codex-workflow-v2 2.0.0-alpha.4 → 2.0.0-alpha.7

package/dist/src/alpha6/remediation.js

@@ -0,0 +1,754 @@
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+import { WorkflowError } from '../errors.js';
+import { createUlid } from '../ulid.js';
+import { assertHash64 } from './store-sidecars.js';
+import { readReviewerAttestations, readStepReviewEvents } from './review.js';
+export const REMEDIATION_EVENTS_SIDECAR = 'remediation-events.jsonl';
+export const CORRECTIVE_DECISIONS_SIDECAR = 'corrective-decisions.jsonl';
+const COMMIT_SHA_PATTERN = /^[a-f0-9]{40}$/;
+const REMEDIATION_FAILURE_KINDS = new Set([
+    'checks-failed',
+    'review-failed',
+    'review-unverified',
+]);
+const REMEDIATION_MODES = new Set(['ordinary', 'corrective']);
+const CORRECTIVE_DECISION_VALUES = new Set([
+    'continue-fix',
+    'replan-required',
+    'split-required',
+    'stop-escalate',
+]);
+export function readRemediationEvents(store, task) {
+    return validateRemediationHistory(store, task).remediationEvents;
+}
+export function readCorrectiveDecisionEvents(store, task) {
+    return validateRemediationHistory(store, task).correctiveDecisionEvents;
+}
+export function defaultCorrectiveAuditorActor(taskId) {
+    if (!/^TASK-[0-9A-HJKMNP-TV-Z]{26}$/.test(taskId)) {
+        throw new WorkflowError('INVALID_ARGUMENT', `Cannot derive a corrective Auditor actor from invalid Task ID ${taskId}.`);
+    }
+    return `agent:corrective-auditor:${taskId.toLowerCase()}`;
+}
+export function assertCorrectiveAuditorIndependence(store, task, stepId, auditor) {
+    const remediationEvents = readRemediationEvents(store, task).filter((event) => event.stepId === stepId);
+    const latestRemediationEvent = remediationEvents.at(-1) ?? null;
+    if (!latestRemediationEvent || latestRemediationEvent.failureKind === 'checks-failed')
+        return;
+    const reviewerAttestationHash = latestRemediationEvent.failureEvidence.reviewerAttestationHash;
+    if (!reviewerAttestationHash) {
+        throw new WorkflowError('STATE_CORRUPT', 'Latest guarded remediation event is missing its strict-review attestation binding.', {
+            taskId: task.id,
+            stepId,
+            eventId: latestRemediationEvent.eventId,
+        });
+    }
+    const attestation = readReviewerAttestations(store, task)
+        .find((event) => event.eventHash === reviewerAttestationHash) ?? null;
+    if (!attestation) {
+        throw new WorkflowError('STATE_CORRUPT', 'Latest guarded remediation event references a missing reviewer attestation.', {
+            taskId: task.id,
+            stepId,
+            reviewerAttestationHash,
+        });
+    }
+    if (attestation.reviewer.trim() === auditor.trim()) {
+        throw new WorkflowError('TRANSITION_BLOCKED', `Corrective decision for ${stepId} must be recorded by an auditor distinct from the latest strict reviewer.`, {
+            taskId: task.id,
+            stepId,
+            reviewer: attestation.reviewer,
+            auditor: auditor.trim(),
+        });
+    }
+}
+function validateRemediationHistory(store, task) {
+    const remediationEvents = readRawRemediationEvents(store, task);
+    const correctiveDecisionEvents = readRawCorrectiveDecisionEvents(store, task);
+    validateRemediationAttemptOrdinals(remediationEvents, task);
+    validateRemediationReviewReferences(store, task, remediationEvents);
+    validateCorrectiveDecisionCoverage(task, correctiveDecisionEvents, remediationEvents);
+    validateHistoricalRemediationModesForAllSteps(task, remediationEvents, correctiveDecisionEvents);
+    return {
+        remediationEvents,
+        correctiveDecisionEvents,
+    };
+}
+function readRawRemediationEvents(store, task) {
+    const sidecarFile = path.join(store.taskRoot(task.projectId, task.id), REMEDIATION_EVENTS_SIDECAR);
+    if (!existsSync(sidecarFile))
+        return [];
+    return store.readSidecarEvents(store.taskRoot(task.projectId, task.id), REMEDIATION_EVENTS_SIDECAR, {
+        validateEvent: (event, context) => validateStoredRemediationEvent(event, task, context.file, context.line),
+    });
+}
+function readRawCorrectiveDecisionEvents(store, task) {
+    const sidecarFile = path.join(store.taskRoot(task.projectId, task.id), CORRECTIVE_DECISIONS_SIDECAR);
+    if (!existsSync(sidecarFile))
+        return [];
+    return store.readSidecarEvents(store.taskRoot(task.projectId, task.id), CORRECTIVE_DECISIONS_SIDECAR, {
+        validateEvent: (event, context) => validateStoredCorrectiveDecisionEvent(event, task, context.file, context.line),
+    });
+}
