@bitkyc08/opencodex 2.12.0 → 2.13.0

package/src/lab/automation/recovery.ts

@@ -0,0 +1,24 @@
+import type { LabAutomationPolicyV1, LabAutomationStateV1 } from "./types";
+import { transitionRun } from "./queue";
+import { setCooldown } from "./cooldown";
+import { LAB_AUTOMATION_HARD_MAX } from "./constants";
+
+/** Reconcile runs left running after process restart. */
+export function recoverLabAutomationState(
+  policy: LabAutomationPolicyV1,
+  state: LabAutomationStateV1,
+  now: number,
+): LabAutomationStateV1 {
+  let next = { ...state };
+  for (const run of state.runs) {
+    if (run.state !== "running") continue;
+    next = transitionRun(next, run.runId, "abandoned", now, "process_restart");
+    next = setCooldown(
+      next,
+      run.runKey,
+      now + Math.min(policy.failureCooldownMs, LAB_AUTOMATION_HARD_MAX.failureCooldownMs),
+      now,
+    );
+  }
+  return next;
+}

package/src/lab/automation/route-context.ts

@@ -0,0 +1,21 @@
+import type { LabRouteContext } from "../live/types";
+import type { ResolvedPolicyRouteSubject } from "../../routing/compatibility/subject";
+
+/** Harness features the production trusted-route automation contract actually provides. */
+export const CL08_TRUSTED_LIVE_HARNESS_FEATURES = Object.freeze([
+  "live_transport",
+]);
+
+/** Build the CL-03 route context automation dispatch and planning share. */
+export function buildAutomationLiveRouteContext(
+  resolved: ResolvedPolicyRouteSubject,
+  allowPrivateNetwork = false,
+): LabRouteContext {
+  return {
+    ...resolved.routeContext,
+    labRunApproval: true,
+    allowPrivateNetwork,
+    requiredClaims: resolved.routeContext.requiredClaims ?? [],
+    availableHarnessFeatures: [...CL08_TRUSTED_LIVE_HARNESS_FEATURES],
+  };
+}

package/src/lab/automation/run-key.ts

@@ -0,0 +1,44 @@
+import { createHash } from "node:crypto";
+import { jcsStringify } from "../digest";
+import type { LabAutomationLayer } from "./types";
+
+export interface RunKeyInput {
+  evidenceLayer: LabAutomationLayer;
+  subjectId: string;
+  suiteId: string;
+  suiteVersion: string;
+  suiteManifestDigest: string;
+  scenarioId: string;
+  scenarioVersion: string;
+  scenarioManifestDigest: string;
+  executionContractDigest: string;
+}
+
+/** Deterministic deduplication key for orchestration runs. */
+export function buildLabAutomationRunKey(input: RunKeyInput): string {
+  const payload = {
+    evidenceLayer: input.evidenceLayer,
+    subjectId: input.subjectId,
+    suiteId: input.suiteId,
+    suiteVersion: input.suiteVersion,
+    suiteManifestDigest: input.suiteManifestDigest,
+    scenarioId: input.scenarioId,
+    scenarioVersion: input.scenarioVersion,
+    scenarioManifestDigest: input.scenarioManifestDigest,
+    executionContractDigest: input.executionContractDigest,
+  };
+  return createHash("sha256").update(jcsStringify(payload)).digest("hex");
+}
+
+/** Contract identity digest for protocol/live/fabric execution boundaries. */
+export function protocolExecutionContractDigest(): string {
+  return createHash("sha256").update(jcsStringify({ contract: "cl-01-protocol-harness-v1" })).digest("hex");
+}
+
+export function liveExecutionContractDigest(): string {
+  return createHash("sha256").update(jcsStringify({ contract: "cl-03-live-trusted-route-v1" })).digest("hex");
+}
+
+export function fabricExecutionContractDigest(): string {
+  return createHash("sha256").update(jcsStringify({ contract: "cl-07-fabric-trusted-route-v1" })).digest("hex");
+}

package/src/lab/automation/runs-query.ts

@@ -0,0 +1,34 @@
+import type { LabAutomationRunRecordV1, LabAutomationStateV1 } from "./types";
+import { LAB_AUTOMATION_HARD_MAX } from "./constants";
+import { LabAutomationError } from "./types";
+
+export interface LabAutomationRunsPage {
+  items: LabAutomationRunRecordV1[];
+  hasMore: boolean;
+  nextCursor?: string;
+}
+
+export function listLabAutomationRuns(
+  state: LabAutomationStateV1,
+  limit = 50,
+  cursor?: string,
+): LabAutomationRunsPage {
+  const capped = Math.min(Math.max(1, limit), LAB_AUTOMATION_HARD_MAX.maxPersistedRuns);
+  const sorted = [...state.runs].sort((a, b) => {
+    if (a.createdAt !== b.createdAt) return b.createdAt - a.createdAt;
+    return a.runId < b.runId ? -1 : 1;
+  });
+  let start = 0;
+  if (cursor) {
+    const index = sorted.findIndex((row) => row.runId === cursor);
+    if (index < 0) throw new LabAutomationError("invalid or expired run cursor", "invalid_cursor");
+    start = index + 1;
+  }
+  const slice = sorted.slice(start, start + capped);
+  const hasMore = start + capped < sorted.length;
+  return {
+    items: slice,
+    hasMore,
+    ...(hasMore && slice.length > 0 ? { nextCursor: slice[slice.length - 1]!.runId } : {}),
+  };
+}

