tickmarkr 2.5.4 → 2.5.6

package/README.md

@@ -52,7 +52,7 @@ prefer, every example below works with either.
 
 - **macOS or Linux.** Every command shells out through `bash`, so native Windows is not
   supported — use WSL (untested).
-- Node ≥ 20 and `git` on PATH.
+- Node ≥ 20.3 and `git` on PATH.
 - At least one agent CLI on PATH (`claude`, `codex`, `cursor-agent`, `opencode`, `grok`, `pi`,
   or `kimi`), authenticated through its own login. tickmarkr never handles vendor API keys itself.
 
@@ -476,6 +476,8 @@ accepted contributions are credited via `Co-authored-by:` on the release commit.
 
 ## Documentation
 
+- [Experimental execution policy](docs/experimental-execution-policy.md) — bounded recovery, cumulative task time, and repair selection.
+
 - **[FLEET.md](https://github.com/alzahrani-khalid/tickmarkr/blob/main/FLEET.md)** — routing modes, steering syntax, tier provenance, and run flags (advanced reference)
 - **[LICENSE](LICENSE)** — MIT license
 - **[CONTRIBUTING.md](CONTRIBUTING.md)** — development setup and contribution guidelines

package/dist/adapters/registry.js

@@ -578,7 +578,12 @@ export function discoverChannels(cfg, adapters, health, role = "worker") {
         // channel — routing an unknown or 403 into dispatch is fail-closed. Operators with pre-v1.21 doctor.json
         // can opt into the prior unknown-is-routable behavior with routing.allowUnverifiedModels.
         // OBS-117: configured aliases absent from the adapter CLI's own model list are not dispatchable.
-        return a.channels(cfg).filter((c) => !invalid.has(c.model) && modelAuthed(h, c.model, cfg.routing.allowUnverifiedModels) && (!s || s.includes(c.model)));
+        return a.channels(cfg)
+            .filter((c) => !invalid.has(c.model) && modelAuthed(h, c.model, cfg.routing.allowUnverifiedModels) && (!s || s.includes(c.model)))
+            .map((c) => {
+            const identity = h?.modelAuth?.[c.model]?.identity ?? h?.modelIdentities?.[c.model];
+            return identity ? { ...c, identity } : c;
+        });
     });
     if (!cfg.routing.allow && !cfg.routing.deny)
         return base;

package/dist/adapters/types.d.ts

@@ -22,6 +22,7 @@ export interface BillingChannel {
     model: string;
     channel: "sub" | "api";
     tier: Tier;
+    identity?: string;
 }
 export declare const MODEL_PROBE_ERRORS: readonly ["EMFILE", "EAGAIN", "ENFILE", "ENOMEM", "ENOSPC"];
 export type ModelProbeError = typeof MODEL_PROBE_ERRORS[number];
@@ -30,6 +31,7 @@ export interface ModelAuth {
     reason?: string;
     probeError?: ModelProbeError;
     probedAt: string;
+    identity?: string;
 }
 export interface AuthHealth {
     installed: boolean;
@@ -40,6 +42,7 @@ export interface AuthHealth {
     modelsDetectedAt?: string;
     servable?: string[];
     modelAuth?: Record<string, ModelAuth>;
+    modelIdentities?: Record<string, string>;
 }
 export declare function modelAuthed(health: AuthHealth | undefined, model: string, allowUnverifiedModels?: boolean): boolean;
 export interface Invocation {

package/dist/cli/commands/approve.d.ts

@@ -21,6 +21,7 @@ export interface NewestPark {
     /** The daemon-recorded kind (task-human data.kind), never inferred from prose. */
     kind: string | undefined;
     reason: string | undefined;
+    approveCommand?: string;
     /** The newest failed gate before the park — the gate a waive would satisfy. */
     failedGate: string | undefined;
     /** A pre-dispatch human gate whose reason marks it permanent by design (see isTombstonePark). */

