@volter/supercode-orchestrator 0.4.139 → 0.4.140

package/board/cli.mjs

@@ -9,7 +9,7 @@ import { spawnSync } from 'node:child_process';
 import { basename, join, resolve } from 'node:path';
 import { tmpdir } from 'node:os';
 import { read } from '../orchestration.mjs';
-import { view, backingPaths, layOut, backingOf, boardExists, boardPath, DEFAULT_BOARD, event, json, listBoards, logsDir, now, openBoard, setActor, tx } from './store.mjs';
+import { actorOf, view, backingPaths, layOut, backingOf, boardExists, boardPath, DEFAULT_BOARD, event, json, listBoards, logsDir, now, openBoard, setActor, tx } from './store.mjs';
 import { isLocalWorkspace } from './workspace.mjs';
 import { openZtrackBoard } from './ztrack.mjs';
 import * as engine from './engine.mjs';
@@ -1090,7 +1090,8 @@ function rolesFor(db, cardId, sessionId, params = {}) {
   const task = engine.getTask(db, cardId);
   if (!task) return [];
   const roles = [];
-  if (completionOwnerOf(db, cardId)?.endsWith(`:${sessionId}`)) roles.push('creator');
+  const creator = completionOwnerOf(db, cardId);
+  if (creator && creator === actorOf()) roles.push('creator');
   const current = task.current_run_id ? json(db.prepare('SELECT metadata FROM task_runs WHERE id = ?').get(task.current_run_id)?.metadata, {})?.supercode : null;
   if (current?.session_id === sessionId) roles.push(current.role ?? 'implementer');
   else if (engine.lastSession(db, cardId)?.session_id === sessionId) roles.push('implementer');
@@ -1111,7 +1112,8 @@ function authorize(db, verb, rest, args, own) {
   if (args.all) refuse(`does not ${verb} every card; only its own`);
   const card = engine.getTask(db, rest[0]);
   if (!card) return; // the verb itself answers "no card"
-  if (completionOwnerOf(db, card.id)?.endsWith(`:${callerSession()}`)) return; // its declared creator doors still govern the act
+  const creator = completionOwnerOf(db, card.id);
+  if (creator && creator === actorOf()) return;
   // a card's session writes its own card and its subtasks; what it may do with them is the workflow's (`by`)
   if (card.id !== own.id && card.subtask_of !== own.id) refuse(`writes only its own card and its subtasks, not ${card.id}`);
   for (const other of args.ids ?? []) if (other !== own.id && engine.getTask(db, other)?.subtask_of !== own.id) refuse(`writes only its own card and its subtasks, not ${other}`);

package/board/engine.mjs

@@ -205,7 +205,7 @@ export function createCard(board, spec) {
                tenant, idempotency_key, max_runtime_seconds, skills, max_retries, model_override, provider_override, reasoning_effort, session_id,
                project_id, goal_mode, goal_max_turns)
              VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
-      id, title, spec.body ?? null, spec.assignee || null, 'todo', Number(spec.priority) || 0, spec.createdBy ?? 'user', t, ws.kind, ws.path,
+      id, title, spec.body ?? null, spec.assignee || null, 'todo', Number(spec.priority) || 0, actorOf() ?? spec.createdBy ?? 'user', t, ws.kind, ws.path,
       spec.branch ?? null, spec.tenant ?? null, spec.idempotencyKey ?? null, spec.maxRuntime ?? null,
       spec.skills?.length ? JSON.stringify(spec.skills) : null, spec.maxRetries ?? null, spec.model ?? null, spec.provider ?? null,
       spec.reasoning ?? null, spec.sessionId ?? null, spec.project ?? null, spec.goal ? 1 : 0, spec.goal?.maxTurns ?? null);

package/board/workflow.mjs

@@ -66,20 +66,7 @@ export function creatorOf(db, id) {
   return payload.source !== 'document' && /^(?:sc:[^:]+:[^:]+:|hermes-run:)/.test(address ?? '') ? address : null;
 }
 
-/** Open subtasks are the current parent worker's plan. Keep creation history
- * immutable while transferring its creator doors when that worker is replaced. */
 export function completionOwnerOf(db, id) {
-  const task = one(db, 'SELECT t.status,c.subtask_of FROM tasks t LEFT JOIN supercode_cards c ON c.task_id=t.id WHERE t.id=?', id);
-  if (task?.subtask_of && !['done', 'archived'].includes(task.status)) {
-    for (const row of all(db, 'SELECT metadata FROM task_runs WHERE task_id=? ORDER BY id DESC', task.subtask_of)) {
-      const session = json(row.metadata, {})?.supercode;
-      if (!session || (session.slot ?? 'worker') !== 'worker') continue;
-      // An unbound replacement leaves authority with the manager; it never
-      // revives the previous worker's ability to finish the new worker's plan.
-      return session.address ?? (session.machine && session.harness && session.session_id
-        ? `sc:${session.machine}:${session.harness}:${session.session_id}` : null);
-    }
-  }
   return creatorOf(db, id);
 }
 
@@ -377,7 +364,12 @@ export function fire(db, board, entry, id, name, { roles = [], payload = {}, ext
   // `sender`: the roles the event was sent with (a validator can ask who is asking)
   const scope = scopeOf(db, board, task, { params, event: payload, extra: { lanes: lanesIn(entry), ...extra, sender: roles } });
   const allowed = candidates.filter((t) => !t.by?.length || t.by.some((r) => roles.includes(r)));
-  if (!allowed.length) throw new Error(`${id} is ${from}; ${name.replace(/_/g, '-')} there is for ${[...new Set(candidates.flatMap((t) => t.by ?? []))].join(' or ')}. ${candidates.map((t) => t.description).filter(Boolean).join(' ')}`);
+  if (!allowed.length) {
+    const state = name === 'complete' ? 'done' : name === 'cancel' ? 'cancelled' : null;
+    const request = state && candidates.some(transition => transition.by?.includes('creator'))
+      ? ` Ask the manager with workflow request-state ${id} --state ${state} --reason <why> --evidence <verdict-and-pointers>.` : '';
+    throw new Error(`${id} is ${from}; ${name.replace(/_/g, '-')} there is for ${[...new Set(candidates.flatMap((t) => t.by ?? []))].join(' or ')}. ${candidates.map((t) => t.description).filter(Boolean).join(' ')}${request}`);
+  }
   const taken = allowed.find((t) => holds(t.guard ?? null, scope));
   if (!taken) {
     const state = scope.card;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-orchestrator",
-  "version": "0.4.139",
+  "version": "0.4.140",
   "type": "module",
   "description": "The orchestrator runtime over the Volter Harness ontology: one typed operational model whose folder is its serialization, read and written through the harness orchestration doors (docs/ORCHESTRATOR-IR.md)",
   "exports": {