tickmarkr 1.71.0 → 1.72.0

package/dist/drivers/herdr.d.ts

@@ -26,6 +26,8 @@ export declare class HerdrDriver implements ExecutorDriver {
     private paneWidth;
     slot(cwd: string, name: string, opts?: SlotOpts): Promise<Slot>;
     private tabSlot;
+    private reclaimStaleLabel;
+    private staleLabelPanes;
     private groupSlot;
     private newGeneration;
     private renameGroupTab;

package/dist/drivers/herdr.js

@@ -60,13 +60,19 @@ export class HerdrDriver {
     herdr(args, cwd = process.cwd(), timeoutMs) {
         return sh(`${shq(this.bin)} ${args}`, cwd, timeoutMs);
     }
+    // herdr 0.7.5 (OBS-123): an "agent" is a DETECTED agent-CLI, so `agent get <name>` no longer resolves
+    // a tickmarkr-named bash pane. Durable identity is the pane LABEL (set via `pane rename`); resolve it
+    // by reading the label back from `pane list`.
     async namedPaneId(name) {
-        const r = await this.herdr(`agent get ${shq(name)}`);
+        const r = await this.herdr(`pane list`);
         if (r.code !== 0)
             return null;
         try {
-            const id = JSON.parse(r.stdout).result?.agent?.pane_id;
-            return typeof id === "string" && id ? id : null;
+            const panes = JSON.parse(r.stdout).result?.panes;
+            if (!Array.isArray(panes))
+                return null;
+            const hit = panes.find((p) => p.label === name && typeof p.pane_id === "string" && p.pane_id);
+            return hit?.pane_id ?? null;
         }
         catch {
             return null;
@@ -120,7 +126,11 @@ export class HerdrDriver {
             throw new Error("herdr placement requires HERDR_WORKSPACE_ID — refusing untargeted pane (VIS-10: fail closed, never place by focus)");
         // pin the tab to the RUN's workspace, UNCONDITIONALLY (inherited via HERDR_WORKSPACE_ID), never the
         // operator's focused one (Intl-Dossier run-20260709-104447 incident: worker tabs opened in the tickmarkr repo workspace)
-        const t = await this.herdr(`tab create --label ${shq(label)} --no-focus --workspace ${shq(this.ws)}`);
+        // herdr 0.7.5 (OBS-123): `tab create --cwd` spawns the tab's root shell pane already at a prompt in
+        // the worktree — that root pane IS the worker pane. The old one-shot `agent start … -- bash` verb
+        // (which named a fresh bash pane) was removed; 0.7.5's `agent start` only ATTACHES to a DETECTED
+        // agent CLI, so tickmarkr names the bash pane itself via `pane rename` and types the worker command in.
+        const t = await this.herdr(`tab create --label ${shq(label)} --no-focus --workspace ${shq(this.ws)} --cwd ${shq(cwd)}`);
         if (t.code !== 0)
             throw new Error(`herdr tab create failed (exit ${t.code}, refusing untargeted placement): ${t.stderr || t.stdout}`);
         let res;
@@ -131,43 +141,27 @@ export class HerdrDriver {
             throw new Error(`herdr tab create returned unparseable JSON (refusing untargeted placement): ${t.stdout}`);
         }
         const tabId = res?.tab?.tab_id;
-        const rootPane = res?.root_pane?.pane_id; // auto-created shell pane (SKILL:343)
+        const id = res?.root_pane?.pane_id; // the tab's root shell pane, already in cwd — this run's worker pane
         if (typeof tabId !== "string" || !tabId)
             throw new Error(`herdr tab create returned no tab_id (refusing untargeted placement): ${t.stdout}`);
+        if (typeof id !== "string" || !id)
+            throw new Error(`herdr tab create returned no root pane id (refusing untargeted placement): ${t.stdout}`);
         // T5: the banner's pane identity line, derived from the T1 owned name (legacy names pass through).
         const identity = shq(paneIdentityLine(canonicalizeLegacyName(name, "")));
-        let r = await this.herdr(`agent start ${shq(name)} --cwd ${shq(cwd)} --tab ${shq(tabId)} --no-focus -- bash`);
-        if (r.code !== 0 && /agent_name_taken/.test(r.stderr + r.stdout)) {
-            // DEFECT-01: a prior (killed) process's kept pane still holds this durable name — reclaim it.
-            // The old attempt is void by construction: its worktree was rm -rf'd on re-dispatch (git.ts:34),
-            // so adoption is meaningless; close the stale PANE only (never its tab — sibling prior-run panes
-            // may still be under the operator's eye) and restart. Match BOTH streams (herdr's error-stream
-            // convention varies — Pitfall 6); an unrelated nonzero exit must never reach pane close (T-10-04).
-            const g = await this.herdr(`agent get ${shq(name)}`);
-            try {
-                const stale = JSON.parse(g.stdout).result?.agent?.pane_id;
-                if (typeof stale === "string" && stale)
-                    await this.herdr(`pane close ${shq(stale)}`);
-            }
-            catch {
-                /* holder vanished between calls (agent_not_found) — retry the start regardless */
-            }
-            r = await this.herdr(`agent start ${shq(name)} --cwd ${shq(cwd)} --tab ${shq(tabId)} --no-focus -- bash`); // once
-        }
-        if (r.code !== 0)
-            throw new Error(`herdr agent start failed: ${r.stderr || r.stdout}`); // fail closed, no loop
-        const id = JSON.parse(r.stdout).result?.agent?.pane_id;
-        if (typeof id !== "string" || !id)
-            throw new Error(`herdr agent start returned no pane id: ${r.stdout}`);
-        // tab create auto-spawns a root shell pane and agent start --tab adds the agent as a SECOND
-        // pane — reap the idle shell so no tab shows a dead "tickmarkr git:" prompt beside its agent
-        // (VIS-04 orphan fix). Best-effort: a failed reap costs cosmetics only.
-        if (typeof rootPane === "string" && rootPane && rootPane !== id) {
-            await this.herdr(`pane close ${shq(rootPane)}`);
-        }
+        // durable identity: label the PANE (resolution + reconcile read it back via `pane list`); fail closed
+        // and reap the tab we just made if the rename fails (no orphan tab).
+        const rn = await this.herdr(`pane rename ${shq(id)} ${shq(name)}`);
+        if (rn.code !== 0) {
+            await this.herdr(`tab close ${shq(tabId)}`);
+            throw new Error(`herdr pane rename failed: ${rn.stderr || rn.stdout}`);
+        }
+        // DEFECT-01: a prior (killed) process's kept pane may still carry this durable label (resume +
+        // keepPanes re-dispatches at attempt=0 into the same name). 0.7.5 rename never collides, so instead
+        // of agent_name_taken we sweep stale same-label panes and verify this fresh pane is the sole holder.
+        await this.reclaimStaleLabel(name, id);
         // VIS-10 hole 3: seed the run's workspace id into the agent pane's shell so a worker's own ad-hoc
-        // `herdr agent start` is workspace-targeted BY CONSTRUCTION — correct placement is the default a
-        // worker GETS, not a rule it must remember (P40-02 probe leak). Fail closed: a failed seed rejects.
+        // `herdr` call is workspace-targeted BY CONSTRUCTION — correct placement is the default a worker GETS,
+        // not a rule it must remember (P40-02 probe leak). Fail closed: a failed seed rejects.
         // v1.22 T3 / OBS-17: also strip HERDR_ENV + socket path so the worker cannot open/mutate panes in
         // the operator's session. Daemon-side this.herdr() calls keep process.env (unsealed).
         const seed = await this.herdr(`pane run ${shq(id)} ${shq(`export HERDR_WORKSPACE_ID=${shq(this.ws)}; export ${PANE_IDENTITY_ENV}=${identity}; ${herdrSealShellPrefix()}`)}`);
@@ -175,6 +169,32 @@ export class HerdrDriver {
             throw new Error(`herdr workspace-id seed failed (refusing untargeted pane): ${seed.stderr || seed.stdout}`);
         return { id, name, cwd, tabId };
     }
+    // DEFECT-01 (0.7.5): close any OTHER pane still carrying this durable label (a prior killed attempt's
+    // kept pane), then verify none remain — else fail closed, since `pane list` would otherwise resolve the
+    // name to an ambiguous/stale pane. No-op on the common path (no dup labels). Best-effort closes; the
+    // post-sweep re-list is the fail-closed gate (a close that does not free the name must reject).
