@smartmemory/compose 0.3.6-beta → 0.3.8

package/lib/smartmemory-config.js

@@ -48,3 +48,57 @@ export function resolveProjectTag(cwd) {
 export function sourcePathFor(projectTag, repoRel) {
   return `compose/${projectTag}/${repoRel}`;
 }
+
+/**
+ * GOV-COMPOSE-SEAM-1 step 0 (`plumbing`).
+ *
+ * Translate the `smartmemory` config block into the three env vars Stratum's
+ * policy client reads, so Compose's ingest events and Stratum's enforcement
+ * events land in ONE workspace instead of two (or, today, one and nowhere).
+ *
+ * Two traps this function exists to close:
+ *
+ * 1. `workspaceId` is two different things. Top-level `compose.json#workspaceId`
+ *    is a Compose PROJECT SLUG (`^[a-z][a-z0-9-]{1,63}$`, see
+ *    discover-workspaces.js) used for provenance tagging. The SmartMemory
+ *    workspace id lives at `smartmemory.workspaceId` and looks like
+ *    `team_26f0bbe60a4c`. Sending the slug as `X-Workspace-Id` scopes every
+ *    event to a workspace that does not exist, and the API answers 200, so the
+ *    failure is silent. This reads the block, never the top level.
+ * 2. Stratum's `SmartMemoryClient` reads `process.env` ONCE at construction
+ *    (policy/smartmemory_client.ts). Setting these after the MCP subprocess
+ *    starts is a no-op — they must be in the spawn env, which is why this
+ *    returns a plain object for `connect()` to merge rather than mutating
+ *    `process.env`.
+ *
+ * Fail-quiet by design, matching the existing fail-open ingest contract: an
+ * unconfigured, disabled, or half-configured workspace returns `{}` and Stratum
+ * simply runs without policy delivery (it warns once on its own). A partial env
+ * would be worse than none — it produces events addressed to nowhere.
+ *
+ * @param {string} cwd
+ * @returns {{SMARTMEMORY_API_URL?: string, SMARTMEMORY_API_KEY?: string, SMARTMEMORY_WORKSPACE_ID?: string}}
+ */
+export function resolveStratumPolicyEnv(cwd) {
+  let cfg;
+  try {
+    cfg = getSmartmemoryConfig(cwd);
+  } catch {
+    return {};
+  }
+  if (cfg.enabled !== true) return {};
+
+  const baseUrl = typeof cfg.baseUrl === 'string' ? cfg.baseUrl.trim() : '';
+  // NEVER cfg.workspaceId's top-level namesake — see trap 1 above.
+  const workspaceId = typeof cfg.workspaceId === 'string' ? cfg.workspaceId.trim() : '';
+  const apiKey = cfg.apiKeyEnv ? process.env[cfg.apiKeyEnv] : undefined;
+
+  // All three or nothing.
+  if (!baseUrl || !workspaceId || !apiKey) return {};
+
+  return {
+    SMARTMEMORY_API_URL: baseUrl,
+    SMARTMEMORY_API_KEY: apiKey,
+    SMARTMEMORY_WORKSPACE_ID: workspaceId,
+  };
+}

package/lib/smartmemory-ingest.js

@@ -26,9 +26,23 @@ export function renderFeatureEventContent(row, projectTag) {
   return `[compose:${projectTag}] ${row.ts} ${row.tool} ${row.code ?? row.feature_code ?? '-'} by ${row.actor ?? 'mcp:agent'}`;
 }
 
