tickmarkr 2.7.9 → 2.8.1

package/dist/gates/run-gates.js

@@ -7,7 +7,7 @@ import { TIER_RANK } from "../config/config.js";
 import { getAdapter } from "../adapters/registry.js";
 import { GATE_NAMES } from "../graph/schema.js";
 import { acceptanceGate } from "./acceptance.js";
-import { classifiedFileDurations, compareToBaseline, effectiveCeilingMs, waitForCalmWindow, calmWindowReady } from "./baseline.js";
+import { classifiedFileDurations, compareToBaseline, effectiveCeilingMs, waitForCalmWindow, calmWindowReady, SIGNAL_EXIT_RE } from "./baseline.js";
 import { evidenceGate } from "./evidence.js";
 import { captureLlmOutput, SeatLaunchError } from "./llm.js";
 import { withLaunchGuard } from "../drivers/orca.js";
@@ -19,7 +19,7 @@ import { discoverTestManifest, evaluateManifestedTest, isVitestTestCommand, mani
 import { RUNNER_INFRA_DIAGNOSTIC_RE, timeoutShaped } from "./timeout-shaped.js";
 import { executionSignal } from "../run/execution-budget.js";
 import { failureDisposition } from "../run/recovery.js";
-import { dependencyLinkRefusal, preserveWorktree, producerFields, readCapacity, shGit, resolvedCapacity, sameCapacity, verificationProtocol } from "../run/git.js";
+import { dependencyLinkRefusal, preserveWorktree, producerFields, readCapacity, reflogWitness, shGit, resolvedCapacity, sameCapacity, verificationProtocol } from "../run/git.js";
 import { withJudgeInvocationEvidence } from "../run/journal.js";
 import { computeVerificationIdentity, verificationIdentityKey, formatReusedRow, getVerdictStore, isInfraResult, resolveStateDir, reusedIdentity, } from "./cache.js";
 const productionLoadProvider = () => loadavg()[0] ?? 0;
@@ -364,30 +364,36 @@ export async function reobserveTestFiles(worktree, testCmd, baseline, files, art
     return r.meta?.recovery === undefined ? r
         : { ...r, pass: false, meta: { ...r.meta, classification: "infra", infra: true, retryable: false, recoveryRefused: true } };
 }
-const SIGNAL_EXIT_RE = /\b(?:SIGTERM|SIGKILL|signal\s+(?:9|15)|exit(?:s|ed|\s+code)?\s+(?:137|143))\b/i;
 const FAILURE_IDENTITY_RE = /\b(?:AssertionError|FAIL\s+\S|Tests?\s+\d+\s+failed|expected\s+.+\s+to\s+)\b/i;
 /** D1: apply the daemon's signal-only rider before either battery cache read or write. Its onGate
  * classification happens after persistence, too late to keep a scripted runner's non-verdict out.
  * Keep named failures as work verdicts and preserve details for failure-policy fingerprinting.
  * A baseline-forgiven "green" whose runner was signal-killed is the same non-verdict: a killed job
- * completed no suite, so forgiveness never publishes or caches it green. The authoritative termination
- * receipt decides, never the verdict text: a signal-terminated job is killed whatever its details say, and
- * a green stands only on a receipt showing a normal exit — a receiptless CACHED one (an older or planted
- * entry) is unavailable proof, so a fresh job measures instead. A fresh row is this invocation's own: every
- * production runner attaches its receipt, and the manifest path's verdict already requires a clean exit
+ * completed no suite. The termination receipt decides first: a signal-terminated job is killed whatever its
+ * details say, and a green stands only on a receipt showing a normal exit — a receiptless CACHED one (an
+ * older or planted entry) is unavailable proof, so a fresh job measures instead. A normal exit 1 can still
+ * be a kill (a wrapper reports its killed worker and exits 1), and a forgiven green's details never carry
+ * the runner's output, so this rider cannot see it: S19m4 — the shared forgiveness decision
+ * (baseline.ts freshFailures) reads kill text beside a forgiven pass itself, turns one into infra that is
+ * never cached, and marks the green it does publish `killTextRead`. A cached forgiven green without that
+ * marker was written by an engine that never read kill text, so it is refused here — a normal exit 1
+ * receipt included — and the job runs again. A fresh row is this invocation's own: every production
+ * runner attaches its receipt, and the manifest path's verdict already requires a clean exit
  * (test-manifest.ts verifyManifestReport). A no-command skip ran nothing and claims none. */
 function classifySignalOnlyTest(g, cached = false) {
     const termination = g.evidenceReceipt?.termination.kind;
     const exitCode = g.evidenceReceipt?.termination.exitCode;
     const killed = termination === "signal" || exitCode === 137 || exitCode === 143 || (!g.pass && SIGNAL_EXIT_RE.test(g.details));
-    const unproven = g.pass && g.meta?.skipped !== true && termination !== "exit" && (cached || termination !== undefined);
+    const killTextUnread = cached && Array.isArray(g.meta?.forgivenFingerprints) && g.meta.killTextRead !== true;
+    const unproven = g.pass && g.meta?.skipped !== true && (killTextUnread || termination !== "exit" && (cached || termination !== undefined));
     if (g.gate !== "test" || g.meta?.infra === true || !(killed || unproven))
         return;
     const named = Array.isArray(g.meta?.failingTests) && g.meta.failingTests.length > 0;
     if (!g.pass && (named || FAILURE_IDENTITY_RE.test(g.details)))
         return;
     g.pass = false;
-    g.meta = { ...g.meta, classification: "infra", infra: true, retryable: false, kind: killed || termination ? "signal-exit" : "no-exit-receipt" };
+    g.meta = { ...g.meta, classification: "infra", infra: true, retryable: false,
+        kind: killed || (termination && termination !== "exit") ? "signal-exit" : termination ? "kill-text-unread" : "no-exit-receipt" };
 }
 /** OBS-1151: a criterion's comparable subject — its canonical text, the task's declared bounds and the
  * operator context. The cited files' blobs are compared separately, over the union of both citations. */
@@ -431,6 +437,49 @@ export async function judgeContradictions(worktree, head, fresh, priors) {
     }
     return found;
 }
+const SUBJECT_LEG_TEXT = {
+    moved: "moved", restored: "moved and restored", witness: "could not be witnessed", unreadable: "is unreadable",
+};
+/** ANL-023 §7.4 S0, read-only: HEAD's symbolic state and its reflog W(HEAD) — plus, when attached, its branch's
+ * W(R) — each valid for the sampled `commit`. A move made inside the checkout writes both logs, a branch move from
+ * another worktree only the branch's, a same-commit retarget only HEAD's, so both are kept. */
+async function openSubjectWitness(dir, commit) {
+    const sym = await shGit("git symbolic-ref -q HEAD", dir);
+    if (sym.code !== 0 && sym.code !== 1)
+        return { leg: "unreadable" };
+    const ref = sym.code === 0 ? sym.stdout.trim() : undefined;
+    const logs = [];
+    for (const name of ref ? ["HEAD", ref] : ["HEAD"]) {
+        const w = await reflogWitness(dir, name);
+        if (w.code !== 0 || w.lines[0] !== commit)
+            return { leg: "witness" };
+        logs.push(w.lines.join("\n"));
+    }
+    return { ref, logs };
+}
+/** ANL-023 §7.4, after the seat returns: HEAD = `commit`, its symbolic state and referent unchanged, and both logs
+ * line for line as S0 found them — or the leg that changed, with the HEAD it found. */
+async function adjudicationSubjectChange(dir, commit, s0) {
+    const head = await shGit("git rev-parse HEAD", dir);
+    if (head.code !== 0)
+        return { leg: "unreadable", found: "unreadable" };
+    const found = head.stdout.trim();
+    if (found !== commit)
+        return { leg: "moved", found };
+    const sym = await shGit("git symbolic-ref -q HEAD", dir);
+    if (sym.code !== 0 && sym.code !== 1)
+        return { leg: "unreadable", found: "unreadable" };
+    if ((sym.code === 0 ? sym.stdout.trim() : undefined) !== s0.ref)
+        return { leg: "moved", found };
+    for (const [i, name] of (s0.ref ? ["HEAD", s0.ref] : ["HEAD"]).entries()) {
+        const w = await reflogWitness(dir, name);
+        if (w.code !== 0)
+            return { leg: "unreadable", found: "unreadable" };
+        if (w.lines.join("\n") !== s0.logs[i])
+            return { leg: "restored", found };
+    }
+    return undefined;
+}
 export async function runGates(task, ctx) {
     const results = [];
     const evidence = {
@@ -1141,6 +1190,11 @@ export async function runGates(task, ctx) {
         // reused. Only a criterion that REVERSES the newest prior ruling on the same subject key over
         // identical cited blobs needs a second, distinct judge; agreement stands (a sound FAIL included),
         // and a split, no distinct eligible seat or an unreadable adjudication parks for the operator.
+        // 2.8.1 T4 (ANL-023 §7.4): the record names the commit it judged, under a validated subject witness. Only when
+        // a second seat is about to run, the subject witness (HEAD's reflog and, when attached, its branch's reflog) is
+        // validated for the sampled HEAD before the second seat runs, read-only, and re-read after it returns with HEAD
+        // and its symbolic state; a move, a move-and-restore or an unwitnessable (or unreadable) subject parks infra with
+        // no record stamped and no worker charge.
         const adjudicate = async (fresh) => {
             const primary = String(fresh.meta?.judge ?? channelKey({ adapter: ctx.cfg.judge.adapter, model: ctx.cfg.judge.model }));
             const head = await shGit("git rev-parse HEAD", ctx.worktree);
@@ -1173,7 +1227,19 @@ export async function runGates(task, ctx) {
             const seatVia = via
                 ? { driver: via.driver, keep: via.keep, onSlot: via.onSlot, name: via.nameFor("judge", seatAdapter.id) + "-r2", label: via.labelFor("judge") }
                 : undefined;
+            const subjectPark = (leg, found, ran) => ({
+                gate: "acceptance", pass: false,
+                details: `the adjudication subject ${SUBJECT_LEG_TEXT[leg]}: sampled ${commit.slice(0, 12)}, found ${found.slice(0, 12)} (${leg}); parked for an operator ruling, no worker charge`,
+                meta: { classification: "infra", infra: true, retryable: false, cause: "subject-moved", judge: primary,
+                    adjudication: { primary, ...(ran ? { adjudicator: ran } : {}), sampled: commit, found, leg } },
+            });
+            const s0 = await openSubjectWitness(ctx.worktree, commit);
+            if ("leg" in s0)
+                return subjectPark(s0.leg, s0.leg === "unreadable" ? "unreadable" : commit);
             const second = await invokeJudge(seatAdapter, seat.model, seatVia, configuredEffort(ctx.cfg, seat));
+            const changed = await adjudicationSubjectChange(ctx.worktree, commit, s0);
+            if (changed)
+                return subjectPark(changed.leg, changed.found, adjudicator);
             const rulings = Array.isArray(second.meta?.judgment) ? second.meta.judgment : undefined;
             // A citation-less ruling cannot be compared, so it confirms nothing (invented evidence is already unparseable,
             // and an internally inconsistent verdict carries no judgment rows at all).
@@ -1193,7 +1259,7 @@ export async function runGates(task, ctx) {
         // details. The v1.1 badReviewers precedent's TIMING can't transfer: its failover lands on the NEXT
         // worker attempt — exactly what this fix forbids; only its meta-carries-channel pattern is mirrored.
         // Straight-line single `if` — NO loop/counter/knob: exactly-once by construction (a knob is a
-        // fail-closed weakening vector); a second garbage verdict fails the gate closed exactly as today.
+        // fail-closed weakening vector); a second garbage verdict fails the gate closed as terminal infra (S23-F11).
         // T6: exclusion mirrors consult reroute semantics — the flaked channel's whole adapter is banned, not
         // just its exact channel key, so an outage window cannot re-select the vendor being routed around.
         // If no other adapter is live, the exclusion degrades to a channel-level reroute within the same
@@ -1226,8 +1292,11 @@ export async function runGates(task, ctx) {
         }
         // OBS-1168(b): the re-routed seat could not launch either — no seat produced a verdict, so this is
         // an infra park over whatever the deterministic gates proved, never a charge against the worker.
-        if (a.meta?.cause === "seat-launch-failed")
+        // S23-F11: the same holds for a retry whose verdict is still unparseable: two seats delivered no readable
+        // verdict, which judges nothing about the worker's diff, so the row is terminal infra, never a charged red.
+        if (a.meta?.cause === "seat-launch-failed" || (a.meta?.judgeRetry !== undefined && a.meta.unparseable === true)) {
             a = { ...a, meta: { ...a.meta, classification: "infra", infra: true, retryable: false } };
+        }
         else if (!cancelled && Array.isArray(a.meta?.judgment))
             a = await adjudicate(a);
         // No dispatch, no key: a deterministic-oracle round writes no `invocations` field rather than an

package/dist/run/daemon.d.ts

@@ -5,8 +5,9 @@ import { type ExecutorDriver, type Slot } from "../drivers/types.js";
 import { type Baseline, type BaselineProvenance, type GateEvidenceOptions } from "../gates/baseline.js";
 import type { GateResult } from "../gates/types.js";
 import { type RunGraph, type Task } from "../graph/schema.js";
-import { type PreserveProducer } from "./git.js";
+import { type PreserveProducer, type RunCapacity } from "./git.js";
 import { Journal, type JournalEvent } from "./journal.js";
+import { type IntegrationLeg, type IntegrationRefState, type TipVerifyResult } from "./merge.js";
 export declare function closeLiveSlot(liveSlots: Set<Slot>, driver: Pick<ExecutorDriver, "close">, slot: Slot): Promise<void>;
 export declare function setContactUnreadableDeadlineMsForTests(ms: number): void;
 export declare function resetContactUnreadableDeadlineMsForTests(): void;
@@ -246,23 +247,86 @@ export interface TipProof {
 export declare function runEndTipProof(events: readonly JournalEvent[]): TipProof;
 /** The close notification's statement of the proof — one clause per kind. */
 export declare function formatTipProof(p: TipProof): string;
+/** 2.8.1 T1 (ANL-023 §7.1): what run end checks the integration ref against; `expected` absent = the opening read. */
+export interface TipIdentity {
+    repo: string;
+    branch: string;
+    expected?: string;
+}
+export type IdentityLeg = IntegrationLeg | "setup" | "witness" | "checkout";
+type DeferredVerdict = NonNullable<TipVerifyResult["deferredVerdict"]>;
+/** One close under an identity: `expected` is what the closing check must find; `identityFailed` skips it. */
+export interface TipClose {
+    failed: boolean;
+    expected?: string;
+    identityFailed: boolean;
+    deferred: DeferredVerdict[];
+}
+interface TipVerifyOptions {
+    lastMergedTask?: string;
+    baseline?: Baseline;
+    signal?: AbortSignal;
+    evidence?: GateEvidenceOptions;
+}
+/**
+ * 2.8.1 T3 (ANL-023 §7.3): anchor A of a run whose run-start carries `integrationAnchor: "journal"` — the newest merge
+ * row's commit (that row must carry a `from`), else the run-start base; any of them not an object id is unreadable.
+ * No marker: undefined (legacy-ref). Resume and approve both read it.
+ */
+export declare function integrationAnchor(events: readonly JournalEvent[]): {
+    anchor: string;
+} | {
+    unreadable: string;
+} | undefined;
+/** The ref legs' details: the leg, both commits, the symbolic target and the repair text. */
+export declare function identityDetails(leg: IntegrationLeg, state: IntegrationRefState, branch: string, runId: string, expected: string | undefined): string;
+/**
+ * The one closed outcome row for every identity leg: an integration `tip-verify-failed` (preceded by a start row
+ * with no gates when this close appended none), which runEndTipProof and every consumer already read as failure.
+ */
+export declare function appendIdentityFailure(journal: Journal, f: {
+    started: boolean;
+    branch: string;
+    expected?: string;
+    leg: IdentityLeg;
+    details: string;
+    state?: IntegrationRefState;
+    cmdHash: string;
+    capacity: RunCapacity;
+    infra?: boolean;
+}): void;
+/** O: I(expected) — or, with no expected value, the ref must be regular and its commit becomes the expected. */
+export declare function openingIdentity(identity: TipIdentity, journal: Journal): Promise<{
+    ok: true;
+    expected: string;
+} | {
+    ok: false;
+    leg: IntegrationLeg;
+    state: IntegrationRefState;
+    expected?: string;
+    details: string;
+}>;
 /**
  * OBS-34's strict tip verify, but it stops re-paying for an unmoved tip (~334m corpus-wide; 69.5m in
  * one park-heavy run whose 18 resume cycles merged nothing new). The verify journals the SHA it
  * verified and the hash of the command set, so a later run-end can recognize the same verified state:
- * head equals the LAST green verified SHA, commands unchanged, tree clean → journal
- * `tip-verify-cached` and skip. ANY doubt — moved head, changed commands, dirty tree, a gate missing
- * from that cycle's green set, a failure recorded in it, a cycle older than the last one — runs the
- * full verify. The tip-verify-before-green law is untouched: a cached green is a verified green OF
- * THAT EXACT COMMIT, established by the most recent real run of the same commands.
- * Returns whether the tip is failing.
+ * the expected commit equals the LAST green verified SHA and the commands are unchanged → journal
+ * `tip-verify-cached` and skip, with no checkout. ANY doubt — moved tip, changed commands, a gate
+ * missing from that cycle's green set, a failure recorded in it, a cycle older than the last one —
+ * runs the full verify. 2.8.1 T1 (ANL-023 §7.1): with `identity` (the daemon always passes it) run end
+ * verifies a fresh detached checkout of the expected commit under a validated HEAD reflog, never the
+ * integration checkout; it checks tracked content after the battery (the battery-end check also proves
+ * the checkout's HEAD and its reflog unchanged), defers verdict-store writes to the caller, and the
+ * caller closes on an identity check taken after the approval serialization with no await before the
+ * run-end row. The opening check reads the ref before the cycle decision, so a cached green is carried
+ * only for the commit the ref holds now. A caller without `identity` keeps the integration checkout's
+ * head and clean tree as the cache key, exactly as before.
+ * Returns whether the tip is failing (without `identity`) or the close's TipClose (with it).
  */
-export declare function verifyIntegrationTipCached(intWt: string, commands: Record<string, string>, journal: Journal, opts?: {
-    lastMergedTask?: string;
-    baseline?: Baseline;
-    signal?: AbortSignal;
-    evidence?: GateEvidenceOptions;
-}): Promise<boolean>;
+export declare function verifyIntegrationTipCached(intWt: string, commands: Record<string, string>, journal: Journal, opts: TipVerifyOptions & {
+    identity: TipIdentity;
+}): Promise<TipClose>;
+export declare function verifyIntegrationTipCached(intWt: string, commands: Record<string, string>, journal: Journal, opts?: TipVerifyOptions): Promise<boolean>;
 type WorkerProcessTree = "empty" | "running" | "unmeasurable";
 export declare function observeWorkerProcessTree(marker: string, cwd: string): Promise<WorkerProcessTree>;
 type SuitePidProbe = (pid: number) => number | undefined;