@tacuchi/agent-workflow-cli 25.7.0 → 25.8.0

package/dist/application/flow/submit.js

@@ -25,12 +25,12 @@ import { authorizeEffects, touchesTheWorld, } from "../../domain/capability/effe
 import { AttemptLedger } from "../../domain/capability/protocol.js";
 import { DEFAULT_CORE_DOCS_CANON, coreDocumentKindForPath } from "../../domain/docs-canon.js";
 import { claimedSeal, parseFlowAnswer, spendsAttempt, } from "../../domain/flow/answer.js";
-import { FIX_PREVIEW_TRANSITION, SETTLEMENT_READINGS, actionOf, alternativesOf, approvalGrantOf, effectsOf, internalActionOf, isRouteEvaluation, proposalContractOf, publishApprovalOf, routeControlOf, scopesSources, } from "../../domain/flow/authority.js";
+import { FIX_PREVIEW_TRANSITION, SETTLEMENT_READINGS, actionOf, alternativesOf, approvalGrantOf, effectsOf, internalActionOf, isRouteEvaluation, occurrenceAt, proposalContractOf, publishApprovalOf, reentryOf, routeControlOf, scopesSources, } from "../../domain/flow/authority.js";
 import { effectApprovalDigest } from "../../domain/flow/authorization.js";
 import { PAUSE_LABEL, STOP_LABEL, stepOf, } from "../../domain/flow/directive.js";
-import { executionVerdict } from "../../domain/flow/execution-result.js";
+import { batchCreditVerdict, executionVerdict, } from "../../domain/flow/execution-result.js";
 import { ROUTE_ACCEPT_LABEL, ROUTE_ADJUST_LABEL, isRouteDisposition, } from "../../domain/flow/route.js";
-import { applyTransition, checkAgainstJourney, currentBatchIteration, restatesLastEvent, settlementAmbiguous, withApproval, withAttempt, withBoundary, withContinuation, withDecisionPreparation, withEvent, withFixPreview, withHandoff, withObservation, withPlanExecBatchStageForTransition, withProposal, withRouteDecisions, withRouteProposal, withScope, withSelectedChoice, withSettlementDeclarations, } from "../../domain/flow/run-state.js";
+import { applyTransition, checkAgainstJourney, iterationOf, restartInvocation, restatesLastEvent, sameIteration, settlementAmbiguous, withApproval, withAttempt, withBoundary, withContinuation, withDecisionPreparation, withEvent, withFixPreview, withHandoff, withObservation, withPlanExecBatchCredit, withPlanExecBatchStageForTransition, withProposal, withReentry, withRouteDecisions, withRouteProposal, withScope, withSelectedChoice, withSettlementDeclarations, } from "../../domain/flow/run-state.js";
 import { withSpecBaseline } from "../../domain/lineage.js";
 import { destinationsOf, observedEffects, sealProposal } from "../../domain/proposal.js";
 import { baseDigest } from "../../domain/proposal.js";
@@ -46,11 +46,11 @@ import { semanticDigest } from "../semantic-operation/protocol.js";
 import { resolveSessionTarget } from "../session-resolver.js";
 import { sourceAliasesOfPlan, } from "../source-boundary-policy.js";
 import { actionDigest, advanceFlowRun, awaitingCliRerun, directiveFor, effectsOfTransition, resolveBoundary, } from "./advance.js";
-import { observeCheckout, withObservedCheckouts } from "./checkout-observation.js";
+import { observeCheckout, observeScopedFingerprints, withObservedCheckouts, } from "./checkout-observation.js";
 import { resolveCheckoutCandidates } from "./checkout-observation.js";
 import { driveInternalActions } from "./internal-drive.js";
 import { journeyForRun } from "./run-journey.js";
-import { applyUnderLock, locateRun } from "./run-state-service.js";
+import { applyUnderLock, locateRun, readRun } from "./run-state-service.js";
 export async function submitFlow(fs, paths, input) {
     const canon = await resolveCoreDocsCanon(fs, paths);
     if (!canon.ok) {
@@ -126,9 +126,30 @@ async function observe(fs, paths, raw, session, git) {
         scope: await observeScope(fs, paths, raw),
         plans: plans.evidence,
         checkouts: await observeCheckouts(fs, paths, session, git),
+        scoped: await observeBatchSources(fs, paths, session, git),
         baselines: plans.baselines,
     };
 }
+/**
+ * The scoped fingerprints a phase validation is judged against, read before the
+ * lock like every other observation. The run read here only decides WHETHER to
+ * measure: the decision under the lock re-reads it, and a run that moved in
+ * between answers a different seal and is refused as stale anyway.
