@casecore/release-agent 0.1.0 → 0.1.1

package/README.md

@@ -49,6 +49,43 @@ import { ReleaseControlProducer } from '@casecore/release-agent/producer';
 `production_acceptance` подтверждается через независимый `readProduction`.
 Журнал сохраняет прежний формат MyRobotica и исходные идентификаторы команд.
 
+UUID исходной попытки доставки и UUID команды CaseCore могут различаться.
+`provider.verifyPublicationDelivery(command, delivery)` подтверждает их связь
+по каноническому источнику продукта до `bindPublicationDelivery`: исходный commit,
+репозиторий, ветка, выбранный исполнитель, доверенный статус, T0 и deadline
+сохраняются. Для разных UUID обработчик обязан вернуть `true`; при подключённом
+обработчике он проверяет и совпадающие UUID. При его отсутствии поддерживается
+прежний контракт с совпадающими UUID.
+
+После ошибки публикации до появления артефакта существующий
+`reconcile(commandId)` вызывает подключённый
+`provider.reconcilePublicationFailure(command, { signal, delivery, recoveryDeadlineAt })`.
+Адаптер возвращает `null` при неопределённом результате либо удерживаемый guard:
+`{ fact, assertOwned(), release({ resolved, proofDigest }) }`.
+`fact` содержит ровно `schema: 1`, `kind: 'failed_before_installation'`,
+`commandId`, `installationKey`, `expectedSource`, исходный `delivery`, свежий
+`observedAt`, `stage: source_ready | ci | build | verify | publish`,
+`authenticated: true`, `executionStopped: true`, `pendingTransaction: false`,
+`publicationResolved: true`, `installationNotStarted: true`.
+
+Адаптер подтверждает фактическую остановку исполнителя и его дочерних/удалённых
+операций, исходную идентичность и отсутствие незавершённой установки через
+существующие журналы и механизмы владения продукта. Он удерживает исключение
+конкурирующих действий до сохранения pending-доказательства и подтверждения
+его durable-завершения в `release({ resolved: true, proofDigest })`.
+`proofDigest` имеет вид `sha256:<hex>` и вычисляется движком из `fact`.
+Ошибка/потеря ACK не разрешает следующий выпуск. Guard и его callback работают
+внутри доверенного адаптера; HTTP-запрос не может подставить этот результат.
+
+Только после подтверждённого завершения движок сохраняет `failed` и
+`recoveryState: verified`, оставляя исходную команду, часы, диагностику и успешные
+этапы. Артефакт и успешная установка не подставляются. Сохранённый pending
+запрещает команды, продолжение и резервирование после перезапуска; восстановление
+проходит через тот же `reconcile` и новую фактическую проверку владения.
+Его отдельный предел — 30 секунд; срок публикации не продлевается.
+Обычный `reserveExclusiveOperation` становится доступен после завершения
+восстановления, когда остальные операции установки также разрешены.
+
 Источник публикации ограничивается установкой. Для `main` передаётся точная
 политика, например `sourcePolicy: { repository: 'owner/product', ref: 'main' }`.
 Без политики сохраняется прежнее ограничение MyRobotica на ветки `codex/`.

package/dist/exclusive-operation.mjs

@@ -3,13 +3,27 @@ import assert from 'node:assert/strict';
 // Generic process-local ownership only. Products restore pending ownership from
 // their own durable configuration state before exposing effect-bearing methods.
 const operations = new WeakMap();
-const mutableMethods = ['command', 'execute', 'resumeScheduled', 'resumePublication',
-  'reconcile', 'bindPublicationDelivery', 'bindPublicationArtifact', 'qualifyForwardRecovery'];
+const mutableMethods = [
+  'command',
+  'execute',
+  'resumeScheduled',
+  'resumePublication',
+  'reconcile',
+  'bindPublicationDelivery',
+  'bindPublicationArtifact',
+  'qualifyForwardRecovery',
+];
 function metadata(producer) {
   const state = operations.get(producer);
   assert.ok(state, 'DELIVERY_OPERATION_BARRIER_REQUIRED');
   return state;
 }
+function pendingFailures(producer, state) {
+  return [
+    ...Object.values(producer.state.commands),
+    ...(state.loaded ? [] : Object.values(producer.journal.read().commands)),
+  ].filter((item) => item.publicationFailureReconciliation?.state === 'pending');
+}
 export function installOperationBarrier(producer) {
   assert.ok(!operations.has(producer), 'DELIVERY_OPERATION_BARRIER_ALREADY_INSTALLED');
   operations.set(producer, { activity: 0, lease: null, loaded: false });
@@ -19,10 +33,26 @@ export function installOperationBarrier(producer) {
     Object.defineProperty(producer, name, {
       value: async function (...args) {
         const state = metadata(this);
-        assert.ok(!state.lease, 'DELIVERY_EXCLUSIVE_OPERATION_HELD');
+        assert.ok(
+          !state.lease ||
+            (name === 'reconcile' &&
+              state.lease.kind === 'publicationFailure' &&
+              state.lease.status === 'held' &&
+              state.lease.commandId === args[0]),
+          'DELIVERY_EXCLUSIVE_OPERATION_HELD'
+        );
+        assert.ok(
+          pendingFailures(this, state).every(
+            (item) => name === 'reconcile' && item.command.commandId === args[0]
+          ),
+          'DELIVERY_PUBLICATION_FAILURE_RECONCILIATION_PENDING'
+        );
         state.activity++;
-        try { return await method.apply(this, args); }
-        finally { state.activity--; }
+        try {
+          return await method.apply(this, args);
+        } finally {
+          state.activity--;
+        }
       },
     });
   }
@@ -33,34 +63,110 @@ export function markOperationStateLoaded(producer) {
 function installationBusy(producer, state) {
   // A restored configuration reservation precedes initialize. Inspect the
   // protected existing journal so an empty constructor cannot hide a live run.
-  const runs = state.loaded ? producer.state.runs :
-    [...producer.state.runs, ...producer.journal.read().runs];
-  return state.activity > 0 || producer.admitting !== undefined ||
-    producer.pending.size > 0 || producer.scheduling === true ||
-    runs.some((run) =>
-      ['queued', 'running'].includes(run.status) ||
-      (run.status === 'blocked' && (run.recoveryState !== 'verified' ||
-        run.blockers?.some((reason) => reason.code === 'RECONCILIATION_REQUIRED'))) ||
-      ['failed', 'unverified'].includes(run.recoveryState));
+  const runs = state.loaded
+    ? producer.state.runs
+    : [...producer.state.runs, ...producer.journal.read().runs];
+  return (
+    pendingFailures(producer, state).length > 0 ||
+    state.activity > 0 ||
+    producer.admitting !== undefined ||
+    producer.pending.size > 0 ||
+    producer.scheduling === true ||
+    runs.some(
+      (run) =>
+        ['queued', 'running'].includes(run.status) ||
+        (run.status === 'blocked' &&
+          (run.recoveryState !== 'verified' ||
+            run.blockers?.some((reason) => reason.code === 'RECONCILIATION_REQUIRED'))) ||
+        ['failed', 'unverified'].includes(run.recoveryState)
+    )
+  );
+}
+
+// Only the existing reconcile entrypoint can recover its own pre-artifact run.
+// General configuration reservations retain the unchanged busy-run refusal.
+export function reservePublicationFailureReconciliation(producer, commandId) {
+  const state = metadata(producer);
+  assert.ok(
+    state.loaded &&
+      state.activity === 1 &&
+      producer.admitting === undefined &&
+      producer.pending.size === 0 &&
+      producer.scheduling !== true,
+    'DELIVERY_INSTALLATION_BUSY'
+  );
+  assert.ok(
+    !state.lease ||
+      (state.lease.kind === 'publicationFailure' &&
+        state.lease.status === 'held' &&
+        state.lease.commandId === commandId),
+    'DELIVERY_EXCLUSIVE_OPERATION_HELD'
+  );
+  assert.ok(
+    !producer.state.runs.some(
+      (run) =>
+        run.commandId !== commandId &&
+        (['queued', 'running'].includes(run.status) ||
+          (run.status === 'blocked' &&
+            (run.recoveryState !== 'verified' ||
+              run.blockers?.some((reason) => reason.code === 'RECONCILIATION_REQUIRED'))) ||
+          ['failed', 'unverified'].includes(run.recoveryState))
+    ),
+    'DELIVERY_INSTALLATION_BUSY'
+  );
+  assert.ok(
+    !Object.values(producer.state.commands).some(
+      (item) =>
+        item.command.commandId !== commandId &&
+        item.publicationFailureReconciliation?.state === 'pending'
+    ),
+    'DELIVERY_INSTALLATION_BUSY'
+  );
+  const generation = Symbol();
+  state.lease = { kind: 'publicationFailure', commandId, generation, status: 'active' };
+  const assertOwned = () =>
+    assert.ok(
+      state.lease?.generation === generation && state.lease.status === 'active',
+      'DELIVERY_EXCLUSIVE_OPERATION_NOT_OWNED'
+    );
+  return {
+    assertOwned,
+    release({ resolved }) {
+      assertOwned();
+      if (resolved === true) state.lease = null;
+      else state.lease.status = 'held';
+    },
+  };
 }
 export function reserveExclusiveOperation(producer, { operationId } = {}) {
-  assert.ok(typeof operationId === 'string' && operationId.trim().length > 0 && operationId.length <= 200,
-    'DELIVERY_OPERATION_ID_REQUIRED');
+  assert.ok(
+    typeof operationId === 'string' && operationId.trim().length > 0 && operationId.length <= 200,
+    'DELIVERY_OPERATION_ID_REQUIRED'
+  );
   const state = metadata(producer);
-  assert.ok(!state.lease || (state.lease.status === 'held' && state.lease.operationId === operationId),
-    'DELIVERY_EXCLUSIVE_OPERATION_HELD');
+  assert.ok(
+    !state.lease || (state.lease.status === 'held' && state.lease.operationId === operationId),
+    'DELIVERY_EXCLUSIVE_OPERATION_HELD'
+  );
   assert.ok(!installationBusy(producer, state), 'DELIVERY_INSTALLATION_BUSY');
   const generation = Symbol();
   state.lease = { operationId, generation, status: 'active' };
-  const assertOwned = () => assert.ok(state.lease?.generation === generation &&
-    state.lease.status === 'active', 'DELIVERY_EXCLUSIVE_OPERATION_NOT_OWNED');
+  const assertOwned = () =>
+    assert.ok(
+      state.lease?.generation === generation && state.lease.status === 'active',
+      'DELIVERY_EXCLUSIVE_OPERATION_NOT_OWNED'
+    );
   return {
     assertOwned,
     release(options = {}) {
       assertOwned();
-      assert.ok(options && typeof options === 'object' && !Array.isArray(options) &&
-        (options.resolved === undefined || typeof options.resolved === 'boolean'),
-      'DELIVERY_OPERATION_RESOLUTION_INVALID');
+      assert.ok(
+        options &&
+          typeof options === 'object' &&
+          !Array.isArray(options) &&
+          (options.resolved === undefined || typeof options.resolved === 'boolean'),
+        'DELIVERY_OPERATION_RESOLUTION_INVALID'
+      );
       if (options?.resolved === true) state.lease = null;
       else state.lease.status = 'held';
     },

