@6reduk/workspace-pipeline 0.1.0

package/src/migrations/legacy-unity-resume-apply.js

@@ -0,0 +1,39 @@
+import {randomUUID} from 'node:crypto';
+import {createLegacyUnityCloseoutLease,legacyUnityLeasePayload} from './legacy-unity-lease.js';
+import {prepareLegacyUnityCloseoutResume} from './legacy-unity-resume.js';
+import {acquireWorkspaceLock} from '../operations/lock.js';
+import {writeCheckedFile,deleteCheckedFile} from '../operations/apply.js';
+import {readRecord} from '../operations/state.js';
+import {resolveChild} from '../workspace/paths.js';
+import {contractDigest} from '../contracts/semantic.js';
+import {sha256} from '../source/inventory.js';
+import {fail} from '../contracts/parse.js';
+
+// Executes only reconstructed closeout operations, never caller-supplied paths.
+export async function applyLegacyUnityCloseoutResume(proposal,approval,workspace,{boundary=async()=>{}}={}){
+ const {lease,preview}=await createLegacyUnityCloseoutLease(proposal,approval,workspace);
+ const lock=await acquireWorkspaceLock(workspace,{migrationOperation:lease});
+ try{
+  const payload=legacyUnityLeasePayload(lease,lock.workspace);
+  const check=()=>prepareLegacyUnityCloseoutResume(lock.workspace,preview.recoveryPath);
+  if(contractDigest(await check())!==contractDigest(preview))fail('migration.resume-drift');
+  const authorizationPath=preview.recoveryPath.replace(/recovery\.json$/,`closeout-authorizations/${randomUUID()}.json`);
+  const authorizationBytes=Buffer.from(JSON.stringify({schemaVersion:1,
+   kind:'legacy-unity-closeout-authorization',preview,approval:{decision:'approve',previewDigest:preview.digest}})+'\n');
+  await writeCheckedFile(lock,authorizationPath,null,authorizationBytes);
+  await boundary('authorization-recorded');
+  if(contractDigest(await check())!==contractDigest(preview))fail('migration.resume-drift');
+  const creation=preview.operations.find(o=>o.action==='create');
+  if(creation)await writeCheckedFile(lock,creation.path,null,Buffer.from(JSON.stringify(creation.value)+'\n'));
+  await boundary('completion-recorded');
+  const final=await check();
+  if(contractDigest(final.verified)!==contractDigest(preview.verified)||final.observations.marker!==preview.observations.marker||
+   final.observations.recovery!==preview.observations.recovery||final.operations.length!==1||final.operations[0].action!=='delete')fail('migration.resume-drift');
+  const completionPath=preview.recoveryPath.replace(/recovery\.json$/,'completion.json');
+  const completion=await readRecord(resolveChild(lock.workspace,completionPath));
+  if(completion.digest!==final.observations.completion)fail('migration.completion-drift');
+  if((await readRecord(resolveChild(lock.workspace,authorizationPath))).digest!==sha256(authorizationBytes))fail('migration.authorization-drift');
+  await deleteCheckedFile(lock,payload.markerPath,payload.markerHash,async()=>{});
+  return {status:'completed',authorizationPath,completionPath,completionHash:completion.digest,runtime:'not-run'};
+ }finally{await lock.release();}
+}

package/src/migrations/legacy-unity-resume.js

@@ -0,0 +1,41 @@
+import {absoluteRoot,resolveChild} from '../workspace/paths.js';
+import {readRecord,observeTargets} from '../operations/state.js';
+import {contractDigest} from '../contracts/semantic.js';
+import {sha256} from '../source/inventory.js';
+import {fail} from '../contracts/parse.js';
+import {inspectInstalledLegacyUnityMigration} from './legacy-unity-finalize.js';
+
+// Narrow restart preview: installed phases only, not partial-target recovery.
+// Digests bind observations, not authorization. No lock or write is performed.
