@litfamily/litclaude 1.0.6 → 1.0.7

package/plugins/litclaude/lib/skill-loop/proposal-store.mjs

@@ -1,187 +0,0 @@
-import { createHash, randomUUID } from "node:crypto";
-import { lstatSync, opendirSync, readFileSync, renameSync, rmSync } from "node:fs";
-import { join } from "node:path";
-
-import {
-  atomicWriteJson,
-  canonicalSkillRootFor,
-  ensureSafeDirectoryChain,
-  PROPOSAL_MAX_BYTES,
-  readStrictJsonFile,
-  prettyJsonBytes,
-  RECORD_ID,
-  skillRootsEquivalent,
-  withSkillLoopLock,
-} from "./common.mjs";
-import { directoryIdentity, pathIdentity, sameDirectoryIdentity, samePathIdentity } from "../secure-path-read.mjs";
-import { SkillLoopProposalError, validateProposal } from "./proposal-record.mjs";
-import { recoverReviewTransactionUnlocked } from "./review-transaction.mjs";
-import { recoverSkillMutationTransactionUnlocked } from "./mutation-transaction.mjs";
-
-export const MAX_PROPOSAL_RECORDS = 256;
-const schemaError = () => new SkillLoopProposalError("PROPOSAL_SCHEMA_INVALID", "proposal does not match v1 schema");
-const proposalDirectory = (root, create) => ensureSafeDirectoryChain(root, [".litclaude", "skill-proposals"], {
-  create,
-  ErrorType: SkillLoopProposalError,
-  code: "PROPOSAL_STORE_UNSAFE",
-});
-
-export const proposalFilePath = (root, id, create = false) => {
-  if (!RECORD_ID.test(id)) throw schemaError();
-  const directory = proposalDirectory(root, create);
-  return directory === null ? null : join(directory, `${id}.json`);
-};
-
-export function readProposalRecord(root, id) {
-  const path = proposalFilePath(root, id, false);
-  if (path === null || !lstatSync(path, { throwIfNoEntry: false })) {
-    throw new SkillLoopProposalError("PROPOSAL_NOT_FOUND", "proposal was not found");
-  }
-  try {
-    const proposal = validateProposal(readStrictJsonFile(path, SkillLoopProposalError, "PROPOSAL_STORE_UNSAFE", {
-      maxBytes: PROPOSAL_MAX_BYTES,
-      parseCode: "PROPOSAL_STORE_INVALID",
-    }));
-    if (proposal.id !== id) throw new SkillLoopProposalError("PROPOSAL_STORE_INVALID", "proposal id does not match its file");
-    return proposal;
-  } catch (error) {
-    if (error instanceof SkillLoopProposalError && error.code === "PROPOSAL_STORE_UNSAFE") throw error;
-    throw new SkillLoopProposalError("PROPOSAL_STORE_INVALID", "proposal store contains an invalid record");
-  }
-}
-
-const allowedTransitions = new Set([
-  "pending->approved",
-  "pending->rejected",
-  "approved->applied",
-  "applied->rolled-back",
-  "rolled-back->rolled-back",
-]);
-
-export function transitionProposalRecordUnlocked(root, id, status, ledgerEntryId) {
-  const current = readProposalRecord(root, id);
-  if (!allowedTransitions.has(`${current.status}->${status}`)) {
-    throw new SkillLoopProposalError("PROPOSAL_TRANSITION_INVALID");
-  }
-  const next = { ...current, status };
-  if (["applied", "rolled-back"].includes(status)) next.ledgerEntryId = ledgerEntryId;
-  else delete next.ledgerEntryId;
-  validateProposal(next);
-  atomicWriteJson(proposalFilePath(root, id, false), next, SkillLoopProposalError, "PROPOSAL_STORE_UNSAFE");
-  return next;
-}
-
-export function transitionProposalRecord(root, id, status, ledgerEntryId) {
-  return withSkillLoopLock(root, "transaction", () => {
-    recoverReviewTransactionUnlocked(root);
