From 6954a8c42be3e0950341e6572a2d9b141a008246 Mon Sep 17 00:00:00 2001 From: Garry Tan Date: Sun, 1 Nov 2026 08:16:00 -0800 Subject: [PATCH 1/9] v1.92.34.0 fix(ship-queue): wave plan links PRs only on a real code conflict and leaves out READY heads whose CI is not green (GST-770) (#3791) * fix(ship-queue): wave plan links PRs only on a real code conflict and leaves out READY heads whose CI is not green (GST-770) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix: pre-landing review fixes (skill templates link on a real conflict; unit rows for linking, pending CI row) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix: pre-landing review fixes (renamed files compare by real path; unreadable CI test; read-only wording) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * docs: wave plan grouping, NOT_GREEN and unreadable CI in ship-policy; changelog fragment (GST-770) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * docs: changelog fragment cites the measured queue (GST-770) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * docs: changelog fragment says shared files link only on a real conflict (GST-770) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> --------- Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> --- CHANGELOG.md | 4 ++ VERSION | 2 +- agents-digest/gstack-AGENTS.md | 2 +- docs/ship-policy.md | 18 +++++-- lib/ship-queue-wave.ts | 51 +++++++++++++------ package.json | 2 +- test/helpers/ship-queue-train-fixture.ts | 3 +- test/ship-queue-wave.test.ts | 65 +++++++++++++++++++++++- 8 files changed, 123 insertions(+), 24 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index d633c0025..c9dab291f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,9 @@ # Changelog +## [1.92.34.0] - 2026-11-01 + +- `gstack-ship-queue wave plan` no longer packs the whole READY queue into one area. Shared files now link two PRs into one group only when `git merge-tree` finds a real conflict between them in a code file or skill template. PRs of the same area still pack together as before. Docs, other Markdown and JSON ledgers never link PRs, since most PRs add to them. Before, any shared file linked two PRs, so `docs/troubleshooting.md` and a few ledgers chained 55 READY PRs into eight waves all labeled `setup`. With this change, the 57-PR queue later that day gives five groups split by area. A READY head whose CI is red or still running now prints `NOT_GREEN: # (...)` and stays out of the plan, as `ready` would refuse it. A head whose CI cannot be read fails the plan with `QUEUE_PROOF_MISSING`, the same as an unreadable PR. Renamed files are compared by their real paths (GST-770). + ## [1.92.33.0] - 2026-11-01 **Eleven flaky tests from the 2026-10-31 flaky pass stop failing correct runs, and six more now name their cause when they fail.** Three paid detectors missed correct replies, one product script copied a file git was rewriting, and the free-test reds came from a binary's slow first launch on a fresh Windows runner, a fixture written in two steps and a cleanup that raced the runner's own scanner. diff --git a/VERSION b/VERSION index 079d43520..64d2db59e 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -1.92.33.0 +1.92.34.0 diff --git a/agents-digest/gstack-AGENTS.md b/agents-digest/gstack-AGENTS.md index 0ad343905..a945033ba 100644 --- a/agents-digest/gstack-AGENTS.md +++ b/agents-digest/gstack-AGENTS.md @@ -1,4 +1,4 @@ -# gstack digest v1.92.33.0 — regenerate/re-copy after upgrading gstack +# gstack digest v1.92.34.0 — regenerate/re-copy after upgrading gstack Behavioral rules from gstack (https://github.com/garrytan/gstack), compressed for agent hosts without a full skill install. The full skills add workflows, diff --git a/docs/ship-policy.md b/docs/ship-policy.md index 99549bf1d..e7d658833 100644 --- a/docs/ship-policy.md +++ b/docs/ship-policy.md @@ -563,7 +563,7 @@ of required checks before it merges, one slot after another, so a wave of three saves two of those rounds and two versions. ```bash -gstack-ship-queue wave plan # read-only: QUEUE, WAVE_ADVISED, WAVE_GROUP lines +gstack-ship-queue wave plan # read-only (merge-tree scratch objects aside): QUEUE, WAVE_ADVISED, WAVE_GROUP lines gstack-ship-queue wave build --area ship --prs 41@,42@,43@ gstack-ship-queue wave build --wave --continue # after resolving a conflict in the printed worktree gstack-ship-queue wave build --wave --drop 42 # rebuild without #42 as a new wave @@ -573,9 +573,19 @@ gstack-ship-queue wave settle --wave [--dry-run] # after the wave ``` - **When.** `wave plan` counts the live READY PRs (open, head equal to their - READY receipt). Over the trigger (6) it prints `WAVE_ADVISED` and suggested - groups of 3 to 6: PRs that change a common file always share a group (their - conflicts are resolved once), each group takes its largest PR's functional + READY receipt, CI green at that head; a READY head whose CI is red, still + running or absent prints a `NOT_GREEN` line and stays out of the plan). A + READY PR whose CI, head or diff cannot be read fails the whole plan with + `QUEUE_PROOF_MISSING`. Over the + trigger (6) it prints `WAVE_ADVISED` and suggested groups of 3 to 6: PRs + whose changes to a common code file conflict (`git merge-tree` cannot merge + the two heads, or the check itself fails) always share a group, so that + conflict is resolved once. Hub + files never link PRs: anything under `docs/`, Markdown (generated skill + renders included; their `.tmpl` sources still link) and every `.json` or + `.jsonl` file (ledgers and registries). Most PRs append to them, and + linking through them once chained a 55-PR queue into a single area + (GST-770). Each group takes its largest PR's functional area (a skill directory, the first word of a `lib/`, `bin/` or `test/` module name, or `docs`), smaller groups ride solo, and the integrator is the PR with the most changed lines. `train build` handed more than 6 pins diff --git a/lib/ship-queue-wave.ts b/lib/ship-queue-wave.ts index 73aec5177..c0f505f41 100644 --- a/lib/ship-queue-wave.ts +++ b/lib/ship-queue-wave.ts @@ -3,7 +3,8 @@ * when the queue is long, 3-6 PRs of one functional area travel as one wave PR * that takes one train slot, one /ship, one READY and one version. * - * wave plan read-only: live READY PRs, WAVE_ADVISED over the trigger, suggested area groups + * wave plan read-only (git merge-tree leaves only unreferenced objects): live READY PRs with green + * CI, WAVE_ADVISED over the trigger, suggested area groups * wave build the integrator branch wave/: main plus each constituent's pinned head merged * unchanged with the train's merge rules (a merge commit whose second parent is the * pin); a conflict stops in a worktree under the state root (--continue resumes); @@ -24,7 +25,7 @@ import { EXIT, formatResult } from './headless-artifacts'; import { RESULT_CODES } from './result-codes'; import { versionAtRef } from './restamp'; import { globToRegExp, type ShipPolicy } from './ship-policy'; -import type { QueueContext } from './ship-queue'; +import { ciAtHead, type QueueContext } from './ship-queue'; import { git, sha256, type QueueFailure } from './ship-queue-gate'; import { fetchBase, mergeCommit, outFailed, outOk, outRefused, parsePins, trainEnv, type TrainEnv, type TrainOut } from './ship-queue-train'; import { prInfo, type PrInfo } from './ship-queue-train-github'; @@ -79,20 +80,34 @@ export function dominantArea(files: string[], areaOf: (f: string) => string): st const largestFirst = (a: PlanPr, b: PlanPr) => b.lines - a.lines || Number(a.pr) - Number(b.pr); /** - * Group PRs into waves: PRs that change a common file always travel together (one integrator - * resolves their conflicts once), each cluster takes its largest PR's area, clusters of one - * area are packed in PR order into waves of at most max, and a wave below min rides solo. - * The integrator is the PR with the most changed lines. + * Hub files: prose (docs/**, Markdown, generated SKILL.md renders) and JSON ledgers and registries. + * Most PRs append to them, so their conflicts are kept-both-sides edits that any train slot + * resolves; linking PRs through them chained a 55-PR queue into one area (GST-770). They never + * link PRs into a wave. Skill templates (.md.tmpl) are source and link on a real conflict. */ -export function groupWaves(prs: PlanPr[], areaOf: (f: string) => string, min = WAVE_MIN, max = WAVE_MAX): { groups: WaveGroup[]; solo: string[] } { +export const isHubFile = (file: string) => file.startsWith('docs/') || /\.(md|jsonl?)$/.test(file); + +/** + * Group PRs into waves: PRs whose changes to a common code file conflict always travel together + * (one integrator resolves the conflict once); hub files never link. conflicts(a, b) names the + * files a merge of the two heads cannot resolve, or null when unknown, which counts every shared + * file as conflicting. Each cluster takes its largest PR's area, clusters of one area are packed + * in PR order into waves of at most max, and a wave below min rides solo. The integrator is the + * PR with the most changed lines. + */ +export function groupWaves(prs: PlanPr[], areaOf: (f: string) => string, min = WAVE_MIN, max = WAVE_MAX, conflicts: (a: PlanPr, b: PlanPr) => string[] | null = () => null): { groups: WaveGroup[]; solo: string[] } { const sorted = [...prs].sort((a, b) => Number(a.pr) - Number(b.pr)); const root = new Map(sorted.map(p => [p.pr, p.pr])); const find = (x: string): string => { const r = root.get(x)!; return r === x ? x : find(r); }; - const owner = new Map(); - for (const p of sorted) for (const f of p.files) { - const o = owner.get(f); - if (o && find(o) !== find(p.pr)) root.set(find(p.pr), find(o)); else if (!o) owner.set(f, p.pr); - } + const sharers = new Map(); + for (const p of sorted) for (const f of p.files) if (!isHubFile(f)) sharers.set(f, [...(sharers.get(f) ?? []), p]); + const clash = new Map(); + for (const [f, list] of sharers) list.forEach((a, i) => list.slice(i + 1).forEach(b => { + const key = `${a.pr} ${b.pr}`; + if (!clash.has(key)) clash.set(key, conflicts(a, b)); + const hit = clash.get(key); + if ((!hit || hit.includes(f)) && find(a.pr) !== find(b.pr)) root.set(find(b.pr), find(a.pr)); + })); const clusters = new Map(); for (const p of sorted) clusters.set(find(p.pr), [...(clusters.get(find(p.pr)) ?? []), p]); const byArea = new Map(); @@ -212,7 +227,7 @@ function readyReceipts(env: TrainEnv): ReadyReceipt[] { function changed(env: TrainEnv, head: string): { files: string[]; lines: number } | null { const fork = git(env.ctx.repoRoot, ['merge-base', `${env.remote}/${env.ctx.base}`, head]); - const stat = fork.ok ? git(env.ctx.repoRoot, ['diff', '--numstat', fork.out, head]) : fork; + const stat = fork.ok ? git(env.ctx.repoRoot, ['diff', '--numstat', '--no-renames', fork.out, head]) : fork; if (!stat.ok) return null; let lines = 0; const files: string[] = []; @@ -250,15 +265,21 @@ export function wavePlan(ctx: QueueContext, o: { trigger: number; min: number; m const info = prInfo(ctx, r.pr); if ('error' in info) { unreadable.push(`#${r.pr} (${info.error})`); continue; } if (info.state !== 'OPEN' || info.headRefOid !== r.head || info.isCrossRepository || info.headRefName.startsWith('wave/')) continue; + const ci = ciAtHead(ctx, r.head); + if (ci.line.startsWith('unknown')) { unreadable.push(`#${r.pr} (CI ${ci.line})`); continue; } + if (!ci.green) { lines.push(`NOT_GREEN: #${r.pr} (${ci.line}; left out until CI is green at the READY head)`); continue; } if (!ensureCommit(env, r.head, r.pr)) { unreadable.push(`#${r.pr} (head ${short(r.head)} not fetchable)`); continue; } const c = changed(env, r.head); if (!c) { unreadable.push(`#${r.pr} (diff unreadable)`); continue; } live.push({ pr: r.pr, head: r.head, ...c }); } if (unreadable.length) return outFailed(fail('QUEUE_PROOF_MISSING', `cannot read ${unreadable.length} READY PR(s): ${unreadable.join('; ')}; a plan from a partial queue would mislead`), lines, `${Q} wave plan (after gh and git can read every PR)`, 'none'); - lines.push(`QUEUE: ${live.length} live READY PR(s) (open, head equal to its READY receipt); wave trigger ${o.trigger}`); + lines.push(`QUEUE: ${live.length} live READY PR(s) (open, head equal to its READY receipt, CI green there); wave trigger ${o.trigger}`); if (live.length <= o.trigger) return outOk([...lines, `WAVE: not needed (${live.length} <= ${o.trigger}); build trains of single PRs`], `${Q} train build --prs `, 'none'); - const plan = groupWaves(live, areaOf(env), o.min, o.max); + const plan = groupWaves(live, areaOf(env), o.min, o.max, (a, b) => { + const m = git(env.ctx.repoRoot, ['merge-tree', '--write-tree', '--name-only', '--no-messages', a.head, b.head]); + return m.ok ? [] : m.status === 1 ? m.out.split('\n').slice(1).filter(Boolean) : null; + }); lines.push(`WAVE_ADVISED: ${live.length} READY PRs over the wave trigger ${o.trigger}; group by area into waves of ${o.min}-${o.max} (Garry R46)`); for (const g of plan.groups) { lines.push(`WAVE_GROUP: area=${g.area} prs=${g.prs.map(p => '#' + p.pr).join(',')} integrator=#${g.integrator} (most changed lines)`); diff --git a/package.json b/package.json index d45586b0c..b8524302e 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "gstack", - "version": "1.92.33", + "version": "1.92.34", "description": "Garry's Stack — Claude Code skills + fast headless browser. One repo, one install, entire AI engineering workflow.", "license": "MIT", "type": "module", diff --git a/test/helpers/ship-queue-train-fixture.ts b/test/helpers/ship-queue-train-fixture.ts index e1baa0cfe..c48fed515 100644 --- a/test/helpers/ship-queue-train-fixture.ts +++ b/test/helpers/ship-queue-train-fixture.ts @@ -44,7 +44,7 @@ export interface Rule { export interface ShimData { repo: string; origin: string; nextId: number; prs: Record; runs: Array>; artifacts: Record>; checks: Record>; - ci: Record; rules: Record; artifact: string; log: Array>; + ci: Record; ciFail?: string[]; rules: Record; artifact: string; log: Array>; /** Commit statuses (the legacy status API) at a sha, beside the check runs in `ci`. */ statuses?: Record>; /** Per PR, how many more `gh pr view` calls answer before the PR reads as not found (a GitHub answer that changes between two reads). */ @@ -206,6 +206,7 @@ function shimSource(): string { " const named = /commits\\/([0-9a-f]+)\\/check-runs\\?check_name=([^&]+)/.exec(a[1] || '');", " if (named) { const list = (d.checks[named[1]] || []).filter(c => c.name === decodeURIComponent(named[2])); out({ total_count: list.length, check_runs: list }); }", " const paged = /commits\\/([0-9a-f]+)\\/(check-runs|status)\\?.*page=(\\d+)/.exec(a[1] || '');", + " if (paged && (d.ciFail || []).includes(paged[1])) fail('HTTP 502: gateway timeout');", " if (paged) { const list = paged[2] === 'check-runs' ? (d.ci[paged[1]] || []) : ((d.statuses || {})[paged[1]] || []); const key = paged[2] === 'check-runs' ? 'check_runs' : 'statuses';", " out(paged[3] === '1' ? { total_count: list.length, state: 'success', [key]: list } : { total_count: list.length, [key]: [] }); }", "}", diff --git a/test/ship-queue-wave.test.ts b/test/ship-queue-wave.test.ts index e2132fd7c..d2f0a1ce2 100644 --- a/test/ship-queue-wave.test.ts +++ b/test/ship-queue-wave.test.ts @@ -12,7 +12,7 @@ import { spawnSync } from 'node:child_process'; import * as fs from 'node:fs'; import * as path from 'node:path'; import { EXIT } from '../lib/headless-artifacts'; -import { WAVE_HELP, areaKey, groupWaves, type PlanPr } from '../lib/ship-queue-wave'; +import { WAVE_HELP, areaKey, groupWaves, isHubFile, type PlanPr } from '../lib/ship-queue-wave'; import { cleanup, runBin } from './helpers/restamp-fixture'; import { line, openPr, queue, readyReceipt, shippedBody, trainFixture, type TrainFixture } from './helpers/ship-queue-train-fixture'; @@ -66,6 +66,19 @@ describe('areas and grouping', () => { ]); expect(solo).toEqual(['7']); }); + + test('groupWaves links PRs through a shared code file or skill template only when the merge conflicts there, never through a hub file (GST-770)', () => { + const pr = (n: string, files: string[]): PlanPr => ({ pr: n, head: n.repeat(40).slice(0, 40), files, lines: 10 }); + const areaOf = (f: string) => areaKey(f, d => d === 'ship'); + const linked = (files: string[], conflicts?: (a: PlanPr, b: PlanPr) => string[] | null) => + groupWaves([pr('1', ['lib/pregate-a.ts', 'test/pregate-a.test.ts', ...files]), pr('2', ['lib/review-b.ts', 'test/review-b.test.ts', ...files])], areaOf, 2, 6, conflicts).groups.map(g => g.prs.map(p => p.pr)); + expect(linked(['lib/ship-a.ts'])).toEqual([['1', '2']]); + expect(linked(['lib/ship-a.ts'], () => ['lib/ship-a.ts'])).toEqual([['1', '2']]); + expect(linked(['lib/ship-a.ts'], () => [])).toEqual([]); + expect(linked(['ship/SKILL.md.tmpl'], () => ['ship/SKILL.md.tmpl'])).toEqual([['1', '2']]); + for (const hub of ['docs/troubleshooting.md', 'ship/SKILL.md', 'scripts/harness-version.json']) expect(linked([hub], () => [hub])).toEqual([]); + expect([isHubFile('docs/x.ts'), isHubFile('TODOS.md'), isHubFile('test/fixtures/x.json'), isHubFile('ship/SKILL.md.tmpl'), isHubFile('lib/x.ts')]).toEqual([true, true, true, false, false]); + }); }); describe('wave build', () => { @@ -235,6 +248,7 @@ describe('ready and train build read the wave', () => { const pins = ['1', '2', '3', '4', '5', '6', '7'].map(pr => { const h = openPr(fx, pr, { file: pr === '7' ? 'docs/seven.md' : `lib/ship-${pr}.ts`, changelog: false }); readyReceipt(fx, pr, h); + fx.write(d => { d.ci[h] = [{ name: 'free-tests', status: 'completed', conclusion: 'success' }]; }); return `${pr}@${h}`; }); const build = queue(fx, ['train', 'build', '--prs', pins.join(','), '--dry-run']); @@ -246,6 +260,55 @@ describe('ready and train build read the wave', () => { expect(line(plan.out, 'SOLO:')).toContain('#7'); expect(line(queue(fx, ['wave', 'plan', '--trigger', '7']).out, 'WAVE:')).toContain('not needed'); }, 180_000); + + test('wave plan links PRs only on a real code conflict, so hub docs and ledgers do not chain areas together, and leaves out READY heads whose CI is not green (GST-770)', () => { + const fx = make(); + const moved = (first: string) => Array.from({ length: 10 }, (_, i) => i === 0 && first ? `export const o0 = '${first}';\n` : `export const o${i} = ${i};\n`).join(''); + const seed = { 'docs/troubleshooting.md': '# Troubleshooting\n', 'test/fixtures/ledger.json': '{}\n', 'lib/ship-a.ts': 'export const a = 0;\n', 'lib/ship-old.ts': moved('') }; + fx.repo.git('checkout', '-q', 'origin/main', '-B', 'seed'); + for (const [f, t] of Object.entries(seed)) { fs.mkdirSync(path.dirname(path.join(fx.repo.work, f)), { recursive: true }); fs.writeFileSync(path.join(fx.repo.work, f), t); } + fx.repo.git('add', '-A'); + fx.repo.git('commit', '-q', '-m', 'seed hub files'); + fx.repo.git('push', '-q', 'origin', 'HEAD:main'); + fx.repo.git('fetch', '-q', 'origin'); + const pr = (n: string, area: string, extra: Record = {}, ci = 'success') => { + fx.repo.git('checkout', '-q', 'origin/main', '-B', `pr-${n}`); + const files = { [`lib/${area}-${n}.ts`]: `export const x${n} = 1;\n`, [`test/${area}-${n}.test.ts`]: `// #${n}\n`, + 'docs/troubleshooting.md': `# Troubleshooting\n\n## #${n}\n`, 'test/fixtures/ledger.json': `{ "pr": ${n} }\n`, ...extra }; + for (const [f, t] of Object.entries(files)) if (t === null) fs.rmSync(path.join(fx.repo.work, f)); else fs.writeFileSync(path.join(fx.repo.work, f), t); + fx.repo.git('add', '-A'); + fx.repo.git('commit', '-q', '-m', `feat #${n}`); + const head = fx.repo.git('rev-parse', 'HEAD'); + fx.repo.git('push', '-q', '-f', 'origin', `HEAD:refs/pull/${n}/head`); + fx.write(d => { + d.prs[n] = { headRefOid: head, isCrossRepository: false, state: 'OPEN', headRefName: `pr-${n}`, url: `https://github.com/fixture/repo/pull/${n}`, body: shippedBody(n, head) }; + d.ci[head] = [{ name: 'free-tests', status: 'completed', conclusion: ci }]; + }); + readyReceipt(fx, n, head); + }; + pr('1', 'ship', { 'lib/ship-a.ts': Array.from({ length: 40 }, (_, i) => `export const a${i} = 'one';\n`).join('') }); + pr('2', 'ship', { 'lib/ship-old.ts': null, 'lib/ship-new.ts': moved('two') }); + pr('3', 'ship'); + for (const n of ['4', '5', '6']) pr(n, 'pregate'); + pr('8', 'review', { 'lib/ship-a.ts': "export const a = 'eight';\n" }); + pr('9', 'pregate', {}, 'failure'); + pr('10', 'pregate'); + pr('11', 'pregate', { 'lib/ship-old.ts': null, 'lib/ship-new.ts': moved('eleven') }); + fx.write(d => { d.ci[(d.prs['10'] as any).headRefOid] = [{ name: 'free-tests', status: 'in_progress', conclusion: null }]; }); + const plan = queue(fx, ['wave', 'plan']); + expect(plan.status).toBe(EXIT.ok); + expect(plan.out.split('\n').filter(l => l.startsWith('NOT_GREEN:')).map(l => l.replace(/ at [0-9a-f]{12} .*/, ''))).toEqual(['NOT_GREEN: #9 (red', 'NOT_GREEN: #10 (pending']); + expect(line(plan.out, 'QUEUE:')).toContain('8 live READY PR(s)'); + expect(plan.out.split('\n').filter(l => l.startsWith('WAVE_GROUP:'))).toEqual([ + 'WAVE_GROUP: area=pregate prs=#4,#5,#6 integrator=#4 (most changed lines)', + 'WAVE_GROUP: area=ship prs=#1,#8,#2,#11,#3 integrator=#1 (most changed lines)', + ]); + expect(line(plan.out, 'SOLO:')).toBe(''); + fx.write(d => { d.ciFail = [(d.prs['4'] as any).headRefOid]; }); + const unread = queue(fx, ['wave', 'plan']); + expect([unread.status, unread.err]).toEqual([EXIT.fail, expect.stringContaining('(QUEUE_PROOF_MISSING')]); + expect(unread.err).toContain('#4 (CI unknown at'); + }, 180_000); }); describe('wave settle', () => { From 4f5b043b3ea02f4fa9887c0122452856c045bb82 Mon Sep 17 00:00:00 2001 From: Garry Tan Date: Sun, 1 Nov 2026 08:28:03 -0800 Subject: [PATCH 2/9] v1.92.35.0 fix(pregate): a timeout-only policy keeps lane verdicts, warn lanes runs the tests, [] keeps removed-test suites (GST-775) (#3792) * fix(pregate): a lane-less policy keeps no-policy verdicts; warn lanes runs the tests; [] keeps removed-test suites (GST-775) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * test(pregate): warn lanes keeps a platform-only selection requires-remote (GST-775) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * test(pregate): a head policy that adds a lane over a lane-less base is strict (GST-775) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix(pregate): no empty no-lane line on mapped runs; trace [] refusals; absent lane flag stays strict (GST-775 review) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * docs(changelog): GST-775 pregate lane policy fragment Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * docs: recommended-harness no-policy row matches pregate (GST-775 docs audit) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> --------- Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> --- CHANGELOG.md | 7 + VERSION | 2 +- agents-digest/gstack-AGENTS.md | 2 +- docs/pregate.md | 24 ++- docs/recommended-harness.md | 2 +- docs/troubleshooting.md | 15 +- lib/pregate/checks/lanes.ts | 51 ++++-- lib/pregate/config.ts | 26 ++- lib/pregate/context.ts | 2 +- lib/pregate/head-policy.ts | 2 +- lib/pregate/index.ts | 4 +- lib/pregate/lane-selection.ts | 19 +- lib/pregate/starter.ts | 9 +- lib/pregate/types.ts | 2 + lib/result-codes-release.ts | 4 +- package.json | 2 +- test/pregate-policy-lane-verdicts.test.ts | 210 ++++++++++++++++++++++ test/pregate-starter.test.ts | 8 +- 18 files changed, 336 insertions(+), 55 deletions(-) create mode 100644 test/pregate-policy-lane-verdicts.test.ts diff --git a/CHANGELOG.md b/CHANGELOG.md index c9dab291f..fc4fff6ab 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,12 @@ # Changelog +## [1.92.35.0] - 2026-11-01 + +- **A `.gstack/pregate.json` that only raises `timeout_s` no longer changes lane verdicts, `warn: ["lanes"]` no longer lets a failing test pass, and a `[]` declaration no longer skips a deleted test's suite** (GST-775, from gbrain-evals #272 and GBEV-22). + - Before, any policy file, even `{"timeout_s": 1800}`, made a touched file with no test lane a hard `PREGATE_NO_LANE` that stopped before any test ran. Now only a policy that declares lanes (a `dependencies`, `empty_lanes`, `selection` or `local` key, even an empty one) does that. A policy with none of them keeps the no-policy verdict: `warn` `PREGATE_NO_POLICY` with a starter, the selected tests run, and a red test is still `PREGATE_LANE_FAILED`. A hand-written policy that sets only `runner`, `guards`, `strays`, `allowlist` or `remote_gate` moves from the hard failure to that warning; add `dependencies` to keep unmapped files failing. See docs/pregate.md#lane-requirements. + - `warn: ["lanes"]` used to downgrade the missing-lane failure before the tests ran, so a red test beside an unmapped file passed. Now the selected tests run first. A red lane is `fail`, an unfinished one `incomplete`, a test only a platform lane runs stays `requires-remote`, and only a green run becomes `warn` `PREGATE_NO_LANE` naming the unmapped files. + - A `[]` declaration that matches a deleted test (the `"**": []` catch-all) used to clear it before the removed-test handling, so its owning suite did not run. Now the deleted test still runs its owning suite, and a file naming it that a `[]` covers, such as a durations list, counts as covered. + ## [1.92.34.0] - 2026-11-01 - `gstack-ship-queue wave plan` no longer packs the whole READY queue into one area. Shared files now link two PRs into one group only when `git merge-tree` finds a real conflict between them in a code file or skill template. PRs of the same area still pack together as before. Docs, other Markdown and JSON ledgers never link PRs, since most PRs add to them. Before, any shared file linked two PRs, so `docs/troubleshooting.md` and a few ledgers chained 55 READY PRs into eight waves all labeled `setup`. With this change, the 57-PR queue later that day gives five groups split by area. A READY head whose CI is red or still running now prints `NOT_GREEN: # (...)