rig-create 1.0.4 → 1.2.0

package/src/reopen.ts

@@ -1,9 +1,15 @@
 import { writeFileSync } from 'node:fs';
+import { readFileSync } from './check-reads.ts';
+import { isDeepStrictEqual } from 'node:util';
 import { resolve } from 'node:path';
 
-import { asArray, asString, isObject, type Finding } from './check.ts';
+import { asArray, asString, collectSignoffs, isObject, type Finding } from './check.ts';
 import { collectAmendments } from './amend.ts';
 import { readProject } from './feedback.ts';
+import { jobHash } from './job-outbox.ts';
+import { acquireBoundJobWrite } from './job-writer.ts';
+import { assertActSubjectDeclared, decodeReviewAct, fetchReviewActBytes, reviewActFindings, reviewActTransport, type ReviewActTransport, type ReopenAct } from './review-act.ts';
+import { stepHash } from './step-hash.ts';
 import { readVerbatim } from './record-input.ts';
 import { refuse, USAGE_EXIT } from './refusal.ts';
 import { newRefusals } from './refusal-baseline.ts';
@@ -77,6 +83,16 @@ function reachedIndex(project: JsonObject, at: number, fromStage: string): numbe
   return reached;
 }
 
+/** An acceptance remains authoring authority until an explicit reopen supersedes it. */
+export function directionReviewClosed(project: JsonObject): boolean {
+  const reopens = collectReopens(project, []);
+  return collectSignoffs(project, []).some(signoff => signoff.stage === 'direction-review'
+    && signoff.checkpoint === null && liveSignoff(reopens, signoff.stage, signoff.at))
+    || asArray(project.versions).filter(isObject).some(version => version.kind === 'post'
+      && asArray(version.verdicts).filter(isObject).some(verdict => verdict.review === 'direction-review'
+        && verdict.verdict === 'accepted' && liveSignoff(reopens, 'direction-review', Date.parse(String(verdict.at)))));
+}
+
 /** Each reopen invalidates its suffix; a later, narrower reopen cannot resurrect an earlier suffix. */
 export function reopenTime(reopens: readonly Reopen[], stage: string): number {
   return Math.max(-Infinity, ...reopens.filter(r => stageIndex(r.stage) <= stageIndex(stage)).map(r => r.at));
@@ -94,38 +110,77 @@ export function liveSignoff(reopens: readonly Reopen[], stage: string, at: numbe
 
 export const REOPEN_HELP = `reopen:
   <stage> [<project dir>]  record a human backward move and set project.stage
+  --from-review <actId>   ingest the exported Review reopen (excludes --by, --verbatim-file and --source)
   --by <who>              human signer (agent is refused)
   --verbatim-file <file>  unchanged UTF-8 words; relative to the current working directory, not the project; or - for stdin (default)
   --source <text>         optional origin of the words, separate from verbatim
   --json                  print the reopen record
   The clock supplies at; sign-offs and versions remain history.`;
 
