wendkeep 0.87.0 → 0.89.0

package/src/observer.mjs

@@ -1,4 +1,6 @@
 import { homedir } from 'node:os';
+import { randomBytes } from 'node:crypto';
+import { readFileSync } from 'node:fs';
 import { isAbsolute, resolve } from 'node:path';
 import { readObserverIndexSource } from './observer-store.mjs';
 import { buildProjectSnapshot } from './observer-snapshot.mjs';
@@ -6,15 +8,23 @@ import { compareMemoryParity } from './observer-memory-publish.mjs';
 import { publishObserverSql } from './observer-sql-publish.mjs';
 import { migrateObserverData } from './observer-sql-migrate.mjs';
 import { startObserverServer } from './observer-server.mjs';
-import { ensureObserverDatabase, migrateObserverDatabase, listSqlProjects, registerSqlProject, upsertSqlProjectSnapshot, OBSERVER_SQL_FILE, OBSERVER_SQL_SCHEMA_VERSION } from './observer-sql-store.mjs';
+import { ensureObserverDatabase, listSqlProjects, readSqlProject, registerSqlProject, upsertSqlProjectSnapshot, OBSERVER_SQL_FILE, OBSERVER_SQL_SCHEMA_VERSION } from './observer-sql-store.mjs';
 import { resolveProjectVault } from '../packages/vault/src/project-vault.mjs';
 import { observerAuthHeaders, resolveObserverToken } from './observer-auth.mjs';
+import { recordObserverAudit } from '../packages/observer/src/authz.mjs';
+import { readObserverPolicy, saveObserverPolicy } from '../packages/observer/src/policy.mjs';
+import { purgeObserverData } from '../packages/observer/src/purge.mjs';
+import { runObserverRetention } from '../packages/observer/src/retention.mjs';
+import { registerObserverToken, revokeObserverToken, rotateObserverToken } from '../packages/observer/src/token-registry.mjs';
+import { observerEncryptionFromEnvironment } from '../packages/observer/src/encryption.mjs';
 
 export const OBSERVER_HELP = `wendkeep observer — Observer local multi-projeto
 
 Uso:
   wendkeep observer serve [--data-dir P] [--host 127.0.0.1] [--port 8787]
-                          [--allow-non-loopback] [--token TOKEN]
+                          [--allow-non-loopback] [--require-loopback-auth] [--require-encryption] [--token TOKEN]
+                          [--bootstrap-token-id ID] [--bootstrap-role ROLE]
+                          [--bootstrap-projects P1,P2] [--bootstrap-scopes S1,S2] --bootstrap-expires-at ISO
   wendkeep observer register --project P [--vault V] [--data-dir D] [--json]
   wendkeep observer publish --project P [--vault V] [--data-dir D] [--json]
   wendkeep observer reconcile --project P [--vault V] [--data-dir D] [--url U]
@@ -22,6 +32,14 @@ Uso:
   wendkeep observer memory import --project P [--vault V] [--url U] [--token TOKEN]
                                     [--capture-level metadata|messages|full-transcript] [--json]
   wendkeep observer status [--data-dir D] [--json]
+  wendkeep observer security token create --project-id P --role R --scopes S
+                          --token-env ENV --expires-at ISO [--token-id ID] [--reason TEXT] [--json]
+  wendkeep observer security token rotate --project-id P --token-id ID --token-env ENV
+                          --expires-at ISO [--new-token-id ID] [--reason TEXT] [--json]
+  wendkeep observer security token revoke --project-id P --token-id ID [--reason TEXT] [--json]
+  wendkeep observer security policy set --project-id P --file policy.json [--json]
+  wendkeep observer security purge --project-id P --before ISO --classes C [--dry-run] [--operation-id ID] [--json]
+  wendkeep observer security retention run --project-id P [--dry-run] [--operation-id ID] [--observed-at ISO] [--json]
 
 O Observer local pode manter snapshots operacionais e uma cópia completa da memória em volume
 Docker. O comando memory import faz a primeira migração de um vault para o container.
@@ -34,6 +52,10 @@ function optionValue(argv, name) {
   return argv.find((item) => item.startsWith(`${name}=`))?.slice(name.length + 1) || '';
 }
 
+function csv(value) {
+  return String(value || '').split(',').map((item) => item.trim()).filter(Boolean);
+}
+
 function dataDir(argv) {
   return resolve(optionValue(argv, '--data-dir')
     || process.env.WENDKEEP_OBSERVER_DATA_DIR
@@ -62,23 +84,22 @@ function summary(index) {
   };
 }
 
-function databaseSummary(dir) {
-  const db = ensureObserverDatabase(dir);
+function databaseSummary(dir, security) {
+  const db = ensureObserverDatabase(dir, { security });
   try {
-    const migrations = migrateObserverDatabase(db);
     return {
       engine: 'sqlite',
       file: OBSERVER_SQL_FILE,
       schema_version: OBSERVER_SQL_SCHEMA_VERSION,
-      migrations: migrations.applied.length,
+      migrations: Number(db.prepare('SELECT COUNT(*) AS count FROM schema_migrations').get().count),
       projects: listSqlProjects(db).length,
       ready: true,
     };
   } finally { db.close(); }
 }
 
-function sqlProjectsSummary(dir) {
-  const db = ensureObserverDatabase(dir);
+function sqlProjectsSummary(dir, security) {
+  const db = ensureObserverDatabase(dir, { security });
   try {
     return listSqlProjects(db).map((project) => ({
       projectId: project.project_id,
@@ -99,21 +120,133 @@ export async function runObserver(argv = [], { write = (chunk) => process.stdout
   }
   const dir = dataDir(argv);
   const token = resolveObserverToken(optionValue(argv, '--token'));
+  const databaseSecurity = {
+    encryption: observerEncryptionFromEnvironment({
+      required: argv.includes('--require-encryption') || process.env.WENDKEEP_OBSERVER_REQUIRE_ENCRYPTION === '1',
+    }),
+  };
+
+  if (sub === 'security') {
+    const domain = argv[1] || '';
+    const action = argv[2] || '';
+    const projectId = optionValue(argv, '--project-id');
+    if (!projectId) throw new Error('observer security: --project-id é obrigatório.');
+    const db = ensureObserverDatabase(dir, { security: databaseSecurity });
+    try {
+      readSqlProject(db, projectId);
+      if (domain === 'token' && action === 'create') {
+        const envName = optionValue(argv, '--token-env');
+        const rawToken = envName ? String(process.env[envName] || '') : '';
+        if (!envName || !rawToken) throw new Error('observer security token create: --token-env deve apontar para um segredo não vazio.');
+        const created = registerObserverToken(db, {
+          tokenId: optionValue(argv, '--token-id') || randomBytes(12).toString('hex'),
+          token: rawToken,
+          role: optionValue(argv, '--role'),
+          projectIds: [projectId],
+          scopes: optionValue(argv, '--scopes').split(',').map((item) => item.trim()).filter(Boolean),
+          expiresAt: optionValue(argv, '--expires-at'),
+        });
+        recordObserverAudit(db, {
+          projectId, tokenId: created.token_id, capability: 'security:recovery', outcome: 'created',
+          metadata: { route: 'offline-cli', method: 'LOCAL', reason: optionValue(argv, '--reason') || 'token create' },
+        });
+        print(created, asJson, write);
+        return 0;
+      }
+      if (domain === 'token' && action === 'revoke') {
+        const tokenId = optionValue(argv, '--token-id');
+        const revoked = revokeObserverToken(db, { tokenId });
+        recordObserverAudit(db, {
+          projectId, tokenId, capability: 'security:recovery', outcome: revoked.revoked ? 'revoked' : 'not-found',
+          metadata: { route: 'offline-cli', method: 'LOCAL', reason: optionValue(argv, '--reason') || 'token revoke' },
+        });
+        print(revoked, asJson, write);
+        return revoked.revoked ? 0 : 1;
+      }
+      if (domain === 'token' && action === 'rotate') {
+        const envName = optionValue(argv, '--token-env');
+        const rawToken = envName ? String(process.env[envName] || '') : '';
+        if (!envName || !rawToken) throw new Error('observer security token rotate: --token-env deve apontar para um segredo não vazio.');
+        const rotated = rotateObserverToken(db, {
+          tokenId: optionValue(argv, '--token-id'),
+          newTokenId: optionValue(argv, '--new-token-id') || randomBytes(12).toString('hex'),
+          newToken: rawToken,
+          expiresAt: optionValue(argv, '--expires-at'),
+        });
+        recordObserverAudit(db, {
+          projectId, tokenId: rotated.token_id, capability: 'security:recovery', outcome: 'rotated',
+          metadata: { route: 'offline-cli', method: 'LOCAL', reason: optionValue(argv, '--reason') || 'token rotate' },
+        });
+        print(rotated, asJson, write);
+        return 0;
+      }
+      if (domain === 'policy' && action === 'set') {
+        const path = optionValue(argv, '--file');
+        if (!path) throw new Error('observer security policy set: --file é obrigatório.');
+        const policy = saveObserverPolicy(db, projectId, JSON.parse(readFileSync(resolve(path), 'utf8')));
+        print({ schema_version: 1, project_id: projectId, policy }, asJson, write);
+        return 0;
+      }
+      if (domain === 'policy' && action === 'show') {
+        print({ schema_version: 1, project_id: projectId, policy: readObserverPolicy(db, projectId) }, asJson, write);
+        return 0;
+      }
+      if (domain === 'purge') {
+        const result = purgeObserverData(db, {
+          projectId,
+          before: optionValue(argv, '--before'),
+          classes: optionValue(argv, '--classes').split(',').map((item) => item.trim()).filter(Boolean),
+          operationId: optionValue(argv, '--operation-id'),
+          dryRun: argv.includes('--dry-run'),
+        });
+        print(result, asJson, write);
+        return 0;
+      }
+      if (domain === 'retention' && action === 'run') {
+        const policy = readObserverPolicy(db, projectId);
+        const observedAt = optionValue(argv, '--observed-at');
+        const result = runObserverRetention(db, {
+          projectId,
+          policy: policy.retention,
+          clock: () => observedAt ? new Date(observedAt) : new Date(),
+          operationId: optionValue(argv, '--operation-id'),
+          dryRun: argv.includes('--dry-run'),
+        });
+        print(result, asJson, write);
+        return 0;
+      }
+      throw new Error(`observer security: operação desconhecida: ${domain} ${action}`.trim());
+    } finally { db.close(); }
+  }
 
