ai-foreman 1.7.20 → 1.7.21

package/dist/qaVerificationContract.js

@@ -0,0 +1,236 @@
+import { Ajv } from "ajv";
+import { qaContractCandidateV1Schema, qaSemanticAssessmentV1Schema, qaChallengeReceiptV1Schema } from "rafi-spec";
+const contractAjv = new Ajv({ allErrors: true });
+const candidateSchema = contractAjv.compile(qaContractCandidateV1Schema);
+const assessmentSchema = contractAjv.compile(qaSemanticAssessmentV1Schema);
+const challengeSchema = contractAjv.compile(qaChallengeReceiptV1Schema);
+import { createHash } from "node:crypto";
+import { canonicalJson } from "./qaProtocolV2.js";
+import { depthObligations, validateDepthDecision } from "./qaPreparationPolicy.js";
+export function canonicalContractJson(value) {
+    const serialized = JSON.stringify(value);
+    if (serialized === undefined)
+        throw new Error("Contract artifacts must have a JSON representation");
+    return canonicalJson(JSON.parse(serialized));
+}
+export function contractDigest(domain, value) { return createHash("sha256").update(`rafi:${domain}:v1\n`).update(canonicalContractJson(value)).digest("hex"); }
+export function candidatePayload(contract) {
+    const { contentDigest: _content, draftPayloadDigest: _draft, semanticAssessmentDigest: _semantic, challengeReceiptDigest: _challenge, ...payload } = contract;
+    return payload;
+}
+export function draftDigest(candidate) { return contractDigest("qa-contract-draft", candidatePayload(candidate)); }
+/** Allocate identities from meaning, replacing proposed agent IDs throughout the draft. */
+export function allocateStableCheckIds(candidate) {
+    const draft = structuredClone(candidate), mapping = new Map(), counts = new Map();
+    const proposed = new Map(draft.checks.map(check => [check.id, check]));
+    if (proposed.size !== draft.checks.length)
+        throw new Error("Duplicate proposed check identity");
+    const fingerprints = new Map(), active = new Set();
+    const fingerprintFor = (id) => {
+        const prior = fingerprints.get(id);
+        if (prior)
+            return prior;
+        const check = proposed.get(id);
+        if (!check)
+            throw new Error(`Unknown proposed dependency ${id}`);
+        if (active.has(id))
+            throw new Error(`Check dependency cycle ${id}`);
+        active.add(id);
+        const { id: _id, successorOf: _successor, dependsOnChecks, ...meaning } = check;
+        const fingerprint = contractDigest("check-identity", { ...meaning, requirementRefs: [...meaning.requirementRefs].sort(), prerequisiteRefs: [...meaning.prerequisiteRefs].sort(), dependencies: dependsOnChecks.map(fingerprintFor).sort() });
+        active.delete(id);
+        fingerprints.set(id, fingerprint);
+        return fingerprint;
+    };
+    for (const check of draft.checks) {
+        const fingerprint = fingerprintFor(check.id), occurrence = counts.get(fingerprint) ?? 0;
+        counts.set(fingerprint, occurrence + 1);
+        mapping.set(check.id, `check-${fingerprint.slice(0, 24)}-${occurrence}`);
+    }
+    const replace = (id) => { const replacement = mapping.get(id); if (!replacement)
+        throw new Error(`Unknown proposed check reference ${id}`); return replacement; };
+    for (const check of draft.checks) {
+        check.id = replace(check.id);
+        check.dependsOnChecks = check.dependsOnChecks.map(replace);
+    }
+    for (const row of draft.coverage)
+        row.checkIds = row.checkIds.map(replace);
+    for (const observation of draft.baseline)
+        if (observation.checkId)
+            observation.checkId = replace(observation.checkId);
+    for (const concern of draft.unresolved)
+        concern.checkIds = concern.checkIds.map(replace);
+    return draft;
+}
+export function inventoryDigest(requirements) { return contractDigest("qa-requirement-inventory", requirements); }
+export function authoritativeInventory(ticket, checklist, inputs) {
+    const result = [];
+    for (const [kind, entries] of [["acceptance", ticket.acceptance], ["required_tests", ticket.required_tests], ["checklist", checklist]]) {
+        const input = inputs.find(ref => ref.kind === (kind === "checklist" ? "checklist" : "ticket"));
+        if (!input)
+            throw new Error(`Missing authoritative ${kind} input`);
+        const occurrences = new Map();
+        entries.forEach((statement, index) => {
+            const fingerprint = contractDigest("requirement-statement", { kind, statement });
+            const occurrence = occurrences.get(fingerprint) ?? 0;
+            occurrences.set(fingerprint, occurrence + 1);
+            result.push({ id: `req-${fingerprint.slice(0, 24)}-${occurrence}`, inputRef: input.id, locator: `${kind}[${index}]`, statement,
+                digest: contractDigest("statement", statement), obligation: "mandatory", origin: "explicit", authority: "approved" });
+        });
+    }
+    return result;
+}
+export function parsePreparationArtifact(text, tag, maximum = 2 * 1024 * 1024) {
+    if (Buffer.byteLength(text) > maximum)
+        throw new Error("QA preparation response exceeds size limit");
+    const start = `${tag}_START`, end = `${tag}_END`;
+    if (text.split(start).length !== 2 || text.split(end).length !== 2)
+        throw new Error(`Expected exactly one ${tag} artifact`);
+    const from = text.indexOf(start) + start.length, to = text.indexOf(end);
+    if (to < from)
+        throw new Error("Malformed preparation artifact envelope");
+    return JSON.parse(text.slice(from, to).trim());
+}
+export function validateCandidate(candidate, inventory, resolveEquivalent) {
