@quolu/lattice 0.61.3 → 0.62.1

package/README.ja.md

@@ -325,7 +325,8 @@ pidへは送りません（pid再利用で無関係のprocessを止めうるた
 [ADR 0157](docs/adr/0157-dashboard-daemons-are-discoverable-by-record.md)が正です。
 状態を書き込む`start / block / unblock / done / evidence promote / reopen / note / independence mode /
 revise / revise-phase / revise-set / phase review|accept|reject|reopen|close-unaudited|baseline /
-dashboard adopt`では、監査actorとして次の3環境変数をすべて設定してください。
+dashboard adopt`では、監査actorとして次の3環境変数を渡せます。未設定ならhost／`session`／USERから
+defaultします。渡した値がidentifierとして不正なら`ACTOR_UNRESOLVED`です。
 
 ```bash
 export LATTICE_TODO_ACTOR_HOST=<host-id>
@@ -333,12 +334,11 @@ export LATTICE_TODO_ACTOR_SESSION=<session-id>
 export LATTICE_TODO_ACTOR_AGENT=<agent-id>
 ```
 
-不足またはidentifierとして不正な値がある場合、mutationはstoreを変更せず`ACTOR_UNRESOLVED`を返します。
-error detailの`missing_environment`／`invalid_environment`と
-`next_action: set_required_actor_environment_and_retry`を確認し、正規値を設定して同じ操作を再試行してください。
+`todo done`は`--evidence`にdescriptor JSONでも証拠本文でも渡せます。`--message`なら本文から
+blobを書きます。flagの順は問いません。空の設計メモは拒否します。無策なら`NO_PLAN`と書いてください。
 
-正確なargv、evidence descriptor、result wireは
-[ADR 0056](docs/adr/0056-todo-authoring-transitions.md)を参照してください。
+authoring入口と閉じる口の契約は
+[ADR 0181](docs/adr/0181-authoring-entry-accepts-drafts.md)を参照してください。
 
 ## 特許
 

package/bin/lattice.mjs

@@ -31,15 +31,26 @@ if (help !== null) {
       cwd: process.cwd(), stdout: process.stdout, cliVersion: packageJson.version, error,
     });
   }
-} else if ((args.length === 4 || args.length === 5) && args[0] === 'plan' && args[1] === 'create'
-  && args[2] === '--input' && (args.length === 4 || args[4] === '--serialization-reviewed')) {
-  const { projectCliFailure, runPlanCreate } = await import('../src/project-cli.mjs');
-  try {
-    process.exitCode = await runPlanCreate({
-      cwd: process.cwd(), inputRef: args[3], stdout: process.stdout,
-    });
-  } catch (error) {
-    process.exitCode = projectCliFailure(process.stderr, error);
+} else if (args[0] === 'plan' && args[1] === 'create'
+  && args[2] !== '--schema' && args[2] !== '--schema-version') {
+  const { matchFlagCommand } = await import('../src/todo-authoring-input.mjs');
+  const flags = matchFlagCommand(args, ['plan', 'create'], {
+    known: ['input', 'serialization-reviewed'],
+    required: ['input'],
+    booleans: ['serialization-reviewed'],
+  });
+  if (flags === null) {
+    process.stderr.write('lattice: unsupported command or arguments: plan create\n');
+    process.exitCode = 2;
+  } else {
+    const { projectCliFailure, runPlanCreate } = await import('../src/project-cli.mjs');
+    try {
+      process.exitCode = await runPlanCreate({
+        cwd: process.cwd(), inputRef: flags.input, stdout: process.stdout,
+      });
+    } catch (error) {
+      process.exitCode = projectCliFailure(process.stderr, error);
+    }
   }
 } else if (args.length === 4 && args[0] === 'plan' && args[1] === 'create'
   && args[2] === '--schema' && args[3] === '--json') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quolu/lattice",
-  "version": "0.61.3",
+  "version": "0.62.1",
   "description": "Schedulability compiler for multi-agent development: observe real code boundaries, refactor the conflicting seam, recompile the plan for parallel execution",
   "author": {
     "name": "Quo / クオ at kitepon.dev",

