pumuki 6.3.75 → 6.3.77

package/integrations/gate/stagePolicies.ts

@@ -233,6 +233,8 @@ type PolicyAsCodeContract = {
   version: '1.0';
   source: 'default' | 'skills.policy' | 'hard-mode';
   signatures: Partial<Record<SkillsStage, string>> & Record<'PRE_COMMIT' | 'PRE_PUSH' | 'CI', string>;
+  strict?: Partial<Record<SkillsStage, boolean>> &
+    Record<'PRE_COMMIT' | 'PRE_PUSH' | 'CI', boolean>;
   expires_at?: string;
 };
 
@@ -272,6 +274,30 @@ const policyStrictModeFromEnv = (): boolean => {
   return raw === '1' || raw === 'true' || raw === 'yes' || raw === 'on';
 };
 
+const isBoolean = (value: unknown): value is boolean => {
+  return typeof value === 'boolean';
+};
+
+const resolveContractStrictForStage = (
+  strictByStage: PolicyAsCodeContract['strict'],
+  stage: SkillsStage
+): boolean | null => {
+  if (!strictByStage) {
+    return null;
+  }
+  if (stage === 'PRE_WRITE') {
+    return strictByStage.PRE_WRITE ?? strictByStage.PRE_COMMIT ?? null;
+  }
+  return strictByStage[stage] ?? null;
+};
+
+const resolvePolicyStrict = (strictByContract: boolean | null): boolean => {
+  if (typeof strictByContract === 'boolean') {
+    return strictByContract;
+  }
+  return policyStrictModeFromEnv();
+};
+
 const isPolicyAsCodeContract = (value: unknown): value is PolicyAsCodeContract => {
   if (!isObject(value)) {
     return false;
@@ -289,6 +315,16 @@ const isPolicyAsCodeContract = (value: unknown): value is PolicyAsCodeContract =
   if (!isObject(value.signatures)) {
     return false;
   }
+  if (
+    typeof value.strict !== 'undefined' &&
+    (!isObject(value.strict)
+      || (typeof value.strict.PRE_WRITE !== 'undefined' && !isBoolean(value.strict.PRE_WRITE))
+      || !isBoolean(value.strict.PRE_COMMIT)
+      || !isBoolean(value.strict.PRE_PUSH)
+      || !isBoolean(value.strict.CI))
+  ) {
+    return false;
+  }
   if (typeof value.expires_at !== 'undefined' && !isIsoDateString(value.expires_at)) {
     return false;
   }
@@ -332,7 +368,7 @@ const resolvePolicyAsCodeTraceMetadata = (params: {
   policySource: string;
   validation: NonNullable<ResolvedStagePolicy['trace']['validation']>;
 } => {
-  const strict = policyStrictModeFromEnv();
+  const envStrict = policyStrictModeFromEnv();
   const computedVersion = `policy-as-code/${params.source}@${POLICY_AS_CODE_VERSION}`;
   const computedSignature = createPolicyAsCodeSignature({
     stage: params.stage,
@@ -344,7 +380,7 @@ const resolvePolicyAsCodeTraceMetadata = (params: {
   const contractPath = join(params.repoRoot, POLICY_AS_CODE_CONTRACT_PATH);
 
   if (!existsSync(contractPath)) {
-    if (strict) {
+    if (envStrict) {
       return {
         version: computedVersion,
         signature: computedSignature,
@@ -354,7 +390,7 @@ const resolvePolicyAsCodeTraceMetadata = (params: {
           code: 'POLICY_AS_CODE_UNSIGNED',
           message:
             'Policy-as-code contract is missing; runtime policy metadata is unsigned.',
-          strict,
+          strict: envStrict,
         },
       };
     }
@@ -367,7 +403,7 @@ const resolvePolicyAsCodeTraceMetadata = (params: {
         status: 'valid',
         code: 'POLICY_AS_CODE_VALID',
         message: 'Policy-as-code metadata generated from active runtime policy.',
-        strict,
+        strict: envStrict,
       },
     };
   }
@@ -383,11 +419,13 @@ const resolvePolicyAsCodeTraceMetadata = (params: {
           status: 'invalid',
           code: 'POLICY_AS_CODE_CONTRACT_INVALID',
           message: 'Policy-as-code contract is malformed.',
-          strict,
+          strict: envStrict,
         },
       };
     }
 
+    const strict = resolvePolicyStrict(resolveContractStrictForStage(raw.strict, params.stage));
+
     if (raw.source !== params.source) {
       return {
         version: `policy-as-code/${raw.source}@${raw.version}`,
@@ -465,7 +503,7 @@ const resolvePolicyAsCodeTraceMetadata = (params: {
         status: 'invalid',
         code: 'POLICY_AS_CODE_CONTRACT_INVALID',
         message: 'Policy-as-code contract cannot be parsed as JSON.',
-        strict,
+        strict: envStrict,
       },
     };
   }

package/integrations/lifecycle/policyReconcile.ts

@@ -103,19 +103,9 @@ const toContractSource = (
   return 'default';
 };
 
-const tryApplyPolicyAutofix = (params: {
+const writePolicyAsCodeContract = (params: {
   report: Omit<PolicyReconcileReport, 'applyRequested' | 'autofix'>;
 }): PolicyReconcileReport['autofix'] => {
-  const actionableDrifts = params.report.drifts.filter((drift) => POLICY_AUTOFIX_DRIFT_CODES.has(drift.code));
-  if (actionableDrifts.length === 0) {
-    return {
-      attempted: false,
-      status: 'SKIPPED',
-      actions: [],
-      details: 'No policy-as-code drift eligible for autofix.',
-    };
-  }
-
   const preWriteStage = params.report.stages.PRE_WRITE;
   const signatures = {
     PRE_WRITE: createPolicyAsCodeSignature({
@@ -134,7 +124,7 @@ const tryApplyPolicyAutofix = (params: {
       attempted: true,
       status: 'FAILED',
       actions: [],
-      details: 'Cannot autofix: missing computed signatures for one or more stages.',
+      details: 'Cannot write policy-as-code contract: missing computed signatures for one or more stages.',
     };
   }
 
@@ -142,6 +132,12 @@ const tryApplyPolicyAutofix = (params: {
   const contract = {
     version: '1.0',
     source: toContractSource(params.report.stages.PRE_WRITE.source),
+    strict: {
+      PRE_WRITE: params.report.stages.PRE_WRITE.strict,
+      PRE_COMMIT: params.report.stages.PRE_COMMIT.strict,
+      PRE_PUSH: params.report.stages.PRE_PUSH.strict,
+      CI: params.report.stages.CI.strict,
+    },
     signatures: {
       PRE_WRITE: signatures.PRE_WRITE,
       PRE_COMMIT: signatures.PRE_COMMIT,
@@ -158,7 +154,7 @@ const tryApplyPolicyAutofix = (params: {
       attempted: true,
       status: 'APPLIED',
       actions: ['WRITE_POLICY_AS_CODE_CONTRACT'],
-      details: `Wrote ${POLICY_AS_CODE_CONTRACT_PATH} with deterministic stage signatures.`,
+      details: `Wrote ${POLICY_AS_CODE_CONTRACT_PATH} with deterministic stage signatures and strict flags.`,
     };
   } catch (error) {
     return {
@@ -170,6 +166,22 @@ const tryApplyPolicyAutofix = (params: {
   }
 };
 
+const tryApplyPolicyAutofix = (params: {
+  report: Omit<PolicyReconcileReport, 'applyRequested' | 'autofix'>;
+}): PolicyReconcileReport['autofix'] => {
+  const actionableDrifts = params.report.drifts.filter((drift) => POLICY_AUTOFIX_DRIFT_CODES.has(drift.code));
+  if (actionableDrifts.length === 0) {
+    return {
+      attempted: false,
+      status: 'SKIPPED',
+      actions: [],
+      details: 'No policy-as-code drift eligible for autofix.',
+    };
+  }
+
+  return writePolicyAsCodeContract(params);
+};
+
 export const runPolicyReconcile = (params?: {
   repoRoot?: string;
   now?: () => Date;
@@ -412,6 +424,31 @@ export const runPolicyReconcile = (params?: {
       };
     }
 
