tickmarkr 2.5.1 → 2.5.2

package/dist/run/git.d.ts

@@ -4,6 +4,8 @@ export { ROUTING_ENV_SEAMS };
 export declare const FORK_CAP_ENV = "VITEST_MAX_FORKS";
 export declare const SUITE_PARENT_ENV = "TICKMARKR_SUITE_PARENT";
 export declare const DEFAULT_FORK_CAP = "6";
+/** Verification owns the serialized suite window; workers keep their concurrency budget. */
+export declare const runWithVerificationBudget: <T>(capacity: RunCapacity, fn: () => Promise<T>) => Promise<T>;
 /**
  * OBS-618: how many PROCESSES one vitest fork can hold at its peak — the fork, a daemon it spawns,
  * and that daemon's own `git` child. The previous formula counted FORKS and assumed one process
@@ -38,7 +40,7 @@ export declare const resolvedForkCap: () => string;
 /**
  * T7: the CAPACITY a suite verdict was measured under — the fork cap the command's child actually
  * received, and the core count that cap was divided from. Two verdicts are comparable only when both
- * numbers match: a run resumed at a different concurrency divides the same machine by a different
+ * numbers match: a run resumed at a different capacity divides the machine by a different
  * number, so a green measured in that other world is not evidence about this one.
  *
  * This pair is the WHOLE comparable identity, and the load averages a gate row already carries beside
@@ -77,7 +79,7 @@ export declare function sameCapacity(recorded: unknown, current: RunCapacity | u
 export declare const describeCapacity: (value: unknown) => string;
 /**
  * The capacity a child spawned on THIS async context would receive: the same precedence `shell`
- * applies below — an operator export of the cap wins over the run's own derived value — beside the
+ * applies below — the verification budget captures any operator export at run start — beside the
  * cores it was divided from. A caller holding a command's own result reads the capacity off THAT
  * result (`ShResult.capacity`, stamped where the child's environment was built); this is for the
  * decisions taken BEFORE any child exists — a cache hit, a reuse predicate.

