A/B: a generic agent and ac on the same task
In the G3 gate (docs/gates.md) a generic coding agent, opencode 1.18.34 with NVIDIA Nemotron 3 Super on Nebius Token Factory, got the restructure with a fixed prompt and no human input, single-shot and persistent (an automated reply asked it to continue whenever it stopped). Its branches were certified in session S4 by our checker, the version that also certified our one-step R1 branch (certificate format 1); the full ladder's certificates come from the S6 version (format 2, which added K7). In S9 the same agent ran again on NVIDIA Nemotron 3 Ultra, the model ac plans with, with the same prompt, scripts and pinned commit (the second table); only the caps differ ($2 single-shot and $12 persistent, where the Super arms shared $5), and opencode ran Ultra at the model's default effort, ac's planner at medium_effort. Its persistent branch was certified by today's checker. The gate's numbers come from its own scripts and name their source. The verdict and check rows, and each "certificate" line under a value, are read from the certificate files when this page is built; where the two count the same thing differently, the notes under the table say why.
immich server/ @ 02063972e8
Target: immich @ 02063972e8. Base: tsc 0 errors; vitest 105 test files, 2,337 cases (docs/gates.md, G2); the OpenAPI spec is 947,932 bytes (the certificates' K8).
A green test count is not proof. On immich, the branch g3/opencode-super (opencode + Nemotron 3 Super, single-shot) still passes all 2,337 of the base's test cases, while 66 of its 171 test files fail to load and tsc reports 1,680 errors (its certificate: K6, K8).
| ac, the full ladder (ours) | ac, one R1-style step (ours) | opencode + Nemotron 3 Super, single-shot | opencode + Nemotron 3 Super, persistent | Source | |
|---|---|---|---|---|---|
| Who | ac architecture-cleaner: Nemotron 3 Ultra plans, the executor moves, the certifier checks every commit | ac architecture-cleaner's executor, one move of 292 of the 302 controllers, services, repositories and DTOs (the 3 index.ts barrels and the barrel's spec, two process.cwd() specs, the three import.meta.dirname users and services/shared/user-methods.ts stay) | opencode 1.18.34, NVIDIA Nemotron 3 Super on Nebius Token Factory, one `opencode run` with the fixed prompt | the same agent; whenever it stopped, an automated reply reported typecheck and test results and asked it to continue | |
| Branch | ac/s6-ladder (S6)run report | ac/s3-r1 (S3) | g3/opencode-super (G3 (S2)) | g3/opencode-super-persistent (G3 (S2)) | |
| Outcome | Completed unattended: 63 commits, each certified on its first attempt; every rung and the whole PR PASS with the oracles | One certified commit | Stopped after 169 s and asked the user to run its sed commands | Stopped by the $5 budget cap during turn 5, after 33 min | docs/sessions/s6.md; docs/sessions/s3.md; docs/gates.md (G3 table) |
| What the diff is | 367 files moved into 38 modules, 20 platform folders and shared/; 2,474 specifier edits in 515 files; 2 boundary-rule files added and proven inert; every other byte identical certificate K1: 367 moved, 180 edited in place, 2 added (2 inert tool configs), 0 deleted | 292 files moved into 100 modules; 1,445 specifier edits in 386 files; every other byte identical certificate K1: 292 moved, 152 edited in place, 0 added, 0 deleted | 211 files copied into src/features/, originals kept; every rewritten import corrupted certificate K1: 0 moved, 0 edited in place, 211 added (31 of them copies of files that still exist), 0 deleted | 297 moved, 562 TypeScript files copied (a src.backup/ tree), 68 edited, 12 Python scripts left behind certificate K1: 365 moved, 0 edited in place, 614 added (291 of them copies of files that still exist), 0 deleted | docs/storyboard.md (lead table); docs/gates.md (G3 table); runs/immich-ladder/certificate.txt (K1, K2) certificate line: each arm's certificate, K1 |
| tsc errors (base: 0) | 0 certificate K8: tsc exit 0 | 0 certificate K8: tsc exit 0 | 1,680 certificate K8: tsc exited 1 on head (1,680 diagnostics), 0 on base | 768 (nest build: 4,675) certificate K8: tsc exited 1 on head (768 diagnostics), 0 on base | docs/storyboard.md (lead table); docs/gates.md (G3 table); runs/immich-ladder/certificate.txt (K8) certificate line: each arm's certificate, K8 tsc |
| Unit suite (base: 105 files, 2,337 cases) | 105/105 files, 2,337/2,337 cases certificate K8: unit 105/105 files and 2,337/2,337 cases equal to base (head: 105/105 files load, 2,337 passed, 0 failed, 0 skipped) | 105/105 files, 2,337/2,337 cases certificate K8: unit 105/105 files and 2,337/2,337 cases equal to base (head: 105/105 files load, 2,337 passed, 0 failed, 0 skipped) | 2,337/2,337 cases pass, but 66 of 171 spec files never load certificate K8: unit 105/171 files and 2,337/2,337 cases equal to base (head: 105/171 files load, 2,337 passed, 0 failed, 0 skipped) | 5/105 files, 52 cases certificate K8: unit 5/105 files and 52/2,337 cases equal to base (head: 5/105 files load, 52 passed, 0 failed, 0 skipped) | docs/storyboard.md (lead table); runs/immich-ladder/certificate.txt (K6, K8) certificate line: each arm's certificate, K8 unit |
| OpenAPI spec (base: 947,932 bytes) | byte-identical certificate K8: openapi byte-identical to the base's open-api/immich-openapi-specs.json (947,932 bytes) | byte-identical certificate K8: openapi byte-identical to the base's open-api/immich-openapi-specs.json (947,932 bytes) | byte-identical: the copies are dead code certificate K8: openapi byte-identical to the base's open-api/immich-openapi-specs.json (947,932 bytes), but 1 step failed on head | not produced: sync-open-api crashes certificate K8: openapi produced nothing | docs/storyboard.md (lead table); docs/gates.md (G3 table); runs/immich-ladder/certificate.txt (K8) certificate line: each arm's certificate, K8 openapi |
| Non-specifier lines changed in moved or copied files | 0 (K2) certificate K2: 2474 specifier spans changed in 515 files; every other byte identical | 0 (K2) certificate K2: 1445 specifier spans changed in 386 files; every other byte identical | 1,104 (2.4%) certificate K2: no file paired with a base file changed, so there was nothing to compare; K1 counts the 211 added files | 0, plus 926 in modified files certificate K2: no file paired with a base file changed, so there was nothing to compare; K1 counts the 614 added files | G3 arms: docs/gates.md (G3 table, the gate's line diff); ac arms: the certificates' K2 certificate line: each arm's certificate, K2 |
| New dangling specifiers | 0 (K3a, K3b, K3c: every site resolves to its base target) certificate K3b: vitest 4.1.11: 4837 sites in 672 files resolve to map(base) | 0 (K3a, K3b, K3c) certificate K3b: vitest 4.1.11: 4837 sites in 672 files resolve to map(base) | 0: its 552 rewritten imports are syntax errors, not specifiers, so the analyzer counts none; the rest still import the originals certificate K3b: vitest 4.1.11: 4837 sites in 672 files resolve to map(base) | 2,923 certificate K3b: vitest 4.1.11: 4548 violations (2802 dangling, 131 retargeted, 1615 dangling in added files) | G3 arms: docs/gates.md (G3 table, the gate's TypeScript analyzer); ac arms: the certificates' K3a–K3c certificate line: each arm's certificate, K3b |
| Behavior changes no unit test catches | None found: K4 finds no moved file whose location reaches behavior; 12 logged stack traces now name the new path (K4 findings) certificate K4: 367 moved files expose no location; no computed path reaches a change; no old path in code, config or CI (13 findings in docs, comments or ungated coverage settings) | None found (K4; 11 logged stack traces now name the new path) certificate K4: 292 moved files expose no location; no computed path reaches a change; no old path in code, config or CI (9 findings in docs, comments or ungated coverage settings) | 0 claims survived review: the copies are dead code certificate K4: 0 path-exposing uses in moved files (and 3 in added files), 0 computed paths into changed directories, 0 old paths in code/config (0 in coverage settings) | 2 survived review: database.repository.ts and config.repository.ts moved but kept their import.meta.dirname paths (migrations, helmet.json) certificate K4: 12 path-exposing uses in moved files (and 15 in added files), 2 computed paths into changed directories, 52 old paths in code/config (0 in coverage settings) | G3 arms: docs/gates.md (Addendum: G3 review); ac arms: the certificates' K4 certificate line: each arm's certificate, K4 |
| LLM cost | $0.1998 for the plan when recorded (Nemotron 3 Ultra) and $0.0010 for the findings narration (Nemotron 3.5 Lightning); a replay costs $0 | $0 | $0.30 (0.98M input tokens, 51 calls) | $4.63 (15.3M input tokens, 200 calls) | runs/immich-ladder/run.json (cost); docs/sessions/s6.md; docs/storyboard.md (lead table); docs/gates.md (G3 table) |
| Time | 1 h 55 m wall time on a quiet machine, certificates included | executor 14 s; certificate: static checks 124 s, oracles 111 s | 169 s | 33 min | docs/sessions/s6.md; docs/storyboard.md (lead table) |
ac certify verdict | PASS (with oracles) | PASS (with oracles) | FAIL (with oracles) failing: K1, K3a, K4, K6, K8 | FAIL (with oracles) failing: K1, K3a, K3b, K3c, K4, K6, K8 | the certificate files; one row per check below |
| K0 Envelope | PASS | PASS | PASS | PASS | |
| K1 Move-set integrity | PASS | PASS | FAIL | FAIL | |
| K2 Byte-span confinement | PASS | PASS | PASS nothing to compare: K1 counts the 211 added files | PASS nothing to compare: K1 counts the 614 added files | |
| K3a Resolution identity under TypeScript | PASS | PASS | FAIL | FAIL | |
| K3b Resolution identity under the test runner | PASS | PASS | PASS | FAIL | |
| K3c Resolution identity under the runtime | PASS | PASS | PASS | FAIL | |
| K4 Location scan | PASS | PASS | FAIL | FAIL | |
| K6 Test inventory | PASS | PASS | FAIL | FAIL | |
| K7 Emit layout | PASS | not checked: K7 came after this certificate (S6) | not checked: K7 came after this certificate (S6) | not checked: K7 came after this certificate (S6) | |
| K8 Oracles on the commit | PASS | PASS | FAIL | FAIL |
Where the gate's numbers and the certificates' differ
- What the diff is: The gate counted moved and copied files with git's rename and copy detection at 50% similarity (spike/g3/measure-diff.mjs). The certifier pairs a head file with a base file only when their bytes are equal outside specifier spans, so a moved, copied or edited file with any other change is an added file to it, and only exact copies count as copies. The persistent branch's certified moves are its base files paired with their untouched copies in src.backup/ (the certificate's pathMap); the files it moved into src/features/ or edited are among the added.
- Non-specifier lines changed in moved or copied files: The gate diffed each renamed or copied file against its original line by line. K2 compares only the files the certifier pairs with a base file, and those differ at most in specifier spans by construction, so the edits inside copies and rewrites are not K2's to see: those files are K1's added files, and K1 fails.
- New dangling specifiers: The gate counted import sites its TypeScript analyzer could not resolve at the head, leaving out specifiers already unresolved at base. K3b resolves every site the way the test runner does (vitest) and counts the sites of kept or moved files that no longer reach their base target (dangling, retargeted) apart from unresolved sites in added files; K3a and K3c do the same under TypeScript and the runtime.
- Behavior changes no unit test catches: K4 fails closed: it lists every use of a moved file's location, computed path into a changed directory and old path in code or config that it can't prove safe, so its counts are hazards, not confirmed breaks. On the persistent branch it flags both files whose breaks the G3 review confirmed by hand (database.repository.ts and config.repository.ts, as added files: their certified pairs are the src.backup/ copies).
