@brainervirus/workit-pi 6.0.0 → 7.0.0

package/README.md

@@ -1,26 +1,24 @@
 # @brainervirus/workit-pi
 
 [![CI](https://github.com/BrainerVirus/workit/actions/workflows/ci.yml/badge.svg)](https://github.com/BrainerVirus/workit/actions/workflows/ci.yml)
-[![license: MIT](https://img.shields.io/badge/license-MIT-green.svg)](../../LICENSE)
-
-Workit native extension for Pi (stock 0.85.1 package contract) — seven core-backed operation tools plus read-only `workit_context`, eleven method skills, session/compaction continuity, and a coordinator that supervises fresh reviewer/investigator processes plus explicitly scoped implementers.
-
-## Requirements
-
-- **Node.js ≥ 24**
-- **Pi coding agent 0.85.1** (peer dependency)
-
-## Install
-
-Install this package alongside the Pi peer dependency. Pi discovers the
-extension and skills through the `pi` manifest section in `package.json`
-(`./dist/workit.js` plus `./skills`); see the Pi documentation for how it
-resolves extension packages in your setup.
-
-## Notes
-
-- Supervised implementer workers run as observed child processes; they no longer acquire a checkout lease. Cancellation or restart uncertainty still blocks a replacement worker.
-- The extension is a workflow control, not an OS sandbox: a supported literal
-  branch-creation command is checked against workspace naming policy; other
-  shell forms stay under the host's native permission rules.
-- Pi project trust still gates mutations. Git and forge effects are bounded by Pi's own permissions plus the workspace autonomy grants (`workit grant show`); Workit asks no consent prompts of its own.
+[![license: MIT](https://img.shields.io/badge/license-MIT-green.svg)](https://github.com/BrainerVirus/workit/blob/main/LICENSE)
+
+[Workit](https://github.com/BrainerVirus/workit) for Pi (stock 0.85.1): a native extension with the
+seven task families plus read-only `workit_context`, the eleven method
+skills, session and compaction continuity, and a coordinator that launches
+fresh reviewer/investigator processes and scoped implementers. Requires
+Node.js 24+.
+
+```bash
+pi install npm:@brainervirus/workit-pi
+pi install ./packages/workit-pi -l --approve   # local checkout
+```
+
+Pi discovers the extension and skills from the package's `pi` manifest
+(`./dist/workit.js`, `./skills`). Pi project trust still gates mutations.
+The `tool_call` boundary applies branch policy and the
+[before-write gate](https://github.com/BrainerVirus/workit/blob/main/docs/guides/verification.md) to write, edit and recognizable bash
+writes (unrecognized shell writes stay agent-guided; an extension is not an OS
+sandbox). Tools take flat fields.
+Delivery limits come from Pi's permissions plus the workspace
+[grants](https://github.com/BrainerVirus/workit/blob/main/docs/guides/grants.md).

