kairos-chain 3.62.0 → 3.64.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d07ef9eddf8433aed348e6ff25d910547da041e89abdf94dc6e5008f2148f417
-  data.tar.gz: bddb2825ffb56e57681be7a1c368e683103133dad90888dff052a8fc5c430ae8
+  metadata.gz: 4ba66e678675e9b4e7776676832765d509f0ac7bb49feed159ee1513ba4b7318
+  data.tar.gz: 28af1484af3a0c98529603bfa30fd9ff188e5b18895c06c11a313bcf3a95d8b2
 SHA512:
-  metadata.gz: f432b43e89098c0d794b8e96d8241009802a6ca41e71804ab77f0ad73abaac07aa0b413889f5d84f0425e22bfddcc6f9fa9a3cbc968196bd6ddbda843e89d1f1
-  data.tar.gz: ff82bd049b30fd06ba14d529ff3910ca9d540c071f441519c23f0189619b90a1b1bfa072449713ba8b53bd575cd5dde763eed6022d141465849f8b6769e5e862
+  metadata.gz: 67e98820708350d674970e3db49f3583efc01491ba8d58f5ecb702b988f64a5ad1efeb083637f45e77897c44dbb30a84569400431e8f669020fb13a2dae7b4aa
+  data.tar.gz: 27fef53ab90cdb4a7745955b49d41e3834d8313f0a0417605a96e21e84b0ab44fcb5c0e3ad27d9ff2cf698bda2a75c0dc7712869ab5e686daeb8cc468da77cdf

data/CHANGELOG.md

@@ -4,6 +4,84 @@ All notable changes to the `kairos-chain` gem will be documented in this file.
 
 This project follows [Semantic Versioning](https://semver.org/).
 
+## [3.64.0] - 2026-08-06
+
+### Fixed
+
+- **An append can no longer erase the chain history on disk.** Two paths
+  erased history before this release, both measured, neither raising an
+  exception: two holders of the chain at the same length both saved and the
+  second save replaced the disk sequence with its own; and a ledger that
+  existed but could not be read collapsed to nil, read as a fresh install,
+  and the next save rebuilt from genesis over it — 687 blocks became 2. An
+  append now takes a key file beside the ledger, re-reads and classifies the
+  disk under that key (absent / unreadable / empty / corrupt / readable),
+  refuses every state but `:readable` and `:absent`, and always builds on
+  the tail that is on disk at that moment. Failures on the read and write
+  side raise `Storage::Error` instead of flattening into nil or false, and
+  every reader consults `Chain#load_state` before trusting the sequence.
+  Includes the 3.62.1 locale fix, and one more of the same family: while
+  the ledger does not yet exist, a symlinked name resolves to its target
+  before the lock key is derived, so a fresh install reached through two
+  names is written under one key (measured pre-fix: 51 blocks shrank to
+  35–49 under concurrent two-name appends). Verified by 149 assertions and
+  a 34-row falsification harness in which each protective mechanism is
+  removed in isolation and its named check confirmed to go red.
+
+## [3.62.1] - 2026-08-06
+
+### Fixed
+
+- **A non-UTF-8 locale no longer erases the ledger on the next append.**
+  Emergency hotfix cut from the shipped 3.62.0 (branch
+  `hotfix/utf8-ledger-read`): `FileBackend#load_blocks` read
+  `blockchain.json` with the locale-derived default encoding, so a
+  LANG-unset start (launchd, cron, plain containers) made a non-ASCII
+  ledger unparseable, the failure was flattened into "no ledger", and one
+  ordinary append overwrote 705 blocks with 2 (measured on a copy of a
+  production ledger). The ledger is now read as UTF-8 explicitly. This is
+  the only change over 3.62.0; 3.64.0 contains the full erasure fix.
+
+## [3.63.0] - 2026-08-06
+
+### Changed
+
+- **`multi_llm_review` findings gain a weight axis, and a worker death no
+  longer discards completed seats** (SkillSet 0.9.1 → 0.10.0, frozen after one
+  review round; every deployment-grounded finding fixed in-round).
+
+  The severity of a finding said what kind of defect it was, never what it
+  costs: measured on a three-persona panel, 3 of one round's 7 P0s were
+  factually correct findings that cost nobody anything, landing at the same
+  severity as a defect that silently corrupts published output. The reviewer
+  prompt contract now requires a `[consequence: who is harmed, and how]`
+  clause on every P0, and aggregation records an unclaused P0 at P2 with the
+  stated severity and the demotion reason kept beside it. Only presence is
+  checked, mechanically; whether a stated consequence is real or trivial
+  stays the orchestrator's call. The clause is read before the byte bound
+  cuts the tail, the first non-empty clause counts, deduplication compares
+  issues without their clauses, and the demotion mark survives merging in
+  any member order. Reviewer prompts also stop naming the round number, and
+  the L1 workflow knowledge (v3.10.0) adds the matching orchestrator-side
+  rule: never tell a reviewer its finding count, the round number, or prior
+  verdicts — counts a reviewer performs select for finding-production over
+  finding-weight.
+
+  Separately, one stuck seat used to cost a whole round: a stale heartbeat
+  killed the detached worker and every completed seat's reply died with it,
+  because nothing left the worker's memory until all seats were done. The
+  worker now persists each seat's outcome the moment it is decided
+  (`partial_results.json`, atomic, single writer — including the
+  dispatcher's own deadline skips, so recovery cannot relabel a reached
+  seat as lost). The collect tool's crash and timeout branches recover the
+  completed seats, but only after the reaper CONFIRMS the worker's death: a
+  stale heartbeat is not a death certificate, and a record sealed over a
+  live worker would be permanently false once idempotent replay pins it.
+  Unconfirmed death falls back to the previous retryable total-loss report.
+  Seats the worker never reached enter the denominator as skip rows named
+  `worker_crashed_seat_lost`, and the payload carries `worker_failure`
+  naming the death and the recovered and lost seat labels.
+
 ## [3.62.0] - 2026-08-06
 
