@casecore/release-agent 0.1.2 → 0.1.3

package/README.md

@@ -131,6 +131,61 @@ Alvori — `release-control-source.json`. Для старого формата A
 переход этапа, время, событие и сохранение выполняются общей реализацией;
 адаптер передаёт фактическое начало и завершение своей операции.
 
+Для команды публикации, которая точно не была принята исполнителем, SDK 0.1.3
+предоставляет `store.reconcileNonAdmission(command, trustedHeldContext)`.
+Ответ GET 404, истёкший срок или пустой журнал сами по себе не разрешают этот
+переход. Контекст передаёт точную установку и политику источника, `scope`
+(`tenantId`, `workspaceId`, `parentRunId`, `operationGeneration`,
+`credentialRevision`, `streamId`, `baselineIdentity`), `recoveryDeadlineAt`
+в миллисекундах UTC и доверенный `acquireGuard(command, context)`.
+Срок восстановления ограничен 30 секундами и не меняет исходные T0 и deadline.
+
+Адаптер удерживает общую блокировку приёма, worker, конфигурации и публикации;
+подтверждает остановку всех исходных обработчиков и операций; исключает поздний
+приём; проверяет отсутствие команды в том же защищённом журнале и получает
+свежее независимое подтверждение прежней установки. Он также удерживает
+каноническое владение CaseCore для той же команды, parent run, outbox и scope.
+`acquireGuard` возвращает `null` при неопределённости либо
+`{ fact, baselineReadback, assertOwned(), release({ resolved, proofDigest }) }`.
+Точный формат `NonAdmissionFact` и контекста описан в декларациях SDK.
+Readback использует прежние пять полей `ProductionReadback`, совпадает с
+`scope.baselineIdentity` и подтверждает успешный smoke после исходного T0,
+не старше 300 секунд. Служебные сведения о native владении передаются отдельно.
+
+Движок сохраняет запись `commands[id]` с двумя полями: `command` и
+`admissionRejection`. Последняя содержит `schema: 1`, `state: pending | rejected`,
+точные `fact`, `baselineReadback`, `proofDigest`, стандартный rejected ACK
+и `completedAt`. Запись не содержит accepted timestamp, этапов, очереди,
+артефакта или выполненного запуска. `progress` исключает её из списка запусков.
+Общая функция `nonAdmissionProofDigest(command, fact, baselineReadback)` доступна
+из `@casecore/release-agent` и `@casecore/release-agent/source-store`;
+адаптер использует её для того же native/central ACK, без копии алгоритма хеша.
+
+Сначала сохраняется защищённый pending-запрет позднего приёма, затем проверяются
+владение и свежесть и вызывается `release({ resolved: true, proofDigest })`.
+Он подтверждает фактический native ACK и завершение центральной транзакции
+владения; отрицательный ACK центральной команды применяется отдельно штатным
+путём после окончательного сохранения SDK. Внешняя native блокировка остаётся
+удержанной до возврата метода. После ACK движок повторно проверяет срок и
+свежесть, сохраняет `rejected` и возвращает стандартное подтверждение отказа.
+Повторные `accept` и `reconcile` возвращают тот же отказ для точной команды;
+коллизия UUID с другими входами запрещена.
+
+Потеря ACK, ошибка сохранения или утрата владения оставляют pending и исходную
+неопределённость. `reconcile` для pending возвращает `null`; повторное восстановление
+требует нового фактически удерживаемого guard с прежней идентичностью команды,
+parent, установки, credential revision, stream и baseline. Generation новой
+временной native/central блокировки может отличаться; это не продлевает старую
+блокировку или исходные часы. Прежние точные доказательства сохраняются в
+частном `admissionRejection.priorProofs` (не более 100), новый digest связывает
+текущее доказательство. Уже завершённый отказ и его ACK не переписываются.
+Pending запрещает новый приём; `save` через другие API того же процесса также
+запрещён во время восстановления. Адаптер учитывает этот дискриминатор при
+выборе worker-задач и при изменении конфигурации. Native fence и проверка
+неопределённого состояния после перезапуска остаются обязательны, в том числе
+когда запись pending физически не удалось сохранить. HTTP не принимает
+доверенный callback или эти доказательства из пользовательского JSON.
