throughline 0.6.0 → 0.6.2

package/src/auditor-context.mjs

@@ -0,0 +1,330 @@
+import { createHash } from 'node:crypto';
+import { existsSync, realpathSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { isAbsolute, join, resolve, sep } from 'node:path';
+import { DatabaseSync } from 'node:sqlite';
+import { buildBodyRowsFromActiveTurns } from './codex-capture.mjs';
+import { parseCodexRolloutFile } from './codex-rollout-memory.mjs';
+import { getLogicalTurnGroups } from './transcript-reader.mjs';
+
+export const AUDITOR_CONTEXT_SCHEMA = 'throughline.auditor_context.v1';
+export const AUDITOR_CONTEXT_DB_SCHEMA_VERSION = 8;
+export const DEFAULT_AUDITOR_RECENT_TURNS = 2;
+export const DEFAULT_AUDITOR_MAX_BODY_CHARS = 1200;
+export const DEFAULT_AUDITOR_MAX_TOTAL_CHARS = 4000;
+
+export function defaultAuditorContextDbPath() {
+  return join(homedir(), '.throughline', 'throughline.db');
+}
+
+export function normalizeAuditorBody(value) {
+  return String(value ?? '').normalize('NFC').replace(/\r\n?/g, '\n').trim();
+}
+
+export function hashAuditorBody(value) {
+  return createHash('sha256').update(normalizeAuditorBody(value), 'utf8').digest('hex');
+}
+
+export function deriveAuditorFreshnessExpectation({ host, transcriptPath, sessionId } = {}) {
+  assertNonEmptyString(transcriptPath, 'transcriptPath');
+  assertNonEmptyString(sessionId, 'sessionId');
+  if (host === 'claude') {
+    const latest = getLogicalTurnGroups(transcriptPath).at(-1);
+    if (!latest) return null;
+    return {
+      expectedOriginSessionId: sessionId,
+      expectedTurnNumber: latest.representative.index,
+      expectedUserSha256: hashAuditorBody(latest.user.content),
+      expectedAssistantSha256: hashAuditorBody(latest.representative.content),
+    };
+  }
+  if (host === 'codex') {
+    const parsed = parseCodexRolloutFile(transcriptPath, { includeInFlightTurn: false });
+    const rows = buildBodyRowsFromActiveTurns(parsed.activeTurns, { sessionId, now: 0 });
+    const latestTurnNumber = rows.reduce((max, row) => Math.max(max, row.turnNumber), 0);
+    if (latestTurnNumber < 1) return null;
+    const user = rows.find((row) => row.turnNumber === latestTurnNumber && row.role === 'user');
+    const assistant = rows.find((row) => row.turnNumber === latestTurnNumber && row.role === 'assistant');
+    if (!user || !assistant) return null;
+    return {
+      expectedOriginSessionId: sessionId,
+      // Codex active turns are rebuilt after rollback/in-flight filtering. Their ordinal can
+      // shift between Stop capture and the next UserPromptSubmit, so it is not a stable identity.
+      // Exact session/origin plus both normalized pair hashes remain mandatory below.
+      expectedTurnNumber: null,
+      expectedUserSha256: hashAuditorBody(user.text),
+      expectedAssistantSha256: hashAuditorBody(assistant.text),
+    };
+  }
+  throw new TypeError('host must be claude or codex');
+}
+
+export function readAuditorContext({
+  dbPath = defaultAuditorContextDbPath(),
+  sessionId,
+  projectRoot,
+  expectedOriginSessionId,
+  expectedTurnNumber,
+  expectedUserSha256,
+  expectedAssistantSha256,
+  recentTurns = DEFAULT_AUDITOR_RECENT_TURNS,
+  maxBodyChars = DEFAULT_AUDITOR_MAX_BODY_CHARS,
+  maxTotalChars = DEFAULT_AUDITOR_MAX_TOTAL_CHARS,
+} = {}) {
+  assertNonEmptyString(sessionId, 'sessionId');
+  assertNonEmptyString(projectRoot, 'projectRoot');
+  assertPositiveInteger(recentTurns, 'recentTurns');
+  assertPositiveInteger(maxBodyChars, 'maxBodyChars');
+  assertPositiveInteger(maxTotalChars, 'maxTotalChars');
+
+  if (!existsSync(dbPath)) {
+    return emptyResult('unavailable', 'db_not_found', { sessionId, projectRoot, recentTurns });
+  }
+
+  let db;
+  try {
+    db = new DatabaseSync(dbPath, { readOnly: true });
+  } catch (cause) {
+    throw new AuditorContextError('E_AUDITOR_CONTEXT_DB_OPEN', 'auditor context DB could not be opened', { cause });
+  }
+
+  try {
+    const version = Number(db.prepare('PRAGMA user_version').get()?.user_version ?? 0);
+    if (version !== AUDITOR_CONTEXT_DB_SCHEMA_VERSION) {
+      return emptyResult('schema_mismatch', 'unsupported_db_schema', {
+        sessionId,
+        projectRoot,
+        recentTurns,
+        dbSchemaVersion: version,
+      });
+    }
+
+    const session = db.prepare(
+      `SELECT session_id, project_path
+       FROM sessions
+       WHERE session_id = ?`,
+    ).get(sessionId);
+    if (!session) {
+      return emptyResult('empty', 'session_not_found', { sessionId, projectRoot, recentTurns });
+    }
+    if (!isSameProjectOrDescendant(session.project_path, projectRoot)) {
+      return emptyResult('session_mismatch', 'project_mismatch', { sessionId, projectRoot, recentTurns });
+    }
+
+    const rows = db.prepare(
+      `SELECT id, origin_session_id, turn_number, role, text, created_at
+       FROM bodies
+       WHERE session_id = ? AND role IN ('user', 'assistant')
+       ORDER BY created_at ASC, id ASC`,
+    ).all(sessionId);
+    const completed = buildCompletedPairs(rows);
+    if (completed.length === 0) {
+      return emptyResult('empty', 'completed_pair_not_found', { sessionId, projectRoot, recentTurns });
+    }
+
+    const latest = completed.at(-1);
+    const stableTurnIdentityAvailable = Number.isInteger(expectedTurnNumber) && expectedTurnNumber >= 0;
+    const codexPairIdentity = sessionId.startsWith('codex:') && expectedOriginSessionId === sessionId;
+    const expectationComplete =
+      typeof expectedOriginSessionId === 'string' && expectedOriginSessionId.length > 0 &&
+      (stableTurnIdentityAvailable || codexPairIdentity) &&
+      isSha256(expectedUserSha256) && isSha256(expectedAssistantSha256);
+    if (!expectationComplete) {
+      return emptyResult('stale', 'freshness_expectation_incomplete', { sessionId, projectRoot, recentTurns });
+    }
+
+    const expectedUserHash = expectedUserSha256.toLowerCase();
+    const expectedAssistantHash = expectedAssistantSha256.toLowerCase();
+    const matchedIndex = stableTurnIdentityAvailable
+      ? completed.length - 1
+      : completed.findLastIndex((pair) =>
+          pair.originSessionId === expectedOriginSessionId &&
+          hashAuditorBody(pair.user) === expectedUserHash &&
+          hashAuditorBody(pair.assistant) === expectedAssistantHash);
+    const matched = matchedIndex >= 0 ? completed[matchedIndex] : latest;
+    const identityMatched = matchedIndex >= 0 && matched.originSessionId === expectedOriginSessionId &&
+      (!stableTurnIdentityAvailable || matched.turnNumber === expectedTurnNumber);
+    const userMatched = matchedIndex >= 0 && hashAuditorBody(matched.user) === expectedUserHash;
+    const assistantMatched = matchedIndex >= 0 && hashAuditorBody(matched.assistant) === expectedAssistantHash;
+    if (!identityMatched || !userMatched || !assistantMatched) {
+      return emptyResult('stale', 'latest_pair_mismatch', { sessionId, projectRoot, recentTurns });
+    }
+
+    const stableCompleted = completed.slice(0, matchedIndex + 1);
+    const bounded = boundCompletedPairs(stableCompleted.slice(-recentTurns), { maxBodyChars, maxTotalChars });
+    return {
+      schema: AUDITOR_CONTEXT_SCHEMA,
+      status: 'fresh',
+      reason: 'latest_pair_matched',
+      sessionId,
+      projectPath: canonicalProjectPath(projectRoot),
+      source: 'throughline-db-l2',
+      freshness: {
+        originSessionId: matched.originSessionId,
+        turnNumber: matched.turnNumber,
+        identityMatched: true,
+        userMatched: true,
+        assistantMatched: true,
+      },
+      turns: bounded.turns,
+      stats: {
+        requestedTurns: recentTurns,
+        returnedTurns: bounded.turns.length,
+        chars: bounded.chars,
+        truncated: bounded.truncated,
+      },
+    };
+  } catch (cause) {
+    if (cause instanceof AuditorContextError) throw cause;
+    throw new AuditorContextError('E_AUDITOR_CONTEXT_QUERY', 'auditor context query failed', { cause });
+  } finally {
+    db.close();
+  }
+}
+
+export class AuditorContextError extends Error {
+  constructor(code, message, { cause } = {}) {
+    super(message, { cause });
+    this.name = 'AuditorContextError';
+    this.code = code;
+  }
+}
+
+function buildCompletedPairs(rows) {
+  const grouped = new Map();
+  for (const row of rows) {
+    if (!row?.origin_session_id || !Number.isInteger(row.turn_number)) continue;
+    const key = `${row.origin_session_id}\u0000${row.turn_number}`;
+    const pair = grouped.get(key) ?? {
+      originSessionId: row.origin_session_id,
+      turnNumber: row.turn_number,
+      user: null,
+      assistant: null,
+      createdAt: Number(row.created_at) || 0,
+      lastId: Number(row.id) || 0,
+    };
+    if (row.role === 'user' && pair.user === null) pair.user = normalizeAuditorBody(row.text);
+    if (row.role === 'assistant' && pair.assistant === null) pair.assistant = normalizeAuditorBody(row.text);
+    pair.createdAt = Math.max(pair.createdAt, Number(row.created_at) || 0);
+    pair.lastId = Math.max(pair.lastId, Number(row.id) || 0);
+    grouped.set(key, pair);
+  }
+  return [...grouped.values()]
+    .filter((pair) => pair.user !== null && pair.assistant !== null)
+    .sort((a, b) => a.createdAt - b.createdAt || a.lastId - b.lastId)
+    .map(({ lastId: _lastId, ...pair }) => pair);
+}
+
+function boundCompletedPairs(pairs, { maxBodyChars, maxTotalChars }) {
+  const prepared = pairs.map((pair) => {
+    const user = tail(pair.user, maxBodyChars);
+    const assistant = tail(pair.assistant, maxBodyChars);
+    return {
+      ...pair,
+      user,
+      assistant,
+      truncated: user.length < pair.user.length || assistant.length < pair.assistant.length,
+    };
+  });
+
+  const selected = [];
+  let chars = 0;
+  let truncated = prepared.some((pair) => pair.truncated);
+  for (let i = prepared.length - 1; i >= 0; i--) {
+    const pair = prepared[i];
+    const remaining = maxTotalChars - chars;
+    if (remaining <= 0) {
+      truncated = true;
+      continue;
+    }
+    let user = pair.user;
+    let assistant = pair.assistant;
+    if (user.length + assistant.length > remaining) {
+      const assistantBudget = Math.min(assistant.length, Math.ceil(remaining / 2));
+      const userBudget = Math.max(0, remaining - assistantBudget);
+      user = tail(user, userBudget);
+      assistant = tail(assistant, assistantBudget);
+      truncated = true;
+    }
+    if (user.length === 0 || assistant.length === 0) {
+      truncated = true;
+      continue;
+    }
+    chars += user.length + assistant.length;
+    selected.unshift({
+      originSessionId: pair.originSessionId,
+      turnNumber: pair.turnNumber,
+      user,
+      assistant,
+      createdAt: pair.createdAt,
+    });
+  }
+  return { turns: selected, chars, truncated };
+}
+
+function emptyResult(status, reason, { sessionId, projectRoot, recentTurns, dbSchemaVersion } = {}) {
+  return {
+    schema: AUDITOR_CONTEXT_SCHEMA,
+    status,
+    reason,
+    sessionId,
+    projectPath: canonicalProjectPath(projectRoot),
+    source: 'throughline-db-l2',
+    freshness: {
+      identityMatched: false,
+      userMatched: false,
+      assistantMatched: false,
+    },
+    turns: [],
+    stats: {
+      requestedTurns: recentTurns,
+      returnedTurns: 0,
+      chars: 0,
+      truncated: false,
+      ...(Number.isInteger(dbSchemaVersion) ? { dbSchemaVersion } : {}),
+    },
+  };
+}
+
+function canonicalProjectPath(value) {
+  const raw = String(value ?? '');
+  if (/^[A-Za-z]:[\\/]/.test(raw)) {
+    return raw.replace(/\\/g, '/').replace(/\/+$/, '').toLowerCase();
+  }
+  let normalized = isAbsolute(raw) ? raw : resolve(raw);
+  try {
+    if (existsSync(normalized)) normalized = realpathSync.native(normalized);
+  } catch {
+    // Keep the lexical path when the filesystem cannot resolve it.
+  }
+  return normalized.split(sep).join('/').replace(/\/+$/, '');
+}
+
+function isSameProjectOrDescendant(candidate, root) {
+  const normalizedCandidate = canonicalProjectPath(candidate);
+  const normalizedRoot = canonicalProjectPath(root);
+  const left = /^[A-Za-z]:\//.test(normalizedCandidate) ? normalizedCandidate.toLowerCase() : normalizedCandidate;
+  const right = /^[A-Za-z]:\//.test(normalizedRoot) ? normalizedRoot.toLowerCase() : normalizedRoot;
+  return left === right || left.startsWith(`${right}/`);
+}
+
+function tail(value, maxChars) {
+  if (maxChars <= 0) return '';
+  return value.length <= maxChars ? value : value.slice(value.length - maxChars);
+}
+
+function isSha256(value) {
+  return typeof value === 'string' && /^[a-fA-F0-9]{64}$/.test(value);
+}
+
+function assertNonEmptyString(value, name) {
+  if (typeof value !== 'string' || value.length === 0) {
+    throw new TypeError(`${name} must be a non-empty string`);
+  }
+}
+
+function assertPositiveInteger(value, name) {
+  if (!Number.isInteger(value) || value < 1) {
+    throw new TypeError(`${name} must be an integer >= 1`);
+  }
+}

package/src/auditor-context.test.mjs

@@ -0,0 +1,303 @@
+import assert from 'node:assert/strict';
+import { existsSync, lstatSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import test from 'node:test';
+import { DatabaseSync } from 'node:sqlite';
+
+import {
+  AUDITOR_CONTEXT_SCHEMA,
+  deriveAuditorFreshnessExpectation,
+  hashAuditorBody,
+  readAuditorContext,
+} from './auditor-context.mjs';
+
+function withDb(fn, { version = 8 } = {}) {
+  const dir = mkdtempSync(join(tmpdir(), 'tl-auditor-context-'));
+  const path = join(dir, 'throughline.db');
+  const db = new DatabaseSync(path);
+  db.exec(`
+    PRAGMA journal_mode = WAL;
+    PRAGMA user_version = ${version};
+    CREATE TABLE sessions (session_id TEXT PRIMARY KEY, project_path TEXT NOT NULL);
+    CREATE TABLE bodies (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      session_id TEXT NOT NULL,
+      origin_session_id TEXT NOT NULL,
+      turn_number INTEGER NOT NULL,
+      role TEXT NOT NULL,
+      text TEXT NOT NULL,
+      created_at INTEGER NOT NULL
+    );
+  `);
+  try {
+    return fn({ db, path, dir });
+  } finally {
+    db.close();
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+function seedSession(db, { sessionId = 'session-1', projectPath = '/repo', pairs = [] } = {}) {
+  db.prepare('INSERT INTO sessions (session_id, project_path) VALUES (?, ?)').run(sessionId, projectPath);
+  let createdAt = 1;
+  for (const pair of pairs) {
+    for (const [role, text] of [['user', pair.user], ['assistant', pair.assistant]]) {
+      db.prepare(
+        'INSERT INTO bodies (session_id, origin_session_id, turn_number, role, text, created_at) VALUES (?, ?, ?, ?, ?, ?)',
+      ).run(sessionId, pair.originSessionId, pair.turnNumber, role, text, createdAt++);
+    }
+  }
+}
+
+function expected(pair) {
+  return {
+    expectedOriginSessionId: pair.originSessionId,
+    expectedTurnNumber: pair.turnNumber,
+    expectedUserSha256: hashAuditorBody(pair.user),
+    expectedAssistantSha256: hashAuditorBody(pair.assistant),
+  };
+}
+
+function read(path, pair, extra = {}) {
+  return readAuditorContext({
+    dbPath: path,
+    sessionId: 'session-1',
+    projectRoot: '/repo',
+    ...expected(pair),
+    ...extra,
+  });
+}
+
+test('readAuditorContext: returns a fresh completed pair with canonical origin identity', () => {
+  withDb(({ db, path }) => {
+    const pair = { originSessionId: 'origin-a', turnNumber: 4, user: ' ask\r\n', assistant: ' answer\r\n' };
+    seedSession(db, { pairs: [pair] });
+
+    const result = read(path, pair);
+    assert.equal(result.schema, AUDITOR_CONTEXT_SCHEMA);
+    assert.equal(result.status, 'fresh');
+    assert.equal(result.reason, 'latest_pair_matched');
+    assert.deepEqual(result.turns, [
+      { originSessionId: 'origin-a', turnNumber: 4, user: 'ask', assistant: 'answer', createdAt: 2 },
+    ]);
+    assert.deepEqual(result.freshness, {
+      originSessionId: 'origin-a', turnNumber: 4, identityMatched: true, userMatched: true, assistantMatched: true,
+    });
+  });
+});
+
+test('readAuditorContext: pair identity or hash mismatch is stale', () => {
+  withDb(({ db, path }) => {
+    const pair = { originSessionId: 'origin-a', turnNumber: 4, user: 'ask', assistant: 'answer' };
+    seedSession(db, { pairs: [pair] });
+
+    for (const extra of [
+      { expectedOriginSessionId: 'origin-other' },
+      { expectedTurnNumber: 5 },
+      { expectedUserSha256: hashAuditorBody('other') },
+      { expectedAssistantSha256: hashAuditorBody('other') },
+    ]) {
+      const result = read(path, pair, extra);
+      assert.equal(result.status, 'stale');
+      assert.equal(result.reason, 'latest_pair_mismatch');
+      assert.deepEqual(result.turns, []);
+    }
+  });
+});
+
+test('readAuditorContext: returns empty for no complete pair and excludes developer/L3 roles', () => {
+  withDb(({ db, path }) => {
+    seedSession(db);
+    db.prepare('INSERT INTO bodies (session_id, origin_session_id, turn_number, role, text, created_at) VALUES (?, ?, ?, ?, ?, ?)')
+      .run('session-1', 'origin-a', 1, 'developer', 'secret developer context', 1);
+    db.prepare('INSERT INTO bodies (session_id, origin_session_id, turn_number, role, text, created_at) VALUES (?, ?, ?, ?, ?, ?)')
+      .run('session-1', 'origin-a', 1, 'user', 'unpaired request', 2);
+    const pair = { originSessionId: 'origin-a', turnNumber: 1, user: 'unpaired request', assistant: 'missing' };
+
+    const result = read(path, pair);
+    assert.equal(result.status, 'empty');
+    assert.equal(result.reason, 'completed_pair_not_found');
+    assert.deepEqual(result.turns, []);
+  });
+});
+
+test('readAuditorContext: reports project mismatch without exposing rows', () => {
+  withDb(({ db, path }) => {
+    const pair = { originSessionId: 'origin-a', turnNumber: 1, user: 'private', assistant: 'private reply' };
+    seedSession(db, { projectPath: '/other-project', pairs: [pair] });
+    const result = read(path, pair);
+    assert.equal(result.status, 'session_mismatch');
+    assert.equal(result.reason, 'project_mismatch');
+    assert.deepEqual(result.turns, []);
+  });
+});
+
+test('readAuditorContext: applies recent-turn, body, and total bounds from the newest pairs', () => {
+  withDb(({ db, path }) => {
+    const old = { originSessionId: 'origin-a', turnNumber: 1, user: 'old user', assistant: 'old assistant' };
+    const latest = { originSessionId: 'origin-a', turnNumber: 2, user: 'abcdef', assistant: 'uvwxyz' };
+    seedSession(db, { pairs: [old, latest] });
+    const result = read(path, latest, { recentTurns: 1, maxBodyChars: 4, maxTotalChars: 5 });
+    assert.equal(result.status, 'fresh');
+    assert.deepEqual(result.turns, [
+      { originSessionId: 'origin-a', turnNumber: 2, user: 'ef', assistant: 'xyz', createdAt: 4 },
+    ]);
+    assert.deepEqual(result.stats, { requestedTurns: 1, returnedTurns: 1, chars: 5, truncated: true });
+  });
+});
+
+test('readAuditorContext: reports schema mismatch and missing DB as exit-safe JSON states', () => {
+  withDb(({ db, path }) => {
+    const pair = { originSessionId: 'origin-a', turnNumber: 1, user: 'u', assistant: 'a' };
+    seedSession(db, { pairs: [pair] });
+    const mismatched = read(path, pair);
+    assert.equal(mismatched.status, 'schema_mismatch');
+    assert.equal(mismatched.reason, 'unsupported_db_schema');
+  }, { version: 7 });
+
+  const pair = { originSessionId: 'origin-a', turnNumber: 1, user: 'u', assistant: 'a' };
+  const missing = read('/definitely-missing-throughline-auditor-context.db', pair);
+  assert.equal(missing.status, 'unavailable');
+  assert.equal(missing.reason, 'db_not_found');
+});
+
+test('readAuditorContext: opens a live WAL database read-only without changing DB, -wal, or -shm', () => {
+  withDb(({ db, path }) => {
+    const pair = { originSessionId: 'origin-a', turnNumber: 1, user: 'u', assistant: 'a' };
+    seedSession(db, { pairs: [pair] });
+    db.exec('BEGIN IMMEDIATE');
+    const before = snapshotSqliteFiles(path);
+    const result = read(path, pair);
+    assert.equal(result.status, 'fresh');
+    assert.deepEqual(snapshotSqliteFiles(path), before);
+    db.exec('ROLLBACK');
+  });
+});
+
+test('readAuditorContext: classifies an exclusive database lock without exposing SQLite diagnostics', () => {
+  withDb(({ db, path }) => {
+    const pair = { originSessionId: 'origin-a', turnNumber: 1, user: 'u', assistant: 'a' };
+    seedSession(db, { pairs: [pair] });
+    db.exec('PRAGMA journal_mode = DELETE; BEGIN EXCLUSIVE');
+    try {
+      assert.throws(
+        () => read(path, pair),
+        (error) => {
+          assert.equal(error.code, 'E_AUDITOR_CONTEXT_QUERY');
+          assert.equal(error.message, 'auditor context query failed');
+          assert.equal(error.message.includes('locked'), false);
+          return true;
+        },
+      );
+    } finally {
+      db.exec('ROLLBACK');
+    }
+  });
+});
+
+test('deriveAuditorFreshnessExpectation: Claude logical groups use the latest representative fragment and session origin', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'tl-auditor-claude-transcript-'));
+  const transcript = join(dir, 'session.jsonl');
+  try {
+    writeFileSync(transcript, [
+      claudeRow('user', 'first request'),
+      claudeRow('assistant', 'first answer'),
+      claudeRow('user', 'latest request'),
+      claudeRow('assistant', 'partial answer'),
+      claudeRow('assistant', 'latest representative answer'),
+    ].map(JSON.stringify).join('\n'));
+
+    assert.deepEqual(
+      deriveAuditorFreshnessExpectation({ host: 'claude', transcriptPath: transcript, sessionId: 'claude-session' }),
+      {
+        expectedOriginSessionId: 'claude-session',
+        expectedTurnNumber: 4,
+        expectedUserSha256: hashAuditorBody('latest request'),
+        expectedAssistantSha256: hashAuditorBody('latest representative answer'),
+      },
+    );
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('deriveAuditorFreshnessExpectation: Codex excludes current in-flight turn before deriving latest completed identity', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'tl-auditor-codex-rollout-'));
+  const rollout = join(dir, 'rollout.jsonl');
+  try {
+    writeFileSync(rollout, [
+      codexEvent('user_message', { message: 'completed request' }),
+      codexEvent('task_started'),
+      codexEvent('agent_message', { message: 'completed answer' }),
+      codexEvent('task_complete'),
+      codexEvent('user_message', { message: 'in-flight request' }),
+      codexEvent('task_started'),
+      codexEvent('agent_message', { message: 'in-flight answer' }),
+    ].map(JSON.stringify).join('\n'));
+
+    assert.deepEqual(
+      deriveAuditorFreshnessExpectation({ host: 'codex', transcriptPath: rollout, sessionId: 'codex:thread-1' }),
+      {
+        expectedOriginSessionId: 'codex:thread-1',
+        expectedTurnNumber: null,
+        expectedUserSha256: hashAuditorBody('completed request'),
+        expectedAssistantSha256: hashAuditorBody('completed answer'),
+      },
+    );
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('readAuditorContext: Codex freshness uses exact origin and both pair hashes when turn ordinals are unstable', () => {
+  withDb(({ db, path }) => {
+    seedSession(db, {
+      sessionId: 'codex:thread-1',
+      projectPath: '/repo',
+      pairs: [{
+        originSessionId: 'codex:thread-1', turnNumber: 32,
+        user: 'completed request', assistant: 'completed answer',
+      }, {
+        originSessionId: 'codex:thread-1', turnNumber: 33,
+        user: 'transient request', assistant: 'transient answer',
+      }],
+    });
+    const result = readAuditorContext({
+      dbPath: path,
+      sessionId: 'codex:thread-1',
+      projectRoot: '/repo',
+      expectedOriginSessionId: 'codex:thread-1',
+      expectedTurnNumber: null,
+      expectedUserSha256: hashAuditorBody('completed request'),
+      expectedAssistantSha256: hashAuditorBody('completed answer'),
+    });
+    assert.equal(result.status, 'fresh');
+    assert.equal(result.freshness.turnNumber, 32);
+    assert.equal(result.turns.at(-1).turnNumber, 32);
+    assert.equal(result.turns.some((turn) => turn.turnNumber === 33), false);
+  });
+});
+
+function snapshotSqliteFiles(path) {
+  return [path, `${path}-wal`, `${path}-shm`].map((file) => {
+    if (!existsSync(file)) return { file, exists: false };
+    const stat = lstatSync(file);
+    try {
+      return { file, exists: true, size: stat.size, mtimeMs: stat.mtimeMs, bytes: readFileSync(file).toString('hex') };
+    } catch (error) {
+      // Windows denies byte reads for a live WAL handle.  Metadata still
+      // proves the read-only auditor did not create or mutate a sidecar.
+      if (error?.code === 'EBUSY') return { file, exists: true, size: stat.size, mtimeMs: stat.mtimeMs, readError: 'EBUSY' };
+      throw error;
+    }
+  });
+}
+
+function claudeRow(role, text) {
+  return { type: role, message: { role, content: [{ type: 'text', text }] } };
+}
+
+function codexEvent(type, payload = {}) {
+  return { timestamp: '2026-07-13T00:00:00.000Z', type: 'event_msg', payload: { type, ...payload } };
+}