+export function appendRemediationEvent(store, task, stepId, failureKind, failureEvidence, planRiskAudit, now) {
+    const existing = readRemediationEvents(store, task).filter((event) => event.stepId === stepId);
+    const matching = existing.filter((event) => remediationEventMatchesFailure(event, failureKind, failureEvidence));
+    if (matching.length > 1) {
+        throw new WorkflowError('STATE_CORRUPT', 'Multiple remediation events match the same failure identity.', {
+            taskId: task.id,
+            stepId,
+            failureKind,
+            matchingEventIds: matching.map((event) => event.eventId),
+        });
+    }
+    if (matching.length === 1) {
+        const reused = matching[0];
+        const priorEvents = existing.filter((event) => event.attemptOrdinal < reused.attemptOrdinal);
+        const gate = deriveAttemptGateFromHistory(task, stepId, planRiskAudit, priorEvents, readCorrectiveDecisionEvents(store, task));
+        if (reused.attemptOrdinal !== gate.nextAttemptOrdinal || reused.mode !== gate.mode || reused.guardedCategory !== gate.guardedCategory) {
+            throw new WorkflowError('STATE_CORRUPT', 'Existing remediation event conflicts with the current guarded retry binding.', {
+                taskId: task.id,
+                stepId,
+                eventId: reused.eventId,
+                expectedAttemptOrdinal: gate.nextAttemptOrdinal,
+                actualAttemptOrdinal: reused.attemptOrdinal,
+                expectedMode: gate.mode,
+                actualMode: reused.mode,
+            });
+        }
+        return reused;
+    }
+    const gate = deriveAttemptGateFromHistory(task, stepId, planRiskAudit, existing, readCorrectiveDecisionEvents(store, task));
+    return store.appendSidecarEvent(store.taskRoot(task.projectId, task.id), REMEDIATION_EVENTS_SIDECAR, {
+        eventId: `RME-${createUlid(now.getTime())}`,
+        recordedAt: now.toISOString(),
+        taskId: task.id,
+        stepId,
+        guardedCategory: gate.guardedCategory,
+        failureKind,
+        failureEvidence,
+        attemptOrdinal: gate.nextAttemptOrdinal,
+        mode: gate.mode,
+    }, {
+        validateEvent: (event, context) => validateStoredRemediationEvent(event, task, context.file, context.line),
+    });
+}
+export function appendCorrectiveDecisionEvent(store, task, stepId, correctiveAudit, planRiskAudit, planHash, now) {
+    validateCorrectiveDecisionAudit(correctiveAudit);
+    const remediationEvents = readRemediationEvents(store, task).filter((event) => event.stepId === stepId);
+    const triggeringAttemptCount = remediationEvents.length + 1;
+    if (triggeringAttemptCount < 3) {
+        throw new WorkflowError('TRANSITION_BLOCKED', `Corrective decision is not available for ${stepId} before two guarded remediation failures exist.`, {
+            taskId: task.id,
+            stepId,
+            triggeringAttemptCount,
+        });
+    }
+    if (triggeringAttemptCount > 3
+        && correctiveAudit.decision !== 'split-required'
+        && correctiveAudit.decision !== 'stop-escalate') {
+        throw new WorkflowError('TRANSITION_BLOCKED', `Guarded Step ${stepId} reached the hard stop after its third failed remediation review.`, {
+            taskId: task.id,
+            stepId,
+            failedAttemptCount: remediationEvents.length,
+            requestedDecision: correctiveAudit.decision,
+            allowedDecisions: ['split-required', 'stop-escalate'],
+        });
+    }
+    const decisions = readCorrectiveDecisionEvents(store, task);
+    const matching = decisions.filter((event) => event.taskId === task.id
+        && event.stepId === stepId
+        && event.triggeringAttemptCount === triggeringAttemptCount);
+    if (matching.length > 1) {
+        throw new WorkflowError('STATE_CORRUPT', 'Multiple corrective decisions exist for the current guarded remediation binding.', {
+            taskId: task.id,
+            stepId,
+            triggeringAttemptCount,
+            eventIds: matching.map((event) => event.eventId),
+        });
+    }
+    const coveredFindingIds = normalizeStringList(correctiveAudit.reviewedFindingIds, 'Corrective decision reviewedFindingIds');
+    const coveredEventIds = remediationEvents.map((event) => event.eventId);
+    if (matching.length === 1) {
+        const reused = matching[0];
+        if (reused.planHash !== planHash) {
+            throw new WorkflowError('STATE_CONFLICT', 'A corrective decision already exists for this Step and triggering ordinal under a different Plan hash.', {
+                taskId: task.id,
+                stepId,
+                triggeringAttemptCount,
+                existingPlanHash: reused.planHash,
+                requestedPlanHash: planHash,
+                eventId: reused.eventId,
+            });
+        }
+        if (reused.decision !== correctiveAudit.decision
+            || reused.auditor !== correctiveAudit.auditor.trim()
+            || !sameStringArray(reused.coveredFindingIds, coveredFindingIds)
+            || !sameStringArray(reused.coveredEventIds, coveredEventIds)) {
+            throw new WorkflowError('STATE_CONFLICT', 'Existing corrective decision payload does not match the requested guarded remediation binding.', {
+                taskId: task.id,
+                stepId,
+                triggeringAttemptCount,
+                eventId: reused.eventId,
+            });
+        }
+        return reused;
+    }
+    requireGuardedCategory(planRiskAudit, stepId);
+    return store.appendSidecarEvent(store.taskRoot(task.projectId, task.id), CORRECTIVE_DECISIONS_SIDECAR, {
+        eventId: `CRD-${createUlid(now.getTime())}`,
+        recordedAt: now.toISOString(),
+        taskId: task.id,
+        stepId,
+        triggeringAttemptCount,
+        decision: correctiveAudit.decision,
+        auditor: correctiveAudit.auditor.trim(),
+        coveredFindingIds,
+        coveredEventIds,
+        planHash,
+    }, {
+        validateEvent: (event, context) => validateStoredCorrectiveDecisionEvent(event, task, context.file, context.line),
+    });
+}
+export function assertGuardedRemediationAttemptAllowed(store, task, stepId, planRiskAudit) {
+    const remediationEvents = readRemediationEvents(store, task).filter((event) => event.stepId === stepId);
+    return deriveAttemptGateFromHistory(task, stepId, planRiskAudit, remediationEvents, readCorrectiveDecisionEvents(store, task), {
+        enforceRuntimeGate: true,
+    });
+}
+export function findFailedGuardedStepRequiringCorrectiveDecision(store, task, planRiskAudit) {
+    const failedGuardedSteps = task.steps.filter((step) => step.status === 'failed' && planRiskAudit.reviewRequiredStepIds.includes(step.id));
+    const matches = failedGuardedSteps
+        .map((step) => {
+        const remediationEvents = readRemediationEvents(store, task).filter((event) => event.stepId === step.id);
+        if (remediationEvents.length < 2)
+            return null;
+        return deriveAttemptGateFromHistory(task, step.id, planRiskAudit, remediationEvents, readCorrectiveDecisionEvents(store, task));
+    })
+        .filter((value) => value !== null);
+    if (matches.length === 0)
+        return null;
+    if (matches.length > 1) {
+        throw new WorkflowError('STATE_CORRUPT', 'Multiple guarded failed Steps simultaneously require corrective remediation decisions.', {
+            taskId: task.id,
+            stepIds: matches.map((match) => match.stepId),
+        });
+    }
+    return matches[0];
+}
+function deriveAttemptGateFromHistory(task, stepId, planRiskAudit, remediationEvents, correctiveDecisions, options = {}) {
+    const attemptCount = remediationEvents.length;
+    const nextAttemptOrdinal = attemptCount + 1;
+    const guardedCategory = requireGuardedCategory(planRiskAudit, stepId);
+    if (attemptCount >= 3) {
+        throw new WorkflowError('TRANSITION_BLOCKED', `Guarded Step ${stepId} reached the hard stop after its third failed remediation review.`, {
+            taskId: task.id,
+            stepId,
+            failedAttemptCount: attemptCount,
+            requiredAction: 'Record split-required or stop-escalate; another remediation run is prohibited.',
+        });
+    }
+    if (attemptCount < 2) {
+        return {
+            stepId,
+            guardedCategory,
+            attemptCount,
+            nextAttemptOrdinal,
+            mode: 'ordinary',
+            correctiveDecision: null,
+        };
+    }
+    const correctiveDecision = findCurrentCorrectiveDecision(task, stepId, nextAttemptOrdinal, correctiveDecisions);
+    if (!correctiveDecision) {
+        if (options.enforceRuntimeGate) {
+            throw new WorkflowError('TRANSITION_BLOCKED', `Guarded Step ${stepId} exhausted two ordinary remediation attempts and requires a corrective decision before another run.`, {
+                taskId: task.id,
+                stepId,
+                attemptCount,
+                requiredSidecar: CORRECTIVE_DECISIONS_SIDECAR,
+                nextAttemptOrdinal,
+                allowedDecision: 'continue-fix',
+                escalationDecisions: ['replan-required', 'split-required', 'stop-escalate'],
