@ornexus/neocortex 4.60.22 → 4.60.23

package/packages/shared/dist/invocation/public-diagnostics.js

@@ -0,0 +1,181 @@
+import { createHash } from 'node:crypto';
+export const INVOCATION_PUBLIC_DIAGNOSTIC_VERSION = 1;
+export const INVOCATION_DIGEST_PREFIX_LENGTH = 12;
+const SAFE_REASON = /^[a-z0-9][a-z0-9._-]{0,79}$/;
+const BYTE_BUCKETS = new Set(['0', '1-1023', '1k-16k', '16k-64k', '64k-128k', '128k-192k', '192k-256k', '256k+']);
+const FLOOR_BUCKETS = new Set(['0-9', '10-99', '100-999', '1k-10k', '10k+']);
+const INVOCATION_SHAPES = new Set([
+    'yolo-story', 'yolo-inline', 'yoloop-target', 'yoloop-session', 'yoloop-discovery',
+]);
+const TRACE_STAGES = new Set(['admission', 'input', 'shape', 'projection', 'size-guard', 'send']);
+function boundedCount(value) {
+    return Number.isSafeInteger(value) && value >= 0 ? Math.min(value, 1_000_000) : 0;
+}
+export function invocationByteBucket(bytes) {
+    const safe = boundedCount(bytes);
+    if (safe === 0)
+        return '0';
+    if (safe < 1024)
+        return '1-1023';
+    if (safe < 16 * 1024)
+        return '1k-16k';
+    if (safe < 64 * 1024)
+        return '16k-64k';
+    if (safe < 128 * 1024)
+        return '64k-128k';
+    if (safe < 192 * 1024)
+        return '128k-192k';
+    if (safe < 256 * 1024)
+        return '192k-256k';
+    return '256k+';
+}
+export function invocationFloorBucket(floor) {
+    const safe = boundedCount(floor);
+    if (safe < 10)
+        return '0-9';
+    if (safe < 100)
+        return '10-99';
+    if (safe < 1_000)
+        return '100-999';
+    if (safe < 10_000)
+        return '1k-10k';
+    return '10k+';
+}
+export function invocationDigestPrefix(domain, value) {
+    return createHash('sha256').update(`${domain}\0${value}`, 'utf8').digest('hex').slice(0, INVOCATION_DIGEST_PREFIX_LENGTH);
+}
+export function buildInputPublicDiagnostic(evidence, outcome = 'accepted', reasonCode) {
+    return Object.freeze({
+        version: 1,
+        event: 'invoke.input',
+        source: evidence.source,
+        bytesBucket: invocationByteBucket(evidence.byteLength),
+        newlineStyle: evidence.newlineStyle,
+        digestPrefix: evidence.sha256.slice(0, INVOCATION_DIGEST_PREFIX_LENGTH),
+        outcome,
+        ...(reasonCode && SAFE_REASON.test(reasonCode) ? { reasonCode } : {}),
+        publicSafe: true,
+    });
+}
+export function buildProjectionPublicDiagnostic(input) {
+    return Object.freeze({
+        version: 1,
+        event: 'invoke.projection',
+        shape: input.shape,
+        bytesBucket: invocationByteBucket(input.bytes),
+        includedEpics: boundedCount(input.includedEpics),
+        includedStories: boundedCount(input.includedStories),
+        omittedEpics: boundedCount(input.omittedEpics),
+        omittedStories: boundedCount(input.omittedStories),
+        nodes: boundedCount(input.nodes ?? input.includedStories),
+        edges: boundedCount(input.edges ?? 0),
+        cycles: boundedCount(input.cycles ?? 0),
+        outcome: input.outcome ?? 'accepted',
+        ...(input.reasonCode && SAFE_REASON.test(input.reasonCode) ? { reasonCode: input.reasonCode } : {}),
+        publicSafe: true,
+    });
+}
+export function buildProjectIdentityPublicDiagnostic(input) {
+    return Object.freeze({
+        version: 1,
+        event: 'invoke.project-identity',
+        phase: input.phase,
+        outcome: input.outcome,
+        floorBucket: invocationFloorBucket(input.floor),
+        scopeDigestPrefix: invocationDigestPrefix('nx-project-scope-v1', `${input.licenseId}\0${input.projectId}`),
+        capability: 'project-identity-migration-v1',
+        publicSafe: true,
+    });
+}
+export function buildDiagnosePublicDiagnostic(receiptStatus, attemptedEffectCount, suppressedEffectCount) {
+    return Object.freeze({
+        version: 1,
+        event: 'invoke.diagnose',
+        authority: 'strict-read-only',
+        receiptStatus,
+        attemptedEffectCount: boundedCount(attemptedEffectCount),
+        suppressedEffectCount: boundedCount(suppressedEffectCount),
+        publicSafe: true,
+    });
+}
+export function buildInvokeTracePublicDiagnostic(stages, outcome, reasonCode) {
+    const allowed = new Set(['admission', 'input', 'shape', 'projection', 'size-guard', 'send']);
+    return Object.freeze({
+        version: 1,
+        event: 'invoke.trace',
+        stages: Object.freeze([...new Set(stages.filter((stage) => allowed.has(stage)))]),
+        outcome,
+        ...(reasonCode && SAFE_REASON.test(reasonCode) ? { reasonCode } : {}),
+        publicSafe: true,
+    });
+}
+export function assertInvocationPublicDiagnosticV1(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error('INVOCATION_PUBLIC_DIAGNOSTIC_INVALID');
+    const record = value;
+    const serialized = JSON.stringify(value);
+    if (record.version !== 1 || record.publicSafe !== true || serialized.length > 4096
+        || /(rawArgs|stateSnapshot|projectRoot|licenseId|projectId|payload|preview|secret|password|privateUrl)/i.test(serialized)) {
+        throw new Error('INVOCATION_PUBLIC_DIAGNOSTIC_INVALID');
+    }
+    const exactKeys = (required, optional = []) => {
+        const allowed = new Set([...required, ...optional]);
+        const keys = Object.keys(record);
+        return required.every((key) => keys.includes(key)) && keys.every((key) => allowed.has(key));
+    };
+    const validReason = record.reasonCode === undefined
+        || (typeof record.reasonCode === 'string' && SAFE_REASON.test(record.reasonCode));
+    const validCount = (candidate) => Number.isSafeInteger(candidate)
+        && candidate >= 0 && candidate <= 1_000_000;
+    const validOutcome = record.outcome === 'accepted' || record.outcome === 'rejected';
+    let valid = false;
+    if (record.event === 'invoke.input') {
+        valid = exactKeys(['version', 'event', 'source', 'bytesBucket', 'newlineStyle', 'digestPrefix', 'outcome', 'publicSafe'], ['reasonCode'])
+            && ['args', 'stdin', 'args-file'].includes(String(record.source))
+            && BYTE_BUCKETS.has(String(record.bytesBucket))
+            && ['none', 'lf', 'crlf', 'mixed'].includes(String(record.newlineStyle))
+            && typeof record.digestPrefix === 'string' && /^[a-f0-9]{12}$/.test(record.digestPrefix)
+            && validOutcome && validReason;
+    }
+    else if (record.event === 'invoke.projection') {
+        valid = exactKeys([
+            'version', 'event', 'shape', 'bytesBucket', 'includedEpics', 'includedStories',
+            'omittedEpics', 'omittedStories', 'nodes', 'edges', 'cycles', 'outcome', 'publicSafe',
+        ], ['reasonCode'])
+            && INVOCATION_SHAPES.has(record.shape)
+            && BYTE_BUCKETS.has(String(record.bytesBucket))
+            && ['includedEpics', 'includedStories', 'omittedEpics', 'omittedStories', 'nodes', 'edges', 'cycles']
+                .every((key) => validCount(record[key]))
+            && validOutcome && validReason;
+    }
+    else if (record.event === 'invoke.project-identity') {
+        valid = exactKeys([
+            'version', 'event', 'phase', 'outcome', 'floorBucket', 'scopeDigestPrefix', 'capability', 'publicSafe',
+        ])
+            && ['prepare', 'seed', 'remote-acknowledged', 'finalize', 'reconcile'].includes(String(record.phase))
+            && ['prepared', 'seeded', 'already-seeded', 'finalized', 'rejected', 'retry'].includes(String(record.outcome))
+            && FLOOR_BUCKETS.has(String(record.floorBucket))
+            && typeof record.scopeDigestPrefix === 'string' && /^[a-f0-9]{12}$/.test(record.scopeDigestPrefix)
+            && record.capability === 'project-identity-migration-v1';
+    }
+    else if (record.event === 'invoke.diagnose') {
+        valid = exactKeys([
+            'version', 'event', 'authority', 'receiptStatus', 'attemptedEffectCount',
+            'suppressedEffectCount', 'publicSafe',
+        ])
+            && record.authority === 'strict-read-only'
+            && (record.receiptStatus === 'verified' || record.receiptStatus === 'rejected')
+            && validCount(record.attemptedEffectCount)
+            && validCount(record.suppressedEffectCount);
+    }
+    else if (record.event === 'invoke.trace') {
+        valid = exactKeys(['version', 'event', 'stages', 'outcome', 'publicSafe'], ['reasonCode'])
+            && Array.isArray(record.stages)
+            && record.stages.length <= TRACE_STAGES.size
+            && new Set(record.stages).size === record.stages.length
+            && record.stages.every((stage) => typeof stage === 'string' && TRACE_STAGES.has(stage))
+            && validOutcome && validReason;
+    }
+    if (!valid)
+        throw new Error('INVOCATION_PUBLIC_DIAGNOSTIC_INVALID');
+}

