codex-workflow-v2 2.0.0-beta.12.3 → 2.0.0-beta.12.5

package/dist/src/workflow.js

@@ -10,7 +10,8 @@ import { pathAllowed, validatePlan } from './domain/validation.js';
 import { WorkflowError } from './errors.js';
 import { bindGraphEvidence, createGraphRefreshRequest, fallbackGraphBinding, inspectGraphBinding, validateGraphRequestCurrent, } from './graph.js';
 import { inspectLocalDependency, inspectWorkflowVersions } from './diagnostics.js';
-import { appendTaskClaim, appendTaskHandback, appendTaskHandoff, appendTaskWriterCredentialReplacement, assertTaskClaimAllowed, assertTaskMutationAllowedByC1, defaultTaskWorkerActor, readTaskC1Posture, } from './alpha6/handoff.js';
+import { appendTaskClaim, appendTaskHandback, appendTaskHandoff, appendTaskWriterCredentialReplacement, assertTaskClaimAllowed, assertTaskMutationAllowedByC1, defaultTaskWorkerActor, prepareTaskCorrectiveYield, readTaskC1Posture, } from './alpha6/handoff.js';
+import { assessDownstreamProofRecovery, downstreamProofInvalidationSidecar, prepareDownstreamProofInvalidation, readDownstreamProofInvalidations, } from './alpha6/downstream-proof.js';
 import { applyAdoptionPosture, assertAdoptionBaselinePreserved, buildAdoptionPreparation, initializeProjectRegistrationAdoption, readCurrentAdoptionPosture, } from './alpha6/adoption.js';
 import { appendCurrentPlanRiskAudit, appendReboundPlanRiskAudit, readCurrentPlanRiskAudit, validatePlanRiskAuditCandidate, } from './alpha6/plan-risk.js';
 import { appendCorrectiveDecisionEvent, appendPlanIntegrityRecoveryDecision, appendRemediationEvent, appendRemediationModeRecovery, appendStopEscalateOverride, assertCorrectiveAuditorIndependence, assertGuardedRemediationAttemptAllowed, defaultCorrectiveAuditorActor, findCurrentGuardedRemediationPosture, findRemediationModeRecoveryCandidate, findFailedGuardedStepRequiringCorrectiveDecision, readGuardedRemediationPostureForStep, readCorrectiveDecisionEvents, readRemediationEvents, prepareStopEscalateOverride, stopEscalateOverrideDecisionEventIds, } from './alpha6/remediation.js';
@@ -170,6 +171,116 @@ export class WorkflowService {
             now: this.now,
         }).recover({ taskId, transactionId });
     }
+    recoverDownstreamProof(repository, taskId, expectedTaskRevision, actor, writerToken, reason) {
+        const context = this.#mutationContext(repository);
+        const lease = context.locks.heartbeat(taskId, writerToken);
+        const task = this.store.readTask(context.identity.projectId, taskId);
+        assertExpectedRevision(task, expectedTaskRevision);
+        this.assertTaskMutationAllowedByHandoff(task, actor, lease.token);
+        const posture = readTaskC1Posture(this.store, task);
+        if (posture.state === 'none' && lease.owner !== actor.trim()) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Downstream proof recovery actor must own the active writer lease.', {
+                taskId,
+                requiredActor: lease.owner,
+                actualActor: actor.trim(),
+            });
+        }
+        const assessment = assessDownstreamProofRecovery(this.store, context.identity.repositoryRoot, task);
+        if (!assessment.applicable || !assessment.eligible || !assessment.activeStepId) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Task is not eligible for bounded downstream proof recovery.', {
+                taskId,
+                assessment,
+            });
+        }
+        const invalidatedIds = new Set(assessment.invalidatedSteps.map((step) => step.stepId));
+        const retainedHistoricalCommits = assessment.invalidatedSteps.map((step) => step.evidenceCommit);
+        const now = this.now();
+        const resultTask = {
+            ...task,
+            revision: task.revision + 1,
+            updatedAt: now.toISOString(),
+            status: 'needs_fix',
+            steps: task.steps.map((step) => {
+                if (invalidatedIds.has(step.id))
+                    return { ...step, status: 'planned', evidence: null };
+                if (step.id === assessment.activeStepId)
+                    return { ...step, status: 'blocked', evidence: null };
+                return step;
+            }),
+            authorizations: task.authorizations.map((authorization) => authorization.kind === 'execution' && authorization.decision === 'approved'
+                ? { ...authorization, decision: 'superseded' }
+                : authorization),
+            review: emptyReview(),
+            resultHash: null,
+            evidenceHash: null,
+            blockReason: `${assessment.activeStepId} exposed changes required in completed predecessor authority; replace the Step Plan before resuming execution.`,
+            invalidatedStepCommits: [...new Set([
+                    ...(task.invalidatedStepCommits ?? []),
+                    ...retainedHistoricalCommits,
+                ])],
+        };
+        const invalidation = prepareDownstreamProofInvalidation(this.store, resultTask, assessment, {
+            previousTaskRevision: task.revision,
+            actor,
+            reason,
+        }, now);
+        const preparedYield = posture.state === 'claimed'
+            ? prepareTaskCorrectiveYield(this.store, resultTask, {
+                actor,
+                writerToken,
+                reason: `Yield after downstream proof invalidated predecessor completion authority: ${reason}`,
+                eventId: `HOF-${sha256Hex([
+                    'downstream-proof-recovery-v1',
+                    task.id,
+                    String(task.revision),
+                    invalidation.event.eventHash,
+                    actor.trim(),
+                ].join('\0'))}`,
+            }, now)
+            : null;
+        const projectRoot = this.store.projectRoot(task.projectId);
+        const relative = (absolute) => path.relative(projectRoot, absolute).split(path.sep).join('/');
+        const taskRoot = this.store.taskRoot(task.projectId, task.id);
+        applyProjectTransaction({
+            projectRoot,
+            projectId: task.projectId,
