tickmarkr 1.84.0 → 1.85.0

package/dist/gates/baseline.js

@@ -14,16 +14,76 @@ const PASS_LINE_RE = /^\s*(?:(?:[\w@./-]+:\s*)*[✓✔]|(?:\[tickmarkr\]\s+)?(?:
 // output to headline it. \s is fine in a TS regex — the BSD [[:space:]] rule binds shell grep only.
 // OBS-42: vitest's diagnostic failure headings are shared anchors for baseline and tip verification.
 const FAIL_ANCHOR_RE = /^\s*(?:FAIL\s+|[^\w]*(?:Unhandled Errors|Uncaught Exception)\b)/;
-const SUMMARY_FAIL_RE = /^\s*Tests?\s+(?:Files?\s+)?\d+\s+failed/; // " Tests  N failed | M passed (T)"
+// OBS-278: a failure fingerprint is a SHAPE — the way a runner reports a failure — never error/fail
+// vocabulary. A status surface that draws those words (zone +N, run attempt N, "1 failed") used to
+// fingerprint as a fresh failure on every attempt, rejecting a task for rendering what it was chartered
+// to render. Digits are written (?:\d+|#) so a shape matches both raw and digit-normalized lines.
+// Run summaries: " Tests  N failed | M passed (T)" (vitest), "# fail N" (TAP / node:test),
+// "ℹ fail N" (node:test's spec reporter) and "test result: FAILED. …" (cargo / libtest).
+const SUMMARY_FAIL_RE = /^\s*(?:Tests?\s+(?:Files?\s+)?(?:\d+|#)\s+failed|#\s+fail\s+(?!0\b)(?:\d+|#)\b|ℹ\s+fail\s+(?!0\b)(?:\d+|#)\b|test result:\s+FAILED\b)/;
+const ERROR_ANCHOR_RE = /^\s*(?:Error|[A-Za-z_$][\w$]*Error):\s+\S/;
+const TSC_ERROR_RE = /^\s*\S.*\((?:\d+|#),(?:\d+|#)\):\s+error\s+[A-Z]+(?:\d+|#):/i; // tsc
+const LINTER_ERROR_RE = /^\s*(?:\d+|#):(?:\d+|#)\s+error\s+\S/; // eslint stylish
+// The failure shapes non-Vitest runners name their tests with: pytest's short summary
+// (`FAILED tests/t.py::test_x - AssertionError`, `ERROR tests/t.py::fixture`), go test
+// (`--- FAIL: TestFoo (0.00s)`), TAP / node:test (`not ok 1 - name`, whose summary line lands in
+// SUMMARY_FAIL_RE) and python unittest's failure-block header (`FAIL: test_x (mod.Class.test_x)`,
+// verbatim capture, python3 -m unittest -v). Each anchors the runner's token at line START; the
+// pytest/go forms also require a file/test identifier after it (`::`, a path separator, or an
+// extension) — so a surface drawing "FAILED" mid-line, or a plain sentence like "FAILED to reach
+// the zone", still matches nothing. Without these a genuinely new pytest/go/TAP/unittest failure on
+// an already-red baseline was forgiven as pre-existing, because only shaped lines can reject.
+const RUNNER_FAIL_RE = /^\s*(?:(?:FAILED|ERROR)\s+\S*(?:::|[/\\]|\.[A-Za-z]\w*\b)|FAIL:\s+\S|---\s+FAIL:\s+\S|not ok\b)/;
+// The other half of the position rule: runners that put the verdict LAST. cargo/libtest names each
+// failing test as `test tests::name ... FAILED` (verbatim capture, cargo 1.95.0) and details it with
+// `thread 'tests::name' (81651804) panicked at src/lib.rs:7:24:`; python unittest -v writes
+// `test_x (mod.Class.test_x) ... FAIL` (and `... ERROR`) — the same rule with the runner's
+// qualified-name token between identifier and separator, and the short verdict spelling (verbatim
+// capture, python3 -m unittest -v). Recognition is positional, not a vendor name: an identifier, the
+// runner's own separator, then the verdict ENDING the line. A drawn status strip ("│ ✗ tip-verify
+// FAILED · zone +3 │") has the verdict mid-line inside chrome, so it matches nothing here — which is
+// why this can generalize without re-opening OBS-278.
