@deksden-com/dd-flow-cli 0.9.0-beta.137 → 0.9.0-beta.138

package/dist/services/memory-correction-check-receipt.js

@@ -0,0 +1,219 @@
+import { Buffer } from "node:buffer";
+import { AppError } from "../shared/errors.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { appendAudit } from "./audit.js";
+import { PreparedRetainedCheckEvidence } from "./code-checks.js";
+import { isMemoryCorrectionInputOwner } from "./memory-correction-input-owner.js";
+import { PreparedMemoryVerificationChecks } from "./memory-verification-checks.js";
+import { runtimeCommand } from "./runtime-command.js";
+const token = Symbol("memory-correction-check-receipt");
+const event = "memory.correction_checks";
+function refuse(reason) {
+    throw new AppError("memory_correction_checks_invalid", "Correction checks lack independent current-view and policy custody", 2, { reason, effect: "no_effect" });
+}
+function stored(context, corrected) {
+    corrected.assertCustody(context);
+    const view = corrected.value();
+    const rows = context.db.all("SELECT payload_json FROM audit_events WHERE project_id=? AND event_type=? AND json_extract(payload_json,'$.run_id')=? AND json_extract(payload_json,'$.wave')=? LIMIT 2", [view.scope.project_id, event, view.scope.run_id, view.wave]);
+    if (!rows.length)
+        return null;
+    if (rows.length !== 1 || Buffer.byteLength(rows[0].payload_json) > 2 * 1024 * 1024)
+        refuse("ambiguous_or_unbounded_check_receipt");
+    let value;
+    try {
+        value = JSON.parse(rows[0].payload_json);
+    }
+    catch {
+        return refuse("invalid_check_receipt");
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        refuse("invalid_check_receipt");
+    return value;
+}
+/** Independent finite-check acceptance, not reviewer or Stage acceptance.
+ * Registration and reconnect use exact current-view evidence. They never
+ * execute a command, allocate Work or declare semantic completeness. */
+export class PreparedMemoryCorrectionCheckReceipt {
+    static isPrepared(value) {
+        return typeof value === "object" && value !== null && #corrected in value;
+    }
+    sha256;
+    #corrected;
+    #policy;
+    #evidence;
+    #receipt;
+    #registered;
+    constructor(key, corrected, policy, evidence, receipt, registered) {
+        if (key !== token)
+            refuse("check_receipt_token_required");
+        this.#corrected = corrected;
+        this.#policy = policy;
+        this.#evidence = evidence;
+        this.#receipt = structuredClone(receipt);
+        this.#registered = registered;
+        this.sha256 = hybridDigest(receipt);
+        Object.freeze(this);
+    }
+    static prepare(context, corrected, policy) {
+        if (!isMemoryCorrectionInputOwner(corrected) || !PreparedMemoryVerificationChecks.isPrepared(policy))
+            refuse("prepared_check_owners_required");
+        if (context.db.isOwnedWriteTransaction?.())
+            refuse("preparation_outside_writer_required");
+        policy.assertCorrectionOwner(corrected);
+        // evidence() revalidates the policy and its exact bound correction owner.
