tickmarkr 2.5.0 → 2.5.2

package/dist/gates/review.js

@@ -6,6 +6,7 @@ import { filesGlob } from "../graph/files-glob.js";
 import { renderAcceptanceItem } from "../graph/schema.js";
 import { getAdapter } from "../adapters/registry.js";
 import { shOk } from "../run/git.js";
+import { structuredFindings } from "../run/journal.js";
 import { redactSecrets } from "../run/redact.js";
 import { marginalCostRank } from "../route/router.js";
 import { modelProvider } from "../route/preference.js";
@@ -178,7 +179,7 @@ export function pickReviewer(author, channels, exclude = [], // v1.1 failover: r
 prefer = [], // v1.53 T2: review.prefer — reorders eligible channels, never changes eligibility
 floor, // task-declared only; config floors govern workers and must not silently move review seats
 history = [], // run-scoped picks, oldest to newest; empty preserves the established ranking
-onSeat) {
+onSeat, demoted = new Set()) {
     // FLEET-05 success criterion 2: an author not resolvable in the channel list yields NO reviewer.
     // The old `?? author.adapter` fallback compared an adapter id to vendor names, matched nothing, and
     // admitted every reviewer — including the author's own channel (fail-OPEN). null lands on reviewGate's
@@ -188,20 +189,21 @@ onSeat) {
         return null;
     const authorProvider = modelProvider(author.model, authorChannel.vendor);
     const ranked = channels
-        // two independent axes: different vendor AND different base-model identity (ADDED TO the vendor
-        // rule, never replacing it — a future edit can't silently drop either). Failover additionally guards
-        // true provider identity; the initial pick keeps the established stamped-vendor contract. The diversity
+        // Three independent axes: different vendor, different resolved provider identity (OBS-946: on initial pick
+        // as well as failover, so an aggregator channel stamped "mixed" never seats the author's own provider),
+        // and different base-model identity (ADDED TO the vendor rule, never replacing it). The diversity
         // filter runs BEFORE preference ranking, so prefer cannot resurrect an excluded channel.
         .filter((c) => c.vendor !== authorChannel.vendor
-        && (exclude.length === 0 || modelProvider(c.model, c.vendor) !== authorProvider)
+        && modelProvider(c.model, c.vendor) !== authorProvider
         && modelId(c.model) !== modelId(author.model)
         && !exclude.includes(channelKey(c))
         && (floor === undefined || TIER_RANK[c.tier] >= TIER_RANK[floor]))
         .sort((a, b) => reviewPreferIndex(a, prefer) - reviewPreferIndex(b, prefer) || TIER_RANK[b.tier] - TIER_RANK[a.tier] || marginalCostRank(a) - marginalCostRank(b));
-    const reviewer = [...ranked].sort((a, b) => history.lastIndexOf(channelKey(a)) - history.lastIndexOf(channelKey(b))
+    const reviewer = [...ranked].sort((a, b) => Number(demoted.has(channelKey(a))) - Number(demoted.has(channelKey(b)))
+        || history.lastIndexOf(channelKey(a)) - history.lastIndexOf(channelKey(b))
         || ranked.indexOf(a) - ranked.indexOf(b))[0] ?? null;
     if (reviewer)
-        onSeat?.(ranked.indexOf(reviewer) + 1);
+        onSeat?.(ranked.indexOf(reviewer) + 1, ranked.length);
     return reviewer;
 }
 /**
@@ -220,7 +222,7 @@ ${files.map((path) => `- ${path}`).join("\n")}`;
 export async function reviewGate(task, worktree, baseRef, author, channels, adapters, cfg, via, excludeReviewers, 
 // OBS-196: run dir for raw-output persistence on an unparseable verdict; absent (older callers,
