codex-workflow-v2 2.0.0-beta.13.8 → 2.0.0-beta.14

package/src/lifecycle/canonical-hash.ts

@@ -0,0 +1,28 @@
+import { createHash } from 'node:crypto';
+
+type JsonPrimitive = boolean | null | number | string;
+export type CanonicalJsonValue = JsonPrimitive | CanonicalJsonValue[] | { [key: string]: CanonicalJsonValue };
+
+const EDITORIAL_KEYS = new Set(['description']);
+
+export function hashCanonical(value: unknown): string {
+  return createHash('sha256').update(JSON.stringify(canonicalize(value))).digest('hex');
+}
+
+function canonicalize(value: unknown): CanonicalJsonValue {
+  if (value === null || typeof value === 'boolean' || typeof value === 'string') return value;
+  if (typeof value === 'number') {
+    if (!Number.isFinite(value)) throw new TypeError('Canonical hashes do not support non-finite numbers.');
+    return value;
+  }
+  if (Array.isArray(value)) return value.map((entry) => canonicalize(entry));
+  if (typeof value === 'object') {
+    return Object.fromEntries(
+      Object.entries(value)
+        .filter(([key, entry]) => entry !== undefined && !EDITORIAL_KEYS.has(key))
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([key, entry]) => [key, canonicalize(entry)]),
+    );
+  }
+  throw new TypeError(`Unsupported canonical hash value: ${typeof value}`);
+}

package/src/lifecycle/catalog.ts

@@ -0,0 +1,202 @@
+import {
+  catalogDefinitionManifestHash, hashCanonical, runtimeCatalogHash, runtimeSemanticFingerprint,
+  transitionDefinitionManifestHash,
+} from './fingerprint.js';
+import { transitionSemanticRegistry } from './semantic-registry.js';
+import {
+  TRANSITION_DEFINITION_FORMAT_VERSION,
+  type EffectCondition, type ExecutableTransitionDefinition, type GuardId, type RegisteredRef,
+  type SerializedTransitionDefinition, type TransitionDefinitionMetadata,
+  type TransitionEffectNode, type TransitionId, type VersionedRegistryEntry,
+} from './types.js';
+
+type AnyDefinition = ExecutableTransitionDefinition<unknown, unknown>;
+type DefinitionLike = AnyDefinition | SerializedTransitionDefinition | TransitionDefinitionMetadata;
+
+export type TransitionSemanticValidationRuleId =
+  | 'validation.atomicity.contract-invalid' | 'validation.definition.format-invalid'
+  | 'validation.definition.manifest-mismatch' | 'validation.effect.graph-invalid'
+  | 'validation.fingerprint.alias-mismatch' | 'validation.fingerprint.runtime-mismatch'
+  | 'validation.guard.evaluator-mismatch' | 'validation.guard.namespace-invalid'
+  | 'validation.namespace.transition-invalid' | 'validation.race.revalidation-invalid'
+  | 'validation.reference.unresolved' | 'validation.semantic-id.duplicate';
+
+export interface TransitionSemanticValidationIssue {
+  readonly ruleId: TransitionSemanticValidationRuleId;
+  readonly path: string;
+  readonly ref?: string;
+  readonly message: string;
+}
+
+export interface TransitionSemanticValidationReport {
+  readonly valid: boolean;
+  readonly issues: readonly TransitionSemanticValidationIssue[];
+  readonly reportHash: string;
+}
+
+export class GuardedTransitionCatalog {
+  readonly #definitions: ReadonlyMap<TransitionId, AnyDefinition>;
+  readonly catalogHash: string;
+  readonly catalogDefinitionManifestHash: string;
+
+  constructor(definitions: readonly AnyDefinition[]) {
+    const indexed = new Map<TransitionId, AnyDefinition>();
+    for (const definition of definitions) {
+      const id = definition.metadata.transitionId;
+      if (indexed.has(id)) throw new TypeError(`validation.semantic-id.duplicate ${id}`);
+      const semantic = validateTransitionDefinitionSemantics(definition);
+      if (!semantic.valid) throw new TypeError(`${semantic.issues[0]!.ruleId} ${id}: ${semantic.issues[0]!.message}`);
+      if (definition.guards.length !== definition.metadata.guards.length
+        || definition.guards.some((guard, index) => guard.metadata.guardId !== definition.metadata.guards[index]?.guardId)) {
+        throw new TypeError(`validation.guard.evaluator-mismatch ${id}`);
+      }
+      indexed.set(id, definition);
+    }
+    this.#definitions = indexed;
+    this.catalogHash = runtimeCatalogHash(this.serialize());
+    this.catalogDefinitionManifestHash = catalogDefinitionManifestHash(this.serialize());
+  }
+
+  has(id: TransitionId): boolean { return this.#definitions.has(id); }
+  get<TSnapshot, TBindings>(id: TransitionId): ExecutableTransitionDefinition<TSnapshot, TBindings> {
+    const definition = this.#definitions.get(id);
+    if (!definition) throw new TypeError(`Unknown transition definition: ${id}`);
+    return definition as ExecutableTransitionDefinition<TSnapshot, TBindings>;
+  }
+  serialize(): SerializedTransitionDefinition[] {
+    return structuredClone([...this.#definitions.values()].map((definition) => ({
+      ...definition.metadata,
+      runtimeSemanticFingerprint: definition.runtimeSemanticFingerprint,
+      semanticFingerprint: definition.semanticFingerprint,
+      definitionManifestHash: definition.definitionManifestHash,
+    })).sort((left, right) => left.transitionId.localeCompare(right.transitionId)));
+  }
+}
+
+export function validateTransitionDefinitionSemantics(definition: DefinitionLike): TransitionSemanticValidationReport {
+  const issues: TransitionSemanticValidationIssue[] = [];
+  let unpacked: ReturnType<typeof unpack>;
+  try { unpacked = unpack(definition); }
+  catch (error) { issue(issues, 'validation.reference.unresolved', '/', message(error)); return report(issues); }
+  const metadata = unpacked.metadata;
+  if (metadata.definitionFormatVersion !== TRANSITION_DEFINITION_FORMAT_VERSION) issue(issues, 'validation.definition.format-invalid', '/definitionFormatVersion', 'Definition format must be 4.');
+  const namespace = metadata.entity === 'step' ? 'task' : metadata.entity === 'project-memory' ? 'project' : metadata.entity;
