chainlesschain 0.166.15 → 0.166.17

package/src/lib/evolution/wiki-informed-skill-proposer.js

@@ -0,0 +1,343 @@
+import { createHash } from "node:crypto";
+
+export const WIKI_SKILL_PROPOSAL_SCHEMA =
+  "chainlesschain.wiki-informed-skill-proposal/v1";
+export const WIKI_PROPOSAL_STATUS = Object.freeze({
+  PROPOSAL: "proposal",
+  NO_PROPOSAL: "no-proposal",
+  NEEDS_EVIDENCE: "needs-evidence",
+});
+
+const DIGEST = /^sha256:[a-f0-9]{64}$/u;
+const SKILL_NAME = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/u;
+const INITIAL_SOURCES = Object.freeze([
+  "wiki-index",
+  "skill-impact",
+  "active-skill",
+  "training-summary",
+]);
+const SELECTIVE_SOURCES = new Set(["pattern", "raw"]);
+const SAFE_DIFF_ROOTS = new Set([
+  "SKILL.md",
+  "PURPOSE.md",
+  "assets",
+  "references",
+  "scripts",
+]);
+
+function canonical(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
+  return `{${Object.keys(value)
+    .sort()
+    .map((key) => `${JSON.stringify(key)}:${canonical(value[key])}`)
+    .join(",")}}`;
+}
+
+function hash(value) {
+  return `sha256:${createHash("sha256").update(canonical(value)).digest("hex")}`;
+}
+
+function deepFreeze(value) {
+  if (value && typeof value === "object" && !Object.isFrozen(value)) {
+    Object.freeze(value);
+    for (const child of Object.values(value)) deepFreeze(child);
+  }
+  return value;
+}
+
+function requiredString(value, name) {
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new TypeError(`${name} is required`);
+  }
+  return value;
+}
+
+function stringList(value, name, { allowEmpty = false, max = 64 } = {}) {
+  if (
+    !Array.isArray(value) ||
+    (!allowEmpty && value.length === 0) ||
+    value.length > max ||
+    value.some((item) => typeof item !== "string" || item.trim() === "") ||
+    new Set(value).size !== value.length
+  ) {
+    throw new TypeError(`${name} must be a bounded unique string list`);
+  }
+  return [...value];
+}
+
+function verifyEnvelope(value, expectedKind) {
+  if (
+    !value ||
+    typeof value !== "object" ||
+    value.kind !== expectedKind ||
+    value.trusted !== true ||
+    typeof value.ref !== "string" ||
+    !DIGEST.test(value.digest ?? "") ||
+    value.digest !== hash(value.data)
+  ) {
+    const error = new Error(`${expectedKind} evidence is not digest-bound and trusted`);
+    error.code = "WIKI_PROPOSAL_UNTRUSTED_EVIDENCE";
+    throw error;
+  }
+  return deepFreeze({
+    kind: value.kind,
+    ref: value.ref,
+    digest: value.digest,
+    data: structuredClone(value.data),
+  });
+}
+
+function normalizeDescriptor(input) {
+  const descriptor = {
+    tenantId: requiredString(input?.tenantId, "tenantId"),
+    evolutionRunId: requiredString(input?.evolutionRunId, "evolutionRunId"),
+    targetSkillName: requiredString(input?.targetSkillName, "targetSkillName"),
+    wikiRevision: requiredString(input?.wikiRevision, "wikiRevision"),
+    proposerModel: requiredString(input?.proposerModel, "proposerModel"),
+    minEvidenceSamples: Math.max(1, Number(input?.minEvidenceSamples) || 1),
+    maxSelectiveEvidence: Math.min(
+      16,
+      Math.max(0, Number(input?.maxSelectiveEvidence) || 4),
+    ),
+  };
+  if (!SKILL_NAME.test(descriptor.targetSkillName)) {
+    throw new TypeError("targetSkillName must be canonical kebab-case");
+  }
+  return deepFreeze(descriptor);
+}
+
+function validateDiff(diff) {
+  if (!Array.isArray(diff) || diff.length === 0 || diff.length > 128) {
+    throw new TypeError("machineDiff must contain 1..128 operations");
+  }
+  return diff.map((entry) => {
+    if (!entry || !["add", "replace", "remove"].includes(entry.op)) {
+      throw new TypeError("machineDiff operation is invalid");
+    }
+    const path = requiredString(entry.path, "machineDiff.path").replaceAll("\\", "/");
+    const parts = path.split("/");
+    if (
+      path.startsWith("/") ||
+      parts.includes("..") ||
+      !SAFE_DIFF_ROOTS.has(parts[0]) ||
+      /(^|\/)(active|\.chainlesschain)(\/|$)/u.test(path)
+    ) {
+      const error = new Error("machineDiff escaped the single candidate Skill");
