run402 4.69.3 → 4.69.5

package/sdk/dist/node/gitvault-publication.js

@@ -3507,6 +3507,7 @@ export class GitvaultVault {
      */
     async push(options) {
         let conflicts = 0;
+        let removalRotated = false;
         let base = options.base ?? (await this.materialize());
         for (;;) {
             // gitvault-multi-writer (task 5.8) — checked fresh on EVERY attempt
@@ -3518,10 +3519,34 @@ export class GitvaultVault {
             // the ordinary GITVAULT_WRITER_NOT_ADMITTED on the first attempt.
             this.assertCallerIsWriter("publishing gitvault head", conflicts > 0);
             const evaluation = await evaluateRefTransaction(base.refs, options.transaction, { isAncestor: (a, d) => isAncestor(this.git(), a, d), protocol_refs: options.protocol_refs });
-            const published = await this.publishGeneration({
-                base, refs: evaluation.refs, dropped: evaluation.dropped, head_target: options.head_target ?? base.head_target,
-                force_checkpoint: options.checkpoint === true, cutoff: options.cutoff ?? null, capture_binding: options.capture_binding,
-            });
+            let published;
+            try {
+                published = await this.publishGeneration({
+                    base, refs: evaluation.refs, dropped: evaluation.dropped, head_target: options.head_target ?? base.head_target,
+                    force_checkpoint: options.checkpoint === true, cutoff: options.cutoff ?? null, capture_binding: options.capture_binding,
+                });
+            }
+            catch (e) {
+                // gitvault-human-envelopes D5 ("Remove: next capture rotates the
+                // epoch key to the remaining set") / gitvault-multi-writer D6: an
+                // outstanding MEMBERSHIP REMOVAL is completed by the next push of any
+                // surviving writer — rotate under the writer-capable
+                // reason:"member_removed", re-materialize on the rotated chain, and
+                // retry this push once. Every OTHER cause the gate names (a
+                // migration bootstrap, an epoch-secret exposure) stays THROWN, with
+                // the enriched next_actions naming its owner + step-up remedy.
+                const details = isRun402Error(e) && e.code === "EPOCH_ROTATION_REQUIRED"
+                    ? (e.details ?? {})
+                    : null;
+                const removalOnly = details !== null && (details.revocation_outstanding === true || details.writer_removal_outstanding === true)
+                    && details.migration_required !== true && details.exposure_outstanding !== true;
+                if (!removalOnly || removalRotated)
+                    throw e;
+                removalRotated = true;
+                await this.rotateEpochForMemberRemoval();
+                base = await this.materialize();
+                continue;
+            }
             if (published.outcome === "conflict") {
                 conflicts += 1;
                 if (conflicts > this.retries)
@@ -3960,6 +3985,20 @@ export class GitvaultVault {
                 fail("GITVAULT_DESIRED_STATE_UNAVAILABLE", "the gateway did not report desired-recipient state (desired[]) for this vault — an epoch rotation cannot compute its H-partition without it", "computing the epoch-rotation H-partition");
             }
             const pinManifest = await this.loadEffectivePinManifest(base.generation);
+            // The vault record: `writer_set` (the chain's active writers, by
+            // principal) and `ineligible_members` (the gateway-blocked writers this
+            // rotation's writer_set_update must remove). Read ONCE here; both the
+            // H-partition below and the writer_set_update fold-in further down use it.
+            const vaultRecord = await this.transport.getVaultRecord({ repo_id: this.repoId });
+            const ineligible = vaultRecord.ineligible_members ?? [];
+            // kygit-handoff's member-removal decision: a keyed desired recipient
+            // whose signing key is an active writer AND survives this rotation is
+            // included on its current directory fingerprint, pin or no pin (the
+            // writer set is client-signed chain state — the same authority that
+            // lets it sign heads). Mirrors the gateway's own rule under its fence.