The single-shot branch's restructure is a dead copy tree: nothing imports its 211 copies, so the tests still run against the original files. (docs/gates.md (G3 table; Addendum: G3 review))
The persistent run is the reference baseline, because single-shot runs quit within 3 minutes. (docs/gates.md (Plan corrections, item 3))
The certificates
ac, the full ladder: PASS sha256:9a5b2404631c…
ac certify 02063972e8..c4be040b57 (package root server/), profile immich
trees: 424df72c34..4e457bb4e8
pathMap: 367 moves, 180 edited in place, 2917 unchanged, 2 added, 0 deleted
PASS K0 Envelope: inside the envelope: 678 TypeScript vs 3 JavaScript sources under server; no automock, nested package scope, symlink, same-stem pair or unreadable runner config around 367 moved files (0.2 s)
PASS K1 Move-set integrity: 367 moves, 180 files edited in place, 2 inert tool configs added, nothing else added or deleted (8.3 s)
finding (tool-config-added) server/.dependency-cruiser-known-violations.json: added at the package root and proven inert: in no tsconfig program, loaded by no reference, packed by no published package, named or globbed by no other file, and the tool runs nowhere; CI path filters match it, so it triggers their jobs: 'server/**' in .github/workflows/docker.yml (line 45), 'server/**' in .github/workflows/test.yml (line 46)
finding (tool-config-added) server/.dependency-cruiser.json: added at the package root and proven inert: in no tsconfig program, loaded by no reference, packed by no published package, named or globbed by no other file, and the tool runs nowhere; CI path filters match it, so it triggers their jobs: 'server/**' in .github/workflows/docker.yml (line 45), 'server/**' in .github/workflows/test.yml (line 46)
PASS K2 Byte-span confinement: 2474 specifier spans changed in 515 files; every other byte identical (3.4 s)
PASS K3a Resolution identity under TypeScript: 6647 sites in 1100 files resolve to map(base) under every program (458 files in several); 2474 rewritten specifiers keep their form (1.8 s)
PASS K3b Resolution identity under the test runner: vitest 4.1.11: 4837 sites in 672 files resolve to map(base) (5.1 s)
PASS K3c Resolution identity under the runtime: 6192 runtime sites resolve to map(base) under nest-cli/emit (3442 rewritten by the build) (6.7 s)
PASS K4 Location scan: 367 moved files expose no location; no computed path reaches a change; no old path in code, config or CI (13 findings in docs, comments or ungated coverage settings) (5.7 s)
finding (stack-text) server/src/repositories/metadata.repository.ts: moved to server/src/platform/metadata/metadata.repository.ts; 1 stack-trace reads passed along as text (line 133); their frames now name the new path
finding (stack-text) server/src/repositories/websocket.repository.ts: moved to server/src/platform/websocket/websocket.repository.ts; 1 stack-trace reads passed along as text (line 95); their frames now name the new path
finding (stack-text) server/src/services/asset-media.service.ts: moved to server/src/modules/asset/asset-media.service.ts; 1 stack-trace reads passed along as text (line 224); their frames now name the new path
… 23 more findings
PASS K6 Test inventory: vitest 4.1.11: 105 test files, 2337 tests, per-file load status and case names equal (0.0 s)
PASS K7 Emit layout: 7 emitting programs keep their outDir and rootDir (1 by TypeScript's default) (0.5 s)
finding (default-root-dir) e2e/tsconfig.json: emits into e2e/dist without a rootDir; TypeScript 6.0+ and before 6.0's default stays e2e and e2e
PASS K8 Oracles on the commit: tsc exit 0; unit 105/105 files and 2,337/2,337 cases equal to base (head: 105/105 files load, 2,337 passed, 0 failed, 0 skipped); openapi byte-identical to the base's open-api/immich-openapi-specs.json (947,932 bytes) (114.9 s)
verdict: PASS (static checks and oracles)
digest: sha256:9a5b2404631c2ac668462ad93fcbcd116637244e2b4f76e987bcc4e23e8be2b5ac, one R1-style step: PASS sha256:2e9e00c96572…
ac certify 02063972e8..ff429b0d24 (package root server/)
pathMap: 292 moves, 152 edited in place, 3020 unchanged, 0 added, 0 deleted
PASS K0 Envelope: inside the envelope: 678 TypeScript vs 3 JavaScript sources under server; no automock, nested package scope, symlink, same-stem pair or unreadable runner config around 292 moved files (8.5 s)
PASS K1 Move-set integrity: 292 moves, 152 files edited in place, nothing added or deleted (1.5 s)
PASS K2 Byte-span confinement: 1445 specifier spans changed in 386 files; every other byte identical (2.9 s)
PASS K3a Resolution identity under TypeScript: 6647 sites in 1100 files resolve to map(base) under every program (458 files in several); 1445 rewritten specifiers keep their form (1.5 s)
PASS K3b Resolution identity under the test runner: vitest 4.1.11: 4837 sites in 672 files resolve to map(base) (5.8 s)
PASS K3c Resolution identity under the runtime: 6192 runtime sites resolve to map(base) under nest-cli/emit (3442 rewritten by the build) (7.2 s)
PASS K4 Location scan: 292 moved files expose no location; no computed path reaches a change; no old path in code, config or CI (9 findings in docs, comments or ungated coverage settings) (5.5 s)
finding (stack-text) server/src/repositories/metadata.repository.ts: moved to server/src/modules/metadata/metadata.repository.ts; 1 stack-trace reads passed along as text (line 133); their frames now name the new path
finding (stack-text) server/src/repositories/websocket.repository.ts: moved to server/src/modules/websocket/websocket.repository.ts; 1 stack-trace reads passed along as text (line 95); their frames now name the new path
finding (stack-text) server/src/services/asset-media.service.ts: moved to server/src/modules/asset-media/asset-media.service.ts; 1 stack-trace reads passed along as text (line 224); their frames now name the new path
… 18 more findings
PASS K6 Test inventory: vitest 4.1.11: 105 test files, 2337 tests, per-file load status and case names equal (91.2 s)
PASS K8 Oracles on the commit: tsc exit 0; unit 105/105 files and 2,337/2,337 cases equal to base (head: 105/105 files load, 2,337 passed, 0 failed, 0 skipped); openapi byte-identical to the base's open-api/immich-openapi-specs.json (947,932 bytes) (110.7 s)
verdict: PASS (static checks and oracles)
digest: sha256:2e9e00c96572e7347cf00084cacd7e371c3004c261092888575bb32d99138820
Ac-Certificate: pass (full) K0=pass K1=pass K2=pass K3=pass K4=pass K6=pass K8=pass
Ac-Certificate-Base: 02063972e82b1bfd17b6fc2e3b3ff39936229ea5
Ac-Certificate-Digest: sha256:2e9e00c96572e7347cf00084cacd7e371c3004c261092888575bb32d99138820opencode + Nemotron 3 Super, single-shot: FAIL sha256:8cbe6c92987f…
ac certify 02063972e8..03e76f3faa (package root server/)
pathMap: 0 moves, 0 edited in place, 3464 unchanged, 211 added, 0 deleted
PASS K0 Envelope: inside the envelope: 889 TypeScript vs 3 JavaScript sources under server; no automock, nested package scope, symlink, same-stem pair or unreadable runner config around 0 moved files (9.1 s)
FAIL K1 Move-set integrity: 211 violations (211 added, 0 deleted, 31 copies) (1.2 s)
server/src/features/activity/activity.controller.spec.ts: added: no file in base has its content (modulo specifiers)
server/src/features/activity/activity.controller.ts: added: no file in base has its content (modulo specifiers)
server/src/features/activity/activity.dto.ts: added: no file in base has its content (modulo specifiers)
server/src/features/activity/activity.repository.ts: added: a copy of server/src/repositories/activity.repository.ts, which still exists
server/src/features/activity/activity.service.spec.ts: added: no file in base has its content (modulo specifiers)
server/src/features/activity/activity.service.ts: added: no file in base has its content (modulo specifiers)
server/src/features/album/album.controller.spec.ts: added: no file in base has its content (modulo specifiers)
server/src/features/album/album.controller.ts: added: no file in base has its content (modulo specifiers)
… 203 more
PASS K2 Byte-span confinement: 0 specifier spans changed in 0 files; every other byte identical (0.0 s)
FAIL K3a Resolution identity under TypeScript: 211 violations (211 added source files) (1.3 s)
server/src/features/activity/activity.controller.spec.ts: added: its 3 reference sites have no counterpart in base
server/src/features/activity/activity.controller.ts: added: its 7 reference sites have no counterpart in base
server/src/features/activity/activity.dto.ts: added: its 4 reference sites have no counterpart in base
server/src/features/activity/activity.repository.ts: added: its 10 reference sites have no counterpart in base
server/src/features/activity/activity.service.spec.ts: added: its 6 reference sites have no counterpart in base
server/src/features/activity/activity.service.ts: added: its 3 reference sites have no counterpart in base
server/src/features/album/album.controller.spec.ts: added: its 3 reference sites have no counterpart in base
server/src/features/album/album.controller.ts: added: its 6 reference sites have no counterpart in base
… 203 more
PASS K3b Resolution identity under the test runner: vitest 4.1.11: 4837 sites in 672 files resolve to map(base) (6.6 s)
PASS K3c Resolution identity under the runtime: 6192 runtime sites resolve to map(base) under nest-cli/emit (3442 rewritten by the build) (7.6 s)
finding (added-file-unresolved) server/src/features/plugin/plugin.dto.ts: nest-cli/emit: import '@immich/plugin-sdk' doesn't resolve (ERR_MODULE_NOT_FOUND) in a file with no base counterpart
finding (added-file-unresolved) server/src/features/workflow/workflow.controller.spec.ts: nest-cli/emit: import '@immich/plugin-sdk' doesn't resolve (ERR_MODULE_NOT_FOUND) in a file with no base counterpart
finding (added-file-unresolved) server/src/features/workflow/workflow.service.ts: nest-cli/emit: import '@immich/plugin-sdk' doesn't resolve (ERR_MODULE_NOT_FOUND) in a file with no base counterpart
FAIL K4 Location scan: 0 path-exposing uses in moved files (and 3 in added files), 0 computed paths into changed directories, 0 old paths in code/config (0 in coverage settings) (0.9 s)
server/src/features/library/library.service.spec.ts: added with no base counterpart; line 888: process.cwd()
server/src/features/library/library.service.spec.ts: added with no base counterpart; line 1284: process.cwd()
server/src/features/library/library.service.spec.ts: added with no base counterpart; line 1298: process.cwd()
finding (stack-text) server/src/features/asset-media/asset-media.service.ts: added with no base counterpart; 1 stack-trace reads passed along as text (line 224); their frames now name the new path
finding (stack-text) server/src/features/auth/auth.service.ts: added with no base counterpart; 1 stack-trace reads passed along as text (line 403); their frames now name the new path
finding (stack-text) server/src/features/duplicate/duplicate.service.ts: added with no base counterpart; 1 stack-trace reads passed along as text (line 104); their frames now name the new path
… 2 more findings
FAIL K6 Test inventory: vitest 4.1.11: 66 violations (66 of 171 test files fail to load (base: 0), 66 new test files) (94.6 s)
server/src/features/activity/activity.controller.spec.ts: new in the vitest test list (added in head; fails to load: x Unexpected token `[`. Expected a string literal ,-[/tmp/ac-s4-certify/g3-immich-opencode-super.full/worktree-head/server/src/features/activity/activity.controller.spec.ts:2:1] 1 | import request fro)
server/src/features/activity/activity.service.spec.ts: new in the vitest test list (added in head; fails to load: x Unexpected token `[`. Expected a string literal ,-[/tmp/ac-s4-certify/g3-immich-opencode-super.full/worktree-head/server/src/features/activity/activity.service.spec.ts:2:1] 1 | import { BadRequestEx)
server/src/features/album/album.controller.spec.ts: new in the vitest test list (added in head; fails to load: x Unexpected token `[`. Expected a string literal ,-[/tmp/ac-s4-certify/g3-immich-opencode-super.full/worktree-head/server/src/features/album/album.controller.spec.ts:2:1] 1 | import request from 'sup)
server/src/features/album/album.service.spec.ts: new in the vitest test list (added in head; fails to load: x Unexpected token `[`. Expected a string literal ,-[/tmp/ac-s4-certify/g3-immich-opencode-super.full/worktree-head/server/src/features/album/album.service.spec.ts:2:1] 1 | import { BadRequestExceptio)
server/src/features/app/app.controller.spec.ts: new in the vitest test list (added in head; fails to load: x Unexpected token `[`. Expected a string literal ,-[/tmp/ac-s4-certify/g3-immich-opencode-super.full/worktree-head/server/src/features/app/app.controller.spec.ts:2:1] 1 | import request from 'superte)
server/src/features/asset/asset.controller.spec.ts: new in the vitest test list (added in head; fails to load: x Unexpected token `[`. Expected a string literal ,-[/tmp/ac-s4-certify/g3-immich-opencode-super.full/worktree-head/server/src/features/asset/asset.controller.spec.ts:2:1] 1 | import request from 'sup)
server/src/features/asset/asset.service.spec.ts: new in the vitest test list (added in head; fails to load: x Unexpected token `[`. Expected a string literal ,-[/tmp/ac-s4-certify/g3-immich-opencode-super.full/worktree-head/server/src/features/asset/asset.service.spec.ts:3:1] 1 | import { BadRequestExceptio)
server/src/features/asset-media/asset-media.controller.spec.ts: new in the vitest test list (added in head; fails to load: x Unexpected token `[`. Expected a string literal ,-[/tmp/ac-s4-certify/g3-immich-opencode-super.full/worktree-head/server/src/features/asset-media/asset-media.controller.spec.ts:2:1] 1 | import reque)
… 58 more
FAIL K8 Oracles on the commit: tsc exited 1 on head (1,680 diagnostics), 0 on base; unit 105/171 files and 2,337/2,337 cases equal to base (head: 105/171 files load, 2,337 passed, 0 failed, 0 skipped); openapi byte-identical to the base's open-api/immich-openapi-specs.json (947,932 bytes), but 1 step failed on head (118.9 s)
tsc: `node_modules/.bin/tsc --noEmit --incremental false --pretty false` exited 1 on head (1,680 diagnostics), exit 0 on base (log /tmp/ac-s4-certify/g3-immich-opencode-super.full/oracles/head/tsc/step-1.log)
server/src/features/activity/activity.controller.spec.ts: tsc: TS1005 ',' expected.