package/dist/producer-admission.mjs

@@ -15,14 +15,10 @@ export class ProducerAdmission extends ProducerState {
       assert.equal(
         existing.fingerprint,
         fingerprint,
-        'Command ID already belongs to different input',
+        'Command ID already belongs to different input'
       );
       if (preparedRunId !== undefined)
-        assert.equal(
-          existing.ack.runId,
-          preparedRunId,
-          'Prepared run ID changed',
-        );
+        assert.equal(existing.ack.runId, preparedRunId, 'Prepared run ID changed');
       return {
         ...existing.ack,
         state: existing.ack.state === 'rejected' ? 'rejected' : 'reconciled',
@@ -36,9 +32,7 @@ export class ProducerAdmission extends ProducerState {
       const current = await this.snapshot('0', {
         deadlineAt: input.deadlineAt,
       });
-      const candidate = current.candidates.find(
-        (c) => c.id === input.candidateId,
-      );
+      const candidate = current.candidates.find((c) => c.id === input.candidateId);
       const publication = input.action === 'publish';
       let reason = null;
       if (
@@ -48,28 +42,21 @@ export class ProducerAdmission extends ProducerState {
           candidate.state !== 'ready' ||
           !sameIdentity(candidate.identity, input.expectedIdentity))
       )
-        reason = blocker(
-          'CANDIDATE_CHANGED',
-          'Кандидат изменился или ещё не готов',
-        );
+        reason = blocker('CANDIDATE_CHANGED', 'Кандидат изменился или ещё не готов');
       if (
         publication &&
         (!candidate ||
           candidate.state !== 'source_ready' ||
           !candidate.expectedSource ||
-          canonical(candidate.expectedSource) !==
-            canonical(input.expectedSource) ||
-          !Object.values(candidate.identity ?? {}).every(
-            (item) => item === null,
-          ) ||
+          canonical(candidate.expectedSource) !== canonical(input.expectedSource) ||
+          !Object.values(candidate.identity ?? {}).every((item) => item === null) ||
           Object.keys(candidate.identity ?? {})
             .sort()
-            .join(',') !==
-            'configDigest,imageDigest,schemaVersion,sourceCommit,version')
+            .join(',') !== 'configDigest,imageDigest,schemaVersion,sourceCommit,version')
       )
         reason = blocker(
           'SOURCE_CANDIDATE_CHANGED',
-          'Исходный кандидат изменился или ещё не готов',
+          'Исходный кандидат изменился или ещё не готов'
         );
       if (
         input.action !== 'rollback' &&
@@ -79,23 +66,15 @@ export class ProducerAdmission extends ProducerState {
             (publication
               ? input.expectedSource.sourceCommit
               : input.expectedIdentity.sourceCommit) ||
-          candidate.changes.baseCommit !==
-            current.installed.identity.sourceCommit)
+          candidate.changes.baseCommit !== current.installed.identity.sourceCommit)
       )
         reason = blocker(
           'SOURCE_COMPARISON_UNVERIFIED',
-          'Точный состав изменений относительно установленной версии не подтверждён',
+          'Точный состав изменений относительно установленной версии не подтверждён'
         );
       if (Date.parse(input.requestedAt) > this.now().getTime() + 30000)
-        reason = blocker(
-          'INVALID_REQUEST_TIME',
-          'Время исходного запроса находится в будущем',
-        );
-      if (
-        !reason &&
-        input.action !== 'rollback' &&
-        this.provider.validateAdmission
-      ) {
+        reason = blocker('INVALID_REQUEST_TIME', 'Время исходного запроса находится в будущем');
+      if (!reason && input.action !== 'rollback' && this.provider.validateAdmission) {
         try {
           await this.provider.validateAdmission(input, candidate, {
             now: this.now(),
@@ -103,18 +82,21 @@ export class ProducerAdmission extends ProducerState {
         } catch {
           reason = blocker(
             'DELIVERY_EXECUTION_INVALID',
-            'Исходный срок доставки не подтверждён или изменён',
+            'Исходный срок доставки не подтверждён или изменён'
           );
         }
       }
       if (input.lane === 'scheduled' && !this.provider.announce)
         reason = blocker(
           'UNSUPPORTED_SCHEDULE',
-          'Транспорт уведомления об окне установки не подключён',
+          'Транспорт уведомления об окне установки не подключён'
         );
       if (Date.parse(input.deadlineAt) <= this.now().getTime())
         reason = blocker('DEADLINE_EXCEEDED', 'Исходный срок выполнения истёк');
       if (
+        Object.values(this.state.commands).some(
+          (item) => item.publicationFailureReconciliation?.state === 'pending'
+        ) ||
         this.state.runs.some(
           (r) =>
             ['queued', 'running'].includes(r.status) ||
@@ -126,44 +108,34 @@ export class ProducerAdmission extends ProducerState {
                 input.action === 'rollback' &&
                 r.id === input.previousRunId &&
                 ['failed', 'blocked'].includes(r.status)
-              )),
+              ))
         )
       )
         reason = blocker(
           'INSTALLATION_BUSY',
           'Установка уже занята или требует восстановления',
-          true,
+          true
         );
       if (!this.provider.actions?.includes(input.action))
-        reason = blocker(
-          'UNSUPPORTED_ACTION',
-          'Операция не подключена к исполнительному агенту',
-        );
+        reason = blocker('UNSUPPORTED_ACTION', 'Операция не подключена к исполнительному агенту');
       if (!['deploy', 'publish'].includes(input.action)) {
-        const previous = this.state.runs.find(
-          (r) => r.id === input.previousRunId,
-        );
-        const previousItem =
-          previous && this.state.commands[previous.commandId];
+        const previous = this.state.runs.find((r) => r.id === input.previousRunId);
+        const previousItem = previous && this.state.commands[previous.commandId];
         const previousCommand = previousItem?.command;
         if (
           !previous ||
           !previousCommand ||
           (input.action === 'retry'
             ? previousCommand.candidateId !== input.candidateId
-            : !sameIdentity(
-                previousItem.baseline?.identity,
-                input.expectedIdentity,
-              )) ||
+            : !sameIdentity(previousItem.baseline?.identity, input.expectedIdentity)) ||
           (input.action === 'retry' &&
             (previousCommand.deadlineAt !== input.deadlineAt ||
               previousCommand.requestedAt !== input.requestedAt)) ||
-          (input.action === 'rollback' &&
-            !['failed', 'blocked'].includes(previous.status))
+          (input.action === 'rollback' && !['failed', 'blocked'].includes(previous.status))
         )
           reason = blocker(
             'INVALID_CONTINUATION',
-            'Продолжение должно сохранить исходный кандидат и срок',
+            'Продолжение должно сохранить исходный кандидат и срок'
           );
       }
       const runId = preparedRunId ?? input.commandId;
@@ -178,12 +150,8 @@ export class ProducerAdmission extends ProducerState {
         fingerprint,
         command: structuredClone(input),
         baseline: structuredClone(current.installed),
-        ...(publication && candidate
-          ? { sourceCandidate: structuredClone(candidate) }
-          : {}),
-        ...(candidate?.deliveryExecution
-          ? { deliveryExecution: candidate.deliveryExecution }
-          : {}),
+        ...(publication && candidate ? { sourceCandidate: structuredClone(candidate) } : {}),
+        ...(candidate?.deliveryExecution ? { deliveryExecution: candidate.deliveryExecution } : {}),
         ack,
       };
       if (!reason) {
@@ -220,7 +188,7 @@ export class ProducerAdmission extends ProducerState {
         null,
         'command',
         reason ? reason.message : 'Команда принята',
-        reason ? 'warning' : 'info',
+        reason ? 'warning' : 'info'
       );
       await this.save();
       if (!reason) {

