tickmarkr 1.86.0 → 1.89.0

package/dist/adapters/types.d.ts

@@ -77,11 +77,42 @@ export type TrustVerdict = {
     status: "action-required";
     command: string;
 };
-export interface TrustDialog {
+export interface CapturedTrustDialog {
+    kind?: "dialog";
     fingerprint: string;
     key: string;
 }
-export declare function matchesTrustDialog(paneText: string, dialog: TrustDialog): boolean;
+export interface NoTrustDialog {
+    kind: "none";
+    reason: string;
+}
+export type TrustDialog = CapturedTrustDialog | NoTrustDialog;
+export declare const TRUST_DIALOG_BLANK_MESSAGE = "trust-dialog fingerprint must be verbatim bytes captured from a workspace-trust prompt \u2014 a blank or whitespace-only fingerprint matches every pane";
+export declare const CLAUDE_TRUST_PANE: string;
+export declare const CODEX_TRUST_PANE: string;
+export declare const CURSOR_TRUST_PANE = "Workspace Trust Required\nTrust this folder?";
+export declare const KIMI_TRUST_PANE: string;
+export declare const KIMI_MCP_TRUST_PANE: string;
+export declare const RECORDED_TRUST_PANES: readonly string[];
+export declare const APPROVED_TRUST_FINGERPRINTS: readonly string[];
+export declare const TRUST_DIALOG_UNRECORDED_MESSAGE = "trust-dialog fingerprint is not one of the approved workspace-trust captures \u2014 it must be exactly an entry of APPROVED_TRUST_FINGERPRINTS in src/adapters/types.ts (each the distinctive bytes of a recorded pane), not a prefix of one, a substring of one, or a sentence describing the prompt; declare {kind: none, reason} if the CLI renders none";
+export declare const TRUST_DIALOG_VARIANTS: readonly [z.ZodObject<{
+    kind: z.ZodOptional<z.ZodLiteral<"dialog">>;
+    fingerprint: z.ZodString;
+    key: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"none">;
+    reason: z.ZodString;
+}, z.core.$strict>];
+export declare const TrustDialogSchema: z.ZodUnion<readonly [z.ZodObject<{
+    kind: z.ZodOptional<z.ZodLiteral<"dialog">>;
+    fingerprint: z.ZodString;
+    key: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"none">;
+    reason: z.ZodString;
+}, z.core.$strict>]>;
+export declare function matchesTrustDialog(paneText: string, dialog: TrustDialog): dialog is CapturedTrustDialog;
 export interface InputBox {
     fingerprint: string;
     match?(paneText: string): boolean;
@@ -118,7 +149,7 @@ export interface WorkerAdapter {
     collectUsage?(cwd: string, sinceMs: number): TokenUsage | undefined;
     contextUsage?(session: SessionRef): ContextUsage | null;
     trust?(repoRoot: string): TrustVerdict;
-    trustDialog?: TrustDialog;
+    trustDialog: TrustDialog;
     inputBox?: InputBox;
     hardcodedFlags?: {
         binary: string;

