@tequila99/githuman 0.12.0 → 0.13.1

package/README.md

@@ -197,6 +197,18 @@ node dist/cli/index.js list --db-prefix ""         # .githuman/reviews.db (ор
 `--api-docs` (`pnpm run dev:server` включает его сам). Агентские маршруты
 попадают в спецификацию, только когда сервер их отдаёт (loopback-хост).
 
+### Отладка валидации артефактов
+
+`githuman serve --debug-validation` не закрывает сессию валидатора после
+завершения проверки и пишет в консоль сервера строки `[validation <id>]`:
+статусы сессии, вызовы инструментов, решения политики прав (ALLOW/DENY с
+причиной), причину завершения. Текст вывода инструментов обрезается до 500
+символов. Флаг нужен для отладки: в обычном режиме сессия закрывается, а
+причина остановки валидатора нигде не сохраняется. Оставленная открытой
+сессия не занимает место в лимите чатов: новый чат закрывает самую старую
+завершённую сессию валидатора. Ключ артефактной сессии такого валидатора
+отзывается сразу при завершении проверки.
+
 ## Разработка
 
 Два процесса нужны одновременно — backend (Fastify, автоперезапуск при

package/dist/cli/config.js

@@ -88,6 +88,7 @@ export function parseServeArgs(argv) {
             'notes-dir': { type: 'string' },
             'db-prefix': { type: 'string' },
             'api-docs': { type: 'boolean', default: false },
+            'debug-validation': { type: 'boolean', default: false },
             'allowed-host': { type: 'string', multiple: true }
         },
         strict: false
@@ -101,6 +102,7 @@ export function parseServeArgs(argv) {
         throw new Error(`Invalid --db-prefix value "${dbPrefix}": use at most 100 characters and none of < > : " / \\ | ? * or control characters. Set it with --db-prefix or GITHUMAN_DB_PREFIX.`);
     }
     const apiDocs = values['api-docs'] === true;
+    const debugValidation = values['debug-validation'] === true;
     const allowedHosts = resolveAllowedHosts(Array.isArray(values['allowed-host']) ? values['allowed-host'] : []);
     return {
         port,
@@ -108,6 +110,7 @@ export function parseServeArgs(argv) {
         open,
         dbPrefix,
         apiDocs,
+        debugValidation,
         allowedHosts,
         ...(typeof values['notes-dir'] === 'string'
             ? { notesDir: values['notes-dir'] }

package/dist/cli/server-runtime.js

@@ -69,6 +69,10 @@ export async function startServer(options) {
         artifactPrefix: resolveDbPrefix(options.dbPrefix),
         watchFiles: true,
         apiDocs: options.apiDocs === true,
+        // The server logs are off; validation debug lines go to the console.
+        ...(options.debugValidation === true
+            ? { onValidationDebug: (line) => console.log(line) }
+            : {}),
         allowedHosts: options.allowedHosts ?? [],
         onPairingRequest: device => console.log(`Pairing request from ${device.name} (${device.address}). Enter the code from the device in a localhost tab.`),
         terminalEnabled: true,

package/dist/server/app.js

@@ -163,6 +163,9 @@ export function buildApp(options = {}) {
     });
     artifacts.lifecycle.transitions.setActorGuard(actor => actor.id === 'local' || devices.isTrusted(actor.id));
     artifacts.lifecycle.transitions.setErrorHandler(error => app.log.error({ err: error }, 'Artifact transition work failed'));
+    if (options.onValidationDebug) {
+        artifacts.lifecycle.jobs.setDebug(options.onValidationDebug);
+    }
     app.register(artifactTransitionRoutes, {
         service: artifacts.lifecycle.transitions,
         recheckAccess: createAccessHook({ devices, allowedHosts })