+            });
+        }
+        return {
+            stepId,
+            guardedCategory,
+            attemptCount,
+            nextAttemptOrdinal,
+            mode: 'ordinary',
+            correctiveDecision: null,
+        };
+    }
+    if (correctiveDecision.planHash !== task.planHash) {
+        if (correctiveDecision.decision === 'replan-required') {
+            return {
+                stepId,
+                guardedCategory,
+                attemptCount,
+                nextAttemptOrdinal,
+                mode: 'corrective',
+                correctiveDecision,
+            };
+        }
+        if (options.enforceRuntimeGate) {
+            throw new WorkflowError('TRANSITION_BLOCKED', `Guarded Step ${stepId} has a corrective decision for a different Plan hash and cannot continue under the current Plan.`, {
+                taskId: task.id,
+                stepId,
+                triggeringAttemptCount: nextAttemptOrdinal,
+                currentPlanHash: task.planHash,
+                decisionPlanHash: correctiveDecision.planHash,
+                decisionEventId: correctiveDecision.eventId,
+            });
+        }
+        return {
+            stepId,
+            guardedCategory,
+            attemptCount,
+            nextAttemptOrdinal,
+            mode: 'ordinary',
+            correctiveDecision,
+        };
+    }
+    if (correctiveDecision.decision !== 'continue-fix' && options.enforceRuntimeGate) {
+        throw correctiveDecisionBlockedError(task, stepId, attemptCount, correctiveDecision);
+    }
+    return {
+        stepId,
+        guardedCategory,
+        attemptCount,
+        nextAttemptOrdinal,
+        mode: correctiveDecision.decision === 'continue-fix' ? 'corrective' : 'ordinary',
+        correctiveDecision,
+    };
+}
+function findCurrentCorrectiveDecision(task, stepId, triggeringAttemptOrdinal, events) {
+    const matches = events.filter((event) => event.taskId === task.id
+        && event.stepId === stepId
+        && event.triggeringAttemptCount === triggeringAttemptOrdinal);
+    if (matches.length === 0)
+        return null;
+    if (matches.length > 1) {
+        throw new WorkflowError('STATE_CORRUPT', 'Multiple corrective decisions exist for the same guarded remediation binding.', {
+            taskId: task.id,
+            stepId,
+            triggeringAttemptCount: triggeringAttemptOrdinal,
+            eventIds: matches.map((event) => event.eventId),
+        });
+    }
+    return matches[0];
+}
+function correctiveDecisionBlockedError(task, stepId, attemptCount, event) {
+    if (event.decision === 'replan-required') {
+        return new WorkflowError('TRANSITION_BLOCKED', `Guarded Step ${stepId} cannot continue because the corrective decision requires a replan.`, {
+            taskId: task.id,
+            stepId,
+            attemptCount,
+            decision: event.decision,
+            decisionEventId: event.eventId,
+            auditor: event.auditor,
+        });
+    }
+    if (event.decision === 'split-required') {
+        return new WorkflowError('TRANSITION_BLOCKED', `Guarded Step ${stepId} cannot continue because the corrective decision requires splitting work into a separate Task.`, {
+            taskId: task.id,
+            stepId,
+            attemptCount,
+            decision: event.decision,
+            decisionEventId: event.eventId,
+            auditor: event.auditor,
+        });
+    }
+    return new WorkflowError('TRANSITION_BLOCKED', `Guarded Step ${stepId} cannot continue because the corrective decision requires coordinator escalation.`, {
+        taskId: task.id,
+        stepId,
+        attemptCount,
+        decision: event.decision,
+        decisionEventId: event.eventId,
+        auditor: event.auditor,
+    });
+}
+function requireGuardedCategory(planRiskAudit, stepId) {
+    const classification = planRiskAudit.audit.stepClassifications.find((candidate) => candidate.stepId === stepId) ?? null;
+    if (!classification || classification.categories.length === 0 || !classification.reviewRequired) {
+        throw new WorkflowError('STATE_CORRUPT', `Current Plan Risk Audit does not define a guarded category for ${stepId}.`, {
+            taskId: planRiskAudit.audit.taskId,
+            stepId,
+        });
+    }
+    return classification.categories[0];
+}
+function validateStoredRemediationEvent(event, task, file, line) {
+    if (event.taskId !== task.id) {
+        throw new WorkflowError('STATE_CORRUPT', 'Remediation event taskId does not match the current Task.', {
+            file,
+            line,
+            taskId: task.id,
+            eventTaskId: event.taskId,
+        });
+    }
+    if (typeof event.stepId !== 'string' || !event.stepId.trim()) {
+        throw new WorkflowError('STATE_CORRUPT', 'Remediation event is missing stepId.', { file, line, taskId: task.id });
+    }
+    if (!REMEDIATION_FAILURE_KINDS.has(event.failureKind)) {
+        throw new WorkflowError('STATE_CORRUPT', 'Remediation event has an unknown failureKind.', {
+            file,
+            line,
+            taskId: task.id,
+            stepId: event.stepId,
+            failureKind: event.failureKind,
+        });
+    }
+    if (!REMEDIATION_MODES.has(event.mode)) {
+        throw new WorkflowError('STATE_CORRUPT', 'Remediation event has an unknown mode.', {
+            file,
+            line,
+            taskId: task.id,
+            stepId: event.stepId,
+            mode: event.mode,
+        });
+    }
+    assertCommitSha(event.failureEvidence.completionCommit, 'Remediation failure evidence completionCommit', file, line);
+    assertHash64(event.failureEvidence.checksHash, `Remediation failure evidence checksHash at ${file}:${line}`);
+    if (event.failureEvidence.reviewEventHash !== null) {
+        assertHash64(event.failureEvidence.reviewEventHash, `Remediation failure evidence reviewEventHash at ${file}:${line}`);
+    }
+    if (event.failureEvidence.reviewerAttestationHash !== null) {
+        assertHash64(event.failureEvidence.reviewerAttestationHash, `Remediation failure evidence reviewerAttestationHash at ${file}:${line}`);
+    }
+    if (!Number.isInteger(event.attemptOrdinal) || event.attemptOrdinal <= 0) {
+        throw new WorkflowError('STATE_CORRUPT', 'Remediation event attemptOrdinal must be a positive integer.', {
+            file,
+            line,
+            taskId: task.id,
+            stepId: event.stepId,
+            attemptOrdinal: event.attemptOrdinal,
+        });
+    }
+    if (event.failureKind === 'checks-failed') {
+        if (event.failureEvidence.reviewEventHash !== null || event.failureEvidence.reviewerAttestationHash !== null) {
+            throw new WorkflowError('STATE_CORRUPT', 'checks-failed remediation events must not reference strict review sidecars.', {
+                file,
+                line,
+                taskId: task.id,
+                stepId: event.stepId,
+                eventId: event.eventId,
+            });
+        }
+    }
+    else if (event.failureEvidence.reviewEventHash === null || event.failureEvidence.reviewerAttestationHash === null) {
+        throw new WorkflowError('STATE_CORRUPT', 'review-failed and review-unverified remediation events must reference both strict review sidecars.', {
+            file,
+            line,
+            taskId: task.id,
+            stepId: event.stepId,
+            eventId: event.eventId,
+        });
+    }
+}
+function validateStoredCorrectiveDecisionEvent(event, task, file, line) {
+    if (event.taskId !== task.id) {
+        throw new WorkflowError('STATE_CORRUPT', 'Corrective decision taskId does not match the current Task.', {
+            file,
+            line,
+            taskId: task.id,
+            eventTaskId: event.taskId,
+        });
+    }
+    if (typeof event.stepId !== 'string' || !event.stepId.trim()) {
+        throw new WorkflowError('STATE_CORRUPT', 'Corrective decision is missing stepId.', { file, line, taskId: task.id });
+    }
+    if (!Number.isInteger(event.triggeringAttemptCount) || event.triggeringAttemptCount < 3) {
+        throw new WorkflowError('STATE_CORRUPT', 'Corrective decision triggeringAttemptCount must be an integer >= 3.', {
+            file,
+            line,
+            taskId: task.id,
+            stepId: event.stepId,
+            triggeringAttemptCount: event.triggeringAttemptCount,
+        });
+    }
+    if (!CORRECTIVE_DECISION_VALUES.has(event.decision)) {
+        throw new WorkflowError('STATE_CORRUPT', 'Corrective decision has an unknown decision value.', {
+            file,
+            line,
+            taskId: task.id,
+            stepId: event.stepId,
+            decision: event.decision,
+        });
+    }
+    if (typeof event.auditor !== 'string' || !event.auditor.trim()) {
+        throw new WorkflowError('STATE_CORRUPT', 'Corrective decision is missing auditor.', {
+            file,
+            line,
+            taskId: task.id,
+            stepId: event.stepId,
+        });
+    }
+    normalizeStringList(event.coveredFindingIds, 'Corrective decision coveredFindingIds');
