@dsh-enhanced/assistant-automations 0.1.23 → 0.1.30

package/lib/service.js

@@ -10,8 +10,10 @@ import { GROWTH_AUTOMATION_OWNER, GrowthAutomationStore, } from './growth.js';
 import { AutomationCoordinator, } from './coordinator.js';
 import { AutomationProposalManager, AutomationProposalStore } from './proposals.js';
 import { DshAutomationRunner, HostAutomationRunner, RoutedAutomationRunner } from './runner.js';
+import { AutomationPreparationRunner } from './preparation.js';
 import { AutomationStore } from './store.js';
 import { registerAutomationTools } from './tools.js';
+import { parseExternalEventEnvelope } from './external-event.js';
 import { isHostAutomationDefinition } from './types.js';
 function registrationOwnedByEvaluation(registration) {
     const candidate = registration;
@@ -174,11 +176,16 @@ export class AssistantAutomationsService extends Service {
     growthStore;
     proposals;
     policy;
+    preparationRunner;
     coordinator;
     hostExecutors = new HostAutomationExecutorRegistry();
     config;
     evaluationProducerGeneration = `assistant-automations:${randomUUID()}`;
     presentationProducerGeneration = `assistant-automations-presentation:${randomUUID()}`;
+    acceptanceProducerGeneration = `assistant-automations-acceptance:${randomUUID()}`;
+    acceptanceSink;
+    /** Once a live verifier requires acceptance, a transient detach must not reopen prompt submission. */
+    acceptanceRequired = false;
     evaluationSink;
     presentationSink;
     approvalDelivery;
@@ -205,6 +212,7 @@ export class AssistantAutomationsService extends Service {
             throw new Error('assistant-automations: assistantPolicy service is required');
         this.config = config;
         this.policy = policy;
+        this.preparationRunner = new AutomationPreparationRunner(ctx, policy);
         const initialDelivery = ctx.get('assistantDelivery');
         this.approvalDelivery = initialDelivery;
         this.workflowTemplateResolver = initialDelivery;
@@ -216,10 +224,13 @@ export class AssistantAutomationsService extends Service {
         const artifacts = new AutomationArtifactStore({ rootPath: config.runsPath, maxBytes: config.maxArtifactBytes });
         const runner = new PolicyBoundRunner(policy, new RoutedAutomationRunner(new DshAutomationRunner(ctx, policy, {
             allowUnbudgetedExecution: config.allowUnbudgetedExecution,
+            prepareAcceptance: input => this.prepareTaskAcceptance(input),
+            acceptanceEnabled: () => this.acceptanceSink !== undefined || this.acceptanceRequired,
         }), new HostAutomationRunner(this.hostExecutors, policy, {
             allowUnbudgetedExecution: config.allowUnbudgetedExecution,
         })));
         this.coordinator = new AutomationCoordinator({
+            beforeDispatch: () => this.revalidatePromotedWorkflows(true),
             store: this.store,
             artifacts,
             runner,
@@ -252,9 +263,15 @@ export class AssistantAutomationsService extends Service {
         ctx.inject(['assistantEvaluation'], evaluationCtx => {
             const evaluation = evaluationCtx.get('assistantEvaluation');
             this.evaluation = evaluation;
+            const unsubscribe = evaluation.onTrustedTaskChange?.(() => this.revalidatePromotedWorkflows());
+            this.revalidatePromotedWorkflows();
             return () => {
-                if (this.evaluation === evaluation)
+                unsubscribe?.();
+                if (this.evaluation === evaluation) {
                     this.evaluation = undefined;
+                    if (this.active)
+                        this.revalidatePromotedWorkflows();
+                }
             };
         });
         // Optional: when a learning plugin is composed, finished runs become evidence.
@@ -289,6 +306,7 @@ export class AssistantAutomationsService extends Service {
         ctx.effect(() => async () => {
             this.active = false;
             this.evaluationSink = undefined;
+            this.acceptanceSink = undefined;
             this.presentationSink?.dispose();
             this.coordinator.setEvaluationRecorder(undefined);
             await this.coordinator.stop();
@@ -301,10 +319,86 @@ export class AssistantAutomationsService extends Service {
         this.assertActive();
         return this.evaluationProducerGeneration;
     }
+    /**
+     * Generate a bounded, unverified Proactive draft in a fresh Session. The
+     * caller owns the durable decision claim and result persistence.
+     */
+    runPreparation(input, signal, assertCurrent) {
+        this.assertActive();
+        return this.preparationRunner.run(input, signal, assertCurrent);
+    }
     trustedDeliveryPresentationProducerGeneration() {
         this.assertActive();
         return this.presentationProducerGeneration;
     }
+    /** Private verifier producer generation; invalidated with this service. */
+    trustedAcceptanceProducerGeneration() {
+        this.assertActive();
+        return this.acceptanceProducerGeneration;
+    }
+    registerTaskAcceptanceSink(registration) {
+        this.assertActive();
+        const verifier = this.ctx.get('assistantVerifier', false);
+        if (registration.protocol !== 'assistant-verifier/host-producer/v1'
+            || registration.generation !== this.acceptanceProducerGeneration
+            || typeof registration.prepare !== 'function' || typeof registration.completed !== 'function'
+            || typeof verifier?.ownsTaskAcceptanceRegistration !== 'function'
+            || !verifier.ownsTaskAcceptanceRegistration(registration)) {
+            throw new AssistantAutomationsError('runtime-conflict', 'task acceptance registration is invalid');
+        }
+        if (this.acceptanceSink !== undefined) {
+            if (this.acceptanceSink.registration === registration) {
+                const token = this.acceptanceSink.token;
+                return () => { if (this.acceptanceSink?.token === token)
+                    this.acceptanceSink = undefined; };
+            }
+            throw new AssistantAutomationsError('runtime-conflict', 'task acceptance sink is already registered');
+        }
+        const token = Symbol('assistant-automations.task-acceptance');
+        this.acceptanceSink = Object.freeze({ token, registration });
+        if (registration.requiresAcceptance === true)
+            this.acceptanceRequired = true;
+        let live = true;
+        return () => {
+            if (!live)
+                return;
+            live = false;
+            if (this.acceptanceSink?.token === token)
+                this.acceptanceSink = undefined;
+        };
+    }
+    async inspectAcceptedExecution(contract) {
+        this.assertActive();
+        return this.store.inspectAcceptedExecution(contract);
+    }
+    prepareTaskAcceptance(input) {
+        const sink = this.acceptanceSink;
+        if (sink === undefined) {
+            if (this.acceptanceRequired) {
+                throw new AssistantAutomationsError('runtime-conflict', 'required task acceptance verifier is unavailable');
+            }
+            return;
+        }
+        if (input.owner === undefined || input.binding === undefined) {
+            if (this.acceptanceRequired) {
+                throw new AssistantAutomationsError('missing-approval-route', 'required task acceptance lacks an authenticated Delivery owner');
+            }
+            return;
+        }
+        const handle = sink.registration.prepare(Object.freeze({ scope: Object.freeze(input.scope), owner: input.owner,
+            task: Object.freeze({ kind: 'automation-run', ref: `run-${input.taskId}` }), objective: input.objective, }));
+        if (handle === null) {
+            if (this.acceptanceRequired) {
+                throw new AssistantAutomationsError('runtime-conflict', 'required task acceptance profile is unavailable');
+            }
+            return;
+        }
+        this.store.bindTaskAcceptance({ taskId: input.taskId, contractId: handle.contractId, contractDigest: handle.contractDigest,
+            scope: input.scope, owner: input.owner, bindingId: input.binding.id, bindingVersion: input.binding.version,
+            bindingGeneration: input.binding.generation,
+            dispatchedAt: Date.now(),
+        });
+    }
     /**
      * Delivery creates this publisher and can revoke it on either service's
      * reload. Automations retains it only as a private coordinator adapter; no
@@ -857,50 +951,31 @@ export class AssistantAutomationsService extends Service {
         this.assertActive();
         const input = validateGrowthCanaryInspectionRequest(inputValue);
         const replay = this.growthStore.beginOperation('canary-inspection', input);
-        if (replay !== undefined)
-            return validateGrowthCanaryInspectionReceipt(replay, input);
-        const artifact = this.growthStore.requireArtifact(input);
+        const artifact = replay === undefined
+            ? this.growthStore.requireArtifact(input)
+            : this.growthStore.requireCanaryInspectionArtifact(input);
+        if (replay !== undefined) {
+            const receipt = validateGrowthCanaryInspectionReceipt(replay, input);
+            if (receipt.outcome === 'passed')
+                this.requireCurrentCanaryProof(artifact);
+            return receipt;
+        }
         const run = artifact.canaryRunId === undefined ? undefined : this.store.getRun(artifact.canaryRunId);
         if (artifact.canaryTaskId === undefined || artifact.canaryRunId === undefined || run === undefined
             || run.taskId !== artifact.canaryTaskId || run.executionMode !== 'production') {
             throw new AssistantAutomationsError('runtime-conflict', 'canary inspection has no exact exposure proof');
         }
-        let proof;
-        const evaluation = this.evaluation;
-        if (evaluation !== undefined && run.status === 'succeeded') {
-            const scope = canonicalEvaluationHostScope({ workspace: artifact.workspace, preset: artifact.preset });
-            const matches = evaluation.query({
-                scope,
-                situation: `automation:${artifact.automationId}`,
-                objectiveStatus: 'achieved',
-                trust: 'trusted',
-                limit: 100,
-            }).filter(outcome => outcome.evidence.some(entry => entry.kind === 'automation-run' && entry.ref === run.id));
-            if (matches.length === 1) {
-                proof = evaluation.getTrustedOutcome({ scope, outcomeId: matches[0].id });
-            }
-        }
-        const passed = proof !== undefined && proof.trust === 'trusted'
-            && proof.objectiveStatus === 'achieved'
-            && proof.evidence.some(entry => entry.kind === 'automation-run' && entry.ref === run.id);
+        const proof = run.status === 'succeeded' ? this.currentCanaryProof(artifact) : undefined;
+        const passed = proof !== undefined;
         const failed = run.status !== 'succeeded';
-        const evaluationDigest = !passed ? undefined : growthObjectDigest({
-            contract: 'assistant-automations-growth-evaluation-proof/v1',
-            id: proof.id,
-            scopeKey: proof.scopeKey,
-            situation: proof.situation,
-            objectiveStatus: proof.objectiveStatus,
-            trust: proof.trust,
-            evidence: proof.evidence,
-            occurredAt: proof.occurredAt,
-            evaluator: proof.evaluator,
-        });
+        const evaluationDigest = proof?.projection.digest;
         if (passed) {
             this.growthStore.recordCanaryEvaluation({
                 artifactId: artifact.artifactId,
                 runId: run.id,
-                evaluationId: proof.id,
+                evaluationId: proof.triggerOutcomeId,
                 evaluationDigest: evaluationDigest,
+                proof: proof,
             });
         }
         const receipt = withGrowthPortReceiptDigest({
@@ -919,6 +994,110 @@ export class AssistantAutomationsService extends Service {
         });
         return validateGrowthCanaryInspectionReceipt(this.growthStore.completeOperation('canary-inspection', input, receipt), input);
     }
+    currentCanaryProof(artifact) {
+        if (artifact.canaryRunId === undefined || this.evaluation === undefined
+            || typeof this.evaluation.getTrustedAutomationRunLearningProjection !== 'function')
+            return undefined;
+        const scope = canonicalEvaluationHostScope({ workspace: artifact.workspace, preset: artifact.preset });
+        const proof = this.evaluation.getTrustedAutomationRunLearningProjection({ scope, runId: artifact.canaryRunId });
+        if (proof === undefined || proof.scope.workspace !== scope.workspace || proof.scope.preset !== scope.preset
+            || proof.situation !== `automation:${artifact.automationId}`
+            || proof.projection.subjectKind !== 'automation-run' || proof.projection.subjectRef !== artifact.canaryRunId
+            || proof.projection.disposition !== 'upsert' || proof.execution?.status !== 'succeeded'
+            || proof.objective?.status !== 'achieved')
+            return undefined;
+        return proof;
+    }
+    requireCurrentCanaryProof(artifact) {
+        const current = this.currentCanaryProof(artifact);
+        const saved = artifact.canaryEvaluationProof;
+        // Legacy append-only proofs deliberately fail closed. Never upgrade an old
+        // inspection receipt to a different canonical revision during promotion.
+        if (current === undefined || saved === undefined
+            || saved.scopeKey !== current.scopeKey
+            || saved.projection.subjectKind !== current.projection.subjectKind
+            || saved.projection.subjectRef !== current.projection.subjectRef
+            || saved.projection.version !== current.projection.version
+            || saved.projection.digest !== current.projection.digest
+            || saved.projection.disposition !== 'upsert'
+            || artifact.canaryEvaluationDigest !== current.projection.digest) {
+            throw new AssistantAutomationsError('runtime-conflict', 'canonical canary evidence changed or is unavailable');
+        }
+        return current;
+    }
+    workflowInvalidationListeners = new Set();
+    onWorkflowEvidenceInvalidated(listener) {
+        this.workflowInvalidationListeners.add(listener);
+        for (const artifact of this.growthStore.listDeployedArtifacts()) {
+            const version = this.growthStore.rollbackVersion(artifact.experimentId);
+            if (artifact.state === 'rolled-back' && version !== undefined)
+                listener(artifact.experimentId, { id: artifact.artifactId, version, digest: artifact.definitionHash });
+        }
+        return () => { this.workflowInvalidationListeners.delete(listener); };
+    }
+    /** Revalidate deployed proof before scheduling, on authoritative writes, and after restart. */
+    revalidatePromotedWorkflows(strict = false) {
+        let unsafe = false;
+        for (let artifact of this.growthStore.listDeployedArtifacts()) {
+            try {
+                if (artifact.state === 'rolled-back') {
+                    const version = this.growthStore.rollbackVersion(artifact.experimentId);
+                    if (version !== undefined)
+                        for (const listener of this.workflowInvalidationListeners)
+                            listener(artifact.experimentId, { id: artifact.artifactId, version, digest: artifact.definitionHash });
+                    continue;
+                }
+                if (artifact.state === 'canary-pending') {
+                    const live = this.store.get(artifact.automationId);
+                    if (live?.status !== 'active' || live.version !== artifact.definitionVersion + 1
+                        || live.owner !== GROWTH_AUTOMATION_OWNER || this.store.getDefinitionHash(live.id) !== artifact.definitionHash)
+                        continue;
+                    if (this.currentCanaryProof(artifact) !== undefined)
+                        continue;
+                    // Recover activation whose acknowledgement was lost before examining its proof.
+                    const recoveredRequest = {
+                        contractVersion: 1, operationId: `${artifact.experimentId}:promotion`,
+                        experimentId: artifact.experimentId, candidateId: artifact.candidateId,
+                        candidateRevision: artifact.candidateRevision, candidateDigest: artifact.candidateDigest,
+                        artifactId: artifact.artifactId, artifactVersion: artifact.definitionVersion, artifactDigest: artifact.definitionHash,
+                    };
+                    artifact = this.growthStore.completePromotion({ automation: live, request: recoveredRequest,
+                        receipt: withGrowthPortReceiptDigest({ ...growthIdentity(recoveredRequest),
+                            artifactId: artifact.artifactId, artifactVersion: artifact.definitionVersion,
+                            artifactDigest: artifact.definitionHash, outcome: 'promoted',
+                            resultingArtifactVersion: live.version, resultingArtifactDigest: artifact.definitionHash, }),
+                    });
+                }
+                if (artifact.state !== 'promoted')
+                    continue;
+                // Deployed artifacts require current exact-run success, while a newer
+                // positive owner judgement may strengthen an already successful proof.
+                if (this.currentCanaryProof(artifact) !== undefined)
+                    continue;
+                this.rollbackWorkflowAutomation({
+                    contractVersion: 1, operationId: `${artifact.experimentId}:rollback`,
+                    experimentId: artifact.experimentId, candidateId: artifact.candidateId,
+                    candidateRevision: artifact.candidateRevision, candidateDigest: artifact.candidateDigest,
+                    artifactId: artifact.artifactId, artifactVersion: artifact.definitionVersion,
+                    artifactDigest: artifact.definitionHash,
+                });
+                for (const listener of this.workflowInvalidationListeners)
+                    listener(artifact.experimentId, { id: artifact.artifactId, version: artifact.definitionVersion, digest: artifact.definitionHash });
+            }
+            catch {
+                // Keep the durable artifact / pending rollback for retry. A different
+                // deployed definition is unrelated and must not be paused or block it.
+                const live = this.store.get(artifact.automationId);
+                if (live?.status === 'active' && live.owner === GROWTH_AUTOMATION_OWNER
+                    && this.store.getDefinitionHash(live.id) === artifact.definitionHash
+                    && (live.version === artifact.definitionVersion
+                        || (artifact.state === 'canary-pending' && live.version === artifact.definitionVersion + 1)))
+                    unsafe = true;
+            }
+        }
+        if (strict && unsafe)
+            throw new AssistantAutomationsError('runtime-conflict', 'exact deployed canary rollback must finish before dispatch');
+    }
     promoteWorkflowAutomation(inputValue) {
         this.assertActive();
         const input = validateGrowthAutomationArtifactRequest(inputValue);
@@ -930,33 +1109,44 @@ export class AssistantAutomationsService extends Service {
             || artifact.canaryEvaluationId === undefined || artifact.canaryEvaluationDigest === undefined) {
             throw new AssistantAutomationsError('runtime-conflict', 'promotion requires the exact canary artifact');
         }
-        const definition = this.requireLiveGrowthArtifact(artifact);
-        if (definition === undefined || definition.owner !== GROWTH_AUTOMATION_OWNER
-            || this.store.getDefinitionHash(definition.id) !== input.artifactDigest
-            || !((definition.status === 'paused' && definition.version === input.artifactVersion)
-                || (definition.status === 'active' && definition.version === input.artifactVersion + 1))) {
-            throw new AssistantAutomationsError('runtime-conflict', 'promotion artifact changed before exact CAS');
-        }
-        const promoted = definition.status === 'active'
-            ? definition
-            : this.reconcileSystem({
-                owner: GROWTH_AUTOMATION_OWNER,
-                automationId: definition.id,
-                idempotencyKey: boundedGrowthKey('growth-promote', input),
-                desiredStatus: 'active',
-                definition: definition.definition,
+        const proof = this.requireCurrentCanaryProof(artifact);
+        const fenced = this.evaluation.withTrustedCanonicalLearningWriterFence({
+            scope: canonicalEvaluationHostScope({ workspace: artifact.workspace, preset: artifact.preset }),
+            scopeWatermark: proof.scopeWatermark,
+            evidence: [{ ...proof.projection, disposition: 'upsert' }],
+        }, () => {
+            const definition = this.requireLiveGrowthArtifact(artifact);
+            if (definition === undefined || definition.owner !== GROWTH_AUTOMATION_OWNER
+                || this.store.getDefinitionHash(definition.id) !== input.artifactDigest
+                || !((definition.status === 'paused' && definition.version === input.artifactVersion)
+                    || (definition.status === 'active' && definition.version === input.artifactVersion + 1))) {
+                throw new AssistantAutomationsError('runtime-conflict', 'promotion artifact changed before exact CAS');
+            }
+            const promoted = definition.status === 'active'
+                ? definition
+                : this.reconcileSystem({
+                    owner: GROWTH_AUTOMATION_OWNER,
+                    automationId: definition.id,
+                    idempotencyKey: boundedGrowthKey('growth-promote', input),
+                    desiredStatus: 'active',
+                    definition: definition.definition,
+                });
+            const receipt = withGrowthPortReceiptDigest({
+                ...growthIdentity(input),
+                artifactId: input.artifactId,
+                artifactVersion: input.artifactVersion,
+                artifactDigest: input.artifactDigest,
+                outcome: 'promoted',
+                resultingArtifactVersion: promoted.version,
+                resultingArtifactDigest: input.artifactDigest,
             });
-        const stored = this.growthStore.completePromotion({ request: input, automation: promoted });
-        const receipt = withGrowthPortReceiptDigest({
-            ...growthIdentity(input),
-            artifactId: input.artifactId,
-            artifactVersion: input.artifactVersion,
-            artifactDigest: input.artifactDigest,
-            outcome: 'promoted',
-            resultingArtifactVersion: stored.definitionVersion,
-            resultingArtifactDigest: stored.definitionHash,
+            this.growthStore.completePromotion({ request: input, automation: promoted, receipt });
+            return validateGrowthPromotionReceipt(this.growthStore.completeOperation('promotion', input, receipt), input);
         });
-        return validateGrowthPromotionReceipt(this.growthStore.completeOperation('promotion', input, receipt), input);
+        if (!fenced.matched) {
+            throw new AssistantAutomationsError('runtime-conflict', `canonical canary evidence fence: ${fenced.reason}`);
+        }
+        return fenced.value;
     }
     rollbackWorkflowAutomation(inputValue) {
         this.assertActive();
@@ -984,7 +1174,6 @@ export class AssistantAutomationsService extends Service {
             });
             automation = this.store.get(automation.id);
         }
-        this.growthStore.completeRollback({ request: input, automation });
         const receipt = withGrowthPortReceiptDigest({
             ...growthIdentity(input),
             artifactId: input.artifactId,
@@ -992,6 +1181,7 @@ export class AssistantAutomationsService extends Service {
             artifactDigest: input.artifactDigest,
             outcome: 'rolled-back',
         });
+        this.growthStore.completeRollback({ request: input, automation, receipt });
         return validateGrowthRollbackReceipt(this.growthStore.completeOperation('rollback', input, receipt), input);
     }
     propose(agent, input) {
@@ -1203,6 +1393,11 @@ export class AssistantAutomationsService extends Service {
     }
     ingestExternal(input) {
         this.assertActive();
+        const envelope = input.envelope === undefined ? undefined : parseExternalEventEnvelope(input.envelope);
+        if (envelope !== undefined && (envelope.source.id !== input.sourceId || envelope.event.id !== input.eventId
+            || envelope.event.occurredAt !== input.occurredAt || envelope.target.automationId !== input.automationId)) {
+            throw new AssistantAutomationsError('invalid-input', 'external event envelope does not bind this ingest input');
+        }
         const automation = this.store.get(input.automationId);
         const decision = this.policy.authorize({
             subject: {
@@ -1220,6 +1415,7 @@ export class AssistantAutomationsService extends Service {
             automationId: input.automationId,
             externalEventId: `${input.sourceId}:${input.eventId}`,
             occurredAt: input.occurredAt,
+            ...(envelope === undefined ? {} : { envelope }),
         });
     }
     reconcileSystem(input) {
@@ -1259,6 +1455,19 @@ export class AssistantAutomationsService extends Service {
         this.assertActive();
         return this.store.inspectSystemOwned(input);
     }
+    /** Host-only binding metadata for exact restart reconciliation; no prompt or task content. */
+    inspectSystemOwnedActivation = (input) => {
+        this.assertActive();
+        const current = this.store.get(input.automationId);
+        if (!current)
+            return undefined;
+        if (current.owner !== input.owner || current.definition.execution?.kind !== 'host')
+            throw new AssistantAutomationsError('not-found', 'exact system-owned Host automation was not found');
+        const definitionHash = this.store.getDefinitionHash(input.automationId);
+        if (!definitionHash)
+            throw new AssistantAutomationsError('not-found', 'system-owned definition hash is unavailable');
+        return Object.freeze({ definitionHash, activationNonce: current.definition.execution.activationNonce, ownerRouteId: current.definition.execution.ownerRouteId });
+    };
     /** Host-only bounded identity inventory; definitions and scopes never leave the store. */
     listSystemOwned(input) {
         this.assertActive();