create-agdf 0.20.2 → 0.30.0

package/generated/plugins/copilot/agdf/runtime/create-agdf/runtime/core/lib/control-state/run-recovery.js

@@ -1,296 +0,0 @@
-import { assertRecoveryOperationsTrusted } from "./run-state-writer.js";
-import { createHash, randomUUID } from "node:crypto";
-import {
-  closeSync, existsSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, writeFileSync, fsyncSync,
-} from "node:fs";
-import { dirname, join } from "node:path";
-import { transitionDecisionForRunState } from "../control-evaluation/gate-policy.js";
-import { prepareRunContentState, userGateOrder } from "../control-evaluation/run-state.js";
-import { containedRegularFile, hasSymlinkComponent } from "./contained-file.js";
-import { duplicateArtefactRowTypes, parseControlState, parseRunState, scalarFields, sectionTableRows } from "./run-state-parser.js";
-import { applyRunSeals, artefactFileDigest, canonicalRunText, computeRunSeals, listedArtefactPaths, pendingArtefactPaths, runSealState } from "./run-seal.js";
-import { runPath } from "./run-state-reader.js";
-import { atomicWrite, recoveryRunContent, unapproveRecoveryApprovals, withRunLock, writeRunRecoveryLocked } from "./run-state-writer.js";
-
-const sha256 = (value) => `sha256:${createHash("sha256").update(value, "utf8").digest("hex")}`;
-const digestContent = (content) => sha256(canonicalRunText(content));
-function recoveryPreviewDigest(preview) {
-  const bound = {
-    schema_version: preview.schema_version, preview_id: preview.preview_id, run_id: preview.run_id,
-    source_revision_id: preview.source_revision_id, source_content_digest: preview.source_content_digest,
-    source_content: preview.source_content, source_artefacts: preview.source_artefacts,
-    git_history: preview.git_history, prior_approvals: preview.prior_approvals,
-    approval_provenance: preview.approval_provenance, approvals_to_invalidate: preview.approvals_to_invalidate,
-    next_gate: preview.next_gate, next_revision_id: preview.next_revision_id,
-    candidate_content: preview.candidate_content, candidate_digest: preview.candidate_digest,
-  };
-  // Version 1 journals did not bind the activity timestamp. Keep their stored digest readable;
-  // new previews bind the timestamp used by both the expected state and the atomic writer.
-  if (preview.preview_format_version === 2) {
-    bound.preview_format_version = 2;
-    bound.created_at = preview.created_at;
-  }
-  return sha256(JSON.stringify(bound));
-}
-
-const PREVIEW_CONFIRMATION = (runId, previewId, digest) => `RECOVER ${runId} ${previewId} ${digest}`;
-
-// Read-only proof of the former self-reference hashing defect. This does not accept arbitrary
-// changed seals: the complete current record must equal the validated journal's old writer result.
-export function inspectSelfReferenceRecovery(root, runId) {
-  const { path, runDir } = safeRunFiles(root, runId);
-  const content = readFileSync(path, "utf8");
-  const parsed = parseRunState(content, runId);
-  const selfPath = `.agdf/control/runs/${runId}/RUN_STATE.md`;
-  if (!parsed.valid || parsed.meta.lifecycle !== "active" || runSealState(root, content).status !== "content_changed"
-      || !listedArtefactPaths(content).includes(selfPath)) return null;
-  const directory = join(runDir, "recovery-previews");
-  if (!existsSync(directory)) return null;
-  const stat = lstatSync(directory);
-  if (stat.isSymbolicLink() || !stat.isDirectory()) throw new Error("AGDF_RUN_PATH_INVALID");
-  for (const name of readdirSync(directory).filter((value) => /^[0-9a-f-]{36}\.json$/iu.test(value))) {
-    try {
-      const { preview } = readPreview(root, runDir, runId, name.slice(0, -5));
-      if (preview.phase !== "committed" || preview.preview_format_version !== 2
-          || preview.result_digest !== digestContent(content) || preview.result_revision_id !== parsed.meta.revision_id
-          || preview.next_revision_id !== parsed.meta.revision_id) continue;
-      const currentArtefacts = artifactSnapshot(root, content).filter((entry) => entry.path !== selfPath);
-      if (JSON.stringify(currentArtefacts) !== JSON.stringify(preview.source_artefacts.filter((entry) => entry.path !== selfPath))) continue;
-      const source = parseRunState(preview.source_content, runId);
-      const restored = recoveryRunContent(root, preview.candidate_content, {
-        revision: source.meta.revision, nextRevisionId: preview.next_revision_id, updatedAt: preview.created_at,
-      });
-      const legacy = applyRunSeals(restored, computeRunSeals(root, restored, { selfReferenceDigest: preview.source_content_digest }));
