opencode-swarm 7.119.0 → 7.120.0

package/dist/knowledge/curation-policy.d.ts

@@ -0,0 +1,125 @@
+/**
+ * Cohort-safe curation authorization policy (issue #1848 §2).
+ *
+ * THE single shared policy every destructive knowledge lifecycle action routes
+ * through. Replaces the previous design where archive/purge/remove/quarantine/
+ * retraction/merge/retire each implemented their own ad-hoc inline ownership
+ * check.
+ *
+ * Decision ladder (fail-closed default):
+ *  1. Config-mismatch guard: cohort members must share curation-relevant
+ *     config. A fingerprint mismatch → fail closed with an actionable
+ *     diagnostic (the worktrees will curate with different semantics).
+ *  2. Owner path: the acting worktree IS the proven producer and the action
+ *     relies on its own validated evidence → authorized.
+ *  3. Unknown-owner legacy protection: entry has no `producer` (legacy) →
+ *     fail closed → record a non-destructive proposal. Never guess an owner
+ *     heuristically from the current worktree.
+ *  4. Not-owner + local-only evidence: a different worktree owns the entry and
+ *     the actor only has LOCAL session evidence → fail closed → proposal.
+ *     Absence of local evidence is NOT negative evidence.
+ *  5. Cohort quorum: cohort-wide evidence (read via the link-aware event
+ *     resolver) satisfies a configured quorum → authorized.
+ *  6. Override: an explicit, audited operator override → authorized + recorded.
+ *
+ * This module is never imported on the plugin-init path. It is called lazily by
+ * the destructive callers (Layer 4 routing).
+ */
+import { readFile } from 'node:fs/promises';
+import { readKnowledgeEvents } from '../hooks/knowledge-events.js';
+import { isLinked, readLinkPointer, resolveKnowledgeStoreDir, resolveLinkDir } from '../hooks/knowledge-link.js';
+import type { CurationAction, CurationEvidenceScope, CurationProposal, KnowledgeConfig } from '../hooks/knowledge-types.js';
+import { type CohortConfigFingerprintInput, cohortConfigFingerprint } from './config-fingerprint.js';
+import { resolveWorktreeId } from './worktree-identity.js';
+/** Entry shape the policy needs to inspect for ownership decisions. */
+export interface CurationTargetEntry {
+    id: string;
+    producer?: {
+        worktree_id: string;
+        cohort_id: string;
+    } | null;
+    revision?: number;
+    content_hash?: string;
+    status?: string;
+}
+/** Input describing the destructive intent. */
+export interface CurationAuthorizationInput {
+    directory: string;
+    action: CurationAction;
+    entryId: string;
+    reason?: string;
+    /** CAS token from the snapshot the plan was built on. */
+    expectedRevision?: number;
+    expectedContentHash?: string;
+    /** Declared by the caller: which evidence scope was used to decide. */
+    evidenceScope: CurationEvidenceScope;
+    /** Resolved worktree id of the actor (injected for testability). If
+     * omitted, resolved lazily via `resolveWorktreeId`. */
+    actorWorktreeId?: string;
+    actorRole?: string;
+    /** Explicit audited operator override. */
+    override?: {
+        actor: 'manual-override';
+        reason: string;
+    };
+}
+/** Result: either authorized (with basis) or unauthorized (with proposal). */
+export type CurationAuthorizationResult = {
+    authorized: true;
+    basis: 'owner' | 'quorum' | 'override' | 'config-skipped-unlinked';
+    detail: string;
+    expectedRevision?: number;
+    expectedContentHash?: string;
+} | {
+    authorized: false;
+    basis: 'protected-unknown-owner' | 'not-owner-local-evidence' | 'config-mismatch' | 'quorum-insufficient' | 'entry-not-found';
+    detail: string;
+    proposal: CurationProposal;
+};
+/** Context carrying config + the target entry (caller pre-fetches once). */
+export interface CurationContext {
+    config: KnowledgeConfig;
+    entry: CurationTargetEntry | null;
+}
+/** Quorum configuration for cohort-wide decisions. */
+export interface CohortQuorumConfig {
+    /** Minimum distinct cohort events (e.g. violations) required to authorize. */
+    minCohortEvidence: number;
+}
+/**
+ * Authorize a destructive curation action against a single entry.
+ *
+ * The caller MUST pre-fetch the entry (so ownership is decided against the
+ * freshest snapshot, not a stale plan) and pass it via `context.entry`.
+ */
+export declare function authorizeCuration(input: CurationAuthorizationInput, context: CurationContext, quorum?: CohortQuorumConfig): Promise<CurationAuthorizationResult>;
+/**
+ * Build a config-fingerprint input from a loaded KnowledgeConfig (issue #1848
+ * §3 / C-8 fix). Projects the config through its field set so two worktrees
+ * with equivalent effective config produce the same fingerprint regardless of
+ * whether a value was set explicitly or resolved to a default (the caller is
+ * responsible for passing the *resolved* config — defaults are already baked
+ * in by the time KnowledgeConfig reaches this layer).
+ */
+export declare function buildConfigFingerprintInput(config: KnowledgeConfig): CohortConfigFingerprintInput;
+/**
+ * Read the cohort's stored config fingerprint from the cohort link dir
+ * (issue #1848 §3). Returns null when no cohort fingerprint is stored yet
+ * (first member) or when unlinked.
+ */
+export declare function readCohortConfigFingerprint(directory: string): Promise<string | null>;
+/**
+ * DI seam for tests. Tests override these to avoid git subprocesses and real
+ * filesystem access (per the `_internals` pattern in AGENTS.md invariant 7).
+ */
+export declare const _internals: {
+    resolveWorktreeId: typeof resolveWorktreeId;
+    readKnowledgeEvents: typeof readKnowledgeEvents;
+    cohortConfigFingerprint: typeof cohortConfigFingerprint;
+    readCohortConfigFingerprint: typeof readCohortConfigFingerprint;
+    readFile: typeof readFile;
+    isLinked: typeof isLinked;
+    readLinkPointer: typeof readLinkPointer;
+    resolveLinkDir: typeof resolveLinkDir;
+    resolveKnowledgeStoreDir: typeof resolveKnowledgeStoreDir;
+};