package/dist/adapters/types.js

@@ -27,8 +27,106 @@ export function modelAuthed(health, model, allowUnverifiedModels = false) {
     const authed = health?.modelAuth?.[model]?.authed;
     return authed === true || (authed === undefined && allowUnverifiedModels);
 }
+export const TRUST_DIALOG_BLANK_MESSAGE = "trust-dialog fingerprint must be verbatim bytes captured from a workspace-trust prompt — a blank or whitespace-only fingerprint matches every pane";
+// v1.89 T1 / OBS-414 round 3 — THE EVIDENCE. The word "trust" is not evidence of a capture: codex's
+// real recorded gate is "Do you trust the contents of this directory?" and the handwritten prose
+// "Do you trust this command?" is one word away, so no regex separates them — only the record does.
+// Round 2 accepted the prose, and the daemon presses Enter on a match, which is auto-approval of an
+// arbitrary tool call. So a fingerprint must be an ENUMERATED capture (APPROVED_TRUST_FINGERPRINTS
+// below), and every pane here is VERBATIM, quoted from the record named beside it — the panes are the
+// evidence each approved entry is checked against, never the acceptance rule themselves.
+//
+// Cost of the posture, stated plainly: an operator adding a CLI through the YAML drive contract
+// cannot declare a trust dialog whose capture is not enumerated here — they declare {kind:"none",
+// reason} and page a human, or contribute the capture. That is deliberate. The alternative is a stall
+// protection that any plausible sentence can turn into a permission auto-approver.
+// v1.75 T2 / OBS-137, claude-code 2.1.218 startup gate.
+export const CLAUDE_TRUST_PANE = [
+    "Accessing workspace:",
+    "/tmp/untrusted-project",
+    "Quick safety check: Is this a project you created or one you trust? (Like your own code, a well-known open source project, or work from your team).",
+    "Yes, I trust this folder",
+].join("\n");
+// v1.75 T2 / OBS-137, codex 0.144.6 startup gate.
+export const CODEX_TRUST_PANE = [
+    "Do you trust the contents of this directory?",
+    "Working with untrusted contents comes with higher risk of prompt injection.",
+    "Trusting the directory allows project-local config, hooks, and exec policies to load.",
+    "› 1. Yes, continue",
+    "Press enter to continue",
+].join("\n");
+// v1.22 T5 / OBS-19, cursor-agent's per-worktree dialog.
+export const CURSOR_TRUST_PANE = "Workspace Trust Required\nTrust this folder?";
+// OBS-358, live pane wW:p2TB of run-20260805-121252 — the dialog that cost 30 minutes — quoted from
+// the record holding all five lines, .overseer/REPAIR-v186/GATE-T28-1.md (OBSERVATIONS.md abridges
+// it to the first three). "← highlighted" is the observer's annotation of the selected row, kept
+// exactly as recorded rather than tidied away.
+export const KIMI_TRUST_PANE = [
+    "Trust this folder?",
+    "  /Users/…/.tickmarkr/worktrees.noindex/tickmarkr-run-20260805-121252--T29",
+    "❯ Trust this folder     ← highlighted",
+    "    Enable project MCP servers. Remembered for this folder.",
+    "  Don't trust",
+].join("\n");
+// OBS-406, live pane wW:p32A of run-20260806-121758-…214 T5 — the same gate in its MCP-trust
+// wording, which is why kimi's fingerprint is the cursor+option row both headings share.
+export const KIMI_MCP_TRUST_PANE = [
+    "Kimi Code loads project-level MCP servers (.mcp.json, .kimi-code/mcp.json) only in trusted folders.",
+    " ❯ Trust this folder      /      Don't trust",
+].join("\n");
+export const RECORDED_TRUST_PANES = [
+    CLAUDE_TRUST_PANE, CODEX_TRUST_PANE, CURSOR_TRUST_PANE, KIMI_TRUST_PANE, KIMI_MCP_TRUST_PANE,
+];
+// v1.89 T1 / OBS-414 round 4 — EXACT, not "leading bytes of a recorded line". Round 3 accepted any
+// prefix of a captured line, and every prefix of a trust prompt is also a substring of unrelated
+// panes: `{fingerprint: "Trust"}` passed, then matched a tool-permission pane reading
+// "Trust this command?" and handed the daemon an Enter to press on it — the auto-approval defect,
+// reopened by the check meant to close it. `"Trust this folder"` (kimi's row minus its cursor glyph)
+// passed the same way, and that exact string is the one OBS-406 measured producing 258 false wakes
+// in 25 minutes on supervisor panes with the words on screen as prose.
+//
+// So the approved fingerprints are ENUMERATED, one per shipped capture, each the distinctive bytes
+// of its own pane and nothing shorter. Kimi's carries the selection cursor because a live modal
+// renders one and prose never does. Membership is exact; the corpus check below it keeps a list
+// entry from drifting away from the pane it claims to quote.
+export const APPROVED_TRUST_FINGERPRINTS = [
+    "Quick safety check: Is this a project you created or one you trust?", // claude-code 2.1.218, OBS-137
+    "Do you trust the contents of this directory?", // codex 0.144.6, OBS-137
+    "Workspace Trust Required", // cursor-agent, OBS-19
+    "❯ Trust this folder", // kimi 0.29.0, OBS-358 + OBS-406 — the cursor glyph is load-bearing
+];
+const isApprovedFingerprint = (fingerprint) => APPROVED_TRUST_FINGERPRINTS.includes(fingerprint)
+    && RECORDED_TRUST_PANES.some((pane) => pane.includes(fingerprint));
+export const TRUST_DIALOG_UNRECORDED_MESSAGE = "trust-dialog fingerprint is not one of the approved workspace-trust captures — it must be exactly an entry of APPROVED_TRUST_FINGERPRINTS in src/adapters/types.ts (each the distinctive bytes of a recorded pane), not a prefix of one, a substring of one, or a sentence describing the prompt; declare {kind: none, reason} if the CLI renders none";
+// The two variants, exported as one tuple so every schema that embeds a trust declaration (the
+// drive contract in catalog.ts) is built from these bytes rather than restating them.
+export const TRUST_DIALOG_VARIANTS = [
+    z.object({
+        kind: z.literal("dialog").optional(),
+        // superRefine, not chained refine(): one failure yields ONE diagnosis, so the operator reads the
+        // reason their declaration was refused instead of every rule it happened to trip.
+        fingerprint: z.string().superRefine((fingerprint, ctx) => {
+            const message = fingerprint.trim().length === 0 ? TRUST_DIALOG_BLANK_MESSAGE
+                : isApprovedFingerprint(fingerprint) ? undefined
+                    : TRUST_DIALOG_UNRECORDED_MESSAGE;
+            if (message)
+                ctx.addIssue({ code: "custom", message });
+        }),
+        key: z.string().min(1),
+    }).strict(),
+    z.object({
+        kind: z.literal("none"),
+        reason: z.string().refine((r) => r.trim().length > 0, "a no-dialog declaration must state a falsifiable reason"),
+    }).strict(),
+];
+export const TrustDialogSchema = z.union(TRUST_DIALOG_VARIANTS);
+// The discrimination lives HERE, at the keypress boundary every caller crosses: a no-dialog
+// declaration never matches, so sendKey is unreachable for it without editing this function. The
+// blank guard is the same fail-closed posture one layer below the schema.
 export function matchesTrustDialog(paneText, dialog) {
-    return paneText.includes(dialog.fingerprint);
+    if (dialog.kind === "none")
+        return false;
+    return dialog.fingerprint.trim().length > 0 && paneText.includes(dialog.fingerprint);
 }
 const inputBoxes = new Map();
 export function declareInputBox(adapterId, inputBox) {

