codex-workflow-v2 2.0.0-beta.2 → 2.0.0-beta.5

package/dist/src/lifecycle/corrective-replan-credential-core.js

@@ -0,0 +1,563 @@
+import { createHash } from 'node:crypto';
+import { types as utilTypes } from 'node:util';
+import { correctiveReplanBindingManifest } from './corrective-replan-binding-manifest.js';
+import { installedAuthoritySemanticBindings } from './corrective-replan-authority.js';
+import { correctiveReplanCredentialSchemaValidators } from './corrective-replan-credential-schema.js';
+import { hashCanonical } from './fingerprint.js';
+import { deepFreeze } from './immutable.js';
+import { LIFECYCLE_EPOCH } from './types.js';
+const kernels = new WeakMap();
+const TTL = 900_000;
+const MAX_SAFE = Number.MAX_SAFE_INTEGER;
+const MALFORMED = Symbol('malformed');
+const LIMIT = Symbol('limit');
+export function createCorrectiveReplanCredentialKernel(ports) {
+    if (!exactKeys(ports, ['snapshotSource', 'coreClock', 'idSource', 'challengeCodeSource', 'validationEventTailSource']))
+        throw new TypeError('Invalid corrective replan Core ports.');
+    const captured = deepFreeze({
+        readSnapshot: ports.snapshotSource.readCorrectiveReplanSnapshot.bind(ports.snapshotSource),
+        now: ports.coreClock.nowMs.bind(ports.coreClock), nextId: ports.idSource.nextId.bind(ports.idSource),
+        issueCode: ports.challengeCodeSource.issueConfirmationCode.bind(ports.challengeCodeSource),
+        readTail: ports.validationEventTailSource.readPlanValidationTail.bind(ports.validationEventTailSource),
+    });
+    const issuer = Object.freeze(Object.create(null));
+    kernels.set(issuer, { ports: captured, plans: new WeakMap(), challenges: new WeakMap(), confirmations: new WeakMap(),
+        receipts: new WeakMap(), events: new WeakMap(), preparations: new Map(), preparationGeneration: { value: 0 },
+        challenged: new WeakSet(), confirmed: new WeakSet(), receipted: new WeakSet(), evented: new WeakSet() });
+    return deepFreeze({
+        issuePlanValidation: (input) => totalResult(() => issuePlanValidation(issuer, input)),
+        issueHumanChallenge: (input) => totalResult(() => issueHumanChallenge(issuer, input)),
+        confirmHuman: (input) => totalResult(() => confirmHuman(issuer, input)),
+        issueReceipt: (input) => totalResult(() => issueReceipt(issuer, input)),
+        verifyReceipt: (input) => totalVerification(() => verifyReceipt(issuer, input)),
+        materializeStoredEvent: (input) => totalResult(() => materializeStoredEvent(issuer, input)),
+        verifyStoredEvent: (input) => totalVerification(() => verifyStoredEvent(issuer, input)),
+    });
+}
+const issuePlanValidation = (issuer, input) => {
+    const kernel = kernels.get(object(issuer));
+    if (!kernel)
+        return rejected('credential.provenance.invalid', '/', 'provenance');
+    const owned = copyOwnedJson(input);
+    if (owned === LIMIT)
+        return rejected('credential.operation.limit-exceeded', '/', 'schema');
+    if (owned === MALFORMED || !exactKeys(owned, ['taskId', 'draft']))
+        return rejected('credential.operation.malformed', '/', 'schema');
+    const envelope = owned;
+    if (!canonicalId(envelope.taskId) || !exactDraft(envelope.draft))
+        return rejected('credential.plan-validation.input-invalid', '/draft', 'schema');
+    const now = safeTime(kernel.ports.now());
+    if (now === null)
+        return rejected('credential.time.invalid', '/coreClock', 'time');
+    const loaded = loadCanonicalSnapshot(kernel, envelope.taskId);
+    if ('issueId' in loaded)
+        return rejected(loaded.issueId, loaded.path, loaded.reasonClass);
+    const { snapshot, snapshotBindingHash } = loaded;
+    const base = record(snapshot.baseValues);
+    const expected = record(snapshot.validationExpectation);
+    const draft = record(envelope.draft);
+    for (const key of ['requirements', 'acceptance', 'architecture'])
+        if (!same(draft[key], expected[key]))
+            return rejected('credential.plan-validation.snapshot-mismatch', `/draft/${key}`, 'binding');
+    const validatorContext = record(draft.validatorContext);
+    const plannerContextHash = get(expected, '/plannerContext/contextHash');
+    if (validatorContext.contextHash === plannerContextHash)
+        return rejected('credential.plan-validation.context-invalid', '/draft/validatorContext', 'binding');
+    if (base.planAuthorIdentityHash === base.planValidatorIdentityHash)
+        return rejected('credential.plan-validation.sod-invalid', '/snapshot/baseValues/planValidatorIdentityHash', 'sod');
+    const findings = array(draft.findings);
+    const dispositions = array(draft.dispositions);
+    if (!keyedBijection(findings, dispositions))
+        return rejected('credential.plan-validation.findings-invalid', '/draft/findings', 'binding');
+    const plannerCaptured = safeTime(get(expected, '/plannerContext/capturedAtMs'));
+    if (plannerCaptured === null || plannerCaptured > now)