` and stays out of the plan, as `ready` would refuse it. A head whose CI cannot be read fails the plan with `QUEUE_PROOF_MISSING`, the same as an unreadable PR. Renamed files are compared by their real paths (GST-770). diff --git a/VERSION b/VERSION index 64d2db59e..a2a712ec1 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -1.92.34.0 +1.92.35.0 diff --git a/agents-digest/gstack-AGENTS.md b/agents-digest/gstack-AGENTS.md index a945033ba..b44d844b5 100644 --- a/agents-digest/gstack-AGENTS.md +++ b/agents-digest/gstack-AGENTS.md @@ -1,4 +1,4 @@ -# gstack digest v1.92.34.0 — regenerate/re-copy after upgrading gstack +# gstack digest v1.92.35.0 — regenerate/re-copy after upgrading gstack Behavioral rules from gstack (https://github.com/garrytan/gstack), compressed for agent hosts without a full skill install. The full skills add workflows, diff --git a/docs/pregate.md b/docs/pregate.md index e6d45e4da..707cc6f72 100644 --- a/docs/pregate.md +++ b/docs/pregate.md @@ -75,10 +75,10 @@ the byte-pinned `/ship` renders in `test/fixtures/golden/`). | Key | Meaning | |---|---| | `runner` | the local test command with `{files}` (gstack: `bun test {files}`); unset, it is detected (bun, vitest, jest, pytest, `node --test`, and `flutter test`/`dart test` per Dart package root, through fvm when that package or an ancestor pins it with `.fvmrc` or `.fvm/fvm_config.json` and fvm is on PATH; `cargo test -p ` per Rust crate, run from the root of the workspace the crate is a member of (Cargo's `members` globs, `exclude` and `package.workspace`), else the crate directory; a JS/TS test whose nearest package.json is a nested package declaring vitest or jest (a dependency or its `test` script) runs from that package, with package-relative paths, through the package manager its `packageManager` field or the nearest lockfile up to the repo root names: `pnpm exec`, `yarn`, `bun x`, else `npx`; every other JS/TS test keeps the root detection); nothing detected, a Dart SDK, cargo or package manager missing from PATH, a `.dart` file with no `pubspec.yaml` above it, a `.rs` file outside any crate, or one in a crate whose name Cargo would reject (anything but letters, digits, `_` and `-`), is `incomplete` (the runnable groups still run, so a real failure still fails) | -| `dependencies` | glob → test files for subprocess targets, runtime reads and generated inputs the import graph cannot see; `[]` declares "no lane needed" (docs, licences) | +| `dependencies` | glob → test files for subprocess targets, runtime reads and generated inputs the import graph cannot see; `[]` declares "no lane needed" (docs, licences). A `[]` that matches a deleted test does not skip it: the deleted test still runs its owning suite, and a file naming it that `[]` covers (a durations list) counts as covered. With this key present, even empty, the policy [declares lanes](#lane-requirements) | | `empty_lanes` | extra globs for the docs/no-tests empty lane. Any Markdown file already qualifies with no pin file when no test depends on it (the same import graph as other files: a quoted path, a `join()` of path segments, an import, or a `dependencies` entry). reStructuredText and AsciiDoc count as Markdown here. README, CHANGELOG, CONTRIBUTING, LICENSE, AGENTS and CLAUDE qualify even without `.md`, and so does licence text under any vendored name (`roboto-LICENSE.txt`, `LICENSE-MIT`, `licenses/*.txt`). Source code and files under a test directory never qualify. A test that reads the file still selects that test | | `selection` | `workflow.yml/job` → a command printing the lane's file list, for matrices a planner computes (gstack: `scripts/test-free-shards.ts --list`) | -| `warn` | check ids downgraded to warn; `secrets` and required lanes never | +| `warn` | check ids downgraded to warn; `secrets` and required lanes never. `"lanes"` downgrades only a touched file with no lane: the selected tests still run, a red lane stays `fail` (`PREGATE_LANE_FAILED`) and an unfinished one `incomplete`; a green run is `warn` `PREGATE_NO_LANE` naming the unmapped files | | `strays.allow` | intentional root files or new top-level directories | | `local` | `workflow.yml/job` lanes a local run satisfies: a platform-agnostic toolchain (an `ubuntu-latest` suite that runs the same on a Mac), or a repo whose CI is off. Their tests run here instead of becoming `requires-remote`, except that on a machine under 8 cores with a `remote_gate` or a remote `test_backend` the small-machine rule still records the test tier as a `requires-remote` obligation. `--explain` notes an id that matches no workflow lane | | `guards` | `[{ id, when: [globs], command, fix?, timeout_s? }]`: repo commands a lane must pass when a touched file matches `when` (manifest checks, subprocess goldens the import graph cannot see); see [guards](#guards) | @@ -141,6 +141,19 @@ unmapped file is `PREGATE_NO_LANE` again: the warning is for the first /ship in a new repository (three Captains lost their first pass to it), never a way to hide missing coverage. `--policy-from head` with a head policy is strict too. + +**Lane requirements.** "Any policy" above means a policy that declares lanes: +one with a `dependencies`, `empty_lanes`, `selection` or `local` key, even an +empty one (`gstack-pregate init` writes the first three). A policy with none of +them, such as +`{"timeout_s": 1800}` to give long tests more time, keeps the no-policy lane +verdicts: an unmapped file is the `warn` `PREGATE_NO_POLICY`, the selected +tests run, a red lane is `fail`, and the starter says the active policy +declares no lanes instead of claiming there is none. So raising +`timeout_s` never needs a `"**": []` catch-all. Add `dependencies` when you +want unmapped files to fail. The same rule applies to the user-owned file and to +a `--policy-from head` bootstrap (gbrain-evals #272, GST-775). + `gstack-pregate init` writes a draft built from the repo, not a fixed example. It prints the languages it found and the runner each language's tests would get, then maps every file the import graph cannot place to the tests of the @@ -266,9 +279,10 @@ Two stages with separate clocks, both printed: `.cjs`, `.mts`, `.cts`, then `index.ts`, `index.tsx`, `index.js`, `index.jsx` and `index.mjs` inside the directory; the first file that exists wins. A touched source file with no lane is `FAIL lanes — has no test lane` - once any policy exists (the base copy, the user-owned file or `--policy-from - head`); with no policy anywhere it is the `warn` `PREGATE_NO_POLICY` with a - starter printed ([no policy](#no-policy)); never a pass. Markdown that no + once a policy that [declares lanes](#lane-requirements) exists (the base copy, + the user-owned file or `--policy-from head`); with no policy anywhere, or one + that declares no lanes, it is the `warn` `PREGATE_NO_POLICY` with a starter + printed ([no policy](#no-policy)); never a pass. Markdown that no test depends on is a docs/no-tests empty lane instead (`docs/no-tests: N documentation file(s)`), including when the base branch has no `.gstack/pregate.json`. The dependency is the same import graph diff --git a/docs/recommended-harness.md b/docs/recommended-harness.md index 3486b131f..9e16984c3 100644 --- a/docs/recommended-harness.md +++ b/docs/recommended-harness.md @@ -82,7 +82,7 @@ a time; each is independent. | File | Why | Without it | |---|---|---| -| `.gstack/pregate.json` | Maps changed paths to test lanes, so `/ship` runs the tests that cover the diff and the remote gate selects correctly ([docs/pregate.md](pregate.md)) | `/ship` fails every touched file with `PREGATE_NO_LANE`. Write it once, from one owner, before the crew starts. | +| `.gstack/pregate.json` | Maps changed paths to test lanes, so `/ship` runs the tests that cover the diff and the remote gate selects correctly ([docs/pregate.md](pregate.md)) | `/ship` warns on every touched file with no test lane (`PREGATE_NO_POLICY`) and prints a starter policy; the selected tests still run. A policy that sets only `timeout_s` or other keys without `dependencies`, `empty_lanes`, `selection` or `local` behaves the same. Write it once, from one owner, before the crew starts. | | `.gstack/ship-policy.json` | `queue_mode`, the `train` block (gate and free workflow names, the full-gate check, the train size and fill wait), the stamp files ([docs/ship-policy.md](ship-policy.md)) | Per-PR queue; `train …` refuses with `QUEUE_TRAIN_OFF`. | | `CHANGELOG.md` + `VERSION` | A stamp per merge and a twice-weekly release with notes ([docs/releases.md](releases.md)) | Skip the version and changelog steps; the train still works on the tree receipt. | | `AGENTS.md` validation discipline | Diagnose before fixing, focused checks during repair, one full suite at the end on a frozen tree | Threads retry blindly and report passes from older revisions. | diff --git a/docs/troubleshooting.md b/docs/troubleshooting.md index 2fb72daf8..575871a04 100644 --- a/docs/troubleshooting.md +++ b/docs/troubleshooting.md @@ -3561,9 +3561,12 @@ never runs them: declare `"**/integration_test/**": []` (and them. A `[]` declaration added only on the branch is refused under `--policy-from head` ([`PREGATE_HEAD_POLICY_LOOSENS`](#pregate-head-policy-loosens)), so land it in its own PR first. -With no policy anywhere (no base copy, no user-owned file) an unmapped file is +With no policy anywhere (no base copy, no user-owned file), or a policy with no +`dependencies`, `empty_lanes`, `selection` or `local` key (a timeout-only file), an unmapped file is the warning [`PREGATE_NO_POLICY`](#pregate-no-policy) with a starter policy -printed, not this error; `gstack-pregate init` writes that draft and lists the +printed, not this error. Under `warn: ["lanes"]` it is a `warn` with this code, +given only after the selected tests ran green (a red lane is still +`PREGATE_LANE_FAILED`); `gstack-pregate init` writes that draft and lists the files it could not place. `--explain` prints every mapping and why. For a file with no lane it also prints the import specifiers in test files that resolved to no repo file (for example a `tsconfig.json` `paths` alias such as `@/lib/x` whose target is missing) and any @@ -3701,8 +3704,9 @@ differing path is a change. ### `PREGATE_NO_POLICY` **Meaning.** The repository has no pregate policy yet (no `.gstack/pregate.json` -on the base branch and no user-owned `/projects//pregate.json`) -and a touched file maps to no test lane. Under no policy that is a `warn`, not +on the base branch and no user-owned `/projects//pregate.json`), +or its policy declares no lanes (no `dependencies`, `empty_lanes`, `selection` or `local` key, a +timeout-only file for example), and a touched file maps to no test lane. Under no policy that is a `warn`, not `PREGATE_NO_LANE`: the selected tests still ran (a red lane is still `fail`), and the table printed a starter policy drafted from the repository (`PREGATE_STARTER:` lines: runner, test directories, CI lanes, the JSON between @@ -3713,7 +3717,8 @@ Details: [docs/pregate.md](pregate.md#no-policy). overwrite an existing file without `--force`), edit each `TODO` (a test that names the file, a `dependencies` entry, or `[]` for a file with no behaviour), run `gstack-pregate validate`, then commit `.gstack/pregate.json` on the base -branch. From then on an unmapped file is `PREGATE_NO_LANE`. +branch. When a policy already exists, add the starter's `dependencies` to it +instead. From then on an unmapped file is `PREGATE_NO_LANE`. ### `PREGATE_ENVIRONMENT` diff --git a/lib/pregate/checks/lanes.ts b/lib/pregate/checks/lanes.ts index f1206404c..58458d39a 100644 --- a/lib/pregate/checks/lanes.ts +++ b/lib/pregate/checks/lanes.ts @@ -4,10 +4,12 @@ * `set -o pipefail` with the exit code and the runner's own summary judged * (zero tests ran is a failure, exit 0 or not); platform lanes this machine * cannot run become persisted `requires-remote` obligations. A touched file - * with no lane is `FAIL lanes — has no test lane` once any policy - * exists; with no policy anywhere (no base `.gstack/pregate.json`, no - * user-owned file) it is the `warn` PREGATE_NO_POLICY with a starter printed - * (lib/pregate/starter.ts), never a pass either way. + * with no lane is `FAIL lanes — has no test lane` once the policy + * declares lanes (a `dependencies`, `empty_lanes`, `selection` or `local` key); with no policy + * anywhere, or one that declares neither (a timeout-only file), it is the + * `warn` PREGATE_NO_POLICY with a starter printed (lib/pregate/starter.ts), + * never a pass either way. `warn: ["lanes"]` downgrades only that condition: + * the selected tests still run and a red lane stays `fail` (GST-775). * Markdown no test depends on is the docs/no-tests empty lane instead * (lib/pregate/docs-lane.ts): it does not fail, and unmapped code still does. * A release manifest whose diff against the merge base changes only version @@ -347,8 +349,15 @@ function unfinished(ctx: PregateContext, r: Awaited> return { code: 'PREGATE_INCOMPLETE', detail: `a runner process timed out after ${ctx.timeoutMs} ms (${ctx.timeoutSource ?? '--timeout'} applies to each runner process; ${total} files; last file started: ${timedOut.map(x => x.lastFile ?? `(none reported; ${x.files.length} file(s))`).join(', ')}${rest})`, fix: 'raise --timeout or split the selection; a timed-out lane never passes' }; } -function describe(sel: Selection, noPolicy = false): string[] { - const lines = noPolicy ? [`no policy: ${sel.noLane.join(' ')} have no test lane (a warning under no policy; the starter below maps them)`] : sel.noLane.map(f => `FAIL lanes — ${f} has no test lane`); +/** How a touched file with no lane is judged: the no-policy warning, the `warn: ["lanes"]` downgrade, or the hard PREGATE_NO_LANE. */ +type NoLaneMode = 'no-policy' | 'warned' | 'strict'; + +function describe(ctx: PregateContext, sel: Selection, mode: NoLaneMode): string[] { + const lines = !sel.noLane.length ? [] + : mode === 'warned' ? sel.noLane.map(f => `WARN lanes — ${f} has no test lane (warn: ["lanes"] in ${ctx.configLabel}; the selected tests are still judged)`) + : mode === 'strict' ? sel.noLane.map(f => `FAIL lanes — ${f} has no test lane`) + : ctx.configKind === 'none' ? [`no policy: ${sel.noLane.join(' ')} have no test lane (a warning under no policy; the starter below maps them)`] + : [`no lane policy: ${sel.noLane.join(' ')} have no test lane (a warning while ${ctx.configLabel} declares no dependencies, empty_lanes, selection or local; the starter below maps them)`]; for (const r of sel.removed) lines.push(`removed (no lane owed): ${r.file} — ${r.note}`); if (sel.emptyLane.length) lines.push(`docs/no-tests (empty lane): ${sel.emptyLane.join(' ')}`); if (sel.inert.length) lines.push(`no-tests (assets and tool config): ${sel.inert.join(' ')}`); @@ -500,9 +509,25 @@ async function runSelected(ctx: PregateContext, sel: Selection, base: CheckResul */ function withStarter(ctx: PregateContext, sel: Selection, result: CheckResult): CheckResult { const lines = [...(result.lines ?? []), ...starterPolicy(ctx, sel.noLane, detectRunner(ctx, sel.localTests.length ? sel.localTests : sel.tests))]; - const noted = `${sel.noLane.length} touched file(s) with no test lane under no policy (starter printed)`; + const noted = `${sel.noLane.length} touched file(s) with no test lane under ${ctx.configKind === 'none' ? 'no policy' : 'a policy that declares no lanes'} (starter printed)`; if (result.status !== 'pass') return { ...result, lines, detail: `${result.detail}; ${noted}`, ...(result.status === 'requires-remote' && !result.code ? { code: 'PREGATE_NO_POLICY' } : {}) }; - return { ...result, status: 'warn', code: 'PREGATE_NO_POLICY', lines, detail: `${result.detail}; ${noted}`, fix: `review the starter above, write it with gstack-pregate init, edit each TODO, then commit ${PREGATE_CONFIG_PATH} on the base branch; from then on an unmapped file is PREGATE_NO_LANE` }; + const fix = ctx.configKind === 'none' + ? `review the starter above, write it with gstack-pregate init, edit each TODO, then commit ${PREGATE_CONFIG_PATH} on the base branch; from then on an unmapped file is PREGATE_NO_LANE` + : `review the starter above and add its dependencies to ${ctx.configFile}${ctx.configKind === 'user' ? '' : ' on the base branch'}, editing each TODO; from then on an unmapped file is PREGATE_NO_LANE`; + return { ...result, status: 'warn', code: 'PREGATE_NO_POLICY', lines, detail: `${result.detail}; ${noted}`, fix }; +} + +/** + * `warn: ["lanes"]` under a policy that declares lanes: the selected tests ran + * and their verdict stands (a red lane is still `fail`, an unfinished one + * `incomplete`); only a green run becomes `warn` PREGATE_NO_LANE naming the + * files with no lane. Before GST-775 the downgraded failure returned before + * any test ran, so a red test beside an unmapped file passed. + */ +function withNoLaneWarning(ctx: PregateContext, sel: Selection, result: CheckResult): CheckResult { + const noted = `${sel.noLane.length} touched file(s) with no test lane: ${sel.noLane.join(' ')} (downgraded to warn by ${ctx.configLabel})`; + if (result.status !== 'pass') return { ...result, detail: `${result.detail}; ${noted}`, ...(result.status === 'requires-remote' && !result.code ? { code: 'PREGATE_NO_LANE' } : {}) }; + return { ...result, status: 'warn', code: 'PREGATE_NO_LANE', detail: `${result.detail}; ${noted}`, fix: noLaneFix(ctx, sel.noLane) }; } async function run(ctx: PregateContext): Promise { @@ -510,16 +535,18 @@ async function run(ctx: PregateContext): Promise { ctx.explain.push(...sel.provenance); for (const [lane, set] of Object.entries(sel.laneSets)) ctx.explain.push(`lane ${lane}: ${set === '?' ? 'file set unknown' : `${set.length} files`}`); const inputs = baseInputs(ctx, { selection: sha256(sel.tests.join('\n')), localTests: sha256(sel.localTests.join('\n')), remote: sha256(sel.remote.map(r => `${r.lane}:${r.tests.join(',')}`).join('\n')) }); - const noPolicy = sel.noLane.length > 0 && ctx.configKind === 'none'; - const base: CheckResult = { id: 'lanes', stage: 'tests', status: 'pass', inputs, lines: describe(sel, noPolicy), remote: sel.remote }; + const declared = ctx.configKind !== 'none' && ctx.policyDeclaresLanes !== false; + const mode: NoLaneMode = !declared ? 'no-policy' : ctx.config.warn.includes('lanes') ? 'warned' : 'strict'; + const base: CheckResult = { id: 'lanes', stage: 'tests', status: 'pass', inputs, lines: describe(ctx, sel, mode), remote: sel.remote }; const lost = new Set(sel.removed.flatMap(r => r.lostCoverage)).size; const removedNote = sel.removed.length ? `${sel.removed.length} removed path(s)${lost ? `; ${lost} subject(s) lost their last test` : ''}` : ''; const withRemoved = (r: CheckResult): CheckResult => (removedNote ? { ...r, detail: r.detail ? `${r.detail}; ${removedNote}` : removedNote } : r); - if (sel.noLane.length && !noPolicy) { + if (sel.noLane.length && mode === 'strict') { return withRemoved({ ...base, status: 'fail', cause: 'diff', code: 'PREGATE_NO_LANE', detail: `${sel.noLane.length} touched file(s) with no test lane: ${sel.noLane.join(' ')}`, fix: noLaneFix(ctx, sel.noLane) }); } const result = withRemoved(await runSelected(ctx, sel, base)); - return noPolicy ? withStarter(ctx, sel, result) : result; + if (!sel.noLane.length) return result; + return mode === 'no-policy' ? withStarter(ctx, sel, result) : withNoLaneWarning(ctx, sel, result); } /** diff --git a/lib/pregate/config.ts b/lib/pregate/config.ts index b30ad4c83..ac2a511d1 100644 --- a/lib/pregate/config.ts +++ b/lib/pregate/config.ts @@ -13,8 +13,9 @@ * depends on it; source code and test trees never do) * selection `/` → the runner-owned command that lists * the lane's test files when the matrix is planner-computed - * warn check ids downgraded to warn (never `secrets`; `lanes` keeps - * its required-lane and requires-remote verdicts) + * warn check ids downgraded to warn (never `secrets`; `lanes` + * downgrades only a touched file with no lane, after the + * selected tests ran: a red lane stays `fail`) * strays.allow root files or new top-level directories that are intentional * local `/` lanes a local run satisfies (a * platform-agnostic toolchain, or a repo whose CI is off): @@ -49,6 +50,11 @@ * `env.value` (a configured credential's real value) and never * the whole `secret` category * + * A policy declares lanes when it has a `dependencies`, `empty_lanes`, + * `selection` or `local` key (LANE_KEYS), even an empty one; only then is a touched file with no lane + * the hard PREGATE_NO_LANE. A policy without either (a timeout-only file) + * keeps the no-policy lane verdicts (lib/pregate/checks/lanes.ts). + * * A repo that keeps `.gstack/` out of git can hold the same file at * `/projects//pregate.json` (lib/state-root.ts), honoured * only when the base carries none. It must sit outside the repo, so a PR @@ -254,17 +260,20 @@ export function validateConfig(raw: unknown, knownChecks: readonly string[] = [] return errors; } -export function parseConfig(text: string, knownChecks: readonly string[] = []): { config: PregateConfig; errors: ConfigError[] } { +/** The keys that declare lanes: with either present, a touched file with no lane is PREGATE_NO_LANE. */ +export const LANE_KEYS = ['dependencies', 'empty_lanes', 'selection', 'local'] as const; + +export function parseConfig(text: string, knownChecks: readonly string[] = []): { config: PregateConfig; errors: ConfigError[]; declaresLanes: boolean } { let raw: unknown; try { raw = JSON.parse(text); } - catch (e: any) { return { config: DEFAULT_CONFIG, errors: [{ code: 'PREGATE_CONFIG_INVALID', path: PREGATE_CONFIG_PATH, message: `not valid JSON: ${e.message}` }] }; } + catch (e: any) { return { config: DEFAULT_CONFIG, errors: [{ code: 'PREGATE_CONFIG_INVALID', path: PREGATE_CONFIG_PATH, message: `not valid JSON: ${e.message}` }], declaresLanes: false }; } const errors = validateConfig(raw, knownChecks); - if (errors.length) return { config: DEFAULT_CONFIG, errors }; + if (errors.length) return { config: DEFAULT_CONFIG, errors, declaresLanes: false }; const o = raw as Partial; - return { config: { $schema: o.$schema, runner: o.runner ?? null, dependencies: o.dependencies ?? {}, empty_lanes: o.empty_lanes ?? [], selection: o.selection ?? {}, warn: o.warn ?? [], strays: { allow: o.strays?.allow ?? [] }, local: o.local ?? [], guards: o.guards ?? [], serial_patterns: o.serial_patterns ?? DEFAULT_SERIAL_PATTERNS, price_file: o.price_file ?? null, stall_timeout_s: o.stall_timeout_s ?? null, timeout_s: o.timeout_s ?? null, remote_gate: o.remote_gate ?? null, allowlist: o.allowlist ?? [], run_profiles: o.run_profiles ?? {}, remote_gate_runs: o.remote_gate_runs ?? null }, errors: [] }; + return { declaresLanes: LANE_KEYS.some(k => k in o), config: { $schema: o.$schema, runner: o.runner ?? null, dependencies: o.dependencies ?? {}, empty_lanes: o.empty_lanes ?? [], selection: o.selection ?? {}, warn: o.warn ?? [], strays: { allow: o.strays?.allow ?? [] }, local: o.local ?? [], guards: o.guards ?? [], serial_patterns: o.serial_patterns ?? DEFAULT_SERIAL_PATTERNS, price_file: o.price_file ?? null, stall_timeout_s: o.stall_timeout_s ?? null, timeout_s: o.timeout_s ?? null, remote_gate: o.remote_gate ?? null, allowlist: o.allowlist ?? [], run_profiles: o.run_profiles ?? {}, remote_gate_runs: o.remote_gate_runs ?? null }, errors: [] }; } -export type ConfigLoad = { config: PregateConfig; errors: ConfigError[]; present: boolean; label: string; kind: 'base' | 'head' | 'user' | 'none'; /** sha256 of the user file's bytes (kind 'user' only). */ digest?: string } | { unavailable: true; base: string; detail: string }; +export type ConfigLoad = { config: PregateConfig; errors: ConfigError[]; present: boolean; label: string; kind: 'base' | 'head' | 'user' | 'none'; /** sha256 of the user file's bytes (kind 'user' only). */ digest?: string; /** The policy has a LANE_KEYS key; absent under kind 'none'. */ declaresLanes?: boolean } | { unavailable: true; base: string; detail: string }; function git(cwd: string, args: string[]): { ok: boolean; out: string } { const r = spawnSync('git', args, { cwd, encoding: 'utf8', timeout: 30_000 }); @@ -333,7 +342,8 @@ export function explainConfig(): string { 'dependencies: glob → test files the import graph cannot see (subprocess targets, runtime reads, generated inputs); [] declares no lane needed', 'empty_lanes: extra globs treated as docs/no-tests when nothing else maps them. Built-in, with or without this file: any Markdown file the import graph maps to no test (a quoted path, a join() of path segments, an import, or a dependencies entry), plus README/CHANGELOG/CONTRIBUTING/LICENSE/AGENTS/CLAUDE and licence text under any name; assets (images, fonts, media) and allowlisted tool config take their own empty lane. Source code and files under a test directory never qualify. A test that reads the file still selects that test', 'selection: / → the runner-owned command that lists that lane’s test files when its matrix is planner-computed', - `warn: check ids downgraded to warn; never ${NON_DOWNGRADABLE.join(', ')}; lanes keeps its required-lane and requires-remote verdicts`, + `warn: check ids downgraded to warn; never ${NON_DOWNGRADABLE.join(', ')}; lanes downgrades only a touched file with no lane, after the selected tests ran (a red lane stays fail)`, + `lane requirements: a policy with any of ${LANE_KEYS.join(', ')} (even empty) makes a touched file with no lane PREGATE_NO_LANE; a policy with none of them (timeout_s only, say) keeps the no-policy warning (PREGATE_NO_POLICY) and starter`, 'strays.allow: root files or new top-level directories that are intentional', 'local: / lanes a local run satisfies (platform-agnostic toolchain, or CI off); their tests run here, not requires-remote', 'guards: [{ id, when: [globs], command, fix?, timeout_s? }]: each guard whose globs match a touched file runs in its own process (--allow-repo-commands); a failure fails pregate with the guard id and fix; never downgradable', diff --git a/lib/pregate/context.ts b/lib/pregate/context.ts index 5ed06266f..b745cb5fc 100644 --- a/lib/pregate/context.ts +++ b/lib/pregate/context.ts @@ -247,7 +247,7 @@ export function buildContext(o: BuildContextOptions): ContextLoad { return { ctx: { repoRoot: o.repoRoot, base, baseRef, baseSha: baseSha.out, mergeBase, head, wtree, touched: touchedFiles(o.repoRoot, mergeBase), - config, configLabel: configLoad.label, configKind: configLoad.kind, scratch, configFile: configLoad.kind === 'user' && o.userConfigPath ? o.userConfigPath : PREGATE_CONFIG_PATH, ...(configLoad.digest ? { configDigest: configLoad.digest } : {}), ...(absentUserPolicy ? { absentUserPolicy } : {}), registry: registryLoad.registry as Registry, registryLabel: registryLoad.source.label, + config, configLabel: configLoad.label, configKind: configLoad.kind, policyDeclaresLanes: configLoad.declaresLanes !== false, scratch, configFile: configLoad.kind === 'user' && o.userConfigPath ? o.userConfigPath : PREGATE_CONFIG_PATH, ...(configLoad.digest ? { configDigest: configLoad.digest } : {}), ...(absentUserPolicy ? { absentUserPolicy } : {}), registry: registryLoad.registry as Registry, registryLabel: registryLoad.source.label, lanes, platform, allowRepoCommands: o.allowRepoCommands, timeoutMs: o.timeoutMs ?? (config.timeout_s ?? 600) * 1000, timeoutSource: o.timeoutMs !== undefined ? '--timeout' : config.timeout_s ? `timeout_s from ${configLoad.label}` : 'the 600 s default', stallTimeoutMs: o.stallTimeoutMs ?? (config.stall_timeout_s ?? DEFAULT_STALL_TIMEOUT_S) * 1000, progress: o.progress ?? (line => process.stderr.write(`${line}\n`)), diff --git a/lib/pregate/head-policy.ts b/lib/pregate/head-policy.ts index 9ef2dd062..0d898cef6 100644 --- a/lib/pregate/head-policy.ts +++ b/lib/pregate/head-policy.ts @@ -66,7 +66,7 @@ export function headPolicy(repoRoot: string, trusted: Loaded, mergeBase: string, for (const [glob, tests] of Object.entries(adds)) dependencies[glob] = [...new Set([...(dependencies[glob] ?? []), ...tests])]; const n = Object.keys(adds).length; return { - load: { ...trusted, config: { ...trusted.config, dependencies }, kind: 'head', label: `head (unreviewed) ${PREGATE_CONFIG_PATH}: adds ${n} lane${n === 1 ? '' : 's'} over ${trusted.label}` }, + load: { ...trusted, config: { ...trusted.config, dependencies }, declaresLanes: trusted.declaresLanes === true || head.declaresLanes === true, kind: 'head', label: `head (unreviewed) ${PREGATE_CONFIG_PATH}: adds ${n} lane${n === 1 ? '' : 's'} over ${trusted.label}` }, explain: Object.entries(adds).map(([glob, tests]) => `head policy adds: dependencies[${JSON.stringify(glob)}] → ${tests.join(', ')}`), }; } diff --git a/lib/pregate/index.ts b/lib/pregate/index.ts index 81233836c..aea1fc748 100644 --- a/lib/pregate/index.ts +++ b/lib/pregate/index.ts @@ -37,12 +37,12 @@ export const PREGATE_TIER2 = ['ratchets', 'lint', 'links', 'hermetic', 'patches' export interface RunOptions { stage: Stage | 'all'; only?: string[]; run?: string } -/** Apply the repo's `warn` downgrades: never `secrets`, and never a lane that could run here and failed. */ +/** Apply the repo's `warn` downgrades: never `secrets`. `lanes` applies its own (a touched file with no lane, after the selected tests ran), so nothing it fails is downgraded here. */ export function applyDowngrades(ctx: PregateContext, result: CheckResult, def: CheckDef): CheckResult { if (result.status !== 'fail') return result; if (!def.downgradable || (NON_DOWNGRADABLE as readonly string[]).includes(def.id)) return result; if (!ctx.config.warn.includes(def.id)) return result; - if (def.id === 'lanes' && result.code === 'PREGATE_LANE_FAILED') return { ...result, detail: `${result.detail} (required lane; warn downgrade does not apply)` }; + if (def.id === 'lanes') return result.code === 'PREGATE_LANE_FAILED' ? { ...result, detail: `${result.detail} (required lane; warn downgrade does not apply)` } : result; return { ...result, status: 'warn', detail: `${result.detail} (downgraded to warn by ${ctx.configLabel})` }; } diff --git a/lib/pregate/lane-selection.ts b/lib/pregate/lane-selection.ts index 5ca134179..ffa5347d4 100644 --- a/lib/pregate/lane-selection.ts +++ b/lib/pregate/lane-selection.ts @@ -165,7 +165,7 @@ function removedPath(ctx: PregateContext, graph: Graph, gone: ReadonlySet !gone.has(f)).filter(n => { const m = testsFor(graph, n, ctx.config.dependencies); for (const t of m.tests) namerSuite.add(t); - return !m.tests.length; + return !m.tests.length && !m.declaredNone; }); if (uncovered.length) return { refused: `removed, but still named by ${shown(uncovered)}, which no test covers` }; const namerNote = namerSuite.size ? `files naming it run: ${shown([...namerSuite].sort())}` : ''; @@ -211,6 +211,11 @@ export function selectLanes(ctx: PregateContext): Selection { const stampOnly: string[] = []; const seeds = new Map(); const touchedByPath = new Map(touched.map(t => [t.path, t])); + const waive = (file: string, r: { removed: Removed; suite: string[] }) => { + removed.push(r.removed); + for (const t of r.suite) tests.add(t); + provenance.push(`${file}: removed (no lane owed) — ${r.removed.note}`); + }; for (const t of touched) { seeds.set(t.path, t.status === 'D' ? 'deleted' : 'touched'); if (t.renamedFrom) seeds.set(t.renamedFrom, `renamed to ${t.path}`); } for (const e of ctx.registry.entries) { if (!touched.some(t => matchesAny(e.inputs, t.path) || matchesAny(e.outputs, t.path))) continue; @@ -221,8 +226,11 @@ export function selectLanes(ctx: PregateContext): Selection { for (const t of m.tests) tests.add(t); provenance.push(...m.provenance.map(p => `${p} [${why}]`)); if (m.tests.length || why.startsWith('generated')) continue; - // An explicit `[]` already cleared the file. Label it docs/no-tests only when it is that class. + // An explicit `[]` already cleared the file. A removed test still runs its owning suite; label the rest docs/no-tests only when it is that class. if (m.declaredNone) { + const r = gone.includes(file) ? removedPath(ctx, graph, goneSet, file) : null; + if (r && 'removed' in r) { waive(file, r); continue; } + if (r) provenance.push(`${file}: ${r.refused}; cleared by its [] declaration`); if (isDocsEmptyLane(file, ctx.config.empty_lanes ?? [])) emptyLane.push(file); continue; } @@ -259,12 +267,7 @@ export function selectLanes(ctx: PregateContext): Selection { } if (gone.includes(file)) { const r = removedPath(ctx, graph, goneSet, file); - if ('removed' in r) { - removed.push(r.removed); - for (const t of r.suite) tests.add(t); - provenance.push(`${file}: removed (no lane owed) — ${r.removed.note}`); - continue; - } + if ('removed' in r) { waive(file, r); continue; } provenance.push(`${file}: ${r.refused}; no lane until declared`); } noLane.push(file); diff --git a/lib/pregate/starter.ts b/lib/pregate/starter.ts index 8ed5a3954..2e27af84f 100644 --- a/lib/pregate/starter.ts +++ b/lib/pregate/starter.ts @@ -2,7 +2,8 @@ * pregate/starter — the policy a repository with none would start from * (Lane D, GSTA-112; FOUN #292, harness-evals #81/#82). When no * `.gstack/pregate.json` exists on the base branch and no user-owned file is - * present, the lanes check does not fail a touched file with no lane + * present, or the active policy declares no lanes (no `dependencies` or + * `empty_lanes`, `selection` or `local` key, GST-775), the lanes check does not fail a touched file with no lane * (PREGATE_NO_LANE); it warns (PREGATE_NO_POLICY) and prints this starter: * the detected runner, a `dependencies` entry for each unmapped touched file * (the tests nearest it, else the tests sharing its stem; never `[]`, which @@ -29,7 +30,7 @@ export function nearestTestsFor(tests: readonly string[], file: string): string[ } /** The starter for `noLane` (touched files with no lane) under `runner` (detected by the lanes check; null when none). */ -export function starterPolicy(ctx: Pick, noLane: readonly string[], runner: string | null): string[] { +export function starterPolicy(ctx: Pick, noLane: readonly string[], runner: string | null): string[] { const tests = listRepoFiles(ctx.repoRoot).filter(isTestFile).sort(); const dependencies: Record = {}; const todo: string[] = []; @@ -43,7 +44,9 @@ export function starterPolicy(ctx: Pick b[1] - a[1] || a[0].localeCompare(b[0])).slice(0, MAX_DIRS).map(([d]) => d); const lanes = ctx.lanes.filter(l => l.runsTests && !l.manual).map(l => `${l.id} (${l.platform}${l.matrixExpression && l.testFiles.length === 0 && !ctx.config.selection[l.id] ? ', matrix computed; declare selection' : ''})`); return [ - `PREGATE_STARTER: no ${PREGATE_CONFIG_PATH} on ${ctx.baseRef}${ctx.absentUserPolicy ? ` and no user-owned policy at ${ctx.absentUserPolicy}` : ''}; a starter drafted from this repository follows. Review it, write it with gstack-pregate init, edit each TODO, then commit it on the base branch (from then on an unmapped file is PREGATE_NO_LANE)`, + ctx.configKind === 'none' + ? `PREGATE_STARTER: no ${PREGATE_CONFIG_PATH} on ${ctx.baseRef}${ctx.absentUserPolicy ? ` and no user-owned policy at ${ctx.absentUserPolicy}` : ''}; a starter drafted from this repository follows. Review it, write it with gstack-pregate init, edit each TODO, then commit it on the base branch (from then on an unmapped file is PREGATE_NO_LANE)` + : `PREGATE_STARTER: ${ctx.configLabel} declares no lanes (no dependencies, empty_lanes, selection or local key); a starter drafted from this repository follows. Review it, add its dependencies to ${ctx.configFile}${ctx.configKind === 'user' ? '' : ' on the base branch'} and edit each TODO (from then on an unmapped file is PREGATE_NO_LANE)`, `PREGATE_STARTER: runner ${runner ?? 'null (none detected; set runner with {files})'}`, `PREGATE_STARTER: test directories: ${dirs.join(', ') || '(no test files found)'}${dirCounts.size > MAX_DIRS ? ` (+${dirCounts.size - MAX_DIRS} more)` : ''}`, `PREGATE_STARTER: CI lanes: ${lanes.join(', ') || '(no test job in .github/workflows)'}`, diff --git a/lib/pregate/types.ts b/lib/pregate/types.ts index 0a4e8a731..67d68c78d 100644 --- a/lib/pregate/types.ts +++ b/lib/pregate/types.ts @@ -35,6 +35,8 @@ export interface PregateContext { configLabel: string; /** Where the policy came from: the base branch, the unreviewed head, the user-owned file, or nowhere (defaults). */ configKind: 'base' | 'head' | 'user' | 'none'; + /** The active policy has a `dependencies`, `empty_lanes`, `selection` or `local` key (config LANE_KEYS); false keeps the no-policy lane verdicts. Absent counts as declared. */ + policyDeclaresLanes?: boolean; /** This run's scratch directory under the state root (lib/pregate/run-scratch.ts): logs and scan files, never os.tmpdir(). */ scratch: string; /** The policy file to edit: the user-owned path when it is the active policy, else `.gstack/pregate.json`. */ diff --git a/lib/result-codes-release.ts b/lib/result-codes-release.ts index 09a36afe4..9dc34904f 100644 --- a/lib/result-codes-release.ts +++ b/lib/result-codes-release.ts @@ -303,8 +303,8 @@ export const RELEASE_RESULT_CODES = { // Lane D (GSTA-112): the no-policy warning and the environment-cause verdict. PREGATE_NO_POLICY: { anchor: 'pregate-no-policy', - summary: 'the repository has no pregate policy yet (no .gstack/pregate.json on the base branch and no user-owned file) and a touched file maps to no test lane; a warn, with a starter policy printed', - fix: 'review the printed starter, write it with `gstack-pregate init`, edit the TODO entries, then commit .gstack/pregate.json on the base branch; from then on an unmapped file is PREGATE_NO_LANE', + summary: 'the repository has no pregate policy yet (no .gstack/pregate.json on the base branch and no user-owned file), or its policy declares no lanes (no dependencies, empty_lanes, selection or local key), and a touched file maps to no test lane; a warn, with a starter policy printed', + fix: 'review the printed starter, write it with `gstack-pregate init` (or add its dependencies to the existing policy), edit the TODO entries, then commit .gstack/pregate.json on the base branch; from then on an unmapped file is PREGATE_NO_LANE', }, PREGATE_ENVIRONMENT: { anchor: 'pregate-environment', diff --git a/package.json b/package.json index b8524302e..4e0eb5e2d 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "gstack", - "version": "1.92.34", + "version": "1.92.35", "description": "Garry's Stack — Claude Code skills + fast headless browser. One repo, one install, entire AI engineering workflow.", "license": "MIT", "type": "module", diff --git a/test/pregate-policy-lane-verdicts.test.ts b/test/pregate-policy-lane-verdicts.test.ts new file mode 100644 index 000000000..c00848c46 --- /dev/null +++ b/test/pregate-policy-lane-verdicts.test.ts @@ -0,0 +1,210 @@ +/** + * GST-775 (from GBEV-3, gbrain-evals #272 and GBEV-22): `.gstack/pregate.json` could not raise the test timeout without + * changing lane verdicts. (1) Any policy file, even `{"timeout_s": 1800}`, turned a touched file with no test lane into a + * hard PREGATE_NO_LANE that returned before any test ran; with no file it only warned. (2) `warn: ["lanes"]` failed open: + * the downgraded PREGATE_NO_LANE returned before the selected tests ran, so a red test beside an unmapped file passed. + * (3) A `[]` declaration that matched a deleted test (the `"**": []` workaround) cleared it before the removed-test + * handling, so the deleted test's owning suite no longer ran. A policy that declares lanes (a `dependencies`, + * `empty_lanes`, `selection` or `local` key) keeps the hard PREGATE_NO_LANE. + */ +import { afterEach, describe, expect, test } from 'bun:test'; +import * as fs from 'node:fs'; +import * as path from 'node:path'; +import { EXIT } from '../lib/headless-artifacts'; +import { BASE_PREGATE, cleanup, commit, makeFixtureRepo, runBin, type FixtureRepo } from './helpers/pregate-fixture'; + +const repos: FixtureRepo[] = []; +const fixture = (opts?: Parameters[0]) => { const r = makeFixtureRepo(opts); repos.push(r); return r; }; +afterEach(() => { while (repos.length) cleanup(repos.pop()!); }); + +/** The fixture's planner-computed Windows lane replaced by a lint job, so the selected tests run here instead of becoming a requires-remote obligation. */ +const NO_PLATFORM_LANE = { '.github/workflows/windows.yml': 'name: Lint\non: [push]\njobs:\n lint:\n runs-on: ubuntu-24.04\n steps:\n - run: echo lint\n' }; +const SCHEMA = BASE_PREGATE.$schema; +const UNMAPPED = { 'lib/orphan.js': 'exports.lonely = () => 2;\n' }; +const GREEN = { ...UNMAPPED, 'lib/util.js': 'exports.add = (a, b) => b + a;\n' }; +const RED = { ...UNMAPPED, 'lib/util.js': 'exports.add = (a, b) => a - b;\n' }; +const UTIL_V2 = "const test = require('node:test');\nconst assert = require('node:assert');\nconst { add } = require('../lib/util.js');\ntest('adds again', () => assert.strictEqual(add(2, 2), 4));\n"; + +function lanes(repo: FixtureRepo, extra: string[] = [], env: Record = {}) { + const r = runBin(repo, 'gstack-pregate', ['--base', 'main', '--allow-repo-commands', '--only', 'lanes', ...extra], env); + const out = JSON.parse(fs.readFileSync(path.join(repo.work, '.gstack/tmp/pregate.json'), 'utf8')); + const row = out.checks.find((c: { id: string }) => c.id === 'lanes'); + const lines: string[] = row.lines ?? []; + return { ...r, row, lines, ran: lines.find(l => l.startsWith('ran: ')) ?? '', removed: lines.filter(l => l.startsWith('removed (no lane owed): ')) }; +} + +describe('a policy that declares no lanes keeps the no-policy lane verdicts (GST-775 bug 1)', () => { + // Value: protects=a timeout-only policy (gbrain-evals #272's intent) leaves an unmapped file a warning with the selected tests run, + // exactly as with no policy; fails_when=any policy file turns the unmapped file into a hard PREGATE_NO_LANE before the tests run; + // why_new=the lane-requirement condition is new; seam=none; no_claim=the 600 s default changes + test.each([ + ['timeout-only', { $schema: SCHEMA, timeout_s: 1800 }], + ['runner, warn and strays', { $schema: SCHEMA, runner: 'node --test {files}', warn: ['strays'], strays: { allow: ['Makefile'] } }], + ])('%s policy: unmapped file warns and the selected test runs, like no policy', (_name, policy) => { + const none = fixture({ pregate: null, baseFiles: NO_PLATFORM_LANE }); + commit(none, GREEN); + const n = lanes(none); + const withPolicy = fixture({ pregate: policy, baseFiles: NO_PLATFORM_LANE }); + commit(withPolicy, GREEN); + const p = lanes(withPolicy); + expect(p.err).not.toContain('PREGATE_NO_LANE'); + expect([p.status, p.row.status, p.row.code]).toEqual([n.status, n.row.status, n.row.code]); + expect([p.status, p.row.status, p.row.code]).toEqual([EXIT.ok, 'warn', 'PREGATE_NO_POLICY']); + expect(p.ran).toContain('test/util.test.js'); + expect(p.row.detail).toMatch(/\d+ tests ran in \d+ file\(s\)/); + expect(p.lines.some(l => l.startsWith('PREGATE_STARTER: '))).toBe(true); + }); + + // Value: protects=the warning never hides a red test under a lane-less policy; fails_when=the timeout-only branch returns warn for a + // failing lane; why_new=new branch; seam=none; no_claim=none + test('timeout-only policy: a red selected test beside an unmapped file is PREGATE_LANE_FAILED', () => { + const repo = fixture({ pregate: { $schema: SCHEMA, timeout_s: 1800 }, baseFiles: NO_PLATFORM_LANE }); + commit(repo, RED); + const r = lanes(repo); + expect([r.status, r.row.status, r.row.code]).toEqual([EXIT.fail, 'fail', 'PREGATE_LANE_FAILED']); + expect(r.ran).toContain('test/util.test.js'); + }); + + // Value: protects=a fully mapped change prints no empty "have no test lane" line under no policy or a lane-less one; fails_when=the + // no-lane line is rendered for an empty list; why_new=the mode switch is new; seam=none; no_claim=none + test.each([['no policy', null], ['timeout-only', { $schema: SCHEMA, timeout_s: 1800 }]])('%s: a fully mapped change passes with no no-lane line', (_name, policy) => { + const repo = fixture({ pregate: policy, baseFiles: NO_PLATFORM_LANE }); + commit(repo, { 'lib/util.js': 'exports.add = (a, b) => b + a;\n' }); + const r = lanes(repo); + expect([r.status, r.row.status]).toEqual([EXIT.ok, 'pass']); + expect(r.lines.some(l => l.includes('have no test lane'))).toBe(false); + }); + + // Value: protects=the starter names the policy that exists instead of claiming there is none; fails_when=the starter header says + // "no .gstack/pregate.json" while one is on the base; why_new=new wording; seam=none; no_claim=none + test('the starter says the active policy declares no lanes, not that there is no policy', () => { + const repo = fixture({ pregate: { $schema: SCHEMA, timeout_s: 1800 }, baseFiles: NO_PLATFORM_LANE }); + commit(repo, GREEN); + const r = lanes(repo); + const header = r.lines.find(l => l.startsWith('PREGATE_STARTER: ')) ?? ''; + expect(header).toContain('declares no lanes'); + expect(header).not.toContain('no .gstack/pregate.json on'); + }); +}); + +describe('warn: ["lanes"] never lets a red test pass (GST-775 bug 2)', () => { + const warnLanes = { ...BASE_PREGATE, warn: ['strays', 'lanes'] }; + + // Value: protects=the documented escape runs the selected tests and keeps a red lane fail; fails_when=the downgraded PREGATE_NO_LANE + // returns before the tests run (GBEV-22's fail-open); why_new=the warn path is new; seam=none; no_claim=none + test('a red selected test beside an unmapped file fails with PREGATE_LANE_FAILED', () => { + const repo = fixture({ pregate: warnLanes }); + commit(repo, RED); + const r = lanes(repo); + expect([r.status, r.row.status, r.row.code]).toEqual([EXIT.fail, 'fail', 'PREGATE_LANE_FAILED']); + expect(r.ran).toContain('test/util.test.js'); + }); + + // Value: protects=only the missing-lane condition becomes the warning, after the tests ran green; fails_when=the warn row carries + // no test run, or the unmapped file is dropped from the row; why_new=new; seam=none; no_claim=none + test('a green run with an unmapped file is warn PREGATE_NO_LANE, naming the file, after the tests ran', () => { + const repo = fixture({ pregate: warnLanes }); + commit(repo, GREEN); + const r = lanes(repo); + expect([r.status, r.row.status, r.row.code]).toEqual([EXIT.ok, 'warn', 'PREGATE_NO_LANE']); + expect(r.ran).toContain('test/util.test.js'); + expect(r.row.detail).toMatch(/\d+ tests ran in \d+ file\(s\)/); + expect(r.row.detail).toContain('lib/orphan.js'); + expect(r.row.detail).toContain('downgraded to warn'); + }); + + // Value: protects=a selected test this machine cannot run stays a requires-remote obligation under the downgrade, never a warn or a + // pass; fails_when=withNoLaneWarning turns an unrun platform lane into warn; why_new=new arm; seam=none; no_claim=none + test('a selected test only a platform lane runs stays requires-remote, coded PREGATE_NO_LANE', () => { + const repo = fixture({ pregate: warnLanes }); + commit(repo, { ...UNMAPPED, 'test/windows-paths.test.js': "const test = require('node:test');\ntest('windows paths again', () => {});\n" }); + const r = lanes(repo); + expect([r.row.status, r.row.code]).toEqual(['requires-remote', 'PREGATE_NO_LANE']); + expect(r.row.detail).toContain('lib/orphan.js'); + }); +}); + +describe('a [] declaration does not skip a deleted test\'s owning suite (GST-775 bug 3)', () => { + const catchAll = { ...BASE_PREGATE, dependencies: { '**': [] } }; + + // Value: protects=gbrain-evals' "**": [] catch-all still runs a deleted test's owning suite; fails_when=the [] declaration clears + // the deleted test before removedPath(); why_new=the ordering is new; seam=none; no_claim=none + test('deleting a test under "**": [] runs its owning suite', () => { + const repo = fixture({ pregate: catchAll, baseFiles: { 'test/util-v2.test.js': UTIL_V2 } }); + commit(repo, { 'test/util.test.js': null }); + const r = lanes(repo); + expect(r.row.status).toBe('pass'); + expect(r.removed).toEqual(['removed (no lane owed): test/util.test.js — owning suite runs: test/util-v2.test.js']); + expect(r.ran).toContain('test/util-v2.test.js'); + }); + + // Value: protects=a file naming the deleted test that [] declares needs no lane (a durations manifest) does not stop the suite; + // fails_when=the namer reads as uncovered and the removal is cleared without its suite; why_new=new; seam=none; no_claim=none + test('a curation file that names the deleted test and is declared [] does not stop the owning suite', () => { + const repo = fixture({ pregate: catchAll, baseFiles: { 'test/util-v2.test.js': UTIL_V2, 'scripts/durations.json': '{"test/util.test.js": 1}\n' } }); + commit(repo, { 'test/util.test.js': null }); + const r = lanes(repo); + expect(r.row.status).toBe('pass'); + expect(r.removed).toEqual(['removed (no lane owed): test/util.test.js — owning suite runs: test/util-v2.test.js']); + expect(r.ran).toContain('test/util-v2.test.js'); + }); +}); + +describe('negative controls: a policy that declares lanes still fails hard', () => { + // Value: protects=declaring dependencies, empty_lanes, selection or local, even empty, keeps PREGATE_NO_LANE a hard stop before any test runs; + // fails_when=the lane-less branch fires for every policy; why_new=the boundary is new; seam=none; no_claim=none + test.each([ + ['dependencies', { ...BASE_PREGATE }], + ['an empty dependencies object', { $schema: SCHEMA, timeout_s: 1800, dependencies: {} }], + ['an empty empty_lanes list', { $schema: SCHEMA, timeout_s: 1800, empty_lanes: [] }], + ['an empty selection object', { $schema: SCHEMA, timeout_s: 1800, selection: {} }], + ['an empty local list', { $schema: SCHEMA, timeout_s: 1800, local: [] }], + ])('a base policy with %s keeps PREGATE_NO_LANE', (_name, policy) => { + const repo = fixture({ pregate: policy, baseFiles: NO_PLATFORM_LANE }); + commit(repo, GREEN); + const r = lanes(repo); + expect([r.status, r.row.status, r.row.code]).toEqual([EXIT.fail, 'fail', 'PREGATE_NO_LANE']); + expect(r.ran).toBe(''); + expect(r.lines.some(l => l.startsWith('PREGATE_STARTER: '))).toBe(false); + }); + + // Value: protects=the user-owned policy follows the same boundary; fails_when=the user file is treated differently from the base + // copy; why_new=new; seam=none; no_claim=none + test('a user-owned policy that declares dependencies keeps PREGATE_NO_LANE', () => { + const repo = fixture({ pregate: null, baseFiles: NO_PLATFORM_LANE }); + commit(repo, GREEN); + const userPolicy = path.join(repo.home, 'projects', 'gst775slug', 'pregate.json'); + fs.mkdirSync(path.dirname(userPolicy), { recursive: true }); + fs.writeFileSync(userPolicy, JSON.stringify({ runner: 'node --test {files}', dependencies: { 'docs/**': [] } })); + const r = lanes(repo, [], { GSTACK_PROJECT_SLUG: 'gst775slug' }); + expect([r.status, r.row.status, r.row.code]).toEqual([EXIT.fail, 'fail', 'PREGATE_NO_LANE']); + }); + + // Value: protects=a --policy-from head file that adds a lane over a lane-less base makes the run strict; fails_when=the head merge + // keeps the base's declaresLanes only; why_new=the merge is new; seam=none; no_claim=none + test('--policy-from head adding dependencies over a timeout-only base keeps PREGATE_NO_LANE', () => { + const repo = fixture({ pregate: { $schema: SCHEMA, timeout_s: 1800 }, baseFiles: NO_PLATFORM_LANE }); + commit(repo, { ...GREEN, '.gstack/pregate.json': JSON.stringify({ $schema: SCHEMA, timeout_s: 1800, dependencies: { 'bin/tool': ['test/util.test.js'] } }) + '\n' }); + const r = lanes(repo, ['--policy-from', 'head']); + expect([r.status, r.row.status, r.row.code]).toEqual([EXIT.fail, 'fail', 'PREGATE_NO_LANE']); + }); + + // Value: protects=without a [] declaration a deleted test still runs its owning suite and an unmapped deleted source still fails; + // fails_when=moving the removed-test handling waives non-test removals; why_new=new; seam=none; no_claim=none + test('a deleted source file under a lane-declaring policy still owes a lane', () => { + const repo = fixture(); + commit(repo, { 'test/util.test.js': null, 'lib/util.js': null }); + const r = lanes(repo); + expect(r.row.code).toBe('PREGATE_NO_LANE'); + expect(r.row.detail).toContain('lib/util.js'); + }); + + // Value: protects=warn: ["lanes"] does not downgrade a red lane even with every file mapped; fails_when=the lanes downgrade starts + // applying to PREGATE_LANE_FAILED; why_new=regression guard; seam=none; no_claim=none + test('warn: ["lanes"] with every file mapped keeps a red lane fail', () => { + const repo = fixture({ pregate: { ...BASE_PREGATE, warn: ['strays', 'lanes'] } }); + commit(repo, { 'lib/util.js': 'exports.add = (a, b) => a - b;\n' }); + const r = lanes(repo); + expect([r.status, r.row.status, r.row.code]).toEqual([EXIT.fail, 'fail', 'PREGATE_LANE_FAILED']); + }); +}); diff --git a/test/pregate-starter.test.ts b/test/pregate-starter.test.ts index fd911b866..f21ec3b81 100644 --- a/test/pregate-starter.test.ts +++ b/test/pregate-starter.test.ts @@ -85,8 +85,8 @@ describe('no policy anywhere: warn plus a printed starter (never PREGATE_NO_LANE expect(r.out).toContain('no policy: lib/orphan.js scripts/report.js have no test lane'); }); - // Value: protects=a repository with a policy keeps the hard PREGATE_NO_LANE (base copy, and the user-owned file); fails_when=the - // warn branch fires whenever an entry is unmapped; why_new=the branch condition is new; seam=none; no_claim=none + // Value: protects=a repository with a policy that declares lanes keeps the hard PREGATE_NO_LANE (base copy, the user-owned file and a + // head bootstrap; a runner-only policy declares none since GST-775); fails_when=the warn branch fires whenever an entry is unmapped; why_new=the branch condition is new; seam=none; no_claim=none test('a base policy or a user-owned policy keeps PREGATE_NO_LANE as a hard failure', () => { const withBase = fixture(); commit(withBase, { 'lib/orphan.js': 'exports.lonely = () => 2;\n' }); @@ -98,14 +98,14 @@ describe('no policy anywhere: warn plus a printed starter (never PREGATE_NO_LANE commit(withUser, { 'lib/orphan.js': 'exports.lonely = () => 2;\n' }); const userPolicy = path.join(withUser.home, 'projects', 'starterslug', 'pregate.json'); fs.mkdirSync(path.dirname(userPolicy), { recursive: true }); - fs.writeFileSync(userPolicy, JSON.stringify({ runner: 'node --test {files}' })); + fs.writeFileSync(userPolicy, JSON.stringify({ runner: 'node --test {files}', dependencies: { 'docs/**': [] } })); const u = lanes(withUser, [], { GSTACK_PROJECT_SLUG: 'starterslug' }); expect(u.status).toBe(EXIT.fail); expect(u.err).toContain('(PREGATE_NO_LANE)'); expect(u.out).not.toContain('PREGATE_STARTER'); // --policy-from head with a head policy (no base copy) is strict too. const withHead = fixture({ pregate: null }); - commit(withHead, { 'lib/orphan.js': 'exports.lonely = () => 2;\n', '.gstack/pregate.json': JSON.stringify({ runner: 'node --test {files}' }) + '\n' }); + commit(withHead, { 'lib/orphan.js': 'exports.lonely = () => 2;\n', '.gstack/pregate.json': JSON.stringify({ runner: 'node --test {files}', dependencies: { 'docs/**': [] } }) + '\n' }); const h = lanes(withHead, ['--policy-from', 'head']); expect(h.status).toBe(EXIT.fail); expect(h.err).toContain('(PREGATE_NO_LANE)'); From 216493fb32d19f261a9ee37a866c3f3513ea949a Mon Sep 17 00:00:00 2001 From: Garry Tan Date: Sun, 1 Nov 2026 09:21:21 -0800 Subject: [PATCH 3/9] v1.92.36.0 fix(review): keep every severity label, so a blocker after "no CRITICAL issues except" is no longer lost (GSTA-167 S1) (#3803) * test(review): a blocker in an exception clause after a negated severity word collects at its label (GSTA-167 S1, failing first) Adds the six exception-clause probes that collect nothing on 8cef24ce, GST-435's label-keeping probes and fixtures (PR #3703, read as text), and turns GST-766's negated-label test into a kept-label test. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix(review): revert GST-766's negation drop; collect keeps every label as before 8cef24ce, stated stays (GSTA-167 S1) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix: pre-landing review fixes (GSTA-167 S1: a closing-summary phantom stays at its label in the judged set and folds only into a finding at least as severe) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> --------- Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> --- CHANGELOG.md | 13 ++ VERSION | 2 +- agents-digest/gstack-AGENTS.md | 2 +- docs/review-policy.md | 12 +- lib/review-ledger.ts | 22 +-- package.json | 2 +- .../review-ledger/geva-77-fix-check.txt | 4 + .../harn15-152-p1-adversarial-native.txt | 42 ++++++ .../review-ledger/harn15-152-p2-fix-check.txt | 17 +++ .../harn15-ship2-p2-adversarial-native.txt | 27 ++++ .../harn15-ship2-p2-fix-check.txt | 12 ++ .../harn15-ship2-p2-red-team.txt | 13 ++ .../review-ledger/harn15-ship2-red-team.txt | 9 ++ test/review-dispatch.test.ts | 132 +++++++++++++++--- 14 files changed, 263 insertions(+), 46 deletions(-) create mode 100644 test/fixtures/review-ledger/geva-77-fix-check.txt create mode 100644 test/fixtures/review-ledger/harn15-152-p1-adversarial-native.txt create mode 100644 test/fixtures/review-ledger/harn15-152-p2-fix-check.txt create mode 100644 test/fixtures/review-ledger/harn15-ship2-p2-adversarial-native.txt create mode 100644 test/fixtures/review-ledger/harn15-ship2-p2-fix-check.txt create mode 100644 test/fixtures/review-ledger/harn15-ship2-p2-red-team.txt create mode 100644 test/fixtures/review-ledger/harn15-ship2-red-team.txt diff --git a/CHANGELOG.md b/CHANGELOG.md index fc4fff6ab..c92999f25 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,18 @@ # Changelog +## [1.92.36.0] - 2026-11-01 + +**/ship's review collector keeps every severity label again, so a blocker named after "no CRITICAL issues except" is no longer lost.** v1.92.29.0 (GST-766) skipped any severity word that followed "no", "nothing", "none" and similar words, to stop a reviewer's closing line like "found nothing CRITICAL" from counting as a finding. That also threw away real blockers named in an exception clause: "No CRITICAL issues except the token leak in log.ts:3", "Nothing CRITICAL apart from the auth bypass (auth.ts:9)" and four more wordings collected nothing at all, so the gate never saw them. The collector now reads labels exactly as it did before v1.92.29.0. The reviewer's own Severity and Blocks fields are still recorded beside the label (`stated`), as in v1.92.29.0. + +### Known +- **A reviewer's closing summary collects at its label again.** Lines like "found nothing CRITICAL" or "Neither finding is CRITICAL." collect as CRITICAL, the same as before v1.92.29.0. They are known phantoms. Each stays CRITICAL in the judged set (lead judgment can fold it only into a finding at least as severe), so it counts toward what blocks. A lost blocker costs more than an extra one. + +### Tests +- `test/review-dispatch.test.ts`: the six exception-clause wordings collect CRITICAL for every reader. GST-766's test that a negated label collects nothing now checks that each of those lines keeps its label. GST-435's label-keeping probes (table rows, FIXABLE, negated subjects, closing summaries kept as known phantoms) are added with their HARN-15 and GEVA-77 fixtures under `test/fixtures/review-ledger/`. + +### Docs +- `docs/review-policy.md` (collect) says a negated severity word still collects at its label. + ## [1.92.35.0] - 2026-11-01 - **A `.gstack/pregate.json` that only raises `timeout_s` no longer changes lane verdicts, `warn: ["lanes"]` no longer lets a failing test pass, and a `[]` declaration no longer skips a deleted test's suite** (GST-775, from gbrain-evals #272 and GBEV-22). diff --git a/VERSION b/VERSION index a2a712ec1..188831bb6 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -1.92.35.0 +1.92.36.0 diff --git a/agents-digest/gstack-AGENTS.md b/agents-digest/gstack-AGENTS.md index b44d844b5..7b4ef5af8 100644 --- a/agents-digest/gstack-AGENTS.md +++ b/agents-digest/gstack-AGENTS.md @@ -1,4 +1,4 @@ -# gstack digest v1.92.35.0 — regenerate/re-copy after upgrading gstack +# gstack digest v1.92.36.0 — regenerate/re-copy after upgrading gstack Behavioral rules from gstack (https://github.com/garrytan/gstack), compressed for agent hosts without a full skill install. The full skills add workflows, diff --git a/docs/review-policy.md b/docs/review-policy.md index 6e23cedff..7dddf25d7 100644 --- a/docs/review-policy.md +++ b/docs/review-policy.md @@ -469,7 +469,7 @@ ones, and the arm lost blockers. `bin/gstack-review-dispatch` closes both ends: 3. `collect` hashes each reader's raw output and appends its findings to `merged.jsonl` with the label as written (a JSON line's `severity`, or the most severe of a prose line's Critical, High, Medium, Low, P0-P3, FIXABLE or INVESTIGATE - wherever they stand outside a negation (below), headings and table rows included; a top-level list item under a + wherever they stand, headings and table rows included; a top-level list item under a label-only heading takes the stronger of the two). A `Severity:` or `Blocks:` line continues the finding above it until a list item, heading, bold paragraph opener or a second line for the same field starts another: `Severity` raises its label, @@ -478,11 +478,11 @@ ones, and the arm lost blockers. `bin/gstack-review-dispatch` closes both ends: adversarial voice's FIXABLE collects as CRITICAL (normalizer v2, GSTA-167). An unnumbered, unlabeled bullet with no file:line under a paragraph finding whose Severity or Blocks line has not come yet is that finding's detail, so the field line after it lands on the finding; a numbered item is its own finding. - A label a negation word governs ("found nothing CRITICAL", "no new **High** or Critical issues", "No P0/P1 issues": - no, nothing, not, none, zero, without or never, optionally followed by new, remaining, other, further, additional, more - or at, through Markdown, and carried to labels joined by a comma, slash, or, nor or and) is no finding unless it opens a - field (`High:`, GST-766). A line whose labels are all negated closes the open finding and heads the next, so a finding - worded around a negated label still arrives through its Severity or Blocks field. Each prose finding's line also + A negated severity word still collects at its label ("found nothing CRITICAL", "No P0/P1 issues"), so a reader's + closing summary is a known phantom: it stays at that label in the judged set, lead judgment can fold it only into a + finding at least as severe, and it counts toward what blocks. GST-766 skipped negated labels and lost + real blockers named in an exception clause ("No CRITICAL issues except the token leak in log.ts:3"); GSTA-167 + reverted that. Each prose finding's line also records the Severity and Blocks its own text states as `stated`, beside the collected label and never in its place; a classified finding that carries `stated` shows it in its deferred-review issue next to the label ("CRITICAL (the reviewer wrote Severity: Low, Blocks: no)"). /ship's Step 9.4 does not copy `stated` into its findings file yet: that diff --git a/lib/review-ledger.ts b/lib/review-ledger.ts index 18528a198..cfbc91656 100644 --- a/lib/review-ledger.ts +++ b/lib/review-ledger.ts @@ -59,14 +59,6 @@ const stronger = (a: string, b: string) => ((rank(a) ?? 0) >= (rank(b) ?? 0) ? a /** A prose voice's `Blocks: yes` (GSTA-167 normalizer v2): the finding is CRITICAL whatever its label; `Blocks: no` never lowers one. */ const BLOCKS_YES = /(? (role === 'adversarial-native' && l.toUpperCase() === 'FIXABLE' ? 'CRITICAL' : l); - const asserted = (t: string) => { - const all = [...t.matchAll(ALL_LABELS)]; - let end = -1, negated = false; - return all.filter(m => { - const at = m.index!; - negated = !/^\s*:/.test(t.slice(at + m[0].length, at + m[0].length + 8).replace(MARKUP, '')) - && (NEGATED.test(t.slice(Math.max(0, at - 60), at).replace(MARKUP, '')) || (negated && NEGATION_LIST.test(t.slice(end, at).replace(MARKUP, '')))); - end = at + m[0].length; - return !negated; - }); - }; - const strongest = (t: string) => asserted(t).map(m => named(m[1]!)).reduce((a, b) => (a === undefined ? b : stronger(a, b)), undefined); + const strongest = (t: string) => [...t.matchAll(ALL_LABELS)].map(m => named(m[1]!)).reduce((a, b) => (a === undefined ? b : stronger(a, b)), undefined); const push = (label: string, raw: string, fields: string[] = []): Finding => { const f = { label, raw, fields: new Set(fields), list: LIST_ITEM.test(raw) }; out.push(f); return f; }; for (const line of output.replace(/\r\n/g, '\n').split('\n')) { const t = line.trim(); @@ -151,7 +132,6 @@ export function parseFindings(reader: string, output: string): Array<{ label: st if (typeof o.severity === 'string') { current = push(o.severity, t); continue; } } catch { /* prose that starts with a brace */ } } - if (!label && !blocks && !(section && listItem) && ANY_LABEL.test(t)) { current = null; head = t; continue; } const detail = listItem && /^[-*+]\s/.test(t) && !locus && !label && !section && !!current && !current.list && !current.fields.size; if (detail && !blocks) { current!.raw += ` | ${t}`; continue; } const fresh = (listItem && !detail) || (!indented && !detail && (t.startsWith('**') || afterGap)) || (!!current?.fields.size && locus); diff --git a/package.json b/package.json index 4e0eb5e2d..c6e216075 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "gstack", - "version": "1.92.35", + "version": "1.92.36", "description": "Garry's Stack — Claude Code skills + fast headless browser. One repo, one install, entire AI engineering workflow.", "license": "MIT", "type": "module", diff --git a/test/fixtures/review-ledger/geva-77-fix-check.txt b/test/fixtures/review-ledger/geva-77-fix-check.txt new file mode 100644 index 000000000..a7f9b9c39 --- /dev/null +++ b/test/fixtures/review-ledger/geva-77-fix-check.txt @@ -0,0 +1,4 @@ +{"severity":"INFORMATIONAL","path":"CHANGELOG.md","line":5,"summary":"The reworded sentence describes /ship behaviour that gstack 1.91.358.0 does not have. Under bump never, Step 12 prints 'VERSION: kept', and Step 13's Kept branch (ship/sections/changelog.md:49-51) puts an entry 'where the repo's own rule puts unit-PR notes (its CHANGELOG preamble or a fragment directory it names), else under ## [Unreleased]'. Only NO_VERSION or changelog: null skip the entry. The preamble still names no location for unit-PR notes (for example the PR body), so a lane that reads Step 13 literally still reaches the [Unreleased] fallback on its next /ship. That half of the original finding is still open. Fix: say where the notes go ('unit-PR notes go in the PR body'), or set changelog: null in ship-policy.json so Step 13 really writes nothing."} +{"severity":"INFORMATIONAL","path":"CHANGELOG.md","line":5,"summary":"The fix leaves the original finding's fragment question open. changelog.d/gsta-30-laneb-quick-3-results.md is still in the tree, and CREW.md still says 'changelog entries go in changelog.d/ fragments'. The new sentence covers CHANGELOG.md only. docs/ship-policy.md:42 says bump never cannot be combined with changelog_fragments, so nothing folds that fragment at release, and a lane following CREW.md can keep adding fragments the preamble never mentions. Fix: name changelog.d/ in the preamble, either as banned or as folded by the Captain at release, and decide what happens to the GSTA-30 fragment."} + +Neither finding is CRITICAL. The change is one prose line, and pregate, tests (1264), typecheck, errors and wiki all pass after the fix. I checked the claim against the installed gstack 1.91.358.0: ship/sections/changelog.md and docs/ship-policy.md. \ No newline at end of file diff --git a/test/fixtures/review-ledger/harn15-152-p1-adversarial-native.txt b/test/fixtures/review-ledger/harn15-152-p1-adversarial-native.txt new file mode 100644 index 000000000..2d9f30e4e --- /dev/null +++ b/test/fixtures/review-ledger/harn15-152-p1-adversarial-native.txt @@ -0,0 +1,42 @@ +The range from 6c8fcfe to HEAD (8dc6584f5) has no blocking defect in today's code paths, because nothing sets `upstream.provider` yet. It does have one cheap authentication hole and two silent-miscount risks to deal with before the provider wiring lands. + +**Coverage:** I read the full source diff: `world/services/gbrain-tap.ts`, `world/services/server.ts`, `world/services/events.ts`, `scripts/v03/mechanism.ts`, the docs and the version files. I also read the helpers they depend on (`describeCall`, `savedFactsOf`, `grantFor`, `turnStarts`, `ingestedFacts`, `resolveActor`). + +**Fixtures were reviewed in summary mode only.** I read the stat and test names for the two new test files, `tests/gbrain-provider-off-identity.test.ts` (+145) and `tests/gbrain-tap-provider.test.ts` (+276), not their payloads: +- the off-path identity test replays the v0.3 pilot events and the denied batches, and checks the mechanism output is byte-identical; +- the provider test covers recall versus query, the cap, `isError`, timeout, forged `acting_user`, `x-qm-actor`, overlapping tokens, `qmDelivery` and the mechanism counts. + +Neither file tests an empty token or a malformed `content` entry. + +I checked docs line truncation with `wc -L` and grep on the paragraph tails; no paragraph lost its tail. No gstack workflow ran on this review voice. + +**Findings** + +1. **An empty provider token skips authentication (FIXABLE, medium).** At `gbrain-tap.ts` ~376-378, the bearer regex plus `.trim()` turns `Authorization: Bearer ` followed by any whitespace into `""`. I confirmed this with bun on `"Bearer "` and `"Bearer \t"`. + - If `provider.tokens` ever contains `""`, for example when the wiring fills it from an unset env var, any client can send a blank bearer. It skips `resolveActor`, gets logged as QM's provider, and is attributed to `provider.actor`. + - The overlap guard at `server.ts:102` doesn't refuse empty, whitespace-only or padded tokens. Padded tokens can never match after the trim, so QM gets a 401. + - It also doesn't check the sidecar's own tokens (`upstream.token`, `tokens.members`, `ingest.tokens`). + - Fix: in `setGbrain`, require a non-empty list of non-empty tokens with no surrounding whitespace, and require `bearer` to be non-empty in the tap. + +2. **A token mismatch produces a silent zero (INVESTIGATE, medium).** A provider request whose bearer isn't in the static list falls through to `resolveActor` and gets a 401 at ~379, before any event is logged. That covers two cases: a client-credentials access token refreshed mid-trial, and a capture write credential nobody listed (the docs admit the second). + - QM swallows provider errors, so the trial goes on. + - `mechanism --provider-aware` never sees an event, so neither `MECH-CALLER-MISSING` nor `MECH-PROVIDER-OP-UNKNOWN` fires, and the table reports "provider recall 0 of N" as a real result. + - This needs a call when the wiring is designed: log a rejected-auth gbrain event in provider mode, and/or have the mechanism refuse a QM-provider trial whose consumer turn has no provider recall event. + +3. **Fact delivery is judged by substring (INVESTIGATE, medium).** `qmDelivery` marks a fact delivered when `delivered.includes(f.fact)`. + - In correction tasks, the needed and superseded facts are often near-duplicates. If the needed text is a prefix or substring of the superseded one ("Launch moved to Friday" inside "Launch moved to Friday at 3pm" returns true), the needed fact counts as delivered when the cap kept only the superseded row. + - Short facts also match unrelated text. + - This inflates `provider_delivered_needed`, `search delivered it` and `model read delivered it` silently, and the correction tasks are where this table matters most. + - Fix: match on row boundaries (the `Saved fact (...): ` line or the row's end) rather than a bare substring. + +4. **A malformed result now crashes the request (FIXABLE, low).** `qmDelivery` reads `c.type` on each `result.content` entry. A `null` entry throws (confirmed: "null is not an object"). + - `tagged` runs inside the logging loop after upstream has already answered. So in provider mode, a reply that used to pass through becomes an uncaught exception: the harness gets a 500 instead of gbrain's reply, and the rest of the batch goes unlogged. + - Fix: guard with `c && c.type === 'text'`. + +5. **Timeout drops lean towards "delivered" (INVESTIGATE, low).** `dropped: 'timeout'` compares the tap-side batch `latency_ms`, which is a lower bound on QM's session time, with `timeout_ms`. Calls just under the threshold at the tap but over it at QM count as delivered. The docs disclose this, but the bias only ever goes towards "delivered", so the report should state that direction. + +6. **The trust premise is unverified (INVESTIGATE, low).** The design depends on the model never seeing QM core's client credentials in `MEMORY_PROVIDER_CONFIG`. If QM gives the model any shell, file or env tool inside the container that holds that config, the model can present the provider token, and its own calls get tagged `provider`. This needs checking against QM b6786d67's tool set before a paid cell. + +7. **Nit (FIXABLE).** In the model-call branch, `JSON.stringify(structured ?? '')` records an empty result as `text_chars` and `delivered_chars` of 2 (the string `""`). The mechanism doesn't read it, but the event data is wrong. + +Recommendation: Fix the empty or whitespace provider-token acceptance at world/services/server.ts:102 and gbrain-tap.ts ~376 before merge, because a blank token in `provider.tokens` would let any client sending a blank bearer skip `resolveActor` and be recorded as QM's provider; the fix is a two-line validation, and findings 2 and 3 can be settled with the wiring since nothing turns provider mode on yet. diff --git a/test/fixtures/review-ledger/harn15-152-p2-fix-check.txt b/test/fixtures/review-ledger/harn15-152-p2-fix-check.txt new file mode 100644 index 000000000..dc4576d02 --- /dev/null +++ b/test/fixtures/review-ledger/harn15-152-p2-fix-check.txt @@ -0,0 +1,17 @@ +The fixes are sound. None of them breaks a caller, opens or closes a guard wrongly, or changes behaviour with the option off, so there's nothing at CRITICAL. I have two INFORMATIONAL findings. The first is the one worth acting on: the tap half of the blank-bearer test never reaches the fixed line. + +``` +{"severity":"INFORMATIONAL","path":"tests/gbrain-tap-provider.test.ts","line":299,"summary":"The tap half of the blank-bearer test can't catch the bug it targets. Header normalization turns 'Bearer ' + ' ' into \"Bearer\", so the regex gives a null bearer and the old line (bearer !== null) also answers 401. I put the old line back in a scratch copy and the test still passed. An input that does reach the fix is 'Bearer \\u00a0' with tokens [''], because HTTP header normalization keeps U+00A0 while trim() strips it. With that input the old line authenticates the request as the provider, and the fixed line answers 401 (checked both ways in a scratch copy). The setGbrain half of the test does pin the server guard."} +{"severity":"INFORMATIONAL","path":"world/services/gbrain-tap.ts","line":404,"summary":"Fix 3 covers provider calls only. A model call whose HTTP status is not 2xx but whose body carries a JSON-RPC result still gets qmDelivery(result) with facts set to true. trialProviderMechanism (scripts/v03/mechanism.ts:117 on) counts model_returned and model_delivered without checking the call's outcome, so a model call QM's client would have thrown on counts as delivering the needed fact. This was already there before these commits, and the input is rare: gbrain would have to answer 500 with a result body."} +``` + +**What I checked:** +- **Blank bearer, fix 1:** `!!bearer` changes only the empty-string case. In the model path, `resolveActor` is unchanged. The `setGbrain` guard throws before `gbrain = u`, so a refused upstream leaves no partial state. The trial.ts:194 caller never sets `provider`, so it never reaches the new check. +- **Dropped calls, fix 2:** The `delivery?.dropped` skip comes after the `provider_searches++` count, so a dropped search still counts as a search. A dropped recall already had `delivered_chars` 0. Only the provider path ever sets `dropped`, so model calls aren't affected. +- **Failed calls, fix 3:** `ok` is `d.outcome === 'ok'` at both call sites, the all-denied branch included. Scope denials already came back as an `isError` result, so they were tool_error before this change as well. Without `provider`, `tagged` still returns `{}`, so events with the option off are unchanged. +- **Null content entry, fix 4:** `c?.type` short-circuits before `c.text` is read. The structuredContent paths don't iterate `content`. +- **Tests for fixes 2 to 5:** I traced the tests for fixes 2 to 4 and the code before these commits would fail each one. For the per-row test (fix 5), I worked through the sums: `provider_searches` is 2 from t2's two calls without `max_chars`, `model_calls` is 2 from the search plus the remember, and `provider_recalls` is 2, all from t1. + +I didn't rerun the full suite. The 41 passing tests and the clean tsc run are your results; I ran only the blank-bearer test and a scratch U+00A0 test, both in a scratch copy I've since removed. Your checkout is untouched. + +gstack: ok 1.91.346.0 (`--check` only, no workflow run; 2 behind latest 1.91.348.0) diff --git a/test/fixtures/review-ledger/harn15-ship2-p2-adversarial-native.txt b/test/fixtures/review-ledger/harn15-ship2-p2-adversarial-native.txt new file mode 100644 index 000000000..024c5bbf9 --- /dev/null +++ b/test/fixtures/review-ledger/harn15-ship2-p2-adversarial-native.txt @@ -0,0 +1,27 @@ +I found six problems in the range 2ae5923..HEAD (cdce7c76d) and none of them blocks. The one to fix before merge is the sandbox adoption at `qm-stack.ts:106`. When a sandbox create call fails, it can delete containers and volumes that belong to other QM stacks on the same host. The fix is one narrower filter. + +gstack: ok 1.91.366.0 require=claude,codex,patch (pins: skipped (no project); behind=3 (latest: 1.91.369.0)). That is the result of the `--check` run on this shared machine, which is above the 1.91.364.0 floor. This review did not run any gstack workflow. + +**Scope.** I read in full all non-fixture source that changed: `harnesses/qm/gstack/{qm-stack,s1-stage,smoke}.ts`, the gstack `README.md` and `CHANGELOG.md`. I reviewed the fixtures and tests in **summary mode only**. `tests/qm-gstack-smoke.test.ts` gained 39 lines and four tests: a successful import after a failed register reports no refusal, `lockHost` refuses a lock held by a live process and takes over a dead one, `receiptOut` keeps the committed receipt only for its own gstack ref, and a transport failure comes back as http 0 instead of throwing. I did not pull any payload bytes. With a scrubbed environment, `bun test tests/qm-gstack-smoke.test.ts` passed 16 of 16 and `bunx tsc --noEmit` was clean. + +**Findings** + +1. **A failed sandbox create adopts sandboxes from other stacks** (`qm-stack.ts:106-108`, `145-149`). `sandboxNames()` lists every container on the host with `label=qm.sandbox=1`. When the create call fails, or is cut off by `qmClient`'s 300 s timeout, `adoptNew()` takes ownership of every such container that appeared during that window. `down()` then runs `docker rm -f` on each one, plus `volume rm -f qm-home-*` and `network rm`. A live trial's QM stack uses the same label (`capture.sh:20`), so one failed s1 create during a trial deletes that trial's sandbox and its home volume. The lock does not help, because it only excludes other qm-gstack runs. The interface comment and the new README line ("never another stack's") claim more than the code does. Fix: add `--filter ancestor=` to the adoption query. s1's image `harness-eval/qm-sandbox:gstack-` is unique to it, and the project lock already rules out a second s1. Alternatively, filter on whatever label QM puts on sandboxes to tie them to their core. FIXABLE. Severity: Medium. Blocks: no, because it needs a concurrent QM stack, which the README already says not to run. + +2. **One bad container name skips the whole teardown** (`qm-stack.ts:105`, `108`, `123`). `own()` throws for any name that is not `qm-sbx-*`. `adoptNew()` calls it inside `down()`'s `finally` before `removeSandboxes()`, `dc down` and `unlock()`. One labelled container with an unexpected name aborts all three steps. Because `stopping` is already true, nothing retries, so pg, core and the owned sandboxes stay running. The same throw inside `createSandbox`'s catch leaves `creating` set, so the same failure repeats at teardown. Fix: skip names that don't match in `adoptNew` instead of throwing, or put each teardown step in its own `try`. FIXABLE. Severity: Low. Blocks: no. + +3. **A sandbox created after the call is cut off leaks** (`qm-stack.ts:108`, `147`). If the client times out while QM is still creating the container, `adoptNew()` takes its snapshot and sets `creating = null` before the container exists. Nothing tracks it afterwards, and `compose down --remove-orphans` doesn't remove it either, because core created it through the Docker socket and not through compose. Fix: keep the pre-create baseline until `down()`, and diff against it after `dc down` has stopped core. FIXABLE. Severity: Low. Blocks: no. + +4. **The host lock is not atomic** (`qm-stack.ts:66-76`). The lock code reads the file, checks the pid and then writes, with no `O_EXCL`. Two runs launched close together can both take the lock. The second run's opening `dc down -v --remove-orphans` then removes the first run's stack, which is the exact case the lock exists to stop. `release()` also deletes the file without checking it still holds its own pid, so the run that lost the race clears the winner's lock. Two smaller gaps: + - The lock directory comes from `tmpdir()`, so a run with `TMPDIR` set and one without lock in different places. + - A reused pid makes a dead lock look alive. + + Fix: create the file with `writeFileSync(path, pid, { flag: 'wx' })`. On `EEXIST`, check whether the holder is alive, then unlink and retry `wx` once. Release only if the file still holds this process's pid. Use a fixed directory. FIXABLE. Severity: Low. Blocks: no, since this is a manual tool. + +5. **A failed s1 run still overwrites the committed router file** (`s1-stage.ts:104`, `117`). The receipt now goes to `--work` on failure, but `routerOut` is still derived from `out` and written at line 117, before the stack runs. At the committed ref, a failed or aborted run overwrites `receipts/s1-router-21277291.md`. The content comes from `gstack-harness ... --print` run under the caller's `HOME`, so it may not be byte-identical, and the committed receipt's `router_sha256` would then no longer match the file. Fix: decide the destination for the router the same way as for the receipt, or write it after `ok` is known. FIXABLE. Severity: Low. Blocks: no. + +6. **`receiptOut` treats an unreadable receipt as permission to overwrite it** (`qm-stack.ts:156-160`). A committed receipt that is missing, has bad JSON, or lacks `gstack.ref` gives `committedRef === null`. Any default run at any ref then overwrites the committed path. Today both committed receipts carry the full sha `21277291c850...` under `gstack.ref`, which matches the newly normalised `ref`, so this is latent. INVESTIGATE: decide whether a parse failure should go to `work` instead. Severity: Low. Blocks: no. + +I checked these and found them sound: the lock now runs before the opening `compose down`; the signed `whoami` check (the committed smoke receipt shows `/v1/admin/whoami` answers 200 at this QM pin); running `prepare.sh` before the lock (it only creates directories and prints values); `refusal` being null after a successful import; `--ref` now resolving to a full commit sha; and the CHANGELOG count (61 skills plus `connect-chrome` plus the root file makes 63). + +Recommendation: Fix the sandbox adoption filter at qm-stack.ts:106 before merge because a failed s1 create runs `docker rm -f` and `volume rm -f` on every new `qm.sandbox=1` container on the host, including a live trial's; the change is one filter and everything else can ship as-is. \ No newline at end of file diff --git a/test/fixtures/review-ledger/harn15-ship2-p2-fix-check.txt b/test/fixtures/review-ledger/harn15-ship2-p2-fix-check.txt new file mode 100644 index 000000000..8f35182c6 --- /dev/null +++ b/test/fixtures/review-ledger/harn15-ship2-p2-fix-check.txt @@ -0,0 +1,12 @@ +None of the fixes blocks landing; I found four INFORMATIONAL defects and no CRITICAL. Three are in the one-run lock and sandbox-ownership fixes (3 and 6), and one is in the receipt-routing fix (9). + +Checks I ran: +- **Whoami (fix 5):** the endpoint exists. The committed smoke receipt shows `GET /v1/admin/whoami` at http 200 as `org_admin`. +- **Sandbox names (fix 6):** QM's `machineId` really is `qm-sbx-…`. The committed s1 receipt has `qm-sbx-sandbox-949f45aa-…-1b711b`, so `own()` accepts the success path. +- **Image pin check (fix 7):** passing `QM_SANDBOX_IMAGE=harness-eval/qm-sandbox:gstack-` to `prepare.sh` doesn't break s1. `Dockerfile.skills` builds `FROM qm-sandbox:dev`, so the image inherits the `harness-eval.commit` label. +- **Receipt ref match (fixes 8 and 9):** both committed receipts record the full 40-character `gstack.ref`, so the full sha from `--verify` matches them. + +{"severity":"INFORMATIONAL","path":"harnesses/qm/gstack/qm-stack.ts","line":108,"summary":"adoptNew() owns every qm.sandbox=1 container that appeared while create() ran. When the create call fails or returns no machineId (http 0, a 5xx, or a body without machineId), teardown runs `docker rm -f` and removes the qm-home-/qm-net- volume and network of any sandbox a concurrent trial, or a second stack on other ports, created in that window. The lock error invites a second stack on other ports, and README and the Stack doc comment still promise 'never another stack's'."} +{"severity":"INFORMATIONAL","path":"harnesses/qm/gstack/qm-stack.ts","line":123,"summary":"adoptNew() runs inside down()'s finally and calls own(), which throws for any qm.sandbox=1 container not named qm-sbx-*. If that happens during a cut-off createSandbox (SIGINT mid-call), removeSandboxes, compose down, unlock and the handler removal are all skipped. pg and core are left running and the lock file stays behind, and the next run refuses until it finds the dead pid. `creating` is also never reset, so later down() calls are no-ops because `stopping` is already true."} +{"severity":"INFORMATIONAL","path":"harnesses/qm/gstack/s1-stage.ts","line":114,"summary":"The one-run lock is taken inside upStack, after main has already mutated the shared --work directory. A second s1 run with the same --work is refused only after stage() has run rmSync on /context and docker build has re-tagged harness-eval/qm-sandbox:gstack-. The live run then reads its staged texts from /context (stagedText) and can hit ENOENT or rewritten files, and its receipt records the new image id. smoke.ts:114 likewise truncates the live run's fake-requests.ndjson before it is refused. This contradicts README's 'refuses a second run while the first is alive'."} +{"severity":"INFORMATIONAL","path":"harnesses/qm/gstack/s1-stage.ts","line":117,"summary":"Fix 9 sends a failed default run's receipt into --work, but routerOut is still computed beside `out` and written before the outcome is known. A failed default s1 run at the committed ref therefore overwrites receipts/s1-router-.md in the repository, and its --work receipt's gstack.router_file points at that committed file."} \ No newline at end of file diff --git a/test/fixtures/review-ledger/harn15-ship2-p2-red-team.txt b/test/fixtures/review-ledger/harn15-ship2-p2-red-team.txt new file mode 100644 index 000000000..b5116e3c5 --- /dev/null +++ b/test/fixtures/review-ledger/harn15-ship2-p2-red-team.txt @@ -0,0 +1,13 @@ +I found three INFORMATIONAL issues and nothing CRITICAL. All three are in the fix commit `cdce7c76d`, which fixes the earlier findings. The new code behind each one is the lock, the sandbox adoption and the receipt-overwrite gate. + +**Fixture coverage was reduced.** I read `tests/qm-gstack-smoke.test.ts` in summary mode only (+39/-1). It adds four tests: the outcome success path, `lockHost`, `receiptOut`, and the http 0 transport failure. No test covers `createSandbox`, `adoptNew` or the teardown order in `down()`. + +**Where the QM facts come from.** QM's container naming and labels come from the QM source copy at `~/.capy/work/local-sandbox.ts`. I assumed it matches the b6786d67 pin. + +**gstack check on this machine:** `gstack: ok 1.91.366.0 require=claude,codex,patch` (3 behind the latest, 1.91.369.0; above the 1.91.364.0 floor). + +```json +{"severity":"INFORMATIONAL","confidence":7,"path":"harnesses/qm/gstack/qm-stack.ts","line":108,"category":"red-team","summary":"adoptNew lists qm.sandbox=1 containers host-wide with no qm.org or qm.scope filter, and calls own(), which throws on any name outside qm-sbx-*. QM's scratch sandboxes (local-sandbox.ts:314-323, runContainer(qm-scratch-, undefined, false)) carry the same qm.sandbox=1 label. Failure 1: if any qm-scratch-* container appears on the host while a create call fails or returns no machineId, own() throws partway through the loop and `creating` is never reset. down() then calls adoptNew() first in its finally, so it throws again and skips removeSandboxes, compose down, unlock and the signal-handler removal. That brings back the teardown bypass outside-voice#3 reported, now triggered by another process's container. Failure 2: a live trial's freshly created qm-sbx-* sandbox (also org harness-eval) that appears in the same window, up to the 300 s client timeout, is adopted and removed with docker rm -f, its qm-home volume and its qm-net network. This contradicts the updated README line 'never another stack's' and brings back a narrower version of the label sweep that was dropped to protect live trials.","fix":"Narrow the diff to this call: filter on label=qm.org=harness-eval plus label=qm.scope=. QM names the container deterministically from the scope (localContainerName = qm-sbx-), so an exact name or scope match is possible. In adoptNew, skip names that fail the regex instead of throwing, and reset `creating` in a finally. In down(), wrap adoptNew in its own try so removeSandboxes, compose down and unlock always run. Add a fake-docker test where a qm-scratch-* name appears during a failed create, and assert that compose down still runs.","fingerprint":"harnesses/qm/gstack/qm-stack.ts:108:red-team","specialist":"red-team"} +{"severity":"INFORMATIONAL","confidence":7,"path":"harnesses/qm/gstack/qm-stack.ts","line":102,"category":"red-team","summary":"The host lock is taken inside upStack, after the caller has already modified the shared default --work directory. Both scripts default to fixed work directories (~/.capy/work/qm-gstack-smoke and qm-gstack-s1). Before reaching the lock, a second run truncates fake-requests.ndjson (smoke.ts:114, s1-stage.ts:135). s1 has also already run stage(), which does rmSync(work/context) and rewrites it (s1-stage.ts:114), rewritten the router, and re-tagged the overlay image. The run that holds the lock then reads the clobbered state after its turn. smoke's fake_model_requests counts lines in the truncated log. s1's stagedText() reads work/context/gstack/..., which is missing or from another ref if the second run failed after its rmSync, so the first run crashes with no receipt or records the wrong comparison. The lock only refuses the second run after this damage is done. The lock itself is also not atomic: it reads, checks liveness and then writes without O_EXCL, so two runs started together can both take it. It also lives under tmpdir(), so runs launched with different TMPDIR values (env -i or not) never see each other's locks.","fix":"Take the lock at the top of main(), before touching --work, and key it on the resolved work directory as well as the project and ports. Create each lock file with writeFileSync(path, pid, { flag: 'wx' }), and take over a dead owner's lock only through unlink-and-retry. Use a fixed lock directory such as /tmp or the work root, not tmpdir().","fingerprint":"harnesses/qm/gstack/qm-stack.ts:102:red-team","specialist":"red-team"} +{"severity":"INFORMATIONAL","confidence":6,"path":"harnesses/qm/gstack/qm-stack.ts","line":156,"category":"red-team","summary":"receiptOut lets a default run overwrite the committed receipt whenever the gstack ref matches, and nothing else is checked. The smoke's success gate is only result.registered (smoke.ts:154). Case 1: `smoke.ts --core-url ... --secret-file ...` at 21277291 replaces receipts/smoke-b6786d67.json with qm.commit null and an unchecked external core, while the file name and CHANGELOG still claim QM b6786d67. Case 2: a default run at the same ref where core can't reach GitHub, or QM's refusal changes, still registers the pack. It then rewrites the published refusal_kind bytes_cap receipt as clone_timeout or other and exits 0, so the README and CHANGELOG cite numbers the committed receipt no longer shows. s1 has the same gap: `ok` checks only the complete read, so a run whose over-cap read (the cited 16,384 cut) fails or changes still overwrites. Also, if pin.json later moves QM, the b6786d67-named file is overwritten with a receipt from the new QM build.","fix":"Overwrite the committed path only when the run's qm.commit equals the pinned commit (refuse when it is null, as with --core-url) and the outcome fields the docs cite (smoke: refusal_kind and refusal; s1: complete_read.identical and over_cap_read.cut) match the committed receipt. Otherwise write to / and print the difference. Or simply require an explicit --out to touch the committed receipts.","fingerprint":"harnesses/qm/gstack/qm-stack.ts:156:red-team","specialist":"red-team"} +``` \ No newline at end of file diff --git a/test/fixtures/review-ledger/harn15-ship2-red-team.txt b/test/fixtures/review-ledger/harn15-ship2-red-team.txt new file mode 100644 index 000000000..04981871d --- /dev/null +++ b/test/fixtures/review-ledger/harn15-ship2-red-team.txt @@ -0,0 +1,9 @@ +Red-team pass is done: I found three INFORMATIONAL issues and no CRITICAL ones. Both earlier specialist findings are already fixed in the working tree. `outcome()` now sets refusal to null when the import succeeds, and both suggested tests are in `tests/qm-gstack-smoke.test.ts`. That file passes 14/14 under `env -i`. + +**Coverage note:** the one test file (`tests/qm-gstack-smoke.test.ts`, +175, 14 tests) was reviewed in summary mode only. It covers request signing, the `upStack` dummy-key refusal, the smoke call sequence against a fake QM, refusal classification, pack sizing and the S1 staging helpers. All other changed files were read in full. Those are `qm-stack.ts`, `smoke.ts`, `s1-stage.ts`, `Dockerfile.skills`, both READMEs, the receipts, CHANGELOG, VERSION and package.json. I also checked `compose.yaml`, `prepare.sh`, `capture.sh` and `fake-anthropic.ts` at the integration boundaries. The only `sk-` token in the receipts is the `sk-ant-capture-dummy` prefix. + +``` +{"severity":"INFORMATIONAL","confidence":8,"path":"harnesses/qm/gstack/s1-stage.ts","line":102,"category":"red-team","summary":"If you rerun either script the way the README says, it overwrites the committed receipt with a different gstack commit, even when the run fails. --ref defaults to the checkout HEAD, but --out is a fixed repository path named only after the QM pin (smoke.ts:105, s1-stage.ts:102). Both scripts write the receipt unconditionally (smoke.ts:154, and s1-stage.ts:200 before the ok check). This machine's ~/.local/share/gstack is already at 12dc6782 (1.91.366.0), not the receipt's 21277291 (1.91.345.0). A default rerun today rewrites s1-staging-b6786d67.json against new gstack, adds s1-router-12dc6782.md next to it, and leaves the README's 4,727 / 29,581 / 17-of-63 / 12,186 figures pointing at a receipt that no longer shows them. To reproduce the published receipt, s1-stage's own refusal says to check out 21277291 in the live gstack install, which puts that machine below the crew's 1.91.364.0 floor.","fix":"Default --ref to the pinned 21277291 commit, and tell users in the README and in the refusal message to pass --gstack pointing at a separate `git worktree add 21277291` instead of checking out the live install. Put the gstack ref in the receipt file name, or refuse to overwrite an existing --out whose gstack.ref differs. On failure, write the receipt to / rather than to the committed path.","fingerprint":"harnesses/qm/gstack/s1-stage.ts:102:red-team","specialist":"red-team"} +{"severity":"INFORMATIONAL","confidence":7,"path":"harnesses/qm/gstack/s1-stage.ts","line":56,"category":"red-team","summary":"The router gstack-harness prints has a defect that the fixture hides: it lists `open-gstack-browser` twice. One line points at `connect-chrome/SKILL.md`, a symlink that only gstack's setup creates and that is not in git. stage() follows the symlink, so the fixture serves that path, but a QM deployment built from the gstack tree would return `[no such file` there. Under the README's counting rule, that is a 'fixture fault, rerun', so a real router defect would never be counted. The duplicate also inflates the published counts. The receipt's router_skills=62 and the CHANGELOG/README '62 router skills' are 61 distinct skills plus one alias (the manifest has connect-chrome and open-gstack-browser with the same sha256 2dd3227c..., 18,560 chars). The 63 staged files hold the same text twice. The 17 that fit inline is unaffected, because both copies are over the cap.","fix":"Report it to GSTA-36 as a gstack finding: `register generic --print` emits a setup-only alias path under another skill's name. In the fixture, mark the alias in the manifest (alias_of: open-gstack-browser) and state the counts as 61 distinct skills plus 1 alias, or drop the alias line from the staged router. Count a request that routes to connect-chrome as a router defect, not a fixture fault.","fingerprint":"harnesses/qm/gstack/s1-stage.ts:56:red-team","specialist":"red-team"} +{"severity":"INFORMATIONAL","confidence":4,"path":"harnesses/qm/gstack/qm-stack.ts","line":107,"category":"red-team","summary":"The health check cannot tell this run's core from another process on the same port. Core runs with network_mode: host (compose.yaml) and only pg publishes a port. If another process already holds 127.0.0.1:58080 and 55432 is free, `compose up -d` still exits 0, because depends_on waits only for pg. This run's core then fails to bind, and /healthz is answered by whatever holds the port. Every signed call goes to that foreign service and gets refused or garbled answers, and with the default --out (finding 1) that bad receipt replaces the committed one. The trial rig uses the same default port pair.","fix":"After the health check passes, call the signed GET /v1/admin/whoami and confirm a 200 before continuing. Or check that `docker compose ps core` is running and was not restarted.","fingerprint":"harnesses/qm/gstack/qm-stack.ts:107:red-team","specialist":"red-team"} +``` \ No newline at end of file diff --git a/test/review-dispatch.test.ts b/test/review-dispatch.test.ts index 3229c82ee..0dd5dcfd8 100644 --- a/test/review-dispatch.test.ts +++ b/test/review-dispatch.test.ts @@ -4,7 +4,7 @@ import * as fs from 'node:fs'; import * as os from 'node:os'; import * as path from 'node:path'; import { BriefError, checkReviewedTree, promptHash, renderBrief, sectionTexts, workspaceParagraph } from '../lib/review-brief'; -import { collect, judge, parseFindings, type MergedLine } from '../lib/review-ledger'; +import { collect, judge, parseFindings, readJsonl, type MergedLine } from '../lib/review-ledger'; const ROOT = path.resolve(import.meta.dir, '..'); const BIN = path.join(ROOT, 'bin', 'gstack-review-dispatch'); @@ -249,10 +249,23 @@ describe('gstack-review-dispatch sent, collect, judge and verify: nothing change expect(judge(m, [{ id: 'r#1', severity: 'INFORMATIONAL', reason: 'a real defect' }]).ok).toBe(true); }); - // Value: protects=a reader's closing prose that negates a severity word ("found nothing CRITICAL") is not collected as a finding, - // while a label stated as a finding still is; fails_when=collect records the negated word as a CRITICAL the judge cannot drop; - // why_new=GST-766: GEVA-92's fix-check#5 on gstack-evals #108 (1.92.17.0) became a phantom CRITICAL; seam=parseFindings; no_claim=prose voices' summaries that state a count - test('a negated severity word is not a finding: GEVA-92 fix-check#5 and its negated forms', () => { + // Value: protects=a blocker named in an exception clause after a negated severity word collects at its label (GSTA-167 S1: GST-766's + // negation drop collected nothing for each of these on 8cef24ce, where 8cef24ce^ collected CRITICAL); fails_when=any probe collects + // nothing or a weaker label; why_new=GST-766 skipped any label a negation word governs and lost these blockers; seam=parseFindings; + // no_claim=that the reader's negated wording is clear (lead judgment reads the raw line) + test('a blocker in an exception clause after a negated severity word collects at its label', () => { + for (const prose of ['No CRITICAL issues except the token leak in log.ts:3', 'There is no CRITICAL issue other than the SQL injection at db.ts:12', + 'Nothing CRITICAL apart from the auth bypass (auth.ts:9).', 'No new CRITICAL findings, but the token leak in log.ts:3 still blocks.', + 'None CRITICAL besides the race in queue.ts:40, which loses writes.', '- **No CRITICAL** issues remain except F2 (store.ts:22 corrupts data).']) + for (const reader of ['outside-voice', 'fix-check', 'red-team', 'adversarial-native']) + expect([prose, reader, parseFindings(reader, prose).map(f => f.label)]).toEqual([prose, reader, ['CRITICAL']]); + }); + + // Value: protects=a negated severity word still collects at its label, so a reader's closing prose ("found nothing CRITICAL") is a + // known phantom lead judgment folds and never a dropped line (GSTA-167 S1 reverts GST-766's negation drop); fails_when=any negated + // form collects nothing or a weaker label; why_new=GST-766's drop lost blockers named in exception clauses; seam=parseFindings; + // no_claim=that a negated line is a real finding (judge folds phantoms) + test('a negated severity word still collects at its label: GEVA-92 fix-check#5 and its negated forms are known phantoms', () => { const fixCheck = [ 'REVIEWED_TREE: bedd511efa0fa16c9277821073c68e438dc760d2 /workspace/gstack-evals', '{"severity":"INFORMATIONAL","path":"wiki/board/README.md","line":229,"summary":"Section 9\'s opening still says every ruling is recorded in the approvals file."}', @@ -262,19 +275,22 @@ describe('gstack-review-dispatch sent, collect, judge and verify: nothing change '- The new secondary: 47/60, 15/60, 5/40, 7/40, 4/40 and 11.5/40.', '- The minimum p of 2^-15.', ].join('\n'); - expect(parseFindings('fix-check', fixCheck).map(f => f.label)).toEqual(['INFORMATIONAL', 'INFORMATIONAL']); - for (const prose of ['Found no CRITICAL issues in the fix range.', 'Nothing CRITICAL or HIGH remains.', 'This is not CRITICAL.', 'I found zero Critical findings, and none High.', 'The retry path is safe; without CRITICAL impact.', - 'No new CRITICAL issues introduced by the fix.', 'No remaining CRITICAL or HIGH findings.', '**No** CRITICAL issues found.', 'No **CRITICAL** issues found.', 'No `CRITICAL` issue.', 'No [P1] issues remain.', 'Nothing at CRITICAL severity remains.', - 'No CRITICAL regressions introduced by the fix.', 'Nothing CRITICAL to report.', 'There is nothing CRITICAL in the fix range.', 'No CRITICAL — the fix is sound.', 'Found no CRITICAL or HIGH regressions.', 'No HIGH-risk changes.', - 'No CRITICAL/HIGH findings.', 'No P0/P1 issues.', 'No CRITICAL, HIGH or MEDIUM issues.', 'Checked collect() at lib/review-ledger.ts:189; no CRITICAL issues remain.', 'No CRITICAL issues; served on localhost:3000.']) - expect([prose, parseFindings('fix-check', prose)]).toEqual([prose, []]); - expect(parseFindings('r', 'Not CRITICAL, but High: the cache drops a row (c.ts:4)').map(f => f.label)).toEqual(['High']); - expect(parseFindings('r', 'No CRITICAL, High: the cache drops a row (c.ts:4)').map(f => f.label)).toEqual(['High']); - expect(parseFindings('r', 'Nothing CRITICAL / HIGH: race in q.ts:7').map(f => f.label)).toEqual(['HIGH']); + expect(parseFindings('fix-check', fixCheck).map(f => f.label)).toEqual(['INFORMATIONAL', 'INFORMATIONAL', 'CRITICAL']); + const kept: Array<[string, string]> = [['Found no CRITICAL issues in the fix range.', 'CRITICAL'], ['Nothing CRITICAL or HIGH remains.', 'CRITICAL'], ['This is not CRITICAL.', 'CRITICAL'], + ['I found zero Critical findings, and none High.', 'Critical'], ['The retry path is safe; without CRITICAL impact.', 'CRITICAL'], ['No new CRITICAL issues introduced by the fix.', 'CRITICAL'], + ['No remaining CRITICAL or HIGH findings.', 'CRITICAL'], ['**No** CRITICAL issues found.', 'CRITICAL'], ['No **CRITICAL** issues found.', 'CRITICAL'], ['No `CRITICAL` issue.', 'CRITICAL'], + ['No [P1] issues remain.', 'P1'], ['Nothing at CRITICAL severity remains.', 'CRITICAL'], ['No CRITICAL regressions introduced by the fix.', 'CRITICAL'], ['Nothing CRITICAL to report.', 'CRITICAL'], + ['There is nothing CRITICAL in the fix range.', 'CRITICAL'], ['No CRITICAL — the fix is sound.', 'CRITICAL'], ['Found no CRITICAL or HIGH regressions.', 'CRITICAL'], ['No HIGH-risk changes.', 'HIGH'], + ['No CRITICAL/HIGH findings.', 'CRITICAL'], ['No P0/P1 issues.', 'P0'], ['No CRITICAL, HIGH or MEDIUM issues.', 'CRITICAL'], + ['Checked collect() at lib/review-ledger.ts:189; no CRITICAL issues remain.', 'CRITICAL'], ['No CRITICAL issues; served on localhost:3000.', 'CRITICAL']]; + for (const [prose, label] of kept) expect([prose, parseFindings('fix-check', prose).map(f => f.label)]).toEqual([prose, [label]]); + expect(parseFindings('r', 'Not CRITICAL, but High: the cache drops a row (c.ts:4)').map(f => f.label)).toEqual(['CRITICAL']); + expect(parseFindings('r', 'No CRITICAL, High: the cache drops a row (c.ts:4)').map(f => f.label)).toEqual(['CRITICAL']); + expect(parseFindings('r', 'Nothing CRITICAL / HIGH: race in q.ts:7').map(f => f.label)).toEqual(['CRITICAL']); expect(parseFindings('r', 'No CRITICAL lock guards the write in Makefile:7\nSeverity: CRITICAL').map(f => f.label)).toEqual(['CRITICAL']); expect(parseFindings('r', '1. auth.ts:3 LOW: log line too verbose\nNo CRITICAL lock guards the write in Makefile:7\nSeverity: CRITICAL').map(f => [f.label, f.raw])).toEqual([['LOW', '1. auth.ts:3 LOW: log line too verbose'], ['CRITICAL', 'No CRITICAL lock guards the write in Makefile:7 | Severity: CRITICAL']]); - expect(parseFindings('r', '1. auth.ts:3 LOW: log line too verbose\nNo CRITICAL issues remain.').map(f => f.label)).toEqual(['LOW']); - expect(parseFindings('outside-voice', '- a.ts:3 race. Severity: Low. Blocks: no\n Separately, nothing CRITICAL about b.ts:9, but it leaks fds.\n Severity: High').map(f => [f.label, f.raw])).toEqual([['Low', '- a.ts:3 race. Severity: Low. Blocks: no'], ['High', 'Separately, nothing CRITICAL about b.ts:9, but it leaks fds. | Severity: High']]); + expect(parseFindings('r', '1. auth.ts:3 LOW: log line too verbose\nNo CRITICAL issues remain.').map(f => f.label)).toEqual(['LOW', 'CRITICAL']); + expect(parseFindings('outside-voice', '- a.ts:3 race. Severity: Low. Blocks: no\n Separately, nothing CRITICAL about b.ts:9, but it leaks fds.\n Severity: High').map(f => [f.label, f.raw])).toEqual([['Low', '- a.ts:3 race. Severity: Low. Blocks: no'], ['CRITICAL', 'Separately, nothing CRITICAL about b.ts:9, but it leaks fds. | Severity: High']]); expect(parseFindings('r', '1. A CRITICAL race in queue.ts:78 that no lock covers').map(f => f.label)).toEqual(['CRITICAL']); expect(parseFindings('r', '- A divide by zero CRITICAL bug in parse()').map(f => f.label)).toEqual(['CRITICAL']); expect(parseFindings('adversarial-native', 'FIXABLE: no timeout on the fetch in a.ts:3').map(f => f.label)).toEqual(['CRITICAL']); @@ -484,6 +500,90 @@ describe('gstack-review-dispatch sent, collect, judge and verify: nothing change expect(json.lines.map(l => [l.label, l.stated])).toEqual([['INFORMATIONAL', undefined]]); }); + // Value: protects=collect keeps every label on a prose line, at the strongest one (GST-435 rule (a)): each line that three review + // rounds found losing its label under a negation-drop draft (an exception clause, a negated subject, "else"/"other", a blocker named in an + // earlier sentence), fix-check 5's table rows and INFORMATIONAL cases, and harness-evals #152's native (FIXABLE, medium) findings collect + // at their label (adversarial.md); fails_when=any of them collects nothing or a weaker label; why_new=GST-435's negation drops lost a + // blocker in each round and were removed; seam=parseFindings; no_claim=that every kept line is a real finding (judge folds phantoms) + test('collect keeps every label at the strongest on its line: no wording drops a blocker', () => { + const kept: Array<[string, string]> = [['| 1 | `CRITICAL` | High | token leak in log.ts:3 |', 'CRITICAL'], ['| log.ts:3 | `CRITICAL` | High | token leak |', 'CRITICAL'], + ['None of the writes are atomic and are CRITICAL (queue.ts:78); High confidence', 'CRITICAL'], ['Nothing guards the write path the failure of which is CRITICAL', 'CRITICAL'], + ['| a.ts:3 | race | not CRITICAL, Low |', 'CRITICAL'], ['| a.ts:3 | maps `FIXABLE` to `CRITICAL` in a comment | Low |', 'CRITICAL'], + ['Neither path checks auth so this is CRITICAL (a.ts:3)', 'CRITICAL'], ['None of the inputs are sanitized so this is CRITICAL (a.ts:3)', 'CRITICAL'], + ['Nothing checks the token which is CRITICAL (a.ts:3)', 'CRITICAL'], ['No bounds check lets CRITICAL data leak (a.ts:3)', 'CRITICAL'], + ['No defects in parsing but the upload handler is CRITICAL.', 'CRITICAL'], ['1. Without auth this is CRITICAL (a.ts:3)', 'CRITICAL'], + ['Not checking expiry at auth.ts:9 lets stale tokens through. Severity: High', 'High'], ["The lock isn't released on error (pool.ts:12): High", 'High'], + ['A retry storm could escalate up to CRITICAL.', 'CRITICAL'], ['Low: the parser now maps `FIXABLE` to `CRITICAL` in a comment (a.ts:3)', 'CRITICAL'], + ['No input validation is CRITICAL (upload.ts:4)', 'CRITICAL'], ['No CSRF token is a CRITICAL gap at form.ts:12', 'CRITICAL'], + ['Nothing escaped here is CRITICAL: stored XSS at view.ts:8', 'CRITICAL'], ['No timeout here is High (fetch.ts:3)', 'High'], + ['Upgraded: not High, CRITICAL (a.ts:3)', 'CRITICAL'], ['Severity: not Medium, CRITICAL', 'CRITICAL'], + ['Nothing else is CRITICAL except the token leak in log.ts:3.', 'CRITICAL'], ['No other issue is CRITICAL besides the auth bypass in auth.ts:9.', 'CRITICAL'], + ['None of the other findings are CRITICAL, but the SQL injection in db.ts:12 is.', 'CRITICAL'], + ['Nothing here is CRITICAL apart from the unescaped query (db.ts:12).', 'CRITICAL'], ['Nothing else is CRITICAL except the token leak.', 'CRITICAL'], + ['Fix the token leak in log.ts:3 first; nothing else is CRITICAL.', 'CRITICAL'], ['The token leak in log.ts:3 blocks the merge. Nothing else is CRITICAL.', 'CRITICAL'], + ['1. Token leak in log.ts:3 must be fixed before landing.\n\nNothing else is CRITICAL.', 'CRITICAL'], ['The token leak blocks the merge.\nNo other issue is CRITICAL.', 'CRITICAL'], + ['The token leak in log.ts:3 blocks the merge. None of the other findings are CRITICAL.', 'CRITICAL'], + ['The token leak in log.ts:3 must block the merge. The other two are nits. Neither finding is CRITICAL.', 'CRITICAL'], + ['Apart from the token leak in log.ts:3, I found two nits. Neither finding is CRITICAL.', 'CRITICAL'], + ['Besides the auth bypass at auth.ts:9 there are three nits. None of the three findings are CRITICAL.', 'CRITICAL'], + ['The token leak in log.ts:3 must block the merge. Nothing here is CRITICAL.', 'CRITICAL'], ['No auth check guards the admin route, so nothing CRITICAL.', 'CRITICAL']]; + for (const [line, label] of kept) expect([line, parseFindings('outside-voice', line).map(f => f.label)]).toEqual([line, [label]]); + const native = fs.readFileSync(path.join(ROOT, 'test/fixtures/review-ledger/harn15-152-p1-adversarial-native.txt'), 'utf8'); + expect(parseFindings('adversarial-native', native).map(f => f.label)).toEqual(['CRITICAL', 'INVESTIGATE', 'INVESTIGATE', 'CRITICAL', 'INVESTIGATE', 'INVESTIGATE', 'CRITICAL']); + expect(parseFindings('adversarial-native', '**1. Race in a.ts:3 (`FIXABLE`).**\nSeverity: Low. Blocks: no').map(f => f.label)).toEqual(['CRITICAL']); + expect(parseFindings('red-team', '1. Race in a.ts:3 (FIXABLE).').map(f => f.label)).toEqual(['FIXABLE']); + expect(parseFindings('adversarial-native', 'No rate limit is FIXABLE (login.ts:9)').map(f => f.label)).toEqual(['CRITICAL']); + }); + + // Value: protects=a reader's own closing summary is a known phantom that keeps its label (HARN-15's Red Team and fix-check replies, + // GEVA-77's "Neither finding is CRITICAL.", "found nothing CRITICAL"): it collects, and judge refuses to drop or lower it; the + // follow-up tags such lines summary_candidate so judge may dismiss a tagged one on record; fails_when=a summary line collects nothing + // or a weaker label, which would mean a drop path is back; why_new=GST-435 removed the drop after it lost blockers in three review + // rounds; seam=parseFindings, collect and judge; no_claim=that a phantom is free (it stays CRITICAL in the judged set) + test('known phantoms: closing summaries keep their label until the summary_candidate follow-up', () => { + const fixture = (name: string) => fs.readFileSync(path.join(ROOT, 'test/fixtures/review-ledger', name), 'utf8'); + const replies: Array<[string, string, number]> = [['red-team', 'harn15-ship2-red-team.txt', 3], ['red-team', 'harn15-ship2-p2-red-team.txt', 3], + ['fix-check', 'harn15-ship2-p2-fix-check.txt', 4], ['fix-check', 'harn15-152-p2-fix-check.txt', 2]]; + for (const [reader, name, json] of replies) { + const found = parseFindings(reader, fixture(name)); + expect([name, found.map(f => f.label)]).toEqual([name, ['CRITICAL', ...Array(json).fill('INFORMATIONAL')]]); + expect(found[0]!.raw).toMatch(/(no|nothing( at)?) CRITICAL/); + } + const fc = fixture('geva-77-fix-check.txt'); + const d = tmp(); + const merged = path.join(d, 'merged.jsonl'); + const r = collect(path.join(d, 'l.jsonl'), 'fix-check', fc, merged); + expect([r.review, r.lines.map(l => [l.id, l.label])]).toEqual([true, [['fix-check#1', 'INFORMATIONAL'], ['fix-check#2', 'INFORMATIONAL'], ['fix-check#3', 'CRITICAL']]]); + expect(r.lines[2]!.raw).toStartWith('Neither finding is CRITICAL.'); + const judged = path.join(d, 'judged.jsonl'); + fs.writeFileSync(judged, r.lines.map(l => JSON.stringify({ id: l.id, severity: 'INFORMATIONAL' })).join('\n') + '\n'); + expect(judge(readJsonl(merged), readJsonl(judged)).ok).toBe(false); + for (const line of ['There are no CRITICAL findings.', 'No CRITICAL or High findings to report.', 'I found nothing CRITICAL.', "So there's nothing at CRITICAL.", + 'Neither finding is CRITICAL.', 'Nothing here is CRITICAL.', 'Neither fix is CRITICAL.', 'Nothing in this diff is CRITICAL.', 'This is not CRITICAL.']) + expect([line, parseFindings('outside-voice', line).map(f => f.label)]).toEqual([line, ['CRITICAL']]); + expect(parseFindings('outside-voice', 'Severity: Low (not High)').map(f => f.label)).toEqual(['High']); + }); + + // Value: protects=item layouts collect as on main: an indented JSON finding keeps its JSON severity, an indented label heading sets + // the section for the next item, and a later Blocks: yes raises the finding a Severity field line or JSON line opened; + // fails_when=any of these collects a lower label or a different finding than main; why_new=GST-435's paragraph-split draft broke each + // of these and was deferred; seam=parseFindings; no_claim=that main's reading is the right one (known, deferred to the follow-up: + // HARN-15 ship2 native item 4 collects without its title, and an indented label heading rates the next item, not the one above it) + test('item layouts collect as on main; the later-paragraph split and indented label headings are known deferred shapes', () => { + const native = fs.readFileSync(path.join(ROOT, 'test/fixtures/review-ledger/harn15-ship2-p2-adversarial-native.txt'), 'utf8'); + const found = parseFindings('adversarial-native', native); + expect(found.map(f => f.label)).toEqual(['CRITICAL', 'CRITICAL', 'CRITICAL', 'CRITICAL', 'CRITICAL', 'Low']); + expect(parseFindings('outside-voice', '1. **Race on the lock** (a.ts:3)\n - the writer holds no lock\n\n Fix: take it first. Severity: High. Blocks: no.').map(f => f.label)).toEqual(['High']); + expect(parseFindings('outside-voice', '1. Lock race (a.ts:3)\n\n Fix: take it first. Blocks: yes\n2. Cache drift (c.ts:4)').map(f => f.label)).toEqual(['CRITICAL']); + expect(parseFindings('red-team', '1. Unescaped query\n {"severity":"critical","summary":"Low-level race in q.ts"}').map(f => [f.label, f.raw])) + .toEqual([['critical', '{"severity":"critical","summary":"Low-level race in q.ts"}']]); + expect(parseFindings('red-team', '1. Unescaped query\n **Critical**\n2. Token leak in the logger').map(f => [f.label, f.raw])).toEqual([['Critical', '2. Token leak in the logger']]); + expect(parseFindings('red-team', '1. Unescaped query\n ## High\n2. Token leak in the logger').map(f => [f.label, f.raw])).toEqual([['High', '2. Token leak in the logger']]); + expect(parseFindings('red-team', '1. Race in queue\n- Severity: Low\n this one blocks. Blocks: yes').map(f => f.label)).toEqual(['CRITICAL']); + expect(parseFindings('red-team', '1. Unescaped query\n {"severity":"low","summary":"race"}\n this blocks the merge. Blocks: yes').map(f => [f.label, f.raw])) + .toEqual([['CRITICAL', '{"severity":"low","summary":"race"} | this blocks the merge. Blocks: yes']]); + }); + // Value: protects=a non-review the same dispatch later answers with a review is voided (counted, VERIFY clean), and a failed outside // voice recorded with --unavailable reads UNAVAILABLE (missing coverage, never a review) without blocking, while --unavailable is // refused for any other reader; fails_when=one outside-voice timeout or one refusal makes VERIFY dirty for good, or --unavailable From 1ea86923a86129d1f32828b36acfe6f91f17c8e6 Mon Sep 17 00:00:00 2001 From: Garry Tan Date: Sun, 1 Nov 2026 09:35:19 -0800 Subject: [PATCH 4/9] v1.92.37.0 fix: review briefs check template slots before pasting reviewer text (GST-797) (#3797) * fix: check brief slots before pasting reviewer text (GST-797) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix: put held reviewer text back only at its per-render token (GST-797 adversarial) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * docs: changelog fragment for GST-797 Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * docs: changelog fragment states the byte-identity claim without an unsourced count Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * docs: changelog fragment scopes the byte-identity claim to briefs that quote no slot name Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * docs: review-policy says reviewer text reaches the brief as written (GST-797) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> --------- Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> --- CHANGELOG.md | 4 ++++ VERSION | 2 +- agents-digest/gstack-AGENTS.md | 2 +- docs/review-policy.md | 6 ++++- lib/review-brief.ts | 17 ++++++++++---- package.json | 2 +- test/review-dispatch.test.ts | 42 ++++++++++++++++++++++++++++++++++ 7 files changed, 67 insertions(+), 8 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c92999f25..bacd0020f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,9 @@ # Changelog +## [1.92.37.0] - 2026-11-01 + +- **A Red Team finding that quotes `origin/` no longer stops `/ship`'s review** (`lib/review-brief.ts`, GST-797). The renderer checked each finished brief for unfilled slots like ``, `` and `` after the reviewers' findings and past learnings had been pasted in, so a finding that quoted one failed the render with `BRIEF_RENDER_FAILED: red-team: unfilled placeholder ` (seen on #3795). A quoted `` was also quietly swapped for the commit sha. The check now runs on the brief before that text goes in, and the quoted text reaches the reader exactly as written. A slot the section really leaves open still fails the render. A brief whose findings and learnings quote no slot name renders the same bytes as before. + ## [1.92.36.0] - 2026-11-01 **/ship's review collector keeps every severity label again, so a blocker named after "no CRITICAL issues except" is no longer lost.** v1.92.29.0 (GST-766) skipped any severity word that followed "no", "nothing", "none" and similar words, to stop a reviewer's closing line like "found nothing CRITICAL" from counting as a finding. That also threw away real blockers named in an exception clause: "No CRITICAL issues except the token leak in log.ts:3", "Nothing CRITICAL apart from the auth bypass (auth.ts:9)" and four more wordings collected nothing at all, so the gate never saw them. The collector now reads labels exactly as it did before v1.92.29.0. The reviewer's own Severity and Blocks fields are still recorded beside the label (`stated`), as in v1.92.29.0. diff --git a/VERSION b/VERSION index 188831bb6..1df70114c 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -1.92.36.0 +1.92.37.0 diff --git a/agents-digest/gstack-AGENTS.md b/agents-digest/gstack-AGENTS.md index 7b4ef5af8..c41ccdba5 100644 --- a/agents-digest/gstack-AGENTS.md +++ b/agents-digest/gstack-AGENTS.md @@ -1,4 +1,4 @@ -# gstack digest v1.92.36.0 — regenerate/re-copy after upgrading gstack +# gstack digest v1.92.37.0 — regenerate/re-copy after upgrading gstack Behavioral rules from gstack (https://github.com/garrytan/gstack), compressed for agent hosts without a full skill install. The full skills add workflows, diff --git a/docs/review-policy.md b/docs/review-policy.md index 7dddf25d7..6895500fa 100644 --- a/docs/review-policy.md +++ b/docs/review-policy.md @@ -462,7 +462,11 @@ ones, and the arm lost blockers. `bin/gstack-review-dispatch` closes both ends: literal diff base, the plan's `DIFF_CMD` excludes, stack, test framework, learnings, checklist paths, the Red Team's merged findings and specialist count, and the outside voice's branch diff. A section that lost an anchor or placeholder - refuses (`BRIEF_RENDER_FAILED`) instead of rendering something else. + refuses (`BRIEF_RENDER_FAILED`) instead of rendering something else, and so does + a slot the section leaves unfilled (every reader but fix-check and the outside voice). + That check runs before the findings and learnings go in, and they reach the reader + as written, so a finding that quotes `origin/` neither fails the render nor + gets filled (GST-797). 2. The dispatch program passes that file's content unchanged as the reader's prompt and runs `sent` on what it passed: a hash that differs from the rendered one is `BRIEF_MISMATCH`, and that reader's review does not count. diff --git a/lib/review-brief.ts b/lib/review-brief.ts index 67086d89e..fe1a3a5e7 100644 --- a/lib/review-brief.ts +++ b/lib/review-brief.ts @@ -15,7 +15,7 @@ * targeted classes, brief (review/specialists/targeted.md's text), checklist (its path), diff_base, stack, test_fw, learnings */ import { spawnSync } from 'node:child_process'; -import { createHash } from 'node:crypto'; +import { createHash, randomUUID } from 'node:crypto'; import * as fs from 'node:fs'; import * as path from 'node:path'; import { renderFixCheckPrompt } from '../scripts/resolvers/fix-check'; @@ -83,12 +83,21 @@ const SPECIALIST_DIFF = 'run\n`DIFF_BASE= && git diff "$DIFF_BASE" ', '', '', '{checklist path}', '{STACK}', '{TEST_FW}', '{merged findings summary}', '{red-team checklist path}', '{learnings']; -/** Render one reader's brief. Throws BriefError on a missing slot, a section that no longer carries an anchor or placeholder, or a placeholder left unfilled. */ +/** + * Render one reader's brief. Throws BriefError on a missing slot, a section that no longer carries an anchor or placeholder, or a placeholder left unfilled. + * Findings and learnings are reviewer text that may quote a slot name such as origin/ (GST-797): they render as a token, so the + * placeholder check and the slot fills never see them, and go in last, trimmed as renderRole trims them. The token carries a + * per-render nonce, so no other slot's text (a diff, a hunk) can name it. + */ export function renderBrief(role: BriefRole, slots: Slots, t: SectionTexts): string { - const text = renderRole(role, slots, t); + const nonce = randomUUID(); + const keys = ['findings', 'learnings'].filter(k => slots[k]?.trim()); + const held: Slots = { ...slots }; + for (const k of keys) held[k] = `\u0000${nonce}:${k}\u0000`; + const text = renderRole(role, held, t); const left = role === 'fix-check' || role === 'outside-voice' ? [] : PLACEHOLDERS.filter(p => text.includes(p)); if (left.length) throw new BriefError(`${role}: unfilled placeholder ${left.join(', ')}`); - return text; + return keys.reduce((out, k) => out.split(held[k]!).join(slots[k]!.trim()), text); } function renderRole(role: BriefRole, slots: Slots, t: SectionTexts): string { diff --git a/package.json b/package.json index c6e216075..161b5cc27 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "gstack", - "version": "1.92.36", + "version": "1.92.37", "description": "Garry's Stack — Claude Code skills + fast headless browser. One repo, one install, entire AI engineering workflow.", "license": "MIT", "type": "module", diff --git a/test/review-dispatch.test.ts b/test/review-dispatch.test.ts index 0dd5dcfd8..e1aa85d8d 100644 --- a/test/review-dispatch.test.ts +++ b/test/review-dispatch.test.ts @@ -106,6 +106,48 @@ describe('gstack-review-dispatch render: briefs from the sections, slots only', expect(fs.readFileSync(field(r.stdout, 'file'), 'utf8')).toContain(`Read each checklist at ${lists} (tag each finding's`); expect(run(['render', '--role', 'specialist-batched', '--out', out, '--diff-base', SHA, '--checklists', 'testing,maintenance']).stderr).toContain('BRIEF_RENDER_FAILED: checklist not found'); }); + + // Value: protects=a finding or learning that quotes a slot name reaches its reader byte for byte instead of failing the render; + // fails_when=the unfilled-slot check runs after findings or learnings are pasted in, or a later slot fill rewrites the pasted text + // (#3795: a finding quoting `origin/` failed with BRIEF_RENDER_FAILED: red-team: unfilled placeholder ); + // why_new=GST-797; seam=lib/review-brief.ts renderBrief via gstack-review-dispatch render; no_claim=fix-check or outside-voice content + test('findings and learnings that quote slot names render verbatim', () => { + const quoted = ['[HIGH] bin/x.ts:4 runs `git merge-base origin/ HEAD` against a stale ref', + '[MEDIUM] lib/y.ts:9 builds `DIFF_BASE= && git diff "$DIFF_BASE" ` by hand'].join('\n'); + const out = tmp(); + const w = (name: string, text: string) => { const f = path.join(out, name); fs.writeFileSync(f, text); return f; }; + const red = run(['render', '--role', 'red-team', '--out', out, '--diff-base', SHA, '--findings-file', w('findings.txt', `${quoted}\n`), '--specialists', '2']); + expect(red.status, red.stderr).toBe(0); + expect(fs.readFileSync(field(red.stdout, 'file'), 'utf8')).toContain(quoted); + const spec = run(['render', '--role', 'specialist', '--name', 'testing', '--out', out, '--diff-base', SHA, '--exclude', "-- . ':(exclude)*.lock'", '--learnings-file', w('learnings.txt', quoted)]); + expect(spec.status, spec.stderr).toBe(0); + const brief = fs.readFileSync(field(spec.stdout, 'file'), 'utf8'); + expect(brief).toContain(`Past learnings: ${quoted}`); + expect(brief).toContain(`git diff "$DIFF_BASE" -- . ':(exclude)*.lock'`); + }); + + // Value: protects=the unfilled-slot refusal still fires when a section really leaves a slot open, quoted findings or not; + // fails_when=the GST-797 fix skips the check, or quoted content masks a real open slot; seam=lib/review-brief.ts renderBrief + test('a slot the section really leaves open still refuses the render', () => { + const t = sectionTexts(ROOT); + const slots = { diff_base: SHA, checklist: '/x/red-team.md', specialists: '2' }; + const open = { ...t, redTeam: `${t.redTeam} Compare against origin/.` }; + expect(() => renderBrief('red-team', slots, open)).toThrow(/^red-team: unfilled placeholder $/); + expect(() => renderBrief('red-team', { ...slots, findings: 'quotes `origin/`' }, open)).toThrow(/^red-team: unfilled placeholder $/); + expect(() => renderBrief('specialist', { ...slots, name: 'testing', learnings: 'see ' }, { ...t, specialist: `${t.specialist} See .` })).toThrow(/^specialist: unfilled placeholder $/); + }); + + // Value: protects=a diff or hunk that carries NUL bytes reaches its reader unchanged and never pulls in another slot's text; + // fails_when=renderBrief's put-back matches a token the caller can type, so a diff with \0learnings\0 splices the project's + // learnings into the outside voice's brief and \0findings\0 crashes the render (GST-797 adversarial pass); seam=lib/review-brief.ts renderBrief + test('reviewer text is put back only where the render held it', () => { + const t = sectionTexts(ROOT); + const diff = '+a \u0000learnings\u0000 b \u0000findings\u0000 c'; + const outside = renderBrief('outside-voice', { diff_base: SHA, diff, learnings: 'SECRET-LEARN', findings: 'F' }, t); + expect(outside).toContain(diff); + expect(outside).not.toContain('SECRET-LEARN'); + expect(renderBrief('fix-check', { fix_list: 'a.ts:3 fixed', hunks: diff, tests: '3 pass' }, t)).toContain(diff); + }); }); describe('gstack-review-dispatch sent, collect, judge and verify: nothing changed on the way in or out', () => { From ab2852fb40219669c583f34a6f69b08f623543b4 Mon Sep 17 00:00:00 2001 From: Garry Tan Date: Sun, 1 Nov 2026 12:15:10 -0800 Subject: [PATCH 5/9] v1.92.38.0 fix(brain-sync): set local edits aside around the retry merge and say why it failed (#3704) (#3728) * test(brain-sync): a rejected push's retry merge must not wedge on local edits (#3704) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix(brain-sync): set local edits aside around the retry merge and say why it failed (#3704) After a rejected push, git refused the fetch-and-merge whenever a file it would update had uncommitted local edits, and brain-sync discarded git's error, so every later run hit the same refusal and stayed push_failed. The merge now stashes tracked edits first and restores them after; a failed merge is aborted; a conflicting restore keeps the merged version in the working tree and names the stash and the restore command in the status. push_failed carries git's merge reason and the real push error line. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix(brain-sync): set aside only the paths the retry merge changes, read them literally, and pop only our own stash entry (#3704) Pre-landing review fixes: a pattern-like conflicting file name no longer resets unrelated local edits, a stash push that saves nothing no longer pops an older entry, and a file that never checks out clean no longer strands every other local edit in the stash. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * docs(brain-sync): describe the retry merge, the kept stash and the push_failed reason (#3704) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> --------- Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> --- CHANGELOG.md | 12 +++ VERSION | 2 +- agents-digest/gstack-AGENTS.md | 2 +- bin/gstack-brain-sync | 61 ++++++++++- docs/gbrain-sync-errors.md | 6 +- docs/gbrain-sync.md | 9 ++ package.json | 2 +- test/brain-sync.test.ts | 192 +++++++++++++++++++++++++++++++++ 8 files changed, 280 insertions(+), 6 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index bacd0020f..5dcbe0188 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,17 @@ # Changelog +## [1.92.38.0] - 2026-11-01 + +**brain-sync no longer gets stuck in `push_failed` when another machine changed a file you have edited locally.** After a rejected push, brain-sync fetches and merges the other machine's commits. Git refuses that merge when a file it would update has uncommitted local edits. brain-sync hid git's error and hit the same refusal on every run, so cross-machine sync stopped for good (#3704). + +### Fixed +- **The retry merge sets aside local edits to the files it changes and puts them back** (`bin/gstack-brain-sync`). Other local edits stay where they are, file names are never read as patterns, and only the stash entry this run made is put back. A failed merge is aborted, so it never leaves conflict markers or a half-finished merge in `~/.gstack`. +- **When a local edit conflicts with the other machine's change, the other machine's version stays.** The local edit is kept in a git stash. The status names the stash and the exact `git -C ~/.gstack --literal-pathspecs restore --source= -- ` command that brings it back. A later sync never pushes the old local copy over the other machine's change. Files with a merge driver (`*.jsonl`, the union-merged plans) merge as before. +- **`push_failed` now says why.** It carries git's merge reason (for example `CONFLICT (content): Merge conflict in developer-profile.json`) and the real push error line instead of git's `To ` banner. + +### Tests +- `test/brain-sync.test.ts`: a dirty file the remote didn't touch, a dirty file the remote also changed (including a second sync and the restore command), local-delete/remote-edit, local-edit/remote-delete, a conflicting file whose name looks like a pattern, a file that never checks out clean, a stash push that saves nothing, and a committed conflict. Five of the eight fail on main. + ## [1.92.37.0] - 2026-11-01 - **A Red Team finding that quotes `origin/` no longer stops `/ship`'s review** (`lib/review-brief.ts`, GST-797). The renderer checked each finished brief for unfilled slots like ``, `` and `` after the reviewers' findings and past learnings had been pasted in, so a finding that quoted one failed the render with `BRIEF_RENDER_FAILED: red-team: unfilled placeholder ` (seen on #3795). A quoted `` was also quietly swapped for the commit sha. The check now runs on the brief before that text goes in, and the quoted text reaches the reader exactly as written. A slot the section really leaves open still fails the render. A brief whose findings and learnings quote no slot name renders the same bytes as before. diff --git a/VERSION b/VERSION index 1df70114c..d99ed55f4 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -1.92.37.0 +1.92.38.0 diff --git a/agents-digest/gstack-AGENTS.md b/agents-digest/gstack-AGENTS.md index c41ccdba5..f10b4a111 100644 --- a/agents-digest/gstack-AGENTS.md +++ b/agents-digest/gstack-AGENTS.md @@ -1,4 +1,4 @@ -# gstack digest v1.92.37.0 — regenerate/re-copy after upgrading gstack +# gstack digest v1.92.38.0 — regenerate/re-copy after upgrading gstack Behavioral rules from gstack (https://github.com/garrytan/gstack), compressed for agent hosts without a full skill install. The full skills add workflows, diff --git a/bin/gstack-brain-sync b/bin/gstack-brain-sync index 0c5d07afb..25625c2bb 100755 --- a/bin/gstack-brain-sync +++ b/bin/gstack-brain-sync @@ -585,6 +585,60 @@ transcripts_consented() { transcript_policy --check 2>/dev/null } +# After a rejected push: merge origin/ into HEAD (#3704). git refuses +# a merge that would overwrite uncommitted edits to tracked files, and that +# refusal used to repeat on every run, so local edits to the paths the merge +# changes are set aside first and put back after; other local edits stay in +# place, and only a stash entry this call created is put back. Paths are +# literal, never patterns. A failed merge is aborted, so no half-finished merge +# or conflict markers block the next commit; git's reason lands in MERGE_ERR. +# When putting an edit back conflicts with what the merge brought in, the +# merged version stays in the working tree, so a later sync never publishes +# the stale local side over the other machine's change, and the local edit +# stays in the kept stash entry, which the status names with the command +# that restores it. +MERGE_ERR="" +merge_origin_keeping_local_edits() { + local branch="$1" out rc=0 p stash_before="" stash_sha="" + local -a lit=(git --literal-pathspecs -C "$GSTACK_HOME") blocking=() + while IFS= read -r -d '' p; do + "${lit[@]}" diff --quiet --no-renames HEAD "origin/$branch" -- "$p" 2>/dev/null || blocking+=("$p") + done < <("${lit[@]}" diff -z --no-renames --name-only HEAD 2>/dev/null) + if [ "${#blocking[@]}" -gt 0 ]; then + stash_before=$("${lit[@]}" rev-parse -q --verify refs/stash 2>/dev/null) + if ! out=$("${lit[@]}" stash push -q -m "gstack-brain-sync: local edits before merging origin/$branch" -- "${blocking[@]}" 2>&1); then + MERGE_ERR="could not set local edits aside: $(printf '%s\n' "$out" | head -1)" + return 1 + fi + stash_sha=$("${lit[@]}" rev-parse -q --verify refs/stash 2>/dev/null) + [ "$stash_sha" != "$stash_before" ] || stash_sha="" + fi + out=$("${lit[@]}" merge --no-edit "origin/$branch" 2>&1) || rc=$? + if [ "$rc" -ne 0 ]; then + MERGE_ERR=$(printf '%s\n' "$out" | grep -m1 -E '^(CONFLICT|error|fatal)' || printf '%s\n' "$out" | head -1) + "${lit[@]}" merge --abort >/dev/null 2>&1 || true + fi + [ -n "$stash_sha" ] || return "$rc" + out=$("${lit[@]}" stash pop -q 2>&1) && return "$rc" + local paths="" args="" failed=0 + while IFS= read -r -d '' p; do + if "${lit[@]}" cat-file -e "HEAD:$p" 2>/dev/null; then + "${lit[@]}" checkout -q HEAD -- "$p" >/dev/null 2>&1 || failed=1 + else + { "${lit[@]}" rm -q --cached -- "$p" >/dev/null 2>&1 && rm -f -- "$GSTACK_HOME/$p"; } || failed=1 + fi + paths="$paths ${p}" + args="$args $(printf '%q' "$p")" + done < <("${lit[@]}" diff -z --name-only --diff-filter=U 2>/dev/null) + "${lit[@]}" reset -q >/dev/null 2>&1 || failed=1 + if [ -z "$paths" ] || [ "$failed" = 1 ]; then + MERGE_ERR="local edits could not be put back after merging origin/$branch ($(printf '%s\n' "$out" | head -1)); they are saved in git -C $GSTACK_HOME stash list" + return 1 + fi + ST_NOTE="$ST_NOTE; local edits to$paths conflicted with the merged remote version, which is kept; the local edits are saved in stash $stash_sha (get them back: git -C $GSTACK_HOME --literal-pathspecs restore --source=$stash_sha --$args)" + return "$rc" +} + # Before every push: scan the unpublished range for transcript pages outside # the current consent; when some exist, the helper rewrites gstack-brain-sync's # own unpublished commits without them, or refuses (exit 3) when it cannot. @@ -1379,7 +1433,7 @@ subcmd_once() { bash -c 'git -C "$1" fetch origin 2>/dev/null' _ "$GSTACK_HOME"; then local branch branch=$(git -C "$GSTACK_HOME" rev-parse --abbrev-ref HEAD 2>/dev/null || echo main) - if git -C "$GSTACK_HOME" merge --no-edit "origin/$branch" >/dev/null 2>&1 && guard_unpublished_range; then + if merge_origin_keeping_local_edits "$branch" && guard_unpublished_range; then validate_outgoing_paths || exit 0 if GSTACK_HOME="$GSTACK_HOME" _receipted_git closed brain-sync "$push_host" curated-memory-git-push "artifacts_sync_mode!=off" \ bash -c 'git -C "$1" push origin HEAD 2>/dev/null' _ "$GSTACK_HOME"; then @@ -1391,7 +1445,10 @@ subcmd_once() { fi fi # Commit exists locally; the run-start detector re-pushes it next time. - write_status "push_failed" "push failed: $(printf '%s' "$push_err" | head -1); commit retained locally, will retry next run" + local push_reason + push_reason=$(printf '%s\n' "$push_err" | grep -v -E '^(To |hint:)' | head -1) + [ -n "$push_reason" ] || push_reason=$(printf '%s\n' "$push_err" | head -1) + write_status "push_failed" "push failed: $push_reason${MERGE_ERR:+; merging origin failed: $MERGE_ERR}; commit retained locally, will retry next run" finalize_queue "$snapshot_file" "$class_file" "$paths_file" exit 0 } diff --git a/docs/gbrain-sync-errors.md b/docs/gbrain-sync-errors.md index 1d6f47990..cd81aa9dd 100644 --- a/docs/gbrain-sync-errors.md +++ b/docs/gbrain-sync-errors.md @@ -107,7 +107,11 @@ After fixing auth, run any skill to retry sync automatically. git's error appears after the colon. **Cause.** Could be network issue, rejected push (remote ahead), server 500, -or repo access revoked. +or repo access revoked. The line is git's own error, not its `To ` +banner or `hint:` lines. After a rejected push, brain-sync fetches and merges +the other machine's commits; when that merge fails, the status adds +`; merging origin failed: ` (for example `CONFLICT (content): Merge +conflict in developer-profile.json`). **Fix.** Look at `~/.gstack/.brain-sync-status.json` for more detail, or run: ```bash diff --git a/docs/gbrain-sync.md b/docs/gbrain-sync.md index d53b57b7b..43d7f2e00 100644 --- a/docs/gbrain-sync.md +++ b/docs/gbrain-sync.md @@ -191,6 +191,15 @@ append commits. Git's default would conflict at the file tail, but the You shouldn't see conflict prompts. If you do (a real semantic conflict, like two machines editing the same plan), git will stop and prompt. +When a push is rejected, brain-sync fetches and merges the other machine's +commits itself. Local edits to files that merge would change are set aside +and put back afterward, and a failed merge is aborted, so `~/.gstack` never +holds conflict markers. If a local edit conflicts with the other machine's +change, the other machine's version stays in the working tree and your edit +is kept in a git stash; `gstack-brain-sync --status` names the stash and the +`git -C ~/.gstack --literal-pathspecs restore --source= -- ` +command that brings it back. + ## Cross-machine pull cadence The preamble runs `git fetch` + `git merge --ff-only` once per 24 hours diff --git a/package.json b/package.json index 161b5cc27..87f13cf66 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "gstack", - "version": "1.92.37", + "version": "1.92.38", "description": "Garry's Stack — Claude Code skills + fast headless browser. One repo, one install, entire AI engineering workflow.", "license": "MIT", "type": "module", diff --git a/test/brain-sync.test.ts b/test/brain-sync.test.ts index 7bffd7c45..ff7ee1432 100644 --- a/test/brain-sync.test.ts +++ b/test/brain-sync.test.ts @@ -825,6 +825,198 @@ describe('gstack-brain-sync per-file hold', () => { expect(remoteFiles()).not.toContain(CLEAN); }); + describe('a rejected push merges the remote without wedging (#3704)', () => { + const SHARED = 'developer-profile.json'; + const OTHER = 'projects/p/ceo-plans/other.md'; + function peerCommit(p: string, body: string) { + const peer = fs.mkdtempSync(path.join(os.tmpdir(), 'brain-sync-peer-')); + try { + expect(git(['clone', '-q', bareRemote, peer]).status).toBe(0); + fs.mkdirSync(path.dirname(path.join(peer, p)), { recursive: true }); + fs.writeFileSync(path.join(peer, p), body); + expect(git(['add', '-f', '--', p], peer).status).toBe(0); + expect(git(['-c', 'user.name=peer', '-c', 'user.email=peer@example.com', 'commit', '-qm', `peer ${p}`], peer).status).toBe(0); + expect(git(['push', '-q', 'origin', 'HEAD'], peer).status).toBe(0); + } finally { + fs.rmSync(peer, { recursive: true, force: true }); + } + } + function setup() { + init(); + write(SHARED, '# shared v1\n'); + write(OTHER, '# other v1\n'); + expect(drain().status).toBe(0); + expect(statusJson().status).toBe('ok'); + // The retry merge commits with the ambient identity; a CI runner has none. + expect(git(['config', 'user.name', 'fixture']).status).toBe(0); + expect(git(['config', 'user.email', 'fixture@example.com']).status).toBe(0); + } + const unmerged = () => git(['ls-files', '--unmerged']).stdout.trim(); + const mergeHead = () => fs.existsSync(path.join(tmpHome, '.git', 'MERGE_HEAD')); + + test('a dirty tracked file the remote did not touch rides through the merge', () => { + setup(); + peerCommit(SHARED, '# shared from the peer\n'); + write(OTHER, '# other, local edit not queued\n', false); + write(CLEAN, '# a plan\n'); + expect(drain().status).toBe(0); + expect(statusJson().status).toBe('ok'); + expect(remoteFiles()).toContain(CLEAN); + expect(remoteShow(SHARED).stdout).toBe('# shared from the peer\n'); + expect(fs.readFileSync(path.join(tmpHome, OTHER), 'utf-8')).toBe('# other, local edit not queued\n'); + expect(fs.readFileSync(path.join(tmpHome, SHARED), 'utf-8')).toBe('# shared from the peer\n'); + }); + + /** The restore command the status names, run as printed. */ + function recover(message: string) { + const m = /get them back: (git -C \S+ --literal-pathspecs restore --source=([0-9a-f]{40}) -- .+?)\)/.exec(message); + expect(m).not.toBeNull(); + const r = spawnSync('bash', ['-c', m![1]], { encoding: 'utf-8', timeout: 30_000 }); + expect(r.status).toBe(0); + return m![2]; + } + + test('a dirty tracked file the remote also changed no longer leaves the push failed', () => { + setup(); + peerCommit(SHARED, '# shared from the peer\n'); + write(SHARED, '# shared, local edit not queued\n', false); + write(CLEAN, '# a plan\n'); + expect(drain().status).toBe(0); + const s = statusJson(); + expect(s.status).toBe('ok'); + expect(remoteFiles()).toContain(CLEAN); + expect(remoteShow(SHARED).stdout).toBe('# shared from the peer\n'); + // The merged version stays in the working tree: no conflict markers, + // nothing staged, and nothing stale for a later sync to publish. + expect(fs.readFileSync(path.join(tmpHome, SHARED), 'utf-8')).toBe('# shared from the peer\n'); + expect(unmerged()).toBe(''); + expect(staged()).toBe(''); + expect(s.message).toContain(`local edits to ${SHARED} conflicted`); + const sha = /saved in stash ([0-9a-f]{40})/.exec(s.message)?.[1]; + expect(sha).toBeTruthy(); + // A second sync run (same file re-queued, plus another) keeps the peer's + // edit on the remote and the stashed local edit intact. + run(['gstack-brain-enqueue', SHARED]); + write(OTHER, '# other v2\n'); + expect(drain().status).toBe(0); + expect(statusJson().status).toBe('ok'); + expect(remoteShow(SHARED).stdout).toBe('# shared from the peer\n'); + expect(git(['show', `${sha}:${SHARED}`]).stdout).toBe('# shared, local edit not queued\n'); + // The printed command brings the local edit back. + expect(recover(s.message)).toBe(sha!); + expect(fs.readFileSync(path.join(tmpHome, SHARED), 'utf-8')).toBe('# shared, local edit not queued\n'); + }); + + test('a local deletion of a file the remote changed keeps the remote file and stashes the deletion', () => { + setup(); + peerCommit(SHARED, '# shared from the peer\n'); + fs.rmSync(path.join(tmpHome, SHARED)); + write(CLEAN, '# a plan\n'); + expect(drain().status).toBe(0); + const s = statusJson(); + expect(s.status).toBe('ok'); + expect(remoteShow(SHARED).stdout).toBe('# shared from the peer\n'); + expect(fs.readFileSync(path.join(tmpHome, SHARED), 'utf-8')).toBe('# shared from the peer\n'); + expect(unmerged()).toBe(''); + expect(s.message).toContain(`local edits to ${SHARED} conflicted`); + recover(s.message); + expect(fs.existsSync(path.join(tmpHome, SHARED))).toBe(false); + }); + + test('a local edit of a file the remote deleted keeps the deletion and stashes the edit', () => { + setup(); + const peer = fs.mkdtempSync(path.join(os.tmpdir(), 'brain-sync-peer-')); + try { + expect(git(['clone', '-q', bareRemote, peer]).status).toBe(0); + expect(git(['rm', '-q', '--', SHARED], peer).status).toBe(0); + expect(git(['-c', 'user.name=peer', '-c', 'user.email=peer@example.com', 'commit', '-qm', 'peer rm'], peer).status).toBe(0); + expect(git(['push', '-q', 'origin', 'HEAD'], peer).status).toBe(0); + } finally { + fs.rmSync(peer, { recursive: true, force: true }); + } + write(SHARED, '# shared, local edit not queued\n', false); + write(CLEAN, '# a plan\n'); + expect(drain().status).toBe(0); + const s = statusJson(); + expect(s.status).toBe('ok'); + expect(remoteFiles()).not.toContain(SHARED); + expect(fs.existsSync(path.join(tmpHome, SHARED))).toBe(false); + expect(unmerged()).toBe(''); + recover(s.message); + expect(fs.readFileSync(path.join(tmpHome, SHARED), 'utf-8')).toBe('# shared, local edit not queued\n'); + }); + + test('a conflicting file whose name looks like a pattern resets only itself', () => { + setup(); + const GLOB = '[d]eveloper-profile.json'; + peerCommit(GLOB, '# glob v1\n'); + expect(git(['fetch', '-q', 'origin']).status).toBe(0); + expect(git(['merge', '-q', '--ff-only', 'origin/main']).status).toBe(0); + peerCommit(GLOB, '# glob from the peer\n'); + write(GLOB, '# glob, local edit not queued\n', false); + write(SHARED, '# shared, local edit not queued\n', false); + write(CLEAN, '# a plan\n'); + expect(drain().status).toBe(0); + const s = statusJson(); + expect(s.status).toBe('ok'); + expect(fs.readFileSync(path.join(tmpHome, GLOB), 'utf-8')).toBe('# glob from the peer\n'); + expect(fs.readFileSync(path.join(tmpHome, SHARED), 'utf-8')).toBe('# shared, local edit not queued\n'); + recover(s.message); + expect(fs.readFileSync(path.join(tmpHome, GLOB), 'utf-8')).toBe('# glob, local edit not queued\n'); + expect(fs.readFileSync(path.join(tmpHome, SHARED), 'utf-8')).toBe('# shared, local edit not queued\n'); + }); + + test('a file that never checks out clean does not strand the other local edits', () => { + setup(); + const CRLF = 'projects/p/ceo-plans/crlf.md'; + write(CRLF, '# crlf\r\nline\r\n'); + expect(drain().status).toBe(0); + fs.mkdirSync(path.join(tmpHome, '.git', 'info'), { recursive: true }); + fs.writeFileSync(path.join(tmpHome, '.git', 'info', 'attributes'), '*.md text eol=lf\n'); + peerCommit(SHARED, '# shared from the peer\n'); + write(OTHER, '# other, local edit not queued\n', false); + write(CLEAN, '# a plan\n'); + expect(drain().status).toBe(0); + expect(statusJson().status).toBe('ok'); + expect(remoteFiles()).toContain(CLEAN); + expect(fs.readFileSync(path.join(tmpHome, OTHER), 'utf-8')).toBe('# other, local edit not queued\n'); + expect(git(['stash', 'list']).stdout.trim()).toBe(''); + }); + + test('a stash push that saves nothing never pops an older stash entry', () => { + setup(); + write(OTHER, '# other, older stashed work\n', false); + expect(git(['stash', 'push', '-q', '-m', 'older work']).status).toBe(0); + peerCommit(SHARED, '# shared from the peer\n'); + write(SHARED, '# shared, local edit not queued\n', false); + write(CLEAN, '# a plan\n'); + const shim = gitShim('case " $* " in *" stash push "*) exit 0;; esac'); + expect(drain(shim.env).status).toBe(0); + expect(statusJson().status).toBe('push_failed'); + expect(git(['stash', 'list']).stdout).toContain('older work'); + expect(fs.readFileSync(path.join(tmpHome, OTHER), 'utf-8')).toBe('# other v1\n'); + expect(fs.readFileSync(path.join(tmpHome, SHARED), 'utf-8')).toBe('# shared, local edit not queued\n'); + }); + + test('a conflicting merge is aborted and git\'s reason reaches the status', () => { + setup(); + peerCommit(SHARED, '# shared from the peer\n'); + write(SHARED, '# shared, local commit\n'); + expect(drain().status).toBe(0); + const s = statusJson(); + expect(s.status).toBe('push_failed'); + expect(s.message).toContain(`Merge conflict in ${SHARED}`); + expect(mergeHead()).toBe(false); + expect(unmerged()).toBe(''); + expect(fs.readFileSync(path.join(tmpHome, SHARED), 'utf-8')).toBe('# shared, local commit\n'); + // The next drain is not blocked by a half-finished merge. + write(OTHER, '# other v2\n'); + expect(drain().status).toBe(0); + expect(statusJson().message).not.toContain('unmerged'); + expect(statusJson().message).toContain(`Merge conflict in ${SHARED}`); + }); + }); + test('a git add failure is reported, never swallowed', () => { if (!canRevokeWrites()) return; // chmod is advisory here (win32, root) init(); From 77fe28c39796cf5573e3d0836b83b2ee436a8f12 Mon Sep 17 00:00:00 2001 From: Garry Tan Date: Sun, 1 Nov 2026 12:30:10 -0800 Subject: [PATCH 6/9] v1.92.39.0 ci: main pushes reuse the merged PR's verified run of the same tree; dispatch-ci and --from-run go through the run verifier (GSTA-156 P3b) (#3709) * feat(pregate): gstack run profiles, dispatch-ci clears through the run verifier, --from-run tests stage (GSTA-156 P3b) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * ci(free-tests): main pushes reuse the merged pull request's verified run of the same tree (GSTA-156 P3b) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * test(cso): the free-tests aggregate still requires cso-docker-integration on its strict path, and only a verified reuse skips it (GSTA-156 P3b) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix(pregate): name the reuse profiles after no lane, so lane clears and ready --dispatch-ci keep the URL path until GST-555 (GSTA-156 P3b) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix(ci): the duration recorder grants actions: read to its windows-free-tests call, and --from-run refuses a run that recorded zero tests (GSTA-156 P3b) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * docs: pregate run_profiles row, no_verified_run code; changelog for caller grant and zero-test refusal Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> --------- Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> --- .github/workflows/free-durations-record.yml | 3 + .github/workflows/free-tests.yml | 105 +++++++++++- .github/workflows/windows-free-tests.yml | 81 ++++++++- .gstack/pregate.json | 4 + CHANGELOG.md | 22 +++ VERSION | 2 +- agents-digest/gstack-AGENTS.md | 2 +- bin/gstack-pregate | 42 ++--- docs/pregate.md | 106 ++++++++++-- lib/headless-artifacts.ts | 4 +- lib/pregate/checks/lanes.ts | 27 ++- lib/pregate/run-check.ts | 40 +++++ lib/pregate/types.ts | 3 + lib/run-evidence.ts | 48 +++++- package.json | 2 +- scripts/ci-tree-reuse.ts | 157 +++++++++++++++++ test/ci-reuse-workflow-wiring.test.ts | 152 +++++++++++++++++ test/ci-tree-reuse.test.ts | 176 ++++++++++++++++++++ test/cso-distribution.test.ts | 12 +- test/free-durations-record-workflow.test.ts | 2 +- test/free-tests-workflow-wiring.test.ts | 2 +- test/pregate-from-run.test.ts | 110 ++++++++++++ test/run-evidence.test.ts | 70 +++++++- test/windows-native-workflows.test.ts | 8 +- 24 files changed, 1114 insertions(+), 66 deletions(-) create mode 100644 lib/pregate/run-check.ts create mode 100755 scripts/ci-tree-reuse.ts create mode 100644 test/ci-reuse-workflow-wiring.test.ts create mode 100644 test/ci-tree-reuse.test.ts create mode 100644 test/pregate-from-run.test.ts diff --git a/.github/workflows/free-durations-record.yml b/.github/workflows/free-durations-record.yml index 9101104d3..8faa4598f 100644 --- a/.github/workflows/free-durations-record.yml +++ b/.github/workflows/free-durations-record.yml @@ -71,6 +71,9 @@ jobs: windows: uses: ./.github/workflows/windows-free-tests.yml + permissions: + contents: read + actions: read with: record_durations: true diff --git a/.github/workflows/free-tests.yml b/.github/workflows/free-tests.yml index 4af58829f..966419ad3 100644 --- a/.github/workflows/free-tests.yml +++ b/.github/workflows/free-tests.yml @@ -14,6 +14,15 @@ name: Free Tests # is permanent false comfort. # # Local `bun run test` still uses the existing bounded process pool. +# +# One full suite per tree (GSTA-156, docs/pregate.md#ci-reuse). The aggregate +# uploads a `tested-tree` record (tree.json) only after strict verification +# passes. A push to main first runs `reuse`: when the merged pull request's +# head has the pushed tree and a green pull_request or workflow_dispatch run of +# this workflow verifies (lib/run-evidence.ts), every suite job is skipped and +# the aggregate links that run instead. Any other answer, a reuse failure +# included, runs every job as before. Pull request and dispatch runs never +# consume; reused runs never upload a record, so they are never reused. on: pull_request: @@ -54,7 +63,40 @@ permissions: contents: read jobs: + # Main pushes only, and the one job with actions: read (it reads this + # repository's runs and their tested-tree artifacts). Every suite job below + # runs unless this job succeeded and reused a run; a skipped or failed reuse + # job runs them all. Their conditions start with !cancelled() because a + # skipped needed job would otherwise skip its dependents on pull_request and + # dispatch runs, where reuse never runs. + reuse: + if: github.event_name == 'push' && github.ref == 'refs/heads/main' + runs-on: ubuntu-24.04 + timeout-minutes: 5 + permissions: + contents: read + actions: read + outputs: + reused: ${{ steps.find.outputs.reused }} + run_id: ${{ steps.find.outputs.run_id }} + run_url: ${{ steps.find.outputs.run_url }} + tree: ${{ steps.find.outputs.tree }} + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false + - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 + with: + bun-version: 1.4.2 + - id: find + name: Find a green pull request or dispatch run of this exact tree + env: + GH_TOKEN: ${{ github.token }} + run: bun run scripts/ci-tree-reuse.ts find --workflow free-tests.yml --profile ci-reuse/free-tests + free-plan: + needs: reuse + if: ${{ !cancelled() && (needs.reuse.result != 'success' || needs.reuse.outputs.reused != 'true') }} runs-on: ubuntu-24.04 timeout-minutes: 5 outputs: @@ -106,6 +148,8 @@ jobs: if-no-files-found: error cso-macos-launcher: + needs: reuse + if: ${{ !cancelled() && (needs.reuse.result != 'success' || needs.reuse.outputs.reused != 'true') }} runs-on: macos-latest timeout-minutes: 15 steps: @@ -144,6 +188,8 @@ jobs: # default, and the job fails if that layout is not symlinked. It also sources # the Codex probe from zsh, macOS's default shell (#3024; no paid call). macos-named-regressions: + needs: reuse + if: ${{ !cancelled() && (needs.reuse.result != 'success' || needs.reuse.outputs.reused != 'true') }} runs-on: macos-latest timeout-minutes: 20 steps: @@ -188,6 +234,8 @@ jobs: bun test "${files[@]}" cso-windows-launcher: + needs: reuse + if: ${{ !cancelled() && (needs.reuse.result != 'success' || needs.reuse.outputs.reused != 'true') }} runs-on: windows-latest timeout-minutes: 15 steps: @@ -216,6 +264,8 @@ jobs: retention-days: 14 cso-docker-integration: + needs: reuse + if: ${{ !cancelled() && (needs.reuse.result != 'success' || needs.reuse.outputs.reused != 'true') }} runs-on: ubuntu-24.04 timeout-minutes: 20 steps: @@ -246,6 +296,8 @@ jobs: DOCKER_HOST: unix:///var/run/docker.sock typecheck: + needs: reuse + if: ${{ !cancelled() && (needs.reuse.result != 'success' || needs.reuse.outputs.reused != 'true') }} runs-on: ubuntu-24.04 timeout-minutes: 10 steps: @@ -269,6 +321,8 @@ jobs: # the quick tier also runs on it. Its pin equals GSTACK_BUN_DEFAULT; # test/bun-version-drift.test.ts checks this job exists and agrees. quick-bun-default: + needs: reuse + if: ${{ !cancelled() && (needs.reuse.result != 'success' || needs.reuse.outputs.reused != 'true') }} runs-on: ubicloud-standard-8 timeout-minutes: 30 steps: @@ -365,7 +419,8 @@ jobs: run: xvfb-run -a bun run test:quick free-suite: - needs: free-plan + needs: [free-plan, reuse] + if: ${{ !cancelled() && needs.free-plan.result == 'success' && (needs.reuse.result != 'success' || needs.reuse.outputs.reused != 'true') }} runs-on: ${{ needs.free-plan.outputs.runner }} timeout-minutes: 20 strategy: @@ -590,13 +645,38 @@ jobs: # Branch protection already requires the `free-tests` context. Keep that # stable name as an always-running aggregate so every platform-specific CSO # gate is merge-blocking without a separate branch-protection migration. + # Its first step picks one of two exclusive paths before any download: a + # verified reuse (main pushes only) links the reused run and passes; anything + # else takes the strict path below unchanged, which alone uploads tested-tree. free-tests: if: always() - needs: [free-suite, typecheck, quick-bun-default, cso-macos-launcher, macos-named-regressions, cso-windows-launcher, cso-docker-integration] + needs: [reuse, free-suite, typecheck, quick-bun-default, cso-macos-launcher, macos-named-regressions, cso-windows-launcher, cso-docker-integration] runs-on: ubuntu-24.04 timeout-minutes: 5 steps: + - name: Take the reuse path only for a verified main-push reuse + id: route + env: + REUSE_RESULT: ${{ needs.reuse.result }} + REUSED: ${{ needs.reuse.outputs.reused }} + REUSE_RUN_ID: ${{ needs.reuse.outputs.run_id }} + REUSE_RUN_URL: ${{ needs.reuse.outputs.run_url }} + REUSE_TREE: ${{ needs.reuse.outputs.tree }} + run: | + set -eu + if [ "$REUSE_RESULT" != success ] || [ "$REUSED" != true ]; then + echo 'reused=false' >> "$GITHUB_OUTPUT" + exit 0 + fi + test "$GITHUB_EVENT_NAME" = push + test "$GITHUB_REF" = refs/heads/main + case "$REUSE_RUN_ID" in ''|*[!0-9]*) echo "::error::the reuse job named no run id"; exit 1 ;; esac + case "$REUSE_TREE" in ''|*[!0-9a-f]*) echo "::error::the reuse job named no tree"; exit 1 ;; esac + test "$REUSE_RUN_URL" = "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$REUSE_RUN_ID" + echo "Reused $REUSE_RUN_URL, which passed on tree $REUSE_TREE; this push ran no suite of its own." >> "$GITHUB_STEP_SUMMARY" + echo 'reused=true' >> "$GITHUB_OUTPUT" - name: Require the free suite, typecheck, the quick tier on the default Bun, macOS regressions, and every CSO platform gate + if: steps.route.outputs.reused != 'true' env: FREE_SUITE_RESULT: ${{ needs.free-suite.result }} TYPECHECK_RESULT: ${{ needs.typecheck.result }} @@ -615,16 +695,20 @@ jobs: test "$CSO_WINDOWS_RESULT" = success test "$CSO_DOCKER_RESULT" = success - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + if: steps.route.outputs.reused != 'true' with: persist-credentials: false - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 + if: steps.route.outputs.reused != 'true' with: bun-version: 1.4.2 - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 + if: steps.route.outputs.reused != 'true' with: name: free-plan path: ${{ runner.temp }} - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 + if: steps.route.outputs.reused != 'true' with: pattern: free-result-* merge-multiple: true @@ -633,10 +717,27 @@ jobs: # flake-ledger.jsonl). A green run is where a retried flake hides, so the # summary runs before strict verification. - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 + if: steps.route.outputs.reused != 'true' with: pattern: flake-ledger-* path: ${{ runner.temp }}/flake-ledgers - name: Summarize flaky passes absorbed by the serial retry + if: steps.route.outputs.reused != 'true' run: bun run scripts/test-health-report.ts flake-summary "$RUNNER_TEMP/flake-ledgers" >> "$GITHUB_STEP_SUMMARY" - name: Require exact coverage and complete strict results + if: steps.route.outputs.reused != 'true' run: bun run scripts/test-free-shards.ts --ci-verify "$RUNNER_TEMP/free-plan.json" --results "$RUNNER_TEMP/free-results" + # Only after strict verification passed, so a red or partial run never + # leaves a record; the reuse path never reaches here. + - name: Record the tested tree + if: steps.route.outputs.reused != 'true' + env: + PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }} + run: bun run scripts/ci-tree-reuse.ts record --plan "$RUNNER_TEMP/free-plan.json" --results "$RUNNER_TEMP/free-results" --os Linux,macOS,Windows --out "$RUNNER_TEMP/tested-tree/tree.json" + - name: Upload the tested tree + if: steps.route.outputs.reused != 'true' + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 + with: + name: tested-tree + path: ${{ runner.temp }}/tested-tree/tree.json + if-no-files-found: error diff --git a/.github/workflows/windows-free-tests.yml b/.github/workflows/windows-free-tests.yml index 6d19e5b48..33e896c42 100644 --- a/.github/workflows/windows-free-tests.yml +++ b/.github/workflows/windows-free-tests.yml @@ -19,6 +19,12 @@ name: Windows Free Tests # # Native browser qualification campaigns (Windows cookie extraction, launch # diagnostics) are dispatch-only in native-qualification.yml. +# +# One full suite per tree (GSTA-156, docs/pregate.md#ci-reuse), as in +# free-tests.yml: the aggregate uploads `tested-tree` only after strict +# verification passes, and a push to main whose merged pull request already +# ran this workflow green on the same tree reuses that run. Pull request, +# dispatch and duration-recording runs never consume. on: pull_request: @@ -50,8 +56,36 @@ permissions: contents: read jobs: + # Main pushes only, and the one job with actions: read; see free-tests.yml. + # A skipped or failed reuse job runs every job below as before. + reuse: + if: github.event_name == 'push' && github.ref == 'refs/heads/main' + runs-on: ubuntu-24.04 + timeout-minutes: 5 + permissions: + contents: read + actions: read + outputs: + reused: ${{ steps.find.outputs.reused }} + run_id: ${{ steps.find.outputs.run_id }} + run_url: ${{ steps.find.outputs.run_url }} + tree: ${{ steps.find.outputs.tree }} + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false + - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 + with: + bun-version: 1.4.2 + - id: find + name: Find a green pull request or dispatch run of this exact tree + env: + GH_TOKEN: ${{ github.token }} + run: bun run scripts/ci-tree-reuse.ts find --workflow windows-free-tests.yml --profile ci-reuse/windows-free-tests + windows-plan: - if: ${{ !inputs.record_durations }} + needs: reuse + if: ${{ !cancelled() && !inputs.record_durations && (needs.reuse.result != 'success' || needs.reuse.outputs.reused != 'true') }} runs-on: ubuntu-24.04 timeout-minutes: 5 outputs: @@ -79,7 +113,8 @@ jobs: if-no-files-found: error windows-free-shard: - needs: windows-plan + needs: [windows-plan, reuse] + if: ${{ !cancelled() && needs.windows-plan.result == 'success' && (needs.reuse.result != 'success' || needs.reuse.outputs.reused != 'true') }} runs-on: windows-latest timeout-minutes: 15 strategy: @@ -184,11 +219,33 @@ jobs: windows-free-tests: if: ${{ always() && !inputs.record_durations }} - needs: [windows-plan, windows-free-shard] + needs: [reuse, windows-plan, windows-free-shard] runs-on: ubuntu-24.04 timeout-minutes: 5 steps: + - name: Take the reuse path only for a verified main-push reuse + id: route + env: + REUSE_RESULT: ${{ needs.reuse.result }} + REUSED: ${{ needs.reuse.outputs.reused }} + REUSE_RUN_ID: ${{ needs.reuse.outputs.run_id }} + REUSE_RUN_URL: ${{ needs.reuse.outputs.run_url }} + REUSE_TREE: ${{ needs.reuse.outputs.tree }} + run: | + set -eu + if [ "$REUSE_RESULT" != success ] || [ "$REUSED" != true ]; then + echo 'reused=false' >> "$GITHUB_OUTPUT" + exit 0 + fi + test "$GITHUB_EVENT_NAME" = push + test "$GITHUB_REF" = refs/heads/main + case "$REUSE_RUN_ID" in ''|*[!0-9]*) echo "::error::the reuse job named no run id"; exit 1 ;; esac + case "$REUSE_TREE" in ''|*[!0-9a-f]*) echo "::error::the reuse job named no tree"; exit 1 ;; esac + test "$REUSE_RUN_URL" = "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$REUSE_RUN_ID" + echo "Reused $REUSE_RUN_URL, which passed on tree $REUSE_TREE; this push ran no suite of its own." >> "$GITHUB_STEP_SUMMARY" + echo 'reused=true' >> "$GITHUB_OUTPUT" - name: Require the plan and every Windows shard + if: steps.route.outputs.reused != 'true' env: PLAN_RESULT: ${{ needs.windows-plan.result }} SHARD_RESULT: ${{ needs.windows-free-shard.result }} @@ -197,22 +254,40 @@ jobs: test "$PLAN_RESULT" = success test "$SHARD_RESULT" = success - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + if: steps.route.outputs.reused != 'true' with: persist-credentials: false - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 + if: steps.route.outputs.reused != 'true' with: bun-version: 1.4.2 - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 + if: steps.route.outputs.reused != 'true' with: name: windows-plan path: ${{ runner.temp }} - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 + if: steps.route.outputs.reused != 'true' with: pattern: windows-result-* merge-multiple: true path: ${{ runner.temp }}/windows-results - name: Require exact coverage and complete strict results + if: steps.route.outputs.reused != 'true' run: bun run scripts/test-free-shards.ts --windows-only --ci-verify "$RUNNER_TEMP/windows-plan.json" --results "$RUNNER_TEMP/windows-results" + # Only after strict verification passed; the reuse path never reaches here. + - name: Record the tested tree + if: steps.route.outputs.reused != 'true' + env: + PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }} + run: bun run scripts/ci-tree-reuse.ts record --plan "$RUNNER_TEMP/windows-plan.json" --results "$RUNNER_TEMP/windows-results" --os Windows --out "$RUNNER_TEMP/tested-tree/tree.json" + - name: Upload the tested tree + if: steps.route.outputs.reused != 'true' + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 + with: + name: tested-tree + path: ${{ runner.temp }}/tested-tree/tree.json + if-no-files-found: error windows-record-durations: if: ${{ inputs.record_durations }} diff --git a/.gstack/pregate.json b/.gstack/pregate.json index 0454e74f3..c424957cc 100644 --- a/.gstack/pregate.json +++ b/.gstack/pregate.json @@ -19,6 +19,10 @@ "free-tests.yml/free-suite": "bun run scripts/test-free-shards.ts --list", "windows-free-tests.yml/windows-free-shard": "bun run scripts/test-free-shards.ts --windows-only --list" }, + "run_profiles": { + "ci-reuse/free-tests": { "workflow": "free-tests.yml", "events": ["pull_request", "workflow_dispatch"], "jobs": ["free-plan", "typecheck", "quick-bun-default", "cso-macos-launcher", "macos-named-regressions", "cso-windows-launcher", "cso-docker-integration", "free-tests"], "artifact": "tested-tree", "os": "Linux" }, + "ci-reuse/windows-free-tests": { "workflow": "windows-free-tests.yml", "events": ["pull_request", "workflow_dispatch"], "jobs": ["windows-plan", "windows-free-tests"], "artifact": "tested-tree", "os": "Windows" } + }, "warn": [], "strays": { "allow": ["modules/loadouts.json", "modules/loadouts.schema.json"] } } diff --git a/CHANGELOG.md b/CHANGELOG.md index 5dcbe0188..758e468fa 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,27 @@ # Changelog +## [1.92.39.0] - 2026-11-01 + +**A push to main no longer runs Free Tests and Windows Free Tests again on a tree its pull request already passed.** 22 of 22 merges in 30 hours (Oct 27–29) reran both suites on the identical tree, about 66 Linux shard-minutes and 44 Windows minutes each. Now a `reuse` job, on main pushes only, finds the merged pull request, requires its head's tree to equal the pushed tree, and verifies that head's newest green `pull_request` or `workflow_dispatch` run with the same checks `gstack-pregate clear --run` uses. When it verifies, every suite job is skipped and the required check links the reused run. Anything else runs every job as before. The same verifier backs a new `--from-run` flag for the pregate tests stage. + +### Added +- **Main-push reuse** in `free-tests.yml` and `windows-free-tests.yml` (`scripts/ci-tree-reuse.ts`, docs/pregate.md#ci-reuse). The `reuse` job is the only one with `actions: read`, and it reads at most 10 pull requests and 10 candidate runs. A newer red run on the head vetoes an older green one. A run that reused another run never counts. Pull request and dispatch runs never consume, and a skipped or failed `reuse` job runs every job exactly as before. The required `free-tests` and `windows-free-tests` aggregates pick their path before any download, and the strict path is unchanged. +- **`tested-tree` records.** Both aggregates upload `tree.json` only after strict verification passes: run, attempt, event, sha, head, tree, workflow, OS list, every planned test file and the test count. +- **`gstack-pregate --stage tests --from-run `** (docs/pregate.md#from-run). The selected local test files a verified Free Tests run on this exact tree lists count as passed and are recorded under `from_run` with the run receipt, and the rest still run. A refused run prints `REUSE: refused reason=` and runs everything. It changes only the tests stage; `--stage all` still runs every preflight check, the secrets scan included. +- **gstack's run profiles** in `.gstack/pregate.json`: `ci-reuse/free-tests` (the complete Free Tests run) and `ci-reuse/windows-free-tests`. Neither is named after a lane, so macOS and Windows lane clears and `gstack-ship-queue ready --dispatch-ci` keep recording the run URL. Lane profiles and dispatch-ci verification wait until open pull requests carry the `tested-tree` producer (GST-555). + +### Changed +- **Run profiles may accept `pull_request` runs.** Such a run counts only when its `tree.json` names the head and the merge commit, and the merge commit's tree equals the head's tree, which means the head already held its base. `tree.json` may list every OS its test jobs ran on, and the profile's OS must be one of them. +- **`free-durations-record.yml` grants its Windows caller job `contents: read` and `actions: read`.** That job calls `windows-free-tests.yml`, whose new `reuse` job asks for `actions: read`, and a called workflow can't hold more than its caller grants. Without the grant, GitHub rejects the scheduled duration run before it starts. +- **A run whose `tree.json` lists no test files or zero tests never counts** for `--from-run` or main-push reuse (`no_tests`). + +### Tests +- `test/ci-tree-reuse.test.ts`: candidate discovery with fake GitHub data (pull request found or missing, unmerged, fork head, tree mismatch, reused record, newer red run veto, dispatch and pull_request candidates, the 10-run bound, API errors), the `tree.json` producer, and the CLI refusing every event but a main push. +- `test/ci-reuse-workflow-wiring.test.ts`: both workflows. It covers the push-only reuse job and its permissions, each suite job's condition evaluated for a skipped, failed and successful reuse, and status functions on every downstream job. It also covers pregate still requiring every test lane, the aggregate's route step run under bash for each input, and the profiles naming real jobs and never a lane. +- `test/cso-distribution.test.ts`: the `free-tests` aggregate still requires `cso-docker-integration` on its strict path, and only a verified reuse skips that job. +- `test/pregate-from-run.test.ts` failed on the old code. `test/run-evidence.test.ts` adds the `pull_request` and OS-list cases and `verifyFromRun`, including the zero-test refusal, which failed on the old code. +- `test/free-durations-record-workflow.test.ts` pins the Windows caller grant, and `test/ci-reuse-workflow-wiring.test.ts` requires every caller of either workflow to grant `actions: read`; it failed without the grant. + ## [1.92.38.0] - 2026-11-01 **brain-sync no longer gets stuck in `push_failed` when another machine changed a file you have edited locally.** After a rejected push, brain-sync fetches and merges the other machine's commits. Git refuses that merge when a file it would update has uncommitted local edits. brain-sync hid git's error and hit the same refusal on every run, so cross-machine sync stopped for good (#3704). diff --git a/VERSION b/VERSION index d99ed55f4..0e6e6f87b 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -1.92.38.0 +1.92.39.0 diff --git a/agents-digest/gstack-AGENTS.md b/agents-digest/gstack-AGENTS.md index f10b4a111..ab2e7139f 100644 --- a/agents-digest/gstack-AGENTS.md +++ b/agents-digest/gstack-AGENTS.md @@ -1,4 +1,4 @@ -# gstack digest v1.92.38.0 — regenerate/re-copy after upgrading gstack +# gstack digest v1.92.39.0 — regenerate/re-copy after upgrading gstack Behavioral rules from gstack (https://github.com/garrytan/gstack), compressed for agent hosts without a full skill install. The full skills add workflows, diff --git a/bin/gstack-pregate b/bin/gstack-pregate index 10da90e78..772bec1b1 100755 --- a/bin/gstack-pregate +++ b/bin/gstack-pregate @@ -4,7 +4,7 @@ * * gstack-pregate [run] [--stage preflight|tests|all] [--only ] [--base ] * [--allow-repo-commands] [--policy-from base|head] [--out ] - * [--timeout ] [--stall-timeout ] [--remote --spend-cap ] [--run ] [--explain] [--json] + * [--timeout ] [--stall-timeout ] [--remote --spend-cap ] [--run ] [--from-run ] [--explain] [--json] * gstack-pregate verify [--out ] [--json] publication check: current tree, no fail/incomplete, obligations cleared * gstack-pregate clear --remote --run-url | --run [--run …] [--allow-repo-commands] | --bundle-lane