muse-crew 0.14.4 → 0.14.6

package/lib/verify-publish.js

@@ -1,414 +0,0 @@
-#!/usr/bin/env node
-// verify-publish.js — deterministic parent publish verifier.
-//
-// The parent never eyeballs an inspection report. This script takes the
-// read-back inspection's result JSON and MECHANICALLY decides the verdict:
-// it parses the machine-readable findings block, compares every
-// added/removed diff line against the reported present/absent verdicts
-// (with mechanically computed collision exemptions for lines that also
-// occur in untouched code and therefore have zero discriminating power),
-// checks supersession via git, and only then stamps provenance, logs the
-// terminal event, and re-queues the task.
-//
-// The sensor is the deterministic lib/readback-disk.js (it reads the
-// on-disk tree the artifact is built/served from); this code is the judge.
-// The LLM inspector driven by lib/build-readback-request.js is retained
-// only as the manual fallback for environments without disk access.
-// Unparseable findings, content mismatches, unverifiable changes (binary
-// files, mode-only changes, renames, fully-colliding hunks), supersession,
-// and stamp failures all fail CLOSED with a terminal parent verdict —
-// never a stamp.
-//
-// Usage:
-//   node verify-publish.js --crew-home <path> --task-id <uuid>
-//       --commit <sha> --base <sha> --repo-path <path> --slug <slug>
-//       --crew-release <release> --inspection-id <uuid> --result-file <path>
-//       --project-id <project-id> [--build-agent-id <uuid>]
-//
-// --base is the previously-stamped provenance source_commit (or the
-// empty-tree sha 4b825dc642cb6eb9a060e54bf8d69288fbee4904 for a first
-// publish). It MUST be the same base the read-back request was built
-// with: the verifier checks the inspector's findings against the
-// base..commit diff, and a mismatched base would compare the findings
-// against the wrong expected change. See the --base contract in
-// lib/build-readback-request.js (push-time reconcile merges break the
-// old commit^1 assumption, 2026-09-14, task 0c53af4e).
-//
-// Exit codes: 0 verified · 1 verification failed (terminal verdict logged) ·
-// 2 usage/validation.
-
-import { execFileSync } from "node:child_process";
-import { readFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
-// Shared content-judgment primitives (2026-09-18, blocker 15): the same
-// diff parser, findings parser, and collision-exemption rules the
-// unknown-recovery classifier uses — one judgment, never two copies.
-import {
-  EMPTY_TREE,
-  parseDiff,
-  parseFindings,
-  makeOldCounter,
-  discriminatingLines,
-} from "./publish-content.js";
-// Terminal-note vocabulary (D7, 2026-09-19): the writer-side guard.
-// terminal() asserts its emitted verb is a registry member before writing,
-// so no future terminal verb ships unrecognized by the scans.
-import { matchTerminalPublishNote } from "./publish-note-vocabulary.js";
-
-// --help: before required-arg parsing (shebang⇔CLI contract).
-if (process.argv.slice(2).includes("--help")) {
-  console.log(
-    "usage: node verify-publish.js --repo-path <path> --commit <sha> --base <sha> --task-id <uuid> --slug <artifact-slug> --project-id <id> [--spaces-root <dir>]\n" +
-    "the mechanical publish verification JUDGE: certifies read-back findings against git diff, checks manifest freshness, stamps provenance"
-  );
-  process.exit(0);
-}
-
-function arg(name, required = true) {
-  const i = process.argv.indexOf(name);
-  if (i < 0 || i + 1 >= process.argv.length) {
-    if (!required) return null;
-    fail("usage", `${name} is required.`, 2);
-  }
-  return process.argv[i + 1];
-}
-function fail(code, message, exitCode) {
-  process.stderr.write(JSON.stringify({ ok: false, error: code, message }) + "\n");
-  process.exit(exitCode);
-}
-
-const crewHome = arg("--crew-home");
-const taskId = arg("--task-id");
-const commit = arg("--commit");
-const base = arg("--base");
-const repoPath = arg("--repo-path");
-const slug = arg("--slug");
-const inspectionId = arg("--inspection-id");
-const resultFile = arg("--result-file");
-const crewRelease = arg("--crew-release");
-const buildAgentId = arg("--build-agent-id", false);
-const projectId = arg("--project-id");
-const attempt = arg("--attempt", false);  // 2026-09-18, blocker 4: exact attempt binding
-const spacesRoot = arg("--spaces-root", false) || join(homedir(), "workspace", "ts-spaces");
-
-if (!/^[0-9a-f]{40}$/.test(commit)) fail("usage", "commit must be a 40-char hex sha.", 2);
-if (!/^[0-9a-f]{40}$/.test(base)) fail("usage", "base must be a 40-char hex sha.", 2);
-
-const crewApi = join(crewHome, "lib", "crew-api.js");
-function api(command, json) {
-  const out = execFileSync("node", [crewApi, "--crew-home", crewHome, command, "--json", JSON.stringify(json)], {
-    encoding: "utf8", maxBuffer: 4 * 1024 * 1024,
-  });
-  return JSON.parse(out);
-}
-// The terminal verdict this writer emits. A single const (not an inline
-// literal) so the emitted verb and the asserted verb can never drift apart.
