opencode-swarm 7.146.2 → 7.146.4

package/dist/council/types.d.ts

@@ -8,6 +8,13 @@ export type CouncilVerdict = 'APPROVE' | 'CONCERNS' | 'REJECT';
 export type CouncilFindingSeverity = 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW';
 export type CouncilFindingCategory = 'logic' | 'edge_case' | 'error_handling' | 'spec_compliance' | 'security' | 'maintainability' | 'naming' | 'domain' | 'test_gap' | 'test_quality' | 'mutation_gap' | 'adversarial_gap' | 'slop_pattern' | 'hallucinated_api' | 'lazy_abstraction' | 'cargo_cult' | 'spec_drift' | 'other';
 export type CouncilAgent = 'critic' | 'reviewer' | 'sme' | 'test_engineer' | 'explorer';
+/**
+ * The canonical five-member council role set (issue #2102 contract H).
+ * Writers, gates, and quorum checks must import this constant instead of
+ * re-declaring the list, so the role policy can never drift between the
+ * write path and the gate path.
+ */
+export declare const COUNCIL_MEMBER_ROLES: readonly CouncilAgent[];
 export interface CouncilFinding {
     severity: CouncilFindingSeverity;
     category: CouncilFindingCategory;
@@ -145,12 +152,25 @@ export interface CouncilCriteria {
     /** ISO 8601 */
     declaredAt: string;
 }
+/** Normalized final-council completion policy (issue #2102 contract C). */
+export interface FinalCompletionPolicyConfig {
+    /** 'all_required' (default, strict legacy) or explicit 'quorum' weakening. */
+    mode: 'all_required' | 'quorum';
+    /** Required when mode is 'quorum'; bounded 3..5 distinct canonical members. */
+    minimumMembers?: number;
+}
 /** Config shape — matched in schema.ts via CouncilConfigSchema. */
 export interface CouncilConfig {
     enabled: boolean;
     /** Default 3 */
     maxRounds: number;
-    /** Default 30_000 */
+    /**
+     * @deprecated Inert — declared for parse compatibility only. No runtime
+     * consumer exists: council tools consume already-returned verdict
+     * submissions and there is no member-dispatch cancellation seam. Config
+     * doctor warns when this is explicitly set; the field will be removed in
+     * a future release. Dispatch timeouts are governed by the agent host.
+     */
     parallelTimeoutMs: number;
     /** Default true — any REJECT blocks */
     vetoPriority: boolean;
@@ -159,15 +179,31 @@ export interface CouncilConfig {
     /** Default 3 — minimum distinct council members required for quorum. requireAllMembers: true overrides this to 5. */
     minimumMembers: number;
     /**
-     * Optional webhook URL or handler name for auto-escalation when maxRounds is
-     * reached without APPROVE. Reserved for forward compatibility — NOT yet
-     * implemented. Currently, maxRounds exhaustion surfaces a user-facing message
-     * via `buildUnifiedFeedbackMd` in council-service.ts (see the "Escalate to
-     * user" block), and the architect must relay it to the user. Future wiring
-     * options: critic_oversight agent, HTTP webhook, or configurable handler.
+     * Optional webhook URL or handler name declared for escalation when
+     * maxRounds is reached without APPROVE. REMAINS INERT: no handler,
+     * webhook, or outbound execution exists or is invoked. Config doctor
+     * visibly warns when it is explicitly set (issue #1650), and max-rounds
+     * exhaustion emits a durable structured event plus a user escalation
+     * message. Wiring real escalation requires a separate security review.
      */
     escalateOnMaxRounds?: string;
     /** Default true — CONCERNS verdict with only MEDIUM/LOW findings does NOT block completion (advisory). Set false to make all CONCERNS block like REJECT. Note: HIGH/CRITICAL findings from CONCERNS members are always promoted to requiredFixes and block at the tool level regardless of this setting. */
     phaseConcernsAllowComplete: boolean;
+    /**
+     * Final-council completion policy. Missing/default `all_required`
+     * preserves the exact legacy requirement (all five canonical roles,
+     * five distinct members, zero absentees). `quorum` is an explicit,
+     * bounded weakening: it requires `minimumMembers` between 3 and 5, and
+     * only distinct members of the canonical five-role set count. The
+     * normalized policy is part of the council policy digest, so any change
+     * invalidates previously accepted final-council evidence.
+     */
+    finalCompletionPolicy: FinalCompletionPolicyConfig;
+    /**
+     * Default 24 — maximum age (hours) of phase-council, architecture-
+     * supervisor, and final-council evidence. Bounded 1..720. Part of the
+     * council policy digest, so changing it invalidates prior evidence.
