@ornexus/neocortex 4.60.62 → 4.60.64

package/packages/shared/dist/project-validation-commands.js

@@ -0,0 +1,96 @@
+/** Bounded project command declarations from the submitted story/spec artifacts.
+ * These are planning data, never permission to execute or independent QA.
+ */
+export const PROJECT_VALIDATION_KINDS = ['unit', 'integration', 'contract', 'bdd-example', 'e2e'];
+export function readProjectValidationCommands(storyId, sources) {
+    const byKind = new Map();
+    const preparation = [];
+    let preparationOwner;
+    let declared = false, invalid = false;
+    const safeCommand = (command) => /^[A-Za-z0-9_./-]+(?: [A-Za-z0-9_./:@%+=,-]+)*$/.test(command)
+        && !/(?:token|password|license_key|secret|credential)=|(?:https?|ssh):\/\/|@[^ /]+\.[A-Za-z]/i.test(command)
+        && !command.split(' ').some(arg => arg.split('/').includes('..'));
+    const allowedPaths = new Set(['story', 'spec', 'tasks'].map(suffix => `docs/stories/${storyId}.${suffix}.md`));
+    if (sources.length > 3 || new Set(sources.map(source => source.path)).size !== sources.length) {
+        return { declared: true, invalid: true, preparation, commands: [] };
+    }
+    for (const source of sources) {
+        if (!allowedPaths.has(source.path) || Buffer.byteLength(source.content) > 131072) {
+            invalid = true;
+            declared = true;
+            continue;
+        }
+        let active, fenced = false, headings = 0, entries = 0;
+        for (const raw of source.content.split(/\r?\n/)) {
+            const line = raw.trim();
+            if (/^(?:```|~~~)/.test(line)) {
+                fenced = !fenced;
+                continue;
+            }
+            if (fenced)
+                continue;
+            if (/^##\s+/.test(line)) {
+                if (active && entries === 0)
+                    invalid = true;
+                active = line === '## Validation Commands' ? 'commands'
+                    : line === '## Validation Preparation' ? 'preparation' : undefined;
+                if (active) {
+                    declared = true;
+                    entries = 0;
+                    if (active === 'commands') {
+                        headings++;
+                        if (headings > 1)
+                            invalid = true;
+                    }
+                    else {
+                        if (preparationOwner !== undefined)
+                            invalid = true;
+                        preparationOwner = source.path;
+                    }
+                }
+                continue;
+            }
+            if (!active || !line)
+                continue;
+            if (active === 'preparation') {
+                const match = /^- prepare: `([^`]{1,220})`$/.exec(line);
+                if (!match || !safeCommand(match[1]) || preparation.length >= 8
+                    || preparation.some(item => item.command === match[1])) {
+                    invalid = true;
+                    continue;
+                }
+                entries++;
+                preparation.push({ command: match[1], sourcePath: source.path });
+                continue;
+            }
+            const match = /^- (unit|integration|contract|bdd-example|e2e): `([^`]{1,220})`$/.exec(line);
+            if (!match) {
+                invalid = true;
+                continue;
+            }
+            const kind = match[1], command = match[2];
+            // No shell language, quoted substitutions, inline secrets or private URLs.
+            // A command stays a literal argv-shaped string throughout this planner.
+            if (!safeCommand(command)) {
+                invalid = true;
+                continue;
+            }
+            entries++;
+            const prior = byKind.get(kind);
+            if (prior && prior.command !== command) {
+                invalid = true;
+                continue;
+            }
+            if (prior?.sourcePaths.includes(source.path)) {
+                invalid = true;
+                continue;
+            }
+            byKind.set(kind, { kind, command, sourcePaths: [...(prior?.sourcePaths ?? []), source.path] });
+        }
+        if (active && entries === 0)
+            invalid = true;
+    }
+    if (declared && !byKind.has('unit'))
+        invalid = true;
+    return { declared, invalid, preparation, commands: [...byKind.values()] };
+}

