@ornexus/neocortex 4.60.66 → 4.60.68

package/packages/client/dist/private-execution/root-memory-git-evidence.js

@@ -1,3 +1,135 @@
-import{execFileSync as S}from"node:child_process";import{createHash as R}from"node:crypto";import{isDeepStrictEqual as f}from"node:util";import{canonicalRootMemoryEffectJson as x,getProjectMemoryTarget as d,listProjectMemoryTargets as E,isRootProjectMemoryEffect as p,rootProjectMemoryPaths as P}from"./shared-root-memory-types.js";import{shouldUseManagedWrapper as g}from"../memory/project-memory-writer.js";const u=o=>R("sha256").update(o).digest("hex"),i=()=>{throw new Error("private-root-memory-git-evidence-unverified")};function l(o,t){return S("git",[...t],{cwd:o,stdio:["ignore","pipe","ignore"],env:{...Object.fromEntries(Object.entries(process.env).filter(([e])=>!e.startsWith("GIT_"))),GIT_NO_REPLACE_OBJECTS:"1"},timeout:3e4,maxBuffer:2*1024*1024})}function m(o,t,e){if(t!==":"&&!/^[a-f0-9]{40,64}$/.test(t)||!P().includes(e))return i();const h=l(o,t===":"?["ls-files","--stage","-z","--",e]:["ls-tree","-z",t,"--",e]).toString("utf8");if(!h)return{kind:"absent",sha256:null};const s=(t===":"?/^(100644|120000) ([a-f0-9]{40,64}) 0\t([^\0]+)\0$/:/^(100644|120000) blob ([a-f0-9]{40,64})\t([^\0]+)\0$/).exec(h);if(!s||s[3]!==e)return i();const c=l(o,["cat-file","blob",s[2]]);return c.byteLength>512*1024?i():s[1]==="120000"?{kind:"symlink",sha256:u(c),linkTarget:c.toString("utf8")}:{kind:"regular",sha256:u(c)}}function $(o,t,e){try{if(!p(t)||!e||["storyId","graphRevision","childClaimRevision","setupSessionId","sourceHeadSha","executionBranch"].some(s=>t[s]!==e[s]))return i();l(o,["merge-base","--is-ancestor",t.sourceHeadSha,t.sourceSnapshotSha]),l(o,["merge-base","--is-ancestor",t.sourceSnapshotSha,t.memorySnapshotSha]);const h=l(o,["diff","--name-only","--no-renames","--no-ext-diff","--no-textconv","-z",t.sourceSnapshotSha,t.memorySnapshotSha]).toString("utf8").split("\0").filter(Boolean).sort();if(!f(h,t.files.map(s=>s.path).sort()))return i();for(const s of t.files){const c=m(o,t.sourceSnapshotSha,s.path),r=m(o,t.memorySnapshotSha,s.path);if(!f(c,s.before)||!f(r,s.after)||f(c,r))return i()}return y(o,t.memorySnapshotSha,t),t}catch{return i()}}function y(o,t,e){const h=m(o,t,"NEOCORTEX.md");if(h.kind!=="regular"||h.sha256!==e.canonicalSha256)return i();const s=new Map;for(const r of[d("canonical"),...E()])for(const a of[r.primaryFile,...r.targetId==="canonical"?[]:r.secondaryFiles.filter(n=>n.scope==="project").map(n=>n.path)])s.has(a)||s.set(a,r.targetId==="canonical"?"canonical":g(r,a)?"managed-wrapper":"semantic-symlink");const c=[...s].sort(([r],[a])=>r<a?-1:r>a?1:0).map(([r,a])=>{const n=m(o,t,r);return n.kind==="absent"||a!=="semantic-symlink"&&n.kind!=="regular"||a==="semantic-symlink"&&(n.kind!=="symlink"||n.linkTarget!=="../".repeat(r.split("/").length-1)+"NEOCORTEX.md")?i():`${r}:${a}:${n.kind==="symlink"?h.sha256:n.sha256}`});if(e.projectionFileCount!==c.length||e.projectionSha256!==u(Buffer.from(c.join(`
-`))))return i()}function k(o){return u(Buffer.from(x(o)))}function C(o,t,e){try{if(!p(t)||!e||t.storyId!==e.storyId||t.executionBranch!==e.executionBranch||t.sourceHeadSha!==e.baseSha||!/^[a-f0-9]{40,64}$/.test(e.baseSha)||e.headRef!==":"&&!/^[a-f0-9]{40,64}$/.test(e.headRef)||!Array.isArray(e.childPaths)||e.childPaths.length<1||e.childPaths.length>1024||e.childPaths.some(r=>typeof r!="string"||!r||r.startsWith("/")||/[\\\x00-\x1f\x7f]/.test(r)||r.split("/").includes("..")||r.split("/").includes(".git"))||new Set(e.childPaths).size!==e.childPaths.length||t.childClaimRevision!==u(Buffer.from([...e.childPaths].sort().join("\0"))))return i();const h=r=>e.childPaths.some(a=>a===r||a.endsWith("/")&&r.startsWith(a)),s=l(o,["diff",...e.headRef===":"?["--cached"]:[],"--name-only","--no-renames","--no-ext-diff","--no-textconv","-z",e.baseSha,...e.headRef===":"?[]:[e.headRef]]).toString("utf8").split("\0").filter(Boolean),c=t.files.map(r=>r.path).sort();if(!f(s.filter(r=>!h(r)).sort(),c)||t.files.some(r=>h(r.path)))return i();for(const r of t.files){const a=m(o,e.baseSha,r.path),n=m(o,e.headRef,r.path);if(!f(a,r.before)||!f(n,r.after)||f(a,n))return i()}if(y(o,e.headRef,t),e.headRef!==":"){const a=l(o,["show","--no-patch","--format=%B",e.headRef]).toString("utf8").split(`
-`).filter(n=>n.startsWith("Neocortex-Root-Memory-Effect:"));if(a.length!==1||a[0]!==`Neocortex-Root-Memory-Effect: ${k(t)}`)return i()}return t}catch{return i()}}export{k as rootMemoryEffectDigest,m as rootMemoryGitFileState,$ as verifyRootMemoryEffectGitEvidence,C as verifyRootMemoryPhysicalWriteSet};
+/** Read-only physical evidence. This does not authorize source writes or checkpoints. */
+import { execFileSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { isDeepStrictEqual } from 'node:util';
+import { canonicalRootMemoryEffectJson, getProjectMemoryTarget, listProjectMemoryTargets, isRootProjectMemoryEffect, rootProjectMemoryPaths } from './shared-root-memory-types.js';
+import { shouldUseManagedWrapper } from '../memory/project-memory-writer.js';
+const hash = (bytes) => createHash('sha256').update(bytes).digest('hex');
+const fail = () => { throw new Error('private-root-memory-git-evidence-unverified'); };
+function git(root, args) {
+    return execFileSync('git', [...args], { cwd: root, stdio: ['ignore', 'pipe', 'ignore'],
+        env: { ...Object.fromEntries(Object.entries(process.env).filter(([key]) => !key.startsWith('GIT_'))), GIT_NO_REPLACE_OBJECTS: '1' },
+        timeout: 30_000, maxBuffer: 2 * 1024 * 1024 });
+}
+/** Hash Git blobs without following links, using the same link-byte hash as the writer. */
+export function rootMemoryGitFileState(root, sha, path) {
+    if (sha !== ':' && !/^[a-f0-9]{40,64}$/.test(sha) || !rootProjectMemoryPaths().includes(path))
+        return fail();
+    const tree = git(root, sha === ':' ? ['ls-files', '--stage', '-z', '--', path] : ['ls-tree', '-z', sha, '--', path]).toString('utf8');
+    if (!tree)
+        return { kind: 'absent', sha256: null };
+    const match = (sha === ':' ? /^(100644|120000) ([a-f0-9]{40,64}) 0\t([^\0]+)\0$/
+        : /^(100644|120000) blob ([a-f0-9]{40,64})\t([^\0]+)\0$/).exec(tree);
+    if (!match || match[3] !== path)
+        return fail();
+    const bytes = git(root, ['cat-file', 'blob', match[2]]);
+    if (bytes.byteLength > 512 * 1024)
+        return fail();
+    return match[1] === '120000'
+        ? { kind: 'symlink', sha256: hash(bytes), linkTarget: bytes.toString('utf8') }
+        : { kind: 'regular', sha256: hash(bytes) };
+}
+/**
+ * Prove that the recorded root range contains exactly the registered memory delta.
