cool-workflow 0.1.80 → 0.1.82

package/dist/trust-audit.js

@@ -3,7 +3,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TRUST_AUDIT_SCHEMA_VERSION = void 0;
+exports.CORRELATION_ID_FIELDS = exports.TRUST_AUDIT_SCHEMA_VERSION = void 0;
+exports.trustAuditGenesis = trustAuditGenesis;
+exports.verifyTrustAudit = verifyTrustAudit;
 exports.ensureTrustAudit = ensureTrustAudit;
 exports.recordTrustAuditEvent = recordTrustAuditEvent;
 exports.recordSandboxPathDecision = recordSandboxPathDecision;
@@ -22,17 +24,198 @@ const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const state_1 = require("./state");
 const evidence_grounding_1 = require("./evidence-grounding");
+const execution_backend_1 = require("./execution-backend");
+const telemetry_attestation_1 = require("./telemetry-attestation");
 exports.TRUST_AUDIT_SCHEMA_VERSION = 1;
+// ---- Tamper-evidence chain (v0.1.81) --------------------------------------
+// Same discipline as telemetry-ledger.ts / reclamation.ts: the event log is
+// hash-chained in APPEND order, and verifyTrustAudit recomputes every hash
+// independently (never trusts a stored value), so an edited or removed event is
+// detected. Durability (fsync) only guards against power loss; this guards
+// against post-hoc edits — the threat an external auditor actually cares about.
+//
+// THREAT MODEL (be honest about the limit): the genesis is sha256(runId), so this
+// detects casual/partial tampering, accidental corruption, truncation, removal,
+// and forged-unchained lines — but NOT a determined local writer who re-chains the
+// WHOLE log with this module's own sha256 after an edit. That is the same limit
+// reclamation.ts's tombstone chain has, and it is INHERENT to a local, self-
+// recomputable chain: closing it needs an anchor the writer cannot reproduce.
+// CW cannot self-sign that anchor — by design CW holds NO private key (see
+// telemetry-attestation.ts: "CW never holds the private key"; the AGENT signs its
+// usage, CW only VERIFIES with the operator-provisioned public half). The single
+// cryptographic anchor that exists is therefore the agent's telemetry signature,
+// which binds agent-reported USAGE (worker-isolation cross-links the chain into it)
+// — it does NOT cover CW-only sandbox/policy/commit-gate decisions, which have no
+// external signer. For those, the only stronger guarantee is operational: commit
+// events.jsonl to an external append-only medium (git history / a remote log) the
+// local writer cannot rewrite. The chain is a strict upgrade over a bare append-
+// only log, not a substitute for an external anchor — and that anchor is not
+// something CW can mint for itself.
+/** Single source of truth for a run's audit-paths object: the schemaVersion plus
+ *  the three derived file paths under auditRoot(run). ensureTrustAudit /
+ *  refreshTrustAudit spread this, and createEventId reads .eventLogPath from it, so
+ *  the path-derivation rule lives in exactly one place. */
+function trustAuditPaths(run) {
+    const dir = auditRoot(run);
+    return {
+        schemaVersion: exports.TRUST_AUDIT_SCHEMA_VERSION,
+        eventLogPath: node_path_1.default.join(dir, "events.jsonl"),
+        summaryPath: node_path_1.default.join(dir, "summary.json"),
+        indexPath: node_path_1.default.join(dir, "index.json")
+    };
+}
+/** Genesis prevHash for a run's chain (no prior event). */
+function trustAuditGenesis(runId) {
+    return (0, execution_backend_1.sha256)(`cw-trust-audit:${runId}`);
+}
+/** Canonical bytes the eventHash binds: every field EXCEPT eventHash itself
+ *  (prevEventHash included, so the chain link is bound).
+ *
+ *  The hash binds the PERSISTED form. `stableStringify` keeps an undefined-valued
+ *  key as `"k":null`, but the `JSON.stringify` that writes events.jsonl DROPS such
+ *  keys — so without this round-trip the record-time hash (over the in-memory event,
+ *  which can carry nested undefined like an absent dispatchId in worker-sandbox
+ *  metadata) would never match the verify-time hash (over the parsed-from-disk
+ *  event), false-failing legitimate worker events as `trust-audit-digest-mismatch`.
+ *  Round-tripping makes record-time == verify-time. It is identity for events with
+ *  no undefined fields, so existing intact chains hash unchanged. */
+function computeEventHash(event) {
+    const { eventHash, ...rest } = event;
+    return (0, execution_backend_1.sha256)((0, telemetry_attestation_1.stableStringify)(JSON.parse(JSON.stringify(rest))));
+}
+/** The hash to chain the NEXT event to: the stored eventHash, or a recompute for
+ *  a legacy event written before the chain existed. */
+function chainHashOf(event) {
+    return event.eventHash || computeEventHash(event);
+}
+/** Read events in FILE (append) order, tolerating corrupt lines — one bad line
+ *  must not brick the whole audit read surface (it is counted, not thrown). The
+ *  chain links append order, so this is the order verification walks. */
+function readEventsRaw(eventLogPath) {
+    if (!node_fs_1.default.existsSync(eventLogPath))
+        return { events: [], corruptLines: 0 };
+    let corruptLines = 0;
+    const events = [];
+    for (const line of node_fs_1.default.readFileSync(eventLogPath, "utf8").split(/\n/g)) {
+        const trimmed = line.trim();
+        if (!trimmed)
+            continue;
+        try {
+            events.push(JSON.parse(trimmed));
+        }
+        catch {
+            corruptLines += 1;
+        }
+    }
+    return { events, corruptLines };
+}
+/** Re-prove the run's trust-audit chain: prevEventHash linkage (append order) +
+ *  per-event hash recompute. A corrupt line, an edited event, or a removed event
+ *  flips verified=false. Legacy events without a hash are reported as `unchained`
+ *  (skipped), NOT treated as a forgery — they predate the chain. */
+function verifyTrustAudit(run) {
+    const audit = ensureTrustAudit(run);
+    const { events, corruptLines } = readEventsRaw(audit.eventLogPath);
+    const checks = [];
+    let verified = corruptLines === 0;
+    if (corruptLines > 0)
+        checks.push({ name: "parse", pass: false, code: "trust-audit-corrupt-line" });
+    let chained = 0;
+    let unchained = 0;
+    let expectedPrev = trustAuditGenesis(run.id);
+    for (let i = 0; i < events.length; i++) {
+        const event = events[i];
+        const recomputed = computeEventHash(event);
+        if (event.eventHash === undefined) {
+            unchained += 1;
+            expectedPrev = recomputed; // advance the chain over legacy events
+            continue;
+        }
+        chained += 1;
+        if (event.eventHash !== recomputed) {
+            verified = false;
+            checks.push({ name: `event-hash[${i}]`, pass: false, code: "trust-audit-digest-mismatch" });
+        }
+        if (event.prevEventHash !== undefined && event.prevEventHash !== expectedPrev) {
+            verified = false;
+            checks.push({ name: `chain-link[${i}]`, pass: false, code: "trust-audit-chain-broken" });
+        }
+        expectedPrev = event.eventHash;
+    }
+    // A log with ANY chained event must have EVERY event chained: a single run is
+    // written by one code version, so it is all-chained (chain era) or all-legacy
+    // (pre-chain). An unchained (eventHash-less) line mixed into a chained log is a
+    // forgery attempt — drop the hash to be waved through as "legacy" — so it fails.
+    if (chained > 0 && unchained > 0) {
+        verified = false;
+        checks.push({ name: "unchained-events", pass: false, code: "trust-audit-unchained-event" });
+    }
+    return { present: events.length > 0, verified, eventCount: events.length, chained, unchained, corruptLines, checks };
+}
+// ---- Correlation-id fields (single source of truth, F12) -------------------
+// These id fields are plain pass-throughs that flow input -> persisted event ->
+// summary index unchanged. They were previously re-listed by hand in three
+// places (recordTrustAuditEvent, the index writer, and partially in
+// multi-agent-trust), so adding a new correlation id meant editing every list and
+// silently dropping it from the index when one was missed. They now live in ONE
+// array; both spread sites pick from it via pickCorrelationIds, so a new id is
+// added in exactly one place.
+//
+// SERIALIZATION-PRESERVING by design: this is a plain key-copy with NO transform,
+// so the persisted JSON for these keys is byte-identical to the old hand-spread
+// (compact() still drops the undefined ones). The hash chain that binds these
+// fields is therefore unaffected. Fields needing derivation/normalization
+// (feedbackIds, sandboxProfileId, policyRef, multiAgentPolicyRef, normalizedPath,
+// envVars, …) are intentionally NOT here — they keep their bespoke handling at the
+// call site.
+exports.CORRELATION_ID_FIELDS = [
+    "candidateId",
+    "scoreId",
+    "selectionId",
+    "commitId",
+    "multiAgentRunId",
+    "agentRoleId",
+    "agentGroupId",
+    "agentMembershipId",
+    "agentFanoutId",
+    "agentFaninId",
+    "blackboardId",
+    "blackboardTopicId",
+    "blackboardMessageId",
+    "blackboardContextId",
+    "blackboardArtifactRefId",
+    "blackboardSnapshotId",
+    "coordinatorDecisionId",
+    "topologyId",
+    "topologyRunId"
+];
+/** Copy exactly the correlation-id keys (and no others) from `source`, preserving
+ *  each value verbatim (including `undefined`, which compact()/JSON.stringify drop
+ *  identically to the prior per-key spread). Spread the result; do not transform. */
+function pickCorrelationIds(source) {
+    const picked = {};
+    for (const field of exports.CORRELATION_ID_FIELDS)
+        picked[field] = source[field];
+    return picked;
+}
+// The summary index has always carried every correlation id EXCEPT scoreId (the
+// per-candidate score lives in the candidates[] rows, not the flat event index).
+// Pin that exception in ONE place so the index stays byte-identical while still
+// inheriting any NEW id from CORRELATION_ID_FIELDS automatically.
+const INDEX_OMITTED_CORRELATION_IDS = new Set(["scoreId"]);
+/** Correlation ids for the summary index: the full pick minus the keys the index
+ *  has historically omitted (see INDEX_OMITTED_CORRELATION_IDS). */
+function indexCorrelationIds(event) {
+    const picked = pickCorrelationIds(event);
+    for (const field of INDEX_OMITTED_CORRELATION_IDS)
+        delete picked[field];
+    return picked;
+}
 function ensureTrustAudit(run) {
     const auditDir = auditRoot(run);
     node_fs_1.default.mkdirSync(auditDir, { recursive: true });
     run.paths.auditDir = auditDir;
-    const audit = {
-        schemaVersion: exports.TRUST_AUDIT_SCHEMA_VERSION,
-        eventLogPath: node_path_1.default.join(auditDir, "events.jsonl"),
-        summaryPath: node_path_1.default.join(auditDir, "summary.json"),
-        indexPath: node_path_1.default.join(auditDir, "index.json")
-    };
+    const audit = { ...trustAuditPaths(run) };
     run.audit = audit;
     if (!node_fs_1.default.existsSync(audit.eventLogPath))
         node_fs_1.default.writeFileSync(audit.eventLogPath, "", "utf8");
@@ -53,25 +236,11 @@ function recordTrustAuditEvent(run, input) {
         taskId: input.taskId,
         nodeId: input.nodeId,
         feedbackIds: input.feedbackIds?.filter(Boolean).sort(),
-        candidateId: input.candidateId,
-        scoreId: input.scoreId,
-        selectionId: input.selectionId,
-        commitId: input.commitId,
-        multiAgentRunId: input.multiAgentRunId,
-        agentRoleId: input.agentRoleId,
-        agentGroupId: input.agentGroupId,
-        agentMembershipId: input.agentMembershipId,
-        agentFanoutId: input.agentFanoutId,
-        agentFaninId: input.agentFaninId,
-        blackboardId: input.blackboardId,
-        blackboardTopicId: input.blackboardTopicId,
-        blackboardMessageId: input.blackboardMessageId,
-        blackboardContextId: input.blackboardContextId,
-        blackboardArtifactRefId: input.blackboardArtifactRefId,
-        blackboardSnapshotId: input.blackboardSnapshotId,
-        coordinatorDecisionId: input.coordinatorDecisionId,
-        topologyId: input.topologyId,
-        topologyRunId: input.topologyRunId,
+        // Plain correlation-id pass-throughs (candidateId … topologyRunId) come from the
+        // single CORRELATION_ID_FIELDS list. Key order is preserved (the list is in the
+        // same order the keys used to be hand-written), so the persisted JSON — and thus
+        // the eventHash chain — is byte-identical.
+        ...pickCorrelationIds(input),
         sandboxProfileId: input.sandboxProfileId || input.policySnapshot?.id,
         policyRef: input.policyRef || (input.policySnapshot?.id ? `run.sandboxProfiles.${input.policySnapshot.id}` : undefined),
         multiAgentPolicyRef: input.policyRef,
@@ -90,6 +259,12 @@ function recordTrustAuditEvent(run, input) {
         parentEventIds: unique(input.parentEventIds || []).sort(),
         metadata: scrubMetadata(input.metadata || {})
     });
+    // Tamper-evidence chain: link this event to the prior one (append order) and
+    // bind its content with eventHash BEFORE persisting. verifyTrustAudit recomputes
+    // both independently, so a later edit or removal is detectable.
+    const prior = readEventsRaw(audit.eventLogPath).events;
+    event.prevEventHash = prior.length ? chainHashOf(prior[prior.length - 1]) : trustAuditGenesis(run.id);
+    event.eventHash = computeEventHash(event);
     // DURABLE append (v0.1.40 self-audit P1): the audit log is the one artifact
     // whose loss breaks audit-completeness, so fsync it before returning — never a
     // bare appendFileSync, which can drop the last event on power loss.
@@ -127,15 +302,7 @@ function recordHostAttestation(run, input) {
 }
 function listTrustAuditEvents(run) {
     const audit = ensureTrustAudit(run);
-    if (!node_fs_1.default.existsSync(audit.eventLogPath))
-        return [];
-    return node_fs_1.default
-        .readFileSync(audit.eventLogPath, "utf8")
-        .split(/\n/g)
-        .map((line) => line.trim())
-        .filter(Boolean)
-        .map((line) => JSON.parse(line))
-        .sort(compareEvents);
+    return readEventsRaw(audit.eventLogPath).events.sort(compareEvents);
 }
 /** Search audit events by kind, worker, or candidate (v0.1.65).
  *  Filters are AND-ed; empty filters match all. */
@@ -159,6 +326,7 @@ function summarizeTrustAudit(run) {
         runId: run.id,
         generatedAt: new Date().toISOString(),
         eventCount: events.length,
+        integrity: verifyTrustAudit(run),
         eventLogPath: audit.eventLogPath,
         indexPath: audit.indexPath,
         summaryPath: audit.summaryPath,
@@ -228,24 +396,11 @@ function summarizeTrustAudit(run) {
             source: event.source,
             workerId: event.workerId,
             taskId: event.taskId,
-            candidateId: event.candidateId,
-            selectionId: event.selectionId,
-            commitId: event.commitId,
-            multiAgentRunId: event.multiAgentRunId,
-            agentRoleId: event.agentRoleId,
-            agentGroupId: event.agentGroupId,
-            agentMembershipId: event.agentMembershipId,
-            agentFanoutId: event.agentFanoutId,
-            agentFaninId: event.agentFaninId,
-            blackboardId: event.blackboardId,
-            blackboardTopicId: event.blackboardTopicId,
-            blackboardMessageId: event.blackboardMessageId,
-            blackboardContextId: event.blackboardContextId,
-            blackboardArtifactRefId: event.blackboardArtifactRefId,
-            blackboardSnapshotId: event.blackboardSnapshotId,
-            coordinatorDecisionId: event.coordinatorDecisionId,
-            topologyId: event.topologyId,
-            topologyRunId: event.topologyRunId,
+            // Same single CORRELATION_ID_FIELDS list the record path uses, so the index
+            // can never silently omit a correlation id that the event carries. (The index
+            // historically omitted scoreId; that is preserved below by deleting it after
+            // the pick, keeping this writer's output byte-identical.)
+            ...indexCorrelationIds(event),
             sandboxProfileId: event.sandboxProfileId,
             policyRef: event.policyRef,
             multiAgentPolicyRef: event.multiAgentPolicyRef
@@ -255,12 +410,7 @@ function summarizeTrustAudit(run) {
     return summary;
 }
 function refreshTrustAudit(run) {
-    const audit = {
-        schemaVersion: exports.TRUST_AUDIT_SCHEMA_VERSION,
-        eventLogPath: node_path_1.default.join(auditRoot(run), "events.jsonl"),
-        summaryPath: node_path_1.default.join(auditRoot(run), "summary.json"),
-        indexPath: node_path_1.default.join(auditRoot(run), "index.json")
-    };
+    const audit = { ...trustAuditPaths(run) };
     node_fs_1.default.mkdirSync(node_path_1.default.dirname(audit.eventLogPath), { recursive: true });
     if (!node_fs_1.default.existsSync(audit.eventLogPath))
         node_fs_1.default.writeFileSync(audit.eventLogPath, "", "utf8");
@@ -365,15 +515,7 @@ function auditRoot(run) {
     return run.paths.auditDir || node_path_1.default.join(run.paths.runDir, "audit");
 }
 function readEvents(eventLogPath) {
-    if (!node_fs_1.default.existsSync(eventLogPath))
-        return [];
-    return node_fs_1.default
-        .readFileSync(eventLogPath, "utf8")
-        .split(/\n/g)
-        .map((line) => line.trim())
-        .filter(Boolean)
-        .map((line) => JSON.parse(line))
-        .sort(compareEvents);
+    return readEventsRaw(eventLogPath).events.sort(compareEvents);
 }
 function workerRows(events, run) {
     const workerIds = unique([...(run.workers || []).map((worker) => worker.id), ...events.map((event) => event.workerId || "")]).sort();
@@ -419,9 +561,11 @@ function commitRows(events, run) {
     });
 }
 function createEventId(run, kind) {
-    const stamp = new Date().toISOString().replace(/[-:]/g, "").replace(/\..+/, "Z");
-    const count = readEvents(node_path_1.default.join(auditRoot(run), "events.jsonl")).length + 1;
-    return `audit-${(0, state_1.safeFileName)(kind)}-${stamp}-${String(count).padStart(4, "0")}`;
+    // Deterministic (FreeBSD-audit L12/L13): chain-local sequence (event-log length),
+    // no wall-clock stamp — event.id is bound into the eventHash chain (computeEventHash),
+    // so a stable id keeps the chain reproducible on replay.
+    const count = readEvents(trustAuditPaths(run).eventLogPath).length + 1;
+    return `audit-${(0, state_1.safeFileName)(kind)}-${String(count).padStart(4, "0")}`;
 }
 function redactPolicy(policy) {
     if (!policy)