sdd-agent-platform 0.4.2 → 0.5.1

package/node_modules/@sdd-agent-platform/core/src/workflow-gate/hard-checks.ts

@@ -1,182 +1,136 @@
-import type { WorkflowGateEvidencePacket, WorkflowGateHardCheck } from './types.js';
-
-type WorkflowGateHardCheckInput = Omit<WorkflowGateEvidencePacket, 'hardChecks'>;
-
-export function evaluateWorkflowGateHardChecks(packet: WorkflowGateHardCheckInput): WorkflowGateHardCheck[] {
-  return [
-    ...runtimeHealthChecks(packet),
-    ...documentChecks(packet),
-    ...latestEligibleChecks(packet),
-    ...dependencyChecks(packet),
-    ...affectedFileChecks(packet),
-    ...durableGapChecks(packet),
-    ...artifactChecks(packet),
-    ...authorityChecks(packet)
-  ];
-}
-
-function runtimeHealthChecks(packet: WorkflowGateHardCheckInput): WorkflowGateHardCheck[] {
-  if (packet.runtimeHealth.status === 'ok') {
-    return [];
-  }
-  return [blocked('schema_health_unavailable', packet.partition, `Runtime store health is unavailable: ${packet.runtimeHealth.issues.join('; ') || 'unknown issue'}.`, 'Repair runtime.sqlite schema or rerun after runtime storage is available.', packet.runtimeHealth.issues)];
-}
-
-function documentChecks(packet: WorkflowGateHardCheckInput): WorkflowGateHardCheck[] {
-  const checks: WorkflowGateHardCheck[] = [];
-  const docs = packet.documents;
-  const missing = [
-    ['spec.md', docs.specExists],
-    ['plan.md', docs.planExists],
-    ['tasks.md', docs.tasksExists],
-    ['verify.md', docs.verifyExists]
-  ].filter(([, exists]) => !exists).map(([name]) => String(name));
-  if (missing.length > 0) {
-    checks.push(blocked('missing_documents', packet.partition, `Missing workflow documents: ${missing.join(', ')}.`, 'Run the missing SDD document stages before gate evaluation.', missing));
-  }
-  const stale = [
-    ['plan.md', docs.planStale],
-    ['tasks.md', docs.tasksStale],
-    ['verify.md', docs.verifyStale]
-  ].filter(([, value]) => value === true).map(([name]) => String(name));
-  if (stale.length > 0) {
-    checks.push(blocked('stale_documents', packet.partition, `Stale workflow documents: ${stale.join(', ')}.`, 'Refresh the stale stage contract before continuing.', stale));
-  }
-  return checks;
-}
-
-function latestEligibleChecks(packet: WorkflowGateHardCheckInput): WorkflowGateHardCheck[] {
-  if (packet.decisionKind === 'test' && packet.workflowScope.runIds.length > 0) {
-    return [];
-  }
-  const scopedSelections = packet.latestEligibleSelections ?? [];
-  const selections = scopedSelections.length > 0 ? scopedSelections : (packet.latestEligibleSelection ? [packet.latestEligibleSelection] : []);
-  if (selections.length === 0) {
-    return [warning('latest_eligible_missing', packet.partition, 'No latest eligible selection is available.', 'Create a run or inspect task evidence before applying gate decisions.', [])];
-  }
-  return selections.flatMap((selection) => {
-    if (!selection.selected && selection.candidates.length > 0) {
-      return [blocked('run_rejected', packet.partition, `No default-eligible run for ${selection.taskId}; rejected candidates=${selection.rejected.length}.`, 'Inspect rejected latest-eligible candidates and resolve their reasons.', selection.rejected.map((candidate) => candidate.runId))];
-    }
-    if (!selection.selected) {
-      return [warning('latest_eligible_missing', packet.partition, `No run candidates found for ${selection.taskId}.`, 'Run implementation or validation before expecting gate PASS.', [])];
-    }
-    const selected = selection.selected;
-    if (selected.runStatus === 'blocked' || selected.runStatus === 'failed' || selected.runStatus === 'archived') {
-      return [blocked('blocked_failed_or_archived_run', packet.partition, `Selected run ${selected.runId} is ${selected.runStatus}.`, 'Use a non-blocked completed run before continuing.', [selected.runId])];
-    }
-    if (!selected.eligibleForDefaultApply || selected.compatibility === 'strict_stale' || selected.compatibility === 'incompatible') {
-      return [blocked('run_rejected', packet.partition, `Selected run ${selected.runId} is not eligible: ${selected.reasons.join('; ') || selected.compatibility}.`, 'Resolve run eligibility before continuing.', [selected.runId])];
