tickmarkr 2.5.5 → 2.5.6

package/dist/gates/baseline.js

@@ -2,6 +2,8 @@ import { existsSync, readFileSync } from "node:fs";
 import { availableParallelism, loadavg } from "node:os";
 import { join } from "node:path";
 import { DEFAULT_SHELL_TIMEOUT_MS, describeCapacity, sameCapacity, sh } from "../run/git.js";
+import { executionSignal } from "../run/execution-budget.js";
+import { isVitestTestCommand, manifestFileCount } from "./test-manifest.js";
 // incident #2 (run-20260709-104447): a vitest ✓ PASS line with "error" in the test NAME, wrapped in ANSI
 // codes that varied between baseline and worktree runs, was reported as a "new failure". Strip ANSI first;
 // a pass-marker line is never a failure. [\d;#] covers raw ANSI and digit-normalized ANSI ("\x1b[#m") from
@@ -464,6 +466,27 @@ const invalidCaptureEntry = (durationMs, invalidCause, invalidatingLines = []) =
     ceilingMs: effectiveCeilingMs({ durationMs }),
     ...(invalidatingLines.length ? { invalidatingLines } : {}),
 });
+// OBS-1044: a vitest command's count is the manifest discovery seam's (the same listing the gate
+// asks the report to certify), never a sum of every summary line in stdout — tests that spawn
+// nested runners echo their own summaries through the filter and inflated a baseline by two files,
+// so any diff that changed the nested echo read as a deficit. The listing is a collection, not a
+// run: the suite still runs exactly once here. Any other command keeps the stdout sum.
+const captureFileCount = async (cwd, cmd, raw) => {
+    if (!isVitestTestCommand(cmd, cwd))
+        return { fileCount: runnerFileCount(raw) };
+    const fileCount = await manifestFileCount(cmd, cwd);
+    return fileCount === null ? { fileCount } : { fileCount, fileCountSource: "manifest" };
+};
+/** OBS-1044: a cached vitest entry whose count is a stdout sum may be inflated; only a manifest-derived
+ * count is safe to apply as a deficit floor. A null count compares nothing and is safe as-is. */
+export function staleFileCountCommands(baseline, commands, cwd) {
+    return Object.entries(commands)
+        .filter(([name, cmd]) => {
+        const entry = baseline.commands[name];
+        return entry?.fileCount != null && entry.fileCountSource !== "manifest" && isVitestTestCommand(cmd, cwd);
+    })
+        .map(([name]) => name);
+}
 export async function captureBaseline(cwd, commands) {
     const base = { commands: {} };
     for (const [name, cmd] of Object.entries(commands)) {
@@ -495,7 +518,7 @@ export async function captureBaseline(cwd, commands) {
             console.error(`tickmarkr: baseline capture for "${name}" was killed at its ${CAPTURE_CEILING_MS}ms ceiling — `
                 + `it recorded NO fingerprints, so nothing is forgiven and every gate will treat a pre-existing `
                 + `failure as a fresh one. Raise the ceiling or shorten the command.`);
-            base.commands[name] = { ...invalidCaptureEntry(durationMs, "ceiling-kill"), fileCount: runnerFileCount(raw) };
+            base.commands[name] = { ...invalidCaptureEntry(durationMs, "ceiling-kill"), ...await captureFileCount(cwd, cmd, raw) };
             continue;
         }
         // Run 2137: the child exited and printed ordinary FAIL/AssertionError lines, so the gate-side
@@ -509,7 +532,7 @@ export async function captureBaseline(cwd, commands) {
                 + `it recorded NO exit-code verdict and NO fingerprints, so nothing is forgiven for this command; `
                 + `the measurement cannot distinguish a pre-existing failure from one caused by exhaustion. `
                 + `First invalidating line: ${invalidatingLines[0]}`);
-            base.commands[name] = { ...invalidCaptureEntry(durationMs, "resource-exhaustion", invalidatingLines), fileCount: runnerFileCount(raw) };
+            base.commands[name] = { ...invalidCaptureEntry(durationMs, "resource-exhaustion", invalidatingLines), ...await captureFileCount(cwd, cmd, raw) };
             continue;
         }
         // OBS-966: a worker RPC timeout is infra even beside an all-green summary.
@@ -517,7 +540,7 @@ export async function captureBaseline(cwd, commands) {
         const runnerVerdict = classifyRunnerOutput(raw, r.code);
         if (runnerVerdict === "infra") {
             console.error(`tickmarkr: baseline capture for "${name}" carries runner-infrastructure evidence — it recorded NO verdict; nothing is forgiven for this command`);
-            base.commands[name] = { ...invalidCaptureEntry(durationMs, "infra", withoutVitestEchoBlocks(combinedOutput).filter((line) => isInfraLine(line.replace(ANSI_RE, "")))), fileCount: runnerFileCount(raw) };
+            base.commands[name] = { ...invalidCaptureEntry(durationMs, "infra", withoutVitestEchoBlocks(combinedOutput).filter((line) => isInfraLine(line.replace(ANSI_RE, "")))), ...await captureFileCount(cwd, cmd, raw) };
             continue;
         }
         base.commands[name] = {
@@ -529,7 +552,7 @@ export async function captureBaseline(cwd, commands) {
             missingCommand: missingConfiguredCommand(cmd, r),
             durationMs,
             ...fileTiming(raw, durationMs),
-            fileCount: runnerFileCount(raw),
+            ...await captureFileCount(cwd, cmd, raw),
