@lamentis/naome 1.4.1 → 1.4.2

package/crates/naome-core/tests/task_status.rs

@@ -134,6 +134,45 @@ fn proof_plan_reports_missing_and_stale_required_checks() {
     }));
 }
 
+#[test]
+fn proof_plan_marks_mutable_npm_scripts_not_safe_to_execute() {
+    let repo = TaskFixture::new(task_state_with_status(
+        "implementing",
+        active_task(json!({
+            "allowedPaths": ["package.json"],
+            "requiredCheckIds": ["package-dry-run"],
+            "proofResults": []
+        })),
+    ));
+    repo.write_json(
+        ".naome/verification.json",
+        json!({
+            "checks": [{
+                "id": "package-dry-run",
+                "command": "npm run pack:dry-run",
+                "cwd": ".",
+                "purpose": "Validate package output.",
+                "cost": "medium",
+                "source": "npm",
+                "evidence": ["package.json"]
+            }]
+        }),
+    );
+    repo.init_git();
+    repo.write_json(
+        "package.json",
+        json!({ "scripts": { "pack:dry-run": "echo changed" } }),
+    );
+
+    let plan = task_proof_plan(repo.path()).unwrap();
+
+    assert!(plan.recommended_commands.iter().any(|command| {
+        command.check_id == "package-dry-run"
+            && command.command == "npm run pack:dry-run"
+            && !command.safe_to_execute
+    }));
+}
+
 #[test]
 fn proof_plan_next_action_reports_missing_proof_without_command_metadata() {
     let repo = TaskFixture::new(task_state_with_status(
@@ -200,6 +239,89 @@ fn transition_readiness_blocks_missing_proof_and_allows_fresh_proof() {
     assert_eq!(allowed.agent_loop.state, "ready_to_commit");
 }
 
+#[test]
+fn transition_readiness_treats_mismatched_proof_fingerprint_as_stale() {
+    let repo = TaskFixture::new(task_state_with_status(
+        "implementing",
+        active_task(json!({
+            "allowedPaths": ["README.md"],
+            "requiredCheckIds": ["diff-check"],
+            "proofPathSets": {
+                "current": ["README.md"]
+            },
+            "proofBatches": [{
+                "id": "old-proof",
+                "checkedAt": "2026-05-04T12:00:00.000Z",
+                "evidencePathSet": "current",
+                "proofs": [{
+                    "checkId": "diff-check",
+                    "exitCode": 0,
+                    "evidenceFingerprint": "fnv64:0000000000000000"
+                }]
+            }]
+        })),
+    ));
+    repo.init_git();
+    repo.write("README.md", "changed after proof\n");
+
+    let transition = task_transition_readiness(repo.path(), "complete").unwrap();
+
+    assert!(!transition.allowed);
+    assert!(transition
+        .blocking_findings
+        .iter()
+        .any(|finding| finding.id == "task.transition.stale_proof"));
+}
+
+#[test]
+fn transition_readiness_blocks_pending_human_review_and_stale_blockers() {
+    let human_review = TaskFixture::new(task_state_with_status(
+        "implementing",
+        active_task(json!({
+            "requiredCheckIds": ["diff-check"],
+            "proofResults": [successful_proof(json!({ "evidence": ["README.md"] }))],
+            "humanReview": {
+                "required": true,
+                "approved": false,
+                "reason": "Security-sensitive change."
+            }
+        })),
+    ));
+    human_review.init_git();
+
+    let transition = task_transition_readiness(human_review.path(), "complete").unwrap();
+
+    assert!(!transition.allowed);
+    assert!(transition
+        .blocking_findings
+        .iter()
+        .any(|finding| finding.id == "task.transition.human_review_required"));
+
+    let mut blocked_state = task_state_with_status(
+        "implementing",
+        active_task(json!({
+            "requiredCheckIds": ["diff-check"],
+            "proofResults": [successful_proof(json!({ "evidence": ["README.md"] }))]
+        })),
+    );
+    blocked_state["blocker"] = json!({
+        "type": "scope_drift",
+        "message": "Resolve stale blocker before completion.",
+        "paths": ["README.md"],
+        "humanOptions": ["review_task_state"]
+    });
+    let blocker = TaskFixture::new(blocked_state);
+    blocker.init_git();
+
+    let transition = task_transition_readiness(blocker.path(), "complete").unwrap();
+
+    assert!(!transition.allowed);
+    assert!(transition
+        .blocking_findings
+        .iter()
+        .any(|finding| finding.id == "task.transition.blocker_present"));
+}
+
 #[test]
 fn legacy_proof_results_remain_readable_when_fresh() {
     let repo = TaskFixture::new(task_state_with_status(