-export function reopenCommand(args: string[], now: number): { stdout: string; exit: number } {
+export function reopenCommand(args: string[], now: number, hooks: { fetch?: (transport: ReviewActTransport) => { bytes: string } } = {}): { stdout: string; exit: number } {
   const opts: Record<string, string> = {};
   const positional: string[] = [];
   let json = false;
   for (let i = 0; i < args.length; i++) {
     const arg = args[i] as string;
     if (arg === '--json') json = true;
-    else if (['--by', '--verbatim-file', '--source'].includes(arg)) {
+    else if (['--by', '--verbatim-file', '--source', '--from-review'].includes(arg)) {
       const value = args[++i];
       if (arg in opts || value === undefined || value === '') refuse('REOPEN_OPTION_INVALID', `reopens: ${arg} needs one non-empty value; supply it once`, USAGE_EXIT);
       opts[arg] = value;
     } else if (arg.startsWith('-')) refuse('UNKNOWN_OPTION', `reopens: unsupported ${arg}; see reopen help`, USAGE_EXIT);
     else positional.push(arg);
   }
-  if (positional.length < 1 || positional.length > 2 || opts['--by'] === undefined) refuse('REOPEN_OPTION_INVALID', 'reopens: supply a stage, --by and one optional project directory', USAGE_EXIT);
+  const actId = opts['--from-review'];
+  if (positional.length < 1 || positional.length > 2 || actId === undefined && opts['--by'] === undefined) refuse('REOPEN_OPTION_INVALID', 'reopens: supply a stage, --by or --from-review, and one optional project directory', USAGE_EXIT);
+  if (actId !== undefined && ['--by', '--verbatim-file', '--source'].some(flag => opts[flag] !== undefined)) {
+    refuse('REOPEN_OPTION_INVALID', 'project.json.reopens: --from-review excludes --by, --verbatim-file and --source; use the exported human values', USAGE_EXIT);
+  }
   const dir = resolve(positional[1] ?? process.cwd());
+  const release = actId === undefined ? () => {} : acquireBoundJobWrite(dir);
+  try { return recordReopen(dir, positional[0]!, opts, json, now, hooks); }
+  finally { release(); }
+}
+
+function recordReopen(dir: string, stage: string, opts: Record<string, string>, json: boolean, now: number,
+  hooks: { fetch?: (transport: ReviewActTransport) => { bytes: string } }): { stdout: string; exit: number } {
   const { file, project } = readProject(dir);
+  const original = readFileSync(file);
+  let review: { act: ReopenAct; bytes: string } | undefined;
+  const result = (entry: JsonObject): { stdout: string; exit: number } => ({ stdout: json ? JSON.stringify(entry, null, 2) : `reopen: ${String(entry.stage)} by ${String(entry.by)} at ${String(entry.at)}`, exit: 0 });
+  const actId = opts['--from-review'];
+  if (actId !== undefined) {
+    const invalid = reviewActFindings(project)[0];
+    if (invalid) refuse(invalid.code, invalid.message);
+    const transport: ReviewActTransport = { ...reviewActTransport(dir, actId), kind: 'reopen' };
+    const bytes = hooks.fetch ? hooks.fetch(transport).bytes : fetchReviewActBytes(transport);
+    const act = decodeReviewAct(bytes, 'reopen');
+    if (act.jobId !== transport.jobId || act.actId !== actId || Date.parse(act.at) > now) {
+      refuse('REVIEW_ACT_INVALID', 'project.json.reopens: fetched act identity or date differs from the request; request the correct reopen act');
+    }
+    if (act.value.stage !== stage) refuse('REVIEW_ACT_KIND_MISMATCH', `project.json.reopens: act reopens ${act.value.stage}, not ${stage}; invoke reopen for the exported stage`);
+    const existing = asArray(project.review_acts).filter(isObject).find(entry => entry.jobId === act.jobId && entry.actId === actId);
+    if (existing) {
+      if (existing.kind !== 'reopen' || existing.bytes !== bytes) refuse('REVIEW_ACT_REPLAY_CONFLICT', 'project.json.review_acts: immutable reopen act changed; restore the original receipt');
