sdd-agent-platform 0.4.2 → 0.5.1

package/node_modules/@sdd-agent-platform/core/src/doctor/checks/run-records.ts

@@ -1,79 +1,79 @@
-import {
-  AGENT_EXECUTION_RECORD_CONTRACT_VERSION,
-  AGENT_ROUTER_CONTRACT_VERSION,
-  TEAM_MODE_POLICY_VERSION,
-  TEAM_SESSION_RECORD_CONTRACT_VERSION
-} from '../../contracts.js';
-import { contractIssue, type ContractValidationIssue } from '../../contracts/issues.js';
-import type { AgentExecutionRecord, AgentExecutionRecordStatus, TeamSessionRecord, TeamSessionRecordStatus } from '../../router/agent-runtime.js';
-
-export function validateAgentExecutionRecordShape(runId: string, record: AgentExecutionRecord): ContractValidationIssue[] {
-  const issues: ContractValidationIssue[] = [];
-  if (record.version !== AGENT_EXECUTION_RECORD_CONTRACT_VERSION) {
-    issues.push(contractIssue('version', `Expected ${AGENT_EXECUTION_RECORD_CONTRACT_VERSION}.`, 'Rewrite the execution record through the Phase 6 runtime record writer.'));
-  }
-  if (record.runId !== runId) {
-    issues.push(contractIssue('runId', `Expected runId ${runId}.`, 'Keep agent execution records under the matching run directory.'));
-  }
-  if (!record.executionId) {
-    issues.push(contractIssue('executionId', 'Agent execution record is missing executionId.', 'Persist the record with a stable execution id.'));
-  }
-  if (!record.taskId) {
-    issues.push(contractIssue('taskId', 'Agent execution record is missing taskId.', 'Route execution records through a concrete SDD task.'));
-  }
-  if (!isAgentExecutionRecordStatus(record.status)) {
-    issues.push(contractIssue('status', `Unknown agent execution status ${String(record.status)}.`, 'Use claimed/completed/failed/blocked/skipped.'));
-  }
-  if (!isStringList(record.capabilitiesUsed)) {
-    issues.push(contractIssue('capabilitiesUsed', 'Agent execution capabilities must be a string array.', 'Record capability ids selected by AgentRouterDecision.'));
-  }
-  if (!isStringList(record.artifacts)) {
-    issues.push(contractIssue('artifacts', 'Agent execution artifacts must be a string array.', 'Record run-relative artifact paths.'));
-  }
-  if (!isRecord(record.routeDecision) || record.routeDecision.version !== AGENT_ROUTER_CONTRACT_VERSION) {
-    issues.push(contractIssue('routeDecision', 'Agent execution record must embed the Phase 6 router decision snapshot.', 'Persist records via router preflight or host adapter ingestion.'));
-  }
-  return issues;
-}
-
-export function validateTeamSessionRecordShape(runId: string, record: TeamSessionRecord): ContractValidationIssue[] {
-  const issues: ContractValidationIssue[] = [];
-  if (record.version !== TEAM_SESSION_RECORD_CONTRACT_VERSION) {
-    issues.push(contractIssue('version', `Expected ${TEAM_SESSION_RECORD_CONTRACT_VERSION}.`, 'Rewrite the team session record through the Phase 6 runtime record writer.'));
-  }
-  if (record.runId !== runId) {
-    issues.push(contractIssue('runId', `Expected runId ${runId}.`, 'Keep team session records under the matching run directory.'));
-  }
-  if (!record.teamId) {
-    issues.push(contractIssue('teamId', 'Team session record is missing teamId.', 'Persist the record with a stable team id.'));
-  }
-  if (!isTeamSessionRecordStatus(record.status)) {
-    issues.push(contractIssue('status', `Unknown team session status ${String(record.status)}.`, 'Use created/completed/blocked/disabled.'));
-  }
-  if (!isStringList(record.memberProfiles)) {
-    issues.push(contractIssue('memberProfiles', 'Team member profiles must be a string array.', 'Record selected team member profiles from TeamModePolicy.'));
