[saucam]

What this adds

The first piece of loops (docs/loop-engineering-design.md §7, milestone A): every check a pipeline gate executes now leaves durable evidence: what ran, on which tree, its result, and its full output. Until now a gate's command output was thrown away and its verdict was just an exit code.

• Results that don't lie. A check is pass, fail, inconclusive, error or cancelled. A test probe that exits 0 after running no tests is inconclusive, not a pass. A missing command is error. A check that runs past its time limit is stopped, along with everything it started, and recorded as a timed-out fail.
• Diagnostics reach the next attempt. A failing gate's reason now carries the end of the failing output (stderr first), so the agent's revise turn sees why it failed.
• Safe to show a model. Checks run with the same stripped environment as an agent's own commands, so the daemon's credentials are never in reach. Stored excerpts are redacted with log-aware rules that keep test names, file paths and exit codes readable. Artifacts are readable only by the daemon's user and are pruned after 30 days or once they pass 2 GiB.
• Owned processes. Each check runs in its own process group. Aborting a pipeline or stopping the daemon stops its checks. A check stopped that way is dropped rather than recorded as a failure, so the gate re-runs when the pipeline resumes.
• Readable. codeoid evidence <id> prints a record. codeoid pipeline show lists each phase's evidence. A halted phase in the web cockpit has "Show check output".

Behaviour change: an auto-derived test/verify probe on a repo where the test command runs zero tests now fails as inconclusive. Pack command gates are still judged on exit status alone.

Review

Two independent audit rounds, each covering security and correctness.

• Round 1 fixed: environment leakage into output shown to models, unredacted output, world-readable artifacts, no retention, zero-test detection that only read the excerpt, and checks orphaned on shutdown or abort.
• Round 2 fixed: cancelled checks being recorded as gate failures, redaction across chunk boundaries and redaction that destroyed test diagnostics, a crash on artifact write errors, and fragile orphan matching. It also kept common toolchain variables for checks.

Full suite: 3822 pass / 0 fail. Web typecheck and tests pass.

For agents: implementation

• src/daemon/evidence/:
  • types.ts: EvidenceRecord, CheckSpec.
  • runner.ts: runCheck. The check runs with detached (its own group) and checkEnv() = buildSubprocessEnv plus a toolchain allowlist and CODEOID_CHECK_ENV_ALLOW. Output goes through a line-scanned ZeroTestScan, head/tail excerpts are UTF-8 safe and cut at line boundaries, and artifact files are 0600 with an error listener.
  • parsers.ts, redact.ts: log-specific rules.
  • store.ts: the evidence table, with artifact_dir relative to the root.
  • service.ts: EvidenceService with per-owner abort flags, abortAll, sweep (age, size, orphans; skips live dirs), and ephemeralCheck via mkdtemp.
  • wire.ts: evidenceToWire. Paths are not exposed.
• Pipeline:
  • gate-probes.ts and the pack.ts command gate run through ctx.runCheck, return evidenceIds plus diagnosticTail, and return cancelled when the check was stopped.
  • engine.ts: GateCancelled drops the step in run(). Evidence ids go on the active phase, capped at 50.
  • interface.ts: GateCtx.runCheck, GateVerdict.evidenceIds/cancelled, PipelinePhase.evidence.
• session-manager.ts:
  • Builds EvidenceService. The sweep runs 60 s after boot and then daily, and its timers are cleared in drain.
  • abortAll runs in drain; abortOwner runs on pipeline.abort.
  • #evidenceGet checks pipeline:read and the pipeline before looking anything up, and returns not_found for anything the caller can't see.
  • The pipeline wire includes evidence for every status.
• Protocol: packages/protocol/src/evidence.ts (evidence.get / evidence.record), plus its schema.
• CLI: codeoid evidence, src/terminal/evidence-format.ts, and a pipeline-format line.
• Web: EvidenceView/EvidenceLink and state/evidence.ts (cached per connection, bounded).

🤖 Generated with Claude Code