codex-workflow-v2 2.0.0-alpha.3 → 2.0.0-alpha.6

package/dist/src/alpha6/review.js

@@ -0,0 +1,785 @@
+import { WorkflowError } from '../errors.js';
+import { canonicalJsonStringify, assertHash64, sha256Hex } from './store-sidecars.js';
+import { createUlid } from '../ulid.js';
+const STEP_REVIEW_EVENTS_SIDECAR = 'step-review-events.jsonl';
+const REVIEWER_ATTESTATIONS_SIDECAR = 'reviewer-attestations.jsonl';
+const GIT_SHA_PATTERN = /^[a-f0-9]{40}$/;
+const STEP_REVIEW_EVENT_TYPES = new Set([
+    'pending',
+    'review-recorded',
+    'attestation-verified',
+]);
+const REVIEW_DECISIONS = new Set(['pending', 'passed', 'failed', 'unverified']);
+const REVIEW_FINDING_SEVERITIES = new Set(['critical', 'major', 'minor']);
+export function isStepReviewRequired(task, stepId, reviewRequiredStepIds) {
+    return reviewRequiredStepIds.includes(stepId);
+}
+export function ensurePendingStrictStepReview(store, task, stepId, now) {
+    const current = buildCurrentStrictStepReviewCycle(store, task, stepId);
+    if (current.pendingEvent && current.latestMatchingEvent?.eventType === 'pending')
+        return current.pendingEvent;
+    return appendStepReviewEvent(store, task, {
+        eventId: `SRE-${createUlid(now.getTime())}`,
+        recordedAt: now.toISOString(),
+        taskId: task.id,
+        taskRevision: task.revision,
+        stepId: current.binding.stepId,
+        stepDefinitionHash: current.binding.stepDefinitionHash,
+        completionCommit: current.binding.completionCommit,
+        checksHash: current.binding.checksHash,
+        planHash: current.binding.planHash,
+        evidenceHash: current.binding.evidenceHash,
+        eventType: 'pending',
+        decision: 'pending',
+        reviewerAttestationHash: null,
+    });
+}
+export function requireCurrentStrictStepReview(store, task, stepId) {
+    const current = buildCurrentStrictStepReviewCycle(store, task, stepId);
+    if (!current.pendingEvent) {
+        throw new WorkflowError('TRANSITION_BLOCKED', `Strict Step Review pending event is missing for ${stepId}.`, {
+            taskId: task.id,
+            stepId,
+            completionCommit: current.binding.completionCommit,
+        });
+    }
+    if (current.latestMatchingEvent?.eventType !== 'pending') {
+        throw new WorkflowError('TRANSITION_BLOCKED', `Strict Step Review for ${stepId} is no longer pending.`, {
+            taskId: task.id,
+            stepId,
+            eventType: current.latestMatchingEvent?.eventType ?? null,
+            completionCommit: current.binding.completionCommit,
+        });
+    }
+    return current;
+}
+export function buildCurrentStrictStepReviewCycle(store, task, stepId) {
+    const current = buildCurrentStrictStepBinding(task, stepId);
+    const stepReviewEvents = readStepReviewEvents(store, task);
+    const reviewerAttestations = readReviewerAttestations(store, task);
+    validateGlobalStrictStepReviewHistory(stepReviewEvents, reviewerAttestations);
+    return resolveCurrentStrictStepReviewCycle(current, stepReviewEvents, reviewerAttestations);
+}
+export function recordStrictStepReview(store, task, stepId, input, now) {
+    let current = buildCurrentStrictStepReviewCycle(store, task, stepId);
+    if (!current.pendingEvent) {
+        throw new WorkflowError('TRANSITION_BLOCKED', `Strict Step Review pending event is missing for ${stepId}.`, {
+            taskId: task.id,
+            stepId,
+            completionCommit: current.binding.completionCommit,
+        });
+    }
+    validateStepReviewRecordInput(current, input);
+    const reviewRecordedEvent = current.reviewRecordedEvent
+        ? reuseReviewRecordedEvent(current, input)
+        : appendStepReviewEvent(store, task, {
+            eventId: `SRE-${createUlid(now.getTime())}`,
+            recordedAt: now.toISOString(),
+            taskId: task.id,
+            taskRevision: task.revision,
+            stepId: current.binding.stepId,
+            stepDefinitionHash: current.binding.stepDefinitionHash,
+            completionCommit: current.binding.completionCommit,
+            checksHash: current.binding.checksHash,
+            planHash: current.binding.planHash,
+            evidenceHash: current.binding.evidenceHash,
+            eventType: 'review-recorded',
+            decision: input.review.status,
+            reviewerAttestationHash: null,
+        });
+    current = buildCurrentStrictStepReviewCycle(store, task, stepId);
+    const reviewerAttestationEvent = current.reviewerAttestationEvent
+        ? reuseReviewerAttestationEvent(current, reviewRecordedEvent, input)
+        : appendReviewerAttestationEvent(store, task, {
