ruvnet-brain 4.6.3 → 4.7.0

package/plugin/scripts/project-progression-suspension.mjs

@@ -1,60 +0,0 @@
-// Operator containment only (#390 B). No store, checkpoint, event, turn or search is disabled here.
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { randomUUID } from 'node:crypto';
-
-const suspendedResults = new WeakSet();
-export function progressionSuspensionFile(env = process.env) {
-  return path.join(env.RUVNET_BRAIN_STATE_DIR || path.join(env.HOME || os.homedir(), '.config', 'ruvnet-brain'), 'brain-progression-suspension');
-}
-export function operatorProgressionSuspension(env = process.env) {
-  if (env.RUVNET_BRAIN_PROGRESSION_SUSPENDED === '1') return { source: 'environment' };
-  if (env.RUVNET_BRAIN_PROGRESSION_SUSPENDED && env.RUVNET_BRAIN_PROGRESSION_SUSPENDED !== '0') {
-    throw new Error('invalid automatic progression suspension environment setting');
-  }
-  let value;
-  try { value = JSON.parse(fs.readFileSync(progressionSuspensionFile(env), 'utf8')); }
-  catch (error) { if (error.code === 'ENOENT') return null; throw new Error('automatic progression suspension policy unreadable or invalid'); }
-  if (value?.schemaVersion !== 1 || typeof value.suspended !== 'boolean') {
-    throw new Error('automatic progression suspension policy unreadable or invalid');
-  }
-  return value.suspended ? { source: 'operator-state' } : null;
-}
-export function automaticProgressionSuspensionResult(env = process.env, fields = {}) {
-  const control = operatorProgressionSuspension(env);
-  if (!control) return null;
-  const result = Object.freeze({ ...fields, progressionSuspended: true, progressionCaptured: false,
-    receipt: null, skipped: 'operator suspended automatic project progression', suspensionSource: control.source });
-  suspendedResults.add(result);
-  return result;
-}
-// A look-alike public flag is never authority to bypass an unexpected capture failure.
-export const isAutomaticProgressionSuspension = (result) => Boolean(result && suspendedResults.has(result));
-
-/** Explicit operator configuration: replacing this control file never touches evidence or queues. */
-export function setOperatorProgressionSuspension(suspended, { env = process.env } = {}) {
-  if (typeof suspended !== 'boolean') throw new TypeError('suspended must be a boolean');
-  const file = progressionSuspensionFile(env);
-  fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
-  const temporary = `${file}.${process.pid}.${randomUUID()}.tmp`;
-  try {
-    fs.writeFileSync(temporary, JSON.stringify({ schemaVersion: 1, suspended }), { flag: 'wx', mode: 0o600 });
-    fs.renameSync(temporary, file);
-  } finally { try { fs.unlinkSync(temporary); } catch { /* renamed or not created */ } }
-  return operatorProgressionSuspension(env);
-}
-
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
-  try {
-    const argv = process.argv.slice(2);
-    if (argv.length !== 1 || !['--suspend', '--resume', '--status'].includes(argv[0])) {
-      throw new Error('usage: project-progression-suspension.mjs --suspend | --resume | --status');
-    }
-    if (argv[0] !== '--status') setOperatorProgressionSuspension(argv[0] === '--suspend');
-    const control = operatorProgressionSuspension();
-    console.log(JSON.stringify({ automaticProgression: control ? 'operator-suspended' : 'enabled', source: control?.source || null,
-      evidencePreserved: true, explicitCheckpointsAvailable: true }));
-  } catch (error) { console.error(error.message); process.exitCode = 1; }
-}

package/plugin/scripts/project-transition-hook.mjs

@@ -1,246 +0,0 @@
-/** Observed transitions are context, never instructions or completion claims. */
-import fs from 'node:fs';
-import path from 'node:path';
-import crypto from 'node:crypto';
-import os from 'node:os';
-import { developmentHooksSuspended } from './development-maintenance.mjs';
-import { resolveTurnDb } from './turn-outcome-capture.mjs';
-import { privateTransitionObservation } from './turn-capture-privacy.mjs';
-import { automaticProgressionSuspensionResult } from './project-progression-suspension.mjs';
-import { execFileSync } from 'node:child_process';
-import { fileURLToPath } from 'node:url';
-import { redactText, normalizeToolOutcome } from './continuity-events.mjs';
-import { conditionNotice } from './continuity-journal.mjs';
-import { normalizeHostEvent } from './hook-input.mjs';
-import { resolveProjectStore } from './project-store-resolver.mjs';
-import { withProgressionReader } from './project-progression-reader.mjs';
-import { redactProgression, restoreProjectProgression, digestCanonical, validateProgressionSnapshot } from './project-progression-contract.mjs';
-import { runSessionSnapshotHook, effectiveBudgetMs, queueCapture, replayOutboxDetached, runOutboxReplay } from './session-snapshot-hook.mjs';
-
-const EVENTS = new Set(['UserPromptSubmit', 'PreToolUse', 'PostToolUse', 'PostToolUseFailure', 'SubagentStop']);
-const TOPICS = [
-  [/\b(agentdb|memory|recall|capture|checkpoint)\b/i, 'project memory'],
-  [/\b(test|tests|vitest|pytest|qa|check)\b/i, 'validation'],
-  [/\b(release|publish|deploy|deployment)\b/i, 'release'],
-  [/\b(doc|docs|documentation|readme)\b/i, 'documentation'],
-  [/\b(security|authentication|permission|secret)\b/i, 'security'],
-  [/\b(runtime|hook|hooks|process|session)\b/i, 'runtime integration'],
-  [/\b(ui|interface|page|browser)\b/i, 'user interface'],
-];
-const ACTIONS = ['fix', 'repair', 'implement', 'add', 'remove', 'update', 'audit', 'review', 'verify', 'test', 'explain', 'build'];
-const MEANINGFUL_TOOLS = /(?:^|__)(?:Write|Edit|MultiEdit|NotebookEdit|apply_patch|Bash|exec_command|write_stdin|agent_spawn|Task|Agent)$/i;
-
-// Classification deliberately returns dictionary words only. Redaction alone cannot
-// distinguish a password from an ordinary word in arbitrary free text.
