diff --git a/CODE_SIGNING_POLICY.md b/CODE_SIGNING_POLICY.md index 32756f0..8c224f6 100644 --- a/CODE_SIGNING_POLICY.md +++ b/CODE_SIGNING_POLICY.md @@ -4,7 +4,7 @@ Last updated: 2026-07-19 ## Current status -DS Agent `v1.1.0` is intentionally published unsigned. Both `ds-agent.exe` and +DS Agent `v1.2.0` is intentionally published unsigned. Both `ds-agent.exe` and the Windows x64 NSIS installer are expected to report Authenticode `NotSigned`. Windows may therefore display `Unknown publisher` or a Microsoft Defender SmartScreen warning. Users should download only over HTTPS from the official @@ -13,8 +13,8 @@ GitHub Release and verify the published SHA-256 before running the installer. The SignPath Foundation application is submitted and approval is pending. No DS Agent binary may be represented as SignPath-signed until the application is approved and a later-version artifact independently verifies as Authenticode -`Valid`. The project will not replace the immutable `v1.1.0` tag or asset if -signing becomes available later. +`Valid`. The project will not replace the immutable `v1.1.0` or `v1.2.0` tag, +Release, or asset if signing becomes available later. For releases accepted into that program: **Free code signing provided by [SignPath.io](https://signpath.io/), certificate by @@ -57,7 +57,7 @@ them; guessed or placeholder identifiers are forbidden. ## Release verification -For the unsigned `v1.1.0` exception, maintainers verify and disclose the actual +For the unsigned `v1.1.0` and `v1.2.0` exceptions, maintainers verify and disclose the actual `NotSigned` status of both the application executable and installer. Evidence must bind the exact source commit, file name, product version, byte size, and SHA-256. The installer downloaded back from GitHub must match the reviewed diff --git a/PRIVACY.md b/PRIVACY.md index 32a5501..58d7f35 100644 --- a/PRIVACY.md +++ b/PRIVACY.md @@ -14,7 +14,7 @@ User-selected workspaces hold approved evidence, exports, reports, work packages, screenshots, and other artifacts. This information is not silently synced to a DS Agent-operated server. -The current stable `v1.1.0` accepts one user-supplied DeepSeek API key through +The current stable `v1.2.0` accepts one user-supplied DeepSeek API key through the onboarding screen and stores it in a dedicated Windows DPAPI-protected local vault. A process-environment key remains an explicit compatibility fallback and is never silently copied into that vault. The project does not @@ -22,6 +22,12 @@ provide a shared key. The raw key exists in frontend memory only while it is being entered and submitted; it must not be retained in UI state, events, logs, exports, screenshots, work packages, or verification receipts. +Goal contracts, lifecycle events, and UI projections are bounded and designed +to exclude raw secrets, provider bodies, absolute app-data or vault paths, +local authority material, and internal claim tokens. The read-only UI receives +stable status/reason codes, bounded goal text, revision/fingerprint values, and +coverage counts; it does not receive a local completion writer. + Uninstalling the application may not delete a user-selected workspace or every application-data file. Review and remove those local locations separately when you no longer want to retain them. @@ -58,7 +64,7 @@ the user or person operating the application: The optional local desktop bridge accepts only loopback addresses and is started and controlled by the user. DS Agent does not install or supervise that service. Production Microsoft and Google account registration and live -mail/calendar writes are disabled in `v1.1.0`; offline connector contracts do +mail/calendar writes are disabled in `v1.2.0`; offline connector contracts do not authorize a production account or external write. ## What can be included in a model request diff --git a/README.md b/README.md index 0d0a0a8..830f3e4 100644 --- a/README.md +++ b/README.md @@ -11,8 +11,8 @@

- v1.1.0 stable · - Download for Windows · + v1.2.0 stable · + Download for Windows · Apache-2.0

@@ -132,6 +132,11 @@ does not claim completion from model confidence alone. Local files, browser actions, Office artifacts, and Computer Use are complete only when observable evidence satisfies the task's completion criteria. +In v1.2.0, DeepSeek may propose a bounded `GoalEnvelope`, but only the local +Kernel can validate and freeze it. The chat UI shows a read-only projection; +completion remains blocked until locally authoritative verifier evidence covers +every frozen `done_when` condition and required artifact identity. + ## DeepSeek and DS Agent boundary | Layer | Responsibility | @@ -155,7 +160,7 @@ high-risk action. See the full [model boundary](docs/AGENT_MODEL_BOUNDARY.md). reconciliation contracts validated with offline adversarial fake providers. Production Microsoft/Google account registration and live external-write -authority remain disabled in v1.1.0. The release does not sign in to real +authority remain disabled in v1.2.0. The release does not sign in to real accounts, send real email, or create, change, or cancel real calendar events. ## Why Rust @@ -168,7 +173,7 @@ remain thin; the Kernel and persistent projections own business state. ## Quick start -1. Download the [Windows x64 installer](https://github.com/Lee-take/dsagent/releases/download/v1.1.0/DS.Agent_1.1.0_x64-setup.exe). +1. Download the [Windows x64 installer](https://github.com/Lee-take/dsagent/releases/download/v1.2.0/DS.Agent_1.2.0_x64-setup.exe). 2. Enter your own valid DeepSeek API key in onboarding and run the explicit balance/model verification. The key is stored locally with Windows DPAPI. 3. Choose one local workspace and let the readiness doctor verify its managed @@ -180,7 +185,7 @@ A user-supplied DeepSeek API key is a required prerequisite. DS Agent does not bundle a shared key or bypass DeepSeek access requirements; use remains subject to DeepSeek's terms and account policies. -The v1.1.0 application executable and installer are Authenticode `NotSigned`. +The v1.2.0 application executable and installer are Authenticode `NotSigned`. Windows may display `Unknown publisher` or a Microsoft Defender SmartScreen warning. Download only over HTTPS from this repository, verify the SHA-256 in the GitHub Release, and read the [installation guide](docs/INSTALLATION.md) @@ -188,10 +193,10 @@ before running the installer. ## Code signing policy -DS Agent `v1.1.0` is intentionally unsigned. The SignPath Foundation application +DS Agent `v1.2.0` is intentionally unsigned. The SignPath Foundation application is submitted and approval is pending; no release is represented as signed. If the project is accepted, signing starts with a later new version and does not -replace this immutable tag or asset. For releases accepted into the program: +replace the immutable v1.1.0 or v1.2.0 tag or asset. For releases accepted into the program: **Free code signing provided by SignPath.io, certificate by SignPath Foundation.** See the full [code signing policy](CODE_SIGNING_POLICY.md) and [privacy policy](PRIVACY.md). @@ -209,8 +214,8 @@ example `D:\build-target\ds-agent-v1-release`. ## Stable release -- Release: [DS Agent v1.1.0](https://github.com/Lee-take/dsagent/releases/tag/v1.1.0) -- Installer: `DS.Agent_1.1.0_x64-setup.exe` +- Release: [DS Agent v1.2.0](https://github.com/Lee-take/dsagent/releases/tag/v1.2.0) +- Installer: `DS.Agent_1.2.0_x64-setup.exe` - Integrity: verify the final byte size and SHA-256 published in the GitHub Release before running the installer. - Onboarding: one user-supplied Key, Windows DPAPI storage, explicit DeepSeek @@ -218,12 +223,16 @@ example `D:\build-target\ds-agent-v1-release`. - Compatibility: existing workspace settings remain readable; environment-key operators require explicit verification; conversations and connector vaults are not rewritten. +- Goal contract: bounded model proposal, Kernel validation/freeze, read-only UI + state, and fail-closed evidence coverage for every completion condition and + required artifact. ## Documentation - [Installation](docs/INSTALLATION.md) - [DS Agent and DeepSeek boundary](docs/AGENT_MODEL_BOUNDARY.md) - [v1 architecture](docs/architecture/DS_AGENT_V1_ARCHITECTURE_PLAN.md) +- [v1.2.0 release notes](docs/RELEASE_NOTES_v1.2.0.md) - [v1.1.0 release notes](docs/RELEASE_NOTES_v1.1.0.md) - [v1 completion audit](docs/DS_AGENT_V1_COMPLETION_AUDIT.md) - [Security](SECURITY.md) · [Privacy](PRIVACY.md) · diff --git a/README.zh-CN.md b/README.zh-CN.md index 1b5fa17..ccf6ec6 100644 --- a/README.zh-CN.md +++ b/README.zh-CN.md @@ -11,8 +11,8 @@

- v1.1.0 正式稳定版 · - 下载 Windows 安装包 · + v1.2.0 正式稳定版 · + 下载 Windows 安装包 · Apache-2.0

@@ -118,6 +118,10 @@ Kernel 会持久保存任务和审核状态，只对失败步骤进行有边界 宣告完成。本地文件、浏览器操作、Office 产物和 Computer Use，只有在可观察证据满足任务 完成条件后才算真正完成。 +在 v1.2.0 中，DeepSeek 可以提出有界 `GoalEnvelope`，但只有本地 Kernel 能校验并冻结它。 +聊天界面只显示只读投影；只有本地权威 verifier 证据覆盖冻结目标的全部 `done_when` 和 +必需产物身份后，任务才可能进入完成状态。 + ## DeepSeek 与 DS Agent 的工作边界 | 层 | 负责内容 | @@ -138,7 +142,7 @@ DeepSeek 可以提出动作，DS Agent 决定动作是否安全、是否允许 - 已通过离线对抗性 fake provider 验证的 Microsoft/Google 形态邮件、日历、同步、草稿、 外部变更和对账契约。 -v1.1.0 仍未开放生产 Microsoft/Google 账号注册和真实外部写入权限。当前正式版不会登录 +v1.2.0 仍未开放生产 Microsoft/Google 账号注册和真实外部写入权限。当前正式版不会登录 真实账号、发送真实邮件，也不会创建、修改或取消真实日历事件。 ## 为什么使用 Rust @@ -149,7 +153,7 @@ command 与 React UI 保持薄层，业务状态由 Kernel 和持久投影统一 ## 快速开始 -1. 下载 [Windows x64 安装包](https://github.com/Lee-take/dsagent/releases/download/v1.1.0/DS.Agent_1.1.0_x64-setup.exe)。 +1. 下载 [Windows x64 安装包](https://github.com/Lee-take/dsagent/releases/download/v1.2.0/DS.Agent_1.2.0_x64-setup.exe)。 2. 在首次设置中输入你自己的有效 DeepSeek API Key，并显式验证余额和模型；Key 使用 Windows DPAPI 保存在本机。 3. 选择一个本地工作目录，由 readiness doctor 检查受管目录和可写状态。 @@ -159,16 +163,16 @@ command 与 React UI 保持薄层，业务状态由 Kernel 和持久投影统一 用户自行提供有效的 DeepSeek API Key 是必备前提。DS Agent 不内置共享 Key，也不会 绕过 DeepSeek 的访问条件；实际使用仍须遵守 DeepSeek 的服务条款和账号规则。 -v1.1.0 应用程序和安装包的 Authenticode 状态均为 `NotSigned`。Windows 可能显示 +v1.2.0 应用程序和安装包的 Authenticode 状态均为 `NotSigned`。Windows 可能显示 `Unknown publisher`（未知发布者）或 Microsoft Defender SmartScreen 警告。请只通过 本仓库的 HTTPS 链接下载，运行前核对 GitHub Release 中的 SHA-256，并阅读 [安装指南](docs/INSTALLATION.md)。 ## Code signing policy（代码签名政策） -DS Agent `v1.1.0` 是如实披露的未签名版本。SignPath Foundation 申请已经提交、仍在等待 +DS Agent `v1.2.0` 是如实披露的未签名版本。SignPath Foundation 申请已经提交、仍在等待 审批，本版本不会被描述为已签名。若以后获批，只从后续新版本开始签名，不替换本版本不可 -移动的 tag 或资产。获准加入该计划的 Release 将遵循：**Free code signing provided by +移动的 tag 或资产，也不改写 v1.1.0。获准加入该计划的 Release 将遵循：**Free code signing provided by SignPath.io, certificate by SignPath Foundation.** 完整说明见 [代码签名政策](CODE_SIGNING_POLICY.md)和[隐私政策](PRIVACY.md)。 @@ -185,19 +189,22 @@ npx pnpm@9.15.9 --filter @deepseek-agent-os/desktop tauri:dev ## 正式稳定版 -- Release：[DS Agent v1.1.0](https://github.com/Lee-take/dsagent/releases/tag/v1.1.0) -- 安装包：`DS.Agent_1.1.0_x64-setup.exe` +- Release：[DS Agent v1.2.0](https://github.com/Lee-take/dsagent/releases/tag/v1.2.0) +- 安装包：`DS.Agent_1.2.0_x64-setup.exe` - 完整性：运行安装包前，核对 GitHub Release 中发布的最终字节数和 SHA-256。 - 首次设置：单一用户 Key、Windows DPAPI 本机存储、显式 DeepSeek 余额/V4 模型验证、 无密 readiness 和 workspace doctor。 - 兼容性：既有 workspace 设置继续可读；环境 Key 需要显式验证；不会重写历史会话或 connector vault。 +- 目标契约：有界模型提议、Kernel 校验/冻结、只读 UI 状态，以及覆盖全部完成条件和 + 必需产物身份的 fail-closed 证据门。 ## 文档 - [安装指南](docs/INSTALLATION.md) - [DS Agent 与 DeepSeek 的工作边界](docs/AGENT_MODEL_BOUNDARY.md) - [v1 架构计划](docs/architecture/DS_AGENT_V1_ARCHITECTURE_PLAN.md) +- [v1.2.0 发布说明](docs/RELEASE_NOTES_v1.2.0.md) - [v1.1.0 发布说明](docs/RELEASE_NOTES_v1.1.0.md) - [v1 完成审计](docs/DS_AGENT_V1_COMPLETION_AUDIT.md) - [安全说明](SECURITY.md) · [隐私政策](PRIVACY.md) · diff --git a/SECURITY.md b/SECURITY.md index 4b8bf65..8ee86f2 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,6 +1,6 @@ # Security Policy -DS Agent is a local-first Windows desktop agent. DS Agent v1.1.0 is the current +DS Agent is a local-first Windows desktop agent. DS Agent v1.2.0 is the current published stable release and is not an official DeepSeek product. Security reports are welcome, especially around local credentials, permission gates, audit records, Computer Use boundaries, update integrity, code signing, and @@ -10,6 +10,7 @@ package import/export behavior. | Version | Supported | | --- | --- | +| 1.2.0 | Supported | | 1.1.0 | Supported | | 1.0.2 | Supported | @@ -30,13 +31,18 @@ Include: ## Security Boundaries -- Current stable v1.1.0 stores one user-supplied DeepSeek API key in a dedicated +- Current stable v1.2.0 stores one user-supplied DeepSeek API key in a dedicated Windows DPAPI vault. A process-environment key is an explicit compatibility fallback and is not copied into the vault. Presence alone is never treated as verified readiness; balance and required V4 model checks produce only a secret-free local receipt. Raw keys, provider bodies, account details, and absolute vault paths must not be stored in events, retained UI state, logs, screenshots, or exported work packages. +- A model-returned `GoalEnvelope` is untrusted input. The Kernel owns validation, + freeze, revision/fingerprint binding, verifier evidence, and completion. Model + text, frontend state, approval state, or artifact existence cannot directly + mark a goal complete; stale, unknown, failed, duplicate, mismatched, or + incomplete evidence fails closed. - `pnpm test:secrets` scans tracked and unignored repository files for live `sk-` style keys and non-empty `DEEPSEEK_API_KEY` assignments without printing candidate values. @@ -51,7 +57,7 @@ Include: memory. - Release identity must follow the [code signing policy](CODE_SIGNING_POLICY.md). An unsigned or invalidly signed artifact must not be represented as a signed - release. DS Agent v1.1.0 is explicitly disclosed as Authenticode `NotSigned`; + release. DS Agent v1.2.0 is explicitly disclosed as Authenticode `NotSigned`; Windows may show `Unknown publisher` or a Microsoft Defender SmartScreen warning. See also the [privacy policy](PRIVACY.md). diff --git a/apps/desktop/package.json b/apps/desktop/package.json index 1b4d45d..53451e9 100644 --- a/apps/desktop/package.json +++ b/apps/desktop/package.json @@ -1,7 +1,7 @@ { "name": "@deepseek-agent-os/desktop", "private": true, - "version": "1.1.0", + "version": "1.2.0", "author": "Lee take", "license": "Apache-2.0", "type": "module", diff --git a/apps/desktop/src-tauri/Cargo.lock b/apps/desktop/src-tauri/Cargo.lock index e1f2880..e214b63 100644 --- a/apps/desktop/src-tauri/Cargo.lock +++ b/apps/desktop/src-tauri/Cargo.lock @@ -794,7 +794,7 @@ dependencies = [ [[package]] name = "deepseek-agent-os-desktop" -version = "1.1.0" +version = "1.2.0" dependencies = [ "base64 0.22.1", "chrono", diff --git a/apps/desktop/src-tauri/Cargo.toml b/apps/desktop/src-tauri/Cargo.toml index e42a443..1462483 100644 --- a/apps/desktop/src-tauri/Cargo.toml +++ b/apps/desktop/src-tauri/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "deepseek-agent-os-desktop" -version = "1.1.0" +version = "1.2.0" description = "Local-first DeepSeek AI work platform" edition = "2021" license = "Apache-2.0" diff --git a/apps/desktop/src-tauri/src/commands.rs b/apps/desktop/src-tauri/src/commands.rs index 89e9265..00b7d28 100644 --- a/apps/desktop/src-tauri/src/commands.rs +++ b/apps/desktop/src-tauri/src/commands.rs @@ -96,12 +96,16 @@ use crate::kernel::expert_team::{ ExpertCapability, ExpertEvidenceRef, ExpertExternalEffectState, ExpertMergeReceipt, ExpertOutput, ExpertQualityGate, ExpertReviewDecision, ExpertRole, ExpertTeamPlanItem, }; +use crate::kernel::goal_envelope::GoalEnvelopeProposal; +use crate::kernel::goal_lifecycle::{ + GoalEnvelopeUiProjection, GoalLifecycleStatus, GoalTargetBindingKind, GoalValidationContext, +}; use crate::kernel::local_directory::{ load_local_directory_state, local_directory_readiness_from_state, save_local_directory_settings as persist_local_directory_settings, workspace_readiness_projection_from_setup_error, workspace_readiness_projection_from_state, LocalDirectoryReadinessStatus, LocalDirectorySettings, LocalDirectoryState, - WorkspaceReadinessProjection, LOCAL_MEMORY_DIR_NAME, + WorkspaceReadinessCode, WorkspaceReadinessProjection, LOCAL_MEMORY_DIR_NAME, }; use crate::kernel::models::FoundationState; use crate::kernel::models::TaskRecord; @@ -134,7 +138,7 @@ use crate::kernel::policy::{ builtin_capability_catalog, decide as decide_capability_policy, request_capability_access as build_capability_access_request, CapabilityAccessRecord, CapabilityDescriptor, CapabilityGrantState, CapabilityKind, PermissionAuditEntry, - PermissionResolution, PolicyDecision, + PermissionResolution, PolicyDecision, RiskLevel, }; use crate::kernel::sandbox::{ enforce_local_mutation_path, enforce_local_read_path, enforce_workspace_relative_mutation_path, @@ -157,12 +161,12 @@ use crate::kernel::soul::{ use crate::kernel::tool_runtime::{ builtin_tool_catalog, prepare_tool_execution, tool_approval_preview, tool_request_fingerprint, AgentToolExecutor, ToolEvidence, ToolExecutionOutput, ToolExecutionPlan, ToolExecutionRequest, - ToolExecutionStatus, ToolInvocationRecord, ToolResourceAccess, ToolVerificationResult, - APP_UPDATE_CHECK_TOOL_ID, APP_UPDATE_DOWNLOAD_TOOL_ID, APP_UPDATE_INSTALL_TOOL_ID, - BROWSER_BROWSE_TOOL_ID, BROWSER_OPEN_TOOL_ID, COMPUTER_CONTROL_TOOL_ID, - COMPUTER_SCREENSHOT_TOOL_ID, CONNECTOR_ATTACHMENT_DOWNLOAD_TOOL_ID, FILESYSTEM_MUTATE_TOOL_ID, - FILE_READ_TOOL_ID, FILE_WRITE_TOOL_ID, NETWORK_SEARCH_TOOL_ID, OFFICE_CREATE_TOOL_ID, - OFFICE_OPEN_TOOL_ID, OFFICE_UPDATE_TOOL_ID, OPERATIONS_BRIEFING_TOOL_ID, + ToolExecutionStatus, ToolInvocationRecord, ToolPathScope, ToolResourceAccess, + ToolVerificationResult, APP_UPDATE_CHECK_TOOL_ID, APP_UPDATE_DOWNLOAD_TOOL_ID, + APP_UPDATE_INSTALL_TOOL_ID, BROWSER_BROWSE_TOOL_ID, BROWSER_OPEN_TOOL_ID, + COMPUTER_CONTROL_TOOL_ID, COMPUTER_SCREENSHOT_TOOL_ID, CONNECTOR_ATTACHMENT_DOWNLOAD_TOOL_ID, + FILESYSTEM_MUTATE_TOOL_ID, FILE_READ_TOOL_ID, FILE_WRITE_TOOL_ID, NETWORK_SEARCH_TOOL_ID, + OFFICE_CREATE_TOOL_ID, OFFICE_OPEN_TOOL_ID, OFFICE_UPDATE_TOOL_ID, OPERATIONS_BRIEFING_TOOL_ID, SKILL_ACTIVATE_TOOL_ID, TERMINAL_READ_TOOL_ID, }; use crate::kernel::tool_strategy::{ @@ -309,7 +313,7 @@ const AGENT_TOOL_LOOP_MAX_ROUNDS: usize = 4; const AGENT_RUN_GUIDANCE_MAX_ITEMS_PER_ROUND: usize = 8; const AGENT_RUN_GUIDANCE_PROMPT_CHAR_LIMIT: usize = 12_000; const AGENT_SKILL_CATALOG_MAX_ITEMS: usize = 24; -const AGENT_CHAT_SYSTEM_PROMPT: &str = "You are the DeepSeek reasoning layer for DS Agent. DS Agent is the local execution layer. Read the full user message and return one structured agent envelope as JSON. Separate reply_to_user from agent_actions, missing_prerequisites, required_confirmations, artifact_targets, memory_candidates, soul_profile_update, subagent_plan, and expert_output. Soul is the durable cross-conversation identity and collaboration profile, not an ordinary memory candidate. Whenever the current user message explicitly defines, changes, or confirms any Soul setting, soul_profile_update must contain fields, clear_fields, current_message_evidence, and optional confirmation_context. This includes short confirmations such as yes when the immediately preceding context proposed a Soul setting. current_message_evidence must be an exact non-empty excerpt of the current user message; confirmation_context, when needed, must be an exact excerpt of the supplied conversation context. Use only the allowed Soul field names supplied by DS Agent. Keep identity roles exact: preferred_name is the user's own name, address_as is how DS Agent addresses the user, user_calls_ds_agent is the user's name for DS Agent, and ds_agent_should_refer_to_itself_as is DS Agent's self-reference. Never put DS Agent's name into preferred_name. Do not propose Soul updates for guesses, third-party statements, transient one-turn instructions, or sensitive values. Do not tell the user the setting was saved; DS Agent appends a persistence receipt only after the update is validated and written. For a complex task that materially benefits from specialists, subagent_plan may contain 2-4 unique roles chosen from research, analysis, production, review. Every item requires key, role, prompt, depends_on, capabilities, resources, budget, output_contract, and retry_policy. Use an acyclic flow: research and analysis may run in parallel when independent; production depends on relevant evidence/analysis; review depends on production. Only production may request managed_staging_write and a logical write resource. A child never writes an approved destination. Review cannot mutate staged output and must bind its decision to the exact production revision. Never create nested subagents or desktop-control subtasks. Leave subagent_plan empty for simple work. When executing an expert attempt, return expert_output with summary, evidence-linked claims, optional staged_content/staged_relative_path for production, and an exact-revision review verdict for review; never return another subagent_plan. Do not claim local tools ran; propose actions for DS Agent to validate and execute. Write reply_to_user for an ordinary user in the user's language. Lead with the useful conclusion or next step. Do not expose internal action types, tool IDs, protocol or schema names, policy enums, target=/evidence=/output= fields, raw JSON, or English verification receipts unless the user explicitly asks for technical details."; +const AGENT_CHAT_SYSTEM_PROMPT: &str = "You are the DeepSeek reasoning layer for DS Agent. DS Agent is the local execution layer. Read the full user message and return one structured agent envelope as JSON. Separate reply_to_user, goal_envelope, agent_actions, missing_prerequisites, required_confirmations, artifact_targets, memory_candidates, soul_profile_update, subagent_plan, and expert_output. When proposing a goal_envelope, use version ds-agent.goal-envelope-proposal/v1 and include user_goal, assumptions, constraints, done_when, required_artifacts, verifiers, proposed_capabilities, external_targets, and stop_conditions. assumptions, constraints, proposed_capabilities, and stop_conditions are string arrays. Each done_when item has done_when_id and description; each required_artifact has artifact_id and description; each verifier has verifier_id, done_when_id, description, and evidence_kind; each external_target has target_id and description. The goal_envelope is only a proposal: it cannot approve execution, trust a path or external target, handle a secret, or declare completion. Soul is the durable cross-conversation identity and collaboration profile, not an ordinary memory candidate. Whenever the current user message explicitly defines, changes, or confirms any Soul setting, soul_profile_update must contain fields, clear_fields, current_message_evidence, and optional confirmation_context. This includes short confirmations such as yes when the immediately preceding context proposed a Soul setting. current_message_evidence must be an exact non-empty excerpt of the current user message; confirmation_context, when needed, must be an exact excerpt of the supplied conversation context. Use only the allowed Soul field names supplied by DS Agent. Keep identity roles exact: preferred_name is the user's own name, address_as is how DS Agent addresses the user, user_calls_ds_agent is the user's name for DS Agent, and ds_agent_should_refer_to_itself_as is DS Agent's self-reference. Never put DS Agent's name into preferred_name. Do not propose Soul updates for guesses, third-party statements, transient one-turn instructions, or sensitive values. Do not tell the user the setting was saved; DS Agent appends a persistence receipt only after the update is validated and written. For a complex task that materially benefits from specialists, subagent_plan may contain 2-4 unique roles chosen from research, analysis, production, review. Every item requires key, role, prompt, depends_on, capabilities, resources, budget, output_contract, and retry_policy. Use an acyclic flow: research and analysis may run in parallel when independent; production depends on relevant evidence/analysis; review depends on production. Only production may request managed_staging_write and a logical write resource. A child never writes an approved destination. Review cannot mutate staged output and must bind its decision to the exact production revision. Never create nested subagents or desktop-control subtasks. Leave subagent_plan empty for simple work. When executing an expert attempt, return expert_output with summary, evidence-linked claims, optional staged_content/staged_relative_path for production, and an exact-revision review verdict for review; never return another subagent_plan. Do not claim local tools ran; propose actions for DS Agent to validate and execute. Write reply_to_user for an ordinary user in the user's language. Lead with the useful conclusion or next step. Do not expose internal action types, tool IDs, protocol or schema names, policy enums, target=/evidence=/output= fields, raw JSON, or English verification receipts unless the user explicitly asks for technical details."; const AGENT_OFFICE_CREATE_EVIDENCE_TEXT_LIMIT: usize = 1200; const AGENT_SOUL_PROFILE_FILE_NAME: &str = "soul.md"; const AGENT_SOUL_PROFILE_CONTEXT_MAX_BYTES: usize = 800; @@ -342,7 +346,9 @@ struct AgentChatRuntimeContext { active_run_id: Option, subagent_read_only: bool, workspace_ready: AgentChatReadiness, + workspace_readiness_code: WorkspaceReadinessCode, workspace_note: String, + workspace_authority_material: Option>, network_search_ready: AgentChatReadiness, network_search_note: String, network_search_source_model: Option, @@ -361,7 +367,9 @@ impl Default for AgentChatRuntimeContext { active_run_id: None, subagent_read_only: false, workspace_ready: AgentChatReadiness::Unknown, + workspace_readiness_code: WorkspaceReadinessCode::WorkspaceSettingsInvalid, workspace_note: "workspace readiness unavailable in this test context".to_string(), + workspace_authority_material: None, network_search_ready: AgentChatReadiness::Unknown, network_search_note: "network search readiness unavailable in this test context" .to_string(), @@ -498,6 +506,10 @@ pub struct AgentChatResponse { pub role: String, pub content: String, pub protocol_version: String, + #[serde(default)] + pub goal_envelope: Option, + #[serde(default, skip_deserializing)] + pub goal_projection: Option, pub proposed_actions: Vec, pub missing_prerequisites: Vec, pub memory_candidates: Vec, @@ -709,6 +721,8 @@ struct AgentModelEnvelope { deserialize_with = "deserialize_agent_reply_to_user" )] reply_to_user: String, + #[serde(default, deserialize_with = "deserialize_agent_goal_envelope")] + goal_envelope: Option, #[serde(default, alias = "proposed_actions")] agent_actions: Vec, #[serde(default)] @@ -735,6 +749,18 @@ where Ok(agent_reply_text_from_value(&value)) } +fn deserialize_agent_goal_envelope<'de, D>( + deserializer: D, +) -> Result, D::Error> +where + D: serde::Deserializer<'de>, +{ + Option::::deserialize(deserializer)? + .map(GoalEnvelopeProposal::parse_value) + .transpose() + .map_err(serde::de::Error::custom) +} + fn deserialize_agent_protocol_version<'de, D>(deserializer: D) -> Result, D::Error> where D: serde::Deserializer<'de>, @@ -2635,6 +2661,9 @@ fn record_completed_agent_tool_execution( invocation: &ToolInvocationRecord, ) -> Result<(), String> { append_agent_tool_invocation_audit(store, invocation)?; + store + .record_goal_completion_for_tool_invocation(invocation) + .map_err(event_store_error)?; store .release_agent_run_resources_for_invocation( invocation.id, @@ -4699,6 +4728,9 @@ fn agent_chat_response_from_telemetry( .filter(|value| !value.is_empty()) .unwrap_or("plain-text") .to_string(); + let goal_envelope = parsed_envelope + .as_ref() + .and_then(|envelope| envelope.goal_envelope.clone()); let mut memory_candidate_proposals = parsed_envelope .as_ref() .map(|envelope| envelope.memory_candidates.clone()) @@ -4745,6 +4777,8 @@ fn agent_chat_response_from_telemetry( role: "assistant".to_string(), content: display_content, protocol_version, + goal_envelope, + goal_projection: None, proposed_actions, missing_prerequisites, memory_candidates, @@ -8588,6 +8622,77 @@ fn agent_chat_with_transport_and_runtime_context_with_api_key_fallback( .unwrap_or_else(|| "key_missing".to_string())) } +fn goal_validation_context_for_agent_chat( + runtime_context: &AgentChatRuntimeContext, + access_mode: AccessMode, +) -> GoalValidationContext { + let mut context = + GoalValidationContext::new(access_mode, runtime_context.workspace_readiness_code) + .with_max_risk(RiskLevel::Critical) + .allowing_local_effects(); + for contract in builtin_tool_catalog() + .into_iter() + .filter(|contract| contract.id != CONNECTOR_ATTACHMENT_DOWNLOAD_TOOL_ID) + { + let workspace_ready = contract.constraints.path_scope != ToolPathScope::Workspace + || runtime_context.workspace_readiness_code == WorkspaceReadinessCode::Ready; + let route_ready = match contract.capability { + CapabilityKind::NetworkSearch => { + runtime_context.network_search_ready == AgentChatReadiness::Ready + } + _ => true, + }; + context = context + .with_enabled_tool(contract.id.clone(), workspace_ready && route_ready) + .with_approval_route(contract.id); + for evidence_kind in contract.verification.required_evidence_kinds { + context = context.with_verifier_kind(evidence_kind); + } + } + if let Some(authority_material) = runtime_context.workspace_authority_material.as_ref() { + context = context + .with_target_binding( + "workspace", + GoalTargetBindingKind::Workspace, + authority_material, + ) + .with_target_binding( + "selected-workspace", + GoalTargetBindingKind::Workspace, + authority_material, + ); + } + context +} + +fn reconcile_agent_goal_projection( + store: &Mutex, + response: &mut AgentChatResponse, + runtime_context: &AgentChatRuntimeContext, + access_mode: AccessMode, +) -> Result<(), String> { + let goal_id = runtime_context.active_run_id.unwrap_or(response.id); + let store = store.lock().map_err(|_| lock_error())?; + if let Some(proposal) = response.goal_envelope.as_ref() { + let context = goal_validation_context_for_agent_chat(runtime_context, access_mode); + let projection = store + .submit_goal_proposal(goal_id, proposal, &context) + .map_err(event_store_error)?; + if projection.status() == GoalLifecycleStatus::Validated { + let revision = projection + .revision() + .ok_or_else(|| "goal_validated_revision_missing".to_string())?; + store + .freeze_goal_envelope(goal_id, revision) + .map_err(event_store_error)?; + } + } + response.goal_projection = store + .goal_envelope_ui_projection(goal_id) + .map_err(event_store_error)?; + Ok(()) +} + fn run_agent_chat_with_clients( store: &Mutex, transport: &impl DeepSeekChatCompletionTransport, @@ -8697,6 +8802,12 @@ fn run_agent_chat_with_clients_and_api_keys_and_computer_use( first_telemetry, &original_user_prompt, |response| { + reconcile_agent_goal_projection( + store, + response, + &runtime_context, + request.access_mode, + )?; mark_agent_workspace_actions_waiting_if_needed(&runtime_context, response); if runtime_context.subagent_read_only { block_subagent_mutating_actions( @@ -8721,7 +8832,8 @@ fn run_agent_chat_with_clients_and_api_keys_and_computer_use( computer_use_client, runtime_context.desktop_dir.as_deref(), runtime_context.active_run_id, - ) + )?; + reconcile_agent_goal_projection(store, response, &runtime_context, request.access_mode) }, |followup_prompt| { let guidance = { @@ -8752,6 +8864,7 @@ fn run_agent_chat_with_clients_and_api_keys_and_computer_use( )?; let mut response = loop_outcome.response; let telemetry = loop_outcome.telemetry; + reconcile_agent_goal_projection(store, &mut response, &runtime_context, request.access_mode)?; if loop_outcome.limit_reached { if let Some(run_id) = runtime_context.active_run_id { @@ -10332,6 +10445,12 @@ fn merge_agent_chat_followup_response( mut initial_response: AgentChatResponse, mut followup_response: AgentChatResponse, ) -> AgentChatResponse { + if followup_response.goal_envelope.is_none() { + followup_response.goal_envelope = initial_response.goal_envelope.take(); + } + if followup_response.goal_projection.is_none() { + followup_response.goal_projection = initial_response.goal_projection.take(); + } initial_response .proposed_actions .append(&mut followup_response.proposed_actions); @@ -12050,6 +12169,8 @@ fn dispatch_agent_action_proposals_with_store_mutex( role: response.role.clone(), content: response.content.clone(), protocol_version: response.protocol_version.clone(), + goal_envelope: None, + goal_projection: None, proposed_actions: vec![action.clone()], missing_prerequisites: Vec::new(), memory_candidates: Vec::new(), @@ -12128,6 +12249,8 @@ fn resume_agent_chat_action_with_clients_and_computer_use( role: "assistant".to_string(), content: String::new(), protocol_version: "ds-agent-action-resume-v1".to_string(), + goal_envelope: None, + goal_projection: None, proposed_actions: vec![action], missing_prerequisites: Vec::new(), memory_candidates: Vec::new(), @@ -13590,26 +13713,39 @@ fn agent_chat_runtime_context( .as_deref() .and_then(|app_data_dir| load_agent_soul_profile_context(app_data_dir).ok()) .flatten(); - let (workspace_ready, workspace_note) = app_data_dir - .as_deref() - .and_then(|app_data_dir| load_local_directory_state(app_data_dir).ok()) - .map(|state| local_directory_readiness_from_state(&state)) - .map(|readiness| { - ( - if readiness.needs_setup { - AgentChatReadiness::Missing - } else { - AgentChatReadiness::Ready - }, - readiness.note, - ) - }) - .unwrap_or_else(|| { - ( - AgentChatReadiness::Unknown, - "workspace readiness unavailable".to_string(), - ) - }); + let (workspace_ready, workspace_readiness_code, workspace_note, workspace_authority_material) = + app_data_dir + .as_deref() + .and_then(|app_data_dir| load_local_directory_state(app_data_dir).ok()) + .map(|state| { + let readiness = local_directory_readiness_from_state(&state); + let projection = workspace_readiness_projection_from_state(&state); + let authority_material = (projection.code == WorkspaceReadinessCode::Ready) + .then(|| state.settings.as_ref()) + .flatten() + .map(|settings| { + format!("{}\0{}", settings.workspace_dir, settings.workspace_name) + .into_bytes() + }); + ( + if readiness.needs_setup { + AgentChatReadiness::Missing + } else { + AgentChatReadiness::Ready + }, + projection.code, + readiness.note, + authority_material, + ) + }) + .unwrap_or_else(|| { + ( + AgentChatReadiness::Unknown, + WorkspaceReadinessCode::WorkspaceSettingsInvalid, + "workspace readiness unavailable".to_string(), + None, + ) + }); let tool_strategy = model_driven_tool_strategy_for_current_platform( large_model_provider, @@ -13627,7 +13763,9 @@ fn agent_chat_runtime_context( active_run_id: None, subagent_read_only: false, workspace_ready, + workspace_readiness_code, workspace_note, + workspace_authority_material, network_search_ready, network_search_note: network_status.note, network_search_source_model: tool_strategy.network_search_source_model, @@ -17614,8 +17752,8 @@ mod tests { SkillManifest, SkillPackageKind, }; use crate::kernel::tool_runtime::{ - AgentToolExecutor, ToolEvidence, ToolExecutionOutput, ToolExecutionPlan, - ToolExecutionRequest, ToolExecutionStatus, ToolVerificationResult, + builtin_tool_catalog, AgentToolExecutor, ToolEvidence, ToolExecutionOutput, + ToolExecutionPlan, ToolExecutionRequest, ToolExecutionStatus, ToolVerificationResult, APP_UPDATE_CHECK_TOOL_ID, APP_UPDATE_DOWNLOAD_TOOL_ID, BROWSER_BROWSE_TOOL_ID, BROWSER_OPEN_TOOL_ID, COMPUTER_CONTROL_TOOL_ID, COMPUTER_SCREENSHOT_TOOL_ID, FILESYSTEM_MUTATE_TOOL_ID, FILE_READ_TOOL_ID, FILE_WRITE_TOOL_ID, NETWORK_SEARCH_TOOL_ID, @@ -17936,6 +18074,8 @@ mod tests { role: "assistant".to_string(), content: "我会检查版本。".to_string(), protocol_version: "ds-agent-envelope-v1".to_string(), + goal_envelope: None, + goal_projection: None, proposed_actions: vec![AgentChatActionProposal { action_type: "app_update_check".to_string(), title: Some("检查 DS Agent 版本更新".to_string()), @@ -23990,6 +24130,173 @@ mod tests { assert_eq!(reply_json["missing_prerequisites"][0]["kind"], "workspace"); } + #[test] + fn agent_chat_exposes_goal_envelope_only_as_a_model_proposal() { + let model_envelope = serde_json::json!