harnery 0.37.0 → 0.38.0

package/src/core/diagnostics/bundle.ts

@@ -8,16 +8,20 @@ import {
   realpathSync,
 } from "node:fs";
 import { dirname, join, resolve, sep } from "node:path";
-import type { ArtifactActor, ArtifactInventoryEntry } from "../artifacts/index.ts";
+import type {
+  ArtifactActor,
+  ArtifactInventoryEntry,
+  ArtifactManifestV2,
+} from "../artifacts/index.ts";
 import {
   ARTIFACT_MANIFEST,
   artifactsRoot,
   configuredArtifactRetentionDays,
   createArtifact,
   inventoryArtifacts,
+  parseArtifactManifest,
   releaseArtifact,
   resolveArtifactRef,
-  showArtifact,
 } from "../artifacts/index.ts";
 import { currentHarneryRuntimeBuild } from "../events/v3/runtime-build.ts";
 import { writePrivateJsonAtomic } from "../storage/atomic-json.ts";
@@ -104,6 +108,17 @@ export interface DiagnosticBundleListRow {
   error?: string;
 }
 
+export interface DiagnosticBundleCandidateRow {
+  artifact_id: string;
+  created_at: string;
+  expires_at: string | null;
+  classification: ArtifactInventoryEntry["classification"];
+  selectable: boolean;
+  captured_at?: string;
+  finding_id?: string;
+  error?: string;
+}
+
 export function captureDiagnosticBundle(
   repoRootRaw: string,
   input: CaptureDiagnosticBundleInput = {},
@@ -210,10 +225,10 @@ export function captureDiagnosticBundle(
   return { path: created.path, manifest, summary };
 }
 
-export function validateDiagnosticBundle(
+function openDiagnosticBundleManifest(
   repoRootRaw: string,
   ref: string,
-): ValidatedDiagnosticBundle {
+): { artifactPath: string; manifest: DiagnosticBundleManifest } {
   const repoRoot = resolve(repoRootRaw);
   const artifactPath = resolveArtifactRef(repoRoot, ref);
   const managedRoot = realpathSync(artifactsRoot(repoRoot));
@@ -225,21 +240,28 @@ export function validateDiagnosticBundle(
     throw new Error("diagnostic bundle is outside the managed artifact root");
   }
   assertBundleTree(artifactPath);
-  const shown = showArtifact(repoRoot, artifactPath);
+  const artifactManifest = readCandidateArtifactManifest(artifactPath);
+  const classification = candidateClassification(artifactManifest);
   if (
     !["managed-active", "managed-current", "managed-expired", "managed-tracked"].includes(
-      shown.entry.classification,
+      classification,
     )
   ) {
-    throw new Error(
-      `diagnostic bundle has invalid managed classification ${shown.entry.classification}`,
-    );
+    throw new Error(`diagnostic bundle has invalid managed classification ${classification}`);
   }
-  if (shown.manifest.slug !== "diagnostic-bundle") {
+  if (artifactManifest.slug !== "diagnostic-bundle") {
     throw new Error("artifact is not a diagnostic bundle");
   }
   const manifest = readJson<DiagnosticBundleManifest>(artifactPath, "diagnostic-manifest.json");
-  validateManifest(manifest, shown.manifest.artifact_id);
+  validateManifest(manifest, artifactManifest.artifact_id);
+  return { artifactPath, manifest };
+}
+
+export function validateDiagnosticBundle(
+  repoRootRaw: string,
+  ref: string,
+): ValidatedDiagnosticBundle {
+  const { artifactPath, manifest } = openDiagnosticBundleManifest(repoRootRaw, ref);
   let totalBytes = 0;
   for (const file of manifest.files) {
     const bytes = readValidatedFile(artifactPath, file.path);
@@ -305,6 +327,92 @@ export function listDiagnosticBundles(repoRoot: string): DiagnosticBundleListRow
     });
 }
 
+/**
+ * Lists managed bundle candidates without opening their bounded payloads.
+ * Selection is not authority: every show, replay, and comparison operation
+ * still performs complete digest and schema validation before returning data.
+ */
+export function listDiagnosticBundleCandidates(repoRoot: string): DiagnosticBundleCandidateRow[] {
+  const root = artifactsRoot(repoRoot);
+  if (!existsSync(root)) return [];
+  const rows: DiagnosticBundleCandidateRow[] = [];
+  for (const name of readdirSync(root).sort()) {
+    const artifactPath = join(root, name);
+    let artifactManifest: ArtifactManifestV2;
+    try {
+      const stat = lstatSync(artifactPath);
+      if (!stat.isDirectory() || stat.isSymbolicLink()) continue;
+      artifactManifest = readCandidateArtifactManifest(artifactPath);
+      if (artifactManifest.slug !== "diagnostic-bundle") continue;
+      assertBundleTree(artifactPath);
+      const manifest = readJson<DiagnosticBundleManifest>(artifactPath, "diagnostic-manifest.json");
+      validateManifest(manifest, artifactManifest.artifact_id);
+      rows.push({
+        artifact_id: artifactManifest.artifact_id,
+        created_at: artifactManifest.created_at,
+        expires_at: artifactManifest.retention.expires_at,
+        classification: candidateClassification(artifactManifest),
+        selectable: true,
+        captured_at: manifest.captured_at,
+        finding_id: manifest.finding_id,
+      });
+    } catch (error) {
+      if (!existsSync(join(artifactPath, "diagnostic-manifest.json"))) continue;
+      const fallbackId = candidateArtifactId(artifactPath) ?? name;
+      rows.push({
+        artifact_id: fallbackId,
+        created_at: "",
+        expires_at: null,
+        classification: "invalid-manifest",
+        selectable: false,
+        error: error instanceof Error ? error.message : String(error),
+      });
+    }
+  }
+  const counts = new Map<string, number>();
+  for (const row of rows) counts.set(row.artifact_id, (counts.get(row.artifact_id) ?? 0) + 1);
+  return rows.map((row) =>
+    counts.get(row.artifact_id) === 1
+      ? row
+      : { ...row, selectable: false, error: "duplicate managed artifact id" },
+  );
+}
+
+function readCandidateArtifactManifest(artifactPath: string): ArtifactManifestV2 {
+  const manifestPath = join(artifactPath, ARTIFACT_MANIFEST);
+  const stat = lstatSync(manifestPath);
+  if (stat.isSymbolicLink() || !stat.isFile() || stat.size > 64 * 1024) {
+    throw new Error("artifact manifest is not a bounded regular file");
+  }
+  let manifest: Partial<ArtifactManifestV2>;
+  try {
+    manifest = JSON.parse(readFileSync(manifestPath, "utf8")) as Partial<ArtifactManifestV2>;
+  } catch {
+    throw new Error("artifact manifest is not valid JSON");
+  }
+  const parsed = parseArtifactManifest(manifest);
+  if (!parsed.ok) throw new Error(parsed.reason);
+  return parsed.manifest;
+}
+
+function candidateArtifactId(artifactPath: string): string | undefined {
+  try {
+    return readCandidateArtifactManifest(artifactPath).artifact_id;
+  } catch {
+    return undefined;
+  }
+}
+
+function candidateClassification(
+  manifest: ArtifactManifestV2,
+): ArtifactInventoryEntry["classification"] {
+  if (manifest.holds.length > 0) return "managed-held";
+  if (!manifest.released_at) return "managed-active";
+  return Date.parse(manifest.retention.expires_at) <= Date.now()
+    ? "managed-expired"
+    : "managed-current";
+}
+
 export function replayDiagnosticBundle(
   repoRoot: string,
   ref: string,

package/src/core/events/v3/bootstrap.ts

@@ -30,6 +30,7 @@ import {
 import { repairEventV3ControlPair } from "./control-writer.ts";
 import { loadOrCreateFingerprintKeyStoreV3 } from "./fingerprint-keys.ts";
 import { EVENT_V3_SCHEMA_DIGEST } from "./generated.ts";
+import { reanchorArchivedHookProducersV3 } from "./producers/recorder.ts";
 import { resolveEventLedgerRotateActiveBytesV3 } from "./rotation-config.ts";
 import { currentHarneryRuntimeBuild, liveEventV3BuildId, livePlatformV3 } from "./runtime-build.ts";
 import { drainReadyEventsV3 } from "./writer.ts";
@@ -210,6 +211,15 @@ export function rotateOversizedEventLedgerV3(
       approvalRecordId: "harnery-runtime-v3-size-rotation",
       forceNewEpoch: true,
     });
+    if (initialized.archived_epoch) {
+      reanchorArchivedHookProducersV3({
+        coordRoot: root,
+        archivedEpoch: initialized.archived_epoch,
+        mode: initialized.control.state,
+        build_id: liveEventV3BuildId(currentHarneryRuntimeBuild()),
+        platform: livePlatformV3(),
+      });
+    }
     return {
       state: "rotated",
       active_bytes: activeBytes,

package/src/core/events/v3/coordination-view.ts

@@ -52,8 +52,11 @@ export interface CoordinationViewV3 {
   contract_major: 2;
   reducer_build_id: typeof EVENT_V3_SAFETY_REDUCER_BUILD;
   source_complete: boolean;
+  /** True when no unscoped authority diagnostic can affect every generation. */
   authority_safe: boolean;
   diagnostics: SafetyProjectionDiagnosticV3[];
+  global_diagnostics: SafetyProjectionDiagnosticV3[];
+  diagnostics_by_generation: Record<string, SafetyProjectionDiagnosticV3[]>;
   instances: Record<string, CoordinationGenerationViewV3>;
   terminal_generations: Record<string, CoordinationGenerationViewV3>;
   delegations: SafetyProjectionV3["delegations"];
@@ -95,7 +98,9 @@ export function projectCoordinationViewV3(read: ReadLedgerV3Result): Coordinatio
   const safety = reduceSafetyProjectionV3(read);
   const starts = new Map<string, Extract<EventV3, { event_type: "session.started" }>>();
   const eventGeneration = new Map<string, string>();
+  const eventTypes = new Map<string, EventV3["event_type"]>();
   for (const { event } of read.events) {
+    eventTypes.set(event.event_id, event.event_type);
     const generationId = "generation_id" in event.scope ? event.scope.generation_id : undefined;
     if (generationId !== undefined) {
       eventGeneration.set(event.event_id, generationId);
@@ -105,6 +110,15 @@ export function projectCoordinationViewV3(read: ReadLedgerV3Result): Coordinatio
     }
   }
 
+  const { globalDiagnostics, diagnosticsByGeneration } = partitionCoordinationDiagnosticsV3(
+    safety,
+    eventGeneration,
+    eventTypes,
+  );
+  const globalAuthoritySafe = !globalDiagnostics.some(
+    (diagnostic) => diagnostic.authority_blocking,
+  );
+
   const instances: Record<string, CoordinationGenerationViewV3> = {};
   const terminalGenerations: Record<string, CoordinationGenerationViewV3> = {};
   const states = Object.values(safety.generations).sort((left, right) =>
@@ -113,14 +127,7 @@ export function projectCoordinationViewV3(read: ReadLedgerV3Result): Coordinatio
   for (const state of states) {
     const started = starts.get(state.generation_id);
     if (!started) continue;
-    const diagnostics = safety.diagnostics.filter(
-      (diagnostic) =>
-        diagnostic.generation_id === state.generation_id ||
-        diagnostic.subject_instance_id === state.instance_id ||
-        (diagnostic.event_id !== undefined &&
-          eventGeneration.get(diagnostic.event_id) === state.generation_id) ||
-        diagnostic.code === "ledger_incomplete",
-    );
+    const diagnostics = diagnosticsByGeneration[state.generation_id] ?? [];
     const delegation = Object.values(safety.delegations).find(
       (candidate) => candidate.child_generation_id === state.generation_id,
     );
@@ -173,8 +180,11 @@ export function projectCoordinationViewV3(read: ReadLedgerV3Result): Coordinatio
       last_context_event_id: state.last_context_event_id,
       provisional_termination: state.provisional_termination,
       terminal: state.terminal,
-      evidence_complete: safety.evidence_complete && diagnostics.length === 0,
-      authority_eligible: safety.authority_safe && state.phase === "live",
+      evidence_complete: globalDiagnostics.length === 0 && diagnostics.length === 0,
+      authority_eligible:
+        globalAuthoritySafe &&
+        !diagnostics.some((diagnostic) => diagnostic.authority_blocking) &&
+        state.phase === "live",
     };
     if (state.phase === "terminal") {
       terminalGenerations[state.generation_id] = view;
@@ -188,8 +198,10 @@ export function projectCoordinationViewV3(read: ReadLedgerV3Result): Coordinatio
     contract_major: 2,
     reducer_build_id: EVENT_V3_SAFETY_REDUCER_BUILD,
     source_complete: read.complete,
-    authority_safe: safety.authority_safe,
+    authority_safe: globalAuthoritySafe,
     diagnostics: safety.diagnostics,
+    global_diagnostics: globalDiagnostics,
+    diagnostics_by_generation: diagnosticsByGeneration,
     instances,
     terminal_generations: terminalGenerations,
     delegations: safety.delegations,
@@ -200,6 +212,83 @@ export function projectCoordinationViewV3(read: ReadLedgerV3Result): Coordinatio
   return view;
 }
 
+/**
+ * Partition reducer findings at the narrowest authority boundary that can be
+ * proven from canonical event attribution. A diagnostic stays global when it
+ * concerns shared claim/decision state, lacks a live generation witness, or
+ * came from the canonical reader. Reader failures deliberately remain global:
+ * an incomplete read cannot produce the append checkpoint that proves causal
+ * parents and attestations for later writes.
+ */
+function partitionCoordinationDiagnosticsV3(
+  safety: SafetyProjectionV3,
+  eventGeneration: ReadonlyMap<string, string>,
+  eventTypes: ReadonlyMap<string, EventV3["event_type"]>,
+): {
+  globalDiagnostics: SafetyProjectionDiagnosticV3[];
+  diagnosticsByGeneration: Record<string, SafetyProjectionDiagnosticV3[]>;
+} {
+  const globalDiagnostics: SafetyProjectionDiagnosticV3[] = [];
+  const diagnosticsByGeneration: Record<string, SafetyProjectionDiagnosticV3[]> = {};
+  for (const diagnostic of safety.diagnostics) {
+    const generationIds = diagnosticGenerationIdsV3(diagnostic, safety, eventGeneration);
+    if (
+      generationIds.length === 0 ||
+      diagnosticRequiresGlobalAuthorityV3(diagnostic, eventTypes.get(diagnostic.event_id ?? ""))
+    ) {
+      globalDiagnostics.push(diagnostic);
+      continue;
+    }
+    for (const generationId of generationIds) {
+      const generationDiagnostics = diagnosticsByGeneration[generationId] ?? [];
+      generationDiagnostics.push(diagnostic);
+      diagnosticsByGeneration[generationId] = generationDiagnostics;
+    }
+  }
+  return { globalDiagnostics, diagnosticsByGeneration };
+}
+
+function diagnosticGenerationIdsV3(
+  diagnostic: SafetyProjectionDiagnosticV3,
+  safety: SafetyProjectionV3,
+  eventGeneration: ReadonlyMap<string, string>,
+): string[] {
+  const exact = new Set<string>();
+  if (diagnostic.generation_id && safety.generations[diagnostic.generation_id]) {
+    exact.add(diagnostic.generation_id);
+  }
+  const eventGenerationId = diagnostic.event_id
+    ? eventGeneration.get(diagnostic.event_id)
+    : undefined;
+  if (eventGenerationId && safety.generations[eventGenerationId]) exact.add(eventGenerationId);
+  if (exact.size > 0) return [...exact].sort();
+
+  const subjectGenerationId = diagnostic.subject_instance_id
+    ? safety.current_generation_by_instance[diagnostic.subject_instance_id]
+    : undefined;
+  return subjectGenerationId && safety.generations[subjectGenerationId]
+    ? [subjectGenerationId]
+    : [];
+}
+
+function diagnosticRequiresGlobalAuthorityV3(
+  diagnostic: SafetyProjectionDiagnosticV3,
+  eventType: EventV3["event_type"] | undefined,
+): boolean {
+  if (diagnostic.code === "ledger_incomplete") return true;
+  if (diagnostic.code === "decision_prior_mismatch") return true;
+  if (
+    diagnostic.code === "claim_acquire_conflict" ||
+    diagnostic.code === "claim_release_without_acquire"
+  ) {
+    return true;
+  }
+  return (
+    diagnostic.code === "authority_attribution_unverified" &&
+    (eventType === "decision.state_changed" || eventType === "coord.claim_changed")
+  );
+}
+
 /** Refuse authority decisions while still allowing callers to render diagnostics. */
 export function requireAuthoritySafeCoordinationViewV3(
   view: CoordinationViewV3,

package/src/core/events/v3/producers/intake.ts

@@ -12,7 +12,7 @@ import {
   unlinkSync,
   writeFileSync,
 } from "node:fs";
-import { join, resolve } from "node:path";
+import { dirname, join, resolve } from "node:path";
 import type { Adapter } from "../../../adapter.ts";
 import type { ParsedPayload } from "../../../hooks/adapter/parse.ts";
 import { fsyncParentDirectory } from "../../../workflow/durable-record.ts";
@@ -224,7 +224,14 @@ export function listHookIntakeRecordsV3(directory: string): HookIntakeEntryV3[]
 }
 
 export function removeIntakeRecordV3(path: string): void {
-  if (existsSync(path)) unlinkSync(path);
+  if (existsSync(path)) {
+    unlinkSync(path);
+  } else if (!existsSync(dirname(path))) {
+    // Epoch rotation atomically moves the complete intake tree into the
+    // archive. A producer that was already draining the old path has nothing
+    // left to remove or fsync in the successor.
+    return;
+  }
   fsyncParentDirectory(path);
 }