package/src/cli-help.mjs

@@ -93,13 +93,17 @@ Write commands:
   migrate --input <extraction.json> [--serialization-reviewed] [--json]
   migrate --input <extraction.json> --dry-run --json [--serialization-reviewed]
       # 既存storeへplanを追加する（plan createは空store初期化専用）。
+      # pretty-print・digest未計算・repo内絶対pathは機械が直す。空の設計メモは拒否する。
       # 結果へdispatch_shapeを載せる。--serialization-reviewedは互換のため受理するだけで門ではない
   start --plan <key> --task <id> [--parallel-frontier|--override-reason <text> [--serial-confirmed]]
-        # readyならflagなしで着手する。--parallel-frontierと--override-reasonは方針・理由の記録。
+        # readyならflagなしで着手する。flagの順は問わない。
+        # --parallel-frontierと--override-reasonは方針・理由の記録。
         # --serial-confirmedは互換のため受理する。いずれも門ではない
   block --plan <key> --task <id> --reason <text>
   unblock --plan <key> --task <id>
-  done --plan <key> --task <id> --evidence <file>  # 構造対象taskはfresh realizationを要求する
+  done --plan <key> --task <id> (--evidence <file>|--message <text>)
+        # taskを閉じる。--evidenceはdescriptor JSONでも証拠本文でもよい。repo内なら絶対path可。
+        # 監査と構造finalizationは残作業であり、doneの門ではない
   reopen --plan <key> --task <id> --reason <text> [--override-reason <text>]
   evidence promote --plan <key> --task <id> --evidence <file>
   dependency connect --from-plan <key> --from-task <id> --to-plan <key> --to-task <id> --reason <text>
@@ -139,8 +143,8 @@ Write commands:
       # 現在gate_readyかつphase eventを1つも持たないPhaseを一括でclosed_unauditedへ宣言する。
       # 自動実行はしない(明示コマンドのみ)。--exceptで指定したplanは対象から除外する
 
-Write commands require LATTICE_TODO_ACTOR_HOST, LATTICE_TODO_ACTOR_SESSION,
-and LATTICE_TODO_ACTOR_AGENT.
+Write commandsはLATTICE_TODO_ACTOR_HOST / SESSION / AGENTを受理する。
+欠落はhost／session／agentのdefaultを使う。渡した値がidentifierとして不正なら拒否する。
 
 storeだけを書き換えるcommandの末尾へ--commit-storeを付けると、共有Git lockを取得し、
 生じた.lattice/todoの変更だけをcommitしてreceiptを返す。
@@ -264,7 +268,7 @@ const SUBCOMMAND_USAGE = Object.freeze({
   'todo retract': 'todo retract --plan <key> --task <id> --reason <text>',
   'todo block': 'todo block --plan <key> --task <id> --reason <text>',
   'todo unblock': 'todo unblock --plan <key> --task <id>',
-  'todo done': 'todo done --plan <key> --task <id> --evidence <file> [--test-result <markdown-file>]',
+  'todo done': 'todo done --plan <key> --task <id> (--evidence <file>|--message <text>) [--test-result <markdown-file>]',
   'todo reopen': 'todo reopen --plan <key> --task <id> --reason <text> [--override-reason <text>]',
   'todo evidence': 'todo evidence promote --plan <key> --task <id> --evidence <file>',
   'todo evidence promote': 'todo evidence promote --plan <key> --task <id> --evidence <file>',

package/src/project-cli.mjs

@@ -1,18 +1,16 @@
 import { gitSync } from './git-process.mjs';
 import { constants as fsConstants } from 'node:fs';
-import { lstat, open, realpath } from 'node:fs/promises';
+import { lstat, open } from 'node:fs/promises';
 import path from 'node:path';
 
 import {
   TODO_DESIGN_MEMO_PROMPT,
-  canonicalizeTodoArtifact,
   exactRecord,
   explainTodoDesignMemo,
   isTodoDesignMemo,
   isStrictTodoTimestamp,
   isTodoDigest,
   isTodoIdentifier,
-  isTodoRef,
   todoSelfDigest,
 } from './todo-contracts.mjs';
 import { projectTodoStatus } from './todo-status.mjs';
@@ -39,10 +37,10 @@ import {
 import {
   computeTodoDispatchShapeForPlan,
 } from './todo-dispatch-shape.mjs';
+import { readAuthoringJsonFile } from './todo-authoring-input.mjs';
 