-/** PURE. One deterministic line per gate-log entry. Shared with sync. */
+/** PURE. One deterministic line per gate-log entry. Shared with sync.
+ *
+ * GOV-COMPOSE-SEAM-1 step 0 (F2): this is a **Vision UI product gate** — a
+ * human approving a feature in the Compose UI, keyed by the UI gate id and a
+ * feature code. It is NOT Stratum's `gate_resolution`, which is a flow-step
+ * gate keyed by `run_id`/`step_id` and emitted by the engine when a run carries
+ * a policy bundle. The design assumed these were two records of one event and
+ * called for deduping them by `run_id`; they are two events, and no Stratum
+ * run id exists at this call site (see gate-log-store.js). Deduping them would
+ * have destroyed a real record.
+ *
+ * So they are disambiguated instead of merged: this line is tagged
+ * `vision-gate` rather than the bare `gate`, so a workspace query can separate
+ * product approvals from enforcement gates without guessing from shape.
+ */
 export function renderGateLogContent(entry, projectTag) {
-  return `[compose:${projectTag}] ${entry.timestamp} gate:${entry.decision} ${entry.feature_code ?? '-'} ${entry.id}`;
+  return `[compose:${projectTag}] ${entry.timestamp} vision-gate:${entry.decision} ${entry.feature_code ?? '-'} ${entry.id}`;
 }
 
 /** PURE. context for an event item (cli:compose regime — content-hash dedupe). */
@@ -45,6 +59,9 @@ export function buildGateLogContext(projectTag, entry) {
   return {
     origin: 'cli:compose',
     project: projectTag,
+    // Explicit record kind so a Compose product-gate approval is never mistaken
+    // for a Stratum enforcement `gate_resolution`. See renderGateLogContent.
+    record_kind: 'compose_vision_gate',
     source_path: sourcePathFor(projectTag, '.compose/data/gate-log.jsonl'),
     event: entry,
   };

package/lib/step-prompt.js

@@ -4,7 +4,7 @@
 
 import { readdirSync, readFileSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
-import { checkStaleness } from './staleness.js';
+import { findStaleArtifacts } from './lineage.js';
 import { readHypotheses, formatRejectedHypotheses } from './bug-ledger.js';
 
 // ---------------------------------------------------------------------------
@@ -242,13 +242,14 @@ export function buildGateContext(gateDispatch, context, gateExtras) {
     sections.push(`## Files Changed by This Feature\n${context.filesChanged.map(f => '- ' + f).join('\n')}`);
   }
 
-  // Staleness warnings — flag artifacts that belong to an earlier phase
-  if (context.featureDir && gateExtras?.toPhase) {
-    const staleArtifacts = checkStaleness(context.featureDir, gateExtras.toPhase);
-    const stale = staleArtifacts.filter(a => a.stale);
+  // Staleness warnings — derivation-based (COMP-PROV-LINEAGE): flag artifacts
+  // whose upstream (wasDerivedFrom) changed more recently than they did. Phase-
+  // independent, so it does not need gateExtras.toPhase.
+  if (context.featureDir) {
+    const stale = findStaleArtifacts(context.featureDir).filter(a => a.stale);
     if (stale.length > 0) {
       const lines = stale.map(a =>
-        `- **${a.file}** was written in phase \`${a.writtenPhase}\` but feature is now in \`${a.currentPhase}\``
+        `- **${a.file}** may be outdated — an upstream it was derived from (${a.staleAgainst.join(', ')}) changed more recently`
       );
       sections.push(`## Stale Artifacts\nThe following artifacts may be outdated:\n${lines.join('\n')}`);
     }

package/lib/stratum-engine.js

@@ -137,6 +137,46 @@ const BIN_CONFIG = {
   },
 };
 
