tickmarkr 1.87.0 → 1.90.0

package/dist/compile/native.js

@@ -1,8 +1,9 @@
 import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
-import { basename, dirname } from "node:path";
+import { basename, dirname, join, resolve } from "node:path";
+import { filesGlob } from "../graph/files-glob.js";
 import picomatch from "picomatch";
-import { GATE_NAMES, GRAPH_ROUTING_MODES, ORACLES, SHAPES, TIERS, validateGraph } from "../graph/schema.js";
+import { GATE_NAMES, GRAPH_ROUTING_MODES, ORACLES, renderAcceptanceItem, SHAPES, TIERS, validateGraph, } from "../graph/schema.js";
 import { CompileError, inferShape, sha256 } from "./common.js";
 // OBS-170/OBS-184: `context:` is a promise to the worker, and nothing ever checked it could be kept.
 // Workers run in `git worktree add <baseRef>` (run/git.ts:169-176), which materialises the base
@@ -71,6 +72,202 @@ const FIELDS = new Set(["goal", "shape", "deps", "files", "context", "complexity
 function invalid(task, field, detail) {
     throw new CompileError(`Task ${task} field "${field}" ${detail}`);
 }
+export const AUTHORING_LINT_CODES = [
+    "criterion-scope",
+    "dependency-closure",
+    "dependency-coupling",
+    "proxy-metric",
+    "external-referent",
+    "closed-enumeration",
+    "one-behavior",
+    "concern-bundle",
+    "seam-exists",
+];
+// The authoring frame's observable oracle is the branch-tip test corpus, never the mutable index or
+// an author's untracked checkout. Load it once per repository: one bounded git read replaces a grep
+// subprocess per token and preserves the base-only native compile's zero-Git property (the index is
+// requested only when a criterion actually carries a rendered observable or a test basename).
+const headTestCache = new Map();
+function repositoryRoot(file) {
+    let current = resolve(dirname(file));
+    for (;;) {
+        if (existsSync(join(current, ".git")))
+            return current;
+        const parent = dirname(current);
+        if (parent === current)
+            return undefined;
+        current = parent;
+    }
+}
+function testsAtHead(root) {
+    const cached = headTestCache.get(root);
+    if (cached)
+        return cached;
+    const grep = spawnSync("git", ["-C", root, "grep", "-I", "-n", "-e", "", "HEAD", "--", "tests/*.test.ts", "tests/**/*.test.ts"], { encoding: "utf8", maxBuffer: 1 << 25 });
+    if (grep.status !== 0 || typeof grep.stdout !== "string") {
+        headTestCache.set(root, []);
+        return [];
+    }
+    const bodies = new Map();
+    for (const line of grep.stdout.split("\n")) {
+        const match = line.match(/^HEAD:(tests\/.*\.test\.ts):\d+:(.*)$/);
+        if (!match)
+            continue;
+        const lines = bodies.get(match[1]) ?? [];
+        lines.push(match[2]);
+        bodies.set(match[1], lines);
+    }
+    const tests = [...bodies].map(([path, lines]) => ({ path, text: lines.join("\n") }));
+    headTestCache.set(root, tests);
+    return tests;
+}
+function criterionTexts(task) {
+    return task.acceptance.map(renderAcceptanceItem);
+}
+function fixtureId(file) {
+    return basename(file).replace(/(?:\.spec)?\.md$/, "");
+}
+function strictNegativeCount(text) {
+    return (text.match(/\b(?:never|neither|cannot)\b|\bno\s+[a-z][a-z-]*(?:\s+[a-z][a-z-]*){0,3}\s+(?:may|can|supplies|becomes)\b/gi) ?? []).length;
+}
+function namedCriterionPaths(text, tests) {
+    const paths = new Set();
+    for (const match of text.matchAll(/(?:^|[\s("'`])((?:src|tests|fixtures|scripts)\/[A-Za-z0-9_@{}*?.,/+-]+\.(?:ts|tsx|js|jsx|mjs|cjs|json|md|txt))/g)) {
+        paths.add(match[1]);
+    }
+    for (const match of text.matchAll(/\b([A-Za-z0-9_.-]+\.test\.ts)\b/g)) {
+        for (const test of tests)
+            if (basename(test.path) === match[1])
+                paths.add(test.path);
+    }
+    return [...paths];
+}
+function renderedObservables(text) {
+    const exact = new Set();
+    const denominators = new Set();
+    for (const match of text.matchAll(/`([^`\n]{2,120})`/g)) {
+        const token = match[1].trim();
+        // Plain vocabulary in backticks is documentation, not a concrete rendered value. Digit-bearing,
+        // path/punctuation-shaped, snake/camel-case tokens are the branch-tip grep substrate from C1.
+        if (/\d|[_./:%-]|[a-z][A-Z]/.test(token))
+            exact.add(token);
+    }
+    for (const match of text.matchAll(/\b(\d+)\s*(?:\/|of)\s*(\d+)\b/gi)) {
+        exact.add(`${match[1]}/${match[2]}`);
+        denominators.add(match[2]);
+    }
+    return { exact: [...exact], denominators: [...denominators] };
+}
+function criterionScopeFinding(task, text, criterion, id, tests) {
+    if (task.files.length === 0)
+        return undefined; // empty files[] is deliberately unrestricted
+    const inScope = filesGlob(task.files.map((entry) => entry.replace(/^\.\//, ""))); // Q120s shared matcher
+    const named = namedCriterionPaths(text, tests);
+    const { exact, denominators } = renderedObservables(text);
+    const asserting = tests.filter((test) => exact.some((token) => test.text.includes(token))
+        || denominators.some((denominator) => new RegExp(`(?:^|\\D)\\d+/${denominator}(?:\\D|$)`).test(test.text))).map((test) => test.path);
+    const missing = [...new Set([...named, ...asserting])].filter((path) => !inScope(path));
+    if (missing.length === 0)
+        return undefined;
+    return {
+        code: "criterion-scope",
+        fixtureId: id,
+        taskId: task.id,
+        criterion,
+        detail: `criterion names asserting file${missing.length === 1 ? "" : "s"} outside expanded files[]: ${missing.join(", ")}`,
+    };
+}
+function exportedIdentifier(root, files, identifier) {
+    const escaped = identifier.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const declaration = new RegExp(`\\bexport\\s+(?:(?:declare|default|async)\\s+)*(?:function|class|const|let|var|interface|type)\\s+${escaped}\\b|\\bexport\\s*\\{[^}]*\\b${escaped}\\b`);
+    return files.some((file) => {
+        if (/[*?{[]/.test(file))
+            return false;
+        try {
+            return declaration.test(readFileSync(join(root, file), "utf8"));
+        }
+        catch {
+            return false;
+        }
+    });
+}
+/**
+ * Frame-v2 authoring checks over the compiled native task shape. Criterion-scope is blocking at the
+ * compile boundary; the remaining checks are review findings, emitted by compileNative below.
+ */
+export function authoringLintFindings(tasks, file) {
+    const id = fixtureId(file);
+    const root = repositoryRoot(file);
+    let indexedTests;
+    const testIndex = () => indexedTests ??= root ? testsAtHead(root) : [];
+    const findings = [];
+    for (const task of tasks) {
+        const criteria = criterionTexts(task);
+        for (const [index, text] of criteria.entries()) {
+            const needsTestIndex = /`[^`\n]{2,120}`|\b\d+\s*(?:\/|of)\s*\d+\b|\b[A-Za-z0-9_.-]+\.test\.ts\b/.test(text);
+            const scope = criterionScopeFinding(task, text, index + 1, id, needsTestIndex ? testIndex() : []);
+            if (scope)
+                findings.push(scope);
+            if (/line[- ]count|physical line|not greater than (?:the|\d)|no larger than|at most \d+ (?:lines|bytes)/i.test(text)) {
+                findings.push({ code: "proxy-metric", fixtureId: id, taskId: task.id, criterion: index + 1, detail: "criterion uses a proxy size metric; state the structural intent instead" });
+            }
+            if (/\bthe (?:audit|ruling|sweep|standby|decision|analysis|handoff)\b|\bper the\b|\bat \.planning\//i.test(text)) {
+                findings.push({ code: "external-referent", fixtureId: id, taskId: task.id, criterion: index + 1, detail: "criterion depends on an external governance referent; inline the deciding fact" });
+            }
+            const separators = text.match(/\band\b|\bwhile\b|\bthen\b|\bplus\b|\bwith\b|,|—/gi) ?? [];
+            if (separators.length >= 4) {
+                findings.push({ code: "one-behavior", fixtureId: id, taskId: task.id, criterion: index + 1, detail: `${separators.length} independently-failable separators; split unless one leg alone reds this title` });
+            }
+        }
+        const prose = [task.goal, ...criteria].join("\n");
+        const dependencyText = prose
+            .replace(/`[^`]*`/g, "")
+            .split("\n")
+            .filter((line) => !/\b(?:accepts?|rejects?)\b/i.test(line))
+            .join("\n");
+        const referenced = [...new Set(dependencyText.match(/\bT\d+\b/g) ?? [])]
+            .filter((dep) => dep !== task.id && !task.deps.includes(dep));
+        if (referenced.length > 0) {
+            findings.push({ code: "dependency-closure", fixtureId: id, taskId: task.id, detail: `references ${referenced.join(", ")} outside deps[]` });
+        }
+        if (/\bwhose independent [^.\n]{0,80}(?:classification|result|decision|output|evidence)\b|\b(?:from|through|provided by|owned by) (?:a |the )?(?:successor|downstream|later|sibling)\b/i.test(dependencyText)) {
+            findings.push({ code: "dependency-coupling", fixtureId: id, taskId: task.id, detail: "de-numbered cross-task coupling needs a dependency or a declared consumes contract" });
+        }
+        const negatives = strictNegativeCount(prose);
+        if (negatives >= 2 && !/enumerat|closed (?:input )?list|closed \w* table|STANDBY/i.test(prose)) {
+            findings.push({ code: "closed-enumeration", fixtureId: id, taskId: task.id, detail: `${negatives} strict prohibitions have no closed enumeration pointer` });
+        }
+        const concerns = [...new Set(task.goal.match(/\bQ\d+\b/g) ?? [])];
+        if (concerns.length > 1) {
+            findings.push({ code: "concern-bundle", fixtureId: id, taskId: task.id, detail: `goal bundles ${concerns.join(", ")}` });
+        }
+        if (root && negatives > 0) {
+            const monoliths = task.files.filter((entry) => {
+                if (!entry.startsWith("src/") || /[*?{[]/.test(entry))
+                    return false;
+                try {
+                    return readFileSync(join(root, entry), "utf8").split("\n").length > 1500;
+                }
+                catch {
+                    return false;
+                }
+            });
+            if (monoliths.length > 0) {
+                const identifiers = [...prose.matchAll(/`([A-Za-z_$][A-Za-z0-9_$]*)`/g)].map((match) => match[1]);
+                const seamExists = identifiers.some((identifier) => exportedIdentifier(root, task.files, identifier));
+                const firstCreatesSeam = /\b(?:add|create|extract|introduce|ship)\b[^.\n]{0,100}\b(?:injectable|seam|clock|snapshot|evidence)\b/i.test(criteria[0] ?? "");
+                if (!seamExists && !firstCreatesSeam) {
