oxe-cc 0.9.3 → 1.2.1

package/packages/runtime/src/policy/policy-engine.ts

@@ -0,0 +1,244 @@
+export type PolicyAction = 'allow' | 'deny' | 'require_human_gate';
+
+export type SideEffectClass =
+  | 'read_fs'
+  | 'write_fs'
+  | 'spawn_process'
+  | 'network_call'
+  | 'git_mutation'
+  | 'db_change'
+  | 'secret_access'
+  | 'infra_operation';
+
+export type AutonomyTier = 'L0' | 'L1' | 'L2' | 'L3';
+
+export interface PolicyWhenClause {
+  tool?: string;
+  env?: string;
+  kind?: string;
+  side_effect_class?: SideEffectClass;
+  autonomy_tier?: AutonomyTier;
+}
+
+export interface PolicyAssertClause {
+  diff_within_scope?: boolean;
+}
+
+export interface NodePolicyConfig {
+  max_retries: number;
+  mutation_budget?: number;
+  autonomy_tier?: AutonomyTier;
+  allowed_side_effects?: SideEffectClass[];
+}
+
+export interface EnvironmentGuardrail {
+  protected_paths: string[];
+  protected_branches: string[];
+  require_human_gate_on: SideEffectClass[];
+}
+
+export interface PolicyRule {
+  id: string;
+  when: PolicyWhenClause;
+  assert?: PolicyAssertClause;
+  action: PolicyAction;
+}
+
+export interface PolicyContext {
+  tool: string;
+  env?: string;
+  kind?: string;
+  mutation_scope?: string[];
+  affected_paths?: string[];
+  side_effect_class?: SideEffectClass;
+  autonomy_tier?: AutonomyTier;
+  mutation_count?: number;
+  node_policy?: NodePolicyConfig;
+}
+
+export interface PolicyDecision {
+  allowed: boolean;
+  gate_required: boolean;
+  reason: string;
+  rule_id: string | null;
+}
+
+const ALLOW_ALL: PolicyDecision = {
+  allowed: true,
+  gate_required: false,
+  reason: 'no matching policy — default allow',
+  rule_id: null,
+};
+
+const DEFAULT_GUARDRAIL: EnvironmentGuardrail = {
+  protected_paths: ['.oxe/config.json', '.env', 'package.json'],
+  protected_branches: ['main', 'master', 'production', 'release'],
+  require_human_gate_on: ['infra_operation', 'db_change', 'secret_access'],
+};
+
+// Autonomy tier → max side effect class allowed without a gate
+const TIER_SIDE_EFFECT_MAP: Record<AutonomyTier, SideEffectClass[]> = {
+  L0: ['read_fs'],
+  L1: ['read_fs', 'write_fs', 'spawn_process'],
+  L2: ['read_fs', 'write_fs', 'spawn_process', 'network_call', 'git_mutation'],
+  L3: ['read_fs', 'write_fs', 'spawn_process', 'network_call', 'git_mutation', 'db_change', 'secret_access', 'infra_operation'],
+};
+
+export class PolicyEngine {
+  constructor(
+    private readonly rules: PolicyRule[] = [],
+    private readonly guardrail: EnvironmentGuardrail = DEFAULT_GUARDRAIL
+  ) {}
+
+  evaluate(ctx: PolicyContext): PolicyDecision {
+    // Check autonomy tier first — a denial takes priority over guardrail gates
+    const tierDecision = this.checkAutonomyTier(ctx);
+    if (tierDecision) return tierDecision;
+
+    // Check environment guardrails (may require gate even when tier permits)
+    const guardrailDecision = this.checkGuardrails(ctx);
+    if (guardrailDecision) return guardrailDecision;
+
+    // Check mutation budget
+    const budgetDecision = this.checkMutationBudget(ctx);
+    if (budgetDecision) return budgetDecision;
+
+    // Evaluate rules (first match wins)
+    for (const rule of this.rules) {
+      if (!this.matches(rule.when, ctx)) continue;
+
+      if (rule.assert) {
+        const assertFailed = this.checkAssert(rule.assert, ctx);
+        if (assertFailed) {
+          return {
+            allowed: false,
+            gate_required: false,
+            reason: `Assert failed for rule ${rule.id}: ${assertFailed}`,
+            rule_id: rule.id,
+          };
+        }
+      }
+
+      switch (rule.action) {
+        case 'allow':
+          return { allowed: true, gate_required: false, reason: `Allowed by rule ${rule.id}`, rule_id: rule.id };
+        case 'deny':
+          return { allowed: false, gate_required: false, reason: `Denied by rule ${rule.id}`, rule_id: rule.id };
+        case 'require_human_gate':