+
 ## Сборка и выпуск
 
 ```sh

package/dist/provenance.json

@@ -1,12 +1,12 @@
 {
   "schema": 1,
   "package": "@casecore/release-agent",
-  "version": "0.1.2",
-  "sourceCommit": "f51fa3e14522b88887645d3f83cc2dcfaf478d32",
+  "version": "0.1.3",
+  "sourceCommit": "a9736762537078698065c74bbb0febb675b980c7",
   "sourceVerified": true,
   "sourceDirty": false,
   "buildKind": "release",
-  "contentDigest": "sha256:8b324e7f25b018f0b79a9deded8aada1b885646a807578a2697bd47b7c8fb5a0",
+  "contentDigest": "sha256:21d9013bdd65fefe213eee463eaa9dc13bb2ee1647f392e2c6c90ca5953d2886",
   "files": {
     "src/configuration-hook.mjs": "sha256:1171bf982cbf7cb0092f63b633ef0b0a0947d8ed1106f88c9175c8add33d81b1",
     "src/exclusive-operation.mjs": "sha256:5a1d0b7d3aa41b901132e239586d66d6c7aa2c16682a7db033a7aab91b1d781a",
@@ -27,15 +27,16 @@
     "src/protocol-internals.mjs": "sha256:d08a0c72079d091792c5327adafac5ffc38ea20138a6c44b88879e7157a890b3",
     "src/protocol.mjs": "sha256:1fe135a2e60922b517886a392c2b0c2250b773abda8b1a1fcd9af86df2be6dae",
     "src/snapshot-validator.mjs": "sha256:1279aa19e0932776bc1998935f70ca6fae65391f96b60e2d65bcab3b2cb46036",
-    "src/source-admission.mjs": "sha256:da083d984b1c0eb018ec464057ce320108a79e1aed3231ab22e8110c32a48363",
-    "src/source-store.mjs": "sha256:5473094f0b75cf73673762530ea1b8db286106c58942bc5670395b0c9fe19a77",
+    "src/source-admission.mjs": "sha256:25e0e3cc163895c3f6b5057162538c4c313bd37e67956c63b2624df52517b437",
+    "src/source-non-admission.mjs": "sha256:a2308518c8337b662946c5778fe30a5a35a6e7f0b8ed6130eeca93d8ea959ded",
+    "src/source-store.mjs": "sha256:b58a833518086a3d64fe163c323c90b6d6f4cd0793982891146c0a5f9d7241b9",
     "src/stage-journal.mjs": "sha256:96321418e4f8b48aba3dd0a4269a8f345d6763acb81f3b1e330ba3baf06a213e",
     "types/index.d.ts": "sha256:92ef7b5600f05d52dcb646fc3e4d2b4944ead52ff1c9ee23bb9f4659bebf05a6",
     "types/journal.d.ts": "sha256:79beb61af50b00400588a87426a7f5b38bf38d4b8224284dc6e0631378aa244e",
     "types/pipeline.d.ts": "sha256:c9135e25fb852377c32a16ce781405393c5857886e3f77754b715747202c70a9",
     "types/producer.d.ts": "sha256:980aad137365f6c131b6bfabfab411a73c4a2b2fb35a167152ef8ed446ec1ade",
     "types/protocol.d.ts": "sha256:02c06986c81bfc4214169f62da8e0566704b71a5add58434dfca92c673fad4ce",
-    "types/source-store.d.ts": "sha256:de044c2bca9826b6c20caefb00d22a4c78183a869b8835fb8f15935989e2372a",
+    "types/source-store.d.ts": "sha256:ce2086dd682e8f57bc5e1581b411ec9fe1cf1cfba8dccafe38c22d102c2b9904",
     "types/types.d.ts": "sha256:cdc6664854bffc371a3da45f29bf1b31f14fd61b66e8f8bae8309dd836f6de6e"
   }
 }

package/dist/source-admission.mjs

@@ -1,5 +1,6 @@
 import { isDeepStrictEqual } from 'node:util';
 import { createHash } from 'node:crypto';
+import { admissionRejectionAck } from './source-non-admission.mjs';
 
 const uuid = /^[a-f0-9]{8}-[a-f0-9]{4}-[1-8][a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/iu;
 const identity = (value) =>
@@ -138,6 +139,7 @@ export function admitArtifactCommand(command, state, options, helpers) {
   const reject = (code, message) =>
     ack(command.commandId, 'rejected', sourceBlocker(code, message));
   const duplicate = state.commands[command.commandId];
+  if (duplicate?.admissionRejection) return admissionRejectionAck(duplicate, command);
   if (duplicate)
     return isDeepStrictEqual(duplicate.command, command)
       ? ack(command.commandId, 'reconciled')
@@ -185,10 +187,11 @@ export function admitArtifactCommand(command, state, options, helpers) {
   if (
     Object.values(state.commands).some(
       (record) =>
-        record !== previous &&
-        (['queued', 'running', 'unverified'].includes(record.status) ||
-          (['failed', 'blocked'].includes(record.status) &&
-            !['verified', 'not_required'].includes(record.recoveryState)))
+        record.admissionRejection?.state === 'pending' ||
+        (record !== previous &&
+          (['queued', 'running', 'unverified'].includes(record.status) ||
+            (['failed', 'blocked'].includes(record.status) &&
+              !['verified', 'not_required'].includes(record.recoveryState))))
     )
   )
