codex-workflow-v2 2.0.0-beta.1 → 2.0.0-beta.11

package/dist/src/dependency-provenance.js

@@ -0,0 +1,185 @@
+import { PACKAGE_NAME, PACKAGE_VERSION } from './version.js';
+import { changedFiles, currentBranch, headCommit, runGit } from './repository.js';
+const RECOVERY_FILES = ['package-lock.json', 'package.json'];
+const TERMINAL_TASK_STATUSES = new Set(['merged', 'cancelled']);
+export function inspectDependencyProvenanceRecovery(repositoryRoot, task, environment) {
+    const blockers = [];
+    const dirty = changedFiles(repositoryRoot);
+    const head = headCommit(repositoryRoot);
+    let parent = null;
+    let commitFiles = [];
+    let retainedHistoricalCommits = [];
+    if (dirty.length > 0)
+        blockers.push('Repository checkout must be clean.');
+    if (task.workspaceOwner !== 'local')
+        blockers.push('Recovery is limited to a local Task workspace.');
+    if (!task.taskBranch || currentBranch(repositoryRoot) !== task.taskBranch) {
+        blockers.push('The current branch must be the recorded Task branch.');
+    }
+    if (!task.baseCommit)
+        blockers.push('The Task must have a recorded base commit.');
+    if (TERMINAL_TASK_STATUSES.has(task.status))
+        blockers.push('Terminal Tasks cannot recover dependency provenance.');
+    if (task.steps.some((step) => step.status === 'in_progress'))
+        blockers.push('No Step may be in progress.');
+    if (environment.activeLeaseCount > 0)
+        blockers.push('No active writer lease may exist.');
+    if (environment.staleLeaseCount > 0)
+        blockers.push('No stale writer lease may exist.');
+    if (environment.pendingTransactionCount > 0)
+        blockers.push('No pending Workflow transaction may exist.');
+    if (environment.corruptTransactionCount > 0)
+        blockers.push('No corrupt Workflow transaction may exist.');
+    if (environment.coreOperationCount > 0)
+        blockers.push('No Core Task operation may exist.');
+    for (const [surface, version] of Object.entries(environment.versions)) {
+        if (version !== PACKAGE_VERSION)
+            blockers.push(`${surface} Workflow version must equal ${PACKAGE_VERSION}.`);
+    }
+    try {
+        parent = runGit(repositoryRoot, ['rev-parse', 'HEAD^']);
+        const output = runGit(repositoryRoot, ['diff-tree', '--no-commit-id', '--name-only', '-r', 'HEAD']);
+        commitFiles = output ? output.split('\n').sort() : [];
+        if (JSON.stringify(commitFiles) !== JSON.stringify(RECOVERY_FILES)) {
+            blockers.push('The candidate commit must change exactly package.json and package-lock.json.');
+        }
+        if (task.systemCommits.includes(head))
+            blockers.push('The candidate commit is already registered.');
+        if (task.baseCommit) {
+            const outputHistory = runGit(repositoryRoot, ['rev-list', '--reverse', `${task.baseCommit}..HEAD`]);
+            const history = outputHistory ? outputHistory.split('\n') : [];
+            const actualBeforeHead = history.slice(0, -1);
+            const expectedBeforeHead = [
+                ...task.steps.flatMap((step) => (step.evidence ? [step.evidence.commitSha] : [])),
+                ...task.systemCommits,
+                ...environment.verifiedHistoricalStepCommits.filter((commit) => actualBeforeHead.includes(commit)),
+            ];
+            retainedHistoricalCommits = environment.verifiedHistoricalStepCommits.filter((commit) => actualBeforeHead.includes(commit)
+                && !task.systemCommits.includes(commit)
+                && !task.steps.some((step) => step.evidence?.commitSha === commit));
+            if (history.at(-1) !== head || !sameCommitSet(actualBeforeHead, [...new Set(expectedBeforeHead)])) {
+                blockers.push('HEAD must be the only unregistered commit after the exact recorded Task history.');
+            }
+            if (parent !== (actualBeforeHead.at(-1) ?? task.baseCommit)) {
+                blockers.push('The candidate parent does not match the recorded Task history boundary.');
+            }
+        }
+        if (!dependencyJsonDiffIsBounded(repositoryRoot, parent, task.baseBranch)) {
+            blockers.push(`The candidate commit contains changes beyond the exact ${PACKAGE_NAME}@${PACKAGE_VERSION} dependency update.`);
+        }
+    }
+    catch {
+        blockers.push('The candidate dependency commit could not be inspected.');
+    }
+    return {
+        eligible: blockers.length === 0,
+        action: blockers.length === 0 ? 'update dependency-provenance-recover' : null,
+        projectId: task.projectId,
+        taskId: task.id,
+        taskRevision: task.revision,
+        commitSha: blockers.length === 0 ? head : null,
+        parentCommitSha: blockers.length === 0 ? parent : null,
+        packageVersion: PACKAGE_VERSION,
+        changedFiles: commitFiles,
+        retainedHistoricalCommits,
+        blockers,
+    };
+}
+function sameCommitSet(actual, expected) {
+    return actual.length === expected.length
+        && actual.every((commit) => expected.includes(commit))
+        && expected.every((commit) => actual.includes(commit));
+}
+function dependencyJsonDiffIsBounded(repositoryRoot, parent, baseBranch) {
+    if (!parent)
+        return false;
+    const beforeManifestContent = runGit(repositoryRoot, ['show', `${parent}:package.json`]);
+    const afterManifestContent = runGit(repositoryRoot, ['show', 'HEAD:package.json']);
+    const beforeLockContent = runGit(repositoryRoot, ['show', `${parent}:package-lock.json`]);
+    const afterLockContent = runGit(repositoryRoot, ['show', 'HEAD:package-lock.json']);
+    if (afterManifestContent !== runGit(repositoryRoot, ['show', `${baseBranch}:package.json`])
+        || afterLockContent !== runGit(repositoryRoot, ['show', `${baseBranch}:package-lock.json`]))
+        return false;
+    const beforeManifest = parseJson(beforeManifestContent);
+    const afterManifest = parseJson(afterManifestContent);
+    const beforeLock = parseJson(beforeLockContent);
+    const afterLock = parseJson(afterLockContent);
+    if (!beforeManifest || !afterManifest || !beforeLock || !afterLock)
+        return false;
+    const beforeManifestDependencies = manifestDependencyValues(beforeManifest);
+    if (!targetsExactDevDependency(afterManifest, PACKAGE_VERSION))
+        return false;
+    if (beforeManifestDependencies.length !== 1 || beforeManifestDependencies[0] === PACKAGE_VERSION)
+        return false;
+    if (!lockTargetsExactVersion(afterLock, PACKAGE_VERSION))
+        return false;
+    if (lockTargetsExactVersion(beforeLock, PACKAGE_VERSION))
+        return false;
+    return JSON.stringify(stripManifestDependency(beforeManifest)) === JSON.stringify(stripManifestDependency(afterManifest))
+        && JSON.stringify(stripLockDependency(beforeLock)) === JSON.stringify(stripLockDependency(afterLock));
+}
+function parseJson(content) {
+    try {
+        const value = JSON.parse(content);
+        return value && typeof value === 'object' && !Array.isArray(value) ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+function manifestDependencyValues(manifest) {
+    const values = [];
+    for (const key of ['devDependencies', 'dependencies']) {
+        const group = record(manifest[key]);
+        if (typeof group?.[PACKAGE_NAME] === 'string')
+            values.push(group[PACKAGE_NAME]);
+    }
+    return values;
+}
+function lockTargetsExactVersion(lock, version) {
+    const packages = record(lock.packages);
+    const entry = record(packages?.[`node_modules/${PACKAGE_NAME}`]);
+    const root = record(packages?.['']);
+    if (entry?.version !== version || !targetsExactDevDependency(root ?? {}, version))
+        return false;
+    const dependencies = record(lock.dependencies);
+    const legacyEntry = record(dependencies?.[PACKAGE_NAME]);
+    return !legacyEntry || legacyEntry.version === version;
+}
+function targetsExactDevDependency(manifest, version) {
+    const devDependencies = record(manifest.devDependencies);
+    const dependencies = record(manifest.dependencies);
+    return devDependencies?.[PACKAGE_NAME] === version && dependencies?.[PACKAGE_NAME] === undefined;
+}
+function stripManifestDependency(source) {
+    const clone = structuredClone(source);
+    for (const key of ['devDependencies', 'dependencies']) {
+        const group = record(clone[key]);
+        if (group)
+            delete group[PACKAGE_NAME];
+    }
+    return clone;
+}
+function stripLockDependency(source) {
+    const clone = structuredClone(source);
+    const packages = record(clone.packages);
+    if (packages) {
+        delete packages[`node_modules/${PACKAGE_NAME}`];
+        const root = record(packages['']);
+        if (root) {
+            for (const key of ['devDependencies', 'dependencies']) {
+                const group = record(root[key]);
+                if (group)
+                    delete group[PACKAGE_NAME];
+            }
+        }
+    }
+    const dependencies = record(clone.dependencies);
+    if (dependencies)
+        delete dependencies[PACKAGE_NAME];
+    return clone;
+}
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : null;
+}
+//# sourceMappingURL=dependency-provenance.js.map

