@gajae-code/coding-agent 0.15.2 → 0.15.4

package/src/coordinator-mcp/question-state.ts

@@ -287,18 +287,51 @@ export interface CreationRequestV1 {
 	key_digest: string;
 	request_digest: string;
 	tool: string;
-	phase: "claimed" | "remote_started" | "wal_committed" | "projected" | "completed" | "uncertain";
+	phase: "claimed" | "remote_started" | "wal_committed" | "projected" | "completed" | "uncertain" | "retired";
 	canonical_create_intent: CanonicalCreateIntentV1 | null;
 	remote_create_key: string;
 	session_id: string | null;
 	endpoint_incarnation: string | null;
 	sidecar_verifier: { key_id: string; public_key: string } | null;
+	/** Retirement is staged before the broker effect so a post-effect crash can replay safely. */
+	retirement_intent?: CreationRetirementIntentV1;
 	wal_revision?: number;
 	wal_digest?: string;
 	safe_response?: Record<string, unknown>;
 	created_at: string;
 	updated_at: string;
 }
+export interface CreationRetirementProofV1 {
+	session_id: string;
+	cwd: string;
+	state_root: string;
+	endpoint_generation: number;
+	endpoint_mtime_ms: number;
+	process_incarnation: string;
+	host_incarnation: string;
+	lifecycle_request_id: string;
+	remote_create_key: string;
+}
+export interface CreationRetirementBrokerProofV1 {
+	session_id: string;
+	retired: true;
+	ledger_state: "terminal_error";
+	index_type: "session_closed";
+	state_root: string;
+	endpoint_generation: number;
+	endpoint_mtime_ms: number;
+	process_incarnation: string;
+	host_incarnation: string;
+	lifecycle_request_id: string;
+	remote_create_key: string;
+}
+export interface CreationRetirementIntentV1 {
+	phase: "intent" | "pre_effect_rejected" | "broker_retired";
+	proof: CreationRetirementProofV1;
+	retirement_key_digest?: string;
+	broker_proof?: CreationRetirementBrokerProofV1;
+	updated_at: string;
+}
 export interface NamespaceDeletionEntryV1 {
 	deletion_id: string;
 	session_id: string;
@@ -2395,21 +2428,219 @@ export async function repairProjections(
 	});
 }
 
+function sameCreationRetirementProof(left: CreationRetirementProofV1, right: CreationRetirementProofV1): boolean {
+	return canonicalJson(left) === canonicalJson(right);
+}
+
+function assertCreationRetirementProofMatches(
+	request: CreationRequestV1,
+	proof: CreationRetirementProofV1,
+	includeStaged = true,
+): void {
+	if (
+		!proof.session_id ||
+		!proof.cwd ||
+		!proof.state_root ||
+		!Number.isSafeInteger(proof.endpoint_generation) ||
+		proof.endpoint_generation <= 0 ||
+		!Number.isFinite(proof.endpoint_mtime_ms) ||
+		proof.endpoint_mtime_ms <= 0 ||
+		!proof.process_incarnation ||
+		!proof.host_incarnation ||
+		!proof.lifecycle_request_id ||
+		!proof.remote_create_key
+	)
+		throw new Error("invalid_input");
+	if (request.remote_create_key !== proof.remote_create_key) throw new Error("idempotency_conflict");
+	if (request.session_id !== null && request.session_id !== proof.session_id) throw new Error("idempotency_conflict");
+	const intent = request.canonical_create_intent;
+	if (intent) {
+		const session = intent.session;
+		if (
+			session.session_id !== proof.session_id ||
+			path.resolve(session.cwd) !== path.resolve(proof.cwd) ||
+			path.resolve(session.cwd, ".gjc", "state") !== path.resolve(proof.state_root) ||
+			session.broker.endpoint_generation !== proof.endpoint_generation ||
+			intent.kind === "register" ||
+			intent.remote_create_key !== proof.remote_create_key
+		)
+			throw new Error("idempotency_conflict");
+	}
+	const staged = includeStaged ? request.retirement_intent : undefined;
+	if (staged && !sameCreationRetirementProof(staged.proof, proof)) throw new Error("idempotency_conflict");
+}
+
+/** Claims retirement under the creation receipt before any broker effect. */
