@hilbras/omninode 2.0.0-alpha.8 → 2.0.0-alpha.9

package/README.md

@@ -18,9 +18,9 @@ existing intelligence; it does not try to become another model.
 
 ## Status
 
-**v2.0.0-alpha.8 — v2 Phase 8: Remembera Integration v2**
+**v2.0.0-alpha.9 — v2 Phase 9: Report System v2**
 (the reliability & interoperability line: architecture → execution →
-protocol → adapters → pipelines → providers → OmniHilbras → memory) (the v2
+protocol → adapters → pipelines → providers → OmniHilbras → memory → reports) (the v2
 roadmap is [docs/ROADMAP_V2.md](docs/ROADMAP_V2.md); the v1 plan is complete:
 the
 full loop from §28 runs in one command —
@@ -31,6 +31,13 @@ for the plan and [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md) for the design).
 
 ### What's new in v2 (so far)
 
+- **Phase 9 — Report System v2**: reports are validated machine-readable
+  objects — `validateReport()` runs on everything entering the system and
+  malformed reports are rejected with diagnostics instead of poisoning
+  aggregation. Findings gain description/confidence/source/recommendation,
+  evidence is typed (`file`, `line`, `url`, `command`, `observation`,
+  `artifact`), and reports carry artifacts and run provenance.
+  Details: [REPORTS.md](docs/REPORTS.md).
 - **Phase 8 — Remembera / Memory v2**: the memory contract is formalized
   (`retrieve` / `store` / `search` / `metadata` with v1 `query` / `write`
   aliases kept working), memory gains structured **categories** (decisions,
@@ -339,7 +346,7 @@ required for the core engine.
 - [Architecture](docs/ARCHITECTURE.md) — module map, workflow, local state
 - [Security model](docs/SECURITY.md) — secrets, process execution, env isolation, audit log
 - [API stability policy](docs/API_STABILITY.md) and [public API inventory](docs/API.md)
-- [Agent Protocol v2 spec](docs/PROTOCOL.md) · [Providers](docs/PROVIDERS.md) · [Memory](docs/MEMORY.md) · [Deprecations](docs/DEPRECATIONS.md) · [Changelog](CHANGELOG.md) · [v2 roadmap](docs/ROADMAP_V2.md)
+- [Agent Protocol v2 spec](docs/PROTOCOL.md) · [Providers](docs/PROVIDERS.md) · [Memory](docs/MEMORY.md) · [Reports](docs/REPORTS.md) · [Deprecations](docs/DEPRECATIONS.md) · [Changelog](CHANGELOG.md) · [v2 roadmap](docs/ROADMAP_V2.md)
 - [Example project](examples/demo/) — a runnable end-to-end demo (`./demo.sh`)
 
 Prefer a container? `docker build -t omninode .` then

package/dist/cli/index.js

@@ -6,7 +6,7 @@ import { realpathSync } from "fs";
 import { Command } from "commander";
 
 // src/version.ts
-var OMNINODE_VERSION = "2.0.0-alpha.8";
+var OMNINODE_VERSION = "2.0.0-alpha.9";
 
 // src/errors/index.ts
 var OmniNodeError = class extends Error {
@@ -2997,6 +2997,84 @@ function truncate2(text, max) {
 
 // src/reports/aggregate.ts
 import { randomBytes as randomBytes2 } from "crypto";
+
+// src/reports/schema.ts
+import { z as z2 } from "zod";
+var evidenceSchema = z2.union([
+  z2.string().transform((excerpt) => ({ kind: "observation", excerpt })),
+  z2.object({
+    kind: z2.enum(["file", "line", "url", "command", "observation", "artifact"]),
+    ref: z2.string().optional(),
+    line: z2.number().int().optional(),
+    excerpt: z2.string().optional(),
+    agent: z2.string().optional()
+  })
+]);
+var findingSchema = z2.object({
+  id: z2.string().min(1),
+  title: z2.string().min(1),
+  detail: z2.string().default(""),
+  description: z2.string().optional(),
+  severity: z2.enum(["info", "low", "medium", "high", "critical"]).optional(),
+  confidence: z2.enum(["low", "medium", "high"]).optional(),
+  evidence: z2.array(evidenceSchema).optional(),
+  location: z2.string().optional(),
+  tags: z2.array(z2.string()).optional(),
+  source: z2.object({ agent: z2.string().optional(), reportId: z2.string().optional(), pipelineRunId: z2.string().optional() }).optional(),
+  recommendation: z2.string().optional()
+});
+var artifactSchema = z2.object({
+  kind: z2.enum(["file", "patch", "log", "screenshot", "document", "data"]),
+  ref: z2.string().min(1),
+  description: z2.string().optional(),
+  mediaType: z2.string().optional(),
+  bytes: z2.number().int().optional()
+});
+var reportSchema = z2.object({
+  id: z2.string().min(1),
+  taskId: z2.string().min(1),
+  agent: z2.string().min(1),
+  agentId: z2.string().optional(),
+  pipelineRunId: z2.string().optional(),
+  model: z2.string().optional(),
+  summary: z2.string(),
+  findings: z2.array(findingSchema),
+  recommendations: z2.array(z2.string()),
+  confidence: z2.enum(["low", "medium", "high"]).optional(),
+  evidence: z2.array(evidenceSchema).optional(),
+  artifacts: z2.array(artifactSchema).optional(),
+  createdAt: z2.string().min(1),
+  metadata: z2.record(z2.unknown()).optional()
+});
+function validateReport(value) {
+  const parsed = reportSchema.safeParse(value);
+  if (!parsed.success) {
+    const issues = parsed.error.issues.map((issue) => ({
+      path: issue.path.join(".") || "(root)",
+      message: issue.message
+    }));
+    return {
+      valid: false,
+      issues,
+      reason: `report failed schema validation (${issues.length} issue(s))`
+    };
+  }
+  const report = parsed.data;
+  report.findings = report.findings.map((finding) => ({
+    ...finding,
+    description: finding.description ?? finding.detail,
+    ...finding.source === void 0 ? { source: { agent: report.agent, reportId: report.id, ...report.pipelineRunId !== void 0 ? { pipelineRunId: report.pipelineRunId } : {} } } : {}
+  }));
+  return { valid: true, report };
+}
+function normalizeEvidence(input) {
+  if (input === void 0) return void 0;
+  return input.map(
+    (item) => typeof item === "string" ? { kind: "observation", excerpt: item } : item
+  );
+}
+
+// src/reports/aggregate.ts
 var SEVERITY_RANK = {
   info: 0,
   low: 1,
@@ -3043,7 +3121,7 @@ function mergeFinding(groups, finding, report, threshold) {
     group.occurrences += 1;
     group.details.push(finding.detail);
     group.sources.push(source);
-    group.evidence.push(...finding.evidence ?? []);
+    group.evidence.push(...normalizeEvidence(finding.evidence) ?? []);
     if (finding.severity && (!group.severity || SEVERITY_RANK[finding.severity] > SEVERITY_RANK[group.severity])) {
       group.severity = finding.severity;
     }
@@ -3055,7 +3133,7 @@ function mergeFinding(groups, finding, report, threshold) {
     sources: [source],
     occurrences: 1,
     ...finding.severity ? { severity: finding.severity } : {},
-    evidence: [...finding.evidence ?? []]
+    evidence: [...normalizeEvidence(finding.evidence) ?? []]
   });
 }
 function mergeRecommendation(groups, text, report, threshold) {
@@ -3137,6 +3215,7 @@ function extractReportFromText(raw, meta) {
     id: `${meta.taskId}-f-${index + 1}`,
     title: truncate4(text, 120),
     detail: text,
+    description: text,
     severity: guessSeverity(text)
   }));
   return {
@@ -3147,7 +3226,8 @@ function extractReportFromText(raw, meta) {
     summary,
     findings,
     recommendations: recommendationTexts.map((t) => truncate4(t, 200)),
-    metadata: evidenceTexts.length > 0 ? { evidence: evidenceTexts } : void 0,
+    ...evidenceTexts.length > 0 ? { evidence: evidenceTexts.map((excerpt) => ({ kind: "observation", excerpt })) } : {},
+    metadata: evidenceTexts.length > 0 ? { evidenceCount: evidenceTexts.length } : void 0,
     createdAt: (/* @__PURE__ */ new Date()).toISOString()
   };
 }
@@ -3163,27 +3243,46 @@ var ReportService = class {
   }
   store;
   log;
+  /** Rejected reports from the last collection (§13 — malformed never enters aggregation). */
+  lastDiagnostics = { collected: 0, accepted: 0, rejected: [] };
   get storeRef() {
     return this.store;
   }
-  /** Normalizes finished tasks into reports (§17 — normalizer). */
+  /** Normalizes finished tasks into reports (§17 — normalizer), validating each
+   *  one so malformed reports never reach aggregation (§13). */
   async collectFromTasks(tasks) {
-    const reports = [];
+    const candidates = [];
     for (const task of tasks) {
       const structured = task.result?.reports ?? [];
       if (structured.length > 0) {
-        reports.push(...structured);
+        candidates.push(...structured);
         continue;
       }
       const text = task.result?.rawOutput ?? task.result?.summary ?? "";
       if (text.trim().length === 0) continue;
-      reports.push(
+      candidates.push(
         extractReportFromText(text, {
           taskId: task.id,
           agent: task.agent ?? "unknown"
         })
       );
     }
+    const reports = [];
+    const rejected = [];
+    for (const candidate of candidates) {
+      const result = validateReport(candidate);
+      if (result.valid) {
+        reports.push(result.report);
+      } else {
+        rejected.push({
+          key: candidate?.id ?? "(unknown)",
+          reason: result.reason,
+          issues: result.issues.map((issue) => `${issue.path}: ${issue.message}`)
+        });
+        this.log.warn(`Rejected malformed report: ${result.reason}`);
+      }
+    }
+    this.lastDiagnostics = { collected: candidates.length, accepted: reports.length, rejected };
     return reports;
   }
   async saveReports(reports) {
@@ -3403,7 +3502,7 @@ function truncate5(text, max) {
 
 // src/planner/model.ts
 import { randomBytes as randomBytes4 } from "crypto";
-import { z as z2 } from "zod";
+import { z as z3 } from "zod";
 
 // src/planner/context.ts
 function buildPlannerContext(request) {
@@ -3456,21 +3555,21 @@ ${request.context}`);
 }
 
 // src/planner/model.ts
-var planStepJsonSchema = z2.object({
-  id: z2.string().optional(),
-  title: z2.string().min(1),
-  description: z2.string().optional(),
-  order: z2.number().int().optional(),
-  targets: z2.array(z2.string()).optional(),
-  acceptance_criteria: z2.array(z2.string()).optional(),
-  depends_on: z2.array(z2.string()).optional(),
-  source_findings: z2.array(z2.string()).optional()
+var planStepJsonSchema = z3.object({
+  id: z3.string().optional(),
+  title: z3.string().min(1),
+  description: z3.string().optional(),
+  order: z3.number().int().optional(),
+  targets: z3.array(z3.string()).optional(),
+  acceptance_criteria: z3.array(z3.string()).optional(),
+  depends_on: z3.array(z3.string()).optional(),
+  source_findings: z3.array(z3.string()).optional()
 }).strict();
-var planJsonSchema = z2.object({
-  summary: z2.string().min(1),
-  steps: z2.array(planStepJsonSchema).min(1),
-  risks: z2.array(z2.string()).optional(),
-  notes: z2.array(z2.string()).optional()
+var planJsonSchema = z3.object({
+  summary: z3.string().min(1),
+  steps: z3.array(planStepJsonSchema).min(1),
+  risks: z3.array(z3.string()).optional(),
+  notes: z3.array(z3.string()).optional()
 }).strict();
 var ModelPlanner = class {
   constructor(options) {