chainlesschain 0.166.22 → 0.166.25

package/src/lib/evolution/skill-promotion-review-ledger-adapter.js

@@ -13,6 +13,10 @@ import {
   verifySkillPromotionReviewDecision,
   verifySkillPromotionReviewPacketArtifact,
 } from "./skill-promotion-review.js";
+import {
+  SKILL_WIKI_REVIEW_DECISION_SCHEMA,
+  createSkillWikiReviewReconciliationSource,
+} from "./skill-wiki-reconciliation.js";
 
 export const SKILL_PROMOTION_REVIEW_REQUEST_EVENT_TYPE =
   "skill.promotion-review.requested";
@@ -298,6 +302,9 @@ export class SkillPromotionReviewLedgerAdapter {
     ) {
       throw new Error("review decision signature verification failed");
     }
+    // The verifier may perform I/O. Do not commit an approval whose lease
+    // expired while that verification was in flight.
+    verifySkillPromotionReviewDecision(decision, packet, Number(this._now()));
     const decisionsForPacket = this._decisionEntries().filter(
       ({ decision: stored }) => stored.packetDigest === packet.packetDigest,
     );
@@ -400,6 +407,67 @@ export class SkillPromotionReviewLedgerAdapter {
     return Object.freeze(output);
   }
 
+  // Historical evidence is not a fresh approval. Workbench recovery may use
+  // this only to reconcile an effect already committed to this exact Ledger.
+  async readReview(packetDigest) {
+    if (!DIGEST.test(packetDigest ?? ""))
+      throw new TypeError("packetDigest is required");
+    const head = this._verifyLedger();
+    const { packet, event: packetEvent } = this._packetByDigest(packetDigest);
+    const matches = this._decisionEntries().filter(
+      ({ decision }) => decision.packetDigest === packetDigest,
+    );
+    if (matches.length > 1) corrupt("review packet has conflicting decisions");
+    const entry = matches[0] ?? null;
+    for (const event of [packetEvent, entry?.event].filter(Boolean)) {
+      if (
+        event.artifactTenantId !== this.descriptor.artifactTenantId ||
+        event.skillName !== packet.skillName ||
+        packet.tenantId !== this.descriptor.tenantId
+      )
+        corrupt("review evidence crossed its durable scope");
+    }
+    if (
+      packetEvent.decision !== "proposed" ||
+      packetEvent.sourceRefs.length !== 0
+    )
+      corrupt("review packet lineage is invalid");
+    if (entry) {
+      verifySkillPromotionReviewDecision(
+        entry.decision,
+        packet,
+        Date.parse(entry.decision.decidedAt),
+      );
+      if (
+        entry.event.sequence <= packetEvent.sequence ||
+        entry.event.timestamp !== entry.decision.decidedAt ||
+        entry.event.reason !== entry.decision.reason ||
+        entry.event.decision !==
+          (entry.decision.decision === "approved" ? "accepted" : "rejected")
+      )
+        corrupt("review decision event binding is invalid");
+      if (
+        (await this._verifyDecisionSignature({
+          decision: entry.decision,
+          packet,
+          source: "workbench-recovery",
+          ledgerEventDigest: entry.event.eventDigest,
+        })) !== true
+      )
+        throw new Error("review decision signature verification failed");
+    }
+    if (this._verifyLedger().headDigest !== head.headDigest)
+      corrupt("review Ledger changed during evidence authentication");
+    return Object.freeze({
+      packet,
+      packetRef: packetEvent.subjectRef,
+      packetSequence: packetEvent.sequence,
+      decision: entry?.decision ?? null,
+      decisionRef: entry?.event.subjectRef ?? null,
+      decisionSequence: entry?.event.sequence ?? null,
+    });
+  }
+
   createDecisionResolver() {
     return Object.freeze({
       resolve: async (request) => {
@@ -444,6 +512,38 @@ export class SkillPromotionReviewLedgerAdapter {
       },
     });
   }
+
+  createWikiRejectionReconciliationSource() {
+    return createSkillWikiReviewReconciliationSource({
+      tenantId: this.descriptor.tenantId,
+      streamId: `${this.descriptor.streamId}:wiki-rejections`,
+      readReviewDecisions: async () => {
+        await this.listReviews();
+        return this._decisionEntries()
+          .filter(({ decision }) => decision.decision === "rejected")
+          .map(({ decision, event }) => {
+            const { packet } = this._packetByDigest(decision.packetDigest);
+            return {
+              schema: SKILL_WIKI_REVIEW_DECISION_SCHEMA,
+              authenticated: true,
+              durable: true,
+              tenantId: this.descriptor.tenantId,
+              streamId: `${this.descriptor.streamId}:wiki-rejections`,
+              sequence: event.sequence,
+              candidateId: packet.candidateId,
+              skillName: packet.skillName,
+              decision: decision.decision,
+              reason: decision.reason,
+              occurredAt: decision.decidedAt,
+              packetDigest: decision.packetDigest,
+              decisionReceiptDigest: decision.receiptDigest,
+              sourceEvidenceRefs: packet.evidenceSummary,
+              sourceReceiptDigest: event.eventDigest,
+            };
+          });
+      },
+    });
+  }
 }
 