+            eventId: `RAT-${createUlid(now.getTime())}`,
+            recordedAt: now.toISOString(),
+            taskId: task.id,
+            stepId: current.binding.stepId,
+            reviewer: input.review.reviewer.trim(),
+            isolationResult: input.isolationResult,
+            outputHash: input.reviewerOutputHash,
+            reviewedCommit: input.reviewedCommit,
+            reviewEventHash: reviewRecordedEvent.eventHash,
+            planHash: current.binding.planHash,
+            evidenceHash: current.binding.evidenceHash,
+        });
+    current = buildCurrentStrictStepReviewCycle(store, task, stepId);
+    const attestationVerifiedEvent = input.isolationResult === 'verified'
+        ? current.attestationVerifiedEvent
+            ? reuseAttestationVerifiedEvent(current, reviewRecordedEvent, reviewerAttestationEvent)
+            : appendStepReviewEvent(store, task, {
+                eventId: `SRE-${createUlid(now.getTime())}`,
+                recordedAt: now.toISOString(),
+                taskId: task.id,
+                taskRevision: task.revision,
+                stepId: current.binding.stepId,
+                stepDefinitionHash: current.binding.stepDefinitionHash,
+                completionCommit: current.binding.completionCommit,
+                checksHash: current.binding.checksHash,
+                planHash: current.binding.planHash,
+                evidenceHash: current.binding.evidenceHash,
+                eventType: 'attestation-verified',
+                decision: reviewRecordedEvent.decision,
+                reviewerAttestationHash: reviewerAttestationEvent.eventHash,
+            })
+        : null;
+    const resolution = deriveStrictStepReviewResolution(reviewRecordedEvent, reviewerAttestationEvent, attestationVerifiedEvent);
+    return {
+        reviewRecordedEvent,
+        reviewerAttestationEvent,
+        attestationVerifiedEvent,
+        resolution,
+        canFinalizeStep: resolution === 'passed_verified',
+    };
+}
+export function readStepReviewEvents(store, task) {
+    return store.readSidecarEvents(store.taskRoot(task.projectId, task.id), STEP_REVIEW_EVENTS_SIDECAR, {
+        validateEvent: (event, context) => validateStoredStepReviewEvent(event, task.id, context.file, context.line),
+    });
+}
+export function readReviewerAttestations(store, task) {
+    return store.readSidecarEvents(store.taskRoot(task.projectId, task.id), REVIEWER_ATTESTATIONS_SIDECAR, {
+        validateEvent: (event, context) => validateStoredReviewerAttestationEvent(event, task.id, context.file, context.line),
+    });
+}
+export function deriveStrictStepReviewResolution(reviewRecordedEvent, reviewerAttestationEvent, attestationVerifiedEvent) {
+    if (!reviewRecordedEvent || !reviewerAttestationEvent)
+        return 'pending';
+    if (reviewRecordedEvent.decision === 'failed')
+        return 'failed';
+    if (reviewRecordedEvent.decision === 'unverified')
+        return 'unverified';
+    if (reviewRecordedEvent.decision !== 'passed')
+        return 'pending';
+    if (reviewerAttestationEvent.isolationResult !== 'verified')
+        return 'unverified';
+    return attestationVerifiedEvent ? 'passed_verified' : 'pending';
+}
+function buildCurrentStrictStepBinding(task, stepId) {
+    const step = requireTaskStep(task, stepId);
+    if (!step.evidence) {
+        throw new WorkflowError('TRANSITION_BLOCKED', `Strict Step Review requires canonical evidence for ${stepId}.`, {
+            taskId: task.id,
+            stepId,
+        });
+    }
+    if (!task.planHash) {
+        throw new WorkflowError('STATE_CORRUPT', `Task ${task.id} has no current plan hash for strict Step Review.`, {
+            taskId: task.id,
+            stepId,
+        });
+    }
+    return {
+        step,
+        evidence: step.evidence,
+        binding: {
+            stepId: step.id,
+            taskRevision: task.revision,
+            stepDefinitionHash: sha256Hex(canonicalJsonStringify(stripStepRuntime(step))),
+            completionCommit: step.evidence.commitSha,
+            checksHash: sha256Hex(canonicalJsonStringify(step.evidence.checks)),
+            planHash: task.planHash,
+            evidenceHash: sha256Hex(canonicalJsonStringify(step.evidence)),
+        },
+    };
+}
+function resolveCurrentStrictStepReviewCycle(current, stepReviewEvents, reviewerAttestations) {
+    const matchingEvents = stepReviewEvents.filter((event) => eventMatchesBinding(event, current.binding));
+    const latestMatchingEvent = matchingEvents.at(-1) ?? null;
+    const latestPendingIndex = findLastIndex(matchingEvents, (event) => event.eventType === 'pending');
