codex-workflow-v2 2.0.0-beta.12.7 → 2.0.0-beta.12.9

package/dist/src/workflow.js

@@ -3,6 +3,7 @@ import { createHash } from 'node:crypto';
 import path from 'node:path';
 import { PROTOCOL_VERSION, STATE_SCHEMA_VERSION, } from './contracts.js';
 import { inspectDependencyProvenanceRecovery, } from './dependency-provenance.js';
+import { inspectHistoricalStepProvenanceRecovery, omittedStepEvidenceCommits, } from './historical-step-provenance.js';
 import { renderBrief, renderPlan, renderResult } from './artifacts.js';
 import { assertDelegationCanAuthorize, hashDelegationPolicy, prepareDelegationGrantGate, } from './delegation.js';
 import { assessDiscovery, mergeUnique } from './domain/discovery.js';
@@ -11,7 +12,7 @@ import { WorkflowError } from './errors.js';
 import { bindGraphEvidence, createGraphRefreshRequest, fallbackGraphBinding, inspectGraphBinding, validateGraphRequestCurrent, } from './graph.js';
 import { inspectLocalDependency, inspectWorkflowVersions } from './diagnostics.js';
 import { appendTaskClaim, appendTaskHandback, appendTaskHandoff, appendTaskWriterCredentialReplacement, assertTaskClaimAllowed, assertTaskMutationAllowedByC1, defaultTaskWorkerActor, prepareTaskCorrectiveYield, readTaskC1Posture, } from './alpha6/handoff.js';
-import { assessDownstreamProofCarryover, assessDownstreamProofReplanRecovery, assessDownstreamProofRecovery, downstreamProofInvalidationSidecar, downstreamProofReplanRecoverySidecar, prepareDownstreamProofInvalidation, prepareDownstreamProofReplanRecovery, readDownstreamProofInvalidations, readDownstreamProofReplanRecoveries, } from './alpha6/downstream-proof.js';
+import { assessDownstreamProofCarryover, assessDownstreamProofReplanRecovery, assessDownstreamProofRecovery, downstreamProofInvalidationSidecar, downstreamProofReplanRecoverySidecar, prepareDownstreamProofInvalidation, prepareDownstreamProofReplanRecovery, readDownstreamProofInvalidations, readDownstreamProofReplanRecoveries, hashDirtyWorktree, } from './alpha6/downstream-proof.js';
 import { applyAdoptionPosture, assertAdoptionBaselinePreserved, buildAdoptionPreparation, initializeProjectRegistrationAdoption, readCurrentAdoptionPosture, } from './alpha6/adoption.js';
 import { appendCurrentPlanRiskAudit, appendReboundPlanRiskAudit, readCurrentPlanRiskAudit, readPlanRiskAuditEvents, validatePlanRiskAuditCandidate, } from './alpha6/plan-risk.js';
 import { appendCorrectiveDecisionEvent, appendPlanIntegrityRecoveryDecision, appendRemediationEvent, appendRemediationModeRecovery, appendStopEscalateOverride, assertCorrectiveAuditorIndependence, assertGuardedRemediationAttemptAllowed, defaultCorrectiveAuditorActor, findCurrentGuardedRemediationPosture, findRemediationModeRecoveryCandidate, findFailedGuardedStepRequiringCorrectiveDecision, readGuardedRemediationPostureForStep, readCorrectiveDecisionEvents, readRemediationEvents, prepareStopEscalateOverride, stopEscalateOverrideDecisionEventIds, } from './alpha6/remediation.js';
@@ -19,7 +20,7 @@ import { assessPlanIntegrityRecovery, defaultPlanIntegrityRecoveryActor, } from
 import { assertMechanicalFeasibilityFresh, evaluateMechanicalFeasibility, hashMechanicalFeasibilityEvidence, } from './alpha6/mechanical-feasibility.js';
 import { assessMilestoneInitialAssembly, applyInitialMilestonePlanTransaction, applyMilestoneScopeChangeTransaction, assertMilestoneDependenciesDeclared, assertMilestoneTaskRunnable, assessMilestoneTaskDependencies, assertMilestoneMembershipIntegrity, assertMilestoneScopeChangeStatusAllowed, inspectMilestoneWithIntegrity, normalizeMilestonePlan, prepareMilestoneScopeChangeCandidate, prepareMilestoneScopeChangeBundle, readMilestoneForScopeChange, readMilestoneWithIntegrity, } from './alpha6/milestone.js';