server/src/features/activity/activity.controller.spec.ts: tsc: TS1002 Unterminated string literal.
server/src/features/activity/activity.controller.spec.ts: tsc: TS1005 ',' expected.
server/src/features/activity/activity.controller.spec.ts: tsc: TS1005 ',' expected.
server/src/features/activity/activity.controller.spec.ts: tsc: TS1002 Unterminated string literal.
server/src/features/activity/activity.controller.spec.ts: tsc: TS1005 ',' expected.
server/src/features/activity/activity.controller.ts: tsc: TS1005 ',' expected.
… 72 more
verdict: FAIL (static checks and oracles)
digest: sha256:8cbe6c92987fbc9132d2af720c36a32a3e5f5598021c85169e7d39de6b6d2beb
Ac-Certificate: fail (full) K0=pass K1=fail K2=pass K3=fail K4=fail K6=fail K8=fail
Ac-Certificate-Base: 02063972e82b1bfd17b6fc2e3b3ff39936229ea5
Ac-Certificate-Digest: sha256:8cbe6c92987fbc9132d2af720c36a32a3e5f5598021c85169e7d39de6b6d2bebopencode + Nemotron 3 Super, persistent: FAIL sha256:90d2d44bbd64…
ac certify 02063972e8..1da2348b7c (package root server/)
pathMap: 365 moves, 0 edited in place, 3099 unchanged, 614 added, 0 deleted
PASS K0 Envelope: inside the envelope: 1242 TypeScript vs 3 JavaScript sources under server; no automock, nested package scope, symlink, same-stem pair or unreadable runner config around 365 moved files (23.1 s)
FAIL K1 Move-set integrity: 979 violations (614 added, 0 deleted, 291 copies) (1.2 s)
server/fix_app_files.py: added: no file in base has its content (modulo specifiers)
server/fix_features_only.py: added: no file in base has its content (modulo specifiers)
server/fix_indexes.py: added: no file in base has its content (modulo specifiers)
server/fix_quotes.py: added: no file in base has its content (modulo specifiers)
server/fix_quotes2.py: added: no file in base has its content (modulo specifiers)
server/fix_restructure.py: added: no file in base has its content (modulo specifiers)
server/rebuild_indexes.py: added: no file in base has its content (modulo specifiers)
server/regenerate_indexes.py: added: no file in base has its content (modulo specifiers)
… 971 more
finding (ambiguous-match) 30 groups of identical files were paired by where their directories' other files went, then by name and path similarity
PASS K2 Byte-span confinement: 0 specifier spans changed in 0 files; every other byte identical (4.2 s)
FAIL K3a Resolution identity under TypeScript: 3097 violations (2168 resolution mismatches, 365 program or format changes, 564 added source files) (2.6 s)
server/src/app.common.ts: line 9: import 'src/maintenance/maintenance-worker.service.js': expected file server/src.backup/maintenance/maintenance-worker.service.ts (typescript), got file server/src/maintenance/maintenance-worker.service.ts (typescript) under server/tsconfig.build.json, server/tsconfig.json
server/src/app.common.ts: line 10: import 'src/middleware/websocket.adapter.js': expected file server/src.backup/middleware/websocket.adapter.ts (typescript), got file server/src/middleware/websocket.adapter.ts (typescript) under server/tsconfig.build.json, server/tsconfig.json
server/src/app.common.ts: line 11: import 'src/repositories/config.repository.js': expected file server/src.backup/repositories/config.repository.ts (typescript), got unresolved under server/tsconfig.build.json, server/tsconfig.json
server/src/app.common.ts: line 12: import 'src/repositories/logging.repository.js': expected file server/src.backup/repositories/logging.repository.ts (typescript), got unresolved under server/tsconfig.build.json, server/tsconfig.json
server/src/app.common.ts: line 13: import 'src/repositories/telemetry.repository.js': expected file server/src.backup/repositories/telemetry.repository.ts (typescript), got unresolved under server/tsconfig.build.json, server/tsconfig.json
server/src/app.common.ts: line 14: import 'src/services/api.service.js': expected file server/src.backup/services/api.service.ts (typescript), got unresolved under server/tsconfig.build.json, server/tsconfig.json
server/src/app.common.ts: line 15: import 'src/utils/misc.js': expected file server/src.backup/utils/misc.ts (typescript), got file server/src/utils/misc.ts (typescript) under server/tsconfig.build.json, server/tsconfig.json
server/src/app.module.ts: line 11: import 'src/controllers/index.js': expected file server/src.backup/controllers/index.ts (typescript), got file server/src/controllers/index.ts (typescript) under server/tsconfig.build.json, server/tsconfig.json
… 3089 more
FAIL K3b Resolution identity under the test runner: vitest 4.1.11: 4548 violations (2802 dangling, 131 retargeted, 1615 dangling in added files) (7.5 s)
server/src/app.common.ts: site 8 'src/maintenance/maintenance-worker.service.js' (import): base server/src.backup/maintenance/maintenance-worker.service.ts, head server/src/maintenance/maintenance-worker.service.ts
server/src/app.common.ts: site 9 'src/middleware/websocket.adapter.js' (import): base server/src.backup/middleware/websocket.adapter.ts, head server/src/middleware/websocket.adapter.ts
server/src/app.common.ts: site 10 'src/repositories/config.repository.js' (import): base server/src.backup/repositories/config.repository.ts, head unresolved
server/src/app.common.ts: site 11 'src/repositories/logging.repository.js' (import): base server/src.backup/repositories/logging.repository.ts, head unresolved
server/src/app.common.ts: site 12 'src/repositories/telemetry.repository.js' (import): base server/src.backup/repositories/telemetry.repository.ts, head unresolved
server/src/app.common.ts: site 13 'src/services/api.service.js' (import): base server/src.backup/services/api.service.ts, head unresolved
server/src/app.common.ts: site 14 'src/utils/misc.js' (import): base server/src.backup/utils/misc.ts, head server/src/utils/misc.ts
server/src/app.module.ts: site 10 'src/controllers/index.js' (import): base server/src.backup/controllers/index.ts, head server/src/controllers/index.ts
… 4540 more
FAIL K3c Resolution identity under the runtime: 2287 violations under nest-cli/emit (10.0 s)
server/src/app.common.ts: nest-cli/emit: import 'src/maintenance/maintenance-worker.service.js' (emitted as './maintenance/maintenance-worker.service.js') resolves to server/src/maintenance/maintenance-worker.service.ts, expected server/src.backup/maintenance/maintenance-worker.service.ts; base server/src/app.common.ts 'src/maintenance/maintenance-worker.service.js'
server/src/app.common.ts: nest-cli/emit: import 'src/middleware/websocket.adapter.js' (emitted as './middleware/websocket.adapter.js') resolves to server/src/middleware/websocket.adapter.ts, expected server/src.backup/middleware/websocket.adapter.ts; base server/src/app.common.ts 'src/middleware/websocket.adapter.js'
server/src/app.common.ts: nest-cli/emit: import 'src/repositories/config.repository.js' resolves to unresolved (ERR_MODULE_NOT_FOUND), expected server/src.backup/repositories/config.repository.ts; base server/src/app.common.ts 'src/repositories/config.repository.js'
server/src/app.common.ts: nest-cli/emit: import 'src/repositories/logging.repository.js' resolves to unresolved (ERR_MODULE_NOT_FOUND), expected server/src.backup/repositories/logging.repository.ts; base server/src/app.common.ts 'src/repositories/logging.repository.js'
server/src/app.common.ts: nest-cli/emit: import 'src/repositories/telemetry.repository.js' resolves to unresolved (ERR_MODULE_NOT_FOUND), expected server/src.backup/repositories/telemetry.repository.ts; base server/src/app.common.ts 'src/repositories/telemetry.repository.js'
server/src/app.common.ts: nest-cli/emit: import 'src/services/api.service.js' resolves to unresolved (ERR_MODULE_NOT_FOUND), expected server/src.backup/services/api.service.ts; base server/src/app.common.ts 'src/services/api.service.js'
server/src/app.common.ts: nest-cli/emit: import 'src/utils/misc.js' (emitted as './utils/misc.js') resolves to server/src/utils/misc.ts, expected server/src.backup/utils/misc.ts; base server/src/app.common.ts 'src/utils/misc.js'
server/src/app.module.ts: nest-cli/emit: import 'src/controllers/index.js' (emitted as './controllers/index.js') resolves to server/src/controllers/index.ts, expected server/src.backup/controllers/index.ts; base server/src/app.module.ts 'src/controllers/index.js'
… 293 more
finding (added-file-unresolved) server/src.backup/app.common.ts: nest-cli/emit: import 'src/repositories/config.repository.js' doesn't resolve (ERR_MODULE_NOT_FOUND) in a file with no base counterpart
finding (added-file-unresolved) server/src.backup/app.common.ts: nest-cli/emit: import 'src/repositories/logging.repository.js' doesn't resolve (ERR_MODULE_NOT_FOUND) in a file with no base counterpart
finding (added-file-unresolved) server/src.backup/app.common.ts: nest-cli/emit: import 'src/repositories/telemetry.repository.js' doesn't resolve (ERR_MODULE_NOT_FOUND) in a file with no base counterpart
… 18 more findings
FAIL K4 Location scan: 12 path-exposing uses in moved files (and 15 in added files), 2 computed paths into changed directories, 52 old paths in code/config (0 in coverage settings) (7.5 s)
server/src/main.ts: moved to server/src.backup/main.ts; line 101: import.meta.filename: dirname(import.meta.filename) pointed at server/src (exists in base), now at server/src.backup (exists in head)
server/src/main.ts: moved to server/src.backup/main.ts; line 116: new Worker(workerFile) (worker_threads)
server/src/repositories/database.repository.ts: moved to server/src.backup/repositories/database.repository.ts; line 510: import(filePath) with a computed specifier (resolved relative to this file)
server/src/repositories/database.repository.ts: moved to server/src.backup/repositories/database.repository.ts; line 511: import.meta.dirname: join(import.meta.dirname, '..', 'schema/migrations') pointed at server/src/schema/migrations (exists in base), now at server/src.backup/schema/migrations (exists in head)
server/src/repositories/storage.repository.spec.ts: moved to server/src.backup/repositories/storage.repository.spec.ts; line 38: process.cwd()
server/src/services/cli.service.ts: moved to server/src.backup/services/cli.service.ts; line 25: import.meta.dirname: join(import.meta.dirname, '../schema/migrations') pointed at server/src/schema/migrations (exists in base), now at server/src.backup/schema/migrations (exists in head)
server/src/services/library.service.spec.ts: moved to server/src.backup/services/library.service.spec.ts; line 888: process.cwd()
server/src/services/library.service.spec.ts: moved to server/src.backup/services/library.service.spec.ts; line 1284: process.cwd()
… 73 more
finding (stack-text) server/src/main.ts: moved to server/src.backup/main.ts; 1 stack-trace reads passed along as text (line 129); their frames now name the new path
finding (stack-text) server/src/repositories/metadata.repository.ts: moved to server/src.backup/repositories/metadata.repository.ts; 1 stack-trace reads passed along as text (line 133); their frames now name the new path
finding (stack-text) server/src/repositories/websocket.repository.ts: moved to server/src.backup/repositories/websocket.repository.ts; 1 stack-trace reads passed along as text (line 95); their frames now name the new path
… 54 more findings
FAIL K6 Test inventory: vitest 4.1.11: 189 violations (100 of 105 test files fail to load (base: 0), 4 files that no longer load, 96 dropped test files, 89 new test files, 2285 lost tests) (53.7 s)
server/src/controllers/activity.controller.spec.ts: no longer in the vitest test list (now at server/src.backup/controllers/activity.controller.spec.ts)
server/src/controllers/album.controller.spec.ts: no longer in the vitest test list (now at server/src.backup/controllers/album.controller.spec.ts)
server/src/controllers/api-key.controller.spec.ts: no longer in the vitest test list (now at server/src.backup/controllers/api-key.controller.spec.ts)
server/src/controllers/app.controller.spec.ts: no longer in the vitest test list (now at server/src.backup/controllers/app.controller.spec.ts)
server/src/controllers/asset-media.controller.spec.ts: no longer in the vitest test list (now at server/src.backup/controllers/asset-media.controller.spec.ts)
server/src/controllers/asset.controller.spec.ts: no longer in the vitest test list (now at server/src.backup/controllers/asset.controller.spec.ts)
server/src/controllers/auth.controller.spec.ts: no longer in the vitest test list (now at server/src.backup/controllers/auth.controller.spec.ts)
server/src/controllers/config.controller.spec.ts: no longer in the vitest test list (now at server/src.backup/controllers/config.controller.spec.ts)
… 181 more
FAIL K8 Oracles on the commit: tsc exited 1 on head (768 diagnostics), 0 on base; unit 5/105 files and 52/2,337 cases equal to base (head: 5/105 files load, 52 passed, 0 failed, 0 skipped); openapi produced nothing (39.3 s)
tsc: `node_modules/.bin/tsc --noEmit --incremental false --pretty false` exited 1 on head (768 diagnostics), exit 0 on base (log /tmp/ac-s4-certify/g3-immich-opencode-super-persistent.full/oracles/head/tsc/step-1.log)
server/src/bin/sync-sql.ts: tsc: TS1002 Unterminated string literal.
