@abelxiaoxing/cadence 1.5.2 → 1.6.0

package/src/package-workflow.ts

@@ -14,6 +14,7 @@ import type { PackageContext } from "./model-source.ts";
 import { inspectOpenSpecDelivery } from "./openspec-cli.ts";
 import { proposePackageCandidate } from "./package-candidate.ts";
 import { packageDeliverySource } from "./package-delivery.ts";
+import { acquirePackageState } from "./package-state.ts";
 import {
   changeVerificationResult,
   executePackageVerification,
@@ -79,6 +80,42 @@ function affectedVerification(
 
 export function openPackageWorkflowService(
   initialContext: PackageContext,
+): PackageWorkflowService {
+  const state = acquirePackageState(
+    resolveStateRoot({
+      consumerRoot: path.resolve(initialContext.cwd),
+      xdgStateHome: process.env.XDG_STATE_HOME,
+    }),
+  );
+  try {
+    const service = openPreparedPackageWorkflowService(initialContext);
+    const notice = (result: Record<string, unknown>) =>
+      state.notice ? { ...result, packageStateReset: state.notice } : result;
+    return {
+      ...service,
+      async execute(...args) {
+        return notice(await service.execute(...args));
+      },
+      async executeDesign(...args) {
+        return notice(await service.executeDesign(...args));
+      },
+      async executeAmendment(...args) {
+        return notice(await service.executeAmendment(...args));
+      },
+      async close() {
+        // Never release ownership while an executor or storage connection may survive.
+        await service.close();
+        state.close();
+      },
+    };
+  } catch (error) {
+    state.close();
+    throw error;
+  }
+}
+
+function openPreparedPackageWorkflowService(
+  initialContext: PackageContext,
 ): PackageWorkflowService {
   const consumerRoot = path.resolve(initialContext.cwd);
   const routeResolution = loadRoutePolicy({
@@ -102,180 +139,188 @@ export function openPackageWorkflowService(
     stateRoot,
     inspectOpenSpec: inspectOpenSpecDelivery,
   });
-  const implementationAgent = loadAgentDefinitions().find(
-    (agent) => agent.role === "implementation-worker",
-  );
-  if (!implementationAgent) {
-    throw new Error("implementation-worker-agent-unavailable");
-  }
-  const hostLimit = (name: string, fallback: number): number => {
-    const value =
-      process.env[name] === undefined ? fallback : Number(process.env[name]);
-    if (!Number.isSafeInteger(value) || value < 1)
-      throw new Error("verification-host-limit-invalid");
-    return value;
-  };
-  const maxReportBytes = hostLimit(
-    "ABEL_VERIFICATION_MAX_REPORT_BYTES",
-    64 * 1024 * 1024,
-  );
-  const workHardLimit = hostLimit("ABEL_WORK_MAX_UNITS", 512);
-  const engine = openDurableWorkflowEngine({
-    workHardLimit,
-    verificationPolicy: `report-file-v5:${JSON.stringify(executionProfile())}`,
-    verificationEnvironment: coalesceVerificationScans(
-      (plan: import("./implement-plan.ts").ImplementPlan, signal) =>
-        captureVerificationEnvironmentIdentity(
-          consumerRoot,
-          [
-            ...plan.tasks.flatMap((task) => [
-              ...Object.values(task.phases).map((phase) => phase.verification),
-              task.affectedVerification,
-              task.repairVerification,
-            ]),
-            plan.verification.baseline.fullSuite,
-            plan.verification.change.fullSuite,
-            plan.verification.change.postApply,
-            ...(plan.verification.agentsCheckpoint.verification
-              ? [plan.verification.agentsCheckpoint.verification]
-              : []),
-          ],
-          signal,
-        ),
-    ),
-    consumerRoot,
-    stateRoot,
-    deliverySource: packageDeliverySource(consumerRoot, {
-      verifyGateProof: (input) => design.verifyGateProof(input),
-      verifyFinalizedDelivery: (input) => design.verifyFinalizedDelivery(input),
-    }),
-    routePolicy: routeResolution.ok
-      ? routeResolution.policy
-      : unavailableRoutePolicy(),
-    proposeCandidate: (input) =>
-      proposePackageCandidate(
-        input,
-        contexts.getStore(),
-        implementationAgent,
-        feedback.getStore()?.current(),
-      ),
-    verifyPhase: async (input) =>
-      phaseVerificationResult(
-        await verify({
-          maxReportBytes,
-          executionWritePaths: input.executionWritePaths,
-          root: input.root,
-          dependencyOwner: consumerRoot,
-          verification: input.verification,
-          signal: input.signal,
-        }),
-      ),
-    verifyChange: async (input) => {
-      const verifications = input.verification
-        ? [input.verification]
-        : input.plan.tasks.map((task) => affectedVerification(task));
-      let failure: ReturnType<typeof changeVerificationResult> | undefined;
-      for (const verification of verifications) {
-        const result = await verify({
-          maxReportBytes,
-          executionWritePaths: input.plan.tasks.flatMap((task) =>
-            Object.values(task.phases).flatMap((phase) => [
-              ...phase.write,
-              ...phase.delete,
-            ]),
+  try {
+    const implementationAgent = loadAgentDefinitions().find(
+      (agent) => agent.role === "implementation-worker",
+    );
+    if (!implementationAgent) {
+      throw new Error("implementation-worker-agent-unavailable");
+    }
+    const hostLimit = (name: string, fallback: number): number => {
+      const value =
+        process.env[name] === undefined ? fallback : Number(process.env[name]);
+      if (!Number.isSafeInteger(value) || value < 1)
+        throw new Error("verification-host-limit-invalid");
+      return value;
+    };
+    const maxReportBytes = hostLimit(
+      "ABEL_VERIFICATION_MAX_REPORT_BYTES",
+      64 * 1024 * 1024,
+    );
+    const workHardLimit = hostLimit("ABEL_WORK_MAX_UNITS", 512);
+    const engine = openDurableWorkflowEngine({
+      workHardLimit,
+      verificationPolicy: `report-file-v5:${JSON.stringify(executionProfile())}`,
+      verificationEnvironment: coalesceVerificationScans(
+        (plan: import("./implement-plan.ts").ImplementPlan, signal) =>
+          captureVerificationEnvironmentIdentity(
+            consumerRoot,
+            [
+              ...plan.tasks.flatMap((task) => [
+                ...Object.values(task.phases).map(
+                  (phase) => phase.verification,
+                ),
+                task.affectedVerification,
+                task.repairVerification,
+              ]),
+              plan.verification.baseline.fullSuite,
+              plan.verification.change.fullSuite,
+              plan.verification.change.postApply,
+              ...(plan.verification.agentsCheckpoint.verification
+                ? [plan.verification.agentsCheckpoint.verification]
+                : []),
+            ],
+            signal,
           ),
-          root: input.root,
-          dependencyOwner: consumerRoot,
-          verification,
-          signal: input.signal,
-        });
-        const observed = changeVerificationResult(result);
-        if (!observed.ok) {
-          if (observed.kind !== "verification") return observed;
-          if (failure && !failure.ok && failure.kind === "verification") {
-            failure.failureIdentities = [
-              ...new Set([
-                ...(failure.failureIdentities ?? []),
-                ...(observed.failureIdentities ?? []),
+      ),
+      consumerRoot,
+      stateRoot,
+      deliverySource: packageDeliverySource(consumerRoot, {
+        verifyGateProof: (input) => design.verifyGateProof(input),
+        verifyFinalizedDelivery: (input) =>
+          design.verifyFinalizedDelivery(input),
+      }),
+      routePolicy: routeResolution.ok
+        ? routeResolution.policy
+        : unavailableRoutePolicy(),
+      proposeCandidate: (input) =>
+        proposePackageCandidate(
+          input,
+          contexts.getStore(),
+          implementationAgent,
+          feedback.getStore()?.current(),
+        ),
+      verifyPhase: async (input) =>
+        phaseVerificationResult(
+          await verify({
+            maxReportBytes,
+            executionWritePaths: input.executionWritePaths,
+            root: input.root,
+            dependencyOwner: consumerRoot,
+            verification: input.verification,
+            signal: input.signal,
+          }),
+        ),
+      verifyChange: async (input) => {
+        const verifications = input.verification
+          ? [input.verification]
+          : input.plan.tasks.map((task) => affectedVerification(task));
+        let failure: ReturnType<typeof changeVerificationResult> | undefined;
+        for (const verification of verifications) {
+          const result = await verify({
+            maxReportBytes,
+            executionWritePaths: input.plan.tasks.flatMap((task) =>
+              Object.values(task.phases).flatMap((phase) => [
+                ...phase.write,
+                ...phase.delete,
               ]),
-            ];
-            failure.attributionReliable =
-              failure.attributionReliable !== false &&
-              observed.attributionReliable !== false;
-          } else failure = observed;
+            ),
+            root: input.root,
+            dependencyOwner: consumerRoot,
+            verification,
+            signal: input.signal,
+          });
+          const observed = changeVerificationResult(result);
+          if (!observed.ok) {
+            if (observed.kind !== "verification") return observed;
+            if (failure && !failure.ok && failure.kind === "verification") {