package/installer/context.js

@@ -49,7 +49,7 @@ export function createInstallerContext() {
     normalizedIntegrityBlock:
       "const expectedMachineOwnedIntegrity = Object.freeze({\n  __generated__: \"sha256:generated\"\n});\n",
     nativeIntegrityPattern:
-      /^const expectedNativeBinaryIntegrity = "(?:sha256:[a-f0-9]{64}|sha256:generated)";\n/m,
+      /^const expectedNativeBinaryIntegrity = "sha256:[a-f0-9]{64}";\n/m,
     normalizedNativeIntegrity: 'const expectedNativeBinaryIntegrity = "sha256:generated";\n',
     executableMachineOwnedPaths: new Set([
       ".naome/bin/naome.js",

package/installer/harness-verification.js

@@ -3,7 +3,6 @@ import { copyFileSync, existsSync, lstatSync, mkdirSync, readFileSync, writeFile
 import { dirname, join } from "node:path";
 
 import { hasSymlinkInTargetPath, removeSkipped } from "./filesystem.js";
-import { findNativeDecisionBinary, usesSourceNativeFallback } from "./native.js";
 import { printCommandFailure, printError } from "./output.js";
 
 export function ensureBuiltInVerificationChecks(ctx) {
@@ -71,13 +70,10 @@ function ensureVerificationFileExists(ctx, relativePath, targetPath) {
 }
 
 function verificationSeederBinary(ctx) {
-  const nativePath = usesSourceNativeFallback(ctx)
-    ? findNativeDecisionBinary(ctx)
-    : join(ctx.targetRoot, ctx.nativeBinaryRelativePath);
+  const nativePath = join(ctx.targetRoot, ctx.nativeBinaryRelativePath);
   if (
-    !nativePath ||
     !existsSync(nativePath) ||
-    (!usesSourceNativeFallback(ctx) && hasSymlinkInTargetPath(ctx, ctx.nativeBinaryRelativePath)) ||
+    hasSymlinkInTargetPath(ctx, ctx.nativeBinaryRelativePath) ||
     !lstatSync(nativePath).isFile()
   ) {
     printError(ctx, "NAOME native decision binary is unavailable for verification seeding.");

package/installer/manifest-state.js

@@ -2,7 +2,7 @@ import { existsSync, lstatSync, mkdirSync, readFileSync, writeFileSync } from "n
 import { dirname, join } from "node:path";
 
 import { hasSymlinkInTargetPath } from "./filesystem.js";
-import { installedMachineOwnedIntegrity, installedNativeBinaryHash, usesSourceNativeFallback } from "./native.js";
+import { installedMachineOwnedIntegrity, installedNativeBinaryHash } from "./native.js";
 import { printError } from "./output.js";
 import { isVersion } from "./version.js";
 
@@ -121,7 +121,7 @@ function applyManifestHealthMetadata(ctx, manifest) {
   manifest.integrity = installedMachineOwnedIntegrity(ctx);
 
   const nativeHash = installedNativeBinaryHash(ctx);
-  if (!usesSourceNativeFallback(ctx) && nativeHash) {
+  if (nativeHash) {
     if (!manifest.machineOwned.includes(ctx.nativeBinaryRelativePath)) {
       manifest.machineOwned.push(ctx.nativeBinaryRelativePath);
     }

package/installer/native.js

@@ -6,7 +6,6 @@ import {
   lstatSync,
   mkdirSync,
   readFileSync,
-  unlinkSync,
   writeFileSync,
 } from "node:fs";
 import { dirname, join, resolve } from "node:path";
@@ -32,12 +31,6 @@ export function installNativeDecisionBinary(ctx) {
     process.exit(1);
   }
 