             ceilingMs: effectiveCeilingMs({ durationMs }),
             // T7: the world this measurement was taken in, so a later reader can ask whether its own world
             // is the same one. Recorded from THIS command's own shell result, never re-derived here.
@@ -615,7 +638,10 @@ export async function compareToBaseline(cwd, commands, baseline, enabled, opts =
         // T7: every verdict below carries the capacity ITS OWN command ran under, taken off the shell
         // result rather than re-derived after the fact. The skip row above ran no command and therefore
         // states no capacity — a row that never divided the machine must not claim that it did.
+        let recoveryBlocked;
         const record = (g) => {
+            if (recoveryBlocked)
+                g = { ...g, meta: { ...g.meta, recoveryBlocked } };
             const withReap = r.reapedGroup ? { ...g, meta: { ...g.meta, reapedGroup: true } } : g;
             const withReapError = r.reapError ? { ...withReap, meta: { ...withReap.meta, reapError: r.reapError } } : withReap;
             const withRerun = rerunOf ? {
@@ -697,19 +723,37 @@ export async function compareToBaseline(cwd, commands, baseline, enabled, opts =
         // retain the whole-output read so a repeated infra abort can never be baseline-forgiven as green.
         const classification = classifyFreshRunnerOutput(entry, raw, r.code);
         if (name === "test" && classification === "infra" && !rerunOf && !opts.infraRerun) {
-            const waitedMs = await waitForCalmWindow();
-            const provenance = { durationMs: r.durationMs ?? 0, referenceMs: entry?.durationMs ?? 0, waitedMs };
-            results.push(...await compareToBaseline(cwd, { [name]: cmd }, baseline, [name], { ...opts, infraRerun: provenance }));
-            continue;
+            const waitedMs = await waitForCalmWindow(executionSignal());
+            if (opts.authorizeRetry && !calmWindowReady()) {
+                recoveryBlocked = "calm window unavailable within the existing wait ceiling";
+            }
+            else if (opts.authorizeRetry && !opts.authorizeRetry("infra")) {
+                recoveryBlocked = "infrastructure retry allowance exhausted or subject unavailable";
+            }
+            else {
+                const provenance = { durationMs: r.durationMs ?? 0, referenceMs: entry?.durationMs ?? 0, waitedMs };
+                results.push(...await compareToBaseline(cwd, { [name]: cmd }, baseline, [name], { ...opts, infraRerun: provenance }));
+                continue;
+            }
         }
         // OBS-896: every fresh failure must be timeout-class, and the suite must take at least twice its
         // own baseline measurement. The first read buys one calm rerun here, never a worker repair.
         if (name === "test" && classification !== "infra" && failing.length && !rerunOf && !opts.infraRerun
             && hostStarved(failing.join("\n"), r.durationMs ?? 0, entry?.durationMs)) {
-            const waitedMs = await waitForCalmWindow();
-            const provenance = { durationMs: r.durationMs ?? 0, referenceMs: entry?.durationMs ?? 0, waitedMs };
-            results.push(...await compareToBaseline(cwd, { [name]: cmd }, baseline, [name], { ...opts, rerunOf: provenance }));
-            continue;
+            const waitedMs = await waitForCalmWindow(executionSignal());
+            if (opts.authorizeRetry && !calmWindowReady()) {
+                recoveryBlocked = "calm window unavailable within the existing wait ceiling";
+            }
+            else if (opts.authorizeRetry && !opts.authorizeRetry("host-starved")) {
+                recoveryBlocked = "verification retry allowance exhausted or subject unavailable";
+            }
+            else {
+                // Compatibility with OBS-896, not an infrastructure reclassification: a persistent
+                // timeout remains the ordinary conservative verdict after the single bounded remeasure.
+                const provenance = { durationMs: r.durationMs ?? 0, referenceMs: entry?.durationMs ?? 0, waitedMs };
+                results.push(...await compareToBaseline(cwd, { [name]: cmd }, baseline, [name], { ...opts, rerunOf: provenance }));
+                continue;
+            }
         }
         if (classification === "infra") {
             const evidence = failing.length
@@ -827,11 +871,14 @@ const DEFAULT_CALM = {
 let calm = DEFAULT_CALM;
 export function setCalmWindowForTests(over) { calm = { ...calm, ...over }; }
 export function resetCalmWindowForTests() { calm = DEFAULT_CALM; }
-export async function waitForCalmWindow() {
+export function calmWindowReady() { return calm.loadProvider() <= calm.calmLoad(); }
+export async function waitForCalmWindow(signal) {
     const started = Date.now();
     while (calm.loadProvider() > calm.calmLoad() && Date.now() - started < calm.maxWaitMs) {
-        await new Promise((resolve) => setTimeout(resolve, calm.pollMs));
+        signal?.throwIfAborted();
+        await new Promise((resolve) => setTimeout(resolve, signal ? Math.min(calm.pollMs, 100) : calm.pollMs));
     }
+    signal?.throwIfAborted();
     return Date.now() - started;
 }
 /** Summary totals survive digit-normalized fingerprints and exclude test-owned echoed output. */

