@awak-app/simy-cli 0.5.71 → 0.5.73

package/src/sqm/claude-plugin.js

@@ -21,6 +21,8 @@ export async function claudePluginFiles() {
     files.set(relative, content.replaceAll("current Codex thread", "current Claude Code conversation"));
   }
   files.set("hooks/delivery-loop.mjs", await readFile(path.join(SOURCE, "hooks/delivery-loop.mjs"), "utf8"));
+  files.set("hooks/outcome-progress.mjs", await readFile(path.join(SOURCE, "hooks/outcome-progress.mjs"), "utf8"));
+  files.set("hooks/continuation-policy.mjs", await readFile(path.join(SOURCE, "hooks/continuation-policy.mjs"), "utf8"));
   files.set("hooks/action-association.mjs", await readFile(path.join(SOURCE, "hooks/action-association.mjs"), "utf8"));
   files.set("hooks/workspace-lease.mjs", await readFile(path.join(SOURCE, "hooks/workspace-lease.mjs"), "utf8"));
   files.set("hooks/connection-reminder.mjs", await readFile(path.join(SOURCE, "hooks/connection-reminder.mjs"), "utf8"));

package/src/sqm/command.js

@@ -1,3 +1,4 @@
+import { safeSqmDiagnostic } from "./diagnostics.js";
 import { createSqmCheckRecorder } from "./history-store.js";
 import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
@@ -10,8 +11,9 @@ import { uploadRunEvidence } from "./evidence-client.js";
 import { evaluateKnowledgeBundle } from "./checkers.js";
 import { runSqmCheck, runSqmMinCheck } from "./index.js";
 import { lintKnowledgeModule, summarizeReplay } from "./reliability.js";
-import { ensureSqmSession } from "./session.js";
+import { ensureSqmSession, sqmSessionScope } from "./session.js";
 import { formatSqmCoverage } from "./report.js";
+import { sqmDiagnostic } from "./request-recovery.js";
 
 export async function runSqmCommand(argv, { cliVersion }) {
   if (argv.includes("--help") || argv.includes("-h") || !argv.length) {
@@ -23,14 +25,17 @@ export async function runSqmCommand(argv, { cliVersion }) {
   if (argv[0] === "replay") return await runReplayCommand(argv);
   if (!["min-check", "check"].includes(argv[0])) throw new Error("Usage: simy sqm <min-check|check|lint|replay> [options]");
   const webOrigin = resolveWebOrigin(option(argv, "--host"));
+  const authorizationLogger = argv.includes("--json")
+    ? { log: message => console.warn(message), error: message => console.error(message) }
+    : console;
   let session = await readSession(webOrigin);
   let validSession = isSessionValid(session, Date.now(), webOrigin) ? session : null;
   if (!validSession && !explicitSqmEnvironment(argv)) {
-    session = await ensureSqmSession(webOrigin, { noOpen: argv.includes("--no-open") });
+    session = await ensureSqmSession(webOrigin, { noOpen: argv.includes("--no-open"), logger: authorizationLogger });
     validSession = session;
   }
   const organizationId = process.env.SIMY_SQM_ORGANIZATION_ID || validSession?.organization_id || validSession?.org_id;
-  const token = process.env.SIMY_SQM_TOKEN || process.env.SIMY_ACCESS_TOKEN || validSession?.token;
+  let token = process.env.SIMY_SQM_TOKEN || process.env.SIMY_ACCESS_TOKEN || validSession?.token;
   const accountId = process.env.SIMY_SQM_ACCOUNT_ID || validSession?.account_id || validSession?.auth_user_id || validSession?.device_id;
   const deviceId = process.env.SIMY_SQM_DEVICE_ID || validSession?.device_id;
   if (!organizationId) throw new Error(`SQM needs an organization-bound SIMY session. Run \`simy --host ${webOrigin}\` once, then retry.`);
@@ -45,10 +50,33 @@ export async function runSqmCommand(argv, { cliVersion }) {
     endpoint,
     accountId,
     organizationId,
+    deviceId,
   };
 
   const save = createSqmCheckRecorder({ scope: { webOrigin, accountId, organizationId },
     phase: argv[0] === "min-check" ? "min" : "full", cwd: common.cwd, baseBranch: common.baseBranch });
+  const onRecoveryEvent = async diagnostic => createSqmCheckRecorder({ scope: { webOrigin, accountId, organizationId },
+    phase: argv[0] === "min-check" ? "min" : "full", cwd: common.cwd, baseBranch: common.baseBranch })({ status: "failed", diagnostic });
+  common.bundleDependencies = { onRecoveryEvent };
+  common.onRecoveryEvent = onRecoveryEvent;
+  let authenticationAttempted = false;
+  if (validSession && !process.env.SIMY_SQM_TOKEN && !process.env.SIMY_ACCESS_TOKEN) {
+    const expectedScope = sqmSessionScope(validSession, webOrigin);
+    common.onAuthenticationRequired = async ({ rejectedToken }) => {
+      if (authenticationAttempted) {
+        const error = new Error("SQM authorization was already refreshed once; resolve the sign-in error before another check.");
+        error.code = "authorization_refresh_failed"; throw error;
+      }
+      authenticationAttempted = true;
+      validSession = await ensureSqmSession(webOrigin, { noOpen: argv.includes("--no-open"), rejectedToken, expectedScope, logger: authorizationLogger });
+      token = validSession.token;
+      common.token = token;
+      return { token, accountId: validSession.account_id || validSession.auth_user_id || validSession.device_id,
+        organizationId: validSession.organization_id || validSession.org_id, deviceId: validSession.device_id,
+        endpoint: process.env.SIMY_SQM_BUNDLE_URL || new URL("sqm/knowledge-bundle", validSession.api_base_url).href };
+    };
+  }
+  let stage = "min_check";
   try {
     if (argv[0] === "min-check") {
       const result = await runSqmMinCheck(common);
@@ -60,6 +88,7 @@ export async function runSqmCommand(argv, { cliVersion }) {
       return result.status === "unavailable" ? 2 : result.status === "preliminary_failed" ? 1 : 0;
     }
 