+              failure.failureIdentities = [
+                ...new Set([
+                  ...(failure.failureIdentities ?? []),
+                  ...(observed.failureIdentities ?? []),
+                ]),
+              ];
+              failure.attributionReliable =
+                failure.attributionReliable !== false &&
+                observed.attributionReliable !== false;
+            } else failure = observed;
+          }
         }
-      }
-      if (failure) return failure;
-      return {
-        ok: true,
-        exitCode: 0,
-        classification: "expected-green",
-      };
-    },
-  });
-  return {
-    async execute(
-      command: unknown,
-      context = initialContext,
-      signal,
-      onActivity,
-    ) {
-      const operationRouteResolution = loadRoutePolicy({
-        cwd: consumerRoot,
-        home: homedir(),
-        ...(context.model ? { parentModel: context.model } : {}),
-      });
-      engine.updateRoutePolicy(
-        operationRouteResolution.ok
-          ? operationRouteResolution.policy
-          : unavailableRoutePolicy(),
-      );
-      const validation = validateControlCommand(command);
-      if (!validation.ok) {
-        const error = new Error(validation.code);
-        error.name = "ControlCommandError";
-        throw error;
-      }
-      return feedback.run(new VerificationFeedback(), () =>
-        contexts.run(context, async () => {
-          const outcome = await engine.execute(
-            validation.value,
-            signal,
-            onActivity,
-          );
-          const routePolicy = visibleRoutePolicyStatus(
-            operationRouteResolution,
-            engine.routePolicyStatus(),
-          );
-          return {
-            ...outcome,
-            routePolicy,
-            verificationDiagnostics: feedback.getStore()?.current() ?? [],
-          };
-        }),
-      );
-    },
-    executeDesign(request: unknown) {
-      return design.execute(request);
-    },
-    executeAmendment(change: string, batchId: string, request: unknown) {
-      return engine.amend(change, batchId, request, (assertAuthority) =>
-        design.executeWithAuthority(request, assertAuthority),
-      );
-    },
-    assertDesignRun(runId: string) {
-      design.assertDesignRun(runId);
-    },
-    recordDesignEvidence(input) {
-      return design.recordEvidence(input);
-    },
-    async close() {
-      contexts.disable();
-      await engine.close();
-      feedback.disable();
-      design.close();
-    },
-  };
+        if (failure) return failure;
+        return {
+          ok: true,
+          exitCode: 0,
+          classification: "expected-green",
+        };
+      },
+    });
+    return {
+      async execute(
+        command: unknown,
+        context = initialContext,
+        signal,
+        onActivity,
+      ) {
+        const operationRouteResolution = loadRoutePolicy({
+          cwd: consumerRoot,
+          home: homedir(),
+          ...(context.model ? { parentModel: context.model } : {}),
+        });
+        engine.updateRoutePolicy(
+          operationRouteResolution.ok
+            ? operationRouteResolution.policy
+            : unavailableRoutePolicy(),
+        );
+        const validation = validateControlCommand(command);
+        if (!validation.ok) {
+          const error = new Error(validation.code);
+          error.name = "ControlCommandError";
+          throw error;
+        }
+        return feedback.run(new VerificationFeedback(), () =>
+          contexts.run(context, async () => {
+            const outcome = await engine.execute(
+              validation.value,
+              signal,
+              onActivity,
+            );
+            const routePolicy = visibleRoutePolicyStatus(
+              operationRouteResolution,
+              engine.routePolicyStatus(),
+            );
+            return {
+              ...outcome,
+              routePolicy,
+              verificationDiagnostics: feedback.getStore()?.current() ?? [],
+            };
+          }),
+        );
+      },
+      executeDesign(request: unknown) {
+        return design.execute(request);
+      },
+      executeAmendment(change: string, batchId: string, request: unknown) {
+        return engine.amend(change, batchId, request, (assertAuthority) =>
+          design.executeWithAuthority(request, assertAuthority),
+        );
+      },
+      assertDesignRun(runId: string) {
+        design.assertDesignRun(runId);
+      },
+      recordDesignEvidence(input) {
+        return design.recordEvidence(input);
+      },
+      async close() {
+        contexts.disable();
+        await engine.close();
+        feedback.disable();
+        design.close();
+      },
+    };
+  } catch (error) {
+    design.close();
+    throw error;
+  }
 }
 