+      error.code = "WIKI_PROPOSAL_UNSAFE_DIFF";
+      throw error;
+    }
+    return {
+      op: entry.op,
+      path,
+      beforeDigest: entry.beforeDigest ?? null,
+      afterDigest: entry.afterDigest ?? null,
+    };
+  });
+}
+
+function validateProposal(output, descriptor, evidence) {
+  if (output?.status !== WIKI_PROPOSAL_STATUS.PROPOSAL) {
+    throw new TypeError("proposal output status is invalid");
+  }
+  if (output.skillName !== descriptor.targetSkillName) {
+    const error = new Error("proposer attempted to change more than the fixed Skill");
+    error.code = "WIKI_PROPOSAL_MULTI_SKILL";
+    throw error;
+  }
+  const knownRefs = new Set(evidence.map((item) => item.ref));
+  const purpose = {
+    summary: requiredString(output.purpose?.summary, "purpose.summary"),
+    patternRefs: stringList(output.purpose?.patternRefs, "purpose.patternRefs"),
+    sourceEvidenceRefs: stringList(
+      output.purpose?.sourceEvidenceRefs,
+      "purpose.sourceEvidenceRefs",
+    ),
+  };
+  for (const ref of [...purpose.patternRefs, ...purpose.sourceEvidenceRefs]) {
+    if (!knownRefs.has(ref)) {
+      const error = new Error("PURPOSE references evidence outside the resolved set");
+      error.code = "WIKI_PROPOSAL_UNKNOWN_LINEAGE";
+      throw error;
+    }
+  }
+  const contextCost = {
+    maxTokens: Number(output.contextCost?.maxTokens),
+    maxBytes: Number(output.contextCost?.maxBytes),
+  };
+  if (
+    !Number.isInteger(contextCost.maxTokens) ||
+    contextCost.maxTokens <= 0 ||
+    !Number.isInteger(contextCost.maxBytes) ||
+    contextCost.maxBytes <= 0
+  ) {
+    throw new TypeError("contextCost must provide positive maxTokens/maxBytes");
+  }
+  return deepFreeze({
+    schema: WIKI_SKILL_PROPOSAL_SCHEMA,
+    status: WIKI_PROPOSAL_STATUS.PROPOSAL,
+    tenantId: descriptor.tenantId,
+    evolutionRunId: descriptor.evolutionRunId,
+    skillName: descriptor.targetSkillName,
+    purpose,
+    applicableWhen: stringList(output.applicableWhen, "applicableWhen"),
+    notApplicableWhen: stringList(output.notApplicableWhen, "notApplicableWhen"),
+    failureCounterexamples: stringList(
+      output.failureCounterexamples,
+      "failureCounterexamples",
+    ),
+    rollbackSteps: stringList(output.rollbackSteps, "rollbackSteps"),
+    validationMethods: stringList(output.validationMethods, "validationMethods"),
+    requestedCapabilities: stringList(
+      output.requestedCapabilities,
+      "requestedCapabilities",
+      { allowEmpty: true },
+    ),
+    targetRuntimes: stringList(output.targetRuntimes, "targetRuntimes"),
+    contextCost,
+    machineDiff: validateDiff(output.machineDiff),
+    sourceEvidenceRefs: evidence.map(({ ref, digest }) => ({ ref, digest })),
+    wikiRevision: descriptor.wikiRevision,
+    proposerModel: descriptor.proposerModel,
+  });
+}
+
+function abstention(status, reason, evidence = []) {
+  return deepFreeze({
+    schema: WIKI_SKILL_PROPOSAL_SCHEMA,
+    status,
+    reason,
+    sourceEvidenceRefs: evidence.map(({ ref, digest }) => ({ ref, digest })),
+  });
+}
+
+export class WikiInformedSkillProposer {
+  constructor({ descriptor, policy, ports } = {}) {
+    this.descriptor = normalizeDescriptor(descriptor);
+    if (policy?.proposerWikiRead !== true || policy?.executionAgentWikiRead === true) {
+      throw new Error("capability policy must isolate Wiki reads to the proposer");
+    }
+    if (typeof ports?.readInitial !== "function")
+      throw new TypeError("readInitial port is required");
+    if (typeof ports?.readSelective !== "function")
+      throw new TypeError("readSelective port is required");
+    if (typeof ports?.generate !== "function")
+      throw new TypeError("generate port is required");
+    if (typeof ports?.createCandidate !== "function")
+      throw new TypeError("createCandidate port is required");
+    this._ports = ports;
+    Object.freeze(this);
+  }
+
+  async propose() {
+    const initial = [];
+    for (const kind of INITIAL_SOURCES) {
+      initial.push(verifyEnvelope(await this._ports.readInitial(kind), kind));