-const TERMINAL_VERB = "publish: verification-failed";
-function terminal(reason, detail) {
-  // Always lands a terminal parent verdict, then exits 1 (failed) — the
-  // task stays parked for human attention. Only the verified path exits 0.
-  // Writer-side registry guard (D7): the verb is in the terminal-note
-  // registry before the note is written — a writer can never introduce a
-  // terminal verb the scans don't recognize.
-  if (!matchTerminalPublishNote(TERMINAL_VERB)) {
-    // Registry and writer disagree — fail loud, never emit an unrecognized
-    // terminal note.
-    process.stderr.write(JSON.stringify({
-      ok: false, verdict: "vocabulary-mismatch",
-      message: `terminal verb '${TERMINAL_VERB}' is not in the terminal-note registry`,
-    }) + "\n");
-    process.exit(2);
-  }
-  const msg = `${TERMINAL_VERB} ${commit} ${reason}${detail ? ` — ${detail}` : ""} (read-back ${inspectionId})`;
-  api("log-event", { task_id: taskId, type: "note", message: msg.slice(0, 1000) });
-  process.stderr.write(JSON.stringify({ ok: false, verdict: reason, message: msg }) + "\n");
-  process.exit(1);
-}
-
-// --- 1. Load the inspection result and extract the findings text ---------
-// The tick worker saves the FULL async result — which may be the inspector's
-// raw prose or a JSON envelope wrapping it (the platform's async handoff
-// shape). The findings block is located mechanically, never assumed:
-//   - raw text (not JSON): the whole file is the one candidate.
-//   - JSON: every string leaf is a candidate (depth-first, encounter order),
-//     recursing into double-encoded JSON strings (bounded depth).
-// The winning candidate is the one whose findings cover the most files from
-// the expected diff — so an echoed request template or stray prose never
-// outranks the real findings block. No candidate with real paths =>
-// unreadable-result, fail closed.
-let resultText;
-try {
-  resultText = readFileSync(resultFile, "utf8");
-} catch (e) {
-  fail("usage", `cannot read result file: ${e.message}`, 2);
-}
-
-function collectCandidates(value, depth, out) {
-  if (depth > 4 || out.length > 64) return;
-  if (typeof value === "string") {
-    out.push(value);
-    const t = value.trim();
-    if ((t.startsWith("{") && t.endsWith("}")) || (t.startsWith("[") && t.endsWith("]"))) {
-      try { collectCandidates(JSON.parse(t), depth + 1, out); } catch { /* not JSON */ }
-    }
-  } else if (Array.isArray(value)) {
-    for (const v of value) collectCandidates(v, depth, out);
-  } else if (value && typeof value === "object") {
-    for (const v of Object.values(value)) collectCandidates(v, depth, out);
-  }
-}
-
-let candidates;
-try {
-  const parsed = JSON.parse(resultText);
-  candidates = [];
-  collectCandidates(parsed, 0, candidates);
-  if (candidates.length === 0) candidates = [resultText];
-} catch {
-  candidates = [resultText];
-}
-
-// The inspector was instructed to emit a machine-readable block:
-//   FILE: <path>
-//   ADDED: <line> :: PRESENT|ABSENT
-//   REMOVED: <line> :: PRESENT|ABSENT
-//   END_FILE
-// (parsed by the shared parseFindings in lib/publish-content.js)
-
-// --- 2. Expected diff from git (never from the builder's report) -----------
-// The expected change is the publish delta base..commit, using the SAME
-// base the read-back request was built with. A base that is not an
-// ancestor of commit is a usage error (exit 2, no terminal verdict — this
-// is a procedural input problem, not a content failure).
