@zq-silk/yui 0.15.12 → 0.16.0

package/dist/storage/migrations/verificationPolicy.js

@@ -0,0 +1,74 @@
+import { resolveHistoricalVerificationPlan } from "./verificationPlanV1.js";
+/** Read-only: an admitted old gate keeps its original plan identity until it
+ * settles. The cutover never relabels a running Job or replays its checks. */
+export function preflightVerificationPolicy(db) {
+    const active = db.prepare(`SELECT task_id, integration_id FROM integration_attempts
+    WHERE status IN ('running','validating')
+      AND json_type(payload,'$.gatePlanDigest') IS NOT NULL LIMIT 1`)
+        .get();
+    if (active !== undefined) {
+        throw new Error(`Verification policy cutover requires the admitted gate to settle: ${active.task_id}/${active.integration_id}. Preserve its Job and continue it with the current release before upgrading.`);
+    }
+}
+/** Frozen 32→33 policy cutover. Only declared configuration representations
+ * change; old execution artifacts/Job results and their logs remain evidence. */
+export function migrateVerificationPolicy(db) {
+    preflightVerificationPolicy(db);
+    const configRow = db.prepare("SELECT payload FROM config WHERE id=1").get();
+    if (configRow !== undefined) {
+        const config = JSON.parse(configRow.payload);
+        const mode = config.leaderNextActionMode;
+        const budget = config.leaderSemanticBudgetRuns;
+        if ((mode != null && (typeof mode !== "string"
+            || !["", "display", "warn", "enforce"].includes(mode.trim().toLowerCase())))
+            || (budget != null && (!Number.isSafeInteger(budget) || budget < 1 || budget > 20))) {
+            throw new Error("Invalid retired Leader policy; preserve the config for diagnosis.");
+        }
+    }
+    const projects = db.prepare("SELECT id,payload FROM projects").all();
+    const saveProject = db.prepare("UPDATE projects SET payload=? WHERE id=?");
+    for (const row of projects) {
+        const project = JSON.parse(row.payload);
+        // This frozen reader preserves validation and duplicate-plan rejection.
+        resolveHistoricalVerificationPlan(project);
+        let changed = false;
+        const knowledge = project.knowledge.map(entry => {
+            if (entry.status !== "active")
+                return entry;
+            let value;
+            try {
+                value = JSON.parse(entry.body);
+            }
+            catch {
+                return entry;
+            }
+            if (typeof value !== "object" || value === null
+                || value.kind !== "verification-plan")
+                return entry;
+            const { mode: _mode, ...plan } = value;
+            changed = true;
+            return { ...entry, body: JSON.stringify({ ...plan, schemaVersion: 1 }) };
+        });
+        if (changed)
+            saveProject.run(JSON.stringify({ ...project, knowledge }), row.id);
+    }
+    const invalidRerun = db.prepare(`SELECT task_id,integration_id FROM integration_attempts
+    WHERE json_type(payload,'$.rerunChecks') IS NOT NULL
+      AND json_type(payload,'$.rerunChecks') NOT IN ('true','false') LIMIT 1`).get();
+    if (invalidRerun !== undefined)
+        throw new Error("Invalid Integration check execution intent; preserve the record.");
+    const artifacts = db.prepare(`SELECT key,payload FROM gate_artifacts
+    WHERE json_type(payload,'$.potentialReuseCount') IS NOT NULL`).all();
+    for (const artifact of artifacts) {
+        const count = JSON.parse(artifact.payload).potentialReuseCount;
+        if (!Number.isSafeInteger(count) || count < 0) {
+            throw new Error(`Invalid historical verification counter: ${artifact.key}. Preserve the artifact for diagnosis.`);
+        }
+    }
+    db.exec(`
+    UPDATE config SET payload=json_remove(payload,'$.leaderNextActionMode','$.leaderSemanticBudgetRuns');
+    UPDATE integration_attempts SET payload=json_set(payload,'$.rerunChecks',json('false'))
+      WHERE json_type(payload,'$.rerunChecks') IS NULL;
+    UPDATE gate_artifacts SET payload=json_remove(payload,'$.potentialReuseCount');
+  `);
+}