+            transactionId: `tx-${createEntityId('TASK', now.getTime()).toLowerCase()}`,
+            kind: 'downstream-proof-predecessor-recovery',
+            now,
+            targets: [
+                {
+                    path: relative(path.join(taskRoot, downstreamProofInvalidationSidecar())),
+                    content: invalidation.postimage,
+                },
+                ...(preparedYield
+                    ? [{ path: relative(path.join(taskRoot, 'handoffs.jsonl')), content: preparedYield.postimage.toString('utf8') }]
+                    : []),
+                { path: relative(path.join(taskRoot, 'state.json')), content: `${JSON.stringify(resultTask, null, 2)}\n` },
+                { path: relative(path.join(this.store.lockRoot(task.projectId), `${task.id}.json`)), content: null },
+            ],
+            validate: () => {
+                const saved = this.store.readTask(task.projectId, task.id);
+                const events = readDownstreamProofInvalidations(this.store, saved);
+                const readbackDirtyFiles = changedFiles(context.identity.repositoryRoot).sort();
+                if (saved.revision !== resultTask.revision
+                    || saved.status !== 'needs_fix'
+                    || events.at(-1)?.eventHash !== invalidation.event.eventHash
+                    || headCommit(context.identity.repositoryRoot) !== assessment.preservedHeadCommit
+                    || JSON.stringify(readbackDirtyFiles) !== JSON.stringify(assessment.dirtyFiles)
+                    || context.locks.inspect(task.id) !== null
+                    || (preparedYield && readTaskC1Posture(this.store, saved).state !== 'none')) {
+                    throw new WorkflowError('STATE_CORRUPT', 'Downstream proof recovery transaction readback failed.', {
+                        taskId,
+                    });
+                }
+                validateTaskHistory(context.identity.repositoryRoot, saved);
+            },
+        });
+        return {
+            task: this.store.readTask(task.projectId, task.id),
+            invalidation: invalidation.event,
+        };
+    }
     correctiveReplanController(repository) {
         const identity = resolveRepositoryIdentity(repository);
         return createCorrectiveReplanPublicController({
@@ -3787,6 +3898,7 @@ export class WorkflowService {
         const planIntegrityAssessment = !remediationModeRecovery && planRiskAudit && failedStep
             ? assessPlanIntegrityRecovery(this.store, repositoryRoot, task, failedStep.id)
             : null;
+        const downstreamProofAssessment = assessDownstreamProofRecovery(this.store, repositoryRoot, task);
         const strictStepReviewStep = planRiskAudit
             ? task.steps.find((step) => {
                 if (step.status !== 'in_progress' || !step.evidence || !planRiskAudit.reviewRequiredStepIds.includes(step.id)) {
@@ -4154,6 +4266,36 @@ export class WorkflowService {
                     break;
             }
         }
+        const downstreamProofOverlay = downstreamProofAssessment.applicable
+            ? downstreamProofAssessment.eligible
+                ? {
+                    action: 'task downstream-proof-recover',
+                    blockedAction: 'task step-complete',
+                    stepId: downstreamProofAssessment.activeStepId,
+                    downstreamProofRecovery: {
+                        state: 'eligible',
+                        expectedRevision: task.revision,
+                        preservesWorktree: true,
+                        preservedHeadCommit: downstreamProofAssessment.preservedHeadCommit,
+                        dirtyFiles: downstreamProofAssessment.dirtyFiles,
+                        outsideActiveStepFiles: downstreamProofAssessment.outsideActiveStepFiles,
+                        invalidatedSteps: downstreamProofAssessment.invalidatedSteps,
+                        boundedEffect: 'invalidate-predecessor-completion-and-return-to-plan-set',
+                    },
+                }
+                : {
+                    action: 'doctor',
+                    blockedAction: 'task downstream-proof-recover',
+                    stepId: downstreamProofAssessment.activeStepId,
+                    downstreamProofRecovery: {
+                        state: 'blocked',
+                        expectedRevision: task.revision,
+                        blockers: downstreamProofAssessment.blockers,
+                        dirtyFiles: downstreamProofAssessment.dirtyFiles,
+                        outsideActiveStepFiles: downstreamProofAssessment.outsideActiveStepFiles,
+                    },
+                }
+            : {};
         const result = {
             ...next,
             ...handoffOverlay,
@@ -4207,6 +4349,7 @@ export class WorkflowService {
                 }
                 : {}),
             ...guardedCorrectiveOverlay,
+            ...downstreamProofOverlay,
             ...(failedStepReviewRouting?.route === 'replan' && next.action === 'task run'
                 ? {
                     action: 'task plan-set',
@@ -4565,7 +4708,7 @@ export class WorkflowService {
             return activeLeaseOwner;
         const authorizationKind = ['task merge', 'task merge-confirm'].includes(action)
             ? 'final_acceptance'
-            : ['task step-complete', 'task submit'].includes(action)
+            : ['task step-complete', 'task downstream-proof-recover', 'task submit'].includes(action)
                 ? 'execution'
                 : null;
         if (!authorizationKind)
@@ -5349,7 +5492,13 @@ function gitMutationPolicyForAction(task, action) {
     }
 }
 function writerTokenContractForAction(action, claimedC1Posture = false) {
-    const alwaysLeaseBound = ['task step-complete', 'task submit', 'task merge', 'task merge-confirm'];
+    const alwaysLeaseBound = [
+        'task step-complete',
+        'task downstream-proof-recover',
+        'task submit',
+        'task merge',
+        'task merge-confirm',
+    ];
     const claimedC1LeaseBound = [
         'task run',
         'task step-review',