+        return rejected('credential.plan-validation.context-time-invalid', '/snapshot/validationExpectation/plannerContext/capturedAtMs', 'time');
+    const preparationKey = hashCanonical({ family: 'corrective-replan', snapshotBindingHash, transitionId: base.transitionId,
+        taskId: base.taskId, revision: base.revision, candidatePlanHash: base.candidatePlanHash, candidateStepSetHash: base.candidateStepSetHash });
+    const previous = kernel.preparations.get(preparationKey);
+    if (previous && now < previous.expiresAtMs)
+        return rejected('credential.preparation.duplicate', '/taskId', 'provenance');
+    if (previous)
+        kernel.preparations.delete(preparationKey);
+    const generation = ++kernel.preparationGeneration.value;
+    kernel.preparations.set(preparationKey, { generation, status: 'reserved', expiresAtMs: now + TTL });
+    let committed = false;
+    try {
+        const sortedFindings = sortRows(findings);
+        const sortedDispositions = sortRows(dispositions);
+        const freshContext = { sourceSnapshotHash: snapshotBindingHash, plannerContextHash, validatorContextHash: validatorContext.contextHash, passed: true };
+        const validation = { domain: 'codex-workflow/plan-validation/v1', source: expected.source, candidate: expected.candidate,
+            requirements: draft.requirements, acceptance: draft.acceptance, architecture: draft.architecture,
+            planAuthor: expected.planAuthor, plannerContext: expected.plannerContext, validator: expected.validator,
+            validatorContext: { contextHash: validatorContext.contextHash, capturedAtMs: now }, freshContext,
+            passed: true, findings: sortedFindings, dispositions: sortedDispositions, validatedAtMs: now, expiresAtMs: now + TTL };
+        const planValidationHash = hashCanonical(validation);
+        const values = { ...clone(base), planValidationHash };
+        if (!canonicalManifestValues(values, true))
+            return rejected('credential.binding.values-invalid', '/binding/values', 'binding');
+        const capability = { id: 'capability.task.corrective-replan', version: 1,
+            issuer: { kind: 'human', identityHash: values.humanPrincipalIdentityHash }, source: 'human-confirmation',
+            scope: { transitionId: values.transitionId, taskId: values.taskId, candidatePlanHash: values.candidatePlanHash,
+                manifestSha256: correctiveReplanBindingManifest.manifestSha256 }, delegation: 'forbidden' };
+        const bindingBase = { schemaVersion: 1, manifestRef: { id: correctiveReplanBindingManifest.id, version: 1 },
+            manifestSha256: correctiveReplanBindingManifest.manifestSha256, values, capability };
+        const binding = { ...bindingBase, bindingSha256: hashCanonical(bindingBase) };
+        if (!schema('schema.corrective-replan-binding', binding))
+            return rejected('credential.binding.invalid', '/binding', 'schema');
+        const attestationBase = { schemaVersion: 1, attestationId: safeId(kernel.ports.nextId('plan-validation-attestation')),
+            bindingSha256: binding.bindingSha256, source: validation.source, candidate: validation.candidate,
+            requirements: validation.requirements, acceptance: validation.acceptance, architecture: validation.architecture,
+            planAuthor: validation.planAuthor, plannerContext: validation.plannerContext, validator: validation.validator,
+            validatorContext: validation.validatorContext, freshContext, passed: true,
+            findings: sortedFindings, dispositions: sortedDispositions, validatedAtMs: now, expiresAtMs: now + TTL };
+        if (!attestationBase.attestationId)
+            return rejected('credential.id.invalid', '/idSource', 'integrity');
+        const attestation = { ...attestationBase, attestationHash: hashCanonical(attestationBase) };
+        if (!schema('schema.corrective-replan-plan-validation-attestation', attestation))
+            return rejected('credential.plan-validation.invalid', '/attestation', 'schema');
+        const handle = opaque();
+        const recordValue = deepFreeze({ preparationKey, generation, snapshot, snapshotBindingHash, binding, attestation });
+        kernel.plans.set(handle, recordValue);
+        kernel.preparations.set(preparationKey, { generation, status: 'active', expiresAtMs: now + TTL });
+        committed = true;
+        return accepted({ handle: handle, binding, attestation });
+    }
+    finally {
+        if (!committed && kernel.preparations.get(preparationKey)?.generation === generation)
+            kernel.preparations.delete(preparationKey);
+    }
+};
+const issueHumanChallenge = (issuer, input) => {
+    const kernel = kernels.get(object(issuer));
+    if (!kernel)
+        return rejected('credential.provenance.invalid', '/', 'provenance');
+    if (!exactKeys(input, ['planValidation']))
+        return rejected('credential.envelope.invalid', '/', 'schema');
+    const handle = object(input.planValidation);
+    const plan = kernel.plans.get(handle);
+    if (!plan)
+        return rejected('credential.provenance.invalid', '/planValidation', 'provenance');
+    if (!activePreparation(kernel, plan))
+        return rejected('credential.preparation.superseded', '/planValidation', 'provenance');
+    if (kernel.challenged.has(handle))
+        return rejected('credential.provenance.invalid', '/planValidation', 'provenance');
+    const now = safeTime(kernel.ports.now());
+    if (now === null)
+        return rejected('credential.time.invalid', '/coreClock', 'time');
+    if (now < number(plan.attestation.validatedAtMs))
+        return rejected('credential.challenge.time-invalid', '/coreClock', 'time');
+    const expiresAtMs = Math.min(now + TTL, number(plan.attestation.expiresAtMs));
+    if (now >= expiresAtMs)
+        return rejected('credential.challenge.expired', '/planValidation', 'time');
+    const challengeId = safeId(kernel.ports.nextId('human-challenge'));
+    if (!challengeId)
+        return rejected('credential.challenge.source-invalid', '/idSource', 'integrity');
+    const code = kernel.ports.issueCode();
+    if (typeof code !== 'string' || !/^[0-9]{6}$/.test(code))
+        return rejected('credential.challenge.source-invalid', '/challengeCodeSource', 'integrity');
+    const core = { schemaVersion: 1, challengeId, owner: 'workflow-core', bindingSha256: plan.binding.bindingSha256,
+        codeSha256: sha(code), issuedAtMs: now, expiresAtMs };
+    const challenge = deepFreeze({ ...core, challengeHash: hashCanonical(core) });
+    const challengeHandle = opaque();
+    kernel.challenges.set(challengeHandle, deepFreeze({ plan, challenge }));
+    kernel.challenged.add(handle);
+    return accepted({ handle: challengeHandle,
+        delivery: { kind: 'corrective-replan-human-challenge-delivery', version: 1, challengeId, confirmationCode: code, expiresAtMs } });
+};
+const confirmHuman = (issuer, input) => {
+    const kernel = kernels.get(object(issuer));
+    if (!kernel)
+        return rejected('credential.provenance.invalid', '/', 'provenance');
+    if (!exactKeys(input, ['challenge', 'confirmation']))
+        return rejected('credential.envelope.invalid', '/', 'schema');
+    const confirmation = input.confirmation;
+    if (!schema('schema.corrective-replan-human-confirmation-input', confirmation))
+        return rejected('credential.confirmation.input-invalid', '/confirmation', 'schema');
+    const challengeHandle = object(input.challenge);
+    const challenge = kernel.challenges.get(challengeHandle);
+    if (!challenge)
+        return rejected('credential.provenance.invalid', '/challenge', 'provenance');
+    if (!activePreparation(kernel, challenge.plan))
+        return rejected('credential.preparation.superseded', '/challenge', 'provenance');
+    if (kernel.confirmed.has(challengeHandle))
+        return rejected('credential.provenance.invalid', '/challenge', 'provenance');
+    const candidate = confirmation;
+    const now = safeTime(kernel.ports.now());
+    if (now === null)
+        return rejected('credential.time.invalid', '/coreClock', 'time');
+    const validatedAt = number(challenge.plan.attestation.validatedAtMs);
+    const issuedAt = number(challenge.challenge.issuedAtMs);
+    const expiresAt = number(challenge.challenge.expiresAtMs);
+    if (now >= expiresAt)
+        return rejected('credential.confirmation.expired', '/coreClock', 'time');
+    if (now < validatedAt || now < issuedAt)
+        return rejected('credential.confirmation.time-invalid', '/coreClock', 'time');
+    if (candidate.challengeId !== challenge.challenge.challengeId || sha(string(candidate.confirmationCode)) !== challenge.challenge.codeSha256)
+        return rejected('credential.confirmation.invalid', '/confirmation/confirmationCode', 'integrity');
+    const projection = { challengeId: challenge.challenge.challengeId, challengeHash: challenge.challenge.challengeHash,
+        bindingSha256: challenge.plan.binding.bindingSha256,
+        humanPrincipalIdentityHash: get(challenge.plan.binding, '/values/humanPrincipalIdentityHash'), confirmedAtMs: now };
+    const handle = opaque();
+    kernel.confirmations.set(handle, deepFreeze({ challenge, projection }));
+    kernel.confirmed.add(challengeHandle);
+    return accepted({ handle: handle, projection });
+};
+const issueReceipt = (issuer, input) => {
+    const kernel = kernels.get(object(issuer));
+    if (!kernel)
+        return rejected('credential.provenance.invalid', '/', 'provenance');
+    if (!exactKeys(input, ['planValidation', 'confirmation']))
+        return rejected('credential.envelope.invalid', '/', 'schema');
+    const plan = kernel.plans.get(object(input.planValidation));
+    const confirmationHandle = object(input.confirmation);
+    const confirmation = kernel.confirmations.get(confirmationHandle);
+    if (!plan || !confirmation || confirmation.challenge.plan !== plan)
