tickmarkr 2.6.6 → 2.6.7

package/dist/run/lease.js

@@ -1,9 +1,10 @@
 import { AsyncLocalStorage } from "node:async_hooks";
-import { execFile } from "node:child_process";
+import { execFile, execFileSync } from "node:child_process";
 import { randomUUID } from "node:crypto";
-import { closeSync, constants, fstatSync, linkSync, mkdirSync, openSync, readFileSync, readdirSync, readlinkSync, rmdirSync, rmSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
+import { closeSync, constants, fstatSync, linkSync, mkdirSync, openSync, readFileSync, readdirSync, readlinkSync, renameSync, rmdirSync, rmSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
 import { createHash } from "node:crypto";
-import { join, resolve } from "node:path";
+import { join } from "node:path";
+import { trustedCommonDir } from "./git-trust.js";
 // The process census and command admission deliberately use the same command-head classifier.
 export function isRunnerCommand(command) {
     // Inspect executable positions only: inference prompts and shell script bodies may name runners.
@@ -119,14 +120,13 @@ export async function reentrantHolder(path, inherited) {
     if (!inherited)
         return undefined;
     const holder = readHolder(path);
-    if (holder?.token !== inherited || holder.pid === process.pid || !alive(holder.pid))
+    if (holder?.token !== inherited || holder.pid === process.pid || !holderAlive(holder))
         return undefined;
     return (await ancestorPids()).has(holder.pid) ? holder : undefined;
 }
 const LEASE_FILE = "tickmarkr-runner.lease";
 export async function repositoryLeasePath(cwd) {
-    const commonDir = await new Promise((ok, fail) => execFile("git", ["rev-parse", "--git-common-dir"], { cwd, encoding: "utf8" }, (error, stdout) => error ? fail(error) : ok(stdout.trim())));
-    return join(resolve(cwd, commonDir), LEASE_FILE);
+    return join(trustedCommonDir(cwd), LEASE_FILE);
 }
 const alive = (pid) => {
     try {
@@ -303,9 +303,9 @@ const reclaimDeadLocked = (path, identity) => {
 };
 /** Exposed for recovery regressions; the standalone verify uses the combined critical section. */
 export const reclaimDead = async (path, identity, pollMs = 10) => withMutationLock(path, pollMs, undefined, () => reclaimDeadLocked(path, identity));
-const inspectAndReserve = (path, mine) => {
+const inspectAndReserve = async (path, mine) => {
     let occupant = readOccupant(path);
-    if (occupant && (!occupant.holder || !alive(occupant.holder.pid))) {
+    if (occupant && (!occupant.holder || (!holderAlive(occupant.holder) && !(occupant.holder.protectOrphans && (await protectedProcesses(occupant.holder)).length)))) {
         reclaimDeadLocked(path, occupant.identity);
         occupant = readOccupant(path);
     }
@@ -313,43 +313,237 @@ const inspectAndReserve = (path, mine) => {
         return { acquired: true };
     return { acquired: false, holder: occupant?.holder };
 };
-export async function withRepositoryLease(cwd, run, opts = {}) {
+// A durable capability is also a crash owner: census checks the exact generation's inherited
+// environment and recorded process groups, including live orphans reparented after owner death.
+// An unreadable census refuses reclamation/release. No dead-pid shortcut admits over a live tree.
+export async function protectedProcesses(holder, tokenEnv = REPOSITORY_LEASE_TOKEN_ENV, ownedOnly = false) {
+    let censusPid;
+    const rows = await new Promise((ok, fail) => {
+        const census = execFile("ps", ["eww", "-A", "-o", "pid=,ppid=,pgid=,stat=,command="], { encoding: "utf8", timeout: 15_000, maxBuffer: 16 * 1024 * 1024 }, (error, stdout) => error ? fail(error) : ok(stdout));
+        censusPid = census.pid;
+    });
+    const token = `${tokenEnv}=${holder.token}`;
+    const lines = rows.split("\n");
+    const safeGroups = new Set((holder.roots ?? []).filter(pid => {
+        const leader = lines.some(line => new RegExp(`^\\s*${pid}\\s+\\d+\\s+${pid}\\s+`).test(line));
+        // A leaderless group still belongs to its recorded root; a reused leader must match its birth.
+        return !leader || sameProcessBirth(processBirth(pid), holder.rootBirths?.[pid]);
+    }));
+    const parsed = lines.flatMap(line => {
+        const match = /^\s*(\d+)\s+(\d+)\s+(\d+)\s+(\S+)\s+(.*)$/.exec(line);
+        return match ? [{ pid: Number(match[1]), parent: Number(match[2]), group: Number(match[3]), stat: match[4], command: match[5] }] : [];
+    });
+    const parents = new Map(parsed.map(row => [row.pid, row.parent]));
+    const descendant = (pid) => {
+        const seen = new Set();
+        for (let at = parents.get(pid) ?? 0; at > 1 && !seen.has(at); at = parents.get(at) ?? 0) {
+            if (at === holder.pid)
+                return true;
+            seen.add(at);
+        }
+        return false;
+    };
+    return parsed.flatMap(row => {
+        if (row.stat.startsWith("Z") || row.pid === holder.pid || row.pid === censusPid)
+            return [];
+        const group = safeGroups.has(row.group);
+        const capability = row.command.split(/\s+/).includes(token);
+        // Copied environment text outside the owned tree can conservatively block reclamation, but
+        // can never authorize signalling an unrelated process. Birth-checked groups survive reparenting.