+export async function recordCreationRetirementIntent(
+	paths: CoordinatorStatePaths,
+	keyDigest: string,
+	proof: CreationRetirementProofV1,
+	retirementKeyDigest?: string,
+): Promise<CreationRequestV1> {
+	return await withNamespaceRegistry(paths, async registry => {
+		const request = registry.creations[keyDigest];
+		if (!request) throw new Error("state_corrupt");
+		if (request.phase !== "remote_started" && request.phase !== "uncertain" && request.phase !== "retired")
+			throw new Error("retire_not_allowed");
+		assertCreationRetirementProofMatches(request, proof, request.retirement_intent?.phase !== "pre_effect_rejected");
+		if (
+			request.retirement_intent?.phase !== "pre_effect_rejected" &&
+			retirementKeyDigest &&
+			request.retirement_intent?.retirement_key_digest &&
+			request.retirement_intent.retirement_key_digest !== retirementKeyDigest
+		)
+			throw new Error("idempotency_conflict");
+		if (!request.retirement_intent) {
+			request.retirement_intent = {
+				phase: "intent",
+				proof,
+				...(retirementKeyDigest ? { retirement_key_digest: retirementKeyDigest } : {}),
+				updated_at: new Date().toISOString(),
+			};
+			request.updated_at = new Date().toISOString();
+		} else if (request.retirement_intent.phase === "pre_effect_rejected") {
+			request.retirement_intent.phase = "intent";
+			request.retirement_intent.proof = proof;
+			if (retirementKeyDigest) request.retirement_intent.retirement_key_digest = retirementKeyDigest;
+			request.retirement_intent.updated_at = new Date().toISOString();
+			request.updated_at = request.retirement_intent.updated_at;
+		} else if (retirementKeyDigest && !request.retirement_intent.retirement_key_digest) {
+			request.retirement_intent.retirement_key_digest = retirementKeyDigest;
+			request.retirement_intent.updated_at = new Date().toISOString();
+			request.updated_at = new Date().toISOString();
+		}
+		return request;
+	});
+}
+
+/** Replaces only a pre-effect retirement proof after an explicit broker rejection. */
+export async function replaceCreationRetirementIntent(
+	paths: CoordinatorStatePaths,
+	keyDigest: string,
+	proof: CreationRetirementProofV1,
+	retirementKeyDigest: string,
+): Promise<CreationRequestV1> {
+	return await withNamespaceRegistry(paths, async registry => {
+		const request = registry.creations[keyDigest];
+		if (!request) throw new Error("state_corrupt");
+		if (request.phase !== "remote_started" && request.phase !== "uncertain" && request.phase !== "retired")
+			throw new Error("retire_not_allowed");
+		const staged = request.retirement_intent;
+		if (!staged || staged.phase !== "intent" || staged.broker_proof) throw new Error("state_corrupt");
+		if (staged.retirement_key_digest !== retirementKeyDigest) throw new Error("idempotency_conflict");
+		assertCreationRetirementProofMatches(request, proof, false);
+		staged.phase = "pre_effect_rejected";
+		staged.updated_at = new Date().toISOString();
+		request.updated_at = staged.updated_at;
+		return request;
+	});
+}
+
+/** Records the bounded broker proof before receipt advancement or idempotency sealing. */
+export async function recordCreationRetirementBrokerProof(
+	paths: CoordinatorStatePaths,
+	keyDigest: string,
+	proof: CreationRetirementProofV1,
+	brokerProof: CreationRetirementBrokerProofV1,
+): Promise<CreationRequestV1> {
+	return await withNamespaceRegistry(paths, async registry => {
+		const request = registry.creations[keyDigest];
+		if (!request) throw new Error("state_corrupt");
+		if (request.phase !== "remote_started" && request.phase !== "uncertain" && request.phase !== "retired")
+			throw new Error("retire_not_allowed");
+		assertCreationRetirementProofMatches(request, proof);
+		if (
+			brokerProof.session_id !== proof.session_id ||
+			brokerProof.state_root !== proof.state_root ||
+			brokerProof.endpoint_generation !== proof.endpoint_generation ||
+			brokerProof.endpoint_mtime_ms !== proof.endpoint_mtime_ms ||
+			brokerProof.process_incarnation !== proof.process_incarnation ||
+			brokerProof.host_incarnation !== proof.host_incarnation ||
+			brokerProof.lifecycle_request_id !== proof.lifecycle_request_id ||
+			brokerProof.remote_create_key !== proof.remote_create_key ||
+			brokerProof.retired !== true ||
+			brokerProof.ledger_state !== "terminal_error" ||
+			brokerProof.index_type !== "session_closed"
+		)
+			throw new Error("protocol_error");
+		const staged = request.retirement_intent;
+		if (staged?.broker_proof) {
+			if (canonicalJson(staged.broker_proof) !== canonicalJson(brokerProof)) throw new Error("state_corrupt");
+			return request;
+		}
+		if (!staged) {
+			request.retirement_intent = {
+				phase: "broker_retired",
+				proof,
+				broker_proof: brokerProof,
+				updated_at: new Date().toISOString(),
+			};
+		} else {
+			staged.phase = "broker_retired";
+			staged.broker_proof = brokerProof;
+			staged.updated_at = new Date().toISOString();
+		}
+		request.updated_at = new Date().toISOString();
+		return request;
+	});
+}
+
 /** Advances a creation receipt only after its WAL or projection authority exists. */
+export async function assertCreationRetirementIdentity(
+	paths: CoordinatorStatePaths,
+	keyDigest: string,
+	proof: CreationRetirementProofV1,
+): Promise<CreationRequestV1> {
+	return await withNamespaceRegistry(paths, async registry => {
+		const request = registry.creations[keyDigest];
+		if (!request) throw new Error("state_corrupt");
+		if (request.phase !== "remote_started" && request.phase !== "uncertain" && request.phase !== "retired")
+			throw new Error("retire_not_allowed");
+		assertCreationRetirementProofMatches(request, proof, request.retirement_intent?.phase !== "pre_effect_rejected");
+		return request;
+	});
+}
+
 export async function advanceCreationReceipt(
 	paths: CoordinatorStatePaths,
 	keyDigest: string,
-	phase: "projected" | "completed" | "uncertain",
+	phase: "projected" | "completed" | "uncertain" | "retired",
 	safeResponse?: Record<string, unknown>,
+	proof?: CreationRetirementProofV1,
 ): Promise<void> {
 	await withNamespaceRegistry(paths, async registry => {
 		const request = registry.creations[keyDigest];
 		if (!request) throw new Error("state_corrupt");
-		if (request.phase === phase) return;
-		if (phase !== "uncertain" && request.phase !== "wal_committed" && request.phase !== "projected")
+		if (proof) assertCreationRetirementProofMatches(request, proof);
+		if (request.phase === phase) {
+			if (phase === "retired" && safeResponse) {
+				request.safe_response = safeResponse;
+				if (request.retirement_intent) request.retirement_intent.updated_at = new Date().toISOString();
+				request.updated_at = new Date().toISOString();
+			}
+			return;
+		}
+		if (
+			phase === "retired" &&
+			(request.phase === "completed" || request.phase === "retired" || request.phase === "claimed")
+		)
+			throw new Error("state_corrupt");
+		if (
+			phase !== "uncertain" &&
+			phase !== "retired" &&
+			request.phase !== "wal_committed" &&
+			request.phase !== "projected"
+		)
 			throw new Error("state_corrupt");
 		request.phase = phase;
 		request.safe_response = safeResponse;
+		if (phase === "retired" && proof && !request.retirement_intent) {
+			request.retirement_intent = {
+				phase: "intent",
+				proof,
+				updated_at: new Date().toISOString(),
+			};
+		}
 		request.updated_at = new Date().toISOString();
 	});
 }