package/src/lab/automation/types.ts

@@ -0,0 +1,160 @@
+import type { EvidenceLayer } from "../constants";
+
+export type LabAutomationLayer =
+  | "protocol_conformance"
+  | "live_route_compatibility"
+  | "task_effectiveness";
+
+export interface LabAutomationPolicyV1 {
+  schemaVersion: 1;
+  enabled: boolean;
+  layers: {
+    protocolConformance: boolean;
+    liveRouteCompatibility: boolean;
+    taskEffectiveness: boolean;
+  };
+  refreshBeforeStaleMs: number;
+  maxConcurrentRuns: number;
+  maxConcurrentLiveRuns: number;
+  maxConcurrentRunsPerRoute: number;
+  maxRunsPerHour: number;
+  maxLiveRequestsPerHour: number;
+  failureCooldownMs: number;
+  blockedCooldownMs: number;
+  taskEffectivenessBackgroundEnabled: boolean;
+}
+
+export type LabAutomationPlanReason =
+  | "automation_disabled"
+  | "layer_disabled"
+  | "fresh"
+  | "refresh_due"
+  | "missing"
+  | "cooldown"
+  | "budget_blocked"
+  | "already_queued"
+  | "already_running"
+  | "route_ineligible"
+  | "scenario_inapplicable"
+  | "task_background_disabled";
+
+export interface PlannedLabRunV1 {
+  runKey: string;
+  evidenceLayer: LabAutomationLayer;
+  suiteId: string;
+  suiteVersion: string;
+  suiteManifestDigest: string;
+  scenarioId: string;
+  scenarioVersion: string;
+  scenarioManifestDigest: string;
+  subjectId: string;
+  reason: LabAutomationPlanReason;
+  priority: number;
+  eligibleAt: number;
+  providerName?: string;
+  modelId?: string;
+}
+
+export type LabAutomationRunState =
+  | "queued"
+  | "running"
+  | "completed"
+  | "blocked"
+  | "failed"
+  | "cancelled"
+  | "abandoned";
+
+export type LabAutomationRunTrigger = "scheduled" | "manual";
+
+export interface LabAutomationRunRecordV1 {
+  runId: string;
+  runKey: string;
+  state: LabAutomationRunState;
+  evidenceLayer: LabAutomationLayer;
+  suiteId: string;
+  suiteVersion: string;
+  suiteManifestDigest: string;
+  scenarioId: string;
+  scenarioVersion: string;
+  scenarioManifestDigest: string;
+  subjectId: string;
+  reason: LabAutomationPlanReason;
+  priority: number;
+  eligibleAt: number;
+  trigger: LabAutomationRunTrigger;
+  createdAt: number;
+  updatedAt: number;
+  startedAt?: number;
+  completedAt?: number;
+  terminalCode?: string;
+  providerName?: string;
+  modelId?: string;
+}
+
+export interface LabAutomationRouteRefV1 {
+  providerName: string;
+  modelId: string;
+}
+
+export interface LabAutomationRoutesV1 {
+  schemaVersion: 1;
+  routes: readonly LabAutomationRouteRefV1[];
+}
+
+export interface LabAutomationStateV1 {
+  schemaVersion: 1;
+  runs: LabAutomationRunRecordV1[];
+  budgetWindowStartedAt: number;
+  runsThisHour: number;
+  liveRequestsThisHour: number;
+  cooldownUntilByKey: Record<string, number>;
+}
+
+export interface LabAutomationStatusV1 {
+  policy: LabAutomationPolicyV1;
+  routes: LabAutomationRoutesV1;
+  counters: {
+    queued: number;
+    running: number;
+    completedLastHour: number;
+    blockedLastHour: number;
+    remainingRunBudget: number;
+    remainingLiveRequestBudget: number;
+  };
+  schedulerRunning: boolean;
+}
+
+export interface AutomationDispatchDeps {
+  configDir?: string;
+  routeExecutor?: import("../live/types").TrustedLabRouteExecutor;
+  patchExecutor?: import("../fabric/types").TrustedFabricPatchExecutor;
+  loadConfig?: () => import("../../types").OcxConfig;
+  abortSignal?: AbortSignal;
+  /** Orchestrator-set guard that requires the queued identity to match current frozen contracts. */
+  enforceRunIdentity?: boolean;
+  /** Test-only DNS seam; production uses destination policy resolution when unset. */
+  resolve?: import("../live/types").DnsResolver;
+}
+
+export class LabAutomationError extends Error {
+  override readonly name = "LabAutomationError";
+  constructor(
+    message: string,
+    readonly code: string,
+  ) {
+    super(message);
+  }
+}
+
+export function evidenceLayerToAutomationLayer(layer: EvidenceLayer): LabAutomationLayer | null {
+  switch (layer) {
+    case "protocol_conformance":
+      return "protocol_conformance";
+    case "live_route_compatibility":
+      return "live_route_compatibility";
+    case "task_effectiveness":
+      return "task_effectiveness";
+    default:
+      return null;
+  }
+}