package/dist/src/dependency-provenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependency-provenance.js","sourceRoot":"","sources":["../../src/dependency-provenance.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAmBlF,MAAM,cAAc,GAAG,CAAC,mBAAmB,EAAE,cAAc,CAAU,CAAC;AACtE,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAsB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;AAErF,MAAM,UAAU,mCAAmC,CACjD,cAAsB,EACtB,IAAe,EACf,WAAgC;IAEhC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,YAAY,CAAC,cAAc,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC;IACxC,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,WAAW,GAAa,EAAE,CAAC;IAC/B,IAAI,yBAAyB,GAAa,EAAE,CAAC;IAE7C,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;IAC1E,IAAI,IAAI,CAAC,cAAc,KAAK,OAAO;QAAE,QAAQ,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;IACrG,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,aAAa,CAAC,cAAc,CAAC,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;QAC1E,QAAQ,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,UAAU;QAAE,QAAQ,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;IAClF,IAAI,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;IACnH,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,aAAa,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC3G,IAAI,WAAW,CAAC,gBAAgB,GAAG,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;IACzF,IAAI,WAAW,CAAC,eAAe,GAAG,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;IACvF,IAAI,WAAW,CAAC,uBAAuB,GAAG,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;IACzG,IAAI,WAAW,CAAC,uBAAuB,GAAG,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;IACzG,IAAI,WAAW,CAAC,kBAAkB,GAAG,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;IAE3F,KAAK,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtE,IAAI,OAAO,KAAK,eAAe;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,gCAAgC,eAAe,GAAG,CAAC,CAAC;IAC/G,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC,WAAW,EAAE,gBAAgB,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACpG,WAAW,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,IAAI,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,CAAC;YACnE,QAAQ,CAAC,IAAI,CAAC,8EAA8E,CAAC,CAAC;QAChG,CAAC;QACD,IAAI,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;QACpG,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,MAAM,aAAa,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,UAAU,QAAQ,CAAC,CAAC,CAAC;YACpG,MAAM,OAAO,GAAG,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9C,MAAM,kBAAkB,GAAG;gBACzB,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACjF,GAAG,IAAI,CAAC,aAAa;gBACrB,GAAG,WAAW,CAAC,6BAA6B,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;aACnG,CAAC;YACF,yBAAyB,GAAG,WAAW,CAAC,6BAA6B,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CACtF,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC;mBAC9B,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC;mBACpC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,KAAK,MAAM,CAAC,CACnE,CAAC;YACF,IAAI,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,aAAa,CAAC,gBAAgB,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClG,QAAQ,CAAC,IAAI,CAAC,kFAAkF,CAAC,CAAC;YACpG,CAAC;YACD,IAAI,MAAM,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC5D,QAAQ,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC;YAC3F,CAAC;QACH,CAAC;QACD,IAAI,CAAC,2BAA2B,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1E,QAAQ,CAAC,IAAI,CAAC,0DAA0D,YAAY,IAAI,eAAe,qBAAqB,CAAC,CAAC;QAChI,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;QAC/B,MAAM,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC,IAAI;QAC7E,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,YAAY,EAAE,IAAI,CAAC,QAAQ;QAC3B,SAAS,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;QAC9C,eAAe,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;QACtD,cAAc,EAAE,eAAe;QAC/B,YAAY,EAAE,WAAW;QACzB,yBAAyB;QACzB,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,MAAgB,EAAE,QAAkB;IACzD,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;WACnC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;WACnD,QAAQ,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,2BAA2B,CAAC,cAAsB,EAAE,MAAqB,EAAE,UAAkB;IACpG,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,qBAAqB,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,CAAC,CAAC;IACzF,MAAM,oBAAoB,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACnF,MAAM,iBAAiB,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,oBAAoB,CAAC,CAAC,CAAC;IAC1F,MAAM,gBAAgB,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC,CAAC;IACpF,IAAI,oBAAoB,KAAK,MAAM,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,GAAG,UAAU,eAAe,CAAC,CAAC;WACtF,gBAAgB,KAAK,MAAM,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,GAAG,UAAU,oBAAoB,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5G,MAAM,cAAc,GAAG,SAAS,CAAC,qBAAqB,CAAC,CAAC;IACxD,MAAM,aAAa,GAAG,SAAS,CAAC,oBAAoB,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,SAAS,CAAC,iBAAiB,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAC9C,IAAI,CAAC,cAAc,IAAI,CAAC,aAAa,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IACjF,MAAM,0BAA0B,GAAG,wBAAwB,CAAC,cAAc,CAAC,CAAC;IAC5E,IAAI,CAAC,yBAAyB,CAAC,aAAa,EAAE,eAAe,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7E,IAAI,0BAA0B,CAAC,MAAM,KAAK,CAAC,IAAI,0BAA0B,CAAC,CAAC,CAAC,KAAK,eAAe;QAAE,OAAO,KAAK,CAAC;IAC/G,IAAI,CAAC,uBAAuB,CAAC,SAAS,EAAE,eAAe,CAAC;QAAE,OAAO,KAAK,CAAC;IACvE,IAAI,uBAAuB,CAAC,UAAU,EAAE,eAAe,CAAC;QAAE,OAAO,KAAK,CAAC;IACvE,OAAO,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC,cAAc,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC,aAAa,CAAC,CAAC;WACpH,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC;AAC1G,CAAC;AAED,SAAS,SAAS,CAAC,OAAe;IAChC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAY,CAAC;QAC7C,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAgC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/G,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,QAAiC;IACjE,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,GAAG,IAAI,CAAC,iBAAiB,EAAE,cAAc,CAAC,EAAE,CAAC;QACtD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QACpC,IAAI,OAAO,KAAK,EAAE,CAAC,YAAY,CAAC,KAAK,QAAQ;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAW,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,uBAAuB,CAAC,IAA6B,EAAE,OAAe;IAC7E,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,gBAAgB,YAAY,EAAE,CAAC,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACpC,IAAI,KAAK,EAAE,OAAO,KAAK,OAAO,IAAI,CAAC,yBAAyB,CAAC,IAAI,IAAI,EAAE,EAAE,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAChG,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;IACzD,OAAO,CAAC,WAAW,IAAI,WAAW,CAAC,OAAO,KAAK,OAAO,CAAC;AACzD,CAAC;AAED,SAAS,yBAAyB,CAAC,QAAiC,EAAE,OAAe;IACnF,MAAM,eAAe,GAAG,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IACzD,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IACnD,OAAO,eAAe,EAAE,CAAC,YAAY,CAAC,KAAK,OAAO,IAAI,YAAY,EAAE,CAAC,YAAY,CAAC,KAAK,SAAS,CAAC;AACnG,CAAC;AAED,SAAS,uBAAuB,CAAC,MAA+B;IAC9D,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACtC,KAAK,MAAM,GAAG,IAAI,CAAC,iBAAiB,EAAE,cAAc,CAAC,EAAE,CAAC;QACtD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACjC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC,YAAY,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,mBAAmB,CAAC,MAA+B;IAC1D,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC,gBAAgB,YAAY,EAAE,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QAClC,IAAI,IAAI,EAAE,CAAC;YACT,KAAK,MAAM,GAAG,IAAI,CAAC,iBAAiB,EAAE,cAAc,CAAC,EAAE,CAAC;gBACtD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;gBAChC,IAAI,KAAK;oBAAE,OAAO,KAAK,CAAC,YAAY,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAChD,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC,YAAY,CAAC,CAAC;IACpD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAgC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/G,CAAC"}

