mirror of
https://github.com/garrytan/gstack.git
synced 2026-10-31 22:14:25 +01:00
* feat(pregate): user-owned policy file and local lanes
A repo that keeps .gstack/ out of git can hold its pregate policy at
<GSTACK_HOME>/projects/<slug>/pregate.json. gstack-pregate run reads it only
under --policy-from base when the base carries no .gstack/pregate.json, so a
reviewed base copy always wins and a PR still cannot reach the policy. A
missing file falls back; any other read error, and a non-null sealed or
price_file (read only from the git copies), refuse with PREGATE_CONFIG_INVALID
and a fix that names the file.
A new `local` key lists <workflow.yml>/<job> lanes a local run satisfies: a
platform lane named there runs here (tier unit) instead of becoming a
requires-remote obligation. Lane ids share one LANE_ID check with selection.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(pregate): the user-owned policy file and local lanes
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(pregate): policy fixes name the user-owned file when it is the active policy
With no .gstack/pregate.json on the base, an edit to that path is never read,
so the no-lane, runner, stall_timeout_s, remote_gate and strays fixes now name
ctx.configFile: the user-owned path when it is the active policy.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(pregate): the remote_gate, strays and stall fixes name the active policy file
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(pregate): pre-landing review fixes for the user-owned policy
Ignore a user policy path that is relative or inside the checkout, fingerprint
the active user file into check inputs, name the user file in its JSON errors
and the refusal lead, add --explain lines for an absent user file and an
unknown local id, and document the state-root location and slug lookup.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(pregate): containment edges and explain wording for the user policy
A state root under an in-repo directory named ..something passed the
inside-the-repo check, and realpath kept the caller's casing on macOS.
The unknown-local explain line now says workflow lane, and the state-root
chain in explain and docs names every source.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(pregate): a base copy git cannot read, or a dangling user symlink, refuses
Any git show failure read as no base policy, which now hands the run to
the unreviewed user file; it is absent only when cat-file says so, and a
spawn error (stdout cut at the buffer limit) counts as a failure. A user
pregate.json that is a dangling symlink refuses instead of reading as
absent.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(pregate): decide a missing base policy from the tree, and catch dangling parent links
cat-file -e checks the blob, so a missing or corrupt object still read as
no base copy; ls-tree reads the tree entry, and any failure refuses. The
dangling-symlink check now covers every path component, not just the file.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(result-codes): POLICY_SOURCE_UNAVAILABLE names an unreadable committed pin file
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(pregate): the active policy may be the user-owned file; new refusals
Guards, remote_gate, stall timeouts and lane fixes name the user-owned file
when it is the active policy; the trust boundary says run alone reads it;
the dangling-symlink and unreadable-base-copy refusals are documented, and
state-root lists the bucket's pregate.json.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(pregate): a checkout's .env cannot pick the user policy; verify re-checks it
Bun loads .env from the working directory, so a branch could set
GSTACK_PROJECT_SLUG or a state root and choose which pregate.json governs
it. The shebang now passes --no-env-file, scriptInvocation carries that
flag over when it launches the bin as bun <script>, and a bare bun launch
beside any dotenv file refuses (POLICY_SOURCE_UNAVAILABLE).
A recorded pass also outlived its policy: pregate.json now records the
user file's digest (or, under the defaults, the path that was absent), and
verify and the ship receipt treat an edited, deleted or newly present user
file as PREGATE_STALE, reading both paths from the record.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(pregate): keep the POLICY_SOURCE_UNAVAILABLE summary's pin-files wording
The added '(or .gstack/pregate.json)' broke describeRefusal's rewrite to
'the reviewed pin files cannot be read', which pregate-wtree-refusal pins.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(pregate): pick the host-foreign lane in the user-policy local-lane test
On a Windows host the windows lane is native, so it never became
requires-remote and the test failed on the Windows shards.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(pregate): Rust crate lanes and nested JS package runners
lanes reported PREGATE_NO_LANE for every touched .rs file and ran a nested
pnpm+vitest package's tests as `bun test` from the repo root.
- Rust: a .rs file of a crate (nearest Cargo.toml with [package]) is a test
under <crate>/tests/ or when it holds a #[cfg(test)]; every .rs file of a
crate and its Cargo.toml select the crate's tests and those of every crate
depending on it (lib/pregate/rust.ts). Selected tests run per crate as
`cargo test -p <name>` from the workspace root, judged on the summed
`test result:` lines (doc-tests included); zero tests stays ZERO-RUN and a
missing cargo is incomplete, like a missing Dart SDK.
- JS/TS: a test owned by a nested package.json that declares vitest or jest
runs from that package with package-relative paths, through the package
manager its packageManager field or nearest lockfile names (pnpm exec,
yarn, bun x, else npx). Root detection and a declared runner are unchanged.
- init notes that Rust tests run per crate; docs/pregate.md updated.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(pregate): parse Cargo manifests as TOML; follow workspace membership
The line scan of Cargo.toml missed dependents (a false green) and picked the
wrong workspace:
- an inherited renamed dependency (`base = { workspace = true }` with
`[workspace.dependencies] base = { package = "alpha", path = ... }`);
- dotted keys (`alpha.path = "../a"`), `[dependencies.<name>]` tables and
target-specific tables, matched by key name only;
- a crate the workspace excludes ran `cargo test -p` from the workspace root.
Manifests are now parsed with Bun.TOML. A dependency resolves by path
(relative to the manifest declaring it, or to the workspace root when
inherited), else by package name. A crate runs from the workspace it is a
member of under Cargo's rules (package.workspace, the nearest [workspace],
members globs, exclude, literal members, path dependencies of members),
else from its own directory. Nothing runs cargo.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(pregate): the Rust fixture's cargo shim wins PATH on Windows and beside a real cargo
windows-free-shard (5) failed 'a touched src file runs its crate...' and
'zero tests is ZERO-RUN...' deterministically: the shim PATH was joined with
':' so Git Bash never saw the shim dir, and the runner's real cargo ran
against the fixture (exit 1, no test result lines). On POSIX hosts where
Bun and cargo share a directory (/usr/local/bin on Capy's image), the lane
puts Bun's directory first and the real cargo wins the same way.
Join with path.delimiter, add cargo.cmd for Bun.which on Windows, and on
POSIX put the shim first again in the lane's own bash through BASH_ENV.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* fix(pregate): quote the crate name in cargoRunner
The crate name is read from the repo's Cargo.toml and was interpolated into
'cargo test -p <name>', which the lane runs through bash. A name like
'evil;touch pwned' ran the second command. Quote it like every file and cwd
the lane already passes; a new end-to-end case checks the name reaches cargo
as one argument and runs nothing.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* test(pregate): the nested-package pnpm shim wins PATH beside a real pnpm
'a touched file in a nested pnpm+vitest package runs vitest there' ran the
host's real pnpm wherever Bun and pnpm share a directory (/usr/local/bin on
Capy's image): the lane puts Bun's directory first, so pnpm installed vitest
from the network, dirtied the fixture tree and the check came back
incomplete. Put the shim first again in the lane's bash through BASH_ENV,
as the Rust fixture does.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* docs(changelog): pregate Rust crate lanes and nested package runners (#3344)
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* fix(pregate): a crate name Cargo would reject never reaches the lane's shell
Port review (outside voice): quoting alone was not enough, because the lane
expands {files} after the runner string is built, so a crate named
'evil{files}' spliced the quoted file list into the quoted name and a file
name like tests/$(cmd).rs then ran. A name outside Cargo's grammar
(letters, digits, _ and -) now gets no runner: its files are unclaimed and
the lane is incomplete, as Cargo itself would refuse the manifest. A valid
name, Unicode included, still runs quoted.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* fix(pregate): match Cargo members globs per path component, without a backtracking regex
Port review (outside voice): members globs went through ship-policy's
matchesAny, which escapes [...] classes (crates/[ab] matched nothing, so the
crate was no member, lost its inherited [workspace.dependencies] path and its
dependents' tests were never selected: a false green) and backtracks
exponentially on a hostile glob such as '*a*a...*ab' (over 5 s for one crate,
before any runner deadline). A small dynamic-programming matcher handles *,
?, [..] with negation and ranges, and ** across components, in
O(pattern x path).
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* fix(pregate): a plain #[test] in src is a Rust test; bound the cfg attribute scan
Port review (outside voice): only #[cfg(test)] modules and tests/ files
counted, so a dependent crate whose tests are plain #[test] or #[tokio::test]
functions in src never ran when its dependency changed (a false green). The
cfg scan also went quadratic on a run of unclosed '#[cfg(' (about 3 s on
120 KB). Test attributes now count, and the cfg predicate and its strings are
length-bounded so the scan stays linear.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* docs(pregate): Rust test attributes, workspace membership and rejected crate names; changelog for the port review fixes
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* fix(pregate): match members globs by code point in one pass, and admit every crate past a size cap
Second port review round (outside voice): the matcher counted UTF-16 units, so
'crates/?' missed a crate directory named with a supplementary character and
dropped its inherited dependencies (a false green); and each unmatched '['
rescanned the rest of the glob (5 s for one crate with a million of them).
