@chatpanel/events 0.102.0 → 0.104.0

package/gate.js

@@ -1,74 +1 @@
-// The gate — how far a team may go without a person, as data an organisation configures.
-//
-// ChatPanel's own gate is the strictest setting; an organisation that trusts its pool more
-// flips a flag. Nothing in the runner changes: project-run.js reads the gate at every step
-// where it would otherwise ask, and `gateAllows` is the one question it asks. Lives in
-// `.chatpanel/gate.json` in the org repo (pillars §14.3), optionally overridden per project.
-
-export const AUTONOMY = Object.freeze(['propose', 'push', 'merge']);
-export const HUMAN_FLAGS = Object.freeze(['merge', 'push', 'publish', 'budgetRaise', 'newAgent', 'newTool', 'writeBack', 'recruit']);
-export const CHECKS = Object.freeze(['guard', 'review', 'tester', 'scan']);
-
-/** ChatPanel's own: a branch push is not a release; everything else waits for a person. */
-export const DEFAULT_GATE = Object.freeze({
-  autonomy: 'push',
-  human: Object.freeze({ merge: true, push: false, publish: true, budgetRaise: true, newAgent: true, newTool: true, writeBack: true, recruit: false }),
-  requiredBeforeMerge: Object.freeze(['guard', 'review', 'tester']),
-  branches: Object.freeze({ base: 'main', protected: Object.freeze(['main']) }),
-  budget: Object.freeze({ perProjectCap: null, perJobCap: null }),
-});
-
-const isRecord = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
-
-export function validateGate(g, { partial = false } = {}) {
-  const errors = [];
-  if (!isRecord(g)) return { ok: false, errors: ['gate must be an object'] };
-  if (g.autonomy !== undefined && !AUTONOMY.includes(g.autonomy)) errors.push(`autonomy: one of ${AUTONOMY.join(', ')}`);
-  if (g.human !== undefined) {
-    if (!isRecord(g.human)) errors.push('human: an object of flags');
-    else for (const [k, v] of Object.entries(g.human)) { if (!HUMAN_FLAGS.includes(k)) errors.push(`human.${k}: unknown flag`); else if (typeof v !== 'boolean') errors.push(`human.${k}: true or false`); }
-  }
-  if (g.requiredBeforeMerge !== undefined && (!Array.isArray(g.requiredBeforeMerge) || g.requiredBeforeMerge.some((c) => !CHECKS.includes(c)))) errors.push(`requiredBeforeMerge: a list of ${CHECKS.join(', ')}`);
-  if (g.branches !== undefined && (!isRecord(g.branches) || (g.branches.protected !== undefined && !Array.isArray(g.branches.protected)))) errors.push('branches: { base, protected[] }');
-  if (g.budget !== undefined && !isRecord(g.budget)) errors.push('budget: { perProjectCap, perJobCap }');
-  if (!partial && g.autonomy === undefined) errors.push('autonomy: required');
-  return { ok: errors.length === 0, errors };
-}
-
-/** A gate over the default: a partial gate fills in from ChatPanel's own; a full one stands alone. */
-export function normalizeGate(g, { partial = false, base = DEFAULT_GATE } = {}) {
-  const v = validateGate(g || {}, { partial: true });
-  if (!v.ok) throw new Error(`gate: ${v.errors.join('; ')}`);
-  const src = g || {};
-  const b = partial ? base : DEFAULT_GATE;
-  return {
-    autonomy: AUTONOMY.includes(src.autonomy) ? src.autonomy : b.autonomy,
-    human: { ...b.human, ...(isRecord(src.human) ? src.human : {}) },
-    requiredBeforeMerge: Array.isArray(src.requiredBeforeMerge) ? [...new Set(src.requiredBeforeMerge)] : [...b.requiredBeforeMerge],
-    branches: { base: String(src.branches?.base || b.branches.base), protected: Array.isArray(src.branches?.protected) ? [...new Set(src.branches.protected.map(String))] : [...b.branches.protected] },
-    budget: { perProjectCap: src.budget?.perProjectCap ?? b.budget.perProjectCap, perJobCap: src.budget?.perJobCap ?? b.budget.perJobCap },
-  };
-}
-
-/** The org's gate with a project's partial one over it. */
-export function effectiveGate(orgGate = null, projectGate = null) {
-  const org = normalizeGate(orgGate || {}, { partial: true });
-  return projectGate ? normalizeGate(projectGate, { partial: true, base: org }) : org;
-}
-
-/**
- * The one question the executive loop asks: may a team do `action` on its own?
