nubos-pilot 1.2.0 → 1.2.2

package/lib/validate.cjs

@@ -0,0 +1,301 @@
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { NubosPilotError } = require('./core.cjs');
+
+const SCHEMA_DIR = path.join(__dirname, 'schemas', 'data');
+const PATTERN_INPUT_MAX = 64 * 1024;
+const _cache = new Map();
+
+function _hasOwn(obj, key) {
+  return Object.prototype.hasOwnProperty.call(obj, key);
+}
+
+function _deepFreeze(obj) {
+  if (obj && typeof obj === 'object' && !Object.isFrozen(obj)) {
+    Object.freeze(obj);
+    for (const key of Object.keys(obj)) _deepFreeze(obj[key]);
+  }
+  return obj;
+}
+
+function _deepEqual(a, b) {
+  if (a === b) return true;
+  if (typeof a !== typeof b) return false;
+  if (a === null || b === null) return a === b;
+  if (typeof a !== 'object') return false;
+  const aArr = Array.isArray(a);
+  if (aArr !== Array.isArray(b)) return false;
+  if (aArr) {
+    if (a.length !== b.length) return false;
+    for (let i = 0; i < a.length; i += 1) if (!_deepEqual(a[i], b[i])) return false;
+    return true;
+  }
+  const aKeys = Object.keys(a);
+  if (aKeys.length !== Object.keys(b).length) return false;
+  for (const key of aKeys) {
+    if (!_hasOwn(b, key) || !_deepEqual(a[key], b[key])) return false;
+  }
+  return true;
+}
+
+function _loadSchema(name) {
+  if (_cache.has(name)) return _cache.get(name);
+  if (!/^[a-z0-9][a-z0-9.\-]*$/.test(String(name))) {
+    throw new NubosPilotError(
+      'data-schema-not-found',
+      'Invalid data-schema name: ' + JSON.stringify(name),
+      { name },
+    );
+  }
+  const p = path.join(SCHEMA_DIR, name + '.json');
+  let raw;
+  try { raw = fs.readFileSync(p, 'utf-8'); }
+  catch (err) {
+    throw new NubosPilotError(
+      'data-schema-not-found',
+      'Unknown data schema: ' + String(name),
+      { name, cause: err && err.code, available: listSchemas() },
+    );
+  }
+  let schema;
+  try { schema = JSON.parse(raw); }
+  catch (err) {
+    throw new NubosPilotError(
+      'data-schema-corrupt',
+      'Data schema ' + name + '.json is not valid JSON: ' + (err && err.message),
+      { name },
+    );
+  }
+  _deepFreeze(schema);
+  _cache.set(name, schema);
+  return schema;
+}
+
+function listSchemas() {
+  let entries;
+  try { entries = fs.readdirSync(SCHEMA_DIR); }
+  catch { return []; }
+  return entries
+    .filter((f) => f.endsWith('.json'))
+    .map((f) => f.slice(0, -5))
+    .sort();
+}
+
+function _typeOf(value) {
+  if (value === null) return 'null';
+  if (Array.isArray(value)) return 'array';
+  if (Number.isInteger(value)) return 'integer';
+  return typeof value;
+}
+
+function _matchesType(value, type) {
+  if (type === 'integer') return typeof value === 'number' && Number.isInteger(value);
+  if (type === 'number') return typeof value === 'number' && Number.isFinite(value);
+  if (type === 'array') return Array.isArray(value);
+  if (type === 'object') return value !== null && typeof value === 'object' && !Array.isArray(value);
+  if (type === 'null') return value === null;
+  return typeof value === type;
+}
+
+function _segmentsToPath(segments) {
+  if (!segments.length) return '';
+  return '/' + segments.map((s) => String(s)).join('/');
+}
+
+function _lastNamed(segments) {
+  for (let i = segments.length - 1; i >= 0; i -= 1) {
+    if (typeof segments[i] === 'string') return segments[i];
+  }
+  return null;
+}
+
+function _firstIndex(segments) {