Tokenize by code point with a precomputed next-']' table, and past 4096
characters of members globs admit every crate under the workspace: a wrong
member fails loudly in cargo, a dropped one is silent. The new supervised
probe kills a super-linear matcher at 30 s instead of hanging the file.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* fix(pregate): scan cfg attributes once without truncating them; an unclosable one counts as a test
Second port review round (outside voice): the length bound from the first
round dropped a valid cfg(any(test, feature = "<257 chars>")), so its crate's
tests were no longer selected (a false green). Read each attribute once to
its closing ']' and resume after it, which keeps the scan linear without a
bound; an attribute the scan cannot close (an unterminated string, no ']')
counts as a test, which selects more, never fewer.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* docs(changelog): second port review round (code-point member globs, unbounded linear cfg scan)
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* fix(pregate): past the members size cap, a crate's run root is undecided and its tests unclaimed
Third port review round (outside voice): admitting every crate past the cap
made a non-member run as 'cargo test -p <name>' from the workspace root,
where a same-named member answered and its passing tests stood in for the
orphan's failing one (a false green). Keep the conservative membership for
dependency edges, but leave such a crate's workspace undecided (null):
planRuns leaves its files unclaimed and the lane incomplete.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* test(pregate): the Rust end-to-end runs put the cargo shim under Windows' own Path key
windows-free-shard (5) still failed both end-to-end cases at fe99b200 with
the same symptom (the runner's real cargo, exit 1, no test result lines).
runBin merges process.env, whose Windows key is 'Path', with the shim's
'PATH', so the child got two path variables and read the original. Write the
shim under the key process.env actually uses, as test/helpers/unreachable-gbrain.ts
and sync-gbrain-readiness-fixture.ts do.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* test(pregate): run the cargo stand-in cases on POSIX only
windows-free-shard (5) still failed both end-to-end cargo-lane cases after the
delimiter, cargo.cmd and Path-key repairs: the lane's Git Bash exits 1 with an
empty log, and that log is not visible from CI. Skip the two cases that run the
bash stand-in on win32 (test.skipIf, as other POSIX-shim pregate fixtures are
handled) and drop the unproven cargo.cmd and Path-key changes. Selection,
planning and the hostile-name case still run on Windows.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* test(pregate): TODO(#3380) on the two win32-skipped cargo-lane cases
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* fix(pregate): refuse a user policy whose link chain passes through the checkout
userConfigRejection checked the lexical path and the final realpath only. A
state root linked into the checkout, or a link hop inside it, let a branch pick
which existing out-of-repo policy governs it. Every hop of the resolution chain
is now checked. Found by the security review of #3286.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* fix(pregate): verify goes stale when a link on the way to the absent user policy dangles
A fresh run refuses a user policy path with a dangling parent link, but verify
looked only at the leaf, so the parent's ENOENT read as continued absence and
an old defaults pass stayed publishable. The loader and verify now share one
absence check. Found by the security review of #3286.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* docs(pregate): CHANGELOG entry for #3286 and the link-chain and dangling-parent rules
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* v1.91.206.0 stamp
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
---------
Co-authored-by: arlophoenix <arlo.phoenix@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: vilano93 <244097767+vilano93@users.noreply.github.com>
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
799 lines
49 KiB
TypeScript
799 lines
49 KiB
TypeScript
/**
|
||
* Result codes for the unattended workflow commands (gstack-artifact,
|
||
* gstack-gate, gstack-autoplan-timing, gstack-review-log --findings, the
|
||
* skill-start guard line) and the install side (gstack-doctor --check,
|
||
* gstack-capy-install, gstack-browser-ensure; the Bash side reads the same
|
||
* table from the generated bin/gstack-doctor-components.sh). Sibling of lib/gate-outcomes.ts, whose `state`
|
||
* enum is for gate outcomes only: a result code has no state, just one
|
||
* stable anchor in docs/troubleshooting.md, a summary and a `fix:` clause.
|
||
* Every error line a workflow command prints ends with `(<CODE>)` so a parent
|
||
* agent greps the code, never the prose. test/troubleshooting-anchors.test.ts
|
||
* checks every anchor exists; add a row here before printing a new code.
|
||
*/
|
||
import { RELEASE_RESULT_CODES } from './result-codes-release';
|
||
import { CAPY_RESULT_CODES } from './result-codes-capy';
|
||
|
||
export interface ResultCode {
|
||
/** Stable `<a id>` in docs/troubleshooting.md. */
|
||
anchor: string;
|
||
/** What happened, in plain words; `<detail>` adds the real value. */
|
||
summary: string;
|
||
fix: string;
|
||
}
|
||
|
||
export const RESULT_CODES = {
|
||
ARTIFACT_INVALID_JSON: {
|
||
anchor: 'artifact-invalid-json',
|
||
summary: 'the manifest or a JSON artifact is not valid JSON',
|
||
fix: 'regenerate the run with the tool that writes it; never hand-edit a manifest',
|
||
},
|
||
ARTIFACT_UNSUPPORTED_VERSION: {
|
||
anchor: 'artifact-unsupported-version',
|
||
summary: 'the artifact declares a schema_version this gstack does not read',
|
||
fix: 'run /gstack-upgrade on the consumer, or regenerate the run with this gstack',
|
||
},
|
||
ARTIFACT_SCHEMA: {
|
||
anchor: 'artifact-schema',
|
||
summary: 'a required field is missing or holds a value outside its enum',
|
||
fix: 'compare the row with `gstack-artifact schema <name>` and regenerate it',
|
||
},
|
||
ARTIFACT_MISSING: {
|
||
anchor: 'artifact-missing',
|
||
summary: 'an artifact named by the manifest is not in the run directory',
|
||
fix: 'copy the whole run directory, not single files; rerun the phase that writes the missing file',
|
||
},
|
||
ARTIFACT_STALE: {
|
||
anchor: 'artifact-stale',
|
||
summary: 'an artifact’s bytes no longer match the hash the manifest recorded',
|
||
fix: 'treat the run as tampered or partially rewritten; regenerate it or re-bind the file through the tool that wrote it',
|
||
},
|
||
ARTIFACT_PATH_ESCAPE: {
|
||
anchor: 'artifact-path-escape',
|
||
summary: 'an artifact path resolves outside the run directory (a `..` segment, an absolute path or a symlink)',
|
||
fix: 'keep every artifact inside the run directory and name it with a plain relative path',
|
||
},
|
||
ARTIFACT_MALFORMED_JSONL: {
|
||
anchor: 'artifact-malformed-jsonl',
|
||
summary: 'a JSONL artifact has a line (usually the tail) that is not one JSON object',
|
||
fix: 'the writer was interrupted mid-append; rerun the phase that writes the file',
|
||
},
|
||
ARTIFACT_DUPLICATE_ID: {
|
||
anchor: 'artifact-duplicate-id',
|
||
summary: 'two rows share one id',
|
||
fix: 'ids are run-bound and unique per file; regenerate the rows with the tool that assigns them',
|
||
},
|
||
ARTIFACT_UNBOUND_ID: {
|
||
anchor: 'artifact-unbound-id',
|
||
summary: 'a row id does not start with the run id',
|
||
fix: 'ids are `<run>-...`; regenerate the row with the run id the manifest names',
|
||
},
|
||
ARTIFACT_DANGLING_REF: {
|
||
anchor: 'artifact-dangling-ref',
|
||
summary: 'a row references an id no artifact in this run defines',
|
||
fix: 'write the referenced finding, decision or task first, or drop the reference',
|
||
},
|
||
ARTIFACT_DEPENDENCY_CYCLE: {
|
||
anchor: 'artifact-dependency-cycle',
|
||
summary: 'tasks depend on each other in a cycle',
|
||
fix: 'break the cycle in `depends_on`; a lane cannot start a task that waits on itself',
|
||
},
|
||
ARTIFACT_COUNT_MISMATCH: {
|
||
anchor: 'artifact-count-mismatch',
|
||
summary: 'a count in run.json disagrees with the rows in the file it summarizes',
|
||
fix: 'regenerate run.json after the last row was written; a count never replaces the file',
|
||
},
|
||
ARTIFACT_RUN_INTERRUPTED: {
|
||
anchor: 'artifact-run-interrupted',
|
||
summary: 'the run did not reach a terminal status or a reviewer never returned',
|
||
fix: 'resume the run (`gstack-autoplan resume --out <dir>`) or treat its artifacts as partial',
|
||
},
|
||
ARTIFACT_REVIEWER_MISSING: {
|
||
anchor: 'artifact-reviewer-missing',
|
||
summary: 'a required phase or one of its voices has no terminal outcome or no bound output file',
|
||
fix: 'finish the phase; a missing voice is missing coverage, never N/A by default',
|
||
},
|
||
ARTIFACT_GUARD_LINE_MISSING: {
|
||
anchor: 'artifact-guard-line-missing',
|
||
summary: 'an unattended run’s review-record.md does not state that the publication guard was not enforced',
|
||
fix: 'start the run through gstack-skill-start so the GUARD_NOT_INSTALLED line is recorded',
|
||
},
|
||
GUARD_NOT_INSTALLED: {
|
||
anchor: 'guard-not-installed',
|
||
summary: 'this host does not execute the autoplan publication hook, so phase publication order is unverified',
|
||
fix: 'nothing to do on this host; the run record carries this line, and the snapshot hashes per phase stand in for the guard',
|
||
},
|
||
REVIEW_STATUS_MISMATCH: {
|
||
anchor: 'review-status-mismatch',
|
||
summary: 'the review-log row claims a status or count that its findings file contradicts',
|
||
fix: 'log through `--findings <file>` and let the row be derived; fix the findings file, not the claim',
|
||
},
|
||
GATE_REV_STALE: {
|
||
anchor: 'gate-rev-stale',
|
||
summary: 'the reply answers an older revision of the gate list',
|
||
fix: 'render the current gate list, read it, and reply with its gate_rev',
|
||
},
|
||
GATE_REPLY_UNPARSED: {
|
||
anchor: 'gate-reply-unparsed',
|
||
summary: 'part of the reply matched no gate item or option, so nothing was applied',
|
||
fix: 'reply with `rec`, `as-is`, `<id><option>` tokens (for example `d3b uc1a`), or `rec except <tokens>`; bare yes/no is ambiguous',
|
||
},
|
||
ANSWER_BY_REQUIRED: {
|
||
anchor: 'answer-by-required',
|
||
summary: 'an unattended gate answer named no valid answerer, so nothing was applied',
|
||
fix: 'pass `--by human` when the owner typed the tokens, or `--by agent:<thread or id>` when an agent relays or decides; the value lands on every decision row as answered_by',
|
||
},
|
||
// PR A (multi-agent wave): gstack-doctor --check, gstack-capy-install, gstack-browser-ensure.