server/src/bin/sync-sql.ts: tsc: TS1002 Unterminated string literal.
server/src/bin/sync-sql.ts: tsc: TS1002 Unterminated string literal.
server/src/bin/sync-sql.ts: tsc: TS1002 Unterminated string literal.
server/src/bin/sync-sql.ts: tsc: TS1002 Unterminated string literal.
server/src/bin/sync-sql.ts: tsc: TS1002 Unterminated string literal.
server/src/bin/sync-sql.ts: tsc: TS1002 Unterminated string literal.
… 206 more
verdict: FAIL (static checks and oracles)
digest: sha256:90d2d44bbd647b5f1b99d61590fbaa9f993572e244c7a8e91fd60c1b0161651e
Ac-Certificate: fail (full) K0=pass K1=fail K2=pass K3=fail K4=fail K6=fail K8=fail
Ac-Certificate-Base: 02063972e82b1bfd17b6fc2e3b3ff39936229ea5
Ac-Certificate-Digest: sha256:90d2d44bbd647b5f1b99d61590fbaa9f993572e244c7a8e91fd60c1b0161651eimmich server/ @ 02063972e8: the same agent on Nemotron 3 Ultra
Target: immich @ 02063972e8. Base: tsc 0 errors; vitest 105 test files, 2,337 cases (docs/gates.md, G2); the OpenAPI spec is 947,932 bytes (the certificates' K8).
| ac, the full ladder (ours) | opencode + Nemotron 3 Ultra, single-shot | opencode + Nemotron 3 Ultra, persistent | Source | |
|---|---|---|---|---|
| Who | ac architecture-cleaner: Nemotron 3 Ultra plans, the executor moves, the certifier checks every commit | the same agent and prompt on NVIDIA Nemotron 3 Ultra, the model ac plans with, on Nebius Token Factory; one `opencode run`, a $2 cap (the Super arms shared one of $5) | the same agent, prompt and automated-reply loop as the Super arm, on Nemotron 3 Ultra; a $12 cap counted at the full input price (about three quarters of the Super arm's tokens at Ultra's price), which stopped it in turn 1, before any automated reply | |
| Branch | ac/s6-ladder (S6)run report | g3/opencode-ultra (S9 (G3's protocol)) | g3/opencode-ultra-persistent (S9 (G3's protocol)) | |
| Outcome | Completed unattended: 63 commits, each certified on its first attempt; every rung and the whole PR PASS with the oracles | Ran `ls` on the same two test folders 38 times in 48 tool calls and changed nothing; its $2 budget cap stopped it after 111 s | Stopped by its $12 budget cap during turn 1, after 9 min 26 s, before the first automated check, with "update all imports" still pending on its own to-do list | ac: docs/sessions/s6.md; Ultra arms: docs/sessions/s9.md (run-meta and opencode's events in ~/ac-work/g3u/, outside the tree; the gateway ledger on branch spike/g3-ultra) |
| What the diff is | 367 files moved into 38 modules, 20 platform folders and shared/; 2,474 specifier edits in 515 files; 2 boundary-rule files added and proven inert; every other byte identical certificate K1: 367 moved, 180 edited in place, 2 added (2 inert tool configs), 0 deleted | No change: nothing to certify | 374 files moved, 373 of them into src/features/ (337 TypeScript files, 20 medium-test specs among them), not one import rewritten certificate K1: 374 moved, 0 edited in place, 0 added, 0 deleted | ac: runs/immich-ladder/certificate.txt (K1, K2); Ultra arms: the persistent certificate (K1) and the measure-diff of its branch (docs/sessions/s9.md) certificate line: each arm's certificate, K1 |
| tsc errors (base: 0) | 0 certificate K8: tsc exit 0 | 0 (no change) | 3,809 certificate K8: tsc exited 1 on head (3,809 diagnostics), 0 on base | the certificates (K8): runs/immich-ladder/certificate.txt; runs/g3/g3-immich-opencode-ultra-persistent.full.txt certificate line: each arm's certificate, K8 tsc |
| Unit suite (base: 105 files, 2,337 cases) | 105/105 files, 2,337/2,337 cases certificate K8: unit 105/105 files and 2,337/2,337 cases equal to base (head: 105/105 files load, 2,337 passed, 0 failed, 0 skipped) | no change | 9 of 125 test files load (20 moved in from the medium tests), 363 of 2,337 cases certificate K8: unit 9/125 files and 363/2,337 cases equal to base (head: 9/125 files load, 363 passed, 0 failed, 0 skipped) | the certificates (K6, K8): runs/immich-ladder/certificate.txt; runs/g3/g3-immich-opencode-ultra-persistent.full.txt certificate line: each arm's certificate, K8 unit |
| OpenAPI spec (base: 947,932 bytes) | byte-identical certificate K8: openapi byte-identical to the base's open-api/immich-openapi-specs.json (947,932 bytes) | no change | not produced certificate K8: openapi produced nothing | the certificates (K8): runs/immich-ladder/certificate.txt; runs/g3/g3-immich-opencode-ultra-persistent.full.txt certificate line: each arm's certificate, K8 openapi |
| Non-specifier lines changed in moved or copied files | 0 (K2) certificate K2: 2474 specifier spans changed in 515 files; every other byte identical | – | 0: pure moves certificate K2: 0 specifier spans changed in 0 files; every other byte identical | the certificates' K2; Ultra persistent: also the measure-diff of its branch (docs/sessions/s9.md) certificate line: each arm's certificate, K2 |
| New dangling specifiers | 0 (K3a, K3b, K3c: every site resolves to its base target) certificate K3b: vitest 4.1.11: 4837 sites in 672 files resolve to map(base) | – | 1,638 certificate K3b: vitest 4.1.11: 1638 violations (1638 dangling) | the certificates' K3a–K3c; Ultra persistent: also the measure-diff of its branch (docs/sessions/s9.md) certificate line: each arm's certificate, K3b |
| Behavior changes no unit test catches | None found: K4 finds no moved file whose location reaches behavior; 12 logged stack traces now name the new path (K4 findings) certificate K4: 367 moved files expose no location; no computed path reaches a change; no old path in code, config or CI (13 findings in docs, comments or ungated coverage settings) | – | not reviewed by hand; K4 flags three moved files whose import.meta.dirname path is gone in head: the two the Super arm's review confirmed (database.repository.ts, config.repository.ts: migrations, helmet.json) and cli.service.ts (migrations) certificate K4: 8 path-exposing uses in moved files, 0 computed paths into changed directories, 30 old paths in code/config (0 in coverage settings) | the certificates' K4; the Super arm's review: docs/gates.md (Addendum: G3 review) certificate line: each arm's certificate, K4 |
| LLM cost | $0.1998 for the plan when recorded (Nemotron 3 Ultra) and $0.0010 for the findings narration (Nemotron 3.5 Lightning); a replay costs $0 | $0.55 billed; its $2 cap counted $1.86 at the full input price (1.85M input tokens, 81% from the prompt cache; 49 calls) | $2.55 billed; its $12 cap counted $11.76 at the full input price (11.6M input tokens, 90% from the prompt cache; 170 calls) | ac: runs/immich-ladder/run.json (cost); Ultra arms: the gateway ledger (spike/g3-ultra), carried into budget/ledger.jsonl, and the Nebius console bill of 2026-10-24, which billed cached input at the cached price (budget/ledger.jsonl, the reconciliation lines) |
| Time | 1 h 55 m wall time on a quiet machine, certificates included | 111 s | 9 min 26 s | ac: docs/sessions/s6.md; Ultra arms: docs/sessions/s9.md (run-meta in ~/ac-work/g3u/) |
ac certify verdict | PASS (with oracles) | no certificate | FAIL (with oracles) failing: K1, K3a, K3b, K3c, K4, K6, K8 | the certificate files; one row per check below |
| K0 Envelope | PASS | no certificate | PASS | |
| K1 Move-set integrity | PASS | no certificate | FAIL | |
| K2 Byte-span confinement | PASS | no certificate | PASS | |
| K3a Resolution identity under TypeScript | PASS | no certificate | FAIL | |
| K3b Resolution identity under the test runner | PASS | no certificate | FAIL | |
| K3c Resolution identity under the runtime | PASS | no certificate | FAIL | |
| K4 Location scan | PASS | no certificate | FAIL | |
| K6 Test inventory | PASS | no certificate | FAIL | |
| K7 Emit layout | PASS | no certificate | PASS | |
| K8 Oracles on the commit | PASS | no certificate | FAIL |
The Ultra arms (S9, at corupta's request) answer "isn't it just a better model?": opencode 1.18.34 on Nemotron 3 Ultra, the model ac plans with, with the same prompt, scripts and pinned commit as the Super arms. Only the caps differ: $2 single-shot and $12 persistent, where the Super arms shared one $5 cap (its single-shot used $0.30 and quit on its own). opencode's default request settings were kept (the model's default reasoning effort, max_tokens 32,000; ac's planner runs Ultra at medium_effort), and every request was recorded. Ultra costs 3.3 times Super per token, so $12 bought about three quarters of the Super arm's tokens. (docs/sessions/s9.md; docs/gates.md (Addendum: G3's Ultra arm))
K4 fails closed: its counts are hazards, not confirmed breaks. On the Ultra branch it flags the same three moved import.meta.dirname users as on the Super branch. (the certificates' K4; docs/gates.md (Addendum: G3 review))
The certificates
ac, the full ladder: PASS sha256:9a5b2404631c…
ac certify 02063972e8..c4be040b57 (package root server/), profile immich
trees: 424df72c34..4e457bb4e8
pathMap: 367 moves, 180 edited in place, 2917 unchanged, 2 added, 0 deleted
PASS K0 Envelope: inside the envelope: 678 TypeScript vs 3 JavaScript sources under server; no automock, nested package scope, symlink, same-stem pair or unreadable runner config around 367 moved files (0.2 s)
PASS K1 Move-set integrity: 367 moves, 180 files edited in place, 2 inert tool configs added, nothing else added or deleted (8.3 s)
finding (tool-config-added) server/.dependency-cruiser-known-violations.json: added at the package root and proven inert: in no tsconfig program, loaded by no reference, packed by no published package, named or globbed by no other file, and the tool runs nowhere; CI path filters match it, so it triggers their jobs: 'server/**' in .github/workflows/docker.yml (line 45), 'server/**' in .github/workflows/test.yml (line 46)
finding (tool-config-added) server/.dependency-cruiser.json: added at the package root and proven inert: in no tsconfig program, loaded by no reference, packed by no published package, named or globbed by no other file, and the tool runs nowhere; CI path filters match it, so it triggers their jobs: 'server/**' in .github/workflows/docker.yml (line 45), 'server/**' in .github/workflows/test.yml (line 46)
PASS K2 Byte-span confinement: 2474 specifier spans changed in 515 files; every other byte identical (3.4 s)
PASS K3a Resolution identity under TypeScript: 6647 sites in 1100 files resolve to map(base) under every program (458 files in several); 2474 rewritten specifiers keep their form (1.8 s)
PASS K3b Resolution identity under the test runner: vitest 4.1.11: 4837 sites in 672 files resolve to map(base) (5.1 s)
PASS K3c Resolution identity under the runtime: 6192 runtime sites resolve to map(base) under nest-cli/emit (3442 rewritten by the build) (6.7 s)
PASS K4 Location scan: 367 moved files expose no location; no computed path reaches a change; no old path in code, config or CI (13 findings in docs, comments or ungated coverage settings) (5.7 s)