+export async function prepareLegacyUnityCloseoutResume(workspace,recoveryPath){
+ workspace=absoluteRoot(workspace);
+ if(typeof recoveryPath!=='string'||!/^\.pipeline\/migrations\/[a-f0-9-]{36}\/recovery\.json$/.test(recoveryPath))fail('migration.recovery-path');
+ const markerPath='.pipeline/migration-operation.json';
+ const marker=await readRecord(resolveChild(workspace,markerPath));
+ const recovery=await readRecord(resolveChild(workspace,recoveryPath));
+ const r=recovery.value,p=r.preview;
+ if(r.kind!=='legacy-unity-recovery'||r.schemaVersion!==1||r.workspace!==workspace||
+  recoveryPath!==`.pipeline/migrations/${r.id}/recovery.json`||p?.workspace!==workspace)fail('migration.recovery-binding');
+ const {digest,...body}=p;
+ if(contractDigest(body)!==digest||contractDigest(r.approval)!==contractDigest({decision:'approve',previewDigest:digest}))fail('migration.preview-binding');
+ const expected={schemaVersion:1,kind:'legacy-unity-pending',workspace,recoveryPath,recoveryHash:recovery.digest,previewDigest:digest};
+ if(contractDigest(marker.value)!==contractDigest(expected))fail('migration.marker-binding');
+ const verified=await inspectInstalledLegacyUnityMigration(workspace,{recoveryPath,recoveryHash:recovery.digest});
+ const completionPath=recoveryPath.replace(/recovery\.json$/,'completion.json');
+ const [completion]=await observeTargets(workspace,[completionPath]);
+ const completionValue={schemaVersion:1,kind:'legacy-unity-completion',workspace,...verified,runtime:'not-run'};
+ if(completion.bytes!==null){
+  const record=await readRecord(resolveChild(workspace,completionPath));
+  if(record.digest!==sha256(completion.bytes)||contractDigest(record.value)!==contractDigest(completionValue))fail('migration.completion-drift');
+ }
+ const observations={marker:marker.digest,recovery:recovery.digest,completion:completion.bytes===null?null:sha256(completion.bytes)};
+ if((await readRecord(resolveChild(workspace,markerPath))).digest!==marker.digest||
+  contractDigest(await inspectInstalledLegacyUnityMigration(workspace,{recoveryPath,recoveryHash:recovery.digest}))!==contractDigest(verified))fail('migration.resume-drift');
+ const [last]=await observeTargets(workspace,[completionPath]);
+ if((last.bytes===null?null:sha256(last.bytes))!==observations.completion)fail('migration.resume-drift');
+ const result={schemaVersion:1,kind:'legacy-unity-closeout-preview',workspace,recoveryPath,observations,verified,
+  operations:[...(completion.bytes===null?[{action:'create',path:completionPath,value:completionValue}]:[]),
+   {action:'delete',path:markerPath,beforeHash:marker.digest}],
+  status:'needs-approval',executable:false,runtime:'not-run'};
+ return {...result,digest:contractDigest(result)};
+}

package/src/migrations/legacy-unity-resumed-evidence.js

@@ -0,0 +1,88 @@
+import {readdir} from 'node:fs/promises';
+import {resolveChild,inspectDirectory} from '../workspace/paths.js';
+import {readRecord} from '../operations/state.js';
+import {contractDigest} from '../contracts/semantic.js';
+import {fail} from '../contracts/parse.js';
+import {validateLegacyUnityDeactivation} from './legacy-unity.js';
+
+// One explicit completed attempt; never choose newest among competing histories.
