opencode-swarm 7.199.5 → 7.200.0

package/dist/cli/{worktree-collision-ownership-xpr0yv7h.js → worktree-collision-ownership-7a1n1f9j.js}

@@ -6,37 +6,37 @@ import {
   WORKTREE_PROVISIONING_OWNER_LEASE_MS,
   removeWorktreeProvisioningOwner,
   scanWorktreeProvisioningOwnersForRecovery
-} from "./index-tsg61z0r.js";
+} from "./index-r02aqt0a.js";
 import {
   scanDelegationFallbacksForRecovery,
   scanDelegationsForRecovery
-} from "./index-4pbzepgw.js";
+} from "./index-rfvnq6wd.js";
 import {
   scanWorktreeMergeFailuresForRecovery
 } from "./index-v3bmwmqw.js";
-import"./index-b3ws03kp.js";
-import"./index-j3rfbs45.js";
-import"./index-9y6yk1n0.js";
-import"./index-snx2vb1x.js";
+import"./index-x1z5d5kj.js";
+import"./index-99zt998b.js";
+import"./index-vmevv6my.js";
+import"./index-d083d1q7.js";
 import"./index-ry16d01s.js";
 import"./index-rdm3px0g.js";
-import"./index-3mzc5rqc.js";
+import"./index-wr0n2w3z.js";
 import"./index-7pmbnjvj.js";
-import"./index-zbygz217.js";
-import"./index-bgydmx8k.js";
+import"./index-1tpz99db.js";
+import"./index-n5k81wym.js";
 import"./index-vzm6zre7.js";
 import"./index-ae75rja9.js";
-import"./index-n1ddn12j.js";
-import"./index-jmhn6ab5.js";
-import"./index-dz15f98h.js";
+import"./index-dng8z8me.js";
+import"./index-ac8vdmgv.js";
+import"./index-q8vfw61p.js";
 import"./index-t7hmqgjy.js";
-import"./index-dtwj4hsk.js";
+import"./index-c2k7q723.js";
 import {
   canonicalRootKeyFresh
 } from "./index-te9hq2f4.js";
 import"./index-ejhxgyvm.js";
 import"./index-7g4c7s5r.js";
-import"./index-270zfq1f.js";
+import"./index-q1x73nnd.js";
 import"./index-sp2cxpaq.js";
 import"./index-qbxk2rn6.js";
 import"./index-zgwm4ryv.js";

package/dist/cli/{worktree-isolation-z6ytes0j.js → worktree-isolation-8snw7w34.js}

@@ -25,79 +25,79 @@ import {
   sanitizeWorktreeTaskId,
   standardWorktreeByCallID,
   standardWorktreeSerializationSessions
-} from "./index-26dmsdx3.js";
-import"./index-my753e0g.js";
-import"./index-3fz5w2wb.js";
-import"./index-6ssraqaa.js";
+} from "./index-hg4qa0aq.js";
+import"./index-nq3zcrhm.js";
+import"./index-8rrs1nc0.js";
+import"./index-md2180vx.js";
+import"./index-yss701b3.js";
+import"./index-0wg5q595.js";
 import"./index-axqyjreb.js";
-import"./index-0je0mees.js";
-import"./index-hx2f3j9w.js";
 import"./index-txdagbh7.js";
-import"./index-zdfzrwbk.js";
+import"./index-qnabg1wp.js";
+import"./index-vqtca3xv.js";
 import"./index-rdec0y3z.js";
-import"./index-9n40q82y.js";
-import"./index-6xyt6d5m.js";
-import"./index-85vd6sxy.js";
-import"./index-10wwrgj2.js";
-import"./index-eyq1q1xn.js";
-import"./index-4cyc18bc.js";
+import"./index-qnst0jwc.js";
+import"./index-71bqn1nn.js";
+import"./index-e8m8bb1r.js";
+import"./index-bp476gwc.js";
+import"./index-8a3aasag.js";
 import"./index-x5jwegqw.js";
-import"./index-tsg61z0r.js";
-import"./index-4pbzepgw.js";
+import"./index-r02aqt0a.js";
+import"./index-rfvnq6wd.js";
 import"./index-8mrentmw.js";
 import"./index-pt7h91zc.js";
 import"./index-q7sjgr1y.js";
-import"./index-xtda4xsn.js";
-import"./index-gyz59cbh.js";
+import"./index-22atsy06.js";
+import"./index-35tf03js.js";
 import"./index-6b295cas.js";
 import"./index-9nyqt3kb.js";
-import"./index-76skvj8z.js";
+import"./index-9nmrw7ek.js";
 import"./index-v3bmwmqw.js";
-import"./index-9c0vp5yj.js";
-import"./index-yg5xd4am.js";
-import"./index-0ra0vs2p.js";
+import"./index-sk1rva12.js";
+import"./index-58cr1xg0.js";
+import"./index-m9j9varx.js";
 import"./index-spggmr30.js";
-import"./index-6xv2hz0e.js";
-import"./index-d7y3cafq.js";
+import"./index-1rfgzsaw.js";
+import"./index-x25rhkmk.js";
 import"./index-m9zzj4ee.js";
-import"./index-b3ws03kp.js";
-import"./index-xyg7des8.js";
-import"./index-0veqvgny.js";
+import"./index-x1z5d5kj.js";
+import"./index-p5m71yph.js";
+import"./index-jy0mgzjq.js";
 import"./index-rtry5xyf.js";
 import {
   resolveWorktreeIsolationConfig
-} from "./index-zte3djpf.js";
+} from "./index-hxp5jgd8.js";
 import"./index-g22dps7x.js";
 import"./index-0725jpp7.js";
-import"./index-p5d32v0x.js";
-import"./index-j3rfbs45.js";
-import"./index-ybvnf7rt.js";
-import"./index-9y6yk1n0.js";
-import"./index-snx2vb1x.js";
+import"./index-pyv8vzkx.js";
+import"./index-99zt998b.js";
+import"./index-7v74n9a1.js";
+import"./index-vmevv6my.js";
+import"./index-d083d1q7.js";
 import"./index-ry16d01s.js";
 import"./index-rdm3px0g.js";
-import"./index-3mzc5rqc.js";
+import"./index-wr0n2w3z.js";
 import"./index-7pmbnjvj.js";
 import"./index-9rwhas09.js";
-import"./index-zbygz217.js";
-import"./index-bgydmx8k.js";
+import"./index-1tpz99db.js";
+import"./index-n5k81wym.js";
 import"./index-vzm6zre7.js";
 import"./index-ae75rja9.js";
-import"./index-n1ddn12j.js";
-import"./index-jmhn6ab5.js";
-import"./index-dz15f98h.js";
+import"./index-dng8z8me.js";
+import"./index-ac8vdmgv.js";
+import"./index-q8vfw61p.js";
 import"./index-t7hmqgjy.js";
-import"./index-dtwj4hsk.js";
+import"./index-c2k7q723.js";
 import"./index-te9hq2f4.js";
 import"./index-ejhxgyvm.js";
 import"./index-7g4c7s5r.js";
-import"./index-270zfq1f.js";
-import"./index-gx2vp8gx.js";
-import"./index-3ckvw3j2.js";
+import"./index-q1x73nnd.js";
+import"./index-3t46mez1.js";
+import"./index-gwc7jahh.js";
 import"./index-sp2cxpaq.js";
 import"./index-qbxk2rn6.js";
 import"./index-zgwm4ryv.js";
-import"./index-dengtwpp.js";
+import"./index-yvv0my1a.js";
 import"./index-xfzkq1k4.js";
 import"./index-bk5tah7q.js";
 import"./index-gknz3bv1.js";

package/dist/commands/attest.d.ts

@@ -0,0 +1,10 @@
+/**
+ * `/swarm attest <task_id>` (issue #3422): verify a git-external deliverable
+ * with the task's pinned read-only git anchors and record the durable
+ * external-evidence bundle that admits completion — the in-machine exit for
+ * tasks whose deliverable (commit/push, gh ops) can never produce a coder
+ * settlement. Human- or agent-invoked; everything fails closed exactly as
+ * the underlying executor does (undeclared tasks, non-read-only commands,
+ * mismatched anchors, oversized output all refuse).
+ */
+export declare function handleAttestCommand(directory: string, args: string[], sessionID?: string): Promise<string>;

