tickmarkr 2.5.8 → 2.6.0

package/dist/run/journal.d.ts

@@ -43,6 +43,15 @@ export interface StructuredFinding {
     note: string;
     rationale?: string;
     fingerprint: string;
+    /** Closed list of spellings actually observed on this chain, including the current one. */
+    observedFingerprints?: string[];
+    /** Prior id validated against the reviewer's reraised list by the review gate. */
+    reraisedFrom?: string;
+    /** Resolved definition AND defect identity; bare symbol spelling is never lineage. */
+    codeIdentity?: {
+        definition: string;
+        defect: string;
+    };
 }
 declare const CONSULT_ACTIONS: readonly ["retry", "reroute", "decompose", "human"];
 export type ConsultGuidanceAction = (typeof CONSULT_ACTIONS)[number];
@@ -187,6 +196,11 @@ export declare function pendingApprovalActions(events: JournalEvent[]): Map<stri
  * because every approval erased exactly the finding the fresh attempt was funded to fix.
  */
 export declare function journaledFailureBrief(events: JournalEvent[], taskId: string): string[];
+/** Never infer a cross-path alias from a symbol, sentence, or hash. */
+export declare function reviewFingerprintMatches(candidate: unknown, fingerprint: string): boolean;
+export declare function observedReviewFingerprints(finding: StructuredFinding): string[];
+/** Re-seat only an unambiguous, positively linked chain; retain the newest evidence path. */
+export declare function carryReviewFindings(priors: readonly StructuredFinding[], rows: readonly StructuredFinding[]): StructuredFinding[];
 /**
  * T6: the review findings still OUTSTANDING on a task. A review finding is a property of the TASK,
  * not of the attempt that drew it: it stays outstanding until a later review PASSES on the task (or
@@ -208,7 +222,8 @@ export declare function journaledFailureBrief(events: JournalEvent[], taskId: st
  * other gate settled that gate, not this one. Reading "approved" as "settled" is how a still-open
  * finding was dropped at the exact moment the operator paid for another attempt to fix it. A review
  * that DECLINED (`skipped`) is not a verdict and neither adds nor retires — fail closed. Findings are
- * keyed by fingerprint, so a reviewer restating one across rounds carries it once, not once per round.
+ * linked by validated lineage across paths; observed spellings remain a closed list. Repeating the
+ * same row carries it once, while distinct defects sharing a symbol retain separate fingerprints.
  *
  * v2.1.5 T2: a passing review settles the findings it BLOCKED on. It does not settle the ones it
  * DEFERRED — those it saw, declined to block on, and recorded a rationale for, and nothing has fixed
@@ -312,8 +327,8 @@ export declare const TelemetryRowSchema: z.ZodObject<{
     }>>;
     kind: z.ZodOptional<z.ZodLiteral<"judge">>;
     judgeOutcome: z.ZodOptional<z.ZodEnum<{
-        parseable: "parseable";
         unparseable: "unparseable";
+        parseable: "parseable";
     }>>;
 }, z.core.$strip>;
 export type TelemetryRow = z.infer<typeof TelemetryRowSchema>;
@@ -422,7 +437,7 @@ export declare class Journal {
         assignment?: Assignment;
     } | null;
     replayResumeState(): Map<string, ResumeState>;
-    replaySatisfiedGates(): Map<string, GateName>;
+    replaySatisfiedGates(currentSubjects?: ReadonlyMap<string, string>): Map<string, GateName>;
     replayCurrentAttemptGateResults(): Map<string, CurrentAttemptGateReplay>;
     replayExcludedChannels(): Set<string>;
     telemetry(row: TelemetryRow): void;

package/dist/run/journal.js

@@ -730,6 +730,83 @@ export function journaledFailureBrief(events, taskId) {
     }
     return rows;
 }
+/** Never infer a cross-path alias from a symbol, sentence, or hash. */
+export function reviewFingerprintMatches(candidate, fingerprint) {
+    return typeof candidate === "string"
+        && candidate.replace(/^\s*fingerprint\s*:\s*/i, "").replace(/\s+/g, "") === fingerprint.replace(/\s+/g, "");
+}
+export function observedReviewFingerprints(finding) {
+    const observed = Array.isArray(finding.observedFingerprints)
+        ? finding.observedFingerprints.filter((id) => typeof id === "string") : [];
+    return [...new Set([finding.fingerprint, ...observed])];
+}
+const reviewNoteIdentity = (note) => note.replace(LINE_REF_RE, "").replace(/\s+/g, " ").trim();
+function distinctReviewFinding(row) {
+    const identity = JSON.stringify([reviewNoteIdentity(row.note), row.codeIdentity ?? null]);
+    const symbol = `${row.symbol}#${createHash("sha256").update(identity).digest("hex").slice(0, 12)}`;
+    return { ...row, symbol, fingerprint: `${row.class}|${row.path}|${symbol}` };
+}
+/** Re-seat only an unambiguous, positively linked chain; retain the newest evidence path. */
+export function carryReviewFindings(priors, rows) {
+    const open = [...priors];
+    for (const row of rows) {
+        const identity = row.codeIdentity;
+        const matches = open.filter((prior) => {
+            if (prior.class !== row.class)
+                return false;
+            if (row.reraisedFrom)
+                return rows.filter((other) => other.reraisedFrom === row.reraisedFrom).length === 1
+                    && observedReviewFingerprints(prior).includes(row.reraisedFrom);
+            if (identity?.definition && identity.defect && prior.codeIdentity) {
+                return prior.codeIdentity.definition === identity.definition && prior.codeIdentity.defect === identity.defect;
+            }
+            return prior.fingerprint === row.fingerprint && reviewNoteIdentity(prior.note) === reviewNoteIdentity(row.note);
+        });
+        if (matches.length === 1) {
+            const prior = matches[0];
+            // Positive lineage does not grant this chain another open defect's display spelling.
+            let newest = row;
+            while (open.some((other) => other !== prior && observedReviewFingerprints(other).includes(newest.fingerprint))) {
+                newest = distinctReviewFinding(newest);
+            }
+            const observed = [...new Set([...observedReviewFingerprints(prior), ...observedReviewFingerprints(newest)])];
+            open[open.indexOf(prior)] = {
+                ...newest,
+                ...(prior.codeIdentity && !newest.codeIdentity ? { codeIdentity: prior.codeIdentity } : {}),
+                ...(observed.length > 1 ? { observedFingerprints: observed } : {}),
+            };
+        }
+        else {
+            // Two defects may name the same definition. Preserve both, with a copyable full triple.
+            // Deferrals intentionally replace their rationale without changing their note.
+            const collision = open.some((prior) => observedReviewFingerprints(prior).includes(row.fingerprint));
+            if (collision) {
+                let distinct = distinctReviewFinding(row);
+                // A generated spelling may itself belong to a chain that has since moved away.
+                // Reuse only a matching row; otherwise keep minting until the spelling is unowned.
+                while (true) {
+                    const owners = open.filter((prior) => observedReviewFingerprints(prior).includes(distinct.fingerprint));
+                    if (owners.length === 0) {
+                        open.push(distinct);
+                        break;
+                    }
+                    if (owners.length === 1 && reviewNoteIdentity(owners[0].note) === reviewNoteIdentity(row.note)) {
+                        const prior = owners[0];
+                        open[open.indexOf(prior)] = {
+                            ...prior, ...distinct,
+                            observedFingerprints: [...new Set([...observedReviewFingerprints(prior), ...observedReviewFingerprints(distinct)])],
+                        };
+                        break;
+                    }
+                    distinct = distinctReviewFinding(distinct);
+                }
+            }
+            else
+                open.push(row);
+        }
+    }
+    return open;
+}
 /**
  * T6: the review findings still OUTSTANDING on a task. A review finding is a property of the TASK,
  * not of the attempt that drew it: it stays outstanding until a later review PASSES on the task (or
@@ -751,7 +828,8 @@ export function journaledFailureBrief(events, taskId) {
  * other gate settled that gate, not this one. Reading "approved" as "settled" is how a still-open
  * finding was dropped at the exact moment the operator paid for another attempt to fix it. A review
  * that DECLINED (`skipped`) is not a verdict and neither adds nor retires — fail closed. Findings are
- * keyed by fingerprint, so a reviewer restating one across rounds carries it once, not once per round.
+ * linked by validated lineage across paths; observed spellings remain a closed list. Repeating the
+ * same row carries it once, while distinct defects sharing a symbol retain separate fingerprints.
  *
  * v2.1.5 T2: a passing review settles the findings it BLOCKED on. It does not settle the ones it
  * DEFERRED — those it saw, declined to block on, and recorded a rationale for, and nothing has fixed
@@ -767,34 +845,44 @@ export function journaledFailureBrief(events, taskId) {
  * row. N rounds of the same concern therefore carry the newest accepted explanation once, not N rows.
  */
 export function outstandingReviewFindings(events, taskId) {
-    const open = new Map();
+    let open = [];
     for (const e of events) {
         if (e.taskId !== taskId)
             continue;
         if (e.event === "task-approved") {
             if (e.data.release === GATE_SATISFIED_RELEASE && e.data.gate === "review")
-                open.clear();
+                open = [];
             continue;
         }
         if (e.event !== "gate-result" || e.data.gate !== "review" || e.data.skipped === true)
             continue;
+        // Rejected or missing verdicts carry diagnostics, not accepted findings or closures.
+        if (e.data.unparseable === true || e.data.noVerdict === true || e.data.cause !== undefined)
+            continue;
+        // A failed review can resolve one chain while re-raising another. Only observed, uniquely
+        // matched spellings retire a chain; skipped/no-verdict rows were excluded above.
+        if (Array.isArray(e.data.resolved)) {
+            const resolved = e.data.resolved;
+            const settled = new Set(resolved.flatMap((id) => {
+                const matches = open.filter((finding) => finding.class === "review:material"
+                    && observedReviewFingerprints(finding).some((fp) => reviewFingerprintMatches(id, fp)));
+                return matches.length === 1 ? matches : [];
+            }));
+            open = open.filter((finding) => !settled.has(finding));
+        }
         if (e.data.pass !== false) {
             // a later review PASSED on this task: every finding it BLOCKED on is settled …
-            for (const [key, finding] of open)
-                if (!isDeferredFinding(finding))
-                    open.delete(key);
+            open = open.filter(isDeferredFinding);
             // … and no deferral is, whether or not this pass restated it. A pass is silent about a
             // deferral it does not mention: the concern is unfixed either way, and the reviewer that
             // waved it through is not the release that accepts it. Retiring on omission would drop it on
             // the very next round — the same silent drop by a different door.
-            for (const finding of findingRows(e, "review").filter(isDeferredFinding))
-                open.set(finding.fingerprint, finding);
+            open = carryReviewFindings(open, findingRows(e, "review").filter(isDeferredFinding));
         }
         else
-            for (const finding of findingRows(e, "review"))
-                open.set(finding.fingerprint, finding);
+            open = carryReviewFindings(open, findingRows(e, "review"));
     }
-    return [...open.values()];
+    return open;
 }
 /** The findings a funded repair must carry into the next dispatch, or undefined if none is pending. */
 export function pendingRepairFindings(events, taskId) {
@@ -1646,26 +1734,62 @@ export class Journal {
         }
         return m;
     }
-    // OBS-130/OBS-571: gate satisfaction is authority, not an inferred daemon state. Only an explicit
-    // task-approved event with the typed release marker and a known gate enters this fold. Authority is
-    // scoped to that approval: any later approval supersedes it, and the worktree-recreation row written
-    // before the approved gate suffix runs consumes it at enactment. A daemon-made gate-satisfied event,
-    // a prior pass/fail result, malformed data, or another task's approval is inert.
-    replaySatisfiedGates() {
+    // OBS-130/OBS-571: only an explicit approval grants gate authority; recreation consumes
+    // its immediate enactment. OBS-1133: retain a review waiver's subject separately so a later
+    // recheck may carry it. Tool waivers never survive recheck. The daemon supplies the recreated
+    // subject before using a carried waiver; absent that, replay can only compare journaled subjects.
+    replaySatisfiedGates(currentSubjects) {
         const satisfied = new Map();
+        const reviewSubjects = new Map();
+        const subjects = new Map();
+        const reviewWaivers = new Map();
         for (const e of this.read()) {
             if (!e.taskId)
                 continue;
+            if (e.event === "task-dispatch") {
+                reviewSubjects.delete(e.taskId);
+                subjects.delete(e.taskId);
+                reviewWaivers.delete(e.taskId);
+                satisfied.delete(e.taskId);
+            }
+            if (e.event === "gate-result") {
+                const commit = typeof e.data.commit === "string" && e.data.commit ? e.data.commit : undefined;
+                if (commit)
+                    subjects.set(e.taskId, commit);
+                else
+                    subjects.delete(e.taskId);
+                if (reviewWaivers.has(e.taskId) && reviewWaivers.get(e.taskId) !== commit) {
+                    reviewWaivers.delete(e.taskId);
+                }
+                if (e.data.gate === "review") {
+                    if (commit && e.data.pass === false)
+                        reviewSubjects.set(e.taskId, commit);
+                    else
+                        reviewSubjects.delete(e.taskId);
+                }
+            }
             if (e.event === "worktree-recreation") {
                 satisfied.delete(e.taskId);
                 continue;
             }
             if (e.event === "task-approved") {
                 satisfied.delete(e.taskId);
+                if (e.data.release === RECHECK_RELEASE) {
+                    const waivedSubject = reviewWaivers.get(e.taskId);
+                    const subject = currentSubjects?.get(e.taskId) ?? subjects.get(e.taskId);
+                    if (waivedSubject && waivedSubject === subject)
+                        satisfied.set(e.taskId, "review");
+                    continue;
+                }
+                reviewWaivers.delete(e.taskId);
                 if (e.data.release === GATE_SATISFIED_RELEASE
                     && typeof e.data.gate === "string"
                     && GATE_NAMES.includes(e.data.gate)) {
                     satisfied.set(e.taskId, e.data.gate);
+                    const subject = reviewSubjects.get(e.taskId);
+                    if (e.data.gate === "review" && subject && subject === subjects.get(e.taskId)) {
+                        reviewWaivers.set(e.taskId, subject);
+                    }
                 }
             }
         }

package/dist/run/merge.d.ts

@@ -1,6 +1,15 @@
 import type { TickmarkrConfig } from "../config/config.js";
-import { type Baseline, type FailureClassification } from "../gates/baseline.js";
+import { type Baseline, type GateEvidenceOptions, type FailureClassification } from "../gates/baseline.js";
+import type { GateEvidenceReceipt } from "./protocol.js";
 export interface TipVerifyResult {
+    evidenceReceipt?: GateEvidenceReceipt;
+    evidenceReceipts?: GateEvidenceReceipt[];
+    evidenceAbsence?: "provenance-refused" | "not-started" | "historical-cache";
+    /** Directory the evidence setup returned; receipt artifact paths resolve against it. */
+    originRunRoot?: string;
+    nonce?: string;
+    stdoutPath?: string;
+    stderrPath?: string;
     gate: string;
     cmd: string;
     pass: boolean;
@@ -20,6 +29,8 @@ export interface TipVerifyResult {
      */
     cause?: FailureClassification;
 }
+/** Carry execution evidence without minting an invocation or rebasing its artifact paths. */
+export declare function reusedTipEvidence(source: Partial<TipVerifyResult>): Partial<TipVerifyResult>;
 export declare function integrationBranch(cfg: TickmarkrConfig, runId: string): string;
 export declare function ensureIntegration(repo: string, branch: string, baseRef: string): Promise<string>;
 export declare function integrationHead(intWt: string): Promise<string>;
@@ -31,4 +42,4 @@ export declare function mergeTask(intWt: string, taskBranch: string, message: st
         branchTip: string;
     };
 }>;
-export declare function verifyIntegrationTip(intWt: string, commands: Record<string, string>, runDir: string, baseline?: Baseline): Promise<TipVerifyResult[]>;
+export declare function verifyIntegrationTip(intWt: string, commands: Record<string, string>, runDir: string, baseline?: Baseline, evidenceOptions?: GateEvidenceOptions): Promise<TipVerifyResult[]>;

package/dist/run/merge.js

@@ -1,11 +1,34 @@
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { shq } from "../adapters/types.js";
-import { ceilingKillResult, classifyFreshRunnerOutput, classifyRunnerOutput, fileCountDeficit, waitForCalmWindow, effectiveCeilingMs, fingerprint, freshFailures, } from "../gates/baseline.js";
+import { beginGateEvidence, ceilingKillResult, classifyFreshRunnerOutput, classifyRunnerOutput, fileCountDeficit, waitForCalmWindow, effectiveCeilingMs, fingerprint, freshFailures, } from "../gates/baseline.js";
 import { evaluateManifestedTest, isVitestTestCommand } from "../gates/test-manifest.js";
 import { computeVerificationIdentity, formatReusedDetails, getVerdictStore, getWorktreeTree, resolveStateDir, isInfraResult, } from "../gates/cache.js";
 import { tickmarkrDir } from "../graph/graph.js";
-import { describeCapacity, gitHead, linkNodeModules, resolveIntegrationBranch, resolvedCapacity, sameCapacity, sh, shGit, shGitOk, WORKTREES_DIR } from "./git.js";
+import { dependencyLinkRefusal, describeCapacity, gitHead, linkNodeModules, resolveIntegrationBranch, resolvedCapacity, sameCapacity, sh, shGit, shGitOk, WORKTREES_DIR } from "./git.js";
+import { executionSignal } from "./execution-budget.js";
+// Diagnostic convenience logs are observational, just like receipt persistence.
+function writeTipLog(path, text) {
+    try {
+        writeFileSync(path, text);
+    }
+    catch { /* the command verdict remains authoritative */ }
+}
+/** Carry execution evidence without minting an invocation or rebasing its artifact paths. */
+export function reusedTipEvidence(source) {
+    return {
+        reused: true,
+        ...(source.evidenceReceipt ? { evidenceReceipt: source.evidenceReceipt } : {}),
+        ...(source.evidenceReceipts ? { evidenceReceipts: source.evidenceReceipts } : {}),
+        ...(source.originRunRoot ? { originRunRoot: source.originRunRoot } : {}),
+        ...(!source.evidenceReceipt
+            ? { evidenceAbsence: source.evidenceAbsence ?? "historical-cache" }
+            : source.evidenceAbsence ? { evidenceAbsence: source.evidenceAbsence } : {}),
+        ...(source.nonce !== undefined ? { nonce: source.nonce } : {}),
+        ...(source.stdoutPath !== undefined ? { stdoutPath: source.stdoutPath } : {}),
+        ...(source.stderrPath !== undefined ? { stderrPath: source.stderrPath } : {}),
+    };
+}
 export function integrationBranch(cfg, runId) {
     return `${cfg.integrationBranchPrefix}${runId}`;
 }
@@ -52,7 +75,7 @@ export async function mergeTask(intWt, taskBranch, message, gatedCommit) {
 // terminus unreachable by construction and misattributed the red to the last merged task.
 // Fail-closed edges kept: no baseline → strict; baseline green for that gate → strict; any fresh
 // fingerprint, or output with no recognizable failure shape, → failed.
-export async function verifyIntegrationTip(intWt, commands, runDir, baseline) {
+export async function verifyIntegrationTip(intWt, commands, runDir, baseline, evidenceOptions = {}) {
     const results = [];
     let runStartCommands;
     let journalFound = false;
@@ -105,11 +128,21 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline) {
     if (!commands.test && commands.tipTest) {
         gatesToRun.push(["test", commands.tipTest]);
     }
+    const dependencyRefusal = dependencyLinkRefusal(intWt);
+    if (dependencyRefusal) {
+        for (const [gate, cmd] of gatesToRun.length ? gatesToRun : [["build", ""]]) {
+            const artifact = join(runDir, `tip-verify-${gate}.log`);
+            writeTipLog(artifact, dependencyRefusal + "\n");
+            results.push({ gate, cmd, pass: false, exitCode: 1, fingerprints: [],
+                cause: "infra", details: dependencyRefusal, evidenceAbsence: "not-started", artifact });
+        }
+        return results;
+    }
     if (journalFound && hasRunEvidenceOrMalformed && runStartCommands === undefined) {
         for (const [gate, cmd] of gatesToRun) {
             const artifact = join(runDir, `tip-verify-${gate}.log`);
             const details = `tip verify could not establish command provenance: run-start evidence missing or malformed in journal`;
-            writeFileSync(artifact, details + "\n");
+            writeTipLog(artifact, details + "\n");
             results.push({
                 gate,
                 cmd,
@@ -117,6 +150,7 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline) {
                 exitCode: 1,
                 fingerprints: [],
                 details,
+                evidenceAbsence: "provenance-refused",
                 artifact,
             });
         }
@@ -127,6 +161,8 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline) {
     // Publish only after the entire verification completes. The daemon kills a cancelled
     // verifier process, so completed early gates must remain in memory until then.
     const pending = new Map();
+    // D-267 (1): each fresh receipt's origin is the root its own beginGateEvidence returned.
+    const evidenceRoots = new Map();
     for (const [gate, cmd] of gatesToRun) {
         if (runStartCommands !== undefined) {
             const expectedCmd = gate === "test"
@@ -135,7 +171,7 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline) {
             if (expectedCmd === undefined || cmd !== expectedCmd) {
                 const artifact = join(runDir, `tip-verify-${gate}.log`);
                 const details = `tip verify command "${cmd}" for gate "${gate}" was not named in run-start row`;
-                writeFileSync(artifact, details + "\n");
+                writeTipLog(artifact, details + "\n");
                 results.push({
                     gate,
                     cmd,
@@ -143,6 +179,7 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline) {
                     exitCode: 1,
                     fingerprints: [],
                     details,
+                    evidenceAbsence: "provenance-refused",
                     artifact,
                 });
                 continue;
@@ -184,7 +221,7 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline) {
                 gate,
                 cmd,
                 pass: hit.pass,
-                reused: true,
+                ...reusedTipEvidence(hit.meta ?? {}),
                 exitCode: hit.exitCode ?? 0,
                 fingerprints: hit.meta?.fingerprints ?? [],
                 ...(hit.meta?.forgiven ? { forgiven: true } : {}),
@@ -201,20 +238,34 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline) {
         // a detected vitest test command never reaches the stdout-count/file-count path below (this
         // gate's own manifest is always the FULL suite; verify has no selected screen to hold). A
         // scripted test command that is not the detected runner falls through unchanged.
+        const evidenceSetup = { artifactDir: runDir, runId: runDir, ...evidenceOptions };
         if (gate === "test" && isVitestTestCommand(cmd, intWt)) {
+            // D-267 (1): stamp the root the evidence setup returned, then give that exact root to every
+            // manifested invocation. Do not reconstruct it from the caller's options: the receipt's
+            // artifact paths are relative to the root returned by beginGateEvidence.
+            const evidence = beginGateEvidence(intWt, gate, cmd, evidenceSetup);
+            const manifestedEvidence = { ...evidenceSetup, artifactDir: evidence.root };
+            evidenceRoots.set(gate, evidence.root);
             const outcome = await evaluateManifestedTest(cmd, intWt, {
                 baselineDurations: entry?.fileDurations,
                 longestFile: entry?.longestFile,
                 overallCeilingMs: effectiveCeilingMs(entry),
                 artifactDir: runDir,
+                evidence: manifestedEvidence,
             });
             const artifact = join(runDir, `tip-verify-${gate}.log`);
             if (!outcome.pass)
-                writeFileSync(artifact, outcome.details);
+                writeTipLog(artifact, outcome.details);
             results.push({
                 gate,
                 cmd,
                 pass: outcome.pass,
+                evidenceReceipt: outcome.evidenceReceipt,
+                evidenceReceipts: outcome.evidenceReceipts,
+                ...(!outcome.evidenceReceipt ? { evidenceAbsence: "not-started" } : {}),
+                nonce: outcome.meta.nonce,
+                stdoutPath: outcome.meta.stdoutPath,
+                stderrPath: outcome.meta.stderrPath,
                 exitCode: outcome.exitCode,
                 reportPath: outcome.reportPath,
                 spawnedCommand: outcome.meta.spawnedCommand,
@@ -230,18 +281,42 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline) {
         // `sh` defaults to. A suite whose capture measured 600007ms carries a recorded 1800021ms ceiling;
         // running it under 600000ms here SIGKILLed a green tip three times while every per-task gate passed.
         const ceilingMs = effectiveCeilingMs(entry);
-        let r = await sh(cmd, intWt, ceilingMs);
+        const evidenceReceipts = [];
+        const execute = async () => {
+            const evidence = beginGateEvidence(intWt, gate, cmd, evidenceSetup);
+            evidenceRoots.set(gate, evidence.root);
+            try {
+                const result = await sh(cmd, intWt, ceilingMs, { env: evidenceOptions.env, onReceipt: receipt => evidence.observe(receipt) });
+                evidenceReceipts.push(...evidence.history, evidence.finish(result.stdout, result.stderr));
+                return result;
+            }
+            catch (error) {
+                const receipt = evidence.finish();
+                if (receipt.termination.kind !== "not-started" || executionSignal()?.aborted)
+                    throw error;
+                evidenceReceipts.push(...evidence.history, receipt);
+                return { code: -1, stdout: "", stderr: String(error) };
+            }
+        };
+        let r = await execute();
         let raw = r.stdout + "\n" + r.stderr;
         let stripped = raw.split(intWt).join("");
         let rerun;
-        if (gate === "test" && !r.timedOut && !fileCountDeficit(entry, stripped)
+        if (evidenceReceipts.at(-1)?.termination.kind !== "not-started" && gate === "test" && !r.timedOut && !fileCountDeficit(entry, stripped)
             && classifyFreshRunnerOutput(entry, stripped, r.code) === "infra") {
             const waitedMs = await waitForCalmWindow();
             rerun = `runner-infra rerun after waiting ${waitedMs}ms for a calm load window`;
-            r = await sh(cmd, intWt, ceilingMs);
+            r = await execute();
             raw = r.stdout + "\n" + r.stderr;
             stripped = raw.split(intWt).join("");
         }
+        const evidenceReceipt = evidenceReceipts.at(-1);
+        if (evidenceReceipt.termination.kind === "not-started") {
+            results.push({ gate, cmd, pass: false, exitCode: r.code, fingerprints: [],
+                details: `infra; command failed to launch: ${r.stderr}`, cause: "infra",
+                evidenceReceipt, evidenceReceipts, evidenceAbsence: "not-started" });
+            continue;
+        }
         const artifact = join(runDir, `tip-verify-${gate}.log`);
         // Battery parity on the ceiling too (baseline.ts Q24): the kill is read BEFORE the exit code is
         // interpreted at all. A SIGKILLed battery never returned a verdict, so no line of its partial
@@ -249,11 +324,12 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline) {
         // operator cannot act on. The kill reader's own text (ceiling + elapsed) and cause replace it.
         const killed = ceilingKillResult(gate, r, ceilingMs);
         if (killed) {
-            writeFileSync(artifact, raw);
+            writeTipLog(artifact, raw);
             results.push({
                 gate,
                 cmd,
                 pass: false,
+                evidenceReceipt, evidenceReceipts,
                 exitCode: r.code,
                 fingerprints: [],
                 details: `${rerun ? `infra; ${rerun}: ` : ""}${killed.details}`,
@@ -290,11 +366,12 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline) {
             && comparable;
         const pass = !deficit && (r.code === 0 || greenTeardown || forgiven);
         if (!pass)
-            writeFileSync(artifact, raw);
+            writeTipLog(artifact, raw);
         const tipResult = {
             gate,
             cmd,
             pass,
+            evidenceReceipt, evidenceReceipts,
             exitCode: r.code,
             fingerprints: r.code !== 0 && !greenTeardown ? fingerprint(stripped) : [],
             details: `${cause === "infra" ? "infra; " : ""}${rerun ? `${rerun}: ` : ""}` + (deficit?.replace(/^infra; /, "") ?? (r.code === 0 ? "exit 0"
@@ -315,12 +392,21 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline) {
     // spawns in the daemon child, and a command that changed the tree invalidates reuse.
     const completedTree = pending.size ? await getWorktreeTree(intWt) : undefined;
     for (const result of results) {
+        if (!result.reused && result.evidenceReceipt) {
+            const evidenceRoot = evidenceRoots.get(result.gate);
+            if (evidenceRoot === undefined)
+                throw new Error(`tip verify receipt for ${result.gate} has no evidence root from its evidence setup`);
+            result.originRunRoot = evidenceRoot;
+        }
         const id = pending.get(result.gate);
         if (id && id.tree === completedTree && !isInfraResult(result)) {
             store.set(id, { ...result, meta: {
                     fingerprints: result.fingerprints, forgiven: result.forgiven,
                     reportPath: result.reportPath, spawnedCommand: result.spawnedCommand,
                     artifact: result.artifact,
+                    evidenceReceipt: result.evidenceReceipt, evidenceReceipts: result.evidenceReceipts,
+                    evidenceAbsence: result.evidenceAbsence, originRunRoot: result.originRunRoot,
+                    nonce: result.nonce, stdoutPath: result.stdoutPath, stderrPath: result.stderrPath,
                 } });
         }
     }

package/dist/run/protocol.d.ts

@@ -37,6 +37,88 @@ export declare const ShellReceiptSchema: z.ZodObject<{
     durationMs: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strict>;
 export type ShellReceipt = z.infer<typeof ShellReceiptSchema>;
+export declare const EVIDENCE_AVAILABILITIES: readonly ["available", "not-started", "capture-failed", "killed", "expired", "missing"];
+export declare const EvidenceArtifactSchema: z.ZodObject<{
+    path: z.ZodString;
+    availability: z.ZodEnum<{
+        available: "available";
+        "not-started": "not-started";
+        "capture-failed": "capture-failed";
+        killed: "killed";
+        expired: "expired";
+        missing: "missing";
+    }>;
+    sha256: z.ZodNullable<z.ZodString>;
+    retainedBytes: z.ZodNumber;
+    droppedBytes: z.ZodNumber;
+    truncated: z.ZodBoolean;
+}, z.core.$strict>;
+export declare const GateEvidenceReceiptSchema: z.ZodObject<{
+    invocationId: z.ZodString;
+    nonce: z.ZodOptional<z.ZodString>;
+    subject: z.ZodObject<{
+        runId: z.ZodString;
+        taskId: z.ZodNullable<z.ZodString>;
+        attempt: z.ZodNullable<z.ZodNumber>;
+        gate: z.ZodString;
+        subjectCommit: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>;
+    termination: z.ZodObject<{
+        kind: z.ZodEnum<{
+            unknown: "unknown";
+            signal: "signal";
+            "not-started": "not-started";
+            exit: "exit";
+            timeout: "timeout";
+        }>;
+        exitCode: z.ZodNullable<z.ZodNumber>;
+        signal: z.ZodNullable<z.ZodString>;
+        timedOut: z.ZodNullable<z.ZodBoolean>;
+    }, z.core.$strict>;
+    availability: z.ZodEnum<{
+        available: "available";
+        "not-started": "not-started";
+        "capture-failed": "capture-failed";
+        killed: "killed";
+        expired: "expired";
+        missing: "missing";
+    }>;
+    redaction: z.ZodObject<{
+        material: z.ZodBoolean;
+    }, z.core.$strict>;
+    stdout: z.ZodObject<{
+        path: z.ZodString;
+        availability: z.ZodEnum<{
+            available: "available";
+            "not-started": "not-started";
+            "capture-failed": "capture-failed";
+            killed: "killed";
+            expired: "expired";
+            missing: "missing";
+        }>;
+        sha256: z.ZodNullable<z.ZodString>;
+        retainedBytes: z.ZodNumber;
+        droppedBytes: z.ZodNumber;
+        truncated: z.ZodBoolean;
+    }, z.core.$strict>;
+    stderr: z.ZodObject<{
+        path: z.ZodString;
+        availability: z.ZodEnum<{
+            available: "available";
+            "not-started": "not-started";
+            "capture-failed": "capture-failed";
+            killed: "killed";
+            expired: "expired";
+            missing: "missing";
+        }>;
+        sha256: z.ZodNullable<z.ZodString>;
+        retainedBytes: z.ZodNumber;
+        droppedBytes: z.ZodNumber;
+        truncated: z.ZodBoolean;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type GateEvidenceReceipt = z.infer<typeof GateEvidenceReceiptSchema>;
+export type EvidenceArtifact = z.infer<typeof EvidenceArtifactSchema>;
 /** A task-build row must carry the entire caller-owned correlation, even before spawn. */
 export declare const CommandReceiptSchema: z.ZodObject<{
     outcome: z.ZodEnum<{