@ashlr/hub 3.3.0 → 3.3.2

package/dist/core/inbox/merge.js

@@ -98,7 +98,7 @@ import { execFileSync } from 'node:child_process';
 import { existsSync, mkdirSync, writeFileSync, unlinkSync, symlinkSync, readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
-import { createHash, randomBytes } from 'node:crypto';
+import { randomBytes } from 'node:crypto';
 import { isDeepStrictEqual } from 'node:util';
 import { loadProposal, recordRealizedMerge, setStatus, updateProposalField } from './store.js';
 import { canonicalModelTag } from '../run/model-catalog.js';
@@ -128,7 +128,6 @@ import { acquireProposalMutationLock, releaseProposalMutationLock } from './prop
 import { acquireOutwardMutationFence, ownsOutwardMutationFence, releaseOutwardMutationFence, } from '../sandbox/mutation-fence.js';
 import { isAuthenticatedAwaitingRemoteHandoff, isApprovedRemoteHandoffRetryCandidate, remoteAuthorityBinding, remoteAuthorityMatchesRepo, remoteIntentAuthorizationId, REMOTE_HANDOFF_RECOVERY_MARKER, } from './remote-handoff.js';
 import { findLocalRealizedMergeDescendant } from './realized-merge.js';
-import { prepareHostMergeRevocation, transitionHostMergeRevocation, readHostMergeRevocationState, } from '../autonomy/host-merge-revocation-protocol.js';
 function auditAutoMergeCanaryFailure(repo, sandboxId) {
     try {
         audit({
@@ -637,13 +636,13 @@ export function evaluateAutoMergeReadinessPreflight(proposal, cfg) {
             // autoArchive. An infra-flavored failure must not permanently kill a
             // proposal whose only crime was that the verifier was momentarily
             // unavailable — it stays pending and is retried next pass.
-            const infraLike = category === 'tool' || category === 'timeout' || category === 'infra';
-            const advisories = infraLike
+            const explicitCodeFailure = category === 'code';
+            const advisories = !explicitCodeFailure
                 ? [
                     `verifier-unavailable: verification could not run to completion (${category}) — not counted toward auto-archive; will retry`,
                 ]
                 : [];
-            return block(`known verification failure: proposal.verifyResult.passed is false${failed ? ` (${failed})` : ''}`, advisories, !infraLike);
+            return block(`known verification failure: proposal.verifyResult.passed is false${failed ? ` (${failed})` : ''}`, advisories, explicitCodeFailure);
         }
         const trustBasis = cfg.foundry?.['autoMerge']
             ? cfg.foundry['autoMerge']?.['trustBasis'] ?? 'tier'
@@ -1718,24 +1717,17 @@ export async function verifyProposal(proposal, cfg) {
         }
         // Apply the diff to the worktree ONLY AFTER capturing the base-derived
         // command list, then run those (immutable) commands against the patched tree.
-        // M??? (merge-pipeline reliability): --3way lets git fall back to a
-        // three-way merge (using the blob shas already embedded in `git diff`'s
-        // extended headers) when the diff's ORIGINAL base has since moved but the
-        // proposal's edits don't actually conflict with what changed. Plain
-        // `apply` fails on any context drift even for benign staleness; `--3way`
-        // only fails closed on a REAL textual conflict, which is the outcome we
-        // actually want to distinguish from "diff is corrupt". Safe: this
-        // worktree is always removed in the finally block below regardless of
-        // outcome, so a conflicted intermediate state is never observed.
+        // Apply exactly to the verified index. Context drift is a refusal, not
+        // authority to synthesize a three-way result that was never proposed.
         patchFile = writeTmpFile(diff);
         try {
-            gitRun(tmpDir, ['apply', '--3way', '--index', patchFile]);
+            gitRun(tmpDir, ['apply', '--index', patchFile]);
         }
         catch (err) {
             return {
                 ok: false,
                 ran: [],
-                detail: `git apply failed in verify worktree (3-way fallback also failed — likely a real conflict, not just a stale base): ${err instanceof Error ? err.message : String(err)}`,
+                detail: `git apply failed in verify worktree: ${err instanceof Error ? err.message : String(err)}`,
                 baseBranch: base,
                 baseHead,
             };
@@ -2012,223 +2004,6 @@ function reconcileLocalMergeIntent(id, cfg) {
     });
     return { ok: true, merged: true, reason };
 }
-// ---------------------------------------------------------------------------
-// Host merge — the last hop of the remote handoff path: the actual
-// `gh pr merge`. Gated by durable per-authority revocation
-// (autonomy/host-merge-revocation-protocol.ts) on top of every existing
-// mechanical/judge/self-target gate already run above. Default DISABLED via
-// cfg.foundry.autoMerge.hostAutoMerge (separate opt-in from pushToRemote —
-// opening a PR and actually merging it are different trust levels).