+const TRAILING_FAIL_RE = /^\s*(?:test\s+)?\S+(?:\s+\([^)]*\))?\s+(?:\.{3}|-{3,})\s+(?:FAIL(?:ED)?|ERROR)\s*$|^\s*thread\s+'[^']*'\s+.*panicked at\s+\S/;
+// node:test's spec reporter speaks glyphs, not words: a failure is named by a leading ✖ (verbatim
+// capture, Node v22 `--test-reporter=spec`: `✖ old failure (0.585875ms)`, totalled as `ℹ fail 1` in
+// SUMMARY_FAIL_RE) — the exact counterpart of the ✓/✔ pass markers PASS_LINE_RE drops, with the same
+// optional label prefixes. Recognition is positional — the runner's own marker at line start — so any
+// runner sharing the glyph protocol is read without being enumerated; a status strip drawing ✖
+// mid-line inside chrome matches nothing, the same position rule as the other shapes.
+const GLYPH_FAIL_RE = /^\s*(?:(?:[\w@./-]+:\s*)*)✖\s+\S/;
+// Lines that NAME a failing test — the ones worth headlining to the operator. One list, so recognition
+// and reporting cannot drift apart (a shape that blocks but never gets named cost 3 attempts once).
+const namesFailure = (l) => FAIL_ANCHOR_RE.test(l) || RUNNER_FAIL_RE.test(l) || TRAILING_FAIL_RE.test(l) || GLYPH_FAIL_RE.test(l);
+const isFailureShaped = (l) => namesFailure(l) || SUMMARY_FAIL_RE.test(l) || ERROR_ANCHOR_RE.test(l)
+    || TSC_ERROR_RE.test(l) || LINTER_ERROR_RE.test(l);
+const VOCAB_RE = /\b(?:error|fail(?:ed|ure|ing)?)\b/i;
 const normalizeLine = (l) => l.replace(/\d+/g, "#").replace(/\s+/g, " ").trim();
+// A failing command whose output holds no shape any runner here names. The marker is content-free and
+// constant: downstream consumers (tip verify journals fingerprint counts) still see that the command
+// failed, while no line of the output — narration, status strip, stack trace — can enter the set. Being
+// constant it is identical on every attempt, so it can never surface as a fresh fingerprint either.
+export const UNRECOGNIZED_FAILURE = "<unrecognized failure output>";
+// OBS-278 dies here: only a failure SHAPE is fingerprintable. Vocabulary is not a shape — a surface that
+// renders "zone +3 · run attempt 2 · 1 failed" (what T9 is chartered to draw) contributes nothing, with
+// or without box glyphs, so it cannot manufacture a fresh-fingerprint rejection on any future attempt.
 export function fingerprint(output) {
     const lines = output
         .split("\n")
         .map((l) => l.replace(ANSI_RE, ""))
-        .filter((l) => !PASS_LINE_RE.test(l) && (FAIL_ANCHOR_RE.test(l) || /\b(error|fail(ed|ure|ing)?)\b/i.test(l)))
-        .map(normalizeLine);
-    return [...new Set(lines)];
+        .filter((l) => !PASS_LINE_RE.test(l));
+    const shaped = lines.filter(isFailureShaped);
+    if (!shaped.length)
+        return lines.some((l) => l.trim()) ? [UNRECOGNIZED_FAILURE] : [];
+    return [...new Set(shaped.map(normalizeLine))];
 }
+// The diagnostic channel for a runner we cannot read: raw output lines, never fingerprints, never a
+// verdict. They exist so the operator sees SOMETHING when a green command turns red unrecognizably.