+    if (strictRequested && baseReport.summary.status === 'PASS') {
+      const strictPersistence = writePolicyAsCodeContract({
+        report: baseReport,
+      });
+      if (strictPersistence.status !== 'APPLIED') {
+        return {
+          ...baseReport,
+          applyRequested: true,
+          autofix: strictPersistence,
+        };
+      }
+
+      const reevaluated = runPolicyReconcile({
+        repoRoot,
+        now,
+        strict: strictRequested,
+        apply: false,
+      });
+      return {
+        ...reevaluated,
+        applyRequested: true,
+        autofix: strictPersistence,
+      };
+    }
+
     const autofix = tryApplyPolicyAutofix({
       report: baseReport,
     });

package/integrations/mcp/enterpriseServer.ts

@@ -39,6 +39,14 @@ type EnterpriseStatusPayload = {
   evidence: ReturnType<typeof toStatusPayload>;
 };
 
+type EnterpriseHealthPayload = {
+  status: 'ok';
+  repoRoot: string;
+  experimentalFeatures: {
+    mcp_enterprise: ReturnType<typeof resolveMcpEnterpriseExperimentalFeature>;
+  };
+};
+
 const ENTERPRISE_RESOURCES = [
   'evidence://status',
   'gitflow://state',
@@ -650,6 +658,14 @@ const buildStatusPayload = (repoRoot: string): EnterpriseStatusPayload => ({
   evidence: toStatusPayload(repoRoot),
 });
 
+const buildHealthPayload = (repoRoot: string): EnterpriseHealthPayload => ({
+  status: 'ok',
+  repoRoot,
+  experimentalFeatures: {
+    mcp_enterprise: readMcpEnterpriseExperimentalState(),
+  },
+});
+
 export const startEnterpriseMcpServer = (
   options: EnterpriseServerOptions = {}
 ): EnterpriseServerHandle => {
@@ -680,7 +696,7 @@ export const startEnterpriseMcpServer = (
         sendJson(res, 405, { error: 'Method not allowed' });
         return;
       }
-      sendJson(res, 200, { status: 'ok' });
+      sendJson(res, 200, buildHealthPayload(repoRoot));
       return;
     }
 

package/integrations/mcp/enterpriseStdioServer.cli.ts

@@ -1,5 +1,6 @@
 import { Socket, createServer } from 'node:net';
 import { startEnterpriseMcpServer } from './enterpriseServer';
+import { resolveMcpEnterpriseExperimentalFeature } from '../policy/experimentalFeatures';
 
 type JsonRpcId = string | number | null;
 
@@ -98,11 +99,32 @@ const fetchJson = async (url: string, options?: RequestInit): Promise<unknown> =
   }
 };
 
+type EnterpriseHealthPayload = {
+  status?: string;
+  repoRoot?: string;
+  experimentalFeatures?: {
+    mcp_enterprise?: {
+      mode?: string;
+    };
+  };
+};
+
+const canReuseEnterpriseHttp = (
+  health: EnterpriseHealthPayload,
+  repoRoot: string,
+  expectedMcpMode: string
+): boolean =>
+  health.status === 'ok'
+  && health.repoRoot === repoRoot
+  && health.experimentalFeatures?.mcp_enterprise?.mode === expectedMcpMode;
+
 const startOrReuseEnterpriseHttp = async (): Promise<{
   host: string;
   port: number;
   startedByThisProcess: boolean;
 }> => {
+  const repoRoot = process.cwd();
+  const expectedMcpMode = resolveMcpEnterpriseExperimentalFeature().mode;
   const host = process.env.PUMUKI_ENTERPRISE_MCP_HOST ?? '127.0.0.1';
   const parsedPort = Number.parseInt(process.env.PUMUKI_ENTERPRISE_MCP_PORT ?? '', 10);
   const preferredPort = Number.isFinite(parsedPort) ? parsedPort : 7391;
@@ -110,16 +132,21 @@ const startOrReuseEnterpriseHttp = async (): Promise<{
 
   const healthUrl = `http://${host}:${requestedPort}/health`;
   try {
-    const health = (await fetchJson(healthUrl)) as { status?: string };
-    if (health.status === 'ok') {
+    const health = (await fetchJson(healthUrl)) as EnterpriseHealthPayload;
+    if (canReuseEnterpriseHttp(health, repoRoot, expectedMcpMode)) {
       return {
         host,
         port: requestedPort,
         startedByThisProcess: false,
       };
     }
-  } catch {
-    // Intentionally ignored: endpoint not available yet.
+  } catch (error) {
+    if (process.env.PUMUKI_DEBUG_MCP === '1') {
+      const message = error instanceof Error ? error.message : String(error);
+      process.stderr.write(
+        `[pumuki-mcp-enterprise-stdio] health probe reuse skipped: ${message}\n`
+      );
+    }
   }
 
