codex-workflow-v2 2.0.0-beta.12.4 → 2.0.0-beta.12.6

package/dist/src/workflow.js

@@ -2,7 +2,7 @@ import { appendFileSync, existsSync, lstatSync, readFileSync, readdirSync } from
 import { createHash } from 'node:crypto';
 import path from 'node:path';
 import { PROTOCOL_VERSION, STATE_SCHEMA_VERSION, } from './contracts.js';
-import { inspectDependencyProvenanceRecovery } from './dependency-provenance.js';
+import { inspectDependencyProvenanceRecovery, } from './dependency-provenance.js';
 import { renderBrief, renderPlan, renderResult } from './artifacts.js';
 import { assertDelegationCanAuthorize, hashDelegationPolicy, prepareDelegationGrantGate, } from './delegation.js';
 import { assessDiscovery, mergeUnique } from './domain/discovery.js';
@@ -10,7 +10,8 @@ import { pathAllowed, validatePlan } from './domain/validation.js';
 import { WorkflowError } from './errors.js';
 import { bindGraphEvidence, createGraphRefreshRequest, fallbackGraphBinding, inspectGraphBinding, validateGraphRequestCurrent, } from './graph.js';
 import { inspectLocalDependency, inspectWorkflowVersions } from './diagnostics.js';
-import { appendTaskClaim, appendTaskHandback, appendTaskHandoff, appendTaskWriterCredentialReplacement, assertTaskClaimAllowed, assertTaskMutationAllowedByC1, defaultTaskWorkerActor, readTaskC1Posture, } from './alpha6/handoff.js';
+import { appendTaskClaim, appendTaskHandback, appendTaskHandoff, appendTaskWriterCredentialReplacement, assertTaskClaimAllowed, assertTaskMutationAllowedByC1, defaultTaskWorkerActor, prepareTaskCorrectiveYield, readTaskC1Posture, } from './alpha6/handoff.js';
+import { assessDownstreamProofRecovery, downstreamProofInvalidationSidecar, prepareDownstreamProofInvalidation, readDownstreamProofInvalidations, } from './alpha6/downstream-proof.js';
 import { applyAdoptionPosture, assertAdoptionBaselinePreserved, buildAdoptionPreparation, initializeProjectRegistrationAdoption, readCurrentAdoptionPosture, } from './alpha6/adoption.js';
 import { appendCurrentPlanRiskAudit, appendReboundPlanRiskAudit, readCurrentPlanRiskAudit, validatePlanRiskAuditCandidate, } from './alpha6/plan-risk.js';
 import { appendCorrectiveDecisionEvent, appendPlanIntegrityRecoveryDecision, appendRemediationEvent, appendRemediationModeRecovery, appendStopEscalateOverride, assertCorrectiveAuditorIndependence, assertGuardedRemediationAttemptAllowed, defaultCorrectiveAuditorActor, findCurrentGuardedRemediationPosture, findRemediationModeRecoveryCandidate, findFailedGuardedStepRequiringCorrectiveDecision, readGuardedRemediationPostureForStep, readCorrectiveDecisionEvents, readRemediationEvents, prepareStopEscalateOverride, stopEscalateOverrideDecisionEventIds, } from './alpha6/remediation.js';
@@ -170,6 +171,116 @@ export class WorkflowService {
             now: this.now,
         }).recover({ taskId, transactionId });
     }
+    recoverDownstreamProof(repository, taskId, expectedTaskRevision, actor, writerToken, reason) {
+        const context = this.#mutationContext(repository);
+        const lease = context.locks.heartbeat(taskId, writerToken);
+        const task = this.store.readTask(context.identity.projectId, taskId);
+        assertExpectedRevision(task, expectedTaskRevision);
+        this.assertTaskMutationAllowedByHandoff(task, actor, lease.token);
+        const posture = readTaskC1Posture(this.store, task);
+        if (posture.state === 'none' && lease.owner !== actor.trim()) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Downstream proof recovery actor must own the active writer lease.', {
+                taskId,
+                requiredActor: lease.owner,
+                actualActor: actor.trim(),
+            });
+        }
+        const assessment = assessDownstreamProofRecovery(this.store, context.identity.repositoryRoot, task);
+        if (!assessment.applicable || !assessment.eligible || !assessment.activeStepId) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Task is not eligible for bounded downstream proof recovery.', {
+                taskId,
+                assessment,
+            });
+        }