+    }
+    const wiki = initial.find((item) => item.kind === "wiki-index");
+    const training = initial.find((item) => item.kind === "training-summary");
+    if ((wiki.data?.contradictionRefs?.length ?? 0) > 0) {
+      return abstention(
+        WIKI_PROPOSAL_STATUS.NEEDS_EVIDENCE,
+        "wiki evidence is contradictory",
+        initial,
+      );
+    }
+    if (Number(training.data?.sampleCount) < this.descriptor.minEvidenceSamples) {
+      return abstention(
+        WIKI_PROPOSAL_STATUS.NEEDS_EVIDENCE,
+        "training evidence sample is insufficient",
+        initial,
+      );
+    }
+
+    let evidence = [...initial];
+    let output = await this._ports.generate({
+      descriptor: this.descriptor,
+      evidence: deepFreeze([...evidence]),
+    });
+    if (output?.status === WIKI_PROPOSAL_STATUS.NO_PROPOSAL) {
+      return abstention(output.status, requiredString(output.reason, "reason"), evidence);
+    }
+    if (output?.status === WIKI_PROPOSAL_STATUS.NEEDS_EVIDENCE) {
+      const requests = output.requests;
+      if (
+        !Array.isArray(requests) ||
+        requests.length === 0 ||
+        requests.length > this.descriptor.maxSelectiveEvidence
+      ) {
+        return abstention(output.status, "selective evidence request is invalid", evidence);
+      }
+      for (const request of requests) {
+        if (!SELECTIVE_SOURCES.has(request?.kind)) {
+          return abstention(output.status, "requested evidence scope is not allowed", evidence);
+        }
+        evidence.push(
+          verifyEnvelope(
+            await this._ports.readSelective(request.kind, request.ref),
+            request.kind,
+          ),
+        );
+      }
+      output = await this._ports.generate({
+        descriptor: this.descriptor,
+        evidence: deepFreeze([...evidence]),
+      });
+      if (output?.status !== WIKI_PROPOSAL_STATUS.PROPOSAL) {
+        return abstention(
+          output?.status === WIKI_PROPOSAL_STATUS.NO_PROPOSAL
+            ? output.status
+            : WIKI_PROPOSAL_STATUS.NEEDS_EVIDENCE,
+          requiredString(output?.reason, "reason"),
+          evidence,
+        );
+      }
+    }
+
+    const proposal = validateProposal(output, this.descriptor, evidence);
+    const proposalDigest = hash(proposal);
+    const candidateInput = deepFreeze({
+      tenantId: proposal.tenantId,
+      skillName: proposal.skillName,
+      derivationMode: "wiki",
+      wikiRevision: proposal.wikiRevision,
+      proposerModel: proposal.proposerModel,
+      requestedCapabilities: proposal.requestedCapabilities,
+      sourceEvidenceRefs: proposal.sourceEvidenceRefs,
+      content: canonical(proposal),
+    });
+    const created = await this._ports.createCandidate(candidateInput);
+    const candidate = created?.candidate;
+    if (
+      typeof candidate?.candidateId !== "string" ||
+      typeof candidate?.contentDigest !== "string" ||
+      candidate.skillName !== proposal.skillName ||
+      candidate.content !== candidateInput.content ||
+      candidate.derivationMode !== "wiki" ||
+      candidate.wikiRevision !== proposal.wikiRevision ||
+      candidate.proposerModel !== proposal.proposerModel ||
+      canonical(candidate.requestedCapabilities) !==
+        canonical(proposal.requestedCapabilities) ||
+      canonical(candidate.targetRuntimes) !== canonical(proposal.targetRuntimes) ||
+      canonical(candidate.sourceEvidenceRefs) !==
+        canonical(proposal.sourceEvidenceRefs)
+    ) {
+      const error = new Error(
+        "candidate sink did not return an exact immutable proposal binding",
+      );
+      error.code = "WIKI_PROPOSAL_CANDIDATE_UNCONFIRMED";
+      throw error;
+    }
+    return deepFreeze({
+      status: WIKI_PROPOSAL_STATUS.PROPOSAL,
+      proposal,
+      proposalDigest,
+      candidateId: candidate.candidateId,
+      contentDigest: candidate.contentDigest,
+    });
+  }
+}
+
+export function createWikiInformedSkillProposer(options) {
+  return new WikiInformedSkillProposer(options);
+}

