tickmarkr 1.62.0 → 1.64.0

package/dist/cli/commands/status.js

@@ -103,14 +103,27 @@ const daemonPid = (events) => {
     }
     return undefined;
 };
+const terminalFailureCause = (events) => {
+    for (let i = events.length - 1; i >= 0; i--) {
+        const e = events[i];
+        if (e.event !== "run-end" || typeof e.data.error !== "string")
+            continue;
+        const phase = typeof e.data.phase === "string" && e.data.phase.trim()
+            ? `${e.data.phase.trim()} failed`
+            : "run failed";
+        return `${phase}: ${e.data.error.replace(/\s+/g, " ").trim()}`;
+    }
+    return undefined;
+};
 const liveness = (events) => {
     const last = events.at(-1);
     if (!last)
         return "last event unknown · daemon pid unknown";
     const age = fmtAge(Date.now() - Date.parse(last.ts));
     const pid = daemonPid(events);
+    const cause = terminalFailureCause(events);
     if (pid === undefined)
-        return `last event ${age} ago · daemon pid unknown`;
+        return `last event ${age} ago · daemon pid unknown${cause ? ` · ${cause}` : ""}`;
     // a dead pid after run-end is a clean exit, not a crash — "dead" is only alarming (red) while
     // the run is still incomplete (operator's crash indicator)
     const ended = events.some((e) => e.event === "run-end");
@@ -122,7 +135,7 @@ const liveness = (events) => {
     catch (k) {
         state = k.code === "ESRCH" ? (ended ? "finished" : "dead") : "alive";
     } // EPERM ⇒ alive
-    return `last event ${age} ago · daemon pid ${pid} ${state}`;
+    return `last event ${age} ago · daemon pid ${pid} ${state}${cause ? ` · ${cause}` : ""}`;
 };
 const renderFrame = (cwd) => {
     const g = loadGraph(cwd);

package/dist/compile/native.js

@@ -21,6 +21,10 @@ export function compileNative(file) {
     if (!existsSync(file))
         throw new CompileError(`no such native spec file: ${file}`);
     const content = readFileSync(file, "utf8");
+    // Exact shared-template check: init writes specTemplate(), and any edit changes the body.
+    if (content === specTemplate()) {
+        throw new CompileError(`${file} is the unedited tickmarkr init scaffold. Edit ${file} before compiling.`);
+    }
     const drafts = [];
     let plainCount = 0; // v1.19: plain-string acceptance items compiled as judge oracles (compat) — warn once
     let specMode;

package/dist/gates/acceptance.d.ts

@@ -8,6 +8,7 @@ export interface JudgeVerdict {
         criterion: string;
         met: boolean;
         reason: string;
+        evidence: string;
     }>;
 }
 export declare function judgeCriterionId(index: number): string;

package/dist/gates/acceptance.js

@@ -4,13 +4,16 @@ import { DEFAULT_DIFF_CAP } from "../config/config.js";
 import { renderAcceptanceItem } from "../graph/schema.js";
 import { sh } from "../run/git.js";
 import { checkDiffCap, fetchTaskDiff } from "./review.js";
-import { extractVerdictJson, generateVerdictNonce, runLlm, verdictNonceLine } from "./llm.js";
+import { COMPLETION_FAKING_CHECKLIST, extractVerdictJson, generateVerdictNonce, runLlm, verdictNonceLine } from "./llm.js";
 // Fable F4: acceptance judge shares review's 900s timeout — 300s default killed frontier judges on cap-sized diffs.
 const JUDGE_TIMEOUT_MS = 900_000;
 const JudgeVerdictRowSchema = z.object({
     criterion: z.string(),
     met: z.boolean(),
     reason: z.string(),
+    // v1.64: a verbatim quote from the judged diff grounding the ruling — required; a verdict
+    // omitting it is malformed and fails closed like any other shape violation.
+    evidence: z.string(),
 });
 const JudgeVerdictSchema = z.object({
     pass: z.boolean(),
@@ -157,6 +160,8 @@ You are a strict acceptance judge. Decide whether the diff satisfies EVERY accep
 Judge only what the diff proves — plausible-but-wrong must fail. Do not award partial credit.
 Deterministic command/test oracles have already passed mechanically; judge ONLY the rubric items below.
 
+${COMPLETION_FAKING_CHECKLIST}
+
 ## Task ${task.id}: ${task.title}
 Goal: ${task.goal}
 