+  if (!metadata.transitionId.startsWith(`${namespace}.`)) issue(issues, 'validation.namespace.transition-invalid', '/transitionId', 'Transition namespace does not match entity.', metadata.transitionId);
+  if (!metadata.guardNamespace.startsWith(`${namespace}.`)) issue(issues, 'validation.guard.namespace-invalid', '/guardNamespace', 'Guard namespace does not match entity.');
+  let runtime = '';
+  try { runtime = runtimeSemanticFingerprint(metadata); }
+  catch (error) { issue(issues, 'validation.reference.unresolved', referencePath(error, metadata), message(error), referenceKey(error)); }
+  if (unpacked.runtime && runtime && unpacked.runtime !== runtime) issue(issues, 'validation.fingerprint.runtime-mismatch', '/runtimeSemanticFingerprint', 'Runtime fingerprint is stale.');
+  if (unpacked.semantic && unpacked.semantic !== unpacked.runtime) issue(issues, 'validation.fingerprint.alias-mismatch', '/semanticFingerprint', 'Deprecated alias is stale.');
+  try {
+    const manifest = transitionDefinitionManifestHash(metadata, runtime);
+    if (unpacked.manifest && unpacked.manifest !== manifest) issue(issues, 'validation.definition.manifest-mismatch', '/definitionManifestHash', 'Definition manifest is stale.');
+  } catch (error) { issue(issues, 'validation.reference.unresolved', '/readinessManifest', message(error), referenceKey(error)); }
+  const inputRefs = new Set(metadata.inputContract.map((entry) => refKey(entry.input)));
+  unique(metadata.inputContract.map((entry) => refKey(entry.input)), '/inputContract', issues);
+  const guards = new Map<GuardId, TransitionDefinitionMetadata['guards'][number]>();
+  metadata.guards.forEach((guard, index) => {
+    if (!guard.guardId.startsWith(`${metadata.guardNamespace}.`)) issue(issues, 'validation.guard.namespace-invalid', `/guards/${index}/guardId`, 'Guard is outside namespace.');
+    if (guards.has(guard.guardId)) issue(issues, 'validation.semantic-id.duplicate', `/guards/${index}/guardId`, 'Duplicate guard.', guard.guardId);
+    guards.set(guard.guardId, guard);
+    const evaluator = exactRef(transitionSemanticRegistry.guardEvaluators, guard.evaluator);
+    if (!evaluator) issue(issues, 'validation.reference.unresolved', `/guards/${index}/evaluator`, 'Guard evaluator is unresolved.', refKey(guard.evaluator));
+    else if (evaluator.transitionId !== metadata.transitionId || evaluator.guardId !== guard.guardId) issue(issues, 'validation.guard.evaluator-mismatch', `/guards/${index}/evaluator`, 'Evaluator does not bind this guard.', refKey(guard.evaluator));
+    guard.requiredInputs.forEach((input) => {
+      if (!inputRefs.has(refKey(input))) issue(issues, 'validation.guard.evaluator-mismatch', `/guards/${index}/requiredInputs`, 'Guard input is outside contract.', refKey(input));
+    });
+  });
+  metadata.inputContract.forEach((entry, index) => {
+    if (entry.required && !metadata.guards.some((guard) => guard.requiredInputs.some((input) => refKey(input) === refKey(entry.input)))) issue(issues, 'validation.guard.evaluator-mismatch', `/inputContract/${index}`, 'Required input has no guard.', refKey(entry.input));
+  });
+  validateEffects(metadata, guards, inputRefs, issues);
+  validateRaces(metadata, guards, issues);
+  validateAtomicity(metadata, issues);
+  return report(issues);
+}
+
+function validateEffects(metadata: TransitionDefinitionMetadata, guards: ReadonlyMap<GuardId, unknown>, inputs: ReadonlySet<string>, issues: TransitionSemanticValidationIssue[]): void {
+  const nodes = metadata.effects.orderedNodes;
+  unique(nodes.map((node) => node.effectId), '/effects/orderedNodes', issues);
+  const byId = new Map(nodes.map((node) => [node.effectId, node]));
+  nodes.forEach((node, index) => {
+    if (node.ordinal !== index) issue(issues, 'validation.effect.graph-invalid', `/effects/orderedNodes/${index}/ordinal`, 'Effect ordinals are not contiguous.');
+    node.dependsOn.forEach((dependency) => {
+      if (!byId.has(dependency) || dependency === node.effectId || depends(byId.get(dependency), node.effectId, byId)) issue(issues, 'validation.effect.graph-invalid', `/effects/orderedNodes/${index}/dependsOn`, 'Effect graph is cyclic or unresolved.', dependency);
+    });
+    node.conditions.forEach((condition, conditionIndex) => validateCondition(condition, `/effects/orderedNodes/${index}/conditions/${conditionIndex}`, guards, inputs, issues));
+  });
+  unique(metadata.effects.postconditions.map((entry) => entry.postconditionId), '/effects/postconditions', issues);
+  metadata.effects.postconditions.forEach((entry, index) => {
+    if (entry.effectNodeIds.length === 0 || entry.effectNodeIds.some((id) => !byId.has(id))) issue(issues, 'validation.effect.graph-invalid', `/effects/postconditions/${index}/effectNodeIds`, 'Postcondition does not bind effects.');
+  });
+}
+
+function validateCondition(condition: EffectCondition, path: string, guards: ReadonlyMap<GuardId, unknown>, inputs: ReadonlySet<string>, issues: TransitionSemanticValidationIssue[]): void {
+  if (condition.kind === 'input-present' ? !inputs.has(refKey(condition.input)) : !guards.has(condition.guardId)) issue(issues, 'validation.effect.graph-invalid', path, 'Effect condition is unresolved.');
+}
+
+function validateRaces(metadata: TransitionDefinitionMetadata, guards: ReadonlyMap<GuardId, TransitionDefinitionMetadata['guards'][number]>, issues: TransitionSemanticValidationIssue[]): void {
+  unique(metadata.admissionBoundary.orderedRevalidations.map((entry) => entry.revalidationId), '/admissionBoundary/orderedRevalidations', issues);
+  unique(metadata.racePreconditions.map((entry) => entry.raceId), '/racePreconditions', issues);
+  metadata.admissionBoundary.orderedRevalidations.forEach((entry, index) => {
+    const race = metadata.racePreconditions.filter((candidate) => candidate.raceId === entry.raceId && candidate.revalidationId === entry.revalidationId);
+    const guard = guards.get(entry.guardId);
+    if (entry.ordinal !== index || race.length !== 1 || race[0]!.guardId !== entry.guardId || !guard || refKey(guard.evaluator) !== refKey(entry.evaluator)) issue(issues, 'validation.race.revalidation-invalid', `/admissionBoundary/orderedRevalidations/${index}`, 'Race and revalidation are not exact.', entry.raceId);
+  });
+}
+
+function validateAtomicity(metadata: TransitionDefinitionMetadata, issues: TransitionSemanticValidationIssue[]): void {
+  const atomicity = metadata.atomicity;
+  const writes = metadata.effects.orderedNodes.filter((entry) => entry.operation !== 'preserve').length;
+  if (atomicity.classification === 'single-write' && writes !== 1) issue(issues, 'validation.atomicity.contract-invalid', '/atomicity/classification', 'single-write requires exactly one write.');
+  if (atomicity.classification === 'read-only' && writes !== 0) issue(issues, 'validation.atomicity.contract-invalid', '/atomicity/classification', 'read-only cannot write.');
+  if (atomicity.classification.includes('multi-write') && writes < 2) issue(issues, 'validation.atomicity.contract-invalid', '/atomicity/classification', 'multi-write requires multiple writes.');
+  if (atomicity.classification === 'non-transactional-multi-write' && atomicity.journal.mode !== 'none') issue(issues, 'validation.atomicity.contract-invalid', '/atomicity/journal', 'Nontransactional write cannot claim journal.');
+  const postconditions = new Set(metadata.effects.postconditions.map((entry) => entry.postconditionId));
+  if (atomicity.readback.postconditionIds.length !== postconditions.size || atomicity.readback.postconditionIds.some((id) => !postconditions.has(id))) issue(issues, 'validation.atomicity.contract-invalid', '/atomicity/readback/postconditionIds', 'Readback does not cover postconditions.');
+}
+
+function unpack(definition: DefinitionLike) {
+  if ('metadata' in definition) return { metadata: definition.metadata, runtime: definition.runtimeSemanticFingerprint, semantic: definition.semanticFingerprint, manifest: definition.definitionManifestHash };
+  if ('runtimeSemanticFingerprint' in definition) {
+    const { runtimeSemanticFingerprint: runtime, semanticFingerprint: semantic, definitionManifestHash: manifest, ...metadata } = definition;
+    return { metadata, runtime, semantic, manifest };
+  }
+  return { metadata: definition, runtime: null, semantic: null, manifest: null };
+}
+
+function exactRef<T extends VersionedRegistryEntry<string>>(entries: readonly T[], ref: RegisteredRef<string>): T | undefined {
+  const matches = entries.filter((entry) => refKey(entry) === refKey(ref));
+  return matches.length === 1 ? matches[0] : undefined;
+}
+function referencePath(error: unknown, metadata: TransitionDefinitionMetadata): string {
+  const key = referenceKey(error); return key ? referencePaths(metadata).get(key) ?? '/' : '/';
+}
+function referencePaths(root: unknown): Map<string, string> {
+  const result = new Map<string, string>(); visit(root, ''); return result;
+  function visit(value: unknown, path: string): void {
+    if (Array.isArray(value)) return value.forEach((entry, index) => visit(entry, `${path}/${index}`));
+    if (value === null || typeof value !== 'object') return;
+    const candidate = value as Record<string, unknown>;
+    if (typeof candidate.id === 'string' && Number.isInteger(candidate.version)) result.set(`${candidate.id}@${candidate.version}`, path || '/');
+    Object.entries(candidate).forEach(([key, entry]) => visit(entry, `${path}/${key}`));
+  }
+}
+function referenceKey(error: unknown): string | undefined { return error instanceof Error ? (error as Error & { ref?: string }).ref : undefined; }
+function refKey(ref: RegisteredRef<string>): string { return `${ref.id}@${ref.version}`; }
+function message(error: unknown): string { return error instanceof Error ? error.message : String(error); }
+function unique(values: readonly string[], path: string, issues: TransitionSemanticValidationIssue[]): void {
+  if (new Set(values).size !== values.length) issue(issues, 'validation.semantic-id.duplicate', path, 'Semantic IDs must be unique.');
+}
+function depends(node: TransitionEffectNode | undefined, target: string, nodes: ReadonlyMap<string, TransitionEffectNode>, seen = new Set<string>()): boolean {
+  if (!node) return false;
+  return node.dependsOn.some((id) => id === target || (!seen.has(id) && (seen.add(id), depends(nodes.get(id), target, nodes, seen))));
+}
+function issue(issues: TransitionSemanticValidationIssue[], ruleId: TransitionSemanticValidationRuleId, path: string, message: string, ref?: string): void {
+  issues.push(ref === undefined ? { ruleId, path, message } : { ruleId, path, message, ref });
+}
+function report(issues: readonly TransitionSemanticValidationIssue[]): TransitionSemanticValidationReport {
+  const ordered = [...issues].sort((left, right) => `${left.path}\0${left.ruleId}\0${left.ref ?? ''}`.localeCompare(`${right.path}\0${right.ruleId}\0${right.ref ?? ''}`));
+  const content = { valid: ordered.length === 0, issues: ordered }; return { ...content, reportHash: hashCanonical(content) };
+}

package/src/lifecycle/compiler-inspection.ts

@@ -0,0 +1,29 @@
+import { diagnoseCoreIssuanceClosure, inspectCorePrivateIr, installedTransitionExecutableBindings } from '../transition-core.js';
+import { validateTransitionDefinitionSemantics } from './catalog.js';
+import { assessCorrectiveReplanAuthorityTuple, installedAuthoritySemanticBindings, projectAuthoritySemanticBundle } from './corrective-replan-authority.js';
+import { correctiveReplanCredentialInspection } from './corrective-replan-credentials.js';
+import { installedCoreRuleBindings } from './core-static-readiness.js';