package/dist/src/errors.d.ts

@@ -1,4 +1,4 @@
-export type WorkflowErrorCode = 'INVALID_ARGUMENT' | 'NOT_FOUND' | 'STATE_CONFLICT' | 'STATE_CORRUPT' | 'LOCKED' | 'LOCK_TOKEN_INVALID' | 'TRANSITION_BLOCKED' | 'GIT_PRECONDITION_FAILED' | 'COMMAND_FAILED';
+export type WorkflowErrorCode = 'INVALID_ARGUMENT' | 'NOT_FOUND' | 'STATE_CONFLICT' | 'STATE_CORRUPT' | 'LOCKED' | 'LOCK_TOKEN_INVALID' | 'TASK_RECOVERY_REQUIRED' | 'TRANSITION_BLOCKED' | 'GIT_PRECONDITION_FAILED' | 'COMMAND_FAILED';
 export declare class WorkflowError extends Error {
     readonly code: WorkflowErrorCode;
     readonly details: Record<string, unknown>;

package/dist/src/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/errors.ts"],"names":[],"mappings":"AAWA,MAAM,OAAO,aAAc,SAAQ,KAAK;IAC7B,IAAI,CAAoB;IACxB,OAAO,CAA0B;IAE1C,YAAY,IAAuB,EAAE,OAAe,EAAE,UAAmC,EAAE;QACzF,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/errors.ts"],"names":[],"mappings":"AAYA,MAAM,OAAO,aAAc,SAAQ,KAAK;IAC7B,IAAI,CAAoB;IACxB,OAAO,CAA0B;IAE1C,YAAY,IAAuB,EAAE,OAAe,EAAE,UAAmC,EAAE;QACzF,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF"}

package/dist/src/git.d.ts

@@ -1,5 +1,5 @@
 import type { TaskState } from './contracts.js';
-export declare function startLocalTaskBranch(repositoryRoot: string, branch: string, baseBranch: string): string;
+export declare function startLocalTaskBranch(repositoryRoot: string, branch: string, baseBranch: string, expectedBaseCommit?: string | null): string;
 export interface CheckResult {
     command: string;
     passed: boolean;