+ * The caller must separately verify the private producer receipt and live session.
+ * A JSON effect plus this inspection alone is never an execution authority.
+ */
+export function verifyRootMemoryEffectGitEvidence(root, effect, binding) {
+    try {
+        if (!isRootProjectMemoryEffect(effect)
+            || !binding || ['storyId', 'graphRevision', 'childClaimRevision', 'setupSessionId', 'sourceHeadSha', 'executionBranch']
+            .some(key => effect[key] !== binding[key]))
+            return fail();
+        git(root, ['merge-base', '--is-ancestor', effect.sourceHeadSha, effect.sourceSnapshotSha]);
+        git(root, ['merge-base', '--is-ancestor', effect.sourceSnapshotSha, effect.memorySnapshotSha]);
+        const changed = git(root, ['diff', '--name-only', '--no-renames', '--no-ext-diff', '--no-textconv', '-z',
+            effect.sourceSnapshotSha, effect.memorySnapshotSha]).toString('utf8').split('\0').filter(Boolean).sort();
+        if (!isDeepStrictEqual(changed, effect.files.map(file => file.path).sort()))
+            return fail();
+        for (const file of effect.files) {
+            const before = rootMemoryGitFileState(root, effect.sourceSnapshotSha, file.path);
+            const after = rootMemoryGitFileState(root, effect.memorySnapshotSha, file.path);
+            if (!isDeepStrictEqual(before, file.before) || !isDeepStrictEqual(after, file.after)
+                || isDeepStrictEqual(before, after))
+                return fail();
+        }
+        verifyRootMemoryGitProjection(root, effect.memorySnapshotSha, effect);
+        return effect;
+    }
+    catch {
+        return fail();
+    }
+}
+function verifyRootMemoryGitProjection(root, ref, effect) {
+    const canonical = rootMemoryGitFileState(root, ref, 'NEOCORTEX.md');
+    if (canonical.kind !== 'regular' || canonical.sha256 !== effect.canonicalSha256)
+        return fail();
+    // Recompute the all-target projection digest from immutable Git blobs, never
+    // from a caller's list, current working files, or a followed external link.
+    const modes = new Map();
+    for (const target of [getProjectMemoryTarget('canonical'), ...listProjectMemoryTargets()]) {
+        for (const path of [target.primaryFile, ...(target.targetId === 'canonical' ? []
+                : target.secondaryFiles.filter(file => file.scope === 'project').map(file => file.path))]) {
+            if (!modes.has(path))
+                modes.set(path, target.targetId === 'canonical' ? 'canonical'
+                    : shouldUseManagedWrapper(target, path) ? 'managed-wrapper' : 'semantic-symlink');
+        }
+    }
+    const projection = [...modes].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([path, mode]) => {
+        const state = rootMemoryGitFileState(root, ref, path);
+        if (state.kind === 'absent' || mode !== 'semantic-symlink' && state.kind !== 'regular'
+            || mode === 'semantic-symlink' && (state.kind !== 'symlink'
+                || state.linkTarget !== '../'.repeat(path.split('/').length - 1) + 'NEOCORTEX.md'))
+            return fail();
+        return `${path}:${mode}:${state.kind === 'symlink' ? canonical.sha256 : state.sha256}`;
+    });
+    if (effect.projectionFileCount !== projection.length
+        || effect.projectionSha256 !== hash(Buffer.from(projection.join('\n'))))
+        return fail();
+}
+export function rootMemoryEffectDigest(effect) {
+    return hash(Buffer.from(canonicalRootMemoryEffectJson(effect)));
+}
+/**
+ * Verify only physical ownership and bytes in the staged/committed C08 bundle.
+ * Selection must come from private producer custody or an already accepted typed
+ * checkpoint. This inspector alone does not grant QA, review or commit authority.
+ */
+export function verifyRootMemoryPhysicalWriteSet(root, candidate, binding) {
+    try {
+        if (!isRootProjectMemoryEffect(candidate) || !binding || candidate.storyId !== binding.storyId
+            || candidate.executionBranch !== binding.executionBranch || candidate.sourceHeadSha !== binding.baseSha
+            || !/^[a-f0-9]{40,64}$/.test(binding.baseSha) || binding.headRef !== ':' && !/^[a-f0-9]{40,64}$/.test(binding.headRef)
+            || !Array.isArray(binding.childPaths) || binding.childPaths.length < 1 || binding.childPaths.length > 1024
+            || binding.childPaths.some(path => typeof path !== 'string' || !path || path.startsWith('/') || /[\\\x00-\x1f\x7f]/.test(path)
+                || path.split('/').includes('..') || path.split('/').includes('.git'))
+            || new Set(binding.childPaths).size !== binding.childPaths.length
+            || candidate.childClaimRevision !== hash(Buffer.from([...binding.childPaths].sort().join('\0'))))
+            return fail();
+        const childCovers = (path) => binding.childPaths.some(scope => scope === path || scope.endsWith('/') && path.startsWith(scope));
+        const paths = git(root, ['diff', ...(binding.headRef === ':' ? ['--cached'] : []), '--name-only', '--no-renames', '--no-ext-diff', '--no-textconv', '-z',
+            binding.baseSha, ...(binding.headRef === ':' ? [] : [binding.headRef])]).toString('utf8').split('\0').filter(Boolean);
+        const rootPaths = candidate.files.map(file => file.path).sort();
+        if (!isDeepStrictEqual(paths.filter(path => !childCovers(path)).sort(), rootPaths)
+            || candidate.files.some(file => childCovers(file.path)))
+            return fail();
+        for (const file of candidate.files) {
+            const before = rootMemoryGitFileState(root, binding.baseSha, file.path);
+            const after = rootMemoryGitFileState(root, binding.headRef, file.path);
+            if (!isDeepStrictEqual(before, file.before) || !isDeepStrictEqual(after, file.after)
+                || isDeepStrictEqual(before, after))
+                return fail();
+        }
+        verifyRootMemoryGitProjection(root, binding.headRef, candidate);
+        if (binding.headRef !== ':') {
+            const body = git(root, ['show', '--no-patch', '--format=%B', binding.headRef]).toString('utf8');
+            const trailers = body.split('\n').filter(line => line.startsWith('Neocortex-Root-Memory-Effect:'));
+            if (trailers.length !== 1 || trailers[0] !== `Neocortex-Root-Memory-Effect: ${rootMemoryEffectDigest(candidate)}`)
+                return fail();
+        }
+        return candidate;
+    }
+    catch {
+        return fail();
+    }
+}

package/packages/client/dist/private-execution/root-memory-recovery.js

@@ -1 +1,93 @@