 const STORE_REF = '.lattice/todo';
 const MANIFEST_REF = `${STORE_REF}/manifest.json`;
-const MAX_INPUT_BYTES = 8_388_608;
 const STATUS_SCHEMA = 'lattice.project_status.v1';
 const SESSION_CONTEXT_SCHEMA = 'lattice.session_context.v1';
 /** HEADが読めない環境でも投影を組めるようにする。記録があるときは実HEADで置き換わる。 */
@@ -339,15 +337,19 @@ export async function runProjectStatus({ cwd, stdout, cliVersion, env = process.
   // dashboard活動の登録はdiscovery面の副作用として維持する（ADR 0131 Decision 4で
   // session-context側だけが持たない、と決めた面である）。
   if (state.store !== null && env.LATTICE_DASHBOARD_AUTOSTART !== '0') {
-    const identity = await resolveProjectIdentity({
-      repoRoot: state.repoRoot, projectId: state.store.project_id, env,
-    });
-    const actorSession = env.LATTICE_TODO_ACTOR_SESSION;
-    await ensureDashboardActivity({
-      repoRoot: state.repoRoot, projectId: state.store.project_id,
-      displayName: identity.displayName,
-      sessionId: isTodoIdentifier(actorSession) ? actorSession : `status-${process.pid}`, env,
-    });
+    try {
+      const identity = await resolveProjectIdentity({
+        repoRoot: state.repoRoot, projectId: state.store.project_id, env,
+      });
+      const actorSession = env.LATTICE_TODO_ACTOR_SESSION;
+      await ensureDashboardActivity({
+        repoRoot: state.repoRoot, projectId: state.store.project_id,
+        displayName: identity.displayName,
+        sessionId: isTodoIdentifier(actorSession) ? actorSession : `status-${process.pid}`, env,
+      });
+    } catch {
+      // dashboardはdiscoveryの副作用。statusをdashboard故障で止めない（ADR 0181）。
+    }
   }
   stdout.write(`${JSON.stringify(state.result)}\n`);
   return state.exitCode;
@@ -382,68 +384,17 @@ export async function runSessionContext({ cwd, stdout, cliVersion }) {
 }
 
