codex-workflow-v2 2.0.0-beta.12 → 2.0.0-beta.12.10

package/dist/src/alpha6/milestone.d.ts

@@ -1,4 +1,4 @@
-import type { AuthorizationEvent, MilestoneMembership, MilestonePlanInput, MilestonePlanMembershipInput, MilestoneScopeSnapshot, MilestoneState, TaskState } from '../contracts.js';
+import type { AuditedRemediationEvidence, AuthorizationEvent, MilestoneMembership, MilestonePlanInput, MilestonePlanMembershipInput, MilestoneScopeChangeEvent, MilestoneScopeSnapshot, MilestoneState, TaskState } from '../contracts.js';
 import type { FileStateStore } from '../state/store.js';
 type ReadTask = (taskId: string) => TaskState;
 type ListTasks = () => TaskState[];
@@ -40,8 +40,10 @@ export interface PreparedMilestoneScopeChange {
     after: MilestoneScopeSnapshot;
     confirmationCodeBindingHash: string;
     confirmationCode: string;
-    authorizationMode: 'human' | 'milestone-autonomy';
+    authorizationMode: 'human' | 'milestone-autonomy' | 'audited-remediation';
     autonomyContractEventHash: string | null;
+    remediationEvidence: AuditedRemediationEvidence | null;
+    resultingStatus: MilestoneState['status'];
 }
 export interface PreparedMilestoneScopeChangeBundle {
     state: MilestoneState;
@@ -83,6 +85,7 @@ export declare function prepareMilestoneScopeChangeCandidate(options: {
     readTask: ReadTask;
     actor: string;
     autonomyContractEventHash?: string;
+    auditedRemediationEvidence?: AuditedRemediationEvidence;
 }): PreparedMilestoneScopeChange;
 export declare function applyMilestoneScopeChangeTransaction(options: {
     store: FileStateStore;
@@ -101,4 +104,5 @@ export declare function applyInitialMilestonePlanTransaction(options: {
     readTask: ReadTask;
     listTasks?: ListTasks;
 }): MilestoneState;
+export declare function readMilestoneScopeChangeEvents(store: FileStateStore, projectId: string, milestoneId: string): MilestoneScopeChangeEvent[];
 export {};

package/dist/src/alpha6/milestone.js

@@ -40,12 +40,13 @@ export function prepareMilestoneScopeChangeBundle(options) {
         confirmationCodeBindingHash: prepared.confirmationCodeBindingHash,
         authorizationMode: prepared.authorizationMode,
         autonomyContractEventHash: prepared.autonomyContractEventHash,
+        remediationEvidence: prepared.remediationEvidence,
     }), { validateEvent: (candidate) => validateMilestoneScopeChangeEvent(candidate, milestone.id) });
     const state = {
         ...milestone,
         revision: milestone.revision + 1,
         updatedAt: now.toISOString(),
-        status: 'awaiting_execution_authorization',
+        status: prepared.resultingStatus,
         outcome: prepared.normalizedPlan.outcome,
         successSignal: prepared.normalizedPlan.successSignal,
         acceptance: prepared.normalizedPlan.acceptance,
@@ -492,7 +493,9 @@ export function prepareMilestoneScopeChangeCandidate(options) {
     if (!trimmedActor) {
         throw new WorkflowError('INVALID_ARGUMENT', 'Milestone scope change requires an explicit actor.');
     }
-    if (trimmedActor.startsWith('agent:') && !options.autonomyContractEventHash) {
+    if (trimmedActor.startsWith('agent:')
+        && !options.autonomyContractEventHash
+        && !options.auditedRemediationEvidence) {
         throw new WorkflowError('TRANSITION_BLOCKED', 'Milestone scope change is human-only and rejects delegated agent actors.', {
             actor: trimmedActor,
         });
@@ -500,8 +503,19 @@ export function prepareMilestoneScopeChangeCandidate(options) {
     if (options.autonomyContractEventHash) {
         assertHash64(options.autonomyContractEventHash, 'Milestone autonomy contract event hash');
     }
-    const authorizationMode = options.autonomyContractEventHash ? 'milestone-autonomy' : 'human';
+    if (options.autonomyContractEventHash && options.auditedRemediationEvidence) {
+        throw new WorkflowError('INVALID_ARGUMENT', 'Milestone scope change cannot combine autonomy and audited-remediation authority.');