 export function createSkillPromotionReviewLedgerAdapter(options) {

package/src/lib/evolution/skill-registry-transition-ledger-adapter.js

@@ -8,7 +8,10 @@ import {
 import {
   EVOLUTION_ARTIFACT_RESOLUTION_SCHEMA,
   EVOLUTION_LEDGER_DOMAIN_EVENT_SCHEMA,
+  EVOLUTION_LEDGER_MAX_EVENTS,
+  EvolutionLedger,
 } from "./evolution-ledger.js";
+import { captureSkillReleaseRegistryReader } from "./skill-release-registry.js";
 import {
   EMPTY_SKILL_ACTIVE_DIGEST,
   captureSkillEvaluatedPromotionControlPlane,
@@ -22,6 +25,10 @@ import {
   digestSkillMutationTransitionSubject,
   verifySkillMutationRequest,
 } from "./skill-mutation-authority.js";
+import {
+  SKILL_WIKI_TRANSITION_SCHEMA,
+  createSkillWikiReconciliationSource,
+} from "./skill-wiki-reconciliation.js";
 
 export const SKILL_REGISTRY_TRANSITION_REQUEST_SCHEMA =
   "chainlesschain.skill-registry-transition-request/v1";
@@ -125,6 +132,85 @@ const SETTLEMENT_KEYS = new Set([
   "settlementDigest",
 ]);
 const AUTHORIZATION_TTL_MS = 4 * 60_000;
+const sortedRefs = (refs) =>
+  [...refs].sort((left, right) =>
+    left.ref < right.ref
+      ? -1
+      : left.ref > right.ref
+        ? 1
+        : left.digest < right.digest
+          ? -1
+          : left.digest > right.digest
+            ? 1
+            : 0,
+  );
+
+// Read-only assembly over the same canonical parsing/effect checks as the
+// transition writer. No source verifier, mutation authority or writer is
+// invented merely to inspect existing workflow records.
+export function createSkillRegistryTransitionLedgerReader({
+  descriptor,
+  ledger,
+  ledgerArtifactResolver,
+  releaseRegistry,
+} = {}) {
+  if (
+    !(ledger instanceof EvolutionLedger) ||
+    utilTypes.isProxy(ledger) ||
+    !isEvolutionLedgerArtifactResolver(ledgerArtifactResolver)
+  )
+    throw new TypeError(
+      "transition reader requires actual Ledger and artifact resolver",
+    );
+  const registry = captureSkillReleaseRegistryReader(releaseRegistry);
+  const scope = normalizeDescriptor(descriptor);
+  if (registry.tenantId !== scope.tenantId)
+    throw new TypeError("transition reader Registry tenant differs");
+  const view = {
+    descriptor: scope,
+    _readLedger: () =>
+      EvolutionLedger.prototype.read.call(ledger, {
+        limit: EVOLUTION_LEDGER_MAX_EVENTS,
+      }),
+    _verifyLedger: EvolutionLedger.prototype.verify.bind(ledger),
+    _resolveArtifact: ledgerArtifactResolver,
+    _readState: registry.readState,
+    _readRelease: registry.readRelease,
+  };
+  for (const name of [
+    "_events",
+    "_resolveEvent",
+    "_requests",
+    "_attempts",
+    "_settlements",
+    "_verifyCommittedSettlement",
+    "list",
+  ])
+    view[name] =
+      SkillRegistryTransitionLedgerAdapter.prototype[name].bind(view);
+  Object.freeze(view);
+  return Object.freeze({
+    list() {
+      const before = view._verifyLedger();
+      const rows = view.list();
+      const settlements = rows.some((row) => row.status === "committed")
+        ? view._settlements()
+        : [];
+      const values = rows.map((row) => ({
+        ...row,
+        settlementEventSequence:
+          settlements.find(
+            (entry) => entry.settlement.requestId === row.request.requestId,
+          )?.event.sequence ?? null,
+      }));
+      if (values.length > 10_000 || !same(before, view._verifyLedger()))
+        throw new Error(
+          "transition history is over budget or changed during authentication",
+        );
+      return deepFreeze(values);
+    },
+  });
+}
 
