chainlesschain 0.166.76 → 0.166.78

package/src/lib/doctor-checkup.js

@@ -26,6 +26,7 @@ import {
   rmSync,
 } from "node:fs";
 import { join, basename } from "node:path";
+import { release as kernelRelease } from "node:os";
 import { getHomeDir, getConfigPath } from "./paths.js";
 import { inspectPrivatePaths, repairPrivatePaths } from "./secure-fs.js";
 import executionBroker from "./process-execution-broker/index.js";
@@ -68,6 +69,7 @@ export const _deps = {
   spawnSync: (...args) => executionBroker.spawnSync(...args),
   now: () => Date.now(),
   platform: () => process.platform,
+  kernelRelease,
 };
 
 function check(id, name, level, detail = "", fix = null) {
@@ -1242,12 +1244,39 @@ async function runtimeSection(opts, deps) {
 
 // ── execution context (P1-7) ───────────────────────────────────────────────
 // "任务在哪执行是 Session 一等属性": surface the DETECTED execution location and
-// the fail-closed permission posture it implies. Read-only advisory — it never
-// blocks. A local trusted machine is OK; a remote/unknown environment is a WARN
+// the fail-closed permission posture it implies. Read-only diagnosis; this does
+// not change execution authority. A remote/unknown environment is a WARN
 // because a session there fails closed to read-only unless powers are granted
 // explicitly (and any policy violation from the pure model is listed).
 async function executionSection(opts, deps) {
   const checks = [];
+  try {
+    // WSL1 lacks STATX_BTIME: Node substitutes mutable ctime for birthtime.
+    // Do not silently drop generation from workspace identity, reset consent,
+    // or claim that a different kernel establishes filesystem trust support.
+    if (
+      deps.platform() === "linux" &&
+      /^4\.4\..*-Microsoft$/iu.test(deps.kernelRelease())
+    ) {
+      checks.push(
+        check(
+          "workspace-trust-identity",
+          "Workspace trust filesystem identity",
+          CHECK_LEVELS.ERR,
+          "WSL1 reports mutable change time as creation time; workspace consent can be lost after directory edits or moves. Use the native Windows CLI for workspace trust operations. There is no safe automatic repair.",
+        ),
+      );
+    }
+  } catch {
+    checks.push(
+      check(
+        "workspace-trust-identity",
+        "Workspace trust filesystem identity",
+        CHECK_LEVELS.ERR,
+        "Kernel information is unavailable; the WSL1 workspace trust limitation could not be checked.",
+      ),
+    );
+  }
   try {
     const {
       detectAmbientLocation,

package/src/lib/durable-security-store.js

@@ -48,7 +48,12 @@ export function readSecurityStore(filePath, label) {
 
 export function writeSecurityStore(filePath, label, store) {
   const directory = path.dirname(filePath);
-  fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+  // A caller may already hold a Linux directory through /proc/self/fd/N.
+  // WSL1 refuses mkdir on that existing descriptor alias; keep all later
+  // writes and fsync bound to the held directory without reopening its path.
+  if (!fs.statSync(directory, { throwIfNoEntry: false })?.isDirectory()) {
+    fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+  }
   const temporaryPath = path.join(
     directory,
     `.${path.basename(filePath)}.${process.pid}.${crypto.randomUUID()}.tmp`,

package/src/lib/evolution/evolution-artifact-identity.js

@@ -0,0 +1,21 @@
+import os from "node:os";
+
+// WSL1's stat fallback reports ctime as birthtime. Creating an index or child
+// directory changes that value without replacing the object. It supplies no
+// creation-time identity; keep device/inode and the caller's no-link, physical
+// containment and descriptor checks. WSL2 and other platforms retain birthtime.
+export function artifactPhysicalIdentity(
+  stat,
+  { platform = process.platform, kernelRelease = os.release() } = {},
+) {
+  const birthtimeMs = Number(stat.birthtimeMs);
+  const wsl1CtimeFallback =
+    platform === "linux" &&
+    /^4\.4\..*-Microsoft$/iu.test(kernelRelease) &&
+    birthtimeMs === Number(stat.ctimeMs);
+  return Object.freeze({
+    birthtimeMs: wsl1CtimeFallback ? null : birthtimeMs,
+    dev: String(stat.dev),
+    ino: String(stat.ino),
+  });
+}

