tickmarkr 2.7.1 → 2.7.3

package/dist/gates/baseline.js

@@ -7,7 +7,7 @@ import { basename, join } from "node:path";
 import { DEFAULT_EVIDENCE_QUOTA_BYTES } from "../config/config.js";
 import { dependencyLinkRefusal, DEFAULT_SHELL_TIMEOUT_MS, describeCapacity, sameCapacity, sh } from "../run/git.js";
 import { executionSignal } from "../run/execution-budget.js";
-import { isVitestTestCommand, manifestFileCount } from "./test-manifest.js";
+import { isVitestTestCommand, manifestChildEnv, manifestFileCount } from "./test-manifest.js";
 export const EVIDENCE_TAIL_BYTES = 16 * 1024;
 /** The default per-run quota; `gates.evidenceQuotaBytes` in config overrides it (OBS-1140). */
 export const EVIDENCE_RUN_QUOTA_BYTES = DEFAULT_EVIDENCE_QUOTA_BYTES;
@@ -726,7 +726,11 @@ export async function captureBaseline(cwd, commands, opts = {}) {
             continue;
         }
         const evidence = beginGateEvidence(cwd, name, cmd, opts.evidence);
-        const r = await sh(cmd, cwd, CAPTURE_CEILING_MS, { env: opts.evidence?.env, onReceipt: receipt => { evidence.observe(receipt); opts.onReceipt?.(receipt); } });
+        // Queue row 104 (D-1644): a manifested test command is captured under the test gate's own runner environment
+        // (node_modules/.bin first), so a bare repo-local runner resolves here exactly as it does in the gate — built on the
+        // caller's own evidence environment when it supplies one (D-1659), never in place of it.
+        const env = (name === "test" || name === "tipTest") && isVitestTestCommand(cmd, cwd) ? manifestChildEnv(cwd, opts.evidence?.env) : opts.evidence?.env;
+        const r = await sh(cmd, cwd, CAPTURE_CEILING_MS, { env, onReceipt: receipt => { evidence.observe(receipt); opts.onReceipt?.(receipt); } });
         (base.evidenceReceipts ??= {})[name] = evidence.finish(r.stdout, r.stderr);
         // ponytail: strip the executing cwd so repo-root capture and worktree compare fingerprint identically; /private-vs-/tmp symlink variance is out of scope
         // ponytail: a capture that was itself killed records the ceiling as its "measurement", which

package/dist/gates/run-gates.js

@@ -15,11 +15,11 @@ import { disallowedBy, observedSeat } from "../route/preference.js";
 import { marginalCostRank } from "../route/router.js";
 import { carriedAuthorVendors, gateReviewerFloor, pickReviewer, reviewGate } from "./review.js";
 import { scopeGate } from "./scope.js";
-import { discoverTestManifest, evaluateManifestedTest, isVitestTestCommand, VITEST_CACHE_ENV, worktreeVitestCache } from "./test-manifest.js";
+import { discoverTestManifest, evaluateManifestedTest, isVitestTestCommand, manifestChildEnv } from "./test-manifest.js";
 import { RUNNER_INFRA_DIAGNOSTIC_RE, timeoutShaped } from "./timeout-shaped.js";
 import { executionSignal } from "../run/execution-budget.js";
 import { failureDisposition } from "../run/recovery.js";
-import { dependencyLinkRefusal, FORK_CAP_ENV, preserveWorktree, producerFields, readCapacity, ROUTING_ENV_SEAMS, shGit, resolvedCapacity, sameCapacity, SUITE_PARENT_ENV, verificationProtocol } from "../run/git.js";
+import { dependencyLinkRefusal, preserveWorktree, producerFields, readCapacity, shGit, resolvedCapacity, sameCapacity, verificationProtocol } from "../run/git.js";
 import { withJudgeInvocationEvidence } from "../run/journal.js";
 import { computeVerificationIdentity, verificationIdentityKey, formatReusedRow, getVerdictStore, isInfraResult, resolveStateDir, reusedIdentity, } from "./cache.js";
 const productionLoadProvider = () => loadavg()[0] ?? 0;
@@ -285,11 +285,7 @@ export function diagnosticAdmission(baseline, selected) {
  * discovery receives (test-manifest.ts manifestEnvironment), so it compares with the one a verdict
  * certified. Undefined when the runner cannot list — an unlisted manifest certifies nothing. */
 async function listFullManifest(cmd, worktree) {
-    const env = { ...process.env, PATH: `${join(worktree, "node_modules/.bin")}:${process.env.PATH ?? ""}`,
-        [VITEST_CACHE_ENV]: worktreeVitestCache(worktree),
-        [FORK_CAP_ENV]: String(resolvedCapacity().forkCap), [SUITE_PARENT_ENV]: String(process.pid) };
-    for (const key of [...ROUTING_ENV_SEAMS, "VITEST", "TEST", "VITEST_WORKER_ID", "VITEST_POOL_ID"])
-        delete env[key];
+    const env = manifestChildEnv(worktree);
     const dir = mkdtempSync(join(tmpdir(), "tickmarkr-full-manifest-"));
     try {
         return (await discoverTestManifest(cmd, worktree, { dir, nonce: randomUUID(), env })).files;