package/dist/server/db/artifact-validation-migrations.js

@@ -51,6 +51,11 @@ export function applyArtifactValidationMigrations(db) {
       operation_id TEXT NOT NULL, payload_json TEXT NOT NULL,
       UNIQUE(store_id,operation_id)
     );
+    CREATE TABLE IF NOT EXISTS artifact_validation_reports (
+      store_id TEXT NOT NULL, validation_id TEXT NOT NULL, sha256 TEXT NOT NULL,
+      bytes INTEGER NOT NULL, body TEXT NOT NULL, created_at INTEGER NOT NULL,
+      PRIMARY KEY(store_id,validation_id)
+    );
     CREATE TABLE IF NOT EXISTS artifact_lifecycle_commits (
       seq INTEGER PRIMARY KEY AUTOINCREMENT, store_id TEXT NOT NULL,
       request_id TEXT NOT NULL, payload_hash TEXT NOT NULL, result_json TEXT NOT NULL,
@@ -65,6 +70,7 @@ export function applyArtifactValidationMigrations(db) {
         artifact_transition_events: 'seq=NEW.seq',
         artifact_transition_requests: 'seq=NEW.seq OR (store_id=NEW.store_id AND request_id=NEW.request_id)',
         artifact_transition_consents: 'seq=NEW.seq OR (store_id=NEW.store_id AND operation_id=NEW.operation_id)',
+        artifact_validation_reports: 'store_id=NEW.store_id AND validation_id=NEW.validation_id',
         artifact_lifecycle_commits: 'seq=NEW.seq OR (store_id=NEW.store_id AND request_id=NEW.request_id)'
     });
 }

package/dist/server/errors/artifacts.js

@@ -5,6 +5,7 @@ const BUSY = Symbol('artifact.busy');
 const LEASE_BUSY = Symbol('artifact.leaseBusy');
 export const ArtifactInputError = createError('GHT_ARTIFACT_INVALID_INPUT', '%s', 400);
 export const ArtifactNotFoundError = createError('GHT_ARTIFACT_NOT_FOUND', 'Artifact not found.', 404);
+export const ArtifactReportTextNotFoundError = createError('GHT_ARTIFACT_REPORT_TEXT_NOT_FOUND', 'The validation has no report text.', 404);
 export const ArtifactConflictError = createError('GHT_ARTIFACT_CONFLICT', '%s', 409);
 function marked(message, marker) {
     return Object.assign(new ArtifactConflictError(message), { [marker]: true });

package/dist/server/hooks/access/local-request.js

@@ -1,5 +1,10 @@
 import { isLoopbackHost } from "../../../shared/network/loopback.js";
 import { forwardedAddresses, isLoopbackAddress, parseHost, sameOrigin } from "../../utils/request-origin.js";
+/** True when the `Host` header names this machine (`localhost`, `127.0.0.1`, `[::1]`). */
+export function isLoopbackHostHeader(host) {
+    const target = parseHost(host);
+    return target !== undefined && isLoopbackHost(target.hostname);
+}
 /**
  * True when the request comes from a page or a client on this machine
  * (ADR 0079). The `Host` header alone is not proof: with a bind on

package/dist/server/hooks/access/require-access.js

@@ -2,7 +2,7 @@ import { ARTIFACT_BRIDGE_ROUTE } from "../../../shared/artifacts/mcp-constants.j
 import { DEVICE_IDLE_TTL_MS } from "../../../shared/devices/constants.js";
 import { ForbiddenError, UnauthorizedError } from "../../errors/http.js";
 import { clientAddress, sameOrigin } from "../../utils/request-origin.js";
-import { isLocalRequest } from "./local-request.js";
+import { isLocalRequest, isLoopbackHostHeader } from "./local-request.js";
 // Methods that do not change state; CSRF checks the others.
 const SAFE_METHODS = new Set(['GET', 'HEAD', 'OPTIONS']);
 // API routes that a browser without access needs to request pairing.
@@ -50,7 +50,10 @@ export function createAccessHook(options) {
         const { host, origin } = request.headers;
         const local = isLocalRequest(request);
         if (!local && !allowedHosts.allows(host)) {
-            throw new ForbiddenError(`Unknown Host "${host ?? '-'}". Open the app by the IP address of this machine, or start the server with --allowed-host.`);
+            // A loopback Host that fails here has a non-local Origin, proxy address or peer.
+            throw new ForbiddenError(isLoopbackHostHeader(host)
+                ? `The request to Host "${host}" is not local: its Origin, X-Forwarded-For or peer address is not on this machine.`
+                : `Unknown Host "${host ?? '-'}". Open the app by the IP address of this machine, or start the server with --allowed-host.`);
         }
         if (origin !== undefined &&
             !SAFE_METHODS.has(request.method) &&

package/dist/server/repositories/artifact-validation.repo.js

@@ -52,6 +52,23 @@ export class ArtifactValidationRepository {
             .prepare('INSERT INTO artifact_validation_current VALUES(?,?,?) ON CONFLICT(store_id,id) DO UPDATE SET payload_json=excluded.payload_json')
             .run(this.storeId, value.id, payload);
     }
+    reportText(id) {
+        const row = this.db
+            .prepare('SELECT body FROM artifact_validation_reports WHERE store_id=? AND validation_id=?')
+            .get(this.storeId, id);
+        return row?.body;
+    }
+    /** Stores the text once; the same text again is a no-op. Returns false for different text. */
+    appendReportText(id, body, summary, now) {
+        const previous = this.reportText(id);
+        if (previous !== undefined) {
+            return previous === body;
+        }
+        this.db
+            .prepare('INSERT INTO artifact_validation_reports(store_id,validation_id,sha256,bytes,body,created_at) VALUES(?,?,?,?,?,?)')
+            .run(this.storeId, id, summary.sha256, summary.bytes, body, now);
+        return true;
+    }
     history(id, afterSeq = 0, limit = 50) {
         return this.db
             .prepare('SELECT seq,payload_json FROM artifact_validation_events WHERE store_id=? AND id=? AND seq>? ORDER BY seq LIMIT ?')
@@ -118,6 +135,17 @@ export class ArtifactValidationRepository {
             .prepare('INSERT INTO artifact_authorization_events(store_id,id,kind,payload_json) VALUES(?,?,?,?)')
             .run(this.storeId, id, kind, JSON.stringify(data));
     }
+    /** What the revoke of a pending action left behind: who asked and when it would expire. */
+    revoked(id) {
+        const row = this.db
+            .prepare("SELECT payload_json FROM artifact_authorization_events WHERE store_id=? AND id=? AND kind='revoked' ORDER BY seq DESC LIMIT 1")
+            .get(this.storeId, id);
+        if (!row) {
+            return null;
+        }
+        const value = JSON.parse(row.payload_json);
+        return typeof value === 'object' && value !== null ? value : {};
+    }
     consumed(id) {
         return Boolean(this.db
             .prepare("SELECT 1 FROM artifact_authorization_events WHERE store_id=? AND id=? AND kind='consumed'")

package/dist/server/routes/artifact-actions.js

@@ -75,6 +75,15 @@ export async function artifactActionRoutes(app, options) {
             response: { 200: ArtifactReportChunkSchema, ...ERROR_RESPONSES }
         }
     }, request => service.jobs.report(request.params.id, request.query.offset));
+    app.get('/api/artifact-validations/:id/report-text', {
+        schema: {
+            tags: ['artifacts'],
+            summary: 'Read the Markdown report text of a validation in chunks',
+            params: ArtifactParams,
+            querystring: ArtifactValidationReportQuery,
+            response: { 200: ArtifactReportChunkSchema, ...ERROR_RESPONSES }
+        }
+    }, request => service.jobs.reportText(request.params.id, request.query.offset));
     app.get('/api/artifact-validations/:id/history', {
         schema: {
             tags: ['artifacts'],
@@ -92,7 +101,7 @@ export async function artifactActionRoutes(app, options) {
         }
     }, () => ({
         storeId: service.storage.storeId,
-        items: service.authorization.list()
+        items: service.listActions()
     }));
     app.get('/api/artifact-actions/:id', {
         schema: {