package/src/lib/evolution/evolution-artifact-ports.js

@@ -13,6 +13,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { types as utilTypes } from "node:util";
 import { ArtifactStore } from "../artifact-store.js";
+import { artifactPhysicalIdentity as physicalIdentity } from "./evolution-artifact-identity.js";
 import { withEvolutionFileIdentity } from "./evolution-file-identity.js";
 import {
   EVOLUTION_ARTIFACT_REF_SCHEMA,
@@ -1060,19 +1061,12 @@ function isContained(root, candidate) {
   );
 }
 
-function physicalIdentity(stat) {
-  return Object.freeze({
-    birthtimeMs: Number(stat.birthtimeMs),
-    dev: String(stat.dev),
-    ino: String(stat.ino),
-  });
-}
-
 function samePhysicalIdentity(stat, expected) {
+  const actual = physicalIdentity(stat);
   return (
-    String(stat.dev) === expected.dev &&
-    String(stat.ino) === expected.ino &&
-    Number(stat.birthtimeMs) === expected.birthtimeMs
+    actual.dev === expected.dev &&
+    actual.ino === expected.ino &&
+    actual.birthtimeMs === expected.birthtimeMs
   );
 }
 

package/src/lib/evolution/evolution-eval-cohort-receipt-reconciliation.js

@@ -0,0 +1,389 @@
+/** Join a sealed admission inventory to presented final Eval receipts.
+ * Missing receipts stay unresolved; a caller-supplied set cannot prove global coverage.
+ */
+import { createHash } from "node:crypto";
+import { isProxy } from "node:util/types";
+import {
+  resolveEvolutionEvalCohortEnrollment,
+  resolveEvolutionEvalCohortReconciliation,
+} from "./evolution-eval-cohort-enrollment.js";
+import {
+  computeEvolutionEvalContextDigest,
+  computeEvolutionEvalLaunchRequestDigest,
+  isEvolutionEvalReceiptVerifier,
+  verifyEvolutionEvalReceipt,
+} from "./evolution-eval-gate.js";
+import { verifyPmExplorationEffectAttemptCohort } from "./pm-exploration-benchmark.js";
+
+export const EVOLUTION_EVAL_COHORT_RECEIPT_RECONCILIATION_SCHEMA =
+  "chainlesschain.evolution-eval-cohort-receipt-reconciliation/v1";
+export const EVOLUTION_EVAL_COHORT_RECEIPT_RECONCILIATION_FAILED_CODE =
+  "CC_EVOLUTION_EVAL_COHORT_RECEIPT_RECONCILIATION_FAILED";
+export const PM_EXPLORATION_ADMISSION_BOUND_COHORT_SCHEMA =
+  "chainlesschain.pm-exploration-admission-bound-cohort/v1";
+
+function fail(message) {
+  const error = new Error(message);
+  error.code = EVOLUTION_EVAL_COHORT_RECEIPT_RECONCILIATION_FAILED_CODE;
+  throw error;
+}
+
+function snapshot(value, budget = { nodes: 0, chars: 0 }, depth = 0) {
+  if (++budget.nodes > 50_000 || depth > 50)
+    fail("cohort receipt evidence exceeds structural limits");
+  if (value === null || typeof value === "boolean") return value;
+  if (typeof value === "number" && Number.isFinite(value)) return value;
+  if (typeof value === "string") {
+    budget.chars += value.length;
+    if (budget.chars > 4_000_000)
+      fail("cohort receipt evidence exceeds size limit");
+    return value;
+  }
+  if (!value || typeof value !== "object" || isProxy(value))
+    fail("cohort receipt evidence must contain plain JSON data");
+  if (Array.isArray(value)) {
+    if (
+      Object.getPrototypeOf(value) !== Array.prototype ||
+      Reflect.ownKeys(value).length !== value.length + 1
+    )
+      fail("cohort receipt array must be dense own data");
+    return Array.from({ length: value.length }, (_, index) => {
+      const property = Object.getOwnPropertyDescriptor(value, String(index));
+      if (!property || !("value" in property))
+        fail("cohort receipt array must be own data");
+      return snapshot(property.value, budget, depth + 1);
+    });
+  }
+  if (![Object.prototype, null].includes(Object.getPrototypeOf(value)))
+    fail("cohort receipt evidence must be plain data");
+  return Object.fromEntries(
+    Reflect.ownKeys(value).map((key) => {
+      const property = Object.getOwnPropertyDescriptor(value, key);
