codex-workflow-v2 2.0.0-beta.2 → 2.0.0-beta.5

package/dist/src/state/corrective-replan-executor.d.ts

@@ -0,0 +1,64 @@
+import type { PlanRiskAuditDecision, PlanRiskAuditStepClassification, TaskPlanInput, TaskState } from '../contracts.js';
+import type { CorrectiveReplanCredentialKernel, ReceiptHandle, StoredPlanValidationEventHandle } from '../lifecycle/corrective-replan-credential-core.js';
+import { type CoreTaskOperationHandle } from './lock.js';
+import { CorrectiveReplanTaskTransactionStore, type CorrectiveReplanTaskTransactionJournal } from './corrective-replan-transaction.js';
+type JsonRecord = Record<string, unknown>;
+export interface CorrectiveReplanRiskAuditInput {
+    readonly summary: string;
+    readonly decision: PlanRiskAuditDecision;
+    readonly splitRationale: string | null;
+    readonly stepClassifications: readonly PlanRiskAuditStepClassification[];
+}
+export type CorrectiveReplanCrashBoundary = 'after-intent' | 'after-applying-phase' | `after-target-${0 | 1 | 2 | 3 | 4}` | `after-target-phase-${0 | 1 | 2 | 3 | 4}` | 'after-published-phase' | 'after-domain-readback' | 'after-completed-phase' | 'after-terminal-readback';
+export interface ExecuteCorrectiveReplanInput {
+    readonly projectId: string;
+    readonly taskId: string;
+    readonly receipt: ReceiptHandle;
+    readonly candidateReceipt: unknown;
+    readonly planValidationEvent: StoredPlanValidationEventHandle;
+    readonly candidatePlanValidationEvent: unknown;
+    readonly plan: TaskPlanInput;
+    readonly riskAudit: CorrectiveReplanRiskAuditInput;
+}
+export interface CorrectiveReplanExecutionResult {
+    readonly kind: 'corrective-replan-execution-result';
+    readonly disposition: 'executed' | 'recovered' | 'replayed';
+    readonly taskId: string;
+    readonly transactionId: string;
+    readonly resultSha256: string;
+}
+export interface CorrectiveReplanExecutor {
+    execute(input: ExecuteCorrectiveReplanInput): CorrectiveReplanExecutionResult;
+    recover(input: {
+        taskId: string;
+        transactionId: string;
+    }): CorrectiveReplanExecutionResult;
+    replay(input: {
+        taskId: string;
+        transactionId: string;
+        receiptHash: string;
+    }): CorrectiveReplanExecutionResult;
+}
+interface ExecutorOptions {
+    readonly taskRoot: string;
+    readonly locksRoot: string;
+    readonly trustedRoot: string;
+    readonly credentialKernel: CorrectiveReplanCredentialKernel;
+    readonly admissionCheck?: (input: Readonly<{
+        task: TaskState;
+        plan: TaskPlanInput;
+        riskAudit: CorrectiveReplanRiskAuditInput;
+        receiptVerified: true;
+        validationEventVerified: true;
+        taskOperationLockHeld: true;
+    }>) => void;
+    readonly now?: () => Date;
+    readonly faultInjector?: (boundary: CorrectiveReplanCrashBoundary) => void;
+}
+export declare function createCorrectiveReplanExecutor(options: ExecutorOptions): CorrectiveReplanExecutor;
+export declare function correctiveReplanStepSetHash(stepIds: readonly string[]): string;
+export declare function correctiveReplanRiskAuditHash(bindingValues: unknown, input: CorrectiveReplanRiskAuditInput): string;
+export declare function driveCorrectiveReplanTransaction(transactions: CorrectiveReplanTaskTransactionStore, handle: CoreTaskOperationHandle, transactionId: string, disposition: CorrectiveReplanExecutionResult['disposition'], fault: (boundary: CorrectiveReplanCrashBoundary) => void): CorrectiveReplanExecutionResult;
+export declare function correctiveReplanTerminalReadback(transactions: CorrectiveReplanTaskTransactionStore, handle: CoreTaskOperationHandle, journal: CorrectiveReplanTaskTransactionJournal): string;
+export declare function correctiveReplanExecutionKeyHash(binding: JsonRecord): string;
+export {};

package/dist/src/state/corrective-replan-executor.js

@@ -0,0 +1,608 @@
+import { createHash } from 'node:crypto';
+import { existsSync, readFileSync } from 'node:fs';
+import { types as utilTypes } from 'node:util';
+import { Ajv2020 } from 'ajv/dist/2020.js';
+import { validatePlan } from '../domain/validation.js';
+import { WorkflowError } from '../errors.js';
+import { computeSidecarEventHash, prepareSidecarAppend, } from '../alpha6/store-sidecars.js';
+import { validateCorrectiveReplanRiskAuditPayload } from '../alpha6/plan-risk.js';
+import { correctiveReplanBindingManifest } from '../lifecycle/corrective-replan-binding-manifest.js';