+    if (!candidateSchema(candidatePayload(candidate)))
+        return (candidateSchema.errors ?? []).map(error => `${error.instancePath} ${error.message}`);
+    const issues = validateDepthDecision(candidate.depthDecision);
+    if (candidate.version !== 1 || !candidate.contractId || !candidate.runId || !candidate.workId || !candidate.admissionDigest || !Number.isSafeInteger(candidate.revision) || candidate.revision < 1)
+        issues.push("Invalid contract identity");
+    for (const field of ["inputs", "baseline", "requirements", "checks", "coverage", "preparationEvidence", "unresolved"])
+        if (!Array.isArray(candidate[field]))
+            issues.push(`Missing ${field} array`);
+    if (issues.length)
+        return issues;
+    const unique = (items, label) => {
+        const ids = new Set();
+        for (const item of items) {
+            if (!item.id || ids.has(item.id))
+                issues.push(`Duplicate/missing ${label} ID ${item.id}`);
+            ids.add(item.id);
+        }
+        return ids;
+    };
+    const inputs = unique(candidate.inputs, "input"), requirements = unique(candidate.requirements, "requirement"), checks = unique(candidate.checks, "check");
+    for (const expected of inventory)
+        if (!candidate.requirements.some(actual => canonicalJson(actual) === canonicalJson(expected)))
+            issues.push(`Missing/altered authoritative requirement ${expected.id}`);
+    for (const input of candidate.inputs)
+        if (input.availability !== "available" || !/^[a-f0-9]{64}$/.test(input.digest))
+            issues.push(`Unavailable/invalid input ${input.id}`);
+    for (const req of candidate.requirements) {
+        if (!inputs.has(req.inputRef) || !req.statement?.trim() || req.digest !== contractDigest("statement", req.statement))
+            issues.push(`Invalid source/statement ${req.id}`);
+        if (req.conflict)
+            issues.push(`Unresolved requirement conflict ${req.id}`);
+        if (req.authority === "proposed" && req.obligation === "mandatory")
+            issues.push(`Proposed scope cannot be mandatory ${req.id}`);
+        const rows = candidate.coverage.filter(row => row.requirementId === req.id);
+        if (rows.length !== 1 || !rows[0].checkIds.length || rows[0].dispositionRef)
+            issues.push(`Requirement lacks concrete coverage ${req.id}`);
+        for (const id of rows[0]?.checkIds ?? [])
+            if (!checks.has(id) || !candidate.checks.find(check => check.id === id)?.requirementRefs.includes(req.id))
+                issues.push(`Invalid coverage ${req.id}/${id}`);
+        if (req.obligation === "mandatory" && !(rows[0]?.checkIds ?? []).some(id => candidate.checks.find(check => check.id === id)?.obligation === "mandatory"))
+            issues.push(`Mandatory requirement only covered by advisory checks ${req.id}`);
+    }
+    for (const row of candidate.coverage)
+        if (!requirements.has(row.requirementId))
+            issues.push(`Unknown coverage requirement ${row.requirementId}`);
+    for (const check of candidate.checks) {
+        if (!check.requirementRefs?.length || check.requirementRefs.some(id => !requirements.has(id)))
+            issues.push(`Unknown requirement on ${check.id}`);
+        if (!check.expectedBehavior?.trim() || !check.expectedEvidence?.length || !check.verification?.length)
+            issues.push(`Nonactionable check ${check.id}`);
+        if (!["mandatory", "advisory"].includes(check.obligation) || !["preimplementation", "postimplementation", "both"].includes(check.timing))
+            issues.push(`Illegal obligation/timing ${check.id}`);
+        if (!check.applicability || !["unconditional", "conditional"].includes(check.applicability.kind) || !["host", "qa"].includes(check.applicability.decisionOwner))
+            issues.push(`Invalid applicability ${check.id}`);
+        else if (check.applicability.kind === "conditional" && (!check.applicability.predicate?.trim() || !check.applicability.requiredEvidence?.length))
+            issues.push(`Underspecified predicate ${check.id}`);
+        if (check.obligation === "mandatory" && check.timing !== "postimplementation") {
+            const readiness = candidate.baseline.find(observation => observation.checkId === check.id);
+            if (!readiness || readiness.applicability === "unresolved" || !readiness.applicability || check.applicability.kind === "unconditional" && readiness.applicability !== "applicable" || readiness.applicability === "applicable" && readiness.status !== "passed" || readiness.applicability === "not-applicable" && !readiness.predicateEvidence?.length)
+                issues.push(`Mandatory preimplementation readiness incomplete ${check.id}`);
+            if (check.applicability.kind === "conditional" && readiness?.applicability === "applicable" && !readiness.predicateEvidence?.length)
+                issues.push(`Preimplementation predicate evidence missing ${check.id}`);
+        }
+        if (check.dispositionRef)
+            issues.push(`Disposition requires resolved persisted authority ${check.id}`);
+        for (const method of check.verification ?? []) {
+            if (!method.expectedOutcome?.trim() || !method.runtime?.trim() || !Number.isSafeInteger(method.timeoutMs) || method.timeoutMs < 1 || method.timeoutMs > 3_600_000 || method.cwd.startsWith("/") || method.cwd.split(/[\\/]/).includes(".."))
+                issues.push(`Invalid method ${check.id}`);
