project-tiny-context-harness 0.8.17 → 0.11.0

package/dist/lib/long-task-state.js

@@ -1,8 +1,12 @@
-import { access, mkdir, open, readFile, readdir, rename, rm, writeFile, } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+import { access, link, lstat, mkdir, open, readFile, readdir, rename, rm, unlink, writeFile, } from "node:fs/promises";
 import path from "node:path";
 import { canonicalJson, canonicalValueJson, sha256Hex, } from "./strict-codec.js";
 import { gitCommonDir, gitConfigGet, gitConfigSet, gitConfigUnset, gitPath, } from "./long-task-workspace.js";
 import { verifierAuthorityDiff } from "./long-task-verifier-authority.js";
+import { deliveryCompileFreshness } from "./long-task-freshness.js";
+import { assertNoUnfinishedContextMutationForAuthority } from "./context-mutation/mutation-journal.js";
+import { assertActiveAuthorityLockToken, runWithActiveAuthorityLockToken, } from "./long-task-active-authority-lock-context.js";
 const RUNTIME_FOLDER = ".ty-context";
 const COMPILED_FILE = "compiled-contract.json";
 const PROGRESS_FOLDER = "progress";
@@ -37,40 +41,210 @@ async function withActiveAuthorityLockInternal(repositoryRoot, operation, action
     const activeFile = await activeRecordPath(root);
     await mkdir(path.dirname(activeFile), { recursive: true });
     const lockFile = await activeAuthorityLockPath(root);
-    let lock;
+    const owner = {
+        schema_version: "active-authority-lock-owner-v1",
+        lock_id: randomUUID(),
+        pid: process.pid,
+        operation,
+        created_at: new Date().toISOString(),
+    };
+    const ownerBytes = Buffer.from(canonicalJson(owner), "utf8");
+    const lock = await acquireActiveAuthorityLock(lockFile, ownerBytes, breakStaleLock);
+    const acquired = await readActiveAuthorityLockSnapshot(lockFile);
+    assertLockSnapshotOwner(acquired, ownerBytes);
+    try {
+        const token = Object.freeze({
+            repository_root: root,
+            operation,
+            lock_id: owner.lock_id,
+        });
+        return await runWithActiveAuthorityLockToken(token, () => action(token));
+    }
+    finally {
+        await lock.close();
+        await releaseActiveAuthorityLock(lockFile, ownerBytes, acquired.identity);
+    }
+}
+async function acquireActiveAuthorityLock(lockFile, ownerBytes, forceClear) {
     try {
-        lock = await open(lockFile, "wx");
+        return await createActiveAuthorityLock(lockFile, ownerBytes);
     }
     catch (error) {
-        if (error.code === "EEXIST" && breakStaleLock) {
-            await rm(lockFile, { force: true });
-            try {
-                lock = await open(lockFile, "wx");
-            }
-            catch (retryError) {
-                if (retryError.code === "EEXIST")
-                    throw new Error("active_authority_compare_and_swap_failed:lock_unavailable");
-                throw retryError;
-            }
+        if (error.code !== "EEXIST")
+            throw error;
+    }
+    let stale;
+    try {
+        stale = await readActiveAuthorityLockSnapshot(lockFile);
+    }
+    catch (error) {
+        throw new Error(`active_authority_compare_and_swap_failed:lock_unavailable:owner_unreadable_manual_recovery_required:${message(error)}`);
+    }
+    if (stale.identity.nlink !== 1n)
+        throw new Error("active_authority_compare_and_swap_failed:lock_owner_hardlinked_manual_recovery_required");
+    if (processIsLive(stale.owner.pid))
+        throw new Error(`active_authority_compare_and_swap_failed:lock_unavailable:live_owner:${stale.owner.pid}:${stale.owner.operation}`);
+    const claim = `${lockFile}.reclaim-${stale.owner.lock_id}`;
+    try {
+        await link(lockFile, claim);
+    }
+    catch (error) {
+        if (error.code === "EEXIST")
+            throw new Error(`active_authority_compare_and_swap_failed:lock_reclaim_interrupted_manual_recovery_required:${forceClear ? "force_clear" : "automatic"}:${stale.owner.lock_id}`);
+        throw error;
+    }
+    let acquired = null;
+    try {
+        const [current, claimed] = await Promise.all([
+            readActiveAuthorityLockSnapshot(lockFile),
+            readActiveAuthorityLockSnapshot(claim),
+        ]);
+        assertSameLockSnapshot(current, claimed);
+        assertClaimedLockTransition(current, stale);
+        if (processIsLive(stale.owner.pid))
+            throw new Error(`active_authority_compare_and_swap_failed:lock_unavailable:owner_became_live:${stale.owner.pid}`);
+        await unlink(lockFile);
+        try {
+            acquired = await createActiveAuthorityLock(lockFile, ownerBytes);
         }
-        else if (error.code === "EEXIST")
-            throw new Error("active_authority_compare_and_swap_failed:lock_unavailable");
-        else
+        catch (error) {
+            if (error.code === "EEXIST")
+                throw new Error("active_authority_compare_and_swap_failed:lock_unavailable:reclaim_lost");
             throw error;
+        }
+    }
+    catch (error) {
+        await unlink(claim).catch(() => undefined);
+        throw error;
     }
     try {
-        await lock.writeFile(canonicalJson({
-            pid: process.pid,
-            operation,
-            created_at: new Date().toISOString(),
-        }), "utf8");
-        await lock.sync();
-        return await action();
+        await unlink(claim);
     }
-    finally {
-        await lock.close();
-        await rm(lockFile, { force: true });
+    catch (error) {
+        await acquired.close().catch(() => undefined);
+        await removeOwnedAcquisition(lockFile, ownerBytes).catch(() => undefined);
+        throw new Error(`active_authority_lock_reclaim_cleanup_failed:${message(error)}`);
     }
+    return acquired;
+}
+async function createActiveAuthorityLock(lockFile, ownerBytes) {
+    const handle = await open(lockFile, "wx");
+    try {
+        await handle.writeFile(ownerBytes);
+        await handle.sync();
+        return handle;
+    }
+    catch (error) {
+        await handle.close().catch(() => undefined);
+        await unlink(lockFile).catch(() => undefined);
+        throw error;
+    }
+}
+async function releaseActiveAuthorityLock(lockFile, ownerBytes, identity) {
+    const current = await readActiveAuthorityLockSnapshot(lockFile).catch((error) => {
+        throw new Error(`active_authority_lock_release_ownership_lost:${message(error)}`);
+    });
+    if (!current.bytes.equals(ownerBytes) ||
+        !sameLockIdentity(current.identity, identity))
+        throw new Error("active_authority_lock_release_ownership_lost");
+    await unlink(lockFile);
+}
+async function readActiveAuthorityLockSnapshot(lockFile) {
+    const before = await lstat(lockFile, { bigint: true });
+    if (!before.isFile() || before.isSymbolicLink())
+        throw new Error("active_authority_lock_owner_unsafe");
+    const bytes = await readFile(lockFile);
+    const after = await lstat(lockFile, { bigint: true });
+    if (!sameLockIdentity(before, after))
+        throw new Error("active_authority_lock_owner_changed_during_read");
+    if (after.ino === 0n)
+        throw new Error("active_authority_lock_owner_identity_unavailable");
+    let value;
+    try {
+        value = JSON.parse(bytes.toString("utf8"));
+    }
+    catch (error) {
+        throw new Error(`active_authority_lock_owner_invalid:${message(error)}`);
+    }
+    const owner = validateActiveAuthorityLockOwner(value);
+    if (!bytes.equals(Buffer.from(canonicalJson(owner), "utf8")))
+        throw new Error("active_authority_lock_owner_noncanonical");
+    return { bytes, identity: after, owner };
+}
+function validateActiveAuthorityLockOwner(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error("active_authority_lock_owner_object_required");
+    const row = value;
+    if (Object.keys(row).sort().join("\0") !==
+        ["created_at", "lock_id", "operation", "pid", "schema_version"]
+            .sort()
+            .join("\0") ||
+        row.schema_version !== "active-authority-lock-owner-v1" ||
+        typeof row.lock_id !== "string" ||
+        !/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/u.test(row.lock_id) ||
+        typeof row.pid !== "number" ||
+        !Number.isSafeInteger(row.pid) ||
+        row.pid <= 0 ||
+        !activeAuthorityLockOperation(row.operation) ||
+        typeof row.created_at !== "string" ||
+        !Number.isFinite(Date.parse(row.created_at)))
+        throw new Error("active_authority_lock_owner_invalid");
+    return row;
+}
+function activeAuthorityLockOperation(value) {
+    return [
+        "compile",
+        "commit",
+        "clear",
+        "abandon",
+        "migrate",
+        "external_confirmation",
+        "context_mutation",
+        "finalize",
+    ].includes(value);
+}
+function processIsLive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code !== "ESRCH";
+    }
+}
+function assertLockSnapshotOwner(snapshot, ownerBytes) {
+    if (!snapshot.bytes.equals(ownerBytes))
+        throw new Error("active_authority_lock_acquire_ownership_lost");
+}
+function assertSameLockSnapshot(current, expected) {
+    if (!current.bytes.equals(expected.bytes) ||
+        !sameLockIdentity(current.identity, expected.identity))
+        throw new Error("active_authority_compare_and_swap_failed:lock_reclaim_owner_changed");
+}
+function assertClaimedLockTransition(current, expected) {
+    if (!current.bytes.equals(expected.bytes) ||
+        current.identity.dev !== expected.identity.dev ||
+        current.identity.ino !== expected.identity.ino ||
+        current.identity.size !== expected.identity.size ||
+        current.identity.mode !== expected.identity.mode ||
+        current.identity.mtimeNs !== expected.identity.mtimeNs ||
+        current.identity.nlink !== 2n)
+        throw new Error("active_authority_compare_and_swap_failed:lock_reclaim_owner_changed");
+}
+async function removeOwnedAcquisition(lockFile, ownerBytes) {
+    const current = await readActiveAuthorityLockSnapshot(lockFile);
+    if (!current.bytes.equals(ownerBytes))
+        throw new Error("active_authority_lock_acquire_cleanup_ownership_lost");
+    await unlink(lockFile);
+}
+function sameLockIdentity(left, right) {
+    return (left.dev === right.dev &&
+        left.ino === right.ino &&
+        left.nlink === right.nlink &&
+        left.size === right.size &&
+        left.mode === right.mode &&
+        left.mtimeNs === right.mtimeNs &&
+        left.ctimeNs === right.ctimeNs);
 }
 export async function writeCompiledDeliveryContract(compiled) {
     const staged = await stageCompiledDeliveryContract(compiled);
@@ -167,9 +341,13 @@ export async function commitActiveAuthority(options) {
         ? "migrate"
         : "commit";
     return withActiveAuthorityLock(root, operation, async () => {
+        await assertNoUnfinishedContextMutationForAuthority(root);
         const current = await loadActiveLongTaskAuthorityUnlocked(root);
         assertAuthorityCasCandidate(current.authority, options.candidate, options.expected_previous_identity);
         await ensureRuntimeExcludes(root, options.candidate.workdir);
+        const stale = await deliveryCompileFreshness(options.candidate);
+        if (stale.length)
+            throw new Error(`active_authority_candidate_stale:${stale.join(",")}`);
         const authority = activeAuthorityFromCompiled(options.candidate, current.authority?.activated_at ?? new Date().toISOString());
         await persistActiveAuthorityCasUnlocked(root, authority, options.expected_previous_identity);
         return authority;
@@ -393,17 +571,83 @@ export async function invalidateDerivedProgress(workdir) {
         rm(runtimePath(workdir, FINAL_FILE), { force: true }),
     ]);
 }
-export async function writeFinalReceipt(repositoryRoot, workdir, unsigned) {
-    const receipt = {
+export function sealFinalReceipt(unsigned) {
+    return {
         ...unsigned,
         receipt_sha256: sha256Hex(canonicalValueJson(unsigned)),
     };
+}
+export async function commitFinalReceiptTransaction(input) {
+    const root = path.resolve(input.repository_root);
+    assertFinalizationLockToken(input.lock_token, root);
+    const active = await assertCurrentAuthorityCas(root, input.workdir, input.expected_authority);
+    const receipt = sealFinalReceipt(input.unsigned);
     const content = canonicalJson(receipt);
-    await Promise.all([
-        atomicText(runtimePath(workdir, FINAL_FILE), content),
-        atomicText(await auditReceiptPath(repositoryRoot), content),
+    const workdirReceipt = runtimePath(input.workdir, FINAL_FILE);
+    const auditReceipt = await auditReceiptPath(root);
+    const activeFile = await activeRecordPath(root);
+    const marker = markerKey(worktreeIdentity(root));
+    const [oldWorkdirReceipt, oldAuditReceipt, oldActiveRecord, oldMarker] = await Promise.all([
+        readOptionalText(workdirReceipt),
+        readOptionalText(auditReceipt),
+        readOptionalText(activeFile),
+        gitConfigGet(root, marker),
     ]);
-    return receipt;
+    if (oldActiveRecord === null || oldMarker !== markerValue(active))
+        throw new Error("finalization_authority_persistence_cas_failed");
+    const stagedWorkdirReceipt = await stageAtomicText(workdirReceipt, content);
+    const stagedAuditReceipt = await stageAtomicText(auditReceipt, content);
+    let activeBackup = null;
+    try {
+        await input.validate_current("after_receipt_stage");
+        await assertCurrentAuthorityCas(root, input.workdir, input.expected_authority);
+        await rename(stagedWorkdirReceipt, workdirReceipt);
+        await rename(stagedAuditReceipt, auditReceipt);
+        await input.validate_current("after_receipt_publish");
+        await assertCurrentAuthorityCas(root, input.workdir, input.expected_authority);
+        if (input.close_on_accept) {
+            activeBackup = `${activeFile}.finalize-${process.pid}-${Date.now()}`;
+            await rename(activeFile, activeBackup);
+            if ((await readFile(activeBackup, "utf8")) !== oldActiveRecord)
+                throw new Error("finalization_authority_record_changed_before_clear");
+            if ((await gitConfigGet(root, marker)) !== oldMarker)
+                throw new Error("finalization_authority_marker_changed_before_clear");
+            await gitConfigUnset(root, marker);
+            await input.validate_current("after_authority_clear");
+            if ((await readOptionalText(activeFile)) !== null)
+                throw new Error("finalization_authority_reappeared_during_clear");
+            if ((await gitConfigGet(root, marker)) !== null)
+                throw new Error("finalization_authority_marker_reappeared_during_clear");
+            await rm(activeBackup, { force: true });
+            activeBackup = null;
+        }
+        return receipt;
+    }
+    catch (error) {
+        await Promise.allSettled([
+            restoreOptionalText(workdirReceipt, oldWorkdirReceipt),
+            restoreOptionalText(auditReceipt, oldAuditReceipt),
+            restoreAuthorityAfterFinalizationFailure({
+                active_file: activeFile,
+                active_backup: activeBackup,
+                old_active_record: oldActiveRecord,
+                repository_root: root,
+                marker,
+                old_marker: oldMarker,
+            }),
+        ]).then((results) => {
+            const rejected = results.find((result) => result.status === "rejected");
+            if (rejected?.status === "rejected")
+                throw new Error(`finalization_transaction_rollback_failed:${message(rejected.reason)}`);
+        });
+        throw error;
+    }
+    finally {
+        await Promise.all([
+            rm(stagedWorkdirReceipt, { force: true }),
+            rm(stagedAuditReceipt, { force: true }),
+        ]);
+    }
 }
 export async function readFinalReceipt(_repositoryRoot, workdir) {
     const value = await readOptionalJson(runtimePath(workdir, FINAL_FILE));
@@ -411,11 +655,19 @@ export async function readFinalReceipt(_repositoryRoot, workdir) {
         return null;
     const receipt = value;
     const { receipt_sha256: receiptHash, ...unsigned } = receipt;
-    if (receipt.schema_version !== "long-task-final-receipt-v2" ||
+    if (!["long-task-final-receipt-v2", "long-task-final-receipt-v3"].includes(receipt.schema_version) ||
         receipt.authority_scope !== "audit_only" ||
         receipt.reusable_for_acceptance !== false ||
+        (receipt.finalization_identity_sha256 !== undefined &&
+            !/^[a-f0-9]{64}$/u.test(receipt.finalization_identity_sha256)) ||
         sha256Hex(canonicalValueJson(unsigned)) !== receiptHash)
         throw new Error("final_receipt_integrity_mismatch");
+    if ((receipt.schema_version === "long-task-final-receipt-v2" &&
+        receipt.workflow_status === "delivery_accepted") ||
+        (receipt.schema_version === "long-task-final-receipt-v3" &&
+            (receipt.workflow_status === "machine_accepted_external_pending" ||
+                !Array.isArray(receipt.external_confirmation_results))))
+        throw new Error("final_receipt_schema_status_mismatch");
     return receipt;
 }
 export function activeAuthorityIdentityMatches(authority, expected) {
@@ -602,6 +854,40 @@ async function stageAtomicText(file, content) {
     }
     return temporary;
 }
+function assertFinalizationLockToken(token, repositoryRoot) {
+    try {
+        assertActiveAuthorityLockToken(token, repositoryRoot);
+    }
+    catch {
+        throw new Error("finalization_active_authority_lock_required");
+    }
+    if (token.operation !== "finalize")
+        throw new Error("finalization_active_authority_lock_required");
+}
+async function assertCurrentAuthorityCas(repositoryRoot, workdir, expected) {
+    const current = (await loadActiveLongTaskAuthorityUnlocked(repositoryRoot))
+        .authority;
+    if (!current ||
+        normalizePath(current.workdir) !== normalizePath(workdir) ||
+        !activeAuthorityIdentityMatches(current, expected))
+        throw new Error("finalization_authority_compare_and_swap_failed");
+    return current;
+}
+async function restoreOptionalText(file, previous) {
+    if (previous === null)
+        await rm(file, { force: true });
+    else
+        await atomicText(file, previous);
+}
+async function restoreAuthorityAfterFinalizationFailure(input) {
+    await atomicText(input.active_file, input.old_active_record);
+    if (input.active_backup)
+        await rm(input.active_backup, { force: true });
+    if (input.old_marker === null)
+        await gitConfigUnset(input.repository_root, input.marker);
+    else
+        await gitConfigSet(input.repository_root, input.marker, input.old_marker);
+}
 function missingError(error) {
     const value = message(error);
     return value.includes("ENOENT") || value.includes("no such file");

package/dist/lib/long-task-static-observation-freeze.js

@@ -3,6 +3,7 @@ import { constants, watch } from "node:fs";
 import { lstat, open, realpath } from "node:fs/promises";
 import path from "node:path";
 import { JSON_POINTER_EXACT_LIMITS, assertJsonTree, decodeUtf8Json, extractJsonPointerExactObservationFromBytes, normalizeObservationArtifactPath, parseJsonWithoutDuplicateKeys, resolveJsonPointer, } from "./long-task-json-pointer-observation.js";
+const OBSERVATION_HASH_READ_BUFFER_BYTES = 1_048_576;
 export class StaticObservationFreezeError extends Error {
     code;
     artifact_path;
@@ -227,7 +228,7 @@ async function captureStaticObservationFile(root, artifactPath, maxFileBytes, re
             assertMetadataEqual(expected, openedMetadata, artifactPath, expected);
         if (openedMetadata.size > maxFileBytes)
             throw freezeError("static_observation_size_limit", artifactPath);
-        const content = await readAndHashBounded(handle, artifactPath, maxFileBytes, retainBytes);
+        const content = await readAndHashBounded(handle, artifactPath, maxFileBytes, retainBytes, openedMetadata.size);
         const afterRead = fileMetadata(await handle.stat({ bigint: true }));
         assertMetadataEqual(openedMetadata, afterRead, artifactPath, expected);
         const pathAfter = fileMetadata(await lstat(absolute, { bigint: true }).catch((error) => {
@@ -335,8 +336,8 @@ function assertMetadataEqual(left, right, artifactPath, postRunExpected) {
         ? "static_observation_changed_by_runner"
         : "static_observation_not_in_pre_run_snapshot", artifactPath, `file_identity.${mismatch}`);
 }
-async function readAndHashBounded(handle, artifactPath, limit, retainBytes) {
-    const buffer = Buffer.allocUnsafe(Math.min(65_536, limit + 1));
+async function readAndHashBounded(handle, artifactPath, limit, retainBytes, expectedSize) {
+    const buffer = Buffer.allocUnsafe(Math.min(OBSERVATION_HASH_READ_BUFFER_BYTES, limit + 1, Math.max(1, expectedSize + 1)));
     const chunks = [];
     const hash = createHash("sha256");
     let offset = 0;

package/dist/lib/long-task-status-projection.d.ts

@@ -1,4 +1,4 @@
-import type { CompiledDeliveryContractV2, FinalReceiptV2, LongTaskFindingV2, OutcomeStatusV2, ProgressRecordV2, StageStatusV2, WorkspaceManifestV2 } from "./long-task-delivery-types.js";
+import type { CompiledDeliveryContractV2, FinalReceiptV2, LongTaskFindingV2, OutcomeStatusV2, ProgressRecordV2, StageStatusV2, WorkspaceManifestV2, ExternalConfirmationEvaluationV1 } from "./long-task-delivery-types.js";
 interface StatusProjectionInputV2 {
     compiled: CompiledDeliveryContractV2;
     manifest: WorkspaceManifestV2;
@@ -6,6 +6,8 @@ interface StatusProjectionInputV2 {
     progress: Record<string, ProgressRecordV2>;
     receipt: FinalReceiptV2 | null;
     receiptError: string | null;
+    finalizationIdentitySha256: string | null;
+    externalConfirmations: ExternalConfirmationEvaluationV1[];
 }
 export type AuditGateStatusV2 = "no_final_gate" | "last_gate_passed" | "last_gate_failed" | "last_gate_blocked" | "last_gate_inputs_stale";
 export declare function projectDeliveryStatus(input: StatusProjectionInputV2): {

package/dist/lib/long-task-status-projection.js

@@ -1,5 +1,5 @@
-import { outcomeResultExternallyBlocked } from "./long-task-claims.js";
 import { progressRecordFresh } from "./long-task-progress.js";
+import { blockingExternalRows } from "./long-task-external-confirmation-identity.js";
 export function projectDeliveryStatus(input) {
     const outcomes = projectOutcomes(input);
     const stages = projectStages(input.compiled, outcomes);
@@ -32,6 +32,8 @@ export function projectDeliveryStatus(input) {
 function projectOutcomes(input) {
     const outcomes = {};
     for (const outcome of input.compiled.outcomes) {
+        const external = input.externalConfirmations.filter((evaluation) => evaluation.blocks_target &&
+            externalConfirmationImpactsOutcome(input.compiled, evaluation, outcome.key));
         const states = outcome.acceptance.checks.map((check) => {
             const record = input.progress[check.internal_id];
             if (!record)
@@ -45,20 +47,29 @@ function projectOutcomes(input) {
                 return "blocked_external";
             return "progress_failing";
         });
-        outcomes[outcome.key] = states.includes("progress_failing")
-            ? "progress_failing"
-            : outcomeResultExternallyBlocked(input.compiled, outcome.key) ||
-                states.includes("blocked_external")
-                ? "blocked_external"
-                : states.includes("progress_stale")
-                    ? "progress_stale"
-                    : states.length > 0 &&
-                        states.every((state) => state === "progress_passing")
-                        ? "progress_passing"
-                        : "unverified";
+        outcomes[outcome.key] =
+            states.includes("progress_failing") ||
+                external.some((evaluation) => evaluation.state !== "fulfilled" && evaluation.state !== "pending")
+                ? "progress_failing"
+                : external.some((evaluation) => evaluation.state === "pending") ||
+                    states.includes("blocked_external")
+                    ? "blocked_external"
+                    : states.includes("progress_stale")
+                        ? "progress_stale"
+                        : states.length > 0 &&
+                            states.every((state) => state === "progress_passing")
+                            ? "progress_passing"
+                            : "unverified";
     }
     return outcomes;
 }
+function externalConfirmationImpactsOutcome(compiled, evaluation, outcomeKey) {
+    return blockingExternalRows(compiled, evaluation.confirmation_ref).some((row) => row.outcome_key === outcomeKey ||
+        row.claim_ref === outcomeKey ||
+        row.claim_ref.startsWith(`${outcomeKey}.`) ||
+        row.local_claim_ref === outcomeKey ||
+        row.local_claim_ref.startsWith(`${outcomeKey}.`));
+}
 function projectFindings(input) {
     const findings = input.stale.map((code) => ({
         code,
@@ -110,7 +121,7 @@ function readyOutcomes(compiled, outcomes, stages) {
 }
 function legacyTargetState(receipt) {
     if (receipt.workflow_status === "machine_accepted" ||
-        receipt.workflow_status === "machine_accepted_external_pending")
+        receipt.workflow_status === "delivery_accepted")
         return receipt.target_profile.required_state;
     return receipt.workflow_status === "blocked_external"
         ? "blocked_external"
@@ -165,6 +176,8 @@ function projectFinalResult(input) {
         return "last_gate_inputs_stale";
     if (input.receipt.workflow_status === "blocked_external")
         return "last_gate_blocked";
+    if (input.receipt.workflow_status === "machine_accepted_external_pending")
+        return "last_gate_blocked";
     if (input.receipt.workflow_status === "needs_work")
         return "last_gate_failed";
     return "last_gate_passed";
@@ -172,9 +185,27 @@ function projectFinalResult(input) {
 function receiptFresh(input) {
     return Boolean(input.receipt &&
         !input.receiptError &&
+        input.finalizationIdentitySha256 !== null &&
+        input.receipt.finalization_identity_sha256 ===
+            input.finalizationIdentitySha256 &&
         !input.stale.length &&
+        blockingExternalInputsFresh(input) &&
         input.receipt.compiled_identity === input.compiled.compiled_identity &&
         input.receipt.snapshot_sha256 === input.manifest.snapshot_sha256 &&
         input.receipt.git_head === input.manifest.git_head &&
         input.receipt.git_tree === input.manifest.fingerprint.head_tree);
 }
+function blockingExternalInputsFresh(input) {
+    if (!input.receipt)
+        return false;
+    const project = (rows) => rows
+        .filter((row) => row.blocks_target)
+        .map((row) => ({
+        confirmation_ref: row.confirmation_ref,
+        state: row.state,
+        record_sha256: row.record_sha256,
+        relevant_input_identity: row.relevant_input_identity,
+    }))
+        .sort((left, right) => left.confirmation_ref.localeCompare(right.confirmation_ref));
+    return (JSON.stringify(project(input.receipt.external_confirmation_results ?? [])) === JSON.stringify(project(input.externalConfirmations)));
+}

package/dist/lib/long-task-status-v2.d.ts

@@ -1,5 +1,5 @@
 import type { AuthorityRevisionDecisionV2 } from "./long-task-authority-revision-types.js";
-import type { ExternalConfirmationV2, FinalReceiptV2, LongTaskFindingV2, OutcomeStatusV2, StageStatusV2, TargetProfileV2 } from "./long-task-delivery-types.js";
+import type { ExternalConfirmationV2, ExternalConfirmationEvaluationV1, FinalReceiptV2, LongTaskFindingV2, OutcomeStatusV2, RepairFrontierV1, StageStatusV2, TargetProfileV2 } from "./long-task-delivery-types.js";
 import { type AuditGateStatusV2 } from "./long-task-status-projection.js";
 export interface DeliveryStatusV2 {
     schema_version: "long-task-status-v2";
@@ -8,11 +8,12 @@ export interface DeliveryStatusV2 {
     effective_risk: "standard" | "strict";
     workspace_snapshot_sha256: string;
     acceptance_authority: "live_final_gate_required";
-    acceptance_scope: "declared_machine_authority";
+    acceptance_scope: "declared_delivery_authority";
     native_goal_effect: "none";
     final_result: AuditGateStatusV2;
     final_workflow_status: FinalReceiptV2["workflow_status"] | null;
     external_confirmations: ExternalConfirmationV2[];
+    external_confirmation_results: ExternalConfirmationEvaluationV1[];
     target_profile: TargetProfileV2;
     target_state: FinalReceiptV2["target_state"];
     outcomes: Record<string, OutcomeStatusV2>;
@@ -25,6 +26,7 @@ export interface DeliveryStatusV2 {
     progress_passing: string[];
     progress_failing: string[];
     findings: LongTaskFindingV2[];
+    repair_frontier: RepairFrontierV1;
     pending_authority_revision: AuthorityRevisionDecisionV2 | null;
 }
 export declare function readDeliveryStatus(workdir: string): Promise<DeliveryStatusV2>;
@@ -36,22 +38,24 @@ export interface StopCheckDeliveryResultV2 {
     reason: string;
     workflow_status?: FinalReceiptV2["workflow_status"];
     external_confirmations?: ExternalConfirmationV2[];
+    external_confirmation_results?: ExternalConfirmationEvaluationV1[];
     target_profile?: TargetProfileV2;
     target_state?: FinalReceiptV2["target_state"];
     stage_results?: FinalReceiptV2["stage_results"];
-    acceptance_scope?: "declared_machine_authority";
+    acceptance_scope?: "declared_delivery_authority";
     native_goal_effect?: "none";
     message?: string;
 }
 export interface CloseDeliveryResultV2 {
     status: "closed";
-    workflow_status: Extract<FinalReceiptV2["workflow_status"], "machine_accepted" | "machine_accepted_external_pending">;
+    workflow_status: Extract<FinalReceiptV2["workflow_status"], "machine_accepted" | "delivery_accepted">;
     external_confirmations: ExternalConfirmationV2[];
+    external_confirmation_results: ExternalConfirmationEvaluationV1[];
     target_profile: TargetProfileV2;
     target_state: FinalReceiptV2["target_state"];
     stage_results: FinalReceiptV2["stage_results"];
-    acceptance_scope: "declared_machine_authority";
-    closed_scope: "machine_authority";
+    acceptance_scope: "declared_delivery_authority";
+    closed_scope: "complete_long_task_authority";
     native_goal_effect: "none";
 }
 export declare function closeDeliveryTask(workdir: string): Promise<CloseDeliveryResultV2>;