+ */
+async function observeBatchSources(fs, paths, session, git) {
+    if (git === undefined)
+        return null;
+    // With a reader present, "not measured" is an empty map and never `null`: the
+    // judgment then finds every source unobservable and refuses, instead of
+    // skipping the one comparison the phase validation exists for.
+    const read = await readRun(fs, locateRun(paths, session));
+    if (!read.ok || read.state.boundary !== PHASE_VALIDATION || read.state.scope === null) {
+        return {};
+    }
+    const observed = await observeScopedFingerprints(fs, git, paths, session, read.state.scope.sources);
+    return observed.ok ? observed.base : {};
+}
+const PHASE_VALIDATION = "plan-exec.validation-execution";
 /**
  * Judge the plan bytes a proposal is carrying, and derive the seal each one gets.
  *
@@ -385,6 +406,16 @@ async function decide(fs, paths, state, input, snapshot) {
             action: "corré 'aw flow advance': el CLI corre una vez más la operación interna y, si reconoce su efecto, avanza sin cobrar",
         });
     }
+    // An internal action is credited only by the driver that ran it: that is what
+    // leaves its `executed` event in the trace. A result from outside, however well
+    // formed, is a claim nobody verified — and applying it used to publish nothing
+    // while marking the step done.
+    if (resolved.kind === "execution" && internalActionOf(resolved.stopped) !== null) {
+        return reject(state, resolved, `'${resolved.stopped.id}' la ejecuta el CLI: un resultado externo no la acredita`, {
+            code: "FLOW_INTERNAL_ACTION_EXTERNAL_RESULT",
+            action: `corré 'aw flow advance --session ${state.session}': el CLI corre la operación y la acredita; si la corrida no sale de esta frontera, '${restartInvocation(state.session)}' la destraba`,
+        }, cost);
+    }
     // The action the run is waiting on is the one that was EMITTED, and the seal
     // would already refuse a result about any other. What the persisted digest adds
     // is the diagnosis: when the two differ, the invocation changed underneath a run
@@ -394,7 +425,7 @@ async function decide(fs, paths, state, input, snapshot) {
     if (drifted !== null)
         return drifted;
     // 2 · The boundary in force decides what is admissible.
-    const admissible = admit(state, resolved, resolved.stopped, input, cost, snapshot.checkouts);
+    const admissible = admit(state, resolved, resolved.stopped, input, cost, snapshot.checkouts, snapshot.scoped);
     if ("decision" in admissible)
         return admissible.decision;
     const parsed = admissible;
@@ -408,7 +439,12 @@ async function decide(fs, paths, state, input, snapshot) {
     if (route.kind === "adjust") {
         return adjustRouteProposal(state, journey);
     }
-    const routed = route.kind === "accept" ? withRouteDecisions(state, route.decisions) : state;
+    const accepted = route.kind === "accept" ? withRouteDecisions(state, route.decisions) : state;
+    // Sealed with the transition it earned, in the same state publication: a batch
+    // is never seen validated without the proofs that validated it.
+    const routed = parsed.credit === undefined
+        ? accepted
+        : withPlanExecBatchCredit(accepted, parsed.credit.batch, parsed.credit.proofs);
     // The registry, not the Spanish consequence text, owns what a selected
     // alternative does. A handoff must stop before any later plan-exec row can
     // mark work, validate or commit; a decision selection is durably recorded
@@ -502,9 +538,12 @@ async function decide(fs, paths, state, input, snapshot) {
     if (preview.preview !== null) {
         selectedState = withFixPreview(selectedState, preview.preview);
     }
+    // A redraft recorded by `grantOf` inserted rows after this boundary, so the
+    // transition is applied against the journey as it now reads.
