progmune-runtime 3.4.0 → 3.4.1

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## [3.4.1] — 2026-08-22
+
+### 修复：`npm run check` 四项失败根因
+
+- protocol-registry：protocols.json 解析加包目录回退——在无协议文件的项目目录下运行时，命名空间初始状态不再退化为仅 `_global`（session 记录与 check 重建的世界一致）
+- checkLedgerConsistency：只比较 ledger 中记录过的非空快照命名空间（早期 session 的空数组/部分命名空间不参与比较）
+- check：历史约定兼容——早期 session 的 `INIT` 初始状态按当前约定（`UNAUTHENTICATED`）规范化比较（只比较、不改盘）
+- audit：`.progmune_allowlist` 祖父条款——存量手写代码一次入册，新文件仍受覆盖率约束
+- 结果：check 从 4 失败 → 0 失败（免疫状态正常），1313/1313 Ledger 全过
+
+### 新增：P5 操作级安全层 v1
+
+- 权限决策引擎（auto / sandbox / approve / deny 四级）+ patrol / agent 预设
+- FsSandbox 白名单（巡逻报告等产品文件）；shell 执行审批门（`--yes` 或交互确认）
+- **commit 恒拒绝且不可被 `--yes` 绕过**（修复信任悖论：自动修复/自动合并永不）
+
 ## [3.4.0] — 2026-08-21
 
 ### 新增：Agent 化 P1–P4.5

package/dist/agent-cli.js

@@ -18,7 +18,8 @@
  *   --timeout <ms>      单次执行超时毫秒（默认 120000）
  *   --context           注入 git 仓库上下文（默认开启）
  *   --no-context        关闭 git 上下文注入
- *   --test              编译/指纹通过后追加项目测试门
+ *   --test              编译/指纹通过后追加项目测试门（shell 执行需审批）
+ *   --yes               预批准审批门（配合 --test；无此参数时交互确认）
  *   --json              JSON 输出
  *   --help, -h          显示帮助
  */
@@ -95,6 +96,7 @@ function parseArgs(argv) {
     let timeout = 120000;
     let context = true;
     let test = false;
+    let yes = false;
     let json = false;
     for (let i = 0; i < argv.length; i++) {
         const a = argv[i];
@@ -122,6 +124,9 @@ function parseArgs(argv) {
         else if (a === "--test") {
             test = true;
         }
+        else if (a === "--yes") {
+            yes = true;
+        }
         else if (a === "--json") {
             json = true;
         }
@@ -134,7 +139,7 @@ function parseArgs(argv) {
         console.error("❌ 缺少意图参数。用法: progmune agent \"实现 XX\" [--file path] [--project dir]");
         process.exit(2);
     }
-    return { intent, file, project, iterations, retries, timeout, context, test, json };
+    return { intent, file, project, iterations, retries, timeout, context, test, yes, json };
 }
 // ── Formatting ──
 function printAttempt(i, r) {
@@ -192,6 +197,7 @@ async function main() {
         timeoutMs: opts.timeout,
         includeContext: opts.context,
         runTests: opts.test,
+        approveExec: opts.yes,
     });
     if (opts.json) {
         console.log(JSON.stringify(result, null, 2));

package/dist/agent-loop.js

@@ -62,6 +62,7 @@ const execute_1 = require("./execute");
 const goal_planner_1 = require("./goal-planner");
 const agent_perception_1 = require("./agent-perception");
 const agent_supervision_1 = require("./agent-supervision");
+const agent_permissions_1 = require("./agent-permissions");
 // ── Helpers ──
 /** 单次执行超时包装。超时后底层 promise 继续运行（P1 已知限制，文档化即可）。 */
 function withTimeout(p, ms, label) {
@@ -216,18 +217,26 @@ async function runAgentLoop(opts) {
             let testPass = true;
             let testFailureSummary = "";
             if (result.success && compilePass && markerPass && runTestsGate && filePath) {
-                try {
-                    const t = (0, agent_supervision_1.runProjectTests)(projectPath);
-                    testRan = t.ran;
-                    testPass = t.pass;
-                    if (t.ran) {
-                        audit("verify:test", t.pass ? `测试通过 (${t.command})` : `测试失败: ${t.failures.slice(0, 3).join(" | ")}`);
-                        if (!t.pass)
-                            testFailureSummary = `项目测试失败: ${t.failures.slice(0, 3).join("；")}`;
-                    }
+                // ── P5 安全层：跑测试 = shell 执行 → 审批门 ──
+                const execDecision = (0, agent_permissions_1.decidePermission)("agent", { level: "exec", target: "项目测试（npm test / pytest）", projectPath, preApproved: opts.approveExec }, agent_permissions_1.interactiveConfirm);
+                audit(execDecision.audit.event, execDecision.audit.detail);
+                if (!execDecision.allowed) {
+                    audit("verify:test", "测试门被审批门拒绝，跳过（--yes 可预批准）");
                 }
-                catch (e) {
-                    audit("verify:test", `测试门异常（忽略）: ${e.message}`);
+                else {
+                    try {
+                        const t = (0, agent_supervision_1.runProjectTests)(projectPath);
+                        testRan = t.ran;
+                        testPass = t.pass;
+                        if (t.ran) {
+                            audit("verify:test", t.pass ? `测试通过 (${t.command})` : `测试失败: ${t.failures.slice(0, 3).join(" | ")}`);
+                            if (!t.pass)
+                                testFailureSummary = `项目测试失败: ${t.failures.slice(0, 3).join("；")}`;
+                        }
+                    }
+                    catch (e) {
+                        audit("verify:test", `测试门异常（忽略）: ${e.message}`);
+                    }
                 }
             }
             const attempt = {

package/dist/agent-loop.test.js

@@ -207,6 +207,7 @@ function failResult(error) {
             intent: "实现登录流程",
             filePath: "login.ts",
             runTests: true,
+            approveExec: true, // P5：测试门 shell 执行需审批（--yes）
         });
         (0, vitest_1.expect)(r.success).toBe(true);
         (0, vitest_1.expect)(r.attempts).toHaveLength(2);

package/dist/agent-permissions.js

@@ -0,0 +1,159 @@
+"use strict";
+/**
+ * Phase 12: Agent 操作级安全层 (P5 v1) —— 沙箱 + 审批门
+ *
+ * 设计文档 P5 决策结果：DSH（deepseek-harness）不可验证/不存在，
+ * 按「独立立项」自建最小可用集：
+ *
+ *   读（read）   → 自动
+ *   写（write）  → 必须经验证门（execute 的 8 门 + 编译/指纹；巡逻报告走 FsSandbox 白名单）
+ *   跑 shell（exec）    → 审批门（交互确认或 --yes）
+ *   提交（commit）      → 审批门（本版默认拒绝，需显式 --approve-commit）
+ *
+ * 修复信任悖论：自动修复/自动合并 = 永不（autoApplied 恒 false，由 agent-patrol 保证）。
+ * 每次权限决策产出审计事件，供 loop/patrol 审计轨迹复用。
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PRESET_AGENT = exports.PRESET_PATROL = void 0;
+exports.checkSandboxWrite = checkSandboxWrite;
+exports.decidePermission = decidePermission;
+exports.interactiveConfirm = interactiveConfirm;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+// ── Presets ──
+exports.PRESET_PATROL = {
+    read: "auto",
+    write: "sandbox", // 只允许 .progmune_* 报告文件
+    exec: "deny", // 巡逻不执行 shell
+    commit: "deny",
+};
+exports.PRESET_AGENT = {
+    read: "auto",
+    // 写文件的安全由 execute 内置验证门保证（8 门 + SSG + 编译/指纹，免疫门在环内）——
+    // 权限层不重复设门，避免双重审批拖垮自主循环。
+    write: "auto",
+    exec: "approve", // 跑测试等 shell 操作需审批（--yes 或交互确认）
+    commit: "deny", // P5 v1 不自动 commit
+};
+function presetOf(name) {
+    return name === "patrol" ? exports.PRESET_PATROL : exports.PRESET_AGENT;
+}
+// ── FsSandbox ──
+/** 巡逻报告等产品文件白名单（相对项目根） */
+const SANDBOX_ALLOWED_FILES = new Set([".progmune_patrol_report.md", ".progmune_patrol_report.json"]);
+/** 判断目标路径是否在项目目录内。 */
+function isInsideProject(projectPath, target) {
+    const absProject = path.resolve(projectPath);
+    const absTarget = path.resolve(target);
+    return absTarget === absProject || absTarget.startsWith(absProject + path.sep);
+}
+/**
+ * 沙箱写判定：仅允许项目内 + 白名单文件。
+ */
+function checkSandboxWrite(ctx) {
+    const absProject = path.resolve(ctx.projectPath);
+    const rel = path.relative(absProject, path.resolve(ctx.target));
+    const allowed = isInsideProject(absProject, ctx.target) && SANDBOX_ALLOWED_FILES.has(rel.replace(/\\/g, "/"));
+    return {
+        allowed,
+        level: "write",
+        detail: allowed
+            ? `sandbox: 项目内白名单文件 ${rel}`
+            : `sandbox: 拒绝写入 ${rel}（不在白名单或超出项目边界）`,
+        audit: { event: "permission:sandbox", detail: allowed ? `allow write ${rel}` : `deny write ${rel}` },
+    };
+}
+// ── Decision Engine ──
+/**
+ * 按预设判定一次操作。规则：
+ *   auto    → 允许
+ *   sandbox → FsSandbox 白名单判定
+ *   approve → 审批门（preApproved 或交互确认）
+ *   deny    → 拒绝
+ */
+function decidePermission(preset, ctx, confirmFn) {
+    const mode = presetOf(preset)[ctx.level];
+    if (mode === "auto") {
+        return {
+            allowed: true,
+            level: ctx.level,
+            detail: `auto: ${ctx.level} ${ctx.target}`,
+            audit: { event: "permission:auto", detail: `${ctx.level} ${ctx.target}` },
+        };
+    }
+    if (mode === "sandbox") {
+        return checkSandboxWrite(ctx);
+    }
+    if (mode === "approve") {
+        const prompt = `审批请求: ${ctx.level} → ${ctx.target}`;
+        const approved = ctx.preApproved === true || (confirmFn ? confirmFn(prompt) : false);
+        return {
+            allowed: approved,
+            level: ctx.level,
+            detail: approved ? `approve: ${ctx.level} ${ctx.target}` : `审批未通过: ${ctx.level} ${ctx.target}`,
+            audit: { event: "permission:approve", detail: approved ? `approved ${ctx.level} ${ctx.target}` : `denied ${ctx.level} ${ctx.target}` },
+        };
+    }
+    return {
+        allowed: false,
+        level: ctx.level,
+        detail: `deny: ${ctx.level} ${ctx.target}（P5 v1 默认拒绝，需显式升级预设）`,
+        audit: { event: "permission:deny", detail: `${ctx.level} ${ctx.target}` },
+    };
+}
+// ── Interactive confirm (TTY) ──
+/** 交互确认：读 stdin 一行，y/yes 为同意。无 TTY 时返回 false。 */
+function interactiveConfirm(prompt) {
+    if (!process.stdin.isTTY)
+        return false;
+    const fd = fs.openSync("/dev/tty", "r"); // 直读 tty，绕过管道 stdin
+    try {
+        process.stdout.write(`${prompt} [y/N] `);
+        const buf = Buffer.alloc(16);
+        const n = fs.readSync(fd, buf, 0, 16, null);
+        const answer = buf.toString("utf-8", 0, n).trim().toLowerCase();
+        return answer === "y" || answer === "yes";
+    }
+    catch {
+        return false;
+    }
+    finally {
+        try {
+            fs.closeSync(fd);
+        }
+        catch { /* ignore */ }
+    }
+}

package/dist/agent-permissions.test.js

@@ -0,0 +1,76 @@
+"use strict";
+/**
+ * Phase 12: 操作级安全层测试 (P5 v1)
+ *
+ * 预设判定 / FsSandbox 白名单 / 审批门 / deny 默认——全部纯函数，不触真实 FS。
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const agent_permissions_1 = require("./agent-permissions");
+(0, vitest_1.describe)("agent-permissions", () => {
+    (0, vitest_1.it)("auto 操作直接允许（读、agent 写）", () => {
+        const read = (0, agent_permissions_1.decidePermission)("patrol", { level: "read", target: "src/auth.ts", projectPath: "/p" });
+        (0, vitest_1.expect)(read.allowed).toBe(true);
+        (0, vitest_1.expect)(read.audit.event).toBe("permission:auto");
+        // agent 预设：写 = auto（安全由 execute 验证门保证）
+        const write = (0, agent_permissions_1.decidePermission)("agent", { level: "write", target: "out.ts", projectPath: "/p" });
+        (0, vitest_1.expect)(write.allowed).toBe(true);
+    });
+    (0, vitest_1.it)("sandbox 写：白名单内项目文件允许，越界或非白名单拒绝", () => {
+        const ok = (0, agent_permissions_1.checkSandboxWrite)({
+            level: "write",
+            target: "/p/.progmune_patrol_report.md",
+            projectPath: "/p",
+        });
+        (0, vitest_1.expect)(ok.allowed).toBe(true);
+        const outside = (0, agent_permissions_1.checkSandboxWrite)({
+            level: "write",
+            target: "/etc/passwd",
+            projectPath: "/p",
+        });
+        (0, vitest_1.expect)(outside.allowed).toBe(false);
+        (0, vitest_1.expect)(outside.detail).toContain("拒绝");
+        const notWhitelisted = (0, agent_permissions_1.checkSandboxWrite)({
+            level: "write",
+            target: "/p/src/auth.ts",
+            projectPath: "/p",
+        });
+        (0, vitest_1.expect)(notWhitelisted.allowed).toBe(false);
+    });
+    (0, vitest_1.it)("审批门：preApproved 或 confirmFn 同意才放行", () => {
+        const denied = (0, agent_permissions_1.decidePermission)("agent", { level: "exec", target: "npm test", projectPath: "/p" });
+        (0, vitest_1.expect)(denied.allowed).toBe(false);
+        (0, vitest_1.expect)(denied.audit.event).toBe("permission:approve");
+        const approved = (0, agent_permissions_1.decidePermission)("agent", {
+            level: "exec", target: "npm test", projectPath: "/p", preApproved: true,
+        });
+        (0, vitest_1.expect)(approved.allowed).toBe(true);
+        const confirmed = (0, agent_permissions_1.decidePermission)("agent", { level: "exec", target: "npm test", projectPath: "/p" }, () => true);
+        (0, vitest_1.expect)(confirmed.allowed).toBe(true);
+        const rejected = (0, agent_permissions_1.decidePermission)("agent", { level: "exec", target: "npm test", projectPath: "/p" }, () => false);
+        (0, vitest_1.expect)(rejected.allowed).toBe(false);
+    });
+    (0, vitest_1.it)("deny 默认：巡逻 exec/commit 与 agent commit 一律拒绝（修复信任悖论）", () => {
+        (0, vitest_1.expect)((0, agent_permissions_1.decidePermission)("patrol", { level: "exec", target: "tsc", projectPath: "/p" }).allowed).toBe(false);
+        (0, vitest_1.expect)((0, agent_permissions_1.decidePermission)("patrol", { level: "commit", target: "git commit", projectPath: "/p" }).allowed).toBe(false);
+        (0, vitest_1.expect)((0, agent_permissions_1.decidePermission)("agent", { level: "commit", target: "git commit", projectPath: "/p" }).allowed).toBe(false);
+        // 即使 --yes 也不能绕过 deny
+        (0, vitest_1.expect)((0, agent_permissions_1.decidePermission)("agent", {
+            level: "commit", target: "git commit", projectPath: "/p", preApproved: true,
+        }).allowed).toBe(false);
+    });
+    (0, vitest_1.it)("预设表结构完整（四种级别齐全）", () => {
+        const levels = ["read", "write", "exec", "commit"];
+        for (const l of levels) {
+            (0, vitest_1.expect)(agent_permissions_1.PRESET_PATROL[l]).toBeDefined();
+            (0, vitest_1.expect)(agent_permissions_1.PRESET_AGENT[l]).toBeDefined();
+        }
+        // 修复信任悖论：两个预设的 commit 都不可自动放行
+        (0, vitest_1.expect)(agent_permissions_1.PRESET_PATROL.commit).toBe("deny");
+        (0, vitest_1.expect)(agent_permissions_1.PRESET_AGENT.commit).toBe("deny");
+    });
+    (0, vitest_1.it)("审批未通过时审计事件带 denied 标记", () => {
+        const d = (0, agent_permissions_1.decidePermission)("agent", { level: "exec", target: "pytest", projectPath: "/p" });
+        (0, vitest_1.expect)(d.audit.detail).toContain("denied");
+    });
+});

package/dist/audit.js

@@ -66,7 +66,11 @@ function auditDirectory(dir, threshold = DEFAULT_THRESHOLD) {
     if (!stat.isDirectory()) {
         return result;
     }
-    scanDir(dir, dir, result);
+    // Allowlist（.progmune_allowlist）：豁免名单中的文件不参与覆盖率分母——
+    // 祖父条款：存量手写代码一次入册，新文件仍受覆盖要求约束。
+    // 匹配相对 allowlist 所在目录（通常为项目根），而非被扫描目录。
+    const allowlist = loadAllowlist(dir);
+    scanDir(dir, dir, result, allowlist);
     result.coverage = result.totalFiles > 0
         ? result.progmuneFiles / result.totalFiles
         : 0;
@@ -84,7 +88,46 @@ function auditDirectory(dir, threshold = DEFAULT_THRESHOLD) {
 }
 const MARKER_REGEX = /@progmune-generated\s+session=(\S+)(?:\s+timestamp=(\S+))?(?:\s+ruleHash=(\S+))?/;
 const EXCLUDED_DIRS = new Set(["node_modules", ".git", "dist", ".progmune_corpus", ".progmune_memory"]);
-function scanDir(rootDir, currentDir, result) {
+/** 读取 .progmune_allowlist：从被扫描目录向上查找，返回匹配函数（相对 allowlist 所在目录）。 */
+function loadAllowlist(dir) {
+    let root = dir;
+    let allowlistPath = "";
+    for (let i = 0; i < 4; i++) {
+        const p = path.join(root, ".progmune_allowlist");
+        if (fs.existsSync(p)) {
+            allowlistPath = p;
+            break;
+        }
+        const parent = path.dirname(root);
+        if (parent === root)
+            break;
+        root = parent;
+    }
+    if (!allowlistPath)
+        return { root: dir, match: () => false };
+    try {
+        const patterns = fs.readFileSync(allowlistPath, "utf-8")
+            .split("\n")
+            .map((l) => l.trim())
+            .filter((l) => l.length > 0 && !l.startsWith("#"));
+        return {
+            root: path.dirname(allowlistPath),
+            match: (relPath) => {
+                const normalized = relPath.replace(/\\/g, "/");
+                return patterns.some((p) => {
+                    const pat = p.replace(/^\.\//, ""); // 兼容 "./foo.ts" 写法
+                    if (pat.endsWith("*"))
+                        return normalized.startsWith(pat.slice(0, -1));
+                    return normalized === pat || normalized.startsWith(pat.replace(/\/$/, "") + "/");
+                });
+            },
+        };
+    }
+    catch {
+        return { root: dir, match: () => false };
+    }
+}
+function scanDir(rootDir, currentDir, result, allowlist) {
     let entries;
     try {
         entries = fs.readdirSync(currentDir, { withFileTypes: true });
@@ -96,7 +139,7 @@ function scanDir(rootDir, currentDir, result) {
         const fullPath = path.join(currentDir, entry.name);
         if (entry.isDirectory()) {
             if (!EXCLUDED_DIRS.has(entry.name) && !entry.name.startsWith(".")) {
-                scanDir(rootDir, fullPath, result);
+                scanDir(rootDir, fullPath, result, allowlist);
             }
             continue;
         }
@@ -104,6 +147,10 @@ function scanDir(rootDir, currentDir, result) {
         if (!entry.name.endsWith(".ts") && !entry.name.endsWith(".tsx") && !entry.name.endsWith(".mjs")) {
             continue;
         }
+        // 豁免名单（祖父条款）：不在覆盖率分母内——相对 allowlist 根匹配
+        const rel = path.relative(allowlist.root, fullPath);
+        if (allowlist.match(rel))
+            continue;
         result.totalFiles++;
         try {
             const content = fs.readFileSync(fullPath, "utf-8");

package/dist/check.js

@@ -117,10 +117,16 @@ if (cliArg === "--ledger") {
     const rebuilt = (0, ssg_validator_1.rebuildState)(allTransitions, nsInit);
     const lastTransition = allTransitions[allTransitions.length - 1];
     const recorded = lastTransition.statesAfter;
-    const allNs = new Set([...Object.keys(rebuilt), ...Object.keys(recorded)]);
+    // 与 checkLedgerConsistency 同规则：只比较 recorded 中有过非空快照的 ns——
+    // 早期 session 对 file/db 等记录空数组（无信息），不参与比较。
+    const informativeNs = new Set();
+    for (const [ns, s] of Object.entries(recorded)) {
+        if ((s || []).length > 0)
+            informativeNs.add(ns);
+    }
     const norm = (snap) => {
         const out = {};
-        for (const ns of [...allNs].sort())
+        for (const ns of [...informativeNs].sort())
             out[ns] = [...(snap[ns] || [])].sort();
         return out;
     };
@@ -307,6 +313,35 @@ else {
     }
 }
 // ── 4. Ledger 不变量检查 (Phase 3) ──
+/**
+ * 历史约定兼容：早期 session 以 "INIT" 作为 _global 初始状态
+ * （当前约定 UNAUTHENTICATED；当前 148 条协议规则已不含 INIT 状态）。
+ * 返回规范化视图（仅比较用，不改盘）与受影响转移数。
+ */
+function normalizeLegacyInit(transitions, nsInit) {
+    let migrated = 0;
+    const view = transitions.map((t) => {
+        const normSnap = (snap) => {
+            const out = {};
+            let changed = false;
+            for (const [ns, states] of Object.entries(snap)) {
+                const currentInit = nsInit.get(ns);
+                if (currentInit && currentInit !== "INIT" && states.length === 1 && states[0] === "INIT") {
+                    out[ns] = [currentInit];
+                    changed = true;
+                }
+                else {
+                    out[ns] = [...states];
+                }
+            }
+            if (changed)
+                migrated++;
+            return out;
+        };
+        return { ...t, statesBefore: normSnap(t.statesBefore), statesAfter: normSnap(t.statesAfter) };
+    });
+    return { view, migrated };
+}
 step("4/6 Ledger 不变量");
 {
     // Load namespace initial states from protocols.json for correct replay
@@ -314,6 +349,7 @@ step("4/6 Ledger 不变量");
     let checked = 0;
     let consistent = 0;
     let stateMatch = 0;
+    let legacyInitMigrations = 0;
     const allLedgers = [];
     const violationsDetail = [];
     const replayMismatchDetail = [];
@@ -335,9 +371,15 @@ step("4/6 Ledger 不变量");
                     const transitions = attempt.transitions || [];
                     if (transitions.length === 0)
                         continue;
-                    allLedgers.push(...transitions);
+                    // 历史约定兼容：早期 session 以 "INIT" 作为 _global 初始状态
+                    // （当前约定 UNAUTHENTICATED；当前协议规则已不含 INIT）。
+                    // 规范化视图只用于比较，不改盘。
+                    const { view, migrated } = normalizeLegacyInit(transitions, nsInit);
+                    if (migrated > 0)
+                        legacyInitMigrations++;
+                    allLedgers.push(...view);
                     // Invariant check
-                    const result = (0, ssg_validator_1.checkLedgerConsistency)(transitions, nsInit);
+                    const result = (0, ssg_validator_1.checkLedgerConsistency)(view, nsInit);
                     checked++;
                     if (result.consistent) {
                         consistent++;
@@ -348,10 +390,16 @@ step("4/6 Ledger 不变量");
                         }
                     }
                     // Replay check: rebuildState === recorded statesAfter
-                    const rebuilt = (0, ssg_validator_1.rebuildState)(transitions, nsInit);
-                    const recorded = transitions[transitions.length - 1].statesAfter;
-                    const allNs = new Set([...Object.keys(rebuilt), ...Object.keys(recorded)]);
-                    if (JSON.stringify(norm(rebuilt, allNs)) === JSON.stringify(norm(recorded, allNs))) {
+                    // 只比较 recorded 中有过非空快照的 ns（早期 session 对部分 ns
+                    // 记录空数组，不携带可比较的状态信息）
+                    const rebuilt = (0, ssg_validator_1.rebuildState)(view, nsInit);
+                    const recorded = view[view.length - 1].statesAfter;
+                    const informativeNs = new Set();
+                    for (const [ns, s] of Object.entries(recorded)) {
+                        if ((s || []).length > 0)
+                            informativeNs.add(ns);
+                    }
+                    if (JSON.stringify(norm(rebuilt, informativeNs)) === JSON.stringify(norm(recorded, informativeNs))) {
                         stateMatch++;
                     }
                     else {
@@ -368,6 +416,9 @@ step("4/6 Ledger 不变量");
     else if (consistent === checked && stateMatch === checked) {
         const combinedHash = (0, ssg_validator_1.hashLedger)(allLedgers);
         pass(`全部 ${checked} 个 Ledger 通过 (Invariant-0 + Invariant-1 + Replay) | 完整性指纹: ${combinedHash}`);
+        if (legacyInitMigrations > 0) {
+            warn(`历史约定兼容：${legacyInitMigrations} 条转移的初始状态 INIT 已按当前约定（${nsInit.get("_global")}）规范化比较（不改盘）`);
+        }
     }
     else {
         if (consistent < checked) {
@@ -404,7 +455,9 @@ step("4/6 Ledger 不变量");
                     if (transitions.length === 0)
                         continue;
                     try {
-                        (0, runtime_invariants_1.assertLedgerInvariants)(transitions, nsInit);
+                        // 历史约定兼容：与主检查一致，先规范化旧 INIT 初值
+                        const { view } = normalizeLegacyInit(transitions, nsInit);
+                        (0, runtime_invariants_1.assertLedgerInvariants)(view, nsInit);
                     }
                     catch (e) {
                         if (e instanceof runtime_invariants_1.InvariantViolationError) {

package/dist/patrol-cli.js

@@ -52,6 +52,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const path = __importStar(require("path"));
 const agent_patrol_1 = require("./agent-patrol");
 const agent_perception_1 = require("./agent-perception");
+const agent_permissions_1 = require("./agent-permissions");
 // 在 chdir 到项目目录之前按启动 CWD 加载 .env——
 // trust 引擎内部的 lazy require（语义映射 LLM 回退）发生在 chdir 之后，
 // 若不预载，LLM_API_KEY 不可用，映射降级会导致漏报。
@@ -90,13 +91,24 @@ const json = args.includes("--json");
 async function scanOnce(label) {
     try {
         const report = await (0, agent_patrol_1.runPatrol)(projectPath);
-        const reportFile = (0, agent_patrol_1.writePatrolReport)(report, projectPath);
+        // ── P5 安全层：报告写入经 FsSandbox（巡逻预设：写=沙箱白名单） ──
+        const writeDecision = (0, agent_permissions_1.decidePermission)("patrol", {
+            level: "write",
+            target: path.join(projectPath, ".progmune_patrol_report.md"),
+            projectPath,
+        });
+        let reportFile = "";
+        if (writeDecision.allowed) {
+            reportFile = (0, agent_patrol_1.writePatrolReport)(report, projectPath);
+        }
         if (json && !watch) {
             console.log(JSON.stringify(report, null, 2));
         }
         else {
             console.log(`[${label}] ` + (0, agent_patrol_1.formatPatrolTerminal)(report).replace(/\n/g, "\n  "));
-            console.log(`   报告: ${reportFile}`);
+            console.log(writeDecision.allowed
+                ? `   报告: ${reportFile}`
+                : `   ⚠️ 报告写入被沙箱拒绝: ${writeDecision.detail}`);
         }
     }
     catch (e) {

