@deksden-com/dd-flow-cli 0.9.0-beta.152 → 0.9.0-beta.156

package/dist/services/memory-fix-stage-results.js

@@ -0,0 +1,106 @@
+import { Ajv2020 } from "ajv/dist/2020.js";
+import { AppError } from "../shared/errors.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { validateMemoryFixRouting } from "./diagnostic-repair-intake.js";
+import { assertMemoryRepairWritePaths } from "./memory-review-correction-plan.js";
+import { verifyDiagnosticSources } from "./diagnostic-evidence.js";
+function refuse(reason) {
+    throw new AppError("memory_fix_stage_result_invalid", "Memory repair result requires its selected input, bounded publication and independent observations", 2, { reason, effect: "no_effect", ...(reason === "invalid_schema" ? { phase: "prepare", recoverable: true } : {}) });
+}
+/** Contract/evidence validation only. Registered handlers must prove actual
+ * delivered consent, source-drift assessment, publication and distinct physical
+ * writer/verifier/reviewer ownership before settlement or finding closure.
+ */
+export function validateMemoryFixStageResult(bytes, schemaBytes, binding) {
+    if (!bytes.length || bytes.length > 1024 * 1024 || !schemaBytes.length || schemaBytes.length > 1024 * 1024)
+        refuse("result_exceeds_bound");
+    let result;
+    try {
+        result = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+    }
+    catch {
+        return refuse("invalid_schema");
+    }
+    const validate = (() => {
+        try {
+            const schema = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(schemaBytes));
+            if (schema.$id !== "dd-flow/mb-fix-stage-result@1")
+                refuse("frozen_schema_invalid");
+            return new Ajv2020({ strict: true, validateFormats: false }).compile(schema);
+        }
+        catch {
+            return refuse("frozen_schema_invalid");
+        }
+    })();
+    if (!validate(result) || result?.schema_id !== "dd-flow/mb-fix-stage-result@1" || result.flow_id !== "mb-fix"
+        || typeof result.summary !== "string" || !result.summary.trim())
+        refuse("invalid_schema");
+    if (result.run_id !== binding.runId || result.stage !== binding.stage || result.input_sha256 !== binding.inputSha256
+        || result.intake_sha256 !== binding.intakeSha256 || result.source_observation_sha256 !== binding.sourceObservationSha256
+        || hybridDigest(result.predecessors) !== hybridDigest(binding.predecessors))
+        refuse("foreign_stage_binding");
+    const details = result.details, routing = validateMemoryFixRouting(binding.findingIds, details.routing);
+    if (hybridDigest(routing) !== hybridDigest(details.routing))
+        refuse("routing_order_changed");
+    const repairs = routing.filter(decision => decision.route === "memory_repair").map(decision => decision.finding_id);
+    if (hybridDigest(details.write_scope) !== hybridDigest(binding.writeScope)
+        || hybridDigest(details.repair_receipt) !== hybridDigest(binding.repairReceipt))
+        refuse("unowned_repair_claim");
+    if (details.write_scope) {
+        const scope = details.write_scope, paths = [...new Set(routing.flatMap(decision => decision.write_paths))].sort();
+        assertMemoryRepairWritePaths(scope.paths);
+        if (hybridDigest(scope.finding_ids) !== hybridDigest(repairs)
+            || hybridDigest([...scope.paths].sort()) !== hybridDigest(paths))
+            refuse("repair_scope_changed");
+    }
+    if (!repairs.length && (details.write_scope || details.repair_receipt))
+        refuse("publication_without_repair_findings");
+    if (repairs.length && !details.write_scope)
+        refuse("intake_requires_approved_scope");
+    if (binding.stage === "intake" && details.repair_receipt)
+        refuse("repair_before_intake");
+    if (binding.stage !== "intake" && repairs.length && (!details.write_scope || !details.repair_receipt))
+        refuse("repair_requires_scope_and_receipt");
+    // Approval/publication authority is independently selected from SQL by the
+    // handler. Re-reading mutable projections here neither proves user consent
+    // nor strengthens that custody, and would break supported projection restore.
+    const verify = binding.stage === "verify" || binding.stage === "review" || binding.stage === "finish";
+    const review = binding.stage === "review" || binding.stage === "finish";
+    const observations = (items, expected) => {
+        const ids = items.map(item => item.finding_id);
+        if (new Set(ids).size !== ids.length || ids.length !== expected.length || expected.some(id => !ids.includes(id)))
+            refuse("incomplete_finding_observations");
+        for (const item of items) {
+            if (!item.summary.trim())
+                refuse("invalid_schema");
+            for (const evidence of item.evidence)
+                verifyDiagnosticSources(evidence.root === "run" ? binding.runRoot : binding.projectRoot, [evidence]);
+        }
+    };
+    observations(details.verification, verify ? repairs : []);
+    observations(details.review, review ? binding.findingIds : []);
+    if (details.verification.some(item => item.verdict === "resolved" && !item.evidence.length))
+        refuse("closure_without_evidence");
+    if (details.review.some(item => item.disposition === "accept" && !item.evidence.length))
+        refuse("closure_without_evidence");
+    return result;
+}
+export function assertMemoryFixStageScope(result, prior) {
+    if (result.intake_sha256 !== prior.intake_sha256 || result.source_observation_sha256 !== prior.source_observation_sha256
+        || hybridDigest(result.details.routing) !== hybridDigest(prior.details.routing)
+        || hybridDigest(result.details.write_scope) !== hybridDigest(prior.details.write_scope)
+        || prior.details.limitations.some(value => !result.details.limitations.includes(value))
+        || prior.stage !== "intake" && hybridDigest(result.details.repair_receipt) !== hybridDigest(prior.details.repair_receipt)
+        || ["verify", "review"].includes(prior.stage) && hybridDigest(result.details.verification) !== hybridDigest(prior.details.verification)
+        || prior.stage === "review" && hybridDigest(result.details.review) !== hybridDigest(prior.details.review))
+        refuse("accepted_scope_changed");
+}
+/** Proposed report projection, never a DEF mutation or independent ownership proof. */
+export function memoryFixClosureProjection(result) {
+    if (result.stage !== "finish")
+        refuse("finish_required");
+    return result.details.routing.map(decision => ({ finding_id: decision.finding_id, route: decision.route,
+        status: decision.route === "defer" ? "deferred" : decision.route !== "memory_repair" ? "routed"
+            : result.details.verification.some(item => item.finding_id === decision.finding_id && item.verdict === "resolved")
+                && result.details.review.some(item => item.finding_id === decision.finding_id && item.disposition === "accept") ? "closed" : "open" }));
+}