package/dist/commands/index.d.ts

@@ -8,6 +8,7 @@ export { handleAgentsCommand } from './agents';
 export { handleAnalyzeCommand } from './analyze';
 export { handleApproveWriteCommand } from './approve-write';
 export { handleArchiveCommand } from './archive';
+export { handleAttestCommand } from './attest';
 export { handleAutoProceedCommand } from './auto-proceed';
 export { handleBenchmarkCommand } from './benchmark';
 export { handleBrainstormCommand } from './brainstorm';

package/dist/commands/registry.d.ts

@@ -1082,6 +1082,14 @@ export declare const COMMAND_REGISTRY: {
         readonly category: "utility";
         readonly toolPolicy: "restricted";
     };
+    readonly attest: {
+        readonly handler: (ctx: CommandContext) => Promise<string>;
+        readonly description: "Verify a git-external deliverable with pinned anchors <task_id>";
+        readonly details: "Runs the task's pinned read-only git evidence_anchors (issue #3422) inside the project root and records the durable external-evidence bundle that admits completion — the in-machine exit for tasks whose deliverable (commit/push, gh ops) can never produce a coder settlement. Fail-closed: the plan task must declare evidence_class external_git with 1..16 anchors (expect exact / expect_prefix non-empty), every anchor runs as a bounded no-shell argv spawn (stdin ignored, 10s per anchor, 30s total; output over the 4096-char evidence bound refuses the anchor rather than truncating it), and only positively-known read-only git subcommands/flags (rev-list, log, rev-parse, show, diff) are admitted. Undeclared tasks, mismatched anchors, and non-read-only commands refuse exactly as the completion gate does. Declaration changes revoke stale proofs (a fresh attest is then required). See docs/commands.md and docs/plan-durability.md.";
+        readonly args: "<task_id>";
+        readonly category: "utility";
+        readonly toolPolicy: "agent";
+    };
     readonly recover: {
         readonly handler: (ctx: CommandContext) => Promise<string>;
         readonly description: "Recover wedged coder settlements [task_id] [--force]";

package/dist/config/plan-schema.d.ts

@@ -53,6 +53,23 @@ export declare const MigrationStatusSchema: z.ZodEnum<{
     migration_failed: "migration_failed";
 }>;
 export type MigrationStatus = z.infer<typeof MigrationStatusSchema>;
+/**
+ * External-evidence anchor (issue #3422): a pinned read-only git assertion a
+ * task declares so `/swarm attest` can verify a git-external deliverable
+ * (commit/push, gh ops) without a coder settlement.
+ *
+ * `expect` matches the trimmed stdout exactly; `expect_prefix` requires a
+ * NON-EMPTY prefix of it (an empty prefix would match everything and attest
+ * nothing). At least one of the two must be present per anchor; both bounds
+ * mirror the durable-evidence storage cap so an anchor is never accepted with
+ * output that cannot be persisted verbatim.
+ */
+export declare const ExternalEvidenceAnchorSchema: z.ZodObject<{
+    command: z.ZodString;
+    expect: z.ZodOptional<z.ZodString>;
+    expect_prefix: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type ExternalEvidenceAnchor = z.infer<typeof ExternalEvidenceAnchorSchema>;
 export declare const TaskSchema: z.ZodObject<{
     id: z.ZodString;
     phase: z.ZodNumber;
@@ -75,6 +92,15 @@ export declare const TaskSchema: z.ZodObject<{
     evidence_path: z.ZodOptional<z.ZodString>;
     blocked_reason: z.ZodOptional<z.ZodString>;
     fr_refs: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    evidence_class: z.ZodOptional<z.ZodEnum<{
+        coder_mutation: "coder_mutation";
+        external_git: "external_git";
+    }>>;
+    evidence_anchors: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        command: z.ZodString;
+        expect: z.ZodOptional<z.ZodString>;
+        expect_prefix: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
 }, z.core.$strip>;
 export type Task = z.infer<typeof TaskSchema>;
 export declare const PhaseSchema: z.ZodObject<{
@@ -110,6 +136,15 @@ export declare const PhaseSchema: z.ZodObject<{
         evidence_path: z.ZodOptional<z.ZodString>;
         blocked_reason: z.ZodOptional<z.ZodString>;
         fr_refs: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        evidence_class: z.ZodOptional<z.ZodEnum<{
+            coder_mutation: "coder_mutation";
+            external_git: "external_git";
+        }>>;
+        evidence_anchors: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            command: z.ZodString;
+            expect: z.ZodOptional<z.ZodString>;
+            expect_prefix: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>>;
     }, z.core.$strip>>>;
     type: z.ZodOptional<z.ZodEnum<{
         code: "code";
@@ -156,6 +191,15 @@ export declare const PlanSchema: z.ZodObject<{
             evidence_path: z.ZodOptional<z.ZodString>;
             blocked_reason: z.ZodOptional<z.ZodString>;
             fr_refs: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            evidence_class: z.ZodOptional<z.ZodEnum<{
+                coder_mutation: "coder_mutation";
+                external_git: "external_git";
+            }>>;
+            evidence_anchors: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                command: z.ZodString;
+                expect: z.ZodOptional<z.ZodString>;
+                expect_prefix: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>>>;
         }, z.core.$strip>>>;
         type: z.ZodOptional<z.ZodEnum<{
             code: "code";