   if (sub === 'status') {
     const legacy = summary(readObserverIndexSource(dir));
-    print({ ...legacy, projects: sqlProjectsSummary(dir), legacy_projects: legacy.projects, database: databaseSummary(dir) }, asJson, write);
+    print({ ...legacy, projects: sqlProjectsSummary(dir, databaseSecurity), legacy_projects: legacy.projects, database: databaseSummary(dir, databaseSecurity) }, asJson, write);
     return 0;
   }
 
   if (sub === 'serve') {
     const host = optionValue(argv, '--host') || '127.0.0.1';
+    const encryption = databaseSecurity.encryption;
+    const secureMode = argv.includes('--require-loopback-auth') || Boolean(encryption);
     const server = await startObserverServer({
       dataDir: dir,
       host,
       port: Number(optionValue(argv, '--port') || 8787),
       allowNonLoopback: argv.includes('--allow-non-loopback'),
       token,
+      bootstrap: {
+        tokenId: optionValue(argv, '--bootstrap-token-id') || process.env.WENDKEEP_OBSERVER_BOOTSTRAP_TOKEN_ID || '',
+        role: optionValue(argv, '--bootstrap-role') || process.env.WENDKEEP_OBSERVER_BOOTSTRAP_ROLE || 'admin',
+        projectIds: csv(optionValue(argv, '--bootstrap-projects') || process.env.WENDKEEP_OBSERVER_BOOTSTRAP_PROJECTS),
+        scopes: csv(optionValue(argv, '--bootstrap-scopes') || process.env.WENDKEEP_OBSERVER_BOOTSTRAP_SCOPES || '*'),
+        expiresAt: optionValue(argv, '--bootstrap-expires-at') || process.env.WENDKEEP_OBSERVER_BOOTSTRAP_EXPIRES_AT || '',
+      },
+      security: {
+        enabled: secureMode,
+        requireLoopbackAuth: argv.includes('--require-loopback-auth'),
+        encryption,
+      },
     });
     const address = server.address();
     process.stdout.write(`wendkeep observer listening: http://${address.address}:${address.port}\n`);
@@ -179,7 +312,7 @@ export async function runObserver(argv = [], { write = (chunk) => process.stdout
     const snapshot = buildProjectSnapshot({ vaultBase: vault, projectRoot: root });
     const url = optionValue(argv, '--url') || process.env.WENDKEEP_OBSERVER_URL || '';
     if (!url) {
-      const db = ensureObserverDatabase(dir);
+      const db = ensureObserverDatabase(dir, { security: databaseSecurity });
       let migration;
       try {
         migration = migrateObserverData({
@@ -231,7 +364,7 @@ export async function runObserver(argv = [], { write = (chunk) => process.stdout
   const snapshot = buildProjectSnapshot({ vaultBase: vault, projectRoot: root });
 