|
||
COMPONENT_MISSING: {
|
||
anchor: 'doctor-component-missing',
|
||
summary: 'a component the selected workflow needs is not installed, not built or not current',
|
||
fix: 'run the command in the row\'s fix clause, then re-run gstack-doctor --check',
|
||
},
|
||
RUNTIME_BELOW_MINIMUM: {
|
||
anchor: 'doctor-runtime-below-minimum',
|
||
summary: 'the Bun on PATH is absent, below gstack\'s security floor, or below its supported minimum',
|
||
fix: 'install the supported Bun through setup\'s checksum-verified recipe (bin/gstack-capy-install does this on Capy), then re-run ./setup',
|
||
},
|
||
PROJECT_PIN_MISMATCH: {
|
||
anchor: 'doctor-project-pin-mismatch',
|
||
summary: 'the running Bun or Node is outside a version the target project pins (package.json engines, .tool-versions, .nvmrc, .bun-version or a CI workflow)',
|
||
fix: 'install the pinned version for this platform (on Capy: run the gstack skill\'s `scripts/install.sh` without --check), or change the pin in the project',
|
||
},
|
||
REVISION_UNMET: {
|
||
anchor: 'doctor-revision-unmet',
|
||
summary: 'the installed gstack checkout is not at the revision --revision requested',
|
||
fix: 'run /gstack-upgrade (or git -C <checkout> fetch && git checkout <ref>, then ./setup) to move the checkout',
|
||
},
|
||
RUNTIME_PIN_CONFLICT: {
|
||
anchor: 'capy-install-runtime-conflict',
|
||
summary: 'gstack\'s supported Bun minimum and the project\'s Bun pin cannot both be satisfied, so the installer changed nothing',
|
||
fix: 'raise the project\'s pin to gstack\'s supported minimum, or install gstack on a machine whose Bun the project accepts',
|
||
},
|
||
BROWSER_UNAVAILABLE: {
|
||
anchor: 'browser-ensure-failed',
|
||
summary: 'Chromium could not be installed or launched by gstack-browser-ensure',
|
||
fix: 'read the installer output above (offline, proxy, AppArmor); on Ubuntu 24.04+ try GSTACK_CHROMIUM_NO_SANDBOX=1, then re-run gstack-browser-ensure',
|
||
},
|
||
INSTALL_PREFLIGHT_FAILED: {
|
||
anchor: 'capy-install-preflight-failed',
|
||
summary: 'a tool the installer needs before ./setup (git, curl, node, jq) is missing, or the Bun install recipe failed its checksum',
|
||
fix: 'install the named tool, then re-run bin/gstack-capy-install',
|
||
},
|
||
SETUP_PS1_EMPTY_ARGUMENT: {
|
||
anchor: 'setup-ps1-empty-argument',
|
||
summary: 'an argument given to .\\setup.ps1 is an empty string, which its Git Bash hand-off cannot carry, so nothing ran',
|
||
fix: 'drop the empty argument or give it a value, then run .\\setup.ps1 again',
|
||
},
|
||
// C-stamp (plan C1, C2, C3, C5, C7): ship policy, restamp, tree receipt, ship receipt.
|
||
POLICY_SOURCE_UNAVAILABLE: {
|
||
anchor: 'policy-source-unavailable',
|
||
summary: 'policy source unavailable: origin/<base> is not a resolvable commit, or a pin file committed on it cannot be read, so the reviewed .gstack/ship-policy.json cannot be read',
|
||
fix: 'git fetch origin <base> --depth=1 (the working-tree copy is never used silently)',
|
||
},
|
||
POLICY_INVALID: {
|
||
anchor: 'policy-invalid',
|
||
summary: '.gstack/ship-policy.json has an unknown key, a wrong type or a value outside its enum',
|
||
fix: 'run `gstack-ship-policy validate`, compare with `gstack-ship-policy init --explain`, and fix the file on the base branch',
|
||
},
|
||
POLICY_CONTAINMENT: {
|
||
anchor: 'policy-containment',
|
||
summary: 'a repo-controlled path, glob, command or list in the policy escapes the repository or exceeds its size cap',
|
||
fix: 'use repo-relative paths without `..`, globs under 256 characters, lists under 64 entries and a release_tool under 512 characters',
|
||
},
|
||
POLICY_EXISTS: {
|
||
anchor: 'policy-exists',
|
||
summary: '.gstack/ship-policy.json already exists; nothing written',
|
||
fix: 'edit the existing file, or pass --force to overwrite it',
|
||
},
|
||
REPO_COMMANDS_NOT_ALLOWED: {
|
||
anchor: 'repo-commands-not-allowed',
|
||
summary: 'repo commands not executed: the policy declares commands and this invocation did not opt in',
|
||
fix: 'pass --allow-repo-commands (what /ship does), or run without the release tool',
|
||
},
|
||
QUEUE_STALE: {
|
||
anchor: 'queue-stale',
|
||
summary: 'the base SHA or queue order the allocation assumed has moved',
|
||
fix: 'recompute with the printed command (gstack-restamp --next ... with the current --expect-base) before merging',
|
||
},
|
||
RESTAMP_VERSION_SOURCE: {
|
||
anchor: 'restamp-version-source',
|
||
summary: 'the configured version source is absent, ambiguous or broken at the base revision or on the branch',
|
||
fix: 'create VERSION or pin .gstack/version-path; gstack never invents a version',
|
||
},
|
||
RESTAMP_MERGE_CONFLICT: {
|
||
anchor: 'restamp-merge-conflict',
|
||
summary: 'the gate-ahead merge of the branch and its predecessor conflicts; nothing written',
|
||
fix: 'merge the predecessor into the branch under /ship Step 3’s conflict rules, then run --after again',
|
||
},
|
||
RESTAMP_RELEASE_TOOL_FAILED: {
|
||
anchor: 'restamp-release-tool-failed',
|
||
summary: 'the policy’s release_tool exited non-zero in the staging worktree; nothing written to the branch',
|
||
fix: 'run the release tool by hand in the repo, fix it, and rerun gstack-restamp',
|
||
},
|
||
RESTAMP_OUTPUT_OUTSIDE_ALLOWED: {
|
||
anchor: 'restamp-output-outside-allowed',
|
||
summary: 'the release tool wrote a path outside the enumerated allowed-output set; nothing written to the branch',
|
||
fix: 'list the path in `release_outputs` or `stamp_paths` on the base branch, or stop the tool from writing it',
|
||
},
|
||
RESTAMP_CONFLICT: {
|
||
anchor: 'restamp-conflict',
|
||
summary: 'a file to write or roll back no longer holds the bytes the journal recorded (a later edit); the restamp stopped',
|
||
fix: 'inspect .gstack/tmp/restamp-journal.json, reconcile the file by hand, then rerun gstack-restamp',
|
||
},
|
||
RESTAMP_PREDECESSOR_MOVED: {
|
||
anchor: 'restamp-predecessor-moved',
|
||
summary: 'PREDECESSOR MOVED: the predecessor head the gate assumed is no longer that PR’s head',
|
||
fix: 'gstack-restamp --after <pr> again and regate on the new synthetic tree',
|
||
},
|
||
CHANGELOG_DUPLICATE_HEADING: {
|
||
anchor: 'changelog-duplicate-heading',
|
||
summary: 'two CHANGELOG sections carry the same version heading',
|
||
fix: 'merge the duplicate sections into one entry under the new version',
|
||
},
|
||
CHANGELOG_TOP_MISMATCH: {
|
||
anchor: 'changelog-top-mismatch',
|
||
summary: 'the first CHANGELOG entry is not the version being stamped',
|
||
fix: 'move the PR’s entry to the top (gstack-restamp does this) or fix the heading to match VERSION',