+    stage = "min_result_read";
     const minPath = option(argv, "--min-result") || defaultMinResultPath();
     let minCheck;
     try {
@@ -71,11 +100,19 @@ export async function runSqmCommand(argv, { cliVersion }) {
       await atomicJson(minPath, minCheck);
     }
     if (minCheck.status === "unavailable") { await save(minCheck); return printUnavailable(minCheck, argv); }
+    stage = "full_check";
     const result = await runSqmCheck({ ...common, minCheck, deviceId, signingKeyPath: option(argv, "--signing-key") || undefined });
     if (result.status === "unavailable") { await save(result); return printUnavailable(result, argv); }
+    if (result.recovery?.code === "knowledge_bundle_changed") {
+      // Keep the earlier min as history; never rewrite it into an apparent
+      // success for the new bundle.
+      await atomicJson(`${minPath}.previous.${minCheck.result_digest.slice(-16)}.json`, minCheck);
+      await atomicJson(minPath, result.min_check);
+    }
     const proofPath = path.resolve(option(argv, "--proof") || "proof.json");
     const evidencePath = path.resolve(option(argv, "--signed-evidence") || `${proofPath}.signed.json`);
     const diagnosticsPath = path.resolve(option(argv, "--diagnostics") || `${proofPath}.diagnostics.json`);
+    stage = "artifact_write";
     await Promise.all([
       atomicJson(proofPath, result.proof),
       atomicJson(evidencePath, result.signed_evidence),
@@ -87,6 +124,7 @@ export async function runSqmCommand(argv, { cliVersion }) {
     let upload = { uploaded: false, reason: "disabled" };
     if (!argv.includes("--no-upload")) {
       const evidenceEndpoint = process.env.SIMY_SQM_EVIDENCE_URL || (validSession?.api_base_url ? new URL("sqm/run-evidence", validSession.api_base_url).href : undefined);
+      stage = "evidence_upload";
       upload = await uploadRunEvidence({ endpoint: evidenceEndpoint, token, proof: result.proof, signedEvidence: result.signed_evidence });
     }
     result.upload = upload;
@@ -101,7 +139,7 @@ export async function runSqmCommand(argv, { cliVersion }) {
     else printFull(result);
     return result.proof.outcome.status === "failed" ? 1 : 0;
   } catch (error) {
-    await save({ status: "failed" });
+    await save({ status: "failed", diagnostic: { ...safeSqmDiagnostic(error, stage), ...sqmDiagnostic(error, stage) } });
     throw error;
   }
 }

package/src/sqm/diagnostics.js

@@ -0,0 +1,23 @@
+// Persist machine diagnostics only. Provider/server response text can contain
+// repository content or credentials and must never enter durable check history.
+export function safeSqmDiagnostic(error, stage = "check", code = "sqm_check_failed") {
+  const value = error?.diagnostic || (error?.error && typeof error.error === "object" ? error.error : error) || {};
+  const machine = (candidate, fallback) => typeof candidate === "string" && /^[a-zA-Z][a-zA-Z0-9_]{0,79}$/.test(candidate) ? candidate : fallback;
+  const status = [value.status, value.http_status, value.errorStatus, value.httpStatus, value.error_status].find(candidate => Number.isInteger(candidate) && candidate >= 400 && candidate <= 599);
+  const requestId = value.requestId ?? value.request_id;
+  return {
+    stage: machine(value.stage ?? value.errorStage ?? value.error_stage, stage),
+    code: machine(value.code ?? value.errorCode ?? value.error_code, code),
+    ...(Number.isInteger(status) && status >= 400 && status <= 599 ? { status } : {}),
+    ...(typeof requestId === "string" && /^(?:[a-f0-9]{16,64}|[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})$/i.test(requestId) ? { requestId } : {}),
+  };
+}
+
+export function formatSqmDiagnostic(value) {
+  const hint = value.status === 401 ? "Reconnect your SIMY session."
+    : value.status === 403 ? "Check access to SQM in the selected organization."
+    : value.code === "repository_scope_unresolved" ? "Connect this repository to a system in SIMY."
+    : value.code === "knowledge_bundle_changed" || value.code === "repository_identity_changed" ? "Run min-check again for the current repository and knowledge version."
+    : "Inspect the command diagnostics for this stage before retrying.";
+  return `${value.stage} · ${value.code}${value.status ? ` · HTTP ${value.status}` : ""}${value.requestId ? ` · Request ${value.requestId}` : ""}\n${hint}`;
+}