-// ---------------------------------------------------------------------------
-/** Bounded lifetime of a single host-merge authority window (< the protocol's 15m cap). */
-export const HOST_MERGE_AUTHORITY_TTL_MS = 10 * 60 * 1000;
-/** Timeout for the `gh pr merge` invocation itself (network op). */
-const HOST_MERGE_TIMEOUT_MS = 30_000;
-/**
- * Placeholder kill-switch epoch. ~/.ashlr/KILL has no versioning of its own
- * today; this binds every host-merge authority to a fixed protocol
- * generation so the identity schema is forward-compatible if a real epoch
- * counter is added later. It is NOT a substitute for the direct
- * killSwitchOn() checks below — those remain the live, load-bearing gate.
- */
-export const HOST_MERGE_KILL_EPOCH_DIGEST = createHash('sha256')
-    .update('ashlr.host-merge-revocation.kill-epoch.v1', 'utf8')
-    .digest('hex');
-export function hostMergeOperationId(id, suffix) {
-    const candidate = `${id}-${suffix}`;
-    return /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,159}$/.test(candidate) ? candidate : null;
-}
-/**
- * Digest binding the currently-configured auto-merge policy surface.
- * Changing any of these values between prepare and arm changes the
- * authority's identity (and therefore its authorityId), so a stale grant
- * prepared under an old policy can never silently carry forward under a
- * different one — transitionHostMergeRevocation would refuse it as
- * 'authority-missing' instead.
- */
-export function hostMergePolicyEpoch(input) {
-    return createHash('sha256').update(JSON.stringify(input), 'utf8').digest('hex');
-}
-export function buildHostMergeRevocationIdentity(input) {
-    return {
-        nameWithOwner: input.nameWithOwner,
-        repositoryId: input.repositoryId,
-        baseRef: input.base,
-        baseOid: input.baseOid,
-        headRef: input.branch,
-        headOid: input.headOid,
-        pullRequestId: input.pullRequestId,
-        pullRequestNumber: input.pullRequestNumber,
-        evidencePackDigest: input.evidencePackDigest,
-        verifierManifestDigest: input.verifierManifestDigest,
-        protectionPolicyDigest: input.protectionPolicyDigest,
-        killEpoch: HOST_MERGE_KILL_EPOCH_DIGEST,
-        policyEpoch: input.policyEpoch,
-        expiresAt: new Date(input.now.getTime() + HOST_MERGE_AUTHORITY_TTL_MS).toISOString(),
-    };
-}
-/** Run `gh pr merge` directly (never throws). */
-function hostMergeGhPrMerge(cwd, args) {
-    try {
-        const stdout = execFileSync('gh', args, {
-            cwd,
-            timeout: HOST_MERGE_TIMEOUT_MS,
-            stdio: 'pipe',
-            encoding: 'utf8',
-            env: {
-                ...process.env,
-                GH_HOST: 'github.com',
-                GH_NO_UPDATE_NOTIFIER: '1',
-                NO_COLOR: '1',
-            },
-        });
-        return { ok: true, detail: (typeof stdout === 'string' ? stdout.trim() : '') || 'gh pr merge exited 0' };
-    }
-    catch (err) {
-        const e = err;
-        const stderr = typeof e.stderr === 'string'
-            ? e.stderr
-            : e.stderr instanceof Buffer
-                ? e.stderr.toString('utf8')
-                : undefined;
-        return { ok: false, detail: (stderr || e.message || 'gh pr merge failed').trim().slice(0, 2000) };
-    }
-}
-/**
- * Attempt the last hop of the remote handoff: the actual `gh pr merge`.
- * Returns a human-readable mergeNote describing the outcome; NEVER throws.
- * Fails closed on every ambiguity (kill switch, unreadable/degraded/missing
- * revocation state, missing identity inputs). The proposal always ends up in
- * the existing awaiting-host-merge state regardless of this function's
- * outcome — the pre-existing reconcileRemoteHandoffs() sweep is the durable
- * source of truth for whatever actually happened on the host, whether we
- * merged it just now or a human merges it later.
- *
- * Exported (with its identity-building helpers) so tests can drive it
- * directly, and so a test can independently prepare/arm/revoke the EXACT
- * authority this function will look up (same identity, same clock) to
- * exercise durable revocation without needing to fabricate an entire
- * end-to-end autoMergeProposal() gate-chain pass.