+  for (const s of segments) if (typeof s === 'number') return s;
+  return null;
+}
+
+function _push(errors, segments, keyword, message, extra) {
+  const err = {
+    instancePath: _segmentsToPath(segments),
+    keyword,
+    message,
+    field: _lastNamed(segments),
+    index: _firstIndex(segments),
+  };
+  if (extra) Object.assign(err, extra);
+  errors.push(err);
+}
+
+function _validateNode(value, schema, segments, errors) {
+  if (!schema || typeof schema !== 'object') return;
+
+  if ('const' in schema && !_deepEqual(value, schema.const)) {
+    _push(errors, segments, 'const', _label(segments) + ' must equal ' + JSON.stringify(schema.const),
+      { expected: schema.const, actual: value });
+    return;
+  }
+
+  if (schema.type) {
+    const types = Array.isArray(schema.type) ? schema.type : [schema.type];
+    if (!types.some((t) => _matchesType(value, t))) {
+      _push(errors, segments, 'type',
+        _label(segments) + ' must be ' + types.join(' or ') + ' (got ' + _typeOf(value) + ')',
+        { expected: schema.type, actual: _typeOf(value) });
+      return;
+    }
+  }
+
+  if (Array.isArray(schema.enum) && !schema.enum.some((e) => _deepEqual(e, value))) {
+    _push(errors, segments, 'enum',
+      _label(segments) + ' must be one of ' + JSON.stringify(schema.enum) + ' (got ' + JSON.stringify(value) + ')',
+      { expected: schema.enum, actual: value });
+  }
+
+  if (typeof value === 'string') _validateString(value, schema, segments, errors);
+  if (typeof value === 'number') _validateNumber(value, schema, segments, errors);
+  if (Array.isArray(value)) _validateArray(value, schema, segments, errors);
+  if (value !== null && typeof value === 'object' && !Array.isArray(value)) {
+    _validateObject(value, schema, segments, errors);
+  }
+}
+
+function _label(segments) {
+  const named = _lastNamed(segments);
+  const idx = _firstIndex(segments);
+  if (named && idx !== null && segments[segments.length - 1] === named) {
+    return named;
+  }
+  return named || (idx !== null ? '[' + idx + ']' : 'value');
+}
+
+function _validateString(value, schema, segments, errors) {
+  if (typeof schema.minLength === 'number' && value.length < schema.minLength) {
+    _push(errors, segments, 'minLength',
+      _label(segments) + ' must be at least ' + schema.minLength + ' characters',
+      { expected: schema.minLength, actual: value.length });
+  }
+  if (typeof schema.maxLength === 'number' && value.length > schema.maxLength) {
+    _push(errors, segments, 'maxLength',
+      _label(segments) + ' must be at most ' + schema.maxLength + ' characters',
+      { expected: schema.maxLength, actual: value.length });
+  }
+  if (typeof schema.maxBytes === 'number') {
+    const bytes = Buffer.byteLength(value, 'utf-8');
+    if (bytes > schema.maxBytes) {
+      _push(errors, segments, 'maxBytes',
+        _label(segments) + ' exceeds ' + schema.maxBytes + ' bytes (got ' + bytes + ')',
+        { expected: schema.maxBytes, actual: bytes });
+    }
+  }
+  if (typeof schema.pattern === 'string') {
+    if (value.length > PATTERN_INPUT_MAX) {
+      _push(errors, segments, 'pattern',
+        _label(segments) + ' is too long (' + value.length + ' chars) to match ' + schema.pattern,
+        { expected: schema.pattern, actual: value.length });
+    } else if (!new RegExp(schema.pattern).test(value)) {
+      _push(errors, segments, 'pattern',
+        _label(segments) + ' must match ' + schema.pattern,
