codex-workflow-v2 2.0.0-beta.13.6 → 2.0.0-beta.13.7

package/dist/src/workflow.js

@@ -15,12 +15,12 @@ import { WorkflowError } from './errors.js';
 import { withObservedRouteMetadata } from './observed-routes.js';
 import { bindGraphEvidence, createGraphRefreshRequest, fallbackGraphBinding, inspectGraphBinding, validateGraphRequestCurrent, } from './graph.js';
 import { inspectLocalDependency, inspectWorkflowVersions } from './diagnostics.js';
-import { appendTaskClaim, appendTaskHandback, appendTaskHandoff, appendTaskWriterCredentialReplacement, assertTaskClaimAllowed, assertTaskMutationAllowedByC1, defaultTaskWorkerActor, prepareTaskCorrectiveYield, readTaskC1Posture, } from './alpha6/handoff.js';
+import { appendTaskClaim, appendTaskHandback, appendTaskHandoff, appendTaskWriterCredentialReplacement, assertTaskClaimAllowed, assertTaskMutationAllowedByC1, defaultTaskWorkerActor, prepareTaskCorrectiveYield, readTaskC1Posture, readTaskHandoffEvents, } from './alpha6/handoff.js';
 import { assessDownstreamProofCarryover, assessDownstreamProofReplanRecovery, assessDownstreamProofRecovery, downstreamProofInvalidationSidecar, downstreamProofReplanRecoverySidecar, prepareDownstreamProofInvalidation, prepareDownstreamProofReplanRecovery, readDownstreamProofInvalidations, readDownstreamProofReplanRecoveries, hashDirtyWorktree, } from './alpha6/downstream-proof.js';
 import { applyAdoptionPosture, assertAdoptionBaselinePreserved, buildAdoptionPreparation, initializeProjectRegistrationAdoption, readCurrentAdoptionPosture, } from './alpha6/adoption.js';
 import { appendCurrentPlanRiskAudit, appendReboundPlanRiskAudit, buildCandidatePlanRiskAuditEvent, buildPlanRiskAuditEvent, readCurrentPlanRiskAudit, readPlanRiskAuditEvents, validatePlanRiskAuditCandidate, } from './alpha6/plan-risk.js';
 import { hashCompletedSteps, hashExecutionAuthorization, preparePreExecutionReplanEvent, preExecutionReplanSidecar, readCurrentPreExecutionReplan, } from './alpha6/preexecution-replan.js';
-import { assessRootCauseReplanDirtyCarryover, } from './alpha6/root-cause-replan-carryover.js';
+import { assessRootCauseReplanDirtyCarryover, matchesTerminalCorrectiveYield, } from './alpha6/root-cause-replan-carryover.js';
 import { appendCorrectiveDecisionEvent, appendPlanIntegrityRecoveryDecision, appendRemediationModeRecovery, appendStopEscalateOverride, assertCorrectiveAuditorIndependence, assertGuardedRemediationAttemptAllowed, defaultCorrectiveAuditorActor, effectiveStepAllowedWrites, findCurrentGuardedRemediationPosture, findRemediationModeRecoveryCandidate, findFailedGuardedStepRequiringCorrectiveDecision, readGuardedRemediationPostureForStep, readCorrectiveDecisionEvents, readRemediationEvents, deriveRollingCauseDecision, deriveCurrentCauseDecisionForTask, prepareRemediationEvent, prepareStopEscalateOverride, stopEscalateOverrideDecisionEventIds, } from './alpha6/remediation.js';
 import { assessPlanIntegrityRecovery, defaultPlanIntegrityRecoveryActor, } from './alpha6/plan-integrity.js';
 import { mechanicalCauseBindings, normalizeMechanicalFailures, } from './alpha6/remediation-cause.js';
@@ -4182,7 +4182,8 @@ export class WorkflowService {
         const task = snapshot.tasks.find((candidate) => candidate.id === taskId);
         if (!task)
             throw new WorkflowError('NOT_FOUND', `Task ${taskId} was not found in this repository.`);
-        const carryover = this.assessCurrentRootCauseReplanDirtyCarryover(snapshot.identity.repositoryRoot, task);
+        const candidate = inspectBoundedWorkflowDependencyCommit(snapshot.identity.repositoryRoot, headCommit(snapshot.identity.repositoryRoot));
+        const carryover = this.assessCurrentRootCauseReplanDirtyCarryover(snapshot.identity.repositoryRoot, task, undefined, candidate?.parentCommitSha);
         const preflight = this.inspectDependencyProvenanceCandidate(snapshot, task, null, null, null, null, carryover.eligible ? carryover.compatibility : null);
         if (!preflight.rootCauseReplan)
             return preflight;
@@ -4201,15 +4202,16 @@ export class WorkflowService {
             ...(preflight.parentCommitSha !== preflight.rootCauseReplan.sourceHeadCommit
