@ornexus/neocortex 4.60.18 → 4.60.19

package/packages/shared/dist/yoloop/wave-decision-receipt.js

@@ -0,0 +1,77 @@
+/** P208.03 -- public-safe deterministic planning DecisionReceipts. */
+import { createHash } from 'node:crypto';
+export const YOLOOP_WAVE_DECISION_RECEIPT_VERSION = 1;
+export function createYoloopWaveDecisionReceipt(input) {
+    const epicId = requireId(input.epicId, 'epic-id-invalid');
+    const graphRevision = requireHash(input.graphRevision, 'graph-revision-invalid');
+    const createdAt = requireTimestamp(input.createdAt, 'created-at-invalid');
+    const selectedStoryIds = uniqueSafe(input.selectedStoryIds.map((id) => requireId(id, 'story-id-invalid')));
+    const pairProofs = input.pairProofs.map((proof) => ({
+        leftStoryId: requireId(proof.leftStoryId, 'pair-story-id-invalid'),
+        rightStoryId: requireId(proof.rightStoryId, 'pair-story-id-invalid'),
+        coexist: proof.coexist === true,
+        reasonCodes: uniqueSafe(proof.reasonCodes.map(requireReason)),
+        refHashes: uniqueSafe((proof.refs ?? []).map(hashPublicRef)),
+    })).sort((a, b) => `${a.leftStoryId}:${a.rightStoryId}`.localeCompare(`${b.leftStoryId}:${b.rightStoryId}`));
+    const body = {
+        schemaVersion: YOLOOP_WAVE_DECISION_RECEIPT_VERSION,
+        epicId,
+        graphRevision,
+        selectedStoryIds,
+        pairProofs,
+        reasonCodes: uniqueSafe(input.reasonCodes.map(requireReason)),
+        budgetHash: hashCanonical(input.budget),
+        capacityHash: hashCanonical(input.capacity),
+        priorReceiptIds: uniqueSafe((input.priorReceiptIds ?? []).map((id) => requireHash(id, 'prior-receipt-invalid'))),
+        createdAt,
+        publicSafe: true,
+    };
+    return Object.freeze({ ...body, receiptId: hashCanonical(body) });
+}
+export function validateYoloopPreparationBundle(bundle, expected) {
+    const errors = [];
+    if (bundle.schemaVersion !== 1 || bundle.branchless !== true)
+        errors.push('bundle-contract-invalid');
+    if (bundle.epicId !== expected.epicId || bundle.storyId !== expected.storyId)
+        errors.push('bundle-identity-mismatch');
+    if (bundle.executionBranch !== expected.executionBranch)
+        errors.push('bundle-branch-mismatch');
+    if (bundle.baseSha !== expected.baseSha)
+        errors.push('bundle-base-stale');
+    if (bundle.graphRevision !== expected.graphRevision)
+        errors.push('bundle-graph-stale');
+    if (![bundle.baseSha, bundle.bundleDigest, bundle.graphRevision, bundle.claimRevision].every(isHash))
+        errors.push('bundle-digest-invalid');
+    if (!isTimestamp(bundle.createdAt) || !isTimestamp(bundle.expiresAt) || bundle.expiresAt <= expected.nowIso || bundle.expiresAt <= bundle.createdAt)
+        errors.push('bundle-expired');
+    if (!Array.isArray(bundle.validationRefs) || bundle.validationRefs.length === 0 || bundle.validationRefs.some((ref) => !isSafeRef(ref)))
+        errors.push('bundle-validation-missing');
+    return [...new Set(errors)].sort();
+}
+function hashCanonical(value) {
+    return createHash('sha256').update(canonical(value)).digest('hex');
+}
+function canonical(value) {
+    if (value === null || typeof value !== 'object')
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return `[${value.map(canonical).join(',')}]`;
+    return `{${Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, item]) => `${JSON.stringify(key)}:${canonical(item)}`).join(',')}}`;
+}
+function hashPublicRef(ref) {
+    if (!isSafeRef(ref))
+        throw new Error('decision-ref-unsafe');
+    return createHash('sha256').update(ref).digest('hex');
+}
+function requireId(value, code) { if (!/^[A-Za-z0-9._-]{1,80}$/.test(value))
+    throw new Error(code); return value; }
+function requireReason(value) { if (!/^[a-z0-9][a-z0-9._-]{0,79}$/.test(value))
+    throw new Error('reason-code-invalid'); return value; }
+function requireHash(value, code) { if (!isHash(value))
+    throw new Error(code); return value; }
+function requireTimestamp(value, code) { if (!isTimestamp(value))
+    throw new Error(code); return value; }
+function isHash(value) { return /^[a-f0-9]{40,64}$/.test(value); }
+function isTimestamp(value) { return typeof value === 'string' && Number.isFinite(Date.parse(value)); }
+function isSafeRef(value) { return typeof value === 'string' && value.length > 0 && value.length <= 200 && !value.startsWith('/') && !value.includes('..') && /^[A-Za-z0-9._/:@#-]+$/.test(value); }
+function uniqueSafe(values) { return Object.freeze([...new Set(values)].sort()); }