|
||
},
|
||
CHANGELOG_SECTION_MISSING: {
|
||
anchor: 'changelog-section-missing',
|
||
summary: 'the CHANGELOG has no `[Unreleased]` or old-version section for this PR to re-head',
|
||
fix: 'write the PR’s entry under `## [Unreleased]` (stamp-at-merge) and rerun',
|
||
},
|
||
GATE_REUSE_NOT_ELIGIBLE: {
|
||
anchor: 'gate-reuse-not-eligible',
|
||
summary: 'the earlier gate ran under a different identity (tree, runtime pins, lockfile, CI config, gate command or selection)',
|
||
fix: 'rerun the named lanes on the final stamped tree with the printed command',
|
||
},
|
||
EVIDENCE_IDENTITY_UNKNOWN: {
|
||
anchor: 'evidence-identity-unknown',
|
||
summary: 'the evidence bundle lacks the execution identity (committed tree, runtime, lockfile or command hash) a reuse decision needs',
|
||
fix: 'rebuild the bundle on the gate machine with `gstack-evidence bundle` after the lanes ran on a committed head',
|
||
},
|
||
EVIDENCE_BUNDLE_INVALID: {
|
||
anchor: 'evidence-bundle-invalid',
|
||
summary: 'the evidence bundle is not valid JSON or not the schema this gstack reads',
|
||
fix: 'rebuild it with `gstack-evidence bundle`; never hand-edit a bundle',
|
||
},
|
||
PREREGISTRATION_NOT_ANCESTOR: {
|
||
anchor: 'preregistration-not-ancestor',
|
||
summary: 'a preregistration_shas entry is not an ancestor of HEAD',
|
||
fix: 'rebase or merge so the preregistered commit is in the branch history, or remove the entry on the base branch',
|
||
},
|
||
HISTORY_POLICY_VIOLATION: {
|
||
anchor: 'history-policy-violation',
|
||
summary: 'the policy says history: merge-only and the plan squashes, rebases or rewrites the branch',
|
||
fix: 'merge the base branch instead (git merge origin/<base>) and keep every commit',
|
||
},
|
||
RECEIPT_MISSING: {
|
||
anchor: 'receipt-missing',
|
||
summary: 'no ```gstack-ship-receipt``` block was found in the PR body',
|
||
fix: 'write it with `gstack-ship-receipt write ... --pr <n>` (/ship Step 18) before reading it',
|
||
},
|
||
RECEIPT_INVALID: {
|
||
anchor: 'receipt-invalid',
|
||
summary: 'the ship receipt block does not validate against the ship-receipt schema',
|
||
fix: 'regenerate it with `gstack-ship-receipt write`; never hand-edit the block',
|
||
},
|
||
// B-runner (gstack-autoplan, gstack-outside-voice, lib/spend-ledger.ts).
|
||
EXECUTION_UNKNOWN: {
|
||
anchor: 'execution-unknown',
|
||
summary: 'an attempt was dispatched but never reached a terminal record, so the provider may have finished and charged',
|
||
fix: 'submit the result file if the reviewer finished (`gstack-autoplan submit ... --attempt <id>`), or redispatch explicitly with `gstack-autoplan next --redispatch <id>`; nothing is redispatched automatically',
|
||
},
|
||
RUN_LOCKED: {
|
||
anchor: 'run-locked',
|
||
summary: 'another gstack-autoplan process owns this run directory',
|
||
fix: 'wait for it to exit, or if its pid is gone run `gstack-autoplan resume --out <dir>` to take ownership',
|
||
},
|
||
RUN_NOT_INITIALIZED: {
|
||
anchor: 'run-not-initialized',
|
||
summary: 'the run directory has no run.json written by gstack-autoplan',
|
||
fix: 'start with `gstack-autoplan next --plan <file> --out <dir>` (the first call initializes the run)',
|
||
},
|
||
PHASE_NOT_AWAITING: {
|
||
anchor: 'phase-not-awaiting',
|
||
summary: 'the submitted phase or voice is not waiting for a result',
|
||
fix: 'run `gstack-autoplan status --out <dir>` and submit for the attempt `next` printed',
|
||
},
|
||
ATTEMPT_MISMATCH: {
|
||
anchor: 'attempt-mismatch',
|
||
summary: 'the attempt id does not name the open attempt for this phase and voice, or it was already submitted',
|
||
fix: 'pass the attempt id `next` printed for this voice; a result is bound exactly once',
|
||
},
|
||
RESULT_RECEIPT_MISSING: {
|
||
anchor: 'result-receipt-missing',
|
||
summary: 'the result file does not start with the full-read receipt `INPUT: <phase> <snapshot sha256>` for this attempt',
|
||
fix: 'the reviewer must read the prompt file through EOF and begin its result with the INPUT line the prompt names; a result for another snapshot is refused',
|
||
},
|
||
RESULT_FINDINGS_MISSING: {
|
||
anchor: 'result-findings-missing',
|
||
summary: 'the result file has no valid canonical findings block (a ```gstack-findings fence of JSONL rows)',
|
||
fix: 'end the review with one ```gstack-findings fence, one JSON object per line with at least severity and title; `[]` rows are not findings, an empty fence means no findings',
|
||
},
|
||
MODEL_FAMILY_CONFLICT: {
|
||
anchor: 'model-family-conflict',
|
||
summary: 'the outside model is in the same family as the native reviewer, or its family is unknown',
|
||
fix: 'pass `--model <id>` of a different family (anthropic, openai, google, xai, deepseek, qwen, zai, moonshot, meta, mistral); a same-family result is not an outside voice',
|
||
},
|
||
SPEND_CAP_EXCEEDED: {
|
||
anchor: 'spend-cap-exceeded',
|
||
summary: 'spent + reserved + the next estimate would exceed the spend cap',
|
||
fix: 'raise `--spend-cap`, settle or release unsettled attempts, or stop; unknown charges count as their reservation',
|
||
},
|
||
CONSENSUS_MISSING: {
|
||
anchor: 'consensus-missing',
|
||
summary: 'a closed prior phase has no consensus record to include in the Eng dispatch',
|
||
fix: 'resume the run so the phase closes through reconciliation; the Eng prompt is never sent without every prior phase summary',
|
||
},
|
||
OUTSIDE_RUNNER_UNAVAILABLE: {
|
||
anchor: 'outside-runner-unavailable',
|
||
summary: 'the selected outside-voice runner cannot run here (CLI missing, no API key, or no result file for host-subagent)',
|
||
fix: 'install or log in the CLI (`gstack-codex-login` from OPENAI_API_KEY), set an API key for `--runner api`, or pass `--result <file> --model <id>` for `--runner host-subagent`',
|
||
},
|
||
// PR D (gstack-plan-reality check).
|
||
REALITY_ROW_MISSING: {
|
||
anchor: 'reality-row-missing',
|
||
summary: 'a plan review carries no `REALITY:` line for an applicable reality row, or marks a tier 1 row n/a',
|
||
fix: 'work the row (`gstack-plan-reality rows --phase <p>` prints its check) and emit `REALITY: <row> pass|finding <summary> <file:line>`; unattended, the phase is incomplete until it does',
|
||
},
|
||
REALITY_RECEIPT_MISSING: {
|
||
anchor: 'reality-receipt-missing',
|
||
summary: 'a `REALITY:` line names its row but carries no file:line or commit receipt',
|
||
fix: 'cite where the check was made (`path:line`, `path:line-line` or a commit sha); a row without a receipt is a claim, not a row',
|
||
},
|
||
// C-pregate (plan C4, C6, C8): generated-file registry, issue links, the cheap pre-gate.
|
||
REGEN_REGISTRY_INVALID: {
|
||
anchor: 'regen-registry-invalid',
|
||
summary: '.gstack/generated.json is not valid JSON, has an unknown key, a missing field or a duplicate id',
|
||
fix: 'run `gstack-regen validate`, compare with `gstack-regen init --explain`, and fix the file on the base branch',
|
||
},
|
||
REGEN_CONTAINMENT: {
|
||
anchor: 'regen-containment',
|
||
summary: 'a registry glob escapes the repository or a command is not one line under 512 bytes',
|
||
fix: 'use repo-relative globs without `..`, at most 64 per list, and a single-line command',
|
||
},
|
||
REGEN_STALE: {
|
||
anchor: 'regen-stale',
|
||
summary: 'a generated output differs from what its registered command produces (stale, or hand-edited)',
|
||
fix: 'run the printed regen command and commit the outputs; never hand-merge a generated file',
|
||
},
|
||
REGEN_COMMAND_FAILED: {
|
||
anchor: 'regen-command-failed',
|
||
summary: 'a registered regen command exited non-zero in the scratch worktree',
|
||
fix: 'run the command by hand in the repository, read its output, fix the generator or its inputs',
|
||
},
|
||
PREGATE_CONFIG_INVALID: {
|
||
anchor: 'pregate-config-invalid',
|
||
summary: 'the pregate policy (.gstack/pregate.json, or the user-owned copy) has an unknown key, a wrong type, a non-downgradable check in `warn`, or an uncontained glob',
|
||
fix: 'run `gstack-pregate validate` and fix the file on the base branch (secrets and required lanes cannot be downgraded)',
|
||
},
|
||
PREGATE_SECRETS: {
|
||
anchor: 'pregate-secrets',
|
||
summary: 'gstack-redact found a HIGH or MEDIUM finding in the branch’s added lines',
|
||
fix: 'rotate the credential, remove it from the added lines (git history included), then rerun; `secrets` cannot be downgraded',
|
||
},
|
||
PREGATE_STRAYS: {
|
||
anchor: 'pregate-strays',
|
||
summary: 'a file was added at the repository root or outside the usual directories (scratch, tmp, zz-*)',
|
||
fix: 'delete the stray or move it under a tracked directory; declare an intentional root file in .gstack/pregate.json `strays.allow`',
|
||
},
|
||
PREGATE_LITERALS: {
|
||
anchor: 'pregate-literals',
|
||
summary: 'a changed exported constant’s old value still appears in the test tree (nightly- and Heavy-only files included)',
|
||
fix: 'update every listed test to the new value, or keep the old constant; a nightly-only file is still a consumer',
|
||
},
|
||
PREGATE_NO_LANE: {
|
||
anchor: 'pregate-no-lane',
|
||
summary: 'a touched source file maps to no test lane through imports, repo-path literals, the bin/<name> convention or a declaration',
|
||
fix: 'add a test that names the file, or declare its lane (or an explicit empty lane) under `dependencies` in .gstack/pregate.json. Markdown no test depends on is already a docs/no-tests empty lane; other documentation goes in `empty_lanes`',
|
||
},
|
||
PREGATE_LANE_FAILED: {
|
||
anchor: 'pregate-lane-failed',
|
||
summary: 'a local test lane the touched files select failed or ran zero tests under pipefail',
|
||
fix: 'read the lane log, fix the in-branch failure, rerun `gstack-pregate --stage tests`; a `| tail`-hidden exit is still a failure',
|
||
},
|
||
PREGATE_INCOMPLETE: {
|
||
anchor: 'pregate-incomplete',
|
||
summary: 'a check timed out, its tool is unavailable, or the tree changed while it ran; the result is incomplete, never pass',
|
||
fix: 'install the named tool or raise --timeout, keep the tree still during the run, then rerun the check',
|
||
},
|
||
PREGATE_STALLED: {
|
||
anchor: 'pregate-stalled',
|
||
summary: 'a test command printed nothing for the stall timeout, so its process group was killed; the check is incomplete, never pass',
|
||
fix: 'read the lane log for the last file started, fix the hang, or raise `--stall-timeout` (`stall_timeout_s`; 0 disables) for a test that is quiet for longer, then rerun `gstack-pregate --stage tests`',
|
||
},
|
||
PREGATE_RECEIPT_INVALID: {
|
||
anchor: 'pregate-receipt-invalid',
|
||
summary: 'the receipt offered to `gstack-pregate clear` for the remote gate obligation does not show the tested tree passing',
|
||
fix: 'rerun the remote gate on this tree and pass its output with `gstack-pregate clear --remote pregate.json/remote_gate --receipt <file>`, or run `gstack-pregate --stage tests --remote --spend-cap <usd> --allow-repo-commands`',
|
||
},
|
||
PREGATE_STALE: {
|
||
anchor: 'pregate-stale',
|
||
summary: 'pregate.json was recorded against a different tree than the one being published',
|
||
fix: 'rerun `gstack-pregate` after the final generation and stamp; publication needs results that are current',
|
||
},
|
||
PREGATE_REMOTE_UNCLEARED: {
|
||
anchor: 'pregate-remote-uncleared',
|
||
summary: 'a requires-remote lane obligation (a platform lane this machine cannot run) has no matching receipt',
|
||
fix: 'dispatch the named workflow job, then pass its run id with `gstack-pregate clear --remote <workflow/job> --run-url <url>` (or an evidence bundle lane) before publishing',
|
||
},
|
||
ISSUE_UNREADABLE: {
|
||
anchor: 'issue-unreadable',
|
||
summary: 'an issue a closure trailer or --issue names could not be read through gstack-issue-guard, so its link is Refs, never Fixes',
|
||
fix: 'check `gh auth status` and the issue number; rerun gstack-issue-links once the issue reads',
|
||
},
|
||
ISSUE_LOOKUP_FAILED: {
|
||
anchor: 'issue-lookup-failed',
|
||
summary: 'gstack-issue-links could not read the repository, this PR\'s author, the open PRs closing a fixed issue, or the flake issues naming a CI run, so Related or Flake lines may be missing or list the owner\'s own PRs',
|
||
fix: 'check `gh auth status` and the repository (`--repo <owner/repo>`), pass `--author <login>` when gh runs as an app, then rerun gstack-issue-links; report the gap in the handoff if it still fails',
|
||
},
|
||
ISSUE_LINKS_MISSING: {
|
||
anchor: 'issue-links-missing',
|
||
summary: 'the PR body lacks a line gstack-issue-links wrote to issues.json, so the body and the ship receipt would disagree about what the PR closes or relates to',
|
||
fix: 'paste every line gstack-issue-links printed under `## Issues` in the body, then rerun gstack-ship-receipt write; nothing was written',
|
||
},
|
||
// PR E (multi-agent wave): gstack-eval-plan, gstack-lane-check, gstack-evidence verify,
|
||
// gstack-owner-brief, gstack-contributor-mode, gstack-banned-terms.