- */
-export async function attemptHostAutoMerge(input) {
-    const { repo, id, cfg, nameWithOwner, repositoryId, url, base, baseOid, branch, headOid, observedPr, evidencePackDigest, verifierManifestDigest, protectionPolicyDigest, maxRisk, managerGateEnabled, allowSelfMerge, maxFiles, maxLines, } = input;
-    const hostAutoMergeEnabled = autoMergeConfigValue(cfg, 'hostAutoMerge') === true;
-    if (!hostAutoMergeEnabled) {
-        return 'PR opened; host auto-merge is disabled (cfg.foundry.autoMerge.hostAutoMerge !== true)';
-    }
-    if (!verifierManifestDigest) {
-        return 'PR opened; host auto-merge refused because no required-verifier manifest digest is bound to this attempt';
-    }
-    if (killSwitchOn()) {
-        return 'PR opened; host auto-merge refused because the autonomy kill switch is ON';
-    }
-    // Re-derive PR identity fresh — never trust an object handed in from an
-    // earlier step of this same invocation. This is also what makes an
-    // interrupted host merge reconcilable: if a prior, crashed attempt already
-    // got the PR merged, we observe that here and never re-invoke gh pr merge.
-    const freshBeforeAttempt = viewPr(repo, url, { repo: nameWithOwner });
-    if (!freshBeforeAttempt) {
-        return 'PR opened; host auto-merge refused because the PR could not be freshly re-read before merging';
-    }
-    if (freshBeforeAttempt.state === 'MERGED' || Boolean(freshBeforeAttempt.mergedAt)) {
-        return 'PR opened; already merged on the host (observed before any merge attempt this pass)';
-    }
-    if (freshBeforeAttempt.state !== 'OPEN' ||
-        !freshBeforeAttempt.headRefOid || freshBeforeAttempt.headRefOid.toLowerCase() !== headOid.toLowerCase() ||
-        freshBeforeAttempt.baseRefName !== base) {
-        return `PR opened; host auto-merge refused because the live PR state changed (state=${freshBeforeAttempt.state ?? 'unknown'})`;
-    }
-    const pullRequestId = observedPr?.id ?? freshBeforeAttempt.id;
-    const pullRequestNumber = observedPr?.number ?? freshBeforeAttempt.number;
-    if (!pullRequestId || typeof pullRequestNumber !== 'number' || !Number.isSafeInteger(pullRequestNumber)) {
-        return 'PR opened; host auto-merge refused because the PR node id/number could not be resolved';
-    }
-    const policyEpoch = hostMergePolicyEpoch({
-        maxRisk, managerGateEnabled, allowSelfMerge, hostAutoMergeEnabled, maxFiles, maxLines,
-    });
-    const now = input.now ?? new Date();
-    const identity = buildHostMergeRevocationIdentity({
-        nameWithOwner, repositoryId, base, baseOid, branch, headOid,
-        pullRequestId, pullRequestNumber, evidencePackDigest, verifierManifestDigest,
-        protectionPolicyDigest, policyEpoch, now,
-    });
-    const prepareOpId = hostMergeOperationId(id, 'host-merge-prepare');
-    const armOpId = hostMergeOperationId(id, 'host-merge-arm');
-    const consumeOpId = hostMergeOperationId(id, 'host-merge-consume');
-    if (!prepareOpId || !armOpId || !consumeOpId) {
-        return 'PR opened; host auto-merge refused because a durable operation id could not be derived';
-    }
-    const prepared = prepareHostMergeRevocation({ identity, operationId: prepareOpId, now });
-    if (!('receipt' in prepared)) {
-        return `PR opened; host auto-merge refused: revocation prepare ${prepared.status} (${prepared.reason})`;
-    }
-    const armed = transitionHostMergeRevocation({
-        identity,
-        action: 'arm',
-        operationId: armOpId,
-        expectedSequence: prepared.receipt.sequence,
-        expectedReceiptDigest: prepared.receipt.receiptDigest,
-        now,
-    });
-    if (!('receipt' in armed)) {
-        return `PR opened; host auto-merge refused: revocation arm ${armed.status} (${armed.reason})`;
-    }
-    // Immediately before the irreversible act: re-check the kill switch AND do
-    // a FRESH authenticated read of the durable revocation store — never trust
-    // the in-memory `armed` result, since a concurrent revoker could have acted
-    // in between.
-    if (killSwitchOn()) {
-        const killRevokeOpId = hostMergeOperationId(id, 'host-merge-revoke-kill');
-        if (killRevokeOpId) {
-            // Best-effort durable revoke — gives the kill switch real teeth against
-            // this specific authority, even though we abort THIS invocation either way.