+        return rejected('credential.provenance.invalid', '/', 'provenance');
+    if (!activePreparation(kernel, plan))
+        return rejected('credential.preparation.superseded', '/planValidation', 'provenance');
+    if (kernel.receipted.has(confirmationHandle))
+        return rejected('credential.provenance.invalid', '/', 'provenance');
+    const freshness = receiptFreshnessIssue(kernel, plan);
+    if (freshness)
+        return rejected(freshness.issueId, freshness.path, freshness.reasonClass);
+    const now = safeTime(kernel.ports.now());
+    if (now === null)
+        return rejected('credential.time.invalid', '/coreClock', 'time');
+    const confirmedAt = number(confirmation.projection.confirmedAtMs);
+    const validatedAt = number(plan.attestation.validatedAtMs);
+    const expiresAtMs = Math.min(number(plan.attestation.expiresAtMs), number(confirmation.challenge.challenge.expiresAtMs));
+    if (validatedAt > confirmedAt || confirmedAt > now || now >= expiresAtMs)
+        return rejected('credential.receipt.time-invalid', '/coreClock', 'time');
+    const values = record(plan.binding.values);
+    const author = values.planAuthorIdentityHash;
+    if (!authorityPassed('authority-role-evaluator.corrective-replan.eligible-role', {
+        actorIdentityHash: values.actorIdentityHash, actorRole: values.actorRole,
+        eligibleRoles: ['delivery-coordinator', 'technical-planner'],
+    }))
+        return rejected('credential.receipt.role-invalid', '/binding/values/actorRole', 'authority');
+    if (!authorityPassed('identity-comparator.corrective-replan.author-validator', {
+        leftIdentityHash: author, rightIdentityHash: values.planValidatorIdentityHash,
+    }) || !authorityPassed('identity-comparator.corrective-replan.author-risk-auditor', {
+        leftIdentityHash: author, rightIdentityHash: values.riskAuditorIdentityHash,
+    }) || !authorityPassed('identity-comparator.corrective-replan.author-human-principal', {
+        leftIdentityHash: author, rightIdentityHash: values.humanPrincipalIdentityHash,
+    }))
+        return rejected('credential.receipt.sod-invalid', '/binding/values', 'sod');
+    const snapshotGrant = record(plan.snapshot.priorPlanAuthorization);
+    const receiptId = safeId(kernel.ports.nextId('receipt'));
+    if (!receiptId || snapshotGrant.requiredDisposition !== 'superseded')
+        return rejected('credential.receipt.source-invalid', '/snapshot/priorPlanAuthorization', 'authority');
+    const validation = { attestationId: plan.attestation.attestationId, attestationHash: plan.attestation.attestationHash,
+        planValidationHash: values.planValidationHash, snapshotBindingHash: plan.snapshotBindingHash, planAuthorIdentityHash: values.planAuthorIdentityHash,
+        planValidatorIdentityHash: values.planValidatorIdentityHash, findingsHash: hashCanonical(plan.attestation.findings),
+        dispositionsHash: hashCanonical(plan.attestation.dispositions), validatedAtMs: plan.attestation.validatedAtMs,
+        expiresAtMs: plan.attestation.expiresAtMs };
+    const base = { schemaVersion: 1, receiptId, domain: 'codex-workflow/corrective-replan-receipt/v1',
+        binding: plan.binding, validation, audit: { riskAuditHash: values.riskAuditHash, riskAuditorIdentityHash: values.riskAuditorIdentityHash },
+        human: { challengeId: confirmation.projection.challengeId, challengeHash: confirmation.projection.challengeHash,
+            humanPrincipalIdentityHash: confirmation.projection.humanPrincipalIdentityHash, confirmedAtMs: confirmation.projection.confirmedAtMs },
+        supersession: { priorGrantHash: snapshotGrant.grantHash, disposition: 'superseded' },
+        issuedAtMs: now, expiresAtMs };
+    const withDomain = { ...base, domainHash: hashCanonical(base) };
+    const receipt = deepFreeze({ ...withDomain, receiptHash: hashCanonical(withDomain) });
+    if (!schema('schema.corrective-replan-receipt', receipt))
+        return rejected('credential.receipt.invalid', '/receipt', 'schema');
+    const handle = opaque();
+    kernel.receipts.set(handle, deepFreeze({ plan, confirmation, receipt }));
+    kernel.receipted.add(confirmationHandle);
+    return accepted({ handle: handle, receipt });
+};
+const verifyReceipt = (issuer, input) => {
+    const kernel = kernels.get(object(issuer));
+    if (!kernel)
+        return verificationRejected('credential.provenance.invalid', '/', 'provenance');
+    if (!exactKeys(input, ['receipt', 'candidate']))
+        return verificationRejected('credential.envelope.invalid', '/', 'schema');
+    const recordValue = kernel.receipts.get(object(input.receipt));
+    if (!recordValue)
+        return verificationRejected('credential.provenance.invalid', '/receipt', 'provenance');
+    const candidate = input.candidate;
+    if (!schema('schema.corrective-replan-receipt', candidate))
+        return verificationRejected('credential.receipt.invalid', '/candidate', 'schema');
