@zq-silk/yui 0.15.3 → 0.15.6

package/dist/agent/managedRuntimeEnvironment.js

@@ -20,6 +20,9 @@ export const YUI_MANAGED_RUNTIME_ENVIRONMENT_NAMES = Object.freeze([
     "YUI_RUNTIME_GENERATION_ID",
     "YUI_NATIVE_SESSION_ROOT",
     "YUI_NATIVE_SESSION_ID",
+    // Retired: Yui no longer publishes a frozen control-plane descriptor into a
+    // managed process. Sessions launched by an earlier release still carry it, so
+    // it stays in this sanitize list.
     "YUI_CONTROL_PLANE_DESCRIPTOR",
     "YUI_TASK_RUNTIME_ISOLATION_DESCRIPTOR",
     "YUI_TASK_RUNTIME_SERVICE_NAMESPACE",

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { spawnSync } from "node:child_process";
 import { readFileSync } from "node:fs";
-import { join, resolve } from "node:path";
+import { resolve } from "node:path";
 import { createInterface } from "node:readline/promises";
 import { fileURLToPath } from "node:url";
 import { isDeepStrictEqual } from "node:util";
@@ -91,7 +91,7 @@ import { TmuxWebTerminalService } from "./web/tmuxWebTerminal.js";
 import { listOperatorSessions, operatorSessionRef } from "./operator/operatorSessionHistory.js";
 import { YUI_VERSION, yuiVersionIdentity } from "./version.js";
 import { SqliteSchemaMigrationError } from "./storage/sqliteSchema.js";
-import { YUI_CONTROL_PLANE_DESCRIPTOR, assertCompatibleControlPlanePreflight, assertExactControlPlanePreflight, exactControlPlaneDigest, extractExactControlArgument, createExactControlPlaneDescriptor, parseExactControlPlaneDescriptor } from "./runtime/exactControlPlane.js";
+import { assertRuntimeCoherence, } from "./runtime/runtimeCoherence.js";
 import { requireManagedTaskCaller } from "./runtime/managedCaller.js";
 import { readSessionBootstrapManifest, refreshManagedSessionCliWrappers } from "./context/sessionBootstrapManifest.js";
 import { createTaskFinalReviewContract, extractTaskFinalReviewRequest } from "./review/taskFinalReviewContract.js";
@@ -101,8 +101,7 @@ import { isCompletedTaskReviewEvidence } from "./review/reviewAcceptance.js";
 import { NodeGitWorkspace } from "./repository/gitWorkspace.js";
 import { currentWorkItemExecutionGroup } from "./workItem/workItem.js";
 const VERSION = YUI_VERSION;
-const exactControlInvocation = extractExactControlArgument(process.argv.slice(2));
-const taskFinalReviewInvocation = extractTaskFinalReviewRequest(exactControlInvocation.args);
+const taskFinalReviewInvocation = extractTaskFinalReviewRequest(process.argv.slice(2));
 const rawArgs = [...taskFinalReviewInvocation.args];
 const jsonOutput = rawArgs.includes("--json");
 const args = normalizeAliases(jsonOutput ? rawArgs.filter((argument) => argument !== "--json") : rawArgs);
@@ -140,8 +139,7 @@ export async function main() {
     const home = resolveYuiHome(process.env);
     const routedForFence = args.length === 0 ? undefined : routeInvocation(args);
     const managedInvocation = process.env.YUI_SESSION_SCOPE === "task"
-        || process.env.YUI_SESSION_SCOPE === "global"
-        || process.env[YUI_CONTROL_PLANE_DESCRIPTOR] !== undefined;
+        || process.env.YUI_SESSION_SCOPE === "global";
     const homeFreeInvocation = args.length === 0
         || (args[0] === "version" && args.length === 1)
         || routedForFence?.kind === "help"
@@ -171,7 +169,7 @@ export async function main() {
         process.exitCode = delegated.status ?? 5;
         return;
     }
-    const { contract: taskFinalReviewContract, verifiedStore, controlPlane: exactCurrentControlPlane } = await preflightManagedTaskControlPlane();
+    const { contract: taskFinalReviewContract, verifiedStore } = await preflightManagedTaskControlPlane();
     if (args.length === 0) {
