@codyswann/lisa 4.71.1 → 4.71.3

package/all/copy-overwrite/scripts/lib/npm-update-helper-inventory.mjs

@@ -42,6 +42,9 @@ const PRODUCER = [
   "allocate",
   "authorization",
   "broker-client",
+  "cancel-origin",
+  "cancellation",
+  "cancellation-proof",
   "checkpoint",
   "contract",
   "controller-broker",
@@ -81,6 +84,7 @@ const PRODUCER = [
   "publish",
   "quality",
   "recovery",
+  "supersession",
   "runtime-archive",
   "runtime-graph",
   "runtime-transport",

package/all/copy-overwrite/scripts/lib/npm-update-hosted-gate.mjs

@@ -21,6 +21,7 @@ import {
 } from "./npm-update-controller-factory.mjs";
 import { startHookReadBroker } from "./npm-update-hook-provider.mjs";
 import { originalHookInstallation } from "./npm-update-hook-installation.mjs";
+import { withStage } from "./npm-update-invariants.mjs";
 import {
   sha256,
   PROPOSAL_PREDICATE,
@@ -234,22 +235,9 @@ function nodeGateway(root, context) {
   return bin;
 }
 
-/** A separate read-only capability is available during original gates; it cannot acquire publisher/issuer permissions. */
-export async function createHostedGate(context, root, env) {
-  assertHostedGate(context);
-  const native = controllerTools(context.config.automationProvenance);
-  const graph = await qualifiedControllerGraph(context.cwd, context.config, [
-    "lisa-work-item.mjs",
-    "lisa-automation-provenance.mjs",
-    "lisa-rails-prepush.mjs",
-    "lib/npm-update-hosted-hook.mjs",
-    "lib/npm-update-hook-preload.mjs",
-  ]);
-  const installed = await installHostedDependencies(context, root, env);
-  const installation = await installOriginalManager(context, installed);
-  const scope = await proofScope(context, installed);
-  mkdirSync(join(root, "gh-config"), { mode: 0o700 });
-  const profile = {
+/** The unchanged read-only subject is constructed separately so diagnostic wrapping stays within function budgets. */
+function hookProfile(context, root, native, scope) {
+  return {
     version: 1,
     deadline: context.deadline,
     cwd: context.cwd,
@@ -267,16 +255,50 @@ export async function createHostedGate(context, root, env) {
       scope.proofs
     ),
   };
-  const broker = await startHookReadBroker(profile, context.token);
+}
+
+/** A separate read-only capability is available during original gates; it cannot acquire publisher/issuer permissions. */
+export async function createHostedGate(context, root, env) {
+  await withStage("gate-validate", () => assertHostedGate(context));
+  const native = await withStage("gate-tools", () =>
+    controllerTools(context.config.automationProvenance)
+  );
+  const graph = await withStage("gate-graph", () =>
+    qualifiedControllerGraph(context.cwd, context.config, [
+      "lisa-work-item.mjs",
+      "lisa-automation-provenance.mjs",
+      "lisa-rails-prepush.mjs",
+      "lib/npm-update-hosted-hook.mjs",
+      "lib/npm-update-hook-preload.mjs",
+    ])
+  );
+  const installed = await withStage("gate-install", () =>
+    installHostedDependencies(context, root, env)
+  );
+  const installation = await withStage("gate-hooks", () =>
+    installOriginalManager(context, installed)
+  );
+  const scope = await withStage("gate-scope", () =>
+    proofScope(context, installed)
+  );
+  const profile = await withStage("gate-scope", () => {
+    mkdirSync(join(root, "gh-config"), { mode: 0o700 });
+    return hookProfile(context, root, native, scope);
+  });
+  const broker = await withStage("gate-broker", () =>
+    startHookReadBroker(profile, context.token)
+  );
   try {
-    const bin = nodeGateway(root, {
-      version: 1,
-      root,
-      cwd: context.cwd,
-      graph,
-      native,
-      reader: { root, path: broker.path, deadline: context.deadline },
-    });
+    const bin = await withStage("gate-gateway", () =>
+      nodeGateway(root, {
+        version: 1,
+        root,
+        cwd: context.cwd,
+        graph,
+        native,
+        reader: { root, path: broker.path, deadline: context.deadline },
+      })
+    );
     return {
       installation,
       env: {
@@ -294,7 +316,7 @@ export async function createHostedGate(context, root, env) {
       close: broker.close,
     };
   } catch (error) {
-    await broker.close();
+    await withStage("gate-close", () => broker.close());
     throw error;
   }
 }

package/all/copy-overwrite/scripts/lib/npm-update-invariants.mjs

@@ -2,6 +2,107 @@
 // Do not edit directly — durable changes belong upstream in Lisa.
 