     return reject('release_in_progress', 'Another canonical execution is not yet reconciled.');
@@ -317,6 +320,7 @@ export function sourceProgress(state, cursor, now, { sourceCandidate, sourceTime
     candidates.set(candidate.id, candidate);
   };
   for (const record of Object.values(state.commands)) {
+    if (record.admissionRejection) continue;
     const sourceCommand = record.sourceCommand ?? record.command;
     const candidate = sourceCandidate(
       sourceCommand.expectedSource,

package/dist/source-non-admission.mjs

@@ -0,0 +1,430 @@
+import assert from 'node:assert/strict';
+import { isDeepStrictEqual } from 'node:util';
+import {
+  canonical,
+  hash,
+  keys,
+  completeIdentity,
+  validateReadback,
+  timestamp,
+} from './protocol-internals.mjs';
+import { acceptedProduction, sameIdentity } from './protocol.mjs';
+import { validPublishCommand } from './source-store.mjs';
+
+const uuid = /^[a-f0-9]{8}-[a-f0-9]{4}-[1-8][a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/iu;
+const scopeFields = [
+  'tenantId',
+  'workspaceId',
+  'parentRunId',
+  'operationGeneration',
+  'credentialRevision',
+  'streamId',
+  'baselineIdentity',
+];
+const operations = new Map();
+const reason = {
+  code: 'command_not_admitted',
+  message: 'Команда не была принята исполнителем; отсутствие выполнения подтверждено',
+  retryable: false,
+};
+const acknowledgement = (command) => ({
+  protocolVersion: 1,
+  commandId: command.commandId,
+  runId: command.commandId,
+  state: 'rejected',
+  reason: structuredClone(reason),
+});
+
+export function nonAdmissionProofDigest(command, fact, baselineReadback) {
+  return `sha256:${hash(canonical({ command, fact, baselineReadback }))}`;
+}
+function validateScope(scope) {
+  keys(scope, scopeFields);
+  for (const key of ['tenantId', 'workspaceId', 'parentRunId', 'operationGeneration'])
+    assert.match(scope[key], uuid);
+  assert.ok(Number.isSafeInteger(scope.credentialRevision) && scope.credentialRevision > 0);
+  assert.ok(
+    typeof scope.streamId === 'string' && scope.streamId.length > 0 && scope.streamId.length <= 200
+  );
+  assert.ok(
+    completeIdentity(scope.baselineIdentity),
+    'Complete retained baseline identity required'
+  );
+}
+function validateFact(fact, command, scope) {
+  keys(fact, [
+    'schema',
+    'kind',
+    'commandId',
+    'installationKey',
+    'expectedSource',
+    'executionProvider',
+    'requestedAt',
+    'deadlineAt',
+    ...scopeFields,
+    'observedAt',
+    'authenticated',
+    'admissionStopped',
+    'journalAbsenceVerified',
+    'executionNotStarted',
+    'installationNotStarted',
+    'pendingTransaction',
+    'baselineUnchanged',
+  ]);
+  assert.equal(fact.schema, 1);
+  assert.equal(fact.kind, 'command_not_admitted');
+  for (const key of [
+    'commandId',
+    'installationKey',
+    'executionProvider',
+    'requestedAt',
+    'deadlineAt',
+  ])
+    assert.equal(fact[key], command[key]);
+  assert.deepEqual(fact.expectedSource, command.expectedSource);
+  const actualScope = Object.fromEntries(scopeFields.map((key) => [key, fact[key]]));
+  validateScope(actualScope);
+  if (scope) assert.deepEqual(actualScope, scope, 'Non-admission ownership scope changed');
+  timestamp(fact.observedAt);
+  for (const key of [
+    'authenticated',
+    'admissionStopped',
+    'journalAbsenceVerified',
+    'executionNotStarted',
+    'installationNotStarted',
+    'baselineUnchanged',
+  ])
+    assert.equal(fact[key], true);
+  assert.equal(fact.pendingTransaction, false);
+}
+function validateBaseline(readback, command, fact, now) {
+  validateReadback(readback);
+  assert.equal(readback.installationKey, command.installationKey);
+  assert.ok(
+    sameIdentity(readback.identity, fact.baselineIdentity),
+    'Non-admission baseline changed'
+  );
+  assert.equal(readback.source, 'independent-production');
+  assert.equal(readback.functionalSmoke.status, 'passed');
+  assert.equal(readback.functionalSmoke.sourceCommit, fact.baselineIdentity.sourceCommit);
+  const observations = [readback.observedAt, readback.functionalSmoke.checkedAt];
+  assert.ok(