 ### Changed

data/lib/kairos_mcp/admin/router.rb

@@ -346,6 +346,7 @@ module KairosMcp
 
         html_response(200, render_partial('_chain_blocks',
                                           blocks: paged_blocks,
+                                          load_state: chain.load_state,
                                           total: total,
                                           limit: limit,
                                           offset: offset))
@@ -353,6 +354,10 @@ module KairosMcp
 
       def handle_chain_block_detail_partial(index)
         chain = KairosChain::Chain.new
+        unless chain.valid?
+          return html_response(200, "<p>Block ##{index} unavailable: ledger is #{chain.load_state}.</p>")
+        end
+
         block = chain.chain.find { |b| b.respond_to?(:index) ? b.index == index : b['index'] == index }
 
         if block
@@ -364,13 +369,17 @@ module KairosMcp
 
       def handle_chain_verify_partial
         chain = KairosChain::Chain.new
-        valid = chain.valid?
-        length = chain.chain.length
 
-        result = if valid
-                   "<div class='flash flash-success'>Chain is valid. #{length} blocks verified.</div>"
+        # Three outcomes: a ledger that does not exist yet is not a failure.
+        result = case chain.load_state
+                 when :readable
+                   "<div class='flash flash-success'>Chain is valid. " \
+                     "#{chain.chain.length} blocks verified.</div>"
+                 when :absent
+                   "<div class='flash'>Chain not created yet. Nothing to verify.</div>"
                  else
-                   "<div class='flash flash-error'>Chain integrity check FAILED!</div>"
+                   "<div class='flash flash-error'>Chain integrity check FAILED! " \
+                     "(state: #{chain.load_state})</div>"
                  end
         html_response(200, result)
       end
@@ -475,17 +484,20 @@ module KairosMcp
         backend = SkillsConfig.storage_backend
 
         latest = chain.latest_block
-        latest_h = latest.respond_to?(:to_h) ? latest.to_h : latest
+        latest_h = latest.respond_to?(:to_h) ? latest&.to_h : latest
 