+            if (method.kind === "command" ? !method.argv?.length || method.argv.some(arg => typeof arg !== "string") : method.kind !== "procedure" || !method.steps?.length)
+                issues.push(`Missing verification procedure ${check.id}`);
+            if (method.equivalentAuthorityId && !resolveEquivalent?.(method.equivalentAuthorityId, candidate, check, method))
+                issues.push(`Equivalent method requires persisted authority ${check.id}`);
+        }
+        if (!Array.isArray(check.dependsOnChecks) || !Array.isArray(check.prerequisiteRefs))
+            issues.push(`Missing dependencies ${check.id}`);
+        for (const id of check.dependsOnChecks ?? [])
+            if (!checks.has(id))
+                issues.push(`Unknown dependency ${id}`);
+        for (const id of check.prerequisiteRefs ?? [])
+            if (!candidate.baseline.some(observation => observation.id === id))
+                issues.push(`Unknown prerequisite ${id}`);
+    }
+    const active = new Set(), visited = new Set();
+    const visit = (id) => { if (active.has(id)) {
+        issues.push(`Check dependency cycle ${id}`);
+        return;
+    } if (visited.has(id))
+        return; active.add(id); for (const dep of candidate.checks.find(check => check.id === id)?.dependsOnChecks ?? [])
+        visit(dep); active.delete(id); visited.add(id); };
+    for (const id of checks)
+        visit(id);
+    for (const obligation of depthObligations(candidate.depthDecision.level))
+        if (!candidate.preparationEvidence.some(evidence => evidence.obligation === obligation && evidence.analysis?.trim() && evidence.evidenceDigest && evidence.operationId && evidence.sessionId && evidence.references.length))
+            issues.push(`Missing depth evidence ${obligation}`);
+    if (candidate.unresolved.some(concern => concern.material))
+        issues.push("Unresolved material concern");
+    return [...new Set(issues)];
+}
+export function validateAssessment(candidate, assessment, authorSessionId) {
+    const validator = "approach" in assessment ? challengeSchema : assessmentSchema;
+    if (!validator(assessment))
+        return (validator.errors ?? []).map(error => `${error.instancePath} ${error.message}`);
+    const issues = [];
+    if (assessment.version !== 1 || assessment.draftPayloadDigest !== draftDigest(candidate) || assessment.inventoryDigest !== inventoryDigest(candidate.requirements) || assessment.policyVersion !== candidate.depthDecision.policyVersion)
+        issues.push("Assessment does not bind the exact draft/inventory/policy");
+    if (!assessment.operationId || !assessment.sessionId || assessment.sessionId === authorSessionId || assessment.authorSessionId !== authorSessionId)
+        issues.push("Assessment lacks independent authorship");
+    for (const req of candidate.requirements)
+        if (!assessment.assessedRequirementIds?.includes(req.id))
+            issues.push(`Requirement not semantically assessed ${req.id}`);
+    for (const obligation of depthObligations(candidate.depthDecision.level))
+        if (!assessment.assessedObligations?.includes(obligation))
+            issues.push(`Obligation not assessed ${obligation}`);
+    if (!Array.isArray(assessment.concerns) || assessment.concerns.some(concern => concern.material))
+        issues.push("Semantic concerns unresolved");
+    return issues;
+}
+export function assembleContract(candidate, inventory, assessment, authorSessionId, challenge, resolveEquivalent) {
+    const issues = [...validateCandidate(candidate, inventory, resolveEquivalent), ...validateAssessment(candidate, assessment, authorSessionId)];
+    if (candidate.depthDecision.level === 5) {
+        if (!challenge)
+            issues.push("Exceptional requires independent challenge");
+        else {
+            issues.push(...validateAssessment(candidate, challenge, authorSessionId));
+            if (!challenge.approach?.trim() || !["scope", "invariants", "failure-boundaries", "verification"].every(category => challenge.concernCategories.includes(category)) || challenge.approachConcerns.some(concern => concern.material))
+                issues.push("Material approach challenge incomplete");
+        }
+    }
+    if (issues.length)
+        throw new Error(issues.join("; "));
+    const body = { ...candidatePayload(candidate), draftPayloadDigest: draftDigest(candidate), semanticAssessmentDigest: contractDigest("artifact-semantic-assessment", assessment), ...(challenge ? { challengeReceiptDigest: contractDigest("artifact-approach-challenge", challenge) } : {}) };
+    return { ...body, contentDigest: contractDigest("qa-contract-content", body) };
+}
+export function verifyContractDigest(contract) {
+    const { contentDigest, ...body } = contract;
+    if (contentDigest !== contractDigest("qa-contract-content", body) || contract.draftPayloadDigest !== draftDigest(contract))
+        throw new Error("Corrupt verification contract");
+}
+export function renderVerificationContract(contract) {
+    return [`Verification contract ${contract.contractId}, revision ${contract.revision}`, `Work: ${contract.workId}; digest: ${contract.contentDigest}`, `Depth: ${contract.depthDecision.level}: ${contract.depthDecision.rationale}`,
+        ...contract.checks.map(check => [`${check.id}: ${check.obligation}; ${check.timing}; ${check.applicability.kind}`, check.expectedBehavior, check.applicability.predicate ?? "Always applicable", `Evidence: ${check.expectedEvidence.join("; ")}`, ...check.verification.map(method => JSON.stringify(method))].join("\n"))].join("\n\n");
+}

package/dist/readinessCleanup.js

@@ -47,9 +47,13 @@ export function inspectReadiness(row, deadline = Date.now() + 5000) {
         return { state: "unknown", reason: "Windows containment unavailable" };
     if (metadata.protocol === "gated-v3" && identity.state !== "dead" && !processGroupQuiescent(row.pid, remaining()))
         return { state: "unknown", reason: "authorized helper can still execute" };
-    return processGroupQuiescent(row.pid, remaining()) && taggedProcesses(row.id, remaining())?.length === 0
-        ? { state: "quiescent", reason: "group and inherited tag inventory empty" }
-        : { state: "unknown", reason: "owned group or tagged descendants active or unavailable" };
+    if (!processGroupQuiescent(row.pid, remaining()))
+        return { state: "unknown", reason: "owned process group remains active or group inventory is unavailable" };
+    const members = taggedProcesses(row.id, remaining());
+    if (!members)
+        return { state: "unknown", reason: "inherited probe tag inventory is unavailable" };
+    return members.length === 0 ? { state: "quiescent", reason: "group and inherited tag inventory empty" }
+        : { state: "unknown", reason: "tagged probe descendants remain active" };
 }
 const cleanupInFlight = new Map();
 /** Coalesce identical observations in this process; cross-process callers use DB CAS. */
@@ -77,12 +81,15 @@ async function cleanReadiness(row, deadline) {
         catch { /* capability is already fenced */ }
     }
     let attempt = 0;
+    let lastEvidence = { state: "unknown", reason: "cleanup inventory unavailable" };
     do {
         const evidence = inspectReadiness(row, deadline);
         if (evidence.state === "quiescent")
             return evidence;
+        if (evidence.reason !== "cleanup inventory deadline exceeded")
+            lastEvidence = evidence;
         if (Date.now() >= deadline)
-            return evidence;
+            break;
         const signal = attempt++ < 3 ? "SIGTERM" : "SIGKILL";
         if (row.pid) {
             const identity = identityOf(row.pid, row.process_start ?? undefined, row.host);
@@ -111,5 +118,5 @@ async function cleanReadiness(row, deadline) {
             break;
         await new Promise(resolve => setTimeout(resolve, 50));
     } while (Date.now() < deadline);
-    return inspectReadiness(row, deadline);
+    return { state: "unknown", reason: `${lastEvidence.reason}; cleanup verification deadline exceeded` };
 }

