMs);
-    return r.stdout + "\n" + r.stderr;
+    const nonce = extractPromptNonce(prompt);
+    let out = r.stdout + "\n" + r.stderr;
+    if (nonce)
+        out = augmentFakeVerdictOutput(adapter, out, nonce);
+    return out;
 }
 // v1.1 default path: the same headless CLI call, but dispatched through the driver
 // as a visible named agent (herdr pane), with the quote-split completion wrapper.
@@ -43,17 +72,23 @@ export async function runViaDriver(adapter, model, prompt, cwd, via, timeoutMs =
     writeFileSync(pf, prompt);
     const scriptPath = join(dir, "dispatch.sh");
     // OBS-50: bootstrap in a script beside the prompt — pane sees one short bash line + banner, not the raw inline command
-    writeFileSync(scriptPath, paneDispatchScript([bannerShell(), adapter.headlessCommand(pf, model)]));
+    const nonce = extractPromptNonce(prompt) ?? generateVerdictNonce();
+    writeFileSync(scriptPath, [
+        "export BASH_SILENCE_DEPRECATION_WARNING=1",
+        bannerShell(),
+        adapter.headlessCommand(pf, model),
+        gateExitTrailer(nonce),
+    ].join("\n"));
     const slot = await via.driver.slot(cwd, rolePaneNameFromPrompt(prompt, via.name), via.label ? { label: via.label } : undefined);
     via.onSlot?.(slot);
     await via.driver.run(slot, paneDispatchCommand(scriptPath));
-    // wait for the digit-suffixed marker (a real $? exit code), never a bare "TICKMARKR_EXIT:" that a
-    // self-referential diff under review merely DISPLAYS — same guard the worker path uses (daemon.ts:193).
-    // Without it, a judge/review pane echoing tickmarkr's own source false-completes before its verdict lands.
-    await via.driver.waitOutput(slot, "TICKMARKR_EXIT:\\d", timeoutMs, { regex: true });
-    const out = await via.driver.read(slot, 400);
+    // nonce-suffixed exit only: a displayed bare "TICKMARKR_EXIT:" or another call's marker must not
+    // false-complete — same guard the worker path uses (daemon.ts:330-331).
+    await via.driver.waitOutput(slot, `TICKMARKR_EXIT_${nonce}:\\d`, timeoutMs, { regex: true });
+    let out = await via.driver.read(slot, 400);
     if (!via.keep)
         await via.driver.close(slot);
+    out = augmentFakeVerdictOutput(adapter, out, nonce);
     return out;
 }
 export function runLlm(adapter, model, prompt, cwd, via, timeoutMs = 300000) {
@@ -104,3 +139,52 @@ export function extractJson(raw) {
     }
     return null;
 }
+/** Fable F3: verdict JSON must echo the call nonce — skip unbound or mismatched objects. */
+export function extractVerdictJson(raw, nonce) {
+    const fenced = [...raw.matchAll(/```json\s*\n([\s\S]*?)```/g)];
+    for (let fi = fenced.length - 1; fi >= 0; fi--) {
+        try {
+            const v = JSON.parse(fenced[fi][1]);
+            if (v && typeof v === "object" && v.nonce === nonce) {
+                const { nonce: _n, ...rest } = v;
+                return rest;
+            }
+        }
+        catch {
+            /* fall through */
+        }
+    }
+    let pos = raw.length - 1;
+    while (pos >= 0) {
+        const end = raw.lastIndexOf("}", pos);
+        if (end === -1)
+            return null;
+        let depth = 1;
+        let stepped = false;
+        for (let i = end - 1; i >= 0; i--) {
+            if (raw[i] === "}")
+                depth++;
+            else if (raw[i] === "{") {
+                depth--;
+                if (depth === 0) {
+                    stepped = true;
+                    try {
+                        const v = JSON.parse(raw.slice(i, end + 1));
+                        if (v && typeof v === "object" && v.nonce === nonce) {
+                            const { nonce: _n, ...rest } = v;
+                            return rest;
+                        }
+                    }
+                    catch {
+                        /* keep scanning */
+                    }
+                    pos = i - 1;
+                    break;
+                }
+            }
+        }
+        if (!stepped)
+            return null;
+    }
+    return null;
+}