package/dist/producer-delivery.mjs

@@ -0,0 +1,34 @@
+import assert from 'node:assert/strict';
+import { hash, canonical } from './protocol-internals.mjs';
+import { validateOriginalDelivery } from './producer-support.mjs';
+
+export async function verifyPublicationDelivery(
+  producer,
+  command,
+  delivery,
+  { fresh = true } = {}
+) {
+  assert.equal(command.action, 'publish');
+  validateOriginalDelivery(delivery, command.expectedSource.sourceCommit);
+  assert.equal(delivery.requestedAt, command.requestedAt);
+  assert.equal(delivery.deadlineAt, command.deadlineAt);
+  const item = producer.state.commands[command.commandId];
+  assert.equal(item?.ack.state, 'accepted', 'Publication command was not admitted');
+  assert.equal(item.fingerprint, hash(canonical(command)));
+  if (item.deliveryExecution)
+    assert.deepEqual(item.deliveryExecution, delivery, 'Original published delivery changed');
+  if (typeof producer.provider.verifyPublicationDelivery === 'function')
+    assert.equal(
+      await producer.provider.verifyPublicationDelivery(command, delivery),
+      true,
+      'Original delivery correlation was not verified'
+    );
+  else
+    assert.equal(
+      delivery.id,
+      command.commandId,
+      'Independent delivery requires a trusted correlation verifier'
+    );
+  if (fresh) assert.ok(Date.parse(command.deadlineAt) > producer.now().getTime());
+  return delivery;
+}

package/dist/producer-journal.mjs

@@ -1,15 +1,22 @@
 import assert from 'node:assert/strict';
 import { hash, canonical, keys, uuid } from './protocol-internals.mjs';
 import { validateRunnerCommand, validateProducerSnapshot } from './protocol.mjs';
+import { validatePublicationFailureRecord } from './producer-publication-failure.mjs';
 
 /** Validate persisted state before any provider command can run after restart. */
 export function validProducerState(state, installationKey, sourcePolicy) {
   try {
-    keys(state, ['schema', 'installationKey', 'cursor', 'commands', 'runs', 'events'], ['diagnostics']);
+    keys(
+      state,
+      ['schema', 'installationKey', 'cursor', 'commands', 'runs', 'events'],
+      ['diagnostics']
+    );
     assert.equal(state.schema, 1);
     assert.equal(state.installationKey, installationKey);
     assert.match(state.cursor, /^\d+$/);
-    assert.ok(state.commands && typeof state.commands === 'object' && !Array.isArray(state.commands));
+    assert.ok(
+      state.commands && typeof state.commands === 'object' && !Array.isArray(state.commands)
+    );
     for (const [id, item] of Object.entries(state.commands)) {
       assert.match(id, uuid);
       assert.equal(item.command.commandId, id);
@@ -19,16 +26,43 @@ export function validProducerState(state, installationKey, sourcePolicy) {
       assert.equal(item.ack.protocolVersion, 1);
       assert.ok(['accepted', 'rejected'].includes(item.ack.state));
       assert.match(item.ack.runId, uuid);
+      if (item.publicationFailureReconciliation !== undefined)
+        validatePublicationFailureRecord(
+          item.publicationFailureReconciliation,
+          item.command,
+          item.deliveryExecution
+        );
     }
-    validateProducerSnapshot({
-      protocolVersion: 1, installationKey, observedAt: new Date().toISOString(),
-      connection: 'unverified', installed: null, candidates: [],
-      runs: state.runs.slice(-100), events: state.events, nextCursor: state.cursor,
-    }, installationKey, sourcePolicy);
+    validateProducerSnapshot(
+      {
+        protocolVersion: 1,
+        installationKey,
+        observedAt: new Date().toISOString(),
+        connection: 'unverified',
+        installed: null,
+        candidates: [],
+        runs: state.runs.slice(-100),
+        events: state.events,
+        nextCursor: state.cursor,
+      },
+      installationKey,
+      sourcePolicy
+    );
     for (const run of state.runs) {
       assert.ok(state.commands[run.commandId]);
       assert.equal(state.commands[run.commandId].ack.runId, run.id);
+      const reconciliation = state.commands[run.commandId].publicationFailureReconciliation;
+      if (reconciliation) {
+        assert.equal(state.commands[run.commandId].command.action, 'publish');
+        assert.ok(!state.commands[run.commandId].artifactIdentity);
+        if (reconciliation.state === 'settled') {
+          assert.equal(run.status, 'failed');
+          assert.equal(run.recoveryState, 'verified');
+        } else assert.equal(run.status, 'blocked');
+      }
     }
     return true;
-  } catch { return false; }
+  } catch {
+    return false;
+  }
 }