-    recoverSkillMutationTransactionUnlocked(root);
-    return transitionProposalRecordUnlocked(root, id, status, ledgerEntryId);
-  }, SkillLoopProposalError, "PROPOSAL_STORE_UNSAFE");
-}
-
-export function queueProposal(root, proposal) {
-  return withSkillLoopLock(root, "transaction", () => {
-    recoverReviewTransactionUnlocked(root);
-    recoverSkillMutationTransactionUnlocked(root);
-    assertProposalCapacityUnlocked(root, 1);
-    return queueProposalRecordUnlocked(root, proposal).proposal;
-  },
-    SkillLoopProposalError, "PROPOSAL_STORE_UNSAFE");
-}
-
-export function queueProposalRecordUnlocked(root, proposal) {
-  const persistedProposal = normalizeProposalTargetRoot(root, proposal);
-  if (persistedProposal.status !== "pending") throw schemaError();
-  const path = proposalFilePath(root, persistedProposal.id, true);
-  if (lstatSync(path, { throwIfNoEntry: false })) throw new SkillLoopProposalError("PROPOSAL_EXISTS");
-  atomicWriteJson(path, persistedProposal, SkillLoopProposalError, "PROPOSAL_STORE_UNSAFE");
-  const written = lstatSync(path, { throwIfNoEntry: false });
-  if (!written?.isFile() || written.isSymbolicLink() || written.nlink !== 1) {
-    throw new SkillLoopProposalError("PROPOSAL_STORE_UNSAFE");
-  }
-  const bytes = prettyJsonBytes(persistedProposal);
-  return {
-    proposal: persistedProposal,
-    path,
-    identity: pathIdentity(written),
-    sha256: createHash("sha256").update(bytes).digest("hex"),
-  };
-}
-
-export function normalizeProposalTargetRoot(root, proposal) {
-  validateProposal(proposal);
-  if (!skillRootsEquivalent(root, proposal.targetRoot)) return proposal;
-  const targetRoot = canonicalSkillRootFor(root, SkillLoopProposalError, "PROPOSAL_STORE_UNSAFE");
-  if (proposal.targetRoot === targetRoot) return proposal;
-  return validateProposal({ ...proposal, targetRoot });
-}
-
-export function removeQueuedProposalRecordUnlocked(record) {
-  const current = lstatSync(record.path, { throwIfNoEntry: false });
-  if (!current?.isFile() || current.isSymbolicLink() || current.nlink !== 1
-    || !samePathIdentity(pathIdentity(current), record.identity)) {
-    throw new SkillLoopProposalError("PROPOSAL_ROLLBACK_UNSAFE");
-  }
-  const quarantine = `${record.path}.remove.${randomUUID()}`;
-  try {
-    renameSync(record.path, quarantine);
-    const moved = lstatSync(quarantine, { throwIfNoEntry: false });
-    if (!moved?.isFile() || moved.isSymbolicLink() || moved.nlink !== 1
-      || !sameDirectoryIdentity(directoryIdentity(moved), {
-        dev: record.identity.dev,
-        ino: record.identity.ino,
-        birthtimeMs: record.identity.birthtimeMs,
-      })) {
-      throw new Error("proposal identity changed");
-    }
-    if (record.sha256
-      && createHash("sha256").update(readFileSync(quarantine)).digest("hex") !== record.sha256) {
-      throw new Error("proposal contents changed");
-    }
-    rmSync(quarantine, { force: true });
-  } catch {
-    try {
-      if (!lstatSync(record.path, { throwIfNoEntry: false })
-        && lstatSync(quarantine, { throwIfNoEntry: false })) renameSync(quarantine, record.path);
-    } catch { /* Leave uncertain cleanup as a visible residue. */ }
-    throw new SkillLoopProposalError("PROPOSAL_ROLLBACK_UNSAFE");
-  }
-}
-
-function proposalEntriesBounded(root) {
-  const directory = proposalDirectory(root, false);
