tickmarkr 2.5.4 → 2.5.6

package/dist/gates/cache.js

@@ -0,0 +1,401 @@
+import { createHash } from "node:crypto";
+import { execSync } from "node:child_process";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { tmpdir } from "node:os";
+import { describeCapacity, resolvedCapacity, shGit, verificationProtocol } from "../run/git.js";
+import { shq } from "../adapters/types.js";
+export const DEFAULT_VERDICT_CACHE_BOUND = 128;
+let testCacheBound;
+export function setVerdictCacheBoundForTests(bound) {
+    testCacheBound = bound;
+}
+export function resetVerdictCacheBoundForTests() {
+    testCacheBound = undefined;
+    globalStoreSequence = 0;
+}
+export const LOCKFILES = [
+    "package-lock.json",
+    "npm-shrinkwrap.json",
+    "pnpm-lock.yaml",
+    "yarn.lock",
+    "bun.lock",
+    "bun.lockb",
+];
+export function lockfileHash(worktree) {
+    const hash = createHash("sha256");
+    let found = false;
+    for (const file of LOCKFILES) {
+        const p = join(worktree, file);
+        if (existsSync(p)) {
+            found = true;
+            try {
+                hash.update(file).update("\0").update(readFileSync(p)).update("\0");
+            }
+            catch {
+                hash.update(file).update("\0unreadable\0");
+            }
+        }
+    }
+    return found ? hash.digest("hex").slice(0, 16) : "no-lockfile";
+}
+export function canonicalJson(obj) {
+    if (obj === null || typeof obj !== "object")
+        return JSON.stringify(obj);
+    if (Array.isArray(obj))
+        return "[" + obj.map(canonicalJson).join(",") + "]";
+    const keys = Object.keys(obj).sort();
+    return "{" + keys.map((k) => JSON.stringify(k) + ":" + canonicalJson(obj[k])).join(",") + "}";
+}
+export function baselineIdentity(baseline) {
+    if (!baseline)
+        return "none";
+    // Measurements control execution budgets, not which failures the baseline forgives.
+    const commands = Object.fromEntries(Object.entries(baseline.commands).map(([gate, entry]) => {
+        const { durationMs: _duration, fileDurationSumMs: _sum, impliedParallelism: _parallelism, longestFile: _longest, fileDurations: _files, ceilingMs: _ceiling, ...evidence } = entry;
+        return [gate, evidence];
+    }));
+    return createHash("sha256").update(canonicalJson(commands)).digest("hex").slice(0, 16);
+}
+// The tree the command actually ran against: HEAD plus every tracked change and ordinary untracked
+// path (a fixture that flips an uncommitted package.json changes the verdict). Built through a
+// disposable index, as preserveWorktree does, so the checkout's real index is never touched.
+export async function getWorktreeTree(worktree) {
+    const scratch = mkdtempSync(join(tmpdir(), "tickmarkr-verdict-index-"));
+    const withIndex = (cmd) => `GIT_INDEX_FILE=${shq(join(scratch, "index"))} ${cmd}`;
+    try {
+        const read = await shGit(withIndex("git read-tree HEAD"), worktree);
+        if (read.code !== 0)
+            return "";
+        const add = await shGit(withIndex("git add -A -- ."), worktree);
+        if (add.code !== 0)
+            return "";
+        const tree = await shGit(withIndex("git write-tree"), worktree);
+        return tree.code === 0 ? tree.stdout.trim() : "";
+    }
+    finally {
+        rmSync(scratch, { recursive: true, force: true });
+    }
+}
+export function environmentFingerprint(env) {
+    const nodeRuntime = env.nodeRuntime ?? process.version;
+    const lockfile = env.lockfile ?? (env.worktree ? lockfileHash(env.worktree) : "no-lockfile");
+    const cap = env.capacity ?? resolvedCapacity();
+    const capacity = { forkCap: cap.forkCap, cores: cap.cores };
+    const selectedSet = env.selectedSet ? [...env.selectedSet].sort() : undefined;
+    const verification = env.verification ?? verificationProtocol(process.env, env.worktree ?? process.cwd());
+    // R41: the protocol and the EFFECTIVE lifecycle are IN the hashed payload, so every entry written
+    // before this stamp — green or red — keys differently and is never answered; no store surgery is
+    // needed. `source` is provenance (kept in parts, printed on the row) and never enters the key: an
+    // explicit `false` and an npmrc `false` are the same policy for the child that ran.
+    const payload = canonicalJson({
+        nodeRuntime,
+        lockfile,
+        capacity,
+        selectedSet: selectedSet ?? null,
+        scope: env.scope ?? "battery",
+        verification: { protocol: verification.protocol, lifecycle: verification.lifecycle },
+    });
+    const fingerprint = createHash("sha256").update(payload).digest("hex").slice(0, 16);
+    return {
+        fingerprint,
+        parts: { nodeRuntime, lockfile, capacity, selectedSet, verification },
+    };
+}
+export async function computeVerificationIdentity(params) {
+    const tree = params.tree ?? (await getWorktreeTree(params.worktree));
+    if (!tree)
+        return undefined;
+    const baseline = baselineIdentity(params.baseline);
+    const env = environmentFingerprint({
+        worktree: params.worktree,
+        selectedSet: params.selectedSet,
+        capacity: params.capacity,
+        lockfile: params.lockfile,
+        nodeRuntime: params.nodeRuntime,
+        scope: params.scope,
+        verification: params.verification,
+    });
+    return {
+        gate: params.gate,
+        scope: params.scope ?? "battery",
+        worktree: realpathSync(params.worktree),
+        tree,
+        command: params.command,
+        baseline,
+        environment: env.fingerprint,
+        envParts: env.parts,
+    };
+}
+export function verificationIdentityKey(id) {
+    const cmdHash = createHash("sha256").update(id.command).digest("hex").slice(0, 16);
+    const gate = id.gate ?? "gate";
+    // Checkout location is diagnostic only. Scope separates each verifier's evidence policy.
+    const workingTree = createHash("sha256").update(id.tree).digest("hex");
+    return `${id.scope ?? "battery"}-${gate}-${workingTree}-${cmdHash}-${id.baseline}-${id.environment}`;
+}
+export function formatReusedDetails(originalDetails, id) {
+    const unadorned = originalDetails.replace(/^reused verdict \(identity: [^)]+\):\s*/, "");
+    const envDesc = id.envParts
+        ? ` [node=${id.envParts.nodeRuntime}, lockfile=${id.envParts.lockfile}, capacity=${describeCapacity(id.envParts.capacity)}${id.envParts.selectedSet ? `, selected=${id.envParts.selectedSet.join(",")}` : ""}, protocol=${id.envParts.verification.protocol}, lifecycle=${id.envParts.verification.lifecycle} (${id.envParts.verification.source})]`
+        : "";
+    const gate = id.gate ?? "gate";
+    const prefix = `reused ${id.scope === "tip" ? "tip " : ""}verdict (identity: gate=${gate} tree=${id.tree}${id.worktree ? ` worktree=${id.worktree}` : ""} command=${id.command} baseline=${id.baseline} env=${id.environment}${envDesc})`;
+    return `${prefix}: ${unadorned}`;
+}
+// A reused GREEN names the reuse in its details. A reused RED keeps the fresh verdict's details
+// byte-for-byte: the daemon's fingerprint cap (identicalGateFailures) compares normalized details
+// across attempts, so a red whose details carried a reuse note would never read as the identical
+// failure it is and would buy a free retry — the reuse is named on the row's meta and on the
+// gate-reused-verdict note run-gates emits beside it, which the daemon journals as its own row.