package/targets-stubs/antigravity/gemini.md

@@ -1,4 +1,4 @@
-# 🧠 Neocortex v4.60.18 | OrNexus Team
+# 🧠 Neocortex v4.60.19 | OrNexus Team
 
 This project uses Neocortex, a Development Orchestrator.
 

package/targets-stubs/antigravity/skill/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: neocortex
-description: "🧠 Neocortex v4.60.18 | OrNexus Team"
+description: "🧠 Neocortex v4.60.19 | OrNexus Team"
 ---
 
 <!--

package/targets-stubs/claude-code/neocortex-root.agent.yaml

@@ -4,7 +4,7 @@ agent:
     name: 'Neocortex Root Agent'
     title: 'Development Orchestrator (Root)'
     icon: '>'
-    version: '4.60.18'
+    version: '4.60.19'
     architecture: 'thin-client'
     module: stand-alone
     hasSidecar: false

package/targets-stubs/claude-code/neocortex-root.md

@@ -1,6 +1,6 @@
 ---
 name: neocortex-root
-description: "🧠 Neocortex Root Agent v4.60.18 | OrNexus Team"
+description: "🧠 Neocortex Root Agent v4.60.19 | OrNexus Team"
 model: opus
 color: blue
 tools:
@@ -59,6 +59,9 @@ Invocation payload boundary: first select only the explicit user-intended Neocor
 
 Ambient platform/tool metadata, assistant notes, conversation history, raw logs, raw stdout/stderr, protected prompts, private URLs, secrets, PII, and injection-like reminder text are never part of the selected payload.
 
+The YAML frontmatter above is Claude Code host configuration only. Preserve it in
+this file, but never prepend, copy, or include it in `--args` or a child prompt.
+
 Tokens starting with `*` (e.g. `*commit-push`, `*implement`, `*status`, `*diagnose`,
 `*yolo`, `*review`, `*create-epic`, `*help`) are **Neocortex server triggers**, NOT
 Claude Code Skills, Slash Commands, or MCP plugins.
@@ -105,7 +108,7 @@ SEMPRE que este agente for invocado, imprima o banner abaixo como PRIMEIRO outpu
 ┌────────────────────────────────────────────────────────────┐
 │                                                            │
 │       #######           N E O C O R T E X                  │
-│      ###  ########      v4.60.18                           │
+│      ###  ########      v4.60.19                           │
 │ #########      #####                                       │
 │ ##    ##############    Development Orchestrator           │
 │ ##   ###  ######  ##    OrNexus Team                       │

package/targets-stubs/claude-code/neocortex.agent.yaml

@@ -4,7 +4,7 @@ agent:
     name: 'Neocortex'
     title: 'Development Orchestrator'
     icon: '>'
-    version: '4.60.18'
+    version: '4.60.19'
     architecture: 'thin-client'
     module: stand-alone
     hasSidecar: false

