tickmarkr 2.2.0 → 2.3.0

package/skills/tickmarkr-overseer/scripts/watch-artifacts.sh

@@ -1,7 +1,7 @@
 #!/bin/bash
 # Wake the overseer when spawned seats have actually DELIVERED.
 #
-#   watch-artifacts.sh <marker> <cap-seconds> <poll-seconds> <file>...
+#   watch-artifacts.sh [--changed-from <sha|mtime|now>] <marker> <cap-seconds> <poll-seconds> <file>...
 #
 # Completion is the ARTIFACT plus its TERMINAL MARKER — never an agent's `done`, which is turn end and
 # fires the moment a seat finishes acknowledging you. Never file existence alone either: a seat killed
@@ -26,12 +26,29 @@ set -u
 # arm crashed before printing its reason — a watcher that dies without a wake reason is the exact failure
 # this script exists to prevent.
 
-MARKER="${1:?usage: watch-artifacts.sh <marker> <cap-seconds> <poll-seconds> <file>...}"
+CHANGED_FROM=""
+if [ "${1:-}" = "--changed-from" ]; then
+  CHANGED_FROM="${2:?--changed-from requires a sha, prior mtime, or 'now'}"
+  shift 2
+fi
+
+MARKER="${1:?usage: watch-artifacts.sh [--changed-from <sha|mtime|now>] <marker> <cap-seconds> <poll-seconds> <file>...}"
 CAP="${2:?}"
 POLL="${3:?}"
 shift 3
 [ "$#" -gt 0 ] || { echo "watch-artifacts: no files given" >&2; exit 2; }
 
+# OBS-848: ownership is a pid-file fact, never an argv/path pattern. Two tiers intentionally watch
+# the same artifacts, so the journal/file argument cannot identify which watcher a seat may retire.
+PID_DIR="${TKR_STATE_DIR:-.tickmarkr}/overseer/pids"
+PID_SEAT=$(printf '%s' "${TKR_ARMING_SEAT:-unattributed}" | sed 's/[^A-Za-z0-9_-]/_/g')
+PID_FILE="$PID_DIR/${PID_SEAT}-watch-artifacts-$$.pid"
+mkdir -p "$PID_DIR" && (umask 077; printf '%s\n' "$$" > "$PID_FILE") || {
+  echo "watch-artifacts: cannot record pid under $PID_DIR" >&2; exit 73;
+}
+clear_pid() { rm -f "$PID_FILE"; }
+trap clear_pid EXIT
+
 # Cap BELOW the host's background-job kill so every arm ends by PRINTING something. A job killed at the
 # limit carries no wake reason and is indistinguishable from a real wake until you read the output —
 # OBS-325, re-earned by a third watcher that had not been capped because the fix was applied only to the
@@ -74,6 +91,22 @@ END=$((SECONDS + CAP))
 # RUNTIME, where the arithmetic then errors, `done_file` returns 1 forever, and the watcher never wakes.
 # Caught by the drill below, not by the syntax check. A syntax check is not a positive control.
 PREV=()
+BASELINE=()
+i=0
+for f in "$@"; do
+  if [ -n "$CHANGED_FROM" ]; then
+    # A SHA is an explicit single-artifact baseline. Historical callers recorded mtimes; retain that
+    # spelling as the arming signal but capture content now, because equal-length rewrites and touches
+    # prove that mtime is not the property this watcher claims to read.
+    if printf '%s' "$CHANGED_FROM" | grep -qE '^[0-9a-fA-F]{40}$' && [ "$#" -eq 1 ]; then
+      BASELINE[$i]=$(printf '%s' "$CHANGED_FROM" | tr 'A-F' 'a-f')
+    else
+      BASELINE[$i]=$(shasum -a 1 "$f" 2>/dev/null | cut -d' ' -f1)
+    fi
+  fi
+  i=$((i + 1))
+done
+
 done_file() {                  # $1 = index into "$@", $2 = path
   local i="$1" f="$2" sig
   [ -s "$f" ] || return 1
@@ -85,6 +118,7 @@ done_file() {                  # $1 = index into "$@", $2 = path
   # catch. Hashing 48KB per poll costs nothing.
   sig=$(shasum -a 1 "$f" 2>/dev/null | cut -d' ' -f1)
   [ -n "$sig" ] || return 1
+  if [ -n "$CHANGED_FROM" ] && [ "${BASELINE[$i]:-}" = "$sig" ]; then return 1; fi
   if [ "${PREV[$i]:-}" = "$sig" ]; then return 0; fi
   PREV[$i]="$sig"              # marked but still moving — hold it one more poll
   return 1

package/skills/tickmarkr-overseer/scripts/watch-contamination.sh

@@ -21,8 +21,16 @@ LOAD_CEIL="${2:-24}"
 POLL="${3:-45}"
 CAP="${4:-14400}"
 
-STATE="$(dirname "$J")/.contamination.seen"
-: > "$STATE" 2>/dev/null || STATE="/tmp/.contamination.seen.$$"
+# OBS-848: the arming seat owns this pid, even when a partner watches the same journal. Never derive
+# retirement ownership from the script or journal argv: both are deliberately shared across tiers.
+PID_DIR="${TKR_STATE_DIR:-.tickmarkr}/overseer/pids"
+PID_SEAT=$(printf '%s' "${TKR_ARMING_SEAT:-unattributed}" | sed 's/[^A-Za-z0-9_-]/_/g')
+PID_FILE="$PID_DIR/${PID_SEAT}-watch-contamination-$$.pid"
+mkdir -p "$PID_DIR" && (umask 077; printf '%s\n' "$$" > "$PID_FILE") || {
+  echo "watch-contamination: cannot record pid under $PID_DIR" >&2; exit 73;
+}
+clear_pid() { rm -f "$PID_FILE"; }
+trap clear_pid EXIT
 
 # Fingerprints of a harness collapse rather than a real regression. Deliberately narrow: a genuine
 # assertion failure must NOT match, or the watcher launders real defects into "infra".
@@ -35,11 +43,8 @@ load1() { uptime | sed 's/.*load averages*: *//' | awk '{print $1}' | tr -d ',';
 vitest_n() { ps -axo comm,command 2>/dev/null | grep -Ec 'node_modules/(\.bin/)?[v]itest|[v]itest/dist/|\([v]itest [0-9]+\)'; }
 
 # Seed the seen-set so we wake on what happens NEXT, not on history already ruled on.
-if [ -f "$J" ]; then
-  grep -c '' "$J" > "$STATE" 2>/dev/null || echo 0 > "$STATE"
-else
-  echo 0 > "$STATE"
-fi
+if [ -f "$J" ]; then seen=$(grep -c '' "$J" 2>/dev/null); else seen=0; fi
+[ -n "$seen" ] || seen=0
 
 elapsed=0
 while [ "$elapsed" -lt "$CAP" ]; do
@@ -54,18 +59,34 @@ while [ "$elapsed" -lt "$CAP" ]; do
   Li=$(printf %s "$L" | sed "s/[^0-9].*//"); [ -z "$Li" ] && Li=0
 
   if [ -f "$J" ]; then
-    seen=$(cat "$STATE" 2>/dev/null); [ -z "$seen" ] && seen=0
     now=$(grep -c '' "$J" 2>/dev/null); [ -z "$now" ] && now=0
     if [ "$now" -gt "$seen" ]; then
       newrows=$(tail -n "$((now - seen))" "$J" 2>/dev/null)
-      echo "$now" > "$STATE"
-      hit=$(printf '%s\n' "$newrows" \
-        | grep '"event":"gate-result"' \
-        | grep '"pass":false' \
-        | grep -E "$INFRA_RE" | head -1)
+      seen="$now"
+      # A fingerprint in arbitrary JSON details is prose, not an occurrence. Parse the event shape,
+      # admit only runner gates, and stop before the baseline classifier's secondary echo list. Review
+      # findings and acceptance prose are deliberately outside this instrument's claim.
+      hit=$(printf '%s\n' "$newrows" | python3 -c '
+import json, re, sys
+infra = re.compile(sys.argv[1], re.I)
+for raw in sys.stdin:
+    try: row = json.loads(raw)
+    except Exception: continue
+    data = row.get("data") or {}
+    gate = data.get("gate")
+    if row.get("event") != "gate-result" or data.get("pass") is not False or gate not in {"test", "build", "lint"}: continue
+    details = str(data.get("details") or "")
+    runner = re.split(r"(?im)^new failure fingerprints vs baseline \(secondary\):[ \t]*$", details, maxsplit=1)[0]
+    match = infra.search(runner)
+    if match:
+        end = runner.find("\n", match.end())
+        line = runner[runner.rfind("\n", 0, match.start()) + 1:end if end >= 0 else len(runner)]
+        print("%s\t%s\t%s" % (row.get("taskId", ""), gate, line))
+        break
+' "$INFRA_RE")
       if [ -n "$hit" ]; then
-        task=$(printf '%s' "$hit" | sed -n 's/.*"taskId":"\([^"]*\)".*/\1/p')
-        gate=$(printf '%s' "$hit" | sed -n 's/.*"gate":"\([^"]*\)".*/\1/p')
+        task=$(printf '%s' "$hit" | cut -f1)
+        gate=$(printf '%s' "$hit" | cut -f2)
         echo "CONTAMINATED_VERDICT task=$task gate=$gate load=$L vitest=$V"
         echo "  an infra fingerprint appeared in a FAILED gate — this red is not evidence about the diff"
         echo "  ruling owed: is the attempt chargeable? (OBS-426: infra failures are not)"

package/skills/tickmarkr-overseer/scripts/watch-context.sh

@@ -33,7 +33,7 @@
 # usage: watch-context.sh <role-slug> <agent|pane> <warn-pct> <act-pct> [handoff-file] [poll-s] [cap-s]
 #   <role-slug> is ANY seat role — orchestrator, overseer, surgeon, consult — and names the tier
 #   `<role>-context`. It is deliberately NOT a closed set: see OBS-730 at the guard below.
-#   TKR_AUTO_CLEAR=1   at act-pct WITH a fresh handoff, send /clear and re-brief instead of waking.
+#   TKR_AUTO_CLEAR=1   at act-pct WITH a fresh handoff, auto-clear orchestrator/overseer; other roles wake only.
 #   TKR_REBRIEF=<path> the file the re-briefed seat is told to read (defaults to the handoff).
 #   TKR_HANDOFF_MAX_AGE_S  how fresh "fresh" is (default 900).
 #   TKR_CLEAR_SETTLE_S     seconds to let a cleared seat settle before the re-brief (default 6).
@@ -63,6 +63,15 @@ case "$ROLE" in
 esac
 TIER="${ROLE}-context"
 
+# A shared target does not identify its watcher owner. The arming seat records this exact pid under
+# the repository state dir; retirement reads that file and never matches a script/target name pattern.
+PID_DIR="${TKR_STATE_DIR:-.tickmarkr}/overseer/pids"
+PID_SEAT=$(printf '%s' "${TKR_ARMING_SEAT:-unattributed}" | sed 's/[^A-Za-z0-9_-]/_/g')
+PID_FILE="$PID_DIR/${PID_SEAT}-watch-context-$$.pid"
+mkdir -p "$PID_DIR" && (umask 077; printf '%s\n' "$$" > "$PID_FILE") || {
+  echo "watch-context: cannot record pid under $PID_DIR" >&2; exit 73;
+}
+clear_pid() { rm -f "$PID_FILE"; }
 
 # The supervision beat interval (SUPERVISION_BEAT_MS = 10s). The loop ticks at the beat cadence or the
 # caller's poll, whichever is SHORTER. Every successful screen read beats; its result is either a
@@ -100,7 +109,8 @@ beat() {
 stand_down() { tickmarkr beat "$TIER" --stand-down --seat "$SEAT" >/dev/null 2>&1; return 0; }
 # EVERY terminal exit — act, unsafe-act, cap — leaves through here, so none of them can forget to
 # record the hand-off. A killed watcher never runs it, which is the one case that must read STALE.
-trap stand_down EXIT
+cleanup() { stand_down; clear_pid; }
+trap cleanup EXIT
 
 # ── WHERE THE NUMBER COMES FROM, and this is the whole 2.1.7-series lesson ────────────────────────────
 # The shipped version read a TERMINAL RENDERING and nothing else. Every context-measurement failure of
@@ -189,15 +199,31 @@ print(int(round(fill * 100.0 / window)))
 ' "$CTX_JSONL" "$CTX_WINDOW" 2>/dev/null
 }
 
-# The banner path stays as the FALLBACK, unchanged: select the model line first, then read a percentage
-# only from it, so a bare numeric search cannot borrow an old N% from scrollback (OBS-780).
+# The banner path stays as the FALLBACK, and it now selects by POSITION (OBS-865). A seat's statusline
+# renders BELOW the input box's horizontal rule, so the only rows that can carry THIS seat's fill are the
+# rows after the LAST rule line in the window. A tip, a transcript row, or a decoy quoting another seat's
+# percentage sits ABOVE that rule and can no longer be chosen. The previous selector took the last
+# vendor-word line ANYWHERE in the window: on a Fable seat that was `Tip: Ask Claude ...` (UNREADABLE,
+# duty silently dead), and a quoted `opus 12%` would have been read as this seat's fill. The model
+# vocabulary survives only as a SANITY CHECK on the already-chosen row, never as the selector (OBS-780).
 banner_pct() {
   local screen banner pct
   screen=$(herdr agent read "$TARGET" --source visible --lines 8 2>/dev/null) || return 1
-  banner=$(printf '%s\n' "$screen" |
-    grep -Ei '(^|[^[:alnum:]])(claude|opus|sonnet|haiku|gpt|gemini|glm|kimi|grok|composer|openai|zai)[[:alnum:]_./-]*([[:space:]]|$)' |
-    tail -1)
+  # The rule glyph is passed IN, never written as an escape: this host's awk (BWK 20200816) does not
+  # honour \xNN, and an unsupported escape matches nothing — the selector would find no rule line and
+  # report UNREADABLE on every real pane while staying green against any fixture that skipped awk.
+  banner=$(printf '%s\n' "$screen" | awk -v rule='─' '
+    { line[NR] = $0
+      bare = $0; gsub(/[[:space:]]/, "", bare)
+      stripped = bare; gsub(rule, "", stripped)
+      if (bare != "" && stripped == "") last = NR }
+    END { if (last) for (i = last + 1; i <= NR; i++) if (line[i] ~ /[0-9]+%/) print line[i] }
+  ' | tail -1)
+  # No rule line in the window, or no percentage below it: say so out loud rather than guess.
   [ -n "$banner" ] || { printf 'UNREADABLE\n'; return 0; }
+  printf '%s\n' "$banner" |
+    grep -Eqi '(^|[^[:alnum:]])(claude|opus|sonnet|haiku|fable|gpt|gemini|glm|kimi|grok|composer|openai|zai)[[:alnum:]_./-]*([[:space:]]|$)' ||
+    { printf 'UNREADABLE\n'; return 0; }
   pct=$(printf '%s\n' "$banner" | grep -oE '[0-9]+%' | tail -1 | tr -d '%')
   [ -n "$pct" ] && printf '%s\n' "$pct" || printf 'UNREADABLE\n'
 }
@@ -221,10 +247,10 @@ handoff_fresh() {
 act_on() {
   local P="$1"
   if handoff_fresh; then
-    if [ "${TKR_AUTO_CLEAR:-0}" = "1" ]; then
+    if [ "${TKR_AUTO_CLEAR:-0}" = "1" ] && { [ "$ROLE" = "orchestrator" ] || [ "$ROLE" = "overseer" ]; }; then
       herdr agent prompt "$TARGET" "/clear" >/dev/null 2>&1
       sleep "$SETTLE"
-      herdr agent prompt "$TARGET" "Read ${REBRIEF} and continue exactly where it says. Your context was cleared at ${P}% against that handoff; it is current as of $(date '+%H:%M'). Do not reconstruct from memory — everything you need is on disk." >/dev/null 2>&1
+      herdr agent prompt "$TARGET" "Read ${REBRIEF} and continue exactly where it says. Your context was cleared at ${P}% against that handoff; it is current as of $(date '+%H:%M'). The same-process clear kept every background task alive: kill only this seat's recorded watcher pids first, verify the process table twice, then re-arm. Do not reconstruct from memory — everything you need is on disk." >/dev/null 2>&1
       echo "CONTEXT_CLEARED $TARGET at ${P}% — handoff fresh, re-briefed from ${REBRIEF}"
       exit 0
     fi

package/skills/tickmarkr-overseer/scripts/watch-pending-input.sh

@@ -21,6 +21,17 @@ POLL="${2:-30}"
 CAP="${3:-14400}"
 CONFIRM="${4:-2}"        # consecutive polls before waking — a draft mid-typing is not a stall
 
+# The path/target is shared evidence, not ownership. Record the arming seat and this exact process so
+# stand-down can retire only what that seat armed, without a pgrep pattern that catches its partner.
+PID_DIR="${TKR_STATE_DIR:-.tickmarkr}/overseer/pids"
+PID_SEAT=$(printf '%s' "${TKR_ARMING_SEAT:-unattributed}" | sed 's/[^A-Za-z0-9_-]/_/g')
+PID_FILE="$PID_DIR/${PID_SEAT}-watch-pending-input-$$.pid"
+mkdir -p "$PID_DIR" && (umask 077; printf '%s\n' "$$" > "$PID_FILE") || {
+  echo "watch-pending-input: cannot record pid under $PID_DIR" >&2; exit 73;
+}
+clear_pid() { rm -f "$PID_FILE"; }
+trap clear_pid EXIT
+
 status_of() {
   herdr agent get "$TARGET" 2>/dev/null \
     | sed -n 's/.*"agent_status":"\([a-z_]*\)".*/\1/p' | head -1
@@ -35,8 +46,11 @@ status_of() {
 # no wake, no streak. Negative scope: sampled on one theme/version; a theme rendering typed input dim
 # would blind this check TOWARD silence, so a wake is still authoritative but its absence is not proof.
 is_ghost() {
-  herdr agent read "$TARGET" --source visible --lines 14 --format ansi 2>/dev/null \
-    | grep -F -- "❯" | grep -F -- "$1" | head -1 | grep -q "$(printf '\033')\[2m"
+  (
+    export LC_ALL=C
+    herdr agent read "$TARGET" --source visible --lines 14 --format ansi 2>/dev/null \
+      | grep -F -- "❯" | grep -F -- "$1" | head -1 | grep -q "$(printf '\033')\[2m"
+  )
 }
 
 pending_text() {
@@ -175,8 +189,11 @@ while [ "$elapsed" -lt "$CAP" ]; do
           # typed draft. Ghost text renders dim/grey; typed text renders default. Emit the styled
           # bytes so the reader can discriminate before treating this as a draft.
           echo "  styling evidence (dim/grey SGR around the text = autosuggest ghost, NOT a draft):"
-          herdr agent read "$TARGET" --source visible --lines 14 --format ansi 2>/dev/null \
-            | grep -F -- "$T" | head -2 | cat -v | sed 's/^/    /'
+          (
+            export LC_ALL=C
+            herdr agent read "$TARGET" --source visible --lines 14 --format ansi 2>/dev/null \
+              | grep -F -- "$T" | head -2 | cat -v | sed 's/^/    /'
+          )
           echo "  the seat is idle and holding live work in its prompt — supersede it, do not re-send:"
           echo "  herdr agent prompt $TARGET \" <-- disregard everything before this arrow (stale draft). ACTUAL: …\""
           # Name the ACTUAL reason we fell through. Saying "budget exhausted" when the cause was the
@@ -208,10 +225,17 @@ done
 echo "WATCH_CAP_REACHED $TARGET status=$(status_of) — no sustained pending input in ${CAP}s"
 FINAL=$(pending_text)
 if [ -n "$FINAL" ]; then
-  echo "  final read (UNSUSTAINED — present at cap, not confirmed across polls): $FINAL"
-  echo "  styling evidence (dim/grey SGR = autosuggest ghost, NOT a draft):"
-  herdr agent read "$TARGET" --source visible --lines 14 --format ansi 2>/dev/null \
-    | grep -F -- "$FINAL" | head -2 | cat -v | sed 's/^/    /'
+  if is_ghost "$FINAL"; then
+    echo "  final read: autosuggest ghost ignored (dim SGR), input box has no typed draft"
+  else
+    echo "  final read (UNSUSTAINED — present at cap, not confirmed across polls): $FINAL"
+    echo "  styling evidence (dim/grey SGR = autosuggest ghost, NOT a draft):"
+    (
+      export LC_ALL=C
+      herdr agent read "$TARGET" --source visible --lines 14 --format ansi 2>/dev/null \
+        | grep -F -- "$FINAL" | head -2 | cat -v | sed 's/^/    /'
+    )
+  fi
 else
   echo "  final read: input box empty"
 fi