+export function formatReusedRow(cached, id) {
+    const reusedDetails = formatReusedDetails(cached.details, id);
+    return {
+        gate: id.gate ?? cached.gate,
+        pass: cached.pass,
+        details: cached.pass ? reusedDetails : cached.details,
+        capacity: cached.capacity,
+        meta: {
+            ...cached.meta,
+            reused: true,
+            reusedDetails,
+            verificationIdentity: reusedIdentity(id),
+        },
+    };
+}
+export function reusedIdentity(id) {
+    return {
+        gate: id.gate ?? "gate",
+        scope: id.scope ?? "battery",
+        tree: id.tree,
+        ...(id.worktree ? { worktree: id.worktree } : {}),
+        command: id.command,
+        baseline: id.baseline,
+        environment: id.environment,
+        key: verificationIdentityKey(id),
+    };
+}
+export function isInfraResult(result) {
+    if (result.meta?.infra === true)
+        return true;
+    if (result.meta?.classification === "infra")
+        return true;
+    if (result.meta?.kind === "ceiling-kill" || result.meta?.kind === "hang")
+        return true;
+    if ("cause" in result && result.cause === "infra")
+        return true;
+    if (typeof result.details === "string") {
+        const d = result.details.toLowerCase();
+        if (d.startsWith("infra;") || d.startsWith("infra: ") || d.includes("infrastructure blocked execution")) {
+            return true;
+        }
+    }
+    return false;
+}
+export function resolveStateDir(worktree, artifactDir) {
+    if (artifactDir) {
+        const idx = artifactDir.lastIndexOf("/.tickmarkr");
+        if (idx !== -1) {
+            return artifactDir.slice(0, idx + "/.tickmarkr".length);
+        }
+    }
+    const idx = worktree.lastIndexOf("/.tickmarkr");
+    if (idx !== -1) {
+        return worktree.slice(0, idx + "/.tickmarkr".length);
+    }
+    if (existsSync(join(worktree, ".tickmarkr"))) {
+        return join(worktree, ".tickmarkr");
+    }
+    try {
+        const commonDir = execSync("git rev-parse --git-common-dir", { cwd: worktree, encoding: "utf8" }).trim();
+        const resolved = resolve(worktree, commonDir);
+        const commonRoot = realpathSync(dirname(resolved));
+        if (existsSync(join(commonRoot, ".tickmarkr"))) {
+            return join(commonRoot, ".tickmarkr");
+        }
+    }
+    catch {
+        // ignore
+    }
+    return join(worktree, ".tickmarkr");
+}
+export function resolveVerdictStoreDir(stateDir) {
+    mkdirSync(stateDir, { recursive: true });
+    const gi = join(stateDir, ".gitignore");
+    if (!existsSync(gi)) {
+        try {
+            writeFileSync(gi, "*\n");
+        }
+        catch {
+            // ignore
+        }
+    }
+    const dir = join(stateDir, "verdicts");
+    mkdirSync(dir, { recursive: true });
+    return dir;
+}
+let globalStoreSequence = 0;
+export function resetGlobalStoreSequenceForTests() {
+    globalStoreSequence = 0;
+}
+export class VerdictStore {
+    dir;
+    constructor(dir) {
+        this.dir = dir;
+    }
+    initSequenceFromDisk() {
+        if (!existsSync(this.dir))
+            return;
+        try {
+            for (const f of readdirSync(this.dir)) {
+                if (f.startsWith("verdict-") && f.endsWith(".json")) {
+                    try {
+                        const raw = JSON.parse(readFileSync(join(this.dir, f), "utf8"));
+                        if (raw && typeof raw.sequence === "number" && raw.sequence > globalStoreSequence) {
+                            globalStoreSequence = raw.sequence;
+                        }
+                    }
+                    catch {
+                        // ignore
+                    }
+                }
+            }
+        }
+        catch {
+            // ignore
+        }
+    }
+    // R41: an identity whose lifecycle policy could not be measured is never answered and never
+    // stored — an unknown policy is not comparable to anything, so the battery runs the command.