-            transitionHostMergeRevocation({
-                identity,
-                action: 'revoke',
-                operationId: killRevokeOpId,
-                expectedSequence: armed.receipt.sequence,
-                expectedReceiptDigest: armed.receipt.receiptDigest,
-                now,
-            });
-        }
-        return 'PR opened; host auto-merge refused because the autonomy kill switch is ON';
-    }
-    const preMergeState = readHostMergeRevocationState(identity);
-    if (preMergeState.state !== 'healthy' || preMergeState.record.phase !== 'armed') {
-        const detail = preMergeState.state === 'healthy'
-            ? `phase=${preMergeState.record.phase}`
-            : preMergeState.state === 'degraded'
-                ? preMergeState.reason
-                : 'authority missing';
-        return `PR opened; host auto-merge refused: revocation authority is not armed (${detail})`;
-    }
-    const mergeMethodCfg = autoMergeConfigValue(cfg, 'mergeMethod');
-    const methodFlag = mergeMethodCfg === 'merge' ? '--merge' : mergeMethodCfg === 'rebase' ? '--rebase' : '--squash';
-    const attempt = hostMergeGhPrMerge(repo, ['pr', 'merge', url, '--repo', nameWithOwner, methodFlag]);
-    const freshAfterAttempt = viewPr(repo, url, { repo: nameWithOwner });
-    const confirmedMerged = Boolean(freshAfterAttempt &&
-        (freshAfterAttempt.state === 'MERGED' || freshAfterAttempt.mergedAt) &&
-        freshAfterAttempt.headRefOid?.toLowerCase() === headOid.toLowerCase());
-    if (confirmedMerged) {
-        transitionHostMergeRevocation({
-            identity,
-            action: 'consume',
-            operationId: consumeOpId,
-            expectedSequence: armed.receipt.sequence,
-            expectedReceiptDigest: armed.receipt.receiptDigest,
-            now,
-        });
-        return `PR opened and merged via host auto-merge (gh pr merge)${attempt.ok ? '' : `; gh reported: ${attempt.detail}`}`;
-    }
-    // Not confirmed merged — leave the authority 'armed' (never consumed, never
-    // revoked) so a later retry via the existing remoteHandoff recovery path
-    // replays the SAME authority instead of minting a new one, and so
-    // reconcileRemoteHandoffs() remains the single source of truth if the host
-    // actually completes the merge after our read.
-    return attempt.ok
-        ? 'PR opened; host auto-merge invoked gh pr merge but the merge was not confirmed on re-read; will reconcile'
-        : `PR opened; host auto-merge refused: ${attempt.detail}`;
-}
 /** Build the staging branch holding the proposal's diff, off the default branch.
  *  Returns the branch name on success, or null + detail on failure. */
 function buildMergeBranch(repo, id, diff, base, expectedBaseHead, finalAuthority) {
@@ -2282,12 +2057,7 @@ function buildMergeBranch(repo, id, diff, base, expectedBaseHead, finalAuthority
             const applyAuthorityFailure = finalAuthority?.();
             if (applyAuthorityFailure)
                 throw new Error(applyAuthorityFailure);
-            // --3way: see the matching comment in verifyProposal()'s apply site —
-            // same rationale, harmless here since expectedBaseHead (when supplied)
-            // already guarantees this worktree's base is byte-identical to what was
-            // verified, so 3-way and plain apply agree; it only helps callers that
-            // omit expectedBaseHead.
-            gitRun(tmpDir, ['apply', '--3way', '--index', patchFile]);
+            gitRun(tmpDir, ['apply', '--index', patchFile]);
             const commitAuthorityFailure = finalAuthority?.();
             if (commitAuthorityFailure)
                 throw new Error(commitAuthorityFailure);
@@ -3038,7 +2808,7 @@ export async function autoMergeProposal(id, cfg, invocation = {}) {
                     let inlineAttestation;
                     const ts = new Date().toISOString();
                     const inlineReviewerIndependence = evaluateReviewerIndependence(proposal, inlineJudgeEngine);
-                    if (verdict.verdict === 'ship' && verdict.wouldMerge === true && isFrontierJudge(inlineJudgeEngine) &&
+                    if (verdict.considered === true && verdict.verdict === 'ship' && verdict.wouldMerge === true && isFrontierJudge(inlineJudgeEngine) &&
                         inlineReviewerIndependence.independent) {
                         try {
                             const { signJudgeAttestation: signAtt, hashDiff: hd } = await import('../foundry/provenance.js');
@@ -3069,15 +2839,15 @@ export async function autoMergeProposal(id, cfg, invocation = {}) {
                         action: 'judged',
                         engine: inlineJudgeEngine,
                         model: inlineJudgeEngine,
-                        verdict: verdict.verdict,
+                        verdict: verdict.considered === true ? verdict.verdict : 'review',
                         // M507: a judgeFailure verdict is a synthetic fail-closed fallback, not
                         // a considered judgment. It must be distinguishable in the ledger from a
                         // real 'review' — conflating them is what made ~22% of judge calls look
                         // like deliberate rejections. Mirrors automerge-pass.ts:243 so BOTH judge
                         // paths record the same way. `wouldMerge` is always false on a failure,
                         // so this never displaces the 'would-merge' marker.
