immune-brain 5.3.0 → 5.5.1

package/plugins/immune-brain/runtime/unattended/batch_disposition.ts

@@ -20,10 +20,10 @@
 // open. No Batch Authorization capability is minted, because retiring a record
 // consumes no child and enrolls nothing — the capability exists to authorize
 // child consumption, and minting one here would be ceremony without a property.
-import { readSecureProjectBytes } from "../kernel/storage";
+import { readSecureProjectBytes, readSettledRunEvidence } from "../kernel/storage";
 import { batchStatePath } from "../kernel/storage_paths";
 import { batchReason, type BatchReason } from "./batch_reasons";
-import { findExistingActiveBatch, findSettledBatchRecord, type BatchGateDecision } from "./batch_preflight";
+import { findExistingActiveBatch, findSettledBatchRecord, readActiveClaimTaskId, type BatchGateDecision } from "./batch_preflight";
 import {
 	isTerminalBatchState,
 	replaceAnyBatchRunState,
@@ -34,7 +34,12 @@ import {
 	type BatchRunState,
 } from "./batch_state";
 
-/** Child states whose Kernel run is still live; a live run settles on its own. */
+/**
+ * Child states the batch runner has not finished absorbing. Such a child is
+ * mid-flight unless the Kernel store proves its run already ended outside the
+ * batch (see `kernelLifecycleOf`): the record alone cannot tell a live run from
+ * one a manual imm-run settled while the drifted batch could no longer resume.
+ */
 const SERIAL_IN_FLIGHT: ReadonlySet<string> = new Set(["enrolled", "settled"]);
 const LANE_IN_FLIGHT: ReadonlySet<string> = new Set(["lane_admitted", "enrolled", "settled", "lane_committed"]);
 
@@ -45,6 +50,8 @@ export interface StaleBatchChildEvidence {
 	state: string;
 	commit: string | null;
 	lane_branch: string | null;
+	/** The Kernel store's terminal lifecycle for this task; null while live or unknown. */
+	kernel_lifecycle: "done" | "stopped" | null;
 }
 
 /** The exact record identity the literal user is asked to retire. */
@@ -74,10 +81,27 @@ const RETIRE_REASON =
 	"Recorded child commits, child states and the batch branch are preserved as evidence. " +
 	"Children this batch never executed carry no commit, no batch trailer and no approval; nothing infers their delivery from this record.";
 
+const RETIRE_REASON_ENDED_OUTSIDE =
+	" A child this record still holds mid-flight had already ended in the Kernel store when the record was retired; its own TaskRecord, not this record, is the evidence of that run.";
+
 const RETIRE_NEXT_ACTION =
 	"The Initiative has no active batch. Run each remaining child with imm-run under its own authorization, or start a new batch for this Initiative after checking out its batch branch.";
 
-function childEvidenceOf(record: AnyBatchRunStateRecord): StaleBatchChildEvidence[] {
+/**
+ * The terminal lifecycle the coordinator's Kernel store holds for a task, or
+ * null. Fail closed: no run, a live run, a task that still owns the workspace
+ * claim, or an unreadable store all read as null, so the child stays mid-flight.
+ */
+function kernelLifecycleOf(root: string, taskId: string): "done" | "stopped" | null {
+	try {
+		if (readActiveClaimTaskId(root) === taskId) return null;
+		return readSettledRunEvidence(root, taskId)?.lifecycle ?? null;
+	} catch {
+		return null;
+	}
+}
+
+function childEvidenceOf(root: string, record: AnyBatchRunStateRecord): StaleBatchChildEvidence[] {
 	if (record.contract === "assurance_kernel/batch_run_state/v2")
 		return record.children.map((child) => ({
 			task_id: child.task_id,
@@ -85,6 +109,7 @@ function childEvidenceOf(record: AnyBatchRunStateRecord): StaleBatchChildEvidenc
 			state: child.state,
 			commit: child.commit,
 			lane_branch: child.lane?.branch ?? null,
+			kernel_lifecycle: kernelLifecycleOf(root, child.task_id),
 		}));
 	return record.children.map((child) => ({
 		task_id: child.task_id,
@@ -92,12 +117,13 @@ function childEvidenceOf(record: AnyBatchRunStateRecord): StaleBatchChildEvidenc
 		state: child.state,
 		commit: child.commit,
 		lane_branch: null,
+		kernel_lifecycle: kernelLifecycleOf(root, child.task_id),
 	}));
 }
 