-      if (legacy !== content || runSealState(root, restored).status !== "valid") continue;
-      return { source: `recovery-previews/${name}`, source_revision_id: parsed.meta.revision_id, content: restored };
-    } catch { /* A damaged checkpoint cannot prove an original. */ }
-  }
-  return null;
-}
-
-function gitHistoryCandidates(root, runId, readGitHistory) {
-  if (typeof readGitHistory !== "function") return { status: "unavailable", candidates: [] };
-  const relativePath = `.agdf/control/runs/${runId}/RUN_STATE.md`;
-  let entries;
-  try { entries = readGitHistory(root, relativePath); } catch { return { status: "unavailable", candidates: [] }; }
-  if (!Array.isArray(entries) || entries.length > 25) return { status: "unavailable", candidates: [] };
-  const candidates = [];
-  for (const entry of entries) {
-    if (!entry || entry.path !== relativePath || !/^[0-9a-f]{40,64}$/u.test(entry.commit) || typeof entry.content !== "string" || Buffer.byteLength(entry.content) > 1024 * 1024) continue;
-    const parsed = parseRunState(entry.content, runId);
-    if (!parsed.valid) continue;
-    const meta = scalarFields(entry.content).values;
-    const sealPattern = /^sha256:[0-9a-f]{64}$/u;
-    candidates.push({ commit: entry.commit, revision_id: parsed.meta.revision_id, content_digest: digestContent(entry.content),
-      seal_lines_present: sealPattern.test(meta.get("content_seal") ?? "") && sealPattern.test(meta.get("approval_seal") ?? ""), approval_provenance: "not_proven_by_git_revision" });
-  }
-  return { status: "available", candidates };
-}
-
-function safeRunFiles(root, runId) {
-  const path = runPath(root, runId);
-  const runDir = dirname(path);
-  let rootStat;
-  try { rootStat = lstatSync(root); } catch { throw new Error("AGDF_RUN_PATH_INVALID"); }
-  if (rootStat.isSymbolicLink() || !rootStat.isDirectory()) throw new Error("AGDF_RUN_PATH_INVALID");
-  for (const target of [join(root, ".agdf"), join(root, ".agdf", "control"), join(root, ".agdf", "control", "runs"), runDir, path]) {
-    let stat;
-    try { stat = lstatSync(target); } catch { throw new Error("AGDF_RUN_PATH_INVALID"); }
-    if (stat.isSymbolicLink() || (target === path ? !stat.isFile() : !stat.isDirectory())) throw new Error("AGDF_RUN_PATH_INVALID");
-  }
-  return { path, runDir };
-}
-
-function artifactSnapshot(root, content) {
-  const paths = listedArtefactPaths(content);
-  const pending = new Set(pendingArtefactPaths(content));
-  const entries = paths.map((path) => {
-    const resolved = containedRegularFile(root, path);
-    const status = hasSymlinkComponent(root, path) ? "invalid" : resolved.status;
-    return { path, status, digest: status === "valid" ? artefactFileDigest(root, path) : status,
-      ...(status === "missing" && pending.has(path) ? { planned: true } : {}) };
-  });
-  return entries;
-}
-
-function approvalSnapshot(content) {
-  return ["Approvals", "Gate Checklist"].flatMap((section) => sectionTableRows(content, section)
-    .filter(([gate]) => userGateOrder.includes(gate))
-    .map(([gate, status = "", evidence = ""]) => ({ section, gate, status: status.replace(/^`|`$/gu, "").trim(), evidence: evidence.trim() })));
-}
-
-function deriveNextGate(root, content, path) {
-  const state = prepareRunContentState(root, content, path);
-  return transitionDecisionForRunState(state).current_gate;
-}
-
-export function inspectRunRecovery(root, runId, { inspectHistory = true, readGitHistory } = {}) {
-  const { path } = safeRunFiles(root, runId);
-  const content = readFileSync(path, "utf8");
-  const state = parseRunState(content, runId);
-  if (!state.valid) throw new Error("AGDF_RUN_STATE_INVALID");
-  if (state.meta.lifecycle !== "active") throw new Error("AGDF_RECOVERY_LIFECYCLE_UNSUPPORTED");
-  if (duplicateArtefactRowTypes(content).length) throw new Error("AGDF_ARTEFACT_ROW_DUPLICATE");
-  const seal = runSealState(root, content);
-  assertRecoveryOperationsTrusted(content);
-  if (!["unsealed", "invalid"].includes(seal.status)) throw new Error("AGDF_RUN_RECOVERY_NOT_REQUIRED");
-  const artefacts = artifactSnapshot(root, content);
-  const gitHistory = inspectHistory ? gitHistoryCandidates(root, runId, readGitHistory) : { status: "not_checked", candidates: [] };
-  return Object.freeze({
-    schema_version: "1", run_id: runId, revision: state.meta.revision,
-    revision_id: state.meta.revision_id, seal_status: seal.status,
-    content_digest: digestContent(content), artefacts,
-    git_history: gitHistory,
-    approvals: approvalSnapshot(content), approval_provenance: "no_independent_provenance",