   if (sub === 'register') {
-    const db = ensureObserverDatabase(dir);
+    const db = ensureObserverDatabase(dir, { security: databaseSecurity });
     let sql;
     try {
       sql = registerSqlProject(db, {
@@ -245,7 +378,7 @@ export async function runObserver(argv = [], { write = (chunk) => process.stdout
     return 0;
   }
 
-  const db = ensureObserverDatabase(dir);
+  const db = ensureObserverDatabase(dir, { security: databaseSecurity });
   let migration;
   try {
     migration = migrateObserverData({

package/src/sync-protocol.mjs

@@ -73,9 +73,25 @@ function validatePrivatePayload(payload) {
   }
 }
 
+function normalizePolicyRef(value) {
+  if (value == null) return null;
+  const keys = Object.keys(value).sort();
+  if (keys.join(',') !== 'hash,policy_id,version'
+    || !HASH_PATTERN.test(String(value.hash || ''))
+    || !Number.isSafeInteger(Number(value.version)) || Number(value.version) < 1) {
+    throw syncError('WENDKEEP_SYNC_POLICY_REF_INVALID', 'policy_ref must contain only policy_id, version and sha256 hash');
+  }
+  return {
+    policy_id: requiredText(value.policy_id, 'policy_ref.policy_id', 160),
+    version: Number(value.version),
+    hash: String(value.hash),
+  };
+}
+
 export function createSyncEvent({
   projectId, recordKey, revision, baseRevision, payload = null, causalParentIds = [],
   actorId, deviceId, leaseId = '', observedAt, operation = 'put', privacy = 'shared',
+  policyRef = null,
 } = {}) {
   const project_id = requiredText(projectId, 'project_id', 160);
   const record_key = requiredText(recordKey, 'record_key', 2048);
@@ -108,6 +124,7 @@ export function createSyncEvent({
     observed_at: timestamp.toISOString(),
     operation,
     privacy,
+    ...(policyRef ? { policy_ref: normalizePolicyRef(policyRef) } : {}),
     payload: operation === 'tombstone' ? null : structuredClone(payload),
   };
   return { ...draft, event_id: syncSha256(draft).slice(7) };
@@ -137,6 +154,7 @@ export function validateSyncEvent(event, { projectId = '' } = {}) {
     observedAt: event.observed_at,
     operation: event.operation,
     privacy: event.privacy,
+    policyRef: event.policy_ref || null,
   });
   return event;
 }
@@ -153,6 +171,7 @@ function eventCandidate(event) {
     observed_at: event.observed_at,
     operation: event.operation,
     privacy: event.privacy,
+    ...(event.policy_ref ? { policy_ref: structuredClone(event.policy_ref) } : {}),
     payload: structuredClone(event.payload),
   };
 }
@@ -168,6 +187,7 @@ function recordFromEvent(event, { conflicted = false } = {}) {
     observed_at: event.observed_at,
     operation: event.operation,
     privacy: event.privacy,
+    ...(event.policy_ref ? { policy_ref: structuredClone(event.policy_ref) } : {}),
     payload: structuredClone(event.payload),
     tombstone: event.operation === 'tombstone',
     conflicted,

package/src/task-contracts.mjs

@@ -43,6 +43,25 @@ function uniqueStrings(values) {
   return [...new Set(list.map((value) => String(value).trim()).filter(Boolean))];
 }
 