package/src/lab/conformance/types.ts

@@ -9,7 +9,11 @@ export type VerificationRole = "required" | "supplemental" | "negative_control";
 export type FailureClassification =
   | "harness_failure"
   | "timeout"
+  | "inactivity_timeout"
   | "budget_exhausted"
+  | "sandbox_violation"
+  | "malformed_producer_outcome"
+  | "layer_subject_mismatch"
   | "protocol_failure"
   | "capability_failure"
   | "behavioral_failure"
@@ -20,6 +24,25 @@ export type FailureClassification =
   | "provider_transient"
   | "inconclusive";
 
+export const FAILURE_CLASSIFICATIONS = [
+  "harness_failure",
+  "timeout",
+  "inactivity_timeout",
+  "budget_exhausted",
+  "sandbox_violation",
+  "malformed_producer_outcome",
+  "layer_subject_mismatch",
+  "protocol_failure",
+  "capability_failure",
+  "behavioral_failure",
+  "authentication_blocked",
+  "quota_blocked",
+  "region_blocked",
+  "network_failure",
+  "provider_transient",
+  "inconclusive",
+] as const satisfies readonly FailureClassification[];
+
 export interface FixtureRecord {
   id: string;
   role: "client_request" | "upstream_response" | "adapter_vector" | "synthetic_tool";

package/src/lab/events/types.ts

@@ -9,6 +9,7 @@ import type {
   ObservationOutcome,
   PurgeAction,
 } from "../constants";
+import type { FailureClassification } from "../conformance/types";
 
 export interface LabProducer {
   name: string;
@@ -90,7 +91,7 @@ export interface AssertionRecordV1 {
 }
 
 export interface FailureRecordV1 {
-  class: string;
+  class: FailureClassification;
   code: string;
   retryable: boolean;
   attribution: "opencodex" | "route" | "environment" | "harness";

package/src/lab/events/validate.ts

@@ -29,6 +29,7 @@ import {
   jcsStringify,
   subjectIdForSubject,
 } from "../digest";
+import { FAILURE_CLASSIFICATIONS } from "../conformance/types";
 import type {
   ArtifactRefV1,
   ClaimCapabilityFactsV1,
@@ -408,7 +409,7 @@ function validateObservation(raw: Record<string, unknown>): ObservationEvent {
   if (raw.failure !== undefined) {
     if (!isPlainObject(raw.failure)) throw new LabValidationError("invalid_failure", "failure");
     event.failure = {
-      class: assertString(raw.failure.class, "failure.class"),
+      class: assertClosed(raw.failure.class, "failure.class", FAILURE_CLASSIFICATIONS),
       code: assertString(raw.failure.code, "failure.code"),
       retryable: raw.failure.retryable === true,
       attribution: assertClosed(raw.failure.attribution, "failure.attribution", [

package/src/lab/fabric/constants.ts

@@ -0,0 +1,40 @@
+/** CL-07 frozen fabric-core / synthetic-patch constants. */
+
+export const FABRIC_SUITE_ID = "fabric-core";
+export const FABRIC_SUITE_VERSION = "1.0.0";
+export const FABRIC_SCENARIO_ID = "fabric-core.task.synthetic-patch";
+export const FABRIC_SCENARIO_VERSION = "1.0.0";
+export const FABRIC_TASK_CLASS_ID = "fabric-core.task.synthetic-patch";
+export const FABRIC_TASK_CLASS_VERSION = "1.0.0";
+export const FABRIC_COMPATIBILITY_VERSION = "ocx-fabric-producer-v1";
+export const FABRIC_VERIFIER_ID = "exact-tree-diff-v1";
+export const FABRIC_EVIDENCE_LAYER = "task_effectiveness" as const;
+
+export const SYNTHETIC_VALUE_PATH = "src/value.txt";
+export const SYNTHETIC_BEFORE_UTF8 = "before\n";
+export const SYNTHETIC_AFTER_UTF8 = "after\n";
+
+export const FABRIC_LIMITS = Object.freeze({
+  maxFiles: 1,
+  /** Upper bound for scratch-tree walks (verifier may see unexpected extras). */
+  maxScratchFiles: 8,
+  maxAggregateIoBytes: 64 * 1024,
+  maxPatchOperations: 1,
+  totalTimeoutMs: 30_000,
+  inactivityTimeoutMs: 5_000,
+  aggregateArtifactBytes: 1024 * 1024,
+  maxArtifacts: 8,
+});
+
+export const SANDBOX_PROFILE_V1 = Object.freeze({
+  schemaVersion: 1,
+  profileId: "lab-fabric-scratch-v1",
+  allowNetwork: false,
+  allowUserMcp: false,
+  allowShell: false,
+  allowUserRepository: false,
+  followSymlinks: false,
+  allowSpecialFiles: false,
+  scratchOnly: true,
+  limits: FABRIC_LIMITS,
+});