@fro.bot/systematic 3.5.0 → 3.5.1

package/dist/index.js

@@ -3320,9 +3320,20 @@ function applyUnitStart(marker, epoch, context) {
     return;
   }
   if (current.unitId === marker.unitId) {
-    if (!sameUnitDeclaration(current, marker))
+    if (current.state === "completed")
+      return "out-of-order";
+    if (!sameUnitDeclaration(current, marker) && unitHasMintedEvidence(current, context)) {
+      return "out-of-order";
+    }
+    if (sameUnitDeclaration(current, marker) && current.transitionDigest !== marker.transitionDigest) {
       return "conflicting-marker";
-    return current.state === "completed" ? "out-of-order" : "conflicting-marker";
+    }
+    if (!unitDeclarationExtends(current, marker))
+      return "conflicting-marker";
+    if (sameUnitDeclaration(current, marker))
+      return;
+    context.progression = { epoch, unit: snapshot };
+    return;
   }
   if (current.state !== "completed")
     return "out-of-order";
@@ -3346,9 +3357,26 @@ function applyUnitComplete(marker, epoch, context) {
   };
   return;
 }
+function unitHasMintedEvidence(current, context) {
+  return [...context.mintByReceipt.values()].some((envelope) => envelope.canonical.epochDigest === current.epochDigest && envelope.canonical.unitDigest === current.unitDigest);
+}
 function sameUnitDeclaration(current, marker) {
   return current.epochDigest === marker.epochDigest && current.unitDigest === marker.unitDigest && current.family === marker.family && JSON.stringify(current.requiredOperations) === JSON.stringify(marker.requiredOperations) && JSON.stringify(current.resourceScopes) === JSON.stringify(marker.resourceScopes);
 }
+function unitDeclarationExtends(current, marker) {
+  if (current.epochDigest !== marker.epochDigest || current.unitDigest !== marker.unitDigest || current.family !== marker.family) {
+    return false;
+  }
+  const nextOperations = new Set(marker.requiredOperations);
+  if (current.requiredOperations.some((operation) => !nextOperations.has(operation))) {
+    return false;
+  }
+  const nextScopes = new Map(marker.resourceScopes.map((scope) => [
+    scope.operation,
+    scope.resourceIdentity
+  ]));
+  return [...current.resourceScopes].every((scope) => nextScopes.get(scope.operation) === scope.resourceIdentity);
+}
 function foldProgressionMarker(marker, context) {
   return marker.target === "epoch" ? applyEpochProgression(marker, context) : applyUnitProgression(marker, context);
 }
@@ -8473,7 +8501,11 @@ function cloneUnit(unit) {
     requiredOperations: unit.requiredOperations,
     requiredResourceOperations: Object.freeze([
       ...unit.declaredResourceOperations
-    ])
+    ]),
+    resourceScopes: Object.freeze([...unit.resourceScopes].map(([operation, resourceIdentity]) => ({
+      operation,
+      resourceIdentity
+    })))
   });
 }
 function familyForSkill(skill) {
@@ -8900,6 +8932,13 @@ function createWorkflowGuard(options) {
       return "receipt-mismatch";
     return context.worktreeIdentity !== currentWorktreeIdentity ? "receipt-mismatch" : undefined;
   }
+  function currentOperationContext() {
+    return Object.freeze({
+      workspaceIdentity: currentWorkspaceIdentity,
+      ...currentRepositoryIdentity === undefined ? {} : { repositoryIdentity: currentRepositoryIdentity },
+      ...currentWorktreeIdentity === undefined ? {} : { worktreeIdentity: currentWorktreeIdentity }
+    });
+  }
   function resourceBeforeReason(input, unit) {
     if (!operationUsesResource(input.operation))
       return;
@@ -9591,9 +9630,10 @@ function createWorkflowGuard(options) {
     }
     return;
   }
-  function mergeResourceScopes(trustedPolicy, modelScopes) {
-    const result = new Map(runtimeScopes);
-    for (const scopes of [trustedPolicy.resourceScopes, modelScopes]) {
+  function mergeResourceScopes(trustedPolicy, modelScopes, existingScopes) {
+    const result = new Map(existingScopes ?? runtimeScopes);
+    const scopesToMerge = existingScopes ? [runtimeScopes, trustedPolicy.resourceScopes, modelScopes] : [trustedPolicy.resourceScopes, modelScopes];
+    for (const scopes of scopesToMerge) {
       for (const [operation, resource] of scopes) {
         const existing = result.get(operation);
         if (existing && existing !== resource)
@@ -9603,22 +9643,71 @@ function createWorkflowGuard(options) {
     }
     return result;
   }
-  function requiredOperationsFor(trustedPolicy, model, resourceScopes) {
+  function requiredOperationsFor(trustedPolicy, model, resourceScopes, existingOperations = []) {
     return Object.freeze([
       ...new Set([
         ...MANDATORY_OPERATIONS,
         ...runtimeRequired,
+        ...existingOperations,
         ...trustedPolicy.expectedOperations,
         ...model.expectedOperations,
         ...resourceScopes.keys()
       ])
     ]);
   }
+  function resourceIdentitiesMatchUnit(unit) {
+    const expected = new Map(runtimeScopes);
+    for (const [operation, resource] of unit.resourceScopes) {
+      expected.set(operation, resource);
+    }
+    if (currentResourceIdentities.size !== expected.size)
+      return false;
+    for (const [operation, resource] of expected) {
+      if (currentResourceIdentities.get(operation) !== resource)
+        return false;
+    }
+    return true;
+  }
+  function pristineActiveUnit(unit) {
+    return unit.evidence.size === 0 && unit.issues.size === 0 && unit.staleReceiptIds.size === 0 && unit.recoveredReceiptIds.size === 0 && unit.operationStates.size === 0 && unit.ledgerContexts.size === 0 && globalIssue === undefined && transitionsByCall.size === 0 && terminalOperationCalls.size === 0 && currentResourceRevisionIdentities.size === 0 && currentPullRequestFingerprint === undefined && currentWorkspaceIdentity === initialWorkspaceIdentity && currentRepositoryIdentity === initialRepositoryIdentity && currentWorktreeIdentity === initialWorktreeIdentity && resourceIdentitiesMatchUnit(unit);
+  }
+  function declarationChanged(unit, requiredOperations, resourceScopes) {
+    if (JSON.stringify(unit.requiredOperations) !== JSON.stringify(requiredOperations)) {
+      return true;
+    }
+    if (unit.resourceScopes.size !== resourceScopes.size)
+      return true;
+    for (const [operation, resource] of resourceScopes) {
+      if (unit.resourceScopes.get(operation) !== resource)
+        return true;
+    }
+    return false;
+  }
+  function startActiveUnit(parsed, trustedPolicy, unit) {
+    if (!pristineActiveUnit(unit)) {
+      return { status: "rejected", reasonCode: "unit-active" };
+    }
+    const resourceScopes = mergeResourceScopes(trustedPolicy, parsed.resourceScopes, unit.resourceScopes);
+    if (!resourceScopes) {
+      return { status: "rejected", reasonCode: "runtime-scope-conflict" };
+    }
+    const requiredOperations = requiredOperationsFor(trustedPolicy, parsed, resourceScopes, unit.requiredOperations);
+    if (!declarationChanged(unit, requiredOperations, resourceScopes)) {
+      return { status: "rejected", reasonCode: "unit-active" };
+    }
+    unit.requiredOperations = requiredOperations;
+    unit.declaredResourceOperations = Object.freeze([...resourceScopes.keys()]);
+    unit.resourceScopes = resourceScopes;
+    for (const [operation, resource] of resourceScopes) {
+      currentResourceIdentities.set(operation, resource);
+    }
+    return { status: "started", unit: cloneUnit(unit) };
+  }
   function startParsedUnit(parsed, trustedPolicy) {
     if (!epoch)
       return { status: "rejected", reasonCode: "no-active-epoch" };
     if (epoch.unit?.status === "active") {
-      return { status: "rejected", reasonCode: "unit-active" };
+      return startActiveUnit(parsed, trustedPolicy, epoch.unit);
     }
     const resourceScopes = mergeResourceScopes(trustedPolicy, parsed.resourceScopes);
     if (!resourceScopes) {
@@ -9706,7 +9795,7 @@ function createWorkflowGuard(options) {
       reasonCode: existing.state === "abandoned" ? "abandoned-transition" : "transition-terminal"
     };
   }
-  async function processOperation(input, parsed, unit) {
+  async function processOperation(input, parsed, unit, trustedClassification) {
     if (!unit.requiredOperations.includes(parsed.operation)) {
       markTerminalOperation(parsed, input);
       return { status: "rejected", reasonCode: "operation-not-required" };
@@ -9725,7 +9814,7 @@ function createWorkflowGuard(options) {
     if (prepared.status !== "prepared") {
       return prepared.reasonCode === "call-context-conflict" ? { status: "rejected", reasonCode: "call-context-conflict" } : { status: "rejected", reasonCode: "rejected-operation" };
     }
-    const classification = await classifyPreparedOperation(parsed, input, unit);
+    const classification = trustedClassification ?? await classifyPreparedOperation(parsed, input, unit);
     return classification ? finalizeOperation(parsed, input, unit, classification) : { status: "rejected", reasonCode: "guard-unavailable" };
   }
   function rejectParsedOperation(parsed, input, unit, reasonCode) {
@@ -10231,12 +10320,44 @@ function createWorkflowGuard(options) {
       }
       return processOperation(input, parsed, epoch.unit);
     },
+    async observeTrustedRecoveredOperation(input) {
+      const modeResult = evidenceModeResult();
+      if (modeResult)
+        return modeResult;
+      if (!epoch)
+        return { status: "rejected", reasonCode: "no-active-epoch" };
+      if (!epoch.unit)
+        return { status: "rejected", reasonCode: "no-active-unit" };
+      if (epoch.unit.status === "completed") {
+        return { status: "rejected", reasonCode: "unit-completed" };
+      }
+      const terminalResult = terminalOperationResult(input);
+      if (terminalResult)
+        return terminalResult;
+      const parsed = parseReceiptOperationObservation(input);
+      if (!parsed) {
+        markTerminalOperation(undefined, input);
+        return recordGlobalEvidenceIssue("invalid-receipt");
+      }
+      const classification = {
+        outcome: "accepted",
+        category: parsed.operation,
+        attribution: "runtime-verified",
+        result: "success",
+        sideEffect: parsed.operation === "verification" || parsed.operation === "check-readback" || parsed.operation === "review-readback" ? "not-required" : "required",
+        reasonCode: "recognized-command"
+      };
+      return processOperation(input, parsed, epoch.unit, classification);
+    },
     observeReadback(input) {
       const parsed = parseReadback(input);
       if (!parsed)
         return { status: "rejected", reasonCode: "invalid-receipt" };
       return observeRevision(parsed, epoch?.unit);
     },
+    currentOperationContext() {
+      return currentOperationContext();
+    },
     status() {
       return projection();
     },
@@ -11156,6 +11277,7 @@ function createSessionRuntime(options) {
     const rollupKey = `${host.sessionID}:${host.callID}:${childSessionID}`;
     if (rolledUpChildren.has(rollupKey))
       return;
+    const parentBefore = guard.currentOperationContext();
     const children = await options.hostReadback.listChildren(host.sessionID);
     if (!children.some((child) => child.sessionId === childSessionID && child.parentID === host.sessionID)) {
       markUnavailable();
@@ -11203,18 +11325,27 @@ function createSessionRuntime(options) {
     const currentStatus = guard.status();
     if (!currentStatus.epoch || !currentStatus.unit)
       return;
-    const expectedWorkspace = ledger.digestIdentity("workspace", options.workspaceIdentity);
-    const expectedRepository = ledger.digestIdentity("repository", options.repositoryIdentity ?? current.snapshot.repositoryRevisionDigest);
-    const expectedWorktree = ledger.digestIdentity("worktree", options.worktreeIdentity ?? current.snapshot.worktreeRevisionDigest);
-    let minted = false;
+    const expectedWorkspace = childLedger.digestIdentity("workspace", parentBefore.workspaceIdentity);
+    const expectedRepository = childLedger.digestIdentity("repository", current.snapshot.repositoryRevisionDigest);
+    const expectedWorktree = childLedger.digestIdentity("worktree", current.snapshot.worktreeRevisionDigest);
+    const candidates = [];
     for (const childReceipt of recovered.receipts) {
       const operation = childReceipt.canonical.operation;
       if (!localOperation(operation))
         continue;
-      if (childReceipt.canonical.workspaceDigest !== expectedWorkspace || childReceipt.canonical.repositoryDigest !== expectedRepository || childReceipt.canonical.worktreeDigest !== expectedWorktree) {
+      if (childReceipt.canonical.workspaceDigest !== expectedWorkspace) {
         markUnavailable();
         return;
       }
+      if (childReceipt.canonical.repositoryDigest !== expectedRepository || childReceipt.canonical.worktreeDigest !== expectedWorktree) {
+        continue;
+      }
+      candidates.push(childReceipt);
+    }
+    let minted = false;
+    for (const childReceipt of candidates) {
+      const operation = childReceipt.canonical.operation;
+      const parentContext = guard.currentOperationContext();
       const callID = `task-${host.callID}-${childReceipt.canonical.receiptId}`;
       const observation = {
         callId: callID,
@@ -11223,12 +11354,12 @@ function createSessionRuntime(options) {
         context: {
           epochId: currentStatus.epoch.epochId,
           unitId: currentStatus.unit.unitId,
-          workspaceIdentity: options.workspaceIdentity,
-          repositoryIdentity: operation === "commit" ? options.repositoryIdentity ?? current.snapshot.repositoryRevisionDigest : current.snapshot.repositoryRevisionDigest,
-          worktreeIdentity: operation === "implementation" ? options.worktreeIdentity ?? current.snapshot.worktreeRevisionDigest : current.snapshot.worktreeRevisionDigest
+          workspaceIdentity: parentContext.workspaceIdentity,
+          ...parentContext.repositoryIdentity ? { repositoryIdentity: parentContext.repositoryIdentity } : {},
+          ...parentContext.worktreeIdentity ? { worktreeIdentity: parentContext.worktreeIdentity } : {}
         },
         after: {
-          workspaceIdentity: options.workspaceIdentity,
+          workspaceIdentity: parentContext.workspaceIdentity,
           repositoryIdentity: current.snapshot.repositoryRevisionDigest,
           worktreeIdentity: current.snapshot.worktreeRevisionDigest
         },
@@ -11238,7 +11369,7 @@ function createSessionRuntime(options) {
           noOp: false
         }
       };
-      const result = await guard.observeOperation(observation);
+      const result = await guard.observeTrustedRecoveredOperation(observation);
       if (result.status === "accepted") {
         const receipt = receiptForOperation(callID, operation);
         if (receipt)
@@ -11433,13 +11564,21 @@ function createSessionRuntime(options) {
     }
     return result;
   }
+  function progressionResourceScopes(unit) {
+    return [...unit.resourceScopes].sort((first, second) => first.operation.localeCompare(second.operation)).map((scope) => ({
+      operation: scope.operation,
+      resourceIdentity: ledger.digestIdentity("resource", scope.resourceIdentity)
+    }));
+  }
   function writeStartResult(output, result) {
     if (!isRecord7(output))
       return;
+    const existingMetadata = isRecord7(output.metadata) ? output.metadata : {};
     if (result.status === "started") {
       output.title = "Workflow unit started";
       output.output = JSON.stringify({ status: "started" });
       output.metadata = {
+        ...existingMetadata,
         ...metadata2(),
         workflowGuard: { status: "started" }
       };
@@ -11452,6 +11591,7 @@ function createSessionRuntime(options) {
       reasonCode
     });
     output.metadata = {
+      ...existingMetadata,
       ...metadata2(),
       workflowGuard: {
         status: "rejected",
@@ -11783,7 +11923,7 @@ function createSessionRuntime(options) {
         unitId: status.unit.unitId,
         family: status.epoch.family,
         requiredOperations: status.unit.requiredOperations,
-        resourceScopes: [],
+        resourceScopes: progressionResourceScopes(status.unit),
         state: "started",
         transitionDigest: ledger.digestIdentity("call", host.callID)
       }));
@@ -11840,7 +11980,7 @@ function createSessionRuntime(options) {
         unitId: unit.unitId,
         family: epoch.family,
         requiredOperations: unit.requiredOperations,
-        resourceScopes: [],
+        resourceScopes: progressionResourceScopes(unit),
         state: "started",
         transitionDigest: ledger.digestIdentity("call", host.callID)
       }));
@@ -12205,9 +12345,10 @@ function createSessionRuntime(options) {
     const marker = projectReceiptMintMarker(receipt, ledger.getSessionSalt());
     if (!marker)
       return;
+    const existing = output.metadata[SYSTEMATIC_WORKFLOW_RECEIPT_METADATA_KEY];
     output.metadata = {
       ...output.metadata,
-      [SYSTEMATIC_WORKFLOW_RECEIPT_METADATA_KEY]: marker
+      [SYSTEMATIC_WORKFLOW_RECEIPT_METADATA_KEY]: existing ? Array.isArray(existing) ? [...existing, marker] : [existing, marker] : marker
     };
   }
   function mergeProgressionMarker(output, marker) {

package/dist/lib/workflow-guard.d.ts

@@ -1,5 +1,6 @@
 import { type ReceiptClassifier } from './receipt-classifier.js';
 import type { ReceiptLedger, ReceiptOperation } from './receipt-ledger.js';
+import type { ReceiptResourceScope } from './receipt-readback.js';
 export type WorkflowMode = 'protected' | 'disabled' | 'unavailable';
 export type WorkflowState = 'protected' | 'waiting' | 'rejected' | 'disabled' | 'unavailable';
 export type RepairKind = 'fresh-readback' | 'rerun-operation' | 'question-attestation';
@@ -34,6 +35,12 @@ export interface UnitSnapshot {
     status: 'active' | 'completed';
     requiredOperations: readonly ReceiptOperation[];
     requiredResourceOperations: readonly ReceiptOperation[];
+    resourceScopes: readonly ReceiptResourceScope[];
+}
+export interface CurrentOperationContext {
+    readonly workspaceIdentity: string;
+    readonly repositoryIdentity?: string;
+    readonly worktreeIdentity?: string;
 }
 export interface WorkflowStatus {
     state: WorkflowState;
@@ -125,7 +132,14 @@ export interface WorkflowGuard {
     observeReceipt(input: unknown): EvidenceObservationResult;
     observeAttempt(input: unknown): EvidenceObservationResult;
     observeOperation(input: unknown): Promise<EvidenceObservationResult>;
+    /**
+     * Internal recovery seam. Callers MUST validate host lineage, own
+     * registration/seed/readback, stable workspace, and current mutable
+     * revisions before using this classifier-bypassing path.
+     */
+    observeTrustedRecoveredOperation(input: unknown): Promise<EvidenceObservationResult>;
     observeReadback(input: unknown): ReadbackObservationResult;
+    currentOperationContext(): CurrentOperationContext;
     status(): WorkflowStatus;
     prepareTransition(input: unknown): TransitionPrepareResult;
     finalizeTransition(input: unknown): TransitionFinalizeResult;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fro.bot/systematic",
-  "version": "3.5.0",
+  "version": "3.5.1",
   "description": "Compound-engineering loops for OpenCode, Pi, and Claude Code",
   "type": "module",
   "homepage": "https://fro.bot/systematic",
@@ -90,10 +90,10 @@
     }
   },
   "devDependencies": {
-    "@biomejs/biome": "2.5.5",
+    "@biomejs/biome": "2.5.6",
     "@earendil-works/pi-coding-agent": "0.80.10",
-    "@opencode-ai/plugin": "1.18.6",
-    "@opencode-ai/sdk": "1.18.6",
+    "@opencode-ai/plugin": "1.18.8",
+    "@opencode-ai/sdk": "1.18.8",
     "@semantic-release/exec": "7.1.0",
     "@tintinweb/pi-subagents": "0.14.3",
     "@types/bun": "latest",