@ornexus/neocortex 4.60.71 → 4.60.73

package/packages/client/dist/private-execution/property-test-review.js

@@ -1,4 +1,258 @@
-import{createHash as $,randomUUID as L}from"node:crypto";import{closeSync as k,existsSync as T,fsyncSync as x,linkSync as P,lstatSync as h,mkdirSync as j,openSync as F,readFileSync as g,realpathSync as H,unlinkSync as C,writeFileSync as D}from"node:fs";import{isAbsolute as J,join as w,resolve as S}from"node:path";import{mutationQaGit as E}from"../commands/mutation-qa-git.js";import{inspectPropertyTestCandidate as z}from"./property-test-candidate.js";import{loadPropertyTestCandidatePlan as R}from"./property-test-choices.js";import{propertyTestInvariantRefs as q}from"./property-test-plan.js";import{verifyPropertyTestRuntime as B}from"./property-test-runtime.js";const A=/^[a-f0-9]{64}$/,b=256*1024;function v(n){return $("sha256").update(n).digest("hex")}function m(n,r){return n!==null&&typeof n=="object"&&!Array.isArray(n)&&Object.keys(n).sort().join("\0")===[...r].sort().join("\0")}function V(n,r){if(!/^tests\/property\/[a-z0-9-]+\.property\.test\.ts$/.test(r))throw new Error("property-test-review-unverified");let i=n;for(const[a,e]of r.split("/").entries()){i=w(i,e);const s=h(i);if(s.isSymbolicLink()||(a===r.split("/").length-1?!s.isFile()||s.size<1||s.size>256*1024:!s.isDirectory()))throw new Error("property-test-review-unverified")}return g(i)}function l(n){try{const r=z(n),{root:i,head:a,plan:e}=R(n);if(a!==r.sourceHead||e.planSha256!==r.planSha256)throw new Error("property-test-review-unverified");const s=E(i,["show",`HEAD:${e.prdPath}`]);if(v(s)!==e.prdSha256)throw new Error("property-test-review-unverified");const o=new TextDecoder("utf-8",{fatal:!0}).decode(s),t=q(o);if(t.length!==e.aggregates.reduce((d,p)=>d+p.invariantCount,0)||new Set(t.map(d=>d.invariantSha256)).size!==t.length)throw new Error("property-test-review-unverified");const u=new Map(e.aggregates.map(d=>[d.name,d])),c=new Map(e.aggregates.map(d=>{const p=V(i,d.testFile),y=new TextDecoder("utf-8",{fatal:!0}).decode(p).split(/\r?\n/);return[d.name,{testFile:d.testFile,testSha256:v(p),lineCount:y.length}]})),f=t.map(d=>{const p=u.get(d.aggregate),y=c.get(d.aggregate);if(!p||!y||d.ordinal>p.invariantCount)throw new Error("property-test-review-unverified");return Object.freeze({...d,...y})});if(z(i).artifactSha256!==r.artifactSha256)throw new Error("property-test-review-unverified");return Object.freeze({schemaVersion:1,kind:"property-test-review-plan",sourceHead:a,planSha256:e.planSha256,candidateSha256:r.artifactSha256,invariants:f,executionVerified:!1,qaAccepted:!1,publicSafe:!0})}catch{throw new Error("property-test-review-unverified")}}function N(n,r){try{const i=l(n);if(!m(r,["schemaVersion","kind","sourceHead","planSha256","candidateSha256","verdict","coverage"])||r.schemaVersion!==1||r.kind!=="property-test-semantic-review"||r.verdict!=="approved"||r.sourceHead!==i.sourceHead||r.planSha256!==i.planSha256||r.candidateSha256!==i.candidateSha256||!Array.isArray(r.coverage)||r.coverage.length!==i.invariants.length||Buffer.byteLength(JSON.stringify(r))>b)throw new Error("property-test-review-unverified");const a=new Map(i.invariants.map(t=>[t.invariantSha256,t])),e=new Set,s=new Set,o=new Map([...new Set(i.invariants.map(t=>t.testFile))].map(t=>[t,new TextDecoder("utf-8",{fatal:!0}).decode(V(n,t)).split(/\r?\n/)]));for(const t of r.coverage){if(!m(t,["invariantSha256","testFile","assertionLine","rationale"])||typeof t.invariantSha256!="string"||!A.test(t.invariantSha256)||e.has(t.invariantSha256))throw new Error("property-test-review-unverified");e.add(t.invariantSha256);const u=a.get(t.invariantSha256),c=`${t.testFile}:${t.assertionLine}`;if(!u||t.testFile!==u.testFile||s.has(c)||!Number.isSafeInteger(t.assertionLine)||Number(t.assertionLine)<1||Number(t.assertionLine)>u.lineCount||typeof t.rationale!