codex-workflow-v2 2.0.0-beta.13.9 → 2.0.0-beta.14.1

package/src/alpha6/preexecution-replan.ts

@@ -0,0 +1,187 @@
+import type { AuthorizationEvent, PlanRiskAuditEvent, SidecarEventRecord, TaskState } from '../contracts.js';
+import { WorkflowError } from '../errors.js';
+import type { FileStateStore } from '../state/store.js';
+import { createUlid } from '../ulid.js';
+import {
+  assertHash64,
+  canonicalJsonStringify,
+  prepareSidecarAppend,
+  sha256Hex,
+} from './store-sidecars.js';
+
+const SIDECAR = 'preexecution-replans.jsonl';
+
+export interface PreExecutionReplanEvent extends SidecarEventRecord {
+  taskId: string;
+  sourceTaskRevision: number;
+  resultTaskRevision: number;
+  briefHash: string;
+  sourcePlanHash: string;
+  knowledgeMapRevision: number;
+  knowledgeMapHash: string;
+  sourcePlanRiskAuditEventId: string;
+  sourcePlanRiskAuditEventHash: string;
+  obstructionPlanRiskAuditEventId: string;
+  obstructionPlanRiskAuditEventHash: string;
+  sourceExecutionAuthorizationHash: string;
+  sourceHeadCommit: string;
+  completedStepIds: string[];
+  completedStepsHash: string;
+  actor: string;
+  reason: string;
+  recordedAt: string;
+}
+
+export function preExecutionReplanSidecar(): string {
+  return SIDECAR;
+}
+
+export function hashExecutionAuthorization(authorization: AuthorizationEvent): string {
+  return sha256Hex(canonicalJsonStringify(authorization));
+}
+
+export function hashCompletedSteps(task: TaskState): string {
+  return sha256Hex(canonicalJsonStringify(
+    task.steps.filter((step) => step.status === 'completed'),
+  ));
+}
+
+export function preparePreExecutionReplanEvent(
+  store: FileStateStore,
+  task: TaskState,
+  input: {
+    sourceAudit: PlanRiskAuditEvent;
+    obstructionAudit: PlanRiskAuditEvent;
+    authorization: AuthorizationEvent;
+    sourceHeadCommit: string;
+    actor: string;
+    reason: string;
+  },
+  now: Date,
+): { event: PreExecutionReplanEvent; postimage: string } {
+  const actor = input.actor.trim();
+  const reason = input.reason.trim();
+  if (!actor) throw new WorkflowError('INVALID_ARGUMENT', 'Pre-execution replan actor is required.');
+  if (!reason) throw new WorkflowError('INVALID_ARGUMENT', 'Pre-execution replan reason is required.');
+  if (reason.length > 2048) throw new WorkflowError('INVALID_ARGUMENT', 'Pre-execution replan reason is too long.');
+  if (!task.planHash || task.knowledgeMapRevision === null || !task.knowledgeMapHash) {
+    throw new WorkflowError('STATE_CORRUPT', 'Pre-execution replan requires complete current Plan and Knowledge bindings.');
+  }
+  const existing = readPreExecutionReplanEvents(store, task);
+  const completedStepIds = task.steps.filter((step) => step.status === 'completed').map((step) => step.id);
+  const prepared = prepareSidecarAppend<PreExecutionReplanEvent>(existing, {
+    eventId: `PER-${createUlid(now.getTime())}`,
+    taskId: task.id,
+    sourceTaskRevision: task.revision,
+    resultTaskRevision: task.revision + 1,
+    briefHash: task.briefHash,
+    sourcePlanHash: task.planHash,
+    knowledgeMapRevision: task.knowledgeMapRevision,
+    knowledgeMapHash: task.knowledgeMapHash,
+    sourcePlanRiskAuditEventId: input.sourceAudit.eventId,
+    sourcePlanRiskAuditEventHash: input.sourceAudit.eventHash,
+    obstructionPlanRiskAuditEventId: input.obstructionAudit.eventId,
+    obstructionPlanRiskAuditEventHash: input.obstructionAudit.eventHash,
+    sourceExecutionAuthorizationHash: hashExecutionAuthorization(input.authorization),
+    sourceHeadCommit: input.sourceHeadCommit,
+    completedStepIds,
+    completedStepsHash: hashCompletedSteps(task),
+    actor,
+    reason,
+    recordedAt: now.toISOString(),
+  }, {
+    validateEvent: validateStoredPreExecutionReplanEvent,
+  });
+  return { event: prepared.event, postimage: prepared.content };
+}
+
+export function readPreExecutionReplanEvents(
+  store: FileStateStore,
+  task: TaskState,
+): PreExecutionReplanEvent[] {
+  return store.readSidecarEvents<PreExecutionReplanEvent>(
+    store.taskRoot(task.projectId, task.id),
+    SIDECAR,
+    { validateEvent: validateStoredPreExecutionReplanEvent },
+  );
+}
+