+        { expected: schema.pattern, actual: value });
+    }
+  }
+}
+
+function _validateNumber(value, schema, segments, errors) {
+  if (typeof schema.minimum === 'number' && value < schema.minimum) {
+    _push(errors, segments, 'minimum',
+      _label(segments) + ' must be >= ' + schema.minimum + ' (got ' + value + ')',
+      { expected: schema.minimum, actual: value });
+  }
+  if (typeof schema.exclusiveMinimum === 'number' && value <= schema.exclusiveMinimum) {
+    _push(errors, segments, 'exclusiveMinimum',
+      _label(segments) + ' must be > ' + schema.exclusiveMinimum + ' (got ' + value + ')',
+      { expected: schema.exclusiveMinimum, actual: value });
+  }
+  if (typeof schema.maximum === 'number' && value > schema.maximum) {
+    _push(errors, segments, 'maximum',
+      _label(segments) + ' must be <= ' + schema.maximum + ' (got ' + value + ')',
+      { expected: schema.maximum, actual: value });
+  }
+}
+
+function _validateArray(value, schema, segments, errors) {
+  if (typeof schema.minItems === 'number' && value.length < schema.minItems) {
+    _push(errors, segments, 'minItems',
+      _label(segments) + ' must have at least ' + schema.minItems + ' items',
+      { expected: schema.minItems, actual: value.length });
+  }
+  if (typeof schema.maxItems === 'number' && value.length > schema.maxItems) {
+    _push(errors, segments, 'maxItems',
+      _label(segments) + ' must have at most ' + schema.maxItems + ' items',
+      { expected: schema.maxItems, actual: value.length });
+  }
+  if (schema.items) {
+    for (let i = 0; i < value.length; i += 1) {
+      _validateNode(value[i], schema.items, segments.concat(i), errors);
+    }
+  }
+}
+
+function _validateObject(value, schema, segments, errors) {
+  if (Array.isArray(schema.required)) {
+    for (const field of schema.required) {
+      if (!_hasOwn(value, field) || value[field] === undefined) {
+        _push(errors, segments.concat(field), 'required',
+          _objLabel(segments) + ' missing required field "' + field + '"',
+          { field });
+      }
+    }
+  }
+  const props = schema.properties || {};
+  const addl = schema.additionalProperties;
+  if (addl === false) {
+    for (const key of Object.keys(value)) {
+      if (!_hasOwn(props, key) && value[key] !== undefined) {
+        _push(errors, segments.concat(key), 'additionalProperties',
+          _objLabel(segments) + ' has unknown field "' + key + '"',
+          { field: key });
+      }
+    }
+  } else if (addl && typeof addl === 'object') {
+    for (const key of Object.keys(value)) {
+      if (!_hasOwn(props, key) && value[key] !== undefined) {
+        _validateNode(value[key], addl, segments.concat(key), errors);
+      }
+    }
+  }
+  for (const key of Object.keys(props)) {
+    if (_hasOwn(value, key) && value[key] !== undefined) {
+      _validateNode(value[key], props[key], segments.concat(key), errors);
+    }
+  }
+}
+
+function _objLabel(segments) {
+  const idx = _firstIndex(segments);
+  const named = _lastNamed(segments);
+  if (named) return named;
+  if (idx !== null) return '[' + idx + ']';
+  return 'object';
+}
+
+function validate(value, schemaName) {
+  const schema = typeof schemaName === 'string' ? _loadSchema(schemaName) : schemaName;
+  const errors = [];
+  _validateNode(value, schema, [], errors);
+  return errors;
+}
+
+function assertValid(value, schemaName, code, baseDetails) {