 async function readCanonicalInput(repoRoot, inputRef) {
-  if (!isTodoRef(inputRef)) throw new TodoStoreError('INPUT_INVALID', 'input_ref_invalid');
-  const root = await realpath(repoRoot);
-  const absolute = path.resolve(root, inputRef);
-  if (!absolute.startsWith(`${root}${path.sep}`)) throw new TodoStoreError('INPUT_INVALID', 'input_outside_repo');
-  let cursor = root;
   try {
-    for (const part of path.relative(root, absolute).split(path.sep)) {
-      cursor = path.join(cursor, part);
-      const entry = await lstat(cursor);
-      if (entry.isSymbolicLink()) throw new TodoStoreError('INPUT_INVALID', 'input_path_symlink');
-    }
+    return await readAuthoringJsonFile(repoRoot, inputRef, { invalidCode: 'INPUT_INVALID' });
   } catch (error) {
-    if (error instanceof TodoStoreError) throw error;
-    throw new TodoStoreError('INPUT_INVALID', 'input_unreadable');
-  }
-  const state = await lstat(absolute);
-  if (!state.isFile() || await realpath(absolute) !== absolute) {
-    throw new TodoStoreError('INPUT_INVALID', 'input_path_invalid');
-  }
-  if (state.size > MAX_INPUT_BYTES) throw new TodoStoreError('INPUT_INVALID', 'input_too_large');
-  let handle;
-  let bytes;
-  try {
-    handle = await open(absolute, fsConstants.O_RDONLY | (fsConstants.O_NOFOLLOW ?? 0));
-    const opened = await handle.stat();
-    if (opened.dev !== state.dev || opened.ino !== state.ino || opened.size !== state.size
-      || opened.mtimeMs !== state.mtimeMs || opened.ctimeMs !== state.ctimeMs || !opened.isFile()) {
-      throw new TodoStoreError('INPUT_INVALID', 'input_changed_during_validation');
-    }
-    if (opened.size > MAX_INPUT_BYTES) throw new TodoStoreError('INPUT_INVALID', 'input_too_large');
-    const capture = Buffer.allocUnsafe(MAX_INPUT_BYTES + 1);
-    let captured = 0;
-    while (captured < capture.length) {
-      const { bytesRead } = await handle.read(capture, captured, capture.length - captured, null);
-      if (bytesRead === 0) break;
-      captured += bytesRead;
-    }
-    if (captured > MAX_INPUT_BYTES) throw new TodoStoreError('INPUT_INVALID', 'input_too_large');
-    bytes = capture.subarray(0, captured);
-    const after = await lstat(absolute);
-    if (after.dev !== opened.dev || after.ino !== opened.ino || after.size !== opened.size
-      || after.mtimeMs !== opened.mtimeMs || after.ctimeMs !== opened.ctimeMs
-      || await realpath(absolute) !== absolute) {
-      throw new TodoStoreError('INPUT_INVALID', 'input_changed_during_validation');
+    if (error instanceof TodoStoreError && [
+      'INPUT_UNREADABLE', 'INPUT_TOO_LARGE', 'INVALID_JSON',
+    ].includes(error.code)) {
+      throw new TodoStoreError('INPUT_INVALID', error.detail?.reason ?? 'input_unreadable', undefined,
+        error.detail);
     }
-  } catch (error) {
-    if (error instanceof TodoStoreError) throw error;
-    throw new TodoStoreError('INPUT_INVALID', 'input_unreadable');
-  } finally {
-    await handle?.close();
-  }
-  if (bytes.length > MAX_INPUT_BYTES) throw new TodoStoreError('INPUT_INVALID', 'input_too_large');
-  let text;
-  try { text = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(bytes); }
-  catch { throw new TodoStoreError('INPUT_INVALID', 'input_utf8_invalid'); }
-  if (!text.endsWith('\n') || text.includes('\r') || text.slice(0, -1).includes('\n')) {
-    throw new TodoStoreError('INPUT_INVALID', 'input_bytes_noncanonical');
+    throw error;
   }
-  let value;
-  try { value = JSON.parse(text.slice(0, -1)); } catch { throw new TodoStoreError('INPUT_INVALID', 'input_json_invalid'); }
-  if (`${canonicalizeTodoArtifact(value)}\n` !== text) throw new TodoStoreError('INPUT_INVALID', 'input_bytes_noncanonical');
-  return value;
 }
 
 function validateCreateInput(value) {

package/src/runtime-pull-intake.mjs

@@ -1082,10 +1082,16 @@ export async function detachPullWorker({ runDir, taskId, environment = process.e
   } finally { await lock.release(); }
 }
 
-function observationModel(state) {
-  const intakes = state.intakes.filter((entry) => (
-    entry.accepted === null && entry.intervention.state !== 'hold'
-  ));
+export function observationIntakes(state, includeTaskId = null) {
+  return state.intakes.filter((entry) => {
+    if (entry.accepted !== null) return false;
+    if (entry.intervention.state !== 'hold') return true;
+    return includeTaskId !== null && entry.task_id === includeTaskId;
+  });
+}
+
+function observationModel(state, { includeTaskId = null } = {}) {
+  const intakes = observationIntakes(state, includeTaskId);
   const manifests = Object.fromEntries(intakes.map((entry) => [entry.task_id, entry.manifest]));
   const nodes = intakes.map((entry) => ({ todo_id: entry.task_id })).sort((l, r) => l.todo_id.localeCompare(r.todo_id));
   const plan = {
@@ -1154,7 +1160,7 @@ export async function acceptPullTask({ repoRoot, runDir, taskId, environment = p
     const checkpoint = await captureWorktreeDiff({
       worktreePath: intake.worktree_path, baseSha: intake.base_sha,
     });
-    const model = observationModel(state);
+    const model = observationModel(state, { includeTaskId: taskId });
     const packets = Object.fromEntries(model.intakes.map((entry) => [entry.task_id, entry.packet]));
     const direct = detectCheckpointFindings({
       todoId: taskId, checkpoint, packets, manifests: model.manifests,