+export function readCurrentPreExecutionReplan(
+  store: FileStateStore,
+  task: TaskState,
+): PreExecutionReplanEvent | null {
+  const event = readPreExecutionReplanEvents(store, task).at(-1) ?? null;
+  if (!event || event.sourcePlanHash !== task.planHash || task.status === 'cancelled') return null;
+  if (task.revision < event.resultTaskRevision) {
+    throw new WorkflowError('STATE_CORRUPT', 'Pre-execution replan marker is newer than its Task state.', {
+      taskId: task.id,
+      eventId: event.eventId,
+    });
+  }
+  if (event.taskId !== task.id || event.briefHash !== task.briefHash
+    || event.knowledgeMapRevision !== task.knowledgeMapRevision
+    || event.knowledgeMapHash !== task.knowledgeMapHash) {
+    throw new WorkflowError('STATE_CORRUPT', 'Current pre-execution replan marker does not match Task authority.', {
+      taskId: task.id,
+      eventId: event.eventId,
+    });
+  }
+  if (event.completedStepsHash !== hashCompletedSteps(task)
+    || canonicalJsonStringify(event.completedStepIds)
+      !== canonicalJsonStringify(task.steps.filter((step) => step.status === 'completed').map((step) => step.id))) {
+    throw new WorkflowError('STATE_CORRUPT', 'Completed Step authority changed after pre-execution replan recording.', {
+      taskId: task.id,
+      eventId: event.eventId,
+    });
+  }
+  return event;
+}
+
+function validateStoredPreExecutionReplanEvent(
+  event: PreExecutionReplanEvent,
+  context: { file: string; line: number; eventId: string },
+): void {
+  const expectedKeys = [
+    'actor', 'briefHash', 'completedStepIds', 'completedStepsHash', 'eventHash', 'eventId',
+    'knowledgeMapHash', 'knowledgeMapRevision', 'obstructionPlanRiskAuditEventHash',
+    'obstructionPlanRiskAuditEventId', 'previousEventHash', 'reason', 'recordedAt',
+    'resultTaskRevision', 'sourceExecutionAuthorizationHash', 'sourceHeadCommit', 'sourcePlanHash',
+    'sourcePlanRiskAuditEventHash', 'sourcePlanRiskAuditEventId', 'sourceTaskRevision', 'taskId',
+  ].sort();
+  if (!event || typeof event !== 'object' || Array.isArray(event)
+    || canonicalJsonStringify(Object.keys(event).sort()) !== canonicalJsonStringify(expectedKeys)) {
+    throw new WorkflowError('STATE_CORRUPT', 'Pre-execution replan event has an invalid shape.', context);
+  }
+  if (!/^PER-[0-9A-HJKMNP-TV-Z]{26}$/.test(event.eventId)
+    || !/^TASK-[0-9A-HJKMNP-TV-Z]{26}$/.test(event.taskId)
+    || !/^PRA-[0-9A-HJKMNP-TV-Z]{26}$/.test(event.sourcePlanRiskAuditEventId)
+    || !/^PRA-[0-9A-HJKMNP-TV-Z]{26}$/.test(event.obstructionPlanRiskAuditEventId)) {
+    throw new WorkflowError('STATE_CORRUPT', 'Pre-execution replan event identity binding is invalid.', context);
+  }
+  if (!Number.isSafeInteger(event.sourceTaskRevision) || event.sourceTaskRevision < 1
+    || event.resultTaskRevision !== event.sourceTaskRevision + 1
+    || !Number.isSafeInteger(event.knowledgeMapRevision) || event.knowledgeMapRevision < 1) {
+    throw new WorkflowError('STATE_CORRUPT', 'Pre-execution replan event revision binding is invalid.', context);
+  }
+  for (const [label, value] of [
+    ['briefHash', event.briefHash], ['sourcePlanHash', event.sourcePlanHash],
+    ['knowledgeMapHash', event.knowledgeMapHash],
+    ['sourcePlanRiskAuditEventHash', event.sourcePlanRiskAuditEventHash],
+    ['obstructionPlanRiskAuditEventHash', event.obstructionPlanRiskAuditEventHash],
+    ['sourceExecutionAuthorizationHash', event.sourceExecutionAuthorizationHash],
+    ['completedStepsHash', event.completedStepsHash],
+  ] as const) assertHash64(value, `Pre-execution replan ${label}`);
+  if (!/^[a-f0-9]{40}$/.test(event.sourceHeadCommit)) {
+    throw new WorkflowError('STATE_CORRUPT', 'Pre-execution replan source HEAD is invalid.', context);
+  }
+  if (!Array.isArray(event.completedStepIds)
+    || event.completedStepIds.some((stepId) => typeof stepId !== 'string' || !stepId.trim())
+    || new Set(event.completedStepIds).size !== event.completedStepIds.length) {
+    throw new WorkflowError('STATE_CORRUPT', 'Pre-execution replan completed Step ids are invalid.', context);
+  }
+  if (typeof event.actor !== 'string' || !event.actor.trim()
+    || typeof event.reason !== 'string' || !event.reason.trim() || event.reason.length > 2048
+    || typeof event.recordedAt !== 'string' || !Number.isFinite(Date.parse(event.recordedAt))) {
+    throw new WorkflowError('STATE_CORRUPT', 'Pre-execution replan provenance is invalid.', context);
+  }
+}

package/src/alpha6/remediation-cause.ts

@@ -0,0 +1,98 @@
+import { createHash } from 'node:crypto';
+import path from 'node:path';
+import type { RemediationCauseBinding } from '../contracts.js';
+import type { CheckResult } from '../git.js';
+import { canonicalJsonStringify } from './store-sidecars.js';
+
+const ANSI_ESCAPE = /\u001b\[[0-9;]*m/g;
+const ISO_TIMESTAMP = /\b\d{4}-\d{2}-\d{2}[T ][0-9:.+-]+Z?\b/g;
+const TEMP_PATH = /\/(?:private\/)?(?:tmp|var\/folders)\/[^\s:'"`]+/g;
+const HEX_ID = /\b[a-f0-9]{40,64}\b/g;
+const SOURCE_LOCATION = /:(?:\d+)(?::\d+)?\b/g;
+const DIAGNOSTIC_CODE = /\b(?:[A-Z][A-Z0-9_]{2,}|TS\d{3,5}|ERR_[A-Z0-9_]+)\b/g;
+const REPOSITORY_PATH = /(?:^|[\s('"`])([A-Za-z0-9_.-]+(?:\/[A-Za-z0-9_.-]+)+\.(?:cjs|js|json|mjs|sql|ts|tsx))(?=[:\s)'"`]|$)/g;
+
+export interface NormalizedMechanicalFailure {
+  command: string;
+  exitCode: number;
+  diagnosticCodes: string[];
+  diagnosticShape: string[];
+  diagnosticPaths: string[];
+  causeFingerprint: string;
+}
+
+export function normalizeMechanicalFailures(
+  checks: readonly CheckResult[],
+  repositoryRoot: string,
+): NormalizedMechanicalFailure[] {
+  return checks.filter((check) => !check.passed).map((check) => {
+    const normalizedOutput = normalizeOutput(check.output, repositoryRoot);
+    const diagnosticCodes = [...new Set(normalizedOutput.match(DIAGNOSTIC_CODE) ?? [])].sort().slice(0, 16);
+    const diagnosticShape = [...new Set(normalizedOutput.split('\n')
+      .map((line) => line.trim().replace(/\s+/g, ' '))
+      .filter(Boolean)
+      .slice(0, 4)
+      .map((line) => line.slice(0, 240)))];
+    const diagnosticPaths = extractRepositoryPaths(check.output, repositoryRoot);
+    const causeMaterial = {
+      domain: 'codex-workflow/mechanical-remediation-cause/v1',
+      command: normalizeCommand(check.command),
+      exitCode: check.exitCode,
+      diagnosticCodes,
+      diagnosticShape,
+    };
+    return {
+      command: causeMaterial.command,
+      exitCode: causeMaterial.exitCode,
+      diagnosticCodes,
+      diagnosticShape,
+      diagnosticPaths,
+      causeFingerprint: createHash('sha256').update(canonicalJsonStringify(causeMaterial)).digest('hex'),
+    };
+  });
+}
+
+export function mechanicalCauseBindings(
+  failures: readonly NormalizedMechanicalFailure[],
+): RemediationCauseBinding[] {
+  return failures.map((failure) => ({
+    authority: 'mechanical',
+    causeId: `mechanical:${failure.causeFingerprint}`,
+    causeFingerprint: failure.causeFingerprint,
+    planConflict: false,
+  }));
+}
+
+export function reviewerCauseFingerprint(causeId: string): string {
+  return createHash('sha256').update(canonicalJsonStringify({
+    domain: 'codex-workflow/external-reviewer-cause/v1',
+    causeId: causeId.trim(),
+  })).digest('hex');
+}
+
+function normalizeOutput(output: string, repositoryRoot: string): string {
+  const normalizedRoot = path.resolve(repositoryRoot).replaceAll('\\', '/');
+  return output
+    .replace(ANSI_ESCAPE, '')
+    .replaceAll('\\', '/')
+    .replaceAll(normalizedRoot, '<repo>')
+    .replace(TEMP_PATH, '<tmp>')
+    .replace(ISO_TIMESTAMP, '<time>')
+    .replace(HEX_ID, '<hash>')
+    .replace(SOURCE_LOCATION, ':<loc>');
+}
+
+function normalizeCommand(command: string): string {
+  return command.trim().replace(/\s+/g, ' ');
+}
+
+function extractRepositoryPaths(output: string, repositoryRoot: string): string[] {
+  const normalizedRoot = path.resolve(repositoryRoot).replaceAll('\\', '/');
+  const normalized = output.replaceAll('\\', '/').replaceAll(`${normalizedRoot}/`, '');
+  const result = new Set<string>();
+  for (const match of normalized.matchAll(REPOSITORY_PATH)) {
+    const candidate = match[1]!;
+    if (!candidate.startsWith('../') && !path.posix.isAbsolute(candidate)) result.add(candidate);
+  }
+  return [...result].sort();
+}