package/dist/src/git.js

@@ -3,7 +3,7 @@ import { WorkflowError } from './errors.js';
 import { changedFiles, currentBranch, headCommit, isClean, runGit } from './repository.js';
 import { pathAllowed } from './domain/validation.js';
 const PROTECTED_BRANCHES = new Set(['main', 'master', 'develop', 'staging', 'production']);
-export function startLocalTaskBranch(repositoryRoot, branch, baseBranch) {
+export function startLocalTaskBranch(repositoryRoot, branch, baseBranch, expectedBaseCommit = null) {
     if (!isClean(repositoryRoot)) {
         throw new WorkflowError('GIT_PRECONDITION_FAILED', 'Task start requires a clean checkout.', {
             changedFiles: changedFiles(repositoryRoot),
@@ -13,6 +13,13 @@ export function startLocalTaskBranch(repositoryRoot, branch, baseBranch) {
         throw new WorkflowError('GIT_PRECONDITION_FAILED', `Task branch is protected: ${branch}`);
     }
     const baseCommit = runGit(repositoryRoot, ['rev-parse', baseBranch]);
+    if (expectedBaseCommit !== null && baseCommit !== expectedBaseCommit) {
+        throw new WorkflowError('GIT_PRECONDITION_FAILED', 'Task start base moved after execution authorization.', {
+            baseBranch,
+            authorizedBaseCommit: expectedBaseCommit,
+            currentBaseCommit: baseCommit,
+        });
+    }
     runGit(repositoryRoot, ['switch', '-c', branch, baseBranch]);
     return baseCommit;
 }
@@ -94,10 +101,11 @@ export function validateTaskHistory(repositoryRoot, task) {
         throw new WorkflowError('STATE_CORRUPT', `Task ${task.id} has no base commit.`);
     const actualOutput = runGit(repositoryRoot, ['rev-list', '--reverse', `${task.baseCommit}..HEAD`]);
     const actual = actualOutput ? actualOutput.split('\n') : [];
-    const expected = [
-        ...task.steps.flatMap((step) => (step.evidence ? [step.evidence.commitSha] : [])),
-        ...task.systemCommits,
-    ];
+    const expected = [...new Set([
+            ...task.steps.flatMap((step) => (step.evidence ? [step.evidence.commitSha] : [])),
+            ...task.systemCommits,
+            ...(task.dependencyProvenanceRecoveries ?? []).flatMap((recovery) => recovery.retainedHistoricalCommits ?? []),
+        ])];
     const missing = expected.filter((commit) => !actual.includes(commit));
     const unexpected = actual.filter((commit) => !expected.includes(commit));
     if (missing.length > 0 || unexpected.length > 0 || actual.length !== expected.length) {

