@patwoodman/dsh-sdlc-flow-core 0.4.0-beta.22 → 0.4.0-beta.24

package/README.md

@@ -22,7 +22,7 @@ dsh plugin --profile <profile> add @patwoodman/dsh-sdlc-flow-core
 ## Requirements
 
 - `@deepseek-ai/dsh` `>=0.2.0-rc.2 <0.3.0-0`
-- Node.js ≥ 22.5 (`node:sqlite`)
+- Node.js ≥ 22.13 (`node:sqlite`)
 
 ## License
 

package/lib/escalation.js

@@ -101,17 +101,27 @@ export function planEscalation(block, { mode = 'interactive' } = {}) {
   };
 }
 
-/** Apply a decision to a blocked task/project. */
-export function applyResolution({ resolution, optionId = null, decidedBy = null } = {}) {
+/**
+ * Apply a decision to a blocked task/project.
+ *
+ * Approval alone is not a corrective plan: `ESCALATED→READY` requires
+ * `correctivePlanApproved === true`, which is granted only when an explicit
+ * `correctivePlan` accompanies the approval. Rejecting/cancelling blocks.
+ */
+export function applyResolution({ resolution, optionId = null, decidedBy = null, correctivePlan = null } = {}) {
   if (!['approved', 'rejected', 'cancelled', 'unavailable'].includes(resolution)) {
     throw new Error(`invalid resolution: ${resolution}`);
   }
-  const unblock = resolution === 'approved';
+  const approved = resolution === 'approved';
+  const unblock = approved && correctivePlan != null;
   return {
     resolution,
     optionId,
     decidedBy,
-    taskTo: unblock ? 'READY' : 'BLOCKED',
+    correctivePlanApproved: unblock,
+    blockerResolved: unblock,
+    waiting_on: unblock ? null : 'user-decision',
+    taskTo: unblock ? 'READY' : (approved ? 'ESCALATED' : 'BLOCKED'),
     projectTo: unblock ? null : 'BLOCKED',
   };
 }

package/lib/integration.js

@@ -64,9 +64,20 @@ export function integrationSteps(task, { mergeBase = null } = {}) {
  */
 export function postMergeOutcome({ gatesPass, mergeCommit, failedTasks = [] } = {}) {
   if (gatesPass) return { action: 'done', tag: true };
+  // Never guess the merge commit: `git revert -m 1 HEAD` on a missing SHA can
+  // revert an unrelated merge. A failed post-merge gate without a commit is an
+  // explicit refusal, not a HEAD fallback.
+  if (typeof mergeCommit !== 'string' || mergeCommit.trim() === '' || mergeCommit.trim() === 'HEAD') {
+    return {
+      action: 'refuse',
+      failedTasks,
+      reason: 'MISSING_MERGE_COMMIT',
+      detail: 'post-merge gate failure requires the merge commit to revert',
+    };
+  }
   return {
     action: 'revert',
-    argv: ['git', 'revert', '-m', '1', mergeCommit ?? 'HEAD'],
+    argv: ['git', 'revert', '-m', '1', mergeCommit],
     failedTasks,
     reason: 'POST_MERGE_GATE_FAILURE',
   };

package/lib/recovery.js

@@ -78,11 +78,14 @@ export function reconcile({
       transitions.push({ taskId: task.id, to: 'ESCALATED', actor: 'recovery', evidence: 'active-state-without-run' });
       continue;
     }
-    const deadPid = run.pid != null && !isAlive(run.pid);
+    // A pid of null is not a live worker: in-process/API runs record no pid, and
+    // a crash leaves them unfinished forever. findOrphans already treats null as
+    // an orphan ('no-pid'); reconcile must agree or the resume path strands them.
+    const deadPid = run.pid == null || !isAlive(run.pid);
     const missingWorktree = Boolean(task.worktree_path) && !worktreeExists(task.worktree_path);
     const missingBranch = Boolean(task.branch) && !branchExists(task.branch);
 