+  const errors = validate(value, schemaName);
+  if (errors.length === 0) return;
+  const first = errors[0];
+  throw new NubosPilotError(
+    code,
+    first.message,
+    Object.assign({ schema: schemaName, errors }, first, baseDetails || {}),
+  );
+}
+
+module.exports = { validate, assertValid, listSchemas, _loadSchema, SCHEMA_DIR };

package/lib/validate.test.cjs

@@ -0,0 +1,242 @@
+'use strict';
+
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+
+const { validate, assertValid, listSchemas, _loadSchema } = require('./validate.cjs');
+const { NubosPilotError } = require('./core.cjs');
+const learnings = require('./learnings.cjs');
+const memory = require('./memory.cjs');
+const messaging = require('./messaging.cjs');
+
+const RECORD = {
+  type: 'object',
+  required: ['fingerprint', 'occurrence'],
+  properties: {
+    fingerprint: { type: 'string', pattern: '^[a-f0-9]{16}$' },
+    occurrence: { type: 'integer', minimum: 1 },
+    pattern: { type: 'string', maxBytes: 8 },
+    status: { type: 'string', enum: ['a', 'b'] },
+    tags: { type: 'array', items: { type: 'string' } },
+  },
+};
+
+test('VAL-1: valid object yields no errors', () => {
+  assert.deepEqual(validate({ fingerprint: 'aaaaaaaaaaaaaaaa', occurrence: 3 }, RECORD), []);
+});
+
+test('VAL-2: missing required field reports field name', () => {
+  const errs = validate({ fingerprint: 'aaaaaaaaaaaaaaaa' }, RECORD);
+  assert.equal(errs.length, 1);
+  assert.equal(errs[0].keyword, 'required');
+  assert.equal(errs[0].field, 'occurrence');
+});
+
+test('VAL-3: type mismatch reports expected/actual', () => {
+  const errs = validate({ fingerprint: 'aaaaaaaaaaaaaaaa', occurrence: 'x' }, RECORD);
+  assert.equal(errs[0].keyword, 'type');
+  assert.equal(errs[0].field, 'occurrence');
+  assert.equal(errs[0].actual, 'string');
+});
+
+test('VAL-4: pattern mismatch', () => {
+  const errs = validate({ fingerprint: 'NOTHEX', occurrence: 1 }, RECORD);
+  assert.equal(errs[0].keyword, 'pattern');
+  assert.match(errs[0].message, /fingerprint/);
+});
+
+test('VAL-5: minimum violation', () => {
+  const errs = validate({ fingerprint: 'aaaaaaaaaaaaaaaa', occurrence: 0 }, RECORD);
+  assert.equal(errs[0].keyword, 'minimum');
+});
+
+test('VAL-6: non-integer rejected by integer type', () => {
+  const errs = validate({ fingerprint: 'aaaaaaaaaaaaaaaa', occurrence: 1.5 }, RECORD);
+  assert.equal(errs[0].keyword, 'type');
+});
+
+test('VAL-7: maxBytes counts UTF-8 bytes', () => {
+  const errs = validate({ fingerprint: 'aaaaaaaaaaaaaaaa', occurrence: 1, pattern: 'üüüüü' }, RECORD);
+  assert.equal(errs[0].keyword, 'maxBytes');
+  assert.equal(errs[0].actual, 10);
+});
+
+test('VAL-8: enum violation', () => {
+  const errs = validate({ fingerprint: 'aaaaaaaaaaaaaaaa', occurrence: 1, status: 'z' }, RECORD);
+  assert.equal(errs[0].keyword, 'enum');
+});
+
+test('VAL-9: nested array items validated with index in path', () => {
+  const errs = validate({ fingerprint: 'aaaaaaaaaaaaaaaa', occurrence: 1, tags: ['ok', 5] }, RECORD);
+  assert.equal(errs[0].keyword, 'type');
+  assert.equal(errs[0].index, 1);
+  assert.equal(errs[0].instancePath, '/tags/1');
+});
+
+test('VAL-10: assertValid throws NubosPilotError with given code and errors detail', () => {
+  assert.throws(
+    () => assertValid({ fingerprint: 'NOTHEX' }, RECORD, 'demo-corrupt', { path: '/tmp/x' }),
+    (err) => err instanceof NubosPilotError
