tickmarkr 2.2.0 → 2.3.0

package/dist/cli/commands/init.js

@@ -1,5 +1,6 @@
+import { execFileSync } from "node:child_process";
 import { appendFileSync, cpSync, existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
+import { join, relative } from "node:path";
 import { fileURLToPath } from "node:url";
 import { createInterface } from "node:readline/promises";
 import { parseArgs } from "node:util";
@@ -8,20 +9,20 @@ import { configTemplate, DEFAULT_CONFIG, globalConfigDir, loadConfig } from "../
 import { LEGACY_PREFIX, specTemplate } from "../../compile/native.js";
 import { BANNER, kvRow, legend, rule, statusRow, title } from "../../brand.js";
 import { tickmarkrDir } from "../../graph/graph.js";
+import { orcaHostDetected } from "../../drivers/index.js";
 import { Journal } from "../../run/journal.js";
 import { doctor } from "./doctor.js";
 import { assembleFleetEditor } from "./fleet.js";
 const SCAFFOLD_SPEC = "tickmarkr.spec.md";
 // Operator-approved (2026-07-17) environments footer — no npm install for herdr (npm package
-// "herdr" is a reserved 0.0.0 placeholder as of that date). The orca row joins it with the v2.1
-// driver: it is a THIRD execution surface an operator selects outright — `auto` still resolves
-// herdr-else-subprocess and never picks it, so the footer names it beside the other two choices.
+// "herdr" is a reserved 0.0.0 placeholder as of that date). Auto resolves herdr → orca →
+// subprocess; the orca leg is environment-only, using the two markers Orca stamps in its terminals.
 const ENVIRONMENTS_FOOTER = [
     "environments:",
-    "  herdr — the full cockpit — every worker, judge, and consult is a visible pane you can watch and unblock · https://herdr.dev",
-    "  orca — visible terminals in the Orca app — an explicit driver choice: set driver: orca (auto never picks it) · https://onorca.dev",
+    "  herdr — the full cockpit — every worker, judge, and consult is a visible pane you can watch and unblock · https://herdr.dev · auto picks it first when HERDR_ENV=1",
+    "  orca — visible terminals in the Orca app — auto picks it inside an Orca terminal after herdr and before subprocess; set driver: orca to force it · https://onorca.dev",
     "  claude code — tickmarkr init --agent installs the /tkr skills + AGENTS.md so Claude Code (or any agent CLI) drives the loop natively",
-    "  anywhere — no herdr? same fail-closed gates, headless subprocess driver",
+    "  anywhere — no herdr or Orca terminal? same fail-closed gates, headless subprocess driver (legacy: no herdr? same fail-closed gates, headless subprocess driver when Orca markers are absent)",
 ].join("\n");
 /** Latest journal without a run-end event, if any. */
 function activeRunId(cwd) {
@@ -140,17 +141,6 @@ you were handed the whole picture — list the repository root, open every guida
   direction each moves, what makes a criterion real, and why an absence or a source-text grep is never a
   criterion. Read it before authoring or repairing acceptance items.
 - **Editing \`src/gates/\`, \`src/compile/\` or \`src/graph/\`?** Read \`docs/codebase/ARCHITECTURE.md\` first.
-- **EVERY fix gets a ship/no-ship decision, recorded, at the moment it is made.** Ask one question of each
-  one: *does a user hit this defect?* If yes, the fix belongs in \`src/**\` or \`skills/**\` — the only trees
-  the package carries (\`files: [dist, schema, skills, fixtures]\`). A script, overlay, config entry or
-  operator-side workaround that resolves the symptom **locally is not the fix; it is a decision to leave
-  every other user broken**, and it must say so in writing and name the condition that removes it.
-  **The default answer is SHIP.** A local remedy is the exception and carries the burden of proof.