+export function normalizeExternalArtifactEvidence(input = {}) {
+  const source = String(input.source || '').trim();
+  const externalId = String(input.external_id || '').trim();
+  const kind = String(input.kind || '').trim();
+  const sha256Value = String(input.sha256 || '').trim();
+  if (!source || !externalId || !['artifact', 'review', 'commit'].includes(kind)
+    || !/^[a-f0-9]{64}$/.test(sha256Value)) {
+    throw Object.assign(new Error('external artifact evidence is incomplete'), { code: 'TASK_EXTERNAL_ARTIFACT_INVALID' });
+  }
+  return {
+    schema_version: 1,
+    source,
+    external_id: externalId,
+    kind,
+    sha256: sha256Value,
+    authority: 'reported',
+  };
+}
+
 function bindingFrom(input) {
   return {
     project_id: String(input.projectId || ''),

package/src/task.mjs

@@ -1,3 +1,4 @@
+import * as bridgeFs from 'node:fs';
 import { isAbsolute, resolve } from 'node:path';
 import { activeChange } from '../hooks/change-core.mjs';
 import { resolveActiveContext } from '../hooks/active-context-store.mjs';
@@ -6,6 +7,19 @@ import { buildTaskContractSnapshot, evaluateTaskContracts } from './task-contrac
 import { claimTaskLease, releaseTaskLease } from './task-leases.mjs';
 import { findProjectRoot } from '../packages/harness/src/sensors-core.mjs';
 import { resolveHookOperatingProfile } from '../hooks/operating-profile-runtime.mjs';
+import { buildSuperpowersDispatch } from '../packages/integrations/src/superpowers-adapter.mjs';
+import { importSpecKitProjection } from '../packages/integrations/src/spec-kit-adapter.mjs';
+import { validateBridgeProjection } from '../packages/integrations/src/bridge-contract.mjs';
+import { issueCanonicalDispatchAuthority } from '../packages/integrations/src/canonical-bridge-authority.mjs';
+
+export function buildExternalTaskDispatch({ adapter = '', taskContract, ...options } = {}) {
+  if (String(adapter) !== 'superpowers') {
+    throw Object.assign(new Error(`unsupported task adapter: ${adapter || '(missing)'}`), {
+      code: 'TASK_ADAPTER_UNSUPPORTED',
+    });
+  }
+  return buildSuperpowersDispatch({ taskContract, ...options });
+}
 
 const HELP = `wendkeep task <list|show|evaluate|claim|release> [task-id]
 