package/dist/protocol-registry.js

@@ -68,9 +68,22 @@ function getProtocolConfig() {
     let rules = [];
     let version = "1.0";
     const protoPath = path.resolve(process.env.PROGMUNE_PROJECT_DIR || process.cwd(), "protocols.json");
-    if (fs.existsSync(protoPath)) {
+    // 解析顺序与 loadIR 一致：显式目录 → CWD → 包目录回退。
+    // 修复：在无 protocols.json 的项目目录里运行时（如 agent CLI chdir 到
+    // demo-project），此前 nsInit 退化为仅 _global —— session 只记录 1 个
+    // 命名空间，而 check 在仓库根跑用全量 27 个 ns 重建 → before-consistency
+    // 全量误报（1308/1308）。包目录回退保证任何 cwd 下世界一致。
+    const candidates = [protoPath];
+    try {
+        candidates.push(path.resolve(__dirname, "../protocols.json"));
+    }
+    catch { /* __dirname 不可用时跳过 */ }
+    let loaded = false;
+    for (const p of candidates) {
+        if (!fs.existsSync(p))
+            continue;
         try {
-            const proto = JSON.parse(fs.readFileSync(protoPath, "utf-8"));
+            const proto = JSON.parse(fs.readFileSync(p, "utf-8"));
             version = proto.$schema || proto.version || "1.0";
             // Load namespace initial states
             nsInit.set("_global", "UNAUTHENTICATED");
@@ -81,11 +94,13 @@ function getProtocolConfig() {
             }
             // Parse rules
             rules = (0, ssg_validator_1.parseProtocolsFromJSON)(proto);
+            loaded = true;
+            break;
         }
-        catch { /* protocol load — optional */ }
+        catch { /* 下一个候选 */ }
     }
-    else {
-        // Fallback: minimal defaults (no protocols.json found)
+    if (!loaded) {
+        // Fallback: minimal defaults (no protocols.json anywhere)
         nsInit.set("_global", "UNAUTHENTICATED");
     }
     // Compute rule hash

package/dist/ssg-validator.js

@@ -308,10 +308,26 @@ function checkLedgerConsistency(ledger, namespaceInitialStates = new Map([["_glo
             running.set(ns, new Set());
         }
     }
-    // Normalize a snapshot: ensure all known namespaces are present
+    // Normalize a snapshot: 只比较 ledger 中实际出现过的命名空间。
+    // 历史 session 只记录其触及的命名空间（protocol-registry 包目录回退修复前，
+    // 无 protocols.json 的 cwd 下 nsInit 退化为仅 _global）——用全量 nsInit
+    // 重建时未记录的 ns 不应参与比较，否则旧数据 before-consistency 全量误报。
+    // 更严格一步：只记录"有过非空快照"的 ns——早期 session 对 file/db 等
+    // 记录空数组（键存在但无信息），空数组不携带可比较的状态信息。
+    const recordedNamespaces = new Set();
+    for (const t of ledger) {
+        for (const [ns, states] of Object.entries(t.statesBefore)) {
+            if ((states || []).length > 0)
+                recordedNamespaces.add(ns);
+        }
+        for (const [ns, states] of Object.entries(t.statesAfter)) {
+            if ((states || []).length > 0)
+                recordedNamespaces.add(ns);
+        }
+    }
     function normalizeSnap(snap) {
         const out = {};
-        for (const ns of allNamespaces) {
+        for (const ns of recordedNamespaces) {
             out[ns] = [...(snap[ns] || [])].sort();
         }
         return out;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "progmune-runtime",
-  "version": "3.4.0",
+  "version": "3.4.1",
   "description": "Progmune — AI Trust Decision Engine. Verify AI-generated code before it reaches production. Outputs APPROVED / NEEDS_REVIEW / BLOCKED with evidence.",
   "files": [
     "dist/",