overwatch

{
  "name": "overwatch",
  "version": "0.2.37",
  "description": "v0.2.31: v0.2.29 の finder 同時起動制限の散文を revert した。同時実行数の上限は parallelguard が PreToolUse で deny して強制する。あわせて origin/main を統合し、`skills/continuous-audit/SKILL.md` の既定 target list から taintguard (2026-08-24 にユーザー裁定で repo から撤去) を外した版を取り込んだうえで parallelguard を含める。したがって正典 GATE set は 7 (blastguard propguard specguard stuckguard mutategate overwatch parallelguard) で、`scripts/continuous-audit.sh` の `DEFAULT_TARGETS` および `scripts/rollout-plugins.sh` の `GATE_CRATES` と同期する (`check-gate-crates-sync.py` が機械照合)。skill prose のみ、コード変更なし。 v0.2.29: continuous-audit の finder 同時起動を最大 3 体に制限し、Step 2 の verifier と合わせて 3 を超えないことを明記。対象 crate は間引かない。 v0.2.28: SessionStart/Stop の `status` が 4 source (backlog / hypothesis / condukt / compass) すべてを bare 名で spawn していたため、hook プロセスに plugin の bin dir が PATH に無い環境では 4 本同時に `(unknown: No such file or directory (os error 2))` へ落ちていた。実測 2026-08-21、測定点 cd2576bd: claude プロセスの /proc/<pid>/environ に plugins/cache/yukineko は 0 件 — plugin bin dir の PATH 追加は Bash tool の shell 内だけで、hook はそれを継承しない。bare 名の spawn は ~/.cargo/bin に残っていた 2026-07-23 版の stale コピーが login PATH 上にあったために偶然動いていただけで、それを (正しく) 削除した 2026-08-20 の bb046648 以降 banner は全滅していた。condukt と compass は ~/.cargo/bin に一度も存在しなかったので、0.2.26 の三値化以前は `(none)` として無言で fail-open していた (hook 経路から一度も観測できていなかった)。修正は新設の `harness_core::plugin_bin::resolve` で plugin cache を第一候補・PATH を fallback として解決する — 順序は意図的に autoflow の既存 resolver の逆で、rollout が版を保証する唯一の配布経路であり、PATH 先行こそ 91fa24df の stale shadow を勝たせた原因だったため。F→P オラクル: `env PATH=/usr/local/bin:/usr/bin:/bin overwatch status` は修正前が 4 unknown (出荷済み SessionStart banner と逐語一致)、修正後は backlog pending 355 ほか全 source を報告する。v0.2.27 (merge reconciliation, no new code): two branches independently shipped DIFFERENT content as 0.2.26 -- the launcher exit-0 fail-open fix and the `overwatch status` tri-state fix (aggregate.rs/render.rs) -- so the label 0.2.26 ambiguously named two trees. This release is the union of both, renumbered so the version identifies one tree again. No behaviour beyond the two merged changes. v0.2.26: `overwatch status` (the SessionStart+Stop hook) rendered `(none)` for a source it could not read, identical to a source it read and found empty. Measured against the shipped binary: a truncated `leases.json` holding one LIVE lease from another session produced byte-identical output, exit 0, to a store that had never been written — `store::load_leases` already separated absent (`Ok(empty)`) from corrupt/unreadable (`Err`) via `boundary::read_to_string`'s `Determination`, but `aggregate::build` bound it with `if let Ok(..)` and threw the distinction away; the same collapse applied to the four subprocess sources (`shell_soft`'s `Option<String>` folded not-installed / non-zero-exit / non-UTF-8 into one `None`) and to the JSON/TSV parsers (`Err(_) => Default::default()`, `unwrap_or(0)`). `(none)` in the Sessions pane is the claim \"no other session is live\" — the fact CLAUDE.md §8 says never to assume, and the liveness input condukt's main-tree guard reads before permitting a commit in main's shared working tree (`condukt/src/maintree.rs` documents this exact flattening as \"a real residual hole, not a safe degradation\"). `ProgressView` now carries `undetermined: Vec<UndeterminedSource>`; unreadable sources render `(unknown: <reason>)` plus a loud stderr WARNING, and `status --json` gains a machine-readable `undetermined` key (omitted on the clean path, so the existing contract is unchanged). Parsers return `Result`; three tests that asserted garbage input yields `pending: 0` / all-zero buckets — writing the fail-open down as the contract — now assert `Err`. v0.2.0 (major bump, not content): 0.1.52 added pub fields to externally-constructible structs (`AuditRound.unverified`, `RoundMetric.unverified`, `AuditMetrics.cumulative_unverified`, `ReviewFinding.verdict`) without a breaking version bump, so `cargo semver-checks` correctly failed CI on main (17 consecutive runs) with `constructible_struct_adds_field`; this release only bumps 0.1→0.2 per the crate's own pre-1.0 convention (breaking change bumps the minor field) to match the version to the API shape already shipped — no code change. v0.1.48: `store::mark_branch_merged` (branch-keyed sibling of `mark_changeset_merged` — the merge path knows only the branch, not the `task_key`) plus `store::clear_runtime_overlap_holds` give condukt the on-land cleanup that takes a merged branch's `ActualChangeset` out of the mid-flight overlap-detection set (fixing spurious ~30-min false-positive merge HOLDs where a cleanly-landed peer stayed `merged=false` within the lease TTL) and clears any stale `RuntimeOverlap` hold recorded against the reused branch name; `prune_stale_changesets` is now wired opportunistically on land to keep `active_changesets.json` bounded. All fail-soft under `LeaseLock`, with a regression test proving a landed branch is excluded from detection and its entry is pruned. v0.1.44: `lease::begin()`'s load->is_held_by_other check->save read-modify-write was unprotected against a TOCTOU race (two sessions racing begin() for the same key could both pass the check before either saved, both believing they'd claimed the lease) -- condukt::lock/backlog::lock had already fixed this exact pattern via hardlink+create_new(O_EXCL) exclusive locking, but overwatch::lease hadn't (hypothesis 9c733d74). New `crates/overwatch/src/lock.rs` (`LeaseLock`) ports that design -- hard-link atomic publish, a TMP_SEQ intra-process collision guard, stale-lock reap via pid liveness, bounded wait, fail-soft degrade-to-unlocked on timeout -- and `begin()` now holds it across the whole load->check->save cycle. New `crates/overwatch/tests/lease_concurrency.rs` spawns two real processes racing `begin()` for the same key across 8 trials and asserts exactly one wins; an env-gated `OVERWATCH_TEST_BEGIN_DELAY_MS` widens the race window past normal process-spawn overhead so the test deterministically forces the interleave (verified by temporarily reverting the lock: the test then reliably catches the double-claim). Also fixed a related pre-existing test-suite flake: `aggregate.rs` and `store.rs` each sandboxed the process-global `$HOME` env var behind their OWN separate `Mutex`, so tests in the two modules could still race each other's `HOME` mutation under parallel `cargo test`; unified to one crate-wide `store::HOME_ENV_LOCK`. v0.1.43: `review-metrics` now reports `stale_undisposed_with_fix_commit` -- a read-only recount (same commit-range/store logic as `reconcile-fixed`, but never writes) of findings whose fix commit has already landed but are still undisposed, printed as a WARNING line in the human-readable report too. Closes the last piece of the 2026-07-17 stale-review-queue gap: `reconcile-fixed` only clears the backlog when someone remembers to run it, so this makes the gap visible on every `review-metrics` call even if reconcile-fixed hasn't run that round. v0.1.42: new `reconcile-fixed` command closes the \"fix commit landed, nobody ran record-disposition\" gap that let review-queue go stale (2026-07-17 incident: 18 already-fixed findings sat \"open\" for weeks because nobody remembered to dispose them). Scans a range of git commit messages (`--since-ref`/`--range`/`--last-n`, default last 50) for `CA-<crate>-<NNN>` finding-id references and auto-records a CONFIRMED disposition (`auto-reconcile(commit <hash>)`) for any referenced finding present on the review-findings store but not yet dispositioned; idempotent (already-disposed ids are skipped, a finding referenced by multiple commits is disposed once). Fail-soft end-to-end: a missing git binary, a non-repo cwd, or a non-zero `git log` all degrade to \"0 processed\" rather than erroring, so it is always safe to wire into automation. Wired into `scripts/continuous-audit.sh` (via the existing fail-soft `run_ow` wrapper) so every Continuous-Audit round auto-reconciles already-fixed findings before bridging the remainder to the backlog. v0.1.39: `test_freshness::run_ignored_test`'s `cargo test` subprocess call used `Command::output()`, which waits unbounded — a hung/deadlocking `#[ignore]`d regression test could wedge `overwatch review-queue --to-backlog`'s per-finding loop forever. Switched to `spawn()` + `wait_timeout()` (60s, since the call includes a build step) mirroring `ctxrot::hooks::guard::run_with_timeout`; timeout kills and reaps the child, folding into the existing `ExecutionError` fail-soft path (`bridge.rs` unchanged). v0.1.35: fixed CA-overwatch-004 — the RECORD path (`overwatch audit-round record --confirmed N --regression-tests-added M`) constructed an `AuditRound` via `AuditRound::new` with NO clamp on `regression_tests_added`, unlike the separate CLOSE path (`set_round_tests`, which already clamps to `confirmed`); `record --confirmed 1 --regression-tests-added 999` previously persisted an unclamped 999 and propagated a closure_rate far above the documented [0,1] range. `AuditRound::new` now clamps `regression_tests_added` to `confirmed` for every construction path, and the `record` CLI's printed JSON reports the stored (clamped) value rather than the raw arg. v0.1.34: continuous-audit SKILL.md's \"対象 crate (既定)\" section understated the target list as 5 crates (blastguard/propguard/specguard/stuckguard/mutategate), omitting overwatch, even though scripts/continuous-audit.sh's actual DEFAULT_TARGETS has included overwatch since it joined GATE_CRATES (558f864) -- fixed the doc to match the real 6-crate default (docs/fix-gate-crates-drift.md). v0.1.32: fixed set_round_tests() so an over-large `--tests` count passed to `audit-round close` clamps to the round's own `confirmed` count before being stored, preventing `closure_rate` from exceeding the documented [0,1] range. v0.1.31: Continuous-Audit finding triage (docs/DESIGN-continuous-audit-triage.md) — `ReviewFinding` gains an optional `rationale` field (verifier's CONFIRMED-判定根拠, `#[serde(default)]` so pre-existing `review_findings.jsonl` rows keep reading) and `record-finding --rationale` wires it through; new `test_freshness` module reverse-looks-up a `#[ignore = \"<finding-id>: ...