audit-tools 0.55.4 → 0.55.6

package/dist/remediate/steps/nextStep.js

@@ -1,4 +1,6 @@
+import { readDecisionSnapshot, decisionContextDigest } from "../state/decisionConsumption.js";
 import { RemediationPlanAuthorityError } from "../contractPipeline/runtimePlanAuthority.js";
+import { reopenStaleTriageSuccesses } from "../phases/triageConformance.js";
 import { stateRunId, requireStateRunId, currentHostBoundaryState } from "../state/runIdentity.js";
 import { presentReportStep } from "./frictionCloseout.js";
 import { reviewFilterDispositionsPath, persistReviewFilterDispositions } from "../review/filterDispositions.js";
@@ -34,7 +36,7 @@ import { applyIntentOrdering } from "../intent/intentOrdering.js";
 import { resolveIntakeStep } from "./intakeResolver.js";
 import { RUNTIME_RESIDUAL_DECLARATION, finalGateDisabledReason, finalGateRecordPath, readFinalGateVerdict, runToolOwnedFinalGate, writeFinalGateRedRecord, recordFinalGateOutcome, writeFinalGateVerdict, } from "./finalGate.js";
 import { renderGateAttribution, worktreeContentId, finalGateBinding, } from "./gateCommands.js";
-import { buildNextContractPipelineStep, readApprovedExecutionPlan, writePathASeedFromFindings, normalizeBlockTouchedFiles, checkWriteScopePathsAgainstTrackedTree, } from "./contractPipeline.js";
+import { buildNextContractPipelineStep, readApprovedExecutionPlan, writePathASeedFromFindings, } from "./contractPipeline.js";
 import { compareCodeUnits } from "../../shared/compareCodeUnits.js";
 import { executionPlanPaths, readCanonicalPlan, readPlanSource, readPlanReviewHistory } from "../contractPipeline/executionPlan.js";
 import { buildReviewRequest, applyReviewResolution, parseReviewResolution, REVIEW_REQUEST_SCHEMA_VERSION, } from "../review/reviewGate.js";
@@ -472,6 +474,15 @@ function remediationIngestReportLines(ingested) {
             .sort(compareCodeUnits),
     });
 }
+/**
+ * Whether the ingest report names a result file the host must write: only the
+ * repair and landed-without-result sections do. Pending results render as a
+ * count, listed in the workload, so a report holding only those names no file.
+ */
+export function reportNamesResultFiles(ingested) {
+    return (ingested.issues.some((issue) => remediationIssueRemedy(issue) === "repair") ||
+        [...ingested.work_item_outcomes].some(([, outcome]) => outcome === "missing_result_with_commit"));
+}
 async function buildImplementDispatchStep(ctx) {
     const { root, artifactsDir, state, store, runLogger } = ctx;
     const runId = requireStateRunId(state);
@@ -618,7 +629,7 @@ async function buildImplementDispatchStep(ctx) {
         "The file lists every work item that is ready now. Give each item's prompt to a worker. You choose the order, the groups, and how many run at the same time.",
         "",
         ...report,
-        ...(report.length > 0 ? ["Change only the result files named above.", ""] : []),
+        ...(reportNamesResultFiles(ingested) ? ["Change only the result files named above.", ""] : []),
         "Do not edit the workload file.",
         "",
         "When each item has its commit on HEAD and its result file, run:",
@@ -720,7 +731,10 @@ async function activateApprovedPlan(root, artifactsDir, existing, _input, _runLo
     if (!existing.run_start_dirty)
         existing = { ...existing, run_start_dirty: [...await stagedAndUntracked(root)].sort() };
     const filter = await readOptionalJsonFile(reviewFilterDispositionsPath(artifactsDir));
-    const decision = await readOptionalJsonFile(reviewDecisionPath(artifactsDir));
+    // Through the schema-checked reader: with zero survivors the review gate never
+    // rewrites a stale-schema record, so a raw read let its declines into the
+    // ledger as declined-by-review although the current run never decided them.
+    const decision = await readReviewDecision(artifactsDir);
     const coverage = buildCoverageLedger({
         planId: plan.plan_id, sourceFindings: filter?.originals ?? source.findings,
         droppedNoEvidence: filter?.droppedNoEvidence ?? [], droppedByCheckpoint: filter?.droppedByCheckpoint ?? [],
@@ -1276,22 +1290,16 @@ const PLAN_CLARIFICATION_ACTIONS = ["clarified", "reject_finding", "defer"];
  * - `rationale` is REQUIRED and non-empty on `clarified`: it becomes the item's
  *   `clarification_context`, the answer the next worker reads. A `clarified`
  *   entry without it re-opened the item with no answer attached.