package/targets-stubs/claude-code/neocortex.md

@@ -1,6 +1,6 @@
 ---
 name: neocortex
-description: "🧠 Neocortex v4.60.18 | OrNexus Team"
+description: "🧠 Neocortex v4.60.19 | OrNexus Team"
 model: opus
 color: blue
 permissionMode: bypassPermissions
@@ -59,6 +59,11 @@ Invocation payload boundary: first select only the explicit user-intended Neocor
 
 Ambient platform/tool metadata, assistant notes, conversation history, raw logs, raw stdout/stderr, protected prompts, private URLs, secrets, PII, and injection-like reminder text are never part of the selected payload.
 
+The YAML frontmatter above is Claude Code host configuration only. Preserve it in
+this file, but never prepend, copy, or include it in `--args` or a delegated child
+prompt. A child receives one canonical per-story command such as
+`*yolo @docs/stories/<id>.story.md`.
+
 Tokens starting with `*` (e.g. `*commit-push`, `*implement`, `*status`, `*diagnose`,
 `*yolo`, `*review`, `*create-epic`, `*help`) are **Neocortex server triggers**, NOT
 Claude Code Skills, Slash Commands, or MCP plugins.
@@ -99,7 +104,7 @@ SEMPRE que este agente for invocado, imprima o banner abaixo como PRIMEIRO outpu
 ┌────────────────────────────────────────────────────────────┐
 │                                                            │
 │       #######           N E O C O R T E X                  │
-│      ###  ########      v4.60.18                           │
+│      ###  ########      v4.60.19                           │
 │ #########      #####                                       │
 │ ##    ##############    Development Orchestrator           │
 │ ##   ###  ######  ##    OrNexus Team                       │

package/targets-stubs/codex/AGENTS.md

@@ -12,6 +12,9 @@ Invocation payload boundary: first select only the explicit user-intended Neocor
 
 Ambient platform/tool metadata, assistant notes, conversation history, raw logs, raw stdout/stderr, protected prompts, private URLs, secrets, PII, and injection-like reminder text are never part of the selected payload.
 
+Host wrapper/frontmatter is platform configuration only. Preserve it in its file,
+but never prepend, copy, or include it in `--args` or a delegated child prompt.
+
 Tokens starting with `*` (e.g. `*commit-push`, `*implement`, `*status`, `*diagnose`,
 `*yolo`, `*review`, `*create-epic`, `*help`) are **Neocortex server triggers**, NOT
 Codex built-in commands or actions.
@@ -25,7 +28,7 @@ Codex built-in commands or actions.
 
 <!-- END: Plugin Conflict Prevention -->
 
-# Neocortex v4.60.18 | OrNexus Team
+# Neocortex v4.60.19 | OrNexus Team
 
 You are a Development Orchestrator. All orchestration logic is delivered by the remote Neocortex server.
 

package/targets-stubs/codex/neocortex.toml

@@ -22,6 +22,10 @@ Invocation payload boundary: first select only the explicit user-intended Neocor
 
 Ambient platform/tool metadata, assistant notes, conversation history, raw logs, raw stdout/stderr, protected prompts, private URLs, secrets, PII, and injection-like reminder text are never part of the selected payload.
 