package/dist/server/routes/artifact-agent.js

@@ -19,6 +19,10 @@ export async function artifactAgentRoutes(app, { storage, registry }) {
             'artifacts.search',
             checked(ArtifactToolSchemas['artifacts.search'], p => storage.search.search(p))
         ],
+        [
+            'change_sets.preview',
+            checked(ArtifactToolSchemas['change_sets.preview'], p => storage.graph.previewChangeSet(p))
+        ],
         [
             'change_sets.propose',
             checked(ArtifactToolSchemas['change_sets.propose'], (p, a) => storage.lifecycle.propose(p, a))
@@ -41,7 +45,19 @@ export async function artifactAgentRoutes(app, { storage, registry }) {
         ],
         [
             'validations.report',
-            checked(ArtifactToolSchemas['validations.report'], p => storage.lifecycle.jobs.report(p.id, p.offset))
+            checked(ArtifactToolSchemas['validations.report'], (p, a) => {
+                const result = storage.lifecycle.jobs.report(p.id, p.offset);
+                storage.lifecycle.jobs.observe(p.id, a.id);
+                return result;
+            })
+        ],
+        [
+            'validations.report_text',
+            checked(ArtifactToolSchemas['validations.report_text'], (p, a) => {
+                const result = storage.lifecycle.jobs.reportText(p.id, p.offset);
+                storage.lifecycle.jobs.observe(p.id, a.id);
+                return result;
+            })
         ],
         [
             'validations.history',
@@ -49,7 +65,11 @@ export async function artifactAgentRoutes(app, { storage, registry }) {
         ],
         [
             'validations.get',
-            checked(ArtifactToolSchemas['validations.get'], p => storage.lifecycle.jobs.get(p.id))
+            checked(ArtifactToolSchemas['validations.get'], (p, a) => {
+                const result = storage.lifecycle.jobs.get(p.id);
+                storage.lifecycle.jobs.observe(p.id, a.id);
+                return result;
+            })
         ],
         [
             'validations.manifest',
@@ -59,6 +79,10 @@ export async function artifactAgentRoutes(app, { storage, registry }) {
             'validations.read',
             checked(ArtifactToolSchemas['validations.read'], (p, a) => storage.lifecycle.jobs.read(p.id, a.id, p.key, p.offset))
         ],
+        [
+            'validations.read_next',
+            checked(ArtifactToolSchemas['validations.read_next'], (p, a) => storage.lifecycle.jobs.readNext(p.id, a.id))
+        ],
         [
             'validations.submit',
             checked(ArtifactToolSchemas['validations.submit'], ({ id, ...p }, a) => storage.lifecycle.jobs.submit(id, a.id, p))

package/dist/server/services/agent/session-registry.js

@@ -11,6 +11,8 @@ import { describePreset } from "../../config/agents.js";
 export function createSessionRegistry(options) {
     const sessions = new Map();
     const unsubscribeSession = new Map();
+    // Finished sessions kept open for inspection; a new session may replace them.
+    const retired = new Set();
     const listeners = new Set();
     const keys = new Map();
     const sessionKeys = new Map();
@@ -70,6 +72,17 @@ export function createSessionRegistry(options) {
         unsubscribeSession.get(id)?.();
         unsubscribeSession.delete(id);
         sessions.delete(id);
+        retired.delete(id);
+    }
+    function closeSession(id) {
+        const session = sessions.get(id);
+        if (!session) {
+            return false;
+        }
+        session.close();
+        drop(id);
+        broadcast({ type: 'sessions' });
+        return true;
     }
     function closeAll() {
         for (const session of sessions.values()) {
@@ -118,6 +131,13 @@ export function createSessionRegistry(options) {
             if (!preset) {
                 throw new UnknownAgentPresetError(`Unknown agent "${presetId}"`);
             }
+            if (sessions.size >= MAX_AGENT_SESSIONS) {
+                // A Set keeps insertion order, so the first retired session is the oldest.
+                const [oldest] = retired;
+                if (oldest !== undefined) {
+                    closeSession(oldest);
+                }
+            }
             if (sessions.size >= MAX_AGENT_SESSIONS) {
                 throw new TooManyAgentSessionsError(`At most ${MAX_AGENT_SESSIONS} chats can be open at once`);
             }
@@ -163,16 +183,18 @@ export function createSessionRegistry(options) {
             return session;
         },
         get: id => sessions.get(id),
-        list: () => [...sessions.values()].map(session => session.info()),
-        close(id) {
-            const session = sessions.get(id);
-            if (!session) {
-                return false;
+        list: () => [...sessions.values()].map(session => ({
+            ...session.info(),
+            ...(retired.has(session.id) ? { retired: true } : {})
+        })),
+        close: closeSession,
+        retire(id) {
+            if (sessions.has(id)) {
+                retired.add(id);
+                // A retired validator stays open for inspection, but its key must stop working.
+                revoke(id);
+                broadcast({ type: 'sessions' });
             }
-            session.close();
-            drop(id);
-            broadcast({ type: 'sessions' });
-            return true;
         },
         closeAll,
         subscribe(listener, afterId = 0) {