package/dist/knowledge/family-manifest.d.ts

@@ -19,10 +19,24 @@
  *  - `append-union`: union by the line's stable id field (event id / entry id),
  *    appending only lines whose id is not already present on the destination.
  *    Idempotent on retry/relink.
+ *  - `append-concat`: union of an append-only audit log that has NO top-level
+ *    `id`. Dedup is keyed off a per-member composite `keyOf` selector (e.g.
+ *    `entry_id + after_revision + timestamp` for rewrite history) so legitimately
+ *    distinct revisions/proposals are preserved while an idempotent relink/retry
+ *    does not duplicate a record. Mechanically identical to `append-union` but
+ *    labelled separately so the manifest documents which members are non-`id`
+ *    audit logs (issue #1848 cohort-scoped rewrite/proposal history).
  *  - `sum-counters`: per-counter field-wise SUM, reusing the existing
  *    `mergeRollupInto` primitive (shown/applied/... counts sum; timestamps take
  *    the max). Used for the counter baseline JSON.
  *
+ * Key selection:
+ *  - Every member is deduped by a stable key. By default the key is the line's
+ *    string `id` field. A member may override this with an explicit `keyOf`
+ *    selector returning a composite string (or `null` for an unkeyable/malformed
+ *    line). The default preserves the historical `id`-keyed behavior for every
+ *    pre-existing member exactly.
+ *
  * NOT in the manifest (deliberate exceptions, documented in
  * `knowledge-link.ts` "Intentionally NOT redirected"):
  *  - `synonym-map.json` — derived state. It is rebuilt deterministically from
@@ -31,8 +45,15 @@
  *  - `.knowledge-shown.json`, `plan.json`, evidence, session state — per
  *    worktree by design.
  */
-export type FamilyRole = 'store' | 'events' | 'rejected' | 'retractions' | 'counters' | 'quarantine' | 'unactionable' | 'application-legacy';
-export type FamilyMergeStrategy = 'dedup-id-merge' | 'append-union' | 'sum-counters';
+export type FamilyRole = 'store' | 'events' | 'rejected' | 'retractions' | 'counters' | 'quarantine' | 'unactionable' | 'application-legacy' | 'rewrite-history' | 'curation-proposals';
+export type FamilyMergeStrategy = 'dedup-id-merge' | 'append-union' | 'append-concat' | 'sum-counters';
+/**
+ * Extracts the stable dedup key from a single parsed JSONL line. Returns `null`
+ * for a line that carries no derivable key (e.g. missing required fields) — such
+ * a line is unaddressable for dedup and is skipped by the append strategies and
+ * rejected by the pre-commit validator, exactly as an id-less line is today.
+ */
+export type FamilyKeySelector = (line: unknown) => string | null;
 export interface KnowledgeFamilyMember {
     /** Filename within the swarm family directory (e.g. `knowledge.jsonl`). */
     readonly filename: string;
@@ -40,6 +61,13 @@ export interface KnowledgeFamilyMember {
     readonly mergeStrategy: FamilyMergeStrategy;
     /** True when unlink may copy this member back to the local worktree. */
     readonly reversible: boolean;
+    /**
+     * Optional per-member identity-key selector. When omitted, the member is
+     * keyed by its string `id` field (the historical default that every
+     * pre-existing member relies on). Members whose records have no top-level
+     * `id` (append-only audit logs) supply a composite selector here.
+     */
+    readonly keyOf?: FamilyKeySelector;
 }
 /**
  * The complete knowledge family that participates in cohort linking.