+const unrecognizedEvidence = (raw) => raw
+    .split("\n")
+    .map((l) => l.replace(ANSI_RE, "").trimEnd())
+    .filter((l) => VOCAB_RE.test(l))
+    .slice(0, 10)
+    .join("\n");
 // stored baselines may predate ANSI/pass-marker hardening — renormalize at compare time so existing
 // on-disk baseline.json files stay comparable without recapture (compat invariant, CLAUDE.md)
 const renormalize = (fp) => normalizeLine(fp.replace(ANSI_RE, ""));
@@ -68,7 +128,9 @@ export async function captureBaseline(cwd, commands) {
         // ponytail: strip the executing cwd so repo-root capture and worktree compare fingerprint identically; /private-vs-/tmp symlink variance is out of scope
         base.commands[name] = {
             exitCode: r.code,
-            fingerprints: fingerprint((r.stdout + "\n" + r.stderr).split(cwd).join("")),
+            // a command that exits 0 has no failures to fingerprint — recording any would be a lie the
+            // compare step then has to forgive
+            fingerprints: r.code === 0 ? [] : fingerprint((r.stdout + "\n" + r.stderr).split(cwd).join("")),
             missingCommand: missingConfiguredCommand(cmd, r),
         };
     }
@@ -119,12 +181,12 @@ function headlineDetails(raw, fresh) {
     const headlines = raw
         .split("\n")
         .map((l) => l.replace(ANSI_RE, ""))
-        .filter((l) => FAIL_ANCHOR_RE.test(l) || SUMMARY_FAIL_RE.test(l));
+        .filter((l) => namesFailure(l) || SUMMARY_FAIL_RE.test(l));
     if (!headlines.length)
         return { details: `new failures vs baseline:\n${fresh.join("\n")}` };
     return {
         details: `failing tests:\n${headlines.join("\n")}\n\nnew failure fingerprints vs baseline (secondary):\n${fresh.join("\n")}`,
-        meta: { failingTests: headlines.filter((l) => FAIL_ANCHOR_RE.test(l)) },
+        meta: { failingTests: headlines.filter(namesFailure) },
     };
 }
 export async function compareToBaseline(cwd, commands, baseline, enabled) {
@@ -145,18 +207,34 @@ export async function compareToBaseline(cwd, commands, baseline, enabled) {
         const raw = (r.stdout + "\n" + r.stderr).split(cwd).join("");
         const known = new Set((baseline.commands[name]?.fingerprints ?? []).map(renormalize));
         // OBS-42: diagnostic headings enrich fingerprints but cannot invalidate legacy baselines.
-        const fresh = fingerprint(raw).filter((f) => !known.has(f) && (!FAIL_ANCHOR_RE.test(f) || f.startsWith("FAIL ")));
-        if (!fresh.length && (baseline.commands[name]?.exitCode ?? 1) === 0) {
+        const current = fingerprint(raw);
+        const fresh = current.filter((f) => !known.has(f) && (!FAIL_ANCHOR_RE.test(f) || f.startsWith("FAIL ")));
+        // OBS-278: only a failure SHAPE is a verdict — everything fingerprint() keeps is one, except the
+        // unrecognized-output marker, which is evidence for the operator and never grounds to reject.
+        // ponytail: ceiling — a runner whose failure output holds no shape above and whose baseline is
+        // already red has its new failures forgiven, so forgiveness that rests on the marker SAYS so
+        // below rather than reading as a verified green. Raise the ceiling by teaching isFailureShaped
+        // that runner's position rule (leading verdict + identifier, or identifier + separator + trailing
+        // verdict); loosening back to vocabulary re-opens OBS-278.