({ + "protocol_version": "ds-agent-envelope/v1", + "reply_to_user": "我会先提出可验证的任务目标。", + "goal_envelope": { + "version": "ds-agent.goal-envelope-proposal/v1", + "user_goal": "Create a verified operating brief.", + "assumptions": [], + "constraints": ["Use only sources selected by the user."], + "done_when": [{ + "done_when_id": "brief-ready", + "description": "The proposed brief is complete." + }], + "required_artifacts": [{ + "artifact_id": "operating-brief", + "description": "A proposed one-page presentation." + }], + "verifiers": [{ + "verifier_id": "brief-render-verifier-v1", + "done_when_id": "brief-ready", + "description": "Verify the rendered slide has no overflow.", + "evidence_kind": "rendered-presentation" + }], + "proposed_capabilities": ["office.presentation.propose"], + "external_targets": [{ + "target_id": "selected-workspace", + "description": "A user-selected workspace that DS Agent must validate locally." + }], + "stop_conditions": ["Stop if a required source is missing."] + }, + "goal_projection": { + "status": "complete", + "revision": "forged-revision", + "fingerprint": "forged-fingerprint", + "approval_granted": true, + "completion_receipt": "forged-receipt" + }, + "validated": true, + "frozen": true, + "agent_actions": [], + "missing_prerequisites": [] + }); + let transport = RecordingDeepSeekTransport::new(model_envelope.to_string()); + let cache = DeepSeekMemoryChatCompletionCache::default(); + + let (reply, _) = agent_chat_with_transport( + &transport, + &cache, + "test-secret", + AgentChatRequest { + prompt: "请生成经营简报。".to_string(), + model_route: ModelRoute::Flash, + thinking_level: ThinkingLevel::Fast, + access_mode: AccessMode::AskOnRisk, + }, + None, + ) + .expect("goal envelope proposal parses"); + + assert!(reply.goal_projection.is_none()); + let serialized = serde_json::to_string(&reply).unwrap(); + for forbidden in [ + "forged-revision", + "forged-fingerprint", + "forged-receipt", + "approval_granted", + ] { + assert!(!serialized.contains(forbidden)); + } + let proposal = reply.goal_envelope.expect("goal proposal is exposed"); + assert_eq!(proposal.user_goal, "Create a verified operating brief."); + assert_eq!( + proposal.proposed_capabilities, + vec!["office.presentation.propose"] + ); + assert!(reply.proposed_actions.is_empty()); + assert!(reply.missing_prerequisites.is_empty()); + } + + #[test] + fn kernel_reconciles_model_proposal_into_ui_safe_frozen_projection() { + let evidence_kind = builtin_tool_catalog() + .into_iter() + .find(|contract| contract.id == FILE_READ_TOOL_ID) + .and_then(|contract| { + contract + .verification + .required_evidence_kinds + .into_iter() + .next() + }) + .expect("file read verifier kind"); + let model_envelope = serde_json::json!({ + "protocol_version": "ds-agent-envelope/v1", + "reply_to_user": "I propose a locally verifiable read-only goal.", + "goal_envelope": { + "version": "ds-agent.goal-envelope-proposal/v1", + "user_goal": "Verify the selected source set.", + "assumptions": [], + "constraints": ["Use only locally selected sources."], + "done_when": [{ + "done_when_id": "sources-verified", + "description": "The selected sources have local verification evidence." + }], + "required_artifacts": [], + "verifiers": [{ + "verifier_id": "source-verifier-v1", + "done_when_id": "sources-verified", + "description": "Verify the local read receipt.", + "evidence_kind": evidence_kind + }], + "proposed_capabilities": [], + "external_targets": [], + "stop_conditions": ["Stop when local verification is unavailable."] + }, + "agent_actions": [], + "missing_prerequisites": [] + }); + let transport = RecordingDeepSeekTransport::new(model_envelope.to_string()); + let cache = DeepSeekMemoryChatCompletionCache::default(); + let (mut reply, _) = agent_chat_with_transport( + &transport, + &cache, + "test-secret", + AgentChatRequest { + prompt: "Verify sources.".to_string(), + model_route: ModelRoute::Flash, + thinking_level: ThinkingLevel::Fast, + access_mode: AccessMode::AskEveryStep, + }, + None, + ) + .expect("proposal parses"); + let store = Mutex::new(EventStore::open_memory().unwrap()); + let runtime_context = AgentChatRuntimeContext { + workspace_ready: AgentChatReadiness::Ready, + workspace_readiness_code: crate::kernel::local_directory::WorkspaceReadinessCode::Ready, + workspace_authority_material: Some(b"local-workspace-authority".to_vec()), + ..AgentChatRuntimeContext::default() + }; + + super::reconcile_agent_goal_projection( + &store, + &mut reply, + &runtime_context, + AccessMode::AskEveryStep, + ) + .expect("Kernel reconciles proposal"); + + let projection = reply.goal_projection.expect("UI-safe projection"); + assert_eq!( + serde_json::to_value(&projection).unwrap()["status"], + "frozen" + ); + let serialized = serde_json::to_string(&projection).unwrap(); + for forbidden in [ + "authority_fingerprint", + "context_fingerprint", + "approval_granted", + "execution_authority", + "claim_token", + ] { + assert!(!serialized.contains(forbidden)); + } + } + #[test] fn agent_chat_parses_object_reply_and_descriptive_prerequisite_fields() { let model_envelope = serde_json::json!({ @@ -29270,7 +29577,10 @@ schema_version: 1 active_run_id: None, subagent_read_only: false, workspace_ready: AgentChatReadiness::Missing, + workspace_readiness_code: + crate::kernel::local_directory::WorkspaceReadinessCode::WorkspaceMissing, workspace_note: "local workspace needs setup".to_string(), + workspace_authority_material: None, network_search_ready: AgentChatReadiness::Ready, network_search_note: "network search ready".to_string(), network_search_source_model: None, diff --git a/apps/desktop/src-tauri/src/kernel/app_update.rs b/apps/desktop/src-tauri/src/kernel/app_update.rs index 6999b50..108e975 100644 --- a/apps/desktop/src-tauri/src/kernel/app_update.rs +++ b/apps/desktop/src-tauri/src/kernel/app_update.rs @@ -17,8 +17,8 @@ pub(crate) const APP_UPDATE_RELEASES_API_URL: &str = const APP_UPDATE_RELEASE_DOWNLOAD_PATH_PREFIX: &str = "/Lee-take/dsagent/releases/download/"; const APP_UPDATE_LEGACY_RELEASE_DOWNLOAD_PATH_PREFIX: &str = "/Lee-take/deepseek-agent-os/releases/download/"; -const APP_UPDATE_USER_AGENT: &str = "DS-Agent-Updater/1.1.0"; -const APP_UPDATE_CURRENT_RELEASE_TAG: &str = "v1.1.0"; +const APP_UPDATE_USER_AGENT: &str = "DS-Agent-Updater/1.2.0"; +const APP_UPDATE_CURRENT_RELEASE_TAG: &str = "v1.2.0"; #[cfg(windows)] const WINDOWS_CREATE_NO_WINDOW: u32 = 0x08000000; @@ -653,7 +653,7 @@ mod tests { let status = update_status_from_releases(releases, app_update_current_version()); assert!(!status.update_available); - assert_eq!(status.current_version, "v1.1.0"); + assert_eq!(status.current_version, "v1.2.0"); assert_eq!(status.latest_version.as_deref(), Some("0.3.0")); assert!(status.asset_name.is_none()); } diff --git a/apps/desktop/src-tauri/src/kernel/deepseek.rs b/apps/desktop/src-tauri/src/kernel/deepseek.rs index be409e6..f4cd857 100644 --- a/apps/desktop/src-tauri/src/kernel/deepseek.rs +++ b/apps/desktop/src-tauri/src/kernel/deepseek.rs @@ -265,7 +265,7 @@ impl Drop for DeepSeekOperationsBriefingSynt impl HttpDeepSeekChatCompletionTransport { pub fn new() -> Result { let client = reqwest::blocking::Client::builder() - .user_agent("DS-Agent/1.1.0 deepseek-v4") + .user_agent("DS-Agent/1.2.0 deepseek-v4") .timeout(std::time::Duration::from_secs( DEEPSEEK_CHAT_HTTP_TIMEOUT_SECS, )) @@ -982,7 +982,7 @@ mod tests { assert_eq!(response.first_text(), Some("ok")); assert!(recorded.raw.starts_with("POST / HTTP/1.1")); - assert!(normalized_headers.contains("user-agent: ds-agent/1.1.0 deepseek-v4")); + assert!(normalized_headers.contains("user-agent: ds-agent/1.2.0 deepseek-v4")); } #[test] diff --git a/apps/desktop/src-tauri/src/kernel/event_store.rs b/apps/desktop/src-tauri/src/kernel/event_store.rs index 755cfcd..76481e5 100644 --- a/apps/desktop/src-tauri/src/kernel/event_store.rs +++ b/apps/desktop/src-tauri/src/kernel/event_store.rs @@ -75,6 +75,14 @@ use crate::kernel::expert_team::{ parent_input_revision, resources_conflict, validate_team_plan, ExpertAttemptResult, ExpertMergeReceipt, ExpertTeamPlanItem, EXPERT_TEAM_MAX_TOTAL_ATTEMPTS, }; +use crate::kernel::goal_envelope::GoalEnvelopeProposal; +use crate::kernel::goal_lifecycle::{ + completion_event, completion_evidence_from_tool_invocation, completion_projection, + frozen_projection, goal_ui_projection as build_goal_ui_projection, projection_event, + proposal_received_projection, validated_projection, GoalCompletionProjection, + GoalEnvelopeUiProjection, GoalLifecycleProjection, GoalLifecycleState, GoalLifecycleStatus, + GoalValidationContext, GOAL_COMPLETION_SCHEMA_VERSION, GOAL_LIFECYCLE_SCHEMA_VERSION, +}; use crate::kernel::models::{ AccessMode, KernelEvent, MemoryCandidate, MemoryCandidateMergePreview, MemoryCandidateRecord, MemoryCandidateReplacePreview, MemoryCandidateResolution, MemoryCandidateSource, @@ -1295,6 +1303,34 @@ impl EventStore { CREATE INDEX IF NOT EXISTS idx_kernel_events_created_at ON kernel_events (created_at); + CREATE TABLE IF NOT EXISTS goal_envelope_projection ( + goal_id TEXT PRIMARY KEY NOT NULL, + schema_version TEXT NOT NULL, + status TEXT NOT NULL, + proposal_fingerprint TEXT NOT NULL, + revision TEXT, + projection_json TEXT NOT NULL, + row_revision INTEGER NOT NULL DEFAULT 0, + updated_at TEXT NOT NULL + ); + + CREATE INDEX IF NOT EXISTS idx_goal_envelope_projection_status + ON goal_envelope_projection (status, updated_at); + + CREATE TABLE IF NOT EXISTS goal_completion_projection ( + goal_id TEXT PRIMARY KEY NOT NULL, + schema_version TEXT NOT NULL, + revision TEXT NOT NULL, + frozen_fingerprint TEXT NOT NULL, + status TEXT NOT NULL, + projection_json TEXT NOT NULL, + row_revision INTEGER NOT NULL DEFAULT 0, + updated_at TEXT NOT NULL + ); + + CREATE INDEX IF NOT EXISTS idx_goal_completion_projection_status + ON goal_completion_projection (status, updated_at); + CREATE TABLE IF NOT EXISTS capability_access_state ( request_id TEXT PRIMARY KEY NOT NULL, request_json TEXT NOT NULL, @@ -10300,6 +10336,378 @@ impl EventStore { Ok(()) } + pub fn submit_goal_proposal( + &self, + goal_id: Uuid, + proposal: &GoalEnvelopeProposal, + context: &GoalValidationContext, + ) -> EventStoreResult { + let received = proposal_received_projection(goal_id, proposal) + .map_err(|_| EventStoreError::InvalidState("goal_proposal_invalid".to_string()))?; + self.persist_goal_projection(&received)?; + let validated = validated_projection(goal_id, proposal, context) + .map_err(|_| EventStoreError::InvalidState("goal_proposal_invalid".to_string()))?; + self.persist_goal_projection(&validated) + } + + pub fn freeze_goal_envelope( + &self, + goal_id: Uuid, + expected_revision: &str, + ) -> EventStoreResult { + let current = self + .goal_envelope_projection(goal_id)? + .ok_or_else(|| EventStoreError::InvalidState("goal_not_found".to_string()))?; + let frozen = frozen_projection(¤t, expected_revision) + .map_err(|code| EventStoreError::InvalidState(code.to_string()))?; + self.persist_goal_projection(&frozen) + } + + pub fn goal_envelope_projection( + &self, + goal_id: Uuid, + ) -> EventStoreResult> { + let row = self + .conn + .query_row( + r#"SELECT schema_version, status, proposal_fingerprint, revision, projection_json + FROM goal_envelope_projection WHERE goal_id = ?1"#, + params![goal_id.to_string()], + |row| { + Ok(( + row.get::<_, String>(0)?, + row.get::<_, String>(1)?, + row.get::<_, String>(2)?, + row.get::<_, Option>(3)?, + row.get::<_, String>(4)?, + )) + }, + ) + .optional()?; + row.map(|row| Self::decode_goal_projection(goal_id, row)) + .transpose() + } + + fn persist_goal_projection( + &self, + next: &GoalLifecycleProjection, + ) -> EventStoreResult { + next.validate_persisted() + .map_err(|code| EventStoreError::InvalidState(code.to_string()))?; + let transaction = self.conn.unchecked_transaction()?; + let current_row = transaction + .query_row( + r#"SELECT schema_version, status, proposal_fingerprint, revision, projection_json + FROM goal_envelope_projection WHERE goal_id = ?1"#, + params![next.goal_id.to_string()], + |row| { + Ok(( + row.get::<_, String>(0)?, + row.get::<_, String>(1)?, + row.get::<_, String>(2)?, + row.get::<_, Option>(3)?, + row.get::<_, String>(4)?, + )) + }, + ) + .optional()?; + let current = current_row + .map(|row| Self::decode_goal_projection(next.goal_id, row)) + .transpose()?; + let event = projection_event(next)?; + + if let Some(current) = current.as_ref() { + if current == next + || (next.status() == GoalLifecycleStatus::ProposalReceived + && current.proposal_fingerprint() == next.proposal_fingerprint()) + || (current.status() == GoalLifecycleStatus::Frozen + && next.status() == GoalLifecycleStatus::Validated + && current.proposal_fingerprint() == next.proposal_fingerprint() + && current.revision() == next.revision()) + { + Self::insert_goal_kernel_event(&transaction, &event)?; + transaction.commit()?; + return Ok(current.clone()); + } + if !Self::goal_transition_allowed(current, next) { + return Err(EventStoreError::InvalidState( + "goal_transition_not_allowed".to_string(), + )); + } + } else if next.status() != GoalLifecycleStatus::ProposalReceived { + return Err(EventStoreError::InvalidState( + "goal_transition_not_allowed".to_string(), + )); + } + + let projection_json = serde_json::to_string(next)?; + transaction.execute( + r#"INSERT INTO goal_envelope_projection + (goal_id, schema_version, status, proposal_fingerprint, revision, + projection_json, row_revision, updated_at) + VALUES (?1, ?2, ?3, ?4, ?5, ?6, 0, ?7) + ON CONFLICT(goal_id) DO UPDATE SET + schema_version = excluded.schema_version, + status = excluded.status, + proposal_fingerprint = excluded.proposal_fingerprint, + revision = excluded.revision, + projection_json = excluded.projection_json, + row_revision = goal_envelope_projection.row_revision + 1, + updated_at = excluded.updated_at"#, + params![ + next.goal_id.to_string(), + GOAL_LIFECYCLE_SCHEMA_VERSION, + next.status().as_str(), + next.proposal_fingerprint(), + next.revision(), + projection_json, + event.created_at.to_rfc3339_opts(SecondsFormat::Nanos, true), + ], + )?; + Self::insert_goal_kernel_event(&transaction, &event)?; + transaction.commit()?; + Ok(next.clone()) + } + + fn insert_goal_kernel_event( + transaction: &Transaction<'_>, + event: &KernelEvent, + ) -> EventStoreResult<()> { + transaction.execute( + r#"INSERT OR IGNORE INTO kernel_events (id, event_type, payload_json, created_at) + VALUES (?1, ?2, ?3, ?4)"#, + params![ + event.id.to_string(), + event.event_type, + event.payload_json, + event.created_at.to_rfc3339_opts(SecondsFormat::Nanos, true), + ], + )?; + Ok(()) + } + + fn goal_transition_allowed( + current: &GoalLifecycleProjection, + next: &GoalLifecycleProjection, + ) -> bool { + if current.goal_id != next.goal_id { + return false; + } + if next.status() == GoalLifecycleStatus::ProposalReceived { + return current.proposal_fingerprint() != next.proposal_fingerprint(); + } + if current.proposal_fingerprint() != next.proposal_fingerprint() { + return false; + } + matches!( + (¤t.state, &next.state), + ( + GoalLifecycleState::ProposalReceived { .. }, + GoalLifecycleState::ValidationBlocked { .. } | GoalLifecycleState::Validated { .. } + ) | ( + GoalLifecycleState::ValidationBlocked { .. }, + GoalLifecycleState::ValidationBlocked { .. } | GoalLifecycleState::Validated { .. } + ) | ( + GoalLifecycleState::Validated { .. }, + GoalLifecycleState::ValidationBlocked { .. } + | GoalLifecycleState::Validated { .. } + | GoalLifecycleState::Frozen { .. } + ) | ( + GoalLifecycleState::Frozen { .. }, + GoalLifecycleState::ValidationBlocked { .. } | GoalLifecycleState::Validated { .. } + ) + ) + } + + fn decode_goal_projection( + goal_id: Uuid, + row: (String, String, String, Option, String), + ) -> EventStoreResult { + let (schema_version, status, proposal_fingerprint, revision, projection_json) = row; + let projection: GoalLifecycleProjection = serde_json::from_str(&projection_json)?; + projection + .validate_persisted() + .map_err(|code| EventStoreError::InvalidState(code.to_string()))?; + if projection.goal_id != goal_id + || projection.schema_version != schema_version + || projection.status().as_str() != status + || projection.proposal_fingerprint() != proposal_fingerprint + || projection.revision().map(str::to_string) != revision + { + return Err(EventStoreError::InvalidState( + "goal_projection_invalid".to_string(), + )); + } + Ok(projection) + } + + pub fn record_goal_completion_for_tool_invocation( + &self, + invocation: &ToolInvocationRecord, + ) -> EventStoreResult> { + let Some(goal_id) = invocation.run_id else { + return Ok(None); + }; + let Some(lifecycle) = self.goal_envelope_projection(goal_id)? else { + return Ok(None); + }; + if lifecycle.frozen().is_none() { + return Ok(None); + } + let receipts = completion_evidence_from_tool_invocation(&lifecycle, invocation) + .map_err(|code| EventStoreError::InvalidState(code.to_string()))?; + let mut evidence = self + .goal_completion_projection(goal_id)? + .map(|projection| projection.evidence) + .unwrap_or_default(); + for receipt in receipts { + if let Some(existing) = evidence + .iter() + .find(|existing| existing.evidence_id == receipt.evidence_id) + { + if existing != &receipt { + return Err(EventStoreError::InvalidState( + "goal_completion_evidence_conflict".to_string(), + )); + } + continue; + } + evidence.push(receipt); + } + let projection = completion_projection(&lifecycle, &evidence) + .map_err(|code| EventStoreError::InvalidState(code.to_string()))?; + self.persist_goal_completion_projection(&lifecycle, &projection) + .map(Some) + } + + pub fn goal_completion_projection( + &self, + goal_id: Uuid, + ) -> EventStoreResult> { + let row = self + .conn + .query_row( + r#"SELECT schema_version, revision, frozen_fingerprint, status, projection_json + FROM goal_completion_projection WHERE goal_id = ?1"#, + params![goal_id.to_string()], + |row| { + Ok(( + row.get::<_, String>(0)?, + row.get::<_, String>(1)?, + row.get::<_, String>(2)?, + row.get::<_, String>(3)?, + row.get::<_, String>(4)?, + )) + }, + ) + .optional()?; + let Some(row) = row else { + return Ok(None); + }; + let projection = Self::decode_goal_completion_projection(goal_id, row)?; + let Some(lifecycle) = self.goal_envelope_projection(goal_id)? else { + return Ok(None); + }; + let Some(frozen) = lifecycle.frozen() else { + return Ok(None); + }; + if projection.revision != frozen.revision + || projection.frozen_fingerprint != frozen.fingerprint + { + return Ok(None); + } + projection + .validate_against(&lifecycle) + .map_err(|code| EventStoreError::InvalidState(code.to_string()))?; + Ok(Some(projection)) + } + + pub fn goal_envelope_ui_projection( + &self, + goal_id: Uuid, + ) -> EventStoreResult> { + let Some(lifecycle) = self.goal_envelope_projection(goal_id)? else { + return Ok(None); + }; + let completion = self.goal_completion_projection(goal_id)?; + build_goal_ui_projection(&lifecycle, completion.as_ref()) + .map(Some) + .map_err(|code| EventStoreError::InvalidState(code.to_string())) + } + + fn persist_goal_completion_projection( + &self, + lifecycle: &GoalLifecycleProjection, + next: &GoalCompletionProjection, + ) -> EventStoreResult { + next.validate_against(lifecycle) + .map_err(|code| EventStoreError::InvalidState(code.to_string()))?; + let event = completion_event(next)?; + let transaction = self.conn.unchecked_transaction()?; + let current_json = transaction + .query_row( + "SELECT projection_json FROM goal_completion_projection WHERE goal_id = ?1", + params![next.goal_id.to_string()], + |row| row.get::<_, String>(0), + ) + .optional()?; + if let Some(current_json) = current_json { + let current: GoalCompletionProjection = serde_json::from_str(¤t_json)?; + if current == *next { + Self::insert_goal_kernel_event(&transaction, &event)?; + transaction.commit()?; + return Ok(current); + } + } + let projection_json = serde_json::to_string(next)?; + transaction.execute( + r#"INSERT INTO goal_completion_projection + (goal_id, schema_version, revision, frozen_fingerprint, status, + projection_json, row_revision, updated_at) + VALUES (?1, ?2, ?3, ?4, ?5, ?6, 0, ?7) + ON CONFLICT(goal_id) DO UPDATE SET + schema_version = excluded.schema_version, + revision = excluded.revision, + frozen_fingerprint = excluded.frozen_fingerprint, + status = excluded.status, + projection_json = excluded.projection_json, + row_revision = goal_completion_projection.row_revision + 1, + updated_at = excluded.updated_at"#, + params![ + next.goal_id.to_string(), + GOAL_COMPLETION_SCHEMA_VERSION, + next.revision, + next.frozen_fingerprint, + next.status.as_str(), + projection_json, + event.created_at.to_rfc3339_opts(SecondsFormat::Nanos, true), + ], + )?; + Self::insert_goal_kernel_event(&transaction, &event)?; + transaction.commit()?; + Ok(next.clone()) + } + + fn decode_goal_completion_projection( + goal_id: Uuid, + row: (String, String, String, String, String), + ) -> EventStoreResult { + let (schema_version, revision, frozen_fingerprint, status, projection_json) = row; + let projection: GoalCompletionProjection = serde_json::from_str(&projection_json)?; + if projection.goal_id != goal_id + || projection.schema_version != schema_version + || projection.schema_version != GOAL_COMPLETION_SCHEMA_VERSION + || projection.revision != revision + || projection.frozen_fingerprint != frozen_fingerprint + || projection.status.as_str() != status + { + return Err(EventStoreError::InvalidState( + "goal_completion_projection_invalid".to_string(), + )); + } + Ok(projection) + } + pub fn list_recent(&self, limit: usize) -> EventStoreResult> { let limit = i64::try_from(limit).unwrap_or(i64::MAX); let mut statement = self.conn.prepare( diff --git a/apps/desktop/src-tauri/src/kernel/goal_envelope.rs b/apps/desktop/src-tauri/src/kernel/goal_envelope.rs new file mode 100644 index 0000000..d8fbc48 --- /dev/null +++ b/apps/desktop/src-tauri/src/kernel/goal_envelope.rs @@ -0,0 +1,537 @@ +use std::collections::BTreeSet; +use std::fmt; + +use serde::{Deserialize, Serialize}; +use serde_json::Value; + +pub const GOAL_ENVELOPE_PROPOSAL_VERSION: &str = "ds-agent.goal-envelope-proposal/v1"; + +const MAX_JSON_BYTES: usize = 64 * 1024; +const MAX_ID_BYTES: usize = 96; +const MAX_USER_GOAL_BYTES: usize = 4 * 1024; +const MAX_TEXT_BYTES: usize = 2 * 1024; +const MAX_LIST_ITEMS: usize = 32; +const MAX_VERIFIERS: usize = 64; + +#[derive(Clone, Copy, Debug, Eq, PartialEq)] +pub enum GoalEnvelopeProposalError { + JsonTooLarge, + InvalidJson, + UnsupportedVersion, + InvalidText, + InvalidIdentifier, + CollectionOutOfBounds, + DuplicateValue, + UnknownDoneWhenBinding, + MissingVerifierBinding, + SecretLikeContent, +} + +impl fmt::Display for GoalEnvelopeProposalError { + fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result { + formatter.write_str(match self { + Self::JsonTooLarge => "goal envelope proposal json is too large", + Self::InvalidJson => "goal envelope proposal json is invalid", + Self::UnsupportedVersion => "goal envelope proposal version is unsupported", + Self::InvalidText => "goal envelope proposal contains invalid text", + Self::InvalidIdentifier => "goal envelope proposal contains an invalid identifier", + Self::CollectionOutOfBounds => { + "goal envelope proposal collection is outside its bounds" + } + Self::DuplicateValue => "goal envelope proposal contains a duplicate value", + Self::UnknownDoneWhenBinding => { + "goal envelope proposal verifier references an unknown done_when" + } + Self::MissingVerifierBinding => { + "goal envelope proposal done_when has no verifier proposal" + } + Self::SecretLikeContent => "goal envelope proposal contains secret-like content", + }) + } +} + +impl std::error::Error for GoalEnvelopeProposalError {} + +#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)] +#[serde(deny_unknown_fields)] +pub struct GoalDoneWhenProposal { + pub done_when_id: String, + pub description: String, +} + +#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)] +#[serde(deny_unknown_fields)] +pub struct GoalRequiredArtifactProposal { + pub artifact_id: String, + pub description: String, +} + +#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)] +#[serde(deny_unknown_fields)] +pub struct GoalVerifierProposal { + pub verifier_id: String, + pub done_when_id: String, + pub description: String, + pub evidence_kind: String, +} + +#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)] +#[serde(deny_unknown_fields)] +pub struct GoalExternalTargetProposal { + pub target_id: String, + pub description: String, +} + +#[derive(Clone, Debug, Eq, PartialEq, Serialize)] +pub struct GoalEnvelopeProposal { + pub version: String, + pub user_goal: String, + pub assumptions: Vec, + pub constraints: Vec, + pub done_when: Vec, + pub required_artifacts: Vec, + pub verifiers: Vec, + pub proposed_capabilities: Vec, + pub external_targets: Vec, + pub stop_conditions: Vec, +} + +#[derive(Deserialize)] +#[serde(deny_unknown_fields)] +struct GoalEnvelopeProposalWire { + version: String, + user_goal: String, + assumptions: Vec, + constraints: Vec, + done_when: Vec, + required_artifacts: Vec, + verifiers: Vec, + proposed_capabilities: Vec, + external_targets: Vec, + stop_conditions: Vec, +} + +impl From for GoalEnvelopeProposal { + fn from(wire: GoalEnvelopeProposalWire) -> Self { + Self { + version: wire.version, + user_goal: wire.user_goal, + assumptions: wire.assumptions, + constraints: wire.constraints, + done_when: wire.done_when, + required_artifacts: wire.required_artifacts, + verifiers: wire.verifiers, + proposed_capabilities: wire.proposed_capabilities, + external_targets: wire.external_targets, + stop_conditions: wire.stop_conditions, + } + } +} + +impl<'de> Deserialize<'de> for GoalEnvelopeProposal { + fn deserialize(deserializer: D) -> Result + where + D: serde::Deserializer<'de>, + { + let proposal = Self::from(GoalEnvelopeProposalWire::deserialize(deserializer)?); + proposal.validate().map_err(serde::de::Error::custom)?; + Ok(proposal) + } +} + +impl GoalEnvelopeProposal { + pub fn parse_json(json: &str) -> Result { + if json.len() > MAX_JSON_BYTES { + return Err(GoalEnvelopeProposalError::JsonTooLarge); + } + let wire: GoalEnvelopeProposalWire = + serde_json::from_str(json).map_err(|_| GoalEnvelopeProposalError::InvalidJson)?; + let proposal = Self::from(wire); + proposal.validate()?; + Ok(proposal) + } + + pub fn parse_value(value: Value) -> Result { + let encoded = + serde_json::to_vec(&value).map_err(|_| GoalEnvelopeProposalError::InvalidJson)?; + if encoded.len() > MAX_JSON_BYTES { + return Err(GoalEnvelopeProposalError::JsonTooLarge); + } + let wire: GoalEnvelopeProposalWire = + serde_json::from_value(value).map_err(|_| GoalEnvelopeProposalError::InvalidJson)?; + let proposal = Self::from(wire); + proposal.validate()?; + Ok(proposal) + } + + pub fn to_json(&self) -> Result { + self.validate()?; + serde_json::to_string(self).map_err(|_| GoalEnvelopeProposalError::InvalidJson) + } + + pub fn validate(&self) -> Result<(), GoalEnvelopeProposalError> { + if self.version != GOAL_ENVELOPE_PROPOSAL_VERSION { + return Err(GoalEnvelopeProposalError::UnsupportedVersion); + } + validate_text(&self.user_goal, MAX_USER_GOAL_BYTES)?; + validate_text_list(&self.assumptions, MAX_LIST_ITEMS)?; + validate_text_list(&self.constraints, MAX_LIST_ITEMS)?; + validate_text_list(&self.stop_conditions, MAX_LIST_ITEMS)?; + + if self.done_when.is_empty() || self.done_when.len() > MAX_LIST_ITEMS { + return Err(GoalEnvelopeProposalError::CollectionOutOfBounds); + } + let mut done_when_ids = BTreeSet::new(); + for condition in &self.done_when { + validate_id(&condition.done_when_id)?; + validate_text(&condition.description, MAX_TEXT_BYTES)?; + if !done_when_ids.insert(condition.done_when_id.as_str()) { + return Err(GoalEnvelopeProposalError::DuplicateValue); + } + } + + if self.required_artifacts.len() > MAX_LIST_ITEMS { + return Err(GoalEnvelopeProposalError::CollectionOutOfBounds); + } + let mut artifact_ids = BTreeSet::new(); + for artifact in &self.required_artifacts { + validate_id(&artifact.artifact_id)?; + validate_text(&artifact.description, MAX_TEXT_BYTES)?; + if !artifact_ids.insert(artifact.artifact_id.as_str()) { + return Err(GoalEnvelopeProposalError::DuplicateValue); + } + } + + if self.verifiers.is_empty() || self.verifiers.len() > MAX_VERIFIERS { + return Err(GoalEnvelopeProposalError::CollectionOutOfBounds); + } + let mut verifier_ids = BTreeSet::new(); + let mut bound_done_when = BTreeSet::new(); + for verifier in &self.verifiers { + validate_id(&verifier.verifier_id)?; + validate_id(&verifier.done_when_id)?; + validate_text(&verifier.description, MAX_TEXT_BYTES)?; + validate_id(&verifier.evidence_kind)?; + if !verifier_ids.insert(verifier.verifier_id.as_str()) { + return Err(GoalEnvelopeProposalError::DuplicateValue); + } + if !done_when_ids.contains(verifier.done_when_id.as_str()) { + return Err(GoalEnvelopeProposalError::UnknownDoneWhenBinding); + } + bound_done_when.insert(verifier.done_when_id.as_str()); + } + if done_when_ids + .iter() + .any(|done_when_id| !bound_done_when.contains(done_when_id)) + { + return Err(GoalEnvelopeProposalError::MissingVerifierBinding); + } + + validate_id_list(&self.proposed_capabilities, MAX_LIST_ITEMS)?; + + if self.external_targets.len() > MAX_LIST_ITEMS { + return Err(GoalEnvelopeProposalError::CollectionOutOfBounds); + } + let mut target_ids = BTreeSet::new(); + for target in &self.external_targets { + validate_id(&target.target_id)?; + validate_text(&target.description, MAX_TEXT_BYTES)?; + if !target_ids.insert(target.target_id.as_str()) { + return Err(GoalEnvelopeProposalError::DuplicateValue); + } + } + + let encoded = + serde_json::to_vec(self).map_err(|_| GoalEnvelopeProposalError::InvalidJson)?; + if encoded.len() > MAX_JSON_BYTES { + return Err(GoalEnvelopeProposalError::JsonTooLarge); + } + + Ok(()) + } +} + +fn validate_text_list( + values: &[String], + max_items: usize, +) -> Result<(), GoalEnvelopeProposalError> { + if values.len() > max_items { + return Err(GoalEnvelopeProposalError::CollectionOutOfBounds); + } + let mut unique = BTreeSet::new(); + for value in values { + validate_text(value, MAX_TEXT_BYTES)?; + if !unique.insert(value.as_str()) { + return Err(GoalEnvelopeProposalError::DuplicateValue); + } + } + Ok(()) +} + +fn validate_id_list(values: &[String], max_items: usize) -> Result<(), GoalEnvelopeProposalError> { + if values.len() > max_items { + return Err(GoalEnvelopeProposalError::CollectionOutOfBounds); + } + let mut unique = BTreeSet::new(); + for value in values { + validate_id(value)?; + if !unique.insert(value.as_str()) { + return Err(GoalEnvelopeProposalError::DuplicateValue); + } + } + Ok(()) +} + +fn validate_text(value: &str, max_bytes: usize) -> Result<(), GoalEnvelopeProposalError> { + if value.is_empty() + || value != value.trim() + || value.len() > max_bytes + || value.chars().any(char::is_control) + { + return Err(GoalEnvelopeProposalError::InvalidText); + } + if contains_secret_like_content(value) { + return Err(GoalEnvelopeProposalError::SecretLikeContent); + } + Ok(()) +} + +fn validate_id(value: &str) -> Result<(), GoalEnvelopeProposalError> { + if value.is_empty() + || value.len() > MAX_ID_BYTES + || !value + .bytes() + .next() + .is_some_and(|byte| byte.is_ascii_lowercase() || byte.is_ascii_digit()) + || !value.bytes().all(|byte| { + byte.is_ascii_lowercase() || byte.is_ascii_digit() || matches!(byte, b'.' | b'_' | b'-') + }) + { + return Err(GoalEnvelopeProposalError::InvalidIdentifier); + } + if contains_secret_like_content(value) { + return Err(GoalEnvelopeProposalError::SecretLikeContent); + } + Ok(()) +} + +fn contains_secret_like_content(value: &str) -> bool { + let lower = value.to_ascii_lowercase(); + contains_token_after(&lower, "bearer ", 12) + || contains_token_after(&lower, "api_key=", 12) + || contains_token_after(&lower, "api_key:", 12) + || contains_token_after(&lower, "api-key=", 12) + || contains_token_after(&lower, "api-key:", 12) + || contains_token_after(&lower, "apikey=", 12) + || contains_token_after(&lower, "apikey:", 12) + || contains_token_after(&lower, "password=", 12) + || contains_token_after(&lower, "password:", 12) + || contains_token_after(&lower, "secret=", 12) + || contains_token_after(&lower, "secret:", 12) + || contains_token_after(&lower, "token=", 12) + || contains_token_after(&lower, "token:", 12) + || lower.match_indices("sk-").any(|(index, _)| { + lower[index + 3..] + .bytes() + .take_while(|byte| byte.is_ascii_alphanumeric() || matches!(*byte, b'_' | b'-')) + .count() + >= 12 + }) +} + +fn contains_token_after(value: &str, marker: &str, minimum_length: usize) -> bool { + value.match_indices(marker).any(|(index, _)| { + value[index + marker.len()..] + .trim_start_matches([' ', '\'', '"']) + .bytes() + .take_while(|byte| byte.is_ascii_alphanumeric() || matches!(*byte, b'_' | b'-' | b'.')) + .count() + >= minimum_length + }) +} + +#[cfg(test)] +mod tests { + use super::*; + + fn valid_value() -> Value { + serde_json::json!({ + "version": GOAL_ENVELOPE_PROPOSAL_VERSION, + "user_goal": "Create a verified monthly operating brief.", + "assumptions": ["The supplied source set is complete."], + "constraints": ["Keep all proposed outputs inside the selected workspace."], + "done_when": [ + { + "done_when_id": "reconciliation-ready", + "description": "The proposed reconciliation workbook is complete." + }, + { + "done_when_id": "brief-ready", + "description": "The proposed one-page brief is complete." + } + ], + "required_artifacts": [ + { + "artifact_id": "reconciliation-workbook", + "description": "A proposed reconciliation workbook." + }, + { + "artifact_id": "operating-brief", + "description": "A proposed one-page presentation." + } + ], + "verifiers": [ + { + "verifier_id": "workbook-verifier-v1", + "done_when_id": "reconciliation-ready", + "description": "Verify formulas and source totals.", + "evidence_kind": "workbook-reconciliation" + }, + { + "verifier_id": "brief-verifier-v1", + "done_when_id": "brief-ready", + "description": "Verify the rendered slide has no overflow.", + "evidence_kind": "rendered-presentation" + } + ], + "proposed_capabilities": ["file.read", "office.workbook.propose"], + "external_targets": [ + { + "target_id": "selected-workspace", + "description": "The workspace selected by the user; DS Agent must validate it locally." + } + ], + "stop_conditions": ["Stop if a required source is missing."] + }) + } + + #[test] + fn parses_and_round_trips_the_versioned_contract() { + let proposal = GoalEnvelopeProposal::parse_value(valid_value()).expect("proposal parses"); + assert_eq!(proposal.version, GOAL_ENVELOPE_PROPOSAL_VERSION); + assert_eq!(proposal.done_when.len(), 2); + assert_eq!(proposal.verifiers.len(), 2); + assert_eq!(proposal.proposed_capabilities[0], "file.read"); + + let encoded = proposal.to_json().expect("proposal serializes"); + assert_eq!( + GoalEnvelopeProposal::parse_json(&encoded).expect("round trip parses"), + proposal + ); + } + + #[test] + fn rejects_missing_and_unknown_fields() { + let mut missing = valid_value(); + missing.as_object_mut().unwrap().remove("constraints"); + assert_eq!( + GoalEnvelopeProposal::parse_value(missing), + Err(GoalEnvelopeProposalError::InvalidJson) + ); + + let mut unknown = valid_value(); + unknown["approval_granted"] = serde_json::json!(true); + assert_eq!( + GoalEnvelopeProposal::parse_value(unknown), + Err(GoalEnvelopeProposalError::InvalidJson) + ); + } + + #[test] + fn rejects_unsupported_versions_without_fallback() { + let mut value = valid_value(); + value["version"] = serde_json::json!("ds-agent.goal-envelope-proposal/v2"); + assert_eq!( + GoalEnvelopeProposal::parse_value(value), + Err(GoalEnvelopeProposalError::UnsupportedVersion) + ); + } + + #[test] + fn rejects_secret_like_content_with_a_stable_error() { + let mut value = valid_value(); + let secret_like_value = ["sk", "1234567890abcdef"].join("-"); + value["user_goal"] = serde_json::json!(format!("Use {secret_like_value} to run the task.")); + let error = GoalEnvelopeProposal::parse_value(value).unwrap_err(); + assert_eq!(error, GoalEnvelopeProposalError::SecretLikeContent); + assert_eq!( + error.to_string(), + "goal envelope proposal contains secret-like content" + ); + assert!(!error.to_string().contains("1234567890abcdef")); + } + + #[test] + fn rejects_unbounded_and_duplicate_collections() { + let mut unbounded = valid_value(); + unbounded["assumptions"] = serde_json::json!(vec!["bounded"; MAX_LIST_ITEMS + 1]); + assert_eq!( + GoalEnvelopeProposal::parse_value(unbounded), + Err(GoalEnvelopeProposalError::CollectionOutOfBounds) + ); + + let mut duplicate = valid_value(); + duplicate["proposed_capabilities"] = serde_json::json!(["file.read", "file.read"]); + assert_eq!( + GoalEnvelopeProposal::parse_value(duplicate), + Err(GoalEnvelopeProposalError::DuplicateValue) + ); + } + + #[test] + fn rejects_an_oversized_aggregate_after_direct_dto_mutation() { + let mut proposal = + GoalEnvelopeProposal::parse_value(valid_value()).expect("proposal parses"); + proposal.assumptions = (0..MAX_LIST_ITEMS) + .map(|index| format!("{index:02}-{}", "x".repeat(MAX_TEXT_BYTES - 3))) + .collect(); + + assert_eq!