package/dist/knowledge/family-migration.d.ts

@@ -36,6 +36,14 @@ export interface FamilyMigrationCounts {
         skipped: number;
     }>;
 }
+/**
+ * Resolve the dedup-key selector for a member: its explicit `keyOf` when
+ * present, else the default `id` selector. Centralising this guarantees the
+ * append merge, the validator, and every consumer key a member identically —
+ * and that every pre-existing (no-`keyOf`) member keeps its exact `id`-keyed
+ * behavior.
+ */
+declare function keySelectorFor(member: KnowledgeFamilyMember): (obj: unknown) => string | null;
 /**
  * Provenance-preserving merge of the active store (`dedup-id-merge`).
  *
@@ -54,11 +62,14 @@ declare function mergeStoreEntries(destination: KnowledgeEntryBase[], source: Kn
 /** Field-level union of `src` into `target` (mutates target). */
 declare function mergeEntryFields(target: KnowledgeEntryBase, src: KnowledgeEntryBase): void;
 /**
- * Append-union: append source lines whose id is not already present on the
- * destination. Lines without an id field are skipped (we cannot dedup them
- * safely, and every family member here is id-keyed).
+ * Append-union / append-concat: append source lines whose key is not already
+ * present on the destination. The key is extracted by `keyOf` — the member's id
+ * field by default (`append-union`), or a composite selector for non-`id`
+ * append-only audit logs (`append-concat`). Lines whose key is `null` (no
+ * derivable key / malformed) are skipped: we cannot dedup them safely, and a
+ * keyless line is unaddressable. Idempotent on retry/relink for both strategies.
  */
-declare function appendUnionById<T>(destination: T[], source: T[]): {
+declare function appendUnionById<T>(destination: T[], source: T[], keyOf?: (obj: unknown) => string | null): {
     merged: T[];
     added: number;
     skipped: number;
@@ -104,6 +115,7 @@ export declare const _internals: {
     mergeEntryFields: typeof mergeEntryFields;
     serialize: typeof serialize;
     validateSerialized: typeof validateSerialized;
+    keySelectorFor: typeof keySelectorFor;
     MIGRATION_LOCK_STALE_MS: number;
 };
 export {};