+    if (latestPendingIndex < 0) {
+        if (matchingEvents.length > 0) {
+            throw new WorkflowError('STATE_CORRUPT', 'Strict Step Review history is missing the pending event that should anchor the current cycle.', {
+                stepId: current.binding.stepId,
+                completionCommit: current.binding.completionCommit,
+                latestEventType: latestMatchingEvent?.eventType ?? null,
+            });
+        }
+        return {
+            ...current,
+            latestMatchingEvent: null,
+            pendingEvent: null,
+            reviewRecordedEvent: null,
+            reviewerAttestationEvent: null,
+            attestationVerifiedEvent: null,
+            resolution: 'pending',
+        };
+    }
+    const pendingEvent = matchingEvents[latestPendingIndex];
+    const cycleEvents = matchingEvents.slice(latestPendingIndex + 1);
+    const reviewRecordedEvents = cycleEvents.filter((event) => event.eventType === 'review-recorded');
+    const attestationVerifiedEvents = cycleEvents.filter((event) => event.eventType === 'attestation-verified');
+    if (reviewRecordedEvents.length > 1) {
+        throw new WorkflowError('STATE_CORRUPT', 'Strict Step Review cycle has multiple review-recorded events for one pending event.', {
+            stepId: current.binding.stepId,
+            completionCommit: current.binding.completionCommit,
+            eventIds: reviewRecordedEvents.map((event) => event.eventId),
+        });
+    }
+    if (attestationVerifiedEvents.length > 1) {
+        throw new WorkflowError('STATE_CORRUPT', 'Strict Step Review cycle has multiple attestation-verified events for one pending event.', {
+            stepId: current.binding.stepId,
+            completionCommit: current.binding.completionCommit,
+            eventIds: attestationVerifiedEvents.map((event) => event.eventId),
+        });
+    }
+    const reviewRecordedEvent = reviewRecordedEvents[0] ?? null;
+    const attestationVerifiedEvent = attestationVerifiedEvents[0] ?? null;
+    let reviewerAttestationEvent = null;
+    if (reviewRecordedEvent) {
+        const linkedAttestations = reviewerAttestations.filter((event) => event.reviewEventHash === reviewRecordedEvent.eventHash);
+        if (linkedAttestations.length > 1) {
+            throw new WorkflowError('STATE_CORRUPT', 'Strict Step Review cycle has multiple reviewer attestations for one review event.', {
+                stepId: current.binding.stepId,
+                reviewEventId: reviewRecordedEvent.eventId,
+                eventIds: linkedAttestations.map((event) => event.eventId),
+            });
+        }
+        reviewerAttestationEvent = linkedAttestations[0] ?? null;
+        if (reviewerAttestationEvent)
+            validateAttestationBinding(current.binding, reviewRecordedEvent, reviewerAttestationEvent);
+    }
+    else if (attestationVerifiedEvent) {
+        throw new WorkflowError('STATE_CORRUPT', 'Strict Step Review attestation verification cannot exist without a review-recorded event.', {
+            stepId: current.binding.stepId,
+            eventId: attestationVerifiedEvent.eventId,
+        });
+    }
+    if (attestationVerifiedEvent) {
+        if (!reviewerAttestationEvent || !reviewRecordedEvent) {
+            throw new WorkflowError('STATE_CORRUPT', 'Strict Step Review attestation verification is missing its prerequisite chain.', {
+                stepId: current.binding.stepId,
+                eventId: attestationVerifiedEvent.eventId,
+            });
+        }
+        validateAttestationVerifiedChain(current.binding, reviewRecordedEvent, reviewerAttestationEvent, attestationVerifiedEvent);
+    }
+    return {
+        ...current,
+        latestMatchingEvent,
+        pendingEvent,
+        reviewRecordedEvent,
+        reviewerAttestationEvent,
+        attestationVerifiedEvent,
+        resolution: deriveStrictStepReviewResolution(reviewRecordedEvent, reviewerAttestationEvent, attestationVerifiedEvent),
+    };
+}
+function validateGlobalStrictStepReviewHistory(stepReviewEvents, reviewerAttestations) {
+    const reviewRecordedEventsByHash = indexStepReviewEventsByHash(stepReviewEvents, 'review-recorded');
+    const reviewerAttestationsByReviewHash = new Map();
+    for (const attestation of reviewerAttestations) {
+        const linkedReviewEvents = reviewRecordedEventsByHash.get(attestation.reviewEventHash) ?? [];
+        if (linkedReviewEvents.length !== 1) {
+            throw new WorkflowError('STATE_CORRUPT', linkedReviewEvents.length === 0
+                ? 'Reviewer attestation references a missing review-recorded Step Review event.'
+                : 'Reviewer attestation references multiple review-recorded Step Review events.', {
+                eventId: attestation.eventId,
+                reviewEventHash: attestation.reviewEventHash,
+                matchCount: linkedReviewEvents.length,
+            });
+        }
+        const linkedReviewEvent = linkedReviewEvents[0];
+        validateHistoricalAttestationBinding(linkedReviewEvent, attestation);
+        const linkedAttestations = reviewerAttestationsByReviewHash.get(attestation.reviewEventHash) ?? [];
+        linkedAttestations.push(attestation);
+        reviewerAttestationsByReviewHash.set(attestation.reviewEventHash, linkedAttestations);
+    }
+    for (const [reviewEventHash, linkedAttestations] of reviewerAttestationsByReviewHash) {
+        if (linkedAttestations.length > 1) {
+            throw new WorkflowError('STATE_CORRUPT', 'Multiple reviewer attestations target the same review-recorded Step Review event.', {
+                reviewEventHash,
+                eventIds: linkedAttestations.map((event) => event.eventId),
+            });
+        }
+    }
+    const reviewerAttestationsByHash = indexReviewerAttestationsByHash(reviewerAttestations);
+    const attestationVerifiedEventsByAttestationHash = new Map();
+    for (const verifiedEvent of stepReviewEvents) {
+        if (verifiedEvent.eventType !== 'attestation-verified')
+            continue;
+        const attestationHash = verifiedEvent.reviewerAttestationHash;
+        if (typeof attestationHash !== 'string') {
+            throw new WorkflowError('STATE_CORRUPT', 'Attestation-verified Step Review event is missing its attestation hash.', {
+                eventId: verifiedEvent.eventId,
+            });
+        }
+        const linkedAttestations = reviewerAttestationsByHash.get(attestationHash) ?? [];
+        if (linkedAttestations.length !== 1) {
+            throw new WorkflowError('STATE_CORRUPT', linkedAttestations.length === 0
+                ? 'Attestation-verified Step Review event references a missing reviewer attestation.'
+                : 'Attestation-verified Step Review event references multiple reviewer attestations.', {
+                eventId: verifiedEvent.eventId,
+                reviewerAttestationHash: attestationHash,
+                matchCount: linkedAttestations.length,
+            });
+        }
+        const reviewerAttestationEvent = linkedAttestations[0];
+        const linkedReviewEvents = reviewRecordedEventsByHash.get(reviewerAttestationEvent.reviewEventHash) ?? [];
+        if (linkedReviewEvents.length !== 1) {
+            throw new WorkflowError('STATE_CORRUPT', linkedReviewEvents.length === 0
+                ? 'Attestation-verified Step Review event references an attestation whose review-recorded event is missing.'
+                : 'Attestation-verified Step Review event references an attestation with multiple review-recorded targets.', {
+                eventId: verifiedEvent.eventId,
+                reviewerAttestationEventId: reviewerAttestationEvent.eventId,
+                reviewEventHash: reviewerAttestationEvent.reviewEventHash,
+                matchCount: linkedReviewEvents.length,
+            });
+        }
+        const linkedReviewEvent = linkedReviewEvents[0];
+        validateHistoricalAttestationBinding(linkedReviewEvent, reviewerAttestationEvent);
+        validateHistoricalAttestationVerifiedChain(linkedReviewEvent, reviewerAttestationEvent, verifiedEvent);
+        const linkedVerifiedEvents = attestationVerifiedEventsByAttestationHash.get(attestationHash) ?? [];
+        linkedVerifiedEvents.push(verifiedEvent);
+        attestationVerifiedEventsByAttestationHash.set(attestationHash, linkedVerifiedEvents);
+    }
+    for (const [reviewerAttestationHash, linkedVerifiedEvents] of attestationVerifiedEventsByAttestationHash) {
+        if (linkedVerifiedEvents.length > 1) {
+            throw new WorkflowError('STATE_CORRUPT', 'Multiple attestation-verified Step Review events target the same reviewer attestation.', {
+                reviewerAttestationHash,
+                eventIds: linkedVerifiedEvents.map((event) => event.eventId),
+            });
+        }
+    }
+}
+function stripStepRuntime(step) {
+    const { status: _status, evidence: _evidence, ...definition } = step;
+    return definition;
+}
+function requireTaskStep(task, stepId) {
+    const step = task.steps.find((candidate) => candidate.id === stepId);
+    if (!step)
+        throw new WorkflowError('NOT_FOUND', `Step not found: ${stepId}`);
+    return step;
+}
+function eventMatchesBinding(event, binding) {
+    return event.stepId === binding.stepId
+        && event.stepDefinitionHash === binding.stepDefinitionHash
+        && event.completionCommit === binding.completionCommit
+        && event.checksHash === binding.checksHash
+        && event.planHash === binding.planHash
+        && event.evidenceHash === binding.evidenceHash;
+}
+function stepReviewEventsMatchStructuralBinding(left, right) {
+    return left.taskId === right.taskId
+        && left.stepId === right.stepId
+        && left.stepDefinitionHash === right.stepDefinitionHash