-    if (deadPid) discrepancies.push({ taskId: task.id, kind: 'dead-worker', detail: `pid ${run.pid} is not alive` });
+    if (deadPid) discrepancies.push({ taskId: task.id, kind: 'dead-worker', detail: run.pid == null ? 'no-pid' : `pid ${run.pid} is not alive` });
     if (missingWorktree) discrepancies.push({ taskId: task.id, kind: 'missing-worktree', detail: task.worktree_path });
     if (missingBranch) discrepancies.push({ taskId: task.id, kind: 'missing-branch', detail: task.branch });
 

package/lib/runtime.js

@@ -15,12 +15,13 @@ import { existsSync, mkdirSync } from 'node:fs';
 import { openDatabase, migrate, quickCheck } from './schema.js';
 import { TaskStateService } from './state-machine.js';
 import { ModelRouter } from './router.js';
-import { budgetsForRisk, normalizeTaskBudget, PROJECT_BUDGET_DEFAULTS, checkDispatch, checkProjectBudget } from './budget.js';
+import { budgetsForRisk, normalizeTaskBudget, PROJECT_BUDGET_DEFAULTS, checkDispatch, checkProjectBudget, evaluateRun } from './budget.js';
 import { riskClass } from './risk.js';
 import { InstanceLock, InstanceLockedError } from './instance-lock.js';
 import { deriveWorkerResult, scopeVerdict, resolveClaims } from './worker-result.js';
 import { exportMetrics } from './metrics.js';
 import { GuardPlugin } from '@patwoodman/dsh-sdlc-flow-guard';
+import { applyResolution } from './escalation.js';
 
 export class RuntimeLockedError extends Error {
   constructor(holder) {
@@ -213,13 +214,16 @@ export class Runtime {
 
   // ── worker runs ──────────────────────────────────────────────────────────
 
-  startWorkerRun({ taskId, attempt, sessionId = null, pid = null, model = null, worktreePath = null, contextManifest = null, id = null }) {
+  startWorkerRun({ taskId, attempt, sessionId = null, pid = null, model = null, worktreePath = null, contextManifest = null, nonce = null, id = null }) {
     const runId = id ?? `${taskId}-a${attempt}-${randomUUID().slice(0, 8)}`;
     this.db.prepare(
       `INSERT INTO worker_runs(id, task_id, attempt, session_id, pid, model_provider, model_id,
         status, started_at, worktree_path, context_manifest_json)
        VALUES (?, ?, ?, ?, ?, ?, ?, 'running', ?, ?, ?)`,
-    ).run(runId, taskId, attempt, sessionId, pid, model?.provider ?? null, model?.id ?? null, this.now(), worktreePath, contextManifest ? JSON.stringify(contextManifest) : null);
+    ).run(
+      runId, taskId, attempt, sessionId, pid, model?.provider ?? null, model?.id ?? null, this.now(), worktreePath,
+      contextManifest || nonce ? JSON.stringify({ ...(contextManifest ?? {}), ...(nonce ? { nonce } : {}) }) : null,
+    );
     return runId;
   }
 
@@ -251,9 +255,26 @@ export class Runtime {
    * resolve the result channel, and persist. Never trusts the worker (L.1.2).
    */
   ingestResult({ runId, filesChanged, contract = {}, outboxRaw = null, finalText = null, runMeta = {}, runtime = {} }) {
-    const claims = resolveClaims({ outboxRaw, finalText, runMeta });
+    // Derive the run identity (and the nonce, when the dispatcher stored one)
+    // from the worker_runs row; caller-supplied fields still win.
+    const storedRun = this.getWorkerRun(runId);
+    const effectiveMeta = {
+      runId: storedRun?.id,
+      taskId: storedRun?.task_id,
+      attempt: storedRun?.attempt,
+      nonce: storedRun?.context_manifest?.nonce,
+      ...runMeta,
+    };
+    const claims = resolveClaims({ outboxRaw, finalText, runMeta: effectiveMeta });
     const result = deriveWorkerResult({ filesChanged, contract, claims: claims.claims, runtime });
     const scope = scopeVerdict(result);
+    const taskRow = this.db.prepare('SELECT id, state, attempt, risk_class FROM tasks WHERE id = (SELECT task_id FROM worker_runs WHERE id = ?)').get(runId);
+    const spendBefore = taskRow ? this.spentForTask(taskRow.id) : { costUsd: 0, durationMs: 0, tokens: 0 };
+    const projectBefore = this.spentTotals();
+    const costKnown = typeof runtime.costUsd === 'number';
+    const tokensKnown = runtime.tokens != null && typeof runtime.tokens === 'object';
+    const tokensTotal = tokensKnown ? (runtime.tokens.in ?? 0) + (runtime.tokens.out ?? 0) : null;
+
     this.finishWorkerRun(runId, {
       status: result.status,
       exitCode: runtime.exitCode ?? null,
@@ -262,7 +283,33 @@ export class Runtime {
       costUsd: runtime.costUsd ?? 0,
       result: { ...result, claims_source: claims.source, scope },
     });
-    return { result, scope, claimsSource: claims.source };
+
+    // Post-run budget accounting. The old path recorded any cost and still let
+    // the result proceed to VERIFYING/ACCEPTED; a per-attempt overrun or project
+    // breach is now evidence (FAILED) before acceptance can happen. Missing
+    // cost/tokens is UNKNOWN, never zero.
+    let budget = { action: 'unknown', available: false, reason: 'COST_UNKNOWN' };
+    if (taskRow && costKnown && tokensKnown) {
+      budget = {
+        available: true,
+        ...evaluateRun({
+          attempt: taskRow.attempt ?? 0,
+          run: { costUsd: runtime.costUsd ?? 0, tokens: tokensTotal, durationMs: runtime.durationMs ?? 0 },
+          taskBudget: budgetsForRisk(taskRow.risk_class, this.config.budgets?.perTask),
+          taskSpend: { costUsd: spendBefore.costUsd },
+          projectBudget: this.config.budgets?.perProject ?? PROJECT_BUDGET_DEFAULTS,
+          projectSpend: projectBefore,
+        }),
+      };
+      const breach = budget.action === 'block' || budget.perAttemptOver === true;
+      if (breach && taskRow.state === 'IN_PROGRESS') {
+        this.state.transition(taskRow.id, 'FAILED', 'worker-mgr', {
+          hardFailure: true,
+          payload: { code: budget.reason ?? 'BUDGET_EXHAUSTED', budget_action: budget.action },
+        });
+      }
+    }
+    return { result, scope, claimsSource: claims.source, budget };
   }
 
   // ── routing, budgets, model runs ─────────────────────────────────────────
@@ -375,6 +422,64 @@ export class Runtime {
       : this.db.prepare('SELECT * FROM requirements ORDER BY created_at').all();
   }
 