package/dist/services/memory-fix-workspace.js

@@ -0,0 +1,127 @@
+import fs from "node:fs";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { AppError } from "../shared/errors.js";
+import { projectCheckoutRoot, resolveProjectRoot } from "../storage/paths.js";
+import { requireProjectByRoot } from "./projects.js";
+import { loadVnextWorkspacePolicy } from "./vnext-workspace-policy.js";
+import { prepareManagedWorktree, createManagedWorktree } from "./worktrees.js";
+import { inspectMemoryGitExecutable } from "./memory-init-preflight.js";
+import { prepareMemoryFixGitPolicy } from "./memory-fix-finish-integration.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { appendAudit } from "./audit.js";
+const intentEvent = "memory_fix.workspace_intent", readyEvent = "memory_fix.workspace_ready";
+function refuse(reason) { throw new AppError("memory_fix_workspace_invalid", "Repair workspace requires its original project-scoped selection", 2, { reason, effect: "no_effect" }); }
+function pending(reason, details = {}) {
+    throw new AppError("memory_fix_workspace_pending", "Reconcile the original workspace creation before redispatch", 1, { reason, effect: "unknown", next_action: "reconcile_original_workspace", ...details });
+}
+/** Worktrunk owns physical creation. This wrapper retains one intent before
+ * dispatch and never reruns an unresolved creation or adopts a foreign tree. */
+export async function prepareMemoryFixWorkspace(context, input) {
+    if (context.db.isOwnedWriteTransaction?.())
+        refuse("preparation_outside_writer_required");
+    const projectRoot = resolveProjectRoot(input.projectRoot), project = requireProjectByRoot(context, projectRoot);
+    if (projectRoot !== input.projectRoot || !/^[A-Za-z0-9][A-Za-z0-9_.-]{0,95}$/.test(input.requestId))
+        refuse("invalid_scope");
+    if (input.selectionSha256 !== undefined && !/^[a-f0-9]{64}$/.test(input.selectionSha256))
+        refuse("invalid_selection_identity");
+    const scope = { projectRoot, requestId: input.requestId };
+    const read = (event) => {
+        const rows = context.db.all("SELECT payload_json FROM audit_events WHERE project_id=? AND event_type=? AND json_extract(payload_json,'$.scope.requestId')=? LIMIT 2", [project.id, event, input.requestId]);
+        if (!rows.length)
+            return null;
+        if (rows.length !== 1 || Buffer.byteLength(rows[0].payload_json) > 32768)
+            pending("ambiguous_workspace_custody");
+        try {
+            const value = JSON.parse(rows[0].payload_json);
+            if (hybridDigest(value.scope) !== hybridDigest(scope))
+                pending("workspace_scope_changed");
+            return value;
+        }
+        catch {
+            return pending("invalid_workspace_custody");
+        }
+    };
+    const observe = (intent) => {
+        const policy = prepareMemoryFixGitPolicy(context.env, { scope: { ...scope, workspaceRoot: intent.workspace_root }, gitExecutable: intent.git_executable, selection: intent.git_policy });
+        const git = JSON.parse(policy.bytes.toString("utf8")).policy;
+        if (intent.creation && (git.workspace_branch !== intent.creation.branch || git.initial_head !== intent.creation.base))
+            refuse("created_workspace_baseline_changed");
+        const stat = fs.lstatSync(intent.workspace_root);
+        if (!stat.isDirectory() || fs.realpathSync(intent.workspace_root) !== intent.workspace_root)
+            refuse("workspace_identity_changed");
+        return { policy_sha256: policy.sha256, owner: { dev: stat.dev, ino: stat.ino } };
+    };
+    const retainReady = (intent, actual) => context.db.writeTransaction(() => {
+        const intentSha256 = hybridDigest(intent), value = { scope, intent_sha256: intentSha256, ...actual };
+        if (hybridDigest(read(intentEvent)) !== intentSha256)
+            pending("workspace_custody_changed");
+        const current = read(readyEvent);
+        if (current) {
+            if (hybridDigest(current) !== hybridDigest(value))
+                pending("workspace_custody_changed");
+            return;
+        }
