tickmarkr 2.1.9 → 2.2.0

package/dist/cli/commands/approve.d.ts

@@ -1,3 +1,27 @@
+export declare const APPROVAL_DISPOSITIONS: readonly ["dispatch", "waive-gate", "re-dispatch", "fund-fixed-attempt", "fresh-budget"];
+export type ApprovalDisposition = (typeof APPROVAL_DISPOSITIONS)[number];
+/**
+ * What each disposition's release actually buys — the clause every operator-facing sentence about
+ * this approval ends on. One table, because two surfaces say it: this command's own message, and the
+ * setup cockpit's pre-write confirm inset, which predicts the effect BEFORE the write. A prediction
+ * that can drift from the write is worth less than none, so neither surface writes the phrase itself.
+ */
+export declare const APPROVAL_ENACTS: Record<ApprovalDisposition, string>;
+export declare function approvalDispositionForRelease(release: unknown): ApprovalDisposition;
 export type ApprovalStatus = "deferred-live" | "recorded-no-owner";
+/** Which run, and whether a LIVE daemon owns THAT run — the two facts an enactment sentence needs. */
+export interface ApprovalRunOwner {
+    runId: string;
+    live: boolean;
+}
+/** The same read `approve` performs, for surfaces that must predict an enactment before writing. */
+export declare function approvalRunOwner(cwd: string, runId: string): ApprovalRunOwner;
+/**
+ * The one sentence that says who enacts this release and what it buys. A live owner's approval is
+ * already scheduled — it rides that daemon's next task boundary — so it must NOT be told to resume:
+ * a second run in the same repository is forbidden, and it would contend for the live daemon's
+ * graph.lock over an approval that has already dispatched.
+ */
+export declare function approvalEnactment(token: ApprovalDisposition, run: ApprovalRunOwner): string;
 /** The production command registered in COMMANDS; its returned bytes are what the CLI prints. */
 export declare function approve(argv: string[], cwd?: string): Promise<string>;

package/dist/cli/commands/approve.js

@@ -1,12 +1,59 @@
 import { userInfo } from "node:os";
 import { GATE_NAMES } from "../../graph/schema.js";
 import { ATTEMPT_CAP_RELEASE, GATE_SATISFIED_RELEASE, Journal, RECHECK_RELEASE, REVIEW_UPHELD_RELEASE } from "../../run/journal.js";
+export const APPROVAL_DISPOSITIONS = ["dispatch", "waive-gate", "re-dispatch", "fund-fixed-attempt", "fresh-budget"];
+/**
+ * What each disposition's release actually buys — the clause every operator-facing sentence about
+ * this approval ends on. One table, because two surfaces say it: this command's own message, and the
+ * setup cockpit's pre-write confirm inset, which predicts the effect BEFORE the write. A prediction
+ * that can drift from the write is worth less than none, so neither surface writes the phrase itself.
+ */
+export const APPROVAL_ENACTS = {
+    dispatch: "dispatch it",
+    "waive-gate": "continue past the approved gate",
+    "re-dispatch": "re-dispatch against the full gate suite",
+    "fund-fixed-attempt": "dispatch a fixed attempt carrying the findings",
+    "fresh-budget": "dispatch it on a fresh attempt budget",
+};
+export function approvalDispositionForRelease(release) {
+    if (release === GATE_SATISFIED_RELEASE)
+        return "waive-gate";
+    if (release === RECHECK_RELEASE)
+        return "re-dispatch";
+    if (release === REVIEW_UPHELD_RELEASE)
+        return "fund-fixed-attempt";
+    if (release === ATTEMPT_CAP_RELEASE)
+        return "fresh-budget";
+    return "dispatch";
+}
 import { acquireApprovalSerialization, runLockOwner } from "../../run/lock.js";
+// THE liveness rule, written once. The lock is REPOSITORY-wide, so a live owner of some OTHER run is
+// not an owner of this one and sweeps none of its approvals — claiming otherwise is the same
+// falsehood in a new shape. Liveness itself comes from lock.ts's runLockOwner (the same inspect() the
+// acquire/unlock decision table uses), never a second `process.kill(pid, 0)`, and never the lock
+// FILE's presence: a stale lock whose recorded pid is dead is not a live run.