+      && err.code === 'demo-corrupt'
+      && Array.isArray(err.details.errors)
+      && err.details.path === '/tmp/x',
+  );
+});
+
+test('VAL-11: assertValid is a no-op when valid', () => {
+  assert.doesNotThrow(() => assertValid({ fingerprint: 'aaaaaaaaaaaaaaaa', occurrence: 1 }, RECORD, 'demo-corrupt'));
+});
+
+test('VAL-12: unknown schema name throws data-schema-not-found', () => {
+  assert.throws(
+    () => validate({}, 'no-such-schema'),
+    (err) => err instanceof NubosPilotError && err.code === 'data-schema-not-found',
+  );
+});
+
+test('VAL-13: invalid schema name is rejected before fs access', () => {
+  assert.throws(
+    () => validate({}, '../etc/passwd'),
+    (err) => err instanceof NubosPilotError && err.code === 'data-schema-not-found',
+  );
+});
+
+test('VAL-14: learnings.v1 is registered and loadable', () => {
+  assert.ok(listSchemas().includes('learnings.v1'));
+  const schema = _loadSchema('learnings.v1');
+  assert.equal(schema.$id, 'learnings.v1');
+});
+
+test('VAL-15: learnings.v1 pattern maxBytes stays in sync with MAX_PATTERN_BYTES', () => {
+  const schema = _loadSchema('learnings.v1');
+  const patternSchema = schema.properties.learnings.items.properties.pattern;
+  assert.equal(
+    patternSchema.maxBytes,
+    learnings.MAX_PATTERN_BYTES,
+    'learnings.v1.json pattern.maxBytes drifted from learnings.MAX_PATTERN_BYTES',
+  );
+});
+
+test('VAL-16: learnings.v1 outcome maxBytes stays in sync with MAX_OUTCOME_BYTES', () => {
+  const schema = _loadSchema('learnings.v1');
+  const outcomeSchema = schema.properties.learnings.items.properties.outcome;
+  assert.equal(
+    outcomeSchema.maxBytes,
+    learnings.MAX_OUTCOME_BYTES,
+    'learnings.v1.json outcome.maxBytes drifted from learnings.MAX_OUTCOME_BYTES',
+  );
+});
+
+test('VAL-17: additionalProperties:false flags inherited-name own keys (no prototype-chain bypass)', () => {
+  const schema = { type: 'object', additionalProperties: false, properties: { a: { type: 'string' } } };
+  const input = JSON.parse('{"a":"x","constructor":1,"toString":1}');
+  const errs = validate(input, schema);
+  const unknown = errs.filter((e) => e.keyword === 'additionalProperties').map((e) => e.field).sort();
+  assert.deepEqual(unknown, ['constructor', 'toString']);
+});
+
+test('VAL-18: required is satisfied only by own properties, not Object.prototype members', () => {
+  const schema = { type: 'object', required: ['toString', 'fingerprint'] };
+  const errs = validate({}, schema);
+  const missing = errs.filter((e) => e.keyword === 'required').map((e) => e.field).sort();
+  assert.deepEqual(missing, ['fingerprint', 'toString']);
+});
+
+test('VAL-19: a property named like a prototype member does not validate the inherited value', () => {
+  const schema = { type: 'object', properties: { toString: { type: 'string' } } };
+  const errs = validate(JSON.parse('{"a":1}'), schema);
+  assert.deepEqual(errs, []);
+});
+
+test('VAL-20: pattern does not run on pathological oversized input (ReDoS guard)', () => {
+  const schema = { type: 'string', pattern: '^(a+)+$' };
+  const errs = validate('a'.repeat(70000) + '!', schema);
+  assert.equal(errs[0].keyword, 'pattern');
+  assert.match(errs[0].message, /too long/);
+});
+
+test('VAL-21: enum/const equality is key-order independent', () => {
+  const enumSchema = { enum: [{ a: 1, b: 2 }] };
+  assert.deepEqual(validate(JSON.parse('{"b":2,"a":1}'), enumSchema), []);
