@quolu/lattice 0.69.4 → 0.70.0

package/README.ja.md

@@ -309,9 +309,13 @@ required evidenceを束縛した`todo phase accept`で重監査の判断を記
 ```bash
 lattice todo phase status --plan <key>   # phase無しplanでも暗黙Phaseを返す（implicit: true）
 lattice todo phase review --plan <key> --phase terminal-audit --reason <text>
-lattice todo phase accept --plan <key> --phase terminal-audit --input <file>
+lattice todo phase accept --plan <key> --phase terminal-audit --evidence <監査file>
 ```
 
+`--evidence`には、commit済みの監査本文をrepo相対pathで渡します。reviewのevent digest、証拠の記述子、
+必須evidence slotはLatticeが組み立てます。必須slotが複数あるPhaseや、記述子を自分で渡したい時は
+`--input <file>`（`lattice.phase_accept_input.v1`、`input_digest`は空でよい）を使います。
+
 **過去の工程は監査できません。** 監査対象のコードが既に変化しているためです。そこで
 「監査なしで閉じた」という状態を別に持ちます——`accepted`（監査を通った）へは絶対に化けず、
 記録は永久に区別できます。工程図では畳まれるので監査待ちの札は外れます。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quolu/lattice",
-  "version": "0.69.4",
+  "version": "0.70.0",
   "description": "Schedulability compiler for multi-agent development: observe real code boundaries, refactor the conflicting seam, recompile the plan for parallel execution",
   "author": {
     "name": "Quo / クオ at kitepon.dev",

package/src/cli-help.mjs

@@ -141,6 +141,8 @@ Write commands:
       # 実際に受理する最新契約のJSON Schemaを返す（storeを読まない）。
       # 入力が契約に合わないときは、違反フィールドのpathがerror detailへ載る
   phase review --plan <key> --phase <id> --reason <text>
+  phase accept --plan <key> --phase <id> --evidence <file>  # 監査fileから入力を機械が組む
+  phase reject --plan <key> --phase <id> --reason <text> --evidence <file>
   phase <accept|reject> --plan <key> --phase <id> --input <file>
   phase reopen --plan <key> --phase <id> --reason <text> [--override-reason <text>]
   phase close-unaudited --plan <key> --phase <id> --reason <text>
@@ -278,8 +280,8 @@ const SUBCOMMAND_USAGE = Object.freeze({
     + ' | baseline --reason <text> [--except <plan_key>]...',
   'todo phase status': 'todo phase status --plan <key>',
   'todo phase review': 'todo phase review --plan <key> --phase <id> --reason <text>',
-  'todo phase accept': 'todo phase accept --plan <key> --phase <id> --input <file>',
-  'todo phase reject': 'todo phase reject --plan <key> --phase <id> --input <file>',
+  'todo phase accept': 'todo phase accept --plan <key> --phase <id> --evidence <file> | --input <file>',
+  'todo phase reject': 'todo phase reject --plan <key> --phase <id> --reason <text> --evidence <file> | --input <file>',
   'todo phase reopen': 'todo phase reopen --plan <key> --phase <id> --reason <text> [--override-reason <text>]',
   'todo phase close-unaudited': 'todo phase close-unaudited --plan <key> --phase <id> --reason <text>',
   'todo phase baseline': 'todo phase baseline --reason <text> [--except <plan_key>]...',

package/src/todo-cli.mjs

@@ -60,6 +60,7 @@ import {
   isPhaselessTodoPlanSchema,
   projectTodoCrossPlanDependencies,
   TERMINAL_AUDIT_PHASE_ID,
+  todoPhaseDefinitions,
   readTodoIndependenceArtifact,
   readTodoSeamProposalArtifact,
   readTodoStore,
@@ -974,13 +975,38 @@ function validatePhaseDecisionInput(value, outcome) {
     && isTodoDigest(value.input_digest) && value.input_digest === todoSelfDigest(value, 'input_digest');
 }
 
