@davesheffer/hunch 1.8.2 → 1.9.2

package/dist/constitution/repository.js

@@ -1,8 +1,8 @@
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync } from "node:fs";
 import { join } from "node:path";
-import { writeFileAtomic } from "../core/io.js";
+import { writeFileAtomic, writeFileAtomicIfAbsent } from "../core/io.js";
 import { shortHash } from "../core/ids.js";
-import { policySemanticHash, proofPlanContentHash } from "./canonical.js";
+import { canonicalHash, policySemanticHash, proofPlanContentHash } from "./canonical.js";
 import { proofCorpusContentHash } from "./corpus.js";
 import { currentHistoryDispositions, historyDispositionContentHash, historyDispositionJudgmentHash } from "./disposition.js";
 import { assertCompositionBinding, compositionDescendants, policyProofHash } from "./composition.js";
@@ -218,9 +218,51 @@ export class PolicyRepository {
         writeFileAtomic(join(dir, `${parsed.id}.json`), encode(parsed));
         return parsed;
     }
-    putProof(proof, policyId) {
+    /** Publish a new policy lifecycle record without overwriting a concurrent
+     * writer. Used by automated proposal materializers so human authority always
+     * wins a race. */
+    putPolicyIfAbsent(policy, opts = {}) {
+        const parsed = PolicySpecSchema.parse(policy);
+        if (opts.private && opts.public)
+            throw new Error("choose only one policy home");
+        const home = opts.private ? "private" : opts.public ? "public" : parsed.data_class !== "public" || this.store.unified ? "private" : "public";
+        if (home === "public" && parsed.data_class !== "public") {
+            throw new Error(`refusing to write ${parsed.data_class} policy ${parsed.id} into the public home`);
+        }
+        const homeOpts = home === "public" ? { publicOnly: true } : { privateOnly: true };
+        const existing = this.getPolicy(parsed.id, homeOpts);
+        const otherHome = this.getPolicy(parsed.id, home === "public" ? { privateOnly: true } : { publicOnly: true });
+        if (existing && otherHome)
+            throw new Error(`policy ${parsed.id} exists in both public and private homes`);
+        if (existing)
+            return { policy: existing, created: false };
+        if (otherHome)
+            throw new Error(`policy ${parsed.id} already exists in the ${home === "public" ? "private" : "public"} home`);
+        const dir = this.dir(home, "policies");
+        mkdirSync(dir, { recursive: true });
+        if (writeFileAtomicIfAbsent(join(dir, `${parsed.id}.json`), encode(parsed))) {
+            const racedOtherHome = this.getPolicy(parsed.id, home === "public" ? { privateOnly: true } : { publicOnly: true });
+            if (racedOtherHome)
+                throw new Error(`policy ${parsed.id} was published concurrently in both public and private homes`);
+            return { policy: parsed, created: true };
+        }
+        const winner = this.getPolicy(parsed.id, homeOpts);
+        if (!winner)
+            throw new Error(`policy ${parsed.id} appeared concurrently but could not be read`);
+        return { policy: winner, created: false };
+    }
+    putProof(proof, policyId, opts = {}) {
         const parsed = PolicyProofSchema.parse(proof);
-        const home = this.homeOfPolicy(policyId) ?? (parsed.data_class === "public" && !this.store.unified ? "public" : "private");
+        if (opts.private && opts.public)
+            throw new Error("choose only one proof home");
+        const home = opts.private
+            ? "private"
+            : opts.public
+                ? "public"
+                : this.homeOfPolicy(policyId) ?? (parsed.data_class === "public" && !this.store.unified ? "public" : "private");
+        if (home === "public" && parsed.data_class !== "public") {
+            throw new Error(`refusing to write ${parsed.data_class} proof ${parsed.id} into the public home`);
+        }
         const homeOpts = home === "public" ? { publicOnly: true } : { privateOnly: true };
         const policy = this.getPolicy(policyId, homeOpts);
         if (policy) {
@@ -240,6 +282,50 @@ export class PolicyRepository {
         writeFileAtomic(join(dir, `${parsed.id}.json`), encode(parsed));
         return parsed;
     }
+    /** Publish an immutable proof without replacing a concurrent writer. */
+    putProofIfAbsent(proof, policyId, opts = {}) {
+        const parsed = PolicyProofSchema.parse(proof);
+        if (opts.private && opts.public)
+            throw new Error("choose only one proof home");
+        const home = opts.private
+            ? "private"
+            : opts.public
+                ? "public"
+                : this.homeOfPolicy(policyId) ?? (parsed.data_class === "public" && !this.store.unified ? "public" : "private");
