prizmkit 1.1.154 → 1.1.156

package/bundled/dev-pipeline/prizmkit_runtime/runtime_commit.py

@@ -0,0 +1,482 @@
+"""Runtime-owned local commit execution for prepared pipeline tasks."""
+
+from __future__ import annotations
+
+import json
+import os
+import re
+import subprocess
+import tempfile
+from dataclasses import dataclass
+from pathlib import Path, PurePosixPath
+from typing import Mapping, Sequence
+
+from .checkpoint_state import (
+    load_checkpoint_state,
+    semantic_state_key,
+    validate_checkpoint_data,
+)
+from .gitops import HIDDEN_TOOL_WORKTREE_EXCLUDES
+
+REQUEST_FILENAME = "runtime-commit-request.json"
+REQUEST_SCHEMA_VERSION = 1
+_HEX_COMMIT = re.compile(r"^[0-9a-fA-F]{40,64}$")
+_FORBIDDEN_EXACT_PATHS = {
+    ".claude/settings.local.json",
+    ".codebuddy/settings.local.json",
+    ".codex/settings.local.json",
+    ".agents/settings.local.json",
+    ".pi/settings.local.json",
+}
+_SENSITIVE_NAMES = {
+    ".env",
+    "id_rsa",
+    "id_dsa",
+    "id_ed25519",
+    "credentials.json",
+    "secrets.json",
+}
+_SENSITIVE_SUFFIXES = {".pem", ".p12", ".pfx"}
+_SUPPORT_ROOT_FILES = {"agents.md", "skills-lock.json"}
+_SUPPORT_ROOT_DIRS = {".claude", ".codebuddy", ".codex", ".agents", ".pi"}
+
+
+@dataclass(frozen=True)
+class RuntimeCommitRequest:
+    """Validated commit preparation emitted by the committer stage."""
+
+    artifact_dir: str
+    base_head: str
+    commit_message: str
+    intended_paths: tuple[str, ...]
+    runtime_commit_hash: str = ""
+
+
+@dataclass(frozen=True)
+class RuntimeCommitResult:
+    """Observable result of one runtime commit finalization attempt."""
+
+    status: str
+    reason: str = ""
+    commit_hash: str = ""
+    recovered: bool = False
+
+    @property
+    def committed(self) -> bool:
+        return self.status == "committed"
+
+
+@dataclass(frozen=True)
+class _GitResult:
+    return_code: int
+    stdout: str
+    stderr: str
+
+
+def finalize_runtime_commit(
+    project_root: Path,
+    *,
+    artifact_dir: Path,
+    checkpoint_path: Path,
+) -> RuntimeCommitResult:
+    """Execute and finalize a valid COMMIT_PENDING runtime handoff.
+
+    A completed checkpoint is accepted only for idempotent cleanup recovery
+    when a request remains after commit finalization passed.
+    """
+    try:
+        root = project_root.resolve()
+        artifact = artifact_dir.resolve()
+        checkpoint = checkpoint_path.resolve()
+    except (OSError, RuntimeError):
+        return RuntimeCommitResult("failed", "unsafe_artifact_identity")
+    if not _within(artifact, root) or not _within(checkpoint, artifact):
+        return RuntimeCommitResult("failed", "unsafe_artifact_identity")
+
+    state = load_checkpoint_state(checkpoint, project_root=root)
+    if not state.valid:
+        return RuntimeCommitResult("failed", f"invalid_checkpoint:{state.error_code}")
+    if not state.semantic_commit_ready and not state.semantic_complete:
+        return RuntimeCommitResult("not_ready", "checkpoint_not_commit_ready")
+
+    request_path = artifact / REQUEST_FILENAME
+    request, error = _load_request(request_path, root, artifact)
+    if request is None:
+        if state.semantic_complete and error == "commit_request_missing":
+            return RuntimeCommitResult("not_ready", "runtime_commit_already_finalized")
+        return RuntimeCommitResult("failed", error or "invalid_commit_request")
+
+    if any(_is_tracked(root, path) for path in (request_path, checkpoint)):
+        return RuntimeCommitResult("failed", "runtime_metadata_must_be_untracked")
+
+    current_head = _git(root, "rev-parse", "HEAD")
+    if current_head.return_code != 0:
+        return RuntimeCommitResult("failed", "git_head_unavailable")
+    head = current_head.stdout.strip()
+    recovered = False
+
+    if head == request.base_head:
+        if request.runtime_commit_hash:
+            return RuntimeCommitResult("failed", "premature_runtime_commit_hash")
+        if state.semantic_complete:
+            return RuntimeCommitResult("failed", "completed_checkpoint_without_commit")
+        changed, status_error = _task_visible_changed_paths(
+            root,
+            artifact_dir=artifact,
+            checkpoint_path=checkpoint,
+            request_path=request_path,
+        )
+        if status_error:
+            return RuntimeCommitResult("failed", status_error)
+        if set(changed) != set(request.intended_paths):
+            return RuntimeCommitResult("failed", "intended_paths_mismatch")
+        staged = _stage_intended_paths(root, request.intended_paths)
+        if staged.return_code != 0:
+            return RuntimeCommitResult("failed", "git_stage_failed")
+        if _git(root, "diff", "--cached", "--quiet", "--exit-code").return_code == 0:
+            return RuntimeCommitResult("failed", "empty_staged_change")
+        committed = _git(
+            root,
+            "-c", "core.hooksPath=/dev/null",
+            "-c", "commit.gpgSign=false",
+            "commit", "-m", request.commit_message,
+        )
+        if committed.return_code != 0:
+            return RuntimeCommitResult("failed", "git_commit_failed")
+        head_result = _git(root, "rev-parse", "HEAD")
+        if head_result.return_code != 0:
+            return RuntimeCommitResult("failed", "commit_identity_unavailable")
+        head = head_result.stdout.strip()
+        if not _matches_prepared_commit(root, request, head):
+            return RuntimeCommitResult("failed", "git_commit_content_mismatch", head)
+        hash_error = _record_runtime_commit_hash(request_path, head)
+        if hash_error:
+            return RuntimeCommitResult("failed", hash_error, head)
+    elif _matches_prepared_commit(root, request, head):
+        if request.runtime_commit_hash and request.runtime_commit_hash.lower() != head.lower():
+            return RuntimeCommitResult("failed", "runtime_commit_hash_mismatch")
+        recovered = True
+        if not request.runtime_commit_hash:
+            hash_error = _record_runtime_commit_hash(request_path, head)
+            if hash_error:
+                return RuntimeCommitResult("failed", hash_error, head, recovered)
+    else:
+        return RuntimeCommitResult("failed", "base_head_mismatch")
+
+    checkpoint_error = _finalize_checkpoint(
+        checkpoint,
+        commit_hash=head,
+        base_head=request.base_head,
+    )
+    if checkpoint_error:
+        return RuntimeCommitResult("failed", checkpoint_error, head, recovered)
+
+    final_state = load_checkpoint_state(checkpoint, project_root=root)
+    if not final_state.semantic_complete:
+        return RuntimeCommitResult("failed", "checkpoint_not_completed_after_commit", head, recovered)
+
+    try:
+        request_path.unlink(missing_ok=True)
+    except OSError:
+        return RuntimeCommitResult("failed", "commit_request_cleanup_failed", head, recovered)
+    return RuntimeCommitResult("committed", "runtime_commit_completed", head, recovered)
+
+
+def _load_request(
+    request_path: Path,
+    project_root: Path,
+    artifact_dir: Path,
+) -> tuple[RuntimeCommitRequest | None, str]:
+    try:
+        raw = json.loads(request_path.read_text(encoding="utf-8"))
+    except FileNotFoundError:
+        return None, "commit_request_missing"
+    except (OSError, UnicodeError, json.JSONDecodeError):
+        return None, "commit_request_invalid_json"
+    if not isinstance(raw, Mapping) or raw.get("schema_version") != REQUEST_SCHEMA_VERSION:
+        return None, "commit_request_invalid_schema"
+    required_keys = {
+        "schema_version", "artifact_dir", "base_head", "commit_message", "intended_paths",
+    }
+    allowed_keys = required_keys | {"runtime_commit_hash"}
+    if not required_keys.issubset(raw) or not set(raw).issubset(allowed_keys):
+        return None, "commit_request_invalid_schema"
+
+    expected_artifact = artifact_dir.relative_to(project_root).as_posix()
+    artifact_text = str(raw.get("artifact_dir") or "").strip().replace("\\", "/")
+    if artifact_text != expected_artifact:
+        return None, "commit_request_artifact_mismatch"
+
+    base_head = str(raw.get("base_head") or "").strip()
+    if not _HEX_COMMIT.fullmatch(base_head):
+        return None, "commit_request_base_head_invalid"
+
+    message = str(raw.get("commit_message") or "").strip()
+    if not message or "\n" in message or len(message) > 240:
+        return None, "commit_request_message_invalid"
+
+    raw_paths = raw.get("intended_paths")
+    if not isinstance(raw_paths, list) or not raw_paths:
+        return None, "commit_request_paths_invalid"
+    intended: list[str] = []
+    for value in raw_paths:
+        relative = _safe_relative_path(value)
+        if relative is None or _forbidden_commit_path(relative, expected_artifact):
+            return None, "commit_request_path_unsafe"
+        intended.append(relative)
+    if len(intended) != len(set(intended)):
+        return None, "commit_request_paths_duplicate"
+
+    runtime_commit_hash = str(raw.get("runtime_commit_hash") or "").strip()
+    if runtime_commit_hash and not _HEX_COMMIT.fullmatch(runtime_commit_hash):
+        return None, "runtime_commit_hash_invalid"
+
+    return RuntimeCommitRequest(
+        artifact_dir=expected_artifact,
+        base_head=base_head.lower(),
+        commit_message=message,
+        intended_paths=tuple(intended),
+        runtime_commit_hash=runtime_commit_hash.lower(),
+    ), ""
+
+
+def _safe_relative_path(value: object) -> str | None:
+    text = str(value or "").strip().replace("\\", "/")
+    if not text or text.startswith("/") or re.match(r"^[A-Za-z]:/", text):
+        return None
+    path = PurePosixPath(text)
+    if path.is_absolute() or any(part in {"", ".", ".."} for part in path.parts):
+        return None
+    return path.as_posix()
+
+
+def _forbidden_commit_path(path: str, artifact_dir: str) -> bool:
+    lower = path.lower()
+    name = PurePosixPath(lower).name
+    if lower in _FORBIDDEN_EXACT_PATHS:
+        return True
+    if lower == ".git" or lower.startswith(".git/"):
+        return True
+    if _known_support_path(lower):
+        return True
+    artifact_prefix = artifact_dir.lower().rstrip("/") + "/"
+    if lower in {
+        artifact_prefix + REQUEST_FILENAME,
+        artifact_prefix + "workflow-checkpoint.json",
+    }:
+        return True
+    if name in _SENSITIVE_NAMES or (name.startswith(".env.") and name != ".env.example"):
+        return True
+    return PurePosixPath(lower).suffix in _SENSITIVE_SUFFIXES
+
+
+def _task_visible_changed_paths(
+    project_root: Path,
+    *,
+    artifact_dir: Path,
+    checkpoint_path: Path,
+    request_path: Path,
+) -> tuple[tuple[str, ...], str]:
+    result = _git(
+        project_root,
+        "status",
+        "--porcelain=v1",
+        "-z",
+        "--untracked-files=all",
+        "--",
+        ".",
+        *HIDDEN_TOOL_WORKTREE_EXCLUDES,
+    )
+    if result.return_code != 0:
+        return (), "git_status_failed"
+    local_paths = {
+        checkpoint_path.relative_to(project_root).as_posix(),
+        request_path.relative_to(project_root).as_posix(),
+    }
+    visible = []
+    for path in _status_record_paths(result.stdout):
+        if path in local_paths:
+            continue
+        if _known_support_path(path.lower()) or path.lower() in _FORBIDDEN_EXACT_PATHS:
+            continue
+        visible.append(path)
+    return tuple(dict.fromkeys(visible)), ""
+
+
+def _known_support_path(lower_path: str) -> bool:
+    path = PurePosixPath(lower_path)
+    parts = path.parts
+    if lower_path in _SUPPORT_ROOT_FILES:
+        return True
+    if parts and parts[0] in _SUPPORT_ROOT_DIRS:
+        return True
+    if lower_path == ".prizmkit-worktree" or lower_path.startswith(
+        ".prizmkit-worktree/"
+    ):
+        return True
+    if (
+        len(parts) >= 2
+        and parts[0].startswith(".")
+        and parts[1] in {"worktree", "worktrees"}
+    ):
+        return True
+    return lower_path == ".prizmkit" or lower_path.startswith(".prizmkit/")
+
+
+def _status_record_paths(stdout: str) -> tuple[str, ...]:
+    records = stdout.split("\0")
+    changed: list[str] = []
+    index = 0
+    while index < len(records):
+        record = records[index]
+        index += 1
+        if not record or len(record) < 4 or record[2] != " ":
+            continue
+        status = record[:2]
+        changed.append(record[3:])
+        if "R" in status or "C" in status:
+            if index < len(records) and records[index]:
+                changed.append(records[index])
+                index += 1
+    return tuple(dict.fromkeys(path for path in changed if path))
+
+
+def _stage_intended_paths(project_root: Path, paths: Sequence[str]) -> _GitResult:
+    pathspecs = tuple(f":(top,literal){path}" for path in paths)
+    return _git(project_root, "add", "-A", "--", *pathspecs)
+
+
+def _matches_prepared_commit(project_root: Path, request: RuntimeCommitRequest, head: str) -> bool:
+    parents = _git(project_root, "show", "-s", "--format=%P", head)
+    subject = _git(project_root, "show", "-s", "--format=%s", head)
+    paths = _git(
+        project_root,
+        "diff-tree", "--no-commit-id", "--name-only", "--no-renames", "-r", "-z", head,
+    )
+    if any(result.return_code != 0 for result in (parents, subject, paths)):
+        return False
+    parent_list = parents.stdout.strip().split()
+    changed = {path for path in paths.stdout.split("\0") if path}
+    return (
+        len(parent_list) == 1
+        and parent_list[0].lower() == request.base_head.lower()
+        and subject.stdout.strip() == request.commit_message
+        and bool(changed)
+        and changed == set(request.intended_paths)
+    )
+
+
+def _record_runtime_commit_hash(path: Path, commit_hash: str) -> str:
+    try:
+        data = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, UnicodeError, json.JSONDecodeError):
+        return "commit_request_hash_record_failed"
+    if not isinstance(data, dict):
+        return "commit_request_hash_record_failed"
+    data["runtime_commit_hash"] = commit_hash
+    error = _write_json_atomic(path, data)
+    return "commit_request_hash_record_failed" if error else ""
+
+
+def _is_tracked(project_root: Path, path: Path) -> bool:
+    try:
+        relative = path.relative_to(project_root).as_posix()
+    except ValueError:
+        return True
+    return _git(project_root, "ls-files", "--error-unmatch", "--", relative).return_code == 0
+
+
+def _finalize_checkpoint(
+    path: Path,
+    *,
+    commit_hash: str,
+    base_head: str,
+) -> str:
+    """Finalize COMMITTED and persist the Runtime's verified commit receipt."""
+    state = load_checkpoint_state(path)
+    if not state.valid:
+        return "checkpoint_commit_finalization_rejected"
+    if state.semantic_complete:
+        return ""
+    if not state.semantic_commit_ready:
+        return "checkpoint_commit_finalization_rejected"
+    data = dict(state.raw_data)
+    raw_steps = data.get("steps")
+    if not isinstance(raw_steps, list):
+        return "checkpoint_commit_finalization_rejected"
+    committers = [
+        step for step in raw_steps
+        if isinstance(step, dict) and step.get("skill") == "prizmkit-committer"
+    ]
+    if len(committers) != 1:
+        return "checkpoint_commit_finalization_rejected"
+    committer = committers[0]
+    committer["status"] = "completed"
+    committer["stage_result"] = "COMMITTED"
+
+    state_key = semantic_state_key(str(data.get("workflow_type") or ""))
+    semantic = data.get(state_key)
+    if not isinstance(semantic, dict):
+        return "checkpoint_commit_finalization_rejected"
+    semantic.update(
+        {
+            "schema_version": 1,
+            "orchestrator": "pipeline-runtime",
+            "stage": "committer",
+            "status": "completed",
+            "stage_result": "COMMITTED",
+            "current_stage": None,
+            "next_stage": None,
+            "resume_from": None,
+            "blocked_reason": None,
+            "terminal_status": "WORKFLOW_COMPLETED",
+            "runtime_base_head": base_head,
+            "runtime_commit_hash": commit_hash,
+        }
+    )
+    candidate = validate_checkpoint_data(data, path=path, exists=True)
+    if not candidate.valid or not candidate.semantic_complete:
+        return "checkpoint_commit_finalization_rejected"
+    if _write_json_atomic(path, data):
+        return "checkpoint_commit_finalization_failed"
+    finalized = load_checkpoint_state(path)
+    return "" if finalized.semantic_complete else "checkpoint_commit_finalization_rejected"
+
+
+def _write_json_atomic(path: Path, data: Mapping[str, object]) -> str:
+    temp_path: str | None = None
+    try:
+        path.parent.mkdir(parents=True, exist_ok=True)
+        fd, temp_path = tempfile.mkstemp(prefix=f".{path.name}.", suffix=".tmp", dir=path.parent)
+        with os.fdopen(fd, "w", encoding="utf-8") as handle:
+            json.dump(data, handle, indent=2, ensure_ascii=False)
+            handle.write("\n")
+        os.replace(temp_path, path)
+    except OSError:
+        if temp_path:
+            try:
+                os.unlink(temp_path)
+            except OSError:
+                pass
+        return "atomic_json_write_failed"
+    return ""
+
+
+def _git(project_root: Path, *args: str) -> _GitResult:
+    completed = subprocess.run(
+        ["git", *args],
+        cwd=project_root,
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        text=True,
+        check=False,
+    )
+    return _GitResult(completed.returncode, completed.stdout, completed.stderr)
+
+
+def _within(path: Path, root: Path) -> bool:
+    try:
+        path.resolve().relative_to(root.resolve())
+    except ValueError:
+        return False
+    return True

package/bundled/dev-pipeline/prizmkit_runtime/test_result.py

@@ -23,8 +23,6 @@ _RESULT_KEYS = {
     "independent_review",
     "repair_rounds",
     "production_changed",
-    "review_required",
-    "review_scope",
     "unresolved_items",
 }
 _INDEPENDENT_REVIEW_KEYS = {
@@ -33,14 +31,40 @@ _INDEPENDENT_REVIEW_KEYS = {
     "downgrade_reason",
     "final_state_rechecked",
 }
+_LEGACY_RESULT_KEYS = _RESULT_KEYS | {"review_required", "review_scope"}
 
 
 def load_test_result(path: str | Path) -> dict[str, Any] | None:
-    """Load one valid terminal projection, or return None."""
+    """Load one strict route-free terminal projection, or return None."""
     try:
         value = json.loads(Path(path).read_text(encoding="utf-8"))
     except (OSError, ValueError, TypeError):
         return None
+    return _validate_test_result_value(value)
+
+
+def load_legacy_test_result(path: str | Path) -> dict[str, Any] | None:
+    """Read a historical pass projection without permitting new legacy output."""
+    try:
+        value = json.loads(Path(path).read_text(encoding="utf-8"))
+    except (OSError, ValueError, TypeError):
+        return None
+    if not isinstance(value, dict):
+        return None
+    if set(value) == _RESULT_KEYS:
+        return _validate_test_result_value(value)
+    if set(value) != _LEGACY_RESULT_KEYS:
+        return None
+    if value.get("review_required") is not False or value.get("review_scope") is not None:
+        return None
+    normalized = {
+        key: item for key, item in value.items()
+        if key not in {"review_required", "review_scope"}
+    }
+    return _validate_test_result_value(normalized)
+
+
+def _validate_test_result_value(value: object) -> dict[str, Any] | None:
     if not isinstance(value, dict):
         return None
     if set(value) != _RESULT_KEYS or value.get("schema_version") != 1:
@@ -79,11 +103,6 @@ def load_test_result(path: str | Path) -> dict[str, Any] | None:
 
     if not isinstance(value.get("production_changed"), bool):
         return None
-    if not isinstance(value.get("review_required"), bool):
-        return None
-    expected_scope = "delta" if value["review_required"] else None
-    if value.get("review_scope") != expected_scope:
-        return None
     unresolved = value.get("unresolved_items")
     if not isinstance(unresolved, list) or any(
         not isinstance(item, str) or not item.strip() for item in unresolved
@@ -91,8 +110,10 @@ def load_test_result(path: str | Path) -> dict[str, Any] | None:
         return None
 
     if value["result"] == "TEST_PASS":
-        if value["review_required"] or unresolved or rounds < 1:
+        if unresolved or rounds < 1:
             return None
+    elif not unresolved:
+        return None
     return value
 
 
@@ -110,14 +131,46 @@ def valid_test_artifact_pair(
     *,
     required_result: str | None = None,
 ) -> bool:
-    """Validate one sibling report/result pair and their terminal result."""
+    """Validate one strict sibling report/result pair and terminal result."""
+    return _valid_test_artifact_pair(
+        report_path,
+        result_path,
+        required_result=required_result,
+        legacy=False,
+    )
+
+
+def valid_legacy_test_artifact_pair(
+    report_path: str | Path,
+    result_path: str | Path,
+    *,
+    required_result: str | None = None,
+) -> bool:
+    """Validate a historical completed pair for read-only recovery."""
+    return _valid_test_artifact_pair(
+        report_path,
+        result_path,
+        required_result=required_result,
+        legacy=True,
+    )
+
+
+def _valid_test_artifact_pair(
+    report_path: str | Path,
+    result_path: str | Path,
+    *,
+    required_result: str | None,
+    legacy: bool,
+) -> bool:
     report = Path(report_path)
     result = Path(result_path)
     if not report.is_file() or not result.is_file():
         return False
     if report.resolve().parent != result.resolve().parent:
         return False
-    projection = load_test_result(result)
+    projection = (
+        load_legacy_test_result(result) if legacy else load_test_result(result)
+    )
     if projection is None:
         return False
     if required_result is not None and projection.get("result") != required_result: