intentional-cognition-os 1.4.3 → 1.5.2

package/CHANGELOG.md

@@ -1,5 +1,37 @@
 # Changelog
 
+## [v1.5.2] - 2026-05-26
+
+- Merge pull request #109 from jeremylongshore/feat/audit-chain-race-fix-lhm (312c2e0)
+- fix(kernel/audit): use FD-based open+fstat+write (CodeQL canonical safe pattern) (d32460a)
+- fix(kernel/audit): drop existsSync check-then-use pattern in writeTrace (ad08dac)
+- fix(kernel/audit): serialize writeTrace under SQLite EXCLUSIVE lock (lhm) (d09d62c)
+
+## [v1.5.1] - 2026-05-26
+
+- chore(beads): file P4 sweep bead for doc 037 prose polish (GFM table-cell escape semantics) (d870d64)
+- Merge pull request #108 from jeremylongshore/fix/codeql-triage-corrections (2974682)
+- fix(docs/security): correct CodeQL triage — hash-chain race is real, alert #13 reopened (fb11fb1)
+- chore(beads): close 0wy.3 (CodeQL triage), file lhm (reliability follow-up) (d98b0d6)
+- Merge pull request #107 from jeremylongshore/feat/codeql-triage-0wy.3 (96f69e0)
+- docs(security): CodeQL alert triage — 31 dismissed, 1 follow-up bead (1613593)
+- chore(beads): nhj.1 + 0wy.1 closed, 2v4 filed (compiler mutation deferral) (8e14ed8)
+
+## [v1.5.0] - 2026-05-26
+
+- Merge pull request #106 from jeremylongshore/feat/stryker-baseline-lock-0wy.1 (01490d8)
+- feat(mutation): lock Stryker kernel baseline at 55% floor + wire to PR gate (e083c51)
+- chore(beads): nhj.1 — upstream comment posted on gastownhall/beads#4135 (b03a2f0)
+- chore(beads): close nhj.1 — dossier + candidate staged for upstream beads (4f6f6f0)
+- Merge pull request #105 from jeremylongshore/chore/steveyegge-to-gastownhall-and-nhj.1-dossier (eda7f63)
+- chore(beads): update upstream repo references steveyegge → gastownhall (b590258)
+- chore(beads): sync state — close 55q.4 + cross-layer mirror evidence (916b005)
+
+## [v1.4.4] - 2026-05-25
+
+- Merge pull request #104 from jeremylongshore/feat/bd-sync-race-gemini-followups (43699e6)
+- fix(bd-sync-repro): address PR #103 Gemini review findings (0e60ba5)
+
 ## [v1.4.3] - 2026-05-25
 
 - Merge pull request #103 from jeremylongshore/feat/bd-sync-rapid-write-race-55q.4 (bf57454)

package/README.md

@@ -152,7 +152,7 @@ Global flags on every command: `--workspace <path>`, `--json`, `--verbose`, `--q
 
 ## Status
 
-**v1.0.5 — stable.** 1.4.3 tests passing across 5 packages. Used daily by the author. Public release on npm.
+**v1.0.5 — stable.** 1.5.2 tests passing across 5 packages. Used daily by the author. Public release on npm.
 
 - **Stable**: all 14 commands, the compilation passes, ask + research + recall + render + promote, the audit chain.
 - **In progress**: post-v1 coverage uplift on compiler + cli packages; mutation-testing baseline.