-export function semanticIntent(text) {
-  const safe = String(text ?? '').slice(0, 8192);
-  const action = ACTIONS.find((word) => new RegExp(`\\b${word}\\b`, 'i').test(safe)) || 'discuss';
-  const topics = TOPICS.filter(([pattern]) => pattern.test(safe)).map(([, label]) => label);
-  return { action, subjects: topics.length ? topics : ['project work'] };
-}
-
-/** Selected user task clause, not a raw prompt archive and never authority to resume. */
-export function selectedUserIntent(value) {
-  if (typeof value !== 'string') return null;
-  const bounded = value.slice(0, 64 * 1024);
-  const redacted = redactText(bounded);
-  const prose = redacted.replace(/```[\s\S]*?(?:```|$)|~~~[\s\S]*?(?:~~~|$)/g, '');
-  const lines = prose.split(/\r?\n/).filter((line) => line.trim()
-    && !/^\s*(?:>|\{|\[|(?:tool|stdout|stderr|output|log|trace|result)\s*:|\d{4}-\d\d-\d\d)/i.test(line));
-  const selected = lines.find((line) => /\b(?:fix|repair|implement|add|remove|update|audit|review|verify|test|explain|build|why|how|what)\b/i.test(line));
-  if (!selected) return null;
-  const clause = selected.trim().split(/(?<=[.!?])\s/)[0].replace(/\s+/g, ' ');
-  if (/\[REDACTED|password|passwd|credential|private key|authorization|bearer|api.?key|secret|(?:access|auth)[-_ ]?token/i.test(clause)) return null;
-  let excerpt = '';
-  for (const character of clause) {
-    if (Buffer.byteLength(excerpt + character, 'utf8') > 240) break;
-    excerpt += character;
-  }
-  if (!excerpt) return null;
-  return { text: excerpt, source: 'user-prompt-excerpt', authoritative: false,
-    redacted: bounded !== redacted, truncated: excerpt !== clause || bounded !== value };
-}
-
-export function normalizeTransition(payload, event, { now = () => new Date().toISOString(), eventId = () => crypto.randomUUID(), host } = {}) {
-  const input = normalizeHostEvent(payload);
-  if (!EVENTS.has(event)) return { skipped: 'unsupported transition' };
-  if (!input || typeof input.session_id !== 'string' || !input.session_id) return { skipped: 'no session identity' };
-  const common = { id: eventId(), occurredAt: now(), trigger: event, source: 'host-observation', authoritative: false };
-  if (event === 'UserPromptSubmit') {
-    const text = input.prompt ?? input.user_prompt;
-    if (typeof text !== 'string' || !text.trim()) return { skipped: 'no user intent supplied' };
-    const selectedIntent = selectedUserIntent(text);
-    return { ...common, kind: 'user-goal-observation', intent: semanticIntent(text),
-      ...(selectedIntent ? { selectedIntent } : {}), outcome: 'requested' };
-  }
-  if (event === 'SubagentStop') return { ...common, kind: 'child-observation', outcome: 'child-stopped', parentGoalChanged: false };
-  if (!MEANINGFUL_TOOLS.test(String(input.tool_name ?? ''))) return { skipped: 'non-material tool observation' };
-  const toolInput = input.tool_input ?? {};
-  const response = input.tool_response && typeof input.tool_response === 'object' ? input.tool_response : {};
-  const normalized = normalizeToolOutcome({ ...input, content: input.tool_response,
-    ...(event === 'PostToolUseFailure' ? { is_error: true } : {}) });
-  const exitCode = normalized.exitCode;
-  const error = typeof response.error === 'string' && response.error ? redactText(response.error).slice(0, 4096) : undefined;
-  const signal = typeof response.signal === 'string' && response.signal ? redactText(response.signal).slice(0, 100) : undefined;
-  // Measured native Claude Bash PostToolUse has no exit code. Its completion envelope
-  // is host-reported success, never an inferred exit-code zero. Other hosts stay unknown.
-  const claudeBashCompletion = host === 'claude' && input.tool_name === 'Bash' && event === 'PostToolUse'
-    && typeof response.stdout === 'string' && typeof response.stderr === 'string'
-    && response.interrupted === false && typeof response.isImage === 'boolean'
-    && typeof response.noOutputExpected === 'boolean';
-  const outcome = event === 'PreToolUse' ? 'pending'
-    : normalized.outcome === 'fail' ? 'failure'
-    : ['interrupted', 'pending'].includes(normalized.outcome) ? normalized.outcome
-    : normalized.outcome === 'pass' || normalized.successfulToolResult ? 'success'
-    : !normalized.uncertain && (response.outcome === 'success' || claudeBashCompletion) ? 'success' : 'unknown';
-  return { ...common, kind: 'tool-observation', tool: String(input.tool_name).split('__').at(-1).slice(0, 100),
-    intent: semanticIntent(toolInput.description ?? toolInput.command ?? toolInput.cmd ?? toolInput.file_path), outcome,
-    ...(outcome === 'success' && claudeBashCompletion ? { outcomeEvidence: 'claude-bash-completion' } : {}),
-    ...(event !== 'PreToolUse' && Number.isSafeInteger(exitCode) ? { exitCode } : event !== 'PreToolUse' && (response.exit_code === null || response.exitCode === null) ? { exitCode: null } : {}),
-    ...(event !== 'PreToolUse' && error ? { error } : {}),
-    ...(event !== 'PreToolUse' && signal ? { signal } : {}) };
-}
-
-export function readTransitionHistory(resolution, { deadlineAt = Infinity } = {}) {
-  const remaining = () => { if (Date.now() >= deadlineAt) throw new Error('transition history deadline exceeded'); };
-  remaining();
-  const result = withProgressionReader(resolution.canonicalAgentDbPath, (reader) => {
-    const keys = reader.listKeys('project-progression');
-    // Complete ancestry under the shared deadline; never a lifetime row cap or latest-N window.
-    remaining();
-    return keys.map((key) => { remaining(); return JSON.parse(reader.readContent('project-progression', key)); });
-  });
-  if (!result.ok) throw new Error('canonical transition history unavailable');
-  return result.value;
-}
-
-export function buildTransitionProgression({ resolution, observation, snapshots = [], sessionIdentity, host, sourceIdentity: originalSourceIdentity }) {
-  const restored = restoreProjectProgression(snapshots, { expectedProjectIdentity: resolution.projectIdentity });
-  if (snapshots.length && !restored.ok) throw new Error('nonempty transition journal has no coherent ancestry');
-  return buildRestoredTransitionProgression({ resolution, observation, snapshots, sessionIdentity, host, sourceIdentity: originalSourceIdentity }, restored);
-}
-
-// Only the validated result computed in this module can reach this private builder.
-function buildRestoredTransitionProgression({ resolution, observation, snapshots, sessionIdentity, host, sourceIdentity: originalSourceIdentity }, restored) {
-  const heads = snapshots.filter((snapshot) => restored.heads.includes(snapshot.eventKey));
-  const prior = restored.state;
-  const empty = Object.fromEntries(['plan', 'completed', 'inProgress', 'blockers', 'failures', 'decisions', 'changedFiles', 'commands', 'proofArtifacts', 'untested', 'resumeConflicts'].map((key) => [key, []]));
-  const state = prior ? structuredClone(prior) : { ...empty, currentGoal: null, nextAction: null, acceptanceContract: null, activeProcess: null, activeStep: null };
-  delete state.sourceIdentity;
-  delete state.journalHeads;
-  state.activeStep = observation.trigger;
-  state.observations = [...(Array.isArray(state.observations) ? state.observations : []), observation];
-  if (observation.kind === 'tool-observation') {
-    state.commands = [...state.commands, observation];
-    if (['failure', 'interrupted'].includes(observation.outcome)) state.failures = [...state.failures, observation];
-  }
-  state.evidence = { ...(state.evidence ?? {}), transition: { originalEventId: observation.id, originalOccurredAt: observation.occurredAt,
-    sourceMeasurement: 'head-only; tree digests not measured at this boundary', authoritative: false } };
-  // Source identity was measured at observation time, never reconstructed by a later drainer.
-  const sourceIdentity = originalSourceIdentity || observeTransitionSource(resolution);
-  return redactProgression({ canonicalAgentDbPath: resolution.canonicalAgentDbPath, sourceIdentity,
-    sequence: Math.max(0, ...heads.map((item) => item.sequence)) + 1, occurredAt: observation.occurredAt,
-    parentEventKeys: restored.heads, dedupId: `${host}:${sessionIdentity}:${observation.id}`, completeProjectState: state }).value;
-}
-
-export function observeTransitionSource(resolution, projectDir = resolution.checkoutRoot) {
-  let head = 'unmeasured';
-  try { head = execFileSync('git', ['rev-parse', 'HEAD'], { cwd: resolution.checkoutRoot, encoding: 'utf8', timeout: 300, stdio: ['ignore', 'pipe', 'ignore'] }).trim(); } catch { /* explicitly unmeasured */ }
-  return { checkoutPath: resolution.checkoutRoot, capturePath: fs.realpathSync.native(projectDir),
-    worktreeId: crypto.createHash('sha256').update(resolution.checkoutRoot).digest('hex'), branch: 'unmeasured', head,
-    trackedDigest: 'unmeasured-at-transition', untrackedDigest: 'unmeasured-at-transition', dirtyTreeDigest: 'unmeasured-at-transition' };
-}
-
-/** Called only by the fenced queue drainer; current heads merge, original observations stay fixed. */
-export function captureNormalizedTransition(job, { readHistory = readTransitionHistory, capture = runSessionSnapshotHook,
-  budgetMs = 6500, makeStoreFactory, now = Date.now, env = process.env,
-  deadlineAt: inheritedDeadlineAt = Infinity, signal } = {}) {
-  const suspended = automaticProgressionSuspensionResult(env);
-  if (suspended) return suspended;
-  const deadlineAt = Math.min(inheritedDeadlineAt, now() + budgetMs);
-  const checkDeadline = () => { if (signal?.aborted || now() >= deadlineAt) throw new Error('restore deadline exceeded'); };
-  checkDeadline();
-  const resolution = resolveProjectStore({ projectDir: job.originProjectDir, gitTimeoutMs: Math.max(1, Math.min(500, budgetMs)), deadlineAt });
-  const normalized = job.payload.normalizedTransition;
-  if (!normalized || normalized.observation?.authoritative !== false || !normalized.observation?.id
-    || normalized.sourceIdentity?.checkoutPath !== resolution.checkoutRoot) throw new Error('invalid normalized transition binding');
-  const policy = resolveTurnDb({ projectDir: job.originProjectDir, brainHome: env.RUVNET_BRAIN_HOME || path.join(env.HOME || os.homedir(), '.cache', 'ruvnet-brain'), deadlineAt, signal });
-  checkDeadline();
-  if (policy.skipped) throw new Error(policy.skipped);
-  if (digestCanonical(privateTransitionObservation(normalized.observation, policy.contentPathExcludes, job.originProjectDir)) !== digestCanonical(normalized.observation)) throw new Error('content exclusions changed; immutable transition retained');
-  const snapshots = readHistory(resolution, { deadlineAt });
-  checkDeadline();
-  const restored = restoreProjectProgression(snapshots, { expectedProjectIdentity: resolution.projectIdentity });
-  if (snapshots.length && !restored.ok) {
-    throw new Error('nonempty transition journal has no coherent ancestry');
-  }
-  // A failed first store already fsynced a snapshot to the outbox. If startup/replay committed
-  // that snapshot before returning to its observation job, verify the same event rather than
-  // turn one observed action into a second event at a new sequence.
-  const dedupId = `${job.host}:${job.payload.session_id}:${normalized.observation.id}`;
-  const committed = snapshots.find((snapshot) => snapshot.dedupId === dedupId
-    && validateProgressionSnapshot(snapshot, { expectedProjectIdentity: resolution.projectIdentity }).ok
-    && digestCanonical(snapshot.sourceIdentity) === digestCanonical(normalized.sourceIdentity)
-    && snapshot.completeProjectState.observations?.some((value) => digestCanonical(value) === digestCanonical(normalized.observation)));
-  if (committed) return { progressionCaptured: true, eventId: normalized.observation.id,
-    receipt: { eventKey: committed.eventKey, payloadDigest: committed.payloadDigest,
-      readbackDigest: committed.payloadDigest, readPath: 'canonical progression reader' } };
-  const progression = buildRestoredTransitionProgression({ resolution, observation: normalized.observation,
-    snapshots, sessionIdentity: job.payload.session_id, host: job.host,
-    sourceIdentity: normalized.sourceIdentity }, restored);
-  checkDeadline();
-  const result = capture(job.originProjectDir, job.event, { host: job.host, env, budgetMs: Math.max(0, deadlineAt - now()), deadlineAt, signal,
-    ...(makeStoreFactory ? { makeStoreFactory } : {}), writeMetadata: false,
-    rawInput: JSON.stringify({ session_id: job.payload.session_id, hook_event_name: job.event, projectProgression: progression }),
-    captureTurn: () => ({ recorded: false, skipped: 'transition boundary' }),
-    captureEvents: () => ({ recorded: 0, skipped: 'transition boundary' }) });
-  return { ...result, eventId: normalized.observation.id };
-}
-
-export function runProjectTransitionHook(projectDir, event, { payload = {}, host = process.env.RUVNET_HOOK_HOST || 'claude',
-  readHistory = readTransitionHistory, capture = runSessionSnapshotHook, env = process.env } = {}) {
-  if (developmentHooksSuspended(projectDir)) return { state: 'skipped', reason: 'development hooks suspended' };
-  const suspended = automaticProgressionSuspensionResult(env, { state: 'suspended', reason: 'automatic project progression is operator-suspended' });
-  if (suspended) return suspended;
-  payload = normalizeHostEvent(payload);
-  let observation = normalizeTransition(payload, event, { host });
-  if (observation.skipped) return { state: 'skipped', reason: observation.skipped };
-  const brainHome = env.RUVNET_BRAIN_HOME || path.join(os.homedir(), '.cache', 'ruvnet-brain');
-  const consent = resolveTurnDb({ projectDir, brainHome, gitTimeoutMs: 500 });
-  if (consent.skipped) return { state: 'skipped', reason: consent.skipped };
-  observation = privateTransitionObservation(observation, consent.contentPathExcludes, projectDir, payload);
-  const resolution = resolveProjectStore({ projectDir, gitTimeoutMs: 500 });
-  if (!fs.existsSync(resolution.canonicalAgentDbPath)) return { state: 'skipped', reason: 'no adopted canonical store' };
-  const transportEvent = event === 'PostToolUseFailure' ? 'PostToolUse' : event;
-  // Fsync the selected observation BEFORE any history enumeration/merge. A deadline, corruption,
-  // or long-lived project must leave it pending rather than erase it or fabricate root ancestry.
-  const queued = queueCapture({ projectDir: resolution.projectRoot, originProjectDir: projectDir, env, event: transportEvent, host,
-    payload: { session_id: payload.session_id, hook_event_name: transportEvent,
-      normalizedTransition: { observation, sourceIdentity: observeTransitionSource(resolution, projectDir) } } });
-  if (!queued) return { state: 'degraded', reason: 'normalized observation queue unwritable', eventId: observation.id };
-  let result = null;
-  runOutboxReplay({ projectDir: resolution.projectRoot, env, budgetMs: Math.min(6500, effectiveBudgetMs(env)),
-    captureNormalized: (job, options) => captureNormalizedTransition(job, { ...options, env, readHistory, capture }),
-    onCaptured: (captured) => { if (captured?.eventId === observation.id) result = captured; } });
-  if (!result?.receipt) replayOutboxDetached({ projectDir: resolution.projectRoot, env });
-  return { state: result?.progressionCaptured && result.receipt ? 'committed' : 'pending', eventId: observation.id, result };
-}
-
-/** One pending-readback condition across prompt/tool boundaries and both CLI entrypoints. */
-export function transitionPendingNotice(projectDir, payload, message) {
-  const { projectRoot } = resolveProjectStore({ projectDir, gitTimeoutMs: 500 });
-  return conditionNotice({ swarm: path.join(projectRoot, '.swarm'),
-    session: normalizeHostEvent(payload)?.session_id, condition: 'project-transition-pending-readback', message });
-}
-
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
-  try {
-    const payload = JSON.parse(fs.readFileSync(0, 'utf8') || '{}');
-    const projectDir = payload.cwd || process.env.CLAUDE_PROJECT_DIR || process.cwd();
-    const result = runProjectTransitionHook(projectDir, process.argv[2], { payload });
-    if (result.state === 'pending') {
-      const message = transitionPendingNotice(projectDir, payload, 'Project memory transition is pending; exact AgentDB readback was not verified at this boundary.');
-      if (message) process.stdout.write(JSON.stringify({ hookSpecificOutput: { hookEventName: process.argv[2], additionalContext: message } }));
-    }
-  } catch { process.stdout.write(JSON.stringify({ systemMessage: 'Project memory transition capture degraded; exact readback was not verified.' })); }
-}

package/plugin/scripts/session-snapshot-contract.mjs

@@ -1,105 +0,0 @@
-import fs from 'node:fs';
-import path from 'node:path';
-
-export const SNAPSHOT_SCHEMA = 'ruvnet-brain.session-snapshot';
-export const SNAPSHOT_VERSION = 1;
-export const SNAPSHOT_MAX_AGE_MS = 30 * 24 * 60 * 60 * 1000;
-
-const EVENTS = new Set(['PreCompact', 'PostCompact', 'SessionEnd']);
-
-export function createSessionSnapshot({ event, capturedAt = new Date().toISOString() }) {
-  if (!EVENTS.has(event)) throw new Error(`unsupported snapshot event: ${event}`);
-  if (!Number.isFinite(Date.parse(capturedAt))) throw new Error('capturedAt must be an ISO-8601 timestamp');
-  return {
-    schema: SNAPSHOT_SCHEMA,
-    version: SNAPSHOT_VERSION,
-    capturedAt,
-    boundary: { event },
-    privacy: { rawTranscriptStored: false, credentialValuesStored: false },
-  };
-}
-
-export function validateSessionSnapshot(value) {
-  return Boolean(value)
-    && typeof value === 'object'
-    && !Array.isArray(value)
-    && value.schema === SNAPSHOT_SCHEMA
-    && value.version === SNAPSHOT_VERSION
-    && EVENTS.has(value.boundary?.event)
-    && Number.isFinite(Date.parse(value.capturedAt))
-    && value.privacy?.rawTranscriptStored === false
-    && value.privacy?.credentialValuesStored === false;
-}
-
-function freshness(capturedAt, now) {
-  const age = now - Date.parse(capturedAt);
-  return age >= 0 && age <= SNAPSHOT_MAX_AGE_MS;
-}
-
-function canonical(projectDir, now) {
-  const file = path.join(projectDir, '.swarm', 'agentdb-sessions.jsonl');
-  if (!fs.existsSync(file)) return { values: [], malformed: false };
-  try {
-    const stat = fs.lstatSync(file);
-    if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 4 * 1024 * 1024) {
-      return { values: [], malformed: true };
-    }
-    const lines = fs.readFileSync(file, 'utf8').trim().split('\n').filter(Boolean).slice(-128);
-    const values = [];
-    let malformed = false;
-    for (const line of lines) {
-      try {
-        const value = JSON.parse(line);
-        if (validateSessionSnapshot(value)) values.push({ kind: 'canonical', fresh: freshness(value.capturedAt, now), capturedAt: value.capturedAt });
-        else malformed = true;
-      } catch { malformed = true; }
-    }
-    return { values, malformed };
-  } catch { return { values: [], malformed: true }; }
-}
-
-function legacy(projectDir, now) {
-  const values = [];
-  let malformed = false;
-  for (const root of ['.claude', '.claude-flow']) {
-    const directory = path.join(projectDir, root, 'sessions');
-    if (!fs.existsSync(directory)) continue;
-    let names;
-    try {
-      const stat = fs.lstatSync(directory);
-      // A malformed ROOT (a stray file or symlink where `sessions/` should be a directory) must not
-      // discard every OTHER root's evidence. This used to `return` here, so a bad `.claude/sessions`
-      // entry made a genuinely fresh `.claude-flow/sessions` legacy session invisible to the whole
-      // scan — `continue` so the loop still inspects the remaining roots, same as the readdirSync
-      // catch below already does for an unreadable directory.
-      if (!stat.isDirectory() || stat.isSymbolicLink()) { malformed = true; continue; }
-      names = fs.readdirSync(directory).filter((name) => /^session-.*\.json$/.test(name)).slice(-64);
-    } catch { malformed = true; continue; }
-    for (const name of names) {
-      try {
-        const file = path.join(directory, name);
-        const stat = fs.lstatSync(file);
-        if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 1024 * 1024) { malformed = true; continue; }
-        const value = JSON.parse(fs.readFileSync(file, 'utf8'));
-        const capturedAt = value.endedAt || value.startedAt;
-        if (typeof value.id !== 'string' || !value.id || !value.context || !value.metrics || !Number.isFinite(Date.parse(capturedAt))) {
-          malformed = true;
-          continue;
-        }
-        values.push({ kind: 'legacy', fresh: freshness(capturedAt, now), capturedAt });
-      } catch { malformed = true; }
-    }
-  }
-  return { values, malformed };
-}
-
-export function inspectSessionSnapshots(projectDir, { now = Date.now() } = {}) {
-  const results = [canonical(projectDir, now), legacy(projectDir, now)];
-  const values = results.flatMap((result) => result.values);
-  const priority = { canonical: 0, legacy: 1 };
-  const fresh = values.filter((value) => value.fresh).sort((a, b) => priority[a.kind] - priority[b.kind] || Date.parse(b.capturedAt) - Date.parse(a.capturedAt))[0];
-  if (fresh) return fresh;
-  if (values.length) return values.sort((a, b) => priority[a.kind] - priority[b.kind] || Date.parse(b.capturedAt) - Date.parse(a.capturedAt))[0];
-  if (results.some((result) => result.malformed)) return { kind: 'malformed', fresh: false };
-  return { kind: 'absent', fresh: false };
-}

package/plugin/scripts/turn-transport-journal.mjs

@@ -1,108 +0,0 @@
-import fs from 'node:fs';
-import path from 'node:path';
-import crypto from 'node:crypto';
-
-export const digest = (value) => crypto.createHash('sha256').update(value).digest('hex');
-export const turnQueueDirectory = (db) => path.join(path.dirname(db), 'turn-outbox');
-function regular(file, directory = false) {
-  const stat = fs.lstatSync(file);
-  if (stat.isSymbolicLink() || (!directory && (!stat.isFile() || stat.nlink !== 1))
-    || (directory && (!stat.isDirectory() || fs.realpathSync.native(file) !== file))) throw new Error('unsafe turn journal path');
-}
-// Node's Windows directory handles do not consistently support fsync. Never weaken
-// file fsync or hide unexpected I/O errors; a missing namespace flush is reported.
-export function syncTurnDirectory(dir, { platform = process.platform, io = fs } = {}) {
-  let fd;
-  try {
-    fd = io.openSync(dir, 'r'); io.fsyncSync(fd);
-    return { platform, directoryFsync: 'completed' };
-  } catch (error) {
-    if (platform !== 'win32' || !['EISDIR', 'EPERM', 'EACCES', 'EINVAL', 'ENOTSUP', 'EBADF'].includes(error.code)) throw error;
-    return { platform, directoryFsync: 'unavailable', reason: error.code,
-      limitation: 'file fsync remains required; directory-entry persistence across power loss is unproven' };
-  } finally { if (fd !== undefined) io.closeSync(fd); }
-}
-// Legacy recipes are data extraction inputs only, never executable commands.
