@codyswann/lisa 4.84.6 → 4.84.8

package/all/copy-overwrite/scripts/lib/completion-proof-markdown.mjs

@@ -0,0 +1,70 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/** Bounded top-level boundaries; examples cannot become runtime declarations. */
+import { requireProof } from "./completion-proof-errors.mjs";
+
+/** Scan the same maximal fence run without ambiguous regex partitions. */
+function fenceMarker(line) {
+  let start = 0;
+  while (start < 3 && line[start] === " ") start += 1;
+  const character = line[start];
+  if (character !== "`" && character !== "~") return null;
+  let end = start;
+  while (line[end] === character) end += 1;
+  if (end - start < 3) return null;
+  const suffix = line.slice(end);
+  if (/[\r\n\u2028\u2029]/.test(suffix)) return null;
+  return [line, line.slice(start, end), suffix];
+}
+
+/** Retain original offsets while excluding fenced/indented examples and comments. */
+export function topLevelLines(body) {
+  const rows = [];
+  let fence = null;
+  let comment = false;
+  let start = 0;
+  for (const raw of body.split("\n")) {
+    const end = start + raw.length + (start + raw.length < body.length ? 1 : 0);
+    const line = raw.endsWith("\r") ? raw.slice(0, -1) : raw;
+    const marker = fenceMarker(line);
+    if (fence) {
+      if (
+        marker &&
+        marker[1][0] === fence.character &&
+        marker[1].length >= fence.length &&
+        !marker[2].trim()
+      )
+        fence = null;
+    } else if (comment) {
+      if (line.includes("-->")) comment = false;
+    } else if (marker && !(marker[1][0] === "`" && marker[2].includes("`"))) {
+      fence = { character: marker[1][0], length: marker[1].length };
+    } else if (/^ {0,3}<!--/.test(line) && !line.includes("-->")) {
+      comment = true;
+    } else if (!/^ {4}|^\t/.test(line)) {
+      rows.push({
+        text: line.trim(),
+        start,
+        end,
+        heading: /^ {0,3}##[ \t]+/.test(line),
+      });
+    }
+    start = end;
+  }
+  return rows;
+}
+
+/** Only actual top-level H2 sections participate in native declarations. */
+export function markdownSection(body, heading) {
+  const headings = topLevelLines(body).filter(row => row.heading);
+  const matches = headings.filter(row => row.text === `## ${heading}`);
+  requireProof(
+    matches.length <= 1,
+    `Duplicate ${heading} sections make completion requirements ambiguous.`
+  );
+  if (!matches.length) return "";
+  const selected = matches[0];
+  const next = headings.find(row => row.start > selected.start);
+  return body.slice(selected.end, next?.start ?? body.length).trim();
+}

package/all/copy-overwrite/scripts/lib/completion-proof-projection.mjs

@@ -0,0 +1,169 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/** Exclude only actual canonical accounting; retain unknown requirement text. */
+import { parseLisaUsageSection } from "./usage-ledger.mjs";
+import { verifyLisaUsageSectionIntegrity } from "./usage-ledger-integrity.mjs";
+import { requireProof } from "./completion-proof-errors.mjs";
+
+/** Stable presentation matching; this does not parse or authorize usage data. */
+const normalizedRow = line =>
+  line
+    .trim()
+    .split("|")
+    .map(part => part.trim())
+    .join("|");
+
+/** Match the canonical writer's visible table rows to the already parsed data. */
+function accountingRows(entries) {
+  const known = new Set([
+    "## Lisa Usage",
+    "_This section is managed by Lisa. Rewrites update matching usage entries in place and preserve older rows._",
+    "|Flow|Source|Model|Tokens|Cost|",
+    "|---|---|---|---:|---:|",
+    "|_No direct entries recorded_|||||",
+  ]);
+  for (const entry of entries) {
+    const tokens =
+      entry.totalTokens !== null
+        ? String(entry.totalTokens)
+        : entry.measuredSubsetTokens == null
+          ? "null"
+          : `${entry.measuredSubsetTokens} measured subset`;
+    const cost =
+      entry.cost === null
+        ? "null"
+        : entry.currency
+          ? `${entry.cost} ${entry.currency}`
+          : String(entry.cost);
+    known.add(
+      normalizedRow(
+        `| ${entry.flow} | ${entry.source} | ${entry.provider}/${entry.model} | ${tokens} | ${cost} |`
+      )
+    );
+  }
+  return known;
+}
+
+/** A known token must positively parse; a tag-shaped comment is insufficient. */
+function canonicalToken(token, section) {
+  if (token.startsWith("<!-- lisa:usage-entry "))
+    return (
+      parseLisaUsageSection(`## Lisa Usage\n${token}\n`).entries.length === 1
+    );
+  if (token.startsWith("<!-- lisa:usage-rollup "))
+    return parseLisaUsageSection(`## Lisa Usage\n${token}\n`).rollup !== null;
+  if (
+    token ===
+    "<!-- lisa:usage-rollup-token-status child_tokens_incomplete=true -->"
+  )
+    return true;
+  if (/^<!-- lisa:usage-effectiveness entry_id=\S+ data=\S+ -->$/.test(token))
+    return true;
+  const subset =
+    /^<!-- lisa:usage-entry-measured-subset entry_id=(\S+) measured_subset_tokens=(\S+) -->$/.exec(
+      token
+    );
+  return (
+    subset &&
+    section.entries.some(
+      row => encodeURIComponent(row.entryId) === subset[1]
+    ) &&
+    (subset[2] === "null" || Number.isFinite(Number(subset[2])))
+  );
+}
+
+/** Unknown prose/table rows within usage remain part of the full spec digest. */
+export function usageSpecRemainder(document) {
+  let parsed;
+  try {
+    parsed = parseLisaUsageSection(document);
+    requireProof(
+      verifyLisaUsageSectionIntegrity(document).ok,
+      "The canonical usage section is not an intact stored ledger."
+    );
+  } catch {
+    requireProof(
+      false,
+      "The canonical usage section is malformed; restore its actual accounting before completion."
+    );
+  }
+  const known = accountingRows(parsed.entries);
+  return document
+    .split(/(?<=\n)/)
+    .map(raw => {
+      const line = raw.replace(
+        /<!-- lisa:usage-(?:entry(?:-measured-subset)?|rollup(?:-token-status)?|effectiveness) [^\r\n]*? -->/g,
+        token => (canonicalToken(token, parsed) ? "" : token)
+      );
+      return !line.trim() || known.has(normalizedRow(line)) ? "" : line;
+    })
+    .join("");
+}
+
+/** Only a closed canonical metadata schema can be omitted from the primary spec. */
+export function canonicalCompletionBlock(name, payload) {
+  let value;
+  try {
+    value = JSON.parse(payload);
+  } catch {
+    return false;
+  }
+  if (
+    payload !== JSON.stringify(value) &&
+    payload !== JSON.stringify(value, null, 2)
+  )
+    return false;
+  if (
+    !value ||
+    typeof value !== "object" ||
+    Array.isArray(value) ||
+    value.schema_version !== 1
+  )
+    return false;
+  const digest = input =>
+    typeof input === "string" && /^[a-f0-9]{64}$/.test(input);
+  const id = input => Number.isSafeInteger(input) && input > 0;
+  const exact = fields =>
+    Object.keys(value).sort().join() === fields.sort().join();
+  if (name === "authorization")
+    return (
+      exact([
+        "schema_version",
+        "record_id",
+        "revision",
+        "repository",
+        "asset_id",
+        "sha256",
+      ]) &&
+      /^completion-[a-f0-9]{64}$/.test(value.record_id) &&
+      id(value.revision) &&
+      id(value.asset_id) &&
+      /^[\w.-]+\/[\w.-]+$/.test(value.repository) &&
+      digest(value.sha256)
+    );
+  return (
+    exact([
+      "schema_version",
+      "provider",
+      "ref",
+      "native_id",
+      "record_sha256",
+      "completed_at",
+      "state",
+    ]) &&
+    ["github", "linear"].includes(value.provider) &&
+    (value.provider === "github"
+      ? /^[\w.-]+\/[\w.-]+#[1-9]\d*$/.test(value.ref) &&
+        value.state === "CLOSED"
+      : /^[A-Z][A-Z0-9_]*-[1-9]\d*$/.test(value.ref) &&
+        value.state === "completed") &&
+    (id(value.native_id) ||
+      (typeof value.native_id === "string" &&
+        /^[\w:/#.-]{1,256}$/.test(value.native_id))) &&
+    digest(value.record_sha256) &&
+    typeof value.completed_at === "string" &&
+    value.completed_at.endsWith("Z") &&
+    Number.isFinite(Date.parse(value.completed_at))
+  );
+}

package/all/copy-overwrite/scripts/lib/completion-proof-publisher.mjs

@@ -0,0 +1,238 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/** Publish accepted/pending/revoked proof without performing a terminal transition. */
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+  CompletionProofError,
+  PROOF_KIND,
+  PROOF_MARKER,
+  MAX_RECORD_BYTES,
+  sha256,
+  primarySpecProjection,
+  requireProof,
+  validateRecordShape,
+  parseLocator,
+  isId,
+} from "./completion-proof-shape.mjs";
+import { githubProofTransport } from "./completion-proof-github.mjs";
+import { completionRecordId } from "./completion-proof-reader.mjs";
+import { evaluateAcceptedRecord } from "./completion-authorization.mjs";
+
+const READ_ERROR = "read-error";
+
+/** Recover the monotonic native index without treating old malformed proof as valid. */
+function previousLocator(
+  context,
+  comments,
+  transport,
+  repositoryId,
+  recordId,
+  trackerActor
+) {
+  const candidates = [];
+  for (const comment of comments) {
+    if (!comment.body?.startsWith(`${PROOF_MARKER}\n`)) continue;
+    const actor = comment.user ?? comment.author;
+    if (
+      context.provider === "github"
+        ? !transport.eligibleCommentAuthor(actor, repositoryId)
+        : String(actor?.id) !== trackerActor
+    )
+      continue;
+    let locator;
+    try {
+      locator = parseLocator(comment.body);
+    } catch {
+      continue;
+    }
+    if (
+      locator.repository === context.repository &&
+      locator.record_id === recordId
+    )
+      candidates.push(locator);
+  }
+  candidates.sort((left, right) => right.revision - left.revision);
+  return candidates[0] ?? null;
+}
+
+/** A candidate bot id is only a hint until native upload metadata confirms it. */
+function publisherIdentity(context, input, transport, repository) {
+  try {
+    const actor = JSON.parse(transport.call(["api", "user"]));
+    requireProof(
+      isId(actor.id) && actor.type === "User",
+      "The native publisher identity is unsupported."
+    );
+    return actor.id;
+  } catch (error) {
+    const id = input.producer?.github_actor_id;
+    const configured = (context.policy.automationPublishers ?? []).some(
+      row =>
+        row.user_id === id &&
+        row.repository_id === repository.id &&
+        row.type === "Bot"
+    );
+    if (!configured) {
+      const refusal = new CompletionProofError(
+        READ_ERROR,
+        "The publisher identity is unreadable and no explicit repository automation identity was configured."
+      );
+      refusal.cause = error;
+      throw refusal;
+    }
+    return id;
+  }
+}
+
+/** Strict immutable publication, followed by exact native readback and locator. */
+export function publishCompletionProof(context, input) {
+  const transport = githubProofTransport(
+    context.run,
+    context.repository,
+    context.policy
+  );
+  const repository = transport.json(transport.root);
+  const subject = {
+    ...context.readSubject(),
+    comments: context.readComments(),
+  };
+  const publisher = publisherIdentity(context, input, transport, repository);
+  const trackerActor = context.trackerActor(publisher);
+  requireProof(
+    trackerActor && trackerActor !== "undefined",
+    "The native tracker publisher identity could not be established."
+  );
+  const identity = {
+    provider: context.provider,
+    ref: context.ref,
+    scope: context.scope,
+    native_id: subject.native_id,
+  };
+  const recordId = completionRecordId(identity);
+  const previous = previousLocator(
+    context,
+    subject.comments,
+    transport,
+    repository.id,
+    recordId,
+    trackerActor
+  );
+  const record = {
+    ...input,
+    schema_version: 1,
+    kind: PROOF_KIND,
+    record_id: recordId,
+    revision: previous ? previous.revision + 1 : 1,
+    supersedes: previous?.sha256 ?? null,
+    captured_at: new Date().toISOString(),
+    subject: identity,
+    producer: {
+      ...input.producer,
+      github_actor_id: publisher,
+      tracker_actor_id: trackerActor,
+    },
+    repository: { name: context.repository, id: repository.id },
+    environment: context.environment,
+    branch: context.branch,
+    spec_sha256: sha256(primarySpecProjection(subject.body)),
+  };
+  validateRecordShape(record);
+  if (record.state === "accepted-for-completion")
+    evaluateAcceptedRecord({ record }, context, subject, transport);
+  const bytes = Buffer.from(`${JSON.stringify(record, null, 2)}\n`);
+  requireProof(
+    bytes.length <= MAX_RECORD_BYTES,
+    "The completion record exceeds its bounded publication size."
+  );
+  const digest = sha256(bytes);
+  const name = `${recordId}-r${record.revision}-${digest}.json`;
+  const temporary = mkdtempSync(join(tmpdir(), "lisa-completion-proof-"));
+  try {
+    mkdirSync(temporary, { recursive: true });
+    const file = join(temporary, name);
+    writeFileSync(file, bytes);
+    const uploaded = context.run(
+      "gh",
+      ["release", "upload", "pr-assets", file, "--repo", context.repository],
+      { allowFailure: true }
+    );
+    requireProof(
+      uploaded.status === 0 && !uploaded.error,
+      "Immutable completion-proof upload failed; no acceptance locator was published.",
+      "write-error"
+    );
+    const release = transport.json(`${transport.root}/releases/tags/pr-assets`);
+    const pages = transport.json(
+      `${transport.root}/releases/${release.id}/assets?per_page=100`,
+      true
+    );
+    requireProof(
+      pages.every(Array.isArray),
+      "The native completion-asset listing is incomplete.",
+      READ_ERROR
+    );
+    const matching = pages.flat().filter(asset => asset.name === name);
+    requireProof(
+      matching.length === 1,
+      "The uploaded completion asset cannot be uniquely read back.",
+      READ_ERROR
+    );
+    const stored = transport.asset(matching[0].id, MAX_RECORD_BYTES);
+    requireProof(
+      stored.bytes.equals(bytes) &&
+        sha256(stored.bytes) === digest &&
+        stored.metadata.uploader?.id === publisher,
+      "The native uploaded acceptance bytes or publisher differ from the producer's record."
+    );
+    const publisherState = transport.trustedPublisher(stored.metadata, record, {
+      publishing: true,
+    });
+    // Recheck native scope after upload; do not publish acceptance for changed requirements.
+    const fresh = {
+      ...context.readSubject(),
+      comments: context.readComments(),
+    };
+    requireProof(
+      sha256(primarySpecProjection(fresh.body)) === record.spec_sha256,
+      "Requirements changed during proof publication; no locator was written.",
+      "pending-proof"
+    );
+    if (record.state === "accepted-for-completion")
+      evaluateAcceptedRecord({ record }, context, fresh, transport);
+    const locator = {
+      schema_version: 1,
+      record_id: recordId,
+      revision: record.revision,
+      repository: context.repository,
+      asset_id: stored.metadata.id,
+      sha256: digest,
+    };
+    const body = `${PROOF_MARKER}\n${JSON.stringify(locator)}`;
+    const comment = context.postLocator(body, subject.native_id);
+    const readback = context
+      .readComments()
+      .find(row => String(row.id) === String(comment.id));
+    requireProof(
+      readback?.body === body &&
+        String((readback.user ?? readback.author)?.id) === trackerActor,
+      "The native completion locator or publisher did not read back exactly.",
+      "write-error"
+    );
+    const deferredProducer = !publisherState.ready;
+    return {
+      category: deferredProducer ? "published/pending-producer" : "published",
+      record_id: recordId,
+      revision: record.revision,
+      asset_id: stored.metadata.id,
+      sha256: digest,
+      comment_id: comment.id,
+      ref: context.ref,
+      terminal_mutation: false,
+    };
+  } finally {
+    rmSync(temporary, { recursive: true, force: true });
+  }
+}

package/all/copy-overwrite/scripts/lib/completion-proof-reader.mjs

@@ -0,0 +1,175 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/** Discover immutable proof through native, attributable locator revisions. */
+import {
+  CompletionProofError,
+  PROOF_MARKER,
+  MAX_RECORD_BYTES,
+  sha256,
+  parseLocator,
+  requireProof,
+  validateRecordShape,
+  isObject,
+} from "./completion-proof-shape.mjs";
+
+/** Stable identity cannot be reset to replay a revoked item's older record. */
+export function completionRecordId(subject) {
+  return `completion-${sha256([subject.provider, subject.scope, subject.ref].join("\0"))}`;
+}
+
+/** Native timestamps and identifiers, not caller-supplied capture times. */
+function order(comment) {
+  const time = Date.parse(
+    comment.updated_at ??
+      comment.updatedAt ??
+      comment.created_at ??
+      comment.createdAt
+  );
+  requireProof(
+    Number.isFinite(time),
+    "A native completion locator has no usable revision timestamp."
+  );
+  return time;
+}
+
+/** A marker alone, an anonymous comment or an issue edit is never authority. */
+export function readTrustedRecord(context, subject, transport) {
+  const comments = context
+    .readComments()
+    .filter(row => row.body?.startsWith(`${PROOF_MARKER}\n`));
+  const repository = transport.json(transport.root);
+  const observations = [];
+  const trustedLinearActors = new Set();
+  for (const comment of comments) {
+    const actor = comment.user ?? comment.author;
+    const trustedNativeActor =
+      context.provider === "github"
+        ? transport.eligibleCommentAuthor(actor, repository.id)
+        : false;
+    if (context.provider === "github" && !trustedNativeActor) continue;
+    let observation;
+    let locator;
+    try {
+      locator = parseLocator(comment.body);
+      requireProof(
+        locator.repository === context.repository,
+        "The proof locator selected another implementation repository."
+      );
+      const asset = transport.asset(locator.asset_id, MAX_RECORD_BYTES);
+      requireProof(
+        sha256(asset.bytes) === locator.sha256,
+        "The accepted record's actual bytes no longer match its locator digest."
+      );
+      let record;
+      try {
+        record = JSON.parse(asset.bytes.toString("utf8"));
+      } catch {
+        throw new CompletionProofError(
+          "invalid-proof",
+          "The completion record attachment is not readable JSON."
+        );
+      }
+      requireProof(
+        isObject(record) &&
+          isObject(record.producer) &&
+          record.producer.github_actor_id === asset.metadata.uploader?.id,
+        "The completion record publisher differs from the asset's native uploader."
+      );
+      transport.trustedPublisher(
+        asset.metadata,
+        { ...record, repository },
+        { identityOnly: true }
+      );
+      if (context.provider === "linear") {
+        if (String(record.producer.tracker_actor_id) !== String(actor?.id))
+          continue;
+        trustedLinearActors.add(String(actor.id));
+      } else
+        requireProof(
+          record.producer.github_actor_id === actor.id,
+          "The managed locator was not published by the record's native publisher."
+        );
+      validateRecordShape(record);
+      transport.trustedPublisher(asset.metadata, record);
+      requireProof(
+        record.subject.provider === context.provider &&
+          record.subject.ref === context.ref &&
+          String(record.subject.native_id) === String(subject.native_id) &&
+          record.subject.scope === context.scope &&
+          record.record_id === completionRecordId(record.subject) &&
+          record.repository.id === repository.id &&
+          record.repository.name === context.repository &&
+          record.revision === locator.revision &&
+          record.record_id === locator.record_id,
+        "The accepted proof belongs to another work item, native scope, repository or revision."
+      );
+      observation = { comment, locator, record, metadata: asset.metadata };
+    } catch (error) {
+      observation = { comment, locator, error };
+    }
+    observations.push(observation);
+  }
+  const trusted = observations.filter(
+    row =>
+      context.provider === "github" ||
+      trustedLinearActors.has(
+        String((row.comment.user ?? row.comment.author)?.id)
+      )
+  );
+  trusted.sort(
+    (left, right) =>
+      order(right.comment) - order(left.comment) ||
+      (right.locator?.revision ?? 0) - (left.locator?.revision ?? 0) ||
+      Number(right.comment.id || 0) - Number(left.comment.id || 0)
+  );
+  if (trusted.length === 0) return null;
+  const chosen = trusted[0];
+  if (chosen.error) throw chosen.error;
+  const older = trusted.slice(1).filter(row => row.locator);
+  requireProof(
+    !older.some(
+      row =>
+        row.locator.revision > chosen.record.revision ||
+        (row.locator.revision === chosen.record.revision &&
+          row.locator.sha256 !== chosen.locator.sha256)
+    ),
+    "The latest trusted locator attempts to roll back or conflict with a newer proof revision."
+  );
+  if (chosen.record.revision > 1)
+    requireProof(
+      older.some(
+        row =>
+          row.locator.revision === chosen.record.revision - 1 &&
+          row.locator.sha256 === chosen.record.supersedes
+      ),
+      "The completion proof revision does not extend its trusted immutable predecessor."
+    );
+  return { ...chosen, history: locatorHistoryFingerprint(comments) };
+}
+
+/** Detect a concurrent locator edit locally after the final authoritative read. */
+export function locatorHistoryFingerprint(comments) {
+  const markers = comments
+    .filter(row => row.body?.startsWith(`${PROOF_MARKER}\n`))
+    .map(row => ({
+      id: String(row.id),
+      body: row.body,
+      actor: (row.user ?? row.author)?.id,
+      updated:
+        row.updated_at ?? row.updatedAt ?? row.created_at ?? row.createdAt,
+    }))
+    .sort((left, right) => left.id.localeCompare(right.id));
+  return sha256(JSON.stringify(markers));
+}
+
+/** A native pointer revision is re-read independently before the first write. */
+export function recordFingerprint(chosen) {
+  return JSON.stringify({
+    id: chosen.comment.id,
+    updated: order(chosen.comment),
+    asset: chosen.locator.asset_id,
+    sha256: chosen.locator.sha256,
+    revision: chosen.record.revision,
+  });
+}