+        && left.completionCommit === right.completionCommit
+        && left.checksHash === right.checksHash
+        && left.planHash === right.planHash
+        && left.evidenceHash === right.evidenceHash;
+}
+function validateStepReviewRecordInput(current, input) {
+    const reviewer = typeof input.review.reviewer === 'string' ? input.review.reviewer.trim() : '';
+    const summary = typeof input.review.summary === 'string' ? input.review.summary.trim() : '';
+    if (!reviewer || !summary) {
+        throw new WorkflowError('INVALID_ARGUMENT', 'Strict Step Review requires reviewer identity and summary.', {
+            stepId: current.binding.stepId,
+        });
+    }
+    if (!Array.isArray(input.review.findings)) {
+        throw new WorkflowError('INVALID_ARGUMENT', 'Strict Step Review findings must be an array.', {
+            stepId: current.binding.stepId,
+        });
+    }
+    if (input.review.status === 'pending' || !REVIEW_DECISIONS.has(input.review.status)) {
+        throw new WorkflowError('INVALID_ARGUMENT', 'Strict Step Review status is invalid.', {
+            stepId: current.binding.stepId,
+            status: input.review.status,
+        });
+    }
+    for (const finding of input.review.findings) {
+        if (!finding || typeof finding !== 'object') {
+            throw new WorkflowError('INVALID_ARGUMENT', 'Strict Step Review findings must be objects.', {
+                stepId: current.binding.stepId,
+            });
+        }
+        if (typeof finding.id !== 'string' || !finding.id.trim()) {
+            throw new WorkflowError('INVALID_ARGUMENT', 'Strict Step Review findings require an id.', {
+                stepId: current.binding.stepId,
+            });
+        }
+        if (!REVIEW_FINDING_SEVERITIES.has(finding.severity)) {
+            throw new WorkflowError('INVALID_ARGUMENT', 'Strict Step Review findings severity is invalid.', {
+                stepId: current.binding.stepId,
+                findingId: finding.id,
+                severity: finding.severity,
+            });
+        }
+        if (finding.requirement !== null && (typeof finding.requirement !== 'string' || !finding.requirement.trim())) {
+            throw new WorkflowError('INVALID_ARGUMENT', 'Strict Step Review finding requirement must be null or a non-empty string.', {
+                stepId: current.binding.stepId,
+                findingId: finding.id,
+            });
+        }
+        for (const [label, value] of [
+            ['summary', finding.summary],
+            ['evidence', finding.evidence],
+            ['requiredAction', finding.requiredAction],
+        ]) {
+            if (typeof value !== 'string' || !value.trim()) {
+                throw new WorkflowError('INVALID_ARGUMENT', `Strict Step Review finding ${label} is required.`, {
+                    stepId: current.binding.stepId,
+                    findingId: finding.id,
+                });
+            }
+        }
+    }
+    if (input.review.status === 'passed' && input.review.findings.length > 0) {
+        throw new WorkflowError('INVALID_ARGUMENT', 'Strict Step Review cannot mark passed while findings remain.', {
+            stepId: current.binding.stepId,
+        });
+    }
+    if (input.review.status === 'failed' && input.review.findings.length === 0) {
+        throw new WorkflowError('INVALID_ARGUMENT', 'Strict Step Review failure must include at least one finding.', {
+            stepId: current.binding.stepId,
+        });
+    }
+    assertHash64(input.reviewerOutputHash, 'Strict Step Review reviewer output hash');
+    if (!GIT_SHA_PATTERN.test(input.reviewedCommit)) {
+        throw new WorkflowError('TRANSITION_BLOCKED', 'Strict Step Review reviewed commit is not a full Git SHA.', {
+            stepId: current.binding.stepId,
+            reviewedCommit: input.reviewedCommit,
+        });
+    }
+    if (input.reviewedCommit !== current.binding.completionCommit) {
+        throw new WorkflowError('TRANSITION_BLOCKED', 'Strict Step Review must bind the exact completion commit.', {
+            stepId: current.binding.stepId,
+            reviewedCommit: input.reviewedCommit,
+            completionCommit: current.binding.completionCommit,
+        });
+    }
+    if (input.isolationResult !== 'verified' && input.isolationResult !== 'unverified') {
+        throw new WorkflowError('INVALID_ARGUMENT', 'Strict Step Review isolation result is invalid.', {
+            stepId: current.binding.stepId,
+            isolationResult: input.isolationResult,
+        });
+    }
+}
+function reuseReviewRecordedEvent(current, input) {
+    const existing = current.reviewRecordedEvent;
+    if (!existing)
+        throw new WorkflowError('STATE_CORRUPT', 'Strict Step Review review-recorded event is unexpectedly missing.', {
+            stepId: current.binding.stepId,
+        });
+    if (existing.decision !== input.review.status) {
+        throw new WorkflowError('TRANSITION_BLOCKED', 'Strict Step Review already recorded a conflicting decision for this completion commit.', {
+            stepId: current.binding.stepId,
+            existingDecision: existing.decision,