@@ -171,8 +176,9 @@ ${diff}
 ${verdictNonceLine(nonce)}
 
 Respond with ONLY this JSON (no prose before or after):
-{"nonce": "${nonce}", "pass": true|false, "criteria": [{"criterion": "c1", "met": true|false, "reason": "..."}]}
+{"nonce": "${nonce}", "pass": true|false, "criteria": [{"criterion": "c1", "met": true|false, "reason": "...", "evidence": "..."}]}
 Each criteria[].criterion MUST be the stable id from the rubric (c1, c2, ...) exactly once.
+Each criteria[].evidence MUST be a short verbatim quote copied from the diff above that grounds the ruling; a quote not found in the diff voids the whole verdict.
 `;
     const raw = await runLlm(judge.adapter, judge.model, prompt, worktree, via, JUDGE_TIMEOUT_MS);
     const extracted = extractVerdictJson(raw, nonce);
@@ -185,6 +191,15 @@ Each criteria[].criterion MUST be the stable id from the rubric (c1, c2, ...) ex
             meta: { unparseable: true, judge: channelKey({ adapter: judge.adapter.id, model: judge.model }) } };
     }
     const { verdict: v, inconsistencies } = checkJudgeVerdict(extracted, expectedIds);
+    // v1.64: quoted evidence must appear verbatim in `diff` — the exact string embedded in the prompt
+    // above, never the worktree or any other artifact. A quote the diff doesn't contain is a
+    // hallucinated verdict: treated as unparseable so GATE-09 retries the judge on a failover channel.
+    const fabricated = v.criteria.filter((row) => !row.evidence.trim() || !diff.includes(row.evidence));
+    if (fabricated.length) {
+        return { gate: "acceptance", pass: false,
+            details: warn + detBlock + `judge verdict quotes evidence absent from the judged diff (${fabricated.map((row) => row.criterion).join(", ")}) — treating as unparseable, failing closed`,
+            meta: { unparseable: true, judge: channelKey({ adapter: judge.adapter.id, model: judge.model }) } };
+    }
     const pass = v.pass === true && inconsistencies.length === 0 && v.criteria.every((row) => row.met);
     const lines = v.criteria.map((row) => `${row.met ? "✓" : "✗"} ${row.criterion}: ${row.reason}`);
     if (!v.pass)

package/dist/gates/baseline.d.ts

@@ -1,12 +1,30 @@
 import type { TickmarkrConfig } from "../config/config.js";
+import type { AcceptanceItem } from "../graph/schema.js";
 import type { GateResult } from "./types.js";
 export interface Baseline {
     commands: Record<string, {
         exitCode: number;
         fingerprints: string[];
+        missingCommand?: boolean;
     }>;
+    warnings?: BaselineWarning[];
+}
+export interface BaselineWarning {
+    kind: "wrong-environment";
+    commands: string[];
+    reason: string;
 }
 export declare function fingerprint(output: string): string[];
 export declare function detectGateCommands(repoRoot: string, cfg: TickmarkrConfig): Record<string, string>;
 export declare function captureBaseline(cwd: string, commands: Record<string, string>): Promise<Baseline>;
+export interface VacuousOracleWarning {
+    kind: "vacuous-oracle";
+    taskId: string;
+    oracles: string[];
+    reason: string;
+}
+export declare function detectVacuousOracles(cwd: string, tasks: ReadonlyArray<{
+    id: string;
+    acceptance: AcceptanceItem[];
+}>): Promise<VacuousOracleWarning[]>;
 export declare function compareToBaseline(cwd: string, commands: Record<string, string>, baseline: Baseline, enabled: string[]): Promise<GateResult[]>;

package/dist/gates/baseline.js

@@ -41,15 +41,74 @@ export function detectGateCommands(repoRoot, cfg) {
     }
     return out;
 }
+const shellToken = (cmd) => {
+    for (const raw of cmd.trim().split(/\s+/)) {
+        if (!raw || /^[A-Za-z_][A-Za-z0-9_]*=/.test(raw))
+            continue;
+        if (raw === "env")
+            continue;
+        return raw.replace(/^['"]|['"]$/g, "");
+    }
+    return undefined;
+};
+const reEscape = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+function missingConfiguredCommand(cmd, result) {
+    if (result.code !== 127)
+        return false;
+    const token = shellToken(cmd);
+    if (!token)
+        return false;
+    const output = `${result.stdout}\n${result.stderr}`;
+    return new RegExp(`(?:^|[:\\s])${reEscape(token)}:\\s+(?:command not found|No such file or directory)`, "i").test(output);
+}
 export async function captureBaseline(cwd, commands) {
     const base = { commands: {} };
     for (const [name, cmd] of Object.entries(commands)) {
         const r = await sh(cmd, cwd);
         // ponytail: strip the executing cwd so repo-root capture and worktree compare fingerprint identically; /private-vs-/tmp symlink variance is out of scope
-        base.commands[name] = { exitCode: r.code, fingerprints: fingerprint((r.stdout + "\n" + r.stderr).split(cwd).join("")) };
+        base.commands[name] = {
+            exitCode: r.code,
+            fingerprints: fingerprint((r.stdout + "\n" + r.stderr).split(cwd).join("")),
+            missingCommand: missingConfiguredCommand(cmd, r),
+        };
+    }
+    const names = Object.keys(commands);
+    const missing = names.filter((name) => base.commands[name]?.missingCommand === true);
+    if (names.length > 0 && missing.length === names.length) {
+        base.warnings = [{
+                kind: "wrong-environment",
+                commands: missing,
+                reason: `wrong environment: every configured baseline command was missing (${missing.join(", ")})`,
+            }];
     }
     return base;
 }
+// Tier A #3 (2026-07-21 repo-scan reconciliation): a command oracle that already exits 0 before any
+// work exists cannot falsify the work — surface it at baseline capture. Observational only: journaled
+// warning, never a gate input, and an oracle that fails at baseline changes nothing. Judge oracles
+// (including plain-string compat judges) are never executed; test oracles stay gate-only (they need
+// the detected runner and the worker's diff to mean anything).
+export async function detectVacuousOracles(cwd, tasks) {
+    const out = [];
+    for (const t of tasks) {
+        const vacuous = [];
+        for (const a of t.acceptance) {
+            if (typeof a !== "object" || a.oracle !== "command")
+                continue;
+            if ((await sh(a.command, cwd)).code === 0)
+                vacuous.push(a.command);
+        }
+        if (vacuous.length) {
+            out.push({
+                kind: "vacuous-oracle",
+                taskId: t.id,
+                oracles: vacuous,
+                reason: `vacuous acceptance oracle on ${t.id}: already passes before any work exists — ${vacuous.map((c) => `$ ${c}`).join("; ")}`,
+            });
+        }
+    }
+    return out;
+}
 // HYG-08 (D-01): headline the runner's own failure naming; demote the fingerprint diff to a secondary
 // section. Extracts from `raw` — the SAME cwd-stripped, per-line ANSI_RE-stripped string that was
 // fingerprinted, digits UN-normalized (Pitfall 2: normalization mangles test names, and the diff set could