package/dist/server/services/artifact-authorization.service.js

@@ -142,6 +142,26 @@ export class ArtifactAuthorizationService {
         };
     }
     status(id, sessionId) {
+        const known = this.pending.get(id) ??
+            [...this.grants.values()].find(value => value.pendingActionId === id);
+        // The requester learns how its request ended, not only that it is gone.
+        if (known?.sessionId === sessionId && known.expiresAt <= this.now()) {
+            return {
+                id,
+                state: 'expired',
+                authorizationId: null,
+                expiresAt: known.expiresAt
+            };
+        }
+        const revoked = known ? null : this.repository.revoked(id);
+        if (revoked?.sessionId === sessionId) {
+            return {
+                id,
+                state: 'revoked',
+                authorizationId: null,
+                expiresAt: revoked.expiresAt ?? this.now()
+            };
+        }
         const value = this.describe(id);
         if (value.pending.sessionId !== sessionId)
             throw new ArtifactNotFoundError();
@@ -163,9 +183,14 @@ export class ArtifactAuthorizationService {
                 at: this.now()
             });
         }
+        const target = this.pending.get(id) ?? grant;
         this.grants.delete(id);
         this.pending.delete(id);
-        this.repository.authorizationEvent(id, 'revoked', { at: this.now() });
+        this.repository.authorizationEvent(id, 'revoked', {
+            at: this.now(),
+            sessionId: target?.sessionId,
+            expiresAt: target?.expiresAt
+        });
         this.changed();
     }
 }

package/dist/server/services/artifact-graph-validation.js

@@ -1,6 +1,10 @@
 import { canonicalJson } from "../../shared/utils/canonical-json.js";
 import { sha256Hex } from "../utils/hash.js";
 import { allowedTransition } from "../../shared/artifact-transitions/transitions.js";
+// A large store can give hundreds of issues. The full list is in the change set preview.
+const MAX_REPORTED_GRAPH_ISSUES = 20;
+// Limit for artifact IDs in one issue line; the rest show as a count.
+const MAX_REPORTED_ISSUE_ARTIFACTS = 20;
 // Status that a lifecycle command gives to each of its subjects.
 const COMMAND_STATUS = {
     return_to_draft: 'draft',
@@ -10,6 +14,37 @@ const COMMAND_STATUS = {
     delete: 'deleted',
     restore: 'draft'
 };
+/**
+ * Builds one error text that names the artifacts of each issue.
+ * Without the IDs and current versions, a caller cannot correct the change set.
+ * Issues with the same code and text merge into one line.
+ */
+export function graphIssuesMessage(issues, versions = []) {
+    const current = new Map(versions.map(item => [item.id, item.version]));
+    const groups = new Map();
+    for (const issue of issues) {
+        const key = `${issue.code}\0${issue.message}`;
+        const group = groups.get(key) ?? { issue, ids: new Set() };
+        for (const id of issue.artifactIds)
+            group.ids.add(id);
+        groups.set(key, group);
+    }
+    const lines = [...groups.values()].map(({ issue, ids }) => {
+        const all = [...ids].map(id => current.has(id) ? `${id}@v${current.get(id)}` : id);
+        const shown = all.slice(0, MAX_REPORTED_ISSUE_ARTIFACTS);
+        if (all.length > shown.length) {
+            shown.push(`+${all.length - shown.length} more`);
+        }
+        return shown.length
+            ? `${issue.code} [${shown.join(', ')}]: ${issue.message}`
+            : `${issue.code}: ${issue.message}`;
+    });
+    const shown = lines.slice(0, MAX_REPORTED_GRAPH_ISSUES);
+    if (lines.length > shown.length) {
+        shown.push(`${lines.length - shown.length} more issues. Preview the change set for the full list.`);
+    }
+    return shown.join(' ');
+}
 // Each kind is a separate graph that must stay acyclic.
 function edgeTargets(kind, artifact) {
     if (kind === 'lineage')
@@ -399,7 +434,7 @@ export function previewArtifactChangeSet(current, input, previouslySuperseded =
             replacements.set(relation.targetId, node.id);
         }
     }
-    errors.push(...graphIssues([...post.values()], canonical.storeId));
+    const postIssues = graphIssues([...post.values()], canonical.storeId);
     // Compute the component in the union of the old and proposed graphs.
     // A references target enters the set for existence checks only. It does not expand the set.
     const referenceTargets = new Set();
@@ -407,7 +442,8 @@ export function previewArtifactChangeSet(current, input, previouslySuperseded =
     while (changed) {
         changed = false;
         const add = (id, viaReference = false) => {
-            if (!nodes.has(id))
+            // Deleted documents were checked when deleted; graph rules still see their metadata.
+            if (!nodes.has(id) || nodes.get(id).status === 'deleted')
                 return;
             if (!affected.has(id)) {
                 affected.add(id);
@@ -443,12 +479,17 @@ export function previewArtifactChangeSet(current, input, previouslySuperseded =
                     add(relation.targetId, true);
                 }
             }
+            // An accepted document of the same task is context only: it does not expand the set (ADR 0119).
             if (node.status === 'accepted' &&
-                (node.taskIds.length === 0 || node.taskIds.some(id => tasks.has(id)))) {
-                add(node.id);
+                node.taskIds.some(id => tasks.has(id))) {
+                add(node.id, true);
             }
         }
     }
+    // An old issue in an unrelated part of the store does not block this change set.
+    const before = new Set(graphIssues(current, canonical.storeId).map(issueKey));
+    errors.push(...postIssues.filter(issue => !before.has(issueKey(issue)) ||
+        issue.artifactIds.some(id => affected.has(id))));
     for (const expected of canonical.expectedVersions) {
         if (nodes.get(expected.id)?.metadataVersion !== expected.version) {
             error('stale_version', [expected.id], 'Expected artifact version no longer matches.');
@@ -484,6 +525,9 @@ export function previewArtifactChangeSet(current, input, previouslySuperseded =
         includedIn
     };
 }
+function issueKey(issue) {
+    return canonicalJson([issue.code, issue.artifactIds]);
+}
 function isAncestor(id, artifact, nodes) {
     const visited = new Set();
     let parent = artifact.revisionOf[0];

package/dist/server/services/artifact-lifecycle.service.js

@@ -7,17 +7,31 @@ import { sha256Hex } from "../utils/hash.js";
 import { HEARTBEAT_STALE_MS } from "../../shared/artifact-transitions/constants.js";
 import { hasErrorCode } from "../utils/system-error.js";
 import { ArtifactConflictError, ArtifactInputError } from "../errors/artifacts.js";
-import { canonicalChangeSet, previewArtifactChangeSet } from "./artifact-graph-validation.js";
+import { canonicalChangeSet, graphIssuesMessage, previewArtifactChangeSet } from "./artifact-graph-validation.js";
 import { ArtifactValidationRepository } from "../repositories/artifact-validation.repo.js";
 import { ArtifactAuthorizationService, artifactActionDigest } from "./artifact-authorization.service.js";
 import { ArtifactValidationJobsService } from "./artifact-validation-jobs.service.js";
 import { ArtifactTransitionRepository } from "../repositories/artifact-transition.repo.js";
 import { ArtifactTransitionService } from "./artifact-transition.service.js";
 // Manifest changes invalidate all earlier semantic conclusions.
-const VALIDATION_RULES_VERSION = 2;
+const VALIDATION_RULES_VERSION = 3;
+// The server is the author of a proposal version that only follows the grown set (ADR 0121).
+const REBASE_ACTOR = { kind: 'system', id: 'validation-rebase' };
+// Preview errors that a rebase can fix: they only name versions of the set context.
+const REBASE_CODES = new Set(['missing_expected_version', 'stale_version']);
+// The reason in the request list is cut to this length; the full text stays in the proposal.
+const ACTION_REASON_CHARS = 300;
 export function artifactSessionId(actor) {
     return actor.kind === 'user' ? `user:${actor.id}` : actor.id;
 }
+/**
+ * The digest covers the affected set, not the store epoch. A store change outside
+ * the set does not make a running validation stale (ADR 0119).
+ */
+function setDigest(manifest) {
+    const { validationEpoch: _epoch, ...content } = manifest;
+    return artifactActionDigest(content);
+}
 export class ArtifactLifecycleService {
     repository;
     authorization;
@@ -89,7 +103,7 @@ export class ArtifactLifecycleService {
         }
         const preview = this.preview(input.changeSet);
         if (preview.errors.length) {
-            throw new ArtifactInputError(preview.errors.map(item => item.message).join(' '));
+            throw new ArtifactInputError(graphIssuesMessage(preview.errors, preview.expectedVersions));
         }
         const previous = input.id ? this.repository.proposal(input.id) : undefined;
         if ((previous && previous.version !== input.expectedVersion) ||
@@ -137,6 +151,26 @@ export class ArtifactLifecycleService {
             };
         });
     }
+    /** The pending requests, each with a short summary so the user can tell them apart. */
+    listActions() {
+        return this.storage.catalog.readSnapshot(() => this.authorization.list().map(pending => {
+            try {
+                const { changeSet } = this.repository.proposalVersion(pending.action.changeSetId, pending.action.version);
+                return {
+                    ...pending,
+                    summary: {
+                        command: changeSet.command,
+                        reason: changeSet.reason.slice(0, ACTION_REASON_CHARS),
+                        documentCount: changeSet.targetStatuses.length
+                    }
+                };
+            }
+            catch {
+                // A proposal that cannot be read must not hide the request itself.
+                return { ...pending, summary: null };
+            }
+        }));
+    }
     inspectAction(id, actor) {
         return this.storage.catalog.readSnapshot(() => {
             const value = this.authorization.describe(id);
@@ -204,7 +238,7 @@ export class ArtifactLifecycleService {
             changeSetId,
             version,
             manifest,
-            manifestDigest: artifactActionDigest(manifest),
+            manifestDigest: setDigest(manifest),
             state: 'prepared',
             validatorSessionId: null,
             owner: null,
@@ -216,7 +250,7 @@ export class ArtifactLifecycleService {
     manifest(proposal) {
         const preview = this.preview(proposal.changeSet);
         if (preview.errors.length) {
-            throw new ArtifactConflictError(preview.errors.map(item => item.message).join(' '));
+            throw new ArtifactConflictError(graphIssuesMessage(preview.errors, preview.expectedVersions));
         }
         const artifacts = preview.affectedIds.map(id => this.storage.readVerifiedFile(id).artifact);
         return {
@@ -228,12 +262,66 @@ export class ArtifactLifecycleService {
             requiredContentIds: artifacts.map(item => item.id)
         };
     }
+    /**
+     * Gives the next proposal version and manifest of a running validation when only
+     * the context of its set changed (ADR 0121). The caller owns the transaction.
+     * Returns undefined when the change needs a decision of the proposal author.
+     */
+    rebaseInTransaction(validation) {
+        const proposal = this.repository.proposal(validation.changeSetId);
+        if (proposal.version !== validation.version ||
+            validation.manifest.rulesVersion !== VALIDATION_RULES_VERSION) {
+            return undefined;
+        }
+        const subjects = new Set(proposal.changeSet.subjectIds);
+        const preview = this.preview(proposal.changeSet);
+        const decided = proposal.changeSet.supplementDispositions
+            .map(item => item.artifactId)
+            .sort();
+        if (!preview.errors.every(issue => REBASE_CODES.has(issue.code) &&
+            issue.artifactIds.every(id => !subjects.has(id))) ||
+            canonicalJson(preview.requiredSupplementDispositions) !==
+                canonicalJson(decided)) {
+            return undefined;
+        }
+        const command = proposal.changeSet.command;
+        // A historical command has no current proposal form; its validation stays stale.
+        if (command === 'submit_review') {
+            return undefined;
+        }
+        let next = proposal;
+        if (preview.errors.length) {
+            next = this.proposeInTransaction({
+                requestId: `validation-rebase:${validation.id}:${proposal.version}`,
+                id: proposal.id,
+                expectedVersion: proposal.version,
+                changeSet: {
+                    ...proposal.changeSet,
+                    command,
+                    expectedVersions: preview.expectedVersions
+                }
+            }, REBASE_ACTOR);
+        }
+        const manifest = this.manifest(next);
+        return { proposal: next, manifest, digest: setDigest(manifest) };
+    }
     assertFresh(validation) {
         const proposal = this.repository.proposal(validation.changeSetId);
+        let digest;
+        try {
+            digest = setDigest(this.manifest(proposal));
+        }
+        catch (error) {
+            // A store change can make the change set invalid, for example a new accepted
+            // artifact without tasks. That is staleness too, so the caller sees one error.
+            if (!(error instanceof ArtifactConflictError)) {
+                throw error;
+            }
+            throw new ArtifactConflictError(`VALIDATION_STALE: manifest changed (${error.message}); prepare a new validation.`);
+        }
         if (validation.manifest.rulesVersion !== VALIDATION_RULES_VERSION ||
             proposal.version !== validation.version ||
-            artifactActionDigest(this.manifest(proposal)) !==
-                validation.manifestDigest) {
+            digest !== validation.manifestDigest) {
             throw new ArtifactConflictError('VALIDATION_STALE: manifest changed; prepare a new validation.');
         }
         return proposal;

package/dist/server/services/artifact-storage.service.js

@@ -4,7 +4,7 @@ import { takeWithinBytes } from "../utils/take-within-bytes.js";
 import { ArtifactTypeService } from "./artifact-type.service.js";
 import { TaskService } from "./task.service.js";
 import { ArtifactGraphService } from "./artifact-graph.service.js";
-import { artifactIssues } from "./artifact-graph-validation.js";
+import { artifactIssues, graphIssuesMessage } from "./artifact-graph-validation.js";
 import { ArtifactGraphRepository } from "../repositories/artifact-graph.repo.js";
 import { TaskRepository } from "../repositories/task.repo.js";
 import { normalizeArtifact } from "../../shared/artifacts/normalize.js";
@@ -622,7 +622,7 @@ export class ArtifactStorageService {
         }
         const issues = artifactIssues(artifact, id => this.catalog.get(id), this.storeId);
         if (issues.length) {
-            throw new ArtifactInputError(issues.map(issue => issue.message).join(' '));
+            throw new ArtifactInputError(graphIssuesMessage(issues));
         }
     }
     assertLimit(limit) {

package/dist/server/services/artifact-transition.service.js

@@ -7,6 +7,7 @@ import { HEARTBEAT_STALE_MS, TRANSITION_CONSENT_TTL_MS, TRANSITION_PREVIEW_TTL_M
 import { isTerminalTransitionStage, transitionCommand, userTransitionTargets } from "../../shared/artifact-transitions/transitions.js";
 import { sha256Hex } from "../utils/hash.js";
 import { ArtifactConflictError, ArtifactInputError, artifactLeaseBusyError, isArtifactBusyError, isArtifactLeaseBusyError, ArtifactNotFoundError } from "../errors/artifacts.js";
+import { graphIssuesMessage } from "./artifact-graph-validation.js";
 // Reconcile cadence; other processes cannot call this process, so it polls.
 const RECONCILE_INTERVAL_MS = 1000;
 // Memory bound for unconfirmed previews.
@@ -174,7 +175,7 @@ export class ArtifactTransitionService {
         }
         if (!preview.view.canConfirm) {
             throw new ArtifactConflictError('The transition is blocked: ' +
-                preview.view.blockers.map(item => item.message).join(' '));
+                graphIssuesMessage(preview.view.blockers));
         }
         const presetState = this.lifecycle.jobs.presetState(input.presetId);
         if (presetState !== 'ok') {