+    const walked = journeyForRun(selectedState);
     const outcome = holds
-        ? holdAfterApproval(selectedState, journey, identity)
-        : applyAndAdvance(selectedState, journey, resolved.stopped, identity, parsed.answer);
+        ? holdAfterApproval(selectedState, walked, identity)
+        : applyAndAdvance(selectedState, walked, resolved.stopped, identity, parsed.answer);
     return standalone === null ? outcome : withStandaloneGuidance(outcome, standalone);
 }
 /**
@@ -679,17 +718,28 @@ function routeAnswer(state, stopped, journey, answer) {
                 },
             };
         }
+        const { decision, control } = configuredControl;
+        const consequence = control.consequences[raw.disposition];
+        if (consequence === undefined) {
+            return {
+                kind: "failure",
+                failure: {
+                    code: "FLOW_ROUTE_HARD_GATE",
+                    message: `'${raw.transition}' no admite '${raw.disposition}': el registro no deja que una ruta la saltee`,
+                    action: "declará apply o substitute para ese control; la evidencia que acredita el paso no se omite",
+                },
+            };
+        }
         const substitution = routeSubstitution(raw.disposition, raw.substitution);
         if ("failure" in substitution)
             return { kind: "failure", failure: substitution.failure };
-        const { decision, control } = configuredControl;
         controls.push({
             transition: decision.id,
             title: decision.title,
             disposition: raw.disposition,
             recommendation: control.recommendation,
             alternatives: control.consequences,
-            consequence: control.consequences[raw.disposition],
+            consequence,
             risk: control.risk,
             reason: raw.reason.trim(),
             substitution: substitution.value,
@@ -1216,11 +1266,11 @@ async function registerSelectedDecision(fs, paths, state, snapshot, resolved, co
  * run that merely advanced would be indistinguishable from one that never decided.
  */
 function standaloneDecisionEvent(state, transition, record) {
-    const batchIteration = currentBatchIteration(state, transition);
+    const rowIteration = iterationOf(state, transition);
     return {
         kind: "executed",
         transition,
-        ...(batchIteration === null ? {} : { batch_iteration: batchIteration }),
+        ...rowIteration,
         operation: "plan-exec.standalone-decision",
         summary: record.decision,
         output_digest: record.digest,
@@ -1396,6 +1446,26 @@ function sealFrom(state, stopped, answer, snapshot, baselines) {
         })),
     };
 }
+/**
+ * The redraft a confirmation row's alternative asked for, or `null`.
+ *
+ * It unseats any standing proposal and records a reentry from the flow's
+ * authoring row, so the run walks the redraft and its gate again instead of
+ * carrying on to a publication with nothing to publish and a finalize that
+ * closes the session. Independent of whether a proposal is seated: a proposal
+ * the run gave up on is exactly when redrafting matters most.
+ */
+function redraftOf(state, stopped, answer, journey) {
+    const redraft = reentryOf(stopped);
+    if (redraft === null || answer.choice !== redraft.label)
+        return null;
+    return withReentry(withProposal(state, null), {
+        kind: "refine",
+        transition: stopped.id,
+        occurrence: occurrenceAt(journey, state.applied.length),
+        from: redraft.from,
+    });
+}
 /**
  * The grant this answer produced, scoped to what it was given over.
  *
@@ -1410,8 +1480,13 @@ function sealFrom(state, stopped, answer, snapshot, baselines) {
  */
 function grantOf(state, resolved, answer, granted, journey) {
     const stopped = resolved.stopped;
+    if (stopped === null)
+        return state;
+    const redrafted = redraftOf(state, stopped, answer, journey);
+    if (redrafted !== null)
+        return redrafted;
     const proposal = state.proposal;
-    const approve = stopped === null ? null : publishApprovalOf(stopped);
+    const approve = publishApprovalOf(stopped);
     if (approve !== null && proposal !== null) {
         if (answer.choice === approve) {
             return withApproval(state, {
@@ -1420,13 +1495,11 @@ function grantOf(state, resolved, answer, granted, journey) {
                 classes: [...proposal.requires_approval],
             });
         }
-        // Declining unseats the proposal, and that is what makes `Refinar` cost
-        // nothing: the publication downstream finds nothing to publish and is skipped
-        // saying so, instead of stopping to ask for an authorization over bytes the
+        // Declining unseats the proposal: no authorization is asked over bytes the
         // person just turned down.
         return withProposal(state, null);
     }
-    const link = stopped === null ? null : approvalGrantOf(stopped);
+    const link = approvalGrantOf(stopped);
     if (link !== null && answer.choice === link.approve) {
         const target = journey.find((row) => row.id === link.transition);
         // A link to a transition this journey does not walk grants nothing: the
@@ -1457,7 +1530,7 @@ function grantOf(state, resolved, answer, granted, journey) {
  * a payload the boundary's own contract rejects, a decline (a real answer that
  * applies nothing), and an execution result that did not earn its transition.