         {
           valid: chain.valid?,
+          state: chain.load_state,
           length: chain.chain.length,
           storage: { backend: backend },
           latest_block: latest_h
         }
       rescue StandardError => e
-        { valid: false, length: 0, storage: { backend: 'unknown' },
-          latest_block: {}, error: e.message }
+        # Chain.new does not raise; this branch is reachable only for failures
+        # outside the ledger (config, rendering). It must not fabricate a state.
+        { valid: false, state: :error, length: 0, storage: { backend: 'unknown' },
+          latest_block: nil, error: e.message }
       end
 
       def fetch_knowledge_list(search: nil)

data/lib/kairos_mcp/admin/views/chain.erb

@@ -11,13 +11,18 @@
     <div>
       <p>
         <strong>Status:</strong>
+        <%# Three displays, not two: an absent ledger is a fresh install. %>
         <% if chain[:valid] %>
           <span class="badge badge-success">Valid</span>
+        <% elsif chain[:state] == :absent %>
+          <span class="badge">Not created yet</span>
         <% else %>
-          <span class="badge badge-error">Invalid</span>
+          <span class="badge badge-error">Invalid (<%= h(chain[:state].to_s) %>)</span>
         <% end %>
       </p>
-      <p><strong>Length:</strong> <%= chain[:length] %> blocks</p>
+      <% if chain[:valid] %>
+        <p><strong>Length:</strong> <%= chain[:length] %> blocks</p>
+      <% end %>
     </div>
     <div>
       <p><strong>Backend:</strong> <%= h(chain.dig(:storage, :backend) || 'unknown') %></p>

data/lib/kairos_mcp/admin/views/dashboard.erb

@@ -9,13 +9,18 @@
   <article>
     <header>Blockchain</header>
     <p>
+      <%# Three displays, not two: an absent ledger is a fresh install. %>
       <% if chain[:valid] %>
         <span class="badge badge-success">Valid</span>
+      <% elsif chain[:state] == :absent %>
+        <span class="badge">Not created yet</span>
       <% else %>
-        <span class="badge badge-error">Invalid</span>
+        <span class="badge badge-error">Invalid (<%= h(chain[:state].to_s) %>)</span>
       <% end %>
     </p>
-    <p><strong><%= chain[:length] %></strong> blocks</p>
+    <% if chain[:valid] %>
+      <p><strong><%= chain[:length] %></strong> blocks</p>
+    <% end %>
     <p><small>Backend: <%= h(chain.dig(:storage, :backend) || 'unknown') %></small></p>
     <footer><a href="/admin/chain">View Chain &rarr;</a></footer>
   </article>

data/lib/kairos_mcp/admin/views/partials/_chain_blocks.erb

@@ -1,5 +1,13 @@
 <% if blocks.empty? %>
-  <p>No blocks found.</p>
+  <%# Three displays, not two: an absent ledger is a fresh install, and an
+      unreadable one must not be reported as an empty history. %>
+  <% if load_state == :readable %>
+    <p>No blocks found.</p>
+  <% elsif load_state == :absent %>
+    <p>Chain not created yet.</p>
+  <% else %>
+    <p>History unavailable: ledger is <%= h(load_state.to_s) %>.</p>
+  <% end %>
 <% else %>
   <div class="overflow-auto">
     <table>

data/lib/kairos_mcp/drift_detection/correspondence_checker.rb

@@ -64,7 +64,23 @@ module KairosMcp
           end
 
           active = Digest::SHA256.hexdigest(File.read(md_file_path))
-          recorded = recorded_digest_for(name, storage_backend)
+
+          chain = KairosChain::Chain.new(storage_backend: storage_backend)
+          # :absent completes normally: a fresh install has no ledger, the scan
+          # over zero blocks finds nothing, and :missing_record is the honest
+          # verdict. The other failed states mean provenance is UNAVAILABLE,
+          # which is not the same claim as "never recorded" — reporting
+          # :missing_record there would accuse every artifact whenever the
+          # ledger cannot be read.
+          unless chain.valid? || chain.load_state == :absent
+            return Result.new(
+              status: :error, name: name,
+              active_digest: active, recorded_digest: nil,
+              message: "L1 '#{name}': provenance unavailable — ledger state is #{chain.load_state}"
+            )
+          end
+
+          recorded = recorded_digest_for(name, chain)
 
           if recorded.nil?
             return Result.new(
@@ -101,8 +117,7 @@ module KairosMcp
         # the most recent knowledge_update record, scanning the chain from head
         # backward. Returns nil when the most recent relevant record removed the
         # artifact (next_hash nil — delete/archive) or when none exists.
-        def recorded_digest_for(name, storage_backend)
-          chain = KairosChain::Chain.new(storage_backend: storage_backend)
+        def recorded_digest_for(name, chain)
           chain.chain.reverse_each do |block|
             Array(block.data).each do |entry|
               record = parse_entry(entry)