package/src/sqm/evidence-client.js

@@ -1,12 +1,29 @@
+import { safeSqmDiagnostic } from "./diagnostics.js";
 export async function uploadRunEvidence({ endpoint, token, proof, signedEvidence, fetchImpl = globalThis.fetch }) {
   if (!endpoint || !token) return { uploaded: false, reason: "authenticated_cloud_session_unavailable" };
-  const response = await fetchImpl(endpoint, {
-    method: "POST",
-    headers: { accept: "application/json", authorization: `Bearer ${token}`, "content-type": "application/json" },
-    body: JSON.stringify({ proof, signed_evidence: signedEvidence }),
-    signal: AbortSignal.timeout(10_000),
-  });
+  let response;
+  try {
+    response = await fetchImpl(endpoint, {
+      method: "POST",
+      headers: { accept: "application/json", authorization: `Bearer ${token}`, "content-type": "application/json" },
+      body: JSON.stringify({ proof, signed_evidence: signedEvidence }),
+      signal: AbortSignal.timeout(10_000),
+    });
+  } catch (cause) {
+    const error = cause instanceof Error ? cause : new Error("SQM run evidence upload failed.");
+    error.stage = "evidence_upload";
+    error.retryable = false;
+    throw error;
+  }
   const payload = await response.json().catch(() => null);
-  if (!response.ok) throw new Error(`SQM run evidence upload failed with HTTP ${response.status}${payload?.error ? `: ${typeof payload.error === "string" ? payload.error : payload.error.message || "unknown error"}` : ""}.`);
+  if (!response.ok) {
+    const error = new Error(`SQM run evidence upload failed with HTTP ${response.status}${payload?.error ? `: ${typeof payload.error === "string" ? payload.error : payload.error.message || "unknown error"}` : ""}.`);
+    error.status = response.status;
+    error.stage = "evidence_upload";
+    error.retryable = false;
+    Object.assign(error, safeSqmDiagnostic({ status: response.status, code: payload?.error?.code,
+      requestId: response.headers?.get?.("x-request-id") }, "evidence_upload", "evidence_upload_failed"));
+    throw error;
+  }
   return { uploaded: true, ...payload };
 }

package/src/sqm/history-store.js

@@ -1,7 +1,9 @@
+import { diagnosticLogger } from "../diagnostic-log.js";
+import { safeSqmDiagnostic, formatSqmDiagnostic } from "./diagnostics.js";
 import { createHash, randomUUID } from "node:crypto";
 import { mkdir, readFile, readdir, rename, rm, writeFile } from "node:fs/promises";
 import { basename, join } from "node:path";
-import { formatSqmCoverage } from "./report.js";
+import { formatSqmCoverage, sqmCoverageWarnings } from "./report.js";
 import { defaultSessionRoot } from "../session-store.js";
 
 const LIMIT = 100;
@@ -44,6 +46,8 @@ export function createSqmHistoryStore({ root = defaultSessionRoot(), now = () =>
       try {
         await writeFile(temp, JSON.stringify(item), { mode: 0o600 });
         await rename(temp, target);
+        if (["failed", "unavailable"].includes(item.state)) await diagnosticLogger({ root, scope }).record({
+          kind: item.kind, stage: entry.errorStage || item.phase || "unknown", code: item.errorCode, provider: item.provider, http_status: entry.httpStatus, at: item.finishedAt || item.startedAt });
       } finally { await rm(temp, { force: true }); cache.delete(dir); }
       const items = await list(scope);
       for (const kind of ["analysis", "check"]) {
@@ -69,9 +73,11 @@ function metadata(entry) {
   if (!entry || !["analysis", "check"].includes(entry.kind) || typeof entry.key !== "string" || !entry.key.startsWith(entry.kind === "analysis" ? "sqm:" : "sqm-check:")) return null;
   if (!["running", "completed", "failed", "unavailable", "interrupted", "verification_pending"].includes(entry.state) || !Number.isFinite(Date.parse(entry.startedAt))) return null;
   const item = {};
-  for (const name of ["key", "id", "kind", "label", "state", "provider", "phase", "repository", "startedAt", "finishedAt", "instruction", "result", "error", "errorCode", "webUrl"]) {
+  for (const name of ["key", "id", "kind", "label", "state", "provider", "phase", "repository", "startedAt", "finishedAt", "instruction", "result", "error", "errorCode", "errorStage", "requestId", "webUrl"]) {
     if (typeof entry[name] === "string") item[name] = entry[name].slice(0, ["instruction", "result", "error"].includes(name) ? 4096 : 512);
   }
+  if (Number.isInteger(entry.errorStatus) && entry.errorStatus >= 400 && entry.errorStatus <= 599) item.errorStatus = entry.errorStatus;
+  if (Number.isInteger(entry.httpStatus) && entry.httpStatus >= 400 && entry.httpStatus <= 599) item.httpStatus = entry.httpStatus;
   return item;
 }
 
