@ornexus/neocortex 4.60.71 → 4.60.73

package/packages/client/dist/runner/headless/epic-git-reconciliation-inventory.js

@@ -1 +1,69 @@
-const I=2048,S=1e3;function N(e){const s=new Map,u=new Set,f=Object.entries(e.epics??{}),b=Object.entries(e.stories??{});if(f.length+b.length>1e4)throw new Error("git-reconciliation-state-inventory-limit");const _=t=>{!t.branch||!t.origin||s.set(t.branch,[...s.get(t.branch)??[],t])};for(const[t,r]of f){const i=c(r.execution_branch),o=c(r.origin_branch);o&&u.add(o);const n=d(r.terminal_git_receipt),a=n?.physicalStatus==="pushed"&&n.epicId===t&&n.executionBranch===i&&n.originBranch===o&&p(n.executionHeadSha)&&p(n.mergeSha)&&p(n.pushedSha),h=m(r.branch_lease)||(r.status===void 0?!a:!g(r.status));_({epicId:t,branch:i,origin:o,active:h,proofs:a?[{head:c(n.executionHeadSha),evidence:["terminal_receipt","canonical_convention","managed_metadata"],mergeSha:c(n.mergeSha),pushedSha:c(n.pushedSha)}]:[],prNumbers:l(r.pr_number)})}for(const[t,r]of b){const i=c(r.epic_id)||t.split(".")[0],o=e.epics?.[i],n=d(r.checkpoint),a=c(r.branch_name)||c(n?.branch);if(!o||a===c(o.execution_branch))continue;const h=n?.branch===a&&p(n.headSha);_({epicId:i,branch:a,origin:c(o.origin_branch),active:!g(r.status)||m(r.branch_lease),proofs:h?[{head:c(n.headSha),evidence:["state_reference","canonical_convention","managed_metadata"]}]:[],prNumbers:l(r.pr_number)})}for(const[t,r]of s)s.set(t,r.map(i=>({...i,proofs:i.proofs.map(o=>({...o,evidence:o.evidence.filter(n=>n!=="canonical_convention"||t===`epic/${i.epicId}`||t.startsWith(`epic/${i.epicId}/`)||t.startsWith(`story/${i.epicId}.`)||t.startsWith(`story/${i.epicId}/`))}))})));return{claims:s,origins:u}}function c(e){return typeof e=="string"?e:""}function d(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)?e:void 0}function p(e){return typeof e=="string"&&/^[a-f0-9]{40,64}$/.test(e)}function g(e){return["done","completed","merged","superseded","cancelled","archived","rolled-back"].includes(c(e))}function m(e){const s=d(e);return!!(s&&Date.parse(c(s.expiresAt))>Date.now())}function l(e){return Number.isSafeInteger(e)&&Number(e)>0?[Number(e)]:[]}export{S as GIT_INVENTORY_PR_LIMIT,I as GIT_INVENTORY_REF_LIMIT,N as collectGitResourceOwnership};
+export const GIT_INVENTORY_REF_LIMIT = 2048;
+/** Maximum PRs related to managed branches, independent of repository history size. */
+export const GIT_INVENTORY_PR_LIMIT = 1000;
+export function collectGitResourceOwnership(state) {
+    const claims = new Map();
+    const origins = new Set();
+    const epics = Object.entries(state.epics ?? {});
+    const stories = Object.entries(state.stories ?? {});
+    if (epics.length + stories.length > 10000)
+        throw new Error('git-reconciliation-state-inventory-limit');
+    const add = (claim) => {
+        if (!claim.branch || !claim.origin)
+            return;
+        claims.set(claim.branch, [...(claims.get(claim.branch) ?? []), claim]);
+    };
+    for (const [epicId, epic] of epics) {
+        const branch = str(epic.execution_branch), origin = str(epic.origin_branch);
+        if (origin)
+            origins.add(origin);
+        const receipt = record(epic.terminal_git_receipt);
+        const receiptMatches = receipt?.physicalStatus === 'pushed' && receipt.epicId === epicId
+            && receipt.executionBranch === branch && receipt.originBranch === origin
+            && sha(receipt.executionHeadSha) && sha(receipt.mergeSha) && sha(receipt.pushedSha);
+        // A receipt-only orphan can be reconciled; an explicitly resumed lifecycle
+        // or live writer always wins over an older terminal receipt.
