opencode-swarm 7.171.0 → 7.171.2

package/dist/observability/index.d.ts

@@ -50,7 +50,7 @@ export type { TraceAndSpanId } from './ids.js';
 export { newEventId, newSpanId, pseudonymousRef, SPAN_ID_HEX_LENGTH, TRACE_ID_HEX_LENGTH, } from './ids.js';
 export { adaptLegacyTelemetryPayload, extractOutcome, extractWorkflowIds, KNOWN_TELEMETRY_KEYS, LEGACY_ADAPTER_RULES, NON_OBJECT_PAYLOAD_MARKER, } from './legacy.js';
 export type { InitObservabilityInput } from './observe.js';
-export { createObservation, initObservability, resetObservabilityForTesting, toLegacyTelemetryLine, } from './observe.js';
+export { canonicalLineContent, createObservation, initObservability, resetObservabilityForTesting, toLegacyTelemetryLine, } from './observe.js';
 export { mappingForEntry, OPENINFERENCE_ATTRIBUTES, OPENINFERENCE_MAPPING_VERSION, OTEL_GENAI_ATTRIBUTES, OTEL_GENAI_MAPPING_VERSION, } from './otel-mapping.js';
 export type { RelationshipValidationResult } from './relationships.js';
 export { RELATIONSHIP_VIOLATION_CODES, validateEventRelationships, } from './relationships.js';

package/dist/observability/observe.d.ts

@@ -101,6 +101,12 @@ export declare function createObservation(kind: string, data: unknown): Observab
  * those inputs.
  */
 export declare function toLegacyTelemetryLine(event: ObservabilityEvent): Record<string, unknown>;
+/**
+ * The exact JSONL line content `emit()` writes, without the EOL. Single
+ * definition so the writer (src/telemetry.ts) and the observability store's
+ * content-derived `line_hash` correlation (issue #2487) can never drift apart.
+ */
+export declare function canonicalLineContent(event: ObservabilityEvent): string;
 /**
  * Reset all four module-scoped variables.
  *

package/dist/pr-review/reducer.d.ts

@@ -1,24 +1,30 @@
 /**
- * PR-review transition authority (issue #2385).
+ * PR-review transition authority (issues #2385, #2512).
  *
  * Pure `(state, event) -> { state, effects }` reducer over the closed
  * `PrReviewEvent` union. Rule computation is delegated to the focused
  * boundary modules (`circuit.ts`, `completion.ts` via its settlement inputs,
  * `critic-routing.ts`, `lifecycle.ts`); this module owns transition
  * composition and the explicit rejection of every invalid transition class
- * named by issue #2385:
+ * named by issue #2385 that is reducer-observable:
  *
- * - observer deadline / client absence → terminal child failure
- * - raw transcript / parser failure → provider circuit signal
- * - one lane → multiple circuit samples (delegated to circuit.ts's
- *   distinct-`(generation, batch, lane)` scan; asserted by property tests)
  * - unresolved/live lane → terminal coverage report
- * - partial/no coverage → approval
+ * - partial coverage → approval; zero coverage → anything but INCOMPLETE
  * - ordinary MEDIUM → critic without typed high-impact/vulnerability evidence
  *   (enforced where critic inventory is composed, via critic-routing.ts)
- * - stale/foreign authorization → reviewer or publication access
+ * - stale/foreign authorization → armed-recovery transition
  * - late old-generation result → current-state mutation
- * - structured receipt → downgrade by later transcript parsing
+ *
+ * Rules that depend on facts this pure boundary cannot observe live at
+ * richer executors and are NOT reducer events (issue #2512 wire-or-retire
+ * census; see docs/pr-review-transition-authority.md): observer-deadline /
+ * client-absence / parser / stale-sweep evidence classification
+ * (`classifyPrReviewCircuitSignal`), structured-receipt downgrade protection
+ * (`validateExactStructuredReceiptCoverage`), operator lane cancellation
+ * (`collectOnce` cancel_pending), publication arming/settlement
+ * (`completePrWorkflow` + `allowedPrReviewReportVerdicts`), and reviewer
+ * re-entry consumption (`reservePrReviewReentryAuthorizationAgainstBinding` —
+ * a pure reducer cannot independently observe a concurrent storage mutation).
  *
  * The owning gate and `dispatch-lanes` are orchestration adapters: they build
  * events from real I/O, apply the returned state, and map typed rejections to
@@ -30,7 +36,9 @@
  * `pending-delegations.ts`; `emit_diagnostic` describes the collect
  * observer's bounded diagnostics channel; `block_dispatch` describes the
  * circuit-open admission refusal. No effect kind is emitted without a real
- * executor (reviewer finding 1, issue #2385 Phase 8b).
+ * executor (reviewer finding 1, issue #2385 Phase 8b), and no event member is
+ * declared without a production construction site (issue #2512; enforced by
+ * tests/unit/pr-review/reducer-adapter-authority.test.ts).
  *
  * Probe outcomes other than an admission rollback are processed by the
  * machine on the NEXT staged admission: the gate feeds the recorded probe's