+import { runtimeSemanticFingerprint, transitionDefinitionManifestHash } from './fingerprint.js';
+import { installedPayloadSchemaArtifacts, installedPayloadSchemaValidators } from './schema-artifact.js';
+import { transitionSemanticRegistry } from './semantic-registry.js';
+
+export const installedCoreRuleBindingsForTests = installedCoreRuleBindings;
+export const installedAuthoritySemanticBindingsForTests = installedAuthoritySemanticBindings;
+export const installedTransitionExecutableBindingsForTests = installedTransitionExecutableBindings;
+export const installedPayloadSchemaArtifactsForTests = installedPayloadSchemaArtifacts;
+export const installedPayloadSchemaValidatorsForTests = installedPayloadSchemaValidators;
+export const installedSemanticRegistryForTests = transitionSemanticRegistry;
+export const inspectCorePrivateIrForTests = inspectCorePrivateIr;
+export const diagnoseCoreIssuanceClosureForTests = diagnoseCoreIssuanceClosure;
+export const assessCorrectiveReplanAuthorityTupleForTests = assessCorrectiveReplanAuthorityTuple;
+export const projectAuthoritySemanticBundleForTests = projectAuthoritySemanticBundle;
+export const correctiveReplanCredentialInspectionForTests = correctiveReplanCredentialInspection;
+export function runtimeSemanticFingerprintForInspection(metadata: unknown) {
+  return runtimeSemanticFingerprint(metadata as Parameters<typeof runtimeSemanticFingerprint>[0]);
+}
+export function definitionManifestHashForInspection(metadata: unknown, runtime?: string) {
+  return transitionDefinitionManifestHash(metadata as Parameters<typeof transitionDefinitionManifestHash>[0], runtime);
+}
+export function validateTransitionDefinitionForInspection(raw: unknown) {
+  return validateTransitionDefinitionSemantics(raw as never);
+}

package/src/lifecycle/core-static-readiness.ts

@@ -0,0 +1,132 @@
+import { runtimeSemanticProjection } from './fingerprint.js';
+import { deepFreeze } from './immutable.js';
+import { coreReleaseRuleDescriptors } from './implementation-table.js';
+import type { CoreReleaseRuleBinding, CoreReleaseRuleContext, RegisteredRef } from './types.js';
+
+type RecordValue = Readonly<Record<string, unknown>>;
+
+const ruleFunctions = [definitionIntegrity, exactAuthority, requiredInputs, admissionBoundary, reliableEffects] as const;
+
+export const installedCoreRuleBindings: readonly CoreReleaseRuleBinding[] = deepFreeze(
+  coreReleaseRuleDescriptors.map(([id, suffix], index) => ({
+    id, version: 1,
+    implementationId: `implementation.release-rule.${suffix}`,
+    implementationVersion: 1,
+    callable: ruleFunctions[index]!,
+  })),
+);
+
+export function projectReleaseRuleContextForCore(raw: unknown, ruleId: string): CoreReleaseRuleContext {
+  const source = raw as Record<string, unknown>;
+  const metadata = Object.fromEntries(Object.entries(source)
+    .filter(([key]) => !['runtimeSemanticFingerprint', 'semanticFingerprint', 'definitionManifestHash'].includes(key)));
+  const closure = runtimeSemanticProjection(metadata as never).resolvedRegistryEntries as {
+    category: string; entry: Record<string, unknown>;
+  }[];
+  const entries = (category: string) => closure.filter((entry) => entry.category === category).map(({ entry }) => entry);
+  const guards = () => rows(metadata.guards).map((guard) => ({ guardId: guard.guardId }));
+  if (ruleId === 'semantic-rule.definition-integrity') return context({ guards: guards() });
+  if (ruleId === 'semantic-rule.exact-authority') {
+    const authority = record(metadata.authority); const actor = record(authority.actor); const principal = record(authority.principal);
+    return context({ authority: { actor: { required: actor.required, identity: ref(actor.identity) }, principal: { identity: ref(principal.identity) },
+      capabilities: presence(authority.capabilities), credentials: presence(authority.credentials), separationOfDuty: presence(authority.separationOfDuty),
+      forbiddenCombinations: presence(authority.forbiddenCombinations),
+      ownership: ref(authority.ownership), eligibleRoles: presence(authority.eligibleRoles) }, guards: guards() }, {
+      capabilities: presence(entries('capabilities')), credentialPolicies: presence(entries('credentialPolicies')),
+      identityComparators: presence(entries('identityComparators')), ownershipPolicies: entries('ownershipPolicies').map((entry) => ({ id: entry.id, version: entry.version, c1Ownership: entry.c1Ownership, writerLease: entry.writerLease })),
+    });
+  }
+  if (ruleId === 'semantic-rule.required-inputs') return context({ inputContract: rows(metadata.inputContract).map((entry) => ({ required: entry.required, input: ref(entry.input) })), guards: rows(metadata.guards).map((guard) => ({ requiredInputs: rows(guard.requiredInputs).map(ref) })) });
+  if (ruleId === 'semantic-rule.admission-boundary') { const boundary = record(metadata.admissionBoundary); return context({ admissionBoundary: {
+    lock: { policy: ref(record(boundary.lock).policy) },
+    orderedRevalidations: rows(boundary.orderedRevalidations).map((entry) => ({ underLock: entry.underLock })),
+    firstEffectAfterRevalidation: boundary.firstEffectAfterRevalidation, release: boundary.release,
+  } }, { lockPolicies: entries('lockPolicies').map((entry) => ({ id: entry.id, version: entry.version, lockKind: entry.lockKind })) }); }
+  if (ruleId === 'semantic-rule.reliable-effects') { const atomicity = record(metadata.atomicity); const readback = record(atomicity.readback); return context({ atomicity: {
+    classification: atomicity.classification, nonMutatingFailureGuarantee: atomicity.nonMutatingFailureGuarantee,
+    readback: { adapter: ref(readback.adapter), wiring: readback.wiring, checkpoints: record(readback.checkpoints) },
+    journal: { mode: record(atomicity.journal).mode }, recovery: { mode: record(atomicity.recovery).mode, trigger: record(atomicity.recovery).trigger },