-if (base !== EMPTY_TREE) {
-  const anc = (() => { try {
-    execFileSync("git", ["-C", repoPath, "merge-base", "--is-ancestor", base, commit], { stdio: "ignore" });
-    return true;
-  } catch { return false; } })();
-  if (!anc) fail("usage", `base ${base} is not an ancestor of commit ${commit} — refusing to verify against an unrelated tree.`, 2);
-}
-let diff;
-try {
-  diff = execFileSync("git", ["-C", repoPath, "diff", base, commit, "--"], {
-    encoding: "utf8", maxBuffer: 4 * 1024 * 1024,
-  });
-} catch (e) {
-  terminal("read-back-unavailable", `git diff failed: ${e.message}`);
-}
-const expected = parseDiff(diff); // path -> { added: [], removed: [], isBinary: bool }
-
-// --- 3. Pick the findings candidate that covers the expected diff -----------
-let findings = null;
-let bestScore = -1;
-let malformedNote = null;
-for (const cand of candidates) {
-  const { findings: f, malformed } = parseFindings(cand);
-  if (f.size === 0) continue;
-  let score = 0;
-  for (const p of f.keys()) if (expected.has(p)) score++;
-  if (malformed && score > 0) malformedNote = malformed;
-  if (score > bestScore) { bestScore = score; findings = f; }
-}
-if (malformedNote && findings) terminal("unreadable-result", malformedNote);
-if (!findings || bestScore <= 0) {
-  terminal("unreadable-result", "no machine-readable FILE blocks covering the expected diff in inspection result");
-}
-
-// --- 4. Mechanical comparison ----------------------------------------------
-// Collision exemption (2026-09-15, task 00bca4b8): a removed diff line that
-// also occurs verbatim in untouched code has zero discriminating power —
-// its presence in the new file cannot tell "old block removed" from "old
-// block present". Task 1d692d91 parked a valid publish because two removed
-// lines (`          return (`, `              </div>`) occur identically in
-// the untouched WorkflowSteps component; the naive every-removed-line-ABSENT
-// rule failed closed on zero signal.
-//
-// The exemption is mechanically computed and signal-preserving: for file F,
-// line L is exempt iff L occurs in F's old tree (at <base>) strictly more
-// times than the expected diff removes it. An exempted line must survive in
-// untouched code no matter what, so exempting it can never turn a missed
-// removal into a pass. No change to the sensor: build-readback-request.js
-// still reports whole-file PRESENT/ABSENT honestly; only this judge gets
-// smarter.
-// Collision exemption (2026-09-15, task 00bca4b8) — decided once by the
-// shared lib/publish-content.js so the verifier and the unknown-recovery
-// classifier can never disagree about what a diff proves:
-//
-// - a removed diff line that also occurs verbatim in untouched code has
-//   zero discriminating power — its presence in the new file cannot tell
-//   "old block removed" from "old block present";
-// - an added line that already occurs in the old tree is reported PRESENT
-//   whether or not the new hunk actually landed — same zero power.
-//
-// Exempting a line can never turn a missed change into a pass: an exempted
-// line must survive in untouched code no matter what. No change to the
-// sensor: build-readback-request.js still reports whole-file PRESENT/ABSENT
-// honestly; only this judge gets smarter. The occurrence counts are
-// computed from `git show <base>:<path>` (never the working tree) by the
-// shared makeOldCounter; the diff may remove the same line more than once
-// and the budget accounting lives in the shared discriminatingLines.
-const oldCount = makeOldCounter(repoPath, base);
-const disc = discriminatingLines(expected, oldCount);
-const discAdded = new Map(); // path -> Set(line): discriminating added lines
-const discRemoved = new Map(); // path -> Set(line): discriminating removed lines
-for (const [p, d] of disc) {
-  discAdded.set(p, new Set(d.addedDisc));
-  discRemoved.set(p, new Set(d.removedDisc));
-}
-
-let exempted = 0;
-for (const [path, exp] of expected) {
-  const found = findings.get(path);
-  if (!found) terminal("content-mismatch", `no findings for changed file ${path}`);
-  // (2026-09-16, critic finding 1) Binary files, mode-only changes, and
-  // renames produce zero added/removed lines: the loops below would
-  // iterate over empty arrays and the stamp would issue with "all added
-  // lines PRESENT, all removed lines ABSENT" — vacuously true, content
-  // never read. The line-based judge cannot verify these changes, so they
-  // fail closed as unverifiable (never stamped); a human verifies.