-  if (directory === null) return [];
-  const entries = [];
-  let handle;
-  try {
-    handle = opendirSync(directory);
-    let entry;
-    while ((entry = handle.readSync()) !== null) {
-      entries.push(entry);
-      if (entries.length > MAX_PROPOSAL_RECORDS) {
-        throw new SkillLoopProposalError("PROPOSAL_STORE_TOO_LARGE");
-      }
-    }
-  } finally {
-    handle?.closeSync();
-  }
-  return entries.sort((left, right) => left.name.localeCompare(right.name));
-}
-
-export function assertProposalCapacityUnlocked(root, addition) {
-  if (!Number.isSafeInteger(addition) || addition < 0 || addition > 3) {
-    throw new SkillLoopProposalError("PROPOSAL_STORE_INVALID");
-  }
-  const count = proposalEntriesBounded(root).length;
-  if (count + addition > MAX_PROPOSAL_RECORDS) throw new SkillLoopProposalError("PROPOSAL_STORE_FULL");
-  return count;
-}
-
-export function listProposalRecords(root) {
-  return proposalEntriesBounded(root).map((entry) => {
-    if (!entry.isFile() || entry.isSymbolicLink() || !entry.name.endsWith(".json")) {
-      throw new SkillLoopProposalError("PROPOSAL_STORE_INVALID");
-    }
-    return readProposalRecord(root, entry.name.slice(0, -5));
-  });
-}

package/plugins/litclaude/lib/skill-loop/proposals.mjs

@@ -1,26 +0,0 @@
-import { withSkillLoopLock } from "./common.mjs";
-import { SkillLoopProposalError, validateProposal } from "./proposal-record.mjs";
-import { listProposalsUnlocked, readProposalUnlocked } from "./proposal-reader.mjs";
-import { queueProposal } from "./proposal-store.mjs";
-import { recoverReviewTransactionUnlocked } from "./review-transaction.mjs";
-import { recoverSkillMutationTransactionUnlocked } from "./mutation-transaction.mjs";
-
-export { SkillLoopProposalError, validateProposal, queueProposal };
-
-export function readProposal(root, id) {
-  return withSkillLoopLock(root, "transaction", () => {
-    recoverReviewTransactionUnlocked(root);
-    recoverSkillMutationTransactionUnlocked(root);
-    return readProposalUnlocked(root, id);
-  },
-    SkillLoopProposalError, "PROPOSAL_STORE_UNSAFE");
-}
-
-export function listProposals(root, options) {
-  return withSkillLoopLock(root, "transaction", () => {
-    recoverReviewTransactionUnlocked(root);
-    recoverSkillMutationTransactionUnlocked(root);
-    return listProposalsUnlocked(root, options);
-  },
-    SkillLoopProposalError, "PROPOSAL_STORE_UNSAFE");
-}

package/plugins/litclaude/lib/skill-loop/review-runner.mjs

@@ -1,13 +0,0 @@
-#!/usr/bin/env node
-import { runReview } from "./review.mjs";
-
-const root = process.argv[2];
-if (typeof root !== "string" || process.argv.length !== 3 || process.env.LITFAMILY_SKILL_REVIEW !== "1") {
-  process.exitCode = 64;
-} else {
-  try {
-    runReview(root);
-  } catch {
-    process.exitCode = 1;
-  }
-}

package/plugins/litclaude/lib/skill-loop/review-transaction.mjs

@@ -1,358 +0,0 @@
-import { randomUUID } from "node:crypto";
-import {
-  closeSync,
-  fsyncSync,
-  lstatSync,
-  openSync,
-  renameSync,
-  unlinkSync,
-} from "node:fs";
-import { dirname, join } from "node:path";
-
-import {
-  assertRegularSingleLink,
-  atomicWriteBytes,
-  atomicWriteJson,
-  ensureSafeDirectoryChain,
-  isPlainObject,
-  parseTimestamp,
-  prettyJsonBytes,
-  readStrictJsonFile,
-  RECORD_ID,