package/dist/cli/commands/approve.js

@@ -1,6 +1,11 @@
+import { graphDefinitionHash, loadGraph, saveGraph } from "../../graph/graph.js";
+import { execFileSync } from "node:child_process";
 import { userInfo } from "node:os";
+import { loadConfig } from "../../config/config.js";
+import { integrationBranch } from "../../run/merge.js";
+import { separabilityErrors } from "../../compile/collateral.js";
 import { GATE_NAMES } from "../../graph/schema.js";
-import { ATTEMPT_CAP_RELEASE, GATE_SATISFIED_RELEASE, Journal, RECHECK_RELEASE, REVIEW_UPHELD_RELEASE } from "../../run/journal.js";
+import { applyScopeAmendments, engagementComparable, ATTEMPT_CAP_RELEASE, GATE_SATISFIED_RELEASE, Journal, RECHECK_RELEASE, REVIEW_UPHELD_RELEASE } from "../../run/journal.js";
 export const APPROVAL_DISPOSITIONS = ["dispatch", "waive-gate", "re-dispatch", "fund-fixed-attempt", "fresh-budget"];
 /**
  * What each disposition's release actually buys — the clause every operator-facing sentence about
@@ -52,6 +57,7 @@ sourceIndexes) {
         const reason = typeof e.data.reason === "string" ? e.data.reason : undefined;
         return {
             index: i, line: (sourceIndexes?.[i] ?? i) + 1, ts: typeof e.ts === "string" ? e.ts : undefined, kind, reason,
+            approveCommand: typeof e.data.approveCommand === "string" ? e.data.approveCommand : undefined,
             failedGate: failedGateForNewestPark(events, taskId, i), tombstone: isTombstonePark(kind, reason),
         };
     }
@@ -73,7 +79,7 @@ export function readJournalEvents(journal) {
  * surface may read it from, so what a menu offers and what the command accepts cannot drift.
  */
 export function permittedDecisionVerbs(park) {
-    if (!park || park.tombstone)
+    if (!park || park.tombstone || park.kind === "scope-request")
         return [];
     if (park.kind === "gate-fail") {
         if (park.failedGate === undefined)
@@ -82,6 +88,8 @@ export function permittedDecisionVerbs(park) {
     }
     if (park.kind === "infra")
         return ["approve", "recheck"];
+    if (park.kind === "diff-cap")
+        return ["recheck"]; // OBS-1007: a cap trip is re-gated under a raised cap, never re-bought
     return ["approve"];
 }
 /** The release marker this command appends for a verb on a park — the fact a read-back must match. */
@@ -123,7 +131,7 @@ export function approvalEnactment(token, run) {
 }
 /** The production command registered in COMMANDS; its returned bytes are what the CLI prints. */
 export async function approve(argv, cwd = process.cwd()) {
-    const { runId, taskId, by, reason, waive, uphold, recheck, reviewRoundCeiling } = parseArgs(argv);
+    const { runId, taskId, by, reason, waive, uphold, recheck, reviewRoundCeiling, files } = parseArgs(argv);
     const decisions = [waive, uphold, recheck].filter(Boolean).length;
     if (decisions > 1)
         throw new Error("--waive, --uphold and --recheck are different decisions — pass one");
@@ -135,6 +143,21 @@ export async function approve(argv, cwd = process.cwd()) {
         if (status === undefined) {
             throw new Error(`task ${taskId} has no events in run ${runId} — unknown task or never dispatched`);
         }
+        // OBS-1022: a task-failed task whose preserved ref (or task branch) carries commits ahead of the
+        // integration base owns verified-able work; --recheck re-gates that tree with no worker. Any other
+        // verb on a failed task, or a recheck over nothing landed, is refused naming why.
+        if (status === "failed" && recheck) {
