@ornexus/neocortex 4.60.72 → 4.60.73

package/packages/client/dist/private-execution/planning-memory-checkpoint.js

@@ -1,3 +1,139 @@
-import{execFileSync as q,spawnSync as x}from"node:child_process";import{createHash as A}from"node:crypto";import{closeSync as h,existsSync as $,fsyncSync as H,lstatSync as g,openSync as S,readFileSync as I,readlinkSync as M,realpathSync as D,unlinkSync as F,writeFileSync as N}from"node:fs";import{join as d,resolve as b}from"node:path";import{isDeepStrictEqual as w}from"node:util";import{canonicalPlanningIntake as B}from"../../../shared/dist/planning/diagnosis-state.js";import{parseRefreshMemoryArgs as O,refreshProjectMemoryTargets as v,verifyProjectMemoryTargets as J}from"../commands/refresh-memory.js";import{planningPendingSidecarDigest as P}from"./planning-diagnosis-checkpoint.js";import{verifyCommittedPlanningGeneration as k}from"./planning-generation-checkpoint.js";const L=e=>A("sha256").update(e).digest("hex"),r=()=>new Error("planning-memory-physical-evidence-invalid"),E=e=>!!e&&typeof e=="object"&&!Array.isArray(e),y=(e,...t)=>q("git",t,{cwd:e,encoding:"utf8",stdio:["ignore","pipe","ignore"],maxBuffer:1024*1024}).trim(),R=e=>`.neocortex/planning/epic-${e}/memory-acceptance.json`;function C(e,t){const i=x("git",["show",`HEAD:${t}`],{cwd:e,encoding:"buffer",maxBuffer:1048576});if(i.status!==0||!Buffer.isBuffer(i.stdout))throw r();return i.stdout}function V(e,t,i){if(D(e)!==e||y(e,"rev-parse","--show-toplevel")!==e)throw r();const o=k(e,t,i),c=O(["--project-root",e,"--verify"]),m=J(c),l=[...new Set(v(c).flatMap(n=>n.files.map(s=>s.relativeFile)))].sort();for(const n of l){const s=d(e,n),a=g(s);if(!(a.isSymbolicLink()?Buffer.from(M(s)):I(s)).equals(C(e,n)))throw r();const f=y(e,"ls-tree","HEAD","--",n).split(" ")[0];if(a.isSymbolicLink()?f!=="120000":!a.isFile()||!["100644","100755"].includes(f))throw r()}if(y(e,"rev-parse","HEAD")!==o.verifiedHead)throw r();return{generation:o,memory:m,files:l}}function u(e){if(!E(e)||Object.keys(e).sort().join("|")!==["schemaVersion","verdict","claimId","epicId","sourceHead","generationReceiptId","canonicalSha256","projectionSha256","fileCount","qaEvidenceId","artifactSummary"].sort().join("|")||e.schemaVersion!=="PlanningMemoryRootReview/1"||e.verdict!=="accepted"||typeof e.claimId!="string"||!/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(e.claimId)||typeof e.epicId!="string"||!/^P[1-9][0-9]{0,11}$/.test(e.epicId)||typeof e.sourceHead!="string"||!/^[a-f0-9]{40}$/.test(e.sourceHead)||[e.generationReceiptId,e.canonicalSha256,e.projectionSha256].some(t=>typeof t!="string"||!/^[a-f0-9]{64}$/.test(t))||!Number.isInteger(e.fileCount)||Number(e.fileCount)<1||Number(e.fileCount)>64||typeof e.qaEvidenceId!="string"||!/^qa-[a-z0-9-]{8,80}$/.test(e.qaEvidenceId)||typeof e.artifactSummary!="string"||!e.artifactSummary.trim())throw r();B({goal:e.artifactSummary})}function j(e,t){u(t);const{generation:i,memory:o}=V(e,t.claimId,t.epicId);if(i.physicalAcceptanceReceiptId!==t.generationReceiptId||o.canonicalSha256!==t.canonicalSha256||o.projectionSha256!==t.projectionSha256||o.fileCount!==t.fileCount||x("git",["merge-base","--is-ancestor",t.sourceHead,"HEAD"],{cwd:e,stdio:"ignore"}).status!==0)throw r();const c={schemaVersion:"PlanningMemoryPhysicalAcceptance/1",claimId:t.claimId,epicId:t.epicId,sourceHead:t.sourceHead,generationReceiptId:t.generationReceiptId,stateSha256:i.stateSha256,canonicalSha256:t.canonicalSha256,projectionSha256:t.projectionSha256,fileCount:t.fileCount,qaEvidenceId:t.qaEvidenceId,artifactSummary:t.artifactSummary};return{...c,receiptId:L(JSON.stringify(c)),publicSafe:!0}}function Z(e,t){u(t);const i=b(e),o=R(t.epicId);k(i,t.claimId,t.epicId);const c=d(i,".neocortex/state.json.planning.lock"),m=S(c,"wx",384);try{const l=P(i),n=j(i,t);if($(d(i,o))){const f=g(d(i,o));if(!f.isFile()||f.isSymbolicLink()||f.size>16384||!w(JSON.parse(I(d(i,o),"utf8")),n))throw r();return n}if(y(i,"rev-parse","HEAD")!==t.sourceHead||y(i,"diff","--name-only")||y(i,"diff","--cached","--name-only")||y(i,"ls-files","--others","--exclude-standard").split(`
-`).filter(Boolean).some(f=>f!==".neocortex/pending-epic-claims.json"&&f!==".neocortex/state.json.planning.lock")||P(i)!==l||!w(j(i,t),n))throw r();const a=S(d(i,o),"wx",384);try{N(a,`${JSON.stringify(n,null,2)}
-`),H(a)}finally{h(a)}const p=S(d(i,".neocortex/planning",`epic-${t.epicId}`),"r");try{H(p)}finally{h(p)}return n}finally{h(m),F(c)}}function _(e,t,i){if(!/^P[1-9][0-9]{0,11}$/.test(i))throw r();const o=b(e),c=R(i),m=g(d(o,c));if(!m.isFile()||m.isSymbolicLink()||m.size>16384)throw r();const l=I(d(o,c));if(!l.equals(C(o,c)))throw r();const n=JSON.parse(l.toString("utf8"));if(!E(n)||n.claimId!==t||n.epicId!==i)throw r();const s={schemaVersion:"PlanningMemoryRootReview/1",verdict:"accepted",claimId:t,epicId:i,sourceHead:n.sourceHead,generationReceiptId:n.generationReceiptId,canonicalSha256:n.canonicalSha256,projectionSha256:n.projectionSha256,fileCount:n.fileCount,qaEvidenceId:n.qaEvidenceId,artifactSummary:n.artifactSummary};u(s);const a=j(o,s);if(!w(n,a))throw r();return a}export{Z as sealPlanningMemory,_ as verifyCommittedPlanningMemory};
+/** Root P04 accepts committed canonical memory and every physical projection. */
+import { execFileSync, spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { closeSync, existsSync, fsyncSync, lstatSync, openSync, readFileSync, readlinkSync, realpathSync, unlinkSync, writeFileSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
+import { canonicalPlanningIntake } from '../../../shared/dist/planning/diagnosis-state.js';
+import { parseRefreshMemoryArgs, refreshProjectMemoryTargets, verifyProjectMemoryTargets } from '../commands/refresh-memory.js';
+import { planningPendingSidecarDigest } from './planning-diagnosis-checkpoint.js';
+import { verifyCommittedPlanningGeneration } from './planning-generation-checkpoint.js';