package/dist/storage/migrations/workItemHistory.js

@@ -0,0 +1,46 @@
+/** Frozen 31→32 transform: obsolete execution-shaped diagnostics are audit
+ * records, not another representation of current WorkItem state. */
+export function migrateWorkItemHistory(db) {
+    const rows = db.prepare(`SELECT task_id, work_item_id, payload FROM work_items
+    WHERE json_type(payload, '$.historicalState') IS NOT NULL
+    ORDER BY task_id, work_item_id`).all();
+    for (const row of rows) {
+        const value = JSON.parse(row.payload);
+        const history = value.historicalState;
+        if (value.taskId !== row.task_id || value.id !== row.work_item_id
+            || history === null || typeof history !== "object" || Array.isArray(history)
+            || !["pending", "running", "awaiting_acceptance", "completed", "failed", "retired"].includes(history.status)
+            || (history.outcome !== undefined && !text(history.outcome))
+            || (history.endedAt !== undefined
+                && (!text(history.endedAt) || !Number.isFinite(Date.parse(history.endedAt))))) {
+            throw new Error(`Invalid historical WorkItem execution state: ${row.task_id}/${row.work_item_id}. Preserve it for diagnosis.`);
+        }
+    }
+    const highWater = db.prepare(`SELECT max(
+    coalesce((SELECT high_water FROM id_sequences WHERE task_id = ? AND kind = 'event'), 0),
+    coalesce((SELECT max(CAST(substr(event_id, 7) AS INTEGER)) FROM events WHERE task_id = ?), 0)
+  ) AS value`);
+    const saveEvent = db.prepare("INSERT INTO events(task_id,event_id,type,occurred_at,payload) VALUES(?,?,?,?,?)");
+    const saveCounter = db.prepare(`INSERT INTO id_sequences(task_id,kind,high_water) VALUES(?,'event',?)
+    ON CONFLICT(task_id,kind) DO UPDATE SET high_water=max(high_water,excluded.high_water)`);
+    const removeHistoricalState = db.prepare(`UPDATE work_items SET payload=json_remove(payload,'$.historicalState')
+    WHERE task_id=? AND work_item_id=?`);
+    const counters = new Map();
+    const at = new Date().toISOString();
+    for (const row of rows) {
+        const sequence = (counters.get(row.task_id)
+            ?? highWater.get(row.task_id, row.task_id).value) + 1;
+        counters.set(row.task_id, sequence);
+        const event = {
+            schemaVersion: 2, id: `event-${sequence}`, taskId: row.task_id,
+            type: "work-item.execution-state-retired", createdAt: at,
+            payload: { workItemId: row.work_item_id, record: row.payload, disposition: "audit-only" }
+        };
+        saveEvent.run(row.task_id, event.id, event.type, at, JSON.stringify(event));
+        saveCounter.run(row.task_id, sequence);
+        removeHistoricalState.run(row.task_id, row.work_item_id);
+    }
+}
+function text(value) {
+    return typeof value === "string" && value.trim().length > 0 && !value.includes("\0");
+}

package/dist/storage/persistenceWorker.js

@@ -3,9 +3,9 @@
  *
  * The worker owns the {@link SqliteTaskStore} connection: one writer connection
  * (single-writer, `BEGIN IMMEDIATE`) plus a small read pool (separate WAL
- * connections that never take the write lock, §3.2). The main thread never
- * touches the db; it sends commands over a `MessageChannel` port and receives
- * results.
+ * connections for reads). Observer folds and telemetry ingestion use this
+ * worker; the Controller's synchronous scheduler still has its own connection
+ * to the same WAL database. This is an execution boundary, not another Store.
  *
  * The port handshake, dispatch, cancellation observation, and error
  * serialization are provided by the shared `core/boundedRpc` worker host
@@ -22,6 +22,8 @@
  *   - `observer` ..... a controller observer method hosted by the worker (the
  *                      `FileSchedulerStoreAdapter` folds run here, off the main
  *                      event loop).
+ *   - `telemetry` .... bounded diagnostic batch, using existing row keys and
+ *                      triggers without Task revision or outbox writes.
  *   - `expectedRevision` enforces the global revision CAS in the same txn
  *                      (§5.3); a mismatch fails with `StorageConflictError`.
  *
@@ -141,6 +143,7 @@ runRpcWorker({
             case "call":
             case "transaction":
             case "observer":
+            case "telemetry":
                 return "request";
         }
     },
@@ -149,6 +152,7 @@ runRpcWorker({
             case "call":
             case "transaction":
             case "observer":
+            case "telemetry":
             case "cancel":
                 return request.requestId;
             case "init":
@@ -157,7 +161,7 @@ runRpcWorker({
         }
     },
     init: (request) => handleInit(request),
-    handle: (request) => {
+    handle: async (request) => {
         switch (request.kind) {
             case "call":
                 return handleCall(request);
@@ -165,6 +169,10 @@ runRpcWorker({
                 return handleTransaction(request);
             case "observer":
                 return handleObserver(request);
+            case "telemetry":
+                if (state.writer === undefined)
+                    throw new Error("Worker not initialized.");
+                return state.writer.flushTelemetry(request.entries, request.runCap);
             case "init":
             case "cancel":
             case "shutdown":