package/dist/src/git.js.map

@@ -1 +1 @@
-{"version":3,"file":"git.js","sourceRoot":"","sources":["../../src/git.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC3F,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAGrD,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;AAE3F,MAAM,UAAU,oBAAoB,CAAC,cAAsB,EAAE,MAAc,EAAE,UAAkB;IAC7F,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,aAAa,CAAC,yBAAyB,EAAE,uCAAuC,EAAE;YAC1F,YAAY,EAAE,YAAY,CAAC,cAAc,CAAC;SAC3C,CAAC,CAAC;IACL,CAAC;IACD,IAAI,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,aAAa,CAAC,yBAAyB,EAAE,6BAA6B,MAAM,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;IACrE,MAAM,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IAC7D,OAAO,UAAU,CAAC;AACpB,CAAC;AASD,MAAM,UAAU,SAAS,CAAC,cAAsB,EAAE,QAAkB;IAClE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9B,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE;YACpD,GAAG,EAAE,cAAc;YACnB,QAAQ,EAAE,MAAM;YAChB,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC;QACxE,OAAO;YACL,OAAO;YACP,MAAM,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;YAC3B,QAAQ,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC;YAC5B,MAAM;SACP,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,cAAsB,EACtB,MAAc,EACd,MAAc,EACd,KAAa,EACb,aAAuB;IAEvB,MAAM,KAAK,GAAG,YAAY,CAAC,cAAc,CAAC,CAAC;IAC3C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,oBAAoB,EAAE,GAAG,MAAM,wBAAwB,CAAC,CAAC;IACzG,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;IAC7E,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,aAAa,CAAC,oBAAoB,EAAE,GAAG,MAAM,uCAAuC,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;IAClH,CAAC;IACD,MAAM,CAAC,cAAc,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC;IAChD,MAAM,CAAC,cAAc,EAAE;QACrB,QAAQ;QACR,IAAI;QACJ,GAAG,MAAM,IAAI,MAAM,KAAK,KAAK,EAAE;QAC/B,IAAI;QACJ,SAAS,MAAM,WAAW,MAAM,EAAE;KACnC,CAAC,CAAC;IACH,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,cAAsB,EAAE,UAAkB,EAAE,UAAkB;IAC5F,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,yBAAyB,EAAE,kCAAkC,CAAC,CAAC;IACrH,IAAI,aAAa,CAAC,cAAc,CAAC,KAAK,UAAU,EAAE,CAAC;QACjD,MAAM,IAAI,aAAa,CAAC,yBAAyB,EAAE,gCAAgC,UAAU,GAAG,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,UAAU,cAAc,CAAC,EAAE;QACzH,QAAQ,EAAE,MAAM;KACjB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACnF,MAAM,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;QAC/C,MAAM,IAAI,aAAa,CAAC,yBAAyB,EAAE,gCAAgC,UAAU,GAAG,EAAE;YAChG,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;YAC5B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;SAC7B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,UAAU,CAAC,cAAc,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,cAAsB,EACtB,UAAkB,EAClB,UAAkB;IAElB,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,yBAAyB,EAAE,sCAAsC,CAAC,CAAC;IACzH,IAAI,aAAa,CAAC,cAAc,CAAC,KAAK,UAAU,EAAE,CAAC;QACjD,MAAM,IAAI,aAAa,CAAC,yBAAyB,EAAE,gCAAgC,UAAU,GAAG,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAChH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACnF,MAAM,IAAI,aAAa,CAAC,yBAAyB,EAAE,2BAA2B,UAAU,GAAG,EAAE;YAC3F,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;YAC5B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;SAC7B,CAAC,CAAC;IACL,CAAC;IACD,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAC7D,UAAU,EAAE,UAAU,CAAC,cAAc,CAAC;KACvC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,cAAsB,EAAE,IAAe;IACzE,IAAI,CAAC,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,QAAQ,IAAI,CAAC,EAAE,sBAAsB,CAAC,CAAC;IACtG,MAAM,YAAY,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,UAAU,QAAQ,CAAC,CAAC,CAAC;IACnG,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,MAAM,QAAQ,GAAG;QACf,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACjF,GAAG,IAAI,CAAC,aAAa;KACtB,CAAC;IACF,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACtE,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACzE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrF,MAAM,IAAI,aAAa,CACrB,yBAAyB,EACzB,iQAAiQ,EACjQ;YACE,OAAO;YACP,UAAU;YACV,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,UAAU,EAAE,UAAU,CAAC,cAAc,CAAC;YACtC,QAAQ,EAAE,mGAAmG;SAC9G,CACF,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"git.js","sourceRoot":"","sources":["../../src/git.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC3F,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAGrD,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;AAE3F,MAAM,UAAU,oBAAoB,CAClC,cAAsB,EACtB,MAAc,EACd,UAAkB,EAClB,qBAAoC,IAAI;IAExC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,aAAa,CAAC,yBAAyB,EAAE,uCAAuC,EAAE;YAC1F,YAAY,EAAE,YAAY,CAAC,cAAc,CAAC;SAC3C,CAAC,CAAC;IACL,CAAC;IACD,IAAI,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,aAAa,CAAC,yBAAyB,EAAE,6BAA6B,MAAM,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;IACrE,IAAI,kBAAkB,KAAK,IAAI,IAAI,UAAU,KAAK,kBAAkB,EAAE,CAAC;QACrE,MAAM,IAAI,aAAa,CAAC,yBAAyB,EAAE,sDAAsD,EAAE;YACzG,UAAU;YACV,oBAAoB,EAAE,kBAAkB;YACxC,iBAAiB,EAAE,UAAU;SAC9B,CAAC,CAAC;IACL,CAAC;IACD,MAAM,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IAC7D,OAAO,UAAU,CAAC;AACpB,CAAC;AASD,MAAM,UAAU,SAAS,CAAC,cAAsB,EAAE,QAAkB;IAClE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9B,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE;YACpD,GAAG,EAAE,cAAc;YACnB,QAAQ,EAAE,MAAM;YAChB,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC;QACxE,OAAO;YACL,OAAO;YACP,MAAM,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;YAC3B,QAAQ,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC;YAC5B,MAAM;SACP,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,cAAsB,EACtB,MAAc,EACd,MAAc,EACd,KAAa,EACb,aAAuB;IAEvB,MAAM,KAAK,GAAG,YAAY,CAAC,cAAc,CAAC,CAAC;IAC3C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,oBAAoB,EAAE,GAAG,MAAM,wBAAwB,CAAC,CAAC;IACzG,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;IAC7E,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,aAAa,CAAC,oBAAoB,EAAE,GAAG,MAAM,uCAAuC,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;IAClH,CAAC;IACD,MAAM,CAAC,cAAc,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC;IAChD,MAAM,CAAC,cAAc,EAAE;QACrB,QAAQ;QACR,IAAI;QACJ,GAAG,MAAM,IAAI,MAAM,KAAK,KAAK,EAAE;QAC/B,IAAI;QACJ,SAAS,MAAM,WAAW,MAAM,EAAE;KACnC,CAAC,CAAC;IACH,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,cAAsB,EAAE,UAAkB,EAAE,UAAkB;IAC5F,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,yBAAyB,EAAE,kCAAkC,CAAC,CAAC;IACrH,IAAI,aAAa,CAAC,cAAc,CAAC,KAAK,UAAU,EAAE,CAAC;QACjD,MAAM,IAAI,aAAa,CAAC,yBAAyB,EAAE,gCAAgC,UAAU,GAAG,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,UAAU,cAAc,CAAC,EAAE;QACzH,QAAQ,EAAE,MAAM;KACjB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACnF,MAAM,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;QAC/C,MAAM,IAAI,aAAa,CAAC,yBAAyB,EAAE,gCAAgC,UAAU,GAAG,EAAE;YAChG,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;YAC5B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;SAC7B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,UAAU,CAAC,cAAc,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,cAAsB,EACtB,UAAkB,EAClB,UAAkB;IAElB,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,yBAAyB,EAAE,sCAAsC,CAAC,CAAC;IACzH,IAAI,aAAa,CAAC,cAAc,CAAC,KAAK,UAAU,EAAE,CAAC;QACjD,MAAM,IAAI,aAAa,CAAC,yBAAyB,EAAE,gCAAgC,UAAU,GAAG,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAChH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACnF,MAAM,IAAI,aAAa,CAAC,yBAAyB,EAAE,2BAA2B,UAAU,GAAG,EAAE;YAC3F,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;YAC5B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;SAC7B,CAAC,CAAC;IACL,CAAC;IACD,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAC7D,UAAU,EAAE,UAAU,CAAC,cAAc,CAAC;KACvC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,cAAsB,EAAE,IAAe;IACzE,IAAI,CAAC,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,QAAQ,IAAI,CAAC,EAAE,sBAAsB,CAAC,CAAC;IACtG,MAAM,YAAY,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,UAAU,QAAQ,CAAC,CAAC,CAAC;IACnG,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;YAC3B,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACjF,GAAG,IAAI,CAAC,aAAa;YACrB,GAAG,CAAC,IAAI,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,yBAAyB,IAAI,EAAE,CAAC;SAC/G,CAAC,CAAC,CAAC;IACJ,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACtE,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACzE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrF,MAAM,IAAI,aAAa,CACrB,yBAAyB,EACzB,iQAAiQ,EACjQ;YACE,OAAO;YACP,UAAU;YACV,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,UAAU,EAAE,UAAU,CAAC,cAAc,CAAC;YACtC,QAAQ,EAAE,mGAAmG;SAC9G,CACF,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/src/index.d.ts