 /** Pure shared diagnostics retain one error identity without importing producer orchestration. */
+const stages = new Set([
+  "configuration",
+  "cancel-intent",
+  "cancel-origin",
+  "cancel-checkpoint",
+  "cancel-close",
+  "gate-input",
+  "gate-validate",
+  "gate-scratch",
+  "gate-stage",
+  "gate-baseline",
+  "gate-link",
+  "gate-attach",
+  "gate-proof",
+  "gate-tools",
+  "gate-graph",
+  "gate-install",
+  "gate-hooks",
+  "gate-scope",
+  "gate-broker",
+  "gate-gateway",
+  "gate-commit",
+  "gate-push",
+  "gate-close",
+  "gate-output",
+]);
+const diagnostics = new WeakMap();
+const signals = new Set([
+  "SIGTERM",
+  "SIGINT",
+  "SIGKILL",
+  "SIGHUP",
+  "SIGQUIT",
+  "SIGABRT",
+  "SIGPIPE",
+  "SIGSEGV",
+  "SIGBUS",
+  "SIGILL",
+  "SIGTRAP",
+  "SIGFPE",
+]);
+const errnos = new Set([
+  "EACCES",
+  "ENOENT",
+  "ENOEXEC",
+  "EMFILE",
+  "ENFILE",
+  "EAGAIN",
+  "EIO",
+  "EPIPE",
+]);
+const categories = new Set([
+  "exit",
+  "signal",
+  "cancelled",
+  "deadline",
+  "output-bound",
+  "input-failed",
+  "spawn-error",
+]);
+
+/** Nested stages preserve the innermost observed boundary and the exact original thrown value. */
+export async function withStage(stage, operation) {
+  required(stages.has(stage), "invalid updater diagnostic stage");
+  try {
+    return await operation();
+  } catch (error) {
+    if (
+      error !== null &&
+      (typeof error === "object" || typeof error === "function")
+    ) {
+      const prior = diagnostics.get(error) ?? {};
+      diagnostics.set(error, { ...prior, stage: prior.stage ?? stage });
+    }
+    throw error;
+  }
+}
+
+/** Only native capture registers observed close facts; exception properties never establish provenance. */
+export function recordNativeFailure(error, category, status, signal, errno) {
+  diagnostics.set(error, {
+    ...diagnostics.get(error),
+    native: categories.has(category) ? category : "unknown",
+    status:
+      Number.isInteger(status) && status >= 0 && status <= 255 ? status : null,
+    signal: signals.has(signal) ? signal : null,
+    errno: errnos.has(errno) ? errno : null,
+  });
+}
+
+/** Never inspect arbitrary messages, stacks, getters, commands, paths or captured child output. */
+export function publicFailure(error) {
+  const facts = diagnostics.get(error);
+  const parts = [`stage=${facts?.stage ?? "unknown"}`];
+  if (facts?.native) {
+    parts.push(`native=${facts.native}`, `status=${facts.status ?? "null"}`);
+    if (facts.signal) parts.push(`signal=${facts.signal}`);
+    if (facts.errno) parts.push(`errno=${facts.errno}`);
+  }
+  return `npm updater failed: required policy, authorization, installation, gate or exact publication evidence was unavailable (${parts.join(" ")})`;
+}
 
 /** Only trusted static boundary reasons may leave a phase as a public diagnostic. */
 export class UpdaterError extends Error {

package/all/copy-overwrite/scripts/lib/npm-update-leaf-contract.mjs

@@ -142,7 +142,7 @@ Git history command: ${evidence.history.command}
 Git history outcome: ${evidence.history.result}
 All-state GitHub query: ${evidence.search.query}
 Outcome: every matching record was loaded completely; unrelated work was preserved and exact proposal recovery was checked separately.
-Matches are read completely before allocating this deterministic proposal. No parent or PRD lineage is declared; this build-ready standalone Task is one leaf.
+Matches are read completely before allocating this deterministic proposal. No parent or PRD lineage is declared; this build-ready standalone Task is one leaf.${evidence.supersession ? `\nSupersedes cancelled proposal ${evidence.supersession.workItem}. Original proposal key: ${evidence.supersession.proposalKey}. Verified cancellation SHA256: ${evidence.supersession.cancellationSha256}. The previous claim, specification and checkpoint are preserved; this leaf has fresh parent-bound authority.` : ""}
 
 ## Validation Journey
 

package/all/copy-overwrite/scripts/lib/npm-update-leaf.mjs

@@ -82,12 +82,29 @@ export async function claimLeaf(
 
 /** Complete provider history and immutable human policy govern every mutation. */
 export async function inspectLeaf(issue, draft, policy, config) {
-  const roles = leafRoles(config, policy.repository);
-  const labels = issue.labels.map(label => label.name);
   required(
     issue.state === "open" && !issue.pull_request && issue.number > 0,
     "closed or nonissue leaf"
   );
+  return inspectLeafFields(issue, draft, policy, config);
+}
+
+/** Closed-state inspection never grants authority without a separately verified cancellation. */
+export async function inspectCancelledLeaf(issue, draft, policy, config) {
+  required(
+    issue.state === "closed" &&
+      issue.state_reason === "not_planned" &&
+      !issue.pull_request &&
+      issue.number > 0,
+    "leaf is not explicitly cancelled"
+  );
+  return inspectLeafFields(issue, draft, policy, config);
+}
+
+/** Both fixed state entry points preserve the original complete ownership and hold checks. */
+async function inspectLeafFields(issue, draft, policy, config) {
+  const roles = leafRoles(config, policy.repository);
+  const labels = issue.labels.map(label => label.name);
   required(
     issue.children.length === 0 &&
       issue.blockers.every(item => item.state === "closed"),
@@ -151,7 +168,16 @@ export function historicalFiling(issue) {
   const value = JSON.parse(
     new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes)
   );
-  keys(value, ["history", "search", "registry", "labels", "main"]);
+  keys(value, [
+    "history",
+    "search",
+    "registry",
+    "labels",
+    "main",
+    ...(value.supersession ? ["supersession"] : []),
+  ]);
+  if (value.supersession)
+    keys(value.supersession, ["workItem", "cancellationSha256", "proposalKey"]);
   required(
     canonicalJson(value) === bytes.toString("utf8"),
     "original filing fields are noncanonical"

package/all/copy-overwrite/scripts/lib/npm-update-native-process.mjs

@@ -5,6 +5,7 @@
 import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import { required } from "./npm-update-contract.mjs";
+import { recordNativeFailure } from "./npm-update-invariants.mjs";
 
 /** The complete supervisor vector, including its control overhead, is bounded literal data. */
 function supervisedArguments(vector) {
@@ -104,27 +105,37 @@ function captureProcess(
     const errors = [];
     let size = 0;
     let failure;
+    let category;
+    let errno;
     let closed = false;
-    const stop = reason => {
-      failure ??= new Error(`npm updater: ${reason}`);
+    const stop = (reason, kind) => {
+      if (!failure) {
+        failure = new Error(`npm updater: ${reason}`);
+        category = kind;
+      }
       if (!closed && child.pid) child.kill("SIGTERM");
     };
-    const abort = () => stop("child was cancelled");
+    const abort = () => stop("child was cancelled", "cancelled");
     abortSignal?.addEventListener("abort", abort, { once: true });
     if (abortSignal?.aborted) abort();
-    const timer = setTimeout(() => stop("child exceeded deadline"), timeout);
+    const timer = setTimeout(
+      () => stop("child exceeded deadline", "deadline"),
+      timeout
+    );
     const collect = target => data => {
       size += data.length;
-      if (size > maximum) stop("child output exceeded bound");
+      if (size > maximum) stop("child output exceeded bound", "output-bound");
       else target.push(data);
     };
     child.stdout.on("data", collect(chunks));
     child.stderr.on("data", collect(errors));
     child.on("error", error => {
       failure = error;
+      category = "spawn-error";
+      errno = error.code;
     });
     child.stdin.on("error", error => {
-      if (error.code !== "EPIPE") stop("child input failed");
+      if (error.code !== "EPIPE") stop("child input failed", "input-failed");
     });
     child.stdin.end(input);
     child.on("close", (code, signal) => {
@@ -134,6 +145,13 @@ function captureProcess(
       if (failure || signal || !allowed.includes(code)) {
         const error =
           failure ?? new Error(`npm updater: child failed (${code ?? signal})`);
+        recordNativeFailure(
+          error,
+          category ?? (signal ? "signal" : "exit"),
+          code,
+          signal,
+          errno
+        );
         reject(
           Object.assign(error, {
             stdout: Buffer.concat(chunks),

package/all/copy-overwrite/scripts/lib/npm-update-supersession.mjs

@@ -0,0 +1,274 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/** Authenticated cancellation chains remain finite, exact and separate from ordinary recovery. */
+import { canonicalJson } from "../lisa-automation-provenance.mjs";
+import { required } from "./npm-update-contract.mjs";
+import { validateProposal, keys } from "./npm-update-contract.mjs";
+import { join } from "node:path";
+import { writeFileSync } from "node:fs";
+import { writeJson, withPrivateRoot } from "./npm-update-process.mjs";
+import { sha256 } from "./github-attestation-verifier.mjs";
+import {
+  completeCheckpoints,
+  committedCancellationConfig,
+  authenticateStaleOrigin,
+  assertOriginTransport,
+} from "./npm-update-cancel-origin.mjs";
+import {
+  cancellationRecord,
+  validateCancellation,
+  assertRecordedOperator,
+  verifyRecordedCancellation,
+} from "./npm-update-cancellation-proof.mjs";
+
+/** This pure topology function consumes already verified records; it grants no signature or provider authority. */
+export function selectSupersession(issues, records, proposal) {
+  required(
+    issues.length > 0 && issues.length <= 100,
+    "supersession inventory exceeds bound"
+  );
+  const keys = new Map(issues.map(issue => [issue.key, issue]));
+  required(keys.size === issues.length, "duplicate proposal keys");
+  const active = issues.filter(issue => issue.state === "open");
+  required(
+    active.length <= 1 && records.size === issues.length - active.length,
+    "unverified closure or multiple active proposals"
+  );
+  const incoming = new Set();
+  for (const issue of issues.filter(item => item.state !== "open")) {
+    const record = records.get(issue.number);
+    required(
+      issue.state === "closed" &&
+        issue.state_reason === "not_planned" &&
+        record?.oldProposalKey === issue.key &&
+        record.proposalKey !== issue.key &&
+        !incoming.has(record.proposalKey),
+      "invalid or forked cancellation chain"
+    );
+    incoming.add(record.proposalKey);
+  }
+  const roots = issues.filter(issue => !incoming.has(issue.key));
+  required(roots.length === 1, "disconnected or cyclic cancellation chain");
+  let cursor = roots[0],
+    count = 0,
+    last;
+  while (cursor.state === "closed") {
+    required(++count <= issues.length, "cyclic cancellation chain");
+    last = records.get(cursor.number);
+    cursor = keys.get(last.proposalKey);
+    if (!cursor) break;
+  }
+  required(
+    count === records.size && (!active.length || cursor === active[0]),
+    "disconnected cancellation chain"
+  );
+  if (cursor)
+    return {
+      status:
+        cursor.parent === proposal.parent ? "existing" : "stale-outstanding",
+      issue: cursor.issue ?? cursor,
+    };
+  required(
+    last?.proposalKey === proposal.key &&
+      last.parent === proposal.parent &&
+      canonicalJson(last.proposalHashes) === canonicalJson(proposal.hashes),
+    "cancelled replacement no longer matches; preserve the chain"
+  );
+  return { status: "new", supersession: last };
+}
+
+/** Both branch and every historical PR must actually be absent before cancellation or reuse. */
+export async function cancellationDestinationAbsent(api, proposalKey) {
+  required(
+    typeof proposalKey === "string" && /^[a-f0-9]{64}$/.test(proposalKey),
+    "invalid cancellation destination"
+  );
+  const branch = `lisa/npm-${proposalKey}`;
+  required(
+    (await api.maybe(
+      `repos/${api.policy.repository}/git/ref/heads/${branch}`
+    )) === null,
+    "published branch prevents cancellation"
+  );
+  const head = encodeURIComponent(
+    `${api.policy.repository.split("/")[0]}:${branch}`
+  );
+  const pulls = await api.list(
+    `repos/${api.policy.repository}/pulls?state=all&head=${head}`
+  );
+  required(pulls.length === 0, "published PR prevents cancellation");
+}
+
+/** Checkpoint discovery remains transport-only and refuses unknown complete roles. */
+function cancellationCheckpoint(issue) {
+  const checkpoints = completeCheckpoints(issue.comments);
+  for (const { payload } of checkpoints)
+    required(
+      payload.preview === null ||
+        payload.preview?.descriptor ||
+        payload.preview?.cancellation,
+      "unknown completed checkpoint role"
+    );
+  const matches = checkpoints.filter(
+    ({ payload }) => payload.preview?.cancellation
+  );
+  required(matches.length <= 1, "ambiguous completed cancellation records");
+  return matches[0];
+}
+
+/** Provider operator and official signature independently authenticate the complete historical subject. */
+async function verifyRecordedBundle(api, authority, checkpoint, record, issue) {
+  const run = await api.request(
+    `repos/${record.repository}/actions/runs/${record.runId}/attempts/${record.runAttempt}`
+  );
+  const permission = await api.request(
+    `repos/${record.repository}/collaborators/${record.maintainer}/permission`
+  );
+  assertRecordedOperator(run, permission, authority, record);
+  assertOriginTransport(issue.comments, checkpoint.digest, authority, run);
+  await withPrivateRoot(async root => {
+    const paths = {
+      cancellation: join(root, "cancellation.json"),
+      cancellationBundle: join(root, "bundle.json"),
+    };
+    writeJson(paths.cancellation, record);
+    required(
+      Buffer.byteLength(checkpoint.payload.bundle) <= 1_048_576,
+      "cancellation bundle exceeds bound"
+    );
+    writeFileSync(paths.cancellationBundle, checkpoint.payload.bundle, {
+      mode: 0o600,
+      flag: "wx",
+    });
+    verifyRecordedCancellation(
+      authority,
+      record,
+      paths,
+      checkpoint.digest,
+      run
+    );
+  });
+}
+
+/** A completion marker is only transport; original authority and a third fixed proof are independently required. */
+export async function recordedCancellation({
+  api,
+  cwd,
+  issue,
+  proposal,
+  config,
+  origin,
+}) {
+  const checkpoint = cancellationCheckpoint(issue);
+  if (!checkpoint) return undefined;
+  keys(checkpoint.payload.preview, ["cancellation"]);
+  const record = checkpoint.payload.preview.cancellation;
+  validateCancellation(record, record);
+  const historical = await committedCancellationConfig(cwd, record.parent);
+  const authority = historical.automationProvenance;
+  required(
+    [
+      "repository",
+      "repositoryId",
+      "ownerId",
+      "claimActorId",
+      "ghExecutable",
+      "ghSha256",
+    ].every(key => authority[key] === api.policy[key]) &&
+      historical.npmUpdater.maintainer === config.npmUpdater.maintainer,
+    "recorded cancellation authority differs"
+  );
+  const replacement = validateProposal(
+    checkpoint.payload.proposal,
+    historical.npmUpdater
+  );
+  required(
+    replacement.selectionKey === proposal.selectionKey,
+    "recorded cancellation selection differs"
+  );
+  const original =
+    origin ??
+    (await authenticateStaleOrigin({ api, cwd, issue, proposal, config }));
+  required(
+    canonicalJson(checkpoint.payload.allocation) ===
+      canonicalJson(original.allocation),
+    "recorded cancellation allocation differs"
+  );
+  const expected = cancellationRecord(
+    original,
+    replacement,
+    historical,
+    record,
+    record.operatorId
+  );
+  validateCancellation(record, expected);
+  required(
+    checkpoint.digest === sha256(`${canonicalJson(record)}\n`),
+    "cancellation subject digest differs"
+  );
+  await verifyRecordedBundle(api, authority, checkpoint, record, issue);
+  await api.main(proposal.parent);
+  await cancellationDestinationAbsent(api, record.oldProposalKey);
+  if (issue.state === "closed")
+    required(
+      issue.state_reason === "not_planned" &&
+        issue.closed_by?.type === "Bot" &&
+        String(issue.closed_by.id) === api.policy.claimActorId,
+      "closure is not the authenticated managed cancellation"
+    );
+  return checkpoint;
+}
+
+/** Every closed match must independently authenticate before a finite connected chain is accepted. */
+export async function discoverSupersession(
+  api,
+  proposal,
+  found,
+  { cwd, config }
+) {
+  required(
+    found.length > 0 && found.length <= 100,
+    "supersession search exceeds bound"
+  );
+  const issues = [],
+    records = new Map();
+  for (const item of found) {
+    const issue = await api.issue(item.number);
+    required(
+      !issue.pull_request && typeof issue.body === "string",
+      "foreign supersession issue"
+    );
+    const one = (name, pattern) => {
+      const values = [
+        ...issue.body.matchAll(new RegExp(`^${name}: (${pattern})$`, "gm")),
+      ];
+      required(values.length === 1, "ambiguous supersession identity");
+      return values[0][1];
+    };
+    required(
+      one("Selection key", "[a-f0-9]{64}") === proposal.selectionKey,
+      "supersession selection differs"
+    );
+    issues.push({
+      number: issue.number,
+      state: issue.state,
+      state_reason: issue.state_reason,
+      key: one("Proposal key", "[a-f0-9]{64}"),
+      parent: one("Base parent", "[a-f0-9]{40}"),
+      issue,
+    });
+    if (issue.state !== "open") {
+      const checkpoint = await recordedCancellation({
+        api,
+        cwd,
+        issue,
+        proposal,
+        config,
+      });
+      required(checkpoint, "closed leaf lacks authenticated cancellation");
+      records.set(issue.number, checkpoint.payload.preview.cancellation);
+    }
+  }
+  return selectSupersession(issues, records, proposal);
+}