+            const blockedWriterPrincipalIds = new Set(ineligible.map((m) => m.principal_id));
+            const survivingWriterPrincipalIds = new Set((vaultRecord.writer_set?.writers ?? []).map((w) => w.principal_id).filter((id) => !blockedWriterPrincipalIds.has(id)));
+            const directoryFingerprintOf = new Map(desired.filter((d) => d.status === "active" && d.ek_fingerprint).map((d) => [d.principal_id, d.ek_fingerprint]));
             // D196's H-partition: included / excluded_keyless / excluded_unconfirmed.
             // A `pending_removal` desired-recipient row is EXCLUDED from H entirely
             // (the gateway's own H is `status='active'` only) — that omission is
@@ -3977,6 +4016,21 @@ export class GitvaultVault {
                 }
                 const pinned = pinManifest.pinnedFingerprintOf.get(d.principal_id);
                 if (pinned === undefined) {
+                    if (survivingWriterPrincipalIds.has(d.principal_id)) {
+                        // A surviving writer without a pin: included on the directory key.
+                        let pub;
+                        try {
+                            pub = fromBase64url(d.public_key, "public_key");
+                        }
+                        catch {
+                            fail("VALIDATION_FAILED", `surviving writer ${d.principal_id}'s directory public key is not valid base64url`, "computing the epoch-rotation H-partition");
+                        }
+                        if (ekFingerprint(pub) !== d.ek_fingerprint) {
+                            fail("VALIDATION_FAILED", `surviving writer ${d.principal_id}'s directory public key does not hash to its declared fingerprint`, "computing the epoch-rotation H-partition");
+                        }
+                        included.push({ principal_id: d.principal_id, ek_fingerprint: d.ek_fingerprint, public_key: pub });
+                        continue;
+                    }
                     excludedUnconfirmed.push(d.principal_id);
                     continue;
                 }
@@ -4017,7 +4071,7 @@ export class GitvaultVault {
             // Self-consistency (defense in depth — the gateway's own recomputation under its live lock is authoritative).
             const desiredIds = new Set(desired.filter((d) => d.status === "active").map((d) => d.principal_id));
             const keyedIds = new Set(desired.filter((d) => d.status === "active" && d.ek_fingerprint).map((d) => d.principal_id));
-            const hCheck = checkHPartition({ desiredPrincipalIds: desiredIds, keyedPrincipalIds: keyedIds, pinnedFingerprintOf: pinManifest.pinnedFingerprintOf, included, excludedKeylessPrincipalIds: excludedKeyless, excludedUnconfirmedPrincipalIds: excludedUnconfirmed });
+            const hCheck = checkHPartition({ desiredPrincipalIds: desiredIds, keyedPrincipalIds: keyedIds, pinnedFingerprintOf: pinManifest.pinnedFingerprintOf, included, excludedKeylessPrincipalIds: excludedKeyless, excludedUnconfirmedPrincipalIds: excludedUnconfirmed, survivingWriterPrincipalIds, directoryFingerprintOf });
             if (!hCheck.ok)
                 fail("VALIDATION_FAILED", `internal: the H-partition this producer built is not a valid bijection over H (${hCheck.detail}) — refusing to submit a rotation the gateway would refuse`, "computing the epoch-rotation H-partition");
             const targetPartitionDigest = computeTargetPartitionDigest({
@@ -4057,8 +4111,6 @@ export class GitvaultVault {
             // with zero client changes — the fold-in doesn't care WHY a key
             // is blocked, only THAT it is.
             const writerPin = this.repoFile().writer_set_pin;
-            const vaultRecord = await this.transport.getVaultRecord({ repo_id: this.repoId });
-            const ineligible = vaultRecord.ineligible_members ?? [];
             let writerSetUpdate = null;
             if (ineligible.length > 0) {
                 if (!writerPin) {
@@ -4090,10 +4142,19 @@ export class GitvaultVault {
             }
             // D195: build + sign the rotation_attempt_descriptor, derive rotation_id, submit the create-only CAS BEFORE any envelope upload.
             const clientIdempotencyKey = options.client_idempotency_key ?? newHex32();
+            // D204 (rev 43): `migration_bootstrap` is schema-optional but the
+            // gateway's fence requires the boolean on BOTH the descriptor and the
+            // payload, and requires the two to agree with its own locked branch
+            // value (the vault's migration flag AND no predecessor manifest). This
+            // producer never drives the bootstrap branch — that is the pre-rev-42
+            // repair ceremony, which co-rides a first manifest — so it declares
+            // `false`; omitting the field is refused RECIPIENT_SET_MISMATCH.
+            const migrationBootstrap = false;
             const descriptorFields = {
                 format: GITVAULT_FORMAT, object_kind: "rotation_attempt_descriptor", suite: GITVAULT_SUITE,
                 repo_id: this.repoId, base_head_sha256: base.head_sha256, new_epoch: newEpoch,
                 recipient_state_version: options.recipient_state_version, recipient_revocation_version: options.recipient_revocation_version,
+                migration_bootstrap: migrationBootstrap,
                 pin_manifest_sha256: pinManifest.pinManifestSha256, target_partition_digest: targetPartitionDigest,
                 client_idempotency_key: clientIdempotencyKey, writer_key_id: this.writerKeyId(),
                 // D227 (rev 47): present together IFF this rotation carries a writer_set_update — frozen at THIS attempt's own admission fence, mirroring recipient_state_version/recipient_revocation_version's existing discipline.
@@ -4122,6 +4183,7 @@ export class GitvaultVault {
             const payloadBase = {
                 new_epoch: newEpoch, rotation_id: rotationId, reason: options.reason,
                 recipient_state_version: options.recipient_state_version, recipient_revocation_version: options.recipient_revocation_version,
+                migration_bootstrap: migrationBootstrap,
                 pin_manifest_sha256: pinManifest.pinManifestSha256, target_partition_digest: targetPartitionDigest,
                 epoch_key_commitment: epochKeyCommitmentValue, excluded_keyless_principal_ids: excludedKeyless, excluded_unconfirmed_principal_ids: excludedUnconfirmed,
                 recipient_authority_attestation: null, envelopes: sealedReceipts,
@@ -4266,6 +4328,27 @@ export class GitvaultVault {
             };
         }
     }
+    /**
+     * The writer-capable rotation that completes an org membership removal
+     * (gitvault-multi-writer D6: "`member_removed` keeps its automatic
+     * writer-capable path"). The removal itself already advanced the org's
+     * D194 counters and flipped the member to `pending_removal`, so there is
+     * nothing to declare: read the counters off the envelope-recipients read
+     * (the same read the H-partition uses) and rotate under
+     * `reason:"member_removed"`, which needs `gitvault.writer` only — any
+     * surviving writer can run it, no owner step-up. Refuses
+     * `GITVAULT_ROTATION_COUNTERS_UNAVAILABLE` on a gateway that does not yet
+     * carry the counters on that read.
+     */
+    async rotateEpochForMemberRemoval(options = {}) {
+        const recipients = await this.transport.listEnvelopeRecipients({ repo_id: this.repoId });
+        const state = recipients.recipient_state_version;
+        const revocation = recipients.recipient_revocation_version;
+        if (typeof state !== "string" || typeof revocation !== "string") {
+            fail("GITVAULT_ROTATION_COUNTERS_UNAVAILABLE", "the gateway did not report the org's rotation counters on the envelope-recipients read — a member-removal rotation cannot be fenced without them; an owner can run `run402 repos access revoke-key <principal_id>` instead", "reading the rotation counters");
+        }
+        return this.rotateEpoch({ reason: "member_removed", recipient_state_version: state, recipient_revocation_version: revocation, client_idempotency_key: options.client_idempotency_key });
+    }
     /**
      * The ONE fully self-contained rotation entry point: declares
      * `reason:"recipient_key_revoked"` (owner + step-up) for `principal_id`,