+    async reclaimStaleLabel(name, fresh) {
+        const stale = await this.staleLabelPanes(name, fresh);
+        if (stale.length === 0)
+            return;
+        for (const p of stale)
+            await this.herdr(`pane close ${shq(p)}`);
+        if ((await this.staleLabelPanes(name, fresh)).length > 0) {
+            throw new Error(`herdr pane rename reclaim failed — durable name ${name} still held by a stale pane`);
+        }
+    }
+    async staleLabelPanes(name, fresh) {
+        const r = await this.herdr(`pane list`);
+        try {
+            const panes = JSON.parse(r.stdout).result?.panes ?? [];
+            return panes
+                .filter((p) => p.label === name && typeof p.pane_id === "string" && p.pane_id !== fresh)
+                .map((p) => p.pane_id);
+        }
+        catch {
+            return [];
+        }
+    }
     // VIS-04 role-tab (extended VIS-09 item 2): first member bootstraps generation 1 (WORKERS);
     // later members join the latest generation with live-member room via joinGroup, else a NEW
     // overflow generation tab (cleanup, cleanup, …) opens — a second `tab create`, NOT a further
@@ -253,7 +273,7 @@ export class HerdrDriver {
         // stack down. Rightward splits below the measured floor shred the marker (e8aa003 at COLUMNS≈2;
         // unrecoverable at 25 cols per measurement). Introspection failure → down (fail closed).
         const direction = entry.members.length === 1 ? workerSplitDirection(await this.paneWidth(srcPane)) : "down";
-        const sp = await this.herdr(`pane split ${shq(srcPane)} --direction ${direction} --no-focus`);
+        const sp = await this.herdr(`pane split ${shq(srcPane)} --direction ${direction} --no-focus --cwd ${shq(cwd)}`);
         if (sp.code !== 0)
             return null;
         let pane;
@@ -265,13 +285,13 @@ export class HerdrDriver {
         }
         if (typeof pane !== "string" || !pane)
             return null;
-        // the split pane is a bare shell: give it a durable agent name (SKILL:197) and VERIFY the name
-        // resolves back to this pane (research A1 is checked live per join, never assumed) — then cd the
-        // shell into this member's own worktree (a split inherits its parent's cwd, not ours).
-        const rn = await this.herdr(`agent rename ${shq(pane)} ${shq(name)}`);
+        // the split pane is a bare shell: give it a durable PANE label (0.7.5 — agent rename only binds
+        // detected agents; SKILL:197 was the old agent-name path) and VERIFY the label resolves back to this
+        // pane (research A1 is checked live per join, never assumed). `pane split --cwd` already placed the
+        // shell in this member's worktree, so no separate `cd` is needed.
+        const rn = await this.herdr(`pane rename ${shq(pane)} ${shq(name)}`);
         const verified = rn.code === 0 && (await this.paneId({ id: "", name, cwd })) === pane;
-        const cd = verified ? await this.herdr(`pane run ${shq(pane)} ${shq(`cd ${shq(cwd)}`)}`) : null;
-        if (!cd || cd.code !== 0) {
+        if (!verified) {
             await this.herdr(`pane close ${shq(pane)}`); // reap the failed join, best-effort
             return null;
         }
@@ -316,7 +336,7 @@ export class HerdrDriver {
             const typed = await this.herdr(`pane send-text ${shq(pane)} ${shq(cmd)}`, slot.cwd);
             if (typed.code !== 0)
                 throw new Error(`herdr pane send-text failed: ${typed.stderr || typed.stdout}`);
-            const back = await this.herdr(`wait output ${shq(pane)} --match ${shq(cmd)} --timeout ${DELIVERY_VERIFY_TIMEOUT_MS}`, slot.cwd, DELIVERY_VERIFY_TIMEOUT_MS + 15_000);
+            const back = await this.herdr(`pane wait-output ${shq(pane)} --match ${shq(cmd)} --timeout ${DELIVERY_VERIFY_TIMEOUT_MS}`, slot.cwd, DELIVERY_VERIFY_TIMEOUT_MS + 15_000);
             if (this.waitOk(back.code, back.stdout) || await this.deliveryReadMatches(pane, cmd, slot.cwd)) {
                 const enter = await this.herdr(`pane send-keys ${shq(pane)} Enter`, slot.cwd);
                 if (enter.code !== 0)
@@ -344,12 +364,19 @@ export class HerdrDriver {
     }
     async waitOutput(slot, pattern, timeoutMs, opts) {
         const pane = await this.paneId(slot);
-        const r = await this.herdr(`wait output ${shq(pane)} --match ${shq(pattern)}${opts?.regex ? " --regex" : ""} --timeout ${Math.floor(timeoutMs)}`, slot.cwd, timeoutMs + 15_000);
+        // 0.7.5: `--match` (literal) and `--regex` (pattern) are MUTUALLY EXCLUSIVE — the old
+        // `--match <p> --regex` form is rejected ("mutually exclusive"), which made the exit-marker wait
+        // error instantly instead of waiting, so LLM-gate/consult verdicts were read before they rendered
+        // and came back unparseable. Pick exactly one flag by whether the caller wants regex.
