@deksden-com/dd-flow-cli 0.9.0-beta.16 → 0.9.0-beta.160

package/dist/services/descriptor-stage-start.js

@@ -0,0 +1,175 @@
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { Ajv2020 } from "ajv/dist/2020.js";
+import { Ajv } from "ajv/dist/ajv.js";
+import { AppError } from "../shared/errors.js";
+import { requireProjectByRoot } from "./projects.js";
+import { resolveProjectRoot } from "../storage/paths.js";
+import { readFlowRunExecutionBundle, assertPreparedRunBundleSqlAuthority, prepareFlowRunStageAttachment, attachFlowRunStage } from "./runs.js";
+import { acceptStagePacket, prepareStagePacket, publishStagePacket, readAcceptedStageData } from "./stage-report-renderer.js";
+import { appendAudit } from "./audit.js";
+import { prepareMemoryOrdinaryDefaults } from "./memory-ordinary-defaults.js";
+import { readMemoryUpgradeEvidence, readIssuedMemoryUpgradeTarget } from "./memory-upgrade-evidence.js";
+import { observeMemoryNormalFlowEntryDiagnostic } from "./memory-normal-flow-entry.js";
+import { readDescriptorStageInput } from "./descriptor-stage-coordinator.js";
+import { readMemoryFinishGitSelection } from "./memory-finish-integration.js";
+import { readMemoryInitGitPolicy } from "./memory-init-git-policy.js";
+const hash = (bytes) => createHash("sha256").update(bytes).digest("hex");
+const event = "flow_run.descriptor_stage_start";
+function refuse(reason) { throw new AppError("descriptor_stage_start_invalid", "Stage start lacks exact retained input custody", 1, { reason, effect: "no_effect" }); }
+/** Atomic generic stage entry; Work/Session launch remains the handler's responsibility. */
+export class PreparedDescriptorStageStart {
+    #scope;
+    #bundle;
+    #packet;
+    #receipt;
+    #attachment;
+    #predecessor;
+    constructor(scope, bundle, packet, receipt, attachment, predecessor) {
+        this.#scope = scope;
+        this.#bundle = bundle;
+        this.#packet = packet;
+        this.#receipt = receipt;
+        this.#attachment = attachment;
+        this.#predecessor = predecessor;
+        Object.freeze(this);
+    }
+    static prepare(context, input) {
+        if (!(input.bytes instanceof Uint8Array) || input.bytes.byteLength > 1024 * 1024)
+            refuse("unbounded_input");
+        const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
+        const bundle = readFlowRunExecutionBundle(context, input);
+        if (!bundle)
+            refuse("frozen_bundle_required");
+        return context.db.readSnapshot(() => {
+            const scope = { projectId: project.id, runId: input.runId, stage: input.stage };
+            const run = assertPreparedRunBundleSqlAuthority(context, scope, bundle), declared = bundle.descriptor.stage(input.stage);
+            if (!run.run_root)
+                refuse("run_root_missing");
+            const prior = context.db.all("SELECT payload_json FROM audit_events WHERE project_id=? AND event_type=? AND json_extract(payload_json,'$.run_id')=? AND json_extract(payload_json,'$.stage')=? LIMIT 2", [project.id, event, input.runId, input.stage]);
+            if (prior.length > 1)
+                refuse("ambiguous_start_receipt");
+            const retained = prior[0] ? JSON.parse(prior[0].payload_json) : null;
+            const attachment = retained ? null : prepareFlowRunStageAttachment(context, { projectRoot: input.projectRoot, runId: input.runId, stage: input.stage, dir: declared.directory, status: "running" });
+            const attempt = retained?.attempt ?? attachment.attempt;
+            if (typeof attempt !== "string" || !/^try-[0-9]{3,}$/.test(attempt))
+                refuse("invalid_attempt");
+            const index = JSON.parse(run.index_json), target = index.stage_runs?.find((stage) => stage.stage === input.stage);
+            const previous = index.stage_runs?.filter((stage) => stage.status === "done" && (!target || stage.order < target.order))
+                .sort((a, b) => b.order - a.order)[0];
+            const accepted = previous ? readAcceptedStageData(context, { ...scope, stage: previous.stage }) : null;
+            if (accepted) {
+                const schema = JSON.parse(bundle.descriptor.stageBlob(previous.stage, "result_schema").toString("utf8"));
+                const ajv = schema.$schema?.includes("2020-12") ? new Ajv2020({ strict: false, validateFormats: false }) : new Ajv({ strict: false, validateFormats: false });
+                if (schema.$id && accepted.data_schema_id !== schema.$id || !ajv.compile(schema)(JSON.parse(accepted.bytes.toString("utf8"))))
+                    refuse("invalid_predecessor_result");
+            }
+            const predecessor = accepted ? { stage: previous.stage, authority: accepted.authority_sha256 } : null;
+            const frozen = bundle.execution.snapshot().scope;
+            const upgradeEvidence = bundle.descriptor.descriptor.id === "mb-upgrade" ? readMemoryUpgradeEvidence(context, { requestId: frozen.requestId, projectRoot: frozen.projectRoot, workspaceRoot: frozen.workspace }) : null;
+            const upgradeTarget = upgradeEvidence ? readIssuedMemoryUpgradeTarget(context, { requestId: frozen.requestId, projectRoot: frozen.projectRoot, workspaceRoot: frozen.workspace }, project.id) : null;
+            let ordinaryDefaults;
+            if (bundle.descriptor.descriptor.id === "mb-init" && input.stage === "compose"
+                || bundle.descriptor.descriptor.id === "mb-upgrade" && ["diff-analysis", "upgrade"].includes(input.stage)) {
+                if (retained) {
+                    const rows = context.db.all("SELECT payload_json FROM audit_events WHERE project_id=? AND event_type='flow_run.stage_packet' AND json_extract(payload_json,'$.run_id')=? AND json_extract(payload_json,'$.file')=? LIMIT 2", [project.id, input.runId, retained.file]);
+                    if (rows.length !== 1)
+                        refuse("input_packet_custody_missing");
+                    ordinaryDefaults = JSON.parse(Buffer.from(JSON.parse(rows[0].payload_json).base64, "base64").toString("utf8")).ordinary_defaults;
+                }
+                else if (bundle.descriptor.descriptor.id === "mb-upgrade" && input.stage === "upgrade") {
+                    // Accepted analysis owns the missing paths before authoring is allocated.
+                    ordinaryDefaults = readDescriptorStageInput(context, { ...scope, stage: "diff-analysis" }, bundle, true, true).input.ordinary_defaults;
+                }
+                else {
+                    const selected = bundle.execution.snapshot().scope;
+                    const requestScope = { requestId: selected.requestId, projectRoot: selected.projectRoot, workspaceRoot: selected.workspace };
+                    const hasInitPolicy = bundle.descriptor.descriptor.id === "mb-init" && readMemoryInitGitPolicy(context, requestScope) !== null;
+                    const gitSelection = bundle.descriptor.descriptor.id === "mb-upgrade" || hasInitPolicy ? readMemoryFinishGitSelection(context, scope, bundle) : null;
+                    const targetContract = upgradeTarget?.index.entries.find(entry => entry.path === ".memory-bank/dd-flow/flow-contract.json");
+                    const contractBytes = targetContract ? upgradeTarget.artifacts.find(file => file.path === targetContract.retained.path) : undefined;
+                    if (bundle.descriptor.descriptor.id === "mb-upgrade" && !contractBytes)
+                        refuse("issued_target_contract_missing");
+                    const targetTemplate = contractBytes ? JSON.parse(Buffer.from(contractBytes.base64, "base64").toString("utf8")).workspace?.feature_branch_template : undefined;
+                    ordinaryDefaults = prepareMemoryOrdinaryDefaults(context, selected.workspace, bundle.execution.settings.root_profile, requestScope, gitSelection?.selection.integrationBranch, targetTemplate);
+                }
+            }
+            let ordinaryEntry;
+            if (upgradeEvidence && input.stage === "verify") {
+                if (retained) {
+                    const rows = context.db.all("SELECT payload_json FROM audit_events WHERE project_id=? AND event_type='flow_run.stage_packet' AND json_extract(payload_json,'$.run_id')=? AND json_extract(payload_json,'$.file')=? LIMIT 2", [project.id, input.runId, retained.file]);
+                    if (rows.length !== 1)
+                        refuse("input_packet_custody_missing");
+                    ordinaryEntry = JSON.parse(Buffer.from(JSON.parse(rows[0].payload_json).base64, "base64").toString("utf8")).ordinary_entry;
+                }
+                else
+                    ordinaryEntry = observeMemoryNormalFlowEntryDiagnostic(context, frozen.workspace);
+            }
+            const bytes = Buffer.from(JSON.stringify({ schema_id: "dd-flow/descriptor-stage-input@1", run_id: input.runId, stage: input.stage, attempt,
+                bundle_sha256: bundle.sha256, descriptor_sha256: bundle.descriptor.sha256, execution_sha256: bundle.execution.sha256,
+                predecessor: accepted ? { stage: previous.stage, result: accepted.result, input_sha256: accepted.input_sha256 ?? null, authority_sha256: accepted.authority_sha256 } : null,
+                payload_base64: Buffer.from(input.bytes).toString("base64"), ...(ordinaryDefaults !== undefined ? { ordinary_defaults: ordinaryDefaults } : {}),
+                ...(upgradeEvidence ? { upgrade_baseline: upgradeEvidence.reference } : {}),
+                ...(ordinaryEntry !== undefined ? { ordinary_entry: ordinaryEntry } : {}),
+                ...(upgradeTarget ? { upgrade_target: upgradeTarget.reference } : {}) }));
+            if (bytes.length > 1024 * 1024)
+                refuse("unbounded_input_packet");
+            const file = path.join(run.run_root, declared.directory, "stage-input.json");
+            const packet = prepareStagePacket(file, bytes);
+            const receipt = { schema_id: "dd-flow/descriptor-stage-start@1", run_id: input.runId, stage: input.stage, attempt, bundle_sha256: bundle.sha256, input_sha256: hash(bytes), file };
+            if (retained && JSON.stringify(retained) !== JSON.stringify(receipt))
+                refuse("changed_start_request");
+            const prepared = new PreparedDescriptorStageStart(scope, bundle, packet, receipt, attachment, predecessor);
+            if (retained)
+                prepared.assertCustody(context);
+            return prepared;
+        });
+    }
+    assertCustody(context) {
+        this.assertPredecessor(context);
+        const run = assertPreparedRunBundleSqlAuthority(context, this.#scope, this.#bundle), index = JSON.parse(run.index_json);
+        const stage = index.stage_runs?.find((value) => value.stage === this.#scope.stage);
+        if (stage?.attempt !== this.#receipt.attempt || stage.input_sha256 !== this.#receipt.input_sha256 || stage.dir !== this.#bundle.descriptor.stage(this.#scope.stage).directory)
+            refuse("stage_input_changed");
+        const packets = context.db.all("SELECT payload_json FROM audit_events WHERE project_id=? AND event_type='flow_run.stage_packet' AND json_extract(payload_json,'$.run_id')=? AND json_extract(payload_json,'$.stage')=? AND json_extract(payload_json,'$.file')=? LIMIT 2", [this.#scope.projectId, this.#scope.runId, this.#scope.stage, this.#packet.file]);
+        if (packets.length !== 1)
+            refuse("input_packet_custody_missing");
+        const packet = JSON.parse(packets[0].payload_json);
+        if (packet.attempt !== this.#receipt.attempt || packet.sha256 !== this.#packet.sha256 || packet.base64 !== this.#packet.bytes.toString("base64"))
+            refuse("input_packet_custody_changed");
+    }
+    assertPredecessor(context) {
+        if (this.#predecessor && readAcceptedStageData(context, { ...this.#scope, stage: this.#predecessor.stage }).authority_sha256 !== this.#predecessor.authority)
+            refuse("predecessor_changed");
+    }
+    apply(context, assertHandlerCustody) {
+        const retainedRun = assertPreparedRunBundleSqlAuthority(context, this.#scope, this.#bundle);
+        const current = readFlowRunExecutionBundle(context, { projectRoot: retainedRun.project_root, runId: this.#scope.runId });
+        if (!current || current.sha256 !== this.#bundle.sha256)
+            refuse("physical_bundle_changed");
+        const changed = context.db.writeTransaction(() => {
+            assertPreparedRunBundleSqlAuthority(context, this.#scope, this.#bundle);
+            assertHandlerCustody?.(context);
+            this.assertPredecessor(context);
+            const prior = context.db.all("SELECT payload_json FROM audit_events WHERE project_id=? AND event_type=? AND json_extract(payload_json,'$.run_id')=? AND json_extract(payload_json,'$.stage')=? LIMIT 2", [this.#scope.projectId, event, this.#scope.runId, this.#scope.stage]);
+            if (prior.length) {
+                if (prior.length !== 1 || prior[0].payload_json !== JSON.stringify(this.#receipt))
+                    refuse("start_receipt_changed");
+                this.assertCustody(context);
+                return false;
+            }
+            if (!this.#attachment)
+                refuse("start_receipt_missing");
+            attachFlowRunStage(context, { projectRoot: this.#attachment.run.project_root, runId: this.#scope.runId, stage: this.#scope.stage,
+                dir: this.#bundle.descriptor.stage(this.#scope.stage).directory, status: "running", inputSha256: this.#packet.sha256 }, this.#attachment);
+            acceptStagePacket(context, { ...this.#scope, prepared: this.#packet });
+            appendAudit(context, { projectId: this.#scope.projectId, eventType: event, payload: this.#receipt });
+            this.assertCustody(context);
+            return true;
+        }, "descriptorStage.start");
+        publishStagePacket(context, this.#scope.projectId, this.#scope.runId, this.#scope.stage, this.#packet.file);
+        const run = assertPreparedRunBundleSqlAuthority(context, this.#scope, this.#bundle);
+        const status = JSON.parse(run.index_json).stage_runs.find((value) => value.stage === this.#scope.stage)?.status;
+        return { changed, stage: this.#scope.stage, status: status, run_status: run.status, attempt: this.#receipt.attempt, input_sha256: this.#packet.sha256, input_path: this.#packet.file };
+    }
+}

package/dist/services/diagnostic-evidence.js

@@ -0,0 +1,73 @@
+import fs from "node:fs";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { AppError } from "../shared/errors.js";
+const refuse = (reason, details = {}) => {
+    const correctable = ["invalid_source_reference", "source_hash_changed", "source_missing"].includes(reason);
+    const message = reason === "source_hash_changed"
+        ? "Citation sha256 does not match its assigned snapshot file; correct the result using source_path and actual_source_sha256, then retry. No result was accepted."
+        : reason === "source_missing" ? "Citation is absent from the original project snapshot. Cite an existing project source instead; generated .dd-flow/review-evidence observations are not project sources. For a missing link target cite the existing referring document and record the absence as a limitation. Correct the result, then retry; no result was accepted."
+            : correctable ? "Use snapshot-relative evidence paths with forward slashes (for example src/index.ts), without absolute paths, dot segments or .git; sha256 must be 64 lowercase hex characters"
+                : "Diagnostic evidence does not match the assigned snapshot and coverage";
+    throw new AppError("diagnostic_evidence_invalid", message, 2, { ...details, reason, effect: "no_effect", ...(correctable ? { phase: "prepare", recoverable: true } : {}) });
+};
+/** Run after schema validation; schema-shaped hashes are not evidence by themselves. */
+export function verifyDiagnosticSources(root, sources) {
+    const canonicalRoot = fs.realpathSync(root), seen = new Map();
+    for (const source of sources) {
+        if (!source.path || source.path.length > 4096 || source.path.includes("\\") || path.posix.isAbsolute(source.path) || path.win32.isAbsolute(source.path)
+            || source.path.split("/").some(part => !part || part === "." || part === ".." || part === ".git")
+            || !/^[a-f0-9]{64}$/.test(source.sha256))
+            refuse("invalid_source_reference");
+        if (seen.has(source.path) && seen.get(source.path) !== source.sha256)
+            refuse("conflicting_source_reference");
+        seen.set(source.path, source.sha256);
+        let bytes;
+        try {
+            const file = fs.realpathSync(path.join(canonicalRoot, source.path)), relative = path.relative(canonicalRoot, file);
+            if (relative === ".." || relative.startsWith(".." + path.sep) || path.isAbsolute(relative))
+                refuse("escaping_source_reference");
+            const stat = fs.statSync(file);
+            if (!stat.isFile() || stat.size > 16 * 1024 * 1024)
+                refuse("unbounded_source_reference");
+            bytes = fs.readFileSync(file);
+        }
+        catch (error) {
+            if (error instanceof AppError)
+                throw error;
+            if (["ENOENT", "ENOTDIR"].includes(error.code ?? "")) {
+                return refuse("source_missing", { source_path: source.path });
+            }
+            return refuse("source_unavailable");
+        }
+        const actual = createHash("sha256").update(bytes).digest("hex");
+        if (actual !== source.sha256)
+            refuse("source_hash_changed", {
+                source_path: source.path, provided_source_sha256: source.sha256, actual_source_sha256: actual
+            });
+    }
+}
+export function verifyDiagnosticCoverage(root, baseline, coverage) {
+    const ids = coverage.map(value => value.id);
+    if (new Set(ids).size !== ids.length || ids.length !== baseline.length || baseline.some(id => !ids.includes(id)))
+        refuse("incomplete_aspect_coverage");
+    for (const value of coverage) {
+        if (!value.reason.trim())
+            refuse("missing_applicability_reason");
+        verifyDiagnosticSources(root, value.evidence);
+    }
+}
+/** Each independent critic must account for every candidate, including rejected findings. */
+export function verifyDiagnosticCritic(root, candidates, decisions) {
+    const ids = candidates.map(value => value.id), reviewed = decisions.map(value => value.finding_id);
+    if (new Set(ids).size !== ids.length || new Set(reviewed).size !== reviewed.length
+        || ids.length !== reviewed.length || ids.some(id => !reviewed.includes(id)))
+        refuse("incomplete_critic_coverage");
+    for (const candidate of candidates) {
+        if (!candidate.evidence.length)
+            refuse("finding_without_evidence");
+        verifyDiagnosticSources(root, candidate.evidence);
+    }
+    for (const decision of decisions)
+        verifyDiagnosticSources(root, decision.evidence);
+}

package/dist/services/diagnostic-repair-intake.js

@@ -0,0 +1,123 @@
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { AppError } from "../shared/errors.js";
+import { isDiagnosticFlow } from "../domain/diagnostic-flows.js";
+import { resolveProjectRoot } from "../storage/paths.js";
+import { requireProjectByRoot } from "./projects.js";
+import { readFlowRunExecutionBundle, resolveRun } from "./runs.js";
+import { readAcceptedStageData, resolveStagePublicationPath } from "./stage-report-renderer.js";
+import { selectDiagnosticFindings } from "./diagnostic-report.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { assertMemoryRepairWritePaths } from "./memory-review-correction-plan.js";
+import { readMemoryFlowUserInputs } from "./memory-flow-user-inputs.js";
+function refuse(reason) {
+    throw new AppError("repair_source_invalid", "Repair intake requires a completed diagnostic RUN and its accepted report", 2, { reason, effect: "no_effect" });
+}
+export function readDiagnosticRepairIntake(context, input) {
+    return context.db.readSnapshot(() => {
+        try {
+            return readIntake(context, input);
+        }
+        catch (error) {
+            if (error instanceof SyntaxError || error instanceof TypeError)
+                refuse("malformed_source_custody");
+            throw error;
+        }
+    });
+}
+export function readMemoryFixUserInputs(context, input, retainedBundle) {
+    return readMemoryFlowUserInputs(context, input, "mb-fix", retainedBundle);
+}
+/** Semantic intake proposal only: no write, closure, migration or SDLC launch
+ * authority. The registered flow must separately bind actual user approval,
+ * observe current source drift and admit its writer/independent verifier.
+ * Never classify prose by keywords or infer selection from severity. */
+export function prepareMemoryFixIntake(context, input) {
+    const source = readDiagnosticRepairIntake(context, input);
+    const routing = validateMemoryFixRouting(source.selected_findings.map(finding => finding.id), input.decisions);
+    return { schema_id: "dd-flow/mb-fix-intake@1", ...source, routing,
+        repair_finding_ids: routing.filter(decision => decision.route === "memory_repair").map(decision => decision.finding_id) };
+}
+/** Shared semantic routing checks; this does not admit a source RUN or user approval. */
+export function validateMemoryFixRouting(findingIds, decisions) {
+    const invalid = (reason) => {
+        throw new AppError("memory_fix_intake_invalid", "Memory repair intake requires one bounded routing decision per selected finding", 2, { reason, effect: "no_effect" });
+    };
+    if (!Array.isArray(findingIds) || !findingIds.length || findingIds.length > 4096
+        || findingIds.some(id => typeof id !== "string" || !id.trim()) || new Set(findingIds).size !== findingIds.length
+        || !Array.isArray(decisions) || decisions.length !== findingIds.length)
+        invalid("complete_routing_required");
+    const selected = new Set(findingIds);
+    const byId = new Map();
+    for (const value of decisions) {
+        if (!value || typeof value !== "object" || Array.isArray(value)
+            || Object.keys(value).sort().join() !== "finding_id,reason,route,write_paths")
+            invalid("invalid_routing_decision");
+        const decision = value;
+        if (typeof decision.finding_id !== "string" || !selected.has(decision.finding_id) || byId.has(decision.finding_id))
+            invalid("foreign_or_duplicate_finding");
+        if (!["memory_repair", "review_fix", "upgrade", "defer"].includes(decision.route)
+            || typeof decision.reason !== "string" || !decision.reason.trim() || decision.reason.includes("\0")
+            || Buffer.byteLength(decision.reason) > 16 * 1024 || !Array.isArray(decision.write_paths))
+            invalid("invalid_routing_decision");
+        if (decision.route === "memory_repair")
+            assertMemoryRepairWritePaths(decision.write_paths);
+        else if (decision.write_paths.length)
+            invalid("non_memory_write_scope");
+        byId.set(decision.finding_id, structuredClone(decision));
+    }
+    return findingIds.map(id => byId.get(id));
+}
+function readIntake(context, input) {
+    const projectRoot = resolveProjectRoot(input.projectRoot), project = requireProjectByRoot(context, projectRoot);
+    const run = resolveRun(context, project.id, input.sourceRunId);
+    if (run.status !== "done" || !isDiagnosticFlow(run.flow_kind))
+        refuse("completed_diagnostic_required");
+    const bundle = readFlowRunExecutionBundle(context, { projectRoot, runId: run.id });
+    if (!bundle || bundle.manifest.flow_id !== run.flow_kind)
+        refuse("diagnostic_bundle_required");
+    const scope = { projectId: project.id, runId: run.id, stage: "report" };
+    const accepted = readAcceptedStageData(context, scope);
+    if (accepted.data_schema_id !== "dd-flow/diagnostic-stage-result@1")
+        refuse("unsupported_source_result");
+    const result = JSON.parse(accepted.bytes.toString("utf8"));
+    if (result.schema_id !== accepted.data_schema_id || result.run_id !== run.id || result.flow_id !== run.flow_kind
+        || result.stage !== "report" || result.input_sha256 !== accepted.input_sha256)
+        refuse("foreign_source_result");
+    const stage = JSON.parse(run.index_json).stage_runs.find((item) => item.stage === "report");
+    const rows = context.db.all("SELECT payload_json FROM audit_events WHERE project_id=? AND event_type='diagnostic.report' AND json_extract(payload_json,'$.run_id')=? AND json_extract(payload_json,'$.attempt')=? LIMIT 2", [project.id, run.id, stage.attempt]);
+    if (rows.length !== 1 || Buffer.byteLength(rows[0].payload_json) > 16 * 1024)
+        refuse("report_publication_missing");
+    const publication = JSON.parse(rows[0].payload_json);
+    const reportPath = `${stage.dir}/diagnostic-report.json`;
+    if (publication.schema_id !== "dd-flow/diagnostic-report-publication@1" || publication.input_sha256 !== accepted.input_sha256
+        || !Array.isArray(publication.artifacts))
+        refuse("foreign_report_publication");
+    const artifacts = publication.artifacts.filter((item) => item.path === reportPath);
+    if (artifacts.length !== 1 || !/^[a-f0-9]{64}$/.test(artifacts[0].sha256))
+        refuse("report_artifact_missing");
+    const packets = context.db.all("SELECT payload_json FROM audit_events WHERE project_id=? AND event_type='flow_run.stage_packet' AND json_extract(payload_json,'$.run_id')=? AND json_extract(payload_json,'$.stage')='report' AND json_extract(payload_json,'$.attempt')=? AND json_extract(payload_json,'$.sha256')=? LIMIT 2", [project.id, run.id, stage.attempt, artifacts[0].sha256]);
+    if (packets.length !== 1 || Buffer.byteLength(packets[0].payload_json) > 6 * 1024 * 1024)
+        refuse("report_packet_missing");
+    const packet = JSON.parse(packets[0].payload_json);
+    const destination = path.resolve(run.run_root ?? run.run_dir, reportPath);
+    if (typeof packet.file !== "string" || resolveStagePublicationPath(context, project.id, run.id, packet.file) !== destination
+        || typeof packet.base64 !== "string")
+        refuse("foreign_report_packet");
+    const bytes = Buffer.from(packet.base64, "base64");
+    if (!bytes.length || bytes.length > 4 * 1024 * 1024 || bytes.toString("base64") !== packet.base64
+        || createHash("sha256").update(bytes).digest("hex") !== artifacts[0].sha256)
+        refuse("report_packet_changed");
+    const report = JSON.parse(bytes.toString("utf8"));
+    if (report.schema_id !== "dd-flow/diagnostic-report@1" || report.run.id !== run.id || report.run.flow_id !== run.flow_kind
+        || report.run.snapshot_sha256 !== result.snapshot_sha256 || report.summary !== result.summary
+        || hybridDigest(report.review_focus) !== hybridDigest(result.details.focus)
+        || hybridDigest(report.aspect_coverage) !== hybridDigest(result.details.coverage)
+        || hybridDigest(report.limitations) !== hybridDigest(result.details.limitations)
+        || !Array.isArray(report.findings_register)
+        || hybridDigest(report.findings_register.map(({ origin: _origin, resolution: _resolution, critic_decisions: _critics, ...finding }) => finding)) !== hybridDigest(result.details.findings)
+        || hybridDigest(report.findings_register.map(finding => finding.resolution)) !== hybridDigest(result.details.decisions))
+        refuse("report_result_changed");
+    return { ...selectDiagnosticFindings(report, input.findingIds),
+        source_stage: { ...accepted.result, authority_sha256: accepted.authority_sha256 } };
+}

package/dist/services/diagnostic-repair-source-intake.js

@@ -0,0 +1,102 @@
+import { createHash } from "node:crypto";
+import { AppError } from "../shared/errors.js";
+import { isDiagnosticFlow } from "../domain/diagnostic-flows.js";
+import { readDiagnosticRepairIntake } from "./diagnostic-repair-intake.js";
+import { readFlowRunExecutionBundle, assertPreparedRunBundleSqlAuthority } from "./runs.js";
+import { requireProjectByRoot } from "./projects.js";
+import { resolveProjectRoot } from "../storage/paths.js";
+const logical = "runtime/repair-intake.json", limit = 4 * 1024 * 1024;
+const hash = (bytes) => createHash("sha256").update(bytes).digest("hex");
+const digest = (value) => typeof value === "string" && /^[a-f0-9]{64}$/.test(value);
+const targets = {
+    "mb-fix": { schema: "dd-flow/mb-fix-source-intake@1", error: "memory_fix_intake_custody_invalid", message: "Memory repair requires its own frozen selected source intake", bundle: "memory_fix_bundle_required" },
+    "review-fix": { schema: "dd-flow/review-fix-source-intake@1", error: "review_fix_intake_custody_invalid", message: "Review-fix requires its own frozen selected source intake", bundle: "review_fix_bundle_required" }
+};
+function refuse(flowId, reason) {
+    const owner = Object.hasOwn(targets, flowId) ? targets[flowId] : targets["mb-fix"];
+    throw new AppError(owner.error, owner.message, 2, { reason, effect: "no_effect" });
+}
+/** SQL/in-memory fence for generic Stage writers; performs no filesystem lookup. */
+export function assertDiagnosticRepairSourceIntakeCustody(context, scope, bundle, expectedSha256, flowId) {
+    if (!Object.hasOwn(targets, flowId))
+        refuse(flowId, "unsupported_flow");
+    if (bundle.manifest.flow_id !== flowId || bundle.manifest.run_id !== scope.runId)
+        refuse(flowId, targets[flowId].bundle);
+    assertPreparedRunBundleSqlAuthority(context, scope, bundle);
+    const references = bundle.manifest.inventory.filter(ref => ref.path === logical);
+    if (references.length !== 1 || references[0].sha256 !== expectedSha256 || hash(bundle.blob(logical)) !== expectedSha256)
+        refuse(flowId, "source_intake_changed");
+}
+/** Initial selection comes from the completed diagnostic's SQL custody, never
+ * an agent-authored report. The RUN bundle factory must retain these exact bytes.
+ * No RUN allocation, write approval or mutation happens here.
+ */
+export function prepareDiagnosticRepairSourceIntake(context, input, flowId) {
+    if (!Object.hasOwn(targets, flowId))
+        refuse(flowId, "unsupported_flow");
+    const intake = readDiagnosticRepairIntake(context, input);
+    const bytes = Buffer.from(JSON.stringify({ schema_id: targets[flowId].schema, intake }));
+    if (bytes.length > limit)
+        refuse(flowId, "intake_exceeds_bound");
+    return { path: logical, sha256: hash(bytes), bytes };
+}
+/** Existing RUNs read their own retained input, not neighboring audit storage.
+ * Original source-stage paths are provenance only, never paths in this RUN.
+ * Frozen-bundle SQL authority still belongs to the existing generic runtime.
+ */
+export function readDiagnosticRepairSourceIntake(context, input, flowId, retainedBundle) {
+    if (!Object.hasOwn(targets, flowId))
+        refuse(flowId, "unsupported_flow");
+    const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
+    const bundle = retainedBundle ?? readFlowRunExecutionBundle(context, input);
+    if (!bundle || bundle.manifest.flow_id !== flowId || bundle.manifest.run_id !== input.runId)
+        refuse(flowId, targets[flowId].bundle);
+    return context.db.readSnapshot(() => {
+        assertPreparedRunBundleSqlAuthority(context, { projectId: project.id, runId: input.runId }, bundle);
+        const references = bundle.manifest.inventory.filter(ref => ref.path === logical);
+        if (references.length !== 1)
+            refuse(flowId, "source_intake_reference_missing");
+        const bytes = bundle.blob(logical);
+        if (!bytes.length || bytes.length > limit || hash(bytes) !== references[0].sha256)
+            refuse(flowId, "source_intake_changed");
+        let value;
+        try {
+            value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+        }
+        catch {
+            return refuse(flowId, "invalid_source_intake");
+        }
+        try {
+            const intake = value.intake;
+            if (value.schema_id !== targets[flowId].schema || Object.keys(value).sort().join() !== "intake,schema_id"
+                || intake.authorization !== "not_granted" || !/^RUN-[0-9]+-[a-z0-9-]+$/.test(intake.source.id)
+                || !isDiagnosticFlow(intake.source.flow_id) || !digest(intake.source.snapshot_sha256) || !digest(intake.source.report_sha256)
+                || !digest(intake.source_stage.sha256) || !digest(intake.source_stage.authority_sha256)
+                || typeof intake.source_stage.path !== "string" || !intake.source_stage.path
+                || !Array.isArray(intake.selected_findings) || !intake.selected_findings.length || intake.selected_findings.length > 4096
+                || !Array.isArray(intake.unselected_ids) || intake.unselected_ids.length > 4096
+                || !Array.isArray(intake.limitations) || intake.limitations.some(item => typeof item !== "string"))
+                refuse(flowId, "invalid_source_intake");
+            const ids = intake.selected_findings.map(finding => finding.id);
+            if (ids.some(id => typeof id !== "string" || !id.trim()) || new Set(ids).size !== ids.length
+                || new Set(intake.unselected_ids).size !== intake.unselected_ids.length
+                || intake.unselected_ids.some(id => typeof id !== "string" || !id.trim() || ids.includes(id)))
+                refuse(flowId, "invalid_source_selection");
+            for (const finding of intake.selected_findings) {
+                if (finding.origin.id !== finding.id || typeof finding.origin.work_id !== "string"
+                    || finding.resolution.finding_id !== finding.id
+                    || !["accepted", "downgraded", "def_candidate", "review_fix_candidate"].includes(finding.resolution.disposition)
+                    || !Array.isArray(finding.evidence) || !Array.isArray(finding.resolution.evidence) || !Array.isArray(finding.critic_decisions)
+                    || finding.critic_decisions.some(critic => critic.decision.finding_id !== finding.id || !Array.isArray(critic.decision.evidence)))
+                    refuse(flowId, "invalid_source_selection");
+            }
+        }
+        catch (error) {
+            if (error instanceof AppError)
+                throw error;
+            return refuse(flowId, "invalid_source_intake");
+        }
+        return { sha256: references[0].sha256, reference: { root: "run", path: `execution-bundle/${logical}`, sha256: references[0].sha256 },
+            intake: structuredClone(value.intake) };
+    });
+}

package/dist/services/diagnostic-report-publication.js

@@ -0,0 +1,72 @@
+import fs from "node:fs";
+import path from "node:path";
+import { AppError } from "../shared/errors.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { appendAudit } from "./audit.js";
+import { prepareStagePacket, acceptStagePacket } from "./stage-report-renderer.js";
+import { publishImmutableInput } from "../storage/immutable-input.js";
+import { renderDiagnosticReport } from "./diagnostic-report.js";
+function refuse(reason) { throw new AppError("diagnostic_report_publication_invalid", "Diagnostic report publication requires its owned stage and exact bytes", 2, { reason, effect: "no_effect" }); }
+/** Files are immutable candidates until retain is called in the Stage acceptance
+ * writer. Interrupted publication can replay before any terminal acceptance. */
+export function prepareDiagnosticReportPublication(context, scope, report) {
+    const run = context.db.get("SELECT run_root,index_json FROM runs WHERE project_id=? AND id=?", [scope.projectId, scope.runId]);
+    const stage = run ? JSON.parse(run.index_json).stage_runs.find((value) => value.stage === scope.stage) : null;
+    if (!run?.run_root || scope.stage !== "report" || stage?.attempt !== scope.attempt || stage.input_sha256 !== scope.inputSha256
+        || report.run.id !== scope.runId || !["running", "done"].includes(stage.status))
+        refuse("foreign_stage");
+    const directory = path.join(run.run_root, stage.dir);
+    if (fs.realpathSync(run.run_root) !== run.run_root || fs.realpathSync(directory) !== directory
+        || !directory.startsWith(run.run_root + path.sep))
+        refuse("unsafe_report_directory");
+    const rendered = renderDiagnosticReport(report);
+    const packets = Object.entries(rendered).map(([kind, bytes]) => {
+        if (bytes.length > 4 * 1024 * 1024)
+            refuse("report_exceeds_bound");
+        const suffix = kind === "markdown" ? "md" : kind;
+        const file = path.join(directory, `diagnostic-report.${suffix}`);
+        try {
+            if (!fs.lstatSync(file).isFile() || fs.lstatSync(file).isSymbolicLink())
+                refuse("unsafe_report_file");
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+        return prepareStagePacket(file, bytes);
+    });
+    const manifest = { schema_id: "dd-flow/diagnostic-report-publication@1", run_id: scope.runId, stage: scope.stage, attempt: scope.attempt,
+        input_sha256: scope.inputSha256, artifacts: packets.map(packet => ({ path: path.relative(run.run_root, packet.file).split(path.sep).join("/"), sha256: packet.sha256 })) };
+    const retained = (writer) => writer.db.all("SELECT payload_json FROM audit_events WHERE project_id=? AND event_type='diagnostic.report' AND json_extract(payload_json,'$.run_id')=? AND json_extract(payload_json,'$.attempt')=? LIMIT 2", [scope.projectId, scope.runId, scope.attempt]);
+    return {
+        manifest,
+        publish() {
+            if (fs.realpathSync(directory) !== directory)
+                refuse("report_directory_changed");
+            for (const packet of packets)
+                publishImmutableInput(packet.file, packet.bytes, "diagnostic_report_conflict");
+        },
+        /** SQL-only. The existing packet ledger retains recoverable authoritative
+         * bytes in the same transaction as Stage completion. */
+        retain(writer) {
+            const rows = retained(writer);
+            if (rows.length) {
+                if (rows.length !== 1 || hybridDigest(JSON.parse(rows[0].payload_json)) !== hybridDigest(manifest))
+                    refuse("report_custody_changed");
+                for (const packet of packets) {
+                    const records = writer.db.all("SELECT payload_json FROM audit_events WHERE project_id=? AND event_type='flow_run.stage_packet' AND json_extract(payload_json,'$.run_id')=? AND json_extract(payload_json,'$.stage')=? AND json_extract(payload_json,'$.attempt')=? AND json_extract(payload_json,'$.file')=? LIMIT 2", [scope.projectId, scope.runId, scope.stage, scope.attempt, packet.file]);
+                    if (records.length !== 1 || Buffer.byteLength(records[0].payload_json) > 6 * 1024 * 1024
+                        || hybridDigest(JSON.parse(records[0].payload_json)) !== hybridDigest({ run_id: scope.runId, stage: scope.stage,
+                            attempt: scope.attempt, file: packet.file, sha256: packet.sha256, base64: packet.bytes.toString("base64") }))
+                        refuse("report_packet_custody_changed");
+                }
+                return;
+            }
+            if (stage.status !== "running")
+                refuse("report_receipt_missing");
+            for (const packet of packets)
+                acceptStagePacket(writer, { ...scope, prepared: packet });
+            appendAudit(writer, { projectId: scope.projectId, eventType: "diagnostic.report", payload: manifest });
+        }
+    };
+}