-  Watch for the three shapes this hides in: a fix applied where you happened to be standing rather than
-  where the defect lives; an observation filed with a product fix named in its own text and queued
-  nowhere; and a local tool that quietly grows into a product feature nobody shipped. **A defect and its
-  fix must be recorded in the same place, or the queue silently becomes a list of things everyone assumed
-  someone else had shipped.**
 ${DOCS_END}
 `;
 // Every applicable host location gets the skills, each paired with its own repository guidance
@@ -229,7 +219,28 @@ const describeDrift = (d) => [
 // should not be asked again just because a copy drifted. Staleness is a different question with a
 // different answer (`--agent --force`), and it is reported by name on every init path below.
 const skillsInstalled = (cwd) => hostTargets(cwd).every((t) => AGENT_SKILLS.every((s) => existsSync(join(t.skillsDir, s, "SKILL.md"))));
-const wizardDriverDefault = () => process.env.HERDR_ENV === "1" ? "herdr" : "auto";
+const wizardDriverDefault = () => process.env.HERDR_ENV === "1" ? "herdr" : orcaHostDetected() ? "orca" : "auto";
+function packageName(cwd) {
+    try {
+        const parsed = JSON.parse(readFileSync(join(cwd, "package.json"), "utf8"));
+        return typeof parsed.name === "string" ? parsed.name : null;
+    }
+    catch {
+        return null;
+    }
+}
+function gitTracked(cwd, path) {
+    const rel = relative(cwd, path);
+    if (rel.startsWith(".."))
+        return false;
+    try {
+        execFileSync("git", ["ls-files", "--error-unmatch", "--", rel], { cwd, stdio: "ignore" });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 async function installAgentFiles(cwd, force, docs, notes) {
     const interactive = process.stdin.isTTY === true && process.stdout.isTTY === true;
     let prompt;
@@ -257,13 +268,14 @@ async function installAgentFiles(cwd, force, docs, notes) {
                     notes.push(`kept current ${dest}`);
                     continue;
                 }
+                const tracked = exists && gitTracked(cwd, dest);
                 if (exists && !force && !(await confirm(`Overwrite ${dest} (${describeDrift(stale)})?`))) {
-                    notes.push(`skipped existing ${dest} — ${describeDrift(stale)}; pass --force to overwrite it`);
+                    notes.push(`skipped existing ${tracked ? "tracked " : ""}${dest} — ${describeDrift(stale)}; pass --force to overwrite it`);
                     continue;
                 }
                 // whole skill dir, not just SKILL.md — the overseer ships its pane-watcher script
                 cpSync(fileURLToPath(new URL(`../../../skills/${skill}`, import.meta.url)), join(skillsDir, skill), { recursive: true });
-                notes.push(`${exists ? "overwrote" : "wrote"} ${dest}`);
+                notes.push(`${exists ? "overwrote" : "wrote"} ${tracked ? "tracked " : ""}${dest}`);
             }
             const current = existsSync(docPath) ? readFileSync(docPath, "utf8") : "";
             // The block is CANONICAL guidance ("stated once here, restated nowhere"), so a repo that has
@@ -341,6 +353,9 @@ export async function init(argv, cwd = process.cwd(), io = {}) {
     });
     // banner at START on the visual surface — every init path, not just the wizard, and never trailing the probe (operator report 2026-07-17)
     emitBanner();
+    if (packageName(cwd) === "tickmarkr") {
+        throw new Error("OBS-584: tickmarkr init refuses to run inside the tickmarkr source repository");
+    }
     const gdir = values["global-dir"] ?? globalConfigDir();
     mkdirSync(gdir, { recursive: true });
     const notes = [];