 // direct tests) skips persistence and changes nothing else.
-artifactDir, reviewHistory) {
+artifactDir, reviewHistory, demotedReviewers, carriedFindings = []) {
     // R3 (OBS-186): participation is keyed on PATHS. The compiler's assignment comes from the DECLARED
     // files[]; the operator's floor may RAISE it to full and can never lower it. `complexityThreshold` is
     // retired — the branch that returned a green skip on a complexity comparison is gone, and with it the
@@ -241,8 +243,9 @@ artifactDir, reviewHistory) {
     // so production rounds have journaled both siblings all along — only the fixtures were blind to it.
     // Fixed in the ledger rather than in the oracles, because determinism run-to-run is a property of
     // the journal, not of three test files that happen to assert it.
+    const priorMaterials = carriedFindings.filter((finding) => finding.class === "review:material");
     const declaredPolicy = declaredReviewPolicy(task.files);
-    const policy = raiseReviewPolicy(declaredPolicy, cfg.review.policy);
+    const policy = priorMaterials.length ? "full" : raiseReviewPolicy(declaredPolicy, cfg.review.policy);
     // PROMOTION: the declared assignment is a claim about paths, and the diff is the evidence. A
     // judge-only task whose diff left the leaf class is reviewed in full — the claim never outranks
     // what actually happened, and an empty diff promotes too (a skip earned by an absence is not earned).
@@ -293,15 +296,15 @@ artifactDir, reviewHistory) {
     // historical seat for every task that never asked for review-tier coupling.
     const reviewerFloor = task.routingHints?.floor;
     let rotationSeat;
-    const reviewer = pickReviewer(author, channels, excludeReviewers ?? [], cfg.review.prefer ?? [], reviewerFloor, reviewHistory, reviewHistory ? (seat) => { rotationSeat = seat; } : undefined);
+    const reviewer = pickReviewer(author, channels, excludeReviewers ?? [], cfg.review.prefer ?? [], reviewerFloor, reviewHistory, reviewHistory ? (seat) => { rotationSeat = seat; } : undefined, demotedReviewers);
     if (!reviewer) {
         // meta.noEligibleReviewer lets run-gates' review-retry keep the ORIGINAL unparseable result when
         // the retry finds no second seat — a truthful cause beats a synthetic no-reviewer failure.
         const reason = reviewerFloor
             ? `no cross-vendor reviewer available at or above task-declared ${reviewerFloor} floor (diversity rule)`
             : "no cross-vendor reviewer available (diversity rule)";
-        return cfg.review.required
-            ? { gate: "review", pass: false, details: `unreadable — ${reason}; set review.required:false to waive`, meta: { noEligibleReviewer: true, unreadable: true, ...(reviewerFloor ? { reviewerFloor } : {}) } }
+        return cfg.review.required || priorMaterials.length > 0
+            ? { gate: "review", pass: false, details: `unreadable — ${reason}; ${priorMaterials.length ? "carried materials require a review verdict" : "set review.required:false to waive"}`, meta: { noEligibleReviewer: true, unreadable: true, ...(reviewerFloor ? { reviewerFloor } : {}) } }
             : { gate: "review", pass: true, details: `WARNING: ${reason} — review waived by config`, meta: { noEligibleReviewer: true, ...(reviewerFloor ? { reviewerFloor } : {}) } };
     }
     reviewHistory?.push(channelKey(reviewer));
@@ -327,7 +330,10 @@ ${task.acceptance.map((a) => `- ${renderAcceptanceItem(a)}`).join("\n")}
 
 ${renderDeclaredWriteScope(task.files)}
 
-## Diff
+${priorMaterials.length ? `## Prior materials this attempt must close
+${priorMaterials.map((finding) => `Fingerprint: ${finding.fingerprint}\n${finding.note}`).join("\n\n")}
+
+` : ""}## Diff
 \`\`\`diff
 ${diff}
 \`\`\`
@@ -340,18 +346,36 @@ block approval. For a minor concern you have decided not to block on, set "defer
 one-line "rationale" — it is recorded in the review, never dropped.
 
 Respond with ONLY this JSON:
-{"nonce": "${nonce}", "approve": true|false, "findings": [{"note": "...", "severity": "material"|"minor", "defer": false, "rationale": ""}], "comments": [{"path": "path/to/file", "line": 42, "body": "actionable feedback"}]}
-Approve iff no material finding remains; an empty findings list is a clean approval.
+{"nonce": "${nonce}", "approve": true|false, "resolved": [], "reraised": [], "findings": [{"note": "...", "severity": "material"|"minor", "defer": false, "rationale": ""}], "comments": [{"path": "path/to/file", "line": 42, "body": "actionable feedback"}]}
+For every prior material, put its fingerprint in exactly one of resolved (verified fixed) or reraised
+(still a blocking defect). Use only the listed fingerprints; never omit one or put it in both lists.
+Approve iff no material finding remains and every prior material is resolved.
 The top-level comments array is optional. Use it only for actionable line-anchored feedback.
 `;
-    let concludedOnInactivity = false;
+    // Filenames are journaled (daemon.ts lifts meta.rawPath/briefPath onto the gate-result row), so they
+    // must be reproducible from the same inputs — the verdict nonce is cryptographically random and would
+    // make two otherwise-identical runs diverge in their journal bytes. The reviewer channel already
+    // disambiguates every call that matters: a retry always excludes the flaked channel (run-gates.ts),
+    // so it can never collide with the attempt it replaces.
+    const artifactId = `${task.id}-${channelKey(reviewer).replace(/[^a-zA-Z0-9_.-]/g, "-")}`;
+    const briefPath = artifactDir ? join(artifactDir, `review-brief-${artifactId}.md`) : undefined;
+    // Persistence is evidence, not a gate input: a full disk or a removed run dir never fails the gate.
+    let savedBrief;
+    if (briefPath) {
+        try {
+            writeFileSync(briefPath, redactSecrets(prompt));
+            savedBrief = briefPath;
+        }
+        catch {
+            savedBrief = undefined;
+        }
+    }
     const llm = await runLlmDetailed(getAdapter(reviewer.adapter, adapters), reviewer.model, prompt, worktree, via ? {
         driver: via.driver,
         keep: via.keep,
         onSlot: via.onSlot,
         name: via.nameFor("review", reviewer.adapter),
         label: via.labelFor("review"),
-        onInactivity: () => { concludedOnInactivity = true; },
     } : undefined, 
     // frontier reviewers routinely need >5min on a configured-cap-sized diff, and `claude -p` buffers all
     // output until completion — runLlm's 300s default killed reviews mid-flight, returning empty
@@ -359,56 +383,85 @@ The top-level comments array is optional. Use it only for actionable line-anchor
     // (run-20260709-104447 P87-09). The configured ceiling defaults to that measured 15 minutes.
     cfg.review.timeoutMs);
     const raw = llm.output;
+    let saved;
+    if (artifactDir) {
+        try {
+            saved = join(artifactDir, `review-raw-${artifactId}.txt`);
+            writeFileSync(saved, redactSecrets(raw));
+        }
+        catch {
+            saved = undefined; // persistence is evidence, not a gate input — never fail the gate on it
+        }
+    }
     const provider = modelProvider(reviewer.model, reviewer.vendor);
     const v = extractVerdictJson(raw, nonce);
     const findings = v && Array.isArray(v.findings) ? v.findings : null;
+    const priorIds = new Set(priorMaterials.map((finding) => finding.fingerprint));
+    const closureLists = [v?.resolved, v?.reraised];
+    const closureInvalid = !!v && (priorIds.size > 0 || closureLists.some((list) => list !== undefined)) && (closureLists.some((list) => !Array.isArray(list) || list.some((id) => typeof id !== "string" || !priorIds.has(id)))
+        || new Set([...(v?.resolved ?? []), ...(v?.reraised ?? [])]).size !== (v?.resolved?.length ?? 0) + (v?.reraised?.length ?? 0)
+        || [...priorIds].some((id) => !v?.resolved?.includes(id) && !v?.reraised?.includes(id)));
     // findings decides the verdict on its own; the legacy path still needs approve + issues to parse.
-    if (!v || (findings === null && (typeof v.approve !== "boolean" || !Array.isArray(v.issues)))) {
+    if (!v || closureInvalid || (findings === null && (typeof v.approve !== "boolean" || !Array.isArray(v.issues)))) {
         // OBS-196: name the cause and persist the raw bytes — a ruled-on "unparseable" without its
         // evidence cannot be audited, and a cutoff must never be indistinguishable from a parse defect.
