tickmarkr 1.50.0 → 1.52.0

package/dist/run/daemon.js

@@ -1,12 +1,14 @@
 import { randomBytes } from "node:crypto";
 import { shq } from "../adapters/types.js";
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { stringify } from "yaml";
 import { trailerPattern, writePrompt } from "../adapters/prompt.js";
 import { allAdapters, discoverChannels, getAdapter, probeAll, readDoctor } from "../adapters/registry.js";
 import { addUsage, channelKey, matchesTrustDialog, QUOTA_RE } from "../adapters/types.js";
 import { bannerShell } from "../brand.js";
-import { loadConfig } from "../config/config.js";
+import { globalConfigDir, loadConfigWithMode, readOverlayFile, repoOverlayPath, } from "../config/config.js";
 import { herdrSealShellPrefix, SubprocessDriver } from "../drivers/subprocess.js";
 import { formatOwnedName } from "../drivers/types.js";
 import { captureBaseline, detectGateCommands } from "../gates/baseline.js";
@@ -17,8 +19,41 @@ import { cleanupRunWorktrees, gitHead, linkNodeModules, sh, shGit, WORKTREE_LAYO
 import { classifyWorkerResultCause, engagementComparable, Journal, loadRoutingProfile, newRunId } from "./journal.js";
 import { acquireRunLock, releaseRunLock } from "./lock.js";
 import { ensureIntegration, integrationBranch, integrationHead, mergeTask, verifyIntegrationTip } from "./merge.js";
-import { nextChannel, route } from "../route/router.js";
+import { nextChannel, QUALITY_ENV, route } from "../route/router.js";
 import { desiredPanes } from "./reconcile.js";
+const MODE_RANK = { "staff-led": 0, "risk-based": 1, "partner-led": 2 };
+// An override (flag/spec) re-resolves through loadConfigWithMode itself, via a synthesized repo overlay
+// carrying routing.mode — floors, explore, lints, and provenance all come from config.ts's preset
+// compiler, never duplicated mode math here (the quality-silently-loses defense holds by construction).
+function withOverlayMode(repoRoot, mode, globalDir) {
+    const overlay = readOverlayFile(repoOverlayPath(repoRoot));
+    const tmp = mkdtempSync(join(tmpdir(), "tickmarkr-mode-"));
+    try {
+        mkdirSync(join(tmp, ".tickmarkr"), { recursive: true });
+        writeFileSync(join(tmp, ".tickmarkr", "config.yaml"), stringify({ ...overlay, routing: { ...overlay.routing, mode } }));
+        return loadConfigWithMode(tmp, { globalDir });
+    }
+    finally {
+        rmSync(tmp, { recursive: true, force: true });
+    }
+}
+export function resolveRunMode(repoRoot, opts = {}) {
+    const overlayMode = (path) => readOverlayFile(path).routing?.mode;
+    const source = opts.flag !== undefined ? "run flag"
+        : opts.spec !== undefined ? "spec"
+            : overlayMode(repoOverlayPath(repoRoot)) !== undefined ? "repo config"
+                : overlayMode(join(opts.globalDir ?? globalConfigDir(), "config.yaml")) !== undefined ? "global config"
+                    : "default";
+    const override = opts.flag ?? opts.spec;
+    const base = loadConfigWithMode(repoRoot, { globalDir: opts.globalDir });
+    const resolved = override === undefined || override === base.mode.mode
+        ? base
+        : withOverlayMode(repoRoot, override, opts.globalDir);
+    const conflict = opts.flag !== undefined && opts.spec !== undefined && MODE_RANK[opts.flag] < MODE_RANK[opts.spec]
+        ? `mode conflict: run flag ${opts.flag} selects a mode below the spec-declared ${opts.spec} — the run flag wins this run`
+        : undefined;
+    return { cfg: resolved.cfg, mode: resolved.mode, source, ...(conflict ? { conflict } : {}) };
+}
 // VIS-01: one formatter, four readers (run-end journal event, run/resume CLI, run-end notify).
 // Parity by construction — every caller renders the same complete bucket line.
 export function formatSummary(s) {
@@ -54,14 +89,11 @@ async function cherryPickCommits(wt, commits) {
     return carried;
 }
 export async function runDaemon(repoRoot, opts = {}) {
-    const cfg = loadConfig(repoRoot, { globalDir: opts.globalDir });
+    // v1.51 T2: retired --quality env seam. Mode resolution owns premium routing now; an exported
+    // TICKMARKR_QUALITY must not resurrect the old one-band floor raise in daemon dispatches.
+    delete process.env[QUALITY_ENV];
     const adapters = opts.adapters ?? allAdapters();
     const health = readDoctor(repoRoot) ?? (await probeAll(adapters));
-    const channels = discoverChannels(cfg, adapters, health);
-    // v1.6 ROUTE-06: build the learned profile ONCE at startup (never per task, never in the comparator).
-    // No preview — the daemon honors routing.learned:off and gets undefined; this snapshot is immutable
-    // for the run, so this run's own telemetry never feeds back into its own routing.
-    const profile = loadRoutingProfile(repoRoot, cfg);
     const driver = opts.driver ?? new SubprocessDriver();
     // HARD-01/02: hold the run lock across the whole read-modify-write of graph.json. Acquire
     // BEFORE loadGraph; release in the finally below (every exit path, incl. throws).
@@ -72,6 +104,18 @@ export async function runDaemon(repoRoot, opts = {}) {
     const lock = acquireRunLock(repoRoot, runId);
     try {
         let graph = loadGraph(repoRoot);
+        // v1.51 T2: the routing mode resolves BEFORE any routing input is built — run flag > spec front-matter
+        // > repo > global > default. The resolved cfg carries mode-compiled floors; route() never sees the mode.
+        const rm = resolveRunMode(repoRoot, { flag: opts.mode, spec: graph.mode, globalDir: opts.globalDir });
+        const cfg = rm.cfg;
+        // v1.51 T4: every dispatch provenance line begins with the mode and its source; when a pin won
+        // the route (the final "→ " segment is a pin, not a degraded-to-auto tail) it names the mode it bypassed.
+        const dispatchProvenance = (p) => `mode ${rm.mode.mode} (${rm.source})${p.split("→ ").pop().startsWith("pin ") ? ` — pin bypasses mode ${rm.mode.mode}` : ""} · ${p}`;
+        const channels = discoverChannels(cfg, adapters, health);
+        // v1.6 ROUTE-06: build the learned profile ONCE at startup (never per task, never in the comparator).
+        // No preview — the daemon honors routing.learned:off and gets undefined; this snapshot is immutable
+        // for the run, so this run's own telemetry never feeds back into its own routing.
+        const profile = loadRoutingProfile(repoRoot, cfg);
         const journal = opts.resume ? Journal.open(repoRoot, runId, opts.narrate) : Journal.create(repoRoot, runId, opts.narrate);
         const branchEvent = opts.resume
             ? [...journal.read()].reverse().find((e) => (e.event === "run-start" || e.event === "run-end" || e.event === "merge") && typeof e.data.branch === "string")
@@ -131,7 +175,7 @@ export async function runDaemon(repoRoot, opts = {}) {
             baseRef = await gitHead(repoRoot);
             baseline = await captureBaseline(repoRoot, commands);
             writeFileSync(join(journal.dir, "baseline.json"), JSON.stringify(baseline, null, 2));
-            journal.append("run-start", undefined, { pid: process.pid, baseRef, commands, channels: channels.map(channelKey), branch, graphDefinitionHash: graphDefinitionHash(graph) }); // graphDefinitionHash: T3 engagement identity (status+resume share it); pid: v1.13 (VIS-11) liveness
+            journal.append("run-start", undefined, { pid: process.pid, baseRef, commands, channels: channels.map(channelKey), branch, graphDefinitionHash: graphDefinitionHash(graph), mode: rm.mode.mode, modeSource: rm.source }); // graphDefinitionHash: T3 engagement identity (status+resume share it); pid: v1.13 (VIS-11) liveness; mode/modeSource: v1.51 T2
         }
         // T6: open the narrator AFTER run-start/run-resume is journaled so the watch surface has a run to
         // show. driver.narrator is undefined on subprocess → no-op (subprocess spawns nothing). Swallowed:
@@ -389,7 +433,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                 lastContextTokens = undefined;
                 graph = setStatus(graph, t.id, "running");
                 saveGraph(repoRoot, graph);
-                journal.append("task-dispatch", t.id, { assignment, attempt, provenance: r.provenance, retryMode });
+                journal.append("task-dispatch", t.id, { assignment, attempt, provenance: dispatchProvenance(r.provenance), retryMode });
                 const taskBase = await integrationHead(intWt); // deps are merged → visible to this task
                 const taskBranch = `${branch}--${t.id}`; // "--": a ref can't nest under the existing integration branch (locked decision 10)
                 const priorWt = worktreePath(repoRoot, taskBranch);