@@ -94,15 +100,25 @@ export function createSqmCheckRecorder({ root, scope, phase, cwd, baseBranch, on
     const repository = identity?.repository || result.repository;
     const outcome = proof?.outcome.status || result.min_check?.status || result.status;
     const state = outcome === "unavailable" ? "unavailable" : ["failed", "preliminary_failed"].includes(outcome) ? "failed" : ["requires_human", "requires_post_deploy"].includes(outcome) ? "verification_pending" : "completed";
+    const failure = result.upload?.diagnostic ? safeSqmDiagnostic(result.upload.diagnostic, "evidence_upload", "evidence_upload_failed") : ["failed", "unavailable"].includes(state) && (result.diagnostic || result.error || result.errorCode || !identity)
+      ? safeSqmDiagnostic(result, phase, state === "unavailable" ? "sqm_check_unavailable" : "sqm_check_failed") : null;
+    const minCheck = result.min_check || result;
+    const minWarnings = !proof && Array.isArray(minCheck.matched_modules)
+      ? sqmCoverageWarnings({ moduleCount: minCheck.matched_modules.length,
+        scenarioCount: Array.isArray(minCheck.full_check_plan) ? minCheck.full_check_plan.length :
+          minCheck.matched_modules.reduce((total, module) => total + (module.scenario_ids?.length || 0), 0),
+        noSystemKnowledge: minCheck.matched_modules.length === 0 && minCheck.coverage_reasons?.includes("no_system_knowledge") === true,
+        outcomeStatus: minCheck.status }) : [];
     const summary = proof ? [`Full check: ${proof.outcome.status}`, formatSqmCoverage(proof), `Evidence upload: ${result.upload?.uploaded ? "uploaded" : "kept locally"}`].join("\n")
-      : state === "unavailable" ? "SQM could not obtain a verified result. Retry the command to see current diagnostics."
-      : state === "failed" && !identity ? "The command did not finish. Retry it to see current diagnostics."
+      : state === "unavailable" ? "SQM could not obtain a verified result. See the recorded diagnostics below."
+      : state === "failed" && !identity ? "The command did not finish. See the recorded diagnostics below."
       : `Min-check: ${result.min_check?.status || result.status} · ${(result.preliminary_findings || result.min_check?.preliminary_findings)?.length || 0} preliminary finding(s) · ${(result.matched_modules || result.min_check?.matched_modules)?.length || 0} matched module(s).\nThis is a preflight; run the full check for signed verification.`;
     try {
       await history.record(scope, { key, id: key, kind: "check", phase, state, startedAt, finishedAt: new Date().toISOString(), repository,
         label: `${phase === "min" ? "Min-check" : "Check"} · ${repository || basename(cwd)}`,
         instruction: [repository || basename(cwd), `Base: ${identity?.base_ref || baseBranch}`, identity?.head_commit ? `Head: ${identity.head_commit}` : ""].filter(Boolean).join("\n"),
-        result: summary });
+        result: [summary, ...minWarnings].join("\n"),
+        ...(failure ? { error: formatSqmDiagnostic(failure), errorCode: failure.code, errorStage: failure.stage, errorStatus: failure.status, requestId: failure.requestId } : {}) });
     } catch { onError(); }
   };
 }

package/src/sqm/index.js

@@ -1,9 +1,13 @@
+import { sqmCoverageWarnings } from "./report.js";
+import { safeSqmDiagnostic } from "./diagnostics.js";
 import { createSqmCheckRecorder } from "./history-store.js";
 import { evaluateKnowledgeBundle } from "./checkers.js";
 import { loadKnowledgeBundle } from "./bundle-store.js";
 import { uploadRunEvidence } from "./evidence-client.js";
 import { buildProof, finalizeMinCheck, repositoryIdentity, sameRepositoryIdentity, signProof, verifyMinCheck, verifySignedEvidence } from "./proof.js";
 import { inspectRepository } from "./repository.js";
+import { sqmDiagnostic } from "./request-recovery.js";
+import { canonicalize } from "./canonical.js";
 
 export function createSqmChecker({
   cwd = process.cwd(),
@@ -19,6 +23,7 @@ export function createSqmChecker({
   webOrigin,
   historyRoot,
   evidenceEndpoint,
+  signingKeyPath,
   uploadRunEvidenceImpl = uploadRunEvidence,
   inspectRepositoryImpl = inspectRepository,
   loadKnowledgeBundleImpl = loadKnowledgeBundle,
@@ -29,34 +34,59 @@ export function createSqmChecker({
   let pinnedLoad = null;
   let pinnedRepository = null;
   let latestMinCheck = null;
+  let pinnedSystemScope;
+  const onRecoveryEvent = async (diagnostic) => {
+    await createSqmCheckRecorder({ root: historyRoot,
+      scope: historyRoot ? { webOrigin, accountId, organizationId } : null,
+      phase: diagnostic.stage === "evidence_upload" ? "full" : "min", cwd, baseBranch })({ status: "failed", diagnostic });
+    await dependencies.onRecoveryEvent?.(diagnostic);
+  };
 