+  const constSchema = { const: { a: 1, b: 2 } };
+  assert.deepEqual(validate(JSON.parse('{"b":2,"a":1}'), constSchema), []);
+});
+
+test('VAL-23: memory-record.v1 type enum stays in sync with TYPE_ENUM', () => {
+  const schema = _loadSchema('memory-record.v1');
+  assert.deepEqual(schema.properties.type.enum, [...memory.TYPE_ENUM]);
+});
+
+test('VAL-24: memory-record.v1 provenance enum stays in sync with PROVENANCE_ENUM', () => {
+  const schema = _loadSchema('memory-record.v1');
+  const nonNull = schema.properties.provenance.enum.filter((e) => e !== null);
+  assert.deepEqual(nonNull, [...memory.PROVENANCE_ENUM]);
+  assert.ok(schema.properties.provenance.enum.includes(null));
+});
+
+test('VAL-25: memory-manifest.v1 accepts both init and rebuilt manifests', () => {
+  assert.deepEqual(validate({ schema_version: 1, model: 'm', dim: 384, alpha: 0.6, created_at: 'x' }, 'memory-manifest.v1'), []);
+  assert.deepEqual(validate({ schema_version: 1, model: 'm', dim: 384, alpha: 0.6, rebuilt_at: 'x' }, 'memory-manifest.v1'), []);
+  assert.equal(validate({ schema_version: 1, model: 'm' }, 'memory-manifest.v1').length, 1);
+});
+
+test('VAL-26: additionalProperties as a schema validates every map value', () => {
+  const schema = { type: 'object', additionalProperties: { type: 'object', required: ['sha256'], properties: { sha256: { type: 'string' } } } };
+  assert.deepEqual(validate({ 'a.js': { sha256: 'x' }, 'b.js': { sha256: 'y' } }, schema), []);
+  const errs = validate({ 'a.js': { sha256: 'x' }, 'b.js': { size: 5 } }, schema);
+  assert.equal(errs[0].keyword, 'required');
+  assert.equal(errs[0].field, 'sha256');
+  assert.equal(errs[0].instancePath, '/b.js/sha256');
+});
+
+test('VAL-27: codebase-manifest.v1 rejects a file entry missing sha256', () => {
+  const errs = validate({ schema_version: 1, files: { 'a.js': { size: 10, ext: '.js' } } }, 'codebase-manifest.v1');
+  assert.equal(errs[0].keyword, 'required');
+  assert.equal(errs[0].field, 'sha256');
+});
+
+test('VAL-28: message.v1 id/from/to patterns stay in sync with messaging regexes', () => {
+  const schema = _loadSchema('message.v1');
+  assert.equal(schema.properties.id.pattern, messaging.ID_RE.source);
+  assert.equal(schema.properties.from.pattern, messaging.AGENT_RE.source);
+  assert.equal(schema.properties.to.pattern, messaging.AGENT_RE.source);
+});
+
+test('VAL-29: message.v1 body maxBytes stays in sync with MAX_BODY_BYTES', () => {
+  const schema = _loadSchema('message.v1');
+  assert.equal(schema.properties.body.maxBytes, messaging.MAX_BODY_BYTES);
+});
+
+test('VAL-32: message.v1 kind enum stays in sync with KIND_ENUM', () => {
+  const schema = _loadSchema('message.v1');
+  assert.deepEqual(schema.properties.kind.enum, [...messaging.KIND_ENUM]);
+});
+
+test('VAL-30: metrics-record.v1 accepts coexisting record shapes (buildRecord + session-aggregate)', () => {
+  const buildShape = {
+    agent: 'a', tier: 't', resolved_model: 'm', phase: '10', plan: 'p', task: 'k',
+    started_at: 'x', ended_at: 'y', duration_ms: 1000, tokens_in: 100, tokens_out: 50,
+    retry_count: 0, status: 'ok', runtime: 'claude', error: null,
+  };
+  const sessionShape = {
+    schema_version: 2, started_at: 'x', phase: 'P1', agent: 'a', tier: 't', resolved_model: 'm',
+    plan: 'PL1', task: 'TA1', tokens_in: 10, tokens_out: 20, duration_ms: 100, status: 'ok',
+    runtime: 'claude', retry_count: 0,