+// `--input`の形が合わないとき、期待形をerrorへ同梱する（ADR 0130）。自己digestは入口が補うので
+// 空でよい（ADR 0181）。証拠記述子を手で作らせないために、ふつうは`--evidence`を案内する。
+const PHASE_DECISION_EXPECTED = Object.freeze({
+  accept: '{ "schema": "lattice.phase_accept_input.v1", "review_event_digest": "<phase reviewのevent_digest>",'
+    + ' "decision_evidence": <evidence記述子>, "evidence_slots": [{ "slot_id": "<必須slot>", "evidence": <evidence記述子> }],'
+    + ' "input_digest": "" }',
+  reject: '{ "schema": "lattice.phase_reject_input.v1", "review_event_digest": "<phase reviewのevent_digest>",'
+    + ' "reason": "<text>", "decision_evidence": <evidence記述子>, "input_digest": "" }',
+  note: 'input_digestは入口が計算する。証拠fileがcommit済みなら、`--evidence <file>`で'
+    + 'review_event_digest・記述子・必須slotを機械が埋める。evidence記述子の形はEVIDENCE_DESCRIPTOR_EXPECTEDを見る。',
+});
+
 async function phaseDecision({ repoRoot, env, planKey, phaseId, outcome, inputRef }) {
-  const input = await readRevisionInput(repoRoot, inputRef, {
-    validate: (value) => validatePhaseDecisionInput(value, outcome),
-    invalidCode: 'PHASE_DECISION_INVALID', invalidReason: 'phase_decision_schema_or_digest_invalid',
-    // phase decision入力はrevision契約と別形状。既定のrevision explainを誤って当てない。
-    explain: null,
-  });
+  let input;
+  try {
+    input = await readRevisionInput(repoRoot, inputRef, {
+      validate: (value) => validatePhaseDecisionInput(value, outcome),
+      invalidCode: 'PHASE_DECISION_INVALID', invalidReason: 'phase_decision_schema_or_digest_invalid',
+      // phase decision入力はrevision契約と別形状。既定のrevision explainを誤って当てない。
+      explain: null,
+    });
+  } catch (error) {
+    if (error instanceof TodoStoreError && error.code === 'PHASE_DECISION_INVALID') {
+      throw new TodoStoreError('PHASE_DECISION_INVALID', 'phase_decision_schema_or_digest_invalid', undefined, {
+        expected: PHASE_DECISION_EXPECTED[outcome], note: PHASE_DECISION_EXPECTED.note,
+        evidence_descriptor: EVIDENCE_DESCRIPTOR_EXPECTED,
+        next_action: `lattice todo phase ${outcome} --plan ${planKey} --phase ${phaseId}`
+          + (outcome === 'reject' ? ' --reason <text>' : '') + ' --evidence <repo内の監査file>',
+      });
+    }
+    throw error;
+  }
   const payload = outcome === 'accept'
     ? { review_event_digest: input.review_event_digest, decision_evidence: input.decision_evidence,
       evidence_slots: input.evidence_slots }
@@ -989,6 +1015,49 @@ async function phaseDecision({ repoRoot, env, planKey, phaseId, outcome, inputRe
   return phaseMutation({ repoRoot, env, planKey, phaseId, kind: `phase_${outcome}`, payload });
 }
 