package/src/todo-authoring-input.mjs

@@ -0,0 +1,183 @@
+/**
+ * AIが書くauthoring入力の受理。
+ *
+ * storeへ書くbytesはこれまでどおりcanonical。入口がpretty-print・digest未計算・
+ * repo内絶対pathを拒否するのは、機械が直せるものを儀式にしている。
+ * 空の設計メモは直さない——NO_PLANは無策の明示申告であり、欠落から作らない。
+ */
+
+import { lstat, readFile, realpath } from 'node:fs/promises';
+import path from 'node:path';
+import { parseTree } from 'jsonc-parser';
+
+import { todoSelfDigest } from './todo-contracts.mjs';
+import { TodoStoreError } from './todo-store.mjs';
+
+const MAX_AUTHORING_INPUT_BYTES = 8_388_608;
+
+export const AUTHORING_DIGEST_FIELDS = Object.freeze({
+  'lattice.todo_witness_set.v1': 'witness_set_digest',
+  'lattice.todo_witness_set.v2': 'witness_set_digest',
+  'lattice.todo_witness_set.v3': 'witness_set_digest',
+  'lattice.todo_witness_set.v4': 'witness_set_digest',
+  'lattice.todo_witness_set.v5': 'witness_set_digest',
+  'lattice.todo_extraction.v2': 'extraction_digest',
+  'lattice.todo_extraction.v3': 'extraction_digest',
+  'lattice.todo_extraction.v4': 'extraction_digest',
+  'lattice.plan_create_input.v1': 'input_digest',
+  'lattice.plan_create_input.v2': 'input_digest',
+  'lattice.plan_create_input.v3': 'input_digest',
+  'lattice.plan_create_input.v4': 'input_digest',
+  'lattice.todo_revision.v1': 'revision_digest',
+  'lattice.todo_revision.v2': 'revision_digest',
+  'lattice.phase_todo_revision.v1': 'revision_digest',
+  'lattice.phase_todo_revision.v2': 'revision_digest',
+  'lattice.phase_todo_revision.v3': 'revision_digest',
+  'lattice.todo_revision_set.v1': 'revision_set_digest',
+  'lattice.todo_revision_set.v2': 'revision_set_digest',
+  'lattice.todo_revision_set.v3': 'revision_set_digest',
+  'lattice.phase_accept_input.v1': 'input_digest',
+  'lattice.phase_reject_input.v1': 'input_digest',
+});
+
+function fail(code, reason, detail) {
+  throw new TodoStoreError(code, reason, undefined, detail);
+}
+
+function within(root, candidate) {
+  return candidate === root || candidate.startsWith(`${root}${path.sep}`);
+}
+
+function hasDuplicateJsonKey(node) {
+  if (node?.type === 'object') {
+    const keys = new Set();
+    for (const property of node.children ?? []) {
+      const [key, value] = property.children ?? [];
+      if (keys.has(key?.value) || hasDuplicateJsonKey(value)) return true;
+      keys.add(key?.value);
+    }
+  } else if (node?.type === 'array') {
+    return (node.children ?? []).some(hasDuplicateJsonKey);
+  }
+  return false;
+}
+
+/** CLI引数がauthoring fileを指しているか。repo相対でも絶対でもよい。 */
+export function isAuthoringPathToken(value) {
+  return typeof value === 'string' && value.length > 0 && !value.startsWith('--');
+}
+
+export function parseAuthoringJson(text, { invalidCode = 'INVALID_JSON' } = {}) {
+  if (typeof text !== 'string') fail(invalidCode, 'input_json_invalid');
+  const normalized = text.replace(/^\uFEFF/u, '').replace(/\r\n/gu, '\n').replace(/\r/gu, '\n');
+  const parseErrors = [];
+  const tree = parseTree(normalized, parseErrors, { allowTrailingComma: false, disallowComments: true });
+  if (parseErrors.length > 0 || tree === undefined) fail(invalidCode, 'json_parse_failed');
+  if (hasDuplicateJsonKey(tree)) fail(invalidCode, 'duplicate_key');
+  try {
+    return JSON.parse(normalized);
+  } catch {
+    fail(invalidCode, 'json_parse_failed');
+  }
+  return null;
+}
+
+export function repairAuthoringArtifact(value) {
+  if (value === null || typeof value !== 'object' || Array.isArray(value)) return value;
+  const field = AUTHORING_DIGEST_FIELDS[value.schema];
+  if (field === undefined) return value;
+  const next = { ...value, [field]: typeof value[field] === 'string' ? value[field] : '' };