-  }
-  if (!Array.isArray(record.messages)) {
-    issues.push(contractIssue('messages', 'Team messages must be an array.', 'Record structured TeamMessageRecord entries.'));
-  }
-  if (!isRecord(record.teamMode) || record.teamMode.version !== TEAM_MODE_POLICY_VERSION) {
-    issues.push(contractIssue('teamMode', 'Team session record must embed TeamModePolicy.', 'Persist records via team-mode preflight.'));
-  }
-  return issues;
-}
-
-function isStringList(value: unknown): value is string[] {
-  return Array.isArray(value) && value.every((item) => typeof item === 'string');
-}
-
-function isAgentExecutionRecordStatus(value: unknown): value is AgentExecutionRecordStatus {
-  return value === 'claimed' || value === 'completed' || value === 'failed' || value === 'blocked' || value === 'skipped';
-}
-
-function isTeamSessionRecordStatus(value: unknown): value is TeamSessionRecordStatus {
-  return value === 'created' || value === 'completed' || value === 'blocked' || value === 'disabled';
-}
-
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === 'object' && value !== null;
-}
+import {
+  AGENT_EXECUTION_RECORD_CONTRACT_VERSION,
+  AGENT_ROUTER_CONTRACT_VERSION,
+  TEAM_MODE_POLICY_VERSION,
+  TEAM_SESSION_RECORD_CONTRACT_VERSION
+} from '../../contracts.js';
+import { contractIssue, type ContractValidationIssue } from '../../contracts/issues.js';
+import type { AgentExecutionRecord, AgentExecutionRecordStatus, TeamSessionRecord, TeamSessionRecordStatus } from '../../router/agent-runtime.js';
+
+export function validateAgentExecutionRecordShape(runId: string, record: AgentExecutionRecord): ContractValidationIssue[] {
+  const issues: ContractValidationIssue[] = [];
+  if (record.version !== AGENT_EXECUTION_RECORD_CONTRACT_VERSION) {
+    issues.push(contractIssue('version', `Expected ${AGENT_EXECUTION_RECORD_CONTRACT_VERSION}.`, 'Rewrite the execution record through the Phase 6 runtime record writer.'));
+  }
+  if (record.runId !== runId) {
+    issues.push(contractIssue('runId', `Expected runId ${runId}.`, 'Keep agent execution records under the matching run directory.'));
+  }
+  if (!record.executionId) {
+    issues.push(contractIssue('executionId', 'Agent execution record is missing executionId.', 'Persist the record with a stable execution id.'));
+  }
+  if (!record.taskId) {
+    issues.push(contractIssue('taskId', 'Agent execution record is missing taskId.', 'Route execution records through a concrete SDD task.'));
+  }
+  if (!isAgentExecutionRecordStatus(record.status)) {
+    issues.push(contractIssue('status', `Unknown agent execution status ${String(record.status)}.`, 'Use claimed/completed/failed/blocked/skipped.'));
+  }
+  if (!isStringList(record.capabilitiesUsed)) {
+    issues.push(contractIssue('capabilitiesUsed', 'Agent execution capabilities must be a string array.', 'Record capability ids selected by AgentRouterDecision.'));
+  }
+  if (!isStringList(record.artifacts)) {
+    issues.push(contractIssue('artifacts', 'Agent execution artifacts must be a string array.', 'Record run-relative artifact paths.'));
+  }
+  if (!isRecord(record.routeDecision) || record.routeDecision.version !== AGENT_ROUTER_CONTRACT_VERSION) {
+    issues.push(contractIssue('routeDecision', 'Agent execution record must embed the Phase 6 router decision snapshot.', 'Persist records via router preflight or host adapter ingestion.'));
+  }
+  return issues;
+}
+
+export function validateTeamSessionRecordShape(runId: string, record: TeamSessionRecord): ContractValidationIssue[] {
+  const issues: ContractValidationIssue[] = [];