+        return group || (capability && (!ownedOnly || descendant(row.pid))) ? [row.pid] : [];
+    });
+}
+const repositoryOwnership = new AsyncLocalStorage();
+export const repositoryLeaseEnvironment = (env) => {
+    const own = repositoryOwnership.getStore();
+    if (!own)
+        return { ...env };
+    const child = { ...env };
+    if (own.active)
+        child[REPOSITORY_LEASE_TOKEN_ENV] = own.holder.token;
+    else
+        delete child[REPOSITORY_LEASE_TOKEN_ENV];
+    return child;
+};
+/** Called synchronously at spawn, before any user callback, and only on an owned generation. */
+export function registerRepositoryChild(pid) {
+    const own = repositoryOwnership.getStore();
+    if (!own?.active || !own.holder.protectOrphans || pid === undefined)
+        return;
+    if (readHolder(own.path)?.token !== own.holder.token)
+        throw new Error("verification reservation superseded before child registration");
+    own.holder.roots = [...new Set([...(readHolder(own.path)?.roots ?? []), pid])];
+    const birth = processBirth(pid);
+    own.holder.rootBirths = { ...readHolder(own.path)?.rootBirths, ...(birth ? { [pid]: birth } : {}) };
+    const draft = `${own.path}.${own.holder.token}.${process.pid}.roots`;
+    try {
+        writeFileSync(draft, JSON.stringify(own.holder) + "\n");
+        renameSync(draft, own.path);
+    }
+    finally {
+        rmSync(draft, { force: true });
+    }
+}
+export const withFreshCommandLease = (command, run) => ownership.run({ token: "", active: false }, () => withCommandLease(command, run));
+const repositoryQueues = new Map();
+/** The standalone wrapper uses the same command-then-repository order when a scheduler exists.
+ * Without one (CLI/global setup), this remains exactly the outer file reservation API. */
+export function withRepositoryLease(cwd, run, opts = {}) {
+    return opts.isolated ? repositoryLease(cwd, run, opts)
+        : withCommandLease("vitest run", () => repositoryLease(cwd, run, opts));
+}
+export const hasRepositoryLeaseOwnership = () => repositoryOwnership.getStore()?.active === true;
+async function repositoryLease(cwd, run, opts) {
     const path = await repositoryLeasePath(cwd);
-    // A descendant of the live holder runs inside its ancestor's reservation and releases nothing.
-    if (await reentrantHolder(path, opts.inherited ?? process.env[REPOSITORY_LEASE_TOKEN_ENV]))
-        return run();
+    const own = repositoryOwnership.getStore();
+    // Only the private async capability can reenter within this process. Environment text cannot.
+    if (!opts.independent && own?.active && own.path === path && readHolder(path)?.token === own.holder.token) {
+        opts.onAdmission?.(own.holder);
+        const value = await run();
+        opts.onRelease?.(); // this caller's span ends; the outer reservation stays owned
+        return value;
+    }
+    if (await reentrantHolder(path, opts.inherited ?? process.env[REPOSITORY_LEASE_TOKEN_ENV])) {
+        const holder = readHolder(path);
+        const inheritedOwner = { path, holder, active: true };
+        return repositoryOwnership.run(inheritedOwner, async () => {
+            opts.onAdmission?.(holder);
+            try {
+                const value = await run();
+                opts.onRelease?.();
+                return value;
+            }
+            finally {
+                inheritedOwner.active = false;
+            }
+        });
+    }
     const pollMs = opts.pollMs ?? 1_000;
-    const mine = { pid: process.pid, cwd, at: Date.now(), token: randomUUID() };
+    const mine = { pid: process.pid, cwd, at: Date.now(), token: randomUUID(),
+        ...(opts.protectOrphans !== false ? { protectOrphans: true, roots: [], identity: ownerIdentity() } : {}) };
+    const queue = repositoryQueues.get(path) ?? new Set();
+    repositoryQueues.set(path, queue);
+    const ticket = Symbol("repository job");
+    queue.add(ticket);
     let waitingOn;
-    for (;;) {
-        opts.signal?.throwIfAborted();
-        const attempt = await withMutationLock(path, pollMs, opts.signal, () => inspectAndReserve(path, mine));
-        if (attempt.acquired)
-            break;
-        if (attempt.holder && attempt.holder.pid !== waitingOn) {
-            waitingOn = attempt.holder.pid;
-            opts.onWait?.(attempt.holder);
+    const waitOn = (holder) => {
+        if (holder && holder.token !== waitingOn) {
+            waitingOn = holder.token;
+            opts.onWait?.(holder);
         }
-        await new Promise((wake) => setTimeout(wake, pollMs));
-    }
-    // Exported before run() so every descendant forked or spawned during the hold can reenter; restored
-    // at release unless another reservation in this process has since exported its own.
-    const exported = process.env[REPOSITORY_LEASE_TOKEN_ENV];
-    process.env[REPOSITORY_LEASE_TOKEN_ENV] = mine.token;
+    };
     try {
-        return await run();
+        for (;;) {
+            opts.signal?.throwIfAborted();
+            if (queue.values().next().value === ticket) {
+                const attempt = await withMutationLock(path, pollMs, opts.signal, () => inspectAndReserve(path, mine));
+                if (attempt.acquired)
+                    break;
+                waitOn(attempt.holder);
+            }
+            else
+                waitOn(readHolder(path));
+            await new Promise(wake => setTimeout(wake, pollMs));
+        }
+        const exported = process.env[REPOSITORY_LEASE_TOKEN_ENV];
+        if (!opts.isolated)
+            process.env[REPOSITORY_LEASE_TOKEN_ENV] = mine.token;
+        const owner = { path, holder: mine, active: true };
+        try {
+            return await repositoryOwnership.run(owner, async () => {
+                opts.signal?.throwIfAborted();
+                opts.onAdmission?.(mine);
+                return run();
+            });
+        }
+        finally {
+            owner.active = false;
+            if (!opts.isolated && process.env[REPOSITORY_LEASE_TOKEN_ENV] === mine.token) {
+                if (exported === undefined)
+                    delete process.env[REPOSITORY_LEASE_TOKEN_ENV];
+                else
+                    process.env[REPOSITORY_LEASE_TOKEN_ENV] = exported;
+            }
+            // All token-bound children, including escaped descendants, cease before release. Shell has
+            // already reaped its group; this closes the inherited-pipe/escaped-child boundary as well.
+            if (mine.protectOrphans)
+                await reapRepositoryChildren(mine, pollMs).catch(async (error) => {
+                    // A failed census or reap deadline must not leave a settled job naming a live owner
+                    // forever. Retain the exact generation and its roots for the orphan rule: admission
+                    // still requires a successful census proving the protected tree has ceased.
+                    await withMutationLock(path, pollMs, undefined, () => {
+                        const holder = readHolder(path);
+                        if (holder?.token !== mine.token)
+                            return;
+                        const draft = `${path}.${mine.token}.${process.pid}.released`;
+                        try {
+                            writeFileSync(draft, JSON.stringify({ ...holder, ownerReleased: true }) + "\n");
+                            renameSync(draft, path);
+                        }
+                        finally {
+                            rmSync(draft, { force: true });
+                        }
+                    });
+                    throw error;
+                });
+            await withMutationLock(path, pollMs, undefined, () => {
+                if (readHolder(path)?.token === mine.token)
+                    unlinkSync(path);
+            });
+            opts.onRelease?.();
+        }
     }
     finally {
-        if (process.env[REPOSITORY_LEASE_TOKEN_ENV] === mine.token) {
-            if (exported === undefined)
-                delete process.env[REPOSITORY_LEASE_TOKEN_ENV];
-            else
-                process.env[REPOSITORY_LEASE_TOKEN_ENV] = exported;
+        queue.delete(ticket);
+        if (!queue.size)
+            repositoryQueues.delete(path);
+        // A waiter removes no repository generation, including cancellation before acquisition.
+    }
+}
+function processBirth(pid) {
+    try {
+        if (process.platform === "linux") {
+            const stat = readFileSync(`/proc/${pid}/stat`, "utf8");
+            return stat.slice(stat.lastIndexOf(")") + 2).split(/\s+/)[19];
         }
-        // Release is serialized with reclamation/acquisition and removes only this generation.
-        await withMutationLock(path, pollMs, undefined, () => {
-            if (readHolder(path)?.token === mine.token)
-                unlinkSync(path);
-        });
+        return execFileSync("ps", ["-p", String(pid), "-o", "lstart="], { encoding: "utf8", timeout: 15_000, stdio: ["ignore", "pipe", "ignore"] }).trim() || undefined;
     }
+    catch {
+        return undefined;
+    }
+}
+function ownerIdentity() {
+    const birth = processBirth(process.pid);
+    // Match git.ts's independent identity format without changing recorded raw root births.
+    return birth ? `${process.pid}:${canonicalBirth(birth)}` : undefined;
+}
+const canonicalBirth = (birth) => birth.trim().replace(/\s+/g, " ");
+const sameProcessBirth = (actual, expected) => actual !== undefined && expected !== undefined && canonicalBirth(actual) === canonicalBirth(expected);
+export async function reapRepositoryChildren(holder, pollMs, tokenEnv = REPOSITORY_LEASE_TOKEN_ENV) {
+    const deadline = Date.now() + 15_000;
+    for (const pid of await protectedProcesses(holder, tokenEnv, true)) {
+        try {
+            process.kill(pid, "SIGKILL");
+        }
+        catch (error) {
+            if (!isCode(error, "ESRCH"))
+                throw error;
+        }
+    }
+    while ((await protectedProcesses(holder, tokenEnv)).length) {
+        if (Date.now() >= deadline)
+            throw new Error("verification children did not cease; reservation retained");
+        await new Promise(wake => setTimeout(wake, pollMs));
+    }
+}
+function holderAlive(holder) {
+    if (holder.ownerReleased === true)
+        return false;
+    if (!alive(holder.pid))
+        return false;
+    if (!holder.identity)
+        return true; // legacy live holder remains protected
+    const birth = processBirth(holder.pid);
+    // Older live generations may contain ps's space-padded day. Formatting cannot prove owner death.
+    return birth === undefined || sameProcessBirth(`${holder.pid}:${birth}`, holder.identity);
 }

package/dist/run/merge.js

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { shq } from "../adapters/types.js";
-import { beginGateEvidence, ceilingKillResult, classifyFreshRunnerOutput, classifyRunnerOutput, fileCountDeficit, waitForCalmWindow, effectiveCeilingMs, fingerprint, freshFailures, } from "../gates/baseline.js";
+import { beginGateEvidence, ceilingKillResult, classifyFreshRunnerOutput, classifyRunnerOutput, fileCountDeficit, waitForCalmWindow, effectiveCeilingMs, classifiedFileDurations, fingerprint, freshFailures, } from "../gates/baseline.js";
 import { evaluateManifestedTest, isVitestTestCommand } from "../gates/test-manifest.js";
 import { computeVerificationIdentity, formatReusedDetails, getVerdictStore, getWorktreeTree, resolveStateDir, isInfraResult, } from "../gates/cache.js";
 import { tickmarkrDir } from "../graph/graph.js";
@@ -248,7 +248,7 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline, ev
             const manifestedEvidence = { ...evidenceSetup, artifactDir: evidence.root };
             evidenceRoots.set(gate, evidence.root);
             const outcome = await evaluateManifestedTest(cmd, intWt, {
-                baselineDurations: entry?.fileDurations,
+                baselineDurations: classifiedFileDurations(entry),
                 longestFile: entry?.longestFile,
                 overallCeilingMs: effectiveCeilingMs(entry),
                 artifactDir: runDir,

package/dist/run/stall.js

@@ -286,7 +286,26 @@ async function reapWorkerProcesses(group, cwd, ownership) {
             // OBS-1173 add.2: a FAILED recheck (null) is unknown too — it never reads as gone.
             if (!details) {
                 const recheck = await workerReapHost.identity(row.pid);
-                return recheck === row.identity || recheck === null ? "unknown" : "spared";
+                if (recheck === null)
+                    return "unknown";
+                if (recheck !== row.identity)
+                    return "spared";
+                // An exiting child loses its cwd before it is reaped yet keeps its birth identity (a zombie, or
+                // on its way to one). The snapshot drops Z rows, so a fresh snapshot that no longer lists this
+                // pid and identity says it has finished; a still-listed live row with no readable cwd stays
+                // unknown, and so does an unreadable snapshot (public CI 37302193795, D-1263). A process still
+                // exiting can stay listed for a moment after its cwd is gone, so read up to three fresh
+                // snapshots 100 ms apart before calling it unknown (public CI 37324617042, D-1278).
+                for (let read = 0; read < 3; read++) {
+                    if (read)
+                        await new Promise((resolve) => setTimeout(resolve, 100));
+                    const fresh = await workerReapHost.snapshot();
+                    if (!fresh)
+                        return "unknown";
+                    if (!fresh.some((r) => r.pid === row.pid && r.identity === row.identity))
+                        return "spared";
+                }
+                return "unknown";
             }
             if (details.suiteParent === process.pid || excludedPaths.some((path) => below(path, details.cwd)))
                 return "spared";

package/dist/run/supervision.d.ts

@@ -13,6 +13,11 @@ export type SupervisionTier = (typeof SUPERVISION_TIERS)[number];
  * to create fresh state there or to wander into an enclosing repository. This function is read-only.
  */
 export declare function resolveSupervisionRoot(cwd: string): string;
+/** Read-only twin for readers: a repository without a state dir is a root with no state, not a refusal. */
+export declare function locateSupervisionRoot(cwd: string): {
+    root: string;
+    state: boolean;
+};
 export declare const SUPERVISION_SEAT_TIERS: readonly ["orchestrator", "orchestrator-context", "overseer", "overseer-context"];
 export type SeatTier = (typeof SUPERVISION_SEAT_TIERS)[number];
 /** Does this tier's record have to name the seat it speaks for? */
@@ -46,8 +51,11 @@ export interface SupervisionArm {
     markerFence: string;
 }
 export declare const supervisionArmPath: (repoRoot: string, tier: SupervisionTier) => string;
+/** The durable arm on disk, undefined when none; a torn or invalid arm throws rather than reading as none. */
+export declare function readSupervisionArm(repoRoot: string, tier: SupervisionTier): SupervisionArm | undefined;
 /** Explicit arming acknowledges the current marker without deleting it. */
 export declare function newSupervisionArm(repoRoot: string, tier: SupervisionTier, armId?: string, initial?: boolean): SupervisionArm;
+export declare function publishStandDown(repoRoot: string, tier: SupervisionTier, seat: string): void;
 export declare const supervisionPresencePath: (repoRoot: string, tier: SupervisionTier, id: string) => string;
 export declare function beatSupervision(repoRoot: string, tier: SupervisionTier, seat?: string, observation?: SupervisionBeatObservation, options?: {
     arm?: SupervisionArm;

package/dist/run/supervision.js

@@ -56,13 +56,19 @@ const pathKind = (path) => {
  * to create fresh state there or to wander into an enclosing repository. This function is read-only.
  */
 export function resolveSupervisionRoot(cwd) {
+    const { root, state } = locateSupervisionRoot(cwd);
+    if (!state)
+        throw new Error(`missing ${stateDirName(root)}/ state dir at repository root ${root}`);
+    return root;
+}
+/** Read-only twin for readers: a repository without a state dir is a root with no state, not a refusal. */
+export function locateSupervisionRoot(cwd) {
     let current = resolve(cwd);
     for (;;) {
         if (pathKind(join(current, stateDirName(current))) === "directory")
-            return current;
-        if (pathKind(join(current, ".git")) !== "absent") {
-            throw new Error(`missing ${stateDirName(current)}/ state dir at repository root ${current}`);
-        }
+            return { root: current, state: true };
+        if (pathKind(join(current, ".git")) !== "absent")
+            return { root: current, state: false };
         const parent = dirname(current);
         if (parent === current) {
             throw new Error(`missing ${stateDirName(current)}/ state dir — no tickmarkr repository found from ${resolve(cwd)}`);
@@ -87,6 +93,10 @@ export const supervisionBeatPath = (repoRoot, tier) => join(supervisionDir(repoR
 /** Where a watcher records that it STOOD DOWN. Its own file: the beat keeps meaning only "alive". */
 export const supervisionStandDownPath = (repoRoot, tier) => join(supervisionDir(repoRoot), `${tier}.standdown`);
 export const supervisionArmPath = (repoRoot, tier) => join(supervisionDir(repoRoot), `${tier}.arm`);
+/** The durable arm on disk, undefined when none; a torn or invalid arm throws rather than reading as none. */
+export function readSupervisionArm(repoRoot, tier) {
+    return readArm(repoRoot, tier);
+}
 function readArm(repoRoot, tier) {
     try {
         const arm = JSON.parse(readFileSync(supervisionArmPath(repoRoot, tier), "utf8"));
@@ -143,6 +153,16 @@ export function newSupervisionArm(repoRoot, tier, armId = randomUUID(), initial
     }
     return readArm(repoRoot, tier);
 }
+// Stand-down is a RECORDED act, not a silence: the marker tells a reader this watcher left on purpose,
+// so the tier reads DISARMED rather than ageing out as a death. Published atomically — written aside,
+// renamed over — because a torn marker is rejected by the reader, and a rejected stand-down reports a
+// deliberate hand-off as a death. The marker names the seat for the same reason the beat does.
+export function publishStandDown(repoRoot, tier, seat) {
+    tickmarkrDir(repoRoot); // the write path DOES create — markers land inside the gitignored state dir
+    atomicRecord(supervisionStandDownPath(repoRoot, tier), {
+        tier, seat, standDownId: randomUUID(), exitedWriterPid: process.pid, disarmedAt: new Date().toISOString(),
+    });
+}
 /** The independent latch a stand-down cannot overwrite or remove. */
 const supervisionObligationPath = (repoRoot, tier) => join(supervisionDir(repoRoot), `${tier}.clear-owed`);
 // SUP-06: PRESENCE — one file per ARMED WATCHER, because a tier may legitimately have more than one.

package/dist/run/verification-job.d.ts

@@ -0,0 +1,51 @@
+import type { ShellReceipt } from "./protocol.js";
+import type { GateEvidenceOptions } from "../gates/baseline.js";
+import { type RepositoryLeaseHolder } from "./lease.js";
+export interface VerificationPhase {
+    phase: "discovery" | "first-pass" | "continuation-discovery" | "continuation";
+    nonce: string;
+    reportPath: string;
+    parentNonce?: string;
+    startedAt?: number;
+    endedAt?: number;
+    pid?: number;
+    outcome?: ShellReceipt["outcome"];
+    state: "pending" | "running" | "completed" | "cancelled" | "failed";
+}
+export interface VerificationJobReport {
+    version: 1;
+    id: string;
+    command: string;
+    cwd: string;
+    subject: {
+        commit: string | null;
+        runId: string;
+        taskId: string | null;
+        attempt: number | null;
+    };
+    scope: string;
+    reason: string;
+    queuedAt: number;
+    repositoryAdmittedAt?: number;
+    admittedAt?: number;
+    reapedAt?: number;
+    repositoryReleasedAt?: number;
+    releasedAt?: number;
+    reservationReused?: boolean;
+    reservation?: RepositoryLeaseHolder;
+    waitingOn?: RepositoryLeaseHolder;
+    state: "queued" | "running" | "completed" | "failed" | "cancelled";
+    phases: VerificationPhase[];
+}
+export declare const VERIFICATION_JOB_TOKEN_ENV = "TICKMARKR_VERIFICATION_JOB_TOKEN";
+export declare function verificationJobEnvironment(env: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+export declare const setVerificationJobClockForTests: (now: () => number) => void;
+export declare const resetVerificationJobClockForTests: () => void;
+export declare function observeVerificationSpawn(pid: number | undefined): void;
+export declare function observeVerificationReceipt(receipt: ShellReceipt): void;
+export declare function verificationPhase<T>(phase: VerificationPhase["phase"], nonce: string, reportPath: string, run: () => Promise<T>, parentNonce?: string): Promise<T>;
+export declare function withVerificationJob<T extends {
+    pass: boolean;
+    meta: Record<string, unknown>;
+    reportPath?: string;
+}>(command: string, cwd: string, reportPath: string, evidence: GateEvidenceOptions | undefined, run: () => Promise<T>): Promise<T>;

package/dist/run/verification-job.js

@@ -0,0 +1,137 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import { execFileSync } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import { renameSync, rmSync, writeFileSync } from "node:fs";
+import { assertGitTrust, protectedGitEnv } from "./git-trust.js";
+import { executionSignal } from "./execution-budget.js";
+import { hasRepositoryLeaseOwnership, REPOSITORY_LEASE_TOKEN_ENV, reentrantHolder, repositoryLeasePath, reapRepositoryChildren, withCommandLease, withFreshCommandLease, withRepositoryLease } from "./lease.js";
+const jobs = new AsyncLocalStorage();
+export const VERIFICATION_JOB_TOKEN_ENV = "TICKMARKR_VERIFICATION_JOB_TOKEN";
+export function verificationJobEnvironment(env) {
+    const job = jobs.getStore();
+    return job ? { ...env, [VERIFICATION_JOB_TOKEN_ENV]: job.report.id } : { ...env };
+}
+let clock = () => Date.now();
+export const setVerificationJobClockForTests = (now) => { clock = now; };
+export const resetVerificationJobClockForTests = () => { clock = () => Date.now(); };
+export function observeVerificationSpawn(pid) {
+    const job = jobs.getStore();
+    if (!job?.phase)
+        return;
+    job.phase.startedAt ??= clock();
+    job.phase.pid = pid;
+    job.phase.state = "running";
+    job.persist();
+}
+export function observeVerificationReceipt(receipt) {
+    const job = jobs.getStore();
+    if (!job?.phase)
+        return;
+    job.phase.outcome = receipt.outcome;
+    job.persist();
+}
+export async function verificationPhase(phase, nonce, reportPath, run, parentNonce) {
+    const job = jobs.getStore();
+    if (!job)
+        return run();
+    const span = { phase, nonce, reportPath, state: "pending", ...(parentNonce ? { parentNonce } : {}) };
+    job.report.phases.push(span);
+    job.phase = span;
+    job.persist();
+    try {
+        const value = await run();
+        span.state = executionSignalSafely()?.aborted || span.outcome === "cancelled" ? "cancelled" : span.outcome === "timed-out" || span.outcome === "spawn-failed" ? "failed" : "completed";
+        return value;
+    }
+    catch (error) {
+        span.state = executionSignalSafely()?.aborted ? "cancelled" : "failed";
+        throw error;
+    }
+    finally {
+        span.endedAt = clock();
+        job.phase = undefined;
+        job.persist();
+    }
+}
+// executionSignal() checks the budget and can throw during cleanup; the initial signal is retained.
+const signals = new AsyncLocalStorage();
+const executionSignalSafely = () => signals.getStore();
+export async function withVerificationJob(command, cwd, reportPath, evidence, run) {
+    const signal = executionSignal();
+    let commit = evidence?.subjectCommit ?? null;
+    if (!commit) {
+        try {
+            assertGitTrust(cwd);
+            commit = execFileSync("git", ["rev-parse", "HEAD"], { cwd, env: protectedGitEnv(process.env), encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+        }
+        catch { /* unknown remains explicit */ }
+    }
+    const report = { version: 1, id: randomUUID(), command, cwd,
+        subject: { commit, runId: evidence?.runId ?? "standalone", taskId: evidence?.taskId ?? null, attempt: evidence?.attempt ?? null },
+        scope: command, reason: "manifest verification", queuedAt: clock(), state: "queued", phases: [] };
+    const path = `${reportPath}.job.json`;
+    const job = { report, path, persist: () => {
+            // Timing persistence is observational, just like gate receipts; failure cannot change proof.
+            const draft = `${path}.${report.id}.draft`;
+            try {
+                writeFileSync(draft, JSON.stringify(report, null, 2) + "\n");
+                renameSync(draft, path);
+            }
+            catch { /* report proof remains authoritative */ }
+            finally {
+                try {
+                    rmSync(draft, { force: true });
+                }
+                catch { /* observational */ }
+            }
+        } };
+    job.persist();
+    let outcome;
+    try {
+        report.reservationReused = hasRepositoryLeaseOwnership() && !jobs.getStore();
+        // A process descendant may share its ancestor's scheduler capability only after the file
+        // generation and strict ancestry have been verified. A same-pid sibling always queues fresh.
+        const inherited = !hasRepositoryLeaseOwnership()
+            && await reentrantHolder(await repositoryLeasePath(cwd), process.env[REPOSITORY_LEASE_TOKEN_ENV]);
+        const reserveCommand = report.reservationReused || inherited ? withCommandLease : withFreshCommandLease;
+        outcome = await reserveCommand(command, () => withRepositoryLease(cwd, () => {
+            signal?.throwIfAborted();
+            report.admittedAt = clock();
+            report.state = "running";
+            job.persist();
+            return signals.run(signal, () => jobs.run(job, async () => {
+                try {
+                    return await run();
+                }
+                finally {
+                    await reapRepositoryChildren({ pid: process.pid, cwd, at: report.queuedAt, token: report.id }, 20, VERIFICATION_JOB_TOKEN_ENV);
+                    report.reapedAt = clock();
+                    job.persist();
+                }
+            }));
+        }, { isolated: true, protectOrphans: true, independent: !!jobs.getStore(), signal, pollMs: 20,
+            onWait: holder => { report.waitingOn = { ...holder }; job.persist(); },
+            onAdmission: holder => { report.repositoryAdmittedAt = clock(); report.reservation = { ...holder }; job.persist(); },
+            onRelease: () => { report.reapedAt ??= clock(); report.repositoryReleasedAt = clock(); job.persist(); } }));
+        report.releasedAt = clock();
+        report.state = signal?.aborted ? "cancelled" : outcome.pass ? "completed" : "failed";
+        outcome.meta = { ...outcome.meta, verificationJobPath: path, verificationJob: report };
+        // Existing tip callers retain only reportPath: its sidecar is the additive producer envelope.
+        if (outcome.reportPath && `${outcome.reportPath}.job.json` !== path) {
+            try {
+                writeFileSync(`${outcome.reportPath}.job.json`, JSON.stringify(report, null, 2) + "\n");
+            }
+            catch { /* observational */ }
+        }
+        return outcome;
+    }
+    catch (error) {
+        if (report.repositoryReleasedAt !== undefined)
+            report.releasedAt = clock();
+        report.state = signal?.aborted ? "cancelled" : "failed";
+        throw Object.assign(error instanceof Error ? error : new Error(String(error)), { verificationJobPath: path, verificationJob: report });
+    }
+    finally {
+        job.persist();
+    }
+}

package/dist/tui/ink/fleet-app.d.ts

@@ -95,6 +95,13 @@ export type FleetStagedDeny = Record<StagedDenyKey, string[]> & {
 };
 /** every scope's staged list, empty — the "every policy scope open" probe the picker lifts against */
 export declare const openStagedDeny: () => FleetStagedDeny;
+/** T5: one real channel a displayed row stands for — a collapsed variant or catalog-fold constituent doctor
+ * served, with its own recorded identity and failed-probe reason */
+export type FleetGroupMember = {
+    model: string;
+    identity?: string;
+    unauthed?: string;
+};
 export type FleetModelGroup = {
     adapter: string;
     vendor?: string;
@@ -109,6 +116,8 @@ export type FleetModelGroup = {
         classifyModel?: string;
         variants?: string[];
         foldedModels?: string[];
+        /** T5: every real member of a grouped row; absent ⇒ the row's own model is its one member */
+        members?: FleetGroupMember[];
         score?: number;
     }>;
 };