nexus-agents 2.132.0 → 2.133.0

package/dist/{chunk-I2SW34K6.js → chunk-4CVITS5D.js}

@@ -787,9 +787,9 @@ function createKeyedSerializer() {
 }
 function raceWithDeadline(p, role, deadlineMs) {
   let timer;
-  const timeoutP = new Promise((resolve) => {
+  const timeoutP = new Promise((resolve2) => {
     timer = setTimeout(() => {
-      resolve(createErrorVoteResult(role, DEADLINE_MESSAGE, deadlineMs));
+      resolve2(createErrorVoteResult(role, DEADLINE_MESSAGE, deadlineMs));
     }, deadlineMs);
   });
   return Promise.race([p, timeoutP]).finally(() => {
@@ -4298,7 +4298,7 @@ function applyErrorPolicy(votes, policy) {
 
 // src/audit/vote-record-store.ts
 import { appendFileSync as appendFileSync2, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2 } from "fs";
-import { dirname, join } from "path";
+import { dirname, isAbsolute, join, resolve } from "path";
 
 // src/audit/vote-record.ts
 import * as crypto from "crypto";
@@ -4316,10 +4316,17 @@ var VoteRecordCountsSchema = z7.object({
   total: z7.number().int().nonnegative()
 }).strict();
 var VoteRecordSchema = z7.object({
-  /** Schema version for forward migrations. */
-  version: z7.literal("1.0"),
+  /** Schema version. '1.1' marks the chain→record-set+sequence model (#3927). */
+  version: z7.literal("1.1"),
   /** Unique record id (also usable as a `ratificationVoteRef`). */
   id: z7.string().min(1),
+  /**
+   * Monotonic sequence number (integer ≥ 0). Assigned as (max existing
+   * sequence)+1 at write time. Sorted, the set of sequences must cover
+   * 0..maxSeq with no gap (omission detection); DUPLICATE sequences are a
+   * benign concurrent-fork signal, not tampering.
+   */
+  sequence: z7.number().int().nonnegative(),
   /** ISO-8601 timestamp the vote was recorded. */
   recordedAt: z7.string().min(1),
   /**
@@ -4350,29 +4357,40 @@ var VoteRecordSchema = z7.object({
   voters: z7.array(VoterSummarySchema),
   /** Optional correlation/decision id linking to the cost rollup / trace. */
   correlationId: z7.string().min(1).optional(),
-  /** Hash of the previous record in the chain (absent for the first). */
+  /**
+   * ADVISORY hash of the tip record at write time (absent for the first).
+   * Retained for audit texture but NOT covered by `hash` and NOT verified —
+   * the record-set model is position-independent (#3927).
+   */
   previousHash: z7.string().length(64).optional(),
-  /** SHA-256 over every field above + previousHash. */
+  /** SHA-256 over every field above EXCEPT `previousHash` (and except `hash`). */
   hash: z7.string().length(64)
 }).strict();
 function computeVoteRecordHash(payload) {
   const canonical = JSON.stringify({
     version: payload.version,
     id: payload.id,
+    sequence: payload.sequence,
     recordedAt: payload.recordedAt,
     proposalHash: payload.proposalHash,
     proposal: payload.proposal,
     strategy: payload.strategy,
     decision: payload.decision,
     approvalPercentage: payload.approvalPercentage,
-    voteCounts: payload.voteCounts,
+    // Rebuild voteCounts in schema order (approve, reject, abstain, total) so the
+    // hash does not depend on how the nested object's keys were ordered (#3962).
+    voteCounts: {
+      approve: payload.voteCounts.approve,
+      reject: payload.voteCounts.reject,
+      abstain: payload.voteCounts.abstain,
+      total: payload.voteCounts.total
+    },
     voters: payload.voters.map((v) => ({
       role: v.role,
       decision: v.decision,
       confidence: v.confidence
     })),
-    correlationId: payload.correlationId ?? null,
-    previousHash: payload.previousHash ?? null
+    correlationId: payload.correlationId ?? null
   });
   return crypto.createHash("sha256").update(canonical).digest("hex");
 }
@@ -4382,6 +4400,7 @@ function hashProposal(proposal) {
 
 // src/audit/vote-record-store.ts
 var VOTE_RECORDS_REL_PATH = "governance/vote-records.jsonl";
+var VOTE_RECORDS_PATH_ENV = "NEXUS_VOTE_RECORDS_PATH";
 var MAX_PROPOSAL_RECORD_CHARS = 500;
 function outcomeToDecision(result) {
   if (result.outcome === "approved") return "approved";
@@ -4400,8 +4419,9 @@ function toVoterSummaries(votes) {
 function buildVoteRecord(input) {
   const proposalTruncated = input.proposal.length > MAX_PROPOSAL_RECORD_CHARS ? input.proposal.slice(0, MAX_PROPOSAL_RECORD_CHARS) + "..." : input.proposal;
   const payload = {
-    version: "1.0",
+    version: "1.1",
     id: input.id,
+    sequence: input.sequence ?? 0,
     recordedAt: input.recordedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
     proposalHash: hashProposal(input.proposal),
     proposal: proposalTruncated,
@@ -4420,21 +4440,27 @@ function buildVoteRecord(input) {
   };
   return { ...payload, hash: computeVoteRecordHash(payload) };
 }
-function readLastHash(filePath, logger10) {
-  if (!existsSync2(filePath)) return void 0;
+function readLedgerTip(filePath, logger10) {
+  if (!existsSync2(filePath)) return { maxSequence: -1, lastHash: void 0 };
   try {
-    const content = readFileSync2(filePath, "utf-8");
-    const lines = content.split("\n").filter((l) => l.trim() !== "");
-    const last = lines[lines.length - 1];
-    if (last === void 0) return void 0;
-    const parsed = VoteRecordSchema.safeParse(JSON.parse(last));
-    return parsed.success ? parsed.data.hash : void 0;
+    const { records } = readVoteRecords(filePath);
+    if (records.length === 0) return { maxSequence: -1, lastHash: void 0 };
+    let maxSequence = -1;
+    for (const record of records) {
+      if (record.sequence > maxSequence) maxSequence = record.sequence;
+    }
+    const last = records[records.length - 1];
+    return { maxSequence, lastHash: last?.hash };
   } catch (error) {
-    logger10.warn("Failed to read prior vote record hash", { error: getErrorMessage(error) });
-    return void 0;
+    logger10.warn("Failed to read vote-record ledger tip", { error: getErrorMessage(error) });
+    return { maxSequence: -1, lastHash: void 0 };
   }
 }
 function resolveVoteRecordsPath() {
+  const envPath = process.env[VOTE_RECORDS_PATH_ENV];
+  if (envPath !== void 0 && envPath.trim() !== "") {
+    return isAbsolute(envPath) ? envPath : resolve(envPath);
+  }
   const root = findRepoRoot(process.cwd());
   if (root === null) return void 0;
   return join(root, VOTE_RECORDS_REL_PATH);
@@ -4443,13 +4469,20 @@ function persistVoteRecord(opts) {
   const logger10 = opts.logger ?? createLogger({ component: "vote-record-store" });
   const filePath = opts.filePath ?? resolveVoteRecordsPath();
   if (filePath === void 0) {
-    logger10.debug("No committable repo root; skipping authentic vote record persist");
+    logger10.warn(
+      `Authentic vote record NOT persisted: no repo root found from process.cwd() and no override set. Per #3927 the authoritative population path is caller-commits \u2014 commit the returned record bytes into ${VOTE_RECORDS_REL_PATH} in the promotion PR. To force a server-side write, set ${VOTE_RECORDS_PATH_ENV} to an absolute file path.`,
+      { id: opts.id }
+    );
     return void 0;
   }
   try {
     mkdirSync2(dirname(filePath), { recursive: true });
-    const previousHash = readLastHash(filePath, logger10);
-    const record = buildVoteRecord({ ...opts, previousHash });
+    const { maxSequence, lastHash } = readLedgerTip(filePath, logger10);
+    const record = buildVoteRecord({
+      ...opts,
+      sequence: maxSequence + 1,
+      previousHash: lastHash
+    });
     appendFileSync2(filePath, JSON.stringify(record) + "\n", "utf-8");
     logger10.info("Persisted authentic vote record", {
       id: record.id,
@@ -4465,6 +4498,22 @@ function persistVoteRecord(opts) {
     return void 0;
   }
 }
+function readVoteRecords(filePath) {
+  const records = [];
+  const invalidLines = [];
+  if (!existsSync2(filePath)) return { records, invalidLines };
+  const lines = readFileSync2(filePath, "utf-8").split("\n").filter((l) => l.trim() !== "");
+  for (const [i, line] of lines.entries()) {
+    try {
+      const parsed = VoteRecordSchema.safeParse(JSON.parse(line));
+      if (parsed.success) records.push(parsed.data);
+      else invalidLines.push(i + 1);
+    } catch {
+      invalidLines.push(i + 1);
+    }
+  }
+  return { records, invalidLines };
+}
 
 // src/orchestration/outcomes/outcome-store-persistence.ts
 import { appendFileSync as appendFileSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync2, existsSync as existsSync3 } from "fs";
@@ -5892,4 +5941,4 @@ export {
   CONSENSUS_VOTE_OUTPUT_SCHEMA,
   registerConsensusVoteTool
 };
-//# sourceMappingURL=chunk-I2SW34K6.js.map
+//# sourceMappingURL=chunk-4CVITS5D.js.map