tickmarkr 2.5.5 → 2.5.6

package/README.md

@@ -52,7 +52,7 @@ prefer, every example below works with either.
 
 - **macOS or Linux.** Every command shells out through `bash`, so native Windows is not
   supported — use WSL (untested).
-- Node ≥ 20 and `git` on PATH.
+- Node ≥ 20.3 and `git` on PATH.
 - At least one agent CLI on PATH (`claude`, `codex`, `cursor-agent`, `opencode`, `grok`, `pi`,
   or `kimi`), authenticated through its own login. tickmarkr never handles vendor API keys itself.
 
@@ -476,6 +476,8 @@ accepted contributions are credited via `Co-authored-by:` on the release commit.
 
 ## Documentation
 
+- [Experimental execution policy](docs/experimental-execution-policy.md) — bounded recovery, cumulative task time, and repair selection.
+
 - **[FLEET.md](https://github.com/alzahrani-khalid/tickmarkr/blob/main/FLEET.md)** — routing modes, steering syntax, tier provenance, and run flags (advanced reference)
 - **[LICENSE](LICENSE)** — MIT license
 - **[CONTRIBUTING.md](CONTRIBUTING.md)** — development setup and contribution guidelines

package/dist/cli/commands/approve.js

@@ -1,5 +1,8 @@
 import { graphDefinitionHash, loadGraph, saveGraph } from "../../graph/graph.js";
+import { execFileSync } from "node:child_process";
 import { userInfo } from "node:os";
+import { loadConfig } from "../../config/config.js";
+import { integrationBranch } from "../../run/merge.js";
 import { separabilityErrors } from "../../compile/collateral.js";
 import { GATE_NAMES } from "../../graph/schema.js";
 import { applyScopeAmendments, engagementComparable, ATTEMPT_CAP_RELEASE, GATE_SATISFIED_RELEASE, Journal, RECHECK_RELEASE, REVIEW_UPHELD_RELEASE } from "../../run/journal.js";
@@ -85,6 +88,8 @@ export function permittedDecisionVerbs(park) {
     }
     if (park.kind === "infra")
         return ["approve", "recheck"];
+    if (park.kind === "diff-cap")
+        return ["recheck"]; // OBS-1007: a cap trip is re-gated under a raised cap, never re-bought
     return ["approve"];
 }
 /** The release marker this command appends for a verb on a park — the fact a read-back must match. */
@@ -138,6 +143,21 @@ export async function approve(argv, cwd = process.cwd()) {
         if (status === undefined) {
             throw new Error(`task ${taskId} has no events in run ${runId} — unknown task or never dispatched`);
         }
+        // OBS-1022: a task-failed task whose preserved ref (or task branch) carries commits ahead of the
+        // integration base owns verified-able work; --recheck re-gates that tree with no worker. Any other
+        // verb on a failed task, or a recheck over nothing landed, is refused naming why.
+        if (status === "failed" && recheck) {
+            const ahead = failedTaskCommitsAhead(cwd, journal, runId, taskId);
+            if (ahead.count === 0) {
+                throw new Error(`task ${taskId} is failed and ${ahead.ref} carries no commits ahead of ${ahead.base} — nothing to re-gate; use resume --retry-failed to fund a worker`);
+            }
+            journal.append("task-approved", taskId, {
+                by, ...(reason ? { reason } : {}), via: "cli", release: RECHECK_RELEASE,
+                recheckedRef: ahead.ref, commitsAhead: ahead.count,
+                ...(reviewRoundCeiling === undefined ? {} : { reviewRoundCeiling }),
+            });
+            return disposition(cwd, runId, "re-dispatch", `re-checking failed ${taskId} in ${runId} — by ${by}; ${ahead.count} commit(s) on ${ahead.ref} ahead of ${ahead.base}; no worker funded`, serialization.contended);
+        }
         if (status !== "human") {
             // a silent no-op would be worse than a loud refusal — name the actual status (D-05)
             throw new Error(`task ${taskId} is ${status}, not a parked human gate — refusing (a silent no-op would be worse)`);
@@ -149,7 +169,7 @@ export async function approve(argv, cwd = process.cwd()) {
         const lastHuman = park === undefined ? undefined : events[park.index];
         const capPark = park?.kind === ATTEMPT_CAP_RELEASE;
         const gateFailPark = park?.kind === "gate-fail";
-        const infraPark = park?.kind === "infra";
+        const infraPark = park?.kind === "infra" || park?.kind === "diff-cap";
         const failedGate = gateFailPark ? park?.failedGate : undefined;
         if ((park?.kind === "scope-request" && !decisions) || files !== undefined) {