 function canonical(value) {
   if (value === null || typeof value !== "object") return JSON.stringify(value);
@@ -703,8 +789,13 @@ export class SkillRegistryTransitionLedgerAdapter {
           event.skillName !== settlement.skillName ||
           !Array.isArray(event.sourceRefs) ||
           event.sourceRefs.length !== 2 ||
-          !same(event.sourceRefs[0], attempt.request.event.subjectRef) ||
-          !same(event.sourceRefs[1], attempt.event.subjectRef)
+          !same(
+            event.sourceRefs,
+            sortedRefs([
+              attempt.request.event.subjectRef,
+              attempt.event.subjectRef,
+            ]),
+          )
         ) {
           fail(
             SKILL_REGISTRY_TRANSITION_CORRUPT_CODE,
@@ -1174,6 +1265,44 @@ export class SkillRegistryTransitionLedgerAdapter {
     );
   }
 
+  createWikiReconciliationSource() {
+    return createSkillWikiReconciliationSource({
+      tenantId: this.descriptor.tenantId,
+      streamId: this.descriptor.streamId,
+      readTransitions: () =>
+        this._settlements().map(({ event, settlement }) => {
+          const candidate = this._readCandidate(settlement.candidateId);
+          if (
+            candidate?.tenantId !== this.descriptor.tenantId ||
+            candidate.candidateId !== settlement.candidateId ||
+            candidate.skillName !== settlement.skillName
+          ) {
+            fail(
+              SKILL_REGISTRY_TRANSITION_CORRUPT_CODE,
+              "transition candidate lineage is invalid for Wiki reconciliation",
+            );
+          }
+          return {
+            schema: SKILL_WIKI_TRANSITION_SCHEMA,
+            authenticated: true,
+            durable: true,
+            tenantId: this.descriptor.tenantId,
+            streamId: this.descriptor.streamId,
+            sequence: event.sequence,
+            candidateId: settlement.candidateId,
+            skillName: settlement.skillName,
+            activeReleaseDigest: settlement.activeReleaseDigest,
+            stateDigest: settlement.stateDigest,
+            settlementDigest: settlement.settlementDigest,
+            occurredAt: settlement.settledAt,
+            wikiRevision: candidate.wikiRevision,
+            sourceEvidenceRefs: candidate.sourceEvidenceRefs,
+            sourceReceiptDigest: event.eventDigest,
+          };
+        }),
+    });
+  }
+
   async processNext() {
     const pending = this.list().find((entry) => entry.status === "pending");
     if (!pending) return deepFreeze({ processed: false });

package/src/lib/evolution/skill-release-registry.js

@@ -60,6 +60,17 @@ export const SKILL_RELEASE_JOURNAL_ARCHIVE_SCHEMA =
   "chainlesschain.skill-release-journal-archive/v1";
 