package/src/lib/formal-quality-eval-runtime.js

@@ -1,8 +1,12 @@
+import { createHash } from "node:crypto";
+import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 
 export const FORMAL_QUALITY_HERMETIC_ENV = "CC_FORMAL_QUALITY_EVAL_HERMETIC";
 export const FORMAL_QUALITY_PROVIDER_ENV = "CC_FORMAL_QUALITY_EVAL_PROVIDER";
+export const FORMAL_QUALITY_ISOLATION_ROOT_ENV =
+  "CC_FORMAL_QUALITY_EVAL_ISOLATION_ROOT";
 export const FORMAL_QUALITY_ALLOWED_FILES_ENV =
   "CC_FORMAL_QUALITY_EVAL_ALLOWED_FILES";
 export const FORMAL_QUALITY_FILE_TOOLS = Object.freeze([
@@ -34,6 +38,102 @@ export function isFormalQualityHermeticRuntime(environment = process.env) {
   );
 }
 
+function formalQualityIsolationRoot(environment) {
+  if (!isFormalQualityHermeticRuntime(environment)) return null;
+  const configuredRoot = String(
+    environment?.[FORMAL_QUALITY_ISOLATION_ROOT_ENV] || "",
+  ).trim();
+  if (!configuredRoot) {
+    throw new Error("formal quality isolation root is missing");
+  }
+  const temporaryRoot = path.resolve(os.tmpdir());
+  const resolvedRoot = path.resolve(configuredRoot);
+  const relation = path.relative(temporaryRoot, resolvedRoot);
+  const configuredHome = path.resolve(String(environment.CHAINLESSCHAIN_HOME));
+  const homeRelation = path.relative(resolvedRoot, configuredHome);
+  if (
+    !relation ||
+    relation === ".." ||
+    relation.startsWith(`..${path.sep}`) ||
+    path.isAbsolute(relation) ||
+    !homeRelation ||
+    homeRelation === ".." ||
+    homeRelation.startsWith(`..${path.sep}`) ||
+    path.isAbsolute(homeRelation)
+  ) {
+    throw new Error("formal quality isolation root is invalid");
+  }
+  return resolvedRoot;
+}
+
+/**
+ * Give concurrent formal teammates separate ephemeral config/cache trees.
+ * Sharing one Windows config root makes independent processes contend on DACL
+ * repair and lets platform first-use caches leak into the benchmark cwd.
+ */
+export function formalQualityChildEnvironment(
+  identity,
+  environment = process.env,
+) {
+  const isolationRoot = formalQualityIsolationRoot(environment);
+  if (!isolationRoot) return null;
+  const normalizedIdentity = String(identity || "").trim();
+  if (
+    !normalizedIdentity ||
+    normalizedIdentity.length > 256 ||
+    normalizedIdentity.includes("\0")
+  ) {
+    throw new Error("formal quality child identity is invalid");
+  }
+  const identityDigest = createHash("sha256")