+            requestedDecision: input.review.status,
+            completionCommit: current.binding.completionCommit,
+        });
+    }
+    return existing;
+}
+function reuseReviewerAttestationEvent(current, reviewRecordedEvent, input) {
+    const existing = current.reviewerAttestationEvent;
+    if (!existing)
+        throw new WorkflowError('STATE_CORRUPT', 'Strict Step Review attestation is unexpectedly missing.', {
+            stepId: current.binding.stepId,
+        });
+    validateAttestationBinding(current.binding, reviewRecordedEvent, existing);
+    const reviewer = input.review.reviewer.trim();
+    if (existing.reviewer !== reviewer
+        || existing.isolationResult !== input.isolationResult
+        || existing.outputHash !== input.reviewerOutputHash
+        || existing.reviewedCommit !== input.reviewedCommit) {
+        throw new WorkflowError('TRANSITION_BLOCKED', 'Strict Step Review already recorded a conflicting reviewer attestation for this completion commit.', {
+            stepId: current.binding.stepId,
+            completionCommit: current.binding.completionCommit,
+            existingReviewer: existing.reviewer,
+            requestedReviewer: reviewer,
+            existingIsolationResult: existing.isolationResult,
+            requestedIsolationResult: input.isolationResult,
+            existingOutputHash: existing.outputHash,
+            requestedOutputHash: input.reviewerOutputHash,
+            existingReviewedCommit: existing.reviewedCommit,
+            requestedReviewedCommit: input.reviewedCommit,
+        });
+    }
+    return existing;
+}
+function reuseAttestationVerifiedEvent(current, reviewRecordedEvent, reviewerAttestationEvent) {
+    const existing = current.attestationVerifiedEvent;
+    if (!existing)
+        throw new WorkflowError('STATE_CORRUPT', 'Strict Step Review attestation verification is unexpectedly missing.', {
+            stepId: current.binding.stepId,
+        });
+    validateAttestationVerifiedChain(current.binding, reviewRecordedEvent, reviewerAttestationEvent, existing);
+    return existing;
+}
+function validateAttestationBinding(binding, reviewRecordedEvent, attestation) {
+    if (attestation.stepId !== binding.stepId
+        || attestation.taskId !== reviewRecordedEvent.taskId
+        || attestation.reviewedCommit !== binding.completionCommit
+        || attestation.reviewEventHash !== reviewRecordedEvent.eventHash
+        || attestation.planHash !== binding.planHash
+        || attestation.evidenceHash !== binding.evidenceHash) {
+        throw new WorkflowError('STATE_CORRUPT', 'Strict Step Review reviewer attestation does not match the current completion binding.', {
+            stepId: binding.stepId,
+            completionCommit: binding.completionCommit,
+            reviewEventId: reviewRecordedEvent.eventId,
+            attestationEventId: attestation.eventId,
+        });
+    }
+}
+function validateHistoricalAttestationBinding(reviewRecordedEvent, attestation) {
+    if (reviewRecordedEvent.eventType !== 'review-recorded') {
+        throw new WorkflowError('STATE_CORRUPT', 'Reviewer attestation must target a review-recorded Step Review event.', {
+            reviewEventId: reviewRecordedEvent.eventId,
+            reviewEventType: reviewRecordedEvent.eventType,
+            attestationEventId: attestation.eventId,
+        });
+    }
+    if (attestation.taskId !== reviewRecordedEvent.taskId
+        || attestation.stepId !== reviewRecordedEvent.stepId
+        || attestation.reviewedCommit !== reviewRecordedEvent.completionCommit
+        || attestation.reviewEventHash !== reviewRecordedEvent.eventHash
+        || attestation.planHash !== reviewRecordedEvent.planHash
+        || attestation.evidenceHash !== reviewRecordedEvent.evidenceHash) {
+        throw new WorkflowError('STATE_CORRUPT', 'Reviewer attestation does not match the referenced review-recorded Step Review event binding.', {
+            reviewEventId: reviewRecordedEvent.eventId,
+            attestationEventId: attestation.eventId,
+            reviewEventHash: reviewRecordedEvent.eventHash,
+        });
+    }
+}
+function validateAttestationVerifiedChain(binding, reviewRecordedEvent, reviewerAttestationEvent, verifiedEvent) {
+    if (!eventMatchesBinding(verifiedEvent, binding)) {
+        throw new WorkflowError('STATE_CORRUPT', 'Strict Step Review attestation verification does not match the current completion binding.', {
+            stepId: binding.stepId,
+            eventId: verifiedEvent.eventId,
+        });
+    }
+    if (reviewerAttestationEvent.isolationResult !== 'verified') {
+        throw new WorkflowError('STATE_CORRUPT', 'Strict Step Review attestation verification cannot exist for an unverified isolation result.', {
+            stepId: binding.stepId,
+            attestationEventId: reviewerAttestationEvent.eventId,
+            verifiedEventId: verifiedEvent.eventId,
+        });
+    }
+    if (verifiedEvent.reviewerAttestationHash !== reviewerAttestationEvent.eventHash) {
+        throw new WorkflowError('STATE_CORRUPT', 'Strict Step Review attestation verification does not reference the expected attestation event.', {