-  requireExactKeys,
-  sha256,
-  withSkillLoopLock,
-} from "./common.mjs";
-import { recoverSkillMutationTransactionUnlocked } from "./mutation-transaction.mjs";
-
-export class SkillLoopReviewTransactionError extends Error {
-  constructor(code, message = code) {
-    super(`${code}: ${message}`);
-    this.name = "SkillLoopReviewTransactionError";
-    this.code = code;
-  }
-}
-
-const MAX_JOURNAL_BYTES = 768 * 1024;
-const MAX_RECORD_BYTES = 64 * 1024;
-const MAX_STATE_BYTES = 64 * 1024;
-const fail = (code, message) => { throw new SkillLoopReviewTransactionError(code, message); };
-
-function stateDirectory(root, create) {
-  return ensureSafeDirectoryChain(root, [".litclaude"], {
-    create,
-    ErrorType: SkillLoopReviewTransactionError,
-    code: "REVIEW_TRANSACTION_UNSAFE",
-  });
-}
-
-function proposalDirectory(root, create) {
-  return ensureSafeDirectoryChain(root, [".litclaude", "skill-proposals"], {
-    create,
-    ErrorType: SkillLoopReviewTransactionError,
-    code: "REVIEW_TRANSACTION_UNSAFE",
-  });
-}
-
-const journalPath = (root, create) => {
-  const directory = stateDirectory(root, create);
-  return directory === null ? null : join(directory, "review-transaction.json");
-};
-
-function strictBase64(value, maxBytes) {
-  if (typeof value !== "string" || value.length === 0 || value.length > Math.ceil(maxBytes / 3) * 4 + 4
-    || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/u.test(value)) {
-    fail("REVIEW_TRANSACTION_INVALID");
-  }
-  const bytes = Buffer.from(value, "base64");
-  if (bytes.length === 0 || bytes.length > maxBytes || bytes.toString("base64") !== value) {
-    fail("REVIEW_TRANSACTION_INVALID");
-  }
-  return bytes;
-}
-
-function validateIdentity(value) {
-  return value === null || (isPlainObject(value) && requireExactKeys(value, ["dev", "ino"])
-    && Number.isSafeInteger(value.dev) && value.dev >= 0
-    && Number.isSafeInteger(value.ino) && value.ino > 0);
-}
-
-function validateJournal(value) {
-  let bytes;
-  try { bytes = prettyJsonBytes(value); } catch { fail("REVIEW_TRANSACTION_INVALID"); }
-  if (bytes.length > MAX_JOURNAL_BYTES || !requireExactKeys(value, [
-    "schema", "id", "createdAt", "phase", "beforeState", "activePending", "rollbackPending",
-    "afterState", "afterPending", "proposals",
-  ]) || value.schema !== "litclaude.review-transaction/v1" || !RECORD_ID.test(value.id)
-    || parseTimestamp(value.createdAt) === null || !["prepared", "committed"].includes(value.phase)
-    || !Array.isArray(value.proposals) || value.proposals.length > 3) {
-    fail("REVIEW_TRANSACTION_INVALID");
-  }
-  for (const field of ["beforeState", "activePending", "rollbackPending", "afterState", "afterPending"]) {
-    strictBase64(value[field], MAX_STATE_BYTES);
-  }
-  const ids = new Set();
-  for (const record of value.proposals) {
-    if (!requireExactKeys(record, ["id", "content", "digest", "stageName", "finalName", "stageState", "identity"])
-      || !RECORD_ID.test(record.id) || ids.has(record.id)
-      || record.stageName !== `.${value.id}.${record.id}.staged`
-      || record.finalName !== `${record.id}.json`
-      || !["absent", "creating", "ready"].includes(record.stageState)
-      || !/^[a-f0-9]{64}$/u.test(record.digest) || !validateIdentity(record.identity)