+        const active = liveLease(epic.branch_lease)
+            || (epic.status === undefined ? !receiptMatches : !terminal(epic.status));
+        add({ epicId, branch, origin, active,
+            proofs: receiptMatches ? [{ head: str(receipt.executionHeadSha),
+                    evidence: ['terminal_receipt', 'canonical_convention', 'managed_metadata'],
+                    mergeSha: str(receipt.mergeSha), pushedSha: str(receipt.pushedSha) }] : [],
+            prNumbers: prNumber(epic.pr_number), });
+    }
+    for (const [storyId, story] of stories) {
+        const epicId = str(story.epic_id) || storyId.split('.')[0];
+        const epic = state.epics?.[epicId];
+        const checkpoint = record(story.checkpoint);
+        const branch = str(story.branch_name) || str(checkpoint?.branch);
+        if (!epic || branch === str(epic.execution_branch))
+            continue;
+        const proofMatches = checkpoint?.branch === branch && sha(checkpoint.headSha);
+        add({ epicId, branch, origin: str(epic.origin_branch),
+            active: !terminal(story.status) || liveLease(story.branch_lease),
+            proofs: proofMatches ? [{ head: str(checkpoint.headSha),
+                    evidence: ['state_reference', 'canonical_convention', 'managed_metadata'] }] : [],
+            prNumbers: prNumber(story.pr_number), });
+    }
+    // Convention is corroboration, never authority; validate it against the
+    // recorded owner rather than accepting a similar branch prefix.
+    for (const [branch, entries] of claims) {
+        claims.set(branch, entries.map((entry) => ({ ...entry, proofs: entry.proofs.map((proof) => ({
+                ...proof, evidence: proof.evidence.filter((item) => item !== 'canonical_convention'
+                    || branch === `epic/${entry.epicId}` || branch.startsWith(`epic/${entry.epicId}/`)
+                    || branch.startsWith(`story/${entry.epicId}.`) || branch.startsWith(`story/${entry.epicId}/`)),
+            })) })));
+    }
+    return { claims, origins };
+}
+function str(value) { return typeof value === 'string' ? value : ''; }
+function record(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value) ? value : undefined;
+}
+function sha(value) { return typeof value === 'string' && /^[a-f0-9]{40,64}$/.test(value); }
+function terminal(value) { return ['done', 'completed', 'merged', 'superseded', 'cancelled', 'archived', 'rolled-back'].includes(str(value)); }
+function liveLease(value) {
+    const lease = record(value);
+    return Boolean(lease && Date.parse(str(lease.expiresAt)) > Date.now());
+}
+function prNumber(value) { return Number.isSafeInteger(value) && Number(value) > 0 ? [Number(value)] : []; }

package/packages/client/dist/runner/headless/epic-merge-candidate-qa.js

@@ -1,4 +1,61 @@
-import{execFile as D}from"node:child_process";import{createHash as x,randomBytes as H}from"node:crypto";import{join as j}from"node:path";import{promisify as A}from"node:util";import{assertGitLifecyclePrivateDirectory as O,ensureGitLifecyclePrivateChildDirectory as L,executeP205TransientAuthority as C,gitLifecycleRuntimeDirectory as P,P205_COMPLETE_COMMAND as R,p205TransientAuthorityMatchesAggregate as q,projectP205TransientExecutionEvidence as I,removeGitLifecyclePrivateDirectory as M}from"../../git/git-lifecycle-store.js";import{anchoredCreateDirectory as N,anchoredDirectoryIdentity as y,anchoredExecuteGit as T,anchoredExecuteNode as _,anchoredExecuteNpm as $,secureFilesystemBoundaryAvailable as z}from"../../git/secure-filesystem-boundary.js";const G=A(D),v=new WeakMap;function U(c,e){const s=c&&v.get(c);if(!s||!q(s.p205,e.mergeSha,e.graphRevision))return;const h=Date.now()-s.acceptedAt;if(h<0||h>1800*1e3)return;const r=s.receipt;return r.originHeadSha===e.originHeadSha&&r.executionHeadSha===e.executionHeadSha&&r.mergeSha===e.mergeSha&&r.graphRevision===e.graphRevision?r:void 0}async function Z(c,e,s=new Date().toISOString()){if(!z())throw new Error("epic-merge-candidate-platform-unsupported");if(![e.originHeadSha,e.executionHeadSha,e.mergeSha].every(a=>/^[a-f0-9]{40,64}$/.test(a))||!/^[a-f0-9]{64}$/.test(e.graphRevision))throw new Error("epic-merge-candidate-binding-invalid");const h=async(...a)=>String((await G("git",a,{cwd:c,encoding:"utf8"})).stdout).trim(),r=(await h("rev-list","--parents","-n","1",e.mergeSha)).split(/\s+/);if(r.length!==3||r[1]!==e.originHeadSha||r[2]!