tickmarkr 2.5.8 → 2.6.0

package/dist/gates/run-gates.d.ts

@@ -2,7 +2,7 @@ import type { CommandReceiptAttribution } from "../run/protocol.js";
 import { type Assignment, type BillingChannel, type WorkerAdapter, type WorkerResult } from "../adapters/types.js";
 import { type TickmarkrConfig } from "../config/config.js";
 import { type GateName, type Task } from "../graph/schema.js";
-import { type Baseline } from "./baseline.js";
+import { type Baseline, type GateEvidenceOptions } from "./baseline.js";
 import { type GateVia } from "./llm.js";
 import { type PriorReviewer } from "./review.js";
 import type { GateResult } from "./types.js";
@@ -46,6 +46,7 @@ export type GateEvent = {
     result?: GateResult;
 };
 export interface GateContext {
+    evidence?: GateEvidenceOptions;
     buildReceiptIdentity?: Omit<CommandReceiptAttribution, "invocation">;
     authorizeInfraRetry?: (subject: string, cause?: VerificationRetryCause) => boolean;
     verificationScope?: VerificationScope;
@@ -61,6 +62,8 @@ export interface GateContext {
     cfg: TickmarkrConfig;
     via?: GateVia;
     carriedFindings?: readonly StructuredFinding[];
+    /** Approval reason bound to this attempt; guidance, never criterion or closure authority. */
+    operatorContext?: string;
     excludeReviewers?: string[];
     demotedReviewers?: Set<string>;
     reviewNoVerdicts?: Map<string, string[]>;

package/dist/gates/run-gates.js

@@ -17,7 +17,7 @@ import { scopeGate } from "./scope.js";
 import { evaluateManifestedTest, isVitestTestCommand } from "./test-manifest.js";
 import { executionSignal } from "../run/execution-budget.js";
 import { failureDisposition } from "../run/recovery.js";
-import { preserveWorktree, shGit, resolvedCapacity, verificationProtocol } from "../run/git.js";
+import { dependencyLinkRefusal, preserveWorktree, shGit, resolvedCapacity, verificationProtocol } from "../run/git.js";
 import { withJudgeInvocationEvidence } from "../run/journal.js";
 import { computeVerificationIdentity, verificationIdentityKey, formatReusedRow, getVerdictStore, isInfraResult, resolveStateDir, reusedIdentity, } from "./cache.js";
 const productionLoadProvider = () => loadavg()[0] ?? 0;
@@ -222,22 +222,25 @@ async function runVitestManifestGate(worktree, cmd, baseline, selected, artifact
         longestFile: entry?.longestFile,
         overallCeilingMs: effectiveCeilingMs(entry),
         artifactDir,
+        evidence: retry.evidence,
     });
     const reportPath = outcome.reportPath;
+    const evidence = { evidenceReceipt: outcome.evidenceReceipt, evidenceReceipts: outcome.evidenceReceipts };
     if (!retried && retry.authorizeRetry && failureDisposition(outcome) === "infrastructure"
         && outcome.meta?.retryable !== false) {
         const waitedMs = await waitForCalmWindow(executionSignal());
         if (!calmWindowReady())
-            return { gate: "test", pass: false, details: outcome.details,
+            return { ...evidence, gate: "test", pass: false, details: outcome.details,
                 meta: { ...outcome.meta, reportPath, recoveryBlocked: "calm window unavailable within the existing wait ceiling" } };
         if (!retry.authorizeRetry("infra")) {
-            return { gate: "test", pass: false, details: outcome.details,
+            return { ...evidence, gate: "test", pass: false, details: outcome.details,
                 meta: { ...outcome.meta, reportPath, recoveryBlocked: "infrastructure retry allowance exhausted or subject unavailable" } };
         }
         const result = await runVitestManifestGate(worktree, cmd, baseline, selected, artifactDir, retry, true);
-        return { ...result, meta: { ...result.meta, runnerInfraRerun: { count: 1, waitedMs, firstReportPath: reportPath } } };
+        return { ...result, evidenceReceipts: [...(outcome.evidenceReceipts ?? []), ...(result.evidenceReceipts ?? [])], meta: { ...result.meta, runnerInfraRerun: { count: 1, waitedMs, firstReportPath: reportPath } } };
     }
     return {
+        ...evidence,
         gate: "test",
         pass: outcome.pass,
         details: outcome.details,
@@ -259,6 +262,12 @@ function classifySignalOnlyTest(g) {
 }
 export async function runGates(task, ctx) {
     const results = [];
+    const evidence = {
+        artifactDir: ctx.artifactDir,
+        runId: ctx.buildReceiptIdentity?.runId ?? ctx.artifactDir ?? "standalone",
+        taskId: task.id, attempt: ctx.buildReceiptIdentity?.attempt ?? 0,
+        ...ctx.evidence,
+    };
     // Receipt identity belongs to this round, never to a cached verdict. Each call from the shell
     // allocates a new invocation, including retries whose local spawn counter starts at one again.
     let currentBuild;
@@ -295,6 +304,16 @@ export async function runGates(task, ctx) {
     };
     let selectionDecision;
     let commits = [];
+    // Check before cache identity, npm policy probes, or any gate command.
+    const dependencyRefusal = dependencyLinkRefusal(ctx.worktree);
+    if (dependencyRefusal) {
+        const gate = GATE_NAMES.find(g => task.gates.includes(g)) ?? "build";
+        const result = { gate, pass: false, details: dependencyRefusal,
+            meta: { infra: true, classification: "infra", retryable: false, kind: "workspace-dependency" } };
+        await noBuild("refused", dependencyRefusal);
+        await ctx.onGate?.({ phase: "end", gate, result });
+        return { results: [result], commits: [] };
+    }
     const stateDir = ctx.stateDir ?? resolveStateDir(ctx.worktree, ctx.artifactDir);
     const verdictStore = getVerdictStore(stateDir);
     // R41: the verification protocol and the EFFECTIVE npm lifecycle policy measured for THIS
@@ -658,8 +677,8 @@ export async function runGates(task, ctx) {
                     // other scripted test command keeps today's exit-code contract byte-identically.
                     const useManifest = g === "test" && commands.test !== undefined && isVitestTestCommand(commands.test, ctx.worktree);
                     r = useManifest
-                        ? await measure(g, () => runVitestManifestGate(ctx.worktree, commands.test, ctx.baseline, selected, ctx.artifactDir, retryOptions(identity)))
-                        : (await measure(g, () => compareToBaseline(ctx.worktree, commands, ctx.baseline, [g], { ...retryOptions(identity), ...(g === "build" ? { onReceipt: buildReceipt, taskBuildAttribution: beginBuild } : {}), ...(g === "test" && selected ? { selected } : {}) })))[0];
+                        ? await measure(g, () => runVitestManifestGate(ctx.worktree, commands.test, ctx.baseline, selected, ctx.artifactDir, { ...retryOptions(identity), evidence }))
+                        : (await measure(g, () => compareToBaseline(ctx.worktree, commands, ctx.baseline, [g], { ...retryOptions(identity), evidence, ...(g === "build" ? { onReceipt: buildReceipt, taskBuildAttribution: beginBuild } : {}), ...(g === "test" && selected ? { selected } : {}) })))[0];
                 }
                 finally {
                     await receiptNotes;
@@ -676,7 +695,7 @@ export async function runGates(task, ctx) {
             if (!cached && r.pass && commands[g]) {
                 const dirt = await dirtyWorktree();
                 if (dirt) {
-                    await record(await dirtyRefusal(g, dirt, commands[g]));
+                    await record({ ...await dirtyRefusal(g, dirt, commands[g]), evidenceReceipt: r.evidenceReceipt, evidenceReceipts: r.evidenceReceipts });
                     return;
                 }
             }
@@ -903,7 +922,7 @@ export async function runGates(task, ctx) {
         const priorReviewers = [...(ctx.priorReviewers ?? []), ...(ctx.excludeReviewers ?? [])];
         const carriedAuthors = ctx.carriedAuthors ?? [];
         let exclusions = [...(ctx.excludeReviewers ?? []), ...retired];
-        let rv = await dispatch((adapters) => reviewGate(task, ctx.worktree, ctx.baseRef, ctx.author, ctx.channels, adapters, ctx.cfg, ctx.via, exclusions, ctx.artifactDir, ctx.reviewHistory, ctx.demotedReviewers, ctx.carriedFindings, priorReviewers, carriedAuthors));
+        let rv = await dispatch((adapters) => reviewGate(task, ctx.worktree, ctx.baseRef, ctx.author, ctx.channels, adapters, ctx.cfg, ctx.via, exclusions, ctx.artifactDir, ctx.reviewHistory, ctx.demotedReviewers, ctx.carriedFindings, priorReviewers, carriedAuthors, ctx.operatorContext));
         // OBS-193/574: an unparseable review verdict retries the REVIEW, preferring a different adapter. Only
         // a single-adapter eligible pool may fall back to another channel on the flaked adapter. The flaked
         // verdict never enters results; an exhausted pool preserves its cause.
@@ -936,7 +955,7 @@ export async function runGates(task, ctx) {
             const crossAdapter = pickReviewer(ctx.author, ctx.channels, [...exclusions, ...adapterExclusions], ctx.cfg.review.prefer ?? [], retryFloor, undefined, undefined, undefined, carriedAuthorVendors(ctx.channels, carriedAuthors));
             const exclusion = crossAdapter ? "adapter" : "channel";
             exclusions = [...exclusions, ...(crossAdapter ? adapterExclusions : [flaked])];
-            const second = await dispatch((adapters) => reviewGate(task, ctx.worktree, ctx.baseRef, ctx.author, ctx.channels, adapters, ctx.cfg, retryVia, exclusions, ctx.artifactDir, ctx.reviewHistory, ctx.demotedReviewers, ctx.carriedFindings, retryPrior, carriedAuthors));
+            const second = await dispatch((adapters) => reviewGate(task, ctx.worktree, ctx.baseRef, ctx.author, ctx.channels, adapters, ctx.cfg, retryVia, exclusions, ctx.artifactDir, ctx.reviewHistory, ctx.demotedReviewers, ctx.carriedFindings, retryPrior, carriedAuthors, ctx.operatorContext));
             if (second.meta?.noEligibleReviewer !== true) {
                 const retried = typeof second.meta?.reviewer === "string" ? second.meta.reviewer : "none";
                 const route = exclusion === "adapter"
@@ -1104,8 +1123,8 @@ export async function runGates(task, ctx) {
         if (!full) {
             const fullUsesManifest = ctx.commands.test !== undefined && isVitestTestCommand(ctx.commands.test, ctx.worktree);
             full = fullUsesManifest
-                ? await measure("test", () => runVitestManifestGate(ctx.worktree, ctx.commands.test, ctx.baseline, undefined, ctx.artifactDir, retryOptions(identity)))
-                : (await measure("test", () => compareToBaseline(ctx.worktree, ctx.commands, ctx.baseline, ["test"], retryOptions(identity))))[0];
+                ? await measure("test", () => runVitestManifestGate(ctx.worktree, ctx.commands.test, ctx.baseline, undefined, ctx.artifactDir, { ...retryOptions(identity), evidence }))
+                : (await measure("test", () => compareToBaseline(ctx.worktree, ctx.commands, ctx.baseline, ["test"], { ...retryOptions(identity), evidence })))[0];
         }
         fullDurationMs = spans.get("test") ? spans.get("test").durationMs - (selectedDurationMs ?? 0) : 0;
         const dirt = (!cached && full.pass) ? await dirtyWorktree() : undefined;
@@ -1115,8 +1134,9 @@ export async function runGates(task, ctx) {
             verdictStore.set(identity, { ...full, meta: { ...full.meta, source: "gate", runDir: ctx.artifactDir } });
         }
         const merged = withTelemetry(dirt
-            ? await dirtyRefusal("test", dirt, ctx.commands.test)
+            ? { ...await dirtyRefusal("test", dirt, ctx.commands.test), evidenceReceipt: full.evidenceReceipt, evidenceReceipts: full.evidenceReceipts }
             : { ...full, meta: { ...full.meta, fullSuite: true, selectedTests: selected } });
+        merged.evidenceReceipts = [...(heldTest?.evidenceReceipts ?? []), ...(full?.evidenceReceipts ?? [])];
         results[results.findIndex((r) => r.gate === "test")] = merged;
         heldTest = undefined;
         await ctx.onGate?.({ phase: "end", gate: "test", result: merged });

package/dist/gates/test-manifest.d.ts

@@ -1,4 +1,5 @@
-import type { BaselineFileDuration } from "./baseline.js";
+import { type GateEvidenceOptions, type BaselineFileDuration } from "./baseline.js";
+import type { GateEvidenceReceipt } from "../run/protocol.js";
 export declare function isVitestTestCommand(cmd: string, cwd: string): boolean;
 /** One identity for every path this module compares: repo-relative, forward-slash. `vitest list
  * --json` and `TestModule.moduleId` both hand back an absolute filesystem path already resolved
@@ -36,6 +37,11 @@ export interface TestReport {
     requested: string[];
     started: Record<string, number>;
     completed: Record<string, TestReportCompletion>;
+    /** Resolved scheduling observed at run start; absent/partial means unknown, never inferred. */
+    scheduling?: Record<string, {
+        pool: string;
+        singleFork: boolean;
+    }>;
     /** Files the reporter observed complete MORE than once — `completed`'s object keys cannot show
      * this themselves (a second write silently overwrites the first), so the reporter records the
      * evidence separately before it is lost. */
@@ -78,6 +84,8 @@ export declare const FILE_HANG_SLACK = 3;
 export declare const DEFAULT_FILE_HANG_BUDGET_MS = 60000;
 export declare function fileHangBudgetMs(file: string, baselineDurations?: readonly BaselineFileDuration[] | null, ceilingMs?: number, longestFile?: BaselineFileDuration | null): number;
 export interface ManifestRunResult {
+    evidenceReceipt: GateEvidenceReceipt;
+    evidenceReceipts: GateEvidenceReceipt[];
     exitCode: number | undefined;
     stdout: string;
     stderr: string;
@@ -91,6 +99,7 @@ export interface ManifestRunResult {
 /** Supervise the configured command and poll the runner's atomic lifecycle snapshots. Every
  * timeout kills the detached process group, including descendants holding the output pipes. */
 export declare function runManifestedTest(cmd: string, cwd: string, opts: {
+    evidence?: GateEvidenceOptions;
     manifest: readonly string[];
     nonce: string;
     reportPath: string;
@@ -101,6 +110,8 @@ export declare function runManifestedTest(cmd: string, cwd: string, opts: {
     overallCeilingMs?: number;
 }): Promise<ManifestRunResult>;
 export interface ManifestGateOutcome {
+    evidenceReceipt?: GateEvidenceReceipt;
+    evidenceReceipts?: GateEvidenceReceipt[];
     pass: boolean;
     kind: ManifestVerdictKind;
     details: string;
@@ -115,6 +126,8 @@ export interface DiscoveredManifest {
     separator: string;
     listingExit: number | undefined;
     listingStdout: string;
+    evidenceReceipt: GateEvidenceReceipt;
+    evidenceReceipts: GateEvidenceReceipt[];
 }
 /** OBS-1044: THE discovery seam — the files the runner would collect under this exact invocation,
  * from its own listing and never from a stdout summary. The gate and the baseline capture share it,
@@ -125,6 +138,7 @@ export declare function discoverTestManifest(cmd: string, cwd: string, opts: {
     nonce: string;
     env: NodeJS.ProcessEnv;
     overallCeilingMs?: number;
+    evidence?: GateEvidenceOptions;
 }): Promise<DiscoveredManifest>;
 /** The baseline capture's reading of the same seam: the manifest's file count, or null when the
  * runner cannot list (a null compares nothing — it never manufactures a deficit). The suite is not
@@ -137,4 +151,5 @@ export declare function evaluateManifestedTest(cmd: string, cwd: string, opts: {
     longestFile?: BaselineFileDuration | null;
     overallCeilingMs?: number;
     artifactDir?: string;
+    evidence?: GateEvidenceOptions;
 }): Promise<ManifestGateOutcome>;

package/dist/gates/test-manifest.js

@@ -4,6 +4,7 @@ import { tmpdir } from "node:os";
 import { isAbsolute, join, relative, sep } from "node:path";
 import { TEST_REPORTER_SOURCE } from "./test-reporter.js";
 import { shq } from "../adapters/types.js";
+import { beginGateEvidence, redactGateOutput } from "./baseline.js";
 import { FORK_CAP_ENV, ROUTING_ENV_SEAMS, SUITE_PARENT_ENV, shell, resolvedCapacity, verificationProtocol } from "../run/git.js";
 /**
  * VL-1 (OBS-985 lineage): a test gate's completion must be the runner's OWN report, never a stdout
@@ -330,6 +331,7 @@ export function runManifestedTest(cmd, cwd, opts) {
     const pollMs = opts.pollMs ?? 20;
     const overallCeilingMs = usable(opts.overallCeilingMs) ? opts.overallCeilingMs : DEFAULT_FILE_HANG_BUDGET_MS;
     const env = { ...(opts.env ?? process.env), TICKMARKR_TEST_REPORT: opts.reportPath, TICKMARKR_TEST_NONCE: opts.nonce };
+    const evidence = beginGateEvidence(cwd, "test", cmd, { ...opts.evidence, env }, opts.nonce);
     const controller = new AbortController();
     let pid;
     let killedFile;
@@ -355,6 +357,7 @@ export function runManifestedTest(cmd, cwd, opts) {
         }
     };
     return shell(cmd, cwd, overallCeilingMs, false, {
+        onReceipt: receipt => evidence.observe(killedFile && receipt.outcome === "cancelled" ? { ...receipt, outcome: "timed-out" } : receipt),
         env, signal: controller.signal, onTimeout: () => checkHang(true),
         onSpawn: (childPid) => {
             pid = childPid;
@@ -362,11 +365,21 @@ export function runManifestedTest(cmd, cwd, opts) {
             clearInterval(poll);
             poll = setInterval(checkHang, pollMs);
         },
-    }).then((result) => ({
-        exitCode: result.signalExit ? undefined : result.code,
-        stdout: result.stdout, stderr: result.stderr,
-        report: readTestReport(opts.reportPath), killedFile, hangBudgetMs, pid,
-    })).finally(() => { clearInterval(poll); });
+    }).then((result) => {
+        const evidenceReceipt = evidence.finish(result.stdout, result.stderr);
+        return {
+            evidenceReceipt, evidenceReceipts: [...evidence.history, evidenceReceipt],
+            exitCode: result.signalExit ? undefined : result.code,
+            stdout: result.stdout, stderr: result.stderr,
+            report: readTestReport(opts.reportPath), killedFile, hangBudgetMs, pid,
+        };
+    }).catch((error) => {
+        if (error instanceof Error) {
+            const evidenceReceipt = evidence.finish();
+            Object.assign(error, { evidenceReceipt, evidenceReceipts: [...evidence.history, evidenceReceipt] });
+        }
+        throw error;
+    }).finally(() => { clearInterval(poll); });
 }
 /** The child environment every manifest invocation (listing and run) receives, and the lifecycle
  * protocol it records. R41: the policy is whatever THIS process was launched with (npm reads
@@ -391,11 +404,12 @@ function manifestEnvironment(cwd) {
 export async function discoverTestManifest(cmd, cwd, opts) {
     const invocation = runnerInvocation(cmd, cwd);
     const listed = await runManifestedTest(invocation.listing, cwd, {
-        manifest: [], nonce: opts.nonce, reportPath: join(opts.dir, `listing-${opts.nonce}.json`), env: opts.env,
+        evidence: opts.evidence, manifest: [], nonce: `${opts.nonce}-listing`, reportPath: join(opts.dir, `listing-${opts.nonce}.json`), env: opts.env,
         overallCeilingMs: opts.overallCeilingMs ?? DEFAULT_FILE_HANG_BUDGET_MS,
     });
+    const discoveryError = (message) => Object.assign(new Error(message), { evidenceReceipt: listed.evidenceReceipt, evidenceReceipts: listed.evidenceReceipts });
     if (listed.exitCode !== 0)
-        throw new Error(`vitest cannot list files (exit ${listed.exitCode ?? "signal"}): ${listed.stderr || listed.stdout}`);
+        throw discoveryError(`vitest cannot list files (exit ${listed.exitCode ?? "signal"}): ${listed.stderr || listed.stdout}`);
     let files;
     try {
         const rows = JSON.parse(listed.stdout.slice(listed.stdout.indexOf("[")));
@@ -404,11 +418,11 @@ export async function discoverTestManifest(cmd, cwd, opts) {
         files = [...new Set(rows.map((r) => toManifestPath(r.file, cwd)))].sort();
     }
     catch {
-        throw new Error(`vitest cannot list files: invalid JSON listing: ${listed.stdout}`);
+        throw discoveryError(`vitest cannot list files: invalid JSON listing: ${listed.stdout}`);
     }
     if (!files.length)
-        throw new Error("vitest cannot list files: empty manifest");
-    return { files, listing: invocation.listing, separator: invocation.separator, listingExit: listed.exitCode, listingStdout: listed.stdout };
+        throw discoveryError("vitest cannot list files: empty manifest");
+    return { files, listing: invocation.listing, separator: invocation.separator, listingExit: listed.exitCode, listingStdout: listed.stdout, evidenceReceipt: listed.evidenceReceipt, evidenceReceipts: listed.evidenceReceipts };
 }
 /** The baseline capture's reading of the same seam: the manifest's file count, or null when the
  * runner cannot list (a null compares nothing — it never manufactures a deficit). The suite is not
@@ -423,18 +437,58 @@ export async function manifestFileCount(cmd, cwd) {
         return null;
     }
 }
+/** Vitest's forks pool awaits the parallel phase, then throws before the single-fork phase
+ * on any rejected worker. Recover only that exact, fully accounted-for boundary. */
+function strandedSingleForkFiles(files, nonce, run) {
+    const r = run.report;
+    if (run.killedFile || run.exitCode !== 1 || !r || r.nonce !== nonce || r.certificate?.exitCode !== 1)
+        return;
+    if (r.requested.length !== files.length || new Set(r.requested).size !== files.length
+        || r.requested.some(f => !files.includes(f)) || r.duplicateCompletions?.length)
+        return;
+    if (Object.keys(r.started).some(f => !files.includes(f))
+        || Object.keys(r.completed).some(f => !files.includes(f) || !Object.hasOwn(r.started, f)))
+        return;
+    const scheduling = r.scheduling;
+    if (!scheduling || Object.keys(scheduling).length !== files.length
+        || files.some(f => !Object.hasOwn(scheduling, f) || scheduling[f]?.pool !== "forks"
+            || typeof scheduling[f]?.singleFork !== "boolean"))
+        return;
+    const diagnostics = r.certificate.diagnostics;
+    if (!Array.isArray(diagnostics) || !diagnostics.length || r.certificate.errors !== diagnostics.length
+        || diagnostics.some(d => {
+            if (typeof d !== "string")
+                return true;
+            const timeout = /^(?:(.+): )?Error: \[vitest-worker\]: Timeout calling "[A-Za-z_$][\w$]*"$/.exec(d);
+            // The optional prefix is the reporter's testPath, not another error or arbitrary prose.
+            return !timeout || (timeout[1] !== undefined && !files.some(f => timeout[1] === f || timeout[1].endsWith(`/${f}`)));
+        }))
+        return;
+    const single = files.filter(f => scheduling[f].singleFork);
+    const parallel = files.filter(f => !scheduling[f].singleFork);
+    if (!single.length || !parallel.length || single.some(f => Object.hasOwn(r.started, f) || Object.hasOwn(r.completed, f)))
+        return;
+    if (parallel.some(f => !Object.hasOwn(r.started, f)
+        || !["passed", "skipped"].includes(r.completed[f]?.status ?? "")
+        || (r.completed[f]?.tests?.failed ?? 0) !== 0))
+        return;
+    return single;
+}
 /** One configured runner execution, and its own collection under the same arguments and environment.
  * The installed runner is trusted (R28 add.1 option B); the nonce catches stale artifacts, not forgery. */
 export async function evaluateManifestedTest(cmd, cwd, opts) {
     const dir = opts.artifactDir ?? mkdtempSync(join(tmpdir(), "tickmarkr-test-report-"));
-    const nonce = randomBytes(16).toString("hex");
-    const reportPath = join(dir, `test-manifest-report-${nonce}.json`);
+    let nonce = randomBytes(16).toString("hex");
+    let reportPath = join(dir, `test-manifest-report-${nonce}.json`);
     const reporterPath = join(dir, `test-reporter-${nonce}.mjs`);
+    const evidenceReceipts = [];
     let spawnedCommand = cmd;
     let manifestPath;
+    let recovery;
     const { env, verification } = manifestEnvironment(cwd);
     try {
-        const invocation = await discoverTestManifest(cmd, cwd, { dir, nonce, env, overallCeilingMs: opts.overallCeilingMs });
+        const invocation = await discoverTestManifest(cmd, cwd, { dir, nonce, env, overallCeilingMs: opts.overallCeilingMs, evidence: { ...opts.evidence, artifactDir: opts.evidence?.artifactDir ?? dir } });
+        evidenceReceipts.push(...invocation.evidenceReceipts);
         const files = invocation.files;
         // R41: the EXPECTED manifest is evidence in its own right — persisted beside the report with the
         // exact discovery invocation, so a later reader can tell what this invocation was asked to prove
@@ -447,22 +501,63 @@ export async function evaluateManifestedTest(cmd, cwd, opts) {
         }, null, 2) + "\n");
         writeFileSync(reporterPath, TEST_REPORTER_SOURCE);
         spawnedCommand = `${cmd}${invocation.separator} --reporter=${shq(reporterPath)} --outputFile=${shq(reportPath)}`;
-        const invoked = await runManifestedTest(spawnedCommand, cwd, {
-            manifest: files, nonce, reportPath, env,
+        let invoked = await runManifestedTest(spawnedCommand, cwd, {
+            evidence: { ...opts.evidence, artifactDir: opts.evidence?.artifactDir ?? dir }, manifest: files, nonce, reportPath, env,
             baselineDurations: opts.baselineDurations?.map((d) => ({ ...d, file: toManifestPath(d.file, cwd) })),
             longestFile: opts.longestFile,
             overallCeilingMs: opts.overallCeilingMs ?? DEFAULT_FILE_HANG_BUDGET_MS,
             pollMs: 20,
         });
-        const verdict = verifyManifestReport({ manifest: files, nonce, exitCode: invoked.exitCode,
+        let verdict = verifyManifestReport({ manifest: files, nonce, exitCode: invoked.exitCode,
             report: invoked.report, killedFile: invoked.killedFile, hangBudgetMs: invoked.hangBudgetMs });
+        evidenceReceipts.push(...invoked.evidenceReceipts);
+        const stranded = strandedSingleForkFiles(files, nonce, invoked);
+        if (stranded) {
+            const first = invoked.report;
+            const retryNonce = randomBytes(16).toString("hex");
+            recovery = { firstNonce: nonce, firstReportPath: reportPath, retryNonce, files: stranded };
+            nonce = retryNonce;
+            reportPath = join(dir, `test-manifest-report-${nonce}.json`);
+            // Positional filters are substring matches (and OR with existing filters). Exclude every
+            // completed file as well, then require discovery to prove the exact retry set before launch.
+            const excluded = files.filter(f => !stranded.includes(f)).map(f => `--exclude=${shq(f.replace(/[\\*?[\]{}()!+@]/g, "\\$&"))}`).join(" ");
+            const retryCommand = `${cmd}${invocation.separator} ${stranded.map(f => shq(join(cwd, f))).join(" ")} ${excluded}`;
+            const listed = await discoverTestManifest(retryCommand, cwd, { dir, nonce, env,
+                overallCeilingMs: opts.overallCeilingMs, evidence: { ...opts.evidence, artifactDir: opts.evidence?.artifactDir ?? dir } });
+            evidenceReceipts.push(...listed.evidenceReceipts);
+            if (listed.files.length !== stranded.length || listed.files.some(f => !stranded.includes(f)))
+                throw new Error("single fork retry discovery does not match the stranded set");
+            writeFileSync(join(dir, `test-manifest-expected-${nonce}.json`), JSON.stringify({ nonce, files: stranded,
+                firstNonce: recovery.firstNonce, listingCommand: listed.listing, verification }, null, 2) + "\n");
+            spawnedCommand = `${retryCommand}${listed.separator} --reporter=${shq(reporterPath)} --outputFile=${shq(reportPath)}`;
+            invoked = await runManifestedTest(spawnedCommand, cwd, {
+                evidence: { ...opts.evidence, artifactDir: opts.evidence?.artifactDir ?? dir }, manifest: stranded, nonce, reportPath, env,
+                baselineDurations: opts.baselineDurations?.map(d => ({ ...d, file: toManifestPath(d.file, cwd) })),
+                longestFile: opts.longestFile, overallCeilingMs: opts.overallCeilingMs ?? DEFAULT_FILE_HANG_BUDGET_MS, pollMs: 20,
+            });
+            evidenceReceipts.push(...invoked.evidenceReceipts);
+            verdict = verifyManifestReport({ manifest: stranded, nonce, exitCode: invoked.exitCode,
+                report: invoked.report, killedFile: invoked.killedFile, hangBudgetMs: invoked.hangBudgetMs });
+            // An all-skipped retry may contribute lifecycle accounting, but only the combined manifest
+            // can establish executed success. Never rewrite either invocation's persisted certificate.
+            if (verdict.pass || verdict.meta.noExecutedModules) {
+                const retry = invoked.report;
+                if (retry.certificate?.errors !== 0 || !Array.isArray(retry.certificate.diagnostics) || retry.certificate.diagnostics.length)
+                    verdict = { kind: "fail-closed", pass: false, details: "single fork retry has unknown or nonempty runner diagnostics", meta: { classification: "infra", infra: true } };
+                else
+                    verdict = verifyManifestReport({ manifest: files, nonce, exitCode: invoked.exitCode, report: {
+                            ...retry, requested: files, started: { ...first.started, ...retry.started }, completed: { ...first.completed, ...retry.completed },
+                        } });
+            }
+            verdict.details = `single fork retry ${nonce} after worker RPC timeout in ${recovery.firstNonce}: ${verdict.details}`;
+        }
         // Preserve the validator's verdict and classification; runner evidence only explains it.
-        const stdoutPath = join(dir, `test-runner-stdout-${nonce}.log`);
-        const stderrPath = join(dir, `test-runner-stderr-${nonce}.log`);
-        const stdoutTail = Buffer.from(invoked.stdout).subarray(-16 * 1024);
-        const stderrTail = Buffer.from(invoked.stderr).subarray(-16 * 1024);
-        writeFileSync(stdoutPath, stdoutTail);
-        writeFileSync(stderrPath, stderrTail);
+        const evidenceReceipt = invoked.evidenceReceipt;
+        const evidenceRoot = opts.evidence?.artifactDir ?? dir;
+        const stdoutPath = join(evidenceRoot, evidenceReceipt.stdout.path);
+        const stderrPath = join(evidenceRoot, evidenceReceipt.stderr.path);
+        const stdoutTail = Buffer.from(redactGateOutput(invoked.stdout, env)).subarray(-16 * 1024);
+        const stderrTail = Buffer.from(redactGateOutput(invoked.stderr, env)).subarray(-16 * 1024);
         const report = invoked.report?.nonce === nonce ? invoked.report : undefined;
         const neverStarted = report ? files.filter(file => !(file in report.started)).length : "unknown";
         const errors = report?.certificate?.errors;
@@ -470,20 +565,25 @@ export async function evaluateManifestedTest(cmd, cwd, opts) {
         const reportedDiagnostics = report?.certificate?.diagnostics;
         const runnerErrors = Array.isArray(reportedDiagnostics) ? reportedDiagnostics.filter(error => typeof error === "string") : [];
         const diagnostics = !verdict.pass
-            ? `\nclassification: ${verdict.meta.classification ?? "unknown"}; runner-level diagnostic: never-started ${neverStarted}; reporter errors ${reporterErrors}`
+            ? `\nclassification: ${verdict.meta.classification ?? "unknown"}; runner-level diagnostic: never-started ${neverStarted}; reporter errors ${reporterErrors}; runner vitest`
                 + [...runnerErrors,
                     stdoutTail.toString(), stderrTail.toString()].filter(Boolean).map(text => `\n${text}`).join("")
             : "";
-        return { pass: verdict.pass, kind: verdict.kind,
+        return { evidenceReceipt, evidenceReceipts, pass: verdict.pass, kind: verdict.kind,
             details: verdict.details + diagnostics,
             classification: verdict.meta.classification,
             meta: { ...verdict.meta, nonce, manifest: files, manifestPath, listingCommand: invocation.listing, verification,
+                ...(recovery ? { recovery, retryable: false } : {}),
                 spawnedCommand, processExit: invoked.exitCode, pid: invoked.pid, stdoutPath, stderrPath },
             exitCode: invoked.exitCode ?? -1, reportPath };
     }
     catch (error) {
-        return { pass: false, kind: "infra", classification: "infra", exitCode: -1, reportPath,
-            details: error instanceof Error ? error.message : String(error),
-            meta: { classification: "infra", infra: true, manifestDiscoveryFailed: true, spawnedCommand, verification, ...(manifestPath ? { manifestPath } : {}) } };
+        const evidenceReceipt = error?.evidenceReceipt;
+        if (evidenceReceipt)
+            evidenceReceipts.push(...(error.evidenceReceipts ?? [evidenceReceipt]));
+        return { evidenceReceipt, evidenceReceipts, pass: false, kind: "infra", classification: "infra", exitCode: -1, reportPath,
+            details: (recovery ? `single fork retry ${recovery.retryNonce} after ${recovery.firstNonce}: ` : "") + (error instanceof Error ? error.message : String(error)),
+            meta: { classification: "infra", infra: true, manifestDiscoveryFailed: true, spawnedCommand, verification,
+                ...(recovery ? { recovery, retryable: false } : {}), ...(manifestPath ? { manifestPath } : {}) } };
     }
 }

package/dist/gates/test-reporter.js

@@ -35,6 +35,10 @@ export default class TickmarkrReporter {
   }
   onTestRunStart(specifications) {
     this.report.requested = specifications.map(s => this.file(s));
+    // The files-only CLI listing has no scheduling information. These are the resolved
+    // specifications the pool will consume, including per-file pool overrides.
+    this.report.scheduling = Object.fromEntries(specifications.filter(s => s.project?.config && typeof s.pool === 'string')
+      .map(s => [this.file(s), { pool: s.pool, singleFork: s.project.config.poolOptions?.forks?.singleFork === true }]));
     this.save();
   }
   onTestModuleStart(module) {

package/dist/graph/graph.d.ts

@@ -24,7 +24,7 @@ export declare function onDiskSpecHash(_repoRoot: string, graph: RunGraph): OnDi
 /** A task's definition minus its files[] (and run state): what a scope amendment must NOT move (OBS-1073). */
 export declare function taskDefinitionFingerprint(task: Task): string;
 export declare function graphDefinitionHash(g: RunGraph): string;
-export declare function taskContentDigest(task: Pick<Task, "goal" | "files" | "acceptance">): string;
+export declare function taskContentDigest(task: Pick<Task, "goal" | "files" | "acceptance" | "outOfScope">): string;
 export declare function tickmarkrDir(repoRoot: string): string;
 export declare function loadGraph(repoRoot: string): RunGraph;
 export declare function saveGraph(repoRoot: string, g: RunGraph): void;

package/dist/graph/graph.js

@@ -94,9 +94,14 @@ export function graphDefinitionHash(g) {
 // finding; changing the goal, write surface or acceptance contract does. Keep the full digest here:
 // unlike graphDefinitionHash this value is persisted beside evidence and is the fail-closed join a
 // later run uses, so there is no benefit in making collision diagnosis less explicit.
+// OBS-1126: outOfScope joins the identity only when present — an absent list keeps the historical
+// bytes so every digest persisted before the field existed still joins.
 export function taskContentDigest(task) {
     return createHash("sha256")
-        .update(JSON.stringify({ goal: task.goal, files: task.files, acceptance: task.acceptance }))
+        .update(JSON.stringify({
+        goal: task.goal, files: task.files, acceptance: task.acceptance,
+        ...(task.outOfScope ? { outOfScope: task.outOfScope } : {}),
+    }))
         .digest("hex");
 }
 export function tickmarkrDir(repoRoot) {

package/dist/graph/schema.d.ts

@@ -80,6 +80,7 @@ export declare const TaskSchema: z.ZodObject<{
         kind: z.ZodLiteral<"fixture">;
         paths: z.ZodArray<z.ZodString>;
     }, z.core.$strip>], "kind">>>;
+    outOfScope: z.ZodOptional<z.ZodArray<z.ZodString>>;
     gates: z.ZodDefault<z.ZodArray<z.ZodEnum<{
         build: "build";
         test: "test";
@@ -181,6 +182,7 @@ export declare const RunGraphSchema: z.ZodObject<{
             kind: z.ZodLiteral<"fixture">;
             paths: z.ZodArray<z.ZodString>;
         }, z.core.$strip>], "kind">>>;
+        outOfScope: z.ZodOptional<z.ZodArray<z.ZodString>>;
         gates: z.ZodDefault<z.ZodArray<z.ZodEnum<{
             build: "build";
             test: "test";

package/dist/graph/schema.js

@@ -71,6 +71,8 @@ export const TaskSchema = z.object({
     }))
         .optional(),
     pins: z.array(PinSchema).optional(),
+    // OBS-1126: declared bounds the task must not cross; absent ⇒ no key (sealed graph bytes hold).
+    outOfScope: z.array(z.string().min(1)).optional(),
     gates: z
         .array(z.enum(GATE_NAMES))
         .default(["build", "test", "lint", "evidence", "scope", "acceptance", "review"])

package/dist/route/preference.d.ts

@@ -1,5 +1,5 @@
 import { type AuthHealth } from "../adapters/types.js";
-import type { TickmarkrConfig } from "../config/config.js";
+import { type TickmarkrConfig } from "../config/config.js";
 export interface Disallowed {
     by: "deny" | "allow";
     entry: string;

package/dist/route/preference.js

@@ -1,4 +1,5 @@
 import { channelKey, channelsFromConfig } from "../adapters/types.js";
+import { DENY_SCOPES, denyEntriesAt } from "../config/config.js";
 import { validateGraph } from "../graph/schema.js";
 import { route, RoutingError } from "./router.js";
 const PREFERENCE_ROLES = ["worker", "judge", "review", "consult"];
@@ -121,47 +122,17 @@ export function entryMatchesChannel(entry, c, allowFamilyMatching = false) {
 export function exclusionCollector(c, routingOrCfg, role = "worker") {
     const routing = "routing" in routingOrCfg ? routingOrCfg.routing : routingOrCfg;
     const out = [];
-    const { allow, deny } = routing ?? {};
-    for (const entry of deny?.adapters ?? []) {
-        if (entryMatchesChannel(entry, c, true)) {
-            out.push({
-                scope: "routing.deny.adapters",
-                path: "routing.deny.adapters",
-                configPath: "routing.deny.adapters",
-                entry,
-                by: "deny",
-            });
-        }
-    }
-    for (const entry of deny?.models ?? []) {
-        if (entryMatchesChannel(entry, c, true)) {
-            out.push({
-                scope: "routing.deny.models",
-                path: "routing.deny.models",
-                configPath: "routing.deny.models",
-                entry,
-                by: "deny",
-            });
-        }
-    }
-    if (role === "worker") {
-        for (const entry of deny?.workers?.adapters ?? []) {
-            if (entryMatchesChannel(entry, c, true)) {
-                out.push({
-                    scope: "routing.deny.workers.adapters",
-                    path: "routing.deny.workers.adapters",
-                    configPath: "routing.deny.workers.adapters",
-                    entry,
-                    by: "deny",
-                });
-            }
-        }
-        for (const entry of deny?.workers?.models ?? []) {
+    const { allow } = routing ?? {};
+    for (const scope of DENY_SCOPES) {
+        // Lists under workers apply only to worker seats; flat deny lists cover every role.
+        if (scope.path[2] === "workers" && role !== "worker")
+            continue;
+        for (const entry of denyEntriesAt(routing, scope) ?? []) {
             if (entryMatchesChannel(entry, c, true)) {
                 out.push({
-                    scope: "routing.deny.workers.models",
-                    path: "routing.deny.workers.models",
-                    configPath: "routing.deny.workers.models",
+                    scope: scope.dotted,
+                    path: scope.dotted,
+                    configPath: scope.dotted,
                     entry,
                     by: "deny",
                 });

package/dist/run/daemon.d.ts

@@ -170,6 +170,11 @@ export declare const HARVESTED_RESULT_SUMMARY = "harvested: the worktree carries
 export declare function commandsHash(commands: Record<string, string>): string;
 export interface TipProof {
     kind: "fresh" | "reused" | "failed" | "incomplete";
+    /** Each completed gate keeps its own execution provenance, even in a mixed cycle. */
+    gates?: Array<{
+        gate: string;
+        kind: "fresh" | "reused";
+    }>;
     /** the commit the cycle's start row spoke for */
     tip?: string;
 }
@@ -177,7 +182,8 @@ export interface TipProof {
  * OBS-1077 close rider: what the engagement's LATEST verification cycle proved — its
  * `tip-verify-start` row and what followed, never a commit comparison. Exactly one kind per close:
  * fresh (every tip command ran AND passed), reused (an eligible cached cycle carried forward),
- * failed, or incomplete (cancelled, cut short, mixed or undelimited). Nothing before the start row
+ * failed, or incomplete (cancelled, cut short or undelimited). Completed mixed cycles retain each
+ * gate's kind beside the whole-cycle reused kind. Nothing before the start row
  * is read, so an unfinished cycle inherits nothing from an earlier green one.
  */
 export declare function runEndTipProof(events: readonly JournalEvent[]): TipProof;