package/dist/cli/commands/plan.js

@@ -1,7 +1,9 @@
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { parseArgs } from "node:util";
 import { allAdapters, discoverChannels, doctorAgeMs, modelAuthExclusions, probeAll, readDoctor, servableExclusions, servabilityLine } from "../../adapters/registry.js";
 import { formatModelAuthLine, contextWindowLints, modelLints, preferEntryLints, ttyVisual } from "../../adapters/model-lints.js";
 import { GLYPHS, dim, rule, title, warn } from "../../brand.js";
-import { parseArgs } from "node:util";
 import { collateralLints, sourceScopeLints } from "../../compile/collateral.js";
 import { classifyContextPath } from "../../compile/native.js";
 import { DEFAULT_CONFIG, overlayPreferShapes, ROUTING_MODES, TIER_RANK } from "../../config/config.js";
@@ -17,6 +19,7 @@ import { loadRoutingProfile } from "../../run/journal.js";
 import { harnessLine, resolveHarness } from "../harness.js";
 import { shq } from "../../adapters/types.js";
 import { shGit } from "../../run/git.js";
+import { driverEvidence, pickDriver } from "../../drivers/index.js";
 // T4 (v1.50): TTY-only brand pass — the title helper frames the routing table, lint/unroutable
 // markers carry the attention glyph, section labels dim to chrome (the doctor/status system).
 // Gated on ttyVisual(): the non-TTY surface returns untouched (byte-pinned, machine-consumable).
@@ -99,16 +102,21 @@ export async function plan(argv, cwd = process.cwd(), adapters = allAdapters(),
     const DOCTOR_STALE_MS = 24 * 60 * 60 * 1000;
     // v1.51 T2: plan previews any mode without a config edit — same source precedence as run
     // (flag > spec front-matter > repo > global > default), same preset compiler.
-    const { values } = parseArgs({ args: argv, options: { mode: { type: "string" } }, allowPositionals: true });
+    const { values } = parseArgs({ args: argv, options: { mode: { type: "string" }, driver: { type: "string" } }, allowPositionals: true });
     if (values.mode !== undefined && !ROUTING_MODES.includes(values.mode)) {
         throw new Error(`--mode must be one of ${ROUTING_MODES.join(" | ")} (got ${values.mode})`);
     }
     const g = loadGraph(cwd);
     const oracleRefusals = new Map();
+    const oracleAdvisories = new Map();
     if (g.tasks.some((task) => task.acceptance.some((item) => typeof item === "object" && item.oracle === "test"))) {
         const listing = await (opts.listTests ?? listVitestTests)(cwd);
         for (const task of g.tasks) {
             const refusals = [];
+            const advisories = [];
+            const authoredTest = task.files
+                .map((path) => path.replace(/^\.\//, ""))
+                .find((path) => /^tests\/.+\.test\.ts$/.test(path) && !/[?*{[]/.test(path) && !existsSync(join(cwd, path)));
             if (listing.status === "failed") {
                 if (task.acceptance.some((item) => typeof item === "object" && item.oracle === "test")) {
                     refusals.push(`acceptance oracle unresolved — runner listing failed: ${listing.error.split("\n")[0]}`);
@@ -116,7 +124,10 @@ export async function plan(argv, cwd = process.cwd(), adapters = allAdapters(),
             }
             else {
                 for (const audit of auditNamedTestOracles(task.acceptance, listing.tests)) {
-                    if (audit.matches.length === 0) {
+                    if (audit.matches.length === 0 && authoredTest) {
+                        advisories.push(`acceptance oracle ${JSON.stringify(audit.criterion)} not yet written (worker authors ${authoredTest})`);
+                    }
+                    else if (audit.matches.length === 0) {
                         refusals.push(`acceptance oracle ${JSON.stringify(audit.criterion)} matches zero runner-listed test names`);
                     }
                     else if (audit.matches.length > 1) {
@@ -126,6 +137,8 @@ export async function plan(argv, cwd = process.cwd(), adapters = allAdapters(),
             }
             if (refusals.length)
                 oracleRefusals.set(task.id, refusals);
+            if (advisories.length)
+                oracleAdvisories.set(task.id, advisories);
         }
     }
     const inputFindings = await taskInputFindings(g.tasks, cwd);
@@ -136,6 +149,7 @@ export async function plan(argv, cwd = process.cwd(), adapters = allAdapters(),
         inputRefusals.set(finding.taskId, [...(inputRefusals.get(finding.taskId) ?? []), finding.detail]);
     }
     const { cfg, mode, source } = resolveRunMode(cwd, { flag: values.mode, spec: g.mode });
+    const selectedDriver = pickDriver(cfg, values.driver);
     // readDoctor cache path: staleness line only fires here (probeAll fallback is fresh by construction).
     const cached = readDoctor(cwd);
     const health = cached ?? (await probeAll(adapters));
@@ -157,6 +171,7 @@ export async function plan(argv, cwd = process.cwd(), adapters = allAdapters(),
     const lines = [
         `tickmarkr plan — dry run (${channels.length} channels available)`,
         `mode: ${mode.mode} (${source}) · explore ${cfg.routing.explore?.mode ?? "on"}`,
+        `driver: ${driverEvidence(cfg, selectedDriver, values.driver)}`,
         harnessLine(resolveHarness(harnessFrom)),
         "",
     ];
@@ -280,6 +295,8 @@ export async function plan(argv, cwd = process.cwd(), adapters = allAdapters(),
                 lines.push(d);
             lints.push(`${t.id}: unroutable — ${msg}`);
         }
+        for (const advisory of oracleAdvisories.get(t.id) ?? [])
+            lines.push(`    ! ${advisory}`);
     }
     const inputWarnings = inputFindings.filter((finding) => finding.severity === "warn");
     if (inputWarnings.length) {

package/dist/cli/commands/report.js

@@ -4,6 +4,7 @@ import { ttyVisual } from "../../adapters/model-lints.js";
 import { addUsage } from "../../adapters/types.js";
 import { dim, rule, title } from "../../brand.js";
 import { loadConfig } from "../../config/config.js";
+import { modelProvider } from "../../gates/review.js";
 import { buildProofBundle, gateDeclined } from "../../report/bundle.js";
 import { compareRuns } from "../../report/compare.js";
 import { estimateCosts } from "../../report/cost.js";
@@ -35,6 +36,22 @@ const channelLabel = (data) => {
     const { adapter, model } = a;
     return typeof adapter === "string" && typeof model === "string" ? `${adapter}:${model}` : EM;
 };
+const modelFromChannel = (channel) => channel.slice(channel.indexOf(":") + 1);
+const reviewerIdentity = (data) => {
+    const details = typeof data.details === "string" ? data.details : "";
+    const fromDetails = /reviewer\s+([^\s;()]+:[^\s;()]+)/i.exec(details)?.[1];
+    const reviewer = typeof data.reviewer === "string" ? data.reviewer : fromDetails;
+    if (!reviewer || !reviewer.includes(":"))
+        return undefined;
+    const vendor = typeof data.vendor === "string"
+        ? data.vendor
+        : /vendor:\s*([^;()]+)/i.exec(details)?.[1]?.trim()
+            ?? /\(([^;:()]+)\):/.exec(details)?.[1]?.trim();
+    const provider = typeof data.provider === "string"
+        ? data.provider
+        : modelProvider(modelFromChannel(reviewer), vendor ?? "unknown");
+    return { reviewer, provider, ...(vendor ? { vendor } : {}) };
+};
 const rateBasis = (row) => {
     if (!row.rate)
         return EM;
@@ -245,6 +262,7 @@ export function renderMarkdownRecord(runId, events, prices = [], rows = []) {
         const dispatches = events.filter((e) => e.taskId === taskId && e.event === "task-dispatch");
         const channels = dispatches.map((e) => channelLabel(e.data));
         const gates = events.filter((e) => e.taskId === taskId && e.event === "gate-result");
+        const leg2 = events.filter((e) => e.taskId === taskId && e.event === "review-leg2");
         const consults = events.filter((e) => e.taskId === taskId && e.event === "consult-verdict");
         const deviations = events.filter((e) => e.taskId === taskId && e.event === "route-deviation");
         const merge = [...events].reverse().find((e) => e.taskId === taskId && e.event === "merge");
@@ -267,10 +285,28 @@ export function renderMarkdownRecord(runId, events, prices = [], rows = []) {
         if (gates.length) {
             for (const g of gates) {
                 // T11: a declined gate never ran — report it as declined, never as a pass.
-                const pass = gateDeclined(g.data) ? "declined" : g.data.pass === true ? "pass" : g.data.pass === false ? "fail" : EM;
+                let pass = gateDeclined(g.data) ? "declined" : g.data.pass === true ? "pass" : g.data.pass === false ? "fail" : EM;
                 const gate = typeof g.data.gate === "string" ? g.data.gate : EM;
+                if (gate === "review" && pass === "pass") {
+                    const reviewer = reviewerIdentity(g.data);
+                    const before = events.slice(0, events.indexOf(g) + 1).reverse()
+                        .find((e) => e.taskId === taskId && e.event === "task-dispatch");
+                    const author = channelLabel(before?.data ?? {});
+                    const authorProvider = author === EM ? "unknown" : modelProvider(modelFromChannel(author));
+                    if (reviewer && authorProvider !== "unknown" && authorProvider === reviewer.provider) {
+                        pass = "pass (same-provider — independence not established)";
+                    }
+                }
                 lines.push(`  - ${gate}: ${pass} — ${firstLine(g.data.details)}`);
             }
+            for (const row of leg2) {
+                const pass = row.data.pass === true ? "pass" : row.data.pass === false ? "fail" : EM;
+                const identity = reviewerIdentity(row.data);
+                const identityText = identity
+                    ? `reviewer ${identity.reviewer}${identity.vendor ? ` (vendor: ${identity.vendor}; provider: ${identity.provider})` : ` (provider: ${identity.provider})`}`
+                    : firstLine(row.data.details);
+                lines.push(`  - review-leg2: ${pass} (supersedes daemon review) — ${identityText}`);
+            }
         }
         else
             lines.push(`  - ${EM}`);

package/dist/cli/commands/verify.d.ts

@@ -4,6 +4,11 @@ export declare function parseCriteria(text: string): AcceptanceItem[];
 export declare const HUMAN_CHANNEL: BillingChannel;
 export declare const HUMAN_AUTHOR: Assignment;
 export declare function verifyStateDir(cwd: string): string;
+/** Linked worktrees share operational state with the repository that owns the common git dir. */
+export declare function verifyStateRoot(cwd: string): Promise<string>;
+/** Cache identity is repository content, never a checkout path. */
+export declare function baselineCachePath(cwd: string, baseSha: string, commands: Record<string, string>): string;
+export declare function excludeAuthorProvider(channels: BillingChannel[], author: BillingChannel): BillingChannel[];
 export declare function verify(argv: string[], cwd?: string): Promise<{
     out: string;
     code: number;