package/dist/cli/commands/approve.d.ts

@@ -1 +1,3 @@
+export type ApprovalStatus = "deferred-live" | "recorded-no-owner";
+/** The production command registered in COMMANDS; its returned bytes are what the CLI prints. */
 export declare function approve(argv: string[], cwd?: string): Promise<string>;

package/dist/cli/commands/approve.js

@@ -1,109 +1,120 @@
 import { userInfo } from "node:os";
 import { GATE_NAMES } from "../../graph/schema.js";
 import { ATTEMPT_CAP_RELEASE, GATE_SATISFIED_RELEASE, Journal, RECHECK_RELEASE, REVIEW_UPHELD_RELEASE } from "../../run/journal.js";
-// GATE-08 (v1.12): approve a parked human gate so the next `tickmarkr resume <runId>` dispatches it.
-//
-// The approval is a JOURNAL EVENT (task-approved) carrying who and when — it touches ONLY the
-// append-only journal. Writing it into tickmarkr's compiled graph artifact would be silently erased by
-// the next recompile (which re-emits humanGate:true from the plan frontmatter) — Phase 42 D-02.
-//
-// v1.24 OBS-18: when the park kind is attempt-cap (not a humanGate pre-dispatch park), the event
-// also carries `release: "attempt-cap"`. replayResumeState zeros the attempt budget on that marker so
-// resume dispatches instead of re-parking in the same tick; tried-list is preserved. Unknown kinds
-// receive no release and remain fail-closed to a human rather than being inferred from prose.
-//
-// Fail-closed (D-05): unknown runId, unknown taskId, a not-parked task, and a double-approve are all
-// LOUD refusals that name the reason and append NO event — never a silent no-op. A handler throw
-// becomes `tickmarkr approve: <message>` at exit 1 (src/cli/index.ts dispatch).
-//
-// Who/when is truthful, not dressed-up auth (D-03): default actor os.userInfo().username; --by overrides
-// for delegated approval; optional --reason; the event's ts (stamped by Journal.append) is the when.
-// OBS-189: `--uphold` is the second decision a review park offers. Plain approve accepts the diff the
-// reviewer rejected (gate-satisfied); --uphold sides WITH the reviewer and funds ONE fixed worker
-// attempt carrying the findings — the park costs an attempt, never the run.
+import { acquireApprovalSerialization, runLockOwner } from "../../run/lock.js";
+/** The production command registered in COMMANDS; its returned bytes are what the CLI prints. */
 export async function approve(argv, cwd = process.cwd()) {
-    const { runId, taskId, by, reason, uphold, recheck } = parseArgs(argv);
+    const { runId, taskId, by, reason, uphold, recheck, reviewRoundCeiling } = parseArgs(argv);
     if (uphold && recheck)
         throw new Error("--uphold and --recheck are different decisions — pass one");
-    // Journal.open throws `no journal for <runId> at <dir>` on an unknown run — that IS the refusal.
-    const journal = Journal.open(cwd, runId);
-    const status = journal.replayStatuses().get(taskId);
-    if (status === undefined) {
-        throw new Error(`task ${taskId} has no events in run ${runId} — unknown task or never dispatched`);
-    }
-    if (status !== "human") {
-        // a silent no-op would be worse than a loud refusal — name the actual status (D-05)
-        throw new Error(`task ${taskId} is ${status}, not a parked human gate — refusing (a silent no-op would be worse)`);
-    }
-    // OBS-18: only the most recent task-human for this task decides whether this approval grants a
-    // fresh attempt budget. The closed daemon-issued kind, never a human prose string, controls release.
-    const events = journal.read();
-    let lastHumanIndex = -1;
-    for (let i = events.length - 1; i >= 0; i--) {
-        if (events[i].event === "task-human" && events[i].taskId === taskId) {
-            lastHumanIndex = i;
-            break;
+    const serialization = await acquireApprovalSerialization(cwd, runId);
+    try {
+        // Journal.open throws `no journal for <runId> at <dir>` on an unknown run — that IS the refusal.
+        const journal = Journal.open(cwd, runId);
+        const status = journal.replayStatuses().get(taskId);
+        if (status === undefined) {
+            throw new Error(`task ${taskId} has no events in run ${runId} — unknown task or never dispatched`);
         }
-    }
-    const lastHuman = events[lastHumanIndex];
-    if (uphold) {
-        // Fail-closed on the DATA: uphold applies only when the newest failed gate is the review gate —
-        // any other gate has no reviewer to uphold. Never inferred from the park's prose.
-        const lastFailed = events.slice(0, lastHumanIndex).reverse().find((e) => e.event === "gate-result" && e.taskId === taskId && e.data.pass === false
-            && typeof e.data.gate === "string" && GATE_NAMES.includes(e.data.gate))?.data.gate;