package/dist/worker.js

@@ -7206,6 +7206,14 @@ function object(shape, params) {
   };
   return new ZodObject(def);
 }
+function looseObject(shape, params) {
+  return new ZodObject({
+    type: "object",
+    shape,
+    catchall: unknown(),
+    ...normalizeParams(params)
+  });
+}
 var ZodUnion = /* @__PURE__ */ $constructor("ZodUnion", (inst, def) => {
   $ZodUnion.init(inst, def);
   ZodType.init(inst, def);
@@ -7607,76 +7615,16 @@ var provenanceSchema = object({
   workerId: nullableId
 }).strict();
 var entrySchema = (data) => object({ id, recordedAt: utc, provenance: provenanceSchema, data }).strict();
-var factSchema = object({
-  statement: text,
-  basis: _enum(["observed", "inferred", "unknown"]),
-  refs: array(refSchema)
-}).strict().check((ctx) => {
-  if (ctx.value.basis === "observed" && ctx.value.refs.length === 0)
-    ctx.issues.push({
-      code: "custom",
-      input: ctx.value,
-      message: "observed facts require supporting references",
-      path: ["refs"]
-    });
-});
-var signalSchema = object({
-  value: union([boolean2(), literal("unknown")]),
-  basis: _enum(["observed", "inferred", "unknown"]),
-  reason: text,
+var RISK_TIERS = ["trivial", "normal", "high"];
+var judgmentSchema = object({
+  riskTier: _enum(RISK_TIERS),
+  behaviorChange: boolean2(),
+  productChoiceOpen: boolean2(),
+  needsPlan: boolean2(),
+  note: text.nullable(),
   refs: array(refSchema)
-}).strict().check((ctx) => {
-  const signal = ctx.value;
-  const valid = signal.value === "unknown" ? signal.basis === "unknown" : signal.basis === "observed" || signal.basis === "inferred";
-  if (!valid)
-    ctx.issues.push({
-      code: "custom",
-      input: signal,
-      message: "signal value and basis disagree",
-      path: []
-    });
-  if (signal.basis === "observed" && signal.refs.length === 0)
-    ctx.issues.push({
-      code: "custom",
-      input: signal,
-      message: "observed signals require supporting references",
-      path: ["refs"]
-    });
-});
-var signalSet = object({
-  approachUnknown: signalSchema,
-  productChoiceOpen: signalSchema,
-  behaviorChange: signalSchema,
-  mechanicalLowRisk: signalSchema,
-  durableAgreementNeeded: signalSchema,
-  coordinationPlanNeeded: signalSchema,
-  helperUseful: signalSchema,
-  testFirstPractical: signalSchema
-}).strict();
-var consequenceSchema = object({
-  area: _enum([
-    "behavior",
-    "public_contract",
-    "data",
-    "security",
-    "operations",
-    "reversibility",
-    "consumers"
-  ]),
-  fact: factSchema
-}).strict();
-var verificationSchema = object({
-  claim: text,
-  scope: scopeSchema,
-  availableChecks: array(refSchema),
-  gaps: array(text)
-}).strict();
-var assessmentSchema = object({
-  facts: array(factSchema),
-  signals: signalSet,
-  consequences: array(consequenceSchema),
-  verification: array(verificationSchema)
 }).strict();
+var legacyAssessmentSchema = looseObject({});
 var constraintSchema = object({
   id: nonEmpty,
   kind: _enum(["host", "project", "user"]),
@@ -7912,7 +7860,8 @@ var taskRecordSchema = object({
   progress: progressSchema,
   pauseReason: text.nullable().optional(),
   runtime: runtimeSchema.optional(),
-  assessments: array(entrySchema(assessmentSchema)),
+  assessments: array(entrySchema(legacyAssessmentSchema)),
+  judgments: array(entrySchema(judgmentSchema)).optional(),
   policy: policySchema.nullable(),
   policyChanges: array(policyChangeSchema),
   candidates: array(candidateSchema),
@@ -8035,14 +7984,15 @@ var taskOperations = {
     decisionIds: array(id).optional()
   })
 };
+var rawJudgment = record(string2(), unknown());