+            stepId: binding.stepId,
+            attestationEventId: reviewerAttestationEvent.eventId,
+            verifiedEventId: verifiedEvent.eventId,
+        });
+    }
+    if (verifiedEvent.decision !== reviewRecordedEvent.decision) {
+        throw new WorkflowError('STATE_CORRUPT', 'Strict Step Review attestation verification decision does not match the review event.', {
+            stepId: binding.stepId,
+            reviewEventId: reviewRecordedEvent.eventId,
+            verifiedEventId: verifiedEvent.eventId,
+            reviewDecision: reviewRecordedEvent.decision,
+            verifiedDecision: verifiedEvent.decision,
+        });
+    }
+    validateAttestationBinding(binding, reviewRecordedEvent, reviewerAttestationEvent);
+}
+function validateHistoricalAttestationVerifiedChain(reviewRecordedEvent, reviewerAttestationEvent, verifiedEvent) {
+    if (reviewRecordedEvent.eventType !== 'review-recorded') {
+        throw new WorkflowError('STATE_CORRUPT', 'Attestation-verified Step Review event must link to a review-recorded Step Review event.', {
+            reviewEventId: reviewRecordedEvent.eventId,
+            reviewEventType: reviewRecordedEvent.eventType,
+            verifiedEventId: verifiedEvent.eventId,
+        });
+    }
+    if (!stepReviewEventsMatchStructuralBinding(verifiedEvent, reviewRecordedEvent)) {
+        throw new WorkflowError('STATE_CORRUPT', 'Attestation-verified Step Review event does not match the referenced review-recorded binding.', {
+            reviewEventId: reviewRecordedEvent.eventId,
+            verifiedEventId: verifiedEvent.eventId,
+        });
+    }
+    if (reviewerAttestationEvent.isolationResult !== 'verified') {
+        throw new WorkflowError('STATE_CORRUPT', 'Attestation-verified Step Review event cannot link to an unverified reviewer attestation.', {
+            reviewEventId: reviewRecordedEvent.eventId,
+            reviewerAttestationEventId: reviewerAttestationEvent.eventId,
+            verifiedEventId: verifiedEvent.eventId,
+        });
+    }
+    if (verifiedEvent.reviewerAttestationHash !== reviewerAttestationEvent.eventHash) {
+        throw new WorkflowError('STATE_CORRUPT', 'Attestation-verified Step Review event does not reference the expected reviewer attestation.', {
+            reviewEventId: reviewRecordedEvent.eventId,
+            reviewerAttestationEventId: reviewerAttestationEvent.eventId,
+            verifiedEventId: verifiedEvent.eventId,
+        });
+    }
+    if (verifiedEvent.decision !== reviewRecordedEvent.decision) {
+        throw new WorkflowError('STATE_CORRUPT', 'Attestation-verified Step Review decision does not match the referenced review-recorded event.', {
+            reviewEventId: reviewRecordedEvent.eventId,
+            reviewerAttestationEventId: reviewerAttestationEvent.eventId,
+            verifiedEventId: verifiedEvent.eventId,
+            reviewDecision: reviewRecordedEvent.decision,
+            verifiedDecision: verifiedEvent.decision,
+        });
+    }
+    validateHistoricalAttestationBinding(reviewRecordedEvent, reviewerAttestationEvent);
+}
+function appendStepReviewEvent(store, task, event) {
+    return store.appendSidecarEvent(store.taskRoot(task.projectId, task.id), STEP_REVIEW_EVENTS_SIDECAR, event, {
+        validateEvent: (candidate, context) => validateStoredStepReviewEvent(candidate, task.id, context.file, context.line),
+    });
+}
+function appendReviewerAttestationEvent(store, task, event) {
+    return store.appendSidecarEvent(store.taskRoot(task.projectId, task.id), REVIEWER_ATTESTATIONS_SIDECAR, event, {
+        validateEvent: (candidate, context) => validateStoredReviewerAttestationEvent(candidate, task.id, context.file, context.line),
+    });
+}
+function validateStoredStepReviewEvent(event, expectedTaskId, file, line) {
+    if (event.taskId !== expectedTaskId) {
+        throw new WorkflowError('STATE_CORRUPT', 'Step Review event task binding does not match its task root.', {
+            file,
+            line,
+            eventId: event.eventId,
+            expectedTaskId,
+            actualTaskId: event.taskId,
+        });
+    }
+    assertPositiveInteger(event.taskRevision, 'Step Review taskRevision', file, line, event.eventId);
+    assertNonEmptyString(event.stepId, 'Step Review stepId', file, line, event.eventId);
+    assertHash64(event.stepDefinitionHash, 'Step Review stepDefinitionHash');
+    assertGitSha(event.completionCommit, 'Step Review completionCommit', file, line, event.eventId);
+    assertHash64(event.checksHash, 'Step Review checksHash');
+    assertHash64(event.planHash, 'Step Review planHash');
+    assertOptionalHash64(event.evidenceHash, 'Step Review evidenceHash', file, line, event.eventId);
+    if (!STEP_REVIEW_EVENT_TYPES.has(event.eventType)) {
+        throw new WorkflowError('STATE_CORRUPT', 'Step Review eventType is invalid.', {
+            file,
+            line,
+            eventId: event.eventId,
+            eventType: event.eventType,
+        });
+    }
+    if (!REVIEW_DECISIONS.has(event.decision)) {
+        throw new WorkflowError('STATE_CORRUPT', 'Step Review decision is invalid.', {