+        const r = await this.herdr(`pane wait-output ${shq(pane)} ${opts?.regex ? "--regex" : "--match"} ${shq(pattern)} --timeout ${Math.floor(timeoutMs)}`, slot.cwd, timeoutMs + 15_000);
         return this.waitOk(r.code, r.stdout); // dead pane: exit 0 + top-level error envelope (herdr bite)
     }
     async waitAgentStatus(slot, status, timeoutMs) {
         const pane = await this.paneId(slot);
-        const r = await this.herdr(`wait agent-status ${shq(pane)} --status ${shq(status)} --timeout ${Math.floor(timeoutMs)}`, slot.cwd, timeoutMs + 15_000);
+        // 0.7.5: `wait agent-status` (top-level) was removed; `agent wait <target> --until <status>` replaces
+        // it. Target is the pane id; when herdr has detected the worker's agent CLI there this resolves, else
+        // it returns an error envelope → waitOk false (a best-effort settle, same as the old timeout path).
+        const r = await this.herdr(`agent wait ${shq(pane)} --until ${shq(status)} --timeout ${Math.floor(timeoutMs)}`, slot.cwd, timeoutMs + 15_000);
         return this.waitOk(r.code, r.stdout);
     }
     async status(slot) {
@@ -358,9 +385,13 @@ export class HerdrDriver {
     // shared by status() and the VIS-13 blocked glyph (renameGroupTab): resolve the live agent_status
     // by durable name; "unknown" on any failure (dead pane, unparseable json) — never throws.
     async statusByName(name) {
-        const r = await this.herdr(`agent get ${shq(name)}`);
+        // 0.7.5: read the pane's herdr-detected agent_status off `pane list` (keyed by the durable label);
+        // "unknown" on any failure (no such label, unparseable json) — never throws.
+        const r = await this.herdr(`pane list`);
         try {
-            const s = JSON.parse(r.stdout).result?.agent?.agent_status;
+            const panes = JSON.parse(r.stdout).result?.panes;
+            const hit = Array.isArray(panes) ? panes.find((p) => p.label === name) : undefined;
+            const s = hit?.agent_status;
             return typeof s === "string" ? s : "unknown";
         }
         catch {
@@ -428,21 +459,21 @@ export class HerdrDriver {
     async priorWatch(runId) {
         if (!this.ws)
             throw new Error("herdr watch placement requires HERDR_WORKSPACE_ID — refusing unseeded pane");
-        const list = await this.herdr("agent list");
+        const list = await this.herdr("pane list");
         if (list.code !== 0)
-            throw new Error(`herdr agent list failed: ${list.stderr || list.stdout}`);
-        let agents;
+            throw new Error(`herdr pane list failed: ${list.stderr || list.stdout}`);
+        let panes;
         try {
-            agents = JSON.parse(list.stdout).result?.agents;
+            panes = JSON.parse(list.stdout).result?.panes;
         }
         catch {
-            throw new Error(`herdr agent list returned unparseable JSON: ${list.stdout}`);
+            throw new Error(`herdr pane list returned unparseable JSON: ${list.stdout}`);
         }
-        if (!Array.isArray(agents))
-            throw new Error(`herdr agent list returned no agents: ${list.stdout}`);
-        const prior = agents.find((a) => {
-            const owned = typeof a.name === "string" ? parseOwnedName(a.name) : null;
-            return a.workspace_id === this.ws && typeof a.pane_id === "string" && owned?.role === "watch" && owned.taskId === "run" && owned.runId !== runId;
+        if (!Array.isArray(panes))
+            throw new Error(`herdr pane list returned no panes: ${list.stdout}`);
+        const prior = panes.find((p) => {
+            const owned = typeof p.label === "string" ? parseOwnedName(p.label) : null;
+            return p.workspace_id === this.ws && typeof p.pane_id === "string" && owned?.role === "watch" && owned.taskId === "run" && owned.runId !== runId;
         });