+        const invalidatedIds = new Set(assessment.invalidatedSteps.map((step) => step.stepId));
+        const retainedHistoricalCommits = assessment.invalidatedSteps.map((step) => step.evidenceCommit);
+        const now = this.now();
+        const resultTask = {
+            ...task,
+            revision: task.revision + 1,
+            updatedAt: now.toISOString(),
+            status: 'needs_fix',
+            steps: task.steps.map((step) => {
+                if (invalidatedIds.has(step.id))
+                    return { ...step, status: 'planned', evidence: null };
+                if (step.id === assessment.activeStepId)
+                    return { ...step, status: 'blocked', evidence: null };
+                return step;
+            }),
+            authorizations: task.authorizations.map((authorization) => authorization.kind === 'execution' && authorization.decision === 'approved'
+                ? { ...authorization, decision: 'superseded' }
+                : authorization),
+            review: emptyReview(),
+            resultHash: null,
+            evidenceHash: null,
+            blockReason: `${assessment.activeStepId} exposed changes required in completed predecessor authority; replace the Step Plan before resuming execution.`,
+            invalidatedStepCommits: [...new Set([
+                    ...(task.invalidatedStepCommits ?? []),
+                    ...retainedHistoricalCommits,
+                ])],
+        };
+        const invalidation = prepareDownstreamProofInvalidation(this.store, resultTask, assessment, {
+            previousTaskRevision: task.revision,
+            actor,
+            reason,
+        }, now);
+        const preparedYield = posture.state === 'claimed'
+            ? prepareTaskCorrectiveYield(this.store, resultTask, {
+                actor,
+                writerToken,
+                reason: `Yield after downstream proof invalidated predecessor completion authority: ${reason}`,
+                eventId: `HOF-${sha256Hex([
+                    'downstream-proof-recovery-v1',
+                    task.id,
+                    String(task.revision),
+                    invalidation.event.eventHash,
+                    actor.trim(),
+                ].join('\0'))}`,
+            }, now)
+            : null;
+        const projectRoot = this.store.projectRoot(task.projectId);
+        const relative = (absolute) => path.relative(projectRoot, absolute).split(path.sep).join('/');
+        const taskRoot = this.store.taskRoot(task.projectId, task.id);
+        applyProjectTransaction({
+            projectRoot,
+            projectId: task.projectId,
+            transactionId: `tx-${createEntityId('TASK', now.getTime()).toLowerCase()}`,
+            kind: 'downstream-proof-predecessor-recovery',
+            now,
+            targets: [
+                {
+                    path: relative(path.join(taskRoot, downstreamProofInvalidationSidecar())),
+                    content: invalidation.postimage,
+                },
+                ...(preparedYield
+                    ? [{ path: relative(path.join(taskRoot, 'handoffs.jsonl')), content: preparedYield.postimage.toString('utf8') }]
+                    : []),
+                { path: relative(path.join(taskRoot, 'state.json')), content: `${JSON.stringify(resultTask, null, 2)}\n` },
+                { path: relative(path.join(this.store.lockRoot(task.projectId), `${task.id}.json`)), content: null },
+            ],
+            validate: () => {
+                const saved = this.store.readTask(task.projectId, task.id);
+                const events = readDownstreamProofInvalidations(this.store, saved);
+                const readbackDirtyFiles = changedFiles(context.identity.repositoryRoot).sort();
+                if (saved.revision !== resultTask.revision
+                    || saved.status !== 'needs_fix'
+                    || events.at(-1)?.eventHash !== invalidation.event.eventHash
+                    || headCommit(context.identity.repositoryRoot) !== assessment.preservedHeadCommit
+                    || JSON.stringify(readbackDirtyFiles) !== JSON.stringify(assessment.dirtyFiles)
+                    || context.locks.inspect(task.id) !== null
+                    || (preparedYield && readTaskC1Posture(this.store, saved).state !== 'none')) {
+                    throw new WorkflowError('STATE_CORRUPT', 'Downstream proof recovery transaction readback failed.', {
+                        taskId,
+                    });
+                }
+                validateTaskHistory(context.identity.repositoryRoot, saved);
+            },
+        });
+        return {
+            task: this.store.readTask(task.projectId, task.id),
+            invalidation: invalidation.event,
+        };
+    }
     correctiveReplanController(repository) {
         const identity = resolveRepositoryIdentity(repository);
         return createCorrectiveReplanPublicController({
@@ -2796,7 +2907,50 @@ export class WorkflowService {
             throw new WorkflowError('NOT_FOUND', `Task ${taskId} was not found in this repository.`);
         return this.inspectDependencyProvenanceCandidate(snapshot, task);
     }
+    activeDownstreamProofDependencyRecoveryPreflight(repository, taskId) {
+        const snapshot = this.observationSnapshot(repository);
+        if (snapshot.observation.kind !== 'assessment') {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Active downstream-proof dependency recovery requires a coherent observation boundary.', {
+                observation: snapshot.observation,
+            });
+        }
+        const task = snapshot.tasks.find((candidate) => candidate.id === taskId);
+        if (!task)
+            throw new WorkflowError('NOT_FOUND', `Task ${taskId} was not found in this repository.`);
+        const assessment = assessDownstreamProofRecovery(this.store, snapshot.identity.repositoryRoot, task, { historyBoundary: 'HEAD^', preservedHeadCommit: headCommit(snapshot.identity.repositoryRoot) });
+        if (!assessment.applicable
+            || !assessment.eligible
+            || !assessment.activeStepId
+            || !assessment.dirtyWorktreeHash
+            || !task.planHash) {
+            const ordinary = this.inspectDependencyProvenanceCandidate(snapshot, task);
+            return {
+                ...ordinary,
+                eligible: false,
+                action: null,
+                activeDownstreamProof: null,
+                blockers: [...new Set([
+                        ...ordinary.blockers,
+                        ...assessment.blockers,
+                        'The Task must have one eligible active downstream-proof predecessor invalidation at the candidate parent boundary.',
+                    ])],
+            };
+        }
+        return this.inspectDependencyProvenanceCandidate(snapshot, task, {
+            activeStepId: assessment.activeStepId,
+            planHash: task.planHash,
+            dirtyFiles: assessment.dirtyFiles,
+            dirtyWorktreeHash: assessment.dirtyWorktreeHash,
+            invalidatedStepIds: assessment.invalidatedSteps.map((step) => step.stepId),
+        });
+    }
     recoverDependencyProvenance(repository, taskId, expectedRevision, actor, reason) {
+        return this.recoverDependencyProvenanceCandidate(repository, taskId, expectedRevision, actor, reason, false);
+    }
+    recoverActiveDownstreamProofDependencyProvenance(repository, taskId, expectedRevision, actor, reason) {
+        return this.recoverDependencyProvenanceCandidate(repository, taskId, expectedRevision, actor, reason, true);
+    }
+    recoverDependencyProvenanceCandidate(repository, taskId, expectedRevision, actor, reason, activeDownstreamProof) {
         const normalizedActor = actor.trim();
         const normalizedReason = reason.trim();
         if (!normalizedActor)
@@ -2806,7 +2960,9 @@ export class WorkflowService {
         const context = this.#mutationContext(repository);
         const current = context.store.readTask(context.identity.projectId, taskId);
         const currentHead = headCommit(context.identity.repositoryRoot);
-        const prior = current.dependencyProvenanceRecoveries?.find((record) => record.commitSha === currentHead && record.packageVersion === PACKAGE_VERSION);