+      return result(asArray(project.reopens)[Number(existing.reopen)] as JsonObject);
+    }
+    if (act.source.projectHash !== jobHash(original) || !isDeepStrictEqual(act.source.plan.steps,
+      asArray(isObject(project.plan) ? project.plan.steps : undefined).map(raw => ({ id: isObject(raw) ? raw.id : null, hash: isObject(raw) ? stepHash(raw) : null })))) {
+      refuse('REVIEW_ACT_SOURCE_STALE', 'project.json.reopens: displayed record or plan changed; request a reopen on the current record');
+    }
+    assertActSubjectDeclared(dir, act, 'project.json.reopens');
+    review = { act, bytes };
+  }
   const before = structuredClone(project);
   const steps = asArray(isObject(project.plan) ? project.plan.steps : undefined);
   if (steps.some(s => !isObject(s) || typeof s.id !== 'string' || (s.phase !== 'rig' && s.phase !== 'post'))) {
     refuse('REOPEN_MALFORMED', 'plan.steps: each step needs id and phase; restore the plan before reopening');
   }
   const affected = steps.filter((s): s is JsonObject => isObject(s)
-    && stageIndex(stageOfStep(s.phase as 'rig' | 'post', s.id as string)) >= stageIndex(positional[0] as string));
-  const entry: JsonObject = { from_stage: project.stage ?? null, steps_before: affected.map(s => ({ id: s.id as string, ...(s.status === undefined ? {} : { status: s.status }) })), stage: positional[0] as string, by: opts['--by'], at: new Date(now).toISOString(), verbatim: '' };
-  if (opts['--source'] !== undefined) entry.source = opts['--source'];
+    && stageIndex(stageOfStep(s.phase as 'rig' | 'post', s.id as string)) >= stageIndex(stage));
+  const entry: JsonObject = { from_stage: project.stage ?? null, steps_before: affected.map(s => ({ id: s.id as string, ...(s.status === undefined ? {} : { status: s.status }) })), stage, by: review?.act.authority.reviewer.id ?? opts['--by']!, at: review?.act.at ?? new Date(now).toISOString(), verbatim: '' };
+  if (review) entry.source = `review act ${review.act.jobId}/${review.act.actId}`;
+  else if (opts['--source'] !== undefined) entry.source = opts['--source'];
   const refusals: Finding[] = [];
   // Validate against the original reached stage before moving it backwards.
   const candidate = { ...project, reopens: [...asArray(project.reopens), entry] };
@@ -133,12 +188,20 @@ export function reopenCommand(args: string[], now: number): { stdout: string; ex
   collectReopens(candidate, refusals);
   const first = refusals[0];
   if (first !== undefined) refuse(first.code, first.message);
-  entry.verbatim = readVerbatim(opts['--verbatim-file'] ?? '-');
+  entry.verbatim = review ? review.act.value.words : readVerbatim(opts['--verbatim-file'] ?? '-');
   for (const step of affected) step.status = 'pending';
   project.reopens = candidate.reopens;
   project.stage = entry.stage;
+  if (review) {
+    project.review_acts = [...asArray(project.review_acts), { schema: 'rig-create/review-act@1', kind: 'reopen',
+      jobId: review.act.jobId, actId: review.act.actId, reopen: asArray(project.reopens).length - 1,
+      bytes: review.bytes, sha256: jobHash(review.bytes), version_hash: jobHash(JSON.stringify(entry)) }];
+    const invalid = reviewActFindings(project)[0];
+    if (invalid) refuse(invalid.code, invalid.message);
+  }
   const rejected = newRefusals(dir, before, project, { now })[0];
   if (rejected !== undefined) refuse(rejected.code, rejected.message);
+  if (review && !readFileSync(file).equals(original)) refuse('REVIEW_ACT_SOURCE_STALE', 'project.json.reopens: record changed during fetch; retry on the current record');
   writeFileSync(file, `${JSON.stringify(project, null, 2)}\n`);
-  return { stdout: json ? JSON.stringify(entry, null, 2) : `reopen: ${String(entry.stage)} by ${String(entry.by)} at ${String(entry.at)}`, exit: 0 };
+  return result(entry);
 }