==e.executionHeadSha)throw new Error("epic-merge-candidate-parents-invalid");const f=await h("rev-parse",`${e.mergeSha}^{tree}`),S=await P(c),n=await L(S,"merge-candidates"),p=`${e.mergeSha.slice(0,16)}-${H(8).toString("hex")}`,o=await N(n,p),u=j(n,p),t=async(...a)=>(await T(n,p,o,a)).toString("utf8").trim();let w;try{if(await t("init","--quiet","--template="),await t("fetch","--quiet","--no-tags",c,e.mergeSha),await t("checkout","--quiet","--detach","FETCH_HEAD"),await t("rev-parse","HEAD")!==e.mergeSha||await t("rev-parse","HEAD^{tree}")!==f)throw new Error("epic-merge-candidate-checkout-invalid");const a=(await t("ls-files","--stage","-z","--","package.json","*/package.json","package-lock.json","*/package-lock.json","npm-shrinkwrap.json","*/npm-shrinkwrap.json",".npmrc","*/.npmrc")).split("\0").filter(Boolean);if(a.length>1024||a.some(l=>!/^100(?:644|755) [a-f0-9]{40,64} 0\t/.test(l)))throw new Error("epic-merge-candidate-dependency-entry-unsafe");const m=(await t("ls-files","-z","--","package-lock.json","*/package-lock.json","npm-shrinkwrap.json","*/npm-shrinkwrap.json")).split("\0").filter(Boolean);if(m.length>32)throw new Error("epic-merge-candidate-dependency-limit");const d=JSON.parse((await _(n,p,o,["-e",`
+/** Canonical P205 execution on an isolated, branchless combined merge tree. */
+import { execFile } from 'node:child_process';
+import { createHash, randomBytes } from 'node:crypto';
+import { join } from 'node:path';
+import { promisify } from 'node:util';
+import { assertGitLifecyclePrivateDirectory, ensureGitLifecyclePrivateChildDirectory, executeP205TransientAuthority, gitLifecycleRuntimeDirectory, P205_COMPLETE_COMMAND, p205TransientAuthorityMatchesAggregate, projectP205TransientExecutionEvidence, removeGitLifecyclePrivateDirectory, } from '../../git/git-lifecycle-store.js';
+import { anchoredCreateDirectory, anchoredDirectoryIdentity, anchoredExecuteGit, anchoredExecuteNode, anchoredExecuteNpm, secureFilesystemBoundaryAvailable, } from '../../git/secure-filesystem-boundary.js';
+const exec = promisify(execFile);
+const AUTHORITIES = new WeakMap();
+export function verifiedEpicMergeCandidateReceipt(authority, binding) {
+    const record = authority && AUTHORITIES.get(authority);
+    if (!record || !p205TransientAuthorityMatchesAggregate(record.p205, binding.mergeSha, binding.graphRevision))
+        return undefined;
+    const age = Date.now() - record.acceptedAt;
+    if (age < 0 || age > 30 * 60 * 1000)
+        return undefined;
+    const receipt = record.receipt;
+    return receipt.originHeadSha === binding.originHeadSha && receipt.executionHeadSha === binding.executionHeadSha
+        && receipt.mergeSha === binding.mergeSha && receipt.graphRevision === binding.graphRevision ? receipt : undefined;
+}
+export async function executeEpicMergeCandidateQa(projectRoot, binding, nowIso = new Date().toISOString()) {
+    if (!secureFilesystemBoundaryAvailable())
+        throw new Error('epic-merge-candidate-platform-unsupported');
+    if (![binding.originHeadSha, binding.executionHeadSha, binding.mergeSha].every((sha) => /^[a-f0-9]{40,64}$/.test(sha))
+        || !/^[a-f0-9]{64}$/.test(binding.graphRevision))
+        throw new Error('epic-merge-candidate-binding-invalid');
+    const rootGit = async (...args) => String((await exec('git', args, { cwd: projectRoot, encoding: 'utf8' })).stdout).trim();
+    const parents = (await rootGit('rev-list', '--parents', '-n', '1', binding.mergeSha)).split(/\s+/);
+    if (parents.length !== 3 || parents[1] !== binding.originHeadSha || parents[2] !== binding.executionHeadSha) {
+        throw new Error('epic-merge-candidate-parents-invalid');
+    }
+    const treeSha = await rootGit('rev-parse', `${binding.mergeSha}^{tree}`);
+    const runtime = await gitLifecycleRuntimeDirectory(projectRoot);
+    const parent = await ensureGitLifecyclePrivateChildDirectory(runtime, 'merge-candidates');
+    const name = `${binding.mergeSha.slice(0, 16)}-${randomBytes(8).toString('hex')}`;
+    const identity = await anchoredCreateDirectory(parent, name);
+    const workspace = join(parent, name);
+    const git = async (...args) => (await anchoredExecuteGit(parent, name, identity, args)).toString('utf8').trim();
+    let p205;
+    try {
+        await git('init', '--quiet', '--template=');
+        await git('fetch', '--quiet', '--no-tags', projectRoot, binding.mergeSha);
+        await git('checkout', '--quiet', '--detach', 'FETCH_HEAD');
+        if (await git('rev-parse', 'HEAD') !== binding.mergeSha || await git('rev-parse', 'HEAD^{tree}') !== treeSha) {
+            throw new Error('epic-merge-candidate-checkout-invalid');
+        }
+        // Inspect committed entry modes before any filesystem read or npm effect:
+        // a symlinked manifest/lock/config can redirect install outside this tree.