         emit(renderCommandHelp((await import("./cli/commandCatalog.js")).ROOT_COMMAND, VERSION));
         return;
@@ -315,7 +313,7 @@ export async function main() {
                 || (process.env.YUI_SESSION_SCOPE === "global" && process.env.YUI_ROLE !== "operator")) {
                 throw usageError("Managed Session CLI refresh may be run only by the user or global Operator.");
             }
-            const result = refreshManagedSessionCliWrappers(home, currentInvocationControlPlane(home));
+            const result = refreshManagedSessionCliWrappers(home, currentInvocationEntryPoint());
             emit(`Refreshed ${result.refreshed} managed Session CLI wrapper(s); `
                 + `${result.current} already current, ${result.skipped} skipped.`, false, result);
             return;
@@ -1506,74 +1504,31 @@ function explicitReleaseActivationDriver() {
     return resolveReleaseActivationDriver(resolveYuiHome(process.env), args[2], fileURLToPath(import.meta.url));
 }
 async function preflightManagedTaskControlPlane() {
-    if (exactControlInvocation.error !== undefined) {
-        throw new Error(exactControlInvocation.error);
-    }
     if (taskFinalReviewInvocation.error !== undefined) {
         throw new Error(taskFinalReviewInvocation.error);
     }
-    const serializedControl = process.env[YUI_CONTROL_PLANE_DESCRIPTOR];
-    const exactAgentRuntime = serializedControl !== undefined;
-    if (process.env.YUI_SESSION_SCOPE === "task" && !exactAgentRuntime) {
-        throw new Error("Exact control-plane invocation requires its frozen descriptor in a managed Task runtime.");
-    }
-    if (!exactAgentRuntime) {
-        if (exactControlInvocation.digest !== undefined
-            || process.env.YUI_SESSION_SCOPE === "global") {
-            return await preflightManagedGlobalControlPlane(exactControlInvocation.digest);
+    if (process.env.YUI_SESSION_SCOPE !== "task") {
+        if (process.env.YUI_SESSION_SCOPE === "global") {
+            return await preflightManagedGlobalControlPlane();
         }
         if (taskFinalReviewInvocation.request !== undefined) {
-            throw new Error("Task final-review contract requires a verified exact Task control-plane invocation.");
+            throw new Error("Task final-review contract may only be established from the Task Leader's managed Session.");
         }
-        return { contract: undefined, controlPlane: undefined, verifiedStore: undefined };
+        return { contract: undefined, verifiedStore: undefined };
     }
-    if (process.env.YUI_SESSION_SCOPE !== "task") {
-        throw new Error("Exact Task control-plane invocation requires a managed Task runtime.");
-    }
-    if (serializedControl === undefined) {
-        throw new Error("Exact control-plane invocation is required for this managed Task runtime.");
-    }
-    const control = parseExactControlPlaneDescriptor(serializedControl);
     const internalCallback = args[0] === "internal"
         && ["agent-host", "session-notify", "runtime-hook"].includes(args[1] ?? "");
     const home = resolveYuiHome(process.env);
-    assertManagedSessionManifest(home, "task");
-    if (resolve(control.yuiHome) !== resolve(home)) {
-        throw new Error("Managed Task control-plane descriptor belongs to another YUI_HOME.");
-    }
-    const frozenDigest = exactControlPlaneDigest(control);
-    const exactCommand = internalCallback || exactControlInvocation.digest !== undefined;
-    let commandControl;
-    let digest;
-    if (exactCommand) {
-        digest = exactControlInvocation.digest ?? frozenDigest;
-        await assertExactControlPlanePreflight({
-            serializedDescriptor: serializedControl,
-            digest,
-            actualExecutable: process.execPath,
-            actualCliEntry: fileURLToPath(import.meta.url),
-            actualHome: home
-        }, {
-            // Provider callbacks must remain able to append their immutable inbox fact
-            // while the Controller is offline. They still validate executable, CLI,
-            // Home, schema, and the exact Task runtime envelope first.
-            checkController: !internalCallback
-        });
-        commandControl = control;
-    }
-    else {
-        await assertCompatibleControlPlanePreflight({ actualHome: home });
-        // Package/build identity is deliberately not part of ordinary Session
-        // continuity. Keep contracts on the Session's frozen digest while the
-        // current CLI is proven protocol/storage compatible.
-        commandControl = control;
-        digest = frozenDigest;
-    }
-    const verifiedStore = openCurrentTaskStore(control.yuiHome);
+    const manifest = assertManagedSessionManifest(home, "task");
+    // One gate for every managed command: the current CLI, Home, and Controller
+    // must agree. Internal callbacks must still be able to append their immutable
+    // fact while the Controller is offline.
+    await assertRuntimeCoherence({ actualHome: home }, { checkController: !internalCallback });
+    const verifiedStore = openCurrentTaskStore(home);
     // One authority for "may this process act as this Task Role?". Yui's own
-    // internal callbacks run in the Host process and authenticate through the
-    // exact control-plane digest verified above; an Agent command proves it is
-    // the Role's current runtime with its per-Session caller key. Nothing here
+    // internal callbacks run inside the Host process Yui itself launched; an Agent
+    // command proves it is the Role's current runtime with its per-Session caller
+    // key. Nothing here
     // gates on the current Turn: which Turn is active is durable state that the
     // command needing it reads, never a fact frozen into a process environment.
     const runtime = internalCallback
@@ -1581,14 +1536,10 @@ async function preflightManagedTaskControlPlane() {
         : requireManagedTaskCaller(verifiedStore, process.env);
     const request = taskFinalReviewInvocation.request;
     if (request === undefined) {
-        return {
-            contract: undefined,
-            controlPlane: { digest, descriptor: commandControl },
-            verifiedStore
-        };
+        return { contract: undefined, verifiedStore };
     }
     if (runtime === undefined || runtime.roleName !== "leader") {
-        throw new Error("Only the exact Task Leader invocation may establish a final-review contract.");
+        throw new Error("Only the Task Leader's managed Session may establish a final-review contract.");
     }
     if (request.taskId !== runtime.taskId) {
         throw new Error(`Task final-review contract Task id mismatch: expected ${runtime.taskId}, found ${request.taskId}.`);
@@ -1602,28 +1553,14 @@ async function preflightManagedTaskControlPlane() {
     return {
         contract: createTaskFinalReviewContract({
             taskId: runtime.taskId,
-            reviewerRoleName: request.reviewerRoleName,
-            // Once Task evidence establishes a contract, a compatible Session or
-            // CLI replacement presents that same capability. Package/build identity
-            // must not force a release rebind or invalidate delivery evidence.
-            controlPlaneDigest: recordedContract?.controlPlaneDigest ?? digest
+            reviewerRoleName: request.reviewerRoleName
         }),
-        controlPlane: { digest, descriptor: commandControl },
         verifiedStore
     };
 }
-async function preflightManagedGlobalControlPlane(digest) {
-    if (process.env.YUI_SESSION_SCOPE !== "global") {
-        throw new Error("A control-plane digest was supplied outside a managed Session runtime. "
-            + "Run the command through the Role's own Session entry point, or use the "
-            + "ordinary yui command.");
-    }
+async function preflightManagedGlobalControlPlane() {
     if (taskFinalReviewInvocation.request !== undefined) {
-        throw new Error("Task final-review contract establishment requires a verified exact Task control-plane invocation.");
-    }
-    const manifestPath = process.env.YUI_SESSION_MANIFEST;
-    if (manifestPath === undefined) {
-        throw new Error("Managed global control-plane invocation requires its Session Manifest.");
+        throw new Error("Task final-review contract may only be established from the Task Leader's managed Session.");
     }
     const home = resolveYuiHome(process.env);
     const manifest = assertManagedSessionManifest(home, "global");
@@ -1632,47 +1569,18 @@ async function preflightManagedGlobalControlPlane(digest) {
         || manifest.roleKind !== expectedRoleKind) {
         throw new Error("Managed global invocation does not match its Session Manifest.");
     }
-    const serializedDescriptor = readFileSync(manifest.controlPlane.descriptorPath, "utf8");
-    const descriptor = parseExactControlPlaneDescriptor(serializedDescriptor);
-    if (resolve(descriptor.yuiHome) !== resolve(home)) {
-        throw new Error("Managed global control-plane descriptor belongs to another YUI_HOME.");
-    }
-    const frozenDigest = exactControlPlaneDigest(descriptor);
-    if (frozenDigest !== manifest.controlPlane.digest
-        || resolve(manifest.controlPlane.descriptorPath) !== resolve(join(descriptor.yuiHome, "runtime", "control-plane", `${frozenDigest}.json`))
-        || resolve(manifestPath) !== resolve(join(descriptor.yuiHome, "runtime", "session-manifests", `${manifest.digest}.json`))) {
-        throw new Error("Exact global Session Manifest does not match its control-plane descriptor.");
-    }
-    let commandControl;
-    let commandDigest;
-    if (digest !== undefined) {
-        await assertExactControlPlanePreflight({
-            serializedDescriptor,
-            digest,
-            actualExecutable: process.execPath,
-            actualCliEntry: fileURLToPath(import.meta.url),
-            actualHome: home
-        });
-        commandControl = descriptor;
-        commandDigest = digest;
-    }
-    else {
-        await assertCompatibleControlPlanePreflight({ actualHome: home });
-        commandControl = currentInvocationControlPlane(home);
-        commandDigest = exactControlPlaneDigest(commandControl);
-    }
-    return {
-        contract: undefined,
-        controlPlane: { digest: commandDigest, descriptor: commandControl },
-        verifiedStore: openCurrentTaskStore(home)
-    };
+    await assertRuntimeCoherence({ actualHome: home });
+    return { contract: undefined, verifiedStore: openCurrentTaskStore(home) };
 }
-function currentInvocationControlPlane(home) {
-    return createExactControlPlaneDescriptor({
+/**
+ * The entry point the current invocation resolves to. Only its executable and
+ * CLI path are used, to retarget managed Session wrappers at this installation.
+ */
+function currentInvocationEntryPoint() {
+    return {
         executable: process.execPath,
-        cliEntry: fileURLToPath(import.meta.url),
-        yuiHome: home
-    });
+        cliEntry: fileURLToPath(import.meta.url)
+    };
 }
 function assertManagedSessionManifest(home, scope) {
     const manifestPath = process.env.YUI_SESSION_MANIFEST;

package/dist/commands/executionAuditCommands.js

@@ -189,6 +189,8 @@ export function renderExecutionAudit(report, width = defaultTableWidth()) {
                 { header: "Role", minWidth: 8, maxWidth: 12 },
                 { header: "Category", minWidth: 12, maxWidth: 20 },
                 { header: "Code", minWidth: 16, maxWidth: 32 },
+                { header: "Input", minWidth: 12, maxWidth: 14 },
+                { header: "Registered", minWidth: 12, maxWidth: 14 },
                 { header: "Session", minWidth: 12, maxWidth: 16 }
             ], errors.entries.map((entry) => [
                 entry.taskId,
@@ -196,6 +198,10 @@ export function renderExecutionAudit(report, width = defaultTableWidth()) {
                 entry.roleName,
                 entry.category,
                 entry.code,
+                entry.inputDisposition,
+                // Blank, not "unknown": the Host reports "unknown" as a real
+                // observation, and a reader must be able to tell the two apart.
+                entry.registrationDisposition ?? "—",
                 entry.sessionDisposition
             ]), width));
         }

package/dist/commands/taskContextCommand.js

@@ -300,7 +300,7 @@ export function runTaskContextCommand(args, store, currentTaskReviewCandidate =
                             `      Review policy: ${candidate.reviewPolicy === undefined ? "none" : `${candidate.reviewPolicy.roleName} (${candidate.reviewPolicy.trigger})`}`,
                             `      Task-final contract: ${candidate.taskFinalReviewContract === undefined
                                 ? "none"
-                                : `${candidate.taskFinalReviewContract.digest} via control ${candidate.taskFinalReviewContract.controlPlaneDigest}`}`,
+                                : `Reviewer ${candidate.taskFinalReviewContract.reviewerRoleName}`}`,
                             `      Frozen Git: ${candidate.gitSnapshot === undefined
                                 ? "unavailable"
                                 : `${candidate.gitSnapshot.reviewBaseCommit} (${candidate.gitSnapshot.projects.length} Projects)`}`,
@@ -442,7 +442,9 @@ function renderReviewRounds(rounds, executionGroupsById = new Map()) {
             ? [
                 `      Frozen Task heads: ${latest.taskCandidate?.projects
                     .map(({ projectId, commit }) => `${projectId}@${commit}`).join(", ") ?? "unavailable"}`,
-                `      Task-final contract: ${latest.taskFinalReviewContract?.digest ?? "global policy"}`,
+                `      Task-final contract: ${latest.taskFinalReviewContract === undefined
+                    ? "global policy"
+                    : `Reviewer ${latest.taskFinalReviewContract.reviewerRoleName}`}`,
                 ...(latest.deltaRecheck === undefined
                     ? [`      Review mode: full`]
                     : [

package/dist/context/sessionBootstrapManifest.js

@@ -1,7 +1,6 @@
 import { createHash } from "node:crypto";
 import { chmodSync, existsSync, readFileSync, readdirSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
-import { exactControlPlaneDigest, serializeExactDescriptor } from "../runtime/exactControlPlane.js";
 import { writeTextFileAtomically } from "../storage/durableFile.js";
 import { SESSION_BOOTSTRAP_MANIFEST_SCHEMA_VERSION, SESSION_CONTEXT_PROTOCOL, sessionManifestCompatibilityDigest } from "./sessionProtocolIdentity.js";
 export { SESSION_BOOTSTRAP_MANIFEST_SCHEMA_VERSION, SESSION_CONTEXT_PROTOCOL, sessionManifestCompatibilityDigest } from "./sessionProtocolIdentity.js";
@@ -13,11 +12,11 @@ const ordinarySessionCli = ["#!/bin/sh", "exec yui \"$@\"", ""].join("\n");
  * a Session legitimately outlives it, so embedding it here would turn an
  * ordinary update into a broken Session.
  */
-function renderSessionCli(controlPlane) {
+function renderSessionCli(entryPoint) {
     return [
         "#!/bin/sh",
-        `exec ${quoteShellWord(controlPlane.executable)} `
-            + `${quoteShellWord(controlPlane.cliEntry)} \"$@\"`,
+        `exec ${quoteShellWord(entryPoint.executable)} `
+            + `${quoteShellWord(entryPoint.cliEntry)} \"$@\"`,
         ""
     ].join("\n");
 }
@@ -68,9 +67,7 @@ export function readSessionBootstrapManifest(path) {
         throw new Error("Task Session Manifest owner is invalid.");
     }
     const control = record.controlPlane;
-    requireText(control.descriptorPath, "Session Manifest control descriptor path");
     requireText(control.sessionCliPath, "Session Manifest CLI path");
-    requireDigest(control.digest, "Session Manifest control-plane digest");
     for (const skill of record.skills) {
         if (skill === null || typeof skill !== "object") {
             throw new Error("Session Manifest Skill entry is invalid.");
@@ -92,15 +89,12 @@ export function readSessionBootstrapManifest(path) {
 }
 export function materializeSessionBootstrap(input) {
     const home = resolve(input.yuiHome);
-    const controlDigest = exactControlPlaneDigest(input.controlPlane);
-    const descriptorPath = resolve(join(home, "runtime", "control-plane", `${controlDigest}.json`));
-    writeImmutableText(descriptorPath, `${serializeExactDescriptor(input.controlPlane)}\n`);
     // Provider command runners may rebuild PATH independently of the managed
     // process environment, so a bare `yui` could resolve to another install or
     // Home. The wrapper pins the resolved entry point instead. Package identity
     // stays out of it: the compatible continuity preflight and the Session's
     // caller key already authorize the command.
-    const sessionCliContent = renderSessionCli(input.controlPlane);
+    const sessionCliContent = renderSessionCli(input.entryPoint);
     const sessionCliDigest = digest(sessionCliContent);
     const sessionCliPath = resolve(join(home, "runtime", "session-cli", `yui-${sessionCliDigest}.sh`));
     writeImmutableText(sessionCliPath, sessionCliContent);
@@ -127,9 +121,7 @@ export function materializeSessionBootstrap(input) {
         roleKind: input.roleKind,
         compatibilityDigest: sessionManifestCompatibilityDigest(input.role.name, input.roleKind, input.role),
         controlPlane: {
-            descriptorPath,
-            sessionCliPath,
-            digest: controlDigest
+            sessionCliPath
         },
         skills: input.skills.map((skill) => Object.freeze({
             id: skill.id,
@@ -142,7 +134,7 @@ export function materializeSessionBootstrap(input) {
                 // A Global Session may move between Yui's remote TUI and Desktop.
                 // Carry its read entry in the Thread-visible Manifest instead of
                 // depending on the client process that happened to create it.
-                loadCommand: renderGlobalContextCommand(input.controlPlane, home, input.role.name)
+                loadCommand: renderGlobalContextCommand(input.entryPoint, home, input.role.name)
             }
             : {
                 loadCommand: "\"$YUI_SESSION_CLI\" task turn context \"$YUI_TASK_ID/<turn-id>\" --json",
@@ -156,15 +148,14 @@ export function materializeSessionBootstrap(input) {
         manifest,
         manifestPath,
         sessionCliPath,
-        roleProfilePath,
-        descriptorPath
+        roleProfilePath
     });
 }
-function renderGlobalContextCommand(controlPlane, home, roleName) {
+function renderGlobalContextCommand(entryPoint, home, roleName) {
     return [
         `YUI_HOME=${quoteShellWord(home)}`,
-        quoteShellWord(controlPlane.executable),
-        quoteShellWord(controlPlane.cliEntry),
+        quoteShellWord(entryPoint.executable),
+        quoteShellWord(entryPoint.cliEntry),
         "session",
         "context",
         quoteShellWord(roleName),
@@ -181,9 +172,9 @@ function quoteShellWord(value) {
  * an earlier release may still pin a control-plane digest; retargeting it here
  * is what removes that stale pin from a live Home.
  */
-export function refreshManagedSessionCliWrappers(homeInput, controlPlane) {
+export function refreshManagedSessionCliWrappers(homeInput, entryPoint) {
     const home = resolve(homeInput);
-    const currentSessionCli = renderSessionCli(controlPlane);
+    const currentSessionCli = renderSessionCli(entryPoint);
     const manifestDirectory = resolve(join(home, "runtime", "session-manifests"));
     const sessionCliDirectory = resolve(join(home, "runtime", "session-cli"));
     if (!existsSync(manifestDirectory)) {

package/dist/controller/clientRuntime.js

@@ -7,7 +7,7 @@ import { AGENT_OPERATIONAL_ENVIRONMENT_NAMES, nativeAgentEnvironmentNames, opera
 import { openCurrentTaskStore } from "../storage/currentTaskStore.js";
 import { yuiTmuxServerName } from "../tmux/tmuxManager.js";
 import { hasRuntimeLifecycleWork } from "../runtime/lifecycleReservation.js";
-import { assertControllerStatusIdentity } from "../runtime/exactControlPlane.js";
+import { assertControllerStatusIdentity } from "../runtime/runtimeCoherence.js";
 import { EPHEMERAL_DOMAIN_ENVIRONMENT_NAMES } from "./domainIdentity.js";
 import { yuiVersionIdentity } from "../version.js";
 import { SessionOwnerReconciliation } from "./sessionOwnerReconciliation.js";