codex-orchestrator 2.0.19 → 2.0.21

package/dist/src/v2/run-issue.js

@@ -5,6 +5,7 @@ import { canonicalJson, containsCredentialEvidence, containsHostIdentityEvidence
 import { findDeniedPathMatch } from './adapters/path-policy.js';
 import { adoptActiveAttempt, confirmActiveAttemptCleanup, createActiveAttempt, launchActiveAttempt, observeActiveAttempt, } from './active-attempt.js';
 import { validateImplementationReport } from './implementation-report.js';
+import { COMPLETE_REVIEW_COVERAGE, validateReviewContext } from './code-review-report.js';
 import { validateCompletedReport } from './contained-report-operation.js';
 import { directReviewCandidateTargetFingerprint, projectTerminalDirectReview, } from './direct-delivery.js';
 import { MAX_REVIEW_PATCH_BYTES } from './implementation-reviewer.js';
@@ -17,6 +18,11 @@ import { createIssueDeliveryAuthority } from './delivery-authority.js';
 import { claimComment, claimRunId, freezeCriteria, historicalClaimCounts, isClaimMarkerComment, isExactClaimMarkerLine, isAdoptableAttempt, observedHistoricalClaimKeys, outcomeEvidenceBytes, publicOutcome, publicIssueSnapshot, refreshClaimedIssueSnapshot, snapshotIssue, sameInspectionIdentity, sameStrings, semanticChangesMatch, } from './run-state-projections.js';
 import { applyValidationTransition, nextValidationTransition, projectValidationFeedbackActivation, projectValidationProofPassed, projectValidationProofStart, projectValidationRepair, projectValidationReviewApproved, projectValidationReviewNeedsWork, projectValidationReviewReportRepair, projectValidationReviewTransportRetry, } from './validation-progression.js';
 import { settleCommentEffect, settleCommitEffect, settleCleanupEffect, settleDraftPullRequestEffect, settleLabelsEffect, settlePushEffect, } from './pending-effect-settlement.js';
+class ReviewTargetCredentialError extends Error {
+    constructor() {
+        super('Review target contains potential credential material; remove real credentials or use explicit dummy session tokens.');
+    }
+}
 export class OwnerLockSafetyError extends Error {
 }
 export class OwnerLockContentionError extends Error {
@@ -925,12 +931,14 @@ export class RunIssue {
         let active;
         try {
             assertPositiveInteger(input.issueNumber, 'issueNumber');
+            if (input.retryProofRunId !== undefined)
+                assertUuid(input.retryProofRunId);
             const targetRoot = resolve(input.targetRoot);
             const initialConfig = await this.readStrictConfig(targetRoot);
             const canonicalRepository = `${initialConfig.config.github.owner.toLowerCase()}/${initialConfig.config.github.repo.toLowerCase()}`;
             const preflightState = await this.dependencies.runRecords.inspect();
             if (preflightState.status === 'unsupported')
-                return { status: 'state-schema-unsupported' };
+                return { status: 'state-schema-unsupported', ...(preflightState.reason ? { reason: preflightState.reason } : {}) };
             try {
                 owner = await this.dependencies.ownerLock.acquire({ canonicalRepository, targetRoot });
             }
@@ -961,11 +969,11 @@ export class RunIssue {
                 return await this.preClaimCancelled(input.issueNumber);
             let authoritativeState = await this.dependencies.runRecords.inspect();
             if (authoritativeState.status === 'unsupported')
-                return { status: 'state-schema-unsupported' };
+                return { status: 'state-schema-unsupported', ...(authoritativeState.reason ? { reason: authoritativeState.reason } : {}) };
             if (!sameInspectionIdentity(preflightState, authoritativeState)) {
                 const stableState = await this.dependencies.runRecords.inspect();
                 if (stableState.status === 'unsupported')
-                    return { status: 'state-schema-unsupported' };
+                    return { status: 'state-schema-unsupported', ...(stableState.reason ? { reason: stableState.reason } : {}) };
                 if (!sameInspectionIdentity(authoritativeState, stableState)) {
                     return { status: 'requeued', reason: 'state-changed' };
                 }
@@ -1003,6 +1011,13 @@ export class RunIssue {
             if (matchingRuns.length > 1)
                 return await this.preClaimInternal('ambiguous-run-state', input.issueNumber);
             const existing = matchingRuns[0];
+            if (input.retryProofRunId !== undefined && (existing?.runId !== input.retryProofRunId
+                || existing.terminalOutcome?.status !== 'internal-error'
+                || existing.terminalOutcome.code !== 'acceptance-proof-internal-failure')) {
+                const reason = 'Proof retry requires the exact run with a terminal Acceptance Proof internal failure.';
+                const evidence = await this.dependencies.writeEvidence({ runId: `issue-${input.issueNumber}`, code: 'proof-retry-not-eligible', summary: reason });
+                return { status: 'not-eligible', reason, evidencePath: evidence.path };
+            }
             let issueSnapshot;
             let frozenCriteria;
             let runId;
@@ -1065,6 +1080,23 @@ export class RunIssue {
                         return reconciled;
                     active = reconciled.active;
                 }
+                if (input.retryProofRunId !== undefined) {
+                    try {
+                        const recovered = await this.retryTerminalProof(active, config);
+                        if ('status' in recovered)
+                            return recovered;
+                        active = recovered.active;
+                    }
+                    catch {
+                        // Recovery uncertainty must not replace the terminal outcome that authorizes this retry.
+                        try {
+                            return await this.invokedFailure(active, 'acceptance-proof-retry-validation-retryable', 'Proof retry validation or its state transition could not be confirmed; inspect durable state before retrying.');
+                        }
+                        catch {
+                            return publicOutcome(active.record.terminalOutcome);
+                        }
+                    }
+                }
                 if (active.record.terminalOutcome) {
                     if (active.record.terminalOutcome.status !== 'review-ready') {
                         return publicOutcome(active.record.terminalOutcome);
@@ -1413,6 +1445,11 @@ export class RunIssue {
                     reviewScope = await this.reviewValidationScope(active, frozenCriteria, checkPolicy.checks, config.deny.readPaths);
                 }
                 catch (error) {
+                    if (error instanceof ReviewTargetCredentialError) {
+                        return this.terminal(active, { status: 'blocked', kind: 'safety', resumable: false, blocker: {
+                                kind: 'safety', summary: error.message, attempted: ['Inspect exact candidate diff for credential material.'], resumable: false,
+                            } }, 'review-target-credential-evidence');
+                    }
                     return this.invokedFailure(active, 'review-target-unavailable', error instanceof Error ? error.message : undefined);
                 }
                 const configuredChecks = Object.entries(reviewScope.checks);
@@ -1731,6 +1768,57 @@ export class RunIssue {
             }
         }
     }
+    async retryTerminalProof(active, config) {
+        const reject = async (reason) => {
+            const evidence = await this.dependencies.writeEvidence({ runId: active.record.runId, code: 'proof-retry-not-eligible', summary: reason });
+            return { status: 'not-eligible', reason, evidencePath: evidence.path };
+        };
+        const record = active.record;
+        const candidate = this.dependencies.git.candidateV2;
+        if (record.lifecycle !== 'internal-error' || record.terminalOutcome?.status !== 'internal-error'
+            || record.terminalOutcome.code !== 'acceptance-proof-internal-failure'
+            || !record.deliveryAuthority || !record.candidateBinding || !record.implementationResult || !candidate
+            || record.pendingEffect || record.activeAttempt || record.candidateMaterialization || record.proofReceipt
+            || record.reviewFeedback?.activeBatch) {
+            return reject('Proof retry requires a quiescent, unpublished candidate without passed proof or pending effects.');
+        }
+        if (!await this.authorized(active, config))
+            return reject('The existing trusted issue claim must still authorize execution.');
+        if (await this.dependencies.pullRequests.findOpen({ headBranch: record.branchName, baseBranch: config.github.baseBranch })) {
+            return reject('Proof retry cannot reopen a run with an open pull request.');
+        }
