opencode-telos 1.0.0

package/dist/sdd/graph/integrity-guard.d.ts

@@ -0,0 +1,129 @@
+/**
+ * Graph Integrity Guard (Anti-Bypass Layer)
+ *
+ * Tracks a checksum of the graph state after every legitimate save.
+ * On load, validates that the graph hasn't been modified outside the
+ * SDD workflow tools (e.g., via Python scripts, direct YAML/DB edits).
+ *
+ * This prevents agents from bypassing enforcement by:
+ * 1. Editing graph.yaml directly with Python
+ * 2. Manipulating graph.db with raw SQL
+ * 3. Editing graph files with shell commands
+ */
+export interface IntegrityState {
+    /** Last known checksum of the graph when saved through SDD tools */
+    last合法Checksum: string;
+    /** Timestamp of last legitimate save */
+    last合法Save: number;
+    /** Number of consecutive tamper detections */
+    tamperCount: number;
+    /** Checksum history for rollback detection */
+    checksumHistory: Array<{
+        checksum: string;
+        timestamp: number;
+        nodeCount: number;
+        relCount: number;
+        changeId?: string;
+    }>;
+    /** Whether the graph is currently flagged as tampered */
+    tampered: boolean;
+    /** List of detected tamper events */
+    tamperLog: Array<{
+        timestamp: number;
+        detected_checksum: string;
+        expected_checksum: string;
+        node_count_diff: number;
+        rel_count_diff: number;
+    }>;
+}
+/**
+ * Compute a deterministic checksum of a KnowledgeGraph.
+ * Includes nodes, relationships, and metadata for full integrity.
+ */
+export declare function computeGraphChecksum(graph: {
+    nodes: Array<{
+        id: string;
+        type: string;
+        name: string;
+        status: string;
+        version: number;
+    }>;
+    relationships: Array<{
+        id: string;
+        from: string;
+        to: string;
+        type: string;
+    }>;
+    metadata: {
+        updated_at: string;
+    };
+}): string;
+/**
+ * Record a legitimate save (called after every SDD tool mutation).
+ * Updates the checksum to the current graph state.
+ */
+export declare function recordLegitimateSave(projectDir: string, graph: {
+    nodes: Array<{
+        id: string;
+        type: string;
+        name: string;
+        status: string;
+        version: number;
+    }>;
+    relationships: Array<{
+        id: string;
+        from: string;
+        to: string;
+        type: string;
+    }>;
+    metadata: {
+        updated_at: string;
+    };
+}, changeId?: string): string;
+/**
+ * Validate the current graph against the last known legitimate state.
+ * Returns tamper detection result.
+ */
+export declare function validateGraphIntegrity(projectDir: string, graph: {
+    nodes: Array<{
+        id: string;
+        type: string;
+        name: string;
+        status: string;
+        version: number;
+    }>;
+    relationships: Array<{
+        id: string;
+        from: string;
+        to: string;
+        type: string;
+    }>;
+    metadata: {
+        updated_at: string;
+    };
+}): {
+    valid: boolean;
+    tampered: boolean;
+    reason?: string;
+    currentChecksum: string;
+    expectedChecksum: string;
+    nodeCountDiff: number;
+    relCountDiff: number;
+};
+/**
+ * Get the tamper log for auditing.
+ */
+export declare function getTamperLog(projectDir: string): IntegrityState["tamperLog"];
+/**
+ * Check if the graph is currently flagged as tampered.
+ */
+export declare function isGraphTampered(projectDir: string): boolean;
+/**
+ * Clear the tamper flag (only after legitimate workflow completion).
+ */
+export declare function clearTamperFlag(projectDir: string): void;
+/**
+ * Format tamper detection result for display.
