omp-conductor 0.17.0 → 0.18.0

package/src/diff-flags.ts

@@ -496,6 +496,14 @@ export interface SettlementAudit {
   /** The dispatching issue's title and body — the attribution source. */
   issueText: string;
   diff: PrDiff;
+  /** The pull request body, or undefined when the tracker could not read one.
+   *  The claims audited below live here, so absent means no proof commands are
+   *  extracted — the flag family stays silent, never cries wolf on nothing. */
+  prBody?: string;
+  /** The run's session transcript (the raw JSONL), or undefined when the run
+   *  had none or it could not be read. Absent means no claimed command can be
+   *  checked — same silence, for the same reason. */
+  transcript?: string;
 }
 
 /**
@@ -513,6 +521,7 @@ export interface SettlementAudit {
 export function analyseSettlement(audit: SettlementAudit): SettlementFlag[] {
   const flags: SettlementFlag[] = [];
   detectWeakening(audit, flags);
+  detectClaimedProof(audit, flags);
   return flags;
 }
 
@@ -671,6 +680,347 @@ function scanHunks(
   }
 }
 
+// ------------------------------------------------------- claimed proof commands
+
+/**
+ * The proof claims a PR body makes, checked against the run's transcript.
+ *
+ * A worker's Verified section is what the orchestrator merges on, and until
+ * this check nothing compared its claims against what the session actually ran
+ * (#582). The audit is the same family as the test-weakening rules: advisory,
+ * never a state change, and resolving ambiguity towards silence. Every PR
+ * body carries backticked prose, so the false-positive pressure here is real —
+ * an extractor that reads any backtick span in the narrative as a claim would
+ * flag every run within a day.
+ *
+ * Three tolerances make the matcher honest rather than decorative:
+ *
+ * - Claims are extracted only from a verified section — a `## Verified`-style
+ *   heading or an inline `Verified:` label — never from the narrative. This is
+ *   the second named fake of the issue (one-heading parsing), asserted for
+ *   both shapes below.
+ * - Matching is on meaningful shell tokens, not string equality: a claimed
+ *   `bun test src/worker.test.ts` is satisfied by a transcript invocation of
+ *   `cd …/omp && bun test src/worker.test.ts src/session-host.test.ts`,
+ *   because a `cd` pair, shell operators and wrappers are dropped from both
+ *   sides and the claim's tokens must then be a subset of one invocation's.
+ *   Flag order is thereby free, which string equality could never be.
+ * - A claimed command whose invocation the transcript shows was refused by the
+ *   shared-host guard is `claimed-proof-blocked`, not `claimed-proof-missing`:
+ *   the worker *tried* and the guard stopped it (the honest #566/#570 shape,
+ *   whose own words are "CI owns them"), which is not the same finding as a
+ *   claim with no attempt at all.
+ */
+
+/** The verified-section markers a claim must live under: a heading whose text
+ *  contains a `veri*`/`proof` root (`## Verified`, `## Verification`,
+ *  `## How verified`, `## Verification & proof`), or an inline
+ *  `Verified:` / `**Verified:**` label row. `## Tests` is deliberately not
+ *  one — a section describing the diff's test impact is narrative, not proof. */
+const VERIFIED_MARKER =
+  /^(?:#{1,6}\s+.*\b(?:verif|proof)\w*\b.*$|^\s*(?:\*\*)?(?:Verif(?:ied|ication)|Proof)(?:\*\*)?\s*[:.])/im;
+
+/**
+ * The slice of a PR body that can carry proof claims: from the first
+ * verified-section marker to the end of its block. Claims live under backticks,
+ * so the region is what keeps narrative code spans out of the audit — a
+ * backticked `retry.modelFallback: true` in a design explanation is commentary,
+ * never a command somebody claimed to run.
+ */
+function claimRegion(body: string): string {
+  const marker = VERIFIED_MARKER.exec(body);
+  if (marker === null) return "";
+  const start = marker.index;
+  const rest = body.slice(start);
+  // The next-heading scan starts after the marker's own match, or `## Verified`
+  // would cut its own block to nothing — the marker line is a heading too.
+  const after = rest.slice(marker[0].length);
+  const next = /^#{1,6}\s+/m.exec(after);
+  return next === null ? rest : rest.slice(0, marker[0].length + next.index);
+}
+
+/** One backticked span that reads as a whole command: at least two shell words
+ *  and a first word that is an executable (no path separator, or a `./` one).
+ *  A span that names a single file or a config key is not a command claim. */
+function claimedCommand(span: string): boolean {
+  const words = span.split(/\s+/).filter((word) => word.length > 0);
+  if (words.length < 2) return false;
+  const first = words[0] ?? "";
+  return first.startsWith("./") || !first.includes("/");
+}
+
+/**
+ * The commands a PR body claims as proof, each deduplicated by its exact span.
+ * Only spans inside the verified region count, and only command-shaped ones
+ * — the two filters are what keep `## Verified`-island prose out of the audit.
+ */
+function claimedProofCommands(body: string): string[] {
+  const region = claimRegion(body);
+  const claims: string[] = [];
+  const seen = new Set<string>();
+  for (const match of region.matchAll(/`([^`\n]+)`/g)) {
+    const span = (match[1] ?? "").trim();
+    if (span === "" || seen.has(span) || !claimedCommand(span)) continue;
+    seen.add(span);
+    claims.push(span);
+  }
+  return claims;
+}
+
+/**
+ * Split a shell command into its meaningful words: whitespace-separated, quote
+ * characters removed so `bun test "src/my file.ts"` stays one word. Deliberately
+ * not a shell parser — the wide net is fine because the comparison is a subset
+ * in one direction only (see {@link satisfiedBy}).
+ */
+function shellWords(command: string): string[] {
+  const words: string[] = [];
+  let current = "";
+  let quote: string | undefined;
+  for (const ch of command) {
+    if (quote !== undefined) {
+      if (ch === quote) quote = undefined;
+      else current += ch;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      continue;
+    }
+    if (/\s/.test(ch)) {
+      if (current !== "") {
+        words.push(current);
+        current = "";
+      }
+      continue;
+    }
+    current += ch;
+  }
+  if (current !== "") words.push(current);
+  return words;
+}
+
+/** A token that is shell plumbing rather than a command word: `&&`, `|`,
+ *  `;`, redirects, grouping — anything made only of the metacharacter
+ *  alphabet. `2>&1` is kept (it carries a number), so stripping never eats a
+ *  word that discriminates one command from another. */
+const SHELL_PUNCT = /^[&|;<>()$!`]+$/;
+
+/**
+ * The meaningful tokens of one command: shell punctuation dropped, and a
+ * `cd <dir>` pair consumed as binding context rather than a command word —
+ * the tolerated-variant half of the acceptance criteria. Wrapper verbs
+ * (`timeout 300`, `env -i`) survive tokenisation because a *transcript* side
+ * carrying them never hurts a subset check; only a claimed side spelling them
+ * would, which is a shape this fleet's bodies do not produce.
+ */
+function commandTokens(command: string): string[] {
+  const words = shellWords(command);
+  const tokens: string[] = [];
+  for (let i = 0; i < words.length; i++) {
+    const word = words[i] ?? "";
+    if (word === "cd") {
+      i++; // its target is binding context too
+      continue;
+    }
+    if (SHELL_PUNCT.test(word)) continue;
+    tokens.push(word);
+  }
+  return tokens;
+}
+
+/**
+ * The shell-executing tools whose invocations can satisfy a claimed command.
+ * The shared-host guard's own invocation prefixes, minus `source` — a dot
+ * script has no command text of its own worth matching.
+ */
+const SHELL_TOOLS = new Set(["bash", "sh", "zsh"]);
+
+/**
+ * Whether a shell command ran in parse-only mode — a leading `bash -n`,
+ * `sh -n` after the `cd`-stripping, before the first non-flag token. This is
+ * the one how-vs-whether distinction the incident itself turned on: the
+ * shared-host guard explicitly permits `bash -n` on a guarded script while
+ * executing it is refused, and the *path token appears in both forms*, so a
+ * subset match alone would let a parse invocation satisfy a claim of having
+ * run the suite. The shared-host refusal wording makes the same explicit
+ * ("parsing never executes").
+ */
+function parseOnly(tokens: string[]): boolean {
+  const first = tokens[0];
+  if (first === undefined || !SHELL_TOOLS.has(first)) return false;
+  return tokens.slice(1).includes("-n");
+}
+
+/** Whether one claimed command is satisfied by one transcript invocation: the
+ *  claim's tokens are a subset (order-free, multiplicity-checked) of the
+ *  invocation's. Subset rather than subsequence is what makes differing flag
+ *  order harmless; multiplicity is what keeps `bun test a a` from being
+ *  satisfied by `bun test a`.
+ *
+ *  The one semantic guard on top of the subset: a claim that the worker *ran*
+ *  a command is never satisfied by an invocation that only parsed it
+ *  (`bash -n`), for the reason {@link parseOnly} states. A parse claim is
+ *  still satisfied by a parse invocation. */
+function satisfiedBy(claimTokens: string[], invocationTokens: string[]): boolean {
+  if (claimTokens.length === 0 || invocationTokens.length === 0) return false;
+  if (parseOnly(invocationTokens) && !parseOnly(claimTokens)) return false;
+  const remaining = [...invocationTokens];
+  for (const token of claimTokens) {
+    const at = remaining.indexOf(token);
+    if (at < 0) return false;
+    remaining.splice(at, 1);
+  }
+  return true;
+}
+
+interface TranscriptCall {
+  /** The tool-call id, present when the record carries one — links an
+   *  invocation to its tool result for the refused-detection below. */
+  id?: string;
+  /** The command text of the invocation, or undefined when the record's shape
+   *  carries none (a synthetic/aborted call, a record this parser does not
+   *  recognise). */
+  command?: string;
+}
+
+/** The command text a content block or top-level record carries, whatever the
+ *  harness's spelling for it — `input` (tool_use), `arguments` (toolCall) or a
+ *  bare `command` — and undefined when the shape is unrecognised. */
+function commandField(record: { readonly [key: string]: unknown }): string | undefined {
+  for (const key of ["input", "arguments"] as const) {
+    const field = record[key];
+    if (field !== null && typeof field === "object") {
+      // The harness's unvalidated transcript shapes; read as unknowns, like the
+      // daemon's other transcript readers.
+      const args = field as { readonly [key: string]: unknown };
+      const command = args["command"];
+      if (typeof command === "string") return command;
+    }
+  }
+  const direct = record["command"];
+  return typeof direct === "string" ? direct : undefined;
+}
+
+/**
+ * Every shell invocation a transcript records, plus every tool-result that a
+ * shared-host guard refusal produced. Defensive, in the module header's sense:
+ * the transcript is the harness's file, so both shapes this package already
+ * reads (a top-level `{toolName}` event and a `tool_use`/`toolCall` content
+ * block inside an assistant message) are recognised, and an unknown shape is
+ * skipped rather than TypeErroring the audit.
+ */
+export function transcriptCalls(text: string): { calls: TranscriptCall[]; refusals: Set<string> } {
+  const calls: TranscriptCall[] = [];
+  const refusals = new Set<string>();
+  for (const line of text.split("\n")) {
+    if (line.length === 0) continue;
+    let row: unknown;
+    try {
+      row = JSON.parse(line) as unknown;
+    } catch {
+      continue;
+    }
+    if (row === null || typeof row !== "object") continue;
+    const rec = row as { readonly [key: string]: unknown };
+
+    const toolName = rec["toolName"];
+    if (typeof toolName === "string") {
+      if (SHELL_TOOLS.has(toolName)) {
+        const id = rec["id"];
+        const command = commandField(rec);
+        calls.push({
+          ...(typeof id === "string" ? { id } : {}),
+          ...(command === undefined ? {} : { command }),
+        });
+      }
+      continue;
+    }
+    if (rec["type"] !== "message") continue;
+    const message = rec["message"];
+    if (message === null || typeof message !== "object") continue;
+    const m = message as { readonly [key: string]: unknown };
+
+    const content = m["content"];
+    if (Array.isArray(content) && m["role"] === "assistant") {
+      for (const part of content) {
+        if (part === null || typeof part !== "object") continue;
+        const p = part as { readonly [key: string]: unknown };
+        const name = p["name"];
+        if (typeof name !== "string" || !SHELL_TOOLS.has(name)) continue;
+        const id = p["id"];
+        const command = commandField(p);
+        calls.push({
+          ...(typeof id === "string" ? { id } : {}),
+          ...(command === undefined ? {} : { command }),
+        });
+      }
+      continue;
+    }
+
+    // A shared-host refusal arrives as a tool result carrying the guard's
+    // own marker. Keyed by the tool-call id so the refused invocation is the
+    // one identified, never its neighbour.
+    if (m["role"] === "toolResult") {
+      const toolCallId = m["toolCallId"];
+      if (typeof toolCallId !== "string") continue;
+      const parts = Array.isArray(content) ? content : [];
+      const refused = parts.some((part): boolean => {
+        if (part === null || typeof part !== "object") return false;
+        const block = part as { readonly [key: string]: unknown };
+        const text = block["text"];
+        return typeof text === "string" && text.includes("sharedHostPolicy");
+      });
+      if (refused) refusals.add(toolCallId);
+    }
+  }
+  return { calls, refusals };
+}
+
+/**
+ * The claimed-proof half of the settlement audit: one finding per claimed
+ * command whose transcript is silent, and a distinct finding (the honest
+ * shape) for one the guard refused. The presence direction — a claim satisfied
+ * by any invocation — produces nothing, which is the whole point of the flag
+ * existing: silence is what a true Verified section earns.
+ */
+function detectClaimedProof(audit: SettlementAudit, flags: SettlementFlag[]): void {
+  if (audit.prBody === undefined || audit.transcript === undefined) return;
+  const claims = claimedProofCommands(audit.prBody);
+  if (claims.length === 0) return;
+  const { calls, refusals } = transcriptCalls(audit.transcript);
+  const invocations = calls
+    .filter((call) => call.command !== undefined)
+    .map((call) => {
+      const tracked = call as { id?: string; command: string };
+      return { ...tracked, tokens: commandTokens(tracked.command) };
+    });
+
+  for (const claim of claims) {
+    const claimTokens = commandTokens(claim);
+    if (claimTokens.length === 0) continue;
+    const matched = invocations.filter((call) => satisfiedBy(claimTokens, call.tokens));
+    if (matched.length > 0) {
+      // A claimed command the guard refused is an attempted-and-blocked report,
+      // never a fabricated one: the worker's own words were "CI owns them",
+      // and a reviewer should be pointing at the guard, not the worker.
+      if (matched.some((call) => call.id !== undefined && refusals.has(call.id))) {
+        flags.push({
+          kind: "claimed-proof-blocked",
+          file: "(transcript)",
+          detail: `\`${evidence(claim)}\` was attempted, but the shared-host guard refused it (CI owns it)`,
+        });
+      }
+      continue;
+    }
+    flags.push({
+      kind: "claimed-proof-missing",
+      file: "(transcript)",
+      detail: `\`${evidence(claim)}\` is claimed as proof, but no command matching it appears in the run's transcript`,
+    });
+  }
+}
+
 // -------------------------------------------------------------------- printing
 