         return prior?.pane_id ?? null;
     }
@@ -465,7 +496,7 @@ export class HerdrDriver {
         }
         if (typeof pane !== "string" || !pane)
             throw new Error(`herdr watch split returned no pane id: ${sp.stdout}`);
-        const renamed = await this.herdr(`agent rename ${shq(pane)} ${shq(name)}`);
+        const renamed = await this.herdr(`pane rename ${shq(pane)} ${shq(name)}`);
         if (renamed.code !== 0 || await this.namedPaneId(name) !== pane) {
             await this.herdr(`pane close ${shq(pane)}`);
             throw new Error(`herdr watch rename failed: ${renamed.stderr || renamed.stdout}`);
@@ -495,7 +526,7 @@ export class HerdrDriver {
             }
             const prior = runId ? await this.priorWatch(runId) : null;
             if (prior) {
-                const renamed = await this.herdr(`agent rename ${shq(prior)} ${shq(name)}`);
+                const renamed = await this.herdr(`pane rename ${shq(prior)} ${shq(name)}`);
                 if (renamed.code !== 0 || await this.namedPaneId(name) !== prior) {
                     throw new Error(`herdr watch reclaim failed: ${renamed.stderr || renamed.stdout}`);
                 }
@@ -528,9 +559,12 @@ export class HerdrDriver {
         try {
             if (!this.ws)
                 return;
-            const list = await this.herdr("agent list");
-            const agents = JSON.parse(list.stdout).result?.agents ?? [];
-            const toClose = panesToClose(agents.map((a) => ({ name: a.name, paneId: a.pane_id, tabId: a.tab_id, workspaceId: a.workspace_id })), desired, this.ws, runId, opts);
+            // 0.7.5: enumerate owned panes from `pane list` (labels), not `agent list` (detected agents only).
+            // panesToClose skips any pane whose label doesn't parse as tickmarkr-owned (orchestrator/operator
+            // shells, undetected agents), so a fuller pane listing never widens the blast radius.
+            const list = await this.herdr("pane list");
+            const panes = JSON.parse(list.stdout).result?.panes ?? [];
+            const toClose = panesToClose(panes.map((p) => ({ name: p.label, paneId: p.pane_id, tabId: p.tab_id, workspaceId: p.workspace_id })), desired, this.ws, runId, opts);
             const touched = new Set();
             for (const c of toClose) {
                 if (typeof c.tabId === "string")

package/dist/gates/acceptance.js

@@ -104,10 +104,15 @@ function tail(out, n = 8) {
         return "";
     return "\n" + t.split("\n").slice(-n).join("\n");
 }
-// v1.70: the new-file line numbers each hunk actually ADDS, per changed path — parsed from the
-// unified-diff hunk headers so a citation is validated against real changed locations, not a substring
-// of the whole diff text (which also matches unchanged context lines and the diff's own +++/@@ headers).
-// Only `+` lines are changed locations; context lines advance the new-file counter but are not changes.
+// v1.70 / OBS-129: the new-file line numbers each changed HUNK spans, per path — parsed from the
+// unified-diff so a citation is validated against real changed regions, not a substring of the whole
+// diff text (which also matches the diff's own +++/@@ headers). A hunk's span is every new-file line it
+// carries: the added (`+`) lines AND the context lines git includes around them.
+// OBS-129: this is a changed-HUNK check, not an exact-added-LINE check. Requiring the exact `+` line made
+// honest judges fail closed on correct work — two frontier judges cited an adjacent line of the same
+// change (LLMs miscount exact line numbers), voiding the whole verdict. The anti-hallucination property
+// holds: a citation outside every hunk, or to an untouched file, still fails (matching the documented
+// "outside every changed hunk → rejected" contract in acceptance.test.ts).
 // ponytail: assumes git's default a/ b/ prefixes (fetchTaskDiff uses plain `git diff`); revisit if a
 // caller passes a --no-prefix diff.
 function changedLinesByFile(diff) {
@@ -137,7 +142,9 @@ function changedLinesByFile(diff) {
         if (!inHunk || path === null)
             continue;
         const c = raw[0];
-        if (c === "+") {
+        if (c === "+" || c === " ") {
+            // OBS-129: record every new-file line the hunk spans — added AND context — so a citation to an
+            // adjacent line of the same change validates, not only the exact `+` line.
             let set = byFile.get(path);
             if (!set) {
                 set = new Set();
@@ -146,17 +153,28 @@ function changedLinesByFile(diff) {
             set.add(newLine);
             newLine++;
         }
-        else if (c === " ") {
-            newLine++;
-        }
         else if (c !== "-") {
             inHunk = false; // "\ No newline", a trailing blank, or the next section — hunk body ended
         }
     }
     return byFile;
 }
-// A citation is valid evidence iff the diff adds the cited line of the cited file. A legacy free-text
-// quote (string) keeps v1.64's substring check — non-empty and present somewhere in the diff.
+// Compact a sorted set of line numbers into "3, 7-9, 14" form for the judge's citable-lines index.
+function compressLines(lines) {
+    const sorted = [...new Set(lines)].sort((a, b) => a - b);
+    const parts = [];
+    for (let i = 0; i < sorted.length;) {
+        let j = i;
+        while (j + 1 < sorted.length && sorted[j + 1] === sorted[j] + 1)
+            j++;
+        parts.push(i === j ? `${sorted[i]}` : `${sorted[i]}-${sorted[j]}`);
+        i = j + 1;
+    }
+    return parts.join(", ");
+}
+// A citation is valid evidence iff the cited line falls inside a changed hunk of the cited file (OBS-129:
+// changed-hunk span, not exact-added-line). A legacy free-text quote (string) keeps v1.64's substring
+// check — non-empty and present somewhere in the diff.
 function citesChangedLocation(evidence, changed, diff) {
     if (typeof evidence === "string")
         return evidence.trim().length > 0 && diff.includes(evidence);
@@ -213,6 +231,10 @@ export async function acceptanceGate(task, worktree, baseRef, judge, via, opts =
     if (capFail)
         return capFail;
     const expectedIds = judgeItems.map((_, index) => judgeCriterionId(index));
+    // OBS-129: give the judge the exact citable new-file line numbers per changed file, so it grounds each
+    // citation in a real changed line instead of miscounting. Validated below against this same `changed`.
+    const changed = changedLinesByFile(diff);
+    const citable = [...changed.entries()].map(([p, set]) => `- ${p}: ${compressLines([...set])}`).join("\n");
     const nonce = generateVerdictNonce();
     const prompt = `TICKMARKR-JUDGE
 You are a strict acceptance judge. Decide whether the diff satisfies EVERY acceptance criterion.
@@ -232,12 +254,15 @@ ${judgeItems.map((a, index) => `- ${renderJudgeCriterion(a, index)}`).join("\n")
 ${diff}
 \`\`\`
 
+## Citable evidence lines (new-file line numbers inside the changed hunks above)
+${citable || "(the diff changes no lines)"}
+
 ${verdictNonceLine(nonce)}
 
 Respond with ONLY this JSON (no prose before or after):
 {"nonce": "${nonce}", "pass": true|false, "criteria": [{"criterion": "c1", "met": true|false, "reason": "...", "evidence": {"path": "path/to/file", "line": 42}}]}
 Each criteria[].criterion MUST be the stable id from the rubric (c1, c2, ...) exactly once.
-Each criteria[].evidence MUST be a structured citation {"path", "line"} pointing at a line the diff above actually adds or changes (the new-file line number); a citation to an unchanged or nonexistent location voids the whole verdict.
+Each criteria[].evidence MUST be a structured citation {"path", "line"} whose "path" and "line" appear in the "Citable evidence lines" list above (a new-file line number inside a changed hunk); a citation outside every changed hunk or to an untouched file voids the whole verdict.
 `;
     const raw = await runLlm(judge.adapter, judge.model, prompt, worktree, via, JUDGE_TIMEOUT_MS);
     const extracted = extractVerdictJson(raw, nonce);
@@ -250,12 +275,11 @@ Each criteria[].evidence MUST be a structured citation {"path", "line"} pointing
             meta: { unparseable: true, judge: channelKey({ adapter: judge.adapter.id, model: judge.model }) } };
     }
     const { verdict: v, inconsistencies } = checkJudgeVerdict(extracted, expectedIds);
-    // v1.70: each citation must point at a line the diff actually changed — validated against the hunks
-    // of `diff` (the exact string embedded in the prompt above), never the worktree or any other artifact.
-    // A citation to an untouched file or a line outside every changed hunk is a hallucinated verdict:
-    // treated as unparseable so GATE-09 retries the judge on a failover channel. (A legacy free-text quote
-    // still validates by substring, for the fake seam and pre-v1.70 fixtures.)
-    const changed = changedLinesByFile(diff);
+    // v1.70 / OBS-129: each citation must fall inside a changed hunk of `diff` (the exact string embedded in
+    // the prompt above and enumerated in the citable-lines index), never the worktree or any other artifact.
+    // A citation to an untouched file or outside every changed hunk is a hallucinated verdict: treated as
+    // unparseable so GATE-09 retries the judge on a failover channel. (A legacy free-text quote still
+    // validates by substring, for the fake seam and pre-v1.70 fixtures.) `changed` is computed above.
     const fabricated = v.criteria.filter((row) => !citesChangedLocation(row.evidence, changed, diff));
     if (fabricated.length) {
         return { gate: "acceptance", pass: false,

package/dist/tui/ink/components.d.ts

@@ -0,0 +1,20 @@
+import type { ReactNode } from "react";
+export type FleetListRow = {
+    id: string;
+    content: ReactNode;
+};
+export declare function ToggleMark({ active }: {
+    active: boolean;
+}): import("react").JSX.Element;
+export declare function FleetListScreen({ title, legend, rows, cursor, details, }: {
+    title: string;
+    legend: string;
+    rows: FleetListRow[];
+    cursor: number;
+    details?: string[];
+}): import("react").JSX.Element;
+export declare function FleetReviewScreen({ title, legend, diff, }: {
+    title: string;
+    legend: string;
+    diff: string;
+}): import("react").JSX.Element;

package/dist/tui/ink/components.js

@@ -0,0 +1,14 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { Box, Text } from "ink";
+import { GLYPHS } from "../../brand.js";
+export function ToggleMark({ active }) {
+    return active
+        ? _jsx(Text, { color: "ansi256(41)", children: GLYPHS.toggleActive })
+        : _jsx(Text, { dimColor: true, children: GLYPHS.toggleInactive });
+}
+export function FleetListScreen({ title, legend, rows, cursor, details = [], }) {
+    return (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, children: title }), _jsx(Text, { dimColor: true, children: legend }), rows.map((row, index) => (_jsxs(Text, { bold: index === cursor, children: [index === cursor ? `${GLYPHS.pointer} ` : "  ", row.content] }, row.id))), details.map((detail) => _jsx(Text, { children: detail }, detail))] }));
+}
+export function FleetReviewScreen({ title, legend, diff, }) {
+    return (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, children: title }), _jsx(Text, { dimColor: true, children: legend }), _jsx(Text, { children: diff })] }));
+}

package/dist/tui/ink/fleet-app.d.ts

@@ -0,0 +1,113 @@
+import type { AuthHealth, WorkerAdapter } from "../../adapters/types.js";
+import type { MapEntry, RoutingMode, Tier } from "../../config/config.js";
+import { type Shape } from "../../graph/schema.js";
+export type FleetSteeringKey = "review" | "consult";
+export type FleetEditorState = {
+    denyAdapters: string[];
+    denyModels: string[];
+    classifications: FleetClassification[];
+    selectedMode: RoutingMode;
+    map: Record<string, MapEntry>;
+    steering: Record<FleetSteeringKey, string[] | undefined>;
+};
+export type FleetOverlayReview = {
+    kind: "empty";
+} | {
+    kind: "diff";
+    before: string;
+    after: string;
+    diff: string;
+    path: string;
+};
+export type FleetEditorResult = {
+    kind: "write";
+    review: Extract<FleetOverlayReview, {
+        kind: "diff";
+    }>;
+} | {
+    kind: "discard";
+} | {
+    kind: "no-changes";
+} | {
+    kind: "quit";
+} | {
+    kind: "refresh";
+};
+type AgentCli = {
+    id: string;
+    version: string;
+    authed: boolean;
+};
+export type FleetModelGroup = {
+    adapter: string;
+    rows: Array<{
+        model: string;
+        tier?: Tier;
+        detectedAt?: string;
+    }>;
+};
+export type FleetClassification = {
+    adapter: string;
+    model: string;
+    tier: Tier;
+    note: string;
+};
+export type FleetModeOption = {
+    id: RoutingMode;
+    gloss: string;
+};
+export type FleetShapeRow = {
+    id: Shape;
+    label: string;
+};
+export type FleetCandidateOption = {
+    id: string;
+    label: string;
+    pin: {
+        via: string;
+        model: string;
+    };
+};
+export declare function formatDoctorAge(ageMs: number | null): string;
+export declare function FleetApp({ ageMs, agents, initialDenyAdapters, initialDenyModels, modelGroups, initialMode, modeOptions, initialMap, modePreview, shapeRows, candidatesForShape, preferOptionsForShape, initialSteering, steeringOptionsFor, reviewOverlay, reloadGuard, }: {
+    ageMs: number | null;
+    agents: AgentCli[];
+    initialDenyAdapters: string[];
+    initialDenyModels: string[];
+    modelGroups: FleetModelGroup[];
+    initialMode: RoutingMode;
+    modeOptions: FleetModeOption[];
+    initialMap: Record<string, MapEntry>;
+    modePreview: (mode: RoutingMode, map: Record<string, MapEntry>) => string[];
+    shapeRows: (mode: RoutingMode, map: Record<string, MapEntry>) => FleetShapeRow[];
+    candidatesForShape: (shape: Shape, mode: RoutingMode, map: Record<string, MapEntry>) => FleetCandidateOption[];
+    preferOptionsForShape: (shape: Shape, current: string[]) => string[];
+    initialSteering: Record<FleetSteeringKey, string[] | undefined>;
+    steeringOptionsFor: (which: FleetSteeringKey, current: string[]) => string[];
+    reviewOverlay: (state: FleetEditorState) => FleetOverlayReview;
+    reloadGuard: (bytes: string) => string | null;
+}): import("react").JSX.Element;
+export declare function runFleetInkEditor({ ageMs, adapters, health, initialDenyAdapters, initialDenyModels, modelGroups, initialMode, modeOptions, initialMap, modePreview, shapeRows, candidatesForShape, preferOptionsForShape, initialSteering, steeringOptionsFor, reviewOverlay, reloadGuard, initialInput, input, output, debug, }: {
+    ageMs: number | null;
+    adapters: WorkerAdapter[];
+    health: Record<string, AuthHealth>;
+    initialDenyAdapters: string[];
+    initialDenyModels: string[];
+    modelGroups: FleetModelGroup[];
+    initialMode: RoutingMode;
+    modeOptions: FleetModeOption[];
+    initialMap: Record<string, MapEntry>;
+    modePreview: (mode: RoutingMode, map: Record<string, MapEntry>) => string[];
+    shapeRows: (mode: RoutingMode, map: Record<string, MapEntry>) => FleetShapeRow[];
+    candidatesForShape: (shape: Shape, mode: RoutingMode, map: Record<string, MapEntry>) => FleetCandidateOption[];
+    preferOptionsForShape: (shape: Shape, current: string[]) => string[];
+    initialSteering: Record<FleetSteeringKey, string[] | undefined>;
+    steeringOptionsFor: (which: FleetSteeringKey, current: string[]) => string[];
+    reviewOverlay: (state: FleetEditorState) => FleetOverlayReview;
+    reloadGuard: (bytes: string) => string | null;
+    initialInput?: string[];
+    input: NodeJS.ReadStream;
+    output: NodeJS.WriteStream;
+    debug?: boolean;
+}): Promise<FleetEditorResult>;
+export {};