   const portInUse = await isPortInUse(host, requestedPort);
@@ -127,7 +154,7 @@ const startOrReuseEnterpriseHttp = async (): Promise<{
   startEnterpriseMcpServer({
     host,
     port: resolvedPort,
-    repoRoot: process.cwd(),
+    repoRoot,
   });
 
   return {

package/integrations/policy/policyAsCode.ts

@@ -30,7 +30,10 @@ export type PolicyAsCodeTraceMetadata = {
 type PolicyAsCodeContract = {
   version: '1.0';
   source: PolicyProfileSource;
-  signatures: Record<SkillsStage, string>;
+  signatures: Partial<Record<SkillsStage, string>> &
+    Record<'PRE_COMMIT' | 'PRE_PUSH' | 'CI', string>;
+  strict?: Partial<Record<SkillsStage, boolean>> &
+    Record<'PRE_COMMIT' | 'PRE_PUSH' | 'CI', boolean>;
   expires_at?: string;
 };
 
@@ -57,6 +60,40 @@ const policyStrictModeFromEnv = (): boolean => {
   return raw === '1' || raw === 'true' || raw === 'yes' || raw === 'on';
 };
 
+const isBoolean = (value: unknown): value is boolean => {
+  return typeof value === 'boolean';
+};
+
+const resolveContractSignatureForStage = (
+  signatures: PolicyAsCodeContract['signatures'],
+  stage: SkillsStage
+): string | undefined => {
+  if (stage === 'PRE_WRITE') {
+    return signatures.PRE_WRITE ?? signatures.PRE_COMMIT;
+  }
+  return signatures[stage];
+};
+
+const resolveContractStrictForStage = (
+  strictByStage: PolicyAsCodeContract['strict'],
+  stage: SkillsStage
+): boolean | null => {
+  if (!strictByStage) {
+    return null;
+  }
+  if (stage === 'PRE_WRITE') {
+    return strictByStage.PRE_WRITE ?? strictByStage.PRE_COMMIT ?? null;
+  }
+  return strictByStage[stage] ?? null;
+};
+
+const resolvePolicyStrict = (strictByContract: boolean | null): boolean => {
+  if (typeof strictByContract === 'boolean') {
+    return strictByContract;
+  }
+  return policyStrictModeFromEnv();
+};
+
 const isPolicyAsCodeContract = (value: unknown): value is PolicyAsCodeContract => {
   if (!isObject(value)) {
     return false;
@@ -74,10 +111,21 @@ const isPolicyAsCodeContract = (value: unknown): value is PolicyAsCodeContract =
   if (!isObject(value.signatures)) {
     return false;
   }
+  if (
+    typeof value.strict !== 'undefined' &&
+    (!isObject(value.strict)
+      || (typeof value.strict.PRE_WRITE !== 'undefined' && !isBoolean(value.strict.PRE_WRITE))
+      || !isBoolean(value.strict.PRE_COMMIT)
+      || !isBoolean(value.strict.PRE_PUSH)
+      || !isBoolean(value.strict.CI))
+  ) {
+    return false;
+  }
   if (typeof value.expires_at !== 'undefined' && !isIsoDateString(value.expires_at)) {
     return false;
   }
   return (
+    (typeof value.signatures.PRE_WRITE === 'undefined' || isSha256Hex(value.signatures.PRE_WRITE)) &&
     isSha256Hex(value.signatures.PRE_COMMIT) &&
     isSha256Hex(value.signatures.PRE_PUSH) &&
     isSha256Hex(value.signatures.CI)
@@ -111,7 +159,7 @@ export const resolvePolicyAsCodeTraceMetadata = (params: {
   hash: string;
   repoRoot: string;
 }): PolicyAsCodeTraceMetadata => {
-  const strict = policyStrictModeFromEnv();
+  const envStrict = policyStrictModeFromEnv();
   const computedVersion = `policy-as-code/${params.source}@${POLICY_AS_CODE_VERSION}`;
   const computedSignature = createPolicyAsCodeSignature({
     stage: params.stage,
@@ -123,7 +171,7 @@ export const resolvePolicyAsCodeTraceMetadata = (params: {
   const contractPath = join(params.repoRoot, POLICY_AS_CODE_CONTRACT_PATH);
 