- * - `scope_additions` lists the files the answer requires the fix to touch. Each
- *   must already be in the owning unit's reviewed `allowed_files`; a path outside
- *   it is refused, because new write scope needs a revised, freshly reviewed plan.
- *   Accepted entries never rewrite the plan, so its approved revision holds. It is allowed
- *   ONLY on `clarified`, the one action that re-opens the item; on
- *   `reject_finding` or `defer` it used to be ignored without a word. Each path
- *   is validated whole-file fail-closed BEFORE anything is applied
- *   (`validateClarificationScopeAdditions`), so the host never edits the plan
- *   by hand.
+ * - There is no write-scope field: new write scope needs a revised, freshly
+ *   reviewed plan, so an answer cannot widen a unit (owner decision 2026-10-01;
+ *   the ignored `scope_additions` field was removed in two releases, and is now
+ *   refused as an unknown field).
  */
 const PlanClarificationResolutionSchema = z
     .object({
     unit_id: z.string().min(1, "must be a non-empty finding id"),
     action: z.enum(PLAN_CLARIFICATION_ACTIONS),
     rationale: z.string().optional(),
-    scope_additions: z.array(z.string()).optional(),
 })
     .strict()
     .superRefine((entry, ctx) => {
@@ -1302,13 +1310,6 @@ const PlanClarificationResolutionSchema = z
             message: 'is required and must be non-empty when action is "clarified" — it carries the answer to the next worker',
         });
     }
-    if (entry.action !== "clarified" && entry.scope_additions !== undefined) {
-        ctx.addIssue({
-            code: z.ZodIssueCode.custom,
-            path: ["scope_additions"],
-            message: `is allowed only with action "clarified" — a ${entry.action} entry widens no write scope`,
-        });
-    }
 });
 /**
  * Read and validate the mid-run `clarification_resolution.json` file.
@@ -1321,10 +1322,10 @@ const PlanClarificationResolutionSchema = z
  * user's answer, and the item then waited forever for a question the round no
  * longer showed.
  */
-async function readPlanClarificationResolutions(path) {
+async function readPlanClarificationResolutions(path, snapshotBytes) {
     let value;
     try {
-        value = JSON.parse(await readFile(path, "utf8"));
+        value = JSON.parse(snapshotBytes ?? await readFile(path, "utf8"));
     }
     catch (error) {
         return {
@@ -1365,10 +1366,9 @@ async function readPlanClarificationResolutions(path) {
 }
 /**
  * Every whole-file refusal of a parsed resolution, in check order: the parse,
- * then the closed id set, then the scope additions. Null means the file may be
- * applied.
+ * then the closed id set. Null means the file may be applied.
  */
-async function planClarificationRefusal(root, state, parsed, validIds, outsideSetLabel) {
+function planClarificationRefusal(parsed, validIds, outsideSetLabel) {
     if (!parsed.ok)
         return parsed.reason;
     const unknownIds = parsed.resolutions
@@ -1377,40 +1377,8 @@ async function planClarificationRefusal(root, state, parsed, validIds, outsideSe
     if (unknownIds.length > 0) {
         return `finding id(s) ${outsideSetLabel}: ${unknownIds.map((i) => `\`${i}\``).join(", ")}`;
     }
-    const scopeRefusals = await validateClarificationScopeAdditions(root, state, parsed.resolutions);
-    if (scopeRefusals.length > 0) {
-        return `invalid scope_additions — fix and re-submit: ${scopeRefusals.join(" | ")}`;
-    }
     return null;
 }
-/**
- * Validate every `clarified` resolution's `scope_additions` BEFORE anything is
- * applied: each entry must normalize beneath the repository root against the
- * finding's owning block (the one write-scope normalizer), must clear the SAME
- * tracked-tree rule the promotion gate enforced (the delta lane must not
- * bypass it), and a finding with no owning block has no scope to widen. ANY
- * refusal refuses the WHOLE resolution file — the uniform id-join contract's
- * shape: a half-applied decision record is worse than a re-ask.
