@deksden-com/dd-flow-cli 0.9.0-beta.135 → 0.9.0-beta.137

package/dist/services/vnext-protocolize.js

@@ -4,6 +4,7 @@ import crypto from "node:crypto";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
+import { parse as parseYaml } from "yaml";
 import { AppError } from "../shared/errors.js";
 import { projectFeatureWorktreePath, resolveProjectRoot } from "../storage/paths.js";
 import { previewNextEntityId } from "./ids.js";
@@ -189,6 +190,29 @@ export async function finishVnextProtocolize(context, input) {
     const resultFile = prepareProtocolizeResultPath(requireRunHome(run), input.resultFile);
     const result = input.result ?? readResult(resultFile, { projectRoot, ddFlowHome: context.ddFlowHome, runId: run.id, runRoot: requireRunHome(run) });
     validateSchema({ schemaName: "vnext-protocolize-result", file: resultFile, data: result, projectRoot, ddFlowHome: context.ddFlowHome, runId: run.id, runRoot: requireRunHome(run) });
+    const acceptedIndex = JSON.parse(context.db.get("SELECT index_json FROM runs WHERE project_id = ? AND id = ?", [project.id, run.id]).index_json);
+    if (acceptedIndex.stage_runs.some(item => item.stage === stage && item.status === "done")) {
+        publishStageReport(context, project.id, run.id, stage, root);
+        const file = path.join(root, "stage-report.json");
+        if (!fs.existsSync(file))
+            throw new AppError("protocolize_report_missing", "Completed PROTOCOLIZE has no accepted report to replay", 1, { run_id: run.id });
+        const accepted = JSON.parse(fs.readFileSync(file, "utf8"));
+        const authoredSha = accepted.semantic.materialization?.authored_result?.sha256;
+        if (authoredSha && authoredSha !== sha256(fs.readFileSync(resultFile)))
+            throw new AppError("protocolize_intent_conflict", "Completed PROTOCOLIZE result differs from accepted input", 1, { run_id: run.id });
+        const currentStage = acceptedIndex.current_stage ?? [...acceptedIndex.stage_runs].reverse().find(item => item.status === "running" || item.status === "done")?.stage;
+        const activeReplay = currentStage === stage && acceptedIndex.status === "running";
+        const resolvedPolicy = activeReplay ? requireVnextWorkspaceRoute({ projectRoot, runId: run.id, runHome: requireRunHome(run), workspaceRoot: run.workspace_root, stage: "protocolize" }) : accepted.mechanical?.workspace_route;
+        if (activeReplay) {
+            if (acceptedIndex.verdict !== "protocolized")
+                advanceFlowRun(context, { settlementStage: "protocolize", projectRoot, runId: run.id, status: "running", verdict: "protocolized", nextAction: "start_plan" });
+            refreshRunWorkProjection(context, project.id, run.id);
+        }
+        const next = activeReplay ? stageSuccessor(context, { projectRoot, runId: run.id, stage: "plan", command: `${flowCommand(context)} stage start ${run.id} --stage plan --project-root ${JSON.stringify(projectRoot)} --json`, metadata: { cwd: run.workspace_root, session_mode: resolvedPolicy.stage_session_mode } }) : { kind: "complete", outcome: "already_completed" };
+        return { ok: true, outcome: "protocolized", run_id: run.id, protocol_ids: accepted.semantic.acceptance, workspace_root: run.workspace_root, git_policy: resolvedPolicy, next_action: activeReplay ? "await_plan" : acceptedIndex.next_action, ...("command" in next && next.command ? { next_command: next.command } : {}), next,
+            artifacts: { result: resultFile, report_json: file, report_markdown: path.join(root, "stage-report.md"), report_html: path.join(root, "stage-report.html"), protocols: accepted.semantic.acceptance.map(id => path.join(run.workspace_root, ".memory-bank/protocol", id, "summary.md")) } };
+    }
+    const resolvedPolicy = requireVnextWorkspaceRoute({ projectRoot, runId: run.id, runHome: requireRunHome(run), workspaceRoot: run.workspace_root, stage: "protocolize" });
     const acceptedObligations = acceptedSpecifyObligations(context, projectRoot, run.id, path.join(requireRunHome(run), "01-specify", "specify.json"));
     let obligations;
     try {
@@ -202,11 +226,11 @@ export async function finishVnextProtocolize(context, input) {
             throw error;
         throw new AppError(error.code, error.message, error.exitCode, { ...error.details, phase: "prepare", effect: "no_effect", recoverable: true });
     }
-    const resolvedPolicy = requireVnextWorkspaceRoute({ projectRoot, runId: run.id, runHome: requireRunHome(run), workspaceRoot: run.workspace_root, stage: "protocolize" });
     const receipt = readWorkspaceRouteReceipt(root);
     const workspaceRoot = run.workspace_root;
     const intent = await prepareProtocolizeIntent(context, run, resultFile, result, obligations);
     publishProtocolizeIntent(context, project.id, intent);
+    const materialization = verifyProtocolizeMaterialization(intent, result, path.relative(requireRunHome(run), resultFile));
     const protocolIds = intent.protocol_ids;
     const changedFiles = intent.changed_files;
     for (const protocolId of protocolIds)