package/dist/producer-publication-failure.mjs

@@ -0,0 +1,191 @@
+import assert from 'node:assert/strict';
+import { canonical, hash, keys, timestamp } from './protocol-internals.mjs';
+import { validateOriginalDelivery, blocker } from './producer-support.mjs';
+import { verifyPublicationDelivery } from './producer-delivery.mjs';
+import { reservePublicationFailureReconciliation } from './exclusive-operation.mjs';
+
+const stages = ['source_ready', 'ci', 'build', 'verify', 'publish'];
+export function validatePublicationFailureFact(fact, command, delivery) {
+  keys(fact, [
+    'schema',
+    'kind',
+    'commandId',
+    'installationKey',
+    'expectedSource',
+    'delivery',
+    'observedAt',
+    'stage',
+    'authenticated',
+    'executionStopped',
+    'pendingTransaction',
+    'publicationResolved',
+    'installationNotStarted',
+  ]);
+  assert.equal(fact.schema, 1);
+  assert.equal(fact.kind, 'failed_before_installation');
+  assert.equal(fact.commandId, command.commandId);
+  assert.equal(fact.installationKey, command.installationKey);
+  keys(fact.expectedSource, ['repository', 'ref', 'sourceCommit']);
+  assert.equal(canonical(fact.expectedSource), canonical(command.expectedSource));
+  validateOriginalDelivery(fact.delivery, command.expectedSource.sourceCommit);
+  assert.equal(fact.delivery.requestedAt, command.requestedAt);
+  assert.equal(fact.delivery.deadlineAt, command.deadlineAt);
+  if (delivery) assert.deepEqual(fact.delivery, delivery);
+  timestamp(fact.observedAt);
+  assert.ok(stages.includes(fact.stage));
+  for (const field of [
+    'authenticated',
+    'executionStopped',
+    'publicationResolved',
+    'installationNotStarted',
+  ])
+    assert.equal(fact[field], true);
+  assert.equal(fact.pendingTransaction, false);
+  return fact;
+}
+
+export function validatePublicationFailureRecord(record, command, delivery) {
+  keys(record, ['state', 'fact']);
+  assert.ok(['pending', 'settled'].includes(record.state));
+  assert.ok(record.state === 'pending' || record.fact !== null);
+  if (record.fact !== null) validatePublicationFailureFact(record.fact, command, delivery);
+}
+
+export async function reconcilePublicationFailure(producer, item, run) {
+  assert.equal(item.ack.state, 'accepted');
+  assert.equal(item.command.action, 'publish');
+  assert.equal(run.status, 'blocked');
+  assert.ok(!item.artifactIdentity);
+  for (const id of ['deploy', 'production_acceptance']) {
+    const row = run.stages.find((stage) => stage.id === id);
+    assert.ok(
+      row && row.startedAt === null && row.status === 'pending',
+      'Installation must reconcile through its existing production boundary'
+    );
+  }
+  const lease = reservePublicationFailureReconciliation(producer, item.command.commandId);
+  const controller = new AbortController();
+  const recoveryDeadlineAt = producer.now().getTime() + 30000;
+  let timer;
+  let guard;
+  let settled = false;
+  let releasing = false;
+  const timeout = new Promise((_, reject) => {
+    timer = setTimeout(() => {
+      controller.abort();
+      reject(
+        Object.assign(Error('Publication failure reconciliation timed out'), {
+          code: 'PUBLICATION_FAILURE_RECONCILIATION_TIMEOUT',
+        })
+      );
+    }, 30000);
+  });
+  const bounded = (operation) => Promise.race([operation, timeout]);
+  const cleanup = (owned) =>
+    Promise.resolve()
+      .then(() => owned.release({ resolved: false, proofDigest: null }))
+      .catch(() => {});
+  try {
+    item.publicationFailureReconciliation ??= { state: 'pending', fact: null };
+    assert.equal(item.publicationFailureReconciliation.state, 'pending');
+    await bounded(producer.save());
+    const arriving = Promise.resolve().then(() =>
+      producer.provider.reconcilePublicationFailure(structuredClone(item.command), {
+        signal: controller.signal,
+        delivery: structuredClone(item.deliveryExecution ?? null),
+        recoveryDeadlineAt,
+      })
+    );
+    // A late native guard still owns its cleanup; timeout never makes it usable.
+    arriving.then(
+      (late) => {
+        if (controller.signal.aborted && late && typeof late.release === 'function')
+          void cleanup(late);
+      },
+      () => {}
+    );
+    guard = await bounded(arriving);
+    if (guard === null) return;
+    assert.ok(
+      guard && typeof guard.assertOwned === 'function' && typeof guard.release === 'function',
+      'Owned publication failure guard required'
+    );
+    const fact = structuredClone(
+      validatePublicationFailureFact(guard.fact, item.command, item.deliveryExecution)
+    );
+    const age = producer.now().getTime() - Date.parse(fact.observedAt);
+    assert.ok(age >= -30000 && age <= 30000, 'Fresh publication failure authority required');
+    const row = run.stages.find((stage) => stage.id === fact.stage);
+    assert.ok(
+      row && !['passed', 'reused'].includes(row.status),
+      'Failed stage conflicts with retained proof'
+    );
+    const previous = item.publicationFailureReconciliation.fact;
+    if (previous) {
+      const { observedAt: _oldTime, ...oldIdentity } = previous;
+      const { observedAt: _newTime, ...newIdentity } = fact;
+      assert.deepEqual(newIdentity, oldIdentity, 'Publication failure reconciliation changed');
+    }
+    await bounded(
+      verifyPublicationDelivery(producer, item.command, fact.delivery, { fresh: false })
+    );
+    await bounded(guard.assertOwned());
+    lease.assertOwned();
+    controller.signal.throwIfAborted();
+    item.publicationFailureReconciliation.fact = fact;
+    item.deliveryExecution = structuredClone(fact.delivery);
+    await bounded(producer.save());
+    const proofDigest = `sha256:${hash(canonical(fact))}`;
+    await bounded(guard.assertOwned());
+    releasing = true;
+    await bounded(guard.release({ resolved: true, proofDigest }));
+    controller.signal.throwIfAborted();
+    lease.assertOwned();
+    run.status = 'failed';
+    run.recoveryState = 'verified';
+    run.completedAt = producer.now().toISOString();
+    run.blockers = [
+      blocker(
+        'FAILED_BEFORE_INSTALLATION',
+        'Выпуск завершился ошибкой до установки; выполнение остановлено'
+      ),
+    ];
+    if (row.status !== 'failed') {
+      row.status = 'failed';
+      row.failure = structuredClone(run.blockers[0]);
+      row.completedAt = run.completedAt;
+      if (row.startedAt)
+        row.elapsedMs = Math.max(0, Date.parse(row.completedAt) - Date.parse(row.startedAt));
+    }
+    item.publicationFailureReconciliation.state = 'settled';
+    producer.event(run.id, null, 'failure', run.blockers[0].message, 'error');
+    await bounded(producer.save());
+    settled = true;
+  } catch (error) {
+    // Even a completed native ACK cannot authorize admission before local save.
+    item.publicationFailureReconciliation ??= { state: 'pending', fact: null };
+    item.publicationFailureReconciliation.state = 'pending';
+    run.status = 'blocked';
+    run.blockers = [
+      blocker(
+        'RECONCILIATION_REQUIRED',
+        'Подтверждение остановки выпуска требует восстановления',
+        true
+      ),
+    ];
+    producer.diagnostic(run.id, null, error);
+    // Persist pending with the same protected store even when a failed queued
+    // save poisoned the promise chain; this is recovery, never a force-clear.
+    try {
+      producer.journal.save(structuredClone(producer.state));
+    } catch {
+      /* Remain HELD; restart requires journal reconciliation. */
+    }
+    throw error;
+  } finally {
+    controller.abort();
+    clearTimeout(timer);
+    if (guard && !settled && !releasing && typeof guard.release === 'function') void cleanup(guard);
+    lease.release({ resolved: settled });
+  }
+}