+        appendAudit(context, { projectId: project.id, eventType: readyEvent, payload: value });
+    });
+    const prior = read(intentEvent);
+    let ready = read(readyEvent);
+    if (prior) {
+        if (input.workspaceRoot !== undefined && input.workspaceRoot !== prior.workspace_root
+            || input.selectionSha256 !== undefined && input.selectionSha256 !== prior.selection_sha256
+            || input.gitPolicy !== undefined && hybridDigest(input.gitPolicy) !== hybridDigest(prior.git_policy))
+            refuse("request_changed");
+        if (!ready && prior.creation && fs.existsSync(prior.workspace_root)) {
+            // Read-only reconciliation of an original creation with a lost reply.
+            // Exact private path/repository/branch/base and a clean tree are required;
+            // no second Worktrunk call, reset or adoption of changed user work occurs.
+            const actual = observe(prior), result = spawnSync(prior.git_executable, ["-c", "core.fsmonitor=false", "-C", prior.workspace_root, "status", "--porcelain=v1", "-z", "--untracked-files=all"], { env: { ...Object.fromEntries(Object.entries(context.env).filter(([key]) => !key.startsWith("GIT_"))), GIT_OPTIONAL_LOCKS: "0" }, timeout: 5000, maxBuffer: 1024 * 1024 });
+            if (result.error || result.signal || result.status !== 0 || result.stdout.length)
+                pending("created_workspace_not_pristine");
+            retainReady(prior, actual);
+            ready = read(readyEvent);
+        }
+        if (!ready || ready.intent_sha256 !== hybridDigest(prior))
+            pending("workspace_creation_unresolved");
+        const actual = observe(prior);
+        if (hybridDigest(actual) !== hybridDigest({ policy_sha256: ready.policy_sha256, owner: ready.owner }))
+            refuse("workspace_changed_before_request_retention");
+        return { workspaceRoot: prior.workspace_root, gitPolicy: prior.git_policy, gitExecutable: prior.git_executable };
+    }
+    if (ready)
+        pending("workspace_intent_missing");
+    const defaults = input.gitPolicy ? null : loadVnextWorkspacePolicy(projectRoot).workspace;
+    const gitPolicy = input.gitPolicy ?? { route: defaults.route, integrationBranch: defaults.integration_branch };
+    const gitExecutable = inspectMemoryGitExecutable(context.env).executable;
+    const key = hybridDigest({ project_id: project.id, scope }).slice(0, 16);
+    const workspaceRoot = input.workspaceRoot ?? (gitPolicy.route === "integration_branch_direct" ? projectRoot
+        : path.join(projectCheckoutRoot(context.ddFlowHome, project.id), "worktrees", `mb-fix-${key}`, path.basename(projectRoot)));
+    const creation = input.workspaceRoot === undefined && gitPolicy.route === "feature_worktree"
+        ? prepareManagedWorktree({ projectRoot, branch: `codex/mb-fix-${key}`, base: gitPolicy.integrationBranch, path: workspaceRoot }) : null;
+    const intent = { scope, workspace_root: workspaceRoot, git_policy: structuredClone(gitPolicy), git_executable: gitExecutable,
+        selection_sha256: input.selectionSha256 ?? null, creation };
+    if (!creation)
+        observe(intent);
+    const claimed = context.db.writeTransaction(() => {
+        if (read(intentEvent) || read(readyEvent))
+            return false;
+        appendAudit(context, { projectId: project.id, eventType: intentEvent, payload: intent });
+        return true;
+    });
+    if (!claimed)
+        pending("workspace_creation_already_owned");
+    try {
+        if (creation) {
+            const created = await createManagedWorktree(context, creation, creation);
+            if (created.worktreePath !== workspaceRoot)
+                pending("unexpected_worktrunk_workspace", { expected_workspace_root: workspaceRoot, observed_workspace_root: created.worktreePath });
+        }
+        retainReady(intent, observe(intent));
+        return { workspaceRoot, gitPolicy, gitExecutable };
+    }
+    catch (error) {
+        if (error instanceof AppError && error.code === "memory_fix_workspace_pending")
+            throw error;
+        return pending(error instanceof AppError ? error.code : "workspace_creation_failed");
+    }
+}