package/dist/gates/review.js

@@ -4,7 +4,7 @@ import { renderAcceptanceItem } from "../graph/schema.js";
 import { getAdapter } from "../adapters/registry.js";
 import { shOk } from "../run/git.js";
 import { marginalCostRank } from "../route/router.js";
-import { extractJson, runLlm } from "./llm.js";
+import { extractVerdictJson, generateVerdictNonce, runLlm, verdictNonceLine } from "./llm.js";
 // OBS-48: cap on zero-context diff bytes (git diff -U0), not context-padded full diff — scattered
 // one-line hunks no longer trip at ~370 diff-bytes per changed line. Full diff still goes to the judge.
 const DIFF_CAP_REMEDY = "split the task, or raise gates.diffCap";
@@ -68,6 +68,7 @@ export async function reviewGate(task, worktree, baseRef, author, channels, adap
     const capFail = checkDiffCap("review", forCap.length, diffCap);
     if (capFail)
         return capFail;
+    const nonce = generateVerdictNonce();
     const prompt = `TICKMARKR-REVIEW
 You are a skeptical cross-vendor code reviewer. Another agent (vendor: ${author.adapter}) authored this diff.
 Look for correctness bugs, security issues, and acceptance-criteria gaps. Approve only if you would merge it.
@@ -81,8 +82,10 @@ ${task.acceptance.map((a) => `- ${renderAcceptanceItem(a)}`).join("\n")}
 ${diff}
 \`\`\`
 
+${verdictNonceLine(nonce)}
+
 Respond with ONLY this JSON:
-{"approve": true|false, "issues": ["..."]}
+{"nonce": "${nonce}", "approve": true|false, "issues": ["..."]}
 `;
     const raw = await runLlm(getAdapter(reviewer.adapter, adapters), reviewer.model, prompt, worktree, via ? { driver: via.driver, keep: via.keep, onSlot: via.onSlot, name: via.nameFor("review", reviewer.adapter), label: via.labelFor("review") } : undefined, 
     // frontier reviewers routinely need >5min on a configured-cap-sized diff, and `claude -p` buffers all
@@ -91,7 +94,7 @@ Respond with ONLY this JSON:
     // (run-20260709-104447 P87-09). ponytail: literal 15min; make it cfg.review.timeoutMs if a
     // second knob-turner appears.
     900_000);
-    const v = extractJson(raw);
+    const v = extractVerdictJson(raw, nonce);
     if (!v || typeof v.approve !== "boolean" || !Array.isArray(v.issues)) {
         return {
             gate: "review",

package/dist/graph/graph.d.ts

@@ -1,6 +1,7 @@
 import { type RunGraph, type Task, type TaskStatus } from "./schema.js";
 export declare function stateDirName(_repoRoot: string): string;
 export declare function graphPath(repoRoot: string): string;
+export declare function graphDefinitionHash(g: RunGraph): string;
 export declare function tickmarkrDir(repoRoot: string): string;
 export declare function loadGraph(repoRoot: string): RunGraph;
 export declare function saveGraph(repoRoot: string, g: RunGraph): void;

package/dist/graph/graph.js

@@ -1,3 +1,4 @@
+import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { validateGraph } from "./schema.js";
@@ -7,6 +8,17 @@ export function stateDirName(_repoRoot) {
 export function graphPath(repoRoot) {
     return join(repoRoot, stateDirName(repoRoot), "graph.json");
 }
+// T3 (Sol #2 / Fable F2): ONE canonical engagement identity over COMPILED TASK DEFINITIONS only.
+// status/evidence are runtime-mutated (the daemon flips status, accumulates evidence every attempt) so
+// they are excluded — the identity survives a status flip or evidence growth but changes the instant a
+// task definition changes (goal/acceptance/deps/gates/etc.). Shared by status AND resume through the
+// single comparator in journal.ts (engagementComparable) so the journal↔graph join is decided once.
+// ponytail: sha256 truncated to 16 hex — stable, grep-friendly; promote to full digest only if a
+// collision ever bites (engagement ids are not a trust boundary, collisions just force a re-run).
+export function graphDefinitionHash(g) {
+    const definitions = g.tasks.map(({ status: _status, evidence: _evidence, ...def }) => def);
+    return createHash("sha256").update(JSON.stringify({ version: g.version, spec: g.spec, tasks: definitions })).digest("hex").slice(0, 16);
+}
 export function tickmarkrDir(repoRoot) {
     const dir = join(repoRoot, stateDirName(repoRoot));
     mkdirSync(dir, { recursive: true });

