tickmarkr 1.86.0 → 1.89.0

package/dist/gates/review.js

@@ -9,6 +9,8 @@ import { redactSecrets } from "../run/redact.js";
 import { marginalCostRank } from "../route/router.js";
 import { appendAnchoredReview, COMPLETION_FAKING_CHECKLIST, extractVerdictJson, generateVerdictNonce, runLlm, verdictNonceLine } from "./llm.js";
 import { classifyVerdictCause } from "./verdict-cause.js";
+import { captureDiffCapFor, measureArtifactDiff, reviewableLogicDiff, } from "./artifact-manifest.js";
+export { isProtectedEvidence, PROTECTED_EVIDENCE_PREFIXES, REGENERABLE_CAPTURE_PATHS, setAsideReceiptPath, setAsideRegenerableCaptures, } from "./artifact-manifest.js";
 // legacy flat `issues` shape — every issue blocks; the approve flag must agree with the list.
 function classifyReviewIssues(approve, issues) {
     const inconsistencies = [];
@@ -69,149 +71,6 @@ function classifyReviewFindings(findings) {
 // OBS-48: cap on zero-context diff bytes (git diff -U0), not context-padded full diff — scattered
 // one-line hunks no longer trip at ~370 diff-bytes per changed line. Full diff still goes to the judge.
 const DIFF_CAP_REMEDY = "split the task, or raise gates.diffCap";
-// v1.82 T1 — the cap bounds what a READER MUST READ, not what a run must write. A regeneration of the
-// frame corpora is ~134KB of `-U0` measurement before a source line changes, and nobody reads it: those
-// frames are asserted byte-for-byte by the corpus tests. Counting them is the category error this
-// removes. The two artifacts stay two (OBS-48: the cap measures -U0, the reader receives the full diff);
-// the exclusion is applied to both, identically, right here so BOTH measuring gates inherit it.
-//
-// Clause 1 — membership is an EXACT PATH match against the shipped capture manifest, the same lists the
-// regeneration path itself uses. Location, directory depth and file extension confer nothing: an
-// unmanifested file sitting beside real frames is measured and shown in full. (The anchors deliberately
-// share basenames with the frames; only the full path separates the oracle from its regenerable twin.)
-//
-// The members are LISTED here rather than imported from the manifest module, for one measured reason:
-// that module is the Ink/React renderer, and importing it puts the whole TUI in every gate's module
-// graph — which also memoises chalk's colour level at import time and turns the fleet suite red. A
-// drift test in tests/gates/diff-cap.test.ts asserts this list is exactly GOLDEN_FRAME_CASES +
-// COLOUR_FRAME_CASES and that every entry exists on disk, so it is a copy that cannot drift rather
-// than a second source of truth: add or rename a frame case and that test goes red until this matches.
-export const REGENERABLE_CAPTURE_PATHS = [
-    "tests/fixtures/cockpit/frames/run.width-stacked.80x24.txt",
-    "tests/fixtures/cockpit/frames/run.width-folded-keys.100x24.txt",
-    "tests/fixtures/cockpit/frames/run.width-three-column.140x24.txt",
-    "tests/fixtures/cockpit/frames/run.height-14.140x14.txt",
-    "tests/fixtures/cockpit/frames/run.height-18.140x18.txt",
-    "tests/fixtures/cockpit/frames/run.height-24.140x24.txt",
-    "tests/fixtures/cockpit/frames/run.height-40.140x40.txt",
-    "tests/fixtures/cockpit/frames/run.no-colour.140x24.txt",
-    "tests/fixtures/cockpit/frames/run.non-tty.140x24.txt",
-    "tests/fixtures/cockpit/frames/run.ci.140x24.txt",
-    "tests/fixtures/cockpit/frames/setup.width-stacked.80x24.txt",
-    "tests/fixtures/cockpit/frames/setup.width-folded-keys.100x24.txt",
-    "tests/fixtures/cockpit/frames/setup.width-three-column.140x24.txt",
-    "tests/fixtures/cockpit/frames/setup.height-14.140x14.txt",
-    "tests/fixtures/cockpit/frames/setup.height-18.140x18.txt",
-    "tests/fixtures/cockpit/frames/setup.height-24.140x24.txt",
-    "tests/fixtures/cockpit/frames/setup.height-40.140x40.txt",
-    "tests/fixtures/cockpit/frames/setup.no-colour.140x24.txt",
-    "tests/fixtures/cockpit/frames/setup.non-tty.140x24.txt",
-    "tests/fixtures/cockpit/frames/setup.ci.140x24.txt",
-    "tests/fixtures/cockpit/colour/run-20260718-000943.colour.140x24.txt",
-    "tests/fixtures/cockpit/colour/run-20260718-000943.no-colour.140x24.txt",
-    "tests/fixtures/cockpit/colour/run-20260725-025004.interrupted.colour.140x24.txt",
-];
-const CAPTURE_MANIFEST = new Set(REGENERABLE_CAPTURE_PATHS);
-// Clause 2 — the frozen appearance anchors and the captured engagement journals are NEVER set aside and
-// are exempt from every other reduction too (clause 5): they are reviewed, immutable evidence. The
-// anchors are the oracle this milestone declares, and the fixture law bans editing a captured journal to
-// satisfy an assertion — so both keep counting toward the cap and keep reaching a reader verbatim.
-export const PROTECTED_EVIDENCE_PREFIXES = [
-    "tests/fixtures/cockpit/anchors/",
-    "tests/fixtures/cockpit/sources/",
-    "tests/fixtures/cockpit/colour/sources/",
-];
