@deksden-com/dd-flow-cli 0.9.0-beta.144 → 0.9.0-beta.149

package/dist/services/memory-finish-evidence.js

@@ -13,14 +13,23 @@ import { ObservedMemorySources } from "./memory-source-observations.js";
 import { memorySourceKey, PreparedMemoryStageResult } from "./memory-stage-results.js";
 import { PreparedDescriptorStageSettlement } from "./descriptor-stage-settlement.js";
 import { assertPreparedRunBundleSqlAuthority } from "./runs.js";
-import { readMemoryInitBootstrapReadiness } from "./memory-init-bootstrap-readiness.js";
-import { readMemoryInitGitPolicy } from "./memory-init-git-policy.js";
 import { reviewedMemoryGitFiles } from "./memory-git-integration.js";
+import { readMemoryFinishGitSelection, readMemoryUpgradeFinishInventory } from "./memory-finish-integration.js";
 const token = Symbol("memory-finish-evidence"), event = "memory.finish_evidence";
 const hash = (bytes) => createHash("sha256").update(bytes).digest("hex");
 function refuse(reason) {
     throw new AppError("memory_finish_evidence_invalid", "Finish evidence lacks independently prepared acceptance custody", 2, { reason, effect: "no_effect" });
 }
+export function parseMemoryFinishProposal(bytes) {
+    if (!(bytes instanceof Uint8Array) || !bytes.length || bytes.length > 1024 * 1024)
+        refuse("invalid_result_bytes");
+    try {
+        return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+    }
+    catch {
+        throw new AppError("memory_finish_evidence_invalid", "Finish proposal must be valid UTF-8 JSON. Correct only the proposal syntax, then use retry_command; do not rerun integration or settled checks", 2, { reason: "invalid_result_json", phase: "prepare", effect: "no_effect", recoverable: true, result_sha256: hash(bytes) });
+    }
+}
 /** Terminal inventory and receipts belong to the accepted review/evidence
  * owners. Optional echoes cannot introduce new references or semantic claims. */
 export function projectMemoryFinishResult(value, owner, resultSha256) {
@@ -77,11 +86,24 @@ function acceptance(context, scope) {
         refuse("ambiguous_finish_acceptance");
     return rows[0] ? JSON.parse(rows[0].payload_json) : null;
 }
+/** Terminal parsing inherits the accepted scope and named old-data criteria;
+ * no fresh version inference or mutable project sources are consulted. */
+function upgradeBinding(context, scope, bundle) {
+    if (bundle.descriptor.descriptor.id !== "mb-upgrade")
+        refuse("upgrade_preservation_binding_changed");
+    const preflight = readAcceptedStageData(context, { ...scope, stage: "preflight" });
+    const diff = readAcceptedStageData(context, { ...scope, stage: "diff-analysis" });
+    const preservationInvariants = JSON.parse(preflight.bytes.toString("utf8")).details.preservation_invariants;
+    const minimumMode = JSON.parse(diff.bytes.toString("utf8")).details.mode;
+    if (!["patch", "targeted_minor", "full_migration"].includes(minimumMode) || !Array.isArray(preservationInvariants))
+        refuse("upgrade_preservation_binding_changed");
+    return { minimumMode, preservationInvariants };
+}
 /** SQL-only historical byte/projection custody. Callers must independently
  * prepare the genuine accepted review owner outside their writer. This does
  * not re-observe today's integration checkout or grant RUN closure. */
 export function readAcceptedMemoryFinishEvidence(context, input) {
-    if (!(input.bundle instanceof RetainedExecutionBundle) || input.bundle.descriptor.descriptor.id !== "mb-init"
+    if (!(input.bundle instanceof RetainedExecutionBundle) || !["mb-init", "mb-upgrade"].includes(input.bundle.descriptor.descriptor.id)
         || !PreparedMemoryFinishReview.isPrepared(input.review))
         refuse("registered_memory_review_required");
     const scope = { ...input.scope, stage: "finish" };
@@ -96,7 +118,7 @@ export function readAcceptedMemoryFinishEvidence(context, input) {
         || evidence.attempt !== stage.attempt || evidence.input_sha256 !== stage.input_sha256