+    normalizeStringList(event.coveredEventIds, 'Corrective decision coveredEventIds');
+    assertHash64(event.planHash, `Corrective decision planHash at ${file}:${line}`);
+}
+function validateRemediationAttemptOrdinals(events, task) {
+    const attemptsByStep = new Map();
+    for (const event of events) {
+        const expectedAttemptOrdinal = (attemptsByStep.get(event.stepId) ?? 0) + 1;
+        if (event.attemptOrdinal !== expectedAttemptOrdinal) {
+            throw new WorkflowError('STATE_CORRUPT', 'Remediation event attemptOrdinal does not match the sidecar history for this Step.', {
+                taskId: task.id,
+                stepId: event.stepId,
+                eventId: event.eventId,
+                expectedAttemptOrdinal,
+                actualAttemptOrdinal: event.attemptOrdinal,
+            });
+        }
+        attemptsByStep.set(event.stepId, event.attemptOrdinal);
+    }
+}
+function validateRemediationReviewReferences(store, task, events) {
+    if (events.length === 0)
+        return;
+    const requiresStrictReviewLookups = events.some((event) => event.failureEvidence.reviewEventHash !== null || event.failureEvidence.reviewerAttestationHash !== null);
+    if (!requiresStrictReviewLookups) {
+        for (const event of events) {
+            if (event.failureKind !== 'checks-failed') {
+                throw new WorkflowError('STATE_CORRUPT', 'Only checks-failed remediation events may omit strict review references.', {
+                    taskId: task.id,
+                    stepId: event.stepId,
+                    eventId: event.eventId,
+                    failureKind: event.failureKind,
+                });
+            }
+        }
+        return;
+    }
+    const reviewEvents = readStepReviewEvents(store, task);
+    const reviewEventsByHash = new Map(reviewEvents.map((event) => [event.eventHash, event]));
+    const reviewerAttestations = readReviewerAttestations(store, task);
+    const reviewerAttestationsByHash = new Map(reviewerAttestations.map((event) => [event.eventHash, event]));
+    const eventKeys = new Set();
+    for (const event of events) {
+        const key = remediationFailureIdentityKey(event.failureKind, event.failureEvidence);
+        if (eventKeys.has(`${event.stepId}\0${key}`)) {
+            throw new WorkflowError('STATE_CORRUPT', 'Duplicate remediation events reference the same failure identity.', {
+                taskId: task.id,
+                stepId: event.stepId,
+                eventId: event.eventId,
+            });
+        }
+        eventKeys.add(`${event.stepId}\0${key}`);
+        if (event.failureEvidence.reviewEventHash === null && event.failureEvidence.reviewerAttestationHash === null) {
+            if (event.failureKind !== 'checks-failed') {
+                throw new WorkflowError('STATE_CORRUPT', 'Only checks-failed remediation events may omit strict review references.', {
+                    taskId: task.id,
+                    stepId: event.stepId,
+                    eventId: event.eventId,
+                    failureKind: event.failureKind,
+                });
+            }
+            continue;
+        }
+        if (event.failureEvidence.reviewEventHash === null || event.failureEvidence.reviewerAttestationHash === null) {
+            throw new WorkflowError('STATE_CORRUPT', 'Remediation event must provide both reviewEventHash and reviewerAttestationHash together.', {
+                taskId: task.id,
+                stepId: event.stepId,
+                eventId: event.eventId,
+            });
+        }
+        const reviewEvent = reviewEventsByHash.get(event.failureEvidence.reviewEventHash) ?? null;
+        const attestation = reviewerAttestationsByHash.get(event.failureEvidence.reviewerAttestationHash) ?? null;
+        if (!reviewEvent || !attestation) {
+            throw new WorkflowError('STATE_CORRUPT', 'Remediation event references missing strict review sidecar history.', {
+                taskId: task.id,
+                stepId: event.stepId,
+                eventId: event.eventId,
+                reviewEventHash: event.failureEvidence.reviewEventHash,
+                reviewerAttestationHash: event.failureEvidence.reviewerAttestationHash,
+            });
+        }
+        if (reviewEvent.taskId !== task.id
+            || reviewEvent.stepId !== event.stepId
+            || reviewEvent.completionCommit !== event.failureEvidence.completionCommit
+            || reviewEvent.checksHash !== event.failureEvidence.checksHash) {
+            throw new WorkflowError('STATE_CORRUPT', 'Remediation event reviewEventHash does not match the exact strict review binding.', {