@@ -7,11 +7,12 @@ export * from './memory.js';
 export * from './migration.js';
 export * from './repository.js';
 export * from './reviewer.js';
-export * from './state/lock.js';
 export * from './state/store.js';
 export * from './workflow.js';
 export * from './version.js';
+export * from './lifecycle/index.js';
 export * from './alpha7/autonomy.js';
+export * from './alpha6/mechanical-feasibility.js';
 export { defaultTaskWorkerActor } from './alpha6/handoff.js';
 export { defaultCorrectiveAuditorActor } from './alpha6/remediation.js';
 export type { AdoptionPreparation } from './alpha6/adoption.js';

package/dist/src/index.js

@@ -7,11 +7,12 @@ export * from './memory.js';
 export * from './migration.js';
 export * from './repository.js';
 export * from './reviewer.js';
-export * from './state/lock.js';
 export * from './state/store.js';
 export * from './workflow.js';
 export * from './version.js';
+export * from './lifecycle/index.js';
 export * from './alpha7/autonomy.js';
+export * from './alpha6/mechanical-feasibility.js';
 export { defaultTaskWorkerActor } from './alpha6/handoff.js';
 export { defaultCorrectiveAuditorActor } from './alpha6/remediation.js';
 //# sourceMappingURL=index.js.map

package/dist/src/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,sBAAsB,CAAC;AACrC,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,6BAA6B,EAAE,MAAM,yBAAyB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oCAAoC,CAAC;AACnD,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,6BAA6B,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/src/lifecycle/canonical-hash.d.ts

@@ -0,0 +1,6 @@
+type JsonPrimitive = boolean | null | number | string;
+export type CanonicalJsonValue = JsonPrimitive | CanonicalJsonValue[] | {
+    [key: string]: CanonicalJsonValue;
+};
+export declare function hashCanonical(value: unknown): string;
+export {};

package/dist/src/lifecycle/canonical-hash.js

@@ -0,0 +1,24 @@
+import { createHash } from 'node:crypto';
+const EDITORIAL_KEYS = new Set(['description']);
+export function hashCanonical(value) {
+    return createHash('sha256').update(JSON.stringify(canonicalize(value))).digest('hex');
+}
+function canonicalize(value) {
+    if (value === null || typeof value === 'boolean' || typeof value === 'string')
+        return value;
+    if (typeof value === 'number') {
+        if (!Number.isFinite(value))
+            throw new TypeError('Canonical hashes do not support non-finite numbers.');
+        return value;
+    }
+    if (Array.isArray(value))
+        return value.map((entry) => canonicalize(entry));
+    if (typeof value === 'object') {
+        return Object.fromEntries(Object.entries(value)
+            .filter(([key, entry]) => entry !== undefined && !EDITORIAL_KEYS.has(key))
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([key, entry]) => [key, canonicalize(entry)]));
+    }
+    throw new TypeError(`Unsupported canonical hash value: ${typeof value}`);
+}
+//# sourceMappingURL=canonical-hash.js.map

package/dist/src/lifecycle/canonical-hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-hash.js","sourceRoot":"","sources":["../../../src/lifecycle/canonical-hash.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAKzC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;AAEhD,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxF,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5F,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,qDAAqD,CAAC,CAAC;QACxG,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3E,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;aAClB,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;aACzE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;aACpD,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CACrD,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,SAAS,CAAC,qCAAqC,OAAO,KAAK,EAAE,CAAC,CAAC;AAC3E,CAAC"}

package/dist/src/lifecycle/catalog.d.ts

@@ -0,0 +1,26 @@
+import { type ExecutableTransitionDefinition, type SerializedTransitionDefinition, type TransitionDefinitionMetadata, type TransitionId } from './types.js';
+type AnyDefinition = ExecutableTransitionDefinition<unknown, unknown>;
+type DefinitionLike = AnyDefinition | SerializedTransitionDefinition | TransitionDefinitionMetadata;
+export type TransitionSemanticValidationRuleId = 'validation.atomicity.contract-invalid' | 'validation.definition.format-invalid' | 'validation.definition.manifest-mismatch' | 'validation.effect.graph-invalid' | 'validation.fingerprint.alias-mismatch' | 'validation.fingerprint.runtime-mismatch' | 'validation.guard.evaluator-mismatch' | 'validation.guard.namespace-invalid' | 'validation.namespace.transition-invalid' | 'validation.race.revalidation-invalid' | 'validation.reference.unresolved' | 'validation.semantic-id.duplicate';
+export interface TransitionSemanticValidationIssue {
+    readonly ruleId: TransitionSemanticValidationRuleId;
+    readonly path: string;
+    readonly ref?: string;
+    readonly message: string;
+}
+export interface TransitionSemanticValidationReport {
+    readonly valid: boolean;
+    readonly issues: readonly TransitionSemanticValidationIssue[];
+    readonly reportHash: string;
+}
+export declare class GuardedTransitionCatalog {
+    #private;
+    readonly catalogHash: string;
+    readonly catalogDefinitionManifestHash: string;
+    constructor(definitions: readonly AnyDefinition[]);
+    has(id: TransitionId): boolean;
+    get<TSnapshot, TBindings>(id: TransitionId): ExecutableTransitionDefinition<TSnapshot, TBindings>;
+    serialize(): SerializedTransitionDefinition[];
+}
+export declare function validateTransitionDefinitionSemantics(definition: DefinitionLike): TransitionSemanticValidationReport;
+export {};

