@allocator-one/rcl 4.5.19 → 4.5.20

package/dist/index.js

@@ -60,7 +60,7 @@ import { writeExclusive, serializeRecoveryDocument } from './evidence/original-r
 import { readStable, sha256 } from './telemetry/recovery/files.js';
 import { appendCalls, appendOutcomes, loadModelStats, resolveDataDir, DEFAULT_WINDOW_DAYS, MIN_OUTCOMES_FOR_WEIGHT, } from './models/stats-store.js';
 import { buildSeedRecords } from './models/seed.js';
-import { assignmentLane, buildRoster, configDigest, diffDigest, describeRunTarget, detectRunner, parseSpecSource, resolveConvergeContext, guardedInputSha256, sha256Hex, stableStringify, validateSha, } from './report/run-header.js';
+import { assignmentLane, buildRoster, configDigest, diffDigest, describeRunTarget, detectRunner, parseSpecSource, resolveConvergeContext, guardedInputSha256, sha256Hex, validateSha, } from './report/run-header.js';
 import { assertExpectedHead, resolveReviewTarget } from './resolver/target.js';
 import { createTelemetryRuntime, deliverRun, evidenceRequirementConflict, emitConvergeEvents, flushOutbox, flushOutboxAtStart, loadHarnessSettings, resolveTelemetryLevel, } from './telemetry/deliver.js';
 import { normalizeGeneratedReport, sanitizeForDelivery } from './telemetry/envelope.js';
@@ -1869,13 +1869,14 @@ async function runReview(target, opts) {
         }
         else {
             const prTarget = parseGitHubTarget(target);
-            diff = await fetchPRDiff(prTarget, config.githubToken);
+            diff = await fetchPRDiff(prTarget, config.githubToken, undefined, { requireMergeBase: true });
         }
         // Resolve the head BEFORE the empty-diff exit so --expect-head-sha is
         // honored even when there is nothing to review: a moved target must
         // never read as a clean round.
         const runTarget = await resolveReviewTarget(diff, gitMode, {
             ...opts,
+            historicalPendingRecovery: opts.exportPendingPackage !== undefined || opts.finalizePendingOnly === true,
             convergeTarget: opts.convergeTarget ?? process.env['RCL_CONVERGE_TARGET'],
             // The flag is the user's word and is refused off a patch file; a value
             // left in the environment only ever attributes a patch file.
@@ -1958,9 +1959,12 @@ async function executeCouncil(spinner, prepared, diff, opts, extra, preparedWork
             explicit: prepared.explicit, gating: prepared.gatingConfig });
         const guardedInput = {
             head: extra.target.headSha, kind: extra.target.kind, repo: extra.target.repo, pr: extra.target.prNumber,
+            ...(extra.target.baseSha === undefined ? {} : { base: extra.target.baseSha }),
             diff: diffDigest(diff.files), config: configDigest(config), roster, prompts,
             asyncRoles: asyncAssignments.map(assignment => assignment.role), spec: prepared.spec,
         };
+        const { base: _base, ...historicalGuardedInput } = guardedInput;
+        const historicalInputSha256 = guardedInputSha256(historicalGuardedInput);
         const ordinaryAsyncDescriptors = chunks.flatMap(() => asyncAssignments.map(assignment => ({
             model: assignment.model, role: assignment.role.name, provider: assignment.provider,
         }))).slice(0, MAX_ASYNC_CALLS_PER_ROUND);
@@ -1968,17 +1972,26 @@ async function executeCouncil(spinner, prepared, diff, opts, extra, preparedWork
         const common = await resolveGitCommonDir();
         if (opts.exportPendingPackage) {
             const pendingNative = await loadConvergeRunState(common, prepared.converge.target);
-            // A launch recorded before shared task context (RCL-191) hashed prompts
-            // without it. Offer that exact earlier form too; the export still
-            // authenticates only an exact match with the recorded input hash.
+            // Discovery only: export re-reads the native marker and authenticates its
+            // complete retained packet before producing anything. The caller can
+            // confirm this historical base, never nominate an unauthenticated one.
+            const original = pendingNative?.lastLaunch;
+            const retainedBase = original?.headSha === extra.target.headSha ? original?.ordinaryInputs?.baseSha : undefined;
+            const exportBaseSha = retainedBase === opts.expectBaseSha ? retainedBase : extra.target.baseSha;
+            // Only explicit historical export may reconstruct older input forms.
+            // New launches always hash a resolved base; older records may omit it or the
+            // shared task context. Retained receipts still check the base separately.