- *   push · merge · publish · budgetRaise · newAgent · newTool · writeBack · recruit
- * Returns `{ allowed, reason }`; a false answer is where the loop asks a person instead.
- */
-export function gateAllows(gate, action, { branch = null } = {}) {
-  const g = normalizeGate(gate || {}, { partial: true });
-  if (action === 'push' || action === 'merge') {
-    if (branch && g.branches.protected.includes(branch)) return { allowed: false, reason: `${branch} is protected — a person merges` };
-    const far = AUTONOMY.indexOf(g.autonomy);
-    if (action === 'push' && far < AUTONOMY.indexOf('push')) return { allowed: false, reason: 'the gate allows proposing only' };
-    if (action === 'merge' && far < AUTONOMY.indexOf('merge')) return { allowed: false, reason: `the gate allows up to ${g.autonomy}` };
-  }
-  if (HUMAN_FLAGS.includes(action) && g.human[action]) return { allowed: false, reason: `a person decides ${action}` };
-  return { allowed: true, reason: `the gate allows ${action}` };
-}
+const u=Object.freeze(["propose","push","merge"]),f=Object.freeze(["merge","push","publish","budgetRaise","newAgent","newTool","writeBack","recruit"]),p=Object.freeze(["guard","review","tester","scan"]),d=Object.freeze({autonomy:"push",human:Object.freeze({merge:!0,push:!1,publish:!0,budgetRaise:!0,newAgent:!0,newTool:!0,writeBack:!0,recruit:!1}),requiredBeforeMerge:Object.freeze(["guard","review","tester"]),branches:Object.freeze({base:"main",protected:Object.freeze(["main"])}),budget:Object.freeze({perProjectCap:null,perJobCap:null})}),s=e=>e!==null&&typeof e=="object"&&!Array.isArray(e);function l(e,{partial:o=!1}={}){const r=[];if(!s(e))return{ok:!1,errors:["gate must be an object"]};if(e.autonomy!==void 0&&!u.includes(e.autonomy)&&r.push(`autonomy: one of ${u.join(", ")}`),e.human!==void 0)if(!s(e.human))r.push("human: an object of flags");else for(const[n,t]of Object.entries(e.human))f.includes(n)?typeof t!="boolean"&&r.push(`human.${n}: true or false`):r.push(`human.${n}: unknown flag`);return e.requiredBeforeMerge!==void 0&&(!Array.isArray(e.requiredBeforeMerge)||e.requiredBeforeMerge.some(n=>!p.includes(n)))&&r.push(`requiredBeforeMerge: a list of ${p.join(", ")}`),e.branches!==void 0&&(!s(e.branches)||e.branches.protected!==void 0&&!Array.isArray(e.branches.protected))&&r.push("branches: { base, protected[] }"),e.budget!==void 0&&!s(e.budget)&&r.push("budget: { perProjectCap, perJobCap }"),!o&&e.autonomy===void 0&&r.push("autonomy: required"),{ok:r.length===0,errors:r}}function i(e,{partial:o=!1,base:r=d}={}){const n=l(e||{},{partial:!0});if(!n.ok)throw new Error(`gate: ${n.errors.join("; ")}`);const t=e||{},a=o?r:d;return{autonomy:u.includes(t.autonomy)?t.autonomy:a.autonomy,human:{...a.human,...s(t.human)?t.human:{}},requiredBeforeMerge:Array.isArray(t.requiredBeforeMerge)?[...new Set(t.requiredBeforeMerge)]:[...a.requiredBeforeMerge],branches:{base:String(t.branches?.base||a.branches.base),protected:Array.isArray(t.branches?.protected)?[...new Set(t.branches.protected.map(String))]:[...a.branches.protected]},budget:{perProjectCap:t.budget?.perProjectCap??a.budget.perProjectCap,perJobCap:t.budget?.perJobCap??a.budget.perJobCap}}}function c(e=null,o=null){const r=i(e||{},{partial:!0});return o?i(o,{partial:!0,base:r}):r}function b(e,o,{branch:r=null}={}){const n=i(e||{},{partial:!0});if(o==="push"||o==="merge"){if(r&&n.branches.protected.includes(r))return{allowed:!1,reason:`${r} is protected — a person merges`};const t=u.indexOf(n.autonomy);if(o==="push"&&t<u.indexOf("push"))return{allowed:!1,reason:"the gate allows proposing only"};if(o==="merge"&&t<u.indexOf("merge"))return{allowed:!1,reason:`the gate allows up to ${n.autonomy}`}}return f.includes(o)&&n.human[o]?{allowed:!1,reason:`a person decides ${o}`}:{allowed:!0,reason:`the gate allows ${o}`}}export{u as AUTONOMY,p as CHECKS,d as DEFAULT_GATE,f as HUMAN_FLAGS,c as effectiveGate,b as gateAllows,i as normalizeGate,l as validateGate};

package/harness.js

@@ -1,101 +1,4 @@
-// THE REPLAY HARNESS — what turns the determinism claim into a checked one.
