chainlesschain 0.166.90 → 0.166.92

package/src/data/changelog.json

@@ -1,16 +1,68 @@
 {
   "source": "CHANGELOG.md",
   "releases": [
+    {
+      "productVersion": null,
+      "cliVersion": "0.166.92",
+      "cliVersions": ["0.166.92"],
+      "date": null,
+      "title": "",
+      "sections": [
+        {
+          "heading": "Fixed - cc CLI 0.166.92: private storage and release regression repairs",
+          "body": "- Publish Session Core `0.3.17` and Context Memory Kernel `0.1.7` before CLI\n  `0.166.92`, with exact CLI dependency pins and public package readback.\n- Stage the actual Session Core package in isolated CLI and desktop fixtures;\n  missing private-storage code fails the fixture checks. Extract the complete\n  packed library when validating new transitive authorization dependencies.\n- Compare temporary fixture paths by their physical identity on Windows and\n  macOS while retaining production symlink and path-admission checks.\n- Preserve full 64-bit RRSI directory and marker identities on Windows so\n  distinct objects cannot collide after numeric rounding. Existing identity\n  mismatches still hold the store without rewriting authenticated records.\n- Create SQLite WAL/SHM files before applying final private-storage protection,\n  including owner-only Windows ACLs when goal schedulers reopen their stores.\n- Exclude validated browser digest metadata from Record & Replay content scans;\n  malformed metadata and sensitive values in user content still fail review.\n- Avoid repeating the same authenticated journal read for each signed sibling\n  in the cohort enrollment regression test; keep every admission assertion.\n- Stop canceled execution-location workflows from reporting missing producer\n  artifacts as a new aggregate failure; failed producers still fail the gate.\n- Await main-process logout in desktop tests and preserve the UI session until\n  revocation succeeds. Failed or unavailable revocation still rejects logout.\n- Require the parent to acknowledge RRSI process-test results before workers\n  disconnect, retaining both the competing-process assertions and exit checks.\n- Pair VS Code `0.37.137` and JetBrains `0.4.155` with CLI `0.166.92`. Disable\n  development plugin hot reload in the JetBrains test host so restart validation\n  retains both the packaged plugin and its UI driver.\n- Require the authorized CLI and downloadable OIDC-published child packages\n  before desktop and mobile builds; remove the product workflow's npm token\n  fallback so dependency failures cannot trigger a separate npm publication."
+        }
+      ]
+    },
+    {
+      "productVersion": null,
+      "cliVersion": "0.166.92",
+      "cliVersions": ["0.166.92"],
+      "date": null,
+      "title": "",
+      "sections": [
+        {
+          "heading": "Added - CLI 0.166.92: organization workflows and authenticated registry reads",
+          "body": "- Carry the committed organization project workbench into the desktop product\n  candidate, with project setup, saved proposals and governed task actions.\n  Session Core `0.3.17` includes the proposal store used by those host services.\n- Bind RRSI Registry read-only construction to authenticated backend evidence.\n  Read-only queries require that construction authority and retain checks for\n  replacement and mutation instead of creating a fresh writable registry."
+        }
+      ]
+    },
+    {
+      "productVersion": null,
+      "cliVersion": "0.166.92",
+      "cliVersions": ["0.166.92"],
+      "date": "2026-10-07",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Upgrade - CLI 0.166.92 and product v5.0.3.139 candidates (2026-10-07)",
+          "body": "- These versions are release candidates until the final versioned commit passes\n  its complete GitHub Actions gates and public release verification.\n- After CLI publication, run `npm install -g chainlesschain@0.166.92`, then\n  `chainlesschain --version`. `cc changelog` includes these bundled release notes.\n  Keep the existing configuration and data directories when replacing binaries.\n- Upgrade IDE plugins after the CLI: VS Code `0.37.137` and JetBrains `0.4.155`.\n  Restart the editor and verify its CLI path. If `cc` resolves to a C compiler,\n  configure the full path to the installed ChainlessChain executable.\n- The final product stage uses desktop `5.0.3-alpha.139`, Android\n  `5.0.3.139` / code `503139`, and iOS `5.0.3` / build `139`. Install the\n  matching platform artifact after the CLI and IDE release stages finish.\n- Back up existing application data before upgrading persistent stores. Close\n  desktop clients before copying SQLite stores, and retain their WAL/SHM files\n  when present so the backup includes committed data."
+        }
+      ]
+    },
+    {
+      "productVersion": null,
+      "cliVersion": "0.166.91",
+      "cliVersions": ["0.166.91"],
+      "date": null,
+      "title": "",
+      "sections": [
+        {
+          "heading": "Fixed - cc CLI 0.166.91: cross-platform release validation",