-export function isProtectedEvidence(path) {
-    return PROTECTED_EVIDENCE_PREFIXES.some((prefix) => path.startsWith(prefix));
-}
-const SET_ASIDE_RECEIPT = /^set aside: regenerable capture (.+?) — \d+ bytes withheld\b/m;
-/** The `{path}` a set-aside receipt names, or null if this section carries no receipt. */
-export function setAsideReceiptPath(section) {
-    return SET_ASIDE_RECEIPT.exec(section)?.[1] ?? null;
-}
-// `--- a/x` / `+++ b/x` → "x"; "/dev/null" → null, which is the ABSENCE of a side, not a membership
-// failure (clause 3). git quotes paths carrying specials, so unquote before stripping the a/ b/ prefix.
-function diffSidePath(raw) {
-    const v = raw.trim();
-    if (v === "/dev/null")
-        return null;
-    const unquoted = v.startsWith('"') && v.endsWith('"') ? v.slice(1, -1) : v;
-    return unquoted.replace(/^[ab]\//, "");
-}
-// The `--- a/x` / `+++ b/x` header pair and the hunk lines below it. Clause 4 — null when the section
-// carries NO content hunk at all (a mode-only change, a pure rename, a binary marker): such a section is
-// left exactly as git wrote it rather than handed a manufactured receipt.
-function parseSection(section) {
-    const lines = section.split("\n");
-    const minus = lines.findIndex((l) => l.startsWith("--- "));
-    if (minus === -1 || !lines[minus + 1]?.startsWith("+++ "))
-        return null;
-    const body = lines.slice(minus + 2);
-    if (!body.some((l) => l.startsWith("@@ ")))
-        return null;
-    return { lines, minus, sides: [diffSidePath(lines[minus].slice(4)), diffSidePath(lines[minus + 1].slice(4))], body };
-}
-// The content a one-sided section carries: its hunk lines with the sign stripped, keeping git's
-// `` markers so a trailing-newline difference still reads as a content
-// difference. Hunk headers are dropped — a delete and an add of the same bytes never share them.
-function hunkPayload(body, sign) {
-    return body.filter((l) => l.startsWith(sign) || l.startsWith("\\")).map((l) => (l[0] === sign ? l.slice(1) : l)).join("\n");
-}
-// Clause 4 — a hunk is NOT proof of a content change. Git spells a KIND change (regular file ⇄ symlink)
-// as a delete plus an add of the SAME path, each carrying a hunk, so when the regular file's bytes are
-// exactly the link target both halves carry identical payloads: the kind changed and the content did
-// not. Nothing was withheld, so neither half earns a receipt — and neither half can see the other, so
-// the pairing is found across sections before any one of them is set aside.
-function kindOnlyPaths(sections) {
-    const removed = new Map();
-    const added = new Map();
-    for (const section of sections) {
-        const parsed = parseSection(section);
-        if (!parsed)
-            continue;
-        const [a, b] = parsed.sides;
-        if (a && !b)
-            removed.set(a, hunkPayload(parsed.body, "-"));
-        else if (b && !a)
-            added.set(b, hunkPayload(parsed.body, "+"));
-    }
-    return new Set([...removed].filter(([path, payload]) => added.get(path) === payload).map(([path]) => path));
-}
-function setAsideSection(section, kindOnly) {
-    const parsed = parseSection(section);
-    if (!parsed)
-        return section;
-    const { lines, minus, sides } = parsed;
-    // Clause 3 — the test is over the sides that name a real file. Requiring BOTH sides to be members
-    // makes every corpus addition (a-side /dev/null) and deletion (b-side /dev/null) ineligible, which is
-    // exactly the frames this milestone adds. A rename crossing the boundary in either direction has two
-    // real sides and one of them is not a member, so it stays whole — `rename from` line included.
-    const named = sides.filter((p) => p !== null);
-    if (!named.length || !named.every((p) => CAPTURE_MANIFEST.has(p)))
-        return section;
-    // Clause 4 — both halves of a content-identical kind change are left exactly as git wrote them. A
-    // kind change that DID move bytes is an ordinary content change and is set aside like any other.
-    if (named.some((p) => kindOnly.has(p)))
-        return section;
-    const withheld = lines.slice(minus).join("\n");
-    // Clause 6 — the claimed size is the UTF-8 BYTE length of what was withheld (the file headers and
-    // hunks this receipt replaces), never a JavaScript string length: box-drawing frames make the two
-    // disagree. And the receipt itself is part of the measured artifact, so N set-aside sections can never
-    // measure as nothing while producing an arbitrarily large reader payload.
-    const receipt = `set aside: regenerable capture ${named.at(-1)} — ${Buffer.byteLength(withheld, "utf8")} bytes withheld (regenerable frame corpus: asserted byte-for-byte by the corpus tests, never read)`;
-    // Clause 4 — everything git said happened survives verbatim: old/new mode, new file mode, deleted file
-    // mode, similarity index, rename from/to, index. Only content is replaced, so a deletion is never