+  } }, { readbackAdapters: entries('readbackAdapters').map((entry) => ({ id: entry.id, version: entry.version, wiring: entry.wiring })) }); }
+  throw new TypeError(`No installed Core context projection for ${ruleId}.`);
+}
+
+export function evaluateInstalledReleaseRulesForCore(
+  bindings: readonly (CoreReleaseRuleBinding & { readonly context: CoreReleaseRuleContext })[],
+): readonly string[] {
+  return [...new Set(bindings.flatMap((binding) => binding.callable(binding.context)))].sort();
+}
+
+function definitionIntegrity({ transition }: CoreReleaseRuleContext): readonly string[] {
+  const guards = new Set(array(transition.guards).map((guard) => String(guard.guardId)));
+  const required = ['actor-role-eligible', 'no-c1-claim', 'no-writer-lease', 'plan-validation-passed', 'receipt-valid', 'risk-audit-passed']
+    .map((suffix) => `task.corrective-replan.${suffix}`);
+  return required.every((guard) => guards.has(guard)) ? [] : ['static.definition.mandatory-guard-incomplete'];
+}
+
+function exactAuthority({ transition, registry }: CoreReleaseRuleContext): readonly string[] {
+  const authority = transition.authority as RecordValue;
+  const actor = authority.actor as RecordValue;
+  const principal = authority.principal as RecordValue;
+  const blockers: string[] = [];
+  if (actor.required !== true || refText(actor.identity) !== 'identity.actor@1'
+    || refText(principal.identity) !== 'identity.human-principal@1') blockers.push('static.authority.actor-unbound');
+  if (array(authority.capabilities).length === 0 || array(registry.capabilities).length === 0) blockers.push('static.authority.exact-capability-missing');
+  if (array(authority.credentials).length === 0 || array(registry.credentialPolicies).length === 0) blockers.push('static.authority.exact-credential-missing');
+  if (array(authority.separationOfDuty).length !== 2 || array(authority.forbiddenCombinations).length !== 1
+    || array(registry.identityComparators).length !== 3) blockers.push('static.authority.sod-unenforced');
+  const ownership = array(registry.ownershipPolicies).find((entry) => refText(entry) === refText(authority.ownership));
+  if (!ownership || ownership.c1Ownership === 'unchecked' || ownership.writerLease === 'unchecked') blockers.push('static.authority.ownership-unchecked');
+  if (array(authority.eligibleRoles).length === 0 || !array(transition.guards)
+    .some((guard) => guard.guardId === 'task.corrective-replan.actor-role-eligible')) blockers.push('static.authority.role-eligibility-unenforced');
+  return blockers;
+}
+
+function requiredInputs({ transition }: CoreReleaseRuleContext): readonly string[] {
+  const inputs = new Set(array(transition.inputContract).filter((entry) => entry.required === true).map((entry) => refText(entry.input)));
+  const guarded = new Set(array(transition.guards).flatMap((guard) => array(guard.requiredInputs).map(refText)));
+  const exact = ['corrective-execution-receipt', 'corrective-plan-risk-audit', 'corrective-plan-validation', 'corrective-replacement-plan', 'expected-revision', 'task-id']
+    .map((id) => `input.${id}@1`);
+  return exact.every((id) => inputs.has(id) && guarded.has(id)) ? [] : ['static.input.exact-contract-incomplete'];
+}
+
+function admissionBoundary({ transition, registry }: CoreReleaseRuleContext): readonly string[] {
+  const boundary = transition.admissionBoundary as RecordValue;
+  const lock = (boundary.lock as RecordValue).policy;
+  const installed = array(registry.lockPolicies).find((entry) => refText(entry) === refText(lock));
+  const revalidations = array(boundary.orderedRevalidations);
+  return installed?.lockKind === 'exclusive-task'
+    && revalidations.length === 3 && revalidations.every((entry) => entry.underLock === true)
+    && boundary.firstEffectAfterRevalidation === true && boundary.release === 'finally-after-readback'
+    ? [] : ['static.admission.exclusive-lock-incomplete'];
+}
+
+function reliableEffects({ transition, registry }: CoreReleaseRuleContext): readonly string[] {
+  const atomicity = transition.atomicity as RecordValue;
+  const readback = atomicity.readback as RecordValue;
+  const installed = array(registry.readbackAdapters).find((entry) => refText(entry) === refText(readback.adapter));
+  const blockers: string[] = [];
+  const checkpoints = readback.checkpoints as RecordValue;
+  if (readback.wiring !== 'invoked-post-effect' || installed?.wiring !== 'invoked-post-effect'
+    || checkpoints.preCompletion !== 'domain-readback' || checkpoints.postTerminal !== 'terminal-readback') blockers.push('static.reliability.readback-unwired');
+  if (atomicity.classification !== 'journaled-multi-write' || atomicity.nonMutatingFailureGuarantee !== 'all-guards-before-effects'
+    || (atomicity.journal as RecordValue).mode !== 'required' || (atomicity.recovery as RecordValue).mode !== 'automatic-roll-forward'
+    || (atomicity.recovery as RecordValue).trigger !== 'explicit-repair') {
+    blockers.push('static.reliability.contract-incomplete');
+  }
+  return blockers;
+}
+
+function context(transition: Record<string, unknown>, registry: Record<string, readonly Record<string, unknown>[]> = {}): CoreReleaseRuleContext { return deepFreeze({ transition, registry, policy: {} }); }
+function record(value: unknown): Record<string, unknown> { return value !== null && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : {}; }
+function rows(value: unknown): Record<string, unknown>[] { return Array.isArray(value) ? value.map(record) : []; }
+function presence(value: unknown): Record<string, never>[] { return Array.isArray(value) ? value.map(() => ({})) : []; }
+function ref(value: unknown): Record<string, unknown> { const entry = record(value); return { id: entry.id, version: entry.version }; }
+