+        if (home === "public" && parsed.data_class !== "public") {
+            throw new Error(`refusing to write ${parsed.data_class} proof ${parsed.id} into the public home`);
+        }
+        const homeOpts = home === "public" ? { publicOnly: true } : { privateOnly: true };
+        const policy = this.getPolicy(policyId, homeOpts);
+        if (policy) {
+            const composition = compositionDescendants(policy, this.listPolicies(homeOpts));
+            assertCompositionBinding(policy, composition, parsed.composition);
+            if (parsed.policy_hash !== policyProofHash(policy, composition))
+                throw new Error(`composite proof ${parsed.id} policy hash mismatch`);
+            if (composition.length) {
+                const plan = this.listPlans(homeOpts).find((candidate) => candidate.content_hash === parsed.plan_hash);
+                if (!plan || plan.policy_candidate_hash !== parsed.policy_hash)
+                    throw new Error(`composite proof ${parsed.id} has no exact bound proof plan`);
+                assertCompositionBinding(policy, composition, plan.composition);
+            }
+        }
+        const existing = this.getProof(parsed.id, homeOpts);
+        if (existing) {
+            if (immutableProofHash(existing) !== immutableProofHash(parsed))
+                throw new Error(`proof ${parsed.id} already exists with different immutable content`);
+            return { proof: existing, created: false };
+        }
+        const dir = this.dir(home, "proofs");
+        mkdirSync(dir, { recursive: true });
+        if (writeFileAtomicIfAbsent(join(dir, `${parsed.id}.json`), encode(parsed)))
+            return { proof: parsed, created: true };
+        const winner = this.getProof(parsed.id, homeOpts);
+        if (!winner)
+            throw new Error(`proof ${parsed.id} appeared concurrently but could not be read`);
+        if (immutableProofHash(winner) !== immutableProofHash(parsed))
+            throw new Error(`proof ${parsed.id} appeared concurrently with different immutable content`);
+        return { proof: winner, created: false };
+    }
     putPlan(plan, policyId, opts = {}) {
         const parsed = validatePlan(plan);
         if (opts.private && opts.public)
@@ -249,6 +335,9 @@ export class PolicyRepository {
             : opts.public
                 ? "public"
                 : this.homeOfPolicy(policyId) ?? (parsed.data_class === "public" && !this.store.unified ? "public" : "private");
+        if (home === "public" && parsed.data_class !== "public") {
+            throw new Error(`refusing to write ${parsed.data_class} proof plan ${parsed.id} into the public home`);
+        }
         const homeOpts = home === "public" ? { publicOnly: true } : { privateOnly: true };
         const policy = this.getPolicy(policyId, homeOpts);
         if (policy) {
@@ -262,6 +351,44 @@ export class PolicyRepository {
         writeFileAtomic(join(dir, `${parsed.id}.json`), encode(parsed));
         return parsed;
     }
+    /** Publish an immutable proof plan without replacing a concurrent writer. */
+    putPlanIfAbsent(plan, policyId, opts = {}) {
+        const parsed = validatePlan(plan);
+        if (opts.private && opts.public)
+            throw new Error("choose only one proof-plan home");
+        const home = opts.private
+            ? "private"
+            : opts.public
+                ? "public"
+                : this.homeOfPolicy(policyId) ?? (parsed.data_class === "public" && !this.store.unified ? "public" : "private");
+        if (home === "public" && parsed.data_class !== "public") {
+            throw new Error(`refusing to write ${parsed.data_class} proof plan ${parsed.id} into the public home`);
+        }
+        const homeOpts = home === "public" ? { publicOnly: true } : { privateOnly: true };
+        const policy = this.getPolicy(policyId, homeOpts);
+        if (policy) {
+            const composition = compositionDescendants(policy, this.listPolicies(homeOpts));
+            assertCompositionBinding(policy, composition, parsed.composition);
+            if (parsed.policy_candidate_hash !== policyProofHash(policy, composition))
+                throw new Error(`composite plan ${parsed.id} policy hash mismatch`);
+        }
+        const existing = this.getPlan(parsed.id, homeOpts);
+        if (existing) {
+            if (existing.content_hash !== parsed.content_hash)
+                throw new Error(`proof plan ${parsed.id} already exists with different immutable content`);
+            return { plan: existing, created: false };
+        }
+        const dir = this.dir(home, "plans");
+        mkdirSync(dir, { recursive: true });