+    observations.every((value) => Date.parse(value) >= Date.parse(command.requestedAt)),
+    'Baseline proof precedes the original request'
+  );
+  if (now !== undefined) {
+    assert.ok(
+      acceptedProduction(
+        readback,
+        { ...command, expectedIdentity: fact.baselineIdentity },
+        new Date(now)
+      ),
+      'Independent baseline acceptance required'
+    );
+    assert.ok(
+      observations.every((value) => now - Date.parse(value) <= 300000),
+      'Fresh independent baseline required'
+    );
+    const age = now - Date.parse(fact.observedAt);
+    assert.ok(age >= -30000 && age <= 30000, 'Fresh non-admission authority required');
+  }
+}
+function immutableFact(fact) {
+  const { observedAt: _time, operationGeneration: _generation, ...identity } = fact;
+  return identity;
+}
+export function validNonAdmissionRecord(record) {
+  try {
+    keys(record, ['command', 'admissionRejection']);
+    const command = record.command;
+    assert.ok(
+      validPublishCommand(
+        command,
+        command.installationKey,
+        command.expectedSource?.repository,
+        command.expectedSource?.ref
+      )
+    );
+    const proof = record.admissionRejection;
+    keys(
+      proof,
+      [
+        'schema',
+        'state',
+        'fact',
+        'baselineReadback',
+        'proofDigest',
+        'acknowledgement',
+        'completedAt',
+      ],
+      ['priorProofs']
+    );
+    assert.equal(proof.schema, 1);
+    assert.ok(['pending', 'rejected'].includes(proof.state));
+    validateFact(proof.fact, command);
+    validateBaseline(proof.baselineReadback, command, proof.fact);
+    assert.equal(
+      proof.proofDigest,
+      nonAdmissionProofDigest(command, proof.fact, proof.baselineReadback)
+    );
+    assert.deepEqual(proof.acknowledgement, acknowledgement(command));
+    if (proof.priorProofs !== undefined) {
+      assert.ok(Array.isArray(proof.priorProofs) && proof.priorProofs.length <= 100);
+      const digests = new Set([proof.proofDigest]);
+      for (const prior of proof.priorProofs) {
+        keys(prior, ['fact', 'baselineReadback', 'proofDigest']);
+        validateFact(prior.fact, command);
+        validateBaseline(prior.baselineReadback, command, prior.fact);
+        assert.deepEqual(
+          immutableFact(prior.fact),
+          immutableFact(proof.fact),
+          'Retained non-admission scope changed'
+        );
+        assert.equal(
+          prior.proofDigest,
+          nonAdmissionProofDigest(command, prior.fact, prior.baselineReadback)
+        );
+        assert.ok(!digests.has(prior.proofDigest), 'Duplicate non-admission attempt proof');
+        digests.add(prior.proofDigest);
+      }
+    }
+    if (proof.state === 'pending') assert.equal(proof.completedAt, null);
+    else {
+      timestamp(proof.completedAt);
+      validateBaseline(proof.baselineReadback, command, proof.fact, Date.parse(proof.completedAt));
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+export function nonAdmissionBusy(path) {
+  return operations.has(path);
+}
+export function admissionRejectionAck(record, command) {
+  assert.ok(validNonAdmissionRecord(record), 'Invalid non-admission receipt');
+  if (command)
+    assert.deepEqual(record.command, command, 'Command ID is bound to different immutable inputs');
+  assert.equal(record.admissionRejection.state, 'rejected', 'NON_ADMISSION_RECONCILIATION_PENDING');
+  return structuredClone(record.admissionRejection.acknowledgement);
+}
+
+/** The caller supplies actual native and central exclusion; journal absence alone has no authority. */
+export async function reconcileNonAdmission(journal, command, context) {
+  command = structuredClone(command);
+  assert.ok(
+    validPublishCommand(
+      command,
+      context.installationKey,
+      context.repository,
+      context.ref ?? 'main'
+    ),
+    'Invalid scoped source command'
+  );
+  validateScope(context.scope);
+  assert.equal(
+    typeof context.acquireGuard,
+    'function',
+    'Trusted non-admission guard callback required'
+  );
+  const clock = context.now ?? Date.now;
+  const deadline = context.recoveryDeadlineAt;
+  const prior = operations.get(journal.path);