package/dist/knowledge/scan-cursor.d.ts

@@ -0,0 +1,107 @@
+/**
+ * Fair, durable scanning cursor for cohort curation (issue #1848 §4).
+ *
+ * Replaces the fixed oldest-~500-entry window in curator-postmortem with
+ * durable, fair pagination/cursor semantics. Every eligible record is
+ * eventually visited; progress survives restart; concurrent append/update does
+ * not permanently skip or duplicate destructive handling; retry after crash is
+ * idempotent.
+ *
+ * TWO-LAYER IDEMPOTENCY (C-5 fix from the critic review):
+ *
+ *  1. ATOMIC BATCH CLAIM: `claimNextScanBatch` reads the cursor AND advances it
+ *     in ONE locked transaction, BEFORE curation. This prevents two concurrent
+ *     cohort worktrees (W1, W2) from taking the same batch — W1 claims batch B,
+ *     advances the cursor; W2 sees the advanced cursor and takes the next batch.
+ *     Crash-after-claim-before-commit → that batch's work is lost for THIS run
+ *     (picked up next generation); crash-before-claim → cursor unchanged →
+ *     retry is idempotent.
+ *
+ *  2. PER-ENTRY GENERATION STAMP: each entry carries `last_curated_generation`.
+ *     Non-idempotent actions (rewrite/demote/confidence-delta) are skipped if
+ *     `entry.last_curated_generation === currentGeneration`. Status-idempotent
+ *     actions (archive/quarantine/remove) need no stamp (re-application is a
+ *     no-op). This makes the cursor safe even if a batch is somehow processed
+ *     twice (e.g. recovery from a crash-after-claim that was partially applied).
+ *
+ * Cursor state is cohort-scoped (under `resolveKnowledgeStoreDir`, so it is
+ * shared across linked worktrees) and lives at `curation-cursor.json`. It is
+ * NOT a KNOWLEDGE_FAMILY migration member — it's regenerable state, not
+ * id-mergeable data.
+ *
+ * This module is never imported on the plugin-init path.
+ */
+import { existsSync } from 'node:fs';
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { resolveKnowledgeStoreDir } from '../hooks/knowledge-link.js';
+import { readKnowledge, transactKnowledge } from '../hooks/knowledge-store.js';
+import type { KnowledgeEntryBase } from '../hooks/knowledge-types.js';
+import { resolveCohortId } from './cohort-identity.js';
+/** Cursor state persisted to disk (cohort-scoped). */
+export interface ScanCursorState {
+    cohort_id: string;
+    /** `${created_at}|${id}` — stable ordering + deterministic tie-breaker. */
+    last_visited_sort_key: string;
+    /** Monotonically increasing sweep generation. */
+    generation: number;
+    /** True when the last sweep reached the tail; next call starts fresh. */
+    completed: boolean;
+    /** Approximate count of entries still eligible to visit this generation. */
+    remaining_estimate: number;
+    updated_at: string;
+}
+/** A claimed batch + its generation (for the generation-stamp idempotency). */
+export interface ScanBatch {
+    entries: KnowledgeEntryBase[];
+    generation: number;
+    /** True when this batch completed the current sweep. */
+    sweepCompleted: boolean;
+    remaining_estimate: number;
+}
+/** Lightweight status for diagnostics. */
+export interface ScanStatus {
+    generation: number;
+    completed: boolean;
+    remaining_estimate: number;
+    cohort_id: string;
+}
+/**
+ * DI seam for tests.
+ */
+export declare const _internals: {
+    readFile: typeof readFile;
+    writeFile: typeof writeFile;
+    existsSync: typeof existsSync;
+    mkdir: typeof mkdir;
+    readKnowledge: typeof readKnowledge;
+    transactKnowledge: typeof transactKnowledge;
+    resolveCohortId: typeof resolveCohortId;
+    resolveKnowledgeStoreDir: typeof resolveKnowledgeStoreDir;
+};
+/**
+ * Claim the next scan batch ATOMICALLY (issue #1848 §4 / C-5 fix).
+ *
+ * Reads the cursor, selects the next `batchSize` unvisited eligible entries,
+ * and ADVANCES the cursor past them in ONE step — all before curation runs.
+ * This means a concurrent cohort worktree calling this in parallel will see
+ * the already-advanced cursor and take the NEXT batch, never the same one.
+ *
+ * Eligible = active status (not archived/quarantined/unactionable) and sort-key
+ * beyond the cursor's last-visited position for this generation.
+ *
+ * Returns an empty batch when the sweep is complete; the caller may then start
+ * a fresh sweep (generation bumped) on the next invocation.
+ */
+export declare function claimNextScanBatch(directory: string, batchSize?: number): Promise<ScanBatch>;
+/**
+ * Read scan status for diagnostics (issue #1848 §4 "remaining eligible work").
+ */
+export declare function getScanStatus(directory: string): Promise<ScanStatus>;
+/**
+ * Check whether a non-idempotent action should be skipped for this entry in the
+ * current generation (C-5 fix, second layer of idempotency). Returns true if
+ * the entry was already curated in this generation → skip the action.
+ */
+export declare function alreadyCuratedThisGeneration(entry: {
+    last_curated_generation?: number;
+}, generation: number): boolean;