+    static unknownPolicy(id) {
+        return id.envParts?.verification?.lifecycle === "unknown";
+    }
+    get(id) {
+        if (!id || !id.tree || VerdictStore.unknownPolicy(id))
+            return undefined;
+        const key = verificationIdentityKey(id);
+        const p = join(this.dir, `verdict-${key}.json`);
+        if (existsSync(p)) {
+            try {
+                const raw = JSON.parse(readFileSync(p, "utf8"));
+                if (raw && raw.verdict)
+                    return raw.verdict;
+            }
+            catch {
+                return undefined;
+            }
+        }
+        return undefined;
+    }
+    set(id, verdict) {
+        if (!id || !id.tree || VerdictStore.unknownPolicy(id))
+            return false;
+        if (isInfraResult(verdict))
+            return false;
+        mkdirSync(this.dir, { recursive: true });
+        this.initSequenceFromDisk();
+        const key = verificationIdentityKey(id);
+        const bound = testCacheBound ?? DEFAULT_VERDICT_CACHE_BOUND;
+        const record = {
+            key,
+            identity: id,
+            verdict: {
+                gate: verdict.gate ?? id.gate ?? "gate",
+                pass: verdict.pass,
+                details: verdict.details,
+                ...("exitCode" in verdict ? { exitCode: verdict.exitCode } : {}),
+                ...(verdict.capacity ? { capacity: verdict.capacity } : {}),
+                ...(verdict.meta ? { meta: verdict.meta } : {}),
+            },
+            timestamp: Date.now(),
+            sequence: ++globalStoreSequence,
+        };
+        const finalPath = join(this.dir, `verdict-${key}.json`);
+        const tmpPath = join(this.dir, `verdict-${key}.${process.pid}.${Date.now()}.${Math.random().toString(16).slice(2)}.tmp`);
+        writeFileSync(tmpPath, JSON.stringify(record, null, 2) + "\n");
+        try {
+            unlinkSync(finalPath);
+        }
+        catch {
+            // ignore
+        }
+        writeFileSync(finalPath, readFileSync(tmpPath));
+        try {
+            unlinkSync(tmpPath);
+        }
+        catch {
+            // ignore
+        }
+        this.evictOldest(bound);
+        return true;
+    }
+    size() {
+        if (!existsSync(this.dir))
+            return 0;
+        return readdirSync(this.dir).filter((f) => f.startsWith("verdict-") && f.endsWith(".json")).length;
+    }
+    clear() {
+        globalStoreSequence = 0;
+        if (!existsSync(this.dir))
+            return;
+        for (const f of readdirSync(this.dir)) {
+            if (f.startsWith("verdict-")) {
+                try {
+                    unlinkSync(join(this.dir, f));
+                }
+                catch {
+                    // ignore
+                }
+            }
+        }
+    }
+    evictOldest(bound) {
+        const limit = bound ?? testCacheBound ?? DEFAULT_VERDICT_CACHE_BOUND;
+        const dir = this.dir;
+        if (!existsSync(dir))
+            return 0;
+        const files = readdirSync(dir).filter((f) => f.startsWith("verdict-") && f.endsWith(".json"));
+        if (files.length <= limit)
+            return 0;
+        const entries = [];
+        for (const file of files) {
+            const p = join(dir, file);
+            try {
+                const raw = JSON.parse(readFileSync(p, "utf8"));
+                entries.push({
+                    file,
+                    sequence: typeof raw.sequence === "number" ? raw.sequence : 0,
+                    timestamp: typeof raw.timestamp === "number" ? raw.timestamp : 0,
+                });
+            }
+            catch {
+                entries.push({ file, sequence: -1, timestamp: -1 });
+            }
+        }
+        entries.sort((a, b) => {
+            // Each write seeds its sequence from disk, including in a fresh process.
+            // Wall-clock corrections must not make the newest write the oldest entry.