-  if (exp.added.length === 0 && exp.removed.length === 0) {
-    terminal("unverifiable-content",
-      `${exp.isBinary ? "binary file" : "no content lines (mode-only change or rename)"} ${path}: ` +
-      "the diff carries no added/removed lines for this file, so the line-based read-back checked nothing — " +
-      "provenance NOT stamped; human verification needed");
-  }
-  // (2026-09-16, critic finding 5) Added-line collisions: require at least
-  // one discriminating added line per file, or the added-side check is
-  // vacuous (finding 1's class).
-  let discriminatingAdded = 0;
-  for (const line of exp.added) {
-    const v = found.added.get(line);
-    if (v === undefined) terminal("unreadable-result", `no ADDED finding for line in ${path}: ${line.slice(0, 60)}`);
-    if (!discAdded.get(path).has(line)) {
-      exempted += 1; // colliding pre-existing line: zero signal, cannot fail a good publish
-      continue;
-    }
-    discriminatingAdded += 1;
-    if (v !== "PRESENT") terminal("content-mismatch", `added line ABSENT in ${path}: ${line.slice(0, 80)}`);
-  }
-  if (exp.added.length > 0 && discriminatingAdded === 0) {
-    terminal("unverifiable-content",
-      `all ${exp.added.length} added line(s) in ${path} already occur in the old tree: ` +
-      "their PRESENT findings cannot tell \"hunk landed\" from \"hunk dropped\" — " +
-      "provenance NOT stamped; human verification needed");
-  }
-  for (const line of exp.removed) {
-    const v = found.removed.get(line);
-    if (v === undefined) terminal("unreadable-result", `no REMOVED finding for line in ${path}: ${line.slice(0, 60)}`);
-    if (v === "ABSENT") continue;
-    if (!discRemoved.get(path).has(line)) {
-      exempted += 1; // colliding pre-existing line: zero signal, cannot fail a good publish
-      continue;
-    }
-    terminal("content-mismatch", `removed line PRESENT in ${path}: ${line.slice(0, 80)}`);
-  }
-}
-
-// --- 5. Supersession ---------------------------------------------------------
-let head;
-try {
-  head = execFileSync("git", ["-C", repoPath, "rev-parse", "HEAD"], { encoding: "utf8" }).trim();
-} catch (e) {
-  terminal("read-back-unavailable", `git rev-parse HEAD failed: ${e.message}`);
-}
-if (head !== commit) {
-  terminal("superseded", `HEAD is ${head}, not ${commit} — a newer publish supersedes this one`);
-}
-
-// --- 5b. Manifest freshness (design §1.9) ------------------------------------
-// The stamp certifies that a NEW build landed for this attempt — not a
-// replayed manifest. The workflow snapshots the pre-trigger manifest into
-// the submitted ledger entry; require (a) the current manifest's built_at
-// advanced past the trigger, and (b) its content_sha256 differs from the
-// pre-trigger baseline (a new build identity). A missing baseline fails
-// closed — without it, freshness cannot be proven.
-// 2026-09-18, blocker 4: bind by exact (task_id, commit, attempt) when the
-// attempt is known — the original and retry attempts share a commit, and
-// positional selection is luck. Within one attempt, select the OLDEST
-// submitted entry (the trigger issuance; a receipt-bearing second "submitted"
-// may follow it — the oldest binds the trigger instant, the latest carries
-// the observed agent_id).
-// D1 (2026-09-19; entry_kind cut 2026-09-20): the trigger instant is the
-// ISSUANCE instant, not the ledger-write instant — a slow ledger write must
-// not make a fresh build look stale (room #23 J1). The anchor is the OLDEST
-// submitted entry by ts and the bound instant is its issued_at (falling back
-// to its ts when the capture was unobserved). One anchor, one field — the
-// retired entry_kind preference filter could never change the bound anchor
-// (issuance and receipt entries carried the same captured issued_at), so the
-// oldest-by-ts selection is the whole mechanism.
-let triggerTs = null;
-let manifestBefore = null;
-try {
-  const ledgerText = readFileSync(join(crewHome, ".publish-ledger", slug + ".jsonl"), "utf8");
-  const entries = ledgerText.split("\n").filter((l) => l.trim()).map((l) => JSON.parse(l));
-  // Collect all submitted entries matching (task_id, commit[, attempt]).