+      if (
+        typeof key !== "string" ||
+        !property?.enumerable ||
+        !("value" in property)
+      )
+        fail("cohort receipt fields must be own data");
+      budget.chars += key.length;
+      if (budget.chars > 4_000_000)
+        fail("cohort receipt evidence exceeds size limit");
+      return [key, snapshot(property.value, budget, depth + 1)];
+    }),
+  );
+}
+
+function exact(value, keys, label) {
+  if (
+    !value ||
+    Array.isArray(value) ||
+    typeof value !== "object" ||
+    Reflect.ownKeys(value).length !== keys.length ||
+    keys.some((key) => !Object.hasOwn(value, key))
+  )
+    fail(`${label} must contain exactly its registered fields`);
+  return value;
+}
+
+function captureRecord(value, keys, label) {
+  if (
+    !value ||
+    Array.isArray(value) ||
+    typeof value !== "object" ||
+    isProxy(value) ||
+    ![Object.prototype, null].includes(Object.getPrototypeOf(value)) ||
+    Reflect.ownKeys(value).length !== keys.length
+  )
+    fail(`${label} must contain exactly its own data fields`);
+  return Object.fromEntries(
+    keys.map((key) => {
+      const property = Object.getOwnPropertyDescriptor(value, key);
+      if (!property?.enumerable || !("value" in property))
+        fail(`${label} must contain exactly its own data fields`);
+      return [key, property.value];
+    }),
+  );
+}
+
+function canonical(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
+  return `{${Object.keys(value)
+    .sort()
+    .map((key) => `${JSON.stringify(key)}:${canonical(value[key])}`)
+    .join(",")}}`;
+}
+
+function hash(
+  value,
+  schema = EVOLUTION_EVAL_COHORT_RECEIPT_RECONCILIATION_SCHEMA,
+) {
+  return `sha256:${createHash("sha256")
+    .update(`${schema}\0${canonical(value)}`)
+    .digest("hex")}`;
+}
+
+function frozen(value) {
+  if (value && typeof value === "object") {
+    for (const child of Object.values(value)) frozen(child);
+    Object.freeze(value);
+  }
+  return value;
+}
+
+/** Re-audit the sealed admission set after signature checks. */
+export async function reconcileEvolutionEvalCohortReceipts(
+  authority,
+  verifier,
+  input,
+) {
+  if (!isEvolutionEvalReceiptVerifier(verifier))
+    fail("a branded final Eval receipt verifier is required");
+  const source = exact(
+    snapshot(input),
+    ["cohortId", "slots"],
+    "cohort receipt source",
+  );
+  if (
+    typeof source.cohortId !== "string" ||
+    !Array.isArray(source.slots) ||
+    source.slots.length > 32
+  )
+    fail("cohort receipt slots are invalid");
+  const lookup = { cohortId: source.cohortId };
+  const enrollment = resolveEvolutionEvalCohortEnrollment(authority, lookup);
+  const sealed = await resolveEvolutionEvalCohortReconciliation(
+    authority,
+    lookup,
+  );
+  if (source.slots.length !== enrollment.evidence.slots.length)
+    fail("cohort receipt source must cover every enrolled slot");
+  const admitted = new Map(
+    sealed.inventory.admissions.map((entry) => [entry.slotId, entry]),
+  );
+  const slots = [];
+  let signedReceiptCount = 0;
+  let receiptUnavailableCount = 0;
+  for (const [index, item] of source.slots.entries()) {
+    const entry = exact(
+      item,
+      ["slotId", "launchRequest", "receipt", "receiptContext"],
+      "cohort receipt slot",
+    );
+    const registered = enrollment.evidence.slots[index];
+    if (entry.slotId !== registered.slotId)
+      fail("cohort receipt slots differ from enrolled order");
+    const admission = admitted.get(entry.slotId);
+    if (entry.receipt === null) {
+      if (entry.launchRequest !== null || entry.receiptContext !== null)
+        fail("missing receipt cannot carry a substituted source");
+      if (admission) receiptUnavailableCount += 1;
+      slots.push({
+        slotId: entry.slotId,