+  // ── escalations (decision authority stays human/lead) ───────────────────
+
+  /** Persist an escalation decision packet before it is put to the user. */
+  recordEscalation({ id, taskId = null, attempt = null, level = null, packet = null } = {}) {
+    if (typeof id !== 'string' || id === '') throw new Error('recordEscalation: id is required');
+    this.db.prepare(
+      `INSERT INTO escalations(id, task_id, attempt, level, packet_json, created_at)
+       VALUES (?, ?, ?, ?, ?, ?)`,
+    ).run(id, taskId, attempt, level, JSON.stringify(packet ?? {}), this.now());
+    this.state.record({
+      taskId, actor: 'escalation-mgr', action: 'escalation-recorded',
+      payload: { escalation_id: id, level },
+    });
+    return this.getEscalation(id);
+  }
+
+  getEscalation(id) {
+    const row = this.db.prepare('SELECT * FROM escalations WHERE id = ?').get(id);
+    if (!row) return null;
+    return { ...row, packet: safeJson(row.packet_json, {}) };
+  }
+
+  getEscalations({ taskId = null } = {}) {
+    const rows = taskId
+      ? this.db.prepare('SELECT * FROM escalations WHERE task_id = ? ORDER BY created_at').all(taskId)
+      : this.db.prepare('SELECT * FROM escalations ORDER BY created_at').all();
+    return rows.map((row) => ({ ...row, packet: safeJson(row.packet_json, {}) }));
+  }
+
+  /**
+   * Apply a recorded decision. Approval without an explicit corrective plan
+   * leaves the task ESCALATED (the state guard requires the plan); rejection
+   * blocks it. Returns the resolution context actually applied.
+   */
+  resolveEscalation(id, { resolution, decidedBy = null, optionId = null, correctivePlan = null } = {}) {
+    const row = this.getEscalation(id);
+    if (!row) throw new Error(`resolveEscalation: unknown escalation ${id}`);
+    const ctx = applyResolution({ resolution, optionId, decidedBy, correctivePlan });
+    this.db.prepare(
+      'UPDATE escalations SET resolution = ?, resolved_by = ?, resolved_at = ? WHERE id = ?',
+    ).run(ctx.resolution, decidedBy, this.now(), id);
+    this.state.record({
+      taskId: row.task_id ?? null, actor: 'escalation-mgr', action: 'escalation-resolved',
+      payload: { escalation_id: id, resolution: ctx.resolution, decided_by: decidedBy, option_id: optionId },
+    });
+    const task = row.task_id ? this.getTask(row.task_id) : null;
+    let transition = null;
+    if (task && task.state === 'ESCALATED' && ctx.taskTo !== 'ESCALATED') {
+      transition = this.state.transition(row.task_id, ctx.taskTo, 'escalation-mgr', {
+        ...ctx,
+        correctivePlanApproved: ctx.correctivePlanApproved,
+        userDecisionRequired: ctx.resolution !== 'approved',
+        payload: { escalation_id: id, resolution: ctx.resolution },
+      });
+    }
+    return { ...ctx, transition };
+  }
+
   // ── evidence ─────────────────────────────────────────────────────────────
 
   recordTestResults(taskId, runId, gateResults) {

package/lib/scheduler.js

@@ -158,11 +158,14 @@ export function planStep(state, {
     }
   }
 
-  // Recompute active set including transitions proposed above (READY is not active).
-  const projected = tasks.map((t) => {
-    const change = transitions.find((x) => x.taskId === t.id);
-    return change ? { ...t, state: change.to } : t;
-  });
+  // Recompute active set including transitions proposed above (READY is not
+  // active). Copy every task: the working snapshot mutates state below, and
+  // aliasing the caller's objects would leak those mutations into its DAG.
+  const projected = tasks.map((task) => ({ ...task }));
+  for (const change of transitions) {
+    const task = projected.find((candidate) => candidate.id === change.taskId);
+    if (task) task.state = change.to;
+  }
 
   let activeCount = activeTasks(projected).length;
   for (const task of projected) {

package/lib/schema.js

@@ -11,6 +11,7 @@
  */
 
 import { DatabaseSync } from 'node:sqlite';
+import { copyFileSync, existsSync } from 'node:fs';
 
 export const SCHEMA_VERSION = 1;
 
