scrumrun 2.0.0 → 2.1.1

package/lib/runtime/request-engine.js

@@ -3,51 +3,56 @@
 const { sha256 } = require("../v2/artifacts");
 const { buildContextPackage } = require("./context");
 const { containsSecret } = require("../security/secrets");
+const { evaluatePolicy, normalized } = require("./policy-engine");
+const { workspaceState } = require("./workspace-state");
 
 function assessRisk(request) {
-  const text = request.toLowerCase();
-  const high = ["delete", "drop ", "migration", "migrate", "payment", "pricing", "auth", "permission", "security", "secret", "production", "publish", "release", "deploy"];
-  const medium = ["database", "schema", "api", "cache", "performance", "refactor", "dependency", "upgrade", "rename", "move"];
-  const reasons = [];
-  for (const term of high) if (text.includes(term)) reasons.push(`high-impact term: ${term.trim()}`);
-  if (reasons.length) return { level: "high", reasons: [...new Set(reasons)].slice(0, 6) };
-  for (const term of medium) if (text.includes(term)) reasons.push(`cross-cutting term: ${term}`);
-  if (reasons.length) return { level: "medium", reasons: [...new Set(reasons)].slice(0, 6) };
+  const text = normalized(request);
+  const high = [
+    ["destructive", /\b(delete|drop|truncate|erase|wipe|apagar|excluir|remover tudo)\b/],
+    ["migration", /\b(migrat\w*|migrac\w*)\b/],
+    ["external-release", /\b(publish|release|deploy|publicar|lancar|implant|producao)\b/],
+    ["security-boundary", /\b(auth|authorization|permission|security|secret|credential|autentic|autoriz|permiss|seguranca|segredo|credencial)\b/],
+    ["money", /\b(payment|pricing|billing|pagamento|preco|faturamento)\b/]
+  ];
+  const medium = [
+    ["data-or-contract", /\b(database|schema|api|contract|banco|contrato)\b/],
+    ["runtime-kernel", /\b(runtime|kernel|transaction|journal|recovery|multi-file|transacion|recuperac|multi-arquivo)\b/],
+    ["performance-or-cache", /\b(cache|performance|latency|index|desempenho|latencia|indice)\b/],
+    ["dependency-or-upgrade", /\b(dependency|upgrade|package|version|dependencia|atualiz|versao)\b/],
+    ["cross-cutting-change", /\b(refactor|rename|move|architecture|cli|refator|renome|mover|arquitetura)\b/]
+  ];
+  const highSignals = high.filter(([, matcher]) => matcher.test(text)).map(([signal]) => `high-impact signal: ${signal}`);
+  if (highSignals.length) return { level: "high", reasons: highSignals.slice(0, 6) };
+  const mediumSignals = medium.filter(([, matcher]) => matcher.test(text)).map(([signal]) => `cross-cutting signal: ${signal}`);
+  if (mediumSignals.length) return { level: "medium", reasons: mediumSignals.slice(0, 6) };
   return { level: "low", reasons: ["no high-impact signals detected; validate scope before execution"] };
 }
 
 function classifyRequest(request) {
-  const text = request.toLowerCase();
+  const text = normalized(request);
   if (/\b(investigat|analy[sz]|study|discover|pesquis|analis|estud|descobr)/.test(text)) {
     return { type: "discovery", taskType: "discovery", reason: "request is primarily knowledge-seeking" };
   }
-  if (/\b(bug|fix|broken|regression|erro|falha|corrigir|consert)/.test(text)) {
+  if (/\b(bug|fix|broken|regression|erro|falha|corrigir|consertar)\b/.test(text)) {
     return { type: "fix", taskType: "fix", reason: "request describes corrective work" };
   }
-  if (/\b(feature|initiative|epic|iniciativa|funcionalidade)\b/.test(text)) {
+  if (/\b(initiative|epic|roadmap|program|iniciativa|programa)\b/.test(text)) {
     return { type: "feature", taskType: "feature", reason: "request describes a long-lived product initiative" };
   }
-  if (/\b(sprint|timebox|batch|release train|lote)\b/.test(text)) {
+  if (/\b(sprint|timebox|batch|release train|lote)\b/.test(text) && /\b(tasks?|tarefas?|entregas?)\b/.test(text)) {
     return { type: "sprint", taskType: "task", reason: "request explicitly asks for a timebox or delivery batch" };
   }
-  if (/\b(document|docs|readme|typo|texto|documenta)/.test(text)) {
+  const documentation = /\b(document|docs|readme|typo|texto|documenta)/.test(text);
+  const implementation = /\b(implement\w*|build\w*|creat\w*|add\w*|runtime|kernel|schema|migrat\w*|migrac\w*|transaction\w*|code|cli|criar|adicionar|construir|codigo|transacion\w*)\b/.test(text);
+  if (documentation && !implementation) {
     return { type: "task", taskType: "docs", reason: "request appears bounded to documentation" };
   }
   return { type: "task", taskType: "task", reason: "request is best represented as one atomic Task" };
 }
 
 function applyPolicy(context) {
-  const violations = [];
-  if (context.layout === "v1") violations.push("Project must be explicitly migrated to v2 before approved execution.");
-  if (containsSecret(context.request)) violations.push("Request appears to contain a secret; remove/redact it before planning or persistence.");
-  if (context.warnings.some((warning) => warning.includes("Secret-like content"))) violations.push("Canonical project context contains secret-like content; remove it before planning.");
-  if (!context.guardrails.length) violations.push("No active canonical guardrail could be loaded.");
-  if (context.warnings.some((warning) => warning.includes("guardrails.md"))) violations.push("Canonical guardrails are missing.");
-  return {
-    status: violations.length ? "blocked" : "passed",
-    checked: context.guardrails.map((guardrail) => guardrail.id),
-    violations
-  };
+  return evaluatePolicy(context);
 }
 