+/**
+ * `--evidence <file>`から判断入力を組み立てる（ADR 0181の下書き受理をphase判断へ広げる）。
+ * review_event_digestはstoreの現在のreviewから、記述子は`todo done`と同じ処理でcommit済み
+ * fileから作る。必須slotが1つならその証拠で埋める。複数slotへ1つの証拠を流用すると
+ * 「各slotを別々に確かめた」ことを偽るので、その場合は`--input`で明示させる。
+ */
+async function phaseDecisionFromEvidence({ repoRoot, env, planKey, phaseId, outcome, evidenceRef, reason }) {
+  const store = await readTodoStore({ repoRoot });
+  const member = store.members.find(({ plan }) => plan.plan_key === planKey);
+  if (member === undefined) {
+    throw new TodoStoreError('PHASE_DECISION_INVALID', 'plan_not_active', undefined, { plan_key: planKey });
+  }
+  const state = member.phases.find(({ phase_id: current }) => current === phaseId);
+  const definition = todoPhaseDefinitions(member.plan).find(({ phase_id: current }) => current === phaseId);
+  if (state === undefined || definition === undefined) {
+    throw new TodoStoreError('PHASE_DECISION_INVALID', 'phase_not_found', undefined, {
+      plan_key: planKey, phase_id: phaseId,
+      phases: todoPhaseDefinitions(member.plan).map(({ phase_id: id }) => id),
+    });
+  }
+  if (state.status !== 'reviewing' || state.review_event_digest === null) {
+    throw new TodoStoreError('PHASE_DECISION_INVALID', 'phase_not_reviewing', undefined, {
+      plan_key: planKey, phase_id: phaseId, status: state.status,
+      next_action: `lattice todo phase review --plan ${planKey} --phase ${phaseId} --reason <text>`,
+    });
+  }
+  if (outcome === 'accept' && definition.required_evidence_slots.length !== 1) {
+    throw new TodoStoreError('PHASE_DECISION_INVALID', 'multiple_evidence_slots_need_input', undefined, {
+      required_evidence_slots: definition.required_evidence_slots,
+      expected: PHASE_DECISION_EXPECTED.accept, evidence_descriptor: EVIDENCE_DESCRIPTOR_EXPECTED,
+      next_action: `lattice todo phase accept --plan ${planKey} --phase ${phaseId} --input <file>`,
+    });
+  }
+  const evidence = await resolveDoneEvidence({
+    repoRoot, evidenceRef, evidenceMessage: null, planKey, taskId: `${phaseId}-${outcome}`,
+  });
+  const payload = outcome === 'accept'
+    ? { review_event_digest: state.review_event_digest, decision_evidence: evidence,
+      evidence_slots: definition.required_evidence_slots.map((slotId) => ({ slot_id: slotId, evidence })) }
+    : { review_event_digest: state.review_event_digest, reason, decision_evidence: evidence };
+  return phaseMutation({ repoRoot, env, planKey, phaseId, kind: `phase_${outcome}`, payload });
+}
+
 async function phaseMutation({ repoRoot, env, planKey, phaseId, kind, payload }) {
   const { event, snapshot, phases } = await appendTodoEvent({
     repoRoot, writer: createTodoStoreWriter({ caller: 'g5-authoring' }), planKey,
@@ -3989,14 +4058,22 @@ export async function runTodoCli({ argv, cwd, stdout, stderr, env = process.env
     action = (repoRoot) => phaseMutation({ repoRoot, env, planKey: argv[3], phaseId: argv[5],
       kind: 'phase_review', payload: { reason: argv[7] } });
   } else if (argv[0] === 'phase' && ['accept', 'reject'].includes(argv[1])) {
-    const flags = matchFlagCommand(argv, ['phase', argv[1]], {
-      known: ['plan', 'phase', 'input'], required: ['plan', 'phase', 'input'],
+    const outcome = argv[1];
+    const flags = matchFlagCommand(argv, ['phase', outcome], {
+      known: ['plan', 'phase', 'input', 'evidence', 'reason'], required: ['plan', 'phase'],
     });
-    if (flags !== null && isTodoIdentifier(flags.plan) && isTodoIdentifier(flags.phase)
-      && isAuthoringPathToken(flags.input)) {
+    const base = flags !== null && isTodoIdentifier(flags.plan) && isTodoIdentifier(flags.phase);
+    if (base && isAuthoringPathToken(flags.input) && flags.evidence === undefined && flags.reason === undefined) {
       action = (repoRoot) => phaseDecision({
         repoRoot, env, planKey: flags.plan, phaseId: flags.phase,
-        outcome: argv[1], inputRef: flags.input,
+        outcome, inputRef: flags.input,
+      });
+    } else if (base && flags.input === undefined && isAuthoringPathToken(flags.evidence)
+      && (outcome === 'accept' ? flags.reason === undefined
+        : typeof flags.reason === 'string' && flags.reason.length > 0)) {
+      action = (repoRoot) => phaseDecisionFromEvidence({
+        repoRoot, env, planKey: flags.plan, phaseId: flags.phase,
+        outcome, evidenceRef: flags.evidence, reason: flags.reason ?? null,
       });
     }
   } else if ((argv.length === 8 || argv.length === 10) && argv[0] === 'phase'