+    .update(normalizedIdentity, "utf8")
+    .digest("hex")
+    .slice(0, 24);
+  const childRoot = path.join(isolationRoot, "agent-homes", identityDigest);
+  const userHome = path.join(childRoot, "user-home");
+  const configHome = path.join(childRoot, "chainlesschain-home");
+  const appData = path.join(userHome, "app-data");
+  const localAppData = path.join(userHome, "local-app-data");
+  const xdgConfigHome = path.join(userHome, "xdg-config");
+  const xdgCacheHome = path.join(userHome, "xdg-cache");
+  const xdgDataHome = path.join(userHome, "xdg-data");
+  const dotnetHome = path.join(userHome, "dotnet-home");
+  const nugetPackages = path.join(userHome, "nuget-packages");
+  for (const directory of [
+    childRoot,
+    userHome,
+    configHome,
+    appData,
+    localAppData,
+    xdgConfigHome,
+    xdgCacheHome,
+    xdgDataHome,
+    dotnetHome,
+    nugetPackages,
+  ]) {
+    fs.mkdirSync(directory, { recursive: true });
+  }
+  const childEnvironment = {
+    HOME: userHome,
+    USERPROFILE: userHome,
+    APPDATA: appData,
+    LOCALAPPDATA: localAppData,
+    XDG_CONFIG_HOME: xdgConfigHome,
+    XDG_CACHE_HOME: xdgCacheHome,
+    XDG_DATA_HOME: xdgDataHome,
+    CHAINLESSCHAIN_HOME: configHome,
+    DOTNET_CLI_HOME: dotnetHome,
+    NUGET_PACKAGES: nugetPackages,
+    POWERSHELL_TELEMETRY_OPTOUT: "1",
+    POWERSHELL_UPDATECHECK: "Off",
+  };
+  if (/^[A-Za-z]:[\\/]/u.test(userHome)) {
+    childEnvironment.HOMEDRIVE = userHome.slice(0, 2);
+    childEnvironment.HOMEPATH = userHome.slice(2);
+  }
+  return Object.freeze(childEnvironment);
+}
+
 /** Resolve the provider that the formal harness bound before any model call. */
 export function formalQualityProvider(environment = process.env) {
   if (!isFormalQualityHermeticRuntime(environment)) return null;

package/src/lib/graph-kernel/cutover-contract.js

@@ -0,0 +1,7 @@
+export const GRAPH_CUTOVER_LEDGER_SCHEMA =
+  "chainlesschain.graph-cutover-ledger/v1";
+export const GRAPH_CUTOVER_REQUIRED_PLATFORMS = Object.freeze([
+  "linux",
+  "windows",
+  "macos",
+]);

package/src/lib/graph-kernel/cutover-ledger.js

@@ -8,14 +8,15 @@ import {
   normalizeGraphRetirementEvidence,
 } from "./retirement-evidence.js";
 import { graphStoreEvidenceDigest } from "./store-cutover-evidence.js";
+import {
+  GRAPH_CUTOVER_LEDGER_SCHEMA,
+  GRAPH_CUTOVER_REQUIRED_PLATFORMS,
+} from "./cutover-contract.js";
 