-    // presented as a file that still exists and an addition is never presented as a modification.
-    return `${lines.slice(0, minus).join("\n")}\n${receipt}\n`;
-}
-/** Replace the content of every section confined to the regenerable frame corpora with a receipt. */
-export function setAsideRegenerableCaptures(diff) {
-    if (!diff.includes("diff --git "))
-        return diff;
-    const sections = diff.split(/(?=^diff --git )/m);
-    const kindOnly = kindOnlyPaths(sections);
-    return sections.map((s) => setAsideSection(s, kindOnly)).join("");
-}
 /**
  * The paths this task's diff ACTUALLY touched. `-z` so a path carrying spaces or non-ASCII bytes is
  * never mangled by git's quoting, `--no-renames` so a rename reports BOTH sides: a file renamed OUT of
@@ -232,7 +91,7 @@ const VERSION_FIELD_LINE_RE = /^[+-]\s*"version":\s*"[^"]*",?\s*$/;
 export async function mirrorsVersionOnly(worktree, baseRef, path) {
     let diff;
     try {
-        diff = await shOk(`git diff -U0 '${baseRef}..HEAD' -- ${shq(path)}`, worktree);
+        diff = await shOk(`git diff --full-index -U0 '${baseRef}..HEAD' -- ${shq(path)}`, worktree);
     }
     catch {
         return false;
@@ -241,9 +100,23 @@ export async function mirrorsVersionOnly(worktree, baseRef, path) {
     return changed.length > 0 && changed.every((l) => VERSION_FIELD_LINE_RE.test(l));
 }
 export async function fetchTaskDiff(worktree, baseRef) {
-    const full = setAsideRegenerableCaptures(await shOk(`git diff '${baseRef}..HEAD'`, worktree));
-    const forCap = setAsideRegenerableCaptures(await shOk(`git diff -U0 '${baseRef}..HEAD'`, worktree));
-    return { full, forCap };
+    // --full-index: abbreviated index lines vary with object-store density, so two measurements of
+    // the same diff could disagree by a few bytes between invocations (CI-only red, release 1.89.0).
+    const [rawFull, rawForCap] = await Promise.all([
+        shOk(`git diff --full-index '${baseRef}..HEAD'`, worktree),
+        shOk(`git diff --full-index -U0 '${baseRef}..HEAD'`, worktree),
+    ]);
+    const fullMeasurement = measureArtifactDiff(rawFull);
+    const capMeasurement = measureArtifactDiff(rawForCap);
+    return {
+        full: fullMeasurement.rendered,
+        forCap: capMeasurement.rendered,
+        logicBytes: Buffer.byteLength(reviewableLogicDiff(capMeasurement.rendered), "utf8"),
+        captureBytes: capMeasurement.captureBytes,
+        classifications: capMeasurement.sections,
+        fullMeasurement,
+        capMeasurement,
+    };
 }
 export function checkDiffCap(gate, measured, cap, prefix = "") {
     if (measured <= cap)
@@ -256,8 +129,26 @@ export function checkDiffCap(gate, measured, cap, prefix = "") {
         meta: { park: "human" },
     };
 }
+/** Apply the strict reviewable-logic cap and the finite, larger capture cap independently. */
+export function checkTaskDiffCaps(gate, measured, logicCap, prefix = "") {
+    const logicFail = checkDiffCap(gate, measured.logicBytes, logicCap, prefix);
+    if (logicFail)
+        return logicFail;
+    const captureCap = captureDiffCapFor(logicCap);
+    if (measured.captureBytes <= captureCap)
+        return null;
+    return {
+        gate,
+        pass: false,
+        details: prefix
+            + `captured artifact diff exceeds verifiable capture cap (${measured.captureBytes} > ${captureCap}) — ${DIFF_CAP_REMEDY}`,
+        meta: { park: "human" },
+    };
+}
 export function isDiffCapPark(result) {
-    return result.pass === false && result.meta?.park === "human" && /diff exceeds verifiable cap/i.test(result.details);
+    return result.pass === false
+        && result.meta?.park === "human"
+        && /diff exceeds verifiable (?:capture )?cap/i.test(result.details);
 }
 // ponytail: single policy hook for callers after runGates — skips the escalation ladder on diff-cap trips.
 export function diffCapParkReason(results) {
@@ -374,9 +265,12 @@ artifactDir) {
             ? { gate: "review", pass: false, details: "no cross-vendor reviewer available (diversity rule); set review.required:false to waive", meta: { noEligibleReviewer: true } }
             : { gate: "review", pass: true, details: "WARNING: no cross-vendor reviewer available — review waived by config", meta: { noEligibleReviewer: true } };
     }
-    const { full: diff, forCap } = await fetchTaskDiff(worktree, baseRef);
+    const measuredDiff = await fetchTaskDiff(worktree, baseRef);
+    // Keep the reader payload identical to the text charged to the strict cap:
+    // whole-file source deletions are represented by their citable operation fact.
+    const diff = reviewableLogicDiff(measuredDiff.full);
     const diffCap = cfg.gates.diffCap ?? DEFAULT_DIFF_CAP;
-    const capFail = checkDiffCap("review", forCap.length, diffCap);
+    const capFail = checkTaskDiffCaps("review", measuredDiff, diffCap);
     if (capFail)
         return capFail;
     const nonce = generateVerdictNonce();