+     */
+    freshnessMaxAgeHours: number;
 }
 export declare const COUNCIL_DEFAULTS: CouncilConfig;

package/dist/hooks/pr-workflow-gate.d.ts

@@ -1,6 +1,6 @@
 import * as fsp from 'node:fs/promises';
 import { z } from 'zod';
-import { type CandidateSeverity, type RowFormatFamily } from '../background/candidate-contract.js';
+import { type CandidateSeverity, type FindingsSeverity, type RowFormatFamily } from '../background/candidate-contract.js';
 import { type LaneOutputArtifact } from '../background/lane-output-store.js';
 import { type BackgroundDelegationRecord, type BackgroundDelegationResult, type BackgroundDelegationWorkflowLaneRecovery, findByBatchId, sweepStaleDelegations } from '../background/pending-delegations.js';
 import { type PrReviewInlineTriggerRow } from '../background/pr-review-trigger-contract.js';
@@ -11,7 +11,7 @@ export declare const PR_REVIEW_BASE_DIMENSION_IDS: readonly ["intent-architectur
 export declare const PR_REVIEW_REQUIRED_MICRO_LANE_IDS: ("auth-identity-secrets" | "untrusted-input-boundaries" | "subprocess-platform" | "concurrency-state" | "dependencies-build-release" | "api-schema-migrations" | "test-infrastructure" | "ui-accessibility-i18n" | "privacy-observability" | "generated-provenance" | "unclassified-risk")[];
 export type PrReviewBaseDimensionId = (typeof PR_REVIEW_BASE_DIMENSION_IDS)[number];
 export type PrWorkflowMode = 'PR_REVIEW' | 'PR_FEEDBACK';
-export type PrReviewLaneValidationPredicate = 'batch.validated_at' | 'batch.expected_lane_unique' | 'record.missing' | 'record.duplicate_lane' | 'record.subagent_session_id' | 'record.duplicate_subagent_session_id' | 'record.forbidden_subagent_session_id' | 'record.created_at' | 'record.workflow_lane' | 'record.owned_workflow_lanes' | 'record.mode' | 'record.pr_head_sha' | 'record.git_head' | 'record.status' | 'result.output_degraded' | 'result.transcript_incomplete' | 'result.chars' | 'result.digest' | 'result.output_ref' | 'artifact.readable' | 'artifact.ref' | 'artifact.batch_id' | 'artifact.lane_id' | 'artifact.mode' | 'artifact.session_id' | 'artifact.parent_session_id' | 'artifact.agent' | 'artifact.role' | 'artifact.source' | 'artifact.workflow_lane_record' | 'artifact.workflow_lane_expected' | 'artifact.pr_head_sha' | 'artifact.git_head' | 'artifact.revision_digest' | 'record.scope' | 'artifact.scope' | 'artifact.digest' | 'artifact.chars' | 'discovery.header' | 'discovery.row' | 'discovery.coverage' | 'discovery.duplicate_evidence';
+export type PrReviewLaneValidationPredicate = 'batch.validated_at' | 'batch.expected_lane_unique' | 'record.missing' | 'record.duplicate_lane' | 'record.subagent_session_id' | 'record.duplicate_subagent_session_id' | 'record.forbidden_subagent_session_id' | 'record.created_at' | 'record.workflow_lane' | 'record.owned_workflow_lanes' | 'record.mode' | 'record.pr_head_sha' | 'record.git_head' | 'record.status' | 'result.output_degraded' | 'result.transcript_incomplete' | 'result.chars' | 'result.digest' | 'result.output_ref' | 'artifact.readable' | 'artifact.ref' | 'artifact.batch_id' | 'artifact.lane_id' | 'artifact.mode' | 'artifact.session_id' | 'artifact.parent_session_id' | 'artifact.agent' | 'artifact.role' | 'artifact.source' | 'artifact.workflow_lane_record' | 'artifact.workflow_lane_expected' | 'artifact.pr_head_sha' | 'artifact.git_head' | 'artifact.revision_digest' | 'record.scope' | 'artifact.scope' | 'artifact.digest' | 'artifact.chars' | 'discovery.header' | 'discovery.row' | 'discovery.coverage' | 'discovery.duplicate_evidence' | 'reviewer.verdict_rows' | 'critic.verdict_rows';
 export interface PrReviewLaneValidationFailure {
     predicate: PrReviewLaneValidationPredicate;
     expected: string;
@@ -54,12 +54,20 @@ export interface PrWorkflowTransportRecoveryValidationInput {
     artifact: LaneOutputArtifact | null;
     revisionDigest: string;
 }
+export interface PrReviewVerdictCollectionReceipt {
+    assignedReviewItemIds: string[];
+    acceptedReviewItemIds: string[];
+    rejectedReviewItemIds: string[];
+}
 export type PrWorkflowTransportRecoveryValidationResult = {
     ok: true;
     recoveries?: readonly BackgroundDelegationWorkflowLaneRecovery[];
+    receipt?: PrReviewVerdictCollectionReceipt;
 } | {
     ok: false;
     reason: string;
+    failure?: PrReviewLaneValidationFailure;
+    receipt?: PrReviewVerdictCollectionReceipt;
 };
 export interface PrWorkflowCheckoutRecoveryRecord {
     code: 'UNMERGED_INDEX' | 'GIT_OPERATION_IN_PROGRESS' | 'DIRTY_SUBMODULE' | 'SWARM_STATE_TRACKING_ERROR' | 'GIT_STATE_INDETERMINATE';
@@ -258,7 +266,14 @@ type PrReviewArtifactRecord = {
     finding_id: string;
     status: 'PENDING' | 'CONFIRMED' | 'DISPROVED' | 'PRE_EXISTING';
     next_action: 'route_to_reviewer' | 'route_to_critic' | 'report' | 'suppress_with_reason' | 'handoff_to_feedback';
-    severity?: CandidateSeverity;
+    /**
+     * Optional in the TYPE only so a legacy findings row persisted before
+     * required-severity landed still loads (`readFindings` JSON-parses without
+     * re-validating). Presence is REQUIRED by
+     * `assertPrReviewArtifactRecordsMatchAuthoritativeVerdicts`, which treats an
+     * omitted severity as a mismatch rather than skipping the check (issue #2279).