+            if (a.sequence !== b.sequence)
+                return a.sequence - b.sequence;
+            return a.timestamp - b.timestamp;
+        });
+        let evicted = 0;
+        while (entries.length > limit) {
+            const oldest = entries.shift();
+            try {
+                unlinkSync(join(dir, oldest.file));
+                evicted++;
+            }
+            catch {
+                // ignore
+            }
+        }
+        return evicted;
+    }
+}
+export function getVerdictStore(stateDir, options) {
+    if (options?.bound !== undefined) {
+        setVerdictCacheBoundForTests(options.bound);
+    }
+    return new VerdictStore(resolveVerdictStoreDir(stateDir));
+}

package/dist/gates/llm.d.ts

@@ -62,11 +62,14 @@ export interface LlmRunResult {
     exitCode?: number;
     timedOut: boolean;
     launchNeverStarted?: boolean;
+    /** OBS-1039: seat-authored bytes stayed under REVIEW_SILENT_BYTE_FLOOR at the first liveness beat. */
+    silentAtBeat?: boolean;
     seatAuthoredBytes?: number;
 }
 export declare const PROMPT_GLYPHS: readonly ["➜", "❯", "$", "%", ">>", ">"];
 export declare function reviewSeatOutput(raw: string, nonce: string, adapterBannerRows?: readonly string[]): string;
 export declare const REVIEW_FIRST_LIVENESS_MS = 30000;
+export declare const REVIEW_SILENT_BYTE_FLOOR = 64;
 export declare function runHeadless(adapter: WorkerAdapter, model: string, prompt: string, cwd: string, timeoutMs?: number): Promise<string>;
 export declare function runViaDriver(adapter: WorkerAdapter, model: string, prompt: string, cwd: string, via: LlmVia, timeoutMs?: number): Promise<string>;
 export declare function dewrapPaneVerdict(out: string, nonce: string): string;

package/dist/gates/llm.js

@@ -300,6 +300,10 @@ export function reviewSeatOutput(raw, nonce, adapterBannerRows = []) {
     return trailer ? seat.slice(0, trailer.index) : seat;
 }
 export const REVIEW_FIRST_LIVENESS_MS = 30_000;
+// OBS-1039: a seat that wrote ten bytes and went quiet escaped the zero-byte beat and sat to the
+// ceiling. Below this many seat-authored bytes at the first beat the seat is `silent` — demoted and
+// re-routed then, not at the ceiling. Pane path only; a headless runner buffers and keeps its ceiling.
+export const REVIEW_SILENT_BYTE_FLOOR = 64;
 async function runHeadlessDetailed(adapter, model, prompt, cwd, timeoutMs = 300000) {
     const dir = mkdtempSync(join(tmpdir(), "tickmarkr-llm-"));
     try {
@@ -356,6 +360,7 @@ async function runViaDriverDetailed(adapter, model, prompt, cwd, via, timeoutMs
         let out;
         let timedOut = false;
         let launchNeverStarted = false;
+        let silentAtBeat = false;
         let seatAuthoredBytes = 0;
         const gatePrompt = prompt.startsWith("TICKMARKR-JUDGE") || prompt.startsWith("TICKMARKR-REVIEW");
         if (!gatePrompt) {
@@ -412,6 +417,11 @@ async function runViaDriverDetailed(adapter, model, prompt, cwd, via, timeoutMs
                         forceClose = true;
                         break;
                     }
+                    if (seatAuthoredBytes < REVIEW_SILENT_BYTE_FLOOR) {
+                        silentAtBeat = true;
+                        forceClose = true;
+                        break;
+                    }
                 }
                 // Producing reviews own their full ceiling; inactivity is not a review verdict.
                 if (reviewing)
@@ -458,6 +468,7 @@ async function runViaDriverDetailed(adapter, model, prompt, cwd, via, timeoutMs
             ...(Number.isFinite(exitCode) ? { exitCode } : {}),
             timedOut,
             launchNeverStarted,
+            silentAtBeat,
             seatAuthoredBytes,
         };
     }

package/dist/gates/review.d.ts

@@ -64,6 +64,13 @@ export declare function matchClosureId(candidate: unknown, fingerprints: Iterabl
  * all route through matchClosureId.
  */
 export declare function isReviewClosureInvalid(v: Pick<ReviewVerdict, "resolved" | "reraised"> | null | undefined, priorIds: ReadonlySet<string> | readonly string[]): boolean;
+/**
+ * OBS-1013 add.3: the reviewer ECHOED closure ids and at least one matches no carried fingerprint —
+ * it answered about the materials and missed the id (a retyped, truncated or paraphrased fingerprint).