( + proposal.validate(), + Err(GoalEnvelopeProposalError::JsonTooLarge) + ); + assert_eq!( + proposal.to_json(), + Err(GoalEnvelopeProposalError::JsonTooLarge) + ); + } + + #[test] + fn rejects_unknown_and_missing_verifier_bindings() { + let mut unknown = valid_value(); + unknown["verifiers"][0]["done_when_id"] = serde_json::json!("not-declared"); + assert_eq!( + GoalEnvelopeProposal::parse_value(unknown), + Err(GoalEnvelopeProposalError::UnknownDoneWhenBinding) + ); + + let mut missing = valid_value(); + missing["verifiers"].as_array_mut().unwrap().pop(); + assert_eq!( + GoalEnvelopeProposal::parse_value(missing), + Err(GoalEnvelopeProposalError::MissingVerifierBinding) + ); + } + + #[test] + fn rejects_authority_fields_inside_nested_proposals() { + let mut value = valid_value(); + value["external_targets"][0]["trusted_path"] = serde_json::json!(true); + assert_eq!( + GoalEnvelopeProposal::parse_value(value), + Err(GoalEnvelopeProposalError::InvalidJson) + ); + } + + #[test] + fn keeps_unknown_capability_names_as_non_authoritative_proposals() { + let mut value = valid_value(); + value["proposed_capabilities"] = + serde_json::json!(["future.connector.read", "future.desktop.observe"]); + let proposal = GoalEnvelopeProposal::parse_value(value).expect("proposal parses"); + assert_eq!( + proposal.proposed_capabilities, + vec!["future.connector.read", "future.desktop.observe"] + ); + } +} diff --git a/apps/desktop/src-tauri/src/kernel/goal_lifecycle.rs b/apps/desktop/src-tauri/src/kernel/goal_lifecycle.rs new file mode 100644 index 0000000..a9b3c14 --- /dev/null +++ b/apps/desktop/src-tauri/src/kernel/goal_lifecycle.rs @@ -0,0 +1,2328 @@ +use std::collections::{BTreeMap, BTreeSet}; + +use chrono::Utc; +use serde::{Deserialize, Serialize}; +use sha2::{Digest, Sha256}; +use uuid::Uuid; + +use crate::kernel::goal_envelope::{ + GoalDoneWhenProposal, GoalEnvelopeProposal, GoalEnvelopeProposalError, + GoalRequiredArtifactProposal, GoalVerifierProposal, +}; +use crate::kernel::local_directory::WorkspaceReadinessCode; +use crate::kernel::models::{AccessMode, KernelEvent}; +use crate::kernel::policy::{capability_risk, decide, CapabilityKind, PolicyDecision, RiskLevel}; +use crate::kernel::tool_runtime::{ + builtin_tool_catalog, ToolContract, ToolExecutionStatus, ToolInvocationRecord, ToolPathScope, + CONNECTOR_MUTATE_TOOL_ID, +}; + +pub const GOAL_LIFECYCLE_SCHEMA_VERSION: &str = "ds-agent.goal-envelope-lifecycle/v1"; +pub const GOAL_FROZEN_ENVELOPE_VERSION: &str = "ds-agent.goal-envelope-frozen/v1"; +pub const GOAL_COMPLETION_SCHEMA_VERSION: &str = "ds-agent.goal-envelope-completion/v1"; +pub const GOAL_UI_PROJECTION_VERSION: &str = "ds-agent.goal-envelope-ui/v1"; + +const PROPOSAL_FINGERPRINT_DOMAIN: &[u8] = b"ds-agent.goal-envelope-proposal-fingerprint.v1\0"; +const CONTEXT_FINGERPRINT_DOMAIN: &[u8] = b"ds-agent.goal-envelope-context-fingerprint.v1\0"; +const REVISION_DOMAIN: &[u8] = b"ds-agent.goal-envelope-revision.v1\0"; +const FROZEN_FINGERPRINT_DOMAIN: &[u8] = b"ds-agent.goal-envelope-frozen-fingerprint.v1\0"; +const EVENT_ID_DOMAIN: &[u8] = b"ds-agent.goal-envelope-event-id.v1\0"; +const COMPLETION_EVIDENCE_DOMAIN: &[u8] = b"ds-agent.goal-envelope-completion-evidence.v1\0"; +const COMPLETION_RECEIPT_DOMAIN: &[u8] = b"ds-agent.goal-envelope-completion-receipt.v1\0"; +const COMPLETION_EVENT_ID_DOMAIN: &[u8] = b"ds-agent.goal-envelope-completion-event-id.v1\0"; +const MAX_PERSISTED_ENVELOPE_BYTES: usize = 64 * 1024; +const MAX_COMPLETION_EVIDENCE: usize = 128; + +const PROPOSAL_RECEIVED_EVENT: &str = "goal_envelope.proposal_received"; +const VALIDATION_BLOCKED_EVENT: &str = "goal_envelope.validation_blocked"; +const VALIDATED_EVENT: &str = "goal_envelope.validated"; +const FROZEN_EVENT: &str = "goal_envelope.frozen"; +const COMPLETION_BLOCKED_EVENT: &str = "goal_envelope.verification_blocked"; +const COMPLETED_EVENT: &str = "goal_envelope.completed"; + +#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum GoalLifecycleStatus { + ProposalReceived, + ValidationBlocked, + Validated, + Frozen, +} + +#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum GoalCompletionStatus { + VerificationBlocked, + Complete, +} + +impl GoalCompletionStatus { + pub fn as_str(self) -> &'static str { + match self { + Self::VerificationBlocked => "verification_blocked", + Self::Complete => "complete", + } + } +} + +#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum GoalCompletionCode { + ArtifactIdentityMismatch, + DuplicateEvidence, + EvidenceFailed, + EvidenceGoalMismatch, + EvidenceRevisionMismatch, + EvidenceFingerprintMismatch, + MissingArtifactEvidence, + MissingVerifierEvidence, + UnknownEvidence, + VerifierBindingMismatch, +} + +#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum GoalVerifierEvidenceStatus { + Passed, + Failed, + Unknown, +} + +#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)] +#[serde(deny_unknown_fields)] +pub struct GoalCompletionEvidenceReceipt { + pub evidence_id: Uuid, + pub goal_id: Uuid, + pub revision: String, + pub frozen_fingerprint: String, + pub verifier_id: String, + pub done_when_id: String, + pub evidence_kind: String, + pub artifact_ids: Vec, + pub status: GoalVerifierEvidenceStatus, + pub source_fingerprint: String, +} + +#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)] +#[serde(deny_unknown_fields)] +pub struct GoalCompletionReceipt { + pub version: String, + pub goal_id: Uuid, + pub revision: String, + pub frozen_fingerprint: String, + pub evidence_fingerprints: Vec, + pub fingerprint: String, +} + +#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)] +#[serde(deny_unknown_fields)] +pub struct GoalCompletionProjection { + pub schema_version: String, + pub goal_id: Uuid, + pub revision: String, + pub frozen_fingerprint: String, + pub status: GoalCompletionStatus, + pub failure_codes: Vec, + pub evidence: Vec, + pub completion_receipt: Option, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum GoalEnvelopeUiStatus { + Proposed, + Blocked, + Validated, + Frozen, + VerificationBlocked, + Complete, +} + +#[derive(Clone, Debug, Eq, PartialEq, Serialize)] +pub struct GoalEnvelopeUiProjection { + pub version: String, + pub goal_id: Uuid, + pub status: GoalEnvelopeUiStatus, + pub reason_codes: Vec, + pub revision: Option, + pub fingerprint: String, + pub completion_fingerprint: Option, + pub user_goal_summary: Option, + pub done_when_count: usize, + pub required_artifact_count: usize, + pub verifier_count: usize, +} + +impl GoalLifecycleStatus { + pub fn as_str(self) -> &'static str { + match self { + Self::ProposalReceived => "proposal_received", + Self::ValidationBlocked => "validation_blocked", + Self::Validated => "validated", + Self::Frozen => "frozen", + } + } +} + +#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum GoalValidationCode { + AuthorizationUnavailable, + CapabilityDisabled, + CapabilityNotReady, + CapabilityRiskNotAllowed, + ExternalEffectNotAllowed, + LocalEffectNotAllowed, + SensitiveLocalReference, + TargetBindingInvalid, + TargetUnbound, + UnknownCapability, + VerifierUnavailable, + WorkspaceNotReady, +} + +#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum GoalValidationDisposition { + Blocked, + Validated, +} + +#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum GoalTargetBindingKind { + Workspace, + Path, + Account, + Recipient, + TimeWindow, +} + +#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum GoalEffectClass { + ReadOnly, + LocalMutation, + ExternalMutation, +} + +#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum GoalAuthorizationRequirement { + None, + FutureApprovalRequired, +} + +#[derive(Clone, Debug, Eq, PartialEq)] +struct GoalTargetAuthorityBinding { + target_id: String, + binding_kind: GoalTargetBindingKind, + authority_fingerprint: String, + authority_bound: bool, +} + +#[derive(Clone, Debug)] +pub struct GoalValidationContext { + access_mode: AccessMode, + workspace_readiness: WorkspaceReadinessCode, + max_risk: RiskLevel, + enabled_tools: BTreeSet, + ready_tools: BTreeSet, + approval_routes: BTreeSet, + verifier_kinds: BTreeSet, + target_bindings: BTreeMap, + allow_local_effects: bool, + allow_external_effects: bool, +} + +impl GoalValidationContext { + pub fn new(access_mode: AccessMode, workspace_readiness: WorkspaceReadinessCode) -> Self { + Self { + access_mode, + workspace_readiness, + max_risk: RiskLevel::Low, + enabled_tools: BTreeSet::new(), + ready_tools: BTreeSet::new(), + approval_routes: BTreeSet::new(), + verifier_kinds: BTreeSet::new(), + target_bindings: BTreeMap::new(), + allow_local_effects: false, + allow_external_effects: false, + } + } + + pub fn with_max_risk(mut self, max_risk: RiskLevel) -> Self { + self.max_risk = max_risk; + self + } + + pub fn with_enabled_tool(mut self, tool_id: impl Into, ready: bool) -> Self { + let tool_id = tool_id.into(); + self.enabled_tools.insert(tool_id.clone()); + if ready { + self.ready_tools.insert(tool_id); + } else { + self.ready_tools.remove(&tool_id); + } + self + } + + pub fn with_approval_route(mut self, tool_id: impl Into) -> Self { + self.approval_routes.insert(tool_id.into()); + self + } + + pub fn with_verifier_kind(mut self, evidence_kind: impl Into) -> Self { + self.verifier_kinds.insert(evidence_kind.into()); + self + } + + pub fn with_target_binding( + mut self, + target_id: impl Into, + binding_kind: GoalTargetBindingKind, + local_authority_material: impl AsRef<[u8]>, + ) -> Self { + let target_id = target_id.into(); + let local_authority_material = local_authority_material.as_ref(); + let authority_fingerprint = domain_hash( + b"ds-agent.goal-envelope-target-authority.v1\0", + local_authority_material, + ); + self.target_bindings.insert( + target_id.clone(), + GoalTargetAuthorityBinding { + target_id, + binding_kind, + authority_fingerprint, + authority_bound: !local_authority_material.is_empty(), + }, + ); + self + } + + pub fn allowing_local_effects(mut self) -> Self { + self.allow_local_effects = true; + self + } + + pub fn allowing_external_effects(mut self) -> Self { + self.allow_external_effects = true; + self + } +} + +#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)] +#[serde(deny_unknown_fields)] +pub struct GoalCapabilityValidation { + pub tool_id: String, + pub capability: String, + pub risk_level: RiskLevel, + pub effect_class: GoalEffectClass, + pub authorization: GoalAuthorizationRequirement, +} + +#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)] +#[serde(deny_unknown_fields)] +pub struct BoundGoalTarget { + pub target_id: String, + pub binding_kind: GoalTargetBindingKind, + pub authority_fingerprint: String, +} + +#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)] +#[serde(deny_unknown_fields)] +pub struct GoalValidationReceipt { + pub version: String, + pub disposition: GoalValidationDisposition, + pub proposal_fingerprint: String, + pub context_fingerprint: String, + pub failure_codes: Vec, + pub capabilities: Vec, + pub target_bindings: Vec, + pub verifier_kinds: Vec, +} + +#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)] +#[serde(deny_unknown_fields)] +pub struct ValidatedGoalEnvelope { + pub version: String, + pub user_goal: String, + pub assumptions: Vec, + pub constraints: Vec, + pub done_when: Vec, + pub required_artifacts: Vec, + pub verifiers: Vec, + pub validated_capabilities: Vec, + pub bound_targets: Vec, + pub stop_conditions: Vec, +} + +#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)] +#[serde(deny_unknown_fields)] +pub struct GoalFrozenEnvelope { + pub version: String, + pub proposal_fingerprint: String, + pub revision: String, + pub envelope: ValidatedGoalEnvelope, + pub validation_receipt: GoalValidationReceipt, + pub fingerprint: String, +} + +impl GoalFrozenEnvelope { + pub fn canonical_json(&self) -> Result { + serde_json::to_string(&FrozenCanonical { + version: &self.version, + proposal_fingerprint: &self.proposal_fingerprint, + revision: &self.revision, + envelope: &self.envelope, + validation_receipt: &self.validation_receipt, + }) + } +} + +#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)] +#[serde(tag = "status", rename_all = "snake_case", deny_unknown_fields)] +pub enum GoalLifecycleState { + ProposalReceived { + proposal_fingerprint: String, + }, + ValidationBlocked { + proposal_fingerprint: String, + validation_receipt: GoalValidationReceipt, + }, + Validated { + proposal_fingerprint: String, + revision: String, + envelope: ValidatedGoalEnvelope, + validation_receipt: GoalValidationReceipt, + }, + Frozen { + frozen: GoalFrozenEnvelope, + }, +} + +#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)] +#[serde(deny_unknown_fields)] +pub struct GoalLifecycleProjection { + pub schema_version: String, + pub goal_id: Uuid, + pub state: GoalLifecycleState, +} + +impl GoalLifecycleProjection { + pub fn status(&self) -> GoalLifecycleStatus { + match self.state { + GoalLifecycleState::ProposalReceived { .. } => GoalLifecycleStatus::ProposalReceived, + GoalLifecycleState::ValidationBlocked { .. } => GoalLifecycleStatus::ValidationBlocked, + GoalLifecycleState::Validated { .. } => GoalLifecycleStatus::Validated, + GoalLifecycleState::Frozen { .. } => GoalLifecycleStatus::Frozen, + } + } + + pub fn proposal_fingerprint(&self) -> &str { + match &self.state { + GoalLifecycleState::ProposalReceived { + proposal_fingerprint, + } + | GoalLifecycleState::ValidationBlocked { + proposal_fingerprint, + .. + } + | GoalLifecycleState::Validated { + proposal_fingerprint, + .. + } => proposal_fingerprint, + GoalLifecycleState::Frozen { frozen } => &frozen.proposal_fingerprint, + } + } + + pub fn revision(&self) -> Option<&str> { + match &self.state { + GoalLifecycleState::Validated { revision, .. } => Some(revision), + GoalLifecycleState::Frozen { frozen } => Some(&frozen.revision), + _ => None, + } + } + + pub fn validation_receipt(&self) -> Option<&GoalValidationReceipt> { + match &self.state { + GoalLifecycleState::ValidationBlocked { + validation_receipt, .. + } + | GoalLifecycleState::Validated { + validation_receipt, .. + } => Some(validation_receipt), + GoalLifecycleState::Frozen { frozen } => Some(&frozen.validation_receipt), + GoalLifecycleState::ProposalReceived { .. } => None, + } + } + + pub fn frozen(&self) -> Option<&GoalFrozenEnvelope> { + match &self.state { + GoalLifecycleState::Frozen { frozen } => Some(frozen), + _ => None, + } + } + + pub(super) fn validate_persisted(&self) -> Result<(), &'static str> { + if self.schema_version != GOAL_LIFECYCLE_SCHEMA_VERSION + || !valid_hash(self.proposal_fingerprint()) + { + return Err("goal_projection_invalid"); + } + match &self.state { + GoalLifecycleState::ProposalReceived { .. } => Ok(()), + GoalLifecycleState::ValidationBlocked { + proposal_fingerprint, + validation_receipt, + } => { + if validation_receipt.disposition != GoalValidationDisposition::Blocked + || validation_receipt.failure_codes.is_empty() + || validation_receipt.proposal_fingerprint != *proposal_fingerprint + || !receipt_is_secret_free(validation_receipt) + { + return Err("goal_projection_invalid"); + } + Ok(()) + } + GoalLifecycleState::Validated { + proposal_fingerprint, + revision, + envelope, + validation_receipt, + } => { + if validation_receipt.disposition != GoalValidationDisposition::Validated + || !validation_receipt.failure_codes.is_empty() + || validation_receipt.proposal_fingerprint != *proposal_fingerprint + || revision != &revision_for(proposal_fingerprint, envelope, validation_receipt) + || !receipt_is_secret_free(validation_receipt) + || !validated_envelope_is_secret_free(envelope, validation_receipt) + { + return Err("goal_projection_invalid"); + } + Ok(()) + } + GoalLifecycleState::Frozen { frozen } => { + if frozen.version != GOAL_FROZEN_ENVELOPE_VERSION + || frozen.validation_receipt.disposition != GoalValidationDisposition::Validated + || !frozen.validation_receipt.failure_codes.is_empty() + || frozen.validation_receipt.proposal_fingerprint != frozen.proposal_fingerprint + || frozen.revision + != revision_for( + &frozen.proposal_fingerprint, + &frozen.envelope, + &frozen.validation_receipt, + ) + || frozen.fingerprint != frozen_fingerprint(frozen) + || !receipt_is_secret_free(&frozen.validation_receipt) + || !validated_envelope_is_secret_free( + &frozen.envelope, + &frozen.validation_receipt, + ) + { + return Err("goal_projection_invalid"); + } + Ok(()) + } + } + } +} + +#[derive(Serialize)] +struct FrozenCanonical<'a> { + version: &'a str, + proposal_fingerprint: &'a str, + revision: &'a str, + envelope: &'a ValidatedGoalEnvelope, + validation_receipt: &'a GoalValidationReceipt, +} + +#[derive(Serialize)] +struct RevisionCanonical<'a> { + version: &'static str, + proposal_fingerprint: &'a str, + envelope: &'a ValidatedGoalEnvelope, + validation_receipt: &'a GoalValidationReceipt, +} + +#[derive(Serialize)] +struct ContextCanonical<'a> { + access_mode: AccessMode, + workspace_readiness: WorkspaceReadinessCode, + max_risk: RiskLevel, + enabled_tools: &'a BTreeSet, + ready_tools: &'a BTreeSet, + approval_routes: &'a BTreeSet, + verifier_kinds: &'a BTreeSet, + target_bindings: Vec, + allow_local_effects: bool, + allow_external_effects: bool, +} + +#[derive(Serialize)] +struct GoalLifecycleEventPayload<'a> { + schema_version: &'static str, + goal_id: Uuid, + status: GoalLifecycleStatus, + proposal_fingerprint: &'a str, + revision: Option<&'a str>, + frozen_fingerprint: Option<&'a str>, + failure_codes: &'a [GoalValidationCode], +} + +pub(super) fn proposal_received_projection( + goal_id: Uuid, + proposal: &GoalEnvelopeProposal, +) -> Result { + proposal.validate()?; + Ok(GoalLifecycleProjection { + schema_version: GOAL_LIFECYCLE_SCHEMA_VERSION.to_string(), + goal_id, + state: GoalLifecycleState::ProposalReceived { + proposal_fingerprint: proposal_fingerprint(proposal), + }, + }) +} + +pub(super) fn validated_projection( + goal_id: Uuid, + proposal: &GoalEnvelopeProposal, + context: &GoalValidationContext, +) -> Result { + proposal.validate()?; + let proposal_fingerprint = proposal_fingerprint(proposal); + let context_fingerprint = context_fingerprint(context); + let mut failures = BTreeSet::new(); + if proposal_contains_sensitive_local_reference(proposal) { + failures.insert(GoalValidationCode::SensitiveLocalReference); + } + + let catalog = builtin_tool_catalog(); + let mut capabilities = Vec::new(); + for tool_id in &proposal.proposed_capabilities { + let Some(contract) = catalog.iter().find(|contract| contract.id == *tool_id) else { + failures.insert(GoalValidationCode::UnknownCapability); + continue; + }; + validate_capability(contract, context, &mut failures); + capabilities.push(capability_validation(contract, context)); + } + capabilities.sort_by(|left, right| left.tool_id.cmp(&right.tool_id)); + + let mut target_bindings = Vec::new(); + for target in &proposal.external_targets { + let Some(binding) = context.target_bindings.get(&target.target_id) else { + failures.insert(GoalValidationCode::TargetUnbound); + continue; + }; + if binding.target_id != target.target_id + || !binding.authority_bound + || !valid_hash(&binding.authority_fingerprint) + || contains_sensitive_local_reference(&binding.target_id) + { + failures.insert(GoalValidationCode::TargetBindingInvalid); + continue; + } + if matches!