-    }
-    if (selected.validationStatus === 'fail' || selected.validationStatus === 'blocked') {
-      return [blocked('validation_failure', packet.partition, `Selected run validation is ${selected.validationStatus}.`, 'Rerun validation and collect passing evidence.', [selected.runId])];
-    }
-    return [];
-  });
-}
-
-function dependencyChecks(packet: WorkflowGateHardCheckInput): WorkflowGateHardCheck[] {
-  return packet.dependencyBlockers.map((blocker) => blocked('dependency_blocker', packet.partition, blocker.reason, `Inspect dependency ${blocker.dependencyId} before continuing.`, [blocker.taskId, blocker.dependencyId]));
-}
-
-function affectedFileChecks(packet: WorkflowGateHardCheckInput): WorkflowGateHardCheck[] {
-  return packet.affectedFileConflicts.map((conflict) => blocked('affected_file_conflict', packet.partition, `Affected file ${conflict.file} is active in run ${conflict.runId}.`, 'Resolve active run conflict before applying changes.', [conflict.file, conflict.runId]));
-}
-
-function durableGapChecks(packet: WorkflowGateHardCheckInput): WorkflowGateHardCheck[] {
-  return packet.durableGaps
-    .filter((gap) => gap.status === 'open' || gap.status === 'acknowledged')
-    .filter((gap) => gap.severity === 'blocking')
-    .map((gap) => blocked('durable_gap_blocking', packet.partition, gap.message, gap.recommendation ?? 'Resolve the blocking durable gap before continuing.', [gap.gapId, ...gap.evidenceRefs]));
-}
-
-function artifactChecks(packet: WorkflowGateHardCheckInput): WorkflowGateHardCheck[] {
-  const checks: WorkflowGateHardCheck[] = [];
-  if (packet.selectedEvidence.source === 'legacy_active_payloads' || packet.selectedEvidence.source === 'candidate_payloads') {
-    checks.push(blocked('missing_evidence_selection', packet.partition, `Gate evidence resolved from ${packet.selectedEvidence.source} instead of an accepted selection pointer.`, 'Create or refresh the runtime accepted evidence set before gate PASS.', packet.selectedEvidence.payloads.map((payload) => payload.payloadId)));
-  }
-  if (packet.selectedEvidence.source === 'none' || packet.selectedEvidence.payloads.length === 0) {
-    checks.push(blocked('missing_evidence_selection', packet.partition, 'No runtime-selected evidence payloads are available for this gate.', 'Collect evidence and create a runtime accepted evidence selection before gate PASS.', packet.requiredArtifactRefs));
-  }
-  const nonConsumable = packet.selectedEvidence.payloads.filter((payload) => !isConsumablePayloadStatus(payload.status));
-  for (const payload of nonConsumable) {
-    checks.push(blocked('non_consumable_evidence', packet.partition, `Evidence ${payload.logicalRef} is ${payload.status} and cannot satisfy gate authority.`, 'Select accepted or current candidate evidence; keep rejected, superseded, quarantined, stale, partial, and active-attempt refs for audit only.', [payload.payloadId, payload.logicalRef, payload.status]));
-  }
-  const nonPrimary = packet.selectedEvidence.payloads.filter((payload) => isConsumablePayloadStatus(payload.status) && !isPrimaryGateEvidencePayload(payload));
-  for (const payload of nonPrimary) {
-    checks.push(warning('non_primary_evidence', packet.partition, `Evidence ${payload.logicalRef} has role ${payload.artifactRole} and cannot satisfy primary gate authority.`, 'Use selected primary stage evidence for gate obligations; keep diagnostic, derived, legacy, and reasoning refs outside primary evidence.', [payload.payloadId, payload.logicalRef, payload.artifactRole]));
-  }
-  const available = new Set(consumableEvidenceRefs(packet));
-  checks.push(...packet.requiredArtifactRefs
-    .filter((ref) => !available.has(ref))
-    .map((ref) => blocked('missing_required_artifact', packet.partition, `Required artifact ${ref} is missing from selected gate evidence.`, 'Collect required artifacts and include them in the accepted evidence selection before gate PASS.', [ref])));
-  for (const payload of packet.artifactPayloadHealth) {
-    if (payload.status === 'missing') {