-  const candidates = entries.filter((e) =>
-    e.task_id === taskId &&
-    e.outcome === "submitted" &&
-    e.commit === commit &&
-    (attempt == null || e.attempt === attempt)
-  );
-  if (candidates.length > 0) {
-    candidates.sort((a, b) => (a.ts || "").localeCompare(b.ts || ""));
-    const e = candidates[0];
-    triggerTs = e.issued_at || e.ts || null;
-    if (e.manifest_before && typeof e.manifest_before === "object") manifestBefore = e.manifest_before;
-  }
-} catch (e) {
-  terminal("read-back-unavailable", `cannot read publish ledger for freshness check: ${e.message}`);
-}
-if (!triggerTs) {
-  terminal("read-back-unavailable", `no submitted ledger entry for commit ${commit} — the trigger instant is unknowable; freshness cannot be proven`);
-}
-if (!manifestBefore || typeof manifestBefore.content_sha256 !== "string") {
-  terminal("unverifiable-content", `no pre-trigger manifest baseline in the submitted ledger entry — freshness cannot be proven; provenance NOT stamped; human verification needed`);
-}
-let currentManifest = null;
-try {
-  const manifestText = readFileSync(join(spacesRoot, slug, ".space-build", "manifest.json"), "utf8");
-  currentManifest = JSON.parse(manifestText);
-} catch (e) {
-  terminal("read-back-unavailable", `cannot read current manifest for freshness check: ${e.message}`);
-}
-const currentBuiltAtMs = currentManifest && currentManifest.built_at ? Date.parse(currentManifest.built_at) : NaN;
-const triggerMs = Date.parse(triggerTs);
-if (!(currentBuiltAtMs > triggerMs)) {
-  terminal("unverifiable-content", `current manifest built_at ${currentManifest && currentManifest.built_at} did not advance past trigger ${triggerTs} — no new build for this attempt; provenance NOT stamped`);
-}
-if (typeof currentManifest.content_sha256 !== "string" || currentManifest.content_sha256 === manifestBefore.content_sha256) {
-  terminal("unverifiable-content", `current manifest content_sha256 is unchanged from the pre-trigger baseline — a replayed manifest, not a new build; provenance NOT stamped; human verification needed`);
-}
-
-// --- 6. Build-ID correlation (informational; the stamp certifies content) ---
-let buildNote = "build-id-unobserved";
-if (buildAgentId && resultText.includes(buildAgentId)) buildNote = `build-id-correlated ${buildAgentId}`;
-
-// --- 7. Stamp (only after the machine-checked comparison succeeded) ---------
-let stamp;
-try {
-  stamp = api("set-provenance", { project_id: projectId, source_commit: commit, crew_release: crewRelease, task_id: taskId });
-} catch (e) {
-  terminal("stamp-failed", `set-provenance threw: ${e.message}`);
-}
-if (!stamp || stamp.ok !== true) terminal("stamp-failed", "set-provenance did not return ok");
-// Exact read-back: the stamp must match what we intended, or it is fiction.
-let prov;
-try {
-  prov = api("get-provenance", { project_id: projectId });
-} catch (e) {
-  terminal("stamp-failed", `get-provenance threw: ${e.message}`);
-}
-const p = prov && prov.provenance;
-if (!p || p.source_commit !== commit || p.task_id !== taskId || p.crew_release !== crewRelease) {
-  terminal("stamp-failed", `provenance read-back mismatch: ${JSON.stringify(p)}`);
-}
-
-// --- 8. Terminal verified event + re-queue -----------------------------------
-const verifiedMsg =
-  `publish: verified ${commit} (${inspectionId}) — read-back: all added lines PRESENT, all removed lines ABSENT` +
-  (exempted > 0 ? ` (${exempted} colliding line${exempted === 1 ? "" : "s"} exempted as non-discriminating)` : "") +
-  `; ${buildNote}; no supersession (HEAD=${commit}).`;
-api("log-event", { task_id: taskId, type: "note", message: verifiedMsg.slice(0, 1000) });
-api("update-task", { id: taskId, state: "in_progress" });
-process.stdout.write(JSON.stringify({ ok: true, verdict: "verified", commit, build_note: buildNote }) + "\n");