chainlesschain 0.166.45 → 0.166.47

package/src/lib/evolution/evidence-backed-wiki-maintainer.js

@@ -1,4 +1,5 @@
 import { createHash } from "node:crypto";
+import { assertEvolutionContentContainsNoKnownSecrets } from "./evolution-evidence-projector.js";
 
 export const WIKI_STATE_SCHEMA = "chainlesschain.evolution-wiki-state/v1";
 export const WIKI_EVIDENCE_SCHEMA = "chainlesschain.evolution-wiki-evidence/v1";
@@ -126,6 +127,105 @@ function assertMetadataOnly(value, path = "data") {
   }
 }
 
+function assertWikiPlaintextSafe(value) {
+  const isDecisionDigestRef = (candidate) =>
+    typeof candidate === "string" &&
+    candidate.startsWith("decision:") &&
+    DIGEST.test(candidate.slice("decision:".length));
+  const isBoundMaintenanceRequestMapKey = (path, key, child) =>
+    path.length === 1 &&
+    path[0] === "maintenanceRequests" &&
+    MAINTENANCE_REQUEST_ID.test(key) &&
+    child &&
+    typeof child === "object" &&
+    !Array.isArray(child) &&
+    DIGEST.test(child.requestDigest ?? "") &&
+    key === `wiki-maintenance:${child.requestDigest.slice("sha256:".length)}`;
+  const isBoundProposalDecisionEvidence = (path, key, child) =>
+    path.length === 1 &&
+    path[0] === "evidence" &&
+    isDecisionDigestRef(key) &&
+    child &&
+    typeof child === "object" &&
+    !Array.isArray(child) &&
+    child.kind === "proposal-decision" &&
+    child.ref === key;
+  const isProposalDecisionEvidenceRecord = (path, item) =>
+    path.length === 2 &&
+    path[0] === "evidence" &&
+    isDecisionDigestRef(path[1]) &&
+    item?.kind === "proposal-decision" &&
+    item.ref === path[1];
+  const isBoundProposalDecisionArtifactRef = (path, item, key, child) =>
+    key === "artifactRef" &&
+    isProposalDecisionEvidenceRecord(path, item) &&
+    DIGEST.test(item.data?.releaseDigest ?? "") &&
+    child ===
+      `artifact://${item.tenantId}/trusted/${item.data.releaseDigest.slice("sha256:".length)}`;
+  const isBoundProposalDecisionReceiptRef = (path, item, key, child) =>
+    path.length === 4 &&
+    path[0] === "skillImpact" &&
+    path[2] === "decisions" &&
+    path[3] === "[]" &&
+    key === "receiptRef" &&
+    DIGEST.test(item.candidateId ?? "") &&
+    child === `decision:${item.candidateId}`;
+  const isProposalImpactCandidateSubject = (path, item, key, child) =>
+    path.length === 2 &&
+    path[0] === "evolutionLog" &&
+    path[1] === "[]" &&
+    key === "subjectId" &&
+    item.type === "proposal-impact-recorded" &&
+    DIGEST.test(child ?? "");
+  const isBoundProtocolValue = (path, item, key, child) =>
+    (key.endsWith("Digest") && DIGEST.test(child ?? "")) ||
+    (key === "candidateId" && DIGEST.test(child ?? "")) ||
+    isProposalImpactCandidateSubject(path, item, key, child) ||
+    isBoundProposalDecisionReceiptRef(path, item, key, child) ||
+    isBoundProposalDecisionArtifactRef(path, item, key, child) ||
+    (isProposalDecisionEvidenceRecord(path, item) &&
+      key === "ref" &&
+      child === path[1]) ||
+    (key === "revisionId" && REVISION_ID.test(child ?? "")) ||
+    (key === "requestId" && MAINTENANCE_REQUEST_ID.test(child ?? ""));
+  const inspect = (item, path = []) => {
+    if (typeof item === "string") {
+      assertEvolutionContentContainsNoKnownSecrets(item);
+    } else if (Array.isArray(item)) {
+      item.forEach((child) => inspect(child, [...path, "[]"]));
+    } else if (item && typeof item === "object") {
+      for (const [key, child] of Object.entries(item)) {
+        // Maintenance requests are stored under their validated, digest-bound
+        // request ID. The map key is opaque protocol metadata, not model text;
+        // inspecting random hash bytes as prose can falsely match PII patterns.
+        // Restrict the exemption to the state map and inspect its complete
+        // record so an untrusted lookalike key cannot bypass this boundary.
+        if (
+          !isBoundMaintenanceRequestMapKey(path, key, child) &&
+          !isBoundProposalDecisionEvidence(path, key, child)
+        )
+          assertEvolutionContentContainsNoKnownSecrets(key);
+        // Protocol metadata can carry random hash bytes that accidentally match
+        // a PII detector. Every exemption is bound to its state path, schema and
+        // sibling fields; prose and lookalikes still go through the detector.
+        if (isBoundProtocolValue(path, item, key, child)) continue;
+        if (["string", "number"].includes(typeof child))
+          assertEvolutionContentContainsNoKnownSecrets(`${key}=${child}`);
+        inspect(child, [...path, key]);
+      }
+    }
+  };
+  try {
+    inspect(value);
+  } catch (cause) {
+    const error = new Error("Wiki revision contains secret or PII plaintext", {
+      cause,
+    });
+    error.code = "WIKI_MAINTAINER_SECRET_LEAK";
+    throw error;
+  }
+}
+
 export function createEmptyWikiState(tenantId) {
   return freeze({
     schema: WIKI_STATE_SCHEMA,
@@ -301,6 +401,36 @@ function evidenceUsable(item, effectiveAt) {
   );
 }
 
