immune-brain 3.6.8 → 4.0.0

package/plugins/immune-brain/runtime/commands/kernel.ts

@@ -1,4 +1,3 @@
-import { createHash } from "node:crypto";
 import {
 	closeSync,
 	constants as fsConstants,
@@ -8,7 +7,7 @@ import {
 	writeFileSync,
 } from "node:fs";
 import { execFileSync } from "node:child_process";
-import { join, resolve } from "node:path";
+import { resolve } from "node:path";
 import process from "node:process";
 import { fileURLToPath } from "node:url";
 import {
@@ -27,6 +26,7 @@ import {
 	parseTaskIntentV1,
 	RISK_FLOOR_SCOPE_PREFIXES,
 } from "../kernel/intent";
+import { inspectSpecBinding } from "../kernel/spec_binding";
 import { projectTask, resolveProjectedRisk } from "../kernel/completion";
 import { deriveAssuranceAuthorization } from "../kernel/assurance_projection";
 import { taskDiffIdentity, taskRevisionIdentity } from "../workspace_scope";
@@ -40,7 +40,7 @@ import { projectLegacyAudit } from "../kernel/legacy_audit";
 import { inspectStorageLayout } from "../kernel/storage_paths";
 import { migrateLegacyLayout } from "../kernel/storage_layout_migration";
 import { readBackendClaim } from "../kernel/backend_claim";
-import { withKernelStoreLock } from "../kernel";
+import { probeKernelStore } from "../kernel";
 
 export interface KernelCommandResult {
 	stdout: string;
@@ -65,12 +65,6 @@ function errorResult(code: string, message: string, returncode: number): KernelC
 	return jsonResult({ error: { code, message } }, returncode);
 }
 
-function asRecord(value: unknown): Record<string, unknown> {
-	return value && typeof value === "object" && !Array.isArray(value)
-		? (value as Record<string, unknown>)
-		: {};
-}
-
 function journalFor(
 	command: string,
 	phase: TaskPhase | null,
@@ -121,16 +115,7 @@ function runStatus(root: string): KernelExecution {
 	try {
 		const layout = inspectStorageLayout(root);
 		const claim = readBackendClaim(root);
-		const workspace = (() => {
-			try {
-				const raw = JSON.parse(readSecureProjectFile(root, ".imm/state/workspace.json")) as {
-					current_working?: unknown;
-				};
-				return typeof raw.current_working === "string" ? raw.current_working : null;
-			} catch {
-				return null;
-			}
-		})();
+		const workspace = readWorkspaceOwner(root);
 		return {
 			result: jsonResult({
 				contract: "assurance_kernel/status/v1",
@@ -193,10 +178,7 @@ function matchingFloorEntries(intent: TaskIntentV1): string[] {
 
