@event4u/agent-config 14.22.0 → 14.23.0

package/src/scripts/session_memory_index.ts

@@ -22,10 +22,18 @@
  * default is off, per the roadmap's "off unless proven".
  */
 
-import { CURATED_TYPES, retrieve_v1 } from './memory_lookup.js';
+import { CURATED_TYPES, MEMORY_ROOT, retrieve_v1 } from './memory_lookup.js';
 import { load_agent_settings } from './_lib/agent_settings.js';
+import {
+    capRows,
+    orderRows,
+    SESSION_INDEX_ROW_CAP,
+    verifyMemoryRoot,
+    type TrustGrant,
+    type TrustVerdict,
+} from './_lib/session_index_trust.js';
 
-export const SESSION_INDEX_ROW_CAP = 30;
+export { SESSION_INDEX_ROW_CAP };
 
 interface IndexRow {
     id: string;
@@ -54,21 +62,72 @@ export function session_index_enabled(root: string): boolean {
  * Expects the caller to have chdir'd to the workspace root — memory roots
  * are cwd-relative, same contract as the MCP tool handlers.
  */
+/**
+ * How many entries retrieval is asked for before the declared order picks.
+ *
+ * R2 finding 2: asking retrieval for the CAP made P4 decorative. Every curated
+ * hit scores an identical 0.1 with an empty key set, so `retrieve` sliced the
+ * first 30 in STORE order at `memory_lookup.ts:995` and `orderRows` then sorted
+ * a set the cap had already chosen. Measured by the reviewer: a 40-entry corpus
+ * with the 5 cheapest last emitted zero cheap rows.
+ *
+ * The number must therefore exceed any realistic curated corpus, not merely the
+ * cap. 500 is a STATED DEFAULT, not a measured optimum — the cost of asking for
+ * more than exists is bounded by what exists, since `detail: 'index'` returns a
+ * row rather than a body. Its falsifier is recorded in the roadmap: a corpus
+ * larger than this bound makes store order decide again, silently.
+ */
+export const SESSION_INDEX_RETRIEVAL_LIMIT = 500;
+
 export function session_index_rows(cap: number = SESSION_INDEX_ROW_CAP): IndexRow[] {
-    const envelope = retrieve_v1([...CURATED_TYPES], [], cap, { detail: 'index' });
+    // Retrieval is asked for far more than the cap, so the declared order below
+    // is what chooses which rows survive truncation. P4 and P6 are one
+    // decision: retrieve wide, order, THEN cap — and never the reverse.
+    const envelope = retrieve_v1([...CURATED_TYPES], [], SESSION_INDEX_RETRIEVAL_LIMIT, { detail: 'index' });
     const entries = (envelope['entries'] as Array<Record<string, unknown>>) ?? [];
-    return entries.slice(0, cap).map((e) => ({
+    const rows: IndexRow[] = entries.map((e) => ({
         id: String(e['id'] ?? ''),
         title: String(e['title'] ?? ''),
         tokens_estimate: Number(e['tokens_estimate'] ?? 0),
     }));
+    return capRows(orderRows(rows), cap);
+}
+
+/**
+ * The trust gate, separated from the render so a caller can log WHY nothing
+ * was injected. `null` from {@link build_session_index_block} is ambiguous by
+ * construction — empty corpus and refused root look identical — and the
+ * distinction is the point of the contract, so it is available here.
+ *
+ * The workspace root is REQUIRED. `MEMORY_ROOT` is relative, so without a root
+ * to resolve it against there is nothing to check identity or containment
+ * against, and a default would be a bypass wearing a convenience.
+ */
+export function session_index_trust(workspaceRoot: string, now?: Date): TrustVerdict {
+    // `exactOptionalPropertyTypes` refuses `now: undefined` on an optional
+    // field, so the key is omitted rather than passed as undefined.
+    return verifyMemoryRoot({
+        workspaceRoot,
+        relativeMemoryRoot: MEMORY_ROOT,
+        ...(now === undefined ? {} : { now }),
+    });
 }
 
 /**
- * Render the injectable block, or `null` when the corpus is empty (no
- * block beats an empty scaffold).
+ * RENDER a block from whatever `MEMORY_ROOT` currently resolves to. Checks
+ * nothing, serves nothing.
+ *
+ * Split out on R2 findings 6 and 7. The trust check used to be an OPTIONAL
+ * parameter, which made the serving path opt-in — and `session_index_cost()`
+ * omitted it, so the one function whose name suggests it only measures was also
+ * the one that could render unchecked. Now the two operations have two names:
+ * this one renders (for cost measurement and for the unit seam that injects an
+ * absolute fixture root via `_setMemoryRoot`, which by construction sits
+ * outside any workspace), and {@link serve_session_index_block} is the only way
+ * to obtain a block for INJECTION — it takes a granted verdict, so there is no
+ * unchecked serving path to forget.
  */
-export function build_session_index_block(cap: number = SESSION_INDEX_ROW_CAP): string | null {
+export function render_session_index_block(cap: number = SESSION_INDEX_ROW_CAP): string | null {
     const rows = session_index_rows(cap);
     if (rows.length === 0) return null;
     const lines = [
@@ -81,13 +140,27 @@ export function build_session_index_block(cap: number = SESSION_INDEX_ROW_CAP):
     return lines.join('\n');
 }
 
+/**
+ * The only path to a block that will be INJECTED.
+ *
+ * Takes a granted verdict rather than a root, so the check happens once, at the
+ * caller, and cannot be skipped here — R2 finding 7 was that the hook and the
+ * builder each computed it, for a diagnostic the dispatcher does not forward.
+ * The type is `TrustGrant`, not `TrustVerdict`: a refusal cannot be passed in,
+ * so "did you check?" is answered by the signature instead of by a convention.
+ */
+export function serve_session_index_block(_grant: TrustGrant, cap: number = SESSION_INDEX_ROW_CAP): string | null {
+    return render_session_index_block(cap);
+}
+
 /**
  * Deterministic fixed cost of the block in real tokens (cl100k_base) —
  * the measurable arm of the roadmap's ship-criterion. Lazy-loads the
  * tokenizer so the enabled=off fast path never pays it.
  */
 export async function session_index_cost(cap: number = SESSION_INDEX_ROW_CAP): Promise<number> {
-    const block = build_session_index_block(cap);
+    // Renders rather than serves: this measures a cost, it injects nothing.
+    const block = render_session_index_block(cap);
     if (block === null) return 0;
     const { gpt_tokens } = await import('./_lib/token_count.js');
     return gpt_tokens(block).tokens;

package/src/server/schemas/settings.ts

@@ -31,7 +31,8 @@ const confidenceBand = z.enum(['off', 'low', 'medium', 'high']);
 const onBlock = z.enum(['stop', 'ask', 'warn']);
 const onBlockFallback = z.enum(['stop', 'warn']);
 const modelAutoSwitch = z.enum(['auto', 'suggest', 'off']);
-const leanProjectionMode = z.enum(['eager-all', 'thin']);
+const leanProjectionMode = z.enum(['eager-all', 'thin', 'delivery']);
+const leanProjectionHost = z.enum(['claude-code', 'cursor', 'cline']);
 const projectionMode = z.enum(['legacy-all', 'scoped']);
 const memoryCadence = z.enum(['auto', 'always', 'never']);
 const projectAudience = z.enum(['self', 'internal', 'client', 'public']);
@@ -64,9 +65,19 @@ export const settingsSchema = z.object({
     ),
     lean_projection: z.object({
         mode: leanProjectionMode.default('eager-all').describe(
-            'How the per-tool projector emits the rule layer. eager-all = every rule body inlined into every projection (default, safe). thin = kernel rules full-bodied + non-kernel rules as router-resolved pointers (~45k GPT-tok lighter per session). EXPERIMENTAL: validate with the live A/B before flipping; one-flip revert to eager-all.',
-        ),
-    }).default({ mode: 'eager-all' }),
+            'How the per-tool projector emits the rule layer. eager-all = every rule body inlined into every projection (safe; what an ABSENT key still resolves to, per ADR-267 decision point 4). thin = kernel rules full-bodied + non-kernel rules as router-resolved pointers (~45k GPT-tok lighter per session), with no delivery mechanism. delivery = thin stubs PLUS the rule-inject hook concern, which delivers a body back on a trigger match; this is the value the SHIPPED TEMPLATE carries for Claude Code since ADR-267, and the activation charge for it is paid in src/config/hook-token-budget.json (user_prompt_submit slot sum 4,096 -> 16,384).',
+        ),
+        hosts: z.array(leanProjectionHost).default(['claude-code']).describe(
+            'Which hosts a thinning mode may thin (ADR-267). Absent resolves to [claude-code]. '
+            + 'Only the three hosts with a per-rule rule tree are accepted, and this enum is the '
+            + 'AUTHORING layer: an id outside it is a hard validation FAILURE here and under '
+            + 'validate_agent_settings, never a warning. resolveLeanProjectionHosts is the '
+            + 'READ-TIME backstop for a hand-edited .agent-settings.yml that passed neither, and '
+            + 'THERE the id is dropped with a warning (R2 finding 6 — the two layers answer '
+            + 'differently and neither said so). Every host outside this list receives exactly '
+            + 'what eager-all writes, asserted byte-for-byte by check_host_tree_parity.',
+        ),
+    }).default({ mode: 'eager-all', hosts: ['claude-code'] }),
     cost: z.object({
         budgets: z.object({
             daily: z.number().min(0).default(0).describe(
@@ -438,6 +449,14 @@ export const settingsSchema = z.object({
             ),
         }),
     }),
+    continuity: z.object({
+        auto_record: z.enum(['on', 'off']).default('off').describe(
+            'Deterministic continuity-record writer at session end (road-to-continuity-writer-activation Phase 1). on = the session-eol concern writes the continuity_record capsule variant on Stop for a substantive session that has claimed a roadmap; every field is computed from on-disk state, with no model spend and no subprocess. off (default) = no automatic record — while session:recycle is still the normal path, a second producer on it before the parity evidence is in would be unverified.',
+        ),
+        run_checkpoints: z.enum(['on', 'off']).default('on').describe(
+            'Deterministic run-checkpoint production at session end (road-to-continuity-writer-activation Phase 1.4). on (default) = a session above the recycle threshold and inside a running roadmap contract leaves agents/runtime/state/checkpoints/<run>.json, so a killed run resumes from a derived checkpoint rather than from bookkeeping. off = no checkpoint; continuity writing, the recycle advisory and the context-fill surface are unaffected. Default ON because it is the behaviour the tree already had — the switch exists to make the three session-end handlers independently disableable, not to change what ships.',
+        ),
+    }),
     memory: z.object({
         cadence: memoryCadence.default('always').describe(
             'Cadence of the 🧠 memory-visibility line after a memory-consulting step. always (default) = show whenever a memory type was asked; auto = show only when 3+ types were consulted (less noise); never = suppress. Distinct from rule_loading_tier — owns its own key since the 2026-06-01 untangle.',

package/src/vendor/grammars/README.md

@@ -41,6 +41,27 @@ they are annotated MIT in `REUSE.toml` and credited in `CREDITS.md`.
 are refreshed from, and the ABI smoke test in `tests/scripts/code_graph.test.ts`
 runs against it. It is deliberately not a runtime dependency.
 
+## Verification
+
+Two checks, and they answer different questions.
+
+`src/config/packed-binary-manifest.json` plus `_lib/packed_binary_predicate.ts`
+verify that these bytes are what the manifest says they are — eleven conditions,
+all of them re-derived from the bytes. Every one of them reads the manifest, so
+a commit that edits a row and its file together satisfies all eleven.
+
+`_lib/vendored_grammar_upstream.ts` verifies that these bytes are what the
+**locked upstream** says they are: it byte-compares each file against
+`node_modules/tree-sitter-wasms/out/`, after asserting that the installed
+version is the one `package-lock.json` pins. An absent or unlocked upstream is a
+refusal, never a pass. It is exercised by
+`tests/scripts/vendored_grammar_upstream.test.ts`, which also drives every
+refusal path and a real mutated grammar to failure.
+
+What neither check covers is a `package-lock.json` row pointing at a hostile
+package; that is review's job, and `packed_binary_predicate.ts`'s docblock says
+so in those words.
+
 ## Refreshing
 
 The pair is ABI-coupled and must move together:
@@ -55,7 +76,11 @@ shasum -a 256 src/vendor/grammars/*.wasm   # update the table above
 
 Then update, in the same change:
 
-- the three `BINARY_PAYLOAD_EXCEPTIONS` entries in `src/scripts/check_pack_size.ts`
-  (they are path-and-size-bound, so any size change invalidates them by design);
+- the three entries in `src/config/packed-binary-manifest.json` (they are
+  path-, sha256- and size-bound, so any refresh invalidates them by design).
+  This used to name `BINARY_PAYLOAD_EXCEPTIONS` in `src/scripts/check_pack_size.ts`,
+  a constant that no longer exists — `grep -rn BINARY_PAYLOAD_EXCEPTIONS` returned
+  this line and nothing else, so a refresher following it would have skipped the
+  manifest and reddened the pack-size gate with no pointer to why;
 - `EXPECTED_GRAMMAR_ABI` in `src/scripts/code_graph/types.ts` if the ABI moved;
 - the install-size line in `MIGRATION.md`.