   const checkCurrentRepository = async function(_attempt = null, { phase = "min" } = {}) {
     let repository;
     try {
       repository = await inspectRepositoryImpl(cwd, { baseBranch, runCommand: dependencies.runCommand });
     } catch (error) {
-      return unavailable(`SQM repository inspection failed: ${message(error)}`);
+      return { ...unavailable(`SQM repository inspection failed: ${message(error)}`), diagnostic: { ...safeSqmDiagnostic(error, "repository", "repository_inspection_failed"), ...sqmDiagnostic(error, "repository") } };
     }
     if (pinnedRepository && pinnedRepository !== repository.repository) return unavailable(`SQM repository changed during a pinned run (${pinnedRepository} to ${repository.repository}).`, repository.repository);
     if (!pinnedLoad) {
       pinnedRepository = repository.repository;
-      pinnedLoad = loadKnowledgeBundleImpl({ repository: repository.repository, cliVersion, offline, refresh, token, endpoint, accountId, organizationId, ...dependencies });
+      pinnedLoad = loadKnowledgeBundleImpl({ ...dependencies, repository: repository.repository, cliVersion, offline, refresh, token, endpoint, accountId, organizationId, onRecoveryEvent });
     }
     const loaded = await pinnedLoad;
-    if (!loaded.bundle) return { ...unavailable(loaded.warnings[0], repository.repository), warnings: loaded.warnings };
+    if (!loaded.bundle) {
+      // A failed read must not poison the run permanently. A later explicit
+      // same-scope check or refreshed sign-in may try loading again.
+      pinnedLoad = null;
+      return { ...unavailable(loaded.warnings[0], repository.repository), warnings: loaded.warnings, diagnostic: loaded.diagnostic };
+    }
+    if (pinnedSystemScope === undefined) pinnedSystemScope = loaded.bundle.system_scope || null;
+    else if (!sameSystemScope(pinnedSystemScope, loaded.bundle.system_scope || null)) {
+      return { ...unavailable("SQM system scope changed during recovery; authorize the current scope before a new check.", repository.repository),
+        diagnostic: { stage: "knowledge_loading", code: "authorization_scope_changed", retryable: false } };
+    }
     try {
       const evaluate = executeKnowledgeBundleImpl
         ? async (bundle, currentRepository) => ({ findings: await executeKnowledgeBundleImpl(bundle, currentRepository), modules: [] })
         : evaluateKnowledgeBundleImpl;
       if (phase === "full") {
-        if (!latestMinCheck || !sameRepositoryIdentity(latestMinCheck.repository_identity, repositoryIdentity(repository))) {
+        if (!latestMinCheck || !sameRepositoryIdentity(latestMinCheck.repository_identity, repositoryIdentity(repository)) ||
+            latestMinCheck.knowledge_bundle.digest !== loaded.bundle.integrity.digest) {
           latestMinCheck = await buildMinCheck({ repository, bundle: loaded.bundle, evaluation: await evaluate(loaded.bundle, repository), organizationId: organizationId || loaded.bundle.organization_id, cliVersion });
         }
-        const full = await buildFullCheck({ repository, bundle: loaded.bundle, minCheck: latestMinCheck, evaluation: await evaluate(loaded.bundle, repository), organizationId: organizationId || loaded.bundle.organization_id, cliVersion, deviceId, accountId });
+        const fullEvaluation = await evaluate(loaded.bundle, repository);
+        const current = await inspectRepositoryImpl(cwd, { baseBranch, runCommand: dependencies.runCommand });
+        if (!sameRepositoryIdentity(repositoryIdentity(repository), repositoryIdentity(current))) {
+          throw candidateError("Repository identity changed during SQM full verification; no current proof can be signed.");
+        }
+        const full = await buildFullCheck({ repository, bundle: loaded.bundle, minCheck: latestMinCheck, evaluation: fullEvaluation, organizationId: organizationId || loaded.bundle.organization_id, cliVersion, deviceId, accountId, signingKeyPath });
         try {
           full.upload = await uploadRunEvidenceImpl({ endpoint: evidenceEndpoint, token, proof: full.proof, signedEvidence: full.signed_evidence });
         } catch (error) {
           full.upload = { uploaded: false, reason: `upload_failed: ${message(error)}` };
+          full.upload.diagnostic = { ...safeSqmDiagnostic(error, "evidence_upload", "evidence_upload_failed"), ...sqmDiagnostic(error, "evidence_upload") };
+          await onRecoveryEvent(full.upload.diagnostic);
           full.warnings.push(`SQM signed evidence remains local because Cloud upload failed: ${message(error)}`);
         }
         return full;
@@ -64,38 +94,91 @@ export function createSqmChecker({
       latestMinCheck = await buildMinCheck({ repository, bundle: loaded.bundle, evaluation: await evaluate(loaded.bundle, repository), organizationId: organizationId || loaded.bundle.organization_id, cliVersion });
       return toLegacyCheck(latestMinCheck, loaded);
     } catch (error) {
-      return { ...unavailable(`SQM ${phase} execution failed: ${message(error)}`, repository.repository), bundle: bundleIdentity(loaded.bundle), warnings: [...loaded.warnings, `SQM ${phase} execution failed: ${message(error)}`] };
+      return { ...unavailable(`SQM ${phase} execution failed: ${message(error)}`, repository.repository), bundle: bundleIdentity(loaded.bundle), warnings: [...loaded.warnings, `SQM ${phase} execution failed: ${message(error)}`], diagnostic: { ...safeSqmDiagnostic(error, `${phase}_check`, "sqm_execution_failed"), ...sqmDiagnostic(error, `${phase}_check`) } };
     }
   };
-  return async (attempt, options = {}) => {
+  const checker = async (attempt, options = {}) => {
     const save = createSqmCheckRecorder({ root: historyRoot, scope: historyRoot ? { webOrigin, accountId, organizationId } : null, phase: options.phase || "min", cwd, baseBranch });
     try {
       const result = await checkCurrentRepository(attempt, options);
       await save(result); return result;
-    } catch (error) { await save({ status: "failed" }); throw error; }
+    } catch (error) {
+      const stage = options.phase === "full" ? "full_check" : "min_check";
+      const diagnostic = { ...safeSqmDiagnostic(error, stage), ...sqmDiagnostic(error, stage) };
+      if (diagnostic.retryable) pinnedLoad = null;
+      await save({ status: "failed", diagnostic }); throw error;
+    }
   };
+  checker.updateSession = (next) => {
+    for (const [field, current] of Object.entries({ accountId, organizationId, deviceId, endpoint, webOrigin })) {
+      if (current && next?.[field] !== current) {
+        const error = new Error(`SQM session changed its ${field}; the original scope cannot be resumed with it.`);
+        error.code = "authorization_scope_changed"; throw error;
+      }
+    }
+    if (!next?.token) throw new Error("An authenticated same-scope SQM session is required.");
+    if (next.token !== token) { token = next.token; pinnedLoad = null; }
+  };
+  return checker;
 }
 
 export async function runSqmMinCheck(options) {
   const context = await loadContext(options);
-  if (!context.loaded.bundle) return { ...unavailable(context.loaded.warnings[0], context.repository.repository), warnings: context.loaded.warnings };
+  if (!context.loaded.bundle) return { ...unavailable(context.loaded.warnings[0], context.repository.repository), warnings: context.loaded.warnings, diagnostic: context.loaded.diagnostic };
   const evaluation = await (options.evaluateKnowledgeBundleImpl || evaluateKnowledgeBundle)(context.loaded.bundle, context.repository);
   return buildMinCheck({ repository: context.repository, bundle: context.loaded.bundle, evaluation, organizationId: options.organizationId, cliVersion: options.cliVersion });
 }
 
 export async function runSqmCheck(options) {
   const context = await loadContext(options);
-  if (!context.loaded.bundle) return { ...unavailable(context.loaded.warnings[0], context.repository.repository), warnings: context.loaded.warnings };
+  if (!context.loaded.bundle) return { ...unavailable(context.loaded.warnings[0], context.repository.repository), warnings: context.loaded.warnings, diagnostic: context.loaded.diagnostic };
   verifyMinCheck(options.minCheck);
-  if (!sameRepositoryIdentity(options.minCheck.repository_identity, repositoryIdentity(context.repository))) throw new Error("Repository identity changed after min-check; run `simy sqm min-check` again.");
-  if (options.minCheck.knowledge_bundle.digest !== context.loaded.bundle.integrity.digest) throw new Error("Knowledge bundle changed after min-check; run `simy sqm min-check` again so both phases use one pinned bundle.");
-  const evaluation = await (options.evaluateKnowledgeBundleImpl || evaluateKnowledgeBundle)(context.loaded.bundle, context.repository);
-  return buildFullCheck({ repository: context.repository, bundle: context.loaded.bundle, minCheck: options.minCheck, evaluation, organizationId: options.organizationId, cliVersion: options.cliVersion, deviceId: options.deviceId, accountId: options.accountId, signingKeyPath: options.signingKeyPath });
+  if (options.minCheck.organization_id !== options.organizationId || context.loaded.bundle.organization_id !== options.organizationId) {
+    throw scopeError("SQM organization changed after min-check; authorize the original organization before resuming.");
+  }
+  if (!sameRepositoryIdentity(options.minCheck.repository_identity, repositoryIdentity(context.repository))) throw Object.assign(candidateError("Repository identity changed after min-check; run `simy sqm min-check` again."), { stage: "identity_validation" });
+  if (!sameSystemScope(options.minCheck.knowledge_bundle.system_scope || null, context.loaded.bundle.system_scope || null)) {
+    throw scopeError("SQM system scope changed after min-check; authorize the current scope before a new check.");
+  }
+  const evaluate = options.evaluateKnowledgeBundleImpl || evaluateKnowledgeBundle;
+  let minCheck = options.minCheck;
+  if (minCheck.knowledge_bundle.digest !== context.loaded.bundle.integrity.digest) {
+    await options.onRecoveryEvent?.({ stage: "full_check", code: "knowledge_bundle_changed", retryable: true });
+    minCheck = await buildMinCheck({ repository: context.repository, bundle: context.loaded.bundle,
+      evaluation: await evaluate(context.loaded.bundle, context.repository), organizationId: options.organizationId, cliVersion: options.cliVersion });
+    const current = await (options.inspectRepositoryImpl || inspectRepository)(options.cwd || process.cwd(), { baseBranch: options.baseBranch || "dev", runCommand: options.runCommand });
+    if (!sameRepositoryIdentity(minCheck.repository_identity, repositoryIdentity(current))) throw new Error("Repository identity changed during min-check recovery; run `simy sqm min-check` again.");
+  }
+  const evaluation = await evaluate(context.loaded.bundle, context.repository);
+  const verifiedRepository = await (options.inspectRepositoryImpl || inspectRepository)(options.cwd || process.cwd(), { baseBranch: options.baseBranch || "dev", runCommand: options.runCommand });
+  if (!sameRepositoryIdentity(repositoryIdentity(context.repository), repositoryIdentity(verifiedRepository))) {
+    throw candidateError("Repository identity changed during SQM full verification; no current proof can be signed.");
+  }
+  const result = await buildFullCheck({ repository: context.repository, bundle: context.loaded.bundle, minCheck, evaluation, organizationId: options.organizationId, cliVersion: options.cliVersion, deviceId: options.deviceId, accountId: options.accountId, signingKeyPath: options.signingKeyPath });
+  if (minCheck !== options.minCheck) result.recovery = { code: "knowledge_bundle_changed", previous_min_digest: options.minCheck.result_digest, current_min_digest: minCheck.result_digest };
+  return result;
 }
 