 function readWorkspaceOwner(root: string): string | null {
 	try {
-		const raw = JSON.parse(readSecureProjectFile(root, ".imm/state/workspace.json")) as {
-			current_working?: unknown;
-		};
-		return typeof raw.current_working === "string" ? raw.current_working : null;
+		return readWorkspaceStateRaw(root).state.current_working;
 	} catch {
 		return null;
 	}
@@ -292,8 +274,8 @@ function runInspect(root: string): KernelExecution {
 		try {
 			identity =
 				record.contract === "assurance_kernel/task_record/v4"
-					? taskRevisionIdentity(root, intent.scope_hint, record.git_base_head)
-					: taskDiffIdentity(root, intent.scope_hint);
+					? taskRevisionIdentity(root, intent.scope_hint, record.git_base_head, intent.task_id)
+					: taskDiffIdentity(root, intent.scope_hint, intent.task_id);
 		} catch (error) {
 			return sourceFailure("inspect", error);
 		}
@@ -499,7 +481,7 @@ function runIntentAuthor(args: string[], root: string): KernelExecution {
 	// its frozen manifest under both locks. The original authoring is retried
 	// only after the affected migration diff is committed.
 	try {
-		withKernelStoreLock(root, () => undefined);
+		probeKernelStore(root);
 	} catch (error) {
 		return {
 			result: errorResult(
@@ -536,46 +518,13 @@ function runIntentAuthor(args: string[], root: string): KernelExecution {
 		};
 	}
 	if (layout.layout === "recovery_required" || layout.layout === "migration_required") {
-		const migration = migrateLegacyLayout(root);
-		if (migration.outcome === "migrated") {
-			return {
-				result: jsonResult({
-					contract: "assurance_kernel/migration_completed/v1",
-					operation: "intent author",
-					affected_paths: migration.affected_paths,
-					next_action: "commit the affected migration paths, then retry intent author",
-				}),
-				journal: journalFor(
-					"intent",
-					null,
-					"escalated",
-					"migration_ambiguous",
-					null,
-					"Legacy evidence was relocated without Git index writes; commit and retry.",
-				),
-			};
-		}
-		if (migration.outcome === "migration_uncommitted") {
-			return {
-				result: errorResult(
-					"migration_uncommitted",
-					`affected storage paths differ from HEAD: ${migration.affected_paths.join(", ") || "(none)"}`,
-					1,
-				),
-				journal: journalFor(
-					"intent",
-					null,
-					"rejected",
-					"migration_ambiguous",
-					null,
-					"Commit or restore the affected paths before retrying.",
-				),
-			};
-		}
+		// Authoring never migrates implicitly: the retired layout is converted by
+		// the explicit claimless command only, so creating a draft cannot publish a
+		// database or retire historical files behind the operator's back.
 		return {
 			result: errorResult(
-				layout.layout === "recovery_required" ? "layout_recovery_required" : "layout_migration_blocked",
-				migration.reason ?? layout.reason ?? "storage layout is not ready",
+				layout.layout === "recovery_required" ? "layout_recovery_required" : "layout_migration_required",
+				`${layout.reason ?? "storage layout is not ready"}; run imm-kernel migrate --storage-layout first`,
 				1,
 			),
 			journal: journalFor(
@@ -584,7 +533,7 @@ function runIntentAuthor(args: string[], root: string): KernelExecution {
 				"rejected",
 				"source_invalid",
 				null,
-				"Resolve the reported storage layout condition before authoring.",
+				"Run imm-kernel migrate --storage-layout, commit the affected paths, then retry intent author.",
 			),
 		};
 	}
@@ -760,7 +709,7 @@ function runIntentAuthor(args: string[], root: string): KernelExecution {
 		return {
 			result: errorResult(
 				"intent_invalid",
-				`candidate acceptance verification failed strict verification_descriptor/v1 parsing: ${error instanceof Error ? error.message : error}`,
+				`candidate acceptance verification failed strict verification_descriptor/v2 parsing: ${error instanceof Error ? error.message : error}`,
 				1,
 			),
 			journal: journalFor(
@@ -769,7 +718,7 @@ function runIntentAuthor(args: string[], root: string): KernelExecution {
 				"rejected",
 				"intent_invalid",
 				null,
-				"Fix the reported verification_descriptor/v1 violations and retry.",
+				"Fix the reported verification_descriptor/v2 violations and retry.",
 			),
 		};
 	}
@@ -1132,6 +1081,29 @@ function runIntentValidate(args: string[], root: string): KernelExecution {
 			),
 		};
 	}
+	const specBinding = inspectSpecBinding(intent);
+	if (!specBinding.ok) {
+		return {
+			result: jsonResult(
+				{
+					contract: "assurance_kernel/intent_validation/v1",
+					valid: false,
+					path: relative,
+					task_id: intent.task_id,
+					reason: specBinding.message,
+				},
+				0,
+			),
+			journal: journalFor(
+				"intent",
+				null,
+				"ok",
+				"command_ok",
+				null,
+				null,
+			),
+		};
+	}
 
