@dzhechkov/harness-cli 0.3.256 → 0.3.257

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dzhechkov/harness-cli",
-  "version": "0.3.256",
+  "version": "0.3.257",
   "description": "The dz CLI — install AI skills for Claude Code, Codex, OpenCode, Hermes, OpenClaude, GitHub Copilot. 35 commands, 13 presets, 6 platform targets.",
   "type": "module",
   "license": "MIT",
@@ -41,7 +41,7 @@
     "sbom.json"
   ],
   "dependencies": {
-    "@dzhechkov/harness-core": "^0.3.145",
+    "@dzhechkov/harness-core": "^0.3.146",
     "@dzhechkov/harness-presets": "^0.5.0",
     "@dzhechkov/scout": "^0.8.0",
     "@dzhechkov/skills-devops": "^0.3.0",

package/sbom.json

@@ -25,7 +25,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "5f73e2c6d9c0ea38d5324f058cbd921bdb28dab60aa97ded97979ed994426731"
+          "content": "7333dd44bcbeb6536e8ee0f0490a57fefca211e706535da7f44cea7012388213"
         }
       ]
     },
@@ -105,7 +105,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "18d5f55ed3c56718e470fef8bd677c55de08f4505e188b1dd29a0f0bbec09d4b"
+          "content": "818293a250cdf1bd10b5d69267b714d9a8ab90017c1fa18de29fc24e28ad8a55"
         }
       ]
     },
@@ -115,7 +115,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "c47d11fd3ed7e6049b1080cd9292ed3498e113d8bc74a9af65a027d70fa96435"
+          "content": "9c37499ed55b571232b5718c863b83b31f7a79faab46a9dcbe3283b993b1862a"
         }
       ]
     },
@@ -125,7 +125,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "684ea0c6fa4edbbbea1ffcd943167cd374166eb196100433d4e8d02d70560794"
+          "content": "6cf537925ccb4b1ffff84c8fd255b487438b78b56a46f9d91d33b25500ae520d"
         }
       ]
     },
@@ -185,7 +185,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "154755702a4652597bf8ca1410f9a3303b76c6a8dae8dacd867921a88c7b3626"
+          "content": "7abb07cdda09bea2b8e948cecdbaed4579371e8d0e8cee4436e7fcb20f430cdd"
         }
       ]
     },
@@ -205,7 +205,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "0dce827134ab5f7aaf55bd76325b5e1e17881770310e64e0d66bafbedc91687e"
+          "content": "d64af623372238bb5f2ead34e733130d7b013c49058a26f4795f09586b2b5dda"
         }
       ]
     },
@@ -225,7 +225,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "7d6ba26ec1188db3b3ac89f50b015ba1f0c6117b5c30d99b22da41da10c96c12"
+          "content": "555aed692218a73f23a343df2f2b38ce028e694dd9d4aff37e727096f88eb50e"
         }
       ]
     },

package/src/cli.ts

@@ -4,7 +4,7 @@
  * @packageDocumentation
  */
 
-import { chmodSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, readlinkSync, realpathSync, renameSync, rmdirSync, rmSync, statSync, symlinkSync, writeFileSync } from 'node:fs';
+import { chmodSync, closeSync, existsSync, fstatSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, readlinkSync, realpathSync, renameSync, rmdirSync, rmSync, statSync, symlinkSync, writeFileSync } from 'node:fs';
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { execFileSync, execSync, spawn } from 'node:child_process';
@@ -107,6 +107,11 @@ import {
   RECALL_USAGE_LOG_MAX_BYTES,
   parseRecallUsageLog,
   buildRecallUsageReport,
+  EVENT_CHAIN_TAIL_BYTES,
+  EMPTY_LOG_TAIL,
+  readTailInfo,
+  appendChainedLines,
+  verifyEventChainText,
   buildManifest,
   buildSbom,
   resolveTrustRoot,
@@ -269,6 +274,7 @@ import {
 import type { IdeaRecord, IdeaStatus } from '@dzhechkov/harness-core';
 import type { Family, ModelRung, Candidate as BtoCandidate, DimScores } from '@dzhechkov/harness-core';
 import type { SetupSpec } from '@dzhechkov/harness-core';
+import type { LogTail } from '@dzhechkov/harness-core';
 import type { ProvenanceMode, PackVerdict, ClaudeUsageModel, PatternRecord, TargetName, BookKU, HarmonizeReport, UsageCalibrationPlan, ClaimFinding, RecallUsagePatternRow, GateExecution, GateStep } from '@dzhechkov/harness-core';
 import { getPreset, PRESET_NAMES } from '@dzhechkov/harness-presets';
 import { scanGitHub, analyzeRepo, generateReport, deepAnalyze, scanAllSources, ScoutMemory } from '@dzhechkov/scout';
@@ -5045,11 +5051,44 @@ function runGuardEvaluation(root: string, op: string, text: string | undefined,
   try {
     const rec = auditRecord(result, new Date().toISOString(), overrideReason !== undefined ? { reason: overrideReason } : undefined);
     mkdirSync(join(root, '.dz'), { recursive: true });
-    writeFileSync(join(root, '.dz', 'guard-audit.jsonl'), JSON.stringify(rec) + '\n', { flag: 'a' });
+    const auditPath = join(root, '.dz', 'guard-audit.jsonl');
+    // event-chain (ADR-001): seq + prevHash derived from the LAST LINE ONLY — this file is the
+    // evidence base `dz guard promote` decides on, and a rewrite that loses or duplicates a record
+    // must not be able to look intact. A tail that cannot be read starts a MARKED segment rather
+    // than blocking the audit: the verdict is never held hostage to a broken log.
+    writeFileSync(auditPath, appendChainedLines([rec], readLogTail(auditPath)), { flag: 'a' });
   } catch { /* audit is best-effort, never blocks the verdict */ }
   return result;
 }
 
+/**
+ * The tail facts of an append-only log, read from its END — O(1) in the file size, which is what
+ * lets the chain be extended on every append without a full-file scan (FR-2). Anything unreadable
+ * yields {@link EMPTY_LOG_TAIL}; the caller then starts a marked segment rather than blocking.
+ */
+function readLogTail(path: string): LogTail {
+  let fd: number | undefined;
+  try {
+    if (!existsSync(path)) return EMPTY_LOG_TAIL;
+    fd = openSync(path, 'r');
+    const size = fstatSync(fd).size;
+    if (!Number.isFinite(size) || size <= 0) return EMPTY_LOG_TAIL;
+    const want = Math.min(size, EVENT_CHAIN_TAIL_BYTES);
+    const buf = Buffer.alloc(want);
+    readSync(fd, buf, 0, want, size - want);
+    return readTailInfo(buf.toString('utf-8'), { partial: want < size });
+  } catch {
+    // A read FAILURE is not an empty file (Codex re-QE LOW): EMPTY_LOG_TAIL means "there is
+    // nothing", which lets the writer open an UNMARKED genesis on a file we merely failed to
+    // read. An unreadable tail must force a marked reset, per the AM-6 contract.
+    return { ...EMPTY_LOG_TAIL, unreadable: true };
+  } finally {
+    if (fd !== undefined) {
+      try { closeSync(fd); } catch { /* nothing to do */ }
+    }
+  }
+}
+
 // ── `dz guard promote` (feature guard-promotion, scout idea #1) ─────────────────────────────────
 
 const PROMOTIONS_DIR = join('features', 'guard-promotion', 'promotions');
@@ -6290,7 +6329,19 @@ function cmdCompounding(options: Map<string, string>, flags: Set<string>, cwd: s
     /* no audit yet */
   }
 
-  const report = assembleCompoundingReport({ lessons, usage, guard, nowTs: new Date().toISOString() });
+  // The evidence logs themselves, verbatim: the report verifies their hash chains (feature
+  // event-chain). Handing over the TEXT rather than a pre-computed verdict keeps one definition of
+  // "the chain is intact" — a second copy here is how a gate and its report start disagreeing.
+  const evidenceLogs: { log: string; text: string }[] = [];
+  for (const rel of ['.dz/recall-usage.jsonl', '.dz/guard-audit.jsonl']) {
+    try {
+      evidenceLogs.push({ log: rel, text: readFileSync(join(root, ...rel.split('/')), 'utf-8') });
+    } catch {
+      /* absent log — reported by its own gate above, not invented here */
+    }
+  }
+
+  const report = assembleCompoundingReport({ lessons, usage, guard, nowTs: new Date().toISOString(), evidenceLogs });
   if (json) write(JSON.stringify({ ...report, exitCode: 0 }, null, 2));
   else write(renderCompoundingReport(report));
   return 0;