+          "body": "- Accept verified directory identities through the Windows Server 2025 native\n  file-information API, while retaining handle binding and reparse-point checks.\n- Preserve Windows native evaluator failure and cleanup evidence when the helper\n  cannot publish a settlement. Compare journal identities within their pathname\n  and descriptor domains on supported Node versions.\n- Keep literal audit search assertions independent of redacted operation text;\n  verify that unsafe legacy text remains omitted from query results.\n- Give the receipt signer deadline test enough admission time on hosted runners\n  and verify that the signer is actually invoked before its bounded timeout.\n- Regenerate the bundled CLI changelog from its canonical source.\n- Capture JetBrains transcript snapshots on the event dispatch thread during\n  cross-platform host validation, retaining the full transcript assertions.\n- Preserve equivalent protected Windows evaluator ACLs across .NET Framework\n  and PowerShell's .NET runtime through the native security API.\n- Retry cooperative lock release during nested safe owner reads without treating\n  it as corruption; losing a held lock still fails closed.\n- Pin the patched `shell-quote` dependency in both workspace and standalone\n  desktop installs to reject command injection after shell comment tokens.\n- Publish Session Core `0.3.16` and Personal Data Hub `0.4.64` before CLI\n  `0.166.91`, with exact dependency pins and public package verification.\n- Pair VS Code `0.37.136` and JetBrains `0.4.154` with CLI `0.166.91` after\n  the full exact-commit CLI and IDE validation workflows pass."
+        }
+      ]
+    },
     {
       "productVersion": null,
       "cliVersion": "0.166.90",
       "cliVersions": ["0.166.90"],
-      "date": null,
+      "date": "2026-10-06",
       "title": "",
       "sections": [
         {
           "heading": "Added - cc CLI 0.166.90: recoverable projections and project risk evidence",
-          "body": "- Publish Personal Data Hub `0.4.63` and Session Core `0.3.15` before the CLI,\n  with exact dependency pins and public tarball verification. Require the full\n  PDH suite with its declared native SQLCipher driver on Linux, Windows and macOS.\n- Publish Agent SDK `0.2.13` with Vitest `4.1.11` test tooling to remove the\n  vulnerable Tinypool dependency, and upgrade the workspace proxy-addr to\n  `2.0.8`. Require SDK build and tests on the exact Linux, Windows and macOS\n  release commit before OIDC publication.\n- Persist PDH projection receipts, recover incomplete derivations and support\n  bounded receipt retention. Harden RAG updates, audit redaction and capability\n  reporting so unavailable sources do not appear as successful live collection.\n- Add offline project risk evaluation and version-bound task description\n  previews. Session Core also supplies native SQLite action/read services and\n  saved rule/source reviews for the desktop project workbench; CLI previews\n  carry unverified snapshot authority and do not execute those desktop actions.\n- Pair VS Code `0.37.135` and JetBrains `0.4.153` with CLI `0.166.90` after\n  exact-commit release checks and public npm readback."
+          "body": "- Verified on 2026-10-06: exact release commit `28cff6adc8` passed complete\n  CLI CI, Strict Sandbox, IDE host and security gates. Session Core `0.3.15`,\n  Agent SDK `0.2.13`, PDH `0.4.63` and CLI `0.166.90` were published through\n  GitHub Actions OIDC with independent public archive verification. Open VSX\n  `0.37.135` and JetBrains `0.4.153` are public; both publication workflows\n  succeeded, and JetBrains approval/listing was independently read back.\n  Desktop workbench changes are outside the separate v5.0.3.138 installer.\n- Publish Personal Data Hub `0.4.63` and Session Core `0.3.15` before the CLI,\n  with exact dependency pins and public tarball verification. Require the full\n  PDH suite with its declared native SQLCipher driver on Linux, Windows and macOS.\n- Publish Agent SDK `0.2.13` with Vitest `4.1.11` test tooling to remove the\n  vulnerable Tinypool dependency, and upgrade the workspace proxy-addr to\n  `2.0.8`. Require SDK build and tests on the exact Linux, Windows and macOS\n  release commit before OIDC publication.\n- Persist PDH projection receipts, recover incomplete derivations and support\n  bounded receipt retention. Harden RAG updates, audit redaction and capability\n  reporting so unavailable sources do not appear as successful live collection.\n- Add offline project risk evaluation and version-bound task description\n  previews. Session Core also supplies native SQLite action/read services and\n  saved rule/source reviews for the desktop project workbench; CLI previews\n  carry unverified snapshot authority and do not execute those desktop actions.\n- Pair VS Code `0.37.135` and JetBrains `0.4.153` with CLI `0.166.90` after\n  exact-commit release checks and public npm readback."
         }
       ]
     },