-        if (lastFailed !== "review") {
-            throw new Error(`--uphold applies to a review rejection; ${taskId}'s last failed gate is ${lastFailed ?? "none"} — refusing`);
+        if (status !== "human") {
+            // a silent no-op would be worse than a loud refusal — name the actual status (D-05)
+            throw new Error(`task ${taskId} is ${status}, not a parked human gate — refusing (a silent no-op would be worse)`);
         }
-        journal.append("task-approved", taskId, {
-            by,
-            ...(reason ? { reason } : {}),
-            via: "cli",
-            release: REVIEW_UPHELD_RELEASE,
-            gate: "review",
-        });
-        return `upheld the reviewer for ${taskId} in ${runId} — by ${by}; run \`tickmarkr resume ${runId}\` to dispatch a fixed attempt carrying the findings`;
-    }
-    const capPark = lastHuman?.data.kind === ATTEMPT_CAP_RELEASE;
-    const gateFailPark = lastHuman?.data.kind === "gate-fail";
-    if (recheck) {
-        // OBS-203: fail-closed on the PARK KIND — only a gate-fail park has a gate to re-run. Refusing
-        // elsewhere keeps --recheck from becoming a silent budget reset on a pre-dispatch human gate.
-        if (!gateFailPark) {
-            throw new Error(`--recheck applies to a gate-fail park; ${taskId}'s park kind is ${lastHuman?.data.kind ?? "none"} — refusing`);
+        // OBS-18: only the most recent task-human for this task decides whether this approval grants a
+        // fresh attempt budget. The closed daemon-issued kind, never a human prose string, controls release.
+        const events = journal.read();
+        let lastHumanIndex = -1;
+        for (let i = events.length - 1; i >= 0; i--) {
+            if (events[i].event === "task-human" && events[i].taskId === taskId) {
+                lastHumanIndex = i;
+                break;
+            }
+        }
+        const lastHuman = events[lastHumanIndex];
+        if (uphold) {
+            // Fail-closed on the DATA: uphold applies only when the newest failed gate is the review gate —
+            // any other gate has no reviewer to uphold. Never inferred from the park's prose.
+            const lastFailed = events.slice(0, lastHumanIndex).reverse().find((e) => e.event === "gate-result" && e.taskId === taskId && e.data.pass === false
+                && typeof e.data.gate === "string" && GATE_NAMES.includes(e.data.gate))?.data.gate;
+            if (lastFailed !== "review") {
+                throw new Error(`--uphold applies to a review rejection; ${taskId}'s last failed gate is ${lastFailed ?? "none"} — refusing`);
+            }
+            journal.append("task-approved", taskId, {
+                by,
+                ...(reason ? { reason } : {}),
+                via: "cli",
+                release: REVIEW_UPHELD_RELEASE,
+                gate: "review",
+                ...(reviewRoundCeiling === undefined ? {} : { reviewRoundCeiling }),
+            });
+            return disposition(cwd, runId, `upheld the reviewer for ${taskId} in ${runId} — by ${by}; run \`tickmarkr resume ${runId}\` to dispatch a fixed attempt carrying the findings`, serialization.contended);
+        }
+        const capPark = lastHuman?.data.kind === ATTEMPT_CAP_RELEASE;
+        const gateFailPark = lastHuman?.data.kind === "gate-fail";
+        if (recheck) {
+            // OBS-203: fail-closed on the PARK KIND — only a gate-fail park has a gate to re-run. Refusing
+            // elsewhere keeps --recheck from becoming a silent budget reset on a pre-dispatch human gate.
+            if (!gateFailPark) {
+                throw new Error(`--recheck applies to a gate-fail park; ${taskId}'s park kind is ${lastHuman?.data.kind ?? "none"} — refusing`);
+            }
+            journal.append("task-approved", taskId, {
+                by,
+                ...(reason ? { reason } : {}),
+                via: "cli",
+                release: RECHECK_RELEASE,
+                ...(reviewRoundCeiling === undefined ? {} : { reviewRoundCeiling }),
+            });
+            return disposition(cwd, runId, `re-checking ${taskId} in ${runId} — by ${by}; no gate marked satisfied, run \`tickmarkr resume ${runId}\` to re-dispatch against the full gate suite`, serialization.contended);
+        }
+        const failedGate = gateFailPark
+            ? events.slice(0, lastHumanIndex).reverse().find((e) => e.event === "gate-result" && e.taskId === taskId && e.data.pass === false
+                && typeof e.data.gate === "string" && GATE_NAMES.includes(e.data.gate))?.data.gate
+            : undefined;
+        if (gateFailPark && !failedGate) {