finding (stack-text) server/src/repositories/metadata.repository.ts: moved to server/src/platform/metadata/metadata.repository.ts; 1 stack-trace reads passed along as text (line 133); their frames now name the new path
finding (stack-text) server/src/repositories/websocket.repository.ts: moved to server/src/platform/websocket/websocket.repository.ts; 1 stack-trace reads passed along as text (line 95); their frames now name the new path
finding (stack-text) server/src/services/asset-media.service.ts: moved to server/src/modules/asset/asset-media.service.ts; 1 stack-trace reads passed along as text (line 224); their frames now name the new path
… 23 more findings
PASS K6 Test inventory: vitest 4.1.11: 105 test files, 2337 tests, per-file load status and case names equal (0.0 s)
PASS K7 Emit layout: 7 emitting programs keep their outDir and rootDir (1 by TypeScript's default) (0.5 s)
finding (default-root-dir) e2e/tsconfig.json: emits into e2e/dist without a rootDir; TypeScript 6.0+ and before 6.0's default stays e2e and e2e
PASS K8 Oracles on the commit: tsc exit 0; unit 105/105 files and 2,337/2,337 cases equal to base (head: 105/105 files load, 2,337 passed, 0 failed, 0 skipped); openapi byte-identical to the base's open-api/immich-openapi-specs.json (947,932 bytes) (114.9 s)
verdict: PASS (static checks and oracles)
digest: sha256:9a5b2404631c2ac668462ad93fcbcd116637244e2b4f76e987bcc4e23e8be2b5opencode + Nemotron 3 Ultra, persistent: FAIL sha256:8c60837c464a…
ac certify 02063972e8..ab16b0749e (package root server/), profile immich
trees: 424df72c34..a80903b996
pathMap: 374 moves, 0 edited in place, 3090 unchanged, 0 added, 0 deleted
PASS K0 Envelope: inside the envelope: 678 TypeScript vs 3 JavaScript sources under server; no automock, nested package scope, symlink, same-stem pair or unreadable runner config around 374 moved files (10.6 s)
FAIL K1 Move-set integrity: 65 violations (0 added, 0 deleted, 0 copies) (1.0 s)
server/test/factories/album-user.factory.ts: .npmignore status changes: not ignored -> ignored at server/src/features/album/tests/album-user.factory.ts
server/test/factories/album.factory.ts: .npmignore status changes: not ignored -> ignored at server/src/features/album/tests/album.factory.ts
server/test/factories/asset-edit.factory.ts: .npmignore status changes: not ignored -> ignored at server/src/features/asset/tests/asset-edit.factory.ts
server/test/factories/asset-exif.factory.ts: .npmignore status changes: not ignored -> ignored at server/src/features/asset/tests/asset-exif.factory.ts
server/test/factories/asset-face.factory.ts: .npmignore status changes: not ignored -> ignored at server/src/features/asset/tests/asset-face.factory.ts
server/test/factories/asset-file.factory.ts: .npmignore status changes: not ignored -> ignored at server/src/features/asset/tests/asset-file.factory.ts
server/test/factories/asset.factory.ts: .npmignore status changes: not ignored -> ignored at server/src/features/asset/tests/asset.factory.ts
server/test/medium/specs/repositories/asset-edit.repository.spec.ts: .npmignore status changes: not ignored -> ignored at server/src/features/asset/tests/asset-edit.repository.spec.ts
… 57 more
PASS K2 Byte-span confinement: 0 specifier spans changed in 0 files; every other byte identical (4.5 s)
FAIL K3a Resolution identity under TypeScript: 1646 violations (1638 resolution mismatches, 8 program or format changes) (2.9 s)
server/src/app.common.ts: line 10: import 'src/middleware/websocket.adapter.js': expected file server/src/features/websocket/middleware/websocket.adapter.ts (typescript), got unresolved under server/tsconfig.build.json, server/tsconfig.json
server/src/app.common.ts: line 11: import 'src/repositories/config.repository.js': expected file server/src/features/config/repository/config.repository.ts (typescript), got unresolved under server/tsconfig.build.json, server/tsconfig.json
server/src/app.common.ts: line 12: import 'src/repositories/logging.repository.js': expected file server/src/features/logging/repository/logging.repository.ts (typescript), got unresolved under server/tsconfig.build.json, server/tsconfig.json
server/src/app.common.ts: line 13: import 'src/repositories/telemetry.repository.js': expected file server/src/features/telemetry/repository/telemetry.repository.ts (typescript), got unresolved under server/tsconfig.build.json, server/tsconfig.json
server/src/app.common.ts: line 14: import 'src/services/api.service.js': expected file server/src/features/api/service/api.service.ts (typescript), got unresolved under server/tsconfig.build.json, server/tsconfig.json
server/src/app.module.ts: line 11: import 'src/controllers/index.js': expected file server/src/features/app/controller/index.ts (typescript), got unresolved under server/tsconfig.build.json, server/tsconfig.json
server/src/app.module.ts: line 18: import 'src/middleware/auth.guard.js': expected file server/src/features/auth/middleware/auth.guard.ts (typescript), got unresolved under server/tsconfig.build.json, server/tsconfig.json
server/src/app.module.ts: line 19: import 'src/middleware/error.interceptor.js': expected file server/src/features/shared/middleware/error.interceptor.ts (typescript), got unresolved under server/tsconfig.build.json, server/tsconfig.json
… 1638 more
FAIL K3b Resolution identity under the test runner: vitest 4.1.11: 1638 violations (1638 dangling) (6.5 s)
server/src/app.common.ts: site 9 'src/middleware/websocket.adapter.js' (import): base server/src/features/websocket/middleware/websocket.adapter.ts, head unresolved
server/src/app.common.ts: site 10 'src/repositories/config.repository.js' (import): base server/src/features/config/repository/config.repository.ts, head unresolved
server/src/app.common.ts: site 11 'src/repositories/logging.repository.js' (import): base server/src/features/logging/repository/logging.repository.ts, head unresolved
server/src/app.common.ts: site 12 'src/repositories/telemetry.repository.js' (import): base server/src/features/telemetry/repository/telemetry.repository.ts, head unresolved
server/src/app.common.ts: site 13 'src/services/api.service.js' (import): base server/src/features/api/service/api.service.ts, head unresolved
server/src/app.module.ts: site 10 'src/controllers/index.js' (import): base server/src/features/app/controller/index.ts, head unresolved
server/src/app.module.ts: site 17 'src/middleware/auth.guard.js' (import): base server/src/features/auth/middleware/auth.guard.ts, head unresolved
server/src/app.module.ts: site 18 'src/middleware/error.interceptor.js' (import): base server/src/features/shared/middleware/error.interceptor.ts, head unresolved
… 1630 more
FAIL K3c Resolution identity under the runtime: 1569 violations under nest-cli/emit (7.4 s)
server/src/app.common.ts: nest-cli/emit: import 'src/middleware/websocket.adapter.js' resolves to unresolved (ERR_MODULE_NOT_FOUND), expected server/src/features/websocket/middleware/websocket.adapter.ts; base server/src/app.common.ts 'src/middleware/websocket.adapter.js'
server/src/app.common.ts: nest-cli/emit: import 'src/repositories/config.repository.js' resolves to unresolved (ERR_MODULE_NOT_FOUND), expected server/src/features/config/repository/config.repository.ts; base server/src/app.common.ts 'src/repositories/config.repository.js'
server/src/app.common.ts: nest-cli/emit: import 'src/repositories/logging.repository.js' resolves to unresolved (ERR_MODULE_NOT_FOUND), expected server/src/features/logging/repository/logging.repository.ts; base server/src/app.common.ts 'src/repositories/logging.repository.js'
server/src/app.common.ts: nest-cli/emit: import 'src/repositories/telemetry.repository.js' resolves to unresolved (ERR_MODULE_NOT_FOUND), expected server/src/features/telemetry/repository/telemetry.repository.ts; base server/src/app.common.ts 'src/repositories/telemetry.repository.js'
server/src/app.common.ts: nest-cli/emit: import 'src/services/api.service.js' resolves to unresolved (ERR_MODULE_NOT_FOUND), expected server/src/features/api/service/api.service.ts; base server/src/app.common.ts 'src/services/api.service.js'
server/src/app.module.ts: nest-cli/emit: import 'src/controllers/index.js' resolves to unresolved (ERR_MODULE_NOT_FOUND), expected server/src/features/app/controller/index.ts; base server/src/app.module.ts 'src/controllers/index.js'
server/src/app.module.ts: nest-cli/emit: import 'src/middleware/auth.guard.js' resolves to unresolved (ERR_MODULE_NOT_FOUND), expected server/src/features/auth/middleware/auth.guard.ts; base server/src/app.module.ts 'src/middleware/auth.guard.js'
server/src/app.module.ts: nest-cli/emit: import 'src/middleware/error.interceptor.js' resolves to unresolved (ERR_MODULE_NOT_FOUND), expected server/src/features/shared/middleware/error.interceptor.ts; base server/src/app.module.ts 'src/middleware/error.interceptor.js'
… 293 more
FAIL K4 Location scan: 8 path-exposing uses in moved files, 0 computed paths into changed directories, 30 old paths in code/config (0 in coverage settings) (6.7 s)
server/src/repositories/config.repository.ts: moved to server/src/features/config/repository/config.repository.ts; line 161: import.meta.dirname: join(import.meta.dirname, '..', '..', 'helmet.json') pointed at server/helmet.json (exists in base), now at server/src/features/helmet.json (missing in head)
server/src/repositories/database.repository.ts: moved to server/src/features/database/repository/database.repository.ts; line 510: import(filePath) with a computed specifier (resolved relative to this file)
server/src/repositories/database.repository.ts: moved to server/src/features/database/repository/database.repository.ts; line 511: import.meta.dirname: join(import.meta.dirname, '..', 'schema/migrations') pointed at server/src/schema/migrations (exists in base), now at server/src/features/database/schema/migrations (missing in head)
server/src/repositories/storage.repository.spec.ts: moved to server/src/features/storage/repository/storage.repository.spec.ts; line 38: process.cwd()
server/src/services/cli.service.ts: moved to server/src/features/cli/service/cli.service.ts; line 25: import.meta.dirname: join(import.meta.dirname, '../schema/migrations') pointed at server/src/schema/migrations (exists in base), now at server/src/features/cli/schema/migrations (missing in head)
server/src/services/library.service.spec.ts: moved to server/src/features/library/service/library.service.spec.ts; line 888: process.cwd()
server/src/services/library.service.spec.ts: moved to server/src/features/library/service/library.service.spec.ts; line 1284: process.cwd()
server/src/services/library.service.spec.ts: moved to server/src/features/library/service/library.service.spec.ts; line 1298: process.cwd()
… 30 more
finding (stack-text) server/src/repositories/metadata.repository.ts: moved to server/src/features/metadata/repository/metadata.repository.ts; 1 stack-trace reads passed along as text (line 133); their frames now name the new path