\"]` regression test by finding-id and re-runs it (`cargo test -p <crate> -- --ignored <fn>`), fail-soft (`ExecutionError`/`NotFound` on any cargo/crate trouble); `review-queue --to-backlog` now thickens each backlog task's notes with elapsed days since confirmation, the rationale (if any), and the regression-test freshness verdict (FAIL/PASS/no test), all advisory-only (core dedup/idempotency unchanged). v0.1.27: SessionStart+Stop `status` hook now shares a short-lived (10s TTL) on-disk cache (`aggregate::build_cached`) so the two hooks firing close together (end of one turn, start of the next) collapse into one full aggregate scan (~5 subprocess spawns + lease-store scan) instead of two; a cold/expired/corrupt cache always falls through to a fresh build (fail-soft, no observability lost — just bounded staleness). Also fixes a latent JSON round-trip bug: `ProgressView`'s `sessions`/`runs` (`Vec`) and `BacklogSummary`'s `pending_by_priority` (`BTreeMap`) were missing `#[serde(default)]` alongside their `skip_serializing_if`, so deserializing an omitted-when-empty field previously errored instead of reconstructing the empty collection. v0.1.25: strengthened `disposition_metrics` integration tests to patch ONLY the timestamp fields (`ts`/`resolved_ts`) of the CLI-written JSONL ledgers, keeping the CLI-serialized `finding_id`/`verdict`/`reviewer` intact, so `false_positive_rate`/`agreement_rate`/`by_verdict` assertions now exercise `record-disposition`'s real field serialization end-to-end (test-only; no behavior change). v0.1.24: new `compact-findings` command performs non-lossy compaction/rotation of the append-only `review_findings.jsonl` hot store: finding records whose finding_id has been resolved (bridged to the backlog, or dispositioned by a human) are MOVED (never deleted) into a cold `review_findings_archive.jsonl`, so `review-queue`'s human-surface read stays bounded to OPEN items rather than lifetime append volume; `review-metrics`'s median-latency join now reads hot plus archive so the metric never regresses after compaction. Atomic temp+rename rewrites (archive written before hot for crash-safety); idempotent (a run with no newly-resolved findings is a byte-identical no-op). v0.1.23: new `auto-approved` companion command (read-only, foreign-file bridge to condukt's `gate-decisions.jsonl`, fail-soft by path) surfaces the DENOMINATOR — the population of decisions condukt self-answered without a human — as a count plus a deterministic seeded sample (`--since`/`--sample`/`--seed`/`--json`), so a human can judge whether spot-check sampling coverage of mass auto-approval is adequate. v0.1.22: review-queue gains a fourth source — condukt's durable escalation queue (`escalate.rs`) is bridged in as `EntryKind::Escalation` (High severity), read fail-soft by path (no condukt crate dependency, so the harness-core<-overwatch<-blastguard<-condukt direction stays acyclic) so every human-awaiting item (blocked/GATED tasks, not just gate-check findings) shows in the one unified pane. v0.1.21: review-effectiveness measurement — new `record-disposition` (confirmed|dismissed|false-positive per finding_id) + `review-metrics` commands close the loop on the human review queue: a fail-soft `dispositions.jsonl` ledger joined against `review_findings.jsonl` yields false-positive rate, human-agreement rate, and median resolution latency (JSON or human-readable). v0.1.20: review-queue noise collapse — AI findings dedup by a content fingerprint (source+file+summary), not just exact finding_id, so independent reports of the same issue under different ids collapse to one row; repeated same-plugin rollbacks likewise collapse to one row. Both carry an additive `occurrences` count (and a `(Nx)` summary marker) so recurring noise doesn't flood the human review surface. v0.1.19: new `store::record_finding` library entry lets condukt's gate-check Escalate branch auto-populate the review-queue ai-finding stream (previously producer-less), so needs-human/gated verdicts surface on the risk-ranked human queue automatically. v0.1.18: review-queue now risk-ranks by normalized severity (High-first) then recency, so a stale high-severity item is never buried/evicted below fresh low-severity noise; --limit yields the top-K riskiest and reports the deferred remainder. Project-global cross-session execution ledger + dedup guard + PDO progress view + fleet-level correlated gate-violation detection. Manages claim registry with heartbeat-based liveness, skip-on-duplicate contract for distributed session coordination, and normalized violation-signature recurrence/escalation across tasks and sessions.",
  "author": {
    "name": "yukineko"
  },
  "keywords": [
    "pdo",
    "cross-session",
    "progress",
    "ledger",
    "dedup",
    "hotl",
    "rust"
  ]
}