+        const prior = current.dependencyProvenanceRecoveries?.find((record) => record.commitSha === currentHead
+            && record.packageVersion === PACKAGE_VERSION
+            && Boolean(record.activeDownstreamProof) === activeDownstreamProof);
         if (prior && current.systemCommits.includes(currentHead))
             return current;
         assertExpectedRevision(current, expectedRevision);
@@ -2814,7 +2970,9 @@ export class WorkflowService {
         const task = snapshot.tasks.find((candidate) => candidate.id === taskId);
         if (!task)
             throw new WorkflowError('NOT_FOUND', `Task ${taskId} was not found in this repository.`);
-        const preflight = this.inspectDependencyProvenanceCandidate(snapshot, task);
+        const preflight = activeDownstreamProof
+            ? this.activeDownstreamProofDependencyRecoveryPreflight(repository, taskId)
+            : this.inspectDependencyProvenanceCandidate(snapshot, task);
         if (!preflight.eligible || !preflight.commitSha || !preflight.parentCommitSha) {
             throw new WorkflowError('GIT_PRECONDITION_FAILED', 'The bounded dependency provenance recovery preflight failed.', {
                 taskId,
@@ -2836,6 +2994,9 @@ export class WorkflowService {
                     reason: normalizedReason,
                     recordedAt: this.now().toISOString(),
                     retainedHistoricalCommits: preflight.retainedHistoricalCommits,
+                    ...(preflight.activeDownstreamProof
+                        ? { activeDownstreamProof: preflight.activeDownstreamProof }
+                        : {}),
                 },
             ],
         }, expectedRevision);
@@ -3249,6 +3410,22 @@ export class WorkflowService {
                     dependencyProvenanceRecovery: dependencyRecovery,
                 });
             }
+            const activeDownstreamProofDependencyRecovery = this.activeDownstreamProofDependencyRecoveryPreflight(repositoryRoot, activeTask.id);
+            if (activeDownstreamProofDependencyRecovery.eligible) {
+                return withAdoption({
+                    scope: 'task',
+                    id: activeTask.id,
+                    status: activeTask.status,
+                    action: 'update downstream-proof-dependency-recover',
+                    revision: activeTask.revision,
+                    dependencyProvenanceRecovery: activeDownstreamProofDependencyRecovery,
+                    compatibilityBoundary: {
+                        preservesWorktree: true,
+                        prerequisite: 'The active Milestone base and Task branch already contain only the exact dependency update commits.',
+                        continuation: 'Run task downstream-proof-recover after this provenance registration.',
+                    },
+                });
+            }
             const activeTaskMilestone = activeTask.milestoneId
                 ? milestonesById.get(activeTask.milestoneId) ?? null
                 : null;
@@ -3309,6 +3486,7 @@ export class WorkflowService {
             const terminalCorrectiveDecision = taskNext?.correctiveDecisionGate?.decision;
             if (taskNext?.action === 'task step-complete'
                 || taskNext?.action === 'task step-review'
+                || taskNext?.action === 'task downstream-proof-recover'
                 || taskNext?.action === 'task remediation-mode-recover'
                 || taskNext?.action === 'task plan-integrity-recover'
                 || taskNext?.blockedAction === 'task plan-integrity-recover'
@@ -3787,6 +3965,7 @@ export class WorkflowService {
         const planIntegrityAssessment = !remediationModeRecovery && planRiskAudit && failedStep
             ? assessPlanIntegrityRecovery(this.store, repositoryRoot, task, failedStep.id)
             : null;
+        const downstreamProofAssessment = assessDownstreamProofRecovery(this.store, repositoryRoot, task);
         const strictStepReviewStep = planRiskAudit
             ? task.steps.find((step) => {
                 if (step.status !== 'in_progress' || !step.evidence || !planRiskAudit.reviewRequiredStepIds.includes(step.id)) {