|
||
PREREG_INCOMPLETE: {
|
||
anchor: 'prereg-incomplete',
|
||
summary: 'the preregistration file lacks a required section or a section is empty',
|
||
fix: 'fill every section `gstack-eval-plan prereg --check` names (bars, arms, decoys, stop rules, held-out exposure) before any priced call',
|
||
},
|
||
EVAL_PRICE_MISSING: {
|
||
anchor: 'eval-price-missing',
|
||
summary: 'an arm names a model with no row in the price table, so its admission cannot be estimated',
|
||
fix: 'add the model to lib/pricing.ts (provider page, USD per million tokens, as_of) or drop the arm; a $0 estimate is never an admission',
|
||
},
|
||
EVAL_DRY_RUN_FAILED: {
|
||
anchor: 'eval-dry-run-failed',
|
||
summary: 'the $0 stub-model dry run found an input or checklist problem (input shape, output budget, retry prompt)',
|
||
fix: 'repair the named input rows or settings and rerun `gstack-eval-plan dry-run`; the pilot refuses to start on a failed dry run',
|
||
},
|
||
EVAL_ARMS_UNRESOLVED: {
|
||
anchor: 'eval-arms-unresolved',
|
||
summary: 'no eval arm could be resolved from the model policy or the repo policy document',
|
||
fix: 'run `gstack-models resolve --role eval-arms`, or pass `--arms <model,model>` / `--policy-doc <file>` naming models in the price table',
|
||
},
|
||
EVAL_BUDGET_EXHAUSTED: {
|
||
anchor: 'eval-budget-exhausted',
|
||
summary: 'the pilot or run stopped because spent + reserved + unknown charges reached the cap',
|
||
fix: 'read the spend table, settle or release open attempts, then raise `--cap` deliberately or stop; never rerun to make room',
|
||
},
|
||
LANE_CONFLICT: {
|
||
anchor: 'lane-conflict',
|
||
summary: 'a planned file is already changed by an in-flight branch or pull request',
|
||
fix: 'assign the file one owner: wait for that PR, stack on its branch, or drop the file from this lane',
|
||
},
|
||
LANE_REF_UNAVAILABLE: {
|
||
anchor: 'lane-ref-unavailable',
|
||
summary: 'a branch or pull request named for the lane check could not be resolved',
|
||
fix: 'fetch the branch (`git fetch origin <branch>`) or check `gh auth status`; an unresolved lane is reported, never assumed clear',
|
||
},
|
||
EVIDENCE_UNVERIFIED: {
|
||
anchor: 'evidence-unverified',
|
||
summary: 'a bundle claim could not be verified on this machine (tree moved, log missing, or the probe was not rerun)',
|
||
fix: 'rerun the lane here with `gstack-evidence verify <bundle> --rerun`, or treat the claim as an imported assertion',
|
||
},
|
||
BANNED_TERM_FOUND: {
|
||
anchor: 'banned-term-found',
|
||
summary: 'the diff adds a banned term outside its allowed locations',
|
||
fix: 'remove the term or move the text to a path `.gstack/banned-terms.json` allows for it',
|
||
},
|
||
BANNED_TERMS_INVALID: {
|
||
anchor: 'banned-terms-invalid',
|
||
summary: '`.gstack/banned-terms.json` is malformed or an allowed path escapes the repository',
|
||
fix: 'keep `terms` a non-empty string list and every `allowed_paths` entry a plain repo-relative glob (no `..`, no absolute path)',
|
||
},
|
||
CONTRIBUTOR_SOURCE_UNAVAILABLE: {
|
||
anchor: 'contributor-source-unavailable',
|
||
summary: 'neither a `maintainers` list in .gstack/ship-policy.json nor the collaborators API could classify the PR author',
|
||
fix: 'add `maintainers` to the ship policy, or run `gh auth login`; the review proceeds with contributor mode off and records the source',
|
||
},
|
||
BRIEF_INPUT_MISSING: {
|
||
anchor: 'brief-input-missing',
|
||
summary: 'the run directory lacks a file the owner brief renders from (gate.json, decisions.jsonl or findings.jsonl)',
|
||
fix: 'finish the run to the gate (`gstack-autoplan next`) so the gate list and decisions exist, then render the brief',
|
||
},
|
||
DRAFT_DIRECTION_UNRESOLVED: {
|
||
anchor: 'draft-direction-unresolved',
|
||
summary: 'a `draft direction stands until the owner decides` line names a decision that is still pending',
|
||
fix: 'answer the gate (`gstack-autoplan answer`) before closing; the close rewrites only decided lines',
|
||
},
|
||
PREGATE_GUARD_FAILED: {
|
||
anchor: 'pregate-guard-failed',
|
||
summary: 'a repo guard from .gstack/pregate.json whose files the branch touched exited non-zero',
|
||
fix: 'run the guard command printed in the table, apply the guard\'s fix line, commit, then rerun `gstack-pregate run --allow-repo-commands`',
|
||
},
|
||
MIGRATION_COLLISION: {
|
||
anchor: 'migration-collision',
|
||
summary: 'a migration number this branch adds is already used on the base branch or by another open PR',
|
||
fix: 'take the next free migration number when this PR is next to merge (rename the file and its id), commit, then rerun `gstack-pregate regate --against <gated-head> --bundle <file>`',
|
||
},
|
||
SEALED_OUTPUT_REFUSED: {
|
||
anchor: 'sealed-output-refused',
|
||
summary: 'a push or PR would publish sealed or eval output (a sealed path, a transcript, a quoted answer, a seed or a local home path) to a public or unknown destination, or the sealed policy is unreadable',
|
||
fix: 'remove it from every published commit, or add one reviewed `rule<TAB>path<TAB>sha<TAB>reason` line to the base branch\'s .gstack/sealed-allow.tsv; a private destination sets sealed.visibility "private" in the base branch\'s .gstack/pregate.json',
|
||
},
|
||
EVAL_GATE_UNPRICED: {
|
||
anchor: 'eval-gate-unpriced',
|
||
summary: 'the paid gate has no call-plan file (no `--plan-file`, no base-policy `price_file`) or the file has no GSTACK_EVAL_CALLS lines, so its cost is unknown',
|
||
fix: 'have the repo commit a call-plan file (docs/eval-calls.md) and set `price_file` in .gstack/pregate.json, or pass `--allow-unpriced "<reason>"` only on the owner\'s say-so',
|
||
},
|
||
EVAL_GATE_OVER_CAP: {
|
||
anchor: 'eval-gate-over-cap',
|
||
summary: 'the paid gate\'s priced total, or one call\'s reservation (input plus maximum output), is above the cap',
|
||
fix: 'cut questions, arms or `max_out_tokens` in the call plan, or raise `--cap-usd` / `--smoke-cap-usd` deliberately with the owner; never split calls to slip under it',
|
||
},
|
||
EVAL_PLAN_STALE: {
|
||
anchor: 'eval-plan-stale',
|
||
summary: 'the call-plan file\'s binding does not match (a different gate command, a head behind HEAD, an input whose sha256 at HEAD differs) or the declared price_file is not in HEAD',
|
||
fix: 'regenerate the call-plan file at HEAD for the exact gate command you are approving, commit it, and rerun `gstack-eval-plan price-gate`',
|
||
},
|
||
PLAN_SECTIONS_INVALID: {
|
||
anchor: 'plan-sections-invalid',
|
||
summary: 'the plan does not have exactly one non-empty `## Implementation plan` section followed by one `## Review record` section',
|
||
fix: 'add the missing heading, or rerun the first `gstack-autoplan next` with --scaffold to review a scaffolded copy (your plan file is never edited); duplicate, reversed or empty sections are fixed by hand',
|
||
},
|
||
PLAN_AMEND_PENDING: {
|
||
anchor: 'plan-amend-pending',
|
||
summary: 'the owner accepted plan changes at the gate that the plan has not absorbed yet',
|
||
fix: 'edit the plan, then `gstack-autoplan revise --out <dir> --plan <file> --incorporates <decision id,...>`; settle a packaging or ordering change with `gstack-autoplan revise --out <dir> --settle <id>`; or drop one with `gstack-autoplan revise --out <dir> --withdraw <decision id>`',
|
||
},
|
||
AMENDMENT_UNKNOWN: {
|
||
anchor: 'amendment-unknown',
|
||
summary: '`revise --incorporates` or `--withdraw` named a decision that is not a pending amendment (never accepted as a plan change, or already incorporated or withdrawn)',
|
||
fix: 'name only the ids the refusal lists after `pending:`; with none pending, drop --incorporates and run `gstack-autoplan revise --out <dir> --plan <file>`',
|
||
},
|
||
AMENDMENT_NOT_SETTLEABLE: {
|
||
anchor: 'amendment-not-settleable',
|
||
summary: '`revise --settle` named an accepted change that needs a plan edit (its item changes scope, cost or direction, or names no packaging/ordering change), or the plan has edits no revise has recorded',
|
||
fix: 'edit the plan, then `gstack-autoplan revise --out <dir> --plan <file> --incorporates <decision id>` (add `--settle <id>` to settle packaging/ordering changes in the same call); settle alone only on the plan the run already reviews',
|
||
},
|
||
GATE_REC_STALE: {
|
||
anchor: 'gate-rec-stale',
|
||
summary: 'a `rec` reply was rendered before `gstack-autoplan recommend` changed the recommendations it takes, or the gate predates `rec` (a gate.json without rec_rev, rendered when `all` left changes pending)',
|
||
fix: 'render the gate again (`gstack-gate render <dir>/gate.json --all`), relay it, and answer with the printed `--rec-hash`',
|
||
},
|
||
CHECKPOINT_INVALID: {
|
||
anchor: 'checkpoint-invalid',
|
||
summary: 'no autoplan checkpoint generation can be restored: a manifest is unreadable, a listed file is missing, escapes the generation (by path or symlink) or does not match its sha256, or the staged run does not validate',
|
||
fix: 'run `gstack-autoplan checkpoints --from <dir>` to see each generation\'s hash status and restore an intact one; nothing was written to --out',
|
||
},
|
||
CHECKPOINT_OVERLAP: {
|
||
anchor: 'checkpoint-overlap',
|
||
summary: 'the checkpoint directory and the run directory (or the restore target) are the same directory or one contains the other, symlinks resolved',
|
||
fix: 'point GSTACK_AUTOPLAN_CHECKPOINT_DIR (or --from / --out) at a directory outside the run; nothing was moved or deleted',
|
||
},
|
||
CHECKPOINT_TARGET_EXISTS: {
|
||
anchor: 'checkpoint-target-exists',
|
||
summary: '`gstack-autoplan resume --from` restores only into an empty or missing --out directory',
|
||
fix: 'pass a new --out directory, or resume the run already there without --from',
|
||
},
|
||
OWNER_REPLY_REQUIRED: {
|
||
anchor: 'owner-reply-required',
|
||
summary: 'an agent answered the gate (`--by agent:<id>`) without the owner\'s verbatim reply',
|
||
fix: 'pass the owner\'s words exactly with `--owner-reply "<text>"`, `--owner-reply -` (stdin) or `--owner-reply-file <path>`',
|
||
},
|
||
GATE_OWNER_REPLY_MISMATCH: {
|
||
anchor: 'gate-owner-reply-mismatch',
|
||
summary: 'the owner\'s verbatim reply parses under the gate grammar but resolves to different choices than the relayed tokens',
|
||
fix: 'relay exactly what the owner chose (or their reply itself, e.g. `--reply rec`); ask the owner when their words and the tokens disagree',
|
||
},
|
||
GSTACK_VERSION_CHANGED: {
|
||
anchor: 'gstack-version-changed',
|
||
summary: 'the run directory was written by a different gstack version',
|
||
fix: 'nothing to do for an older run (journaled forward migrations ran); a run written by a newer gstack needs that gstack: upgrade with bin/gstack-upgrade',
|
||
},
|
||
ARTIFACT_GATE_UNSETTLED: {
|
||
anchor: 'artifact-gate-unsettled',
|
||
summary: 'the run says complete while an approval item of its last gate revision or an accepted plan amendment is still pending',
|
||
fix: 'answer the gate until every approval settles and revise (or withdraw) every accepted change with `gstack-autoplan`; never hand-edit status',
|
||
},
|
||
// Field wave lane A (items 1-4): gstack-upgrade, the Capy skill bootstrapper, install admission.