package/dist/gates/cache.d.ts

@@ -1,6 +1,6 @@
 import type { Baseline } from "./baseline.js";
 import type { GateResult } from "./types.js";
-import { type RunCapacity } from "../run/git.js";
+import { type RunCapacity, type VerificationProtocol } from "../run/git.js";
 export declare const DEFAULT_VERDICT_CACHE_BOUND = 128;
 export declare function setVerdictCacheBoundForTests(bound: number | undefined): void;
 export declare function resetVerdictCacheBoundForTests(): void;
@@ -16,15 +16,19 @@ export interface GateEnvironmentInput {
     capacity?: RunCapacity;
     selectedSet?: readonly string[];
     scope?: VerificationScope;
+    /** R41: the verification protocol + runner lifecycle policy; defaults to this process's. */
+    verification?: VerificationProtocol;
+}
+export interface EnvironmentParts {
+    nodeRuntime: string;
+    lockfile: string;
+    capacity: RunCapacity;
+    selectedSet?: readonly string[];
+    verification: VerificationProtocol;
 }
 export declare function environmentFingerprint(env: GateEnvironmentInput): {
     fingerprint: string;
-    parts: {
-        nodeRuntime: string;
-        lockfile: string;
-        capacity: RunCapacity;
-        selectedSet?: readonly string[];
-    };
+    parts: EnvironmentParts;
 };
 export type VerificationScope = "battery" | "tip" | "standalone";
 export interface VerificationIdentity {
@@ -38,12 +42,7 @@ export interface VerificationIdentity {
     command: string;
     baseline: string;
     environment: string;
-    envParts?: {
-        nodeRuntime: string;
-        lockfile: string;
-        capacity: RunCapacity;
-        selectedSet?: readonly string[];
-    };
+    envParts?: EnvironmentParts;
 }
 export declare function computeVerificationIdentity(params: {
     worktree: string;
@@ -56,6 +55,7 @@ export declare function computeVerificationIdentity(params: {
     tree?: string;
     lockfile?: string;
     nodeRuntime?: string;
+    verification?: VerificationProtocol;
 }): Promise<VerificationIdentity | undefined>;
 export declare function verificationIdentityKey(id: VerificationIdentity): string;
 export declare function formatReusedDetails(originalDetails: string, id: VerificationIdentity): string;
@@ -89,6 +89,7 @@ export declare class VerdictStore {
     readonly dir: string;
     constructor(dir: string);
     private initSequenceFromDisk;
+    private static unknownPolicy;
     get(id?: VerificationIdentity): CachedVerdict | undefined;
     set(id: VerificationIdentity | undefined, verdict: GateResult | CachedVerdict): boolean;
     size(): number;