package/dist/run/consult.d.ts

@@ -18,7 +18,7 @@ export interface Dossier {
     diff: string;
     gates: GateResult[];
 }
-export declare function buildDossierPrompt(d: Dossier): string;
+export declare function buildDossierPrompt(d: Dossier, nonce: string): string;
 export declare function consult(d: Dossier, cfg: TickmarkrConfig, adapters: WorkerAdapter[], driver: ExecutorDriver, cwd: string, runDir: string, opts?: {
     keep?: boolean;
     onSlot?: (slot: Slot) => void;

package/dist/run/consult.js

@@ -1,8 +1,8 @@
 import { mkdirSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { getAdapter } from "../adapters/registry.js";
-import { bannerShell, paneDispatchCommand, paneDispatchScript } from "../brand.js";
-import { extractJson, gatePaneName } from "../gates/llm.js";
+import { bannerShell, paneDispatchCommand } from "../brand.js";
+import { augmentFakeVerdictOutput, extractVerdictJson, gateExitTrailer, gatePaneName, generateVerdictNonce, verdictNonceLine } from "../gates/llm.js";
 import { sh } from "./git.js";
 const MAX_RETRY_GUIDANCE_LINES = 10;
 function guidanceParts(text) {
@@ -20,7 +20,7 @@ export function renderRetryGuidance(v) {
     return lines.slice(0, MAX_RETRY_GUIDANCE_LINES).map((l) => `- ${l}`).join("\n");
 }
 const ACTIONS = ["retry", "reroute", "decompose", "human"];
-export function buildDossierPrompt(d) {
+export function buildDossierPrompt(d, nonce) {
     return `TICKMARKR-CONSULT
 You are a senior engineering consult for the tickmarkr orchestrator. A worker task hit trouble.
 Read the dossier and return a verdict. Be decisive; cost is the lowest priority, quality the highest.
@@ -47,8 +47,10 @@ channel of that adapter for this task. Use it for environmental failures ("the C
 trust dialog, broken install) — not when a single model produced bad code. Omit for model-level
 reroutes so other models of the same adapter remain eligible.
 
+${verdictNonceLine(nonce)}
+
 Respond with ONLY this JSON:
-{"action": "retry" | "reroute" | "decompose" | "human", "reason": "why this action", "guidance": "imperative steps for the worker (newline-separated ok)", "excludeAdapter"?: "<adapter-id>"}
+{"nonce": "${nonce}", "action": "retry" | "reroute" | "decompose" | "human", "reason": "why this action", "guidance": "imperative steps for the worker (newline-separated ok)", "excludeAdapter"?: "<adapter-id>"}
 `;
 }
 let consultSeq = 0;
@@ -57,15 +59,17 @@ export async function consult(d, cfg, adapters, driver, cwd, runDir,
 // via SlotOpts.owned; without it the legacy gatePaneName shape survives (non-daemon callers/tests).
 opts = {}) {
     const n = ++consultSeq;
+    const nonce = generateVerdictNonce();
     const dir = join(runDir, "consults");
     mkdirSync(dir, { recursive: true });
     const promptFile = join(dir, `${d.taskId}-${n}.md`);
-    writeFileSync(promptFile, buildDossierPrompt(d));
+    writeFileSync(promptFile, buildDossierPrompt(d, nonce));
     const adapter = getAdapter(cfg.consult.adapter, adapters);
     let out;
     if (cfg.visibility.llm === "headless") {
         const r = await sh(adapter.headlessCommand(promptFile, cfg.consult.model), cwd, cfg.consult.stallMinutes * 60_000);
         out = r.stdout + r.stderr;
+        out = augmentFakeVerdictOutput(adapter, out, nonce);
     }
     else {
         // T8: role-first pane name for fleet visibility (consult · T2); consultSeq stays on the dossier artifact only
@@ -76,16 +80,21 @@ opts = {}) {
         opts.onSlot?.(slot);
         const scriptPath = join(dir, `${d.taskId}-${n}.sh`);
         // OBS-50: visible consult panes get the brand banner; headless path above stays banner-free (machine-parsed stdout)
-        writeFileSync(scriptPath, paneDispatchScript([bannerShell(), adapter.headlessCommand(promptFile, cfg.consult.model)]));
+        writeFileSync(scriptPath, [
+            "export BASH_SILENCE_DEPRECATION_WARNING=1",
+            bannerShell(),
+            adapter.headlessCommand(promptFile, cfg.consult.model),
+            gateExitTrailer(nonce),
+        ].join("\n"));
         await driver.run(slot, paneDispatchCommand(scriptPath));
-        // digit-suffixed marker only: a dossier quoting tickmarkr's own "TICKMARKR_EXIT:" literal must not
-        // false-complete the consult pane before its verdict (same guard as daemon.ts:193 / llm.ts).
-        await driver.waitOutput(slot, "TICKMARKR_EXIT:\\d", cfg.consult.stallMinutes * 60_000, { regex: true });
+        // nonce-suffixed exit only: a dossier quoting tickmarkr's own exit literal must not false-complete.
+        await driver.waitOutput(slot, `TICKMARKR_EXIT_${nonce}:\\d`, cfg.consult.stallMinutes * 60_000, { regex: true });
         out = await driver.read(slot, 300);
         if (!opts.keep)
             await driver.close(slot);
+        out = augmentFakeVerdictOutput(adapter, out, nonce);
     }
-    const v = extractJson(out);
+    const v = extractVerdictJson(out, nonce);
     if (!v || !ACTIONS.includes(v.action)) {
         return { action: "human", notes: "consult verdict unparseable — failing safe to human" };
     }