+        const dependencyEntries = (await git('ls-files', '--stage', '-z', '--', 'package.json', '*/package.json', 'package-lock.json', '*/package-lock.json', 'npm-shrinkwrap.json', '*/npm-shrinkwrap.json', '.npmrc', '*/.npmrc')).split('\0').filter(Boolean);
+        if (dependencyEntries.length > 1024 || dependencyEntries.some((entry) => !/^100(?:644|755) [a-f0-9]{40,64} 0\t/.test(entry))) {
+            throw new Error('epic-merge-candidate-dependency-entry-unsafe');
+        }
+        // Each lockfile is installed into the candidate itself. No source
+        // node_modules symlink/copy can make QA test the wrong dependency graph.
+        const lockfiles = (await git('ls-files', '-z', '--', 'package-lock.json', '*/package-lock.json', 'npm-shrinkwrap.json', '*/npm-shrinkwrap.json')).split('\0').filter(Boolean);
+        if (lockfiles.length > 32)
+            throw new Error('epic-merge-candidate-dependency-limit');
+        const dependencies = JSON.parse((await anchoredExecuteNode(parent, name, identity, ['-e', `
       const fs=require('node:fs'); const path=require('node:path'); const locks=JSON.parse(process.argv[1]);
       // npm-shrinkwrap wins over package-lock in the same installation root.
       // Validate every selected root, not only the repository's top-level lock.
@@ -25,4 +82,55 @@ import{execFile as D}from"node:child_process";import{createHash as x,randomBytes
       }
       process.stdout.write(JSON.stringify({unsafeLinks,roots:[...selected.keys()]
         .filter(p=>!workspacePaths.has(p)).sort((a,b)=>a.length-b.length)}));
-    `,JSON.stringify(m)])).toString("utf8"));if(d.unsafeLinks)throw new Error("epic-merge-candidate-dependency-link-unsafe");if(d.roots.length>16)throw new Error("epic-merge-candidate-dependency-limit");for(const l of d.roots){if(l!=="."&&!/^[A-Za-z0-9_.\/-]+$/.test(l)||l.split("/").includes(".."))throw new Error("epic-merge-candidate-dependency-path-invalid");await $(n,p,o,["--prefix",l,"ci","--include=dev","--no-audit","--no-fund"])}if(await t("status","--porcelain","--untracked-files=normal"))throw new Error("epic-merge-candidate-dirty");if(w=await C(u,{headSha:e.mergeSha,graphRevision:e.graphRevision,nowIso:s,anchoredWorkspace:{parent:n,name:p,identity:o}}),await t("status","--porcelain","--untracked-files=normal")||await t("rev-parse","HEAD")!==e.mergeSha||await t("rev-parse","HEAD^{tree}")!==f)throw new Error("epic-merge-candidate-raced")}finally{await O(u,n);const a=await y(u);if(a.dev!==o.dev||a.ino!==o.ino)throw new Error("epic-merge-candidate-cleanup-owner-raced");if(!await M(u,n,async m=>{const d=await y(m);return d.dev===o.dev&&d.ino===o.ino}))throw new Error("epic-merge-candidate-cleanup-unverified")}const i=I(w);if(!i||i.executionHeadSha!==e.mergeSha)throw new Error("epic-merge-candidate-authority-missing");const E=`merge-qa:${x("sha256").update(["epic-merge-candidate-qa-v1",e.originHeadSha,e.executionHeadSha,e.mergeSha,f,e.graphRevision,i.manifestDigest,i.resultDigest,i.gateIds.join(",")].join("\0")).digest("hex")}`,g=Object.freeze({schemaVersion:1,kind:"epic_merge_candidate_qa",contract:"P205-CI-02",command:R,...e,treeSha:f,manifestDigest:i.manifestDigest,resultDigest:i.resultDigest,gateIds:Object.freeze([...i.gateIds]),checkedAt:i.executedAt,receiptRef:E}),k=Object.freeze(Object.create(null));return v.set(k,{receipt:g,p205:w,acceptedAt:Date.now()}),{candidateQa:g,candidateAuthority:k}}export{Z as executeEpicMergeCandidateQa,U as verifiedEpicMergeCandidateReceipt};