package/src/review-act.ts

@@ -3,6 +3,8 @@ import { PARTS_CLI_RECEIPT } from './parts-verdict-record.ts';
 import { randomUUID } from 'node:crypto';
 import { readFileSync, realpathSync } from './check-reads.ts';
 import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { jobRuntimeExecArgv } from './job-writer.ts';
 import { isDeepStrictEqual } from 'node:util';
 import { JOB_COMMENTS_ACT_SCHEMA, parseCommentsAct, parseRecordAct, projectComments,
   type JobAct, type JobCommentPartsAnchor, type JobCommentsAct, type JobModelSourceBinding, type JobRigStill, type RecordAct } from '@rig-c/review/job-host';
@@ -28,6 +30,9 @@ export type PartsIssue = {
 };
 /** Review's JobAct now includes comments; legacy adapters keep their original source guarantees. */
 type LegacyJobAct = Exclude<JobAct, { schema: typeof JOB_COMMENTS_ACT_SCHEMA }>;
+export type ReopenAct = Extract<RecordAct, { kind: 'reopen' }>;
+export type ReviewActKind = 'review-verdict' | 'parts-verdict' | 'interview-picks' | 'checkpoint' | 'signoff' | 'reopen';
+export type DecodedReviewAct = ReviewVerdictAct | PartsVerdictAct | InterviewPicksAct | CheckpointAct | SignoffAct | ReopenAct;
 export type InterviewPicksAct = Extract<LegacyJobAct | RecordAct, { kind: 'interview-picks' }>;
 export type PartsVerdictActV2 = Extract<LegacyJobAct, { kind: 'parts-verdict' }>;
 export type PartsVerdictActV5 = Omit<PartsVerdictActV2, 'schema' | 'value'> & {
@@ -88,7 +93,7 @@ function failure(code: string, detail: string): never {
 }
 
 /** The shared decoder validates grammar; Create separately admits its existing source adapters. */
-function decodeCommentsReviewAct(raw: JsonObject, kind: 'review-verdict' | 'parts-verdict' | 'interview-picks' | 'checkpoint' | 'signoff'): ReviewVerdictAct | PartsVerdictAct | CheckpointAct | SignoffAct {
+function decodeCommentsReviewAct(raw: JsonObject, kind: ReviewActKind): ReviewVerdictAct | PartsVerdictAct | CheckpointAct | SignoffAct {
   if (kind === 'interview-picks' || raw.kind === 'interview-picks') failure('REVIEW_ACT_KIND_MISMATCH', 'comments acts do not carry interview answers');
   let act: JobCommentsAct;
   try { act = parseCommentsAct(raw); }
@@ -151,18 +156,22 @@ export function decodeReviewAct(bytes: string, kind: 'interview-picks'): Intervi
 export function decodeReviewAct(bytes: string, kind: 'parts-verdict'): PartsVerdictAct;
 export function decodeReviewAct(bytes: string, kind: 'checkpoint'): CheckpointAct;
 export function decodeReviewAct(bytes: string, kind: 'signoff'): SignoffAct;
-export function decodeReviewAct(bytes: string, kind: 'review-verdict' | 'parts-verdict' | 'interview-picks' | 'checkpoint' | 'signoff'): ReviewVerdictAct | PartsVerdictAct | InterviewPicksAct | CheckpointAct | SignoffAct;
-export function decodeReviewAct(bytes: string, kind: 'review-verdict' | 'parts-verdict' | 'interview-picks' | 'checkpoint' | 'signoff' = 'review-verdict'): ReviewVerdictAct | PartsVerdictAct | InterviewPicksAct | CheckpointAct | SignoffAct {
+export function decodeReviewAct(bytes: string, kind: 'reopen'): ReopenAct;
+export function decodeReviewAct(bytes: string, kind: ReviewActKind): DecodedReviewAct;
+export function decodeReviewAct(bytes: string, kind: ReviewActKind = 'review-verdict'): DecodedReviewAct {
   let act: JsonObject;
   try { const parsed: unknown = JSON.parse(bytes); if (!object(parsed)) throw Error(); act = parsed; }
   catch { return failure('REVIEW_ACT_INVALID', 'act is not a JSON object'); }
+  if (kind === 'reopen' && act.schema !== 'rig-review/act@4') failure('REVIEW_ACT_SCHEMA_UNSUPPORTED', 'reopen requires a record act@4');
+  if (act.schema === 'rig-review/act@4' && act.kind === 'reopen' && kind !== 'reopen') {
+    failure('REVIEW_ACT_KIND_MISMATCH', 'record reopen acts require the reopen writer');
+  }
   if (act.schema === JOB_COMMENTS_ACT_SCHEMA) return decodeCommentsReviewAct(act, kind);
-  if (act.schema === 'rig-review/act@4' && act.kind === 'reopen' && kind !== 'checkpoint') failure('REVIEW_ACT_SCHEMA_UNSUPPORTED', 'record reopen acts have no Create writer mapping');
-  if (['checkpoint', 'interview-picks', 'signoff'].includes(kind) && act.schema === 'rig-review/act@4') {
+  if (['checkpoint', 'interview-picks', 'signoff', 'reopen'].includes(kind) && act.schema === 'rig-review/act@4') {
     try {
       const recordAct = parseRecordAct(act);
       if (recordAct.kind !== kind) return failure('REVIEW_ACT_KIND_MISMATCH', 'record act kind differs from requested kind');
-      return recordAct as CheckpointAct | InterviewPicksAct | SignoffAct;
+      return recordAct as CheckpointAct | InterviewPicksAct | SignoffAct | ReopenAct;
     } catch { return failure('REVIEW_ACT_INVALID', 'record act or its sealed source is malformed'); }
   }
   if (act.schema !== 'rig-review/act@2' && !(kind === 'review-verdict' && act.schema === 'rig-review/act@3')
@@ -292,7 +301,7 @@ export function decodeReviewAct(bytes: string, kind: 'review-verdict' | 'parts-v
   return act as unknown as ReviewVerdictAct;
 }
 