package/dist/producer-publication.mjs

@@ -1,6 +1,6 @@
 import assert from 'node:assert/strict';
-import { hash, canonical, completeIdentity } from './protocol-internals.mjs';
-import { validateOriginalDelivery } from './producer-support.mjs';
+import { completeIdentity } from './protocol-internals.mjs';
+import { verifyPublicationDelivery } from './producer-delivery.mjs';
 import { ProducerAdmission } from './producer-admission.mjs';
 
 export class ProducerPublication extends ProducerAdmission {
@@ -9,7 +9,7 @@ export class ProducerPublication extends ProducerAdmission {
     const item = this.state.commands[command.commandId];
     assert.ok(
       completeIdentity(item?.artifactIdentity),
-      'Published artifact identity has not been verified',
+      'Published artifact identity has not been verified'
     );
     return {
       ...command,
@@ -17,53 +17,30 @@ export class ProducerPublication extends ProducerAdmission {
     };
   }
   async bindPublicationDelivery(command, delivery) {
-    assert.equal(command.action, 'publish');
-    validateOriginalDelivery(delivery, command.expectedSource.sourceCommit);
-    assert.equal(delivery.id, command.commandId);
-    assert.equal(delivery.requestedAt, command.requestedAt);
-    assert.equal(delivery.deadlineAt, command.deadlineAt);
-    assert.ok(Date.parse(command.deadlineAt) > this.now().getTime());
+    await verifyPublicationDelivery(this, command, delivery);
     const item = this.state.commands[command.commandId];
-    assert.equal(item.fingerprint, hash(canonical(command)));
-    if (item.deliveryExecution)
-      assert.deepEqual(
-        item.deliveryExecution,
-        delivery,
-        'Original published delivery changed',
-      );
     item.deliveryExecution = structuredClone(delivery);
     await this.save();
     return delivery;
   }
   async bindPublicationArtifact(command, identity, { delivery } = {}) {
     assert.equal(command.action, 'publish');
-    assert.ok(
-      completeIdentity(identity),
-      'Published artifact identity must be complete',
-    );
+    assert.ok(completeIdentity(identity), 'Published artifact identity must be complete');
     await this.bindPublicationDelivery(command, delivery);
     assert.equal(
       typeof this.provider.verifyPublicationArtifact,
       'function',
-      'Signed publication lineage verifier is required',
+      'Signed publication lineage verifier is required'
     );
     assert.equal(
-      await this.provider.verifyPublicationArtifact(
-        command,
-        identity,
-        delivery,
-      ),
+      await this.provider.verifyPublicationArtifact(command, identity, delivery),
       true,
-      'Signed publication lineage was not verified',
+      'Signed publication lineage was not verified'
     );
     assert.ok(Date.parse(command.deadlineAt) > this.now().getTime());
     const item = this.state.commands[command.commandId];
     if (item.artifactIdentity)
-      assert.deepEqual(
-        item.artifactIdentity,
-        identity,
-        'Bound artifact identity changed',
-      );
+      assert.deepEqual(item.artifactIdentity, identity, 'Bound artifact identity changed');
     item.artifactIdentity = structuredClone(identity);
     await this.save();
     return identity;
@@ -72,54 +49,47 @@ export class ProducerPublication extends ProducerAdmission {
     const item = this.state.commands[commandId];
     assert.ok(
       item?.ack.state !== 'rejected' && item?.command.action === 'publish',
-      'Source publication was not admitted',
+      'Source publication was not admitted'
     );
     if ([...this.pending].length) return this.acknowledgement(commandId);
     assert.ok(
       Date.parse(item.command.deadlineAt) > this.now().getTime(),
-      'Original publication deadline exhausted',
+      'Original publication deadline exhausted'
     );
     assert.equal(
       typeof this.provider.validatePublicationResume,
       'function',
-      'Source publication recovery is not connected',
+      'Source publication recovery is not connected'
     );
     assert.equal(
       await this.provider.validatePublicationResume(item.command, item),
       true,
-      'Source publication recovery is not verified',
-    );
-    const run = this.state.runs.find(
-      (record) => record.commandId === commandId,
+      'Source publication recovery is not verified'
     );
+    const run = this.state.runs.find((record) => record.commandId === commandId);
     assert.ok(run && !['deployed', 'rolled_back'].includes(run.status));
     if (run.recoveryState !== 'not_required') {
       assert.ok(
         this.provider.remotePublication === true &&
           typeof this.provider.qualifyPublicationResume === 'function',
-        'Pending installation must reconcile before publication resumes',
+        'Pending installation must reconcile before publication resumes'
       );
       if (!item.artifactIdentity) {
-        const prepared = await this.provider.publicationResumeArtifact?.(
-          item.command,
-          item,
-        );
+        const prepared = await this.provider.publicationResumeArtifact?.(item.command, item);
         if (!prepared) return this.acknowledgement(commandId);
         await this.bindPublicationArtifact(item.command, prepared.identity, {
           delivery: prepared.delivery,
         });
       }
       if (
-        (await this.provider.qualifyPublicationResume(
-          this.resolvedCommand(item.command),
-          item,
-        )) !== true
+        (await this.provider.qualifyPublicationResume(this.resolvedCommand(item.command), item)) !==
+        true
       )
         return this.acknowledgement(commandId);
     }
     assert.ok(
       Date.parse(item.command.deadlineAt) > this.now().getTime(),
-      'Original publication deadline exhausted',
+      'Original publication deadline exhausted'
     );
     run.status = 'queued';
     run.blockers = [];