  */
-function admit(state, resolved, stopped, input, cost, checkouts) {
+function admit(state, resolved, stopped, input, cost, checkouts, scoped) {
     const expectedApproval = resolved.kind === "authorization"
         ? effectApprovalDigest(stopped.id, resolved.authorization?.planned ?? [])
         : null;
@@ -1520,22 +1593,53 @@ function admit(state, resolved, stopped, input, cost, checkouts) {
     // An execution result has to EARN the transition. Anything short of a completed
     // run with its evidence and its whole effect keeps the boundary standing: the
     // work stays pending, with the recovery the action declared.
-    if (resolved.kind === "execution") {
-        // The row's `effects` are the ceiling and the sealed proposal is what really
-        // happens: demanding an overwrite from a publication that only creates files
-        // would leave the transition pending for an effect nobody could produce.
-        const verdict = executionVerdict(parsed.answer.result, resolved.action, effectsOfTransition(state, stopped), checkouts);
-        if (verdict !== null) {
-            const trace = declaredTrace(state, stopped, resolved, parsed.answer, verdict);
-            return {
-                decision: reject(state, resolved, verdict.message, verdict.detail, {
-                    ...cost,
-                    ...(trace === null ? {} : { trace }),
-                }),
-            };
-        }
+    if (resolved.kind !== "execution")
+        return parsed;
+    return earned(state, resolved, stopped, parsed, cost, checkouts, scoped);
+}
+/** The execution verdict, then — at the phase validation — the batch's own credit. */
+function earned(state, resolved, stopped, parsed, cost, checkouts, scoped) {
+    // The row's `effects` are the ceiling and the sealed proposal is what really
+    // happens: demanding an overwrite from a publication that only creates files
+    // would leave the transition pending for an effect nobody could produce.
+    const verdict = executionVerdict(parsed.answer.result, resolved.action, effectsOfTransition(state, stopped), checkouts);
+    if (verdict !== null) {
+        const trace = declaredTrace(state, stopped, resolved, parsed.answer, verdict);
+        return {
+            decision: reject(state, resolved, verdict.message, verdict.detail, {
+                ...cost,
+                ...(trace === null ? {} : { trace }),
+            }),
+        };
+    }
+    const credited = batchCredit(state, stopped, parsed.answer, resolved, scoped);
+    if (credited === null)
+        return parsed;
+    if (!credited.ok) {
+        return {
+            decision: reject(state, resolved, credited.refusal.message, credited.refusal.detail, cost),
+        };
     }
-    return parsed;
+    return { ...parsed, credit: credited.credit };
+}
+/**
+ * The phase validation's own judgment: the batch it closes must bring a proof of
+ * each of its sources, of its own checkout. `null` on every other boundary, and
+ * on a run with no batch standing, where there is nothing to credit.
+ */
+function batchCredit(state, stopped, answer, resolved, scoped) {
+    if (stopped.id !== PHASE_VALIDATION || answer.result === null || state.scope === null) {
+        return null;
+    }
+    const iteration = state.batch_loop?.iteration ?? null;
+    const batches = state.batches ?? [];
+    const batch = batches.find((entry) => entry.iteration === iteration);
+    if (batch === undefined)
+        return null;
+    const verdict = batchCreditVerdict(answer.result, { batch, batches, sources: state.scope.sources, scoped }, resolved.action?.recovery ?? "");
+    if (!verdict.ok)
+        return verdict;
+    return { ok: true, credit: { batch: batch.id, proofs: verdict.credit } };
 }
 /**
  * The material fact a REFUSED external result still leaves behind — or `null`.