package/dist/recoveryGuidance.d.ts

@@ -6,3 +6,12 @@ export declare function formatRecoveryCommand(projectDir: string, family?: Recov
     id: string;
     steps: number;
 }): string;
+/** Fixed choices are executable; custom answers use the owning CLI's input flow. */
+export declare function formatDecisionCommands(projectDir: string, runId: string, decision: {
+    decisionId: string;
+    choices: Array<{
+        id: string;
+        label: string;
+    }>;
+}, family?: RecoveryCommandFamily): string[];
+export declare function formatExactRunRecovery(projectDir: string, runId: string, family?: RecoveryCommandFamily): string;

package/dist/recoveryGuidance.js

@@ -23,3 +23,16 @@ export function formatRecoveryCommand(projectDir, family = commandFamily.getStor
     }
     return canonical(projectDir) === canonical(cwd) ? "rafi resume" : `rafi resume ${shellArgument(resolve(projectDir))}`;
 }
+/** Fixed choices are executable; custom answers use the owning CLI's input flow. */
+export function formatDecisionCommands(projectDir, runId, decision, family = commandFamily.getStore() ?? "rafi") {
+    return decision.choices.flatMap(choice => choice.id === "custom"
+        ? [family === "ai-foreman"
+                ? `  Custom response: use ${family} build:decide ${shellArgument(resolve(projectDir))} --run ${shellArgument(runId)} --decision ${shellArgument(decision.decisionId)} --choice custom with --answer followed by your shell-quoted response.`
+                : `  Custom response: run ${formatExactRunRecovery(projectDir, runId, family)} in an interactive terminal.`]
+        : [`  ${choice.label}`, `  ${family} build:decide ${shellArgument(resolve(projectDir))} --run ${shellArgument(runId)} --decision ${shellArgument(decision.decisionId)} --choice ${shellArgument(choice.id)}`]);
+}
+export function formatExactRunRecovery(projectDir, runId, family = commandFamily.getStore() ?? "rafi") {
+    if (family === "ai-foreman")
+        return `ai-foreman manager ${shellArgument(resolve(projectDir))} --run ${shellArgument(runId)}`;
+    return `rafi resume ${shellArgument(resolve(projectDir))} --run ${shellArgument(runId)}`;
+}

package/dist/runtimeAuth.d.ts

@@ -14,6 +14,7 @@ export declare class RuntimeAuthError extends Error {
     readonly stdout: string;
     readonly stderr: string;
     readonly authLikely: boolean;
+    readonly cleanupUnverified: boolean;
     constructor(opts: RuntimeAuthErrorOptions);
 }
 export declare function checkRuntimeReady(projectDir: string, runtime: AgentRuntime, options?: ProbeRuntimeOptions): Promise<import("rafi-spec").RuntimeProbeResult>;

package/dist/runtimeAuth.js

@@ -1,10 +1,11 @@
-import { formatRuntimeProbeFailure, probeRuntime } from "./runtimeReadiness.js";
+import { formatRuntimeProbeFailure, probeRuntime, RuntimeCleanupError, runtimeCleanupRecoveryHelp } from "./runtimeReadiness.js";
 export class RuntimeAuthError extends Error {
     runtime;
     exitCode;
     stdout;
     stderr;
     authLikely;
+    cleanupUnverified;
     constructor(opts) {
         super(formatRuntimeAuthFailure(opts), { cause: opts.cause });
         this.name = "RuntimeAuthError";
@@ -13,6 +14,7 @@ export class RuntimeAuthError extends Error {
         this.stdout = opts.stdout ?? "";
         this.stderr = opts.stderr ?? "";
         this.authLikely = isRuntimeAuthFailure(`${this.stderr}\n${this.stdout}`);
+        this.cleanupUnverified = opts.cause instanceof RuntimeCleanupError;
     }
 }
 export async function checkRuntimeReady(projectDir, runtime, options = {}) {
@@ -67,6 +69,8 @@ export function runtimeRepairCommands(runtime) {
     ].join("\n");
 }
 export function formatRuntimeAuthFailure(opts) {
+    if (opts.cause instanceof RuntimeCleanupError)
+        return `${opts.cause.message}\n\n${opts.context} is paused before further provider work. This is a process cleanup problem; changing login or provider will not clear it.\n\n${runtimeCleanupRecoveryHelp()}`;
     const output = [opts.stderr, opts.stdout].filter(Boolean).join("\n").trim();
     const exit = opts.exitCode === undefined || opts.exitCode === null ? "unknown" : String(opts.exitCode);
     const authLine = isRuntimeAuthFailure(output)

package/dist/runtimeReadiness.d.ts

@@ -13,6 +13,7 @@ export interface BuildReadinessContext {
 export declare class RuntimeCleanupError extends Error {
     constructor(message: string);
 }
+export declare function runtimeCleanupRecoveryHelp(): string;
 export interface ProbeRuntimeOptions {
     /** Omit only for standalone authentication/capability commands. Build callers use probeBuildRuntime. */
     build?: BuildReadinessContext;

package/dist/runtimeReadiness.js

@@ -20,6 +20,16 @@ export function cancelOwnedRuntimeProbes() { for (const cancel of ownedProbes)
 export class RuntimeCleanupError extends Error {
     constructor(message) { super(message); this.name = "RuntimeCleanupError"; }
 }
+export function runtimeCleanupRecoveryHelp() {
+    return [
+        "Keep this Rafi process open while repairing visibility in another terminal, then choose retry.",
+        "Linux/WSL: check that /proc is mounted and readable by this user. Use a native Linux Node and provider installation in the same WSL distribution; inspect command -v node and command -v claude (or codex).",
+        "macOS: check that ps is available on PATH and process inspection is permitted by the terminal or host sandbox.",
+        "Windows: check that Windows PowerShell and process/Job Object inspection are available to the same user.",
+        "Retry first reconciles the original probe; no new provider starts until cleanup is verified. Avoid restarting Rafi to bypass this check or killing unrelated processes.",
+        "You may cancel deliberately; generated files remain available for a later create walkthrough.",
+    ].join("\n");
+}
 /** Resolve the executable Node will launch without involving a shell. */
 export function resolveExecutablePath(command, env = process.env, platform = process.platform) {
     const hasPathSeparator = command.includes("/") || command.includes("\\");
@@ -260,6 +270,7 @@ async function probeRuntimeInternal(cwd, runtime, opts) {
             // Probe completion and process cleanup are independent. Clean on success too.
             clearTimeout(startupTimer);
             let cleaned = Boolean(spawnError && !child.pid);
+            let cleanupReason = "ownership reconciliation did not verify shutdown";
             if (authority && ownedProcess) {
                 let journal;
                 try {
@@ -280,6 +291,7 @@ async function probeRuntimeInternal(cwd, runtime, opts) {
             else if (child.pid) {
                 const row = { id: tag, run_id: "standalone", owner: "standalone", pid: child.pid, process_start: childStart ?? null, host: (await import("node:os")).hostname(), state: "running", outcome_json: JSON.stringify({ protocol: windows ? "windows-job-v1" : "tagged-v2" }) };
                 const evidence = await cleanupReadiness(row);
+                cleanupReason = evidence.reason;
                 if (evidence.state !== "quiescent") {
                     pendingStandaloneCleanup.set(tag, row);
                     // The trusted holder exits on disconnect; retain the record until OS
@@ -316,7 +328,7 @@ async function probeRuntimeInternal(cwd, runtime, opts) {
             if (!cleaned) {
                 rejectResult(new RuntimeCleanupError(authority
                     ? "Readiness process cleanup is unverified; use rafi resume in the owning project to reconcile before continuing"
-                    : "Standalone probe cleanup is unverified; restore process visibility and retry. No new probe will start until cleanup is verified."));
+                    : `Standalone probe cleanup is unverified (${cleanupReason}); restore process visibility and retry. No new probe will start until cleanup is verified.`));
                 return;
             }
             spawnError ??= providerSpawnError;

package/dist/sessionIdentity.d.ts

@@ -23,6 +23,8 @@ export declare function canonicalSessionPath(path: string): string;
  * administrative Git directory (not in the checked-out tree), so normal edits
  * and commits do not change it while removal/recreation cannot inherit it.
  */
+/** Existing identity only: graph reads must never initialize a worktree marker. */
+export declare function readWorkspaceIdentity(cwd: string): string | undefined;
 export declare function captureWorkspaceIdentity(cwd: string): string | undefined;
 export declare function createProviderSessionRef(input: CreateProviderSessionRefInput): ProviderSessionRefV1;
 /** Identity used by accounting, compaction, settings acknowledgements, and mutation leases. */

package/dist/sessionIdentity.js

@@ -17,6 +17,20 @@ export function canonicalSessionPath(path) {
  * administrative Git directory (not in the checked-out tree), so normal edits
  * and commits do not change it while removal/recreation cannot inherit it.
  */
+/** Existing identity only: graph reads must never initialize a worktree marker. */
+export function readWorkspaceIdentity(cwd) {
+    try {
+        const canonicalCwd = canonicalSessionPath(cwd);
+        const gitDir = canonicalSessionPath(execFileSync("git", ["rev-parse", "--absolute-git-dir"], { cwd: canonicalCwd, encoding: "utf8", timeout: 5000, stdio: ["ignore", "pipe", "ignore"] }).trim());
+        const token = readFileSync(join(gitDir, "rafi-workspace-id-v1"), "utf8").trim();
+        if (!/^[0-9a-f-]{36}$/i.test(token))
+            return undefined;
+        return createHash("sha256").update(`${canonicalCwd}\0${gitDir}\0${token}`).digest("hex");
+    }
+    catch {
+        return undefined;
+    }
+}
 export function captureWorkspaceIdentity(cwd) {
     try {
         const canonicalCwd = canonicalSessionPath(cwd);