package/dist/producer.d.ts

@@ -58,6 +58,11 @@ export interface ReleaseProvider {
     identity: ArtifactIdentity,
     delivery: OriginalDelivery
   ): Promise<boolean>;
+  verifyPublicationDelivery?(command: RunnerCommand, delivery: OriginalDelivery): Promise<boolean>;
+  reconcilePublicationFailure?(
+    command: RunnerCommand,
+    context: ProviderContext & { delivery: OriginalDelivery | null; recoveryDeadlineAt: number }
+  ): Promise<PublicationFailureGuard | null>;
   validatePublicationResume?(
     command: RunnerCommand,
     item: Record<string, unknown>
@@ -76,6 +81,26 @@ export interface ReleaseProvider {
   ): Promise<Record<string, unknown>>;
   productionFailure?(fact: ProductionReadback): Error | undefined;
 }
+export interface PublicationFailureFact {
+  schema: 1;
+  kind: 'failed_before_installation';
+  commandId: string;
+  installationKey: string;
+  expectedSource: { repository: string; ref: string; sourceCommit: string };
+  delivery: OriginalDelivery;
+  observedAt: string;
+  stage: 'source_ready' | 'ci' | 'build' | 'verify' | 'publish';
+  authenticated: true;
+  executionStopped: true;
+  pendingTransaction: false;
+  publicationResolved: true;
+  installationNotStarted: true;
+}
+export interface PublicationFailureGuard {
+  fact: PublicationFailureFact;
+  assertOwned(): Promise<void>;
+  release(options: { resolved: boolean; proofDigest: string | null }): Promise<void>;
+}
 export class ReleaseControlProducer {
   constructor(options: {
     installationKey: string;

package/dist/producer.mjs

@@ -2,7 +2,14 @@ import assert from 'node:assert/strict';
 import { sameIdentity, acceptedProduction } from './protocol.mjs';
 import { blocker, failureMessage, failedProduction } from './producer-support.mjs';
 import { ProducerExecution } from './producer-execution.mjs';
-export { sameIdentity, validateExpectedSource, validateRunnerCommand, validateProducerSnapshot, acceptedProduction } from './protocol.mjs';
+import { reconcilePublicationFailure } from './producer-publication-failure.mjs';
+export {
+  sameIdentity,
+  validateExpectedSource,
+  validateRunnerCommand,
+  validateProducerSnapshot,
+  acceptedProduction,
+} from './protocol.mjs';
 export { producerServer } from './producer-server.mjs';
 
 export class ReleaseControlProducer extends ProducerExecution {
@@ -10,6 +17,17 @@ export class ReleaseControlProducer extends ProducerExecution {
     const item = this.state.commands[commandId];
     assert.ok(item, 'Unknown command');
     const run = this.state.runs.find((r) => r.commandId === commandId);
+    if (
+      item.command.action === 'publish' &&
+      run?.status === 'blocked' &&
+      !item.artifactIdentity &&
+      typeof this.provider.reconcilePublicationFailure === 'function'
+    ) {
+      await reconcilePublicationFailure(this, item, run);
+      return this.acknowledgement(commandId);
+    }
+    if (item.publicationFailureReconciliation?.state === 'pending')
+      return this.acknowledgement(commandId);
     if (
       item.command.action === 'publish' &&
       run?.status === 'blocked' &&
@@ -41,13 +59,10 @@ export class ReleaseControlProducer extends ProducerExecution {
         await this.qualifyForwardRecovery(run, item.command);
         if (run.status === 'failed') {
           for (const row of run.stages.filter((s) =>
-            ['running', 'unverified'].includes(s.status),
+            ['running', 'unverified'].includes(s.status)
           )) {
             row.status = 'failed';
-            row.failure = blocker(
-              'INTERRUPTED_PROOF',
-              'Подтверждение результата было прервано',
-            );
+            row.failure = blocker('INTERRUPTED_PROOF', 'Подтверждение результата было прервано');
           }
         }
         await this.save();
@@ -60,7 +75,7 @@ export class ReleaseControlProducer extends ProducerExecution {
         acceptedProduction(
           fact,
           { ...resolved, expectedIdentity: item.baseline.identity },
-          this.now(),
+          this.now()
         ) &&
         !sameIdentity(item.baseline.identity, resolved.expectedIdentity)
       ) {
@@ -71,16 +86,11 @@ export class ReleaseControlProducer extends ProducerExecution {
           blocker(
             'RECOVERY_VERIFIED',
             'Предыдущая установка восстановлена; исходная выкатка не завершена',
-            true,
+            true
           ),
         ];
         run.completedAt = this.now().toISOString();
-        this.event(
-          run.id,
-          null,
-          'readback',
-          'Подтверждено восстановление предыдущей установки',
-        );
+        this.event(run.id, null, 'readback', 'Подтверждено восстановление предыдущей установки');
         await this.save();
       }
       if (
@@ -90,35 +100,28 @@ export class ReleaseControlProducer extends ProducerExecution {
           .every((s) => ['passed', 'reused'].includes(s.status))
       ) {
         for (const row of run.stages.filter((s) =>
-          ['deploy', 'production_acceptance'].includes(s.id),
+          ['deploy', 'production_acceptance'].includes(s.id)
         )) {
           row.status = 'passed';
           row.completedAt = this.now().toISOString();
           row.failure = null;
           if (row.startedAt)
-            row.elapsedMs = Math.max(
-              0,
-              Date.parse(row.completedAt) - Date.parse(row.startedAt),
-            );
+            row.elapsedMs = Math.max(0, Date.parse(row.completedAt) - Date.parse(row.startedAt));
         }
         run.recoveryState = 'verified';
         run.readback = fact;
-        run.status =
-          item.command.action === 'rollback' ? 'rolled_back' : 'deployed';
+        run.status = item.command.action === 'rollback' ? 'rolled_back' : 'deployed';
         run.blockers = [];
         run.completedAt = this.now().toISOString();
         this.event(
           run.id,
           null,
           'readback',
-          'Фактический результат восстановлен после перезапуска',
+          'Фактический результат восстановлен после перезапуска'
         );
         await this.save();
       }
-      if (
-        run.status === 'blocked' &&
-        failedProduction(fact, resolved, this.now())
-      ) {
+      if (run.status === 'blocked' && failedProduction(fact, resolved, this.now())) {
         run.readback = fact;
         const cause = this.provider.productionFailure?.(fact);
         if (cause) this.diagnostic(run.id, 'production_acceptance', cause);
@@ -130,7 +133,7 @@ export class ReleaseControlProducer extends ProducerExecution {
             cause?.code || 'FUNCTIONAL_ACCEPTANCE_FAILED',
             cause
               ? failureMessage(cause)
-              : 'Функциональная приёмка установленной версии не пройдена',
+              : 'Функциональная приёмка установленной версии не пройдена'
           );
         }
         await this.save();