package/dist/services/memory-flow-user-inputs.js

@@ -0,0 +1,88 @@
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { AppError } from "../shared/errors.js";
+import { readFlowRunExecutionBundle, assertPreparedRunBundleSqlAuthority } from "./runs.js";
+import { requireProjectByRoot } from "./projects.js";
+import { resolveProjectRoot } from "../storage/paths.js";
+import { resolveStagePublicationPath } from "./stage-report-renderer.js";
+const hash = (bytes) => createHash("sha256").update(bytes).digest("hex");
+const inputOwners = {
+    "mb-distill": { code: "distill_user_input_invalid", message: "Distillation needs its original delivered request and answers", bundle: "distill_bundle_required", schema: "dd-flow/distill-user-inputs@1" },
+    "mb-fix": { code: "memory_fix_user_input_invalid", message: "Memory repair needs its original delivered request and answers", bundle: "memory_fix_bundle_required", schema: "dd-flow/mb-fix-user-inputs@1" },
+    "review-fix": { code: "review_fix_user_input_invalid", message: "Review-fix needs its original delivered request and answers", bundle: "review_fix_bundle_required", schema: "dd-flow/review-fix-user-inputs@1" },
+    "interactive": { code: "interactive_user_input_invalid", message: "Interactive needs its original delivered request and answers", bundle: "interactive_bundle_required", schema: "dd-flow/interactive-user-answers@1" },
+    "release": { code: "delivery_user_input_invalid", message: "Release needs its original delivered request and answers", bundle: "delivery_bundle_required", schema: "dd-flow/release-user-inputs@1" },
+    "deploy": { code: "delivery_user_input_invalid", message: "Deploy needs its original delivered request and answers", bundle: "delivery_bundle_required", schema: "dd-flow/deploy-user-inputs@1" },
+    "publish": { code: "delivery_user_input_invalid", message: "Publish needs its original delivered request and answers", bundle: "delivery_bundle_required", schema: "dd-flow/publish-user-inputs@1" }
+};
+/** Read task evidence, not approval semantics. A Stage owner must consider the
+ * full ordered input set, select the actual agreement and fence this same set
+ * again before publication. Agent files and result claims are not user input.
+ * SQL custody survives projection loss and supported RUN relocation. */
+export function readMemoryFlowUserInputs(context, input, flowId, retainedBundle) {
+    const owner = Object.hasOwn(inputOwners, flowId) ? inputOwners[flowId] : inputOwners["mb-fix"];
+    function refuse(reason) {
+        throw new AppError(owner.code, owner.message, 1, { reason, effect: "no_effect" });
+    }
+    if (!Object.hasOwn(inputOwners, flowId))
+        refuse("unsupported_flow");
+    const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
+    const bundle = retainedBundle ?? readFlowRunExecutionBundle(context, input);
+    return readPreparedMemoryFlowUserInputs(context, { projectId: project.id, runId: input.runId }, flowId, bundle);
+}
+/** SQL/in-memory read for an already selected RUN. No root discovery or
+ * filesystem reads occur inside a Stage/publication settlement fence. */
+export function readPreparedMemoryFlowUserInputs(context, scope, flowId, bundle) {
+    const owner = Object.hasOwn(inputOwners, flowId) ? inputOwners[flowId] : inputOwners["mb-fix"];
+    function refuse(reason) {
+        throw new AppError(owner.code, owner.message, 1, { reason, effect: "no_effect" });
+    }
+    if (!Object.hasOwn(inputOwners, flowId))
+        refuse("unsupported_flow");
+    if (!bundle || bundle.manifest.flow_id !== flowId)
+        refuse(owner.bundle);
+    return context.db.readSnapshot(() => {
+        const run = assertPreparedRunBundleSqlAuthority(context, scope, bundle);
+        if (!run.run_root)
+            refuse("run_home_required");
+        const request = bundle.blob("runtime/source-request.md"), reference = bundle.manifest.inventory.find(ref => ref.path === "runtime/source-request.md");
+        if (!request.length || request.length > 64 * 1024 || !reference || hash(request) !== reference.sha256)
+            refuse("original_request_missing");
+        const sources = [{ role: "request", event_id: 0, stage: null, pause_id: null,
+                root: "run", path: "execution-bundle/runtime/source-request.md", sha256: reference.sha256, base64: request.toString("base64") }];
+        const rows = context.db.all("SELECT id,payload_json FROM audit_events WHERE project_id=? AND event_type='flow_run.stage_resumed' AND json_extract(payload_json,'$.run_id')=? ORDER BY id LIMIT 129", [scope.projectId, scope.runId]);
+        if (rows.length > 128)
+            refuse("too_many_answers");
+        const pauses = new Set();
+        let total = request.length;
+        for (const row of rows) {
+            if (Buffer.byteLength(row.payload_json) > 64 * 1024)
+                refuse("unbounded_answer_event");
+            const answer = JSON.parse(row.payload_json);
+            if (typeof answer.stage !== "string" || typeof answer.pause_id !== "string" || !answer.pause_id || pauses.has(answer.pause_id)
+                || typeof answer.answer_path !== "string")
+                refuse("ambiguous_answer");
+            pauses.add(answer.pause_id);
+            for (const [role, locator] of [["question", path.join(path.dirname(answer.answer_path), "question.md")], ["answer", answer.answer_path]]) {
+                const file = resolveStagePublicationPath(context, scope.projectId, scope.runId, locator);
+                const relative = path.relative(run.run_root, file).split(path.sep).join("/");
+                if (!relative || path.isAbsolute(relative) || relative.split("/").some(part => !part || part === ".." || part === "."))
+                    refuse("input_outside_run");
+                const packets = context.db.all("SELECT payload_json FROM audit_events WHERE project_id=? AND event_type='flow_run.stage_packet' AND json_extract(payload_json,'$.run_id')=? AND json_extract(payload_json,'$.stage')=? AND json_extract(payload_json,'$.file')=? LIMIT 2", [scope.projectId, scope.runId, answer.stage, locator]);
+                if (packets.length !== 1 || Buffer.byteLength(packets[0].payload_json) > 2 * 1024 * 1024)
+                    refuse("answer_custody_missing");
+                const packet = JSON.parse(packets[0].payload_json);
+                if (typeof packet.base64 !== "string")
+                    refuse("answer_custody_changed");
+                const bytes = Buffer.from(packet.base64, "base64");
+                total += bytes.length;
+                if (!bytes.length || bytes.length > 1024 * 1024 || total > 16 * 1024 * 1024 || bytes.toString("base64") !== packet.base64
+                    || hash(bytes) !== packet.sha256)
+                    refuse("answer_custody_changed");
+                sources.push({ role: role, event_id: row.id, stage: answer.stage, pause_id: answer.pause_id,
+                    root: "run", path: relative, sha256: packet.sha256, base64: packet.base64 });
+            }
+        }
+        return { schema_id: owner.schema, run_id: scope.runId, bundle_sha256: bundle.sha256, sources };
+    });
+}

package/dist/services/memory-init-contexts.js

@@ -7,20 +7,70 @@ import { publishImmutableInput } from "../storage/immutable-input.js";
 import { readBoundedReleaseFile } from "./release-source.js";
 import { readMemoryInitStartupInput } from "./memory-init-startup-custody.js";
 import { readUpgradeStorageReadiness } from "./memory-upgrade-storage-readiness.js";
-import { isDiagnosticFlow } from "../domain/diagnostic-flows.js";
+import { isSourceSnapshotFlow } from "../domain/source-snapshot-flows.js";
 import { readDiagnosticRequest } from "./diagnostic-start.js";
+import { isDeliveryFlow } from "../domain/delivery-flows.js";
+/** Repair's objective is already part of its own retained bundle. Continuation
+ * does not need the source diagnostic or mutable operator/request files. */
+export function prepareMemoryFixContexts(bundle, directory) {
+    return prepareRequestContexts(bundle, directory, "mb-fix");
+}
+/** Static controller candidates carry only the original request. Current turns,
+ * scope and checks are read from their retained owners at each Stage boundary. */
+export function prepareInteractiveContexts(bundle, directory) {
+    return prepareRequestContexts(bundle, directory, "interactive");
+}
+export function prepareDeliveryContexts(bundle, directory) {
+    if (!isDeliveryFlow(bundle.manifest.flow_id))
+        throw new AppError("delivery_context_invalid", "Delivery bundle required", 2, { effect: "no_effect" });
+    return prepareRequestContexts(bundle, directory, bundle.manifest.flow_id);
+}
+export function publishDeliveryContexts(bundle, objective, directory, expectedSha256, expectedOwner) {
+    const original = prepareDeliveryContexts(bundle, directory);
+    if (objective !== original.objective)
+        throw new AppError("delivery_context_invalid", "Delivery objective cannot be replaced", 2, { effect: "no_effect" });
+    return publishMemoryContexts(bundle, objective, directory, expectedSha256, expectedOwner, bundle.manifest.flow_id);
+}
+function prepareRequestContexts(bundle, directory, flowId) {
+    const code = isDeliveryFlow(flowId) ? "delivery_context_invalid" : flowId === "interactive" ? "interactive_context_invalid" : "memory_fix_context_invalid";
+    if (!(bundle instanceof RetainedExecutionBundle) || bundle.manifest.flow_id !== flowId)
+        throw new AppError(code, "Retained request-owning bundle required", 2, { effect: "no_effect" });
+    const bytes = bundle.blob("runtime/source-request.md"), refs = bundle.manifest.inventory.filter(ref => ref.path === "runtime/source-request.md");
+    if (!bytes.length || bytes.length > 64 * 1024 || refs.length !== 1 || refs[0].sha256 !== createHash("sha256").update(bytes).digest("hex"))
+        throw new AppError(code, "Original retained request required", 2, { effect: "no_effect" });
+    let objective;
+    try {
+        objective = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes);
+    }
+    catch {
+        throw new AppError(code, "Original request must be UTF-8", 2, { effect: "no_effect" });
+    }
+    return { ...prepareMemoryContexts(bundle, objective, directory, flowId), objective };
+}
+export function publishInteractiveContexts(bundle, objective, directory, expectedSha256, expectedOwner) {
+    const original = prepareInteractiveContexts(bundle, directory);
+    if (objective !== original.objective)
+        throw new AppError("interactive_context_invalid", "Interactive objective cannot be replaced", 2, { effect: "no_effect" });
+    return publishMemoryContexts(bundle, objective, directory, expectedSha256, expectedOwner, "interactive");
+}
+export function publishMemoryFixContexts(bundle, objective, directory, expectedSha256, expectedOwner) {
+    const original = prepareMemoryFixContexts(bundle, directory);
+    if (objective !== original.objective)
+        throw new AppError("memory_fix_context_invalid", "Repair objective cannot be replaced", 2, { effect: "no_effect" });
+    return publishMemoryContexts(bundle, objective, directory, expectedSha256, expectedOwner, "mb-fix");
+}
 export function prepareDiagnosticContextsFromRequest(context, bundle, directory) {
     const scope = bundle.execution.snapshot().scope, flowId = bundle.manifest.flow_id;
-    if (!isDiagnosticFlow(flowId))
-        throw new AppError("diagnostic_context_invalid", "Diagnostic bundle required", 2, { effect: "no_effect" });
+    if (!isSourceSnapshotFlow(flowId))
+        throw new AppError("diagnostic_context_invalid", "Source-snapshot bundle required", 2, { effect: "no_effect" });
     const request = readDiagnosticRequest(context, { projectRoot: scope.projectRoot, requestId: scope.requestId, flowId });
     if (!request || request.execution_sha256 !== bundle.execution.sha256)
         throw new AppError("diagnostic_context_invalid", "Original diagnostic objective required", 2, { effect: "no_effect" });
     return { ...prepareMemoryContexts(bundle, request.objective, directory, flowId), objective: request.objective };
 }
 export function publishDiagnosticContexts(bundle, objective, directory, expectedSha256, expectedOwner) {
-    if (!isDiagnosticFlow(bundle.manifest.flow_id))
-        throw new AppError("diagnostic_context_invalid", "Diagnostic bundle required", 2, { effect: "no_effect" });
+    if (!isSourceSnapshotFlow(bundle.manifest.flow_id))
+        throw new AppError("diagnostic_context_invalid", "Source-snapshot bundle required", 2, { effect: "no_effect" });
     return publishMemoryContexts(bundle, objective, directory, expectedSha256, expectedOwner, bundle.manifest.flow_id);
 }
 /** Original upgrade intake comes from the independently retained storage

package/dist/services/memory-init-controller-start.js

@@ -11,9 +11,16 @@ import { requireRun } from "./run-controller-state.js";
 import { prepareRunControllerLaunch } from "./run-controller.js";
 import { prepareMemoryInitContextsFromStartup, publishMemoryInitContexts, prepareMemoryUpgradeContextsFromStartup, publishMemoryUpgradeContexts } from "./memory-init-contexts.js";
 import { parseRuntimeBudget } from "./runtime-budget.js";
-import { isDiagnosticFlow } from "../domain/diagnostic-flows.js";
+import { isSourceSnapshotFlow } from "../domain/source-snapshot-flows.js";
 import { startDiagnosticRun } from "./diagnostic-start.js";
 import { prepareDiagnosticContextsFromRequest, publishDiagnosticContexts } from "./memory-init-contexts.js";
+import { prepareMemoryFixContexts, publishMemoryFixContexts } from "./memory-init-contexts.js";
+import { startMemoryFixRun } from "./memory-fix-request.js";
+import { startInteractiveRun } from "./interactive-request.js";
+import { prepareInteractiveContexts, publishInteractiveContexts } from "./memory-init-contexts.js";
+import { prepareDeliveryContexts, publishDeliveryContexts } from "./memory-init-contexts.js";
+import { isDeliveryFlow } from "../domain/delivery-flows.js";
+import { startDeliveryRun } from "./delivery-request.js";
 function refuse(reason) {
     throw new AppError("memory_init_controller_start_invalid", "Init controller requires its exact published startup request", 1, { reason, effect: "no_effect", next_action: "reconcile_exact_request" });
 }
@@ -30,6 +37,15 @@ export function prepareMemoryUpgradeControllerStart(context, scope) {
 export function prepareDiagnosticControllerStart(context, scope, flowId) {
     return prepareMemoryControllerStart(context, scope, flowId);
 }
+export function prepareMemoryFixControllerStart(context, scope) {
+    return prepareMemoryControllerStart(context, scope, "mb-fix");
+}
+export function prepareInteractiveControllerStart(context, scope) {
+    return prepareMemoryControllerStart(context, scope, "interactive");
+}
+export function prepareDeliveryControllerStart(context, scope, flowId) {
+    return prepareMemoryControllerStart(context, scope, flowId);
+}
 function prepareMemoryControllerStart(context, scope, flowId) {
     validateMemoryInitStartupScope(scope);
     if (context.db.isOwnedWriteTransaction?.())
@@ -47,7 +63,7 @@ function prepareMemoryControllerStart(context, scope, flowId) {
         refuse("published_run_required");
     // Restores the exact request and verifies independent SQL/physical root
     // ownership without consulting current canon/profiles or creating a RUN.
-    const started = isDiagnosticFlow(flowId) ? startDiagnosticRun(context, { projectRoot: scope.projectRoot, requestId: scope.requestId, flowId })
+    const started = isDeliveryFlow(flowId) ? startDeliveryRun(context, { projectRoot: scope.projectRoot, requestId: scope.requestId, flowId }) : flowId === "interactive" ? startInteractiveRun(context, scope) : flowId === "mb-fix" ? startMemoryFixRun(context, scope) : isSourceSnapshotFlow(flowId) ? startDiagnosticRun(context, { projectRoot: scope.projectRoot, requestId: scope.requestId, flowId })
         : flowId === "mb-init" ? startMemoryInitRun(context, scope) : startMemoryUpgradeRun(context, scope);
     const run = requireRun(context, project.id, started.runId);
     const bundle = readFlowRunExecutionBundle(context, { projectRoot: scope.projectRoot, runId: run.id });
@@ -55,7 +71,7 @@ function prepareMemoryControllerStart(context, scope, flowId) {
         refuse("retained_bundle_required");
     if (bundle.execution.settings.execution !== "managed")
         refuse("managed_execution_required");
-    const contexts = isDiagnosticFlow(flowId) ? prepareDiagnosticContextsFromRequest(context, bundle, run.run_root)
+    const contexts = isDeliveryFlow(flowId) ? prepareDeliveryContexts(bundle, run.run_root) : flowId === "interactive" ? prepareInteractiveContexts(bundle, run.run_root) : flowId === "mb-fix" ? prepareMemoryFixContexts(bundle, run.run_root) : isSourceSnapshotFlow(flowId) ? prepareDiagnosticContextsFromRequest(context, bundle, run.run_root)
         : flowId === "mb-init" ? prepareMemoryInitContextsFromStartup(context, bundle, run.run_root)
             : prepareMemoryUpgradeContextsFromStartup(context, bundle, run.run_root);
     const input = { projectRoot: scope.projectRoot, runId: run.id, requestId: scope.requestId,
@@ -91,7 +107,7 @@ function prepareMemoryControllerStart(context, scope, flowId) {
     });
     if (!rootOwner || !Number.isSafeInteger(rootOwner.dev) || !Number.isSafeInteger(rootOwner.ino))
         refuse("root_owner_changed");
-    const publish = isDiagnosticFlow(flowId) ? publishDiagnosticContexts : flowId === "mb-init" ? publishMemoryInitContexts : publishMemoryUpgradeContexts;
+    const publish = isDeliveryFlow(flowId) ? publishDeliveryContexts : flowId === "interactive" ? publishInteractiveContexts : flowId === "mb-fix" ? publishMemoryFixContexts : isSourceSnapshotFlow(flowId) ? publishDiagnosticContexts : flowId === "mb-init" ? publishMemoryInitContexts : publishMemoryUpgradeContexts;
     publish(bundle, contexts.objective, run.run_root, contexts.sha256, rootOwner);
     try {
         return { input, prepared: prepareRunControllerLaunch(context, input) };

package/dist/services/memory-layer.js

@@ -12,12 +12,14 @@ import { inspectReleaseArchive } from "./release-archive.js";
 import { canonicalOnlyFlowNames } from "./version-status.js";
 export function isCanonicalOnlyMemoryPath(logical) {
     return logical.startsWith("dd-flow/project-review/")
+        || logical.startsWith("dd-flow/delivery/")
+        || logical === "dd-flow/mb-sdlc/review-fix.md"
         || canonicalOnlyFlowNames.some(name => logical === `dd-flow/${name}` || logical.startsWith(`dd-flow/${name.slice(0, -3)}/`));
 }
 const rootFiles = ["README.md", "index.md", "compatibility.json", "flow-contract.json", "go.md", "f.md", "prime.md", "protocol.md",
     "protocol-implement.md", "plan.md", "code.md", "merge.md", "merge-start.md", "merge-stop.md", "release.md", "deploy.md", "publish.md",
-    "review-fix.md", "mb-fix.md", "mb-lint.md", "interactive.md", "finish.md", "fix-def.md"];
-const supportDirectories = ["common", "prime", "mb-sdlc", "aspects", "def", "workers", "schemas", "vnext", "specify", "stage-reports", "dashboard", "plan", "code", "merge"];
+    "mb-lint.md", "interactive.md", "finish.md", "fix-def.md"];
+const supportDirectories = ["common", "prime", "mb-sdlc", "aspects", "def", "workers", "schemas", "vnext", "specify", "stage-reports", "dashboard", "plan", "code", "merge", "interactive"];
 const required = ["README.md", "index.md", "flow-contract.json", "compatibility.json", "prime.md", "go.md",
     "common/style.md", "common/runtime-contract.md", "common/lifecycle-guards.md", "common/workspace-bootstrap.md", "common/worker-session.md",
     "vnext/start.md", "vnext/specify.md", "vnext/protocolize.md", "vnext/plan.md", "vnext/plan-review.md", "vnext/code.md", "vnext/code-review.md", "vnext/merge.md",
@@ -77,6 +79,8 @@ export class PreparedMemoryLayer {
                 directory(source);
                 for (const name of fs.readdirSync(source).sort()) {
                     const file = path.join(source, name), target = `${logical}/${name}`, stat = fs.lstatSync(file);
+                    if (isCanonicalOnlyMemoryPath(target))
+                        continue;
                     if (stat.isDirectory())
                         collect(file, target);
                     else if (stat.isFile())
@@ -91,7 +95,7 @@ export class PreparedMemoryLayer {
             const flowRoot = path.join(memoryRoot, "dd-flow");
             directory(flowRoot);
             for (const name of rootFiles)
-                if (fs.existsSync(path.join(flowRoot, name)))
+                if (!isCanonicalOnlyMemoryPath(`dd-flow/${name}`) && fs.existsSync(path.join(flowRoot, name)))
                     put(`dd-flow/${name}`, readBoundedReleaseFile(path.join(flowRoot, name), 1024 * 1024));
             for (const name of supportDirectories)
                 if (fs.existsSync(path.join(flowRoot, name)))

package/dist/services/memory-native-review-copy.js

@@ -8,10 +8,29 @@ import { assertRunMutationAllowed } from "./run-recovery-guard.js";
 import { reviewSourceFilter, reviewSourceHash, reviewExecutionCopyHash } from "./review-copy.js";
 import { writeReviewGitEvidence } from "./external-work-launch.js";
 import { memoryReviewPhysicalDestination } from "./hook-memory-routing.js";
+import { assertSharedReviewInput } from "./work-registry.js";
+import { readFlowRunExecutionBundle } from "./runs.js";
+import { PreparedInteractiveWorkStart } from "./interactive-work-start.js";
 function refuse(reason) { throw new AppError("memory_native_review_copy_invalid", "Native Memory review requires an independently owned immutable execution copy", 1, { reason, effect: "no_effect" }); }
 export { memoryNativeReviewAssignedHookCwd } from "./hook-memory-routing.js";
+function prepareInteractiveReviewOwner(context, work, run, generation) {
+    const bundle = readFlowRunExecutionBundle(context, { projectRoot: run.project_root, runId: work.run_id });
+    if (bundle?.manifest.flow_id !== "interactive" || JSON.parse(work.payload_json ?? "null")?.kind !== "interactive-review")
+        refuse("registered_interactive_review_required");
+    const input = assertSharedReviewInput(context, work, { ...run, id: work.run_id }, generation);
+    if (!input)
+        refuse("registered_interactive_review_required");
+    const start = PreparedInteractiveWorkStart.prepare(context, { projectId: work.project_id, runId: work.run_id, workId: work.work_id, projectRoot: run.project_root });
+    return { bundle, input, assertCustody: (writer) => start.assertCustody(writer),
+        revalidate: (reader) => {
+            start.revalidate();
+            if (hybridDigest(assertSharedReviewInput(reader, work, { ...run, id: work.run_id }, generation)) !== hybridDigest(input))
+                refuse("review_input_changed");
+        } };
+}
 /** Existing source/copy policy, separate native physical custody: no external
- * launch row is invented. An interrupted allocation is never overwritten. */
+ * launch row is invented. An interrupted allocation is never overwritten.
+ * Interactive review reuses this owner and its historical copy event format. */
 export function prepareMemoryNativeReviewCopy(context, workId, allocate = false, preparedOwner) {
     const work = context.db.get("SELECT * FROM works WHERE work_id=?", [workId]);
     if (!work)
@@ -20,8 +39,13 @@ export function prepareMemoryNativeReviewCopy(context, workId, allocate = false,
     if (!run)
         refuse("owned_run_required");
     const generation = assertRunMutationAllowed(context, work.project_id, work.run_id);
-    const owner = preparedOwner ?? prepareMemoryReviewWorkInput(context, work, run, generation);
-    assertPreparedMemoryReviewWorkInput(context, owner, work, run, generation);
+    const interactive = work.result_schema === "dd-flow/interactive-work-result@1";
+    if (interactive && preparedOwner)
+        refuse("foreign_prepared_review_input");
+    const memoryOwner = interactive ? null : preparedOwner ?? prepareMemoryReviewWorkInput(context, work, run, generation);
+    if (memoryOwner)
+        assertPreparedMemoryReviewWorkInput(context, memoryOwner, work, run, generation);
+    const owner = memoryOwner ?? prepareInteractiveReviewOwner(context, work, run, generation);
     const route = owner.bundle.execution.work("review");
     if (route.delegation.mode !== "native")
         refuse("native_route_required");

package/dist/services/memory-repair-document-delta.js

@@ -20,6 +20,7 @@ function ordered(entries) {
         return left.length - right.length;
     });
 }
+export { ordered as orderMemoryDocumentEntries };
 function refuse(reason) {
     throw new AppError("memory_repair_document_delta_invalid", "Physical repair documents differ from their bounded baseline", 2, { reason, effect: "no_effect" });
 }