package/dist/cli/commands/verify.js

@@ -1,16 +1,18 @@
 import { createHash } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { dirname, join, resolve } from "node:path";
 import { parseArgs } from "node:util";
 import { allAdapters, probeAll, readDoctor, rolePools } from "../../adapters/registry.js";
 import { channelKey } from "../../adapters/types.js";
 import { loadConfig } from "../../config/config.js";
 import { captureBaseline, detectGateCommands } from "../../gates/baseline.js";
+import { modelProvider } from "../../gates/review.js";
 import { runGates } from "../../gates/run-gates.js";
 import { getTask, loadGraph } from "../../graph/graph.js";
 import { GATE_NAMES } from "../../graph/schema.js";
 import { linkNodeModules, removeWorktree, shGit, shGitOk } from "../../run/git.js";
+import { Journal } from "../../run/journal.js";
 /**
  * tickmarkr verify — the gate battery as a standalone command (OPERATING-MODEL-2026-08-11 item 3).
  *
@@ -59,6 +61,70 @@ const DIRTY_WHY = `refusing to gate a dirty worktree: the shell gates run agains
 export function verifyStateDir(cwd) {
     return join(realpathSync(tmpdir()), "tickmarkr-verify", createHash("sha256").update(cwd).digest("hex").slice(0, 12));
 }
+const STATE_FILES = ["graph.json", "doctor.json", "config.yaml"];
+const LOCKFILES = ["package-lock.json", "npm-shrinkwrap.json", "pnpm-lock.yaml", "yarn.lock", "bun.lock", "bun.lockb"];
+/** Linked worktrees share operational state with the repository that owns the common git dir. */
+export async function verifyStateRoot(cwd) {
+    const commonDir = resolve(cwd, (await shGitOk("git rev-parse --git-common-dir", cwd)).trim());
+    const commonRoot = realpathSync(dirname(commonDir));
+    if (commonRoot === realpathSync(cwd))
+        return cwd;
+    const localState = join(cwd, ".tickmarkr");
+    const commonState = join(commonRoot, ".tickmarkr");
+    return STATE_FILES.some((file) => !existsSync(join(localState, file)) && existsSync(join(commonState, file)))
+        ? commonRoot
+        : cwd;
+}
+const hashParts = (parts) => {
+    const hash = createHash("sha256");
+    for (const part of parts)
+        hash.update(part);
+    return hash.digest("hex").slice(0, 12);
+};
+/** Cache identity is repository content, never a checkout path. */
+export function baselineCachePath(cwd, baseSha, commands) {
+    const lockParts = [];
+    for (const file of LOCKFILES) {
+        const path = join(cwd, file);
+        lockParts.push(file, existsSync(path) ? readFileSync(path) : "<absent>");
+    }
+    const commandParts = Object.entries(commands).sort(([a], [b]) => a.localeCompare(b)).map(([name, command]) => `${name}\0${command}\0`);
+    return join(realpathSync(tmpdir()), "tickmarkr-verify", "cache", `baseline-${baseSha.slice(0, 12)}-${hashParts(lockParts)}-${hashParts(commandParts)}.json`);
+}
+const verdictlessCommands = (baseline, commands) => Object.keys(commands).filter((name) => baseline.commands[name]?.exitCode === undefined);
+export function excludeAuthorProvider(channels, author) {
+    const provider = modelProvider(author.model, author.vendor);
+    return [author, ...channels.filter((candidate) => candidate !== author && modelProvider(candidate.model, candidate.vendor) !== provider)];
+}
+function recordedMerges(repoRoot) {
+    const runs = join(repoRoot, ".tickmarkr", "runs");
+    if (!existsSync(runs))
+        return [];
+    const rows = [];
+    for (const runId of readdirSync(runs).filter((name) => name.startsWith("run-")).sort().reverse()) {
+        const path = join(runs, runId, "journal.jsonl");
+        if (!existsSync(path))
+            continue;
+        for (const line of readFileSync(path, "utf8").split("\n").filter(Boolean)) {
+            try {
+                const row = JSON.parse(line);
+                if (row.event === "merge" && row.taskId && row.data?.commit)
+                    rows.push({ runId, taskId: row.taskId, commit: row.data.commit });
+            }
+            catch { /* torn journal tail is not a merge record */ }
+        }
+    }
+    return rows;
+}
+async function warnWideTaskRange(cwd, stateRoot, taskId, mergeBase) {
+    const inRange = new Set((await shGitOk(`git rev-list --merges '${mergeBase}..HEAD'`, cwd)).trim().split("\n").filter(Boolean));
+    const merges = recordedMerges(stateRoot).filter((row) => inRange.has(row.commit));
+    const own = merges.find((row) => row.taskId === taskId);
+    const others = own ? merges.filter((row) => row.taskId !== taskId) : [];
+    if (own && others.length) {
+        console.error(`verify: WARNING --task ${taskId} range also carries merge commit(s) for ${others.map((row) => `${row.taskId} ${row.commit.slice(0, 12)}`).join(", ")}; ${taskId}'s own merge ${own.commit} is the intended HEAD`);
+    }
+}
 export async function verify(argv, cwd = process.cwd()) {