+  if (record.version !== TEAM_SESSION_RECORD_CONTRACT_VERSION) {
+    issues.push(contractIssue('version', `Expected ${TEAM_SESSION_RECORD_CONTRACT_VERSION}.`, 'Rewrite the team session record through the Phase 6 runtime record writer.'));
+  }
+  if (record.runId !== runId) {
+    issues.push(contractIssue('runId', `Expected runId ${runId}.`, 'Keep team session records under the matching run directory.'));
+  }
+  if (!record.teamId) {
+    issues.push(contractIssue('teamId', 'Team session record is missing teamId.', 'Persist the record with a stable team id.'));
+  }
+  if (!isTeamSessionRecordStatus(record.status)) {
+    issues.push(contractIssue('status', `Unknown team session status ${String(record.status)}.`, 'Use created/completed/blocked/disabled.'));
+  }
+  if (!isStringList(record.memberProfiles)) {
+    issues.push(contractIssue('memberProfiles', 'Team member profiles must be a string array.', 'Record selected team member profiles from TeamModePolicy.'));
+  }
+  if (!Array.isArray(record.messages)) {
+    issues.push(contractIssue('messages', 'Team messages must be an array.', 'Record structured TeamMessageRecord entries.'));
+  }
+  if (!isRecord(record.teamMode) || record.teamMode.version !== TEAM_MODE_POLICY_VERSION) {
+    issues.push(contractIssue('teamMode', 'Team session record must embed TeamModePolicy.', 'Persist records via team-mode preflight.'));
+  }
+  return issues;
+}
+
+function isStringList(value: unknown): value is string[] {
+  return Array.isArray(value) && value.every((item) => typeof item === 'string');
+}
+
+function isAgentExecutionRecordStatus(value: unknown): value is AgentExecutionRecordStatus {
+  return value === 'claimed' || value === 'completed' || value === 'failed' || value === 'blocked' || value === 'skipped';
+}
+
+function isTeamSessionRecordStatus(value: unknown): value is TeamSessionRecordStatus {
+  return value === 'created' || value === 'completed' || value === 'blocked' || value === 'disabled';
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null;
+}

package/node_modules/@sdd-agent-platform/core/src/doctor/checks/run-trust.ts

@@ -1,107 +1,128 @@
-import { SDD_EVIDENCE_CONTRACT } from '../../contracts.js';
-import { messageFromError } from '../../contracts/issues.js';
-import { containsTemplatePlaceholder, validateArtifactTrust, type EvidenceClaim } from '../../artifacts/sdd-evidence.js';
-import { parseSddResultMarkdown } from '../../artifacts/sdd-result.js';
-import { readArtifact } from '../../run-state/artifacts.js';
-import type { InvocationLedgerEntry, RunState } from '../../run-state/model.js';
-import { toArtifactRootRelativePath } from '../../runtime-paths.js';
-import type { DoctorCheck } from '../model.js';
-
-export async function inspectRunTrustEvidence(projectRoot: string, state: RunState, invocationLedger: InvocationLedgerEntry[]): Promise<DoctorCheck[]> {
-  const checks: DoctorCheck[] = [];
-  const runId = state.runId;
-  const materials = ledgerMaterialRefs(invocationLedger);
-  let inspectedTrustArtifacts = 0;
-
-
-  for (const [taskId, taskState] of Object.entries(state.tasks)) {
-    for (const coverage of acceptanceCoverageEntries(taskState)) {
-      if (coverage.status === 'PASS') {
-        const evidence = typeof coverage.evidence === 'string' ? coverage.evidence : '';
-        const issueCodes = Array.isArray(coverage.issueCodes) ? coverage.issueCodes.join(',') : '';
-        if (/Mentioned in artifacts\//i.test(evidence) || !isRecord(coverage.policyDecision) || issueCodes.includes('MENTION_ONLY')) {