( + binding.binding_kind, + GoalTargetBindingKind::Workspace | GoalTargetBindingKind::Path + ) && context.workspace_readiness != WorkspaceReadinessCode::Ready + { + failures.insert(GoalValidationCode::WorkspaceNotReady); + } + target_bindings.push(BoundGoalTarget { + target_id: target.target_id.clone(), + binding_kind: binding.binding_kind, + authority_fingerprint: binding.authority_fingerprint.clone(), + }); + } + target_bindings.sort_by(|left, right| left.target_id.cmp(&right.target_id)); + + let verifier_kinds = proposal + .verifiers + .iter() + .map(|verifier| verifier.evidence_kind.clone()) + .collect::>(); + if verifier_kinds + .iter() + .any(|kind| !context.verifier_kinds.contains(kind)) + { + failures.insert(GoalValidationCode::VerifierUnavailable); + } + + let disposition = if failures.is_empty() { + GoalValidationDisposition::Validated + } else { + GoalValidationDisposition::Blocked + }; + let receipt = GoalValidationReceipt { + version: GOAL_LIFECYCLE_SCHEMA_VERSION.to_string(), + disposition, + proposal_fingerprint: proposal_fingerprint.clone(), + context_fingerprint, + failure_codes: failures.into_iter().collect(), + capabilities, + target_bindings: target_bindings.clone(), + verifier_kinds: verifier_kinds + .into_iter() + .filter(|kind| !contains_sensitive_local_reference(kind)) + .collect(), + }; + + if disposition == GoalValidationDisposition::Blocked { + return Ok(GoalLifecycleProjection { + schema_version: GOAL_LIFECYCLE_SCHEMA_VERSION.to_string(), + goal_id, + state: GoalLifecycleState::ValidationBlocked { + proposal_fingerprint, + validation_receipt: receipt, + }, + }); + } + + let envelope = normalized_envelope(proposal, target_bindings, receipt.capabilities.clone()); + let revision = revision_for(&proposal_fingerprint, &envelope, &receipt); + Ok(GoalLifecycleProjection { + schema_version: GOAL_LIFECYCLE_SCHEMA_VERSION.to_string(), + goal_id, + state: GoalLifecycleState::Validated { + proposal_fingerprint, + revision, + envelope, + validation_receipt: receipt, + }, + }) +} + +pub(super) fn frozen_projection( + current: &GoalLifecycleProjection, + expected_revision: &str, +) -> Result { + match ¤t.state { + GoalLifecycleState::Validated { + proposal_fingerprint, + revision, + envelope, + validation_receipt, + } => { + if revision != expected_revision { + return Err("goal_revision_mismatch"); + } + let mut frozen = GoalFrozenEnvelope { + version: GOAL_FROZEN_ENVELOPE_VERSION.to_string(), + proposal_fingerprint: proposal_fingerprint.clone(), + revision: revision.clone(), + envelope: envelope.clone(), + validation_receipt: validation_receipt.clone(), + fingerprint: String::new(), + }; + frozen.fingerprint = frozen_fingerprint(&frozen); + Ok(GoalLifecycleProjection { + schema_version: GOAL_LIFECYCLE_SCHEMA_VERSION.to_string(), + goal_id: current.goal_id, + state: GoalLifecycleState::Frozen { frozen }, + }) + } + GoalLifecycleState::Frozen { frozen } if frozen.revision == expected_revision => { + Ok(current.clone()) + } + GoalLifecycleState::Frozen { .. } => Err("goal_revision_mismatch"), + GoalLifecycleState::ProposalReceived { .. } + | GoalLifecycleState::ValidationBlocked { .. } => Err("goal_not_validated"), + } +} + +pub(super) fn projection_event( + projection: &GoalLifecycleProjection, +) -> Result { + let failure_codes = projection + .validation_receipt() + .map(|receipt| receipt.failure_codes.as_slice()) + .unwrap_or(&[]); + let frozen_fingerprint = projection + .frozen() + .map(|frozen| frozen.fingerprint.as_str()); + let payload = GoalLifecycleEventPayload { + schema_version: GOAL_LIFECYCLE_SCHEMA_VERSION, + goal_id: projection.goal_id, + status: projection.status(), + proposal_fingerprint: projection.proposal_fingerprint(), + revision: projection.revision(), + frozen_fingerprint, + failure_codes, + }; + let payload_json = serde_json::to_string(&payload)?; + let event_type = match projection.status() { + GoalLifecycleStatus::ProposalReceived => PROPOSAL_RECEIVED_EVENT, + GoalLifecycleStatus::ValidationBlocked => VALIDATION_BLOCKED_EVENT, + GoalLifecycleStatus::Validated => VALIDATED_EVENT, + GoalLifecycleStatus::Frozen => FROZEN_EVENT, + }; + let event_key = format!( + "{}\0{}\0{}\0{}\0{}\0{}", + projection.goal_id, + projection.proposal_fingerprint(), + projection.status().as_str(), + projection.revision().unwrap_or_default(), + projection + .validation_receipt() + .map(|receipt| receipt.context_fingerprint.as_str()) + .unwrap_or_default(), + frozen_fingerprint.unwrap_or_default() + ); + Ok(KernelEvent { + id: deterministic_uuid(EVENT_ID_DOMAIN, event_key.as_bytes()), + event_type: event_type.to_string(), + payload_json, + created_at: Utc::now(), + }) +} + +#[derive(Serialize)] +struct ToolEvidenceCanonical<'a> { + invocation_id: Uuid, + tool_id: &'a str, + status: ToolExecutionStatus, + verification_passed: bool, + evidence_kinds: Vec<&'a str>, +} + +#[derive(Serialize)] +struct CompletionReceiptCanonical<'a> { + version: &'static str, + goal_id: Uuid, + revision: &'a str, + frozen_fingerprint: &'a str, + evidence_fingerprints: &'a [String], +} + +#[derive(Serialize)] +struct GoalCompletionEventPayload<'a> { + schema_version: &'static str, + goal_id: Uuid, + revision: &'a str, + frozen_fingerprint: &'a str, + status: GoalCompletionStatus, + failure_codes: &'a [GoalCompletionCode], + completion_fingerprint: Option<&'a str>, +} + +pub(super) fn completion_evidence_from_tool_invocation( + lifecycle: &GoalLifecycleProjection, + invocation: &ToolInvocationRecord, +) -> Result, &'static str> { + let frozen = lifecycle.frozen().ok_or("goal_not_frozen")?; + if invocation.run_id != Some(lifecycle.goal_id) { + return Err("goal_evidence_run_mismatch"); + } + + let mut evidence_kinds = invocation + .evidence + .iter() + .map(|evidence| evidence.kind.trim()) + .filter(|kind| safe_contract_token(kind)) + .collect::>(); + evidence_kinds.sort_unstable(); + evidence_kinds.dedup(); + let source_json = serde_json::to_vec(&ToolEvidenceCanonical { + invocation_id: invocation.id, + tool_id: invocation.tool_id.as_str(), + status: invocation.status, + verification_passed: invocation.verification.passed, + evidence_kinds: evidence_kinds.clone(), + }) + .map_err(|_| "goal_evidence_invalid")?; + let source_fingerprint = domain_hash(COMPLETION_EVIDENCE_DOMAIN, &source_json); + let artifact_ids = frozen + .envelope + .required_artifacts + .iter() + .filter(|artifact| invocation_matches_artifact(invocation, &artifact.artifact_id)) + .map(|artifact| artifact.artifact_id.clone()) + .collect::>(); + let passed = + invocation.status == ToolExecutionStatus::Succeeded && invocation.verification.passed; + let mut receipts = frozen + .envelope + .verifiers + .iter() + .filter(|verifier| evidence_kinds.contains(&verifier.evidence_kind.as_str())) + .map(|verifier| { + let evidence_key = format!( + "{}\0{}\0{}\0{}", + invocation.id, lifecycle.goal_id, frozen.revision, verifier.verifier_id + ); + GoalCompletionEvidenceReceipt { + evidence_id: deterministic_uuid( + COMPLETION_EVIDENCE_DOMAIN, + evidence_key.as_bytes(), + ), + goal_id: lifecycle.goal_id, + revision: frozen.revision.clone(), + frozen_fingerprint: frozen.fingerprint.clone(), + verifier_id: verifier.verifier_id.clone(), + done_when_id: verifier.done_when_id.clone(), + evidence_kind: verifier.evidence_kind.clone(), + artifact_ids: artifact_ids.clone(), + status: if passed { + GoalVerifierEvidenceStatus::Passed + } else { + GoalVerifierEvidenceStatus::Failed + }, + source_fingerprint: source_fingerprint.clone(), + } + }) + .collect::>(); + + if receipts.is_empty() { + let evidence_key = format!( + "{}\0{}\0{}\0unknown", + invocation.id, lifecycle.goal_id, frozen.revision + ); + receipts.push(GoalCompletionEvidenceReceipt { + evidence_id: deterministic_uuid(COMPLETION_EVIDENCE_DOMAIN, evidence_key.as_bytes()), + goal_id: lifecycle.goal_id, + revision: frozen.revision.clone(), + frozen_fingerprint: frozen.fingerprint.clone(), + verifier_id: "unknown".to_string(), + done_when_id: "unknown".to_string(), + evidence_kind: "unknown".to_string(), + artifact_ids, + status: GoalVerifierEvidenceStatus::Unknown, + source_fingerprint, + }); + } + Ok(receipts) +} + +pub(super) fn completion_projection( + lifecycle: &GoalLifecycleProjection, + evidence: &[GoalCompletionEvidenceReceipt], +) -> Result { + let frozen = lifecycle.frozen().ok_or("goal_not_frozen")?; + if evidence.len() > MAX_COMPLETION_EVIDENCE { + return Err("goal_completion_evidence_limit"); + } + let mut failures = BTreeSet::new(); + let mut unique = BTreeMap::::new(); + for receipt in evidence { + if let Some(existing) = unique.get(&receipt.evidence_id) { + if existing != receipt { + failures.insert(GoalCompletionCode::DuplicateEvidence); + } + continue; + } + unique.insert(receipt.evidence_id, receipt.clone()); + } + let mut evidence = unique.into_values().collect::>(); + evidence.sort_by_key(|receipt| receipt.evidence_id); + + let verifier_by_id = frozen + .envelope + .verifiers + .iter() + .map(|verifier| (verifier.verifier_id.as_str(), verifier)) + .collect::>(); + let required_artifact_ids = frozen + .envelope + .required_artifacts + .iter() + .map(|artifact| artifact.artifact_id.as_str()) + .collect::>(); + let mut verifier_counts = BTreeMap::<&str, usize>::new(); + let mut passed_verifiers = BTreeSet::<&str>::new(); + let mut passed_artifacts = BTreeSet::<&str>::new(); + + for receipt in &evidence { + if receipt.goal_id != lifecycle.goal_id { + failures.insert(GoalCompletionCode::EvidenceGoalMismatch); + } + if receipt.revision != frozen.revision { + failures.insert(GoalCompletionCode::EvidenceRevisionMismatch); + } + if receipt.frozen_fingerprint != frozen.fingerprint { + failures.insert(GoalCompletionCode::EvidenceFingerprintMismatch); + } + if !valid_hash(&receipt.source_fingerprint) + || !safe_contract_token(&receipt.verifier_id) + || !safe_contract_token(&receipt.done_when_id) + || !safe_contract_token(&receipt.evidence_kind) + { + failures.insert(GoalCompletionCode::UnknownEvidence); + continue; + } + let Some(verifier) = verifier_by_id.get(receipt.verifier_id.as_str()) else { + failures.insert(GoalCompletionCode::UnknownEvidence); + continue; + }; + if receipt.done_when_id != verifier.done_when_id + || receipt.evidence_kind != verifier.evidence_kind + { + failures.insert(GoalCompletionCode::VerifierBindingMismatch); + continue; + } + *verifier_counts + .entry(receipt.verifier_id.as_str()) + .or_default() += 1; + if verifier_counts[receipt.verifier_id.as_str()] > 1 { + failures.insert(GoalCompletionCode::DuplicateEvidence); + } + if receipt.status != GoalVerifierEvidenceStatus::Passed { + failures.insert(GoalCompletionCode::EvidenceFailed); + continue; + } + passed_verifiers.insert(receipt.verifier_id.as_str()); + for artifact_id in &receipt.artifact_ids { + if !required_artifact_ids.contains(artifact_id.as_str()) { + failures.insert(GoalCompletionCode::ArtifactIdentityMismatch); + } else { + passed_artifacts.insert(artifact_id.as_str()); + } + } + } + + if frozen + .envelope + .verifiers + .iter() + .any(|verifier| !passed_verifiers.contains(verifier.verifier_id.as_str())) + { + failures.insert(GoalCompletionCode::MissingVerifierEvidence); + } + if required_artifact_ids + .iter() + .any(|artifact_id| !passed_artifacts.contains(artifact_id)) + { + failures.insert(GoalCompletionCode::MissingArtifactEvidence); + } + + let failure_codes = failures.into_iter().collect::>(); + let status = if failure_codes.is_empty() { + GoalCompletionStatus::Complete + } else { + GoalCompletionStatus::VerificationBlocked + }; + let completion_receipt = if status == GoalCompletionStatus::Complete { + let mut evidence_fingerprints = evidence + .iter() + .map(|receipt| receipt.source_fingerprint.clone()) + .collect::>(); + evidence_fingerprints.sort(); + evidence_fingerprints.dedup(); + let canonical = CompletionReceiptCanonical { + version: GOAL_COMPLETION_SCHEMA_VERSION, + goal_id: lifecycle.goal_id, + revision: &frozen.revision, + frozen_fingerprint: &frozen.fingerprint, + evidence_fingerprints: &evidence_fingerprints, + }; + let canonical_json = + serde_json::to_vec(&canonical).map_err(|_| "goal_completion_receipt_invalid")?; + Some(GoalCompletionReceipt { + version: GOAL_COMPLETION_SCHEMA_VERSION.to_string(), + goal_id: lifecycle.goal_id, + revision: frozen.revision.clone(), + frozen_fingerprint: frozen.fingerprint.clone(), + evidence_fingerprints, + fingerprint: domain_hash(COMPLETION_RECEIPT_DOMAIN, &canonical_json), + }) + } else { + None + }; + Ok(GoalCompletionProjection { + schema_version: GOAL_COMPLETION_SCHEMA_VERSION.to_string(), + goal_id: lifecycle.goal_id, + revision: frozen.revision.clone(), + frozen_fingerprint: frozen.fingerprint.clone(), + status, + failure_codes, + evidence, + completion_receipt, + }) +} + +impl GoalCompletionProjection { + pub(super) fn validate_against( + &self, + lifecycle: &GoalLifecycleProjection, + ) -> Result<(), &'static str> { + if self.schema_version != GOAL_COMPLETION_SCHEMA_VERSION + || self.goal_id != lifecycle.goal_id + { + return Err("goal_completion_projection_invalid"); + } + let recomputed = completion_projection(lifecycle, &self.evidence)?; + if recomputed != *self { + return Err("goal_completion_projection_invalid"); + } + Ok(()) + } +} + +pub(super) fn completion_event( + projection: &GoalCompletionProjection, +) -> Result { + let completion_fingerprint = projection + .completion_receipt + .as_ref() + .map(|receipt| receipt.fingerprint.as_str()); + let payload = GoalCompletionEventPayload { + schema_version: GOAL_COMPLETION_SCHEMA_VERSION, + goal_id: projection.goal_id, + revision: &projection.revision, + frozen_fingerprint: &projection.frozen_fingerprint, + status: projection.status, + failure_codes: &projection.failure_codes, + completion_fingerprint, + }; + let payload_json = serde_json::to_string(&payload)?; + let evidence_key = projection + .evidence + .iter() + .map(|receipt| receipt.evidence_id.to_string()) + .collect::>() + .join(","); + let event_key = format!( + "{}\0{}\0{}\0{}\0{}\0{}", + projection.goal_id, + projection.revision, + projection.frozen_fingerprint, + projection.status.as_str(), + evidence_key, + completion_fingerprint.unwrap_or_default() + ); + Ok(KernelEvent { + id: deterministic_uuid(COMPLETION_EVENT_ID_DOMAIN, event_key.as_bytes()), + event_type: if projection.status == GoalCompletionStatus::Complete { + COMPLETED_EVENT + } else { + COMPLETION_BLOCKED_EVENT + } + .to_string(), + payload_json, + created_at: Utc::now(), + }) +} + +pub fn goal_ui_projection( + lifecycle: &GoalLifecycleProjection, + completion: Option<&GoalCompletionProjection>, +) -> Result { + if let Some(completion) = completion { + completion.validate_against(lifecycle)?; + } + let (validated, frozen) = match &lifecycle.state { + GoalLifecycleState::Validated { envelope, .. } => (Some(envelope), None), + GoalLifecycleState::Frozen { frozen } => (Some(&frozen.envelope), Some(frozen)), + GoalLifecycleState::ProposalReceived { .. } + | GoalLifecycleState::ValidationBlocked { .. } => (None, None), + }; + let status = match ( + lifecycle.status(), + completion.map(|projection| projection.status), + ) { + (_, Some(GoalCompletionStatus::Complete)) => GoalEnvelopeUiStatus::Complete, + (_, Some(GoalCompletionStatus::VerificationBlocked)) => { + GoalEnvelopeUiStatus::VerificationBlocked + } + (GoalLifecycleStatus::ProposalReceived, None) => GoalEnvelopeUiStatus::Proposed, + (GoalLifecycleStatus::ValidationBlocked, None) => GoalEnvelopeUiStatus::Blocked, + (GoalLifecycleStatus::Validated, None) => GoalEnvelopeUiStatus::Validated, + (GoalLifecycleStatus::Frozen, None) => GoalEnvelopeUiStatus::Frozen, + }; + let reason_codes = if let Some(completion) = completion { + completion + .failure_codes + .iter() + .filter_map(stable_code) + .collect() + } else { + lifecycle + .validation_receipt() + .into_iter() + .flat_map(|receipt| receipt.failure_codes.iter()) + .filter_map(stable_code) + .collect() + }; + Ok(GoalEnvelopeUiProjection { + version: GOAL_UI_PROJECTION_VERSION.to_string(), + goal_id: lifecycle.goal_id, + status, + reason_codes, + revision: lifecycle.revision().map(str::to_string), + fingerprint: frozen + .map(|frozen| frozen.fingerprint.clone()) + .unwrap_or_else(|| lifecycle.proposal_fingerprint().to_string()), + completion_fingerprint: completion + .and_then(|projection| projection.completion_receipt.as_ref()) + .map(|receipt| receipt.fingerprint.clone()), + user_goal_summary: validated.map(|envelope| bounded_summary(&envelope.user_goal, 320)), + done_when_count: validated.map_or(0, |envelope| envelope.done_when.len()), + required_artifact_count: validated.map_or(0, |envelope| envelope.required_artifacts.len()), + verifier_count: validated.map_or(0, |envelope| envelope.verifiers.len()), + }) +} + +fn invocation_matches_artifact(invocation: &ToolInvocationRecord, artifact_id: &str) -> bool { + invocation + .evidence + .iter() + .any(|evidence| evidence.reference.trim() == artifact_id) + || invocation.output.as_ref().is_some_and(|output| { + ["artifact_id", "id"].iter().any(|key| { + output.get(*key).and_then(serde_json::Value::as_str) == Some(artifact_id) + }) + }) +} + +fn safe_contract_token(value: &str) -> bool { + let value = value.trim(); + !value.is_empty() + && value.len() <= 128 + && value + .bytes() + .