+const digest = (bytes) => createHash('sha256').update(bytes).digest('hex');
+const fail = () => new Error('planning-memory-physical-evidence-invalid');
+const record = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
+const git = (root, ...args) => execFileSync('git', args, { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 1024 * 1024 }).trim();
+const receiptPath = (epicId) => `.neocortex/planning/epic-${epicId}/memory-acceptance.json`;
+function committed(root, path) {
+    const result = spawnSync('git', ['show', `HEAD:${path}`], { cwd: root, encoding: 'buffer', maxBuffer: 1024 * 1024 });
+    if (result.status !== 0 || !Buffer.isBuffer(result.stdout))
+        throw fail();
+    return result.stdout;
+}
+function physical(root, claimId, epicId) {
+    if (realpathSync(root) !== root || git(root, 'rev-parse', '--show-toplevel') !== root)
+        throw fail();
+    const generation = verifyCommittedPlanningGeneration(root, claimId, epicId);
+    const options = parseRefreshMemoryArgs(['--project-root', root, '--verify']);
+    const memory = verifyProjectMemoryTargets(options);
+    const files = [...new Set(refreshProjectMemoryTargets(options).flatMap(r => r.files.map(f => f.relativeFile)))].sort();
+    for (const path of files) {
+        const file = join(root, path), entry = lstatSync(file);
+        const bytes = entry.isSymbolicLink() ? Buffer.from(readlinkSync(file)) : readFileSync(file);
+        if (!bytes.equals(committed(root, path)))
+            throw fail();
+        const mode = git(root, 'ls-tree', 'HEAD', '--', path).split(' ')[0];
+        if (entry.isSymbolicLink() ? mode !== '120000' : !entry.isFile() || !['100644', '100755'].includes(mode))
+            throw fail();
+    }
+    if (git(root, 'rev-parse', 'HEAD') !== generation.verifiedHead)
+        throw fail();
+    return { generation, memory, files };
+}
+function review(value) {
+    if (!record(value) || Object.keys(value).sort().join('|') !== [
+        'schemaVersion', 'verdict', 'claimId', 'epicId', 'sourceHead', 'generationReceiptId',
+        'canonicalSha256', 'projectionSha256', 'fileCount', 'qaEvidenceId', 'artifactSummary',
+    ].sort().join('|') || value.schemaVersion !== 'PlanningMemoryRootReview/1' || value.verdict !== 'accepted'
+        || typeof value.claimId !== 'string' || !/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(value.claimId)
+        || typeof value.epicId !== 'string' || !/^P[1-9][0-9]{0,11}$/.test(value.epicId)
+        || typeof value.sourceHead !== 'string' || !/^[a-f0-9]{40}$/.test(value.sourceHead)
+        || [value.generationReceiptId, value.canonicalSha256, value.projectionSha256].some(v => typeof v !== 'string' || !/^[a-f0-9]{64}$/.test(v))
+        || !Number.isInteger(value.fileCount) || Number(value.fileCount) < 1 || Number(value.fileCount) > 64
+        || typeof value.qaEvidenceId !== 'string' || !/^qa-[a-z0-9-]{8,80}$/.test(value.qaEvidenceId)
+        || typeof value.artifactSummary !== 'string' || !value.artifactSummary.trim())
+        throw fail();
+    canonicalPlanningIntake({ goal: value.artifactSummary });
+}
+function derive(root, input) {
+    review(input);
+    const { generation, memory } = physical(root, input.claimId, input.epicId);
+    if (generation.physicalAcceptanceReceiptId !== input.generationReceiptId
+        || memory.canonicalSha256 !== input.canonicalSha256 || memory.projectionSha256 !== input.projectionSha256
+        || memory.fileCount !== input.fileCount
+        || spawnSync('git', ['merge-base', '--is-ancestor', input.sourceHead, 'HEAD'], { cwd: root, stdio: 'ignore' }).status !== 0)
+        throw fail();
+    const fields = { schemaVersion: 'PlanningMemoryPhysicalAcceptance/1',
+        claimId: input.claimId, epicId: input.epicId, sourceHead: input.sourceHead,
+        generationReceiptId: input.generationReceiptId, stateSha256: generation.stateSha256,
+        canonicalSha256: input.canonicalSha256, projectionSha256: input.projectionSha256,
+        fileCount: input.fileCount, qaEvidenceId: input.qaEvidenceId, artifactSummary: input.artifactSummary };
+    return { ...fields, receiptId: digest(JSON.stringify(fields)), publicSafe: true };
+}
+/** Only a typed independent root review can create this receipt. No canonical state is rewritten. */
+export function sealPlanningMemory(projectRoot, input) {
+    review(input);
+    const root = resolve(projectRoot), path = receiptPath(input.epicId);
+    verifyCommittedPlanningGeneration(root, input.claimId, input.epicId);
+    const lockPath = join(root, '.neocortex/state.json.planning.lock'), lock = openSync(lockPath, 'wx', 0o600);
+    try {
+        const pending = planningPendingSidecarDigest(root), result = derive(root, input);
+        if (existsSync(join(root, path))) {
+            const entry = lstatSync(join(root, path));
+            if (!entry.isFile() || entry.isSymbolicLink() || entry.size > 16384
+                || !isDeepStrictEqual(JSON.parse(readFileSync(join(root, path), 'utf8')), result))
+                throw fail();
+            return result;
+        }
+        if (git(root, 'rev-parse', 'HEAD') !== input.sourceHead || git(root, 'diff', '--name-only')
+            || git(root, 'diff', '--cached', '--name-only'))
+            throw fail();
+        const untracked = git(root, 'ls-files', '--others', '--exclude-standard').split('\n').filter(Boolean);
+        if (untracked.some(path => path !== '.neocortex/pending-epic-claims.json' && path !== '.neocortex/state.json.planning.lock'))
+            throw fail();
+        if (planningPendingSidecarDigest(root) !== pending || !isDeepStrictEqual(derive(root, input), result))
+            throw fail();
+        const fd = openSync(join(root, path), 'wx', 0o600);
+        try {
+            writeFileSync(fd, `${JSON.stringify(result, null, 2)}\n`);