package/dist/provenance.json

@@ -1,27 +1,29 @@
 {
   "schema": 1,
   "package": "@casecore/release-agent",
-  "version": "0.1.0",
-  "sourceCommit": "fed6c2a396507ac6a488b78d38383593031dfe4a",
+  "version": "0.1.1",
+  "sourceCommit": "afb036322db3a5ff3bbe4d3d2d975837ebf469b1",
   "sourceVerified": true,
   "sourceDirty": false,
   "buildKind": "release",
-  "contentDigest": "sha256:1ee3136876107e544ba846d3997fadf9c85ea109950f55a322d3df80eb3c1ea1",
+  "contentDigest": "sha256:c5f5749d35f85bf2ae7878983ecfd0ef77ee065e1526bf29d54680ddf1b9cc70",
   "files": {
     "src/configuration-hook.mjs": "sha256:1171bf982cbf7cb0092f63b633ef0b0a0947d8ed1106f88c9175c8add33d81b1",
-    "src/exclusive-operation.mjs": "sha256:05f09115e6292c014f8881d125148983f0097f8b5fa7dbcf365dd8355e747657",
+    "src/exclusive-operation.mjs": "sha256:5a1d0b7d3aa41b901132e239586d66d6c7aa2c16682a7db033a7aab91b1d781a",
     "src/identity.mjs": "sha256:253021058fc79232d83f3ecba6f1023fd046f27aabdf9c129a103d3c9ccb07f5",
     "src/index.mjs": "sha256:38d3ebcffe8716f7146c18061d26a392d7784b97a79c59ed53ff839175de2f94",
     "src/journal.mjs": "sha256:35a2620d56084ec1aa164e09d77b8e77096413d9572f7b601da8ef7149b996bd",
     "src/pipeline.mjs": "sha256:7a2d39d235ce7160441d177200389c5f3eae1cc494ec36082a23e8d64a0abe3f",
-    "src/producer-admission.mjs": "sha256:61030d58f3a1e66bb487cef60ab17efec364ddfc8c0c61ba7396f64f0ee55de0",
+    "src/producer-admission.mjs": "sha256:975c7dac25d4c8f94423e5a4db2bd99c556afd6492b26fbda58e841f1df8fc3c",
+    "src/producer-delivery.mjs": "sha256:b20d9ae20dee90bbbe739245a84c9f4b91b1ab958b5e2995ff8705da24ba3988",
     "src/producer-execution.mjs": "sha256:6d9fbca493e4386c92c4d853a66ece3677ec7ab644d6da15b68dd744f30186ef",
-    "src/producer-journal.mjs": "sha256:58a31d919300c697dfc3630c856512df5c9c9c47cad4b29c66e4da545a9a0255",
-    "src/producer-publication.mjs": "sha256:dac520f02205ac6c2b3f66a059f66d8cb61e7b0324e45f9264cf69a96042749b",
+    "src/producer-journal.mjs": "sha256:4799a2224ff1004d68892b807b222da708f8f51e0554b01f54d5c877a8ef84bd",
+    "src/producer-publication-failure.mjs": "sha256:513e71276c7ce4088c95cb3605917afc4709cbb7222ac746958923d7f18eac70",
+    "src/producer-publication.mjs": "sha256:c09fa07b37507093b71bbaff3af9df8ec2331c0cba24a4b936d247e9b35257f7",
     "src/producer-server.mjs": "sha256:def28e10a17eb80fb04ba69b09050731bb005949f949a7f1fb46dae267323434",
     "src/producer-state.mjs": "sha256:c3fcdace4c6579be092d39803cfb308e4bf88060b3f75bb7fc8b91284609b4ce",
     "src/producer-support.mjs": "sha256:0a10f6fa50cd8e729ba432640d0845004488ead2bcc1c9383f02548037f83d66",
-    "src/producer.mjs": "sha256:24cc6db310bcacf301c28982859d732f07d8c5f468e4b5f172d4eb19f6ca14b9",
+    "src/producer.mjs": "sha256:7dd4e6118531c25c6d5547d769263858e556731c76af87fba4c21c8ed98b3994",
     "src/protocol-internals.mjs": "sha256:d08a0c72079d091792c5327adafac5ffc38ea20138a6c44b88879e7157a890b3",
     "src/protocol.mjs": "sha256:1fe135a2e60922b517886a392c2b0c2250b773abda8b1a1fcd9af86df2be6dae",
     "src/snapshot-validator.mjs": "sha256:1279aa19e0932776bc1998935f70ca6fae65391f96b60e2d65bcab3b2cb46036",
@@ -31,7 +33,7 @@
     "types/index.d.ts": "sha256:92ef7b5600f05d52dcb646fc3e4d2b4944ead52ff1c9ee23bb9f4659bebf05a6",
     "types/journal.d.ts": "sha256:79beb61af50b00400588a87426a7f5b38bf38d4b8224284dc6e0631378aa244e",
     "types/pipeline.d.ts": "sha256:c9135e25fb852377c32a16ce781405393c5857886e3f77754b715747202c70a9",
-    "types/producer.d.ts": "sha256:df99fb3617710eb7bbb7a038df22f089e029f2b1fbd1d82f5ad862dadc3b43da",
+    "types/producer.d.ts": "sha256:16ec1e81964a982c9653cdfe70eb3aa22ea8dd7200c2949a8e6731686df7a7bb",
     "types/protocol.d.ts": "sha256:02c06986c81bfc4214169f62da8e0566704b71a5add58434dfca92c673fad4ce",
     "types/source-store.d.ts": "sha256:de044c2bca9826b6c20caefb00d22a4c78183a869b8835fb8f15935989e2372a",
     "types/types.d.ts": "sha256:cdc6664854bffc371a3da45f29bf1b31f14fd61b66e8f8bae8309dd836f6de6e"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@casecore/release-agent",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Общий движок поставки CaseCore с адаптерами продуктов",
   "license": "UNLICENSED",
   "repository": {