     const { values } = parseArgs({
         args: argv,
@@ -69,13 +135,18 @@ export async function verify(argv, cwd = process.cwd()) {
             files: { type: "string", multiple: true },
             author: { type: "string" },
             baseline: { type: "string" },
+            record: { type: "string" },
             json: { type: "boolean", default: false },
             "no-review": { type: "boolean", default: false },
             "no-acceptance": { type: "boolean", default: false },
         },
         allowPositionals: false,
     });
-    const cfg = loadConfig(cwd);
+    const stateRoot = await verifyStateRoot(cwd);
+    if (resolve(stateRoot) !== resolve(cwd)) {
+        console.error(`verify: state files graph.json, doctor.json and config.yaml resolved read-only from ${join(stateRoot, ".tickmarkr")} (linked worktree)`);
+    }
+    const cfg = loadConfig(stateRoot);
     const head = (await shGitOk("git rev-parse HEAD", cwd)).trim();
     const baseTip = (await shGitOk(`git rev-parse '${values.base}'`, cwd).catch(() => {
         throw new Error(`--base ${values.base} is not a resolvable ref — pass --base <ref> naming the branch this diff targets`);
@@ -89,9 +160,7 @@ export async function verify(argv, cwd = process.cwd()) {
     let files = values.files ?? [];
     let goal = `independent verification of the ${values.base}..HEAD diff`;
     if (values.task) {
-        const t = getTask(loadGraph(cwd), values.task);
-        if (!t)
-            throw new Error(`--task ${values.task}: no such task in .tickmarkr/graph.json`);
+        const t = getTask(loadGraph(stateRoot), values.task);
         acceptance = t.acceptance;
         if (!files.length)
             files = t.files;
@@ -102,6 +171,8 @@ export async function verify(argv, cwd = process.cwd()) {
         if (!acceptance.length)
             throw new Error(`--criteria ${values.criteria}: no criteria found (bullets or command:/test:/judge: lines)`);
     }
+    if (values.task)
+        await warnWideTaskRange(cwd, stateRoot, values.task, mergeBase);
     const wantAcceptance = acceptance.length > 0 && !values["no-acceptance"];
     const wantReview = !values["no-review"];
     // A gate that enforced nothing must not print a green row. `files` has exactly three sources —
@@ -145,7 +216,7 @@ export async function verify(argv, cwd = process.cwd()) {
     let author = HUMAN_AUTHOR;
     const adapters = allAdapters();
     if (wantAcceptance || wantReview) {
-        const health = readDoctor(cwd) ?? (await probeAll(adapters));
+        const health = readDoctor(stateRoot) ?? (await probeAll(adapters));
         const pools = rolePools(cfg, adapters, health);
         judgeChannels = pools.judge;
         channels = pools.review;
@@ -157,6 +228,7 @@ export async function verify(argv, cwd = process.cwd()) {
                 throw new Error(`--author ${values.author} does not name a discoverable review channel — one of: ${channels.map(channelKey).join(", ") || "(none)"}`);
             }
             author = { adapter: c.adapter, model: c.model, channel: c.channel, tier: c.tier };
+            channels = excludeAuthorProvider(channels, c);
         }
         else {
             channels = [...channels, HUMAN_CHANNEL];
@@ -173,28 +245,56 @@ export async function verify(argv, cwd = process.cwd()) {
     const stateDir = verifyStateDir(cwd);
     mkdirSync(stateDir, { recursive: true });
     let baseline;
-    const cachePath = join(stateDir, `baseline-${mergeBase.slice(0, 12)}.json`);
+    const cachePath = baselineCachePath(cwd, mergeBase, commands);
+    const verdictlessMarker = `${cachePath}.verdictless`;
+    mkdirSync(dirname(cachePath), { recursive: true });
     if (values.baseline) {
         baseline = JSON.parse(readFileSync(values.baseline, "utf8"));
     }
-    else if (existsSync(cachePath)) {
-        console.error(`verify: reusing cached baseline for ${mergeBase.slice(0, 12)} (${cachePath})`);
-        baseline = JSON.parse(readFileSync(cachePath, "utf8"));
-    }
     else {
-        const baseDir = join(stateDir, `base-${mergeBase.slice(0, 12)}`);
-        console.error(`verify: capturing baseline at merge-base ${mergeBase.slice(0, 12)} (one-time per base; cached at ${cachePath})`);
-        await shGit(`git worktree remove --force '${baseDir}'`, cwd); // stale leftover from an interrupted run
-        await shGitOk(`git worktree add --detach '${baseDir}' '${mergeBase}'`, cwd);
-        try {
-            linkNodeModules(cwd, baseDir, { force: true });
-            baseline = await captureBaseline(baseDir, commands);
-            writeFileSync(cachePath, JSON.stringify(baseline, null, 2));
+        let cached;
+        if (existsSync(cachePath)) {
+            cached = JSON.parse(readFileSync(cachePath, "utf8"));
+            const missing = verdictlessCommands(cached, commands);
