@codedology/code-forge 0.5.1 → 0.6.1

package/src/review/gate-check.mjs

@@ -17,6 +17,18 @@
  * (`file` + `finding`; a finding id is scoped to one file, so a waiver of `F1` in `a.mjs` never
  * clears `F1` in `b.mjs`); a late finding counts whether or not it is signed (fail closed).
  *
+ * B47 (autopilot): a `review.waived {by: autopilot}` row (written by `autopilot waive`) clears a
+ * finding ONLY when {@link autopilotWaiverProblem} finds nothing wrong with it: its MAC verifies;
+ * the finding is not `proof`; the finding's severity recorded in the block's signed review rows
+ * (`review.triage`, `review.late_finding`; {@link recordedSeverity}) is `warning` or `nit` and
+ * equals the waiver's `severity`; a signed `autopilot.grant` row of this run with the waiver's
+ * `grant_id` exists, its window (`ts` ≤ waiver `ts` < `until`) holds the waiver, and its scopes
+ * include `waive:<severity>`; no `autopilot.stop` / `autopilot.expire` row for that grant is
+ * dated at or before the waiver (or undated); and its `decision_id` names a signed, acted
+ * `autopilot.decision` of the same grant, scope, block, file and finding made at most 30 min
+ * before it ({@link decisionProblem}). Otherwise the waiver is ignored and the finding is refused as
+ * `autopilot_waiver_invalid` (the detail says why). `by: human` waivers are unchanged.
+ *
  * `block waive <id> <finding> --file <path> --reason <text>` (`waiveFinding`) writes a signed
  * `review.waived` row with `by: human`. The orchestrator runs it only after the human said so in chat; the brief
  * never mentions it; for a coder the argv is forbidden (`mergeForbidden()` always carries B12b's
@@ -34,7 +46,7 @@ import { tierFor } from '../proof/tiers.mjs';
 import { DELETED_HASH, contentHash, gitChildEnv } from '../worker/ticket.mjs';
 
 /**
- * @typedef {{code: 'unreviewed' | 'unsigned' | 'rule_break' | 'late_unruled' | 'review_cap' | 'unproven', file?: string, finding?: string, detail?: string}} Refusal
+ * @typedef {{code: 'unreviewed' | 'unsigned' | 'rule_break' | 'late_unruled' | 'review_cap' | 'unproven' | 'autopilot_waiver_invalid', file?: string, finding?: string, detail?: string}} Refusal
  */
 
 /** @param {Record<string, any>} row @param {Buffer} key */
@@ -76,28 +88,166 @@ export function checkBlockReviews({ block, runId, files, rows, key, transcript =
 
   const signedOf = (/** @type {string} */ event) => mine.filter((r) => r.event === event && verified(r, key));
   const waivers = signedOf('review.waived').filter((r) => r.by === 'human');
+  const autopilotWaivers = mine.filter((r) => r.event === 'review.waived' && r.by === 'autopilot');
+  const runRows = rows.filter((r) => r?.run === runId);
   const rulings = signedOf('review.late_ruling');
   const matches = (/** @type {Record<string, any>} */ r, /** @type {string} */ file, /** @type {string} */ finding) => r.finding === finding && r.file === file;
-  const waived = (/** @type {string} */ file, /** @type {string} */ finding) => waivers.some((r) => matches(r, file, finding));
+  /**
+   * Whether the finding is waived: a signed human waiver, or an autopilot waiver its grant covered.
+   * `invalid`: why the autopilot waivers naming it do not count (null when none names it).
+   * @param {string} file @param {string} finding @returns {{waived: boolean, invalid: string | null}}
+   */
+  const waiverFor = (file, finding) => {
+    if (waivers.some((r) => matches(r, file, finding))) return { waived: true, invalid: null };
+    const named = autopilotWaivers.filter((r) => matches(r, file, finding));
+    if (named.length === 0) return { waived: false, invalid: null };
+    const problems = named.map((w) => autopilotWaiverProblem(w, { blockRows: mine, runRows, allRows: rows, key }));
+    if (problems.some((p) => p === null)) return { waived: true, invalid: null };
+    return { waived: false, invalid: /** @type {string} */ (problems[0]) };
+  };
+  /** @param {Refusal} refusal @param {string} finding @param {string | null} invalid @returns {Refusal} */
+  const orInvalid = (refusal, finding, invalid) =>
+    invalid === null ? refusal : { code: 'autopilot_waiver_invalid', file: refusal.file, finding, detail: `the autopilot waiver of ${finding} in ${refusal.file} does not count: ${invalid}` };
 
   for (const late of mine.filter((r) => r.event === 'review.late_finding')) {
-    if (rulings.some((r) => matches(r, late.file, late.finding)) || waived(late.file, late.finding)) continue;
-    refusals.push({ code: 'late_unruled', file: late.file, finding: late.finding, detail: `late finding ${late.finding} in ${late.file} has no ruling` });
+    if (rulings.some((r) => matches(r, late.file, late.finding))) continue;
+    const w = waiverFor(late.file, late.finding);
+    if (w.waived) continue;
+    refusals.push(orInvalid({ code: 'late_unruled', file: late.file, finding: late.finding, detail: `late finding ${late.finding} in ${late.file} has no ruling` }, late.finding, w.invalid));
   }
 
   for (const cap of mine.filter((r) => r.event === 'review.cap')) {
     const hash = hashOf.get(cap.file);
     if (hash !== undefined && approvedFor(cap.file, hash).some((r) => verified(r, key))) continue;
     for (const finding of Array.isArray(cap.open) ? cap.open : []) {
-      if (!waived(cap.file, finding)) refusals.push({ code: 'review_cap', file: cap.file, finding, detail: `${cap.file} stopped at review_cap; finding ${finding} is open and not waived` });
+      const w = waiverFor(cap.file, finding);
+      if (!w.waived) refusals.push(orInvalid({ code: 'review_cap', file: cap.file, finding, detail: `${cap.file} stopped at review_cap; finding ${finding} is open and not waived` }, finding, w.invalid));
     }
   }
   for (const r of checkBlockProof({ runId, files: proofFiles, rows: mine, key, highPaths })) {
-    if (!waived(/** @type {string} */ (r.file), PROOF_FINDING)) refusals.push(r);
+    const w = waiverFor(/** @type {string} */ (r.file), PROOF_FINDING);
+    if (!w.waived) refusals.push(orInvalid(r, PROOF_FINDING, w.invalid));
   }
   return { ok: refusals.length === 0, refusals };
 }
 
+/** The finding severities autopilot may waive (B47); anything else is never delegated. */
+export const DELEGABLE_SEVERITIES = Object.freeze(['warning', 'nit']);
+
+/** Severity order for {@link recordedSeverity}: the worst recorded one wins. */
+const SEVERITY_RANK = Object.freeze({ nit: 0, warning: 1, critical: 2, blocker: 3 });
+
+/**
+ * The severity the block's signed review rows record for one finding of one file (B47): every
+ * `review.triage` and `review.late_finding` row with that `block`, `file` and `finding`; the worst
+ * one wins. Fails closed: no row ⇒ `not-recorded`; any such row whose MAC does not verify ⇒
+ * `unverified`; a severity outside critical/blocker/warning/nit ⇒ `unknown` — each with
+ * `severity: null`.
+ * @param {Array<Record<string, any>>} rows - rows of ONE run (other runs filtered out by the caller).
+ * @param {{block: string, file: string, finding: string, key: Buffer}} where
+ * @returns {{severity: string, why: null} | {severity: null, why: 'not-recorded' | 'unverified' | 'unknown'}}
+ */
+export function recordedSeverity(rows, { block, file, finding, key }) {
+  const named = rows.filter((r) => (r?.event === 'review.triage' || r?.event === 'review.late_finding') && r.block === block && r.file === file && r.finding === finding);
+  if (named.length === 0) return { severity: null, why: 'not-recorded' };
+  if (named.some((r) => !verified(r, key))) return { severity: null, why: 'unverified' };
+  /** @type {Record<string, number>} */
+  const rank = SEVERITY_RANK;
+  let worst = '';
+  for (const r of named) {
+    if (typeof r.severity !== 'string' || !Object.hasOwn(rank, r.severity)) return { severity: null, why: 'unknown' };
+    if (worst === '' || rank[r.severity] > rank[worst]) worst = r.severity;
+  }
+  return { severity: worst, why: null };
+}
+
+/**
+ * Why a `review.waived {by: autopilot}` row does NOT clear its finding, or null when it does (the
+ * rules are in the module doc). `blockRows`: the block's rows of this run (the review rows the
+ * severity is read from); `runRows`: every row of this run (grant, stop and expire rows carry no
+ * block); `allRows`: every row given (stop and expire rows are matched by grant id across all of
+ * them, whatever their `run`). A stop or expire row counts whether or not it is signed (fail closed).
+ * @param {Record<string, any>} waiver
+ * @param {{blockRows: Array<Record<string, any>>, runRows: Array<Record<string, any>>, allRows?: Array<Record<string, any>>, key: Buffer}} ctx
+ * @returns {string | null}
+ */
+export function autopilotWaiverProblem(waiver, { blockRows, runRows, allRows = runRows, key }) {
+  if (!verified(waiver, key)) return 'the waiver has no valid MAC';
+  if (waiver.finding === PROOF_FINDING) return 'proof is never delegated';
+  const recorded = recordedSeverity(blockRows, { block: waiver.block, file: waiver.file, finding: waiver.finding, key });
+  if (recorded.severity === null) return `the finding's severity is ${recorded.why}; critical findings are never delegated`;
+  if (!DELEGABLE_SEVERITIES.includes(recorded.severity)) return `the finding is ${recorded.severity}; critical findings are never delegated`;
+  if (waiver.severity !== recorded.severity) return `the waiver says ${String(waiver.severity)} but the finding is recorded as ${recorded.severity}`;
+  const at = typeof waiver.ts === 'string' ? Date.parse(waiver.ts) : Number.NaN;
+  if (!Number.isFinite(at)) return 'the waiver has no time';
+  const scope = `waive:${recorded.severity}`;
+  return (
+    grantCoverProblem(runRows, { grantId: waiver.grant_id, scope, at, key, what: 'the waiver', endRows: allRows }) ??
+    decisionProblem(runRows, { decisionId: waiver.decision_id, grantId: waiver.grant_id, scope, subject: { block: waiver.block, file: waiver.file, finding: waiver.finding }, decision: 'waive', at, key })
+  );
+}
+
+/** A delegate decision allows an action for at most this long after it was made (B47). */
+export const DECISION_MAX_AGE_MS = 30 * 60 * 1000;
+
+/**
+ * Why grant `grantId` did NOT cover `scope` at time `at` (epoch ms), or null when it did (B47;
+ * shared by the waiver check and the fix loop's extra rounds): a signed `autopilot.grant` row of
+ * the run with that id, whose window (`ts` ≤ at < `until`) holds `at`, whose scopes include the
+ * scope and whose deny list does not, and no `autopilot.stop` / `autopilot.expire` row for it at
+ * or before `at`. A stop or expire row counts whether or not it is signed, and one with a missing
+ * or unparsable `ts` counts as having stopped the grant (fail closed). Stop and expire rows are
+ * looked for in `endRows` (default `runRows`) by grant id alone, whatever their `run`.
+ * @param {Array<Record<string, any>>} runRows - every row of the run.
+ * @param {{grantId: unknown, scope: string, at: number, key: Buffer, what?: string, endRows?: Array<Record<string, any>>}} q - `what` names the action in the message.
+ * @returns {string | null}
+ */
+export function grantCoverProblem(runRows, { grantId, scope, at, key, what = 'the action', endRows = runRows }) {
+  const id = grantId;
+  const grant = runRows.find((r) => r?.event === 'autopilot.grant' && typeof id === 'string' && r.grant_id === id && verified(r, key));
+  if (!grant) return `no signed autopilot.grant row for grant ${String(id)} in this run`;
+  const from = Date.parse(grant.ts);
+  const until = Date.parse(grant.until);
+  if (!(Number.isFinite(from) && Number.isFinite(until) && at >= from && at < until)) return `${what} is outside grant ${id}'s window`;
+  if (!Array.isArray(grant.scopes) || !grant.scopes.includes(scope) || (Array.isArray(grant.deny) && grant.deny.includes(scope))) return `grant ${id} does not allow ${scope}`;
+  const ended = endRows.find((r) => {
+    if ((r?.event !== 'autopilot.stop' && r?.event !== 'autopilot.expire') || r.grant_id !== id) return false;
+    const ts = typeof r.ts === 'string' ? Date.parse(r.ts) : Number.NaN;
+    return !Number.isFinite(ts) || ts <= at;
+  });
+  if (ended) return `grant ${id} was ${ended.event === 'autopilot.stop' ? 'stopped' : 'expired'} before ${what}`;
+  return null;
+}
+
+/**
+ * Why decision `decisionId` does NOT allow the action, or null when it does (B47): a signed
+ * `autopilot.decision` row of the run with that `decision_id`, `acted: true`, the same grant and
+ * scope, the fixed option word the action needs as its `decision` (`waive` for a waiver, `allow`
+ * for an extra round, the level itself — `L0`/`L1`/`L2` — for a coder level; so an acted "fix" or
+ * "deny" never authorises anything), a `subject` naming the same block (and file / finding when
+ * the action has them), made at or before `at` and at most {@link DECISION_MAX_AGE_MS} before it.
+ * @param {Array<Record<string, any>>} runRows
+ * @param {{decisionId: unknown, grantId: unknown, scope: string, subject: {block: string, file?: string, finding?: string}, decision: string, at: number, key: Buffer}} q
+ * @returns {string | null}
+ */
+export function decisionProblem(runRows, { decisionId, grantId, scope, subject, decision, at, key }) {
+  if (typeof decisionId !== 'string' || decisionId.length === 0) return 'no delegate decision named';
+  const row = runRows.find((r) => r?.event === 'autopilot.decision' && r.decision_id === decisionId);
+  if (!row) return `no autopilot.decision row ${decisionId} in this run`;
+  if (!verified(row, key)) return `decision ${decisionId} has no valid MAC`;
+  if (row.acted !== true) return `decision ${decisionId} did not act (it went to the owner)`;
+  if (row.grant_id !== grantId) return `decision ${decisionId} is under another grant`;
+  if (row.scope !== scope) return `decision ${decisionId} is for ${String(row.scope)}, not ${scope}`;
+  if (row.decision !== decision) return `decision ${decisionId} decided ${JSON.stringify(row.decision)}, not ${JSON.stringify(decision)}`;
+  const named = row.subject && typeof row.subject === 'object' ? row.subject : {};
+  for (const k of /** @type {Array<'block' | 'file' | 'finding'>} */ (['block', 'file', 'finding'])) {
+    if (subject[k] !== undefined && named[k] !== subject[k]) return `decision ${decisionId} is about another ${k}`;
+  }
+  const ts = typeof row.ts === 'string' ? Date.parse(row.ts) : Number.NaN;
+  if (!Number.isFinite(ts) || ts > at || at - ts > DECISION_MAX_AGE_MS) return `decision ${decisionId} is older than 30 min (or not yet made)`;
+  return null;
+}
+
 /** The finding id a human waives to clear an `unproven` file: `block waive <id> proof --file <path>`. */
 export const PROOF_FINDING = 'proof';