@ornexus/neocortex 4.60.58 → 4.60.60

package/packages/shared/dist/planning/diagnosis-state.js

@@ -0,0 +1,143 @@
+/**
+ * Physical P01 state projection shared by the server policy and the client CAS.
+ * This is deliberately not an acceptance decision: callers must establish the
+ * durable claim, independently accepted checkpoint and exact source revision.
+ */
+import { createHash } from 'node:crypto';
+import { isDeepStrictEqual } from 'node:util';
+function record(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+const SCALARS = ['goal', 'problem', 'desiredOutcome', 'rawIntent'];
+const LISTS = ['context', 'users', 'surfaces', 'constraints', 'assumptions', 'risks', 'nonGoals',
+    'validationExpectations', 'debtRefs', 'repositoryEvidencePaths', 'journeyIds', 'screenIds',
+    'storybookStoryIds', 'backendContractIds', 'featureBlockerIds', 'remediationRefs'];
+const BOOLEANS = ['uiScope', 'remediationStory'];
+const EXAMPLE_KEYS = ['id', 'title', 'actor', 'given', 'when', 'then', 'source',
+    'coveredRequirement', 'expectedValidation'];
+const CONTRACT_KEYS = ['id', 'kind', 'description', 'path'];
+const UNSAFE = /(?:[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}|https?:\/\/(?:localhost|127\.0\.0\.1|10\.\d+\.\d+\.\d+|192\.168\.\d+\.\d+|172\.(?:1[6-9]|2\d|3[0-1])\.\d+\.\d+|[^\s/]*internal[^\s/]*)\S*|sk-[A-Za-z0-9_-]{12,})/i;
+const INLINE_SECRET = /(?:token|api[_-]?key|secret|password|credential|license[_-]?key)\s*[:=]\s*\S+/i;
+const PRIVATE_CONTENT = /(?:customer\s+pii|private\s+prompt|system\s+prompt|developer\s+prompt|raw\s+vendor\s+corpus|begin\s+raw\s+logs?)/i;
+function safeText(value, max = 512) {
+    if (typeof value !== 'string' || value.length > max
+        || /[\x00-\x08\x0b\x0c\x0e-\x1f]/.test(value)
+        || UNSAFE.test(value) || INLINE_SECRET.test(value) || PRIVATE_CONTENT.test(value)) {
+        throw new Error('planning-unsafe-text');
+    }
+    return value;
+}
+function allowedKeys(value, allowed) {
+    if (Object.keys(value).some((key) => !allowed.includes(key)))
+        throw new Error('planning-unknown-field');
+}
+/** Stable revision input shared by the server and the physical root checkpoint. */
+export function canonicalPlanningIntake(value) {
+    if (!record(value) || Buffer.byteLength(JSON.stringify(value)) > 16_384) {
+        throw new Error('planning-intake-shape');
+    }
+    allowedKeys(value, [...SCALARS, ...LISTS, ...BOOLEANS, 'examples', 'contracts']);
+    const result = {};
+    for (const key of SCALARS)
+        if (value[key] !== undefined)
+            result[key] = safeText(value[key]);
+    for (const key of LISTS)
+        if (value[key] !== undefined) {
+            const entries = value[key];
+            if (!Array.isArray(entries) || entries.length > 32)
+                throw new Error('planning-list-shape');
+            result[key] = entries.map((entry) => safeText(entry, 256));
+        }
+    for (const key of BOOLEANS)
+        if (value[key] !== undefined) {
+            if (typeof value[key] !== 'boolean')
+                throw new Error('planning-boolean-shape');
+            result[key] = value[key];
+        }
+    for (const [key, allowed] of [['examples', EXAMPLE_KEYS], ['contracts', CONTRACT_KEYS]]) {
+        if (value[key] === undefined)
+            continue;
+        const entries = value[key];
+        if (!Array.isArray(entries) || entries.length > 16)
+            throw new Error('planning-record-list-shape');
+        result[key] = entries.map((entry) => {
+            if (!record(entry))
+                throw new Error('planning-record-shape');
+            allowedKeys(entry, allowed);
+            const copy = {};
+            for (const field of allowed)
+                if (entry[field] !== undefined)
+                    copy[field] = safeText(entry[field], 256);
+            return copy;
+        });
+    }
+    return result;
+}
+export function planningIntakeRevision(value) {
+    return createHash('sha256').update(JSON.stringify(canonicalPlanningIntake(value))).digest('hex');
+}
+/** A consistency digest only. The caller must separately establish independent QA. */
+export function createPlanningReceiptV1(input) {
+    const summary = input.artifactSummary;
+    if (!/^P[1-9][0-9]{0,11}$/.test(input.epicId)
+        || !/^[a-f0-9]{64}$/.test(input.intakeRevision)
+        || input.accepted !== true || !['diagnosis', 'research'].includes(input.kind)
+        || typeof summary !== 'string' || !summary.trim() || summary.length > 1024
+        || /[\x00-\x08\x0b\x0c\x0e-\x1f]/.test(summary)
+        || /^\s*(?:docs\/|\.neocortex\/|https?:\/)/i.test(summary)
+        || UNSAFE.test(summary) || INLINE_SECRET.test(summary) || PRIVATE_CONTENT.test(summary)
+        || input.kind === 'diagnosis' && input.predecessorReceiptId !== undefined
+        || input.kind === 'research' && !/^[a-f0-9]{64}$/.test(input.predecessorReceiptId ?? '')) {
+        throw new Error('planning-receipt-invalid');
+    }
+    const base = { schemaVersion: 1, kind: input.kind, epicId: input.epicId,
+        intakeRevision: input.intakeRevision, artifactSummary: summary,
+        artifactDigest: createHash('sha256').update(summary).digest('hex'),
+        ...(input.predecessorReceiptId ? { predecessorReceiptId: input.predecessorReceiptId } : {}),
+        accepted: true };
+    return { ...base, receiptId: createHash('sha256').update(JSON.stringify(base)).digest('hex') };
+}
+export function projectDiagnosedEpicState(currentState, input) {
+    const checkpoint = input.checkpoint;
+    if (currentState.schema_version !== 1 || !record(currentState.epics) || !record(currentState.stories)
+        || !/^P[1-9][0-9]{0,11}$/.test(input.epicId)
+        || !/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(input.claimId)
+        || !record(checkpoint) || checkpoint.schemaVersion !== 1
+        || checkpoint.epicId !== input.epicId || !record(checkpoint.intake)
+        || typeof checkpoint.intake.goal !== 'string'
+        || !checkpoint.intake.goal.trim() || checkpoint.intake.goal.length > 512
+        || typeof checkpoint.intakeRevision !== 'string'
+        || !/^[a-f0-9]{64}$/.test(checkpoint.intakeRevision)
+        || !record(checkpoint.diagnosisReceipt)) {
+        throw new Error('planning-diagnosis-identity-invalid');
+    }
+    const ledger = currentState.epic_id_ledger === undefined
+        ? { schema_version: 1, reserved_ids: [] }
+        : currentState.epic_id_ledger;
+    if (!record(ledger) || ledger.schema_version !== 1
+        || !Array.isArray(ledger.reserved_ids) || ledger.reserved_ids.length > 4096
+        || ledger.reserved_ids.some((id) => typeof id !== 'string' || !/^P[1-9][0-9]{0,11}$/.test(id))
+        || new Set(ledger.reserved_ids).size !== ledger.reserved_ids.length) {
+        throw new Error('planning-diagnosis-ledger-invalid');
+    }
+    const epic = {
+        id: input.epicId, title: checkpoint.intake.goal, status: 'diagnosed',
+        source: 'create-epic', stories: [],
+        createEpicPlanningClaim: { schemaVersion: 1, claimId: input.claimId, epicId: input.epicId },
+        createEpicPlanning: checkpoint,
+    };
+    const epics = currentState.epics;
+    if (Object.hasOwn(epics, input.epicId)) {
+        if (isDeepStrictEqual(epics[input.epicId], epic) && ledger.reserved_ids.includes(input.epicId)) {
+            return currentState;
+        }
+        throw new Error('planning-diagnosis-epic-conflict');
+    }
+    if (ledger.reserved_ids.includes(input.epicId))
+        throw new Error('planning-diagnosis-ledger-conflict');
+    return {
+        ...currentState,
+        epics: { ...epics, [input.epicId]: epic },
+        epic_id_ledger: { ...ledger, reserved_ids: [...ledger.reserved_ids, input.epicId] },
+    };
+}