-      || (["absent", "creating"].includes(record.stageState) && record.identity !== null)
-      || (record.stageState === "ready" && record.identity === null)
-      || (value.phase === "committed" && record.stageState !== "ready")) {
-      fail("REVIEW_TRANSACTION_INVALID");
-    }
-    const content = strictBase64(record.content, MAX_RECORD_BYTES);
-    if (sha256(content) !== record.digest) fail("REVIEW_TRANSACTION_INVALID");
-    ids.add(record.id);
-  }
-  return value;
-}
-
-function readJournalUnlocked(root) {
-  const path = journalPath(root, false);
-  if (path === null || !lstatSync(path, { throwIfNoEntry: false })) return null;
-  return validateJournal(readStrictJsonFile(
-    path,
-    SkillLoopReviewTransactionError,
-    "REVIEW_TRANSACTION_UNSAFE",
-    { maxBytes: MAX_JOURNAL_BYTES, parseCode: "REVIEW_TRANSACTION_INVALID" },
-  ));
-}
-
-function writeJournalUnlocked(root, journal) {
-  validateJournal(journal);
-  atomicWriteJson(journalPath(root, true), journal,
-    SkillLoopReviewTransactionError, "REVIEW_TRANSACTION_UNSAFE");
-  return journal;
-}
-
-function syncDirectory(path) {
-  let descriptor;
-  try {
-    descriptor = openSync(path, "r");
-    fsyncSync(descriptor);
-  } catch {
-    // Atomic writes already fsync their data; some hosts reject directory fsync.
-  } finally {
-    if (descriptor !== undefined) closeSync(descriptor);
-  }
-}
-
-function currentBytes(path, maxBytes) {
-  if (!lstatSync(path, { throwIfNoEntry: false })) return null;
-  return assertRegularSingleLink(path, SkillLoopReviewTransactionError, "REVIEW_TRANSACTION_UNSAFE", { maxBytes });
-}
-
-function exactRecordAt(path, record) {
-  const details = lstatSync(path, { throwIfNoEntry: false });
-  if (!details) return false;
-  if (!details.isFile() || details.isSymbolicLink() || details.nlink !== 1) {
-    fail("REVIEW_TRANSACTION_AMBIGUOUS");
-  }
-  if (record.identity === null
-    || details.dev !== record.identity.dev || details.ino !== record.identity.ino) {
-    fail("REVIEW_TRANSACTION_AMBIGUOUS");
-  }
-  const expected = Buffer.from(record.content, "base64");
-  const actual = assertRegularSingleLink(path, SkillLoopReviewTransactionError,
-    "REVIEW_TRANSACTION_UNSAFE", { maxBytes: MAX_RECORD_BYTES });
-  if (!actual.equals(expected)) fail("REVIEW_TRANSACTION_AMBIGUOUS");
-  return true;
-}
-
-function exactUnidentifiedRecordAt(path, record) {
-  const details = lstatSync(path, { throwIfNoEntry: false });
-  if (!details) return false;
-  if (!details.isFile() || details.isSymbolicLink() || details.nlink !== 1) {
-    fail("REVIEW_TRANSACTION_AMBIGUOUS");
-  }
-  const expected = Buffer.from(record.content, "base64");
-  const actual = assertRegularSingleLink(path, SkillLoopReviewTransactionError,
-    "REVIEW_TRANSACTION_UNSAFE", { maxBytes: MAX_RECORD_BYTES });
-  if (!actual.equals(expected)) fail("REVIEW_TRANSACTION_AMBIGUOUS");
-  return true;
-}
-
-function unlinkExactRecord(path, record) {
-  if (!exactRecordAt(path, record)) return;
-  unlinkSync(path);
-  syncDirectory(dirname(path));
-}
-
-function removeJournalUnlocked(root) {
-  const path = journalPath(root, false);
-  const details = path === null ? null : lstatSync(path, { throwIfNoEntry: false });
-  if (!details) return;
-  if (!details.isFile() || details.isSymbolicLink() || details.nlink !== 1) {
-    fail("REVIEW_TRANSACTION_UNSAFE");