package/dist/pr-review/types.d.ts

@@ -78,7 +78,7 @@ export type PrReviewEffect = {
     replay?: boolean;
 } | {
     kind: 'emit_diagnostic';
-    source: 'collection_observer' | 'legacy_transcript_adapter';
+    source: 'collection_observer';
     code: string;
     boundedDetail?: string | undefined;
 } | {
@@ -104,11 +104,38 @@ export type PrReviewCircuitProbeOutcome = {
 } | {
     result: 'rolled_back_admission';
 };
+/**
+ * A settled critic receipt: a critic verdict that terminates its assigned
+ * coverage obligation (issue #2512). UPHELD, DOWNGRADED, and DISPROVED each
+ * satisfy the critic coverage their finding was assigned; NEEDS_MORE_EVIDENCE
+ * is deliberately nonterminal and is not representable here. The digest is the
+ * authoritative reviewer verdict row the critic claim was bound to at
+ * composition time (`reviewerVerdictRowDigest`; composition rejects unbound
+ * claims), so a receipt can only be built from the current authoritative
+ * reviewer rows.
+ */
+export interface PrReviewCriticSettledReceipt {
+    findingId: string;
+    status: 'UPHELD' | 'DOWNGRADED' | 'DISPROVED';
+    reviewerRowDigest: string;
+}
+/**
+ * The closed event vocabulary for the PR-review transition authority
+ * (`reducer.ts`), issue #2512's registered-path contract: every declared event
+ * member has a production construction site (see
+ * docs/pr-review-transition-authority.md for the wire-or-retire table). Events
+ * whose production authority lives at a richer executor boundary — transcript
+ * downgrade protection (`validateExactStructuredReceiptCoverage`), provider
+ * terminal evidence classification (`classifyPrReviewCircuitSignal`),
+ * operator lane cancellation (`collectOnce` cancel_pending), publication
+ * arming/settlement (`completePrWorkflow`), and reviewer re-entry consumption
+ * (`reservePrReviewReentryAuthorizationAgainstBinding`) — are deliberately
+ * RETIRED from this union rather than declared without a dispatch site.
+ */
 export type PrReviewEvent = {
     type: 'base_admission_requested';
     batchId: string;
     lanes: PrReviewBaseDispatchLane[];
-    depthTier: 'S' | 'M' | 'L';
     maxBatches: number;
     validatedAt: string;
 } | {
@@ -128,34 +155,6 @@ export type PrReviewEvent = {
     semanticEnvelopeDigest: string;
     outcome: 'CLEAN' | 'FINDINGS' | 'INCOMPLETE';
     existingReceiptDigest?: string | undefined;
-} | {
-    type: 'transcript_evidence_presented';
-    batchId: string;
-    laneId: string;
-    laneHasStructuredReceipt: boolean;
-} | {
-    type: 'provider_terminal_observed';
-    batchId: string;
-    laneId: string;
-    generation: number;
-    evidence: {
-        source: 'typed_terminal_error_class';
-        category: string;
-        kind: string;
-    } | {
-        source: 'observer_deadline';
-    } | {
-        source: 'client_unavailable';
-    } | {
-        source: 'parser_or_transcript';
-    } | {
-        source: 'stale_observation';
-    };
-} | {
-    type: 'lane_cancelled';
-    batchId: string;
-    laneId: string;
-    generation: number;
 } | {