package/dist/knowledge/worktree-identity.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Stable per-worktree identity (issue #1848 §1).
+ *
+ * `resolveWorktreeId` returns a stable UUID that is UNIQUE PER WORKTREE (not
+ * per cohort). It is the primary ownership key for the curation-policy layer:
+ * a worktree may directly mutate a knowledge entry only when it is the proven
+ * producer (`entry.producer.worktree_id === actorWorktreeId`).
+ *
+ * CRITICAL: this id is stored at `<directory>/.swarm/worktree-id.json` via the
+ * RAW directory path — it is deliberately NOT link-resolved. Two sibling
+ * worktrees of the same cohort share a knowledge store but have DISTINCT
+ * worktree ids, which is exactly what makes cohort-safe ownership decisions
+ * possible.
+ *
+ * This module performs no git subprocess calls and is never imported on the
+ * plugin-init path. It is called lazily by the curation stamping path and the
+ * authorization policy. Fail-open: if the id file cannot be read or written, a
+ * transient ephemeral id is returned so curation never hard-blocks on an I/O
+ * hiccup.
+ */
+import { randomUUID } from 'node:crypto';
+import { existsSync } from 'node:fs';
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+/**
+ * Seam for dependency injection in tests. Tests override `readFile`,
+ * `writeFile`, and `randomUUID` to avoid touching the real filesystem / entropy.
+ */
+export declare const _internals: {
+    readFile: typeof readFile;
+    writeFile: typeof writeFile;
+    existsSync: typeof existsSync;
+    mkdir: typeof mkdir;
+    randomUUID: typeof randomUUID;
+};
+/**
+ * Resolve the stable per-worktree id, creating it on first call if absent.
+ * Returns a transient ephemeral id on I/O failure (fail-open).
+ */
+export declare function resolveWorktreeId(directory: string): Promise<string>;

package/dist/memory/schema.d.ts

@@ -215,8 +215,8 @@ export declare const MemoryProposalSchema: z.ZodObject<{
     rationale: z.ZodString;
     evidenceRefs: z.ZodArray<z.ZodString>;
     status: z.ZodEnum<{
-        applied: "applied";
         pending: "pending";
+        applied: "applied";
         rejected: "rejected";
         approved: "approved";
         superseded: "superseded";

package/dist/services/knowledge-diagnostics.d.ts

@@ -91,6 +91,35 @@ export interface KnowledgeDebugMeta {
             promotion_event_id?: string;
         }>;
     };
+    /**
+     * Cohort-safe curation health (issue #1848). Surfaces the fair scan
+     * cursor progress and cohort config-fingerprint agreement so an operator
+     * knows whether entries are being starved and whether cohort members
+     * share curation semantics.
+     */
+    curation: {
+        /** Fair scan generation (monotonic sweep counter). 0 = no cursor yet. */
+        scan_generation: number;
+        /** True when the last sweep completed (next sweep starts fresh). */
+        scan_completed: boolean;
+        /** Approximate count of entries still eligible to visit this generation. */
+        scan_remaining_estimate: number;
+        /** True when this worktree's config fingerprint matches the cohort's.
+         * `null` when unlinked or no cohort fingerprint is stored. */
+        config_fingerprint_match: boolean | null;
+        /** Count of entries with producer provenance (v3+). */
+        entries_with_provenance: number;
+        /** Count of legacy entries without provenance (protected by default). */
+        entries_unknown_owner: number;
+        /**
+         * Pending curation proposals persisted to `curation-proposals.jsonl`
+         * (PRR-008): destructive actions that were blocked (unknown-owner,
+         * config-mismatch, insufficient evidence) and recorded for a cohort
+         * member to later confirm. Never surfaced before; operators need to see
+         * that blocked destructive intent is queued.
+         */
+        pending_proposals: number;
+    };
 }
 /**
  * Compute the debug-metadata block for the knowledge system. Best-effort: never