+    if (!same(candidate, recordValue.receipt))
+        return verificationRejected('credential.receipt.mismatch', '/candidate', 'integrity');
+    const freshness = receiptFreshnessIssue(kernel, recordValue.plan);
+    if (freshness)
+        return verificationRejected(freshness.issueId, freshness.path, freshness.reasonClass);
+    const now = safeTime(kernel.ports.now());
+    if (now === null)
+        return verificationRejected('credential.time.invalid', '/coreClock', 'time');
+    if (now < number(recordValue.receipt.issuedAtMs))
+        return verificationRejected('credential.receipt.time-invalid', '/coreClock', 'time');
+    if (now >= number(recordValue.receipt.expiresAtMs))
+        return verificationRejected('credential.receipt.expired', '/coreClock', 'time');
+    return verified(recordValue.receipt);
+};
+const materializeStoredEvent = (issuer, input) => {
+    const kernel = kernels.get(object(issuer));
+    if (!kernel)
+        return rejected('credential.provenance.invalid', '/', 'provenance');
+    if (!exactKeys(input, ['receipt']))
+        return rejected('credential.envelope.invalid', '/', 'schema');
+    const handle = object(input.receipt);
+    const receipt = kernel.receipts.get(handle);
+    if (!receipt || kernel.evented.has(handle))
+        return rejected('credential.provenance.invalid', '/receipt', 'provenance');
+    const now = safeTime(kernel.ports.now());
+    if (now === null)
+        return rejected('credential.time.invalid', '/coreClock', 'time');
+    if (now < number(receipt.receipt.issuedAtMs))
+        return rejected('credential.event.time-invalid', '/coreClock', 'time');
+    const freshness = receiptFreshnessIssue(kernel, receipt.plan);
+    if (freshness)
+        return rejected(freshness.issueId, freshness.path, freshness.reasonClass);
+    if (now >= number(receipt.receipt.expiresAtMs))
+        return rejected('credential.receipt.expired', '/coreClock', 'time');
+    const tail = kernel.ports.readTail(string(get(receipt.receipt, '/binding/values/taskId')));
+    const previousEventHash = tail === null ? null : exactKeys(tail, ['eventHash']) ? tail.eventHash : undefined;
+    const eventId = safeId(kernel.ports.nextId('plan-validation-event'));
+    if (!(previousEventHash === null || hex(previousEventHash)) || !eventId)
+        return rejected('credential.event.source-invalid', '/validationEventTailSource', 'integrity');
+    const base = { schemaVersion: 1, eventId, previousEventHash, taskId: get(receipt.receipt, '/binding/values/taskId'),
+        candidatePlanHash: get(receipt.receipt, '/binding/values/candidatePlanHash'), attestationId: get(receipt.receipt, '/validation/attestationId'),
+        attestationHash: get(receipt.receipt, '/validation/attestationHash'), receiptId: receipt.receipt.receiptId,
+        receiptHash: receipt.receipt.receiptHash, receiptDomainHash: receipt.receipt.domainHash,
+        challengeId: receipt.confirmation.projection.challengeId, challengeHash: receipt.confirmation.projection.challengeHash,
+        recordedAt: new Date(now).toISOString(), recordedAtMs: now };
+    const event = deepFreeze({ ...base, eventHash: hashCanonical(base) });
+    if (!schema('schema.corrective-replan-stored-plan-validation-event', event))
+        return rejected('credential.event.invalid', '/event', 'schema');
+    const eventHandle = opaque();
+    kernel.events.set(eventHandle, deepFreeze({ receipt, event }));
+    kernel.evented.add(handle);
+    return accepted({ handle: eventHandle, event });
+};
+const verifyStoredEvent = (issuer, input) => {
+    const kernel = kernels.get(object(issuer));
+    if (!kernel)
+        return verificationRejected('credential.provenance.invalid', '/', 'provenance');
+    if (!exactKeys(input, ['event', 'candidate']))
+        return verificationRejected('credential.envelope.invalid', '/', 'schema');
+    const recordValue = kernel.events.get(object(input.event));
+    if (!recordValue)
+        return verificationRejected('credential.provenance.invalid', '/event', 'provenance');
+    const candidate = input.candidate;
+    if (!schema('schema.corrective-replan-stored-plan-validation-event', candidate))
+        return verificationRejected('credential.event.invalid', '/candidate', 'schema');
+    if (!same(candidate, recordValue.event))
+        return verificationRejected('credential.event.mismatch', '/candidate', 'integrity');
+    return verified(recordValue.event);
+};
+const functions = [issuePlanValidation, issueHumanChallenge, confirmHuman, issueReceipt, verifyReceipt, materializeStoredEvent, verifyStoredEvent];
+const ids = ['credential-materializer.corrective-replan.plan-validation-attestation', 'credential-materializer.corrective-replan.expected-human-challenge',
+    'credential-verifier.corrective-replan.human-confirmation', 'credential-materializer.corrective-replan.receipt',
+    'credential-verifier.corrective-replan.receipt', 'credential-materializer.corrective-replan.stored-plan-validation-event',