+  assert.ok(
+    !prior || (prior.state === 'held' && prior.commandId === command.commandId),
+    'NON_ADMISSION_OPERATION_BUSY'
+  );
+  const operation = { commandId: command.commandId, state: 'active' };
+  operations.set(journal.path, operation);
+  let guard,
+    timer,
+    releasing = false,
+    settled = false,
+    retain = prior !== undefined;
+  const controller = new AbortController();
+  const signal = context.signal
+    ? AbortSignal.any([context.signal, controller.signal])
+    : controller.signal;
+  const alive = () => {
+    signal.throwIfAborted();
+    assert.ok(
+      Number.isSafeInteger(deadline) && deadline > clock() && deadline <= clock() + 30000,
+      'Non-admission recovery deadline expired'
+    );
+  };
+  const timeout = new Promise((_, reject) => {
+    timer = setTimeout(
+      () => {
+        controller.abort();
+        reject(Error('Non-admission recovery timed out'));
+      },
+      Math.max(1, Math.min(30000, deadline - clock()))
+    );
+  });
+  const bounded = (promise) => Promise.race([promise, timeout]);
+  const cleanup = (owned) =>
+    Promise.resolve()
+      .then(() => owned.release({ resolved: false, proofDigest: null }))
+      .catch(() => {});
+  let pending;
+  try {
+    alive();
+    const existing = journal.read().commands[command.commandId];
+    if (existing) {
+      assert.deepEqual(
+        existing.command,
+        command,
+        'Command ID is bound to different immutable inputs'
+      );
+      assert.ok(
+        existing.admissionRejection,
+        'Command already admitted; use its existing recovery boundary'
+      );
+      retain = true;
+      validateFact(existing.admissionRejection.fact, command, {
+        ...context.scope,
+        operationGeneration: existing.admissionRejection.fact.operationGeneration,
+      });
+      if (existing.admissionRejection.state === 'rejected') {
+        settled = true;
+        return admissionRejectionAck(existing, command);
+      }
+    }
+    const arriving = Promise.resolve().then(() =>
+      context.acquireGuard(structuredClone(command), {
+        signal,
+        recoveryDeadlineAt: deadline,
+        scope: structuredClone(context.scope),
+      })
+    );
+    arriving.then(
+      (late) => {
+        if (signal.aborted && late && typeof late.release === 'function') void cleanup(late);
+      },
+      () => {}
+    );
+    guard = await bounded(arriving);
+    if (guard === null) return null;
+    retain = true;
+    assert.ok(
+      guard && typeof guard.assertOwned === 'function' && typeof guard.release === 'function',
+      'Held non-admission guard required'
+    );
+    const fact = structuredClone(guard.fact),
+      baselineReadback = structuredClone(guard.baselineReadback);
+    validateFact(fact, command, context.scope);
+    const fresh = () => {
+      alive();
+      const now = clock();
+      assert.ok(now < deadline, 'Non-admission recovery deadline expired');
+      validateBaseline(baselineReadback, command, fact, now);
+      return now;
+    };
+    await bounded(guard.assertOwned());
+    fresh();
+    const state = journal.read();
+    const previous = state.commands[command.commandId];
+    if (previous) {
+      assert.deepEqual(
+        previous.command,
+        command,
+        'Command ID is bound to different immutable inputs'
+      );
+      assert.ok(previous.admissionRejection?.state === 'pending', 'Non-admission receipt changed');
+      assert.deepEqual(
+        immutableFact(fact),
+        immutableFact(previous.admissionRejection.fact),
+        'Non-admission identity changed'
+      );
+    }
+    assert.ok(
+      Object.entries(state.commands).every(
+        ([id, record]) =>
+          id === command.commandId ||
+          (record.admissionRejection
+            ? record.admissionRejection.state === 'rejected'
+            : !['queued', 'running', 'unverified'].includes(record.status) &&
+              (!['failed', 'blocked'].includes(record.status) ||
+                ['verified', 'not_required'].includes(record.recoveryState)))
+      ),
+      'Other source work requires reconciliation'
+    );