@@ -1557,11 +1661,11 @@ function declaredTrace(state, stopped, resolved, answer, verdict) {
     if (!touchesTheWorld(applied) && verdict.detail.code !== "FLOW_EFFECT_PARTIAL")
         return null;
     const invocation = resolved.action?.invocation;
-    const batchIteration = currentBatchIteration(state, stopped.id);
+    const rowIteration = iterationOf(state, stopped.id);
     return {
         kind: "failed",
         transition: stopped.id,
-        ...(batchIteration === null ? {} : { batch_iteration: batchIteration }),
+        ...rowIteration,
         // What was really run, named the way whoever ran it would recognize it: an
         // external execution has no internal operation id to quote.
         operation: invocation === undefined ? stopped.id : [invocation.program, ...invocation.args].join(" "),
@@ -1618,13 +1722,6 @@ function applyAndAdvance(approved, journey, stopped, identity, answer) {
         ? withObservation(approved, observationFor(approved, stopped.id, answer.signals))
         : approved;
     next = withPlanExecBatchStageForTransition(applyTransition(next, stopped.id, effectsOfTransition(next, stopped)), stopped.id);
-    // A published proposal is spent, whoever published it. This is the degraded
-    // path — no internal executor, so the caller ran the write and returned its
-    // result — and leaving the proposal seated would keep a preview of bytes that
-    // are already on disk standing in front of the next boundary.
-    if (internalActionOf(stopped)?.operation === "proposal.publish") {
-        next = withProposal(next, null);
-    }
     next = withAttempt(next, identity);
     // The boundary follows the position, always: handing the engine a state whose
     // boundary still names the transition just applied is exactly the incoherence
@@ -1779,7 +1876,7 @@ function resendCheck(state, resolved, cost) {
     // The twin was refused: this is a retry of the same wrong answer, so it gets
     // the same real diagnosis again and counts toward the cap, which is what
     // eventually degrades the boundary instead of leaving the caller looping.
-    if (twin !== undefined && !state.applied.includes(twin.transition))
+    if (twin !== undefined && twinWasRefused(state, twin))
         return null;
     return reject(state, resolved, "esta respuesta ya se había aplicado: el recorrido no avanza dos veces", {
         code: "FLOW_ANSWER_RESENT",
@@ -1787,6 +1884,19 @@ function resendCheck(state, resolved, cost) {
         outcome: "completed",
     }, cost);
 }
+/**
+ * Whether the attempt a resend matches never advanced anything.
+ *
+ * Its transition missing from `applied` says so. So does its transition being
+ * the boundary still standing at the same iteration: a repeated row (a batch or
+ * a redraft copy) has its id in `applied` from an earlier walk, and that earlier
+ * walk is not this one.
+ */
+function twinWasRefused(state, twin) {
+    if (!state.applied.includes(twin.transition))
+        return true;
+    return (twin.transition === state.boundary && sameIteration(twin, iterationOf(state, twin.transition)));
+}
 /**
  * A rejection, expressed as the recalculated directive.
  *
@@ -1848,7 +1958,7 @@ function reject(state, resolved, message, detail, cost) {
  */
 function attemptIdentity(state, input, seal, transition) {
     const digest = semanticDigest({ payload: input.raw, approval: input.approval });
-    const batchIteration = currentBatchIteration(state, transition);
+    const rowIteration = iterationOf(state, transition);
     const prior = state.attempts.filter((past) => past.invocation_id === seal);
     const twin = prior.find((past) => past.request_digest === digest);
     // The next ordinal, asked with the SAME expression `AttemptLedger.record`
@@ -1872,18 +1982,18 @@ function attemptIdentity(state, input, seal, transition) {
         // The seal moves with the state; the transition does not while the run
         // stands there. It is what the cap counts over.
         transition,
-        ...(batchIteration === null ? {} : { batch_iteration: batchIteration }),
+        ...rowIteration,
     };
 }
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function observationFor(state, transition, signals) {
-    const batchIteration = currentBatchIteration(state, transition);
+    const rowIteration = iterationOf(state, transition);
     return {
         transition,
         signals,
-        ...(batchIteration === null ? {} : { batch_iteration: batchIteration }),
+        ...rowIteration,
     };
 }
 //# sourceMappingURL=submit.js.map