-export function decodeReviewResponse(text: string, jobId: string, actId: string, requestId: string, kind: 'review-verdict' | 'parts-verdict' | 'interview-picks' | 'checkpoint' | 'signoff' = 'review-verdict'): { act: ReviewVerdictAct | PartsVerdictAct | InterviewPicksAct | CheckpointAct | SignoffAct; bytes: string } {
+export function decodeReviewResponse(text: string, jobId: string, actId: string, requestId: string, kind: ReviewActKind = 'review-verdict'): { act: DecodedReviewAct; bytes: string } {
   let response: JsonObject;
   try { const parsed: unknown = JSON.parse(text); if (!object(parsed)) throw Error(); response = parsed; }
   catch { return failure('REVIEW_ACT_INVALID', 'Review response is not JSON'); }
@@ -312,7 +321,23 @@ export interface ReviewActTransport {
   jobId: string;
   actId: string;
   fetchCapability: string;
-  kind?: 'parts-verdict' | 'interview-picks' | 'checkpoint' | 'signoff';
+  kind?: Exclude<ReviewActKind, 'review-verdict'>;
+}
+
+/** Synchronous writers use the same authenticated fetch/decoder through the private runtime. */
+export function fetchReviewActRuntime(transport: ReviewActTransport): { bytes: string; stillBytes?: string } {
+  const child = Bun.spawnSync([process.execPath, ...jobRuntimeExecArgv(), fileURLToPath(new URL('./review-act-runtime.ts', import.meta.url))], {
+    stdin: Buffer.from(JSON.stringify(transport)), stdout: 'pipe', stderr: 'pipe',
+  });
+  let response: { ok: boolean; bytes: string; stillBytes?: string; code: string; message: string };
+  try { response = JSON.parse(child.stdout.toString()); }
+  catch { return failure('REVIEW_ACT_FETCH_REFUSED', 'fetch adapter failed'); }
+  if (!response.ok || child.exitCode !== 0) refuse(response.code, response.message);
+  return { bytes: response.bytes, stillBytes: response.stillBytes };
+}
+
+export function fetchReviewActBytes(transport: ReviewActTransport): string {
+  return fetchReviewActRuntime(transport).bytes;
 }
 
 /** Only the route and fetch grant leave the binding reader. Never attach a host. */
@@ -329,7 +354,7 @@ export function reviewActTransport(root: string, actId: string): ReviewActTransp
   return { origin: origin.origin, jobId: binding.jobId, actId, fetchCapability: binding.fetchCapability };
 }
 
-export async function fetchReviewAct(transport: ReviewActTransport, fetchAdapter: typeof fetch = fetch): Promise<{ act: ReviewVerdictAct | PartsVerdictAct | InterviewPicksAct | CheckpointAct | SignoffAct; bytes: string; stillBytes?: string }> {
+export async function fetchReviewAct(transport: ReviewActTransport, fetchAdapter: typeof fetch = fetch): Promise<{ act: DecodedReviewAct; bytes: string; stillBytes?: string }> {
   const requestId = randomUUID();
   const request = JSON.stringify({ schema: 'rig-review/job-api@2', verb: 'fetch-act', jobId: transport.jobId, actId: transport.actId, requestId });
   async function read(accept: string): Promise<Response> {
@@ -342,7 +367,7 @@ export async function fetchReviewAct(transport: ReviewActTransport, fetchAdapter
       return response;
     } catch { return failure('REVIEW_ACT_FETCH_REFUSED', 'live Review fetch failed'); }
   }
-  if (transport.kind === 'parts-verdict' || transport.kind === 'interview-picks' || transport.kind === 'checkpoint' || transport.kind === 'signoff') return decodeReviewResponse(await (await read('application/json')).text(), transport.jobId, transport.actId, requestId, transport.kind);
+  if (transport.kind === 'parts-verdict' || transport.kind === 'interview-picks' || transport.kind === 'checkpoint' || transport.kind === 'signoff' || transport.kind === 'reopen') return decodeReviewResponse(await (await read('application/json')).text(), transport.jobId, transport.actId, requestId, transport.kind);
   const bytes = await (await read('application/vnd.rig-review.act+json')).text();
   const act = decodeReviewAct(bytes);
   if (act.jobId !== transport.jobId || act.actId !== transport.actId) failure('REVIEW_ACT_INVALID', 'fetched act identity differs from the request');
@@ -459,12 +484,12 @@ export function reviewActSignoff(act: SignoffAct): JsonObject {
  * acknowledged receipt keeps the subjects create published; a receipt that predates
  * them, or none (a clone), leaves only Review's own ask binding to vouch for it.
  */
-export function assertActSubjectDeclared(root: string, act: SignoffAct | CheckpointAct | InterviewPicksAct, path: string): void {
+export function assertActSubjectDeclared(root: string, act: SignoffAct | CheckpointAct | InterviewPicksAct | ReopenAct, path: string): void {
   const receipt = readAcknowledgedPublication(root, act.jobId, act.publicationId);
   if (receipt?.subjects === undefined) return;
-  const subject = act.kind === 'interview-picks' ? { kind: 'interview-picks', questionId: act.value.questionId, setId: act.source.optionSet.id } : act.kind === 'signoff' ? { kind: 'signoff', stage: act.value.stage } : { kind: 'checkpoint', checkpointId: act.value.checkpointId };
+  const subject = act.kind === 'interview-picks' ? { kind: 'interview-picks', questionId: act.value.questionId, setId: act.source.optionSet.id } : act.kind === 'signoff' || act.kind === 'reopen' ? { kind: act.kind, stage: act.value.stage } : { kind: 'checkpoint', checkpointId: act.value.checkpointId };
   if (receipt.subjects.some(declared => isDeepStrictEqual(declared, subject))) return;
-  const named = act.kind === 'interview-picks' ? `answers ${act.value.questionId}` : act.kind === 'signoff' ? `signs ${act.value.stage}` : `passes checkpoint ${act.value.checkpointId}`;
+  const named = act.kind === 'interview-picks' ? `answers ${act.value.questionId}` : act.kind === 'signoff' || act.kind === 'reopen' ? `${act.kind} ${act.value.stage}` : `passes checkpoint ${act.value.checkpointId}`;
   refuse('REVIEW_ACT_SUBJECT_UNDECLARED', `${path}: act ${act.jobId}/${act.actId} ${named}, which its publication ${act.publicationId} did not declare; ask for it in Review on a publication made while the record can sign it`);
 }
 