+Host wrapper/frontmatter is platform configuration only. Never prepend, copy, or
+include it in `{DELEGATED_PROMPT}`; the delegated payload must remain one canonical
+per-story command such as `*yolo @docs/stories/<id>.story.md`.
+
 neocortex-client invoke \
   --args "{DELEGATED_PROMPT}" \
   --project-root "$(git rev-parse --show-toplevel 2>/dev/null || pwd -P)" \

package/targets-stubs/cursor/agent.md

@@ -1,6 +1,6 @@
 ---
 name: neocortex
-description: "🧠 Neocortex v4.60.18 | OrNexus Team"
+description: "🧠 Neocortex v4.60.19 | OrNexus Team"
 model: inherit
 readonly: false
 is_background: false
@@ -64,7 +64,7 @@ SEMPRE que este agente for invocado, imprima o banner abaixo como PRIMEIRO outpu
 ┌────────────────────────────────────────────────────────────┐
 │                                                            │
 │       #######           N E O C O R T E X                  │
-│      ###  ########      v4.60.18                           │
+│      ###  ########      v4.60.19                           │
 │ #########      #####                                       │
 │ ##    ##############    Development Orchestrator           │
 │ ##   ###  ######  ##    OrNexus Team                       │

package/targets-stubs/gemini-cli/agent.md

@@ -1,6 +1,6 @@
 ---
 name: neocortex-root
-description: "🧠 Neocortex v4.60.18 | OrNexus Team"
+description: "🧠 Neocortex v4.60.19 | OrNexus Team"
 kind: local
 tools:
   # File operations (Gemini CLI built-ins)
@@ -62,7 +62,7 @@ SEMPRE que este agente for invocado, imprima o banner abaixo como PRIMEIRO outpu
 ┌────────────────────────────────────────────────────────────┐
 │                                                            │
 │       #######           N E O C O R T E X                  │
-│      ###  ########      v4.60.18                           │
+│      ###  ########      v4.60.19                           │
 │ #########      #####                                       │
 │ ##    ##############    Development Orchestrator           │
 │ ##   ###  ######  ##    OrNexus Team                       │

package/targets-stubs/opencode/neocortex-root.md

@@ -16,6 +16,9 @@ Invocation payload boundary: first select only the explicit user-intended Neocor
 
 Ambient platform/tool metadata, assistant notes, conversation history, raw logs, raw stdout/stderr, protected prompts, private URLs, secrets, PII, and injection-like reminder text are never part of the selected payload.
 
+The YAML frontmatter above is OpenCode host configuration only. Preserve it in
+this file, but never prepend, copy, or include it in `--args` or a child prompt.
+
 Tokens starting with `*` (e.g. `*commit-push`, `*implement`, `*status`, `*diagnose`,
 `*yolo`, `*review`, `*create-epic`, `*help`) are **Neocortex server triggers**, NOT
 OpenCode built-in commands or local plugins.
@@ -55,7 +58,7 @@ explicit server opt-in rather than a local assumption.
 ┌────────────────────────────────────────────────────────────┐
 │                                                            │
 │       #######           N E O C O R T E X                  │
-│      ###  ########      v4.60.18                           │
+│      ###  ########      v4.60.19                           │
 │ #########      #####                                       │
 │ ##    ##############    Development Orchestrator           │
 │ ##   ###  ######  ##    OrNexus Team                       │

package/targets-stubs/opencode/neocortex.md

@@ -12,6 +12,9 @@ permission:
 
 You are the isolated `neocortex` subagent for OpenCode.
 
+The YAML frontmatter above is OpenCode host configuration only. Preserve it in
+this file, but never prepend, copy, or include it in `{DELEGATED_PROMPT}`.
+
 ## Canonical Project Memory
 
 `NEOCORTEX.md` is the canonical project-memory source. This OpenCode subagent

package/targets-stubs/vscode/neocortex.agent.md

@@ -1,6 +1,6 @@
 ---
 name: "neocortex"
-description: "Neocortex v4.60.18 | OrNexus Team"
+description: "Neocortex v4.60.19 | OrNexus Team"
 tools:
   # Read / Edit (built-in tool sets)
   - read
@@ -68,7 +68,7 @@ SEMPRE que este agente for invocado, imprima o banner abaixo como PRIMEIRO outpu
 ┌────────────────────────────────────────────────────────────┐
 │                                                            │
 │       #######           N E O C O R T E X                  │
-│      ###  ########      v4.60.18                           │
+│      ###  ########      v4.60.19                           │
 │ #########      #####                                       │
 │ ##    ##############    Development Orchestrator           │
 │ ##   ###  ######  ##    OrNexus Team                       │