 import { applyProjectTransaction, recoverProjectTransactions, runRollbackProjectTransaction, } from './beta1/project-transaction.js';
-import { buildCurrentStrictStepReviewCycle, countUnverifiedStrictStepReviews, ensurePendingStrictStepReview, isStepReviewRequired, latestFailedStepReviewRouting, latestPassedVerifiedStepReviewEvent, recordStrictStepReview, verifiedHistoricalStepReviewCommits, } from './alpha6/review.js';
+import { buildCurrentStrictStepReviewCycle, countUnverifiedStrictStepReviews, ensurePendingStrictStepReview, isStepReviewRequired, latestFailedStepReviewRouting, latestPassedVerifiedStepReviewEvent, recordStrictStepReview, verifiedHistoricalStepReviewCommits, verifiedHistoricalStepReviewBindings, } from './alpha6/review.js';
 import { applyMilestoneAutonomyContract, assertAutonomousPlanEvolution, prepareMilestoneAutonomyContract, readMilestoneAutonomyEvents, requireActiveMilestoneAutonomy, } from './alpha7/autonomy.js';
 import { appendCorrectiveDecisionRecovery, readValidatedCorrectiveDecisionRecoveryForNavigation, readValidatedStopOverrideContextRebindIfApplicable, requireCorrectiveDecisionRecoveryForRun, } from './alpha7/corrective-recovery.js';
 import { applyKnowledgeSelections, hashKnowledgeMap, inspectKnowledgeMap, normalizeRelativePath, reconcileKnowledgeMap, scanProjectKnowledge, selectKnowledgeSources, } from './memory.js';
@@ -1399,6 +1400,10 @@ export class WorkflowService {
             status: dependenciesComplete(step, completedIds) ? 'planned' : 'blocked',
             evidence: null,
         }));
+        const invalidatedStepCommits = [...new Set([
+                ...(task.invalidatedStepCommits ?? []),
+                ...omittedStepEvidenceCommits(task, plannedSteps),
+            ])];
         if (task.status === 'needs_fix' &&
             task.review.status === 'failed' &&
             plannedSteps.every((step) => step.status === 'completed')) {
@@ -1437,6 +1442,7 @@ export class WorkflowService {
             knowledgeMapHash: plan.knowledgeMapHash,
             graphUse: plan.graphUse,
             steps: plannedSteps,
+            invalidatedStepCommits,
             authorizations,
             review: emptyReview(),
             resultHash: null,
@@ -2733,16 +2739,23 @@ export class WorkflowService {
         assertCorrectiveAuditorIndependence(this.store, task, stepId, correctiveAudit.auditor);
         return appendCorrectiveDecisionEvent(this.store, task, stepId, correctiveAudit, planRiskAudit, task.planHash, this.now());
     }
-    setTaskResult(repository, taskId, expectedRevision, summary, limitations) {
-        const { identity } = this.#mutationContext(repository);
+    setTaskResult(repository, taskId, expectedRevision, summary, limitations, writerToken, actor) {
+        const context = this.#mutationContext(repository);
+        const { identity } = context;
         const task = this.store.readTask(identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         if (task.status !== 'validating' || task.review.status !== 'passed') {
             throw new WorkflowError('TRANSITION_BLOCKED', 'Result requires a passing independent review.');
         }
         this.assertReviewFresh(identity.repositoryRoot, task);
+        const lease = context.locks.heartbeat(taskId, writerToken);
+        this.assertTaskMutationAllowedByHandoff(task, actor ?? null, lease.token);
         const root = this.store.taskRoot(task.projectId, task.id);
         const stagedResult = this.store.stageArtifact(root, 'result.md', renderResult(task, summary, limitations));
+        // Human final acceptance is an intentionally unbounded pause. Release the
+        // execution lease before entering that gate so elapsed human time cannot
+        // turn a successful Task into a repository-wide stale-lock repair route.
+        context.locks.release(taskId, lease.token);
         const saved = this.store.writeTask({ ...task, status: 'awaiting_final_acceptance', resultHash: stagedResult.hash, blockReason: null }, expectedRevision);
         this.store.publishArtifact(stagedResult);
         return saved;
@@ -3005,6 +3018,137 @@ export class WorkflowService {
             throw new WorkflowError('NOT_FOUND', `Task ${taskId} was not found in this repository.`);
         return this.inspectDependencyProvenanceCandidate(snapshot, task);
     }
+    historicalStepProvenanceRecoveryPreflight(repository, taskId) {
+        const snapshot = this.observationSnapshot(repository);
+        if (snapshot.observation.kind !== 'assessment') {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Historical Step provenance recovery requires a coherent observation boundary.', {
+                observation: snapshot.observation,
+            });
+        }
+        const task = snapshot.tasks.find((candidate) => candidate.id === taskId);
+        if (!task)
+            throw new WorkflowError('NOT_FOUND', `Task ${taskId} was not found in this repository.`);
+        return this.inspectHistoricalStepProvenanceCandidate(snapshot, task);
+    }
+    historicalStepDependencyRecoveryPreflight(repository, taskId) {
+        const snapshot = this.observationSnapshot(repository);
+        if (snapshot.observation.kind !== 'assessment') {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Historical Step dependency recovery requires a coherent observation boundary.', {
+                observation: snapshot.observation,
+            });
+        }
+        const task = snapshot.tasks.find((candidate) => candidate.id === taskId);
+        if (!task)
+            throw new WorkflowError('NOT_FOUND', `Task ${taskId} was not found in this repository.`);
+        let candidateParent = null;
+        try {
+            candidateParent = runGit(snapshot.identity.repositoryRoot, ['rev-parse', 'HEAD^']);
+        }
+        catch {
+            candidateParent = null;
+        }
+        const assessment = candidateParent
+            ? this.inspectHistoricalStepProvenanceCandidate(snapshot, task, {
+                historyBoundary: 'HEAD^',
+                preservedHeadCommit: candidateParent,
+            })
+            : null;
+        if (!assessment?.eligible
+            || !assessment.activeStepId
+            || !assessment.commitSha
+            || !task.planHash) {
+            const ordinary = this.inspectDependencyProvenanceCandidate(snapshot, task);
+            return {
+                ...ordinary,
+                eligible: false,
+                action: null,
+                historicalStepProvenance: null,
+                blockers: [...new Set([
+                        ...ordinary.blockers,
+                        ...(assessment?.blockers ?? []),
+                        'The dependency candidate parent must contain exactly one accepted and strictly reviewed historical Step commit omitted by the current corrective Plan.',
+                    ])],
+            };
+        }
+        let dirtyWorktreeHash;
+        try {
+            dirtyWorktreeHash = hashDirtyWorktree(snapshot.identity.repositoryRoot, assessment.dirtyFiles);
+        }
+        catch (error) {
+            const ordinary = this.inspectDependencyProvenanceCandidate(snapshot, task);
+            return {
+                ...ordinary,
+                eligible: false,
+                action: null,
+                historicalStepProvenance: null,
+                blockers: [...new Set([
+                        ...ordinary.blockers,
+                        error instanceof Error ? error.message : String(error),
+                    ])],
+            };
+        }
+        return this.inspectDependencyProvenanceCandidate(snapshot, task, null, null, {
+            activeStepId: assessment.activeStepId,
+            planHash: task.planHash,
+            dirtyFiles: assessment.dirtyFiles,
+            dirtyWorktreeHash,
+            retainedCommitSha: assessment.commitSha,
+        });
+    }
+    recoverHistoricalStepProvenance(repository, taskId, expectedRevision, commitSha, actor, reason) {
+        const normalizedActor = actor.trim();
+        const normalizedReason = reason.trim();
+        if (!normalizedActor)
+            throw new WorkflowError('INVALID_ARGUMENT', 'Historical Step provenance recovery requires an actor.');
+        if (!normalizedReason)
+            throw new WorkflowError('INVALID_ARGUMENT', 'Historical Step provenance recovery requires a reason.');
+        const context = this.#mutationContext(repository);
+        const current = context.store.readTask(context.identity.projectId, taskId);
+        const prior = current.historicalStepProvenanceRecoveries?.find((record) => record.commitSha === commitSha);
+        if (prior && (current.invalidatedStepCommits ?? []).includes(commitSha)) {
+            validateTaskHistory(context.identity.repositoryRoot, current);
+            return current;
+        }
+        assertExpectedRevision(current, expectedRevision);
+        const preflight = this.historicalStepProvenanceRecoveryPreflight(repository, taskId);
+        if (!preflight.eligible || preflight.commitSha !== commitSha || !preflight.sourceFinalAcceptanceRecordedAt) {
+            throw new WorkflowError('GIT_PRECONDITION_FAILED', 'The bounded historical Step provenance recovery preflight failed.', {
+                taskId,
+                requestedCommit: commitSha,
+                candidateCommit: preflight.commitSha,
+                blockers: preflight.blockers,
+            });
+        }
+        const sourceAcceptance = current.authorizations.find((authorization) => authorization.kind === 'final_acceptance'
+            && ['approved', 'superseded'].includes(authorization.decision)
+            && authorization.headCommit === commitSha
+            && authorization.recordedAt === preflight.sourceFinalAcceptanceRecordedAt
+            && authorization.planHash
+            && authorization.resultHash
+            && authorization.evidenceHash);
+        if (!sourceAcceptance?.planHash || !sourceAcceptance.resultHash || !sourceAcceptance.evidenceHash) {
+            throw new WorkflowError('STATE_CONFLICT', 'The source final acceptance changed after historical provenance preflight.');
+        }
+        const saved = context.store.writeTask({
+            ...current,
+            invalidatedStepCommits: [...new Set([...(current.invalidatedStepCommits ?? []), commitSha])],
+            historicalStepProvenanceRecoveries: [
+                ...(current.historicalStepProvenanceRecoveries ?? []),
+                {
+                    commitSha,
+                    actor: normalizedActor,
+                    reason: normalizedReason,
+                    recordedAt: this.now().toISOString(),
+                    sourceFinalAcceptanceRecordedAt: sourceAcceptance.recordedAt,
+                    sourcePlanHash: sourceAcceptance.planHash,
+                    sourceResultHash: sourceAcceptance.resultHash,
+                    sourceEvidenceHash: sourceAcceptance.evidenceHash,
+                },
+            ],
+        }, expectedRevision);
+        validateTaskHistory(context.identity.repositoryRoot, saved);
+        return saved;
+    }
     activeDownstreamProofDependencyRecoveryPreflight(repository, taskId) {
         const snapshot = this.observationSnapshot(repository);
         if (snapshot.observation.kind !== 'assessment') {
@@ -3152,6 +3296,9 @@ export class WorkflowService {
     recoverDownstreamProofReplanDependencyProvenance(repository, taskId, expectedRevision, actor, reason) {
         return this.recoverDependencyProvenanceCandidate(repository, taskId, expectedRevision, actor, reason, 'downstream-replan');
     }
+    recoverHistoricalStepDependencyProvenance(repository, taskId, expectedRevision, actor, reason) {
+        return this.recoverDependencyProvenanceCandidate(repository, taskId, expectedRevision, actor, reason, 'historical-step');
+    }
     recoverDependencyProvenanceCandidate(repository, taskId, expectedRevision, actor, reason, recoveryMode) {
         const normalizedActor = actor.trim();
         const normalizedReason = reason.trim();
@@ -3166,7 +3313,9 @@ export class WorkflowService {
             && record.packageVersion === PACKAGE_VERSION
             && (recoveryMode === 'downstream-replan'
                 ? Boolean(record.downstreamProofReplan)
-                : Boolean(record.activeDownstreamProof) === recoveryMode));
+                : recoveryMode === 'historical-step'
+                    ? Boolean(record.historicalStepProvenance)
+                    : Boolean(record.activeDownstreamProof) === recoveryMode));
         if (prior && current.systemCommits.includes(currentHead))
             return current;
         assertExpectedRevision(current, expectedRevision);
@@ -3176,9 +3325,11 @@ export class WorkflowService {
             throw new WorkflowError('NOT_FOUND', `Task ${taskId} was not found in this repository.`);
         const preflight = recoveryMode === 'downstream-replan'
             ? this.downstreamProofReplanDependencyRecoveryPreflight(repository, taskId)
-            : recoveryMode
-                ? this.activeDownstreamProofDependencyRecoveryPreflight(repository, taskId)
-                : this.inspectDependencyProvenanceCandidate(snapshot, task);
+            : recoveryMode === 'historical-step'
+                ? this.historicalStepDependencyRecoveryPreflight(repository, taskId)
+                : recoveryMode
+                    ? this.activeDownstreamProofDependencyRecoveryPreflight(repository, taskId)
+                    : this.inspectDependencyProvenanceCandidate(snapshot, task);
         if (!preflight.eligible || !preflight.commitSha || !preflight.parentCommitSha) {
             throw new WorkflowError('GIT_PRECONDITION_FAILED', 'The bounded dependency provenance recovery preflight failed.', {
                 taskId,
@@ -3206,6 +3357,9 @@ export class WorkflowService {
                     ...(preflight.downstreamProofReplan
                         ? { downstreamProofReplan: preflight.downstreamProofReplan }
                         : {}),
+                    ...(preflight.historicalStepProvenance