+const ownedByLiveDaemon = (owner, runId) => ({ runId, live: owner?.live === true && owner.runId === runId });
+/** The same read `approve` performs, for surfaces that must predict an enactment before writing. */
+export function approvalRunOwner(cwd, runId) {
+    return ownedByLiveDaemon(runLockOwner(cwd), runId);
+}
+/**
+ * The one sentence that says who enacts this release and what it buys. A live owner's approval is
+ * already scheduled — it rides that daemon's next task boundary — so it must NOT be told to resume:
+ * a second run in the same repository is forbidden, and it would contend for the live daemon's
+ * graph.lock over an approval that has already dispatched.
+ */
+export function approvalEnactment(token, run) {
+    return run.live
+        ? `the live daemon enacts this at its next task boundary — it will ${APPROVAL_ENACTS[token]}`
+        : `run \`tickmarkr resume ${run.runId}\` to ${APPROVAL_ENACTS[token]}`;
+}
 /** The production command registered in COMMANDS; its returned bytes are what the CLI prints. */
 export async function approve(argv, cwd = process.cwd()) {
-    const { runId, taskId, by, reason, uphold, recheck, reviewRoundCeiling } = parseArgs(argv);
-    if (uphold && recheck)
-        throw new Error("--uphold and --recheck are different decisions — pass one");
+    const { runId, taskId, by, reason, waive, uphold, recheck, reviewRoundCeiling } = parseArgs(argv);
+    const decisions = [waive, uphold, recheck].filter(Boolean).length;
+    if (decisions > 1)
+        throw new Error("--waive, --uphold and --recheck are different decisions — pass one");
     const serialization = await acquireApprovalSerialization(cwd, runId);
     try {
         // Journal.open throws `no journal for <runId> at <dir>` on an unknown run — that IS the refusal.
@@ -30,13 +77,15 @@ export async function approve(argv, cwd = process.cwd()) {
             }
         }
         const lastHuman = events[lastHumanIndex];
+        const capPark = lastHuman?.data.kind === ATTEMPT_CAP_RELEASE;
+        const gateFailPark = lastHuman?.data.kind === "gate-fail";
+        const failedGate = gateFailPark ? failedGateForNewestPark(events, taskId, lastHumanIndex) : undefined;
+        if (gateFailPark && !failedGate) {
+            throw new Error(`task ${taskId} is parked on gate-fail but has no failed gate result on the newest park — refusing to infer one`);
+        }
         if (uphold) {
-            // Fail-closed on the DATA: uphold applies only when the newest failed gate is the review gate —
-            // any other gate has no reviewer to uphold. Never inferred from the park's prose.
-            const lastFailed = events.slice(0, lastHumanIndex).reverse().find((e) => e.event === "gate-result" && e.taskId === taskId && e.data.pass === false
-                && typeof e.data.gate === "string" && GATE_NAMES.includes(e.data.gate))?.data.gate;
-            if (lastFailed !== "review") {
-                throw new Error(`--uphold applies to a review rejection; ${taskId}'s last failed gate is ${lastFailed ?? "none"} — refusing`);
+            if (!gateFailPark || failedGate !== "review") {
+                throw new Error(`--uphold applies to a review gate-fail park; ${taskId}'s newest park is ${String(lastHuman?.data.kind ?? "none")} with failed gate ${failedGate ?? "none"} — refusing`);
             }
             journal.append("task-approved", taskId, {
                 by,
@@ -46,15 +95,11 @@ export async function approve(argv, cwd = process.cwd()) {
                 gate: "review",
                 ...(reviewRoundCeiling === undefined ? {} : { reviewRoundCeiling }),
             });
-            return disposition(cwd, runId, `upheld the reviewer for ${taskId} in ${runId} — by ${by}; run \`tickmarkr resume ${runId}\` to dispatch a fixed attempt carrying the findings`, serialization.contended);
+            return disposition(cwd, runId, "fund-fixed-attempt", `upheld the reviewer for ${taskId} in ${runId} — by ${by}`, serialization.contended);
         }
-        const capPark = lastHuman?.data.kind === ATTEMPT_CAP_RELEASE;
-        const gateFailPark = lastHuman?.data.kind === "gate-fail";
         if (recheck) {
-            // OBS-203: fail-closed on the PARK KIND — only a gate-fail park has a gate to re-run. Refusing
-            // elsewhere keeps --recheck from becoming a silent budget reset on a pre-dispatch human gate.