+// Sibling checkout's package.json — used only to tell the user when the
+// installed dependency is shadowing a checkout at a different version.
+export const LIVE_STRATUM_TS_PACKAGE_JSON = resolve(
+  __dirname, '..', '..', 'stratum', 'ts', 'package.json',
+);
+
+function readPackageVersion(packageJsonPath) {
+  try {
+    const version = JSON.parse(readFileSync(packageJsonPath, 'utf8'))?.version;
+    return typeof version === 'string' ? version : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+// One warning per (kind, paths, versions) per process: the resolver runs on every connect.
+const shadowWarned = new Set();
+
+/**
+ * The installed dependency wins over the sibling checkout by design (CI has no
+ * sibling). In the monorepo that silently runs a STALE stratum after a local
+ * rebuild — found 2026-08-30 when the STRAT-LEARN-COST census ran against
+ * 0.3.3 (no `stratum_usage_report`) while `stratum/ts` was at 0.3.4. Say so
+ * once, with the escape hatch, whenever the two versions differ.
+ */
+function warnIfSiblingShadowed(kind, envVar, installedPackageJsonPath, siblingPackageJsonPath, warn) {
+  if (!siblingPackageJsonPath || !existsSync(siblingPackageJsonPath)) return;
+  const installedVersion = readPackageVersion(installedPackageJsonPath);
+  const siblingVersion = readPackageVersion(siblingPackageJsonPath);
+  if (!installedVersion || !siblingVersion || installedVersion === siblingVersion) return;
+  const key = `${kind}|${installedPackageJsonPath}|${siblingPackageJsonPath}|${installedVersion}|${siblingVersion}`;
+  if (shadowWarned.has(key)) return;
+  shadowWarned.add(key);
+  warn(
+    `[stratum-engine] using installed @smartmemory/stratum ${installedVersion}; `
+      + `the sibling checkout at ${dirname(siblingPackageJsonPath)} is ${siblingVersion} and is NOT what compose runs. `
+      + `Set ${envVar} to run a rebuilt checkout (${kind === 'mcp' ? 'dist/mcp/main.js' : 'dist/cli/stratum.js'}).`,
+  );
+}
+
 /** Resolve a bin from an installed @smartmemory/stratum package, if present. */
 function resolveInstalledBin(packageBin, requireResolve) {
   let packageJsonPath;
@@ -156,7 +196,7 @@ function resolveInstalledBin(packageBin, requireResolve) {
       ? packageJson.bin?.[packageBin]
       : undefined;
     if (typeof relativeBin !== 'string') return undefined;
-    return resolve(dirname(packageJsonPath), relativeBin);
+    return { bin: resolve(dirname(packageJsonPath), relativeBin), packageJsonPath };
   } catch {
     return undefined;
   }
@@ -168,7 +208,7 @@ function resolveInstalledBin(packageBin, requireResolve) {
  *
  * @param {'mcp'|'cli'} kind
  * @param {string} [cwd]
- * @param {{env?: object, requireResolve?: Function, siblingBins?: object}} [deps]
+ * @param {{env?: object, requireResolve?: Function, siblingBins?: object, siblingPackageJson?: string, warn?: Function}} [deps]
  */
 export function resolveStratumBin(kind, cwd = process.cwd(), deps = {}) {
   const config = BIN_CONFIG[kind];
@@ -180,11 +220,20 @@ export function resolveStratumBin(kind, cwd = process.cwd(), deps = {}) {
     || (kind === 'cli' ? env.COMPOSE_STRATUM_TS_BIN : undefined);
   if (envCandidate && existsSync(envCandidate)) return envCandidate;
 
-  const installedCandidate = resolveInstalledBin(
+  const installed = resolveInstalledBin(
     config.packageBin,
     deps.requireResolve ?? require.resolve.bind(require),
   );
-  if (installedCandidate && existsSync(installedCandidate)) return installedCandidate;
+  if (installed && existsSync(installed.bin)) {
+    warnIfSiblingShadowed(
+      kind,
+      config.env,
+      installed.packageJsonPath,
+      deps.siblingPackageJson ?? LIVE_STRATUM_TS_PACKAGE_JSON,
+      deps.warn ?? ((message) => console.warn(message)),
+    );
+    return installed.bin;
+  }
 
   const siblingCandidate = deps.siblingBins?.[kind] ?? config.sibling;
   if (siblingCandidate && existsSync(siblingCandidate)) return siblingCandidate;