-    next_gate_if_recovered: deriveNextGate(root, unapproveRecoveryApprovals(content), path),
-  });
-}
-
-function previewDirectory(runDir) {
-  const path = join(runDir, "recovery-previews");
-  try { mkdirSync(path, { mode: 0o700 }); } catch (error) { if (error.code !== "EEXIST") throw error; }
-  const stat = lstatSync(path);
-  if (stat.isSymbolicLink() || !stat.isDirectory()) throw new Error("AGDF_RUN_PATH_INVALID");
-  if (process.platform !== "win32" && (stat.mode & 0o077) !== 0) throw new Error("AGDF_RECOVERY_JOURNAL_PERMISSIONS_INVALID");
-  return path;
-}
-
-function createJournal(path, record) {
-  let fd;
-  try {
-    fd = openSync(path, "wx", 0o600);
-    writeFileSync(fd, `${JSON.stringify(record, null, 2)}\n`, "utf8");
-    fsyncSync(fd);
-  } finally {
-    if (fd !== undefined) closeSync(fd);
-  }
-}
-
-export function previewRunRecovery(root, runId, options = {}) {
-  const inspection = inspectRunRecovery(root, runId, options);
-  if (inspection.artefacts.some((entry) => entry.status !== "valid" && !entry.planned)) {
-    throw new Error(inspection.artefacts.some((entry) => entry.status === "invalid")
-      ? "AGDF_RECOVERY_ARTEFACT_PATH_INVALID" : "AGDF_RECOVERY_ARTEFACT_MISSING");
-  }
-  const { path, runDir } = safeRunFiles(root, runId);
-  const source = readFileSync(path, "utf8");
-  if (digestContent(source) !== inspection.content_digest) throw new Error("AGDF_STALE_RUN_REVISION");
-  if (JSON.stringify(artifactSnapshot(root, source)) !== JSON.stringify(inspection.artefacts)) throw new Error("AGDF_STALE_RUN_REVISION");
-  const previewId = randomUUID();
-  const nextRevisionId = randomUUID();
-  const candidate = unapproveRecoveryApprovals(source);
-  const preview = {
-    schema_version: "1", preview_format_version: 2, preview_id: previewId, run_id: runId,
-    created_at: new Date().toISOString(),
-    source_revision_id: inspection.revision_id, source_content_digest: inspection.content_digest,
-    source_content: source,
-    source_artefacts: inspection.artefacts, git_history: inspection.git_history,
-    prior_approvals: inspection.approvals,
-    approval_provenance: "no_independent_provenance", approvals_to_invalidate: userGateOrder,
-    next_gate: inspection.next_gate_if_recovered, next_revision_id: nextRevisionId,
-    candidate_content: candidate, candidate_digest: digestContent(candidate),
-    phase: "prepared",
-  };
-  preview.preview_digest = recoveryPreviewDigest(preview);
-  preview.confirmation = PREVIEW_CONFIRMATION(runId, previewId, preview.preview_digest);
-  const dir = previewDirectory(runDir);
-  const journalPath = join(dir, `${previewId}.json`);
-  createJournal(journalPath, preview);
-  return Object.freeze({
-    schema_version: "1", outcome: "previewed", run_id: runId, preview_id: previewId,
-    confirmation: preview.confirmation, source_content_digest: preview.source_content_digest,
-    source_artefacts: preview.source_artefacts, git_history: preview.git_history,
-    approvals_to_invalidate: preview.approvals_to_invalidate,
-    approval_provenance: preview.approval_provenance, next_gate: preview.next_gate,
-    journal: journalPath.slice(root.length + 1),
-  });
-}
-
-function readPreview(root, runDir, runId, previewId) {
-  if (!/^[0-9a-f-]{36}$/iu.test(previewId)) throw new Error("AGDF_RECOVERY_PREVIEW_INVALID");
-  const dir = join(runDir, "recovery-previews");
-  const dirStat = lstatSync(dir);
-  if (dirStat.isSymbolicLink() || !dirStat.isDirectory()) throw new Error("AGDF_RUN_PATH_INVALID");
-  const path = join(dir, `${previewId}.json`);
-  const fileStat = lstatSync(path);
-  if (fileStat.isSymbolicLink() || !fileStat.isFile()) throw new Error("AGDF_RECOVERY_PREVIEW_INVALID");
-  const preview = JSON.parse(readFileSync(path, "utf8"));
-  if (preview.preview_format_version !== undefined && preview.preview_format_version !== 2) {
-    throw new Error("AGDF_RECOVERY_PREVIEW_VERSION_UNSUPPORTED");
-  }
-  if (preview.schema_version !== "1" || preview.preview_id !== previewId || preview.run_id !== runId
-      || preview.preview_digest !== recoveryPreviewDigest(preview)
-      || preview.confirmation !== PREVIEW_CONFIRMATION(runId, previewId, preview.preview_digest)
-      || preview.source_content_digest !== digestContent(preview.source_content)
-      || preview.candidate_digest !== digestContent(unapproveRecoveryApprovals(preview.source_content))
-      || preview.candidate_content !== unapproveRecoveryApprovals(preview.source_content)
-      || JSON.stringify(preview.prior_approvals) !== JSON.stringify(approvalSnapshot(preview.source_content))) {