package/dist/gates/cache.js

@@ -3,7 +3,7 @@ import { execSync } from "node:child_process";
 import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { tmpdir } from "node:os";
-import { describeCapacity, resolvedCapacity, shGit } from "../run/git.js";
+import { describeCapacity, resolvedCapacity, shGit, verificationProtocol } from "../run/git.js";
 import { shq } from "../adapters/types.js";
 export const DEFAULT_VERDICT_CACHE_BOUND = 128;
 let testCacheBound;
@@ -83,17 +83,23 @@ export function environmentFingerprint(env) {
     const cap = env.capacity ?? resolvedCapacity();
     const capacity = { forkCap: cap.forkCap, cores: cap.cores };
     const selectedSet = env.selectedSet ? [...env.selectedSet].sort() : undefined;
+    const verification = env.verification ?? verificationProtocol(process.env, env.worktree ?? process.cwd());
+    // R41: the protocol and the EFFECTIVE lifecycle are IN the hashed payload, so every entry written
+    // before this stamp — green or red — keys differently and is never answered; no store surgery is
+    // needed. `source` is provenance (kept in parts, printed on the row) and never enters the key: an
+    // explicit `false` and an npmrc `false` are the same policy for the child that ran.
     const payload = canonicalJson({
         nodeRuntime,
         lockfile,
         capacity,
         selectedSet: selectedSet ?? null,
         scope: env.scope ?? "battery",
+        verification: { protocol: verification.protocol, lifecycle: verification.lifecycle },
     });
     const fingerprint = createHash("sha256").update(payload).digest("hex").slice(0, 16);
     return {
         fingerprint,
-        parts: { nodeRuntime, lockfile, capacity, selectedSet },
+        parts: { nodeRuntime, lockfile, capacity, selectedSet, verification },
     };
 }
 export async function computeVerificationIdentity(params) {
@@ -108,6 +114,7 @@ export async function computeVerificationIdentity(params) {
         lockfile: params.lockfile,
         nodeRuntime: params.nodeRuntime,
         scope: params.scope,
+        verification: params.verification,
     });
     return {
         gate: params.gate,
@@ -130,7 +137,7 @@ export function verificationIdentityKey(id) {
 export function formatReusedDetails(originalDetails, id) {
     const unadorned = originalDetails.replace(/^reused verdict \(identity: [^)]+\):\s*/, "");
     const envDesc = id.envParts
-        ? ` [node=${id.envParts.nodeRuntime}, lockfile=${id.envParts.lockfile}, capacity=${describeCapacity(id.envParts.capacity)}${id.envParts.selectedSet ? `, selected=${id.envParts.selectedSet.join(",")}` : ""}]`
+        ? ` [node=${id.envParts.nodeRuntime}, lockfile=${id.envParts.lockfile}, capacity=${describeCapacity(id.envParts.capacity)}${id.envParts.selectedSet ? `, selected=${id.envParts.selectedSet.join(",")}` : ""}, protocol=${id.envParts.verification.protocol}, lifecycle=${id.envParts.verification.lifecycle} (${id.envParts.verification.source})]`
         : "";
     const gate = id.gate ?? "gate";
     const prefix = `reused ${id.scope === "tip" ? "tip " : ""}verdict (identity: gate=${gate} tree=${id.tree}${id.worktree ? ` worktree=${id.worktree}` : ""} command=${id.command} baseline=${id.baseline} env=${id.environment}${envDesc})`;
@@ -258,8 +265,13 @@ export class VerdictStore {
             // ignore
         }
     }
+    // R41: an identity whose lifecycle policy could not be measured is never answered and never
+    // stored — an unknown policy is not comparable to anything, so the battery runs the command.
+    static unknownPolicy(id) {
+        return id.envParts?.verification?.lifecycle === "unknown";
+    }
     get(id) {
-        if (!id || !id.tree)
+        if (!id || !id.tree || VerdictStore.unknownPolicy(id))
             return undefined;
         const key = verificationIdentityKey(id);
         const p = join(this.dir, `verdict-${key}.json`);
@@ -276,7 +288,7 @@ export class VerdictStore {
         return undefined;
     }
     set(id, verdict) {
-        if (!id || !id.tree)
+        if (!id || !id.tree || VerdictStore.unknownPolicy(id))
             return false;
         if (isInfraResult(verdict))
             return false;

package/dist/gates/llm.d.ts

@@ -62,11 +62,14 @@ export interface LlmRunResult {
     exitCode?: number;
     timedOut: boolean;
     launchNeverStarted?: boolean;
+    /** OBS-1039: seat-authored bytes stayed under REVIEW_SILENT_BYTE_FLOOR at the first liveness beat. */
+    silentAtBeat?: boolean;
     seatAuthoredBytes?: number;
 }
 export declare const PROMPT_GLYPHS: readonly ["➜", "❯", "$", "%", ">>", ">"];
 export declare function reviewSeatOutput(raw: string, nonce: string, adapterBannerRows?: readonly string[]): string;
 export declare const REVIEW_FIRST_LIVENESS_MS = 30000;
+export declare const REVIEW_SILENT_BYTE_FLOOR = 64;
 export declare function runHeadless(adapter: WorkerAdapter, model: string, prompt: string, cwd: string, timeoutMs?: number): Promise<string>;
 export declare function runViaDriver(adapter: WorkerAdapter, model: string, prompt: string, cwd: string, via: LlmVia, timeoutMs?: number): Promise<string>;
 export declare function dewrapPaneVerdict(out: string, nonce: string): string;

package/dist/gates/llm.js

@@ -300,6 +300,10 @@ export function reviewSeatOutput(raw, nonce, adapterBannerRows = []) {
     return trailer ? seat.slice(0, trailer.index) : seat;
 }
 export const REVIEW_FIRST_LIVENESS_MS = 30_000;
+// OBS-1039: a seat that wrote ten bytes and went quiet escaped the zero-byte beat and sat to the
+// ceiling. Below this many seat-authored bytes at the first beat the seat is `silent` — demoted and
+// re-routed then, not at the ceiling. Pane path only; a headless runner buffers and keeps its ceiling.
+export const REVIEW_SILENT_BYTE_FLOOR = 64;
 async function runHeadlessDetailed(adapter, model, prompt, cwd, timeoutMs = 300000) {
     const dir = mkdtempSync(join(tmpdir(), "tickmarkr-llm-"));
     try {
@@ -356,6 +360,7 @@ async function runViaDriverDetailed(adapter, model, prompt, cwd, via, timeoutMs
         let out;
         let timedOut = false;
         let launchNeverStarted = false;
+        let silentAtBeat = false;
         let seatAuthoredBytes = 0;
         const gatePrompt = prompt.startsWith("TICKMARKR-JUDGE") || prompt.startsWith("TICKMARKR-REVIEW");
         if (!gatePrompt) {
@@ -412,6 +417,11 @@ async function runViaDriverDetailed(adapter, model, prompt, cwd, via, timeoutMs
                         forceClose = true;
                         break;
                     }
+                    if (seatAuthoredBytes < REVIEW_SILENT_BYTE_FLOOR) {
+                        silentAtBeat = true;
+                        forceClose = true;
+                        break;
+                    }
                 }
                 // Producing reviews own their full ceiling; inactivity is not a review verdict.
                 if (reviewing)
@@ -458,6 +468,7 @@ async function runViaDriverDetailed(adapter, model, prompt, cwd, via, timeoutMs
             ...(Number.isFinite(exitCode) ? { exitCode } : {}),
             timedOut,
             launchNeverStarted,
+            silentAtBeat,
             seatAuthoredBytes,
         };
     }

package/dist/gates/review.d.ts

@@ -64,6 +64,13 @@ export declare function matchClosureId(candidate: unknown, fingerprints: Iterabl
  * all route through matchClosureId.
  */
 export declare function isReviewClosureInvalid(v: Pick<ReviewVerdict, "resolved" | "reraised"> | null | undefined, priorIds: ReadonlySet<string> | readonly string[]): boolean;
+/**
+ * OBS-1013 add.3: the reviewer ECHOED closure ids and at least one matches no carried fingerprint —
+ * it answered about the materials and missed the id (a retyped, truncated or paraphrased fingerprint).
+ * That is a no-verdict about the carried work (re-route), not a parse defect. A verdict that omits a
+ * list, carries a non-string or duplicates an id stays malformed: its shape, not its ids, is wrong.
+ */
+export declare function isReviewClosureMismatch(v: Pick<ReviewVerdict, "resolved" | "reraised"> | null | undefined, priorIds: ReadonlySet<string> | readonly string[]): boolean;
 export type ReviewerFloorCause = "author-tier" | "task-floor" | "config" | "prior-reviewer";
 /**
  * RF-1 (OBS-922 add.2/3): the tier a reviewer must meet is the maximum of the author's tier, the
@@ -101,12 +108,30 @@ export declare function pickReviewer(author: Assignment, channels: BillingChanne
 prefer?: string[], // v1.53 T2: review.prefer — reorders eligible channels, never changes eligibility
 floor?: Tier, // task/config/prior floor from the caller; the author's own tier is ALWAYS applied here (RF-1)
 history?: string[], // run-scoped picks, oldest to newest; empty preserves the established ranking
-onSeat?: (seat: number, count: number) => void, demoted?: ReadonlySet<string>): BillingChannel | null;
-export type ReviewUnparseableCause = VerdictUnparseableCause | "launch-never-started" | "truncated" | "silent";
+onSeat?: (seat: number, count: number) => void, demoted?: ReadonlySet<string>, excludeVendors?: ReadonlySet<string>): BillingChannel | null;
+export type ReviewUnparseableCause = VerdictUnparseableCause | "launch-never-started" | "truncated" | "silent" | "closure-mismatch";
 /**
  * This shows the reviewer what the task DECLARED, never what the diff may actually reach. The diff
  * remains a separate stated input, so whether its touched paths fit the declaration stays a reviewer
  * judgement rather than a guarantee made by this renderer.
  */
 export declare function renderDeclaredWriteScope(files: ReadonlyArray<string>): string;
-export declare function reviewGate(task: Task, worktree: string, baseRef: string, author: Assignment, channels: BillingChannel[], adapters: WorkerAdapter[], cfg: TickmarkrConfig, via?: GateVia, excludeReviewers?: string[], artifactDir?: string, reviewHistory?: string[], demotedReviewers?: ReadonlySet<string>, carriedFindings?: readonly StructuredFinding[], priorReviewers?: readonly PriorReviewer[]): Promise<GateResult>;
+/**
+ * OBS-1033: the vendors of the seats that authored commits inside the accumulated diff. A seat is
+ * never handed its own earlier work to approve. A prior author not resolvable in the pool excludes
+ * its adapter's vendors instead (fail closed: the seat is known, its vendor is whatever it bills as).
+ */
+export declare function carriedAuthorVendors(channels: BillingChannel[], carriedAuthors?: readonly string[]): Set<string>;
+/**
+ * OBS-1020: the compiled goal is the contract. After `resume --graph-changed` the worktree's copy of
+ * the spec is the pre-change text on the integration branch, so a reviewer that reads it grades a
+ * superseded contract. The daemon's repository root is where specs and planning records are current.
+ */
+export declare function renderGoalSection(goal: string, repoRoot?: string): string;
+/**
+ * OBS-1013 add.3: each carried id is printed ONCE, verbatim, inside a fenced block the reviewer can
+ * copy; the notes follow in the same order. A reviewer that retyped a 600-byte id from prose lost
+ * closure on a typo and that read as malformed — the block is what a closure list is copied from.
+ */
+export declare function renderPriorMaterials(priorMaterials: readonly StructuredFinding[]): string;
+export declare function reviewGate(task: Task, worktree: string, baseRef: string, author: Assignment, channels: BillingChannel[], adapters: WorkerAdapter[], cfg: TickmarkrConfig, via?: GateVia, excludeReviewers?: string[], artifactDir?: string, reviewHistory?: string[], demotedReviewers?: ReadonlySet<string>, carriedFindings?: readonly StructuredFinding[], priorReviewers?: readonly PriorReviewer[], carriedAuthors?: readonly string[]): Promise<GateResult>;