                 ? ['Corrective carryover dependency parent must equal the bound source HEAD.'] : []),
             ...(preflight.parentCommitSha
-                && workflowDependencyVersionAt(snapshot.identity.repositoryRoot, preflight.parentCommitSha) !== '2.0.0-beta.13.5'
-                ? ['Corrective carryover dependency parent must declare exact source 2.0.0-beta.13.5.'] : []),
-            ...(preflight.dependencyCommits.at(-1)?.packageVersion !== '2.0.0-beta.13.6'
-                ? ['Corrective carryover dependency commit must declare exact target 2.0.0-beta.13.6.'] : []),
+                && workflowDependencyVersionAt(snapshot.identity.repositoryRoot, preflight.parentCommitSha) !== '2.0.0-beta.13.6'
+                ? ['Corrective carryover dependency parent must declare exact source beta.13.6.'] : []),
+            ...(preflight.dependencyCommits.at(-1)?.packageVersion !== PACKAGE_VERSION
+                ? [`Corrective carryover dependency commit must declare exact target ${PACKAGE_VERSION}.`] : []),
             ...(!baseDependency
                 || baseDependency.commitSha !== baseTip
-                || baseDependency.packageVersion !== '2.0.0-beta.13.6'
-                || workflowDependencyVersionAt(snapshot.identity.repositoryRoot, baseDependency.parentCommitSha) !== '2.0.0-beta.13.5'
-                ? ['Corrective carryover Milestone-base tip must be one exact 2.0.0-beta.13.5 to 2.0.0-beta.13.6 dependency-only commit.'] : []),
+                || baseDependency.packageVersion !== PACKAGE_VERSION
+                || workflowDependencyVersionAt(snapshot.identity.repositoryRoot, baseDependency.parentCommitSha)
+                    !== workflowDependencyVersionAt(snapshot.identity.repositoryRoot, preflight.parentCommitSha ?? '')
+                ? ['Corrective carryover Milestone-base tip must be one dependency-only commit with the same exact source and runtime target.'] : []),
         ];
         return bridgeBlockers.length === 0
             ? preflight
@@ -4222,14 +4224,14 @@ export class WorkflowService {
                 blockers: [...new Set([...preflight.blockers, ...bridgeBlockers])],
             };
     }
-    correctiveCarryoverUpdatePreflight(repository, taskId) {
+    correctiveCarryoverUpdatePreflight(repository, taskId, candidate = null) {
         const snapshot = this.observationSnapshot(repository);
         const task = snapshot.tasks.find((candidate) => candidate.id === taskId);
         if (!task)
             throw new WorkflowError('NOT_FOUND', `Task ${taskId} was not found in this repository.`);
-        const sourceVersion = '2.0.0-beta.13.5';
-        const targetVersion = '2.0.0-beta.13.6';
         const versions = inspectWorkflowVersions(snapshot.identity.repositoryRoot, [task.baseBranch]);
+        const sourceVersion = '2.0.0-beta.13.6';
+        const targetVersion = '2.0.0-beta.13.7';
         const sourceSurfaces = {
             declared: versions.declared,
             locked: versions.locked,
@@ -4237,8 +4239,11 @@ export class WorkflowService {
             currentBranch: versions.currentBranch,
             baseBranch: versions.milestoneBases.find((base) => base.branch === task.baseBranch)?.version ?? null,
         };
-        const assessment = this.assessCurrentRootCauseReplanDirtyCarryover(snapshot.identity.repositoryRoot, task);
         const c1 = readTaskC1Posture(this.store, task);
+        if (c1.state !== 'claimed') {
+            return this.consumedCarryoverSourceRecoveryPreflight(snapshot, task, sourceSurfaces, candidate);
+        }
+        const assessment = this.assessCurrentRootCauseReplanDirtyCarryover(snapshot.identity.repositoryRoot, task);
         const now = this.now().getTime();
         const activeLeases = snapshot.leases.filter((lease) => Date.parse(lease.expiresAt) > now);
         const staleLeases = snapshot.leases.filter((lease) => Date.parse(lease.expiresAt) <= now);
@@ -4322,6 +4327,155 @@ export class WorkflowService {
             blockers,
         };
     }
+    consumedCarryoverSourceRecoveryPreflight(snapshot, task, sourceSurfaces, candidate) {