+// Corroboration needs distinct content AND distinct trust domains. Counting
+// either set alone lets the same observation be repeated under new identities.
+// A bounded bipartite matching also handles policies requiring >2 sources,
+// where min(unique contents, unique domains) can still overcount independence.
+function independentSourceCount(evidence) {
+  const domains = new Map();
+  for (const item of evidence) {
+    if (!domains.has(item.trustDomain))
+      domains.set(item.trustDomain, new Set());
+    domains.get(item.trustDomain).add(item.sourceDigest);
+  }
+  const matchedSources = new Map();
+  const match = (domain, visited) => {
+    for (const source of domains.get(domain)) {
+      if (visited.has(source)) continue;
+      visited.add(source);
+      if (
+        !matchedSources.has(source) ||
+        match(matchedSources.get(source), visited)
+      ) {
+        matchedSources.set(source, domain);
+        return true;
+      }
+    }
+    return false;
+  };
+  for (const domain of domains.keys()) match(domain, new Set());
+  return matchedSources.size;
+}
+
 function rebuildDerivedState(state, effectiveAt, descriptor) {
   const dependents = {};
   for (const pattern of Object.values(state.patterns)) {
@@ -352,7 +482,10 @@ function rebuildDerivedState(state, effectiveAt, descriptor) {
       pattern.status = WIKI_PATTERN_STATUS.STALE;
     } else if (negative.length > 0 || pattern.contradicts.length > 0)
       pattern.status = WIKI_PATTERN_STATUS.CONTRADICTED;
-    else if (hasGrader || domains.length >= descriptor.minCorroboratingSources)
+    else if (
+      hasGrader ||
+      independentSourceCount(positive) >= descriptor.minCorroboratingSources
+    )
       pattern.status = WIKI_PATTERN_STATUS.CORROBORATED;
     else pattern.status = WIKI_PATTERN_STATUS.HYPOTHESIS;
     pattern.trustDomains = domains;
@@ -735,6 +868,10 @@ export class EvidenceBackedWikiMaintainer {
         revisionId: state.revisionId,
       };
     }
+    // Trusted inputs do not make a model's derived output safe to persist.
+    // Inspect the complete outgoing state, including reasons, index and log,
+    // before publishing any revision artifact. Share the Raw/Skill policy.
+    assertWikiPlaintextSafe(state);
     const stateDigest = hash(state);
     const revision = freeze({
       ...revisionPayload,
@@ -742,6 +879,22 @@ export class EvidenceBackedWikiMaintainer {
       stateDigest,
       state: freeze(clone(state)),
     });
+    // Derivation may await a model or another worker. Re-resolve through the
+    // trusted evidence boundary immediately before writing: prior read success
+    // is not permission to publish after revocation, deletion, or expiry. A
+    // changed but valid envelope requires fresh derivation, never a silent swap.
+    for (const ref of refs) {
+      const current = verifyEvidence(
+        await this._ports.resolveEvidence(ref),
+        this.descriptor.tenantId,
+        ref,
+      );
+      if (current.envelopeDigest !== evidenceByRef.get(ref).envelopeDigest) {
+        const error = new Error("Wiki evidence changed during derivation");
+        error.code = "WIKI_MAINTAINER_EVIDENCE_CHANGED";
+        throw error;
+      }
+    }
     const committed = await this._ports.commitRevision(
       freeze({ expectedStateDigest: priorStateDigest, revision }),
     );

