audit-tools 0.55.6 → 0.55.8

package/dist/remediate/steps/nextStep.js

@@ -1,3 +1,4 @@
+import { admitRemediationDirtyBaseline, RemediationDirtyBaselineError } from "../state/dirtyBaseline.js";
 import { readDecisionSnapshot, decisionContextDigest } from "../state/decisionConsumption.js";
 import { RemediationPlanAuthorityError } from "../contractPipeline/runtimePlanAuthority.js";
 import { reopenStaleTriageSuccesses } from "../phases/triageConformance.js";
@@ -441,13 +442,14 @@ async function saveStateForPlan(artifactsDir, existing, plan, planCoverage) {
     return state;
 }
 async function forceReplanFromExistingIntake(root, artifactsDir, previous, runLogger) {
+    admitRemediationDirtyBaseline(previous);
     const step = await buildNextContractPipelineStep({ root, artifactsDir, runId: requireStateRunId(previous), forceRevision: false });
     if (step)
         return { kind: "planning_step", step };
     const approved = await readApprovedExecutionPlan(artifactsDir);
     if (!approved)
         return { kind: "blocked", reason: "Revise and independently approve the current executable plan before replanning. Accepted execution history is preserved." };
-    const activated = await activateApprovedPlan(root, artifactsDir, previous, approved, runLogger);
+    const activated = await activateApprovedPlan(root, artifactsDir, previous, approved, runLogger, "existing_run");
     if (activated.kind === "blocked")
         return activated;
     // Activation already carries unchanged history and applies CURRENT owner
@@ -708,7 +710,11 @@ async function emitPlanRevisionBlockedStep(root, artifactsDir, blocked) {
         prompt: `# Executable plan requires attention\n\n${blocked.reason}\nThe current plan and accepted execution history are preserved. Revise the plan through its tool-issued submission and obtain fresh review before continuing.`,
         allowedCommands: [loaderCommand("next-step")], stopCondition: "Resolve the named plan/review issue before implementation.", artifactPaths: { execution_plan: executionPlanPaths(artifactsDir).canonical } });
 }
-async function activateApprovedPlan(root, artifactsDir, existing, _input, _runLogger) {
+async function activateApprovedPlan(root, artifactsDir, existing, _input, _runLogger, origin) {
+    if (origin === "existing_run")
+        admitRemediationDirtyBaseline(existing);
+    else if ("run_start_dirty" in existing || "run_start_dirty_encoding" in existing)
+        throw new RemediationDirtyBaselineError();
     const approved = await readApprovedExecutionPlan(artifactsDir);
     if (!approved)
         return { kind: "blocked", reason: "No current independently approved executable plan exists. Re-run planning; unreviewed projections cannot dispatch." };
@@ -728,8 +734,9 @@ async function activateApprovedPlan(root, artifactsDir, existing, _input, _runLo
         ...(facts.commands.e2e ? { e2e_command: renderPromptCommand(facts.commands.e2e), e2e_command_source: "project_facts" } : {}),
     };
     plan = await applyCheckpointIntentOrdering(artifactsDir, plan);
-    if (!existing.run_start_dirty)
-        existing = { ...existing, run_start_dirty: [...await stagedAndUntracked(root)].sort() };
+    if (origin === "new_pre_edit_run") {
+        existing = { ...existing, run_start_dirty: [...await stagedAndUntracked(root)], run_start_dirty_encoding: "git-z/v1" };
+    }
     const filter = await readOptionalJsonFile(reviewFilterDispositionsPath(artifactsDir));
     // Through the schema-checked reader: with zero survivors the review gate never
     // rewrites a stale-schema record, so a raw read let its declines into the
@@ -1004,11 +1011,11 @@ sourceAuditRead) {
             `path=${findingsPath}`,
     });
 }
-async function handleReadyIntakeContractPipeline(root, artifactsDir, options, runLogger) {
+async function handleReadyIntakeContractPipeline(root, artifactsDir, options, runLogger, origin) {
     // Resume the tool-owned plan without reconstructing completed intake.
     const earlyExtractedPlan = await readApprovedExecutionPlan(artifactsDir);
     if (earlyExtractedPlan && !existsSync(executionPlanPaths(artifactsDir).submission)) {
-        const outcome = await activateApprovedPlan(root, artifactsDir, { status: "pending" }, earlyExtractedPlan, runLogger);
+        const outcome = await activateApprovedPlan(root, artifactsDir, { status: "pending" }, earlyExtractedPlan, runLogger, origin);
         return outcome.kind === "blocked"
             ? emitPlanRevisionBlockedStep(root, artifactsDir, outcome)
             : outcome.state;
@@ -1022,7 +1029,7 @@ async function handleReadyIntakeContractPipeline(root, artifactsDir, options, ru
         const approved = await readApprovedExecutionPlan(artifactsDir);
         if (!approved)
             return null;
-        const outcome = await activateApprovedPlan(root, artifactsDir, { status: "pending" }, approved, runLogger);
+        const outcome = await activateApprovedPlan(root, artifactsDir, { status: "pending" }, approved, runLogger, origin);
         return outcome.kind === "blocked"
             ? emitPlanRevisionBlockedStep(root, artifactsDir, outcome)
             : outcome.state;
@@ -1177,16 +1184,16 @@ async function handleReadyIntakeContractPipeline(root, artifactsDir, options, ru
     if (!extractedPlan) {
         return null;
     }
-    const outcome = await activateApprovedPlan(root, artifactsDir, { status: "pending" }, extractedPlan, runLogger);
+    const outcome = await activateApprovedPlan(root, artifactsDir, { status: "pending" }, extractedPlan, runLogger, origin);
     return outcome.kind === "blocked"
         ? emitPlanRevisionBlockedStep(root, artifactsDir, outcome)
         : outcome.state;
 }
-async function handlePendingIntake(root, artifactsDir, options, runLogger) {
+async function handlePendingIntake(root, artifactsDir, options, runLogger, origin) {
     // Existing source ownership survives pending review and approval invalidation.