 /** Beyond this the report is a wall of text nobody reads; the count still tells

package/src/digest-schedule.ts

@@ -58,6 +58,43 @@ export function localDayKey(at: number, timezone?: string): string {
   return localDigestMinute(at, timezone).day;
 }
 
+/** The durable day-marker key for the db-snapshot cadence (#289), mirroring
+ *  the `digest:<day>` dedupe keys in the report outbox. */
+export function dbSnapshotMarkerKey(dayKey: string): string {
+  return `db-snapshot:${dayKey}`;
+}
+
+/**
+ * Whether the conductor.db snapshot cadence is due now.
+ *
+ * The store is the ledger — the verb ledger, the decision rows and the run
+ * history have no other copy — so it is snapshotted once per day, aligned to
+ * the digest tick: a daily digest applies the exact {@link digestDue}
+ * predicate (same day boundary, same `at`, same timezone), so the snapshot
+ * lands on the same tick the digest goes out. A `none` or `per-tick` digest
+ * still leaves the ledger on a daily schedule — durability does not follow
+ * the reporting preference — bounded by the policy-zone day key (host zone
+ * when the policy carries none), with no `at`. The zone must be the
+ * policy's: the caller writes the `db-snapshot:<day>` marker with
+ * {@link localDayKey localDayKey(now, policy.digest.timezone)}, so a
+ * host-zone read here would disagree with it whenever the two zones fall on
+ * different days, and a `{cadence: "per-tick", timezone: "Europe/London"}`
+ * policy on a UTC host would re-snapshot on every tick during the offset
+ * window, pruning the retained set to nothing.
+ *
+ * Pure by construction, like {@link digestDue}: the last-run fact arrives as
+ * the day key (`db-snapshot:<day>` marker present for today ⟺ last run was
+ * today), never a clock the caller read an hour ago.
+ */
+export function dbSnapshotDue(
+  policy: Pick<ReportingPolicy, "digest">,
+  lastSnapshotDayKey: string | undefined,
+  now: number,
+): boolean {
+  if (policy.digest.cadence === "daily") return digestDue(policy, lastSnapshotDayKey, now);
+  return localDayKey(now, policy.digest.timezone) !== lastSnapshotDayKey;
+}
+
 /**
  * Whether the digest is due now.
  *