@rulemetric/local 0.12.1 → 0.12.3

package/dist/supabase/migrations/00205_auto_accept_writes_only_to_canonical_checkouts.sql

@@ -0,0 +1,110 @@
+-- 00205 — an unattended file writer may only write to a project's canonical
+-- checkout.
+--
+-- THE DEFECT, found 2026-08-24 by releasing the staleness backlog and LOOKING at
+-- what became eligible rather than assuming.
+--
+-- `enqueue_auto_accept_suggestions` groups by `instruction_suggestions.project_path`
+-- verbatim. It has never asked whether that path is a checkout, let alone THE
+-- checkout. While the catalog-skill backlog was stale that was invisible: the
+-- pool held two paths. The moment the backlog was released, the producer's match
+-- set was 13 paths, of which exactly TWO are canonical checkouts:
+--
+--     /Users/nickyeager                                    14 skills   HOME DIRECTORY
+--     /private/var/folders/dn/.../T                         3 skills   temp directory
+--     /Users/nickyeager/Code/agents/momento-mori/apps/cli   7 skills   the dead path from 00186
+--     …/tinyworlds/.worktrees/image-blast-m4, -m6, -m7     13 skills   worktrees
+--     /Users/kylechalmers/Development                       2 skills   a parent of two workspaces
+--
+-- `/Users/nickyeager` is the one that matters most: `acceptSkill` writes under
+-- `<projectPath>/.claude/skills/`, so the home directory means `~/.claude/skills/`
+-- — the GLOBAL skills directory, loaded into every session of every project. An
+-- unattended loop would have installed 14 skills globally and reported success.
+--
+-- 00202 cannot catch any of these. Its question is "is this path on disk", and
+-- all of them are. This is the same defect as 00202's — a producer aiming at a
+-- path nobody validated — wearing a different hat.
+--
+-- THE RULE, and it is not new. `public.project_canonical_checkouts` (00186) is
+-- the single authority for which path IS a project, and CLAUDE.md's invariant is
+-- that it must never be re-derived. `enqueue_instruction_training` has been
+-- gated on it since 00188, whose comment records the identical failure: "the
+-- project-level activity join in 00174 let every subpath of an active repo
+-- through, and apps/cli collected 6 undead trials that way". Auto-accept — which
+-- writes FILES rather than nominating trials — was never given the same gate.
+-- It is the site that needed it most.
+--
+-- CONSEQUENCE, stated rather than buried: this blocks the external user
+-- entirely, because none of his three paths is a canonical checkout. That is the
+-- correct default for an unattended writer (better to write nowhere than into a
+-- directory holding two unrelated workspaces), but it means his skill lane moves
+-- from "dead via is_stale" to "dead via this gate", and the real fix is that his
+-- checkouts are not registered in `project_checkouts`. Tracked separately; do not
+-- widen this gate to paper over it.
+
+create or replace function public.enqueue_auto_accept_suggestions()
+returns integer
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+  queued integer;
+begin
+  with eligible as (
+    select s.user_id, s.project_path
+    from instruction_suggestions s
+    join profiles p on p.id = s.user_id
+    join instructions i on i.id = s.instruction_id
+    left join projects proj on proj.id = s.project_id
+    where
+          s.kind = 'add'
+      and (s.score >= 0.8 or i.frontmatter->>'source' = 'insights')
+      and i.type in ('instruction', 'skill')
+      and i.archived = false
+      and s.accepted_at is null
+      and s.dismissed_at is null
+      -- Nobody answering is not a refusal (00203).
+      and (s.declined_at is null or s.declined_reason = 'surface_budget')
+      and s.is_stale = false
+      and coalesce(
+            proj.metadata->>'autoAcceptSuggestions',
+            p.auto_accept_suggestions::text
+          ) = 'true'
+      -- WHERE an unattended writer may write: the project's canonical checkout,
+      -- and nowhere else. Not a home directory, not a temp directory, not a
+      -- worktree, not a subdirectory somebody once opened a session in. Read
+      -- from the view, never re-derived (00186, and CLAUDE.md's invariant).
+      and exists (
+        select 1 from public.project_canonical_checkouts c
+         where c.path = s.project_path
+      )
+      -- The worker said this directory is not there (00202).
+      and not public.project_path_recently_missing(s.user_id, s.project_path)
+      and not exists (
+        select 1 from agent_jobs j
+        where j.task_kind = 'cron_auto_accept_suggestions'
+          and j.status in ('pending', 'claimed', 'running')
+          and j.payload->>'projectPath' = s.project_path
+          and j.user_id = s.user_id
+      )
+    group by s.user_id, s.project_path
+  ),
+  ins as (
+    insert into agent_jobs (user_id, task_kind, status, payload, dedupe_key)
+    select e.user_id,
+           'cron_auto_accept_suggestions',
+           'pending',
+           jsonb_build_object('projectPath', e.project_path),
+           'auto-accept:' || e.user_id::text || ':' || e.project_path
+    from eligible e
+    returning 1
+  )
+  select count(*)::int into queued from ins;
+
+  return queued;
+end;
+$$;
+
+comment on function public.enqueue_auto_accept_suggestions() is
+  'Hourly producer for cron_auto_accept_suggestions. Requires a consented ADD proposal that is high-confidence or insights-authored, of an auto-adoptable type (00197), not declined by MEASUREMENT (00203), on a path that IS the project canonical checkout (00205 — releasing the staleness backlog revealed the match set was 13 paths of which 2 were checkouts; the others were a HOME directory, a temp directory, three worktrees and the dead apps/cli path, and acceptSkill would have written 14 skills into ~/.claude/skills/ globally), and that a worker has not reported missing from disk in 24h (00202).';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rulemetric/local",
-  "version": "0.12.1",
+  "version": "0.12.3",
   "description": "RuleMetric local-mode runtime: bundled API server, web dashboard, and database migrations for fully local (zero cloud contact) deployments. Installed on demand by `rulemetric local up` — not meant to be used directly.",
   "type": "module",
   "exports": {
@@ -28,7 +28,7 @@
     "postgres": "^3.4.0",
     "resend": "^4.0.0",
     "zod": "^3.24.0",
-    "@rulemetric/skills-registry": "0.12.1"
+    "@rulemetric/skills-registry": "0.12.3"
   },
   "devDependencies": {
     "esbuild": "^0.25.0",