opencode-swarm 7.119.0 → 7.121.0

package/dist/cli/{skill-generator-3f8dqjj2.js → skill-generator-tkv7s12g.js}

@@ -33,19 +33,22 @@ import {
   sanitizeSlug,
   selectCandidateEntries,
   writeEvalStub
-} from "./index-r2ysfdet.js";
-import"./index-pjhfe7c3.js";
-import"./index-5hze8ztj.js";
-import"./index-qx5z58a7.js";
-import"./index-bfwt3abw.js";
-import"./index-wpgv6hht.js";
+} from "./index-78b192v7.js";
+import"./index-3366gs26.js";
+import"./index-69ms9ny1.js";
+import"./index-rtry5xyf.js";
+import"./index-rywkdacj.js";
+import"./index-nhgw7de8.js";
+import"./index-ae75rja9.js";
+import"./index-3jvqw5hy.js";
+import"./index-4rhcth7a.js";
 import"./index-ye3fndsw.js";
 import"./index-zgwm4ryv.js";
-import"./index-0pfqcjp6.js";
-import"./index-42cx6g2h.js";
+import"./index-h07wn84h.js";
+import"./index-76kvm9z5.js";
 import"./index-fsrp8wp3.js";
 import"./index-q2rrv0cy.js";
-import"./index-vvk2g744.js";
+import"./index-7g4c7s5r.js";
 import"./index-qe3v54nb.js";
 import"./index-a76rekgs.js";
 export {

package/dist/config/schema.d.ts

@@ -616,9 +616,9 @@ export declare const KnowledgeConfigSchema: z.ZodObject<{
     todo_max_phases: z.ZodDefault<z.ZodNumber>;
     sweep_enabled: z.ZodDefault<z.ZodBoolean>;
     confidence_floor_action: z.ZodDefault<z.ZodEnum<{
-        none: "none";
-        demote: "demote";
         quarantine: "quarantine";
+        demote: "demote";
+        none: "none";
     }>>;
     confidence_floor_min_outcomes: z.ZodDefault<z.ZodNumber>;
     confidence_floor_signal_threshold: z.ZodDefault<z.ZodNumber>;
@@ -1386,9 +1386,9 @@ export declare const ExternalSkillCandidateSourceTypeSchema: z.ZodEnum<{
 export type ExternalSkillCandidateSourceType = z.infer<typeof ExternalSkillCandidateSourceTypeSchema>;
 /** Evaluation verdict for an external skill candidate. */
 export declare const ExternalSkillCandidateEvaluationVerdictSchema: z.ZodEnum<{
+    pending: "pending";
     promoted: "promoted";
     quarantined: "quarantined";
-    pending: "pending";
     in_review: "in_review";
     passed: "passed";
     rejected: "rejected";
@@ -1433,9 +1433,9 @@ export declare const ExternalSkillCandidateSchema: z.ZodObject<{
     skill_body: z.ZodString;
     risk_flags: z.ZodDefault<z.ZodArray<z.ZodString>>;
     evaluation_verdict: z.ZodDefault<z.ZodEnum<{
+        pending: "pending";
         promoted: "promoted";
         quarantined: "quarantined";
-        pending: "pending";
         in_review: "in_review";
         passed: "passed";
         rejected: "rejected";
@@ -1443,9 +1443,9 @@ export declare const ExternalSkillCandidateSchema: z.ZodObject<{
     }>>;
     evaluation_history: z.ZodDefault<z.ZodArray<z.ZodObject<{
         verdict: z.ZodEnum<{
+            pending: "pending";
             promoted: "promoted";
             quarantined: "quarantined";
-            pending: "pending";
             in_review: "in_review";
             passed: "passed";
             rejected: "rejected";
@@ -1456,9 +1456,9 @@ export declare const ExternalSkillCandidateSchema: z.ZodObject<{
         reason: z.ZodOptional<z.ZodString>;
         candidate_id: z.ZodOptional<z.ZodString>;
         original_verdict: z.ZodOptional<z.ZodEnum<{
+            pending: "pending";
             promoted: "promoted";
             quarantined: "quarantined";
-            pending: "pending";
             in_review: "in_review";
             passed: "passed";
             rejected: "rejected";
@@ -1928,9 +1928,9 @@ export declare const PluginConfigSchema: z.ZodObject<{
         todo_max_phases: z.ZodDefault<z.ZodNumber>;
         sweep_enabled: z.ZodDefault<z.ZodBoolean>;
         confidence_floor_action: z.ZodDefault<z.ZodEnum<{
-            none: "none";
-            demote: "demote";
             quarantine: "quarantine";
+            demote: "demote";
+            none: "none";
         }>>;
         confidence_floor_min_outcomes: z.ZodDefault<z.ZodNumber>;
         confidence_floor_signal_threshold: z.ZodDefault<z.ZodNumber>;

