chati-dev 4.5.16 → 4.5.28

package/node_modules/@chati/review-council/src/index.js

@@ -79,6 +79,9 @@ export function validateReviewRecord(review) {
   if (review.findings.some((finding) => finding.disposition === 'accepted') && review.verdict !== 'rework') {
     fail('ACCEPTED_FINDINGS_REQUIRE_REWORK', 'any accepted finding requires verdict rework');
   }
+  if (review.verdict === 'rework' && !review.findings.some((finding) => finding.disposition === 'accepted')) {
+    fail('REWORK_REQUIRES_ACCEPTED_FINDING', 'verdict rework requires at least one accepted finding');
+  }
   assertObject(review.impasse, 'INVALID_REVIEW_IMPASSE', 'impasse');
   if (!IMPASSE_KINDS.has(review.impasse.kind)) fail('INVALID_REVIEW_IMPASSE', 'impasse.kind is invalid');
   if (review.impasse.kind === 'technical') assertRef(review.impasse.evidence_ref, 'INVALID_REVIEW_IMPASSE', 'impasse.evidence_ref');
@@ -103,6 +106,66 @@ export function computeIndependenceLevel({ builder_identity, reviewer_identity }
   return 'C';
 }
 
+const REVIEW_REASONING = Object.freeze(['low', 'medium', 'high', 'xhigh', 'max']);
+
+function nearestReviewReasoning(binding, model) {
+  const preferred = model.tier === 'worker' ? 'low' : 'high';
+  const maximumRank = REVIEW_REASONING.indexOf(model.highest_reasoning_configuration || 'xhigh');
+  const preferredRank = REVIEW_REASONING.indexOf(preferred);
+  if (maximumRank < 0) return null;
+  return (binding.allowed_reasoning_configurations || [])
+    .filter((candidate) => {
+      const rank = REVIEW_REASONING.indexOf(candidate);
+      return rank >= 0 && rank <= maximumRank;
+    })
+    .sort((left, right) => {
+      const leftRank = REVIEW_REASONING.indexOf(left);
+      const rightRank = REVIEW_REASONING.indexOf(right);
+      return Math.abs(leftRank - preferredRank) - Math.abs(rightRank - preferredRank)
+        || leftRank - rightRank;
+    })[0] || null;
+}
+
+/** Selects the one canonical reviewer from the signed selected-only capability projection. */
+export function selectCanonicalReviewer({ installation, snapshot, builder_identity, clock = () => new Date() } = {}) {
+  assertObject(installation, 'INVALID_REVIEW_SELECTION', 'installation');
+  assertObject(snapshot, 'INVALID_REVIEW_SELECTION', 'snapshot');
+  const candidates = (installation.enabled_providers || []).flatMap((binding) =>
+    (binding.allowed_models || []).flatMap((modelId) => {
+      const model = snapshot.models?.find((candidate) =>
+        candidate.provider_id === binding.provider_id && candidate.model_id === modelId);
+      if (!model?.actions?.includes('review')) return [];
+      const reasoning = nearestReviewReasoning(binding, model);
+      if (!reasoning) return [];
+      const reviewer_identity = { provider_id: binding.provider_id, model_id: model.model_id };
+      return [{
+        binding, model, reasoning, reviewer_identity,
+        independence_level: computeIndependenceLevel({ builder_identity, reviewer_identity }),
+      }];
+    })
+  ).sort((left, right) =>
+    ({ A: 3, B: 2, C: 1 })[right.independence_level] - ({ A: 3, B: 2, C: 1 })[left.independence_level]
+    || (right.model.routing_priority?.['rail:review'] ?? right.model.routing_priority?.review ?? 0)
+      - (left.model.routing_priority?.['rail:review'] ?? left.model.routing_priority?.review ?? 0)
+    || (right.model.adjudication_priority ?? 0) - (left.model.adjudication_priority ?? 0)
+    || `${left.binding.harness_id}:${left.model.model_id}`.localeCompare(`${right.binding.harness_id}:${right.model.model_id}`)
+  );
+  const selected = candidates[0];
+  if (!selected) fail('NO_ELIGIBLE_REVIEWER', 'no eligible installed model exists for independent review');
+  const invocation = {
+    provider_id: selected.binding.provider_id,
+    harness_id: selected.binding.harness_id,
+    action: 'review',
+    model_pin: {
+      model_id: selected.model.model_id,
+      catalog_snapshot_ref: snapshot.snapshot_id,
+      reasoning_configuration: selected.reasoning,
+    },
+  };
+  assertEligibleInvocation({ installation, snapshot, invocation, clock });
+  return freeze({ ...invocation, independence_level: selected.independence_level });
+}
+
 /** C-05: A/B may never silently degrade to C. */
 export function assertReviewIndependence(review) {
   const validated = validateReviewRecord(review);

package/node_modules/@chati/tracking-clickup/README.md

@@ -7,6 +7,19 @@ snapshots. Delivery and reconciliation are distinct state dimensions. A caller
 may inject a fake transport in tests or an independently authorized ClickUp
 adapter at an outer boundary.
 
+The installed `@chati/dev` router accepts remote acknowledgements and lookups
+only after `.chati/v2/tracking/clickup-mcp-authority.json` contains a
+project-bound authority certificate signed by the embedded CHATI Ed25519 root.
+The certified MCP boundary then signs each result over the projection id,
+ClickUp ref, idempotency key, operation, exact durable delivery attempt,
+attempt timestamp and response digest. A receipt from an older send cannot
+reconcile or reopen a newer uncertain attempt. Missing, expired,
+foreign-project or self-signed certificates fail closed before reconciliation.
+Only the certified factory can mint the verifier, and certificate validity is
+rechecked for every receipt instead of only once at construction.
+Public acknowledgement and lookup APIs load that project authority internally;
+they expose no verifier parameter that caller code can replace.
+
 ## Guarantees
 
 - A projection is persisted before `transport.send()` can run.