@ornexus/neocortex 4.60.68 → 4.60.70

package/packages/client/dist/runner/headless/epic-git-reconciliation-inventory.js

@@ -1,69 +1 @@
-export const GIT_INVENTORY_REF_LIMIT = 2048;
-/** Maximum PRs related to managed branches, independent of repository history size. */
-export const GIT_INVENTORY_PR_LIMIT = 1000;
-export function collectGitResourceOwnership(state) {
-    const claims = new Map();
-    const origins = new Set();
-    const epics = Object.entries(state.epics ?? {});
-    const stories = Object.entries(state.stories ?? {});
-    if (epics.length + stories.length > 10000)
-        throw new Error('git-reconciliation-state-inventory-limit');
-    const add = (claim) => {
-        if (!claim.branch || !claim.origin)
-            return;
-        claims.set(claim.branch, [...(claims.get(claim.branch) ?? []), claim]);
-    };
-    for (const [epicId, epic] of epics) {
-        const branch = str(epic.execution_branch), origin = str(epic.origin_branch);
-        if (origin)
-            origins.add(origin);
-        const receipt = record(epic.terminal_git_receipt);
-        const receiptMatches = receipt?.physicalStatus === 'pushed' && receipt.epicId === epicId
-            && receipt.executionBranch === branch && receipt.originBranch === origin
-            && sha(receipt.executionHeadSha) && sha(receipt.mergeSha) && sha(receipt.pushedSha);
-        // A receipt-only orphan can be reconciled; an explicitly resumed lifecycle
-        // or live writer always wins over an older terminal receipt.
-        const active = liveLease(epic.branch_lease)
-            || (epic.status === undefined ? !receiptMatches : !terminal(epic.status));
-        add({ epicId, branch, origin, active,
-            proofs: receiptMatches ? [{ head: str(receipt.executionHeadSha),
-                    evidence: ['terminal_receipt', 'canonical_convention', 'managed_metadata'],
-                    mergeSha: str(receipt.mergeSha), pushedSha: str(receipt.pushedSha) }] : [],
-            prNumbers: prNumber(epic.pr_number), });
-    }
-    for (const [storyId, story] of stories) {
-        const epicId = str(story.epic_id) || storyId.split('.')[0];
-        const epic = state.epics?.[epicId];
-        const checkpoint = record(story.checkpoint);
-        const branch = str(story.branch_name) || str(checkpoint?.branch);
-        if (!epic || branch === str(epic.execution_branch))
-            continue;
-        const proofMatches = checkpoint?.branch === branch && sha(checkpoint.headSha);
-        add({ epicId, branch, origin: str(epic.origin_branch),
-            active: !terminal(story.status) || liveLease(story.branch_lease),
-            proofs: proofMatches ? [{ head: str(checkpoint.headSha),
-                    evidence: ['state_reference', 'canonical_convention', 'managed_metadata'] }] : [],
-            prNumbers: prNumber(story.pr_number), });
-    }
-    // Convention is corroboration, never authority; validate it against the
-    // recorded owner rather than accepting a similar branch prefix.
-    for (const [branch, entries] of claims) {
-        claims.set(branch, entries.map((entry) => ({ ...entry, proofs: entry.proofs.map((proof) => ({
-                ...proof, evidence: proof.evidence.filter((item) => item !== 'canonical_convention'
-                    || branch === `epic/${entry.epicId}` || branch.startsWith(`epic/${entry.epicId}/`)
-                    || branch.startsWith(`story/${entry.epicId}.`) || branch.startsWith(`story/${entry.epicId}/`)),
-            })) })));
-    }
-    return { claims, origins };
-}
-function str(value) { return typeof value === 'string' ? value : ''; }
-function record(value) {
-    return value !== null && typeof value === 'object' && !Array.isArray(value) ? value : undefined;
-}
-function sha(value) { return typeof value === 'string' && /^[a-f0-9]{40,64}$/.test(value); }
-function terminal(value) { return ['done', 'completed', 'merged', 'superseded', 'cancelled', 'archived', 'rolled-back'].includes(str(value)); }
-function liveLease(value) {
-    const lease = record(value);
-    return Boolean(lease && Date.parse(str(lease.expiresAt)) > Date.now());
-}
-function prNumber(value) { return Number.isSafeInteger(value) && Number(value) > 0 ? [Number(value)] : []; }
+const I=2048,S=1e3;function N(e){const s=new Map,u=new Set,f=Object.entries(e.epics??{}),b=Object.entries(e.stories??{});if(f.length+b.length>1e4)throw new Error("git-reconciliation-state-inventory-limit");const _=t=>{!t.branch||!t.origin||s.set(t.branch,[...s.get(t.branch)??[],t])};for(const[t,r]of f){const i=c(r.execution_branch),o=c(r.origin_branch);o&&u.add(o);const n=d(r.terminal_git_receipt),a=n?.physicalStatus==="pushed"&&n.epicId===t&&n.executionBranch===i&&n.originBranch===o&&p(n.executionHeadSha)&&p(n.mergeSha)&&p(n.pushedSha),h=m(r.branch_lease)||(r.status===void 0?!a:!g(r.status));_({epicId:t,branch:i,origin:o,active:h,proofs:a?[{head:c(n.executionHeadSha),evidence:["terminal_receipt","canonical_convention","managed_metadata"],mergeSha:c(n.mergeSha),pushedSha:c(n.pushedSha)}]:[],prNumbers:l(r.pr_number)})}for(const[t,r]of b){const i=c(r.epic_id)||t.split(".")[0],o=e.epics?.[i],n=d(r.checkpoint),a=c(r.branch_name)||c(n?.branch);if(!o||a===c(o.execution_branch))continue;const h=n?.branch===a&&p(n.headSha);_({epicId:i,branch:a,origin:c(o.origin_branch),active:!g(r.status)||m(r.branch_lease),proofs:h?[{head:c(n.headSha),evidence:["state_reference","canonical_convention","managed_metadata"]}]:[],prNumbers:l(r.pr_number)})}for(const[t,r]of s)s.set(t,r.map(i=>({...i,proofs:i.proofs.map(o=>({...o,evidence:o.evidence.filter(n=>n!=="canonical_convention"||t===`epic/${i.epicId}`||t.startsWith(`epic/${i.epicId}/`)||t.startsWith(`story/${i.epicId}.`)||t.startsWith(`story/${i.epicId}/`))}))})));return{claims:s,origins:u}}function c(e){return typeof e=="string"?e:""}function d(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)?e:void 0}function p(e){return typeof e=="string"&&/^[a-f0-9]{40,64}$/.test(e)}function g(e){return["done","completed","merged","superseded","cancelled","archived","rolled-back"].includes(c(e))}function m(e){const s=d(e);return!!(s&&Date.parse(c(s.expiresAt))>Date.now())}function l(e){return Number.isSafeInteger(e)&&Number(e)>0?[Number(e)]:[]}export{S as GIT_INVENTORY_PR_LIMIT,I as GIT_INVENTORY_REF_LIMIT,N as collectGitResourceOwnership};

package/packages/client/dist/runner/headless/epic-merge-candidate-qa.js

@@ -1,61 +1,4 @@
-/** Canonical P205 execution on an isolated, branchless combined merge tree. */
-import { execFile } from 'node:child_process';
-import { createHash, randomBytes } from 'node:crypto';
-import { join } from 'node:path';
-import { promisify } from 'node:util';
-import { assertGitLifecyclePrivateDirectory, ensureGitLifecyclePrivateChildDirectory, executeP205TransientAuthority, gitLifecycleRuntimeDirectory, P205_COMPLETE_COMMAND, p205TransientAuthorityMatchesAggregate, projectP205TransientExecutionEvidence, removeGitLifecyclePrivateDirectory, } from '../../git/git-lifecycle-store.js';
-import { anchoredCreateDirectory, anchoredDirectoryIdentity, anchoredExecuteGit, anchoredExecuteNode, anchoredExecuteNpm, secureFilesystemBoundaryAvailable, } from '../../git/secure-filesystem-boundary.js';
-const exec = promisify(execFile);
-const AUTHORITIES = new WeakMap();
-export function verifiedEpicMergeCandidateReceipt(authority, binding) {
-    const record = authority && AUTHORITIES.get(authority);
-    if (!record || !p205TransientAuthorityMatchesAggregate(record.p205, binding.mergeSha, binding.graphRevision))
-        return undefined;
-    const age = Date.now() - record.acceptedAt;
-    if (age < 0 || age > 30 * 60 * 1000)
-        return undefined;
-    const receipt = record.receipt;
-    return receipt.originHeadSha === binding.originHeadSha && receipt.executionHeadSha === binding.executionHeadSha
-        && receipt.mergeSha === binding.mergeSha && receipt.graphRevision === binding.graphRevision ? receipt : undefined;
-}
-export async function executeEpicMergeCandidateQa(projectRoot, binding, nowIso = new Date().toISOString()) {
-    if (!secureFilesystemBoundaryAvailable())
-        throw new Error('epic-merge-candidate-platform-unsupported');
-    if (![binding.originHeadSha, binding.executionHeadSha, binding.mergeSha].every((sha) => /^[a-f0-9]{40,64}$/.test(sha))
-        || !/^[a-f0-9]{64}$/.test(binding.graphRevision))
-        throw new Error('epic-merge-candidate-binding-invalid');
-    const rootGit = async (...args) => String((await exec('git', args, { cwd: projectRoot, encoding: 'utf8' })).stdout).trim();
-    const parents = (await rootGit('rev-list', '--parents', '-n', '1', binding.mergeSha)).split(/\s+/);
-    if (parents.length !== 3 || parents[1] !== binding.originHeadSha || parents[2] !== binding.executionHeadSha) {
-        throw new Error('epic-merge-candidate-parents-invalid');
-    }
-    const treeSha = await rootGit('rev-parse', `${binding.mergeSha}^{tree}`);
-    const runtime = await gitLifecycleRuntimeDirectory(projectRoot);
-    const parent = await ensureGitLifecyclePrivateChildDirectory(runtime, 'merge-candidates');
-    const name = `${binding.mergeSha.slice(0, 16)}-${randomBytes(8).toString('hex')}`;
-    const identity = await anchoredCreateDirectory(parent, name);
-    const workspace = join(parent, name);
-    const git = async (...args) => (await anchoredExecuteGit(parent, name, identity, args)).toString('utf8').trim();
-    let p205;
-    try {
-        await git('init', '--quiet', '--template=');
-        await git('fetch', '--quiet', '--no-tags', projectRoot, binding.mergeSha);
-        await git('checkout', '--quiet', '--detach', 'FETCH_HEAD');
-        if (await git('rev-parse', 'HEAD') !== binding.mergeSha || await git('rev-parse', 'HEAD^{tree}') !== treeSha) {
-            throw new Error('epic-merge-candidate-checkout-invalid');
-        }
-        // Inspect committed entry modes before any filesystem read or npm effect:
-        // a symlinked manifest/lock/config can redirect install outside this tree.
-        const dependencyEntries = (await git('ls-files', '--stage', '-z', '--', 'package.json', '*/package.json', 'package-lock.json', '*/package-lock.json', 'npm-shrinkwrap.json', '*/npm-shrinkwrap.json', '.npmrc', '*/.npmrc')).split('\0').filter(Boolean);
-        if (dependencyEntries.length > 1024 || dependencyEntries.some((entry) => !/^100(?:644|755) [a-f0-9]{40,64} 0\t/.test(entry))) {
-            throw new Error('epic-merge-candidate-dependency-entry-unsafe');
-        }
-        // Each lockfile is installed into the candidate itself. No source
-        // node_modules symlink/copy can make QA test the wrong dependency graph.
-        const lockfiles = (await git('ls-files', '-z', '--', 'package-lock.json', '*/package-lock.json', 'npm-shrinkwrap.json', '*/npm-shrinkwrap.json')).split('\0').filter(Boolean);
-        if (lockfiles.length > 32)
-            throw new Error('epic-merge-candidate-dependency-limit');
-        const dependencies = JSON.parse((await anchoredExecuteNode(parent, name, identity, ['-e', `
+import{execFile as D}from"node:child_process";import{createHash as x,randomBytes as H}from"node:crypto";import{join as j}from"node:path";import{promisify as A}from"node:util";import{assertGitLifecyclePrivateDirectory as O,ensureGitLifecyclePrivateChildDirectory as L,executeP205TransientAuthority as C,gitLifecycleRuntimeDirectory as P,P205_COMPLETE_COMMAND as R,p205TransientAuthorityMatchesAggregate as q,projectP205TransientExecutionEvidence as I,removeGitLifecyclePrivateDirectory as M}from"../../git/git-lifecycle-store.js";import{anchoredCreateDirectory as N,anchoredDirectoryIdentity as y,anchoredExecuteGit as T,anchoredExecuteNode as _,anchoredExecuteNpm as $,secureFilesystemBoundaryAvailable as z}from"../../git/secure-filesystem-boundary.js";const G=A(D),v=new WeakMap;function U(c,e){const s=c&&v.get(c);if(!s||!q(s.p205,e.mergeSha,e.graphRevision))return;const h=Date.now()-s.acceptedAt;if(h<0||h>1800*1e3)return;const r=s.receipt;return r.originHeadSha===e.originHeadSha&&r.executionHeadSha===e.executionHeadSha&&r.mergeSha===e.mergeSha&&r.graphRevision===e.graphRevision?r:void 0}async function Z(c,e,s=new Date().toISOString()){if(!z())throw new Error("epic-merge-candidate-platform-unsupported");if(![e.originHeadSha,e.executionHeadSha,e.mergeSha].every(a=>/^[a-f0-9]{40,64}$/.test(a))||!/^[a-f0-9]{64}$/.test(e.graphRevision))throw new Error("epic-merge-candidate-binding-invalid");const h=async(...a)=>String((await G("git",a,{cwd:c,encoding:"utf8"})).stdout).trim(),r=(await h("rev-list","--parents","-n","1",e.mergeSha)).split(/\s+/);if(r.length!==3||r[1]!==e.originHeadSha||r[2]!==e.executionHeadSha)throw new Error("epic-merge-candidate-parents-invalid");const f=await h("rev-parse",`${e.mergeSha}^{tree}`),S=await P(c),n=await L(S,"merge-candidates"),p=`${e.mergeSha.slice(0,16)}-${H(8).toString("hex")}`,o=await N(n,p),u=j(n,p),t=async(...a)=>(await T(n,p,o,a)).toString("utf8").trim();let w;try{if(await t("init","--quiet","--template="),await t("fetch","--quiet","--no-tags",c,e.mergeSha),await t("checkout","--quiet","--detach","FETCH_HEAD"),await t("rev-parse","HEAD")!==e.mergeSha||await t("rev-parse","HEAD^{tree}")!==f)throw new Error("epic-merge-candidate-checkout-invalid");const a=(await t("ls-files","--stage","-z","--","package.json","*/package.json","package-lock.json","*/package-lock.json","npm-shrinkwrap.json","*/npm-shrinkwrap.json",".npmrc","*/.npmrc")).split("\0").filter(Boolean);if(a.length>1024||a.some(l=>!/^100(?:644|755) [a-f0-9]{40,64} 0\t/.test(l)))throw new Error("epic-merge-candidate-dependency-entry-unsafe");const m=(await t("ls-files","-z","--","package-lock.json","*/package-lock.json","npm-shrinkwrap.json","*/npm-shrinkwrap.json")).split("\0").filter(Boolean);if(m.length>32)throw new Error("epic-merge-candidate-dependency-limit");const d=JSON.parse((await _(n,p,o,["-e",`
       const fs=require('node:fs'); const path=require('node:path'); const locks=JSON.parse(process.argv[1]);
       // npm-shrinkwrap wins over package-lock in the same installation root.
       // Validate every selected root, not only the repository's top-level lock.
@@ -82,55 +25,4 @@ export async function executeEpicMergeCandidateQa(projectRoot, binding, nowIso =
       }
       process.stdout.write(JSON.stringify({unsafeLinks,roots:[...selected.keys()]
         .filter(p=>!workspacePaths.has(p)).sort((a,b)=>a.length-b.length)}));
-    `, JSON.stringify(lockfiles)])).toString('utf8'));
-        if (dependencies.unsafeLinks)
-            throw new Error('epic-merge-candidate-dependency-link-unsafe');
-        if (dependencies.roots.length > 16)
-            throw new Error('epic-merge-candidate-dependency-limit');
-        for (const dependencyRoot of dependencies.roots) {
-            if (dependencyRoot !== '.' && !/^[A-Za-z0-9_.\/-]+$/.test(dependencyRoot)
-                || dependencyRoot.split('/').includes('..'))
-                throw new Error('epic-merge-candidate-dependency-path-invalid');
-            await anchoredExecuteNpm(parent, name, identity, ['--prefix', dependencyRoot, 'ci', '--include=dev', '--no-audit', '--no-fund']);
-        }
-        if (await git('status', '--porcelain', '--untracked-files=normal'))
-            throw new Error('epic-merge-candidate-dirty');
-        p205 = await executeP205TransientAuthority(workspace, {
-            headSha: binding.mergeSha, graphRevision: binding.graphRevision, nowIso,
-            anchoredWorkspace: { parent, name, identity },
-        });
-        if (await git('status', '--porcelain', '--untracked-files=normal')
-            || await git('rev-parse', 'HEAD') !== binding.mergeSha || await git('rev-parse', 'HEAD^{tree}') !== treeSha) {
-            throw new Error('epic-merge-candidate-raced');
-        }
-    }
-    finally {
-        // Cleanup is identity-checked; a substituted directory is never removed.
-        await assertGitLifecyclePrivateDirectory(workspace, parent);
-        const current = await anchoredDirectoryIdentity(workspace);
-        if (current.dev !== identity.dev || current.ino !== identity.ino)
-            throw new Error('epic-merge-candidate-cleanup-owner-raced');
-        if (!(await removeGitLifecyclePrivateDirectory(workspace, parent, async (renamed) => {
-            const moved = await anchoredDirectoryIdentity(renamed);
-            return moved.dev === identity.dev && moved.ino === identity.ino;
-        })))
-            throw new Error('epic-merge-candidate-cleanup-unverified');
-    }
-    const evidence = projectP205TransientExecutionEvidence(p205);
-    if (!evidence || evidence.executionHeadSha !== binding.mergeSha)
-        throw new Error('epic-merge-candidate-authority-missing');
-    const receiptRef = `merge-qa:${createHash('sha256').update([
-        'epic-merge-candidate-qa-v1', binding.originHeadSha, binding.executionHeadSha, binding.mergeSha,
-        treeSha, binding.graphRevision, evidence.manifestDigest, evidence.resultDigest, evidence.gateIds.join(','),
-    ].join('\0')).digest('hex')}`;
-    const candidateQa = Object.freeze({ schemaVersion: 1,
-        kind: 'epic_merge_candidate_qa', contract: 'P205-CI-02', command: P205_COMPLETE_COMMAND,
-        ...binding, treeSha, manifestDigest: evidence.manifestDigest, resultDigest: evidence.resultDigest,
-        gateIds: Object.freeze([...evidence.gateIds]), checkedAt: evidence.executedAt, receiptRef,
-    });
-    const candidateAuthority = Object.freeze(Object.create(null));
-    // Freshness is process-local evidence captured after QA, not a caller's
-    // serialized timestamp. Clock rollback or expiry requires new execution.
-    AUTHORITIES.set(candidateAuthority, { receipt: candidateQa, p205: p205, acceptedAt: Date.now() });
-    return { candidateQa, candidateAuthority };
-}
+    `,JSON.stringify(m)])).toString("utf8"));if(d.unsafeLinks)throw new Error("epic-merge-candidate-dependency-link-unsafe");if(d.roots.length>16)throw new Error("epic-merge-candidate-dependency-limit");for(const l of d.roots){if(l!=="."&&!/^[A-Za-z0-9_.\/-]+$/.test(l)||l.split("/").includes(".."))throw new Error("epic-merge-candidate-dependency-path-invalid");await $(n,p,o,["--prefix",l,"ci","--include=dev","--no-audit","--no-fund"])}if(await t("status","--porcelain","--untracked-files=normal"))throw new Error("epic-merge-candidate-dirty");if(w=await C(u,{headSha:e.mergeSha,graphRevision:e.graphRevision,nowIso:s,anchoredWorkspace:{parent:n,name:p,identity:o}}),await t("status","--porcelain","--untracked-files=normal")||await t("rev-parse","HEAD")!==e.mergeSha||await t("rev-parse","HEAD^{tree}")!==f)throw new Error("epic-merge-candidate-raced")}finally{await O(u,n);const a=await y(u);if(a.dev!==o.dev||a.ino!==o.ino)throw new Error("epic-merge-candidate-cleanup-owner-raced");if(!await M(u,n,async m=>{const d=await y(m);return d.dev===o.dev&&d.ino===o.ino}))throw new Error("epic-merge-candidate-cleanup-unverified")}const i=I(w);if(!i||i.executionHeadSha!==e.mergeSha)throw new Error("epic-merge-candidate-authority-missing");const E=`merge-qa:${x("sha256").update(["epic-merge-candidate-qa-v1",e.originHeadSha,e.executionHeadSha,e.mergeSha,f,e.graphRevision,i.manifestDigest,i.resultDigest,i.gateIds.join(",")].join("\0")).digest("hex")}`,g=Object.freeze({schemaVersion:1,kind:"epic_merge_candidate_qa",contract:"P205-CI-02",command:R,...e,treeSha:f,manifestDigest:i.manifestDigest,resultDigest:i.resultDigest,gateIds:Object.freeze([...i.gateIds]),checkedAt:i.executedAt,receiptRef:E}),k=Object.freeze(Object.create(null));return v.set(k,{receipt:g,p205:w,acceptedAt:Date.now()}),{candidateQa:g,candidateAuthority:k}}export{Z as executeEpicMergeCandidateQa,U as verifiedEpicMergeCandidateReceipt};