+    assert.ok(
+      previous || Object.keys(state.commands).length < 100,
+      'Source journal retention requires reconciliation'
+    );
+    pending = {
+      command,
+      admissionRejection: {
+        schema: 1,
+        state: 'pending',
+        fact,
+        baselineReadback,
+        proofDigest: nonAdmissionProofDigest(command, fact, baselineReadback),
+        acknowledgement: acknowledgement(command),
+        completedAt: null,
+      },
+    };
+    if (previous) {
+      const retained = previous.admissionRejection;
+      const history = structuredClone(retained.priorProofs ?? []);
+      if (retained.proofDigest !== pending.admissionRejection.proofDigest) {
+        assert.ok(history.length < 100, 'Non-admission attempt retention requires reconciliation');
+        history.push({
+          fact: structuredClone(retained.fact),
+          baselineReadback: structuredClone(retained.baselineReadback),
+          proofDigest: retained.proofDigest,
+        });
+      }
+      pending.admissionRejection.priorProofs = history;
+    }
+    state.commands[command.commandId] = pending;
+    journal.save(state);
+    await bounded(guard.assertOwned());
+    fresh();
+    releasing = true;
+    await bounded(
+      guard.release({ resolved: true, proofDigest: pending.admissionRejection.proofDigest })
+    );
+    fresh();
+    const latest = journal.read();
+    assert.deepEqual(
+      latest.commands[command.commandId],
+      pending,
+      'Protected non-admission receipt changed'
+    );
+    const completed = structuredClone(pending);
+    completed.admissionRejection.state = 'rejected';
+    completed.admissionRejection.completedAt = new Date(fresh()).toISOString();
+    latest.commands[command.commandId] = completed;
+    journal.save(latest);
+    fresh();
+    settled = true;
+    return admissionRejectionAck(completed, command);
+  } catch (error) {
+    if (pending) {
+      try {
+        const latest = journal.read(),
+          selected = latest.commands[command.commandId];
+        if (
+          isDeepStrictEqual(selected, pending) ||
+          (selected?.admissionRejection?.state === 'rejected' &&
+            isDeepStrictEqual(selected.command, command) &&
+            selected.admissionRejection.proofDigest === pending.admissionRejection.proofDigest)
+        ) {
+          latest.commands[command.commandId] = pending;
+          journal.save(latest);
+        }
+      } catch {
+        /* Retain in-process ownership; native startup must also refuse uncertain recovery. */
+      }
+    }
+    throw error;
+  } finally {
+    controller.abort();
+    clearTimeout(timer);
+    if (guard && !settled && !releasing && typeof guard.release === 'function') void cleanup(guard);
+    if (settled || !retain) operations.delete(journal.path);
+    else operation.state = 'held';
+  }
+}

package/dist/source-store.d.ts

@@ -5,7 +5,76 @@ import type {
   Blocker,
   StageId,
   ArtifactIdentity,
+  ProductionReadback,
 } from './types.js';
+export interface NonAdmissionScope {
+  tenantId: string;
+  workspaceId: string;
+  parentRunId: string;
+  operationGeneration: string;
+  credentialRevision: number;
+  streamId: string;
+  baselineIdentity: ArtifactIdentity;
+}
+export interface NonAdmissionFact extends NonAdmissionScope {
+  schema: 1;
+  kind: 'command_not_admitted';
+  commandId: string;
+  installationKey: string;
+  expectedSource: ExpectedSource;
+  executionProvider: 'github' | 'local';
+  requestedAt: string;
+  deadlineAt: string;
+  observedAt: string;
+  authenticated: true;
+  admissionStopped: true;
+  journalAbsenceVerified: true;
+  executionNotStarted: true;
+  installationNotStarted: true;
+  pendingTransaction: false;
+  baselineUnchanged: true;
+}
+export interface NonAdmissionGuard {
+  fact: NonAdmissionFact;
+  baselineReadback: ProductionReadback;
+  assertOwned(): Promise<void>;
+  release(options: { resolved: boolean; proofDigest: string | null }): Promise<void>;
+}
+export interface NonAdmissionContext {
+  installationKey: string;
+  repository: string;
+  ref?: string;
+  scope: NonAdmissionScope;
+  signal?: AbortSignal;
+  recoveryDeadlineAt: number;