+            throw new Error(`task ${taskId} is parked on gate-fail but has no failed gate result — refusing to infer one`);
         }
         journal.append("task-approved", taskId, {
             by,
             ...(reason ? { reason } : {}),
             via: "cli",
-            release: RECHECK_RELEASE,
+            ...(reviewRoundCeiling === undefined ? {} : { reviewRoundCeiling }),
+            ...(capPark ? { release: ATTEMPT_CAP_RELEASE } : {}),
+            ...(failedGate ? { release: GATE_SATISFIED_RELEASE, gate: failedGate } : {}),
         });
-        return `re-checking ${taskId} in ${runId} — by ${by}; no gate marked satisfied, run \`tickmarkr resume ${runId}\` to re-dispatch against the full gate suite`;
+        return disposition(cwd, runId, `approved ${taskId} in ${runId} — by ${by}; run \`tickmarkr resume ${runId}\` to ${failedGate ? "continue past the approved gate" : "dispatch it"}`, serialization.contended);
     }
-    const failedGate = gateFailPark
-        ? events.slice(0, lastHumanIndex).reverse().find((e) => e.event === "gate-result" && e.taskId === taskId && e.data.pass === false
-            && typeof e.data.gate === "string" && GATE_NAMES.includes(e.data.gate))?.data.gate
-        : undefined;
-    if (gateFailPark && !failedGate) {
-        throw new Error(`task ${taskId} is parked on gate-fail but has no failed gate result — refusing to infer one`);
+    finally {
+        serialization.release();
     }
-    journal.append("task-approved", taskId, {
-        by,
-        ...(reason ? { reason } : {}),
-        via: "cli",
-        ...(capPark ? { release: ATTEMPT_CAP_RELEASE } : {}),
-        ...(failedGate ? { release: GATE_SATISFIED_RELEASE, gate: failedGate } : {}),
-    });
-    return `approved ${taskId} in ${runId} — by ${by}; run \`tickmarkr resume ${runId}\` to ${failedGate ? "continue past the approved gate" : "dispatch it"}`;
 }
-const USAGE = "usage: tickmarkr approve <run-id> <task-id> [--uphold|--recheck] [--by <name>] [--reason <text>]";
-// hand-parsed argv — no CLI framework (house style). Flags --uphold, --by <name>, --reason <text>;
-// positionals are runId then taskId. Throws usage on missing positionals (mirrors resume.ts/unlock.ts).
+// The status is command OUTPUT, not a typed sibling result: the registered approve function returns
+// one primitive string and the dispatcher prints those bytes unchanged. A compact sentinel followed
+// by JSON makes the contract unambiguous to machines without widening the shared command result type.
+// No-lock approvals keep their historical one-line result for the cockpit; a dead recorded owner and
+// a command delayed behind terminalization both emit recorded-no-owner.
+function disposition(cwd, runId, message, contended) {
+    const owner = runLockOwner(cwd);
+    const resume = `tickmarkr resume ${runId}`;
+    if (!owner && !contended)
+        return message;
+    const status = owner?.live ? "deferred-live" : "recorded-no-owner";
+    const record = {
+        status,
+        resume,
+        ...(owner?.pid === undefined ? {} : { ownerPid: owner.pid }),
+        ...(owner?.runId === undefined ? {} : { ownerRunId: owner.runId }),
+    };
+    return `${message}\nTICKMARKR_APPROVAL ${JSON.stringify(record)}`;
+}
+const USAGE = "usage: tickmarkr approve <run-id> <task-id> [--uphold|--recheck] [--review-rounds <positive-integer>] [--by <name>] [--reason <text>]";
+// hand-parsed argv — no CLI framework (house style). Positionals are runId then taskId; decision,
+// ceiling, actor and reason are flags. Throws usage on missing positionals (mirrors resume.ts/unlock.ts).
 function parseArgs(argv) {
     const positionals = [];
     let by;
     let reason;
     let uphold = false;
     let recheck = false;
+    let reviewRoundCeiling;
     for (let i = 0; i < argv.length; i++) {
         const a = argv[i];
         if (a === "--by") {
@@ -122,6 +133,15 @@ function parseArgs(argv) {
         else if (a === "--recheck") {
             recheck = true;
         }
+        else if (a === "--review-rounds") {
+            const value = argv[++i];
+            if (value === undefined)
+                throw new Error(USAGE);
+            if (!/^[1-9]\d*$/.test(value) || !Number.isSafeInteger(Number(value))) {
+                throw new Error("--review-rounds must be a positive integer");
+            }
+            reviewRoundCeiling = Number(value);
+        }
         else {
             positionals.push(a);
         }
@@ -130,5 +150,5 @@ function parseArgs(argv) {
     if (!runId || !taskId) {
         throw new Error(USAGE);
     }
-    return { runId, taskId, by: by ?? userInfo().username, reason, uphold, recheck };
+    return { runId, taskId, by: by ?? userInfo().username, reason, uphold, recheck, reviewRoundCeiling };
 }