 	const verification: Array<{ id: string; eligible: boolean; reason: string | null }> = [];
 	let allEligible = true;
@@ -1244,6 +1216,25 @@ function executeKernelCommand(args: string[], root: string): KernelExecution {
 			};
 		return runInspect(root);
 	}
+	if (command === "migrate") {
+		if (flags.length !== 1 || flags[0] !== "--storage-layout")
+			return {
+				result: errorResult(
+					"invalid_command",
+					"migrate accepts only --storage-layout",
+					2,
+				),
+				journal: journalFor(
+					command,
+					null,
+					"rejected",
+					"invalid_command",
+					null,
+					"Run imm-kernel migrate --storage-layout.",
+				),
+			};
+		return runStorageLayoutMigration(root);
+	}
 	if (command === "audit") {
 		if (args.length !== 2 || args[1] !== "--legacy")
 			return {
@@ -1341,6 +1332,106 @@ function executeKernelCommand(args: string[], root: string): KernelExecution {
 	};
 }
 
+/**
+ * Explicit claimless storage-layout migration.
+ *
+ * The retired file store is converted here and nowhere else: this command never
+ * authors an intent, never opens a task, and never needs an active claim, so a
+ * worktree that is still on the retired layout has one reachable entry point.
+ * Mutating commands keep their fail-closed gate; this is the command that
+ * resolves it.
+ */
+function runStorageLayoutMigration(root: string): KernelExecution {
+	const inspection = inspectStorageLayout(root);
+	// Only a live owner blocks the command. Every other diagnosis is handed to
+	// the migrator, which owns the recovery decisions: an interrupted
+	// publication shows both stores and must stay reachable through this CLI.
+	if (inspection.layout === "migration_blocked_active")
+		return {
+			result: errorResult(
+				"layout_migration_blocked",
+				inspection.reason ?? "a live legacy task still owns work; settle or stop it on the prior runtime first",
+				1,
+			),
+			journal: journalFor(
+				"migrate",
+				null,
+				"rejected",
+				"source_invalid",
+				null,
+				"Resolve the reported layout condition, then rerun imm-kernel migrate --storage-layout.",
+			),
+		};
+	const migration = migrateLegacyLayout(root);
+	if (migration.outcome === "migrated")
+		return {
+			result: jsonResult({
+				contract: "assurance_kernel/migration_completed/v1",
+				operation: "storage layout migration",
+				affected_paths: migration.affected_paths,
+				next_action: "commit the affected migration paths, then retry the original command",
+			}),
+			journal: journalFor(
+				"migrate",
+				null,
+				"escalated",
+				"migration_ambiguous",
+				null,
+				"Commit the affected migration paths, then retry the original command.",
+			),
+		};
+	if (migration.outcome === "migration_uncommitted")
+		return {
+			result: jsonResult({
+				contract: "assurance_kernel/migration_pending_commit/v1",
+				operation: "storage layout migration",
+				affected_paths: migration.affected_paths,
+				reason: migration.reason,
+				next_action: "commit the preserved audit evidence, then rerun imm-kernel migrate --storage-layout",
+			}),
+			journal: journalFor(
+				"migrate",
+				null,
+				"escalated",
+				"migration_ambiguous",
+				null,
+				"Commit the preserved audit evidence, then rerun imm-kernel migrate --storage-layout.",
+			),
+		};
+	if (migration.outcome === "already_migrated")
+		return {
+			result: jsonResult({
+				contract: "assurance_kernel/migration_completed/v1",
+				operation: "storage layout migration",
+				affected_paths: [],
+				next_action: "retry the original command",
+			}),
+			journal: journalFor(
+				"migrate",
+				null,
+				"ok",
+				"command_ok",
+				null,
+				"Retry the original command.",
+			),
+		};
+	return {
+		result: errorResult(
+			"layout_migration_blocked",
+			migration.reason ?? "the storage layout migration did not complete",
+			1,
+		),
+		journal: journalFor(
+			"migrate",
+			null,
+			"rejected",
+			"source_invalid",
+			null,
+			"Resolve the reported layout condition, then rerun imm-kernel migrate --storage-layout.",
+		),
+	};
+}
+
 export function runKernelCommand(
 	args: string[],
 	root = process.cwd(),