-            if (!gateFailPark) {
-                throw new Error(`--recheck applies to a gate-fail park; ${taskId}'s park kind is ${lastHuman?.data.kind ?? "none"} — refusing`);
+            if (!gateFailPark || !failedGate) {
+                throw new Error(`--recheck applies to a gate-fail park; ${taskId}'s newest park is ${String(lastHuman?.data.kind ?? "none")} with failed gate ${failedGate ?? "none"} — refusing`);
             }
             journal.append("task-approved", taskId, {
                 by,
@@ -63,14 +108,27 @@ export async function approve(argv, cwd = process.cwd()) {
                 release: RECHECK_RELEASE,
                 ...(reviewRoundCeiling === undefined ? {} : { reviewRoundCeiling }),
             });
-            return disposition(cwd, runId, `re-checking ${taskId} in ${runId} — by ${by}; no gate marked satisfied, run \`tickmarkr resume ${runId}\` to re-dispatch against the full gate suite`, serialization.contended);
+            return disposition(cwd, runId, "re-dispatch", `re-checking ${taskId} in ${runId} — by ${by}; failed gate ${failedGate}; no gate marked satisfied`, serialization.contended);
         }
-        const failedGate = gateFailPark
-            ? events.slice(0, lastHumanIndex).reverse().find((e) => e.event === "gate-result" && e.taskId === taskId && e.data.pass === false
-                && typeof e.data.gate === "string" && GATE_NAMES.includes(e.data.gate))?.data.gate
-            : undefined;
-        if (gateFailPark && !failedGate) {
-            throw new Error(`task ${taskId} is parked on gate-fail but has no failed gate result — refusing to infer one`);
+        if (waive) {
+            if (!gateFailPark || !failedGate) {
+                throw new Error(`--waive applies to a gate-fail park; ${taskId}'s newest park is ${String(lastHuman?.data.kind ?? "none")} with failed gate ${failedGate ?? "none"} — refusing`);
+            }
+            journal.append("task-approved", taskId, {
+                by,
+                ...(reason ? { reason } : {}),
+                via: "cli",
+                release: GATE_SATISFIED_RELEASE,
+                gate: failedGate,
+                ...(reviewRoundCeiling === undefined ? {} : { reviewRoundCeiling }),
+            });
+            return disposition(cwd, runId, "waive-gate", `waived failed gate ${failedGate} for ${taskId} in ${runId} — by ${by}`, serialization.contended);
+        }
+        if (gateFailPark) {
+            const choices = [`--waive (disposition waive-gate)`, `--recheck (disposition re-dispatch)`];
+            if (failedGate === "review")
+                choices.push(`--uphold (disposition fund-fixed-attempt)`);
+            throw new Error(`task ${taskId} is parked on failed gate ${failedGate}; plain approve has disposition only for non-gate parks — pass ${choices.join(" or ")}`);
         }
         journal.append("task-approved", taskId, {
             by,
@@ -78,9 +136,9 @@ export async function approve(argv, cwd = process.cwd()) {
             via: "cli",
             ...(reviewRoundCeiling === undefined ? {} : { reviewRoundCeiling }),
             ...(capPark ? { release: ATTEMPT_CAP_RELEASE } : {}),
-            ...(failedGate ? { release: GATE_SATISFIED_RELEASE, gate: failedGate } : {}),
         });
-        return disposition(cwd, runId, `approved ${taskId} in ${runId} — by ${by}; run \`tickmarkr resume ${runId}\` to ${failedGate ? "continue past the approved gate" : "dispatch it"}`, serialization.contended);
+        const token = capPark ? "fresh-budget" : "dispatch";
+        return disposition(cwd, runId, token, `approved ${taskId} in ${runId} — by ${by}`, serialization.contended);
     }
     finally {
         serialization.release();
@@ -89,29 +147,41 @@ export async function approve(argv, cwd = process.cwd()) {
 // The status is command OUTPUT, not a typed sibling result: the registered approve function returns
 // one primitive string and the dispatcher prints those bytes unchanged. A compact sentinel followed
 // by JSON makes the contract unambiguous to machines without widening the shared command result type.