package/dist/src/lifecycle/catalog.js

@@ -0,0 +1,208 @@
+import { catalogDefinitionManifestHash, hashCanonical, runtimeCatalogHash, runtimeSemanticFingerprint, transitionDefinitionManifestHash, } from './fingerprint.js';
+import { transitionSemanticRegistry } from './semantic-registry.js';
+import { TRANSITION_DEFINITION_FORMAT_VERSION, } from './types.js';
+export class GuardedTransitionCatalog {
+    #definitions;
+    catalogHash;
+    catalogDefinitionManifestHash;
+    constructor(definitions) {
+        const indexed = new Map();
+        for (const definition of definitions) {
+            const id = definition.metadata.transitionId;
+            if (indexed.has(id))
+                throw new TypeError(`validation.semantic-id.duplicate ${id}`);
+            const semantic = validateTransitionDefinitionSemantics(definition);
+            if (!semantic.valid)
+                throw new TypeError(`${semantic.issues[0].ruleId} ${id}: ${semantic.issues[0].message}`);
+            if (definition.guards.length !== definition.metadata.guards.length
+                || definition.guards.some((guard, index) => guard.metadata.guardId !== definition.metadata.guards[index]?.guardId)) {
+                throw new TypeError(`validation.guard.evaluator-mismatch ${id}`);
+            }
+            indexed.set(id, definition);
+        }
+        this.#definitions = indexed;
+        this.catalogHash = runtimeCatalogHash(this.serialize());
+        this.catalogDefinitionManifestHash = catalogDefinitionManifestHash(this.serialize());
+    }
+    has(id) { return this.#definitions.has(id); }
+    get(id) {
+        const definition = this.#definitions.get(id);
+        if (!definition)
+            throw new TypeError(`Unknown transition definition: ${id}`);
+        return definition;
+    }
+    serialize() {
+        return structuredClone([...this.#definitions.values()].map((definition) => ({
+            ...definition.metadata,
+            runtimeSemanticFingerprint: definition.runtimeSemanticFingerprint,
+            semanticFingerprint: definition.semanticFingerprint,
+            definitionManifestHash: definition.definitionManifestHash,
+        })).sort((left, right) => left.transitionId.localeCompare(right.transitionId)));
+    }
+}
+export function validateTransitionDefinitionSemantics(definition) {
+    const issues = [];
+    let unpacked;
+    try {
+        unpacked = unpack(definition);
+    }
+    catch (error) {
+        issue(issues, 'validation.reference.unresolved', '/', message(error));
+        return report(issues);
+    }
+    const metadata = unpacked.metadata;
+    if (metadata.definitionFormatVersion !== TRANSITION_DEFINITION_FORMAT_VERSION)
+        issue(issues, 'validation.definition.format-invalid', '/definitionFormatVersion', 'Definition format must be 4.');
+    const namespace = metadata.entity === 'step' ? 'task' : metadata.entity === 'project-memory' ? 'project' : metadata.entity;
+    if (!metadata.transitionId.startsWith(`${namespace}.`))
+        issue(issues, 'validation.namespace.transition-invalid', '/transitionId', 'Transition namespace does not match entity.', metadata.transitionId);
+    if (!metadata.guardNamespace.startsWith(`${namespace}.`))
+        issue(issues, 'validation.guard.namespace-invalid', '/guardNamespace', 'Guard namespace does not match entity.');
+    let runtime = '';
+    try {
+        runtime = runtimeSemanticFingerprint(metadata);
+    }
+    catch (error) {
+        issue(issues, 'validation.reference.unresolved', referencePath(error, metadata), message(error), referenceKey(error));
+    }
+    if (unpacked.runtime && runtime && unpacked.runtime !== runtime)
+        issue(issues, 'validation.fingerprint.runtime-mismatch', '/runtimeSemanticFingerprint', 'Runtime fingerprint is stale.');
+    if (unpacked.semantic && unpacked.semantic !== unpacked.runtime)
+        issue(issues, 'validation.fingerprint.alias-mismatch', '/semanticFingerprint', 'Deprecated alias is stale.');
+    try {
+        const manifest = transitionDefinitionManifestHash(metadata, runtime);
+        if (unpacked.manifest && unpacked.manifest !== manifest)
+            issue(issues, 'validation.definition.manifest-mismatch', '/definitionManifestHash', 'Definition manifest is stale.');
+    }
+    catch (error) {
+        issue(issues, 'validation.reference.unresolved', '/readinessManifest', message(error), referenceKey(error));
+    }
+    const inputRefs = new Set(metadata.inputContract.map((entry) => refKey(entry.input)));
+    unique(metadata.inputContract.map((entry) => refKey(entry.input)), '/inputContract', issues);
+    const guards = new Map();
+    metadata.guards.forEach((guard, index) => {
+        if (!guard.guardId.startsWith(`${metadata.guardNamespace}.`))
+            issue(issues, 'validation.guard.namespace-invalid', `/guards/${index}/guardId`, 'Guard is outside namespace.');
+        if (guards.has(guard.guardId))
+            issue(issues, 'validation.semantic-id.duplicate', `/guards/${index}/guardId`, 'Duplicate guard.', guard.guardId);
+        guards.set(guard.guardId, guard);
+        const evaluator = exactRef(transitionSemanticRegistry.guardEvaluators, guard.evaluator);
+        if (!evaluator)
+            issue(issues, 'validation.reference.unresolved', `/guards/${index}/evaluator`, 'Guard evaluator is unresolved.', refKey(guard.evaluator));
+        else if (evaluator.transitionId !== metadata.transitionId || evaluator.guardId !== guard.guardId)
+            issue(issues, 'validation.guard.evaluator-mismatch', `/guards/${index}/evaluator`, 'Evaluator does not bind this guard.', refKey(guard.evaluator));
+        guard.requiredInputs.forEach((input) => {
+            if (!inputRefs.has(refKey(input)))
+                issue(issues, 'validation.guard.evaluator-mismatch', `/guards/${index}/requiredInputs`, 'Guard input is outside contract.', refKey(input));
+        });
+    });
+    metadata.inputContract.forEach((entry, index) => {
+        if (entry.required && !metadata.guards.some((guard) => guard.requiredInputs.some((input) => refKey(input) === refKey(entry.input))))
+            issue(issues, 'validation.guard.evaluator-mismatch', `/inputContract/${index}`, 'Required input has no guard.', refKey(entry.input));
+    });
+    validateEffects(metadata, guards, inputRefs, issues);
+    validateRaces(metadata, guards, issues);
+    validateAtomicity(metadata, issues);
+    return report(issues);
+}
+function validateEffects(metadata, guards, inputs, issues) {
+    const nodes = metadata.effects.orderedNodes;
+    unique(nodes.map((node) => node.effectId), '/effects/orderedNodes', issues);
+    const byId = new Map(nodes.map((node) => [node.effectId, node]));
+    nodes.forEach((node, index) => {
+        if (node.ordinal !== index)
+            issue(issues, 'validation.effect.graph-invalid', `/effects/orderedNodes/${index}/ordinal`, 'Effect ordinals are not contiguous.');
+        node.dependsOn.forEach((dependency) => {
+            if (!byId.has(dependency) || dependency === node.effectId || depends(byId.get(dependency), node.effectId, byId))
+                issue(issues, 'validation.effect.graph-invalid', `/effects/orderedNodes/${index}/dependsOn`, 'Effect graph is cyclic or unresolved.', dependency);
+        });
+        node.conditions.forEach((condition, conditionIndex) => validateCondition(condition, `/effects/orderedNodes/${index}/conditions/${conditionIndex}`, guards, inputs, issues));
+    });
+    unique(metadata.effects.postconditions.map((entry) => entry.postconditionId), '/effects/postconditions', issues);
+    metadata.effects.postconditions.forEach((entry, index) => {
+        if (entry.effectNodeIds.length === 0 || entry.effectNodeIds.some((id) => !byId.has(id)))
+            issue(issues, 'validation.effect.graph-invalid', `/effects/postconditions/${index}/effectNodeIds`, 'Postcondition does not bind effects.');
+    });
+}
+function validateCondition(condition, path, guards, inputs, issues) {
+    if (condition.kind === 'input-present' ? !inputs.has(refKey(condition.input)) : !guards.has(condition.guardId))
+        issue(issues, 'validation.effect.graph-invalid', path, 'Effect condition is unresolved.');
+}
+function validateRaces(metadata, guards, issues) {
+    unique(metadata.admissionBoundary.orderedRevalidations.map((entry) => entry.revalidationId), '/admissionBoundary/orderedRevalidations', issues);
+    unique(metadata.racePreconditions.map((entry) => entry.raceId), '/racePreconditions', issues);
+    metadata.admissionBoundary.orderedRevalidations.forEach((entry, index) => {
+        const race = metadata.racePreconditions.filter((candidate) => candidate.raceId === entry.raceId && candidate.revalidationId === entry.revalidationId);
+        const guard = guards.get(entry.guardId);
+        if (entry.ordinal !== index || race.length !== 1 || race[0].guardId !== entry.guardId || !guard || refKey(guard.evaluator) !== refKey(entry.evaluator))
+            issue(issues, 'validation.race.revalidation-invalid', `/admissionBoundary/orderedRevalidations/${index}`, 'Race and revalidation are not exact.', entry.raceId);
+    });
+}
+function validateAtomicity(metadata, issues) {
+    const atomicity = metadata.atomicity;
+    const writes = metadata.effects.orderedNodes.filter((entry) => entry.operation !== 'preserve').length;
+    if (atomicity.classification === 'single-write' && writes !== 1)
+        issue(issues, 'validation.atomicity.contract-invalid', '/atomicity/classification', 'single-write requires exactly one write.');
+    if (atomicity.classification === 'read-only' && writes !== 0)
+        issue(issues, 'validation.atomicity.contract-invalid', '/atomicity/classification', 'read-only cannot write.');
+    if (atomicity.classification.includes('multi-write') && writes < 2)
+        issue(issues, 'validation.atomicity.contract-invalid', '/atomicity/classification', 'multi-write requires multiple writes.');
+    if (atomicity.classification === 'non-transactional-multi-write' && atomicity.journal.mode !== 'none')
+        issue(issues, 'validation.atomicity.contract-invalid', '/atomicity/journal', 'Nontransactional write cannot claim journal.');
+    const postconditions = new Set(metadata.effects.postconditions.map((entry) => entry.postconditionId));
+    if (atomicity.readback.postconditionIds.length !== postconditions.size || atomicity.readback.postconditionIds.some((id) => !postconditions.has(id)))
+        issue(issues, 'validation.atomicity.contract-invalid', '/atomicity/readback/postconditionIds', 'Readback does not cover postconditions.');
+}
+function unpack(definition) {
+    if ('metadata' in definition)
+        return { metadata: definition.metadata, runtime: definition.runtimeSemanticFingerprint, semantic: definition.semanticFingerprint, manifest: definition.definitionManifestHash };
+    if ('runtimeSemanticFingerprint' in definition) {
+        const { runtimeSemanticFingerprint: runtime, semanticFingerprint: semantic, definitionManifestHash: manifest, ...metadata } = definition;
+        return { metadata, runtime, semantic, manifest };
+    }
+    return { metadata: definition, runtime: null, semantic: null, manifest: null };
+}
+function exactRef(entries, ref) {
+    const matches = entries.filter((entry) => refKey(entry) === refKey(ref));
+    return matches.length === 1 ? matches[0] : undefined;
+}
+function referencePath(error, metadata) {
+    const key = referenceKey(error);
+    return key ? referencePaths(metadata).get(key) ?? '/' : '/';
+}
+function referencePaths(root) {
+    const result = new Map();
+    visit(root, '');
+    return result;
+    function visit(value, path) {
+        if (Array.isArray(value))
+            return value.forEach((entry, index) => visit(entry, `${path}/${index}`));
+        if (value === null || typeof value !== 'object')
+            return;
+        const candidate = value;
+        if (typeof candidate.id === 'string' && Number.isInteger(candidate.version))
+            result.set(`${candidate.id}@${candidate.version}`, path || '/');
+        Object.entries(candidate).forEach(([key, entry]) => visit(entry, `${path}/${key}`));
+    }
+}
+function referenceKey(error) { return error instanceof Error ? error.ref : undefined; }
+function refKey(ref) { return `${ref.id}@${ref.version}`; }
+function message(error) { return error instanceof Error ? error.message : String(error); }
+function unique(values, path, issues) {
+    if (new Set(values).size !== values.length)
+        issue(issues, 'validation.semantic-id.duplicate', path, 'Semantic IDs must be unique.');
+}
+function depends(node, target, nodes, seen = new Set()) {
+    if (!node)
+        return false;
+    return node.dependsOn.some((id) => id === target || (!seen.has(id) && (seen.add(id), depends(nodes.get(id), target, nodes, seen))));
+}
+function issue(issues, ruleId, path, message, ref) {
+    issues.push(ref === undefined ? { ruleId, path, message } : { ruleId, path, message, ref });
+}
+function report(issues) {
+    const ordered = [...issues].sort((left, right) => `${left.path}\0${left.ruleId}\0${left.ref ?? ''}`.localeCompare(`${right.path}\0${right.ruleId}\0${right.ref ?? ''}`));
+    const content = { valid: ordered.length === 0, issues: ordered };
+    return { ...content, reportHash: hashCanonical(content) };
+}
+//# sourceMappingURL=catalog.js.map