+ */
+export declare function formatTamperReport(result: ReturnType<typeof validateGraphIntegrity>): string;
+//# sourceMappingURL=integrity-guard.d.ts.map

package/dist/sdd/graph/integrity-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrity-guard.d.ts","sourceRoot":"","sources":["../../../src/sdd/graph/integrity-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AASH,MAAM,WAAW,cAAc;IAC7B,oEAAoE;IACpE,cAAc,EAAE,MAAM,CAAA;IACtB,wCAAwC;IACxC,UAAU,EAAE,MAAM,CAAA;IAClB,8CAA8C;IAC9C,WAAW,EAAE,MAAM,CAAA;IACnB,8CAA8C;IAC9C,eAAe,EAAE,KAAK,CAAC;QACrB,QAAQ,EAAE,MAAM,CAAA;QAChB,SAAS,EAAE,MAAM,CAAA;QACjB,SAAS,EAAE,MAAM,CAAA;QACjB,QAAQ,EAAE,MAAM,CAAA;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;KAClB,CAAC,CAAA;IACF,yDAAyD;IACzD,QAAQ,EAAE,OAAO,CAAA;IACjB,qCAAqC;IACrC,SAAS,EAAE,KAAK,CAAC;QACf,SAAS,EAAE,MAAM,CAAA;QACjB,iBAAiB,EAAE,MAAM,CAAA;QACzB,iBAAiB,EAAE,MAAM,CAAA;QACzB,eAAe,EAAE,MAAM,CAAA;QACvB,cAAc,EAAE,MAAM,CAAA;KACvB,CAAC,CAAA;CACH;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,KAAK,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACzF,aAAa,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC5E,QAAQ,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAA;CACjC,GAAG,MAAM,CAeT;AAkDD;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE;IACL,KAAK,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACzF,aAAa,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC5E,QAAQ,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAA;CACjC,EACD,QAAQ,CAAC,EAAE,MAAM,GAChB,MAAM,CAwBR;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE;IACL,KAAK,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACzF,aAAa,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC5E,QAAQ,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAA;CACjC,GACA;IACD,KAAK,EAAE,OAAO,CAAA;IACd,QAAQ,EAAE,OAAO,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,eAAe,EAAE,MAAM,CAAA;IACvB,gBAAgB,EAAE,MAAM,CAAA;IACxB,aAAa,EAAE,MAAM,CAAA;IACrB,YAAY,EAAE,MAAM,CAAA;CACrB,CAsGA;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,cAAc,CAAC,WAAW,CAAC,CAG5E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAG3D;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAKxD;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,UAAU,CAAC,OAAO,sBAAsB,CAAC,GAChD,MAAM,CAmCR"}

package/dist/sdd/graph/integrity-guard.js

@@ -0,0 +1,263 @@
+/**
+ * Graph Integrity Guard (Anti-Bypass Layer)
+ *
+ * Tracks a checksum of the graph state after every legitimate save.
+ * On load, validates that the graph hasn't been modified outside the
+ * SDD workflow tools (e.g., via Python scripts, direct YAML/DB edits).
+ *
+ * This prevents agents from bypassing enforcement by:
+ * 1. Editing graph.yaml directly with Python
+ * 2. Manipulating graph.db with raw SQL
+ * 3. Editing graph files with shell commands
+ */
+import { createHash } from "crypto";
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from "fs";
+import { join, dirname } from "path";
+const INTEGRITY_FILE = ".sdd/graph-integrity.json";
+const CHECKSUM_HISTORY_SIZE = 50;
+/**
+ * Compute a deterministic checksum of a KnowledgeGraph.
+ * Includes nodes, relationships, and metadata for full integrity.
+ */
+export function computeGraphChecksum(graph) {
+    // Sort nodes by ID for determinism
+    const sortedNodes = [...graph.nodes]
+        .sort((a, b) => a.id.localeCompare(b.id))
+        .map(n => `${n.id}:${n.type}:${n.status}:${n.version}`)
+        .join("|");
+    // Sort relationships by ID for determinism
+    const sortedRels = [...graph.relationships]
+        .sort((a, b) => a.id.localeCompare(b.id))
+        .map(r => `${r.id}:${r.from}:${r.to}:${r.type}`)
+        .join("|");
+    const payload = `nodes[${sortedNodes}]rels[${sortedRels}]ts:${graph.metadata.updated_at}`;
+    return createHash("sha256").update(payload).digest("hex").slice(0, 16);
+}
+/**
+ * Load integrity state from disk.
