sibyl-system 1.3.1 → 1.3.3

package/README.md

@@ -12,6 +12,7 @@ A standalone [opencode](https://opencode.ai) plugin:
   the result is aggregated into a verdict.
 - **`sibyl_review` / `sibyl-chamber`** (v1.1) — a general review chamber with
   isolated role sessions and one conclusion spoken in one voice (see below).
+- **`sibyl_audit`** — the outside lane as a product organ: completion-state ballots convene themselves from a fresh root session (see Tools).
 - **`sibyl_status` + audit primitives** (`sibyl_anchor_check`, `sibyl_time_probe`,
   `sibyl_attribute`) — read-only verification tools: run-store view, human-message
   anchor re-verification, clock integrity, ref-move attribution.
@@ -98,6 +99,7 @@ stderr, registers nothing, and returns empty hooks.
 | Tool | Arguments | Behavior |
 |------|-----------|----------|
 | `sibyl_consult` | `{ artifact, goal }` | `artifact` is a file path or inline multi-line text (≤ 256 KiB). The three councilors audit it in parallel; each reply is parsed into a verdict (one in-session JSON-only repair shot per voter). Returns the tally, merged reasons/must-fix, run id, and per-voter reply file paths. |
+| `sibyl_audit` | `{ artifact, goal }` | Independent audit lane: the council is convened by a FRESH engine-provisioned root session (structurally non-kin to any drafting chain), so the ballot enters the effective path without the caller's identity touching it. Receipt: auditor session id (retained, DB-reconcilable), artifact sha256 bound at start and end (mid-flight drift => VOID), verdict face; anything but INDEPENDENT on the fresh convener => REFUSED, no receipt. |
 | `sibyl_swarm` | `{ artifact, goal, judge? }` | ARCHITECT decomposes goal + artifact into a strict-JSON workflow schema; workers are minted deterministically and dispatched in dependency waves; drafts land in the run's space dir. Verdict: `APPROVE` / `REJECT` / `EXHAUSTED`, forced to `CANNOT_ANSWER` when a declared worker left no terminal row (W2) or zero drafts were produced. With `judge: true`, one extra judge pass may replace the derived verdict — an unrecognized or failed judge reply keeps the derived one. |
 | `sibyl_status` | `{ runId? }` | Read-only. Lists all recorded runs (newest last) + the last chamber-ledger rows, or shows one run's full record and space dir. |
 | `sibyl_review` | `{ target, goal, seed?, maxRounds? }` | v1.1 general democratic-centralism chamber: launches the isolated evidence→clash→judge pipeline detached and returns a receipt (explicitly NOT a verdict); the single voice lands in the run record at terminal state. CLI twin: `sibyl-chamber`. |
@@ -211,7 +213,7 @@ Dependencies point downward only:
 
 ```
 index.ts            plugin entry: parse options → share one RunStore + client
-                    adapter → register the seven sibyl_* tools
+                    adapter → register the eight sibyl_* tools
 ├── engine/         runPersona(): create + prompt one child session through a
 │                   structural client seam; per-stage timeouts; never throws —
 │                   every failure is a structured PersonaRunResult

package/dist/index.js

@@ -31971,7 +31971,53 @@ function contentMatches(input2, needle) {
   }
   return false;
 }
-function scanMessages(rows, convenerIndex, sid, artifact) {
+var SHELL_TOOLS = ["bash"];
+var SHELL_KEYS = ["command"];
+var LINEAGE_CHUNK = 256;
+var LINEAGE_SAMPLES = 32;
+var LINEAGE_UNION_RATIO = 0.6;
+var LINEAGE_MIN_WINDOWS = 3;
+function sampleWindows(text) {
+  const total = Math.floor(text.length / LINEAGE_CHUNK);
+  if (total < LINEAGE_MIN_WINDOWS) return [];
+  const step = Math.max(1, Math.floor(total / LINEAGE_SAMPLES));
+  const out = [];
+  for (let i = 0; i < total; i += step) out.push(text.slice(i * LINEAGE_CHUNK, (i + 1) * LINEAGE_CHUNK));
+  return out.slice(0, LINEAGE_SAMPLES);
+}
+function beginLineage(artifact) {
+  if (artifact.kind !== "path" || artifact.mtimeMs === void 0) return null;
+  const chunks = sampleWindows(artifact.text);
+  if (chunks.length < LINEAGE_MIN_WINDOWS) return null;
+  return {
+    chunks,
+    need: Math.max(2, Math.ceil(chunks.length * LINEAGE_UNION_RATIO)),
+    mtimeMs: artifact.mtimeMs,
+    matched: /* @__PURE__ */ new Map(),
+    copiedAfterMtime: 0,
+    timeless: 0
+  };
+}
+function messageTime(m) {
+  const t = m.info?.time?.created;
+  return typeof t === "number" ? t : void 0;
+}
+function partCandidates(p) {
+  const shell = p.tool !== void 0 && SHELL_TOOLS.includes(p.tool);
+  if (!shell && !isDraftingTool(p.tool)) return [];
+  const keys = shell ? SHELL_KEYS : CONTENT_KEYS;
+  const out = [];
+  for (const key of keys) {
+    const v = p.input?.[key];
+    if (typeof v === "string" && v.length >= LINEAGE_CHUNK) out.push(v);
+  }
+  return out;
+}
+function lineageVerdict(lg, artifact) {
+  const sources = [.../* @__PURE__ */ new Set([...lg.matched.values()])].slice(0, 3).join("; ");
+  return `content-lineage evidence: ${String(lg.matched.size)} of ${String(lg.chunks.length)} verbatim ${String(LINEAGE_CHUNK)}-byte windows of ${artifact.source} appear in convener-chain tool inputs that predate its mtime (${sources}) \u2014 the chain authored this artifact's bytes before/independently of this path`;
+}
+function scanMessages(rows, convenerIndex, sid, artifact, lg) {
   for (const [mi, m] of rows.entries()) {
     for (const p of m.parts ?? []) {
       if (p.type === "tool" && isDraftingTool(p.tool)) {
@@ -31985,6 +32031,26 @@ function scanMessages(rows, convenerIndex, sid, artifact) {
       if (artifact.kind === "inline" && m.info?.role === "assistant" && p.type === "text" && typeof p.text === "string" && artifact.text.trim().length >= MIN_INLINE_MATCH && p.text.includes(artifact.text.trim())) {
         return `drafting evidence: assistant text in convener-chain session ${sid} (chain position ${String(convenerIndex)}, message ${String(mi)}) contains the inline artifact`;
       }
+      if (p.type === "tool" && lg !== null) {
+        const t = messageTime(m);
+        if (t === void 0) {
+          lg.timeless += 1;
+          continue;
+        }
+        if (t > lg.mtimeMs) {
+          lg.copiedAfterMtime += 1;
+          continue;
+        }
+        const label = `${p.tool ?? "tool"}@${sid}:${String(mi)}`;
+        for (const cand of partCandidates(p)) {
+          if (artifact.kind === "path" && cand.includes(artifact.text.trim())) {
+            return `${lineageVerdict({ ...lg, matched: /* @__PURE__ */ new Map([[0, label]]) }, artifact)}; full-text containment in ${label}`;
+          }
+          for (const [wi, chunk] of lg.chunks.entries()) {
+            if (!lg.matched.has(wi) && cand.includes(chunk)) lg.matched.set(wi, label);
+          }
+        }
+      }
     }
   }
   return null;
@@ -32025,6 +32091,7 @@ async function assessIndependence(client, directory, convenerSessionID, artifact
     seen.add(parent);
     current = parent;
   }
+  const lg = beginLineage(artifact);
   let scanFailed = "";
   for (const [i, sid] of chain.entries()) {
     const res = await client.session.messages({ path: { id: sid }, query: { directory } });
@@ -32032,22 +32099,33 @@ async function assessIndependence(client, directory, convenerSessionID, artifact
       scanFailed = scanFailed.length > 0 ? scanFailed : `messages(${sid}) refused`;
       continue;
     }
-    const hit = scanMessages(res.data, i, sid, artifact);
+    const hit = scanMessages(res.data, i, sid, artifact, lg);
     if (hit !== null) {
       return { status: "NOT-INDEPENDENT", convenerChain: chain, evidence: hit };
     }
   }
+  if (lg !== null && lg.matched.size >= lg.need) {
+    return { status: "NOT-INDEPENDENT", convenerChain: chain, evidence: lineageVerdict(lg, artifact) };
+  }
   if (scanFailed.length > 0 || walkIncomplete) {
     const why = [walkIncomplete ? walkReason : "", scanFailed].filter((s) => s.length > 0).join("; ");
     return { status: "UNVERIFIABLE", convenerChain: chain, evidence: `partial read: ${why} \u2014 independence was NOT established` };
   }
   const note = walkReason.length > 0 ? `; walk note: ${walkReason}` : "";
+  const lineageNote = lineageFaceNote(lg);
   return {
     status: "INDEPENDENT",
     convenerChain: chain,
-    evidence: `scanned ${String(chain.length)} session(s) of the convener chain to root; no drafting evidence within read scope${note}`
+    evidence: `scanned ${String(chain.length)} session(s) of the convener chain to root; no drafting evidence within read scope${lineageNote}${note}`
   };
 }
+function lineageFaceNote(lg) {
+  if (lg === null) return "";
+  const parts = [`${String(lg.matched.size)}/${String(lg.chunks.length)} lineage windows matched (need ${String(lg.need)})`];
+  if (lg.copiedAfterMtime > 0) parts.push(`${String(lg.copiedAfterMtime)} part(s) excluded as post-mtime copies`);
+  if (lg.timeless > 0) parts.push(`${String(lg.timeless)} part(s) lacked timestamps`);
+  return `; content-lineage: ${parts.join(", ")}`;
+}
 function independenceLabel(v) {
   return v.status === "INDEPENDENT" ? "independence=INDEPENDENT" : `independence=${v.status} \u2014 ${v.evidence}`;
 }
@@ -32526,7 +32604,7 @@ async function readArtifact(raw, cwd) {
   } catch (err) {
     return { ok: false, error: `artifact "${path}": ${errMessage(err)}` };
   }
-  return { ok: true, kind: "path", source: path, text };
+  return { ok: true, kind: "path", source: path, text, mtimeMs: info.mtimeMs };
 }
 function errMessage(err) {
   if (err instanceof Error) return err.message;
@@ -32953,6 +33031,79 @@ function buildAnchorTool(deps) {
   });
 }
 
+// src/tools/audit.ts
+import { createHash as createHash3 } from "node:crypto";
+var AUDIT_TOOL_NAME = "sibyl_audit";
+var RUN_ID_RE = /run (sibyl-[0-9TZ-]+-[0-9a-f]+)/;
+function sha2562(text) {
+  return createHash3("sha256").update(text, "utf8").digest("hex");
+}
+async function artifactHash(raw, dir) {
+  const art = await readArtifact(raw, dir);
+  return art.ok ? sha2562(art.text) : null;
+}
+function buildAuditTool(deps) {
+  return tool({
+    description: "SIBYL independent audit lane: convenes the three-councilor consult from a FRESH engine-provisioned root session (structurally non-kin to any drafting chain), so the ballot enters the effective path without the caller's identity touching it. Emits an audit receipt \u2014 auditor session id (retained, DB-reconcilable), artifact sha256 bound at start and end, verdict face. REFUSES (no receipt) if the fresh convener resolves to anything but INDEPENDENT, or the artifact drifts mid-ballot (VOID).",
+    args: {
+      artifact: tool.schema.string().min(1).describe("Path to the artifact, or its inline content (multi-line)."),
+      goal: tool.schema.string().min(1).describe("The question the audit must answer.")
+    },
+    execute: async (args, context) => {
+      try {
+        return await auditExecute(deps, args, context);
+      } catch (err) {
+        return internalError(AUDIT_TOOL_NAME, err);
+      }
+    }
+  });
+}
+async function auditExecute(deps, args, ctx) {
+  const start = await readArtifact(args.artifact, ctx.directory);
+  if (!start.ok) {
+    return `SIBYL AUDIT: refused \u2014 artifact unreadable: ${start.error}`;
+  }
+  const shaStart = sha2562(start.text);
+  const created = await deps.client.session.create({
+    body: { title: `sibyl:audit ${(/* @__PURE__ */ new Date()).toISOString()}` },
+    query: { directory: ctx.directory }
+  });
+  const auditor = created.data?.id ?? "";
+  if (auditor.length === 0) {
+    const why = created.error === void 0 ? "no id in response" : JSON.stringify(created.error).slice(0, 140);
+    return `SIBYL AUDIT: refused \u2014 engine did not provision the fresh root convener (${why}); an audit without a resolvable auditor session is not an audit`;
+  }
+  const caller = ctx.sessionID.length > 0 ? ctx.sessionID : "headless";
+  const ballot = await consultExecute(deps, args, { ...ctx, sessionID: auditor });
+  const runId = RUN_ID_RE.exec(ballot)?.[1] ?? "";
+  const runs = await deps.store.load();
+  const rec = runs.find((r) => r.runId === runId);
+  const ind = rec?.independence;
+  const independence = ind?.status ?? "MISSING-RECORD";
+  if (independence !== "INDEPENDENT") {
+    const ev = ind?.evidence ?? `run ${runId.length > 0 ? runId : "(unresolvable)"} not found in the store`;
+    return `SIBYL AUDIT: REFUSED \u2014 the fresh convener ${auditor} resolved to independence=${independence}: ${ev}
+  the ballot ${runId.length > 0 ? runId : "(no run id)"} is archived as DATA and carries no audit receipt; requested-by=` + caller + " (DATA only)";
+  }
+  const shaEnd = await artifactHash(args.artifact, ctx.directory);
+  if (shaEnd !== shaStart) {
+    return `SIBYL AUDIT: VOID \u2014 artifact bytes moved while the ballot was in flight (start sha256 ${shaStart.slice(0, 16)}\u2026, end ${shaEnd === null ? "unreadable" : `${shaEnd.slice(0, 16)}\u2026`}); run ${runId} archived as DATA; re-audit the current bytes`;
+  }
+  const v = rec?.verdict;
+  const counts = v === void 0 ? "no verdict" : `${String(v.approvals)}A/${String(v.rejects)}R/${String(v.errors)}E/${String(v.missing)}M`;
+  const rules = rec?.instrument?.rulesHash.slice(0, 12) ?? "no-instrument-face";
+  return [
+    `SIBYL AUDIT RECEIPT run=${runId}`,
+    `  verdict=${v?.verdict ?? "unknown"} (${counts}) rules=${rules}`,
+    `  auditor-convener=${auditor} (fresh engine-provisioned root; session row RETAINED for DB reconciliation)`,
+    `  requested-by=${caller} \u2014 recorded as ledger data only; it neither convenes nor votes`,
+    `  artifact-sha256=${shaStart} (re-hashed after the ballot, identical \u2014 the receipt binds to these bytes)`,
+    "",
+    "--- ballot face ---",
+    ballot
+  ].join("\n");
+}
+
 // src/tools/probes.ts
 var DEFAULT_TIME_POOL = [
   { url: "https://www.cloudflare.com", ownerDept: "cloudflare" },
@@ -33858,7 +34009,11 @@ function toEngineClient(sdk) {
                   ...m.info.providerID !== void 0 && { providerID: m.info.providerID },
                   ...m.info.modelID !== void 0 && { modelID: m.info.modelID },
                   ...m.info.time !== void 0 && {
-                    time: { ...m.info.time.completed !== void 0 && { completed: m.info.time.completed } }
+                    time: {
+                      ...m.info.time.completed !== void 0 && { completed: m.info.time.completed },
+                      // W1-v2 lineage time gate needs creation stamps too
+                      ..."created" in m.info.time && m.info.time.created !== void 0 && { created: m.info.time.created }
+                    }
                   },
                   ...m.info.error !== void 0 && { error: m.info.error }
                 }
@@ -33909,6 +34064,7 @@ async function SibylPlugin(input2, options) {
   return {
     tool: {
       sibyl_consult: buildConsultTool(deps),
+      sibyl_audit: buildAuditTool(deps),
       sibyl_swarm: buildSwarmTool(deps),
       sibyl_status: buildStatusTool(deps),
       sibyl_review: buildReviewTool(deps),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sibyl-system",
-  "version": "1.3.1",
+  "version": "1.3.3",
   "license": "MIT",
   "type": "module",
   "description": "Sibyl-System: democratic-centralism review chamber (one conclusion, one voice) + fail-closed council voting + dynamic swarm plugin for OpenCode",