+function array(value: unknown): Record<string, unknown>[] {
+  return Array.isArray(value) ? value as Record<string, unknown>[] : [];
+}
+
+function refText(value: unknown): string {
+  const ref = value as Partial<RegisteredRef<string>> | undefined;
+  return ref && typeof ref.id === 'string' && Number.isInteger(ref.version) ? `${ref.id}@${ref.version}` : '';
+}

package/src/lifecycle/corrective-replan-authority.ts

@@ -0,0 +1,136 @@
+import { createHash } from 'node:crypto';
+import { correctiveReplanBindingManifest } from './corrective-replan-binding-manifest.js';
+import { hashCanonical } from './fingerprint.js';
+import { deepFreeze } from './immutable.js';
+
+type JsonRecord = Record<string, unknown>;
+type AuthorityCallable = (...arguments_: readonly unknown[]) => unknown;
+
+export interface AuthoritySemanticBinding {
+  readonly id: string;
+  readonly version: 1;
+  readonly kind: 'role-evaluator' | 'identity-comparator';
+  readonly implementationId: `implementation.${string}`;
+  readonly implementationVersion: number;
+  readonly wiring: 'invoked';
+  readonly callable: AuthorityCallable;
+}
+
+interface AuthorityIssue { readonly issueId: string; readonly path: string; readonly message: string }
+
+const eligibleRole: AuthorityCallable = (input) => roleVerdict(input);
+const authorValidator: AuthorityCallable = (input) => identityVerdict(input);
+const authorRiskAuditor: AuthorityCallable = (input) => identityVerdict(input);
+const authorHumanPrincipal: AuthorityCallable = (input) => identityVerdict(input);
+
+export const installedAuthoritySemanticBindings: readonly AuthoritySemanticBinding[] = deepFreeze([
+  binding('authority-role-evaluator.corrective-replan.eligible-role', 'authority-role-evaluator.corrective-replan.eligible-role', 'role-evaluator', eligibleRole),
+  binding('identity-comparator.corrective-replan.author-validator', 'identity-comparator.corrective-replan.author-validator', 'identity-comparator', authorValidator),
+  binding('identity-comparator.corrective-replan.author-risk-auditor', 'identity-comparator.corrective-replan.author-risk-auditor', 'identity-comparator', authorRiskAuditor),
+  binding('identity-comparator.corrective-replan.author-human-principal', 'identity-comparator.corrective-replan.author-human-principal', 'identity-comparator', authorHumanPrincipal),
+]);
+
+const ref = (id: string) => ({ id, version: 1 });
+const constraints = [
+  constraint('constraint.corrective-replan.author-not-validator', 'author-validator', 'actor.validator'),
+  constraint('constraint.corrective-replan.author-not-risk-auditor', 'author-risk-auditor', 'actor.risk-auditor'),
+  constraint('constraint.corrective-replan.author-not-human-principal', 'author-human-principal', 'principal.human'),
+];
+
+/** Diagnostic-only assessment of the installed static tuple. It cannot issue a Core handle. */
+export function assessCorrectiveReplanAuthorityTuple(tuple: unknown) {
+  const value = record(tuple); const issues: AuthorityIssue[] = [];
+  extraFields(value, ['transitionId', 'actor', 'eligibleRoles', 'roleEvaluator', 'humanPrincipal', 'capability', 'delegation', 'ownership', 'constraints', 'priorPlanAuthorization'],
+    '/','authority.tuple.extra-field', issues);
+  extraFields(record(value.actor), ['identity', 'basis'], '/actor/', 'authority.tuple.extra-field', issues);
+  extraFields(record(value.humanPrincipal), ['identity', 'basis', 'kind'], '/humanPrincipal/', 'authority.tuple.extra-field', issues);
+  extraFields(record(value.capability), ['id', 'version', 'source', 'issuer', 'transitionId', 'scope', 'bindingManifest'], '/capability/', 'authority.tuple.extra-field', issues);
+  extraFields(record(value.priorPlanAuthorization), ['disposition', 'authority'], '/priorPlanAuthorization/', 'authority.tuple.extra-field', issues);
+  check(value, '/transitionId', 'authority.transition.mismatch', 'task.plan.corrective-replan', issues);
+  check(value, '/actor/identity', 'authority.actor.identity-mismatch', ref('identity.actor'), issues);
+  check(value, '/actor/basis', 'authority.actor.basis-mismatch', ref('principal-basis.human-confirmation'), issues);
+  check(value, '/eligibleRoles', 'authority.role-evaluator.mismatch', ['delivery-coordinator', 'technical-planner'], issues);
+  check(value, '/roleEvaluator', 'authority.role-evaluator.mismatch', ref('authority-role-evaluator.corrective-replan.eligible-role'), issues);
+  check(value, '/humanPrincipal/identity', 'authority.principal.identity-mismatch', ref('identity.human-principal'), issues);
+  check(value, '/humanPrincipal/basis', 'authority.principal.basis-mismatch', ref('principal-basis.human-confirmation'), issues);
+  check(value, '/humanPrincipal/kind', 'authority.principal.kind-mismatch', 'human', issues);
+  const capability = get(value, '/capability');
+  if (!isRecord(capability)) issue(issues, 'authority.capability.missing', '/capability');
+  else {
+    check(value, '/capability/id', 'authority.capability.id-mismatch', 'capability.task.corrective-replan', issues);
+    check(value, '/capability/version', 'authority.capability.version-mismatch', 1, issues);
+    check(value, '/capability/source', 'authority.capability.source-mismatch', ref('authority-source.human-confirmation'), issues);
+    check(value, '/capability/issuer', 'authority.capability.issuer-mismatch', ref('identity.human-principal'), issues);
+    check(value, '/capability/transitionId', 'authority.capability.transition-mismatch', 'task.plan.corrective-replan', issues);
+    check(value, '/capability/scope', 'authority.capability.scope-mismatch', { entity: 'task', task: 'taskId', guardedStep: 'guardedStepId' }, issues);
+    if (capability.bindingManifest !== correctiveReplanBindingManifest)
+      issue(issues, 'authority.capability.binding-manifest-mismatch', '/capability/bindingManifest');
+  }