+        const repositoryRoot = snapshot.identity.repositoryRoot;
+        const sourceVersion = '2.0.0-beta.13.6';
+        const targetVersion = '2.0.0-beta.13.7';
+        const c1 = readTaskC1Posture(this.store, task);
+        const recorded = [...(task.dependencyProvenanceRecoveries ?? [])].reverse().find((record) => record.rootCauseReplan && task.systemCommits.includes(record.commitSha))?.rootCauseReplan;
+        const currentHead = headCommit(repositoryRoot);
+        const dirtyFiles = changedFiles(repositoryRoot).sort();
+        const dirtyWorktreeHash = hashDirtyWorktree(repositoryRoot, dirtyFiles);
+        const navigation = this.next(repositoryRoot, task.id);
+        const action = String(navigation.action);
+        const stepId = typeof navigation.stepId === 'string' ? navigation.stepId : null;
+        const step = task.steps.find((candidate) => candidate.id === stepId) ?? null;
+        const terminal = readRemediationEvents(this.store, task)
+            .filter((event) => event.stepId === stepId && event.failureKind === 'checks-failed').at(-1);
+        const matchingYields = readTaskHandoffEvents(this.store, task).filter((event) => terminal && matchesTerminalCorrectiveYield(event, terminal, task.id));
+        const yielded = matchingYields.length === 1 ? matchingYields[0] : null;
+        const assessment = this.assessCurrentRootCauseReplanDirtyCarryover(repositoryRoot, task, stepId ?? undefined);
+        const missingClaimOnly = assessment.blockers.length === 1
+            && assessment.blockers[0].startsWith('Corrective carryover requires the retained claimed C1');
+        const rollingWave = navigation.rollingWave;
+        const sourceActionAllowed = (action === 'task plan-set' && step?.status === 'failed'
+            && rollingWave?.state === 'root-cause-replan-required' && !assessment.applicable && c1.state === 'none')
+            || (action === 'task handoff-prepare' && step?.status === 'planned' && missingClaimOnly && c1.state === 'none')
+            || (action === 'task claim' && step?.status === 'planned' && missingClaimOnly
+                && c1.state === 'pending' && c1.targetActor === yielded?.actor);
+        const blockers = [
+            ...(PACKAGE_VERSION !== targetVersion ? [`Runner must be the exact ${targetVersion} compatibility target.`] : []),
+            ...Object.entries(sourceSurfaces).filter(([, version]) => version !== sourceVersion)
+                .map(([surface]) => `${surface} Workflow version must equal the exact ${sourceVersion} source.`),
+            ...observationPreflightBlockers(snapshot.observation),
+            ...(snapshot.leases.length > 0 ? ['No active or stale writer lease may exist before source recovery.'] : []),
+            ...(snapshot.observation.pendingProjectTransactions.length
+                + snapshot.observation.pendingMilestoneTransactions.length
+                + snapshot.observation.pendingTaskTransactions.length
+                + snapshot.observation.corruptTaskTransactions.length
+                + snapshot.observation.coreTaskOperations.length > 0 ? ['No pending or corrupt transaction or Core operation may exist.'] : []),
+            ...(!recorded || recorded.stepId === stepId
+                || task.steps.find((candidate) => candidate.id === recorded.stepId)?.status !== 'completed'
+                ? ['A different, verified completed Step must own the historical carryover binding.'] : []),
+            ...(!sourceActionAllowed ? ['No exact source Plan replacement or original-Worker handoff action is eligible.'] : []),
+            ...(!(task.status === 'ready' || (action === 'task plan-set' && task.status === 'needs_fix'))
+                || task.workspaceOwner !== 'local'
+                || currentBranch(repositoryRoot) !== task.taskBranch
+                || task.steps.some((candidate) => candidate.status === 'in_progress')
+                ? ['The Task must retain its local, no-running-Step source recovery boundary.'] : []),
+            ...(!step || dirtyFiles.length === 0
+                || dirtyFiles.some((file) => !pathAllowed(file, step.allowedWrites) || pathAllowed(file, step.forbiddenScope))