+        const unreadable = current.includes(UNRECOGNIZED_FAILURE);
+        const failing = fresh.filter((f) => f !== UNRECOGNIZED_FAILURE);
+        if (!failing.length && (baseline.commands[name]?.exitCode ?? 1) === 0) {
+            const closed = `command was green at baseline but now exits ${r.code} with no recognizable failure lines — failing closed`;
+            const evidence = unrecognizedEvidence(raw);
             results.push({
                 gate: name,
                 pass: false,
-                details: `command was green at baseline but now exits ${r.code} with no recognizable failure lines — failing closed`,
+                details: evidence ? `${closed}\nunrecognized output:\n${evidence}` : closed,
             });
             continue;
         }
-        results.push(fresh.length
-            ? { gate: name, pass: false, ...headlineDetails(raw, fresh) }
-            : { gate: name, pass: true, details: `exit ${r.code} but only pre-existing failures (forgiven)` });
+        results.push(failing.length
+            ? { gate: name, pass: false, ...headlineDetails(raw, failing) }
+            : {
+                gate: name,
+                pass: true,
+                details: `exit ${r.code} but only pre-existing failures (forgiven)${unreadable ? " — no failure shape recognized in this output, so a new failure from this runner is invisible to the baseline gate" : ""}`,
+            });
     }
     return results;
 }

package/dist/gates/review.d.ts

@@ -27,6 +27,13 @@ export declare function isProtectedEvidence(path: string): boolean;
 export declare function setAsideReceiptPath(section: string): string | null;
 /** Replace the content of every section confined to the regenerable frame corpora with a receipt. */
 export declare function setAsideRegenerableCaptures(diff: string): string;
+/**
+ * The paths this task's diff ACTUALLY touched. `-z` so a path carrying spaces or non-ASCII bytes is
+ * never mangled by git's quoting, `--no-renames` so a rename reports BOTH sides: a file renamed OUT of
+ * the leaf class must be visible to the promotion test, and rename detection would hide the old side.
+ */
+export declare function changedPaths(worktree: string, baseRef: string): Promise<string[]>;
+export declare function mirrorsVersionOnly(worktree: string, baseRef: string, path: string): Promise<boolean>;
 export declare function fetchTaskDiff(worktree: string, baseRef: string): Promise<{
     full: string;
     forCap: string;

package/dist/gates/review.js

@@ -1,7 +1,7 @@
 import { writeFileSync } from "node:fs";
 import { join } from "node:path";
-import { channelKey } from "../adapters/types.js";
-import { DEFAULT_DIFF_CAP, TIER_RANK } from "../config/config.js";
+import { channelKey, shq } from "../adapters/types.js";
+import { criticalPathHits, DEFAULT_DIFF_CAP, DEFAULT_REVIEW_CRITICAL_PATHS, declaredReviewPolicy, isReviewLeafPath, raiseReviewPolicy, REVIEW_VERSION_MIRRORS, TIER_RANK, } from "../config/config.js";
 import { renderAcceptanceItem } from "../graph/schema.js";
 import { getAdapter } from "../adapters/registry.js";
 import { shOk } from "../run/git.js";
@@ -211,6 +211,34 @@ export function setAsideRegenerableCaptures(diff) {
     const kindOnly = kindOnlyPaths(sections);
     return sections.map((s) => setAsideSection(s, kindOnly)).join("");
 }
+/**
+ * The paths this task's diff ACTUALLY touched. `-z` so a path carrying spaces or non-ASCII bytes is
+ * never mangled by git's quoting, `--no-renames` so a rename reports BOTH sides: a file renamed OUT of
+ * the leaf class must be visible to the promotion test, and rename detection would hide the old side.
+ */
+export async function changedPaths(worktree, baseRef) {
+    const out = await shOk(`git diff --name-only --no-renames -z '${baseRef}..HEAD'`, worktree);
+    return [...new Set(out.split("\0").map((p) => p.trim()).filter(Boolean))].sort();
+}
+/**
+ * A root manifest is a version MIRROR only when the bump is all it changed. `package.json` carries the
+ * gate commands and the dependency set, so a diff that moves `scripts` or `dependencies` is executable
+ * behaviour wearing a leaf-class path — the one thing a path predicate can never see for itself. Every
+ * added or removed line must be a `"version":` line (a lockfile bump rewrites several of them); a
+ * manifest whose diff cannot be read at all fails closed, out of the class.