+  check(value, '/delegation', 'authority.delegation.not-forbidden', ref('delegation.forbidden'), issues);
+  check(value, '/ownership', 'authority.ownership.not-clear', { c1Claim: 'none', writerLease: 'none' }, issues);
+  const rows = Array.isArray(value.constraints) ? value.constraints : [];
+  const seen = new Set<string>();
+  rows.forEach((entry, index) => {
+    const id = isRecord(entry) && typeof entry.constraintId === 'string' ? entry.constraintId : '';
+    if (seen.has(id)) issue(issues, 'authority.constraint.duplicate', `/constraints/${index}/constraintId`);
+    else if (id === 'constraint.corrective-replan.validator-not-risk-auditor') issue(issues, 'authority.constraint.forbidden-validator-risk', `/constraints/${index}`);
+    else if (!constraints.some((expected) => expected.constraintId === id)) issue(issues, 'authority.constraint.unknown', `/constraints/${index}/constraintId`);
+    seen.add(id);
+    if (isRecord(entry)) extraFields(entry, ['constraintId', 'comparator', 'operands', 'relation', 'missing', 'enforcement'],
+      `/constraints/${index}/`, 'authority.constraint.extra-field', issues);
+  });
+  constraints.forEach((expected, index) => {
+    const actualIndex = rows.findIndex((entry) => isRecord(entry) && entry.constraintId === expected.constraintId);
+    if (actualIndex < 0) return issue(issues, 'authority.constraint.missing', `/constraints/${index}`);
+    for (const field of ['comparator', 'operands', 'relation', 'missing', 'enforcement'] as const) {
+      check(value, `/constraints/${actualIndex}/${field}`, `authority.constraint.${field === 'comparator' ? 'comparator-id' : field}-mismatch`, expected[field], issues,
+        field === 'comparator' ? `/constraints/${index}/${field}/id` : `/constraints/${index}/${field}`);
+      if (field === 'comparator') check(value, `/constraints/${actualIndex}/comparator/version`, 'authority.constraint.comparator-version-mismatch', 1, issues, `/constraints/${index}/comparator/version`);
+    }
+  });
+  check(value, '/priorPlanAuthorization/disposition', 'authority.plan-bound-grant-active', 'superseded', issues);
+  check(value, '/priorPlanAuthorization/authority', 'authority.plan-bound-grant-active', 'none', issues);
+  const ordered = [...issues].sort((a, b) => `${a.path}\0${a.issueId}`.localeCompare(`${b.path}\0${b.issueId}`));
+  const blockers: string[] = [];
+  if (ordered.some((entry) => entry.issueId === 'authority.capability.missing')) blockers.push('static.authority.exact-capability-missing');
+  if (ordered.some((entry) => entry.issueId === 'authority.plan-bound-grant-active')) blockers.push('static.authority.plan-bound-grant-not-superseded');
+  if (ordered.length > 0) blockers.push('static.authority.exact-tuple-invalid');
+  const content = { staticTupleValid: ordered.length === 0, blockers: [...new Set(blockers)], issues: ordered,
+    bindings: installedAuthoritySemanticBindings };
+  return deepFreeze({ ...content, reportHash: hashCanonical({ ...content, bindings: content.bindings.map(projectBinding) }) });
+}
+
+function binding(id: string, suffix: string, kind: AuthoritySemanticBinding['kind'], callable: AuthorityCallable): AuthoritySemanticBinding {
+  return { id, version: 1, kind, implementationId: `implementation.${suffix}`, implementationVersion: 1, wiring: 'invoked', callable };
+}
+export function projectAuthoritySemanticBundle(bindings: readonly AuthoritySemanticBinding[]) {
+  const projection = { bundleVersion: 2, bindingManifest: correctiveReplanBindingManifest, bindings: bindings.map(projectBinding) };
+  return deepFreeze({ ...projection, bundleSha256: createHash('sha256').update(JSON.stringify(projection)).digest('hex') });
+}
+function constraint(constraintId: string, suffix: string, right: string) { return { constraintId,
+  comparator: ref(`identity-comparator.corrective-replan.${suffix}`), operands: ['actor.author', right],
+  relation: 'not-equal', missing: 'block', enforcement: 'static-and-runtime' }; }
+function roleVerdict(input: unknown) { const value = record(input); const roles = ['delivery-coordinator', 'technical-planner'];
+  if (!/^[a-f0-9]{64}$/.test(String(value.actorIdentityHash ?? '')) || !sameSet(value.eligibleRoles, roles)
+    || typeof value.actorRole !== 'string' || value.actorRole.length === 0) return verdict(false, 'ROLE_INPUT_INVALID');
+  return roles.includes(value.actorRole) ? verdict(true, null) : verdict(false, 'ROLE_NOT_ELIGIBLE'); }
+function identityVerdict(input: unknown) { const value = record(input); const valid = /^[a-f0-9]{64}$/;
+  if (typeof value.leftIdentityHash !== 'string' || typeof value.rightIdentityHash !== 'string'
+    || !valid.test(value.leftIdentityHash) || !valid.test(value.rightIdentityHash)) return verdict(false, 'IDENTITY_INPUT_INVALID');
+  return value.leftIdentityHash !== value.rightIdentityHash ? verdict(true, null) : verdict(false, 'IDENTITY_CONSTRAINT_VIOLATED'); }
+function verdict(passed: boolean, reasonCode: string | null) { return deepFreeze({ passed, blocked: !passed, reasonCode }); }
+function projectBinding({ callable: _callable, wiring: _wiring, ...binding }: AuthoritySemanticBinding) { return binding; }
+function record(value: unknown): JsonRecord { return isRecord(value) ? value : {}; }
+function isRecord(value: unknown): value is JsonRecord { return value !== null && typeof value === 'object' && !Array.isArray(value); }
+function get(value: JsonRecord, path: string): unknown { return path.split('/').filter(Boolean).reduce<unknown>((cursor, key) =>
+  Array.isArray(cursor) && /^\d+$/.test(key) ? cursor[Number(key)] : isRecord(cursor) ? cursor[key] : undefined, value); }
+function check(value: JsonRecord, path: string, issueId: string, expected: unknown, issues: AuthorityIssue[], reportedPath = path): void {
+  const actual = get(value, path);
+  if (actual === undefined || hashCanonical(actual) !== hashCanonical(expected)) issue(issues, issueId, reportedPath);
+}
+function sameSet(value: unknown, expected: readonly string[]): boolean { return Array.isArray(value) && value.length === expected.length
+  && new Set(value).size === expected.length && value.every((entry) => typeof entry === 'string' && expected.includes(entry)); }
+function extraFields(value: JsonRecord, allowed: readonly string[], prefix: string, issueId: string, issues: AuthorityIssue[]): void {
+  Object.keys(value).filter((key) => !allowed.includes(key)).forEach((key) => issue(issues, issueId, `${prefix}${key}`));
+}
+function issue(issues: AuthorityIssue[], issueId: string, path: string): void { issues.push({ issueId, path, message: `${issueId} at ${path}.` }); }

package/src/lifecycle/corrective-replan-binding-manifest.ts

@@ -0,0 +1,51 @@
+import { hashCanonical } from './canonical-hash.js';
+import { deepFreeze } from './immutable.js';
+import type { ProjectionFieldId, ProjectionId } from './types.js';
+
+const ref = <TId extends string>(id: TId) => ({ id, version: 1 as const });
+type ValueKind = 'literal' | 'sha256' | 'safe-integer' | 'entity-id' | 'git-oid' | 'actor-role';
+type Canonicalization = 'exact' | 'lowercase-hex' | 'safe-nonnegative-integer' | 'nfc-trim' | 'lowercase-git-oid' | 'registered-enum';
+const row = (bindingId: string, projection: ProjectionId, fieldId: ProjectionFieldId, valueKind: ValueKind, canonicalization: Canonicalization) => ({
+  ordinal: rowsOrdinal++, bindingId, projection: ref(projection), fieldId, valueKind, canonicalization,
+  receiptPath: `/binding/values/${bindingId}` as `/binding/values/${string}`,
+});
+let rowsOrdinal = 0;
+const protocol = (id: string, field: ProjectionFieldId, kind: ValueKind, canonical: Canonicalization) => row(id, 'projection.corrective-replan.protocol', field, kind, canonical);
+const state = (id: string, field: ProjectionFieldId, kind: ValueKind, canonical: Canonicalization) => row(id, 'projection.corrective-replan.state', field, kind, canonical);
+const candidate = (id: string, field: ProjectionFieldId) => row(id, 'projection.corrective-replan.candidate', field, 'sha256', 'lowercase-hex');
+const candidateState = (id: string, field: ProjectionFieldId, kind: ValueKind, canonical: Canonicalization) => row(id, 'projection.corrective-replan.candidate', field, kind, canonical);
+const authority = (id: string, field: ProjectionFieldId, kind: ValueKind, canonical: Canonicalization) => row(id, 'projection.corrective-replan.authority', field, kind, canonical);
+
+const rows = [
+  protocol('transitionId', 'field.transition-id', 'literal', 'exact'), protocol('runtimeFingerprint', 'field.runtime-fingerprint', 'sha256', 'lowercase-hex'),
+  protocol('catalogHash', 'field.catalog-hash', 'sha256', 'lowercase-hex'), protocol('lifecycleEpoch', 'field.lifecycle-epoch', 'safe-integer', 'safe-nonnegative-integer'),
+  state('taskId', 'field.task-id', 'entity-id', 'nfc-trim'), state('revision', 'field.task-revision', 'safe-integer', 'safe-nonnegative-integer'),
+  state('currentPlanHash', 'field.current-plan-hash', 'sha256', 'lowercase-hex'), state('briefHash', 'field.brief-hash', 'sha256', 'lowercase-hex'),
+  state('knowledgeRevision', 'field.knowledge-revision', 'safe-integer', 'safe-nonnegative-integer'), state('knowledgeHash', 'field.knowledge-hash', 'sha256', 'lowercase-hex'),
+  candidateState('targetKnowledgeRevision', 'field.target-knowledge-revision', 'safe-integer', 'safe-nonnegative-integer'), candidate('targetKnowledgeHash', 'field.target-knowledge-hash'),
+  state('gitHead', 'field.git-head', 'git-oid', 'lowercase-git-oid'), state('guardedStepId', 'field.guarded-step-id', 'entity-id', 'nfc-trim'),
+  state('correctiveDecisionEventId', 'field.corrective-decision-event-id', 'entity-id', 'nfc-trim'), state('correctiveDecisionHash', 'field.corrective-decision-hash', 'sha256', 'lowercase-hex'),
+  state('attemptCount', 'field.attempt-count', 'safe-integer', 'safe-nonnegative-integer'), state('remediationTailHash', 'field.remediation-tail-hash', 'sha256', 'lowercase-hex'),
+  candidate('candidatePlanHash', 'field.candidate-plan-hash'), candidate('candidateStepSetHash', 'field.candidate-step-set-hash'),
+  candidate('planAuthorIdentityHash', 'field.plan-author-identity-hash'), candidate('planValidationHash', 'field.plan-validation-hash'),
+  candidate('planValidatorIdentityHash', 'field.plan-validator-identity-hash'), candidate('riskAuditHash', 'field.risk-audit-hash'), candidate('riskAuditorIdentityHash', 'field.risk-auditor-identity-hash'),
+  authority('actorIdentityHash', 'field.actor-identity-hash', 'sha256', 'lowercase-hex'), authority('actorRole', 'field.actor-role', 'actor-role', 'registered-enum'),
+  authority('humanPrincipalIdentityHash', 'field.human-principal-identity-hash', 'sha256', 'lowercase-hex'), authority('capabilityId', 'field.capability-id', 'literal', 'exact'),
+  authority('capabilityVersion', 'field.capability-version', 'safe-integer', 'safe-nonnegative-integer'),
+];
+
+const identity = { id: 'binding-manifest.corrective-replan.exact-v1' as const, version: 1 as const, rows };
+export const correctiveReplanBindingManifest = deepFreeze({
+  ...identity,
+  manifestSha256: hashCanonical({ ...identity, rows: [...rows].sort((a, b) => a.bindingId.localeCompare(b.bindingId)) }),
+});
+
+export const correctiveReplanBindingIds = deepFreeze(rows.map(({ bindingId }) => bindingId));
+
+export const historicalCompletedCorrectiveReplanBindingIdentities = deepFreeze([
+  {
+    manifestSha256: 'edab7ee7ac4018e759f5fc702a11a0fd113ef4f2cf8ed8fa823a59fde3012a1a',
+    runtimeFingerprint: 'bd4e7a0ddfcb6abc0c5eb107775e6aea7e08c4606dda4d945d77af8a4520710d',
+    catalogHash: 'fa1d11860d4f07978c3b8e85d1f91cd3d15b17284b05f41e05d462d3bb092aed',
+  },
+] as const);