audit-tools 0.34.15 → 0.34.18

package/dist/remediate/steps/nextStep.js

@@ -26,7 +26,7 @@ import { resolveIntakeStep } from "./intakeResolver.js";
 import { runToolOwnedFinalGate, applyCoarseReblock, readFinalGateSidecar, writeFinalGateSidecar, } from "./finalGate.js";
 import { buildNextContractPipelineStep, shouldEnterContractPipeline, writePathASeedFromFindings, buildLeanExtractedPlan, } from "./contractPipeline.js";
 import { contractArtifactExists, contractPipelineDir, } from "../contractPipeline/artifactStore.js";
-import { buildReviewRequest, applyReviewResolution, } from "../review/reviewGate.js";
+import { buildReviewRequest, applyReviewResolution, isResolutionForRequest, } from "../review/reviewGate.js";
 import { buildAutonomousReviewDecision } from "../review/autonomousGate.js";
 import { runFindingFilterPass } from "../findingFilter.js";
 import { intakePaths, isIntakeReady, readIntakeArtifacts, resolveManifestSources, } from "../intake.js";
@@ -1506,6 +1506,7 @@ async function buildImplementDispatchStep(ctx) {
             const rollMerge = loaderCommand(`merge-implement-results --run-id ${runId}`);
             const rollNext = loaderCommand("next-step");
             const acceptCmd = loaderCommand(`accept-node --id <BLOCK_ID> --run-id ${runId}`);
+            const reverifyCmd = loaderCommand(`reverify-node --id <BLOCK_ID> --run-id ${runId}`);
             const nodeLines = rolling.initial
                 .map((n) => `- \`${n.block_id}\` — prompt: \`${n.prompt_path}\` — worktree (subagent cwd): \`${n.worktree_root}\``)
                 .join("\n");
@@ -1544,10 +1545,17 @@ As EACH subagent finishes, run (substituting the finished node's block id):
 It runs the commit -> verify -> merge lifecycle for that node and prints a JSON
 directive on stdout:
 - \`{"directive":"wait",...}\` — other granted nodes are still in flight; do not spawn more.
-- \`{"directive":"done",...}\` — every granted node has been accepted. Then run:
+- \`{"directive":"done",...}\` — every granted node reached a terminal accept. Then run:
 
 \`${rollMerge}\`
 
+If the directive's \`accept_failed\` array names any node, that node's accept FAILED:
+its committed work is preserved under a quarantine ref and nothing landed. Do NOT
+re-run \`accept-node\` for it (that only re-reports the failure). Fix the named cause,
+then re-drive it with:
+
+\`${reverifyCmd}\`
+
 Then run:
 
 \`${rollNext}\`
@@ -1560,8 +1568,8 @@ ${DISPATCH_PROMPT_HANDOFF_NOTE}
 
 ${renderHostScratchNote(hostScratchDir(artifactsDir, runId))}
 `,
-                    allowedCommands: [acceptCmd, rollMerge, rollNext],
-                    stopCondition: "Stop after every node has been accepted (accept-node returns done), results merged, and next-step has been run.",
+                    allowedCommands: [acceptCmd, reverifyCmd, rollMerge, rollNext],
+                    stopCondition: "Stop after every node has reached a terminal accept (accept-node returns done), results merged, and next-step has been run.",
                     artifactPaths: { dispatch_plan: rolling.planPath, dispatch_quota: rolling.quotaPath },
                 }) };
         }
@@ -1945,8 +1953,6 @@ async function handlePendingExtractedPlan(root, artifactsDir, existing, extracte
 // pipeline. File-driven and pre-state (no RemediationState exists at intake yet),
 // mirroring the intake-clarification gate rather than waiting_for_clarification.
 const REVIEW_DECISION_SCHEMA_VERSION = "remediate-code-review-decision/v1";
-/** Stable, informational plan id for the pre-plan review request/decision pair. */
-const REVIEW_GATE_PLAN_ID = "path-a-review";
 function reviewRequestPath(artifactsDir) {
     return join(artifactsDir, "review_request.json");
 }
@@ -2016,11 +2022,12 @@ async function runReviewApprovalGate(root, artifactsDir, survivors, autonomous =
     if (gateOpen && autonomous) {
         const auto = buildAutonomousReviewDecision(survivors);
         const approvedSet = new Set(auto.approved_ids);
-        // Leftovers stay LIVE: declined is EMPTY (no durable rejection). The split
-        // below excludes nothing, so every leftover remains a live finding.
+        // Leftovers stay LIVE: declined is EMPTY (no durable rejection). The
+        // decision REPLAY keys on approved_ids (COR-227a02ae), so on later calls
+        // exactly the approved subset — never the live leftovers — re-enters.
         const record = {
             schema_version: REVIEW_DECISION_SCHEMA_VERSION,
-            plan_id: REVIEW_GATE_PLAN_ID,
+            plan_id: randomRunId("path-a-review"),
             approved_ids: auto.approved_ids,
             declined: [],
             created_at: new Date().toISOString(),
@@ -2042,7 +2049,9 @@ async function runReviewApprovalGate(root, artifactsDir, survivors, autonomous =
         const requestPath = reviewRequestPath(artifactsDir);
         if (!existsSync(resolutionPath)) {
             // Halt: present the tiered survivors and wait for the user's decision.
-            const request = buildReviewRequest(survivors, REVIEW_GATE_PLAN_ID);
+            // The request's plan id is minted RUN-UNIQUE so a stale resolution from
+            // another run can never correlate against it (COR-0b906e37).
+            const request = buildReviewRequest(survivors, randomRunId("path-a-review"));
             await writeJsonFile(requestPath, request);
             return {
                 kind: "halt",
@@ -2051,12 +2060,22 @@ async function runReviewApprovalGate(root, artifactsDir, survivors, autonomous =
         }
         // Consume the resolution into a durable, reasoned decision record.
         const request = (await readOptionalJsonFile(requestPath)) ??
-            buildReviewRequest(survivors, REVIEW_GATE_PLAN_ID);
+            buildReviewRequest(survivors, randomRunId("path-a-review"));
         const resolution = await readOptionalJsonFile(resolutionPath);
+        if (!isResolutionForRequest(request, resolution)) {
+            // Stale cross-run resolution (plan_id mismatch): archive it and RE-HALT
+            // with the live request rather than applying another run's answer.
+            await withFsRetry(() => rename(resolutionPath, `${resolutionPath}.stale-${Date.now()}`));
+            await writeJsonFile(requestPath, request);
+            return {
+                kind: "halt",
+                step: await handleWaitingForReviewApproval(root, artifactsDir, request),
+            };
+        }
         const decision = applyReviewResolution(request, resolution);
         const record = {
             schema_version: REVIEW_DECISION_SCHEMA_VERSION,
-            plan_id: REVIEW_GATE_PLAN_ID,
+            plan_id: request.plan_id,
             approved_ids: decision.approved_ids,
             declined: decision.declined,
             created_at: new Date().toISOString(),
@@ -2069,13 +2088,20 @@ async function runReviewApprovalGate(root, artifactsDir, survivors, autonomous =
             }
         }
     }
-    // Decision recorded (now or on a prior call): split the survivors.
+    // Decision recorded (now or on a prior call): split the survivors. The
+    // replay honours the recorded approved_ids (COR-227a02ae) — an autonomous
+    // decision approves a SUBSET with declined EMPTY (leftovers live but not
+    // approved), so keying the replay on the declined set alone would silently
+    // re-approve every leftover on the next call.
     const decision = await readOptionalJsonFile(decisionPath);
     const declined = decision?.declined ?? [];
     const declinedIds = new Set(declined.map((d) => d.finding_id));
+    const approvedIds = decision ? new Set(decision.approved_ids ?? []) : undefined;
     return {
         kind: "proceed",
-        approved: survivors.filter((f) => !declinedIds.has(f.id)),
+        approved: approvedIds !== undefined
