gstack/docs/TESTING_INTERNALS.md

Testing internals: env keys, hermetic E2E

Moved verbatim from CLAUDE.md (token-load reduction). Read this before writing or debugging E2E tests, passing env: to a runner, or touching test/helpers/hermetic-env.ts.

Env keys in Conductor workspaces. The GSTACK_* env-shim (v1.39.2.0+, lib/conductor-env-shim.ts) promotes GSTACK_ANTHROPIC_API_KEY / GSTACK_OPENAI_API_KEY to their canonical names inside gstack's TS binaries. Tests run through gstack entrypoints inherit this promotion automatically. Don't echo the key value to stdout, logs, or shell history. The historical "never pass env: to runAgentSdkTest" rule is retired: the failure was partial-env replacement (the SDK's Options.env REPLACES the child's entire environment, so an object without the key broke auth). The runner now always passes a COMPLETE hermetic env with per-test env: merged last, so per-test overrides are safe; ambient process.env.ANTHROPIC_API_KEY mutation also still works (the env builder reads process.env at call time).

Hermetic local E2E (default). Every E2E runner (claude -p, PTY, Agent SDK, codex, gemini) spawns children through test/helpers/hermetic-env.ts: allowlist-scrubbed env (operator CONDUCTOR_*, CLAUDE_*, GSTACK_*, MCP_*, GBRAIN_*, and credentials like GH_TOKEN never reach children), a fresh seeded CLAUDE_CONFIG_DIR (no operator ~/.claude CLAUDE.md / MCP servers / skills), a temp GSTACK_HOME, and --strict-mcp-config. Local eval signal matches CI. Debug against real operator state with EVALS_HERMETIC=0 (restores the legacy env AND drops the strict-MCP flag). Per-test env: overrides merge last, so deliberate contamination (CONDUCTOR_WORKSPACE_PATH, per-test GSTACK_HOME) keeps working. The hermetic config dir seeds NO skills by default; a PTY test that types a /skill slash command must pass seedSkills: true to the PTY runner, which points the child's CLAUDE_CONFIG_DIR at hermeticSkillsConfigDir() — a seeded registry that symlinks the LIVE working tree's SKILL.md files (by design: the skills ARE the subject under test; a snapshot would measure stale copies). Wiring is pinned by test/hermetic-wiring.test.ts (static tripwire), two gate-tier canaries in test/skill-e2e-hermetic-canary.test.ts, and the seeding tripwires in test/hermetic-skills-seeding.test.ts / test/pty-skill-seeding-wiring.test.ts.

Seeded planning sessions also receive an isolated runtime home through test/helpers/hermetic-skill-runtime.ts, so absolute lazy-section paths resolve to the working tree under test. Explicit per-test home overrides remain intact. Autoplan resolves each review skill from its own installed host registry.

Interactive planning evidence. Native plan-review count drivers use observeScreen: true and await currentScreen() before choosing an input. The existing xterm dependency interprets cursor moves and erases; old menus in the raw stream cannot establish a current prompt. Snapshots preserve terminal.raw.log, terminal.visible.log, and terminal.screen.log separately. Setting EVALS_RUN_ID or GSTACK_EVAL_DIR retains these snapshots; an output directory without a run ID gets a stable, unique local ID for that writer. Completed native transcript calls establish question counts and phase coverage. Report-aware count tests also require a fresh, complete report and native completion evidence before accepting a completion heading.

The periodic first-question matrix uses test/helpers/auq-native-capture.ts to match the first public PreToolUse AskUserQuestion payload to its current native display. It grades that question's exact public fields without answering it or reading model transcripts. question_captured records workflowCompleted: false. With GSTACK_EVAL_DIR, EVALS_RUN_ID, or an explicit run ID, native-auq/<run-id>/<test>-<suffix>/capture.json under the eval directory retains the public payload, bounded current viewport, and capture outcome. CEO mode selection uses the actual SDK AskUserQuestion permission callback in auq-sdk-capture.ts, with the existing 12-turn and 240-second limits. It captures the public question and stops without submitting an answer; its question_captured outcome also records workflowCompleted: false. The retained capture survives fixture cleanup. Provider refusals and malformed questions remain failures. Section-loading captures retain their noninteractive contract.

Shared-code revalidation fixtures pair public tool calls with their successful results to verify that the current trusted start record was inspected before completion. A discovered path in tool output counts; a path mentioned only in instructions or narration does not. Saved public captures cover absolute and relative paths and discovery followed by a read. The revalidation prompt supplies the path to the trusted start-record directory and declares the existing turn limit. It asks the agent to batch independent reads and retrieve the complete final record; every source, approval, persistence, and completion check still applies. The path-boundary fixtures use this same execution contract for symlinks, submodules, ignored files, index flags, and legacy or filtered evidence. Their skip actor accepts an explicit no-change choice; a preservation word inside an option that also approves changes cannot authorize edits. Captured native questions exercise the actual answer callback, and native turn-limit failures still fail even after a question was answered.

The engineering and DX finding fixtures check coverage of their seeded issues rather than cap the total number of review questions. Each decision needs a distinct, completed native question with an offered answer; accepting, rejecting, or deferring a recommendation all count as reviewing it. Engineering's mandatory legacy regression tests also need affirmative plan or public-narration evidence. Additional useful questions are allowed within the existing time limits. Generic question counts remain diagnostic, and a fresh final review report is required.

E2E tests stream progress in real-time (tool-by-tool via --output-format stream-json --verbose). Results are persisted to ~/.gstack/projects/<slug>/evals/ (legacy fallback ~/.gstack-dev/evals/) with auto-comparison against the previous finalized run (in-flight _partial files are never used as a baseline, so a run can't compare against itself).

The periodic overlay fixtures use a versioned behavior gate with efficacy reported separately. See Overlay benchmark contract v4 for exact correctness requirements, retired fanout cases, immutable evidence, and the limits of a passing result. Under v4 a completed wrong answer is a measured correctness result in either arm (taskCorrect: false with answerError); only an overlay-ON wrong answer fails the case, so an overlay-OFF wrong answer stays in the comparison. v3 verdicts keep their original meaning.

Coverage ownership

The test portfolio audit separates deterministic harness checks, prompt judges, live first-question captures, completed workflows and platform integrations. Shared setup is reusable; evidence with different scenario or independent-trial requirements is not. It records the preserved coverage and measured component savings from the test-speed refactor.

Runners: how the suites execute (2026-08 overhaul)

Aside-only E2E tests self-skip without a live Aside; browser-driving tests run on either engine. Every skill that opens a web page drives the Aside AI browser first (scripts/resolvers/aside.ts) and falls back to gstack's own browse engine when Aside is absent (and Chromium bootstrapped). The cases that need Aside itself (test/skill-e2e-aside.test.ts, design-review-fix in test/skill-e2e-design.test.ts) call asideAvailable() from test/helpers/aside-available.ts (the same probe the skills run in BROWSER SETUP) and skip when the aside CLI or the Aside app is absent. CI runners have no Aside, so those run only on macOS dev machines and sit in the periodic tier; set GSTACK_SKIP_ASIDE=1 to force the skip locally (which also exercises the fallback hand-off). The qa E2E files (test/skill-e2e-qa-workflow.test.ts, test/skill-e2e-qa-bugs.test.ts) gate on asideAvailable() || fs.existsSync(browseBin): the skill's own BROWSER SETUP picks the engine, so on a Mac they drive Aside and on Linux CI they drive the built browse binary, skipping only when neither exists. The $B-driven E2E cases and browse/test/ run on every platform as before, so Linux CI proves the fallback engine live.

Bootstrap dependency retention is opt-in qualification, not the behavior test. qa-bootstrap still runs its original unpinned Vitest installation and assertions on macOS and Linux, including documented unsharded commands. Only a Linux paid shard runner issues the owned retention scope: it binds each actual fixture and native lifetime, retains locks, package manifests and the installed file/link inventory, and acknowledges capture before deleting the fixture. The outer runner also captures evidence when a callback is killed. Incomplete capture fails qualification and preserves the source fixture as well as partial evidence. Other platforms explicitly report retention as unavailable and still execute the native behavior test. A run without the runner-issued scope earns no retained dependency qualification credit; candidate acceptance requiring that evidence must use the Linux sharded path and verify every attempt's complete capture, acknowledgment and cleanup fallback. A passing unsharded or macOS behavior test does not substitute for that evidence.

The renderer picks the same way, so the render gates are engine-agnostic. /make-pdf, /diagram, and design previews print and screenshot their local HTML through lib/aside-render.ts / bin/gstack-render.ts, which render in Aside when probeAside() says READY and through the browse engine otherwise. make-pdf's *-gate.test.ts and test/skill-e2e-diagram.test.ts (periodic, paid) gate on browserAvailable() (test/helpers/browser-available.ts: asideAvailable() || resolveBrowseBin() !== null) — on a Mac they print through Aside, on Linux CI through the browse binary bun run build:gates compiles, and they skip only when neither exists. Only test/aside-render.test.ts's two live Aside cases (a full round-trip and a late-readiness --wait-expr poll) are Aside-only: its option mapping and generated-script pins run everywhere, and its fake-executable cases drive both engines hermetically (fake aside / browse scripts on PATH pin probe classification, the stdout contract, loopback-server policy, the timeout kill, engine choice and the mid-run fallback). test/gstack-render-cli.test.ts does the same for bin/gstack-render.ts with GSTACK_SKIP_ASIDE=1 and GSTACK_BROWSE_BIN pointed at a fake daemon that logs every argv line. A green gate on Linux proves the fallback engine, not Aside; the Mac run is the Aside evidence. The browse-binary leg presumes Chromium bootstrapped: resolveBrowseBin() only checks that the binary (or the find-browse shim) exists, never that Chromium can launch, so on an install where the best-effort Chromium step was skipped (GSTACK_SKIP_PLAYWRIGHT=1) or failed, these gates run and fail at browser launch instead of skipping. Fix the bootstrap (or move the binary aside) before running them locally; CI always installs Chromium first. test/dom-dump-hygiene.test.ts is the one free-suite case on the same leg: it runs lib/dom-dump.js (the rendered-DOM dump /design-review hands the design detector) inside a real Chromium page through the built browse binary, so it self-skips when the binary is absent and, because a cold Chromium launch is load-sensitive on a busy dev box, runs only in CI or on explicit opt-in (GSTACK_DOM_DUMP_HYGIENE=1).

Free suite (bun run test:free). scripts/test-free-shards.ts runs N concurrent shard processes (serial within each) with strict-output classification per shard. Local defaults use the available CPU affinity (which Bun also bounds by a container's cgroup CPU quota), floored at one and capped at 16 on Linux and six on macOS and Windows; GSTACK_FREE_JOBS remains an explicit override. This does not change the separate CI machine count. Full-suite shards are packed by RECORDED PER-FILE DURATIONS (LPT, packShardsByDuration) when the committed seed scripts/free-test-durations.json exists — refresh it with bun run test:ubicloud --record-durations, which times each file in its own child on a VM with the CI lane's environment and copies the seed back; see Free suite duration seed. Missing seed → silent hash-shard fallback; corrupt seed → one warning + fallback; unknown files get 99th-percentile pessimism, and both full-suite and --ci-plan runs name them on stderr so a new slow file cannot silently become the long pole. Packed shards get duration-aware walls (max(base, predicted × 3, files × 5s)). The legacy --shards N --shard i path keeps stable hash indices. Required CI uses one duration-packed --ci-plan, 20 ordinary --ci-run shards plus a separate exclusive-fixture shard, and a --ci-verify aggregate. CI shards still run on independent machines without ordering unrelated jobs. The public TREE_MUTATING map now classifies exclusive host-state fixtures; its sole entry is test/bootstrap-retention.test.ts, whose same-UID nondumpable actors affect host-wide procfs permission checks. Locally, this file runs only after all parallel shards settle, and cancellation prevents that final phase from starting. No selected files, retries, budgets, or receipt requirements are removed. Former generator mutators still render into private output directories; this serial phase protects process visibility, not in-place doc generation.