package/src/lib/audit-logger.js

@@ -7,6 +7,17 @@ import crypto from "crypto";
 import { safeJsonParse } from "./safe-json.js";
 import { escapeLike } from "./sql-like.js";
 import { sanitizeAuditDetails } from "./audit-sanitizer.js";
+import auditDataPolicy from "@chainlesschain/session-core/audit-data-policy";
+import restrictedAudit from "@chainlesschain/session-core/restricted-audit-store";
+
+const { projectAuditMetadata, projectAuditField, validateRetentionDays } =
+  auditDataPolicy;
+
+// Host API: authorization must come from the invoking host, never event details.
+// No general audit query/export includes this separate store.
+export function createAuditDiagnostics(db, options) {
+  return new restrictedAudit.RestrictedAuditStore(db, options);
+}
 
 /**
  * Event types for audit logging.
@@ -117,7 +128,7 @@ export function sanitizeDetails(details) {
 }
 
 function sanitizeErrorMessage(value) {
-  const sanitized = sanitizeDetails(value);
+  const sanitized = projectAuditMetadata(value);
   if (sanitized == null) return null;
   return typeof sanitized === "object"
     ? JSON.stringify(sanitized)
@@ -131,23 +142,24 @@ export function logEvent(db, event) {
   ensureAuditTables(db);
 
   const id = crypto.randomUUID();
-  const sanitized = sanitizeDetails(event.details);
-  const risk =
-    event.riskLevel || assessRisk(event.eventType, event.operation, sanitized);
+  const sanitized = projectAuditMetadata(event.details);
+  const risk = Object.values(RISK_LEVELS).includes(event.riskLevel)
+    ? event.riskLevel
+    : assessRisk(event.eventType, event.operation || "unknown", sanitized);
 
   db.prepare(
     `INSERT INTO audit_log (id, event_type, operation, actor, target, details, risk_level, ip_address, user_agent, success, error_message)
      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
   ).run(
     id,
-    event.eventType || EVENT_TYPES.SYSTEM,
-    event.operation || "unknown",
-    event.actor || null,
-    event.target || null,
+    projectAuditField("eventType", event.eventType || EVENT_TYPES.SYSTEM),
+    projectAuditField("operation", event.operation || "unknown"),
+    projectAuditField("actor", event.actor || null),
+    projectAuditField("target", event.target || null),
     sanitized == null ? null : JSON.stringify(sanitized),
     risk,
-    event.ipAddress || null,
-    event.userAgent || null,
+    event.ipAddress ? projectAuditField("ipAddress", event.ipAddress) : null,
+    event.userAgent ? projectAuditField("userAgent", event.userAgent) : null,
     event.success !== false ? 1 : 0,
     sanitizeErrorMessage(event.errorMessage),
   );
@@ -220,8 +232,21 @@ export function queryLogs(db, filters = {}) {
   const rows = db.prepare(sql).all(...params);
   return rows.map((r) => ({
     ...r,
+    event_type: projectAuditField("eventType", r.event_type),
+    operation: projectAuditField("operation", r.operation),
     // One corrupt details cell must not throw out of the whole query.
-    details: safeJsonParse(r.details, null),
+    details: projectAuditMetadata(safeJsonParse(r.details, null)),
+    error_message: sanitizeErrorMessage(
+      safeJsonParse(r.error_message, r.error_message),
+    ),
+    actor: projectAuditField("actor", r.actor),
+    target: projectAuditField("target", r.target),
+    ip_address: r.ip_address
+      ? projectAuditField("ipAddress", r.ip_address)
+      : null,
+    user_agent: r.user_agent
+      ? projectAuditField("userAgent", r.user_agent)
+      : null,
     success: r.success === 1,
   }));
 }
@@ -333,6 +358,7 @@ export function exportLogs(db, format = "json", filters = {}) {
  * Delete old audit logs.
  */
 export function purgeLogs(db, daysToKeep = 90) {
+  validateRetentionDays(daysToKeep);
   ensureAuditTables(db);
 