="string"||t.rationale.length<30||t.rationale.length>500||/[\x00-\x1f\x7f]/.test(t.rationale))throw new Error("property-test-review-unverified");s.add(c);const f=o.get(u.testFile)?.[Number(t.assertionLine)-1]??"";if(!/\b(?:expect|assert|throw)\s*\(/.test(f.split("//")[0]??""))throw new Error("property-test-review-unverified")}if(e.size!==a.size||l(n).candidateSha256!==i.candidateSha256)throw new Error("property-test-review-unverified");return Object.freeze({plan:i,reviewSha256:v(`property-test-semantic-review-v1\0${JSON.stringify(r)}`)})}catch{throw new Error("property-test-review-unverified")}}function O(n,r){const i=E(n,["rev-parse","--show-toplevel"]).toString("utf8").trim(),a=E(n,["rev-parse","--git-common-dir"]).toString("utf8").trim(),e=J(a)?S(a):S(n,a);if(H(n)!==n||i!==n||H(e)!==e||h(e).isSymbolicLink()||h(e).uid!==process.getuid?.())throw new Error("property-test-review-unverified");const s=w(e,"neocortex-property-test");r&&j(s,{recursive:!0,mode:448});const o=h(s);if(!o.isDirectory()||o.isSymbolicLink()||o.uid!==process.getuid?.()||(o.mode&63)!==0)throw new Error("property-test-review-unverified");return s}function X(n,r){try{const i=S(n),a=N(i,r),e=B(i);if(!e.executionVerified||e.qaAccepted||e.outcome!=="execution-proven"||e.sourceHead!==a.plan.sourceHead||e.candidateSha256!==a.plan.candidateSha256||e.passedTests<a.plan.invariants.length||e.causalFailedTests!==e.passedTests||l(i).candidateSha256!==a.plan.candidateSha256)throw new Error("property-test-review-unverified");const s=Object.freeze({schemaVersion:1,kind:"property-test-review-acceptance",sourceHead:a.plan.sourceHead,planSha256:a.plan.planSha256,candidateSha256:a.plan.candidateSha256,reviewSha256:a.reviewSha256,invariantCount:a.plan.invariants.length,passedTests:e.passedTests,causalFailedTests:e.causalFailedTests,executionVerified:!0,qaAccepted:!0,publicSafe:!0}),o=O(i,!0),t=w(o,`review-${s.candidateSha256}.json`),u={report:r,receipt:s},c={schemaVersion:1,kind:"property-test-review-record",...u,checksumSha256:v(`property-test-review-record-v1\0${JSON.stringify(u)}`)};if(T(t)){const p=h(t);if(!p.isFile()||p.isSymbolicLink()||p.uid!==process.getuid?.()||(p.mode&63)!==0||p.size<1||p.size>b+4096||g(t,"utf8")!==`${JSON.stringify(c)}
-`)throw new Error("property-test-review-unverified");return s}const f=w(o,`review-${L()}.tmp`),d=F(f,"wx",384);try{D(d,`${JSON.stringify(c)}
-`),x(d)}finally{k(d)}try{if(l(i).candidateSha256!==s.candidateSha256)throw new Error("property-test-review-unverified");P(f,t);const p=F(o,"r");try{x(p)}finally{k(p)}}finally{T(f)&&C(f)}return s}catch{throw new Error("property-test-review-unverified")}}function Y(n){try{const r=S(n),i=l(r),a=w(O(r,!1),`review-${i.candidateSha256}.json`),e=h(a);if(!e.isFile()||e.isSymbolicLink()||e.uid!==process.getuid?.()||(e.mode&63)!==0||e.size<1||e.size>b+4096)throw new Error("property-test-review-unverified");const s=g(a,"utf8"),o=JSON.parse(s);if(!m(o,["schemaVersion","kind","report","receipt","checksumSha256"])||o.schemaVersion!==1||o.kind!=="property-test-review-record"||typeof o.checksumSha256!="string"||!A.test(o.checksumSha256)||s!==`${JSON.stringify(o)}
-`)throw new Error("property-test-review-unverified");const t={report:o.report,receipt:o.receipt};if(o.checksumSha256!==v(`property-test-review-record-v1\0${JSON.stringify(t)}`))throw new Error("property-test-review-unverified");const u=N(r,o.report),c=o.receipt;if(!m(c,["schemaVersion","kind","sourceHead","planSha256","candidateSha256","reviewSha256","invariantCount","passedTests","causalFailedTests","executionVerified","qaAccepted","publicSafe"])||c.schemaVersion!==1||c.kind!=="property-test-review-acceptance"||c.sourceHead!==i.sourceHead||c.planSha256!==i.planSha256||c.candidateSha256!==i.candidateSha256||c.reviewSha256!==u.reviewSha256||c.invariantCount!==i.invariants.length||!Number.isSafeInteger(c.passedTests)||Number(c.passedTests)<i.invariants.length||c.causalFailedTests!==c.passedTests||c.executionVerified!==!0||c.qaAccepted!==!0||c.publicSafe!==!0||l(r).candidateSha256!==i.candidateSha256)throw new Error("property-test-review-unverified");return Object.freeze(c)}catch{throw new Error("property-test-review-unverified")}}export{X as acceptPropertyTestSemanticReview,l as inspectPropertyTestReviewPlan,Y as readPropertyTestReviewReceipt,N as validatePropertyTestSemanticReview};