Full child output is retained in private files under .context/free-test-logs/, outside each shard's temporary cleanup directory. The runner prints the path at launch and completion. Losing the log fails the run even when the child exits successfully. A redirected log directory is rejected before launching a child. On failure, read that log first: the recovery message distinguishes incomplete capture, unconfirmed cleanup, deadline expiry and a test/module failure. Fix the demonstrated cause before rerunning. A focused bun test command is offered only when every failure is attributable to existing selected files; it proves that repair, not completion of the original selection. Preserve failed attempts when sharing results, and inspect logs for private data before sharing them.

Before publication, classify new deterministic regressions for quick feedback. Refresh the timing seed with the existing recorder on fixed inputs; do not edit source while tests run. Critical boundary controls belong in QUICK_CORE when their feedback cost is justified. Other measured files qualify at two seconds or less; slow and unmeasured files remain outside quick, not outside full tests. Report cold setup separately from warm execution, while retaining failed-attempt, retry and cleanup time in the total cost.

PTY fixture timing. Plan-count sessions wake on terminal output or exit, with at least 250ms between expensive observations and a 2s fallback for transcript or hook changes that produce no terminal output. New output batches settle for 250ms before observation so split terminal redraws cannot route input from their first chunk. Input debounces, permission guards, and the real CLI's 8s startup grace are unchanged. Synthetic CLIs can pass startupReadyMarker to runPlanSkillCounting and emit that exact marker after installing their input handlers; a missing marker fails before any command is sent. The marker wait stays inside the existing startup and total-run deadlines. test/pty-output-wake.test.ts covers output, silent waits, exit, close, missing readiness, split redraws, and continuous redraws. Close and output waits cancel their losing deadlines so completed workers can exit immediately.

The UI-positive design gate commits the supplied plan as review-input.md before the first model turn. It requires an acknowledged Design focus/rating question followed by an answered native finding about concrete UI behavior; setup and outside-review choices cannot satisfy that sequence. Its declared board actor submits feedback before acknowledging it. The final proof uses the full native question, not the truncated diagnostic snippet, and proposal text mentioning "no UI scope" is not treated as an exit verdict. Unknown-command failures must name the invoked slash command; a child tool rejecting --help is not a skill registration failure. Periodic seeded-finding classifiers separately verify fixture-owned findings.

Paid suite (sharded runner, local AND CI). scripts/test-paid-shards.ts is the single selection engine: 1 file per shard, EVALS_JOBS shard processes × EVALS_CONCURRENCY within-shard, per-shard GSTACK_EVAL_DIR, full-stream spooling to per-shard log files (path printed at START and on failure), never-started/timed-out taxonomy, and parent-computed diff selection propagated to children via EVALS_SELECTION_JSON (fail-open: a child that can't parse it recomputes locally with one warning). Paid evals never retry, except the gate's one flaky rerun; each case's kind fixes its trials before the run (see "Eval verdict policy" below). Files in CASE_SHARDED_FILES run one registered case per process (<file>#<case id>, an exact --test-name-pattern, exactly one executed case), so a long file of short cases spreads across runners and each case gets its own SDK semaphore. test/carve-section-loading.test.ts is one of them: it registers one periodic case per carved skill (carve-section-loading-<skill>, each with its own touchfiles and history). Run one case with bun run scripts/test-paid-shards.ts --tier periodic --case carve-section-loading-<skill>. Trial telemetry rides the store: every recorded test carries its 1-based attempt plus, on an isolated trial shard, its case_id, kind, trial, panel and policy_version, and each lane's report uploads one trial-outcomes JSONL line per trial. bun run eval:pass-rates turns that history into per-case pass rates (see "Pass-rate history" below; free-suite flakes are a separate record, see Flake ledger). Census integrity is enforced from the free suite: every E2E_TOUCHFILES / LLM_JUDGE_TOUCHFILES key must name a living paid test (test/touchfiles.test.ts's reverse invariant), and git show <sha>:path fixtures are banned — vendor the bytes instead (test/git-ref-fixture-tripwire.test.ts).

Functional QA and documentation acceptance require an explicit EVALS_RUN_ID; GSTACK_EVAL_DIR alone does not satisfy their evidence-ownership guard. For each local invocation, supply a fresh ID to the documented detached runner:

EVALS_RUN_ID="local-$(bun -e 'console.log(crypto.randomUUID())')" bun run eval:bg:pr

Neither package scripts nor gstack-detach invent this identity. CI's PR/manual slices, periodic slices and weekly gate census supply an ID bound to the workflow run, attempt, job and slice. Existing slice artifacts retain per-shard snapshots; separate always-run native-captures-<EVALS_RUN_ID> artifacts retain project/legacy e2e-runs and evals/qa-callers evidence for 90 days. These diagnostic artifacts are not collector results and do not establish that an unfinished test passed.

Fast PR profile and evidence reuse. test:pr selects the changed cases in scripts/test-pr-profile.ts plus every changed quality judge. --profile full retains the broad census; no case IDs or tier assignments are removed. The plan records both E2E and judge selections and lists deferred coverage. Executors receive those selections separately and the report checks actual executed case counts. Unknown source dependencies restore the broad gate (see PR paid lane fallback); unmapped prompts without registered coverage require full validation. Known broad-only prompt changes are explicitly deferred, not counted as PR passes. Weekly/manual runs of evals-periodic.yml execute both complete censuses fresh; manual evals.yml runs the broad gate. This deliberately moves some defect detection later.

scripts/eval-input-cache.ts accepts only complete, clean, first-attempt passes with matching before/after inputs. The audited workflow-judge adapter hashes the actual expanded prompt, source/fixture/rubric/runner closure, installed SDK, model parameters and runtime. Missing/unknown inputs force execution. Receipts are scoped to the same repository and PR, expire after 24 hours, and contain public scores and provenance rather than prompts or secrets. Of the 17 cases using runWorkflowJudge, 16 are eligible; the cookie workflow's custom input does not match the cache adapter and stays fresh, as do the other 11 quality cases. CI supplies the scoped cache/runtime configuration; local runs are fresh by default. Cached scores must pass current assertions; reused records retain their original source and time and cannot renew the receipt. scripts/e2e-shard-reuse.ts extends the same receipts to PR-profile E2E shards (paid evals never retry, so a pass is structurally a first attempt): the identity hashes the test's import closure, every tracked file matched by the touchfiles of every case the file registers plus the global touchfiles, the runner/workflow/setup actions, the child's environment pins, the CI image and Claude CLI version, and the shard's case ids, pattern, wall and concurrency. A computed registration, an unmatched touchfile pattern, a retrying file, a preload option or a custom endpoint makes the shard ineligible. A reused shard reports reused with its source run and writes execution: "reused" collector records; the report rejects reused outcomes outside the fast PR profile. EVALS_FRESH=1, periodic, marathon and release validation bypass both lookup and publishing.

Free test timing and isolation. test:quick is an explicitly partial measured subset for edit feedback. test remains complete local acceptance with its bounded worker pool. The CI planner inventories every free file and packs them using scripts/free-test-durations.json; each machine runs its assigned shard serially. Plans and receipts bind the source revision, complete inventory and strict outcomes; missing, duplicate or mismatched receipts fail the required aggregate. The existing maximum five-file flaky retry allowance applies across the entire lane, not separately to every machine. Refresh the full timing list with bun run test:ubicloud --record-durations. Profiling records failures faithfully and is separate from final release acceptance.

CI planner/executor/report. --emit-plan <path> --slice-budget S --jobs J (CI) or --slices K (local) computes selection + the slice plan ONCE (killing per-slice selector divergence); --plan <path> --slice i executors consume the manifest and write slice-result artifacts; --report <dir> reconciles them FAIL-CLOSED (a slice whose artifact never landed, or a planned shard nobody reported, is a failure). Budget mode (packBySliceBudget) places shards longest-recorded-first into the fullest slice whose estimated wall on J FIFO workers stays within S seconds, else a new slice; a shard with no recorded wall weighs the whole budget (its own runner), a shard longer than the budget runs alone, and overlays keep one final one-at-a-time slice. The manifest's plan records each slice estimate and its own CI job ceiling in sliceCiTimeoutMinutes: max(2 × slice budget, the slice's longest shard supervised wall, the serialized overlay envelope) + 20 minutes setup (CI_SETUP_ALLOWANCE_MINUTES); ciTimeoutMinutes is the largest of them. CI derives the matrix ([range(1; .sliceCount + 1)]) from the manifest and indexes each slice's ceiling as its job timeout (fromJSON(needs.plan-slices.outputs.slice_timeouts)[matrix.slice]). Executors refuse an EVALS_JOBS other than the planned J and run their shards longest first.

Each executor's first step records its job start (GSTACK_SLICE_JOB_STARTED_AT). The slice deadline is that start + the slice ceiling − a 5-minute upload reserve: after it the executor starts no more shards. A shard that never started reports not_run (INFRA, never-started); a shard still running is killed and reports hung (TIMEOUT, timed-out). The executor checkpoints slice-N.json after every shard start and finish, so a job killed before its final write reports from the checkpoint (slice N/M ended before its final result …: TIMEOUT), never as a missing slice. --slices K keeps the supervised round-robin baseline re-packed by recorded times for local runs. Durations are recorded per tier (a file's gate and periodic cases differ); refresh one tier from a downloaded report directory with --report <dir> --write-durations. Under EVALS_ALL the hollow-shard guard marks exit-0 shards with ZERO executed tests passed-empty (a failure) — census-health, not just test runs. evals.yml runs the sliced gate lane per PR — the ONLY paid lane since the legacy 17-row matrix (22.6 min/$21 per PR serialized ahead of the slices) was deleted after demonstrated parity; its KNOWN_MATRIX_GAPS/KNOWN_TIER_UNSET ratchets retired with it and test/evals-workflow-wiring.test.ts pins the surviving wiring (slice-count agreement, tier consistency, the shared register-skills composite with its fail-fast verification loop). Tier marathon (complete start-to-finish flows) is selected positively: a file enters the marathon plan only when it declares describeE2ETier('marathon') or registers a marathon-tier case, and the gate and periodic planners exclude marathon-only files; evals-marathon.yml runs them weekly and on dispatch, fresh, one file per runner, with its own fail-closed report and tracking issue, and nothing requires it. evals-periodic.yml runs ALL periodic-tier files weekly (the coverage contract) minus the reasoned exclusions in test/helpers/periodic-exclude-data.ts (reason + tracking required per entry; removal re-activates the file), plus a weekly EVALS_ALL gate census. A red census writes one report on every ref, to the step summary and the census-report-a<attempt> artifact: the run's branch, sha and event, both lanes' summaries, every pass-rate alarm line, the red ledger and session headroom (eval:pass-rates --reds / --headroom --runs 10 --branch <ref>), the all-green estimate and a link to the red-census guide, with report-derived text passed through scripts/lib/published-text.ts. Only a run on refs/heads/main comments on (or opens) the one tracking issue and closes it on the next green run; the marathon lane does the same with its own issue and marathon-report-a<attempt> artifact. test/evals-tracking-issue.test.ts pins the main-only guard and runs both report scripts. The host-run Codex job also carries the live Codex multi-block case (codex-multiblock-live: ./setup --host codex from the job's checkout into a fresh CODEX_HOME, the router in codex debug prompt-input, and a later /learn block rooted by its own prelude), and the periodic lane runs the design default-model smoke (design-model-smoke), a visible SKIPPED with no coverage credit when OPENAI_API_KEY is absent. The CI image pins the claude CLI to an exact version (.github/docker/Dockerfile.ci, enforced by test/ci-image-cli-pin.test.ts — bumps ride PRs that run the PTY gate), and every eval-store run records claude --version, resolved once in the runner parent and handed to shard children as GSTACK_CLAUDE_CLI_VERSION (never spawned on a test thread), so a TUI-drift flake hunt is a grep, not archaeology.