+                ? ['Retained dirty files must remain inside the exact current Step scope.'] : []),
+            ...(!terminal || terminal.failureEvidence.completionCommit !== currentHead
+                || terminal.failureEvidence.dirtyWorktreeHash !== dirtyWorktreeHash
+                ? ['The terminal repeated failure HEAD and dirty-byte binding must remain unchanged.'] : []),
+            ...(!yielded || !terminal || yielded.planHash === null
+                || !Number.isFinite(Date.parse(yielded.recordedAt))
+                || Date.parse(yielded.recordedAt) < Date.parse(terminal.recordedAt)
+                ? ['The terminal failure must retain its exact completed original-Worker corrective yield.'] : []),
+        ];
+        let candidateBinding = null;
+        if (action === 'task plan-set') {
+            if (!candidate) {
+                blockers.push('Source Plan replacement requires candidate Plan and independent Plan Risk Audit inputs.');
+            }
+            else {
+                try {
+                    validatePlan(candidate.plan);
+                    const retained = deriveCompletedStepCarryover(task, candidate.plan.steps);
+                    if (task.steps.some((completed) => completed.status === 'completed' && !retained.has(completed.id))) {
+                        throw new Error('Candidate must preserve every completed Step definition and its execution authority exactly.');
+                    }
+                    const correctiveStep = candidate.plan.steps.find((candidateStep) => candidateStep.id === stepId);
+                    if (!correctiveStep || dirtyFiles.some((file) => !pathAllowed(file, correctiveStep.allowedWrites) || pathAllowed(file, correctiveStep.forbiddenScope))) {
+                        throw new Error('Candidate must retain the exact failed Step and confine every dirty path to its replacement scope.');
+                    }
+                    if (correctiveStep.dependencies.some((dependency) => !retained.has(dependency))) {
+                        throw new Error('Candidate corrective Step dependencies must retain completed execution authority.');
+                    }
+                    if (candidate.plan.objective !== task.planObjective
+                        || canonicalJsonStringify(candidate.plan.requirements) !== canonicalJsonStringify(task.requirements)
+                        || canonicalJsonStringify(candidate.plan.acceptance) !== canonicalJsonStringify(task.acceptance)) {
+                        throw new Error('Candidate cannot change Task objective, requirements or acceptance.');
+                    }
+                    const map = this.assertKnowledgeMapBinding(repositoryRoot, task.projectId, candidate.plan.knowledgeMapRevision, candidate.plan.knowledgeMapHash);
+                    this.validateKnowledgeTargets(map, candidate.plan);
+                    const prepared = prepareCorrectiveReplanCandidate(task, candidate.plan);
+                    if (!task.planHash || normalizePlanKnowledgeBinding(prepared.planBytes, 'source recovery candidate').semanticHash
+                        === normalizePlanKnowledgeBinding(readVerifiedPlanArtifact(this.store.taskRoot(task.projectId, task.id), task.planHash, task.planHash), 'current failed Plan').semanticHash) {
+                        throw new Error('Candidate must change the failed Plan semantics before source recovery.');
+                    }
+                    if (!['approved', 'approved-with-rationale'].includes(candidate.planRiskAudit.decision)) {
+                        throw new Error('Source recovery candidate requires a positive independent Plan Risk Audit.');
+                    }
+                    const auditTask = {
+                        ...task, status: 'awaiting_execution_authorization', planHash: prepared.planHash,
+                        knowledgeMapRevision: candidate.plan.knowledgeMapRevision,
+                        knowledgeMapHash: candidate.plan.knowledgeMapHash,
+                        steps: candidate.plan.steps.map((candidateStep) => retained.get(candidateStep.id) ?? {