+            ? survivors.filter((f) => approvedIds.has(f.id))
+            : survivors.filter((f) => !declinedIds.has(f.id)),
         declined,
     };
 }
@@ -2279,6 +2305,17 @@ async function handleReadyIntakeContractPipeline(root, artifactsDir, options) {
     if (!pipeline.shouldHandleContractPipeline) {
         return null;
     }
+    // The effective session config is loaded BEFORE the review gate
+    // (COR-5f8fb354): the gate's attended-vs-autonomous resolution must see the
+    // PERSISTED session-config.json (`autonomous_mode`), not only a programmatic
+    // override — resolving from the bare CLI options meant a nightly unattended
+    // run halted for a human at the review gate. The same loaded config feeds
+    // the dispatch-capability resolution further down (single load).
+    const sessionConfigForDispatch = await loadRemediateSessionConfig({
+        root,
+        override: options?.sessionConfig,
+        artifactsFirst: true,
+    });
     // Path A: run the single filter pass over the ORIGINAL findings, present the
     // SURVIVORS at the review gate (deduped / evidence-bearing / path-grounded /
     // checkpoint-kept, tiered by review-necessity), then seed the pipeline with the
@@ -2304,7 +2341,10 @@ async function handleReadyIntakeContractPipeline(root, artifactsDir, options) {
                     checkpoint: checkpoint ?? undefined,
                     evidenceGrounding: true,
                 });
-                const gate = await runReviewApprovalGate(root, artifactsDir, filter.survivors, resolveAutonomousMode(options ?? {}));
+                const gate = await runReviewApprovalGate(root, artifactsDir, filter.survivors, 
+                // Autonomy resolves from the PERSISTED session config (hoisted load
+                // above) → env → attended default, never from the bare CLI options.
+                resolveAutonomousMode({ sessionConfig: sessionConfigForDispatch }));
                 if (gate.kind === "halt") {
                     return gate.step;
                 }
@@ -2415,12 +2455,8 @@ async function handleReadyIntakeContractPipeline(root, artifactsDir, options) {
     // (`resolveHostDispatchCapability`) implement dispatch uses — never a manual
     // flag. Threaded into the contract pipeline so the adversarial 'critique' /
     // 'critic' prompts MANDATE an independent sub-agent reviewer when the host can
-    // dispatch one (fail-safe: mandate by default).
-    const sessionConfigForDispatch = await loadRemediateSessionConfig({
-        root,
-        override: options?.sessionConfig,
-        artifactsFirst: true,
-    });
+    // dispatch one (fail-safe: mandate by default). The config itself was loaded
+    // once, above the review gate (COR-5f8fb354).
     const hostCanDispatchSubagents = resolveHostDispatchCapability({
         hostCanDispatchSubagents: options?.hostCanDispatchSubagents,
         sessionConfig: sessionConfigForDispatch,
@@ -2665,8 +2701,6 @@ async function handleWaitingForTriage(root, artifactsDir, state) {
         },
     });
 }
-/** Stable, informational plan id for the Path-B (planning-point) review pair. */
-const REVIEW_GATE_PLAN_ID_PATH_B = "path-b-review";
 /**
  * Path-B (document / conversation) review-necessity gate, fired at the PLANNING
  * point over the deduped/grounded node findings. Path A records its review
@@ -2690,20 +2724,30 @@ async function runPlanningReviewGate(root, artifactsDir, state, store) {
     const requestPath = reviewRequestPath(artifactsDir);
     const resolutionPath = reviewResolutionPath(artifactsDir);
     const decisionPath = reviewDecisionPath(artifactsDir);
+    // Path B correlates on the LIVE plan's own id (INV-RSM-RESOLUTION-CORRELATE):
+    // the plan exists at the planning point, so its plan_id is the natural
+    // run-unique key — a stale resolution from an earlier plan can never match.
+    const reviewPlanId = state.plan?.plan_id ?? randomRunId("path-b-review");
     if (!existsSync(resolutionPath)) {
         // Halt: present the tiered node findings and wait for the user's decision.
-        const request = buildReviewRequest(findings, REVIEW_GATE_PLAN_ID_PATH_B);
+        const request = buildReviewRequest(findings, reviewPlanId);
         await writeJsonFile(requestPath, request);
         return handleWaitingForReviewApproval(root, artifactsDir, request);
     }
     // Resolution present: consume it into a durable, reasoned decision record.
     const request = (await readOptionalJsonFile(requestPath)) ??
-        buildReviewRequest(findings, REVIEW_GATE_PLAN_ID_PATH_B);
+        buildReviewRequest(findings, reviewPlanId);
     const resolution = await readOptionalJsonFile(resolutionPath);
+    if (!isResolutionForRequest(request, resolution)) {
+        // Stale cross-run resolution: archive it and re-halt with the live request.
+        await withFsRetry(() => rename(resolutionPath, `${resolutionPath}.stale-${Date.now()}`));
+        await writeJsonFile(requestPath, request);
+        return handleWaitingForReviewApproval(root, artifactsDir, request);
+    }
     const decision = applyReviewResolution(request, resolution);
     const record = {
         schema_version: REVIEW_DECISION_SCHEMA_VERSION,
-        plan_id: REVIEW_GATE_PLAN_ID_PATH_B,
+        plan_id: request.plan_id,
         approved_ids: decision.approved_ids,
         declined: decision.declined,
         created_at: new Date().toISOString(),