@fro.bot/systematic 3.5.4 → 3.5.6

package/dist/lib/opencode-operation-observer.d.ts

@@ -1,4 +1,24 @@
 export type OperationObserverReasonCode = 'target-unavailable' | 'command-failed' | 'command-timeout' | 'command-output-limit' | 'file-limit' | 'file-output-limit' | 'file-read-failed' | 'remote-command-failed' | 'remote-command-output-limit' | 'remote-invalid-json' | 'remote-missing-field' | 'remote-item-limit' | 'remote-not-advanced' | 'commit-not-closed';
+export interface RegisteredWorktreeParentIdentity {
+    readonly targetRoot: string;
+    readonly gitDir: string;
+    readonly commonDir: string;
+    readonly registeredWorktreeRoots: readonly string[];
+}
+export interface RegisteredWorktreeValidationOptions {
+    readonly commandRunner?: OperationObserverCommandRunner;
+    readonly limits?: OperationObserverLimits;
+    readonly realPath?: (filePath: string) => string;
+}
+export type RegisteredWorktreeValidationResult = {
+    readonly status: 'ok';
+    readonly targetRoot: string;
+    readonly gitDir: string;
+    readonly commonDir: string;
+} | {
+    readonly status: 'error';
+    readonly reasonCode: OperationObserverReasonCode;
+};
 export type RemoteOperation = 'push' | 'pr-creation' | 'check-readback' | 'review-readback';
 export type RemoteReadbackPhase = 'before' | 'after';
 export interface OperationObserverSnapshot {
@@ -73,7 +93,9 @@ export interface OpencodeOperationObserverOptions {
 }
 export interface OpencodeOperationObserver {
     readonly targetDigest: string;
+    validateRegisteredWorktree(candidateDirectory: string): RegisteredWorktreeValidationResult;
     snapshot(): Promise<OperationObserverResult>;
     remoteSnapshot?(operation: RemoteOperation, phase: RemoteReadbackPhase): Promise<OperationObserverRemoteResult>;
 }
+export declare function validateRegisteredWorktree(candidateDirectory: string, parentIdentity: RegisteredWorktreeParentIdentity, options?: RegisteredWorktreeValidationOptions): RegisteredWorktreeValidationResult;
 export declare function createOpencodeOperationObserver(options: OpencodeOperationObserverOptions): OpencodeOperationObserver;

package/dist/lib/opencode-workflow-guard.d.ts

@@ -1,5 +1,5 @@
 import type { ToolDefinition } from '@opencode-ai/plugin';
-import type { OpencodeOperationObserver } from './opencode-operation-observer.js';
+import type { OpencodeOperationObserver, RegisteredWorktreeValidationResult } from './opencode-operation-observer.js';
 import type { ReceiptClassifier } from './receipt-classifier.js';
 import { type ReceiptLedger, type ReceiptOperation } from './receipt-ledger.js';
 import { type EvidenceObservationResult, type RuntimeUnitPolicy, type TransitionPrepareResult, type WorkflowReasonCode, type WorkflowStatus } from './workflow-guard.js';
@@ -26,6 +26,8 @@ export interface OpencodeWorkflowGuardOptions {
     hostReadback?: OpencodeWorkflowHostReadback;
     readonly registrationIdentity?: string;
     readonly sessionSalt?: Uint8Array;
+    readonly targetDirectory?: string;
+    readonly sessionLocation?: string;
 }
 export interface OpencodeWorkflowChildSession {
     readonly sessionId: string;
@@ -50,5 +52,20 @@ export interface OpencodeWorkflowGuard {
     prepareTransition(sessionID: unknown, input: unknown): TransitionPrepareResult;
     startUnit(sessionID: unknown, input: unknown, policy?: RuntimeUnitPolicy): unknown;
 }
+export type LocalOperationTool = 'write' | 'edit' | 'apply_patch' | 'bash';
+export interface OpencodeOperationTargetDerivationOptions {
+    readonly parentTargetRoot: string;
+    readonly sessionLocation?: string;
+    readonly validateRegisteredWorktree: (candidateDirectory: string) => RegisteredWorktreeValidationResult;
+    readonly realPath?: (filePath: string) => string;
+}
+export type OpencodeOperationTargetDerivationResult = {
+    readonly status: 'available';
+    readonly targetRoot: string;
+} | {
+    readonly status: 'unavailable';
+    readonly reasonCode: 'target-unavailable';
+};
+export declare function deriveOpencodeOperationTarget(tool: LocalOperationTool, args: unknown, options: OpencodeOperationTargetDerivationOptions): OpencodeOperationTargetDerivationResult;
 export declare function createOpencodeWorkflowGuard(options: OpencodeWorkflowGuardOptions): OpencodeWorkflowGuard;
 export {};

package/dist/lib/receipt-ledger.d.ts

@@ -1,6 +1,8 @@
 import type { ReceiptDigestDomain, ReceiptReadbackFailureCategory, ReceiptReadbackProgression } from './receipt-readback.js';
-export declare const RECEIPT_SCHEMA_VERSION: 1;
-export declare const RECEIPT_PROTOCOL_VERSION: 1;
+export declare const RECEIPT_SCHEMA_VERSION: 2;
+export declare const RECEIPT_PROTOCOL_VERSION: 2;
+declare const LEGACY_RECEIPT_SCHEMA_VERSION: 1;
+declare const LEGACY_RECEIPT_PROTOCOL_VERSION: 1;
 export type ReceiptOperation = 'implementation' | 'verification' | 'commit' | 'push' | 'pr-creation' | 'check-readback' | 'review-readback';
 export type ReceiptClassificationOutcome = 'accepted' | 'rejected' | 'unavailable';
 export type ReceiptAttribution = 'runtime-verified' | 'unattributed';
@@ -24,12 +26,14 @@ export interface ReceiptContext {
     workspaceIdentity: string;
     repositoryIdentity?: string;
     worktreeIdentity?: string;
+    operationTargetIdentity?: string;
     resourceIdentity?: string;
 }
 export interface ReceiptObservationAfter {
     workspaceIdentity: string;
     repositoryIdentity?: string;
     worktreeIdentity?: string;
+    operationTargetIdentity?: string;
     resourceIdentity?: string;
 }
 export interface TerminalObservation {
@@ -57,6 +61,7 @@ export interface CanonicalReceiptFields {
     workspaceDigest: string;
     repositoryDigest?: string;
     worktreeDigest?: string;
+    operationTargetIdentity?: string;
     resourceDigest?: string;
     operation: ReceiptOperation;
     result: 'success';
@@ -65,8 +70,8 @@ export interface CanonicalReceiptFields {
     timestamp: number;
 }
 export interface ReceiptEnvelope {
-    schemaVersion: typeof RECEIPT_SCHEMA_VERSION;
-    protocolVersion: typeof RECEIPT_PROTOCOL_VERSION;
+    schemaVersion: typeof RECEIPT_SCHEMA_VERSION | typeof LEGACY_RECEIPT_SCHEMA_VERSION;
+    protocolVersion: typeof RECEIPT_PROTOCOL_VERSION | typeof LEGACY_RECEIPT_PROTOCOL_VERSION;
     registrationDigest: string;
     capabilityFlags: readonly string[];
     compatibility: 'compatible';
@@ -128,12 +133,14 @@ export interface ReceiptLedger {
     finalizeObservation(input: unknown): FinalizeObservationResult;
     abandonObservation(input: unknown): AbandonObservationResult;
     consumeReceipt(receiptId: unknown, context: unknown): ConsumeReceiptResult;
-    recoverReceipt(input: unknown): RecoverReceiptResult;
-    recoverReadback(input: readonly unknown[]): RecoverReadbackResult;
+    recoverReceipt(input: unknown, operationTargetIdentity?: string): RecoverReceiptResult;
+    recoverReadback(input: readonly unknown[], operationTargetIdentity?: string): RecoverReadbackResult;
     getProgressionState(): ReceiptReadbackProgression;
     validateEnvelope(input: unknown): EnvelopeValidationResult;
     getEnvelope(receiptId: unknown): ReceiptEnvelope | undefined;
     listReceipts(): readonly ReceiptEnvelope[];
     getSessionSalt(): Uint8Array;
 }
+export declare function isLocalOperation(operation: ReceiptOperation): operation is 'implementation' | 'verification' | 'commit';
 export declare function createReceiptLedger(options?: ReceiptLedgerOptions): ReceiptLedger;
+export {};

package/dist/lib/receipt-readback.d.ts

@@ -1,6 +1,8 @@
 import type { ReceiptEnvelope, ReceiptLedgerMetadata, ReceiptOperation } from './receipt-ledger.js';
-export declare const RECEIPT_READBACK_SCHEMA_VERSION: 1;
-export declare const RECEIPT_READBACK_PROTOCOL_VERSION: 1;
+export declare const RECEIPT_READBACK_SCHEMA_VERSION: 2;
+export declare const RECEIPT_READBACK_PROTOCOL_VERSION: 2;
+declare const LEGACY_RECEIPT_READBACK_SCHEMA_VERSION: 1;
+type ReceiptReadbackVersion = typeof RECEIPT_READBACK_SCHEMA_VERSION | typeof LEGACY_RECEIPT_READBACK_SCHEMA_VERSION;
 export type ReceiptDigestDomain = 'repository' | 'worktree' | 'resource' | 'workspace' | 'epoch' | 'unit' | 'call' | 'registration';
 export type ReceiptProgressionStateName = 'started' | 'completed';
 export type ReceiptEpochFamily = 'work' | 'shipping';
@@ -11,16 +13,16 @@ export interface ReceiptResourceScope {
 export type ReceiptReadbackFailureCategory = 'malformed' | 'forbidden-field' | 'unknown-kind' | 'unknown-schema' | 'unknown-protocol' | 'unknown-capability' | 'integrity-mismatch' | 'missing-mint' | 'control-before-mint' | 'conflicting-marker' | 'out-of-order' | 'cross-registration' | 'capability-mismatch' | 'salt-mismatch' | 'receipt-mismatch' | 'progression-mismatch' | 'inconsistent-evidence' | 'missing-internal-id' | 'identity-digest-mismatch' | 'conflicting-seed' | 'missing-seed';
 export interface ReceiptMintMarker {
     readonly kind: 'mint';
-    readonly schemaVersion: typeof RECEIPT_READBACK_SCHEMA_VERSION;
-    readonly protocolVersion: typeof RECEIPT_READBACK_PROTOCOL_VERSION;
+    readonly schemaVersion: ReceiptReadbackVersion;
+    readonly protocolVersion: ReceiptReadbackVersion;
     readonly envelope: ReceiptEnvelope;
     readonly sessionSalt: string;
     readonly integrity: string;
 }
 export interface ReceiptConsumeMarker {
     readonly kind: 'control';
-    readonly schemaVersion: typeof RECEIPT_READBACK_SCHEMA_VERSION;
-    readonly protocolVersion: typeof RECEIPT_READBACK_PROTOCOL_VERSION;
+    readonly schemaVersion: ReceiptReadbackVersion;
+    readonly protocolVersion: ReceiptReadbackVersion;
     readonly registrationDigest: string;
     readonly capabilityFlags: readonly string[];
     readonly control: 'consume';
@@ -31,8 +33,8 @@ export interface ReceiptConsumeMarker {
 }
 export interface ReceiptEpochProgressionMarker {
     readonly kind: 'control';
-    readonly schemaVersion: typeof RECEIPT_READBACK_SCHEMA_VERSION;
-    readonly protocolVersion: typeof RECEIPT_READBACK_PROTOCOL_VERSION;
+    readonly schemaVersion: ReceiptReadbackVersion;
+    readonly protocolVersion: ReceiptReadbackVersion;
     readonly registrationDigest: string;
     readonly capabilityFlags: readonly string[];
     readonly control: 'progression';
@@ -48,8 +50,8 @@ export interface ReceiptEpochProgressionMarker {
 }
 export interface ReceiptUnitProgressionMarker {
     readonly kind: 'control';
-    readonly schemaVersion: typeof RECEIPT_READBACK_SCHEMA_VERSION;
-    readonly protocolVersion: typeof RECEIPT_READBACK_PROTOCOL_VERSION;
+    readonly schemaVersion: ReceiptReadbackVersion;
+    readonly protocolVersion: ReceiptReadbackVersion;
     readonly registrationDigest: string;
     readonly capabilityFlags: readonly string[];
     readonly control: 'progression';
@@ -61,6 +63,7 @@ export interface ReceiptUnitProgressionMarker {
     readonly family: ReceiptEpochFamily;
     readonly requiredOperations: readonly ReceiptOperation[];
     readonly resourceScopes: readonly ReceiptResourceScope[];
+    readonly pinnedOperationTargetIdentity?: string;
     readonly state: ReceiptProgressionStateName;
     readonly transitionDigest: string;
     readonly timestamp: number;
@@ -85,6 +88,7 @@ export type ReceiptProgressionMarkerInput = {
     readonly family: ReceiptEpochFamily;
     readonly requiredOperations: readonly ReceiptOperation[];
     readonly resourceScopes: readonly ReceiptResourceScope[];
+    readonly pinnedOperationTargetIdentity?: string;
     readonly transitionDigest: string;
     readonly timestamp?: number;
 };
@@ -98,6 +102,12 @@ export interface ReceiptReadbackExpectation {
     readonly capabilityFlags: readonly string[];
     readonly sessionSalt: Uint8Array;
     readonly source?: 'runtime-verified';
+    /**
+     * When present, legacy v1 mint markers are rejected because they cannot
+     * authenticate a foreign/worktree target. Absence retains the narrow v1
+     * parent-target recovery shim; callers must validate that parent separately.
+     */
+    readonly operationTargetIdentity?: string;
 }
 export type ReceiptEpochProgressionSnapshot = {
     readonly target: 'epoch';
@@ -117,6 +127,7 @@ export type ReceiptUnitProgressionSnapshot = {
     readonly family: ReceiptEpochFamily;
     readonly requiredOperations: readonly ReceiptOperation[];
     readonly resourceScopes: readonly ReceiptResourceScope[];
+    readonly pinnedOperationTargetIdentity?: string;
     readonly transitionDigest: string;
 };
 export type ReceiptProgressionSnapshot = ReceiptEpochProgressionSnapshot | ReceiptUnitProgressionSnapshot;
@@ -171,4 +182,5 @@ export declare function projectReceiptMintMarker(receipt: unknown, sessionSalt:
 export declare function projectReceiptConsumptionMarker(receipt: unknown, transitionDigest: string, timestamp?: number): ReceiptConsumeMarker | undefined;
 export declare function projectReceiptProgressionMarker(source: ReceiptProgressionProjectionSource, input: ReceiptProgressionMarkerInput): ReceiptProgressionMarker | undefined;
 export declare function foldReceiptReadback(inputs: readonly unknown[], expectation: ReceiptReadbackExpectation): ReceiptReadbackResult;
-export declare function receiptReadbackExpectationFromMetadata(metadata: ReceiptLedgerMetadata, sessionSalt: Uint8Array): ReceiptReadbackExpectation;
+export declare function receiptReadbackExpectationFromMetadata(metadata: ReceiptLedgerMetadata, sessionSalt: Uint8Array, operationTargetIdentity?: string): ReceiptReadbackExpectation;
+export {};

package/dist/lib/workflow-guard.d.ts

@@ -6,7 +6,7 @@ export type WorkflowState = 'protected' | 'waiting' | 'rejected' | 'disabled' |
 export type RepairKind = 'fresh-readback' | 'rerun-operation' | 'question-attestation';
 export type TransitionTarget = 'unit' | 'epoch';
 export type EpochFamily = 'work' | 'shipping';
-export type WorkflowReasonCode = 'abandoned-transition' | 'call-context-conflict' | 'cancelled-operation' | 'consumed-receipt' | 'disabled' | 'epoch-completed' | 'epoch-mismatch' | 'failed-operation' | 'family-conflict' | 'finalization-failed' | 'foreign-registration' | 'forbidden-field' | 'guard-unavailable' | 'incompatible-receipt' | 'invalid-configuration' | 'invalid-control' | 'invalid-receipt' | 'invalid-transition' | 'missing-evidence' | 'no-supported-repair' | 'no-active-epoch' | 'no-active-unit' | 'no-op-operation' | 'operation-not-required' | 'receipt-mismatch' | 'rejected-operation' | 'resource-mismatch' | 'running-operation' | 'stale-receipt' | 'transition-finalized' | 'transition-terminal' | 'transition-replayed' | 'unattributed-operation' | 'unit-active' | 'unit-completed' | 'unit-incomplete' | 'unit-mismatch' | 'unit-ready' | 'workspace-mismatch' | 'runtime-scope-conflict' | 'invalid-recovery' | 'recovery-conflict' | 'fork-copy-not-lineage';
+export type WorkflowReasonCode = 'abandoned-transition' | 'call-context-conflict' | 'cancelled-operation' | 'consumed-receipt' | 'disabled' | 'epoch-completed' | 'epoch-mismatch' | 'failed-operation' | 'family-conflict' | 'finalization-failed' | 'foreign-registration' | 'forbidden-field' | 'guard-unavailable' | 'incompatible-receipt' | 'invalid-configuration' | 'invalid-control' | 'invalid-receipt' | 'invalid-transition' | 'missing-evidence' | 'no-supported-repair' | 'no-active-epoch' | 'no-active-unit' | 'no-op-operation' | 'operation-not-required' | 'operation-target-mismatch' | 'receipt-mismatch' | 'rejected-operation' | 'resource-mismatch' | 'running-operation' | 'stale-receipt' | 'transition-finalized' | 'transition-terminal' | 'transition-replayed' | 'unattributed-operation' | 'unit-active' | 'unit-completed' | 'unit-incomplete' | 'unit-mismatch' | 'unit-ready' | 'workspace-mismatch' | 'runtime-scope-conflict' | 'invalid-recovery' | 'recovery-conflict' | 'fork-copy-not-lineage';
 export interface WorkflowGuardOptions {
     ledger: ReceiptLedger;
     classifier?: ReceiptClassifier;
@@ -36,6 +36,7 @@ export interface UnitSnapshot {
     requiredOperations: readonly ReceiptOperation[];
     requiredResourceOperations: readonly ReceiptOperation[];
     resourceScopes: readonly ReceiptResourceScope[];
+    pinnedOperationTargetIdentity?: string;
 }
 export interface CurrentOperationContext {
     readonly workspaceIdentity: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fro.bot/systematic",
-  "version": "3.5.4",
+  "version": "3.5.6",
   "description": "Compound-engineering loops for OpenCode, Pi, and Claude Code",
   "type": "module",
   "homepage": "https://fro.bot/systematic",
@@ -93,8 +93,8 @@
   "devDependencies": {
     "@biomejs/biome": "2.5.6",
     "@earendil-works/pi-coding-agent": "0.80.10",
-    "@opencode-ai/plugin": "1.18.9",
-    "@opencode-ai/sdk": "1.18.9",
+    "@opencode-ai/plugin": "1.18.10",
+    "@opencode-ai/sdk": "1.18.10",
     "@semantic-release/exec": "7.1.0",
     "@tintinweb/pi-subagents": "0.14.3",
     "@types/bun": "latest",

package/skills/ce-review/references/subagent-template.md

@@ -17,6 +17,10 @@ You are a specialist code reviewer.
 {diff_scope_rules}
 </scope-rules>
 
+<bounded-investigation>
+The supplied diff is the primary source of truth. Use the supplied paths and line numbers, and read each unresolved surrounding range or symbol once. Re-read only when a concrete ambiguity remains or the file changed since the prior read. Stop and return a finding or verdict once the evidence is sufficient. If evidence cannot be obtained within this bounded pass, return an explicit blocker or residual risk instead of broadening the investigation indefinitely.
+</bounded-investigation>
+
 <output-contract>
 You produce up to two outputs depending on whether a run ID was provided: