done-done-axi 0.6.19 → 0.6.20

package/README.md

@@ -48,12 +48,12 @@ Commit `.done-done.yaml` and the verify skill so later runs and your teammates u
 Installing done-done from another installer (a fleet bootstrap, a Juggernaut-style one-command install) takes three calls and no prompts. Pin the version:
 
 ```sh
-npm install -g done-done-axi@0.6.19
+npm install -g done-done-axi@0.6.20
 done-done init --no-skill --agent <agent> --model <model> --judge <route> --judge-model <model>
 done-done doctor --setup --json
 ```
 
-- `done-done --version` prints the installed version (here `0.6.19`); check it before anything else.
+- `done-done --version` prints the installed version (here `0.6.20`); check it before anything else.
 - `init --no-skill` writes `.done-done.yaml` and the global `~/.done-done/config.yaml`, and starts no agent: it skips the verify skill, so it spends nothing and asks nothing. `<route>` is `answerer:<agent>` or a bare agent name. Exit `0` when the agent is set and the config is valid, `2` when it is not.
 - `doctor --setup --json` is install health: exit `0` when git, the config, the evidence root, the agent and the judge are ok, `2` when one of them is not. The verify skill and the journey rows are warnings, so a fresh install passes.
 - Exit codes: `0` pass, `2` usage or config error ([all codes](docs/reference.md#exit-codes)).

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { execFileSync, spawn, spawnSync } from 'node:child_process';
 import { createHash, randomBytes } from 'node:crypto';
-import { accessSync, appendFileSync, closeSync, constants, cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readdirSync, readFileSync, realpathSync, renameSync, rmdirSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { accessSync, appendFileSync, closeSync, constants, copyFileSync, cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readdirSync, readFileSync, realpathSync, renameSync, rmdirSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { homedir, tmpdir, userInfo } from 'node:os';
 import { basename, dirname, isAbsolute, join, matchesGlob, relative, resolve, sep } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
@@ -505,6 +505,31 @@ function writeRecord(cfg, rec) {
 }
 // The random suffix keeps two runs in the same second at one commit apart; mkdir without recursive refuses a reused id.
 const newRunId = (commit) => `${new Date().toISOString().replace(/[-:]/g, '').replace(/\.\d+Z$/, 'Z')}-${commit.slice(0, 8)}-${randomBytes(3).toString('hex')}`;
+// A passing check seals the evidence it accepted that no run at this commit holds, so a proof made by `check` alone leaves a run
+// record at HEAD (exit 0, byte-for-byte copies, hashes). Its command names the seal, so it is never taken for a command that ran;
+// it keeps the step record of the run it copies from, so a later check that ties to it passes the same rules.
+function sealEvidence(repo, cfg, items) {
+    const rec = openRun(repo, cfg, null, 'check (sealed)');
+    const names = new Set();
+    rec.files = items.map(({ path }) => {
+        let name = basename(path);
+        for (let n = 2; names.has(name); n++)
+            name = `${n}-${basename(path)}`;
+        names.add(name);
+        copyFileSync(path, join(runDir(cfg, rec.run_id), name));
+        const b = readFileSync(join(runDir(cfg, rec.run_id), name));
+        return { path: join(rec.run_id, name), sha256: sha256(b), bytes: b.length };
+    });
+    const from = items.find((i) => i.source.steps || i.source.steps_error)?.source;
+    if (from?.steps)
+        rec.steps = from.steps;
+    if (from?.steps_error)
+        rec.steps_error = from.steps_error;
+    rec.ended_at = new Date().toISOString();
+    rec.exit = 0;
+    writeRecord(cfg, rec);
+    return `${rec.run_id} (${shown(repo, join(recordsDir(cfg), `${rec.run_id}.json`))})`;
+}
 function openRun(repo, cfg, journey, command, id) {
     const h = head(repo);
     const runId = id ?? newRunId(h.commit);
@@ -825,6 +850,8 @@ async function runCheck(argv, run) {
     const seen = new Map();
     const hashes = [];
     const cited = [];
+    // Cited files no run at this commit holds yet: a pass seals them (sealEvidence), so a check-only proof leaves a run record at HEAD.
+    const unsealed = [];
     const captures = [];
     // The run behind each cited capture, for the real-product rule and the receipt.
     const runs = new Map();
@@ -907,6 +934,8 @@ async function runCheck(argv, run) {
             continue;
         }
         const rec = (atNow.length ? atNow : claims).reduce((a, b) => (b.started_at > a.started_at ? b : a));
+        if (!byHash.some((r) => r.commit === now.commit && r.exit === 0))
+            unsealed.push({ path, source: rec });
         runs.set(rec.run_id, { run_id: rec.run_id, commit: rec.commit, journey: rec.journey, command: rec.command, ...(rec.feature && { feature: rec.feature }), ...(rec.tool && { tool: rec.tool }), ...(rec.steps && { steps: rec.steps }), ...(rec.steps_error && { steps_error: rec.steps_error }) });
         // Only a capture tied to a run record can reach the judge, so a stray cited file is never sent.
         const c = { name, bytes, sha256: hash, media: v };
@@ -1107,6 +1136,12 @@ async function runCheck(argv, run) {
     if (rep.code === PASS) {
         mkdirSync(dirname(ledger), { recursive: true });
         appendFileSync(ledger, hashes.filter((h) => !used.get(h)?.has(claimId)).map((h) => `${h} ${claimId}\n`).join(''));
+        if (unsealed.length) {
+            if (now.dirty)
+                rep.result.not_sealed = 'the tree has uncommitted changes, so a run record at this commit would not be clean proof; commit, then check again to seal the evidence';
+            else
+                rep.result.sealed = sealEvidence(repo, cfg, unsealed);
+        }
     }
     return { code: rep.code, result: rep.result, judge: judged, judgeBlock, claim: claim?.outcome, skill: claim?.skill, files, cited, runs: [...runs.values()], head: now, findings, warnings, ...(evals && { evals }) };
 }

package/docs/reference.md

@@ -462,6 +462,8 @@ A plain check is never a verdict on its own. A cited file that fails one of thes
 
 Files that are in no run record give an inconclusive result when another cited capture is one the judge reads: nothing ties them to a commit. So does a file that more than one run record claims when none of those runs is at the current commit (possible only with records from before each run had its own folder). A file ties to a run by its bytes: a sealed or renamed copy of a file a run wrote, cited outside the evidence root or at another path inside it, is that run's evidence, and the record's own path for those bytes picks the run when several wrote them. Byte-identical captures from several runs are fine when one of those runs is at the current commit: that run ties the file to the commit. A file whose path is named in a run record but whose bytes no longer match fails as `changed after run <run-id>` (exit 2, before the judge), not inconclusive: the path ties it to that run, so editing it after the run is tampering, not untied evidence.
 
+A passing `check` seals the evidence it accepted, so a proof made by `check` alone leaves a run record at its commit: when a cited file is in no run record at HEAD with `exit: 0` (it ties to a run at an earlier commit, for example after a docs-only change), the pass copies each such file byte for byte into a new run folder and writes a schema 1 record at HEAD with `exit: 0`, `dirty: false`, the files with their sha256 and bytes, `tool` and the step record of the run it copied from, and the command `check (sealed)`, which names the seal so it is never taken for a command that ran. The result names it as `sealed: <run id> (<record path>)`. Nothing is sealed on a fail or an inconclusive result, on a dirty tree (the result says so in `not_sealed`), or when every cited file already ties to a run at HEAD with `exit: 0`; a second pass at the same head finds the seal and writes no second record. The record is never a pass by itself: only a check's verdict is, and how `check` ties files and what it reports are unchanged.
+
 A config whose journeys are all code-only, or cited captures that all come from code-only runs, stop the check the same way, before the judge, naming the journeys ([Real-product evidence](#real-product-evidence)). So does a claim whose cited runs have no well-formed step record ([Step record](#step-record)).
 
 `evidence: not proven: <cause>` stops the check before its judge is asked, always: exit 2, no result, no receipt. `checks.not_proven` is gone: a config that still sets it is a config error (exit 2) that says to delete the line.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "done-done-axi",
-  "version": "0.6.19",
+  "version": "0.6.20",
   "license": "Apache-2.0",
   "description": "Prove your app really works: done-done drives your app the way a user does, a fresh judge checks every capture, and the proof is tied to a commit.",
   "type": "module",