-// No-lock approvals keep their historical one-line result for the cockpit; a dead recorded owner and
-// a command delayed behind terminalization both emit recorded-no-owner.
-function disposition(cwd, runId, message, contended) {
+// No-lock approvals keep their historical one-line result for the cockpit; a dead recorded owner, a
+// live owner executing some OTHER run, and a command delayed behind terminalization all emit
+// recorded-no-owner — none of them is a daemon that will sweep this run's approvals.
+//
+// The ENACTMENT half of the message is completed here because only here is liveness known: the call
+// sites carry the decision, not the answer to who will act on it. `deferred-live` keeps its v1.89
+// token — machine consumers parse it — while its TEXT now names the boundary sweep, and the `resume`
+// field it used to carry unconditionally is withheld from the live branch it would misdirect.
+function disposition(cwd, runId, token, message, contended) {
     const owner = runLockOwner(cwd);
+    const run = ownedByLiveDaemon(owner, runId);
     const resume = `tickmarkr resume ${runId}`;
+    const out = `approval disposition ${token}: ${message}; ${approvalEnactment(token, run)}`;
     if (!owner && !contended)
-        return message;
-    const status = owner?.live ? "deferred-live" : "recorded-no-owner";
+        return out;
+    const status = run.live ? "deferred-live" : "recorded-no-owner";
     const record = {
         status,
-        resume,
+        disposition: token,
+        // The recovery command is claimed only where it IS the enactment. A live owner's approval is
+        // already scheduled, and a resume would contend for that daemon's graph.lock.
+        ...(run.live ? {} : { resume }),
         ...(owner?.pid === undefined ? {} : { ownerPid: owner.pid }),
         ...(owner?.runId === undefined ? {} : { ownerRunId: owner.runId }),
     };
-    return `${message}\nTICKMARKR_APPROVAL ${JSON.stringify(record)}`;
+    return `${out}\nTICKMARKR_APPROVAL ${JSON.stringify(record)}`;
 }
-const USAGE = "usage: tickmarkr approve <run-id> <task-id> [--uphold|--recheck] [--review-rounds <positive-integer>] [--by <name>] [--reason <text>]";
+const USAGE = "usage: tickmarkr approve <run-id> <task-id> [--waive|--uphold|--recheck] [--review-rounds <positive-integer>] [--by <name>] [--reason <text>]";
 // hand-parsed argv — no CLI framework (house style). Positionals are runId then taskId; decision,
 // ceiling, actor and reason are flags. Throws usage on missing positionals (mirrors resume.ts/unlock.ts).