package/dist/gates/run-gates.d.ts

@@ -23,6 +23,7 @@ export interface GateContext {
     commands: Record<string, string>;
     baseline: Baseline;
     channels: BillingChannel[];
+    judgeChannels?: BillingChannel[];
     adapters: WorkerAdapter[];
     cfg: TickmarkrConfig;
     via?: GateVia;

package/dist/gates/run-gates.js

@@ -8,6 +8,7 @@ import { acceptanceGate } from "./acceptance.js";
 import { compareToBaseline } from "./baseline.js";
 import { evidenceGate } from "./evidence.js";
 import { captureLlmOutput } from "./llm.js";
+import { disallowedBy } from "../route/preference.js";
 import { marginalCostRank } from "../route/router.js";
 import { reviewGate } from "./review.js";
 import { scopeGate } from "./scope.js";
@@ -142,12 +143,76 @@ export async function runGates(task, ctx) {
             heldTest = undefined;
             await ctx.onGate?.({ phase: "end", gate: "test", result: held });
         }
-        return {
-            results: [...results].sort((a, b) => GATE_NAMES.indexOf(a.gate) - GATE_NAMES.indexOf(b.gate)),
-            commits,
-        };
+        const sorted = [...results].sort((a, b) => GATE_NAMES.indexOf(a.gate) - GATE_NAMES.indexOf(b.gate));
+        // v1.87 T5: no round returns a MERGEABLE GREEN on a dirty tree. The battery is not the only gate
+        // that executes shell in this worktree — the acceptance gate runs command and named-test oracles
+        // (acceptance.ts:264,275) and both verdict gates dispatch a vendor CLI here — so the last word on
+        // cleanliness has to be the round's last act rather than the battery's. `results` is what the
+        // daemon merges on (daemon.ts `results.every(gateSatisfied)`), so the withdrawal lands there; the
+        // journal keeps both the green and its retraction, the honest record of a verdict that did not
+        // survive its own round.
+        const last = sorted[sorted.length - 1];
+        if (last && sorted.every((r) => r.pass || r.meta?.skipped === true)) {
+            const dirt = await dirtyWorktree();
+            if (dirt) {
+                const refusal = dirtyRoundRefusal(last.gate, dirt);
+                results[results.indexOf(last)] = refusal;
+                sorted[sorted.length - 1] = refusal;
+                await ctx.onGate?.({ phase: "end", gate: refusal.gate, result: refusal });
+            }
+        }
+        return { results: sorted, commits };
     };
     const toolGates = ["build", "test", "lint"].filter(enabled);
+    /**
+     * v1.87 T5: the shell gates run their commands against the WORKING TREE, while evidence, scope,
+     * the judged diff and the merge all read COMMITS. Uncommitted work is therefore visible to
+     * build/test/lint and invisible to everything that decides what ships — a green battery on a dirty
+     * tree certifies a tree nobody will ever merge, and the committed diff it stands for was never run.
+     *
+     * That is not gatable-with-a-caveat, so the battery refuses it rather than gating it and hoping.
+     * An unreadable `git status` is refused on the same rule: a tree that cannot be proven clean is not
+     * proven clean. Returns the dirt (porcelain lines) to name in the refusal, or undefined when clean.
+     *
+     * The one exemption is tickmarkr's OWN droppings — root-level `.tickmarkr-*` (the adapters' usage
+     * record). The harness wrote those, not the worker; they are not work anyone meant to merge, and
+     * refusing a tree for the harness's own litter would fail every metered run. Nothing else is
+     * exempt: an untracked source file is uncommitted work by every reading git offers.
+     */
+    const dirtyWorktree = async () => {
+        const r = await shGit("GIT_OPTIONAL_LOCKS=0 git status --porcelain", ctx.worktree);
+        if (r.code !== 0)
+            return `git status failed (exit ${r.code}) — the worktree cannot be proven clean`;
+        const entries = r.stdout
+            .split("\n")
+            .map((l) => l.trimEnd())
+            .filter((l) => l.trim() && !/^.. \.tickmarkr-[^/]*$/.test(l));
+        return entries.length ? entries.join("\n") : undefined;
+    };
+    const DIRTY_WHY = `refusing to gate a dirty worktree: the shell gates run against the working tree while `
+        + `evidence, scope and the merge read commits, so these uncommitted changes would be gated `
+        + `and never merged (and the committed diff would never be run)`;
+    // `left` names the command that CREATED the dirt when one did; a round-entry refusal has no culprit.
+    const dirtyRefusal = (gate, dirt, left) => ({
+        gate,
+        pass: false,
+        details: DIRTY_WHY
+            + (left ? `. The ${gate} command (${left}) left them behind, so every gate after it would judge a tree nobody will merge:\n` : `:\n`)
+            + dirt,
+        meta: { dirtyWorktree: true, ...(left ? { dirtiedBy: gate } : {}) },
+    });
+    // The round-end withdrawal (see `done`). It blames no command: whatever dirtied the tree ran after
+    // the last cleanliness check, and naming a culprit this function cannot identify would be a worse
+    // record than naming the fact. `gate` is the verdict being withdrawn, not an accusation about who wrote.