+  now?: () => number;
+  acquireGuard(
+    command: RunnerCommand,
+    context: { signal: AbortSignal; recoveryDeadlineAt: number; scope: NonAdmissionScope }
+  ): Promise<NonAdmissionGuard | null>;
+}
+export interface NonAdmissionRecord {
+  command: RunnerCommand;
+  admissionRejection: {
+    schema: 1;
+    state: 'pending' | 'rejected';
+    fact: NonAdmissionFact;
+    baselineReadback: ProductionReadback;
+    proofDigest: string;
+    acknowledgement: Acknowledgement;
+    completedAt: string | null;
+    priorProofs?: {
+      fact: NonAdmissionFact;
+      baselineReadback: ProductionReadback;
+      proofDigest: string;
+    }[];
+  };
+}
+export function nonAdmissionProofDigest(
+  command: RunnerCommand,
+  fact: NonAdmissionFact,
+  baselineReadback: ProductionReadback
+): string;
 export interface SourceState {
   schema: 1;
   cursor: number;
@@ -50,6 +119,10 @@ export function sourceStore(
     options: { installationKey: string; repository: string; ref?: string; now?: number }
   ): Acknowledgement;
   reconcile(commandId: string): Acknowledgement | null;
+  reconcileNonAdmission(
+    command: RunnerCommand,
+    context: NonAdmissionContext
+  ): Promise<Acknowledgement | null>;
 };
 export function progress(
   state: SourceState,

package/dist/source-store.mjs

@@ -1,6 +1,13 @@
 import { isDeepStrictEqual } from 'node:util';
 import { createProtectedJsonStore } from './journal.mjs';
 import { admitArtifactCommand, sourceProgress } from './source-admission.mjs';
+import {
+  validNonAdmissionRecord,
+  admissionRejectionAck,
+  nonAdmissionBusy,
+  reconcileNonAdmission,
+} from './source-non-admission.mjs';
+export { nonAdmissionProofDigest } from './source-non-admission.mjs';
 
 const fields = (value, keys) =>
   value &&
@@ -106,27 +113,29 @@ export function validSourceState(state) {
         record.command?.commandId === id &&
         record.command.protocolVersion === 1 &&
         ['publish', 'deploy', 'retry', 'rollback'].includes(record.command.action) &&
-        [
-          'queued',
-          'running',
-          'failed',
-          'blocked',
-          'deployed',
-          'rolled_back',
-          'unverified',
-        ].includes(record.status) &&
-        sourceTimestamp(record.acceptedAt) &&
-        (record.completedAt === null || sourceTimestamp(record.completedAt)) &&
-        Array.isArray(record.stages) &&
-        record.stages.length === sourceStageDefinitions.length &&
-        sourceStageDefinitions.every(
-          ([stageId]) => record.stages.filter((stage) => stage.id === stageId).length === 1
-        ) &&
-        Array.isArray(record.blockers) &&
-        record.blockers.length <= 100 &&
-        record.dispatches &&
-        typeof record.dispatches === 'object' &&
-        !Array.isArray(record.dispatches)
+        (Object.hasOwn(record, 'admissionRejection')
+          ? validNonAdmissionRecord(record)
+          : [
+              'queued',
+              'running',
+              'failed',
+              'blocked',
+              'deployed',
+              'rolled_back',
+              'unverified',
+            ].includes(record.status) &&
+            sourceTimestamp(record.acceptedAt) &&
+            (record.completedAt === null || sourceTimestamp(record.completedAt)) &&
+            Array.isArray(record.stages) &&
+            record.stages.length === sourceStageDefinitions.length &&
+            sourceStageDefinitions.every(
+              ([stageId]) => record.stages.filter((stage) => stage.id === stageId).length === 1
+            ) &&
+            Array.isArray(record.blockers) &&
+            record.blockers.length <= 100 &&
+            record.dispatches &&
+            typeof record.dispatches === 'object' &&
+            !Array.isArray(record.dispatches))
     ) &&
     Array.isArray(state.events) &&
     state.events.length <= 1000
@@ -134,10 +143,21 @@ export function validSourceState(state) {
 }
 
 /** One host driver writes under its shared flock; atomic readers never infer missing success. */
-export function sourceStore(directory, { filename = 'source-publication.json', validateState = validSourceState } = {}) {