+            fsyncSync(fd);
+        }
+        finally {
+            closeSync(fd);
+        }
+        const directory = openSync(join(root, '.neocortex/planning', `epic-${input.epicId}`), 'r');
+        try {
+            fsyncSync(directory);
+        }
+        finally {
+            closeSync(directory);
+        }
+        return result;
+    }
+    finally {
+        closeSync(lock);
+        unlinkSync(lockPath);
+    }
+}
+/** Fresh read-only physical verification; metadata, a digest or an old receipt is insufficient. */
+export function verifyCommittedPlanningMemory(projectRoot, claimId, epicId) {
+    if (!/^P[1-9][0-9]{0,11}$/.test(epicId))
+        throw fail();
+    const root = resolve(projectRoot), path = receiptPath(epicId), entry = lstatSync(join(root, path));
+    if (!entry.isFile() || entry.isSymbolicLink() || entry.size > 16384)
+        throw fail();
+    const bytes = readFileSync(join(root, path));
+    if (!bytes.equals(committed(root, path)))
+        throw fail();
+    const receipt = JSON.parse(bytes.toString('utf8'));
+    if (!record(receipt) || receipt.claimId !== claimId || receipt.epicId !== epicId)
+        throw fail();
+    const input = { schemaVersion: 'PlanningMemoryRootReview/1', verdict: 'accepted',
+        claimId, epicId, sourceHead: receipt.sourceHead, generationReceiptId: receipt.generationReceiptId,
+        canonicalSha256: receipt.canonicalSha256, projectionSha256: receipt.projectionSha256,
+        fileCount: receipt.fileCount, qaEvidenceId: receipt.qaEvidenceId, artifactSummary: receipt.artifactSummary };
+    review(input);
+    const expected = derive(root, input);
+    if (!isDeepStrictEqual(receipt, expected))
+        throw fail();
+    return expected;
+}

package/packages/client/dist/private-execution/planning-research-checkpoint.js

@@ -1,4 +1,325 @@
-import{execFileSync as W,spawnSync as X}from"node:child_process";import{createHash as K,randomUUID as Q}from"node:crypto";import{closeSync as D,fsyncSync as q,lstatSync as A,mkdirSync as Y,openSync as b,readFileSync as v,realpathSync as J,renameSync as ee,unlinkSync as F,writeFileSync as L}from"node:fs";import{isAbsolute as te,join as y,resolve as B}from"node:path";import{isDeepStrictEqual as P}from"node:util";import{createPlanningReceiptV1 as V}from"../../../shared/dist/planning/diagnosis-state.js";import{acceptedPlanningDiagnosisPredecessor as T,planningPendingSidecarDigest as C,planningPhysicalPatchDigest as ie}from"./planning-diagnosis-checkpoint.js";const l=/^[a-f0-9]{64}$/,ne=/^P[1-9][0-9]{0,11}$/,se=/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/,ce="acd455ed0e39d98b90fb57391db75e366e4c5604db043e03a89a20e33d643c3c",re="fa2194f89c01f07e225fd6f39e98e679f628e072239b6cd0af3ee527f0722518";function p(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}function u(e){return K("sha256").update(e).digest("hex")}function _(e,t,i=128*1024){return W("git",[...t],{cwd:e,encoding:"utf8",stdio:["ignore","pipe","ignore"],maxBuffer:i}).trim()}function w(e,t,i){const n=A(y(e,t));if(!n.isFile()||n.isSymbolicLink()||n.size<1||n.size>i)throw new Error("planning-research-physical-artifact-invalid");return v(y(e,t))}function G(e,t){for(const i of[".neocortex",".neocortex/planning",`.neocortex/planning/epic-${t}`]){const n=A(y(e,i));if(!n.isDirectory()||n.isSymbolicLink()||n.uid!==process.getuid?.()||i===".neocortex"&&(n.mode&18)!==0)throw new Error("planning-research-directory-boundary-invalid")}}function M(e,t){return typeof e=="string"&&e.length<=128&&u(e)===t}function ae(e,t){const i=e.replace(/\r\n/g,`
-`),n=/^---\n([\s\S]{1,8192}?)\n---\n/.exec(i)?.[1];if(!n)return;const a=n.split(`
-`),r=c=>{const s=a.filter(o=>o.startsWith(`${c}:`));return s.length===1?s[0].slice(c.length+1).trim().replace(/^(?:"(.*)"|'(.*)')$/,"$1$2"):void 0},g=r("step");return r("epic_id")===t&&r("status")==="completed"&&M(g,re)&&i.slice(n.length+9).trim().length>0?g:void 0}function oe(e){if(!p(e)||Object.keys(e).sort().join("|")!==["schemaVersion","verdict","claimId","epicId","diagnosisReceiptId","intakeRevision","sourceHead","sourceBranch","sourceStateSha256","admission","artifactDigests","qaEvidenceId","artifactSummary"].sort().join("|")||e.schemaVersion!=="PlanningResearchRootReview/1"||e.verdict!=="accepted"||typeof e.claimId!="string"||!se.test(e.claimId)||typeof e.epicId!="string"||!ne.test(e.epicId)||typeof e.diagnosisReceiptId!="string"||!l.test(e.diagnosisReceiptId)||typeof e.intakeRevision!="string"||!l.test(e.intakeRevision)||typeof e.sourceHead!="string"||!/^[a-f0-9]{40}$/.test(e.sourceHead)||typeof e.sourceBranch!="string"||!/^[a-zA-Z0-9][a-zA-Z0-9._/-]{0,127}$/.test(e.sourceBranch)||typeof e.sourceStateSha256!="string"||!l.test(e.sourceStateSha256)||!p(e.admission)||Object.keys(e.admission).sort().join("|")!==["schemaVersion","outcome","baseSha","executionBranch","changedPaths","patchSha256"].sort().join("|")||e.admission.schemaVersion!==1||e.admission.outcome!=="admitted-unverified"||e.admission.baseSha!==e.sourceHead||e.admission.executionBranch!==e.sourceBranch||typeof e.admission.patchSha256!="string"||!l.test(e.admission.patchSha256)||!p(e.artifactDigests)||Object.keys(e.artifactDigests).sort().join("|")!=="index|research"||typeof e.artifactDigests.index!="string"||!l.test(e.artifactDigests.index)||typeof e.artifactDigests.research!="string"||!l.test(e.artifactDigests.research)||typeof e.qaEvidenceId!="string"||!/^qa-[a-z0-9-]{8,80}$/.test(e.qaEvidenceId)||typeof e.artifactSummary!="string")throw new Error("planning-research-review-invalid");V({kind:"research",epicId:e.epicId,intakeRevision:e.intakeRevision,predecessorReceiptId:e.diagnosisReceiptId,artifactSummary:e.artifactSummary,accepted:!0})}function U(e,t){const i={schemaVersion:"PlanningResearchPhysicalAcceptance/1",claimId:e.claimId,epicId:e.epicId,diagnosisReceiptId:e.diagnosisReceiptId,researchReceiptId:t,intakeRevision:e.intakeRevision,qaEvidenceId:e.qaEvidenceId,sourceHead:e.sourceHead,sourceStateSha256:e.sourceStateSha256,admissionPatchSha256:e.admission.patchSha256,artifactDigests:e.artifactDigests};return{...i,receiptId:u(JSON.stringify(i)),publicSafe:!0}}function z(e,t,i,n){if(G(e,t.epicId),_(e,["rev-parse","HEAD"])!