   const cutoff = new Date();
@@ -502,7 +528,7 @@ export function logEventV2(
   if (_logStatesV2.has(logId)) {
     throw new Error(`Log already registered: ${logId}`);
   }
-  const sanitized = sanitizeDetails(details);
+  const sanitized = projectAuditMetadata(details);
   const risk = riskLevel || assessRisk(eventType, operation, sanitized);
   if (!RISK_LEVELS_V2.includes(risk)) {
     throw new Error(`Invalid riskLevel: ${risk}`);
@@ -510,14 +536,14 @@ export function logEventV2(
   const now = Date.now();
   const entry = {
     logId,
-    eventType,
-    operation,
-    actor: actor || null,
-    target: target || null,
+    eventType: projectAuditField("eventType", eventType),
+    operation: projectAuditField("operation", operation),
+    actor: projectAuditField("actor", actor || null),
+    target: projectAuditField("target", target || null),
     details: sanitized ?? null,
     riskLevel: risk,
-    ipAddress: ipAddress || null,
-    userAgent: userAgent || null,
+    ipAddress: ipAddress ? projectAuditField("ipAddress", ipAddress) : null,
+    userAgent: userAgent ? projectAuditField("userAgent", userAgent) : null,
     success: success !== false,
     errorMessage: sanitizeErrorMessage(errorMessage),
     status: LOG_STATUS_V2.ACTIVE,
@@ -539,8 +565,8 @@ export function logEventV2(
       _alertStatesV2.set(alertId, {
         alertId,
         logId,
-        actor,
-        operation,
+        actor: entry.actor,
+        operation: entry.operation,
         riskLevel: risk,
         status: ALERT_STATUS_V2.OPEN,
         reason: null,

package/src/lib/checkpoint-restore-saga.js

@@ -464,6 +464,16 @@ function isMissingPathError(error) {
   return error?.code === "ENOENT" || error?.cause?.code === "ENOENT";
 }
 
+function hasMissingLockPathCause(error) {
+  // A bounded owner read wraps secure-parent errors, which themselves wrap
+  // ENOENT when a cooperating process detaches its released lock directory.
+  // Only unlocked lock inspection uses this; losing our held owner still fails.
+  for (let depth = 0; error && depth < 8; depth++, error = error.cause) {
+    if (error.code === "ENOENT") return true;
+  }
+  return false;
+}
+
 function attachCommitState(error, details) {
   if (!error || typeof error !== "object") return error;
   for (const [key, value] of Object.entries(details)) {
@@ -1887,7 +1897,7 @@ export class CheckpointRestoreSagaStore {
       // The same valid release can happen after readdir observed owner.json
       // but before its lstat/read. Only tolerate absence during the unlocked
       // pre/postflight inspection; losing our own owner still fails closed.
-      if (isMissingPathError(cause) && !requireOwner) return null;
+      if (hasMissingLockPathCause(cause) && !requireOwner) return null;
       throw sagaError(
         CHECKPOINT_RESTORE_SAGA_ERROR_CODES.LOCK_FAILED,
         "Saga state lock owner is corrupt or unbounded",

package/src/lib/eval/verify01-host-evidence.js

@@ -149,13 +149,46 @@ export function inspectIdeProtocol(records, { prompt, comparison } = {}) {
       resultRecords[0].event.session_id === sessionId,
     "IDE terminal is missing or ambiguous",
   );
+  const terminal = resultRecords[0].event;
+  // Persistent headless streams emit one lifecycle end after stdin closes.
+  // Accept only that exact, same-session one-turn trailer; task output after
+  // the result stays ambiguous. Keep the complete capture intact.
+  const trailing = outputs.slice(outputs.indexOf(resultRecords[0]) + 1);
+  const end = trailing[0]?.event;
+  const lifecycleFrames = outputs.filter(
+    (record) =>
+      record.event.type === "system" && record.event.subtype === "end",
+  );
+  const lifecycleEnded =
+    trailing.length === 1 &&
+    lifecycleFrames.length === 1 &&
+    end.type === "system" &&
+    end.subtype === "end" &&
+    end.session_id === sessionId &&
+    end.turns === 1 &&
+    terminal.turn === 1 &&
+    Object.keys(end).every((key) =>
+      ["type", "subtype", "session_id", "turns", "trace_id", "seq"].includes(
+        key,
+      ),
+    ) &&
+    (end.trace_id === undefined ||
+      (typeof end.trace_id === "string" &&
+        end.trace_id === terminal.trace_id)) &&
+    (end.seq === undefined ||
+      (Number.isSafeInteger(end.seq) &&
+        Number.isSafeInteger(terminal.seq) &&
+        end.seq === terminal.seq + 1));
+  const taskOutputs = lifecycleEnded ? outputs.slice(0, -1) : outputs;
   const parsed = verifyAgentTerminal(
-    outputs.map((record) => JSON.stringify(record.event)).join("\n"),
+    taskOutputs.map((record) => JSON.stringify(record.event)).join("\n"),
   );
-  const terminal = resultRecords[0].event;
+  if (lifecycleFrames.length > 0 && !lifecycleEnded)
+    parsed.terminalVerified = false;
   // A complete explicit failure is an observation. It never becomes success.
   const knownFailure =
-    outputs.at(-1) === resultRecords[0] &&
+    taskOutputs.at(-1) === resultRecords[0] &&
+    (lifecycleFrames.length === 0 || lifecycleEnded) &&
     terminal.is_error === true &&
     typeof terminal.subtype === "string" &&
     terminal.subtype.length > 0 &&