+export async function verifyLegacyUnityResumedEvidence(workspace,recoveryPath,recoveryHash,original){
+ const root=recoveryPath.replace(/recovery\.json$/,'deactivation-resumes');
+ if(!(await inspectDirectory(resolveChild(workspace,root))).exists)return null;
+ const attempts=await readdir(resolveChild(workspace,root));
+ if(attempts.length!==1||! /^[a-f0-9]{64}$/.test(attempts[0]))fail('migration.resume-selection');
+ const directory=root+'/'+attempts[0];await inspectDirectory(resolveChild(workspace,directory));
+ const names=(await readdir(resolveChild(workspace,directory))).sort();
+ if(names.join(',')!=='000000.json,000001.json,000002.json,000003.json,000004.json,000005.json')fail('migration.resume-incomplete');
+ const records=[];for(const name of names)records.push(await readRecord(resolveChild(workspace,directory+'/'+name)));
+ const authorization=records[0].value.detail,p=authorization?.preview;
+ if(!p||p.kind!=='legacy-unity-deactivation-resume-preview'||p.workspace!==workspace||p.recoveryPath!==recoveryPath||
+  p.recoveryHash!==recoveryHash||p.status!=='needs-approval'||p.conflicts?.length!==0||p.digest!=='sha256:'+attempts[0])fail('migration.resume-binding');
+ const {digest,...body}=p;
+ if(contractDigest(body)!==digest||contractDigest(authorization.approval)!==contractDigest({decision:'approve',previewDigest:digest}))fail('migration.resume-binding');
+ const marker=await readRecord(resolveChild(workspace,'.pipeline/migration-operation.json'));
+ if(marker.digest!==p.markerHash||contractDigest(marker.value)!==contractDigest({schemaVersion:1,kind:'legacy-unity-pending',
+  workspace,recoveryPath,recoveryHash,previewDigest:original.digest}))fail('migration.marker-binding');
+ const phase=validateLegacyUnityDeactivation(original.preflight.deactivation);
+ const expectedObservations=new Map(original.initialObservations.map(o=>[o.path,o.hash]));
+ for(const o of original.preflight.observations){
+  if(expectedObservations.has(o.path)&&expectedObservations.get(o.path)!==o.sha256)fail('migration.observation-binding');
+  expectedObservations.set(o.path,o.sha256);
+ }
+ if(!Array.isArray(p.observations)||p.observations.length!==expectedObservations.size||new Set(p.observations.map(o=>o.path)).size!==p.observations.length)fail('migration.resume-binding');
+ for(const o of p.observations){
+  const target=phase.targets.find(t=>t.path===o.path);
+  if(!expectedObservations.has(o.path)||(!target&&o.hash!==expectedObservations.get(o.path))||
+   (target&&o.hash!==target.beforeHash&&o.hash!==target.afterHash))fail('migration.resume-binding');
+ }
+ const oldDirectory=recoveryPath.replace(/recovery\.json$/,'deactivation');
+ const oldNames=(await inspectDirectory(resolveChild(workspace,oldDirectory))).exists?(await readdir(resolveChild(workspace,oldDirectory))).sort():[];
+ if(!Array.isArray(p.events)||oldNames.length!==p.events.length||oldNames.length>6)fail('migration.phase-evidence');
+ let previous=null,stopped=false;const intents=new Set(),completed=new Set();
+ for(let seq=0;seq<oldNames.length;seq++){
+  const name=String(seq).padStart(6,'0')+'.json',relative=oldDirectory+'/'+name;
+  if(stopped||oldNames[seq]!==name||p.events[seq].path!==relative)fail('migration.phase-evidence');
+  const record=await readRecord(resolveChild(workspace,relative));let expected;
+  if(record.digest!==p.events[seq].hash)fail('migration.phase-evidence');
+  if(seq===0)expected={kind:'start',detail:null};
+  else if(seq===5)expected={kind:'phase-checked',detail:{phase:'deactivate-legacy'}};
+  else{
+   const t=phase.targets[Math.floor((seq-1)/2)];
+   if(seq%2){expected={kind:'intent',detail:{path:t.path,beforeHash:t.beforeHash,afterHash:t.afterHash}};intents.add(t.path);}
+   else{
+    const d=record.value.detail;
+    if(!d||!['completed','failed','uncertain'].includes(d.status)||!(d.observedHash===null||/^sha256:[a-f0-9]{64}$/.test(d.observedHash))||
+     d.status==='completed'&&d.observedHash!==t.afterHash||d.status==='failed'&&d.observedHash!==t.beforeHash)fail('migration.phase-evidence');
+    stopped=d.status!=='completed';if(!stopped)completed.add(t.path);
+    expected={kind:'outcome',detail:{path:t.path,status:d.status,observedHash:d.observedHash}};
+   }
+  }
+  if(contractDigest(record.value)!==contractDigest({schemaVersion:1,seq,previous,recoveryHash,...expected}))fail('migration.phase-evidence');
+  previous=record.digest;
+ }
+ const operations=phase.targets.map(t=>{
+  const hash=p.observations.find(o=>o.path===t.path).hash;
+  const state=hash===t.beforeHash?(t.beforeHash===t.afterHash?'unchanged-disabled':'before'):'after';
+  if(state==='after'&&!intents.has(t.path)||state==='before'&&completed.has(t.path))fail('migration.resume-binding');