- */
-async function validateClarificationScopeAdditions(root, state, resolutions) {
-    const refusals = [];
-    for (const res of resolutions) {
-        if (res.action !== "clarified" || !res.scope_additions?.length)
-            continue;
-        const block = state.plan?.units?.find((b) => b.id === res.unit_id);
-        if (!block) {
-            refusals.push(`scope_additions for \`${res.unit_id}\`: no plan block owns this finding, so ` +
-                `there is no write scope to widen.`);
-            continue;
-        }
-        const normalized = normalizeBlockTouchedFiles(root, res.scope_additions, block.id);
-        if (normalized.touched_files.some(path => !block.allowed_files.includes(path)))
-            refusals.push(`Unit ${block.id} needs a revised executable plan and fresh review before its write scope can expand.`);
-        refusals.push(...normalized.refusals);
-        refusals.push(...(await checkWriteScopePathsAgainstTrackedTree(root, normalized.touched_files, `scope_additions for \`${res.unit_id}\` (block "${block.id}")`)));
-    }
-    return refusals;
-}
 /**
  * Apply one mid-run clarification resolution to its execution unit:
  * `clarified` re-opens it (pending) with the answer as context,
@@ -1449,14 +1417,15 @@ async function applyPlanClarificationResolution(root, artifactsDir, state, store
     if (!state.plan || !state.items)
         return { kind: "applied", state };
     const resolutionPath = join(artifactsDir, "clarification_resolution.json");
-    const parsed = await readPlanClarificationResolutions(resolutionPath);
-    // Uniform whole-file fail-closed contract: a malformed entry, an id outside
-    // the paused set, or an invalid scope addition refuses the WHOLE resolution
-    // (archived, nothing applied) and re-halts with the reason named. The
-    // silent-continue alternative drops the user's answer and leaves its item
-    // waiting on a question nobody is asked, so a decision record never
-    // half-applies (open-bugs.md:110).
-    const refusal = await planClarificationRefusal(root, state, parsed, new Set(pausedClarifications(state).map((q) => q.unit_id)), "not waiting for a clarification");
+    const inputSnapshot = await readDecisionSnapshot(resolutionPath);
+    const contextDigest = decisionContextDigest(state);
+    const parsed = await readPlanClarificationResolutions(resolutionPath, inputSnapshot?.bytes);
+    // Uniform whole-file fail-closed contract: a malformed entry or an id outside
+    // the paused set refuses the WHOLE resolution (archived, nothing applied) and
+    // re-halts with the reason named. The silent-continue alternative drops the
+    // user's answer and leaves its item waiting on a question nobody is asked, so
+    // a decision record never half-applies.
+    const refusal = planClarificationRefusal(parsed, new Set(pausedClarifications(state).map((q) => q.unit_id)), "not waiting for a clarification");
     if (refusal !== null || !parsed.ok) {
         await withFsRetry(() => rename(resolutionPath, `${resolutionPath}.refused-${Date.now()}`));
         return {
@@ -1471,9 +1440,8 @@ async function applyPlanClarificationResolution(root, artifactsDir, state, store
         const item = state.items[res.unit_id];
         if (!item || isTerminalStatus(item.status))
             continue;
-        // Validation admits only paths already in the reviewed unit's allowed_files, so an
-        // accepted scope_additions entry changes nothing: the reviewed plan is never rewritten
-        // here, and its revision (which hashes author order) stays the approved one.
+        // The reviewed plan is never rewritten here, and its revision (which hashes
+        // author order) stays the approved one.
         applyClarificationActionToItem(item, res, now);
         appliedCount += 1;
     }
@@ -1484,9 +1452,11 @@ async function applyPlanClarificationResolution(root, artifactsDir, state, store
     // outright). Mirrors the saveStateForPlan strip.
