software-defence-factory 0.11.1 → 0.11.2

package/docs/npm.md

@@ -104,8 +104,8 @@ installation or retained attempt needs them.
 
 ## Protected evidence compatibility
 
-Factory 0.11.1 recognizes version-1 execution profiles emitted by native
-**0.8.0, 0.9.0, 0.9.1, 0.10.0, 0.11.0 and 0.11.1**. This is an exact allowlist in
+Factory 0.11.2 recognizes version-1 execution profiles emitted by native
+**0.8.0, 0.9.0, 0.9.1, 0.10.0, 0.11.0, 0.11.1 and 0.11.2**. This is an exact allowlist in
 `factory/execution-profile.mjs`, independent of the installed package version;
 it is not a semver range or an automatic promise for later releases. Unknown
 runtime strings, unknown profile formats and incomplete legacy acceptance
@@ -143,6 +143,12 @@ a checkpoint usable. Browser-disabled 0.8.0 records cannot satisfy a newly
 enabled browser policy. Missing or unsupported records stay unchanged and
 unavailable; no schema migration, profile relabeling or policy repair occurs.
 
+Version 0.11.2 retains the v1 profile/evidence schema and current provenance
+rules while preserving exact patch bytes and requiring reconstruction before
+new acceptance. Older writers remain compatible only when their retained patch
+passes the current digest and tree reconstruction checks. A digest-matching
+malformed patch remains blocked and unchanged; follow the [recovery guidance](recovery.md#already-accepted-malformed-patches-91).
+
 New publication still requires the current remote target to equal the original
 accepted base; reviewed-candidate continuation preserves that baseline, while
 target refresh remains #72. See [the verification map](https://github.com/arcitai/software-and-defence-factory/blob/main/docs/proof.md) for delivered

package/docs/recovery.md

@@ -332,6 +332,27 @@ approval; do not edit SQLite or acceptance evidence to bypass the guard. A stale
 target after branch creation leaves that unique branch for inspection and does
 not open a PR. A PR does not imply integration or deployment.
 
+## Already accepted malformed patches (#91)
+
+A matching digest does not prove a patch can reproduce its candidate. Before
+0.11.2, trimming Git diff output could remove trailing blank context lines.
+Native publication correctly refuses such a patch before provider writes.
+Preserve the accepted record, patch, digests, retained Git objects and prior
+attempts. Restarting or reading state does not repair or migrate this evidence.
+
+For recovery, use a separately reviewed, normal protected maintainer PR from
+the exact retained candidate tree, checking its tree identity and original base,
+or run a new native attempt with fresh Verify, independent Review and approval.
+The maintainer route is not successful native publication. Never replace an old
+patch or acceptance hash, fabricate approval, or disable reconstruction guards.
+
+New handoffs in 0.11.2 retain raw Git bytes and reconstruct the protected patch
+against the original retained base in private bare storage before acceptance.
+Failure retains evidence and creates no accepted record or provider writes.
+Publication still repeats reconstruction and all current provenance, source,
+workflow and target checks. Operator installed/native qualification on Z13 is
+required before further general unattended delivery.
+
 ## Continue a reviewed candidate (first #42 slice)
 
 Use one explicit starting point for a current software review with a returned

package/factory/candidate-patch.mjs

@@ -0,0 +1,73 @@
+import { assertPrivateDirectory } from './execution-evidence.mjs';
+import { lstatSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { digest } from './lib.mjs';
+
+const MAX_PATCH_BYTES = 8 * 1024 * 1024;
+const MAX_TREE_BYTES = 8 * 1024 * 1024;
+
+function readPrivateFile(path, limit) {
+  const stat = lstatSync(path);
+  if (!stat.isFile() || stat.isSymbolicLink() || (stat.mode & 0o077) !== 0 || stat.size > limit)
+    throw new Error('Protected candidate patch is missing, unsafe or too large.');
+  return readFileSync(path);
+}
+function runGitCommand(args) {
+  const env = {
+    PATH: process.env.PATH || '/usr/bin:/bin', HOME: '/nonexistent',
+    GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: '/dev/null',
+    GIT_TERMINAL_PROMPT: '0', GIT_OPTIONAL_LOCKS: '0',
+  };
+  const result = spawnSync('git', args, { env, encoding: 'utf8', maxBuffer: MAX_TREE_BYTES + MAX_PATCH_BYTES + 1024 * 1024 });
+  if (result.error || result.status !== 0) throw new Error('Could not prepare private candidate reconstruction storage.');
+  return result.stdout.trim();
+}
+function runGit(repo, args, { input, binary = false } = {}) {
+  // Delivery reconstruction runs only trusted Git operations in a newly made
+  // bare repository. Candidate hooks, filters, global config and credentials
+  // are unavailable to these subprocesses.
+  const env = {
+    PATH: process.env.PATH || '/usr/bin:/bin',
+    HOME: '/nonexistent',
+    GIT_CONFIG_NOSYSTEM: '1',
+    GIT_CONFIG_GLOBAL: '/dev/null',
+    GIT_TERMINAL_PROMPT: '0',
+    GIT_OPTIONAL_LOCKS: '0',
+  };
+  const result = spawnSync('git', ['--git-dir', repo, '-c', 'core.hooksPath=/dev/null', '-c', 'core.fsmonitor=false', ...args], {
+    env, input, encoding: binary ? null : 'utf8', maxBuffer: MAX_TREE_BYTES + MAX_PATCH_BYTES + 1024 * 1024,
+  });
+  if (result.error || result.status !== 0) throw new Error('Could not reconstruct the accepted candidate from retained Git objects.');
+  return binary ? result.stdout : result.stdout.trim();
+}
+// Shared acceptance/publication boundary. Only the original retained base and
+// exact protected patch bytes enter new, private bare storage. The callback may
+// inspect reconstructed objects; cleanup removes only this invocation's scratch.
+export function withReconstructedCandidate({ state, jobId, sourcePath, objectFormat, candidate }, inspect = () => {}) {
+  const oid = new RegExp(`^[a-f0-9]{${objectFormat === 'sha256' ? 64 : 40}}$`);
+  if (!['sha1', 'sha256'].includes(objectFormat) || !oid.test(candidate.base || '') || !oid.test(candidate.tree || ''))
+    throw new Error('Candidate has an unsupported Git object identity.');
+  const folder = join(state, 'jobs', jobId);
+  const patchPath = join(folder, 'delivery-input', 'candidate.patch');
+  assertPrivateDirectory(join(state, 'jobs'));
+  assertPrivateDirectory(folder);
+  assertPrivateDirectory(join(folder, 'delivery-input'));
+  const patch = readPrivateFile(patchPath, MAX_PATCH_BYTES);
+  if (!patch.length || digest(patch) !== candidate.patch_sha256) throw new Error('Accepted patch digest does not match the approval record.');
+  const scratchRoot = mkdtempSync(join(folder, 'delivery-work-'));
+  const repo = join(scratchRoot, 'candidate.git');
+  try {
+    runGitCommand(['init', '--bare', '--quiet', '--template=', `--object-format=${objectFormat}`, repo]);
+    runGit(repo, ['fetch', '--quiet', '--no-tags', '--', sourcePath, `${candidate.base}:refs/heads/factory-base`]);
+    if (runGit(repo, ['rev-parse', '--verify', `${candidate.base}^{commit}`]) !== candidate.base)
+      throw new Error('Accepted base differs from the retained source commit.');
+    runGit(repo, ['read-tree', candidate.base]);
+    runGit(repo, ['apply', '--cached', '--binary', '--whitespace=nowarn', '-'], { input: patch });
+    const tree = runGit(repo, ['write-tree']);
+    if (tree !== candidate.tree) throw new Error('Protected patch does not reproduce the accepted candidate tree.');
+    return inspect({ repo, patch, tree, git: runGit });
+  } finally {
+    rmSync(scratchRoot, { recursive: true, force: true });
+  }
+}

package/factory/delivery.mjs

@@ -1,8 +1,8 @@
-import { readPrivateJson, assertPrivateDirectory, trustedExecutionProfile } from './execution-evidence.mjs';
+import { withReconstructedCandidate } from './candidate-patch.mjs';
+import { readPrivateJson, trustedExecutionProfile } from './execution-evidence.mjs';
 import { createHash, randomBytes } from 'node:crypto';
-import { existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { join, resolve } from 'node:path';
-import { spawnSync } from 'node:child_process';
 import { configAt, digest } from './lib.mjs';
 import { effectiveExecutionConfig, isSupportedExecutionProfile } from './execution-profile.mjs';
 import { publicSourceAdmission } from './source-admission.mjs';
@@ -11,7 +11,6 @@ import { readProjectLinks } from './project-links.mjs';
 import { qualifyGitHubActions } from './workflow-qualification.mjs';
 import { assertCurrentWebEvidence, assertCurrentWebArtifacts } from './web-verification.mjs';
 
-const MAX_PATCH_BYTES = 8 * 1024 * 1024;
 const MAX_CHANGED_FILES = 500;
 const MAX_TREE_BYTES = 8 * 1024 * 1024;
 const SHA1 = /^[a-f0-9]{40}$/;
@@ -39,7 +38,6 @@ class BranchCollisionError extends QueueError {
   }
 }
 
-function sha256(value) { return createHash('sha256').update(value).digest('hex'); }
 function utcGitDate(value) {
   const parsed = new Date(value);
   if (!Number.isFinite(parsed.getTime())) throw new Error('Accepted timestamp is invalid.');
@@ -54,40 +52,6 @@ function commitObjectSha({ tree, parents, message, author, committer }) {
   const raw = Buffer.from(`tree ${tree}\nparent ${parents[0]}\nauthor ${author.name} <${author.email}> ${date.epoch} +0000\ncommitter ${committer.name} <${committer.email}> ${date.epoch} +0000\n\n${message}`, 'utf8');
   return createHash('sha1').update(`commit ${raw.length}\0`).update(raw).digest('hex');
 }
-function readPrivateFile(path, limit) {
-  const stat = lstatSync(path);
-  if (!stat.isFile() || stat.isSymbolicLink() || (stat.mode & 0o077) !== 0 || stat.size > limit)
-    throw new Error('Protected candidate patch is missing, unsafe or too large.');
-  return readFileSync(path);
-}
-function runGitCommand(args) {
-  const env = {
-    PATH: process.env.PATH || '/usr/bin:/bin', HOME: '/nonexistent',
-    GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: '/dev/null',
-    GIT_TERMINAL_PROMPT: '0', GIT_OPTIONAL_LOCKS: '0',
-  };
-  const result = spawnSync('git', args, { env, encoding: 'utf8', maxBuffer: MAX_TREE_BYTES + MAX_PATCH_BYTES + 1024 * 1024 });
-  if (result.error || result.status !== 0) throw new Error('Could not prepare private candidate reconstruction storage.');
-  return result.stdout.trim();
-}
-function runGit(repo, args, { input, binary = false } = {}) {
-  // Delivery reconstruction runs only trusted Git operations in a newly made
-  // bare repository. Candidate hooks, filters, global config and credentials
-  // are unavailable to these subprocesses.
-  const env = {
-    PATH: process.env.PATH || '/usr/bin:/bin',
-    HOME: '/nonexistent',
-    GIT_CONFIG_NOSYSTEM: '1',
-    GIT_CONFIG_GLOBAL: '/dev/null',
-    GIT_TERMINAL_PROMPT: '0',
-    GIT_OPTIONAL_LOCKS: '0',
-  };
-  const result = spawnSync('git', ['--git-dir', repo, '-c', 'core.hooksPath=/dev/null', '-c', 'core.fsmonitor=false', ...args], {
-    env, input, encoding: binary ? null : 'utf8', maxBuffer: MAX_TREE_BYTES + MAX_PATCH_BYTES + 1024 * 1024,
-  });
-  if (result.error || result.status !== 0) throw new Error('Could not reconstruct the accepted candidate from retained Git objects.');
-  return binary ? result.stdout : result.stdout.trim();
-}
 function parseTree(bytes) {
   const entries = new Map();
   let start = 0;
@@ -112,24 +76,8 @@ function parseTree(bytes) {
 function candidateTree(state, job, sourcePath, sourceAdmission, accepted, { branch, target }) {
   if (sourceAdmission.object_format !== 'sha1' || !SHA1.test(accepted.base || '') || !SHA1.test(accepted.tree || ''))
     throw new Error('GitHub delivery currently requires a SHA-1 candidate from the retained source repository.');
-  const patchPath = join(state, 'jobs', job.id, 'delivery-input', 'candidate.patch');
-  assertPrivateDirectory(join(state, 'jobs'));
-  assertPrivateDirectory(join(state, 'jobs', job.id));
-  assertPrivateDirectory(join(state, 'jobs', job.id, 'delivery-input'));
-  const patch = readPrivateFile(patchPath, MAX_PATCH_BYTES);
-  if (!patch.length || sha256(patch) !== accepted.patch_sha256) throw new Error('Accepted patch digest does not match the approval record.');
-  const folder = join(state, 'jobs', job.id);
-  const scratchRoot = mkdtempSync(join(folder, 'delivery-work-'));
-  const scratchRepo = join(scratchRoot, 'candidate.git');
-  try {
-    runGitCommand(['init', '--bare', '--quiet', '--object-format=sha1', scratchRepo]);
-    runGit(scratchRepo, ['fetch', '--quiet', '--no-tags', '--', sourcePath, `${accepted.base}:refs/heads/factory-base`]);
-    const baseCommit = runGit(scratchRepo, ['rev-parse', '--verify', `${accepted.base}^{commit}`]);
-    if (baseCommit !== accepted.base) throw new Error('Accepted base differs from the retained source commit.');
-    runGit(scratchRepo, ['read-tree', accepted.base]);
-    runGit(scratchRepo, ['apply', '--cached', '--binary', '--whitespace=nowarn', patchPath]);
-    const tree = runGit(scratchRepo, ['write-tree']);
-    if (tree !== accepted.tree) throw new Error('Protected patch does not reproduce the accepted candidate tree.');
+  return withReconstructedCandidate({ state, jobId: job.id, sourcePath,
+    objectFormat: sourceAdmission.object_format, candidate: accepted }, ({ repo: scratchRepo, patch, tree, git: runGit }) => {
     const baseTree = runGit(scratchRepo, ['rev-parse', `${accepted.base}^{tree}`]);
     const before = parseTree(runGit(scratchRepo, ['ls-tree', '-r', '-z', accepted.base], { binary: true }));
     const after = parseTree(runGit(scratchRepo, ['ls-tree', '-r', '-z', tree], { binary: true }));
@@ -159,9 +107,7 @@ function candidateTree(state, job, sourcePath, sourceAdmission, accepted, { bran
       entries.push({ path, mode: next.mode, type: 'blob', content });
     }
     return { patch, patch_sha256: accepted.patch_sha256, base_tree: baseTree, tree, entries, workflowQualification };
-  } finally {
-    rmSync(scratchRoot, { recursive: true, force: true });
-  }
+  });
 }
 
 function sourceIssue(job, repository) {

package/factory/execution-profile.mjs

@@ -7,12 +7,14 @@ import { effectiveInferenceProvider } from './model-environment.mjs';
 import { expectedWebStories, webPolicyHash } from './web-verification.mjs';
 
 // Audited v1 protected evidence writers: 0.8.0 (380f749), 0.9.0 (cdaadef),
-// 0.9.1, 0.10.0, 0.11.0 and 0.11.1 (unchanged protected evidence writers).
+// 0.9.1, 0.10.0, 0.11.0 and 0.11.1 (unchanged protected evidence writers),
+// 0.11.2 (exact patch bytes and pre-acceptance reconstruction; same v1 schema).
+// Older writers still require exact patch/tree reconstruction before publication.
 // Deliberately independent of VERSION: a release bump is not
 // evidence compatibility. Re-audit this list for every trust-relevant writer,
 // isolation or validation change; remove versions whose guarantees no longer
 // satisfy current policy. See docs/npm.md. This predicate alone grants no trust.
-const SUPPORTED_EXECUTION_RUNTIMES_V1 = new Set(['0.8.0', '0.9.0', '0.9.1', '0.10.0', '0.11.0', '0.11.1']);
+const SUPPORTED_EXECUTION_RUNTIMES_V1 = new Set(['0.8.0', '0.9.0', '0.9.1', '0.10.0', '0.11.0', '0.11.1', '0.11.2']);
 
 export function isSupportedExecutionProfile(profile) {
   return profile?.version === 1 && SUPPORTED_EXECUTION_RUNTIMES_V1.has(profile.runtimeVersion);

package/factory/executor.mjs

@@ -1,3 +1,4 @@
+import { withReconstructedCandidate } from './candidate-patch.mjs';
 import { harnessOf } from './lib.mjs';
 import { existsSync, mkdirSync, readFileSync, writeFileSync, rmSync, lstatSync } from 'node:fs';
 import { join } from 'node:path';
@@ -7,7 +8,7 @@ import { incidentFor, validateReport } from './incident.mjs';
 import { BoundedLog } from './bounded-log.mjs';
 import { CodexUsageParser, emptyUsage, usageFields } from './usage.mjs';
 import { assertRetainedSource, publicSourceAdmission, publicContinuation, restoreBuildCheckout } from './source-admission.mjs';
-import { runCandidateGit } from './git-environment.mjs';
+import { runCandidateGit, runCandidateGitRaw } from './git-environment.mjs';
 import { selectedInferenceSecrets, writeSelectedModelEnvironment } from './model-environment.mjs';
 import { redactInferenceText, redactRetainedPhaseOutputs } from './inference-redaction.mjs';
 import { assertCurrentHandoffEvidence } from './execution-evidence.mjs';
@@ -293,8 +294,7 @@ try {
       source_admission: publicSourceAdmission(sourceAdmission) };
     save(join(folder,'candidate.json'),meta);
     save(join(output,'candidate.json'),meta);
-    const patchText = git('--no-pager', 'diff', '--binary', '--full-index', '--no-ext-diff', '--no-textconv', meta.base, meta.head);
-    const patch = patchText ? `${patchText}\n` : '';
+    const patch = runCandidateGitRaw(workspace, '--no-pager', 'diff', '--binary', '--full-index', '--no-ext-diff', '--no-textconv', meta.base, meta.head);
     writeFileSync(join(output,'change.patch'), patch);
     writeFileSync(join(output,'implementation.md'),safeRead(join(reports,'agent-report.md')));
   } else if (phase === 'verify') {
@@ -343,9 +343,8 @@ try {
     if (config.webVerification?.enabled) assertCurrentWebArtifacts(config.webVerification, checks.web_verification,
       join(folder, 'artifacts', checks.run_id));
     assertCurrentHandoffEvidence(meta, checks, review, policyHash, config, job);
-    const patchText = git('--no-pager', 'diff', '--binary', '--full-index', '--no-ext-diff', '--no-textconv', meta.base, meta.head);
-    const patch = patchText ? `${patchText}\n` : '';
-    if (!patch) throw new Error('Candidate has no content changes to accept');
+    const patch = runCandidateGitRaw(workspace, '--no-pager', 'diff', '--binary', '--full-index', '--no-ext-diff', '--no-textconv', meta.base, meta.head);
+    if (!patch.length) throw new Error('Candidate has no content changes to accept');
     const patchHash = digest(patch);
     const deliveryInput = join(folder, 'delivery-input');
     mkdirSync(deliveryInput, { recursive: true, mode: 0o700 });
@@ -355,6 +354,9 @@ try {
       if (!stat.isFile() || stat.isSymbolicLink() || digest(readFileSync(deliveryPatch)) !== patchHash)
         throw new Error('A different protected candidate patch already exists');
     } else writeFileSync(deliveryPatch, patch, { mode: 0o600, flag: 'wx' });
+    const retained = assertRetainedSource(state, job, sourceAdmission);
+    withReconstructedCandidate({ state, jobId: job, sourcePath: retained.path,
+      objectFormat: sourceAdmission.object_format, candidate: { ...meta, patch_sha256: patchHash } });
     const sourceSha = meta.source_admission?.resolved_sha || 'Not recorded (legacy/unknown)';
     writeFileSync(join(output,'handoff.md'), `Accepted candidate ${meta.head} (tree ${meta.tree}), based on source ${sourceSha}.\nPatch handoff remains available. Optional PR delivery is a separate explicit operator action when configured.\nNo integration, merge, release or deployment performed.\nSee docs/quickstart.md for applying the reviewed change.patch to your own branch.\n`);
     save(join(folder,'accepted.json'), { base: meta.base, head: meta.head, tree: meta.tree, patch_sha256: patchHash,

package/factory/git-environment.mjs

@@ -16,11 +16,21 @@ export function runHostGit(args, options = {}) {
   return run('git', args, { ...options, env: hostGitEnvironment() });
 }
 
-export function runCandidateGit(workspace, ...args) {
+function candidateGit(workspace, args, options) {
   return runHostGit([
     '-c', 'core.hooksPath=/dev/null',
     '-c', 'core.fsmonitor=false',
     '-C', workspace,
     ...args,
-  ]);
+  ], options);
+}
+
+// Scalar queries retain their historical trimming. Byte-bearing output must
+// explicitly opt into Buffer stdout, with identical environment and limits.
+export function runCandidateGit(workspace, ...args) {
+  return candidateGit(workspace, args);
+}
+
+export function runCandidateGitRaw(workspace, ...args) {
+  return candidateGit(workspace, args, { encoding: null });
 }

package/factory/lib.mjs

@@ -19,7 +19,7 @@ export function run(command, args, options = {}) {
   const result = spawnSync(command, args, { encoding: 'utf8', maxBuffer: 32 * 1024 * 1024, ...options });
   if (result.error) throw result.error;
   if (result.status !== 0) throw new Error(`${command} failed (${result.status}): ${result.stderr || result.stdout || ''}`);
-  return result.stdout?.trim() ?? '';
+  return Buffer.isBuffer(result.stdout) ? result.stdout : result.stdout?.trim() ?? '';
 }
 export function stream(command, args, options = {}) {
   return new Promise((ok, fail) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "software-defence-factory",
-  "version": "0.11.1",
+  "version": "0.11.2",
   "description": "Factory: scoped software delivery and defence investigations with isolated jobs, evidence and review",
   "type": "module",
   "license": "MIT",