package/packages/shared/dist/invocation/state-projection.d.ts

@@ -0,0 +1,21 @@
+export declare const STATE_PROJECTION_VERSION: 2;
+export type InvocationShapeV2 = 'yolo-story' | 'yolo-inline' | 'yoloop-target' | 'yoloop-session' | 'yoloop-discovery';
+export type StructuralProjectionErrorCodeV2 = 'STRUCTURAL_TARGET_NOT_FOUND' | 'STRUCTURAL_DEPENDENCY_MISSING' | 'STRUCTURAL_DEPENDENCY_CYCLE' | 'STRUCTURAL_CONTEXT_TOO_LARGE';
+export interface StateProjectionCountsV2 {
+    readonly epics: number;
+    readonly stories: number;
+    readonly edges: number;
+}
+export type StateProjectionResultV2<TSnapshot> = {
+    readonly ok: true;
+    readonly version: typeof STATE_PROJECTION_VERSION;
+    readonly shape: InvocationShapeV2;
+    readonly snapshot: TSnapshot;
+    readonly included: StateProjectionCountsV2;
+    readonly omitted: Omit<StateProjectionCountsV2, 'edges'>;
+    readonly cycleCount: number;
+} | {
+    readonly ok: false;
+    readonly code: StructuralProjectionErrorCodeV2;
+    readonly publicDetails: Readonly<Record<string, string | number>>;
+};

package/packages/shared/dist/invocation/state-projection.js

@@ -0,0 +1 @@
+export const STATE_PROJECTION_VERSION = 2;

package/packages/shared/dist/invocation/strict-effect-receipt.d.ts

@@ -0,0 +1,12 @@
+export declare const STRICT_DIAGNOSE_RECEIPT_VERSION: 1;
+export interface StrictDiagnoseReceiptV1 {
+    readonly version: typeof STRICT_DIAGNOSE_RECEIPT_VERSION;
+    readonly authority: 'strict-read-only';
+    readonly projectBusinessMutation: false;
+    readonly attemptedEffects: readonly string[];
+    readonly suppressedEffects: readonly string[];
+    readonly inputDigest: string;
+    readonly responseDigest: string;
+}
+export declare function assertStrictDiagnoseReceiptV1(value: unknown): asserts value is StrictDiagnoseReceiptV1;
+export declare function verifyStrictDiagnoseReceiptV1(value: unknown, rawArgs: string, responseInstructions: string): asserts value is StrictDiagnoseReceiptV1;

