@deksden-com/dd-flow-cli 0.9.0-beta.136 → 0.9.0-beta.138

package/dist/services/memory-repair-registration.js

@@ -0,0 +1,239 @@
+import { createHash } from "node:crypto";
+import { AppError } from "../shared/errors.js";
+import { appendAudit } from "./audit.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { PreparedMemoryInitialCorrectionPlan, validateMemoryReviewCorrectionPlan } from "./memory-review-correction-plan.js";
+import { PreparedRetainedMemoryReviewResults } from "./memory-retained-review-results.js";
+import { memoryReviewWaveProjection } from "./memory-review-acceptance.js";
+import { addWorkBatch, prepareWorkBatch, readWorkBatchCustody } from "./work-registry.js";
+export const memoryRepairWorkerSchema = "dd-flow/memory-repair-work-result@1";
+const event = "memory.repair_registration";
+const registrationToken = Symbol("registered-memory-corrections");
+const hash = (bytes) => createHash("sha256").update(bytes).digest("hex");
+function refuse(reason) {
+    throw new AppError("memory_repair_registration_invalid", "Correction Work lacks independently retained plan and review custody", 2, { reason, effect: "no_effect" });
+}
+/** Deterministic allocation projection, not source-byte/write admission. The
+ * task is retained exactly as admitted; profile selection stays in the generic
+ * frozen execution route rather than in a new repair-specific dispatcher.
+ */
+export function memoryRepairBatch(input) {
+    let total = 0;
+    const batch = { works: input.plan.works.map(work => {
+            const packet = { schema_id: "dd-flow/memory-repair-work-packet@1", run_id: input.scope.run_id,
+                stage: "review", wave: input.plan.wave, key: work.key, plan_sha256: input.planSha256,
+                review_sha256: input.plan.review_sha256, original_registration_sha256: input.originalRegistrationSha256,
+                unit_ids: [...work.unit_ids], findings: structuredClone(input.findings.filter(finding => work.finding_ids.includes(finding.id))),
+                write_paths: [...work.write_paths], read_inputs: structuredClone(input.references), result_schema: memoryRepairWorkerSchema };
+            const item = { key: work.key, task: work.task, depends_on: [...work.depends_on], launch_policy: "fresh_agent_required",
+                result_schema: memoryRepairWorkerSchema, payload: { kind: "memory-repair", read_only: false,
+                    ...(work.profile_id === null ? {} : { execution_override: { agent_profile_id: work.profile_id } }),
+                    memory_repair: { ...packet, packet_sha256: hybridDigest(packet) } } };
+            const size = Buffer.byteLength(JSON.stringify(item));
+            total += size;
+            if (size > 1024 * 1024 || total > 64 * 1024 * 1024)
+                refuse("unbounded_repair_batch");
+            return item;
+        }) };
+    return batch;
+}
+function batchScope(scope) {
+    return { project_id: scope.project_id, run_id: scope.run_id, stage: "review", attempt: scope.attempt,
+        cycle: "", parent_work_id: scope.parent_work_id, request_key: "memory-repair-wave-1" };
+}
+function selected(context, scope) {
+    const rows = context.db.all("SELECT payload_json FROM audit_events WHERE project_id=? AND event_type=? AND json_extract(payload_json,'$.run_id')=? AND json_extract(payload_json,'$.scope.attempt')=? AND json_extract(payload_json,'$.scope.parent_work_id')=? AND json_extract(payload_json,'$.wave')=1 LIMIT 2", [scope.project_id, event, scope.run_id, scope.attempt, scope.parent_work_id]);
+    if (!rows.length)
+        return null;
+    try {
+        if (rows.length !== 1 || Buffer.byteLength(rows[0].payload_json) > 2 * 1024 * 1024)
+            refuse("ambiguous_or_unbounded_registration");
+        const receipt = JSON.parse(rows[0].payload_json);
+        if (receipt.schema_id !== "dd-flow/memory-repair-registration@1" || receipt.run_id !== scope.run_id || receipt.wave !== 1
+            || hybridDigest(receipt.scope) !== hybridDigest(scope)
+            || [receipt.original_registration_sha256, receipt.review_sha256, receipt.plan_sha256, receipt.batch_sha256].some(value => typeof value !== "string" || !/^[a-f0-9]{64}$/.test(value))