 var policyOperations = {
   assess: operation({
     action: literal("assess"),
     ...taskId,
     expectedRevision: revision.optional(),
-    assessment: assessmentSchema
+    judgment: rawJudgment
   }),
-  preview: operation({ action: literal("preview"), ...taskId, assessment: assessmentSchema }),
+  preview: operation({ action: literal("preview"), ...taskId, judgment: rawJudgment }),
   explain: operation({ action: literal("explain"), ...taskId })
 };
 var evidenceOperations = {
@@ -8081,7 +8031,10 @@ var decisionOperations = {
     ...taskId,
     expectedRevision: revision.optional(),
     purpose: decisionSchema.shape.purpose,
-    binding: decisionSchema.shape.binding,
+    binding: decisionSchema.shape.binding.extend({
+      taskId: id.optional(),
+      workspaceId: id.optional()
+    }),
     response: decisionSchema.shape.response,
     requirementIds: array(digest)
   }),
@@ -8135,6 +8088,15 @@ var operationSchemas = {
   worker: discriminatedUnion("action", Object.values(workerOperations)),
   state: discriminatedUnion("action", Object.values(stateOperations))
 };
+var OPERATION_ACTIONS = {
+  task: Object.keys(taskOperations),
+  policy: Object.keys(policyOperations),
+  evidence: Object.keys(evidenceOperations),
+  finding: Object.keys(findingOperations),
+  decision: Object.keys(decisionOperations),
+  worker: Object.keys(workerOperations),
+  state: Object.keys(stateOperations)
+};
 var withImplicitTask = (options) => Object.values(options).map((option) => ("taskId" in option.shape) ? option.extend({ taskId: id.optional() }) : option);
 var advertised = (options) => discriminatedUnion("action", withImplicitTask(options));
 var advertisedOperationSchemas = {
@@ -8223,6 +8185,126 @@ function candidateDigest(input) {
     head: input.head
   });
 }
+// packages/workit-core/src/core/operation-input.ts
+var str = (d, values) => ({
+  type: "string",
+  ...values ? { enum: values } : {},
+  ...d ? { d } : {}
+});
+var list = (d) => ({ type: "array", ...d ? { d } : {} });
+var bool = (d) => ({ type: "boolean", ...d ? { d } : {} });
+var int2 = (d) => ({ type: "integer", ...d ? { d } : {} });
+var scopeFields = {
+  paths: list("Scope paths (default: whole checkout)."),
+  exclusions: list(),
+  scope: str("Scope description.")
+};
+var refs = list("Paths or URLs.");
+var FLAT = {
+  task: {
+    fields: {
+      objective: str(),
+      ...scopeFields,
+      refs,
+      reason: str(),
+      summary: str(),
+      nextAction: str(),
+      blockers: list(),
+      outcome: str(undefined, ["verified", "accepted_limitations", "stopped"]),
+      decisionIds: list(),
+      status: str(undefined, ["open", "closed", "all"]),
+      query: str(),
+      limit: int2(),
+      view: str(undefined, ["summary", "full"])
+    }
+  },
+  policy: {
+    fields: {
+      riskTier: str("low=trivial, medium=normal.", ["trivial", "normal", "high", "low", "medium"]),
+      behaviorChange: bool("Observable behavior changes."),
+      productChoiceOpen: bool("A product/preference choice is still open."),
+      needsPlan: bool("Needs a written plan or spec first."),
+      note: str(),
+      refs: list("Plan/spec paths or URLs.")
+    }
+  },
+  evidence: {
+    fields: {
+      kind: str(undefined, ["check", "review", "investigation", "artifact"]),
+      claim: str(),
+      result: str(undefined, ["passed", "failed", "missing", "skipped"]),
+      summary: str(),
+      exitCode: int2(),
+      refs,
+      requirementIds: list(),
+      candidateId: str(),
+      beforeCandidateId: str(),
+      reviewSession: str("Reviewer session handle (review evidence).")