package/packages/shared/dist/yolo/change-evidence.js

@@ -42,3 +42,38 @@ export function assertYoloChangeEvidenceV1(value, expectedHeadSha) {
         || record.pathsSha256 !== digest(record.changedPaths))
         fail();
 }
+/** Select a lossless transport; never truncate, filter or relabel v1 evidence. */
+export function createYoloChangeEvidence(input) {
+    if (!Array.isArray(input.changedPaths))
+        fail();
+    const paths = [...new Set(input.changedPaths)].sort();
+    if (paths.length <= 256)
+        return createYoloChangeEvidenceV1(input);
+    const evidence = {
+        schemaVersion: 2, source: 'git-diff-base-and-worktree',
+        baseSha: input.baseSha, headSha: input.headSha, changedPaths: paths,
+        pathsSha256: digest(paths), encodedPathsBytes: Buffer.byteLength(JSON.stringify(paths), 'utf8'),
+    };
+    assertYoloChangeEvidence(evidence, input.headSha);
+    return evidence;
+}
+export function assertYoloChangeEvidence(value, expectedHeadSha) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        fail();
+    const record = value;
+    if (record.schemaVersion === 1)
+        return assertYoloChangeEvidenceV1(value, expectedHeadSha);
+    const expected = ['schemaVersion', 'source', 'baseSha', 'headSha', 'changedPaths', 'pathsSha256', 'encodedPathsBytes'].sort();
+    const keys = Object.keys(record).sort();
+    if (keys.length !== expected.length || keys.some((key, index) => key !== expected[index])
+        || record.schemaVersion !== 2 || record.source !== 'git-diff-base-and-worktree'
+        || typeof record.baseSha !== 'string' || !SHA.test(record.baseSha)
+        || record.headSha !== expectedHeadSha || typeof record.headSha !== 'string' || !SHA.test(record.headSha)
+        || !Array.isArray(record.changedPaths) || record.changedPaths.length <= 256 || record.changedPaths.length > 512
+        || record.changedPaths.some(path => !validPath(path))
+        || JSON.stringify([...new Set(record.changedPaths)].sort()) !== JSON.stringify(record.changedPaths)
+        || record.pathsSha256 !== digest(record.changedPaths)
+        || record.encodedPathsBytes !== Buffer.byteLength(JSON.stringify(record.changedPaths), 'utf8')
+        || !Number.isSafeInteger(record.encodedPathsBytes) || Number(record.encodedPathsBytes) > 16_384)
+        fail();
+}

package/packages/shared/dist/yoloop/branch-unit.js

@@ -1,3 +1,4 @@
+import { canonicalRootMemoryEffectJson, isRootProjectMemoryEffect } from './root-memory-effect.js';
 /**
  * Public, deterministic branch-unit contract for epic-owned YOLO/YOLOOP runs.
  * Pure data/functions only: callers own Git and filesystem effects.
@@ -72,7 +73,10 @@ export function reconcileStoryCheckpoint(current, requested) {
         current.claimRevision === requested.claimRevision &&
         sameEvidenceReceipt(current.qaReceipt, requested.qaReceipt) &&
         sameEvidenceReceipt(current.reviewReceipt, requested.reviewReceipt) &&
-        JSON.stringify(current.reviewReconciliation ?? null) === JSON.stringify(requested.reviewReconciliation ?? null))
+        JSON.stringify(current.reviewReconciliation ?? null) === JSON.stringify(requested.reviewReconciliation ?? null) &&
+        (current.rootMemoryEffect === undefined && requested.rootMemoryEffect === undefined
+            || current.rootMemoryEffect !== undefined && requested.rootMemoryEffect !== undefined
+                && canonicalRootMemoryEffectJson(current.rootMemoryEffect) === canonicalRootMemoryEffectJson(requested.rootMemoryEffect)))
         return { kind: 'reused', checkpoint: current };
     return { kind: 'blocked', reasonCode: 'checkpoint-idempotency-conflict' };
 }
@@ -147,6 +151,11 @@ export function validateStoryCheckpoint(checkpoint, resolution) {
         errors.push('checkpoint-claim-revision-required');
     else if (!isHash(checkpoint.claimRevision))
         errors.push('checkpoint-claim-revision-invalid');
+    if (checkpoint.rootMemoryEffect !== undefined && (!isRootProjectMemoryEffect(checkpoint.rootMemoryEffect)
+        || checkpoint.rootMemoryEffect.storyId !== checkpoint.storyId || checkpoint.rootMemoryEffect.executionBranch !== checkpoint.branch
+        || checkpoint.rootMemoryEffect.sourceHeadSha !== checkpoint.baseSha || checkpoint.rootMemoryEffect.childClaimRevision !== checkpoint.claimRevision)) {
+        errors.push('checkpoint-root-memory-effect-invalid');
+    }
     if (!Array.isArray(checkpoint.receiptRefs) || checkpoint.receiptRefs.length === 0 || checkpoint.receiptRefs.some((ref) => !nonEmpty(ref))) {
         errors.push('checkpoint-receipts-missing');
     }

package/packages/shared/dist/yoloop/root-memory-effect.js

@@ -0,0 +1,57 @@
+import { listProjectMemoryTargets } from '../project-memory-targets.js';
+/** Stable identity across schema-preserving JSON serializers. Array order stays explicit. */
+export function canonicalRootMemoryEffectJson(effect) {
+    const ordered = (value) => Array.isArray(value) ? value.map(ordered)
+        : value !== null && typeof value === 'object'
+            ? Object.fromEntries(Object.keys(value).sort().map(key => [key, ordered(value[key])]))
+            : value;
+    return JSON.stringify(ordered(effect));
+}
+export function rootProjectMemoryPaths() {
+    return [...new Set(['NEOCORTEX.md', ...listProjectMemoryTargets().flatMap(target => [target.primaryFile,
+                ...target.secondaryFiles.filter(file => file.scope === 'project').map(file => file.path)])])].sort();
+}
+export function isRootProjectMemoryEffect(value) {
+    const record = (v) => v !== null && typeof v === 'object' && !Array.isArray(v) ? v : undefined;
+    const r = record(value);
+    const keys = ['schemaVersion', 'producer', 'storyId', 'epicId', 'executionBranch', 'sourceHeadSha',
+        'sourceSnapshotSha', 'memorySnapshotSha', 'graphRevision', 'childClaimRevision', 'setupSessionId',
+        'rootQaReceiptId', 'proposalSha256', 'canonicalSha256', 'projectionSha256', 'projectionFileCount', 'files', 'recordedAt', 'publicSafe'];
+    if (!r || Object.keys(r).sort().join('|') !== keys.sort().join('|')
+        || r.schemaVersion !== 'RootProjectMemoryEffect/1' || r.producer !== 'root-project-memory' || r.publicSafe !== true
+        || typeof r.storyId !== 'string' || !/^P[1-9][0-9]*\.[0-9]+$/.test(r.storyId) || r.epicId !== r.storyId.split('.')[0]
+        || r.executionBranch !== `epic/${r.epicId}`
+        || ['sourceHeadSha', 'sourceSnapshotSha', 'memorySnapshotSha'].some(key => typeof r[key] !== 'string' || !/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(r[key]))
+        || ['graphRevision', 'childClaimRevision', 'rootQaReceiptId', 'proposalSha256', 'canonicalSha256', 'projectionSha256'].some(key => typeof r[key] !== 'string' || !/^[a-f0-9]{64}$/.test(r[key]))
+        || typeof r.setupSessionId !== 'string' || !/^setup-[a-f0-9]{64}$/.test(r.setupSessionId)
+        || typeof r.recordedAt !== 'string' || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(r.recordedAt)
+        || !Number.isFinite(Date.parse(r.recordedAt)) || new Date(r.recordedAt).toISOString() !== r.recordedAt
+        || !Number.isSafeInteger(r.projectionFileCount) || r.projectionFileCount < 1 || r.projectionFileCount > 128
+        || !Array.isArray(r.files) || r.files.length > 128)
+        return false;
+    const allowed = new Set(rootProjectMemoryPaths()), seen = new Set();
+    const state = (v, path, after) => {
+        const s = record(v);
+        if (!s || !['absent', 'regular', 'symlink'].includes(String(s.kind))
+            || Object.keys(s).sort().join('|') !== ['kind', 'sha256', ...(s.kind === 'symlink' ? ['linkTarget'] : [])].sort().join('|'))
+            return false;
+        if (s.kind === 'absent')
+            return !after && s.sha256 === null;
+        if (typeof s.sha256 !== 'string' || !/^[a-f0-9]{64}$/.test(s.sha256))
+            return false;
+        if (path === 'NEOCORTEX.md' && s.kind !== 'regular')
+            return false;
+        const canonicalTarget = '../'.repeat(path.split('/').length - 1) + 'NEOCORTEX.md';
+        return s.kind !== 'symlink' || typeof s.linkTarget === 'string' && s.linkTarget.length <= 1024
+            && (after ? s.linkTarget === canonicalTarget
+                : s.linkTarget.split('/').filter(part => part !== '.').join('/') === canonicalTarget);
+    };
+    return r.files.every(value => {
+        const file = record(value);
+        if (!file || Object.keys(file).sort().join('|') !== 'after|before|path' || typeof file.path !== 'string'
+            || !allowed.has(file.path) || seen.has(file.path) || !state(file.before, file.path, false) || !state(file.after, file.path, true))
+            return false;
+        seen.add(file.path);
+        return true;
+    });
+}

package/targets-stubs/antigravity/gemini.md

@@ -1,4 +1,4 @@
-# 🧠 Neocortex v4.60.62 | OrNexus Team
+# 🧠 Neocortex v4.60.64 | OrNexus Team
 
 This project uses Neocortex, a Development Orchestrator.
 

package/targets-stubs/antigravity/skill/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: neocortex
-description: "🧠 Neocortex v4.60.62 | OrNexus Team"
+description: "🧠 Neocortex v4.60.64 | OrNexus Team"
 ---
 
 <!--

package/targets-stubs/claude-code/neocortex-root.agent.yaml

@@ -4,7 +4,7 @@ agent:
     name: 'Neocortex Root Agent'
     title: 'Development Orchestrator (Root)'
     icon: '>'
-    version: '4.60.62'
+    version: '4.60.64'
     architecture: 'thin-client'
     module: stand-alone
     hasSidecar: false

package/targets-stubs/claude-code/neocortex-root.md

@@ -1,6 +1,6 @@
 ---
 name: neocortex-root
-description: "🧠 Neocortex Root Agent v4.60.62 | OrNexus Team"
+description: "🧠 Neocortex Root Agent v4.60.64 | OrNexus Team"
 model: opus
 color: blue
 tools:
@@ -108,7 +108,7 @@ SEMPRE que este agente for invocado, imprima o banner abaixo como PRIMEIRO outpu
 ┌────────────────────────────────────────────────────────────┐
 │                                                            │
 │       #######           N E O C O R T E X                  │
-│      ###  ########      v4.60.62                           │
+│      ###  ########      v4.60.64                           │
 │ #########      #####                                       │
 │ ##    ##############    Development Orchestrator           │
 │ ##   ###  ######  ##    OrNexus Team                       │

package/targets-stubs/claude-code/neocortex.agent.yaml

@@ -4,7 +4,7 @@ agent:
     name: 'Neocortex'
     title: 'Development Orchestrator'
     icon: '>'
-    version: '4.60.62'
+    version: '4.60.64'
     architecture: 'thin-client'
     module: stand-alone
     hasSidecar: false