+                taskId: task.id,
+                stepId: event.stepId,
+                eventId: event.eventId,
+                reviewEventId: reviewEvent.eventId,
+            });
+        }
+        if (attestation.taskId !== task.id
+            || attestation.stepId !== event.stepId
+            || attestation.reviewedCommit !== event.failureEvidence.completionCommit
+            || attestation.reviewEventHash !== reviewEvent.eventHash) {
+            throw new WorkflowError('STATE_CORRUPT', 'Remediation event reviewerAttestationHash does not match the exact strict review binding.', {
+                taskId: task.id,
+                stepId: event.stepId,
+                eventId: event.eventId,
+                reviewerAttestationEventId: attestation.eventId,
+            });
+        }
+        const expectedDecision = event.failureKind === 'review-failed' ? 'failed' : 'unverified';
+        if (reviewEvent.decision !== expectedDecision) {
+            throw new WorkflowError('STATE_CORRUPT', 'Remediation event failureKind does not match the referenced strict review decision.', {
+                taskId: task.id,
+                stepId: event.stepId,
+                eventId: event.eventId,
+                failureKind: event.failureKind,
+                reviewDecision: reviewEvent.decision,
+            });
+        }
+    }
+}
+function validateCorrectiveDecisionCoverage(task, decisions, remediationEvents) {
+    const remediationEventsById = new Map(remediationEvents.map((event) => [event.eventId, event]));
+    const decisionBindings = new Set();
+    for (const decision of decisions) {
+        const binding = `${decision.stepId}\0${decision.triggeringAttemptCount}`;
+        if (decisionBindings.has(binding)) {
+            throw new WorkflowError('STATE_CORRUPT', 'Duplicate corrective decisions exist for the same Step and triggering ordinal.', {
+                taskId: task.id,
+                stepId: decision.stepId,
+                triggeringAttemptCount: decision.triggeringAttemptCount,
+            });
+        }
+        decisionBindings.add(binding);
+        const priorEvents = remediationEvents
+            .filter((event) => event.stepId === decision.stepId && event.attemptOrdinal < decision.triggeringAttemptCount)
+            .sort((left, right) => left.attemptOrdinal - right.attemptOrdinal);
+        const coveredEventIds = normalizeStringList(decision.coveredEventIds, 'Corrective decision coveredEventIds');
+        if (decision.triggeringAttemptCount !== priorEvents.length + 1) {
+            throw new WorkflowError('STATE_CORRUPT', 'Corrective decision triggeringAttemptCount must equal the blocked next attempt ordinal.', {
+                taskId: task.id,
+                stepId: decision.stepId,
+                decisionEventId: decision.eventId,
+                triggeringAttemptCount: decision.triggeringAttemptCount,
+                priorAttemptCount: priorEvents.length,
+            });
+        }
+        if (!sameStringArray(coveredEventIds, priorEvents.map((event) => event.eventId))) {
+            throw new WorkflowError('STATE_CORRUPT', 'Corrective decision coveredEventIds must exactly cover prior remediation events for that Step binding.', {
+                taskId: task.id,
+                stepId: decision.stepId,
+                decisionEventId: decision.eventId,
+                coveredEventIds,
+                expectedCoveredEventIds: priorEvents.map((event) => event.eventId),
+            });
+        }
+        for (const eventId of coveredEventIds) {
+            const linked = remediationEventsById.get(eventId);
+            if (!linked || linked.stepId !== decision.stepId) {
+                throw new WorkflowError('STATE_CORRUPT', 'Corrective decision coveredEventIds references an invalid remediation event.', {
+                    taskId: task.id,
+                    stepId: decision.stepId,
+                    decisionEventId: decision.eventId,
+                    eventId,
+                });
+            }
+        }
+    }
+}
+function validateHistoricalRemediationModes(task, stepId, remediationEvents, correctiveDecisions) {
+    for (const event of remediationEvents) {
+        if (event.attemptOrdinal <= 2) {
+            if (event.mode !== 'ordinary') {
+                throw new WorkflowError('STATE_CORRUPT', 'The first two remediation attempts must remain ordinary.', {
+                    taskId: task.id,
+                    stepId,
+                    eventId: event.eventId,