+    const dirtyRoundRefusal = (gate, dirt) => ({
+        gate,
+        pass: false,
+        details: `${DIRTY_WHY}. Every gate of this round was satisfied and the round ended dirty — something after `
+            + `the last cleanliness check (the acceptance gate's command/test oracles, or a verdict gate's `
+            + `vendor CLI) wrote into the worktree — so this mergeable result is withdrawn rather than merged. `
+            + `Uncommitted at round end:\n${dirt}`,
+        meta: { dirtyWorktree: true, dirtyAtRoundEnd: true },
+    });
     // build/test/lint vs the shared baseline
     const runBattery = async (commands, selected) => {
         if (!toolGates.length)
@@ -157,9 +222,15 @@ export async function runGates(task, ctx) {
             // not at true execution start. They are collectively sub-second (measured), so the debounce
             // suppresses them anyway; split compareToBaseline only if a tool gate ever gets slow.
             const toolResults = await compareToBaseline(ctx.worktree, commands, ctx.baseline, toolGates);
+            // The same refusal AFTER the commands, because a green command can dirty the tree the check
+            // above just proved clean. Batched, legacy cannot say WHICH command did it, so the refusal
+            // lands on the last gate that had one — the round dies there either way. A red battery is
+            // reported as the red it is: the round already ends, and the command output is the better lead.
+            const dirt = toolResults.every((r) => r.pass) ? await dirtyWorktree() : undefined;
+            const blame = dirt ? [...toolGates].reverse().find((g) => commands[g]) : undefined;
             for (const r of toolResults) {
                 await emitStart(r.gate);
-                await record(r);
+                await record(r.gate === blame ? dirtyRefusal(blame, dirt, commands[blame]) : r);
             }
             return;
         }
@@ -168,6 +239,18 @@ export async function runGates(task, ctx) {
         for (const g of toolGates) {
             await emitStart(g);
             const [r] = await compareToBaseline(ctx.worktree, commands, ctx.baseline, [g]);
+            // The pre-battery check proves the tree clean ONCE; a command that exits 0 having rewritten a
+            // tracked file makes it dirty again, and every gate after it — including the next shell gate,
+            // which would then run against bytes HEAD does not hold — inherits that. So re-check after each
+            // command, the last one included, and fail the gate whose command did it. (A red command needs
+            // no check: it already ends the round, and its own output is the truer verdict.)
+            if (r.pass && commands[g]) {
+                const dirt = await dirtyWorktree();
+                if (dirt) {
+                    await record(dirtyRefusal(g, dirt, commands[g]));
+                    return;
+                }
+            }
             if (g === "test" && selected) {
                 const screened = { ...r, meta: { ...r.meta, selectedTests: selected } };
                 // green: held (see heldTest) so the full suite below can supersede it with ONE verdict.
@@ -193,7 +276,23 @@ export async function runGates(task, ctx) {
         commits = e.commits;
         return { gate: e.gate, pass: e.pass, details: e.details };
     };
-    const scopeResult = () => scopeGate(ctx.worktree, ctx.baseRef, task.files, ctx.result, ctx.cfg.scope?.allowDeviations ?? []);
+    /**
+     * v1.87 T5: the allowlist is read ONCE — at entry, before any gate of this round runs — copied out
+     * of `ctx.cfg` and frozen. Both halves are the enforcement: the copy means a later write to the
+     * daemon's live config object cannot reach the gate mid-round (the screen at line ~296 and the
+     * canonical scope gate below are two separate reads of it), and the freeze means nothing this file
+     * hands to `scopeGate` can be widened in flight either. Nothing anywhere writes it back.
+     *
+     * The boundary, stated rather than implied: this binds the allowlist for the lifetime of a round,
+     * which is the largest unit this function owns. It cannot speak for a `tickmarkr resume`, which is
+     * a new process whose config the daemon resolves afresh (src/run/daemon.ts) — binding an allowlist
+     * across a restart would have to live there, is outside this task's file scope, and is claimed
+     * neither here nor in the worker prompt. What the prompt does claim is what holds: a WORKER has no
+     * way to change this list, mid-round or otherwise.
+     */
+    const allowDeviations = [...(ctx.cfg.scope?.allowDeviations ?? [])];
+    Object.freeze(allowDeviations);
+    const scopeResult = () => scopeGate(ctx.worktree, ctx.baseRef, task.files, ctx.result, allowDeviations);
     const runGate = async (gate, compute) => {
         await emitStart(gate);
         await record(await compute());
@@ -233,6 +332,21 @@ export async function runGates(task, ctx) {
     };
     // acceptance judge — LLM spend, so everything deterministic has already passed when this runs
     const runAcceptance = async () => {
+        // v1.87 T2: the judge is a configured seat like any other — check it against the operator's
+        // policy BEFORE spending a dispatch on it. disallowedBy carries the whole deny grammar (adapter,
+        // model, or adapter:model), so a model-scoped deny cannot slip past an adapter-id-only read.
+        const judgeDenied = disallowedBy({ adapter: ctx.cfg.judge.adapter, model: ctx.cfg.judge.model }, ctx.cfg.routing, "judge");
+        if (judgeDenied) {
+            return {
+                result: {
+                    gate: "acceptance",
+                    pass: false,
+                    details: `judge ${channelKey({ adapter: ctx.cfg.judge.adapter, model: ctx.cfg.judge.model })} is disallowed by routing.${judgeDenied.by} (${judgeDenied.entry}) — remove the ${judgeDenied.by} entry or re-point cfg.judge at an allowed channel`,
+                    meta: { judgeDisallowed: { by: judgeDenied.by, entry: judgeDenied.entry } },
+                },
+                invocations: [],
+            };
+        }
         const judgeAdapter = getAdapter(ctx.cfg.judge.adapter, ctx.adapters);
         const jvia = ctx.via
             ? { driver: ctx.via.driver, keep: ctx.via.keep, onSlot: ctx.via.onSlot, name: ctx.via.nameFor("judge", judgeAdapter.id), label: ctx.via.labelFor("judge") }
@@ -280,8 +394,11 @@ export async function runGates(task, ctx) {
                 // pickReviewer's sort (review.ts:37): TIER_RANK desc, marginalCostRank asc — proven ordering; both
                 // symbols already imported by a sibling gate file.
                 .sort((x, y) => TIER_RANK[y.tier] - TIER_RANK[x.tier] || marginalCostRank(x) - marginalCostRank(y))[0];
-            const crossAdapter = pick(ctx.channels.filter((c) => c.adapter !== flakedAdapter));
-            const sameAdapter = pick(ctx.channels.filter((c) => c.adapter === flakedAdapter && channelKey(c) !== flakedKey));
+            // v1.87 T2: the failover seat obeys the same policy the primary judge just passed — a denied
+            // channel is refused here too, never reached by falling through the exclusion arms below.
+            const judgePool = (ctx.judgeChannels ?? ctx.channels).filter((c) => disallowedBy(c, ctx.cfg.routing, "judge") === null);
+            const crossAdapter = pick(judgePool.filter((c) => c.adapter !== flakedAdapter));
+            const sameAdapter = pick(judgePool.filter((c) => c.adapter === flakedAdapter && channelKey(c) !== flakedKey));
             // Prefer a different adapter; if the fleet only has one adapter, retry on a different channel of
             // that adapter; if the fleet has only one channel, fall back to the original judge config.
             const retry = crossAdapter ?? sameAdapter ?? { adapter: ctx.cfg.judge.adapter, model: ctx.cfg.judge.model };
@@ -318,6 +435,19 @@ export async function runGates(task, ctx) {
         }
         return rv;
     };
+    // v1.87 T5: the refusal is the FIRST thing a round does, whatever that round is configured to run.
+    // Guarding only the configured build/test/lint commands left the hole this repairs: the battery is
+    // not the only gate that executes shell in this worktree — the acceptance gate runs command and
+    // named-test oracles — so a task with NO tool command configured skipped the check entirely and its
+    // oracles judged uncommitted state, on a commit whose diff nobody had run. One check at the top, and
+    // no shell-executing gate path is reachable on a dirty tree. It lands on the first gate of this
+    // round's sequence: the round dies there, exactly as it does on a red command.
+    const entryDirt = sequence.length ? await dirtyWorktree() : undefined;
+    if (entryDirt) {
+        await emitStart(sequence[0]);
+        await record(dirtyRefusal(sequence[0], entryDirt));
+        return done();
+    }
     if (v185 && await screenBlocks())
         return done();
     // A non-final round may run only the tests covering its own diff; the merge-candidate round below
@@ -385,8 +515,14 @@ export async function runGates(task, ctx) {
     // stream, and `fullSuite` says which suite spoke while `selectedTests` keeps what the screen ran.
     if (selected) {
         await emitStart("test");
+        // This is the last shell command a round can run — the judge's named-test oracle (acceptance.ts)
+        // may have run one before it, and every gate between the battery and here reads commits only, so
+        // a clean tree HERE is what makes "the gated commit is the tested tree" true at merge time.
         const [full] = await compareToBaseline(ctx.worktree, ctx.commands, ctx.baseline, ["test"]);
-        const merged = { ...full, meta: { ...full.meta, fullSuite: true, selectedTests: selected } };
+        const dirt = full.pass ? await dirtyWorktree() : undefined;
+        const merged = dirt
+            ? dirtyRefusal("test", dirt, ctx.commands.test)
+            : { ...full, meta: { ...full.meta, fullSuite: true, selectedTests: selected } };
         results[results.findIndex((r) => r.gate === "test")] = merged;
         heldTest = undefined;
         await ctx.onGate?.({ phase: "end", gate: "test", result: merged });