-export const GRAPH_CUTOVER_LEDGER_SCHEMA =
-  "chainlesschain.graph-cutover-ledger/v1";
-export const GRAPH_CUTOVER_REQUIRED_PLATFORMS = Object.freeze([
-  "linux",
-  "windows",
-  "macos",
-]);
+export {
+  GRAPH_CUTOVER_LEDGER_SCHEMA,
+  GRAPH_CUTOVER_REQUIRED_PLATFORMS,
+} from "./cutover-contract.js";
 
 const IDENTIFIER = /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,159}$/u;
 const DIGEST = /^sha256:[a-f0-9]{64}$/u;

package/src/lib/graph-kernel/evidence-digest.js

@@ -0,0 +1,47 @@
+import { createHash } from "node:crypto";
+
+function stableValue(value, state = { seen: new WeakSet(), nodes: 0 }) {
+  state.nodes += 1;
+  if (state.nodes > 250_000) {
+    throw new TypeError("Graph evidence exceeds canonicalization limits");
+  }
+  if (Array.isArray(value))
+    return value.map((item) => stableValue(item, state));
+  if (!value || typeof value !== "object") {
+    if (typeof value === "number" && !Number.isFinite(value)) {
+      throw new TypeError("Graph evidence contains a non-finite number");
+    }
+    if (["bigint", "function", "symbol", "undefined"].includes(typeof value)) {
+      throw new TypeError("Graph evidence contains a non-JSON value");
+    }
+    return value;
+  }
+  if (state.seen.has(value)) {
+    throw new TypeError("Graph evidence contains a cycle or repeated object");
+  }
+  state.seen.add(value);
+  if (
+    Object.getPrototypeOf(value) !== Object.prototype &&
+    Object.getPrototypeOf(value) !== null
+  ) {
+    throw new TypeError("Graph evidence must contain plain JSON objects");
+  }
+  return Object.fromEntries(
+    Object.keys(value)
+      .filter((key) => value[key] !== undefined)
+      .sort()
+      .map((key) => [key, stableValue(value[key], state)]),
+  );
+}
+
+export function canonicalGraphEvidenceJson(value) {
+  return JSON.stringify(stableValue(value));
+}
+
+export function graphEvidenceDigest(value, domain) {
+  return `sha256:${createHash("sha256")
+    .update(domain)
+    .update("\0")
+    .update(canonicalGraphEvidenceJson(value))
+    .digest("hex")}`;
+}

package/src/lib/graph-kernel/evolution-run-runtime-adapter.js

@@ -0,0 +1,5 @@
+import evolutionRun from "@chainlesschain/session-core/evolution-run";
+
+export function projectGraphEvolutionRun(events, options) {
+  return evolutionRun.projectEvolutionRun(events, options);
+}

package/src/lib/graph-kernel/graph-runtime-surfaces.json

@@ -6,7 +6,14 @@
     "ledgerSchema": "chainlesschain.graph-cutover-ledger/v1",
     "scope": "entry",
     "requiredPlatforms": ["linux", "windows", "macos"],
-    "existingCanonicalRunRollback": "retain_authority"
+    "existingCanonicalRunRollback": "retain_authority",
+    "legacyMutationErrorCodes": {
+      "browser": "CC_CLI_LEGACY_RUNTIME_READ_ONLY",
+      "cli_team": "CC_CLI_LEGACY_RUNTIME_READ_ONLY",
+      "cowork": "CC_CLI_LEGACY_RUNTIME_READ_ONLY",
+      "desktop": "CC_DESKTOP_LEGACY_RUNTIME_READ_ONLY",
+      "scheduler": "CC_CLI_LEGACY_RUNTIME_READ_ONLY"
+    }
   },
   "surfaces": [
     {