   if (!existsSync(contractPath)) {
-    if (strict) {
+    if (envStrict) {
       return {
         version: computedVersion,
         signature: computedSignature,
@@ -133,7 +181,7 @@ export const resolvePolicyAsCodeTraceMetadata = (params: {
           code: 'POLICY_AS_CODE_UNSIGNED',
           message:
             'Policy-as-code contract is missing; runtime policy metadata is unsigned.',
-          strict,
+          strict: envStrict,
         },
       };
     }
@@ -146,7 +194,7 @@ export const resolvePolicyAsCodeTraceMetadata = (params: {
         status: 'valid',
         code: 'POLICY_AS_CODE_VALID',
         message: 'Policy-as-code metadata generated from active runtime policy.',
-        strict,
+        strict: envStrict,
       },
     };
   }
@@ -162,15 +210,17 @@ export const resolvePolicyAsCodeTraceMetadata = (params: {
           status: 'invalid',
           code: 'POLICY_AS_CODE_CONTRACT_INVALID',
           message: 'Policy-as-code contract is malformed.',
-          strict,
+          strict: envStrict,
         },
       };
     }
 
+    const strict = resolvePolicyStrict(resolveContractStrictForStage(raw.strict, params.stage));
+
     if (raw.source !== params.source) {
       return {
         version: `policy-as-code/${raw.source}@${raw.version}`,
-        signature: raw.signatures[params.stage],
+        signature: resolveContractSignatureForStage(raw.signatures, params.stage) ?? computedSignature,
         policySource: `file:${POLICY_AS_CODE_CONTRACT_PATH}`,
         validation: {
           status: 'unknown-source',
@@ -183,18 +233,18 @@ export const resolvePolicyAsCodeTraceMetadata = (params: {
     }
 
     const expectedSignature = createPolicyAsCodeSignature({
-      stage: params.stage,
+      stage: params.stage === 'PRE_WRITE' ? 'PRE_COMMIT' : params.stage,
       source: params.source,
       bundle: params.bundle,
       hash: params.hash,
       version: raw.version,
     });
-    const stageSignature = raw.signatures[params.stage];
+    const stageSignature = resolveContractSignatureForStage(raw.signatures, params.stage);
 
     if (stageSignature !== expectedSignature) {
       return {
         version: `policy-as-code/${raw.source}@${raw.version}`,
-        signature: stageSignature,
+        signature: stageSignature ?? computedSignature,
         policySource: `file:${POLICY_AS_CODE_CONTRACT_PATH}`,
         validation: {
           status: 'invalid',
@@ -211,7 +261,7 @@ export const resolvePolicyAsCodeTraceMetadata = (params: {
       if (Number.isFinite(expiresAtTimestamp) && Date.now() >= expiresAtTimestamp) {
         return {
           version: `policy-as-code/${raw.source}@${raw.version}`,
-          signature: stageSignature,
+          signature: stageSignature ?? computedSignature,
           policySource: `file:${POLICY_AS_CODE_CONTRACT_PATH}`,
           validation: {
             status: 'expired',
@@ -225,7 +275,7 @@ export const resolvePolicyAsCodeTraceMetadata = (params: {
 
     return {
       version: `policy-as-code/${raw.source}@${raw.version}`,
-      signature: stageSignature,
+      signature: stageSignature ?? computedSignature,
       policySource: `file:${POLICY_AS_CODE_CONTRACT_PATH}`,
       validation: {
         status: 'valid',
@@ -243,7 +293,7 @@ export const resolvePolicyAsCodeTraceMetadata = (params: {
         status: 'invalid',
         code: 'POLICY_AS_CODE_CONTRACT_INVALID',
         message: 'Policy-as-code contract cannot be parsed as JSON.',
-        strict,
+        strict: envStrict,
       },
     };
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pumuki",
-  "version": "6.3.75",
+  "version": "6.3.77",
   "description": "Enterprise-grade AST Intelligence System with multi-platform support (iOS, Android, Backend, Frontend) and Feature-First + DDD + Clean Architecture enforcement. Includes dynamic violations API for intelligent querying.",
   "main": "index.js",
   "bin": {