package/dist/index.js

@@ -4329,11 +4329,15 @@ import { join as join3 } from "path";
 import { randomUUID } from "crypto";
 import {
   appendFileSync,
+  closeSync,
+  constants as fsConstants,
   existsSync as existsSync4,
+  fstatSync,
   mkdirSync as mkdirSync2,
+  openSync,
   readFileSync as readFileSync4,
-  statSync,
-  writeFileSync as writeFileSync2
+  writeFileSync as writeFileSync2,
+  writeSync
 } from "fs";
 import { join as join2 } from "path";
 import { readFileSync as readFileSync3 } from "fs";
@@ -4350,7 +4354,7 @@ import { basename, resolve as resolve4 } from "path";
 import { existsSync as existsSync8, readdirSync as readdirSync4, readFileSync as readFileSync7 } from "fs";
 import { basename as basename2, resolve as resolve5 } from "path";
 import { createHash as createHash3, randomUUID as randomUUID5 } from "crypto";
-import { existsSync as existsSync9, mkdirSync as mkdirSync5, readFileSync as readFileSync8, statSync as statSync2, unlinkSync, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync9, mkdirSync as mkdirSync5, readFileSync as readFileSync8, statSync, unlinkSync, writeFileSync as writeFileSync4 } from "fs";
 import { join as join5, relative, resolve as resolve6 } from "path";
 import matter from "gray-matter";
 import matter2 from "gray-matter";
@@ -4364,16 +4368,16 @@ import {
   readdirSync as readdirSync6,
   readFileSync as readFileSync11,
   renameSync as renameSync2,
-  statSync as statSync4,
+  statSync as statSync3,
   writeFileSync as writeFileSync5
 } from "fs";
 import { basename as basename3, join as join9, resolve as resolve7 } from "path";
 import matter4 from "gray-matter";
 import { existsSync as existsSync14, readdirSync as readdirSync7, readFileSync as readFileSync12 } from "fs";
 import { basename as basename4, join as join10 } from "path";
-import { mkdirSync as mkdirSync7, readdirSync as readdirSync8, statSync as statSync5, writeFileSync as writeFileSync6 } from "fs";
+import { mkdirSync as mkdirSync7, readdirSync as readdirSync8, statSync as statSync4, writeFileSync as writeFileSync6 } from "fs";
 import { join as join11 } from "path";
-import { readdirSync as readdirSync9, readFileSync as readFileSync13, statSync as statSync6 } from "fs";
+import { readdirSync as readdirSync9, readFileSync as readFileSync13, statSync as statSync5 } from "fs";
 import { join as join12, resolve as resolve8 } from "path";
 import { load as yamlLoad } from "js-yaml";
 import { randomUUID as randomUUID6 } from "crypto";
@@ -4893,39 +4897,46 @@ function writeTrace(db, workspacePath, eventType, payload, options) {
     const absoluteFilePath = join2(workspacePath, relativeFilePath);
     const tracesDir = join2(workspacePath, "audit", "traces");
     mkdirSync2(tracesDir, { recursive: true });
-    const lastLine = readLastLine(absoluteFilePath);
-    const prev_hash = lastLine !== null ? sha256Hex(lastLine) : null;
-    const envelope = {
-      timestamp,
-      event_type: eventType,
-      event_id,
-      correlation_id,
-      payload: safePayload,
-      prev_hash
-    };
-    const jsonLine = JSON.stringify(envelope);
-    let line_offset = 0;
-    if (existsSync4(absoluteFilePath)) {
-      try {
-        line_offset = statSync(absoluteFilePath).size;
-      } catch {
-        line_offset = 0;
-      }
-    }
-    appendFileSync(absoluteFilePath, jsonLine + "\n", "utf-8");
-    const stmt = db.prepare(
+    const insertStmt = db.prepare(
       `INSERT INTO traces (id, event_type, correlation_id, timestamp, file_path, line_offset, summary)
        VALUES (?, ?, ?, ?, ?, ?, ?)`
     );
-    stmt.run(
-      event_id,
-      eventType,
-      correlation_id,
-      timestamp,
-      relativeFilePath,
-      line_offset,
-      summary
-    );
+    const writeAndIndex = db.transaction(() => {
+      const lastLine = readLastLine(absoluteFilePath);
+      const prev_hash = lastLine !== null ? sha256Hex(lastLine) : null;
+      const envelope2 = {
+        timestamp,
+        event_type: eventType,
+        event_id,
+        correlation_id,
+        payload: safePayload,
+        prev_hash
+      };
+      const jsonLine = JSON.stringify(envelope2);
+      const fd = openSync(
+        absoluteFilePath,
+        fsConstants.O_CREAT | fsConstants.O_APPEND | fsConstants.O_WRONLY,
+        384
+      );
+      let line_offset;
+      try {
+        line_offset = fstatSync(fd).size;
+        writeSync(fd, jsonLine + "\n");
+      } finally {
+        closeSync(fd);
+      }
+      insertStmt.run(
+        event_id,
+        eventType,
+        correlation_id,
+        timestamp,
+        relativeFilePath,
+        line_offset,
+        summary
+      );
+      return envelope2;
+    });
+    const envelope = writeAndIndex.exclusive();
     appendToAuditLog(workspacePath, timestamp, eventType, summary);
     return ok(envelope);
   } catch (e) {
@@ -5674,7 +5685,7 @@ function promoteArtifact(db, workspacePath, input) {
   }
   let fileSize;
   try {
-    fileSize = statSync2(absoluteSource).size;
+    fileSize = statSync(absoluteSource).size;
   } catch {
     return err(new PromotionError("FILE_NOT_FOUND", `Cannot stat source file: ${relativeSource}`));
   }
@@ -6096,7 +6107,7 @@ function atomicWriteSpool(outDirAbs, filename, jsonlBody, candidateIds, emittedA
   try {
     writeFileSync5(spoolTmp, jsonlBody, "utf-8");
     renameSync2(spoolTmp, spoolFile);
-    const bytes = statSync4(spoolFile).size;
+    const bytes = statSync3(spoolFile).size;
     const sha256 = createHash4("sha256").update(jsonlBody, "utf-8").digest("hex");
     const manifest = {
       schemaVersion,
@@ -6425,7 +6436,7 @@ function countFiles(dirPath) {
     const files = [];
     for (const entry of entries) {
       try {
-        const s = statSync5(join11(dirPath, entry));
+        const s = statSync4(join11(dirPath, entry));
         if (s.isFile()) {
           files.push(entry);
         }
@@ -11435,7 +11446,7 @@ function register4(program) {
 }
 
 // src/commands/ingest.ts
-import { copyFileSync, existsSync as existsSync24, mkdirSync as mkdirSync9, readdirSync as readdirSync12, statSync as statSync3 } from "fs";
+import { copyFileSync, existsSync as existsSync24, mkdirSync as mkdirSync9, readdirSync as readdirSync12, statSync as statSync2 } from "fs";
 import { basename as basename6, extname, join as join16, relative as relative3 } from "path";
 import { createInterface } from "readline";
 var SIZE_LIMITS = {
@@ -11504,7 +11515,7 @@ function runIngest(filePath, ingestOpts, globalOpts) {
   }
   let fileSize;
   try {
-    fileSize = statSync3(filePath).size;
+    fileSize = statSync2(filePath).size;
   } catch (e) {
     return { ok: false, error: e instanceof Error ? e : new Error(String(e)) };
   }
@@ -11665,7 +11676,7 @@ function register5(program) {
       ...globalOpts.workspace !== void 0 && { workspace: globalOpts.workspace }
     };
     const skipConfirm = opts.yes === true || globalOpts.yes === true;
-    const pathStat = statSync3(filePath, { throwIfNoEntry: false });
+    const pathStat = statSync2(filePath, { throwIfNoEntry: false });
     if (pathStat?.isDirectory()) {
       const files = scanDirectory(filePath);
       if (files.length === 0) {
@@ -11683,7 +11694,7 @@ function register5(program) {
         if (!skipConfirm && process.stdin.isTTY) {
           let fileSize = 0;
           try {
-            fileSize = statSync3(file).size;
+            fileSize = statSync2(file).size;
           } catch {
           }
           const previewType = detectSourceType2(file);
@@ -11729,7 +11740,7 @@ function register5(program) {
       }
       let fileSize = 0;
       try {
-        fileSize = statSync3(filePath).size;
+        fileSize = statSync2(filePath).size;
       } catch {
       }
       const previewType = detectSourceType2(filePath);