package/src/todo-store.mjs

@@ -62,7 +62,6 @@ const CROSS_PLAN_RECOVERY_CLAIMS_REF = `${STORE_ROOT_REF}/.cross-plan-recovery`;
 const CROSS_PLAN_IMPORT_TRANSACTION_SCHEMA = 'lattice.todo_cross_plan_import_transaction.v1';
 const SOURCE_CUTOVER_BARRIER_REF = `${STORE_ROOT_REF}/source-cutover-recovery.json`;
 const SOURCE_CUTOVER_RECOVERY_CAPABILITY = Symbol('lattice.todo.source-cutover-recovery');
-const EVIDENCE_REPAIR_CAPABILITY = Symbol('lattice.todo.evidence-repair');
 const MAX_FUTURE_SKEW_MS = 5 * 60 * 1_000;
 const WRITER_CALLERS = new Set(['g4-migration', 'g5-authoring']);
 const TODO_REVISION_SCHEMAS = Object.freeze([
@@ -621,8 +620,10 @@ function replay(plan, events, { now = new Date(), verifyEvidence, verifyImportSo
           const decisionEvidence = event.payload.decision_evidence;
           const slotEvidence = event.payload.evidence_slots.map((slot) => slot.evidence);
           pendingVerifications.set(`phase:${event.phase_id}`, () => {
-            verifyEvidence(decisionEvidence);
-            for (const evidence of slotEvidence) verifyEvidence(evidence);
+            const context = { plan_key: plan.plan_key, phase_id: event.phase_id,
+              event_digest: event.event_digest };
+            verifyEvidence(decisionEvidence, context);
+            for (const evidence of slotEvidence) verifyEvidence(evidence, context);
           });
         }
         state.status = 'accepted'; state.decision_event_digest = event.event_digest;
@@ -633,7 +634,9 @@ function replay(plan, events, { now = new Date(), verifyEvidence, verifyImportSo
         }
         if (verifyEvidence) {
           const decisionEvidence = event.payload.decision_evidence;
-          pendingVerifications.set(`phase:${event.phase_id}`, () => verifyEvidence(decisionEvidence));
+          pendingVerifications.set(`phase:${event.phase_id}`, () => verifyEvidence(decisionEvidence, {
+            plan_key: plan.plan_key, phase_id: event.phase_id, event_digest: event.event_digest,
+          }));
         }
         state.status = 'rejected'; state.decision_event_digest = event.event_digest;
         state.decision_evidence = event.payload.decision_evidence;
@@ -1222,7 +1225,7 @@ function readEvidenceBlob(absoluteRepo, oid) {
   return entry.bytes;
 }
 