+  return {path:t.path,action:state==='before'?'write-disabled':'confirm-observed',state,beforeHash:hash,afterHash:t.afterHash};
+ });
+ if(contractDigest(p.operations)!==contractDigest(operations))fail('migration.resume-binding');
+ const classifications=operations.map(o=>({provider:phase.targets.find(t=>t.path===o.path).provider,path:o.path,state:o.state}));
+ if(contractDigest(p.classifications)!==contractDigest(classifications))fail('migration.resume-binding');
+ const expected=[{kind:'authorization',detail:authorization}];
+ for(const o of operations)expected.push({kind:'intent',detail:o},{kind:'outcome',detail:{path:o.path,
+  status:o.action==='write-disabled'?'written':'confirmed-observed',observedHash:o.afterHash}});
+ expected.push({kind:'phase-observed',detail:{phase:'deactivate-legacy',recoveryHash}});
+ previous=null;
+ for(let seq=0;seq<records.length;seq++){
+  if(contractDigest(records[seq].value)!==contractDigest({schemaVersion:1,seq,previous,...expected[seq]}))fail('migration.resume-evidence');
+  previous=records[seq].digest;
+ }
+ for(let i=0;i<names.length;i++)if((await readRecord(resolveChild(workspace,directory+'/'+names[i]))).digest!==records[i].digest)fail('migration.journal-drift');
+ if((await readdir(resolveChild(workspace,root))).sort().join(',')!==attempts.sort().join(',')||
+  (await readdir(resolveChild(workspace,directory))).sort().join(',')!==names.join(','))fail('migration.journal-drift');
+ for(const e of p.events)if((await readRecord(resolveChild(workspace,e.path))).digest!==e.hash)fail('migration.journal-drift');
+ const oldFinal=(await inspectDirectory(resolveChild(workspace,oldDirectory))).exists?(await readdir(resolveChild(workspace,oldDirectory))).sort():[];
+ if(oldFinal.join(',')!==oldNames.join(','))fail('migration.journal-drift');
+ return {directory,head:previous};
+}

package/src/migrations/legacy-unity.js

@@ -0,0 +1,99 @@
+// Pure preparation; no filesystem, authorization, installation or rollback.
+import {parseTOML, getStaticTOMLValue} from 'toml-eslint-parser';
+import {parseDocument} from 'yaml';
+import {isDeepStrictEqual} from 'node:util';
+import {createHash} from 'node:crypto';
+import {parse, fail, MAX_INPUT_BYTES} from '../contracts/parse.js';
+import {utf8} from '../source/inventory.js';
+import {contractDigest} from '../contracts/semantic.js';
+import {requestShape} from '../operations/ownership.js';
+const id='unity-sdd-pipeline@unity-sdd';
+const hash=b=>'sha256:'+createHash('sha256').update(b).digest('hex');
+const object=v=>v!==null&&typeof v==='object'&&!Array.isArray(v);
+function toml(text){try{const ast=parseTOML(text,{tomlVersion:'1.0'});return {ast,value:getStaticTOMLValue(ast)};}catch{fail('migration.toml');}}
+const keys=k=>k.keys.map(x=>x.type==='TOMLBare'?x.name:x.value);
+export function prepareLegacyUnityOptOut(provider,bytes){
+ if(!['codex','claude'].includes(provider))fail('migration.provider');
+ if(!Buffer.isBuffer(bytes)||bytes.length>MAX_INPUT_BYTES)fail('migration.input');
+ const text=utf8(bytes);let value,range,read;
+ if(provider==='codex'){
+  const parsed=toml(text);value=parsed.value;read=s=>toml(s).value;
+  const matches=[];
+  const pair=(node,base)=>{if(isDeepStrictEqual([...base,...keys(node.key)],['plugins',id,'enabled']))matches.push(node.value.range);};
+  for(const node of parsed.ast.body[0].body){
+   if(node.type==='TOMLKeyValue')pair(node,[]);
+   else if(node.type==='TOMLTable'&&node.kind==='standard')for(const item of node.body)pair(item,node.resolvedKey);
+  }
+  if(!object(value.plugins)||!object(value.plugins[id])||typeof value.plugins[id].enabled!=='boolean')fail('migration.activation-missing');
+  if(value.plugins[id].enabled){if(matches.length!==1)fail('migration.toml-layout');range=matches[0];}
+  value.plugins[id].enabled=false;
+ }else{
+  value=parse(text,'json');read=s=>parse(s,'json');
+  if(!object(value)||!object(value.enabledPlugins)||typeof value.enabledPlugins[id]!=='boolean')fail('migration.activation-missing');
+  if(value.enabledPlugins[id])range=parseDocument(text).getIn(['enabledPlugins',id],true)?.range?.slice(0,2);
+  value.enabledPlugins[id]=false;
+ }
+ let output=text;
+ if(range){if(text.slice(...range)!=='true')fail('migration.layout');output=text.slice(0,range[0])+'false'+text.slice(range[1]);}
+ if(!isDeepStrictEqual(read(output),value))fail('migration.postcondition');
+ const after=Buffer.from(output);
+ return {provider,path:provider==='codex'?'.codex/config.toml':'.claude/settings.local.json',beforeHash:hash(bytes),afterHash:hash(after),changed:!bytes.equals(after),bytes:after};
+}
+
+// Configuration-only phase: entry replacement and installation are deliberately
+// NOT encoded here. The outer migration coordinator must prefetch first and bind
+// this phase to its complete approved migration, using the existing workspace lock.