package/dist/sessionLifecycle.js

@@ -79,7 +79,7 @@ export class RoleSessionController {
     }
     effectiveThreshold() {
         if (!this.thresholdController)
-            return this.options.settings.auto_compact_threshold_percent ?? 50;
+            return this.options.settings.auto_compact_threshold_percent ?? 65;
         return this.thresholdController.effectiveThreshold();
     }
     async next(durableHandoff, nextSettings) {
@@ -781,11 +781,11 @@ export class ThresholdCompactionController {
             ? effective
             : undefined;
     }
-    threshold() { return this.runOnlyThreshold ?? this.providerEffectiveThreshold ?? this.settings.auto_compact_threshold_percent ?? 50; }
+    threshold() { return this.runOnlyThreshold ?? this.providerEffectiveThreshold ?? this.settings.auto_compact_threshold_percent ?? 65; }
     now() { return this.options.now?.() ?? new Date(); }
 }
 function normalizeContextSettings(settings) {
-    const threshold = settings.auto_compact_threshold_percent ?? 50;
+    const threshold = settings.auto_compact_threshold_percent ?? 65;
     const maximum = settings.compact_maximum ?? 10;
     if (!Number.isInteger(threshold) || threshold < 1 || threshold > 99)
         throw new Error("auto_compact_threshold_percent must be an integer from 1 to 99");

package/dist/sources/sourceRegistry.js

@@ -1,3 +1,4 @@
+import { reconcileGraphSourceSelection } from "../graph/sources.js";
 import { execFile, execFileSync } from "node:child_process";
 import { promisify } from "node:util";
 import { createHash } from "node:crypto";
@@ -67,6 +68,12 @@ export function saveSourceRegistry(projectDir, registry) {
     writeFileSync(configPath, stringify(raw, { lineWidth: 100 }), "utf8");
     backfillUniqueTicketSourceIds(root, registry);
     ensurePrivateCacheIgnored(root);
+    try {
+        reconcileGraphSourceSelection(root);
+    }
+    catch (error) {
+        console.error(`rafi graph: registered-source selection unavailable: ${String(error)}. Existing graph evidence must not substitute a later capture.`);
+    }
 }
 export function addPendingSourceDescription(registry, description, now = new Date()) {
     const value = description.trim();