-    throw new Error("AGDF_RECOVERY_PREVIEW_INVALID");
-  }
-  return { path, preview };
-}
-
-export function applyRunRecovery(root, { runId, previewId, confirmation }, hooks = {}) {
-  if (typeof confirmation !== "string") throw new Error("AGDF_RECOVERY_CONFIRMATION_REQUIRED");
-  const { path, runDir } = safeRunFiles(root, runId);
-  const { path: journalPath, preview } = readPreview(root, runDir, runId, previewId);
-  if (confirmation !== preview.confirmation) throw new Error("AGDF_RECOVERY_CONFIRMATION_REQUIRED");
-  return withRunLock(path, () => {
-    const lockedPreview = readPreview(root, runDir, runId, previewId).preview;
-    if (lockedPreview.preview_digest !== preview.preview_digest || lockedPreview.confirmation !== confirmation) {
-      throw new Error("AGDF_RECOVERY_PREVIEW_INVALID");
-    }
-    Object.assign(preview, lockedPreview);
-    const current = readFileSync(path, "utf8");
-    const currentDigest = digestContent(current);
-    if (JSON.stringify(artifactSnapshot(root, current)) !== JSON.stringify(preview.source_artefacts)) {
-      throw new Error("AGDF_STALE_RUN_REVISION");
-    }
-    if (preview.phase === "committed") {
-      const committed = parseRunState(current, runId);
-      if (currentDigest !== preview.result_digest || runSealState(root, current).status !== "valid"
-          || !committed.valid || committed.meta.revision_id !== preview.next_revision_id
-          || preview.result_revision_id !== preview.next_revision_id) throw new Error("AGDF_RECOVERY_JOURNAL_CONFLICT");
-      return Object.freeze({ schema_version: "1", outcome: "already_recovered", run_id: runId, preview_id: previewId, revision_id: preview.result_revision_id,
-        backlog: "pending", backlog_reason: "run_only_recovery",
-        backlog_next_action: `Synchronize this Run with run-update --run ${runId} --revision ${preview.result_revision_id}.` });
-    }
-    if (preview.phase !== "prepared" && preview.phase !== "applying") throw new Error("AGDF_RECOVERY_JOURNAL_PHASE_INVALID");
-    if (preview.phase === "prepared" && (currentDigest !== preview.source_content_digest
-        || current !== preview.source_content || JSON.stringify(artifactSnapshot(root, current)) !== JSON.stringify(preview.source_artefacts))) {
-      throw new Error("AGDF_STALE_RUN_REVISION");
-    }
-    const parsedSource = parseRunState(preview.source_content, runId);
-    if (!parsedSource.valid || parsedSource.meta.revision_id !== preview.source_revision_id) throw new Error("AGDF_RECOVERY_PREVIEW_INVALID");
-    const expectedResultContent = recoveryRunContent(root, preview.candidate_content, {
-      revision: parsedSource.meta.revision, nextRevisionId: preview.next_revision_id, updatedAt: preview.created_at,
-    });
-    const expectedResultDigest = digestContent(expectedResultContent);
-    let written;
-    if (preview.phase === "applying" && currentDigest === preview.result_digest
-        && currentDigest === expectedResultDigest && runSealState(root, current).status === "valid") {
-      written = parseRunState(current, runId);
-    } else {
-      if (preview.phase === "applying" && currentDigest !== preview.source_content_digest) throw new Error("AGDF_RECOVERY_JOURNAL_CONFLICT");
-      const applying = { ...preview, phase: "applying", source_content: current,
-        result_digest: expectedResultDigest, result_revision_id: preview.next_revision_id };
-      atomicWrite(journalPath, `${JSON.stringify(applying, null, 2)}\n`);
-      hooks.beforeRunWrite?.();
-      written = writeRunRecoveryLocked(path, preview.candidate_content, {
-        expectedContent: current, expectedRevisionId: preview.source_revision_id,
-        nextRevisionId: preview.next_revision_id,
-        updatedAt: preview.created_at,
-      });
-      hooks.afterRunWrite?.();
-    }
-    const resultContent = readFileSync(path, "utf8");
-    const completed = { ...preview, phase: "committed", result_digest: digestContent(resultContent), result_revision_id: written.meta.revision_id };
-    hooks.beforeJournalCommit?.();
-    atomicWrite(journalPath, `${JSON.stringify(completed, null, 2)}\n`);
-    return Object.freeze({ schema_version: "1", outcome: "recovered", run_id: runId,
-      backlog: "pending", backlog_reason: "run_only_recovery",
-      backlog_next_action: `Synchronize this Run with run-update --run ${runId} --revision ${written.meta.revision_id}.`,
-      preview_id: previewId, revision: written.meta.revision, revision_id: written.meta.revision_id,
-      seal_status: runSealState(root, resultContent).status, next_gate: deriveNextGate(root, resultContent, path) });
-  });
-}

package/generated/plugins/copilot/agdf/runtime/create-agdf/runtime/core/lib/control-state/run-relationship-correction.js

@@ -1,74 +0,0 @@
-import { randomUUID } from "node:crypto";
-import { canonicalJson } from "./approval-command-contract.js";
-import { readArtefactBindings } from "./artefact-bindings.js";
-import { exactApprovedArtefacts, validateBindingProof } from "./artefact-binding-proof.js";
-import { APPROVAL_GATES, runSealState } from "./run-seal.js";
-import { readRun, appendTableRow, guardedWrite, rejected } from "./run-state-edits.js";
-import { prepareRunContentState } from "../control-evaluation/run-state.js";
-import { parseControlState } from "./run-state-parser.js";
-import { runPath } from "./run-state-reader.js";
-import { flushRunCommit, withRunLock, writeRunLocked } from "./run-state-writer.js";
-import { sameRelationship } from "../control-evaluation/delivery-relationships.js";
-import { transitionDecisionForRunState } from "../control-evaluation/gate-policy.js";
-
-const controlFor = (root, run) => ({ ...prepareRunContentState(root, run.content, run.path), meta: run.meta });
-
-// Mutation owner for authorized bound continuation only. Evaluators never call it.
-export function correctRunRelationship(root, { runId, revisionId }, { evaluateGateCheck, checkpoint, confirmCommit = flushRunCommit } = {}) {
-  const locked = guardedWrite(runId, () => withRunLock(runPath(root, runId), () => {
-    const run = readRun(root, runId);
-    if (run.rejection) return run.rejection;
-    if (run.meta.revision_id !== revisionId) return rejected(runId, "stale_revision");
-    if (runSealState(root, run.content).status !== "valid") return rejected(runId, "seal_invalid");
-    const report = evaluateGateCheck(root, { runId });
-    const decisive = (report.delivery_map?.findings ?? []).filter(row => ["block", "revise"].includes(row.severity));
-    const missing = (report.delivery_map?.relationships ?? []).filter(row => row.required && row.status === "missing");
-    if (missing.length === 0 && decisive.length === 0) return { schema_version: "1", outcome: "unchanged", run_id: runId, revision_id: revisionId };
-    const unrelatedDoctor = (report.doctor_report?.findings ?? []).filter(row => ["block", "revise"].includes(row.severity)
-      && row.code !== "AGDF_DELIVERY_RELATIONSHIP_MISSING");
-    if (unrelatedDoctor.length || decisive.length !== 1 || decisive[0].code !== "AGDF_DELIVERY_RELATIONSHIP_MISSING"
-        || missing.length !== 1 || report.blocking_reason !== "AGDF_DELIVERY_RELATIONSHIP_MISSING") return rejected(runId, "correction_not_eligible");
-    const control = controlFor(root, run), expected = missing[0];
-    if (control.artefact_chain.some(row => row.from === expected.from)) return rejected(runId, "correction_not_eligible");
-    const history = readArtefactBindings(run.content);
-    const eligible = history.active.filter(receipt => receipt.run_id === runId && receipt.operation.revision <= Number(run.meta.revision)
-      && sameRelationship(receipt.relationship, expected));
-    if (!history.valid || eligible.length !== 1) return rejected(runId, "binding_proof_missing_or_ambiguous");
-    const receipt = eligible[0], destinationGate = expected.from === "QA_REPORT" ? "QA" : expected.from;
-    const destination = control.artefacts.get(destinationGate), source = control.artefacts.get(expected.to);
-    if (destination?.path !== receipt.destination.path || source?.path !== receipt.source.path
-        || !validateBindingProof(root, receipt) || !exactApprovedArtefacts(root, control)) return rejected(runId, "artefact_binding_proof_invalid");
-    const before = canonicalJson(transitionDecisionForRunState(control));
-    let next = appendTableRow(run.content, "Artefact Chain", [expected.from, expected.relationship, expected.to,
-      `binding ${receipt.binding_id}; exact sealed reviewed mapping ${receipt.review.path}`]);
-    if (!next) return rejected(runId, "run_layout_unsupported");
-    const nextRevisionId = randomUUID();
-    next = appendTableRow(next, "Evidence", ["Relationship correction", receipt.review.path,
-      `binding ${receipt.binding_id}; ${expected.from} ${expected.relationship} ${expected.to}; revision ${revisionId} -> ${nextRevisionId}`, "exact sealed reviewed mapping"]);
-    if (!next || canonicalJson(transitionDecisionForRunState(controlFor(root, { ...run, content: next }))) !== before) return rejected(runId, "correction_permission_changed");
-    let written, recoveredCommit = false;
-    try { written = writeRunLocked(run.path, next, revisionId, { expectedContent: run.content, nextRevisionId, checkpoint,
-      validateBeforeWrite: () => {
-        if (!validateBindingProof(root, receipt) || !exactApprovedArtefacts(root, control)
-            || runSealState(root, run.content).status !== "valid") throw new Error("AGDF_ARTEFACT_BINDING_PROOF_INVALID");
-      } }); }
-    catch (error) {
-      const actual = readRun(root, runId);
-      if (actual.rejection || actual.meta.revision_id !== nextRevisionId || runSealState(root, actual.content).status !== "valid") throw error;
-      // Reuse the existing owner's durability confirmation; never retry into another revision.
-      try { confirmCommit(run.path); }
-      catch {
-        const unconfirmed = new Error("AGDF_CORRECTION_COMMIT_UNCONFIRMED");
-        unconfirmed.committed_revision_id = nextRevisionId;
-        throw unconfirmed;
-      }
-      written = { meta: actual.meta }; recoveredCommit = true;
-    }
-    return { schema_version: "1", outcome: "corrected", run_id: runId, binding_id: receipt.binding_id,
-      backlog: "pending", backlog_reason: "run_only_relationship_correction",
-      backlog_next_action: `Synchronize this Run with run-update --run ${runId} --revision ${written.meta.revision_id}.`,
-      relationship: receipt.relationship, previous_revision_id: revisionId, revision_id: written.meta.revision_id, revision: written.meta.revision,
-      ...(recoveredCommit ? { recovered_commit: true } : {}) };
-  }));
-  return locked.rejection ?? locked.state;
-}

package/lib/control-maintenance/interaction.js

@@ -1,28 +0,0 @@
-import { createInterface } from "node:readline/promises";
-import process from "node:process";
-import { interactionLocales } from "#agdf-core/resources/context.js";
-import { selectControlMigration, selectControlRepair } from "#agdf-core/control-maintenance/interaction.js";
-export * from "#agdf-core/control-maintenance/interaction.js";
-export async function promptControlMigration(plan, {
-  input = process.stdin, output = process.stdout, registry = interactionLocales, language = "en",
-} = {}) {
-  const prompt = createInterface({ input, output });
-  try {
-    return await selectControlMigration(plan, { registry, language,
-      write(value) { output.write(`${value}\n`); },
-      readChoice({ prompt: question }) { return prompt.question(question); },
-    });
-  } finally { prompt.close(); }
-}
-
-export async function promptControlRepair(value, {
-  input = process.stdin, output = process.stdout, registry = interactionLocales, language = "en", phase = "offer",
-} = {}) {
-  const prompt = createInterface({ input, output });
-  try {
-    return await selectControlRepair(value, { registry, language, phase,
-      write(text) { output.write(`${text}\n`); },
-      readChoice({ prompt: question }) { return prompt.question(question); },
-    });
-  } finally { prompt.close(); }
-}

package/lib/control-maintenance/repair.js

@@ -1,4 +0,0 @@
-import { inspectControlRepair as inspect, repairInstallationControl as repair } from "#agdf-core/control-maintenance/repair.js";
-import { readGitOriginals } from "../runtime/git-originals.js";
-export const inspectControlRepair = (root, options = {}) => inspect(root, { readGitOriginals, ...options });
-export const repairInstallationControl = (control, options = {}) => repair(control, { readGitOriginals, ...options });

package/lib/control-maintenance/service.js

@@ -1,3 +0,0 @@
-import { runControlMaintenance as run } from "#agdf-core/control-maintenance/service.js";
-import { readGitOriginals } from "../runtime/git-originals.js";
-export const runControlMaintenance = (target, options = {}) => run(target, { readGitOriginals, ...options });

package/lib/control-state/run-recovery.js

@@ -1,5 +0,0 @@
-import { inspectRunRecovery as inspect, previewRunRecovery as preview } from "#agdf-core/control-state/run-recovery.js";
-import { readGitHistory } from "../runtime/git-history.js";
-export { applyRunRecovery, inspectSelfReferenceRecovery } from "#agdf-core/control-state/run-recovery.js";
-export const inspectRunRecovery = (root, runId, options = {}) => inspect(root, runId, { readGitHistory, ...options });
-export const previewRunRecovery = (root, runId, options = {}) => preview(root, runId, { readGitHistory, ...options });

package/lib/install-setup/control-repair.js

@@ -1 +0,0 @@
-export { inspectControlRepair, repairInstallationControl } from "../control-maintenance/repair.js";

package/runtime/core/lib/control-inspect/cockpit-backlog.js

@@ -1,135 +0,0 @@
-import { join } from 'node:path';
-import { createHash } from 'node:crypto';
-import { existsSync, readFileSync } from '../control-read/fs.js';
-import { markdownSection, parseBacklogSection, tableRows, cleanStatusCell, markdownLink, resolvedBacklogLinkTarget } from '../control-evaluation/shared.js';
-import { isSafeControlRelativePath } from '../control-state/contained-file.js';
-import { READ_LIMITS, fail } from '../control-read/snapshot.js';
-import { COCKPIT_BACKLOG_SECTIONS } from './cockpit-list.js';
-import { decodeBacklogMarker, savedBacklogSummary } from '../control-state/backlog-summary.js';
-
-const SOURCE = '.agdf/control/MASTER_BACKLOG.md';
-const decoder = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true });
-const headings = COCKPIT_BACKLOG_SECTIONS;
-const completedHeader = ['key', 'work item', 'status', 'record', 'outcome'];
-const canonicalCompletedHeader = ['key', 'work item', 'final status', 'historical record', 'outcome'];
-
-// A stored pointer projection. It never resolves Runs, evaluates gates or follows links.
-export function projectCockpitBacklog(root) {
-  const path = join(root, SOURCE);
-  if (!existsSync(path)) return { state: 'missing', code: 'backlog_missing', data: null };
-  const bytes = readFileSync(path);
-  if (bytes.length > READ_LIMITS.preview) fail('resource_limit');
-  let source;
-  try { source = decoder.decode(bytes); if (source.includes('\0')) throw Error(); }
-  catch { return { state: 'unsupported', code: 'backlog_unsupported', data: null }; }
-  const entries = [], diagnostics = [], counts = {};
-  const markers = source.split('\n').map(decodeBacklogMarker).filter(Boolean);
-  const diagnostic = (code, section, key = null) => diagnostics.push({ code, path: SOURCE, section, key });
-  for (const section of headings) {
-    const content = markdownSection(source, section), rows = tableRows(content);
-    if (!new RegExp(`^## ${section.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\s*$`, 'm').test(source)) {
-      diagnostic('backlog_section_missing', section); counts[section] = 0; continue;
-    }
-    if (!rows.length) { diagnostic('backlog_layout_missing', section); counts[section] = 0; continue; }
-    const completed = section === headings[2];
-    const normalized = rows[0].map(cell => cell.toLowerCase().trim());
-    let pointers = [];
-    if (completed) {
-      if (![completedHeader.join('|'), canonicalCompletedHeader.join('|')].includes(normalized.join('|'))) {
-        diagnostic('backlog_layout_unsupported', section); counts[section] = 0; continue;
-      }
-    } else {
-      const findings = [];
-      pointers = parseBacklogSection(content, findings, SOURCE);
-      diagnostics.push(...findings.map(row => ({ ...row, section })));
-      if (findings.some(row => row.code === 'AGDF_BACKLOG_LAYOUT_UNKNOWN')) { counts[section] = 0; continue; }
-    }
-    const width = rows[0].length;
-    let pointerIndex = 0;
-    for (const cells of rows.slice(1).filter(row => row.some(Boolean))) {
-      const pointer = completed ? null : pointers[pointerIndex++];
-      const compact = width === 7;
-      const key = cleanStatusCell(cells[completed ? 0 : 1] ?? '');
-      const malformed = cells.length !== width || !key || !(cells[completed ? 1 : 2] ?? '').trim();
-      if (malformed) diagnostic('backlog_row_malformed', section, key);
-      const saved_summary = savedBacklogSummary(root, section, cells, markers);
-      if (saved_summary.code) diagnostic(saved_summary.code, section, key);
-      entries.push({ section, key, original_key: cells[completed ? 0 : 1] ?? '',
-        title: cells[completed ? 1 : 2] ?? '', stored_status: cells[completed ? 2 : 3] ?? '',
-        scope: pointer?.scope ?? '', priority: completed ? null : cells[0] ?? '',
-        stored_next_step: completed ? cells[4] ?? '' : cells[compact ? 6 : 12] ?? '',
-        source_links: completed ? cells[3] ?? '' : compact ? cells[4] ?? '' : cells.slice(4, 11).join(' · '),
-        current_spec: completed ? null : cells[compact ? 5 : 11] ?? '',
-        normalized_pointer: pointer, saved_summary,
-        selectable: !malformed && /^[A-Za-z0-9_-]{1,128}$/.test(key) });
-    }
-    counts[section] = entries.filter(row => row.section === section).length;
-  }
-  const seen = new Map();
-  for (const entry of entries) {
-    if (seen.has(entry.key)) {
-      diagnostic('backlog_key_duplicate', entry.section, entry.key);
-      entry.selectable = false; seen.get(entry.key).selectable = false;
-    } else seen.set(entry.key, entry);
-  }
-  return { state: diagnostics.length ? 'partial' : entries.length ? 'available' : 'empty',
-    code: diagnostics.length ? 'backlog_partial' : null,
-    data: { kind: 'backlog', entries, diagnostics, source_path: SOURCE,
-      content_digest: createHash('sha256').update(bytes).digest('hex'), counts } };
-}
-
-export function backlogUrSource(row) {
-  const paths = new Set();
-  for (const match of `${row.source_links} · ${row.current_spec ?? ''}`.matchAll(/\[UR\]\([^)]+\)/gi)) {
-    const link = markdownLink(match[0]);
-    const path = link && resolvedBacklogLinkTarget(link.target);
-    if (!path || /[%#?\0]/.test(link.target) || !isSafeControlRelativePath(path)
-      || !path.startsWith('.agdf/control/artefacts/') || !/\.md$/i.test(path)) return { path: null, code: 'resource_denied' };
-    paths.add(path);
-  }
-  return paths.size === 1 ? { path: [...paths][0], code: null }
-    : { path: null, code: paths.size ? 'ur_link_ambiguous' : 'ur_link_missing' };
-}
-
-// Passive Markdown heading extraction for list presentation only. No evaluator changes.
-export function backlogUrHeading(content) {
-  let fence = null, comment = false, front = false, previous = '';
-  const lines = content.replace(/^\uFEFF/, '').split(/\r?\n/);
-  for (let i = 0; i < lines.length; i++) {
-    let line = lines[i];
-    if (i === 0 && line.trim() === '---') { front = true; continue; }
-    if (front) { if (/^(---|\.\.\.)\s*$/.test(line)) front = false; continue; }
-    if (comment) { const end = line.indexOf('-->'); if (end < 0) continue; line = line.slice(end + 3); comment = false; }
-    const block = line.match(/^ {0,3}(`{3,}|~{3,})/);
-    if (fence) { if (new RegExp(`^ {0,3}${fence[0]}{${fence.length},}\\s*$`).test(line)) fence = null; continue; }
-    if (block) { fence = block[1]; previous = ''; continue; }
-    while (line.includes('<!--')) {
-      const start = line.indexOf('<!--'), end = line.indexOf('-->', start + 4);
-      if (end < 0) { line = line.slice(0, start); comment = true; previous = ''; break; }
-      line = line.slice(0, start) + line.slice(end + 3);
-    }
-    const atx = line.match(/^ {0,3}#(?:[ \t]+(.*)|$)/);
-    if (atx) return (atx[1] ?? '').replace(/[ \t]+#+[ \t]*$/, '').trim();
-    if (previous && /^ {0,3}=+\s*$/.test(line)) return previous;
-    const paragraph = line.trim() && !/^(?:\s{4}|\t)|^ {0,3}(?:[#>|]|[-+*]\s|\d+[.)]\s|[-*_]{3,}\s*$)/.test(line);
-    previous = paragraph ? (previous ? previous + '\n' : '') + line.trim() : '';
-  }
-  return '';
-}
-
-export function projectBacklogUrTitle(root, view, row, backlogDigest) {
-  const source = backlogUrSource(row);
-  const observation = { state: 'unavailable', code: source.code, path: source.path, heading: null, title: null,
-    content_digest: null, observed_as_of: view.observed_as_of, backlog_digest: backlogDigest };
-  if (!source.path) return observation;
-  const read = view.readOptionalFileSync(join(root, source.path), READ_LIMITS.preview);
-  if (read.code) return { ...observation, code: read.code };
-  let content;
-  try { content = decoder.decode(read.bytes); if (content.includes('\0')) throw Error(); }
-  catch { return { ...observation, code: 'document_unsupported' }; }
-  const heading = backlogUrHeading(content), title = heading.replace(/^UR:\s*/i, '').trim();
-  if (!title) return { ...observation, code: 'ur_heading_missing' };
-  if ([...heading].length > 512 || Buffer.byteLength(heading, 'utf8') > 2048) return { ...observation, code: 'resource_limit' };
-  return { ...observation, state: 'available', code: null, heading, title,
-    content_digest: createHash('sha256').update(read.bytes).digest('hex') };
-}

package/runtime/core/lib/control-maintenance/interaction.js

@@ -1,57 +0,0 @@
-import { interactionLocales } from "../resources/context.js";
-import { localePack } from "../interaction-presentation.js";
-import { renderMaintenanceOffer, renderControlMigrationDecision, renderControlRepairOffer, renderControlRepairPlan } from "./presentation.js";
-
-export async function selectControlMaintenance(control, {
-  readChoice, write = () => {}, registry = interactionLocales, language = "en",
-} = {}) {
-  if (typeof readChoice !== "function") throw new Error("AGDF_MAINTENANCE_INTERACTION_REQUIRED");
-  const copy = localePack(registry, language).repositoryMaintenance;
-  write(renderMaintenanceOffer(control, { registry, language }));
-  while (true) {
-    let raw;
-    try { raw = await readChoice({ prompt: copy.prompt, default: null }); } catch { return "skip"; }
-    const choice = typeof raw === "string" ? raw.trim().toLowerCase() : "";
-    if (!choice || ["2", "skip", "later"].includes(choice)) return "skip";
-    if (["1", "start"].includes(choice)) return "start";
-    if (["3", "d", "details"].includes(choice)) write(renderMaintenanceOffer(control, { registry, language, details: true }));
-    else write(copy.invalid);
-  }
-}
-
-export async function selectControlMigration(plan, {
-  readChoice, write = () => {}, registry = interactionLocales, language = "en",
-} = {}) {
-  if (typeof readChoice !== "function") throw new Error("AGDF_CONTROL_MIGRATION_READER_REQUIRED");
-  const copy = localePack(registry, language).installSetup.controlMigration;
-  write(renderControlMigrationDecision(plan, { registry, language }));
-  while (true) {
-    let value;
-    try { value = await readChoice({ prompt: copy.batchPrompt, default: null }); } catch { return "skip"; }
-    const choice = typeof value === "string" ? value.trim().toLowerCase() : "";
-    if (!choice || ["2", "skip", "later"].includes(choice)) return "skip";
-    if (["1", "migrate"].includes(choice)) return "migrate";
-    if (["3", "d", "details"].includes(choice)) write(renderControlMigrationDecision(plan, { registry, language, details: true }));
-    else write(copy.invalidChoice);
-  }
-}
-
-export async function selectControlRepair(value, {
-  readChoice, write = () => {}, registry = interactionLocales, language = "en", phase = "offer",
-} = {}) {
-  if (typeof readChoice !== "function") throw new Error("AGDF_CONTROL_REPAIR_READER_REQUIRED");
-  if (!["offer", "plan"].includes(phase)) throw new Error("AGDF_CONTROL_REPAIR_PHASE_INVALID");
-  const copy = localePack(registry, language).installSetup.controlRepair;
-  const render = phase === "offer" ? renderControlRepairOffer : renderControlRepairPlan;
-  write(render(value, { registry, language }));
-  while (true) {
-    let raw;
-    try { raw = await readChoice({ prompt: copy.prompt, default: null }); } catch { return "skip"; }
-    const choice = typeof raw === "string" ? raw.trim().toLowerCase() : "";
-    if (!choice || ["2", "skip", "later"].includes(choice)) return "skip";
-    if (choice === "1" && (phase === "offer" || value.items.some((item) => item.available))) return phase === "offer" ? "start" : "repair";
-    if (["3", "d", "details"].includes(choice)) write(render(value, { registry, language, details: true }));
-    else write(copy.invalidChoice);
-  }
-}
-