package/dist/gate-evidence.d.ts

@@ -16,6 +16,7 @@
  * authorization against a process with arbitrary same-user workspace access;
  * that requires a protected trust root outside the project workspace.
  */
+import { z } from 'zod';
 import { appendTaskGateRequirementsReceiptIfNeeded } from './evidence/task-gate-requirements.js';
 import type { ReviewRouteEvidence } from './review/routing-enforcement.js';
 import type { TaskWorkflowState } from './state';
@@ -28,7 +29,7 @@ export interface GateEvidence {
     agent: string;
 }
 export declare const TASK_WORKFLOW_SCHEMA_MARKER: "exact-task-v1";
-declare const TASK_WORKFLOW_OUTCOMES: readonly ["none", "dispatch_attempted", "dispatch_no_mutation", "accepted_mutation", "accepted_mutation_failed", "stage_a_passed", "stage_a_failed", "stage_b_completed", "stage_b_failed", "gate_recorded", "task_completed", "task_blocked", "task_closed", "repair_idle"];
+declare const TASK_WORKFLOW_OUTCOMES: readonly ["none", "dispatch_attempted", "dispatch_no_mutation", "accepted_mutation", "accepted_mutation_failed", "stage_a_passed", "stage_a_failed", "stage_b_completed", "stage_b_failed", "gate_recorded", "task_completed", "task_blocked", "task_closed", "repair_idle", "external_evidence_attested", "external_evidence_revoked"];
 export type TaskWorkflowTransitionOutcome = (typeof TASK_WORKFLOW_OUTCOMES)[number];
 export interface TaskWorkflowMetadata {
     schema: typeof TASK_WORKFLOW_SCHEMA_MARKER;
@@ -95,6 +96,17 @@ export interface TaskWorkflowMetadata {
         transitionId: string;
         declaredFiles: string[];
     };
+    /**
+     * Pinned external evidence bundle (issue #3422): the read-only git proof
+     * for a task declared `evidence_class: 'external_git'`, attested while the
+     * workflow is idle and preserved through the terminal task_completed write
+     * so a duplicate completion can re-validate the same current proof. Cleared
+     * by a new coder attribution window (dispatch_attempted /
+     * dispatch_no_mutation / accepted_mutation), by repair_idle's fresh
+     * generation, and by the declaration-change revoke; terminal states are
+     * never revoked (06-critic-review.md R4F1).
+     */
+    externalEvidence?: ExternalEvidenceBundle;
 }
 export interface TaskWorkflowSnapshot extends TaskWorkflowMetadata {
     authoritative: boolean;
@@ -237,6 +249,13 @@ export type TaskWorkflowTransitionEvent = {
     qaExempt?: boolean;
     /** Durable, non-forced completion of a trusted empty-scope settlement. */
     readOnlyNoMutation?: boolean;
+    /**
+     * Issue #3422: the caller proved the external bundle current via
+     * externalProofCurrent / isExternalEvidenceInitialCompletionEligible
+     * before forwarding the terminal event; the reducer still requires the
+     * durable bundle to exist and fully match before admitting it.
+     */
+    externalEvidence?: boolean;
     expectedGeneration: number;
     transitionId?: string;
 } | {
@@ -251,6 +270,27 @@ export type TaskWorkflowTransitionEvent = {
     type: 'repair_idle';
     expectedGeneration: number;
     transitionId?: string;
+} | {
+    /**
+     * Issue #3422: pin the attest producer's validated read-only git bundle
+     * as durable workflow metadata. State-preserving (the gate_recorded
+     * precedent) and admitted from idle only — an external task never
+     * enters the coder QA lifecycle.
+     */
+    type: 'external_evidence_attested';
+    bundle: ExternalEvidenceBundle;
+    expectedGeneration: number;
+    transitionId?: string;
+} | {
+    /**
+     * Issue #3422: the plan declaration changed under a nonterminal task, so
+     * the pinned bundle no longer describes the declared work. Terminal
+     * states are never revoked (06-critic-review.md R4F1).
+     */
+    type: 'external_evidence_revoked';
+    reason: 'declaration_changed';
+    expectedGeneration: number;
+    transitionId?: string;
 };
 export interface TaskEvidenceTransaction {
     taskId: string;
@@ -277,6 +317,29 @@ export interface TaskEvidenceTransaction {
      */
     save?(nextEvidence: TaskEvidence): Promise<TaskEvidence>;
 }
+/**
+ * Durable external-evidence bundle (issue #3422): the pinned read-only git
+ * proof for a task whose deliverable is verified outside the coder QA
+ * lifecycle. The attest producer validates the bundle (digest recompute, all
+ * anchors matched, bounds) before publishing it through the
+ * `external_evidence_attested` transition; this schema is the persistence
+ * boundary that refuses anything malformed after the fact.
+ */
+export declare const ExternalEvidenceBundleSchema: z.ZodObject<{
+    class: z.ZodLiteral<"external_git">;
+    transitionId: z.ZodString;
+    declarationDigest: z.ZodString;
+    anchors: z.ZodArray<z.ZodObject<{
+        command: z.ZodString;
+        expect: z.ZodOptional<z.ZodString>;
+        expect_prefix: z.ZodOptional<z.ZodString>;
+        matched: z.ZodBoolean;
+        exit_code: z.ZodNumber;
+        stdout: z.ZodString;
+    }, z.core.$strip>>;
+    attestedAt: z.ZodString;
+}, z.core.$strip>;
+export type ExternalEvidenceBundle = z.infer<typeof ExternalEvidenceBundleSchema>;
 export declare function parseTaskEvidence(raw: string, expectedTaskId: string): TaskEvidence;
 export declare const DEFAULT_REQUIRED_GATES: string[];
 export interface GateDerivationContext {
@@ -308,6 +371,80 @@ export declare function deriveApplicableGateSet(evidence: TaskEvidence | null |
 export declare function isReadOnlyNoMutationEligible(evidence: TaskEvidence | null | undefined, options?: {
     currentDeclaredFiles?: readonly string[] | null;
 }): boolean;
+/**
+ * Inputs to the external-evidence declaration digest (issue #3422,
+ * 05-fix-plan.md §3): the exact task declaration plus the plan identity and
+ * evidence generation the digest binds.
+ */
+export interface ExternalDeclarationInput {
+    taskId: string;
+    evidence_class: 'external_git';
+    evidence_anchors: ReadonlyArray<{
+        command: string;
+        expect?: string;
+        expect_prefix?: string;
+    }>;
+    plan_title: string;
+    plan_swarm: string;
+    generation: number;
+}
+/**
+ * Compute the declaration digest bound into an external evidence bundle:
+ * sha256 hex over the canonical JSON of `{taskId, evidence_class,
+ * evidence_anchors (ordered definitions only), plan_title, plan_swarm,
+ * generation}`.
+ *
+ * Deliberately CURSOR-FREE (issue #3422, 05-fix-plan.md §3): the whole-plan
+ * structure hash includes `current_phase`, which advances during the terminal
+ * plan write. Binding the digest to it would self-invalidate the proof in
+ * the crash window after plan.json advances and before the evidence
+ * transaction applies. Every revalidation recomputes this digest from the
+ * CURRENT plan task and CURRENT generation instead — no whole-plan hash is
+ * ever consulted.
+ */
+export declare function computeExternalDeclarationDigest(input: ExternalDeclarationInput): string;
+/** Plan identity inputs to the external declaration digest (issue #3422). */
+export interface ExternalPlanIdentity {
+    title: string;
+    swarm: string;
+}
+/**
+ * The subset of a plan task the external-evidence predicates consult: the
+ * declaration fields save_plan validated (issue #3422).
+ */
+export interface ExternalPlanTaskRef {
+    id: string;
+    evidence_class?: string;
+    evidence_anchors?: ReadonlyArray<{
+        command: string;
+        expect?: string;
+        expect_prefix?: string;
+    }> | undefined;
+}
+/**
+ * Proof-currency predicate (issue #3422, 05-fix-plan.md §4c / R3F1): true iff
+ * the task declares `external_git`, a bundle exists with at least one anchor,
+ * every anchor matched, and the bundle's declarationDigest equals the digest
+ * recomputed from the CURRENT plan declaration + CURRENT generation. There is
+ * NO workflow-state condition — this is the "proof is current" predicate
+ * usable in ANY state (mirroring isNoMutationSettlementMetadata's
+ * idle || complete acceptance), so duplicate completion, committed-WAL
+ * idempotent replay, terminal recovery, and check_gate_status on a completed
+ * task all re-validate the same way.
+ */
+export declare function externalProofCurrent(plan: ExternalPlanIdentity, planTask: ExternalPlanTaskRef, evidence: TaskEvidence | null | undefined): boolean;
+/**
+ * Initial-completion eligibility (issue #3422, 05-fix-plan.md §4c / R3F1):
+ * `externalProofCurrent` AND the authoritative workflow state is exactly
+ * `idle` (blocked removed — a blocked task reopens via the audited
+ * blocked → in_progress plan transition first). This is the R3F1 split's
+ * other half: the FIRST completion requires idle, while DUPLICATE
+ * completions and terminal recovery use `externalProofCurrent` and accept
+ * `complete`. Consults the authoritative snapshot (the
+ * isNoMutationSettlementMetadata pattern) so non-authoritative legacy
+ * metadata never admits an external completion.
+ */
+export declare function isExternalEvidenceInitialCompletionEligible(plan: ExternalPlanIdentity, planTask: ExternalPlanTaskRef, evidence: TaskEvidence | null | undefined): boolean;
 export declare function reduceTaskWorkflowSnapshot(current: TaskWorkflowSnapshot, event: TaskWorkflowTransitionEvent, context: {
     requiredGates: string[];
     gates: Record<string, GateEvidence>;

package/dist/host/v2/guidance.d.ts

@@ -18,6 +18,13 @@
  * `event.agent` is an Agent.Info-shaped object on v2; it is normalized to a
  * name before any v1 agent comparison (frozen C4 header requirement).
  *
+ * View -> original pairing: every v1 view is stamped `info.swarmV2Origin` (its
+ * index in the original `event.messages`). Kept views are paired by object
+ * identity, then `id`, then that stamp (role-checked for non-carriers); there
+ * is no positional fallback. Views the chain INSERTS carry no stamp and are
+ * dropped — on v2, id-less chain inserts (full-auto verdict/continuation
+ * messages) are therefore not delivered.
+ *
  * Part-kind mapping (R10): text parts map 1:1; non-text content kinds
  * (media, tool-call, tool-result, reasoning, step-start, compaction, effort)
  * are preserved untouched on their message — the v1 chain's steps only read