cool-workflow 0.1.79 → 0.1.81

package/dist/reclamation.js

@@ -29,7 +29,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ReclamationError = exports.ReclamationAbort = exports.SKELETON_REQUIRED_KEYS = exports.RECLAMATION_SCHEMA_VERSION = void 0;
+exports.ReclamationError = exports.ReclamationAbort = exports.SKELETON_REQUIRED_KEYS = void 0;
 exports.sha256OfString = sha256OfString;
 exports.sha256OfFile = sha256OfFile;
 exports.dirBytes = dirBytes;
@@ -56,7 +56,7 @@ const multi_agent_eval_1 = require("./multi-agent-eval");
 const node_snapshot_1 = require("./node-snapshot");
 const state_1 = require("./state");
 const trust_audit_1 = require("./trust-audit");
-exports.RECLAMATION_SCHEMA_VERSION = 1;
+const compare_1 = require("./compare");
 /** The skeleton schema is the contract for what MUST survive every reclamation.
  *  Machine-checkable via validateSkeleton(). If extraction can't produce all of
  *  these, reclamation fails closed and frees nothing. */
@@ -135,7 +135,7 @@ function contentDigest(p) {
         return sha256OfFile(p);
     const parts = [];
     const walk = (dir, rel) => {
-        for (const entry of node_fs_1.default.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+        for (const entry of node_fs_1.default.readdirSync(dir, { withFileTypes: true }).sort((a, b) => (0, compare_1.compareBytes)(a.name, b.name))) {
             const abs = node_path_1.default.join(dir, entry.name);
             const r = node_path_1.default.join(rel, entry.name);
             if (entry.isDirectory())
@@ -261,7 +261,7 @@ function extractSkeleton(run) {
     }
     const evidenceDigests = [...evidenceMap.entries()]
         .map(([ref, digest]) => ({ ref, digest }))
-        .sort((a, b) => a.ref.localeCompare(b.ref));
+        .sort((a, b) => (0, compare_1.compareBytes)(a.ref, b.ref));
     const eventLog = auditEventLogPath(run);
     const auditLogDigest = node_fs_1.default.existsSync(eventLog) ? sha256OfFile(eventLog) : sha256OfString("");
     const events = node_fs_1.default.existsSync(eventLog)
@@ -287,7 +287,7 @@ function extractSkeleton(run) {
     };
     const collaboration = run.collaboration;
     const collaborationLog = {
-        digest: sha256OfString((0, multi_agent_eval_1.stableStringify)(collaboration || {})),
+        digest: sha256OfString((0, multi_agent_eval_1.replayStableStringify)(collaboration || {})),
         approvals: collaboration?.approvals?.length || 0,
         comments: collaboration?.comments?.length || 0,
         handoffs: collaboration?.handoffs?.length || 0
@@ -414,12 +414,12 @@ function snapshotProjectionDigest(node) {
         contractId: node.contractId,
         metadata: node.metadata
     });
-    return sha256OfString((0, multi_agent_eval_1.stableStringify)(body));
+    return sha256OfString((0, multi_agent_eval_1.replayStableStringify)(body));
 }
 /** Body digest of the RETAINED node (lives in state.json). The reconstruction
  *  verifier re-derives the projection from this retained input. */
 function nodeBodyDigest(node) {
-    return sha256OfString((0, multi_agent_eval_1.stableStringify)(rawNodeBody(node)));
+    return sha256OfString((0, multi_agent_eval_1.replayStableStringify)(rawNodeBody(node)));
 }
 function rawNodeBody(node) {
     return {
@@ -449,7 +449,6 @@ function planReclamation(run, policy = {}) {
     // freeable once the result node's worker-result artifact is re-pointed.
     let reclaimedScratch = false;
     if (!policy.keepScratch) {
-        const workersDir = run.paths.workersDir || node_path_1.default.join(runDir, "workers");
         for (const scope of run.workers || []) {
             const workerDir = scope.workerDir;
             if (!workerDir || !node_fs_1.default.existsSync(workerDir))
@@ -472,7 +471,6 @@ function planReclamation(run, policy = {}) {
             });
             reclaimedScratch = true;
         }
-        void workersDir;
     }
     // A node whose scratch is being re-pointed THIS pass must NOT also have its
     // snapshot freed in the same pass — re-pointing mutates the node body, which
@@ -515,7 +513,7 @@ function planReclamation(run, policy = {}) {
                     const recipe = {
                         recipeKind: "node-snapshot-projection",
                         inputDigests: [inputDigest],
-                        inputsDigest: sha256OfString((0, multi_agent_eval_1.stableStringify)([inputDigest])),
+                        inputsDigest: sha256OfString((0, multi_agent_eval_1.replayStableStringify)([inputDigest])),
                         expectDigest: snapshotProjectionDigest(node),
                         sourceRef: node.id
                     };
@@ -531,6 +529,13 @@ function planReclamation(run, policy = {}) {
     // retention, and we do not yet auto-capture reconstruction recipes for them.
     // The reference graph is consulted so the door is closed, not merely unbuilt.
     void buildReferenceGraph;
+    // Determinism (HARD constraint): the snapshot candidates above are gathered in
+    // fs.readdirSync order, which is filesystem-dependent. freeable feeds the freed
+    // manifest that buildTombstone binds into tombstoneHash (and the prevTombstoneHash
+    // chain), so an unsorted order makes the tombstone hash irreproducible across
+    // hosts. Sort by path — the same compareBytes discipline the directory reads at
+    // :128 and the reference list at :243 already use — before anything hashes it.
+    freeable.sort((a, b) => (0, compare_1.compareBytes)(a.path, b.path));
     const byKind = {};
     let bytesToFree = 0;
     for (const entry of freeable) {
@@ -557,16 +562,16 @@ function planReclamation(run, policy = {}) {
     return { freeable, bytesToFree, byKind, capability, capabilityReason };
 }
 function policyDigestOf(policy) {
-    return sha256OfString((0, multi_agent_eval_1.stableStringify)(policy));
+    return sha256OfString((0, multi_agent_eval_1.replayStableStringify)(policy));
 }
 /** genesis prevTombstoneHash = sha256 of the sealed skeleton. */
 function genesisPrevHash(skeleton) {
-    return sha256OfString((0, multi_agent_eval_1.stableStringify)(skeleton));
+    return sha256OfString((0, multi_agent_eval_1.replayStableStringify)(skeleton));
 }
 /** The canonical bytes a tombstoneHash binds: freed-manifest + sealed skeleton +
  *  prevTombstoneHash + capability. Recomputed independently by `gc verify`. */
 function tombstoneHashInput(t) {
-    return (0, multi_agent_eval_1.stableStringify)({
+    return (0, multi_agent_eval_1.replayStableStringify)({
         runId: t.runId,
         tombstoneId: t.tombstoneId,
         reclaimedAt: t.reclaimedAt,
@@ -574,7 +579,7 @@ function tombstoneHashInput(t) {
         policyDigest: t.policyDigest,
         freed: t.freed.map((f) => ({ path: f.path, kind: f.kind, bytes: f.bytes, sha256: f.sha256, recipe: f.recipe || null })),
         bytesFreed: t.bytesFreed,
-        skeletonDigest: sha256OfString((0, multi_agent_eval_1.stableStringify)(t.skeleton)),
+        skeletonDigest: sha256OfString((0, multi_agent_eval_1.replayStableStringify)(t.skeleton)),
         capability: t.capability,
         capabilityReason: t.capabilityReason,
         prevTombstoneHash: t.prevTombstoneHash
@@ -583,11 +588,11 @@ function tombstoneHashInput(t) {
 function computeTombstoneHash(t) {
     return sha256OfString(tombstoneHashInput(t));
 }
-let tombstoneCounter = 0;
-function tombstoneId(run, now) {
-    tombstoneCounter += 1;
-    const stamp = now.replace(/[-:.TZ]/g, "").slice(0, 14);
-    return `tomb-${stamp}-${String(tombstoneCounter).padStart(3, "0")}`;
+function tombstoneId(seq) {
+    // Deterministic (FreeBSD-audit L13): the chain POSITION, not a process-global
+    // counter or wall-clock stamp — tombstoneId is bound into the tombstoneHash
+    // chain that `gc verify` recomputes, so it must be reproducible.
+    return `tomb-${String(seq).padStart(3, "0")}`;
 }
 /** STEP 2: build the FULL tombstone (pre-deletion sha256 per freed path + the
  *  hash chain). Reads the freed files (still present); mutates nothing on disk. */
@@ -605,7 +610,7 @@ function buildTombstone(run, skeleton, plan, options = {}) {
     const base = {
         schemaVersion: 1,
         runId: run.id,
-        tombstoneId: tombstoneId(run, now),
+        tombstoneId: tombstoneId(prior.length + 1),
         reclaimedAt: now,
         actor: options.actor,
         policyDigest: policyDigestOf(options.policy || {}),
@@ -800,7 +805,7 @@ function reconstructArtifact(run, recipe) {
             return { inputsDigest: sha256OfString("absent"), expectDigest: sha256OfString("absent") };
         }
         const inputDigest = nodeBodyDigest(node);
-        const inputsDigest = sha256OfString((0, multi_agent_eval_1.stableStringify)([inputDigest]));
+        const inputsDigest = sha256OfString((0, multi_agent_eval_1.replayStableStringify)([inputDigest]));
         const expectDigest = snapshotProjectionDigest(node);
         return { inputsDigest, expectDigest };
     }