witnora 0.18.5 → 0.18.6

package/dist/gateway.js

@@ -1260,20 +1260,33 @@ export async function activateManagedWorkflowHarness(options) {
     const path = join(directory, "workflow-harness.json");
     const serialized = `${JSON.stringify(config, null, 2)}\n`;
     let created = false;
+    let changed = false;
     if (await exists(path)) {
         const current = await readFile(path, "utf8");
         if (current !== serialized) {
             const parsed = parseManagedWorkflowHarnessConfig(current);
-            if (parsed.schemaVersion !== MANAGED_WORKFLOW_HARNESS_SCHEMA || canonicalHarnessConfig(parsed) !== canonicalHarnessConfig(config))
+            if (parsed.schemaVersion !== MANAGED_WORKFLOW_HARNESS_SCHEMA
+                || (canonicalHarnessConfig(parsed) !== canonicalHarnessConfig(config)
+                    && !isExactGeneratedHarnessUpgrade(parsed, config, options.previousGeneratedModuleSha256))) {
                 throw new Error("Existing workflow-harness.json differs from the generated Assurance Harness binding; refusing to overwrite customer configuration.");
+            }
             await writeFile(path, serialized, { encoding: "utf8", mode: 0o600 });
+            changed = true;
         }
     }
     else {
         await writeFile(path, serialized, { encoding: "utf8", mode: 0o600, flag: "wx" });
         created = true;
+        changed = true;
     }
-    return { state: "READY_TO_START", path, modulePath: evaluatorModulePath, config, created };
+    return { state: "READY_TO_START", path, modulePath: evaluatorModulePath, config, created, changed };
+}
+function isExactGeneratedHarnessUpgrade(current, next, previousGeneratedModuleSha256) {
+    if (!previousGeneratedModuleSha256 || current.evaluatorModuleSha256 !== previousGeneratedModuleSha256 || current.evaluatorContractSha256 !== previousGeneratedModuleSha256)
+        return false;
+    const { realPathActivations: _currentActivations, evaluatorModuleSha256: _currentModule, evaluatorContractSha256: _currentContract, ...currentStable } = current;
+    const { realPathActivations: _nextActivations, evaluatorModuleSha256: _nextModule, evaluatorContractSha256: _nextContract, ...nextStable } = next;
+    return JSON.stringify(currentStable) === JSON.stringify(nextStable);
 }
 function canonicalHarnessConfig(value) {
     const { realPathActivations: _activations, ...stable } = value;

package/dist/onboard.js

@@ -88,6 +88,7 @@ export async function runOnboard(options) {
     let gatewayMigration;
     let managedGateway;
     let runtimeUpgrade;
+    let realPathActivation;
     let assuranceHarnessReadiness = {
         state: "WAITING_FOR_CUSTOMER_HARNESS",
         limitation: "No approved customer Harness module is bound to this Agent repository.",
@@ -196,13 +197,13 @@ export async function runOnboard(options) {
         }
         const runtimeConfigured = await gatewayHasRuntimeWorker(repositoryPath);
         generatedFiles.push(...await generateAutopilotFiles(repositoryPath, repository.name, runtimeConfigured));
-        const realPathActivation = await activateRealPathIntegrations({ repository: repositoryPath, server, projectId: token.projectId, apiKey: token.apiKey, env: options.env, fetch: requestFetch });
+        realPathActivation = await activateRealPathIntegrations({ repository: repositoryPath, server, projectId: token.projectId, apiKey: token.apiKey, env: options.env, fetch: requestFetch });
         generatedFiles.push(...realPathActivation.generatedFiles);
         try {
-            const activation = await activateManagedWorkflowHarness({ repository: repositoryPath, realPathActivations: realPathActivation.activations });
+            const activation = await activateManagedWorkflowHarness({ repository: repositoryPath, realPathActivations: realPathActivation.activations, previousGeneratedModuleSha256: realPathActivation.previousGeneratedModuleSha256 });
             if (activation.created)
                 generatedFiles.push(activation.path);
-            assuranceHarnessChanged = activation.created;
+            assuranceHarnessChanged = activation.changed;
             assuranceHarnessReadiness = { state: "ACTIVE" };
         }
         catch (error) {
@@ -266,6 +267,7 @@ export async function runOnboard(options) {
         if (managedGateway?.started) {
             await gatewayLifecycle.stop({ repository: repositoryPath, configHome: options.configHome, fetch: requestFetch }).catch(() => undefined);
         }
+        await realPathActivation?.rollback().catch(() => undefined);
         await rollbackGeneratedFiles(generatedFiles);
         await runtimeUpgrade?.rollback().catch(() => undefined);
         if (gatewayMigration)

package/dist/real-path-activation.js

@@ -1,5 +1,5 @@
 import { createHash, randomUUID } from "node:crypto";
-import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
 export async function activateRealPathIntegrations(options) {
     const repository = resolve(options.repository ?? process.cwd());
@@ -7,14 +7,14 @@ export async function activateRealPathIntegrations(options) {
     const base = options.server.replace(/\/$/, "");
     const response = await request(`${base}/v1/projects/${encodeURIComponent(options.projectId)}/real-path-integrations`, { headers: { authorization: `Bearer ${options.apiKey}` } });
     if (response.status === 404)
-        return { state: "NOT_CONFIGURED", created: false, activations: [], generatedFiles: [] };
+        return { state: "NOT_CONFIGURED", created: false, activations: [], generatedFiles: [], rollback: async () => undefined };
     if (!response.ok)
         throw new Error(`Could not load approved real-path integrations (${response.status}).`);
     const body = await boundedJson(response);
     const approved = Array.isArray(body.integrations) ? body.integrations.map(parsePlan).filter((plan) => plan.status === "READY_TO_ACTIVATE") : [];
     const plans = approved.filter((plan) => ["STRIPE_REFUND", "SHOPIFY_DISPUTE", "ZENDESK_TICKET", "SALESFORCE_RECORD", "HUBSPOT_CRM_RECORD", "POSTGRES_RECORD"].includes(plan.generated.providerPackId) && plan.environment === "sandbox" && plan.customerSummary.evaluationMode === "SHADOW");
     if (!plans.length)
-        return { state: "NOT_CONFIGURED", created: false, activations: [], generatedFiles: [] };
+        return { state: "NOT_CONFIGURED", created: false, activations: [], generatedFiles: [], rollback: async () => undefined };
     const environment = options.env ?? process.env;
     const activations = [];
     const scenarios = [];
@@ -32,7 +32,9 @@ export async function activateRealPathIntegrations(options) {
     let created = false;
     const generatedFiles = [];
     const current = await readFile(modulePath, "utf8").catch((error) => error.code === "ENOENT" ? undefined : Promise.reject(error));
-    const prior = await readFile(manifestPath, "utf8").then((value) => JSON.parse(value)).catch(() => undefined);
+    const priorSource = await readFile(manifestPath, "utf8").catch((error) => error.code === "ENOENT" ? undefined : Promise.reject(error));
+    const prior = priorSource === undefined ? undefined : JSON.parse(priorSource);
+    const previousGeneratedModuleSha256 = current !== undefined && sha(current) === prior?.moduleDigestSha256 ? prior.moduleDigestSha256 : undefined;
     if (current === undefined) {
         await writeFile(modulePath, source, { encoding: "utf8", mode: 0o600, flag: "wx" });
         created = true;
@@ -44,12 +46,12 @@ export async function activateRealPathIntegrations(options) {
         const temporary = `${modulePath}.${randomUUID()}.tmp`;
         await writeFile(temporary, source, { encoding: "utf8", mode: 0o600, flag: "wx" });
         await rename(temporary, modulePath);
-        generatedFiles.push(modulePath);
     }
     const manifest = { schemaVersion: "witnora.real_path_activation_manifest.v0.1", projectId: options.projectId, moduleDigestSha256, activations };
     await mkdir(dirname(manifestPath), { recursive: true });
     await writeFile(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
-    generatedFiles.push(manifestPath);
+    if (priorSource === undefined)
+        generatedFiles.push(manifestPath);
     for (const item of scenarios) {
         const path = join(repository, ".witnora", "scenarios", `${item.plan.taskContractId}.json`);
         await mkdir(dirname(path), { recursive: true });
@@ -62,7 +64,16 @@ export async function activateRealPathIntegrations(options) {
                 throw error;
         }
     }
-    return { state: "READY_TO_START", created, modulePath: "witnora.assurance-harness.mjs", activations, generatedFiles };
+    return { state: "READY_TO_START", created, modulePath: "witnora.assurance-harness.mjs", activations, generatedFiles, ...(previousGeneratedModuleSha256 ? { previousGeneratedModuleSha256 } : {}), rollback: async () => {
+            if (current === undefined)
+                await rm(modulePath, { force: true });
+            else
+                await writeFile(modulePath, current, { encoding: "utf8", mode: 0o600 });
+            if (priorSource === undefined)
+                await rm(manifestPath, { force: true });
+            else
+                await writeFile(manifestPath, priorSource, { encoding: "utf8", mode: 0o600 });
+        } };
 }
 async function providerPreflight(request, env, plan, now, postgresClientFactory) {
     if (plan.generated.providerPackId === "STRIPE_REFUND") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "witnora",
-  "version": "0.18.5",
+  "version": "0.18.6",
   "description": "Independent assurance for covered agent action paths across models and frameworks.",
   "type": "module",
   "license": "Apache-2.0",