@inerrata-corporation/errata 2.0.0-dev.75 → 2.0.0-dev.77

package/consolidate-worker.mjs

@@ -53,7 +53,18 @@ var init_castalia = __esm({
       "OperatingSystem",
       "Paradigm",
       "DataStructure",
-      "AgentModel"
+      "AgentModel",
+      // An OPAQUE anchor identity in a project's stratum (PJ-anchors · plan §6c).
+      // Deliberately NOT one of the CODE_NODE_LABELS below — those are the local code
+      // graph and never cross. A cloud `Symbol` carries the salted `sym_` id and a
+      // coarse `kind`, and NOTHING ELSE: no path, no qualified name. It exists so two
+      // teammates' knowledge about the same function lands on one node; the cloud
+      // learns THAT they concern the same symbol, never WHICH symbol.
+      //
+      // Project-stratum only. The ingest door rejects a `Symbol` node — and any
+      // ANCHORED_AT edge — on a batch that carries no verified projectId, so the
+      // org/team/public lanes can never acquire one by accident.
+      "Symbol"
     ];
     CODE_NODE_LABELS = [
       "File",
@@ -15123,7 +15134,7 @@ var init_symbol_intent = __esm({
 });
 
 // ../../packages/shared/src/wire.ts
-var CLOUD_NODE_LABELS, CLOUD_WRITABLE_NODE_LABELS, CLOUD_WRITABLE_NODE_LABEL_SET, CLOUD_EDGE_TYPES, INGEST_SOURCES, INGEST_EXTRACTION_SOURCES, CastaliaIngestNodeSchema, RouteContextCountWireSchema, CastaliaIngestEdgeSchema, SymbolSummarySidecarSchema, CastaliaIngestPayloadSchema;
+var CLOUD_NODE_LABELS, CLOUD_WRITABLE_NODE_LABELS, PROJECT_ONLY_NODE_LABELS, PROJECT_ONLY_NODE_LABEL_SET, PROJECT_ONLY_EDGE_TYPES, PROJECT_ONLY_EDGE_TYPE_SET, CLOUD_WRITABLE_NODE_LABEL_SET, CLOUD_EDGE_TYPES, INGEST_SOURCES, INGEST_EXTRACTION_SOURCES, CastaliaIngestNodeSchema, RouteContextCountWireSchema, CastaliaIngestEdgeSchema, SymbolSummarySidecarSchema, CastaliaIngestPayloadSchema;
 var init_wire = __esm({
   "../../packages/shared/src/wire.ts"() {
     "use strict";
@@ -15154,11 +15165,20 @@ var init_wire = __esm({
       "DataStructure",
       "Triage",
       "Claim",
-      "AntiPattern"
+      "AntiPattern",
+      // PJ-anchors (§6c): the OPAQUE project anchor identity — salted `sym_` id +
+      // coarse kind, no path, no qualified name. Writable ONLY on a batch with a
+      // verified projectId; the ingest door rejects it outright otherwise, so its
+      // presence in this list does not admit it to the org/team/public lanes.
+      "Symbol"
     ];
+    PROJECT_ONLY_NODE_LABELS = ["Symbol"];
+    PROJECT_ONLY_NODE_LABEL_SET = new Set(PROJECT_ONLY_NODE_LABELS);
+    PROJECT_ONLY_EDGE_TYPES = ["ANCHORED_AT"];
+    PROJECT_ONLY_EDGE_TYPE_SET = new Set(PROJECT_ONLY_EDGE_TYPES);
     CLOUD_WRITABLE_NODE_LABEL_SET = new Set(CLOUD_WRITABLE_NODE_LABELS);
     CLOUD_EDGE_TYPES = ALL_EDGE_TYPES.filter(
-      (e) => !CODE_EDGES.includes(e) && !GIT_EDGES.includes(e) && !BRIDGE_EDGES.includes(e)
+      (e) => e === "ANCHORED_AT" || !CODE_EDGES.includes(e) && !GIT_EDGES.includes(e) && !BRIDGE_EDGES.includes(e)
     );
     INGEST_SOURCES = ["agent", "daemon", "corpus-importer", "spine-importer"];
     INGEST_EXTRACTION_SOURCES = [

package/errata.mjs

@@ -103,7 +103,18 @@ var init_castalia = __esm({
       "OperatingSystem",
       "Paradigm",
       "DataStructure",
-      "AgentModel"
+      "AgentModel",
+      // An OPAQUE anchor identity in a project's stratum (PJ-anchors · plan §6c).
+      // Deliberately NOT one of the CODE_NODE_LABELS below — those are the local code
+      // graph and never cross. A cloud `Symbol` carries the salted `sym_` id and a
+      // coarse `kind`, and NOTHING ELSE: no path, no qualified name. It exists so two
+      // teammates' knowledge about the same function lands on one node; the cloud
+      // learns THAT they concern the same symbol, never WHICH symbol.
+      //
+      // Project-stratum only. The ingest door rejects a `Symbol` node — and any
+      // ANCHORED_AT edge — on a batch that carries no verified projectId, so the
+      // org/team/public lanes can never acquire one by accident.
+      "Symbol"
     ];
     CODE_NODE_LABELS = [
       "File",
@@ -15259,6 +15270,18 @@ var init_edge_rules = __esm({
   "../../packages/shared/src/edge-rules.ts"() {
     "use strict";
     EDGE_RULES = {
+      // ── Project anchors (PJ-anchors · PLAN_PROJECT_STORE §6c) ──
+      // ANCHORED_AT is the ONE bridge edge admitted to the cloud, and it exists for
+      // exactly one purpose: point a piece of knowledge at an OPAQUE project `Symbol`
+      // so two teammates' observations about the same function converge on one node.
+      // Constrain it to that purpose — an unconstrained ANCHORED_AT (its state before
+      // this rule, since a missing entry means "anything goes") would let a batch
+      // anchor anything at anything, e.g. at a public `Package`, quietly re-creating
+      // the code↔collective bridge the membrane exists to prevent.
+      ANCHORED_AT: {
+        from: ["Problem", "Solution", "RootCause", "Claim"],
+        to: ["Symbol"]
+      },
       // ── Security spine (v1 taxonomy.ts SECURITY_FORWARD_ONLY commentary) ──
       TARGETS: { from: ["Exploit"], to: ["Vulnerability"] },
       ENABLES: { from: ["AntiPattern"], to: ["Vulnerability"] },
@@ -15385,6 +15408,12 @@ var init_symbol_intent = __esm({
 });
 
 // ../../packages/shared/src/wire.ts
+function isProjectOnlyNodeLabel(label) {
+  return PROJECT_ONLY_NODE_LABEL_SET.has(label);
+}
+function isProjectOnlyEdgeType(type) {
+  return PROJECT_ONLY_EDGE_TYPE_SET.has(type);
+}
 function isCloudWritableNodeLabel(label) {
   return CLOUD_WRITABLE_NODE_LABEL_SET.has(label);
 }
@@ -15440,7 +15469,7 @@ function summarizeIngestResult(r) {
     ...r.patternReconciliation ? { patternReconciliation: r.patternReconciliation } : {}
   };
 }
-var CLOUD_NODE_LABELS, CLOUD_WRITABLE_NODE_LABELS, CLOUD_WRITABLE_NODE_LABEL_SET, CLOUD_EDGE_TYPES, INGEST_SOURCES, INGEST_EXTRACTION_SOURCES, QUARANTINE_EXTRACTION_SOURCE_PREFIX, MAX_NODES_PER_PAYLOAD, MAX_EDGES_PER_PAYLOAD, CastaliaIngestNodeSchema, RouteContextCountWireSchema, CastaliaIngestEdgeSchema, SymbolSummarySidecarSchema, CastaliaIngestPayloadSchema;
+var CLOUD_NODE_LABELS, CLOUD_WRITABLE_NODE_LABELS, PROJECT_ONLY_NODE_LABELS, PROJECT_ONLY_NODE_LABEL_SET, PROJECT_ONLY_EDGE_TYPES, PROJECT_ONLY_EDGE_TYPE_SET, CLOUD_WRITABLE_NODE_LABEL_SET, CLOUD_EDGE_TYPES, INGEST_SOURCES, INGEST_EXTRACTION_SOURCES, QUARANTINE_EXTRACTION_SOURCE_PREFIX, MAX_NODES_PER_PAYLOAD, MAX_EDGES_PER_PAYLOAD, CastaliaIngestNodeSchema, RouteContextCountWireSchema, CastaliaIngestEdgeSchema, SymbolSummarySidecarSchema, CastaliaIngestPayloadSchema;
 var init_wire = __esm({
   "../../packages/shared/src/wire.ts"() {
     "use strict";
@@ -15471,11 +15500,20 @@ var init_wire = __esm({
       "DataStructure",
       "Triage",
       "Claim",
-      "AntiPattern"
+      "AntiPattern",
+      // PJ-anchors (§6c): the OPAQUE project anchor identity — salted `sym_` id +
+      // coarse kind, no path, no qualified name. Writable ONLY on a batch with a
+      // verified projectId; the ingest door rejects it outright otherwise, so its
+      // presence in this list does not admit it to the org/team/public lanes.
+      "Symbol"
     ];
+    PROJECT_ONLY_NODE_LABELS = ["Symbol"];
+    PROJECT_ONLY_NODE_LABEL_SET = new Set(PROJECT_ONLY_NODE_LABELS);
+    PROJECT_ONLY_EDGE_TYPES = ["ANCHORED_AT"];
+    PROJECT_ONLY_EDGE_TYPE_SET = new Set(PROJECT_ONLY_EDGE_TYPES);
     CLOUD_WRITABLE_NODE_LABEL_SET = new Set(CLOUD_WRITABLE_NODE_LABELS);
     CLOUD_EDGE_TYPES = ALL_EDGE_TYPES.filter(
-      (e) => !CODE_EDGES.includes(e) && !GIT_EDGES.includes(e) && !BRIDGE_EDGES.includes(e)
+      (e) => e === "ANCHORED_AT" || !CODE_EDGES.includes(e) && !GIT_EDGES.includes(e) && !BRIDGE_EDGES.includes(e)
     );
     INGEST_SOURCES = ["agent", "daemon", "corpus-importer", "spine-importer"];
     INGEST_EXTRACTION_SOURCES = [
@@ -15677,6 +15715,8 @@ __export(src_exports, {
   MAX_SYMBOL_SUMMARY_CHARS: () => MAX_SYMBOL_SUMMARY_CHARS,
   PAGERANK_EXCLUSIONS: () => PAGERANK_EXCLUSIONS,
   PROBLEM_RESOLUTION: () => PROBLEM_RESOLUTION,
+  PROJECT_ONLY_EDGE_TYPES: () => PROJECT_ONLY_EDGE_TYPES,
+  PROJECT_ONLY_NODE_LABELS: () => PROJECT_ONLY_NODE_LABELS,
   QUARANTINE_EXTRACTION_SOURCE_PREFIX: () => QUARANTINE_EXTRACTION_SOURCE_PREFIX,
   RESOLUTION_EDGES: () => RESOLUTION_EDGES,
   RouteContextCountWireSchema: () => RouteContextCountWireSchema,
@@ -15713,6 +15753,8 @@ __export(src_exports, {
   isCodeLabel: () => isCodeLabel,
   isContextLabel: () => isContextLabel,
   isInferredSource: () => isInferredSource,
+  isProjectOnlyEdgeType: () => isProjectOnlyEdgeType,
+  isProjectOnlyNodeLabel: () => isProjectOnlyNodeLabel,
   isQuarantinedExtractionSource: () => isQuarantinedExtractionSource,
   isSeedProvenance: () => isSeedProvenance,
   isSemanticLabel: () => isSemanticLabel,
@@ -20857,6 +20899,11 @@ function toWirePayload(batch, runId) {
     // Origin key (= project) for the refute channel's cross-origin gate; absent
     // for id-less batches (principle sync) → those nodes stay fail-open.
     ...batch.originProject ? { originProject: batch.originProject } : {},
+    // PJ-write (§5a): the AUDIENCE assertion — which project stratum this batch is
+    // contributed to. Verified server-side against the projected link record; an
+    // unverifiable assertion rejects the whole batch rather than downgrading it to a
+    // wider audience. Absent ⇒ exactly today's wire.
+    ...batch.projectId ? { projectId: batch.projectId } : {},
     nodes,
     edges,
     ...symbolSummaries ? { symbolSummaries } : {}
@@ -21103,6 +21150,18 @@ var init_client = __esm({
       async attachProject(projectId, locator) {
         return this.json("POST", "/api/gate/projects/attach", { projectId, locator });
       }
+      /** Fetch the project's symbol salt (PJ-anchors · plan §6c) — the HMAC key this
+       *  workspace needs to derive project-canonical `sym_` anchor ids that CONVERGE
+       *  with every other member's.
+       *
+       *  Members-only: the server gates it with the same fail-closed check the ingest
+       *  door uses (known + active + owned by the caller's org), and 403s otherwise.
+       *  Safe to hold locally for exactly one reason — a project member can already read
+       *  the project's code, so the salt lets them compute ids for symbols they can see
+       *  anyway. It is key material: keep it in memory, never log it. */
+      async projectSymbolSalt(projectId) {
+        return this.json("GET", `/v2/projects/${encodeURIComponent(projectId)}/symbol-salt`);
+      }
       /** Create a locator-less project — `errata link --name` for repos without a
        *  usable remote. Discovery can't find it; the caller stamps the id locally. */
       async createProject(name2) {
@@ -43234,7 +43293,7 @@ function startLoopLagMonitor(thresholdMs = 1e3) {
 }
 
 // src/engine.ts
-var DAEMON_VERSION = true ? "2.0.0-dev.75" : "2.0.0-alpha.0";
+var DAEMON_VERSION = true ? "2.0.0-dev.77" : "2.0.0-alpha.0";
 var IGNORED_PATH = /[\\/](?:\.git|node_modules|\.errata|\.claude|\.codex|\.cursor|\.turbo|\.next|dist|coverage|test-results|playwright-report|__pycache__)(?:[\\/]|$)/;
 var IGNORED_NOISE = /castalia\.db|eventlog\.sqlite|turn-cursors/;
 var GIT_OP_MUTE_MS = 4e3;
@@ -44963,6 +45022,7 @@ function runLockfilePass(opts) {
 init_src();
 init_src2();
 init_src8();
+init_src();
 
 // src/contribution-ready.ts
 init_src3();
@@ -45101,6 +45161,50 @@ function buildInstanceIngest(store, profile, daemonVersion, ignorePatterns = [],
       contextNodes.push(shareableContext(t, wireId));
     }
   }
+  const project = opts.project;
+  if (project) {
+    const now = Date.now();
+    for (const sourceId of anchorSources) {
+      const source = store.getNode(sourceId);
+      if (!source) continue;
+      for (const e of store.outEdges(sourceId, ["ANCHORED_AT"])) {
+        const target = store.getNode(e.to);
+        if (!target) continue;
+        const relPath = target.attrs["relPath"];
+        const qname = target.attrs["qname"];
+        if (typeof relPath !== "string" || typeof qname !== "string") continue;
+        if (ignored(relPath) || ignored(qname)) continue;
+        const symId = projectSymbolId(project.salt, project.projectId, relPath, qname, target.label);
+        if (!contextSeen.has(symId)) {
+          contextSeen.add(symId);
+          contextNodes.push({
+            id: symId,
+            label: "Symbol",
+            // The id IS the description: there is nothing that can be said about an
+            // opaque symbol without disclosing it, and the wire requires a non-empty
+            // string. It must never carry the name or the path.
+            description: symId,
+            // `kind` is coarse (Function/Class/…) — shape, not identity.
+            attrs: { kind: target.label },
+            embedding: [],
+            extractionConfidence: 1,
+            extractionSource: "daemon-extracted",
+            cumulativeSurprise: 0,
+            peakSurprise: 0,
+            cumulativeHits: 0,
+            lastUpdatedAt: now,
+            createdAt: now,
+            memoryTier: "short-term",
+            pageRank: 0,
+            isLandmark: false,
+            community: null,
+            stability: "unstable"
+          });
+        }
+        anchorEdges.push({ ...e, to: symId, attrs: {} });
+      }
+    }
+  }
   if (nodes.length === 0 && anchorEdges.length === 0) return null;
   let symbolSummaries;
   if (opts.lexicon && opts.lexicon.size > 0 && nodes.length > 0) {
@@ -45402,6 +45506,14 @@ function createRootAdopter(deps) {
 }
 
 // src/multi.ts
+var projectSymbolSalts = /* @__PURE__ */ new Map();
+async function resolveProjectSymbolSalt(client, projectId) {
+  const cached2 = projectSymbolSalts.get(projectId);
+  if (cached2) return { projectId, salt: cached2 };
+  const { salt } = await client.projectSymbolSalt(projectId);
+  projectSymbolSalts.set(projectId, salt);
+  return { projectId, salt };
+}
 function normPath(p) {
   return p.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
 }
@@ -46010,11 +46122,21 @@ async function startMultiDaemon(opts = {}) {
           if (summaries.size > 0) lexicon = buildSymbolLexicon(store, summaries);
         } catch {
         }
+        const projectId = r.engine.profile.projectId;
+        let project;
+        if (projectId) {
+          try {
+            project = await resolveProjectSymbolSalt(client, projectId);
+          } catch {
+          }
+        }
         const instances = buildInstanceIngest(store, r.engine.profile, DAEMON_VERSION, ignore, {
           includePackages: cfg2.consent.contributePackages,
-          ...lexicon ? { lexicon } : {}
+          ...lexicon ? { lexicon } : {},
+          ...project ? { project } : {}
         });
         if (instances) {
+          if (project) instances.projectId = project.projectId;
           const res = await client.ingest(instances);
           uploaded += res.accepted;
           const seq = store.currentIngestSeq();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inerrata-corporation/errata",
-  "version": "2.0.0-dev.75",
+  "version": "2.0.0-dev.77",
   "description": "errata - local-first observation engine for AI coding agents",
   "type": "module",
   "bin": {

package/pass-worker.mjs

@@ -64,7 +64,18 @@ var init_castalia = __esm({
       "OperatingSystem",
       "Paradigm",
       "DataStructure",
-      "AgentModel"
+      "AgentModel",
+      // An OPAQUE anchor identity in a project's stratum (PJ-anchors · plan §6c).
+      // Deliberately NOT one of the CODE_NODE_LABELS below — those are the local code
+      // graph and never cross. A cloud `Symbol` carries the salted `sym_` id and a
+      // coarse `kind`, and NOTHING ELSE: no path, no qualified name. It exists so two
+      // teammates' knowledge about the same function lands on one node; the cloud
+      // learns THAT they concern the same symbol, never WHICH symbol.
+      //
+      // Project-stratum only. The ingest door rejects a `Symbol` node — and any
+      // ANCHORED_AT edge — on a batch that carries no verified projectId, so the
+      // org/team/public lanes can never acquire one by accident.
+      "Symbol"
     ];
     CODE_NODE_LABELS = [
       "File",
@@ -14978,7 +14989,7 @@ var init_symbol_intent = __esm({
 });
 
 // ../../packages/shared/src/wire.ts
-var CLOUD_NODE_LABELS, CLOUD_WRITABLE_NODE_LABELS, CLOUD_WRITABLE_NODE_LABEL_SET, CLOUD_EDGE_TYPES, INGEST_SOURCES, INGEST_EXTRACTION_SOURCES, CastaliaIngestNodeSchema, RouteContextCountWireSchema, CastaliaIngestEdgeSchema, SymbolSummarySidecarSchema, CastaliaIngestPayloadSchema;
+var CLOUD_NODE_LABELS, CLOUD_WRITABLE_NODE_LABELS, PROJECT_ONLY_NODE_LABELS, PROJECT_ONLY_NODE_LABEL_SET, PROJECT_ONLY_EDGE_TYPES, PROJECT_ONLY_EDGE_TYPE_SET, CLOUD_WRITABLE_NODE_LABEL_SET, CLOUD_EDGE_TYPES, INGEST_SOURCES, INGEST_EXTRACTION_SOURCES, CastaliaIngestNodeSchema, RouteContextCountWireSchema, CastaliaIngestEdgeSchema, SymbolSummarySidecarSchema, CastaliaIngestPayloadSchema;
 var init_wire = __esm({
   "../../packages/shared/src/wire.ts"() {
     "use strict";
@@ -15009,11 +15020,20 @@ var init_wire = __esm({
       "DataStructure",
       "Triage",
       "Claim",
-      "AntiPattern"
+      "AntiPattern",
+      // PJ-anchors (§6c): the OPAQUE project anchor identity — salted `sym_` id +
+      // coarse kind, no path, no qualified name. Writable ONLY on a batch with a
+      // verified projectId; the ingest door rejects it outright otherwise, so its
+      // presence in this list does not admit it to the org/team/public lanes.
+      "Symbol"
     ];
+    PROJECT_ONLY_NODE_LABELS = ["Symbol"];
+    PROJECT_ONLY_NODE_LABEL_SET = new Set(PROJECT_ONLY_NODE_LABELS);
+    PROJECT_ONLY_EDGE_TYPES = ["ANCHORED_AT"];
+    PROJECT_ONLY_EDGE_TYPE_SET = new Set(PROJECT_ONLY_EDGE_TYPES);
     CLOUD_WRITABLE_NODE_LABEL_SET = new Set(CLOUD_WRITABLE_NODE_LABELS);
     CLOUD_EDGE_TYPES = ALL_EDGE_TYPES.filter(
-      (e) => !CODE_EDGES.includes(e) && !GIT_EDGES.includes(e) && !BRIDGE_EDGES.includes(e)
+      (e) => e === "ANCHORED_AT" || !CODE_EDGES.includes(e) && !GIT_EDGES.includes(e) && !BRIDGE_EDGES.includes(e)
     );
     INGEST_SOURCES = ["agent", "daemon", "corpus-importer", "spine-importer"];
     INGEST_EXTRACTION_SOURCES = [