+        status: admission ? "receipt-unavailable" : "unadmitted",
+        admissionDigest: admission?.admissionDigest ?? null,
+        runId: admission?.runId ?? null,
+        receiptDigest: null,
+        decision: null,
+      });
+      continue;
+    }
+    if (!admission || !entry.launchRequest || !entry.receiptContext)
+      fail("signed receipt has no matching admitted slot or context");
+    const request = exact(
+      entry.launchRequest,
+      [
+        "suiteRef",
+        "candidateId",
+        "baselineId",
+        "targetEnvironmentRef",
+        "evaluationContext",
+      ],
+      "cohort launch request",
+    );
+    const context = exact(
+      entry.receiptContext,
+      [
+        "runId",
+        "runNonce",
+        "suiteDigest",
+        "policyDigest",
+        "evaluationAuthorityRoot",
+        "targetEnvironmentRef",
+        "evaluationContextDigest",
+        "candidateId",
+        "baselineId",
+        "environmentDigest",
+        "tenantId",
+        "provenanceAudience",
+        "trainerAuthority",
+        "trainerRevision",
+      ],
+      "cohort receipt context",
+    );
+    const run = exact(
+      request.evaluationContext,
+      ["planDigest", "targetMatrixRoot", "cellId", "runtimeId"],
+      "cohort evaluation context",
+    );
+    if (
+      computeEvolutionEvalLaunchRequestDigest(request) !==
+        admission.requestDigest ||
+      run.planDigest !== registered.evaluationPlanDigest ||
+      run.cellId !== entry.slotId ||
+      request.candidateId !== context.candidateId ||
+      request.baselineId !== context.baselineId ||
+      request.targetEnvironmentRef !== context.targetEnvironmentRef ||
+      context.runId !== admission.runId ||
+      context.runNonce !== admission.runNonce ||
+      context.tenantId !== enrollment.evidence.descriptor.tenantId ||
+      context.policyDigest !== registered.policyDigest ||
+      context.evaluationAuthorityRoot !== registered.evaluationAuthorityRoot ||
+      context.evaluationContextDigest !==
+        computeEvolutionEvalContextDigest({
+          ...run,
+          tenantId: context.tenantId,
+          targetEnvironmentRef: context.targetEnvironmentRef,
+          environmentDigest: context.environmentDigest,
+          candidateId: context.candidateId,
+          baselineId: context.baselineId,
+          suiteDigest: context.suiteDigest,
+          policyDigest: context.policyDigest,
+          evaluationAuthorityRoot: context.evaluationAuthorityRoot,
+        })
+    )
+      fail("signed receipt differs from admitted request or enrolled cell");
+    const verified = await verifyEvolutionEvalReceipt(
+      verifier,
+      entry.receipt,
+      context,
+    );
+    signedReceiptCount += 1;
+    slots.push({
+      slotId: entry.slotId,
+      status: "signed-receipt",
+      admissionDigest: admission.admissionDigest,
+      runId: admission.runId,
+      receiptDigest: verified.receiptDigest,
+      decision: verified.decision,
+    });
+  }
+  const finalSeal = await resolveEvolutionEvalCohortReconciliation(
+    authority,
+    lookup,
+  );
+  if (canonical(finalSeal) !== canonical(sealed))
+    fail("sealed Ledger inventory changed during receipt verification");
+  const core = {
+    schema: EVOLUTION_EVAL_COHORT_RECEIPT_RECONCILIATION_SCHEMA,
+    cohortId: source.cohortId,
+    enrollmentDigest: sealed.enrollmentDigest,
+    sealDigest: sealed.sealDigest,
+    admissionInventoryAuthenticated: true,
+    signedReceiptCount,
+    receiptUnavailableCount,
+    unadmittedSlotCount: sealed.inventory.unadmittedSlotIds.length,
+    slots,
+    presentedReceiptsAuthenticated: true,
+    receiptSetCompletenessAuthenticated: false,
+    executionCoverageAuthenticated: false,
+    cohortCompletenessAuthenticated: false,
+    promotionAuthority: false,
+  };
+  return frozen({ ...core, reconciliationDigest: hash(core) });
+}
+
+/** Bind the independently verified PM denominator to the signed admission/receipt census. */
+export async function reconcilePmExplorationAdmissionBoundCohort(
+  authority,
+  verifier,
+  input,
+) {
+  if (!isEvolutionEvalReceiptVerifier(verifier))
+    fail("a branded final Eval receipt verifier is required");
+  const source = captureRecord(
+    input,
+    ["cohortId", "receiptSlots", "cohortSource", "cohort", "registration"],
+    "PM admission-bound cohort source",
+  );
+  const receiptSlots = snapshot(source.receiptSlots);
+  const registration = exact(
+    snapshot(source.registration),
+    ["cohortId", "planDigest", "slots"],
+    "PM cohort registration",
+  );
+  // This verifier snapshots its source and expected context before its first await.
+  const pm = await verifyPmExplorationEffectAttemptCohort(
+    verifier,
+    { source: source.cohortSource, cohort: source.cohort },
+    registration,
+  );
+  const joined = await reconcileEvolutionEvalCohortReceipts(
+    authority,
+    verifier,
+    { cohortId: source.cohortId, slots: receiptSlots },
+  );
+  const enrollment = resolveEvolutionEvalCohortEnrollment(authority, {
+    cohortId: source.cohortId,
+  });
+  if (
+    pm.cohortId !== source.cohortId ||
+    registration.cohortId !== source.cohortId ||
+    pm.planDigest !== enrollment.evidence.plan.planDigest ||
+    registration.planDigest !== pm.planDigest ||
+    pm.registeredSlotCount !== enrollment.evidence.manifest.slotIds.length ||
+    pm.perArmDenominator !==
+      enrollment.evidence.manifest.plannedTestObservationsPerArm ||
+    canonical(registration.slots.map((slot) => slot.slotId)) !==
+      canonical(enrollment.evidence.manifest.slotIds)
+  )
+    fail("PM denominator differs from signed cohort enrollment");
+  for (const [index, attempt] of pm.attempts.entries()) {
+    const admitted = joined.slots[index];
+    if (
+      attempt.slotId !== admitted.slotId ||
+      (admitted.status === "signed-receipt" &&
+        (attempt.kind === "receipt-unavailable" ||
+          attempt.runId !== admitted.runId ||
+          attempt.receiptDigest !== admitted.receiptDigest)) ||
+      (admitted.status !== "signed-receipt" &&
+        (attempt.kind !== "receipt-unavailable" ||
+          attempt.runId !== null ||
+          attempt.receiptDigest !== null))
+    )
+      fail("PM attempt differs from its sealed admission and final receipt");
+  }
+  if (
+    pm.authenticatedAttemptCount !== joined.signedReceiptCount ||
+    (pm.missingReceiptCount ?? 0) !==
+      joined.receiptUnavailableCount + joined.unadmittedSlotCount
+  )
+    fail("PM attempt counts differ from sealed admission inventory");
+  const core = {
+    schema: PM_EXPLORATION_ADMISSION_BOUND_COHORT_SCHEMA,
+    cohortId: source.cohortId,
+    planDigest: pm.planDigest,
+    enrollmentDigest: joined.enrollmentDigest,
+    sealDigest: joined.sealDigest,
+    receiptReconciliationDigest: joined.reconciliationDigest,
+    attemptCohortDigest: pm.cohortDigest,
+    registeredSlotCount: pm.registeredSlotCount,
+    signedReceiptCount: joined.signedReceiptCount,
+    admittedMissingReceiptCount: joined.receiptUnavailableCount,
+    unadmittedSlotCount: joined.unadmittedSlotCount,
+    perArmDenominator: pm.perArmDenominator,
+    baseline: pm.baseline,
+    candidate: pm.candidate,
+    admissionAndAttemptBindingAuthenticated: true,
+    receiptSetCompletenessAuthenticated: false,
+    executionCoverageAuthenticated: false,
+    cohortCompletenessAuthenticated: false,
+    reportAuthenticated: false,
+    requiresIndependentPilotApproval: true,
+    qualifiesForPromotion: false,
+  };
+  return frozen({
+    ...core,
+    bindingDigest: hash(core, PM_EXPLORATION_ADMISSION_BOUND_COHORT_SCHEMA),
+  });
+}