@@ -4154,6 +4333,36 @@ export class WorkflowService {
                     break;
             }
         }
+        const downstreamProofOverlay = downstreamProofAssessment.applicable
+            ? downstreamProofAssessment.eligible
+                ? {
+                    action: 'task downstream-proof-recover',
+                    blockedAction: 'task step-complete',
+                    stepId: downstreamProofAssessment.activeStepId,
+                    downstreamProofRecovery: {
+                        state: 'eligible',
+                        expectedRevision: task.revision,
+                        preservesWorktree: true,
+                        preservedHeadCommit: downstreamProofAssessment.preservedHeadCommit,
+                        dirtyFiles: downstreamProofAssessment.dirtyFiles,
+                        outsideActiveStepFiles: downstreamProofAssessment.outsideActiveStepFiles,
+                        invalidatedSteps: downstreamProofAssessment.invalidatedSteps,
+                        boundedEffect: 'invalidate-predecessor-completion-and-return-to-plan-set',
+                    },
+                }
+                : {
+                    action: 'doctor',
+                    blockedAction: 'task downstream-proof-recover',
+                    stepId: downstreamProofAssessment.activeStepId,
+                    downstreamProofRecovery: {
+                        state: 'blocked',
+                        expectedRevision: task.revision,
+                        blockers: downstreamProofAssessment.blockers,
+                        dirtyFiles: downstreamProofAssessment.dirtyFiles,
+                        outsideActiveStepFiles: downstreamProofAssessment.outsideActiveStepFiles,
+                    },
+                }
+            : {};
         const result = {
             ...next,
             ...handoffOverlay,
@@ -4207,6 +4416,7 @@ export class WorkflowService {
                 }
                 : {}),
             ...guardedCorrectiveOverlay,
+            ...downstreamProofOverlay,
             ...(failedStepReviewRouting?.route === 'replan' && next.action === 'task run'
                 ? {
                     action: 'task plan-set',
@@ -4507,7 +4717,7 @@ export class WorkflowService {
             },
         };
     }
-    inspectDependencyProvenanceCandidate(snapshot, task) {
+    inspectDependencyProvenanceCandidate(snapshot, task, activeDownstreamProof = null) {
         const versions = inspectWorkflowVersions(snapshot.identity.repositoryRoot, [task.baseBranch]);
         const now = this.now().getTime();
         return inspectDependencyProvenanceRecovery(snapshot.identity.repositoryRoot, task, {
@@ -4527,7 +4737,7 @@ export class WorkflowService {
                 currentBranch: versions.currentBranch,
                 baseBranch: versions.milestoneBases.find((base) => base.branch === task.baseBranch)?.version ?? null,
             },
-        });
+        }, activeDownstreamProof);
     }
     withTaskNavigationContracts(task, next) {
         const action = typeof next.action === 'string' ? next.action : null;
@@ -4565,7 +4775,7 @@ export class WorkflowService {
             return activeLeaseOwner;
         const authorizationKind = ['task merge', 'task merge-confirm'].includes(action)
             ? 'final_acceptance'
-            : ['task step-complete', 'task submit'].includes(action)
+            : ['task step-complete', 'task downstream-proof-recover', 'task submit'].includes(action)
                 ? 'execution'
                 : null;
         if (!authorizationKind)
@@ -5349,7 +5559,13 @@ function gitMutationPolicyForAction(task, action) {
     }
 }
 function writerTokenContractForAction(action, claimedC1Posture = false) {
-    const alwaysLeaseBound = ['task step-complete', 'task submit', 'task merge', 'task merge-confirm'];
+    const alwaysLeaseBound = [
+        'task step-complete',
+        'task downstream-proof-recover',
+        'task submit',
+        'task merge',
+        'task merge-confirm',
+    ];
     const claimedC1LeaseBound = [
         'task run',
         'task step-review',