-import{createHash as x}from"node:crypto";import{execFileSync as M}from"node:child_process";import{existsSync as O,lstatSync as m,readFileSync as P,realpathSync as A}from"node:fs";import{join as l}from"node:path";import{isDeepStrictEqual as d}from"node:util";import{isRootProjectMemoryEffect as D,rootProjectMemoryPaths as H}from"./shared-root-memory-types.js";import{assertGitLifecyclePrivateFile as B}from"../git/git-lifecycle-store.js";import{privateYoloSourceFileMatchesSnapshot as F}from"./isolated-admission.js";import{rootMemoryGitFileState as I,verifyRootMemoryEffectGitEvidence as J}from"./root-memory-git-evidence.js";import{rootMemoryFileState as N}from"./root-memory-writer.js";const S=s=>x("sha256").update(s).digest("hex"),n=()=>{throw new Error("private-root-memory-prepared-recovery-unverified")},b=(s,e)=>Object.keys(s).sort().join("|")===[...e].sort().join("|");function c(s,e){return M("git",[...e],{cwd:s,stdio:["ignore","pipe","ignore"],env:{...Object.fromEntries(Object.entries(process.env).filter(([t])=>!t.startsWith("GIT_"))),GIT_NO_REPLACE_OBJECTS:"1"},timeout:3e4,maxBuffer:16*1024*1024})}function G(s,e){return`memory-operation-${S(JSON.stringify([s.storyId,s.setupSessionId,s.graphRevision,e.review.snapshotSha,e.review.proposalSha256,e.review.sourceStateSha256,e.review.rootQaReceiptId,S(JSON.stringify(e.review.notes))]))}.json`}async function U(s){try{const{projectRoot:e,current:t,request:g,childPaths:f}=s,{review:h,directive:u}=g,y=l(s.parent,G(t,g));await B(y,s.parent);const w=P(y);if(w.length>256*1024)return n();const p=JSON.parse(w.toString("utf8"));if(!p||!b(p,["schemaVersion","kind","previousSession","receipt","patchSha256"])||p.schemaVersion!==1||p.kind!=="prepared-root-memory-effect"||!d(p.previousSession,t)||t.rootMemoryEffect!==void 0)return n();const r=p.receipt,a=r?.rootMemoryEffect;if(!r||!b(r,["schemaVersion","kind","storyId","graphRevision","sourceHeadSha","snapshotSha","proposalSha256","notesSha256","sourceStateSha256","checks","reviewedAt","rootMemoryEffect","independentStoryQaAccepted","terminalAccepted"])||!D(a)||r.schemaVersion!==1||r.kind!=="private-project-memory-root-review"||r.storyId!==t.storyId||r.graphRevision!==t.graphRevision||r.sourceHeadSha!==t.workspace.baseSha||r.snapshotSha!==a.memorySnapshotSha||r.proposalSha256!==h.proposalSha256||r.sourceStateSha256!==h.sourceStateSha256||r.notesSha256!==S(JSON.stringify(h.notes))||r.notesSha256!==a.proposalSha256||!d(r.checks,h.checks)||r.reviewedAt!==a.recordedAt||a.sourceSnapshotSha!==t.snapshotSha||a.rootQaReceiptId!==h.rootQaReceiptId||r.independentStoryQaAccepted!==!1||r.terminalAccepted!==!1)return n();const o=t.workspace.workspacePath;if(A(e)!==e||A(o)!==o||!m(o).isDirectory()||m(o).uid!==process.getuid?.()||(m(o).mode&63)!==0||!m(l(o,".git")).isDirectory()||m(l(o,".git")).isSymbolicLink()||O(l(o,".git/objects/info/alternates"))||c(o,["rev-parse","--show-toplevel"]).toString().trim()!==o||c(e,["rev-parse","--show-toplevel"]).toString().trim()!==e||c(e,["rev-parse","HEAD"]).toString().trim()!==t.workspace.baseSha||c(e,["symbolic-ref","--short","HEAD"]).toString().trim()!==u.executionBranch||c(o,["rev-parse","HEAD"]).toString().trim()!==a.memorySnapshotSha||c(o,["symbolic-ref","--short","HEAD"]).toString().trim()!==u.executionBranch||c(o,["status","--porcelain=v1","-z","--untracked-files=all","--ignored=matching"]).length!==0||c(e,["diff","--cached","--name-only","-z"]).length!==0||(J(o,a,{storyId:t.storyId,graphRevision:t.graphRevision,childClaimRevision:S([...f].sort().join("\0")),setupSessionId:t.setupSessionId,sourceHeadSha:t.workspace.baseSha,executionBranch:u.executionBranch}),f.some(i=>!F(e,o,t.snapshotSha,i))))return n();const k=a.files.map(i=>i.path);if(c(e,["status","--porcelain=v1","-z","--untracked-files=all"]).toString("utf8").split("\0").filter(Boolean).some(i=>![" M"," D","??"," T"].includes(i.slice(0,2))||!f.includes(i.slice(3))&&!k.includes(i.slice(3))||i.slice(0,2)===" T"&&!k.includes(i.slice(3))))return n();let E=!0,v=!0;for(const i of H()){if(f.includes(i))return n();const R=N(e,i);E&&=d(R,I(o,t.snapshotSha,i)),v&&=d(R,I(o,a.memorySnapshotSha,i))}if(!E&&!v)return n();const j=c(o,["diff","--binary","--full-index",t.snapshotSha,a.memorySnapshotSha]);return S(j)!==p.patchSha256?n():{receipt:r,effect:a,patch:j,sourceAlreadyApplied:v,journalPath:y}}catch{return n()}}export{U as readVerifiedPreparedRootMemory,G as rootMemoryOperationJournalName};
+/** Validate a real prepared root journal before any interrupted source effect resumes. */
+import { createHash } from 'node:crypto';
+import { execFileSync } from 'node:child_process';
+import { existsSync, lstatSync, readFileSync, realpathSync } from 'node:fs';
+import { join } from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
+import { isRootProjectMemoryEffect, rootProjectMemoryPaths } from './shared-root-memory-types.js';
+import { assertGitLifecyclePrivateFile } from '../git/git-lifecycle-store.js';
+import { privateYoloSourceFileMatchesSnapshot } from './isolated-admission.js';
+import { rootMemoryGitFileState, verifyRootMemoryEffectGitEvidence } from './root-memory-git-evidence.js';
+import { rootMemoryFileState } from './root-memory-writer.js';
+const hash = (value) => createHash('sha256').update(value).digest('hex');
+const fail = () => { throw new Error('private-root-memory-prepared-recovery-unverified'); };
+const exact = (value, keys) => Object.keys(value).sort().join('|') === [...keys].sort().join('|');
+function git(root, args) {
+    return execFileSync('git', [...args], { cwd: root, stdio: ['ignore', 'pipe', 'ignore'],
+        env: { ...Object.fromEntries(Object.entries(process.env).filter(([key]) => !key.startsWith('GIT_'))), GIT_NO_REPLACE_OBJECTS: '1' },
+        timeout: 30_000, maxBuffer: 16 * 1024 * 1024 });
+}
+export function rootMemoryOperationJournalName(current, request) {
+    return `memory-operation-${hash(JSON.stringify([current.storyId, current.setupSessionId, current.graphRevision,
+        request.review.snapshotSha, request.review.proposalSha256, request.review.sourceStateSha256,
+        request.review.rootQaReceiptId, hash(JSON.stringify(request.review.notes))]))}.json`;
+}
+export async function readVerifiedPreparedRootMemory(input) {
+    try {
+        const { projectRoot: root, current, request, childPaths } = input, { review, directive } = request;
+        const path = join(input.parent, rootMemoryOperationJournalName(current, request));
+        await assertGitLifecyclePrivateFile(path, input.parent);
+        const bytes = readFileSync(path);
+        if (bytes.length > 256 * 1024)
+            return fail();
+        const journal = JSON.parse(bytes.toString('utf8'));
+        if (!journal || !exact(journal, ['schemaVersion', 'kind', 'previousSession', 'receipt', 'patchSha256'])
+            || journal.schemaVersion !== 1 || journal.kind !== 'prepared-root-memory-effect'
+            || !isDeepStrictEqual(journal.previousSession, current) || current.rootMemoryEffect !== undefined)
+            return fail();
+        const receipt = journal.receipt, effect = receipt?.rootMemoryEffect;
+        if (!receipt || !exact(receipt, ['schemaVersion', 'kind', 'storyId', 'graphRevision', 'sourceHeadSha', 'snapshotSha',
+            'proposalSha256', 'notesSha256', 'sourceStateSha256', 'checks', 'reviewedAt', 'rootMemoryEffect', 'independentStoryQaAccepted', 'terminalAccepted'])
+            || !isRootProjectMemoryEffect(effect) || receipt.schemaVersion !== 1 || receipt.kind !== 'private-project-memory-root-review'
+            || receipt.storyId !== current.storyId || receipt.graphRevision !== current.graphRevision
+            || receipt.sourceHeadSha !== current.workspace.baseSha || receipt.snapshotSha !== effect.memorySnapshotSha
+            || receipt.proposalSha256 !== review.proposalSha256 || receipt.sourceStateSha256 !== review.sourceStateSha256
+            || receipt.notesSha256 !== hash(JSON.stringify(review.notes)) || receipt.notesSha256 !== effect.proposalSha256
+            || !isDeepStrictEqual(receipt.checks, review.checks) || receipt.reviewedAt !== effect.recordedAt
+            || effect.sourceSnapshotSha !== current.snapshotSha || effect.rootQaReceiptId !== review.rootQaReceiptId
+            || receipt.independentStoryQaAccepted !== false || receipt.terminalAccepted !== false)
+            return fail();
+        const clone = current.workspace.workspacePath;
+        if (realpathSync(root) !== root || realpathSync(clone) !== clone || !lstatSync(clone).isDirectory()
+            || lstatSync(clone).uid !== process.getuid?.() || (lstatSync(clone).mode & 0o077) !== 0
+            || !lstatSync(join(clone, '.git')).isDirectory() || lstatSync(join(clone, '.git')).isSymbolicLink()
+            || existsSync(join(clone, '.git/objects/info/alternates'))
+            || git(clone, ['rev-parse', '--show-toplevel']).toString().trim() !== clone
+            || git(root, ['rev-parse', '--show-toplevel']).toString().trim() !== root
+            || git(root, ['rev-parse', 'HEAD']).toString().trim() !== current.workspace.baseSha
+            || git(root, ['symbolic-ref', '--short', 'HEAD']).toString().trim() !== directive.executionBranch
+            || git(clone, ['rev-parse', 'HEAD']).toString().trim() !== effect.memorySnapshotSha
+            || git(clone, ['symbolic-ref', '--short', 'HEAD']).toString().trim() !== directive.executionBranch
+            || git(clone, ['status', '--porcelain=v1', '-z', '--untracked-files=all', '--ignored=matching']).length !== 0
+            || git(root, ['diff', '--cached', '--name-only', '-z']).length !== 0)
+            return fail();
+        verifyRootMemoryEffectGitEvidence(clone, effect, { storyId: current.storyId, graphRevision: current.graphRevision,
+            childClaimRevision: hash([...childPaths].sort().join('\0')), setupSessionId: current.setupSessionId,
+            sourceHeadSha: current.workspace.baseSha, executionBranch: directive.executionBranch });
+        if (childPaths.some(path => !privateYoloSourceFileMatchesSnapshot(root, clone, current.snapshotSha, path)))
+            return fail();
+        const rootPaths = effect.files.map(file => file.path);
+        const rows = git(root, ['status', '--porcelain=v1', '-z', '--untracked-files=all']).toString('utf8').split('\0').filter(Boolean);
+        if (rows.some(row => ![' M', ' D', '??', ' T'].includes(row.slice(0, 2))
+            || !childPaths.includes(row.slice(3)) && !rootPaths.includes(row.slice(3))
+            || row.slice(0, 2) === ' T' && !rootPaths.includes(row.slice(3))))
+            return fail();
+        let before = true, after = true;
+        for (const path of rootProjectMemoryPaths()) {
+            if (childPaths.includes(path))
+                return fail();
+            const actual = rootMemoryFileState(root, path);
+            before &&= isDeepStrictEqual(actual, rootMemoryGitFileState(clone, current.snapshotSha, path));
+            after &&= isDeepStrictEqual(actual, rootMemoryGitFileState(clone, effect.memorySnapshotSha, path));
+        }
+        if (!before && !after)
+            return fail();
+        const patch = git(clone, ['diff', '--binary', '--full-index', current.snapshotSha, effect.memorySnapshotSha]);
+        if (hash(patch) !== journal.patchSha256)
+            return fail();
+        return { receipt, effect, patch, sourceAlreadyApplied: after, journalPath: path };
+    }
+    catch {
+        return fail();
+    }
+}

package/packages/client/dist/private-execution/root-memory-request.js

@@ -1 +1,29 @@
-import{createHash as h}from"node:crypto";const v="638cc25234b6a507841c889ad7f5c8c1e33bd38aa20ca7818b0f21c4a3e9030e",c=["canonicalUpdateReviewed","acceptedQaReviewed","scopeReviewed","unresolvedGatesPreserved","platformTargetsReviewed","wrapperPreservationReviewed","mandatoryRequirementsResolved","noImplementationChange"];function u(n){const p=()=>{throw new Error("private-root-memory-review-unverified")},s=t=>t!==null&&typeof t=="object"&&!Array.isArray(t)?t:void 0,a=(t,d)=>Object.keys(t).sort().join("|")===d.sort().join("|"),o=s(n),r=s(o?.directive),e=s(o?.review),i=s(e?.checks);return!o||!r||!e||!i||!a(o,["schemaVersion","executorStopped","directive","review"])||o.schemaVersion!=="PrivateYoloProjectMemoryAcceptance/1"||o.executorStopped!==!0||!a(r,["schemaVersion","action","storyId","executionBranch","graphRevision","stepId","publicSafe"])||r.schemaVersion!==1||r.action!=="review-project-memory-candidate"||r.stepId!=="step-638cc252"||r.publicSafe!==!0||typeof r.storyId!="string"||!/^P[1-9][0-9]*\.[0-9]+$/.test(r.storyId)||r.executionBranch!==`epic/${r.storyId.split(".")[0]}`||typeof r.graphRevision!="string"||!/^[a-f0-9]{64}$/.test(r.graphRevision)||!a(e,["reviewer","decision","snapshotSha","proposalSha256","sourceStateSha256","rootQaReceiptId","rawStepId","reviewedAt","notes","checks"])||e.reviewer!=="root"||e.decision!=="approve-project-memory"||typeof e.snapshotSha!="string"||!/^[a-f0-9]{40,64}$/.test(e.snapshotSha)||["proposalSha256","sourceStateSha256","rootQaReceiptId"].some(t=>typeof e[t]!="string"||!/^[a-f0-9]{64}$/.test(e[t]))||typeof e.rawStepId!="string"||h("sha256").update(e.rawStepId).digest("hex")!==v||typeof e.reviewedAt!="string"||!Number.isFinite(Date.parse(e.reviewedAt))||Date.parse(e.reviewedAt)>Date.now()||Date.now()-Date.parse(e.reviewedAt)>10*6e4||!Array.isArray(e.notes)||e.notes.length<1||e.notes.length>8||e.notes.some(t=>typeof t!="string"||Buffer.byteLength(t)<1||Buffer.byteLength(t)>512)||!a(i,[...c])||c.some(t=>i[t]!==!0)?p():structuredClone(n)}export{c as ROOT_MEMORY_REVIEW_CHECKS,v as ROOT_MEMORY_STEP_DIGEST,u as parsePrivateRootMemoryRequest};
+/** Closed public root review shape. It is not a write grant by itself. */
+import { createHash } from 'node:crypto';
+export const ROOT_MEMORY_STEP_DIGEST = '638cc25234b6a507841c889ad7f5c8c1e33bd38aa20ca7818b0f21c4a3e9030e';
+export const ROOT_MEMORY_REVIEW_CHECKS = ['canonicalUpdateReviewed', 'acceptedQaReviewed', 'scopeReviewed', 'unresolvedGatesPreserved',
+    'platformTargetsReviewed', 'wrapperPreservationReviewed', 'mandatoryRequirementsResolved', 'noImplementationChange'];
+export function parsePrivateRootMemoryRequest(value) {
+    const fail = () => { throw new Error('private-root-memory-review-unverified'); };
+    const object = (v) => v !== null && typeof v === 'object' && !Array.isArray(v) ? v : undefined;
+    const exact = (v, keys) => Object.keys(v).sort().join('|') === keys.sort().join('|');
+    const r = object(value), d = object(r?.directive), review = object(r?.review), checks = object(review?.checks);
+    if (!r || !d || !review || !checks || !exact(r, ['schemaVersion', 'executorStopped', 'directive', 'review'])
+        || r.schemaVersion !== 'PrivateYoloProjectMemoryAcceptance/1' || r.executorStopped !== true
+        || !exact(d, ['schemaVersion', 'action', 'storyId', 'executionBranch', 'graphRevision', 'stepId', 'publicSafe'])
+        || d.schemaVersion !== 1 || d.action !== 'review-project-memory-candidate' || d.stepId !== 'step-638cc252' || d.publicSafe !== true
+        || typeof d.storyId !== 'string' || !/^P[1-9][0-9]*\.[0-9]+$/.test(d.storyId)
+        || d.executionBranch !== `epic/${d.storyId.split('.')[0]}` || typeof d.graphRevision !== 'string' || !/^[a-f0-9]{64}$/.test(d.graphRevision)
+        || !exact(review, ['reviewer', 'decision', 'snapshotSha', 'proposalSha256', 'sourceStateSha256', 'rootQaReceiptId', 'rawStepId', 'reviewedAt', 'notes', 'checks'])
+        || review.reviewer !== 'root' || review.decision !== 'approve-project-memory'
+        || typeof review.snapshotSha !== 'string' || !/^[a-f0-9]{40,64}$/.test(review.snapshotSha)
+        || ['proposalSha256', 'sourceStateSha256', 'rootQaReceiptId'].some(k => typeof review[k] !== 'string' || !/^[a-f0-9]{64}$/.test(review[k]))
+        || typeof review.rawStepId !== 'string' || createHash('sha256').update(review.rawStepId).digest('hex') !== ROOT_MEMORY_STEP_DIGEST
+        || typeof review.reviewedAt !== 'string' || !Number.isFinite(Date.parse(review.reviewedAt))
+        || Date.parse(review.reviewedAt) > Date.now() || Date.now() - Date.parse(review.reviewedAt) > 10 * 60_000
+        || !Array.isArray(review.notes) || review.notes.length < 1 || review.notes.length > 8
+        || review.notes.some(note => typeof note !== 'string' || Buffer.byteLength(note) < 1 || Buffer.byteLength(note) > 512)
+        || !exact(checks, [...ROOT_MEMORY_REVIEW_CHECKS]) || ROOT_MEMORY_REVIEW_CHECKS.some(key => checks[key] !== true))
+        return fail();
+    return structuredClone(value);
+}

package/packages/client/dist/private-execution/root-memory-scope.js

@@ -1 +1,178 @@
-import{createHash as S}from"node:crypto";import{execFileSync as A}from"node:child_process";import{existsSync as B,readFileSync as l}from"node:fs";import{join as g,resolve as w}from"node:path";import{isDeepStrictEqual as u}from"node:util";import{isRootProjectMemoryEffect as _}from"./shared-root-memory-types.js";import{assertGitLifecyclePrivateFile as R,ensureGitLifecyclePrivateChildDirectory as k,gitLifecycleRuntimeDirectory as P,readGitLifecycleRuntime as H}from"../git/git-lifecycle-store.js";import{rootMemoryGitFileState as I,verifyRootMemoryEffectGitEvidence as C,verifyRootMemoryPhysicalWriteSet as $}from"./root-memory-git-evidence.js";import{rootMemoryFileState as G}from"./root-memory-writer.js";import{ROOT_MEMORY_REVIEW_CHECKS as b,ROOT_MEMORY_STEP_DIGEST as T}from"./root-memory-request.js";import{parseRefreshMemoryArgs as q,verifyProjectMemoryTargets as F}from"../commands/refresh-memory.js";const j=new WeakMap,n=()=>{throw new Error("private-root-memory-scope-unverified")};function m(e,o){return A("git",[...o],{cwd:e,encoding:"utf8",stdio:["ignore","pipe","ignore"],env:{...Object.fromEntries(Object.entries(process.env).filter(([h])=>!h.startsWith("GIT_"))),GIT_NO_REPLACE_OBJECTS:"1"},timeout:3e4,maxBuffer:2*1024*1024})}async function J(e){let o="pin";try{const h=w(e.projectRoot);if(!/^P[1-9][0-9]*\.[0-9]+$/.test(e.storyId))return n();const r=await k(await P(h),"private-execution"),a=g(r,`session-${S("sha256").update(e.storyId).digest("hex")}.json`);await R(a,r);const i=l(a);if(i.length>128*1024)return n();const s=JSON.parse(i.toString("utf8"));if(o="binding",s.storyId!==e.storyId||s.graphRevision!==e.graphRevision||s.setupSessionId!==e.setupSessionId||s.snapshotSha!==e.snapshotSha||s.workspace?.sourceRoot!==h||s.workspace?.workspacePath!==e.snapshotRoot||s.workspace?.baseSha!==e.sourceHeadSha||s.workspace?.executionBranch!==e.executionBranch)return n();if(s.rootMemoryEffect===void 0)return;const t=s.rootMemoryEffect;if(!_(t)||!Array.isArray(s.graphHistory)||!s.graphHistory.includes(t.graphRevision))return n();o="producer-receipt";const d=f=>S("sha256").update(f).digest("hex"),y=g(r,`memory-review-${d(JSON.stringify(t))}.json`);await R(y,r);const x=l(y);if(x.length>128*1024)return n();const c=JSON.parse(x.toString("utf8"));if(Object.keys(c).sort().join("|")!==["schemaVersion","kind","storyId","graphRevision","sourceHeadSha","snapshotSha","proposalSha256","notesSha256","sourceStateSha256","checks","reviewedAt","rootMemoryEffect","independentStoryQaAccepted","terminalAccepted"].sort().join("|")||c.schemaVersion!==1||c.kind!=="private-project-memory-root-review"||c.storyId!==e.storyId||c.graphRevision!==t.graphRevision||c.sourceHeadSha!==e.sourceHeadSha||c.snapshotSha!==t.memorySnapshotSha||c.notesSha256!==t.proposalSha256||c.reviewedAt!==t.recordedAt||c.independentStoryQaAccepted!==!1||c.terminalAccepted!==!1||!u(c.rootMemoryEffect,t)||!c.checks||Object.keys(c.checks).sort().join("|")!==[...b].sort().join("|")||b.some(f=>c.checks[f]!==!0)||c.proposalSha256!==d(Buffer.from(m(e.snapshotRoot,["show",`${t.sourceSnapshotSha}:.neocortex/stories/${e.storyId}/validation-evidence.md`])))||c.sourceStateSha256!==d(Buffer.from(m(e.snapshotRoot,["show",`${t.sourceSnapshotSha}:.neocortex/state.json`]))))return n();const E=g(r,`qa-review-${t.rootQaReceiptId}.json`);await R(E,r);const v=l(E);if(v.length>16384||d(v)!==t.rootQaReceiptId)return n();const p=JSON.parse(v.toString("utf8"));if(p.kind!=="private-qa-root-review"||p.storyId!==e.storyId||p.sourceHeadSha!==e.sourceHeadSha||p.precommitQaAccepted!==!0||p.independentStoryQaAccepted!==!1||p.terminalAccepted!==!1||(m(e.snapshotRoot,["merge-base","--is-ancestor",p.snapshotSha,t.sourceSnapshotSha]),o="git-evidence",C(e.snapshotRoot,t,{storyId:e.storyId,executionBranch:e.executionBranch,sourceHeadSha:e.sourceHeadSha,graphRevision:t.graphRevision,setupSessionId:e.setupSessionId,childClaimRevision:S("sha256").update([...e.childPaths].sort().join("\0")).digest("hex")}),o="range",m(e.snapshotRoot,["merge-base","--is-ancestor",t.memorySnapshotSha,e.snapshotSha]),m(e.snapshotRoot,["diff","--name-only","--no-renames","--no-ext-diff","--no-textconv","-z",e.sourceHeadSha,e.snapshotSha]).split("\0").filter(Boolean).some(f=>!e.childPaths.includes(f)&&!t.files.some(O=>O.path===f))))return n();o="files";for(const f of t.files)if(e.childPaths.includes(f.path)||!u(I(e.snapshotRoot,e.sourceHeadSha,f.path),f.before)||!u(I(e.snapshotRoot,e.snapshotSha,f.path),f.after))return n();const M=Object.freeze(Object.create(null));return j.set(M,Object.freeze({effect:structuredClone(t),root:h,snapshotRoot:e.snapshotRoot})),M}catch{throw new Error(`private-root-memory-scope-${o}-unverified`)}}function N(e){const o=j.get(e);return o?structuredClone(o.effect):n()}function Q(e,o,h,r){return L(e,o,h,r)==="matched"}function L(e,o,h,r){const a=j.get(e);if(!a||a.root!==w(o)||h!==void 0&&h!==a.snapshotRoot)return"scope-binding";let i="snapshot-ancestry";try{if(r&&(m(a.snapshotRoot,["merge-base","--is-ancestor",a.effect.memorySnapshotSha,r]),i="snapshot-content",a.effect.files.some(t=>!u(I(a.snapshotRoot,r,t.path),t.after)))||(i="source-content",!a.effect.files.every(t=>u(G(o,t.path),t.after))))return i;i="source-projection";const s=F(q(["--project-root",o,"--verify"]));return s.canonicalSha256===a.effect.canonicalSha256&&s.projectionSha256===a.effect.projectionSha256&&s.fileCount===a.effect.projectionFileCount?"matched":i}catch{return i+"-unsafe"}}async function re(e){try{const o=w(e.projectRoot),h=await H(o,{required:!0}),r=h.stories[e.storyId]?.checkpoint;if(r?.rootMemoryEffect!==void 0)return r.storyId!==e.storyId||r.branch!==e.executionBranch||typeof r.baseSha!="string"||typeof r.headSha!="string"?n():structuredClone($(o,r.rootMemoryEffect,{storyId:e.storyId,executionBranch:e.executionBranch,baseSha:r.baseSha,headRef:r.headSha,childPaths:e.childPaths}));if(!/^P[1-9][0-9]*\.[0-9]+$/.test(e.storyId))return;const a=await k(await P(o),"private-execution"),i=g(a,`session-${S("sha256").update(e.storyId).digest("hex")}.json`);if(!B(i))return;await R(i,a);const s=l(i);if(s.length>128*1024)return n();const t=JSON.parse(s.toString("utf8"));if(t.rootMemoryEffect===void 0)return;const d=h.stories[e.storyId];if(d?.status!=="memory-updated"||typeof d.last_step!="string"||S("sha256").update(d.last_step).digest("hex")!==T||!Array.isArray(d.steps_completed)||d.steps_completed.at(-1)!==d.last_step)return n();const y=await J({projectRoot:o,storyId:e.storyId,snapshotRoot:t.workspace?.workspacePath,snapshotSha:t.snapshotSha,sourceHeadSha:t.workspace?.baseSha,executionBranch:e.executionBranch,graphRevision:e.graphRevision,setupSessionId:t.setupSessionId,childPaths:e.childPaths});return!y||!Q(y,o,t.workspace?.workspacePath,t.snapshotSha)?n():N(y)}catch{return n()}}export{N as privateRootMemoryEffect,L as privateRootMemorySourceMatchReason,Q as privateRootMemorySourceMatches,J as readPrivateRootMemoryScope,re as readRootMemoryEffectForCheckpoint};
+/** Load root memory scope only from the actual owner-private session pin. */
+import { createHash } from 'node:crypto';
+import { execFileSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
+import { isRootProjectMemoryEffect } from './shared-root-memory-types.js';
+import { assertGitLifecyclePrivateFile, ensureGitLifecyclePrivateChildDirectory, gitLifecycleRuntimeDirectory, readGitLifecycleRuntime } from '../git/git-lifecycle-store.js';