+            const ahead = failedTaskCommitsAhead(cwd, journal, runId, taskId);
+            if (ahead.count === 0) {
+                throw new Error(`task ${taskId} is failed and ${ahead.ref} carries no commits ahead of ${ahead.base} — nothing to re-gate; use resume --retry-failed to fund a worker`);
+            }
+            journal.append("task-approved", taskId, {
+                by, ...(reason ? { reason } : {}), via: "cli", release: RECHECK_RELEASE,
+                recheckedRef: ahead.ref, commitsAhead: ahead.count,
+                ...(reviewRoundCeiling === undefined ? {} : { reviewRoundCeiling }),
+            });
+            return disposition(cwd, runId, "re-dispatch", `re-checking failed ${taskId} in ${runId} — by ${by}; ${ahead.count} commit(s) on ${ahead.ref} ahead of ${ahead.base}; no worker funded`, serialization.contended);
+        }
         if (status !== "human") {
             // a silent no-op would be worse than a loud refusal — name the actual status (D-05)
             throw new Error(`task ${taskId} is ${status}, not a parked human gate — refusing (a silent no-op would be worse)`);
@@ -146,8 +169,43 @@ export async function approve(argv, cwd = process.cwd()) {
         const lastHuman = park === undefined ? undefined : events[park.index];
         const capPark = park?.kind === ATTEMPT_CAP_RELEASE;
         const gateFailPark = park?.kind === "gate-fail";
-        const infraPark = park?.kind === "infra";
+        const infraPark = park?.kind === "infra" || park?.kind === "diff-cap";
         const failedGate = gateFailPark ? park?.failedGate : undefined;
+        if ((park?.kind === "scope-request" && !decisions) || files !== undefined) {
+            if (park?.kind !== "scope-request")
+                throw new Error("--files requires a scope-request park");
+            if (!files?.length)
+                throw new Error(`scope-request for ${taskId} requires --files <glob,…>`);
+            if (decisions)
+                throw new Error("--files cannot be combined with --waive, --uphold or --recheck");
+            const graph = applyScopeAmendments(loadGraph(cwd), journal);
+            const from = graphDefinitionHash(graph);
+            if (!engagementComparable(journal.read(), from).comparable
+                || (lastHuman?.data.graphDefinitionHash !== undefined && lastHuman.data.graphDefinitionHash !== from)) {
+                throw new Error(`refusing stale scope-request approval for ${taskId}: graph revision changed`);
+            }
+            const task = graph.tasks.find((t) => t.id === taskId);
+            if (!task)
+                throw new Error(`unknown task ${taskId}`);
+            const amendedFiles = [...new Set([...task.files, ...files])];
+            if (amendedFiles.length === task.files.length)
+                throw new Error("--files must extend the parked files[] revision");
+            const amended = { ...graph, tasks: graph.tasks.map((t) => t.id === taskId ? { ...t, files: amendedFiles } : t) };
+            const conflicts = separabilityErrors(amended.tasks);
+            if (conflicts.length)
+                throw new Error(`refusing scope-request approval for ${taskId}: ${conflicts.join("\n")}`);
+            journal.append("task-approved", taskId, {
+                by, ...(reason ? { reason } : {}), via: "cli", release: "scope-request",
+                amendment: { from, to: graphDefinitionHash(amended), beforeFiles: task.files, files: amendedFiles, parkLine: park.line },
+            });
+            // Do not write graph.json from this process while the daemon owns it: its sweep materializes