-function inFlightChildOf(record: AnyBatchRunStateRecord): { task_id: string } | null {
+function inFlightChildOf(root: string, record: AnyBatchRunStateRecord): { task_id: string } | null {
 	const inFlight = record.contract === "assurance_kernel/batch_run_state/v2" ? LANE_IN_FLIGHT : SERIAL_IN_FLIGHT;
-	return record.children.find((child) => inFlight.has(child.state)) ?? null;
+	return record.children.find((child) => inFlight.has(child.state) && kernelLifecycleOf(root, child.task_id) === null) ?? null;
 }
 
 /**
@@ -114,7 +140,7 @@ export function readStaleBatchLookup(root: string, initiativeSlug: string): Stal
 	if (found.corrupt) return { kind: "corrupt", path: found.path };
 	const record = found.record;
 	if (isTerminalBatchState(record.batch_state)) return { kind: "terminal", batch_id: record.batch_id };
-	const inFlight = inFlightChildOf(record);
+	const inFlight = inFlightChildOf(root, record);
 	if (inFlight) return { kind: "in_flight", batch_id: record.batch_id, task_id: inFlight.task_id };
 	return {
 		kind: "retirable",
@@ -128,7 +154,7 @@ export function readStaleBatchLookup(root: string, initiativeSlug: string): Stal
 			base_head: record.base_head,
 			confirmation_time: record.confirmation_time,
 			recorded_commits: [...record.commits],
-			children: childEvidenceOf(record),
+			children: childEvidenceOf(root, record),
 		},
 	};
 }
@@ -188,6 +214,10 @@ export async function retireStaleBatch<HostRejection>(options: {
 	// Children, commits and branch are carried over untouched: the disposition
 	// records what the batch did and did not do, and invents neither.
 	const retired: AnyBatchRunStateRecord = { ...record, batch_state: "superseded" };
+	const inFlightStates = record.contract === "assurance_kernel/batch_run_state/v2" ? LANE_IN_FLIGHT : SERIAL_IN_FLIGHT;
+	const reason = record.children.some((child) => inFlightStates.has(child.state))
+		? RETIRE_REASON + RETIRE_REASON_ENDED_OUTSIDE
+		: RETIRE_REASON;
 	const stored = replaceAnyBatchRunState(root, expected, retired, () => {
 		if (!readSecureProjectBytes(root, batchStatePath(record.batch_id)).equals(expected))
 			throw new Error("batch state changed before the disposition was applied");
@@ -202,7 +232,7 @@ export async function retireStaleBatch<HostRejection>(options: {
 					max_parallel: stored.max_parallel,
 					children: stored.children,
 					commits: stored.commits,
-					reason: RETIRE_REASON,
+					reason,
 					handoffs: [],
 					next_action: RETIRE_NEXT_ACTION,
 					created_at: now,
@@ -214,7 +244,7 @@ export async function retireStaleBatch<HostRejection>(options: {
 					batch_state: stored.batch_state,
 					children: stored.children,
 					commits: stored.commits,
-					reason: RETIRE_REASON,
+					reason,
 					next_action: RETIRE_NEXT_ACTION,
 					created_at: now,
 				} satisfies BatchRunReport);

package/plugins/immune-brain/runtime/unattended/batch_final_verification.ts

@@ -4,6 +4,8 @@
 // the completing tick runs exactly what the literal user saw at confirmation.
 // A failure marks the completion report as not passed; integrated commits are
 // never rolled back. Only exit status and timing are recorded, never output.
+import { createHash } from "node:crypto";
+import { parseTaskIntentV1 } from "../kernel/intent";
 import { spawn, spawnSync } from "node:child_process";
 
 export const MAX_FINAL_VERIFICATION_COMMANDS = 8;
@@ -38,6 +40,24 @@ export function parseFinalVerification(value: unknown): string[] | undefined {
 	});
 }
 
+export function parseFinalVerificationReport(value: unknown, commands?: readonly string[]): FinalVerificationReport {
+	if (!value || typeof value !== "object") throw new Error("invalid final verification result");
+	const report = value as FinalVerificationReport;
+	if (typeof report.passed !== "boolean" || !(report.head === null || typeof report.head === "string") ||
+		!Array.isArray(report.results) || !report.results.length || report.results.some(result =>
+			!result || typeof result.command !== "string" || typeof result.passed !== "boolean" ||
+			!(result.exit_code === null || Number.isInteger(result.exit_code)) ||
+			!(result.signal === null || typeof result.signal === "string") ||
+			!Number.isFinite(result.duration_ms) || result.duration_ms < 0 ||
+			result.passed !== (result.exit_code === 0 && result.signal === null)))
+		throw new Error("invalid final verification result");
+	parseFinalVerification(report.results.map(result => result.command));
+	if (report.passed && report.results.some(result => !result.passed)) throw new Error("contradictory final verification result");
+	if (commands && JSON.stringify(report.results.map(result => result.command)) !== JSON.stringify(commands))
+		throw new Error("final verification commands changed");
+	return report;
+}
+
 /** One command, asynchronously, so a long suite never blocks the Host's event loop. */
 function runOne(root: string, command: string, timeoutMs: number): Promise<FinalVerificationResult> {
 	const [executable, ...argv] = command.split(" ");
@@ -48,7 +68,7 @@ function runOne(root: string, command: string, timeoutMs: number): Promise<Final
 			if (settled) return;
 			settled = true;
 			clearTimeout(timer);
-			resolve({ command, exit_code: exitCode, signal, passed: exitCode === 0, duration_ms: Date.now() - started });
+			resolve({ command, exit_code: exitCode, signal, passed: exitCode === 0 && signal === null, duration_ms: Date.now() - started });
 		};
 		const child = spawn(executable!, argv, { cwd: root, stdio: "ignore", env: process.env });
 		const timer = setTimeout(() => {
@@ -60,13 +80,47 @@ function runOne(root: string, command: string, timeoutMs: number): Promise<Final
 	});
 }
 