package/dist/config/skill-mirrors.d.ts

@@ -92,7 +92,7 @@ export declare const OPENCODE_ONLY_ARCHITECT_MODE_SKILLS: Array<{
  */
 export declare const ADDITIONAL_SKILL_MIRROR_CONTRACTS: Array<{
     slug: string;
-    kind: 'identical' | 'divergent' | 'opencode-only' | 'adapter';
+    kind: 'identical' | 'divergent' | 'opencode-only' | 'adapter' | 'agents-only';
     canonical?: '.claude' | '.opencode';
     extraIdenticalPaths?: string[];
     /**

package/dist/hooks/curator-postmortem.d.ts

@@ -67,9 +67,11 @@ export interface PostMortemActionResult {
     proposals_rejected: number;
     proposals_skipped: number;
 }
-declare function collectKnowledgeSummary(directory: string, scope?: 'session' | 'project', sessionID?: string): Promise<KnowledgeEventSummary[]>;
+declare function collectKnowledgeSummary(directory: string, scope?: 'session' | 'project', sessionID?: string, out?: {
+    generation?: number;
+}): Promise<KnowledgeEventSummary[]>;
 declare function parsePostMortemActions(llmOutput: string): ParsedPostMortemActions;
-declare function executePostMortemActions(directory: string, parsed: ParsedPostMortemActions, options: PostMortemOptions): Promise<{
+declare function executePostMortemActions(directory: string, parsed: ParsedPostMortemActions, options: PostMortemOptions, generation?: number): Promise<{
     result: PostMortemActionResult;
     warnings: string[];
 }>;
@@ -131,8 +133,8 @@ export declare const _internals: {
     executePostMortemActions: typeof executePostMortemActions;
     verifyPostMortemKnowledgeActions: typeof verifyPostMortemKnowledgeActions;
     repairPostMortemActions: typeof repairPostMortemActions;
-    loadDefaultKnowledgeConfig: () => Promise<KnowledgeConfig>;
-    applyCuratorKnowledgeUpdates: (directory: string, recommendations: KnowledgeRecommendation[], knowledgeConfig: KnowledgeConfig) => Promise<{
+    loadDefaultKnowledgeConfig: (directory: string) => Promise<KnowledgeConfig>;
+    applyCuratorKnowledgeUpdates: (directory: string, recommendations: KnowledgeRecommendation[], knowledgeConfig: KnowledgeConfig, generation?: number) => Promise<{
         applied: number;
         skipped: number;
     }>;

package/dist/hooks/curator.d.ts

@@ -213,9 +213,13 @@ export declare function runCuratorPhase(directory: string, phase: number, agents
  * @param directory - The workspace directory
  * @param recommendations - Array of knowledge recommendations to apply
  * @param knowledgeConfig - Knowledge configuration (for path resolution)
+ * @param generation - Optional fair-scan-cursor generation (#1848 §4). When
+ *   provided, curation mutations stamp `last_curated_generation` on the mutated
+ *   entry so a future sweep can detect it was already curated this generation.
+ *   When undefined, no stamp is written (preserves callers that don't pass it).
  * @returns Counts of applied and skipped recommendations
  */
-export declare function applyCuratorKnowledgeUpdates(directory: string, recommendations: KnowledgeRecommendation[], knowledgeConfig: KnowledgeConfig): Promise<{
+export declare function applyCuratorKnowledgeUpdates(directory: string, recommendations: KnowledgeRecommendation[], knowledgeConfig: KnowledgeConfig, generation?: number): Promise<{
     applied: number;
     skipped: number;
 }>;

