diff --git a/bin/gstack-review-dispatch b/bin/gstack-review-dispatch index 66a47d9c4..9e4ea74ce 100755 --- a/bin/gstack-review-dispatch +++ b/bin/gstack-review-dispatch @@ -24,7 +24,7 @@ const HELP = `gstack-review-dispatch — verbatim reviewer briefs and loss-free roles: ${BRIEF_ROLES.join(', ')} slots: --diff-base (every role but fix-check) --exclude '' --stack --test-fw --learnings-file --checklist (default /review/specialists/.md; red-team.md for red-team) - --checklists (specialist-batched) --findings-file --specialists (red-team) + --checklists (specialist-batched: the plan's checklists= names, or paths) --findings-file --specialists (red-team) --fix-list --hunks --tests [--callers ] (fix-check) writes /[-].prompt.md, records it in the ledger (default /review-ledger.jsonl) and prints BRIEF: reader= sha256= bytes= file=. Pass that file's content as the reader's prompt, unchanged. @@ -57,6 +57,8 @@ function render(): number { const diffBase = flag('--diff-base'); const checklist = flag('--checklist') ?? (role === 'red-team' ? path.join(ROOT, 'review/specialists/red-team.md') : role === 'specialist' && name ? path.join(ROOT, 'review/specialists', `${name}.md`) : undefined); if (checklist && (role === 'specialist' || role === 'red-team') && !fs.existsSync(checklist)) throw new BriefError(`checklist not found: ${checklist}`); + const checklists = flag('--checklists')?.split(',').map(s => s.trim()).filter(Boolean).map(c => (c.includes('/') ? c : path.join(ROOT, 'review/specialists', `${c}.md`))); + for (const c of checklists ?? []) if (!fs.existsSync(c)) throw new BriefError(`checklist not found: ${c}`); let diff: string | undefined; if (role === 'outside-voice' && diffBase) { const r = spawnSync('git', ['-c', 'core.quotePath=false', 'diff', '--no-color', '--no-ext-diff', diffBase], { encoding: 'utf8', timeout: 60_000, maxBuffer: 256 * 1024 * 1024 }); @@ -65,7 +67,7 @@ function render(): number { } const slots: Slots = { name, diff_base: diffBase, exclude: flag('--exclude'), stack: flag('--stack'), test_fw: flag('--test-fw'), - learnings: readFile(flag('--learnings-file'), 'learnings'), checklist, checklists: flag('--checklists'), + learnings: readFile(flag('--learnings-file'), 'learnings'), checklist, checklists: checklists?.join(','), findings: readFile(flag('--findings-file'), 'findings'), specialists: flag('--specialists'), diff, fix_list: readFile(flag('--fix-list'), 'fix list'), hunks: readFile(flag('--hunks'), 'hunks'), tests: readFile(flag('--tests'), 'tests'), callers: readFile(flag('--callers'), 'callers'), }; diff --git a/docs/review-policy.md b/docs/review-policy.md index 744e47101..e243d6f66 100644 --- a/docs/review-policy.md +++ b/docs/review-policy.md @@ -413,7 +413,9 @@ ones, and the arm lost blockers. `bin/gstack-review-dispatch` closes both ends: `merged.jsonl` with the label exactly as written (a JSON line's `severity`, or a prose line's Critical, High, Medium, Low, P0-P3, FIXABLE or INVESTIGATE wherever it stands, headings and table rows included; a top-level list item under a label-only - heading takes that label). A phantom finding costs a fold; a lost one costs the gate. + heading takes that label). A prose voice's `Blocks: yes` collects as CRITICAL: on + its own line, or on the finding just before it; with no finding there it is one + (normalizer v2, GSTA-167). A phantom finding costs a fold; a lost one costs the gate. 4. Lead judgment writes `judged.jsonl`; `judge` refuses a set that drops a merged finding, lowers its severity, folds it into a less severe duplicate, or adds or promotes one without a reason (`JUDGMENT_REJECTED`). A merged file missing any id diff --git a/lib/review-brief.ts b/lib/review-brief.ts index b3e3063c2..65e207403 100644 --- a/lib/review-brief.ts +++ b/lib/review-brief.ts @@ -117,7 +117,7 @@ function renderRole(role: BriefRole, slots: Slots, t: SectionTexts): string { return fill(t.native, [['DIFF_BASE=$(git merge-base origin/ HEAD)', `DIFF_BASE=${diffBase}`]], role); case 'outside-voice': { const body = fill(t.outside, [['DIFF_BASE=$(git merge-base origin/ HEAD)', `DIFF_BASE=${diffBase}`]], role); - return [body, '', 'Give each finding a severity: Critical, High, Medium or Low.', '', `## Branch diff (git diff ${diffBase})`, FENCE + 'diff', (slots.diff ?? '').trim(), FENCE].join('\n'); + return [body, '', `## Branch diff (git diff ${diffBase})`, FENCE + 'diff', (slots.diff ?? '').trim(), FENCE].join('\n'); } case 'fix-check': return renderFixCheckPrompt({ fixList: need(slots, 'fix_list'), touchedHunks: need(slots, 'hunks'), testResults: need(slots, 'tests'), callers: slots.callers ?? '' }); diff --git a/lib/review-ledger.ts b/lib/review-ledger.ts index defc5208a..2d92ae29c 100644 --- a/lib/review-ledger.ts +++ b/lib/review-ledger.ts @@ -8,7 +8,8 @@ * judgment each lead-judgment change: an added or promoted finding, with its reason * judge the verdict on the parent's judged set (ok, or the dropped and downgraded ids) * - * Findings reach merged.jsonl only through collect, with each voice's label exactly as written. + * Findings reach merged.jsonl only through collect, with each voice's label exactly as written, + * except that a prose voice's `Blocks: yes` collects as CRITICAL (GSTA-167 normalizer v2). * The parent's judged set may add or promote a finding and may fold a duplicate into one at least * as severe; it never drops or downgrades one. verify replays every check from the ledger alone. */ @@ -53,29 +54,47 @@ const LABEL_HEADING = new RegExp(`^(?:#{1,6}\\s*|\\*\\*)(${LABELS})(?:\\s+(?:fin const HEADING = /^(?:#{1,6}\s|\*\*[^*]+\*\*:?$)/; const LIST_ITEM = /^(?:[-*+]|\d+[.)])\s+\S/; const stronger = (a: string, b: string) => ((rank(a) ?? 0) >= (rank(b) ?? 0) ? a : b); +/** A prose voice's `Blocks: yes` (GSTA-167 normalizer v2): the finding is CRITICAL whatever its label; `Blocks: no` never lowers one. */ +const BLOCKS_YES = /(? { const out: Array<{ label: string; raw: string }> = []; let section: string | null = null; + let previous: { label: string; raw: string } | null = null; + let previousText = ''; for (const line of output.replace(/\r\n/g, '\n').split('\n')) { const t = line.trim(); - if (!t || /^NO FINDINGS\.?$/.test(t) || /^Recommendation:/i.test(t)) continue; + if (!t) continue; + const before: { label: string; raw: string } | null = previous; + const beforeText = previousText; + previous = null; + previousText = t; + if (/^NO FINDINGS\.?$/.test(t) || /^Recommendation:/i.test(t)) continue; + if (BLOCKS_YES.test(t) && !ANY_LABEL.test(t) && !t.startsWith('{')) { + if (before) { before.label = 'CRITICAL'; before.raw += ` | ${t}`; previous = before; } + else out.push(previous = { label: 'CRITICAL', raw: beforeText ? `${beforeText} | ${t}` : t }); + continue; + } const heading = LABEL_HEADING.exec(t); if (heading) { section = heading[1]!; continue; } if (line === line.trimStart() && HEADING.test(t)) section = null; if (t.startsWith('{')) { try { const o = JSON.parse(t) as Record; - if (typeof o.severity === 'string') { out.push({ label: o.severity, raw: t }); continue; } + if (typeof o.severity === 'string') { out.push(previous = { label: o.severity, raw: t }); continue; } } catch { /* prose that starts with a brace */ } } const inline = ANY_LABEL.exec(t)?.[1]; const inherited = section && line === line.trimStart() && LIST_ITEM.test(t) ? section : undefined; const label = inline && inherited ? stronger(inherited, inline) : inline ?? inherited; - if (label) out.push({ label, raw: t }); + if (label) out.push(previous = { label: BLOCKS_YES.test(t) ? 'CRITICAL' : label, raw: t }); } return out; } diff --git a/test/review-dispatch.test.ts b/test/review-dispatch.test.ts index 44c7ef8c6..1133dd358 100644 --- a/test/review-dispatch.test.ts +++ b/test/review-dispatch.test.ts @@ -73,6 +73,19 @@ describe('gstack-review-dispatch render: briefs from the sections, slots only', expect(fs.readFileSync(path.join(out, 'review-ledger.jsonl'), 'utf8')).toContain('"event":"rendered"'); expect(run(['render', '--role', 'specialist', '--name', 'no-such-specialist', '--out', out, '--diff-base', SHA]).stderr).toContain('BRIEF_RENDER_FAILED: checklist not found'); }); + + // Value: protects=the lean ensemble's one batched reader (GSTA-167 part 2) gets checklist paths when the parent passes the plan's + // checklists= names as printed; fails_when=the brief names bare checklist words a reader cannot open, or an unknown name + // renders; seam=gstack-review-dispatch render + test('specialist-batched takes the DISPATCH checklists= names and writes each checklist path into the brief', () => { + const out = tmp(); + const r = run(['render', '--role', 'specialist-batched', '--out', out, '--diff-base', SHA, '--checklists', 'testing,security,state-machines']); + expect(r.status, r.stderr).toBe(0); + const root = path.join(import.meta.dir, '..'); + const lists = ['testing', 'security', 'state-machines'].map(n => path.join(root, 'review/specialists', `${n}.md`)).join(', '); + expect(fs.readFileSync(field(r.stdout, 'file'), 'utf8')).toContain(`Read each checklist at ${lists} (tag each finding's`); + expect(run(['render', '--role', 'specialist-batched', '--out', out, '--diff-base', SHA, '--checklists', 'testing,maintenance']).stderr).toContain('BRIEF_RENDER_FAILED: checklist not found'); + }); }); describe('gstack-review-dispatch sent, collect, judge and verify: nothing changed on the way in or out', () => { @@ -214,6 +227,31 @@ describe('gstack-review-dispatch sent, collect, judge and verify: nothing change expect(judge(m, [{ id: 'r#1', severity: 'INFORMATIONAL', reason: 'a real defect' }]).ok).toBe(true); }); + // Value: protects=normalizer v2 in production (GSTA-167 part 1, certified by round 5's G1): a prose voice's Blocks: yes reaches + // merged.jsonl as CRITICAL, so judge refuses a lead that keeps it below the floor; Blocks: no never lowers a label; + // fails_when=a Blocks: yes finding is collected at its Medium or INVESTIGATE label, a Blocks line with no finding before it is + // lost, or Blocks: no demotes; seam=parseFindings, judge + test('a prose voice\'s Blocks: yes collects as CRITICAL, on its own line or the finding just before it; Blocks: no never lowers', () => { + const out = [ + '1. Retry loop drops the last row (queue.ts:78). Severity: Medium · Blocks: yes', + '2. INVESTIGATE: lock order in pool.ts:12', + ' Blocks: yes', + '3. FIXABLE: stale cache key (cache.ts:4)', + ' Severity: High', + ' Blocks: no', + '4. Token never expires (auth.ts:9)', + ' Fix: check exp', + ' **Blocks:** yes', + 'Recommendation: Fix the retry loop because it loses rows', + ].join('\n'); + const got = parseFindings('outside-voice', out); + expect(got.map(g => g.label)).toEqual(['CRITICAL', 'CRITICAL', 'FIXABLE', 'High', 'CRITICAL']); + expect(got[1]!.raw).toBe('2. INVESTIGATE: lock order in pool.ts:12 | Blocks: yes'); + expect(got[4]!.raw).toBe('Fix: check exp | **Blocks:** yes'); + const m: MergedLine[] = got.map((g, i) => ({ id: `o#${i + 1}`, reader: 'outside-voice', label: g.label, raw: g.raw, output_sha256: 'h' })); + expect(judge(m, m.map(x => ({ id: x.id, severity: x.label === 'CRITICAL' ? 'Medium' : x.label }))).downgraded).toEqual(['o#1', 'o#2', 'o#5']); + }); + test('verify on a ledger that kept no prompts says so and exits 3', () => { const d = tmp(); const ledger = path.join(d, 'ledger.jsonl');