 async function loadContext(options) {
   const repository = await (options.inspectRepositoryImpl || inspectRepository)(options.cwd || process.cwd(), { baseBranch: options.baseBranch || "dev", runCommand: options.runCommand });
-  const loaded = await (options.loadKnowledgeBundleImpl || loadKnowledgeBundle)({ repository: repository.repository, cliVersion: options.cliVersion, offline: options.offline, refresh: options.refresh, token: options.token, endpoint: options.endpoint, accountId: options.accountId, organizationId: options.organizationId, ...(options.bundleDependencies || {}) });
+  const rejectedToken = options.token;
+  const originalIdentity = repositoryIdentity(repository);
+  const scope = Object.fromEntries(["accountId", "organizationId", "deviceId", "endpoint"].map(field => [field, options[field]]));
+  const load = (token) => (options.loadKnowledgeBundleImpl || loadKnowledgeBundle)({ ...(options.bundleDependencies || {}),
+    repository: repository.repository, cliVersion: options.cliVersion, offline: options.offline, refresh: options.refresh,
+    token, endpoint: scope.endpoint, accountId: scope.accountId, organizationId: scope.organizationId });
+  let loaded = await load(rejectedToken);
+  if (!loaded.bundle && loaded.diagnostic?.http_status === 401 && options.onAuthenticationRequired && !options.offline) {
+    await options.onRecoveryEvent?.(loaded.diagnostic);
+    const next = await options.onAuthenticationRequired({ rejectedToken, ...scope });
+    for (const field of ["accountId", "organizationId", "deviceId", "endpoint"]) {
+      if (scope[field] && next?.[field] !== scope[field]) throw scopeError(`SQM authorization changed its ${field}; do not resume another scope.`);
+    }
+    if (!next?.token || next.token === rejectedToken) throw scopeError("SQM authorization did not replace the rejected token.");
+    const current = await (options.inspectRepositoryImpl || inspectRepository)(options.cwd || process.cwd(), { baseBranch: options.baseBranch || "dev", runCommand: options.runCommand });
+    if (!sameRepositoryIdentity(originalIdentity, repositoryIdentity(current))) throw candidateError("Repository identity changed while waiting for SQM authorization; begin a new check against the current candidate.");
+    loaded = await load(next.token);
+  }
   return { repository, loaded };
 }
 
@@ -113,6 +196,13 @@ async function buildMinCheck({ repository, bundle, evaluation, organizationId, c
     preliminary_findings: evaluation.findings,
     matched_modules: evaluation.modules.map((module) => ({ module_id: module.module_id, module_version: module.module_version, state_model_ids: module.state_models.map((model) => model.id), transition_ids: module.state_models.flatMap((model) => model.transitions.map((transition) => transition.id)), stressor_ids: module.stressors.map((stressor) => stressor.id), scenario_ids: module.scenarios.map((scenario) => scenario.id) })),
     full_check_plan: plan,
+    coverage_reasons: [
+      ...(evaluation.modules.length === 0 ? ["no_applicable_rules"] : []),
+      ...(bundle.modules?.length === 0 ? ["no_system_knowledge"] : []),
+    ],
+    warnings: sqmCoverageWarnings({ moduleCount: evaluation.modules.length, scenarioCount: plan.length,
+      noSystemKnowledge: bundle.modules?.length === 0,
+      outcomeStatus: evaluation.findings.some(finding => finding.enforcement === "blocking") ? "preliminary_failed" : "passed" }),
   });
 }
 
@@ -133,12 +223,12 @@ async function buildFullCheck({ repository, bundle, minCheck, evaluation, organi
     proof,
     signed_evidence: signedEvidence,
     signature_verification: verification,
-    warnings: [],
+    warnings: sqmCoverageWarnings({ moduleCount: evaluation.modules.length, scenarioCount: evaluation.modules.reduce((count, module) => count + module.scenarios.length, 0), noSystemKnowledge: bundle.modules?.length === 0, outcomeStatus: proof.outcome.status }),
   };
 }
 
 function toLegacyCheck(minCheck, loaded) {
-  return { status: "checked", mode: "min", repository: minCheck.repository_identity.repository, base_ref: minCheck.repository_identity.base_ref, source: loaded.source, warnings: loaded.warnings, bundle: minCheck.knowledge_bundle, findings: minCheck.preliminary_findings, min_check: minCheck };
+  return { status: "checked", mode: "min", repository: minCheck.repository_identity.repository, base_ref: minCheck.repository_identity.base_ref, source: loaded.source, warnings: [...loaded.warnings, ...(minCheck.warnings || [])], bundle: minCheck.knowledge_bundle, findings: minCheck.preliminary_findings, min_check: minCheck };
 }
 
 function bundleIdentity(bundle) {
@@ -150,3 +240,12 @@ function unavailable(warning, repository = null) {
 }
 
 function message(error) { return error instanceof Error ? error.message : String(error); }
+
+function sameSystemScope(left, right) {
+  const normalized = (scope) => scope ? { organization_id: scope.organization_id,
+    repository: scope.repository?.toLowerCase(), graph_revision: scope.graph_revision,
+    repositories: [...(scope.repositories || [])].map((repository) => repository.toLowerCase()).sort() } : null;
+  return canonicalize(normalized(left)) === canonicalize(normalized(right));
+}
+function scopeError(message) { const error = new Error(message); error.code = "authorization_scope_changed"; return error; }
+function candidateError(message) { const error = new Error(message); error.code = "repository_identity_changed"; return error; }