+     */
+    severity?: FindingsSeverity;
 };
 interface PrFeedbackScopeDeclarationRecord {
     taskId: string;
@@ -292,8 +307,9 @@ interface PrReviewValidationBatchRecord {
 interface PrReviewBatchCoherenceRecord {
     /**
      * The exact candidate/critic inventory this batch's ownership was validated
-     * against at record time (the same set `assertExactStringSet` compared the
-     * declared lane items to).
+     * against at record time. A batch may own a subset of this inventory; retaining
+     * the full set here prevents stale partial batches from contributing after the
+     * mechanically derived inventory changes.
      */
     validatedInventory: string[];
     /**
@@ -305,6 +321,8 @@ interface PrReviewBatchCoherenceRecord {
      * claims it invalidated and leaves its siblings intact.
      */
     reviewerItemBindings?: Record<string, string>;
+    /** Key encoding for reviewerItemBindings; absent means legacy raw item IDs. */
+    reviewerItemBindingKeyEncoding?: 'prefixed-v1';
 }
 export interface PrWorkflowGateState {
     schemaVersion: 1;
@@ -888,6 +906,12 @@ export declare const _test_exports: {
     resolveRemoteRefsContainingHead: typeof resolveRemoteRefsContainingHead;
     resolveRemoteRefsContainingHeadAsync: typeof resolveRemoteRefsContainingHeadAsync;
     parseCriticVerdict: typeof parseCriticVerdict;
+    /**
+     * Exact production verdict-row analysis and item composition parsers. Exposed
+     * so the assignment-boundary regression can prove both paths remain linear.
+     */
+    analyzePrReviewVerdictRowContract: typeof analyzePrReviewVerdictRowContract;
+    parseLaneItemVerdicts: typeof parseLaneItemVerdicts;
     /**
      * Read-only view of the item-keyed composition for one session, including
      * the diagnostics that settlement only logs (abandoned declared lanes,
@@ -994,6 +1018,12 @@ interface PrReviewGateContext {
     reviewer?: PrReviewPhaseComposition;
     critic?: PrReviewPhaseComposition;
     candidateInventory?: string[];
+    /**
+     * candidate_id -> the severity its `[CANDIDATE]` row declared. Populated
+     * as a by-product of deriving the inventory, so it is exactly as
+     * authoritative and as scoped as the inventory itself (issue #2320).
+     */
+    candidateSeverities?: Map<string, CandidateSeverity>;
 }
 /**
  * Extract candidate ids from a discovery artifact's [CANDIDATE] rows. When
@@ -1006,6 +1036,13 @@ interface PrReviewGateContext {
 interface CanonicalCandidateArtifactRow {
     candidateId: string;
     workflowLane: string;
+    /**
+     * The row's declared severity, already validated against
+     * `CANDIDATE_SEVERITIES` by `analyzeCandidateFields` (so never `NONE`).
+     * Carried so the `post_explorer` findings boundary can compare a record's
+     * severity against the candidate row that produced it (issue #2320).
+     */
+    severity: CandidateSeverity | null;
     evidence: string;
     lineNumber: number;
 }
@@ -1133,6 +1170,22 @@ export declare function prReviewDiscoveryArtifactCoversLane(text: string, expect
  * `pipeFields` can never produce, so no field boundary is forgeable.
  */
 declare function reviewerVerdictRowDigest(fields: readonly string[]): string;
+/**
+ * Per-item verdicts an artifact actually carries, as a map rather than a
+ * boolean. This is the granularity the composition needs: one unparseable item
+ * must not discard its healthy siblings in the same lane.
+ */
+declare function parseLaneItemVerdicts(text: string, itemIds: readonly string[], phase: PrReviewComposablePhase, reviewerClaims?: ReadonlyMap<string, PrReviewItemClaim>): Map<string, {
+    classification: string;
+    severity: string;
+    rowDigest?: string;
+}>;
+/** Exact assigned-row contract used by both normal and recovered collection. */
+declare function analyzePrReviewVerdictRowContract(text: string, itemIds: readonly string[], phase: PrReviewComposablePhase, reviewerClaims?: ReadonlyMap<string, PrReviewItemClaim>): {
+    ok: boolean;
+    expected: string;
+    actual: string;
+};
 declare function parseCriticVerdict(text: string, itemId: string, reviewerSeverity?: string): {
     status: string;
     severity: string;