+                    findings.push({ code: "seam-exists", fixtureId: id, taskId: task.id, detail: `law-shaped task touches ${monoliths.join(", ")} but names no exported seam and does not create one first` });
+                }
+            }
+        }
+    }
+    return findings;
+}
+function renderAuthoringFinding(finding) {
+    const criterion = finding.criterion === undefined ? "" : ` criterion ${finding.criterion}`;
+    return `tickmarkr: authoring-lint[${finding.code}] fixture ${finding.fixtureId} task ${finding.taskId}${criterion}: ${finding.detail}`;
+}
 export function compileNative(file) {
     if (!existsSync(file))
         throw new CompileError(`no such native spec file: ${file}`);
@@ -82,14 +279,27 @@ export function compileNative(file) {
     const drafts = [];
     let plainCount = 0; // v1.19: plain-string acceptance items compiled as judge oracles (compat) — warn once
     let specMode;
-    for (const line of content.split("\n")) {
+    let specBase;
+    for (const [index, line] of content.split("\n").entries()) {
         const heading = line.match(HEAD_RE);
         if (heading) {
-            drafts.push({ id: heading[1], title: heading[2].trim(), fields: {}, acceptance: [], gates: [], hasGates: false, list: null, continuationField: null });
+            drafts.push({ id: heading[1], title: heading[2].trim(), fields: {}, acceptanceRaw: [], acceptance: [], gates: [], hasGates: false, list: null, itemOpen: false, continuationField: null });
             continue;
         }
         const draft = drafts.at(-1);
         if (!draft) {
+            const base = line.match(/^base:\s*(.*)$/);
+            if (base) {
+                const value = base[1].trim();
+                if (!value) {
+                    throw new CompileError("spec front-matter base must not be empty — repair: write lower-case base: <commit-or-ref> at column zero");
+                }
+                specBase = value;
+                continue;
+            }
+            if (/^Base:\s*/.test(line)) {
+                throw new CompileError("native task unit contract rejects column-zero Base: as untyped prose — repair: write lower-case base: <commit-or-ref>");
+            }
             // v1.51 T2: spec front-matter — a top-level `mode: <name>` line before the first task heading
             // declares the engagement's routing mode (loses only to an explicit run flag).
             const fm = line.match(/^mode:\s*(\S+)\s*$/);
@@ -107,6 +317,7 @@ export function compileNative(file) {
             if (!FIELDS.has(name))
                 invalid(draft.id, field[1], "is unknown");
             const value = field[2].trim();
+            draft.itemOpen = false;
             if (name === "acceptance" || name === "gates") {
                 if (value)
                     invalid(draft.id, field[1], "must be a nested list");
@@ -155,31 +366,51 @@ export function compileNative(file) {
             const value = nested[1].trim();
             if (!value)
                 invalid(draft.id, draft.list, "must not contain empty entries");
-            // v1.19: only the acceptance list parses typed oracle prefixes; gates stay plain names.
-            if (draft.list === "acceptance") {
-                const typed = value.match(ORACLE_RE);
-                if (typed) {
-                    const [, kind, body] = typed;
-                    if (!body.trim())
-                        invalid(draft.id, "acceptance", `${kind} oracle must carry a value`);
-                    draft.acceptance.push(kind === "command" ? { oracle: "command", command: body.trim() }
-                        : kind === "test" ? { oracle: "test", test: body.trim() }
-                            : { oracle: "judge", text: body.trim() });
-                }
-                else {
-                    plainCount++;
-                    draft.acceptance.push(value);
-                }
-            }
-            else {
-                draft[draft.list].push(value);
-            }
+            (draft.list === "acceptance" ? draft.acceptanceRaw : draft.gates).push(value);
+            draft.itemOpen = true;
+            continue;
+        }
+        // OBS-488: a deeper-indented non-item line under a list item is that item's wrapped
+        // continuation — join with a single space, exactly as OBS-60/OBS-308 guarantee for fields.
+        // 1.87.0 dropped these lines silently: 53/78 of run-551's criteria compiled to first-line
+        // stubs and every falsifier tail was invisible to the judge.
+        if (draft.list && draft.itemOpen && (line.startsWith(" ") || line.startsWith("\t")) && line.trim()) {
+            const items = draft.list === "acceptance" ? draft.acceptanceRaw : draft.gates;
+            items[items.length - 1] += ` ${line.trim()}`;
             continue;
         }
         if (line.startsWith("- "))
             invalid(draft.id, "field", `bullet is malformed: ${JSON.stringify(line)}`);
-        if (line.trim() && !line.startsWith(" "))
-            draft.list = null;
+        if (!line.trim()) {
+            draft.itemOpen = false;
+            continue;
+        }
+        // OBS-488 fail-closed invariant: a non-blank line inside a task block that no rule consumes
+        // is an error, never a silent drop — dropping author bytes is the meta-defect that hid the
+        // criterion truncation for months.
+        throw new CompileError(`Task ${draft.id} line ${index + 1}: no parse rule consumes this line: ${JSON.stringify(line)}.\n` +
+            `A non-blank line in a task block must be a "- field:" bullet, a "  - " list item, or an\n` +
+            `indented continuation of the preceding field or list item. tickmarkr refuses to silently\n` +
+            `drop spec bytes (OBS-488) — move prose above the first task heading or into a field.`);
+    }
+    // OBS-488: typed-oracle prefixes parse on the COMPLETE joined item text, never its first
+    // physical line — a wrapped `command:` body or falsifier tail is part of the criterion.
+    for (const draft of drafts) {
+        for (const raw of draft.acceptanceRaw) {
+            const typed = raw.match(ORACLE_RE);
+            if (typed) {
+                const [, kind, body] = typed;
+                if (!body.trim())
+                    invalid(draft.id, "acceptance", `${kind} oracle must carry a value`);
+                draft.acceptance.push(kind === "command" ? { oracle: "command", command: body.trim() }
+                    : kind === "test" ? { oracle: "test", test: body.trim() }
+                        : { oracle: "judge", text: body.trim() });
+            }
+            else {
+                plainCount++;
+                draft.acceptance.push(raw);
+            }
+        }
     }
     if (!drafts.length) {
         throw new CompileError(`${file} has no task sections. Expected "## T1: Title" headings with field bullets.`);
@@ -294,7 +525,7 @@ export function compileNative(file) {
         return [probe, ...variants];
     };
     const canHostTest = (entry) => {
-        const self = picomatch(entry, { dot: true });
+        const self = filesGlob(entry); // Q120s shared matcher — paren dirs stay literal in the self-probe
         return expandBraces(entry)
             .flatMap((branch) => PROBE_TOKENS.map((token) => branch.replace(/\*+/g, token)))
             .flatMap(qmarkVariants)
@@ -358,9 +589,23 @@ export function compileNative(file) {
     const result = validateGraph({
         version: 1,
         ...(specMode ? { mode: specMode } : {}),
-        spec: { source: "native", paths: [file], hash: sha256(content) },
+        spec: {
+            source: "native",
+            paths: [file],
+            hash: sha256(content),
+            ...(specBase !== undefined ? { base: specBase } : {}),
+        },
         tasks,
     });
+    const authoringFindings = authoringLintFindings(result.tasks, file);
+    for (const finding of authoringFindings.filter(({ code }) => code !== "criterion-scope")) {
+        console.warn(renderAuthoringFinding(finding));
+    }
+    const scopeErrors = authoringFindings.filter(({ code }) => code === "criterion-scope");
+    if (scopeErrors.length > 0) {
+        throw new CompileError(`${file} violates the criterion-scope authoring lint (${scopeErrors.length} error${scopeErrors.length === 1 ? "" : "s"}):\n`
+            + scopeErrors.map((finding) => `  - ${renderAuthoringFinding(finding)}`).join("\n"));
+    }
     // v1.19 read-old/write-new: a plain-string acceptance item compiles as a judge oracle. This is the
     // one-time nudge toward typed oracles (command/test/judge); PRD/Spec Kit/GSD stay silent (untouched).
     if (plainCount > 0) {
@@ -378,7 +623,7 @@ export function compileNative(file) {
     // OBS-170/OBS-184: warn per unreachable context: entry, classified by the action its author must
     // take. Warn-only by operator ruling (2026-08-03) — fail-closed would have refused to compile the
     // spec that shipped green. Fails open when git cannot answer, so non-repo fixtures stay silent.
-    const repo = trackedAtHead(dirname(file));
+    const repo = tasks.some((task) => task.context.length > 0) ? trackedAtHead(dirname(file)) : undefined;
     if (repo) {
         const unreachable = [];
         for (const t of tasks) {
@@ -419,6 +664,8 @@ acceptance is required on every task (a nested list of observable outcomes).
   Spec front-matter (top-level, before the first task heading):
     mode: partner-led | risk-based | staff-led — this engagement's routing mode
           (loses only to an explicit \`run --mode\` flag)
+    base: commit-or-ref — optional declared source base; the declaration must begin at column zero
+                          (runtime enforcement happens before a run)
 
   Fields available per task:
     goal:        outcome the task must achieve (defaults to the title if omitted)
@@ -450,6 +697,10 @@ acceptance is required on every task (a nested list of observable outcomes).
   WHAT MAKES A CRITERION REAL:
     - "test:" must name a real test asserting on recorded state, journal lines, or drawn frames, and its
       title must match the criterion string verbatim. It also needs a collectable test path in files[].
+    - A "test:" oracle must name a TOP-LEVEL test case, never one nested under describe(). Vitest prefixes
+      nested cases with every suite title, while the acceptance gate builds an anchored pattern that
+      vitest -t applies against the FULL runner-visible name; the verbatim leaf title then selects ZERO
+      tests and the gate parks even though the suite is green. Measured: two parks in one run.
     - NO criterion may be satisfiable by an absence, a rename, a source-text grep, or an empty collection.
       "no file references X" is not a criterion — it passes in a repo where the feature was never built.
     - "goal:" is NEVER verification. Prose in the goal enforces nothing: every obligation needs an
@@ -461,9 +712,31 @@ acceptance is required on every task (a nested list of observable outcomes).
       correctly-shaped fix that runs SOMETIMES satisfies it. "cleanup is try/finally at all four sites"
       is satisfied by \`finally { if (cond) cleanup() }\` — the shape is present and the fix is inert in
       production. Say UNCONDITIONAL, or name the branch that may not exist.
+    - Ask of every criterion: COULD THIS BE SATISFIED BY CODE THAT NOTHING OUTSIDE THE TEST SUITE CALLS?
+      A criterion naming a CAPABILITY is satisfiable by a stub whose only caller is its own test, and the
+      judge cannot catch it — it reads the DIFF, and a stub's hunks are real. Name the PRODUCTION CALLER
+      that must exercise the capability, and the path it runs on; "X is supported" ships as dead code.
     - Enumerating one axis exhaustively is what hides the others. A spec that guards PARTIAL coverage
       site-by-site, member-by-member, can be defeated wholesale by CONDITIONAL coverage, which leaves
       every enumeration satisfied. After you enumerate, ask what a single flag would do to the whole set.
+    - A criterion that names a behaviour must name the VALUE AT WHICH IT WOULD BREAK. Every criterion is a
+      claim about a variable — a status, a width, a count, an arrival time — and if it does not say which
+      value of that variable is the hard one, THE TEST WILL CHOOSE THE EASY ONE AND BE GREEN. Measured: a
+      grace-window criterion whose tests pinned pane status to "working" when the defect needed "blocked";
+      a width criterion tested at 2-cell task ids when the schema permits 64; a fork-budget criterion
+      tested only where concurrency <= cores when config accepts every positive integer. Each was
+      satisfied exactly as written, and each shipped the defect. State six things per criterion:
+        1. the PRODUCTION ENTRY POINT and the FINAL OBSERVABLE — what a caller invokes, what a reader sees;
+        2. the AUTHORITATIVE SOURCE of each value, never a nearby re-derivation that can disagree with it;
+        3. the QUANTIFIER, or the closed subject set the claim ranges over;
+        4. the VARIABLE whose change could falsify the claim;
+        5. TWO DISCRIMINATING CASES that vary that variable — or the invariance relation, if the claim is
+           that varying it changes nothing — drawn from the FULL domain the system accepts, never a
+           convenient subrange, because the domain is chosen by whoever must satisfy the criterion;
+        6. the concrete FALSE-CLEAN case: what a passing test would look like if the mechanism were absent.
+      A criterion that cannot name (4) is a claim about nothing and its test cannot fail. If (5) has no
+      hard value anywhere in the domain, the criterion asserts a universal that may be FALSE ABOUT THE
+      WORLD — bound it or say where it stops holding, rather than demanding a value that does not exist.
 
   ORDERING AND OWNERSHIP:
     - Every path has exactly ONE owning task. Two tasks writing one file must be ORDERED by deps, or the
@@ -474,6 +747,15 @@ acceptance is required on every task (a nested list of observable outcomes).
       mechanism DOES for them; the most dangerous consumer is a file no task owns, because nothing fixes it
       and no edge can order it.
 
+  EVIDENCE DISCIPLINE THE REVIEWERS ENFORCE (write criteria assuming these; violations are material):
+    - A result row whose shape is unknown, mixed, or internally contradictory is MALFORMED and must fail
+      closed. Recognizing one discriminator never licenses ignoring the rest of the row; malformed input
+      may never normalize to passed or any other gate-satisfying outcome.
+    - Preserve machine evidence according to the producer's protocol: never trim, discard, or change
+      delimiters before validation. Git path evidence MUST use -z and NUL parsing with bytes preserved;
+      inspect timeout, signal, and exit status before interpreting output, because a failed or timed-out
+      producer may never normalize to an empty successful result.
+
   "timeout:" IS A KILL CEILING, NOT AN ESTIMATE. Never read a sum of timeouts as a predicted duration.
 -->
 

package/dist/config/config.js

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import picomatch from "picomatch";
+import { filesGlob } from "../graph/files-glob.js";
 import { Document, parse } from "yaml";
 import { z } from "zod";
 import { CITED_MODEL_WINDOWS } from "../adapters/model-windows.js";
@@ -223,7 +223,7 @@ export function criticalPathHits(files, criticalPaths = []) {
             const critical = normPath(rawCritical);
             if (!critical)
                 continue;
-            if (f === critical || picomatch(critical, { dot: true })(f) || picomatch(f, { dot: true })(critical)
+            if (f === critical || filesGlob(critical)(f) || filesGlob(f)(critical) // Q120s shared matcher
                 || (GLOB_META_RE.test(f) && GLOB_META_RE.test(critical) && globsMayIntersect(f, critical))) {
                 hits.add(f);
             }

package/dist/drivers/subprocess.d.ts

@@ -1,7 +1,12 @@
 import type { ExecutorDriver, NotifyOpts, Slot } from "./types.js";
 export declare const MAX_BUF: number;
 export declare const HERDR_CONTROL_VARS: readonly ["HERDR_ENV", "HERDR_SOCKET_PATH"];
-/** Copy of worker env with the fork cap applied and herdr control-plane vars stripped. */
+/**
+ * Copy of worker env with the fork cap applied and herdr control-plane vars stripped.
+ * The cap is the one the enclosing run resolved (resolvedForkCap) — a worker's suites divide the
+ * same machine the gate shells do, so both seams have to read the same run-owned number rather
+ * than a flat constant. The operator's own export still wins.
+ */
 export declare function sealHerdrEnv(env?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
 /** Pane/login-shell form of the same worker env seal (herdr seed + daemon setup). */
 export declare function herdrSealShellPrefix(env?: NodeJS.ProcessEnv): string;

package/dist/drivers/subprocess.js

@@ -1,6 +1,6 @@
 import { spawn } from "node:child_process";
 import { shq } from "../adapters/types.js";
-import { createWorktree, DEFAULT_FORK_CAP, FORK_CAP_ENV } from "../run/git.js";
+import { createWorktree, FORK_CAP_ENV, resolvedForkCap } from "../run/git.js";
 // HARD-03: cap retained worker output so a chatty worker can't grow tickmarkr's heap unbounded.
 // 2MB is safe against BOTH consumers: the largest read() call site asks for 1000 lines
 // (daemon.ts:217/247), and every marker (TICKMARKR_RESULT, TICKMARKR_EXIT_<nonce>) is emitted at the
@@ -13,18 +13,23 @@ export const MAX_BUF = 2 * 1024 * 1024;
 // (and its own herdr driver CLI calls) keep the live session. Socket path is the wire; HERDR_ENV
 // is the "I am inside herdr" gate every agent skill checks before mutating panes.
 export const HERDR_CONTROL_VARS = ["HERDR_ENV", "HERDR_SOCKET_PATH"];
-/** Copy of worker env with the fork cap applied and herdr control-plane vars stripped. */
+/**
+ * Copy of worker env with the fork cap applied and herdr control-plane vars stripped.
+ * The cap is the one the enclosing run resolved (resolvedForkCap) — a worker's suites divide the
+ * same machine the gate shells do, so both seams have to read the same run-owned number rather
+ * than a flat constant. The operator's own export still wins.
+ */
 export function sealHerdrEnv(env = process.env) {
     const out = { ...env };
     if (!(FORK_CAP_ENV in out))
-        out[FORK_CAP_ENV] = DEFAULT_FORK_CAP;
+        out[FORK_CAP_ENV] = resolvedForkCap();
     for (const k of HERDR_CONTROL_VARS)
         delete out[k];
     return out;
 }
 /** Pane/login-shell form of the same worker env seal (herdr seed + daemon setup). */
 export function herdrSealShellPrefix(env = process.env) {
-    const forkCap = sealHerdrEnv(env)[FORK_CAP_ENV] ?? DEFAULT_FORK_CAP;
+    const forkCap = sealHerdrEnv(env)[FORK_CAP_ENV] ?? resolvedForkCap();
     return `export ${FORK_CAP_ENV}=${shq(forkCap)}; ` +
         HERDR_CONTROL_VARS.map((k) => `unset ${k}`).join("; ") + "; ";
 }

package/dist/gates/acceptance.d.ts

@@ -1,5 +1,5 @@
 import { type WorkerAdapter } from "../adapters/types.js";
-import { type Task } from "../graph/schema.js";
+import { type AcceptanceItem, type Task } from "../graph/schema.js";
 import { type LlmVia } from "./llm.js";
 import type { GateResult } from "./types.js";
 export interface EvidenceCitation {
@@ -21,7 +21,27 @@ export interface JudgeVerdict {
     }>;
 }
 export declare function judgeCriterionId(index: number): string;
+export declare function testFilterPattern(name: string): string;
 export declare function testFiltered(testCmd: string, name: string): string;
+export interface VitestListedTest {
+    name: string;
+    file: string;
+    projectName?: string;
+}
+export type AcceptanceCorpusAuditResult = {
+    specPath: string;
+    status: "parse-failed";
+    error: string;
+} | {
+    specPath: string;
+    status: "parsed";
+    item: AcceptanceItem;
+    namedTest?: {
+        criterion: string;
+        matches: VitestListedTest[];
+    };
+};
+export declare function auditAcceptanceCorpus(corpusRoot: string, listedTests: readonly VitestListedTest[]): AcceptanceCorpusAuditResult[];
 export interface AcceptanceGateOpts {
     testCmd?: string;
     diffCap?: number;