+    }
+    if (options.auditedRemediationEvidence && !trimmedActor.startsWith('agent:')) {
+        throw new WorkflowError('INVALID_ARGUMENT', 'Audited remediation requires an agent actor.');
+    }
+    const authorizationMode = options.auditedRemediationEvidence
+        ? 'audited-remediation'
+        : options.autonomyContractEventHash
+            ? 'milestone-autonomy'
+            : 'human';
     const autonomyContractEventHash = options.autonomyContractEventHash ?? null;
+    const remediationEvidence = options.auditedRemediationEvidence ?? null;
     const normalizedPlan = normalizeMilestonePlan(plan);
     const before = milestoneScopeSnapshotFromState(milestone);
     const after = milestoneScopeSnapshotFromPlan(normalizedPlan);
@@ -558,6 +572,7 @@ export function prepareMilestoneScopeChangeCandidate(options) {
         after,
         authorizationMode,
         autonomyContractEventHash,
+        remediationEvidence,
     });
     return {
         milestoneId: milestone.id,
@@ -572,6 +587,10 @@ export function prepareMilestoneScopeChangeCandidate(options) {
         confirmationCode: milestoneScopeChangeConfirmationCode(confirmationCodeBindingHash),
         authorizationMode,
         autonomyContractEventHash,
+        remediationEvidence,
+        resultingStatus: authorizationMode === 'audited-remediation'
+            ? 'active'
+            : 'awaiting_execution_authorization',
     };
 }
 export function applyMilestoneScopeChangeTransaction(options) {
@@ -598,6 +617,7 @@ export function applyMilestoneScopeChangeTransaction(options) {
         confirmationCodeBindingHash: prepared.confirmationCodeBindingHash,
         authorizationMode: prepared.authorizationMode,
         autonomyContractEventHash: prepared.autonomyContractEventHash,
+        remediationEvidence: prepared.remediationEvidence,
     }), { validateEvent: (candidate) => validateMilestoneScopeChangeEvent(candidate, milestone.id) });
     if (preparedSidecar.event.actor !== prepared.actor) {
         throw new WorkflowError('STATE_CORRUPT', 'Prepared Milestone scope-change actor drifted before journal apply.', {
@@ -616,7 +636,7 @@ export function applyMilestoneScopeChangeTransaction(options) {
         ...milestone,
         revision: milestone.revision + 1,
         updatedAt: now.toISOString(),
-        status: 'awaiting_execution_authorization',
+        status: prepared.resultingStatus,
         outcome: prepared.normalizedPlan.outcome,
         successSignal: prepared.normalizedPlan.successSignal,
         acceptance: prepared.normalizedPlan.acceptance,
@@ -843,7 +863,7 @@ function assertMilestonePlanAgreement(store, milestone) {
         });
     }
 }
-function readMilestoneScopeChangeEvents(store, projectId, milestoneId) {
+export function readMilestoneScopeChangeEvents(store, projectId, milestoneId) {
     const sidecarPath = path.join(resolveAlpha6MilestoneRoot(store, projectId, milestoneId), SCOPE_CHANGE_SIDECAR);
     assertNoSymlinkPathComponents(sidecarPath, { label: 'Milestone scope-change sidecar path', requireLeaf: true });
     if (!existsSync(sidecarPath))
@@ -886,7 +906,9 @@ function validateMilestoneScopeChangeEvent(event, expectedMilestoneId) {
     if (!event.actor.trim()) {
         throw new WorkflowError('STATE_CORRUPT', 'Milestone scope-change actor is required.', { eventId: event.eventId });
     }
-    if (event.actor.startsWith('agent:') && event.authorizationMode !== 'milestone-autonomy') {
+    if (event.actor.startsWith('agent:')
+        && event.authorizationMode !== 'milestone-autonomy'
+        && event.authorizationMode !== 'audited-remediation') {
         throw new WorkflowError('STATE_CORRUPT', 'Milestone scope-change actor must be human-only.', {
             eventId: event.eventId,
             actor: event.actor,
@@ -903,6 +925,20 @@ function validateMilestoneScopeChangeEvent(event, expectedMilestoneId) {
     else if (event.autonomyContractEventHash !== undefined && event.autonomyContractEventHash !== null) {
         throw new WorkflowError('STATE_CORRUPT', 'Human Milestone scope change cannot carry autonomy contract evidence.');
     }
+    if (event.authorizationMode === 'audited-remediation') {
+        if (event.actor !== `agent:milestone-remediation:${event.milestoneId}` || !event.remediationEvidence) {
+            throw new WorkflowError('STATE_CORRUPT', 'Audited remediation requires an agent actor and bound remediation evidence.', {
+                eventId: event.eventId,
+            });
+        }
+        validateAuditedRemediationEvidence(event.remediationEvidence, event.eventId);
+        validateAuditedRemediationTopologyEvent(event);
+    }
+    else if (event.remediationEvidence !== undefined && event.remediationEvidence !== null) {
+        throw new WorkflowError('STATE_CORRUPT', 'Non-remediation scope change cannot carry remediation evidence.', {
+            eventId: event.eventId,
+        });
+    }
     if (!event.confirmationCodeBindingHash.trim()) {
         throw new WorkflowError('STATE_CORRUPT', 'Milestone scope-change confirmationCodeBindingHash is required.', {
             eventId: event.eventId,
@@ -922,6 +958,9 @@ function validateMilestoneScopeChangeEvent(event, expectedMilestoneId) {
         ...(event.autonomyContractEventHash === undefined
             ? {}
             : { autonomyContractEventHash: event.autonomyContractEventHash }),
+        ...(event.remediationEvidence === undefined
+            ? {}
+            : { remediationEvidence: event.remediationEvidence }),
     });
     if (event.confirmationCodeBindingHash !== expectedBindingHash) {
         throw new WorkflowError('STATE_CORRUPT', 'Milestone scope-change confirmationCodeBindingHash is inconsistent.', {
@@ -1213,7 +1252,7 @@ function parseMilestoneScopeChangeEvents(content, milestoneId) {
     return events;
 }
 function createMilestoneScopeChangeEvent(options) {
-    const { milestone, normalizedPlan, actor, now, previousEventHash, candidatePlanHash, candidateMembershipRevision, confirmationCodeBindingHash, authorizationMode, autonomyContractEventHash, } = options;
+    const { milestone, normalizedPlan, actor, now, previousEventHash, candidatePlanHash, candidateMembershipRevision, confirmationCodeBindingHash, authorizationMode, autonomyContractEventHash, remediationEvidence, } = options;
     return {
         eventId: createEntityId('MS', now.getTime()),
         previousEventHash,
@@ -1230,7 +1269,9 @@ function createMilestoneScopeChangeEvent(options) {
         confirmationCodeBindingHash,
         ...(authorizationMode === 'milestone-autonomy'
             ? { authorizationMode, autonomyContractEventHash }
-            : {}),
+            : authorizationMode === 'audited-remediation'
+                ? { authorizationMode, remediationEvidence }
+                : {}),
     };
 }
 function milestoneScopeSnapshotFromState(milestone) {
@@ -1264,6 +1305,7 @@ function parseMilestoneScopeChangeEventRecord(parsed, milestoneId, line) {
         'confirmationCodeBindingHash',
         'authorizationMode',
         'autonomyContractEventHash',
+        'remediationEvidence',
         'eventHash',
     ]);
     const extraKeys = Object.keys(record).filter((key) => !allowedKeys.has(key));
@@ -1292,6 +1334,9 @@ function parseMilestoneScopeChangeEventRecord(parsed, milestoneId, line) {
     const autonomyContractEventHash = record.autonomyContractEventHash === undefined
         ? undefined
         : requireNullableHash64(record.autonomyContractEventHash, `Milestone ${milestoneId} scope-change autonomyContractEventHash`, { line });
+    const remediationEvidence = record.remediationEvidence === undefined
+        ? undefined
+        : parseAuditedRemediationEvidence(record.remediationEvidence, milestoneId, line);
     const eventHash = requireHash64(record.eventHash, `Milestone ${milestoneId} scope-change eventHash`, { line });
     return {
         eventId,
@@ -1309,11 +1354,12 @@ function parseMilestoneScopeChangeEventRecord(parsed, milestoneId, line) {
         confirmationCodeBindingHash,
         ...(authorizationMode === undefined ? {} : { authorizationMode }),
         ...(autonomyContractEventHash === undefined ? {} : { autonomyContractEventHash }),
+        ...(remediationEvidence === undefined ? {} : { remediationEvidence }),
         eventHash,
     };
 }
 function requireMilestoneScopeChangeAuthorizationMode(value, milestoneId, line) {
-    if (value !== 'human' && value !== 'milestone-autonomy') {
+    if (value !== 'human' && value !== 'milestone-autonomy' && value !== 'audited-remediation') {
         throw new WorkflowError('STATE_CORRUPT', `Milestone ${milestoneId} scope-change authorizationMode is invalid.`, {
             line,
             value,
@@ -1321,6 +1367,109 @@ function requireMilestoneScopeChangeAuthorizationMode(value, milestoneId, line)
     }
     return value;
 }
+function parseAuditedRemediationEvidence(value, milestoneId, line) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new WorkflowError('STATE_CORRUPT', `Milestone ${milestoneId} remediation evidence must be an object.`, { line });
+    }
+    const record = value;
+    const allowedKeys = new Set([
+        'blockedTaskId',
+        'blockedTaskRevision',
+        'blockedBriefHash',
+        'blockedPlanHash',
+        'planRiskAuditEventId',
+        'planRiskAuditEventHash',
+        'remediationTaskId',
+        'predecessorTaskIds',
+    ]);
+    const extraKeys = Object.keys(record).filter((key) => !allowedKeys.has(key));
+    if (extraKeys.length > 0) {
+        throw new WorkflowError('STATE_CORRUPT', `Milestone ${milestoneId} remediation evidence contains unexpected fields.`, {
+            line,
+            extraKeys,
+        });
+    }
+    const evidence = {
+        blockedTaskId: requireNonEmptyString(record.blockedTaskId, 'remediation blockedTaskId', { line }),
+        blockedTaskRevision: requireInteger(record.blockedTaskRevision, 'remediation blockedTaskRevision', { line }),
+        blockedBriefHash: requireHash64(record.blockedBriefHash, 'remediation blockedBriefHash', { line }),
+        blockedPlanHash: requireHash64(record.blockedPlanHash, 'remediation blockedPlanHash', { line }),
+        planRiskAuditEventId: requireNonEmptyString(record.planRiskAuditEventId, 'remediation planRiskAuditEventId', { line }),
+        planRiskAuditEventHash: requireHash64(record.planRiskAuditEventHash, 'remediation planRiskAuditEventHash', { line }),
+        remediationTaskId: requireNonEmptyString(record.remediationTaskId, 'remediation remediationTaskId', { line }),
+        predecessorTaskIds: parseTaskIdArray(record.predecessorTaskIds, 'remediation predecessorTaskIds', { line }),
+    };
+    validateAuditedRemediationEvidence(evidence, evidence.planRiskAuditEventId);
+    return evidence;
+}
+function validateAuditedRemediationEvidence(evidence, eventId) {
+    if (!Number.isInteger(evidence.blockedTaskRevision) || evidence.blockedTaskRevision < 1) {
+        throw new WorkflowError('STATE_CORRUPT', 'Audited remediation blocked Task revision is invalid.', {
+            eventId,
+            blockedTaskRevision: evidence.blockedTaskRevision,
+        });
+    }
+    assertHash64(evidence.blockedBriefHash, 'Audited remediation blocked Brief hash');
+    assertHash64(evidence.blockedPlanHash, 'Audited remediation blocked Plan hash');
+    assertHash64(evidence.planRiskAuditEventHash, 'Audited remediation Plan Risk Audit event hash');
+    if (!evidence.blockedTaskId.trim()
+        || !evidence.planRiskAuditEventId.trim()
+        || !evidence.remediationTaskId.trim()
+        || evidence.predecessorTaskIds.length === 0
+        || new Set(evidence.predecessorTaskIds).size !== evidence.predecessorTaskIds.length