+import { correctiveReplanCredentialSchemaValidators } from '../lifecycle/corrective-replan-credential-schema.js';
+import { hashCorrectivePlanBytes, prepareCorrectiveReplanCandidate, } from '../lifecycle/corrective-replan.js';
+import { hashCanonical } from '../lifecycle/fingerprint.js';
+import { deepFreeze } from '../lifecycle/immutable.js';
+import { CoreTaskOperationLockManager, } from './lock.js';
+import { CORRECTIVE_REPLAN_TARGETS, CorrectiveReplanTaskTransactionStore, } from './corrective-replan-transaction.js';
+const HASH = /^[a-f0-9]{64}$/;
+const executionSchema = JSON.parse(readFileSync(new URL('../../../schemas/corrective-replan-execution-event.private.schema.json', import.meta.url), 'utf8'));
+const riskSchema = JSON.parse(readFileSync(new URL('../../../schemas/plan-risk-audit-event.schema.json', import.meta.url), 'utf8'));
+const taskSchema = JSON.parse(readFileSync(new URL('../../../schemas/task.schema.json', import.meta.url), 'utf8'));
+const canonicalDateTimeFormat = {
+    type: 'string',
+    validate(value) {
+        const parsed = Date.parse(value);
+        return Number.isFinite(parsed) && new Date(parsed).toISOString() === value;
+    },
+};
+const exactAjv = new Ajv2020({ allErrors: true, strict: true, formats: { 'date-time': canonicalDateTimeFormat } });
+const legacyAjv = new Ajv2020({
+    allErrors: true,
+    strict: false,
+    formats: { 'date-time': canonicalDateTimeFormat },
+});
+if (!exactAjv.validateSchema(executionSchema))
+    throw new TypeError(`Invalid CD-3 schema: ${exactAjv.errorsText(exactAjv.errors)}`);
+for (const candidate of [riskSchema, taskSchema]) {
+    if (!legacyAjv.validateSchema(candidate))
+        throw new TypeError(`Invalid legacy CD-3 input schema: ${legacyAjv.errorsText(legacyAjv.errors)}`);
+}
+const validateExecutionEvent = exactAjv.compile(executionSchema);
+const validateRiskEvent = legacyAjv.compile(riskSchema);
+const validateTask = legacyAjv.compile(taskSchema);
+const planValidationValidator = correctiveReplanCredentialSchemaValidators
+    .find((entry) => entry.id === 'schema.corrective-replan-stored-plan-validation-event');
+if (!planValidationValidator)
+    throw new TypeError('Installed Plan Validation event validator is missing.');
+const validatePlanValidationEvent = planValidationValidator.callable;
+export function createCorrectiveReplanExecutor(options) {
+    const now = options.now ?? (() => new Date());
+    const locks = new CoreTaskOperationLockManager(options.locksRoot, now, options.trustedRoot);
+    const transactions = new CorrectiveReplanTaskTransactionStore({
+        taskRoot: options.taskRoot,
+        locksRoot: options.locksRoot,
+        trustedRoot: options.trustedRoot,
+        now,
+    });
+    const fault = (boundary) => options.faultInjector?.(boundary);
+    const recover = (input) => {
+        assertExactRecord(input, ['taskId', 'transactionId'], 'Recovery input');
+        assertHash(input.transactionId, 'Recovery transaction id');
+        const journal = transactions.read(input.transactionId);
+        if (journal.taskId !== input.taskId)
+            throw new WorkflowError('STATE_CONFLICT', 'Recovery Task identity mismatch.');
+        const handle = locks.acquireForRecovery({
+            entityId: journal.taskId,
+            operationId: journal.executionKeyHash,
+            transitionId: journal.transitionId,
+        });
+        let succeeded = false;
+        try {
+            const result = driveCorrectiveReplanTransaction(transactions, handle, journal.transactionId, 'recovered', fault);
+            succeeded = true;
+            return result;
+        }
+        finally {
+            if (succeeded)
+                locks.release(handle);
+        }
+    };
+    const replay = (input) => {
+        assertExactRecord(input, ['receiptHash', 'taskId', 'transactionId'], 'Replay input');
+        assertHash(input.receiptHash, 'Replay receipt hash');
+        const journal = transactions.read(input.transactionId);
+        if (journal.taskId !== input.taskId || journal.receiptHash !== input.receiptHash) {
+            throw new WorkflowError('STATE_CONFLICT', 'Corrective-replan replay binding mismatch.');
+        }
+        const recovered = recover({ taskId: input.taskId, transactionId: input.transactionId });
+        return deepFreeze({ ...recovered, disposition: journal.phase === 'completed' ? 'replayed' : 'recovered' });
+    };
+    const execute = (input) => {
+        assertExactRecord(input, [