-  const journal = createProtectedJsonStore(directory, { filename, validate: validateState, initial: blank });
+export function sourceStore(
+  directory,
+  { filename = 'source-publication.json', validateState = validSourceState } = {}
+) {
+  const journal = createProtectedJsonStore(directory, {
+    filename,
+    validate: validateState,
+    initial: blank,
+  });
   directory = journal.directory;
-  const { read, save } = journal;
+  const { read } = journal;
+  const save = (state) => {
+    if (nonAdmissionBusy(journal.path)) throw new Error('NON_ADMISSION_OPERATION_BUSY');
+    journal.save(state);
+  };
   const event = (
     state,
     record,
@@ -175,6 +195,13 @@ export function sourceStore(directory, { filename = 'source-publication.json', v
     save,
     event,
     accept(command, { installationKey, repository, ref = 'main', now = Date.now() }) {
+      const retained = read().commands[command?.commandId];
+      if (retained?.admissionRejection) {
+        if (!validPublishCommand(command, installationKey, repository, ref))
+          throw new Error('Invalid scoped source publication command.');
+        return admissionRejectionAck(retained, command);
+      }
+      if (nonAdmissionBusy(journal.path)) throw new Error('NON_ADMISSION_OPERATION_BUSY');
       if (command?.action !== 'publish')
         return admitArtifactCommand(
           command,
@@ -186,6 +213,7 @@ export function sourceStore(directory, { filename = 'source-publication.json', v
         throw new Error('Invalid scoped source publication command.');
       const state = read();
       const previous = state.commands[command.commandId];
+      if (previous?.admissionRejection) return admissionRejectionAck(previous, command);
       if (previous)
         return isDeepStrictEqual(previous.command, command)
           ? ack(command.commandId, 'reconciled')
@@ -207,6 +235,7 @@ export function sourceStore(directory, { filename = 'source-publication.json', v
       if (
         Object.values(state.commands).some(
           (record) =>
+            record.admissionRejection?.state === 'pending' ||
             ['queued', 'running', 'unverified'].includes(record.status) ||
             (['failed', 'blocked'].includes(record.status) &&
               record.recoveryState !== 'verified' &&
@@ -269,7 +298,15 @@ export function sourceStore(directory, { filename = 'source-publication.json', v
     },
     reconcile(commandId) {
       if (!uuid.test(commandId ?? '')) throw new Error('Invalid command identity.');
-      return read().commands[commandId] ? ack(commandId, 'reconciled') : null;
+      const record = read().commands[commandId];
+      if (record?.admissionRejection)
+        return record.admissionRejection.state === 'rejected'
+          ? admissionRejectionAck(record)
+          : null;
+      return record ? ack(commandId, 'reconciled') : null;
+    },
+    reconcileNonAdmission(command, context) {
+      return reconcileNonAdmission(journal, command, context);
     },
   };
 }
@@ -304,11 +341,21 @@ export function sourceCandidate(expectedSource, at, blockers = []) {
     },
   };
 }
-export function progress(state, cursor = '0', now = Date.now(), { validateState = validSourceState } = {}) {
+export function progress(
+  state,
+  cursor = '0',
+  now = Date.now(),
+  { validateState = validSourceState } = {}
+) {
   if (!validateState(state) || !/^\d+$/u.test(cursor) || BigInt(cursor) > BigInt(state.cursor))
     throw new Error('Invalid source journal cursor or state.');
   return sourceProgress(state, cursor, now, { sourceCandidate, sourceTimestamp });
 }
 
-export { completeArtifact, baselineCandidateId, admitArtifactCommand, sourceProgress } from './source-admission.mjs';
+export {
+  completeArtifact,
+  baselineCandidateId,
+  admitArtifactCommand,
+  sourceProgress,
+} from './source-admission.mjs';
 export { createStageJournal } from './stage-journal.mjs';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@casecore/release-agent",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Общий движок поставки CaseCore с адаптерами продуктов",
   "license": "UNLICENSED",
   "repository": {