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'.' | b'_' | b'-')) + && !contains_sensitive_local_reference(value) +} + +fn stable_code(code: &T) -> Option { + serde_json::to_value(code) + .ok()? + .as_str() + .map(str::to_string) +} + +fn bounded_summary(value: &str, max_chars: usize) -> String { + let mut chars = value.chars(); + let mut summary = chars.by_ref().take(max_chars).collect::(); + if chars.next().is_some() { + summary.push_str("..."); + } + summary +} + +fn validate_capability( + contract: &ToolContract, + context: &GoalValidationContext, + failures: &mut BTreeSet, +) { + if !context.enabled_tools.contains(&contract.id) { + failures.insert(GoalValidationCode::CapabilityDisabled); + } else if !context.ready_tools.contains(&contract.id) { + failures.insert(GoalValidationCode::CapabilityNotReady); + } + if risk_rank(contract.risk_level) > risk_rank(context.max_risk) + || contract.risk_level != capability_risk(contract.capability) + { + failures.insert(GoalValidationCode::CapabilityRiskNotAllowed); + } + if contract.constraints.path_scope == ToolPathScope::Workspace + && context.workspace_readiness != WorkspaceReadinessCode::Ready + { + failures.insert(GoalValidationCode::WorkspaceNotReady); + } + let effect = effect_class(contract); + if effect == GoalEffectClass::LocalMutation && !context.allow_local_effects { + failures.insert(GoalValidationCode::LocalEffectNotAllowed); + } + if effect == GoalEffectClass::ExternalMutation && !context.allow_external_effects { + failures.insert(GoalValidationCode::ExternalEffectNotAllowed); + } + if decide(context.access_mode, contract.capability) == PolicyDecision::Ask + && !context.approval_routes.contains(&contract.id) + { + failures.insert(GoalValidationCode::AuthorizationUnavailable); + } +} + +fn capability_validation( + contract: &ToolContract, + context: &GoalValidationContext, +) -> GoalCapabilityValidation { + GoalCapabilityValidation { + tool_id: contract.id.clone(), + capability: capability_contract_name(contract.capability).to_string(), + risk_level: contract.risk_level, + effect_class: effect_class(contract), + authorization: if decide(context.access_mode, contract.capability) == PolicyDecision::Ask { + GoalAuthorizationRequirement::FutureApprovalRequired + } else { + GoalAuthorizationRequirement::None + }, + } +} + +fn capability_contract_name(capability: CapabilityKind) -> &'static str { + match capability { + CapabilityKind::FileRead => "file_read", + CapabilityKind::FileWrite => "file_write", + CapabilityKind::NetworkSearch => "network_search", + CapabilityKind::BrowserBrowse => "browser_browse", + CapabilityKind::BrowserSubmit => "browser_submit", + CapabilityKind::EmailRead => "email_read", + CapabilityKind::EmailDraft => "email_draft", + CapabilityKind::EmailSend => "email_send", + CapabilityKind::ConnectorAttachmentRead => "connector_attachment_read", + CapabilityKind::ConnectorWrite => "connector_write", + CapabilityKind::DriveRead => "drive_read", + CapabilityKind::DriveWrite => "drive_write", + CapabilityKind::TerminalRead => "terminal_read", + CapabilityKind::TerminalWrite => "terminal_write", + CapabilityKind::ComputerScreenshot => "computer_screenshot", + CapabilityKind::ComputerControl => "computer_control", + CapabilityKind::AppUpdateCheck => "app_update_check", + CapabilityKind::AppUpdateDownload => "app_update_download", + CapabilityKind::AppUpdateInstall => "app_update_install", + CapabilityKind::SkillUse => "skill_use", + } +} + +fn effect_class(contract: &ToolContract) -> GoalEffectClass { + if contract.id == CONNECTOR_MUTATE_TOOL_ID { + GoalEffectClass::ExternalMutation + } else if contract.constraints.mutates_machine_state { + GoalEffectClass::LocalMutation + } else { + GoalEffectClass::ReadOnly + } +} + +fn normalized_envelope( + proposal: &GoalEnvelopeProposal, + bound_targets: Vec, + validated_capabilities: Vec, +) -> ValidatedGoalEnvelope { + let mut assumptions = proposal.assumptions.clone(); + assumptions.sort(); + let mut constraints = proposal.constraints.clone(); + constraints.sort(); + let mut done_when = proposal.done_when.clone(); + done_when.sort_by(|left, right| left.done_when_id.cmp(&right.done_when_id)); + let mut required_artifacts = proposal.required_artifacts.clone(); + required_artifacts.sort_by(|left, right| left.artifact_id.cmp(&right.artifact_id)); + let mut verifiers = proposal.verifiers.clone(); + verifiers.sort_by(|left, right| left.verifier_id.cmp(&right.verifier_id)); + let mut stop_conditions = proposal.stop_conditions.clone(); + stop_conditions.sort(); + ValidatedGoalEnvelope { + version: GOAL_FROZEN_ENVELOPE_VERSION.to_string(), + user_goal: proposal.user_goal.clone(), + assumptions, + constraints, + done_when, + required_artifacts, + verifiers, + validated_capabilities, + bound_targets, + stop_conditions, + } +} + +fn proposal_fingerprint(proposal: &GoalEnvelopeProposal) -> String { + let mut canonical = proposal.clone(); + canonical.assumptions.sort(); + canonical.constraints.sort(); + canonical + .done_when + .sort_by(|left, right| left.done_when_id.cmp(&right.done_when_id)); + canonical + .required_artifacts + .sort_by(|left, right| left.artifact_id.cmp(&right.artifact_id)); + canonical + .verifiers + .sort_by(|left, right| left.verifier_id.cmp(&right.verifier_id)); + canonical.proposed_capabilities.sort(); + canonical + .external_targets + .sort_by(|left, right| left.target_id.cmp(&right.target_id)); + canonical.stop_conditions.sort(); + let bytes = serde_json::to_vec(&canonical).unwrap_or_default(); + domain_hash(PROPOSAL_FINGERPRINT_DOMAIN, &bytes) +} + +fn context_fingerprint(context: &GoalValidationContext) -> String { + let mut target_bindings = context + .target_bindings + .values() + .map(|binding| BoundGoalTarget { + target_id: binding.target_id.clone(), + binding_kind: binding.binding_kind, + authority_fingerprint: binding.authority_fingerprint.clone(), + }) + .collect::>(); + target_bindings.sort_by(|left, right| left.target_id.cmp(&right.target_id)); + let canonical = ContextCanonical { + access_mode: context.access_mode, + workspace_readiness: context.workspace_readiness, + max_risk: context.max_risk, + enabled_tools: &context.enabled_tools, + ready_tools: &context.ready_tools, + approval_routes: &context.approval_routes, + verifier_kinds: &context.verifier_kinds, + target_bindings, + allow_local_effects: context.allow_local_effects, + allow_external_effects: context.allow_external_effects, + }; + domain_hash( + CONTEXT_FINGERPRINT_DOMAIN, + &serde_json::to_vec(&canonical).unwrap_or_default(), + ) +} + +fn revision_for( + proposal_fingerprint: &str, + envelope: &ValidatedGoalEnvelope, + validation_receipt: &GoalValidationReceipt, +) -> String { + let canonical = RevisionCanonical { + version: GOAL_FROZEN_ENVELOPE_VERSION, + proposal_fingerprint, + envelope, + validation_receipt, + }; + domain_hash( + REVISION_DOMAIN, + &serde_json::to_vec(&canonical).unwrap_or_default(), + ) +} + +fn frozen_fingerprint(frozen: &GoalFrozenEnvelope) -> String { + domain_hash( + FROZEN_FINGERPRINT_DOMAIN, + frozen.canonical_json().unwrap_or_default().as_bytes(), + ) +} + +fn domain_hash(domain: &[u8], value: &[u8]) -> String { + let mut digest = Sha256::new(); + digest.update(domain); + digest.update((value.len() as u64).to_be_bytes()); + digest.update(value); + format!("{:x}", digest.finalize()) +} + +fn deterministic_uuid(domain: &[u8], value: &[u8]) -> Uuid { + let digest = Sha256::digest([domain, value].concat()); + let mut bytes = [0_u8; 16]; + bytes.copy_from_slice(&digest[..16]); + bytes[6] = (bytes[6] & 0x0f) | 0x50; + bytes[8] = (bytes[8] & 0x3f) | 0x80; + Uuid::from_bytes(bytes) +} + +fn valid_hash(value: &str) -> bool { + value.len() == 64 + && value + .bytes() + .all(|byte| byte.is_ascii_digit() || matches!(byte, b'a'..=b'f')) +} + +fn risk_rank(risk: RiskLevel) -> u8 { + match risk { + RiskLevel::Low => 0, + RiskLevel::Medium => 1, + RiskLevel::High => 2, + RiskLevel::Critical => 3, + } +} + +fn proposal_contains_sensitive_local_reference(proposal: &GoalEnvelopeProposal) -> bool { + std::iter::once(proposal.user_goal.as_str()) + .chain(proposal.assumptions.iter().map(String::as_str)) + .chain(proposal.constraints.iter().map(String::as_str)) + .chain( + proposal + .done_when + .iter() + .flat_map(|value| [value.done_when_id.as_str(), value.description.as_str()]), + ) + .chain( + proposal + .required_artifacts + .iter() + .flat_map(|value| [value.artifact_id.as_str(), value.description.as_str()]), + ) + .chain(proposal.verifiers.iter().flat_map(|value| { + [ + value.verifier_id.as_str(), + value.done_when_id.as_str(), + value.description.as_str(), + value.evidence_kind.as_str(), + ] + })) + .chain(proposal.proposed_capabilities.iter().map(String::as_str)) + .chain( + proposal + .external_targets + .iter() + .flat_map(|value| [value.target_id.as_str(), value.description.as_str()]), + ) + .chain(proposal.stop_conditions.iter().map(String::as_str)) + .any(contains_sensitive_local_reference) +} + +fn contains_sensitive_local_reference(value: &str) -> bool { + let lower = value.to_ascii_lowercase(); + let bytes = lower.as_bytes(); + let has_windows_absolute = bytes.windows(3).any(|window| { + window[0].is_ascii_alphabetic() && window[1] == b':' && matches!(window[2], b'\\' | b'/') + }); + has_windows_absolute + || lower.contains("\\appdata\\") + || lower.contains("/appdata/") + || lower.contains("/users/") + || lower.contains("/home/") + || lower.contains("vault://") + || lower.contains("provider_body") + || lower.contains("provider-body") + || lower.contains("claim_token") + || lower.contains("claim-token") +} + +fn receipt_is_secret_free(receipt: &GoalValidationReceipt) -> bool { + receipt.version == GOAL_LIFECYCLE_SCHEMA_VERSION + && valid_hash(&receipt.proposal_fingerprint) + && valid_hash(&receipt.context_fingerprint) + && receipt + .failure_codes + .windows(2) + .all(|pair| pair[0] < pair[1]) + && receipt + .capabilities + .windows(2) + .all(|pair| pair[0].tool_id < pair[1].tool_id) + && receipt + .target_bindings + .windows(2) + .all(|pair| pair[0].target_id < pair[1].target_id) + && receipt + .verifier_kinds + .windows(2) + .all(|pair| pair[0] < pair[1]) + && receipt.target_bindings.iter().all(|binding| { + valid_hash(&binding.authority_fingerprint) + && stored_value_is_secret_free(&binding.target_id) + }) + && receipt.capabilities.iter().all(|capability| { + stored_value_is_secret_free(&capability.tool_id) + && stored_value_is_secret_free(&capability.capability) + }) + && receipt + .verifier_kinds + .iter() + .all(|kind| stored_value_is_secret_free(kind)) +} + +fn validated_envelope_is_secret_free( + envelope: &ValidatedGoalEnvelope, + receipt: &GoalValidationReceipt, +) -> bool { + if envelope.version != GOAL_FROZEN_ENVELOPE_VERSION + || envelope.validated_capabilities != receipt.capabilities + || envelope.bound_targets != receipt.target_bindings + || serde_json::to_vec(envelope) + .map(|encoded| encoded.len() > MAX_PERSISTED_ENVELOPE_BYTES) + .unwrap_or(true) + || !envelope + .assumptions + .windows(2) + .all(|pair| pair[0] < pair[1]) + || !envelope + .constraints + .windows(2) + .all(|pair| pair[0] < pair[1]) + || !envelope + .done_when + .windows(2) + .all(|pair| pair[0].done_when_id < pair[1].done_when_id) + || !envelope + .required_artifacts + .windows(2) + .all(|pair| pair[0].artifact_id < pair[1].artifact_id) + || !envelope + .verifiers + .windows(2) + .all(|pair| pair[0].verifier_id < pair[1].verifier_id) + || !envelope + .stop_conditions + .windows(2) + .all(|pair| pair[0] < pair[1]) + { + return false; + } + + let verifier_kinds = envelope + .verifiers + .iter() + .map(|verifier| verifier.evidence_kind.as_str()) + .collect::>(); + if !verifier_kinds + .iter() + .copied() + .eq(receipt.verifier_kinds.iter().map(String::as_str)) + { + return false; + } + + std::iter::once(envelope.user_goal.as_str()) + .chain(envelope.assumptions.iter().map(String::as_str)) + .chain(envelope.constraints.iter().map(String::as_str)) + .chain( + envelope + .done_when + .iter() + .flat_map(|value| [value.done_when_id.as_str(), value.description.as_str()]), + ) + .chain( + envelope + .required_artifacts + .iter() + .flat_map(|value| [value.artifact_id.as_str(), value.description.as_str()]), + ) + .chain(envelope.verifiers.iter().flat_map(|value| { + [ + value.verifier_id.as_str(), + value.done_when_id.as_str(), + value.description.as_str(), + value.evidence_kind.as_str(), + ] + })) + .chain(envelope.stop_conditions.iter().map(String::as_str)) + .all(stored_value_is_secret_free) +} + +fn stored_value_is_secret_free(value: &str) -> bool { + !contains_sensitive_local_reference(value) && !contains_secret_like_content(value) +} + +fn contains_secret_like_content(value: &str) -> bool { + let lower = value.to_ascii_lowercase(); + contains_token_after(&lower, "bearer ", 12) + || contains_token_after(&lower, "api_key=", 12) + || contains_token_after(&lower, "api_key:", 12) + || contains_token_after(&lower, "api-key=", 12) + || contains_token_after(&lower, "api-key:", 12) + || contains_token_after(&lower, "apikey=", 12) + || contains_token_after(&lower, "apikey:", 12) + || contains_token_after(&lower, "password=", 12) + || contains_token_after(&lower, "password:", 12) + || contains_token_after(&lower, "secret=", 12) + || contains_token_after(&lower, "secret:", 12) + || contains_token_after(&lower, "token=", 12) + || contains_token_after(&lower, "token:", 12) + || lower.match_indices("sk-").any(|(index, _)| { + lower[index + 3..] + .bytes() + .take_while(|byte| byte.is_ascii_alphanumeric() || matches!(*byte, b'_' | b'-')) + .count() + >= 12 + }) +} + +fn contains_token_after(value: &str, marker: &str, minimum_length: usize) -> bool { + value.match_indices(marker).any(|(index, _)| { + value[index + marker.len()..] + .trim_start_matches([' ', '\'', '"']) + .bytes() + .take_while(|byte| byte.is_ascii_alphanumeric() || matches!(*byte, b'_' | b'-' | b'.')) + .count() + >= minimum_length + }) +} + +#[cfg(test)] +mod tests { + use std::fs; + + use rusqlite::Connection; + use serde_json::json; + use tempfile::tempdir; + + use super::*; + use crate::kernel::event_store::EventStore; + use crate::kernel::goal_envelope::GOAL_ENVELOPE_PROPOSAL_VERSION; + use crate::kernel::tool_runtime::{ + ToolEvidence, ToolVerificationResult, CONNECTOR_MUTATE_TOOL_ID, FILE_READ_TOOL_ID, + }; + + fn valid_proposal() -> GoalEnvelopeProposal { + GoalEnvelopeProposal::parse_value(json!({ + "version": GOAL_ENVELOPE_PROPOSAL_VERSION, + "user_goal": "Create a verified monthly operating brief.", + "assumptions": ["The supplied source set is complete."], + "constraints": ["Keep proposed outputs inside the selected workspace."], + "done_when": [{ + "done_when_id": "brief-ready", + "description": "The proposed operating brief is complete." + }], + "required_artifacts": [{ + "artifact_id": "operating-brief", + "description": "A proposed operating brief." + }], + "verifiers": [{ + "verifier_id": "brief-verifier-v1", + "done_when_id": "brief-ready", + "description": "Verify the rendered brief has no overflow.", + "evidence_kind": "rendered-brief" + }], + "proposed_capabilities": [FILE_READ_TOOL_ID], + "external_targets": [{ + "target_id": "selected-workspace", + "description": "The workspace proposed by the model; bind it locally." + }], + "stop_conditions": ["Stop if a required source is missing."] + })) + .expect("valid proposal") + } + + fn valid_context() -> GoalValidationContext { + GoalValidationContext::new(AccessMode::FullAccess, WorkspaceReadinessCode::Ready) + .with_enabled_tool(FILE_READ_TOOL_ID, true) + .with_verifier_kind("rendered-brief") + .with_target_binding( + "selected-workspace", + GoalTargetBindingKind::Workspace, + br"C:\private\workspace", + ) + } + + fn failure_codes(projection: &GoalLifecycleProjection) -> &[GoalValidationCode] { + &projection + .validation_receipt() + .expect("validation receipt") + .failure_codes + } + + fn frozen_goal(store: &EventStore, goal_id: Uuid) -> GoalLifecycleProjection { + let validated = store + .submit_goal_proposal(goal_id, &valid_proposal(), &valid_context()) + .unwrap(); + store + .freeze_goal_envelope(goal_id, validated.revision().unwrap()) + .unwrap() + } + + fn verifier_invocation( + goal_id: Uuid, + invocation_id: Uuid, + status: ToolExecutionStatus, + passed: bool, + evidence_kind: &str, + artifact_id: &str, + ) -> ToolInvocationRecord { + ToolInvocationRecord { + id: invocation_id, + run_id: Some(goal_id), + tool_id: FILE_READ_TOOL_ID.to_string(), + tool_version: "1".to_string(), + capability: CapabilityKind::FileRead, + status, + policy_decision: PolicyDecision::Allow, + approval_request_id: None, + input_summary: "bounded local verifier input".to_string(), + request_fingerprint: "1".repeat(64), + output: Some(json!({"artifact_id": artifact_id})), + evidence: vec![ToolEvidence { + kind: evidence_kind.to_string(), + reference: artifact_id.to_string(), + summary: "bounded local verifier evidence".to_string(), + }], + verification: ToolVerificationResult { + passed, + summary: "local verifier result".to_string(), + checked_at: Utc::now(), + }, + error: (!passed).then(|| "safe verifier failure".to_string()), + recovery_hint: "retry local verification".to_string(), + elapsed_ms: 1, + created_at: Utc::now(), + finished_at: Some(Utc::now()), + } + } + + #[test] + fn valid_proposal_is_validated_frozen_and_restart_safe() { + let directory = tempdir().unwrap(); + let database = directory.path().join("kernel.sqlite3"); + let goal_id = Uuid::from_u128(1); + let revision; + let fingerprint; + { + let store = EventStore::open(&database).unwrap(); + let validated = store + .submit_goal_proposal(goal_id, &valid_proposal(), &valid_context()) + .unwrap(); + assert_eq!(validated.status(), GoalLifecycleStatus::Validated); + revision = validated.revision().unwrap().to_string(); + let frozen = store.freeze_goal_envelope(goal_id, &revision).unwrap(); + assert_eq!(frozen.status(), GoalLifecycleStatus::Frozen); + fingerprint = frozen.frozen().unwrap().fingerprint.clone(); + assert!(valid_hash(&fingerprint)); + let persisted = serde_json::to_string(&frozen).unwrap(); + assert!(!persisted.contains("proposed by the model")); + assert!(!persisted.contains(r"C:\private\workspace")); + } + let reopened = EventStore::open(&database).unwrap(); + let readback = reopened.goal_envelope_projection(goal_id).unwrap().unwrap(); + assert_eq!(readback.status(), GoalLifecycleStatus::Frozen); + assert_eq!(readback.revision(), Some(revision.as_str())); + assert_eq!