-//
-// An unverified invariant decays silently. The claim we actually sell is replay
-// determinism ("same log, same reconstructed inputs"), so it needs a job that re-runs
-// recorded logs and fails the build when reconstruction drifts — the same discipline as
-// the `sync:pii --check` drift guard and the CSP assertion in build-editor.mjs.
-//
-// What it verifies, and what it deliberately does not:
-//   • ORDER is reproduced exactly, from (host, seq) and causes, never from a clock.
-//   • MODEL-VISIBLE INPUT is reconstructable: every resident Ref resolves by hash.
-//   • A Ref whose blob is gone reports VERIFIED-BUT-UNAVAILABLE. That is a PASS, not a
-//     failure — crypto-shredding is a feature, and the log still proves what was sent.
-//   • A Ref whose source CHANGED reports DRIFTED, and that IS a failure, because the
-//     alternative is replay quietly substituting today's note for the one actually sent.
-
-import { upcastAll } from './upcast.js';
-import { linearize } from './order.js';
-import { checkInvariants } from './invariants.js';
-import { resolveRef, RESOLUTION } from './ref.js';
-
-/**
- * @param stored  events as persisted (any schema version)
- * @param blobs   { lookup(ref) } — omit to skip content reconstruction
- * @returns a report; `ok` is the CI signal.
- */
-export function replay(stored, { blobs = null, invariantOptions = {} } = {}) {
-  const events = upcastAll(stored);
-  const ordered = linearize(events);
-
-  // Determinism: linearize is a function of the SET. Feed it back reversed; if the order
-  // changes, replay depends on how the log happened to be read off disk.
-  const stable = linearize([...events].reverse()).map((e) => e.id).join(',')
-    === ordered.map((e) => e.id).join(',');
-
-  const violations = checkInvariants(ordered, invariantOptions);
-
-  const refs = { exact: 0, unavailable: 0, drifted: [] };
-  const turns = [];
-  if (blobs) {
-    for (const e of ordered) {
-      // What the model was SHOWN and what it SAID are refs too, and they are the half a
-      // reader most wants replayed. Checking only `resident` verified the toolset while
-      // leaving the conversation unverified — the part that actually reconstructs a turn.
