@deksden-com/dd-flow-cli 0.9.0-beta.137 → 0.9.0-beta.138

package/dist/services/release-producer.js

@@ -0,0 +1,63 @@
+import fs from "node:fs";
+import path from "node:path";
+import { createPublicKey, randomUUID } from "node:crypto";
+import { AppError } from "../shared/errors.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { acquireInstallationLock } from "./installation-lock.js";
+import { authenticateReleaseEnvelope, produceReleaseEnvelope, releaseProducerKeyId } from "./release-envelope.js";
+import { readLocalReleaseBundle } from "./release-source.js";
+import { validateReleasePayloadIdentity } from "./release-payload.js";
+function refuse(reason) {
+    throw new AppError("release_producer", "Release bundle cannot be published", 1, { reason, phase: "release_production", effect: "no_effect" });
+}
+/** Local immutable delivery only. Qualification facts must already come from their
+ * owner ledger; this producer never performs, synthesizes or upgrades qualification.
+ */
+export function publishReleaseBundle(destination, input) {
+    if (!input.payload || typeof input.payload !== "object" || !input.payload.source
+        || typeof input.payload.source.repository !== "string")
+        refuse("invalid_producer_payload");
+    const envelope = produceReleaseEnvelope(input.payload, input.privateKey, input.compatibility);
+    const publicKey = createPublicKey(input.privateKey), producers = new Map([[releaseProducerKeyId(publicKey), {
+                publicKey, repository: input.payload.source.repository, channels: new Set([input.compatibility.channel])
+            }]]);
+    const admitted = authenticateReleaseEnvelope(envelope, producers, input.compatibility);
+    validateReleasePayloadIdentity(admitted.manifest, input.canonArchive, input.engineArchive);
+    const root = path.resolve(destination), parent = path.dirname(root);
+    if (root === parent || !fs.existsSync(parent) || !fs.lstatSync(parent).isDirectory())
+        refuse("invalid_output_parent");
+    const envelopeBytes = Buffer.from(JSON.stringify(envelope));
+    const lease = acquireInstallationLock(`${root}.lock`, hybridDigest({ envelope, canon: admitted.manifest.canon.archive, engine: admitted.manifest.engine.archive }));
+    let staging = null;
+    try {
+        if (fs.existsSync(root)) {
+            const retained = readLocalReleaseBundle(root, producers, input.compatibility);
+            if (fs.readdirSync(root).sort().join("/") !== "canon.tgz/engine.tgz/release-envelope.json"
+                || !fs.readFileSync(path.join(root, "release-envelope.json")).equals(envelopeBytes)
+                || !retained.canonArchive.equals(input.canonArchive) || !retained.engineArchive.equals(input.engineArchive))
+                refuse("immutable_bundle_conflict");
+            return { root, replayed: true, producer_key_id: envelope.producer_key_id };
+        }
+        staging = path.join(parent, `.release-staging-${randomUUID()}`);
+        fs.mkdirSync(staging, { mode: 0o700 });
+        for (const [name, bytes] of [["release-envelope.json", envelopeBytes], ["canon.tgz", input.canonArchive], ["engine.tgz", input.engineArchive]]) {
+            const fd = fs.openSync(path.join(staging, name), "wx", 0o600);
+            try {
+                fs.writeFileSync(fd, bytes);
+                fs.fsyncSync(fd);
+            }
+            finally {
+                fs.closeSync(fd);
+            }
+        }
+        readLocalReleaseBundle(staging, producers, input.compatibility);
+        fs.renameSync(staging, root);
+        staging = null;
+        return { root, replayed: false, producer_key_id: envelope.producer_key_id };
+    }
+    finally {
+        if (staging)
+            fs.rmSync(staging, { recursive: true, force: true });
+        lease.release();
+    }
+}

package/dist/services/release-provenance.js

@@ -0,0 +1,160 @@
+import fs from "node:fs";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { AppError } from "../shared/errors.js";
+import { readBoundedReleaseFile } from "./release-source.js";
+import { inspectReleaseArchive } from "./release-archive.js";
+import { produceReleaseArchive } from "./release-archive-producer.js";
+function refuse(reason) {
+    throw new AppError("release_provenance", "Producer source provenance cannot be verified", 1, { reason, phase: "release_production", effect: "no_effect" });
+}
+function gitBytes(directory, args, maxBuffer = 1024 * 1024, input) {
+    const env = { ...process.env, GIT_OPTIONAL_LOCKS: "0", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: process.platform === "win32" ? "NUL" : "/dev/null" };
+    for (const name of Object.keys(env))
+        if (name.startsWith("GIT_") && !["GIT_OPTIONAL_LOCKS", "GIT_CONFIG_NOSYSTEM", "GIT_CONFIG_GLOBAL"].includes(name))
+            delete env[name];
+    const result = spawnSync("git", ["-c", "core.fsmonitor=false", "-c", "core.untrackedCache=false", ...args], {
+        cwd: directory, env, timeout: 10_000, maxBuffer, input
+    });
+    if (result.status !== 0 || result.error)
+        refuse("git_source_unavailable");
+    return result.stdout;
+}
+/** Read-only source/tag verification. No fetch, tag creation, commit or cleanup. */
+export function verifyProducerSource(root, source, version) {
+    if (!source || !/^[a-f0-9]{40}$/.test(source.commit) || !/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(source.repository)
+        || !/^[0-9]+\.[0-9]+\.[0-9]+(?:-[A-Za-z0-9.-]+)?$/.test(version)
+        || (source.kind !== "source_checkout" && source.kind !== "published_release")
+        || (source.kind === "source_checkout" ? source.tag !== null : source.tag !== `v${version}`))
+        refuse("invalid_source_identity");
+    let directory;
+    try {
+        directory = fs.realpathSync(root);
+    }
+    catch {
+        return refuse("source_unavailable");
+    }
+    const git = (args) => gitBytes(directory, args).toString("utf8").trim();
+    const top = git(["rev-parse", "--show-toplevel"]);
+    try {
+        if (fs.realpathSync(top) !== directory)
+            refuse("source_root_mismatch");
+    }
+    catch (error) {
+        if (error instanceof AppError)
+            throw error;
+        return refuse("source_root_mismatch");
+    }
+    const origin = git(["remote", "get-url", "origin"]);
+    if (![`https://github.com/${source.repository}`, `https://github.com/${source.repository}.git`, `git@github.com:${source.repository}.git`, `ssh://git@github.com/${source.repository}.git`].includes(origin))
+        refuse("source_repository_mismatch");
+    if (git(["status", "--porcelain", "--untracked-files=all"]))
+        refuse("source_not_clean");
+    const commit = git(["rev-parse", "HEAD"]), tree = git(["rev-parse", "HEAD^{tree}"]);
+    if (commit !== source.commit)
+        refuse("source_commit_mismatch");
+    if (readBoundedReleaseFile(path.join(directory, "VERSION"), 1024).toString("utf8").trim() !== version)
+        refuse("source_version_mismatch");
+    if (source.tag && git(["rev-parse", "--verify", `refs/tags/${source.tag}^{commit}`]) !== commit)
+        refuse("source_tag_mismatch");
+    return { commit, tree, version };
+}
+/** Exact committed release tree, with only the four canon directory aliases
+ * materialized as regular files. No mutable worktree reads or export filters.
+ */
+function committedBlobs(root, commit) {
+    if (!/^[a-f0-9]{40}$/.test(commit))
+        refuse("invalid_source_identity");
+    const blobs = new Map();
+    const links = [];
+    const listing = gitBytes(root, ["ls-tree", "-rz", "--full-tree", commit], 16 * 1024 * 1024).toString("utf8");
+    for (const record of listing.split("\0").filter(Boolean)) {
+        const match = /^(100644|100755|120000) blob ([a-f0-9]{40})\t(.+)$/.exec(record);
+        if (!match)
+            refuse("unsupported_committed_tree_entry");
+        const mode = match[1], hash = match[2], name = match[3];
+        if (mode === "120000")
+            links.push({ name, hash });
+        else
+            blobs.set(name, { hash, executable: mode === "100755" });
+    }
+    const aliases = { code: "mb-sdlc/code", plan: "mb-sdlc/plan", merge: "mb-sdlc/merge", specify: "mb-sdlc/specify" };
+    for (const link of links) {
+        const match = /^(\.memory-bank\/)?dd-flow\/(code|plan|merge|specify)$/.exec(link.name);
+        if (!match)
+            refuse("unreviewed_committed_alias");
+        const target = gitBytes(root, ["cat-file", "blob", link.hash]).toString("utf8");
+        if (target !== aliases[match[2]])
+            refuse("unreviewed_committed_alias");
+        const targetPrefix = `${path.posix.dirname(link.name)}/${target}/`;
+        const children = [...blobs].filter(([name]) => name.startsWith(targetPrefix));
+        if (!children.length)
+            refuse("empty_committed_alias");
+        for (const [name, blob] of children) {
+            const alias = `${link.name}/${name.slice(targetPrefix.length)}`;
+            if (blobs.has(alias))
+                refuse("committed_alias_collision");
+            blobs.set(alias, blob);
+        }
+    }
+    return blobs;
+}
+export function verifyCanonArchiveSource(root, commit, identity, compressed) {
+    const blobs = committedBlobs(root, commit), entries = inspectReleaseArchive(identity, compressed);
+    const roots = new Set(entries.map(entry => entry.path.split("/")[0]));
+    if (roots.size !== 1)
+        refuse("canon_archive_root_ambiguous");
+    const prefix = `${[...roots][0]}/`;
+    const directories = new Set();
+    for (const name of blobs.keys()) {
+        const parts = name.split("/");
+        for (let index = 1; index < parts.length; index++)
+            directories.add(parts.slice(0, index).join("/"));
+    }
+    const seen = new Set();
+    for (const entry of entries) {
+        if (entry.path === prefix.slice(0, -1) && entry.kind === "directory")
+            continue;
+        const name = entry.path.slice(prefix.length);
+        if (entry.kind === "directory") {
+            if (!directories.has(name))
+                refuse("canon_archive_extra_entry");
+            continue;
+        }
+        const blob = blobs.get(name);
+        if (!blob)
+            refuse("canon_archive_extra_entry");
+        const hash = createHash("sha1").update(`blob ${entry.bytes.length}\0`).update(entry.bytes).digest("hex");
+        if (hash !== blob.hash || Boolean(entry.mode & 0o111) !== blob.executable)
+            refuse("canon_archive_blob_mismatch");
+        seen.add(name);
+    }
+    if (seen.size !== blobs.size)
+        refuse("canon_archive_missing_entry");
+}
+/** Produce from immutable Git objects in one bounded batch, not worktree files. */
+export function produceCanonArchive(root, commit) {
+    const blobs = committedBlobs(root, commit), hashes = [...new Set([...blobs.values()].map(blob => blob.hash))];
+    const batch = gitBytes(root, ["cat-file", "--batch"], 512 * 1024 * 1024, Buffer.from(hashes.join("\n") + "\n"));
+    const contents = new Map();
+    let offset = 0;
+    for (const hash of hashes) {
+        const newline = batch.indexOf(10, offset);
+        if (newline < 0)
+            refuse("invalid_git_blob_batch");
+        const match = /^([a-f0-9]{40}) blob ([0-9]+)$/.exec(batch.subarray(offset, newline).toString("ascii"));
+        if (!match || match[1] !== hash)
+            refuse("invalid_git_blob_batch");
+        const size = Number(match[2]), end = newline + 1 + size;
+        if (!Number.isSafeInteger(size) || end >= batch.length || batch[end] !== 10)
+            refuse("invalid_git_blob_batch");
+        contents.set(hash, batch.subarray(newline + 1, end));
+        offset = end + 1;
+    }
+    if (offset !== batch.length)
+        refuse("invalid_git_blob_batch");
+    const bytes = produceReleaseArchive([...blobs].map(([name, blob]) => ({ path: `canon/${name}`, bytes: contents.get(blob.hash), executable: blob.executable })));
+    verifyCanonArchiveSource(root, commit, { url: "https://producer.invalid/canon.tgz", bytes: bytes.length, sha256: createHash("sha256").update(bytes).digest("hex") }, bytes);
+    return bytes;
+}

package/dist/services/release-registry.js

@@ -0,0 +1,66 @@
+import { valid, prerelease } from "semver";
+import { AppError } from "../shared/errors.js";
+import { readBoundedReleaseFile } from "./release-source.js";
+function refuse(reason) {
+    throw new AppError("release_registry", "Release selection cannot be resolved", 1, { reason, phase: "release_selection", effect: "no_effect", help: "setup" });
+}
+function object(value, keys, required = keys) {
+    if (!value || typeof value !== "object" || Array.isArray(value)
+        || required.some(key => !Object.hasOwn(value, key))
+        || Object.keys(value).some(key => !keys.includes(key)))
+        refuse("invalid_registry_shape");
+    return value;
+}
+/** Operator registry is a selector, not signing authority or qualification evidence. */
+export function selectRegistryRelease(input, channel, version) {
+    if (!["stable", "preview", "development"].includes(channel))
+        refuse("invalid_selected_channel");
+    const registry = object(input, ["schema_id", "releases", "defaults"]);
+    if (registry.schema_id !== "dd-flow/release-registry@1" || !Array.isArray(registry.releases)
+        || registry.releases.length < 1 || registry.releases.length > 10_000)
+        refuse("invalid_registry_shape");
+    const defaults = object(registry.defaults, ["stable", "preview", "development"], []);
+    const entries = new Map();
+    for (const value of registry.releases) {
+        const entry = object(value, ["channel", "version", "envelope_url"]);
+        if (!["stable", "preview", "development"].includes(String(entry.channel))
+            || typeof entry.version !== "string" || valid(entry.version) !== entry.version
+            || (entry.channel === "stable" && prerelease(entry.version)) || typeof entry.envelope_url !== "string")
+            refuse("invalid_registry_entry");
+        let url;
+        try {
+            url = new URL(entry.envelope_url);
+        }
+        catch {
+            return refuse("invalid_registry_url");
+        }
+        if (url.protocol !== "https:" || url.username || url.password || url.hash || (url.port && url.port !== "443"))
+            refuse("invalid_registry_url");
+        const key = `${entry.channel}/${entry.version}`;
+        if (entries.has(key))
+            refuse("duplicate_registry_selection");
+        entries.set(key, { channel: entry.channel, version: entry.version, envelope_url: entry.envelope_url });
+    }
+    for (const [key, selected] of Object.entries(defaults)) {
+        if (typeof selected !== "string" || !entries.has(`${key}/${selected}`))
+            refuse("invalid_registry_default");
+    }
+    const selected = version ?? defaults[channel];
+    if (typeof selected !== "string" || valid(selected) !== selected)
+        refuse("missing_or_invalid_release_version");
+    const entry = entries.get(`${channel}/${selected}`);
+    if (!entry)
+        refuse("release_not_in_selected_channel");
+    return { ...entry };
+}
+export function readRegistryRelease(file, channel, version) {
+    const bytes = readBoundedReleaseFile(file, 4 * 1024 * 1024);
+    let input;
+    try {
+        input = JSON.parse(bytes.toString("utf8"));
+    }
+    catch {
+        return refuse("invalid_registry_json");
+    }
+    return selectRegistryRelease(input, channel, version);
+}

package/dist/services/release-source.js

@@ -0,0 +1,194 @@
+import fs from "node:fs";
+import path from "node:path";
+import { createPublicKey } from "node:crypto";
+import { AppError } from "../shared/errors.js";
+import { authenticateReleaseEnvelope, releaseProducerKeyId } from "./release-envelope.js";
+import { verifyReleaseArchive } from "./release-manifest.js";
+import { downloadReleaseArchive } from "./release-download.js";
+function refuse(reason) {
+    throw new AppError("release_source", "Release source cannot be read", 1, { reason, phase: "release_source", effect: "no_effect", help: "setup" });
+}
+/** Bounded regular-file reads; paths, parser excerpts and key material never enter diagnostics. */
+export function readBoundedReleaseFile(file, maxBytes) {
+    if (!Number.isSafeInteger(maxBytes) || maxBytes < 1)
+        refuse("invalid_source_limit");
+    let fd;
+    try {
+        if (!fs.lstatSync(file).isFile())
+            refuse("source_not_regular_file");
+        fd = fs.openSync(file, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0));
+    }
+    catch (error) {
+        if (error instanceof AppError)
+            throw error;
+        return refuse("source_unavailable");
+    }
+    try {
+        const stat = fs.fstatSync(fd);
+        if (!stat.isFile() || stat.size < 1 || stat.size > maxBytes)
+            refuse("source_size_outside_limit");
+        const bytes = Buffer.alloc(stat.size);
+        let offset = 0;
+        while (offset < bytes.length) {
+            const received = fs.readSync(fd, bytes, offset, bytes.length - offset, offset);
+            if (!received)
+                refuse("source_changed_during_read");
+            offset += received;
+        }
+        if (fs.readSync(fd, Buffer.alloc(1), 0, 1, offset) !== 0)
+            refuse("source_changed_during_read");
+        return bytes;
+    }
+    catch (error) {
+        if (error instanceof AppError)
+            throw error;
+        return refuse("source_unavailable");
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+function json(bytes) {
+    try {
+        return JSON.parse(bytes.toString("utf8"));
+    }
+    catch {
+        return refuse("invalid_source_json");
+    }
+}
+/** Explicit operator trust input is separate from the release bundle. No implicit key enrollment. */
+export function readTrustedReleaseProducers(file) {
+    const input = json(readBoundedReleaseFile(file, 1024 * 1024));
+    if (!input || typeof input !== "object" || Array.isArray(input) || Object.keys(input).length !== 2 || Object.keys(input).some(key => !["producers", "schema_id"].includes(key)))
+        refuse("invalid_trust_shape");
+    const settings = input;
+    if (settings.schema_id !== "dd-flow/release-trust@1" || !Array.isArray(settings.producers) || settings.producers.length < 1 || settings.producers.length > 100)
+        refuse("invalid_trust_shape");
+    const result = new Map();
+    for (const input of settings.producers) {
+        if (!input || typeof input !== "object" || Array.isArray(input) || Object.keys(input).length !== 3 || Object.keys(input).some(key => !["channels", "public_key_pem", "repository"].includes(key)))
+            refuse("invalid_producer_shape");
+        const producer = input;
+        if (typeof producer.public_key_pem !== "string" || !/^-----BEGIN PUBLIC KEY-----\r?\n[A-Za-z0-9+/=\r\n]+-----END PUBLIC KEY-----\r?\n?$/.test(producer.public_key_pem) ||
+            typeof producer.repository !== "string" || !/^[A-Za-z0-9][A-Za-z0-9_.-]*\/[A-Za-z0-9][A-Za-z0-9_.-]*$/.test(producer.repository) ||
+            !Array.isArray(producer.channels) || producer.channels.length < 1 || producer.channels.length > 3 ||
+            producer.channels.some(channel => !["stable", "preview", "development"].includes(channel)) || new Set(producer.channels).size !== producer.channels.length)
+            refuse("invalid_producer_scope");
+        try {
+            const publicKey = createPublicKey(producer.public_key_pem), id = releaseProducerKeyId(publicKey);
+            if (result.has(id))
+                refuse("duplicate_producer_key");
+            result.set(id, { publicKey, repository: producer.repository, channels: new Set(producer.channels) });
+        }
+        catch (error) {
+            if (error instanceof AppError)
+                throw error;
+            return refuse("invalid_producer_key");
+        }
+    }
+    return result;
+}
+/** Authenticate metadata before reading archives; all integrity checks precede installation writes. */
+export function readLocalReleaseBundle(root, producers, compatibility) {
+    try {
+        if (!fs.lstatSync(root).isDirectory())
+            refuse("source_not_directory");
+    }
+    catch (error) {
+        if (error instanceof AppError)
+            throw error;
+        return refuse("source_unavailable");
+    }
+    const envelope = json(readBoundedReleaseFile(path.join(root, "release-envelope.json"), 24 * 1024 * 1024));
+    const authenticated = authenticateReleaseEnvelope(envelope, producers, compatibility);
+    const canonArchive = readBoundedReleaseFile(path.join(root, "canon.tgz"), Math.min(authenticated.manifest.canon.archive.bytes, 256 * 1024 * 1024));
+    const engineArchive = readBoundedReleaseFile(path.join(root, "engine.tgz"), Math.min(authenticated.manifest.engine.archive.bytes, 256 * 1024 * 1024));
+    verifyReleaseArchive(authenticated.manifest.canon.archive, canonArchive);
+    verifyReleaseArchive(authenticated.manifest.engine.archive, engineArchive);
+    return { envelope, authenticated, canonArchive, engineArchive };
+}
+function remoteUrl(input) {
+    let url;
+    try {
+        url = new URL(input);
+    }
+    catch {
+        return refuse("invalid_remote_source");
+    }
+    // The explicit source selects a transport origin, never a signing key.
+    if (url.protocol !== "https:" || url.username || url.password || url.hash || (url.port && url.port !== "443"))
+        refuse("unsafe_remote_source");
+    return url;
+}
+/** Remote metadata is untrusted until signature verification; archives are fetched only afterward.
+ * Redirects, cross-origin artifacts and implicit credential forwarding are never admitted.
+ */
+export async function readRemoteReleaseBundle(source, producers, compatibility, options = {}) {
+    const url = remoteUrl(source), timeoutMs = options.timeoutMs ?? 60_000;
+    if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 60_000)
+        refuse("invalid_source_timeout");
+    const fetcher = options.fetch ?? globalThis.fetch;
+    let response;
+    try {
+        response = await fetcher(url, { redirect: "error", signal: AbortSignal.timeout(timeoutMs), credentials: "omit" });
+    }
+    catch {
+        return refuse("remote_source_unavailable_or_redirect");
+    }
+    if (!response.ok || !response.body) {
+        await response.body?.cancel();
+        return refuse("remote_source_http_failure");
+    }
+    const maxBytes = 24 * 1024 * 1024, length = response.headers.get("content-length");
+    if (length !== null && (!/^[0-9]+$/.test(length) || Number(length) < 1 || Number(length) > maxBytes)) {
+        await response.body.cancel();
+        return refuse("remote_source_size_outside_limit");
+    }
+    const reader = response.body.getReader(), chunks = [];
+    let received = 0;
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            received += value.byteLength;
+            if (received > maxBytes) {
+                await reader.cancel();
+                return refuse("remote_source_size_outside_limit");
+            }
+            chunks.push(Buffer.from(value));
+        }
+    }
+    catch (error) {
+        if (error instanceof AppError)
+            throw error;
+        return refuse("remote_source_interrupted");
+    }
+    finally {
+        reader.releaseLock();
+    }
+    if (!received || (length !== null && Number(length) !== received))
+        refuse("remote_source_length_mismatch");
+    const envelope = json(Buffer.concat(chunks, received));
+    const authenticated = authenticateReleaseEnvelope(envelope, producers, compatibility);
+    if (options.expectedVersion !== undefined && authenticated.manifest.version !== options.expectedVersion)
+        refuse("selected_version_mismatch");
+    for (const artifact of [authenticated.manifest.canon.archive, authenticated.manifest.engine.archive]) {
+        if (remoteUrl(artifact.url).origin !== url.origin)
+            refuse("cross_origin_artifact_refused");
+    }
+    const archives = [];
+    for (const artifact of ["canon", "engine"]) {
+        archives.push(await downloadReleaseArchive(authenticated.manifest[artifact].archive, {
+            allowedHosts: new Set([url.hostname]), timeoutMs, fetch: fetcher,
+            ...(options.onProgress ? { onProgress: progress => options.onProgress({ artifact, ...progress }) } : {})
+        }));
+    }
+    return { envelope, authenticated, canonArchive: archives[0], engineArchive: archives[1] };
+}
+/** One source selector for setup/update; local bundles remain fully offline. */
+export async function readReleaseBundle(source, producers, compatibility, options = {}) {
+    if (/^https?:\/\//i.test(source))
+        return readRemoteReleaseBundle(source, producers, compatibility, options);
+    return readLocalReleaseBundle(source, producers, compatibility);
+}

package/dist/services/repair-intents.js

@@ -6,7 +6,7 @@ import { assertSourceRepairEligible } from "./code-checks.js";
 /** Checks finish before entering this synchronous registration transaction. */
 export function ensureAggregateRepair(context, input, create) {
     if (!input.failures.length)
-        throw new AppError("repair_intent_invalid", "Repair requires assertion-backed failed receipts", 1);
+        throw new AppError("repair_intent_invalid", "Repair requires candidate-source-backed failed receipts", 1);
     assertSourceRepairEligible(input.failures);
     const causes = input.failures.map(receipt => ({ id: receipt.id, epoch: receipt.verification_epoch, fingerprint: receipt.workspace_fingerprint })).sort((a, b) => a.id.localeCompare(b.id));
     return ensureRepairIntent(context, { ...input, causes: { receipts: causes, origins: [...(input.origins ?? [])].sort() } }, create);

package/dist/services/review-copy.js

@@ -27,14 +27,22 @@ export function reviewerSourceInstruction(root, aspectIds) {
     return ["Read the assigned canonical criterion files and the available project orientation below before independent review. Apply each criterion's scope; a small behavior change is not by itself a reason to omit testing or evidence. These starting inputs do not limit relevant project investigation. Do not edit them.", ...inputs.map(input => `- ${path.join(root, input.path)} (SHA256 ${input.sha256})`)].join("\n");
 }
 export function reviewEnvironmentAllowed(file) {
-    return localEnvironmentAllowed(file);
+    // Relative evidence names are scoped to the project: a private parent also
+    // makes its children private. Absolute filesystem traversal checks each
+    // directory separately, without classifying ancestors outside the workspace.
+    return path.isAbsolute(file) || path.win32.isAbsolute(file)
+        ? localEnvironmentAllowed(file)
+        : file.split(/[\\/]/).every(part => localEnvironmentAllowed(part));
 }
 export function reviewSourcePaths(root, explicitInputs = [], base = "HEAD") {
     const inventory = workspaceGitFiles(root, ["--cached", "--others", "--exclude-standard"]);
     if (inventory === null)
         return null;
     const serviceAllowed = projectServicePathFilter(root, explicitInputs);
-    const hasBase = base !== "HEAD" || spawnSync("git", ["-C", root, "rev-parse", "--verify", "HEAD"], { encoding: "utf8" }).status === 0;
+    const hasHead = spawnSync("git", ["-C", root, "rev-parse", "--verify", "HEAD"], { encoding: "utf8" }).status === 0;
+    if (base === "unborn" && hasHead)
+        throw new AppError("review_git_evidence_failed", "Unborn review baseline no longer matches the workspace", 1, { workspace_root: root });
+    const hasBase = base === "unborn" ? false : base !== "HEAD" || hasHead;
     const changes = hasBase ? spawnSync("git", ["-C", root, "diff", "--name-status", "-z", "--find-renames", base, "--"], { encoding: "utf8", maxBuffer: 64 * 1024 * 1024 }) : null;
     if (changes && (changes.status !== 0 || changes.error))
         throw new AppError("review_git_evidence_failed", "Could not classify renamed review paths", 1, { workspace_root: root, cause: changes.error?.message ?? changes.stderr });