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "opencode-swarm",
-	"version": "7.119.0",
+	"version": "7.120.0",
 	"description": "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",

package/dist/cli/curator-llm-factory-rwwnmdvk.js

@@ -1,43 +0,0 @@
-// @bun
-import {
-  createCuratorLLMDelegate
-} from "./index-mr3pnc4h.js";
-import"./index-nprawcc0.js";
-import"./index-g2wrs7jy.js";
-import"./index-c8s9a3zh.js";
-import"./index-11q1t6g0.js";
-import"./index-pdk1n8yh.js";
-import"./index-p45sshb5.js";
-import"./index-vwvkpg0d.js";
-import"./index-4905hd2m.js";
-import"./index-5bcrp3bc.js";
-import"./index-r2ysfdet.js";
-import"./index-pjhfe7c3.js";
-import"./index-jbdgpqpj.js";
-import"./index-5hze8ztj.js";
-import"./index-qx5z58a7.js";
-import"./index-bfwt3abw.js";
-import"./index-wpgv6hht.js";
-import"./index-vxv732ex.js";
-import"./index-8fwhhayc.js";
-import"./index-q1exe2b3.js";
-import"./index-n6fa2hhk.js";
-import"./index-q4kgsvdd.js";
-import"./index-ye3fndsw.js";
-import"./index-kzj3fp7c.js";
-import"./index-5e4e2hvv.js";
-import"./index-p0arc26j.js";
-import"./index-zgwm4ryv.js";
-import"./index-dqh3zhhc.js";
-import"./index-abjjn4yh.js";
-import"./index-0pfqcjp6.js";
-import"./index-293f68mj.js";
-import"./index-42cx6g2h.js";
-import"./index-fsrp8wp3.js";
-import"./index-q2rrv0cy.js";
-import"./index-vvk2g744.js";
-import"./index-qe3v54nb.js";
-import"./index-a76rekgs.js";
-export {
-  createCuratorLLMDelegate
-};

package/dist/cli/guardrail-explain-kacpc2zm.js

@@ -1,44 +0,0 @@
-// @bun
-import {
-  handleGuardrailExplain
-} from "./index-7pspktns.js";
-import"./index-mr3pnc4h.js";
-import"./index-nprawcc0.js";
-import"./index-g2wrs7jy.js";
-import"./index-c8s9a3zh.js";
-import"./index-11q1t6g0.js";
-import"./index-pdk1n8yh.js";
-import"./index-p45sshb5.js";
-import"./index-vwvkpg0d.js";
-import"./index-4905hd2m.js";
-import"./index-5bcrp3bc.js";
-import"./index-r2ysfdet.js";
-import"./index-pjhfe7c3.js";
-import"./index-jbdgpqpj.js";
-import"./index-5hze8ztj.js";
-import"./index-qx5z58a7.js";
-import"./index-bfwt3abw.js";
-import"./index-wpgv6hht.js";
-import"./index-vxv732ex.js";
-import"./index-8fwhhayc.js";
-import"./index-q1exe2b3.js";
-import"./index-n6fa2hhk.js";
-import"./index-q4kgsvdd.js";
-import"./index-ye3fndsw.js";
-import"./index-kzj3fp7c.js";
-import"./index-5e4e2hvv.js";
-import"./index-p0arc26j.js";
-import"./index-zgwm4ryv.js";
-import"./index-dqh3zhhc.js";
-import"./index-abjjn4yh.js";
-import"./index-0pfqcjp6.js";
-import"./index-293f68mj.js";
-import"./index-42cx6g2h.js";
-import"./index-fsrp8wp3.js";
-import"./index-q2rrv0cy.js";
-import"./index-vvk2g744.js";
-import"./index-qe3v54nb.js";
-import"./index-a76rekgs.js";
-export {
-  handleGuardrailExplain
-};