+/** Root-only semantic review of one physically admitted property-test candidate. */
+import { createHash, randomUUID } from 'node:crypto';
+import { closeSync, existsSync, fsyncSync, linkSync, lstatSync, mkdirSync, openSync, readFileSync, realpathSync, unlinkSync, writeFileSync } from 'node:fs';
+import { isAbsolute, join, resolve } from 'node:path';
+import { mutationQaGit } from '../commands/mutation-qa-git.js';
+import { inspectPropertyTestCandidate } from './property-test-candidate.js';
+import { loadPropertyTestCandidatePlan } from './property-test-choices.js';
+import { propertyTestInvariantRefs } from './property-test-plan.js';
+import { verifyPropertyTestRuntime } from './property-test-runtime.js';
+const SHA256 = /^[a-f0-9]{64}$/;
+const MAX_REVIEW_BYTES = 256 * 1024;
+function digest(value) {
+    return createHash('sha256').update(value).digest('hex');
+}
+function exactKeys(value, keys) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value)
+        && Object.keys(value).sort().join('\0') === [...keys].sort().join('\0');
+}
+function safeTestBytes(root, path) {
+    if (!/^tests\/property\/[a-z0-9-]+\.property\.test\.ts$/.test(path)) {
+        throw new Error('property-test-review-unverified');
+    }
+    let current = root;
+    for (const [index, part] of path.split('/').entries()) {
+        current = join(current, part);
+        const entry = lstatSync(current);
+        if (entry.isSymbolicLink() || (index === path.split('/').length - 1
+            ? !entry.isFile() || entry.size < 1 || entry.size > 256 * 1024 : !entry.isDirectory())) {
+            throw new Error('property-test-review-unverified');
+        }
+    }
+    return readFileSync(current);
+}
+/** Only hashes, counts and planned paths leave this local planning function. */
+export function inspectPropertyTestReviewPlan(projectRoot) {
+    try {
+        const candidate = inspectPropertyTestCandidate(projectRoot);
+        const { root, head, plan } = loadPropertyTestCandidatePlan(projectRoot);
+        if (head !== candidate.sourceHead || plan.planSha256 !== candidate.planSha256) {
+            throw new Error('property-test-review-unverified');
+        }
+        const originalPrd = mutationQaGit(root, ['show', `HEAD:${plan.prdPath}`]);
+        if (digest(originalPrd) !== plan.prdSha256)
+            throw new Error('property-test-review-unverified');
+        const markdown = new TextDecoder('utf-8', { fatal: true }).decode(originalPrd);
+        const refs = propertyTestInvariantRefs(markdown);
+        if (refs.length !== plan.aggregates.reduce((sum, item) => sum + item.invariantCount, 0)
+            || new Set(refs.map((row) => row.invariantSha256)).size !== refs.length) {
+            throw new Error('property-test-review-unverified');
+        }
+        const sourceByAggregate = new Map(plan.aggregates.map((item) => [item.name, item]));
+        const files = new Map(plan.aggregates.map((item) => {
+            const bytes = safeTestBytes(root, item.testFile);
+            const lines = new TextDecoder('utf-8', { fatal: true }).decode(bytes).split(/\r?\n/);
+            return [item.name, { testFile: item.testFile, testSha256: digest(bytes), lineCount: lines.length }];
+        }));
+        const invariants = refs.map((row) => {
+            const item = sourceByAggregate.get(row.aggregate);
+            const file = files.get(row.aggregate);
+            if (!item || !file || row.ordinal > item.invariantCount) {
+                throw new Error('property-test-review-unverified');