@@ -512,7 +537,7 @@ export function reviewActFindings(project: JsonObject): { code: string; path: st
     try {
       if (!object(entry) || entry.schema !== 'rig-create/review-act@1' || typeof entry.bytes !== 'string'
         || !sha(entry.sha256) || jobHash(entry.bytes) !== entry.sha256 || !sha(entry.version_hash)) failure('REVIEW_ACT_LEDGER_INVALID', 'receipt shape or bytes hash is invalid');
-      const act = decodeReviewAct(entry.bytes, entry.kind === 'parts-verdict' ? 'parts-verdict' : entry.kind === 'interview-picks' ? 'interview-picks' : entry.kind === 'checkpoint' ? 'checkpoint' : entry.kind === 'signoff' ? 'signoff' : 'review-verdict');
+      const act = decodeReviewAct(entry.bytes, entry.kind === 'parts-verdict' ? 'parts-verdict' : entry.kind === 'interview-picks' ? 'interview-picks' : entry.kind === 'checkpoint' ? 'checkpoint' : entry.kind === 'signoff' ? 'signoff' : entry.kind === 'reopen' ? 'reopen' : 'review-verdict');
       if (entry.jobId !== act.jobId || entry.actId !== act.actId) failure('REVIEW_ACT_LEDGER_INVALID', 'receipt identity differs from its act');
       const key = JSON.stringify([act.jobId, act.actId]);
       if (seen.has(key)) failure('REVIEW_ACT_REPLAY_CONFLICT', 'duplicate act receipt');
@@ -537,6 +562,16 @@ export function reviewActFindings(project: JsonObject): { code: string; path: st
         }
         return;
       }
+      if (act.kind === 'reopen') {
+        const recorded = Number.isSafeInteger(entry.reopen) && Number(entry.reopen) >= 0 ? asArray(project.reopens)[Number(entry.reopen)] : null;
+        if (!object(recorded) || entry.version_hash !== jobHash(JSON.stringify(recorded))
+          || recorded.stage !== act.value.stage || recorded.by !== act.authority.reviewer.id
+          || recorded.at !== act.at || recorded.verbatim !== act.value.words
+          || recorded.source !== `review act ${act.jobId}/${act.actId}`) {
+          failure('REVIEW_ACT_LEDGER_INVALID', 'recorded reopen differs from the immutable act');
+        }
+        return;
+      }
       if (act.kind === 'checkpoint') {
         const signoffs = Array.isArray(project.signoffs) ? project.signoffs : [];
         const signoff = Number.isSafeInteger(entry.signoff) && Number(entry.signoff) >= 0 ? signoffs[Number(entry.signoff)] : undefined;

package/src/review-package.ts

@@ -13,6 +13,7 @@ import { asArray, isObject, readJsonObject, type Ctx } from './check.ts';
 import { draftFileUnavailable, draftVersionFindings } from './drafts.ts';
 import { Refusal, refuse, USAGE_EXIT } from './refusal.ts';
 import { assertRigVersionDate, rigVersionDateFinding } from './rig-version-date.ts';
+import { registeredDepthPartsMatch } from './rig-version.ts';
 import { latestPartsApproval, retainedJson } from './structure.ts';
 import type { Json, JsonObject } from './templates.ts';
 
@@ -50,7 +51,8 @@ function checkBuildIdentity(ctx: Pick<Ctx, 'dir' | 'project' | 'refusals' | 'war
   const files = asArray(parts.files).filter(isObject);
   const manifest = files.find(file => file.path === `${parts.path}/parts.json`);
   const packaged = asArray(record.files).find(f => isObject(f) && f.path === 'out/parts.json');
-  if (isObject(manifest) && typeof manifest.sha256 === 'string' && isObject(packaged) && typeof packaged.sha256 === 'string' && manifest.sha256 !== packaged.sha256) {
+  if (isObject(manifest) && typeof manifest.sha256 === 'string' && isObject(packaged) && typeof packaged.sha256 === 'string' && manifest.sha256 !== packaged.sha256
+    && !registeredDepthPartsMatch(ctx.dir, version, manifest.sha256, packaged.sha256)) {
     mismatch('REVIEW_PACKAGE_PARTS_MISMATCH', 'files[out/parts.json]', manifest.sha256, packaged.sha256);
   }
   if (!isObject(manifest) || typeof manifest.path !== 'string') return;