             let exportInput = guardedInput;
-            if (work.taskContext && pendingNative?.lastLaunch?.inputSha256 !== guardedInputSha256(guardedInput)) {
-                const earlier = { ...guardedInput, prompts: await Promise.all(chunkAssignments.map(({ assignment, chunk }) => buildPrompt(chunk, assignment.role, { contextDocs, plan: planContext }))) };
-                if (pendingNative?.lastLaunch?.inputSha256 === guardedInputSha256(earlier))
-                    exportInput = earlier;
+            if (pendingNative?.lastLaunch?.inputSha256 !== guardedInputSha256(guardedInput)) {
+                const candidates = [guardedInput, ...(exportBaseSha === undefined ? [] : [{ ...guardedInput, base: exportBaseSha }]), historicalGuardedInput];
+                if (work.taskContext) {
+                    const earlierPrompts = await Promise.all(chunkAssignments.map(({ assignment, chunk }) => buildPrompt(chunk, assignment.role, { contextDocs, plan: planContext })));
+                    candidates.push(...candidates.map(input => ({ ...input, prompts: earlierPrompts })));
+                }
+                exportInput = candidates.find(input => pendingNative?.lastLaunch?.inputSha256 === guardedInputSha256(input)) ?? guardedInput;
             }
             const receipt = await exportOrdinaryPendingPackage({ gitCommonDir: common,
-                target: prepared.converge.target, headSha: extra.target.headSha ?? '', baseSha: extra.target.baseSha ?? '',
+                target: prepared.converge.target, headSha: extra.target.headSha ?? '', baseSha: exportBaseSha ?? '',
                 expectedBaseSha: opts.expectBaseSha, expectedRound: prepared.converge.round,
                 guardedInput: exportInput, path: opts.exportPendingPackage,
                 preview: opts.previewPending === true,
@@ -2028,6 +2041,14 @@ async function executeCouncil(spinner, prepared, diff, opts, extra, preparedWork
             const migrationPackage = opts.ordinaryPendingPackage === undefined ? undefined : JSON.parse((await readStable(opts.ordinaryPendingPackage)).text);
             const migrationGuardedInput = migrationPackage
                 ? ordinaryPendingGuardedInput(migrationPackage) : undefined;
+            // Only finalize-only may authenticate the old PR base rather than the
+            // current comparison. Never feed that base into a successor's capture.
+            // Advanced receipt replay remains available via an explicitly bound patch.
+            const retainedBase = native?.lastLaunch?.headSha === extra.target.headSha
+                ? native?.lastLaunch?.ordinaryInputs?.baseSha : undefined;
+            const finalizationBaseSha = opts.finalizePendingOnly && extra.target.kind === 'pr' &&
+                retainedBase !== undefined && retainedBase === migrationPackage?.baseSha
+                ? retainedBase : extra.target.baseSha ?? '';
             if (opts.expectPrHeadSha !== undefined && migrationPackage?.version !== 2) {
                 throw new ReviewLaunchRefused('pending_finalize_incompatible', '--expect-pr-head-sha requires a cycle-backed version-2 pending package.');
             }
@@ -2084,7 +2105,7 @@ async function executeCouncil(spinner, prepared, diff, opts, extra, preparedWork
             if (opts.previewPending && migrationPackage) {
                 const inputSha256 = guardedInputSha256(migrationGuardedInput);
                 const preview = await previewOrdinaryPendingLaunch({ gitCommonDir: common,
-                    target: prepared.converge.target, headSha: extra.target.headSha ?? '', baseSha: extra.target.baseSha ?? '',
+                    target: prepared.converge.target, headSha: extra.target.headSha ?? '', baseSha: finalizationBaseSha,
                     pendingInputSha256: inputSha256, recoveryInputSha256: inputSha256,
                     retryReason: opts.retryReason ?? 'Finalize-only authentication preview.',
                     captured: {}, retainedAsyncSha256: expectedAsyncSha256,
@@ -2104,7 +2125,7 @@ async function executeCouncil(spinner, prepared, diff, opts, extra, preparedWork
                 const inputSha256 = guardedInputSha256(migrationGuardedInput);
                 const result = await finalizeOrdinaryPendingLaunch({ gitCommonDir: common,
                     target: prepared.converge.target, headSha: extra.target.headSha ?? '',
-                    baseSha: extra.target.baseSha ?? '', pendingInputSha256: inputSha256,
+                    baseSha: finalizationBaseSha, pendingInputSha256: inputSha256,
                     nativeStateSha256: opts.pendingNativeSha256, attemptStateSha256: opts.pendingAttemptSha256,
                     retainedAsyncSha256: expectedAsyncSha256, migrationPackage,
                     maxAttempts: Number(opts.maxAttempts), cycleRemote,
@@ -2177,15 +2198,12 @@ async function executeCouncil(spinner, prepared, diff, opts, extra, preparedWork
                     } } : {}), });
             const asyncStoreDir = await resolveAsyncStoreDir();
             const asyncKey = asyncTargetKey(extra.asyncTargetLabel ?? prepared.converge.target, extra.target.kind === 'patch' ? prepared.converge.target : undefined, prepared.converge.cycleId);
-            const recoveryInputSha256 = sha256Hex(stableStringify({
-                head: extra.target.headSha, kind: extra.target.kind, repo: extra.target.repo,
-                pr: extra.target.prNumber, diff: diffDigest(diff.files), config: configDigest(config),
-                roster, prompts, asyncRoles: asyncAssignments.map(assignment => assignment.role), spec: prepared.spec,
-            }));
+            const recoveryInputSha256 = guardedInputSha256(guardedInput);
             const pendingResumeOptions = { gitCommonDir: common,
                 target: prepared.converge.target, headSha: extra.target.headSha ?? '',
                 baseSha: extra.target.baseSha ?? '',
                 pendingInputSha256: claimedInputSha256, recoveryInputSha256,
+                historicalRecoveryInputSha256: historicalInputSha256,
                 retryReason: opts.retryReason,
                 ...(opts.retryReport ? { legacyRetry: { reportPath: opts.retryReport, config, roster,
                         historicalPlan: prepared.historicalRetryPlan === true } } : {}),
@@ -2280,6 +2298,7 @@ async function executeCouncil(spinner, prepared, diff, opts, extra, preparedWork
             recoverySource: prepared.converge.recovery_source,
             headSha: extra.target.headSha ?? '',
             inputSha256: guardedInputSha256(guardedInput),
+            historicalInputSha256,
             round: prepared.converge.round,
             intent: opts.launchIntent,
             retryReason: opts.retryReason,