patchwork-os 1.2.0-beta.2.canary.755 → 1.2.0-beta.2.canary.757

package/dist/index.js

@@ -220,6 +220,10 @@ const KNOWN_SUBCOMMANDS = [
     "reject",
     "gate",
     "outcomes",
+    // Raw PR-event ledger. Absent from this array a verb IS dispatched but the
+    // suggester calls it unknown — the exact trap the `tools` comment below
+    // records, and audit-cli-commands.mjs reads this array as ground truth.
+    "pr-outcomes",
     "butler",
     "privacy",
     "doctor",
@@ -304,6 +308,7 @@ if (process.argv[2] === "--help" ||
         `Diagnose\n` +
         `  halts [--window 1h|24h|overnight|7d]      Morning summary of recent recipe halts\n` +
         `  judgments [--window ...] [--recipe N]     Recent judge-step verdicts across runs\n` +
+        `  pr-outcomes <collect|show>               Record raw PR events so trust can be derived later\n` +
         `  privacy destinations                     Where prompts may go, and which leave this machine\n` +
         `  privacy receipts [--since-days N]        What the LIVE information boundary actually decided\n` +
         `  privacy shadow [--since-days N]          What a candidate privacy policy would have stopped\n` +
@@ -4161,6 +4166,147 @@ if (process.argv[2] === "shadow-scan") {
 //
 // Reports DENOMINATORS. It is not the reader, and building the reader is
 // exactly what the spine's own rule defers until there is evidence to read.
+// --- pr-outcomes (maintenance roadmap, phase 1) ---
+//
+// Built before the workers that will read it, deliberately, and it is the one
+// item on that roadmap where that is correct: outcome history accrues only
+// with wall-clock time, and a day not recorded is a day that cannot be
+// recovered. Everything else can be built whenever.
+if (process.argv[2] === "pr-outcomes") {
+    const args = process.argv.slice(3);
+    if (args.includes("--help") || args.includes("-h")) {
+        process.stdout.write("Usage: patchwork pr-outcomes <collect|show> [--repo owner/name] [--limit N] [--json]\n\n" +
+            "Record raw pull-request events so trust can be derived LATER from evidence\n" +
+            "rather than asserted now. Each row is what the API said at one moment; run\n" +
+            "`collect` regularly and trajectories appear. Run it once and you get final\n" +
+            "states only, which the summary says rather than implying otherwise.\n\n" +
+            "  collect   query the repo and append anything that changed\n" +
+            "  show      summarise what the ledger already holds\n\n" +
+            "No score is derived. Whether a worker opened a PR is OMITTED when no roster\n" +
+            "is configured, never recorded as false: unknown and no are different facts.\n\n" +
+            "Rows name real pull requests and authors, so they are operator data like the\n" +
+            "other ledgers - quote a measurement, never paste the rows.\n");
+        process.exit(0);
+    }
+    (async () => {
+        const { readFileSync, appendFileSync, existsSync } = await import("node:fs");
+        const { join } = await import("node:path");
+        const { patchworkPath } = await import("./patchworkHome.js");
+        const { execFileSync } = await import("node:child_process");
+        const { toObservation, dedupeAgainst, summarise, formatLedgerSummary } = await import("./maintenance/prOutcomeLedger.js");
+        const file = join(patchworkPath(), "pr_outcomes.jsonl");
+        const read = () => {
+            if (!existsSync(file))
+                return [];
+            const out = [];
+            for (const line of readFileSync(file, "utf-8").split("\n")) {
+                if (line.trim() === "")
+                    continue;
+                try {
+                    out.push(JSON.parse(line));
+                }
+                catch {
+                    // A corrupt line is skipped, never repaired: rewriting an
+                    // append-only evidence file to make it parse is how evidence
+                    // quietly becomes fiction.
+                }
+            }
+            return out;
+        };
+        const sub = args[0] ?? "show";
+        if (sub === "show") {
+            const rows = read();
+            const s = summarise(rows);
+            process.stdout.write(args.includes("--json")
+                ? `${JSON.stringify(s, null, 2)}\n`
+                : `${formatLedgerSummary(s)}\n`);
+            // Always 0. An empty ledger on day one is a true and expected state.
+            process.exit(0);
+        }
+        if (sub === "collect") {
+            const repoIdx = args.indexOf("--repo");
+            const limIdx = args.indexOf("--limit");
+            const limit = limIdx >= 0 ? Number(args[limIdx + 1]) : 100;
+            let repo = repoIdx >= 0 ? args[repoIdx + 1] : undefined;
+            if (repo === undefined) {
+                try {
+                    repo = execFileSync("gh", ["repo", "view", "--json", "nameWithOwner", "-q", ".nameWithOwner"], {
+                        encoding: "utf-8",
+                        stdio: ["ignore", "pipe", "ignore"],
+                    }).trim();
+                }
+                catch {
+                    process.stderr.write("[pr-outcomes] could not determine the repository. Pass --repo owner/name.\n");
+                    process.exit(2);
+                }
+            }
+            let payload = "";
+            try {
+                payload = execFileSync("gh", [
+                    "pr",
+                    "list",
+                    "--repo",
+                    repo,
+                    "--state",
+                    "all",
+                    "--limit",
+                    String(Number.isFinite(limit) ? limit : 100),
+                    "--json",
+                    "number,state,createdAt,mergedAt,closedAt,additions,deletions,changedFiles,author,mergeCommit",
+                ], {
+                    encoding: "utf-8",
+                    stdio: ["ignore", "pipe", "pipe"],
+                    maxBuffer: 32 * 1024 * 1024,
+                });
+            }
+            catch (err) {
+                // Fail-soft and LOUD. A collector that silently reports success on a
+                // failed query would leave a gap indistinguishable from a quiet week.
+                process.stderr.write(`[pr-outcomes] the GitHub query failed, so NOTHING was recorded: ${err instanceof Error ? err.message.split("\n")[0] : String(err)}\n`);
+                process.exit(1);
+            }
+            let parsed;
+            try {
+                parsed = JSON.parse(payload);
+            }
+            catch {
+                process.stderr.write("[pr-outcomes] the GitHub response did not parse; nothing recorded.\n");
+                process.exit(1);
+            }
+            const observedAt = new Date().toISOString();
+            const incoming = [];
+            let unusable = 0;
+            for (const r of Array.isArray(parsed) ? parsed : []) {
+                const o = toObservation(r, {
+                    repo: repo,
+                    observedAt,
+                });
+                if (o === null)
+                    unusable++;
+                else
+                    incoming.push(o);
+            }
+            const existing = read();
+            const { toAppend, unchanged, firstSighting } = dedupeAgainst(existing, incoming);
+            for (const o of toAppend)
+                appendFileSync(file, `${JSON.stringify(o)}\n`, { mode: 0o600 });
+            process.stdout.write(`[pr-outcomes] ${repo}: ${incoming.length} pull request(s) queried\n` +
+                `  ${toAppend.length} appended (${firstSighting} seen for the first time)\n` +
+                `  ${unchanged} unchanged since the last collection\n` +
+                (unusable > 0
+                    ? `  ${unusable} row(s) lacked the fields needed to key them and were DROPPED\n`
+                    : "") +
+                (firstSighting === incoming.length && existing.length === 0
+                    ? "\n  Every row is a first sighting, so this is a snapshot of final\n" +
+                        "  states rather than a history. Trajectories begin from the next\n" +
+                        "  collection onward - that part cannot be backfilled.\n"
+                    : ""));
+            process.exit(0);
+        }
+        process.stderr.write("Usage: patchwork pr-outcomes <collect|show>\n");
+        process.exit(2);
+    })();
+}
 if (process.argv[2] === "evidence") {
     const args = process.argv.slice(3);
     if (args.includes("--help") || args.includes("-h")) {
@@ -4204,10 +4350,17 @@ if (process.argv[2] === "workers") {
     if ((sub !== "shadow" &&
         sub !== "backtest" &&
         sub !== "list" &&
-        sub !== "validate") ||
+        sub !== "validate" &&
+        sub !== "authority-delta") ||
         args.includes("--help") ||
         args.includes("-h")) {
-        process.stdout.write("Usage: patchwork workers <list|validate|shadow|backtest> [--workers-dir <path>]\n\n" +
+        process.stdout.write("Usage: patchwork workers <list|validate|authority-delta|shadow|backtest> [--workers-dir <path>]\n\n" +
+            "  authority-delta  What a change does to worker AUTHORITY, comparing manifests\n" +
+            "            between two git refs (--base, --head, --dir). Reuses the runtime\n" +
+            "            policy primitives, with one inversion: an unreadable `forbids`\n" +
+            "            entry fails OPEN at runtime and is reported here as a WIDENING,\n" +
+            '            because "I could not read your deny-list" must never resolve to\n' +
+            '            "looks fine". Exits 1 on a widening.\n' +
             "  list      What is installed, and — the point — what the bridge IGNORES.\n" +
             "            A manifest that does not parse is skipped by the loader, so no\n" +
             "            worker owns its recipe and the autonomy gate never runs for it.\n" +
@@ -4226,57 +4379,114 @@ if (process.argv[2] === "workers") {
             "  --workers-dir <path>  Where *.worker.yaml live (default ~/.patchwork/workers)\n");
         process.exit(0);
     }
-    (async () => {
-        try {
-            const dirIdx = args.indexOf("--workers-dir");
-            const workersDir = dirIdx !== -1 ? args[dirIdx + 1] : undefined;
-            if (sub === "list" || sub === "validate") {
-                const { scanWorkers, validateWorkers, formatWorkersList, formatWorkersValidate, defaultWorkersDir, defaultRecipesDir, } = await import("./workers/workersCli.js");
-                const dir = workersDir ?? defaultWorkersDir();
-                const json = args.includes("--json");
-                if (sub === "list") {
-                    const scan = scanWorkers(dir);
+    if (sub === "authority-delta") {
+        (async () => {
+            const { execFileSync } = await import("node:child_process");
+            const { parse: parseYaml } = await import("yaml");
+            const { parseWorker } = await import("./workers/worker.js");
+            const { authorityDeltaForSet, formatAuthorityDeltas, widensAuthority } = await import("./workers/authorityDelta.js");
+            const argAfter = (flag) => {
+                const i = args.indexOf(flag);
+                return i >= 0 ? args[i + 1] : undefined;
+            };
+            const base = argAfter("--base") ?? "main";
+            const head = argAfter("--head") ?? "HEAD";
+            const dir = argAfter("--dir") ?? "templates/workers";
+            const git = (a) => execFileSync("git", a, { encoding: "utf-8" });
+            const listAt = (ref) => {
+                const m = new Map();
+                let files = [];
+                try {
+                    files = git(["ls-tree", "-r", "--name-only", ref, "--", dir])
+                        .split("\n")
+                        .filter((f) => /\.ya?ml$/i.test(f));
+                }
+                catch {
+                    // A ref that cannot be read is a usage error, not "no manifests" —
+                    // returning empty would report every worker as newly added, which
+                    // this classifier treats as a widening. Failing loudly is the only
+                    // honest answer.
+                    process.stderr.write(`[authority] cannot read ref "${ref}"\n`);
+                    process.exit(2);
+                }
+                for (const f of files) {
+                    try {
+                        m.set(f, parseWorker(parseYaml(git(["show", `${ref}:${f}`]))));
+                    }
+                    catch {
+                        // An unparseable manifest is SKIPPED by the loader at runtime, so
+                        // the worker governs nothing. Omitting it here would masquerade as
+                        // a deletion — itself reported as a widening — so say what
+                        // happened and point at the verb that diagnoses it.
+                        process.stderr.write(`[authority] ${ref}:${f} does not parse — run \`patchwork workers validate\`\n`);
+                    }
+                }
+                return m;
+            };
+            const deltas = authorityDeltaForSet(listAt(base), listAt(head));
+            if (args.includes("--json")) {
+                process.stdout.write(`${JSON.stringify(deltas, null, 2)}\n`);
+            }
+            else {
+                process.stdout.write(`${formatAuthorityDeltas(deltas)}\n`);
+            }
+            // Exit 1 on a widening so CI can gate on it. A widening is not a defect;
+            // it is a change that requires a person to say so.
