@codyswann/lisa 4.71.2 → 4.71.3

package/all/copy-overwrite/scripts/lib/npm-update-cancellation.mjs

@@ -0,0 +1,248 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/** Explicit hosted manual cancellation preserves the old leaf and issues no publication authority. */
+import { join } from "node:path";
+import { writeFileSync } from "node:fs";
+import { canonicalJson } from "../lisa-automation-provenance.mjs";
+import { required, keys } from "./npm-update-contract.mjs";
+import { readBytes, readJson, writeJson } from "./npm-update-process.mjs";
+import { assertHostedGate } from "./npm-update-hosted-gate.mjs";
+import { sha256 } from "./github-attestation-verifier.mjs";
+import { discoverPrior } from "./npm-update-allocate.mjs";
+import { authenticateStaleOrigin } from "./npm-update-cancel-origin.mjs";
+import {
+  recordedCancellation,
+  cancellationDestinationAbsent,
+} from "./npm-update-supersession.mjs";
+import {
+  assertManualCancellation,
+  cancellationRecord,
+  validateCancellation,
+  verifyCancellationAttestation,
+} from "./npm-update-cancellation-proof.mjs";
+import {
+  persistCheckpoint,
+  decodeCheckpoint,
+} from "./npm-update-checkpoint.mjs";
+import { withStage } from "./npm-update-invariants.mjs";
+
+/** Native dispatch bytes are checked independently of reusable workflow input forwarding. */
+export function assertDispatchCancellation(event, run, request, authority) {
+  required(
+    event &&
+      ["main", "refs/heads/main"].includes(event.ref) &&
+      event.repository?.full_name === authority.repository &&
+      String(event.repository.id) === authority.repositoryId &&
+      String(event.repository.owner?.id) === authority.ownerId &&
+      event.sender?.type === "User" &&
+      event.sender.id === run.triggering_actor?.id &&
+      event.sender.login === run.triggering_actor.login &&
+      event.inputs?.cancel_issue === String(request.number) &&
+      event.inputs.cancel_proposal_key === request.proposalKey &&
+      event.inputs.cancel_expected_main === request.parent,
+    "native manual dispatch intent differs"
+  );
+}
+
+/** The actual run and repository permission are read through the existing pinned default-token transport. */
+async function manualAuthority(api, proposal, config, request) {
+  assertHostedGate({ policy: config.npmUpdater, proposal, config });
+  const invocation = {
+    runId: process.env.GITHUB_RUN_ID,
+    runAttempt: process.env.GITHUB_RUN_ATTEMPT,
+  };
+  required(
+    Object.values(invocation).every(
+      value => typeof value === "string" && /^[1-9]\d*$/.test(value)
+    ),
+    "native cancellation invocation is absent"
+  );
+  await api.main(proposal.parent);
+  const run = await api.request(
+    `repos/${proposal.repository}/actions/runs/${invocation.runId}/attempts/${invocation.runAttempt}`
+  );
+  const permission = await api.request(
+    `repos/${proposal.repository}/collaborators/${config.npmUpdater.maintainer}/permission`
+  );
+  const operatorId = assertManualCancellation(
+    run,
+    permission,
+    api.policy,
+    config.npmUpdater.maintainer,
+    proposal,
+    request,
+    invocation
+  );
+  const event = JSON.parse(
+    new TextDecoder("utf8", { fatal: true }).decode(
+      readBytes(process.env.GITHUB_EVENT_PATH, 1_048_576, false)
+    )
+  );
+  assertDispatchCancellation(event, run, request, api.policy);
+  return { invocation, operatorId };
+}
+
+/** Named stale origins are never substituted by a closed implementation ticket or another active leaf. */
+async function cancellationState(context) {
+  const { api, cwd, proposal, config, request } = context;
+  const manual = await withStage("cancel-intent", () =>
+    manualAuthority(api, proposal, config, request)
+  );
+  const prior = await discoverPrior(api, proposal, { cwd, config });
+  const issue = await api.issue(request.number);
+  const origin = await withStage("cancel-origin", () =>
+    authenticateStaleOrigin({ api, cwd, issue, proposal, config })
+  );
+  required(
+    origin.proposal.key === request.proposalKey,
+    "named original proposal differs"
+  );
+  await cancellationDestinationAbsent(api, request.proposalKey);
+  const recorded = await recordedCancellation({
+    api,
+    cwd,
+    issue,
+    proposal,
+    config,
+    origin,
+  });
+  if (recorded) {
+    const record = recorded.payload.preview.cancellation;
+    required(
+      record.parent === proposal.parent &&
+        record.proposalKey === proposal.key &&
+        canonicalJson(record.proposalHashes) === canonicalJson(proposal.hashes),
+      "recorded replacement no longer matches"
+    );
+  } else
+    required(
+      issue.state === "open" &&
+        prior.status === "stale-outstanding" &&
+        prior.issue.number === request.number,
+      "only the active stale origin can be cancelled"
+    );
+  return { ...manual, issue, origin, recorded };
+}
+
+/** Preparation writes only a private prospective subject, never a provider lifecycle mutation. */
+export async function prepareCancellation(context) {
+  const { output, proposal, config, request } = context;
+  const state = await cancellationState(context);
+  const record =
+    state.recorded?.payload.preview.cancellation ??
+    cancellationRecord(
+      state.origin,
+      proposal,
+      config,
+      state.invocation,
+      state.operatorId
+    );
+  validateCancellation(record, record);
+  writeJson(join(output, "cancellation.json"), record);
+  const mode = state.recorded ? "recorded" : "fresh";
+  if (state.recorded) {
+    const bytes = Buffer.from(state.recorded.payload.bundle);
+    required(bytes.length <= 1_048_576, "cancellation bundle exceeds bound");
+    writeFileSync(join(output, "cancellation-bundle.json"), bytes, {
+      mode: 0o600,
+      flag: "wx",
+    });
+  }
+  writeJson(join(output, "cancellation-state.json"), { mode, request });
+  return { mode };
+}
+
+/** Each chunk and closure rechecks current operator, main, holds, destination and immutable subject. */
+async function authorizeCancellation(context, record, paths, state) {
+  const current = await cancellationState(context);
+  if (state.mode === "fresh") {
+    validateCancellation(
+      record,
+      cancellationRecord(
+        current.origin,
+        context.proposal,
+        context.config,
+        current.invocation,
+        current.operatorId
+      )
+    );
+    verifyCancellationAttestation(
+      context.api.policy,
+      record,
+      paths,
+      sha256(readBytes(paths.cancellation, 65_536))
+    );
+  } else
+    required(
+      state.mode === "recorded" &&
+        current.recorded &&
+        canonicalJson(current.recorded.payload.preview.cancellation) ===
+          canonicalJson(record),
+      "recorded cancellation authority differs"
+    );
+  return current;
+}
+
+/** Durable proof precedes a not_planned close; interruptions retain all evidence for the next manual run. */
+export async function finalizeCancellation(context) {
+  const { api, output, proposal, request } = context;
+  const state = readJson(join(output, "cancellation-state.json"), 65_536);
+  keys(state, ["mode", "request"]);
+  required(
+    canonicalJson(state.request) === canonicalJson(request),
+    "cancellation intent changed"
+  );
+  const paths = {
+    cancellation: join(output, "cancellation.json"),
+    cancellationBundle: join(output, "cancellation-bundle.json"),
+  };
+  const record = readJson(paths.cancellation, 65_536);
+  const digest = sha256(readBytes(paths.cancellation, 65_536));
+  const current = await authorizeCancellation(context, record, paths, state);
+  const payload = current.recorded?.payload ?? {
+    version: 1,
+    proposal,
+    allocation: current.origin.allocation,
+    preview: { cancellation: record },
+    bundle: readBytes(paths.cancellationBundle, 1_048_576).toString("utf8"),
+  };
+  if (!current.recorded)
+    await withStage("cancel-checkpoint", () =>
+      persistCheckpoint(api, request.number, payload, digest, () =>
+        authorizeCancellation(context, record, paths, state)
+      )
+    );
+  const issue = (await authorizeCancellation(context, record, paths, state))
+    .issue;
+  required(
+    canonicalJson(decodeCheckpoint(issue.comments, digest)) ===
+      canonicalJson(payload),
+    "durable cancellation checkpoint differs"
+  );
+  if (issue.state === "open")
+    await withStage("cancel-close", () =>
+      api.request(
+        `repos/${proposal.repository}/issues/${request.number}`,
+        "PATCH",
+        { state: "closed", state_reason: "not_planned" }
+      )
+    );
+  const closed = await api.issue(request.number);
+  required(
+    closed.state === "closed" &&
+      closed.state_reason === "not_planned" &&
+      closed.closed_by?.type === "Bot" &&
+      String(closed.closed_by.id) === api.policy.claimActorId &&
+      closed.body === issue.body &&
+      closed.title === issue.title,
+    "cancellation closure readback differs"
+  );
+  await api.main(proposal.parent);
+  await cancellationDestinationAbsent(api, request.proposalKey);
+  return {
+    status: "cancelled",
+    number: request.number,
+    cancellationSha256: digest,
+  };
+}

package/all/copy-overwrite/scripts/lib/npm-update-helper-inventory.mjs

@@ -42,6 +42,9 @@ const PRODUCER = [
   "allocate",
   "authorization",
   "broker-client",
+  "cancel-origin",
+  "cancellation",
+  "cancellation-proof",
   "checkpoint",
   "contract",
   "controller-broker",
@@ -81,6 +84,7 @@ const PRODUCER = [
   "publish",
   "quality",
   "recovery",
+  "supersession",
   "runtime-archive",
   "runtime-graph",
   "runtime-transport",

package/all/copy-overwrite/scripts/lib/npm-update-invariants.mjs

@@ -4,6 +4,10 @@
 /** Pure shared diagnostics retain one error identity without importing producer orchestration. */
 const stages = new Set([
   "configuration",
+  "cancel-intent",
+  "cancel-origin",
+  "cancel-checkpoint",
+  "cancel-close",
   "gate-input",
   "gate-validate",
   "gate-scratch",

package/all/copy-overwrite/scripts/lib/npm-update-leaf-contract.mjs

@@ -142,7 +142,7 @@ Git history command: ${evidence.history.command}
 Git history outcome: ${evidence.history.result}
 All-state GitHub query: ${evidence.search.query}
 Outcome: every matching record was loaded completely; unrelated work was preserved and exact proposal recovery was checked separately.
-Matches are read completely before allocating this deterministic proposal. No parent or PRD lineage is declared; this build-ready standalone Task is one leaf.
+Matches are read completely before allocating this deterministic proposal. No parent or PRD lineage is declared; this build-ready standalone Task is one leaf.${evidence.supersession ? `\nSupersedes cancelled proposal ${evidence.supersession.workItem}. Original proposal key: ${evidence.supersession.proposalKey}. Verified cancellation SHA256: ${evidence.supersession.cancellationSha256}. The previous claim, specification and checkpoint are preserved; this leaf has fresh parent-bound authority.` : ""}
 
 ## Validation Journey
 

package/all/copy-overwrite/scripts/lib/npm-update-leaf.mjs

@@ -82,12 +82,29 @@ export async function claimLeaf(
 
 /** Complete provider history and immutable human policy govern every mutation. */
 export async function inspectLeaf(issue, draft, policy, config) {
-  const roles = leafRoles(config, policy.repository);
-  const labels = issue.labels.map(label => label.name);
   required(
     issue.state === "open" && !issue.pull_request && issue.number > 0,
     "closed or nonissue leaf"
   );
+  return inspectLeafFields(issue, draft, policy, config);
+}
+
+/** Closed-state inspection never grants authority without a separately verified cancellation. */
+export async function inspectCancelledLeaf(issue, draft, policy, config) {
+  required(
+    issue.state === "closed" &&
+      issue.state_reason === "not_planned" &&
+      !issue.pull_request &&
+      issue.number > 0,
+    "leaf is not explicitly cancelled"
+  );
+  return inspectLeafFields(issue, draft, policy, config);
+}
+
+/** Both fixed state entry points preserve the original complete ownership and hold checks. */
+async function inspectLeafFields(issue, draft, policy, config) {
+  const roles = leafRoles(config, policy.repository);
+  const labels = issue.labels.map(label => label.name);
   required(
     issue.children.length === 0 &&
       issue.blockers.every(item => item.state === "closed"),
@@ -151,7 +168,16 @@ export function historicalFiling(issue) {
   const value = JSON.parse(
     new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes)
   );
-  keys(value, ["history", "search", "registry", "labels", "main"]);
+  keys(value, [
+    "history",
+    "search",
+    "registry",
+    "labels",
+    "main",
+    ...(value.supersession ? ["supersession"] : []),
+  ]);
+  if (value.supersession)
+    keys(value.supersession, ["workItem", "cancellationSha256", "proposalKey"]);
   required(
     canonicalJson(value) === bytes.toString("utf8"),
     "original filing fields are noncanonical"

package/all/copy-overwrite/scripts/lib/npm-update-supersession.mjs

@@ -0,0 +1,274 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/** Authenticated cancellation chains remain finite, exact and separate from ordinary recovery. */
+import { canonicalJson } from "../lisa-automation-provenance.mjs";
+import { required } from "./npm-update-contract.mjs";
+import { validateProposal, keys } from "./npm-update-contract.mjs";
+import { join } from "node:path";
+import { writeFileSync } from "node:fs";
+import { writeJson, withPrivateRoot } from "./npm-update-process.mjs";
+import { sha256 } from "./github-attestation-verifier.mjs";
+import {
+  completeCheckpoints,
+  committedCancellationConfig,
+  authenticateStaleOrigin,
+  assertOriginTransport,
+} from "./npm-update-cancel-origin.mjs";
+import {
+  cancellationRecord,
+  validateCancellation,
+  assertRecordedOperator,
+  verifyRecordedCancellation,
+} from "./npm-update-cancellation-proof.mjs";
+
+/** This pure topology function consumes already verified records; it grants no signature or provider authority. */
+export function selectSupersession(issues, records, proposal) {
+  required(
+    issues.length > 0 && issues.length <= 100,
+    "supersession inventory exceeds bound"
+  );
+  const keys = new Map(issues.map(issue => [issue.key, issue]));
+  required(keys.size === issues.length, "duplicate proposal keys");
+  const active = issues.filter(issue => issue.state === "open");
+  required(
+    active.length <= 1 && records.size === issues.length - active.length,
+    "unverified closure or multiple active proposals"
+  );
+  const incoming = new Set();
+  for (const issue of issues.filter(item => item.state !== "open")) {
+    const record = records.get(issue.number);
+    required(
+      issue.state === "closed" &&
+        issue.state_reason === "not_planned" &&
+        record?.oldProposalKey === issue.key &&
+        record.proposalKey !== issue.key &&
+        !incoming.has(record.proposalKey),
+      "invalid or forked cancellation chain"
+    );
+    incoming.add(record.proposalKey);
+  }
+  const roots = issues.filter(issue => !incoming.has(issue.key));
+  required(roots.length === 1, "disconnected or cyclic cancellation chain");
+  let cursor = roots[0],
+    count = 0,
+    last;
+  while (cursor.state === "closed") {
+    required(++count <= issues.length, "cyclic cancellation chain");
+    last = records.get(cursor.number);
+    cursor = keys.get(last.proposalKey);
+    if (!cursor) break;
+  }
+  required(
+    count === records.size && (!active.length || cursor === active[0]),
+    "disconnected cancellation chain"
+  );
+  if (cursor)
+    return {
+      status:
+        cursor.parent === proposal.parent ? "existing" : "stale-outstanding",
+      issue: cursor.issue ?? cursor,
+    };
+  required(
+    last?.proposalKey === proposal.key &&
+      last.parent === proposal.parent &&
+      canonicalJson(last.proposalHashes) === canonicalJson(proposal.hashes),
+    "cancelled replacement no longer matches; preserve the chain"
+  );
+  return { status: "new", supersession: last };
+}
+
+/** Both branch and every historical PR must actually be absent before cancellation or reuse. */
+export async function cancellationDestinationAbsent(api, proposalKey) {
+  required(
+    typeof proposalKey === "string" && /^[a-f0-9]{64}$/.test(proposalKey),
+    "invalid cancellation destination"
+  );
+  const branch = `lisa/npm-${proposalKey}`;
+  required(
+    (await api.maybe(
+      `repos/${api.policy.repository}/git/ref/heads/${branch}`
+    )) === null,
+    "published branch prevents cancellation"
+  );
+  const head = encodeURIComponent(
+    `${api.policy.repository.split("/")[0]}:${branch}`
+  );
+  const pulls = await api.list(
+    `repos/${api.policy.repository}/pulls?state=all&head=${head}`
+  );
+  required(pulls.length === 0, "published PR prevents cancellation");
+}
+
+/** Checkpoint discovery remains transport-only and refuses unknown complete roles. */
+function cancellationCheckpoint(issue) {
+  const checkpoints = completeCheckpoints(issue.comments);
+  for (const { payload } of checkpoints)
+    required(
+      payload.preview === null ||
+        payload.preview?.descriptor ||
+        payload.preview?.cancellation,
+      "unknown completed checkpoint role"
+    );
+  const matches = checkpoints.filter(
+    ({ payload }) => payload.preview?.cancellation
+  );
+  required(matches.length <= 1, "ambiguous completed cancellation records");
+  return matches[0];
+}
+
+/** Provider operator and official signature independently authenticate the complete historical subject. */
+async function verifyRecordedBundle(api, authority, checkpoint, record, issue) {
+  const run = await api.request(
+    `repos/${record.repository}/actions/runs/${record.runId}/attempts/${record.runAttempt}`
+  );
+  const permission = await api.request(
+    `repos/${record.repository}/collaborators/${record.maintainer}/permission`
+  );
+  assertRecordedOperator(run, permission, authority, record);
+  assertOriginTransport(issue.comments, checkpoint.digest, authority, run);
+  await withPrivateRoot(async root => {
+    const paths = {
+      cancellation: join(root, "cancellation.json"),
+      cancellationBundle: join(root, "bundle.json"),
+    };
+    writeJson(paths.cancellation, record);
+    required(
+      Buffer.byteLength(checkpoint.payload.bundle) <= 1_048_576,
+      "cancellation bundle exceeds bound"
+    );
+    writeFileSync(paths.cancellationBundle, checkpoint.payload.bundle, {
+      mode: 0o600,
+      flag: "wx",
+    });
+    verifyRecordedCancellation(
+      authority,
+      record,
+      paths,
+      checkpoint.digest,
+      run
+    );
+  });
+}
+
+/** A completion marker is only transport; original authority and a third fixed proof are independently required. */
+export async function recordedCancellation({
+  api,
+  cwd,
+  issue,
+  proposal,
+  config,
+  origin,
+}) {
+  const checkpoint = cancellationCheckpoint(issue);
+  if (!checkpoint) return undefined;
+  keys(checkpoint.payload.preview, ["cancellation"]);
+  const record = checkpoint.payload.preview.cancellation;
+  validateCancellation(record, record);
+  const historical = await committedCancellationConfig(cwd, record.parent);
+  const authority = historical.automationProvenance;
+  required(
+    [
+      "repository",
+      "repositoryId",
+      "ownerId",
+      "claimActorId",
+      "ghExecutable",
+      "ghSha256",
+    ].every(key => authority[key] === api.policy[key]) &&
+      historical.npmUpdater.maintainer === config.npmUpdater.maintainer,
+    "recorded cancellation authority differs"
+  );
+  const replacement = validateProposal(
+    checkpoint.payload.proposal,
+    historical.npmUpdater
+  );
+  required(
+    replacement.selectionKey === proposal.selectionKey,
+    "recorded cancellation selection differs"
+  );
+  const original =
+    origin ??
+    (await authenticateStaleOrigin({ api, cwd, issue, proposal, config }));
+  required(
+    canonicalJson(checkpoint.payload.allocation) ===
+      canonicalJson(original.allocation),
+    "recorded cancellation allocation differs"
+  );
+  const expected = cancellationRecord(
+    original,
+    replacement,
+    historical,
+    record,
+    record.operatorId
+  );
+  validateCancellation(record, expected);
+  required(
+    checkpoint.digest === sha256(`${canonicalJson(record)}\n`),
+    "cancellation subject digest differs"
+  );
+  await verifyRecordedBundle(api, authority, checkpoint, record, issue);
+  await api.main(proposal.parent);
+  await cancellationDestinationAbsent(api, record.oldProposalKey);
+  if (issue.state === "closed")
+    required(
+      issue.state_reason === "not_planned" &&
+        issue.closed_by?.type === "Bot" &&
+        String(issue.closed_by.id) === api.policy.claimActorId,
+      "closure is not the authenticated managed cancellation"
+    );
+  return checkpoint;
+}
+
+/** Every closed match must independently authenticate before a finite connected chain is accepted. */
+export async function discoverSupersession(
+  api,
+  proposal,
+  found,
+  { cwd, config }
+) {
+  required(
+    found.length > 0 && found.length <= 100,
+    "supersession search exceeds bound"
+  );
+  const issues = [],
+    records = new Map();
+  for (const item of found) {
+    const issue = await api.issue(item.number);
+    required(
+      !issue.pull_request && typeof issue.body === "string",
+      "foreign supersession issue"
+    );
+    const one = (name, pattern) => {
+      const values = [
+        ...issue.body.matchAll(new RegExp(`^${name}: (${pattern})$`, "gm")),
+      ];
+      required(values.length === 1, "ambiguous supersession identity");
+      return values[0][1];
+    };
+    required(
+      one("Selection key", "[a-f0-9]{64}") === proposal.selectionKey,
+      "supersession selection differs"
+    );
+    issues.push({
+      number: issue.number,
+      state: issue.state,
+      state_reason: issue.state_reason,
+      key: one("Proposal key", "[a-f0-9]{64}"),
+      parent: one("Base parent", "[a-f0-9]{40}"),
+      issue,
+    });
+    if (issue.state !== "open") {
+      const checkpoint = await recordedCancellation({
+        api,
+        cwd,
+        issue,
+        proposal,
+        config,
+      });
+      required(checkpoint, "closed leaf lacks authenticated cancellation");
+      records.set(issue.number, checkpoint.payload.preview.cancellation);
+    }
+  }
+  return selectSupersession(issues, records, proposal);
+}