package/dist/storage/recordValidation.js

@@ -0,0 +1,87 @@
+import { validateConfiguredAgent } from "../agent/agent.js";
+import { validateRun } from "../agentRun/agentRun.js";
+import { validateContextSnapshot } from "../context/contextSnapshot.js";
+import { validateDecision } from "../decision/decision.js";
+import { validateTaskEvent } from "../event/taskEvent.js";
+import { validateRoleSessionSet } from "../executor/agentExecutor.js";
+import { validateInputRequest } from "../input/inputRequest.js";
+import { validateChangeSet } from "../integration/changeSet.js";
+import { validateIntegrationAttempt } from "../integration/integrationAttempt.js";
+import { validateDurableJob } from "../job/durableJob.js";
+import { validateGlobalRoleMessage, validateTaskMessage } from "../message/message.js";
+import { validateMilestone } from "../milestone/milestone.js";
+import { validatePluginIntent } from "../plugins/pluginIntent.js";
+import { validatePluginValidation } from "../plugins/pluginPackage.js";
+import { validateAgentProfile } from "../profile/agentProfile.js";
+import { validateProject } from "../repository/project.js";
+import { validateEnvironmentPreparation, validateLocalResource } from "../resources/projectResource.js";
+import { validateReviewRound } from "../review/reviewRound.js";
+import { validateGlobalRole, validateTaskRole } from "../role/role.js";
+import { createSessionOwnerIdentity } from "../runtime/sessionOwnerIdentity.js";
+import { validateTaskWake } from "../scheduler/taskWake.js";
+import { validateTask } from "../task/task.js";
+import { validateGateArtifact } from "../verification/gateArtifact.js";
+import { validateWorkItem } from "../workItem/workItem.js";
+import { validateManagedWorkspace } from "../worktree/managedWorkspace.js";
+import { StorageRecordError, storedCapabilityGrant, storedPublicationReference, storedReleaseWorkflow } from "./taskStore.js";
+const check = (validate) => record => { validate(record); };
+/** One current domain contract for saves, reads and explicit Home diagnostics.
+ * Protocol-specific metadata/outbox/telemetry have their own readers. This is
+ * validation only: historical formats belong exclusively to migrations. */
+const validators = {
+    task_records: check(validateTask),
+    work_items: check(validateWorkItem),
+    configured_agents: check(validateConfiguredAgent),
+    agent_profiles: check(validateAgentProfile),
+    projects: check(validateProject),
+    task_roles: check(validateTaskRole),
+    global_roles: check(validateGlobalRole),
+    role_session_sets: check(validateRoleSessionSet),
+    global_role_session_sets: check(validateRoleSessionSet),
+    messages: check(validateTaskMessage),
+    global_role_messages: check(validateGlobalRoleMessage),
+    turns: check(validateRun),
+    review_rounds: check(validateReviewRound),
+    change_sets: check(validateChangeSet),
+    integration_attempts: check(validateIntegrationAttempt),
+    durable_jobs: check(validateDurableJob),
+    context_snapshots: check(validateContextSnapshot),
+    managed_workspaces: check(validateManagedWorkspace),
+    input_requests: check(validateInputRequest),
+    decisions: check(validateDecision),
+    milestones: check(validateMilestone),
+    events: check(validateTaskEvent),
+    task_wakes: check(validateTaskWake),
+    gate_artifacts: check(validateGateArtifact),
+    capability_grants: check(storedCapabilityGrant),
+    release_workflows: check(storedReleaseWorkflow),
+    publication_references: check(storedPublicationReference),
+    local_resources: check(validateLocalResource),
+    environment_preparations: check(validateEnvironmentPreparation),
+    plugin_intents: check(validatePluginIntent),
+    plugin_validations: check(validatePluginValidation),
+    session_owners: check((record) => {
+        if (record.schemaVersion !== 2 || record.kind !== "yui-session-owner" || Object.hasOwn(record, "launchId")) {
+            throw new Error("Session owner identity is invalid.");
+        }
+        createSessionOwnerIdentity({ ...record, recordedAt: new Date(record.recordedAt) });
+    })
+};
+export const STORED_RECORD_TABLES = Object.freeze(Object.keys(validators));
+export function validateStoredRecord(table, record) {
+    if (!Object.hasOwn(validators, table))
+        return;
+    try {
+        if (record === null || typeof record !== "object" || Array.isArray(record)) {
+            throw new Error("Record must be an object.");
+        }
+        validators[table](record);
+    }
+    catch (error) {
+        const fields = record !== null && typeof record === "object" ? record : {};
+        const identity = [fields.taskId, fields.id ?? fields.name ?? fields.pluginId]
+            .filter((value) => typeof value === "string")
+            .map(value => JSON.stringify(value.slice(0, 160))).join("/");
+        throw new StorageRecordError(`Invalid ${table} record${identity ? ` ${identity}` : ""}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}

package/dist/storage/sqliteSchema.js

@@ -25,6 +25,13 @@ import { REMOVE_RUNTIME_GENERATION_SQL, removeRuntimeGenerationRecords } from ".
 import { migrateAgentRunContract } from "./migrations/agentRunContract.js";
 import { migrateArtifactsToGit } from "./migrations/artifactsToGit.js";
 import { migrateIntegrationContinuation } from "./migrations/integrationContinuation.js";
+import { migrateNotificationOnlyWakes } from "./migrations/notificationOnlyWakes.js";
+import { migrateWorkItemHistory } from "./migrations/workItemHistory.js";
+import { migrateVerificationPolicy } from "./migrations/verificationPolicy.js";
+import { migrateCurrentInputContract } from "./migrations/currentInputContract.js";
+import { CURRENT_RUNTIME_CONTRACT_SQL, migrateCurrentRuntimeContract } from "./migrations/currentRuntimeContract.js";
+import { migrateAgentFailureContext } from "./migrations/agentFailureContext.js";
+import { migrateNarrowAgentFailureContext } from "./migrations/narrowAgentFailureContext.js";
 import { UNIFY_HOME_LAYOUT_SQL, migrateUnifyHomeLayout } from "./migrations/unifyHomeLayout.js";
 import { COLLAPSE_WORKTREE_LAYOUT_SQL, migrateCollapseWorktreeLayout } from "./migrations/collapseWorktreeLayout.js";
 import { CURRENT_STORAGE_VERSION, MIN_SUPPORTED_STORAGE_VERSION } from "./storageVersions.js";
@@ -1295,6 +1302,140 @@ CREATE INDEX idx_global_provider_retry ON global_role_session_sets(
   json_extract(payload, '$.providerBinding.retry.status')
 ) WHERE json_extract(payload, '$.providerBinding.retry.status') IN ('waiting', 'in-flight');
 `
+    },
+    {
+        version: 28,
+        name: "current-contract-only-dispatch",
+        introducedIn: "0.16.0",
+        // Freeze the one valid earlier singleton dispatch shape here, not in the
+        // normal runtime. Preserve the full input batch and sequence; only replace
+        // its transport dedupe identity. Merged/ambiguous batches, processing
+        // claims, original Messages, results and external-effect evidence remain
+        // untouched. This step does not accept, replay or complete any execution.
+        sql: `
+UPDATE mailboxes
+SET pending = json_set(pending,
+  '$.sources', json_array('turn-dispatch'),
+  '$.dedupeKeys', json_array('role-turn:' || task_id || ':' || role_name || ':' ||
+    (SELECT json_extract(value, '$.id') FROM json_each(mailboxes.pending, '$.refs')
+     WHERE json_extract(value, '$.type') = 'run'
+       AND json_extract(value, '$.taskId') = mailboxes.task_id)))
+WHERE target_kind = 'role' AND role_name <> 'leader' AND pending IS NOT NULL
+  AND json_extract(pending, '$.requestCount') = 1
+  AND json_array_length(pending, '$.sources') = 1
+  AND json_extract(pending, '$.sources[0]') = 'yui'
+  AND EXISTS (SELECT 1 FROM json_each(mailboxes.pending, '$.reasons')
+    WHERE value IN ('turn-dispatched', 'turn-retried', 'review-requested',
+                    'workitem-synthesis-ready', 'review-synthesis-ready'))
+  AND (SELECT count(*) FROM json_each(mailboxes.pending, '$.refs')
+       WHERE json_extract(value, '$.type') = 'run') = 1
+  AND EXISTS (SELECT 1 FROM json_each(mailboxes.pending, '$.refs')
+    WHERE json_extract(value, '$.type') = 'run'
+      AND json_extract(value, '$.taskId') = mailboxes.task_id);
+`
+    },
+    {
+        version: 29,
+        name: "agent-ordered-atomic-integration",
+        introducedIn: "0.16.0",
+        // Retire the scheduler, not its user's intent. Freeze each complete queue
+        // payload in ordinary Task history before dropping the active table.
+        // Existing Integrations, Jobs and WorkItem delivery evidence remain exact;
+        // no entry is interpreted as committed or automatically replayed.
+        sql: `
+CREATE TEMP TABLE retired_integration_queue AS
+SELECT q.*,
+  strftime('%Y-%m-%dT%H:%M:%fZ', 'now') AS retired_at,
+  max(
+    coalesce((SELECT high_water FROM id_sequences
+              WHERE task_id = q.task_id AND kind = 'event'), 0),
+    coalesce((SELECT max(CAST(substr(event_id, 7) AS INTEGER)) FROM events
+              WHERE task_id = q.task_id), 0)
+  ) + row_number() OVER (
+    PARTITION BY q.task_id ORDER BY q.created_at,
+      CAST(substr(q.queue_id, length('integration-queue-') + 1) AS INTEGER)
+  ) AS event_sequence
+FROM integration_queue AS q;
+
+INSERT INTO events(task_id, event_id, type, occurred_at, payload)
+SELECT task_id, 'event-' || event_sequence, 'integration.queue-retired', retired_at,
+  json_object(
+    'schemaVersion', 2, 'id', 'event-' || event_sequence, 'taskId', task_id,
+    'type', 'integration.queue-retired', 'createdAt', retired_at,
+    'payload', json_object('queueId', queue_id, 'record', payload,
+      'disposition', 'retired-without-replay')
+  )
+FROM retired_integration_queue;
+
+INSERT INTO id_sequences(task_id, kind, high_water)
+SELECT task_id, 'event', max(event_sequence)
+FROM retired_integration_queue GROUP BY task_id
+ON CONFLICT(task_id, kind) DO UPDATE SET high_water = excluded.high_water;
+
+DROP TABLE retired_integration_queue;
+DROP TABLE integration_queue;
+DELETE FROM id_sequences WHERE kind = 'integrationQueue';
+`
+    },
+    {
+        version: 30,
+        name: "notification-only-wakes",
+        introducedIn: "0.16.0",
+        sql: "SELECT 1; -- Retire Run-linked wakes as audit events; notification schema 2; explicit Global providerBinding",
+        migrateData: migrateNotificationOnlyWakes
+    },
+    {
+        version: 31,
+        name: "explicit-review-scope",
+        introducedIn: "0.16.0",
+        sql: `
+UPDATE review_rounds
+SET payload = json_set(payload, '$.scope', 'work-item')
+WHERE json_type(payload, '$.scope') IS NULL
+   OR json_type(payload, '$.scope') = 'null';
+`
+    },
+    {
+        version: 32,
+        name: "work-item-history-as-events",
+        introducedIn: "0.16.0",
+        sql: "SELECT 1; -- Archive original WorkItem payloads before removing historicalState",
+        migrateData: migrateWorkItemHistory
+    },
+    {
+        version: 33,
+        name: "advisory-and-verification-policy",
+        introducedIn: "0.16.0",
+        sql: "SELECT 1; -- Retire rollout modes/shadow metrics; explicit rerun intent; verification proof v3",
+        migrateData: migrateVerificationPolicy
+    },
+    {
+        version: 34,
+        name: "current-input-contract",
+        introducedIn: "0.16.0",
+        sql: "SELECT 1; -- Archive retired Message wake policies and activation origin gates",
+        migrateData: migrateCurrentInputContract
+    },
+    {
+        version: 35,
+        name: "current-verification-and-owner-contract",
+        introducedIn: "0.16.0",
+        sql: CURRENT_RUNTIME_CONTRACT_SQL,
+        migrateData: migrateCurrentRuntimeContract
+    },
+    {
+        version: 36,
+        name: "agent-failure-configuration-context",
+        introducedIn: "0.16.0",
+        sql: "SELECT 1; -- Preserve historical errors; absent original launch configuration is explicitly unavailable",
+        migrateData: migrateAgentFailureContext
+    },
+    {
+        version: 37,
+        name: "narrow-agent-failure-context",
+        introducedIn: "0.16.0",
+        sql: "SELECT 1; -- Archive full v36 failure snapshots; retain only native metadata selectors",
+        migrateData: migrateNarrowAgentFailureContext
     }
 ]);
 for (let index = 0; index < MIGRATIONS.length; index += 1) {
@@ -1571,6 +1712,7 @@ export function migrateSqliteSchema(db, options) {
 }
 /** The names of every table the schema creates (for tests/introspection). */
 export const SQLITE_SCHEMA_TABLES = [
+    "storage_migration_archive",
     "plugin_intents",
     "plugin_validations",
     "local_resources",
@@ -1589,7 +1731,6 @@ export const SQLITE_SCHEMA_TABLES = [
     "managed_workspaces",
     "id_sequences",
     "coordination_locks",
-    "integration_queue",
     "durable_jobs",
     "outbox",
     "mailboxes",