 function visibleRoutePolicyStatus(

package/src/run-store.ts

@@ -17,7 +17,10 @@ import {
   type ResolvedStateRoot,
   StateRootError,
 } from "./state-root.ts";
-import { RUN_SCHEMA as SCHEMA } from "./storage-schema.ts";
+import {
+  LEGACY_RUN_SCHEMA_V2,
+  RUN_SCHEMA as SCHEMA,
+} from "./storage-schema.ts";
 
 export class RunStoreFormatError extends Error {
   readonly code = "run-store-reset-required" as const;
@@ -115,7 +118,10 @@ function requireIdentifier(value: string, label: string): void {
   if (!IDENTIFIER.test(value)) throw new Error(`invalid-${label}`);
 }
 
-const LEGACY_SCHEMA_VERSION = 4;
+const LEGACY_SCHEMA_VERSIONS = new Map([
+  [2, LEGACY_RUN_SCHEMA_V2],
+  [4, SCHEMA],
+]);
 
 function applicationTables(database: DatabaseSync): string[] {
   return (
@@ -153,25 +159,35 @@ function hasCurrentSchema(
   );
 }
 
-function isSupportedLegacySchema(
+function supportedLegacyVersion(
   database: DatabaseSync,
   tables: readonly string[],
-): boolean {
+): number | undefined {
   if (
     !tables.includes("schema_meta") ||
-    !hasRequiredCoreSchema(database, tables) ||
     tableColumns(database, "schema_meta").join("\0") !== "version"
   ) {
-    return false;
+    return undefined;
   }
   const rows = database
     .prepare("SELECT version FROM schema_meta")
     .all() as unknown as Array<{
     version: number;
   }>;
-  return (
-    rows.length === 1 && Number(rows[0]?.version) === LEGACY_SCHEMA_VERSION
-  );
+  if (rows.length !== 1) return undefined;
+  const version = rows[0]?.version;
+  const schema = LEGACY_SCHEMA_VERSIONS.get(version);
+  if (!schema || !matchesSqliteSchema(database, schema)) return undefined;
+  // A v2 database cannot already contain any proof fields. Do not repair a
+  // partial/ambiguous upgrade or reinterpret malformed fields as authority.
+  if (
+    version === 2 &&
+    tableColumns(database, "delivery_bindings").some((column) =>
+      ["approval_revision", "contract_hash", "record_hash"].includes(column),
+    )
+  )
+    return undefined;
+  return version;
 }
 