finding (stack-text) server/src/repositories/websocket.repository.ts: moved to server/src/features/websocket/repository/websocket.repository.ts; 1 stack-trace reads passed along as text (line 95); their frames now name the new path
finding (stack-text) server/src/services/asset-media.service.ts: moved to server/src/features/asset/service/asset-media.service.ts; 1 stack-trace reads passed along as text (line 224); their frames now name the new path
… 22 more findings
FAIL K6 Test inventory: vitest 4.1.11: 116 violations (116 of 125 test files fail to load (base: 0), 96 files that no longer load, 20 new test files, 1974 lost tests) (57.9 s)
server/src/features/album/tests/album.service.spec.ts: new in the vitest test list (was server/test/medium/specs/services/album.service.spec.ts, not a test file in base; fails to load: Cannot find package 'src/repositories/access.repository.js' imported from /tmp/ac-certify-hkZIpU/worktree-head/server/src/features/album/tests/album.service.spec.ts)
server/src/features/album/tests/sync-album-user.spec.ts: new in the vitest test list (was server/test/medium/specs/sync/sync-album-user.spec.ts, not a test file in base; fails to load: Cannot find package 'src/repositories/album-user.repository.js' imported from /tmp/ac-certify-hkZIpU/worktree-head/server/src/features/album/tests/sync-album-user.spec.ts)
server/src/features/album/tests/sync-album.spec.ts: new in the vitest test list (was server/test/medium/specs/sync/sync-album.spec.ts, not a test file in base; fails to load: Cannot find package 'src/repositories/album-user.repository.js' imported from /tmp/ac-certify-hkZIpU/worktree-head/server/src/features/album/tests/sync-album.spec.ts)
server/src/features/asset/tests/asset-edit.repository.spec.ts: new in the vitest test list (was server/test/medium/specs/repositories/asset-edit.repository.spec.ts, not a test file in base; fails to load: Cannot find package 'src/dtos/editing.dto.js' imported from /tmp/ac-certify-hkZIpU/worktree-head/server/src/features/asset/tests/asset-edit.repository.spec.ts)
server/src/features/asset/tests/asset-job.repository.spec.ts: new in the vitest test list (was server/test/medium/specs/repositories/asset-job.repository.spec.ts, not a test file in base; fails to load: Cannot find package 'src/repositories/asset-job.repository.js' imported from /tmp/ac-certify-hkZIpU/worktree-head/server/src/features/asset/tests/asset-job.repository.spec.ts)
server/src/features/asset/tests/asset-media.service.spec.ts: new in the vitest test list (was server/test/medium/specs/services/asset-media.service.spec.ts, not a test file in base; fails to load: Cannot find package 'src/dtos/asset-media-response.dto.js' imported from /tmp/ac-certify-hkZIpU/worktree-head/server/src/features/asset/tests/asset-media.service.spec.ts)
server/src/features/asset/tests/asset.repository.spec.ts: new in the vitest test list (was server/test/medium/specs/repositories/asset.repository.spec.ts, not a test file in base; fails to load: Cannot find package 'src/repositories/asset.repository.js' imported from /tmp/ac-certify-hkZIpU/worktree-head/server/src/features/asset/tests/asset.repository.spec.ts)
server/src/features/asset/tests/asset.service.spec.ts: new in the vitest test list (was server/test/medium/specs/services/asset.service.spec.ts, not a test file in base; fails to load: Cannot find package 'src/dtos/editing.dto.js' imported from /tmp/ac-certify-hkZIpU/worktree-head/server/src/features/asset/tests/asset.service.spec.ts)
… 108 more
PASS K7 Emit layout: 7 emitting programs keep their outDir and rootDir (1 by TypeScript's default) (0.4 s)
finding (default-root-dir) e2e/tsconfig.json: emits into e2e/dist without a rootDir; TypeScript 6.0+ and before 6.0's default stays e2e and e2e
FAIL K8 Oracles on the commit: tsc exited 1 on head (3,809 diagnostics), 0 on base; unit 9/125 files and 363/2,337 cases equal to base (head: 9/125 files load, 363 passed, 0 failed, 0 skipped); openapi produced nothing (293.3 s)
tsc: `node_modules/.bin/tsc --noEmit --incremental false --pretty false` exited 1 on head (3,809 diagnostics), exit 0 on base (log /tmp/ac-certify-hkZIpU/oracles/head/tsc/step-1.log)
server/src/app.common.ts: tsc: TS2307 Cannot find module 'src/middleware/websocket.adapter.js' or its corresponding type declarations.
server/src/app.common.ts: tsc: TS2307 Cannot find module 'src/repositories/config.repository.js' or its corresponding type declarations.
server/src/app.common.ts: tsc: TS2307 Cannot find module 'src/repositories/logging.repository.js' or its corresponding type declarations.
server/src/app.common.ts: tsc: TS2307 Cannot find module 'src/repositories/telemetry.repository.js' or its corresponding type declarations.
server/src/app.common.ts: tsc: TS2307 Cannot find module 'src/services/api.service.js' or its corresponding type declarations.
server/src/app.module.ts: tsc: TS2307 Cannot find module 'src/controllers/index.js' or its corresponding type declarations.
server/src/app.module.ts: tsc: TS2307 Cannot find module 'src/middleware/auth.guard.js' or its corresponding type declarations.
… 126 more
verdict: FAIL (static checks and oracles)
digest: sha256:8c60837c464acbec6312f54bd78d12c3685a288372464be763de79592e5f8c3f
Ac-Certificate: fail (full) K0=pass K1=fail K2=pass K3=fail K4=fail K6=fail K7=pass K8=fail
Ac-Certificate-Base-Tree: 424df72c3407dd1e7df5ee4e81a1d5fcd85cc01c
Ac-Certificate-Tree: a80903b996d68aae45bd05776158f681ae071fd6
Ac-Certificate-Digest: sha256:8c60837c464acbec6312f54bd78d12c3685a288372464be763de79592e5f8c3fmcphub @ 70cf036c90
Target: mcphub @ 70cf036c90. Base: tsc 0 errors; jest 218/226 files, 1,952/1,986 cases offline (docs/gates.md, G2). ac made no restructure of mcphub (it only certified the agent's branches): there is no ac arm.
A green test count is not proof. On mcphub, the branch g3/opencode-super-persistent (opencode + Nemotron 3 Super, persistent) still passes all 1,934 of the base's test cases outside the 7 network test files K8 sets aside, while 35 of its 264 test files fail to load and tsc reports 101 errors (its certificate: K6, K8).
| opencode + Nemotron 3 Super, single-shot | opencode + Nemotron 3 Super, persistent | Source | |
|---|---|---|---|
| Who | opencode 1.18.34, NVIDIA Nemotron 3 Super on Nebius Token Factory, one `opencode run` with the fixed prompt | the same agent with automated continue replies | |
| Branch | g3/opencode-super (G3 (S2)) | g3/opencode-super-persistent (G3 (S2)) | |
| Outcome | Stopped after 48 s and asked the user which approach to take | 25 turns, 24 min; tool calls in only 3 of 25 turns, and the same refusal text 16 times (Super decodes greedily) | docs/gates.md (G3 table) |
| File operations | 87 source files moved, 1 deleted, 0 importers rewritten certificate K1: 89 moved, 0 edited in place, 1 added, 1 deleted | 287 copied, 5 new re-export facades certificate K1: 0 moved, 0 edited in place, 299 added (214 of them copies of files that still exist), 0 deleted | docs/gates.md (G3 table) certificate line: each arm's certificate, K1 |
| Non-specifier lines changed in moved or copied files | 0 certificate K2: no file paired with a base file changed, so there was nothing to compare; K1 counts the 1 added file | 256 (0.4%) certificate K2: no file paired with a base file changed, so there was nothing to compare; K1 counts the 299 added files | docs/gates.md (G3 table) certificate line: each arm's certificate, K2 |
| New dangling specifiers | 1,102 (720 imports, 367 jest.mock, 15 dynamic or typeof) certificate K3b: jest 30.3.0: 1100 violations (1100 dangling) | 891 certificate K3b: jest 30.3.0: 939 violations (939 dangling in added files) | docs/gates.md (G3 table) certificate line: each arm's certificate, K3b |
| tsc errors (base: 0) | 908 certificate K8: tsc exited 2 on head (908 diagnostics), 0 on base | 101 certificate K8: tsc exited 2 on head (101 diagnostics), 0 on base | docs/gates.md (G3 table) certificate line: each arm's certificate, K8 tsc |
| Unit tests, offline (base: 218/226 files, 1,952/1,986 cases) | 96/226 files, 790/800 cases certificate K8: unit 96/219 files and 779/1,934 cases equal to base (head: 99/219 files load, 779 passed, 8 failed, 0 skipped) | 222/264 files (+38 duplicates), 1,971/2,004 cases; the extra failures are all in the duplicated copies certificate K8: unit 219/257 files and 1,934/1,952 cases equal to base (head: 222/257 files load, 1,952 passed, 0 failed, 0 skipped) | docs/gates.md (G3 table) certificate line: each arm's certificate, K8 unit |
| LLM cost | $0.04 | $0.82 (2.7M input tokens) | docs/gates.md (G3 table) |
ac certify verdict | FAIL (with oracles) failing: K1, K3a, K3b, K3c, K4, K6, K8 | FAIL (with oracles) failing: K1, K3a, K3b, K4, K6, K8 | the certificate files; one row per check below |
| K0 Envelope | PASS | PASS | |
| K1 Move-set integrity | FAIL | FAIL | |
| K2 Byte-span confinement | PASS nothing to compare: K1 counts the 1 added file | PASS nothing to compare: K1 counts the 299 added files | |
| K3a Resolution identity under TypeScript | FAIL | FAIL | |
| K3b Resolution identity under the test runner | FAIL | FAIL | |
| K3c Resolution identity under the runtime | FAIL | PASS | |
| K4 Location scan | FAIL | FAIL | |
| K6 Test inventory | FAIL | FAIL | |
| K8 Oracles on the commit | FAIL | FAIL |
Where the gate's numbers and the certificates' differ
- File operations: The gate counted moved and copied files with git's rename and copy detection at 50% similarity (spike/g3/measure-diff.mjs). The certifier pairs a head file with a base file only when their bytes are equal outside specifier spans, so a moved, copied or edited file with any other change is an added file to it, and only exact copies count as copies.
- Non-specifier lines changed in moved or copied files: The gate diffed each renamed or copied file against its original line by line. K2 compares only the files the certifier pairs with a base file, and those differ at most in specifier spans by construction, so the edits inside copies and rewrites are not K2's to see: those files are K1's added files, and K1 fails.
- New dangling specifiers: The gate counted import sites its TypeScript analyzer could not resolve at the head, leaving out specifiers already unresolved at base. K3b resolves every site the way the test runner does (jest) and counts the sites of kept or moved files that no longer reach their base target (dangling, retargeted) apart from unresolved sites in added files; K3a and K3c do the same under TypeScript and the runtime.
- Unit tests, offline (base: 218/226 files, 1,952/1,986 cases): The gate ran the whole suite and counted passing cases over collected ones. K8 leaves out the 7 test files that need the network (the G2 quarantine, docs/gates.md; unit.quarantined in the certificate) and counts the files and cases equal to base, so its base is 219 files and 1,934 cases.