-function evidenceVerifier(manifest, repoRoot, hard, repair = null) {
+function evidenceVerifier(manifest, repoRoot, hard, newEventDigest = null) {
   const repositories = new Map(manifest.repositories.map((repo) => [repo.repo_id, repo.path]));
   return (descriptor, context = {}) => {
     if (!validateEvidenceDescriptor(descriptor)) fail('STORE_INCONSISTENT', 'evidence_descriptor_invalid');
@@ -1245,15 +1248,8 @@ function evidenceVerifier(manifest, repoRoot, hard, repair = null) {
       if (sha256Bytes(bytes) !== descriptor.content_digest) throw new Error('digest mismatch');
       return true;
     } catch {
-      const repairTarget = repair !== null
-        && typeof repair.taskId === 'string'
-        && context.plan_key === repair.planKey
-        && typeof context.task_id === 'string'
-        && context.task_id === repair.taskId;
-      // evidence promotionだけは、同じtaskの過去eventを新しいhard-verified eventで
-      // supersedeするためにここを通る。prospective event自身と他taskは免除しない。
-      if (repairTarget
-        && (repair.eventDigest === null || context.event_digest !== repair.eventDigest)) return false;
+      // 既存の不達は未検証として残す。新eventの証拠だけは書込み前にhard検証する。
+      if (newEventDigest !== null && context.event_digest !== newEventDigest) return false;
       if (hard) fail('STORE_INCONSISTENT', 'evidence_unverified', {
         ...context,
         next_action: context.plan_key === undefined
@@ -1416,20 +1412,14 @@ function liveReplacementPreservesListStructure(lineBytes, replacement) {
   return source !== null && target !== null && source[1] === target[1] && source[2] === target[2];
 }
 
-function importSourceVerifier(repoRoot, hard, cache = null, repair = null) {
+function importSourceVerifier(repoRoot, hard, cache = null, newEventDigest = null) {
   return (descriptor, context = {}) => {
     if (!validateTodoImportSource(descriptor)) fail('STORE_INCONSISTENT', 'import_source_descriptor_invalid');
     try {
       pinnedSourceLine(repoRoot, descriptor, cache);
       return true;
     } catch {
-      const repairTarget = repair !== null
-        && typeof repair.taskId === 'string'
-        && context.plan_key === repair.planKey
-        && typeof context.task_id === 'string'
-        && context.task_id === repair.taskId;
-      if (repairTarget
-        && (repair.eventDigest === null || context.event_digest !== repair.eventDigest)) return false;
+      if (newEventDigest !== null && context.event_digest !== newEventDigest) return false;
       if (hard) fail('STORE_INCONSISTENT', 'import_source_unverified', {
         ...context,
         next_action: 'verify_source_commit_origin_path_and_line_then_retry',
@@ -1605,14 +1595,8 @@ export async function readTodoStore(options = {}) {
       fail('STORE_INCONSISTENT', 'manifest_revision_binding_mismatch');
     }
     prefetchVerificationObjects(manifest, repoRoot, journal.events, pinnedSourceCache);
-    const evidenceRepair = options.evidenceRepairCapability === EVIDENCE_REPAIR_CAPABILITY
-      ? options.evidenceRepair ?? null : null;
-    const verifyEvidence = evidenceVerifier(
-      manifest, repoRoot, options.forWrite === true, evidenceRepair,
-    );
-    const verifyImportSource = importSourceVerifier(
-      repoRoot, options.forWrite === true, pinnedSourceCache, evidenceRepair,
-    );
+    const verifyEvidence = evidenceVerifier(manifest, repoRoot, false);
+    const verifyImportSource = importSourceVerifier(repoRoot, false, pinnedSourceCache);
     const tasks = replay(plan, journal.events, {
       now: options.now ? new Date(options.now) : new Date(),
       verifyEvidence: options.forWrite === true ? verifyEvidence : undefined,
@@ -2056,13 +2040,8 @@ export async function appendTodoEvent(options = {}) {
   requireWriter(options.writer, 'g5-authoring');
   const repoRoot = path.resolve(options.repoRoot ?? process.cwd());
   return withLock(repoRoot, async () => {
-    const evidenceRepair = options.event.kind === 'done'
-      && options.event.payload?.done_mode === 'evidence_promotion'
-      ? { planKey: options.planKey, taskId: options.event.task_id, eventDigest: null }
