codex-workflow-v2 2.0.0-beta.13.9 → 2.0.0-beta.14.1

package/src/lifecycle/corrective-replan-authority.ts

@@ -0,0 +1,136 @@
+import { createHash } from 'node:crypto';
+import { correctiveReplanBindingManifest } from './corrective-replan-binding-manifest.js';
+import { hashCanonical } from './fingerprint.js';
+import { deepFreeze } from './immutable.js';
+
+type JsonRecord = Record<string, unknown>;
+type AuthorityCallable = (...arguments_: readonly unknown[]) => unknown;
+
+export interface AuthoritySemanticBinding {
+  readonly id: string;
+  readonly version: 1;
+  readonly kind: 'role-evaluator' | 'identity-comparator';
+  readonly implementationId: `implementation.${string}`;
+  readonly implementationVersion: number;
+  readonly wiring: 'invoked';
+  readonly callable: AuthorityCallable;
+}
+
+interface AuthorityIssue { readonly issueId: string; readonly path: string; readonly message: string }
+
+const eligibleRole: AuthorityCallable = (input) => roleVerdict(input);
+const authorValidator: AuthorityCallable = (input) => identityVerdict(input);
+const authorRiskAuditor: AuthorityCallable = (input) => identityVerdict(input);
+const authorHumanPrincipal: AuthorityCallable = (input) => identityVerdict(input);
+
+export const installedAuthoritySemanticBindings: readonly AuthoritySemanticBinding[] = deepFreeze([
+  binding('authority-role-evaluator.corrective-replan.eligible-role', 'authority-role-evaluator.corrective-replan.eligible-role', 'role-evaluator', eligibleRole),
+  binding('identity-comparator.corrective-replan.author-validator', 'identity-comparator.corrective-replan.author-validator', 'identity-comparator', authorValidator),
+  binding('identity-comparator.corrective-replan.author-risk-auditor', 'identity-comparator.corrective-replan.author-risk-auditor', 'identity-comparator', authorRiskAuditor),
+  binding('identity-comparator.corrective-replan.author-human-principal', 'identity-comparator.corrective-replan.author-human-principal', 'identity-comparator', authorHumanPrincipal),
+]);
+
+const ref = (id: string) => ({ id, version: 1 });
+const constraints = [
+  constraint('constraint.corrective-replan.author-not-validator', 'author-validator', 'actor.validator'),
+  constraint('constraint.corrective-replan.author-not-risk-auditor', 'author-risk-auditor', 'actor.risk-auditor'),
+  constraint('constraint.corrective-replan.author-not-human-principal', 'author-human-principal', 'principal.human'),
+];
+
+/** Diagnostic-only assessment of the installed static tuple. It cannot issue a Core handle. */
+export function assessCorrectiveReplanAuthorityTuple(tuple: unknown) {
+  const value = record(tuple); const issues: AuthorityIssue[] = [];
+  extraFields(value, ['transitionId', 'actor', 'eligibleRoles', 'roleEvaluator', 'humanPrincipal', 'capability', 'delegation', 'ownership', 'constraints', 'priorPlanAuthorization'],
+    '/','authority.tuple.extra-field', issues);
+  extraFields(record(value.actor), ['identity', 'basis'], '/actor/', 'authority.tuple.extra-field', issues);
+  extraFields(record(value.humanPrincipal), ['identity', 'basis', 'kind'], '/humanPrincipal/', 'authority.tuple.extra-field', issues);
+  extraFields(record(value.capability), ['id', 'version', 'source', 'issuer', 'transitionId', 'scope', 'bindingManifest'], '/capability/', 'authority.tuple.extra-field', issues);
+  extraFields(record(value.priorPlanAuthorization), ['disposition', 'authority'], '/priorPlanAuthorization/', 'authority.tuple.extra-field', issues);
+  check(value, '/transitionId', 'authority.transition.mismatch', 'task.plan.corrective-replan', issues);
+  check(value, '/actor/identity', 'authority.actor.identity-mismatch', ref('identity.actor'), issues);
+  check(value, '/actor/basis', 'authority.actor.basis-mismatch', ref('principal-basis.human-confirmation'), issues);
+  check(value, '/eligibleRoles', 'authority.role-evaluator.mismatch', ['delivery-coordinator', 'technical-planner'], issues);
+  check(value, '/roleEvaluator', 'authority.role-evaluator.mismatch', ref('authority-role-evaluator.corrective-replan.eligible-role'), issues);
+  check(value, '/humanPrincipal/identity', 'authority.principal.identity-mismatch', ref('identity.human-principal'), issues);
+  check(value, '/humanPrincipal/basis', 'authority.principal.basis-mismatch', ref('principal-basis.human-confirmation'), issues);
+  check(value, '/humanPrincipal/kind', 'authority.principal.kind-mismatch', 'human', issues);
+  const capability = get(value, '/capability');
+  if (!isRecord(capability)) issue(issues, 'authority.capability.missing', '/capability');
+  else {
+    check(value, '/capability/id', 'authority.capability.id-mismatch', 'capability.task.corrective-replan', issues);
+    check(value, '/capability/version', 'authority.capability.version-mismatch', 1, issues);
+    check(value, '/capability/source', 'authority.capability.source-mismatch', ref('authority-source.human-confirmation'), issues);
+    check(value, '/capability/issuer', 'authority.capability.issuer-mismatch', ref('identity.human-principal'), issues);
+    check(value, '/capability/transitionId', 'authority.capability.transition-mismatch', 'task.plan.corrective-replan', issues);
+    check(value, '/capability/scope', 'authority.capability.scope-mismatch', { entity: 'task', task: 'taskId', guardedStep: 'guardedStepId' }, issues);
+    if (capability.bindingManifest !== correctiveReplanBindingManifest)
+      issue(issues, 'authority.capability.binding-manifest-mismatch', '/capability/bindingManifest');
+  }
+  check(value, '/delegation', 'authority.delegation.not-forbidden', ref('delegation.forbidden'), issues);
+  check(value, '/ownership', 'authority.ownership.not-clear', { c1Claim: 'none', writerLease: 'none' }, issues);
+  const rows = Array.isArray(value.constraints) ? value.constraints : [];
+  const seen = new Set<string>();
+  rows.forEach((entry, index) => {
+    const id = isRecord(entry) && typeof entry.constraintId === 'string' ? entry.constraintId : '';
+    if (seen.has(id)) issue(issues, 'authority.constraint.duplicate', `/constraints/${index}/constraintId`);
+    else if (id === 'constraint.corrective-replan.validator-not-risk-auditor') issue(issues, 'authority.constraint.forbidden-validator-risk', `/constraints/${index}`);
+    else if (!constraints.some((expected) => expected.constraintId === id)) issue(issues, 'authority.constraint.unknown', `/constraints/${index}/constraintId`);
+    seen.add(id);
+    if (isRecord(entry)) extraFields(entry, ['constraintId', 'comparator', 'operands', 'relation', 'missing', 'enforcement'],
+      `/constraints/${index}/`, 'authority.constraint.extra-field', issues);
+  });
+  constraints.forEach((expected, index) => {
+    const actualIndex = rows.findIndex((entry) => isRecord(entry) && entry.constraintId === expected.constraintId);
+    if (actualIndex < 0) return issue(issues, 'authority.constraint.missing', `/constraints/${index}`);
+    for (const field of ['comparator', 'operands', 'relation', 'missing', 'enforcement'] as const) {
+      check(value, `/constraints/${actualIndex}/${field}`, `authority.constraint.${field === 'comparator' ? 'comparator-id' : field}-mismatch`, expected[field], issues,
+        field === 'comparator' ? `/constraints/${index}/${field}/id` : `/constraints/${index}/${field}`);
+      if (field === 'comparator') check(value, `/constraints/${actualIndex}/comparator/version`, 'authority.constraint.comparator-version-mismatch', 1, issues, `/constraints/${index}/comparator/version`);
+    }
+  });
+  check(value, '/priorPlanAuthorization/disposition', 'authority.plan-bound-grant-active', 'superseded', issues);
+  check(value, '/priorPlanAuthorization/authority', 'authority.plan-bound-grant-active', 'none', issues);
+  const ordered = [...issues].sort((a, b) => `${a.path}\0${a.issueId}`.localeCompare(`${b.path}\0${b.issueId}`));
+  const blockers: string[] = [];
+  if (ordered.some((entry) => entry.issueId === 'authority.capability.missing')) blockers.push('static.authority.exact-capability-missing');
+  if (ordered.some((entry) => entry.issueId === 'authority.plan-bound-grant-active')) blockers.push('static.authority.plan-bound-grant-not-superseded');
+  if (ordered.length > 0) blockers.push('static.authority.exact-tuple-invalid');
+  const content = { staticTupleValid: ordered.length === 0, blockers: [...new Set(blockers)], issues: ordered,
+    bindings: installedAuthoritySemanticBindings };
+  return deepFreeze({ ...content, reportHash: hashCanonical({ ...content, bindings: content.bindings.map(projectBinding) }) });
+}
+
+function binding(id: string, suffix: string, kind: AuthoritySemanticBinding['kind'], callable: AuthorityCallable): AuthoritySemanticBinding {
+  return { id, version: 1, kind, implementationId: `implementation.${suffix}`, implementationVersion: 1, wiring: 'invoked', callable };
+}
+export function projectAuthoritySemanticBundle(bindings: readonly AuthoritySemanticBinding[]) {
+  const projection = { bundleVersion: 2, bindingManifest: correctiveReplanBindingManifest, bindings: bindings.map(projectBinding) };
+  return deepFreeze({ ...projection, bundleSha256: createHash('sha256').update(JSON.stringify(projection)).digest('hex') });
+}
+function constraint(constraintId: string, suffix: string, right: string) { return { constraintId,
+  comparator: ref(`identity-comparator.corrective-replan.${suffix}`), operands: ['actor.author', right],
+  relation: 'not-equal', missing: 'block', enforcement: 'static-and-runtime' }; }
+function roleVerdict(input: unknown) { const value = record(input); const roles = ['delivery-coordinator', 'technical-planner'];
+  if (!/^[a-f0-9]{64}$/.test(String(value.actorIdentityHash ?? '')) || !sameSet(value.eligibleRoles, roles)
+    || typeof value.actorRole !== 'string' || value.actorRole.length === 0) return verdict(false, 'ROLE_INPUT_INVALID');
+  return roles.includes(value.actorRole) ? verdict(true, null) : verdict(false, 'ROLE_NOT_ELIGIBLE'); }
+function identityVerdict(input: unknown) { const value = record(input); const valid = /^[a-f0-9]{64}$/;
+  if (typeof value.leftIdentityHash !== 'string' || typeof value.rightIdentityHash !== 'string'
+    || !valid.test(value.leftIdentityHash) || !valid.test(value.rightIdentityHash)) return verdict(false, 'IDENTITY_INPUT_INVALID');
+  return value.leftIdentityHash !== value.rightIdentityHash ? verdict(true, null) : verdict(false, 'IDENTITY_CONSTRAINT_VIOLATED'); }
+function verdict(passed: boolean, reasonCode: string | null) { return deepFreeze({ passed, blocked: !passed, reasonCode }); }
+function projectBinding({ callable: _callable, wiring: _wiring, ...binding }: AuthoritySemanticBinding) { return binding; }
+function record(value: unknown): JsonRecord { return isRecord(value) ? value : {}; }
+function isRecord(value: unknown): value is JsonRecord { return value !== null && typeof value === 'object' && !Array.isArray(value); }
+function get(value: JsonRecord, path: string): unknown { return path.split('/').filter(Boolean).reduce<unknown>((cursor, key) =>
+  Array.isArray(cursor) && /^\d+$/.test(key) ? cursor[Number(key)] : isRecord(cursor) ? cursor[key] : undefined, value); }
+function check(value: JsonRecord, path: string, issueId: string, expected: unknown, issues: AuthorityIssue[], reportedPath = path): void {
+  const actual = get(value, path);
+  if (actual === undefined || hashCanonical(actual) !== hashCanonical(expected)) issue(issues, issueId, reportedPath);
+}
+function sameSet(value: unknown, expected: readonly string[]): boolean { return Array.isArray(value) && value.length === expected.length
+  && new Set(value).size === expected.length && value.every((entry) => typeof entry === 'string' && expected.includes(entry)); }
+function extraFields(value: JsonRecord, allowed: readonly string[], prefix: string, issueId: string, issues: AuthorityIssue[]): void {
+  Object.keys(value).filter((key) => !allowed.includes(key)).forEach((key) => issue(issues, issueId, `${prefix}${key}`));
+}
+function issue(issues: AuthorityIssue[], issueId: string, path: string): void { issues.push({ issueId, path, message: `${issueId} at ${path}.` }); }

package/src/lifecycle/corrective-replan-binding-manifest.ts

@@ -0,0 +1,51 @@
+import { hashCanonical } from './canonical-hash.js';
+import { deepFreeze } from './immutable.js';
+import type { ProjectionFieldId, ProjectionId } from './types.js';
+
+const ref = <TId extends string>(id: TId) => ({ id, version: 1 as const });
+type ValueKind = 'literal' | 'sha256' | 'safe-integer' | 'entity-id' | 'git-oid' | 'actor-role';
+type Canonicalization = 'exact' | 'lowercase-hex' | 'safe-nonnegative-integer' | 'nfc-trim' | 'lowercase-git-oid' | 'registered-enum';
+const row = (bindingId: string, projection: ProjectionId, fieldId: ProjectionFieldId, valueKind: ValueKind, canonicalization: Canonicalization) => ({
+  ordinal: rowsOrdinal++, bindingId, projection: ref(projection), fieldId, valueKind, canonicalization,
+  receiptPath: `/binding/values/${bindingId}` as `/binding/values/${string}`,
+});
+let rowsOrdinal = 0;
+const protocol = (id: string, field: ProjectionFieldId, kind: ValueKind, canonical: Canonicalization) => row(id, 'projection.corrective-replan.protocol', field, kind, canonical);
+const state = (id: string, field: ProjectionFieldId, kind: ValueKind, canonical: Canonicalization) => row(id, 'projection.corrective-replan.state', field, kind, canonical);
+const candidate = (id: string, field: ProjectionFieldId) => row(id, 'projection.corrective-replan.candidate', field, 'sha256', 'lowercase-hex');
+const candidateState = (id: string, field: ProjectionFieldId, kind: ValueKind, canonical: Canonicalization) => row(id, 'projection.corrective-replan.candidate', field, kind, canonical);
+const authority = (id: string, field: ProjectionFieldId, kind: ValueKind, canonical: Canonicalization) => row(id, 'projection.corrective-replan.authority', field, kind, canonical);
+
+const rows = [
+  protocol('transitionId', 'field.transition-id', 'literal', 'exact'), protocol('runtimeFingerprint', 'field.runtime-fingerprint', 'sha256', 'lowercase-hex'),
+  protocol('catalogHash', 'field.catalog-hash', 'sha256', 'lowercase-hex'), protocol('lifecycleEpoch', 'field.lifecycle-epoch', 'safe-integer', 'safe-nonnegative-integer'),
+  state('taskId', 'field.task-id', 'entity-id', 'nfc-trim'), state('revision', 'field.task-revision', 'safe-integer', 'safe-nonnegative-integer'),
+  state('currentPlanHash', 'field.current-plan-hash', 'sha256', 'lowercase-hex'), state('briefHash', 'field.brief-hash', 'sha256', 'lowercase-hex'),
+  state('knowledgeRevision', 'field.knowledge-revision', 'safe-integer', 'safe-nonnegative-integer'), state('knowledgeHash', 'field.knowledge-hash', 'sha256', 'lowercase-hex'),
+  candidateState('targetKnowledgeRevision', 'field.target-knowledge-revision', 'safe-integer', 'safe-nonnegative-integer'), candidate('targetKnowledgeHash', 'field.target-knowledge-hash'),
+  state('gitHead', 'field.git-head', 'git-oid', 'lowercase-git-oid'), state('guardedStepId', 'field.guarded-step-id', 'entity-id', 'nfc-trim'),
+  state('correctiveDecisionEventId', 'field.corrective-decision-event-id', 'entity-id', 'nfc-trim'), state('correctiveDecisionHash', 'field.corrective-decision-hash', 'sha256', 'lowercase-hex'),
+  state('attemptCount', 'field.attempt-count', 'safe-integer', 'safe-nonnegative-integer'), state('remediationTailHash', 'field.remediation-tail-hash', 'sha256', 'lowercase-hex'),
+  candidate('candidatePlanHash', 'field.candidate-plan-hash'), candidate('candidateStepSetHash', 'field.candidate-step-set-hash'),
+  candidate('planAuthorIdentityHash', 'field.plan-author-identity-hash'), candidate('planValidationHash', 'field.plan-validation-hash'),
+  candidate('planValidatorIdentityHash', 'field.plan-validator-identity-hash'), candidate('riskAuditHash', 'field.risk-audit-hash'), candidate('riskAuditorIdentityHash', 'field.risk-auditor-identity-hash'),
+  authority('actorIdentityHash', 'field.actor-identity-hash', 'sha256', 'lowercase-hex'), authority('actorRole', 'field.actor-role', 'actor-role', 'registered-enum'),
+  authority('humanPrincipalIdentityHash', 'field.human-principal-identity-hash', 'sha256', 'lowercase-hex'), authority('capabilityId', 'field.capability-id', 'literal', 'exact'),
+  authority('capabilityVersion', 'field.capability-version', 'safe-integer', 'safe-nonnegative-integer'),
+];
+
+const identity = { id: 'binding-manifest.corrective-replan.exact-v1' as const, version: 1 as const, rows };
+export const correctiveReplanBindingManifest = deepFreeze({
+  ...identity,
+  manifestSha256: hashCanonical({ ...identity, rows: [...rows].sort((a, b) => a.bindingId.localeCompare(b.bindingId)) }),
+});
+
+export const correctiveReplanBindingIds = deepFreeze(rows.map(({ bindingId }) => bindingId));
+
+export const historicalCompletedCorrectiveReplanBindingIdentities = deepFreeze([
+  {
+    manifestSha256: 'edab7ee7ac4018e759f5fc702a11a0fd113ef4f2cf8ed8fa823a59fde3012a1a',
+    runtimeFingerprint: 'bd4e7a0ddfcb6abc0c5eb107775e6aea7e08c4606dda4d945d77af8a4520710d',
+    catalogHash: 'fa1d11860d4f07978c3b8e85d1f91cd3d15b17284b05f41e05d462d3bb092aed',
+  },
+] as const);