+        || evidence.predecessorTaskIds.includes(evidence.blockedTaskId)
+        || evidence.predecessorTaskIds.includes(evidence.remediationTaskId)) {
+        throw new WorkflowError('STATE_CORRUPT', 'Audited remediation evidence has invalid Task bindings.', {
+            eventId,
+            evidence,
+        });
+    }
+}
+function validateAuditedRemediationTopologyEvent(event) {
+    const evidence = event.remediationEvidence;
+    const semanticsBefore = {
+        outcome: event.before.outcome,
+        successSignal: event.before.successSignal,
+        acceptance: event.before.acceptance,
+        checks: event.before.checks,
+    };
+    const semanticsAfter = {
+        outcome: event.after.outcome,
+        successSignal: event.after.successSignal,
+        acceptance: event.after.acceptance,
+        checks: event.after.checks,
+    };
+    const expectedTaskIds = [...event.before.taskIds, evidence.remediationTaskId];
+    const beforeBlocked = event.before.memberships.find((membership) => membership.taskId === evidence.blockedTaskId);
+    const afterBlocked = event.after.memberships.find((membership) => membership.taskId === evidence.blockedTaskId);
+    const remediation = event.after.memberships.find((membership) => membership.taskId === evidence.remediationTaskId);
+    const expectedBlockedDependencies = [...new Set([
+            ...(beforeBlocked?.dependsOnTaskIds ?? []),
+            evidence.remediationTaskId,
+        ])].sort();
+    const unchangedMemberships = event.before.memberships.every((beforeMembership) => {
+        if (beforeMembership.taskId === evidence.blockedTaskId)
+            return true;
+        const afterMembership = event.after.memberships.find((candidate) => candidate.taskId === beforeMembership.taskId);
+        return canonicalJsonStringify(afterMembership) === canonicalJsonStringify(beforeMembership);
+    });
+    if (canonicalJsonStringify(semanticsBefore) !== canonicalJsonStringify(semanticsAfter)
+        || canonicalJsonStringify(event.after.taskIds) !== canonicalJsonStringify(expectedTaskIds)
+        || event.after.memberships.length !== event.before.memberships.length + 1
+        || beforeBlocked?.disposition !== 'required'
+        || afterBlocked?.disposition !== 'required'
+        || canonicalJsonStringify(afterBlocked?.dependsOnTaskIds ?? [])
+            !== canonicalJsonStringify(expectedBlockedDependencies)
+        || remediation?.disposition !== 'required'
+        || !remediation.reason.trim()
+        || canonicalJsonStringify(remediation.dependsOnTaskIds ?? [])
+            !== canonicalJsonStringify(evidence.predecessorTaskIds)
+        || canonicalJsonStringify(beforeBlocked?.dependsOnTaskIds ?? [])
+            !== canonicalJsonStringify(evidence.predecessorTaskIds)
+        || !unchangedMemberships) {
+        throw new WorkflowError('STATE_CORRUPT', 'Audited remediation scope-change event exceeds its additive topology authority.', { eventId: event.eventId, remediationEvidence: evidence });
+    }
+}
 function parseMilestoneScopeSnapshot(value, milestoneId, line, label) {
     if (!value || typeof value !== 'object' || Array.isArray(value)) {
         throw new WorkflowError('STATE_CORRUPT', `Milestone ${milestoneId} scope-change ${label} snapshot must be an object.`, { line });
@@ -1491,7 +1640,12 @@ function computeMilestoneScopeChangeBindingHash(input) {
                 authorizationMode: input.authorizationMode,
                 autonomyContractEventHash: input.autonomyContractEventHash,
             }
-            : {}),
+            : input.authorizationMode === 'audited-remediation'
+                ? {
+                    authorizationMode: input.authorizationMode,
+                    remediationEvidence: input.remediationEvidence,
+                }
+                : {}),
     }));
 }
 function assertSnapshotTaskIdsMatchMemberships(snapshot, milestoneId, details = {}) {