+  };
+  assert.deepEqual(validate(buildShape, 'metrics-record.v1'), []);
+  assert.deepEqual(validate(sessionShape, 'metrics-record.v1'), []);
+});
+
+test('VAL-31: metrics-record.v1 rejects a record whose arithmetic field is the wrong type', () => {
+  const errs = validate({ agent: 'a', tokens_in: 'not-a-number' }, 'metrics-record.v1');
+  assert.equal(errs[0].keyword, 'type');
+  assert.equal(errs[0].field, 'tokens_in');
+});
+
+test('VAL-22: circular / non-serializable input does not throw a raw TypeError', () => {
+  const circular = { a: 1 };
+  circular.self = circular;
+  let errs;
+  assert.doesNotThrow(() => { errs = validate(circular, { const: { a: 1 } }); });
+  assert.equal(errs[0].keyword, 'const');
+});

package/np-tools.cjs

@@ -42,6 +42,7 @@ const topLevelCommands = {
   'config-get':     require('./bin/np-tools/config.cjs'),
   'scan-codebase':  require('./bin/np-tools/scan-codebase.cjs'),
   'update-docs':    require('./bin/np-tools/update-docs.cjs'),
+  'graph-impact':   require('./bin/np-tools/graph-impact.cjs'),
   'doctor':         require('./bin/np-tools/doctor.cjs'),
   'generate-slug':  require('./bin/np-tools/slug.cjs'),
   'metrics':        require('./bin/np-tools/metrics.cjs'),
@@ -103,6 +104,7 @@ const topLevelCommands = {
   'loop-stuck':          require('./bin/np-tools/loop-stuck.cjs'),
   'loop-metrics':       require('./bin/np-tools/loop-metrics.cjs'),
   'spawn-headless':     require('./bin/np-tools/spawn-headless.cjs'),
+  'security':           require('./bin/np-tools/security.cjs'),
   'learning-log':      require('./bin/np-tools/learning-log.cjs'),
   'learning-match':    require('./bin/np-tools/learning-match.cjs'),
   'learning-list':     require('./bin/np-tools/learning-list.cjs'),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nubos-pilot",
-  "version": "1.2.0",
+  "version": "1.2.2",
   "description": "Self-hosted AI pilot for any codebase. Researcher and critic agents plan, execute and verify each change.",
   "homepage": "https://pilot.nubos.cloud",
   "repository": {
@@ -43,6 +43,8 @@
     "check-coverage": "node bin/check-coverage.cjs",
     "docs:generate": "node scripts/generate-docs.cjs",
     "docs:check": "node scripts/generate-docs.cjs --check",
+    "attributions": "node scripts/generate-attributions.cjs",
+    "attributions:check": "node scripts/generate-attributions.cjs --check",
     "ci": "npm run test && npm run check-coverage"
   }
 }

package/templates/claude/payload/hooks/np-security-hook.cjs

@@ -0,0 +1,50 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const cp = require('node:child_process');
+
+const ALLOWED_VERBS = new Set(['session-start', 'baseline', 'scan', 'review', 'commit']);
+
+function resolveNpTools() {
+  const candidates = [
+    path.join(process.cwd(), '.nubos-pilot', 'bin', 'np-tools.cjs'),
+    path.join(__dirname, '..', '..', '..', '.nubos-pilot', 'bin', 'np-tools.cjs'),
+  ];
+  for (const c of candidates) {
+    try { if (fs.statSync(c).isFile()) return c; } catch {}
+  }
+  return null;
+}
+
+function readStdin() {
+  return new Promise((resolve) => {
+    if (process.stdin.isTTY) return resolve('');
+    let buf = '';
+    process.stdin.setEncoding('utf-8');
+    const timer = setTimeout(() => { try { process.stdin.removeAllListeners(); } catch {} resolve(buf); }, 800);
+    process.stdin.on('data', (c) => { buf += c; });
