codex-workflow-v2 2.0.0-beta.13.14 → 2.0.0-beta.13.16

package/src/alpha6/failed-step-planning-recovery.ts

@@ -0,0 +1,88 @@
+import { readFileSync } from 'node:fs';
+import path from 'node:path';
+import type { TaskState } from '../contracts.js';
+import type { FileStateStore } from '../state/store.js';
+import { WorkflowError } from '../errors.js';
+import { hashKnowledgeMap } from '../memory.js';
+import { canonicalJsonStringify, sha256Hex } from './store-sidecars.js';
+import { readCurrentPlanRiskAudit, readCurrentPlanningObstructionAudit, readPlanRiskAuditEvents } from './plan-risk.js';
+import { assertKnowledgeBindingOnlyPlanChange } from '../alpha7/corrective-recovery.js';
+
+/** A stopped rebound Plan is evidence for repair, never execution authority. */
+export function readFailedStepPlanningRecovery(store: FileStateStore, task: TaskState) {
+  if (task.status !== 'awaiting_execution_authorization' || !task.planHash
+    || task.workspaceOwner === null || !task.steps.some(step => step.status === 'failed')
+    || task.steps.some(step => step.status === 'in_progress')) return null;
+  const current = readCurrentPlanningObstructionAudit(store, task);
+  if (!current || current.audit.decision !== 'stop-escalate') return null;
+  const fail = (message: string): never => { throw new WorkflowError('TRANSITION_BLOCKED', message, { taskId: task.id }); };
+  const map = store.readKnowledgeMap(task.projectId);
+  if (map.status !== 'active' || map.revision !== task.knowledgeMapRevision || hashKnowledgeMap(map) !== task.knowledgeMapHash)
+    fail('Planning recovery requires the current active Knowledge binding.');
+  const audits = readPlanRiskAuditEvents(store, task);
+  const root = store.taskRoot(task.projectId, task.id);
+  let hash = task.planHash;
+  let knowledgeRevision = task.knowledgeMapRevision;
+  let knowledgeHash = task.knowledgeMapHash;
+  const visited = new Set<string>();
+  const plan = (h: string) => {
+    const text = readFileSync(h === task.planHash ? path.join(root, 'plan.md') : path.join(root, '.versions', `plan.md.${h}`), 'utf8');
+    if (sha256Hex(text) !== h) fail('Planning recovery Plan artifact hash mismatch.');
+    return text;
+  };
+  while (!visited.has(hash)) {
+    visited.add(hash);
+    const links = task.knowledgeRebinds.filter(record => record.reboundPlanHash === hash);
+    if (links.length !== 1) return fail('Planning recovery requires an unambiguous Knowledge rebind chain.');
+    const link = links[0]!;
+    if (link.toKnowledgeMapRevision !== knowledgeRevision || link.toKnowledgeMapHash !== knowledgeHash
+      || !link.previousPlanHash) fail('Planning recovery Knowledge rebind endpoints are stale.');
+    const before = plan(link.previousPlanHash), after = plan(hash);
+    assertKnowledgeBindingOnlyPlanChange(before, after);
+    if (!before.includes(`- Knowledge map: revision ${link.fromKnowledgeMapRevision}, hash ${link.fromKnowledgeMapHash}\n`)
+      || !after.includes(`- Knowledge map: revision ${link.toKnowledgeMapRevision}, hash ${link.toKnowledgeMapHash}\n`))
+      fail('Planning recovery artifact Knowledge endpoints differ from the recorded rebind.');
+    hash = link.previousPlanHash;
+    knowledgeRevision = link.fromKnowledgeMapRevision;
+    knowledgeHash = link.fromKnowledgeMapHash;
+    const baseline = audits.filter(a => a.planHash === hash && a.briefHash === task.briefHash
+      && a.knowledgeMapRevision === knowledgeRevision && a.knowledgeMapHash === knowledgeHash
+      && ['approved', 'approved-with-rationale'].includes(a.decision)
+      && audits.indexOf(a) < audits.findIndex(event => event.eventHash === current.audit.eventHash)
+      && task.authorizations.some(grant => grant.kind === 'execution' && grant.decision === 'superseded'
+        && grant.planHash === a.planHash && grant.briefHash === a.briefHash
+        && Date.parse(grant.recordedAt) >= Date.parse(a.recordedAt))).at(-1);
+    if (!baseline) continue;
+    // A negative audit may append an observed counterexample without erasing the
+    // historical proof. Prefix preservation is NOT proof of semantic strengthening:
+    // both audits remain planning evidence, and replacement requires its own gates.
+    const obstructionClassifications = structuredClone(current.audit.stepClassifications);
+    for (const [stepIndex, classification] of obstructionClassifications.entries()) {
+      const original = baseline.stepClassifications[stepIndex];
+      if (!original) return fail('Planning recovery must preserve the approved Step classification ordering.');
+      const proofs = classification.proofObligations ?? [], originalProofs = original.proofObligations ?? [];
+      if (proofs.length !== originalProofs.length)
+        fail('Planning recovery must preserve the approved proof tuple count and ordering.');
+      for (const [proofIndex, proof] of proofs.entries()) {
+        const originalProof = originalProofs[proofIndex]!;
+        for (const field of ['counterexample', 'expectedResult'] as const) {
+          if (!proof[field].startsWith(originalProof[field]))
+            fail('Planning recovery cannot truncate or replace historical proof narratives.');
+          proof[field] = originalProof[field];
+        }
+      }
+    }
+    if (canonicalJsonStringify(baseline.stepClassifications) !== canonicalJsonStringify(obstructionClassifications))
+      fail('Planning recovery must preserve the approved risk classifications and proof tuples.');
+    const grants = task.authorizations.filter(a => a.kind === 'execution' && a.decision === 'superseded'
+      && a.planHash === baseline.planHash && a.briefHash === baseline.briefHash
+      && Date.parse(a.recordedAt) >= Date.parse(baseline.recordedAt));
+    if (grants.length !== 1) fail('Planning recovery requires one historical superseded Plan authorization.');
+    return { current, baseline, priorAuthorization: grants[0]!, authority: 'planning-only' as const };
+  }
+  return fail('Planning recovery Knowledge rebind chain contains a cycle.');
+}
+
+export function readCorrectivePlanningAudit(store: FileStateStore, task: TaskState) {
+  return readFailedStepPlanningRecovery(store, task)?.current ?? readCurrentPlanRiskAudit(store, task);
+}