Eval verdict policy (EVAL_POLICY version 2 in test/helpers/periodic-exclude-data.ts; version 1 pre-registered 2026-09-29, version 2 approved 2026-10-04 with the decision memo in test-audit-2026-10.md). Paid evals never retry, except the gate's one flaky rerun. Each live case has exactly one kind in E2E_KINDS (test/helpers/touchfiles-data.ts; test/eval-kinds.test.ts enforces coverage), and the kind fixes its trials before the run:

• rule (default): one trial; any failed assertion fails the verdict. For cases where nothing stochastic decides the verdict, or where it checks a contract the product must meet every run.
• behavior: a panel of n = 3 independent trials, launched together as isolated case shards on different slices (key <file>#<id>~t<N>). All three always run: no early stop and no conditional extra trial. PASS when at least k = 2 pass and no trial violated a contract (expectContract() stamps failure_class: 'contract'). Each behavior case names its tolerated deviation in BEHAVIOR_WHY and must have a literal registration so it can run alone.
• judge: an LLM judge scoring a fixed input. judgePanel() (test/helpers/llm-judge.ts) draws 3 samples of the same prompt concurrently inside the unchanged JUDGE_MS; numeric dimensions gate on the per-dimension median of exactly 3 samples, so at least 2 of 3 must meet the unchanged threshold (judgePanelMedian(); no dimension compensates for another, and any other sample count fails closed), booleans on a strict majority. Panel logs show every sample and the mean for information; the median is the gate (EVAL_POLICY v3, approved 2026-10-06). A sample that errors (refusal, truncation, non-JSON, a malformed field) fails the panel and is never resampled; a refusal counts as an unscored panel only when every sample refused. callJudge's 429 backoff happens before any model output and is transport, not a verdict retry. The workflow-judge cache stores whole panels only. The rule case auq-matrix uses the same panel inside its one execution: each skill's single native capture has its recommendation substance scored by 3 judge samples, gated on their median against the unchanged minimum of 4, and a failed sample fails the panel without resampling (approved 2026-10-04 for censuses after the change).

panelVerdict() (test/helpers/eval-store.ts) is the single verdict function the report, collector-outcomes.json, the PR comment and pass-rates all use. A timed-out, crashed or infrastructure-failed trial is a failed trial recorded with its class; a missing or duplicate trial record makes the verdict INCOMPLETE, which fails the lane; a 2/3 PASS is shown as PASS 2/3 with the failed trial's cause. A manual re-run adds trials under a new run attempt and never replaces the first attempt's verdict; on the gate it resolves a red only by the flaky rule. A red census is never rerun on unchanged inputs: each red is diagnosed as product, test/detector, harness or infra and resolved by a concrete repair and a fresh census, or listed as a named red. The one exception: a census whose every red verdict is machine-classified INFRA or INCOMPLETE (missing slice artifact, runner loss, API error before the first model turn) may be re-dispatched once as a new run, and both runs are reported. Changing any EVAL_POLICY constant after seeing census results needs Garry's re-approval, a version bump and a fresh census; test/periodic-exclude-policy.test.ts pins the approved values.

Flaky reruns

CREW rule 16; a gate edit. Garry, 2026-10-19: "you can just run the failed test again and note that it is flaky... You don't have to do the whole test pass again for one failed test." After the gate's slices, rerun-plan in evals.yml (scripts/test-paid-shards.ts --report DIR --rerun-plan OUT, scripts/lib/paid-rerun.ts) reruns, once, at the same head and in the same run attempt, every case whose verdict failed and that nothing has re-executed yet: a red rule or judge case on its own shard (narrowed to that case in PR mode; when a dependents or full-fallback plan reruns the whole file, only the planned cases count), a behavior FAIL as its whole planned panel of 3 trials, a judge case with its 3 samples. Kinds, trial counts, thresholds and the judge model never change, and the rerun runs fresh (eval-rerun: no receipts in, none published). It plans nothing when the red is a harness failure (runner error, slice deadline, unfinalized checkpoint, a different executed case count, a reused result), an INFRA or INCOMPLETE panel, an INFRA-class or unattributed testcase, a case already red twice, or when any other problem would keep the gate red anyway. A trial whose provider rejected the run's credentials is INFRA-class (credentialRejection() in test/helpers/eval-store.ts): a session its runner saw end on Anthropic's 401 authentication_error, the CLI's authentication_failed or Invalid API key · message (claude -p, Agent SDK, or anywhere on a PTY screen), or OpenAI's invalid_api_key, or the same evidence in its failure text. The run's key is shared, so a rerun cannot help; the report counts these under INFRA and names them credentials rejected:. Assertion text that only mentions a key keeps its class.

slices-report reads every attempt's slices (paid-slice-*), each attempt's rerun (paid-rerun-*, bound to its own rerun-plan-a<attempt> manifest) and orders them into one history per case. A case is FLAKY when it failed exactly once, that failure was eligible, and its very next observation passed: the gate is GREEN with a FLAKY N headline line, a ⚑ line per case in the report and PR comment, and one JSONL record per case in the run's flake-records-a<attempt> artifact (flake-records.jsonl: case, kind, PR, head, run, where it failed and passed, symptom, rerun cost) for the daily flaky-fix pass. A case that fails twice is a real red (FAILED TWICE). Rerun spend is reported on the same headline line. Pass-rate history (trial-outcomes.jsonl) still records each run's first execution unchanged; a rerun's trials stay in its paid-rerun-* artifacts and the flake record.

A manual gh run rerun --failed attempt follows the same history, so an attempt that passes every earlier red is GREEN with the same annotation, while a red that first appears in a later attempt stays red unless its own next observation passes; a later attempt never hides a new red. On the gate lane a completed rule shard's red case no longer fails its slice job (sliceExitCode caseVerdicts); the report still fails closed on it, so the run's conclusion follows the report, and a flaky GREEN run concludes success. A rerun that --failed re-triggers (because an earlier problem blocked the in-run rerun) still reruns a case only once. A flaky GREEN binds as GREEN with its flaky_cases and is reusable by R2a and R2 (reused_flaky); a run still red after its rerun binds RED and is never reused. Train runs take the same rerun-plan path; a bisect reruns a VERDICT FAIL once on its prefix inside scripts/train-gate.ts, and a pass there is a flaky PASS naming both runs.

Ship measure

Measure-then-fix: diagnostic trials are not verdicts (scripts/ship-measure.ts). When a paid case goes red during /ship, /ship measures that case alone before it reruns the full gate: classify the red line, measure, fix at the cause, re-measure, then run the gate once (ship/sections/measure.md). The repeated runs are diagnostic measurement, not verdict retries, so they fit the no-retry rule above: they never change the recorded verdict of the run that failed, every trial and measurement file says "label": "diagnostic" and "verdict": null, and they are written under .context/ship-measure/<case>/<round>/t<NN>/ (one directory per baseline, repair round and trial; an existing round is never overwritten). The runner refuses an output directory inside the project eval dir, so pass-rate history and CI uploads never read a diagnostic trial as a verdict. The lane verdict still comes only from the full gate run. Each trial runs through gstack's single-case runner (scripts/test-paid-shards.ts --tier <tier> --case <id> --trials 1; a standalone judge id runs its file with only that judge selected and needs its own passing record) or through the project's documented single-case command (--command '<command> {case}', split on whitespace, no shell).

Counts per kind come from gstack config (bin/gstack-config), so a measurement is pre-registered before it runs. Each measurement is decided by the measurement bar (scripts/lib/measure-bar.ts, approved 2026-10-06), applied in this order:

Kind	Trials per batch (config key, default)	MEETS	MEETS-qualified	EXTEND, then the pooled decision
rule	ship_measure_rule_trials, 10	at least 9 of 10	8 of 10, every red qualifying	7 of 10, or 8 that does not qualify: 10 more trials, then 18 of 20 strict or 16 of 20 qualified
behavior	ship_measure_behavior_panels, 4 panels of 3 (12 trials)	at least 11 of 12	10 of 12, every red qualifying	9 of 12, or 10 that does not qualify: 12 more trials, then 22 of 24 strict or 20 of 24 qualified
judge	ship_measure_judge_outputs, 10 outputs	at least 9 of 10 outputs	8 of 10, every red qualifying	7 of 10, or 8 that does not qualify: 10 more outputs, then 18 of 20 or 16 of 20 qualified

A judge output passes when the median of its 3 samples passes (EVAL_POLICY v3, so at least 2 of 3). Everything below the EXTEND row is BELOW: a fix round.

• Qualifying reds (the only reds MEETS-qualified accepts): provider, which is mechanical: the trial's own failure_cause is api_error, or pre_turn_infra whose evidence names a 429 or 5xx, a rate limit, an overload or a connection reset (ship-measure classify refuses provider otherwise); judge-noise, a judge sample at the threshold; and model-miss, which counts only with a path:line citation of the deviation. Never qualifying: a timeout or hang (session_timeout, observer_timeout and provider_stall are classified so without review and cannot be reclassified into a qualifying class), a regression, a contract violation (BELOW at any count), or any red with a known fixable cause (fixable): each goes to a fix round.
• needs-classify. A batch below the strict bar but at or above the EXTEND floor, with a failed trial nobody classified, returns needs-classify (exit 5) with the trials to classify. ship-measure classify --trials 2,5 --class <c> --evidence <text> appends one immutable record per trial to the round's classifications.jsonl (a later record supersedes an earlier one) and re-decides. unclassified records "reviewed, no route"; it allows EXTEND but never qualifies.
• EXTEND (exit 6). ship-measure extend runs N more trials only when the round decided EXTEND and only on identical inputs: the measurement's identity (the working tree's frozen git tree, kind, trials, runner, Claude CLI, model, CI image GSTACK_CI_IMAGE, Bun, EVAL_POLICY and HARNESS_VERSION) must match field for field, and the refusal names the field that changed. The pooled 2N is decided once and is never extended again: there is no third batch.
• Void batches. A batch where more than 30% of trials fail with affirmative provider or transport evidence is void (an outage, not a measurement); the runner redispatches it once, both batches are reported, and a second void batch stops with a named red. A crash or module-load failure without provider evidence never voids a batch.

ship_measure_budget_usd (default 25) is an estimated admission budget per red case across the baseline, an extension or redispatch, every repair round and judge scoring: before each batch the runner reserves the estimated cost of every concurrent trial and admits only what fits beside what was already spent, then reconciles actual costs after the batch. When the next trial no longer fits it stops with a named red. A case with no per-trial estimate, or one above ship_measure_ask_per_trial_usd (default 2), asks once before any trial runs; with no estimate it then runs one calibration trial alone. ship_measure_max_rounds (default 3) limits repair rounds; an extension or a redispatch is not a round. ship-measure report prints the PR-body table: each measurement as "observed k/n" (after the named fix for a repair round, with every batch), the bar, the decision, estimated and actual spend, and qualified MEETS under their own heading. A red the user declares infrastructure is recorded with ship-measure skip and shows as unmeasured, never as a pass. A case is called fixed only with a named causal change and every failure in the closing measurement explained; the weekly census, not the loop, reports long-term reliability.

The same rule covers a failed free-suite shard: ship-measure free reruns that shard's exact file list 10 times (rerun 1 alone as the baseline, the rest in parallel at max(1, floor(cores / shard concurrency))), each with its own HOME, state root and flake ledger and with GSTACK_FREE_RETRY_FLAKY=0, under a 10-minute wall cap that reports a partial count. Browse daemons in a rerun pick free random ports, as in the normal suite. ship_rerun_backend=ubicloud runs the reruns on one Ubicloud VM through bun run test:ubicloud --diagnostic, which also sets the flaky retry off. The seeded paid case ship-measure-seeded-flake (periodic, behavior) drives /ship through this loop against a stub eval command that fails trial slots 2, 5 and 9 until its list is sorted. The weekly off-ship sweep measures main's flakiest gate cases with the same runner and bar.