package/dist/run/git.js

@@ -15,24 +15,11 @@ export { ROUTING_ENV_SEAMS };
 export const FORK_CAP_ENV = "VITEST_MAX_FORKS";
 export const SUITE_PARENT_ENV = "TICKMARKR_SUITE_PARENT";
 export const DEFAULT_FORK_CAP = "6";
-/**
- * The fork budget belongs to ONE run: how many gate suites can be in flight at once is exactly that
- * run's resolved concurrency, so the per-suite cap must divide the machine by THAT number and no
- * other. Two things rule out a module-level variable. A single Node process holds more than one
- * runDaemon call — the suites do it, and so does a supervisor driving two repositories — so a
- * captured-once global hands whichever run started first its cap to every other run, and only a
- * reset seam production never calls could hide it. And re-deriving the number at spawn time reads
- * whatever `process.argv` or the config overlay says NOW, not what the run resolved: `parseArgs`
- * settles `--concurrency 2 --concurrency 8` on the LAST occurrence, and an overlay is a mutable
- * file, so a re-derived cap can disagree with the concurrency the run is actually enforcing.
- *
- * AsyncLocalStorage is the stdlib answer to both. The store is entered once, around the run body,
- * from the single value `runDaemon` resolved; every shell that run spawns — baseline capture, gate
- * batteries, tip verify, worker environments — inherits it through the async context, and a
- * concurrent run's shells inherit their own. There is nothing to reset: leaving the run leaves
- * the store, so sequential runs cannot inherit each other either.
- */
+/** Worker concurrency is resolved once per run and isolated from other async runs. */
 const forkBudget = new AsyncLocalStorage();
+const verificationBudget = new AsyncLocalStorage();
+/** Verification owns the serialized suite window; workers keep their concurrency budget. */
+export const runWithVerificationBudget = (capacity, fn) => verificationBudget.run(capacity, fn);
 /**
  * OBS-618: how many PROCESSES one vitest fork can hold at its peak — the fork, a daemon it spawns,
  * and that daemon's own `git` child. The previous formula counted FORKS and assumed one process
@@ -102,12 +89,12 @@ export const describeCapacity = (value) => {
 };
 /**
  * The capacity a child spawned on THIS async context would receive: the same precedence `shell`
- * applies below — an operator export of the cap wins over the run's own derived value — beside the
+ * applies below — the verification budget captures any operator export at run start — beside the
  * cores it was divided from. A caller holding a command's own result reads the capacity off THAT
  * result (`ShResult.capacity`, stamped where the child's environment was built); this is for the
  * decisions taken BEFORE any child exists — a cache hit, a reuse predicate.
  */
-export const resolvedCapacity = () => ({
+export const resolvedCapacity = () => verificationBudget.getStore() ?? ({
     forkCap: Number(FORK_CAP_ENV in process.env ? process.env[FORK_CAP_ENV] : resolvedForkCap()),
     cores: availableParallelism(),
 });
@@ -151,9 +138,10 @@ function shell(cmd, cwd, timeoutMs, login) {
     const env = { ...process.env };
     for (const k of ROUTING_ENV_SEAMS)
         delete env[k];
-    // OBS-110: apply the run's own fork cap only when the operator has not already set one.
-    if (!(FORK_CAP_ENV in env))
-        env[FORK_CAP_ENV] = resolvedForkCap();
+    // A run freezes the operator override and cores at startup; admission can lower the round cap.
+    env[FORK_CAP_ENV] = verificationBudget.getStore()
+        ? String(resolvedCapacity().forkCap)
+        : env[FORK_CAP_ENV] ?? resolvedForkCap();
     // OBS-854: descendants can leave the checkout (nested fixture suites do), so cwd alone cannot
     // attribute them. Every daemon shell exports the daemon pid as their durable parentage marker.
     env[SUITE_PARENT_ENV] = String(process.pid);
@@ -163,7 +151,7 @@ function shell(cmd, cwd, timeoutMs, login) {
     // for; re-deriving the run's own budget after the command returned would stamp a cap no child ran
     // under. `Number` of an unparseable export is NaN, which every reader treats as malformed and
     // therefore fails closed — the honest direction when the cap in play cannot be stated.
-    const capacity = { forkCap: Number(env[FORK_CAP_ENV]), cores: availableParallelism() };
+    const capacity = { forkCap: Number(env[FORK_CAP_ENV]), cores: resolvedCapacity().cores };
     const attempt = () => new Promise((resolve) => {
         const startedAt = Date.now();
         // detached: bash gets its own process group so a timeout can kill the whole tree —

package/dist/run/merge.d.ts

@@ -12,7 +12,7 @@ export interface TipVerifyResult {
     forgiven?: boolean;
     /**
      * OBS-534: what a nonzero exit is evidence OF, taken from the battery's own readers — `ceilingKillResult`
-     * for a kill, `classifyFailureOutput` for everything else. `infra` means nothing was verified.
+     * for a kill, the shared runner classifier for everything else. `infra` means nothing was verified.
      */
     cause?: FailureClassification;
 }