@@ -56,6 +70,74 @@ function commandState(argv) {
   };
 }
 
+function resolveCanonicalTaskAuthority(argv = [], taskIdOverride = '') {
+  const state = commandState(argv);
+  const snapshot = buildTaskContractSnapshot(state);
+  const taskId = String(taskIdOverride || opt(argv, '--task-id') || '').trim();
+  const contract = snapshot.contracts.find((item) => item.task_id === taskId);
+  if (!contract) {
+    throw Object.assign(new Error(`task not found: ${taskId || '(missing id)'}`), { code: 'TASK_NOT_FOUND' });
+  }
+  return {
+    authority: 'wendkeep-canonical',
+    task_contract: structuredClone(contract),
+    active_context: structuredClone(snapshot.binding),
+  };
+}
+
+export function buildCanonicalExternalTaskDispatch({
+  adapter = '', authorityArgv = [], taskId = '', submittedTaskContract = null,
+  projectRoot = '', config, specKitProjection = null, baselineProjection = null, ...options
+} = {}) {
+  if (adapter !== 'superpowers') return buildExternalTaskDispatch({ adapter, taskContract: null, ...options });
+  if (specKitProjection) {
+    const supplied = validateBridgeProjection(specKitProjection);
+    if (!supplied.valid) {
+      return {
+        schema_version: 1, adapter: 'superpowers', active: true, ok: false,
+        diagnostics: [{
+          schema_version: 1, code: 'BRIDGE_PROJECTION_INVALID', adapter: 'spec-kit', blocking: true,
+          message: 'submitted Spec Kit projection is not sealed by its complete decision state',
+        }],
+      };
+    }
+  }
+  if (config?.adapters?.['spec-kit']?.enabled) {
+    if (!specKitProjection || !baselineProjection) {
+      return {
+        schema_version: 1, adapter: 'superpowers', active: true, ok: false,
+        diagnostics: [{
+          schema_version: 1, code: 'BRIDGE_BASELINE_MISSING', adapter: 'spec-kit', blocking: true,
+          message: 'active Spec Kit dispatch requires its canonical baseline and submitted projection',
+        }],
+      };
+    }
+    const baseline = validateBridgeProjection(baselineProjection);
+    if (!baseline.valid || baselineProjection.projection_id !== specKitProjection.projection_id) {
+      return {
+        schema_version: 1, adapter: 'superpowers', active: true, ok: false,
+        diagnostics: [{
+          schema_version: 1, code: 'BRIDGE_BASELINE_STALE', adapter: 'spec-kit', blocking: true,
+          message: 'submitted projection does not match the canonical Spec Kit baseline',
+        }],
+      };
+    }
+  }
+  const canonical = resolveCanonicalTaskAuthority(authorityArgv, taskId);
+  const canonicalReceipt = issueCanonicalDispatchAuthority(canonical);
+  const liveProjection = specKitProjection
+    ? importSpecKitProjection({ projectRoot, config, previousProjection: baselineProjection || specKitProjection, fs: bridgeFs })
+    : null;
+  return buildExternalTaskDispatch({
+    adapter,
+    taskContract: submittedTaskContract || canonical.task_contract,
+    canonicalAuthority: canonicalReceipt,
+    specKitProjection: liveProjection,
+    config,
+    ...options,
+  });
+}
+
 function write(value, json, line = '') {
   if (json) process.stdout.write(`${JSON.stringify(value)}\n`);
   else process.stdout.write(`${line || String(value)}\n`);

package/src/verify.mjs

@@ -25,6 +25,7 @@ import { resolveCommandActiveContext } from './active-context-runtime.mjs';
 import { resolveHookOperatingProfile } from '../hooks/operating-profile-runtime.mjs';
 import { evaluateTddAttestation } from './tdd-attestation.mjs';
 import { readTddAttestationStore } from './tdd-attestation-store.mjs';
+import { collectBridgeArtifactEvidence } from './ecosystem-bridge-artifact-collector.mjs';
 import { writeVaultFileAtomic } from '../packages/vault/src/vault-path-safety.mjs';
 import { evaluateHostCoverage } from '../packages/integrations/src/capabilities.mjs';
 import { evidenceCheckoutBinding } from '../packages/vault/src/evidence-envelope.mjs';
@@ -151,6 +152,13 @@ export function runVerify(argv) {
     process.stderr.write(`wendkeep verify: ${error.code || 'WENDKEEP_EVIDENCE_BINDING_FAILED'}: ${error.message}\n`);
     process.exit(2);
   }
+  let externalArtifacts;
+  try {
+    externalArtifacts = collectBridgeArtifactEvidence({ projectRoot, tasks, sensors: evidence });
+  } catch (error) {
+    process.stderr.write(`wendkeep verify: ${error.code || 'BRIDGE_ARTIFACT_COLLECTION_FAILED'}: ${error.message}\n`);
+    process.exit(2);
+  }
   const envelope = buildEvidenceEnvelope({
     identity,
     changeSlug: slug,
@@ -159,6 +167,7 @@ export function runVerify(argv) {
     effectiveSpecSha256: `sha256:${effective.hash}`,
     sensorConfigSha256: sensorConfigSha256(sensors, ids),
     sensors: evidence,
+    externalArtifacts,
     tddAttestations,
     startedAt,
     finishedAt: new Date().toISOString(),