@@ -214,7 +215,28 @@ export const TABLES = [
  * @param {import('node:sqlite').DatabaseSync} db
  * @returns {number} applied schema version
  */
+export function schemaVersion(db) {
+  const table = db.prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'schema_version'").get();
+  if (!table) return null;
+  const row = db.prepare('SELECT version FROM schema_version ORDER BY version DESC LIMIT 1').get();
+  return row?.version ?? null;
+}
+
+/** Refuse a database written by a newer plugin before any DDL mutates it. */
+export function assertSchemaCompatible(db) {
+  const version = schemaVersion(db);
+  if (version !== null && version > SCHEMA_VERSION) {
+    throw new Error(
+      `sdlc.db schema version ${version} is newer than this plugin (${SCHEMA_VERSION}); `
+      + 'refusing to open or migrate it. Upgrade the plugin or restore a backup.',
+    );
+  }
+  return version;
+}
+
 export function migrate(db) {
+  // Check BEFORE pragmas/DDL: a future schema must not be partially mutated.
+  assertSchemaCompatible(db);
   for (const pragma of PRAGMAS) {
     try { db.exec(pragma); } catch { /* :memory: and read-only mounts may refuse WAL */ }
   }
@@ -228,6 +250,13 @@ export function migrate(db) {
     );
     return SCHEMA_VERSION;
   }
+  if (row.version < SCHEMA_VERSION) {
+    db.prepare('INSERT INTO schema_version(version, applied_at) VALUES (?, ?)').run(
+      SCHEMA_VERSION,
+      new Date().toISOString(),
+    );
+    return SCHEMA_VERSION;
+  }
   return row.version;
 }
 
@@ -261,9 +290,20 @@ export function quickCheck(db) {
  */
 export function openDatabase(dbPath, { requireQuickCheck = true, DatabaseSync: Ctor = DatabaseSync } = {}) {
   const db = new Ctor(dbPath);
-  migrate(db);
-  if (requireQuickCheck) quickCheck(db);
-  return db;
+  try {
+    // Integrity + compatibility BEFORE any write. A torn DB must refuse to open
+    // (B.2.3), and a newer schema must never be migrated by an older plugin.
+    const version = assertSchemaCompatible(db);
+    if (requireQuickCheck) quickCheck(db);
+    if (version !== null && version < SCHEMA_VERSION && dbPath !== ':memory:' && existsSync(dbPath)) {
+      try { copyFileSync(dbPath, `${dbPath}.bak-v${version}`); } catch { /* backup is best-effort; migration is still checked */ }
+    }
+    migrate(db);
+    return db;
+  } catch (error) {
+    try { db.close(); } catch { /* already closed */ }
+    throw error;
+  }
 }
 
 export function tableNames(db) {
@@ -277,4 +317,4 @@ export function triggerNames(db) {
     .map((r) => r.name);
 }
 
-export default { migrate, quickCheck, openDatabase, SCHEMA_VERSION, DDL, TABLES };
+export default { migrate, quickCheck, openDatabase, schemaVersion, assertSchemaCompatible, SCHEMA_VERSION, DDL, TABLES };

package/lib/state-machine.js

@@ -38,7 +38,7 @@ const G = {
   launchFailed: (ctx = {}) => ctx.launchFailed === true,
   hardFailure: (ctx = {}) => ctx.hardFailure === true,
   gatesFailed: (ctx = {}) => ctx.gatesPass === false,
-  gatesPass: (ctx = {}) => ctx.gatesPass !== false,
+  gatesPass: (ctx = {}) => ctx.gatesPass === true,
   loopMatched: (ctx = {}) => ctx.loopMatched === true,
   mergeSlotFree: (ctx = {}) => ctx.mergeSlotFree !== false,
   mergedAndGreen: (ctx = {}) => ctx.merged === true && ctx.postMergeGatesPass !== false,
@@ -277,8 +277,18 @@ export class TaskStateService {
         const pairLegal = TASK_TRANSITIONS.some((t) => t.to === to && (t.from === from || t.from === '*'));
         return fail(pairLegal ? `actor ${actor} may not perform ${from ?? '—'}→${to}` : `no transition ${from ?? '—'}→${to}`);
       }
+      // Single-writer is a DATABASE invariant, not a caller promise. When the
+      // caller does not state the slot, derive it from the one MERGING task in
+      // the store; a second ACCEPTED→MERGING with `{}` must fail closed.
+      let effectiveCtx = ctx;
+      if (to === 'MERGING') {
+        // The caller may VETO a free slot, never grant one: the holder is read
+        // inside the same BEGIN IMMEDIATE transaction as the state write.
+        const holder = this.db.prepare("SELECT id FROM tasks WHERE state = 'MERGING' AND id <> ?").get(taskId);
+        effectiveCtx = { ...ctx, mergeSlotFree: ctx.mergeSlotFree !== false && holder == null };
+      }
       const guard = GUARDS[entry.guard] ?? GUARDS.always;
-      if (!guard(ctx)) return fail(`guard ${entry.guard} rejected ${from ?? '—'}→${to}`);
+      if (!guard(effectiveCtx)) return fail(`guard ${entry.guard} rejected ${from ?? '—'}→${to}`);
 
       const attemptDelta = to === 'READY' && (from === 'FAILED' || from === 'ESCALATED') ? 1 : 0;
       const ts = this.now();

package/lib/verifier.js

@@ -5,7 +5,7 @@
  * This module is the pure decision table; the DSH service wires it to the DB.
  */
 
-import { violatesBehavioralTestRule } from './risk.js';
+import { violatesBehavioralTestRule, requiredGates as riskRequiredGates } from './risk.js';
 
 export const REJECTION_CODES = [
   'SCOPE_VIOLATION',
@@ -38,6 +38,7 @@ export function decideAcceptance({
   claims = null,
   runtimeStatus = 'completed',
   blockedBySkippedGate = false,
+  requiredGates = null,
 } = {}) {
   const reasons = [];
 
@@ -73,6 +74,29 @@ export function decideAcceptance({
   if (failedGates.length) {
     return reject('FAILED', 'GATE_FAILED', failedGates.map(([g, r]) => `${g}: ${r.status}`));
   }
+  // A required gate must be PRESENT and PASSING. The old check only required
+  // *some* evidence, so an R4 task with `syntax: pass` (or a required gate
+  // marked `skipped:*`) was accepted. Callers that know the risk-derived gate
+  // set pass it explicitly; skipped-but-not-required gates are excluded by the
+  // caller (requiredGates().filter(g => g.required)), preserving B.4/L.5.
+  // Default to the risk-derived floor. A caller that needs a deliberately
+  // reduced set (appearance-only, configured skips) passes it explicitly; R1
+  // is the only class that may be accepted without gate evidence.
+  const enforcedGates = Array.isArray(requiredGates)
+    ? requiredGates
+    : (riskClass === 'R1' ? [] : riskRequiredGates(riskClass).filter((g) => g.required).map((g) => g.gate));
+  if (enforcedGates.length > 0) {
+    const missing = enforcedGates.filter((gate) => {
+      const result = gateResults[gate];
+      return !result || !String(result.status).startsWith('pass');
+    });
+    if (missing.length) {
+      if (Object.keys(gateResults).length === 0) {
+        return reject('FAILED', 'GATE_FAILED', ['no gate evidence recorded']);
+      }
+      return reject('FAILED', 'SKIPPED_GATE_NOT_PASSED', missing.map((gate) => `${gate}: ${gateResults[gate]?.status ?? 'missing'}`));
+    }
+  }
   const requiredButMissing = Object.keys(gateResults).length === 0;
   if (requiredButMissing && riskClass !== 'R1') {
     return reject('FAILED', 'GATE_FAILED', ['no gate evidence recorded']);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@patwoodman/dsh-sdlc-flow-core",
-  "version": "0.4.0-beta.22",
+  "version": "0.4.0-beta.24",
   "type": "module",
   "description": "Host services (tasks, scheduler, router, verifier, integration, evidence, escalation, worker-mgr). NEVER installed into a worker profile.",
   "main": "lib/index.js",
@@ -40,7 +40,7 @@
   },
   "icon": "icon.svg",
   "engines": {
-    "node": ">=22.5.0"
+    "node": ">=22.13.0"
   },
   "publishConfig": {
     "access": "public"
@@ -50,6 +50,6 @@
     "url": "https://github.com/pwoodman/dsh-sdlc/issues"
   },
   "dependencies": {
-    "@patwoodman/dsh-sdlc-flow-guard": "0.4.0-beta.22"
+    "@patwoodman/dsh-sdlc-flow-guard": "0.4.0-beta.24"
   }
 }