+        await this.dependencies.verifyWorkflowGeneration(record.workflowGeneration);
+        const worktree = await this.dependencies.git.inspectWorktree({
+            worktreePath: record.worktreePath, branchName: record.branchName, baseSha: expectedImplementationHead(record),
+        });
+        if (worktree !== 'matching')
+            return reject('The existing issue worktree identity or HEAD has changed.');
+        const pin = await candidate.inspectPin(record.candidateBinding);
+        if (pin.kind === 'failed')
+            return this.mapCandidateFailure(active, pin.code);
+        if (pin.value !== 'matching')
+            return reject('The immutable candidate pin is missing or diverged.');
+        let directReview = record.directReview;
+        if (directReview) {
+            if (directReview.status !== 'terminal' || directReview.review.disposition !== 'active') {
+                return reject('The retained Review cannot resume validation of this candidate.');
+            }
+            const { terminalCode: _code, terminalOutcome: _outcome, ...retained } = structuredClone(directReview);
+            directReview = { ...retained, status: 'active' };
+        }
+        if (!await this.authorized(active, config))
+            return reject('Issue execution authority changed during proof retry validation.');
+        await this.dependencies.writeEvidence({
+            runId: record.runId, code: 'acceptance-proof-retry-authorized',
+            summary: canonicalJson({ previousOutcome: record.terminalOutcome, previousProofId: record.proofId ?? null,
+                candidateBindingId: record.candidateBinding.bindingId, cycle: record.cycle }),
+        });
+        return { active: await this.persist(active, {
+                lifecycle: 'checking', terminalOutcome: undefined, outcomeEvidenceId: undefined,
+                checks: [], checkedChangeSha256: undefined, proofId: undefined, proofExecution: undefined, proofReceipt: undefined,
+                ...(directReview ? { directReview } : {}),
+            }) };
+    }
     async initializeClaimedRun(active, issue) {
         if (active.record.lifecycle !== 'claimed'
             || active.record.activeAttempt
@@ -2514,9 +2602,10 @@ export class RunIssue {
         if (!binding)
             throw new Error('review scope requires candidate identity');
         const completeDiff = await this.dependencies.git.diffTrees(active.record.worktreePath, active.record.baseSha, binding.candidateTreeSha);
+        if (containsCredentialEvidence(completeDiff.patch))
+            throw new ReviewTargetCredentialError();
         if (completeDiff.changedFiles.length === 0 || completeDiff.patch.trim().length === 0
             || Buffer.byteLength(completeDiff.patch, 'utf8') > MAX_REVIEW_PATCH_BYTES
-            || containsCredentialEvidence(completeDiff.patch)
             || completeDiff.changedFiles.some((path) => findDeniedPathMatch(path, deniedPaths))) {
             throw new Error('exact complete Review target is unavailable');
         }
@@ -2597,32 +2686,42 @@ export class RunIssue {
             reviewScope = suppliedScope ?? await this.reviewValidationScope(active, frozenCriteria, resolveIssueCheckPolicy(active.record.issueSnapshot.body, config.checks).checks, config.deny.readPaths);
         }
         catch (error) {
+            if (error instanceof ReviewTargetCredentialError) {
+                return this.terminal(active, { status: 'blocked', kind: 'safety', resumable: false, blocker: {
+                        kind: 'safety', summary: error.message, attempted: ['Inspect exact candidate diff for credential material.'], resumable: false,
+                    } }, 'review-target-credential-evidence');
+            }
             return this.invokedFailure(active, 'review-scope-unavailable', error instanceof Error ? error.message : undefined);
         }
         let reportRepair;
         const retainedAttempt = active.record.activeAttempt;
         const retainedReview = active.record.directReview;
-        if (retainedReview?.review.reportRepairs && retainedAttempt?.stage === 'adopted' && retainedAttempt.result) {
-            const stored = await this.dependencies.inspectAttemptResult(retainedAttempt.resultPath);
-            if (!stored || stored.sha256 !== retainedAttempt.result.sha256) {
+        if (retainedReview?.review.reportRepairs) {
+            const original = retainedReview.review.reportCorrection
+                ?? (retainedAttempt?.stage === 'adopted' ? retainedAttempt.result : undefined);