==t.sourceHead||_(e,["symbolic-ref","--quiet","--short","HEAD"])!==t.sourceBranch)throw new Error("planning-research-head-conflict");const a={research:`.neocortex/planning/epic-${t.epicId}/research.md`,index:".neocortex/planning/planning.json"};if(!Array.isArray(t.admission.changedPaths)||[...t.admission.changedPaths].sort().join("|")!==Object.values(a).sort().join("|")||i&&ie(e,a,n,!0)!==t.admission.patchSha256)throw new Error("planning-research-admission-patch-conflict");const r={research:w(e,a.research,256*1024),index:w(e,a.index,128*1024)},g=ae(r.research.toString("utf8"),t.epicId);if(u(r.research)!==t.artifactDigests.research||u(r.index)!==t.artifactDigests.index||!g)throw new Error("planning-research-artifact-conflict");const c=w(e,".neocortex/state.json",8*1024*1024),s=JSON.parse(c.toString("utf8")),o=T(s,t.claimId,t.epicId,!i);if(o.diagnosisReceiptId!==t.diagnosisReceiptId||o.intakeRevision!==t.intakeRevision||i&&u(c)!==t.sourceStateSha256)throw new Error("planning-research-state-conflict");const j=s.epics[t.epicId].createEpicPlanningPhysical.artifactDigests,I=`.neocortex/planning/epic-${t.epicId}`;for(const[x,$]of Object.entries({idea:`${I}/idea.json`,diagnosis:`${I}/diagnosis.md`,enrichment:`${I}/enriched-prompt.md`}))if(u(w(e,$,x==="idea"?32*1024:256*1024))!==j[x])throw new Error("planning-research-predecessor-artifact-drift");const R=X("git",["show",`HEAD:${a.index}`],{cwd:e,encoding:"buffer",maxBuffer:128*1024});if(R.status!==0||!Buffer.isBuffer(R.stdout)||u(R.stdout)!==j.index)throw new Error("planning-research-predecessor-index-drift");const m=JSON.parse(R.stdout.toString("utf8")),f=JSON.parse(r.index.toString("utf8"));if(!p(m)||!p(m.epics)||!p(f)||!p(f.epics))throw new Error("planning-research-index-invalid");const d=m.epics[t.epicId];if(!p(d)||d.id!==t.epicId||d.idea!==o.rawIntent||d.status!=="diagnosed"||!Array.isArray(d.steps_completed)||d.steps_completed.length!==1||!M(d.steps_completed[0],ce)||!P(d.output_files,{diagnosis:`${I}/diagnosis.md`}))throw new Error("planning-research-index-predecessor-invalid");const E={...m,last_scan:f.last_scan,epics:{...m.epics,[t.epicId]:{...d,status:"researched",steps_completed:[...d.steps_completed,g],output_files:{diagnosis:`${I}/diagnosis.md`,research:a.research}}}};if(typeof f.last_scan!="string"||!Number.isFinite(Date.parse(f.last_scan))||!P(f,E))throw new Error("planning-research-index-transition-invalid");const k=V({kind:"research",epicId:t.epicId,intakeRevision:t.intakeRevision,predecessorReceiptId:t.diagnosisReceiptId,artifactSummary:t.artifactSummary,accepted:!0});return{stateRaw:c,state:s,receipt:k}}function de(e,t){const i=z(e,t,!1),a=i.state.epics[t.epicId],r=a.createEpicPlanning;if(a.status!=="researched"||!P(r.researchReceipt,i.receipt)||!P(a.createEpicPlanningResearchPhysical,U(t,i.receipt.receiptId)))throw new Error("planning-research-replay-conflict");return i.receipt.receiptId}function Ie(e,t,i){const n=T(e,t,i,!0),r=e.epics[i],g=p(r?.createEpicPlanning)?r.createEpicPlanning:void 0,c=p(g?.researchReceipt)?g.researchReceipt:void 0,s=p(r?.createEpicPlanningResearchPhysical)?r.createEpicPlanningResearchPhysical:void 0,o=p(s?.artifactDigests)?s.artifactDigests:void 0;if(r?.status!=="researched"||!c||!s||!o||typeof c.artifactSummary!="string"||!P(c,V({kind:"research",epicId:i,intakeRevision:n.intakeRevision,predecessorReceiptId:n.diagnosisReceiptId,artifactSummary:c.artifactSummary,accepted:!0}))||s.schemaVersion!=="PlanningResearchPhysicalAcceptance/1"||s.claimId!==t||s.epicId!==i||s.diagnosisReceiptId!==n.diagnosisReceiptId||s.researchReceiptId!==c.receiptId||s.intakeRevision!==n.intakeRevision||typeof s.qaEvidenceId!="string"||!/^qa-[a-z0-9-]{8,80}$/.test(s.qaEvidenceId)||typeof s.sourceHead!="string"||!/^[a-f0-9]{40}$/.test(s.sourceHead)||typeof s.sourceStateSha256!="string"||!l.test(s.sourceStateSha256)||typeof s.admissionPatchSha256!="string"||!l.test(s.admissionPatchSha256)||Object.keys(o).sort().join("|")!=="index|research"||typeof o.index!="string"||!l.test(o.index)||typeof o.research!="string"||!l.test(o.research))throw new Error("planning-generation-predecessor-invalid");const h={schemaVersion:s.schemaVersion,claimId:t,epicId:i,diagnosisReceiptId:n.diagnosisReceiptId,researchReceiptId:c.receiptId,intakeRevision:n.intakeRevision,qaEvidenceId:s.qaEvidenceId,sourceHead:s.sourceHead,sourceStateSha256:s.sourceStateSha256,admissionPatchSha256:s.admissionPatchSha256,artifactDigests:o},S={...h,receiptId:u(JSON.stringify(h)),publicSafe:!0};if(!P(s,S))throw new Error("planning-generation-predecessor-invalid");return{intakeRevision:n.intakeRevision,diagnosisReceiptId:n.diagnosisReceiptId,researchReceiptId:c.receiptId,physicalAcceptanceReceiptId:S.receiptId}}function Se(e,t){oe(t);const i=t,n=B(e);if(J(n)!==n||_(n,["rev-parse","--show-toplevel"])!==n)throw new Error("planning-research-root-invalid");G(n,i.epicId);const a=y(n,".neocortex"),r=y(a,"state.json.planning.lock"),g=b(r,"wx",384);let c;try{const s=C(n),o=w(n,".neocortex/state.json",8*1024*1024);if(u(o)!==i.sourceStateSha256){const Z=de(n,i);return{epicId:i.epicId,researchReceiptId:Z,qaEvidenceId:i.qaEvidenceId}}const h=z(n,i,!0),S=h.state.epics,H=S[i.epicId],j=H.createEpicPlanning,I=U(i,h.receipt.receiptId),R={...h.state,epics:{...S,[i.epicId]:{...H,status:"researched",createEpicPlanning:{...j,researchReceipt:h.receipt},createEpicPlanningResearchPhysical:I}}},m=_(n,["rev-parse","--git-common-dir"]),f=te(m)?B(m):B(n,m);if(J(f)!==f||A(f).isSymbolicLink())throw new Error("planning-research-backup-dir-invalid");const d=y(f,"neocortex-planning");Y(d,{recursive:!0,mode:448});const E=A(d);if(!E.isDirectory()||E.isSymbolicLink()||E.uid!==process.getuid?.()||(E.mode&63)!==0)throw new Error("planning-research-backup-dir-invalid");const k=Q(),x=b(y(d,`state-backup-${k}.json`),"wx",384);try{L(x,h.stateRaw),q(x)}finally{D(x)}const $=b(d,"r");try{q($)}finally{D($)}c=y(a,`state.json.planning-tmp-${k}`);const O=b(c,"wx",384);try{L(O,`${JSON.stringify(R,null,2)}