package/src/lib/evolution/evolution-artifact-ports.js

@@ -78,6 +78,8 @@ export const EVOLUTION_ARTIFACT_LEDGER_RETENTION_TYPES = Object.freeze([
   "skill-registry-transition-request",
   "skill-registry-transition-settlement",
   "skill-retrieval-revocation-state",
+  "skill-runtime-revalidation-state",
+  "evolution-ledger-v2-journal",
   "evolution-run-event",
   "evolution-eval-child-evidence",
   "evolution-raw-deletion-receipt",
@@ -177,6 +179,8 @@ export const EVOLUTION_ARTIFACT_TYPES = Object.freeze([
   "skill-registry-transition-request",
   "skill-registry-transition-settlement",
   "skill-retrieval-revocation-state",
+  "skill-runtime-revalidation-state",
+  "evolution-ledger-v2-journal",
   "skill-release-finalization",
   "skill-release-state-migration",
   "structured-memory-authority-receipt",
@@ -381,6 +385,8 @@ const LEDGER_RETENTION_PURPOSES_BY_TYPE = new Map([
   ["skill-registry-transition-request", new Set(["evolution-ledger"])],
   ["skill-registry-transition-settlement", new Set(["evolution-ledger"])],
   ["skill-retrieval-revocation-state", new Set(["evolution-ledger"])],
+  ["skill-runtime-revalidation-state", new Set(["evolution-ledger"])],
+  ["evolution-ledger-v2-journal", new Set(["evolution-ledger"])],
   ["wiki-pruning-journal", new Set(["evolution-ledger"])],
   ["wiki-pruning-retrieval-projection", new Set(["evolution-ledger"])],
   ["evolution-run-event", new Set(["evolution-ledger"])],

package/src/lib/evolution/evolution-deployment-loader.js

@@ -27,6 +27,7 @@ const SUPPORTED_COMMANDS = new Set([
   "marketplace",
   "orchestrate",
   "serve",
+  "skill",
   "stream",
   "ui",
 ]);
@@ -128,11 +129,129 @@ function dependencies(value, commandName) {
     throw new TypeError(
       `evolution deployment returned invalid dependencies for ${commandName}`,
     );
-  return Object.freeze({ ...value });
+  return Object.freeze({
+    ...value,
+    ...(["agent", "skill", "chat", "serve"].includes(commandName)
+      ? { skillRuntimeAdmissionRequired: true }
+      : {}),
+  });
+}
+
+function deniedAgentDependencies(commandName, code, message, source = null) {
+  if (commandName !== "agent") return null;
+  const evolutionCompositionFactory = Object.freeze(async () => {
+    const error = new Error(message);
+    error.code = code;
+    throw error;
+  });
+  if (
+    source === null ||
+    typeof source !== "object" ||
+    Array.isArray(source) ||
+    utilTypes.isProxy(source)
+  ) {
+    return Object.freeze({ evolutionCompositionFactory });
+  }
+  const descriptors = Object.getOwnPropertyDescriptors(source);
+  const result = {};
+  for (const [name, descriptor] of Object.entries(descriptors)) {
+    if (name === "evolutionCompositionFactory" || !("value" in descriptor)) {
+      continue;
+    }
+    Object.defineProperty(result, name, {
+      value: descriptor.value,
+      enumerable: descriptor.enumerable,
+      configurable: false,
+      writable: false,
+    });
+  }
+  Object.defineProperty(result, "evolutionCompositionFactory", {
+    value: evolutionCompositionFactory,
+    enumerable: true,
+    configurable: false,
+    writable: false,
+  });
+  return Object.freeze(result);
+}
+
+function authenticatedDependencies(value, commandName) {
+  if (commandName !== "agent") return dependencies(value, commandName);
+  if (
+    value === null ||
+    typeof value !== "object" ||
+    Array.isArray(value) ||
+    utilTypes.isProxy(value)
+  ) {
+    return deniedAgentDependencies(
+      commandName,
+      "EVOLUTION_DEPLOYMENT_INVALID_DEPENDENCIES",
+      "Authenticated agent deployment returned invalid dependencies",
+    );
+  }
+  const descriptor = Object.getOwnPropertyDescriptor(
+    value,
+    "evolutionCompositionFactory",
+  );
+  if (
+    !descriptor ||
+    !("value" in descriptor) ||
+    typeof descriptor.value !== "function" ||
+    descriptor.enumerable !== true
+  ) {
+    return deniedAgentDependencies(
+      commandName,
+      "EVOLUTION_DEPLOYMENT_INVALID_DEPENDENCIES",
+      "Authenticated agent deployment did not provide an evolution composition factory",
+      value,
+    );
+  }
+  return dependencies(value, commandName);
 }
 