+import { rootMemoryGitFileState, verifyRootMemoryEffectGitEvidence, verifyRootMemoryPhysicalWriteSet } from './root-memory-git-evidence.js';
+import { rootMemoryFileState } from './root-memory-writer.js';
+import { ROOT_MEMORY_REVIEW_CHECKS, ROOT_MEMORY_STEP_DIGEST } from './root-memory-request.js';
+import { parseRefreshMemoryArgs, verifyProjectMemoryTargets } from '../commands/refresh-memory.js';
+const scopes = new WeakMap();
+const fail = () => { throw new Error('private-root-memory-scope-unverified'); };
+function git(root, args) {
+    return execFileSync('git', [...args], { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'],
+        env: { ...Object.fromEntries(Object.entries(process.env).filter(([key]) => !key.startsWith('GIT_'))), GIT_NO_REPLACE_OBJECTS: '1' },
+        timeout: 30_000, maxBuffer: 2 * 1024 * 1024 });
+}
+/** Absence means no extra scope; malformed or mismatched existing evidence fails closed. */
+export async function readPrivateRootMemoryScope(input) {
+    let stage = 'pin';
+    try {
+        const root = resolve(input.projectRoot);
+        if (!/^P[1-9][0-9]*\.[0-9]+$/.test(input.storyId))
+            return fail();
+        const parent = await ensureGitLifecyclePrivateChildDirectory(await gitLifecycleRuntimeDirectory(root), 'private-execution');
+        const path = join(parent, `session-${createHash('sha256').update(input.storyId).digest('hex')}.json`);
+        await assertGitLifecyclePrivateFile(path, parent);
+        const bytes = readFileSync(path);
+        if (bytes.length > 128 * 1024)
+            return fail();
+        const pin = JSON.parse(bytes.toString('utf8'));
+        stage = 'binding';
+        if (pin.storyId !== input.storyId || pin.graphRevision !== input.graphRevision
+            || pin.setupSessionId !== input.setupSessionId || pin.snapshotSha !== input.snapshotSha
+            || pin.workspace?.sourceRoot !== root || pin.workspace?.workspacePath !== input.snapshotRoot
+            || pin.workspace?.baseSha !== input.sourceHeadSha || pin.workspace?.executionBranch !== input.executionBranch)
+            return fail();
+        if (pin.rootMemoryEffect === undefined)
+            return undefined;
+        const effect = pin.rootMemoryEffect;
+        if (!isRootProjectMemoryEffect(effect) || !Array.isArray(pin.graphHistory)
+            || !pin.graphHistory.includes(effect.graphRevision))
+            return fail();
+        stage = 'producer-receipt';
+        const digest = (value) => createHash('sha256').update(value).digest('hex');
+        const receiptPath = join(parent, `memory-review-${digest(JSON.stringify(effect))}.json`);
+        await assertGitLifecyclePrivateFile(receiptPath, parent);
+        const receiptBytes = readFileSync(receiptPath);
+        if (receiptBytes.length > 128 * 1024)
+            return fail();
+        const receipt = JSON.parse(receiptBytes.toString('utf8'));
+        if (Object.keys(receipt).sort().join('|') !== ['schemaVersion', 'kind', 'storyId', 'graphRevision', 'sourceHeadSha', 'snapshotSha',
+            'proposalSha256', 'notesSha256', 'sourceStateSha256', 'checks', 'reviewedAt', 'rootMemoryEffect', 'independentStoryQaAccepted', 'terminalAccepted'].sort().join('|')
+            || receipt.schemaVersion !== 1 || receipt.kind !== 'private-project-memory-root-review'
+            || receipt.storyId !== input.storyId || receipt.graphRevision !== effect.graphRevision || receipt.sourceHeadSha !== input.sourceHeadSha
+            || receipt.snapshotSha !== effect.memorySnapshotSha || receipt.notesSha256 !== effect.proposalSha256 || receipt.reviewedAt !== effect.recordedAt
+            || receipt.independentStoryQaAccepted !== false || receipt.terminalAccepted !== false || !isDeepStrictEqual(receipt.rootMemoryEffect, effect)
+            || !receipt.checks || Object.keys(receipt.checks).sort().join('|') !== [...ROOT_MEMORY_REVIEW_CHECKS].sort().join('|')
+            || ROOT_MEMORY_REVIEW_CHECKS.some(key => receipt.checks[key] !== true)
+            || receipt.proposalSha256 !== digest(Buffer.from(git(input.snapshotRoot, ['show', `${effect.sourceSnapshotSha}:.neocortex/stories/${input.storyId}/validation-evidence.md`])))
+            || receipt.sourceStateSha256 !== digest(Buffer.from(git(input.snapshotRoot, ['show', `${effect.sourceSnapshotSha}:.neocortex/state.json`]))))
+            return fail();
+        const qaPath = join(parent, `qa-review-${effect.rootQaReceiptId}.json`);
+        await assertGitLifecyclePrivateFile(qaPath, parent);
+        const qaBytes = readFileSync(qaPath);
+        if (qaBytes.length > 16384 || digest(qaBytes) !== effect.rootQaReceiptId)
+            return fail();
+        const qa = JSON.parse(qaBytes.toString('utf8'));
+        if (qa.kind !== 'private-qa-root-review' || qa.storyId !== input.storyId || qa.sourceHeadSha !== input.sourceHeadSha
+            || qa.precommitQaAccepted !== true || qa.independentStoryQaAccepted !== false || qa.terminalAccepted !== false)
+            return fail();
+        git(input.snapshotRoot, ['merge-base', '--is-ancestor', qa.snapshotSha, effect.sourceSnapshotSha]);
+        stage = 'git-evidence';
+        verifyRootMemoryEffectGitEvidence(input.snapshotRoot, effect, {
+            storyId: input.storyId, executionBranch: input.executionBranch, sourceHeadSha: input.sourceHeadSha,
+            graphRevision: effect.graphRevision, setupSessionId: input.setupSessionId,
+            childClaimRevision: createHash('sha256').update([...input.childPaths].sort().join('\0')).digest('hex'),
+        });
+        stage = 'range';
+        git(input.snapshotRoot, ['merge-base', '--is-ancestor', effect.memorySnapshotSha, input.snapshotSha]);
+        const changed = git(input.snapshotRoot, ['diff', '--name-only', '--no-renames', '--no-ext-diff', '--no-textconv', '-z',
+            input.sourceHeadSha, input.snapshotSha]).split('\0').filter(Boolean);
+        if (changed.some(path => !input.childPaths.includes(path) && !effect.files.some(file => file.path === path)))
+            return fail();
+        stage = 'files';
+        for (const file of effect.files) {
+            if (input.childPaths.includes(file.path)
+                || !isDeepStrictEqual(rootMemoryGitFileState(input.snapshotRoot, input.sourceHeadSha, file.path), file.before)
+                || !isDeepStrictEqual(rootMemoryGitFileState(input.snapshotRoot, input.snapshotSha, file.path), file.after))
+                return fail();
+        }
+        const scope = Object.freeze(Object.create(null));
+        scopes.set(scope, Object.freeze({ effect: structuredClone(effect), root, snapshotRoot: input.snapshotRoot }));
+        return scope;
+    }
+    catch {
+        throw new Error(`private-root-memory-scope-${stage}-unverified`);
+    }
+}
+/** A caller-provided object never supplies extra source or agent permissions. */
+export function privateRootMemoryEffect(scope) {
+    const value = scopes.get(scope);
+    if (!value)
+        return fail();
+    return structuredClone(value.effect);
+}
+export function privateRootMemorySourceMatches(scope, root, snapshotRoot, snapshotSha) {
+    return privateRootMemorySourceMatchReason(scope, root, snapshotRoot, snapshotSha) === 'matched';
+}
+export function privateRootMemorySourceMatchReason(scope, root, snapshotRoot, snapshotSha) {
+    const value = scopes.get(scope);
+    if (!value || value.root !== resolve(root) || snapshotRoot !== undefined && snapshotRoot !== value.snapshotRoot)
+        return 'scope-binding';
+    let stage = 'snapshot-ancestry';
+    try {
+        if (snapshotSha) {
+            git(value.snapshotRoot, ['merge-base', '--is-ancestor', value.effect.memorySnapshotSha, snapshotSha]);
+            stage = 'snapshot-content';
+            if (value.effect.files.some(file => !isDeepStrictEqual(rootMemoryGitFileState(value.snapshotRoot, snapshotSha, file.path), file.after)))
+                return stage;
+        }
+        stage = 'source-content';
+        if (!value.effect.files.every(file => isDeepStrictEqual(rootMemoryFileState(root, file.path), file.after)))
+            return stage;
+        stage = 'source-projection';
+        const verified = verifyProjectMemoryTargets(parseRefreshMemoryArgs(['--project-root', root, '--verify']));
+        return verified.canonicalSha256 === value.effect.canonicalSha256 && verified.projectionSha256 === value.effect.projectionSha256
+            && verified.fileCount === value.effect.projectionFileCount ? 'matched' : stage;
+    }
+    catch {
+        return stage + '-unsafe';
+    }
+}
+/** C08 selection comes from actual private custody, never caller-supplied JSON. */
+export async function readRootMemoryEffectForCheckpoint(input) {
+    try {
+        const root = resolve(input.projectRoot), runtime = await readGitLifecycleRuntime(root, { required: true });
+        const checkpoint = runtime.stories[input.storyId]?.checkpoint;
+        if (checkpoint?.rootMemoryEffect !== undefined) {
+            if (checkpoint.storyId !== input.storyId || checkpoint.branch !== input.executionBranch
+                || typeof checkpoint.baseSha !== 'string' || typeof checkpoint.headSha !== 'string')
+                return fail();
+            return structuredClone(verifyRootMemoryPhysicalWriteSet(root, checkpoint.rootMemoryEffect, {
+                storyId: input.storyId, executionBranch: input.executionBranch, baseSha: checkpoint.baseSha,
+                headRef: checkpoint.headSha, childPaths: input.childPaths,
+            }));
+        }
+        if (!/^P[1-9][0-9]*\.[0-9]+$/.test(input.storyId))
+            return undefined;
+        const parent = await ensureGitLifecyclePrivateChildDirectory(await gitLifecycleRuntimeDirectory(root), 'private-execution');
+        const path = join(parent, `session-${createHash('sha256').update(input.storyId).digest('hex')}.json`);
+        if (!existsSync(path))
+            return undefined;
+        await assertGitLifecyclePrivateFile(path, parent);
+        const bytes = readFileSync(path);
+        if (bytes.length > 128 * 1024)
+            return fail();
+        const pin = JSON.parse(bytes.toString('utf8'));
+        if (pin.rootMemoryEffect === undefined)
+            return undefined;
+        const story = runtime.stories[input.storyId];
+        if (story?.status !== 'memory-updated' || typeof story.last_step !== 'string'
+            || createHash('sha256').update(story.last_step).digest('hex') !== ROOT_MEMORY_STEP_DIGEST
+            || !Array.isArray(story.steps_completed) || story.steps_completed.at(-1) !== story.last_step)
+            return fail();
+        const scope = await readPrivateRootMemoryScope({ projectRoot: root, storyId: input.storyId,
+            snapshotRoot: pin.workspace?.workspacePath, snapshotSha: pin.snapshotSha, sourceHeadSha: pin.workspace?.baseSha,
+            executionBranch: input.executionBranch, graphRevision: input.graphRevision, setupSessionId: pin.setupSessionId, childPaths: input.childPaths });
+        if (!scope || !privateRootMemorySourceMatches(scope, root, pin.workspace?.workspacePath, pin.snapshotSha))
+            return fail();
+        return privateRootMemoryEffect(scope);
+    }
+    catch {
+        return fail();
+    }
+}

package/packages/client/dist/private-execution/root-memory-writer.js

@@ -1 +1,102 @@
-import{execFileSync as z}from"node:child_process";import{createHash as N}from"node:crypto";import{lstatSync as y,readFileSync as E,readlinkSync as D,realpathSync as v}from"node:fs";import{join as O,resolve as l}from"node:path";import{rootProjectMemoryPaths as j}from"./shared-root-memory-types.js";import{parseRefreshMemoryArgs as x,refreshProjectMemoryTargets as M,verifyProjectMemoryTargets as J}from"../commands/refresh-memory.js";import{assertProjectMemoryPaths as w}from"../memory/project-memory-path-scope.js";import{classifyProjectMemoryUpdate as P}from"../memory/project-memory-writer.js";const d=r=>N("sha256").update(r).digest("hex"),h=new WeakMap,n=()=>{throw new Error("private-root-memory-writer-unverified")};function c(r,...e){return z("git",e,{cwd:r,encoding:"utf8",stdio:["ignore","pipe","ignore"],env:Object.fromEntries(Object.entries(process.env).filter(([i])=>!i.startsWith("GIT_"))),timeout:3e4,maxBuffer:2*1024*1024})}function m(r,e){if(!j().includes(e))return n();w(r,[e]);const i=O(r,e);let o;try{o=y(i)}catch(a){return a.code==="ENOENT"?{kind:"absent",sha256:null}:n()}if(o.uid!==process.getuid?.()||o.nlink!==1||(o.mode&18)!==0&&!o.isSymbolicLink())return n();if(o.isSymbolicLink()){const a=D(i);return l(r,e,"..",a)!==O(l(r),"NEOCORTEX.md")?n():{kind:"symlink",sha256:d(a),linkTarget:a}}return!o.isFile()||o.size>512*1024?n():{kind:"regular",sha256:d(E(i))}}function G(r){const e=l(r.snapshotRoot),i=l(r.backupDirectory),o=y(e),a=y(i);if(!o.isDirectory()||o.uid!==process.getuid?.()||(o.mode&63)!==0||v(e)!==e||!a.isDirectory()||a.isSymbolicLink()||a.uid!==process.getuid?.()||(a.mode&63)!==0||v(i)!==i||i===e||i.startsWith(e+"/")||!/^[a-f0-9]{40,64}$/.test(r.expectedSnapshotSha)||!Array.isArray(r.notes)||r.notes.length<1||r.notes.length>8||r.notes.some(t=>typeof t!="string"||Buffer.byteLength(t)<1||Buffer.byteLength(t)>512)||c(e,"rev-parse","HEAD").trim()!==r.expectedSnapshotSha||c(e,"status","--porcelain=v1","--untracked-files=all").length!==0)return n();for(const t of r.notes)P(t);const f=j(),g=new Map(f.map(t=>[t,m(e,t)])),S=x(["--project-root",e,...r.notes.flatMap(t=>["--note",t])]);if(M({...S,dryRun:!0}).some(t=>t.files.some(s=>s.fallbackReason||s.remediationDebt||s.mode==="compatibility-materialized-fallback"||!f.includes(s.relativeFile))))return n();for(const[t,s]of g)if(JSON.stringify(m(e,t))!==JSON.stringify(s))return n();if(M({...S,backupDirectory:i}).some(t=>t.files.some(s=>s.fallbackReason||s.remediationDebt||s.mode==="compatibility-materialized-fallback"||!f.includes(s.relativeFile))))return n();const R=J(x(["--project-root",e,"--verify"])),u=c(e,"status","--porcelain=v1","-z","--untracked-files=all").split("\0").filter(Boolean).map(t=>t.slice(3));if(u.some(t=>!f.includes(t))||c(e,"rev-parse","HEAD").trim()!==r.expectedSnapshotSha)return n();const p=f.flatMap(t=>{const s=g.get(t),k=m(e,t);return JSON.stringify(s)===JSON.stringify(k)?[]:[Object.freeze({path:t,before:Object.freeze(s),after:Object.freeze(k)})]});if(p.some(t=>!u.includes(t.path))||u.some(t=>!p.some(s=>s.path===t)))return n();const b=Object.freeze(Object.create(null));return h.set(b,Object.freeze({snapshotRoot:e,sourceSnapshotSha:r.expectedSnapshotSha,notesSha256:d(JSON.stringify(r.notes)),files:Object.freeze(p),verification:Object.freeze(R)})),b}function U(r){return h.get(r)}function X(r){const e=h.get(r);if(!e||c(e.snapshotRoot,"rev-parse","HEAD").trim()!==e.sourceSnapshotSha)return n();const i=c(e.snapshotRoot,"status","--porcelain=v1","-z","--untracked-files=all").split("\0").filter(Boolean).map(o=>o.slice(3)).sort();return JSON.stringify(i)!==JSON.stringify(e.files.map(o=>o.path).sort())||e.files.some(o=>JSON.stringify(m(e.snapshotRoot,o.path))!==JSON.stringify(o.after))?n():e}export{G as executeRootMemoryWriter,U as projectRootMemoryWriterExecution,m as rootMemoryFileState,X as verifyRootMemoryWriterExecution};
+/** Executes the existing canonical/all-target writer in the root's private clone.