package/packages/shared/dist/yoloop/branch-unit.js

@@ -9,6 +9,13 @@ const LEGACY_INTEGRATION_STEPS = new Set([
     'step-c-11-review-pr',
     'step-c-12-merge-pr',
 ]);
+/** Do not let a stale epic story list hide physical progress in the snapshot. */
+export function resolveEpicStoryIds(epicId, listedStoryIds, snapshotStoryIds) {
+    return [...new Set([
+            ...(listedStoryIds ?? []),
+            ...snapshotStoryIds.filter((id) => id.startsWith(`${epicId}.`)),
+        ])];
+}
 /** Resolve once from persisted state. Existing Git progress always wins. */
 export function resolveBranchUnit(epic, stories) {
     const legacyProgress = stories.some(hasLegacyStoryGitProgress);
@@ -64,7 +71,8 @@ export function reconcileStoryCheckpoint(current, requested) {
         current.graphRevision === requested.graphRevision &&
         current.claimRevision === requested.claimRevision &&
         sameEvidenceReceipt(current.qaReceipt, requested.qaReceipt) &&
-        sameEvidenceReceipt(current.reviewReceipt, requested.reviewReceipt))
+        sameEvidenceReceipt(current.reviewReceipt, requested.reviewReceipt) &&
+        JSON.stringify(current.reviewReconciliation ?? null) === JSON.stringify(requested.reviewReconciliation ?? null))
         return { kind: 'reused', checkpoint: current };
     return { kind: 'blocked', reasonCode: 'checkpoint-idempotency-conflict' };
 }
@@ -183,6 +191,7 @@ function validateCheckpointEvidence(checkpoint) {
         else if (review.schemaVersion !== 1 || review.kind !== 'story_review_evidence'
             || review.producer !== 'root-commit-range-review' || review.verdict !== checkpoint.reviewVerdict
             || !evidenceBindingMatches(checkpoint, review) || !isHash(review.sourceEvidenceDigest)
+            || (review.reviewArtifactDigest !== undefined && !isHash(review.reviewArtifactDigest))
             || !nonEmpty(review.receiptRef) || review.receiptRef !== `story-review:${review.sourceEvidenceDigest}`
             || !Number.isFinite(Date.parse(review.reviewedAt))) {
             errors.push('checkpoint-review-evidence-invalid');
@@ -201,6 +210,19 @@ function validateCheckpointEvidence(checkpoint) {
         if (Date.parse(review.reviewedAt) < Date.parse(qa.checkedAt))
             errors.push('checkpoint-review-before-qa');
     }
+    const reconciliation = checkpoint.reviewReconciliation;
+    if (reconciliation && (!qa || !review || reconciliation.schemaVersion !== 1
+        || reconciliation.kind !== 'historical_review_reconciliation'
+        || reconciliation.storyId !== checkpoint.storyId || reconciliation.epicId !== checkpoint.epicId
+        || reconciliation.checkpointHeadSha !== checkpoint.headSha
+        || !isSha(reconciliation.approvalCommitSha)
+        || !isHash(reconciliation.approvalArtifactDigest) || !isHash(reconciliation.sourceEvidenceDigest)
+        || reconciliation.qaReceiptRef !== qa.receiptRef || reconciliation.reviewReceiptRef !== review.receiptRef
+        || reconciliation.receiptRef !== `story-review-reconciliation:${reconciliation.sourceEvidenceDigest}`
+        || !checkpoint.receiptRefs.includes(reconciliation.receiptRef)
+        || !Number.isFinite(Date.parse(reconciliation.reviewedAt)))) {
+        errors.push('checkpoint-review-reconciliation-invalid');
+    }
     return errors;
 }
 function evidenceBindingMatches(checkpoint, evidence) {

package/targets-stubs/antigravity/gemini.md

@@ -1,4 +1,4 @@
-# 🧠 Neocortex v4.60.58 | OrNexus Team
+# 🧠 Neocortex v4.60.60 | OrNexus Team
 
 This project uses Neocortex, a Development Orchestrator.
 

package/targets-stubs/antigravity/skill/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: neocortex
-description: "🧠 Neocortex v4.60.58 | OrNexus Team"
+description: "🧠 Neocortex v4.60.60 | OrNexus Team"
 ---
 
 <!--

package/targets-stubs/claude-code/neocortex-root.agent.yaml

@@ -4,7 +4,7 @@ agent:
     name: 'Neocortex Root Agent'
     title: 'Development Orchestrator (Root)'
     icon: '>'
-    version: '4.60.58'
+    version: '4.60.60'
     architecture: 'thin-client'
     module: stand-alone
     hasSidecar: false

package/targets-stubs/claude-code/neocortex-root.md

@@ -1,6 +1,6 @@
 ---
 name: neocortex-root
-description: "🧠 Neocortex Root Agent v4.60.58 | OrNexus Team"
+description: "🧠 Neocortex Root Agent v4.60.60 | OrNexus Team"
 model: opus
 color: blue
 tools:
@@ -108,7 +108,7 @@ SEMPRE que este agente for invocado, imprima o banner abaixo como PRIMEIRO outpu
 ┌────────────────────────────────────────────────────────────┐
 │                                                            │
 │       #######           N E O C O R T E X                  │
-│      ###  ########      v4.60.58                           │
+│      ###  ########      v4.60.60                           │
 │ #########      #####                                       │
 │ ##    ##############    Development Orchestrator           │
 │ ##   ###  ######  ##    OrNexus Team                       │