package/dist/run/merge.js

@@ -1,7 +1,7 @@
-import { existsSync, writeFileSync } from "node:fs";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { shq } from "../adapters/types.js";
-import { ceilingKillResult, classifyFailureOutput, effectiveCeilingMs, fingerprint, freshFailures, } from "../gates/baseline.js";
+import { ceilingKillResult, classifyFreshRunnerOutput, classifyRunnerOutput, fileCountDeficit, waitForCalmWindow, effectiveCeilingMs, fingerprint, freshFailures, } from "../gates/baseline.js";
 import { tickmarkrDir } from "../graph/graph.js";
 import { describeCapacity, gitHead, linkNodeModules, resolveIntegrationBranch, sameCapacity, sh, shGit, shGitOk, WORKTREES_DIR } from "./git.js";
 export function integrationBranch(cfg, runId) {
@@ -52,16 +52,121 @@ export async function mergeTask(intWt, taskBranch, message, gatedCommit) {
 // fingerprint, or output with no recognizable failure shape, → failed.
 export async function verifyIntegrationTip(intWt, commands, runDir, baseline) {
     const results = [];
+    let runStartCommands;
+    let journalFound = false;
+    let hasRunEvidenceOrMalformed = false;
+    const journalPath = join(runDir, "journal.jsonl");
+    if (existsSync(journalPath)) {
+        journalFound = true;
+        try {
+            const raw = readFileSync(journalPath, "utf8").trim();
+            if (!raw) {
+                hasRunEvidenceOrMalformed = true;
+            }
+            else {
+                const lines = raw.split("\n");
+                for (const line of lines) {
+                    if (!line.trim())
+                        continue;
+                    try {
+                        const parsed = JSON.parse(line);
+                        if (parsed.event === "run-start" && parsed.data?.commands) {
+                            runStartCommands = parsed.data.commands;
+                            break;
+                        }
+                        if (parsed.event && !parsed.event.startsWith("tip-verify")) {
+                            hasRunEvidenceOrMalformed = true;
+                        }
+                    }
+                    catch {
+                        // Recover valid rows: skip malformed rows while searching for run-start
+                        hasRunEvidenceOrMalformed = true;
+                    }
+                }
+            }
+        }
+        catch {
+            hasRunEvidenceOrMalformed = true;
+        }
+    }
+    const gatesToRun = [];
     for (const [gate, cmd] of Object.entries(commands)) {
-        const entry = baseline?.commands[gate];
+        if (gate === "tipTest")
+            continue;
+        if (gate === "test") {
+            gatesToRun.push(["test", commands.tipTest ?? cmd]);
+        }
+        else {
+            gatesToRun.push([gate, cmd]);
+        }
+    }
+    if (!commands.test && commands.tipTest) {
+        gatesToRun.push(["test", commands.tipTest]);
+    }
+    if (journalFound && hasRunEvidenceOrMalformed && runStartCommands === undefined) {
+        for (const [gate, cmd] of gatesToRun) {
+            const artifact = join(runDir, `tip-verify-${gate}.log`);
+            const details = `tip verify could not establish command provenance: run-start evidence missing or malformed in journal`;
+            writeFileSync(artifact, details + "\n");
+            results.push({
+                gate,
+                cmd,
+                pass: false,
+                exitCode: 1,
+                fingerprints: [],
+                details,
+                artifact,
+            });
+        }
+        return results;
+    }
+    for (const [gate, cmd] of gatesToRun) {
+        if (runStartCommands !== undefined) {
+            const expectedCmd = gate === "test"
+                ? (runStartCommands.tipTest ?? runStartCommands.test)
+                : runStartCommands[gate];
+            if (expectedCmd === undefined || cmd !== expectedCmd) {
+                const artifact = join(runDir, `tip-verify-${gate}.log`);
+                const details = `tip verify command "${cmd}" for gate "${gate}" was not named in run-start row`;
+                writeFileSync(artifact, details + "\n");
+                results.push({
+                    gate,
+                    cmd,
+                    pass: false,
+                    exitCode: 1,
+                    fingerprints: [],
+                    details,
+                    artifact,
+                });
+                continue;
+            }
+        }
+        // Leg-2 T3 M1 (RULING-230-15): the entry is chosen by the RECORDED identity — the same provenance the
+        // command was validated against above — never the current config. After a resume whose config task
+        // command converged on the recorded tip command, the current-config test read "no distinct tip" and
+        // forgave a tip red against the TASK entry. Only standalone verify (no run-start row) has no record.
+        const identity = runStartCommands ?? commands;
+        const hasTipCommand = Boolean(identity.tipTest && identity.tipTest !== identity.test);
+        const entry = gate === "test" && (hasTipCommand || (!identity.test && identity.tipTest))
+            ? baseline?.commands.tipTest
+            : baseline?.commands[gate];