|
||
UPGRADE_REFUSED: {
|
||
anchor: 'upgrade-refused',
|
||
summary: 'bin/gstack-upgrade changed nothing: the checkout is dirty, diverged, pinned (detached or off the remote default branch), not a gstack checkout, or the incoming release holds',
|
||
fix: 'resolve the named cause (commit or move the listed changes, check out the default branch), then re-run bin/gstack-upgrade; it never stashes or resets',
|
||
},
|
||
UPGRADE_BUSY: {
|
||
anchor: 'upgrade-busy',
|
||
summary: 'bin/gstack-upgrade changed nothing: another live session holds a workflow lease on this installation (bin/gstack-lease live), so moving the checkout would change gstack under it',
|
||
fix: 'wait for those sessions to finish (bin/gstack-lease list names each pid and age), then re-run bin/gstack-upgrade; GSTACK_UPGRADE_FORCE=1 overrides when you know they are idle',
|
||
},
|
||
UPGRADE_FETCH_FAILED: {
|
||
anchor: 'upgrade-fetch-failed',
|
||
summary: 'bin/gstack-upgrade could not fetch the remote default branch, so it cannot tell whether the checkout is current',
|
||
fix: 'check network access to the checkout\'s origin (git -C <checkout> remote -v), then re-run bin/gstack-upgrade',
|
||
},
|
||
REVISION_BELOW_MINIMUM: {
|
||
anchor: 'revision-below-minimum',
|
||
summary: 'the installed gstack revision is below the supported minimum declared in capy/support.env on the remote default branch',
|
||
fix: 'run the Capy skill installer without --check (it fast-forwards a clean, unpinned checkout), or bin/gstack-upgrade; a pinned, dirty or diverged checkout is named in the row',
|
||
},
|
||
CAPY_WRAPPER_STALE: {
|
||
anchor: 'capy-wrapper-stale',
|
||
summary: 'the Capy skill copy that ran (or, without provenance, every Drive copy) is older than the checkout\'s GSTACK_CAPY_MIN_WRAPPER',
|
||
fix: 'this session: run <checkout>/capy/skill/gstack/scripts/install.sh, which certifies; owner: copy <checkout>/capy/skill/gstack/ over the Drive skill folder (it recurs every session until the copy changes)',
|
||
},
|
||
BUN_RESOLUTION_DRIFT: {
|
||
anchor: 'bun-resolution-drift',
|
||
summary: 'the Bun the install verdict recorded for this checkout and project is gone, reports another version, or no longer satisfies the pins (or the Bun running is not it)',
|
||
fix: 'run the fix the row prints: the installer, which records the current resolution or re-downloads a verified Bun into the store',
|
||
},
|
||
BUN_INSTALL_VERSION_INVALID: {
|
||
anchor: 'bun-install-version-invalid',
|
||
summary: 'GSTACK_BUN_INSTALL_VERSION names a Bun without a verified archive, or one below gstack\'s supported minimum',
|
||
fix: 'unset GSTACK_BUN_INSTALL_VERSION, or set it to a version listed in GSTACK_BUN_VERIFIED (bin/gstack-bun-version.sh)',
|
||
},
|
||
INSTALL_UNVERIFIED: {
|
||
anchor: 'install-unverified',
|
||
summary: 'a Capy session (GSTACK_CAPY=1) has no passing install verdict for this checkout, HEAD and workflow, so the workflow refused to start',
|
||
fix: 'run the Capy skill installer with --for <workflow> on this machine and launch with the GSTACK_LAUNCH line it prints',
|
||
},
|
||
// Fix wave 2026-10-15, PR 1a (items 7 and 11).
|
||
BROWSE_TAB_UNRECOVERABLE: {
|
||
anchor: 'browse-tab-unrecoverable',
|
||
summary: 'every tab was closed outside browse and a new one could not be opened, because the browser or its context is gone',
|
||
fix: 'run `browse restart` (`$B restart` in a gstack skill); `browse status` and `browse stop` keep working',
|
||
},
|
||
BUN_VERSION_UNREADABLE: {
|
||
anchor: 'bun-version-unreadable',
|
||
summary: 'bun --version did not print a version gstack can compare with the incoming release\'s Bun floor, so the update was held and nothing was changed',
|
||
fix: 'reinstall Bun from https://bun.sh (bun upgrade may not run on a broken install), check that bun --version prints a version such as 1.4.2, then update again',
|
||
},
|
||
// #3197: the one Windows bash resolver (lib/script-invocation.ts) found no usable Git Bash.
|
||
BASH_UNAVAILABLE: {
|
||
anchor: 'bash-unavailable',
|
||
summary: 'no Git Bash found to run gstack\'s bash scripts on Windows',
|
||
fix: 'install Git for Windows (winget install --id Git.Git -e), or set GSTACK_GIT_BASH to its bash.exe for good: in PowerShell, [Environment]::SetEnvironmentVariable(\'GSTACK_GIT_BASH\', \'C:\\Program Files\\Git\\bin\\bash.exe\', \'User\') and restart Claude Code, or add it to the "env" block of ~/.claude/settings.json',
|
||
},
|
||
// Fix wave 2026-10-15, PR 3 (item 23, #1796).
|
||
IOS_LAUNCH_ENV_INVALID: {
|
||
anchor: 'ios-launch-env-invalid',
|
||
summary: 'GSTACK_IOS_LAUNCH_ENV is set but is not a JSON object of string to string, or sets a GSTACK_ variable the debug bridge reserves, so the app was not launched',
|
||
fix: 'set it to a JSON object such as GSTACK_IOS_LAUNCH_ENV=\'{"DEBUG_BRIDGE":"1"}\' (string values, no GSTACK_ keys), or unset it, then restart gstack-ios-qa-daemon',
|
||
},
|
||
// Fix wave 2026-10-15, PR 4 (item 17, #3182).
|
||
OUTSIDE_VOICE_UNAVAILABLE: {
|
||
anchor: 'outside-voice-unavailable',
|
||
summary: 'a plan review ran without its second opinion: the outside provider did not run or failed, and the bounded native Plan reviewer was not offered or did not finish within five minutes',
|
||
fix: 'repair the provider the line names (install it, or log in with `codex login`); for the native fallback use Claude Code 2.1.277 or later with background tasks enabled (`CLAUDE_CODE_DISABLE_BACKGROUND_TASKS` unset), then re-run the review',
|
||
},
|
||
// Field list 2, W6: the public copy of an autoplan run.
|
||
ARTIFACT_MACHINE_PATH: {
|
||
anchor: 'artifact-machine-path',
|
||
summary: 'a public copy of an autoplan run still contains a machine path the run recorded (its run directory, home, plan directory, checkpoint directory or worktree root)',
|
||
fix: 'export with `gstack-autoplan export --out <run> --public <dir>`, which rewrites recorded roots in prose; a root inside a code span or fence in the plan is never rewritten, so edit the plan, revise, and export again',
|
||
},
|
||
ARTIFACT_PUBLIC_TARGET_EXISTS: {
|
||
anchor: 'artifact-public-target-exists',
|
||
summary: '`gstack-autoplan export --public <dir>` writes only into an empty directory or over an earlier public copy of the same run',
|
||
fix: 'pass an empty or new --public directory, or the directory that already holds this run\'s public copy',
|
||
},
|
||
// Field list 2 (2026-10-16), W8: preregistered diagnostics run before the freeze commit.