+ * That is a no-verdict about the carried work (re-route), not a parse defect. A verdict that omits a
+ * list, carries a non-string or duplicates an id stays malformed: its shape, not its ids, is wrong.
+ */
+export declare function isReviewClosureMismatch(v: Pick<ReviewVerdict, "resolved" | "reraised"> | null | undefined, priorIds: ReadonlySet<string> | readonly string[]): boolean;
 export type ReviewerFloorCause = "author-tier" | "task-floor" | "config" | "prior-reviewer";
 /**
  * RF-1 (OBS-922 add.2/3): the tier a reviewer must meet is the maximum of the author's tier, the
@@ -101,12 +108,30 @@ export declare function pickReviewer(author: Assignment, channels: BillingChanne
 prefer?: string[], // v1.53 T2: review.prefer — reorders eligible channels, never changes eligibility
 floor?: Tier, // task/config/prior floor from the caller; the author's own tier is ALWAYS applied here (RF-1)
 history?: string[], // run-scoped picks, oldest to newest; empty preserves the established ranking
-onSeat?: (seat: number, count: number) => void, demoted?: ReadonlySet<string>): BillingChannel | null;
-export type ReviewUnparseableCause = VerdictUnparseableCause | "launch-never-started" | "truncated" | "silent";
+onSeat?: (seat: number, count: number) => void, demoted?: ReadonlySet<string>, excludeVendors?: ReadonlySet<string>): BillingChannel | null;
+export type ReviewUnparseableCause = VerdictUnparseableCause | "launch-never-started" | "truncated" | "silent" | "closure-mismatch";
 /**
  * This shows the reviewer what the task DECLARED, never what the diff may actually reach. The diff
  * remains a separate stated input, so whether its touched paths fit the declaration stays a reviewer
  * judgement rather than a guarantee made by this renderer.
  */
 export declare function renderDeclaredWriteScope(files: ReadonlyArray<string>): string;
-export declare function reviewGate(task: Task, worktree: string, baseRef: string, author: Assignment, channels: BillingChannel[], adapters: WorkerAdapter[], cfg: TickmarkrConfig, via?: GateVia, excludeReviewers?: string[], artifactDir?: string, reviewHistory?: string[], demotedReviewers?: ReadonlySet<string>, carriedFindings?: readonly StructuredFinding[], priorReviewers?: readonly PriorReviewer[]): Promise<GateResult>;
+/**
+ * OBS-1033: the vendors of the seats that authored commits inside the accumulated diff. A seat is
+ * never handed its own earlier work to approve. A prior author not resolvable in the pool excludes
+ * its adapter's vendors instead (fail closed: the seat is known, its vendor is whatever it bills as).
+ */
+export declare function carriedAuthorVendors(channels: BillingChannel[], carriedAuthors?: readonly string[]): Set<string>;
+/**
+ * OBS-1020: the compiled goal is the contract. After `resume --graph-changed` the worktree's copy of
+ * the spec is the pre-change text on the integration branch, so a reviewer that reads it grades a
+ * superseded contract. The daemon's repository root is where specs and planning records are current.
+ */
+export declare function renderGoalSection(goal: string, repoRoot?: string): string;
+/**
+ * OBS-1013 add.3: each carried id is printed ONCE, verbatim, inside a fenced block the reviewer can
+ * copy; the notes follow in the same order. A reviewer that retyped a 600-byte id from prose lost
+ * closure on a typo and that read as malformed — the block is what a closure list is copied from.
+ */
+export declare function renderPriorMaterials(priorMaterials: readonly StructuredFinding[]): string;
+export declare function reviewGate(task: Task, worktree: string, baseRef: string, author: Assignment, channels: BillingChannel[], adapters: WorkerAdapter[], cfg: TickmarkrConfig, via?: GateVia, excludeReviewers?: string[], artifactDir?: string, reviewHistory?: string[], demotedReviewers?: ReadonlySet<string>, carriedFindings?: readonly StructuredFinding[], priorReviewers?: readonly PriorReviewer[], carriedAuthors?: readonly string[]): Promise<GateResult>;