 function isSqliteLocked(error: unknown): boolean {
@@ -210,7 +226,7 @@ function ensureCurrentSchema(
   const initialTables = applicationTables(database);
   if (hasCurrentSchema(database, initialTables)) return;
   let transactionStarted = false;
-  let migrating = false;
+  let migrating: number | undefined;
   try {
     database.exec("BEGIN IMMEDIATE");
     transactionStarted = true;
@@ -219,11 +235,19 @@ function ensureCurrentSchema(
       database.exec(SCHEMA);
     } else if (hasCurrentSchema(database, tables)) {
       // Another opener may already have completed the same migration.
-    } else if (isSupportedLegacySchema(database, tables)) {
-      migrating = true;
-      database.exec("DROP TABLE schema_meta");
     } else {
-      throw new RunStoreFormatError(databasePath);
+      migrating = supportedLegacyVersion(database, tables);
+      if (migrating === undefined) throw new RunStoreFormatError(databasePath);
+      if (migrating === 2) {
+        database.exec(`
+          ALTER TABLE delivery_bindings ADD COLUMN approval_revision INTEGER;
+          ALTER TABLE delivery_bindings ADD COLUMN contract_hash TEXT;
+          ALTER TABLE delivery_bindings ADD COLUMN record_hash TEXT;
+        `);
+      }
+      if (!hasRequiredCoreSchema(database, tables))
+        throw new RunStoreFormatError(databasePath);
+      database.exec("DROP TABLE schema_meta");
     }
     database.exec("COMMIT");
   } catch (error) {
@@ -242,7 +266,7 @@ function ensureCurrentSchema(
       throw error;
     }
     if (migrating) {
-      throw new RunStoreMigrationError(LEGACY_SCHEMA_VERSION, error);
+      throw new RunStoreMigrationError(migrating, error);
     }
     throw error;
   }

package/src/storage-schema.ts

@@ -7,8 +7,14 @@ export const ROUTE_HEALTH_SCHEMA = `
   ) STRICT;
 `;
 
-/** Owner-private storage contracts. Migrations run atomically before use. */
-export const RUN_SCHEMA = `
+/** v2 predates proof-bound delivery receipts; migration must not invent proof. */
+const DELIVERY_PROOF_COLUMNS = `
+    approval_revision INTEGER,
+    contract_hash TEXT,
+    record_hash TEXT,`;
+
+function runSchema(withDeliveryProof: boolean): string {
+  return `
   CREATE TABLE IF NOT EXISTS runs (
     run_id TEXT PRIMARY KEY,
     root_hash TEXT NOT NULL,
@@ -29,10 +35,7 @@ export const RUN_SCHEMA = `
     run_id TEXT NOT NULL REFERENCES runs(run_id) ON DELETE CASCADE,
     gate TEXT NOT NULL,
     revision INTEGER NOT NULL,
-    receipt_hash TEXT NOT NULL,
-    approval_revision INTEGER,
-    contract_hash TEXT,
-    record_hash TEXT,
+    receipt_hash TEXT NOT NULL,${withDeliveryProof ? DELIVERY_PROOF_COLUMNS : ""}
     operation_id TEXT NOT NULL,
     PRIMARY KEY (run_id, gate, revision),
     UNIQUE (run_id, operation_id)
@@ -102,6 +105,11 @@ ${ROUTE_HEALTH_SCHEMA}
     facts_json TEXT NOT NULL
   ) STRICT;
 `;
+}
+
+/** Owner-private storage contracts. Migrations run atomically before use. */
+export const RUN_SCHEMA = runSchema(true);
+export const LEGACY_RUN_SCHEMA_V2 = runSchema(false);
 
 export const DESIGN_SCHEMA = `
   CREATE TABLE IF NOT EXISTS design_facts (