+          return { allowed: true, gate_required: true, reason: `Gate required by rule ${rule.id}`, rule_id: rule.id };
+      }
+    }
+
+    return ALLOW_ALL;
+  }
+
+  private checkGuardrails(ctx: PolicyContext): PolicyDecision | null {
+    // Protected path check
+    const affected = ctx.affected_paths ?? [];
+    for (const p of affected) {
+      if (this.guardrail.protected_paths.some((pp) => p === pp || p.startsWith(pp + '/'))) {
+        return {
+          allowed: true,
+          gate_required: true,
+          reason: `Protected path affected: ${p}`,
+          rule_id: '__guardrail_path',
+        };
+      }
+    }
+
+    // Side effect class requiring gate
+    if (ctx.side_effect_class && this.guardrail.require_human_gate_on.includes(ctx.side_effect_class)) {
+      return {
+        allowed: true,
+        gate_required: true,
+        reason: `Side effect class '${ctx.side_effect_class}' requires human gate`,
+        rule_id: '__guardrail_side_effect',
+      };
+    }
+
+    return null;
+  }
+
+  private checkAutonomyTier(ctx: PolicyContext): PolicyDecision | null {
+    if (!ctx.autonomy_tier || !ctx.side_effect_class) return null;
+    const allowed = TIER_SIDE_EFFECT_MAP[ctx.autonomy_tier] ?? [];
+    if (!allowed.includes(ctx.side_effect_class)) {
+      return {
+        allowed: false,
+        gate_required: false,
+        reason: `Autonomy tier ${ctx.autonomy_tier} does not permit side effect '${ctx.side_effect_class}'`,
+        rule_id: '__autonomy_tier',
+      };
+    }
+    return null;
+  }
+
+  private checkMutationBudget(ctx: PolicyContext): PolicyDecision | null {
+    const budget = ctx.node_policy?.mutation_budget;
+    if (budget === undefined || budget === null) return null;
+    const count = ctx.mutation_count ?? 0;
+    if (count >= budget) {
+      return {
+        allowed: false,
+        gate_required: false,
+        reason: `Mutation budget exhausted: ${count}/${budget}`,
+        rule_id: '__mutation_budget',
+      };
+    }
+    return null;
+  }
+
+  private matches(when: PolicyWhenClause, ctx: PolicyContext): boolean {
+    if (when.tool && when.tool !== ctx.tool) return false;
+    if (when.env && when.env !== ctx.env) return false;
+    if (when.kind && when.kind !== ctx.kind) return false;
+    if (when.side_effect_class && when.side_effect_class !== ctx.side_effect_class) return false;
+    if (when.autonomy_tier && when.autonomy_tier !== ctx.autonomy_tier) return false;
+    return true;
+  }
+
+  private checkAssert(assert: PolicyAssertClause, ctx: PolicyContext): string | null {
+    if (assert.diff_within_scope === true) {
+      const scope = ctx.mutation_scope ?? [];
+      const affected = ctx.affected_paths ?? [];
+      if (scope.length === 0) return null;
+      const outsideScope = affected.filter(
+        (p) => !scope.some((s) => p.startsWith(s) || s.startsWith(p))
+      );
+      if (outsideScope.length > 0) {
+        return `paths outside mutation scope: ${outsideScope.join(', ')}`;
+      }
+    }
+    return null;
+  }
+
+  withRule(rule: PolicyRule): PolicyEngine {
+    return new PolicyEngine([...this.rules, rule], this.guardrail);
+  }
+
+  withGuardrail(guardrail: EnvironmentGuardrail): PolicyEngine {
+    return new PolicyEngine(this.rules, guardrail);
+  }
+
+  getGuardrail(): EnvironmentGuardrail {
+    return this.guardrail;
+  }
+
+  static fromConfig(config: { policies?: PolicyRule[]; guardrail?: EnvironmentGuardrail }): PolicyEngine {
+    return new PolicyEngine(config.policies ?? [], config.guardrail ?? DEFAULT_GUARDRAIL);
+  }
+
+  static fromConfigFile(configPath: string): PolicyEngine {
+    try {
+      // eslint-disable-next-line @typescript-eslint/no-var-requires
+      const cfg = require(configPath) as { policies?: PolicyRule[]; guardrail?: EnvironmentGuardrail };
+      return PolicyEngine.fromConfig(cfg);
+    } catch {
+      return new PolicyEngine();
+    }
+  }
+
+  static defaultGuardrail(): EnvironmentGuardrail {
+    return { ...DEFAULT_GUARDRAIL };
+  }
+}