+        const view = corrected.value(), evidence = policy.evidence(context);
+        evidence.assertOwner({ projectId: view.scope.project_id, runId: view.scope.run_id, scope: "aggregate" });
+        const receipt = { schema_id: "dd-flow/memory-correction-checks@1", project_id: view.scope.project_id, run_id: view.scope.run_id,
+            wave: view.wave, review_input_sha256: view.scope.input_sha256, corrected_input_sha256: corrected.sha256,
+            completed_correction_sha256: view.completed_correction_sha256, profile_sha256: corrected.verificationProfileHash(context),
+            declarations_sha256: hybridDigest(policy.declarations()), checks: evidence.retainedReferences(context) };
+        if (!receipt.checks.length || receipt.checks.length > 4096 || Buffer.byteLength(JSON.stringify(receipt)) > 2 * 1024 * 1024)
+            refuse("unbounded_check_receipt");
+        const existing = context.db.readSnapshot(() => stored(context, corrected));
+        if (existing && hybridDigest(existing) !== hybridDigest(receipt))
+            refuse("registered_check_receipt_changed");
+        const prepared = new PreparedMemoryCorrectionCheckReceipt(token, corrected, policy, evidence, receipt, Boolean(existing));
+        prepared.assertCustody(context);
+        return prepared;
+    }
+    static restore(context, corrected) {
+        if (!isMemoryCorrectionInputOwner(corrected))
+            refuse("prepared_check_owners_required");
+        if (context.db.isOwnedWriteTransaction?.())
+            refuse("preparation_outside_writer_required");
+        if (!context.db.readSnapshot(() => stored(context, corrected))) {
+            const view = corrected.value(), projectRoot = corrected.bundle().execution.snapshot().scope.projectRoot;
+            const args = ["--run", view.scope.run_id, "--project-root", projectRoot, "--wave", String(view.wave), "--json"];
+            throw new AppError("memory_correction_checks_invalid", "Correction checks have not been registered for the settled corrected view", 2, { reason: "registered_check_receipt_required", phase: "prepare", effect: "no_effect", recoverable: true,
+                correction_instruction: `Run ${runtimeCommand(context, ["memory", "corrections", "checks", ...args])}, then ${runtimeCommand(context, ["memory", "review", "selective-register", ...args])}. End this Turn so the controller can dispatch the independent reviewers. Use retry_command only after their selective review completes; do not retry Finish before checks and selective review.` });
+        }
+        const bundle = corrected.bundle(), scope = corrected.value().scope;
+        const policy = PreparedMemoryVerificationChecks.prepare(context, { projectId: scope.project_id, runId: scope.run_id,
+            execution: bundle.execution, flow: bundle.descriptor, corrected });
+        return PreparedMemoryCorrectionCheckReceipt.prepare(context, corrected, policy);
+    }
+    value() {
+        return structuredClone(this.#receipt);
+    }
+    assertOwner(corrected) {
+        if (!isMemoryCorrectionInputOwner(corrected) || corrected.sha256 !== this.#corrected.sha256)
+            refuse("foreign_corrected_check_receipt");
+    }
+    assertRegisteredCustody(context) {
+        if (!this.#registered)
+            refuse("registered_check_receipt_required");
+        this.assertCustody(context);
+    }
+    assertCustody(context) {
+        this.#corrected.assertCustody(context);
+        this.#policy.assertCustody(context);
+        this.#evidence.assertCustody(context);
+        const existing = stored(context, this.#corrected);
+        if ((this.#registered && !existing) || (existing && hybridDigest(existing) !== this.sha256))
+            refuse("registered_check_receipt_changed");
+        if (hybridDigest(this.#evidence.retainedReferences(context)) !== hybridDigest(this.#receipt.checks))
+            refuse("selected_check_evidence_changed");
+    }
+    revalidate(context) {
+        this.#policy.revalidate(context);
+        this.#evidence.revalidate(context);
+        this.assertCustody(context);
+    }
+    register(context) {
+        this.revalidate(context);
+        const replay = context.db.writeTransaction(() => {
+            if (!context.db.isOwnedWriteTransaction?.())
+                refuse("owned_check_writer_required");
+            this.assertCustody(context);
+            const existing = stored(context, this.#corrected);
+            if (existing)
+                return true;
+            appendAudit(context, { projectId: this.#receipt.project_id, eventType: event, payload: this.#receipt });
+            return false;
+        }, "memory.registerCorrectionChecks");
+        this.#registered = true;
+        this.assertCustody(context);
+        try {
+            this.revalidate(context);
+        }
+        catch (error) {
+            throw new AppError("memory_correction_checks_pending", "Check receipt committed but current-view revalidation needs recovery", 1, { effect: "committed", receipt_sha256: this.sha256, cause: error instanceof Error ? error.message : String(error) });
+        }
+        return { receipt: this.value(), receipt_sha256: this.sha256, replay };
+    }
+}
+function historicalReceipt(context, scope) {
+    const rows = context.db.all("SELECT payload_json FROM audit_events WHERE project_id=? AND event_type=? AND json_extract(payload_json,'$.run_id')=? AND json_extract(payload_json,'$.wave')=? LIMIT 2", [scope.projectId, event, scope.runId, scope.wave]);
+    if (rows.length !== 1 || Buffer.byteLength(rows[0].payload_json) > 2 * 1024 * 1024)
+        refuse("historical_check_receipt_missing");
+    let value;
+    try {
+        value = JSON.parse(rows[0].payload_json);
+    }
+    catch {
+        return refuse("invalid_check_receipt");
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value)
+        || value.schema_id !== "dd-flow/memory-correction-checks@1" || value.project_id !== scope.projectId
+        || value.run_id !== scope.runId || value.wave !== scope.wave || value.corrected_input_sha256 !== scope.correctedInputSha256
+        || hybridDigest(value) !== scope.receiptSha256
+        || [value.review_input_sha256, value.corrected_input_sha256, value.completed_correction_sha256, value.declarations_sha256]
+            .some(hash => typeof hash !== "string" || !/^[a-f0-9]{64}$/.test(hash))
+        || (value.profile_sha256 !== null && (typeof value.profile_sha256 !== "string" || !/^[a-f0-9]{64}$/.test(value.profile_sha256)))
+        || Object.keys(value).some(key => !["schema_id", "project_id", "run_id", "wave", "review_input_sha256", "corrected_input_sha256",
+            "completed_correction_sha256", "profile_sha256", "declarations_sha256", "checks"].includes(key))
+        || !Array.isArray(value.checks) || !value.checks.length || value.checks.length > 4096
+        || value.checks.some(ref => !ref || typeof ref !== "object" || Array.isArray(ref)
+            || typeof ref.id !== "string" || !ref.id || typeof ref.path !== "string"
+            || Object.keys(ref).some(key => !["id", "path", "sha256", "sql_sha256"].includes(key))
+            || [ref.sha256, ref.sql_sha256].some(hash => typeof hash !== "string" || !/^[a-f0-9]{64}$/.test(hash))))
+        refuse("historical_check_receipt_changed");
+    for (const reference of value.checks) {
+        const row = context.db.get("SELECT profile_hash FROM check_receipts WHERE project_id=? AND run_id=? AND id=?", [scope.projectId, scope.runId, reference?.id]);
+        if (!row || row.profile_hash !== value.profile_sha256)
+            refuse("historical_check_policy_changed");
+    }
+    return value;
+}
+/** Retained finite-check proof for accepted-review replay. Expected hashes
+ * must come from the independent reviewer/Stage receipt, not a caller claim.
+ * This owner proves only the scoped historical check receipt and executions;
+ * it grants no current-view, reviewer allocation or Stage acceptance rights. */
+export class PreparedRetainedMemoryCorrectionChecks {
+    #scope;
+    #checks;
+    constructor(key, scope, checks) {
+        if (key !== token)
+            refuse("check_receipt_token_required");
+        this.#scope = { ...scope };
+        this.#checks = checks;
+        Object.freeze(this);
+    }
+    static prepare(context, scope) {
+        return this.prepareWave(context, scope, 1);
+    }
+    static prepareSecond(context, scope) {
+        return this.prepareWave(context, scope, 2);
+    }
+    static prepareWave(context, scope, wave) {
+        if (wave !== 1 && wave !== 2)
+            refuse("historical_check_wave_required");
+        if (!scope || typeof scope.projectId !== "string" || !scope.projectId || typeof scope.runId !== "string" || !scope.runId
+            || [scope.receiptSha256, scope.correctedInputSha256].some(hash => typeof hash !== "string" || !/^[a-f0-9]{64}$/.test(hash)))
+            refuse("historical_check_scope_required");
+        if (context.db.isOwnedWriteTransaction?.())
+            refuse("preparation_outside_writer_required");
+        const selectedScope = { ...scope, wave };
+        const receipt = context.db.readSnapshot(() => historicalReceipt(context, selectedScope));
+        const checks = PreparedRetainedCheckEvidence.prepare(context, { projectId: scope.projectId, runId: scope.runId, references: receipt.checks });
+        const prepared = new PreparedRetainedMemoryCorrectionChecks(token, selectedScope, checks);
+        prepared.assertCustody(context);
+        return prepared;
+    }
+    assertCustody(context) {
+        historicalReceipt(context, this.#scope);
+        this.#checks.assertCustody(context);
+    }
+    value(context) { this.assertCustody(context); return structuredClone(historicalReceipt(context, this.#scope)); }
+    revalidate(context) { this.#checks.revalidate(context); this.assertCustody(context); }
+}

package/dist/services/memory-correction-input-owner.js

@@ -0,0 +1,6 @@
+import { PreparedCorrectedMemoryReviewInputs } from "./memory-corrected-review-inputs.js";
+import { PreparedSecondCorrectedMemoryReviewInputs } from "./memory-second-corrected-review-inputs.js";
+/** Only the two sealed wave owners, never a structural evidence interface. */
+export function isMemoryCorrectionInputOwner(value) {
+    return PreparedCorrectedMemoryReviewInputs.isPrepared(value) || PreparedSecondCorrectedMemoryReviewInputs.isPrepared(value);
+}

package/dist/services/memory-discover-handler.js

@@ -0,0 +1,104 @@
+import { AppError } from "../shared/errors.js";
+import { PreparedMemoryStageResult, memorySourceKey } from "./memory-stage-results.js";
+import { PreparedMemoryResultBinding } from "./memory-result-binding.js";
+import { PreparedMemoryBaselinePreservation } from "./memory-baseline-preservation.js";
+import { captureMemoryPreflightSources } from "./memory-preflight-handler.js";
+import { PreparedDescriptorStageStart } from "./descriptor-stage-start.js";
+import { PreparedDescriptorStageCoordinator } from "./descriptor-stage-coordinator.js";
+import { PreparedDescriptorStageSettlement } from "./descriptor-stage-settlement.js";
+import { readAcceptedStageData } from "./stage-report-renderer.js";
+import { assertPreparedRunBundleSqlAuthority, readFlowRunExecutionBundle } from "./runs.js";
+import { requireProjectByRoot } from "./projects.js";
+import { resolveProjectRoot } from "../storage/paths.js";
+function refuse(reason) {
+    throw new AppError("memory_discover_handler_invalid", "Memory discovery lacks accepted scope or bounded evidence", 2, { reason, effect: "no_effect" });
+}
+function selected(context, input) {
+    if (!(input.bytes instanceof Uint8Array) || input.bytes.length > 1024 * 1024)
+        refuse("invalid_input_bytes");
+    const bundle = readFlowRunExecutionBundle(context, input);
+    if (!bundle || bundle.descriptor.descriptor.id !== "mb-init" || bundle.descriptor.successor("preflight", "accepted") !== "discover")
+        refuse("registered_memory_bundle_required");
+    const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot)), scope = { projectId: project.id, runId: input.runId, stage: "discover" };
+    const run = assertPreparedRunBundleSqlAuthority(context, scope, bundle), index = JSON.parse(run.index_json);
+    return { bundle, scope, accepted: index.stage_runs.find((stage) => stage.stage === "discover")?.status === "done" };
+}
+/** Result-level discovery checks, not physical/RUN or semantic completeness
+ * authority. The handler separately supplies independently selected SQL scope
+ * and physical baseline observations. Unknown facts remain valid with their
+ * frozen-schema reason/next-action rather than being converted to confirmations.