+            // the amendment without replacing a sibling's running state with this command's snapshot.
+            const projected = applyScopeAmendments(graph, journal);
+            const owner = approvalRunOwner(cwd, runId);
+            if (!owner.live && !owner.blockingRunId)
+                saveGraph(cwd, projected);
+            return disposition(cwd, runId, "dispatch", `approved files[] for ${taskId} in ${runId} — by ${by}`, serialization.contended);
+        }
         if (gateFailPark && !failedGate) {
             throw new Error(`task ${taskId} is parked on gate-fail but has no failed gate result on the newest park — refusing to infer one`);
         }
@@ -167,7 +225,7 @@ export async function approve(argv, cwd = process.cwd()) {
         }
         if (recheck) {
             if ((!gateFailPark || !failedGate) && !infraPark) {
-                throw new Error(`--recheck applies to a gate-fail or infra park; ${taskId}'s newest park is ${String(lastHuman?.data.kind ?? "none")} with failed gate ${failedGate ?? "none"} — refusing`);
+                throw new Error(`--recheck applies to a gate-fail, infra or diff-cap park; ${taskId}'s newest park is ${String(lastHuman?.data.kind ?? "none")} with failed gate ${failedGate ?? "none"} — refusing`);
             }
             journal.append("task-approved", taskId, {
                 by,
@@ -176,7 +234,7 @@ export async function approve(argv, cwd = process.cwd()) {
                 release: RECHECK_RELEASE,
                 ...(reviewRoundCeiling === undefined ? {} : { reviewRoundCeiling }),
             });
-            return disposition(cwd, runId, "re-dispatch", `re-checking ${taskId} in ${runId} — by ${by}; ${failedGate ? `failed gate ${failedGate}` : "infra park"}; no gate marked satisfied`, serialization.contended);
+            return disposition(cwd, runId, "re-dispatch", `re-checking ${taskId} in ${runId} — by ${by}; ${failedGate ? `failed gate ${failedGate}` : `${park.kind} park`}; no gate marked satisfied`, serialization.contended);
         }
         if (waive) {
             if (!gateFailPark || !failedGate) {
@@ -204,6 +262,11 @@ export async function approve(argv, cwd = process.cwd()) {
         if (park?.tombstone) {
             throw new Error(`task ${taskId}'s newest park is a tombstone (${park.reason ?? "no reason"}) — permanent by design; no verb releases it`);
         }
+        // OBS-1007: a cap trip is re-gated under a raised cap, never re-bought — plain approve would fund a
+        // worker the production oracle (permittedDecisionVerbs) says this park cannot buy.
+        if (park?.kind === "diff-cap") {
+            throw new Error(`task ${taskId} is parked on a diff cap; plain approve would fund another worker — raise gates.diffCap and pass --recheck (disposition re-dispatch)`);
+        }
         journal.append("task-approved", taskId, {
             by,
             ...(reason ? { reason } : {}),
@@ -218,6 +281,42 @@ export async function approve(argv, cwd = process.cwd()) {
         serialization.release();
     }
 }
+/**
+ * OBS-1022: what a failed task has landed. A preserved snapshot is authoritative only when it contains
+ * the current task-branch tip; an older preservation can remain in the journal after a later retry has
+ * advanced/rebuilt the branch. Missing task branches may still recover from a preserved ref. The selected
+ * ref is counted against the run's integration branch; unreadable refs count as zero and fail closed.
+ */
+function failedTaskCommitsAhead(cwd, journal, runId, taskId) {
+    const cfg = loadConfig(cwd);