package/packages/runtime/src/projection/index.ts

@@ -0,0 +1 @@
+export * from './projection-engine';

package/packages/runtime/src/projection/projection-engine.ts

@@ -0,0 +1,249 @@
+import type { RunState } from '../reducers/run-state-reducer';
+import type { ExecutionGraph } from '../compiler/graph-compiler';
+import type { VerificationResult } from '../models/verification-result';
+import type { CheckResult } from '../verification/verification-compiler';
+
+function isoToDate(iso: string | null | undefined): string {
+  if (!iso) return '—';
+  return iso.slice(0, 10);
+}
+
+function statusIcon(status: string): string {
+  switch (status) {
+    case 'completed': return '✓';
+    case 'failed': return '✗';
+    case 'blocked': return '⊘';
+    case 'running': return '⟳';
+    default: return '○';
+  }
+}
+
+function verifyIcon(status: string): string {
+  switch (status) {
+    case 'pass': return '✓ PASS';
+    case 'fail': return '✗ FAIL';
+    case 'skip': return '— SKIP';
+    case 'error': return '! ERROR';
+    default: return status;
+  }
+}
+
+export class ProjectionEngine {
+  projectPlan(state: RunState, graph: ExecutionGraph): string {
+    const run = state.run;
+    const lines: string[] = [
+      '# OXE — Plano de Execução',
+      '',
+      '<!-- Gerado automaticamente pelo Projection Engine — não editar diretamente -->',
+      '',
+      '## Resumo',
+      '',
+      `- **Run:** ${run?.run_id ?? '—'}`,
+      `- **Status:** ${run?.status ?? 'sem run'}`,
+      `- **Iniciado em:** ${isoToDate(run?.started_at)}`,
+      `- **Nós:** ${graph.metadata.node_count} tarefas em ${graph.metadata.wave_count} onda(s)`,
+      '',
+      '## Ondas e tarefas',
+      '',
+    ];
+
+    for (const wave of graph.waves) {
+      lines.push(`### Onda ${wave.wave_number}`);
+      lines.push('');
+      lines.push('| ID | Título | Status | Dependências |');
+      lines.push('|----|--------|--------|--------------|');
+      for (const nodeId of wave.node_ids) {
+        const node = graph.nodes.get(nodeId);
+        const wItem = state.workItems.get(nodeId);
+        const status = wItem?.status ?? 'pending';
+        const deps = node?.depends_on.join(', ') || '—';
+        lines.push(`| ${nodeId} | ${node?.title ?? nodeId} | ${statusIcon(status)} ${status} | ${deps} |`);
+      }
+      lines.push('');
+    }
+
+    if (state.completedWorkItems.size > 0 || state.failedWorkItems.size > 0) {
+      lines.push('## Progresso');
+      lines.push('');
+      lines.push(`- **Concluídos:** ${[...state.completedWorkItems].join(', ') || '—'}`);
+      lines.push(`- **Falhos:** ${[...state.failedWorkItems].join(', ') || '—'}`);
+      lines.push(`- **Bloqueados:** ${[...state.blockedWorkItems].join(', ') || '—'}`);
+      lines.push('');
+    }
+
+    return lines.join('\n');
+  }
+
+  projectVerify(
+    state: RunState,
+    results: VerificationResult[],
+    checkResults?: CheckResult[]
+  ): string {
+    const run = state.run;
+    const lines: string[] = [
+      '# OXE — Verificação',
+      '',
+      '<!-- Gerado automaticamente pelo Projection Engine — não editar diretamente -->',
+      '',
+      '## Auditoria de pré-execução',
+      '',
+      `- **Run:** ${run?.run_id ?? '—'}`,
+      `- **Iniciado em:** ${isoToDate(run?.started_at)}`,
+      `- **Concluído em:** ${isoToDate(run?.ended_at)}`,
+      `- **Status:** ${run?.status ?? '—'}`,
+      '',
+    ];
+
+    if (results.length > 0) {
+      lines.push('## Critérios de aceite');
+      lines.push('');
+      lines.push('| ID | Check | Status | Evidências |');
+      lines.push('|----|-------|--------|------------|');
+      for (const r of results) {
+        const evidenceList = r.evidence_refs.join(', ') || '—';
+        lines.push(`| ${r.check_id} | ${r.summary ?? r.check_id} | ${verifyIcon(r.status)} | ${evidenceList} |`);
+      }
+      lines.push('');
+    }
+
+    if (checkResults && checkResults.length > 0) {
+      lines.push('## Resultados dos checks executados');
+      lines.push('');
+      lines.push('| Check | Aceite | Status | Duração |');
+      lines.push('|-------|--------|--------|---------|');
+      for (const cr of checkResults) {
+        lines.push(`| ${cr.check_id} | ${cr.acceptance_ref ?? '—'} | ${verifyIcon(cr.status)} | ${cr.duration_ms}ms |`);
