tickmarkr 2.5.7 → 2.5.8

package/dist/drivers/index.js

@@ -1,5 +1,7 @@
 import { HerdrDriver } from "./herdr.js";
-import { OrcaDriver } from "./orca.js";
+import { shq } from "../adapters/types.js";
+import { sh } from "../run/git.js";
+import { canonicalWorktreePath, OrcaDriver, OrcaError, parseEnvelope, resolveOrcaCliBinary, terminalWorktree } from "./orca.js";
 import { SubprocessDriver } from "./subprocess.js";
 export const DRIVER_CHOICES = ["auto", "herdr", "subprocess", "orca"];
 const overrideByDriver = new WeakMap();
@@ -20,18 +22,64 @@ export function classifyHost(env = process.env) {
         return "orca";
     return "none";
 }
+const UNMANAGED_CHECKOUT = "checkout is not Orca-managed; run from an orca worktree create checkout or pass --driver subprocess";
+/**
+ * OBS-1061: the ONE admission probe — `worktree current` asked from the run root. Like the driver's
+ * own per-checkout query it accepts an enclosing tracked checkout after path canonicalisation. An
+ * untracked checkout refuses with both remedies; any other failure refuses naming its reason, never
+ * read as managed.
+ */
+async function admitOrcaCheckout(runRoot, env) {
+    const bin = resolveOrcaCliBinary(runRoot, { env }) ?? "orca";
+    const refuse = (reason) => new Error(`refusing driver 'orca': Orca admission probe of ${runRoot} failed — ${reason}`);
+    let reported;
+    // The transport's own diagnostics (timeout, exit, stderr): a stderr-only failure such as a missing
+    // executable parses as 'empty response', which alone names no cause.
+    let transport = "";
+    try {
+        // Config values flow into a shell here: every argv element is quoted, always.
+        const r = await sh([bin, "worktree", "current", "--json"].map(shq).join(" "), runRoot);
+        const raw = [r.stdout, r.stderr ? `STDERR: ${r.stderr}` : ""].filter(Boolean).join("\n");
+        transport = [r.timedOut ? "probe timed out" : r.code !== 0 ? `orca exited ${r.code}` : "", r.stderr.trim() ? `stderr: ${r.stderr.trim()}` : ""]
+            .filter(Boolean).join("; ");
+        const envelope = parseEnvelope("worktree-current", r.stdout, raw);
+        // An ok:true body on a nonzero exit is a transport failure (stale stdout), as in the driver.
+        if (r.code !== 0)
+            throw new OrcaError("worktree-current", `orca exited ${r.code}`, raw);
+        const worktree = envelope.result.worktree;
+        reported = typeof worktree === "object" && worktree !== null && !Array.isArray(worktree)
+            ? terminalWorktree(worktree)
+            : undefined;
+        if (!reported)
+            throw new OrcaError("worktree-current", "response carries no worktree path", raw);
+    }
+    catch (e) {
+        if (e instanceof OrcaError && e.code === "selector_not_found")
+            throw new Error(`refusing driver 'orca': ${UNMANAGED_CHECKOUT}`);
+        const reason = e instanceof OrcaError ? e.reason : e.message;
+        throw refuse(transport.startsWith(reason) ? transport : [reason, transport].filter(Boolean).join("; "));
+    }
+    const tracked = canonicalWorktreePath(reported);
+    const root = canonicalWorktreePath(runRoot);
+    if (tracked !== root && !root.startsWith(`${tracked}/`))
+        throw new Error(`refusing driver 'orca': ${UNMANAGED_CHECKOUT}`);
+}
 /**
  * A config driver of herdr or orca whose host is not the classified one is refused naming the
  * detected host, the config line and the --driver remedy. Any explicit --driver value bypasses
- * this; auto and subprocess are never refused.
+ * that; auto and subprocess are never refused. Then, when the RESOLVED driver is orca (config,
+ * auto on an Orca host, or an explicit flag), the run root is admitted by one probe before any run
+ * directory, journal row or dispatch exists. Subprocess and herdr selections probe nothing.
  */
-export function preflightHostDriver(cfg, driverOverride, host) {
-    if (driverOverride !== undefined)
-        return;
-    if ((cfg.driver === "herdr" || cfg.driver === "orca") && cfg.driver !== host) {
+export async function preflightHostDriver(cfg, driverOverride, host, runRoot, env = process.env) {
+    if (driverOverride === undefined && (cfg.driver === "herdr" || cfg.driver === "orca") && cfg.driver !== host) {
         const remedy = host === "none" ? "subprocess" : host;
         throw new Error(`refusing driver '${cfg.driver}' (config line 'driver: ${cfg.driver}'): detected host is ${host}; use --driver ${remedy} to override`);
     }
+    const want = parseDriverOverride(driverOverride) ?? cfg.driver;
+    const resolved = want === "auto" ? (host === "none" ? "subprocess" : host) : want;
+    if (resolved === "orca")
+        await admitOrcaCheckout(runRoot, env);
 }
 /**
  * Orca authors both markers on every terminal it creates. Requiring the pair avoids treating an

package/dist/gates/run-gates.d.ts

@@ -65,6 +65,8 @@ export interface GateContext {
     demotedReviewers?: Set<string>;
     reviewNoVerdicts?: Map<string, string[]>;
     recheck?: boolean;
+    /** Explicit worker funding requires fresh red measurements, never a gate waiver. */
+    cachedRedBypass?: "operator-rerun";
     carriedAuthors?: readonly string[];
     reviewHistory?: string[];
     priorReviewers?: PriorReviewer[];

package/dist/gates/run-gates.js

@@ -310,9 +310,11 @@ export async function runGates(task, ctx) {
     // OBS-1055: on a recheck a cached red is the answer the operator just said was wrongly given; it is
     // journaled as discarded and the gate runs. Returns true when the hit must NOT be reused.
     const discardCachedRed = async (gate, hit) => {
-        if (!ctx.recheck || hit.pass)
+        const reason = ctx.recheck ? "recheck" : ctx.cachedRedBypass;
+        if (!reason || hit.pass)
             return false;
-        await ctx.onGate?.({ phase: "note", gate, name: "recheck-rerun", payload: { gate, reason: "cached-red-discarded" }, result: hit });
+        await ctx.onGate?.({ phase: "note", gate, name: reason === "recheck" ? "recheck-rerun" : "gate-rerun",
+            payload: { gate, reason: "cached-red-discarded", ...(reason === "recheck" ? {} : { bypass: reason }) }, result: hit });
         return true;
     };
     const shapeGates = ctx.cfg.gates.byShape?.[task.shape];

package/dist/gates/test-manifest.d.ts

@@ -20,6 +20,15 @@ export interface TestReportCompletion {
         failed: number;
         skipped: number;
     };
+    /** Bounded (4096 bytes) runner evidence per failed test — diff, actual/expected or stack head.
+     * Never part of the failure's identity: `failures` alone feeds details and fingerprints. */
+    evidence?: FailureEvidence[];
+}
+export interface FailureEvidence {
+    test: string;
+    text: string;
+    truncated?: true;
+    unavailable?: true;
 }
 /** The runner's own machine report — requested/started/completed are the runner's claims about ITSELF. */
 export interface TestReport {

package/dist/gates/test-manifest.js

@@ -103,6 +103,12 @@ export function toManifestPath(file, cwd) {
     catch { /* cwd unreadable — best effort with the given path */ }
     return relative(resolvedCwd, file).split(sep).join("/");
 }
+function isFailureEvidence(v) {
+    if (typeof v !== "object" || v === null)
+        return false;
+    const e = v;
+    return typeof e.test === "string" && typeof e.text === "string";
+}
 function isTestReportShape(v) {
     if (typeof v !== "object" || v === null)
         return false;
@@ -228,10 +234,12 @@ export function verifyManifestReport(opts) {
     const failedCompletions = Object.entries(report.completed).filter(([, c]) => c.status === "failed");
     const failingFiles = failedCompletions.map(([file]) => file).sort();
     const failures = failedCompletions.flatMap(([, c]) => c.failures?.length ? c.failures : ["<unnamed failure>"]);
+    // Parsed defensively: a malformed entry is dropped, never a verdict change — evidence is diagnostics only.
+    const failureEvidence = failedCompletions.flatMap(([, c]) => Array.isArray(c.evidence) ? c.evidence.filter(isFailureEvidence) : []);
     if (failures.length)
         return { kind: "work", pass: false,
             details: `test report names failing fingerprint(s):\n${failures.join("\n")}`,
-            meta: { classification: "regression", failingTests: failures, failingFiles, processExit: exitCode } };
+            meta: { classification: "regression", failingTests: failures, failingFiles, processExit: exitCode, failureEvidence } };
     if (exitCode === undefined) {
         return {
             kind: "fail-closed",

package/dist/gates/test-reporter.js

@@ -11,6 +11,24 @@ export default class TickmarkrReporter {
     this.cwd = realpathSync(process.cwd());
   }
   file(module) { return relative(this.cwd, module.moduleId).split(sep).join('/'); }
+  // Bounded assertion evidence, kept BESIDE the failure fingerprint and never inside it: the
+  // fingerprint is the failure's identity (the repeated-failure cap compares it), the evidence is
+  // what the runner knew and the message elided. ONE 4096-byte budget per failed test, shared by
+  // all of its errors (expect.soft yields several); never invented.
+  evidence(test, errors) {
+    const parts = [];
+    for (const e of errors) {
+      if (e && typeof e.diff === 'string' && e.diff) parts.push(e.diff);
+      else for (const k of ['actual', 'expected']) if (e && e[k] !== undefined && e[k] !== null) parts.push(k + ': ' + (typeof e[k] === 'string' ? e[k] : JSON.stringify(e[k])));
+      if (e && typeof e.stack === 'string' && e.stack) parts.push(e.stack.split('\n').slice(0, 8).join('\n'));
+    }
+    if (!parts.length) return { test, text: '', unavailable: true };
+    const full = parts.join('\n').replace(/\x1b\[[0-9;]*m/g, '');
+    if (Buffer.byteLength(full) <= 4096) return { test, text: full };
+    let text = full.slice(0, 4096);
+    while (Buffer.byteLength(text) > 4096) text = text.slice(0, -1);
+    return { test, text, truncated: true };
+  }
   save() {
     writeFileSync(this.path + '.tmp', JSON.stringify(this.report));
     renameSync(this.path + '.tmp', this.path);
@@ -27,6 +45,7 @@ export default class TickmarkrReporter {
     const file = this.file(module);
     const failed = module.state() === 'failed';
     const failures = [];
+    const evidence = [];
     // R41: count test bodies by their own state so a module whose every test was skipped (a
     // describe.skipIf gate) is recorded as SKIPPED — present in the lifecycle, but never as
     // executed test-body success. 'passed'/'failed' executed; anything else did not run.
@@ -37,6 +56,8 @@ export default class TickmarkrReporter {
         tests.failed++;
         if (failed) {
           const errors = test.result().errors || [];
+          const name = file + ' > ' + test.fullName;
+          evidence.push(this.evidence(name, errors));
           failures.push(...(errors.length ? errors.map(e => 'FAIL ' + file + ' > ' + test.fullName + ': ' + e.message) : ['FAIL ' + file + ' > ' + test.fullName]));
         }
       } else if (state === 'passed') tests.passed++;
@@ -45,7 +66,7 @@ export default class TickmarkrReporter {
     if (failed && !failures.length) failures.push('FAIL ' + file);
     const status = failed ? 'failed' : tests.passed + tests.failed === 0 ? 'skipped' : 'passed';
     if (file in this.report.completed) this.report.duplicateCompletions.push(file);
-    this.report.completed[file] = { at: Date.now(), status, failures, tests };
+    this.report.completed[file] = { at: Date.now(), status, failures, tests, ...(evidence.length ? { evidence } : {}) };
     this.save();
   }
   onTestRunEnd(modules, errors, reason) {

package/dist/graph/schema.d.ts

@@ -19,12 +19,22 @@ export declare const AcceptanceItemSchema: z.ZodUnion<readonly [z.ZodString, z.Z
     oracle: z.ZodLiteral<"test">;
     test: z.ZodString;
     text: z.ZodOptional<z.ZodString>;
+    landing: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
     oracle: z.ZodLiteral<"judge">;
     text: z.ZodString;
 }, z.core.$strip>]>;
 export type AcceptanceItem = z.infer<typeof AcceptanceItemSchema>;
 export declare function renderAcceptanceItem(item: AcceptanceItem): string;
+export declare const PinSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"literal">;
+    text: z.ZodString;
+    glob: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<"fixture">;
+    paths: z.ZodArray<z.ZodString>;
+}, z.core.$strip>], "kind">;
+export type Pin = z.infer<typeof PinSchema>;
 export declare const TaskSchema: z.ZodObject<{
     id: z.ZodString;
     title: z.ZodString;
@@ -52,6 +62,7 @@ export declare const TaskSchema: z.ZodObject<{
         oracle: z.ZodLiteral<"test">;
         test: z.ZodString;
         text: z.ZodOptional<z.ZodString>;
+        landing: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>, z.ZodObject<{
         oracle: z.ZodLiteral<"judge">;
         text: z.ZodString;
@@ -61,6 +72,14 @@ export declare const TaskSchema: z.ZodObject<{
         confidence: z.ZodOptional<z.ZodNumber>;
         reason: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>>;
+    pins: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"literal">;
+        text: z.ZodString;
+        glob: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"fixture">;
+        paths: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>], "kind">>>;
     gates: z.ZodDefault<z.ZodArray<z.ZodEnum<{
         build: "build";
         test: "test";
@@ -144,6 +163,7 @@ export declare const RunGraphSchema: z.ZodObject<{
             oracle: z.ZodLiteral<"test">;
             test: z.ZodString;
             text: z.ZodOptional<z.ZodString>;
+            landing: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>, z.ZodObject<{
             oracle: z.ZodLiteral<"judge">;
             text: z.ZodString;
@@ -153,6 +173,14 @@ export declare const RunGraphSchema: z.ZodObject<{
             confidence: z.ZodOptional<z.ZodNumber>;
             reason: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>>>;
+        pins: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"literal">;
+            text: z.ZodString;
+            glob: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            kind: z.ZodLiteral<"fixture">;
+            paths: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>], "kind">>>;
         gates: z.ZodDefault<z.ZodArray<z.ZodEnum<{
             build: "build";
             test: "test";

package/dist/graph/schema.js

@@ -19,7 +19,9 @@ export const ORACLES = ["command", "test", "judge"];
 export const AcceptanceItemSchema = z.union([
     z.string().min(1),
     z.object({ oracle: z.literal("command"), command: z.string().min(1), text: z.string().min(1).optional() }),
-    z.object({ oracle: z.literal("test"), test: z.string().min(1), text: z.string().min(1).optional() }),
+    // v2.5.8 T8 (OBS-1064): landing = the collectable suite path a test criterion lands in, declared
+    // beside the verbatim title (never inside it). Optional; compile enforces the collectable glob.
+    z.object({ oracle: z.literal("test"), test: z.string().min(1), text: z.string().min(1).optional(), landing: z.string().min(1).optional() }),
     z.object({ oracle: z.literal("judge"), text: z.string().min(1) }),
 ]);
 // Shared text rendering of one acceptance item — every consumer (worker prompt, acceptance gate,
@@ -33,6 +35,15 @@ export function renderAcceptanceItem(item) {
         return item.text ?? `test: ${item.test}`;
     return item.text; // judge — bare text, byte-identical to a plain-string judge criterion
 }
+// v2.5.8 T7 (agreement C2): declared pin obligations — a LIMITED AUTHORING CONTRACT, not an assertion
+// analyzer. literal = an exact text plus the glob it is pinned in (every matching file holding the text
+// is obligated); fixture = a path set whose every matching file is itself obligated (byte-pinned output
+// the change will move) and which carries no literal text. Declared here because z.object strips
+// undeclared keys on every load.
+export const PinSchema = z.discriminatedUnion("kind", [
+    z.object({ kind: z.literal("literal"), text: z.string().min(1), glob: z.string().min(1) }),
+    z.object({ kind: z.literal("fixture"), paths: z.array(z.string().min(1)).min(1) }),
+]);
 export const TaskSchema = z.object({
     // ids land in git branch names and herdr pane names — branch-safe characters only, bounded
     // length (refs hit filesystem limits), and never "--" (the task-branch separator, locked
@@ -59,6 +70,7 @@ export const TaskSchema = z.object({
         reason: z.string().optional(),
     }))
         .optional(),
+    pins: z.array(PinSchema).optional(),
     gates: z
         .array(z.enum(GATE_NAMES))
         .default(["build", "test", "lint", "evidence", "scope", "acceptance", "review"])

package/dist/run/daemon.d.ts

@@ -4,6 +4,7 @@ import { type DriverChoice } from "../drivers/index.js";
 import { type ExecutorDriver, type Slot } from "../drivers/types.js";
 import { type Baseline } from "../gates/baseline.js";
 import type { GateResult } from "../gates/types.js";
+import { type RunGraph } from "../graph/schema.js";
 import { Journal, type JournalEvent } from "./journal.js";
 export declare function closeLiveSlot(liveSlots: Set<Slot>, driver: Pick<ExecutorDriver, "close">, slot: Slot): Promise<void>;
 /** Optional authoritative transport receipt. Screen text can prove execution, never nonacceptance. */
@@ -58,6 +59,8 @@ export interface RunSummary {
     pending: string[];
     blocked: string[];
     tipVerify?: "passed" | "failed";
+    /** additive beside the legacy tipVerify enum: HOW the close's latest verification cycle earned its verdict */
+    tipProof?: TipProof;
     lastMergedTask?: string;
     /** T14: did every approval this run accepted actually get enacted, or did the run end over one? */
     approvalDisposition?: "complete" | "outstanding";
@@ -165,6 +168,21 @@ export declare function resetHarvestSilentMsForTests(): void;
 export declare const HARVESTED_RESULT_SUMMARY = "harvested: the worktree carries committed work; the worker emitted no TICKMARKR_RESULT trailer";
 /** T4 (OBS-266): identity of the command SET a tip verify ran — a changed command is a different verify. */
 export declare function commandsHash(commands: Record<string, string>): string;
+export interface TipProof {
+    kind: "fresh" | "reused" | "failed" | "incomplete";
+    /** the commit the cycle's start row spoke for */
+    tip?: string;
+}
+/**
+ * OBS-1077 close rider: what the engagement's LATEST verification cycle proved — its
+ * `tip-verify-start` row and what followed, never a commit comparison. Exactly one kind per close:
+ * fresh (every tip command ran AND passed), reused (an eligible cached cycle carried forward),
+ * failed, or incomplete (cancelled, cut short, mixed or undelimited). Nothing before the start row
+ * is read, so an unfinished cycle inherits nothing from an earlier green one.
+ */
+export declare function runEndTipProof(events: readonly JournalEvent[]): TipProof;
+/** The close notification's statement of the proof — one clause per kind. */
+export declare function formatTipProof(p: TipProof): string;
 /**
  * OBS-34's strict tip verify, but it stops re-paying for an unmoved tip (~334m corpus-wide; 69.5m in
  * one park-heavy run whose 18 resume cycles merged nothing new). The verify journals the SHA it
@@ -194,4 +212,5 @@ export declare function liveSuiteCount(repoRoot: string): Promise<number>;
 /** Test seam — exercise the production observer's total read bound with a small real tree. */
 export declare function setObserveBudgetBytesForTests(bytes: number): void;
 export declare function resetObserveBudgetBytesForTests(): void;
+export declare function recordFatalRunEnd(journal: Journal, runId: string, branch: string, err: unknown, graph?: RunGraph, phase?: string): TipProof | undefined;
 export declare function runDaemon(repoRoot: string, opts?: RunOptions): Promise<RunSummary>;