package/dist/graph/schema.d.ts

@@ -4,11 +4,13 @@ export declare const GRAPH_ROUTING_MODES: readonly ["partner-led", "risk-based",
 export declare const STATUSES: readonly ["pending", "running", "gated", "failed", "done", "human"];
 export declare const GATE_NAMES: readonly ["build", "test", "lint", "evidence", "scope", "acceptance", "review"];
 export declare const TIERS: readonly ["cheap", "mid", "frontier"];
+export declare const SPEC_SOURCES: readonly ["speckit", "gsd", "prd", "native"];
 export declare const ORACLES: readonly ["command", "test", "judge"];
 export type Shape = (typeof SHAPES)[number];
 export type TaskStatus = (typeof STATUSES)[number];
 export type GateName = (typeof GATE_NAMES)[number];
 export type Oracle = (typeof ORACLES)[number];
+export type SpecSource = (typeof SPEC_SOURCES)[number];
 export declare const AcceptanceItemSchema: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
     oracle: z.ZodLiteral<"command">;
     command: z.ZodString;
@@ -110,10 +112,10 @@ export declare const RunGraphSchema: z.ZodObject<{
             gsd: "gsd";
             prd: "prd";
             native: "native";
-            taskmaster: "taskmaster";
         }>;
         paths: z.ZodArray<z.ZodString>;
         hash: z.ZodString;
+        base: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>;
     tasks: z.ZodArray<z.ZodObject<{
         id: z.ZodString;

package/dist/graph/schema.js

@@ -7,6 +7,7 @@ export const STATUSES = ["pending", "running", "gated", "failed", "done", "human
 export const GATE_NAMES = ["build", "test", "lint", "evidence", "scope", "acceptance", "review"];
 const MANDATORY_GATES = ["build", "test", "lint", "evidence", "scope"];
 export const TIERS = ["cheap", "mid", "frontier"];
+export const SPEC_SOURCES = ["speckit", "gsd", "prd", "native"];
 // v1.19 acceptance oracles: command (exit code), test (named test), judge (LLM, free-text rubric).
 // A plain string is the read-old/write-new compat form — semantically a judge oracle (spec §2).
 export const ORACLES = ["command", "test", "judge"];
@@ -98,9 +99,11 @@ export const RunGraphSchema = z
     // precedence: run flag > this > repo config > global config > default (risk-based).
     mode: z.enum(GRAPH_ROUTING_MODES).optional(),
     spec: z.object({
-        source: z.enum(["speckit", "gsd", "prd", "native", "taskmaster"]),
+        source: z.enum(SPEC_SOURCES),
         paths: z.array(z.string()),
         hash: z.string(),
+        // Q11 compile half: an author-declared ref only. Runtime Git resolution/enforcement is later.
+        base: z.string().min(1).optional(),
     }),
     tasks: z.array(TaskSchema).min(1),
 })

package/dist/route/preference.d.ts

@@ -33,5 +33,5 @@ export interface DenyPreferCollision {
     disallowed: Disallowed;
 }
 export declare function preferEntryDenied(p: string, cfg: TickmarkrConfig): Disallowed | null;
-export declare function denyPreferCollisions(cfg: TickmarkrConfig): DenyPreferCollision[];
+export declare function denyPreferCollisions(cfg: TickmarkrConfig, shapes?: Iterable<string>): DenyPreferCollision[];
 export declare function denyPreferCollisionLine({ kind, shape, detail, disallowed }: DenyPreferCollision): string;

package/dist/route/preference.js

@@ -81,11 +81,18 @@ export function preferEntryDenied(p, cfg) {
         throw e;
     }
 }
-export function denyPreferCollisions(cfg) {
+// v1.87 T3 (OBS-162): graph-aware walk. `shapes` narrows it to the shapes the caller will actually
+// route — resume hands it the loaded graph's shape set, so a collision on a shape no resumed task
+// uses can no longer refuse the only crash-recovery path. Omitted ⇒ the whole routing map: doctor
+// audits the config itself, which has no graph to be scoped by.
+export function denyPreferCollisions(cfg, shapes) {
     if (!cfg.routing.allow && !cfg.routing.deny)
         return [];
+    const inGraph = shapes === undefined ? undefined : new Set(shapes);
     const out = [];
     for (const [shape, entry] of Object.entries(cfg.routing.map)) {
+        if (inGraph && !inGraph.has(shape))
+            continue;
         if (entry.pin) {
             const d = disallowedBy({ adapter: entry.pin.via, model: entry.pin.model }, cfg.routing);
             if (d) {

package/dist/run/consult.js

@@ -4,6 +4,7 @@ import { getAdapter } from "../adapters/registry.js";
 import { bannerShell, paneDispatchCommand } from "../brand.js";
 import { extractVerdictJson, gateExitTrailer, gatePaneName, generateVerdictNonce, verdictNonceLine } from "../gates/llm.js";
 import { classifyVerdictCause } from "../gates/verdict-cause.js";
+import { disallowedBy } from "../route/preference.js";
 import { sh } from "./git.js";
 import { redactSecrets } from "./redact.js";
 import { filterLlmTranscript } from "./stall.js";
@@ -184,7 +185,19 @@ opts = {}) {
         .map((entry) => ({ adapter: entry.slice(0, entry.indexOf(":")), model: entry.slice(entry.indexOf(":") + 1) }))
         .filter((s) => live.has(s.adapter));
     seats.push({ adapter: cfg.consult.adapter, model: cfg.consult.model });
-    for (const [i, seat] of seats.entries()) {
+    // v1.87 T2: a consult seat reads the code, so it passes through the operator's policy exactly like
+    // a worker does. The filter runs AFTER the pin is pushed, so the final pinned seat is checked by
+    // the same rule as every prefer entry — and disallowedBy carries the full deny grammar (adapter,
+    // model, or adapter:model), so a model-scoped deny cannot slip past an adapter-id-only read.
+    const allowedSeats = seats.filter((s) => disallowedBy(s, cfg.routing, "consult") === null);
+    if (!allowedSeats.length) {
+        const d = disallowedBy(seats[seats.length - 1], cfg.routing, "consult");
+        return {
+            action: "human",
+            notes: `every consult seat is disallowed by routing.${d.by} (${d.entry}) — failing safe to human`,
+        };
+    }
+    for (const [i, seat] of allowedSeats.entries()) {
         try {
             const parsed = await invokeSeat(seat.adapter, seat.model, i);
             if (parsed.verdict)