-      checks.push(blocked('missing_payload', packet.partition, `Artifact payload ${payload.logicalRef} is missing at ${payload.physicalPayloadPath}.`, 'Restore the immutable payload or regenerate current evidence before gate PASS.', [payload.payloadId, payload.logicalRef, payload.physicalPayloadPath]));
-    } else if (payload.status === 'digest_drift') {
-      checks.push(blocked('digest_drift', packet.partition, `Artifact payload ${payload.logicalRef} digest drifted: expected ${payload.expectedDigest} actual ${payload.actualDigest}.`, 'Treat the payload as tampered or stale; regenerate accepted evidence before gate PASS.', [payload.payloadId, payload.logicalRef, payload.physicalPayloadPath]));
-    }
-  }
-  return checks;
-}
-
-function consumableEvidenceRefs(packet: WorkflowGateHardCheckInput): string[] {
-  if (packet.selectedEvidence.source === 'selection_pointer') {
-    if (packet.selectedEvidence.evidenceSet?.status !== 'accepted') {
-      return [];
-    }
-    return activePayloadRefs(packet);
-  }
-  if (packet.selectedEvidence.source === 'candidate_payloads') {
-    return activePayloadRefs(packet);
-  }
-  return [];
-}
-
-function activePayloadRefs(packet: WorkflowGateHardCheckInput): string[] {
-  return packet.selectedEvidence.payloads.filter((payload) => isConsumablePayloadStatus(payload.status) && isPrimaryGateEvidencePayload(payload)).map((payload) => payload.logicalRef);
-}
-
-function isConsumablePayloadStatus(status: string): boolean {
-  return status === 'active';
-}
-
-function isPrimaryGateEvidencePayload(payload: WorkflowGateHardCheckInput['selectedEvidence']['payloads'][number]): boolean {
-  const ref = payload.logicalRef.replace(/\\/g, '/').toLowerCase();
-  const role = payload.artifactRole.toLowerCase();
-  if (ref.startsWith('runs/') || ref.startsWith('artifacts/') || ref.includes('/evidence/artifacts/')) {
-    return false;
-  }
-  if (ref.includes('/test-index-') || ref.endsWith('.log')) {
-    return false;
-  }
-  return !/(command-output|test-index|diagnostic|derived|cache|profile|summary|context-package|acceptance-coverage|review|manager|handoff|collaboration)/.test(role);
-}
-
-
-function authorityChecks(packet: WorkflowGateHardCheckInput): WorkflowGateHardCheck[] {
-  const checks: WorkflowGateHardCheck[] = [];
-  for (const fanIn of packet.fanInEvidenceSets) {
-    if (fanIn.gateInputOnly !== true) {
-      checks.push(blocked('authority_violation', packet.partition, `Fan-in evidence set ${fanIn.fanInId} is not gate-input-only.`, 'Regenerate fan-in evidence as non-final gate input.', [fanIn.fanInId]));
-    }
-  }
-  for (const advisor of packet.advisorAssessments) {
-    if (advisor.advisoryOnly !== true) {
-      checks.push(blocked('authority_violation', packet.partition, `Advisor assessment ${advisor.assessmentId} is not advisory-only.`, 'Discard or regenerate advisor assessment as advisory-only.', [advisor.assessmentId]));
-    }
-  }
-  return checks;
-}
-
-function blocked(code: WorkflowGateHardCheck['code'], scope: string, message: string, recovery: string, refs: string[]): WorkflowGateHardCheck {
-  return { code, severity: 'blocked', scope, message, recovery, refs: sortedUnique(refs) };
-}
-
-function warning(code: WorkflowGateHardCheck['code'], scope: string, message: string, recovery: string, refs: string[]): WorkflowGateHardCheck {
-  return { code, severity: 'warning', scope, message, recovery, refs: sortedUnique(refs) };
-}
-
-function sortedUnique(values: string[]): string[] {
-  return [...new Set(values.filter(Boolean))].sort();
-}
+import type { WorkflowGateEvidencePacket, WorkflowGateHardCheck } from './types.js';
+
+type WorkflowGateHardCheckInput = Omit<WorkflowGateEvidencePacket, 'hardChecks'>;
+
+export function evaluateWorkflowGateHardChecks(packet: WorkflowGateHardCheckInput): WorkflowGateHardCheck[] {
+  return [
+    ...runtimeHealthChecks(packet),
+    ...documentChecks(packet),
+    ...latestEligibleChecks(packet),
+    ...dependencyChecks(packet),
+    ...affectedFileChecks(packet),
+    ...durableGapChecks(packet),
+    ...artifactChecks(packet),
+    ...authorityChecks(packet)
+  ];
+}
+