@@ -216,9 +240,10 @@ export async function finishVnextProtocolize(context, input) {
             ensureManagedWorktreeRecorded(context, { protocolId, projectRoot, branch: requiredPolicyValue(resolvedPolicy.feature_branch, "feature branch"), base: requiredPolicyValue(resolvedPolicy.base_ref, "base ref"), created: receipt.created, bootstrap: receipt.bootstrap });
     }
     const now = context.now();
-    const workSession = completeWorkSession(context, work.work_id, resultFile, now);
+    const workSession = context.db.get("SELECT * FROM work_sessions WHERE work_id = ? AND status = 'running' ORDER BY created_at DESC LIMIT 1", [work.work_id]);
     const routedRun = requireRun(context, projectRoot, run.id);
     const report = stageReport(context, routedRun, resultFile, protocolIds, changedFiles, workSession?.session_id ?? null, now, resolvedPolicy);
+    Object.assign(report.semantic, { materialization });
     const reportJson = path.join(root, "stage-report.json");
     const reportMarkdown = path.join(root, "stage-report.md");
     const reportHtml = path.join(root, "stage-report.html");
@@ -235,6 +260,7 @@ export async function finishVnextProtocolize(context, input) {
         const completion = { projectRoot, runId: run.id, stage, status: "done", data: "protocolize-result.json", dataSchemaId: "dd-flow/vnext-protocolize-result@3", report: "stage-report.md", stageReport: "stage-report.html", dataSha256: crypto.createHash("sha256").update(fs.readFileSync(resultFile)).digest("hex") };
         const preparedCompletion = prepareFlowRunStageCompletion(context, completion);
         withStageSettlement(context, () => {
+            completeWorkSession(context, work.work_id, resultFile, now);
             acceptStageReport(context, { projectId: project.id, runId: run.id, stage, root, prepared: preparedReport });
             completeFlowRunStage(context, completion, preparedCompletion);
         });
@@ -367,6 +393,38 @@ function ensureManagedWorktreeRecorded(context, input) {
     recordManagedWorktree(context, input);
 }
 function sha256(bytes) { return crypto.createHash("sha256").update(bytes).digest("hex"); }
+export function verifyProtocolizeMaterialization(intent, result, authoredPath) {
+    const documents = intent.files.map(file => {
+        const target = path.resolve(intent.workspace_root, file.relative);
+        inside(path.join(intent.workspace_root, ".memory-bank"), target);
+        assertNoSymlinkPath(path.join(intent.workspace_root, ".memory-bank"), target);
+        const bytes = fs.readFileSync(target);
+        if (sha256(bytes) !== file.after_sha256)
+            throw new AppError("protocolize_materialization_invalid", "Published document differs from accepted intent", 1, { path: file.relative });
+        return { path: file.relative, sha256: file.after_sha256 };
+    });
+    const featurePaths = intent.changed_files.filter(file => /\/features\/FT-[^/]+\/index\.md$/.test(file));
+    const featurePath = result.feature.action === "not_applicable" ? null : featurePaths.length === 1 ? featurePaths[0] : null;
+    if (result.feature.action !== "not_applicable" && !featurePath)
+        throw new AppError("protocolize_materialization_invalid", "Accepted feature output is ambiguous or missing", 1);
+    const frontmatter = (relative) => {
+        const text = fs.readFileSync(path.join(intent.workspace_root, relative), "utf8");
+        const match = /^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/.exec(text);
+        const value = match ? parseYaml(match[1]) : null;
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            throw new AppError("protocolize_materialization_invalid", "Published document lacks frontmatter", 1, { path: relative });
+        return value;
+    };
+    const edges = featurePath ? intent.protocol_ids.map(protocolId => ({ feature_path: featurePath, protocol_id: protocolId, protocol_path: `.memory-bank/protocol/${protocolId}/summary.md` })) : [];
+    for (const edge of edges) {
+        const protocols = frontmatter(edge.feature_path).related_protocols;
+        const features = frontmatter(edge.protocol_path).related_features;
+        if (!Array.isArray(protocols) || !protocols.includes(edge.protocol_id) || !Array.isArray(features) || !features.includes(edge.feature_path))
+            throw new AppError("protocolize_materialization_invalid", "Owned feature/protocol links are not reciprocal", 1, edge);
+    }
+    return { schema_id: "dd-flow/protocolize-materialization@1", run_id: intent.run_id, stage: "protocolize", action: result.feature.action, feature_path: featurePath,
+        protocol_ids: intent.protocol_ids, authored_result: { role: "authored_input", run_relative_path: authoredPath, sha256: intent.result_sha256 }, documents, owned_links: edges, status: "passed" };
+}
 async function materialize(projectRoot, runId, runHome, result, obligations, ids, psetId) {
     const psetPath = psetId ? path.join(projectRoot, ".memory-bank", "protocol", "_set", `${psetId}.md`) : null;
     const created = [];

package/dist/storage/database.js

@@ -5,7 +5,7 @@ import { channel } from "node:diagnostics_channel";
 import { createRequire } from "node:module";
 import { ensureDir } from "./paths.js";
 import { AppError } from "../shared/errors.js";
-import { executeStoreSchema, readStoreWriterContract, registerStoreWriter, STORE_WRITER_VERSION } from "./writer-contract.js";
+import { executeStoreSchema, readStoreWriterContract, registerStoreWriter, registerReconciliationWriter, STORE_WRITER_VERSION } from "./writer-contract.js";
 import { assertImportAdmission } from "./import-guard.js";
 import { withStoreCleanup, rollbackStoreTransaction } from "./native-cleanup.js";
 const workContinuationStorageSql = `
@@ -354,6 +354,8 @@ export function getDatabase(ddFlowHome, mode = "initialize", importPermitId, hoo
     }
     if (mode === "hook" && !exists)
         throw new AppError("hook_storage_unprepared", "Prepare the runtime store before starting native hooks", 1);
+    if (mode === "reconcile" && !exists)
+        throw new AppError("reconciliation_storage_unprepared", "Reconciliation cannot create a runtime store", 1);
     if (!exists || mode === "migrate")
         ensureDir(ddFlowHome);
     const db = mode === "read_existing" ? new DatabaseSync(dbPath, { readOnly: true }) : new DatabaseSync(dbPath);
@@ -365,7 +367,10 @@ export function getDatabase(ddFlowHome, mode = "initialize", importPermitId, hoo
     }
     if (mode !== "read_existing") {
         try {
-            registerStoreWriter(db);
+            if (mode === "reconcile")
+                registerReconciliationWriter(db);
+            else
+                registerStoreWriter(db);
         }
         catch (error) {
             return closeAfterOpenFailure(db, error);
@@ -379,7 +384,7 @@ export function getDatabase(ddFlowHome, mode = "initialize", importPermitId, hoo
     }
     // Internal additive schema changes must be available to every write command.
     // Higher-level Memory Bank migrations remain explicit in services/migrations.
-    if (mode !== "read_existing") {
+    if (mode !== "read_existing" && mode !== "reconcile") {
         try {
             const initialize = () => { migrate(db); ensureRecoveryStorage(db); ensureLifecycleInvocationStorage(db); };
             if (mode !== "hook") {
@@ -402,6 +407,16 @@ export function getDatabase(ddFlowHome, mode = "initialize", importPermitId, hoo
     }
     if (mode === "read_existing")
         db.exec("PRAGMA query_only = ON");
+    if (mode === "reconcile") {
+        try {
+            db.prepare("SELECT id, project_id, status, verdict, next_action, index_json, updated_at, completed_at FROM runs LIMIT 0");
+            db.prepare("SELECT id, root FROM projects LIMIT 0");
+            db.prepare("SELECT id, event_type, payload_json FROM audit_events LIMIT 0");
+        }
+        catch (error) {
+            return closeAfterOpenFailure(db, error);
+        }
+    }
     db.exec("PRAGMA foreign_keys = ON");
     return databaseFacade(dbPath, mode !== "read_existing", db, undefined, deadline);
 }

package/dist/storage/writer-contract.js

@@ -35,6 +35,14 @@ export function registerStoreWriter(db) {
         throw new AppError("store_writer_incompatible", "This CLI cannot write the store's required contract", 1, { required: current, supported: version });
     db.function("dd_flow_writer_version", () => version);
 }
+/** Health maintenance uses only verified legacy lifecycle columns and never
+ * migrates schema. Keep the retained writer fence, including version 1. */
+export function registerReconciliationWriter(db) {
+    const current = readStoreWriterContract(db);
+    if (current !== null && current !== 1 && current !== version)
+        throw new AppError("store_writer_incompatible", "Unsupported reconciliation writer contract", 1, { required: current, supported: [1, version] });
+    db.function("dd_flow_writer_version", () => current ?? version);
+}
 export function readStoreWriterContract(db) {
     if (!db.prepare("SELECT 1 FROM sqlite_schema WHERE type = 'table' AND name = ?").get(table))
         return null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deksden-com/dd-flow-cli",
-  "version": "0.9.0-beta.135",
+  "version": "0.9.0-beta.137",
   "description": "Mechanical runtime CLI for dd-flow workflows.",
   "type": "module",
   "packageManager": "pnpm@10.23.0",