+ */
+const VERSION_FIELD_LINE_RE = /^[+-]\s*"version":\s*"[^"]*",?\s*$/;
+export async function mirrorsVersionOnly(worktree, baseRef, path) {
+    let diff;
+    try {
+        diff = await shOk(`git diff -U0 '${baseRef}..HEAD' -- ${shq(path)}`, worktree);
+    }
+    catch {
+        return false;
+    }
+    const changed = diff.split("\n").filter((l) => /^[+-]/.test(l) && !/^(?:\+\+\+|---)/.test(l));
+    return changed.length > 0 && changed.every((l) => VERSION_FIELD_LINE_RE.test(l));
+}
 export async function fetchTaskDiff(worktree, baseRef) {
     const full = setAsideRegenerableCaptures(await shOk(`git diff '${baseRef}..HEAD'`, worktree));
     const forCap = setAsideRegenerableCaptures(await shOk(`git diff -U0 '${baseRef}..HEAD'`, worktree));
@@ -269,9 +297,74 @@ export async function reviewGate(task, worktree, baseRef, author, channels, adap
 // OBS-196: run dir for raw-output persistence on an unparseable verdict; absent (older callers,
 // direct tests) skips persistence and changes nothing else.
 artifactDir) {
-    if (task.complexity < cfg.review.complexityThreshold) {
-        return { gate: "review", pass: true, details: `skipped — complexity ${task.complexity} < threshold ${cfg.review.complexityThreshold}`, meta: { skipped: true } };
+    // R3 (OBS-186): participation is keyed on PATHS. The compiler's assignment comes from the DECLARED
+    // files[]; the operator's floor may RAISE it to full and can never lower it. `complexityThreshold` is
+    // retired — the branch that returned a green skip on a complexity comparison is gone, and with it the
+    // "a law caps complexity at 3, the gate starts at 7" unreachability OBS-186 measured.
+    //
+    // COLLATERAL this rescoped task closed: the run-gates/daemon participation assertions are rewritten
+    // path-keyed, the NamedFake review fixtures carry their own nonce trailer (llm.ts's injection is
+    // scoped to adapter id "fake" and a renamed fake is a different adapter to it — the check is not
+    // weakened, the fixture is fixed), the merge decision reads `gateSatisfied`, and the daemon writes a
+    // parallel round's gate-result rows in GATE_NAMES order (src/run/daemon.ts).
+    //
+    // That last one is why: retiring the switch makes fixtures that used to SKIP review journal TWO
+    // verdict rows per round instead of one, and judge ‖ review publish in COMPLETION order — so the
+    // three journal-determinism oracles (tests/run/narration.test.ts's byte comparison and its
+    // throwing-sink event-order check, tests/run/notify-identity.test.ts's two-run equality, and this
+    // repo's own phase-start/gate-result pairing in tests/run/daemon.test.ts) start seeing a race.
+    // LATENT, not introduced: the operator's config has run `complexityThreshold: 0` since 2026-07-31,
+    // so production rounds have journaled both siblings all along — only the fixtures were blind to it.
+    // Fixed in the ledger rather than in the oracles, because determinism run-to-run is a property of
+    // the journal, not of three test files that happen to assert it.
+    const declaredPolicy = declaredReviewPolicy(task.files);
+    const policy = raiseReviewPolicy(declaredPolicy, cfg.review.policy);
+    // PROMOTION: the declared assignment is a claim about paths, and the diff is the evidence. A
+    // judge-only task whose diff left the leaf class is reviewed in full — the claim never outranks
+    // what actually happened, and an empty diff promotes too (a skip earned by an absence is not earned).
+    let promotedBy = null;
+    if (policy === "judge-only") {
+        const touched = await changedPaths(worktree, baseRef);
+        // Two ways a path leaves the leaf class. It is not a member (`docs/tool.ts`, `docs/Makefile`) — or
+        // it is a root version mirror whose diff moved more than the version field, which no path predicate
+        // can see. `package.json` carries the gate commands, so a scripts edit hiding behind a leaf-class
+        // path is exactly the promotion this buys.
+        const nonMembers = touched.filter((p) => !isReviewLeafPath(p));
+        const impostorMirrors = (await Promise.all(touched.filter((p) => REVIEW_VERSION_MIRRORS.has(p))
+            .map(async (p) => await mirrorsVersionOnly(worktree, baseRef, p) ? null : p))).filter((p) => p !== null);
+        // The fail-closed backstop for the compile lint. reviewParticipationErrors runs at a repo root the
+        // compile seam cannot always name (collateral.ts); THIS gate is handed the run's real config, so a
+        // critical path that reached dispatch is reviewed here whatever the lint saw. The shipped defaults
+        // are unioned in for the same reason they are there: a config that names none still has a floor.