The persistent run reset its work twice with git reset --hard, which turned the restructure into a copy; the originals are intact. (docs/gates.md (Addendum: G3 review))
The certificates
opencode + Nemotron 3 Super, single-shot: FAIL sha256:0e250c4745c1…
ac certify 70cf036c90..f50276187f
pathMap: 89 moves, 0 edited in place, 729 unchanged, 1 added, 1 deleted
PASS K0 Envelope: inside the envelope: 604 TypeScript vs 12 JavaScript sources under the repo root; no automock, nested package scope, symlink, same-stem pair or unreadable runner config around 89 moved files (4.2 s)
FAIL K1 Move-set integrity: 2 violations (1 added, 1 deleted, 0 copies) (0.3 s)
src/services/dataService.ts: deleted: no file in head has its content (modulo specifiers)
restructure.sh: added: no file in base has its content (modulo specifiers)
PASS K2 Byte-span confinement: 0 specifier spans changed in 0 files; every other byte identical (1.4 s)
FAIL K3a Resolution identity under TypeScript: 1102 violations (1101 resolution mismatches, 1 deleted source files) (1.8 s)
src/cli/commands/groups.ts: line 6: import '../../types/index.js': expected file src/features/index.ts/types/index.ts (typescript), got unresolved under tsconfig.json, tsconfig.test.json
src/cli/commands/keys.ts: line 6: import '../../types/index.js': expected file src/features/index.ts/types/index.ts (typescript), got unresolved under tsconfig.json, tsconfig.test.json
src/cli/commands/servers.ts: line 7: import '../../types/index.js': expected file src/features/index.ts/types/index.ts (typescript), got unresolved under tsconfig.json, tsconfig.test.json
src/cli/commands/tools.ts: line 6: import '../../types/index.js': expected file src/features/index.ts/types/index.ts (typescript), got unresolved under tsconfig.json, tsconfig.test.json
src/clients/__tests__/openapi-cookie.test.ts: line 2: import '../../types/index.js': expected file src/features/index.ts/types/index.ts (typescript), got unresolved
src/clients/__tests__/openapi-error-handling.test.ts: line 2: import '../../types/index.js': expected file src/features/index.ts/types/index.ts (typescript), got unresolved
src/clients/__tests__/openapi-external-ref.test.ts: line 2: import '../../types/index.js': expected file src/features/index.ts/types/index.ts (typescript), got unresolved
src/clients/__tests__/openapi-input-schema.test.ts: line 2: import '../../types/index.js': expected file src/features/index.ts/types/index.ts (typescript), got unresolved
… 1094 more
FAIL K3b Resolution identity under the test runner: jest 30.3.0: 1100 violations (1100 dangling) (5.3 s)
frontend/src/utils/bearerKeyScopeFilter.ts: site 0 '@/types' (import): base src/features/index.ts/types/index.ts, head unresolved (Configuration error: Could not locate module @/types mapped as: /tmp/ac-s4-certify/g3-mcphub-opencode-super.full/worktree-head/src/$1. Please check your configuration for these entries: { "moduleNameM); moduleNameMapper stub base src/features/index.ts/types/index.ts, head unresolved
frontend/src/utils/serverFilters.ts: site 0 '@/types' (import): base src/features/index.ts/types/index.ts, head unresolved (Configuration error: Could not locate module @/types mapped as: /tmp/ac-s4-certify/g3-mcphub-opencode-super.full/worktree-head/src/$1. Please check your configuration for these entries: { "moduleNameM); moduleNameMapper stub base src/features/index.ts/types/index.ts, head unresolved
frontend/src/utils/serverListState.ts: site 0 '@/types' (import): base src/features/index.ts/types/index.ts, head unresolved (Configuration error: Could not locate module @/types mapped as: /tmp/ac-s4-certify/g3-mcphub-opencode-super.full/worktree-head/src/$1. Please check your configuration for these entries: { "moduleNameM); moduleNameMapper stub base src/features/index.ts/types/index.ts, head unresolved
src/cli/commands/groups.ts: site 5 '../../types/index.js' (import): base src/features/index.ts/types/index.ts, head unresolved (Configuration error: Could not locate module ../../types/index.js mapped as: $1. Please check your configuration for these entries: { "moduleNameMapper": { "/^(\.{1,2}\/.*)\.js$/": "$1" }, "resolver":); moduleNameMapper stub base src/features/index.ts/types/index.ts, head unresolved
src/cli/commands/keys.ts: site 5 '../../types/index.js' (import): base src/features/index.ts/types/index.ts, head unresolved (Configuration error: Could not locate module ../../types/index.js mapped as: $1. Please check your configuration for these entries: { "moduleNameMapper": { "/^(\.{1,2}\/.*)\.js$/": "$1" }, "resolver":); moduleNameMapper stub base src/features/index.ts/types/index.ts, head unresolved
src/cli/commands/servers.ts: site 6 '../../types/index.js' (import): base src/features/index.ts/types/index.ts, head unresolved (Configuration error: Could not locate module ../../types/index.js mapped as: $1. Please check your configuration for these entries: { "moduleNameMapper": { "/^(\.{1,2}\/.*)\.js$/": "$1" }, "resolver":); moduleNameMapper stub base src/features/index.ts/types/index.ts, head unresolved
src/cli/commands/tools.ts: site 5 '../../types/index.js' (import): base src/features/index.ts/types/index.ts, head unresolved (Configuration error: Could not locate module ../../types/index.js mapped as: $1. Please check your configuration for these entries: { "moduleNameMapper": { "/^(\.{1,2}\/.*)\.js$/": "$1" }, "resolver":); moduleNameMapper stub base src/features/index.ts/types/index.ts, head unresolved
src/clients/__tests__/openapi-cookie.test.ts: site 1 '../../types/index.js' (import): base src/features/index.ts/types/index.ts, head unresolved (Configuration error: Could not locate module ../../types/index.js mapped as: $1. Please check your configuration for these entries: { "moduleNameMapper": { "/^(\.{1,2}\/.*)\.js$/": "$1" }, "resolver":); moduleNameMapper stub base src/features/index.ts/types/index.ts, head unresolved
… 1092 more
FAIL K3c Resolution identity under the runtime: 1347 violations under node/emit, tsx/source (4.0 s)
src/clients/__tests__/openapi-input-schema.test.ts: node/emit: import '../../types/index.js' resolves to unresolved (ERR_MODULE_NOT_FOUND), expected src/features/index.ts/types/index.ts; base src/clients/__tests__/openapi-input-schema.test.ts '../../types/index.js'
src/clients/__tests__/openapi-operation-name.test.ts: node/emit: import '../../types/index.js' resolves to unresolved (ERR_MODULE_NOT_FOUND), expected src/features/index.ts/types/index.ts; base src/clients/__tests__/openapi-operation-name.test.ts '../../types/index.js'
src/clients/__tests__/openapi-request-body-content-types.test.ts: node/emit: import '../../types/index.js' resolves to unresolved (ERR_MODULE_NOT_FOUND), expected src/features/index.ts/types/index.ts; base src/clients/__tests__/openapi-request-body-content-types.test.ts '../../types/index.js'
src/clients/__tests__/openapi-server-template.test.ts: node/emit: import '../../types/index.js' resolves to unresolved (ERR_MODULE_NOT_FOUND), expected src/features/index.ts/types/index.ts; base src/clients/__tests__/openapi-server-template.test.ts '../../types/index.js'
src/clients/openapi.ts: node/emit: import '../types/index.js' resolves to unresolved (ERR_MODULE_NOT_FOUND), expected src/features/index.ts/types/index.ts; base src/clients/openapi.ts '../types/index.js'
src/config/configManager.ts: node/emit: import '../types/index.js' resolves to unresolved (ERR_MODULE_NOT_FOUND), expected src/features/index.ts/types/index.ts; base src/config/configManager.ts '../types/index.js'
src/config/configManager.ts: node/emit: import '../services/dataService.js' resolves to unresolved (ERR_MODULE_NOT_FOUND), expected src/services/dataService.ts; base src/config/configManager.ts '../services/dataService.js'
src/config/DaoConfigService.ts: node/emit: import '../types/index.js' resolves to unresolved (ERR_MODULE_NOT_FOUND), expected src/features/index.ts/types/index.ts; base src/config/DaoConfigService.ts '../types/index.js'
… 293 more
FAIL K4 Location scan: 8 path-exposing uses in moved files, 4 computed paths into changed directories, 8 old paths in code/config (0 in coverage settings) (3.0 s)
src/controllers/mcpbController.ts: moved to src/features/mcpb/mcpbController.ts; line 14: cwd-relative path path.join(process.cwd(), 'data/uploads/mcpb')
src/controllers/mcpbController.ts: moved to src/features/mcpb/mcpbController.ts; line 14: process.cwd()
src/controllers/mcpbController.ts: moved to src/features/mcpb/mcpbController.ts; line 47: cwd-relative path path.join('data', 'uploads', 'mcpb')
src/controllers/mcpbController.ts: moved to src/features/mcpb/mcpbController.ts; line 49: cwd-relative path path.join(process.cwd(), MCPB_UPLOAD_DIR)
src/controllers/mcpbController.ts: moved to src/features/mcpb/mcpbController.ts; line 49: process.cwd()
src/controllers/mcpbController.ts: moved to src/features/mcpb/mcpbController.ts; line 64: cwd-relative path path.resolve(resolvedBaseDir, `server-${serverName}`)
src/services/mcpService.ts: moved to src/features/mcp/mcpService.ts; line 1704: process.cwd()
scripts/dev-backend.js: line 13: path.resolve(projectRoot, value) computes a path inside ., whose tracked contents changed (src)
… 12 more
finding (stack-text) src/controllers/oauthCallbackController.ts: moved to src/features/oauthCallback/oauthCallbackController.ts; 2 stack-trace reads passed along as text (line 474); their frames now name the new path
finding (opaque-dynamic-load) bin/cli.js: line 86: import(cliEntryUrl) loads a module by a path K4 can't evaluate
finding (opaque-dynamic-load) bin/cli.js: line 108: import(entryUrl) loads a module by a path K4 can't evaluate
… 45 more findings
FAIL K6 Test inventory: jest 30.3.0: 126 violations (126 of 226 test files fail to load (base: 0), 126 files that no longer load, 1186 lost tests) (21.4 s)
tests/controllers/serverController.test.ts: loads in base, fails to load in head: ● Test suite failed to run Configuration error: Could not locate module ../../src/dao/DaoFactory.js mapped as: $1. Please check your configuration for these entries: { "moduleNameMapper": { "/^(\.{1,2
src/services/sseService.test.ts: loads in base, fails to load in head: ● Test suite failed to run Configuration error: Could not locate module ./mcpService.js mapped as: $1. Please check your configuration for these entries: { "moduleNameMapper": { "/^(\.{1,2}\/.*)\.js$/
tests/integration/personal-credentials.test.ts: loads in base, fails to load in head: ● Test suite failed to run Configuration error: Could not locate module ../../src/services/oauthService.js mapped as: $1. Please check your configuration for these entries: { "moduleNameMapper": { "/^
tests/services/vectorSearchService.test.ts: loads in base, fails to load in head: ● Test suite failed to run Configuration error: Could not locate module ../../src/services/logService.js mapped as: $1. Please check your configuration for these entries: { "moduleNameMapper": { "/^(\
tests/integration/sse-service-real-client.test.ts: loads in base, fails to load in head: ● Test suite failed to run Configuration error: Could not locate module ./dataService.js mapped as: $1. Please check your configuration for these entries: { "moduleNameMapper": { "/^(\.{1,2}\/.*)\.js$
tests/utils/smartRouting.test.ts: loads in base, fails to load in head: ● Test suite failed to run Configuration error: Could not locate module ../../src/dao/DaoFactory.js mapped as: $1. Please check your configuration for these entries: { "moduleNameMapper": { "/^(\.{1,2
tests/services/mcpService-apps.test.ts: loads in base, fails to load in head: ● Test suite failed to run Configuration error: Could not locate module ../../src/services/oauthService.js mapped as: $1. Please check your configuration for these entries: { "moduleNameMapper": { "/^
tests/controllers/smartRoutingController.test.ts: loads in base, fails to load in head: ● Test suite failed to run Configuration error: Could not locate module ../../src/services/mcpService.js mapped as: $1. Please check your configuration for these entries: { "moduleNameMapper": { "/^(\
… 118 more
FAIL K8 Oracles on the commit: tsc exited 2 on head (908 diagnostics), 0 on base; unit 96/219 files and 779/1,934 cases equal to base (head: 99/219 files load, 779 passed, 8 failed, 0 skipped) (19.8 s)
tsc: `node_modules/.bin/tsc --outDir {scratch}/dist --incremental false --pretty false` exited 2 on head (908 diagnostics), exit 0 on base (log /tmp/ac-s4-certify/g3-mcphub-opencode-super.full/oracles/head/tsc/step-1.log)
src/cli/commands/groups.ts: tsc: TS2307 Cannot find module '../../types/index.js' or its corresponding type declarations.
src/cli/commands/keys.ts: tsc: TS2307 Cannot find module '../../types/index.js' or its corresponding type declarations.
src/cli/commands/servers.ts: tsc: TS2307 Cannot find module '../../types/index.js' or its corresponding type declarations.
src/cli/commands/tools.ts: tsc: TS2307 Cannot find module '../../types/index.js' or its corresponding type declarations.
src/clients/openapi.ts: tsc: TS2307 Cannot find module '../types/index.js' or its corresponding type declarations.
src/clients/openapi.ts: tsc: TS2305 Module '"../dao/index.js"' has no exported member 'getUserDao'.
src/clients/openapi.ts: tsc: TS2366 Function lacks ending return statement and return type does not include 'undefined'.