+    `, JSON.stringify(lockfiles)])).toString('utf8'));
+        if (dependencies.unsafeLinks)
+            throw new Error('epic-merge-candidate-dependency-link-unsafe');
+        if (dependencies.roots.length > 16)
+            throw new Error('epic-merge-candidate-dependency-limit');
+        for (const dependencyRoot of dependencies.roots) {
+            if (dependencyRoot !== '.' && !/^[A-Za-z0-9_.\/-]+$/.test(dependencyRoot)
+                || dependencyRoot.split('/').includes('..'))
+                throw new Error('epic-merge-candidate-dependency-path-invalid');
+            await anchoredExecuteNpm(parent, name, identity, ['--prefix', dependencyRoot, 'ci', '--include=dev', '--no-audit', '--no-fund']);
+        }
+        if (await git('status', '--porcelain', '--untracked-files=normal'))
+            throw new Error('epic-merge-candidate-dirty');
+        p205 = await executeP205TransientAuthority(workspace, {
+            headSha: binding.mergeSha, graphRevision: binding.graphRevision, nowIso,
+            anchoredWorkspace: { parent, name, identity },
+        });
+        if (await git('status', '--porcelain', '--untracked-files=normal')
+            || await git('rev-parse', 'HEAD') !== binding.mergeSha || await git('rev-parse', 'HEAD^{tree}') !== treeSha) {
+            throw new Error('epic-merge-candidate-raced');
+        }
+    }
+    finally {
+        // Cleanup is identity-checked; a substituted directory is never removed.
+        await assertGitLifecyclePrivateDirectory(workspace, parent);
+        const current = await anchoredDirectoryIdentity(workspace);
+        if (current.dev !== identity.dev || current.ino !== identity.ino)
+            throw new Error('epic-merge-candidate-cleanup-owner-raced');
+        if (!(await removeGitLifecyclePrivateDirectory(workspace, parent, async (renamed) => {
+            const moved = await anchoredDirectoryIdentity(renamed);
+            return moved.dev === identity.dev && moved.ino === identity.ino;
+        })))
+            throw new Error('epic-merge-candidate-cleanup-unverified');
+    }
+    const evidence = projectP205TransientExecutionEvidence(p205);
+    if (!evidence || evidence.executionHeadSha !== binding.mergeSha)
+        throw new Error('epic-merge-candidate-authority-missing');
+    const receiptRef = `merge-qa:${createHash('sha256').update([
+        'epic-merge-candidate-qa-v1', binding.originHeadSha, binding.executionHeadSha, binding.mergeSha,
+        treeSha, binding.graphRevision, evidence.manifestDigest, evidence.resultDigest, evidence.gateIds.join(','),
+    ].join('\0')).digest('hex')}`;
+    const candidateQa = Object.freeze({ schemaVersion: 1,
+        kind: 'epic_merge_candidate_qa', contract: 'P205-CI-02', command: P205_COMPLETE_COMMAND,
+        ...binding, treeSha, manifestDigest: evidence.manifestDigest, resultDigest: evidence.resultDigest,
+        gateIds: Object.freeze([...evidence.gateIds]), checkedAt: evidence.executedAt, receiptRef,
+    });
+    const candidateAuthority = Object.freeze(Object.create(null));
+    // Freshness is process-local evidence captured after QA, not a caller's
+    // serialized timestamp. Clock rollback or expiry requires new execution.
+    AUTHORITIES.set(candidateAuthority, { receipt: candidateQa, p205: p205, acceptedAt: Date.now() });
+    return { candidateQa, candidateAuthority };
+}