package/dist/gates/test-manifest.d.ts

@@ -206,6 +206,9 @@ export interface ManifestGateOutcome {
     exitCode: number;
     reportPath: string;
 }
+/** Queue row 104 (D-1644): THE child environment of a manifested test command — its listing and run here, the full
+ * manifest re-listing (run-gates.ts) and its baseline capture (baseline.ts) — so every one resolves the same runner. */
+export declare function manifestChildEnv(cwd: string, base?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
 export interface DiscoveredManifest {
     files: string[];
     listing: string;

package/dist/gates/test-manifest.js

@@ -504,17 +504,22 @@ export function runManifestedTest(cmd, cwd, opts) {
  * `npm_config_ignore_scripts` from the environment over every npmrc); the verdict records it so a
  * verdict measured with `pretest` hooks is never compared to one without. */
 function manifestEnvironment(cwd) {
-    const env = { ...process.env, PATH: `${join(cwd, "node_modules/.bin")}:${process.env.PATH ?? ""}`,
+    const env = manifestBaseEnv(cwd);
+    return { env: scrubbedManifestEnv(env), verification: verificationProtocol(env, cwd) };
+}
+function manifestBaseEnv(cwd, base = process.env) {
+    return { ...base, PATH: `${join(cwd, "node_modules/.bin")}:${base.PATH ?? ""}`,
         [VITEST_CACHE_ENV]: worktreeVitestCache(cwd),
         [FORK_CAP_ENV]: String(resolvedCapacity().forkCap), [SUITE_PARENT_ENV]: String(process.pid) };
-    const verification = verificationProtocol(env, cwd);
-    for (const key of ROUTING_ENV_SEAMS)
-        delete env[key];
-    // A gate can itself be tested under Vitest. Do not give the child the outer worker identity.
-    for (const key of Object.keys(env))
-        if (["VITEST", "TEST", "VITEST_WORKER_ID", "VITEST_POOL_ID"].includes(key))
-            delete env[key];
-    return { env, verification };
+}
+// A gate can itself be tested under Vitest. Do not give the child the outer worker identity.
+const OUTER_RUNNER_KEYS = new Set([...ROUTING_ENV_SEAMS, "VITEST", "TEST", "VITEST_WORKER_ID", "VITEST_POOL_ID"]);
+const scrubbedManifestEnv = (env) => Object.fromEntries(Object.entries(env).filter(([key]) => !OUTER_RUNNER_KEYS.has(key)));
+/** Queue row 104 (D-1644): THE child environment of a manifested test command — its listing and run here, the full
+ * manifest re-listing (run-gates.ts) and its baseline capture (baseline.ts) — so every one resolves the same runner. */
+export function manifestChildEnv(cwd, base) {
+    // built on `base` when a caller supplies its own environment (captureBaseline's evidence env), else on process.env
+    return scrubbedManifestEnv(manifestBaseEnv(cwd, base));
 }
 /** OBS-1044: THE discovery seam — the files the runner would collect under this exact invocation,
  * from its own listing and never from a stdout summary. The gate and the baseline capture share it,

package/dist/run/daemon.d.ts

@@ -4,7 +4,7 @@ import { type DriverChoice } from "../drivers/index.js";
 import { type ExecutorDriver, type Slot } from "../drivers/types.js";
 import { type Baseline, type BaselineProvenance, type GateEvidenceOptions } from "../gates/baseline.js";
 import type { GateResult } from "../gates/types.js";
-import { type RunGraph } from "../graph/schema.js";
+import { type RunGraph, type Task } from "../graph/schema.js";
 import { type PreserveProducer } from "./git.js";
 import { Journal, type JournalEvent } from "./journal.js";
 export declare function closeLiveSlot(liveSlots: Set<Slot>, driver: Pick<ExecutorDriver, "close">, slot: Slot): Promise<void>;
@@ -144,6 +144,19 @@ export declare const gateSatisfied: (g: GateResult) => boolean;
  * preference (ranked last, never excluded) — every review-pool-demotion except the launch-caused ones, which
  * never demote a seat (live or replayed). plan.ts previews a resume with this same fold. */
 export declare function replayedReviewerDemotions(events: readonly JournalEvent[]): Set<string>;
+/** C: a journaled test red whose failing-file attribution is nonempty, trustworthy and complete (repair
+ * selection's own rule: a behavioral red on a real subject from a full suite or a screen that names
+ * every failure), POSITIVELY certified complete by its runner, uncontradicted by the files its own text
+ * names, and wholly outside a declared files[]. Empty files[] is unrestricted and never qualifies;
+ * every other shape keeps its replay. */
+export declare function outsideScopeRed(t: Task, taskId: string, data: Record<string, unknown>, commit: string): boolean;
+/** OBS-1106 residual, D-607: what ONE isolated rerun of a timeout-shaped red's attributed `files` says about that
+ * red. Lifted unchanged out of adjudicateInfraShapedRed (queue row 102) so its closed outcome table runs on this
+ * function in-process. Pure: it reads only its arguments; the caller classifies the rerun first. */
+export declare function reobservationOutcome(files: readonly string[], rerun: GateResult): {
+    outcome: "reproduced" | "passed" | "ambiguous";
+    selection: string[] | undefined;
+};
 /**
  * T4 (OBS-265): the journal with the review objections a round did NOT hinge on removed. Judge and
  * review are now launched together, so a round can journal a failed review that the serial walk would
@@ -250,6 +263,8 @@ export declare function verifyIntegrationTipCached(intWt: string, commands: Reco
     signal?: AbortSignal;
     evidence?: GateEvidenceOptions;
 }): Promise<boolean>;
+type WorkerProcessTree = "empty" | "running" | "unmeasurable";
+export declare function observeWorkerProcessTree(marker: string, cwd: string): Promise<WorkerProcessTree>;
 type SuitePidProbe = (pid: number) => number | undefined;
 /** Count full-suite roots in one process-table snapshot. The probes are arguments so the ownership
  * rules remain testable on hosts that forbid process inspection; production supplies cwd and the

package/dist/run/daemon.js

@@ -34,7 +34,7 @@ import { executionSignal, remainingExecutionMs, withExecutionBudget, withoutExec
 import { repairSelectionDecision, repairSelectionEnabled } from "./repair-selection.js";
 import { failureDisposition, reserveInfrastructureRetry } from "./recovery.js";
 import { runEnvironment } from "./environment.js";
-import { addDetachedWorktree, changeRepresented, cleanupRunWorktrees, deriveForkCap, FORK_CAP_ENV, gitHead, linkNodeModules, npmDependencyInstallCommand, npmDependencyManifestChanged, PRESERVE_COMMIT_SUBJECT, PRESERVE_PRODUCER_TRAILER, preserveWorktree, producerFields, removeWorktree, resolvedCapacity, runWithForkBudget, runWithVerificationBudget, sameCapacity, sameVerification, sh, shGit, SUITE_PARENT_ENV, verificationProtocol, WORKTREE_LAYOUT_CONTRACT, WORKTREES_DIR, worktreePath } from "./git.js";
+import { addDetachedWorktree, changeRepresented, cleanupRunWorktrees, deriveForkCap, FORK_CAP_ENV, gitHead, linkNodeModules, npmDependencyInstallCommand, npmDependencyManifestChanged, PRESERVE_COMMIT_SUBJECT, PRESERVE_PRODUCER_TRAILER, preserveWorktree, producerFields, removeWorktree, resolvedCapacity, runWithForkBudget, runWithVerificationBudget, sameCapacity, sameVerification, sh, shell, shGit, SUITE_PARENT_ENV, verificationProtocol, WORKTREE_LAYOUT_CONTRACT, WORKTREES_DIR, worktreePath } from "./git.js";
 import { MASK } from "./redact.js";
 import { runInteractiveSeed } from "./interactive-seed.js";
 import { classifyRepairDisposition, resolveScopeHints } from "./repair-disposition.js";
@@ -409,7 +409,7 @@ const RUNNER_CERTIFICATE_RE = /runner-level diagnostic: never-started ([^;\s]+);
  * every failure), POSITIVELY certified complete by its runner, uncontradicted by the files its own text
  * names, and wholly outside a declared files[]. Empty files[] is unrestricted and never qualifies;
  * every other shape keeps its replay. */
-function outsideScopeRed(t, taskId, data, commit) {
+export function outsideScopeRed(t, taskId, data, commit) {
     if (!t.files.length || data.gate !== "test" || data.pass !== false || data.skipped === true || data.commit !== commit
         // a failed producer — an infra row, a dirty-tree refusal, a recovery the runner could not finish —
         // never attributes anything, whatever files it lists
@@ -456,6 +456,21 @@ const observedSelection = (g) => {
 /** D-607: on the manifest path only the reporter's own attribution counts — a `FAIL path` line inside
  * captured stdout is text, not attribution. Headline lexing is for runners without a reporter. */
 const rerunFailingFiles = (g) => metaFiles(g.meta?.manifest) ? [...new Set(metaFiles(g.meta?.failingFiles) ?? [])].sort() : attributedFailingFiles(g);
+/** OBS-1106 residual, D-607: what ONE isolated rerun of a timeout-shaped red's attributed `files` says about that
+ * red. Lifted unchanged out of adjudicateInfraShapedRed (queue row 102) so its closed outcome table runs on this
+ * function in-process. Pure: it reads only its arguments; the caller classifies the rerun first. */
+export function reobservationOutcome(files, rerun) {
+    // Reproduced only by failure evidence the rerun ATTRIBUTES to one of exactly these files, from an
+    // OBSERVED selection that was exactly these files (D-607): a path merely printed in output, a
+    // positional filter that also collected another file, or a runner that ignored the file
+    // arguments and reported no manifest of its selection, says nothing about the original red.
+    const failing = rerunFailingFiles(rerun);
+    const selection = observedSelection(rerun);
+    const isolated = selection !== undefined && selection.length === files.length
+        && files.every((file) => selection.includes(file)) && failing.every((file) => files.includes(file));
+    const outcome = rerun.pass ? "passed" : isolated && !isInfraResult(rerun) && failing.length ? "reproduced" : "ambiguous";
+    return { outcome, selection };
+}
 // v1.85 T3: the gates whose failure IS a deterministic measurement — a machine re-ran a command over a
 // tree and printed the same bytes. Those are the failures the fingerprint cap governs (the ruling names
 // it a "deterministic-gate" cap): a third identical answer to a question already answered twice is the
@@ -1222,8 +1237,9 @@ async function gateCommitSubject(base, head, wt) {
 // OBS-737 needs. A readable process table with no marker root is measured empty; a failed or empty
 // table is unmeasurable. Descendants are closed over PPID because not every child retains the
 // dispatch-script marker in its own argv.
-async function observeWorkerProcessTree(marker, cwd) {
-    const snapshot = await shGit("ps -Awwo pid=,ppid=,command=", cwd, 15_000);
+export async function observeWorkerProcessTree(marker, cwd) {
+    // queue row 113: `ps` is not git, so the payload entry — the own-git entry's pin probes are two SYNC git spawns per call
+    const snapshot = await shell("ps -Awwo pid=,ppid=,command=", cwd, 15_000);
     if (snapshot.code !== 0)
         return "unmeasurable";
     const rows = [];
@@ -1312,7 +1328,8 @@ export const resetLiveSuiteCountForTests = () => { liveSuiteCountForTests = unde
 export async function liveSuiteCount(repoRoot) {
     if (liveSuiteCountForTests)
         return liveSuiteCountForTests(repoRoot);
-    const snapshot = await shGit("ps -Aww -o pid=,ppid=,state=,command=", repoRoot, 15_000);
+    // queue row 113: `ps` is not git, so the payload entry — the own-git entry's pin probes are two SYNC git spawns per call
+    const snapshot = await shell("ps -Aww -o pid=,ppid=,state=,command=", repoRoot, 15_000);
     if (snapshot.code !== 0)
         return 0;
     // row 103: one batched async probe per snapshot — a synchronous lsof/ps per pid held this loop 44–46 s
@@ -3080,15 +3097,9 @@ export async function runDaemon(repoRoot, opts = {}) {
                             rerun = await withCommandContext(t.id, () => reobserveTestFiles(wt, commands.test, baseline, files, journal.dir))
                                 .catch((error) => ({ gate: "test", pass: false, details: `infra: rerun failed: ${error instanceof Error ? error.message : String(error)}`, meta: { infra: true } }));
                             classifyInfraResult(rerun);
-                            // Reproduced only by failure evidence the rerun ATTRIBUTES to one of exactly these files, from an
-                            // OBSERVED selection that was exactly these files (D-607): a path merely printed in output, a
-                            // positional filter that also collected another file, or a runner that ignored the file
-                            // arguments and reported no manifest of its selection, says nothing about the original red.
-                            const failing = rerunFailingFiles(rerun);
-                            selection = observedSelection(rerun);
-                            const isolated = selection !== undefined && selection.length === files.length
-                                && files.every((file) => selection.includes(file)) && failing.every((file) => files.includes(file));
-                            outcome = rerun.pass ? "passed" : isolated && !isInfraResult(rerun) && failing.length ? "reproduced" : "ambiguous";
+                            const judged = reobservationOutcome(files, rerun);
+                            outcome = judged.outcome;
+                            selection = judged.selection;
                         }
                         journal.append("gate-reobserved", t.id, {
                             gate: "test", attempt, commit: subject, fingerprint, ...(observation ? { observation } : {}), files, outcome,

package/dist/run/stall.js

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync, realpathSync } from "node:fs";
 import { execFile } from "node:child_process";
 import { isAbsolute, relative, sep } from "node:path";
-import { activeShellIdentities, processIdentity, resolveActiveShellIdentities, shGit, SUITE_PARENT_ENV } from "./git.js";
+import { activeShellIdentities, processIdentity, resolveActiveShellIdentities, shell, SUITE_PARENT_ENV } from "./git.js";
 // OBS-82: normalize known presentation tokens before measuring transcript extent or filtering an
 // LLM-bound transcript. This remains a closed allowlist — ANSI/VT escapes, braille-range spinner
 // glyphs, and elapsed-time tokens bound to time-unit suffixes. Every other byte passes through
@@ -71,7 +71,8 @@ export async function reapOwnedProcessGroup(group, cwd, ownership) {
         return reapWorkerProcesses(group, cwd, ownership);
     if (group === undefined)
         return null;
-    const own = await shGit(`ps -o pgid= -p ${process.pid}`, cwd, 5_000);
+    // queue row 113: `ps` is not git, so the payload entry — the own-git entry's pin probes are two SYNC git spawns per call
+    const own = await shell(`ps -o pgid= -p ${process.pid}`, cwd, 5_000);
     // An in-process driver fixture (or a non-isolating host) can share the daemon's
     // group. It is not an owned worker group: let the driver's close retire that slot.
     if (own.code !== 0 || !/^\d+$/.test(own.stdout.trim()) || Number(own.stdout.trim()) === group)
@@ -87,7 +88,7 @@ export async function reapOwnedProcessGroup(group, cwd, ownership) {
     // SIGKILL delivery and process retirement are asynchronous. Bound the confirmation
     // grace, retaining names if a process is still present after it.
     for (let probe = 0; probe < 5; probe++) {
-        const snapshot = await shGit("ps -Awwo pid=,pgid=,stat=", cwd, 5_000);
+        const snapshot = await shell("ps -Awwo pid=,pgid=,stat=", cwd, 5_000);
         if (snapshot.code !== 0)
             return null;
         survivors = snapshot.stdout.split("\n").flatMap((line) => {
@@ -377,9 +378,9 @@ let linuxClockTickMs;
 function linuxProcessCpuMs(pid, cwd) {
     if (!existsSync("/proc/self/stat"))
         return Promise.resolve(undefined);
-    // shGit, not sh: the accountant samples at 100ms cadence and must not run the operator's login
-    // profile (nvm/pyenv/direnv side effects included) on every sample.
-    linuxClockTickMs ??= shGit("getconf CLK_TCK", cwd, 15_000).then((r) => {
+    // shell (login false), not sh: the accountant samples at 100ms cadence and must not run the operator's login
+    // profile (nvm/pyenv/direnv side effects included). Not shGit either: getconf is not git (queue row 113).
+    linuxClockTickMs ??= shell("getconf CLK_TCK", cwd, 15_000).then((r) => {
         const ticks = r.code === 0 ? Number(r.stdout.trim()) : Number.NaN;
         return Number.isFinite(ticks) && ticks > 0 ? 1_000 / ticks : undefined;
     });
@@ -403,12 +404,21 @@ function linuxProcessCpuMs(pid, cwd) {
 // finds that root and its descendants. An empty tree is measurable zero; a failed or unparseable
 // snapshot is undefined because missing evidence can never prove inactivity.
 async function workerTreeCpuSnapshot(marker, cwd, group, identities) {
-    const snapshot = await shGit("ps -Awwo pid=,ppid=,time=,command=", cwd, 15_000);
+    // queue row 113: `ps` is not git, so the payload entry — the own-git entry's pin probes are two SYNC git spawns per call
+    // ONE snapshot carries the group column too (it was a second `ps -Awwo pid=,pgid=` per sample).
+    const snapshot = await shell("ps -Awwo pid=,ppid=,pgid=,time=,command=", cwd, 15_000);
     if (snapshot.code !== 0)
         return undefined;
     const rows = [];
+    const grouped = [];
     for (const line of snapshot.stdout.split("\n")) {
-        const m = /^\s*(\d+)\s+(\d+)\s+(\S+)\s+(.*)$/.exec(line);
+        // Group membership reads EVERY row, as the separate group snapshot did; a CPU row also needs a parseable time.
+        const ids = /^\s*(\d+)\s+(\d+)\s+(\d+)(?:\s|$)/.exec(line);
+        if (!ids)
+            continue;
+        if (group !== undefined && Number(ids[3]) === group)
+            grouped.push(ids[1]);
+        const m = /^\s*(\d+)\s+(\d+)\s+\d+\s+(\S+)\s+(.*)$/.exec(line);
         if (!m)
             continue;
         const cpu = parsePsCpu(m[3]);
@@ -420,16 +430,8 @@ async function workerTreeCpuSnapshot(marker, cwd, group, identities) {
     const tree = new Set(rows.filter((p) => p.cmd.includes(marker)).map((p) => p.pid));
     // CPU presentation matching is intentionally broader than authority to signal a process.
     const owned = new Set(rows.filter((p) => p.cmd === `bash ${marker}` || p.cmd === `/bin/bash ${marker}`).map((p) => p.pid));
-    if (group !== undefined) {
-        const groups = await shGit("ps -Awwo pid=,pgid=", cwd, 15_000);
-        if (groups.code !== 0)
-            return undefined;
-        for (const line of groups.stdout.split("\n")) {
-            const row = /^\s*(\d+)\s+(\d+)\s*$/.exec(line);
-            if (row && Number(row[2]) === group)
-                tree.add(row[1]);
-        }
-    }
+    for (const pid of grouped)
+        tree.add(pid);
     // ps output is not topologically ordered; relax the parent -> child closure until stable.
     for (let grew = true; grew;) {
         grew = false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.7.1",
+  "version": "2.7.3",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",