     // The earlier confirm_intent obligation still guards this continuation.
     if (await readPlanSource(artifactsDir)) {
-        return handleReadyIntakeContractPipeline(root, artifactsDir, options, runLogger);
+        return handleReadyIntakeContractPipeline(root, artifactsDir, options, runLogger, origin);
     }
     const inputResolution = resolveInputPaths(root, options.input);
     const intakeResult = await resolveIntakeStep({
@@ -1205,7 +1212,7 @@ async function handlePendingIntake(root, artifactsDir, options, runLogger) {
         return intakeResult.step;
     }
     // Intake is complete — route both paths through the contract pipeline.
-    return handleReadyIntakeContractPipeline(root, artifactsDir, options, runLogger);
+    return handleReadyIntakeContractPipeline(root, artifactsDir, options, runLogger, origin);
 }
 async function handleNoState(root, artifactsDir) {
     const paths = intakePaths(artifactsDir);
@@ -1614,6 +1621,7 @@ async function handleImplementing(root, artifactsDir, state, runLogger, store) {
  */
 async function emitFinalGateRedStep(ctx) {
     const { root, artifactsDir, state, scope, gate, runLogger } = ctx;
+    admitRemediationDirtyBaseline(state);
     const failed = gate.results.find((r) => !r.passed);
     const recordPath = ctx.recordedPath ?? await writeFinalGateRedRecord(artifactsDir, scope, failed, {
         root,
@@ -1736,6 +1744,7 @@ function explicitFinalGateTestCommand(state) {
 }
 async function runPhaseBoundaryGate(ctx) {
     const { root, artifactsDir, state, options, runLogger } = ctx;
+    admitRemediationDirtyBaseline(state);
     // Whether a gate is DUE is decided BEFORE whether it is suppressed. The old
     // order asked the suppression first and returned, so a disabled run could not
     // tell "no gate was due this pass" from "a gate was due and skipped" — and the
@@ -2404,19 +2413,7 @@ function requireState(state) {
     }
     return state;
 }
-/**
- * Priority order for the pre-intake obligations — mirrors the original cascade's
- * top-down guard order exactly so selection cannot drift.
- */
-export const PRE_INTAKE_PRIORITY = [
-    "input_conflict",
-    "confirm_resume",
-    "confirm_intent",
-    "interpret_intent",
-    "complete_redelivery",
-    "complete",
-    "pending_intake",
-];
+// sites-pinned: tests/remediate/obligation-priority-coverage.test.ts
 /**
  * The linear pre-intake gates as declarative obligations (A3 slice 1). Built per
  * call so each `derive` can close over `ctx` paths + the pre-read `snapshot` and
@@ -2668,7 +2665,7 @@ Then run:
             id: "pending_intake",
             derive: (state) => (state == null ? "missing" : "satisfied"),
             execute: async (_state, c) => {
-                const outcome = await handlePendingIntake(c.root, c.artifactsDir, c.options, c.runLogger);
+                const outcome = await handlePendingIntake(c.root, c.artifactsDir, c.options, c.runLogger, "new_pre_edit_run");
                 if (outcome && "step_kind" in outcome) {
                     return { kind: "emit", step: outcome };
                 }
@@ -2680,23 +2677,6 @@ Then run:
         },
     ];
 }
-/**
- * Priority order for the main (post-intake) obligations — mirrors the original
- * cascade tail's guard order exactly so selection cannot drift.
- */
-export const MAIN_PRIORITY = [
-    "operator_plan_only",
-    "waiting_for_clarification",
-    "waiting_for_triage",
-    "planning_documentable",
-    "deferred_clarification",
-    "implementing",
-    "triage",
-    "planning_zero",
-    "all_terminal",
-    "closing",
-    "unhandled",
-];
 /**
  * The post-intake cascade tail as declarative obligations (A3 slice 2). Runs on a
  * non-null state (pre-intake resolved it). Every phase handler returns a
@@ -2947,6 +2927,21 @@ async function advanceUnderPhaseLock(deps) {
     // Loaded FRESH under the mutex: a peer may have advanced and persisted state
     // between the entry read and this process winning the lock.
     let state = await store.loadState();
+    const reportOnlyRequest = state?.status === "complete" &&
+        options.input === undefined && options.severity === undefined && options.findingIds === undefined &&
+        options.guidanceFile === undefined && options.guidanceText === undefined && options.verificationCommand === undefined &&
+        options.guidanceFileSupplied !== true && options.forceReplan !== true && options.planOnly !== true && options.finalizeClosing !== true;
+    // Only a potential complete/report-only request may inspect plan freshness
+    // before baseline admission. No authority write can precede this fence.