-  if (usesSourceNativeFallback(ctx)) {
-    removeInstalledNativeDecisionBinary(ctx);
-    patchInstalledNativeIntegrity(ctx, "sha256:generated");
-    return;
-  }
-
   mkdirSync(dirname(targetPath), { recursive: true });
   const sourceHash = sha256(readFileSync(sourcePath));
   const targetHash =
@@ -93,11 +86,6 @@ export function patchInstalledMachineOwnedIntegrity(ctx) {
   }
 }
 
-export function usesSourceNativeFallback(ctx) {
-  return existsSync(join(ctx.targetRoot, "packages", "naome", "Cargo.toml"))
-    && existsSync(join(ctx.targetRoot, "packages", "naome", "crates", "naome-cli", "src", "main.rs"));
-}
-
 export function installedNativeBinaryHash(ctx) {
   const targetPath = join(ctx.targetRoot, ctx.nativeBinaryRelativePath);
   if (
@@ -111,23 +99,6 @@ export function installedNativeBinaryHash(ctx) {
   return sha256(readFileSync(targetPath));
 }
 
-function removeInstalledNativeDecisionBinary(ctx) {
-  const targetPath = join(ctx.targetRoot, ctx.nativeBinaryRelativePath);
-  if (!existsSync(targetPath)) {
-    ctx.skipped.push(ctx.nativeBinaryRelativePath);
-    return;
-  }
-
-  if (hasSymlinkInTargetPath(ctx, ctx.nativeBinaryRelativePath) || !lstatSync(targetPath).isFile()) {
-    ctx.skipped.push(ctx.nativeBinaryRelativePath);
-    ctx.unsafeSkipped.push(ctx.nativeBinaryRelativePath);
-    return;
-  }
-
-  unlinkSync(targetPath);
-  ctx.updated.push(ctx.nativeBinaryRelativePath);
-}
-
 export function templateIntegrity(ctx) {
   const integrity = {};
 
@@ -143,7 +114,7 @@ export function installedMachineOwnedIntegrity(ctx) {
   const integrity = templateIntegrity(ctx);
   const nativeHash = installedNativeBinaryHash(ctx);
 
-  if (!usesSourceNativeFallback(ctx) && nativeHash) {
+  if (nativeHash) {
     integrity[ctx.nativeBinaryRelativePath] = `sha256:${nativeHash}`;
   }
 
@@ -181,6 +152,7 @@ export function hasGeneratedNativeIntegrity(ctx, relativePath) {
 }
 
 function patchInstalledNativeIntegrity(ctx, expectedIntegrity) {
+  const nativeIntegrityPatchPattern = /^const expectedNativeBinaryIntegrity = "(?:sha256:[a-f0-9]{64}|sha256:generated)";\n/m;
   const nativeIntegrityPaths = [
     ctx.healthCheckerRelativePath,
     ctx.taskStateCheckerRelativePath,
@@ -195,7 +167,7 @@ function patchInstalledNativeIntegrity(ctx, expectedIntegrity) {
 
     const content = readFileSync(targetPath, "utf8");
     const nextContent = content.replace(
-      ctx.nativeIntegrityPattern,
+      nativeIntegrityPatchPattern,
       `const expectedNativeBinaryIntegrity = "${expectedIntegrity}";\n`,
     );
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lamentis/naome",
-  "version": "1.4.1",
+  "version": "1.4.2",
   "description": "Native-first CLI for the NAOME agent harness.",
   "license": "Apache-2.0",
   "type": "module",

package/templates/naome-root/.naome/bin/check-harness-health.js

@@ -11,8 +11,8 @@ const expectedNativeBinaryIntegrity = "sha256:generated";
 
 const expectedMachineOwnedIntegrity = Object.freeze({
   ".naome/bin/check-harness-health.js": "sha256:802d7419774981a6af1826b3882270ff8f41259d516f98c52a02b4ddc184c467",
-  ".naome/bin/check-task-state.js": "sha256:2612577b7e4ab45d9d39dd5ac54c8e7ed749d237d78f1a8d252f4dfa0b4eaaab",
-  ".naome/bin/naome.js": "sha256:f129c580fb70b3a1d92d0ab0de9fa6c131b2fc51a8dcdebe9d6f5a812a3be61b",
+  ".naome/bin/check-task-state.js": "sha256:d1c12ba6d8a0ffc3fd28c6900b675c4bbc9c54b6bd287d219f6e9104bfb9621e",
+  ".naome/bin/naome.js": "sha256:8a9d9ed783981ef9750021fa30e92460283775bb4a0eacdea60b63041a9c6a05",
   ".naome/package.json": "sha256:8005a3491db7d92f36ac66369861589f9c47123d3a7c71e643fc2c06168cd45a",
   ".naome/task-contract.schema.json": "sha256:1b3b62350328d0d6d660e36d1d1baaa2b88718530db774f9ab2a9e2fcba369c8",
   "AGENTS.md": "sha256:e8b2fc786c1c72b69ba8f2b2ffce4f459e799c7453ce9ff4a9f6448a8f9e6b4f",

package/templates/naome-root/.naome/bin/check-task-state.js

@@ -11,8 +11,8 @@ const expectedNativeBinaryIntegrity = "sha256:generated";
 
 const expectedMachineOwnedIntegrity = Object.freeze({
   ".naome/bin/check-harness-health.js": "sha256:802d7419774981a6af1826b3882270ff8f41259d516f98c52a02b4ddc184c467",
-  ".naome/bin/check-task-state.js": "sha256:2612577b7e4ab45d9d39dd5ac54c8e7ed749d237d78f1a8d252f4dfa0b4eaaab",
-  ".naome/bin/naome.js": "sha256:f129c580fb70b3a1d92d0ab0de9fa6c131b2fc51a8dcdebe9d6f5a812a3be61b",
+  ".naome/bin/check-task-state.js": "sha256:d1c12ba6d8a0ffc3fd28c6900b675c4bbc9c54b6bd287d219f6e9104bfb9621e",
+  ".naome/bin/naome.js": "sha256:8a9d9ed783981ef9750021fa30e92460283775bb4a0eacdea60b63041a9c6a05",
   ".naome/package.json": "sha256:8005a3491db7d92f36ac66369861589f9c47123d3a7c71e643fc2c06168cd45a",
   ".naome/task-contract.schema.json": "sha256:1b3b62350328d0d6d660e36d1d1baaa2b88718530db774f9ab2a9e2fcba369c8",
   "AGENTS.md": "sha256:e8b2fc786c1c72b69ba8f2b2ffce4f459e799c7453ce9ff4a9f6448a8f9e6b4f",
@@ -67,9 +67,7 @@ function resolveNativeDecisionBinary(root) {
   const expectedIntegrity = expectedNativeIntegrity();
   const candidates = [
     process.env.NAOME_NATIVE_BIN,
-    join(root, nativeBinaryRelativePath),
-    join(root, "packages", "naome", "target", "release", nativeBinaryName),
-    join(root, "packages", "naome", "target", "debug", nativeBinaryName)
+    expectedIntegrity && join(root, nativeBinaryRelativePath)
   ].filter(Boolean);
 
   if (expectedIntegrity) {
@@ -82,12 +80,7 @@ function resolveNativeDecisionBinary(root) {
     fail(`No runnable NAOME native task-state binary matched ${expectedIntegrity}. Run naome sync again.`);
   }
 
-  const built = buildSourceNativeBinary(root);
-  if (built && isUsableNativeBinary(built, root, null)) {
-    return built;
-  }
-
-  fail("NAOME native task-state binary is missing or incompatible. Run naome sync again.");
+  fail("NAOME native task-state binary is missing trusted integrity. Run naome sync again.");
 }
 
 function expectedNativeIntegrity() {
@@ -118,34 +111,6 @@ function isUsableNativeBinary(candidate, root, expectedIntegrity) {
   return !probe.error && probe.status !== null;
 }
 
-function buildSourceNativeBinary(root) {
-  if (expectedNativeBinaryIntegrity !== "sha256:generated") {
-    return null;
-  }
-
-  const packageRoot = join(root, "packages", "naome");
-  const manifestPath = join(packageRoot, "Cargo.toml");
-  if (!existsSync(manifestPath)) {
-    return null;
-  }
-
-  const result = spawnSync(
-    "cargo",
-    ["build", "--release", "--manifest-path", manifestPath, "-p", "naome-cli"],
-    {
-      cwd: root,
-      encoding: "utf8",
-      stdio: "ignore"
-    }
-  );
-  if (result.status !== 0) {
-    return null;
-  }
-
-  const builtPath = join(packageRoot, "target", "release", nativeBinaryName);
-  return existsSync(builtPath) ? builtPath : null;
-}
-
 function findHarnessRoot(startPath) {
   let current = resolve(startPath);
 

package/templates/naome-root/.naome/bin/naome.js

@@ -66,9 +66,7 @@ function spawnNative(root, args, options = {}) {
 function resolveNativeDecisionBinary(root) {
   const candidates = [
     process.env.NAOME_NATIVE_BIN,
-    join(root, nativeBinaryRelativePath),
-    join(root, "packages", "naome", "target", "release", nativeBinaryName),
-    join(root, "packages", "naome", "target", "debug", nativeBinaryName)
+    expectedNativeBinaryIntegrity !== "sha256:generated" && join(root, nativeBinaryRelativePath)
   ].filter(Boolean);
 
   for (const candidate of candidates) {
@@ -77,11 +75,6 @@ function resolveNativeDecisionBinary(root) {
     }
   }
 
-  const built = buildSourceNativeBinary(root);
-  if (built && isUsableNativeBinary(built, root)) {
-    return built;
-  }
-
   fail("NAOME native decision binary is missing or incompatible. Run naome sync again, or set NAOME_NATIVE_BIN to a built naome binary.");
 }
 
@@ -91,7 +84,7 @@ function isUsableNativeBinary(candidate, root) {
   }
 
   if (expectedNativeBinaryIntegrity === "sha256:generated") {
-    return isRunnableNativeBinary(candidate, root);
+    return candidate === process.env.NAOME_NATIVE_BIN && isRunnableNativeBinary(candidate, root);
   }
 
   const actual = `sha256:${createHash("sha256").update(readFileSync(candidate)).digest("hex")}`;
@@ -111,27 +104,6 @@ function isRunnableNativeBinary(candidate, root) {
   return !probe.error && probe.status !== null;
 }
 
-function buildSourceNativeBinary(root) {
-  if (expectedNativeBinaryIntegrity !== "sha256:generated") {
-    return null;
-  }
-
-  const sourcePath = (...parts) => join(root, "packages", "naome", ...parts);
-  const manifestPath = sourcePath("Cargo.toml");
-  if (!existsSync(manifestPath)) {
-    return null;
-  }
-
-  const buildArgs = ["build", "--release", "--manifest-path", manifestPath, "-p", "naome-cli"];
-  const result = spawnSync("cargo", buildArgs, { cwd: root, encoding: "utf8", stdio: "ignore" });
-  if (result.status !== 0) {
-    return null;
-  }
-
-  const builtPath = sourcePath("target", "release", nativeBinaryName);
-  return existsSync(builtPath) ? builtPath : null;
-}
-
 function commit(args) {
   const root = findHarnessRoot(process.cwd());
   if (!root) {

package/templates/naome-root/.naome/manifest.json

@@ -3,8 +3,8 @@
   "installedAt": null,
   "integrity": {
     ".naome/bin/check-harness-health.js": "sha256:802d7419774981a6af1826b3882270ff8f41259d516f98c52a02b4ddc184c467",
-    ".naome/bin/check-task-state.js": "sha256:2612577b7e4ab45d9d39dd5ac54c8e7ed749d237d78f1a8d252f4dfa0b4eaaab",
-    ".naome/bin/naome.js": "sha256:f129c580fb70b3a1d92d0ab0de9fa6c131b2fc51a8dcdebe9d6f5a812a3be61b",
+    ".naome/bin/check-task-state.js": "sha256:d1c12ba6d8a0ffc3fd28c6900b675c4bbc9c54b6bd287d219f6e9104bfb9621e",
+    ".naome/bin/naome.js": "sha256:8a9d9ed783981ef9750021fa30e92460283775bb4a0eacdea60b63041a9c6a05",
     ".naome/package.json": "sha256:8005a3491db7d92f36ac66369861589f9c47123d3a7c71e643fc2c06168cd45a",
     ".naome/task-contract.schema.json": "sha256:1b3b62350328d0d6d660e36d1d1baaa2b88718530db774f9ab2a9e2fcba369c8",
     "AGENTS.md": "sha256:e8b2fc786c1c72b69ba8f2b2ffce4f459e799c7453ce9ff4a9f6448a8f9e6b4f",