-        const cause = classifyVerdictCause(raw, nonce, "approve", llm);
-        const bytes = Buffer.byteLength(raw, "utf8");
-        let saved;
-        if (artifactDir) {
-            try {
-                saved = join(artifactDir, `review-raw-${task.id}-${Date.now()}.txt`);
-                writeFileSync(saved, redactSecrets(raw));
-            }
-            catch {
-                saved = undefined; // persistence is evidence, not a gate input — never fail the gate on it
-            }
-        }
-        const failure = concludedOnInactivity
-            ? "review dispatch concluded on the inactivity policy without a structurally valid nonce-bound response; output unparseable"
-            : cause === "malformed-verdict"
-                ? "review output unparseable"
-                : "review dispatch failed — no structurally valid nonce-bound response; output unparseable";
+        const bytes = llm.seatAuthoredBytes ?? Buffer.byteLength(raw.trim(), "utf8");
+        const cause = closureInvalid ? "malformed-verdict" : llm.launchNeverStarted ? "launch-never-started"
+            : llm.timedOut ? (bytes > 0 ? "truncated" : "silent")
+                : classifyVerdictCause(raw, nonce, "approve", llm);
+        const failure = cause === "malformed-verdict"
+            ? "review output unparseable"
+            : "review dispatch failed — no structurally valid nonce-bound response";
         return {
             gate: "review",
             pass: false,
-            details: `${failure} (reviewer ${reviewer.adapter}:${reviewer.model}; vendor: ${reviewer.vendor}; provider: ${provider}; cause: ${cause}${cause === "timeout" ? `; killed at configured review timeout ${cfg.review.timeoutMs}ms` : ""}${saved ? `; raw saved: ${saved}` : ""}) — failing closed`,
+            details: `${failure} (reviewer ${reviewer.adapter}:${reviewer.model}; vendor: ${reviewer.vendor}; provider: ${provider}; cause: ${cause}${llm.timedOut ? `; killed at configured review timeout ${cfg.review.timeoutMs}ms` : ""}${saved ? `; raw saved: ${saved}` : ""}) — failing closed`,
             meta: {
                 ...policyMeta,
                 ...rotationMeta,
                 reviewer: channelKey(reviewer),
                 vendor: reviewer.vendor,
                 provider,
-                unparseable: true,
+                ...(cause === "malformed-verdict" ? { unparseable: true } : { noVerdict: true, classification: "infra", infra: true }),
                 cause,
-                ...(cause === "empty-output" ? { bytes } : {}),
-                ...(cause === "timeout" ? { timeoutMs: cfg.review.timeoutMs } : {}),
-                ...(concludedOnInactivity ? { classification: "infra", infra: true } : {}),
+                bytes, seatAuthoredBytes: bytes,
+                ...(saved ? { rawPath: saved } : {}),
+                ...(savedBrief ? { briefPath: savedBrief } : {}),
+                ...(llm.timedOut ? { timeoutMs: cfg.review.timeoutMs } : {}),
             },
         };
     }
     const decided = findings !== null
         ? classifyReviewFindings(findings)
         : classifyReviewIssues(v.approve, v.issues);
+    const reraised = priorMaterials.filter((finding) => v.reraised?.includes(finding.fingerprint));
+    if (reraised.length) {
+        if (decided.pass)
+            decided.headline = "requested changes";
+        decided.pass = false;
+        // A reviewer may also restate a re-raised material in findings. Preserve the original
+        // prose once so an unchanged defect keeps the same failure brief across repair rounds.
+        for (const finding of reraised) {
+            const line = `- [material] ${finding.note}`;
+            if (!decided.lines.includes(line))
+                decided.lines.push(line);
+        }
+    }
     const prose = `reviewer ${reviewer.adapter}:${reviewer.model} (vendor: ${reviewer.vendor}; provider: ${provider}): ${decided.headline}${decided.lines.length ? "\n" + decided.lines.join("\n") : ""}`;
+    const details = appendAnchoredReview(prose, v);
     return {
         gate: "review",
         pass: decided.pass,
-        details: appendAnchoredReview(prose, v),
-        meta: { ...policyMeta, ...rotationMeta, reviewer: channelKey(reviewer), vendor: reviewer.vendor, provider },
+        details,
+        meta: {
+            ...policyMeta, ...rotationMeta, reviewer: channelKey(reviewer), vendor: reviewer.vendor, provider,
+            ...(priorMaterials.length ? { resolved: v.resolved, reraised: v.reraised } : {}),
+            ...(reraised.length ? { findings: [
+                    ...structuredFindings("review", details).filter((finding) => !reraised.some((prior) => prior.note === finding.note)),
+                    ...reraised,
+                ] } : {}),
+            ...(saved ? { rawPath: saved } : {}),
+            ...(savedBrief ? { briefPath: savedBrief } : {}),
+        },
     };
 }

package/dist/gates/run-gates.d.ts

@@ -4,6 +4,7 @@ import { type GateName, type Task } from "../graph/schema.js";
 import { type Baseline } from "./baseline.js";
 import { type GateVia } from "./llm.js";
 import type { GateResult } from "./types.js";
+import { type StructuredFinding } from "../run/journal.js";
 export type LoadProvider = () => number;
 /** Test seam — inject deterministic load samples; production always reads os.loadavg. */
 export declare function setLoadProviderForTests(provider: LoadProvider): void;
@@ -52,7 +53,9 @@ export interface GateContext {
     adapters: WorkerAdapter[];
     cfg: TickmarkrConfig;
     via?: GateVia;
+    carriedFindings?: readonly StructuredFinding[];
     excludeReviewers?: string[];
+    demotedReviewers?: Set<string>;
     reviewHistory?: string[];
     artifactDir?: string;
     pipeline?: "v185" | "legacy";

package/dist/gates/run-gates.js

@@ -590,13 +590,23 @@ export async function runGates(task, ctx) {
         const dispatch = async (run) => {
             const captured = await captureLlmDispatches(ctx.adapters, run);
             invocations.push(...captured.invocations);
-            return captured.value;
+            const rv = captured.value;
+            if (rv.meta?.noVerdict === true || rv.meta?.unparseable === true) {
+                await ctx.onGate?.({ phase: "note", gate: "review", name: "review-no-verdict", payload: { ...rv.meta }, result: rv });
+                if (rv.meta.seatAuthoredBytes === 0 && typeof rv.meta.reviewer === "string"
+                    && !ctx.demotedReviewers?.has(rv.meta.reviewer)) {
+                    ctx.demotedReviewers?.add(rv.meta.reviewer);
+                    await ctx.onGate?.({ phase: "note", gate: "review", name: "review-pool-demotion",
+                        payload: { reviewer: rv.meta.reviewer, cause: rv.meta.cause, seatAuthoredBytes: 0 }, result: rv });
+                }
+            }
+            return rv;
         };
-        let rv = await dispatch((adapters) => reviewGate(task, ctx.worktree, ctx.baseRef, ctx.author, ctx.channels, adapters, ctx.cfg, ctx.via, ctx.excludeReviewers, ctx.artifactDir, ctx.reviewHistory));
+        let rv = await dispatch((adapters) => reviewGate(task, ctx.worktree, ctx.baseRef, ctx.author, ctx.channels, adapters, ctx.cfg, ctx.via, ctx.excludeReviewers, ctx.artifactDir, ctx.reviewHistory, ctx.demotedReviewers, ctx.carriedFindings));
         // OBS-193/574: an unparseable review verdict retries the REVIEW exactly once, preferring a
         // different adapter. Only a single-adapter eligible pool may fall back to another channel on the
         // flaked adapter. The flaked verdict never enters results; an exhausted pool preserves its cause.
-        if (rv.meta?.unparseable === true && typeof rv.meta.reviewer === "string") {
+        if ((rv.meta?.unparseable === true || rv.meta?.noVerdict === true) && typeof rv.meta.reviewer === "string") {
             const flaked = rv.meta.reviewer;
             const emptyOutput = rv.meta.cause === "empty-output";
             if (emptyOutput) {
@@ -615,7 +625,7 @@ export async function runGates(task, ctx) {
             const crossAdapter = pickReviewer(ctx.author, ctx.channels, [...priorExclusions, ...adapterExclusions], ctx.cfg.review.prefer ?? [], task.routingHints?.floor);
             const exclusion = crossAdapter ? "adapter" : "channel";
             const retryExclusions = [...priorExclusions, ...(crossAdapter ? adapterExclusions : [flaked])];
-            const second = await dispatch((adapters) => reviewGate(task, ctx.worktree, ctx.baseRef, ctx.author, ctx.channels, adapters, ctx.cfg, retryVia, retryExclusions, ctx.artifactDir, ctx.reviewHistory));
+            const second = await dispatch((adapters) => reviewGate(task, ctx.worktree, ctx.baseRef, ctx.author, ctx.channels, adapters, ctx.cfg, retryVia, retryExclusions, ctx.artifactDir, ctx.reviewHistory, ctx.demotedReviewers, ctx.carriedFindings));
             if (second.meta?.noEligibleReviewer !== true) {
                 const retried = typeof second.meta?.reviewer === "string" ? second.meta.reviewer : "none";
                 const route = exclusion === "adapter"

package/dist/run/daemon.d.ts

@@ -1,10 +1,11 @@
 import { type WorkerAdapter } from "../adapters/types.js";
 import { type ModeResolution, type RoutingMode, type TickmarkrConfig } from "../config/config.js";
 import { type DriverChoice } from "../drivers/index.js";
-import { type ExecutorDriver } from "../drivers/types.js";
+import { type ExecutorDriver, type Slot } from "../drivers/types.js";
 import { type Baseline } from "../gates/baseline.js";
 import type { GateResult } from "../gates/types.js";
 import { Journal, type JournalEvent } from "./journal.js";
+export declare function closeLiveSlot(liveSlots: Set<Slot>, driver: Pick<ExecutorDriver, "close">, slot: Slot): Promise<void>;
 export { harvestCpuFlatWindowMs, resetHarvestCpuFlatMsForTests, setHarvestCpuFlatMsForTests, workerTreeCpuMs, } from "./stall.js";
 export interface RunOptions {
     runId?: string;
@@ -13,6 +14,8 @@ export interface RunOptions {
     graphChanged?: boolean;
     retryFailed?: boolean;
     concurrency?: number;
+    /** Bounded wait at a drain caused solely by parked tasks. */
+    approvalWindowMs?: number;
     driver?: ExecutorDriver;
     driverOverride?: DriverChoice;
     adapters?: WorkerAdapter[];
@@ -54,9 +57,8 @@ export interface RunSummary {
  * T14, amended by v2.2 T3: approvals the run accepted and never acted on. `approved` above is still
  * built ONCE at startup — replay determinism depends on it — but a live approval is no longer inert:
  * the boundary sweep in the task loop releases what lands while the daemon runs, so an approval
- * written mid-run is normally enacted by this run. ONE window survives, and it is the reason this
- * fold still exists: an approval accepted after the task loop exits — during tip verify, before the
- * run-end sample below — meets no further boundary, so nothing can release it before this run ends.
+ * written mid-run is enacted at a boundary, during the approval window, or by cancelling tip verify.
+ * This fold still exposes decisions that could not enact, including a failure before dispatch.
  * Without this the run-end record stated only buckets and tipVerify, both accurate, over a milestone
  * that was silently incomplete: run …230 ended tipVerify "passed" with two upheld approvals and zero
  * subsequent dispatches. Scored per task on its NEWEST approval: a later approval is the live
@@ -107,6 +109,7 @@ export declare const SUITE_WAIT_CEILING_MS = 600000;
 export declare const setSuiteWaitCeilingForTests: (ms: number) => void;
 export declare const resetSuiteWaitCeilingForTests: () => void;
 export declare const APPROVAL_POLL_MS = 250;
+export declare const APPROVAL_WINDOW_MS = 1000;
 export declare const EARLY_LAUNCH_LIVENESS_MS = 60000;
 /** Test seam — lowers the empty-pane liveness window without sleeping 60s per case. */
 export declare function setEarlyLaunchLivenessMsForTests(ms: number): void;
@@ -150,6 +153,7 @@ export declare function commandsHash(commands: Record<string, string>): string;
 export declare function verifyIntegrationTipCached(intWt: string, commands: Record<string, string>, journal: Journal, opts?: {
     lastMergedTask?: string;
     baseline?: Baseline;
+    signal?: AbortSignal;
 }): Promise<boolean>;
 type SuitePidProbe = (pid: number) => number | undefined;
 /** Count full-suite roots in one process-table snapshot. The probes are arguments so the ownership