package/dist/cli/commands/compile.d.ts

@@ -1 +1 @@
-export declare function compile(argv: string[], cwd?: string): Promise<string>;
+export declare function compile(argv: string[], cwd?: string, harnessFrom?: string | undefined): Promise<string>;

package/dist/cli/commands/compile.js

@@ -1,28 +1,45 @@
 import { isAbsolute, join } from "node:path";
 import { parseArgs } from "node:util";
+import { collateralLints, sourceScopeLints } from "../../compile/collateral.js";
 import { compileSource } from "../../compile/index.js";
 import { saveGraph, stateDirName } from "../../graph/graph.js";
 import { acquireRunLock, releaseRunLock } from "../../run/lock.js";
-export async function compile(argv, cwd = process.cwd()) {
+import { harnessLine, resolveHarness } from "../harness.js";
+// v1.89 T4: harnessFrom is the resolver's INPUT (see plan.ts); the default is the INVOKED entrypoint
+// (`process.argv[1]`, the bin symlink), never this module's own url — that names an internal module.
+export async function compile(argv, cwd = process.cwd(), harnessFrom = process.argv[1]) {
     const { values, positionals } = parseArgs({
         args: argv,
-        options: { type: { type: "string" } },
+        options: {
+            type: { type: "string" },
+            "dry-run": { type: "boolean" },
+        },
         allowPositionals: true,
     });
     const src = positionals[0];
     if (!src)
-        throw new Error("usage: tickmarkr compile <spec-dir-or-md> [--type speckit|prd|gsd|native]");
+        throw new Error("usage: tickmarkr compile <spec-dir-or-md> [--type speckit|prd|gsd|native] [--dry-run]");
     // resolve against the target repo, not the process cwd (the CLI test passes a tmp repo)
+    // Both modes reach the same pure compiler; --dry-run only removes the lock/write side effect below.
     const g = compileSource(isAbsolute(src) ? src : join(cwd, src), values.type, cwd);
-    // HARD-01 / Sol #3: hold the same link(2) run lock as the daemon around saveGraph so compile
-    // cannot swap graph.json under an active run between the daemon's read and act.
     const stateDir = stateDirName(cwd);
-    acquireRunLock(cwd, "compile");
-    try {
-        saveGraph(cwd, g);
+    if (!values["dry-run"]) {
+        // HARD-01 / Sol #3: hold the same link(2) run lock as the daemon around saveGraph so compile
+        // cannot swap graph.json under an active run between the daemon's read and act.
+        acquireRunLock(cwd, "compile");
+        try {
+            saveGraph(cwd, g);
+        }
+        finally {
+            releaseRunLock(cwd);
+        }
     }
-    finally {
-        releaseRunLock(cwd);
-    }
-    return `compiled ${src} → ${stateDir}/graph.json (${g.tasks.length} tasks, source ${g.spec.source}, hash ${g.spec.hash.slice(0, 12)})`;
+    const summary = values["dry-run"]
+        ? `validated ${src} (${g.tasks.length} tasks, source ${g.spec.source}, hash ${g.spec.hash.slice(0, 12)}) — dry run; no graph written`
+        : `compiled ${src} → ${stateDir}/graph.json (${g.tasks.length} tasks, source ${g.spec.source}, hash ${g.spec.hash.slice(0, 12)})`;
+    const scopeLints = [...collateralLints(g.tasks, cwd), ...sourceScopeLints(g.tasks, cwd)];
+    const diagnostics = scopeLints.length
+        ? `\nscope lints:\n${scopeLints.map((lint) => `  ! ${lint}`).join("\n")}`
+        : "";
+    return `${harnessLine(resolveHarness(harnessFrom))}\n${summary}${diagnostics}`;
 }

package/dist/cli/commands/init.js

@@ -100,7 +100,7 @@ Outside multi-agent environments, run the loop directly.
 
 ### Version preflight
 
-Before \`tickmarkr compile\` or \`tickmarkr run\`: run \`tickmarkr version\`, read \`package.json\` version, and if the binary is older on major.minor, stop and tell the operator to update. Never proceed on hope — stale binaries silently skip daemon gates.
+Before \`tickmarkr compile\` or \`tickmarkr run\`: run \`tickmarkr version\`, read \`package.json\` version, and if the binary is older on major.minor, stop and tell the operator to update. Never proceed on hope — stale binaries silently skip daemon gates. Also verify no run is live before starting one: \`pgrep -f "tickmarkr (run|resume)"\` must be empty — match the process, not one install path (\`dist/cli/index.js\` alone misses global and homebrew installs), and treat a held \`.tickmarkr/graph.lock\` as a live run until its holder pid is proven dead.
 
 ### Tip-verify-before-green
 

package/dist/cli/commands/plan.d.ts

@@ -1,2 +1,2 @@
 import type { WorkerAdapter } from "../../adapters/types.js";
-export declare function plan(argv: string[], cwd?: string, adapters?: WorkerAdapter[]): Promise<string>;
+export declare function plan(argv: string[], cwd?: string, adapters?: WorkerAdapter[], harnessFrom?: string | undefined): Promise<string>;

package/dist/cli/commands/plan.js

@@ -11,6 +11,7 @@ import { staffLedEvidence } from "../../route/profile.js";
 import { route, RoutingError } from "../../route/router.js";
 import { modelId } from "../../gates/review.js";
 import { loadRoutingProfile } from "../../run/journal.js";
+import { harnessLine, resolveHarness } from "../harness.js";
 // T4 (v1.50): TTY-only brand pass — the title helper frames the routing table, lint/unroutable
 // markers carry the attention glyph, section labels dim to chrome (the doctor/status system).
 // Gated on ttyVisual(): the non-TTY surface returns untouched (byte-pinned, machine-consumable).
@@ -34,7 +35,12 @@ const fleetCanCrossVendorReview = (channels) => {
                 return true;
     return false;
 };
-export async function plan(argv, cwd = process.cwd(), adapters = allAdapters()) {
+// v1.89 T4: harnessFrom is the resolver's INPUT — a caller (the byte-pinned goldens) fixes the location
+// and keeps this machine's absolute paths out of a fixture. The default is the INVOKED entrypoint,
+// `process.argv[1]`: the bin symlink a global install puts on PATH, which resolves to dist/cli/index.js.
+// It is NOT `import.meta.url` — that names dist/cli/commands/plan.js, an internal module of the harness
+// rather than the harness that was invoked, so the banner would identify the wrong file entirely.
+export async function plan(argv, cwd = process.cwd(), adapters = allAdapters(), harnessFrom = process.argv[1]) {
     // ponytail: hardcoded 24h TTL — promote to config when an operator asks. mtime is the signal because
     // doctor.json has no probe timestamp and a schema field would break the existing-files compat invariant.
     const DOCTOR_STALE_MS = 24 * 60 * 60 * 1000;
@@ -62,9 +68,12 @@ export async function plan(argv, cwd = process.cwd(), adapters = allAdapters())
     let deviations = 0;
     // v1.51 T4: the mode is never invisible — the header names the resolved mode, its winning
     // source, and the explore posture; each task row carries a floor-derivation line below.
+    // v1.89 T4: the harness names itself ABOVE the routing table — the table is only as trustworthy as the
+    // binary that produced it, and version equality cannot tell an installed package from a checkout.
     const lines = [
         `tickmarkr plan — dry run (${channels.length} channels available)`,
         `mode: ${mode.mode} (${source}) · explore ${cfg.routing.explore?.mode ?? "on"}`,
+        harnessLine(resolveHarness(harnessFrom)),
         "",
     ];
     const derivation = (shape) => {
@@ -127,7 +136,17 @@ export async function plan(argv, cwd = process.cwd(), adapters = allAdapters())
     lints.push(...modelLints(cfg, health, adapters, { tty: ttyVisual() })); // health may be pre-v1.5/probeAll-fallback — no-detection branch covers both
     // v1.54 T3: dead-steering sweep — advisory only, renders with the routing lints, never alters routing.
     lints.push(...preferEntryLints(cfg, health, overlayPreferShapes(cwd)));
-    if (cfg.review.required && channels.length && !fleetCanCrossVendorReview(channels)) {
+    // The guard here was `channels.length && !fleetCanCrossVendorReview(channels)`, so the review lint went
+    // SILENT at zero channels — the first-run state, where review.required is set and nothing can route at all.
+    // Deleting that clause outright is worse than the silence: it fires "no cross-vendor reviewer pair in fleet"
+    // when there IS no fleet. An empty fleet and a single-vendor fleet are different faults with different
+    // repairs — install or auth ANY adapter vs. add a second VENDOR — so they are two lints, not one clause.
+    // The pair text stays byte-identical: tests/fixtures/brand-surfaces/plan-lints.txt pins it and this task
+    // does not own that fixture, so the pair lint keeps naming the waiver as the repair it can offer inline.
+    if (cfg.review.required && channels.length === 0) {
+        lints.push("review: review.required is set but no channel can route — the fleet is empty; install or authenticate an adapter");
+    }
+    else if (cfg.review.required && !fleetCanCrossVendorReview(channels)) {
         lints.push("review: no cross-vendor reviewer pair in fleet — set review.required: false to waive");
     }
     let cost = 0;

package/dist/cli/commands/report.js

@@ -9,6 +9,7 @@ import { compareRuns } from "../../report/compare.js";
 import { estimateCosts } from "../../report/cost.js";
 import { cellsOf, cellSummary } from "../../route/profile.js";
 import { Journal, loadRoutingProfile } from "../../run/journal.js";
+import { deriveRunCockpitData } from "../../tui/cockpit/derive.js";
 const n = (x) => x.toLocaleString("en-US"); // explicit locale — CI/darwin flake guard
 const EM = "—";
 // TokenUsage fields that are actually present — filtered, never coalesced to zero (absent ⇒ unmetered).
@@ -144,6 +145,53 @@ const outcomeFor = (events, taskId, runEnd) => {
     }
     return "not recorded";
 };
+const tipStatusItem = (runId, events) => {
+    try {
+        return deriveRunCockpitData({ fileName: runId, raw: events.map((e) => JSON.stringify(e)).join("\n") }, "", // binaryVersion — unread here; the tip-verify status item is all this asks for
+        { isDaemonAlive: () => false }).statusItems.find((item) => item.text.startsWith("tip-verify "));
+    }
+    catch {
+        // A capture the cockpit refuses (empty, or no run-start) verified nothing. Absent, never a pass.
+        return undefined;
+    }
+};
+/**
+ * The events the cockpit's verdict speaks for: a verification cycle ends at the `run-end` that
+ * closes it (derive.ts tipVerificationPassed slices to `lastRunEnd + 1`), so verify events a later
+ * resume appended belong to a cycle nothing has closed. Both readings below take THIS one slice, so
+ * the record can never name a cache that belongs to a cycle the state never judged.
+ */
+const closedCycle = (events) => {
+    for (let i = events.length - 1; i >= 0; i--) {
+        if (events[i].event === "run-end")
+            return events.slice(0, i + 1);
+    }
+    return events;
+};
+const verificationOf = (runId, events) => {
+    const cycle = closedCycle(events);
+    const tip = tipStatusItem(runId, cycle);
+    if (tip?.state === "fail")
+        return "failed";
+    if (tip?.state !== "pass")
+        return "absent";
+    // A cached green is a verified green of an EARLIER tip (daemon.ts verifyIntegrationTipCached
+    // stamps `cached` on every gate it replays), so the record names it instead of folding it into a
+    // plain pass. Still no second window: the cockpit reports "pass" only when the closed cycle
+    // carried verdicts, so the last `tip-verify` IN THAT CYCLE is the one it passed on.
+    const last = [...cycle].reverse().find((e) => e.event === "tip-verify");
+    return last?.data.cached === true ? "cached" : "passed";
+};
+// Absent is a state to render, never a zero to invent — and no reading here calls a run green.
+// NOTE: every reading below is byte-pinned by tests/fixtures/brand-surfaces/report-md.md — the
+// golden freezes the WHOLE markdown record, so changing a reading (or the line that renders it)
+// means regenerating that fixture in the same commit.
+const VERIFICATION_READING = {
+    passed: "passed — tickmarkr verified this run's integration tip",
+    cached: "cached — carried forward from an earlier verified tip, not re-run for this one",
+    failed: "FAILED — the run did not verify its own tip",
+    absent: "absent — no tip verification recorded: neither passed nor failed",
+};
 // VIS-07 / REC-01: derived only from the run journal, telemetry, and local configuration.
 export function renderMarkdownRecord(runId, events, prices = [], rows = []) {
     const runStart = events.find((e) => e.event === "run-start");
@@ -180,6 +228,7 @@ export function renderMarkdownRecord(runId, events, prices = [], rows = []) {
         `- **done:** ${count("done")}`,
         `- **failed:** ${count("failed")}`,
         `- **human:** ${count("human")}`,
+        `- **verification:** ${VERIFICATION_READING[verificationOf(runId, events)]}`,
         "",
         "## Usage & efficiency",
         "",

package/dist/cli/commands/resume.js

@@ -1,5 +1,6 @@
 import { loadConfig } from "../../config/config.js";
 import { pickDriver } from "../../drivers/index.js";
+import { loadGraph } from "../../graph/graph.js";
 import { formatSummary, runDaemon } from "../../run/daemon.js";
 import { formatJournalNarration } from "../../run/journal.js";
 import { denyPreferCollisionLine, denyPreferCollisions } from "../../route/preference.js";
@@ -15,7 +16,12 @@ export async function resume(argv, cwd = process.cwd()) {
     const graphChanged = argv.includes("--graph-changed");
     const retryFailed = argv.includes("--retry-failed");
     const cfg = loadConfig(cwd);
-    const collisions = denyPreferCollisions(cfg);
+    // v1.87 T3 (OBS-162, twice-carried workaround): the preflight runs AFTER the graph is read and
+    // sees only the shapes the resumed graph carries. A deny∩prefer collision on a shape no resumed
+    // task uses is a config fact the run would never resolve — it must not refuse the only
+    // crash-recovery path. doctor still walks the whole map.
+    const graph = loadGraph(cwd);
+    const collisions = denyPreferCollisions(cfg, graph.tasks.map((t) => t.shape));
     if (collisions.length) {
         throw new Error(collisions.map(denyPreferCollisionLine).join("; "));
     }