@danielblomma/cortex-mcp 2.0.15 → 2.0.18

package/scaffold/mcp/src/core/workflow/resolution.ts

@@ -0,0 +1,113 @@
+import { DEFAULT_WORKFLOWS } from "./default-workflows.js";
+import { loadSyncedWorkflows } from "./synced-registry.js";
+import type { WorkflowDefinition } from "./schemas.js";
+
+export type WorkflowSource = "bundled" | "synced" | "injected";
+
+export type WorkflowResolutionWarning = {
+  code: "bundled-workflow-fallback";
+  workflow_id: string;
+  message: string;
+  bundled_available: boolean;
+  synced_available: boolean;
+};
+
+export type WorkflowResolution = {
+  workflow: WorkflowDefinition;
+  source: WorkflowSource;
+  warnings: WorkflowResolutionWarning[];
+  bundled_ids: string[];
+  synced_ids: string[];
+  available_ids: string[];
+};
+
+type ResolveWorkflowOptions = {
+  registry?: Record<string, WorkflowDefinition>;
+  syncedDir?: string;
+  emitBundledFallbackWarning?: boolean;
+  bundledFallbackPolicy?: "allow" | "warn" | "block";
+};
+
+function sortIds(ids: Iterable<string>): string[] {
+  return [...ids].sort((left, right) => left.localeCompare(right));
+}
+
+function formatIds(ids: string[]): string {
+  return ids.length > 0 ? ids.join(", ") : "<none>";
+}
+
+export function resolveWorkflowDefinition(
+  workflowId: string,
+  options: ResolveWorkflowOptions = {},
+): WorkflowResolution {
+  if (options.registry) {
+    const availableIds = sortIds(Object.keys(options.registry));
+    const workflow = options.registry[workflowId];
+    if (!workflow) {
+      throw new Error(
+        `Unknown workflow_id: ${workflowId}. Available injected: ${formatIds(availableIds)}`,
+      );
+    }
+    return {
+      workflow,
+      source: "injected",
+      warnings: [],
+      bundled_ids: [],
+      synced_ids: [],
+      available_ids: availableIds,
+    };
+  }
+
+  const bundled = DEFAULT_WORKFLOWS;
+  const synced = loadSyncedWorkflows(options.syncedDir);
+  const bundledIds = sortIds(Object.keys(bundled));
+  const syncedIds = sortIds(Object.keys(synced));
+  const merged = { ...bundled, ...synced };
+  const availableIds = sortIds(Object.keys(merged));
+  const workflow = merged[workflowId];
+
+  if (!workflow) {
+    throw new Error(
+      `Unknown workflow_id: ${workflowId}. Available bundled: ${formatIds(bundledIds)}. ` +
+        `Available synced: ${formatIds(syncedIds)}. Available all: ${formatIds(availableIds)}`,
+    );
+  }
+
+  const source: WorkflowSource = Object.prototype.hasOwnProperty.call(synced, workflowId)
+    ? "synced"
+    : "bundled";
+  const warnings: WorkflowResolutionWarning[] = [];
+  const fallbackPolicy = options.bundledFallbackPolicy ?? "allow";
+
+  if (source === "bundled" && fallbackPolicy === "block") {
+    throw new Error(
+      `Workflow "${workflowId}" is only available from the bundled registry, ` +
+        "but enforced govern mode requires a synced org workflow. " +
+        `Available synced: ${formatIds(syncedIds)}.`,
+    );
+  }
+
+  if (
+    source === "bundled" &&
+    (options.emitBundledFallbackWarning || fallbackPolicy === "warn")
+  ) {
+    warnings.push({
+      code: "bundled-workflow-fallback",
+      workflow_id: workflowId,
+      bundled_available: true,
+      synced_available: syncedIds.length > 0,
+      message:
+        `Workflow "${workflowId}" was resolved from the bundled registry because ` +
+        "no synced org workflow with that id exists in the local cache.",
+    });
+  }
+
+  return {
+    workflow,
+    source,
+    warnings,
+    bundled_ids: bundledIds,
+    synced_ids: syncedIds,
+    available_ids: availableIds,
+  };
+}

package/scaffold/mcp/src/daemon/main.ts

@@ -13,6 +13,7 @@ import type {
 import { loadEnterpriseConfig, resolveEnterpriseActivation } from "../core/config.js";
 import { pushMetrics } from "../enterprise/telemetry/sync.js";
 import { TelemetryCollector, type TelemetryMetrics } from "../core/telemetry/collector.js";
+import { resolveTelemetryStateDir, telemetryStatePath } from "../core/telemetry/state-dir.js";
 import { AuditWriter, type AuditEntry } from "../core/audit/writer.js";
 import { PolicyStore } from "../core/policy/store.js";
 import {
@@ -84,7 +85,7 @@ async function policyCheck(
 }
 
 function readMetrics(contextDir: string): TelemetryMetrics | null {
-  const path = join(contextDir, "telemetry", "metrics.json");
+  const path = telemetryStatePath(contextDir, "metrics.json");
   if (!existsSync(path)) return null;
   try {
     return JSON.parse(readFileSync(path, "utf8")) as TelemetryMetrics;
@@ -103,7 +104,7 @@ type PendingPush = {
 };
 
 function pendingPushPath(contextDir: string): string {
-  return join(contextDir, "telemetry", "pending-push.json");
+  return telemetryStatePath(contextDir, "pending-push.json");
 }
 
 function readPendingPush(contextDir: string): PendingPush | null {
@@ -118,7 +119,7 @@ function readPendingPush(contextDir: string): PendingPush | null {
 
 function writePendingPush(contextDir: string, pending: PendingPush): void {
   const path = pendingPushPath(contextDir);
-  mkdirSync(join(contextDir, "telemetry"), { recursive: true });
+  mkdirSync(resolveTelemetryStateDir(contextDir), { recursive: true });
   writeFileSync(path, JSON.stringify(pending, null, 2), "utf8");
 }
 

package/scaffold/mcp/src/enterprise/index.ts

@@ -17,7 +17,8 @@ import { registerEnterpriseTools } from "./tools/enterprise.js";
 import { registerHarnessTools } from "./tools/harness.js";
 import { pushViolations, setViolationPushContext } from "./violations/push.js";
 import { pushReviewResults, setReviewPushContext } from "./reviews/push.js";
-import { setWorkflowPushContext } from "./workflow/push.js";
+import { pushWorkflowSnapshot, setWorkflowPushContext } from "./workflow/push.js";
+import { hasWorkflowState, loadWorkflowState } from "./workflow/state.js";
 
 const require = createRequire(import.meta.url);
 const pkg = require("../package.json") as { version: string };
@@ -32,6 +33,7 @@ let activeAuditWriter: AuditWriter | null = null;
 let activeInstanceId: string | null = null;
 let activeSessionId: string | null = null;
 let activeRepo: string | null = null;
+let activeContextDir: string | null = null;
 
 async function flushComplianceQueues(
   config: EnterpriseConfig,
@@ -64,6 +66,15 @@ async function flushComplianceQueues(
     if (!result.success) {
       process.stderr.write(`[cortex-enterprise] ${reason} reviews push failed: ${result.error}\n`);
     }
+    if (result.attempted && activeContextDir && hasWorkflowState(activeContextDir)) {
+      const workflowState = loadWorkflowState(activeContextDir);
+      const workflowResult = await pushWorkflowSnapshot(baseUrl, apiKey, workflowState);
+      if (!workflowResult.success) {
+        process.stderr.write(
+          `[cortex-enterprise] ${reason} workflow snapshot refresh after review push failed: ${workflowResult.error}\n`,
+        );
+      }
+    }
   } catch (err) {
     process.stderr.write(`[cortex-enterprise] ${reason} reviews push error: ${err}\n`);
   }
@@ -113,6 +124,7 @@ export function shutdown(): void {
   activeInstanceId = null;
   activeSessionId = null;
   activeRepo = null;
+  activeContextDir = null;
   setAuditPushContext({});
   setViolationPushContext({});
   setReviewPushContext({});
@@ -248,6 +260,7 @@ export async function onSessionEvent(event: SessionEvent): Promise<void> {
 export async function register(server: McpServer): Promise<void> {
   const projectRoot = process.env.CORTEX_PROJECT_ROOT?.trim() || process.cwd();
   const contextDir = path.join(projectRoot, ".context");
+  activeContextDir = contextDir;
 
   const config = loadEnterpriseConfig(contextDir);
   const activation = resolveEnterpriseActivation(config);
@@ -295,6 +308,8 @@ export async function register(server: McpServer): Promise<void> {
     repo: activeRepo ?? undefined,
     instance_id: activeInstanceId ?? undefined,
     session_id: activeSessionId ?? undefined,
+    context_dir: contextDir,
+    project_root: projectRoot,
   });
   setWorkflowPushContext({
     repo: activeRepo ?? undefined,

package/scaffold/mcp/src/enterprise/reviews/policy-selection.ts

@@ -0,0 +1,65 @@
+import type { OrgPolicy } from "../../core/policy/store.js";
+import {
+  getGenericEvaluator,
+  getValidator,
+  type EnforcedPolicy,
+} from "../../core/validators/engine.js";
+import type { ReviewSkippedPolicy } from "./trust-state.js";
+
+export const DEFERRED_CODE_REVIEW_REASON =
+  "Current context.review invocation is the review being recorded; validate this policy from workflow state on the next run.";
+
+export type PartitionedReviewPolicies = {
+  enforced: EnforcedPolicy[];
+  skipped: ReviewSkippedPolicy[];
+};
+
+export function partitionReviewPolicies(
+  policies: OrgPolicy[],
+): PartitionedReviewPolicies {
+  const enforced: EnforcedPolicy[] = [];
+  const skipped: ReviewSkippedPolicy[] = [];
+
+  for (const policy of policies) {
+    if (!policy.enforce) continue;
+
+    if (policy.id === "require-code-review") {
+      skipped.push({
+        policy_id: policy.id,
+        kind: policy.kind ?? null,
+        type: policy.type ?? null,
+        reason: DEFERRED_CODE_REVIEW_REASON,
+      });
+      continue;
+    }
+
+    if (policy.type) {
+      if (!getGenericEvaluator(policy.type)) {
+        skipped.push({
+          policy_id: policy.id,
+          kind: policy.kind ?? null,
+          type: policy.type,
+          reason: `No evaluator registered for type "${policy.type}"`,
+        });
+        continue;
+      }
+    } else if (!getValidator(policy.id)) {
+      skipped.push({
+        policy_id: policy.id,
+        kind: policy.kind ?? null,
+        type: null,
+        reason: "No executable validator registered for this policy",
+      });
+      continue;
+    }
+
+    enforced.push({
+      id: policy.id,
+      type: policy.type ?? null,
+      config: policy.config ?? null,
+      severity: policy.severity ?? "block",
+    });
+  }
+
+  return { enforced, skipped };
+}

package/scaffold/mcp/src/enterprise/reviews/push.ts

@@ -1,3 +1,5 @@
+import { recordReviewDeliveryStatus } from "./trust-state.js";
+
 export type ReviewPushItem = {
   policy_id: string;
   pass: boolean;
@@ -11,12 +13,16 @@ export type ReviewPushContext = {
   repo?: string;
   instance_id?: string;
   session_id?: string;
+  context_dir?: string;
+  project_root?: string;
 };
 
 export type ReviewPushResult = {
   success: boolean;
   count: number;
   error?: string;
+  attempted?: boolean;
+  delivery_status?: "accepted" | "failed";
 };
 
 const pending: ReviewPushItem[] = [];
@@ -26,6 +32,10 @@ export function setReviewPushContext(context: ReviewPushContext): void {
   activeContext = { ...context };
 }
 
+export function getReviewPushContext(): ReviewPushContext {
+  return { ...activeContext };
+}
+
 export function queueReviewResult(item: ReviewPushItem): void {
   pending.push(item);
 }
@@ -39,11 +49,18 @@ export async function pushReviewResults(
   apiKey: string,
 ): Promise<ReviewPushResult> {
   if (pending.length === 0) {
-    return { success: true, count: 0 };
+    return { success: true, count: 0, attempted: false };
   }
 
   const reviewsUrl = `${baseUrl.replace(/\/$/, "")}/api/v1/reviews/push`;
   const batch = pending.splice(0, 100);
+  const attemptedAt = new Date().toISOString();
+  if (activeContext.context_dir) {
+    recordReviewDeliveryStatus(activeContext.context_dir, "pushed", {
+      reviewCount: batch.length,
+      attemptedAt,
+    });
+  }
 
   try {
     const response = await fetch(reviewsUrl, {
@@ -64,16 +81,50 @@ export async function pushReviewResults(
 
     if (!response.ok) {
       pending.unshift(...batch);
-      return { success: false, count: 0, error: `HTTP ${response.status}` };
+      if (activeContext.context_dir) {
+        recordReviewDeliveryStatus(activeContext.context_dir, "failed", {
+          reviewCount: batch.length,
+          attemptedAt,
+          error: `HTTP ${response.status}`,
+        });
+      }
+      return {
+        success: false,
+        count: 0,
+        error: `HTTP ${response.status}`,
+        attempted: true,
+        delivery_status: "failed",
+      };
     }
 
-    return { success: true, count: batch.length };
+    if (activeContext.context_dir) {
+      recordReviewDeliveryStatus(activeContext.context_dir, "accepted", {
+        reviewCount: batch.length,
+        attemptedAt,
+      });
+    }
+    return {
+      success: true,
+      count: batch.length,
+      attempted: true,
+      delivery_status: "accepted",
+    };
   } catch (err) {
     pending.unshift(...batch);
+    const error = err instanceof Error ? err.message : "unknown error";
+    if (activeContext.context_dir) {
+      recordReviewDeliveryStatus(activeContext.context_dir, "failed", {
+        reviewCount: batch.length,
+        attemptedAt,
+        error,
+      });
+    }
     return {
       success: false,
       count: 0,
-      error: err instanceof Error ? err.message : "unknown error",
+      error,
+      attempted: true,
+      delivery_status: "failed",
     };
   }
 }

package/scaffold/mcp/src/enterprise/reviews/trust-state.ts

@@ -0,0 +1,305 @@
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  writeFileSync,
+} from "node:fs";
+import { join } from "node:path";
+import { setWorkflowReviewTrust } from "../workflow/state.js";
+import { resolveWorkflowDefinition, type WorkflowSource } from "../../core/workflow/resolution.js";
+
+export type ReviewDeliveryStatus =
+  | "never_attempted"
+  | "queued"
+  | "pushed"
+  | "accepted"
+  | "failed";
+
+export type ReviewTrustWarning = {
+  code:
+    | "workflow-source-unverified"
+    | "workflow-unresolved"
+    | "review-delivery-pending"
+    | "review-delivery-failed"
+    | "policy-not-enforceable";
+  message: string;
+};
+
+export type ReviewSkippedPolicy = {
+  policy_id: string;
+  kind: string | null;
+  type: string | null;
+  reason: string;
+};
+
+export type ReviewTrustState = {
+  version: 1;
+  repo: string | null;
+  instance_id: string | null;
+  session_id: string | null;
+  workflow: {
+    id: string | null;
+    source: WorkflowSource | "unknown";
+    task_id: string | null;
+  };
+  last_review_at: string | null;
+  review_summary: {
+    total: number;
+    passed: number;
+    failed: number;
+    warnings: number;
+    skipped: number;
+  } | null;
+  skipped_policies: ReviewSkippedPolicy[];
+  delivery: {
+    status: ReviewDeliveryStatus;
+    review_count: number;
+    queued_at: string | null;
+    last_attempted_at: string | null;
+    last_pushed_at: string | null;
+    last_accepted_at: string | null;
+    last_error: string | null;
+  };
+  trust_warnings: ReviewTrustWarning[];
+};
+
+type TrustContext = {
+  contextDir: string;
+  projectRoot: string;
+  repo?: string;
+  instance_id?: string;
+  session_id?: string;
+  task_id?: string;
+};
+
+type ReviewSummaryInput = {
+  total: number;
+  passed: number;
+  failed: number;
+  warnings: number;
+  skipped: number;
+};
+
+type WorkflowInference = {
+  id: string | null;
+  source: WorkflowSource | "unknown";
+  task_id: string | null;
+};
+
+function trustStatePath(contextDir: string): string {
+  return join(contextDir, "review-trust.json");
+}
+
+function nowIso(): string {
+  return new Date().toISOString();
+}
+
+function initialTrustState(): ReviewTrustState {
+  return {
+    version: 1,
+    repo: null,
+    instance_id: null,
+    session_id: null,
+    workflow: {
+      id: null,
+      source: "unknown",
+      task_id: null,
+    },
+    last_review_at: null,
+    review_summary: null,
+    skipped_policies: [],
+    delivery: {
+      status: "never_attempted",
+      review_count: 0,
+      queued_at: null,
+      last_attempted_at: null,
+      last_pushed_at: null,
+      last_accepted_at: null,
+      last_error: null,
+    },
+    trust_warnings: [],
+  };
+}
+
+function ensureContextDir(contextDir: string): void {
+  mkdirSync(contextDir, { recursive: true });
+}
+
+function inferWorkflow(projectRoot: string, taskId?: string): WorkflowInference {
+  const normalizedTaskId = taskId?.trim();
+  if (!normalizedTaskId) {
+    return { id: null, source: "unknown", task_id: null };
+  }
+
+  const statePath = join(projectRoot, ".agents", normalizedTaskId, "state.json");
+  if (!existsSync(statePath)) {
+    return { id: null, source: "unknown", task_id: normalizedTaskId };
+  }
+
+  try {
+    const raw = JSON.parse(readFileSync(statePath, "utf8")) as Record<string, unknown>;
+    const workflowId =
+      typeof raw.workflow_id === "string" ? raw.workflow_id : null;
+    if (!workflowId) {
+      return { id: null, source: "unknown", task_id: normalizedTaskId };
+    }
+    const resolved = resolveWorkflowDefinition(workflowId);
+    return {
+      id: workflowId,
+      source: resolved.source,
+      task_id: normalizedTaskId,
+    };
+  } catch {
+    return {
+      id: null,
+      source: "unknown",
+      task_id: normalizedTaskId,
+    };
+  }
+}
+
+function computeWarnings(state: ReviewTrustState): ReviewTrustWarning[] {
+  const warnings: ReviewTrustWarning[] = [];
+
+  if (!state.workflow.id) {
+    warnings.push({
+      code: "workflow-unresolved",
+      message:
+        "No active local workflow could be resolved for this review session, so workflow/review correlation is unproven.",
+    });
+  } else if (state.workflow.source !== "synced") {
+    warnings.push({