+    'credential-verifier.corrective-replan.stored-plan-validation-event'];
+export const correctiveReplanCredentialFunctionBindings = deepFreeze(ids.map((id, index) => ({ id, version: 1,
+    kind: id.includes('materializer') ? 'materializer' : 'verifier', implementationId: `implementation.${id}`,
+    implementationVersion: 1, wiring: 'invoked', callable: functions[index] })));
+function loadCanonicalSnapshot(kernel, taskId) {
+    const source = kernel.ports.readSnapshot(taskId);
+    if (!isRecord(source))
+        return issue('credential.snapshot.missing', '/taskId', 'binding');
+    if (source.bindingManifest !== correctiveReplanBindingManifest)
+        return issue('credential.snapshot.manifest-invalid', '/snapshot/bindingManifest', 'binding');
+    const invalid = snapshotIssue(source, taskId);
+    if (invalid)
+        return invalid;
+    const snapshot = deepFreeze({ ...clone(source), bindingManifest: correctiveReplanBindingManifest });
+    return { snapshot, snapshotBindingHash: hashCanonical(snapshot) };
+}
+function receiptFreshnessIssue(kernel, plan) {
+    const loaded = loadCanonicalSnapshot(kernel, string(get(plan.binding, '/values/taskId')));
+    if ('issueId' in loaded)
+        return issue('credential.receipt.snapshot-stale', '/snapshotBindingHash', 'binding');
+    if (!same(loaded.snapshot.priorPlanAuthorization, plan.snapshot.priorPlanAuthorization))
+        return issue('credential.receipt.grant-stale', '/snapshot/priorPlanAuthorization/grantHash', 'authority');
+    return loaded.snapshotBindingHash === plan.snapshotBindingHash ? null : issue('credential.receipt.snapshot-stale', '/snapshotBindingHash', 'binding');
+}
+function snapshotIssue(snapshot, taskId) {
+    if (!exactKeys(snapshot, ['snapshotVersion', 'bindingManifest', 'worktree', 'baseValues', 'validationExpectation', 'priorPlanAuthorization']) || snapshot.snapshotVersion !== 2)
+        return issue('credential.snapshot.invalid', '/snapshot', 'schema');
+    const base = record(snapshot.baseValues);
+    const expected = record(snapshot.validationExpectation);
+    if (base.taskId !== taskId || base.transitionId !== 'task.plan.corrective-replan' || base.capabilityId !== 'capability.task.corrective-replan'
+        || base.capabilityVersion !== 1 || base.lifecycleEpoch !== LIFECYCLE_EPOCH || !canonicalManifestValues(base, false))
+        return issue('credential.snapshot.values-invalid', '/snapshot/baseValues', 'binding');
+    if (!validWorktree(snapshot.worktree, base.gitHead) || !validExpectation(expected) || !exactKeys(snapshot.priorPlanAuthorization, ['grantHash', 'requiredDisposition'])
+        || !hex(record(snapshot.priorPlanAuthorization).grantHash) || record(snapshot.priorPlanAuthorization).requiredDisposition !== 'superseded')
+        return issue('credential.snapshot.invalid', '/snapshot/validationExpectation', 'schema');
+    const pairs = [['taskId', 'taskId'], ['revision', 'revision'], ['currentPlanHash', 'currentPlanHash'],
+        ['briefHash', 'briefHash'], ['knowledgeRevision', 'knowledgeRevision'], ['knowledgeHash', 'knowledgeHash'], ['gitHead', 'gitHead'],
+        ['guardedStepId', 'guardedStepId'], ['correctiveDecisionHash', 'correctiveDecisionHash'], ['remediationTailHash', 'remediationTailHash']];
+    if (pairs.some(([sourceKey, baseKey]) => get(expected, `/source/${sourceKey}`) !== base[baseKey])
+        || get(expected, '/candidate/planHash') !== base.candidatePlanHash || get(expected, '/candidate/stepSetHash') !== base.candidateStepSetHash
+        || get(expected, '/planAuthor/identityHash') !== base.planAuthorIdentityHash || get(expected, '/validator/identityHash') !== base.planValidatorIdentityHash)
+        return issue('credential.snapshot.cross-link-invalid', '/snapshot/validationExpectation', 'binding');
+    return null;
+}
+function validWorktree(value, gitHead) {
+    if (!exactKeys(value, ['kind', 'version', 'gitHead', 'changeSha256', 'entries'])
+        || value.kind !== 'guarded-step-worktree' || value.version !== 1 || value.gitHead !== gitHead
+        || !hex(value.changeSha256) || !Array.isArray(value.entries))
+        return false;
+    const entries = value.entries;
+    if (entries.length > 256)
+        return false;
+    const paths = new Set();
+    for (const candidate of entries) {
+        if (!isRecord(candidate) || typeof candidate.path !== 'string' || paths.has(candidate.path))
+            return false;
+        paths.add(candidate.path);
+        if (candidate.disposition === 'deleted') {
+            if (!exactKeys(candidate, ['path', 'disposition']))
+                return false;
+        }
+        else if (candidate.disposition === 'present') {
+            if (!exactKeys(candidate, ['path', 'disposition', 'executable', 'contentSha256'])
+                || typeof candidate.executable !== 'boolean' || !hex(candidate.contentSha256))
+                return false;
+        }
+        else
+            return false;
+    }
+    return entries.every((entry, index) => index === 0
+        || String(entries[index - 1].path).localeCompare(String(entry.path)) < 0)
+        && value.changeSha256 === hashCanonical({ domain: 'codex-workflow/corrective-replan-worktree/v1', entries });
+}
+function canonicalManifestValues(values, includePlanValidationHash) {
+    const rows = correctiveReplanBindingManifest.rows
+        .filter((row) => includePlanValidationHash || row.bindingId !== 'planValidationHash');
+    if (Object.keys(values).sort().join('\0') !== rows.map((row) => string(row.bindingId)).sort().join('\0'))
+        return false;
+    return rows.every((row) => {
+        const id = string(row.bindingId);
+        const value = values[id];
+        switch (row.canonicalization) {
+            case 'lowercase-hex': return hex(value);
+            case 'safe-nonnegative-integer': return safeTime(value) !== null;
+            case 'nfc-trim': return canonicalId(value);
+            case 'lowercase-git-oid': return typeof value === 'string' && /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(value);
+            case 'registered-enum': return value === 'delivery-coordinator' || value === 'technical-planner';
+            case 'exact': return value === (id === 'transitionId' ? 'task.plan.corrective-replan' : 'capability.task.corrective-replan');
+            default: return false;
+        }
+    });
+}
+function validExpectation(value) {
+    return exactKeys(value, ['source', 'candidate', 'requirements', 'acceptance', 'architecture', 'planAuthor', 'plannerContext', 'validator'])
+        && exactKeys(value.source, ['taskId', 'revision', 'currentPlanHash', 'briefHash', 'knowledgeRevision', 'knowledgeHash', 'gitHead', 'guardedStepId', 'correctiveDecisionHash', 'remediationTailHash'])
+        && exactKeys(value.candidate, ['planHash', 'stepSetHash']) && validCoverage(value.requirements) && validCoverage(value.acceptance)
+        && validArchitecture(value.architecture) && validIdentity(value.planAuthor) && validIdentity(value.validator)
+        && validContext(value.plannerContext, true);
+}
+function exactDraft(value) {
+    if (!exactKeys(value, ['schemaVersion', 'requirements', 'acceptance', 'architecture', 'validatorContext', 'passed', 'findings', 'dispositions']))
+        return false;
+    const draft = value;
+    const findings = array(draft.findings);
+    const dispositions = array(draft.dispositions);
+    return draft.schemaVersion === 1 && draft.passed === true && validCoverage(draft.requirements) && validCoverage(draft.acceptance)
+        && validArchitecture(draft.architecture) && validContext(draft.validatorContext, false) && findings.length <= 128 && dispositions.length <= 128
+        && findings.every(validFinding) && dispositions.every(validDisposition);
+}
+function validCoverage(value) { return exactKeys(value, ['sourceHash', 'coverageHash', 'passed']) && hex(value.sourceHash) && hex(value.coverageHash) && value.passed === true; }
+function validArchitecture(value) { return exactKeys(value, ['sourceHash', 'compatibilityHash', 'passed']) && hex(value.sourceHash) && hex(value.compatibilityHash) && value.passed === true; }
+function validIdentity(value) { return exactKeys(value, ['identityHash']) && hex(value.identityHash); }
+function validContext(value, captured) { return exactKeys(value, captured ? ['contextHash', 'capturedAtMs'] : ['contextHash']) && hex(value.contextHash) && (!captured || safeTime(value.capturedAtMs) !== null); }
+function validFinding(value) { return exactKeys(value, ['findingId', 'severity', 'requirementRef', 'evidenceHash']) && canonicalId(value.findingId) && canonicalId(value.requirementRef) && ['low', 'medium', 'high'].includes(string(value.severity)) && hex(value.evidenceHash); }
+function validDisposition(value) { return exactKeys(value, ['findingId', 'decision', 'evidenceHash']) && canonicalId(value.findingId) && ['resolved', 'accepted-documented-limitation'].includes(string(value.decision)) && hex(value.evidenceHash); }
+function keyedBijection(findings, dispositions) {
+    const findingIds = findings.map((entry) => string(record(entry).findingId));
+    const dispositionIds = dispositions.map((entry) => string(record(entry).findingId));
+    return findingIds.length === dispositions.length
+        && findingIds.every(Boolean) && new Set(findingIds).size === findingIds.length && new Set(dispositionIds).size === dispositionIds.length
+        && [...findingIds].sort().join('\0') === [...dispositionIds].sort().join('\0');
+}
+function sortRows(rows) { return rows.map(clone).sort((a, b) => { const left = string(record(a).findingId); const right = string(record(b).findingId); return left < right ? -1 : left > right ? 1 : 0; }); }
+function schema(id, value) { return correctiveReplanCredentialSchemaValidators.find((entry) => entry.id === id)?.callable(value) === true; }
+function accepted(value) { return deepFreeze({ ok: true, value: deepFreeze(value), issues: [] }); }
+function rejected(issueId, path, reasonClass) { const issues = [issue(issueId, path, reasonClass)]; return deepFreeze({ ok: false, value: null, issues, reportHash: hashCanonical(issues) }); }
+function verified(projection) { const content = { valid: true, projection: deepFreeze(projection), issues: [] }; return deepFreeze({ ...content, reportHash: hashCanonical(content) }); }
+function verificationRejected(issueId, path, reasonClass) { const issues = [issue(issueId, path, reasonClass)]; return deepFreeze({ valid: false, projection: null, issues, reportHash: hashCanonical(issues) }); }
+function issue(issueId, path, reasonClass) { return { issueId, path, reasonClass }; }
+function totalResult(invoke) { try {
+    return invoke();
+}
+catch {
+    return rejected('credential.operation.malformed', '/', 'schema');
+} }
+function totalVerification(invoke) { try {
+    return invoke();
+}
+catch {
+    return verificationRejected('credential.operation.malformed', '/', 'schema');
+} }
+function activePreparation(kernel, plan) { const current = kernel.preparations.get(plan.preparationKey); return current?.status === 'active' && current.generation === plan.generation; }
+function exactKeys(value, keys) { return isRecord(value) && Object.keys(value).sort().join('\0') === [...keys].sort().join('\0'); }
+function isRecord(value) { return value !== null && typeof value === 'object' && !Array.isArray(value); }
+function copyOwnedJson(value, budget = { nodes: 0, bytes: 0, active: new Set() }, depth = 0) {
+    if (++budget.nodes > 4096 || (budget.bytes += 8) > 262_144 || depth > 32)
+        return LIMIT;
+    if (typeof value === 'string') {
+        budget.bytes += Buffer.byteLength(value, 'utf8');
+        return budget.bytes > 262_144 ? LIMIT : value;
+    }
+    if (value === null || typeof value === 'boolean')
+        return value;
+    if (typeof value === 'number')
+        return Number.isSafeInteger(value) ? value : MALFORMED;
+    if (typeof value !== 'object' || utilTypes.isProxy(value) || budget.active.has(value))
+        return MALFORMED;
+    const arrayValue = Array.isArray(value);
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== (arrayValue ? Array.prototype : Object.prototype) && prototype !== null)
+        return MALFORMED;
+    const keys = Reflect.ownKeys(value);
+    if (keys.some((key) => typeof key !== 'string'))
+        return MALFORMED;
+    const names = keys.filter((key) => !arrayValue || key !== 'length');
+    const descriptors = Object.getOwnPropertyDescriptors(value);
+    if (arrayValue && (names.length !== value.length || names.some((key, index) => key !== String(index))))
+        return MALFORMED;
+    const result = arrayValue ? [] : Object.create(null);
+    budget.active.add(value);
+    for (const key of names) {
+        const descriptor = descriptors[key];
+        budget.bytes += Buffer.byteLength(key, 'utf8');
+        if (budget.bytes > 262_144)
+            return LIMIT;
+        if (!descriptor?.enumerable || !('value' in descriptor))
+            return MALFORMED;
+        const child = copyOwnedJson(descriptor.value, budget, depth + 1);
+        if (child === LIMIT || child === MALFORMED)
+            return child;
+        result[key] = child;
+    }
+    budget.active.delete(value);
+    return result;
+}
+function record(value) { return isRecord(value) ? value : {}; }
+function object(value) { return value !== null && typeof value === 'object' ? value : Object.freeze(Object.create(null)); }
+function opaque() { return Object.freeze(Object.create(null)); }
+function array(value) { return Array.isArray(value) ? value : []; }
+function string(value) { return typeof value === 'string' ? value : ''; }
+function number(value) { return typeof value === 'number' ? value : Number.NaN; }
+function safeTime(value) { return typeof value === 'number' && Number.isSafeInteger(value) && value >= 0 && value <= MAX_SAFE ? value : null; }
+function safeId(value) { return canonicalId(value) ? value : ''; }
+function canonicalId(value) { return typeof value === 'string' && value.length > 0 && value.length <= 256 && value === value.trim() && value === value.normalize('NFC'); }
+function hex(value) { return typeof value === 'string' && /^[a-f0-9]{64}$/.test(value); }
+function get(value, path) { return path.split('/').filter(Boolean).reduce((cursor, key) => isRecord(cursor) ? cursor[key] : undefined, value); }
+function same(left, right) { try {
+    return hashCanonical(left) === hashCanonical(right);
+}
+catch {
+    return false;
+} }
+function authorityPassed(id, input) {
+    const binding = installedAuthoritySemanticBindings.find((entry) => entry.id === id);
+    return binding !== undefined && record(binding.callable(input)).passed === true;
+}
+function clone(value) { return structuredClone(value); }
+function sha(value) { return createHash('sha256').update(value).digest('hex'); }
+//# sourceMappingURL=corrective-replan-credential-core.js.map