 function stableJson(value) {
@@ -67,6 +72,7 @@ function encodeApproval(plan) {
     classification: plan.classification,
     risk: plan.risk,
     policy: plan.policy,
+    workspaceFingerprint: plan.workspaceFingerprint,
     issuedAt: plan.issuedAt
   };
   const encoded = Buffer.from(stableJson(payload)).toString("base64url");
@@ -94,6 +100,7 @@ function planRequest(projectRoot, request) {
   if (!normalized) throw new Error("A non-empty request is required for intake.");
   if (normalized.length > 10000) throw new Error("Request exceeds the 10,000 character intake limit.");
   const context = buildContextPackage(projectRoot, normalized);
+  const workspaceFingerprint = workspaceState(projectRoot).fingerprint;
   const policy = applyPolicy(context);
   const risk = assessRisk(normalized);
   const classification = classifyRequest(normalized);
@@ -102,6 +109,7 @@ function planRequest(projectRoot, request) {
     pipeline: ["received", "contextualizing", "policy", "risk", "classification", "planning", policy.status === "passed" ? "awaiting_approval" : "blocked"],
     request: normalized,
     context,
+    workspaceFingerprint,
     policy,
     risk,
     classification,

package/lib/runtime/review-service.js

@@ -0,0 +1,92 @@
+"use strict";
+
+const path = require("node:path");
+const { ArtifactRepository, METHOD_VERSION, withArtifactLock } = require("../v2/artifacts");
+const { auditProject } = require("../v2/conformance");
+const { assertCanonicalWrite } = require("./mutation-gateway");
+
+function today() {
+  return new Date().toISOString().slice(0, 10);
+}
+
+function oneLine(value, label) {
+  const text = String(value || "").replace(/\s+/g, " ").trim();
+  if (!text) throw new Error(`${label} is required.`);
+  if (text.length > 500) throw new Error(`${label} exceeds 500 characters.`);
+  return text;
+}
+
+function nextReviewId(repository) {
+  const highest = repository.list("review").reduce((max, artifact) => {
+    const match = artifact.record.id.match(/-(\d+)$/);
+    return match ? Math.max(max, Number(match[1])) : max;
+  }, 0);
+  return `REV-${String(highest + 1).padStart(3, "0")}`;
+}
+
+function recordArtifactReviewUnlocked(projectRoot, options) {
+  const scrumDir = path.join(projectRoot, ".scrumrun");
+  const repository = new ArtifactRepository(scrumDir);
+  const taskId = oneLine(options.task, "task");
+  const task = repository.read("task", taskId);
+  if (!task || task.errors.length) throw new Error(`Review Task is missing or invalid: ${taskId}`);
+  const runId = options.run ? oneLine(options.run, "run") : null;
+  if (runId) {
+    const run = repository.read("run", runId);
+    if (!run || run.errors.length) throw new Error(`Review Run is missing or invalid: ${runId}`);
+    if (run.record.task !== taskId) throw new Error(`${runId} belongs to ${run.record.task}, not ${taskId}.`);
+  }
+  const title = oneLine(options.title || `Artifact conformance review for ${runId || taskId}`, "title");
+  const suppliedEvidence = (Array.isArray(options.evidence) ? options.evidence : []).map((item) => oneLine(item, "evidence"));
+  const audit = auditProject(projectRoot);
+  const created = today();
+  const record = {
+    id: nextReviewId(repository),
+    kind: "review",
+    status: audit.passed ? "passed" : "failed",
+    created,
+    updated: created,
+    method: METHOD_VERSION,
+    task: taskId
+  };
+  const findings = audit.findings.length
+    ? audit.findings.map((finding) => `- ${finding.severity}: ${finding.code} — ${finding.message}`)
+    : ["- No conformance findings."];
+  const evidence = [
+    `- Artifact audit: ${audit.invariants} invariants; ${audit.findings.length} finding(s); passed=${audit.passed}.`,
+    ...(runId ? [`- Run under review: ${runId}.`] : []),
+    ...suppliedEvidence.map((item) => `- ${item}`)
+  ];
+  const verdict = audit.passed
+    ? "Passed. The machine-readable artifact audit has no blocking finding."
+    : "Failed. Blocking conformance findings must be resolved in a separately authorized mutation.";
+  const body = [
+    `# ${title}`,
+    "",
+    "## Scope",
+    "",
+    `Review canonical project conformance for ${runId || taskId}.`,
+    "",
+    "## Evidence",
+    "",
+    ...evidence,
+    "",
+    "## Findings",
+    "",
+    ...findings,
+    "",
+    "## Verdict",
+    "",
+    verdict
+  ].join("\n");
+  assertCanonicalWrite(projectRoot, "record-artifact-review", [title, ...suppliedEvidence, body]);
+  repository.write(record, body);
+  return { review: repository.read("review", record.id), audit };
+}
+
+function recordArtifactReview(projectRoot, options = {}) {
+  const scrumDir = path.join(projectRoot, ".scrumrun");
+  return withArtifactLock(scrumDir, "review-artifact", () => recordArtifactReviewUnlocked(projectRoot, options));
+}
+
+module.exports = { recordArtifactReview };