             if (park?.kind !== "scope-request")
@@ -205,7 +225,7 @@ export async function approve(argv, cwd = process.cwd()) {
         }
         if (recheck) {
             if ((!gateFailPark || !failedGate) && !infraPark) {
-                throw new Error(`--recheck applies to a gate-fail or infra park; ${taskId}'s newest park is ${String(lastHuman?.data.kind ?? "none")} with failed gate ${failedGate ?? "none"} — refusing`);
+                throw new Error(`--recheck applies to a gate-fail, infra or diff-cap park; ${taskId}'s newest park is ${String(lastHuman?.data.kind ?? "none")} with failed gate ${failedGate ?? "none"} — refusing`);
             }
             journal.append("task-approved", taskId, {
                 by,
@@ -214,7 +234,7 @@ export async function approve(argv, cwd = process.cwd()) {
                 release: RECHECK_RELEASE,
                 ...(reviewRoundCeiling === undefined ? {} : { reviewRoundCeiling }),
             });
-            return disposition(cwd, runId, "re-dispatch", `re-checking ${taskId} in ${runId} — by ${by}; ${failedGate ? `failed gate ${failedGate}` : "infra park"}; no gate marked satisfied`, serialization.contended);
+            return disposition(cwd, runId, "re-dispatch", `re-checking ${taskId} in ${runId} — by ${by}; ${failedGate ? `failed gate ${failedGate}` : `${park.kind} park`}; no gate marked satisfied`, serialization.contended);
         }
         if (waive) {
             if (!gateFailPark || !failedGate) {
@@ -242,6 +262,11 @@ export async function approve(argv, cwd = process.cwd()) {
         if (park?.tombstone) {
             throw new Error(`task ${taskId}'s newest park is a tombstone (${park.reason ?? "no reason"}) — permanent by design; no verb releases it`);
         }
+        // OBS-1007: a cap trip is re-gated under a raised cap, never re-bought — plain approve would fund a
+        // worker the production oracle (permittedDecisionVerbs) says this park cannot buy.
+        if (park?.kind === "diff-cap") {
+            throw new Error(`task ${taskId} is parked on a diff cap; plain approve would fund another worker — raise gates.diffCap and pass --recheck (disposition re-dispatch)`);
+        }
         journal.append("task-approved", taskId, {
             by,
             ...(reason ? { reason } : {}),
@@ -256,6 +281,42 @@ export async function approve(argv, cwd = process.cwd()) {
         serialization.release();
     }
 }
+/**
+ * OBS-1022: what a failed task has landed. A preserved snapshot is authoritative only when it contains
+ * the current task-branch tip; an older preservation can remain in the journal after a later retry has
+ * advanced/rebuilt the branch. Missing task branches may still recover from a preserved ref. The selected
+ * ref is counted against the run's integration branch; unreadable refs count as zero and fail closed.
+ */
+function failedTaskCommitsAhead(cwd, journal, runId, taskId) {
+    const cfg = loadConfig(cwd);
+    const base = integrationBranch(cfg, runId);
+    const taskRef = `${base}--${taskId}`;
+    const preserved = [...journal.read()].reverse().find((e) => e.taskId === taskId && e.event === "worktree-preserved" && typeof e.data.ref === "string");
+    const preservedRef = preserved?.data.ref;
+    let ref = taskRef;
+    if (preservedRef) {
+        try {
+            execFileSync("git", ["rev-parse", "--verify", taskRef], { cwd, stdio: "ignore" });
+            execFileSync("git", ["merge-base", "--is-ancestor", taskRef, preservedRef], { cwd, stdio: "ignore" });
+            ref = preservedRef;
+        }
+        catch {
+            try {
+                execFileSync("git", ["rev-parse", "--verify", taskRef], { cwd, stdio: "ignore" });
+            }
+            catch {
+                ref = preservedRef;
+            }
+        }
+    }
+    try {
+        const out = execFileSync("git", ["rev-list", "--count", `${base}..${ref}`], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+        return { ref, base, count: Number.parseInt(out.trim(), 10) || 0 };
+    }
+    catch {
+        return { ref, base, count: 0 };
+    }
+}
 // The status is command OUTPUT, not a typed sibling result: the registered approve function returns
 // one primitive string and the dispatcher prints those bytes unchanged. A compact sentinel followed
 // by JSON makes the contract unambiguous to machines without widening the shared command result type.