 function parseArgs(argv) {
     const positionals = [];
     let by;
     let reason;
+    let waive = false;
     let uphold = false;
     let recheck = false;
     let reviewRoundCeiling;
@@ -127,6 +197,9 @@ function parseArgs(argv) {
             if (!reason)
                 throw new Error(USAGE);
         }
+        else if (a === "--waive") {
+            waive = true;
+        }
         else if (a === "--uphold") {
             uphold = true;
         }
@@ -150,5 +223,19 @@ function parseArgs(argv) {
     if (!runId || !taskId) {
         throw new Error(USAGE);
     }
-    return { runId, taskId, by: by ?? userInfo().username, reason, uphold, recheck, reviewRoundCeiling };
+    return { runId, taskId, by: by ?? userInfo().username, reason, waive, uphold, recheck, reviewRoundCeiling };
+}
+function failedGateForNewestPark(events, taskId, lastHumanIndex) {
+    for (let i = lastHumanIndex - 1; i >= 0; i -= 1) {
+        const event = events[i];
+        if (event.taskId !== taskId)
+            continue;
+        if (event.event === "task-approved" || event.event === "task-human" || event.event === "task-dispatch")
+            return undefined;
+        if (event.event === "gate-result" && event.data.pass === false
+            && typeof event.data.gate === "string" && GATE_NAMES.includes(event.data.gate)) {
+            return event.data.gate;
+        }
+    }
+    return undefined;
 }

package/dist/compile/collateral.js

@@ -262,6 +262,148 @@ export function criterionReadsOnly(text, target) {
     });
 }
 const ARCH_PAGES = ["docs/codebase/ARCHITECTURE.md", "docs/codebase/STRUCTURE.md"];
+// files[] is deliberately small, but a brace range can still be broad. If a pattern exceeds
+// this advisory budget, fail open instead of printing an unexpanded brace fragment as a directory.
+const MAX_BRACE_EXPANSIONS = 256;
+const RANGE_CHAR_START = 32;
+const RANGE_CHAR_END = 126;
+function isEscaped(input, index) {
+    let backslashes = 0;
+    for (let i = index - 1; i >= 0 && input[i] === "\\"; i--)
+        backslashes++;
+    return backslashes % 2 === 1;
+}
+function unescapeGlobLiteral(input) {
+    return input.replace(/\\(.)/g, "$1");
+}
+function rangeParts(body) {
+    const parts = [];
+    let depth = 0;
+    let start = 0;
+    let sawRange = false;
+    for (let i = 0; i < body.length - 1; i++) {
+        if (isEscaped(body, i))
+            continue;
+        const ch = body[i];
+        if (ch === "{") {
+            depth++;
+            continue;
+        }
+        if (ch === "}") {
+            depth = Math.max(0, depth - 1);
+            continue;
+        }
+        if (ch !== "." || body[i + 1] !== "." || isEscaped(body, i + 1) || depth !== 0)
+            continue;
+        parts.push(body.slice(start, i));
+        i++;
+        start = i + 1;
+        sawRange = true;
+    }
+    if (!sawRange)
+        return undefined;
+    parts.push(body.slice(start));
+    return parts;
+}
+function rangeAlternatives(body) {
+    const parts = rangeParts(body);
+    if (!parts)
+        return undefined;
+    const source = `[${parts.map(unescapeGlobLiteral).sort().join("-")}]`;
+    let re;
+    try {
+        re = new RegExp(`^${source}$`);
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    for (let code = RANGE_CHAR_START; code <= RANGE_CHAR_END; code++) {
+        const ch = String.fromCharCode(code);
+        if (re.test(ch))
+            out.push(ch);
+        if (out.length > MAX_BRACE_EXPANSIONS)
+            return [];
+    }
+    return out;
+}
+function braceAlternatives(body) {
+    const alternatives = [];
+    let depth = 0;
+    let start = 0;
+    let hasComma = false;
+    for (let i = 0; i < body.length; i++) {
+        if (isEscaped(body, i))
+            continue;
+        const ch = body[i];
+        if (ch === "{") {
+            depth++;
+            continue;
+        }
+        if (ch === "}") {
+            depth = Math.max(0, depth - 1);
+            continue;
+        }
+        if (ch !== "," || depth !== 0)
+            continue;
+        alternatives.push(body.slice(start, i));
+        start = i + 1;
+        hasComma = true;
+    }
+    if (hasComma) {
+        alternatives.push(body.slice(start));
+        return alternatives;
+    }
+    return rangeAlternatives(body);
+}
+function expandableBrace(pattern) {
+    const opens = [];