+                        ? { historicalStepProvenance: preflight.historicalStepProvenance }
+                        : {}),
                 },
             ],
         }, expectedRevision);
@@ -3608,6 +3762,33 @@ export class WorkflowService {
         const activeTask = requestedTask
             ?? status.tasks.find((task) => taskIsActionableFromRepositoryNext(task, milestonesById, tasksById));
         if (activeTask) {
+            const historicalStepProvenanceRecovery = this.historicalStepProvenanceRecoveryPreflight(repositoryRoot, activeTask.id);
+            if (historicalStepProvenanceRecovery.eligible) {
+                return withAdoption({
+                    scope: 'task',
+                    id: activeTask.id,
+                    status: activeTask.status,
+                    action: 'task historical-step-provenance-recover',
+                    revision: activeTask.revision,
+                    historicalStepProvenanceRecovery,
+                });
+            }
+            const historicalStepDependencyRecovery = this.historicalStepDependencyRecoveryPreflight(repositoryRoot, activeTask.id);
+            if (historicalStepDependencyRecovery.eligible) {
+                return withAdoption({
+                    scope: 'task',
+                    id: activeTask.id,
+                    status: activeTask.status,
+                    action: 'update historical-step-dependency-recover',
+                    revision: activeTask.revision,
+                    dependencyProvenanceRecovery: historicalStepDependencyRecovery,
+                    compatibilityBoundary: {
+                        preservesWorktree: true,
+                        prerequisite: 'The active Milestone base and Task branch contain only the exact target dependency commits; the candidate parent still binds the reviewed historical Step commit.',
+                        continuation: 'Register the dependency commit and historical provenance atomically, then follow fresh next.',
+                    },
+                });
+            }
             const dependencyRecovery = this.dependencyProvenanceRecoveryPreflight(repositoryRoot, activeTask.id);
             if (dependencyRecovery.eligible) {
                 return withAdoption({
@@ -5056,7 +5237,7 @@ export class WorkflowService {
             },
         };
     }
-    inspectDependencyProvenanceCandidate(snapshot, task, activeDownstreamProof = null, downstreamProofReplan = null) {
+    inspectDependencyProvenanceCandidate(snapshot, task, activeDownstreamProof = null, downstreamProofReplan = null, historicalStepProvenance = null) {
         const versions = inspectWorkflowVersions(snapshot.identity.repositoryRoot, [task.baseBranch]);
         const now = this.now().getTime();
         return inspectDependencyProvenanceRecovery(snapshot.identity.repositoryRoot, task, {
@@ -5076,7 +5257,20 @@ export class WorkflowService {
                 currentBranch: versions.currentBranch,
                 baseBranch: versions.milestoneBases.find((base) => base.branch === task.baseBranch)?.version ?? null,
             },
-        }, activeDownstreamProof, downstreamProofReplan);
+        }, activeDownstreamProof, downstreamProofReplan, historicalStepProvenance);
+    }
+    inspectHistoricalStepProvenanceCandidate(snapshot, task, options = {}) {
+        const now = this.now().getTime();
+        return inspectHistoricalStepProvenanceRecovery(snapshot.identity.repositoryRoot, task, {
+            activeLeaseCount: snapshot.leases.filter((lease) => Date.parse(lease.expiresAt) > now).length,
+            staleLeaseCount: snapshot.leases.filter((lease) => Date.parse(lease.expiresAt) <= now).length,
+            pendingTransactionCount: snapshot.observation.pendingProjectTransactions.length
+                + snapshot.observation.pendingMilestoneTransactions.length
+                + snapshot.observation.pendingTaskTransactions.length,
+            corruptTransactionCount: snapshot.observation.corruptTaskTransactions.length,
+            coreOperationCount: snapshot.observation.coreTaskOperations.length,
+            verifiedHistoricalStepBindings: verifiedHistoricalStepReviewBindings(this.store, task),
+        }, options);
     }
     withTaskNavigationContracts(task, next) {
         const action = typeof next.action === 'string' ? next.action : null;
@@ -5114,7 +5308,7 @@ export class WorkflowService {
             return activeLeaseOwner;
         const authorizationKind = ['task merge', 'task merge-confirm'].includes(action)
             ? 'final_acceptance'
-            : ['task step-complete', 'task downstream-proof-recover', 'task submit'].includes(action)
+            : ['task step-complete', 'task downstream-proof-recover', 'task submit', 'task result-set'].includes(action)
                 ? 'execution'
                 : null;
         if (!authorizationKind)
@@ -5902,6 +6096,7 @@ function writerTokenContractForAction(action, claimedC1Posture = false) {
         'task step-complete',
         'task downstream-proof-recover',
         'task submit',
+        'task result-set',
         'task merge',
         'task merge-confirm',
     ];