package/dist/cli/commands/doctor.d.ts

@@ -203,6 +203,11 @@ export declare function doctorProbePreflight(cwd?: string, cfg?: {
         worker: "interactive" | "print";
         workersPerTab: number;
     };
+    executionPolicy?: {
+        boundedInfrastructure: boolean;
+        repairSelection: boolean;
+        taskExecutionLimitMs: number;
+    } | undefined;
     setup?: string | undefined;
     cost?: {
         models?: Record<string, {
@@ -322,6 +327,11 @@ export declare function cachedDoctorDiagnostics(cwd?: string, adapters?: WorkerA
         worker: "interactive" | "print";
         workersPerTab: number;
     };
+    executionPolicy?: {
+        boundedInfrastructure: boolean;
+        repairSelection: boolean;
+        taskExecutionLimitMs: number;
+    } | undefined;
     setup?: string | undefined;
     cost?: {
         models?: Record<string, {

package/dist/cli/commands/fleet.js

@@ -324,6 +324,8 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
         ...structuredClone(initial),
         denyAdapters: deny.adapters,
         denyModels: deny.models,
+        // OBS-1046: the allow complement is staged beside the deny lists, never folded into them
+        allowOut: deny.allowOut ?? initial.allowOut,
         denyWorkersAdapters: deny.workersAdapters,
         denyWorkersModels: deny.workersModels,
         map,
@@ -644,6 +646,7 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
         const staged = structuredClone(initial);
         staged.denyAdapters = state.denyAdapters;
         staged.denyModels = state.denyModels;
+        staged.allowOut = state.allowOut ?? initial.allowOut;
         // OBS-994/FL-1: the workers-only deny scope rides the same review/write funnel as the flat one.
         staged.denyWorkersAdapters = state.denyWorkersAdapters;
         staged.denyWorkersModels = state.denyWorkersModels;
@@ -699,6 +702,7 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
         health,
         initialDenyAdapters: editable.denyAdapters,
         initialDenyModels: editable.denyModels,
+        initialAllowOut: editable.allowOut,
         initialDenyWorkersAdapters: editable.denyWorkersAdapters,
         initialDenyWorkersModels: editable.denyWorkersModels,
         modelGroups,