+ * This produces an opaque execution authority, never source or checkpoint permission.
+ */
+import { execFileSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { lstatSync, readFileSync, readlinkSync, realpathSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { rootProjectMemoryPaths } from './shared-root-memory-types.js';
+import { parseRefreshMemoryArgs, refreshProjectMemoryTargets, verifyProjectMemoryTargets } from '../commands/refresh-memory.js';
+import { assertProjectMemoryPaths } from '../memory/project-memory-path-scope.js';
+import { classifyProjectMemoryUpdate } from '../memory/project-memory-writer.js';
+const hash = (bytes) => createHash('sha256').update(bytes).digest('hex');
+const authorities = new WeakMap();
+const fail = () => { throw new Error('private-root-memory-writer-unverified'); };
+function git(root, ...args) {
+    return execFileSync('git', args, { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'],
+        env: Object.fromEntries(Object.entries(process.env).filter(([key]) => !key.startsWith('GIT_'))),
+        timeout: 30_000, maxBuffer: 2 * 1024 * 1024 });
+}
+export function rootMemoryFileState(root, path) {
+    if (!rootProjectMemoryPaths().includes(path))
+        return fail();
+    assertProjectMemoryPaths(root, [path]);
+    const full = join(root, path);
+    let info;
+    try {
+        info = lstatSync(full);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return { kind: 'absent', sha256: null };
+        return fail();
+    }
+    if (info.uid !== process.getuid?.() || info.nlink !== 1 || (info.mode & 0o022) !== 0 && !info.isSymbolicLink())
+        return fail();
+    if (info.isSymbolicLink()) {
+        const linkTarget = readlinkSync(full);
+        // Never follow an arbitrary source link or copy external data into memory.
+        if (resolve(root, path, '..', linkTarget) !== join(resolve(root), 'NEOCORTEX.md'))
+            return fail();
+        return { kind: 'symlink', sha256: hash(linkTarget), linkTarget };
+    }
+    if (!info.isFile() || info.size > 512 * 1024)
+        return fail();
+    return { kind: 'regular', sha256: hash(readFileSync(full)) };
+}
+export function executeRootMemoryWriter(input) {
+    const root = resolve(input.snapshotRoot), backup = resolve(input.backupDirectory);
+    const info = lstatSync(root), backupInfo = lstatSync(backup);
+    if (!info.isDirectory() || info.uid !== process.getuid?.() || (info.mode & 0o077) !== 0 || realpathSync(root) !== root || !backupInfo.isDirectory() || backupInfo.isSymbolicLink()
+        || backupInfo.uid !== process.getuid?.() || (backupInfo.mode & 0o077) !== 0 || realpathSync(backup) !== backup
+        || backup === root || backup.startsWith(root + '/') || !/^[a-f0-9]{40,64}$/.test(input.expectedSnapshotSha)
+        || !Array.isArray(input.notes) || input.notes.length < 1 || input.notes.length > 8
+        || input.notes.some(note => typeof note !== 'string' || Buffer.byteLength(note) < 1 || Buffer.byteLength(note) > 512)
+        || git(root, 'rev-parse', 'HEAD').trim() !== input.expectedSnapshotSha
+        || git(root, 'status', '--porcelain=v1', '--untracked-files=all').length !== 0)
+        return fail();
+    for (const note of input.notes)
+        classifyProjectMemoryUpdate(note);
+    const paths = rootProjectMemoryPaths(), before = new Map(paths.map(path => [path, rootMemoryFileState(root, path)]));
+    const options = parseRefreshMemoryArgs(['--project-root', root, ...input.notes.flatMap(note => ['--note', note])]);
+    const preview = refreshProjectMemoryTargets({ ...options, dryRun: true });
+    if (preview.some(result => result.files.some(file => file.fallbackReason || file.remediationDebt
+        || file.mode === 'compatibility-materialized-fallback' || !paths.includes(file.relativeFile))))
+        return fail();
+    for (const [path, state] of before)
+        if (JSON.stringify(rootMemoryFileState(root, path)) !== JSON.stringify(state))
+            return fail();
+    const results = refreshProjectMemoryTargets({ ...options, backupDirectory: backup });
+    if (results.some(result => result.files.some(file => file.fallbackReason || file.remediationDebt
+        || file.mode === 'compatibility-materialized-fallback' || !paths.includes(file.relativeFile))))
+        return fail();
+    const verification = verifyProjectMemoryTargets(parseRefreshMemoryArgs(['--project-root', root, '--verify']));
+    const changed = git(root, 'status', '--porcelain=v1', '-z', '--untracked-files=all').split('\0').filter(Boolean)
+        .map(row => row.slice(3));
+    if (changed.some(path => !paths.includes(path)) || git(root, 'rev-parse', 'HEAD').trim() !== input.expectedSnapshotSha)
+        return fail();
+    const files = paths.flatMap(path => {
+        const previous = before.get(path), after = rootMemoryFileState(root, path);
+        return JSON.stringify(previous) === JSON.stringify(after) ? [] : [Object.freeze({ path, before: Object.freeze(previous), after: Object.freeze(after) })];
+    });
+    if (files.some(file => !changed.includes(file.path)) || changed.some(path => !files.some(file => file.path === path)))
+        return fail();
+    const authority = Object.freeze(Object.create(null));
+    authorities.set(authority, Object.freeze({ snapshotRoot: root, sourceSnapshotSha: input.expectedSnapshotSha,
+        notesSha256: hash(JSON.stringify(input.notes)), files: Object.freeze(files), verification: Object.freeze(verification) }));
+    return authority;
+}
+export function projectRootMemoryWriterExecution(authority) {
+    return authorities.get(authority);
+}
+/** Recheck the actual writer output immediately before source admission. */
+export function verifyRootMemoryWriterExecution(authority) {
+    const value = authorities.get(authority);
+    if (!value || git(value.snapshotRoot, 'rev-parse', 'HEAD').trim() !== value.sourceSnapshotSha)
+        return fail();
+    const changed = git(value.snapshotRoot, 'status', '--porcelain=v1', '-z', '--untracked-files=all').split('\0').filter(Boolean).map(row => row.slice(3)).sort();
+    if (JSON.stringify(changed) !== JSON.stringify(value.files.map(file => file.path).sort())
+        || value.files.some(file => JSON.stringify(rootMemoryFileState(value.snapshotRoot, file.path)) !== JSON.stringify(file.after)))
+        return fail();
+    return value;
+}