+            if (missing.length) {
+                console.error(`verify: cached baseline recorded no verdict for ${missing.join(", ")}; it was not reusable and will be recaptured`);
+                rmSync(cachePath, { force: true });
+                cached = undefined;
+            }
         }
-        finally {
-            await removeWorktree(cwd, baseDir);
+        if (cached) {
+            console.error(`verify: reusing cached baseline for ${mergeBase.slice(0, 12)} (${cachePath})`);
+            baseline = cached;
+        }
+        else {
+            if (existsSync(verdictlessMarker)) {
+                console.error(`verify: prior baseline recorded no verdict and was not cached; recapturing merge-base ${mergeBase.slice(0, 12)}`);
+            }
+            else {
+                console.error(`verify: capturing baseline at merge-base ${mergeBase.slice(0, 12)} (cached by base, lockfile and command hashes at ${cachePath})`);
+            }
+            const baseDir = join(stateDir, `base-${mergeBase.slice(0, 12)}`);
+            await shGit(`git worktree remove --force '${baseDir}'`, cwd); // stale leftover from an interrupted run
+            await shGitOk(`git worktree add --detach '${baseDir}' '${mergeBase}'`, cwd);
+            try {
+                linkNodeModules(cwd, baseDir, { force: true });
+                baseline = await captureBaseline(baseDir, commands);
+                const missing = verdictlessCommands(baseline, commands);
+                if (missing.length) {
+                    writeFileSync(verdictlessMarker, JSON.stringify({ base: mergeBase, commands: missing }) + "\n");
+                    rmSync(cachePath, { force: true });
+                }
+                else {
+                    writeFileSync(cachePath, JSON.stringify(baseline, null, 2));
+                    rmSync(verdictlessMarker, { force: true });
+                }
+            }
+            finally {
+                await removeWorktree(cwd, baseDir);
+            }
         }
     }
+    const recordJournal = values.record ? Journal.open(stateRoot, values.record) : undefined;
     const artifactDir = join(stateDir, new Date().toISOString().replace(/[:.]/g, "-"));
     mkdirSync(artifactDir, { recursive: true });
     const { results } = await runGates(task, {
@@ -205,17 +305,34 @@ export async function verify(argv, cwd = process.cwd()) {
         onGate: (e) => {
             if (e.phase === "start")
                 console.error(`verify: → ${e.gate} (${e.index}/${e.total})`);
+            else if (e.phase === "note")
+                console.error(`verify: note ${e.gate} ${e.name} ${JSON.stringify(e.payload)}`);
             else
                 console.error(`verify: ${e.result.pass ? "✓" : "✗"} ${e.result.gate} — ${e.result.details.split("\n")[0] ?? ""}`);
         },
     });
     const green = results.length > 0 && results.every((r) => r.pass || r.meta?.skipped === true);
+    const reviewRows = results.filter((result) => result.gate === "review");
+    const reviewFindings = reviewRows.flatMap((result) => result.details.split("\n").flatMap((line) => {
+        const match = /^- \[([^\]]+)\] (.*)$/.exec(line);
+        return match ? [{ classification: match[1], note: match[2], reviewer: result.meta?.reviewer }] : [];
+    }));
+    const artifactPath = join(artifactDir, "verify-results.json");
+    writeFileSync(artifactPath, JSON.stringify({ base: baseTip, head, mergeBase, green, gateRows: results, reviewFindings }, null, 2) + "\n");
+    console.error(`verify: artifacts written to ${artifactPath}`);
+    const review = reviewRows.at(-1);
+    if (recordJournal && review) {
+        recordJournal.append("review-leg2", values.task ?? "VERIFY", {
+            base: baseTip, head, mergeBase, author: channelKey(author), artifactPath,
+            ...review,
+        });
+    }
     if (values.json) {
-        return { out: JSON.stringify({ base: baseTip, head, mergeBase, green, results }, null, 2), code: green ? 0 : 2 };
+        return { out: JSON.stringify({ base: baseTip, head, mergeBase, green, artifactPath, results }, null, 2), code: green ? 0 : 2 };
     }
     const lines = results.map((r) => `${r.pass ? "PASS" : "FAIL"} ${r.gate}\n${r.details.split("\n").map((l) => `  ${l}`).join("\n")}`);
     const verdict = green
-        ? `verify GREEN — ${results.length} gate(s) passed on ${mergeBase.slice(0, 12)}..${head.slice(0, 12)} (merge is a human decision)`
-        : `verify RED — first failure decides; artifacts in ${artifactDir}`;
+        ? `verify GREEN — ${results.length} gate(s) passed on ${mergeBase.slice(0, 12)}..${head.slice(0, 12)} (merge is a human decision; artifacts: ${artifactPath})`
+        : `verify RED — first failure decides; artifacts: ${artifactPath}`;
     return { out: [...lines, "", verdict].join("\n"), code: green ? 0 : 2 };
 }