+ */
+function loadIntegrityState(projectDir) {
+    const path = join(projectDir, INTEGRITY_FILE);
+    if (!existsSync(path)) {
+        return {
+            last合法Checksum: "",
+            last合法Save: 0,
+            tamperCount: 0,
+            checksumHistory: [],
+            tampered: false,
+            tamperLog: [],
+        };
+    }
+    try {
+        const data = JSON.parse(readFileSync(path, "utf-8"));
+        // Migration: handle old format without tamper fields
+        return {
+            last合法Checksum: data.last合法Checksum || data.lastChecksum || "",
+            last合法Save: data.last合法Save || data.lastSave || 0,
+            tamperCount: data.tamperCount || 0,
+            checksumHistory: data.checksumHistory || [],
+            tampered: data.tampered || false,
+            tamperLog: data.tamperLog || [],
+        };
+    }
+    catch {
+        return {
+            last合法Checksum: "",
+            last合法Save: 0,
+            tamperCount: 0,
+            checksumHistory: [],
+            tampered: false,
+            tamperLog: [],
+        };
+    }
+}
+/**
+ * Save integrity state to disk.
+ */
+function saveIntegrityState(projectDir, state) {
+    const path = join(projectDir, INTEGRITY_FILE);
+    const dir = dirname(path);
+    if (!existsSync(dir))
+        mkdirSync(dir, { recursive: true });
+    writeFileSync(path, JSON.stringify(state, null, 2), "utf-8");
+}
+/**
+ * Record a legitimate save (called after every SDD tool mutation).
+ * Updates the checksum to the current graph state.
+ */
+export function recordLegitimateSave(projectDir, graph, changeId) {
+    const checksum = computeGraphChecksum(graph);
+    const state = loadIntegrityState(projectDir);
+    state.last合法Checksum = checksum;
+    state.last合法Save = Date.now();
+    state.tampered = false;
+    state.tamperCount = 0;
+    state.checksumHistory.push({
+        checksum,
+        timestamp: Date.now(),
+        nodeCount: graph.nodes.length,
+        relCount: graph.relationships.length,
+        changeId,
+    });
+    // Keep history bounded
+    if (state.checksumHistory.length > CHECKSUM_HISTORY_SIZE) {
+        state.checksumHistory = state.checksumHistory.slice(-CHECKSUM_HISTORY_SIZE);
+    }
+    saveIntegrityState(projectDir, state);
+    return checksum;
+}
+/**
+ * Validate the current graph against the last known legitimate state.
+ * Returns tamper detection result.
+ */
+export function validateGraphIntegrity(projectDir, graph) {
+    const state = loadIntegrityState(projectDir);
+    const currentChecksum = computeGraphChecksum(graph);
+    // No baseline yet — first save, accept
+    if (!state.last合法Checksum) {
+        return {
+            valid: true,
+            tampered: false,
+            currentChecksum,
+            expectedChecksum: "",
+            nodeCountDiff: 0,
+            relCountDiff: 0,
+        };
+    }
+    if (currentChecksum === state.last合法Checksum) {
+        return {
+            valid: true,
+            tampered: false,
+            currentChecksum,
+            expectedChecksum: state.last合法Checksum,
+            nodeCountDiff: 0,
+            relCountDiff: 0,
+        };
+    }
+    // Checksum mismatch — compute diffs for diagnostics
+    const lastEntry = state.checksumHistory[state.checksumHistory.length - 1];
+    const nodeCountDiff = lastEntry ? graph.nodes.length - lastEntry.nodeCount : 0;
+    const relCountDiff = lastEntry ? graph.relationships.length - lastEntry.relCount : 0;
+    // Determine if this is a suspicious modification:
+    // - No Change node was created (no changeId in recent history)
+    // - Nodes/relationships changed significantly without workflow
+    const timeSinceLastSave = Date.now() - state.last合法Save;
+    const recentChangeIds = state.checksumHistory
+        .filter(e => e.changeId)
+        .slice(-3)
+        .map(e => e.changeId);
+    const isSuspicious = recentChangeIds.length === 0 && // No recent workflow activity
+        Math.abs(nodeCountDiff) + Math.abs(relCountDiff) > 0; // But graph changed
+    if (isSuspicious) {