+      code: "workflow-source-unverified",
+      message:
+        `Workflow "${state.workflow.id}" is not proven to come from the synced org registry for this session.`,
+    });
+  }
+
+  if (state.delivery.status === "queued" || state.delivery.status === "pushed") {
+    warnings.push({
+      code: "review-delivery-pending",
+      message:
+        "Local review results exist for this session, but Cortex has not yet confirmed acceptance by the control plane.",
+    });
+  }
+
+  if (state.delivery.status === "failed") {
+    warnings.push({
+      code: "review-delivery-failed",
+      message:
+        `Review delivery failed${state.delivery.last_error ? `: ${state.delivery.last_error}` : ""}`,
+    });
+  }
+
+  if (state.skipped_policies.length > 0) {
+    warnings.push({
+      code: "policy-not-enforceable",
+      message:
+        `${state.skipped_policies.length} configured policy` +
+        `${state.skipped_policies.length === 1 ? " was" : "ies were"} not enforceable locally.`,
+    });
+  }
+
+  return warnings;
+}
+
+export function loadReviewTrustState(contextDir: string): ReviewTrustState {
+  ensureContextDir(contextDir);
+  const filePath = trustStatePath(contextDir);
+  if (!existsSync(filePath)) {
+    const initial = initialTrustState();
+    writeReviewTrustState(contextDir, initial);
+    return initial;
+  }
+
+  try {
+    const parsed = JSON.parse(readFileSync(filePath, "utf8")) as ReviewTrustState;
+    parsed.trust_warnings = computeWarnings(parsed);
+    return parsed;
+  } catch {
+    const initial = initialTrustState();
+    writeReviewTrustState(contextDir, initial);
+    return initial;
+  }
+}
+
+export function writeReviewTrustState(
+  contextDir: string,
+  state: ReviewTrustState,
+): ReviewTrustState {
+  ensureContextDir(contextDir);
+  state.trust_warnings = computeWarnings(state);
+  writeFileSync(trustStatePath(contextDir), `${JSON.stringify(state, null, 2)}\n`, "utf8");
+  setWorkflowReviewTrust(contextDir, state);
+  return state;
+}
+
+export function recordQueuedReviewTrustState(
+  context: TrustContext,
+  input: {
+    reviewedAt: string;
+    summary: ReviewSummaryInput;
+    skippedPolicies: ReviewSkippedPolicy[];
+  },
+): ReviewTrustState {
+  const state = loadReviewTrustState(context.contextDir);
+  const workflow = inferWorkflow(context.projectRoot, context.task_id);
+  state.repo = context.repo ?? state.repo;
+  state.instance_id = context.instance_id ?? state.instance_id;
+  state.session_id = context.session_id ?? state.session_id;
+  state.workflow = workflow;
+  state.last_review_at = input.reviewedAt;
+  state.review_summary = {
+    total: input.summary.total,
+    passed: input.summary.passed,
+    failed: input.summary.failed,
+    warnings: input.summary.warnings,
+    skipped: input.summary.skipped,
+  };
+  state.skipped_policies = input.skippedPolicies;
+  const hasQueuedReviews = input.summary.total > 0;
+  state.delivery = {
+    status: hasQueuedReviews ? "queued" : "never_attempted",
+    review_count: input.summary.total,
+    queued_at: hasQueuedReviews ? input.reviewedAt : null,
+    last_attempted_at: null,
+    last_pushed_at: null,
+    last_accepted_at: null,
+    last_error: null,
+  };
+  return writeReviewTrustState(context.contextDir, state);
+}
+
+export function recordReviewDeliveryStatus(
+  contextDir: string,
+  status: ReviewDeliveryStatus,
+  input: {
+    reviewCount?: number;
+    error?: string;
+    attemptedAt?: string;
+  } = {},
+): ReviewTrustState {
+  const state = loadReviewTrustState(contextDir);
+  const at = input.attemptedAt ?? nowIso();
+  state.delivery.review_count = input.reviewCount ?? state.delivery.review_count;
+  state.delivery.last_attempted_at = at;
+
+  if (status === "pushed") {
+    state.delivery.status = "pushed";
+    state.delivery.last_pushed_at = at;
+    state.delivery.last_error = null;
+  } else if (status === "accepted") {
+    state.delivery.status = "accepted";
+    state.delivery.last_pushed_at = at;
+    state.delivery.last_accepted_at = at;
+    state.delivery.last_error = null;
+  } else if (status === "failed") {
+    state.delivery.status = "failed";
+    state.delivery.last_pushed_at = at;
+    state.delivery.last_error = input.error ?? "unknown error";
+  } else {
+    state.delivery.status = status;
+  }
+
+  return writeReviewTrustState(contextDir, state);
+}