package/dist/gates/review.js

@@ -1,5 +1,5 @@
 import { existsSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 import { channelKey, shq } from "../adapters/types.js";
 import { criticalPathHits, DEFAULT_DIFF_CAP, DEFAULT_REVIEW_CRITICAL_PATHS, declaredReviewPolicy, isReviewLeafPath, raiseReviewPolicy, REVIEW_VERSION_MIRRORS, TIER_RANK, } from "../config/config.js";
 import { filesGlob } from "../graph/files-glob.js";
@@ -10,6 +10,7 @@ import { structuredFindings } from "../run/journal.js";
 import { redactSecrets } from "../run/redact.js";
 import { marginalCostRank } from "../route/router.js";
 import { modelProvider } from "../route/preference.js";
+import { resolveStateDir } from "./cache.js";
 import { appendAnchoredReview, COMPLETION_FAKING_CHECKLIST, extractVerdictJson, generateVerdictNonce, runLlmDetailed, verdictNonceLine } from "./llm.js";
 import { classifyVerdictCause } from "./verdict-cause.js";
 import { captureDiffCapFor, measureArtifactDiff, reviewableLogicDiff, } from "./artifact-manifest.js";
@@ -130,8 +131,14 @@ export function checkDiffCap(gate, measured, cap, prefix = "") {
         gate,
         pass: false,
         details: prefix + `diff exceeds verifiable cap (${measured} > ${cap}) — ${DIFF_CAP_REMEDY}`,
-        // daemon/run-gates: park('human') immediately — the diff cannot shrink by retrying (OBS-48).
-        meta: { park: "human" },
+        meta: {
+            park: "diff-cap",
+            parkKind: "diff-cap",
+            measuredBytes: measured,
+            permittedBytes: cap,
+            measured,
+            permitted: cap,
+        },
     };
 }
 /** Apply the strict reviewable-logic cap and the finite, larger capture cap independently. */
@@ -147,12 +154,19 @@ export function checkTaskDiffCaps(gate, measured, logicCap, prefix = "") {
         pass: false,
         details: prefix
             + `captured artifact diff exceeds verifiable capture cap (${measured.captureBytes} > ${captureCap}) — ${DIFF_CAP_REMEDY}`,
-        meta: { park: "human" },
+        meta: {
+            park: "diff-cap",
+            parkKind: "diff-cap",
+            measuredBytes: measured.captureBytes,
+            permittedBytes: captureCap,
+            measured: measured.captureBytes,
+            permitted: captureCap,
+        },
     };
 }
 export function isDiffCapPark(result) {
     return result.pass === false
-        && result.meta?.park === "human"
+        && result.meta?.parkKind === "diff-cap"
         && /diff exceeds verifiable (?:capture )?cap/i.test(result.details);
 }
 // ponytail: single policy hook for callers after runGates — skips the escalation ladder on diff-cap trips.
@@ -193,6 +207,21 @@ export function isReviewClosureInvalid(v, priorIds) {
         || new Set(allCandidateIds.map((id) => matchClosureId(id, priors) ?? id)).size !== allCandidateIds.length
         || [...priors].some((id) => !allCandidateIds.some((candidate) => matchClosureId(candidate, id))));
 }
+/**
+ * OBS-1013 add.3: the reviewer ECHOED closure ids and at least one matches no carried fingerprint —
+ * it answered about the materials and missed the id (a retyped, truncated or paraphrased fingerprint).
+ * That is a no-verdict about the carried work (re-route), not a parse defect. A verdict that omits a
+ * list, carries a non-string or duplicates an id stays malformed: its shape, not its ids, is wrong.
+ */
+export function isReviewClosureMismatch(v, priorIds) {
+    if (!v || !Array.isArray(v.resolved) || !Array.isArray(v.reraised))
+        return false;
+    const ids = [...v.resolved, ...v.reraised];
+    if (!ids.every((id) => typeof id === "string"))
+        return false;
+    const priors = priorIds instanceof Set ? priorIds : new Set(priorIds);
+    return ids.some((id) => matchClosureId(id, priors) === undefined);
+}
 // v1.53 T2: same entry grammar as routing.map.prefer (router.ts preferIndex — router is out of this
 // module's dependency direction for a private fn, so the 3 lines live here too): `adapter` matches
 // every channel of that adapter, `adapter:model` exactly one; unmatched channels sort after all entries.
@@ -247,7 +276,9 @@ export function pickReviewer(author, channels, exclude = [], // v1.1 failover: r
 prefer = [], // v1.53 T2: review.prefer — reorders eligible channels, never changes eligibility
 floor, // task/config/prior floor from the caller; the author's own tier is ALWAYS applied here (RF-1)
 history = [], // run-scoped picks, oldest to newest; empty preserves the established ranking
-onSeat, demoted = new Set()) {
+onSeat, demoted = new Set(), 
+// OBS-1033: vendors that authored a carried commit inside the accumulated diff — excluded for the round.
+excludeVendors = new Set()) {
     // FLEET-05 success criterion 2: an author not resolvable in the channel list yields NO reviewer.
     // The old `?? author.adapter` fallback compared an adapter id to vendor names, matched nothing, and
     // admitted every reviewer — including the author's own channel (fail-OPEN). null lands on reviewGate's
@@ -267,6 +298,7 @@ onSeat, demoted = new Set()) {
         && modelProvider(c.model, c.vendor) !== authorProvider
         && modelId(c.model) !== modelId(author.model)
         && !exclude.includes(channelKey(c))
+        && !excludeVendors.has(c.vendor)
         && TIER_RANK[c.tier] >= TIER_RANK[effectiveFloor])
         .sort((a, b) => reviewPreferIndex(a, prefer) - reviewPreferIndex(b, prefer) || TIER_RANK[b.tier] - TIER_RANK[a.tier] || marginalCostRank(a) - marginalCostRank(b));