+    let unsupported;
+    for (let i = 0; i < pattern.length; i++) {
+        if (isEscaped(pattern, i))
+            continue;
+        if (pattern[i] === "{") {
+            opens.push(i);
+            continue;
+        }
+        if (pattern[i] !== "}" || !opens.length)
+            continue;
+        const start = opens.pop();
+        const alternatives = braceAlternatives(pattern.slice(start + 1, i));
+        if (alternatives === undefined)
+            continue;
+        if (alternatives.length === 0) {
+            unsupported ??= { start, end: i, alternatives };
+            continue;
+        }
+        return { start, end: i, alternatives };
+    }
+    return unsupported;
+}
+function expandFilesPattern(pattern) {
+    const pending = [pattern];
+    const expanded = new Set();
+    let visited = 0;
+    while (pending.length) {
+        const candidate = pending.pop();
+        if (++visited > MAX_BRACE_EXPANSIONS)
+            return [];
+        const brace = expandableBrace(candidate);
+        if (!brace) {
+            expanded.add(unescapeGlobLiteral(candidate));
+            continue;
+        }
+        if (brace.alternatives.length === 0)
+            continue;
+        if (pending.length + brace.alternatives.length > MAX_BRACE_EXPANSIONS)
+            return [];
+        for (const alternative of brace.alternatives) {
+            pending.push(candidate.slice(0, brace.start) + alternative + candidate.slice(brace.end + 1));
+        }
+    }
+    const scoped = filesGlob(pattern);
+    return [...expanded].filter((candidate) => scoped(candidate));
+}
 function topLevelSrcDir(file) {
     const parts = file.replace(/^\.\//, "").replace(/\/+$/, "").split("/");
     if (parts[0] !== "src" || parts.length < 2 || !parts[1])
@@ -293,10 +435,13 @@ export function newDirectoryLints(tasks, repoRoot) {
         const scoped = filesGlob(t.files.map((f) => f.replace(/^\.\//, "")));
         const newDirs = new Set();
         for (const f of t.files) {
-            const dir = topLevelSrcDir(f);
-            if (!dir || existing.has(dir))
-                continue;
-            newDirs.add(`src/${dir}/`);
+            const normalized = f.replace(/^\.\//, "");
+            for (const expanded of expandFilesPattern(normalized)) {
+                const dir = topLevelSrcDir(expanded);
+                if (!dir || existing.has(dir))
+                    continue;
+                newDirs.add(`src/${dir}/`);
+            }
         }
         if (!newDirs.size)
             continue;

package/dist/run/daemon.d.ts

@@ -49,12 +49,16 @@ export interface RunSummary {
     outstandingApprovals?: string[];
 }
 /**
- * T14: approvals the run accepted and never acted on. `approved` above is built ONCE at startup —
- * deliberately, replay determinism depends on it — so an approval written while the daemon is live is
- * inert for that run. Without this the run-end record stated only buckets and tipVerify, both
- * accurate, over a milestone that was silently incomplete: run …230 ended tipVerify "passed" with two
- * upheld approvals and zero subsequent dispatches. Scored per task on its NEWEST approval: a later
- * approval is the live decision, and the events that answer it are the ones after it.
+ * T14, amended by v2.2 T3: approvals the run accepted and never acted on. `approved` above is still
+ * built ONCE at startup — replay determinism depends on it — but a live approval is no longer inert:
+ * the boundary sweep in the task loop releases what lands while the daemon runs, so an approval
+ * written mid-run is normally enacted by this run. ONE window survives, and it is the reason this
+ * fold still exists: an approval accepted after the task loop exits — during tip verify, before the
+ * run-end sample below — meets no further boundary, so nothing can release it before this run ends.
+ * Without this the run-end record stated only buckets and tipVerify, both accurate, over a milestone
+ * that was silently incomplete: run …230 ended tipVerify "passed" with two upheld approvals and zero
+ * subsequent dispatches. Scored per task on its NEWEST approval: a later approval is the live
+ * decision, and the events that answer it are the ones after it.
  */
 export declare function outstandingApprovals(events: JournalEvent[]): string[];
 export declare function formatSummary(s: RunSummary): string;