package/src/sqm/proof.js

@@ -1,9 +1,9 @@
-import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync, randomUUID, sign, verify } from "node:crypto";
-import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { createHash, createPublicKey, randomUUID, sign, verify } from "node:crypto";
 import { homedir } from "node:os";
 import path from "node:path";
 
 import { canonicalize } from "./canonical.js";
+import { loadDeviceSigningIdentity } from "../device-signing-identity.js";
 
 export function repositoryIdentity(repository) {
   return {
@@ -73,6 +73,7 @@ export function buildProof({ organizationId, repository, bundle, minCheck, evalu
         ...(hasFailure ? ["one_or_more_blocking_checks_failed"] : []),
         ...(advisoryFindingCount > 0 ? ["advisory_findings_observed"] : []),
         ...(evaluation.modules.length === 0 ? ["no_applicable_rules"] : []),
+        ...(bundle.modules?.length === 0 ? ["no_system_knowledge"] : []),
         ...(requiresHuman ? ["human_evidence_required"] : []),
         ...(requiresPostDeploy ? ["post_deploy_evidence_required"] : []),
       ],
@@ -97,7 +98,7 @@ export async function signProof(proof, {
   issuedAt = new Date().toISOString(),
 } = {}) {
   if (!deviceId) throw new Error("A trusted SIMY CLI device identity is required to sign SQM proof.");
-  const identity = await loadOrCreateSigningIdentity(keyPath);
+  const identity = await loadDeviceSigningIdentity(keyPath, { create: true });
   const proofDigest = verifyProof(proof);
   const signature = sign(null, Buffer.from(proofDigest.slice("sha256:".length), "hex"), identity.privateKey).toString("base64");
   return {
@@ -132,26 +133,6 @@ export function verifySignedEvidence(proof, evidence) {
   return { proof_digest: proofDigest, key_id: keyId, valid: true };
 }
 
-async function loadOrCreateSigningIdentity(location) {
-  try {
-    const parsed = JSON.parse(await readFile(location, "utf8"));
-    const privateKey = createPrivateKey({ key: Buffer.from(parsed.private_key, "base64"), format: "der", type: "pkcs8" });
-    const publicKeyDer = Buffer.from(parsed.public_key, "base64");
-    const keyId = `sha256:${createHash("sha256").update(publicKeyDer).digest("hex")}`;
-    if (parsed.key_id !== keyId) throw new Error("stored key ID mismatch");
-    return { privateKey, publicKeyDer, keyId };
-  } catch (error) {
-    if (error?.code !== "ENOENT") throw new Error(`SQM signing identity is invalid: ${error.message}`);
-  }
-  const pair = generateKeyPairSync("ed25519");
-  const privateKeyDer = pair.privateKey.export({ format: "der", type: "pkcs8" });
-  const publicKeyDer = pair.publicKey.export({ format: "der", type: "spki" });
-  const keyId = `sha256:${createHash("sha256").update(publicKeyDer).digest("hex")}`;
-  await mkdir(path.dirname(location), { recursive: true, mode: 0o700 });
-  await writeFile(location, `${JSON.stringify({ algorithm: "ed25519", key_id: keyId, private_key: privateKeyDer.toString("base64"), public_key: publicKeyDer.toString("base64"), created_at: new Date().toISOString() }, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
-  return { privateKey: pair.privateKey, publicKeyDer, keyId };
-}
-
 function taggedDigest(value) {
   return `sha256:${createHash("sha256").update(canonicalize(value), "utf8").digest("hex")}`;
 }

package/src/sqm/report.js

@@ -15,9 +15,16 @@ export function formatSqmCoverage(proof) {
   ];
   if (scenarios.length) lines.push(`Scenario evaluations: ${[...statusCounts].map(([status, count]) => `${status}=${count}`).join(" · ")}`);
   if (proof.outcome.reasons.length) lines.push(`Outcome reasons: ${proof.outcome.reasons.join(", ")}`);
-  if (!modules.length) lines.push("No applicable rules: this result does not establish feature or historical incident coverage.");
-  else if (!scenarios.length) lines.push("No scenario evaluations: rule results alone do not establish scenario coverage.");
+  lines.push(...sqmCoverageWarnings({ moduleCount: modules.length, scenarioCount: scenarios.length,
+    noSystemKnowledge: proof.outcome.reasons.includes("no_system_knowledge"), outcomeStatus: proof.outcome.status }));
   if (modules.length && !blocking) lines.push("Advisory-only scope: findings do not block this outcome.");
   lines.push("Scenario evaluations are deterministic checks, not browser/provider/deployed journey evidence. Record incident coverage and delivery acceptance separately.");
   return lines.join("\n");
 }
+
+export function sqmCoverageWarnings({ moduleCount, scenarioCount, noSystemKnowledge, outcomeStatus = "passed" }) {
+  if (noSystemKnowledge) return [`Warning: the selected system/repository's downloaded SQM knowledge bundle has no published knowledge. ${outcomeStatus === "passed" ? "This is a pass with 0 evaluated cases" : "This result has 0 evaluated cases"}; it does not establish feature or historical incident coverage.`];
+  if (!moduleCount) return ["Warning: no applicable rules matched this change (0 evaluated cases). This result does not establish feature or historical incident coverage; it does not mean the system has no past knowledge."];
+  if (!scenarioCount) return ["Warning: No scenario evaluations: rule results alone do not establish scenario coverage."];
+  return [];
+}