     const reviewer = [...ranked].sort((a, b) => Number(demoted.has(channelKey(a))) - Number(demoted.has(channelKey(b)))
@@ -289,13 +321,66 @@ export function renderDeclaredWriteScope(files) {
 The task DECLARED these write-scope patterns:
 ${files.map((path) => `- ${path}`).join("\n")}`;
 }
+/**
+ * OBS-1033: the vendors of the seats that authored commits inside the accumulated diff. A seat is
+ * never handed its own earlier work to approve. A prior author not resolvable in the pool excludes
+ * its adapter's vendors instead (fail closed: the seat is known, its vendor is whatever it bills as).
+ */
+export function carriedAuthorVendors(channels, carriedAuthors = []) {
+    const vendors = new Set();
+    for (const key of carriedAuthors) {
+        const adapter = key.split(":")[0];
+        const exact = channels.filter((c) => channelKey(c) === key);
+        for (const c of exact.length ? exact : channels.filter((c) => c.adapter === adapter))
+            vendors.add(c.vendor);
+    }
+    return vendors;
+}
+/**
+ * OBS-1020: the compiled goal is the contract. After `resume --graph-changed` the worktree's copy of
+ * the spec is the pre-change text on the integration branch, so a reviewer that reads it grades a
+ * superseded contract. The daemon's repository root is where specs and planning records are current.
+ */
+export function renderGoalSection(goal, repoRoot) {
+    return `## Goal (authoritative — compiled from the sealed graph; the worktree's spec file may be stale after resume --graph-changed)
+${goal}
+${repoRoot ? `Specs and planning records are read in the daemon's repository root ${repoRoot} (its specs/ and .planning/), never this worktree's copies.` : ""}`;
+}
+/**
+ * The daemon's repository root: the parent of the state dir the run's artifacts live under. Named
+ * only when that state dir exists — a guessed one would send the reviewer to a path that holds nothing.
+ */
+function daemonRepoRoot(worktree, artifactDir) {
+    try {
+        const stateDir = resolveStateDir(worktree, artifactDir);
+        return stateDir.endsWith("/.tickmarkr") && existsSync(stateDir) ? dirname(stateDir) : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * OBS-1013 add.3: each carried id is printed ONCE, verbatim, inside a fenced block the reviewer can
+ * copy; the notes follow in the same order. A reviewer that retyped a 600-byte id from prose lost
+ * closure on a typo and that read as malformed — the block is what a closure list is copied from.
+ */
+export function renderPriorMaterials(priorMaterials) {
+    return `## Prior materials this attempt must close
+Copy each fingerprint below EXACTLY (they appear once, in this block) into resolved or reraised:
+\`\`\`text
+${priorMaterials.map((finding) => `Fingerprint: ${finding.fingerprint}`).join("\n")}
+\`\`\`
+${priorMaterials.map((finding, i) => `${i + 1}. ${finding.note}`).join("\n\n")}`;
+}
 export async function reviewGate(task, worktree, baseRef, author, channels, adapters, cfg, via, excludeReviewers, 
 // OBS-196: run dir for raw-output persistence on an unparseable verdict; absent (older callers,
 // direct tests) skips persistence and changes nothing else.
 artifactDir, reviewHistory, demotedReviewers, carriedFindings = [], 
 // RF-1: channel keys of THIS task's prior reviewers (earlier rounds, a flaked seat) — task-scoped,
 // never the run-wide rotation history nor excludeReviewers; the seat holds the highest of their tiers.
-priorReviewers = []) {
+priorReviewers = [], 
+// OBS-1033: channel keys of the seats that authored the carried commits (the daemon's tried list).
+carriedAuthors = []) {
     // R3 (OBS-186): participation is keyed on PATHS. The compiler's assignment comes from the DECLARED
     // files[]; the operator's floor may RAISE it to full and can never lower it. `complexityThreshold` is
     // retired — the branch that returned a green skip on a complexity comparison is gone, and with it the
@@ -370,7 +455,7 @@ priorReviewers = []) {
     const { floor: reviewerFloor, cause: reviewerFloorCause } = gateReviewerFloor(task, cfg, author, channels, priorReviewers);
     const floorMeta = { reviewerFloor, reviewerFloorCause };
     let rotationSeat;
-    const reviewer = pickReviewer(author, channels, excludeReviewers ?? [], cfg.review.prefer ?? [], reviewerFloor, reviewHistory, reviewHistory ? (seat) => { rotationSeat = seat; } : undefined, demotedReviewers);
+    const reviewer = pickReviewer(author, channels, excludeReviewers ?? [], cfg.review.prefer ?? [], reviewerFloor, reviewHistory, reviewHistory ? (seat) => { rotationSeat = seat; } : undefined, demotedReviewers, carriedAuthorVendors(channels, carriedAuthors));
     if (!reviewer) {
         // meta.noEligibleReviewer lets run-gates' review-retry keep the ORIGINAL unparseable result when
         // the retry finds no second seat — a truthful cause beats a synthetic no-reviewer failure.
@@ -390,6 +475,7 @@ priorReviewers = []) {
     if (capFail)
         return capFail;
     const nonce = generateVerdictNonce();
+    const repoRoot = daemonRepoRoot(worktree, artifactDir);
     const prompt = `TICKMARKR-REVIEW
 You are a skeptical cross-vendor code reviewer. Another agent (vendor: ${author.adapter}) authored this diff.
 Look for correctness bugs, security issues, and acceptance-criteria gaps. Approve only if you would merge it.
@@ -397,13 +483,13 @@ Look for correctness bugs, security issues, and acceptance-criteria gaps. Approv
 ${COMPLETION_FAKING_CHECKLIST}
 