-`),q(O)}finally{D(O)}if(!z(n,i,!0,`.neocortex/state.json.planning-tmp-${k}`).stateRaw.equals(h.stateRaw))throw new Error("planning-research-state-conflict");if(C(n)!==s)throw new Error("planning-research-pending-conflict");ee(c,y(a,"state.json")),c=void 0;const N=b(a,"r");try{q(N)}finally{D(N)}return{epicId:i.epicId,researchReceiptId:h.receipt.receiptId,qaEvidenceId:i.qaEvidenceId}}finally{if(c)try{F(c)}catch{}D(g),F(r)}}export{Ie as acceptedPlanningResearchPredecessor,Se as sealPlanningResearch};
+/** Root-owned P02 transition after an independently reviewed isolated research candidate. */
+import { execFileSync, spawnSync } from 'node:child_process';
+import { createHash, randomUUID } from 'node:crypto';
+import { closeSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, realpathSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
+import { isAbsolute, join, resolve } from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
+import { createPlanningReceiptV1 } from '../../../shared/dist/planning/diagnosis-state.js';
+import { acceptedPlanningDiagnosisPredecessor, planningPendingSidecarDigest, planningPhysicalPatchDigest } from './planning-diagnosis-checkpoint.js';
+const HEX = /^[a-f0-9]{64}$/;
+const EPIC = /^P[1-9][0-9]{0,11}$/;
+const CLAIM = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/;
+const P01_STEP_DIGEST = 'acd455ed0e39d98b90fb57391db75e366e4c5604db043e03a89a20e33d643c3c';
+const P02_STEP_DIGEST = 'fa2194f89c01f07e225fd6f39e98e679f628e072239b6cd0af3ee527f0722518';
+function record(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function digest(value) {
+    return createHash('sha256').update(value).digest('hex');
+}
+function git(root, args, maxBuffer = 128 * 1024) {
+    return execFileSync('git', [...args], { cwd: root, encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'ignore'], maxBuffer }).trim();
+}
+function regularBytes(root, path, maxBytes) {
+    const entry = lstatSync(join(root, path));
+    if (!entry.isFile() || entry.isSymbolicLink() || entry.size < 1 || entry.size > maxBytes) {
+        throw new Error('planning-research-physical-artifact-invalid');
+    }
+    return readFileSync(join(root, path));
+}
+function safePlanningParents(root, epicId) {
+    for (const relativePath of ['.neocortex', '.neocortex/planning',
+        `.neocortex/planning/epic-${epicId}`]) {
+        const entry = lstatSync(join(root, relativePath));
+        if (!entry.isDirectory() || entry.isSymbolicLink()
+            || entry.uid !== process.getuid?.()
+            || relativePath === '.neocortex' && (entry.mode & 0o022) !== 0) {
+            throw new Error('planning-research-directory-boundary-invalid');
+        }
+    }
+}
+function stepMatches(value, expected) {
+    return typeof value === 'string' && value.length <= 128 && digest(value) === expected;
+}
+function researchDocumentStep(content, epicId) {
+    const normalized = content.replace(/\r\n/g, '\n');
+    const header = /^---\n([\s\S]{1,8192}?)\n---\n/.exec(normalized)?.[1];
+    if (!header)
+        return undefined;
+    const lines = header.split('\n');
+    const scalar = (key) => {
+        const found = lines.filter((line) => line.startsWith(`${key}:`));
+        return found.length === 1
+            ? found[0].slice(key.length + 1).trim().replace(/^(?:"(.*)"|'(.*)')$/, '$1$2')
+            : undefined;
+    };
+    const step = scalar('step');
+    return scalar('epic_id') === epicId && scalar('status') === 'completed'
+        && stepMatches(step, P02_STEP_DIGEST)
+        && normalized.slice(header.length + 9).trim().length > 0 ? step : undefined;
+}
+function validateReview(value) {
+    if (!record(value) || Object.keys(value).sort().join('|') !== [
+        'schemaVersion', 'verdict', 'claimId', 'epicId', 'diagnosisReceiptId',
+        'intakeRevision', 'sourceHead', 'sourceBranch', 'sourceStateSha256',
+        'admission', 'artifactDigests', 'qaEvidenceId', 'artifactSummary',
+    ].sort().join('|') || value.schemaVersion !== 'PlanningResearchRootReview/1'
+        || value.verdict !== 'accepted' || typeof value.claimId !== 'string' || !CLAIM.test(value.claimId)
+        || typeof value.epicId !== 'string' || !EPIC.test(value.epicId)
+        || typeof value.diagnosisReceiptId !== 'string' || !HEX.test(value.diagnosisReceiptId)
+        || typeof value.intakeRevision !== 'string' || !HEX.test(value.intakeRevision)
+        || typeof value.sourceHead !== 'string' || !/^[a-f0-9]{40}$/.test(value.sourceHead)
+        || typeof value.sourceBranch !== 'string'
+        || !/^[a-zA-Z0-9][a-zA-Z0-9._/-]{0,127}$/.test(value.sourceBranch)
+        || typeof value.sourceStateSha256 !== 'string' || !HEX.test(value.sourceStateSha256)
+        || !record(value.admission) || Object.keys(value.admission).sort().join('|') !== [
+        'schemaVersion', 'outcome', 'baseSha', 'executionBranch', 'changedPaths', 'patchSha256',
+    ].sort().join('|')
+        || value.admission.schemaVersion !== 1 || value.admission.outcome !== 'admitted-unverified'
+        || value.admission.baseSha !== value.sourceHead
+        || value.admission.executionBranch !== value.sourceBranch
+        || typeof value.admission.patchSha256 !== 'string' || !HEX.test(value.admission.patchSha256)
+        || !record(value.artifactDigests)
+        || Object.keys(value.artifactDigests).sort().join('|') !== 'index|research'
+        || typeof value.artifactDigests.index !== 'string' || !HEX.test(value.artifactDigests.index)