-                        detail: verdict.judgeFailure
-                            ? (verdict.judgeFailure === 'parse' ? 'judge-parse-failure' : 'judge-network-failure')
+                        detail: verdict.judgeFailure || verdict.considered !== true
+                            ? (verdict.judgeFailure === 'network' ? 'judge-network-failure' : 'judge-parse-failure')
                             : (verdict.wouldMerge && inlineReviewerIndependence.independent ? 'would-merge' : ''),
                         ...(verdict.semanticEvents ? { semanticEvents: verdict.semanticEvents } : {}),
                         ...(inlineAttestation !== undefined ? { judgeAttestation: inlineAttestation } : {}),
@@ -3085,14 +2855,15 @@ export async function autoMergeProposal(id, cfg, invocation = {}) {
                             ? { judgeAttestationIssuedAt: ts, judgeAttestationIntent: 'would-merge' }
                             : {}),
                     });
-                    if (verdict.verdict === 'ship' && verdict.wouldMerge === true &&
+                    if (verdict.considered === true && verdict.verdict === 'ship' && verdict.wouldMerge === true &&
                         !inlineReviewerIndependence.independent) {
                         return refuse(`manager quality gate: ${inlineReviewerIndependence.reason}`, repo);
                     }
+                    const consideredVerdict = verdict.considered === true;
                     managerVerdict = {
-                        verdict: verdict.verdict,
-                        wouldMerge: verdict.wouldMerge,
-                        reasonCode: judgeDecisionReasonCode(verdict.verdict, verdict.wouldMerge && inlineReviewerIndependence.independent),
+                        verdict: consideredVerdict ? verdict.verdict : 'review',
+                        wouldMerge: consideredVerdict ? verdict.wouldMerge : false,
+                        reasonCode: judgeDecisionReasonCode(consideredVerdict ? verdict.verdict : 'review', consideredVerdict && verdict.wouldMerge && inlineReviewerIndependence.independent),
                     };
                 }
                 catch {
@@ -3689,37 +3460,12 @@ export async function autoMergeProposal(id, cfg, invocation = {}) {
                         else if (!originStable) {
                             mergeNote = 'PR opened; host auto-merge refused because canonical GitHub origin changed';
                         }
-                        else if (!url) {
-                            mergeNote = 'PR opened; host auto-merge refused because no canonical PR URL is available';
-                        }
                         else {
-                            // Reaching this branch means every protected-handoff precondition was
-                            // confirmed (PR identity, base OID, live protection, canonical origin,
-                            // canonical URL). Record that BEFORE attempting the host merge, so the
-                            // strictHandoffUncertain reconciliation path below stays correct
-                            // regardless of what the merge attempt itself returns.
-                            finalProtectedHandoffConfirmed = true;
-                            mergeNote = await attemptHostAutoMerge({
-                                repo,
-                                id,
-                                cfg,
-                                nameWithOwner: githubOrigin.nameWithOwner,
-                                repositoryId: latestProtection.evidence.repositoryId,
-                                url,
-                                base,
-                                baseOid: boundBaseHead,
-                                branch,
-                                headOid: stagedHead,
-                                observedPr,
-                                evidencePackDigest,
-                                verifierManifestDigest: requiredVerifierManifest?.digest ?? null,
-                                protectionPolicyDigest: latestProtection.evidence.policyHash,
-                                maxRisk,
-                                managerGateEnabled,
-                                allowSelfMerge,
-                                maxFiles: maxFilesForEvidence,
-                                maxLines: maxLinesForEvidence,
-                            });
+                            // Protected PR handoff is the terminal autonomous action. A host
+                            // merge requires separate authority and remains intentionally
+                            // unavailable in this release.
+                            finalProtectedHandoffConfirmed = Boolean(url);
+                            mergeNote = 'PR opened; host auto-merge is disabled until durable revocation is available';
                         }
                     }
                     const durableReason = `${mergeNote}${url ? `: ${url}` : ''} (remote handoff; awaiting host merge)`;