+    const base = integrationBranch(cfg, runId);
+    const taskRef = `${base}--${taskId}`;
+    const preserved = [...journal.read()].reverse().find((e) => e.taskId === taskId && e.event === "worktree-preserved" && typeof e.data.ref === "string");
+    const preservedRef = preserved?.data.ref;
+    let ref = taskRef;
+    if (preservedRef) {
+        try {
+            execFileSync("git", ["rev-parse", "--verify", taskRef], { cwd, stdio: "ignore" });
+            execFileSync("git", ["merge-base", "--is-ancestor", taskRef, preservedRef], { cwd, stdio: "ignore" });
+            ref = preservedRef;
+        }
+        catch {
+            try {
+                execFileSync("git", ["rev-parse", "--verify", taskRef], { cwd, stdio: "ignore" });
+            }
+            catch {
+                ref = preservedRef;
+            }
+        }
+    }
+    try {
+        const out = execFileSync("git", ["rev-list", "--count", `${base}..${ref}`], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+        return { ref, base, count: Number.parseInt(out.trim(), 10) || 0 };
+    }
+    catch {
+        return { ref, base, count: 0 };
+    }
+}
 // The status is command OUTPUT, not a typed sibling result: the registered approve function returns
 // one primitive string and the dispatcher prints those bytes unchanged. A compact sentinel followed
 // by JSON makes the contract unambiguous to machines without widening the shared command result type.
@@ -247,11 +346,12 @@ function disposition(cwd, runId, token, message, contended) {
     };
     return `${out}\nTICKMARKR_APPROVAL ${JSON.stringify(record)}`;
 }
-const USAGE = "usage: tickmarkr approve <run-id> <task-id> [--waive|--uphold|--recheck] [--review-rounds <positive-integer>] [--by <name>] [--reason <text>]";
+const USAGE = "usage: tickmarkr approve <run-id> <task-id> [--files <glob,…>] [--waive|--uphold|--recheck] [--review-rounds <positive-integer>] [--by <name>] [--reason <text>]";
 // hand-parsed argv — no CLI framework (house style). Positionals are runId then taskId; decision,
 // ceiling, actor and reason are flags. Throws usage on missing positionals (mirrors resume.ts/unlock.ts).
 function parseArgs(argv) {
     const positionals = [];
+    let files;
     let by;
     let reason;
     let waive = false;
@@ -260,7 +360,16 @@ function parseArgs(argv) {
     let reviewRoundCeiling;
     for (let i = 0; i < argv.length; i++) {
         const a = argv[i];
-        if (a === "--by") {
+        if (a === "--files") {
+            const value = argv[++i];
+            if (!value || value.startsWith("--"))
+                throw new Error("--files requires <glob,…>");
+            files = value.split(",").map((file) => file.trim());
+            if (files.some((file) => !file || file.startsWith("/") || file.startsWith("!") || file.split("/").includes(".."))) {
+                throw new Error("--files requires non-empty repository-relative globs");
+            }
+        }
+        else if (a === "--by") {
             by = argv[++i];
             if (!by)
                 throw new Error(USAGE);
@@ -296,7 +405,7 @@ function parseArgs(argv) {
     if (!runId || !taskId) {
         throw new Error(USAGE);
     }
-    return { runId, taskId, by: by ?? userInfo().username, reason, waive, uphold, recheck, reviewRoundCeiling };
+    return { runId, taskId, by: by ?? userInfo().username, reason, waive, uphold, recheck, reviewRoundCeiling, files };
 }
 function failedGateForNewestPark(events, taskId, lastHumanIndex) {
     for (let i = lastHumanIndex - 1; i >= 0; i -= 1) {