+        || typeof value.artifactDigests.research !== 'string' || !HEX.test(value.artifactDigests.research)
+        || typeof value.qaEvidenceId !== 'string' || !/^qa-[a-z0-9-]{8,80}$/.test(value.qaEvidenceId)
+        || typeof value.artifactSummary !== 'string') {
+        throw new Error('planning-research-review-invalid');
+    }
+    createPlanningReceiptV1({ kind: 'research', epicId: value.epicId,
+        intakeRevision: value.intakeRevision, predecessorReceiptId: value.diagnosisReceiptId,
+        artifactSummary: value.artifactSummary, accepted: true });
+}
+function physicalAcceptance(review, researchReceiptId) {
+    const fields = { schemaVersion: 'PlanningResearchPhysicalAcceptance/1',
+        claimId: review.claimId, epicId: review.epicId,
+        diagnosisReceiptId: review.diagnosisReceiptId, researchReceiptId,
+        intakeRevision: review.intakeRevision, qaEvidenceId: review.qaEvidenceId,
+        sourceHead: review.sourceHead, sourceStateSha256: review.sourceStateSha256,
+        admissionPatchSha256: review.admission.patchSha256,
+        artifactDigests: review.artifactDigests };
+    return { ...fields, receiptId: digest(JSON.stringify(fields)), publicSafe: true };
+}
+function evidence(root, review, checkPatch, ownTemporaryPath) {
+    safePlanningParents(root, review.epicId);
+    if (git(root, ['rev-parse', 'HEAD']) !== review.sourceHead
+        || git(root, ['symbolic-ref', '--quiet', '--short', 'HEAD']) !== review.sourceBranch) {
+        throw new Error('planning-research-head-conflict');
+    }
+    const paths = { research: `.neocortex/planning/epic-${review.epicId}/research.md`,
+        index: '.neocortex/planning/planning.json' };
+    if (!Array.isArray(review.admission.changedPaths)
+        || [...review.admission.changedPaths].sort().join('|') !== Object.values(paths).sort().join('|')
+        || checkPatch && planningPhysicalPatchDigest(root, paths, ownTemporaryPath, true)
+            !== review.admission.patchSha256) {
+        throw new Error('planning-research-admission-patch-conflict');
+    }
+    const current = { research: regularBytes(root, paths.research, 256 * 1024),
+        index: regularBytes(root, paths.index, 128 * 1024) };
+    const researchStep = researchDocumentStep(current.research.toString('utf8'), review.epicId);
+    if (digest(current.research) !== review.artifactDigests.research
+        || digest(current.index) !== review.artifactDigests.index
+        || !researchStep) {
+        throw new Error('planning-research-artifact-conflict');
+    }
+    const stateRaw = regularBytes(root, '.neocortex/state.json', 8 * 1024 * 1024);
+    const state = JSON.parse(stateRaw.toString('utf8'));
+    const predecessor = acceptedPlanningDiagnosisPredecessor(state, review.claimId, review.epicId, !checkPatch);
+    if (predecessor.diagnosisReceiptId !== review.diagnosisReceiptId
+        || predecessor.intakeRevision !== review.intakeRevision
+        || checkPatch && digest(stateRaw) !== review.sourceStateSha256) {
+        throw new Error('planning-research-state-conflict');
+    }
+    const epics = state.epics;
+    const epic = epics[review.epicId];
+    const physical = epic.createEpicPlanningPhysical;
+    const acceptedDigests = physical.artifactDigests;
+    const prefix = `.neocortex/planning/epic-${review.epicId}`;
+    for (const [name, path] of Object.entries({ idea: `${prefix}/idea.json`,
+        diagnosis: `${prefix}/diagnosis.md`, enrichment: `${prefix}/enriched-prompt.md` })) {
+        if (digest(regularBytes(root, path, name === 'idea' ? 32 * 1024 : 256 * 1024))
+            !== acceptedDigests[name])
+            throw new Error('planning-research-predecessor-artifact-drift');
+    }
+    const baseline = spawnSync('git', ['show', `HEAD:${paths.index}`], { cwd: root,
+        encoding: 'buffer', maxBuffer: 128 * 1024 });
+    if (baseline.status !== 0 || !Buffer.isBuffer(baseline.stdout)
+        || digest(baseline.stdout) !== acceptedDigests.index) {
+        throw new Error('planning-research-predecessor-index-drift');
+    }
+    const prior = JSON.parse(baseline.stdout.toString('utf8'));
+    const next = JSON.parse(current.index.toString('utf8'));
+    if (!record(prior) || !record(prior.epics) || !record(next) || !record(next.epics)) {
+        throw new Error('planning-research-index-invalid');
+    }
+    const priorEpic = prior.epics[review.epicId];
+    if (!record(priorEpic) || priorEpic.id !== review.epicId
+        || priorEpic.idea !== predecessor.rawIntent || priorEpic.status !== 'diagnosed'
+        || !Array.isArray(priorEpic.steps_completed) || priorEpic.steps_completed.length !== 1
+        || !stepMatches(priorEpic.steps_completed[0], P01_STEP_DIGEST)
+        || !isDeepStrictEqual(priorEpic.output_files, { diagnosis: `${prefix}/diagnosis.md` })) {
+        throw new Error('planning-research-index-predecessor-invalid');
+    }
+    const expected = { ...prior, last_scan: next.last_scan, epics: { ...prior.epics,
+            [review.epicId]: { ...priorEpic, status: 'researched',
+                steps_completed: [...priorEpic.steps_completed, researchStep],
+                output_files: { diagnosis: `${prefix}/diagnosis.md`, research: paths.research } } } };
+    if (typeof next.last_scan !== 'string' || !Number.isFinite(Date.parse(next.last_scan))
+        || !isDeepStrictEqual(next, expected)) {
+        throw new Error('planning-research-index-transition-invalid');
+    }
+    const receipt = createPlanningReceiptV1({ kind: 'research', epicId: review.epicId,
+        intakeRevision: review.intakeRevision, predecessorReceiptId: review.diagnosisReceiptId,
+        artifactSummary: review.artifactSummary, accepted: true });
+    return { stateRaw, state, receipt };
+}
+function acceptedReplay(root, review) {
+    const current = evidence(root, review, false);
+    const epics = current.state.epics;
+    const epic = epics[review.epicId];
+    const checkpoint = epic.createEpicPlanning;
+    if (epic.status !== 'researched' || !isDeepStrictEqual(checkpoint.researchReceipt, current.receipt)
+        || !isDeepStrictEqual(epic.createEpicPlanningResearchPhysical, physicalAcceptance(review, current.receipt.receiptId))) {
+        throw new Error('planning-research-replay-conflict');
+    }
+    return current.receipt.receiptId;
+}
+/** State-consistent P02 seal for a future P03 lease; physical files remain a separate check. */
+export function acceptedPlanningResearchPredecessor(stateInput, claimId, epicId) {
+    const diagnosis = acceptedPlanningDiagnosisPredecessor(stateInput, claimId, epicId, true);
+    const state = stateInput;
+    const epic = state.epics[epicId];
+    const checkpoint = record(epic?.createEpicPlanning) ? epic.createEpicPlanning : undefined;
+    const receipt = record(checkpoint?.researchReceipt) ? checkpoint.researchReceipt : undefined;
+    const physical = record(epic?.createEpicPlanningResearchPhysical)
+        ? epic.createEpicPlanningResearchPhysical : undefined;
+    const digests = record(physical?.artifactDigests) ? physical.artifactDigests : undefined;
+    if (epic?.status !== 'researched' || !receipt || !physical || !digests
+        || typeof receipt.artifactSummary !== 'string'
+        || !isDeepStrictEqual(receipt, createPlanningReceiptV1({ kind: 'research', epicId,
+            intakeRevision: diagnosis.intakeRevision,
+            predecessorReceiptId: diagnosis.diagnosisReceiptId,
+            artifactSummary: receipt.artifactSummary, accepted: true }))
+        || physical.schemaVersion !== 'PlanningResearchPhysicalAcceptance/1'
+        || physical.claimId !== claimId || physical.epicId !== epicId
+        || physical.diagnosisReceiptId !== diagnosis.diagnosisReceiptId
+        || physical.researchReceiptId !== receipt.receiptId
+        || physical.intakeRevision !== diagnosis.intakeRevision
+        || typeof physical.qaEvidenceId !== 'string'
+        || !/^qa-[a-z0-9-]{8,80}$/.test(physical.qaEvidenceId)
+        || typeof physical.sourceHead !== 'string' || !/^[a-f0-9]{40}$/.test(physical.sourceHead)
+        || typeof physical.sourceStateSha256 !== 'string' || !HEX.test(physical.sourceStateSha256)
+        || typeof physical.admissionPatchSha256 !== 'string' || !HEX.test(physical.admissionPatchSha256)
+        || Object.keys(digests).sort().join('|') !== 'index|research'
+        || typeof digests.index !== 'string' || !HEX.test(digests.index)
+        || typeof digests.research !== 'string' || !HEX.test(digests.research)) {
+        throw new Error('planning-generation-predecessor-invalid');
+    }
+    const fields = { schemaVersion: physical.schemaVersion, claimId, epicId,
+        diagnosisReceiptId: diagnosis.diagnosisReceiptId, researchReceiptId: receipt.receiptId,
+        intakeRevision: diagnosis.intakeRevision, qaEvidenceId: physical.qaEvidenceId,
+        sourceHead: physical.sourceHead, sourceStateSha256: physical.sourceStateSha256,
+        admissionPatchSha256: physical.admissionPatchSha256, artifactDigests: digests };
+    const expected = { ...fields, receiptId: digest(JSON.stringify(fields)), publicSafe: true };
+    if (!isDeepStrictEqual(physical, expected))
+        throw new Error('planning-generation-predecessor-invalid');
+    return { intakeRevision: diagnosis.intakeRevision,
+        diagnosisReceiptId: diagnosis.diagnosisReceiptId, researchReceiptId: receipt.receiptId,
+        physicalAcceptanceReceiptId: expected.receiptId };
+}
+/** A root reviewer accepts exact P02 files, then this CAS persists only the research checkpoint. */
+export function sealPlanningResearch(projectRoot, reviewInput) {
+    validateReview(reviewInput);
+    const review = reviewInput;
+    const root = resolve(projectRoot);
+    if (realpathSync(root) !== root || git(root, ['rev-parse', '--show-toplevel']) !== root) {
+        throw new Error('planning-research-root-invalid');
+    }
+    safePlanningParents(root, review.epicId);
+    const stateDir = join(root, '.neocortex');
+    const lockPath = join(stateDir, 'state.json.planning.lock');
+    const lock = openSync(lockPath, 'wx', 0o600);
+    let temporaryPath;
+    try {
+        const pendingDigest = planningPendingSidecarDigest(root);
+        const currentRaw = regularBytes(root, '.neocortex/state.json', 8 * 1024 * 1024);
+        if (digest(currentRaw) !== review.sourceStateSha256) {
+            const researchReceiptId = acceptedReplay(root, review);
+            return { epicId: review.epicId, researchReceiptId, qaEvidenceId: review.qaEvidenceId };
+        }
+        const before = evidence(root, review, true);
+        const epics = before.state.epics;
+        const epic = epics[review.epicId];
+        const checkpoint = epic.createEpicPlanning;
+        const acceptance = physicalAcceptance(review, before.receipt.receiptId);
+        const next = { ...before.state, epics: { ...epics,
+                [review.epicId]: { ...epic, status: 'researched',
+                    createEpicPlanning: { ...checkpoint, researchReceipt: before.receipt },
+                    createEpicPlanningResearchPhysical: acceptance } } };
+        const commonRaw = git(root, ['rev-parse', '--git-common-dir']);
+        const commonDir = isAbsolute(commonRaw) ? resolve(commonRaw) : resolve(root, commonRaw);
+        if (realpathSync(commonDir) !== commonDir || lstatSync(commonDir).isSymbolicLink()) {
+            throw new Error('planning-research-backup-dir-invalid');
+        }
+        const backupDir = join(commonDir, 'neocortex-planning');
+        mkdirSync(backupDir, { recursive: true, mode: 0o700 });
+        const backupEntry = lstatSync(backupDir);
+        if (!backupEntry.isDirectory() || backupEntry.isSymbolicLink()
