@davesheffer/hunch 1.8.2 → 1.9.2

package/dist/constitution/g2BehaviorDependencies.js

@@ -1,22 +1,207 @@
 import { execFileSync, spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
-import { existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync, } from "node:fs";
-import { basename, join } from "node:path";
+import { chmodSync, closeSync, constants as fsConstants, copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readlinkSync, readSync, readdirSync, realpathSync, renameSync, rmSync, statSync, symlinkSync, writeFileSync, } from "node:fs";
+import { basename, dirname, isAbsolute, join, resolve, sep } from "node:path";
+import { TextDecoder } from "node:util";
 import { shortHash } from "../core/ids.js";
+import { compareCodeUnits } from "../core/canonicalOrder.js";
 import { canonicalHash, canonicalJson } from "./canonical.js";
 import { replaySafeEnvironment } from "./replay.js";
+import { replacementFreeExactCommit, replacementFreeGitEnvironment } from "./replacementFreeGit.js";
 const FULL_SHA = /^[a-f0-9]{40}$/;
 const PACKAGE_NAME = /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/i;
-const SNAPSHOT_VERSION = 1;
+// v1 bound only the installed lock and native binaries. Including the version
+// in SnapshotInput makes those caches ineligible and provisions a fresh v2 tree.
+const SNAPSHOT_VERSION = 2;
+const TREE_HASH_VERSION = "hunch-node-modules-tree-v1";
+const HASH_BUFFER_BYTES = 64 * 1024;
+const UTF8_DECODER = new TextDecoder("utf-8", { fatal: true });
 function sha256(value) {
     return `sha256:${createHash("sha256").update(value).digest("hex")}`;
 }
-function gitFile(root, commit, file) {
-    if (!FULL_SHA.test(commit))
-        throw new Error(`dependency snapshot commit ${commit} is not a full SHA`);
+function fileSha256(file) {
+    const hash = createHash("sha256");
+    const buffer = Buffer.allocUnsafe(HASH_BUFFER_BYTES);
+    const fd = openSync(file, "r");
+    try {
+        for (let bytes = readSync(fd, buffer, 0, buffer.length, null); bytes > 0; bytes = readSync(fd, buffer, 0, buffer.length, null)) {
+            hash.update(buffer.subarray(0, bytes));
+        }
+    }
+    finally {
+        closeSync(fd);
+    }
+    return `sha256:${hash.digest("hex")}`;
+}
+function hashField(hash, value) {
+    const bytes = typeof value === "string" ? Buffer.from(value, "utf8") : value;
+    const length = Buffer.allocUnsafe(8);
+    length.writeBigUInt64BE(BigInt(bytes.length));
+    hash.update(length);
+    hash.update(bytes);
+}
+function safeEntryName(name) {
+    if (!name || name === "." || name === ".." || name.includes("\0") || name.includes("/") || (sep === "\\" && name.includes("\\"))) {
+        throw new Error("dependency snapshot contains an unsafe filesystem entry name");
+    }
+    return name;
+}
+function symlinkTarget(link) {
+    const raw = readlinkSync(link, { encoding: "buffer" });
+    try {
+        return UTF8_DECODER.decode(raw);
+    }
+    catch {
+        throw new Error("dependency snapshot contains a non-UTF-8 symlink target");
+    }
+}
+function inside(root, target) {
+    return target === root || target.startsWith(`${root}${sep}`);
+}
+function safeInternalSymlink(root, link, target) {
+    if (!target || target.includes("\0") || isAbsolute(target)) {
+        throw new Error("dependency snapshot contains an absolute or empty symlink target");
+    }
+    const lexicalRoot = resolve(root);
+    const lexicalTarget = resolve(dirname(link), target);
+    if (!inside(lexicalRoot, lexicalTarget)) {
+        throw new Error("dependency snapshot contains an escaping symlink target");
+    }
+    const realRoot = realpathSync(root);
+    const realTarget = realpathSync(lexicalTarget);
+    if (!inside(realRoot, realTarget)) {
+        throw new Error("dependency snapshot contains a symlink target outside node_modules");
+    }
+    const targetStat = statSync(link);
+    if (targetStat.isFile())
+        return "file";
+    if (targetStat.isDirectory())
+        return "dir";
+    throw new Error("dependency snapshot symlink resolves to a special filesystem entry");
+}
+function treeEntries(dir) {
+    return readdirSync(dir, { encoding: "buffer" })
+        .sort((left, right) => Buffer.compare(left, right))
+        .map((raw) => {
+        let name;
+        try {
+            name = UTF8_DECODER.decode(raw);
+        }
+        catch {
+            throw new Error("dependency snapshot contains a non-UTF-8 filesystem entry name");
+        }
+        return safeEntryName(name);
+    });
+}
+function treeRecord(hash, relative, kind, mode, payload = "") {
+    hashField(hash, relative);
+    hashField(hash, kind);
+    hashField(hash, (mode & 0o7777).toString(8).padStart(4, "0"));
+    hashField(hash, payload);
+}
+/** Hash every directory, regular file, executable bit, and internal symlink in
+ * a dependency tree. Traversal uses raw UTF-8 byte ordering rather than the
+ * host locale, and rejects filesystem shapes that cannot be copied safely. */
+export function dependencySnapshotTreeHash(nodeModules) {
+    const rootStat = lstatSync(nodeModules);
+    if (!rootStat.isDirectory() || rootStat.isSymbolicLink()) {
+        throw new Error("dependency snapshot node_modules root is not a real directory");
+    }
+    const hash = createHash("sha256");
+    hashField(hash, TREE_HASH_VERSION);
+    treeRecord(hash, "", "directory", rootStat.mode);
+    const walk = (dir, relative) => {
+        for (const name of treeEntries(dir)) {
+            const absolute = join(dir, name);
+            const next = relative ? `${relative}/${name}` : name;
+            const stat = lstatSync(absolute);
+            if (stat.isSymbolicLink()) {
+                const target = symlinkTarget(absolute);
+                safeInternalSymlink(nodeModules, absolute, target);
+                treeRecord(hash, next, "symlink", stat.mode, target);
+            }
+            else if (stat.isDirectory()) {
+                treeRecord(hash, next, "directory", stat.mode);
+                walk(absolute, next);
+            }
+            else if (stat.isFile()) {
+                treeRecord(hash, next, "file", stat.mode, fileSha256(absolute));
+            }
+            else {
+                throw new Error(`dependency snapshot contains special filesystem entry ${next}`);
+            }
+        }
+    };
+    walk(nodeModules, "");
+    return `sha256:${hash.digest("hex")}`;
+}
+function copyDependencyTree(source, destination) {
+    const copyDirectory = (sourceDir, destinationDir) => {
+        const sourceStat = lstatSync(sourceDir);
+        if (!sourceStat.isDirectory() || sourceStat.isSymbolicLink()) {
+            throw new Error("dependency snapshot copy source is not a real directory");
+        }
+        mkdirSync(destinationDir, { mode: sourceStat.mode & 0o7777 });
+        for (const name of treeEntries(sourceDir)) {
+            const sourceEntry = join(sourceDir, name);
+            const destinationEntry = join(destinationDir, name);
+            const stat = lstatSync(sourceEntry);
+            if (stat.isSymbolicLink()) {
+                const target = symlinkTarget(sourceEntry);
+                const targetType = safeInternalSymlink(source, sourceEntry, target);
+                symlinkSync(target, destinationEntry, process.platform === "win32" ? targetType : undefined);
+            }
+            else if (stat.isDirectory()) {
+                copyDirectory(sourceEntry, destinationEntry);
+            }
+            else if (stat.isFile()) {
+                copyFileSync(sourceEntry, destinationEntry, fsConstants.COPYFILE_FICLONE);
+                chmodSync(destinationEntry, stat.mode & 0o7777);
+            }
+            else {
+                throw new Error("dependency snapshot contains a special filesystem entry");
+            }
+        }
+        chmodSync(destinationDir, sourceStat.mode & 0o7777);
+    };
+    copyDirectory(source, destination);
+}
+/** Create one independently writable dependency tree. COPYFILE_FICLONE is a
+ * copy-on-write optimization where supported, never a shared hardlink; the
+ * byte-copy fallback has the same isolation. Pre/post hashes bind the copy. */
+export function materializeDependencyTree(source, destination, opts = {}) {
+    if (existsSync(destination))
+        throw new Error("dependency snapshot destination already exists");
+    const sourceHash = dependencySnapshotTreeHash(source);
+    if (opts.expectedHash && sourceHash !== opts.expectedHash) {
+        throw new Error("dependency tree hash mismatch before materialization");
+    }
+    try {
+        copyDependencyTree(source, destination);
+        if (dependencySnapshotTreeHash(destination) !== sourceHash) {
+            throw new Error("dependency tree hash mismatch after materialization");
+        }
+        return sourceHash;
+    }
+    catch (error) {
+        rmSync(destination, { recursive: true, force: true });
+        throw error;
+    }
+}
+/** Materialize a private writable dependency tree for one disposable run. */
+export function materializeDependencySnapshot(dependency, destination) {
+    materializeDependencyTree(dependency.nodeModules, destination, {
+        expectedHash: dependency.snapshot.node_modules_hash,
+    });
+}
+function gitFile(root, commit, file, env) {
+    if (!FULL_SHA.test(commit) || replacementFreeExactCommit(root, commit) !== commit) {
+        throw new Error(`dependency snapshot commit ${commit} is not one exact commit`);
+    }
     try {
         return execFileSync("git", ["-C", root, "show", `${commit}:${file}`], {
             encoding: "utf8",
+            env: replacementFreeGitEnvironment(env),
             maxBuffer: 20 * 1024 * 1024,
             stdio: ["ignore", "pipe", "ignore"],
         });
@@ -62,7 +247,7 @@ function lockedPackageNames(lock) {
     return names;
 }
 function normalizeAllowlist(values, lock) {
-    const result = [...new Set(values.map((value) => value.trim()).filter(Boolean))].sort();
+    const result = [...new Set(values.map((value) => value.trim()).filter(Boolean))].sort(compareCodeUnits);
     const locked = lockedPackageNames(lock);
     for (const name of result) {
         if (!PACKAGE_NAME.test(name))
@@ -104,8 +289,8 @@ function runtimeIdentity(env) {
     return { node: process.version, npm: result.stdout.trim(), platform: process.platform, arch: process.arch };
 }
 function snapshotInput(root, commit, allowInstallScripts, env) {
-    const packageJson = gitFile(root, commit, "package.json");
-    const packageLock = gitFile(root, commit, "package-lock.json");
+    const packageJson = gitFile(root, commit, "package.json", env);
+    const packageLock = gitFile(root, commit, "package-lock.json", env);
     const pkg = parseObject(packageJson, "package.json");
     const lock = parseObject(packageLock, "package-lock.json");
     if (lock.lockfileVersion !== 2 && lock.lockfileVersion !== 3) {
@@ -139,7 +324,7 @@ function snapshotInput(root, commit, allowInstallScripts, env) {
 function nativeInventory(nodeModules) {
     const files = [];
     const walk = (dir, relative) => {
-        for (const entry of readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+        for (const entry of readdirSync(dir, { withFileTypes: true }).sort((a, b) => compareCodeUnits(a.name, b.name))) {
             const absolute = join(dir, entry.name);
             const next = relative ? `${relative}/${entry.name}` : entry.name;
             if (entry.isSymbolicLink())
@@ -171,6 +356,8 @@ function readSnapshot(dir) {
         const installedLock = join(nodeModules, ".package-lock.json");
         if (!existsSync(nodeModules) || !lstatSync(nodeModules).isDirectory())
             return null;
+        if (dependencySnapshotTreeHash(nodeModules) !== value.node_modules_hash)
+            return null;
         const installedLockHash = existsSync(installedLock) ? sha256(readFileSync(installedLock)) : sha256("");
         if (installedLockHash !== value.installed_lock_hash)
             return null;
@@ -232,6 +419,7 @@ function buildSnapshot(base, input, env, timeoutMs) {
         const nodeModules = join(work, "node_modules");
         const installedLock = join(nodeModules, ".package-lock.json");
         mkdirSync(nodeModules, { recursive: true });
+        const nodeModulesHash = dependencySnapshotTreeHash(nodeModules);
         const body = {
             input_hash: input.inputHash,
             package_json_hash: input.packageJsonHash,
@@ -242,6 +430,7 @@ function buildSnapshot(base, input, env, timeoutMs) {
             allow_install_scripts: input.allowInstallScripts,
             installed_lock_hash: existsSync(installedLock) ? sha256(readFileSync(installedLock)) : sha256(""),
             native_binaries: nativeInventory(nodeModules),
+            node_modules_hash: nodeModulesHash,
             format_version: SNAPSHOT_VERSION,
             data_class: "private",
             authority: "none",
@@ -298,8 +487,8 @@ export function dependencySnapshotForCommit(root, commit, allowedIds) {
     let packageJson;
     let packageLock;
     try {
-        packageJson = gitFile(root, commit, "package.json");
-        packageLock = gitFile(root, commit, "package-lock.json");
+        packageJson = gitFile(root, commit, "package.json", env);
+        packageLock = gitFile(root, commit, "package-lock.json", env);
     }
     catch {
         return null;
@@ -343,7 +532,7 @@ export function provisionG2BehaviorDependencySnapshotsForCommits(root, commits,
         });
         return {
             snapshots: [...new Map([...byInput.values()].map((snapshot) => [snapshot.id, snapshot])).values()]
-                .sort((left, right) => left.id.localeCompare(right.id)),
+                .sort((left, right) => compareCodeUnits(left.id, right.id)),
             commits: mapped,
         };
     }
@@ -367,7 +556,7 @@ export function provisionG2BehaviorDependencySnapshots(root, report, candidate,
             known_bad: { commit: candidate.proposed_corpus.known_bad.ref, dependency_snapshot_id: bad.dependency_snapshot_id },
             known_good: { commit: candidate.proposed_corpus.known_good.ref, dependency_snapshot_id: good.dependency_snapshot_id },
         },
-        allow_install_scripts: [...new Set(allowInstallScripts.map((value) => value.trim()).filter(Boolean))].sort(),
+        allow_install_scripts: [...new Set(allowInstallScripts.map((value) => value.trim()).filter(Boolean))].sort(compareCodeUnits),
         data_class: "private",
         authority: "none",
         effects: "cache_only",

package/dist/constitution/g2Candidates.js

@@ -77,7 +77,7 @@ export function buildG2CandidateReview(store, root, opts = {}, resolutions = [])
     const graphStore = new HunchStore(hunchPathsForDir(scratchRoot));
     try {
         graphStore.json.ensureDirs();
-        indexRepo(graphStore, root, { churn: false });
+        indexRepo(graphStore, root, { churn: false, requireComplete: true });
         return buildFromIndexedGraph(store, graphStore, root, opts, resolutions);
     }
     finally {

package/dist/constitution/lifecycle.js

@@ -24,11 +24,25 @@ export function blockingEvidenceError(proof, dispositions = []) {
     return assessHistoryDispositions(proof, dispositions).blocking_error;
 }
 const proofRank = { P0: 0, P1: 1, P2: 2, P3: 3, P4: 4, P5: 5 };
+/** Activation is a runtime property, not merely an approval-time check. The
+ * audit fallback keeps correction policies compiled before `origin` was added
+ * fail-closed after they are loaded by the current schema. */
+export function activationGateError(policy) {
+    const isMd1Correction = policy.origin === "correction_md1a"
+        || policy.audit.some((event) => event.action === "compiled" && event.actor === "hunch:correction-policy-materializer");
+    if (isMd1Correction && policy.activation_gate?.status !== "blocked") {
+        return "MD-1a correction policy is missing its required source-currentness activation gate";
+    }
+    return policy.activation_gate?.status === "blocked" ? policy.activation_gate.reason : null;
+}
 /** Rechecked on every blocking evaluation; a hand-edited lifecycle flag without
  * a current P3 proof is a configuration error, never authority. */
 export function blockingProofError(policy, proof, dispositions = [], composition = [], currentBehaviorAttestations = []) {
     if (policy.state !== "active_blocking")
         return null;
+    const activationError = activationGateError(policy);
+    if (activationError)
+        return activationError;
     if (policy.authority?.kind !== "human")
         return "active blocking policy has no human authority event";
     const behaviorAttestationError = executableBehaviorAttestationError(policy, currentBehaviorAttestations);
@@ -95,6 +109,9 @@ export function proposeProvedPolicy(policy, proof, at, composition = [], current
     };
 }
 export function approvePolicy(policy, proof, mode, actor, at, dispositions = [], composition = [], currentBehaviorAttestations = []) {
+    const activationError = activationGateError(policy);
+    if (activationError)
+        throw new Error(`policy ${policy.id} cannot activate: ${activationError}`);
     requireHuman(actor);
     const behaviorAttestationError = executableBehaviorAttestationError(policy, currentBehaviorAttestations);
     if (behaviorAttestationError)

package/dist/constitution/plan.js

@@ -1,10 +1,12 @@
-import { basename } from "node:path";
 import { shortHash } from "../core/ids.js";
-import { firstCommitForFile, headSha, revExists, revParse } from "../extractors/git.js";
+import { stableRepositoryName } from "../extractors/git.js";
 import { canonicalHash, policySemanticHash } from "./canonical.js";
 import { policyCompositionBinding, policyProofHash } from "./composition.js";
 import { graphSnapshot, mutationOperatorForPolicy, selectedPolicyForComposition } from "./evaluator.js";
 import { createExecutableBehaviorProofPlan } from "./behaviorProof.js";
+import { canonicalStaticGraphBaseline, isAncestorOrSame } from "./staticGraphBaseline.js";
+import { replacementFreeExactCommit, replacementFreeFirstCommitForFile } from "./replacementFreeGit.js";
+export { canonicalStaticGraphBaseline } from "./staticGraphBaseline.js";
 import { POLICY_EVALUATOR, MUTATION_ENGINE, ProofPlanSchema, } from "./schema.js";
 function clamp(value, fallback, min, max) {
     if (value == null || !Number.isFinite(value))
@@ -46,19 +48,26 @@ export function createProofPlan(store, root, repository, policy, opts = {}) {
             throw new Error("executable-behavior policies cannot have exception composition");
         return createExecutableBehaviorProofPlan(root, repository, policy, { now: opts.now, privateOnly: true });
     }
-    const head = headSha(root);
-    if (!head)
+    const repositoryHead = replacementFreeExactCommit(root, "HEAD");
+    if (!repositoryHead)
         throw new Error("proof planning needs a Git repository with a current HEAD");
+    const head = canonicalStaticGraphBaseline(root, repositoryHead);
     const composition = opts.composition ?? [];
     const parentHash = policySemanticHash(policy);
     const policyHash = policyProofHash(policy, composition);
     const compositionBinding = policyCompositionBinding(policy, composition);
     const corpus = repository.getCorpus(policy.id, opts);
+    // Proof plans are shared memory. A clone-local directory basename would mint
+    // different plan IDs for Architect, Developer, CI, and linked worktrees even
+    // when every one of them is looking at the same repository and policy. An
+    // existing immutable corpus remains the compatibility authority for artifacts
+    // created before stable repository identities were introduced.
+    const repositoryName = opts.repositoryName ?? corpus?.repository ?? stableRepositoryName(root);
     if (corpus) {
         if (corpus.policy_hash !== parentHash) {
             throw new Error(`proof corpus ${corpus.id} is stale for policy ${policy.id}; re-import it after the policy semantic change`);
         }
-        if (corpus.repository !== basename(root) || corpus.data_class !== policy.data_class) {
+        if (corpus.repository !== repositoryName || corpus.data_class !== policy.data_class) {
             throw new Error(`proof corpus ${corpus.id} does not match repository/data class for policy ${policy.id}`);
         }
     }
@@ -73,11 +82,19 @@ export function createProofPlan(store, root, repository, policy, opts = {}) {
         .filter((ref) => ref.startsWith("dec_"))
         .map(readDecision)
         .find((record) => !!record);
-    const policyCommit = firstCommitForFile(`.hunch/policies/${policy.id}.json`, root);
+    const policyCommit = replacementFreeFirstCommitForFile(root, `.hunch/policies/${policy.id}.json`);
     const sourceRef = sourceEvent?.commit ?? decision?.commit ?? (policyCommit || head);
-    if (!revExists(sourceRef, root))
+    const rawSource = replacementFreeExactCommit(root, sourceRef);
+    if (!rawSource)
         throw new Error(`proof-plan source commit ${sourceRef} does not resolve in this repository`);
-    const sourceCommit = revParse(sourceRef, root);
+    // Canonicalize the source independently of current HEAD. A policy introduced
+    // by a Hunch-only publication commit remains anchored to the indexed-code (or
+    // merge) boundary immediately before that publication, even after later code
+    // commits advance the current baseline.
+    const sourceCommit = canonicalStaticGraphBaseline(root, rawSource);
+    if (!isAncestorOrSame(root, sourceCommit, head)) {
+        throw new Error(`proof-plan source commit ${sourceCommit} is not an ancestor of canonical graph baseline ${head}`);
+    }
     const structural = events.find((event) => event.structural_delta && (event.kind === "bug_fix" || event.kind === "revert" || event.kind === "decision"));
     const structuralKnownBad = structural?.structural_delta
         ? [{
@@ -112,7 +129,7 @@ export function createProofPlan(store, root, repository, policy, opts = {}) {
     const body = {
         policy_id: policy.id,
         policy_candidate_hash: policyHash,
-        repository: basename(root),
+        repository: repositoryName,
         data_class: policy.data_class,
         source_commit: sourceCommit,
         valid_from_commit: sourceCommit,

package/dist/constitution/replacementFreeGit.js

@@ -0,0 +1,67 @@
+import { execFileSync, spawnSync } from "node:child_process";
+import { foreignRepoEnv } from "../extractors/git.js";
+/** Constitution proof identity is the repository's real object graph, never a
+ * clone-local `refs/replace/*` or legacy graft view. Keep this environment
+ * private to proof planning so every traversal and ancestry check agrees with
+ * replay, which uses the same Git invariant. */
+export function replacementFreeGitEnvironment(source = process.env) {
+    return {
+        ...foreignRepoEnv(source),
+        GIT_NO_REPLACE_OBJECTS: "1",
+    };
+}
+function gitText(root, args, maxBuffer = 64 * 1024 * 1024) {
+    return execFileSync("git", ["-C", root, ...args], {
+        encoding: "utf8",
+        env: replacementFreeGitEnvironment(),
+        maxBuffer,
+        stdio: ["ignore", "pipe", "ignore"],
+    }).trim();
+}
+function gitTextSafe(root, args, maxBuffer) {
+    try {
+        return gitText(root, args, maxBuffer);
+    }
+    catch {
+        return "";
+    }
+}
+/** Resolve one commit-ish through the real object graph. */
+export function replacementFreeExactCommit(root, ref) {
+    const oid = gitTextSafe(root, ["rev-parse", "--verify", "--quiet", `${ref}^{commit}`]).toLowerCase();
+    return /^[0-9a-f]{40,64}$/.test(oid) ? oid : null;
+}
+/** Files changed by an exact commit, ignoring local replacement objects. */
+export function replacementFreeCommitFiles(root, commit) {
+    const out = gitTextSafe(root, ["diff-tree", "--no-commit-id", "--name-only", "-r", "--root", commit]);
+    return out ? out.split("\n").filter(Boolean) : [];
+}
+export function replacementFreeCommitMeta(root, commit) {
+    const raw = gitTextSafe(root, ["show", "-s", "--format=%H%x1f%h%x1f%s%x1f%b%x1f%an%x1f%aI", commit]);
+    if (!raw)
+        return null;
+    const [sha = "", shortSha = "", subject = "", body = "", author = "", date = ""] = raw.split("\x1f");
+    if (!/^[0-9a-f]{40,64}$/i.test(sha))
+        return null;
+    return { sha, shortSha, subject, body, author, date, files: replacementFreeCommitFiles(root, sha) };
+}
+/** Exact introducing commit for a Git-native policy record. */
+export function replacementFreeFirstCommitForFile(root, file) {
+    const added = gitTextSafe(root, ["log", "--diff-filter=A", "--format=%H", "--", file])
+        .split("\n")
+        .find(Boolean);
+    if (added)
+        return added;
+    return gitTextSafe(root, ["log", "--reverse", "--format=%H", "--", file])
+        .split("\n")
+        .find(Boolean) ?? "";
+}
+export function replacementFreeIsAncestorOrSame(root, ancestor, descendant) {
+    if (ancestor === descendant)
+        return true;
+    return spawnSync("git", ["-C", root, "merge-base", "--is-ancestor", ancestor, descendant], {
+        env: replacementFreeGitEnvironment(),
+        stdio: "ignore",
+    }).status === 0;
+}
+//# sourceMappingURL=replacementFreeGit.js.map

