tickmarkr 2.7.9 → 2.8.1

package/dist/run/merge.js

@@ -4,8 +4,7 @@ import { shq } from "../adapters/types.js";
 import { baselineEntryRefusal, beginGateEvidence, ceilingKillResult, classifyFreshRunnerOutput, classifyRunnerOutput, fileCountDeficit, waitForCalmWindow, effectiveCeilingMs, classifiedFileDurations, fingerprint, freshFailures, } from "../gates/baseline.js";
 import { evaluateManifestedTest, isVitestTestCommand } from "../gates/test-manifest.js";
 import { computeVerificationIdentity, formatReusedDetails, getVerdictStore, getWorktreeTree, resolveStateDir, isInfraResult, } from "../gates/cache.js";
-import { tickmarkrDir } from "../graph/graph.js";
-import { dependencyLinkRefusal, describeCapacity, gitHead, linkNodeModules, resolveIntegrationBranch, resolvedCapacity, sameCapacity, sh, shGit, shGitOk, WORKTREES_DIR } from "./git.js";
+import { dependencyLinkRefusal, describeCapacity, resolveIntegrationBranch, resolvedCapacity, sameCapacity, sh, shGit } from "./git.js";
 import { executionSignal } from "./execution-budget.js";
 // Diagnostic convenience logs are observational, just like receipt persistence.
 function writeTipLog(path, text) {
@@ -32,42 +31,131 @@ export function reusedTipEvidence(source) {
 export function integrationBranch(cfg, runId) {
     return `${cfg.integrationBranchPrefix}${runId}`;
 }
-const sanitize = (branch) => branch.replace(/[^\w.-]+/g, "-");
+/**
+ * 2.8.1 T2 (ANL-023 §7.2): creates the integration ref create-only at `baseRef` (the empty old value means "must not
+ * exist") and returns the published tip E. The run keeps no checkout of the branch: every later publication is a
+ * compare-and-swap of the ref from `repo` (mergeTask). An existing or uncreatable ref throws — the fatal path's text.
+ */
 export async function ensureIntegration(repo, branch, baseRef) {
     branch = await resolveIntegrationBranch(repo, branch);
-    const dir = join(tickmarkrDir(repo), WORKTREES_DIR, sanitize(branch));
-    if (!existsSync(join(dir, ".git"))) {
-        const exists = (await shGit(`git rev-parse --verify refs/heads/${shq(branch)}`, repo)).code === 0;
-        if (exists) {
-            await shGitOk(`git worktree add ${shq(dir)} ${shq(branch)}`, repo, { createsWorktree: "branch", rollback: { dir } });
-        }
-        else {
-            await shGitOk(`git worktree add -b ${shq(branch)} ${shq(dir)} ${shq(baseRef)}`, repo, { createsWorktree: "branch", rollback: { dir, branch: { name: branch } } });
-        }
-    }
-    linkNodeModules(repo, dir);
-    return dir;
+    // ponytail: no --create-reflog (ANL-023 §7.2 names it): the repository's own core.logAllRefUpdates decides, because
+    // nothing reads this reflog (X10) and run-end-integration's E-P10 builds its no-reflog legacy branch through a fresh
+    // run with logging disabled. Add the flag back once that fixture builds its legacy branch by hand.
+    const r = await shGit(`git update-ref --no-deref -m ${shq("tickmarkr: run start")} ${shq(`refs/heads/${branch}`)} ${shq(baseRef)} ""`, repo);
+    if (r.code !== 0)
+        throw new Error(`integration branch ${branch} already exists or cannot be created: ${(r.stderr || r.stdout).trim()}`);
+    return baseRef;
+}
+/**
+ * R(ref): the integration ref read from `repo` through the own-git runner, never its reflog. The exact ref only —
+ * a descendant ref (`refs/heads/<branch>/x`) is not this ref, and a ref that exists but names no commit is unreadable.
+ */
+export async function readIntegrationRef(repo, branch) {
+    const ref = `refs/heads/${branch}`;
+    const unreadable = (cmd, r) => ({ kind: "unreadable", read: `${cmd} exited ${r.code}${(r.stderr || r.stdout).trim() ? `: ${(r.stderr || r.stdout).trim()}` : ""}` });
+    const symbolic = await shGit(`git symbolic-ref -q ${shq(ref)}`, repo);
+    if (symbolic.code !== 0 && symbolic.code !== 1)
+        return unreadable("git symbolic-ref", symbolic);
+    const commit = await shGit(`git rev-parse --verify -q ${shq(`${ref}^{commit}`)}`, repo);
+    if (commit.code !== 0 && commit.code !== 1)
+        return unreadable("git rev-parse", commit);
+    const found = commit.code === 0 ? commit.stdout.trim() : undefined;
+    if (symbolic.code === 0)
+        return { kind: "symbolic", target: symbolic.stdout.trim(), ...(found ? { commit: found } : {}) };
+    if (found)
+        return { kind: "regular", commit: found };
+    const exists = await shGit(`git show-ref --verify -q ${shq(ref)}`, repo);
+    return exists.code === 1 ? { kind: "missing" } : unreadable("git show-ref", exists);
 }
-export function integrationHead(intWt) {
-    return gitHead(intWt);
+/** I(x): holds iff the ref is regular at x; otherwise the leg, with the state the repair text is chosen by. */
+export async function checkIntegrationIdentity(repo, branch, expected) {
+    const state = await readIntegrationRef(repo, branch);
+    if (state.kind === "regular" && state.commit === expected)
+        return { ok: true, state };
+    return { ok: false, leg: state.kind === "regular" ? "value" : state.kind, state };
 }
-export async function mergeTask(intWt, taskBranch, message, gatedCommit) {
-    const tip = await shGit(`git rev-parse --verify ${shq(`refs/heads/${taskBranch}`)}`, intWt);
+/**
+ * The repair text (shared by run end's failure row, the merge park and the resume refusal): backticked commands run
+ * from the repository root in order, stopping at the first that fails. A found commit is preserved create-only under
+ * refs/tickmarkr/found/<runId>/<F> before a no-deref compare-and-swap restores the ref; a symbolic found ref or one
+ * already holding another commit stops the sequence before the restore. Dangling and unreadable print no command.
+ */
+export function integrationRepairText(state, branch, runId, expected) {
+    const ref = `refs/heads/${branch}`;
+    const byHand = `inspect ${ref} and restore it to ${expected} by hand`;
+    const found = state.kind === "regular" ? state.commit : state.kind === "symbolic" ? state.commit : undefined;
+    if (found) {
+        const keep = `refs/tickmarkr/found/${runId}/${found}`;
+        return `\`test -z "$(git symbolic-ref -q ${keep})"\` then \`test "$(git rev-parse -q --verify ${keep})" = ${found} || git update-ref --no-deref ${keep} ${found} ""\` then \`git update-ref --no-deref ${ref} ${expected} ${found}\``;
+    }
+    if (state.kind === "missing")
+        return `\`git update-ref --no-deref ${ref} ${expected} ""\``;
+    if (state.kind === "symbolic")
+        return `symbolic to ${state.target}, which names no commit; ${byHand}`;
+    return state.kind === "unreadable" ? `${ref} is unreadable (${state.read}); ${byHand}` : byHand;
+}
+/**
+ * 2.8.1 T2 (ANL-023 §7.2): publishes `gated` onto the integration ref by compare-and-swap from the stored tip
+ * `expected`, all git from `repo` — no checkout. (1) the task-tip check; (2) I(expected); (3) ancestry; (4) merge-tree;
+ * (5) commit-tree; (6) `update-ref --no-deref` from `expected`; (7) `onPublished(M)` in the same synchronous
+ * continuation as (6)'s result, so the caller's rows land in publication order. `merged` is the task's recorded merge
+ * commits, newest first: a gated commit already in the history is done only through its own recorded merge.
+ * `ancestorOnly` (a replay that ran no gates): a gated commit not in E is refused `infra`, never published.
+ */
+export async function mergeTask(repo, { branch, expected, merged = [], ancestorOnly = false }, taskBranch, message, gated, onPublished, seam) {
+    const tip = await shGit(`git rev-parse --verify ${shq(`refs/heads/${taskBranch}`)}`, repo);
     if (tip.code !== 0)
         return { ok: false, conflict: tip.stderr || tip.stdout };
     const branchTip = tip.stdout.trim();
-    if (branchTip !== gatedCommit)
-        return { ok: false, tipMoved: { gatedCommit, branchTip } };
-    // Merge the verified hash, not the mutable branch name: a move after the comparison cannot land ungated content.
-    const r = await shGit(`git merge --no-ff ${shq(gatedCommit)} -m ${shq(message)}`, intWt);
-    if (r.code === 0)
-        return { ok: true };
-    const conflict = (await shGit("git status --porcelain", intWt)).stdout
-        .split("\n")
-        .filter((l) => l.startsWith("UU") || l.startsWith("AA"))
-        .join("\n") || r.stderr || r.stdout;
-    await shGit("git merge --abort", intWt);
-    return { ok: false, conflict };
+    if (branchTip !== gated)
+        return { ok: false, tipMoved: { gatedCommit: gated, branchTip } };
+    const moved = (leg, state, stage) => ({
+        ok: false, state, integrationMoved: { branch, expected, leg, stage,
+            found: (state.kind === "regular" || state.kind === "symbolic" ? state.commit : undefined) ?? null,
+            ...(state.kind === "symbolic" ? { target: state.target } : {}) },
+    });
+    const infra = (step, r) => ({ ok: false, infra: { step, message: (r.stderr || r.stdout).trim() || `exit ${r.code}` } });
+    const run = async (step, cmd) => (await seam?.(step)) || shGit(cmd, repo);
+    const held = await checkIntegrationIdentity(repo, branch, expected);
+    if (!held.ok)
+        return moved(held.leg, held.state, "check");
+    const ancestry = await run("ancestry", `git merge-base --is-ancestor ${shq(gated)} ${shq(expected)}`);
+    if (ancestry.code === 0) {
+        // Ancestor or equal tip: only the task's own recorded merge (second parent = gated) makes it done. A resume replay
+        // hands the task's own gated commit here, never a tip recreated on E (runDaemon's resume gate replay).
+        for (const commit of merged) {
+            const second = await shGit(`git rev-parse --verify -q ${shq(`${commit}^2`)}`, repo);
+            if (second.code !== 0)
+                break; // a failed read (no second parent, no such object) is never passed over: fail closed
+            if (second.stdout.trim() === gated)
+                return { ok: true, alreadyMerged: commit };
+        }
+        return { ok: false, alreadyIntegrated: { gated, tip: expected } };
+    }
+    if (ancestry.code !== 1)
+        return infra("ancestry", ancestry);
+    // A caller that skipped the gates on its own ancestry proof (a resume replay) never reaches construction.
+    if (ancestorOnly)
+        return infra("ancestry", { code: 1, stdout: "", stderr: `${gated} is not in ${expected}; an ungated replay publishes nothing` });
+    const tree = await run("merge-tree", `git merge-tree --write-tree ${shq(expected)} ${shq(gated)}`);
+    if (tree.code === 1)
+        return { ok: false, conflict: (tree.stdout || tree.stderr).trim() };
+    if (tree.code !== 0)
+        return infra("merge-tree", tree);
+    const made = await run("commit-tree", `git commit-tree ${shq(tree.stdout.split("\n")[0].trim())} -p ${shq(expected)} -p ${shq(gated)} -m ${shq(message)}`);
+    if (made.code !== 0)
+        return infra("commit-tree", made);
+    const commit = made.stdout.trim();
+    await seam?.("publish");
+    const published = await shGit(`git update-ref --no-deref -m ${shq(message)} ${shq(`refs/heads/${branch}`)} ${shq(commit)} ${shq(expected)}`, repo);
+    if (published.code === 0) {
+        onPublished(commit); // no await between the compare-and-swap's result and the caller's rows
+        return { ok: true, commit, from: expected };
+    }
+    const state = await readIntegrationRef(repo, branch);
+    if (state.kind === "regular" && state.commit === expected)
+        return infra("publish", published);
+    return moved(state.kind === "regular" ? "value" : state.kind, state, "publish");
 }
 // OBS-34 ruled strict exit-code verify; Q121s (TRIAL T-OBS-1) narrows it: a red whose failure
 // fingerprints are ALL recorded in the run's baseline is forgiven with the battery's own math
@@ -75,7 +163,7 @@ export async function mergeTask(intWt, taskBranch, message, gatedCommit) {
 // terminus unreachable by construction and misattributed the red to the last merged task.
 // Fail-closed edges kept: no baseline → strict; baseline green for that gate → strict; any fresh
 // fingerprint, or output with no recognizable failure shape, → failed.
-export async function verifyIntegrationTip(intWt, commands, runDir, baseline, evidenceOptions = {}) {
+export async function verifyIntegrationTip(intWt, commands, runDir, baseline, evidenceOptions = {}, { deferVerdicts = false } = {}) {
     const results = [];
     let runStartCommands;
     let journalFound = false;
@@ -216,7 +304,9 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline, ev
         // Persistent reuse requires the run's durable journal. Without it there is no
         // recorded cycle provenance to reconcile with the caller's capacity checks.
         const hit = journalFound ? store.get(id) : undefined;
-        if (hit && id && hit.pass && !isInfraResult(hit)) {
+        // S19m4: a forgiven test green written before the tip read kill text never proves the suite completed.
+        const killTextUnread = gate === "test" && hit?.meta?.forgiven === true && hit.meta.killTextRead !== true;
+        if (hit && id && hit.pass && !isInfraResult(hit) && !killTextUnread) {
             results.push({
                 gate,
                 cmd,
@@ -339,7 +429,7 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline, ev
             });
             continue;
         }
-        const verdict = freshFailures(entry, stripped);
+        const verdict = freshFailures(entry, stripped, gate === "test");
         const { failing, unreadable } = verdict;
         // S22: a missing or unreadable entry forgives nothing; the red names it rather than a bare exit code.
         const refusal = baselineEntryRefusal(gate, verdict);
@@ -366,8 +456,12 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline, ev
         // often the previous session's — so a capture taken under a different resolved capacity forgives
         // nothing at the tip either. An absent capacity is a pre-T7 baseline and keeps today's verdict.
         const comparable = sameCapacity(entry?.capacity, r.capacity);
-        const forgiven = r.code !== 0 && baselineRed && failing.length === 0 && !unreadable && cause !== "infra"
+        const forgivable = r.code !== 0 && baselineRed && failing.length === 0 && !unreadable && cause !== "infra"
             && comparable;
+        // S19m4 (battery parity): kill text beside forgivable failures means the suite never completed — red, infra.
+        const killLine = forgivable && !greenTeardown && !deficit ? verdict.killLine : undefined;
+        const forgiven = forgivable && killLine === undefined;
+        const rowCause = killLine !== undefined ? "infra" : cause;
         const pass = !deficit && (r.code === 0 || greenTeardown || forgiven);
         if (!pass)
             writeTipLog(artifact, raw);
@@ -378,18 +472,20 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline, ev
             evidenceReceipt, evidenceReceipts,
             exitCode: r.code,
             fingerprints: r.code !== 0 && !greenTeardown ? fingerprint(stripped) : [],
-            details: `${cause === "infra" ? "infra; " : ""}${rerun ? `${rerun}: ` : ""}` + (deficit?.replace(/^infra; /, "") ?? (r.code === 0 ? "exit 0"
+            details: `${rowCause === "infra" ? "infra; " : ""}${rerun ? `${rerun}: ` : ""}` + (deficit?.replace(/^infra; /, "") ?? (r.code === 0 ? "exit 0"
                 : greenTeardown ? `exit ${r.code} after a green suite summary; only the runner's teardown fingerprint followed it`
                     : forgiven ? `exit ${r.code} but only baseline-recorded failures (forgiven vs baseline)`
-                        : !comparable && baselineRed && failing.length === 0
-                            ? `exit ${r.code}; every failure is baseline-recorded, but that capture ran under `
-                                + `${describeCapacity(entry?.capacity)} and this verification ran under ${describeCapacity(r.capacity)} `
-                                + `— forgiveness across a changed capacity is not evidence`
-                            : `exit ${r.code}`))
+                        : killLine !== undefined ? `exit ${r.code}; every failure is baseline-recorded, but the runner printed kill text — `
+                            + `it never completed a suite, so nothing is forgiven: ${killLine}`
+                            : !comparable && baselineRed && failing.length === 0
+                                ? `exit ${r.code}; every failure is baseline-recorded, but that capture ran under `
+                                    + `${describeCapacity(entry?.capacity)} and this verification ran under ${describeCapacity(r.capacity)} `
+                                    + `— forgiveness across a changed capacity is not evidence`
+                                : `exit ${r.code}`))
                 // S22: every red here names a missing or unreadable entry beside its own cause, deficit included
                 + (!pass && refusal ? `; ${refusal}` : ""),
             ...(forgiven && !deficit ? { forgiven: true, ...(baseline?.provenance ? { baselineProvenance: baseline.provenance } : {}) } : {}),
-            ...(cause ? { cause } : {}),
+            ...(rowCause ? { cause: rowCause } : {}),
             ...(pass ? {} : { artifact }),
         };
         results.push(tipResult);
@@ -406,14 +502,20 @@ export async function verifyIntegrationTip(intWt, commands, runDir, baseline, ev
         }
         const id = pending.get(result.gate);
         if (id && id.tree === completedTree && !isInfraResult(result)) {
-            store.set(id, { ...result, meta: {
+            const verdict = { ...result, meta: {
                     fingerprints: result.fingerprints, forgiven: result.forgiven, baselineProvenance: result.baselineProvenance,
+                    ...(result.forgiven && result.gate === "test" ? { killTextRead: true } : {}),
                     reportPath: result.reportPath, spawnedCommand: result.spawnedCommand,
                     artifact: result.artifact,
                     evidenceReceipt: result.evidenceReceipt, evidenceReceipts: result.evidenceReceipts,
                     evidenceAbsence: result.evidenceAbsence, originRunRoot: result.originRunRoot,
                     nonce: result.nonce, stdoutPath: result.stdoutPath, stderrPath: result.stderrPath,
-                } });
+                } };
+            // 2.8.1 T1: a deferring caller (run end) writes the verdict itself, only after its closing identity check.
+            if (deferVerdicts)
+                result.deferredVerdict = { id, verdict };
+            else
+                store.set(id, verdict);
         }
     }
     return results;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.7.9",
+  "version": "2.8.1",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",

package/skills/tickmarkr-overseer/SKILL.md

@@ -503,6 +503,14 @@ journal tail to decide what happens next, or sweeping orphans — you have taken
    - **the INTEGRATION subject** — the integration-branch commit that worktree was created from, named by
      sha from the journal's `task-dispatch` row or `tickmarkr status`; never "the run", and never the
      branch name alone, which moves while you are reading it;
+   - **the operator view of that branch** — a live run has NO integration checkout: the daemon publishes
+     each merge onto `tickmarkr/<runId>` by compare-and-swap from the repository root. View it through a
+     detached snapshot (`git worktree add --detach <dir> tickmarkr/<runId>`), refreshed by removing it
+     (`git worktree remove <dir>`) and re-adding it; check the branch out attached only with the daemon
+     stopped (no live `graph.lock`) — an attached checkout taken while the run is live goes stale at the next
+     publication, and any write to the ref parks the next merge infra. Run `tickmarkr verify` and `report`
+     from the main checkout or a snapshot;
+     a legacy attached view from a 2.8.0 run is stale from the first publication;
    - **and, where the fix is a FILE the tree must hold** — a new test, a fixture, a schema — its presence
      at that commit: `git -C <task-worktree> cat-file -e <task-head>:<path>`. A fix that lives only in the
      daemon's `dist` cannot make a worker's missing oracle appear, and a worker red on that missing file is