+        if (writeFileAtomicIfAbsent(join(dir, `${parsed.id}.json`), encode(parsed)))
+            return { plan: parsed, created: true };
+        const winner = this.getPlan(parsed.id, homeOpts);
+        if (!winner)
+            throw new Error(`proof plan ${parsed.id} appeared concurrently but could not be read`);
+        if (winner.content_hash !== parsed.content_hash)
+            throw new Error(`proof plan ${parsed.id} appeared concurrently with different immutable content`);
+        return { plan: winner, created: false };
+    }
     putCorpus(corpus, policyId) {
         const parsed = validateCorpus(corpus);
         if (parsed.policy_id !== policyId)
@@ -280,7 +407,12 @@ export class PolicyRepository {
     }
     putEvidence(event, opts = {}) {
         const parsed = EvidenceEventSchema.parse(event);
-        const home = opts.private || parsed.data_class !== "public" || this.store.unified ? "private" : "public";
+        if (opts.private && opts.public)
+            throw new Error("choose only one evidence home");
+        const home = opts.private ? "private" : opts.public ? "public" : parsed.data_class !== "public" || this.store.unified ? "private" : "public";
+        if (home === "public" && parsed.data_class !== "public") {
+            throw new Error(`refusing to write ${parsed.data_class} evidence ${parsed.id} into the public home`);
+        }
         const dir = this.dir(home, "evidence");
         mkdirSync(dir, { recursive: true });
         writeFileAtomic(join(dir, `${parsed.id}.json`), encode(parsed));
@@ -395,6 +527,10 @@ export class PolicyRepository {
         return parsed;
     }
 }
+function immutableProofHash(proof) {
+    const { generated_at: _generatedAt, ...payload } = proof;
+    return canonicalHash(payload);
+}
 function validatePlan(raw) {
     const plan = ProofPlanSchema.parse(raw);
     const hash = proofPlanContentHash(plan);

package/dist/constitution/safeCheckout.js

@@ -0,0 +1,75 @@
+import { execFileSync } from "node:child_process";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+const CHECKOUT_TRANSFORM_ATTRIBUTES = ["filter", "working-tree-encoding", "ident", "eol", "text", "crlf"];
+const MAX_ATTRIBUTE_BYTES = 64 * 1024 * 1024;
+function nulFields(bytes) {
+    const fields = [];
+    let start = 0;
+    for (let end = bytes.indexOf(0, start); end !== -1; end = bytes.indexOf(0, start)) {
+        fields.push(bytes.subarray(start, end));
+        start = end + 1;
+    }
+    if (start < bytes.length)
+        fields.push(bytes.subarray(start));
+    return fields;
+}
+/** Inspect the exact target tree plus repository-local info attributes without
+ * checking it out. Any checkout transform could execute code or make the worktree
+ * bytes diverge from the raw blobs bound by receipts, so fail closed. Merge
+ * attributes are intentionally excluded: worktree materialization never invokes a
+ * merge driver. LFS is allowed only when callers explicitly disable its
+ * smudge/process hooks. */
+export function hasUnsafeCheckoutAttributes(root, commit, env, opts = {}) {
+    const session = mkdtempSync(join(tmpdir(), "hunch-attr-index-"));
+    const index = join(session, "index");
+    const exactEnv = { ...env, GIT_INDEX_FILE: index, GIT_NO_REPLACE_OBJECTS: "1", GIT_ATTR_NOSYSTEM: "1" };
+    try {
+        execFileSync("git", ["-C", root, "read-tree", commit], {
+            env: exactEnv,
+            timeout: 10_000,
+            maxBuffer: MAX_ATTRIBUTE_BYTES,
+            stdio: ["ignore", "ignore", "ignore"],
+        });
+        const paths = execFileSync("git", ["-C", root, "ls-files", "-z"], {
+            env: exactEnv,
+            timeout: 10_000,
+            maxBuffer: MAX_ATTRIBUTE_BYTES,
+            encoding: "buffer",
+            stdio: ["ignore", "pipe", "ignore"],
+        });
+        if (!paths.length)
+            return false;
+        const raw = execFileSync("git", ["-C", root, "check-attr", "--cached", "-z", "--stdin", ...CHECKOUT_TRANSFORM_ATTRIBUTES], {
+            env: exactEnv,
+            input: paths,
+            timeout: 10_000,
+            maxBuffer: MAX_ATTRIBUTE_BYTES,
+            encoding: "buffer",
+            stdio: ["pipe", "pipe", "ignore"],
+        });
+        const fields = nulFields(raw);
+        if (fields.length % 3 !== 0)
+            return true;
+        for (let index = 0; index < fields.length; index += 3) {
+            const attribute = fields[index + 1].toString("utf8");
+            const value = fields[index + 2].toString("utf8");
+            if (!CHECKOUT_TRANSFORM_ATTRIBUTES.includes(attribute))
+                return true;
+            if (value === "unspecified" || value === "unset")
+                continue;
+            if (opts.allowDisabledLfs && attribute === "filter" && value === "lfs")
+                continue;
+            return true;
+        }
+        return false;
+    }
+    catch {
+        return true;
+    }
+    finally {
+        rmSync(session, { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=safeCheckout.js.map

package/dist/constitution/schema.js

@@ -4,6 +4,10 @@ export const POLICY_IR_VERSION = 1;
 export const POLICY_EVALUATOR = { name: "hunch-graph-policy", version: "1.3.0" };
 export const MUTATION_ENGINE = { name: "hunch-static-graph-controls", version: "5" };
 export const EXECUTABLE_BEHAVIOR_IR_VERSION = 2;
+/** Source-gated correction policies deliberately use an IR unknown to pre-Matrix
+ * clients. Those clients then reject the artifact instead of loading it without
+ * understanding (and potentially bypassing) its activation gate. */
+export const CORRECTION_POLICY_IR_VERSION = 3;
 export const BEHAVIOR_POLICY_EVALUATOR = { name: "hunch-executable-behavior", version: "1.0.0" };
 export const BEHAVIOR_MUTATION_ENGINE = { name: "hunch-behavior-controls", version: "1" };
 export const DataClassSchema = z.enum(["public", "private", "secret"]);
@@ -195,10 +199,20 @@ export const PolicyAuthoritySchema = z.object({
     event: z.string().min(1),
     at: z.string().datetime({ offset: true }),
 });
+export const PolicyActivationGateSchema = z.object({
+    kind: z.literal("source_currentness"),
+    status: z.literal("blocked"),
+    reason: z.string().min(1),
+}).strict();
 export const PolicySpecSchema = z.object({
     id: z.string().regex(/^pol_[a-f0-9]{10}$/),
     topic: z.string().min(1),
-    ir_version: z.union([z.literal(POLICY_IR_VERSION), z.literal(EXECUTABLE_BEHAVIOR_IR_VERSION)]),
+    origin: z.enum(["generic", "correction_md1a"]).default("generic"),
+    ir_version: z.union([
+        z.literal(POLICY_IR_VERSION),
+        z.literal(EXECUTABLE_BEHAVIOR_IR_VERSION),
+        z.literal(CORRECTION_POLICY_IR_VERSION),
+    ]),
     revision: z.number().int().min(1),
     state: PolicyStateSchema,
     statement: z.string().min(1),
@@ -208,6 +222,7 @@ export const PolicySpecSchema = z.object({
     severity: z.enum(["advisory", "warning", "blocking"]).default("warning"),
     surfaces: z.array(z.enum(["pre_edit", "pre_commit", "ci", "mcp", "cli"])).default(["cli", "mcp"]),
     authority: PolicyAuthoritySchema.nullable().default(null),
+    activation_gate: PolicyActivationGateSchema.nullable().default(null),
     evidence: z.array(z.string()).default([]),
     proof: z.string().nullable().default(null),
     reversal_conditions: z.array(z.string()).default([]),
@@ -225,11 +240,21 @@ export const PolicySpecSchema = z.object({
     updated_at: z.string().datetime({ offset: true }),
     provenance: ProvenanceSchema,
 }).passthrough().superRefine((policy, context) => {
-    if (policy.assertion.kind === "executable-behavior" && policy.ir_version !== EXECUTABLE_BEHAVIOR_IR_VERSION) {
-        context.addIssue({ code: "custom", path: ["ir_version"], message: `executable-behavior requires Policy IR v${EXECUTABLE_BEHAVIOR_IR_VERSION}` });
+    if (policy.origin === "correction_md1a") {
+        if (policy.assertion.kind === "executable-behavior") {
+            context.addIssue({ code: "custom", path: ["assertion", "kind"], message: "source-gated correction policies require a graph assertion" });
+        }
+        if (policy.ir_version !== CORRECTION_POLICY_IR_VERSION) {
+            context.addIssue({ code: "custom", path: ["ir_version"], message: `source-gated correction policies require Policy IR v${CORRECTION_POLICY_IR_VERSION}` });
+        }
     }
-    if (policy.assertion.kind !== "executable-behavior" && policy.ir_version !== POLICY_IR_VERSION) {
-        context.addIssue({ code: "custom", path: ["ir_version"], message: `graph assertions require Policy IR v${POLICY_IR_VERSION}` });
+    else {
+        if (policy.assertion.kind === "executable-behavior" && policy.ir_version !== EXECUTABLE_BEHAVIOR_IR_VERSION) {
+            context.addIssue({ code: "custom", path: ["ir_version"], message: `executable-behavior requires Policy IR v${EXECUTABLE_BEHAVIOR_IR_VERSION}` });
+        }
+        if (policy.assertion.kind !== "executable-behavior" && policy.ir_version !== POLICY_IR_VERSION) {
+            context.addIssue({ code: "custom", path: ["ir_version"], message: `graph assertions require Policy IR v${POLICY_IR_VERSION}` });
+        }
     }
 });
 export const PolicyCompositionMemberSchema = z.object({

package/dist/constitution/service.js

@@ -1,10 +1,11 @@
 import { execFileSync, spawnSync } from "node:child_process";
 import { headSha } from "../extractors/git.js";
 import { canonicalHash, canonicalJson } from "./canonical.js";