+                            ...candidateStep, status: 'planned', evidence: null, failurePause: null,
+                        }),
+                    };
+                    validatePlanRiskAuditCandidate(this.store, auditTask, candidate.planRiskAudit);
+                    candidateBinding = {
+                        candidatePlanHash: prepared.planHash,
+                        candidateInputHash: sha256Hex(canonicalJsonStringify(candidate.plan)),
+                        riskAuditInputHash: sha256Hex(canonicalJsonStringify(candidate.planRiskAudit)),
+                    };
+                }
+                catch (error) {
+                    blockers.push(error instanceof Error ? error.message : String(error));
+                }
+            }
+        }
+        try {
+            validateTaskHistory(repositoryRoot, task);
+            this.assertTaskKnowledgeBinding(repositoryRoot, task);
+            const sourceAudit = [...readPlanRiskAuditEvents(this.store, task)].reverse().find((event) => event.taskRevision <= (terminal?.failureEvidence.executionTaskRevision ?? -1));
+            if (!sourceAudit || !yielded?.planHash || !task.planHash
+                || normalizePlanKnowledgeBinding(readVerifiedPlanArtifact(this.store.taskRoot(task.projectId, task.id), sourceAudit.planHash, task.planHash), 'terminal source').semanticHash
+                    !== normalizePlanKnowledgeBinding(readVerifiedPlanArtifact(this.store.taskRoot(task.projectId, task.id), yielded.planHash, task.planHash), 'terminal corrective yield').semanticHash) {
+                throw new Error('Terminal failure and exact corrective yield must share a verified source Plan.');
+            }
+        }
+        catch (error) {
+            blockers.push(error instanceof Error ? error.message : String(error));
+        }
+        const binding = {
+            taskId: task.id, taskRevision: task.revision, stepId, briefHash: task.briefHash,
+            planHash: task.planHash, planRiskAuditEventHash: readCurrentPlanRiskAudit(this.store, task)?.audit.eventHash ?? null,
+            sourceHeadCommit: currentHead, dirtyFiles, dirtyWorktreeHash,
+            completedStepsHash: hashCompletedSteps(task), historicalCarryoverHash: recorded?.compatibilityHash ?? null,
+            terminalRemediationEventHash: terminal?.eventHash ?? null,
+            correctiveYieldEventHash: yielded?.eventHash ?? null, originalWorker: yielded?.actor ?? null,
+            c1Posture: c1.state,
+            candidateBinding,
+        };
+        return {
+            readOnly: true, eligible: false, sourceVersion, targetVersion, ...binding,
+            action: null, transportAllowed: false,
+            ...(action === 'task plan-set' ? { taskPlanContract: navigation.taskPlanContract } : {}),
+            compatibilityHash: sha256Hex(canonicalJsonStringify(binding)),
+            sourceRecovery: blockers.length === 0 ? {
+                eligible: true, action,
+                ...(action === 'task plan-set' ? { ...candidateBinding } : {}),
+                ...(action === 'task handoff-prepare' ? { targetActor: yielded.actor } : {}),
+                ...(action === 'task claim' ? { actor: yielded.actor } : {}),
+                instruction: 'Execute only this exact action with the installed source package; run source status then next and repeat this read-only preflight. Ordinary Plan Risk Audit and execution authorization retain their normal gates.',
+            } : null,
+            blockers,
+        };
+    }
     historicalStepProvenanceRecoveryPreflight(repository, taskId) {
         const snapshot = this.observationSnapshot(repository);
         if (snapshot.observation.kind !== 'assessment') {
@@ -7512,21 +7666,67 @@ export class WorkflowService {
             },
         }, activeDownstreamProof, downstreamProofReplan, historicalStepProvenance, planIntegrity, rootCauseReplan);
     }
-    assessCurrentRootCauseReplanDirtyCarryover(repositoryRoot, task, stepId) {
-        const recorded = [...(task.dependencyProvenanceRecoveries ?? [])].reverse().find((record) => record.rootCauseReplan