+export function prepareFinalRepairCandidate(input: {
+	initiative_slug: string; original_goal: string; scope_hint: string[];
+	failure: FinalVerificationReport; prior_repairs: number;
+}) {
+	const failure = parseFinalVerificationReport(input.failure);
+	if (failure.passed || !failure.head) throw new Error("repair candidate requires a failed final verification bound to a delivery HEAD");
+	if (!failure.results.some(result => !result.passed)) throw new Error("reconcile the verification environment or delivery HEAD before preparing a code repair");
+	if (!Number.isInteger(input.prior_repairs) || input.prior_repairs < 0 || input.prior_repairs >= 2)
+		throw new Error("Parent coordinator correction budget exhausted");
+	const identity = createHash("sha256").update(JSON.stringify({ head: failure.head,
+		results: failure.results.map(({ command, exit_code, signal }) => ({ command, exit_code, signal })) })).digest("hex");
+	const taskId = `${input.initiative_slug.slice(0, 96)}-repair-${identity.slice(0, 12)}`;
+	const candidate = parseTaskIntentV1({ contract: "assurance_kernel/task_intent/v1", task_id: taskId,
+		goal: input.original_goal, owner: "user", revision: 1, risk: "material", scope_hint: [...new Set([...input.scope_hint, `docs/plans/${taskId}.intent.json`])],
+		acceptance: failure.results.map((result, index) => {
+			const [executable, ...argv] = result.command.split(" ");
+			return { id: `final-${index + 1}`, assertion: `Restore the original goal and pass final command ${index + 1}`,
+				verification: JSON.stringify({ contract: "assurance_kernel/verification_descriptor/v2",
+					command: { executable, argv, cwd: ".", timeout_ms: 120000, max_output_bytes: 131072 },
+					environment: { prepare: null, writable_paths: [] } }, null, 2) + "\n" };
+		}) });
+	return { failure_id: `sha256:${identity}`, delivery_head: failure.head, candidate };
+}
+
 export async function runFinalVerification(
 	root: string,
 	commands: readonly string[],
 	options: { timeoutMs?: number } = {},
 ): Promise<FinalVerificationReport> {
+	const verifiedCommands = parseFinalVerification([...commands])!;
 	const head = spawnSync("git", ["-C", root, "rev-parse", "HEAD"], { encoding: "utf8" });
+	const clean = () => {
+		const tracked = spawnSync("git", ["-C", root, "diff", "--quiet", "HEAD"]);
+		const untracked = spawnSync("git", ["-C", root, "ls-files", "--others", "--exclude-standard", "-z"], { encoding: "utf8" });
+		return tracked.status === 0 && untracked.status === 0 && untracked.stdout.length === 0;
+	};
+	const cleanBefore = clean();
 	const results: FinalVerificationResult[] = [];
-	for (const command of commands) results.push(await runOne(root, command, options.timeoutMs ?? DEFAULT_TIMEOUT_MS));
-	return { passed: results.every((result) => result.passed), head: head.status === 0 ? head.stdout.trim() : null, results };
+	for (const command of verifiedCommands) results.push(await runOne(root, command, options.timeoutMs ?? DEFAULT_TIMEOUT_MS));
+	const after = spawnSync("git", ["-C", root, "rev-parse", "HEAD"], { encoding: "utf8" });
+	const unchangedHead = head.status === 0 && after.status === 0 && head.stdout.trim() === after.stdout.trim();
+	const cleanAfter = clean();
+	return { passed: results.every(result => result.passed) && unchangedHead && cleanBefore && cleanAfter, head: head.status === 0 ? head.stdout.trim() : null, results };
 }