package/dist/cli/commands/plan.js

@@ -7,7 +7,7 @@ import { GLYPHS, dim, rule, title, warn } from "../../brand.js";
 import { collateralLints, sourceScopeLints } from "../../compile/collateral.js";
 import { classifyContextPath } from "../../compile/native.js";
 import { DEFAULT_CONFIG, effectiveReviewPolicy, overlayPreferShapes, ROUTING_MODES, TIER_RANK } from "../../config/config.js";
-import { graphDefinitionHash, loadGraph, stateDirName } from "../../graph/graph.js";
+import { chainDepth, dispatchWaves, graphDefinitionHash, loadGraph, stateDirName } from "../../graph/graph.js";
 import { renderAcceptanceItem } from "../../graph/schema.js";
 import { resolveRunMode } from "../../run/daemon.js";
 import { disallowedBy, excludedChannels, exclusionLine, routingEntrySeatLines } from "../../route/preference.js";
@@ -364,11 +364,27 @@ export async function plan(argv, cwd = process.cwd(), adapters = allAdapters(),
             : "";
         return { line: `${channelKey(reviewer)}${rotationNote} — reviewPolicy full`, cost: seatCost(reviewer) };
     };
+    // OBS-1018: depth and wave come from the same functions the daemon admits by, so the plan shows the
+    // critical path the run will actually follow at this concurrency.
+    const depths = chainDepth(g);
+    const waves = dispatchWaves(g, cfg.concurrency);
+    const byId = new Map(g.tasks.map((t) => [t.id, t]));
+    const chainLine = (t) => {
+        const wave = waves.get(t.id);
+        // Map absence never implies status: a pending task stays wave-less when a dependency is
+        // running/gated/failed/human, so render the real status and name the blocking deps.
+        const tail = wave !== undefined
+            ? `wave ${wave} at concurrency ${cfg.concurrency}`
+            : t.status !== "pending"
+                ? `no wave (${t.status})`
+                : `no wave (pending; blocked by ${t.deps.filter((d) => byId.get(d)?.status !== "done").map((d) => `${d}:${byId.get(d)?.status ?? "missing"}`).join(", ")})`;
+        return `    chain: depth ${depths.get(t.id)} · ${tail}`;
+    };
     const routed = [];
     for (const t of g.tasks) {
         const refusals = [...(oracleRefusals.get(t.id) ?? []), ...(inputRefusals.get(t.id) ?? [])];
         if (refusals.length) {
-            lines.push(`  ${t.id.padEnd(6)} ${t.shape.padEnd(10)} !! pre-dispatch refusal — ${refusals.join("; ")}`);
+            lines.push(`  ${t.id.padEnd(6)} ${t.shape.padEnd(10)} !! pre-dispatch refusal — ${refusals.join("; ")}`, chainLine(t));
             continue;
         }
         try {
@@ -382,7 +398,7 @@ export async function plan(argv, cwd = process.cwd(), adapters = allAdapters(),
             const judge = judgeSeat(t);
             const review = reviewSeat(t, r.assignment);
             cost += est + judge.cost + review.cost;
-            lines.push(`  ${t.id.padEnd(6)} ${t.shape.padEnd(10)} c${String(t.complexity).padEnd(3)}→ ${r.assignment.adapter}:${r.assignment.model} [${r.assignment.channel}/${r.assignment.tier}]${t.timeoutMinutes !== undefined ? ` (timeout ${t.timeoutMinutes}m)` : ""}${t.humanGate ? " (human gate)" : ""}${est ? ` ~$${est.toFixed(2)}` : ""} — ${r.provenance}`, `    judge: ${judge.line}${judge.cost ? ` ~$${judge.cost.toFixed(2)}` : ""}`, `    review: ${review.line}${review.cost ? ` ~$${review.cost.toFixed(2)}` : ""}`);
+            lines.push(`  ${t.id.padEnd(6)} ${t.shape.padEnd(10)} c${String(t.complexity).padEnd(3)}→ ${r.assignment.adapter}:${r.assignment.model} [${r.assignment.channel}/${r.assignment.tier}]${t.timeoutMinutes !== undefined ? ` (timeout ${t.timeoutMinutes}m)` : ""}${t.humanGate ? " (human gate)" : ""}${est ? ` ~$${est.toFixed(2)}` : ""} — ${r.provenance}`, `    judge: ${judge.line}${judge.cost ? ` ~$${judge.cost.toFixed(2)}` : ""}`, `    review: ${review.line}${review.cost ? ` ~$${review.cost.toFixed(2)}` : ""}`, chainLine(t));
             const d = derivation(t.shape);
             if (d)
                 lines.push(d);
@@ -406,7 +422,7 @@ export async function plan(argv, cwd = process.cwd(), adapters = allAdapters(),
             if (!(e instanceof RoutingError))
                 throw e;
             const msg = `${e.message}${exclusionReason(e.message)}`;
-            lines.push(`  ${t.id.padEnd(6)} ${t.shape.padEnd(10)} !! ${msg}`);
+            lines.push(`  ${t.id.padEnd(6)} ${t.shape.padEnd(10)} !! ${msg}`, chainLine(t));
             const d = derivation(t.shape);
             if (d)
                 lines.push(d);

package/dist/cli/commands/verify.js

@@ -6,13 +6,15 @@ import { parseArgs } from "node:util";
 import { allAdapters, probeAll, readDoctor, rolePools } from "../../adapters/registry.js";
 import { channelKey } from "../../adapters/types.js";
 import { loadConfig } from "../../config/config.js";
-import { captureBaseline, detectGateCommands } from "../../gates/baseline.js";
+import { captureBaseline, detectGateCommands, staleFileCountCommands } from "../../gates/baseline.js";
 import { modelProvider } from "../../gates/review.js";
 import { runGates } from "../../gates/run-gates.js";
 import { getTask, loadGraph } from "../../graph/graph.js";
 import { GATE_NAMES } from "../../graph/schema.js";
+import { executionSignal } from "../../run/execution-budget.js";
 import { linkNodeModules, removeWorktree, shGit, shGitOk } from "../../run/git.js";
 import { Journal } from "../../run/journal.js";
+import { withRepositoryLease } from "../../run/lease.js";
 /**
  * tickmarkr verify — the gate battery as a standalone command (OPERATING-MODEL-2026-08-11 item 3).
  *
@@ -249,95 +251,114 @@ export async function verify(argv, cwd = process.cwd()) {
     // ponytail: tmpdir means the baseline cache dies on reboot/cleanup — worst case is one re-capture.
     const stateDir = verifyStateDir(cwd);
     mkdirSync(stateDir, { recursive: true });
-    let baseline;
-    const cachePath = baselineCachePath(cwd, mergeBase, commands);
-    const verdictlessMarker = `${cachePath}.verdictless`;
-    mkdirSync(dirname(cachePath), { recursive: true });
-    if (values.baseline) {
-        baseline = JSON.parse(readFileSync(values.baseline, "utf8"));
-    }
-    else {
-        let cached;
-        if (existsSync(cachePath)) {
-            cached = JSON.parse(readFileSync(cachePath, "utf8"));
-            const missing = verdictlessCommands(cached, commands);
-            if (missing.length) {
-                console.error(`verify: cached baseline recorded no verdict for ${missing.join(", ")}; it was not reusable and will be recaptured`);
-                rmSync(cachePath, { force: true });
-                cached = undefined;
-            }
-        }
-        if (cached) {
-            console.error(`verify: reusing cached baseline for ${mergeBase.slice(0, 12)} (${cachePath})`);
-            baseline = cached;
+    const recordJournal = values.record ? Journal.open(stateRoot, values.record) : undefined;
+    // OBS-1042: one runner root per repository across every linked worktree — the capture and the
+    // battery below run under a reservation keyed on the common git dir, and a waiter says who holds it.
+    return withRepositoryLease(cwd, () => leasedVerify(), {
+        signal: executionSignal(),
+        onWait: (holder) => {
+            console.error(`verify: waiting for the repository's runner lease held by pid ${holder.pid} in ${holder.cwd}`);
+            recordJournal?.append("suite-wait", values.task ?? "VERIFY", { holderPid: holder.pid, holderCwd: holder.cwd });
+        },
+    });
+    async function leasedVerify() {
+        let baseline;
+        const cachePath = baselineCachePath(cwd, mergeBase, commands);
+        const verdictlessMarker = `${cachePath}.verdictless`;
+        mkdirSync(dirname(cachePath), { recursive: true });
+        if (values.baseline) {
+            baseline = JSON.parse(readFileSync(values.baseline, "utf8"));
         }
         else {
-            if (existsSync(verdictlessMarker)) {
-                console.error(`verify: prior baseline recorded no verdict and was not cached; recapturing merge-base ${mergeBase.slice(0, 12)}`);
-            }
-            else {
-                console.error(`verify: capturing baseline at merge-base ${mergeBase.slice(0, 12)} (cached by base, lockfile and command hashes at ${cachePath})`);
-            }
-            const baseDir = join(stateDir, `base-${mergeBase.slice(0, 12)}`);
-            await shGit(`git worktree remove --force '${baseDir}'`, cwd); // stale leftover from an interrupted run
-            await shGitOk(`git worktree add --detach '${baseDir}' '${mergeBase}'`, cwd);
-            try {
-                linkNodeModules(cwd, baseDir, { force: true });
-                baseline = await captureBaseline(baseDir, commands);
-                const missing = verdictlessCommands(baseline, commands);
+            let cached;
+            if (existsSync(cachePath)) {
+                cached = JSON.parse(readFileSync(cachePath, "utf8"));
+                const missing = verdictlessCommands(cached, commands);
                 if (missing.length) {
-                    writeFileSync(verdictlessMarker, JSON.stringify({ base: mergeBase, commands: missing }) + "\n");
+                    console.error(`verify: cached baseline recorded no verdict for ${missing.join(", ")}; it was not reusable and will be recaptured`);
                     rmSync(cachePath, { force: true });
+                    cached = undefined;
                 }
-                else {
-                    writeFileSync(cachePath, JSON.stringify(baseline, null, 2));
-                    rmSync(verdictlessMarker, { force: true });
+                // OBS-1044: a cached vitest count that is a stdout sum may be inflated by nested runner echo;
+                // applying it would manufacture a deficit. Only a manifest-derived count is a floor.
+                const stale = cached ? staleFileCountCommands(cached, commands, cwd) : [];
+                if (stale.length) {
+                    console.error(`verify: cached baseline's file count for ${stale.join(", ")} is not manifest-derived; it will be recaptured`);
+                    rmSync(cachePath, { force: true });
+                    cached = undefined;
                 }
             }
-            finally {
-                await removeWorktree(cwd, baseDir);
+            if (cached) {
+                console.error(`verify: reusing cached baseline for ${mergeBase.slice(0, 12)} (${cachePath})`);
+                baseline = cached;
+            }
+            else {
+                if (existsSync(verdictlessMarker)) {
+                    console.error(`verify: prior baseline recorded no verdict and was not cached; recapturing merge-base ${mergeBase.slice(0, 12)}`);
+                }
+                else {
+                    console.error(`verify: capturing baseline at merge-base ${mergeBase.slice(0, 12)} (cached by base, lockfile and command hashes at ${cachePath})`);
+                }
+                const baseDir = join(stateDir, `base-${mergeBase.slice(0, 12)}`);
+                await shGit(`git worktree remove --force '${baseDir}'`, cwd); // stale leftover from an interrupted run
+                await shGitOk(`git worktree add --detach '${baseDir}' '${mergeBase}'`, cwd);
+                try {
+                    linkNodeModules(cwd, baseDir, { force: true });
+                    baseline = await captureBaseline(baseDir, commands);
+                    const missing = verdictlessCommands(baseline, commands);
+                    if (missing.length) {
+                        writeFileSync(verdictlessMarker, JSON.stringify({ base: mergeBase, commands: missing }) + "\n");
+                        rmSync(cachePath, { force: true });
+                    }
+                    else {
+                        writeFileSync(cachePath, JSON.stringify(baseline, null, 2));
+                        rmSync(verdictlessMarker, { force: true });
+                    }
+                }
+                finally {
+                    await removeWorktree(cwd, baseDir);
+                }
             }
         }
-    }
-    const recordJournal = values.record ? Journal.open(stateRoot, values.record) : undefined;
-    const artifactDir = join(stateDir, new Date().toISOString().replace(/[:.]/g, "-"));
-    mkdirSync(artifactDir, { recursive: true });
-    const { results } = await runGates(task, {
-        worktree: cwd, baseRef: mergeBase,
-        result: { ok: true, summary: "standalone verify — no worker claims to trust", deviations: [], raw: "" },
-        author, commands, baseline, channels, ...(judgeChannels ? { judgeChannels } : {}), adapters, cfg,
-        pipeline: "v185", verificationScope: "standalone", artifactDir, stateDir: join(stateRoot, ".tickmarkr"),
-        onGate: (e) => {
-            if (e.phase === "start")
-                console.error(`verify: → ${e.gate} (${e.index}/${e.total})`);
-            else if (e.phase === "note")
-                console.error(`verify: note ${e.gate} ${e.name} ${JSON.stringify(e.payload)}`);
-            else
-                console.error(`verify: ${e.result.pass ? "✓" : "✗"} ${e.result.gate} — ${e.result.details.split("\n")[0] ?? ""}`);
-        },
-    });
-    const green = results.length > 0 && results.every((r) => r.pass || r.meta?.skipped === true);
-    const reviewRows = results.filter((result) => result.gate === "review");
-    const reviewFindings = reviewRows.flatMap((result) => result.details.split("\n").flatMap((line) => {
-        const match = /^- \[([^\]]+)\] (.*)$/.exec(line);
-        return match ? [{ classification: match[1], note: match[2], reviewer: result.meta?.reviewer }] : [];
-    }));
-    const artifactPath = join(artifactDir, "verify-results.json");
-    writeFileSync(artifactPath, JSON.stringify({ base: baseTip, head, mergeBase, green, gateRows: results, reviewFindings }, null, 2) + "\n");
-    console.error(`verify: artifacts written to ${artifactPath}`);
-    const review = reviewRows.at(-1);
-    if (recordJournal && review) {
-        recordJournal.append("review-leg2", values.task ?? "VERIFY", {
-            base: baseTip, head, mergeBase, author: channelKey(author), artifactPath,
-            ...review,
+        const artifactDir = join(stateDir, new Date().toISOString().replace(/[:.]/g, "-"));
+        mkdirSync(artifactDir, { recursive: true });
+        const { results } = await runGates(task, {
+            worktree: cwd, baseRef: mergeBase,
+            result: { ok: true, summary: "standalone verify — no worker claims to trust", deviations: [], raw: "" },
+            author, commands, baseline, channels, ...(judgeChannels ? { judgeChannels } : {}), adapters, cfg,
+            verificationScope: "standalone", artifactDir, stateDir: join(stateRoot, ".tickmarkr"),
+            onGate: (e) => {
+                if (e.phase === "start")
+                    console.error(`verify: → ${e.gate} (${e.index}/${e.total})`);
+                else if (e.phase === "note")
+                    console.error(`verify: note ${e.gate} ${e.name} ${JSON.stringify(e.payload)}`);
+                else
+                    console.error(`verify: ${e.result.pass ? "✓" : "✗"} ${e.result.gate} — ${e.result.details.split("\n")[0] ?? ""}`);
+            },
         });
+        const green = results.length > 0 && results.every((r) => r.pass || r.meta?.skipped === true);
+        const reviewRows = results.filter((result) => result.gate === "review");
+        const reviewFindings = reviewRows.flatMap((result) => result.details.split("\n").flatMap((line) => {
+            const match = /^- \[([^\]]+)\] (.*)$/.exec(line);
+            return match ? [{ classification: match[1], note: match[2], reviewer: result.meta?.reviewer }] : [];
+        }));
+        const artifactPath = join(artifactDir, "verify-results.json");
+        writeFileSync(artifactPath, JSON.stringify({ base: baseTip, head, mergeBase, green, gateRows: results, reviewFindings }, null, 2) + "\n");
+        console.error(`verify: artifacts written to ${artifactPath}`);
+        const review = reviewRows.at(-1);
+        if (recordJournal && review) {
+            recordJournal.append("review-leg2", values.task ?? "VERIFY", {
+                base: baseTip, head, mergeBase, author: channelKey(author), artifactPath,
+                ...review,
+            });
+        }
+        if (values.json) {
+            return { out: JSON.stringify({ base: baseTip, head, mergeBase, green, artifactPath, results }, null, 2), code: green ? 0 : 2 };
+        }
+        const lines = results.map((r) => `${r.pass ? "PASS" : "FAIL"} ${r.gate}\n${r.details.split("\n").map((l) => `  ${l}`).join("\n")}`);
+        const verdict = green
+            ? `verify GREEN — ${results.length} gate(s) passed on ${mergeBase.slice(0, 12)}..${head.slice(0, 12)} (merge is a human decision; artifacts: ${artifactPath})`
+            : `verify RED — first failure decides; artifacts: ${artifactPath}`;
+        return { out: [...lines, "", verdict].join("\n"), code: green ? 0 : 2 };
     }
-    if (values.json) {
-        return { out: JSON.stringify({ base: baseTip, head, mergeBase, green, artifactPath, results }, null, 2), code: green ? 0 : 2 };
-    }
-    const lines = results.map((r) => `${r.pass ? "PASS" : "FAIL"} ${r.gate}\n${r.details.split("\n").map((l) => `  ${l}`).join("\n")}`);
-    const verdict = green
-        ? `verify GREEN — ${results.length} gate(s) passed on ${mergeBase.slice(0, 12)}..${head.slice(0, 12)} (merge is a human decision; artifacts: ${artifactPath})`
-        : `verify RED — first failure decides; artifacts: ${artifactPath}`;
-    return { out: [...lines, "", verdict].join("\n"), code: green ? 0 : 2 };
 }

package/dist/config/config.d.ts

@@ -132,7 +132,17 @@ export declare function effectiveReviewPolicy(files: ReadonlyArray<string>, revi
  * under-flagged one skips the only gate that exists for it.
  */
 export declare function criticalPathHits(files: ReadonlyArray<string>, criticalPaths?: ReadonlyArray<string>): string[];
+export declare const ExecutionPolicySchema: z.ZodObject<{
+    boundedInfrastructure: z.ZodDefault<z.ZodBoolean>;
+    repairSelection: z.ZodDefault<z.ZodBoolean>;
+    taskExecutionLimitMs: z.ZodNumber;
+}, z.core.$strict>;
 export declare const TickmarkrConfigSchema: z.ZodObject<{
+    executionPolicy: z.ZodOptional<z.ZodObject<{
+        boundedInfrastructure: z.ZodDefault<z.ZodBoolean>;
+        repairSelection: z.ZodDefault<z.ZodBoolean>;
+        taskExecutionLimitMs: z.ZodNumber;
+    }, z.core.$strict>>;
     concurrency: z.ZodNumber;
     driver: z.ZodEnum<{
         auto: "auto";
@@ -366,6 +376,7 @@ export type FleetEditable = {
     denyModels: string[];
     denyWorkersAdapters?: string[];
     denyWorkersModels?: string[];
+    allowOut?: string[];
     tiers: Record<string, Record<string, FleetTierAssignment | null>>;
     map: Record<string, MapEntry>;
     floors: Record<string, Tier>;

package/dist/config/config.js

@@ -264,7 +264,14 @@ const ShapeGateParticipationSchema = z
         });
     }
 });
+export const ExecutionPolicySchema = z.object({
+    boundedInfrastructure: z.boolean().default(false),
+    repairSelection: z.boolean().default(false),
+    taskExecutionLimitMs: z.number().int().positive(),
+}).strict();
 export const TickmarkrConfigSchema = z.object({
+    // Opt-in recovery experiment. The original run snapshot owns this across resumes.
+    executionPolicy: ExecutionPolicySchema.optional(),
     concurrency: z.number().int().positive(),
     driver: z.enum(["auto", "herdr", "subprocess", "orca"]),
     integrationBranchPrefix: z
@@ -902,12 +909,13 @@ export function universeEntryMatches(row, model, entry) {
 export function universeCovers(universe, entry) {
     return universe.some((row) => entry === row.adapter || row.models.some((m) => entry === m || entry === `${row.adapter}:${m}`));
 }
-// v1.92 fleet membership: with a discovered `universe` (classified models only) the deny sets become
-// the EFFECTIVE out-of-fleet set — the routing.allow complement (fail-closed) as adapter ids and
-// adapter:model keys, UNION every authored routing.deny adapters/models entry VERBATIM in its own list
-// (never workers). LEG2-T3 round 2 finding 2: authored entries are never collapsed into a membership
-// key, so one Space press clears one reason; finding 3: allow admission honours recorded identity.
-// Absent universe ⇒ deny arrays verbatim, so non-UI callers stay byte-identical.
+// v1.92 fleet membership: with a discovered `universe` (classified models only) the routing.allow
+// complement (fail-closed) rides as `allowOut` — adapter ids and adapter:model keys — BESIDE the
+// authored routing.deny adapters/models entries, which ride VERBATIM in their own lists (never
+// workers). LEG2-T3 round 2 finding 2: authored entries are never collapsed into a membership key;
+// OBS-1046: nor is an allow exclusion folded into a deny list — the two reasons stay distinct so
+// one Space press clears one; finding 3: allow admission honours recorded identity.
+// Absent universe ⇒ deny arrays verbatim and no allowOut, so non-UI callers stay byte-identical.
 export function fleetEditableFromConfig(cfg, universe) {
     const tiers = {};
     for (const [adapter, entry] of Object.entries(cfg.tiers)) {
@@ -916,8 +924,9 @@ export function fleetEditableFromConfig(cfg, universe) {
             tiers[adapter][model] = { tier };
         }
     }
-    let denyAdapters = [...(cfg.routing.deny?.adapters ?? [])].sort();
-    let denyModels = [...(cfg.routing.deny?.models ?? [])].sort();
+    const denyAdapters = [...(cfg.routing.deny?.adapters ?? [])].sort();
+    const denyModels = [...(cfg.routing.deny?.models ?? [])].sort();
+    let allowOut;
     if (universe !== undefined) {
         const { allow } = cfg.routing;
         const allowEntries = allow ? [...(allow.adapters ?? []), ...(allow.models ?? [])] : null;
@@ -933,14 +942,14 @@ export function fleetEditableFromConfig(cfg, universe) {
                 modelsOut.push(...out.map((m) => `${row.adapter}:${m}`));
             }
         }
-        // OBS-517: authored deny entries — covered by the probe universe or not — ride verbatim, so a
-        // transient probe failure can never un-deny one on the next write (fail-open on the ban list).
-        denyAdapters = [...new Set([...adaptersOut, ...denyAdapters])].sort();
-        denyModels = [...new Set([...modelsOut, ...denyModels])].sort();
+        // OBS-517: authored deny entries — covered by the probe universe or not — ride verbatim (above),
+        // so a transient probe failure can never un-deny one on the next write (fail-open on the ban list).
+        allowOut = [...new Set([...adaptersOut, ...modelsOut])].sort();
     }
     return {
         denyAdapters,
         denyModels,
+        ...(allowOut !== undefined ? { allowOut } : {}),
         // OBS-994: workers-only deny is never folded into the all-seats complement above — it is
         // returned verbatim beside the flat scopes so the fleet browser can show and toggle it.
         denyWorkersAdapters: [...(cfg.routing.deny?.workers?.adapters ?? [])].sort(),