         || evidence.bundle_sha256 !== input.bundle.sha256 || evidence.review_sha256 !== reviewData.result.sha256
         || !input.review.bytes().equals(reviewData.bytes)
-        || data.data_schema_id !== "dd-flow/mb-init-finish-result@1" || data.input_sha256 !== stage.input_sha256
+        || data.data_schema_id !== (input.bundle.descriptor.descriptor.id === "mb-upgrade" ? "dd-flow/mb-upgrade-stage-result@1" : "dd-flow/mb-init-finish-result@1") || data.input_sha256 !== stage.input_sha256
         || hybridDigest(evidence.checks) !== hybridDigest(input.review.finalChecks(context)))
         refuse("accepted_finish_evidence_changed");
     const expectedAcceptance = { schema_id: "dd-flow/memory-finish-acceptance@1", project_id: scope.projectId, run_id: scope.runId,
@@ -134,16 +156,18 @@ export function readAcceptedMemoryFinishEvidence(context, input) {
         refuse("historical_evidence_projection_changed");
     const frozen = input.bundle.execution.snapshot().scope;
     const request = { requestId: frozen.requestId, projectRoot: frozen.projectRoot, workspaceRoot: frozen.workspace };
-    const bootstrap = readMemoryInitBootstrapReadiness(context, request), policy = readMemoryInitGitPolicy(context, request);
-    if (!bootstrap || !policy || bootstrap.projectId !== scope.projectId
-        || bootstrap.authority.binding.execution_sha256 !== input.bundle.execution.sha256
-        || bootstrap.authority.binding.git_policy_sha256 !== hybridDigest(policy)
-        || policy.target_sha256 !== hybridDigest(bootstrap.authority.binding.target)
-        || readiness.value.bootstrap_authority_sha256 !== hybridDigest(bootstrap.authority)
-        || readiness.value.pack_sha256 !== bootstrap.authority.binding.pack_sha256)
+    const selected = readMemoryFinishGitSelection(context, scope, input.bundle), policy = selected.policy;
+    const packSha256 = selected.kind === "init" ? selected.readiness.authority.binding.pack_sha256 : selected.readiness.authority.receipt.upgrade_target.pack_sha256;
+    if (readiness.value.bootstrap_authority_sha256 !== hybridDigest(selected.readiness.authority)
+        || readiness.value.pack_sha256 !== packSha256)
         refuse("historical_terminal_bootstrap_policy_changed");
     const integrated = integration.value;
-    const reviewedFiles = reviewedMemoryGitFiles(input.review.reviewedSources(context));
+    const upgrade = selected.kind === "upgrade" ? readMemoryUpgradeFinishInventory(context, scope, input.bundle, input.review) : null;
+    const reviewedFiles = upgrade?.references ?? reviewedMemoryGitFiles(input.review.reviewedSources(context));
+    if (upgrade && (integrated.upgrade_inventory_sha256 !== hybridDigest(upgrade)
+        || integrated.removed_files_sha256 !== (upgrade.removals.length ? hybridDigest(upgrade.removals) : undefined)
+        || hybridDigest([readiness.value.migration_record]) !== hybridDigest([upgrade.migrationRecord])))
+        refuse("historical_upgrade_inventory_changed");
     if (integrated.schema_id !== "dd-flow/memory-git-integration-observation@1"
         || integrated.project_root !== request.projectRoot || integrated.workspace_root !== request.workspaceRoot
         || integrated.repository !== policy.repository || integrated.workspace_branch !== policy.workspace_branch
@@ -167,11 +191,13 @@ export function readAcceptedMemoryFinishEvidence(context, input) {
         runId: scope.runId, stage: "finish", inputSha256: stage.input_sha256,
         predecessors: [{ stage: "review", result: reviewData.result, input_sha256: reviewData.input_sha256 }],
         unitIds: reviewed.units.map((unit) => unit.id), sources,
+        ...(upgrade ? { upgrade: upgradeBinding(context, scope, input.bundle) } : {}),
         historicalEvidence: new Set(reviewed.units.flatMap((unit) => unit.evidence.map(ref => `${memorySourceKey(ref.root, ref.path)}\0${ref.sha256}`)))
     });
     const value = result.value(), references = { coverage: evidence.coverage,