-      if (String(e.type).startsWith('assistant.')) {
-        const r = resolveRef(e.payload.ref, (x) => blobs.lookup(x));
-        if (r.resolution === RESOLUTION.EXACT) refs.exact++;
-        else if (r.resolution === RESOLUTION.UNAVAILABLE) refs.unavailable++;
-        else refs.drifted.push({ eventId: e.id, ref: r.ref, actualHash: r.actualHash });
-        continue;
-      }
-      if (e.type !== 'context.assembled') continue;
-      const resolved = e.payload.resident.map((ref) => resolveRef(ref, (r) => blobs.lookup(r)));
-      for (const r of resolved) {
-        if (r.resolution === RESOLUTION.EXACT) refs.exact++;
-        else if (r.resolution === RESOLUTION.UNAVAILABLE) refs.unavailable++;
-        else refs.drifted.push({ eventId: e.id, ref: r.ref, actualHash: r.actualHash });
-      }
-      turns.push({
-        turnId: e.payload.turnId,
-        budget: e.payload.budget,
-        used: e.payload.used,
-        parts: e.payload.parts,
-        reconstructable: resolved.every((r) => r.resolution !== RESOLUTION.DRIFTED),
-      });
-    }
-  }
-
-  return {
-    ok: stable && violations.length === 0 && refs.drifted.length === 0,
-    events: ordered.length,
-    stable,
-    violations,
-    refs,
-    turns,
-    order: ordered.map((e) => e.id),
-  };
-}
-
-/** One-line CI summary. */
-export function formatReport(report) {
-  const lines = [
-    `${report.ok ? 'PASS' : 'FAIL'} — ${report.events} events`,
-    `  order stable        ${report.stable ? 'yes' : 'NO — replay is order-dependent'}`,
-    `  invariants          ${report.violations.length === 0 ? 'I1-I6 hold' : `${report.violations.length} violation(s)`}`,
-  ];
-  for (const v of report.violations) lines.push(`    ${v.invariant} ${v.eventId || ''} ${v.message}`);
-  if (report.refs.exact || report.refs.unavailable || report.refs.drifted.length) {
-    lines.push(`  refs                ${report.refs.exact} exact · ${report.refs.unavailable} shredded/evicted · ${report.refs.drifted.length} DRIFTED`);
-  }
-  for (const d of report.refs.drifted) lines.push(`    drifted ${d.ref.kind}:${d.ref.id} — the source changed since capture`);
-  return lines.join('\n');
-}
-
-/** Parse a JSONL log. Blank lines ignored so a truncated export still loads. */
-export function parseJsonl(text) {
-  return String(text).split('\n').map((l) => l.trim()).filter(Boolean).map((l) => JSON.parse(l));
-}
-
-export function toJsonl(events) {
-  return events.map((e) => JSON.stringify(e)).join('\n');
-}
+import{upcastAll as m}from"./upcast.js";import{linearize as v}from"./order.js";import{checkInvariants as g}from"./invariants.js";import{resolveRef as h,RESOLUTION as r}from"./ref.js";function A(e,{blobs:n=null,invariantOptions:a={}}={}){const d=m(e),o=v(d),f=v([...d].reverse()).map(t=>t.id).join(",")===o.map(t=>t.id).join(","),u=g(o,a),i={exact:0,unavailable:0,drifted:[]},c=[];if(n)for(const t of o){if(String(t.type).startsWith("assistant.")){const s=h(t.payload.ref,l=>n.lookup(l));s.resolution===r.EXACT?i.exact++:s.resolution===r.UNAVAILABLE?i.unavailable++:i.drifted.push({eventId:t.id,ref:s.ref,actualHash:s.actualHash});continue}if(t.type!=="context.assembled")continue;const p=t.payload.resident.map(s=>h(s,l=>n.lookup(l)));for(const s of p)s.resolution===r.EXACT?i.exact++:s.resolution===r.UNAVAILABLE?i.unavailable++:i.drifted.push({eventId:t.id,ref:s.ref,actualHash:s.actualHash});c.push({turnId:t.payload.turnId,budget:t.payload.budget,used:t.payload.used,parts:t.payload.parts,reconstructable:p.every(s=>s.resolution!==r.DRIFTED)})}return{ok:f&&u.length===0&&i.drifted.length===0,events:o.length,stable:f,violations:u,refs:i,turns:c,order:o.map(t=>t.id)}}function b(e){const n=[`${e.ok?"PASS":"FAIL"} — ${e.events} events`,`  order stable        ${e.stable?"yes":"NO — replay is order-dependent"}`,`  invariants          ${e.violations.length===0?"I1-I6 hold":`${e.violations.length} violation(s)`}`];for(const a of e.violations)n.push(`    ${a.invariant} ${a.eventId||""} ${a.message}`);(e.refs.exact||e.refs.unavailable||e.refs.drifted.length)&&n.push(`  refs                ${e.refs.exact} exact · ${e.refs.unavailable} shredded/evicted · ${e.refs.drifted.length} DRIFTED`);for(const a of e.refs.drifted)n.push(`    drifted ${a.ref.kind}:${a.ref.id} — the source changed since capture`);return n.join(`
+`)}function E(e){return String(e).split(`
+`).map(n=>n.trim()).filter(Boolean).map(n=>JSON.parse(n))}function S(e){return e.map(n=>JSON.stringify(n)).join(`
+`)}export{b as formatReport,E as parseJsonl,A as replay,S as toJsonl};