+    }
+  },
+  finding: {
+    fields: {
+      claim: str(),
+      consequence: str(),
+      ...scopeFields,
+      candidateId: str(),
+      refs,
+      findingId: str(),
+      disposition: str(undefined, ["open", "fixed", "dismissed", "deferred"]),
+      reason: str(),
+      evidenceIds: list(),
+      decisionIds: list()
+    }
+  },
+  decision: {
+    fields: {
+      purpose: str(undefined, ["design", "action", "limitation", "preference"]),
+      response: str(undefined, ["approved", "rejected", "stated"]),
+      presented: str("What the user was asked."),
+      choice: str("The user's stated choice (response=stated)."),
+      ...scopeFields,
+      refs,
+      requirementIds: list(),
+      decisionId: str(),
+      reason: str()
+    }
+  },
+  worker: {
+    fields: {
+      role: str(undefined, ["investigator", "reviewer", "implementer"]),
+      objective: str(),
+      ...scopeFields,
+      decisionIds: list(),
+      requirementIds: list(),
+      candidateId: str(),
+      stoppingCondition: str(),
+      workerId: str(),
+      outcome: str(undefined, ["completed", "failed", "cancelled"]),
+      summary: str(),
+      evidenceIds: list(),
+      findingIds: list(),
+      reason: str()
+    }
+  },
+  state: {
+    fields: { bundle: { type: "object", d: "An export bundle (object or JSON string)." } }
+  }
+};
+var COMMON = {
+  taskId: str("Omit for this branch's task."),
+  expectedRevision: str(),
+  expectedWorkspaceRevision: str()
+};
+var READ_TASK_FIELDS = new Set(["status", "query", "limit", "view"]);
+var READ_ONLY_ACTIONS = new Set(["list", "inspect", "preview", "explain", "export"]);
+var ENVELOPE = new Set([
+  "schemaVersion",
+  "action",
+  "taskId",
+  "expectedRevision",
+  "expectedWorkspaceRevision",
+  "judgment"
+]);
 // packages/workit-core/src/core/package-root.ts
 import { existsSync } from "node:fs";
 import path from "node:path";
@@ -8292,6 +8374,25 @@ var heldInProcess = new Map;
 // packages/workit-core/src/git/rev.ts
 var MAX_BUFFER = 256 * 1024 * 1024;
 var MAX_UNTRACKED_BYTES = 5 * 1024 * 1024;
+
+// packages/workit-core/src/ledger.ts
+var PASSING = new Set(["verified", "tests-verified", "type-check-only"]);
+var FAILING = new Set(["failed", "blocked"]);
+var STRONG_RESULTS = new Set(["verified", "tests-verified"]);
+var PR_ROW_TYPES = new Set(["pr.created", "pr.status", "pr.merged"]);
+var NETWORK_FS_TYPES = new Set([
+  26985,
+  20859,
+  4266872130,
+  4283649346,
+  1702057286,
+  1397113167,
+  12805120,
+  16914839,
+  1196443219,
+  198183888
+]);
+var OBSERVED_ONLY = new Set(["check", ...PR_ROW_TYPES]);
 // packages/workit-core/src/core/config.ts
 var PRESETS = {
   gitflow: {
@@ -8394,6 +8495,7 @@ var workspaceConfigSchema = object({
   }).passthrough().optional(),
   autoApprove: union([boolean2(), array(nonBlank)]).optional(),
   defaultEndpoint: _enum(["commit", "pr"]).optional(),
+  verification: _enum(["self", "independent"]).optional(),
   autonomy: object(Object.fromEntries(["push", "pr", "merge", "release", "rerun"].map((kind) => [
     kind,
     union([boolean2(), literal("verified")]).optional()
@@ -8437,18 +8539,19 @@ var workspacesFileSchema = object({ workspaces: array(workspaceConfigSchema).opt
 var runtimeWorkspaceIndexSchema = object({
   workspaces: array(object({ name: nonBlank, glob: nonBlank }).passthrough()).optional()
 }).passthrough();
-// packages/workit-core/src/core/policy-resolver.ts
-var resolverInputSchema = object({
-  intent: intentSchema,
-  assessment: assessmentSchema,
-  constraints: array(constraintSchema),
-  prior: object({
-    decisions: array(decisionSchema),
-    findings: array(findingSchema),
-    requirements: array(requirementSchema)
-  }).strict(),
-  preferences: object({ fast: boolean2().optional(), thorough: boolean2().optional() }).strict().optional()
-}).strict();
+// packages/workit-core/src/core/policy/judgment.ts
+var LEGACY_KEYS = new Set(["assessment", "facts", "signals", "consequences", "verification"]);
+var YES = new Set(["true", "yes", "y", "1", "on"]);
+var NO = new Set(["false", "no", "n", "0", "off", "none"]);
+
+// packages/workit-core/src/autonomy.ts
+var DEFAULT_GRANTS = Object.freeze({
+  push: true,
+  pr: true,
+  merge: false,
+  release: false,
+  rerun: true
+});
 
 // packages/workit-core/src/core/task-engine.ts
 var verifiedWorkers = new WeakMap;