package/dist/gates/llm.d.ts

@@ -1,12 +1,13 @@
 import type { WorkerAdapter } from "../adapters/types.js";
 import { type ExecutorDriver, type Slot } from "../drivers/types.js";
 export declare const GATE_PANE_SEP = " \u00B7 ";
+export declare const COMPLETION_FAKING_CHECKLIST = "## Completion-faking checklist\nHunt for these concrete completion-faking shortcuts before ruling on any criterion:\n- hardcoded-result: output or fixture hardcoded to satisfy the stated criterion instead of real logic\n- test-weakening: tests skipped, deleted, or assertions loosened until failing behavior looks green\n- vacuous-assertion: a test that cannot fail (asserts a constant, asserts its own setup, no assertion)\n- fixture-overfit: implementation narrowed to the exact test inputs rather than the described behavior\n- echo-not-implement: criterion text echoed in names, comments, or strings without the behavior itself\n- stub-left-behind: TODO, throw, or no-op stub where the real implementation should be\n- error-swallowing: catch or fallback that hides failures instead of handling them\n- self-mocking: the code under test mocked or faked so the test exercises the mock\n- check-bypass: lint, type, or CI checks disabled, relaxed, or excluded to get green\n- rename-as-work: code moved or renamed and presented as the requested change\n- scope-padding: unrelated edits padding the diff while the criterion's behavior is untouched\nWhen a criterion fails, the verdict MUST name which shortcut above it matches, or state that none does.";
 /** Fable F3: per-call nonce echoed in verdict JSON and gate exit markers. */
 export declare function generateVerdictNonce(): string;
 export declare function verdictNonceLine(nonce: string): string;
 export declare function extractPromptNonce(prompt: string): string | null;
 export declare function gateExitTrailer(nonce: string): string;
-export declare function augmentFakeVerdictOutput(adapter: WorkerAdapter, out: string, nonce: string): string;
+export declare function augmentFakeVerdictOutput(adapter: WorkerAdapter, out: string, nonce: string, prompt?: string): string;
 export type GatePaneRole = "judge" | "review" | "consult";
 /** T8: role-first pane name for fleet visibility — judge · T4, review · T3, consult · T2. */
 export declare function gatePaneName(role: GatePaneRole, taskId: string, suffix?: string): string;

package/dist/gates/llm.js

@@ -6,6 +6,22 @@ import { formatOwnedName, parseOwnedName } from "../drivers/types.js";
 import { bannerShell, paneDispatchCommand } from "../brand.js";
 import { sh } from "../run/git.js";
 export const GATE_PANE_SEP = " · ";
+// v1.64 gate-integrity (repo-scan Tier A·1): the concrete completion-faking shortcuts every
+// judge/review verdict must hunt for. Shared verbatim by the acceptance judge and review prompts.
+export const COMPLETION_FAKING_CHECKLIST = `## Completion-faking checklist
+Hunt for these concrete completion-faking shortcuts before ruling on any criterion:
+- hardcoded-result: output or fixture hardcoded to satisfy the stated criterion instead of real logic
+- test-weakening: tests skipped, deleted, or assertions loosened until failing behavior looks green
+- vacuous-assertion: a test that cannot fail (asserts a constant, asserts its own setup, no assertion)
+- fixture-overfit: implementation narrowed to the exact test inputs rather than the described behavior
+- echo-not-implement: criterion text echoed in names, comments, or strings without the behavior itself
+- stub-left-behind: TODO, throw, or no-op stub where the real implementation should be
+- error-swallowing: catch or fallback that hides failures instead of handling them
+- self-mocking: the code under test mocked or faked so the test exercises the mock
+- check-bypass: lint, type, or CI checks disabled, relaxed, or excluded to get green
+- rename-as-work: code moved or renamed and presented as the requested change
+- scope-padding: unrelated edits padding the diff while the criterion's behavior is untouched
+When a criterion fails, the verdict MUST name which shortcut above it matches, or state that none does.`;
 /** Fable F3: per-call nonce echoed in verdict JSON and gate exit markers. */
 export function generateVerdictNonce() {
     return randomBytes(4).toString("hex");
@@ -19,8 +35,20 @@ export function extractPromptNonce(prompt) {
 export function gateExitTrailer(nonce) {
     return `printf '\\nTICKMARKR_''EXIT_${nonce}:%s\\n' $?`;
 }
+// v1.64: scripted fake judge verdicts predate the required per-criterion evidence field — quote the
+// first line of the prompt's own diff block into rows lacking one so zero-token fixtures keep their
+// outcomes. Rows scripting an explicit evidence value pass through verbatim (tests exercise both paths).
+function injectFakeEvidence(obj, prompt) {
+    if (!prompt.startsWith("TICKMARKR-JUDGE") || !Array.isArray(obj.criteria))
+        return obj;
+    const line = /```diff\n([\s\S]*?)```/.exec(prompt)?.[1].split("\n").find((l) => l.trim());
+    if (!line)
+        return obj;
+    const criteria = obj.criteria.map((row) => row && typeof row === "object" && !("evidence" in row) ? { ...row, evidence: line } : row);
+    return { ...obj, criteria };
+}
 // ponytail: fake adapter serves static verdict JSON without nonce; append a bound copy for zero-token tests.
-export function augmentFakeVerdictOutput(adapter, out, nonce) {
+export function augmentFakeVerdictOutput(adapter, out, nonce, prompt = "") {
     if (adapter.id !== "fake")
         return out;
     const obj = extractJson(out);
@@ -28,7 +56,7 @@ export function augmentFakeVerdictOutput(adapter, out, nonce) {
         return out;
     if (typeof obj.nonce === "string")
         return out;
-    return `${out}\n${JSON.stringify({ ...obj, nonce })}`;
+    return `${out}\n${JSON.stringify(injectFakeEvidence({ ...obj, nonce }, prompt))}`;
 }
 /** T8: role-first pane name for fleet visibility — judge · T4, review · T3, consult · T2. */
 export function gatePaneName(role, taskId, suffix = "") {
@@ -61,7 +89,7 @@ export async function runHeadless(adapter, model, prompt, cwd, timeoutMs = 30000
     const nonce = extractPromptNonce(prompt);
     let out = r.stdout + "\n" + r.stderr;
     if (nonce)
-        out = augmentFakeVerdictOutput(adapter, out, nonce);
+        out = augmentFakeVerdictOutput(adapter, out, nonce, prompt);
     return out;
 }
 // v1.1 default path: the same headless CLI call, but dispatched through the driver
@@ -88,7 +116,7 @@ export async function runViaDriver(adapter, model, prompt, cwd, via, timeoutMs =
     let out = await via.driver.read(slot, 400);
     if (!via.keep)
         await via.driver.close(slot);
-    out = augmentFakeVerdictOutput(adapter, out, nonce);
+    out = augmentFakeVerdictOutput(adapter, out, nonce, prompt);
     return out;
 }
 export function runLlm(adapter, model, prompt, cwd, via, timeoutMs = 300000) {

package/dist/gates/review.js

@@ -4,7 +4,7 @@ import { renderAcceptanceItem } from "../graph/schema.js";
 import { getAdapter } from "../adapters/registry.js";
 import { shOk } from "../run/git.js";
 import { marginalCostRank } from "../route/router.js";
-import { extractVerdictJson, generateVerdictNonce, runLlm, verdictNonceLine } from "./llm.js";
+import { COMPLETION_FAKING_CHECKLIST, extractVerdictJson, generateVerdictNonce, runLlm, verdictNonceLine } from "./llm.js";
 // OBS-48: cap on zero-context diff bytes (git diff -U0), not context-padded full diff — scattered
 // one-line hunks no longer trip at ~370 diff-bytes per changed line. Full diff still goes to the judge.
 const DIFF_CAP_REMEDY = "split the task, or raise gates.diffCap";
@@ -82,6 +82,8 @@ export async function reviewGate(task, worktree, baseRef, author, channels, adap
 You are a skeptical cross-vendor code reviewer. Another agent (vendor: ${author.adapter}) authored this diff.
 Look for correctness bugs, security issues, and acceptance-criteria gaps. Approve only if you would merge it.
 
+${COMPLETION_FAKING_CHECKLIST}
+
 ## Task ${task.id}: ${task.title} (complexity ${task.complexity})
 ## Acceptance criteria
 ${task.acceptance.map((a) => `- ${renderAcceptanceItem(a)}`).join("\n")}

package/dist/run/consult.js

@@ -4,6 +4,7 @@ import { getAdapter } from "../adapters/registry.js";
 import { bannerShell, paneDispatchCommand } from "../brand.js";
 import { augmentFakeVerdictOutput, extractVerdictJson, gateExitTrailer, gatePaneName, generateVerdictNonce, verdictNonceLine } from "../gates/llm.js";
 import { sh } from "./git.js";
+import { redactSecrets } from "./redact.js";
 const MAX_RETRY_GUIDANCE_LINES = 10;
 function guidanceParts(text) {
     return text.split(/\n+/).flatMap((line) => line.split(/(?<=[.!?])\s+/)).map((s) => s.trim()).filter(Boolean);
@@ -100,7 +101,9 @@ opts = {}) {
     const dir = join(runDir, "consults");
     mkdirSync(dir, { recursive: true });
     const promptFile = join(dir, `${d.taskId}-${n}.md`);
-    writeFileSync(promptFile, buildDossierPrompt(d, nonce));
+    // T3 secret redaction: the persisted dossier artifact (transcript/diff/journal tail — also what the
+    // consult model reads) is masked at this seam; the in-memory Dossier stays untouched.
+    writeFileSync(promptFile, redactSecrets(buildDossierPrompt(d, nonce)));
     // One seat = the WHOLE invoke-and-parse unit, both visibility branches (OBS-69 class: a headless-only
     // failover would leave the production pane path hard-failing on seat one). null = no parseable verdict.
     const invokeSeat = async (seatAdapter, seatModel, seatIdx) => {

package/dist/run/daemon.js

@@ -11,7 +11,7 @@ import { bannerShell, paneDispatchCommand } from "../brand.js";
 import { globalConfigDir, loadConfigWithMode, readOverlayFile, repoOverlayPath, } from "../config/config.js";
 import { herdrSealShellPrefix, SubprocessDriver } from "../drivers/subprocess.js";
 import { formatOwnedName } from "../drivers/types.js";
-import { captureBaseline, detectGateCommands } from "../gates/baseline.js";
+import { captureBaseline, detectGateCommands, detectVacuousOracles } from "../gates/baseline.js";
 import { runGates } from "../gates/run-gates.js";
 import { addEvidence, attributeBlocked, blockedTasks, getTask, graphDefinitionHash, loadGraph, pendingTasks, readyTasks, saveGraph, setStatus } from "../graph/graph.js";
 import { augmentRetryBrief, consult, renderRetryGuidance } from "./consult.js";
@@ -109,6 +109,10 @@ export async function runDaemon(repoRoot, opts = {}) {
     // v1.54 T2: declared before the try so the finally can always deregister (a throw before
     // registration leaves it undefined — the guard below covers that path).
     let onTermination;
+    let journal;
+    let runStarted = false;
+    let taskLoopStarted = false;
+    let branch = "";
     try {
         let graph = loadGraph(repoRoot);
         // v1.51 T2: the routing mode resolves BEFORE any routing input is built — run flag > spec front-matter
@@ -184,12 +188,12 @@ export async function runDaemon(repoRoot, opts = {}) {
         };
         process.on("SIGINT", onTermination);
         process.on("SIGTERM", onTermination);
-        const journal = opts.resume ? Journal.open(repoRoot, runId, opts.narrate) : Journal.create(repoRoot, runId, opts.narrate);
+        journal = opts.resume ? Journal.open(repoRoot, runId, opts.narrate) : Journal.create(repoRoot, runId, opts.narrate);
         const branchEvent = opts.resume
             ? [...journal.read()].reverse().find((e) => (e.event === "run-start" || e.event === "run-end" || e.event === "merge") && typeof e.data.branch === "string")
             : undefined;
         const recordedBranch = typeof branchEvent?.data.branch === "string" ? branchEvent.data.branch : undefined;
-        const branch = recordedBranch
+        branch = recordedBranch
             ? branchEvent.event === "merge" ? recordedBranch.slice(0, recordedBranch.lastIndexOf("--")) : recordedBranch
             : integrationBranch(cfg, runId);
         if (lock.reclaimed)
@@ -249,15 +253,27 @@ export async function runDaemon(repoRoot, opts = {}) {
             baseline = await captureBaseline(repoRoot, commands);
             writeFileSync(join(journal.dir, "baseline.json"), JSON.stringify(baseline, null, 2));
             journal.append("run-start", undefined, { pid: process.pid, baseRef, commands, channels: channels.map(channelKey), branch, graphDefinitionHash: graphDefinitionHash(graph), mode: rm.mode.mode, modeSource: rm.source, ...(prior ? { supersedes: prior.runId } : {}) }); // graphDefinitionHash: T3 engagement identity (status+resume share it); pid: v1.13 (VIS-11) liveness; mode/modeSource: v1.51 T2; supersedes: v1.53 T5
+            runStarted = true;
             // v1.53 T5: mark the prior run AFTER this run's run-start exists, so the prior journal never
             // names a successor that has no journal. Append-only — the prior journal is never rewritten.
             prior?.append("superseded", undefined, { by: runId });
+            for (const warning of baseline.warnings ?? [])
+                journal.append("baseline-warning", undefined, { ...warning });
+            // Tier A #3: run each task's command-typed acceptance oracles against the pristine baseline —
+            // one that already exits 0 verifies nothing. Warning only, taskId-stamped; never a gate input.
+            for (const w of await detectVacuousOracles(repoRoot, graph.tasks))
+                journal.append("baseline-warning", w.taskId, { ...w });
         }
         // T6: open the narrator AFTER run-start/run-resume is journaled so the watch surface has a run to
         // show. driver.narrator is undefined on subprocess → no-op (subprocess spawns nothing). Swallowed:
         // a failed-to-open or later-dead watch pane never affects the run.
+        // OBS-103: hold the returned slot — narrator() adopts an already-open watch by its owned name
+        // (a prior daemon instance's, after a stop→resume cycle), so the run-end sweep below can retire
+        // it regardless of which instance split the pane.
+        const watchName = formatOwnedName({ role: "watch", taskId: "run", attempt: 0, runId });
+        let watchSlot;
         try {
-            await driver.narrator?.(repoRoot, "tickmarkr status --watch", runId);
+            watchSlot = await driver.narrator?.(repoRoot, "tickmarkr status --watch", runId);
         }
         catch {
             /* cosmetic-only — the run proceeds without a live surface */
@@ -286,7 +302,22 @@ export async function runDaemon(repoRoot, opts = {}) {
             if (keepForever)
                 return;
             try {
-                await driver.reconcile?.(desiredPanes(journal.read(), runId), runId, opts);
+                const desired = desiredPanes(journal.read(), runId);
+                // The watch pane is never the DRIVER sweep's candidate (panesToClose spares role "watch":
+                // herdr's watches bookkeeping lives in close(), and a raw pane-close in the sweep would
+                // leave narrator() a stale cache) — the driver always sees it as desired; its lifecycle is
+                // decided here from the fold alone.
+                await driver.reconcile?.(new Set([...desired, watchName]), runId, opts);
+                // OBS-103: when the fold retires the watch (run-end boundary), close the narrator. The
+                // decision keys on the run identity in the pane name — narrator() adopts a prior daemon
+                // instance's pane under the same owned name, so a stop→resume cycle's leftover narrator
+                // closes exactly like one this instance opened. A narrator carrying a non-canonical name
+                // (no run identity) is never this run's to sweep.
+                if (watchSlot && watchSlot.name === watchName && !desired.has(watchName)) {
+                    const w = watchSlot;
+                    watchSlot = undefined;
+                    await driver.close(w);
+                }
             }
             catch {
                 /* cosmetic — visibility is never a gate */
@@ -979,6 +1010,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                 return;
             }
         };
+        taskLoopStarted = true;
         const inflight = new Map();
         while (true) {
             // v1.54 T2: a signal that landed while nothing was racing `aborted` (empty inflight window)
@@ -1069,6 +1101,23 @@ export async function runDaemon(repoRoot, opts = {}) {
         await driver.notify(`tickmarkr ${runId}: ${summary.done.length} done, ${summary.failed.length} failed, ${summary.human.length} awaiting human, ${summary.blocked.length} blocked, ${summary.pending.length} pending${attribution ? ` (${attribution})` : ""}${tipFail} — integration branch ${branch} (merge to main is yours)`, { tier: summary.tipVerify === "failed" ? "attention" : "routine" });
         return summary;
     }
+    catch (err) {
+        if (runStarted && !taskLoopStarted && !journal.read().some((e) => e.event === "run-end")) {
+            journal.append("run-end", undefined, {
+                runId,
+                branch,
+                done: [],
+                failed: [],
+                human: [],
+                blocked: [],
+                pending: [],
+                phase: "setup",
+                fatal: true,
+                error: err instanceof Error ? err.message : String(err),
+            });
+        }
+        throw err;
+    }
     finally {
         // v1.54 T2: deregister on EVERY exit (normal run end, throw, termination unwind) — the daemon
         // test suite runs runDaemon dozens of times in one process; a leaked handler would close a

package/dist/run/journal.js

@@ -5,6 +5,7 @@ import { channelKey, TokenUsageSchema } from "../adapters/types.js";
 import { stateDirName, tickmarkrDir } from "../graph/graph.js";
 import { TIERS } from "../graph/schema.js";
 import { buildProfile } from "../route/profile.js";
+import { redactSecrets } from "./redact.js";
 export function formatJournalNarration({ event, taskId, data }) {
     const assignment = data.assignment;
     const direct = [data.summary, data.reason, data.error, data.step, data.action, data.lint, data.branch, data.from]
@@ -311,9 +312,12 @@ export class Journal {
     }
     append(event, taskId, data = {}) {
         const row = { ts: new Date().toISOString(), event, ...(taskId ? { taskId } : {}), data };
-        appendFileSync(this.journalPath, JSON.stringify(row) + "\n");
+        // T3 secret redaction: only the persisted bytes are masked — the caller's data stays untouched in
+        // memory. The narrator receives the persisted (masked) row so a pane sink never shows a credential.
+        const line = redactSecrets(JSON.stringify(row));
+        appendFileSync(this.journalPath, line + "\n");
         try {
-            this.narrate?.(row);
+            this.narrate?.(JSON.parse(line));
         }
         catch {
             // narration is observational; a broken sink must not affect the journal or run
@@ -421,7 +425,8 @@ export class Journal {
         return m;
     }
     telemetry(row) {
-        appendFileSync(join(this.dir, "telemetry.jsonl"), JSON.stringify(row) + "\n");
+        // T3 secret redaction: same persistence seam as append — credential-free rows are byte-identical.
+        appendFileSync(join(this.dir, "telemetry.jsonl"), redactSecrets(JSON.stringify(row)) + "\n");
     }
     // Per-run, raw (NOT schema-validated) — report.ts reads v1.5 core fields; stays byte-compatible.
     readTelemetry() {

package/dist/run/reconcile.js

@@ -87,8 +87,10 @@ export function desiredPanes(rows, runId) {
                 clearTask(row.taskId);
                 break;
             case "run-end":
+                // OBS-103: run-end retires EVERY run-tagged pane, the watch narrator included. The fold
+                // keys on the run identity in the pane name, so a narrator a prior daemon instance opened
+                // (stop→resume cycle) retires all the same; a later run-resume re-desires it above.
                 desired.clear();
-                desired.add(formatOwnedName({ role: "watch", taskId: "run", attempt: 0, runId }));
                 break;
         }
     }

package/dist/run/redact.d.ts

@@ -0,0 +1,2 @@
+export declare const MASK = "[REDACTED]";
+export declare function redactSecrets(text: string): string;

package/dist/run/redact.js

@@ -0,0 +1,53 @@
+// T3 (repo-scan Tier A #2): the shared secret-redaction pass for captured agent text at the
+// persistence seams. Every seam that persists captured agent text routes its bytes through
+// redactSecrets before hitting disk — journal event payloads and telemetry rows (journal.ts) and
+// consult dossier artifacts (consult.ts). In-memory originals are never touched: redaction applies
+// to the serialized bytes only, at the write site.
+//
+// Two shape families:
+//   - vendor keys: recognizable prefix + high-entropy body. The prefix survives masking so the
+//     credential class stays identifiable; the body never persists.
+//   - secret assignments: KEY=value / "key": "value" where the key NAME announces a secret. The key
+//     survives; the value is masked.
+// Text with no credential shapes passes through byte-identical. Masks contain no quote or backslash
+// and value charsets never cross a JSON string boundary, so redacting a serialized JSON line always
+// yields a line that still parses.
+export const MASK = "[REDACTED]";
+// Order matters: more specific prefixes (sk-ant-, sk-proj-) before the generic sk- form.
+const VENDOR_KEY_RES = [
+    /\b(sk-ant-)[A-Za-z0-9_-]{8,}/g, // Anthropic
+    /\b(sk-proj-)[A-Za-z0-9_-]{8,}/g, // OpenAI project key
+    /\b(sk-)[A-Za-z0-9_-]{16,}/g, // OpenAI classic / sk-prefixed secret keys
+    /\b(github_pat_)[A-Za-z0-9_]{8,}/g, // GitHub fine-grained PAT
+    /\b(gh[pousr]_)[A-Za-z0-9]{16,}/g, // GitHub token family (ghp_/gho_/ghu_/ghs_/ghr_)
+    /\b(glpat-)[A-Za-z0-9_-]{8,}/g, // GitLab PAT
+    /\b(xox[baprs]-)[A-Za-z0-9-]{8,}/g, // Slack token family
+    /\b(npm_)[A-Za-z0-9]{16,}/g, // npm token
+    /\b(AKIA)[0-9A-Z]{16}\b/g, // AWS access key id
+    /\b(AIza)[0-9A-Za-z_-]{35}\b/g, // Google API key
+];
+// Key names that announce a secret. The optional quote after the key closes a JSON key ("apiKey": "…").
+// The match starts AT the keyword — chars before it (MY_ in MY_API_KEY=) are simply left in place by
+// replace, so anchoring on the keyword yields identical output while keeping the scan linear (a
+// leading [A-Za-z0-9_.-]* here backtracks quadratically on long tokens — seconds on a 50K blob, and
+// journal payloads carry parked diffs up to the diff cap).
+// The value charset excludes quotes/backslash (never crosses a JSON string boundary) and square
+// brackets (an already-masked value never re-matches ⇒ idempotent, and a vendor prefix kept by the
+// pass above survives). The letter lookahead skips purely numeric values ("maxTokens":30000000 is a
+// count, not a credential — and masking a bare JSON number would break the line's parse).
+// Quotes may arrive backslash-escaped (a transcript already serialized inside a JSON string), so the
+// optional opening/closing quote around key and value accepts \" as well as ".
+const ASSIGNMENT_RE = /((?:api[_-]?key|apikey|secret|token|passwd|password|credential|access[_-]?key)[A-Za-z0-9_.-]*(?:\\?["'])?\s*[=:]\s*(?:\\?["'])?)(?=[^\s"'`\\,;[\]]*[A-Za-z])([^\s"'`\\,;[\]]{8,})/gi;
+// Authorization headers are the most common credential shape in captured transcripts.
+const BEARER_RE = /\b(Bearer\s+)[A-Za-z0-9._~+/=-]{16,}/g;
+// Cheap literal prescan: every pattern above needs one of these substrings, and most persisted text
+// (diffs, prose, telemetry) has none — those payloads skip all 12 regex passes in one linear scan.
+const HINT_RE = /sk-|github_pat_|gh[pousr]_|glpat-|xox[baprs]-|npm_|AKIA|AIza|Bearer|api[_-]?key|apikey|secret|token|passwd|password|credential|access[_-]?key/i;
+export function redactSecrets(text) {
+    if (!HINT_RE.test(text))
+        return text;
+    let out = text;
+    for (const re of VENDOR_KEY_RES)
+        out = out.replace(re, `$1${MASK}`);
+    return out.replace(ASSIGNMENT_RE, `$1${MASK}`).replace(BEARER_RE, `$1${MASK}`);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "1.62.0",
+  "version": "1.64.0",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",

package/skills/tickmarkr-auto/SKILL.md

@@ -16,7 +16,8 @@ When working in a multi-agent terminal environment, decide your role before star
 - **Supervisor with a live orchestrator:** do not start a second run. Relay the mission to the existing orchestrator with a [verified handoff](#verified-handoffs-agent-to-agent-messaging), then supervise it as OVERSEER.
 - **Primary session without an orchestrator:** rename your own tab `OVERSEER · <version>` and your agent `overseer`, spawn one child orchestration session with your host's launch form, label its tab `ORCH · <version>` and name its agent, give it the mission and these rules verbatim, then supervise it. Do not drive a duplicate single-tier run yourself. Before spawning, confirm any PREVIOUS orchestrator has stood down (monitors stopped, input box empty — dim ghost-text suggestions are UI, not queued input; ANSI-verify before alarming) and close its tab — the journal, records, and ledger hold the story; scrollback is disposable.
   - **Claude Code:** `herdr agent start orchestrator --cwd <repo> --no-focus -- claude --permission-mode bypassPermissions`
-  - **Codex:** `herdr agent start orchestrator --cwd <repo> --no-focus -- codex --ask-for-approval never --sandbox workspace-write`
+  - **Codex:** `herdr agent start orchestrator --cwd <repo> --no-focus -- codex --dangerously-bypass-approvals-and-sandbox` — the unsandboxed flag is REQUIRED, not optional: codex's `workspace-write` sandbox keeps `.git` refs read-only, so a sandboxed orchestrator's `tickmarkr run` dies at integration-branch creation (`git worktree add` cannot lock the ref). Do not downgrade this flag; the herdr pane and repo scope are the containment.
+  - **Auxiliary agents you spawn (consultants, reviewers, scouts) follow the same forms.** Never launch a claude session in plan mode or default permission mode for autonomous work — both stall on per-command approval prompts nobody is watching; claude is always `--permission-mode bypassPermissions` (tickmarkr's own adapter uses exactly this for workers, judges, and consults). A read-only codex consultant may use `--sandbox read-only`; any codex session that must touch git needs the unsandboxed flag above.
 
 Outside a multi-agent terminal environment, run the loop directly.
 

package/skills/tickmarkr-loop/SKILL.md

@@ -15,7 +15,8 @@ When working in a multi-agent terminal environment, decide your role before star
 - **Supervisor with a live orchestrator:** do not start a second run. Relay the mission to the existing orchestrator with a [verified handoff](#verified-handoffs-agent-to-agent-messaging), then supervise it as OVERSEER.
 - **Primary session without an orchestrator:** rename your own tab `OVERSEER · <version>` and your agent `overseer`, spawn one child orchestration session with your host's launch form, label its tab `ORCH · <version>` and name its agent, give it the mission and these rules verbatim, then supervise it. Do not drive a duplicate single-tier run yourself. Before spawning, confirm any PREVIOUS orchestrator has [stood down](#stand-down-mission-end-and-retirement) and close its tab.
   - **Claude Code:** `herdr agent start orchestrator --cwd <repo> --no-focus -- claude --permission-mode bypassPermissions`
-  - **Codex:** `herdr agent start orchestrator --cwd <repo> --no-focus -- codex --ask-for-approval never --sandbox workspace-write`
+  - **Codex:** `herdr agent start orchestrator --cwd <repo> --no-focus -- codex --dangerously-bypass-approvals-and-sandbox` — the unsandboxed flag is REQUIRED, not optional: codex's `workspace-write` sandbox keeps `.git` refs read-only, so a sandboxed orchestrator's `tickmarkr run` dies at integration-branch creation (`git worktree add` cannot lock the ref). Do not downgrade this flag; the herdr pane and repo scope are the containment.
+  - **Auxiliary agents you spawn (consultants, reviewers, scouts) follow the same forms.** Never launch a claude session in plan mode or default permission mode for autonomous work — both stall on per-command approval prompts nobody is watching; claude is always `--permission-mode bypassPermissions` (tickmarkr's own adapter uses exactly this for workers, judges, and consults). A read-only codex consultant may use `--sandbox read-only`; any codex session that must touch git needs the unsandboxed flag above.
 
 Outside a multi-agent terminal environment, run the loop directly.
 

package/skills/tickmarkr-overseer/SKILL.md

@@ -29,7 +29,7 @@ Requires `HERDR_ENV=1`; if unset, say so and stop.
    main name plus at most ONE hot-state token. Vocabulary: ORCH carries the milestone and progress
    fraction (`ORCH · v1.19 4/5`, updated on every task-done); WORKERS carries the task token (tickmarkr
    updates it). Never long context strings or ✓-chains.
-2. **Orchestrator**: Launch the orchestrator with your agent host. For Claude Code, use `herdr agent start orchestrator --cwd <repo> --no-focus -- claude --permission-mode bypassPermissions` (pin a strong model with `--model <m>` if the operator has a policy). For Codex, use `herdr agent start orchestrator --cwd <repo> --no-focus -- codex --ask-for-approval never --sandbox workspace-write` (add `--model <m>` to specify the model). Workers you never spawn — tickmarkr spawns its own visible worker panes.
+2. **Orchestrator**: Launch the orchestrator with your agent host. For Claude Code, use `herdr agent start orchestrator --cwd <repo> --no-focus -- claude --permission-mode bypassPermissions` (pin a strong model with `--model <m>` if the operator has a policy). For Codex, use `herdr agent start orchestrator --cwd <repo> --no-focus -- codex --dangerously-bypass-approvals-and-sandbox` (add `--model <m>` to specify the model). The unsandboxed flag is REQUIRED: codex's `workspace-write` sandbox keeps `.git` refs read-only, so a sandboxed orchestrator's `tickmarkr run` dies at integration-branch creation — do not downgrade it. Workers you never spawn — tickmarkr spawns its own visible worker panes. Auxiliary agents you do spawn (consultants, reviewers, scouts) follow the same forms: never launch a claude session in plan mode or default permission mode for autonomous work — both stall on per-command approval prompts nobody is watching; claude is always `--permission-mode bypassPermissions`, and a read-only codex consultant may use `--sandbox read-only`.
 3. **Standing instructions travel as a brief FILE, never as pane text** — PTY input truncates at ~1024B and a
    truncated brief silently drops policy. Write the full brief to `<repo>/.tickmarkr/overseer/ORCH-BRIEF.md`
    (inside the tickmarkr state dir — already self-gitignored, no exclude step needed), then send one line: