@inerrata-corporation/errata 2.0.16 → 2.0.17-dev.3407

package/consolidate-worker.mjs

@@ -802,6 +802,12 @@ function identityId(input) {
     }
     case "Claim":
       return canonicalClaimId(input.text, input.scope);
+    case "WitnessedVulnerability":
+      return genericCanonicalId("dvuln", {
+        workspaceId: input.workspaceId,
+        target: input.target.replace(/\\/g, "/").replace(/^\.\//, ""),
+        statement: canonicalClaimId(input.statement.trim())
+      });
     case "DesignProblem":
       return `${DESIGN_PROBLEM_PREFIX}${canonicalClaimId(input.statement.trim())}`.slice(
         0,
@@ -15258,7 +15264,7 @@ var init_edge_rules = __esm({
       // anchor anything at anything, e.g. at a public `Package`, quietly re-creating
       // the code↔collective bridge the membrane exists to prevent.
       ANCHORED_AT: {
-        from: ["Problem", "Solution", "RootCause", "Claim"],
+        from: ["Problem", "Vulnerability", "Solution", "RootCause", "Claim"],
         to: ["Symbol"]
       },
       // ── Security spine (v1 taxonomy.ts SECURITY_FORWARD_ONLY commentary) ──
@@ -15303,7 +15309,7 @@ var init_edge_rules = __esm({
       // `Component` joined the target set with OM-agent-anchors: an agent-named
       // component ("React Router") is the same knowledge→named-unit anchor shape as
       // a Tool — the knowledge is ABOUT it, not dependent on it.
-      CONCERNS: { from: ["Problem", "Solution", "RootCause", "Claim", "Pattern"], to: ["Tool", "Component"] },
+      CONCERNS: { from: ["Problem", "Vulnerability", "Solution", "RootCause", "Claim", "Pattern"], to: ["Tool", "Component"] },
       OPERATES_ON: { from: ["Algorithm"], to: ["DataStructure"] },
       INVOLVES: { from: ["Problem", "Solution"], to: ["DataStructure"] },
       // ── Taxonomy (Track 4 Stream C: MITRE CWE `ChildOf` → `Weakness —IS_A→ Weakness`) ──
@@ -16210,12 +16216,13 @@ function installHistoryCacheFloor(db) {
 }
 
 // ../../packages/local-graph/src/session-evidence.ts
+var arrays = /* @__PURE__ */ new Set(["sources", "recurrenceSources", "contributors", "inferredContributors", "citeSessions"]);
+var scalars = /* @__PURE__ */ new Set(["discriminatorSource", "originSession", "sessionId", "sourceSession"]);
+var SESSION_EVIDENCE_FIELDS = [...arrays, ...scalars, "citeAnchorHints"];
 function repairSessionEvidence(input, aliases = /* @__PURE__ */ new Map()) {
   const mapping = new Map(aliases);
   const uuid3 = "[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}";
   const codex = new RegExp(`^codex:(?:rollout-.*?)?(${uuid3})$`, "i");
-  const arrays = /* @__PURE__ */ new Set(["sources", "recurrenceSources", "contributors", "inferredContributors", "citeSessions"]);
-  const scalars = /* @__PURE__ */ new Set(["discriminatorSource", "originSession", "sessionId", "sourceSession"]);
   const discover = (value, key = "") => {
     if (typeof value === "string" && (arrays.has(key) || scalars.has(key) || key === "citeAnchorHints")) {
       const match = value.match(codex);
@@ -16313,6 +16320,7 @@ function localEdgeViolation(fromLabel, type, toLabel) {
   return verdict.ok ? null : verdict.reason ?? "edge rule violation";
 }
 var SCHEMA_VERSION = 6;
+var SESSION_EVIDENCE_PREDICATE = SESSION_EVIDENCE_FIELDS.map((field) => `instr(attrs_json, '${JSON.stringify(field)}') > 0`).join(" OR ");
 var SCHEMA_SQL = `
 CREATE TABLE IF NOT EXISTS schema_version (
   version INTEGER PRIMARY KEY
@@ -16405,12 +16413,17 @@ CREATE UNIQUE INDEX IF NOT EXISTS edges_triple ON edges(from_id, type, to_id);
 `;
 var TEMPORAL_INDEX_SQL = `
 CREATE INDEX IF NOT EXISTS nodes_live ON nodes(label, valid_to);
+CREATE INDEX IF NOT EXISTS nodes_live_count ON nodes(valid_to);
+CREATE INDEX IF NOT EXISTS nodes_live_recent ON nodes(label, last_updated_at DESC) WHERE valid_to IS NULL;
+CREATE INDEX IF NOT EXISTS nodes_session_evidence ON nodes(id) WHERE ${SESSION_EVIDENCE_PREDICATE};
+CREATE INDEX IF NOT EXISTS edges_session_evidence ON edges(id) WHERE ${SESSION_EVIDENCE_PREDICATE};
 -- Covering + partial index for labelFingerprint over the instance labels: the
 -- live-push probe runs it per workspace on a timer, and each hit used to read
 -- its table row. Partial, so it maintains a few thousand rows instead of adding
 -- a write to every node write. Its label list is FINGERPRINT_INDEXED_LABELS.
 DROP INDEX IF EXISTS nodes_live_fingerprint;
-CREATE INDEX IF NOT EXISTS nodes_instance_fingerprint ON nodes(label, last_updated_at, last_reinforced_at_seq, created_at_seq) WHERE valid_to IS NULL AND label IN ('Problem','Solution','RootCause');
+DROP INDEX IF EXISTS nodes_instance_fingerprint;
+CREATE INDEX IF NOT EXISTS nodes_instance_fingerprint_v2 ON nodes(label, last_updated_at, last_reinforced_at_seq, created_at_seq) WHERE valid_to IS NULL AND label IN ('Problem','Vulnerability','Solution','RootCause');
 CREATE INDEX IF NOT EXISTS nodes_logical ON nodes(logical_id, version);
 CREATE INDEX IF NOT EXISTS edges_live ON edges(valid_to);
 -- Expression index on the per-node relPath (stored in attrs_json) so the
@@ -16481,7 +16494,7 @@ function rowToEdge(r) {
     attrs: JSON.parse(r.attrs_json)
   };
 }
-var FINGERPRINT_INDEXED_LABELS = ["Problem", "Solution", "RootCause"];
+var FINGERPRINT_INDEXED_LABELS = ["Problem", "Vulnerability", "Solution", "RootCause"];
 var SqliteGraphStore = class {
   db;
   // Typed edge lookups build their SQL from the number of types asked for, and
@@ -16773,12 +16786,13 @@ var SqliteGraphStore = class {
     });
   }
   repairSessionAliases(canonical, aliases = []) {
+    if (canonical && aliases.length === 0) return 0;
     const mapping = new Map(aliases.map((alias) => [alias, canonical]));
     let changed = 0;
     for (const table of ["nodes", "edges"]) {
       const predicates = canonical ? aliases.map(() => "instr(attrs_json, ?) > 0") : ["instr(attrs_json, 'codex:') > 0", "instr(attrs_json, 'discriminatorSource') > 0"];
       if (!predicates.length) continue;
-      const rows = this.db.prepare(`SELECT id, attrs_json FROM ${table} WHERE ${predicates.join(" OR ")}`).all(...canonical ? aliases : []);
+      const rows = this.db.prepare(`SELECT id, attrs_json FROM ${table} WHERE (${SESSION_EVIDENCE_PREDICATE}) AND (${predicates.join(" OR ")})`).all(...canonical ? aliases.map((alias) => JSON.stringify(alias)) : []);
       const update = this.db.prepare(`UPDATE ${table} SET attrs_json = ?${table === "edges" ? ", type = CASE WHEN type = 'CONFIRMS' AND json_extract(?, '$.provisional') = 1 THEN 'INDICATES' ELSE type END" : ""} WHERE id = ?`);
       for (const row of rows) {
         const attrs = JSON.stringify(repairSessionEvidence(JSON.parse(row.attrs_json), mapping));
@@ -17004,6 +17018,25 @@ var SqliteGraphStore = class {
     const rows = this.db.prepare("SELECT id FROM nodes WHERE label = ? AND valid_to IS NULL ORDER BY last_updated_at DESC LIMIT ?").all(label, Math.max(0, limit));
     return rows.map((r) => r.id);
   }
+  recentOpenProblemCandidates(opts) {
+    if (!Number.isSafeInteger(opts.limit) || opts.limit < 0) {
+      throw new RangeError("candidate limit must be a non-negative safe integer");
+    }
+    return this.db.prepare(`SELECT id, description FROM nodes
+      WHERE label = 'Problem' AND valid_to IS NULL
+        AND json_extract(attrs_json, '$.resolvedAt') IS NULL
+        AND json_type(attrs_json, '$.mergedInto') IS NULL
+        AND (? IS NULL OR id != ?)
+        AND (json_type(attrs_json, '$.workspaceId') IS NULL OR json_extract(attrs_json, '$.workspaceId') = ?)
+        AND COALESCE(json_extract(attrs_json, '$.kind') = 'constraint', 0) = ?
+      ORDER BY last_updated_at DESC, rowid ASC LIMIT ?`).all(
+      opts.excludeId ?? null,
+      opts.excludeId ?? null,
+      opts.workspaceId,
+      opts.constraint ? 1 : 0,
+      opts.limit
+    );
+  }
   hasLiveNodes() {
     const r = this.db.prepare("SELECT EXISTS(SELECT 1 FROM nodes WHERE valid_to IS NULL) AS e").get();
     return r.e === 1;
@@ -17159,8 +17192,8 @@ var SqliteGraphStore = class {
       const r2 = this.db.prepare(
         `SELECT COUNT(*) AS n, MAX(last_updated_at) AS t,
                   MAX(COALESCE(last_reinforced_at_seq, created_at_seq, 0)) AS s
-             FROM nodes INDEXED BY nodes_instance_fingerprint
-            WHERE valid_to IS NULL AND label IN ('Problem','Solution','RootCause')`
+             FROM nodes INDEXED BY nodes_instance_fingerprint_v2
+            WHERE valid_to IS NULL AND label IN ('Problem','Vulnerability','Solution','RootCause')`
       ).get();
       return `${r2.n}:${r2.t ?? 0}:${r2.s ?? 0}`;
     }
@@ -19389,7 +19422,7 @@ function generalizeFileRefs(text, fileLexicon, level = 1) {
 }
 
 // src/instance-ingest.ts
-var INSTANCE_LABELS = ["Problem", "Solution", "RootCause"];
+var INSTANCE_LABELS = ["Problem", "Vulnerability", "Solution", "RootCause"];
 var INSTANCE_EDGES = ["CAUSED_BY", "SOLVED_BY"];
 var ANCHOR_EDGES = ["OCCURS_IN", "DEPENDS_ON", "PERTAIN_TO", "CONCERNS"];
 var ANCHOR_TARGET_LABELS = ["Language", "Package", "Domain", "Component"];
@@ -19509,6 +19542,10 @@ function buildInstanceIngest(store, profile, daemonVersion, ignorePatterns = [],
       attrs: {
         scope: stripCodebaseScope(n.attrs["scope"]),
         ...n.attrs["kind"] ? { kind: n.attrs["kind"] } : {},
+        ...n.attrs["privateFinding"] ? { privateFinding: true } : {},
+        ...n.attrs["assessment"] ? { assessment: n.attrs["assessment"] } : {},
+        ...n.attrs["sourceClass"] ? { sourceClass: n.attrs["sourceClass"] } : {},
+        ...n.attrs["resolutionWitnessed"] ? { resolutionWitnessed: true, resolvedAt: n.attrs["resolvedAt"] } : {},
         ...n.attrs["resolvedAs"] ? { resolvedAs: n.attrs["resolvedAs"] } : {},
         ...preserved.length > 0 ? { preservedSymbols: preserved } : {},
         ...internal.length > 0 ? { internalSymbols: internal } : {}
@@ -19523,6 +19560,7 @@ function buildInstanceIngest(store, profile, daemonVersion, ignorePatterns = [],
   const semanticEndpoints = /* @__PURE__ */ new Map();
   const includedByLabel = /* @__PURE__ */ new Map();
   const composition = {
+    privateTargetMissing: 0,
     candidates: 0,
     shipped: 0,
     cloudSourced: 0,
@@ -19568,11 +19606,15 @@ function buildInstanceIngest(store, profile, daemonVersion, ignorePatterns = [],
       if (walked.has(n.id)) continue;
       walked.add(n.id);
       composition.candidates++;
+      if ((n.attrs["privateFinding"] || n.label === "Vulnerability") && !opts.project) {
+        composition.privateTargetMissing++;
+        continue;
+      }
       if (n.attrs["source"] === "cloud") {
         composition.cloudSourced++;
         continue;
       }
-      if (label === "Problem" && n.attrs["resolvedAs"] === PROBLEM_RESOLUTION.FALSE_POSITIVE) {
+      if (n.attrs["resolvedAs"] === PROBLEM_RESOLUTION.FALSE_POSITIVE) {
         composition.falsePositive++;
         continue;
       }
@@ -19595,7 +19637,7 @@ function buildInstanceIngest(store, profile, daemonVersion, ignorePatterns = [],
         composition.terminalRefused++;
         continue;
       }
-      if (!noveltyAgainst(n, ref, noveltyOpts).ready) {
+      if (!n.attrs["privateFinding"] && !noveltyAgainst(n, ref, noveltyOpts).ready) {
         composition.notNovel++;
         continue;
       }
@@ -19638,7 +19680,7 @@ function buildInstanceIngest(store, profile, daemonVersion, ignorePatterns = [],
     }
     if (targets.length === 0) continue;
     const shipped = shippedById.get(sourceId);
-    if (shipped) {
+    if (shipped && !shipped.attrs["privateFinding"]) {
       const anchors = (label) => targets.filter((x) => x.t.label === label).map(
         (x) => label === "Language" ? langAnchor(x.t) : label === "Component" ? `component:${x.wireId}` : x.wireId
       ).filter((a) => a != null).sort();