package/dist/constitution/replay.js

@@ -7,6 +7,7 @@ import { canonicalHash, proofEvaluationHash, proofPlanContentHash } from "./cano
 import { assertCompositionBinding, policyProofHash } from "./composition.js";
 import { evaluateCompositePolicyOnSnapshot, evaluatePolicyOnSnapshot } from "./evaluator.js";
 import { loadReplaySnapshot, putReplaySnapshot } from "./replayCache.js";
+import { hasUnsafeCheckoutAttributes } from "./safeCheckout.js";
 import { POLICY_EVALUATOR, ProofPlanSchema, ReplayReceiptSchema, } from "./schema.js";
 const ZERO_SHA = "0".repeat(40);
 export const DEFAULT_REPLAY_WORKERS = 4;
@@ -26,6 +27,7 @@ export function replaySafeEnvironment(home, gitConfig) {
         HOME: home,
         GIT_CONFIG_GLOBAL: gitConfig,
         GIT_CONFIG_NOSYSTEM: "1",
+        GIT_NO_REPLACE_OBJECTS: "1",
         GIT_TERMINAL_PROMPT: "0",
         GIT_LFS_SKIP_SMUDGE: "1",
         HUNCH_PRIVATE_DIR: "",
@@ -204,6 +206,10 @@ export function replayProofPlan(root, policy, inputPlan, opts = {}) {
                 outcomes.set(commit, { commit, error_code: "timeout" });
                 continue;
             }
+            if (hasUnsafeCheckoutAttributes(root, commit, env, { allowDisabledLfs: true })) {
+                outcomes.set(commit, { commit, error_code: "unsafe-checkout-attributes" });
+                continue;
+            }
             const cached = loadReplaySnapshot(root, commit, plan.data_class);
             if (cached.status === "hit" && cached.snapshot) {
                 cacheStats.hits++;

package/dist/constitution/replayCache.js

@@ -6,7 +6,7 @@ import { writeFileAtomic } from "../core/io.js";
 import { canonicalHash } from "./canonical.js";
 import { graphSnapshotFromRecords } from "./evaluator.js";
 import { DataClassSchema, POLICY_EVALUATOR } from "./schema.js";
-export const REPLAY_CACHE_ENGINE = { name: "hunch-tsjs-static-index", version: "3" };
+export const REPLAY_CACHE_ENGINE = { name: "hunch-tsjs-static-index", version: "4" };
 const ReplayGraphCacheSchema = z.object({
     version: z.literal(1),
     engine: z.object({ name: z.string().min(1), version: z.string().min(1) }),

package/dist/constitution/replayWorker.js

@@ -13,7 +13,7 @@ let message;
 try {
     store = new HunchStore(hunchPathsForDir(input.graph));
     store.json.ensureDirs();
-    indexRepo(store, input.checkout, { churn: false });
+    indexRepo(store, input.checkout, { churn: false, requireComplete: true });
     message = {
         commit: input.commit,
         snapshot: graphSnapshot(store, input.root, { publicOnly: true, head: input.commit }),