package/targets-stubs/claude-code/neocortex.agent.yaml

@@ -4,7 +4,7 @@ agent:
     name: 'Neocortex'
     title: 'Development Orchestrator'
     icon: '>'
-    version: '4.60.58'
+    version: '4.60.60'
     architecture: 'thin-client'
     module: stand-alone
     hasSidecar: false

package/targets-stubs/claude-code/neocortex.md

@@ -1,6 +1,6 @@
 ---
 name: neocortex
-description: "🧠 Neocortex v4.60.58 | OrNexus Team"
+description: "🧠 Neocortex v4.60.60 | OrNexus Team"
 model: opus
 color: blue
 permissionMode: bypassPermissions
@@ -104,7 +104,7 @@ SEMPRE que este agente for invocado, imprima o banner abaixo como PRIMEIRO outpu
 ┌────────────────────────────────────────────────────────────┐
 │                                                            │
 │       #######           N E O C O R T E X                  │
-│      ###  ########      v4.60.58                           │
+│      ###  ########      v4.60.60                           │
 │ #########      #####                                       │
 │ ##    ##############    Development Orchestrator           │
 │ ##   ###  ######  ##    OrNexus Team                       │

package/targets-stubs/codex/AGENTS.md

@@ -28,7 +28,7 @@ Codex built-in commands or actions.
 
 <!-- END: Plugin Conflict Prevention -->
 
-# Neocortex v4.60.58 | OrNexus Team
+# Neocortex v4.60.60 | OrNexus Team
 
 You are a Development Orchestrator. All orchestration logic is delivered by the remote Neocortex server.
 

package/targets-stubs/cursor/agent.md

@@ -1,6 +1,6 @@
 ---
 name: neocortex
-description: "🧠 Neocortex v4.60.58 | OrNexus Team"
+description: "🧠 Neocortex v4.60.60 | OrNexus Team"
 model: inherit
 readonly: false
 is_background: false
@@ -64,7 +64,7 @@ SEMPRE que este agente for invocado, imprima o banner abaixo como PRIMEIRO outpu
 ┌────────────────────────────────────────────────────────────┐
 │                                                            │
 │       #######           N E O C O R T E X                  │
-│      ###  ########      v4.60.58                           │
+│      ###  ########      v4.60.60                           │
 │ #########      #####                                       │
 │ ##    ##############    Development Orchestrator           │
 │ ##   ###  ######  ##    OrNexus Team                       │

package/targets-stubs/gemini-cli/agent.md

@@ -1,6 +1,6 @@
 ---
 name: neocortex-root
-description: "🧠 Neocortex v4.60.58 | OrNexus Team"
+description: "🧠 Neocortex v4.60.60 | OrNexus Team"
 kind: local
 tools:
   # File operations (Gemini CLI built-ins)
@@ -62,7 +62,7 @@ SEMPRE que este agente for invocado, imprima o banner abaixo como PRIMEIRO outpu
 ┌────────────────────────────────────────────────────────────┐
 │                                                            │
 │       #######           N E O C O R T E X                  │
-│      ###  ########      v4.60.58                           │
+│      ###  ########      v4.60.60                           │
 │ #########      #####                                       │
 │ ##    ##############    Development Orchestrator           │
 │ ##   ###  ######  ##    OrNexus Team                       │

package/targets-stubs/opencode/neocortex-root.md

@@ -58,7 +58,7 @@ explicit server opt-in rather than a local assumption.
 ┌────────────────────────────────────────────────────────────┐
 │                                                            │
 │       #######           N E O C O R T E X                  │
-│      ###  ########      v4.60.58                           │
+│      ###  ########      v4.60.60                           │
 │ #########      #####                                       │
 │ ##    ##############    Development Orchestrator           │
 │ ##   ###  ######  ##    OrNexus Team                       │

package/targets-stubs/vscode/neocortex.agent.md

@@ -1,6 +1,6 @@
 ---
 name: "neocortex"
-description: "Neocortex v4.60.58 | OrNexus Team"
+description: "Neocortex v4.60.60 | OrNexus Team"
 tools:
   # Read / Edit (built-in tool sets)
   - read
@@ -68,7 +68,7 @@ SEMPRE que este agente for invocado, imprima o banner abaixo como PRIMEIRO outpu
 ┌────────────────────────────────────────────────────────────┐
 │                                                            │
 │       #######           N E O C O R T E X                  │
-│      ###  ########      v4.60.58                           │
+│      ###  ########      v4.60.60                           │
 │ #########      #####                                       │
 │ ##    ##############    Development Orchestrator           │
 │ ##   ###  ######  ##    OrNexus Team                       │