-          checks.push({ level: 'FAIL', check: 'acceptance_trust', message: `${runId}/${taskId}: acceptance ${String(coverage.acceptance ?? 'unknown')} is PASS without policy-backed source evidence.`, action: `Use ${SDD_EVIDENCE_CONTRACT} claims; mention-only acceptance coverage cannot satisfy PASS.` });
-        }
-        if (containsTemplatePlaceholder(evidence)) {
-          checks.push({ level: 'FAIL', check: 'acceptance_trust', message: `${runId}/${taskId}: acceptance ${String(coverage.acceptance ?? 'unknown')} PASS evidence contains template placeholder text.`, action: 'Replace generated TODO/template acceptance text with real source evidence.' });
-        }
-      }
-    }
-  }
-
-  for (const artifact of state.artifacts) {
-    const looksLikeValidatorArtifact = artifact.agent === 'validator' || /(?:^|\/)validation-[^/]+\.md$/i.test(artifact.path);
-    if (!looksLikeValidatorArtifact) {
-      continue;
-    }
-    try {
-      const artifactRootRelativePath = toArtifactRootRelativePath(artifact.path);
-      const raw = await readArtifact(projectRoot, runId, artifactRootRelativePath);
-      const parsed = parseSddResultMarkdown(raw);
-      if (!parsed.result || parsed.result.agent !== 'validator' || (parsed.result.status !== 'PASS' && parsed.result.status !== 'PASS_WITH_GAPS')) {
-        continue;
-      }
-      inspectedTrustArtifacts += 1;
-      const trust = validateArtifactTrust(raw, parsed.result, artifact.path, { expectedTask: artifact.task ?? parsed.result.task, expectedAgent: 'validator' });
-      if (!trust.valid) {
-        for (const issue of trust.issues) {
-          checks.push({ level: 'FAIL', check: 'artifact_trust', message: `${runId}/${artifact.path}: ${issue.message}`, action: issue.recommendation });
-        }
-      }
-      for (const claim of trust.claims) {
-        for (const ref of claimMaterialRefs(claim)) {
-          if (!materials.has(ref)) {
-            checks.push({ level: 'FAIL', check: 'material_provenance', message: `${runId}/${artifact.path}: material evidence ${ref} has no matching runtime activity entry.`, action: 'Record material/tool/command provenance in runtime.sqlite activities before using the material as source evidence.' });
-          }
-        }
-      }
-    } catch (error) {
-      checks.push({ level: 'FAIL', check: 'artifact_trust', message: `${runId}/${artifact.path}: cannot inspect validator artifact: ${messageFromError(error)}`, action: 'Restore the validator artifact or remove it from accepted run evidence.' });
-    }
-  }
-
-  if (inspectedTrustArtifacts > 0 && !checks.some((check) => check.check === 'artifact_trust' || check.check === 'material_provenance')) {
-    checks.push({ level: 'PASS', check: 'artifact_trust', message: `${runId}: inspected ${inspectedTrustArtifacts} validator trust artifact(s).` });
-  }
-  return checks;
-}
-
-function acceptanceCoverageEntries(taskState: unknown): Array<Record<string, unknown>> {
-  if (!isRecord(taskState) || !Array.isArray(taskState.acceptanceCoverage)) {
-    return [];
-  }
-  return taskState.acceptanceCoverage.filter(isRecord);
-}
-
-function ledgerMaterialRefs(entries: InvocationLedgerEntry[]): Set<string> {
-  const refs = new Set<string>();
-  for (const entry of entries) {
-    if (entry.kind === 'material') {
-      refs.add(entry.ref);
-    }
-    for (const ref of entry.materialRefs) {
-      refs.add(ref);
-    }
-  }
-  return refs;
-}
-
-function claimMaterialRefs(claim: EvidenceClaim): string[] {
-  const refs: string[] = [];
-  for (const item of claim.evidence) {
-    if (item.kind === 'material') {
-      refs.push(item.ref);
-    }
-  }
-  for (const ref of claim.provenance) {
-    if (ref.startsWith('material:')) {
-      refs.push(ref.slice('material:'.length));
-    }
-  }
-  return refs;
-}
-
-
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === 'object' && value !== null;
-}
+import { createHash } from 'node:crypto';
+import { SDD_EVIDENCE_CONTRACT } from '../../contracts.js';
+import { messageFromError } from '../../contracts/issues.js';
+import { containsTemplatePlaceholder, validateArtifactTrust, type EvidenceClaim } from '../../artifacts/sdd-evidence.js';
+import { parseSddResultMarkdown } from '../../artifacts/sdd-result.js';
+import { readArtifact } from '../../run-state/artifacts.js';
+import type { InvocationLedgerEntry, RunState } from '../../run-state/model.js';
+import { toArtifactRootRelativePath } from '../../runtime-paths.js';
+import type { DoctorCheck } from '../model.js';
+
+export async function inspectRunTrustEvidence(projectRoot: string, state: RunState, invocationLedger: InvocationLedgerEntry[]): Promise<DoctorCheck[]> {
+  const checks: DoctorCheck[] = [];
+  const runId = state.runId;
+  const materials = ledgerMaterialRefs(invocationLedger);
+  let inspectedTrustArtifacts = 0;
+
+  if (state.syncBack.status !== 'not_created') {
+    if (!state.syncBack.proposalPath) {
+      checks.push({ level: 'FAIL', check: 'sync_back_monotonicity', message: `${runId}: sync-back status is ${state.syncBack.status} but proposalPath is missing.`, action: 'Keep sync-back transitions monotonic and preserve the proposal path from verify/apply.' });
+    } else if (!state.syncBack.proposalDigest) {
+      checks.push({ level: 'WARN', check: 'sync_back_proposal_digest', message: `${runId}: sync-back proposal ${state.syncBack.proposalPath} has no recorded digest.`, action: 'Re-run verify with the Phase 6.9 runtime so inspect/apply can detect proposal drift.' });
+    } else {
+      try {
+        const proposal = await readArtifact(projectRoot, runId, toArtifactRootRelativePath(state.syncBack.proposalPath));
+        const digest = hashDocumentContent(proposal);
+        if (digest !== state.syncBack.proposalDigest) {
+          checks.push({ level: 'FAIL', check: 'sync_back_proposal_digest', message: `${runId}: sync-back proposal ${state.syncBack.proposalPath} digest changed from ${state.syncBack.proposalDigest} to ${digest}.`, action: 'Restore the verified proposal or re-run verify before sync-back apply.' });
+        }
+      } catch (error) {
+        checks.push({ level: 'FAIL', check: 'sync_back_proposal_digest', message: `${runId}: cannot read sync-back proposal ${state.syncBack.proposalPath}: ${messageFromError(error)}`, action: 'Restore the proposal artifact before sync-back inspect/apply.' });
+      }
+    }
+  }
+
+  for (const [taskId, taskState] of Object.entries(state.tasks)) {
+    for (const coverage of acceptanceCoverageEntries(taskState)) {
+      if (coverage.status === 'PASS') {
+        const evidence = typeof coverage.evidence === 'string' ? coverage.evidence : '';
+        const issueCodes = Array.isArray(coverage.issueCodes) ? coverage.issueCodes.join(',') : '';
+        if (/Mentioned in artifacts\//i.test(evidence) || !isRecord(coverage.policyDecision) || issueCodes.includes('MENTION_ONLY')) {
+          checks.push({ level: 'FAIL', check: 'acceptance_trust', message: `${runId}/${taskId}: acceptance ${String(coverage.acceptance ?? 'unknown')} is PASS without policy-backed source evidence.`, action: `Use ${SDD_EVIDENCE_CONTRACT} claims; mention-only acceptance coverage cannot satisfy PASS.` });
+        }
+        if (containsTemplatePlaceholder(evidence)) {
+          checks.push({ level: 'FAIL', check: 'acceptance_trust', message: `${runId}/${taskId}: acceptance ${String(coverage.acceptance ?? 'unknown')} PASS evidence contains template placeholder text.`, action: 'Replace generated TODO/template acceptance text with real source evidence.' });
+        }
+      }
+    }
+  }
+
+  for (const artifact of state.artifacts) {
+    const looksLikeValidatorArtifact = artifact.agent === 'validator' || /(?:^|\/)validation-[^/]+\.md$/i.test(artifact.path);
+    if (!looksLikeValidatorArtifact) {
+      continue;
+    }
+    try {
+      const artifactRootRelativePath = toArtifactRootRelativePath(artifact.path);
+      const raw = await readArtifact(projectRoot, runId, artifactRootRelativePath);
+      const parsed = parseSddResultMarkdown(raw);
+      if (!parsed.result || parsed.result.agent !== 'validator' || (parsed.result.status !== 'PASS' && parsed.result.status !== 'PASS_WITH_GAPS')) {
+        continue;
+      }
+      inspectedTrustArtifacts += 1;
+      const trust = validateArtifactTrust(raw, parsed.result, artifact.path, { expectedTask: artifact.task ?? parsed.result.task, expectedAgent: 'validator' });
+      if (!trust.valid) {
+        for (const issue of trust.issues) {
+          checks.push({ level: 'FAIL', check: 'artifact_trust', message: `${runId}/${artifact.path}: ${issue.message}`, action: issue.recommendation });
+        }
+      }
+      for (const claim of trust.claims) {
+        for (const ref of claimMaterialRefs(claim)) {
+          if (!materials.has(ref)) {
+            checks.push({ level: 'FAIL', check: 'material_provenance', message: `${runId}/${artifact.path}: material evidence ${ref} has no matching runtime activity entry.`, action: 'Record material/tool/command provenance in runtime.sqlite activities before using the material as source evidence.' });
+          }
+        }
+      }
+    } catch (error) {
+      checks.push({ level: 'FAIL', check: 'artifact_trust', message: `${runId}/${artifact.path}: cannot inspect validator artifact: ${messageFromError(error)}`, action: 'Restore the validator artifact or remove it from accepted run evidence.' });
+    }
+  }
+
+  if (inspectedTrustArtifacts > 0 && !checks.some((check) => check.check === 'artifact_trust' || check.check === 'material_provenance')) {
+    checks.push({ level: 'PASS', check: 'artifact_trust', message: `${runId}: inspected ${inspectedTrustArtifacts} validator trust artifact(s).` });
+  }
+  return checks;
+}
+
+function acceptanceCoverageEntries(taskState: unknown): Array<Record<string, unknown>> {
+  if (!isRecord(taskState) || !Array.isArray(taskState.acceptanceCoverage)) {
+    return [];
+  }
+  return taskState.acceptanceCoverage.filter(isRecord);
+}
+
+function ledgerMaterialRefs(entries: InvocationLedgerEntry[]): Set<string> {
+  const refs = new Set<string>();
+  for (const entry of entries) {
+    if (entry.kind === 'material') {
+      refs.add(entry.ref);
+    }
+    for (const ref of entry.materialRefs) {
+      refs.add(ref);
+    }
+  }
+  return refs;
+}
+
+function claimMaterialRefs(claim: EvidenceClaim): string[] {
+  const refs: string[] = [];
+  for (const item of claim.evidence) {
+    if (item.kind === 'material') {
+      refs.push(item.ref);
+    }
+  }
+  for (const ref of claim.provenance) {
+    if (ref.startsWith('material:')) {
+      refs.push(ref.slice('material:'.length));
+    }
+  }
+  return refs;
+}
+
+function hashDocumentContent(raw: string): string {
+  return createHash('sha256').update(raw.replace(/\r\n/g, '\n'), 'utf8').digest('hex');
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null;
+}