+            process.exit(widensAuthority(deltas) ? 1 : 0);
+        })();
+    }
+    else
+        (async () => {
+            try {
+                const dirIdx = args.indexOf("--workers-dir");
+                const workersDir = dirIdx !== -1 ? args[dirIdx + 1] : undefined;
+                if (sub === "list" || sub === "validate") {
+                    const { scanWorkers, validateWorkers, formatWorkersList, formatWorkersValidate, defaultWorkersDir, defaultRecipesDir, } = await import("./workers/workersCli.js");
+                    const dir = workersDir ?? defaultWorkersDir();
+                    const json = args.includes("--json");
+                    if (sub === "list") {
+                        const scan = scanWorkers(dir);
+                        process.stdout.write(json
+                            ? `${JSON.stringify({
+                                dir: scan.dir,
+                                loaded: scan.loaded.map((l) => ({
+                                    file: l.file,
+                                    id: l.worker.id,
+                                    name: l.worker.name,
+                                    recipe: l.worker.recipe ?? null,
+                                    autonomyCeiling: l.worker.autonomyCeiling,
+                                    owns: l.worker.owns,
+                                })),
+                                broken: scan.broken,
+                            }, null, 2)}\n`
+                            : formatWorkersList(scan));
+                        // A manifest the bridge ignores is a governance gap, not a note.
+                        process.exit(scan.broken.length > 0 ? 1 : 0);
+                    }
+                    const tIdx = args.indexOf("--templates-dir");
+                    const templatesDir = tIdx !== -1 ? args[tIdx + 1] : undefined;
+                    const rIdx = args.indexOf("--recipes-dir");
+                    const result = validateWorkers({
+                        workersDir: dir,
+                        recipesDir: rIdx !== -1 ? args[rIdx + 1] : defaultRecipesDir(),
+                        ...(templatesDir ? { templatesDir } : {}),
+                    });
                     process.stdout.write(json
-                        ? `${JSON.stringify({
-                            dir: scan.dir,
-                            loaded: scan.loaded.map((l) => ({
-                                file: l.file,
-                                id: l.worker.id,
-                                name: l.worker.name,
-                                recipe: l.worker.recipe ?? null,
-                                autonomyCeiling: l.worker.autonomyCeiling,
-                                owns: l.worker.owns,
-                            })),
-                            broken: scan.broken,
-                        }, null, 2)}\n`
-                        : formatWorkersList(scan));
-                    // A manifest the bridge ignores is a governance gap, not a note.
-                    process.exit(scan.broken.length > 0 ? 1 : 0);
+                        ? `${JSON.stringify(result, null, 2)}\n`
+                        : formatWorkersValidate(result));
+                    process.exit(result.healthy ? 0 : 1);
                 }
-                const tIdx = args.indexOf("--templates-dir");
-                const templatesDir = tIdx !== -1 ? args[tIdx + 1] : undefined;
-                const rIdx = args.indexOf("--recipes-dir");
-                const result = validateWorkers({
-                    workersDir: dir,
-                    recipesDir: rIdx !== -1 ? args[rIdx + 1] : defaultRecipesDir(),
-                    ...(templatesDir ? { templatesDir } : {}),
-                });
-                process.stdout.write(json
-                    ? `${JSON.stringify(result, null, 2)}\n`
-                    : formatWorkersValidate(result));
-                process.exit(result.healthy ? 0 : 1);
+                const { runWorkerShadowReport, runWorkerBacktest } = await import("./workers/runWorkerShadow.js");
+                const opts = workersDir ? { workersDir } : {};
+                process.stdout.write(sub === "backtest"
+                    ? runWorkerBacktest(opts)
+                    : runWorkerShadowReport(opts));
             }
-            const { runWorkerShadowReport, runWorkerBacktest } = await import("./workers/runWorkerShadow.js");
-            const opts = workersDir ? { workersDir } : {};
-            process.stdout.write(sub === "backtest"
-                ? runWorkerBacktest(opts)
-                : runWorkerShadowReport(opts));
-        }
-        catch (err) {
-            process.stderr.write(`Error: ${err instanceof Error ? err.message : String(err)}\n`);
-            process.exit(1);
-        }
-    })();
+            catch (err) {
+                process.stderr.write(`Error: ${err instanceof Error ? err.message : String(err)}\n`);
+                process.exit(1);
+            }
+        })();
 }
 // Handle approvals subcommand — considered-approval KPI. Reads the local
 // approval-decision log directly (like `workers shadow`); no bridge round-trip.