+        state.tampered = true;
+        state.tamperCount++;
+        state.tamperLog.push({
+            timestamp: Date.now(),
+            detected_checksum: currentChecksum,
+            expected_checksum: state.last合法Checksum,
+            node_count_diff: nodeCountDiff,
+            rel_count_diff: relCountDiff,
+        });
+        // Keep log bounded
+        if (state.tamperLog.length > 20) {
+            state.tamperLog = state.tamperLog.slice(-20);
+        }
+        saveIntegrityState(projectDir, state);
+        return {
+            valid: false,
+            tampered: true,
+            reason: `⚠️ TAMPER DETECTED: Graph was modified outside the SDD workflow.\n` +
+                `Expected checksum: ${state.last合法Checksum}\n` +
+                `Current checksum:  ${currentChecksum}\n` +
+                `Node diff: ${nodeCountDiff > 0 ? "+" : ""}${nodeCountDiff}, ` +
+                `Relationship diff: ${relCountDiff > 0 ? "+" : ""}${relCountDiff}\n` +
+                `Time since last legitimate save: ${Math.round(timeSinceLastSave / 1000)}s\n\n` +
+                `The graph appears to have been modified directly (e.g., via Python script, ` +
+                `shell command, or direct file edit) instead of through SDD tools.\n\n` +
+                `This modification has been logged. To fix:\n` +
+                `1. Run sdd.enforce to create a proper Change node\n` +
+                `2. Make changes through SDD tools only\n` +
+                `3. The tamper flag will be cleared on the next legitimate save`,
+            currentChecksum,
+            expectedChecksum: state.last合法Checksum,
+            nodeCountDiff,
+            relCountDiff,
+        };
+    }
+    // Graph changed but through legitimate means — update baseline
+    saveIntegrityState(projectDir, {
+        ...state,
+        last合法Checksum: currentChecksum,
+        last合法Save: Date.now(),
+        tampered: false,
+    });
+    return {
+        valid: true,
+        tampered: false,
+        currentChecksum,
+        expectedChecksum: state.last合法Checksum,
+        nodeCountDiff,
+        relCountDiff,
+    };
+}
+/**
+ * Get the tamper log for auditing.
+ */
+export function getTamperLog(projectDir) {
+    const state = loadIntegrityState(projectDir);
+    return state.tamperLog;
+}
+/**
+ * Check if the graph is currently flagged as tampered.
+ */
+export function isGraphTampered(projectDir) {
+    const state = loadIntegrityState(projectDir);
+    return state.tampered;
+}
+/**
+ * Clear the tamper flag (only after legitimate workflow completion).
+ */
+export function clearTamperFlag(projectDir) {
+    const state = loadIntegrityState(projectDir);
+    state.tampered = false;
+    state.tamperCount = 0;
+    saveIntegrityState(projectDir, state);
+}
+/**
+ * Format tamper detection result for display.
+ */
+export function formatTamperReport(result) {
+    if (!result.tampered) {
+        return "✅ Graph integrity: VALID — no tampering detected.";
+    }
+    const lines = [
+        "## 🚨 GRAPH TAMPER DETECTED",
+        "",
+        "The SDD Knowledge Graph has been modified outside the approved workflow.",
+        "",
+        "### Details",
+        `- **Expected checksum:** \`${result.expectedChecksum}\``,
+        `- **Actual checksum:** \`${result.currentChecksum}\``,
+        `- **Node count change:** ${result.nodeCountDiff > 0 ? "+" : ""}${result.nodeCountDiff}`,
+        `- **Relationship count change:** ${result.relCountDiff > 0 ? "+" : ""}${result.relCountDiff}`,
+        "",
+        "### What happened",
+        "Someone (likely the AI agent) modified the graph data files directly",
+        "(e.g., via Python script or shell command) instead of using SDD tools.",
+        "",
+        "### Why this is a problem",
+        "- No Change node was created for audit trail",
+        "- No approval workflow was followed",
+        "- No impact analysis was performed",
+        "- Specification validation was skipped",
+        "",
+        "### How to fix",
+        "1. Revert the unauthorized changes (git checkout .sdd/graph.yaml)",
+        "2. Use `sdd.enforce` → `sdd.update_from_answers` → `sdd.approve_change`",
+        "3. Make changes through SDD tools only",
+        "",
+        `### Tamper logged at: ${new Date().toISOString()}`,
+    ];
+    return lines.join("\n");
+}
+//# sourceMappingURL=integrity-guard.js.map

package/dist/sdd/graph/integrity-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrity-guard.js","sourceRoot":"","sources":["../../../src/sdd/graph/integrity-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AACnC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,IAAI,CAAA;AACvE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAEpC,MAAM,cAAc,GAAG,2BAA2B,CAAA;AAClD,MAAM,qBAAqB,GAAG,EAAE,CAAA;AA6BhC;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAIpC;IACC,mCAAmC;IACnC,MAAM,WAAW,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;SACjC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;SACxC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;SACtD,IAAI,CAAC,GAAG,CAAC,CAAA;IAEZ,2CAA2C;IAC3C,MAAM,UAAU,GAAG,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC;SACxC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;SACxC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;SAC/C,IAAI,CAAC,GAAG,CAAC,CAAA;IAEZ,MAAM,OAAO,GAAG,SAAS,WAAW,SAAS,UAAU,OAAO,KAAK,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAA;IACzF,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;AACxE,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CAAC,UAAkB;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAA;IAC7C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,cAAc,EAAE,EAAE;YAClB,UAAU,EAAE,CAAC;YACb,WAAW,EAAE,CAAC;YACd,eAAe,EAAE,EAAE;YACnB,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,EAAE;SACd,CAAA;IACH,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAA;QACpD,qDAAqD;QACrD,OAAO;YACL,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,YAAY,IAAI,EAAE;YAC9D,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC;YACjD,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,CAAC;YAClC,eAAe,EAAE,IAAI,CAAC,eAAe,IAAI,EAAE;YAC3C,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,KAAK;YAChC,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,EAAE;SAChC,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,cAAc,EAAE,EAAE;YAClB,UAAU,EAAE,CAAC;YACb,WAAW,EAAE,CAAC;YACd,eAAe,EAAE,EAAE;YACnB,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,EAAE;SACd,CAAA;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CAAC,UAAkB,EAAE,KAAqB;IACnE,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAA;IAC7C,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACzB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACzD,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAAkB,EAClB,KAIC,EACD,QAAiB;IAEjB,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAA;IAC5C,MAAM,KAAK,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAA;IAE5C,KAAK,CAAC,cAAc,GAAG,QAAQ,CAAA;IAC/B,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IAC7B,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAA;IACtB,KAAK,CAAC,WAAW,GAAG,CAAC,CAAA;IAErB,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC;QACzB,QAAQ;QACR,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;QACrB,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM;QAC7B,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,MAAM;QACpC,QAAQ;KACT,CAAC,CAAA;IAEF,uBAAuB;IACvB,IAAI,KAAK,CAAC,eAAe,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;QACzD,KAAK,CAAC,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC,CAAA;IAC7E,CAAC;IAED,kBAAkB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;IACrC,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACpC,UAAkB,EAClB,KAIC;IAUD,MAAM,KAAK,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAA;IAC5C,MAAM,eAAe,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAA;IAEnD,uCAAuC;IACvC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1B,OAAO;YACL,KAAK,EAAE,IAAI;YACX,QAAQ,EAAE,KAAK;YACf,eAAe;YACf,gBAAgB,EAAE,EAAE;YACpB,aAAa,EAAE,CAAC;YAChB,YAAY,EAAE,CAAC;SAChB,CAAA;IACH,CAAC;IAED,IAAI,eAAe,KAAK,KAAK,CAAC,cAAc,EAAE,CAAC;QAC7C,OAAO;YACL,KAAK,EAAE,IAAI;YACX,QAAQ,EAAE,KAAK;YACf,eAAe;YACf,gBAAgB,EAAE,KAAK,CAAC,cAAc;YACtC,aAAa,EAAE,CAAC;YAChB,YAAY,EAAE,CAAC;SAChB,CAAA;IACH,CAAC;IAED,oDAAoD;IACpD,MAAM,SAAS,GAAG,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IACzE,MAAM,aAAa,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAA;IAC9E,MAAM,YAAY,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;IAEpF,kDAAkD;IAClD,+DAA+D;IAC/D,+DAA+D;IAC/D,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,UAAU,CAAA;IACvD,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe;SAC1C,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;SACvB,KAAK,CAAC,CAAC,CAAC,CAAC;SACT,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;IAEvB,MAAM,YAAY,GAChB,eAAe,CAAC,MAAM,KAAK,CAAC,IAAI,8BAA8B;QAC9D,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAA,CAAC,oBAAoB;IAE3E,IAAI,YAAY,EAAE,CAAC;QACjB,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAA;QACrB,KAAK,CAAC,WAAW,EAAE,CAAA;QACnB,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC;YACnB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,iBAAiB,EAAE,eAAe;YAClC,iBAAiB,EAAE,KAAK,CAAC,cAAc;YACvC,eAAe,EAAE,aAAa;YAC9B,cAAc,EAAE,YAAY;SAC7B,CAAC,CAAA;QAEF,mBAAmB;QACnB,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAChC,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAA;QAC9C,CAAC;QAED,kBAAkB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;QAErC,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,QAAQ,EAAE,IAAI;YACd,MAAM,EACJ,oEAAoE;gBACpE,sBAAsB,KAAK,CAAC,cAAc,IAAI;gBAC9C,sBAAsB,eAAe,IAAI;gBACzC,cAAc,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,aAAa,IAAI;gBAC9D,sBAAsB,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,YAAY,IAAI;gBACpE,oCAAoC,IAAI,CAAC,KAAK,CAAC,iBAAiB,GAAG,IAAI,CAAC,OAAO;gBAC/E,6EAA6E;gBAC7E,uEAAuE;gBACvE,8CAA8C;gBAC9C,qDAAqD;gBACrD,0CAA0C;gBAC1C,gEAAgE;YAClE,eAAe;YACf,gBAAgB,EAAE,KAAK,CAAC,cAAc;YACtC,aAAa;YACb,YAAY;SACb,CAAA;IACH,CAAC;IAED,+DAA+D;IAC/D,kBAAkB,CAAC,UAAU,EAAE;QAC7B,GAAG,KAAK;QACR,cAAc,EAAE,eAAe;QAC/B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;QACtB,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAA;IAEF,OAAO;QACL,KAAK,EAAE,IAAI;QACX,QAAQ,EAAE,KAAK;QACf,eAAe;QACf,gBAAgB,EAAE,KAAK,CAAC,cAAc;QACtC,aAAa;QACb,YAAY;KACb,CAAA;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,UAAkB;IAC7C,MAAM,KAAK,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAA;IAC5C,OAAO,KAAK,CAAC,SAAS,CAAA;AACxB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,UAAkB;IAChD,MAAM,KAAK,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAA;IAC5C,OAAO,KAAK,CAAC,QAAQ,CAAA;AACvB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,UAAkB;IAChD,MAAM,KAAK,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAA;IAC5C,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAA;IACtB,KAAK,CAAC,WAAW,GAAG,CAAC,CAAA;IACrB,kBAAkB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;AACvC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAiD;IAEjD,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,OAAO,mDAAmD,CAAA;IAC5D,CAAC;IAED,MAAM,KAAK,GAAG;QACZ,6BAA6B;QAC7B,EAAE;QACF,0EAA0E;QAC1E,EAAE;QACF,aAAa;QACb,8BAA8B,MAAM,CAAC,gBAAgB,IAAI;QACzD,4BAA4B,MAAM,CAAC,eAAe,IAAI;QACtD,4BAA4B,MAAM,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,aAAa,EAAE;QACxF,oCAAoC,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,YAAY,EAAE;QAC9F,EAAE;QACF,mBAAmB;QACnB,sEAAsE;QACtE,wEAAwE;QACxE,EAAE;QACF,2BAA2B;QAC3B,8CAA8C;QAC9C,qCAAqC;QACrC,oCAAoC;QACpC,wCAAwC;QACxC,EAAE;QACF,gBAAgB;QAChB,mEAAmE;QACnE,yEAAyE;QACzE,wCAAwC;QACxC,EAAE;QACF,yBAAyB,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;KACpD,CAAA;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC"}

package/dist/sdd/graph/integrity.d.ts

@@ -0,0 +1,79 @@
+import type { KnowledgeGraph, RelationshipType } from "../domain/types.js";
+export interface IntegrityReport {
+    orphan_nodes: OrphanInfo[];
+    disconnected_groups: DisconnectedGroup[];
+    redundant_relationships: RedundantRelationship[];
+    fixes_applied: IntegrityFix[];
+    summary: IntegritySummary;
+}
+/**
+ * Options for controlling graph integrity check scope.