Failure causes and details (diagnostic only; verdicts unchanged under v1). Every failed trial record keeps failure_class (assertion, contract, timeout, infra: the field verdicts, INFRA re-dispatch and pass rates read) and its 300-character error exactly as before. failureCauseOf() (test/helpers/eval-store.ts, called by both record builders, including the JUnit census for PTY and JUnit-only cases) adds an optional failure_cause with a one-line failure_cause_evidence. It never changes failure_class. The highest-precedence cause with evidence wins:

failure_cause	Recorded when	First step
contract	expectContract() stamped a contract violation	fix the product; a violation fails a behavior panel outright
pre_turn_infra	the trial failed before the first model turn (failure_class: 'infra'), a rejected credential included	check the runner and API status (for credentials rejected:, the key secret); an all-INFRA census is re-dispatched once
api_error	a session ended on an API error (for PTY, the API Error: panel on an idle turn) or the runner's exit reason was error_api	read the evidence line; a provider outage is a named red
refusal	the structured stop reason was a refusal (phrases only as a last resort; quoted refusal text in a tool result does not count)	check whether the fixture prompt invites the refusal
provider_stall	a session that streamed partial messages saw no event of any kind, thinking deltas included, for STALL_WINDOW_MS (120 s) while a model request was in flight and no tool, permission prompt, hook or subagent was outstanding; sessions without partial messages are never stalls	read the session ledger row; still a failed trial under v1
session_timeout	a runner's armed session timeout fired	eval:pass-rates --headroom; cut work, never raise the budget
observer_timeout	the test's observer gave up waiting for an outcome (outcome=timeout)	read the transcript tail: a missed detector or a product that never answered
assertion	a check failed after the session ran (session completed; check failed when it ended normally)	the Expected/Received values or judge dimensions
unknown	the trial failed with no evidence for any cause above	inspect the shard directory

A detector, harness or product fault is a human diagnosis, never a cause. Readers before this field accept the new records (a frozen v1 reader runs over them in test/eval-store.test.ts); an unknown cause from a newer gstack is rejected with unknown failure_cause "<x>" (written by a newer gstack; update this checkout to read it).

failure_detail carries the values error cannot hold: a failed Bun matcher's {expected, received}, or for a judge one {dimension, mean, threshold, samples, rationale} entry per failing dimension (since EVAL_POLICY v3 mean holds the panel's gating median), each part capped at 200 characters. sessions[] (at most 32) summarizes the trial's session-ledger rows. cost_known: false marks a record or trial whose harness captured no billing: PTY and Codex sessions never bill, and an SDK session bills only with a terminal total_cost_usd. It also marks a trial no result record could be attributed to: a record named by the case id or carrying case_id is that case's, and a record named by a display label (/qa fix loop) is the shard's only case's when the shard ran one case, so a multi-case shard whose records carry display labels leaves those trials cost-unknown rather than guessing which case paid (junitCensus in scripts/lib/paid-report.ts). An absent field means known. Census and marathon cost lines print the known sum and N of M trial(s) cost unknown, and a train verdict's ATTEMPT: line prints cost=$<known> known + <n> of <m> case(s) cost unknown when some but not every case in the train record has a cost (a record with no priced case prints no cost at all), never a bare total over unknowns.

Session ledger. Every runner (session-runner, the Agent SDK runner including runSharedInteractive, the PTY session and runRecordedCodexEval) appends one best-effort line per armed session to $GSTACK_EVAL_DIR/session-ledger.jsonl (test/helpers/session-ledger.ts): a stable key <runner>:<label>#n, the exact budget_ms it armed, monotonic elapsed_ms, the end reason, sanitized evidence, billed, and a compact liveness summary (longest in-request silence, the last event kind, any tool open at the end). claude -p sessions stream partial messages for this summary; transcripts keep their shape and size (full stream diagnostics only with publicStreamDiagnostics). A failed ledger write never fails a trial; a trial without ledger rows has no sessions and its headroom is unknown, never scored. The ledger rides in each slice artifact beside the shard results.

Quarantine (CASE_QUARANTINE, same file). An entry needs: a per-trial rate below 95% over at least 10 post-policy trials of the case's current input identity (pre-policy backfill may justify only an initial entry, labeled as such); a written diagnosis in reason whose failureClass is detector, harness or model-latency (a product defect is fixed or listed as a named red, never quarantined); unchanged case touchfiles in the change that adds it; and an owner, tracking pointer, enteredAt date and measurable exit. A quarantined case still runs its full panel and reports in every lane but cannot fail it, except on a hard break (0 of n) or a contract violation, and it never counts as passing coverage. At most 10% of a blocking tier (gate, periodic) may be quarantined. The weekly report fails when an entry passes its exit rule (at least 97% over at least 10 trials) without being removed, when an entry is 8 weekly runs old, or when a tier is over its cap.

Pass-rate history (bun run eval:pass-rates, scripts/eval-flake-rank.ts). It reads the trial-outcomes artifact of the last N completed weekly evals-periodic.yml runs, meaning scheduled runs on main plus main dispatches, plus completed branch census runs in the same window (flags: --case, --runs N, --branch to inspect one branch, --dir, --backfill, --json, --gate, and the views --headroom, --reds, --run <id>; --help works offline, and an unknown flag or case id exits 2 before anything is fetched; every view prints its scope: line). A branch trial counts only toward a series main has also run (same case-owned bytes, HARNESS_VERSION, model and CLI); a branch never starts or becomes a case's current series, and weeks for quarantine expiry count main runs only. It prints per-case per-trial pass rates with 95% Wilson intervals. A series is one case under one input identity (Harness version), per model, Claude CLI version and policy version (Pass-rate policy versions); a change starts a new series and older ones stay visible. Labels: INCONCLUSIVE below 10 trials, BROKEN when the latest run is 0/n after a prior interval at or above 95%, FLAKY when failures leave the interval straddling 95%, FAILING when the whole interval is below it, PASSING otherwise. --backfill imports legacy slice artifacts as pre-policy trials (first attempt only; a record that names no registry id is listed as unattributed, never guessed); they are display-only. --gate (the weekly report) fails with ACTION REQUIRED, on post-policy trials of the current series only, when a non-quarantined blocking case meets the entry rule (proposing an entry), when a rule case does (rule case behaving like behavior: fix or reclassify), when a blocking case's current identity is significantly below its previous one (one-sided Fisher exact, α = 0.05, at least 6 trials each side, Holm-controlled across the cases tested), on the quarantine rules above, and with a [headroom] alarm when a case's slowest session ran above HEADROOM_FAIL (85%) of the budget it armed. History that cannot be fetched fails the gate closed.

The views (scripts/lib/eval-history.ts): --headroom lists each case's slowest armed session against its budget (warn above HEADROOM_WARN, 75%; insufficient below 3 samples; timed-out samples marked censored; unknown without a session ledger, with the case wall beside it as a labelled upper bound) and the census critical path from the slice job timings. --reds lists verdict reds per census lane by failure class and cause, pooled and shrunk per-case red rates, and the all-green probability Π(1 − p_i) over the latest census's cases with an interval, labelled an approximation because verdicts are not proven independent. --run <id> is one census's triage: each red with its values and history, and the transcript evidence it downloads from only the slices its reds name (a slice artifact over 64 MB is reported, not fetched). The three thresholds HEADROOM_WARN, HEADROOM_FAIL and STALL_WINDOW_MS live in test/helpers/eval-budgets.ts, outside EVAL_POLICY; a slow case gets less work, never a larger budget. The red-census walkthrough is docs/evals/census-red.md.

The arithmetic. With per-trial pass rate p, the chance a single case goes red (a false red while the product works, the catch rate once it has regressed):

p	1 trial	2-of-3 panel
0.99	1.0%	0.03%
0.95	5.0%	0.72%
0.90	10.0%	2.8%
0.70	30.0%	21.6%
0.30	70.0%	78.4%

The panel removes most false reds at healthy rates, but it catches a 0.95 → 0.70 regression in one run only 21.6% of the time (a single trial 30%, retry-until-green 3%), so drift detection is the history rule's job, not the per-run verdict's. The Fisher alarm is weak at the minimum sample (5.4% power for 0.95 → 0.70 at 6 trials a side), and ten straight passes still leave a 72% Wilson lower bound: after this policy lands, every series starts INCONCLUSIVE.

A lane is all green with probability Π p_rule × Π P(≥2 of 3 | p_behavior) × Π p_judge. For the current registry (PR gate worst case: 107 rule cases and 24 judges; weekly census: 190 rule, 22 behavior and 25 judge verdicts), with rule and judge verdicts at p_rule:

p_rule	full PR gate	weekly, behavior p = 0.90	0.95	0.97
0.99	26.8%	6.2%	9.8%	10.9%
0.995	51.9%	18.2%	29.0%	32.1%
0.999	87.7%	43.2%	68.7%	76.1%

The rule term dominates: a green lane on a working product needs rule cases to be near-deterministic (0.999), which is why failing detectors are converted to outcome checks and product defects are fixed or named, and why each census reports its all-green probability from the measured rates (eval:pass-rates --reds, carried into the census report).

Timeout policy. Paid tests use the tiers in test/helpers/eval-budgets.ts (JUDGE/CAPTURE/CAPTURE_LONG/PTY/PTY_LONG); test/eval-budgets-policy.test.ts pins that every tier fits the shard wall minus overhead and ratchets raw literals. Budget above the wall is fiction. No paid test may exceed the ordinary tiers.

FINDING_RETRY_BUDGETS also registers the CEO split-overflow and Eng multi-finding batching files. Each retains its 25-minute case deadline and runs once (paid evals never retry) in a 27-minute shard wall including two minutes for cleanup. No per-case budget grows. Overlay wrappers have a 1,830-second minimum shard wall and run without Bun retries; see the overlay contract for their unchanged work budget.

The quality file reserves its whole-file wall (3,170 seconds) for every case run once, plus cleanup. Each still has 120 seconds of model work. Its 17 workflow judges own their deadline and abort signal, with five seconds for terminal recording inside a ten-second Bun grace; the other 11 retain their existing 120-second Bun timeout. Late responses cannot create records or cache passes.

The ship documentation file reserves 4,920 seconds for four 600-second cases and eight 300-second fault cases, run once, plus cleanup; in CI each case runs as its own shard. The standalone documentation child retains its 600-second case. The five review/ship explorer cases reserve 1,695 seconds, run once, including finalization grace. These are whole-file supervision limits, not additional model work per case.

The shared-library path file reserves 1,920 seconds for its three serial 600-second cases, run once, plus 120 seconds for cleanup; in CI each case runs as its own shard with a 720-second wall (a registered file's case shard supervises caseMs times its allowed attempts plus the reserve). Its registered budget keeps the file in its own shard and binds the expected wall to both the saved plan and the execution receipt; missing or stale budget records fail reconciliation. Case deadlines and model budgets do not grow.

resolvePaidShardBudget(files, overrideMs?) is the canonical per-job resolver. Each registered finding file and each overlay wrapper requires its own shard, even with --files-per-shard above one. Mixed or multi-file overlay jobs are rejected. An explicit CLI --timeout, EVALS_SHARD_TIMEOUT_MS, or API timeoutMs still wins for these policies, including a lower cap; overlay overrides below their minimum are rejected. Planner entries and execution results record the effective wall, its source and policy identifier. Custom drivers must resolve each job instead of passing their ordinary 1800-second default as an explicit cap; their outer controller/detach wall must also cover the allocated work and cleanup. The paid census counts are printed by --list for each tier. eval:bg:<pr|gate|periodic|release> runs scripts/eval-bg.ts. On the local backend its outer cap is ceil(1.5 × planned serial seconds / EVALS_JOBS) + 20 minutes, at most 4 hours, computed from scripts/paid-test-durations.json for the lane's current plan (--timeout SECS overrides). On the dispatch backend the CI job ceilings above bound the run, and the local follower stops after 4 hours. test/eval-detach-timeout-floor.test.ts pins the cap formula, the 4-hour ceiling, the backend choice, the sentinel on both backends, the conclusion mapping and dispatch dedupe.

CI plans with --slice-budget 420 --jobs 2 for the PR gate, the periodic census and the weekly gate census (the gate census also --skip-judges), and --slice-budget 1 --jobs 1 (one file per runner) for marathon. The live plans must fit their workflow's max-parallel so every slice starts at once, and every per-slice ceiling must stay within 360 minutes; test/evals-workflow-wiring.test.ts recomputes both from the complete census. Reconciliation rejects missing, duplicated or misplaced registered work, absent budget records, case shards that did not execute exactly their case, and reused results outside the PR profile. Ordinary paid tiers and the default 1800-second shard wall remain unchanged; the registered and overlay policies above supply exceptions, and unregistered over-ceiling tests still fail policy checks.

Session timeouts are two-phase: a silent API dies at the startup grace (90s local / 300s CI floor, distinct exit reason timeout_startup) and the work budget arms on the first byte — the total wall never grows (test/session-runner-startup-grace.test.ts pins the floor). A timed-out session kills its whole detached process group (claude, codex, and gemini runners alike — test/session-runner-groupkill.test.ts), so a stray grandchild can't stretch a 600s budget past 1400s. And sync spawns can't wedge a shard: every spawnSync/execSync/execFileSync/Bun.spawnSync in the test trees must carry a timeout, enforced by test/spawnsync-timeout-tripwire.test.ts with a shrink-only exemption ratchet.

Anchor-sliced setup harnesses. setup is one large bash script, so the free tests that pin its linker, cleanup, retired-skill prune, browser hint, rebuild decision, and Chromium-bootstrap behavior never run the whole thing. They slice the source by anchor (extractFn(name) takes name() { through the next \n}\n; test/setup-playwright-best-effort.test.ts slices the # 2. Ensure Playwright's Chromium is available block up to # 2b.), join the extracted functions with stubbed collaborators, and execute the REAL bash under a temp HOME with stubbed probes and installers. Two rules keep the harness honest: renaming a function or anchor comment in setup fails the test with function not found / anchor not found instead of silently testing nothing, and test/setup-link-ownership.test.ts and test/setup-playwright-best-effort.test.ts throw on any command not found on stderr as harness drift (a helper the test forgot to extract) rather than letting it degrade into a pass. Files: test/setup-link-ownership.test.ts, test/setup-cleanup-orphans.test.ts, test/setup-playwright-best-effort.test.ts, test/setup-prune-stale-generated.test.ts (_prune_stale_generated against a temp render tree plus host dirs: host cleanup after the generator already pruned, symlink targets survive, frontmatter-renamed skills, foreign links), test/setup-browser-hint.test.ts (_browser_hint and the bootstrap summary across Aside present/absent, bootstrap ok/failed/skipped, GSTACK_SKIP_ASIDE), and test/setup-needs-build.test.ts (the NEEDS_BUILD block sliced between two anchors: every binary and source set flips it, Windows .exe suffixes). test/relink.test.ts shells out to a copy of the real bin/gstack-relink against a temp GSTACK_INSTALL_DIR / GSTACK_SKILLS_DIR, and test/hook-scripts.test.ts runs the real careful/bin/check-careful.sh and freeze/bin/check-freeze.sh with JSON payloads on stdin (including the GSTACK_HOME state-root parity against bin/gstack-paths, PowerShell tool and NotebookEdit payloads); it is named Windows coverage in the curated windows-free-tests lane.

Ship measure sweep

Weekly off-ship qualification sweep (ship-measure sweep, scripts/ship-measure-sweep.ts, .github/workflows/eval-sweep.yml; approved 2026-10-06). With about 130 gate verdicts, an all-green gate is unlikely even when every case is healthy (26.8% at 99% per verdict), so flaky cases are measured on main before any ship hits them. The sweep reads eval:pass-rates history (evals-periodic.yml on main plus pooled branch census runs), takes the latest gate census, and ranks every live, non-quarantined gate case with a failed trial or red verdict by its cost to the all-green probability Π(1 − p_i) (the shrunk red-verdict rate from --reds; ties go to the lower per-trial pass rate). It measures the top K (ship_measure_sweep_cases, default 5; --k) at their kind's N on the checked-out head with /ship's runner and bar, in rank order. The report (sweep-report.md and .json under .context/ship-measure/sweep-<time>/, rewritten after every case) has one row per case (history rate, measured count, decision, estimated and actual cost, captures path) and the predicted gate all-green probability before (history) and after (each measured case's measured failure fraction, shrunk toward the pooled rate and converted to panel red risk for behavior cases). Spend is capped by ship_measure_sweep_budget_usd (default $150 per 7 days, --cap-usd) through the same admission budget: the cap is shared by the sweep's cases and every non-dry-run sweep report of the last 7 days under --prior and the local sweep root, so a dispatch after the weekly run spends only what is left. When the cap is exhausted the sweep stops and lists every skipped case. --dry-run plans and estimates at $0; --history-dir reads local trial-outcomes directories; --command '<cmd> {case}' swaps in another single-case runner. History that cannot be read fails closed with nothing measured.

The workflow runs Mondays at 12:00 UTC (after the 06:00 periodic census) and on workflow_dispatch (inputs k, cap_usd, dry_run), in the CI image with the paid-eval secrets setup the census uses. It downloads the last 7 days of sweep reports first, uploads the report and captures as the ship-measure-sweep artifact, and writes the job summary. It holds contents: read, never pushes or opens a pull request, and runs one sweep at a time repository-wide (concurrency group eval-sweep, not cancelled) so two runs never spend the same weekly cap. Fixing is done by an agent from the report, through /ship's measure loop. Sweep trials are diagnostic like every ship-measure trial: they never become verdicts and never enter EVAL_POLICY pooling or series history.

Pass-rate policy versions

Readers score only trials recorded under their own EVAL_POLICY.version. Trials from an older policy are shown display-only. Trials from a newer policy are ignored with a printed count ("ignored N trial(s) recorded under a policy newer than vX"). When you see that line, run pass-rates from a checkout at or after the commit that bumped the version. The supported rollback of a policy change is reverting its writer commit; the reader-compatibility commit before it stays.

Harness version

Under EVAL_POLICY v2 a case's series identity is the bytes the case owns (its paid test file, its fixtures and its skills' prompt files, including the generated SKILL.md) plus HARNESS_VERSION, keyed with model, Claude CLI version and policy version (scripts/eval-trial-series.ts). Each trial also records the full consumed-input fingerprint as provenance. scripts/harness-version.json pins every shared-harness file (GLOBAL_TOUCHFILES plus the session runners, the PTY harness, the e2e gate and the LLM judge) by blob hash. When test/harness-version.test.ts fails, run one of:

bun run scripts/bump-harness-version.ts --non-behavioral "<why no verdict can change>"  # no series reset
bun run scripts/bump-harness-version.ts --bump "<what behavior changed>"                # new series for every case

On a merge conflict in the manifest, take the higher version, then rerun the script.

Ubicloud VMs (bun run test:ubicloud)

bun run test:ubicloud [test:free args] runs the free suite on an ephemeral Ubicloud VM instead of the local machine. It is the fast path from small dev boxes, containers, and cloud sandboxes, and the way to record the duration seed in the CI lane's environment. It needs UBICLOUD_API_KEY (a project token from the Ubicloud console) plus bash, curl, python3, ssh, ssh-keygen, and tar locally.

scripts/ubicloud/ubi-runner.sh creates the VM (UBI_SIZE, default standard-16; UBI_LOCATION, default eu-central-h1) and streams the checkout to it: tracked files, untracked files that are not ignored, and .git, so uncommitted edits are tested. It then runs scripts/ubicloud/setup-free-suite.sh, which mirrors the free-suite CI job (same Bun pin, Playwright Chromium with its setuid sandbox helper, Xvfb, poppler, emoji fonts, zsh for the bash+zsh portability arms (#2669), generated host outputs, gate binaries, and the CSO helper), and runs xvfb-run -a bun run test:free with GSTACK_EXPECT_BINARIES=1 and GSTACK_FREE_RETRY_FLAKY=1. Shard logs are copied to .context/ubicloud/<timestamp>/, and the VM is destroyed on every exit path. The exit status is the suite's. --diagnostic instead runs /ship's free-shard measurement (scripts/ship-measure.ts free, see ship-measure) with GSTACK_FREE_RETRY_FLAKY=0.

A stock Ubuntu 24.04 VM differs from a GitHub-hosted runner in three ways that the scripts correct: the login umask is 002 (group-writable directories fail the CSO private-state checks), AppArmor blocks the unprivileged user namespaces Chromium's sandbox needs, and python3-venv is absent (required by the Python runner tests).

VMs are named ubirun-<owner>-<epoch>-<hex>, plus a -t<hours> TTL suffix (below); <owner> is UBI_OWNER (set it to the thread id on a Capy machine; lowercase letters and digits, at most 12), else a stable per-machine id. Every exit path destroys the client's own VM (trap on EXIT, INT, TERM, HUP and QUIT), and down fails loudly (FAILED to destroy <location>/<name> (HTTP <code>)) unless the VM is confirmed gone. list --mine shows this owner's VMs, usage the project's, and records the VM-id scratch file (UBI_VM_RECORD, default ~/.capy/work/ubi-runner/vms.tsv, else <state root>/vms.tsv): every VM is recorded there before the create call and forgotten only after a confirmed destroy, so a killed runner leaves a name to clean up. No age-based sweep runs by default, because the project quota is shared with other agents' runners (the TTL reaper below destroys only a VM whose own -t<hours> TTL has ended); set UBI_GC_HOURS to a positive number (or run gc HOURS; gc 0 is a no-op) to sweep only this owner's VMs older than that. For other commands, use the runner directly: scripts/ubicloud/ubi-runner.sh run --setup <script> -- '<command>', or its up / ssh / sync / pull / down steps (--help lists them).

The runner is also the /ubicloud skill's engine (bin/gstack-ubi execs it). A generated name ends in -t<hours> (UBI_TTL_HOURS, default 4; 0 omits it), the creator's own statement of how long the VM may live: reap destroys every VM in the project whose TTL ended more than ten minutes ago, whichever owner made it, and every up runs it first (UBI_REAP=0 skips it); names without a TTL, such as the ones pregate-remote.sh builds itself, are never reaped. The quota preflight adds the size's vCPUs to the project's running VMs and refuses before the create request when that exceeds the known ceiling (UBI_QUOTA_VCPUS, or the maximum the last refusal printed, remembered in the state root; UBI_QUOTA_WAIT=<seconds> waits for room instead). run, verify and ssh NAME COMMAND stream the remote output through a watchdog: a heartbeat line every UBI_HEARTBEAT seconds (300), and a command silent for UBI_IDLE_TIMEOUT seconds (1800) or older than UBI_RUN_TIMEOUT (0, unlimited) is killed with exit 124 and its last 40 lines on stderr, so a hung verify fails fast instead of holding the VM until its TTL. verify runs a repository's committed .gstack/ubicloud.json (setup, command, size, location, storage, image, env, pass, pull; flags and a trailing -- COMMAND override it) and refuses without the file, so every lane runs one definition. The file is repository content: its setup script and pull destinations must resolve inside --src, and a name it lists under pass is forwarded only when the command line grants it (--pass NAME, or all of them with --trust-config); --pass never forwards UBICLOUD_*. All of this is pinned offline in test/ubicloud-runner.test.ts against a fake API and a fake ssh, including a fixture whose fake API creates, so run and verify execute end to end.

Under 8 cores (gstack-doctor's cores row says so), run the full unit and E2E tiers on a remote gate: gstack-config set test_backend ubicloud records the choice and the row names the runner. Resume checklist after a wake or a machine swap, in this order:

1. scripts/ubicloud/ubi-runner.sh records and list --mine: a VM listed in the record but absent from the project is already gone (forget it); a VM in the project but not in the record belongs to another owner, leave it.
2. Watched background operations: a runner started under gstack-detach keeps its ### gstack-detach EXIT=<code> ### sentinel in its log; a log without the sentinel after the VM is gone is an interrupted run, not a pass.
3. One before/after pair per machine: the measurement a change claims is taken on the base and on the candidate from the same VM size and location, never one side local and the other remote.
4. Profiling very large imports (a whole-repo ingest, the full free suite under a profiler) is warned about before it starts: it holds the VM for hours, and any other lane's up reaps it once its TTL (UBI_TTL_HOURS, default 4) plus ten minutes has passed, so set UBI_TTL_HOURS above the expected duration and name that duration in the thread before launching.

Cloud sandboxes (Vercel / Conductor cloud workspaces)

Syscall-supervised sandboxes need environment setup before bun run test can run green: run scripts/sandbox-doctor.sh once per boot. It documents and treats the full failure taxonomy (missing /dev/fd, 64M /dev/shm, spurious access(2) EACCES from the seccomp supervisor under load, full-capability processes defeating chmod-denial tests, no X server, no git identity, and Conductor's git-shim exit-code laundering). The doctor seeds TMPDIR, DISPLAY, and the runner knobs into ~/.bashrc, so open a new shell (or source ~/.bashrc) before running the suite. Then:

setpriv --ambient-caps=-all --bounding-set=-all bun run test

Two runner knobs exist for these environments (both no-ops unless set): GSTACK_FREE_JOBS overrides the shard count in either direction (2 is the measured sweet spot — one serial mega-shard and 6-way sharding both saturate the per-process syscall supervisor), and GSTACK_FREE_RETRY_FLAKY=1 re-runs attributed failures once serially, downgrading a clean retry to a loud FLAKY-PASS (capped at 5 files so a broken tree can't masquerade as flaky). The required CI free lane and the Windows lane set the retry knob too, appending every flaky pass to the JSONL ledger it uploads (GSTACK_FLAKE_LEDGER) — a flaky pass never reds the lane, but it never disappears either (Flake ledger).

Test selection and tiers

Moved verbatim from CLAUDE.md (#2096 size limit).

Diff-based test selection: the sharded paid runner (test:pr, eval:bg:pr, test:gate:sharded) selects tests based on git diff against the base branch. Each test declares its file dependencies in test/helpers/touchfiles.ts. Changes to global touchfiles (session-runner, eval-store, touchfiles.ts itself) trigger all tests. Use EVALS_ALL=1 to force all tests. Run eval:select to preview which tests would run; it applies the PR profile by default, and --profile full shows the plain touchfile selection. Commands by task: CONTRIBUTING.md.

Two-tier system: Tests are classified as gate or periodic in E2E_TIERS (in test/helpers/touchfiles.ts — a facade over touchfiles-data.ts + test-selection.ts). CI runs the changed fast PR profile and selected judges per PR via evals.yml's sliced lane (planner manifest → executors → fail-closed report; engine = scripts/test-paid-shards.ts, the same runner as local eval:bg:pr); the free suite runs on every PR via .github/workflows/free-tests.yml (a REQUIRED check, secretless — fork PRs get real signal); ALL periodic tests run weekly via evals-periodic.yml (EVALS_ALL, minus the reasoned exclusions in test/helpers/periodic-exclude-data.ts — reason + tracking required per entry), plus a weekly EVALS_ALL gate census. Use EVALS_TIER=gate or EVALS_TIER=periodic to filter locally. When adding new E2E tests, classify them:

1. Safety guardrail or deterministic functional test? -> gate
2. Quality benchmark, Opus model test, or non-deterministic? -> periodic
3. Requires external service (Codex, Gemini)? -> periodic

Tier declarations are enforced by test/e2e-tier-alignment.test.ts (free, runs in bun test): a skill-e2e-* file named in a touchfiles dep list whose EVALS_TIER self-gate disagrees with its declared tier in E2E_TIERS fails the suite. Files not named in any dep list are reported, not enforced — keep both in sync.

PR paid lane fallback

PR selection (scripts/test-pr-profile.ts) classifies every changed file. A file mapped by a paid case's touchfiles selects that case. These files are exempt and select nothing: docs, any non-paid *.test.ts(x), FREE_ONLY_PR_FILES (the free and paid duration seeds, scripts/ubicloud/**, every workflow that runs no paid evals, captain/templates/**, and free-only tools), the release metadata in RELEASE_METADATA_FILES (NOTICE.md, LICENSE, licenses/**), and the fixtures in FREE_FIXTURES (test/helpers/free-fixtures-data.ts, each fixture with its free consumers). Unmapped files under DERIVABLE_PREFIXES (bin/, lib/, scripts/, browse/, design/, make-pdf/, hosts/, extension/, model-overlays/, agents/, test/helpers/, capy/) are not unknown: scripts/pr-dependencies.ts derives the cases whose reference closure reaches them (prCoverage.mode = dependents), or reports that no paid case reaches them. The derivation scans the imports of every code file, including #!-shebang .ts files and extensionless Bun or Node scripts; if any import scan fails, every unmapped file restores the full gate (label import scan failed). PR_FULL_GATE_FILES, PAID_WORKFLOW_FILES (evals.yml, evals-periodic.yml, evals-marathon.yml) and any other unknown file restore the full gate (prCoverage.mode = full-fallback). The job summary and PR comment list each unmapped file that caused a fallback with one of these labels:

• needs touchfile entry: a paid test, helper or fixture no case maps; add it to the owning case in E2E_TOUCHFILES (test/helpers/touchfiles-data.ts).
• add to FREE_ONLY_PR_FILES: a file only free lanes read; add it to the list in scripts/test-pr-profile.ts (or a fixture to FREE_FIXTURES).
• full-gate input: a PR_FULL_GATE_FILES entry every case consumes; the full gate is intended and no mapping narrows it.
• deleted but still referenced and import scan failed: fix the named reference or parse error.
• real unknown dependency: a file outside the derivable directories that no list classifies (for example ETHOS.md); map it, exempt it, or derive its directory.

The fallback rate is a label, not the bill: a dependents run whose derived closure reaches every gate case costs about what a full-fallback run does. bun run test:health leads with the cost per merged PR and reports pr-cases-per-run (mean selected gate cases and judges per PR run, per mode) and pr-known-cost-per-run (mean known trial cost per PR run, per mode) beside pr-fallback-rate.

package.json (beyond a version-only change) and bun.lock stay full-gate inputs. Over the 225 PR runs from 2026-10-07 to 2026-10-17, no run fell back on them alone, dependabot PRs never reach the paid lane (evals.yml skips github.actor == 'dependabot[bot]'), and every runtime package's importer (test/helpers/agent-sdk-runner.ts, test/helpers/llm-judge.ts, browse/src/*, make-pdf/src/*) reaches every gate case or is in the global set, so narrowing them would select the same cases.

test/free-fixtures.test.ts holds the inventory: each test/fixtures/** path belongs to a paid touchfile or FREE_FIXTURES, and each workflow to the paid or free-only list. Editing a paid test file runs its own gate cases on the PR when their Bun test is named by the case id; the file's other cases stay deferred with a reason that says to name the test by its case id.

Exercised-path map

The derived closure (above) reaches almost every gate case from most bin/ and lib/ files, because it follows prose, string and doc-comment mentions. The exercised-path map is a tighter consumer set that runs in shadow mode: it is computed and reported on every PR plan, and it never changes which cases a PR runs. Activating it is a later decision that needs PTY command capture for the cases that record no commands, two weeks of shadow data with zero shadow misses, and Garry's call on the measured saving.

A case's exercised consumers (exercisedConsumers in scripts/pr-dependencies.ts) are the union of its touchfile matches, the closure of its test file and helpers, the executable shell of its loaded skill (template and generated SKILL.md) and of every bin, lib and script that shell runs, and the bins its recorded trials invoked. Shell edges are command-position gstack-* names and repo paths, ./source, ./setup, quoted path literals, path.join pairs, data files, bun run scripts and compiled outfiles (browse/dist/browse, $B, design/dist/design, $D, make-pdf/dist/pdf). Comments, echo/printf/die messages, case patterns, bare VAR=gstack-x strings and slash-command skill names are not edges; command substitutions are kept, an expanding heredoc keeps its substitutions and a heredoc an interpreter reads stays whole. The closure stops at PR_FULL_GATE_FILES and the global set, which stay full. test/exercised-map.test.ts pins that this function equals or is a reviewed superset of the measured prototype (test/helpers/exercised-prototype.ts).

The observed half is test/helpers/exercised-commands.json (generated; per case the bins and compiled outfiles its recorded trials ran, observation counts, the source run ids and a mean known cost per run). Refreshes are union-only: an observation never removes a command and a missing or empty artifact never erases one; removing a command is a reviewed edit. While the map is in shadow mode it changes no selection, so a PR that changes only the map selects no paid case.

Dollar figures are lower bounds. Known cost excludes PTY trials, whose cost is unknown: about 39% of observed case runs in the committed map. The shadow block and test:health both say so.

• Shadow block: prCoverage.shadow in the paid-plan manifest lists the gate cases the map would select, would drop and would add, a provenance line per changed file ("selects N case(s): touchfile (k), import (k), skill bash via bin/gstack-x (k), observed bin/gstack-y (k)"), the predicted saving and the unknown-cost share. The coverage summary prints one line of it.
• Shadow misses (bun run test:health, metric pr-shadow-map): a red case (more executed failed than passed trials in the run) that the shadow would drop is an activation miss unless the case passed in a later run of the same branch at the same head SHA. That later pass marks it a flaky drop, which is listed but not counted. The D3 activation bar counts activation misses only.
• MAP_GAP: the paid report runs the same bin matcher over each executed case's recorded commands and prints, and writes to map-gaps.txt, MAP_GAP <case> <command>: non-blocking for this PR; the next census refresh widens the map (docs/TESTING_INTERNALS.md#exercised-path-map) for a command outside the case's static-plus-observed closure. It is its own result: never a case verdict, a lane problem or an INFRA re-dispatch input.
• Census refresh: the weekly census unions its own recorded commands into the map (no REST artifact downloads), uploads it as exercised-map-a<attempt>, reports MAP_GAP lines and the cases that recorded no commands, and prints the refresh command. Run bun run test:exercised-map --from-run <id>, or --from-dir <dir> on a locally downloaded exercised-map-a<attempt> artifact when the download hits HTTP 403, and open the change as an ordinary PR. bun run test:exercised-map --check validates the committed file.
• Refresh contract: a refresh whose input is unavailable or partial writes nothing, keeps the committed union and exits with a stable code that names what was missing: 2 usage; 3 input unavailable (a missing directory, or a failed or HTTP 403 download); 4 input incomplete (no shards/, no trial-outcomes.jsonl, an executed case without a shard artifact, or a missing or malformed exercised-commands.json). The census step reports a failed refresh in its job summary and uploads no map.
• Replay receipt: bun run test:exercised-map --replay replays the recorded red PR runs in test/fixtures/exercised-map-replay.json (every executed failed gate trial in 225 evals.yml pull_request runs, 2026-10-07 to 2026-10-17) through today's selector and its shadow, and exits 1 on any MISS: a failed gate case the shadow would not run. test/exercised-map.test.ts pins zero.

PR receipts, recovery, readiness and verdict reuse

Passes and failures of single-trial shards are written as receipts at the execution boundary, so a cancelled run's finished work survives. The recover-receipts job runs scripts/recover-receipts.ts from the base ref with actions: read: it merges the receipts of at most 5 completed, cancelled evals.yml runs of the same PR (oldest first, negatives before passes, so a newer FAIL blocks an older PASS) and hands the store to plan-slices, which keeps contents: read only. Its recovery.json checkpoint never advances past an unresolved run. plan-slices turns reuse off when recovery degraded, the checkpoint is missing or a cancelled run is still unresolved; recovery itself never fails the run, and the job summary names the reason (rate limit with its reset time, gh auth status, the 60-second budget). The whole store is saved by slices-report. Both the restore and the save run on GitHub-hosted runners: an Ubicloud runner sends actions/cache to Ubicloud's transparent cache, which a GitHub-hosted restore never sees (until GSTA-48 every restore missed).

Readiness (R1). Paid slices for a PR head start only when the PR has been quiet for the window (repository variable EVALS_QUIET_MINUTES, default 10, measured from the run's creation) and Free Tests has concluded success on the same head SHA, as GitHub's pull_request run or, for a head with none, as a workflow_dispatch run on the branch (the dispatch route of docs/ship-policy.md for a head whose only conflict with the base is the CHANGELOG, which gets no pull_request CI; the pull_request run built the merge ref, so it decides whenever it exists, a dispatched run decides only without one, and a red dispatched run blocks like any other, #3508). The readiness job (scripts/eval-readiness.ts) sleeps out the window with no API calls, since a newer push cancels the run anyway, then polls Free Tests every minute for up to 80 minutes. Free Tests red on the head fails the run without paid work; re-run Free Tests, then re-run this workflow (a re-run keeps the creation time, so it does not wait out the window again). A head that is no longer the PR's head reports "superseded by " and plans nothing. Selection, trials and verdict rules do not change. Version Gate is not an input, so a stamp push waits only for its own Free Tests and always gets a gate. Dispatches (eval:bg, the census) never wait.

Verdict reuse (R2a restamp-only, R2 main moved; a gate edit). A PR head reuses the verdict of the newest executed gate of the same PR instead of running one only when all of these hold. Every newer run of the PR either bound a verdict or provably ran no paid slice (superseded, readiness-blocked, a reuse, or cancelled before a slice finished); a newer run that is still running, finished a slice, or holds a paid-slice-* artifact without a bound verdict blocks reuse, so a newer red or partial result is never skipped. The gate is GREEN with reconcile exit 0, a successful run and no manually accepted (unscored) case; it ran the PR profile on a different head. Each run's newest attempt binding counts, and a flaky GREEN is a GREEN whose reuse names its flaky cases. Then either:

• R2a, restamp-only: it ran on the same base (the tested merge commit's first parent), the tree receipt (lib/tree-receipt.ts under the base's ship policy) prints TREE: same-modulo-stamps, and every differing file is the version file, package.json, the CHANGELOG or a release output (the agents digest); or
• R2, main moved: the base moved, and the PR's own diff from its merge-base, excluding stamp files, is byte-identical to the gated head's (git diff --binary --full-index, so pre-image blob ids are compared and a main change to a file the PR also changes is a difference; package.json compared without its version; release outputs with each revision's version replaced; the CHANGELOG by its preamble and the sections the PR added and removed, dropping only version or [Unreleased] headings).

Finally this head's own plan must have the same selection fingerprint (cases, statuses, trial plans, profile), so a main move that changes what the PR gate selects runs the full gate. recover-receipts proposes the candidate from base-ref code (scripts/gate-reuse.ts find), plan-slices confirms the selection, eval-slices is skipped, and the report and PR comment say PASS (reused: restamp-only, R2a) or PASS (reused: main moved, R2) with the reused run, its head, why, and the receipt digest or own-diff signature. Free Tests and every other check still run on the new head. Executed runs upload a gate-binding-a<attempt> artifact (base, verdict, reconcile exit, manual count, selection); reused runs bind nothing, so reuse never chains off a reuse. Any other case (a changed own diff, a non-stamp byte including CHANGELOG entry text or a file mode, a missing binding, receipt or merge-base, a gh or git error, evals-fresh) runs the full gate. For a restamp to qualify, write the CHANGELOG entry before the gated push (under ## [Unreleased] or the tentative version) so the stamp only re-heads it.

PR labels: evals-no-debounce sets the quiet window to 0 (Free Tests is still required) and evals-fresh turns receipt reuse and verdict reuse off. Labels apply from the next push, because adding a label does not start evals.yml.

Replay gate cost

bun run scripts/gate-cost-replay.ts --runs <id,...> [--since YYYY-MM-DD --until YYYY-MM-DD | --prs 3201,3202] [--json] measures the paid PR gate's bill from recorded artifacts, for free. --runs names complete full-gate runs; their paid-slice-* and trial-outcomes artifacts are downloaded read-only with gh into .context/gate-cost-cache once and reused from there. It prints:

• recorded $ per gate (mean, min, max), split by model and by token class (cache write, output including thinking, cache read, uncached input), priced through lib/pricing.ts;
• a per-case mean cost table (--cases prints all of it); a case whose runs record no cost (PTY sessions) is estimated from its duration and marked estimated, at recorded dollars per recorded session-second unless --usd-per-second pins the rate;
• for each squash merge on origin/main's first-parent history in the window (bare dates are UTC days, --until inclusive), the selection cost under today's selector, R4's exercised-map shadow and the screening rule, and the mean, median and mean case count per merged PR over every merged PR in the window, zeros included;
• a seeded merge-train model (every merged PR lands in a train; screened and unscreened defect rates, outside reds, a $6 bisect per red, culprits requeued, one rebuild per unattributed red) for each screening policy, with $ per week and per merged PR and the multiple against $9,950 and $8,400 a week.

Screening figures are labelled screen-provisional: the rule's preamble detector is a line-commonality heuristic, not T2's hunk classifier, so they stay heuristic until T2 lands. A package.json change that only moves the version is neither selected nor a canary trigger, and all 24 judges always run. The selectors are this checkout's, so an old merge is replayed against today's maps. A shallow checkout says which git fetch --shallow-since to run. Logic: lib/gate-cost.ts; tests: test/gate-cost.test.ts.

Free suite runner, judge reuse and engine skips

Moved verbatim from CLAUDE.md (#2096 size limit).

bun run test routes through scripts/test-free-shards.ts (N concurrent shard processes, serial within each, packed by recorded per-file durations when scripts/free-test-durations.json exists — refresh it with bun run test:ubicloud --record-durations; strict-output classification per shard: a shard without bun's terminal summary line FAILS — silent truncation cannot report green). TREE_MUTATING lists the files that still run in their own trailing serial shard (today only test/bootstrap-retention.test.ts, for host-wide procfs visibility); gen-skill-docs tests no longer need it (main() guard, and --out-dir renders every host into mkdtemps — see docs/TESTING_INTERNALS.md). Never type bare bun test for the suite: it walks the whole repo, loading paid eval files and missing the strict classifier. It covers skill validation, gen-skill-docs quality checks, browse integration tests, the Aside contract pins, and the render-wrapper pins. bun run test:pr runs the selected short live behaviors and quality judges. It reports deferred broad coverage; unknown dependencies restore the full gate, and an unmapped prompt without registered coverage blocks planning. Full free acceptance and required PR checks must pass before publishing. CI can reuse the 16 workflow-judge passes for 24 hours when their complete consumed inputs and runtime match; records preserve original provenance. The cookie workflow's custom input, the other 11 judge cases, dynamic agent tests, and local runs without scoped cache configuration stay fresh. Scheduled/manual full coverage and test:release always run fresh. See testing policy for commands and measured targets. Anything that needs Aside itself (test/skill-e2e-aside.test.ts, the Aside qa/design E2E cases, the live render in test/aside-render.test.ts) runs only on a Mac with the Aside app open and self-skips elsewhere (asideAvailable()). make-pdf's render gates and test/skill-e2e-diagram.test.ts run through whichever engine resolves (browserAvailable() — Aside, or the browse binary CI builds with bun run build:gates) and skip only when neither exists; the fallback engine's own tests run everywhere.

Real-home tripwire

No free test may write the developer's real home. scripts/lib/free-home-guard.ts snapshots ~/.gstack, ~/.claude, ~/.codex, ~/.agents and ~/.config/gstack (live session logs excluded) and fails the run when an entry changes.

• A shard that runs alone (--shard, CI, the exclusive host-state shard, the flaky retry) owns its window, so the failure names its files.
• Full-suite shards run concurrently on one HOME and cannot tell whose write a change was. The runner guards that whole phase once and names no shard.
• bun run scripts/test-free-shards.ts --attribute-home names the writer: it runs every file alone with a private HOME (browser cache and git identity still come from the real home) and reports each file that wrote a watched surface. The retained shard directory keeps the written files as evidence.

Fix a writer with usePrivateStateRoot() (test/helpers/private-state-root.ts) or a child HOME/GSTACK_HOME, and resolve product state paths at write time, never at import.

Flake ledger

GSTACK_FREE_RETRY_FLAKY=1 reruns a failing free test file once, serially. A clean retry turns the shard green as a flaky pass and appends an entry to that shard's flake ledger, uploaded as flake-ledger-<shard> (90-day retention). The Monday "Weekly test health" workflow (bun run test:health --enforce) reads main's ledgers through scripts/lib/ci-history.ts and fails when a file flakes in more than 5% of main free-tests runs over a window of at least 20 runs; a window thinner than 20 runs in the last 7 days widens to the newest 20 runs, and fewer than 20 runs is report-only. bun run test:health flake-summary <dir> prints a run's ledgers as a table. A flaky file is fixed at source; the retry never masks it. bun run eval:pass-rates lists only the local ledger (flakeLedgerPath(), overridden by GSTACK_FLAKE_LEDGER).

The aggregate job of free-tests.yml downloads every flake-ledger-* artifact of the run and appends bun run scripts/test-health-report.ts flake-summary <dir> to its job summary. The Windows lane uploads flake-ledger-windows-<shard>.

Free-suite flake rules:

• Bun gives a child stdio: 'pipe' a unix socketpair. A test that must hold a write blocked uses a FIFO the test never reads (test/qa-evidence.test.ts, test/qa-deadline.test.ts), not a paused child stream: socket capacity follows net.core.{w,r}mem_default and the parent's reader.
• A test that rewrites CI provenance variables (CI, GITHUB_*, CI_*) restores them. Free shards run many files in one process, and a later browse daemon without CI=true launches Chromium sandboxed.
• Handshakes with a runner wait for the runner's own observable effect (its progress line, a coalesced read count), not for a fixture side file or a timer.
• Fixtures that commit and then list, watch or remove a repository's .git turn git auto-maintenance off themselves (maintenance.auto=false and gc.auto=0 in the repo config, or in the explicit git env they build). Since git 2.29, git commit starts a detached git maintenance run --auto that creates and deletes .git/objects/maintenance.lock after the commit has returned; a listing counts it, a watcher's lstat misses it, and Bun's rmSync(..., { recursive: true, force: true }) returns without an error while leaving the directory behind. runFreeShard appends the same two keys to every shard child's GIT_CONFIG_* pairs as a backstop, so it covers fixtures that inherit the environment, and bun run scripts/ship-measure.ts free --backend local measures with that environment; a fixture with its own replacement env never sees the backstop. Neither does the receiving side of a push to a local path: git's local transport drops GIT_CONFIG_* from the receive-pack it starts, so every push into a fixture's bare origin still leaves a detached maintenance run in that origin. A fixture that clones such an origin passes --no-local (coordinatorClone in test/helpers/ship-queue-fixture.ts), so the clone reads it through git's transport instead of copying objects/ entry by entry.

To reproduce a ledger entry, take the shard's exact file list from the CI run's free-plan artifact, then rerun it with the flaky retry off on a CI-mirrored VM:

gh run download <run-id> -R garrytan/gstack -n free-plan -D /tmp/free-plan
files=$(jq -r --argjson s <shard> '.shards[] | select(.shard == $s) | .files | join(",")' /tmp/free-plan/free-plan.json)
bun run test:ubicloud --diagnostic --files "$files" --reruns 30

The ledger entry names the shard (flake-ledger-<shard>). Read the counts from the run's free-measurement.json (completed, passed, capHit): with a before-fix failure rate p, a fix needs at least 3/p clean completed reruns of the same command, so zero failures would have under a 5% chance if nothing had changed. Cut or unstarted reruns are incomplete, not passes.

Free suite duration seed

scripts/free-test-durations.json drives shard packing; files missing from it pack at the seed's 99th percentile. Acceptable seeds come only from a recording in the CI lane's environment, each file timed in its own child: the weekly free-durations-record.yml run, or bun run test:ubicloud --record-durations (it needs UBICLOUD_API_KEY and copies the refreshed seed back into the checkout). A 4-core laptop or small-sandbox recording is not acceptable: browser and display tests skip or slow down there, so the seed misstates them. Contributors without UBICLOUD_API_KEY leave the refresh to a maintainer.

• --ci-plan warns in the job summary, with the refresh command, when more than 5 files are unseeded; it never fails a PR. --ci-verify lists shards that ran longer than 1.5× their prediction and at least 30 seconds over.
• The weekly test-health run fails its enforced unseeded-free-files check ("stale seed: N unseeded file(s) > 5") when more than 5 free test files are missing from the seed, so contributors without Ubicloud access learn within a week that it needs a refresh.
• test/free-seed-ratchet.test.ts (run with full history in free-tests.yml's free-plan job, GSTACK_FREE_SEED_BASE=$(git merge-base HEAD origin/main)) fails when a seeded file over 60 seconds is missing from scripts/free-test-seed-allowlist.json, when an allowlist entry is stale (gone, or no longer over 60 seconds), or when an entry is added relative to the merge-base copy without a todo. An annotated exception is {file, reason, todo} and the test prints it. A merge-base without the allowlist file counts as the first allowlist. Fix a failure by splitting the file, then rerun bun run test:ubicloud --record-durations.
• free-durations-record.yml (Mondays 04:00 UTC, before test-health, and on dispatch) records the Linux seed on ubicloud-standard-8 with scripts/ubicloud/setup-free-suite.sh and the Windows seed through windows-free-tests.yml's record_durations path. When either recording adds or drops a test file, it force-updates the bot/free-duration-seeds branch, opens or refreshes one seed PR whose body states the ratchet result, and dispatches Free Tests, Windows Free Tests and Quality gate on it. Those dispatched runs are the seed PR's checks, and Free Tests supplies the required free-tests check. GitHub holds the pull_request runs of a token-opened PR as "action required" until someone approves them. A file that fails while recording turns its job red but keeps its duration, and the PR body names it; the seed PR's own free checks decide whether the tree is healthy. An interrupted recording uploads no seed, and more than 5 red files on either OS proposes nothing. The bot never edits the allowlist: a ratchet failure is fixed on the branch by a maintainer before the PR merges, and while the open seed PR holds any commit besides the bot's one refresh commit, later runs leave it alone. Only runs on main push the branch; a dispatch from another ref reports only.

Windows free lane

windows-free-tests.yml plans on Linux (--windows-only --ci-plan --shards 6), runs one strict serial shard per windows-latest job (bun run test:windows --ci-run), and verifies every shard receipt on Linux (--windows-only --ci-verify). Packing uses Windows-measured durations from scripts/free-test-durations-windows.json; the weekly free-durations-record.yml run refreshes them, or by hand run gh workflow run windows-free-tests.yml --ref <branch> -f record_durations=true, then download the free-test-durations-windows artifact and commit it.

Curation lives in scripts/lib/windows-curation.ts. Every Windows plan and --list prints the curated count and the top exclusion reasons (also in the job summary). Files a probe proved safe despite a /tmp literal are force-included (WINDOWS_PROBE_SAFE). test/windows-native-workflows.test.ts holds WINDOWS_CURATED_FLOOR; when Windows-safe tests are deleted on purpose, lower it in the same PR with a reason.

To see whether one test is in the subset, and why not when it is excluded:

bun run scripts/test-free-shards.ts --windows-only --list | grep test/<name>.test.ts

A test a content pattern excludes wrongly joins the subset through KNOWN_WINDOWS_SAFE (with its reason) or, for a /tmp literal a probe proved safe, WINDOWS_PROBE_SAFE. A test that fails on windows-latest for a reason the patterns cannot see (it expects the Linux-host lanes verdict, skips itself on win32, drives a POSIX signal path) leaves it through a KNOWN_WINDOWS_INCOMPATIBLE entry naming the reason; rerun --list to confirm the file moved.

Native qualification campaigns (Windows cookie extraction, Windows launch diagnostics) run only on dispatch of native-qualification.yml:

gh workflow run native-qualification.yml --ref <branch> -f mode=<cookie-native|windows-native-diagnostics>

Real-setup install fixture

Tests that run the real setup use test/helpers/install-fixture.ts. Each test file builds one read-only seed checkout and clones it per test with copy-on-write file copies (plain copy fallback), never hard links. Writes go through put, setVersion and the fixture*Sync helpers; files register afterEach(cleanupFixtures) and afterAll(cleanupSeed). test/install-fixture.test.ts is the isolation tripwire: writes in one clone leave the seed and sibling clones unchanged.

Test-only timing knobs

Defaults are the product's; tests shrink them instead of waiting real time: GSTACK_RENDER_SLACK_MS (lib/aside-render.ts, default 10000), GSTACK_MEMORABLE_LOCK_TRIES (bin/gstack-memorable, default 50 tries of 0.1 s), the recordGraceMs option of test/helpers/office-hours-attempt.ts (default 5000) and the timeoutMs argument of clearCookieTargetStorage(page, origin, timeoutMs) (default 15000).

Candidate-side blinding

A paid case has two readers that must not know what the other knows: the candidate (the agent under test) must not know it is being graded, and the judge must not know which arm it is grading. /eval-plan Step 1c states the three rules a preregistration carries; this is what they mean for gstack's own fixtures.

• The candidate's view carries no eval word. Nothing the candidate can read (its working directory, file names, the task prompt, commit messages, the environment) says eval, test, judge, experiment, rubric, score, compare, benchmark, candidate or arena. The project's own test/ directory is exempt when the task is about those tests, and so is the skill text an arm loads as its own instructions (a gstack SKILL.md and the ETHOS.md it points at use these words freely); the rule governs what the case builds. The hermetic home a case builds (test/helpers/hermetic-env.ts) is the boundary: what is copied in is visible, what stays in the runner is not.
• Fixture roots are project-shaped. A fixture the candidate works in is named like the project it imitates, with the files that project would hold. Runner-side fixtures (captured transcripts, judge calibration sets, census reports) are never shown to a candidate and may keep descriptive names.
• The judge grades labels and reads, not claims. A judge prompt names arms A and B, never the model or run, and a chain-following dimension is scored from the files the transcript shows the candidate opened, not from what the candidate says it read.

An audit on 2026-10-26 (GSTA-124) found these fixture directory names on the word list: test/fixtures/arm-benchmark/ and its four children, browse-judge/, cso-eval/, eval-history/, judge-calibration/ and its children, two shard names under paid-report-census/ and the test/ subdirectories of state-matrix-6792/. All of these are runner-side: no candidate's working directory is one of them. Candidate-visible gaps are in the temporary roots the harnesses create: test/helpers/arm-benchmark-harness.ts copies each fixture into os.tmpdir()/arm-<fixture>-<arm>-*, so the candidate's working directory is named after the arm rather than after a project; test/skill-e2e-deploy.test.ts runs the /benchmark case in skill-e2e-benchmark-*, a root that carries a listed word; test/skill-e2e-test-value.test.ts creates skill-e2e-<id>-* roots as the candidate's working directory, and two of its ids (review-test-value, test-audit-report-only) carry the word test; and test/skill-e2e-health.test.ts creates gstack-health-eval-*. That list comes from a scan of the mkdtemp prefixes in the e2e tests, not from a proof that no other root carries a listed word. The audit matched whole lower-case words in path components under test/fixtures/; a substring match (factory-scorecard/, ios-qa/FixtureApp/Tests/) was not counted. Renaming is a separate change with its own touchfile updates; the list is here so that change can be scoped.

Running evals as an agent: detach

Moved verbatim from CLAUDE.md (#2096 size limit). The short rule stays in CLAUDE.md; this is the full mechanism.

When you (an agent/harness) launch a long eval/benchmark run, run it through bin/gstack-detach — NEVER as a plain backgrounded Bash task. A plain background task lives in the harness's process group, so a SIGTERM ("polite quit") on a turn boundary, a stopped Monitor, or an interruption kills the run mid-flight (observed: script "test:gate" was terminated by signal SIGTERM ~40 min into a run of the since-retired single-process runner). On macOS the run can also die to idle-sleep. gstack-detach fixes both: a fresh session (escapes the group SIGTERM) wrapped in caffeinate -i (blocks idle-sleep).

• Use bun run eval:bg:<pr|gate|periodic|release> (scripts/eval-bg.ts). It prints [eval-bg] backend=<dispatch|local> … and gstack-detach LOG <path> and returns at once. Both backends run under gstack-detach with the machine-wide gstack-evals lock (concurrent worktrees serialize instead of saturating the shared model API) and a run-scoped log under ~/.gstack-dev/eval-runs/ whose first line names the backend, the run and the tested revision.
  • Dispatch (default when HEAD is clean and equal to its pushed branch on garrytan/gstack, checked with gh api, and gh can dispatch): pr and gate dispatch evals.yml (evals_all=false with base_ref/base_sha for pr, evals_all=true for gate), periodic dispatches evals-periodic.yml, release dispatches both. Every dispatch passes expected_sha (the workflow fails fast when the checked-out revision differs) and a nonce that appears in the run name (E2E Evals [eval-bg <nonce>]), which is how the log finds and follows its run. A queued, running or green dispatch with the same revision and inputs is followed instead of dispatched again. Dispatched runs are validation runs: fresh and never writing PR receipts, except that a pr dispatch on a branch with an open same-repo PR passes pr_receipts=<PR> and reads that PR's receipts read-only.
  • Local (dirty tree, unpushed commits, a fork, no gh, or --local / GSTACK_EVAL_BG_MODE=local): the sharded paid runner (scripts/test-paid-shards.ts) on this machine, capped at ceil(1.5 × planned serial seconds / EVALS_JOBS) + 20 minutes, at most 4 hours (--timeout SECS overrides). One Bun process per test file, an external wall-clock timeout that kills the shard's process GROUP (stray claude/codex grandchildren included), a per-shard GSTACK_EVAL_DIR=<evalDir>/shards/<slug>/ honored by the EvalCollector constructor, and an aggregate that separates failed vs timed-out vs never-started shards. EVALS_JOBS sets the shard process count (default 8, 2 for pr); EVALS_CONCURRENCY is bun's --max-concurrency WITHIN a shard (default 2). Export ANTHROPIC_API_KEY first (never pass keys in argv).
  • --dispatch refuses with the fix ("commit and push, or rerun with --local") instead of falling back. eval:list / eval:compare / eval:summary / eval:pass-rates read the shard dirs too. For any other long agent job, call gstack-detach [--lock NAME] [--timeout SECS] [--label LBL] -- <cmd> directly.
• Then poll the printed logfile with a death-aware watcher: break on the guaranteed ### gstack-detach EXIT=<code> ### sentinel (0 passed, 1 failed, 130 cancelled, 2 other on both backends; silence is never mistaken for success). bun run scripts/eval-bg.ts status <log-or-run-id> reconnects and prints running, passed, failed, cancelled or incomplete (died without a sentinel). The detached run survives even if your watcher gets reaped, so re-checking the log always works. Keep checking until the sentinel appears or the user tells you to stop; a long run is expected, and a promise to check later is not a result. At each check, report which tests passed, which are still running, and any failures so far.
• Why the lock: a shared dev box with several Conductor worktrees will rate-limit the model API if two eval suites run at once (15-way concurrency each), which mass-times-out E2E tests. The lock makes the second run WAIT, not collide.
• Humans running bun run test:pr foreground in their own terminal don't need this — Ctrl-C is intended there. Detachment is for agent-launched runs only.