package/src/lib/execution-location-failure-site.js

@@ -0,0 +1,63 @@
+// Diagnostic locations are public source labels, never target paths, stack
+// text or error messages. They do not grant authority or trigger a retry.
+const SOURCES = Object.freeze({
+  "commands/session-location.js": "session-location",
+  "harness/jsonl-session-store.js": "session-store",
+  "harness/session-index.js": "session-index",
+  "harness/transcript-integrity.js": "transcript-integrity",
+  "lib/secure-fs.js": "private-storage",
+  "lib/secure-file-identity.js": "file-identity",
+  "lib/session-anti-rollback-anchor.js": "session-anchor",
+  "lib/with-file-lock.js": "file-lock",
+  "lib/execution-location-local-supervisor.mjs": "local-supervisor",
+  "lib/execution-location-contract.js": "location-contract",
+});
+const LABELS = new Set(Object.values(SOURCES));
+const PREFIX = "CC_EXECUTION_LOCATION_FAILURE_SITE=";
+const MAX_DIAGNOSTIC_CHARS = 8192;
+
+// PowerShell diagnostics are deliberately bounded to fixed native operation
+// labels and HRESULTs; neither paths nor exception text cross the boundary.
+export function readExecutionLocationStorageFailure(stderr) {
+  const match = String(stderr || "")
+    .slice(0, MAX_DIAGNOSTIC_CHARS)
+    .match(
+      /\[windows-acl:(initialize|traversal|lookup|repair-lock|repair-inspect|repair-write|verify|timeout(?:-(?:startup|initialize|traversal|lookup|repair-lock|repair-inspect|repair-write|verify))?|spawn|output)(:0x[0-9a-f]{8})?\]/u,
+    );
+  return match ? `${match[1]}${match[2] || ""}` : null;
+}
+
+export function executionLocationFailureSite(error) {
+  const stack = String(error?.stack || "").slice(0, MAX_DIAGNOSTIC_CHARS);
+  for (const frame of stack.split(/\r?\n/u).slice(1)) {
+    if (!/^\s+at /u.test(frame)) continue;
+    const normalized = frame.replaceAll("\\", "/");
+    for (const [source, label] of Object.entries(SOURCES)) {
+      const suffix = `/packages/cli/src/${source}:`;
+      const index = normalized.lastIndexOf(suffix);
+      if (index < 0) continue;
+      const position = normalized.slice(index + suffix.length);
+      const line = position.match(/^([1-9][0-9]{0,5}):[0-9]+\)?$/u)?.[1];
+      if (line) return `${label}:${line}`;
+    }
+  }
+  return null;
+}
+
+export function formatExecutionLocationFailureSite(error) {
+  const site = executionLocationFailureSite(error);
+  return site === null ? "" : `${PREFIX}${site}\n`;
+}
+
+export function readExecutionLocationFailureSite(stderr) {
+  const text = String(stderr || "").slice(0, MAX_DIAGNOSTIC_CHARS);
+  for (const line of text.split(/\r?\n/u)) {
+    if (!line.startsWith(PREFIX)) continue;
+    const match = line
+      .slice(PREFIX.length)
+      .match(/^([a-z-]+):([1-9][0-9]{0,5})$/u);
+    if (match && LABELS.has(match[1])) return `${match[1]}:${match[2]}`;
+  }
+  // An uncaught supervisor exception already has a stack on stderr.
+  return executionLocationFailureSite({ stack: text });
+}