         // OBS-534: the ceiling is the BATTERY's, derived by effectiveCeilingMs from the same baseline entry
         // this loop already reads for forgiveness two lines down — never the flat DEFAULT_SHELL_TIMEOUT_MS
         // `sh` defaults to. A suite whose capture measured 600007ms carries a recorded 1800021ms ceiling;
         // running it under 600000ms here SIGKILLed a green tip three times while every per-task gate passed.
         const ceilingMs = effectiveCeilingMs(entry);
-        const r = await sh(cmd, intWt, ceilingMs);
-        const raw = r.stdout + "\n" + r.stderr;
-        const stripped = raw.split(intWt).join("");
+        let r = await sh(cmd, intWt, ceilingMs);
+        let raw = r.stdout + "\n" + r.stderr;
+        let stripped = raw.split(intWt).join("");
+        let rerun;
+        if (gate === "test" && !r.timedOut && !fileCountDeficit(entry, stripped)
+            && classifyFreshRunnerOutput(entry, stripped, r.code) === "infra") {
+            const waitedMs = await waitForCalmWindow();
+            rerun = `runner-infra rerun after waiting ${waitedMs}ms for a calm load window`;
+            r = await sh(cmd, intWt, ceilingMs);
+            raw = r.stdout + "\n" + r.stderr;
+            stripped = raw.split(intWt).join("");
+        }
         const artifact = join(runDir, `tip-verify-${gate}.log`);
         // Battery parity on the ceiling too (baseline.ts Q24): the kill is read BEFORE the exit code is
         // interpreted at all. A SIGKILLed battery never returned a verdict, so no line of its partial
@@ -76,14 +181,16 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline) {
                 pass: false,
                 exitCode: r.code,
                 fingerprints: [],
-                details: killed.details,
+                details: `${rerun ? `infra; ${rerun}: ` : ""}${killed.details}`,
                 cause: killed.meta?.classification,
                 artifact,
             });
             continue;
         }
         const { failing, unreadable } = freshFailures(entry, stripped);
-        const cause = r.code === 0 ? undefined : classifyFailureOutput(stripped);
+        const deficit = fileCountDeficit(entry, stripped);
+        const cause = deficit ? "infra" : classifyFreshRunnerOutput(entry, stripped, r.code);
+        const greenTeardown = classifyRunnerOutput(stripped, r.code) === "green-teardown";
         // `?? 1` is the battery's own default (baseline.ts compareToBaseline): an exitCode-less legacy
         // entry reads as red-at-baseline there, so it must read the same here or old baselines silently
         // lose forgiveness. OBS-534 (T2): a capture killed at its ceiling now records a CAUSE and no
@@ -106,7 +213,7 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline) {
         const comparable = sameCapacity(entry?.capacity, r.capacity);
         const forgiven = r.code !== 0 && baselineRed && failing.length === 0 && !unreadable && cause !== "infra"
             && comparable;
-        const pass = r.code === 0 || forgiven;
+        const pass = !deficit && (r.code === 0 || greenTeardown || forgiven);
         if (!pass)
             writeFileSync(artifact, raw);
         results.push({
@@ -114,15 +221,16 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline) {
             cmd,
             pass,
             exitCode: r.code,
-            fingerprints: r.code !== 0 ? fingerprint(stripped) : [],
-            details: r.code === 0 ? "exit 0"
-                : forgiven ? `exit ${r.code} but only baseline-recorded failures (forgiven vs baseline)`
-                    : !comparable && baselineRed && failing.length === 0
-                        ? `exit ${r.code}; every failure is baseline-recorded, but that capture ran under `
-                            + `${describeCapacity(entry?.capacity)} and this verification ran under ${describeCapacity(r.capacity)} `
-                            + `— forgiveness across a changed capacity is not evidence`
-                        : `exit ${r.code}`,
-            ...(forgiven ? { forgiven: true } : {}),
+            fingerprints: r.code !== 0 && !greenTeardown ? fingerprint(stripped) : [],
+            details: `${cause === "infra" ? "infra; " : ""}${rerun ? `${rerun}: ` : ""}` + (deficit?.replace(/^infra; /, "") ?? (r.code === 0 ? "exit 0"
+                : greenTeardown ? `exit ${r.code} after a green suite summary; only the runner's teardown fingerprint followed it`
+                    : forgiven ? `exit ${r.code} but only baseline-recorded failures (forgiven vs baseline)`
+                        : !comparable && baselineRed && failing.length === 0
+                            ? `exit ${r.code}; every failure is baseline-recorded, but that capture ran under `
+                                + `${describeCapacity(entry?.capacity)} and this verification ran under ${describeCapacity(r.capacity)} `
+                                + `— forgiveness across a changed capacity is not evidence`
+                            : `exit ${r.code}`)),
+            ...(forgiven && !deficit ? { forgiven: true } : {}),
             ...(cause ? { cause } : {}),
             ...(pass ? {} : { artifact }),
         });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.5.1",
+  "version": "2.5.2",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",