package/dist/hooks/hive-promoter.d.ts

@@ -22,6 +22,7 @@
  * runs only on the lazy `/swarm promote`, close, curate, and postmortem paths.
  */
 import { resolveCohortId } from '../knowledge/cohort-identity.js';
+import { authorizeCuration } from '../knowledge/curation-policy.js';
 import { appendCuratorRecommendation, readCuratorSummary } from './curator.js';
 import { transactHiveStore } from './hive-transaction.js';
 import type { KnowledgeConfig, ProjectConfirmationRecord, PromotionEvidenceRecord, SwarmKnowledgeEntry } from './knowledge-types.js';
@@ -79,6 +80,7 @@ export declare const _internals: {
     resolveCohortId: typeof resolveCohortId;
     transactHiveStore: typeof transactHiveStore;
     validateLesson: typeof validateLesson;
+    authorizeCuration: typeof authorizeCuration;
     /** Loads validated terminal-application evidence per swarm entry id. Empty
      *  until #1849 produces real receipts (conservative: no synthetic credit). */
     loadPromotionEvidence: (_swarmEntries: SwarmKnowledgeEntry[]) => Promise<Record<string, PromotionEvidenceRecord[]>>;
@@ -113,7 +115,7 @@ export declare const _internals: {
         default_max_phases: number;
         todo_max_phases: number;
         sweep_enabled: boolean;
-        confidence_floor_action: "none" | "demote" | "quarantine";
+        confidence_floor_action: "quarantine" | "demote" | "none";
         confidence_floor_min_outcomes: number;
         confidence_floor_signal_threshold: number;
         contradiction_threshold_action: "quarantine" | "tag_only";

package/dist/hooks/knowledge-store.d.ts

@@ -1,10 +1,11 @@
 /** Core storage layer for the opencode-swarm v6.17 two-tier knowledge system. */
 import { resolveHiveDataDir, resolveHiveEventsPath as resolveHiveEventsPathImpl, resolveHiveKnowledgePath as resolveHiveKnowledgePathImpl, resolveHiveRejectedPath as resolveHiveRejectedPathImpl } from '../knowledge/hive-paths.js';
-import type { KnowledgeEntryBase, RejectedLesson, RetrievalOutcome } from './knowledge-types.js';
+import type { KnowledgeEntryBase, RejectedLesson, RetrievalOutcome, RewriteHistoryRecord } from './knowledge-types.js';
 export declare function getPlatformConfigDir(): string;
 export declare function resolveSwarmKnowledgePath(directory: string): string;
 export declare function resolveSwarmRejectedPath(directory: string): string;
 export declare function resolveSwarmRetractionsPath(directory: string): string;
+export declare function resolveRewriteHistoryPath(directory: string): string;
 export declare const resolveHiveKnowledgePath: typeof resolveHiveKnowledgePathImpl;
 export declare const resolveHiveRejectedPath: typeof resolveHiveRejectedPathImpl;
 export declare const resolveHiveEventsPath: typeof resolveHiveEventsPathImpl;
@@ -12,6 +13,12 @@ export { resolveHiveDataDir };
 declare function parseKnowledgeContent<T>(content: string, max: number): T[];
 export declare function readKnowledge<T>(filePath: string, maxEntries?: number): Promise<T[]>;
 export declare function normalizeEntry<T>(raw: T): T;
+/**
+ * Compute a 12-hex SHA-256 prefix of a lesson string (issue #1848 §3).
+ * Used as the `content_hash` CAS token, stamped at write/mutation time only.
+ * Mirrors the style of `lessonRevision()` in hive-promoter.ts.
+ */
+export declare function computeContentHash(lesson: string): string;
 export declare function readRejectedLessons(directory: string): Promise<RejectedLesson[]>;
 export interface KnowledgeRetractionRecord {
     id: string;
@@ -24,10 +31,56 @@ export interface KnowledgeRetractionRecord {
 }
 export declare function readRetractionRecords(directory: string): Promise<KnowledgeRetractionRecord[]>;
 export declare function appendRetractionRecord(directory: string, record: KnowledgeRetractionRecord): Promise<void>;
+/**
+ * Append an immutable rewrite/merge history record to the cohort-scoped audit
+ * log (issue #1848 §3). FIFO-capped at 2000 entries so the audit trail is
+ * bounded. Fail-open: a history-append failure must not abort the mutation that
+ * already committed (the mutation is the source of truth; history is audit).
+ */
+export declare function appendRewriteHistory(directory: string, record: RewriteHistoryRecord): Promise<void>;
+/**
+ * Read rewrite/merge history records (issue #1848 §3). Used for audit/recovery.
+ */
+export declare function readRewriteHistory(directory: string): Promise<RewriteHistoryRecord[]>;
 export declare function appendKnowledge<T>(filePath: string, entry: T): Promise<void>;
 export declare function rewriteKnowledge<T>(filePath: string, entries: T[]): Promise<void>;
 export declare function transactFile<T>(filePath: string, read: (filePath: string) => Promise<T>, write: (filePath: string, data: T) => Promise<void>, mutate: (data: T) => T | null): Promise<boolean>;
 export declare function transactKnowledge<T>(filePath: string, mutate: (entries: T[]) => T[] | null): Promise<boolean>;
+/**
+ * Compare-and-swap guarded mutation for a single entry (issue #1848 §3).
+ *
+ * Runs inside the existing directory lock (lock-before-read). Finds the entry
+ * by `id`. If `expectedRevision`/`expectedContentHash` are provided and the
+ * current entry's revision/content_hash do not match, the mutation is SKIPPED
+ * and `{committed:false, casFailed:true}` is returned — a stale curator plan is
+ * rejected, NOT silently applied. This closes the lost-update hazard where a
+ * plan generated from a stale snapshot overwrites an entry a sibling worktree
+ * just updated.
+ *
+ * On an accepted mutation: bumps `revision`, recomputes `content_hash`, stamps
+ * `updated_at`, and (when `apply` returns a `RewriteHistoryRecord`) appends the
+ * immutable before/after audit record. Authorization is the CALLER's
+ * responsibility (run `authorizeCuration` BEFORE calling this); CAS enforces
+ * the revision contract INSIDE the transaction.
+ *
+ * Legacy entry (revision 0/undefined): CAS with `expectedRevision === undefined`
+ * is allowed (the first authorized mutation stamps revision 1). The
+ * unknown-owner-protected case never reaches here because authorizeCuration
+ * returns a proposal instead of authorizing.
+ */
+export declare function transactKnowledgeWithCas<T extends {
+    id: string;
+    revision?: number;
+    content_hash?: string;
+    lesson?: string;
+    updated_at?: string;
+}>(directory: string, filePath: string, entryId: string, expectedRevision: number | undefined, expectedContentHash: string | undefined, apply: (entry: T) => {
+    mutated: T;
+    rewriteHistory?: RewriteHistoryRecord;
+} | null): Promise<{
+    committed: boolean;
+    casFailed: boolean;
+}>;
 export declare function getArchivedKnowledgeIds(directory: string): Promise<Set<string>>;
 export declare function appendKnowledgeWithCapEnforcement<T>(filePath: string, entry: T, maxEntries: number): Promise<boolean>;
 export declare function enforceKnowledgeCap<T>(filePath: string, maxEntries: number): Promise<void>;

package/dist/hooks/knowledge-types.d.ts

@@ -120,6 +120,87 @@ export interface ActionableDirectiveFields {
     /** ISO 8601 timestamp of last explicit acknowledgment. */
     last_acknowledged_at?: string;
 }
+/**
+ * Canonical cohort-scoped producer provenance (issue #1848 §1).
+ *
+ * Every mutable knowledge entry carries enough immutable provenance for a
+ * cohort-safe ownership decision: who produced it, in which cohort, from which
+ * worktree/session, and tied to which creation transaction. Absent/null on
+ * legacy entries written before #1848 — such entries are treated as
+ * unknown-owner and protected from destructive curation by default (the
+ * curation-policy layer converts destructive intent into a non-destructive
+ * proposal rather than guessing an owner from the current worktree).
+ *
+ * `worktree_id` is the primary ownership key: a worktree may directly mutate an
+ * entry only when it is the proven producer (or cohort quorum / operator
+ * override applies). It is stored at write time from `resolveWorktreeId`
+ * (src/knowledge/worktree-identity.ts) — a per-worktree stable id, NOT
+ * link-resolved, so two sibling worktrees of the same cohort have distinct
+ * ownership keys.
+ */
+export interface ProducerProvenance {
+    /** Canonical cohort id (from `resolveCohortId`, #1846). Scopes quorum + audit. */
+    cohort_id: string;
+    /** Stable per-worktree id (owner key). NOT link-resolved — per-worktree. */
+    worktree_id: string;
+    /** Producing session id, when known (audit). */
+    session_id?: string;
+    /** Producing agent/role, when known (audit). */
+    role?: string;
+    /** Creation transaction/event id, when known (audit lineage). */
+    creation_event_id?: string;
+}
+/**
+ * The evidence scope a curation decision was based on (issue #1848 §2).
+ *
+ * Absence of LOCAL session events is NOT negative evidence — a worktree that
+ * never saw an application event for an entry cannot conclude the entry was
+ * never applied (a sibling producer may have applied it). Evidence queries must
+ * be scoped intentionally:
+ *   - `local-session`: only this worktree's session events (owner-local decisions)
+ *   - `producer`:       the producing worktree's own validated evidence
+ *   - `cohort-wide`:    the full cohort event log (shared/quorum decisions)
+ */
+export type CurationEvidenceScope = 'local-session' | 'producer' | 'cohort-wide';
+/**
+ * Every destructive lifecycle action the curation-policy layer authorizes
+ * (issue #1848 §2). All of these share one policy so archive/purge/remove/
+ * quarantine/retraction/merge/retire cannot diverge in ownership semantics.
+ */
+export type CurationAction = 'archive' | 'purge' | 'remove' | 'quarantine' | 'retract' | 'rewrite' | 'merge' | 'retire' | 'demote' | 'restore' | 'unarchive' | 'escalate';
+/**
+ * A non-destructive proposal recorded when a destructive curation action is
+ * unauthorized (issue #1848 §2). Other cohort members may later confirm it.
+ * Destructive intent is preserved WITHOUT mutating the shared record.
+ */
+export interface CurationProposal {
+    entryId: string;
+    action: CurationAction;
+    reason?: string;
+    evidenceScope: CurationEvidenceScope;
+    proposedAt: string;
+    status: 'pending';
+}
+/**
+ * Immutable before/after history for a destructive rewrite or merge (issue
+ * #1848 §3). Ensures the only copy of prior lesson text is never overwritten,
+ * and supports deterministic reconstruction or rollback. Appended to the
+ * cohort-scoped `knowledge-rewrites.jsonl` audit log.
+ */
+export interface RewriteHistoryRecord {
+    entry_id: string;
+    before_lesson: string;
+    after_lesson: string;
+    before_revision: number;
+    after_revision: number;
+    /** 'auto' | producing worktree_id | 'manual-override'. */
+    actor: string;
+    reason?: string;
+    /** Event/trace ids that justified the change. */
+    evidence_refs?: string[];
+    timestamp: string;
+    action: 'rewrite' | 'merge';
+}
 export interface KnowledgeEntryBase extends ActionableDirectiveFields {
     id: string;
     tier: 'swarm' | 'hive';
@@ -163,9 +244,33 @@ export interface KnowledgeEntryBase extends ActionableDirectiveFields {
      * counter update. Prevents double-counting when `curateAndStoreSwarm` runs
      * multiple times in the same logical phase (e.g. phase-complete + close). */
     last_demotion_phase?: number;
+    /** #1848 §1: producer provenance. Absent/null on legacy entries →
+     * unknown-owner → protected from destructive curation by default. Filled at
+     * creation time by all new-entry paths via `resolveWorktreeId` +
+     * `resolveCohortId`. Never synthesized for legacy records. */
+    producer?: ProducerProvenance | null;
+    /** #1848 §3: monotonic revision counter for compare-and-swap. Starts at 1
+     * at creation, bumped on each accepted mutation. Absent/0 = legacy (CAS
+     * with `expectedRevision === undefined` allows the first mutation). */
+    revision?: number;
+    /** #1848 §3: 12-hex SHA-256 prefix of `lesson`, for CAS content verification.
+     * Computed at WRITE time only (never per-read) to avoid hashing thousands of
+     * entries on every readKnowledge of a large cohort store. Absent on legacy. */
+    content_hash?: string;
+    /** #1848 §4: idempotency stamp for the fair scan cursor. Records the
+     * generation in which this entry was last curated by a non-idempotent action
+     * (rewrite/demote/confidence-delta). Prevents compounding under concurrent
+     * cohort postmortems that claim the same batch. */
+    last_curated_generation?: number;
 }
-/** v2 schema marker. v1 entries are still parseable and normalized in-memory by knowledge-store.normalizeEntry. */
-export declare const KNOWLEDGE_SCHEMA_VERSION = 2;
+/**
+ * Current knowledge schema marker. v1 entries are still parseable and
+ * normalized in-memory by knowledge-store.normalizeEntry. v3 (#1848) adds
+ * optional `producer`, `revision`, `content_hash`, and `last_curated_generation`
+ * fields — all default-absent so v1/v2/v3 records coexist on disk without an
+ * on-disk migration. New writes stamp v3.
+ */
+export declare const KNOWLEDGE_SCHEMA_VERSION = 3;
 /**
  * The single canonical set of inactive (non-retrieval) knowledge statuses.
  * Every retrieval/filter consumer MUST go through {@link isActiveStatus} rather

package/dist/hooks/knowledge-validator.d.ts

@@ -1,4 +1,5 @@
 /** Three-layer validation gate for the opencode-swarm v6.17 knowledge system. */
+import { type CurationAuthorizationInput, type CurationContext } from '../knowledge/curation-policy.js';
 import type { ActionableDirectiveFields, DirectivePriority, KnowledgeCategory, KnowledgeEntryBase } from './knowledge-types.js';
 export interface ValidationResult {
     valid: boolean;
@@ -124,12 +125,27 @@ export interface EntryHealthResult {
     concern?: string;
 }
 export declare function auditEntryHealth(entry: KnowledgeEntryBase): EntryHealthResult;
-export declare function quarantineEntry(directory: string, entryId: string, reason: string, reportedBy: 'architect' | 'user' | 'auto'): Promise<void>;
-export declare function restoreEntry(directory: string, entryId: string): Promise<void>;
+export declare function quarantineEntry(directory: string, entryId: string, reason: string, reportedBy: 'architect' | 'user' | 'auto', 
+/** #1848: cohort-safe curation context. When provided, the quarantine is
+ * authorized through the shared curation policy BEFORE mutating; an
+ * unauthorized action becomes a non-destructive no-op (the policy records a
+ * proposal). When omitted, the legacy behavior applies (used by
+ * deterministic validation-failure withholds and non-cohort callers). */
+curationContext?: {
+    input: CurationAuthorizationInput;
+    context: CurationContext;
+}): Promise<void>;
+export declare function restoreEntry(directory: string, entryId: string, 
+/** #1848 §2: cohort-safe curation context (optional). When provided, the
+ * restore is authorized through the shared policy before mutating. */
+curationContext?: {
+    input: CurationAuthorizationInput;
+    context: CurationContext;
+}): Promise<void>;
 export interface UnarchiveResult {
     restored: boolean;
     restored_to?: string;
-    reason?: 'not_found' | 'not_archived' | 'invalid_lesson';
+    reason?: 'not_found' | 'not_archived' | 'invalid_lesson' | 'blocked_by_policy';
 }
 /**
  * G6 (#1716): restore an `archived`-status entry from `knowledge.jsonl` to its
@@ -139,7 +155,12 @@ export interface UnarchiveResult {
  * (especially one restored to `promoted`) is not demoted almost immediately
  * under the new demotion window.
  */
-export declare function unarchiveEntry(directory: string, entryId: string): Promise<UnarchiveResult>;
+export declare function unarchiveEntry(directory: string, entryId: string, 
+/** #1848 §2 (IR-3 fix): cohort-safe curation context (optional). */
+curationContext?: {
+    input: CurationAuthorizationInput;
+    context: CurationContext;
+}): Promise<UnarchiveResult>;
 export declare const _internals: {
     validateLesson: typeof validateLesson;
     auditEntryHealth: typeof auditEntryHealth;