+            || backupEntry.uid !== process.getuid?.() || (backupEntry.mode & 0o077) !== 0) {
+            throw new Error('planning-research-backup-dir-invalid');
+        }
+        const suffix = randomUUID();
+        const backup = openSync(join(backupDir, `state-backup-${suffix}.json`), 'wx', 0o600);
+        try {
+            writeFileSync(backup, before.stateRaw);
+            fsyncSync(backup);
+        }
+        finally {
+            closeSync(backup);
+        }
+        const backupDirectory = openSync(backupDir, 'r');
+        try {
+            fsyncSync(backupDirectory);
+        }
+        finally {
+            closeSync(backupDirectory);
+        }
+        temporaryPath = join(stateDir, `state.json.planning-tmp-${suffix}`);
+        const temporary = openSync(temporaryPath, 'wx', 0o600);
+        try {
+            writeFileSync(temporary, `${JSON.stringify(next, null, 2)}\n`);
+            fsyncSync(temporary);
+        }
+        finally {
+            closeSync(temporary);
+        }
+        const recheck = evidence(root, review, true, `.neocortex/state.json.planning-tmp-${suffix}`);
+        if (!recheck.stateRaw.equals(before.stateRaw))
+            throw new Error('planning-research-state-conflict');
+        if (planningPendingSidecarDigest(root) !== pendingDigest) {
+            throw new Error('planning-research-pending-conflict');
+        }
+        renameSync(temporaryPath, join(stateDir, 'state.json'));
+        temporaryPath = undefined;
+        const stateDirectory = openSync(stateDir, 'r');
+        try {
+            fsyncSync(stateDirectory);
+        }
+        finally {
+            closeSync(stateDirectory);
+        }
+        return { epicId: review.epicId, researchReceiptId: before.receipt.receiptId,
+            qaEvidenceId: review.qaEvidenceId };
+    }
+    finally {
+        if (temporaryPath)
+            try {
+                unlinkSync(temporaryPath);
+            }
+            catch { /* preserve primary failure */ }
+        closeSync(lock);
+        unlinkSync(lockPath);
+    }
+}

package/packages/client/dist/private-execution/private-report-store.js

@@ -1 +1,42 @@
-import{createHash as f}from"node:crypto";import{existsSync as m,readFileSync as s}from"node:fs";import{join as h}from"node:path";import{assertGitLifecyclePrivateFile as l,ensureGitLifecyclePrivateChildDirectory as u,gitLifecycleRuntimeDirectory as p}from"../git/git-lifecycle-store.js";import{anchoredAtomicWriteFile as v}from"../git/secure-filesystem-boundary.js";async function x(r){try{if(r.format!=="markdown"&&r.format!=="json"||typeof r.material!="string"||!/^[a-f0-9]{64}$/.test(r.sha256))throw new Error("private-report-input-invalid");const e=Buffer.from(r.material,"utf8");if(e.length===0||e.length>1024*1024||f("sha256").update(e).digest("hex")!==r.sha256)throw new Error("private-report-digest-invalid");if(r.format==="json"){const i=JSON.parse(r.material);if(!i||typeof i!="object"||Array.isArray(i))throw new Error("private-report-json-invalid")}const c=await p(r.projectRoot),a=await u(c,"private-ui-ux-reports"),o=`${r.sha256}.${r.format==="json"?"json":"md"}`,t=h(a,o),n=m(t);if(n||await v(a,o,e),await l(t,a),!s(t).equals(e))throw new Error("private-report-readback-invalid");return Object.freeze({schemaVersion:1,kind:"private-ui-ux-review-report",format:r.format,sha256:r.sha256,byteLength:e.length,path:t,reused:n,publicSafe:!0})}catch{throw new Error("private-execution-report-store-unverified")}}export{x as storePrivateUiUxReviewReport};
+/** Owner-private, content-addressed delivery for a root-owned review report. */
+import { createHash } from 'node:crypto';
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { assertGitLifecyclePrivateFile, ensureGitLifecyclePrivateChildDirectory, gitLifecycleRuntimeDirectory } from '../git/git-lifecycle-store.js';
+import { anchoredAtomicWriteFile } from '../git/secure-filesystem-boundary.js';
+/** The returned path is local-only; callers must never place report bytes in public metadata. */
+export async function storePrivateUiUxReviewReport(options) {
+    try {
+        if (options.format !== 'markdown' && options.format !== 'json'
+            || typeof options.material !== 'string'
+            || !/^[a-f0-9]{64}$/.test(options.sha256))
+            throw new Error('private-report-input-invalid');
+        const bytes = Buffer.from(options.material, 'utf8');
+        if (bytes.length === 0 || bytes.length > 1024 * 1024
+            || createHash('sha256').update(bytes).digest('hex') !== options.sha256) {
+            throw new Error('private-report-digest-invalid');
+        }
+        if (options.format === 'json') {
+            const value = JSON.parse(options.material);
+            if (!value || typeof value !== 'object' || Array.isArray(value)) {
+                throw new Error('private-report-json-invalid');
+            }
+        }
+        const runtime = await gitLifecycleRuntimeDirectory(options.projectRoot);
+        const parent = await ensureGitLifecyclePrivateChildDirectory(runtime, 'private-ui-ux-reports');
+        const name = `${options.sha256}.${options.format === 'json' ? 'json' : 'md'}`;
+        const path = join(parent, name);
+        const reused = existsSync(path);
+        if (!reused)
+            await anchoredAtomicWriteFile(parent, name, bytes);
+        await assertGitLifecyclePrivateFile(path, parent);
+        if (!readFileSync(path).equals(bytes))
+            throw new Error('private-report-readback-invalid');
+        return Object.freeze({ schemaVersion: 1, kind: 'private-ui-ux-review-report',
+            format: options.format, sha256: options.sha256, byteLength: bytes.length,
+            path, reused, publicSafe: true });
+    }
+    catch {
+        throw new Error('private-execution-report-store-unverified');
+    }
+}