+            }
+            return Object.freeze({ ...row, ...file });
+        });
+        if (inspectPropertyTestCandidate(root).artifactSha256 !== candidate.artifactSha256) {
+            throw new Error('property-test-review-unverified');
+        }
+        return Object.freeze({ schemaVersion: 1, kind: 'property-test-review-plan',
+            sourceHead: head, planSha256: plan.planSha256,
+            candidateSha256: candidate.artifactSha256, invariants,
+            executionVerified: false, qaAccepted: false, publicSafe: true });
+    }
+    catch {
+        throw new Error('property-test-review-unverified');
+    }
+}
+/** Exact-root report shape and complete per-invariant review are mandatory. */
+export function validatePropertyTestSemanticReview(projectRoot, report) {
+    try {
+        const plan = inspectPropertyTestReviewPlan(projectRoot);
+        if (!exactKeys(report, ['schemaVersion', 'kind', 'sourceHead', 'planSha256',
+            'candidateSha256', 'verdict', 'coverage'])
+            || report.schemaVersion !== 1 || report.kind !== 'property-test-semantic-review'
+            || report.verdict !== 'approved' || report.sourceHead !== plan.sourceHead
+            || report.planSha256 !== plan.planSha256
+            || report.candidateSha256 !== plan.candidateSha256
+            || !Array.isArray(report.coverage) || report.coverage.length !== plan.invariants.length
+            || Buffer.byteLength(JSON.stringify(report)) > MAX_REVIEW_BYTES) {
+            throw new Error('property-test-review-unverified');
+        }
+        const expected = new Map(plan.invariants.map((row) => [row.invariantSha256, row]));
+        const seen = new Set();
+        const usedAssertions = new Set();
+        const linesByFile = new Map([...new Set(plan.invariants.map((row) => row.testFile))]
+            .map((path) => [path, new TextDecoder('utf-8', { fatal: true })
+                .decode(safeTestBytes(projectRoot, path)).split(/\r?\n/)]));
+        for (const value of report.coverage) {
+            if (!exactKeys(value, ['invariantSha256', 'testFile', 'assertionLine', 'rationale'])
+                || typeof value.invariantSha256 !== 'string' || !SHA256.test(value.invariantSha256)
+                || seen.has(value.invariantSha256))
+                throw new Error('property-test-review-unverified');
+            seen.add(value.invariantSha256);
+            const row = expected.get(value.invariantSha256);
+            const assertionKey = `${value.testFile}:${value.assertionLine}`;
+            if (!row || value.testFile !== row.testFile
+                || usedAssertions.has(assertionKey)
+                || !Number.isSafeInteger(value.assertionLine) || Number(value.assertionLine) < 1
+                || Number(value.assertionLine) > row.lineCount
+                || typeof value.rationale !== 'string' || value.rationale.length < 30
+                || value.rationale.length > 500 || /[\x00-\x1f\x7f]/.test(value.rationale)) {
+                throw new Error('property-test-review-unverified');
+            }
+            usedAssertions.add(assertionKey);
+            const line = linesByFile.get(row.testFile)?.[Number(value.assertionLine) - 1] ?? '';
+            if (!/\b(?:expect|assert|throw)\s*\(/.test(line.split('//')[0] ?? '')) {
+                throw new Error('property-test-review-unverified');
+            }
+        }
+        if (seen.size !== expected.size || inspectPropertyTestReviewPlan(projectRoot).candidateSha256
+            !== plan.candidateSha256)
+            throw new Error('property-test-review-unverified');
+        return Object.freeze({ plan, reviewSha256: digest(`property-test-semantic-review-v1\0${JSON.stringify(report)}`) });
+    }
+    catch {
+        throw new Error('property-test-review-unverified');
+    }
+}
+function privateDirectory(root, create) {
+    const top = mutationQaGit(root, ['rev-parse', '--show-toplevel']).toString('utf8').trim();
+    const commonRaw = mutationQaGit(root, ['rev-parse', '--git-common-dir']).toString('utf8').trim();
+    const common = isAbsolute(commonRaw) ? resolve(commonRaw) : resolve(root, commonRaw);
+    if (realpathSync(root) !== root || top !== root || realpathSync(common) !== common
+        || lstatSync(common).isSymbolicLink() || lstatSync(common).uid !== process.getuid?.()) {
+        throw new Error('property-test-review-unverified');
+    }
+    const directory = join(common, 'neocortex-property-test');
+    if (create)
+        mkdirSync(directory, { recursive: true, mode: 0o700 });
+    const entry = lstatSync(directory);
+    if (!entry.isDirectory() || entry.isSymbolicLink() || entry.uid !== process.getuid?.()
+        || (entry.mode & 0o077) !== 0)
+        throw new Error('property-test-review-unverified');
+    return directory;
+}
+/** Explicit root acceptance re-runs physical + causal QA before an immutable private receipt. */
+export function acceptPropertyTestSemanticReview(projectRoot, report) {
+    try {
+        const root = resolve(projectRoot);
+        const checked = validatePropertyTestSemanticReview(root, report);
+        const runtime = verifyPropertyTestRuntime(root);
+        if (!runtime.executionVerified || runtime.qaAccepted || runtime.outcome !== 'execution-proven'
+            || runtime.sourceHead !== checked.plan.sourceHead
+            || runtime.candidateSha256 !== checked.plan.candidateSha256
+            || runtime.passedTests < checked.plan.invariants.length
+            || runtime.causalFailedTests !== runtime.passedTests
+            || inspectPropertyTestReviewPlan(root).candidateSha256 !== checked.plan.candidateSha256) {
+            throw new Error('property-test-review-unverified');
+        }
+        const receipt = Object.freeze({ schemaVersion: 1,
+            kind: 'property-test-review-acceptance', sourceHead: checked.plan.sourceHead,
+            planSha256: checked.plan.planSha256, candidateSha256: checked.plan.candidateSha256,
+            reviewSha256: checked.reviewSha256, invariantCount: checked.plan.invariants.length,
+            passedTests: runtime.passedTests, causalFailedTests: runtime.causalFailedTests,
+            executionVerified: true, qaAccepted: true, publicSafe: true });
+        const directory = privateDirectory(root, true);
+        const target = join(directory, `review-${receipt.candidateSha256}.json`);
+        const payload = { report, receipt };
+        const record = { schemaVersion: 1, kind: 'property-test-review-record', ...payload,
+            checksumSha256: digest(`property-test-review-record-v1\0${JSON.stringify(payload)}`) };
+        if (existsSync(target)) {
+            const entry = lstatSync(target);
+            if (!entry.isFile() || entry.isSymbolicLink() || entry.uid !== process.getuid?.()
+                || (entry.mode & 0o077) !== 0 || entry.size < 1 || entry.size > MAX_REVIEW_BYTES + 4096
+                || readFileSync(target, 'utf8') !== `${JSON.stringify(record)}\n`) {
+                throw new Error('property-test-review-unverified');
+            }
+            return receipt;
+        }
+        const temporary = join(directory, `review-${randomUUID()}.tmp`);
+        const handle = openSync(temporary, 'wx', 0o600);
+        try {
+            writeFileSync(handle, `${JSON.stringify(record)}\n`);
+            fsyncSync(handle);
+        }
+        finally {
+            closeSync(handle);
+        }
+        try {
+            if (inspectPropertyTestReviewPlan(root).candidateSha256 !== receipt.candidateSha256) {
+                throw new Error('property-test-review-unverified');
+            }
+            // Atomic no-replace link prevents a concurrent reviewer from replacing
+            // an accepted report or exposing a partially written target.
+            linkSync(temporary, target);
+            const directoryHandle = openSync(directory, 'r');
+            try {
+                fsyncSync(directoryHandle);
+            }
+            finally {
+                closeSync(directoryHandle);
+            }
+        }
+        finally {
+            if (existsSync(temporary))
+                unlinkSync(temporary);
+        }
+        return receipt;
+    }
+    catch {
+        throw new Error('property-test-review-unverified');
+    }
+}
+/** Revalidate the immutable root decision against the current physical candidate. */
+export function readPropertyTestReviewReceipt(projectRoot) {
+    try {
+        const root = resolve(projectRoot);
+        const plan = inspectPropertyTestReviewPlan(root);
+        const target = join(privateDirectory(root, false), `review-${plan.candidateSha256}.json`);
+        const entry = lstatSync(target);
+        if (!entry.isFile() || entry.isSymbolicLink() || entry.uid !== process.getuid?.()
+            || (entry.mode & 0o077) !== 0 || entry.size < 1 || entry.size > MAX_REVIEW_BYTES + 4096) {
+            throw new Error('property-test-review-unverified');
+        }
+        const raw = readFileSync(target, 'utf8');
+        const record = JSON.parse(raw);
+        if (!exactKeys(record, ['schemaVersion', 'kind', 'report', 'receipt', 'checksumSha256'])
+            || record.schemaVersion !== 1 || record.kind !== 'property-test-review-record'
+            || typeof record.checksumSha256 !== 'string' || !SHA256.test(record.checksumSha256)
+            || raw !== `${JSON.stringify(record)}\n`)
+            throw new Error('property-test-review-unverified');
+        const payload = { report: record.report, receipt: record.receipt };
+        if (record.checksumSha256 !== digest(`property-test-review-record-v1\0${JSON.stringify(payload)}`)) {
+            throw new Error('property-test-review-unverified');
+        }
+        const checked = validatePropertyTestSemanticReview(root, record.report);
+        const receipt = record.receipt;
+        if (!exactKeys(receipt, ['schemaVersion', 'kind', 'sourceHead', 'planSha256',
+            'candidateSha256', 'reviewSha256', 'invariantCount', 'passedTests',
+            'causalFailedTests', 'executionVerified', 'qaAccepted', 'publicSafe'])
+            || receipt.schemaVersion !== 1 || receipt.kind !== 'property-test-review-acceptance'
+            || receipt.sourceHead !== plan.sourceHead || receipt.planSha256 !== plan.planSha256
+            || receipt.candidateSha256 !== plan.candidateSha256
+            || receipt.reviewSha256 !== checked.reviewSha256
+            || receipt.invariantCount !== plan.invariants.length
+            || !Number.isSafeInteger(receipt.passedTests)
+            || Number(receipt.passedTests) < plan.invariants.length
+            || receipt.causalFailedTests !== receipt.passedTests
+            || receipt.executionVerified !== true || receipt.qaAccepted !== true
+            || receipt.publicSafe !== true
+            || inspectPropertyTestReviewPlan(root).candidateSha256 !== plan.candidateSha256) {
+            throw new Error('property-test-review-unverified');
+        }
+        return Object.freeze(receipt);
+    }
+    catch {
+        throw new Error('property-test-review-unverified');
+    }
+}