-export function storeData(step) {
-  if (step?.kind !== 'store' || !Array.isArray(step.args) || step.args[0] !== 'memory' || step.args[1] !== 'store') throw new Error('invalid turn store operation');
-  const fields = {}; const aliases = { '-k': 'key', '--key': 'key', '--value': 'value', '-n': 'namespace', '--namespace': 'namespace', '--path': 'db', '--tags': 'tags', '--provenance': 'provenance' };
-  let strict = false; let native = false; let immutable = false;
-  for (let i = 2; i < step.args.length; i++) {
-    const flag = step.args[i];
-    if (flag === '--append-only') { if (immutable) throw new Error('duplicate turn store flag'); immutable = true; continue; }
-    if (flag === '--require-native') { if (native) throw new Error('duplicate turn store flag'); native = true; continue; }
-    if (flag === '--no-upsert') { if (strict) throw new Error('duplicate turn store flag'); strict = true; continue; }
-    const field = aliases[flag];
-    if (!field || Object.hasOwn(fields, field) || typeof step.args[i + 1] !== 'string') throw new Error('unknown or duplicate turn store flag');
-    fields[field] = step.args[++i];
-  }
-  if (!fields.key || typeof fields.value !== 'string' || fields.namespace !== 'turns' || !path.isAbsolute(fields.db || '')) throw new Error('invalid turn store namespace or data');
-  return { key: fields.key, value: fields.value, db: fields.db };
-}
-const bindingOf = (step) => ({ projectRoot: step.projectRoot, projectDir: step.projectDir, rootIdentity: step.rootIdentity });
-function validateBinding(binding) {
-  if (!binding || Object.keys(binding).some((key) => !['projectRoot', 'projectDir', 'rootIdentity'].includes(key))
-    || !path.isAbsolute(binding.projectRoot || '') || !path.isAbsolute(binding.projectDir || '')
-    || typeof binding.rootIdentity !== 'string' || !/^\d+:\d+$/.test(binding.rootIdentity)) throw new Error('invalid turn canonical binding');
-}
-export function journalTurn(step, db, key, { platform = process.platform, io = fs, onDurability } = {}) {
-  const dir = turnQueueDirectory(db);
-  fs.mkdirSync(dir, { recursive: true, mode: 0o700 }); regular(dir, true);
-  const file = path.join(dir, `${digest(key)}.json`);
-  const data = storeData(step);
-  if (data.db !== db || data.key !== key) throw new Error('turn journal identity mismatch');
-  const binding = bindingOf(step); validateBinding(binding);
-  const record = { schemaVersion: 2, key, value: data.value, contentDigest: digest(data.value), consentScope: 'canonical-project-and-path', binding };
-  let created = false;
-  try {
-    const fd = io.openSync(file, 'wx', 0o600);
-    created = true;
-    try { io.writeFileSync(fd, JSON.stringify(record)); io.fsyncSync(fd); } finally { io.closeSync(fd); }
-  } catch (error) {
-    if (error.code !== 'EEXIST') throw error;
-    const previous = readJournal(file, db);
-    if (previous.key !== key || previous.contentDigest !== record.contentDigest) throw new Error('turn journal identity collision');
-    // Reflush an existing complete entry: its creator may have died before fsync.
-    const fd = io.openSync(file, 'r+');
-    try { io.fsyncSync(fd); } finally { io.closeSync(fd); }
-  }
-  const evidence = { fileFsync: 'completed', entry: created ? 'created-exclusively' : 'existing-exact-match-reflushed', ...syncTurnDirectory(dir, { platform, io }) };
-  if (onDurability) onDurability(evidence);
-  return file;
-}
-export function readJournal(file, db) {
-  const dir = turnQueueDirectory(db); regular(dir, true);
-  if (path.dirname(file) !== dir) throw new Error('foreign turn journal rejected');
-  regular(file);
-  const record = JSON.parse(fs.readFileSync(file, 'utf8'));
-  let normalized = record;
-  if (record.schemaVersion === 1) {
-    const data = storeData(record.step);
-    if (!record.step.args.includes('--no-upsert')) throw new Error('legacy turn journal requires strict insert');
-    if (data.db !== db || data.key !== record.key) throw new Error('legacy turn journal identity mismatch');
-    // Legacy job-selected consent settings are never consumed; caller policy governs replay.
-    normalized = { schemaVersion: 2, key: data.key, value: data.value, contentDigest: record.contentDigest,
-      consentScope: record.consentScope, binding: bindingOf(record.step), legacyBrainHome: record.step.brainHome };
-  } else if (Object.keys(record).some((key) => !['schemaVersion', 'key', 'value', 'contentDigest', 'consentScope', 'binding'].includes(key))) throw new Error('unknown turn journal field');
-  validateBinding(normalized.binding);
-  if (normalized.schemaVersion !== 2 || normalized.consentScope !== 'canonical-project-and-path'
-    || typeof normalized.key !== 'string' || !normalized.key.startsWith('turn-') || normalized.key.length > 250
-    || typeof normalized.value !== 'string' || normalized.value.length > 4000
-    || digest(normalized.value) !== normalized.contentDigest
-    || path.basename(file) !== `${digest(normalized.key)}.json`) throw new Error('invalid turn journal');
-  return normalized;
-}
-export function pendingTurnFiles(db, limit = 10) {
-  const dir = turnQueueDirectory(db);
-  try { regular(dir, true); } catch (error) { if (error.code === 'ENOENT') return []; throw error; }
-  return fs.readdirSync(dir).filter((name) => /^[a-f0-9]{64}\.json$/.test(name)).sort().slice(0, Math.min(25, Math.max(0, limit))).map((name) => path.join(dir, name));
-}
-export function acknowledgeJournal(file, db, options = {}) {
-  readJournal(file, db); fs.unlinkSync(file); return syncTurnDirectory(path.dirname(file), options);
-}
-export function appendReceipt(file, row) {