+  next[field] = todoSelfDigest(next, field);
+  return next;
+}
+
+export async function resolveAuthoringInputPath(repoRoot, inputRef) {
+  if (typeof inputRef !== 'string' || inputRef.length === 0) {
+    fail('INPUT_UNREADABLE', 'input_ref_invalid', { input_ref: inputRef });
+  }
+  const canonicalRoot = await realpath(repoRoot);
+  const candidate = path.isAbsolute(inputRef)
+    ? inputRef
+    : path.resolve(canonicalRoot, inputRef);
+  let stats;
+  try { stats = await lstat(candidate); } catch {
+    fail('INPUT_UNREADABLE', 'input_missing', { input_ref: inputRef });
+  }
+  if (stats.isSymbolicLink() || !stats.isFile()) {
+    fail('INPUT_UNREADABLE', 'unsafe_input_path', { input_ref: inputRef });
+  }
+  const resolved = await realpath(candidate);
+  if (!within(canonicalRoot, resolved) || resolved === canonicalRoot) {
+    fail('INPUT_UNREADABLE', 'input_path_outside_repo', { input_ref: inputRef });
+  }
+  if (stats.size > MAX_AUTHORING_INPUT_BYTES) fail('INPUT_TOO_LARGE', 'input_size_limit_exceeded');
+  const relative = path.relative(canonicalRoot, resolved);
+  if (relative.startsWith(`..${path.sep}`) || relative === '..' || path.isAbsolute(relative)) {
+    fail('INPUT_UNREADABLE', 'input_path_outside_repo', { input_ref: inputRef });
+  }
+  return {
+    absolute: resolved,
+    inputRef: relative.split(path.sep).join('/'),
+    maxBytes: MAX_AUTHORING_INPUT_BYTES,
+  };
+}
+
+export async function readAuthoringJsonFile(repoRoot, inputRef, {
+  invalidCode = 'INVALID_JSON',
+} = {}) {
+  const located = await resolveAuthoringInputPath(repoRoot, inputRef);
+  const bytes = await readFile(located.absolute);
+  if (bytes.length > located.maxBytes) fail('INPUT_TOO_LARGE', 'input_size_limit_exceeded');
+  let text;
+  try { text = new TextDecoder('utf-8', { fatal: true }).decode(bytes); }
+  catch { fail(invalidCode, 'invalid_utf8'); }
+  const parsed = parseAuthoringJson(text, { invalidCode });
+  return repairAuthoringArtifact(parsed);
+}
+
+export function parseFlagMap(argv) {
+  const flags = Object.create(null);
+  const rest = [];
+  for (let index = 0; index < argv.length; index += 1) {
+    const token = argv[index];
+    if (typeof token !== 'string' || !token.startsWith('--') || token === '--') {
+      rest.push(token);
+      continue;
+    }
+    const name = token.slice(2);
+    const next = argv[index + 1];
+    if (next !== undefined && typeof next === 'string' && !next.startsWith('--')) {
+      flags[name] = next;
+      index += 1;
+    } else {
+      flags[name] = true;
+    }
+  }
+  return { flags, rest };
+}
+
+export function flagMapKeys(flags, expected) {
+  const actual = Object.keys(flags).sort();
+  const allowed = [...expected].sort();
+  return actual.length === allowed.length && actual.every((key, index) => key === allowed[index]);
+}
+
+/**
+ * 位置ではなくflag名でwriteコマンドを束ねる。未知flag・位置引数は受理しない。
+ * boolean flagは値がtrueのときだけ合法。requiredは非空string。
+ */
+export function matchFlagCommand(argv, head, { known, required = [], booleans = [] } = {}) {
+  if (!Array.isArray(argv) || !Array.isArray(head) || head.some((token, index) => argv[index] !== token)) {
+    return null;
+  }
+  const { flags, rest } = parseFlagMap(argv.slice(head.length));
+  if (rest.length > 0) return null;
+  if (Object.keys(flags).some((key) => !known.includes(key))) return null;
+  for (const key of required) {
+    if (typeof flags[key] !== 'string' || flags[key].length === 0) return null;
+  }
+  for (const key of booleans) {
+    if (flags[key] !== undefined && flags[key] !== true) return null;
+  }
+  return flags;
+}