-            && task.systemCommits.includes(record.commitSha))?.rootCauseReplan ?? null;
+    assessCurrentRootCauseReplanDirtyCarryover(repositoryRoot, task, stepId, historyHead) {
+        const recordedRecovery = [...(task.dependencyProvenanceRecoveries ?? [])].reverse().find((record) => record.rootCauseReplan
+            && task.systemCommits.includes(record.commitSha)) ?? null;
+        const recorded = recordedRecovery?.rootCauseReplan ?? null;
         if (recorded) {
-            if (stepId && stepId !== recorded.stepId) {
+            const recordedStep = task.steps.find((candidate) => candidate.id === recorded.stepId) ?? null;
+            if (!recordedStep) {
                 return {
                     applicable: true,
                     eligible: false,
                     compatibility: null,
-                    blockers: [`Recorded corrective carryover is bound to ${recorded.stepId}, not requested ${stepId}.`],
+                    blockers: [`Recorded corrective carryover Step ${recorded.stepId} is missing from the current Plan.`],
                 };
             }
-            return assessRootCauseReplanDirtyCarryover(this.store, repositoryRoot, task, recorded.stepId, {
-                binding: recorded,
-            });
+            if (recordedStep.status === 'completed') {
+                const blockers = [];
+                if (!recordedStep.evidence) {
+                    blockers.push(`Completed corrective carryover Step ${recorded.stepId} has no execution evidence.`);
+                }
+                try {
+                    validateTaskHistory(repositoryRoot, task, historyHead);
+                    const sourceAudit = readPlanRiskAuditEvents(this.store, task).find((event) => event.eventId === recorded.replacementPlanRiskAuditEventId
+                        && event.eventHash === recorded.replacementPlanRiskAuditEventHash) ?? null;
+                    const classification = sourceAudit?.stepClassifications.find((candidate) => candidate.stepId === recorded.stepId) ?? null;
+                    if (!sourceAudit || !classification) {
+                        blockers.push('Completed corrective carryover Step lost its exact replacement Plan Risk Audit binding.');
+                    }
+                    else if (classification.reviewRequired
+                        && recordedStep.evidence
+                        && !verifiedHistoricalStepReviewBindings(this.store, task).some((binding) => binding.stepId === recorded.stepId
+                            && binding.commitSha === recordedStep.evidence.commitSha)) {
+                        blockers.push(`Completed corrective carryover Step ${recorded.stepId} lacks verified strict-review proof.`);
+                    }
+                }
+                catch (error) {
+                    blockers.push(error instanceof Error ? error.message : String(error));
+                }
+                if (blockers.length > 0) {
+                    return {
+                        applicable: true,
+                        eligible: false,
+                        compatibility: null,
+                        blockers: [...new Set(blockers)],
+                    };
+                }
+                // A reviewed, history-valid completed Step consumed this carryover. Keep its
+                // immutable recovery record, but let later Steps use their own lifecycle route.
+            }
+            else {
+                if (stepId && stepId !== recorded.stepId) {
+                    return {
+                        applicable: true,
+                        eligible: false,
+                        compatibility: null,
+                        blockers: [`Recorded corrective carryover is bound to ${recorded.stepId}, not requested ${stepId}.`],
+                    };
+                }
+                return assessRootCauseReplanDirtyCarryover(this.store, repositoryRoot, task, recorded.stepId, {
+                    binding: recorded,
+                });
+            }
         }
         const candidates = task.steps
             .filter((step) => step.status === 'planned' && (!stepId || step.id === stepId))