+ */
+export interface IntegrityCheckOptions {
+    /** Auto-fix detected issues. */
+    auto_fix?: boolean;
+    /** Only check these specific node IDs and their neighbors. */
+    focusNodeIds?: string[];
+    /** Skip these check types. */
+    skipChecks?: Array<"orphans" | "disconnected" | "redundant">;
+    /** Only check nodes that changed since a specific timestamp. */
+    changedSince?: string;
+    /** Maximum disconnected groups to report. */
+    maxGroups?: number;
+    /** Maximum orphans to report. */
+    maxOrphans?: number;
+    /** Cache for disconnected group detection (graph_hash → result). */
+    connectivityCache?: Map<string, {
+        connected: boolean;
+        groups: DisconnectedGroup[];
+        timestamp: number;
+    }>;
+}
+export interface OrphanInfo {
+    node_id: string;
+    node_name: string;
+    node_type: string;
+}
+export interface DisconnectedGroup {
+    group_id: number;
+    node_ids: string[];
+    node_names: string[];
+    size: number;
+    suggested_connection: {
+        target_id: string;
+        target_name: string;
+        relationship_type: RelationshipType;
+    } | null;
+}
+export interface RedundantRelationship {
+    relationship_id: string;
+    from: string;
+    to: string;
+    type: string;
+    reason: "duplicate" | "self_loop" | "reversed_exists";
+}
+export interface IntegrityFix {
+    action: "connected_orphan" | "merged_group" | "removed_duplicate" | "removed_self_loop" | "removed_reversed";
+    details: string;
+    relationship?: {
+        from: string;
+        to: string;
+        type: string;
+    };
+}
+export interface IntegritySummary {
+    total_nodes: number;
+    total_relationships: number;
+    orphans_found: number;
+    disconnected_groups_found: number;
+    redundant_relationships_found: number;
+    fixes_applied: number;
+    graph_connected: boolean;
+}
+/**
+ * Runs a full integrity check on the graph and optionally fixes issues.
+ * This should be called after any graph mutation (add/remove node or relationship).
+ */
+export declare function ensureGraphIntegrity(graph: KnowledgeGraph, options?: IntegrityCheckOptions): IntegrityReport;
+export declare function formatIntegrityReport(report: IntegrityReport): string;
+//# sourceMappingURL=integrity.d.ts.map

package/dist/sdd/graph/integrity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrity.d.ts","sourceRoot":"","sources":["../../../src/sdd/graph/integrity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EAGd,gBAAgB,EACjB,MAAM,oBAAoB,CAAA;AAW3B,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,UAAU,EAAE,CAAA;IAC1B,mBAAmB,EAAE,iBAAiB,EAAE,CAAA;IACxC,uBAAuB,EAAE,qBAAqB,EAAE,CAAA;IAChD,aAAa,EAAE,YAAY,EAAE,CAAA;IAC7B,OAAO,EAAE,gBAAgB,CAAA;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,gCAAgC;IAChC,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,8DAA8D;IAC9D,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB,8BAA8B;IAC9B,UAAU,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,cAAc,GAAG,WAAW,CAAC,CAAA;IAC5D,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,6CAA6C;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,iCAAiC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,oEAAoE;IACpE,iBAAiB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACxG;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,IAAI,EAAE,MAAM,CAAA;IACZ,oBAAoB,EAAE;QACpB,SAAS,EAAE,MAAM,CAAA;QACjB,WAAW,EAAE,MAAM,CAAA;QACnB,iBAAiB,EAAE,gBAAgB,CAAA;KACpC,GAAG,IAAI,CAAA;CACT;AAED,MAAM,WAAW,qBAAqB;IACpC,eAAe,EAAE,MAAM,CAAA;IACvB,IAAI,EAAE,MAAM,CAAA;IACZ,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,WAAW,GAAG,WAAW,GAAG,iBAAiB,CAAA;CACtD;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,kBAAkB,GAAG,cAAc,GAAG,mBAAmB,GAAG,mBAAmB,GAAG,kBAAkB,CAAA;IAC5G,OAAO,EAAE,MAAM,CAAA;IACf,YAAY,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAC1D;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAA;IACnB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,aAAa,EAAE,MAAM,CAAA;IACrB,yBAAyB,EAAE,MAAM,CAAA;IACjC,6BAA6B,EAAE,MAAM,CAAA;IACrC,aAAa,EAAE,MAAM,CAAA;IACrB,eAAe,EAAE,OAAO,CAAA;CACzB;AAID;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,cAAc,EACrB,OAAO,GAAE,qBAA0B,GAClC,eAAe,CAoGjB;AAwXD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,CAwDrE"}