 const JOURNAL_SCHEMA = "chainlesschain.skill-release-journal/v4";
+const REGISTRY_READERS = new WeakMap();
+
+export function captureSkillReleaseRegistryReader(value) {
+  const reader = REGISTRY_READERS.get(value);
+  if (
+    !reader ||
+    Object.getPrototypeOf(value) !== SkillReleaseRegistry.prototype
+  )
+    throw new TypeError("a genuine SkillReleaseRegistry reader is required");
+  return reader;
+}
 const INTENT_SCHEMA = "chainlesschain.skill-release-transition-intent/v2";
 const RELEASE_DOMAIN = `${SKILL_RELEASE_SCHEMA}\0`;
 const STATE_DOMAIN = `${SKILL_RELEASE_STATE_SCHEMA}\0`;
@@ -76,6 +87,9 @@ const TENANT_KEY_PATTERN = /^[a-f0-9]{64}$/u;
 const TEMP_PATTERN = /^\.(?:release|state|write)-[A-Za-z0-9._-]+\.tmp$/u;
 const MAX_FILE_BYTES = 4 * 1024 * 1024;
 const MAX_TENANT_MARKER_BYTES = 4096;
+export const SKILL_RELEASE_INVENTORY_MAX_ENTRIES = 4_096;
+export const SKILL_RELEASE_INVENTORY_MAX_BYTES = 32 * 1024 * 1024;
+export const SKILL_RELEASE_INVENTORY_MAX_NODES = 1_000_000;
 const MAX_CANONICAL_DEPTH = 32;
 const MAX_CANONICAL_NODES = 100_000;
 const MAX_CANONICAL_ARRAY_ENTRIES = 65_536;
@@ -2765,6 +2779,18 @@ export class SkillReleaseRegistry {
         { cause },
       );
     }
+    REGISTRY_READERS.set(
+      this,
+      Object.freeze({
+        tenantId: ownerTenantId,
+        readActive: SkillReleaseRegistry.prototype.readActive.bind(this),
+        readState: SkillReleaseRegistry.prototype.readState.bind(this),
+        readRelease: SkillReleaseRegistry.prototype.readRelease.bind(this),
+        readInventory:
+          SkillReleaseRegistry.prototype.readInventory.bind(this),
+        matchesTransactionLedger: (value) => value === transactionLedger,
+      }),
+    );
     Object.freeze(this);
   }
 
@@ -3677,7 +3703,7 @@ export class SkillReleaseRegistry {
       });
       let projection;
       try {
-        projection = this.#ledgerMigrate(request);
+        projection = this.#ledgerMigrate(request, { active, lastKnownGood });
       } catch (cause) {
         throw failure(
           "SKILL_RELEASE_STATE_MIGRATION_LEDGER_FAILED",
@@ -3861,6 +3887,144 @@ export class SkillReleaseRegistry {
         });
   }
 