+            || typeof receipt.plan_base64 !== "string" || !receipt.work_ids || typeof receipt.work_ids !== "object" || Array.isArray(receipt.work_ids)
+            || !Object.keys(receipt.work_ids).length || Object.keys(receipt.work_ids).length > 256
+            || Object.values(receipt.work_ids).some(id => typeof id !== "string" || !id)
+            || new Set(Object.values(receipt.work_ids)).size !== Object.keys(receipt.work_ids).length)
+            refuse("changed_registration");
+        const bytes = Buffer.from(receipt.plan_base64, "base64");
+        if (!bytes.length || bytes.length > 1024 * 1024 || bytes.toString("base64") !== receipt.plan_base64 || hash(bytes) !== receipt.plan_sha256)
+            refuse("changed_plan_bytes");
+        return structuredClone(receipt);
+    }
+    catch (error) {
+        if (error instanceof AppError && error.code === "memory_repair_registration_invalid")
+            throw error;
+        return refuse("invalid_registration");
+    }
+}
+function project(review, plan, planSha256) {
+    const original = review.original().registration();
+    return memoryRepairBatch({ scope: original.scope, plan, planSha256, originalRegistrationSha256: hybridDigest(original),
+        references: [...original.view.run_inputs, ...review.references().map(ref => ({ root: "run", ...ref.result }))],
+        findings: memoryReviewWaveProjection(review.results(), original.view.diagnostic_findings).findings });
+}
+function assertAllocation(context, receipt, batch) {
+    if (hybridDigest(batch.works) !== receipt.batch_sha256 || batch.works.length !== Object.keys(receipt.work_ids).length)
+        refuse("changed_repair_batch");
+    for (const item of batch.works) {
+        if (!Object.hasOwn(receipt.work_ids, item.key) || !receipt.work_ids[item.key])
+            refuse("missing_repair_work");
+        const custody = readWorkBatchCustody(context, receipt.work_ids[item.key]);
+        if (custody.item_key !== item.key || custody.batch_sha256 !== receipt.batch_sha256
+            || hybridDigest(custody.scope) !== hybridDigest(batchScope(receipt.scope))
+            || hybridDigest(custody.work_ids) !== hybridDigest(receipt.work_ids))
+            refuse("changed_work_custody");
+        const work = context.db.get("SELECT parent_work_id,task,launch_policy,result_schema,payload_json,depends_on_json FROM works WHERE project_id=? AND run_id=? AND work_id=?", [receipt.scope.project_id, receipt.run_id, receipt.work_ids[item.key]]);
+        let payload, dependencies;
+        try {
+            payload = JSON.parse(work?.payload_json ?? "null");
+            dependencies = JSON.parse(work?.depends_on_json ?? "null");
+        }
+        catch {
+            return refuse("invalid_repair_work");
+        }
+        if (!work || work.parent_work_id !== receipt.scope.parent_work_id || work.task !== item.task
+            || work.launch_policy !== item.launch_policy || work.result_schema !== item.result_schema
+            || hybridDigest(dependencies) !== hybridDigest(item.depends_on.map(key => receipt.work_ids[key]))
+            || hybridDigest(payload) !== hybridDigest({ ...item.payload, _dd_flow_batch_request: {
+                    request_sha256: custody.request_sha256, batch_sha256: custody.batch_sha256, item_key: item.key
+                } }))
+            refuse("changed_repair_work");
+    }
+}
+/** Retained metadata/allocation readers only, not current repair admission. */
+export function readRetainedMemoryRepairRegistration(context, scope) {
+    const receipt = selected(context, scope);
+    if (!receipt)
+        refuse("repair_registration_missing");
+    return receipt;
+}
+export function assertRetainedMemoryRepairAllocation(context, receipt, batch) {
+    const retained = readRetainedMemoryRepairRegistration(context, receipt.scope);
+    if (hybridDigest(retained) !== hybridDigest(receipt))
+        refuse("repair_registration_changed");
+    assertAllocation(context, retained, batch);
+}
+/** Historical registered-plan authority. Restore deliberately does not require
+ * today's documents to match the pre-correction hashes. It proves exact plan
+ * and Work identity only: current bytes, repair success and delta re-review
+ * require separate settlement owners. No Work or provider is allocated here.