+import { replacementFreeGitEnvironment } from "./replacementFreeGit.js";
 import { shortHash } from "../core/ids.js";
 import { compileDecisionPolicy } from "./compiler.js";
-import { evaluatePolicy, policyBlocks, policyIsActive } from "./evaluator.js";
-import { approvePolicy, blockingProofError, demotePolicy, linkPolicyException, proposeProvedPolicy, retirePolicy, withdrawPolicy } from "./lifecycle.js";
+import { evaluatePolicy, policyBlocks } from "./evaluator.js";
+import { activationGateError, approvePolicy, blockingProofError, demotePolicy, linkPolicyException, proposeProvedPolicy, retirePolicy, withdrawPolicy } from "./lifecycle.js";
 import { provePolicy } from "./proof.js";
 import { PolicyRepository } from "./repository.js";
 import { bootstrapPolicies } from "./bootstrap.js";
@@ -31,8 +32,19 @@ import { evaluateExecutableBehaviorPolicy } from "./behaviorEvaluator.js";
 import { executeG2OperationalDrill } from "./g2Drills.js";
 import { G3_REQUIRED_EXPERIMENTS, G3EvidenceRepository, compileExperimentPreregistration, compileG3Plan, compileProofReviewMeasurement, scoreG3Readiness, } from "./g3.js";
 import { executeG3AdapterConformance, g3ConformanceSourceHash } from "./g3Conformance.js";
-import { ExperimentRepository, assignmentTreatment, buildExperimentReport, compileExperimentCaseBank, compileExperimentFollowup, compileExperimentOutcome, compileExperimentReviewStart, compileExperimentRun, compileExperimentStop, compileExp03ReviewResponse, currentExperimentOutcomes, normalizedEditDistance, } from "./experiment.js";
+import { ExperimentRepository, assignmentTreatment, buildExperimentReport, compileExperimentCaseBank, compileExperimentFollowup, compileExperimentOutcome, compileExperimentReviewStart, compileExperimentReviewerQualification, compileExperimentRun, compileExperimentStop, compileExp03ReviewResponse, currentExperimentOutcomes, experimentReviewGuide, normalizedEditDistance, } from "./experiment.js";
 import { executeExp01Assignment } from "./experimentRunner.js";
+import { materializeCorrectionPolicies, materializeCorrectionPolicy, } from "./correctionPolicyMaterializer.js";
+export function policyEvaluationEnvelope(result) {
+    return {
+        ...result.evaluation,
+        enforcement: {
+            blocks: result.blocks,
+            strict_error: result.strict_error,
+            gate_error: result.gate_error ?? null,
+        },
+    };
+}
 function relationSummary(policy) {
     return {
         id: policy.id,
@@ -76,6 +88,7 @@ export function shadowCommitEligible(root, policy, commit) {
     const sourceCommit = policy.assertion.test.source_commit;
     const check = spawnSync("git", ["-C", root, "merge-base", "--is-ancestor", sourceCommit, commit], {
         encoding: "utf8",
+        env: replacementFreeGitEnvironment(),
         stdio: ["ignore", "ignore", "pipe"],
     });
     if (check.status === 0)
@@ -492,11 +505,22 @@ export class ConstitutionService {
         const bank = this.experimentRepository.listCaseBanks().find((item) => item.id === run.case_bank_id);
         if (!bank)
             throw new Error(`run ${run.id} is missing exact case bank ${run.case_bank_id}`);
+        const preregistration = this.g3Repository.listExperiments().find((item) => item.id === run.preregistration_id && item.content_hash === run.preregistration_hash);
+        const usesPlainLanguageReview = bank.cases.some((item) => "required_relationship" in item);
+        if (usesPlainLanguageReview && !preregistration)
+            throw new Error(`run ${run.id} is missing exact preregistration ${run.preregistration_id}`);
+        if (preregistration && preregistration.revision >= 2) {
+            const qualification = this.experimentRepository.listReviewerQualifications().find((item) => item.preregistration_id === preregistration.id && item.preregistration_hash === preregistration.content_hash && item.reviewer === reviewer);
+            if (!qualification)
+                throw new Error(`${reviewer} must pass the excluded plain-language comprehension check before a revision-${preregistration.revision} timed review`);
+            const targetReviewers = new Set(bank.cases.map((item) => item.strata.target_reviewer).filter(Boolean));
+            if (targetReviewers.has(reviewer) || targetReviewers.has(reviewer.replace(/^human:/i, "")))
+                throw new Error(`${reviewer} cannot perform timed reviews because the same actor labeled revision-${preregistration.revision} targets`);
+        }
         // Single-operator mitigation (expreg_9c9617cd13, revision >= 3): at least 48 hours
         // must separate the case-bank lock from the FIRST review start — enforced, not
         // merely auditable, so a violation is impossible rather than post-hoc visible.
-        const prereg = this.g3Repository.listExperiments().find((item) => item.id === run.preregistration_id);
-        if (prereg && prereg.revision >= 3) {
+        if (preregistration && preregistration.revision >= 3) {
             const elapsed = Date.parse(opts.now ?? new Date().toISOString()) - Date.parse(bank.locked_at);
             const hasStart = this.experimentRepository.listReviewStarts().some((item) => item.run_id === run.id);
             if (!hasStart && elapsed < 48 * 3_600_000) {
@@ -518,7 +542,13 @@ export class ConstitutionService {
         if (!assignment)
             throw new Error(`no unreviewed EXP-03 assignment is available for ${reviewer}`);
         const start = existing ?? this.experimentRepository.putReviewStart(compileExperimentReviewStart(run, assignment, reviewer, opts));
-        return { start, assignment, treatment: assignmentTreatment(bank, run, assignment) };
+        return { start, assignment, treatment: assignmentTreatment(bank, run, assignment), review_guide: experimentReviewGuide(assignment.arm) };
+    }
+    qualifyExperimentReviewer(input, opts = {}) {
+        const preregistration = this.g3Repository.currentExperiments().find((item) => item.experiment === "EXP-03");
+        if (!preregistration)
+            throw new Error("no current EXP-03 preregistration");
+        return this.experimentRepository.putReviewerQualification(compileExperimentReviewerQualification(input, preregistration, opts));
     }
     /** Resolve an EXP-03 run/assignment/case triple (the shared lookup for both
      *  review-submission dialects). */
@@ -676,6 +706,7 @@ export class ConstitutionService {
         const manifest = this.g2Repository.currentPlan();
         const commits = manifest ? execFileSync("git", ["-C", this.root, "rev-list", "--first-parent", `--max-count=${maxCommits}`, "HEAD"], {
             encoding: "utf8",
+            env: replacementFreeGitEnvironment(),
             stdio: ["ignore", "pipe", "ignore"],
         }).trim().split("\n").filter((commit) => /^[a-f0-9]{40}$/.test(commit)) : [];
         const attempted = (manifest?.policy_ids.length ?? 0) * commits.length;
@@ -927,6 +958,12 @@ export class ConstitutionService {
     ingest(opts = {}) {
         return ingestLocalEvidence(this.store, this.root, this.repository, opts);
     }
+    upgradeCorrection(id, opts = {}) {
+        return materializeCorrectionPolicy(this.store, this.root, this.repository, id, opts);
+    }
+    upgradeCorrections(opts = {}) {
+        return materializeCorrectionPolicies(this.store, this.root, this.repository, opts);
+    }
     plan(id, opts = {}) {
         const policy = this.get(id, opts);
         const home = opts.publicOnly ? "public" : opts.privateOnly ? "private" : this.repository.homeOfPolicy(id);
@@ -944,7 +981,7 @@ export class ConstitutionService {
         const publicOnly = policy.data_class === "public" && this.repository.homeOfPolicy(id) === "public";
         const homeOpts = publicOnly ? { publicOnly: true } : { privateOnly: true };
         const composition = this.composition(policy, homeOpts);
-        const plan = this.plan(id, { publicOnly, now: opts.now });
+        const plan = this.plan(id, { publicOnly, now: opts.now, repositoryName: opts.repositoryName });
         const proof = provePolicy(this.store, this.root, policy, { publicOnly, now: opts.now, plan, composition });
         this.repository.putProof(proof, policy.id);
         const proposed = proposeProvedPolicy(policy, proof, opts.now ?? proof.generated_at, composition, this.g2BehaviorAttestationRepository.current());
@@ -1020,13 +1057,18 @@ export class ConstitutionService {
             throw new Error(`historical shadow backfill supports executable-behavior policies only; ${policy.id} is ${policy.assertion.kind}`);
         }
         else {
-            evaluation = evaluatePolicy(this.store, this.root, policy, { publicOnly: home === "public", composition });
+            evaluation = evaluatePolicy(this.store, this.root, policy, {
+                publicOnly: home === "public",
+                composition,
+                snapshot: opts.snapshot,
+                behavior: opts.behavior,
+            });
         }
         const latencyMs = opts.latencyMs ?? performance.now() - started;
         const sameMatches = canonicalJson(evaluation.matches);
         const alsoDetectedBy = evaluation.result === "violated"
             && (!opts.commit || opts.commit === currentHead)
-            ? this.evaluate({ activeOnly: true, publicOnly: home === "public" })
+            ? this.evaluate({ activeOnly: true, publicOnly: home === "public", snapshot: opts.snapshot, behavior: opts.behavior })
                 .filter((candidate) => candidate.policy.id !== id
                 && candidate.evaluation.result === "violated"
                 && canonicalJson(candidate.evaluation.matches) === sameMatches)
@@ -1057,7 +1099,10 @@ export class ConstitutionService {
         const audit = this.repository.listShadowDispositions(opts).filter((record) => record.policy_id === id);
         const current = currentShadowDispositions(audit);
         const history = this.repository.listDispositions(opts).filter((record) => record.policy_id === id && record.proof_id === proof.id);
-        const scoringRecords = records.filter((record) => shadowCommitEligible(this.root, policy, record.evaluation.repository.head));
+        const scoringRecords = records.filter((record) => shadowCommitEligible(this.root, policy, 
+        // Workspace receipts retain their content-addressed pseudo-head for
+        // dedupe, but ancestry eligibility is anchored to the real base commit.
+        record.evaluation.repository.base ?? record.evaluation.repository.head));
         const report = scoreShadowPrecision(policy, proof, scoringRecords, audit, history, thresholds);
         return {
             ...report,
@@ -1183,11 +1228,21 @@ export class ConstitutionService {
     }
     evaluate(opts = {}) {
         let policies = opts.id ? [this.get(opts.id, opts)] : this.list(opts);
-        if (opts.activeOnly)
-            policies = policies.filter(policyIsActive);
+        // Select the persisted active lifecycle states, including invalid/tampered
+        // ones. The evaluator below must surface their gate/proof error so strict CI
+        // fails visibly; filtering through policyIsActive would silently erase the
+        // exact fail-closed configuration errors this seam is responsible for.
+        if (opts.activeOnly) {
+            policies = policies.filter((policy) => policy.state === "active_advisory" || policy.state === "active_blocking");
+        }
         return policies.map((policy) => {
             const composition = this.composition(policy, opts);
-            const evaluation = evaluatePolicy(this.store, this.root, policy, { publicOnly: opts.publicOnly, composition, behavior: opts.behavior });
+            const evaluation = evaluatePolicy(this.store, this.root, policy, {
+                publicOnly: opts.publicOnly,
+                composition,
+                behavior: opts.behavior,
+                snapshot: opts.snapshot,
+            });
             let proof;
             let dispositions = [];
             if (policy.state === "active_blocking" && policy.proof) {
@@ -1197,7 +1252,12 @@ export class ConstitutionService {
                 dispositions = this.repository.listDispositions(homeOpts).filter((record) => record.policy_id === policy.id && record.proof_id === policy.proof);
             }
             const behaviorBindingError = executableBehaviorAttestationError(policy, this.g2BehaviorAttestationRepository.current());
-            const gateError = behaviorBindingError ?? blockingProofError(policy, proof, dispositions, composition, this.g2BehaviorAttestationRepository.current());
+            const activeActivationError = policy.state === "active_advisory" || policy.state === "active_blocking"
+                ? activationGateError(policy)
+                : null;
+            const gateError = behaviorBindingError
+                ?? activeActivationError
+                ?? blockingProofError(policy, proof, dispositions, composition, this.g2BehaviorAttestationRepository.current());
             return {
                 policy,
                 evaluation,

package/dist/constitution/sourceMutation.js

@@ -1,6 +1,6 @@
 import { execFileSync } from "node:child_process";
-import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { dirname, join, posix, relative } from "node:path";
+import { closeSync, constants, fstatSync, ftruncateSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, realpathSync, rmSync, writeFileSync, writeSync, } from "node:fs";
+import { dirname, isAbsolute, join, posix, relative, resolve, sep } from "node:path";
 import { hunchPathsForDir } from "../core/paths.js";
 import { symbolId } from "../core/ids.js";
 import { externalPackage } from "../core/externalImports.js";
@@ -11,6 +11,7 @@ import { parseSource } from "../extractors/parse.js";
 import { HunchStore } from "../store/hunchStore.js";
 import { canonicalHash } from "./canonical.js";
 import { evaluatePolicyOnSnapshot, graphSnapshot } from "./evaluator.js";
+import { hasUnsafeCheckoutAttributes } from "./safeCheckout.js";
 function safeEnvironment(home, gitConfig) {
     const env = {};
     for (const key of ["PATH", "SystemRoot", "WINDIR", "TMPDIR", "TMP", "TEMP"]) {
@@ -22,6 +23,7 @@ function safeEnvironment(home, gitConfig) {
         HOME: home,
         GIT_CONFIG_GLOBAL: gitConfig,
         GIT_CONFIG_NOSYSTEM: "1",
+        GIT_NO_REPLACE_OBJECTS: "1",
         GIT_TERMINAL_PROMPT: "0",
         GIT_LFS_SKIP_SMUDGE: "1",
         HUNCH_PRIVATE_DIR: "",
@@ -232,6 +234,37 @@ function removeWorktree(root, hooks, env, checkout) {
         }
     }
 }
+function openRegularSourceNoFollow(checkout, sourceFile) {
+    const file = join(checkout, sourceFile);
+    const before = lstatSync(file);
+    if (before.isSymbolicLink())
+        throw new Error("mutation-source-symlink-unsupported");
+    if (!before.isFile())
+        throw new Error("mutation-source-not-regular");