+ */
+export class PreparedMemoryDiscoveryAcceptance {
+    #sha256;
+    constructor(result) { this.#sha256 = result.sha256; Object.freeze(this); }
+    static prepare(result) {
+        if (!(result instanceof PreparedMemoryStageResult))
+            refuse("prepared_result_required");
+        const value = JSON.parse(result.bytes().toString("utf8"));
+        if (value.stage !== "discover" || value.outcome !== "accepted"
+            || value.findings.some((finding) => finding.severity !== "minor" && finding.status !== "resolved"))
+            refuse("discovery_not_accepted");
+        const inventory = new Map();
+        for (const source of value.details.inventory) {
+            const key = memorySourceKey(source.root, source.path);
+            if (inventory.has(key))
+                refuse("duplicate_inventory_source");
+            inventory.set(key, source.sha256);
+        }
+        const exclusions = new Set();
+        for (const exclusion of value.details.exclusions) {
+            if (!exclusion.reason.trim() || exclusions.has(exclusion.path))
+                refuse("invalid_or_duplicate_exclusion");
+            exclusions.add(exclusion.path);
+            const excluded = exclusion.path.replace(/\/+$/, "");
+            if (value.details.inventory.some((source) => source.path === excluded || source.path.startsWith(`${excluded}/`)))
+                refuse("observed_source_excluded");
+        }
+        return new PreparedMemoryDiscoveryAcceptance(result);
+    }
+    assertResult(result) {
+        if (!(result instanceof PreparedMemoryStageResult) || result.sha256 !== this.#sha256)
+            refuse("discovery_result_changed");
+    }
+}
+/** Unregistered implementation until the complete memory registry is ready.
+ * Entry inherits accepted preflight and preserves its independent bootstrap
+ * baseline through Stage/coordinator writers, without dispatching a provider.
+ */
+export function startMemoryDiscovery(context, input) {
+    const { bundle, scope, accepted } = selected(context, input);
+    if (accepted)
+        refuse("use_accepted_finish_replay");
+    const preservation = PreparedMemoryBaselinePreservation.prepare(context, bundle.execution);
+    const preflight = context.db.readSnapshot(() => readAcceptedStageData(context, { ...scope, stage: "preflight" }));
+    const value = JSON.parse(preflight.bytes.toString("utf8"));
+    if (value.schema_id !== "dd-flow/mb-init-preflight-result@1" || value.outcome !== "accepted" || value.run_id !== input.runId)
+        refuse("foreign_preflight_baseline");
+    const fence = (writer) => {
+        preservation.assertCustody(writer);
+        if (readAcceptedStageData(writer, { ...scope, stage: "preflight" }).authority_sha256 !== preflight.authority_sha256)
+            refuse("preflight_custody_changed");
+    };
+    const start = PreparedDescriptorStageStart.prepare(context, { ...input, stage: "discover" });
+    preservation.revalidate(context);
+    const stage = start.apply(context, fence);
+    const coordinator = PreparedDescriptorStageCoordinator.prepare(context, { ...input, stage: "discover" });
+    preservation.revalidate(context);
+    return { ...stage, ...coordinator.apply(context, fence) };
+}
+export function finishMemoryDiscovery(context, input) {
+    const { bundle, scope, accepted } = selected(context, input);
+    const sources = captureMemoryPreflightSources(context, bundle, input.bytes);
+    const binding = PreparedMemoryResultBinding.prepare(context, { ...scope, flow: bundle.descriptor, execution: bundle.execution, bundle, sources, acceptedReplay: accepted });
+    const replay = binding.acceptedBytes();
+    if (replay && !replay.equals(input.bytes))
+        refuse("accepted_result_changed");
+    const result = PreparedMemoryStageResult.prepare(input.bytes, bundle.descriptor, binding.binding());
+    const acceptance = PreparedMemoryDiscoveryAcceptance.prepare(result);
+    const settlement = PreparedDescriptorStageSettlement.prepare(context, { ...input, stage: "discover", bytes: result.bytes() });
+    binding.revalidate(context);
+    return settlement.apply(context, writer => {
+        binding.assertCustody(writer);
+        acceptance.assertResult(result);
+    });
+}