+                    attemptOrdinal: event.attemptOrdinal,
+                    mode: event.mode,
+                });
+            }
+            continue;
+        }
+        if (event.mode === 'ordinary') {
+            throw new WorkflowError('STATE_CORRUPT', 'Guarded remediation attempt ordinals above 2 must not remain ordinary.', {
+                taskId: task.id,
+                stepId,
+                eventId: event.eventId,
+                attemptOrdinal: event.attemptOrdinal,
+            });
+        }
+        const priorEvents = remediationEvents
+            .filter((candidate) => candidate.stepId === stepId && candidate.attemptOrdinal < event.attemptOrdinal)
+            .sort((left, right) => left.attemptOrdinal - right.attemptOrdinal);
+        const matching = correctiveDecisions.filter((decision) => decision.taskId === task.id
+            && decision.stepId === stepId
+            && decision.triggeringAttemptCount === event.attemptOrdinal
+            && (decision.decision === 'continue-fix' || decision.decision === 'replan-required')
+            && sameStringArray(decision.coveredEventIds, priorEvents.map((candidate) => candidate.eventId)));
+        if (matching.length !== 1) {
+            throw new WorkflowError('STATE_CORRUPT', 'Corrective remediation mode requires one unique continue-fix or replan-required decision for the exact blocked ordinal.', {
+                taskId: task.id,
+                stepId,
+                eventId: event.eventId,
+                attemptOrdinal: event.attemptOrdinal,
+                matchingDecisionIds: matching.map((decision) => decision.eventId),
+            });
+        }
+    }
+}
+function validateHistoricalRemediationModesForAllSteps(task, remediationEvents, correctiveDecisions) {
+    const stepIds = new Set(remediationEvents.map((event) => event.stepId));
+    for (const stepId of stepIds) {
+        const stepEvents = remediationEvents
+            .filter((event) => event.stepId === stepId)
+            .sort((left, right) => left.attemptOrdinal - right.attemptOrdinal);
+        validateHistoricalRemediationModes(task, stepId, stepEvents, correctiveDecisions);
+    }
+}
+function validateCorrectiveDecisionAudit(audit) {
+    if (!audit.auditor.trim() || !audit.summary.trim()) {
+        throw new WorkflowError('INVALID_ARGUMENT', 'Corrective decision requires auditor and summary.');
+    }
+    if (!CORRECTIVE_DECISION_VALUES.has(audit.decision)) {
+        throw new WorkflowError('INVALID_ARGUMENT', 'Corrective decision value is not supported.', {
+            decision: audit.decision,
+        });
+    }
+    normalizeStringList(audit.reviewedFindingIds, 'Corrective decision reviewedFindingIds');
+}
+function normalizeStringList(values, label) {
+    if (!Array.isArray(values)) {
+        throw new WorkflowError('INVALID_ARGUMENT', `${label} must be an array.`);
+    }
+    const normalized = values.map((value) => {
+        if (typeof value !== 'string' || !value.trim()) {
+            throw new WorkflowError('INVALID_ARGUMENT', `${label} must contain non-empty strings.`);
+        }
+        return value.trim();
+    });
+    if (new Set(normalized).size !== normalized.length) {
+        throw new WorkflowError('INVALID_ARGUMENT', `${label} must not contain duplicates.`);
+    }
+    return normalized;
+}
+function remediationEventMatchesFailure(event, failureKind, failureEvidence) {
+    return event.failureKind === failureKind
+        && event.failureEvidence.completionCommit === failureEvidence.completionCommit
+        && event.failureEvidence.checksHash === failureEvidence.checksHash
+        && event.failureEvidence.reviewEventHash === failureEvidence.reviewEventHash
+        && event.failureEvidence.reviewerAttestationHash === failureEvidence.reviewerAttestationHash;
+}
+function remediationFailureIdentityKey(failureKind, failureEvidence) {
+    return [
+        failureKind,
+        failureEvidence.completionCommit,
+        failureEvidence.checksHash,
+        failureEvidence.reviewEventHash ?? '',
+        failureEvidence.reviewerAttestationHash ?? '',
+    ].join('\0');
+}
+function sameStringArray(left, right) {
+    return left.length === right.length && left.every((value, index) => value === right[index]);
+}
+function assertCommitSha(value, label, file, line) {
+    if (!COMMIT_SHA_PATTERN.test(value)) {
+        throw new WorkflowError('STATE_CORRUPT', `${label} must be a full lowercase Git commit SHA.`, {
+            file,
+            line,
+            value,
+        });
+    }
+}
+//# sourceMappingURL=remediation.js.map