package/src/lib/evolution/evolution-artifact-ports.js

@@ -82,6 +82,8 @@ export const EVOLUTION_ARTIFACT_LEDGER_RETENTION_TYPES = Object.freeze([
   "skill-runtime-revalidation-state",
   "evolution-ledger-v2-journal",
   "evolution-run-event",
+  "rrsi-history-event",
+  "skill-registry-store-policy",
   "pm-exploration-recovery-snapshot",
   "pm-exploration-provider-settlement",
   "evolution-eval-child-evidence",
@@ -140,6 +142,8 @@ export const EVOLUTION_ARTIFACT_TYPES = Object.freeze([
   "evaluation",
   "evaluation-result",
   "evolution-run-event",
+  "rrsi-history-event",
+  "skill-registry-store-policy",
   "pm-exploration-recovery-snapshot",
   "pm-exploration-provider-settlement",
   "evolution-eval-child-evidence",
@@ -357,6 +361,7 @@ const CONSTRUCTOR_REQUIRED_KEYS = new Set([
 const LEDGER_RESOLVER_OPTION_KEYS = new Set(["purpose"]);
 const EVOLUTION_LEDGER_ARTIFACT_RESOLVERS = new WeakSet();
 const EVOLUTION_LEDGER_BATCH_RESOLVERS = new WeakMap();
+const EVOLUTION_LEDGER_RESOLVER_BINDINGS = new WeakMap();
 const isProxy = Object.freeze(utilTypes.isProxy.bind(utilTypes));
 const isDate = Object.freeze(utilTypes.isDate.bind(utilTypes));
 const dateGetTime = Object.freeze(
@@ -395,6 +400,8 @@ const LEDGER_RETENTION_PURPOSES_BY_TYPE = new Map([
   ["wiki-pruning-journal", new Set(["evolution-ledger"])],
   ["wiki-pruning-retrieval-projection", new Set(["evolution-ledger"])],
   ["evolution-run-event", new Set(["evolution-ledger"])],
+  ["rrsi-history-event", new Set(["evolution-ledger"])],
+  ["skill-registry-store-policy", new Set(["evolution-ledger"])],
   ["pm-exploration-recovery-snapshot", new Set(["evolution-ledger"])],
   ["pm-exploration-provider-settlement", new Set(["evolution-ledger"])],
   ["evolution-eval-child-evidence", new Set(["evolution-ledger"])],
@@ -3557,6 +3564,15 @@ export class EvolutionArtifactPorts {
     EVOLUTION_LEDGER_BATCH_RESOLVERS.set(resolveReadOnly, (requests) =>
       this.#resolveLedgerBatch(requests, normalizedPurpose),
     );
+    EVOLUTION_LEDGER_RESOLVER_BINDINGS.set(
+      resolveReadOnly,
+      Object.freeze({
+        purpose: normalizedPurpose,
+        tenantId: this.#tenantId,
+        audience: this.#audience,
+        matchesArtifactPorts: Object.freeze((value) => value === this),
+      }),
+    );
     return Object.freeze(resolveReadOnly);
   }
 }
@@ -3591,4 +3607,14 @@ export function captureEvolutionLedgerBatchResolver(value) {
   return resolve;
 }
 
+/** Private construction identity, independent of matching resolver descriptors. */
+export function captureEvolutionLedgerArtifactResolverBinding(value) {
+  const binding = EVOLUTION_LEDGER_RESOLVER_BINDINGS.get(value);
+  if (!binding)
+    throw new TypeError(
+      "a branded ledger artifact resolver binding is required",
+    );
+  return binding;
+}
+
 Object.freeze(EvolutionArtifactPorts.prototype);