+ */
+export class PreparedRegisteredMemoryCorrections {
+    static isPrepared(value) {
+        return typeof value === "object" && value !== null && #receipt in value;
+    }
+    sha256;
+    #review;
+    #receipt;
+    #plan;
+    #batch;
+    constructor(token, review, receipt, plan, batch) {
+        if (token !== registrationToken)
+            refuse("registration_token_required");
+        this.#review = review;
+        this.#receipt = structuredClone(receipt);
+        this.#plan = structuredClone(plan);
+        this.#batch = structuredClone(batch);
+        this.sha256 = hybridDigest(receipt);
+        Object.freeze(this);
+    }
+    static restore(context, review, expectedBytes) {
+        if (!(review instanceof PreparedRetainedMemoryReviewResults))
+            refuse("prepared_review_results_required");
+        review.revalidate(context);
+        const original = review.original().registration(), bundle = review.original().bundle();
+        const receipt = context.db.readSnapshot(() => selected(context, original.scope));
+        if (!receipt)
+            refuse("repair_registration_missing");
+        if (receipt.original_registration_sha256 !== hybridDigest(original) || receipt.review_sha256 !== review.sha256
+            || review.results().some(result => result.outcome === "blocked"))
+            refuse("foreign_original_review");
+        const bytes = Buffer.from(receipt.plan_base64, "base64");
+        if (expectedBytes !== undefined && (!(expectedBytes instanceof Uint8Array) || !bytes.equals(Buffer.from(expectedBytes))))
+            refuse("plan_replay_conflict");
+        const plan = validateMemoryReviewCorrectionPlan(bytes, bundle.engine(), { runId: original.run_id, wave: 1,
+            reviewSha256: review.sha256, units: original.view.unit_inventory, findings: memoryReviewWaveProjection(review.results(), original.view.diagnostic_findings).findings });
+        for (const work of plan.works)
+            bundle.execution.work("review", work.profile_id ?? undefined);
+        const schema = JSON.parse(bundle.engine().schema("memory-repair-work-result").toString("utf8"));
+        if (schema.$id !== memoryRepairWorkerSchema)
+            refuse("frozen_repair_worker_schema_required");
+        const batch = project(review, plan, receipt.plan_sha256);
+        const prepared = new PreparedRegisteredMemoryCorrections(registrationToken, review, receipt, plan, batch);
+        prepared.assertCustody(context);
+        return prepared;
+    }
+    receipt() { return structuredClone(this.#receipt); }
+    plan() { return structuredClone(this.#plan); }
+    batch() { return structuredClone(this.#batch); }
+    review() { return this.#review; }
+    bytes() { return Buffer.from(this.#receipt.plan_base64, "base64"); }
+    assertCustody(context) {
+        this.#review.assertCustody(context);
+        const receipt = selected(context, this.#receipt.scope);
+        if (!receipt || hybridDigest(receipt) !== this.sha256)
+            refuse("repair_registration_changed");
+        assertAllocation(context, receipt, this.#batch);
+    }
+    revalidate(context) { this.#review.revalidate(context); this.assertCustody(context); }
+    replay(context) {
+        this.revalidate(context);
+        const scope = batchScope(this.#receipt.scope), batchInput = { parentWorkId: scope.parent_work_id,
+            requestKey: scope.request_key, stage: "review", value: this.#batch };
+        const prepared = prepareWorkBatch(context, batchInput);
+        return context.db.writeTransaction(() => {
+            this.assertCustody(context);
+            const allocation = addWorkBatch(context, { ...batchInput, prepared });
+            if (!allocation.replayed || hybridDigest(allocation.work_ids) !== hybridDigest(this.#receipt.work_ids))
+                refuse("changed_replay_allocation");
+            return { wave: 1, plan_sha256: this.#receipt.plan_sha256, work_ids: { ...this.#receipt.work_ids }, replayed: true };
+        });
+    }
+}
+/** First correction allocation. All source and frozen-schema/profile reads
+ * precede the writer; SQL-only review custody, generic allocation and the
+ * independent plan receipt commit together. Lost receipts cannot be adopted.
+ */
+export function registerMemoryInitialCorrections(context, plan) {
+    if (!(plan instanceof PreparedMemoryInitialCorrectionPlan))
+        refuse("prepared_initial_plan_required");
+    const review = plan.review(), original = review.original().registration(), bundle = review.original().bundle();
+    const schema = JSON.parse(bundle.engine().schema("memory-repair-work-result").toString("utf8"));
+    if (schema.$id !== memoryRepairWorkerSchema)
+        refuse("frozen_repair_worker_schema_required");
+    const batch = project(review, plan.value(), plan.sha256), scope = batchScope(original.scope);
+    const batchInput = { parentWorkId: scope.parent_work_id, requestKey: scope.request_key, stage: "review", value: batch };
+    const prepared = prepareWorkBatch(context, batchInput);
+    plan.revalidate(context);
+    return context.db.writeTransaction(() => {
+        plan.assertCustody(context);
+        const prior = selected(context, original.scope);
+        if (prior) {
+            if (prior.plan_sha256 !== plan.sha256 || prior.review_sha256 !== review.sha256
+                || prior.original_registration_sha256 !== hybridDigest(original))
+                refuse("plan_replay_conflict");
+            assertAllocation(context, prior, batch);
+            const allocated = addWorkBatch(context, { ...batchInput, prepared });
+            if (!allocated.replayed || hybridDigest(allocated.work_ids) !== hybridDigest(prior.work_ids))
+                refuse("changed_replay_allocation");
+            return { wave: 1, plan_sha256: prior.plan_sha256, work_ids: { ...prior.work_ids }, replayed: true };
+        }
+        if (context.db.get("SELECT 1 FROM works w JOIN stage_work_memberships m ON m.work_id=w.work_id AND m.project_id=w.project_id AND m.run_id=w.run_id WHERE w.project_id=? AND w.run_id=? AND w.parent_work_id=? AND m.stage='review' AND m.attempt=? AND (w.result_schema=? OR json_extract(w.payload_json,'$.kind')='memory-repair') AND (json_extract(w.payload_json,'$.memory_repair.wave')=1 OR json_extract(w.payload_json,'$.memory_repair.wave') IS NULL) LIMIT 1", [scope.project_id, scope.run_id, scope.parent_work_id, scope.attempt, memoryRepairWorkerSchema]))
+            refuse("repair_registration_missing");
+        const allocated = addWorkBatch(context, { ...batchInput, prepared });
+        if (allocated.replayed)
+            refuse("repair_registration_missing");
+        const receipt = { schema_id: "dd-flow/memory-repair-registration@1", run_id: scope.run_id, scope: original.scope, wave: 1,
+            original_registration_sha256: hybridDigest(original), review_sha256: review.sha256, plan_sha256: plan.sha256,
+            plan_base64: plan.bytes().toString("base64"), batch_sha256: hybridDigest(batch.works), work_ids: allocated.work_ids };
+        appendAudit(context, { projectId: scope.project_id, eventType: event, payload: receipt });
+        const retained = selected(context, original.scope);
+        if (!retained)
+            refuse("repair_registration_missing");
+        assertAllocation(context, retained, batch);
+        return { wave: 1, plan_sha256: retained.plan_sha256, work_ids: { ...retained.work_ids }, replayed: false };
+    });
+}