+export function prepareLegacyUnityDeactivation(observations){
+ if(!Array.isArray(observations)||observations.length!==2)fail('migration.observations');
+ const found=new Map();
+ for(const item of observations){
+  requestShape(item,['provider','bytes'],[],'migration.observations');
+  if(found.has(item.provider))fail('migration.observations');
+  found.set(item.provider,prepareLegacyUnityOptOut(item.provider,item.bytes));
+ }
+ if(!found.has('codex')||!found.has('claude'))fail('migration.observations');
+ const targets=['codex','claude'].map(provider=>{
+  const result=found.get(provider),before=observations.find(x=>x.provider===provider).bytes;
+  return {provider,path:result.path,beforeHash:result.beforeHash,afterHash:result.afterHash,
+   before:before.toString('base64'),after:result.bytes.toString('base64')};
+ });
+ const body={schemaVersion:1,kind:'legacy-unity-deactivation',targets};
+ return {...body,digest:contractDigest(body)};
+}
+
+export function validateLegacyUnityDeactivation(record){
+ requestShape(record,['schemaVersion','kind','targets','digest'],[],'migration.record');
+ if(record.schemaVersion!==1||record.kind!=='legacy-unity-deactivation'||!Array.isArray(record.targets)||record.targets.length!==2)fail('migration.record');
+ const observations=record.targets.map(t=>{
+  requestShape(t,['provider','path','beforeHash','afterHash','before','after'],[],'migration.record');
+  if(Object.values(t).some(v=>typeof v!=='string'))fail('migration.record');
+  if(typeof t.before!=='string'||t.before.length>Math.ceil(MAX_INPUT_BYTES/3)*4)fail('migration.record');
+  const bytes=Buffer.from(t.before,'base64');
+  if(bytes.toString('base64')!==t.before)fail('migration.record');
+  return {provider:t.provider,bytes};
+ });
+ const rebuilt=prepareLegacyUnityDeactivation(observations);
+ // Rebuild transformations; a caller-supplied digest alone grants no scope.
+ // The strict record reader returns null-prototype JSON objects. Prototype is
+ // not persisted identity; validated keys/values and ordering are.
+ if(contractDigest(record)!==contractDigest(rebuilt))fail('migration.binding');
+ return rebuilt;
+}
+
+// Observation classification only, never an instruction to write or restore.
+// An after-state could have been written by somebody else: hash equality is not
+// ownership or proof that this migration executed it.
+export function inspectLegacyUnityDeactivation(record,observations){
+ const checked=validateLegacyUnityDeactivation(record);
+ if(!Array.isArray(observations)||observations.length!==2)fail('migration.observations');
+ const found=new Map();
+ for(const item of observations){
+  requestShape(item,['provider','bytes'],[],'migration.observations');
+  if(!['codex','claude'].includes(item.provider)||found.has(item.provider)||
+    (item.bytes!==null&&(!Buffer.isBuffer(item.bytes)||item.bytes.length>MAX_INPUT_BYTES)))fail('migration.observations');
+  found.set(item.provider,item.bytes===null?null:hash(item.bytes));
+ }
+ return checked.targets.map(t=>({provider:t.provider,path:t.path,
+  state:found.get(t.provider)===t.beforeHash?(t.beforeHash===t.afterHash?'unchanged-disabled':'before'):
+   found.get(t.provider)===t.afterHash?'after':'conflict'}));
+}