 async function loadBuiltInFactories(commandName) {
   const factories = {};
+  if (
+    ["agent", "skill", "chat", "serve", "evolution", "learning"].includes(
+      commandName,
+    )
+  ) {
+    const [
+      runtime,
+      adapter,
+      registry,
+      ledgerPorts,
+      artifactPorts,
+      ledgerBackend,
+      artifactStore,
+      manifest,
+    ] = await Promise.all([
+      import("./skill-runtime-revalidation.js"),
+      import("./skill-runtime-revalidation-ledger-adapter.js"),
+      import("./skill-release-registry.js"),
+      import("./evolution-ledger-ports.js"),
+      import("./evolution-artifact-ports.js"),
+      import("./evolution-ledger-file-backend.js"),
+      import("../artifact-store.js"),
+      import("./skill-execution-manifest.js"),
+    ]);
+    Object.assign(factories, {
+      createSkillRuntimeRevalidationAuthority:
+        runtime.createSkillRuntimeRevalidationAuthority,
+      createSkillRuntimeRevalidationLedgerAdapter: (options) =>
+        new adapter.SkillRuntimeRevalidationLedgerAdapter(options),
+      createSkillReleaseRegistry: (options) =>
+        new registry.SkillReleaseRegistry(options),
+      createEvolutionLedgerPorts: ledgerPorts.createEvolutionLedgerPorts,
+      createEvolutionArtifactPorts: (options) =>
+        new artifactPorts.EvolutionArtifactPorts(options),
+      createEvolutionLedgerFileBackend:
+        ledgerBackend.createEvolutionLedgerFileBackend,
+      createArtifactStore: (options) =>
+        new artifactStore.ArtifactStore(options),
+      buildSkillRuntimeManifest: manifest.buildSkillRuntimeManifest,
+      buildSkillDependencyLock: manifest.buildSkillDependencyLock,
+    });
+  }
   if (commandName === "learning") {
     const [
       { createGovernedSkillSynthesisCliHost },
@@ -229,9 +348,7 @@ async function loadBuiltInFactories(commandName) {
       import("./evolution-eval-process-supervisor.js"),
       import("./governed-skill-synthesis-attestor-trust-approval-client.js"),
       import("./governed-skill-synthesis-attestor-trust-operations-client.js"),
-      import(
-        "./governed-skill-synthesis-attestor-trust-operations-cli-host.js"
-      ),
+      import("./governed-skill-synthesis-attestor-trust-operations-cli-host.js"),
     ]);
     factories.createEvolutionWorkbenchCliHost = createEvolutionWorkbenchCliHost;
     factories.createEvolutionWorkbenchReviewRuntime =
@@ -346,6 +463,7 @@ async function loadBuiltInFactories(commandName) {
   }
   if (
     commandName === "agent" ||
+    commandName === "learning" ||
     commandName === "ask" ||
     commandName === "chat" ||
     commandName === "compact" ||
@@ -355,14 +473,47 @@ async function loadBuiltInFactories(commandName) {
     commandName === "cowork" ||
     commandName === "orchestrate" ||
     commandName === "serve" ||
+    commandName === "skill" ||
     commandName === "stream" ||
     commandName === "ui"
   ) {
-    const { createAgentEvolutionRuntimeComposition } = await import(
-      "./agent-evolution-runtime-composition.js"
-    );
+    const {
+      assembleAgentSkillOutcomeIndexFromCatalog,
+      createAgentEvolutionRuntimeComposition,
+    } = await import("./agent-evolution-runtime-composition.js");
     factories.createAgentEvolutionRuntimeComposition =
       createAgentEvolutionRuntimeComposition;
+    const [
+      { createEvolutionEvalRuntimeComposition },
+      { EvolutionEvalGate, EvolutionEvalReceiptVerifier },
+      { createEvolutionEvalProcessSupervisor },
+    ] = await Promise.all([
+      import("./evolution-eval-runtime-composition.js"),
+      import("./evolution-eval-gate.js"),
+      import("./evolution-eval-process-supervisor.js"),
+    ]);
+    Object.assign(factories, {
+      createEvolutionEvalRuntimeComposition,
+      createEvolutionEvalGate: (options) => new EvolutionEvalGate(options),
+      createEvolutionEvalReceiptVerifier: (options) =>
+        new EvolutionEvalReceiptVerifier(options),
+      createEvolutionEvalProcessSupervisor,
+    });
+    if (commandName === "skill") {
+      const [
+        { createSkillOutcomeSourceCatalogAuthority },
+        { createSkillVectorProcessAuthority },
+      ] = await Promise.all([
+        import("./skill-outcome-source-catalog-authority.js"),
+        import("../skill-vector-process-authority.js"),
+      ]);
+      factories.assembleAgentSkillOutcomeIndexFromCatalog =
+        assembleAgentSkillOutcomeIndexFromCatalog;
+      factories.createSkillOutcomeSourceCatalogAuthority =
+        createSkillOutcomeSourceCatalogAuthority;
+      factories.createSkillVectorProcessAuthority =
+        createSkillVectorProcessAuthority;
+    }
   }
   return Object.freeze(factories);
 }
@@ -382,6 +533,7 @@ function bindFactoriesToModule(factories, moduleDigest) {
     "createWikiSkillBenchmarkGrader",
     "createWikiSkillBenchmarkReportAttestor",
     "createWikiSkillBenchmarkRunner",
+    "createEvolutionEvalRuntimeComposition",
   ];
   for (const name of providerFactories) {
     if (typeof factories[name] !== "function") continue;
@@ -494,6 +646,20 @@ export async function loadEvolutionDeploymentCommandDependencies(
   let saved = null;
   if (!descriptorPath && !trustRootPath) {
     saved = await readEvolutionDeploymentProfile({ env });
+    if (saved.error) {
+      return deniedAgentDependencies(
+        commandName,
+        "EVOLUTION_DEPLOYMENT_PROFILE_INVALID",
+        "Saved evolution deployment profile is invalid",
+      );
+    }
+    if (saved.profile && !saved.profile.enabled) {
+      return deniedAgentDependencies(
+        commandName,
+        "EVOLUTION_DEPLOYMENT_DISABLED",
+        "Saved evolution deployment profile is disabled",
+      );
+    }
     if (!saved.error && saved.profile?.enabled) {
       descriptorPath = saved.profile.descriptorPath;
       trustRootPath = saved.profile.trustRootPath;
@@ -531,11 +697,23 @@ export async function loadEvolutionDeploymentCommandDependencies(
     // governed capabilities fail-closed while allowing `deployment status`,
     // `configure`, and `disable` to start so the operator can recover. Explicit
     // environment overrides remain strict and surface the error immediately.
-    if (fromSavedProfile) return null;
+    if (fromSavedProfile) {
+      return deniedAgentDependencies(
+        commandName,
+        error?.code || "EVOLUTION_DEPLOYMENT_NOT_VERIFIED",
+        `Saved evolution deployment could not be verified: ${error?.message || String(error)}`,
+      );
+    }
     throw error;
   }
   const { descriptor, moduleBytes } = verified;
-  if (!descriptor.commands.includes(commandName)) return null;
+  if (!descriptor.commands.includes(commandName)) {
+    return deniedAgentDependencies(
+      commandName,
+      "EVOLUTION_DEPLOYMENT_COMMAND_NOT_ALLOWED",
+      `Signed evolution deployment does not admit command: ${commandName}`,
+    );
+  }
   // Import the exact bytes that were authenticated. Importing modulePath here
   // would reopen a pathname-replacement window between hashing and execution.
   // Deployment entrypoints are therefore single-file ESM bundles; any external
@@ -578,7 +756,7 @@ export async function loadEvolutionDeploymentCommandDependencies(
       "additional evolution deployment factories are invalid",
     );
   }
-  return dependencies(
+  return authenticatedDependencies(
     await loaded.createChainlessChainCommandDependencies(
       Object.freeze({
         commandName,

package/src/lib/evolution/evolution-eval-gate.js

@@ -6437,6 +6437,14 @@ export class EvolutionEvalReceiptVerifier {
 Object.freeze(EvolutionEvalGate.prototype);
 Object.freeze(EvolutionEvalReceiptVerifier.prototype);
 
+export function isEvolutionEvalGate(value) {
+  return GATE_INSTANCES.has(value);
+}
+
+export function isEvolutionEvalReceiptVerifier(value) {
+  return RECEIPT_VERIFIER_INSTANCES.has(value);
+}
+
 export async function runEvolutionEvalGate(gate, request) {
   if (!GATE_INSTANCES.has(gate)) {
     throw evalError(