package/dist/run/git.d.ts

@@ -1,3 +1,5 @@
+import { ROUTING_ENV_SEAMS } from "../route/router.js";
+export { ROUTING_ENV_SEAMS };
 export interface ShResult {
     code: number;
     stdout: string;

package/dist/run/git.js

@@ -3,14 +3,23 @@ import { existsSync, lstatSync, readlinkSync, rmSync, symlinkSync } from "node:f
 import { join } from "node:path";
 import { shq } from "../adapters/types.js";
 import { tickmarkrDir } from "../graph/graph.js";
+import { ROUTING_ENV_SEAMS } from "../route/router.js";
+export { ROUTING_ENV_SEAMS };
 // stdin "ignore": same class as HARD-05 / SubprocessDriver — never leave an open pipe a child can block on
 // (pi -p / codex exec wait for stdin EOF). timedOut distinguishes SIGKILL-timeout from a real nonzero exit.
 function shell(cmd, cwd, timeoutMs, login) {
+    // OBS-74: scrub tickmarkr's own routing env seams from every child — a daemon carrying
+    // TICKMARKR_QUALITY leaked it into baseline/gate/tip-verify children, turning a dogfood
+    // repo's route() tests red inside the gates. Scrub a copy at this one choke point so
+    // children are hermetic by construction; the daemon's own process.env stays unchanged.
+    const env = { ...process.env };
+    for (const k of ROUTING_ENV_SEAMS)
+        delete env[k];
     return new Promise((resolve) => {
         // detached: bash gets its own process group so a timeout can kill the whole tree —
         // SIGKILLing bash alone orphans grandchildren (codex/pi) that hold the stdio pipes
         // open, so "close" never fires and the promise wedges forever (v1.33.1 init hang).
-        const p = spawn("bash", [login ? "-lc" : "-c", cmd], { cwd, stdio: ["ignore", "pipe", "pipe"], detached: true });
+        const p = spawn("bash", [login ? "-lc" : "-c", cmd], { cwd, env, stdio: ["ignore", "pipe", "pipe"], detached: true });
         let stdout = "", stderr = "";
         let timedOut = false, done = false;
         const finish = (code, err) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "1.50.0",
+  "version": "1.52.0",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",