gsd-pi 2.74.0-dev.2b524c3 → 2.74.0-dev.703eabc

package/dist/resources/extensions/gsd/uok/gate-runner.js

@@ -0,0 +1,109 @@
+import { insertGateRun } from "../gsd-db.js";
+import { buildAuditEnvelope, emitUokAuditEvent } from "./audit.js";
+const RETRY_MATRIX = {
+    none: 0,
+    policy: 0,
+    input: 0,
+    execution: 1,
+    artifact: 1,
+    verification: 1,
+    closeout: 1,
+    git: 1,
+    timeout: 2,
+    "manual-attention": 0,
+    unknown: 0,
+};
+export class UokGateRunner {
+    registry = new Map();
+    register(gate) {
+        this.registry.set(gate.id, gate);
+    }
+    list() {
+        return Array.from(this.registry.values());
+    }
+    async run(id, ctx) {
+        const gate = this.registry.get(id);
+        if (!gate) {
+            return {
+                gateId: id,
+                gateType: "unknown",
+                outcome: "manual-attention",
+                failureClass: "unknown",
+                rationale: `Gate ${id} not registered`,
+                attempt: 1,
+                maxAttempts: 1,
+                retryable: false,
+                evaluatedAt: new Date().toISOString(),
+            };
+        }
+        let attempt = 0;
+        let final = null;
+        const maxAttemptsByFailureClass = RETRY_MATRIX;
+        while (attempt < 3) {
+            attempt += 1;
+            const now = new Date().toISOString();
+            const result = await gate.execute(ctx, attempt);
+            const failureClass = result.failureClass ?? (result.outcome === "pass" ? "none" : "unknown");
+            const retryBudget = maxAttemptsByFailureClass[failureClass] ?? 0;
+            const retryable = result.outcome !== "pass" && attempt <= retryBudget;
+            final = {
+                gateId: gate.id,
+                gateType: gate.type,
+                outcome: retryable ? "retry" : result.outcome,
+                failureClass,
+                rationale: result.rationale,
+                findings: result.findings,
+                attempt,
+                maxAttempts: Math.max(1, retryBudget),
+                retryable,
+                evaluatedAt: now,
+            };
+            insertGateRun({
+                traceId: ctx.traceId,
+                turnId: ctx.turnId,
+                gateId: final.gateId,
+                gateType: final.gateType,
+                unitType: ctx.unitType,
+                unitId: ctx.unitId,
+                milestoneId: ctx.milestoneId,
+                sliceId: ctx.sliceId,
+                taskId: ctx.taskId,
+                outcome: final.outcome,
+                failureClass: final.failureClass,
+                rationale: final.rationale,
+                findings: final.findings,
+                attempt: final.attempt,
+                maxAttempts: final.maxAttempts,
+                retryable: final.retryable,
+                evaluatedAt: final.evaluatedAt,
+            });
+            emitUokAuditEvent(ctx.basePath, buildAuditEnvelope({
+                traceId: ctx.traceId,
+                turnId: ctx.turnId,
+                category: "gate",
+                type: "gate-run",
+                payload: {
+                    gateId: final.gateId,
+                    gateType: final.gateType,
+                    outcome: final.outcome,
+                    failureClass: final.failureClass,
+                    attempt: final.attempt,
+                    maxAttempts: final.maxAttempts,
+                    retryable: final.retryable,
+                },
+            }));
+            if (!retryable)
+                break;
+        }
+        return final ?? {
+            gateId: gate.id,
+            gateType: gate.type,
+            outcome: "manual-attention",
+            failureClass: "unknown",
+            attempt: 1,
+            maxAttempts: 1,
+            retryable: false,
+            evaluatedAt: new Date().toISOString(),
+        };
+    }
+}

package/dist/resources/extensions/gsd/uok/gitops.js

@@ -0,0 +1,53 @@
+import { isDbAvailable, upsertTurnGitTransaction } from "../gsd-db.js";
+import { buildAuditEnvelope, emitUokAuditEvent } from "./audit.js";
+export function writeTurnGitTransaction(args) {
+    if (!isDbAvailable())
+        return;
+    upsertTurnGitTransaction({
+        traceId: args.traceId,
+        turnId: args.turnId,
+        unitType: args.unitType,
+        unitId: args.unitId,
+        stage: args.stage,
+        action: args.action,
+        push: args.push,
+        status: args.status,
+        error: args.error,
+        metadata: args.metadata,
+        updatedAt: new Date().toISOString(),
+    });
+    emitUokAuditEvent(args.basePath, buildAuditEnvelope({
+        traceId: args.traceId,
+        turnId: args.turnId,
+        category: "gitops",
+        type: `turn-git-${args.stage}`,
+        payload: {
+            unitType: args.unitType,
+            unitId: args.unitId,
+            action: args.action,
+            push: args.push,
+            status: args.status,
+            error: args.error,
+            ...(args.metadata ?? {}),
+        },
+    }));
+}
+export function writeTurnCloseoutGitRecord(basePath, record) {
+    writeTurnGitTransaction({
+        basePath,
+        traceId: record.traceId,
+        turnId: record.turnId,
+        unitType: record.unitType,
+        unitId: record.unitId,
+        stage: "record",
+        action: record.gitAction,
+        push: record.gitPushed,
+        status: record.failureClass === "git" ? "failed" : "ok",
+        error: record.failureClass === "git" ? "git closeout failure" : undefined,
+        metadata: {
+            turnStatus: record.status,
+            finishedAt: record.finishedAt,
+            activityFile: record.activityFile,
+        },
+    });
+}

package/dist/resources/extensions/gsd/uok/kernel.js

@@ -0,0 +1,80 @@
+import { appendFileSync, mkdirSync } from "node:fs";
+import { join } from "node:path";
+import { gsdRoot } from "../paths.js";
+import { buildAuditEnvelope, emitUokAuditEvent } from "./audit.js";
+import { setUnifiedAuditEnabled } from "./audit-toggle.js";
+import { resolveUokFlags } from "./flags.js";
+import { createTurnObserver } from "./loop-adapter.js";
+function parityLogPath(basePath) {
+    return join(gsdRoot(basePath), "runtime", "uok-parity.jsonl");
+}
+function writeParityEvent(basePath, event) {
+    try {
+        mkdirSync(join(gsdRoot(basePath), "runtime"), { recursive: true });
+        appendFileSync(parityLogPath(basePath), `${JSON.stringify(event)}\n`, "utf-8");
+    }
+    catch {
+        // parity telemetry must never block orchestration
+    }
+}
+function resolveKernelPathLabel(flags) {
+    if (flags.legacyFallback)
+        return "legacy-fallback";
+    return flags.enabled ? "uok-wrapper" : "legacy-wrapper";
+}
+export async function runAutoLoopWithUok(args) {
+    const { ctx, pi, s, deps, runLegacyLoop } = args;
+    const prefs = deps.loadEffectiveGSDPreferences()?.preferences;
+    const flags = resolveUokFlags(prefs);
+    setUnifiedAuditEnabled(flags.auditUnified);
+    writeParityEvent(s.basePath, {
+        ts: new Date().toISOString(),
+        path: resolveKernelPathLabel(flags),
+        flags,
+        phase: "enter",
+    });
+    if (flags.auditUnified) {
+        emitUokAuditEvent(s.basePath, buildAuditEnvelope({
+            traceId: `session:${String(s.autoStartTime || Date.now())}`,
+            category: "orchestration",
+            type: "uok-kernel-enter",
+            payload: {
+                flags,
+                sessionId: ctx.sessionManager?.getSessionId?.(),
+            },
+        }));
+    }
+    const decoratedDeps = flags.enabled
+        ? {
+            ...deps,
+            uokObserver: createTurnObserver({
+                basePath: s.basePath,
+                gitAction: flags.gitopsTurnAction,
+                gitPush: flags.gitopsTurnPush,
+                enableAudit: flags.auditUnified,
+                enableGitops: flags.gitops,
+            }),
+        }
+        : deps;
+    try {
+        await runLegacyLoop(ctx, pi, s, decoratedDeps);
+        writeParityEvent(s.basePath, {
+            ts: new Date().toISOString(),
+            path: resolveKernelPathLabel(flags),
+            flags,
+            phase: "exit",
+            status: "ok",
+        });
+    }
+    catch (err) {
+        writeParityEvent(s.basePath, {
+            ts: new Date().toISOString(),
+            path: resolveKernelPathLabel(flags),
+            flags,
+            phase: "exit",
+            status: "error",
+            error: err instanceof Error ? err.message : String(err),
+        });
+        throw err;
+    }
+}

package/dist/resources/extensions/gsd/uok/loop-adapter.js

@@ -0,0 +1,133 @@
+import { buildAuditEnvelope, emitUokAuditEvent } from "./audit.js";
+import { writeTurnCloseoutGitRecord, writeTurnGitTransaction } from "./gitops.js";
+export function createTurnObserver(options) {
+    let current = null;
+    const phaseResults = [];
+    return {
+        onTurnStart(contract) {
+            current = contract;
+            phaseResults.length = 0;
+            if (options.enableGitops) {
+                writeTurnGitTransaction({
+                    basePath: options.basePath,
+                    traceId: contract.traceId,
+                    turnId: contract.turnId,
+                    unitType: contract.unitType,
+                    unitId: contract.unitId,
+                    stage: "turn-start",
+                    action: options.gitAction,
+                    push: options.gitPush,
+                    status: "ok",
+                    metadata: {
+                        iteration: contract.iteration,
+                        sidecarKind: contract.sidecarKind,
+                    },
+                });
+            }
+            if (options.enableAudit) {
+                emitUokAuditEvent(options.basePath, buildAuditEnvelope({
+                    traceId: contract.traceId,
+                    turnId: contract.turnId,
+                    category: "orchestration",
+                    type: "turn-start",
+                    payload: {
+                        iteration: contract.iteration,
+                        unitType: contract.unitType,
+                        unitId: contract.unitId,
+                        sidecarKind: contract.sidecarKind,
+                    },
+                }));
+            }
+        },
+        onPhaseResult(phase, action, data) {
+            phaseResults.push({
+                phase,
+                action,
+                ts: new Date().toISOString(),
+                data,
+            });
+            if (!current || !options.enableGitops)
+                return;
+            if (phase === "dispatch") {
+                writeTurnGitTransaction({
+                    basePath: options.basePath,
+                    traceId: current.traceId,
+                    turnId: current.turnId,
+                    unitType: data?.unitType,
+                    unitId: data?.unitId,
+                    stage: "stage",
+                    action: options.gitAction,
+                    push: options.gitPush,
+                    status: "ok",
+                    metadata: { action },
+                });
+            }
+            if (phase === "unit") {
+                writeTurnGitTransaction({
+                    basePath: options.basePath,
+                    traceId: current.traceId,
+                    turnId: current.turnId,
+                    unitType: data?.unitType,
+                    unitId: data?.unitId,
+                    stage: "checkpoint",
+                    action: options.gitAction,
+                    push: options.gitPush,
+                    status: "ok",
+                    metadata: { action },
+                });
+            }
+            if (phase === "finalize") {
+                writeTurnGitTransaction({
+                    basePath: options.basePath,
+                    traceId: current.traceId,
+                    turnId: current.turnId,
+                    unitType: data?.unitType,
+                    unitId: data?.unitId,
+                    stage: "publish",
+                    action: options.gitAction,
+                    push: options.gitPush,
+                    status: "ok",
+                    metadata: { action },
+                });
+            }
+        },
+        onTurnResult(result) {
+            const merged = {
+                ...result,
+                phaseResults: result.phaseResults.length > 0 ? result.phaseResults : [...phaseResults],
+            };
+            if (options.enableAudit) {
+                emitUokAuditEvent(options.basePath, buildAuditEnvelope({
+                    traceId: merged.traceId,
+                    turnId: merged.turnId,
+                    category: "orchestration",
+                    type: "turn-result",
+                    payload: {
+                        unitType: merged.unitType,
+                        unitId: merged.unitId,
+                        status: merged.status,
+                        failureClass: merged.failureClass,
+                        error: merged.error,
+                        phaseCount: merged.phaseResults.length,
+                    },
+                }));
+            }
+            if (options.enableGitops) {
+                const closeout = merged.closeout ?? {
+                    traceId: merged.traceId,
+                    turnId: merged.turnId,
+                    unitType: merged.unitType,
+                    unitId: merged.unitId,
+                    status: merged.status,
+                    failureClass: merged.failureClass,
+                    gitAction: options.gitAction,
+                    gitPushed: options.gitPush,
+                    finishedAt: merged.finishedAt,
+                };
+                writeTurnCloseoutGitRecord(options.basePath, closeout);
+            }
+            current = null;
+            phaseResults.length = 0;
+        },
+    };
+}

package/dist/resources/extensions/gsd/uok/model-policy.js

@@ -0,0 +1,66 @@
+import { computeTaskRequirements, filterToolsForProvider } from "../model-router.js";
+import { buildAuditEnvelope, emitUokAuditEvent } from "./audit.js";
+export function buildRequirementVector(unitType, taskMetadata) {
+    if (!unitType)
+        return {};
+    return computeTaskRequirements(unitType, taskMetadata);
+}
+export function applyModelPolicyFilter(candidates, options) {
+    const requiredTools = options.requiredTools ?? [];
+    const deniedProviders = new Set((options.deniedProviders ?? []).map((p) => p.toLowerCase()));
+    const allowedApis = options.allowedApis ? new Set(options.allowedApis) : null;
+    const requirements = buildRequirementVector(options.unitType, options.taskMetadata);
+    const decisions = [];
+    const eligible = [];
+    for (const model of candidates) {
+        let allowed = true;
+        let reason = "allowed";
+        if (options.allowCrossProvider === false && options.currentProvider && model.provider !== options.currentProvider) {
+            allowed = false;
+            reason = `cross-provider routing disabled (${model.provider} != ${options.currentProvider})`;
+        }
+        if (allowed && deniedProviders.has(model.provider.toLowerCase())) {
+            allowed = false;
+            reason = `provider denied by policy: ${model.provider}`;
+        }
+        if (allowed && allowedApis && !allowedApis.has(model.api)) {
+            allowed = false;
+            reason = `transport/api denied by policy: ${model.api}`;
+        }
+        if (allowed && requiredTools.length > 0) {
+            const compatibility = filterToolsForProvider(requiredTools, model.api);
+            if (compatibility.filtered.length > 0) {
+                allowed = false;
+                reason = `tool policy denied (${compatibility.filtered.join(", ")}) for ${model.api}`;
+            }
+        }
+        const decision = {
+            modelId: model.id,
+            provider: model.provider,
+            allowed,
+            reason,
+        };
+        decisions.push(decision);
+        emitUokAuditEvent(options.basePath, buildAuditEnvelope({
+            traceId: options.traceId,
+            turnId: options.turnId,
+            category: "model-policy",
+            type: allowed ? "model-policy-allow" : "model-policy-deny",
+            payload: {
+                modelId: model.id,
+                provider: model.provider,
+                api: model.api,
+                reason,
+                unitType: options.unitType,
+                requirements,
+            },
+        }));
+        if (allowed)
+            eligible.push(model);
+    }
+    return {
+        eligible,
+        decisions,
+        requirements,
+    };
+}

package/dist/resources/extensions/gsd/uok/plan-v2.js

@@ -0,0 +1,132 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { gsdRoot, resolveMilestoneFile, resolveSliceFile } from "../paths.js";
+import { isDbAvailable, getMilestoneSlices, getSliceTasks } from "../gsd-db.js";
+const PLAN_V2_CLARIFY_ROUND_LIMIT = 3;
+const EXECUTION_ENTRY_PHASES = new Set([
+    "executing",
+    "summarizing",
+    "validating-milestone",
+    "completing-milestone",
+]);
+function graphOutputPath(basePath) {
+    return join(gsdRoot(basePath), "runtime", "uok-plan-v2-graph.json");
+}
+function hasFileContent(path) {
+    if (!path || !existsSync(path))
+        return false;
+    try {
+        return readFileSync(path, "utf-8").trim().length > 0;
+    }
+    catch {
+        return false;
+    }
+}
+function countSliceResearchArtifacts(basePath, milestoneId, slices) {
+    let count = 0;
+    for (const slice of slices) {
+        if (hasFileContent(resolveSliceFile(basePath, milestoneId, slice.id, "RESEARCH"))) {
+            count += 1;
+        }
+    }
+    return count;
+}
+function isExecutionEntryPhase(phase) {
+    return EXECUTION_ENTRY_PHASES.has(phase);
+}
+export function compileUnitGraphFromState(basePath, state) {
+    const mid = state.activeMilestone?.id;
+    if (!mid)
+        return { ok: false, reason: "no active milestone" };
+    if (!isDbAvailable())
+        return { ok: false, reason: "database not available" };
+    const slices = getMilestoneSlices(mid).sort((a, b) => Number(a.sequence ?? 0) - Number(b.sequence ?? 0));
+    const nodes = [];
+    const clarifyRoundLimit = PLAN_V2_CLARIFY_ROUND_LIMIT;
+    const draftContextIncluded = hasFileContent(resolveMilestoneFile(basePath, mid, "CONTEXT-DRAFT"));
+    const finalizedContextIncluded = hasFileContent(resolveMilestoneFile(basePath, mid, "CONTEXT"));
+    const researchSynthesized = hasFileContent(resolveMilestoneFile(basePath, mid, "RESEARCH"))
+        || countSliceResearchArtifacts(basePath, mid, slices) > 0;
+    if (isExecutionEntryPhase(state.phase) && !finalizedContextIncluded) {
+        const reason = draftContextIncluded
+            ? "milestone context draft exists but finalized CONTEXT.md is missing"
+            : "missing milestone CONTEXT.md";
+        return {
+            ok: false,
+            reason,
+            clarifyRoundLimit,
+            researchSynthesized,
+            draftContextIncluded,
+            finalizedContextIncluded,
+        };
+    }
+    for (const slice of slices) {
+        const sid = slice.id;
+        const tasks = getSliceTasks(mid, sid)
+            .sort((a, b) => Number(a.sequence ?? 0) - Number(b.sequence ?? 0));
+        let previousTaskNodeId = null;
+        for (const task of tasks) {
+            const nodeId = `execute-task:${mid}:${sid}:${task.id}`;
+            const dependsOn = previousTaskNodeId ? [previousTaskNodeId] : [];
+            nodes.push({
+                id: nodeId,
+                kind: "unit",
+                dependsOn,
+                writes: task.key_files,
+                metadata: {
+                    unitType: "execute-task",
+                    unitId: `${mid}.${sid}.${task.id}`,
+                    title: task.title,
+                    status: task.status,
+                },
+            });
+            previousTaskNodeId = nodeId;
+        }
+        if (previousTaskNodeId) {
+            nodes.push({
+                id: `complete-slice:${mid}:${sid}`,
+                kind: "verification",
+                dependsOn: [previousTaskNodeId],
+                metadata: {
+                    unitType: "complete-slice",
+                    unitId: `${mid}.${sid}`,
+                    title: slice.title,
+                    status: slice.status,
+                },
+            });
+        }
+    }
+    const output = {
+        compiledAt: new Date().toISOString(),
+        milestoneId: mid,
+        pipeline: {
+            clarifyRoundLimit,
+            researchSynthesized,
+            draftContextIncluded,
+            finalizedContextIncluded,
+            sourcePhase: state.phase,
+        },
+        nodes,
+    };
+    const outPath = graphOutputPath(basePath);
+    mkdirSync(join(gsdRoot(basePath), "runtime"), { recursive: true });
+    writeFileSync(outPath, JSON.stringify(output, null, 2) + "\n", "utf-8");
+    return {
+        ok: true,
+        graphPath: outPath,
+        nodeCount: nodes.length,
+        clarifyRoundLimit,
+        researchSynthesized: output.pipeline.researchSynthesized,
+        draftContextIncluded: output.pipeline.draftContextIncluded,
+        finalizedContextIncluded: output.pipeline.finalizedContextIncluded,
+    };
+}
+export function ensurePlanV2Graph(basePath, state) {
+    const compiled = compileUnitGraphFromState(basePath, state);
+    if (!compiled.ok)
+        return compiled;
+    if ((compiled.nodeCount ?? 0) <= 0) {
+        return { ok: false, reason: "compiled graph is empty" };
+    }
+    return compiled;
+}

package/dist/resources/extensions/gsd/workflow-logger.js

@@ -18,6 +18,8 @@
 import { appendFileSync, readFileSync, existsSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
 import { appendNotification } from "./notification-store.js";
+import { buildAuditEnvelope, emitUokAuditEvent } from "./uok/audit.js";
+import { isUnifiedAuditEnabled } from "./uok/audit-toggle.js";
 // ─── Buffer & Persistent Audit ──────────────────────────────────────────
 const MAX_BUFFER = 100;
 let _buffer = [];
@@ -202,6 +204,26 @@ function _push(severity, component, message, context) {
     if (_buffer.length > MAX_BUFFER) {
         _buffer.shift();
     }
+    if (_auditBasePath && isUnifiedAuditEnabled()) {
+        try {
+            emitUokAuditEvent(_auditBasePath, buildAuditEnvelope({
+                traceId: `workflow-log:${component}`,
+                turnId: context?.id,
+                causedBy: context?.fn ?? context?.tool,
+                category: "orchestration",
+                type: severity === "error" ? "workflow-log-error" : "workflow-log-warn",
+                payload: {
+                    component,
+                    message,
+                    context: context ?? {},
+                },
+            }));
+        }
+        catch (auditEmitErr) {
+            // Best-effort: unified audit projection must never block workflow logger.
+            _writeStderr(`[gsd:workflow-logger] unified-audit emit failed: ${auditEmitErr.message}\n`);
+        }
+    }
     // Persist errors to .gsd/audit-log.jsonl so they survive context resets.
     // Only error-severity entries are persisted — warnings are ephemeral (stderr + buffer)
     // to avoid log amplification from expected-control-flow catch paths.