-  fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
-  if (fs.existsSync(file)) regular(file);
-  const fd = fs.openSync(file, 'a', 0o600);
-  try { fs.writeFileSync(fd, `${JSON.stringify(row)}\n`); fs.fsyncSync(fd); } finally { fs.closeSync(fd); }
-}

package/scripts/qa/progression-validation-benchmark.mjs

@@ -1,66 +0,0 @@
-/** Source-bound synthetic validation comparison; deliberately excludes database/host I/O. */
-import fs from 'node:fs';
-import path from 'node:path';
-import crypto from 'node:crypto';
-import { fileURLToPath, pathToFileURL } from 'node:url';
-import { performance } from 'node:perf_hooks';
-import { createProgressionSnapshot, restoreProjectProgression, digestCanonical } from '../../plugin/scripts/project-progression-contract.mjs';
-
-const flag = (name) => process.argv[process.argv.indexOf(name) + 1];
-if (!process.argv.includes('--baseline-module') || !process.argv.includes('--output')) {
-  throw new Error('Require --baseline-module <unchanged contract module> --output <receipt.json>');
-}
-const baselinePath = path.resolve(flag('--baseline-module'));
-const baseline = await import(pathToFileURL(baselinePath).href);
-const currentPath = fileURLToPath(new URL('../../plugin/scripts/project-progression-contract.mjs', import.meta.url));
-const hash = (file) => crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
-const sizes = (process.argv.includes('--sizes') ? flag('--sizes') : '100,400,1000').split(',').map(Number);
-if (!sizes.every(n => Number.isSafeInteger(n) && n > 0 && n <= 10_000)) throw new Error('sizes must be positive integers <= 10000');
-const projectIdentity = { id: 'synthetic-validation', canonicalAgentDbPath: '/synthetic/project/.swarm/memory.db' };
-const sourceIdentity = { checkoutPath: '/synthetic/project', worktreeId: 'primary', branch: 'main', head: 'a'.repeat(40),
-  trackedDigest: 'b'.repeat(64), untrackedDigest: 'c'.repeat(64), dirtyTreeDigest: 'd'.repeat(64) };
-const empty = Object.fromEntries(['plan', 'completed', 'inProgress', 'blockers', 'failures', 'decisions',
-  'changedFiles', 'commands', 'proofArtifacts', 'untested', 'resumeConflicts'].map(k => [k, []]));
-const receipt = { scope: 'Synthetic CPU-only complete-history validation; no native capture/restore deadline claim',
-  node: process.version, platform: process.platform, arch: process.arch,
-  sources: { baseline: { path: baselinePath, sha256: hash(baselinePath) }, candidate: { path: currentPath, sha256: hash(currentPath) } },
-  workloads: [] };
-for (const size of sizes) {
-  const snapshots = [], observations = [];
-  let parents = [];
-  for (let sequence = 1; sequence <= size; sequence++) {
-    observations.push({ id: `event-${sequence}`, occurredAt: '2026-10-05T00:00:00.000Z', trigger: 'PostToolUse',
-      kind: 'tool-observation', source: 'host-observation', authoritative: false, outcome: 'success', exitCode: 0,
-      intent: { action: 'verify', subjects: ['project memory'] }, tool: 'exec_command' });
-    const snapshot = createProgressionSnapshot({ projectIdentity, sourceIdentity,
-      hostIdentity: { host: 'codex', adapterVersion: 'synthetic-benchmark' }, sessionIdentity: 'synthetic',
-      sequence, parentEventKeys: parents, occurredAt: '2026-10-05T00:00:00.000Z', trigger: 'PostToolUse', dedupId: `event-${sequence}`,
-      completeProjectState: { ...empty, currentGoal: 'Preserve complete history', nextAction: 'Validate all evidence',
-        acceptanceContract: { required: ['exact equality'] }, activeProcess: 'verification', activeStep: 'PostToolUse',
-        observations: [...observations], commands: [...observations] } });
-    snapshots.push(snapshot); parents = [snapshot.eventKey];
-  }
-  const run = (restore) => {
-    const started = performance.now();
-    const value = restore(snapshots, { expectedProjectIdentity: projectIdentity });
-    return { ms: performance.now() - started, value };
-  };
-  const original = run(baseline.restoreProjectProgression);
-  const candidate = run(restoreProjectProgression);
-  if (JSON.stringify(original.value) !== JSON.stringify(candidate.value)) throw new Error('full restored result differs from baseline');
-  // Check a historical mutation whose digest was not recomputed, not just the current head.
-  const oldGoal = snapshots[0].completeProjectState.currentGoal;
-  snapshots[0].completeProjectState.currentGoal = 'tampered historical state';
-  const mutatedOriginal = baseline.restoreProjectProgression(snapshots, { expectedProjectIdentity: projectIdentity });
-  const mutatedCandidate = restoreProjectProgression(snapshots, { expectedProjectIdentity: projectIdentity });
-  if (JSON.stringify(mutatedOriginal) !== JSON.stringify(mutatedCandidate) || mutatedCandidate.ok) {
-    throw new Error('historical mutation negative semantics differ');
-  }
-  snapshots[0].completeProjectState.currentGoal = oldGoal;
-  receipt.workloads.push({ snapshots: size, bytes: snapshots.reduce((n, s) => n + Buffer.byteLength(JSON.stringify(s)), 0),
-    baselineMs: original.ms, candidateMs: candidate.ms, resultDigest: digestCanonical(candidate.value),
-    fullResultEqual: true, historicalMutationRejected: true, observations: candidate.value.state.observations.length,
-    commands: candidate.value.state.commands.length, peakRssKiB: process.resourceUsage().maxRSS });
-  fs.writeFileSync(path.resolve(flag('--output')), JSON.stringify(receipt, null, 2));
-  process.stdout.write(`${JSON.stringify(receipt.workloads.at(-1))}\n`);
-}

package/scripts/session-snapshot-contract.mjs

@@ -1 +0,0 @@
-export * from '../plugin/scripts/session-snapshot-contract.mjs';