package/dist/cli/commands/doctor.d.ts

@@ -203,6 +203,11 @@ export declare function doctorProbePreflight(cwd?: string, cfg?: {
         worker: "interactive" | "print";
         workersPerTab: number;
     };
+    executionPolicy?: {
+        boundedInfrastructure: boolean;
+        repairSelection: boolean;
+        taskExecutionLimitMs: number;
+    } | undefined;
     setup?: string | undefined;
     cost?: {
         models?: Record<string, {
@@ -322,6 +327,11 @@ export declare function cachedDoctorDiagnostics(cwd?: string, adapters?: WorkerA
         worker: "interactive" | "print";
         workersPerTab: number;
     };
+    executionPolicy?: {
+        boundedInfrastructure: boolean;
+        repairSelection: boolean;
+        taskExecutionLimitMs: number;
+    } | undefined;
     setup?: string | undefined;
     cost?: {
         models?: Record<string, {

package/dist/cli/commands/doctor.js

@@ -613,6 +613,46 @@ export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(
     if (probeProgressTTY && probeOk + probeBad > 0) {
         process.stderr.write(`\r\x1b[2K  probed ${probeOk + probeBad} channels · ${probeOk} ok${probeBad ? ` · ${probeBad} failed` : ""}\n`);
     }
+    const identityResolver = opts.resolveClaudeAliasIdentity
+        ?? (adapters.some((a) => a.id === claudeCode.id) ? resolveClaudeAliasIdentity : undefined);
+    const aliasDriftFindings = [];
+    // Single pre-write snapshot of the resolver's outcome per alias (including undefined/failure).
+    // Catalog rendering below reads only this map — never calls the resolver again — so a transient
+    // resolver that succeeds on a later call can never produce a result that stays display-only
+    // while doctor.json and discovery keep the earlier undefined/failed outcome.
+    const resolvedIdentitySnapshot = {};
+    if (identityResolver && health["claude-code"]?.installed) {
+        const configured = cfg.tiers["claude-code"]?.models ?? {};
+        for (const [alias, stampedIdentity] of Object.entries(CLAUDE_ALIAS_IDENTITY_STAMPS)) {
+            if (!(alias in configured))
+                continue;
+            let resolvedIdentity;
+            try {
+                resolvedIdentity = identityResolver(cwd, alias);
+            }
+            catch {
+                resolvedIdentitySnapshot[alias] = undefined;
+                continue; // advisory source failure is unknown, never a doctor failure
+            }
+            resolvedIdentitySnapshot[alias] = resolvedIdentity;
+            if (resolvedIdentity) {
+                if (!health["claude-code"].modelAuth) {
+                    health["claude-code"].modelAuth = {};
+                }
+                const existing = health["claude-code"].modelAuth[alias] ?? {
+                    authed: true,
+                    probedAt: new Date().toISOString(),
+                };
+                health["claude-code"].modelAuth[alias] = {
+                    ...existing,
+                    identity: resolvedIdentity,
+                };
+            }
+            if (resolvedIdentity && resolvedIdentity !== stampedIdentity) {
+                aliasDriftFindings.push(`resolved-identity drift: claude-code:${alias} resolved to ${resolvedIdentity}, stamped identity ${stampedIdentity} — reclassify per benchmark policy (advisory — routing unchanged)`);
+            }
+        }
+    }
     writeDoctor(cwd, health);
     const rows = adapters.map((a) => {
         const h = health[a.id];
@@ -752,37 +792,12 @@ export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(
     // v1.65 T3: hardcoded-flag drift — advisory warn rows only. Runs AFTER writeDoctor so the verdicts
     // can never leak into doctor.json, and discoverChannels/routing never read them.
     lintRows.push(...flagDriftWarnings(adapters, health).map(attentionRow));
-    // OBS-145: resolved-identity drift is the same class of display-only doctor warning. Stamps live
-    // beside the alias-owning adapter; the comparison runs only for configured floating aliases and
-    // never enters health/doctor.json, config, channel discovery, learned profiles, or route().
-    const identityResolver = opts.resolveClaudeAliasIdentity
-        ?? (adapters.includes(claudeCode) ? resolveClaudeAliasIdentity : undefined);
-    if (identityResolver && health["claude-code"]?.installed) {
-        const configured = cfg.tiers["claude-code"]?.models ?? {};
-        for (const [alias, stampedIdentity] of Object.entries(CLAUDE_ALIAS_IDENTITY_STAMPS)) {
-            if (!(alias in configured))
-                continue;
-            let resolvedIdentity;
-            try {
-                resolvedIdentity = identityResolver(cwd, alias);
-            }
-            catch {
-                continue; // advisory source failure is unknown, never a doctor failure
-            }
-            if (resolvedIdentity && resolvedIdentity !== stampedIdentity) {
-                lintRows.push(attentionRow(`resolved-identity drift: claude-code:${alias} resolved to ${resolvedIdentity}, stamped identity ${stampedIdentity} — reclassify per benchmark policy (advisory — routing unchanged)`));
-            }
-        }
-    }
+    // OBS-145: resolved-identity drift is advisory display warning.
+    lintRows.push(...aliasDriftFindings.map(attentionRow));
     const resolvedCatalogModel = (adapter, model) => {
-        if (adapter !== "claude-code" || !identityResolver || !(model in CLAUDE_ALIAS_IDENTITY_STAMPS))
+        if (adapter !== "claude-code" || !(model in CLAUDE_ALIAS_IDENTITY_STAMPS))
             return undefined;
-        try {
-            return identityResolver(cwd, model);
-        }
-        catch {
-            return undefined;
-        }
+        return resolvedIdentitySnapshot[model];
     };
     // MODEL-05/06: print-only drift fragment; advisory, whole-line-commented additions, tickmarkr NEVER applies it.
     // TTY gets a one-line summary + the fragment as a file (the full dump drowned everything else,