package/skills/tickmarkr-overseer/scripts/watch-context.sh

@@ -220,17 +220,20 @@ banner_pct() {
       stripped = bare; gsub(rule, "", stripped)
       if (bare != "" && stripped == "") last = NR }
     END { labelled = 0
-          for (i = 1; i <= NR; i++) if (line[i] ~ /Context [0-9]+% used/) { print line[i]; labelled = 1 }
+          for (i = 1; i <= NR; i++) if (line[i] ~ /Context [0-9]+% used/ || line[i] ~ /ctx [0-9]+%/) { print line[i]; labelled = 1 }
           if (!labelled && last) for (i = last + 1; i <= NR; i++) if (line[i] ~ /[0-9]+%/) print line[i] }
   ' | tail -1)
   # No rule line in the window, or no percentage below it: say so out loud rather than guess.
   [ -n "$banner" ] || { printf 'UNREADABLE\n'; return 0; }
+  # OBS-964 add.6: a claude-code statusline plugin (Graft) can replace the model row with a self-labelled
+  # `ctx N%` row; the label IS the selector, so no model name is required on that row.
+  printf '%s\n' "$banner" | grep -Eq 'ctx [0-9]+%' ||
   printf '%s\n' "$banner" |
     grep -Eqi '(^|[^[:alnum:]])(claude|opus|sonnet|haiku|fable|gpt|gemini|glm|kimi|grok|composer|openai|zai)[[:alnum:]_./-]*([[:space:]]|$)' ||
     { printf 'UNREADABLE\n'; return 0; }
   # OBS-964: a codex banner carries TWO percentages ("Context 16% used · weekly 96% left"); the LAST one is the
   # quota, not the fill. Prefer the labelled context figure; fall back to the last bare % (claude-code banner).
-  pct=$(printf '%s\n' "$banner" | grep -oE 'Context [0-9]+% used' | grep -oE '[0-9]+' | head -1)
+  pct=$(printf '%s\n' "$banner" | grep -oE '(Context [0-9]+% used|ctx [0-9]+%)' | grep -oE '[0-9]+' | head -1)
   # OBS-964 add.3: a codex footer while WORKING drops the labelled figure but keeps `weekly N% left`; strip the
   # quota phrase before the bare-% fallback so a quota can never be read as fill.
   [ -n "$pct" ] || pct=$(printf '%s\n' "$banner" | sed -E 's/weekly [0-9]+% left//g' | grep -oE '[0-9]+%' | tail -1 | tr -d '%')