… 128 more
finding (network-attempt) unit on head: 5 network attempts refused (log /tmp/ac-s4-certify/g3-mcphub-opencode-super.full/oracles/head/unit/network.jsonl)
finding (network-attempt) unit on base: 5 network attempts refused (log /home/paseo/ac-work/s4/oracle-cache/mcphub-70cf036c90f8-unit-7840c52c5958cd0e/network.jsonl)
verdict: FAIL (static checks and oracles)
digest: sha256:0e250c4745c1f84045cac9fa2879648bfcfa559829cd36d6c7b0fb7407e3c175
Ac-Certificate: fail (full) K0=pass K1=fail K2=pass K3=fail K4=fail K6=fail K8=fail
Ac-Certificate-Base: 70cf036c90f8239c2a11a57f137b588fce7d1b0c
Ac-Certificate-Digest: sha256:0e250c4745c1f84045cac9fa2879648bfcfa559829cd36d6c7b0fb7407e3c175opencode + Nemotron 3 Super, persistent: FAIL sha256:468c1acbeedf…
ac certify 70cf036c90..17a703d797
pathMap: 0 moves, 0 edited in place, 819 unchanged, 299 added, 0 deleted
PASS K0 Envelope: inside the envelope: 897 TypeScript vs 17 JavaScript sources under the repo root; no automock, nested package scope, symlink, same-stem pair or unreadable runner config around 0 moved files (5.3 s)
FAIL K1 Move-set integrity: 299 violations (299 added, 0 deleted, 214 copies) (0.3 s)
create-shims.cjs: added: no file in base has its content (modulo specifiers)
fix-better-auth.cjs: added: no file in base has its content (modulo specifiers)
fix-imports.cjs: added: no file in base has its content (modulo specifiers)
restructure.cjs: added: no file in base has its content (modulo specifiers)
restructure2.cjs: added: no file in base has its content (modulo specifiers)
src/dao/BaseDao.ts: added: no file in base has its content (modulo specifiers)
src/dao/JsonFileBaseDao.ts: added: no file in base has its content (modulo specifiers)
src/db/VectorEmbeddingSubscriber.ts: added: no file in base has its content (modulo specifiers)
… 291 more
PASS K2 Byte-span confinement: 0 specifier spans changed in 0 files; every other byte identical (0.0 s)
FAIL K3a Resolution identity under TypeScript: 299 violations (299 added source files) (1.7 s)
create-shims.cjs: added: its 2 reference sites have no counterpart in base
fix-better-auth.cjs: added: its 2 reference sites have no counterpart in base
fix-imports.cjs: added: its 2 reference sites have no counterpart in base
restructure.cjs: added: its 2 reference sites have no counterpart in base
restructure2.cjs: added: its 2 reference sites have no counterpart in base
src/dao/BaseDao.ts: added: its 1 reference sites have no counterpart in base
src/dao/JsonFileBaseDao.ts: added: its 1 reference sites have no counterpart in base
src/db/VectorEmbeddingSubscriber.ts: added: its 1 reference sites have no counterpart in base
… 291 more
FAIL K3b Resolution identity under the test runner: jest 30.3.0: 939 violations (939 dangling in added files) (6.0 s)
src/features/abortisolatingfetch.test/utils/__tests__/abortIsolatingFetch.test.ts: site 0 '../abortIsolatingFetch.js' (import) in a file added in head does not resolve: unresolved (Configuration error: Could not locate module ../abortIsolatingFetch.js mapped as: $1. Please check your configuration for these entries: { "moduleNameMapper": { "/^(\.{1,2}\/.*)\.js$/": "$1" }, "resol)
src/features/activity/controllers/activityController.ts: site 1 '../dao/DaoFactory.js' (import) in a file added in head does not resolve: unresolved (Configuration error: Could not locate module ../dao/DaoFactory.js mapped as: $1. Please check your configuration for these entries: { "moduleNameMapper": { "/^(\.{1,2}\/.*)\.js$/": "$1" }, "resolver":)
src/features/activity/controllers/activityController.ts: site 2 '../types/index.js' (import) in a file added in head does not resolve: unresolved (Configuration error: Could not locate module ../types/index.js mapped as: $1. Please check your configuration for these entries: { "moduleNameMapper": { "/^(\.{1,2}\/.*)\.js$/": "$1" }, "resolver": un)
src/features/activity/controllers/activityController.ts: site 3 '../utils/logger.js' (import) in a file added in head does not resolve: unresolved (Configuration error: Could not locate module ../utils/logger.js mapped as: $1. Please check your configuration for these entries: { "moduleNameMapper": { "/^(\.{1,2}\/.*)\.js$/": "$1" }, "resolver": u)
src/features/activity/controllers/activityController.ts: site 4 '../utils/requireAdmin.js' (import) in a file added in head does not resolve: unresolved (Configuration error: Could not locate module ../utils/requireAdmin.js mapped as: $1. Please check your configuration for these entries: { "moduleNameMapper": { "/^(\.{1,2}\/.*)\.js$/": "$1" }, "resolv)
src/features/activity/dao/ActivityDao.ts: site 0 '../types/index.js' (import) in a file added in head does not resolve: unresolved (Configuration error: Could not locate module ../types/index.js mapped as: $1. Please check your configuration for these entries: { "moduleNameMapper": { "/^(\.{1,2}\/.*)\.js$/": "$1" }, "resolver": un)
src/features/activity/dao/ActivityDao.ts: site 1 './index.js' (import) in a file added in head does not resolve: unresolved (Configuration error: Could not locate module ./index.js mapped as: $1. Please check your configuration for these entries: { "moduleNameMapper": { "/^(\.{1,2}\/.*)\.js$/": "$1" }, "resolver": undefined)
src/features/activity/db/repositories/ActivityRepository.ts: site 2 '../connection.js' (import) in a file added in head does not resolve: unresolved (Configuration error: Could not locate module ../connection.js mapped as: $1. Please check your configuration for these entries: { "moduleNameMapper": { "/^(\.{1,2}\/.*)\.js$/": "$1" }, "resolver": und)
… 931 more
PASS K3c Resolution identity under the runtime: 4590 runtime sites resolve to map(base) under node/emit, tsx/source (6.6 s)
finding (added-file-unresolved) src/dao/BaseDao.ts: node/emit: export './../features/base/dao/BaseDao.ts' doesn't resolve (ERR_MODULE_NOT_FOUND) in a file with no base counterpart
finding (added-file-unresolved) src/dao/JsonFileBaseDao.ts: node/emit: export './../features/jsonfilebase/dao/JsonFileBaseDao.ts' doesn't resolve (ERR_MODULE_NOT_FOUND) in a file with no base counterpart
finding (added-file-unresolved) src/db/VectorEmbeddingSubscriber.ts: node/emit: export './../features/vectorembeddingsubscriber/db/VectorEmbeddingSubscriber.ts' doesn't resolve (ERR_MODULE_NOT_FOUND) in a file with no base counterpart
… 18 more findings
FAIL K4 Location scan: 0 path-exposing uses in moved files (and 52 in added files), 0 computed paths into changed directories, 0 old paths in code/config (0 in coverage settings) (0.9 s)
create-shims.cjs: added with no base counterpart; line 4: __dirname
fix-better-auth.cjs: added with no base counterpart; line 4: __dirname
fix-imports.cjs: added with no base counterpart; line 4: __dirname
restructure.cjs: added with no base counterpart; line 4: __dirname
restructure.cjs: added with no base counterpart; line 106: __dirname
restructure.cjs: added with no base counterpart; line 145: __dirname
restructure2.cjs: added with no base counterpart; line 4: __dirname
src/features/dao-demo/scripts/dao-demo.ts: a copy of src/scripts/dao-demo.ts; line 259: require.main
… 44 more
finding (stack-text) src/features/main/cli/main.ts: added with no base counterpart; 2 stack-trace reads passed along as text (line 78); their frames now name the new path
finding (stack-text) src/features/oauthcallback/controllers/oauthCallbackController.ts: a copy of src/controllers/oauthCallbackController.ts; 2 stack-trace reads passed along as text (line 474); their frames now name the new path
FAIL K6 Test inventory: jest 30.3.0: 76 violations (35 of 264 test files fail to load (base: 0), 38 new test files, 38 files in other jest projects) (25.7 s)
src/features/sseservice.test/services/sseService.test.ts: new in the jest test list (added in head; fails to load: ● Test suite failed to run Configuration error: Could not locate module ./mcpService.js mapped as: $1. Please check your configuration for these entries: { "moduleNameMapper": { "/^(\.{1,2}\/.*)\.js$/)
src/features/cacheutils.test/utils/cacheUtils.test.ts: new in the jest test list (added in head; fails to load: ● Test suite failed to run src/features/cacheutils.test/utils/cacheUtils.test.ts:8:11 - error TS1005: '=' expected. 8 import fs undefined ~~~~~~~~~ src/features/cacheutils.test/utils/cacheUtils.test.t)
src/features/openapi-oauth2.test/clients/__tests__/openapi-oauth2.test.ts: new in the jest test list (added in head; fails to load: ● Test suite failed to run Configuration error: Could not locate module ../openapi.js mapped as: $1. Please check your configuration for these entries: { "moduleNameMapper": { "/^(\.{1,2}\/.*)\.js$/":)
src/features/auth.test/middlewares/auth.test.ts: new in the jest test list (added in head; fails to load: ● Test suite failed to run src/features/auth.test/middlewares/auth.test.ts:1:16 - error TS1005: '=' expected. 1 import express undefined ~~~~~~~~~ src/features/auth.test/middlewares/auth.test.ts:2:16 )
src/features/openapi-spec-auth.test/clients/__tests__/openapi-spec-auth.test.ts: new in the jest test list (added in head; fails to load: ● Test suite failed to run src/features/openapi-spec-auth.test/clients/__tests__/openapi-spec-auth.test.ts:1:14 - error TS1005: '=' expected. 1 import axios undefined ~~~~~~~~~)
src/features/openapi-cookie.test/clients/__tests__/openapi-cookie.test.ts: new in the jest test list (added in head; fails to load: ● Test suite failed to run Configuration error: Could not locate module ../openapi.js mapped as: $1. Please check your configuration for these entries: { "moduleNameMapper": { "/^(\.{1,2}\/.*)\.js$/":)
src/features/openapi-request-body-content-types.test/clients/__tests__/openapi-request-body-content-types.test.ts: new in the jest test list (added in head; fails to load: ● Test suite failed to run src/features/openapi-request-body-content-types.test/clients/__tests__/openapi-request-body-content-types.test.ts:3:22 - error TS1005: 'from' expected. 3 import { OpenAPIV3 )
src/features/ssrf.test/utils/__tests__/ssrf.test.ts: new in the jest test list (added in head; fails to load: ● Test suite failed to run src/features/ssrf.test/utils/__tests__/ssrf.test.ts:1:39 - error TS1005: 'from' expected. 1 import { describe, expect, it, jest } undefined ~~~~~~~~~)
… 68 more
FAIL K8 Oracles on the commit: tsc exited 2 on head (101 diagnostics), 0 on base; unit 219/257 files and 1,934/1,952 cases equal to base (head: 222/257 files load, 1,952 passed, 0 failed, 0 skipped) (35.8 s)
tsc: `node_modules/.bin/tsc --outDir {scratch}/dist --incremental false --pretty false` exited 2 on head (101 diagnostics), exit 0 on base (log /tmp/ac-s4-certify/g3-mcphub-opencode-super-persistent.full/oracles/head/tsc/step-1.log)
src/features/activityrepository/db/repositories/ActivityRepository.ts: tsc: TS1005 'from' expected.
src/features/auth/middlewares/auth.ts: tsc: TS1005 'from' expected.
src/features/auth/middlewares/auth.ts: tsc: TS1005 '=' expected.
src/features/baserepository/db/repositories/BaseRepository.ts: tsc: TS1005 'from' expected.
src/features/bearerauth/utils/bearerAuth.ts: tsc: TS1005 'from' expected.
src/features/bearerkeyrepository/db/repositories/BearerKeyRepository.ts: tsc: TS1005 'from' expected.
src/features/builtinpromptrepository/db/repositories/BuiltinPromptRepository.ts: tsc: TS1005 'from' expected.
… 43 more
finding (network-attempt) unit on head: 5 network attempts refused (log /tmp/ac-s4-certify/g3-mcphub-opencode-super-persistent.full/oracles/head/unit/network.jsonl)
finding (network-attempt) unit on base: 5 network attempts refused (log /home/paseo/ac-work/s4/oracle-cache/mcphub-70cf036c90f8-unit-7840c52c5958cd0e/network.jsonl)
verdict: FAIL (static checks and oracles)
digest: sha256:468c1acbeedfdae859428e2b0a029c236e3e6757c0fd93e2ab6797d815cd4fe6
Ac-Certificate: fail (full) K0=pass K1=fail K2=pass K3=fail K4=fail K6=fail K8=fail
Ac-Certificate-Base: 70cf036c90f8239c2a11a57f137b588fce7d1b0c
Ac-Certificate-Digest: sha256:468c1acbeedfdae859428e2b0a029c236e3e6757c0fd93e2ab6797d815cd4fe6