+    const canonicalCheckout = realpathSync(checkout);
+    const canonicalFile = realpathSync(file);
+    const fromCheckout = relative(canonicalCheckout, canonicalFile);
+    if (!fromCheckout || fromCheckout === ".." || fromCheckout.startsWith(`..${sep}`) || isAbsolute(fromCheckout)
+        || canonicalFile !== resolve(canonicalCheckout, sourceFile)) {
+        throw new Error("mutation-source-outside-checkout");
+    }
+    let descriptor;
+    try {
+        descriptor = openSync(file, constants.O_RDWR | constants.O_NOFOLLOW);
+        const opened = fstatSync(descriptor);
+        if (!opened.isFile() || opened.dev !== before.dev || opened.ino !== before.ino) {
+            throw new Error("mutation-source-changed-before-open");
+        }
+        return descriptor;
+    }
+    catch (error) {
+        if (descriptor !== undefined)
+            closeSync(descriptor);
+        if (error.code === "ELOOP")
+            throw new Error("mutation-source-symlink-unsupported");
+        throw error;
+    }
+}
 /** Apply one primary mutation to an immutable disposable source checkout. No
  * project script, build, test, provider, model, or repository hook executes. */
 export function runSourceMutation(root, policy, base) {
@@ -255,6 +288,9 @@ export function runSourceMutation(root, policy, base) {
     try {
         if (unsafeLocalFilter(root, env))
             throw new Error("unsafe-local-filter-config");
+        if (hasUnsafeCheckoutAttributes(root, base.head, env, { allowDisabledLfs: true })) {
+            throw new Error("unsafe-checkout-attributes");
+        }
         execFileSync("git", gitArgs(root, hooks, ["worktree", "add", "--detach", "--force", checkout, base.head]), {
             env,
             timeout: 30_000,
@@ -266,15 +302,32 @@ export function runSourceMutation(root, policy, base) {
         const sourceFile = subject?.file ?? (subjectComponent ? componentFiles(base, subjectComponent)[0] : undefined);
         if (!sourceFile)
             throw new Error("mutation-subject-unresolved");
-        const file = join(checkout, sourceFile);
-        const mutation = mutateSource(policy, base, sourceFile, readFileSync(file, "utf8"));
-        if ("error" in mutation)
-            throw new Error(mutation.error);
-        const parsed = parseSource(mutation.file, mutation.source);
-        if (!parsed?.parseable)
-            throw new Error("mutation-source-unparseable");
-        writeFileSync(file, mutation.source);
-        const diff = execFileSync("git", gitArgs(checkout, hooks, ["diff", "--no-ext-diff", "--", mutation.file]), {
+        const descriptor = openRegularSourceNoFollow(checkout, sourceFile);
+        let mutation;
+        try {
+            const attempted = mutateSource(policy, base, sourceFile, readFileSync(descriptor, "utf8"));
+            if ("error" in attempted)
+                throw new Error(attempted.error);
+            mutation = attempted;
+            if (mutation.file !== sourceFile)
+                throw new Error("mutation-source-target-changed");
+            const parsed = parseSource(mutation.file, mutation.source);
+            if (!parsed?.parseable)
+                throw new Error("mutation-source-unparseable");
+            ftruncateSync(descriptor, 0);
+            const bytes = Buffer.from(mutation.source, "utf8");
+            let written = 0;
+            while (written < bytes.length) {
+                const count = writeSync(descriptor, bytes, written, bytes.length - written, written);
+                if (!count)
+                    throw new Error("mutation-source-write-incomplete");
+                written += count;
+            }
+        }
+        finally {
+            closeSync(descriptor);
+        }
+        const diff = execFileSync("git", gitArgs(checkout, hooks, ["diff", "--no-ext-diff", "--no-textconv", "--", mutation.file]), {
             env,
             encoding: "utf8",
             timeout: 10_000,
@@ -286,7 +339,7 @@ export function runSourceMutation(root, policy, base) {
             throw new Error("mutation-source-diff-too-large");
         store = new HunchStore(hunchPathsForDir(graph));
         store.json.ensureDirs();
-        indexRepo(store, checkout, { churn: false });
+        indexRepo(store, checkout, { churn: false, requireComplete: true });
         const snapshot = graphSnapshot(store, root, { publicOnly: true, head: base.head });
         outcome = {
             snapshot,