+      }
+      lines.push('');
+    }
+
+    const passed = results.filter((r) => r.status === 'pass').length;
+    const failed = results.filter((r) => r.status === 'fail').length;
+    const allPass = failed === 0 && results.length > 0;
+
+    lines.push('## Conclusão');
+    lines.push('');
+    lines.push(`- **Total de critérios:** ${results.length}`);
+    lines.push(`- **Aprovados:** ${passed}`);
+    lines.push(`- **Reprovados:** ${failed}`);
+    lines.push('');
+    lines.push(allPass
+      ? '> ✓ **Verificação concluída com sucesso.** Todos os critérios foram atendidos.'
+      : `> ✗ **Verificação com falhas.** ${failed} critério(s) não atendido(s).`);
+    lines.push('');
+
+    return lines.join('\n');
+  }
+
+  projectState(state: RunState): string {
+    const run = state.run;
+    const completed = [...state.completedWorkItems];
+    const failed = [...state.failedWorkItems];
+    const blocked = [...state.blockedWorkItems];
+
+    const lines: string[] = [
+      '# OXE — Estado',
+      '',
+      '<!-- Gerado automaticamente pelo Projection Engine — não editar diretamente -->',
+      '',
+      '## Fase atual',
+      '',
+      `- **Status da run:** ${run?.status ?? 'sem run ativa'}`,
+      `- **Run ID:** ${run?.run_id ?? '—'}`,
+      `- **Modo:** ${run?.mode ?? '—'}`,
+      '',
+      '## Runtime operacional',
+      '',
+      `- **runtime_status:** ${run?.status ?? '—'}`,
+      `- **active_run_ref:** ${run?.run_id ?? '—'}`,
+      '',
+      '## Progresso',
+      '',
+      `- **Concluídos (${completed.length}):** ${completed.join(', ') || '—'}`,
+      `- **Falhos (${failed.length}):** ${failed.join(', ') || '—'}`,
+      `- **Bloqueados (${blocked.length}):** ${blocked.join(', ') || '—'}`,
+      '',
+      `- **lifecycleStatus:** ${run?.status === 'completed' ? 'closed' : run?.status === 'running' ? 'executing' : 'pending_execute'}`,
+      '',
+    ];
+
+    return lines.join('\n');
+  }
+
+  projectRunSummary(state: RunState): string {
+    const run = state.run;
+    const completed = [...state.completedWorkItems];
+    const failed = [...state.failedWorkItems];
+    const blocked = [...state.blockedWorkItems];
+    const totalAttempts = [...state.attempts.values()].reduce((s, a) => s + a.length, 0);
+
+    const lines: string[] = [
+      `## Run Summary — ${run?.run_id ?? 'unknown'}`,
+      '',
+      `**Status:** ${run?.status ?? '—'}  `,
+      `**Mode:** ${run?.mode ?? '—'}  `,
+      `**Started:** ${isoToDate(run?.started_at)}  `,
+      `**Ended:** ${isoToDate(run?.ended_at)}  `,
+      '',
+      `**Completed:** ${completed.length} tasks  `,
+      `**Failed:** ${failed.length} tasks  `,
+      `**Blocked:** ${blocked.length} tasks  `,
+      `**Total attempts:** ${totalAttempts}  `,
+      '',
+    ];
+
+    if (completed.length > 0) {
+      lines.push(`**✓ Completed:** ${completed.join(', ')}`);
+    }
+    if (failed.length > 0) {
+      lines.push(`**✗ Failed:** ${failed.join(', ')}`);
+    }
+    if (blocked.length > 0) {
+      lines.push(`**⊘ Blocked:** ${blocked.join(', ')}`);
+    }
+
+    return lines.join('\n');
+  }
+
+  projectPRSummary(state: RunState, graph: ExecutionGraph): string {
+    const run = state.run;
+    const completed = [...state.completedWorkItems];
+    const failed = [...state.failedWorkItems];
+
+    const lines: string[] = [
+      '## Summary',
+      '',
+    ];
+
+    if (completed.length > 0) {
+      for (const id of completed) {
+        const node = graph.nodes.get(id);
+        lines.push(`- ✓ ${node?.title ?? id} (\`${id}\`)`);
+      }
+    }
+
+    if (failed.length > 0) {
+      lines.push('');
+      lines.push('**⚠️ Incomplete tasks:**');
+      for (const id of failed) {
+        const node = graph.nodes.get(id);
+        lines.push(`- ✗ ${node?.title ?? id} (\`${id}\`)`);
+      }
+    }
+
+    lines.push('');
+    lines.push('## Test plan');
+    lines.push('');
+
+    for (const wave of graph.waves) {
+      lines.push(`- [ ] Wave ${wave.wave_number}: ${wave.node_ids.join(', ')}`);
+    }
+
+    lines.push('');
+    lines.push(`**Run:** \`${run?.run_id ?? '—'}\` | **Status:** ${run?.status ?? '—'}`);
+    lines.push('');
+    lines.push('🤖 Generated with [OXE Runtime](https://github.com/propagno/oxe-build)');
+
+    return lines.join('\n');
+  }
+}