+            file,
+            line,
+            eventId: event.eventId,
+            decision: event.decision,
+        });
+    }
+    if (event.eventType === 'pending') {
+        if (event.decision !== 'pending' || event.reviewerAttestationHash !== null) {
+            throw new WorkflowError('STATE_CORRUPT', 'Pending Step Review event must remain unattested with decision pending.', {
+                file,
+                line,
+                eventId: event.eventId,
+            });
+        }
+    }
+    if (event.eventType === 'review-recorded') {
+        if (event.decision === 'pending' || event.reviewerAttestationHash !== null) {
+            throw new WorkflowError('STATE_CORRUPT', 'Review-recorded Step Review event must carry a terminal review decision and no attestation hash.', {
+                file,
+                line,
+                eventId: event.eventId,
+            });
+        }
+    }
+    if (event.eventType === 'attestation-verified') {
+        if (event.decision === 'pending' || typeof event.reviewerAttestationHash !== 'string') {
+            throw new WorkflowError('STATE_CORRUPT', 'Attestation-verified Step Review event must carry a terminal decision and attestation hash.', {
+                file,
+                line,
+                eventId: event.eventId,
+            });
+        }
+        assertHash64(event.reviewerAttestationHash, 'Step Review reviewerAttestationHash');
+    }
+}
+function validateStoredReviewerAttestationEvent(event, expectedTaskId, file, line) {
+    if (event.taskId !== expectedTaskId) {
+        throw new WorkflowError('STATE_CORRUPT', 'Reviewer attestation task binding does not match its task root.', {
+            file,
+            line,
+            eventId: event.eventId,
+            expectedTaskId,
+            actualTaskId: event.taskId,
+        });
+    }
+    assertNonEmptyString(event.stepId, 'Reviewer attestation stepId', file, line, event.eventId);
+    assertNonEmptyString(event.reviewer, 'Reviewer attestation reviewer', file, line, event.eventId);
+    if (event.isolationResult !== 'verified' && event.isolationResult !== 'unverified') {
+        throw new WorkflowError('STATE_CORRUPT', 'Reviewer attestation isolation result is invalid.', {
+            file,
+            line,
+            eventId: event.eventId,
+            isolationResult: event.isolationResult,
+        });
+    }
+    assertHash64(event.outputHash, 'Reviewer attestation outputHash');
+    assertGitSha(event.reviewedCommit, 'Reviewer attestation reviewedCommit', file, line, event.eventId);
+    assertHash64(event.reviewEventHash, 'Reviewer attestation reviewEventHash');
+    assertHash64(event.planHash, 'Reviewer attestation planHash');
+    assertOptionalHash64(event.evidenceHash, 'Reviewer attestation evidenceHash', file, line, event.eventId);
+}
+function findLastIndex(items, predicate) {
+    for (let index = items.length - 1; index >= 0; index -= 1) {
+        if (predicate(items[index]))
+            return index;
+    }
+    return -1;
+}
+function indexStepReviewEventsByHash(stepReviewEvents, eventType) {
+    const indexed = new Map();
+    for (const event of stepReviewEvents) {
+        if (event.eventType !== eventType)
+            continue;
+        const matches = indexed.get(event.eventHash) ?? [];
+        matches.push(event);
+        indexed.set(event.eventHash, matches);
+    }
+    return indexed;
+}
+function indexReviewerAttestationsByHash(reviewerAttestations) {
+    const indexed = new Map();
+    for (const event of reviewerAttestations) {
+        const matches = indexed.get(event.eventHash) ?? [];
+        matches.push(event);
+        indexed.set(event.eventHash, matches);
+    }
+    return indexed;
+}
+function assertPositiveInteger(value, label, file, line, eventId) {
+    if (!Number.isInteger(value) || Number(value) < 1) {
+        throw new WorkflowError('STATE_CORRUPT', `${label} must be a positive integer.`, {
+            file,
+            line,
+            eventId,
+            value,
+        });
+    }
+}
+function assertNonEmptyString(value, label, file, line, eventId) {
+    if (typeof value !== 'string' || !value.trim()) {
+        throw new WorkflowError('STATE_CORRUPT', `${label} must be a non-empty string.`, {
+            file,
+            line,
+            eventId,
+            value,
+        });
+    }
+}
+function assertGitSha(value, label, file, line, eventId) {
+    if (typeof value !== 'string' || !GIT_SHA_PATTERN.test(value)) {
+        throw new WorkflowError('STATE_CORRUPT', `${label} must be a full Git SHA.`, {
+            file,
+            line,
+            eventId,
+            value,
+        });
+    }
+}
+function assertOptionalHash64(value, label, file, line, eventId) {
+    if (value === null)
+        return;
+    if (typeof value !== 'string') {
+        throw new WorkflowError('STATE_CORRUPT', `${label} must be null or a sha256 hex digest.`, {
+            file,
+            line,
+            eventId,
+            value,
+        });
+    }
+    assertHash64(value, label);
+}
+//# sourceMappingURL=review.js.map