package/packages/shared/dist/invocation/strict-effect-receipt.js

@@ -0,0 +1,43 @@
+import { SHA256_HEX_PATTERN } from './project-identity-migration.js';
+import { invokeInputSha256 } from './input-envelope.js';
+export const STRICT_DIAGNOSE_RECEIPT_VERSION = 1;
+const validEffects = (value) => Array.isArray(value)
+    && value.length <= 128
+    && value.every((entry) => typeof entry === 'string' && entry.length > 0 && entry.length <= 128);
+export function assertStrictDiagnoseReceiptV1(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error('STRICT_DIAGNOSE_RECEIPT_INVALID');
+    }
+    const candidate = value;
+    if (candidate.version !== STRICT_DIAGNOSE_RECEIPT_VERSION) {
+        throw new Error('STRICT_DIAGNOSE_RECEIPT_VERSION_UNSUPPORTED');
+    }
+    if (candidate.projectBusinessMutation !== false) {
+        throw new Error('STRICT_DIAGNOSE_RECEIPT_MUTATION_CONFLICT');
+    }
+    const expectedKeys = [
+        'attemptedEffects', 'authority', 'inputDigest', 'projectBusinessMutation',
+        'responseDigest', 'suppressedEffects', 'version',
+    ];
+    const actualKeys = Object.keys(candidate).sort();
+    if (actualKeys.length !== expectedKeys.length
+        || actualKeys.some((key, index) => key !== expectedKeys[index])
+        || candidate.authority !== 'strict-read-only'
+        || !validEffects(candidate.attemptedEffects)
+        || !validEffects(candidate.suppressedEffects)
+        || typeof candidate.inputDigest !== 'string'
+        || !SHA256_HEX_PATTERN.test(candidate.inputDigest)
+        || typeof candidate.responseDigest !== 'string'
+        || !SHA256_HEX_PATTERN.test(candidate.responseDigest)) {
+        throw new Error('STRICT_DIAGNOSE_RECEIPT_INVALID');
+    }
+}
+export function verifyStrictDiagnoseReceiptV1(value, rawArgs, responseInstructions) {
+    assertStrictDiagnoseReceiptV1(value);
+    const receipt = value;
+    if (receipt.inputDigest !== invokeInputSha256(rawArgs)
+        || receipt.responseDigest !== invokeInputSha256(responseInstructions)
+        || JSON.stringify(receipt.attemptedEffects) !== JSON.stringify(receipt.suppressedEffects)) {
+        throw new Error('STRICT_DIAGNOSE_RECEIPT_BINDING_CONFLICT');
+    }
+}

package/targets-stubs/antigravity/gemini.md

@@ -1,4 +1,4 @@
-# 🧠 Neocortex v4.60.22 | OrNexus Team
+# 🧠 Neocortex v4.60.23 | OrNexus Team
 
 This project uses Neocortex, a Development Orchestrator.
 

package/targets-stubs/antigravity/skill/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: neocortex
-description: "🧠 Neocortex v4.60.22 | OrNexus Team"
+description: "🧠 Neocortex v4.60.23 | OrNexus Team"
 ---
 
 <!--

package/targets-stubs/claude-code/neocortex-root.agent.yaml

@@ -4,7 +4,7 @@ agent:
     name: 'Neocortex Root Agent'
     title: 'Development Orchestrator (Root)'
     icon: '>'
-    version: '4.60.22'
+    version: '4.60.23'
     architecture: 'thin-client'
     module: stand-alone
     hasSidecar: false

package/targets-stubs/claude-code/neocortex-root.md

@@ -1,6 +1,6 @@
 ---
 name: neocortex-root
-description: "🧠 Neocortex Root Agent v4.60.22 | OrNexus Team"
+description: "🧠 Neocortex Root Agent v4.60.23 | OrNexus Team"
 model: opus
 color: blue
 tools:
@@ -108,7 +108,7 @@ SEMPRE que este agente for invocado, imprima o banner abaixo como PRIMEIRO outpu
 ┌────────────────────────────────────────────────────────────┐
 │                                                            │
 │       #######           N E O C O R T E X                  │
-│      ###  ########      v4.60.22                           │
+│      ###  ########      v4.60.23                           │
 │ #########      #####                                       │
 │ ##    ##############    Development Orchestrator           │
 │ ##   ###  ######  ##    OrNexus Team                       │

package/targets-stubs/claude-code/neocortex.agent.yaml

@@ -4,7 +4,7 @@ agent:
     name: 'Neocortex'
     title: 'Development Orchestrator'
     icon: '>'
-    version: '4.60.22'
+    version: '4.60.23'
     architecture: 'thin-client'
     module: stand-alone
     hasSidecar: false

