cool-workflow 0.1.81 → 0.1.83

package/dist/run-registry.js

@@ -162,29 +162,36 @@ class RunRegistry {
         return node_path_1.default.join(this.homeRoot, "registry");
     }
     // ---- per-repo overlays (plain files) ------------------------------------
+    // Overlay reads distinguish ABSENT (clean default) from PRESENT-but-corrupt
+    // (fail closed). readJson throws `Invalid JSON in <file>` on a present file
+    // that won't parse; we let that propagate instead of swallowing it. Swallowing
+    // is the absent-vs-corrupt conflation telemetry-ledger.ts flags as the bug that
+    // "let a corrupt overlay verify green" — here it would silently un-archive every
+    // archived run / drop every provenance link. This is authoritative durable state.
+    // A present overlay must parse to a JSON OBJECT. readJson already fails closed
+    // on unparseable bytes; this catches the next shape over: valid JSON that is
+    // `null`, an array, or a scalar. Without it `parsed.archived` throws a cryptic
+    // TypeError (null) or silently reads `undefined` (array) and the whole registry
+    // scan breaks. Fail closed with a clear message instead.
+    requireOverlayObject(parsed, file) {
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+            throw new Error(`Corrupt overlay ${file}: expected a JSON object, got ${Array.isArray(parsed) ? "array" : parsed === null ? "null" : typeof parsed}`);
+        }
+        return parsed;
+    }
     loadArchiveOverlay(repo) {
         const file = node_path_1.default.join(this.repoRegistryDir(repo), "archive.json");
         if (!node_fs_1.default.existsSync(file))
             return { schemaVersion: 1, archived: {} };
-        try {
-            const parsed = (0, state_1.readJson)(file);
-            return { schemaVersion: 1, archived: parsed.archived || {} };
-        }
-        catch {
-            return { schemaVersion: 1, archived: {} };
-        }
+        const parsed = this.requireOverlayObject((0, state_1.readJson)(file), file);
+        return { schemaVersion: 1, archived: parsed.archived || {} };
     }
     loadProvenanceOverlay(repo) {
         const file = node_path_1.default.join(this.repoRegistryDir(repo), "provenance.json");
         if (!node_fs_1.default.existsSync(file))
             return { schemaVersion: 1, links: {} };
-        try {
-            const parsed = (0, state_1.readJson)(file);
-            return { schemaVersion: 1, links: parsed.links || {} };
-        }
-        catch {
-            return { schemaVersion: 1, links: {} };
-        }
+        const parsed = this.requireOverlayObject((0, state_1.readJson)(file), file);
+        return { schemaVersion: 1, links: parsed.links || {} };
     }
     loadRepoOverlays(repo) {
         return {
@@ -203,15 +210,14 @@ class RunRegistry {
     }
     loadRepos() {
         const file = this.reposFilePath();
+        // Absent => no registered repos. Present-but-corrupt must fail closed: a
+        // swallowed parse error here silently drops every cross-repo root the
+        // operator registered, shrinking the home index to the current repo with no
+        // signal. Let readJson's `Invalid JSON` throw surface the corruption.
         if (!node_fs_1.default.existsSync(file))
             return { schemaVersion: 1, repos: [] };
-        try {
-            const parsed = (0, state_1.readJson)(file);
-            return { schemaVersion: 1, repos: Array.isArray(parsed.repos) ? parsed.repos : [] };
-        }
-        catch {
-            return { schemaVersion: 1, repos: [] };
-        }
+        const parsed = this.requireOverlayObject((0, state_1.readJson)(file), file);
+        return { schemaVersion: 1, repos: Array.isArray(parsed.repos) ? parsed.repos : [] };
     }
     /** Persisted union of registered repo roots and the current repo, deduped and
      *  sorted. Read-only: does NOT write repos.json (reads stay pure). */
@@ -745,9 +751,14 @@ class RunRegistry {
         // Record provenance in the per-repo overlay (derived metadata), NOT in the
         // original run's source state — the past is never mutated.
         const provFile = node_path_1.default.join(this.repoRegistryDir(original.repo), "provenance.json");
-        const provOverlay = this.loadProvenanceOverlay(original.repo);
-        provOverlay.links[newRun.id] = provenance;
-        (0, state_1.writeJson)(provFile, provOverlay, { durable: true });
+        // Lock the read-modify-write: a concurrent rerun/archive on the same repo
+        // overlay would otherwise last-writer-wins and drop a provenance link. The
+        // sibling writers (registerRepo, archive) already serialize via withFileLock.
+        (0, state_1.withFileLock)(provFile, () => {
+            const provOverlay = this.loadProvenanceOverlay(original.repo);
+            provOverlay.links[newRun.id] = provenance;
+            (0, state_1.writeJson)(provFile, provOverlay, { durable: true });
+        });
         return {
             schemaVersion: 1,
             originalRunId: runId,

package/dist/scheduler.js

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Scheduler = void 0;
+const node_crypto_1 = __importDefault(require("node:crypto"));
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const state_1 = require("./state");
@@ -15,6 +16,16 @@ class Scheduler {
         this.cwd = node_path_1.default.resolve(cwd);
         this.storePath = node_path_1.default.join(this.cwd, ".cw", "schedules", "tasks.json");
     }
+    // Every mutation is a cross-process read-modify-write of the one store file
+    // (the daemon polls `due` while CLI calls create/complete/delete concurrently).
+    // Without serialization two writers both load, both atomically rename their
+    // copy back, and the second silently clobbers the first's new task / status /
+    // history record. `locked` holds the same advisory lock the queue and
+    // reclamation stores already use. Reads (list/history) need no lock: the atomic
+    // rename means a reader always sees a whole old-or-new store.
+    locked(fn) {
+        return (0, state_1.withFileLock)(this.storePath, fn);
+    }
     create(options) {
         const kind = normalizeKind(options.kind);
         const now = new Date();
@@ -42,23 +53,30 @@ class Scheduler {
             maxRuns: numberOption(options.maxRuns),
             runCount: 0
         };
-        const store = this.load();
-        store.tasks.push(task);
-        this.save(store);
-        return task;
+        return this.locked(() => {
+            const store = this.load();
+            store.tasks.push(task);
+            this.save(store);
+            return task;
+        });
     }
     list(status) {
         const store = this.load();
         return status ? store.tasks.filter((task) => task.status === status) : store.tasks;
     }
     delete(id) {
-        const store = this.load();
-        const before = store.tasks.length;
-        store.tasks = store.tasks.filter((task) => task.id !== id);
-        this.save(store);
-        return { deleted: store.tasks.length !== before, id };
+        return this.locked(() => {
+            const store = this.load();
+            const before = store.tasks.length;
+            store.tasks = store.tasks.filter((task) => task.id !== id);
+            this.save(store);
+            return { deleted: store.tasks.length !== before, id };
+        });
     }
     due(now = new Date()) {
+        return this.locked(() => this.dueLocked(now));
+    }
+    dueLocked(now) {
         const store = this.load();
         let changed = false;
         for (const task of store.tasks) {
@@ -86,63 +104,71 @@ class Scheduler {
         return dueTasks;
     }
     complete(id, options = {}) {
-        const store = this.load();
-        const task = store.tasks.find((candidate) => candidate.id === id);
-        if (!task)
-            throw new Error(`Scheduled task not found: ${id}`);
-        const now = new Date();
-        task.runCount += 1;
-        task.lastRunAt = now.toISOString();
-        task.updatedAt = now.toISOString();
-        const maxRuns = numberOption(options.maxRuns) ?? task.maxRuns;
-        if (maxRuns !== undefined)
-            task.maxRuns = maxRuns;
-        if (task.kind === "reminder" || (task.maxRuns !== undefined && task.runCount >= task.maxRuns)) {
-            task.status = "completed";
-        }
-        else {
-            task.nextRunAt = computeNextRunAt(task, now).toISOString();
-        }
-        this.save(store);
-        return task;
+        return this.locked(() => {
+            const store = this.load();
+            const task = store.tasks.find((candidate) => candidate.id === id);
+            if (!task)
+                throw new Error(`Scheduled task not found: ${id}`);
+            const now = new Date();
+            task.runCount += 1;
+            task.lastRunAt = now.toISOString();
+            task.updatedAt = now.toISOString();
+            const maxRuns = numberOption(options.maxRuns) ?? task.maxRuns;
+            if (maxRuns !== undefined)
+                task.maxRuns = maxRuns;
+            if (task.kind === "reminder" || (task.maxRuns !== undefined && task.runCount >= task.maxRuns)) {
+                task.status = "completed";
+            }
+            else {
+                task.nextRunAt = computeNextRunAt(task, now).toISOString();
+            }
+            this.save(store);
+            return task;
+        });
     }
     pause(id) {
         return this.setStatus(id, "paused");
     }
     resume(id) {
-        const store = this.load();
-        const task = findTask(store, id);
-        const now = new Date();
-        task.status = "active";
-        task.updatedAt = now.toISOString();
-        if (new Date(task.nextRunAt).getTime() <= now.getTime()) {
-            task.nextRunAt = computeNextRunAt(task, now).toISOString();
-        }
-        this.save(store);
-        return task;
+        return this.locked(() => {
+            const store = this.load();
+            const task = findTask(store, id);
+            const now = new Date();
+            task.status = "active";
+            task.updatedAt = now.toISOString();
+            if (new Date(task.nextRunAt).getTime() <= now.getTime()) {
+                task.nextRunAt = computeNextRunAt(task, now).toISOString();
+            }
+            this.save(store);
+            return task;
+        });
     }
     runNow(id) {
-        const store = this.load();
-        const task = findTask(store, id);
-        const now = new Date();
-        task.lastDueAt = now.toISOString();
-        task.updatedAt = now.toISOString();
-        const record = createHistoryRecord(task, "started", this.cwd, now);
-        store.history.push(record);
-        this.save(store);
-        return record;
+        return this.locked(() => {
+            const store = this.load();
+            const task = findTask(store, id);
+            const now = new Date();
+            task.lastDueAt = now.toISOString();
+            task.updatedAt = now.toISOString();
+            const record = createHistoryRecord(task, "started", this.cwd, now);
+            store.history.push(record);
+            this.save(store);
+            return record;
+        });
     }
     history(id) {
         const store = this.load();
         return id ? store.history.filter((record) => record.scheduleId === id) : store.history;
     }
     setStatus(id, status) {
-        const store = this.load();
-        const task = findTask(store, id);
-        task.status = status;
-        task.updatedAt = new Date().toISOString();
-        this.save(store);
-        return task;
+        return this.locked(() => {
+            const store = this.load();
+            const task = findTask(store, id);
+            task.status = status;
+            task.updatedAt = new Date().toISOString();
+            this.save(store);
+            return task;
+        });
     }
     load() {
         if (!node_fs_1.default.existsSync(this.storePath))
@@ -233,19 +259,48 @@ function matchesCron(value, expr, min, max) {
         return Number.isInteger(parsed) && parsed >= min && parsed <= max && parsed === value;
     });
 }
+// Deterministic jitter (replay-determinism self-audit): the jittered Date is NOT a
+// runtime-only sleep — it lands in persisted/replayed state (task.nextRunAt and,
+// transitively, the schedule store), so a Math.random() offset broke replay
+// determinism. The spread (0..jitterSeconds) is now derived from a content hash of
+// the base instant, so the same base time + jitter window always yields the same
+// offset; distinct base times still spread out across the window. The base Date is
+// itself an edge timestamp that is recorded once.
 function addJitter(date, jitterSeconds) {
     if (!jitterSeconds)
         return date;
-    const offset = Math.floor(Math.random() * (jitterSeconds + 1)) * 1000;
-    return new Date(date.getTime() + offset);
+    const digest = node_crypto_1.default.createHash("sha256").update(`${date.getTime()}`).digest();
+    const seconds = digest.readUInt32BE(0) % (jitterSeconds + 1);
+    return new Date(date.getTime() + seconds * 1000);
 }
+// Deterministic schedule id (replay-determinism self-audit): the stamp is an edge
+// timestamp (recorded once), but the former Math.random() suffix made each
+// persisted schedule id non-reproducible. The suffix is now a content hash of the
+// schedule's deterministic identity (kind + the recorded stamp), so re-deriving the
+// id for a recorded schedule yields the byte-identical value while schedules created
+// at distinct instants still get distinct ids. Mirrors src/worker-isolation/paths.ts.
+let scheduleIdSequence = 0;
 function createScheduleId(kind) {
     const stamp = new Date().toISOString().replace(/[-:]/g, "").replace(/\..+/, "Z");
-    return `${kind}-${stamp}-${Math.random().toString(36).slice(2, 8)}`;
+    // Second-resolution stamp: two schedules of the same kind created within one
+    // second would otherwise collide on an identical id. process.pid + a monotonic
+    // counter break the tie across concurrent processes and within one process,
+    // deterministically (not a PRNG).
+    scheduleIdSequence += 1;
+    const suffix = node_crypto_1.default.createHash("sha256").update(`${kind}:${stamp}:${process.pid}:${scheduleIdSequence}`).digest("hex").slice(0, 6);
+    return `${kind}-${stamp}-${suffix}`;
 }
+// Deterministic schedule-run (history) id — same rationale as createScheduleId. The
+// history record stamp differs from the owning schedule's, so the hashed identity
+// (kind + run stamp) stays distinct from the schedule id while remaining a pure
+// function of already-recorded state.
+let scheduleRunIdSequence = 0;
 function createScheduleRunId(kind) {
     const stamp = new Date().toISOString().replace(/[-:]/g, "").replace(/\..+/, "Z");
-    return `run-${kind}-${stamp}-${Math.random().toString(36).slice(2, 8)}`;
+    // pid + counter break same-kind/same-second collisions (see createScheduleId).
+    scheduleRunIdSequence += 1;
+    const suffix = node_crypto_1.default.createHash("sha256").update(`run:${kind}:${stamp}:${process.pid}:${scheduleRunIdSequence}`).digest("hex").slice(0, 6);
+    return `run-${kind}-${stamp}-${suffix}`;
 }
 function requiredString(value, name) {
     const text = stringOption(value);

package/dist/topology.js

@@ -17,6 +17,8 @@ exports.showTopologyRun = showTopologyRun;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const state_1 = require("./state");
+const execution_backend_1 = require("./execution-backend");
+const telemetry_attestation_1 = require("./telemetry-attestation");
 const pipeline_contract_1 = require("./pipeline-contract");
 const state_node_1 = require("./state-node");
 const trust_audit_1 = require("./trust-audit");
@@ -186,10 +188,16 @@ function applyTopology(run, topologyId, input = {}) {
     const definition = validation.definition;
     const state = ensureTopologyState(run);
     (0, multi_agent_1.ensureMultiAgentState)(run);
-    const id = input.id || `${definition.id}-${timestampId()}`;
+    const taskIds = selectedTaskIds(run, input.taskIds);
+    // Default id is a DETERMINISTIC content-hash (replay determinism): two `topology
+    // apply` invocations WITHOUT --id over the same definition/tasks/run produce a
+    // byte-identical id. Same sha256/stableStringify the kernel uses for node ids
+    // (state-node/createNodeId) and ledger record ids. `state.runs.length` is the
+    // stable sequence so repeated applies on the same run get distinct ids without a
+    // wall-clock stamp. input.id stays an explicit override.
+    const id = input.id || topologyRunId(definition, taskIds, run.id, state.runs.length);
     if (state.runs.some((record) => record.id === id))
         throw new Error(`Duplicate MultiAgentTopologyRun id: ${id}`);
-    const taskIds = selectedTaskIds(run, input.taskIds);
     const board = (0, coordinator_1.resolveBlackboard)(run, {
         id: input.blackboardId || `${id}-blackboard`,
         title: `${definition.title} Blackboard`,
@@ -514,8 +522,21 @@ function statusToNodeStatus(status) {
 function issue(code, message, path) {
     return { code, message, path };
 }
-function timestampId() {
-    return new Date().toISOString().replace(/[-:.]/g, "").slice(0, 15).toLowerCase();
+// Deterministic default topology-run id (F2, replay determinism): no wall-clock.
+// Bound to a short sha256 of canonical content — definition id, the SORTED role and
+// selected-task ids, the workflow run id, and a stable sequence (the count of
+// topology runs already on this run). Same sha256/stableStringify the kernel uses
+// for node ids and ledger record hashes, so two replays without --id reach a
+// byte-identical fingerprint, while distinct applies on one run stay distinct.
+function topologyRunId(definition, taskIds, runId, sequence) {
+    const digest = (0, execution_backend_1.sha256)((0, telemetry_attestation_1.stableStringify)({
+        definitionId: definition.id,
+        roleIds: [...definition.roles.map((role) => role.id)].sort(),
+        taskIds: [...taskIds].sort(),
+        runId,
+        sequence
+    }));
+    return `${definition.id}-${digest.replace("sha256:", "").slice(0, 16)}`;
 }
 function countBy(items, pick) {
     const counts = {};

package/dist/trust-audit.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TRUST_AUDIT_SCHEMA_VERSION = void 0;
+exports.CORRELATION_ID_FIELDS = exports.TRUST_AUDIT_SCHEMA_VERSION = void 0;
 exports.trustAuditGenesis = trustAuditGenesis;
 exports.verifyTrustAudit = verifyTrustAudit;
 exports.ensureTrustAudit = ensureTrustAudit;
@@ -152,6 +152,65 @@ function verifyTrustAudit(run) {
     }
     return { present: events.length > 0, verified, eventCount: events.length, chained, unchained, corruptLines, checks };
 }
+// ---- Correlation-id fields (single source of truth, F12) -------------------
+// These id fields are plain pass-throughs that flow input -> persisted event ->
+// summary index unchanged. They were previously re-listed by hand in three
+// places (recordTrustAuditEvent, the index writer, and partially in
+// multi-agent-trust), so adding a new correlation id meant editing every list and
+// silently dropping it from the index when one was missed. They now live in ONE
+// array; both spread sites pick from it via pickCorrelationIds, so a new id is
+// added in exactly one place.
+//
+// SERIALIZATION-PRESERVING by design: this is a plain key-copy with NO transform,
+// so the persisted JSON for these keys is byte-identical to the old hand-spread
+// (compact() still drops the undefined ones). The hash chain that binds these
+// fields is therefore unaffected. Fields needing derivation/normalization
+// (feedbackIds, sandboxProfileId, policyRef, multiAgentPolicyRef, normalizedPath,
+// envVars, …) are intentionally NOT here — they keep their bespoke handling at the
+// call site.
+exports.CORRELATION_ID_FIELDS = [
+    "candidateId",
+    "scoreId",
+    "selectionId",
+    "commitId",
+    "multiAgentRunId",
+    "agentRoleId",
+    "agentGroupId",
+    "agentMembershipId",
+    "agentFanoutId",
+    "agentFaninId",
+    "blackboardId",
+    "blackboardTopicId",
+    "blackboardMessageId",
+    "blackboardContextId",
+    "blackboardArtifactRefId",
+    "blackboardSnapshotId",
+    "coordinatorDecisionId",
+    "topologyId",
+    "topologyRunId"
+];
+/** Copy exactly the correlation-id keys (and no others) from `source`, preserving
+ *  each value verbatim (including `undefined`, which compact()/JSON.stringify drop
+ *  identically to the prior per-key spread). Spread the result; do not transform. */
+function pickCorrelationIds(source) {
+    const picked = {};
+    for (const field of exports.CORRELATION_ID_FIELDS)
+        picked[field] = source[field];
+    return picked;
+}
+// The summary index has always carried every correlation id EXCEPT scoreId (the
+// per-candidate score lives in the candidates[] rows, not the flat event index).
+// Pin that exception in ONE place so the index stays byte-identical while still
+// inheriting any NEW id from CORRELATION_ID_FIELDS automatically.
+const INDEX_OMITTED_CORRELATION_IDS = new Set(["scoreId"]);
+/** Correlation ids for the summary index: the full pick minus the keys the index
+ *  has historically omitted (see INDEX_OMITTED_CORRELATION_IDS). */
+function indexCorrelationIds(event) {
+    const picked = pickCorrelationIds(event);
+    for (const field of INDEX_OMITTED_CORRELATION_IDS)
+        delete picked[field];
+    return picked;
+}
 function ensureTrustAudit(run) {
     const auditDir = auditRoot(run);
     node_fs_1.default.mkdirSync(auditDir, { recursive: true });
@@ -177,25 +236,11 @@ function recordTrustAuditEvent(run, input) {
         taskId: input.taskId,
         nodeId: input.nodeId,
         feedbackIds: input.feedbackIds?.filter(Boolean).sort(),
-        candidateId: input.candidateId,
-        scoreId: input.scoreId,
-        selectionId: input.selectionId,
-        commitId: input.commitId,
-        multiAgentRunId: input.multiAgentRunId,
-        agentRoleId: input.agentRoleId,
-        agentGroupId: input.agentGroupId,
-        agentMembershipId: input.agentMembershipId,
-        agentFanoutId: input.agentFanoutId,
-        agentFaninId: input.agentFaninId,
-        blackboardId: input.blackboardId,
-        blackboardTopicId: input.blackboardTopicId,
-        blackboardMessageId: input.blackboardMessageId,
-        blackboardContextId: input.blackboardContextId,
-        blackboardArtifactRefId: input.blackboardArtifactRefId,
-        blackboardSnapshotId: input.blackboardSnapshotId,
-        coordinatorDecisionId: input.coordinatorDecisionId,
-        topologyId: input.topologyId,
-        topologyRunId: input.topologyRunId,
+        // Plain correlation-id pass-throughs (candidateId … topologyRunId) come from the
+        // single CORRELATION_ID_FIELDS list. Key order is preserved (the list is in the
+        // same order the keys used to be hand-written), so the persisted JSON — and thus
+        // the eventHash chain — is byte-identical.
+        ...pickCorrelationIds(input),
         sandboxProfileId: input.sandboxProfileId || input.policySnapshot?.id,
         policyRef: input.policyRef || (input.policySnapshot?.id ? `run.sandboxProfiles.${input.policySnapshot.id}` : undefined),
         multiAgentPolicyRef: input.policyRef,
@@ -351,24 +396,11 @@ function summarizeTrustAudit(run) {
             source: event.source,
             workerId: event.workerId,
             taskId: event.taskId,
-            candidateId: event.candidateId,
-            selectionId: event.selectionId,
-            commitId: event.commitId,
-            multiAgentRunId: event.multiAgentRunId,
-            agentRoleId: event.agentRoleId,
-            agentGroupId: event.agentGroupId,
-            agentMembershipId: event.agentMembershipId,
-            agentFanoutId: event.agentFanoutId,
-            agentFaninId: event.agentFaninId,
-            blackboardId: event.blackboardId,
-            blackboardTopicId: event.blackboardTopicId,
-            blackboardMessageId: event.blackboardMessageId,
-            blackboardContextId: event.blackboardContextId,
-            blackboardArtifactRefId: event.blackboardArtifactRefId,
-            blackboardSnapshotId: event.blackboardSnapshotId,
-            coordinatorDecisionId: event.coordinatorDecisionId,
-            topologyId: event.topologyId,
-            topologyRunId: event.topologyRunId,
+            // Same single CORRELATION_ID_FIELDS list the record path uses, so the index
+            // can never silently omit a correlation id that the event carries. (The index
+            // historically omitted scoreId; that is preserved below by deleting it after
+            // the pick, keeping this writer's output byte-identical.)
+            ...indexCorrelationIds(event),
             sandboxProfileId: event.sandboxProfileId,
             policyRef: event.policyRef,
             multiAgentPolicyRef: event.multiAgentPolicyRef