+function runtimeHealthChecks(packet: WorkflowGateHardCheckInput): WorkflowGateHardCheck[] {
+  if (packet.runtimeHealth.status === 'ok') {
+    return [];
+  }
+  return [blocked('schema_health_unavailable', packet.partition, `Runtime store health is unavailable: ${packet.runtimeHealth.issues.join('; ') || 'unknown issue'}.`, 'Repair runtime.sqlite schema or rerun after runtime storage is available.', packet.runtimeHealth.issues)];
+}
+
+function documentChecks(packet: WorkflowGateHardCheckInput): WorkflowGateHardCheck[] {
+  const checks: WorkflowGateHardCheck[] = [];
+  const docs = packet.documents;
+  const missing = [
+    ['spec.md', docs.specExists],
+    ['plan.md', docs.planExists],
+    ['tasks.md', docs.tasksExists],
+    ['verify.md', docs.verifyExists]
+  ].filter(([, exists]) => !exists).map(([name]) => String(name));
+  if (missing.length > 0) {
+    checks.push(blocked('missing_documents', packet.partition, `Missing workflow documents: ${missing.join(', ')}.`, 'Run the missing SDD document stages before gate evaluation.', missing));
+  }
+  const stale = [
+    ['plan.md', docs.planStale],
+    ['tasks.md', docs.tasksStale],
+    ['verify.md', docs.verifyStale]
+  ].filter(([, value]) => value === true).map(([name]) => String(name));
+  if (stale.length > 0) {
+    checks.push(blocked('stale_documents', packet.partition, `Stale workflow documents: ${stale.join(', ')}.`, 'Refresh the stale stage contract before continuing.', stale));
+  }
+  if (docs.verifyExists && !docs.verifyBasedOnTasksContractHash) {
+    checks.push(blocked('contract_hash_mismatch', packet.partition, 'verify.md is missing based_on_tasks_contract_hash.', 'Regenerate verify.md from the frozen current tasks contract.', ['verify.md', 'tasks.md']));
+  } else if (docs.verifyBasedOnTasksContractHash && docs.tasksContractHash && docs.verifyBasedOnTasksContractHash !== docs.tasksContractHash) {
+    checks.push(blocked('contract_hash_mismatch', packet.partition, 'verify.md is bound to an older tasks contract hash.', 'Regenerate verify.md from the frozen current tasks contract.', ['verify.md', 'tasks.md']));
+  }
+  return checks;
+}
+
+function latestEligibleChecks(packet: WorkflowGateHardCheckInput): WorkflowGateHardCheck[] {
+  const scopedSelections = packet.latestEligibleSelections ?? [];
+  const selections = scopedSelections.length > 0 ? scopedSelections : (packet.latestEligibleSelection ? [packet.latestEligibleSelection] : []);
+  if (selections.length === 0) {
+    return [warning('latest_eligible_missing', packet.partition, 'No latest eligible selection is available.', 'Create a run or inspect task evidence before applying gate decisions.', [])];
+  }
+  return selections.flatMap((selection) => {
+    if (!selection.selected && selection.candidates.length > 0) {
+      return [blocked('run_rejected', packet.partition, `No default-eligible run for ${selection.taskId}; rejected candidates=${selection.rejected.length}.`, 'Inspect rejected latest-eligible candidates and resolve their reasons.', selection.rejected.map((candidate) => candidate.runId))];
+    }
+    if (!selection.selected) {
+      return [warning('latest_eligible_missing', packet.partition, `No run candidates found for ${selection.taskId}.`, 'Run implementation or validation before expecting gate PASS.', [])];
+    }
+    const selected = selection.selected;
+    if (selected.runStatus === 'blocked' || selected.runStatus === 'failed' || selected.runStatus === 'archived') {
+      return [blocked('blocked_failed_or_archived_run', packet.partition, `Selected run ${selected.runId} is ${selected.runStatus}.`, 'Use a non-blocked completed run before continuing.', [selected.runId])];
+    }
+    if (!selected.eligibleForDefaultApply || selected.compatibility === 'strict_stale' || selected.compatibility === 'incompatible') {
+      return [blocked('run_rejected', packet.partition, `Selected run ${selected.runId} is not eligible: ${selected.reasons.join('; ') || selected.compatibility}.`, 'Resolve run eligibility before continuing.', [selected.runId])];
+    }
+    if (selected.validationStatus === 'fail' || selected.validationStatus === 'blocked') {
+      return [blocked('validation_failure', packet.partition, `Selected run validation is ${selected.validationStatus}.`, 'Rerun validation and collect passing evidence.', [selected.runId])];
+    }
+    return [];
+  });
+}
+
+function dependencyChecks(packet: WorkflowGateHardCheckInput): WorkflowGateHardCheck[] {
+  return packet.dependencyBlockers.map((blocker) => blocked('dependency_blocker', packet.partition, blocker.reason, `Inspect dependency ${blocker.dependencyId} before continuing.`, [blocker.taskId, blocker.dependencyId]));
+}
+
+function affectedFileChecks(packet: WorkflowGateHardCheckInput): WorkflowGateHardCheck[] {
+  return packet.affectedFileConflicts.map((conflict) => blocked('affected_file_conflict', packet.partition, `Affected file ${conflict.file} is active in run ${conflict.runId}.`, 'Resolve active run conflict before applying changes.', [conflict.file, conflict.runId]));
+}
+
+function durableGapChecks(packet: WorkflowGateHardCheckInput): WorkflowGateHardCheck[] {
+  return packet.durableGaps
+    .filter((gap) => gap.status === 'open' || gap.status === 'acknowledged')
+    .filter((gap) => gap.severity === 'blocking')
+    .map((gap) => blocked('durable_gap_blocking', packet.partition, gap.message, gap.recommendation ?? 'Resolve the blocking durable gap before continuing.', [gap.gapId, ...gap.evidenceRefs]));
+}
+
+function artifactChecks(packet: WorkflowGateHardCheckInput): WorkflowGateHardCheck[] {
+  const available = new Set([...packet.canonicalEvidenceRefs, ...packet.fanInEvidenceSets.flatMap((set) => [...set.canonicalEvidenceRefs, ...set.evidenceRefs])]);
+  const checks = packet.requiredArtifactRefs
+    .filter((ref) => !available.has(ref))
+    .map((ref) => blocked('missing_required_artifact', packet.partition, `Required artifact ${ref} is missing from gate evidence.`, 'Collect required artifacts before gate PASS.', [ref]));
+  for (const payload of packet.artifactPayloadHealth) {
+    if (payload.status === 'missing') {
+      checks.push(blocked('missing_payload', packet.partition, `Artifact payload ${payload.logicalRef} is missing at ${payload.physicalPayloadPath}.`, 'Restore the immutable payload or regenerate current evidence before gate PASS.', [payload.payloadId, payload.logicalRef, payload.physicalPayloadPath]));
+    } else if (payload.status === 'digest_drift') {
+      checks.push(blocked('digest_drift', packet.partition, `Artifact payload ${payload.logicalRef} digest drifted: expected ${payload.expectedDigest} actual ${payload.actualDigest}.`, 'Treat the payload as tampered or stale; regenerate accepted evidence before gate PASS.', [payload.payloadId, payload.logicalRef, payload.physicalPayloadPath]));
+    }
+  }
+  return checks;
+}
+
+
+function authorityChecks(packet: WorkflowGateHardCheckInput): WorkflowGateHardCheck[] {
+  const checks: WorkflowGateHardCheck[] = [];
+  for (const fanIn of packet.fanInEvidenceSets) {
+    if (fanIn.gateInputOnly !== true) {
+      checks.push(blocked('authority_violation', packet.partition, `Fan-in evidence set ${fanIn.fanInId} is not gate-input-only.`, 'Regenerate fan-in evidence as non-final gate input.', [fanIn.fanInId]));
+    }
+  }
+  for (const advisor of packet.advisorAssessments) {
+    if (advisor.advisoryOnly !== true) {
+      checks.push(blocked('authority_violation', packet.partition, `Advisor assessment ${advisor.assessmentId} is not advisory-only.`, 'Discard or regenerate advisor assessment as advisory-only.', [advisor.assessmentId]));
+    }
+  }
+  return checks;
+}
+
+function blocked(code: WorkflowGateHardCheck['code'], scope: string, message: string, recovery: string, refs: string[]): WorkflowGateHardCheck {
+  return { code, severity: 'blocked', scope, message, recovery, refs: sortedUnique(refs) };
+}
+
+function warning(code: WorkflowGateHardCheck['code'], scope: string, message: string, recovery: string, refs: string[]): WorkflowGateHardCheck {
+  return { code, severity: 'warning', scope, message, recovery, refs: sortedUnique(refs) };
+}
+
+function sortedUnique(values: string[]): string[] {
+  return [...new Set(values.filter(Boolean))].sort();
+}