|
||
PREREG_DIAGNOSTIC_UNTESTED: {
|
||
anchor: 'prereg-diagnostic-untested',
|
||
summary: 'the declared summarizer, run on the declared synthetic fixture, did not report every preregistered diagnostic at its expected count',
|
||
fix: 'fix the summarizer or the declared definition (expected count, fixture) until every PREREG_DIAGNOSTIC line says ok, then commit the freeze; never freeze a diagnostic the summarizer has not counted',
|
||
},
|
||
// Field list 2 (2026-10-16), W9: .gstack/eval-models.json.
|
||
EVAL_MODELS_INVALID: {
|
||
anchor: 'eval-models-invalid',
|
||
summary: 'the eval model rules (.gstack/eval-models.json) are unreadable or invalid, so no arm can be checked',
|
||
fix: 'fix what the line names (docs/eval-models.md: schema_version 1, a non-empty allow, optional deny, scopes and families newest first), or fetch the base branch; no arm passes until the rules parse',
|
||
},
|
||
EVAL_MODEL_DENIED: {
|
||
anchor: 'eval-model-denied',
|
||
summary: 'an arm names a model the eval model rules deny, or one no allow entry covers for its scope',
|
||
fix: 'pick a model the rules allow for that scope (the EVAL_MODEL line names the rule), or change .gstack/eval-models.json in a reviewed PR',
|
||
},
|
||
EVAL_MODEL_OLD_GENERATION: {
|
||
anchor: 'eval-model-old-generation',
|
||
summary: 'an arm names an older generation of a model family the eval model rules order newest first',
|
||
fix: 'use the newest id of the family the EVAL_MODEL line names, or reorder families in .gstack/eval-models.json in a reviewed PR',
|
||
},
|
||
EVAL_MODEL_GENERATION_UNRESOLVED: {
|
||
anchor: 'eval-model-generation-unresolved',
|
||
summary: 'the eval model rules declare families (newest generation only) and an arm names a model in none of them, so its generation cannot be checked',
|
||
fix: 'add the model to its family in .gstack/eval-models.json (newest first) in a reviewed PR, or pick a model a family lists',
|
||
},
|
||
// #3226: gstack-error-capture (lib/dx-error-capture.ts) prints these; exit codes and recovery live there.
|
||
DX_CAPTURE_USAGE: {
|
||
anchor: 'dx-capture-usage',
|
||
summary: 'gstack-error-capture arguments are malformed: an unknown flag, a flag missing its value, no `--`, or no command after it',
|
||
fix: 'gstack-error-capture [--deadline <s>] [--max-bytes <n>] [--pass-env NAME,...] [--copy-config <path>] [--cwd <dir>] [--approved] [--launch-check] -- <cmd> [args]',
|
||
},
|
||
DX_CAPTURE_BAD_DEADLINE: {
|
||
anchor: 'dx-capture-bad-deadline',
|
||
summary: '--deadline is not a positive number of seconds (at most 3600, up to 3 decimals)',
|
||
fix: '--deadline 20',
|
||
},
|
||
DX_CAPTURE_BAD_MAX_BYTES: {
|
||
anchor: 'dx-capture-bad-max-bytes',
|
||
summary: '--max-bytes is not an integer from 1 to 1048576',
|
||
fix: '--max-bytes 65536',
|
||
},
|
||
DX_CAPTURE_BAD_PASS_ENV: {
|
||
anchor: 'dx-capture-bad-pass-env',
|
||
summary: '--pass-env names an invalid or unset variable, or one the containment owns (PATH, HOME, XDG_CONFIG_HOME, TERM, USERPROFILE)',
|
||
fix: '--pass-env NAME with NAME set in the calling environment',
|
||
},
|
||
DX_CAPTURE_BAD_CWD: {
|
||
anchor: 'dx-capture-bad-cwd',
|
||
summary: '--cwd is not an existing directory',
|
||
fix: '--cwd <existing directory> --approved',
|
||
},
|
||
DX_CAPTURE_APPROVAL_REQUIRED: {
|
||
anchor: 'dx-capture-approval-required',
|
||
summary: '--pass-env, --copy-config or --cwd was given without --approved; they hand the target credentials or real files',
|
||
fix: 'ask the user to approve the named variables, files or directory, then add --approved',
|
||
},
|
||
DX_CAPTURE_CONFIG_REFUSED: {
|
||
anchor: 'dx-capture-config-refused',
|
||
summary: '--copy-config names a missing file, a symlink, a non-regular file, a path outside HOME, a duplicate, or a file over 1 MiB',
|
||
fix: '--copy-config <regular file under $HOME, no symlinks>',
|
||
},
|
||
DX_CAPTURE_NOT_FOUND: {
|
||
anchor: 'dx-capture-not-found',
|
||
summary: 'the command does not resolve to an executable file; the record carries launch "not_found" and nothing ran',
|
||
fix: 'install the command or pass its absolute path after --',
|
||
},
|
||
DX_CAPTURE_TEMP_DIR: {
|
||
anchor: 'dx-capture-temp-dir',
|
||
summary: 'the private 0700 containment directory under the gstack state root could not be created',
|
||
fix: 'make $GSTACK_STATE_ROOT/error-capture a writable directory you own (not a symlink), then rerun',
|
||
},
|
||
DX_CAPTURE_CONTAINMENT_UNAVAILABLE: {
|
||
anchor: 'dx-capture-containment-unavailable',
|
||
summary: 'process-group or Windows job containment is unavailable on this platform; nothing ran',
|
||
fix: 'run the capture on Linux, macOS or Windows with job objects available',
|
||
},
|
||
DX_CAPTURE_SUPERVISOR_FAILED: {
|
||
anchor: 'dx-capture-supervisor-failed',
|
||
summary: 'the deadline supervisor failed before reporting a result',
|
||
fix: 'rerun the same command once; if it repeats, run bin/gstack-qa-deadline --help to check the supervisor',
|
||
},
|
||
DX_CAPTURE_INTERRUPTED: {
|
||
anchor: 'dx-capture-interrupted',
|
||
summary: 'the helper received SIGINT, SIGTERM or SIGHUP; the target group was killed and no record was printed',
|
||
fix: 'rerun the same command without interrupting it',
|
||
},
|
||
DX_CAPTURE_REDACTION_FAILED: {
|
||
anchor: 'dx-capture-redaction-failed',
|
||
summary: 'the finished record still matched a secret check, so nothing was printed',
|
||
fix: 'do not rerun with more --pass-env; report the command name to the gstack maintainers',
|
||
},
|
||
DX_CAPTURE_INTERNAL: {
|
||
anchor: 'dx-capture-internal',
|
||
summary: 'unexpected helper failure; the line names the error class and its first stack frame',
|
||
fix: 'rerun once; if it repeats, report the printed frame to the gstack maintainers',
|
||
},
|
||
...RELEASE_RESULT_CODES,
|
||
...CAPY_RESULT_CODES,
|
||
} as const satisfies Record<string, ResultCode>;
|
||
|
||
export type ResultCodeName = keyof typeof RESULT_CODES;
|
||
|
||
/** Alias kept for the doctor/installer side. */
|
||
export type ResultCodeId = ResultCodeName;
|
||
|
||
export const TROUBLESHOOTING_DOC = 'https://github.com/garrytan/gstack/blob/main/docs/troubleshooting.md';
|
||
|
||
/** `(CODE; <doc>#anchor)` — the suffix the doctor and installer rows carry. */
|
||
export function resultCodeSuffix(code: ResultCodeName): string {
|
||
return `(${code}; ${TROUBLESHOOTING_DOC}#${RESULT_CODES[code].anchor})`;
|
||
}
|
||
|
||
/** The installer form: `<context>: <summary>[ — <detail>]; fix: <fix> (<CODE>; <doc>#anchor)`. */
|
||
export function resultLineWithDocs(context: string, code: ResultCodeName, detail?: string): string {
|
||
const row: ResultCode = RESULT_CODES[code];
|
||
return `${context}: ${row.summary}${detail ? ` — ${detail}` : ''}; fix: ${row.fix} ${resultCodeSuffix(code)}`;
|
||
}
|
||
|
||
/** One error line: `<context>: <summary>[ (<detail>)]; fix: <fix> (<CODE>)`. */
|
||
export function resultLine(context: string, code: ResultCodeName, detail?: string): string {
|
||
const row: ResultCode = RESULT_CODES[code];
|
||
const what = detail ? `${row.summary} (${detail})` : row.summary;
|
||
return `${context}: ${what}; fix: ${row.fix} (${code})`;
|
||
}
|