package/dist/stateTransfer.js

@@ -1,9 +1,11 @@
+import { registerQaGraphJournalWriter } from "./qaDeliveryJournal.js";
+import { normalizeTransferredGraphState } from "./graph/storage.js";
 import { WorkflowReader } from "./workflowReader.js";
 import { classifyProcess } from "./processIdentity.js";
 import Database from "better-sqlite3";
 import { registerHandbackWriter } from "./qaHandbackMigration.js";
 import { createHash, randomUUID } from "node:crypto";
-import { copyFileSync, cpSync, existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync, } from "node:fs";
+import { copyFileSync, cpSync, existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, realpathSync, rmSync, statSync, writeFileSync, } from "node:fs";
 import { tmpdir } from "node:os";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { spawnSync } from "node:child_process";
@@ -156,6 +158,29 @@ export async function importStateBundle(projectDir, bundleFile, opts = {}) {
             mkdirSync(dirname(out), { recursive: true });
             writeFileSync(out, Buffer.from(entry.data, "base64"));
         }
+        const workflowPath = join(staged, WORKFLOW_DB_FILE);
+        if (existsSync(workflowPath)) {
+            const preview = new Database(workflowPath, { readonly: true, fileMustExist: true });
+            try {
+                if (preview.pragma("integrity_check", { simple: true }) !== "ok" || preview.pragma("foreign_key_check").length)
+                    throw new Error("Imported workflow database integrity failure");
+                if (Number(preview.pragma("user_version", { simple: true })) > 4)
+                    throw new Error("Imported workflow requires a newer Rafi writer");
+                if (tableExists(preview, "build_work_scope"))
+                    for (const { name } of preview.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name LIKE 'qa_%'").all()) {
+                        if (!/^qa_[a-z_]+$/.test(name))
+                            throw new Error("Unexpected imported QA table");
+                        const columns = preview.prepare(`PRAGMA table_info(${name})`).all();
+                        if (columns.some(column => column.name === "run_id") && columns.some(column => column.name === "ticket_id") && preview.prepare(`SELECT 1 FROM ${name} q WHERE NOT EXISTS(SELECT 1 FROM build_work_scope s WHERE s.run_id=q.run_id AND s.work_id=q.ticket_id) LIMIT 1`).get())
+                            throw new Error(`Imported QA work is outside the ownership registry: ${name}`);
+                    }
+            }
+            finally {
+                preview.close();
+                rmSync(workflowPath + "-shm", { force: true });
+                rmSync(workflowPath + "-wal", { force: true });
+            }
+        }
         const backup = backupExistingState(root, opts.now ?? new Date());
         backupDir = backup?.durableBackupDir;
         rollbackDir = backup?.snapshotDir;
@@ -296,6 +321,15 @@ async function stageSqliteBackup(root, rel, dest) {
     const db = new Database(source, { readonly: true, fileMustExist: true });
     try {
         await db.backup(dest);
+        if (rel === WORKFLOW_DB_FILE) {
+            const stagedDb = new Database(dest);
+            try {
+                normalizeTransferredGraphState(stagedDb);
+            }
+            finally {
+                stagedDb.close();
+            }
+        }
     }
     finally {
         db.close();
@@ -406,7 +440,22 @@ function rewriteWorkflowDb(root, sourceRoot) {
     if (!existsSync(path))
         return;
     const db = new Database(path);
+    normalizeTransferredGraphState(db);
     registerHandbackWriter(db);
+    registerQaGraphJournalWriter(db);
+    db.function("rafi_work_authority", () => 1);
+    if (tableExists(db, "build_project_identity")) {
+        const prior = db.prepare("SELECT project_id,canonical_root FROM build_project_identity WHERE singleton=1").get();
+        db.transaction(() => {
+            db.exec("CREATE TABLE IF NOT EXISTS build_project_rebindings(sequence INTEGER PRIMARY KEY AUTOINCREMENT,project_id TEXT NOT NULL,previous_root TEXT NOT NULL,new_root TEXT NOT NULL,rebound_at TEXT NOT NULL)");
+            for (const action of ["INSERT", "UPDATE", "DELETE"])
+                db.exec(`CREATE TRIGGER IF NOT EXISTS rebinding_protocol_${action} BEFORE ${action} ON build_project_rebindings BEGIN SELECT CASE WHEN rafi_writer_protocol()<>4 THEN RAISE(ABORT,'incompatible project rebinding writer') END; END`);
+            for (const action of ["UPDATE", "DELETE"])
+                db.exec(`CREATE TRIGGER IF NOT EXISTS rebinding_immutable_${action} BEFORE ${action} ON build_project_rebindings BEGIN SELECT RAISE(ABORT,'Project rebinding history is immutable'); END`);
+            db.prepare("INSERT INTO build_project_rebindings(project_id,previous_root,new_root,rebound_at) VALUES(?,?,?,?)").run(prior.project_id, prior.canonical_root, realpathSync(root), new Date().toISOString());
+            db.prepare("UPDATE build_project_identity SET canonical_root=? WHERE singleton=1").run(realpathSync(root));
+        })();
+    }
     // This connection only rewrites an offline imported snapshot. It cannot
     // dispatch; preserve imported ownership as unknown instead of adopting it.
     const importedOwner = tableExists(db, "build_admission") ? db.prepare("SELECT record_json FROM build_admission WHERE singleton=1").get() : undefined;

package/dist/statusReporter.d.ts

@@ -90,6 +90,7 @@ export declare class RoleStatusAdapter implements BuilderAdapter {
     restoreNativeCompactions(compactions: NativeCompaction[]): void;
     contextUsageAfterNativeCompaction(compaction: NativeCompaction): Promise<ContextUsage | undefined>;
     contextUsage(): Promise<ContextUsage | undefined>;
+    graphRuntimeSettings(): Pick<import("./adapters/types.js").BuilderAdapterOptions, "model" | "effort" | "fast" | "runtimeExecutable"> | undefined;
     sessionUsage(): Promise<ProviderSessionUsage | undefined>;
     switchSettings(settings: ProviderSettingSwitch): Promise<CompactResult>;
     events(): AsyncIterable<BuilderEvent>;

package/dist/statusReporter.js

@@ -189,6 +189,7 @@ export class RoleStatusAdapter {
     restoreNativeCompactions(compactions) { this.adapter.restoreNativeCompactions?.(compactions); }
     contextUsageAfterNativeCompaction(compaction) { return this.adapter.contextUsageAfterNativeCompaction?.(compaction) ?? Promise.resolve(undefined); }
     contextUsage() { return this.adapter.contextUsage?.() ?? Promise.resolve(undefined); }
+    graphRuntimeSettings() { return this.adapter.graphRuntimeSettings?.(); }
     sessionUsage() { return this.adapter.sessionUsage?.() ?? Promise.resolve(undefined); }
     switchSettings(settings) { return this.adapter.switchSettings?.(settings) ?? Promise.resolve({ ok: false, error: "settings switch unavailable" }); }
     events() { return this.adapter.events(); }