-      : null;
     const store = await readTodoStore({
-      repoRoot, forWrite: true, now: options.now, evidenceRepair,
-      evidenceRepairCapability: EVIDENCE_REPAIR_CAPABILITY,
+      repoRoot, forWrite: true, now: options.now,
       // 修理扉は除去event（tombstone）の書込みだけに開く。それ以外の書込みは従来どおり
       // binding_stale で fail closed する（validateMergedGraph の注記を参照）
       tolerateStaleBindings: options.tolerateStaleBindings === true
@@ -2113,16 +2092,8 @@ export async function appendTodoEvent(options = {}) {
       [...member.journal.events, event], appendSourceCache);
     replay(member.plan, [...member.journal.events, event], {
       now: options.now ? new Date(options.now) : new Date(),
-      verifyEvidence: evidenceVerifier(store.manifest, repoRoot, true, {
-        planKey: member.plan.plan_key,
-        taskId: event.task_id,
-        eventDigest: event.event_digest,
-      }),
-      verifyImportSource: importSourceVerifier(repoRoot, true, appendSourceCache, {
-        planKey: member.plan.plan_key,
-        taskId: event.task_id,
-        eventDigest: event.event_digest,
-      }),
+      verifyEvidence: evidenceVerifier(store.manifest, repoRoot, true, event.event_digest),
+      verifyImportSource: importSourceVerifier(repoRoot, true, appendSourceCache, event.event_digest),
     });
     if (options.materializedEvidence !== null && options.materializedEvidence !== undefined) {
       const asset = options.materializedEvidence;
@@ -4270,8 +4241,8 @@ async function applyPhaseTodoRevisionV3(options, revision, repoRoot) {
     await protocolStage(options, 'phase_v3_marker_durable');
     const tasks = replay(revision.desired_plan, [genesis], {
       now: options.now ? new Date(options.now) : new Date(),
-      verifyEvidence: evidenceVerifier(store.manifest, repoRoot, true),
-      verifyImportSource: importSourceVerifier(repoRoot, true),
+      verifyEvidence: evidenceVerifier(store.manifest, repoRoot, false),
+      verifyImportSource: importSourceVerifier(repoRoot, false),
     });
     const snapshot = snapshotFor(revision.desired_plan, [genesis], tasks);
     for (const [stage, ref, bytes] of [
@@ -4437,8 +4408,8 @@ export async function applyPhaseTodoRevision(options = {}) {
     const journalRef = `${base}/journal/active.jsonl`; const snapshotRef = `${base}/snapshot.json`;
     const tasks = replay(revision.desired_plan, [genesis], {
       now: options.now ? new Date(options.now) : new Date(),
-      verifyEvidence: evidenceVerifier(store.manifest, repoRoot, true),
-      verifyImportSource: importSourceVerifier(repoRoot, true),
+      verifyEvidence: evidenceVerifier(store.manifest, repoRoot, false),
+      verifyImportSource: importSourceVerifier(repoRoot, false),
     });
     const snapshot = snapshotFor(revision.desired_plan, [genesis], tasks);
     const artifacts = [
@@ -4586,8 +4557,8 @@ export async function applyTodoRevision(options = {}) {
     }
     await protocolStage(options, 'revision_marker_durable');
 
-    const verifyEvidence = evidenceVerifier(store.manifest, repoRoot, true);
-    const verifyImportSource = importSourceVerifier(repoRoot, true);
+    const verifyEvidence = evidenceVerifier(store.manifest, repoRoot, false);
+    const verifyImportSource = importSourceVerifier(repoRoot, false);
     const tasks = replay(revision.desired_plan, [genesis], {
       now: options.now ? new Date(options.now) : new Date(), verifyEvidence, verifyImportSource,
     });
@@ -4862,8 +4833,8 @@ export async function applyTodoRevisionSet(options = {}) {
     }
     await protocolStage(options, 'revision_set_marker_durable');
 
-    const verifyEvidence = evidenceVerifier(store.manifest, repoRoot, true);
-    const verifyImportSource = importSourceVerifier(repoRoot, true);
+    const verifyEvidence = evidenceVerifier(store.manifest, repoRoot, false);
+    const verifyImportSource = importSourceVerifier(repoRoot, false);
     for (const entry of prepared) {
       const { revision, genesis } = entry;
       const tasks = replay(revision.desired_plan, [genesis], {