package/packages/runtime/src/reducers/debug-reducer.ts

@@ -0,0 +1,36 @@
+import type { OxeEvent } from '../events/envelope';
+import { createEmptyRunState, applyEventExported as applyEvent } from './run-state-reducer';
+import type { RunState } from './run-state-reducer';
+
+export interface ReplayStep {
+  index: number;
+  event: OxeEvent;
+  state: RunState;
+}
+
+export function* stepReplay(events: OxeEvent[]): Generator<ReplayStep> {
+  let state = createEmptyRunState();
+  for (let i = 0; i < events.length; i++) {
+    state = applyEvent(state, events[i]);
+    yield { index: i, event: events[i], state };
+  }
+}
+
+export function replayUntil(
+  events: OxeEvent[],
+  predicate: (step: ReplayStep) => boolean
+): ReplayStep | null {
+  for (const step of stepReplay(events)) {
+    if (predicate(step)) return step;
+  }
+  return null;
+}
+
+export function replaySlice(events: OxeEvent[], from: number, to: number): ReplayStep[] {
+  const steps: ReplayStep[] = [];
+  for (const step of stepReplay(events)) {
+    if (step.index >= from && step.index <= to) steps.push(step);
+    if (step.index > to) break;
+  }
+  return steps;
+}

package/packages/runtime/src/reducers/index.ts

@@ -0,0 +1,2 @@
+export * from './run-state-reducer';
+export * from './debug-reducer';