+    process.stdin.on('end', () => { clearTimeout(timer); resolve(buf); });
+    process.stdin.on('error', () => { clearTimeout(timer); resolve(buf); });
+  });
+}
+
+(async () => {
+  const verb = process.argv[2];
+  if (!ALLOWED_VERBS.has(verb)) { process.exit(0); return; }
+  const npTools = resolveNpTools();
+  if (!npTools) { process.exit(0); return; }
+  const input = await readStdin();
+  try {
+    const r = cp.spawnSync(process.execPath, [npTools, 'security', verb, '--stdin'], {
+      input,
+      encoding: 'utf-8',
+      timeout: 20000,
+      maxBuffer: 8 * 1024 * 1024,
+      cwd: process.cwd(),
+    });
+    if (r && typeof r.stdout === 'string' && r.stdout.length) process.stdout.write(r.stdout);
+  } catch { /* never let a security hook break the session */ }
+  process.exit(0);
+})().catch(() => { process.exit(0); });

package/workflows/execute-phase.md

@@ -168,6 +168,10 @@ AUTO_LOG_LEARNING=$(node .nubos-pilot/bin/np-tools.cjs config-get auto_log_learn
 SPAWN_HEADLESS_ENABLED=$(node .nubos-pilot/bin/np-tools.cjs config-get spawn.headless.enabled 2>/dev/null || echo false)
 SPAWN_HEADLESS_AGENTS=$(node .nubos-pilot/bin/np-tools.cjs config-get spawn.headless.agents 2>/dev/null || echo '["np-critic","np-researcher"]')
 SPAWN_HEADLESS_FALLBACK=$(node .nubos-pilot/bin/np-tools.cjs config-get spawn.headless.fallback_on_error 2>/dev/null || echo true)
+CONF_INJECT_CRITERIA=$(node .nubos-pilot/bin/np-tools.cjs config-get conformance.inject_criteria 2>/dev/null || echo true)
+# Milestone success_criteria as the executor's acceptance target (rendered once from the INIT payload).
+# Intent-level only (ADR-0019): these describe what "done right" means, NOT how to build it.
+SUCCESS_CRITERIA_BLOCK=$(echo "$INIT" | node -e 'process.stdin.on("data",d=>{try{const c=JSON.parse(d).success_criteria||[];console.log(c.map(x=>"- "+(x.id?x.id+": ":"")+(x.text||x)).join("\n"))}catch(e){console.log("")}})')
 ```
 
 ## Spawn dispatch — agent-tool vs. headless subprocess (ADR-0010 §L6)
@@ -336,11 +340,17 @@ for WAVE_INDEX in 0 1 2 ...; do
       #     Prompt fields:
       #       <files_to_read>: task plan, slice plan, prior slice SUMMARYs, CONTEXT.md
       #       <consensus_pattern>: $CONSENSUS_PATTERN (with [VERIFIED]/[PROVISIONAL]/[CACHED])
+      #       <success_criteria>: when $CONF_INJECT_CRITERIA = true, include the milestone
+      #         acceptance target — $SUCCESS_CRITERIA_BLOCK plus the slice UAT path
+      #         (.nubos-pilot/milestones/M<NNN>/slices/S<NNN>/S<NNN>-UAT.md). Frame it as
+      #         "what done-right means (intent, ADR-0019) — NOT a build spec, NOT a scope
+      #         expansion". Omit the field entirely when the flag is false.
       #       <prior_findings>: critic findings JSON   (R≥2 only)
       #       <verify_excerpt>: tail of $VERIFY_LOG    (R≥2 only)
       #       <lang_directive>: $LANG_DIRECTIVE
       #       <skills>: $AGENT_SKILLS_EXECUTOR
-      #     RULES — Agent MUST: edit ONLY paths in files_modified (D-04 scope guard),
+      #     RULES — Agent MUST: edit ONLY paths in files_modified (D-04 scope guard) —
+      #     success_criteria are the acceptance target, NEVER a licence to touch other files,
       #     run `node np-tools.cjs knowledge-search "<q>" --task $TASK_ID` via Bash
       #     ≥1× (Rule 9 — the --task flag writes the audit evidence ledger),
       #     NOT call commit-task. Capture tool_use stream for audit (group (3) below).