package/dist/cli/commands/version.d.ts

@@ -1 +1,2 @@
-export declare function version(_argv?: string[]): Promise<string>;
+export declare function distFingerprint(dir?: string): string;
+export declare function version(argv?: string[], dir?: string): Promise<string>;

package/dist/cli/commands/version.js

@@ -1,8 +1,29 @@
-import { readFileSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
+import { dirname, join, relative } from "node:path";
 import { fileURLToPath } from "node:url";
 const pkgPath = join(dirname(fileURLToPath(import.meta.url)), "../../../package.json");
-export async function version(_argv = []) {
+const distDir = join(dirname(pkgPath), "dist");
+export function distFingerprint(dir = distDir) {
+    if (!existsSync(dir))
+        return "missing";
+    const files = [];
+    const visit = (path) => {
+        for (const entry of readdirSync(path, { withFileTypes: true })) {
+            const child = join(path, entry.name);
+            if (entry.isDirectory())
+                visit(child);
+            else if (entry.isFile())
+                files.push(child);
+        }
+    };
+    visit(dir);
+    const hash = createHash("sha256");
+    for (const file of files.sort())
+        hash.update(relative(dir, file)).update("\0").update(readFileSync(file)).update("\0");
+    return hash.digest("hex");
+}
+export async function version(argv = [], dir = distDir) {
     const { version: v } = JSON.parse(readFileSync(pkgPath, "utf8"));
-    return v;
+    return argv.includes("--dist") ? `${v} dist:${distFingerprint(dir)}` : v;
 }

package/dist/compile/collateral.js

@@ -1,4 +1,4 @@
-import { readdirSync, readFileSync, statSync } from "node:fs";
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
 import { extname, join, relative } from "node:path";
 import { filesGlob } from "../graph/files-glob.js";
 import { criticalPathHits, DEFAULT_CONFIG, DEFAULT_REVIEW_CRITICAL_PATHS, effectiveReviewPolicy, loadConfig, } from "../config/config.js";
@@ -15,6 +15,7 @@ const MAX_WALK_FILES = 400;
 const MAX_HITS_PER_TASK = 20;
 /** Skip giant fixtures / snapshots. */
 const MAX_READ_BYTES = 512 * 1024;
+const EXPORT_MANIFEST_TEST = "tests/repo/export-manifest.test.ts";
 const SRC_EXT = /\.(ts|tsx|js|jsx|mts|cts)$/;
 const CODE_EXT = /\.(ts|tsx|js|jsx|mts|cts)$/;
 function isSrcPath(p) {
@@ -112,15 +113,20 @@ export function collateralHits(tasks, repoRoot) {
     const read = makeReader(repoRoot);
     for (const t of tasks) {
         // OBS-22: scopeGate accepts picomatch globs; advisory collateral warnings must agree.
-        const scoped = filesGlob(t.files.map((f) => f.replace(/^\.\//, "")));
-        const srcFiles = t.files.map((f) => f.replace(/^\.\//, "")).filter(isSrcPath);
-        if (!srcFiles.length)
-            continue;
+        const files = t.files.map((f) => f.replace(/^\.\//, ""));
+        const scoped = filesGlob(files);
+        const srcFiles = files.filter(isSrcPath);
+        const hits = [];
+        // Exact-enumerated scripts are an export-set contract: a new path has no name or symbol for the
+        // ordinary sweep to find, but the manifest test will reject it unless the task owns that oracle.
+        if (testFiles.includes(EXPORT_MANIFEST_TEST)
+            && !scoped(EXPORT_MANIFEST_TEST)
+            && files.some((path) => path.startsWith("scripts/") && !/[?*{[]/.test(path) && !existsSync(join(repoRoot, path))))
+            hits.push(EXPORT_MANIFEST_TEST);
         // needles unioned across all src files in this task
         const needles = [...new Set(srcFiles.flatMap(needlesFor))];
-        const hits = [];
         for (const tf of testFiles) {
-            if (scoped(tf))
+            if (scoped(tf) || hits.includes(tf))
                 continue;
             const text = read(tf);
             if (text === null)
@@ -128,9 +134,9 @@ export function collateralHits(tasks, repoRoot) {
             if (mentions(text, needles))
                 hits.push(tf);
         }
-        // deterministic: walk already sorted; stable list
+        // deterministic: the special hit and walk are stable; sort their union for one canonical map.
         if (hits.length)
-            map.set(t.id, hits);
+            map.set(t.id, hits.sort());
     }
     return map;
 }