+  #readInventoryNames(area, pattern) {
+    const directory = this.#directories[area]?.path;
+    if (!directory || typeof this.#fs.opendirSync !== "function") {
+      throw failure(
+        "SKILL_RELEASE_STORE_UNSAFE",
+        "release inventory requires bounded directory enumeration",
+      );
+    }
+    const names = [];
+    let handle = null;
+    let enumerationError = null;
+    try {
+      handle = this.#fs.opendirSync(directory);
+      while (true) {
+        const entry = handle.readSync();
+        if (entry === null) break;
+        if (
+          !entry ||
+          typeof entry.name !== "string" ||
+          !pattern.test(entry.name)
+        ) {
+          throw failure(
+            "SKILL_RELEASE_STORE_UNSAFE",
+            `release inventory found an unexpected ${area} entry`,
+          );
+        }
+        if (names.length >= SKILL_RELEASE_INVENTORY_MAX_ENTRIES) {
+          throw failure(
+            "SKILL_RELEASE_STORE_LIMIT",
+            `release inventory ${area} entry limit was exceeded`,
+          );
+        }
+        names.push(entry.name);
+      }
+    } catch (cause) {
+      enumerationError =
+        cause instanceof SkillReleaseRegistryError
+          ? cause
+          : failure(
+              "SKILL_RELEASE_STORE_UNSAFE",
+              `release inventory could not enumerate ${area} safely`,
+              { cause },
+            );
+    }
+    if (handle !== null && typeof handle.closeSync === "function") {
+      try {
+        handle.closeSync();
+      } catch (cause) {
+        enumerationError = failure(
+          "SKILL_RELEASE_STORE_UNSAFE",
+          `release inventory could not close ${area} safely`,
+          { cause, enumerationError },
+        );
+      }
+    }
+    if (enumerationError !== null) throw enumerationError;
+    return names.sort();
+  }
+
+  readInventory() {
+    this.#assertBoundary();
+    const releasePattern = /^[a-f0-9]{64}\.json$/u;
+    const statePattern = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*\.json$/u;
+    const beforeReleases = this.#readInventoryNames(
+      "artifacts",
+      releasePattern,
+    );
+    const beforeStates = this.#readInventoryNames("active", statePattern);
+    if (
+      beforeReleases.length + beforeStates.length >
+      SKILL_RELEASE_INVENTORY_MAX_ENTRIES
+    ) {
+      throw failure(
+        "SKILL_RELEASE_STORE_LIMIT",
+        "release inventory aggregate entry limit was exceeded",
+      );
+    }
+    const releases = beforeReleases.map((name) =>
+      this.readRelease(`sha256:${name.slice(0, -".json".length)}`),
+    );
+    const active = beforeStates.map((name) => {
+      const skill = name.slice(0, -".json".length);
+      const value = this.readActive(skill);
+      if (value === null) {
+        throw failure(
+          "SKILL_RELEASE_STATE_CORRUPT",
+          "persisted active state has no committed release",
+        );
+      }
+      return deepFreeze({ skillName: skill, ...value });
+    });
+    let bytes = 0;
+    let nodes = 0;
+    const stack = [...releases, ...active.map(({ state }) => state)];
+    for (const value of stack) {
+      bytes += Buffer.byteLength(canonicalJson(value), "utf8");
+      const pending = [value];
+      while (pending.length > 0) {
+        const node = pending.pop();
+        nodes += 1;
+        if (nodes > SKILL_RELEASE_INVENTORY_MAX_NODES) {
+          throw failure(
+            "SKILL_RELEASE_STORE_LIMIT",
+            "release inventory aggregate node limit was exceeded",
+          );
+        }
+        if (node !== null && typeof node === "object") {
+          pending.push(...(Array.isArray(node) ? node : Object.values(node)));
+        }
+      }
+    }
+    if (bytes > SKILL_RELEASE_INVENTORY_MAX_BYTES) {
+      throw failure(
+        "SKILL_RELEASE_STORE_LIMIT",
+        "release inventory aggregate byte limit was exceeded",
+      );
+    }
+    const afterReleases = this.#readInventoryNames("artifacts", releasePattern);
+    const afterStates = this.#readInventoryNames("active", statePattern);
+    const afterStateDigests = afterStates.map((name) =>
+      this.readState(name.slice(0, -".json".length)).stateDigest,
+    );
+    if (
+      canonicalJson(beforeReleases) !== canonicalJson(afterReleases) ||
+      canonicalJson(beforeStates) !== canonicalJson(afterStates) ||
+      active.some(
+        ({ state }, index) => state.stateDigest !== afterStateDigests[index],
+      )
+    ) {
+      throw failure(
+        "SKILL_RELEASE_STORE_UNSAFE",
+        "release inventory changed during authenticated enumeration",
+      );
+    }
+    this.#assertBoundary();
+    return deepFreeze({ active, releases });
+  }
+
   pinActive(name) {
     const active = this.readActive(name);
     if (!active)
@@ -4606,10 +4770,10 @@ export class SkillReleaseRegistry {
     );
   }
 
-  #prepare(intent) {
+  #prepare(intent, targetRelease) {
     let projection;
     try {
-      projection = this.#ledgerPrepare(intent);
+      projection = this.#ledgerPrepare(intent, targetRelease);
     } catch (cause) {
       throw failure(
         "SKILL_RELEASE_LEDGER_PREPARE_FAILED",
@@ -5374,7 +5538,7 @@ export class SkillReleaseRegistry {
       await this.#crash("after-journal", journal);
 
       this.#renewLease(lease);
-      prepareReceipt = this.#prepare(intent);
+      prepareReceipt = this.#prepare(intent, target);
       journal = this.#persistJournal({
         ...journal,
         phase: "prepared",