+    if (state && !reportOnlyRequest)
+        admitRemediationDirtyBaseline(state);
+    const currentCanonical = state?.plan ? await readCanonicalPlan(artifactsDir) : undefined;
+    const pendingPlanSubmission = existsSync(executionPlanPaths(artifactsDir).submission);
+    const revisionMismatch = Boolean(currentCanonical && currentCanonical.revision_sha256 !== state?.plan?.review_revision_sha256);
+    if (reportOnlyRequest && !pendingPlanSubmission && !revisionMismatch)
+        return handleComplete(root, artifactsDir, state);
+    if (state && reportOnlyRequest)
+        admitRemediationDirtyBaseline(state);
     if (state)
         await store.reconcileDecisionApplications(state);
     let control = await store.loadOperatorLifecycle();
@@ -3001,8 +2996,7 @@ async function advanceUnderPhaseLock(deps) {
     // Preamble — forceReplan re-grounds from existing intake. The whole decide loop
     // runs once per host call (the engine folds planning → implementing → … through
     // transitions, never a recursive decideNextStepLoop), so this fires at most once.
-    const currentCanonical = state?.plan ? await readCanonicalPlan(artifactsDir) : undefined;
-    if (state != null && (options.forceReplan || existsSync(executionPlanPaths(artifactsDir).submission) || (currentCanonical && currentCanonical.revision_sha256 !== state.plan?.review_revision_sha256))) {
+    if (state != null && (options.forceReplan || pendingPlanSubmission || revisionMismatch)) {
         await countStep(state);
         const replanOutcome = await forceReplanFromExistingIntake(root, artifactsDir, state, runLogger);
         // A discarded plan is REPORTED here, not collapsed into `state = null`. Once
@@ -3062,7 +3056,7 @@ async function advanceUnderPhaseLock(deps) {
     // The linear pre-intake gates run as obligations through the shared advance
     // loop. An emit returns to the host; a transition re-scans within this call;
     // exhausting them (step === null) means the run is past intake and falls
-    // through to the post-intake `advance` (MAIN_PRIORITY) below.
+    // through to the post-intake `advance` below.
     const ctx = {
         root,
         artifactsDir,
@@ -3072,20 +3066,21 @@ async function advanceUnderPhaseLock(deps) {
         inputResolution,
         countStep,
     };
+    const preIntakeObligations = buildPreIntakeObligations(ctx, {
+        existingCheckpoint,
+        rejectedCheckpointFields: checkpointRead?.rejected ?? [],
+        resumeAck,
+        entryState: state,
+        suppliedInputUnchanged,
+        sourceAlreadyBound: boundSource !== undefined,
+        inputSelectionChanged,
+        selectionAlreadyBound: recordedSelection !== undefined,
+        selectedSourceChanged,
+        guidanceFileSupplied: Boolean(options.guidanceFileSupplied || options.guidanceFile || options.guidanceText !== undefined),
+    });
     const preIntake = await advance({
-        priority: PRE_INTAKE_PRIORITY,
-        obligations: buildPreIntakeObligations(ctx, {
-            existingCheckpoint,
-            rejectedCheckpointFields: checkpointRead?.rejected ?? [],
-            resumeAck,
-            entryState: state,
-            suppliedInputUnchanged,
-            sourceAlreadyBound: boundSource !== undefined,
-            inputSelectionChanged,
-            selectionAlreadyBound: recordedSelection !== undefined,
-            selectedSourceChanged,
-            guidanceFileSupplied: Boolean(options.guidanceFileSupplied || options.guidanceFile || options.guidanceText !== undefined),
-        }),
+        priority: preIntakeObligations.map(def => def.id),
+        obligations: preIntakeObligations,
     }, state, ctx);
     if (preIntake.step)
         return preIntake.step;
@@ -3113,7 +3108,8 @@ async function advanceUnderPhaseLock(deps) {
     // store without returning the persisted value, so the main fold reads from disk
     // exactly as it did when it owned its own lock acquisition.
     const advanceState = (await store.loadState()) ?? state;
-    const main = await advance({ priority: MAIN_PRIORITY, obligations: buildMainObligations(ctx) }, advanceState, ctx);
+    const mainObligations = buildMainObligations(ctx);
+    const main = await advance({ priority: mainObligations.map(def => def.id), obligations: mainObligations }, advanceState, ctx);
     if (main.step)
         return main.step;
     // Same contract as the pre-intake fold above: a non-convergent stop must not