+            'candidatePlanValidationEvent', 'candidateReceipt', 'plan', 'planValidationEvent', 'projectId',
+            'receipt', 'riskAudit', 'taskId',
+        ], 'Execution input');
+        const plan = copyJsonInput(input.plan, 'Plan');
+        const riskAudit = copyJsonInput(input.riskAudit, 'Risk Audit');
+        validatePlan(plan);
+        const receiptVerification = options.credentialKernel.verifyReceipt({
+            receipt: input.receipt,
+            candidate: input.candidateReceipt,
+        });
+        if (!receiptVerification.valid)
+            throw credentialFailure('Receipt verification failed.', receiptVerification.issues);
+        const receipt = receiptVerification.projection;
+        const validationVerification = options.credentialKernel.verifyStoredEvent({
+            event: input.planValidationEvent,
+            candidate: input.candidatePlanValidationEvent,
+        });
+        if (!validationVerification.valid)
+            throw credentialFailure('Plan Validation event verification failed.', validationVerification.issues);
+        const validationEvent = validationVerification.projection;
+        const binding = record(receipt.binding);
+        const values = record(binding.values);
+        const transactionId = correctiveReplanExecutionKeyHash(binding);
+        assertReceiptExecutionIdentity(receipt, values, input, validationEvent, transactionId);
+        if (existsSync(transactions.journalPath(transactionId))) {
+            return replay({ taskId: input.taskId, transactionId, receiptHash: string(receipt.receiptHash) });
+        }
+        const handle = locks.acquire({
+            entityId: input.taskId,
+            operationId: transactionId,
+            transitionId: 'task.plan.corrective-replan',
+        });
+        let intentCreated = false;
+        let succeeded = false;
+        try {
+            const underLock = options.credentialKernel.verifyReceipt({ receipt: input.receipt, candidate: input.candidateReceipt });
+            if (!underLock.valid)
+                throw credentialFailure('Receipt revalidation failed under the Task lock.', underLock.issues);
+            const underLockValidation = options.credentialKernel.verifyStoredEvent({
+                event: input.planValidationEvent, candidate: input.candidatePlanValidationEvent,
+            });
+            if (!underLockValidation.valid)
+                throw credentialFailure('Plan Validation revalidation failed under the Task lock.', underLockValidation.issues);
+            const currentStateBytes = requiredCurrentTarget(transactions, handle, input.taskId, transactionId, 'task-state');
+            const currentTask = parseTask(currentStateBytes);
+            assertCurrentTaskBinding(currentTask, input.projectId, values);
+            const prepared = prepareCorrectiveReplanCandidate(currentTask, plan);
+            if (prepared.planHash !== values.candidatePlanHash
+                || correctiveReplanStepSetHash(prepared.stepIds) !== values.candidateStepSetHash) {
+                throw new WorkflowError('TRANSITION_BLOCKED', 'Replacement Plan does not match the admitted receipt candidate.');
+            }
+            options.admissionCheck?.({
+                task: currentTask, plan, riskAudit,
+                receiptVerified: true, validationEventVerified: true, taskOperationLockHeld: true,
+            });
+            const recordedAt = now().toISOString();
+            const resultTask = materializeResultTask(currentTask, plan, prepared.planHash, recordedAt);
+            const taskState = jsonBytes(resultTask);
+            const validationBytes = appendEventBytes(transactions.captureCurrentTarget(handle, { taskId: input.taskId, operationId: transactionId, targetId: 'plan-validation' }), validationEvent);
+            const risk = materializeRiskAuditEvent(transactions.captureCurrentTarget(handle, { taskId: input.taskId, operationId: transactionId, targetId: 'plan-risk-audit' }), resultTask, values, riskAudit, transactionId, recordedAt);
+            const execution = materializeExecutionEvent(transactions.captureCurrentTarget(handle, { taskId: input.taskId, operationId: transactionId, targetId: 'execution-evidence' }), receipt, values, validationEvent, risk.event, transactionId, resultTask.revision, sha256(taskState), hashCorrectivePlanBytes(prepared.planBytes), recordedAt);
+            transactions.createIntent(handle, {
+                projectId: input.projectId,
+                taskId: input.taskId,
+                transitionId: 'task.plan.corrective-replan',
+                executionKeyHash: transactionId,
+                runtimeFingerprint: string(values.runtimeFingerprint),
+                catalogHash: string(values.catalogHash),
+                lifecycleEpoch: number(values.lifecycleEpoch),
+                bindingManifest: {
+                    id: correctiveReplanBindingManifest.id,
+                    version: correctiveReplanBindingManifest.version,
+                    manifestSha256: correctiveReplanBindingManifest.manifestSha256,
+                },
+                bindingSha256: string(binding.bindingSha256),
+                receiptHash: string(receipt.receiptHash),
+                actorIdentityHash: string(values.actorIdentityHash),
+                humanPrincipalIdentityHash: string(values.humanPrincipalIdentityHash),
+                expectedTaskRevision: currentTask.revision,
+                resultTaskRevision: resultTask.revision,
+                postimages: {
+                    taskState,
+                    plan: Buffer.from(prepared.planBytes, 'utf8'),
+                    planValidation: validationBytes,
+                    planRiskAudit: risk.bytes,
+                    executionEvidence: execution.bytes,
+                },
+            });
+            intentCreated = true;
+            fault('after-intent');
+            const result = driveCorrectiveReplanTransaction(transactions, handle, transactionId, 'executed', fault);
+            succeeded = true;
+            return result;
+        }
+        finally {
+            if (succeeded || !intentCreated)
+                locks.release(handle);
+        }
+    };
+    return deepFreeze({ execute, recover, replay });
+}
+export function correctiveReplanStepSetHash(stepIds) {
+    return hashCanonical({
+        domain: 'codex-workflow/corrective-replan-step-set/v1',
+        stepIds: [...stepIds].sort(),
+    });
+}
+export function correctiveReplanRiskAuditHash(bindingValues, input) {
+    const values = record(bindingValues);
+    return hashCanonical({
+        domain: 'codex-workflow/corrective-replan-risk-audit/v1',
+        taskId: values.taskId,
+        taskRevision: number(values.revision) + 1,
+        briefHash: values.briefHash,
+        planHash: values.candidatePlanHash,
+        knowledgeMapRevision: values.knowledgeRevision,
+        knowledgeMapHash: values.knowledgeHash,
+        planner: values.planAuthorIdentityHash,
+        auditor: values.riskAuditorIdentityHash,
+        summary: input.summary,
+        decision: input.decision,
+        splitRationale: input.splitRationale,
+        stepClassifications: input.stepClassifications,
+    });
+}
+export function driveCorrectiveReplanTransaction(transactions, handle, transactionId, disposition, fault) {
+    let journal = transactions.read(transactionId);
+    if (journal.phase === 'intent') {
+        journal = transactions.compareAndSetPhase(handle, transactionId, {
+            expectedPhase: 'intent', expectedRevision: journal.phaseRevision,
+            nextPhase: 'applying', nextTargetOrdinal: 0,
+        });
+        fault('after-applying-phase');
+    }
+    while (journal.phase === 'applying' && journal.nextTargetOrdinal < CORRECTIVE_REPLAN_TARGETS.length) {
+        const ordinal = journal.nextTargetOrdinal;
+        transactions.applyTarget(handle, transactionId, CORRECTIVE_REPLAN_TARGETS[ordinal].targetId);
+        fault(`after-target-${ordinal}`);
+        journal = transactions.compareAndSetPhase(handle, transactionId, {
+            expectedPhase: 'applying', expectedRevision: journal.phaseRevision,
+            nextPhase: 'applying', nextTargetOrdinal: ordinal + 1,
+        });
+        fault(`after-target-phase-${ordinal}`);
+    }
+    if (journal.phase === 'applying') {
+        journal = transactions.compareAndSetPhase(handle, transactionId, {
+            expectedPhase: 'applying', expectedRevision: journal.phaseRevision,
+            nextPhase: 'published-pending-readback', nextTargetOrdinal: CORRECTIVE_REPLAN_TARGETS.length,
+        });
+        fault('after-published-phase');
+    }
+    if (journal.phase === 'published-pending-readback') {
+        const resultSha256 = domainReadback(transactions, handle, journal);
+        fault('after-domain-readback');
+        journal = transactions.compareAndSetPhase(handle, transactionId, {
+            expectedPhase: 'published-pending-readback', expectedRevision: journal.phaseRevision,