     type: 'circuit_advance_requested';
     nowMs: number;
@@ -187,29 +186,26 @@ export type PrReviewEvent = {
 } | {
     type: 'critic_result_recorded';
     criticRequiredFindingIds: readonly string[];
-    criticConfirmedFindingIds: readonly string[];
-} | {
-    type: 'publication_armed';
-    coverageKind: PrReviewTerminalCoverageKind;
-    verdict: PrReviewReportVerdict;
-} | {
-    type: 'publication_published';
-    binding: PrReviewAuthorizationBinding;
+    criticSettledReceipts: readonly PrReviewCriticSettledReceipt[];
 } | {
     type: 'armed_recovery_requested';
     binding: PrReviewAuthorizationBinding;
     dimensionsToCancel: PrReviewBaseDimensionId[];
     nowIso: string;
-} | {
-    type: 'reviewer_authorization_consumed';
-    binding: PrReviewAuthorizationBinding;
-    expectedRole: 'reviewer' | 'test_engineer';
-    role: 'reviewer' | 'test_engineer';
+    /** The operator's sanitized reason; the transition persists it verbatim. */
+    reason: string;
 };
 /**
- * The exact-identity binding an armed recovery, publication, or re-entry
- * authorization must carry (issue #2383/#2385). Stale or foreign values are
- * rejected with `stale_foreign_authorization`.
+ * The exact-identity binding an armed recovery authorization must carry
+ * (issues #2383/#2385/#2512). Stale or foreign values are rejected with
+ * `stale_foreign_authorization`.
+ *
+ * Authority split (issue #2512): the reducer validates the fields the workflow
+ * state itself carries — `sessionID`, `workflowInstanceId`, `prHeadSha`, and
+ * `generation` (`bindingRejection` in reducer.ts). `revisionDigest` is only
+ * observable by the executor that resolved it (the armed publication record or
+ * the live binding context), so it is validated THERE — never here; a pure
+ * reducer cannot independently observe a concurrent storage mutation.
  */
 export interface PrReviewAuthorizationBinding {
     sessionID: string;
@@ -218,7 +214,7 @@ export interface PrReviewAuthorizationBinding {
     revisionDigest?: string;
     generation: number;
 }
-export type PrReviewTransitionRejectionCode = 'observer_deadline_not_terminal_evidence' | 'client_absence_not_terminal_evidence' | 'parser_failure_not_provider_signal' | 'stale_observation_not_provider_signal' | 'live_lane_blocks_coverage' | 'partial_coverage_cannot_approve' | 'no_coverage_cannot_approve' | 'critic_required_unfulfilled' | 'stale_foreign_authorization' | 'stale_generation_result' | 'receipt_cannot_be_downgraded' | 'duplicate_conflicting_result' | 'base_batch_limit_reached' | 'rollback_preconditions_failed' | 'lane_not_stale_eligible' | 'unknown_event';
+export type PrReviewTransitionRejectionCode = 'live_lane_blocks_coverage' | 'partial_coverage_cannot_approve' | 'no_coverage_requires_incomplete' | 'critic_required_unfulfilled' | 'stale_foreign_authorization' | 'stale_generation_result' | 'duplicate_conflicting_result' | 'base_batch_limit_reached' | 'rollback_preconditions_failed' | 'unknown_event';
 export interface PrReviewTransitionRejection {
     code: PrReviewTransitionRejectionCode;
     detail: string;

package/dist/retention/dir-prune.d.ts

@@ -23,6 +23,7 @@
  *  - per-entry failures are swallowed (fail-open): one unreadable entry
  *    never aborts the family.
  */
+import * as fs from 'node:fs';
 export interface PruneDirectoryOptions {
     /** Keep at most this many entries (newest by mtime). */
     maxEntries?: number;
@@ -39,7 +40,10 @@ export interface PruneDirectoryOptions {
     maxScan?: number;
     /** Count victims without deleting (blast-radius rehearsal / dry_run). */
     dryRun?: boolean;
+    /** Optional allow-list for entries eligible for age/count pruning. */
+    includeEntry?: PruneEntryFilter;
 }
+export type PruneEntryFilter = (name: string, stat: fs.Stats) => boolean;
 export interface PruneCandidate {
     name: string;
     mtimeMs: number;
@@ -61,7 +65,7 @@ export declare function subtreeNewestFileMtime(root: string, maxScan: number): n
  */
 export declare const SUBTREE_SCAN_CAP = 2000;
 /** List bounded entries with effective mtimes; symlinked entries are collected separately and refused. */
-export declare function listPruneCandidates(dir: string, maxScan: number): {
+export declare function listPruneCandidates(dir: string, maxScan: number, includeEntry?: PruneEntryFilter): {
     candidates: PruneCandidate[];
     refusedSymlinks: string[];
 };

package/dist/telemetry.d.ts

@@ -1,5 +1,5 @@
 import type { ObservabilityEvent } from './observability/envelope.js';
-import { createObservation, toLegacyTelemetryLine } from './observability/index.js';
+import { canonicalLineContent, createObservation, toLegacyTelemetryLine } from './observability/index.js';
 import type { DelegationCostFields } from './services/cost-accounting.js';
 export type TelemetryEvent = 'session_started' | 'session_ended' | 'agent_activated' | 'delegation_begin' | 'delegation_end' | 'delegation_cost_correction' | 'delegation_cost_binding' | 'delegation_cost_join' | 'task_state_changed' | 'gate_passed' | 'gate_failed' | 'gate_parse_error' | 'reviewer_gate_decision' | 'phase_changed' | 'budget_updated' | 'context_pruned' | 'retrieval_routed' | 'model_fallback'
 /**
@@ -50,7 +50,14 @@ export type TelemetryListener = (event: TelemetryEvent, data: Record<string, unk
  * two-argument listener stays assignable. The SQLite observability sink
  * (`src/db/observability-event-store.ts`) is the canonical consumer.
  */
-canonical?: ObservabilityEvent) => void;
+canonical?: ObservabilityEvent, 
+/**
+ * The canonical JSONL line content for `canonical` (no trailing EOL),
+ * stringified exactly once by `emit()` and handed to listeners so the
+ * sink's line-hash path never re-stringifies the same envelope (issue
+ * #2487 review PRR-005).
+ */
+canonicalContent?: string) => void;
 export declare function startHeartbeatTracking(): void;
 export declare function getLastHeartbeat(sessionId: string): number | undefined;
 export declare function stopHeartbeatTracking(): void;
@@ -510,4 +517,5 @@ export declare const _internals: {
     heartbeatListenerCount: () => number;
     createObservation: typeof createObservation;
     toLegacyTelemetryLine: typeof toLegacyTelemetryLine;
+    canonicalLineContent: typeof canonicalLineContent;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "opencode-swarm",
-	"version": "7.171.0",
+	"version": "7.171.2",
 	"description": "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",
@@ -113,6 +113,7 @@
 		"repro:704": "node scripts/repro-704.mjs",
 		"repro:1144": "bun scripts/repro-1144.mjs",
 		"repro:1873": "bun build scripts/repro-1873-entry.ts --outdir dist-build-test/repro-1873 --target node --format esm && node scripts/repro-1873.mjs",
+		"repro:2487": "bun build scripts/repro-2487-parity-entry.ts --outdir dist-build-test/repro-2487 --target node --format esm && node scripts/repro-2487-parity.mjs",
 		"check:events": "bun run scripts/check-event-contract.ts",
 		"check:retention": "bun run scripts/check-retention-registry.ts",
 		"check:core-events": "bun run scripts/check-core-events-usage.ts",