package/targets-stubs/claude-code/neocortex.md

@@ -1,6 +1,6 @@
 ---
 name: neocortex
-description: "🧠 Neocortex v4.60.62 | OrNexus Team"
+description: "🧠 Neocortex v4.60.64 | OrNexus Team"
 model: opus
 color: blue
 permissionMode: bypassPermissions
@@ -104,7 +104,7 @@ SEMPRE que este agente for invocado, imprima o banner abaixo como PRIMEIRO outpu
 ┌────────────────────────────────────────────────────────────┐
 │                                                            │
 │       #######           N E O C O R T E X                  │
-│      ###  ########      v4.60.62                           │
+│      ###  ########      v4.60.64                           │
 │ #########      #####                                       │
 │ ##    ##############    Development Orchestrator           │
 │ ##   ###  ######  ##    OrNexus Team                       │

package/targets-stubs/codex/AGENTS.md

@@ -28,7 +28,7 @@ Codex built-in commands or actions.
 
 <!-- END: Plugin Conflict Prevention -->
 
-# Neocortex v4.60.62 | OrNexus Team
+# Neocortex v4.60.64 | OrNexus Team
 
 You are a Development Orchestrator. All orchestration logic is delivered by the remote Neocortex server.
 

package/targets-stubs/cursor/agent.md

@@ -1,6 +1,6 @@
 ---
 name: neocortex
-description: "🧠 Neocortex v4.60.62 | OrNexus Team"
+description: "🧠 Neocortex v4.60.64 | OrNexus Team"
 model: inherit
 readonly: false
 is_background: false
@@ -64,7 +64,7 @@ SEMPRE que este agente for invocado, imprima o banner abaixo como PRIMEIRO outpu
 ┌────────────────────────────────────────────────────────────┐
 │                                                            │
 │       #######           N E O C O R T E X                  │
-│      ###  ########      v4.60.62                           │
+│      ###  ########      v4.60.64                           │
 │ #########      #####                                       │
 │ ##    ##############    Development Orchestrator           │
 │ ##   ###  ######  ##    OrNexus Team                       │

package/targets-stubs/gemini-cli/agent.md

@@ -1,6 +1,6 @@
 ---
 name: neocortex-root
-description: "🧠 Neocortex v4.60.62 | OrNexus Team"
+description: "🧠 Neocortex v4.60.64 | OrNexus Team"
 kind: local
 tools:
   # File operations (Gemini CLI built-ins)
@@ -62,7 +62,7 @@ SEMPRE que este agente for invocado, imprima o banner abaixo como PRIMEIRO outpu
 ┌────────────────────────────────────────────────────────────┐
 │                                                            │
 │       #######           N E O C O R T E X                  │
-│      ###  ########      v4.60.62                           │
+│      ###  ########      v4.60.64                           │
 │ #########      #####                                       │
 │ ##    ##############    Development Orchestrator           │
 │ ##   ###  ######  ##    OrNexus Team                       │

package/targets-stubs/opencode/neocortex-root.md

@@ -58,7 +58,7 @@ explicit server opt-in rather than a local assumption.
 ┌────────────────────────────────────────────────────────────┐
 │                                                            │
 │       #######           N E O C O R T E X                  │
-│      ###  ########      v4.60.62                           │
+│      ###  ########      v4.60.64                           │
 │ #########      #####                                       │
 │ ##    ##############    Development Orchestrator           │
 │ ##   ###  ######  ##    OrNexus Team                       │

package/targets-stubs/vscode/neocortex.agent.md

@@ -1,6 +1,6 @@
 ---
 name: "neocortex"
-description: "Neocortex v4.60.62 | OrNexus Team"
+description: "Neocortex v4.60.64 | OrNexus Team"
 tools:
   # Read / Edit (built-in tool sets)
   - read
@@ -68,7 +68,7 @@ SEMPRE que este agente for invocado, imprima o banner abaixo como PRIMEIRO outpu
 ┌────────────────────────────────────────────────────────────┐
 │                                                            │
 │       #######           N E O C O R T E X                  │
-│      ###  ########      v4.60.62                           │
+│      ###  ########      v4.60.64                           │
 │ #########      #####                                       │
 │ ##    ##############    Development Orchestrator           │
 │ ##   ###  ######  ##    OrNexus Team                       │