+            if (!original)
+                return this.terminal(active, { status: 'internal-error', code: 'review-report-correction-result-missing' });
+            const stored = await this.dependencies.inspectAttemptResult(original.path);
+            if (!stored || stored.sha256 !== original.sha256) {
                 return this.invokedFailure(active, 'direct-review-report-result-unavailable', 'The exact malformed Review result is not currently observable; report-only recovery remains fenced.');
             }
-            const validation = validateCompletedReport('code-review', retainedAttempt.attemptId, stored.bytes, {
-                operation: 'code-review',
-                targetRevision: retainedReview.targetRevision,
-                targetFingerprint: retainedReview.targetFingerprint,
-                reviewerSessionId: retainedReview.review.reviewerSessionId,
-                previousFindingIds: [
-                    ...retainedReview.review.defects.filter((defect) => defect.status === 'fixed').map((defect) => defect.id),
-                    ...retainedReview.repairFindings.filter((finding) => finding.status === 'fixed').map((finding) => finding.id),
-                ].sort(),
-                requiredCoverage: reviewScope.mode === 'complete' ? [
-                    'candidate-proof-binding', 'correctness', 'duplicate-ownership', 'maintainability',
-                    'repository-standards', 'requirements', 'tests', 'zero-legacy',
-                ] : [],
-                requireAllReviewers: reviewScope.mode === 'complete',
-                requireReviewerEvidence: true,
-            });
+            if (retainedReview.review.reportRepairs >= 2) {
+                return this.terminal(active, { status: 'blocked', kind: 'external', resumable: false, blocker: {
+                        kind: 'external', resumable: false, summary: 'Review report correction limit reached; retained candidate and report require operator recovery.',
+                        attempted: ['Preserved the candidate, checks, proof and retained report without launching another reviewer.'],
+                    } });
+            }
+            let context;
+            try {
+                context = validateReviewContext(retainedReview.review.validationContext);
+                if (context.targetRevision !== retainedReview.targetRevision || context.targetFingerprint !== retainedReview.targetFingerprint
+                    || context.reviewerSessionId !== retainedReview.review.reviewerSessionId)
+                    throw new Error('review context drift');
+            }
+            catch {
+                return this.terminal(active, { status: 'internal-error', code: 'review-validation-context-missing' });
+            }
+            const validation = validateCompletedReport('code-review', retainedAttempt?.attemptId ?? active.record.runId, stored.bytes, context);
             if (validation.status !== 'invalid' || !validation.repairInput) {
                 return this.terminal(active, { status: 'blocked', kind: 'safety', resumable: false }, 'direct-review-retained-result-diverged');
             }
@@ -2631,7 +2730,12 @@ export class RunIssue {
                 originalReportBytes: Buffer.from(validation.repairInput.originalReportBytes),
                 diagnostic: validation.findings[0] ?? 'review report is invalid',
             };
-            active = await this.clearAttempt(active);
+            if (!retainedReview.review.reportCorrection) {
+                active = await this.persist(active, { directReview: { ...retainedReview,
+                        review: { ...retainedReview.review, reportCorrection: original } } });
+            }
+            if (retainedAttempt?.stage === 'adopted')
+                active = await this.clearAttempt(active);
         }
         while (true) {
             const directReview = active.record.directReview;
@@ -2701,10 +2805,7 @@ export class RunIssue {
                 frozenCriteria: reviewScope.criteria,
                 deliveryAuthority: structuredClone(active.record.deliveryAuthority),
                 defects: structuredClone(directReview.review.defects),
-                reviewFocus: [
-                    'candidate-proof-binding', 'correctness', 'duplicate-ownership', 'maintainability',
-                    'repository-standards', 'requirements', 'tests', 'zero-legacy',
-                ],
+                reviewFocus: [...COMPLETE_REVIEW_COVERAGE],
                 workflowGeneration: structuredClone(active.record.workflowGeneration),
                 repairOnly: reportRepair !== undefined,
                 originalReportSha256: reportRepair?.originalReportSha256 ?? null,
@@ -2714,6 +2815,12 @@ export class RunIssue {
                 onPrepared: async (invocation) => {
                     if (!active.record.directReview)
                         throw new Error('direct review disappeared before prepare');
+                    const validationContext = validateReviewContext(invocation.validationContext);
+                    if (validationContext.targetFingerprint !== directReview.targetFingerprint || validationContext.targetRevision !== directReview.targetRevision
+                        || validationContext.reviewerSessionId !== reviewerSessionId)
+                        throw new Error('review validation context drift');
+                    active = await this.persist(active, { directReview: { ...active.record.directReview,
+                            review: { ...active.record.directReview.review, validationContext } } });
                     if (invocation.attemptId !== active.record.activeAttempt?.attemptId
                         || invocation.operation !== 'code-review'
                         || invocation.reviewerSessionId !== reviewerSessionId)
@@ -2759,6 +2866,8 @@ export class RunIssue {
                         completeReview.review.defects = structuredClone(result.report.defects);
                         completeReview.review.reviewerSessionId = this.dependencies.createReviewSessionId();
                         completeReview.review.reportRepairs = 0;
+                        delete completeReview.review.validationContext;
+                        delete completeReview.review.reportCorrection;
                         completeReview.review.transportRetries = 0;
                         active = await this.persist(settledExecution.active, {
                             lifecycle: 'checking',
@@ -2819,7 +2928,15 @@ export class RunIssue {
                 const current = active.record.directReview;
                 if (!current)
                     return this.terminal(active, { status: 'internal-error', code: 'direct-review-result-orphaned' });
-                active = await this.adoptValidationTransition(active, result.originalReportSha256, projectValidationReviewReportRepair(active.record));
+                active = await this.adoptValidationTransition(active, result.originalReportSha256, projectValidationReviewReportRepair(active.record, { path: active.record.activeAttempt.resultPath, sha256: result.originalReportSha256 }));
+                if (active.record.directReview.review.reportRepairs >= 2) {
+                    const repeated = reportRepair?.originalReportSha256 === result.originalReportSha256;
+                    return this.terminal(active, { status: 'blocked', kind: 'external', resumable: false, blocker: {
+                            kind: 'external', resumable: false,
+                            summary: `Review report correction failed${repeated ? ' without changing the report' : ''}: ${result.diagnostic}. Candidate and evidence are retained.`,
+                            attempted: ['Reviewed the candidate and attempted one report-only correction.'],
+                        } });
+                }
                 return this.invokedFailure(active, 'direct-review-report-retryable', 'The review report was malformed; a later bounded invocation may retry the same immutable candidate.');
             }
             if (result.kind === 'transport-failed') {
@@ -3352,7 +3469,9 @@ function terminalReportSnapshot(record, outcome) {
         : outcome.status === 'blocked'
             ? outcome.resumable
                 ? 'Resolve the stated blocker, then rerun the same issue.'
-                : 'Provide the missing decision or authority in this issue before continuing.'
+                : outcome.kind === 'external'
+                    ? 'Inspect the retained report and Runner diagnostics, correct the reported condition, then explicitly retry the retained work.'
+                    : 'Provide the missing decision or authority in this issue before continuing.'
             : outcome.status === 'internal-error'
                 ? 'Inspect the package-owned evidence for the code above, correct the runner condition, and retry the same issue.'
                 : 'Re-add the authorization label and rerun the same issue if the work should continue.';