+        const criticalHits = criticalPathHits([...task.files, ...touched], [...new Set([...DEFAULT_REVIEW_CRITICAL_PATHS, ...(cfg.review.criticalPaths ?? [])])]);
+        const escaped = [...new Set([...nonMembers, ...impostorMirrors, ...criticalHits])].sort();
+        if (touched.length > 0 && escaped.length === 0) {
+            // A declined review makes NO green claim. types.ts's T11 note ("pass stays true so enforcement is
+            // unchanged") describes the baseline skips — a build/test/lint command the repo never configured.
+            // R3 overrules it here: a cross-vendor review that did not run cannot report a pass, so the record
+            // carries verdict "skipped" with the policy that declined it and the reason, and pass is never
+            // true. The merge-predicate seam this opens is named in the collateral note above.
+            return {
+                gate: "review",
+                pass: false,
+                details: `skipped — reviewPolicy judge-only: every declared path is docs/CHANGELOG/RELEASING/version-mirror leaf work and the diff stayed in that class (${touched.join(", ")})`,
+                meta: {
+                    skipped: true,
+                    verdict: "skipped",
+                    policy: "judge-only",
+                    reason: "every declared path and every path this diff touched is provably leaf-class work",
+                    paths: touched,
+                },
+            };
+        }
+        promotedBy = escaped.length > 0 ? escaped : [];
     }
+    // Every verdict this gate reports from here on was produced under `full` — either declared full, or
+    // promoted here. `promotedBy` names the paths that bought the promotion, so the record shows WHY.
+    const policyMeta = {
+        policy: "full",
+        ...(promotedBy ? { promotedFrom: declaredPolicy, promotedBy } : {}),
+    };
     const reviewer = pickReviewer(author, channels, excludeReviewers ?? [], cfg.review.prefer ?? []);
     if (!reviewer) {
         // meta.noEligibleReviewer lets run-gates' review-retry keep the ORIGINAL unparseable result when
@@ -343,7 +436,7 @@ The top-level comments array is optional. Use it only for actionable line-anchor
             gate: "review",
             pass: false,
             details: `review output unparseable (reviewer ${reviewer.adapter}:${reviewer.model}; cause: ${cause}${saved ? `; raw saved: ${saved}` : ""}) — failing closed`,
-            meta: { reviewer: channelKey(reviewer), unparseable: true, cause },
+            meta: { ...policyMeta, reviewer: channelKey(reviewer), unparseable: true, cause },
         };
     }
     const decided = findings !== null
@@ -354,6 +447,6 @@ The top-level comments array is optional. Use it only for actionable line-anchor
         gate: "review",
         pass: decided.pass,
         details: appendAnchoredReview(prose, v),
-        meta: { reviewer: channelKey(reviewer) },
+        meta: { ...policyMeta, reviewer: channelKey(reviewer) },
     };
 }

package/dist/gates/run-gates.d.ts

@@ -9,6 +9,7 @@ export type GateEvent = {
     gate: GateName;
     index: number;
     total: number;
+    parentAt?: number;
 } | {
     phase: "end";
     gate: GateName;
@@ -27,8 +28,16 @@ export interface GateContext {
     via?: GateVia;
     excludeReviewers?: string[];
     artifactDir?: string;
+    pipeline?: "v185" | "legacy";
+    selectTests?: boolean;
     onGate?: (e: GateEvent) => void | Promise<void>;
 }
+/**
+ * The configured test command narrowed to these files. Mirrors testFiltered's `--` rule (acceptance.ts:104):
+ * npm/yarn/pnpm/npx script wrappers need one `--` to forward positional filters to the underlying runner;
+ * a command that already has `--` takes them directly. Every path is quoted — config flows into a shell.
+ */
+export declare function testCommandForFiles(testCmd: string, files: string[]): string;
 export declare function runGates(task: Task, ctx: GateContext): Promise<{
     results: GateResult[];
     commits: string[];