 ## Task ${task.id}: ${task.title} (complexity ${task.complexity})
+${renderGoalSection(task.goal, repoRoot)}
 ## Acceptance criteria
 ${task.acceptance.map((a) => `- ${renderAcceptanceItem(a)}`).join("\n")}
 
 ${renderDeclaredWriteScope(task.files)}
 
-${priorMaterials.length ? `## Prior materials this attempt must close
-${priorMaterials.map((finding) => `Fingerprint: ${finding.fingerprint}\n${finding.note}`).join("\n\n")}
+${priorMaterials.length ? `${renderPriorMaterials(priorMaterials)}
 
 ` : ""}## Diff
 \`\`\`diff
@@ -483,17 +569,22 @@ The top-level comments array is optional. Use it only for actionable line-anchor
     const findings = v && Array.isArray(v.findings) ? v.findings : null;
     const priorIds = new Set(priorMaterials.map((finding) => finding.fingerprint));
     const closureInvalid = isReviewClosureInvalid(v, priorIds);
+    const closureMismatch = closureInvalid && isReviewClosureMismatch(v, priorIds);
     // findings decides the verdict on its own; the legacy path still needs approve + issues to parse.
     if (!v || closureInvalid || (findings === null && (typeof v.approve !== "boolean" || !Array.isArray(v.issues)))) {
         // OBS-196: name the cause and persist the raw bytes — a ruled-on "unparseable" without its
         // evidence cannot be audited, and a cutoff must never be indistinguishable from a parse defect.
         const bytes = llm.seatAuthoredBytes ?? Buffer.byteLength(raw.trim(), "utf8");
-        const cause = closureInvalid ? "malformed-verdict" : llm.launchNeverStarted ? "launch-never-started"
-            : llm.timedOut ? (bytes > 0 ? "truncated" : "silent")
-                : classifyVerdictCause(raw, nonce, "approve", llm);
+        const cause = closureMismatch ? "closure-mismatch" : closureInvalid ? "malformed-verdict"
+            : llm.launchNeverStarted ? "launch-never-started"
+                : llm.silentAtBeat ? "silent"
+                    : llm.timedOut ? (bytes > 0 ? "truncated" : "silent")
+                        : classifyVerdictCause(raw, nonce, "approve", llm);
         const failure = cause === "malformed-verdict"
             ? "review output unparseable"
-            : "review dispatch failed — no structurally valid nonce-bound response";
+            : cause === "closure-mismatch"
+                ? "review verdict closes no carried fingerprint — closure ids match none of the carried materials"
+                : "review dispatch failed — no structurally valid nonce-bound response";
         return {
             gate: "review",
             pass: false,
@@ -508,6 +599,7 @@ The top-level comments array is optional. Use it only for actionable line-anchor
                 provider,
                 ...(cause === "malformed-verdict" ? { unparseable: true } : { noVerdict: true, classification: "infra", infra: true }),
                 cause,
+                ...(closureMismatch ? { resolved: v?.resolved, reraised: v?.reraised, carriedFingerprints: [...priorIds] } : {}),
                 bytes, seatAuthoredBytes: bytes,
                 ...(saved ? { rawPath: saved } : {}),
                 ...(savedBrief ? { briefPath: savedBrief } : {}),