FE-872: Install-failure classification — infra-vs-test split

[kostandinang]

Stacks on FE-871. Third Arc-1 frontier -- the FE-843-deferred fail/infra test-outcome split. No install verb: the install action stays agent-native (bash + FE-843 testConventions, A98).

What?

Make a broken toolchain distinguishable from a failing test, report it honestly, pin the promoted tree as reproducible, and make that classification visible everywhere tests run.

• Slice 1 -- classify (TestResult.failureKind, classifyTestFailure): a failed run carries 'infra' | 'test'. Classified conservatively -- only an unambiguous "runner isn't there" signal is infra (spawn ENOENT, shell command not found). Everything else, incl. a missing module, stays test (ambiguous with a legitimate TDD red -- mislabeling would silently skip a real failure). The tests-run report surfaces an aggregate failureKind.
• Slice 2 -- react (net-compiler.ts): when a slice exhausts retries because tests never ran, the halt reads toolchain/install failure (tests never ran in N attempts) instead of the misdirecting retry exhaustion.
• Slice 3 -- greenfield dep capture (promote-run.test.ts): the agent's manifest + lockfile are pinned as a promotion invariant via git ls-files -- turning promoteGreenfieldRun's incidental copy into an asserted reproducible-tree guarantee.
• Slice 4 -- unify the seam (runVerification): collapse the three diverged test-execution paths onto one TestRunner + one verdict helper, so failureKind is visible at every site, not just the net path.

Why?

TestResult was a single { passed } boolean, so a failed npm install looked identical to a logic bug -- sending the code-writer to "fix the code" while the toolchain never installed, then halting with a cause that named the wrong thing. And without a pinned capture invariant, a promoted tree could silently drop the lockfile. app-runtime-probe / integration-oracle depend on both: infra separated from test, and deps reproducible in the promoted tree.

Slice 4 closes the gap that slices 1-2 left: classification was only half-wired. evaluate-done and verify-epic ran tests through a private, spawn-based runTest that returned a bare boolean, so the new failureKind never reached them -- only the net run-tests path saw it. The duplicate execution path had also drifted (spawn vs spawnSync). Now there is one execution seam (TestRunner.run) and one verification seam (runVerification) owning the >=1-and-all-pass verdict rule and the infra-dominates aggregate; a runner that throws is treated as infra. pi-actions.runTest and evaluateVerificationTargets are deleted.

Scope discipline

Not a bespoke re-install arc -- the loop already retries and the agent re-installs via bash on its next turn. The harness owns only what bash install can't give: the classification, the honest terminal cause, the capture invariant, and one path that carries them.

Deferred

Brownfield dep-delta capture over the CoW baseline is blocked on brownfield-promotion (no brownfield promote path yet).

Co-authored-by: Amp amp@ampcode.com

[kostandinang]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• FE-881: Cook agent loads the target repo's sandbox-scoped skills #227
• FE-864: Orchestrator improvements #224
• FE-878: Brunch serve — one-shot plan-then-cook capstone #222
• FE-877: Brownfield promotion — commit the cook result onto cook/<runId> #221
• FE-876: Integration oracle — reachability gate + grounding seam #220
• FE-875: App runtime probe — boot, probe, classify #219
• FE-872: Install-failure classification — infra-vs-test split #218 👈 (View in Graphite)
• FE-871: Brunch toolchain detection — detect + plan-emitter wiring #214
• FE-867: Agent extension host — dual-mode pi-harness contract #213
• FE-864: Plan orchestrator brownfield enhancements #212 : 1 other dependent PR (#223 )
• FE-843: Toolchain profile expansion — TS runtimes + live profile selection #198
• FE-841: Embed pi as an in-process SDK to drop the external pi CLI dependency #194 : 1 other dependent PR (#211 )
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[cursor]

PR Summary

Medium Risk
Changes core cook verification, retry halt semantics, and shared test execution paths used by evaluate-done, verify-epic, and the Petri net; misclassification could still misroute retries, but behavior is conservative and well covered by new unit/contract tests.

Overview
FE-872 splits toolchain/install failures from test assertion failures so the cook loop and halt messages stop blaming code when the runner never ran.

Failed runs now carry optional failureKind: 'infra' | 'test' on TestResult, set by classifyTestFailure (only missing-runner signals count as infra; missing modules stay test for TDD reds). ToolchainTestRunner stamps this on failed spawns; runVerification is the single seam for the “≥1 target, all pass” verdict and infra-dominates aggregate, used by evaluate-done, verify-epic, and the net run-tests transition. The old pi-actions spawn/evaluateVerificationTargets path is removed; createPiActions takes an optional testRunner (wired from cook-cli).

When retries are exhausted with failureKind === 'infra', the slice halt reason becomes toolchain/install failure during verification instead of generic retry exhaustion. Reports (eval-done, epic-verified, tests-run) include failureKind.

Greenfield promotion gains a test that package.json and lockfile are tracked in git after promote (reproducible tree invariant). memory/PLAN.md and SPEC.md (A98) are updated for FE-872 / dogfood-spike status.

^{Reviewed by Cursor Bugbot for commit 371b6e4. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 371b6e4. Configure here.}