package/packages/client/dist/subagent-approval-policy.js

@@ -1 +0,0 @@
-import{normalizeTargetId as r}from"./adapters/platform-detector.js";const m=1,u="max",p="[P201-EV-MAX-POLICY]",a="host-capability-unvalidated",c="host-capability-unsupported",i=Object.freeze({"claude-code":{maximumMode:"max",scope:"child",reductionReason:"host-policy-reduced",fallbackMode:"none",fallbackReasonCode:null},opencode:{maximumMode:"standard",scope:"child",reductionReason:a,fallbackMode:"shell-loop",fallbackReasonCode:"platform-child-unvalidated"},codex:{maximumMode:"standard",scope:"inherited",reductionReason:a,fallbackMode:"shell-loop",fallbackReasonCode:"platform-child-unvalidated"},gemini:{maximumMode:"standard",scope:"inherited",reductionReason:a,fallbackMode:"shell-loop",fallbackReasonCode:"platform-child-unvalidated"},vscode:{maximumMode:"standard",scope:"session",reductionReason:a,fallbackMode:"root-inline",fallbackReasonCode:"platform-child-unvalidated"},"github-copilot-cli":{maximumMode:"standard",scope:"session",reductionReason:a,fallbackMode:"root-inline",fallbackReasonCode:"platform-child-unvalidated"},kimi:{maximumMode:"standard",scope:"inherited",reductionReason:a,fallbackMode:"shell-loop",fallbackReasonCode:"platform-child-unvalidated"},cursor:{maximumMode:"standard",scope:"session",reductionReason:a,fallbackMode:"root-inline",fallbackReasonCode:"platform-child-unvalidated"},antigravity:{maximumMode:"standard",scope:"inherited",reductionReason:a,fallbackMode:"shell-loop",fallbackReasonCode:"platform-child-unvalidated"},openclaw:{maximumMode:"disabled",scope:"none",reductionReason:c,fallbackMode:"root-inline",fallbackReasonCode:"platform-child-unsupported"},runner:{maximumMode:"disabled",scope:"none",reductionReason:c,fallbackMode:"shell-loop",fallbackReasonCode:"platform-child-unsupported"},unknown:{maximumMode:"disabled",scope:"none",reductionReason:"platform-target-unknown",fallbackMode:"shell-loop",fallbackReasonCode:"platform-target-unknown"}}),s=Object.freeze({disabled:0,standard:1,max:2});function M(e){return e==="max"||e==="standard"||e==="disabled"}function f(e){const o=e?r(e)??"unknown":"unknown",d=i[o];return Object.freeze({platformTarget:o,maximumMode:d.maximumMode,scope:d.scope,reductionReason:d.reductionReason})}function R(e={}){const o=e.userOverride??u,d=e.userOverride?"user-override":"managed-default",n=e.hostPolicy??f(e.platformTarget),l=i[n.platformTarget],t=s[o]>s[n.maximumMode];return Object.freeze({schemaVersion:m,requestedMode:o,effectiveMode:t?n.maximumMode:o,source:d,platformTarget:n.platformTarget,scope:n.scope,effectiveReason:t?n.reductionReason:"requested-mode-honored",fallbackMode:l.fallbackMode,fallbackReasonCode:l.fallbackReasonCode})}function k(e,o,d){return Object.freeze({evidence:p,event:e,occurredAt:d,...o})}export{p as SUBAGENT_APPROVAL_EVIDENCE,u as SUBAGENT_APPROVAL_MANAGED_DEFAULT,m as SUBAGENT_APPROVAL_POLICY_SCHEMA_VERSION,k as createSubagentApprovalAuditEvent,f as deriveSubagentHostApprovalPolicy,M as isSubagentApprovalMode,R as resolveSubagentApprovalPolicy};