-  }
-  unlinkSync(path);
-  syncDirectory(dirname(path));
-}
-
-const oneOf = (actual, candidates) => candidates.some((candidate) => actual?.equals(candidate));
-
-export function recoverReviewTransactionUnlocked(root) {
-  const journal = readJournalUnlocked(root);
-  if (journal === null) return { status: "none" };
-  const directory = proposalDirectory(root, false);
-  if (directory === null && journal.proposals.length > 0) fail("REVIEW_TRANSACTION_AMBIGUOUS");
-  const decoded = Object.fromEntries([
-    "beforeState", "activePending", "rollbackPending", "afterState", "afterPending",
-  ].map((field) => [field, Buffer.from(journal[field], "base64")]));
-  const statePath = join(stateDirectory(root, false), "skill-loop-state.json");
-  const pendingPath = join(stateDirectory(root, false), "pending-review.json");
-  const state = currentBytes(statePath, MAX_STATE_BYTES);
-  const pending = currentBytes(pendingPath, MAX_STATE_BYTES);
-
-  if (journal.phase === "committed") {
-    if (!state?.equals(decoded.afterState) || !pending?.equals(decoded.afterPending)) {
-      fail("REVIEW_TRANSACTION_AMBIGUOUS");
-    }
-    for (const record of journal.proposals) {
-      const stage = join(directory, record.stageName);
-      const final = join(directory, record.finalName);
-      if (lstatSync(stage, { throwIfNoEntry: false }) || !exactRecordAt(final, record)) {
-        fail("REVIEW_TRANSACTION_AMBIGUOUS");
-      }
-    }
-    removeJournalUnlocked(root);
-    return { status: "finalized" };
-  }
-
-  if (!oneOf(state, [decoded.beforeState, decoded.afterState])
-    || !oneOf(pending, [decoded.activePending, decoded.rollbackPending, decoded.afterPending])) {
-    fail("REVIEW_TRANSACTION_AMBIGUOUS");
-  }
-  for (const record of journal.proposals) {
-    const stage = join(directory, record.stageName);
-    const final = join(directory, record.finalName);
-    if (record.stageState === "absent") {
-      if (lstatSync(stage, { throwIfNoEntry: false }) || lstatSync(final, { throwIfNoEntry: false })) {
-        fail("REVIEW_TRANSACTION_AMBIGUOUS");
-      }
-      continue;
-    }
-    if (record.stageState === "creating") {
-      if (lstatSync(final, { throwIfNoEntry: false })) fail("REVIEW_TRANSACTION_AMBIGUOUS");
-      exactUnidentifiedRecordAt(stage, record);
-      continue;
-    }
-    const hasStage = exactRecordAt(stage, record);
-    const hasFinal = exactRecordAt(final, record);
-    if (hasStage && hasFinal) fail("REVIEW_TRANSACTION_AMBIGUOUS");
-  }
-  for (const record of [...journal.proposals].reverse()) {
-    unlinkExactRecord(join(directory, record.finalName), record);
-    if (record.stageState === "creating") {
-      const stage = join(directory, record.stageName);
-      if (exactUnidentifiedRecordAt(stage, record)) {
-        unlinkSync(stage);
-        syncDirectory(directory);
-      }
-    } else if (record.stageState === "ready") unlinkExactRecord(join(directory, record.stageName), record);
-  }
-  atomicWriteBytes(statePath, decoded.beforeState,
-    SkillLoopReviewTransactionError, "REVIEW_TRANSACTION_UNSAFE");
-  atomicWriteBytes(pendingPath, decoded.rollbackPending,
-    SkillLoopReviewTransactionError, "REVIEW_TRANSACTION_UNSAFE");
-  removeJournalUnlocked(root);
-  return { status: "rolled-back" };
-}
-
-export function recoverReviewTransaction(root) {
-  return withSkillLoopLock(root, "transaction", () => {
-    recoverSkillMutationTransactionUnlocked(root);
-    return recoverReviewTransactionUnlocked(root);
-  },
-    SkillLoopReviewTransactionError, "REVIEW_TRANSACTION_LOCK_FAILED");
-}
-
-export function beginReviewTransactionUnlocked(root, {
-  beforeState,
-  activePending,
-  rollbackPending,
-  afterState,
-  afterPending,
-  proposals,
-  now,
-}) {
-  if (readJournalUnlocked(root) !== null) fail("REVIEW_TRANSACTION_ACTIVE");
-  const id = randomUUID();
-  const journal = {
-    schema: "litclaude.review-transaction/v1",
-    id,
-    createdAt: now,
-    phase: "prepared",
-    beforeState: beforeState.toString("base64"),
-    activePending: activePending.toString("base64"),
-    rollbackPending: rollbackPending.toString("base64"),
-    afterState: afterState.toString("base64"),
-    afterPending: afterPending.toString("base64"),
-    proposals: proposals.map((proposal) => {
-      const content = prettyJsonBytes(proposal);
-      return {
-        id: proposal.id,
-        content: content.toString("base64"),
-        digest: sha256(content),
-        stageName: `.${id}.${proposal.id}.staged`,
-        finalName: `${proposal.id}.json`,
-        stageState: "absent",
-        identity: null,
-      };
-    }),
-  };
-  return writeJournalUnlocked(root, journal);
-}
-
-export function stageReviewTransactionUnlocked(root, journal, afterStageWrite, afterStageCreate) {
-  const directory = proposalDirectory(root, true);
-  for (const [index, record] of journal.proposals.entries()) {
-    const path = join(directory, record.stageName);
-    if (lstatSync(path, { throwIfNoEntry: false })) fail("REVIEW_TRANSACTION_AMBIGUOUS");
-    journal.proposals[index] = { ...record, stageState: "creating" };
-    writeJournalUnlocked(root, journal);
-    atomicWriteBytes(path, Buffer.from(record.content, "base64"),
-      SkillLoopReviewTransactionError, "REVIEW_TRANSACTION_UNSAFE");
-    afterStageCreate?.(index);
-    const details = lstatSync(path, { throwIfNoEntry: false });
-    if (!details?.isFile() || details.isSymbolicLink() || details.nlink !== 1) {
-      fail("REVIEW_TRANSACTION_UNSAFE");
-    }
-    journal.proposals[index] = {
-      ...journal.proposals[index],
-      stageState: "ready",
-      identity: { dev: details.dev, ino: details.ino },
-    };
-    writeJournalUnlocked(root, journal);
-    afterStageWrite?.(index);
-  }
-  return journal;
-}
-
-export function publishReviewTransactionUnlocked(root, journal, afterProposalWrite) {
-  const directory = proposalDirectory(root, false);
-  for (const [index, record] of journal.proposals.entries()) {
-    const stage = join(directory, record.stageName);
-    const final = join(directory, record.finalName);
-    if (!exactRecordAt(stage, record) || lstatSync(final, { throwIfNoEntry: false })) {
-      fail("REVIEW_TRANSACTION_AMBIGUOUS");
-    }
-    renameSync(stage, final);
-    syncDirectory(directory);
-    if (!exactRecordAt(final, record)) fail("REVIEW_TRANSACTION_AMBIGUOUS");
-    afterProposalWrite?.(index);
-  }
-}
-
-export function markReviewTransactionCommittedUnlocked(root, journal) {
-  journal.phase = "committed";
-  writeJournalUnlocked(root, journal);
-}
-
-export function clearReviewTransactionUnlocked(root) {
-  removeJournalUnlocked(root);
-}