package/targets-stubs/claude-code/neocortex.md

@@ -1,6 +1,6 @@
 ---
 name: neocortex
-description: "🧠 Neocortex v4.60.22 | OrNexus Team"
+description: "🧠 Neocortex v4.60.23 | OrNexus Team"
 model: opus
 color: blue
 permissionMode: bypassPermissions
@@ -104,7 +104,7 @@ SEMPRE que este agente for invocado, imprima o banner abaixo como PRIMEIRO outpu
 ┌────────────────────────────────────────────────────────────┐
 │                                                            │
 │       #######           N E O C O R T E X                  │
-│      ###  ########      v4.60.22                           │
+│      ###  ########      v4.60.23                           │
 │ #########      #####                                       │
 │ ##    ##############    Development Orchestrator           │
 │ ##   ###  ######  ##    OrNexus Team                       │

package/targets-stubs/codex/AGENTS.md

@@ -28,7 +28,7 @@ Codex built-in commands or actions.
 
 <!-- END: Plugin Conflict Prevention -->
 
-# Neocortex v4.60.22 | OrNexus Team
+# Neocortex v4.60.23 | OrNexus Team
 
 You are a Development Orchestrator. All orchestration logic is delivered by the remote Neocortex server.
 

package/targets-stubs/cursor/agent.md

@@ -1,6 +1,6 @@
 ---
 name: neocortex
-description: "🧠 Neocortex v4.60.22 | OrNexus Team"
+description: "🧠 Neocortex v4.60.23 | OrNexus Team"
 model: inherit
 readonly: false
 is_background: false
@@ -64,7 +64,7 @@ SEMPRE que este agente for invocado, imprima o banner abaixo como PRIMEIRO outpu
 ┌────────────────────────────────────────────────────────────┐
 │                                                            │
 │       #######           N E O C O R T E X                  │
-│      ###  ########      v4.60.22                           │
+│      ###  ########      v4.60.23                           │
 │ #########      #####                                       │
 │ ##    ##############    Development Orchestrator           │
 │ ##   ###  ######  ##    OrNexus Team                       │

package/targets-stubs/gemini-cli/agent.md

@@ -1,6 +1,6 @@
 ---
 name: neocortex-root
-description: "🧠 Neocortex v4.60.22 | OrNexus Team"
+description: "🧠 Neocortex v4.60.23 | OrNexus Team"
 kind: local
 tools:
   # File operations (Gemini CLI built-ins)
@@ -62,7 +62,7 @@ SEMPRE que este agente for invocado, imprima o banner abaixo como PRIMEIRO outpu
 ┌────────────────────────────────────────────────────────────┐
 │                                                            │
 │       #######           N E O C O R T E X                  │
-│      ###  ########      v4.60.22                           │
+│      ###  ########      v4.60.23                           │
 │ #########      #####                                       │
 │ ##    ##############    Development Orchestrator           │
 │ ##   ###  ######  ##    OrNexus Team                       │

package/targets-stubs/opencode/neocortex-root.md

@@ -58,7 +58,7 @@ explicit server opt-in rather than a local assumption.
 ┌────────────────────────────────────────────────────────────┐
 │                                                            │
 │       #######           N E O C O R T E X                  │
-│      ###  ########      v4.60.22                           │
+│      ###  ########      v4.60.23                           │
 │ #########      #####                                       │
 │ ##    ##############    Development Orchestrator           │
 │ ##   ###  ######  ##    OrNexus Team                       │

package/targets-stubs/vscode/neocortex.agent.md

@@ -1,6 +1,6 @@
 ---
 name: "neocortex"
-description: "Neocortex v4.60.22 | OrNexus Team"
+description: "Neocortex v4.60.23 | OrNexus Team"
 tools:
   # Read / Edit (built-in tool sets)
   - read
@@ -68,7 +68,7 @@ SEMPRE que este agente for invocado, imprima o banner abaixo como PRIMEIRO outpu
 ┌────────────────────────────────────────────────────────────┐
 │                                                            │
 │       #######           N E O C O R T E X                  │
-│      ###  ########      v4.60.22                           │
+│      ###  ########      v4.60.23                           │
 │ #########      #####                                       │
 │ ##    ##############    Development Orchestrator           │
 │ ##   ###  ######  ##    OrNexus Team                       │