+            nextPhase: 'completed', nextTargetOrdinal: CORRECTIVE_REPLAN_TARGETS.length,
+            completedResultSha256: resultSha256,
+        });
+        fault('after-completed-phase');
+    }
+    const resultSha256 = correctiveReplanTerminalReadback(transactions, handle, journal);
+    fault('after-terminal-readback');
+    return deepFreeze({
+        kind: 'corrective-replan-execution-result',
+        disposition,
+        taskId: journal.taskId,
+        transactionId: journal.transactionId,
+        resultSha256,
+    });
+}
+function domainReadback(transactions, handle, journal) {
+    return validateReadback(journal, Object.fromEntries(CORRECTIVE_REPLAN_TARGETS.map((target) => [
+        target.targetId,
+        transactions.readCanonicalTarget(handle, journal.transactionId, target.targetId),
+    ])));
+}
+export function correctiveReplanTerminalReadback(transactions, handle, journal) {
+    const completed = transactions.read(journal.transactionId);
+    if (completed.phase !== 'completed' || !completed.completedResult) {
+        throw new WorkflowError('TASK_RECOVERY_REQUIRED', 'Corrective-replan transaction is not terminal.');
+    }
+    const result = domainReadback(transactions, handle, completed);
+    if (result !== completed.completedResult.resultSha256) {
+        throw new WorkflowError('STATE_CORRUPT', 'Completed corrective-replan result digest mismatch.');
+    }
+    return result;
+}
+function validateReadback(journal, targets) {
+    const task = parseTask(targets['task-state']);
+    const plan = targets.plan;
+    const validationEvents = parseSidecarBytes(targets['plan-validation']);
+    const riskEvents = parseSidecarBytes(targets['plan-risk-audit']);
+    const executionEvents = parseSidecarBytes(targets['execution-evidence']);
+    const validation = record(validationEvents.at(-1));
+    const risk = record(riskEvents.at(-1));
+    const execution = record(executionEvents.at(-1));
+    if (task.id !== journal.taskId || task.projectId !== journal.projectId
+        || task.revision !== journal.targets[0].taskCas.resultRevision
+        || task.status !== 'awaiting_execution_authorization'
+        || task.planHash !== sha256(plan)
+        || task.authorizations.some((authorization) => authorization.kind === 'execution' && authorization.decision === 'approved')) {
+        throw new WorkflowError('STATE_CORRUPT', 'Corrective-replan Task/Plan readback mismatch.');
+    }
+    if (validatePlanValidationEvent(validation) !== true || validation.receiptHash !== journal.receiptHash
+        || validation.taskId !== journal.taskId || validation.candidatePlanHash !== task.planHash) {
+        throw new WorkflowError('STATE_CORRUPT', 'Plan Validation readback mismatch.');
+    }
+    if (validateRiskEvent(risk) !== true)
+        throw new WorkflowError('STATE_CORRUPT', 'Plan Risk Audit readback schema mismatch.');
+    validateCorrectiveReplanRiskAuditPayload(task, risk, task.steps.map((step) => step.id));
+    if (risk.planHash !== task.planHash || risk.taskRevision !== task.revision) {
+        throw new WorkflowError('STATE_CORRUPT', 'Plan Risk Audit readback binding mismatch.');
+    }
+    if (validateExecutionEvent(execution) !== true
+        || execution.executionKeyHash !== journal.executionKeyHash
+        || execution.bindingSha256 !== journal.bindingSha256
+        || execution.receiptHash !== journal.receiptHash
+        || execution.taskId !== journal.taskId
+        || execution.taskRevision !== task.revision
+        || execution.candidatePlanHash !== task.planHash
+        || execution.planValidationEventHash !== validation.eventHash
+        || execution.planRiskAuditEventHash !== risk.eventHash
+        || execution.taskStateSha256 !== sha256(targets['task-state'])
+        || execution.planBytesSha256 !== sha256(plan)) {
+        throw new WorkflowError('STATE_CORRUPT', 'Execution evidence readback mismatch.');
+    }
+    return hashCanonical({
+        domain: 'codex-workflow/corrective-replan-execution-result/v1',
+        transactionId: journal.transactionId,
+        intentSha256: journal.intentSha256,
+        receiptHash: journal.receiptHash,
+        targets: journal.targets.map((target) => ({ targetId: target.targetId, contentSha256: target.postimage.contentSha256 })),
+        executionEventHash: execution.eventHash,
+    });
+}
+function materializeResultTask(task, plan, planHash, recordedAt) {