     if (appliedCount > 0)
         delete state.host_handoff;
-    if (existsSync(resolutionPath)) {
-        await withFsRetry(() => rename(resolutionPath, `${resolutionPath}.consumed-${Date.now()}`));
-    }
+    if (!inputSnapshot)
+        throw new Error("Clarification input changed during application; retry without accepting it.");
+    (state.decision_applications ??= []).push({ input: "clarification_resolution.json", input_sha256: inputSnapshot.sha256, input_identity_sha256: inputSnapshot.identity_sha256,
+        context_sha256: contextDigest, run_id: state.plan.plan_id, revision_sha256: state.plan.review_revision_sha256,
+        applied_at: now, retry_results: [] });
     const remainingPending = state.plan.units.some((f) => state.items?.[f.id]?.status === "pending");
     // Undecided-remainder guard, mirroring triage's still-blocked guard: a
     // resolution covering only SOME of the paused items must not fall through to
@@ -1595,12 +1565,24 @@ async function handlePlanning(root, artifactsDir, state, store) {
 async function handleImplementing(root, artifactsDir, state, runLogger, store) {
     const triageStart = Date.now();
     runLogger.event({ phase: "next-step", kind: "executor_start", obligation: state.status, note: "triage" });
-    const triaged = await runTriagePhase(state, { root, artifactsDir });
+    // sites-pinned: tests/remediate/host-handoff-corroboration-obligations.test.ts
+    const conformanceIssues = [];
+    const triaged = await runTriagePhase(state, { root, artifactsDir }, issue => conformanceIssues.push(issue));
     runLogger.event({ phase: "next-step", kind: "executor_end", obligation: state.status, note: "triage", duration_ms: Date.now() - triageStart });
+    if (conformanceIssues.length) {
+        await store.saveState(triaged);
+        return { kind: "emit", step: await writeCurrentStep({
+                stepKind: "review_contract_conformance", status: conformanceIssues.some(issue => issue.code === "conformance_review_unavailable") ? "blocked" : "ready",
+                runId: stateRunId(triaged), repoRoot: root, artifactsDir,
+                prompt: ["Independent contract conformance review is required before triage can accept these tool-owned working-tree observations.", ...conformanceIssues.map(issue => `${issue.work_item_id}: ${issue.message}\nRequest: ${issue.review_request_path}`), "Read each request in an independent context and write its bound response. Self-review cannot satisfy this requirement. Resume next-step after the responses are ready."].join("\n\n"),
+                stopCondition: "Obtain independent conformance review or remain paused.",
+                allowedCommands: [loaderCommand("next-step")],
+            }) };
+    }
     // Triage may enter closing directly: the close itself owns mandatory final
     // acceptance, so a status transition cannot bypass it.
     if (triaged.status === "closing")
-        return handleAllTerminalTransition(triaged, store);
+        return handleAllTerminalTransition(triaged, store, root, artifactsDir);
     await store.saveState(triaged);
     return { kind: "transition", state: triaged };
 }
@@ -1889,7 +1871,12 @@ async function runPhaseBoundaryGate(ctx) {
         runLogger,
     });
 }
-async function handleAllTerminalTransition(state, store) {
+async function handleAllTerminalTransition(state, store, root, artifactsDir) {
+    // sites-pinned: tests/remediate/host-handoff-corroboration-obligations.test.ts
+    if (await reopenStaleTriageSuccesses(root, artifactsDir, state)) {
+        await store.saveState(state);
+        return { kind: "transition", state };
+    }
     // Final acceptance belongs to the actual close execution, after preview
     // pauses. A transition carries no executable verification verdict.
     state.status = "closing";
@@ -1897,6 +1884,11 @@ async function handleAllTerminalTransition(state, store) {
     return { kind: "transition", state };
 }
 async function handleClosing(root, artifactsDir, state, runLogger, store, options) {
+    // sites-pinned: tests/remediate/host-handoff-corroboration-obligations.test.ts
+    if (await reopenStaleTriageSuccesses(root, artifactsDir, state)) {
+        await store.saveState(state);
+        return { kind: "transition", state };
+    }
     const closeStart = Date.now();
     runLogger.event({ phase: "next-step", kind: "executor_start", obligation: state.status, note: "close" });
     // Target verification and closing are product obligations. Development
@@ -2885,7 +2877,7 @@ export function buildMainObligations(ctx) {
             derive: (state) => state != null && allItemsTerminal(state) && state.status !== "closing"
                 ? "missing"
                 : "satisfied",
-            execute: async (state) => handleAllTerminalTransition(requireState(state), store),
+            execute: async (state) => handleAllTerminalTransition(requireState(state), store, root, artifactsDir),
         },
         {
             id: "closing",
@@ -2955,6 +2947,8 @@ async function advanceUnderPhaseLock(deps) {
     // Loaded FRESH under the mutex: a peer may have advanced and persisted state
     // between the entry read and this process winning the lock.
     let state = await store.loadState();
+    if (state)
+        await store.reconcileDecisionApplications(state);
     let control = await store.loadOperatorLifecycle();
     if (control && control.mode !== "active") {
         return buildOperatorControlStep(root, artifactsDir, state, control);