package/dist/run/daemon.d.ts

@@ -4,6 +4,7 @@ import { type JournalEvent } from "./journal.js";
 export interface RunOptions {
     runId?: string;
     resume?: boolean;
+    graphChanged?: boolean;
     concurrency?: number;
     driver?: ExecutorDriver;
     adapters?: WorkerAdapter[];

package/dist/run/daemon.js

@@ -9,10 +9,10 @@ import { herdrSealShellPrefix, SubprocessDriver } from "../drivers/subprocess.js
 import { formatOwnedName } from "../drivers/types.js";
 import { captureBaseline, detectGateCommands } from "../gates/baseline.js";
 import { runGates } from "../gates/run-gates.js";
-import { addEvidence, attributeBlocked, blockedTasks, getTask, loadGraph, pendingTasks, readyTasks, saveGraph, setStatus } from "../graph/graph.js";
+import { addEvidence, attributeBlocked, blockedTasks, getTask, graphDefinitionHash, loadGraph, pendingTasks, readyTasks, saveGraph, setStatus } from "../graph/graph.js";
 import { consult, renderRetryGuidance } from "./consult.js";
 import { cleanupRunWorktrees, gitHead, linkNodeModules, sh, WORKTREE_LAYOUT_CONTRACT } from "./git.js";
-import { Journal, loadRoutingProfile, newRunId } from "./journal.js";
+import { engagementComparable, Journal, loadRoutingProfile, newRunId } from "./journal.js";
 import { acquireRunLock, releaseRunLock } from "./lock.js";
 import { ensureIntegration, integrationBranch, integrationHead, mergeTask, verifyIntegrationTip } from "./merge.js";
 import { nextChannel, route } from "../route/router.js";
@@ -74,6 +74,24 @@ export async function runDaemon(repoRoot, opts = {}) {
             if (!start)
                 throw new Error(`journal for ${runId} has no run-start event`);
             baseRef = start.data.baseRef;
+            // T3 (Sol #2 / Fable F2): refuse to replay this journal's task states onto a graph it does not
+            // belong to — overlapping ids would inherit foreign done/human/approval state, missing ids throw.
+            // The SAME comparator status uses (engagementComparable); one decision, two consumers. Fail closed:
+            // no resume path silently accepts a mismatched or unbound journal. --graph-changed is the operator's
+            // audited release for the stop-amend-resume workflow, journaling a graph-rehash naming both hashes.
+            const loadedHash = graphDefinitionHash(graph);
+            const cmp = engagementComparable(journal.read(), loadedHash);
+            if (!cmp.comparable) {
+                if (!opts.graphChanged) {
+                    throw new Error(cmp.reason === "unbound"
+                        ? `refusing to resume ${runId}: journal has no recorded graph definition hash (older tickmarkr) — pass --graph-changed to override`
+                        : `refusing to resume ${runId}: graph changed since this run (recorded ${cmp.recorded} ≠ loaded ${loadedHash}) — pass --graph-changed to override`);
+                }
+                journal.append("graph-rehash", undefined, {
+                    from: cmp.reason === "mismatch" ? cmp.recorded : null,
+                    to: loadedHash,
+                });
+            }
             baseline = JSON.parse(readFileSync(join(journal.dir, "baseline.json"), "utf8"));
             for (const [id, st] of journal.replayStatuses()) {
                 // operator release: a graph.json edit back to "pending" beats a replayed human/failed park (locked decision 12)
@@ -87,7 +105,7 @@ export async function runDaemon(repoRoot, opts = {}) {
             baseRef = await gitHead(repoRoot);
             baseline = await captureBaseline(repoRoot, commands);
             writeFileSync(join(journal.dir, "baseline.json"), JSON.stringify(baseline, null, 2));
-            journal.append("run-start", undefined, { pid: process.pid, baseRef, commands, channels: channels.map(channelKey), branch, graphHash: graph.spec.hash }); // graphHash: OBS-52 status join guard; pid: v1.13 (VIS-11) liveness
+            journal.append("run-start", undefined, { pid: process.pid, baseRef, commands, channels: channels.map(channelKey), branch, graphDefinitionHash: graphDefinitionHash(graph) }); // graphDefinitionHash: T3 engagement identity (status+resume share it); pid: v1.13 (VIS-11) liveness
         }
         // T6: open the narrator AFTER run-start/run-resume is journaled so the watch surface has a run to
         // show. driver.narrator is undefined on subprocess → no-op (subprocess spawns nothing). Swallowed:

package/dist/run/journal.d.ts

@@ -62,9 +62,21 @@ export declare const TelemetryRowSchema: z.ZodObject<{
     }>>;
 }, z.core.$strip>;
 export type TelemetryRow = z.infer<typeof TelemetryRowSchema>;
-export declare function recordedGraphHash(events: JournalEvent[]): string | undefined;
-export declare function journalComparable(events: JournalEvent[], loadedHash: string): boolean;
+export declare function recordedGraphDefinitionHash(events: JournalEvent[]): string | undefined;
+export type EngagementCompare = {
+    comparable: true;
+    recorded: string;
+} | {
+    comparable: false;
+    reason: "mismatch";
+    recorded: string;
+} | {
+    comparable: false;
+    reason: "unbound";
+};
+export declare function engagementComparable(events: JournalEvent[], loadedHash: string): EngagementCompare;
 export declare function newRunId(now?: Date): string;
+export declare function parseRunId(runId: string): string;
 export declare function readAllTelemetry(repoRoot: string, lastK: number, opts?: {
     after?: string;
 }): (TelemetryRow & {

package/dist/run/journal.js

@@ -72,22 +72,47 @@ export const TelemetryRowSchema = z.object({
     // v1.29 additive: mode of the attempt represented by this row. Absent on old telemetry.
     retryMode: z.enum(RETRY_MODES).optional(),
 });
-// OBS-52: graph hash on run-start binds status replay to the compiled graph that started the run.
-export function recordedGraphHash(events) {
+// T3 (Sol #2 / Fable F2): one canonical engagement identity, shared by status AND resume. The run-start
+// event records graphDefinitionHash (over compiled task definitions only — see graph.graphDefinitionHash);
+// this is the single field both consumers read, and the single comparator below is the single place the
+// journal↔graph join is decided. unbound (no recorded definition hash, e.g. a pre-v1.44 journal) and
+// mismatch are both not-comparable — status renders the notice either way; resume refuses either way and
+// distinguishes the reason only for its message and the --graph-changed release event.
+export function recordedGraphDefinitionHash(events) {
     for (const e of events) {
-        if (e.event === "run-start" && typeof e.data.graphHash === "string")
-            return e.data.graphHash;
+        if (e.event === "run-start" && typeof e.data.graphDefinitionHash === "string")
+            return e.data.graphDefinitionHash;
     }
     return undefined;
 }
-export function journalComparable(events, loadedHash) {
-    const recorded = recordedGraphHash(events);
-    return recorded !== undefined && recorded === loadedHash;
+// THE shared comparator (criterion: status and resume decide through one comparator). status reads
+// .comparable; resume reads .comparable plus .reason/.recorded for its refusal message and the release.
+export function engagementComparable(events, loadedHash) {
+    const recorded = recordedGraphDefinitionHash(events);
+    if (recorded === undefined)
+        return { comparable: false, reason: "unbound" };
+    return recorded === loadedHash ? { comparable: true, recorded } : { comparable: false, reason: "mismatch", recorded };
 }
 export function newRunId(now = new Date()) {
     const p = (n, w = 2) => String(n).padStart(w, "0");
     return `run-${now.getFullYear()}${p(now.getMonth() + 1)}${p(now.getDate())}-${p(now.getHours())}${p(now.getMinutes())}${p(now.getSeconds())}`;
 }
+// Sol #4: one strict parser for every journal open/create path — generated run-… ids plus test
+// suffix chars only; forbid path separators, dot-segments, and empty ids.
+export function parseRunId(runId) {
+    const id = runId.trim();
+    if (!id)
+        throw new Error("invalid run id: empty");
+    if (id.includes("/") || id.includes("\\"))
+        throw new Error(`invalid run id: ${runId}`);
+    for (const seg of id.split(/[/\\]/)) {
+        if (seg === "." || seg === "..")
+            throw new Error(`invalid run id: ${runId}`);
+    }
+    if (!/^run-[A-Za-z0-9][A-Za-z0-9_-]*$/.test(id))
+        throw new Error(`invalid run id: ${runId}`);
+    return id;
+}
 const runsDir = (repoRoot) => join(repoRoot, stateDirName(repoRoot), "runs");
 // One JSONL reader for every append-only log: skip blanks, drop any line that
 // won't parse, keeping everything before it intact.
@@ -163,15 +188,19 @@ export class Journal {
         this.narrate = narrate;
     }
     static create(repoRoot, runId, narrate) {
-        const dir = join(runsDir(repoRoot), runId);
+        const id = parseRunId(runId);
+        const dir = join(runsDir(repoRoot), id);
+        if (existsSync(join(dir, "journal.jsonl")))
+            throw new Error(`journal already exists for ${id}`);
         mkdirSync(dir, { recursive: true });
-        return new Journal(dir, runId, narrate);
+        return new Journal(dir, id, narrate);
     }
     static open(repoRoot, runId, narrate) {
-        const dir = join(runsDir(repoRoot), runId);
+        const id = parseRunId(runId);
+        const dir = join(runsDir(repoRoot), id);
         if (!existsSync(join(dir, "journal.jsonl")))
-            throw new Error(`no journal for ${runId} at ${dir}`);
-        return new Journal(dir, runId, narrate);
+            throw new Error(`no journal for ${id} at ${dir}`);
+        return new Journal(dir, id, narrate);
     }
     // withJournal: journal.jsonl appears at first append, after Journal.create mkdirs — a caller that
     // will Journal.open the result (status, report) must fall back to the newest run that is actually

package/dist/run/lock.js

@@ -141,9 +141,9 @@ export function releaseRunLock(repoRoot) {
     unlinkIfOurs(lockPath(repoRoot)); // never delete a reclaiming successor's lock — only ours
     heldPath = undefined;
 }
-// Read-only check for compile: true iff a lock exists that the decision table would REFUSE on
-// (alive, EPERM, or ANY garbage). A provably-dead holder (ESRCH) reads not-live — compile proceeds
-// in step with resume (LOCK-02/OBS-05). Never mutates the lock.
+// Read-only predicate: true iff a lock exists that the decision table would REFUSE on (alive,
+// EPERM, or ANY garbage). A provably-dead holder (ESRCH) reads not-live (LOCK-02/OBS-05). Never
+// mutates the lock. compile now acquires via acquireRunLock; this remains for drift oracles/tests.
 export function isRunLockLive(repoRoot) {
     try {
         return shouldRefuse(inspect(lockPath(repoRoot)));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "1.44.0",
+  "version": "1.45.0",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",