+    const completedIds = task.steps.filter((candidate) => candidate.status === 'completed').map((candidate) => candidate.id);
+    const plannedSteps = plan.steps.map((step) => {
+        const completed = preserveCompletedStep(task, step);
+        if (completed)
+            return completed;
+        const previous = task.steps.find((candidate) => candidate.id === step.id);
+        return {
+            ...step,
+            status: previous?.status === 'failed'
+                ? 'failed'
+                : step.dependencies.every((dependency) => completedIds.includes(dependency))
+                    ? 'planned'
+                    : 'blocked',
+            evidence: null,
+        };
+    });
+    const result = {
+        ...task,
+        revision: task.revision + 1,
+        updatedAt: recordedAt,
+        status: 'awaiting_execution_authorization',
+        planHash,
+        planObjective: plan.objective,
+        requirements: [...plan.requirements],
+        acceptance: [...plan.acceptance],
+        risks: [...plan.risks],
+        knowledgeImpact: plan.knowledgeImpact,
+        knowledgeImpactReason: plan.knowledgeImpactReason,
+        knowledgeTargets: structuredClone(plan.knowledgeTargets),
+        knowledgeMapRevision: plan.knowledgeMapRevision,
+        knowledgeMapHash: plan.knowledgeMapHash,
+        graphUse: plan.graphUse,
+        steps: plannedSteps,
+        authorizations: task.authorizations.map((authorization) => authorization.kind === 'execution' && authorization.decision === 'approved'
+            ? { ...authorization, decision: 'superseded' }
+            : authorization),
+        review: emptyReview(),
+        resultHash: null,
+        evidenceHash: null,
+        blockReason: null,
+    };
+    if (validateTask(result) !== true)
+        throw new WorkflowError('STATE_CORRUPT', 'Materialized corrective-replan Task is invalid.');
+    return result;
+}
+function materializeRiskAuditEvent(current, task, values, input, executionKeyHashValue, recordedAt) {
+    if (correctiveReplanRiskAuditHash(values, input) !== values.riskAuditHash) {
+        throw new WorkflowError('TRANSITION_BLOCKED', 'Plan Risk Audit does not match the admitted receipt.');
+    }
+    const event = {
+        eventId: `PRA-${executionKeyHashValue}`,
+        recordedAt,
+        taskId: task.id,
+        taskRevision: task.revision,
+        briefHash: values.briefHash,
+        planHash: values.candidatePlanHash,
+        knowledgeMapRevision: values.knowledgeRevision,
+        knowledgeMapHash: values.knowledgeHash,
+        planner: values.planAuthorIdentityHash,
+        auditor: values.riskAuditorIdentityHash,
+        summary: input.summary,
+        decision: input.decision,
+        splitRationale: input.splitRationale,
+        stepClassifications: input.stepClassifications,
+    };
+    validateCorrectiveReplanRiskAuditPayload(task, event, task.steps.map((step) => step.id));
+    const prepared = appendEvent(current, event);
+    if (validateRiskEvent(prepared.event) !== true)
+        throw new WorkflowError('INVALID_ARGUMENT', 'Plan Risk Audit event schema is invalid.');
+    return prepared;
+}
+function materializeExecutionEvent(current, receipt, values, validationEvent, riskEvent, executionKeyHashValue, taskRevision, taskStateSha256, planBytesSha256, recordedAt) {
+    const binding = record(receipt.binding);
+    const event = {
+        schemaVersion: 1,
+        kind: 'corrective-replan-execution-recorded',
+        eventId: `CRE-${executionKeyHashValue}`,
+        recordedAt,
+        taskId: values.taskId,
+        taskRevision,
+        taskStatus: 'awaiting_execution_authorization',
+        transitionId: values.transitionId,
+        executionKeyHash: executionKeyHashValue,
+        runtimeFingerprint: values.runtimeFingerprint,
+        catalogHash: values.catalogHash,
+        lifecycleEpoch: values.lifecycleEpoch,
+        bindingManifest: {
+            id: correctiveReplanBindingManifest.id,
+            version: correctiveReplanBindingManifest.version,
+            manifestSha256: correctiveReplanBindingManifest.manifestSha256,
+        },
+        bindingSha256: binding.bindingSha256,
+        receiptId: receipt.receiptId,
+        receiptHash: receipt.receiptHash,
+        receiptDomainHash: receipt.domainHash,
+        candidatePlanHash: values.candidatePlanHash,
+        planValidationEventHash: validationEvent.eventHash,
+        planRiskAuditEventHash: riskEvent.eventHash,
+        actorIdentityHash: values.actorIdentityHash,
+        humanPrincipalIdentityHash: values.humanPrincipalIdentityHash,
+        priorGrantHash: get(receipt, '/supersession/priorGrantHash'),
+        taskStateSha256,
+        planBytesSha256,
+    };
+    const prepared = appendEvent(current, event);
+    if (validateExecutionEvent(prepared.event) !== true) {
+        throw new WorkflowError('STATE_CORRUPT', 'Execution evidence materialization failed schema validation.');
+    }
+    return prepared;
+}
+function appendEvent(current, event) {
+    const prepared = prepareSidecarAppend(parseSidecarBytes(current), event);
+    return { bytes: Buffer.from(prepared.content, 'utf8'), event: prepared.event };
+}
+function appendEventBytes(current, event) {
+    return appendEvent(current, event).bytes;
+}
+function parseSidecarBytes(content) {
+    if (content === null || content.byteLength === 0)
+        return [];
+    const text = content.toString('utf8');
+    if (!text.endsWith('\n'))
+        throw new WorkflowError('STATE_CORRUPT', 'Corrective-replan sidecar is not newline terminated.');
+    const events = [];
+    let previous = null;
+    for (const line of text.slice(0, -1).split('\n')) {
+        let parsed;
+        try {
+            parsed = JSON.parse(line);
+        }
+        catch {
+            throw new WorkflowError('STATE_CORRUPT', 'Corrective-replan sidecar contains invalid JSON.');
+        }
+        const event = record(parsed);
+        if (typeof event.eventId !== 'string' || typeof event.recordedAt !== 'string' || event.previousEventHash !== previous
+            || !HASH.test(event.eventHash) || computeSidecarEventHash(event) !== event.eventHash) {
+            throw new WorkflowError('STATE_CORRUPT', 'Corrective-replan sidecar chain is invalid.');
+        }
+        previous = event.eventHash;
+        events.push(event);
+    }
+    return events;
+}
+function assertReceiptExecutionIdentity(receipt, values, input, validationEvent, transactionId) {
+    const binding = record(receipt.binding);
+    if (values.transitionId !== 'task.plan.corrective-replan' || values.taskId !== input.taskId
+        || binding.manifestSha256 !== correctiveReplanBindingManifest.manifestSha256
+        || get(binding, '/manifestRef/id') !== correctiveReplanBindingManifest.id
+        || get(binding, '/manifestRef/version') !== correctiveReplanBindingManifest.version
+        || validationEvent.receiptHash !== receipt.receiptHash
+        || validationEvent.taskId !== values.taskId
+        || validationEvent.candidatePlanHash !== values.candidatePlanHash
+        || !HASH.test(transactionId)) {
+        throw new WorkflowError('TRANSITION_BLOCKED', 'Credential does not bind the exact corrective-replan execution.');
+    }
+}
+function assertCurrentTaskBinding(task, projectId, values) {
+    if (task.projectId !== projectId || task.id !== values.taskId || task.revision !== values.revision
+        || task.planHash !== values.currentPlanHash || task.briefHash !== values.briefHash
+        || task.knowledgeMapRevision !== values.knowledgeRevision || task.knowledgeMapHash !== values.knowledgeHash) {
+        throw new WorkflowError('STATE_CONFLICT', 'Current Task no longer matches the admitted corrective-replan binding.');
+    }
+}
+export function correctiveReplanExecutionKeyHash(binding) {
+    return hashCanonical({
+        domain: 'codex-workflow/corrective-replan-execution-key/v1',
+        manifestRef: binding.manifestRef,
+        manifestSha256: binding.manifestSha256,
+        values: binding.values,
+    });
+}
+function requiredCurrentTarget(transactions, handle, taskId, operationId, targetId) {
+    const value = transactions.captureCurrentTarget(handle, { taskId, operationId, targetId });
+    if (value === null)
+        throw new WorkflowError('STATE_CONFLICT', 'Corrective-replan Task state is missing.');
+    return value;
+}
+function parseTask(content) {
+    let value;
+    try {
+        value = JSON.parse(content.toString('utf8'));
+    }
+    catch {
+        throw new WorkflowError('STATE_CORRUPT', 'Task state is invalid JSON.');
+    }
+    if (validateTask(value) !== true)
+        throw new WorkflowError('STATE_CORRUPT', 'Task state schema is invalid.');
+    return value;
+}
+function preserveCompletedStep(task, next) {
+    const previous = task.steps.find((candidate) => candidate.id === next.id && candidate.status === 'completed');
+    if (!previous)
+        return null;
+    const { status: _status, evidence: _evidence, ...definition } = previous;
+    return JSON.stringify(definition) === JSON.stringify(next) ? previous : null;
+}
+function emptyReview() {
+    return { status: 'pending', reviewer: '', recordedAt: null, headCommit: null, briefHash: null,
+        planHash: null, evidenceHash: null, summary: '', findings: [] };
+}
+function credentialFailure(message, issues) {
+    return new WorkflowError('TRANSITION_BLOCKED', message, { credentialIssueIds: issues.map((candidate) => record(candidate).issueId) });
+}
+function copyJsonInput(value, label) {
+    const copied = copyJson(value, new Set(), 0, { nodes: 0, bytes: 0 });
+    if (copied === undefined)
+        throw new WorkflowError('INVALID_ARGUMENT', `${label} must be bounded plain JSON data.`);
+    return copied;
+}
+function copyJson(value, active, depth, budget) {
+    if (++budget.nodes > 4096 || (budget.bytes += 8) > 262_144 || depth > 32)
+        return undefined;
+    if (typeof value === 'string') {
+        budget.bytes += Buffer.byteLength(value, 'utf8');
+        return budget.bytes > 262_144 ? undefined : value;
+    }
+    if (value === null || typeof value === 'boolean')
+        return value;
+    if (typeof value === 'number')
+        return Number.isFinite(value) && Number.isSafeInteger(value) ? value : undefined;
+    if (typeof value !== 'object' || utilTypes.isProxy(value) || active.has(value))
+        return undefined;
+    const arrayValue = Array.isArray(value);
+    if (arrayValue && value.length > 4096)
+        return undefined;
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== (arrayValue ? Array.prototype : Object.prototype) && prototype !== null)
+        return undefined;
+    const keys = Reflect.ownKeys(value);
+    if (keys.some((key) => typeof key !== 'string'))
+        return undefined;
+    const names = keys.filter((key) => !arrayValue || key !== 'length');
+    if (arrayValue && (names.length !== value.length || names.some((key, index) => key !== String(index))))
+        return undefined;
+    const descriptors = Object.getOwnPropertyDescriptors(value);
+    const result = arrayValue ? [] : Object.create(null);
+    active.add(value);
+    for (const key of names) {
+        const descriptor = descriptors[key];
+        budget.bytes += Buffer.byteLength(key, 'utf8');
+        if (budget.bytes > 262_144)
+            return undefined;
+        if (!descriptor?.enumerable || !('value' in descriptor))
+            return undefined;
+        const child = copyJson(descriptor.value, active, depth + 1, budget);
+        if (child === undefined)
+            return undefined;
+        result[key] = child;
+    }
+    active.delete(value);
+    return result;
+}
+function assertExactRecord(value, keys, label) {
+    if (!value || typeof value !== 'object' || Array.isArray(value) || utilTypes.isProxy(value)
+        || Object.getPrototypeOf(value) !== Object.prototype) {
+        throw new WorkflowError('INVALID_ARGUMENT', `${label} has unknown or missing fields.`);
+    }
+    const ownKeys = Reflect.ownKeys(value);
+    const descriptors = Object.getOwnPropertyDescriptors(value);
+    if (ownKeys.some((key) => typeof key !== 'string')
+        || ownKeys.map(String).sort().join('\0') !== [...keys].sort().join('\0')
+        || ownKeys.some((key) => {
+            const descriptor = descriptors[String(key)];
+            return !descriptor?.enumerable || !('value' in descriptor);
+        })) {
+        throw new WorkflowError('INVALID_ARGUMENT', `${label} has unknown or missing fields.`);
+    }
+}
+function jsonBytes(value) { return Buffer.from(`${JSON.stringify(value, null, 2)}\n`, 'utf8'); }
+function sha256(value) { return createHash('sha256').update(value).digest('hex'); }
+function assertHash(value, label) {
+    if (typeof value !== 'string' || !HASH.test(value))
+        throw new WorkflowError('INVALID_ARGUMENT', `${label} must be lowercase SHA-256.`);
+}
+function record(value) { return value !== null && typeof value === 'object' && !Array.isArray(value) ? value : {}; }
+function string(value) { return typeof value === 'string' ? value : ''; }
+function number(value) { return typeof value === 'number' && Number.isSafeInteger(value) ? value : Number.NaN; }
+function get(value, pointer) {
+    return pointer.split('/').filter(Boolean).reduce((current, key) => record(current)[key], value);
+}
+//# sourceMappingURL=corrective-replan-executor.js.map