         checks: evidence.checks.map(({ path, sha256 }) => ({ path, sha256 })),
-        integration: evidence.integration, normal_flow_readiness: evidence.normal_flow_readiness };
+        integration: evidence.integration, normal_flow_readiness: evidence.normal_flow_readiness,
+        ...(upgrade ? { migration_record: upgrade.migrationRecord } : {}) };
     if (value.outcome !== "accepted" || hybridDigest(value.units) !== hybridDigest(reviewed.units)
         || hybridDigest(value.findings) !== hybridDigest(reviewed.findings) || hybridDigest(value.details) !== hybridDigest(references))
         refuse("historical_finish_result_projection_changed");
@@ -209,7 +235,7 @@ export class PreparedMemoryFinishEvidence {
         Object.freeze(this);
     }
     static prepare(context, input) {
-        if (!(input.bundle instanceof RetainedExecutionBundle) || input.bundle.descriptor.descriptor.id !== "mb-init")
+        if (!(input.bundle instanceof RetainedExecutionBundle) || !["mb-init", "mb-upgrade"].includes(input.bundle.descriptor.descriptor.id))
             refuse("registered_memory_bundle_required");
         if (context.db.isOwnedWriteTransaction?.())
             refuse("preparation_outside_writer_required");
@@ -258,7 +284,8 @@ export class PreparedMemoryFinishEvidence {
     references() {
         const value = this.#receipt;
         return { coverage: { ...value.coverage }, checks: value.checks.map(({ path, sha256 }) => ({ path, sha256 })),
-            integration: { ...value.integration }, normal_flow_readiness: { ...value.normal_flow_readiness } };
+            integration: { ...value.integration }, normal_flow_readiness: { ...value.normal_flow_readiness },
+            ...(this.#bundle.descriptor.descriptor.id === "mb-upgrade" ? { migration_record: this.#readiness.value().migration_record } : {}) };
     }
     /** Fresh terminal result preparation, never a historical replay reader.
      * The proposal cannot replace accepted review coverage or CLI evidence. */
@@ -274,18 +301,13 @@ export class PreparedMemoryFinishEvidence {
         if (typeof review.input_sha256 !== "string")
             refuse("accepted_review_input_missing");
         const reviewed = JSON.parse(this.#review.bytes().toString("utf8"));
-        let proposal;
-        try {
-            proposal = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
-        }
-        catch {
-            refuse("invalid_result_bytes");
-        }
+        const proposal = parseMemoryFinishProposal(bytes);
         const canonical = projectMemoryFinishResult(proposal, { units: reviewed.units, findings: reviewed.findings, details: this.references() }, hash(bytes));
         const result = PreparedMemoryStageResult.prepare(Buffer.from(JSON.stringify(canonical)), bundle.descriptor, {
             runId: this.#scope.runId, stage: "finish", inputSha256: this.#input.inputSha256,
             predecessors: [{ stage: "review", result: review.result, input_sha256: review.input_sha256 }],
             unitIds: reviewed.units.map((unit) => unit.id), sources: sources.hashes(),
+            ...(bundle.descriptor.descriptor.id === "mb-upgrade" ? { upgrade: upgradeBinding(context, this.#scope, bundle) } : {}),
             historicalEvidence: new Set(reviewed.units.flatMap((unit) => unit.evidence.map(ref => `${memorySourceKey(ref.root, ref.path)}\0${ref.sha256}`)))
         });
         const value = result.value();

package/dist/services/memory-finish-handler.js

@@ -1,3 +1,4 @@
+import { assertMemorySqlCustody, withMemoryCustodySnapshot } from "./memory-custody-snapshot.js";
 import { AppError } from "../shared/errors.js";
 import { RetainedExecutionBundle } from "./execution-bundles.js";
 import { readAcceptedStageData } from "./stage-report-renderer.js";
@@ -32,6 +33,7 @@ function selected(context, scope) {
 /** Closed review predecessor proof only. It does not establish integration,
  * normal-flow readiness, terminal Stage acceptance or RUN completion. */
 export class PreparedMemoryFinishReview {
+    #custodyKey = {};
     static isPrepared(value) {
         return typeof value === "object" && value !== null && #review in value;
     }
@@ -51,40 +53,52 @@ export class PreparedMemoryFinishReview {
         Object.freeze(this);
     }
     static prepare(context, input) {
-        if (!(input.bundle instanceof RetainedExecutionBundle) || input.bundle.descriptor.descriptor.id !== "mb-init"
+        if (!(input.bundle instanceof RetainedExecutionBundle) || !["mb-init", "mb-upgrade"].includes(input.bundle.descriptor.descriptor.id)
             || input.bundle.descriptor.successor("review", "accepted") !== "finish")
             refuse("registered_memory_bundle_required");
         if (context.db.isOwnedWriteTransaction?.())
             refuse("preparation_outside_writer_required");
-        assertPreparedRunBundleSqlAuthority(context, input.scope, input.bundle);
-        const data = context.db.readSnapshot(() => selected(context, input.scope));
-        const review = data.corrected
-            ? PreparedAcceptedMemoryCorrectedReview.prepare(context, { ...input, bytes: data.data.bytes })
-            : PreparedAcceptedMemoryInitialReview.prepare(context, { ...input, bytes: data.data.bytes });
-        const prepared = new PreparedMemoryFinishReview(token, input.scope, review, data);
-        prepared.revalidate(context);
-        return prepared;
+        return withMemoryCustodySnapshot(context, () => {
+            assertPreparedRunBundleSqlAuthority(context, input.scope, input.bundle);
+            const data = context.db.readSnapshot(() => selected(context, input.scope));
+            const review = data.corrected
+                ? PreparedAcceptedMemoryCorrectedReview.prepare(context, { ...input, bytes: data.data.bytes })
+                : PreparedAcceptedMemoryInitialReview.prepare(context, { ...input, bytes: data.data.bytes });
+            const prepared = new PreparedMemoryFinishReview(token, input.scope, review, data);
+            prepared.revalidate(context);
+            return prepared;
+        });
     }
     bytes() { return Buffer.from(this.#bytes); }
     reviewedSources(context) { this.assertCustody(context); return this.#review.reviewedSources(context); }
+    reviewedDocumentInventory(context) {
+        this.assertCustody(context);
+        return this.#review instanceof PreparedAcceptedMemoryCorrectedReview ? this.#review.settledDocumentBaseline(context).entries() : null;
+    }
     finalChecks(context) { this.assertCustody(context); return this.#review.finalChecks(context); }
     assertCustody(context) {
-        this.#review.assertCustody(context);
-        const data = selected(context, this.#scope);
-        if (data.corrected !== this.#corrected || data.data.authority_sha256 !== this.#authority
-            || !data.data.bytes.equals(this.#bytes))
-            refuse("accepted_review_changed");
+        const review = this.#review;
+        assertMemorySqlCustody(context, this.#custodyKey, () => {
+            review.assertCustody(context);
+            const data = selected(context, this.#scope);
+            if (data.corrected !== this.#corrected || data.data.authority_sha256 !== this.#authority
+                || !data.data.bytes.equals(this.#bytes))
+                refuse("accepted_review_changed");
+        });
+    }
+    revalidate(context) {
+        const review = this.#review;
+        withMemoryCustodySnapshot(context, () => { review.revalidate(context); this.assertCustody(context); });
     }
-    revalidate(context) { this.#review.revalidate(context); this.assertCustody(context); }
 }
-/** Productive terminal entry awaiting the complete six-stage registry. Opens
- * only after historical review proof; no provider dispatch or Git mutation.
+/** Shared terminal entry for registered Memory flows. Opens only after
+ * historical review proof; no provider dispatch or Git mutation.
  * Terminal settlement must separately prove integration and readiness. */
 export function startMemoryFinish(context, input) {
     if (!(input.bytes instanceof Uint8Array) || input.bytes.length > 1024 * 1024)
         refuse("invalid_input_bytes");
     const bundle = readFlowRunExecutionBundle(context, input);
-    if (!bundle || bundle.descriptor.descriptor.id !== "mb-init" || !bundle.descriptor.descriptor.terminal_stages.includes("finish")
+    if (!bundle || !["mb-init", "mb-upgrade"].includes(bundle.descriptor.descriptor.id) || !bundle.descriptor.descriptor.terminal_stages.includes("finish")
         || bundle.descriptor.successor("review", "accepted") !== "finish")
         refuse("registered_memory_bundle_required");
     const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot)), scope = { projectId: project.id, runId: input.runId };
@@ -107,7 +121,7 @@ export function replayAcceptedMemoryFinish(context, input) {
     if (context.db.isOwnedWriteTransaction?.())
         refuse("preparation_outside_writer_required");
     const bundle = readFlowRunExecutionBundle(context, input);
-    if (!bundle || bundle.descriptor.descriptor.id !== "mb-init")
+    if (!bundle || !["mb-init", "mb-upgrade"].includes(bundle.descriptor.descriptor.id))
         refuse("registered_memory_bundle_required");
     const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot)), scope = { projectId: project.id, runId: input.runId };
     const review = PreparedMemoryFinishReview.prepare(context, { scope, bundle });
@@ -149,7 +163,7 @@ export function settleAcceptedMemoryRun(context, input) {
     if (context.db.isOwnedWriteTransaction?.())
         refuse("preparation_outside_writer_required");
     const bundle = readFlowRunExecutionBundle(context, input);
-    if (!bundle || bundle.descriptor.descriptor.id !== "mb-init"
+    if (!bundle || !["mb-init", "mb-upgrade"].includes(bundle.descriptor.descriptor.id)
         || !bundle.descriptor.descriptor.terminal_stages.includes("finish"))
         refuse("registered_memory_bundle_required");
     const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot)), scope = { projectId: project.id, runId: input.runId };
@@ -175,14 +189,14 @@ export function settleAcceptedMemoryRun(context, input) {
  * Publication has its own exact receipt and does not accept the Stage. */
 export function registerMemoryFinishEvidenceFromStage(context, input) {
     const bundle = readFlowRunExecutionBundle(context, input);
-    if (!bundle || bundle.descriptor.descriptor.id !== "mb-init")
+    if (!bundle || !["mb-init", "mb-upgrade"].includes(bundle.descriptor.descriptor.id))
         refuse("registered_memory_bundle_required");
     const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
     return PreparedMemoryFinishEvidence.prepare(context, { scope: { projectId: project.id, runId: input.runId }, bundle }).register(context);
 }
 export function integrateMemoryFinishFromStage(context, input) {
     const bundle = readFlowRunExecutionBundle(context, input);
-    if (!bundle || bundle.descriptor.descriptor.id !== "mb-init")
+    if (!bundle || !["mb-init", "mb-upgrade"].includes(bundle.descriptor.descriptor.id))
         refuse("registered_memory_bundle_required");
     const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
     return integrateMemoryFinish(context, { scope: { projectId: project.id, runId: input.runId }, bundle });
@@ -196,7 +210,7 @@ export function finishMemoryFinish(context, input) {
     if (context.db.isOwnedWriteTransaction?.())
         refuse("preparation_outside_writer_required");
     const bundle = readFlowRunExecutionBundle(context, input);
-    if (!bundle || bundle.descriptor.descriptor.id !== "mb-init")
+    if (!bundle || !["mb-init", "mb-upgrade"].includes(bundle.descriptor.descriptor.id))
         refuse("registered_memory_bundle_required");
     const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot)), scope = { projectId: project.id, runId: input.runId };
     const run = assertPreparedRunBundleSqlAuthority(context, scope, bundle);