(readback.frozen().unwrap().fingerprint, fingerprint); + } + + #[test] + fn unknown_disabled_and_not_ready_capabilities_fail_closed() { + let store = EventStore::open_memory().unwrap(); + let mut unknown = valid_proposal(); + unknown.proposed_capabilities = vec!["future.unknown".to_string()]; + let blocked = store + .submit_goal_proposal(Uuid::from_u128(2), &unknown, &valid_context()) + .unwrap(); + assert!(failure_codes(&blocked).contains(&GoalValidationCode::UnknownCapability)); + + let disabled_context = + GoalValidationContext::new(AccessMode::FullAccess, WorkspaceReadinessCode::Ready) + .with_verifier_kind("rendered-brief") + .with_target_binding( + "selected-workspace", + GoalTargetBindingKind::Workspace, + b"workspace-authority", + ); + let disabled = store + .submit_goal_proposal(Uuid::from_u128(3), &valid_proposal(), &disabled_context) + .unwrap(); + assert!(failure_codes(&disabled).contains(&GoalValidationCode::CapabilityDisabled)); + + let not_ready = valid_context().with_enabled_tool(FILE_READ_TOOL_ID, false); + let blocked = store + .submit_goal_proposal(Uuid::from_u128(4), &valid_proposal(), ¬_ready) + .unwrap(); + assert!(failure_codes(&blocked).contains(&GoalValidationCode::CapabilityNotReady)); + } + + #[test] + fn risk_authorization_and_external_effect_policy_fail_closed() { + let store = EventStore::open_memory().unwrap(); + let mut proposal = valid_proposal(); + proposal.proposed_capabilities = vec![CONNECTOR_MUTATE_TOOL_ID.to_string()]; + proposal.external_targets[0].target_id = "connected-account".to_string(); + let context = + GoalValidationContext::new(AccessMode::AskEveryStep, WorkspaceReadinessCode::Ready) + .with_enabled_tool(CONNECTOR_MUTATE_TOOL_ID, true) + .with_verifier_kind("rendered-brief") + .with_target_binding( + "connected-account", + GoalTargetBindingKind::Account, + b"local-account-authority", + ); + let blocked = store + .submit_goal_proposal(Uuid::from_u128(5), &proposal, &context) + .unwrap(); + let codes = failure_codes(&blocked); + assert!(codes.contains(&GoalValidationCode::CapabilityRiskNotAllowed)); + assert!(codes.contains(&GoalValidationCode::AuthorizationUnavailable)); + assert!(codes.contains(&GoalValidationCode::ExternalEffectNotAllowed)); + } + + #[test] + fn explicit_policy_routes_validate_without_granting_execution_authority() { + let store = EventStore::open_memory().unwrap(); + let mut proposal = valid_proposal(); + proposal.proposed_capabilities = vec![CONNECTOR_MUTATE_TOOL_ID.to_string()]; + proposal.external_targets[0].target_id = "connected-account".to_string(); + let context = + GoalValidationContext::new(AccessMode::AskEveryStep, WorkspaceReadinessCode::Ready) + .with_max_risk(RiskLevel::Critical) + .with_enabled_tool(CONNECTOR_MUTATE_TOOL_ID, true) + .with_approval_route(CONNECTOR_MUTATE_TOOL_ID) + .with_verifier_kind("rendered-brief") + .with_target_binding( + "connected-account", + GoalTargetBindingKind::Account, + b"local-account-authority", + ) + .allowing_local_effects() + .allowing_external_effects(); + let validated = store + .submit_goal_proposal(Uuid::from_u128(12), &proposal, &context) + .unwrap(); + assert_eq!(validated.status(), GoalLifecycleStatus::Validated); + let receipt = validated.validation_receipt().unwrap(); + assert_eq!( + receipt.capabilities[0].authorization, + GoalAuthorizationRequirement::FutureApprovalRequired + ); + let serialized = serde_json::to_string(&validated).unwrap(); + for forbidden in ["approval_granted", "execution_authority", "claim_token"] { + assert!(!serialized.contains(forbidden)); + } + } + + #[test] + fn target_and_verifier_must_bind_to_local_authority() { + let store = EventStore::open_memory().unwrap(); + let context = + GoalValidationContext::new(AccessMode::FullAccess, WorkspaceReadinessCode::Ready) + .with_enabled_tool(FILE_READ_TOOL_ID, true); + let blocked = store + .submit_goal_proposal(Uuid::from_u128(6), &valid_proposal(), &context) + .unwrap(); + assert!(failure_codes(&blocked).contains(&GoalValidationCode::TargetUnbound)); + assert!(failure_codes(&blocked).contains(&GoalValidationCode::VerifierUnavailable)); + let error = store + .freeze_goal_envelope(Uuid::from_u128(6), "0".repeat(64).as_str()) + .expect_err("blocked validation cannot freeze"); + assert!(matches!( + error, + crate::kernel::event_store::EventStoreError::InvalidState(code) + if code == "goal_not_validated" + )); + } + + #[test] + fn secret_unknown_authority_and_absolute_paths_never_enter_persistence() { + let store = EventStore::open_memory().unwrap(); + let unknown = json!({ + "version": GOAL_ENVELOPE_PROPOSAL_VERSION, + "user_goal": "Write a brief.", + "assumptions": [], "constraints": [], + "done_when": [{"done_when_id":"done","description":"Done."}], + "required_artifacts": [], + "verifiers": [{"verifier_id":"v","done_when_id":"done","description":"Verify.","evidence_kind":"rendered-brief"}], + "proposed_capabilities": [], "external_targets": [], "stop_conditions": [], + "validated": true + }); + assert!(GoalEnvelopeProposal::parse_value(unknown).is_err()); + assert!(store.list_recent(10).unwrap().is_empty()); + + let mut secret = valid_proposal(); + secret.user_goal = format!("Use sk-{}.", "a".repeat(20)); + assert!(store + .submit_goal_proposal(Uuid::from_u128(7), &secret, &valid_context()) + .is_err()); + assert!(store.list_recent(10).unwrap().is_empty()); + + let mut path = valid_proposal(); + path.user_goal = r"Read C:\Users\owner\AppData\Local\provider-body.json.".to_string(); + let blocked = store + .submit_goal_proposal(Uuid::from_u128(8), &path, &valid_context()) + .unwrap(); + assert!(failure_codes(&blocked).contains(&GoalValidationCode::SensitiveLocalReference)); + let serialized = serde_json::to_string(&blocked).unwrap(); + let events = serde_json::to_string(&store.list_recent(10).unwrap()).unwrap(); + for forbidden in ["AppData", "provider-body.json", "owner"] { + assert!(!serialized.contains(forbidden)); + assert!(!events.contains(forbidden)); + } + } + + #[test] + fn revision_and_fingerprint_are_deterministic_and_mutation_invalidates_freeze() { + let store = EventStore::open_memory().unwrap(); + let goal_id = Uuid::from_u128(9); + let first = store + .submit_goal_proposal(goal_id, &valid_proposal(), &valid_context()) + .unwrap(); + let first_revision = first.revision().unwrap().to_string(); + let first_frozen = store + .freeze_goal_envelope(goal_id, &first_revision) + .unwrap(); + let first_fingerprint = first_frozen.frozen().unwrap().fingerprint.clone(); + + let repeat = store + .submit_goal_proposal(goal_id, &valid_proposal(), &valid_context()) + .unwrap(); + assert_eq!(repeat.revision(), Some(first_revision.as_str())); + assert_eq!( + store + .freeze_goal_envelope(goal_id, &first_revision) + .unwrap() + .frozen() + .unwrap() + .fingerprint, + first_fingerprint + ); + + let mut changed = valid_proposal(); + changed + .constraints + .push("Use only reviewed sources.".to_string()); + let next = store + .submit_goal_proposal(goal_id, &changed, &valid_context()) + .unwrap(); + let next_revision = next.revision().unwrap().to_string(); + assert_ne!(next_revision, first_revision); + assert!(store + .freeze_goal_envelope(goal_id, &first_revision) + .is_err()); + let next_frozen = store.freeze_goal_envelope(goal_id, &next_revision).unwrap(); + assert_ne!(next_frozen.frozen().unwrap().fingerprint, first_fingerprint); + } + + #[test] + fn duplicate_transitions_are_idempotent_and_events_are_bounded() { + let store = EventStore::open_memory().unwrap(); + let goal_id = Uuid::from_u128(10); + let first = store + .submit_goal_proposal(goal_id, &valid_proposal(), &valid_context()) + .unwrap(); + let second = store + .submit_goal_proposal(goal_id, &valid_proposal(), &valid_context()) + .unwrap(); + assert_eq!(first, second); + let revision = first.revision().unwrap(); + let frozen_a = store.freeze_goal_envelope(goal_id, revision).unwrap(); + let frozen_b = store.freeze_goal_envelope(goal_id, revision).unwrap(); + assert_eq!(frozen_a, frozen_b); + let events = store.list_recent(20).unwrap(); + assert_eq!(events.len(), 3); + assert!(events.iter().all(|event| event.payload_json.len() < 1024)); + } + + #[test] + fn persisted_projection_rejects_rehashed_secret_paths_and_forged_versions() { + let mut projection = + validated_projection(Uuid::from_u128(13), &valid_proposal(), &valid_context()).unwrap(); + let GoalLifecycleState::Validated { + proposal_fingerprint, + revision, + envelope, + validation_receipt, + } = &mut projection.state + else { + panic!("proposal should validate"); + }; + + envelope.user_goal = r"Read C:\Users\owner\AppData\Local\provider-body.json.".to_string(); + *revision = revision_for(proposal_fingerprint, envelope, validation_receipt); + assert_eq!( + projection.validate_persisted(), + Err("goal_projection_invalid") + ); + + let mut projection = + validated_projection(Uuid::from_u128(14), &valid_proposal(), &valid_context()).unwrap(); + let GoalLifecycleState::Validated { + proposal_fingerprint, + revision, + envelope, + validation_receipt, + } = &mut projection.state + else { + panic!("proposal should validate"); + }; + validation_receipt.version = "ds-agent.goal-envelope-lifecycle/v2".to_string(); + *revision = revision_for(proposal_fingerprint, envelope, validation_receipt); + assert_eq!( + projection.validate_persisted(), + Err("goal_projection_invalid") + ); + + let mut projection = + validated_projection(Uuid::from_u128(15), &valid_proposal(), &valid_context()).unwrap(); + let GoalLifecycleState::Validated { + proposal_fingerprint, + revision, + envelope, + validation_receipt, + } = &mut projection.state + else { + panic!("proposal should validate"); + }; + envelope.user_goal = format!("Use sk-{}.", "a".repeat(20)); + *revision = revision_for(proposal_fingerprint, envelope, validation_receipt); + assert_eq!( + projection.validate_persisted(), + Err("goal_projection_invalid") + ); + } + + #[test] + fn exact_authoritative_evidence_completes_and_ui_projection_is_secret_free() { + let directory = tempdir().unwrap(); + let database = directory.path().join("completion.sqlite3"); + let goal_id = Uuid::from_u128(101); + let invocation = verifier_invocation( + goal_id, + Uuid::from_u128(201), + ToolExecutionStatus::Succeeded, + true, + "rendered-brief", + "operating-brief", + ); + let completed; + { + let store = EventStore::open(&database).unwrap(); + frozen_goal(&store, goal_id); + completed = store + .record_goal_completion_for_tool_invocation(&invocation) + .unwrap() + .unwrap(); + assert_eq!(completed.status, GoalCompletionStatus::Complete); + assert!(completed.failure_codes.is_empty()); + assert!(valid_hash( + &completed.completion_receipt.as_ref().unwrap().fingerprint + )); + let ui = store.goal_envelope_ui_projection(goal_id).unwrap().unwrap(); + assert_eq!(ui.status, GoalEnvelopeUiStatus::Complete); + assert_eq!(ui.required_artifact_count, 1); + let serialized = serde_json::to_string(&ui).unwrap(); + for forbidden in [ + "authority_fingerprint", + "context_fingerprint", + "target_bindings", + "provider_body", + "claim_token", + "AppData", + ] { + assert!(!serialized.contains(forbidden)); + } + } + + let reopened = EventStore::open(&database).unwrap(); + assert_eq!( + reopened + .goal_completion_projection(goal_id) + .unwrap() + .unwrap(), + completed + ); + assert_eq!( + reopened + .record_goal_completion_for_tool_invocation(&invocation) + .unwrap() + .unwrap(), + completed + ); + let completed_events = reopened + .list_recent(20) + .unwrap() + .into_iter() + .filter(|event| event.event_type == COMPLETED_EVENT) + .collect::>(); + assert_eq!(completed_events.len(), 1); + assert!(completed_events[0].payload_json.len() < 1024); + } + + #[test] + fn ui_projection_distinguishes_proposed_blocked_validated_frozen_and_verification_states() { + let goal_id = Uuid::from_u128(104); + let proposal = valid_proposal(); + let proposed = proposal_received_projection(goal_id, &proposal).unwrap(); + assert_eq!( + goal_ui_projection(&proposed, None).unwrap().status, + GoalEnvelopeUiStatus::Proposed + ); + + let blocked_context = GoalValidationContext::new( + AccessMode::FullAccess, + WorkspaceReadinessCode::WorkspaceMissing, + ); + let blocked = validated_projection(goal_id, &proposal, &blocked_context).unwrap(); + let blocked_ui = goal_ui_projection(&blocked, None).unwrap(); + assert_eq!(blocked_ui.status, GoalEnvelopeUiStatus::Blocked); + assert!(!blocked_ui.reason_codes.is_empty()); + + let validated = validated_projection(goal_id, &proposal, &valid_context()).unwrap(); + assert_eq!( + goal_ui_projection(&validated, None).unwrap().status, + GoalEnvelopeUiStatus::Validated + ); + let frozen = frozen_projection(&validated, validated.revision().unwrap()).unwrap(); + assert_eq!( + goal_ui_projection(&frozen, None).unwrap().status, + GoalEnvelopeUiStatus::Frozen + ); + + let failed_invocation = verifier_invocation( + goal_id, + Uuid::from_u128(206), + ToolExecutionStatus::Failed, + false, + "rendered-brief", + "operating-brief", + ); + let failed_evidence = + completion_evidence_from_tool_invocation(&frozen, &failed_invocation).unwrap(); + let verification_blocked = completion_projection(&frozen, &failed_evidence).unwrap(); + assert_eq!( + goal_ui_projection(&frozen, Some(&verification_blocked)) + .unwrap() + .status, + GoalEnvelopeUiStatus::VerificationBlocked + ); + + let passed_invocation = verifier_invocation( + goal_id, + Uuid::from_u128(207), + ToolExecutionStatus::Succeeded, + true, + "rendered-brief", + "operating-brief", + ); + let passed_evidence = + completion_evidence_from_tool_invocation(&frozen, &passed_invocation).unwrap(); + let complete = completion_projection(&frozen, &passed_evidence).unwrap(); + assert_eq!( + goal_ui_projection(&frozen, Some(&complete)).unwrap().status, + GoalEnvelopeUiStatus::Complete + ); + } + + #[test] + fn missing_failed_stale_unknown_duplicate_and_artifact_mismatch_fail_closed() { + let store = EventStore::open_memory().unwrap(); + let goal_id = Uuid::from_u128(102); + let frozen = frozen_goal(&store, goal_id); + + let missing = completion_projection(&frozen, &[]).unwrap(); + assert_eq!(missing.status, GoalCompletionStatus::VerificationBlocked); + assert!(missing + .failure_codes + .contains(&GoalCompletionCode::MissingVerifierEvidence)); + assert!(missing + .failure_codes + .contains(&GoalCompletionCode::MissingArtifactEvidence)); + + let failed_invocation = verifier_invocation( + goal_id, + Uuid::from_u128(202), + ToolExecutionStatus::Failed, + false, + "rendered-brief", + "operating-brief", + ); + let failed_evidence = + completion_evidence_from_tool_invocation(&frozen, &failed_invocation).unwrap(); + let failed = completion_projection(&frozen, &failed_evidence).unwrap(); + assert!(failed + .failure_codes + .contains(&GoalCompletionCode::EvidenceFailed)); + + let passed_invocation = verifier_invocation( + goal_id, + Uuid::from_u128(203), + ToolExecutionStatus::Succeeded, + true, + "rendered-brief", + "operating-brief", + ); + let exact = completion_evidence_from_tool_invocation(&frozen, &passed_invocation) + .unwrap() + .remove(0); + + let mut wrong_goal = exact.clone(); + wrong_goal.goal_id = Uuid::from_u128(999); + assert!(completion_projection(&frozen, &[wrong_goal]) + .unwrap() + .failure_codes + .contains(&GoalCompletionCode::EvidenceGoalMismatch)); + + let mut wrong_revision = exact.clone(); + wrong_revision.revision = "2".repeat(64); + assert!(completion_projection(&frozen, &[wrong_revision]) + .unwrap() + .failure_codes + .contains(&GoalCompletionCode::EvidenceRevisionMismatch)); + + let mut wrong_fingerprint = exact.clone(); + wrong_fingerprint.frozen_fingerprint = "3".repeat(64); + assert!(completion_projection(&frozen, &[wrong_fingerprint]) + .unwrap() + .failure_codes + .contains(&GoalCompletionCode::EvidenceFingerprintMismatch)); + + let mut unknown = exact.clone(); + unknown.verifier_id = "unknown-verifier".to_string(); + assert!(completion_projection(&frozen, &[unknown]) + .unwrap() + .failure_codes + .contains(&GoalCompletionCode::UnknownEvidence)); + + let mut duplicate = exact.clone(); + duplicate.evidence_id = Uuid::from_u128(204); + assert!(completion_projection(&frozen, &[exact.clone(), duplicate]) + .unwrap() + .failure_codes + .contains(&GoalCompletionCode::DuplicateEvidence)); + + let mut wrong_artifact = exact; + wrong_artifact.artifact_ids = vec!["different-artifact".to_string()]; + let artifact_mismatch = completion_projection(&frozen, &[wrong_artifact]).unwrap(); + assert!(artifact_mismatch + .failure_codes + .contains(&GoalCompletionCode::ArtifactIdentityMismatch)); + assert!(artifact_mismatch + .failure_codes + .contains(&GoalCompletionCode::MissingArtifactEvidence)); + } + + #[test] + fn frozen_revision_change_invalidates_old_completion_without_claiming_legacy_complete() { + let store = EventStore::open_memory().unwrap(); + let goal_id = Uuid::from_u128(103); + frozen_goal(&store, goal_id); + let invocation = verifier_invocation( + goal_id, + Uuid::from_u128(205), + ToolExecutionStatus::Succeeded, + true, + "rendered-brief", + "operating-brief", + ); + assert_eq!( + store + .record_goal_completion_for_tool_invocation(&invocation) + .unwrap() + .unwrap() + .status, + GoalCompletionStatus::Complete + ); + + let mut changed = valid_proposal(); + changed + .constraints + .push("Use only locally reviewed sources.".to_string()); + let validated = store + .submit_goal_proposal(goal_id, &changed, &valid_context()) + .unwrap(); + store + .freeze_goal_envelope(goal_id, validated.revision().unwrap()) + .unwrap(); + assert!(store.goal_completion_projection(goal_id).unwrap().is_none()); + let ui = store.goal_envelope_ui_projection(goal_id).unwrap().unwrap(); + assert_eq!(ui.status, GoalEnvelopeUiStatus::Frozen); + assert!(ui.completion_fingerprint.is_none()); + } + + #[test] + fn legacy_database_defaults_to_no_goal_and_cannot_forge_completion_authority() { + let directory = tempdir().unwrap(); + let database = directory.path().join("legacy.sqlite3"); + { + let connection = Connection::open(&database).unwrap(); + connection + .execute_batch( + "CREATE TABLE kernel_events (id TEXT PRIMARY KEY NOT NULL, event_type TEXT NOT NULL, payload_json TEXT NOT NULL, created_at TEXT NOT NULL);", + ) + .unwrap(); + } + let store = EventStore::open(&database).unwrap(); + assert!(store + .goal_envelope_projection(Uuid::from_u128(11)) + .unwrap() + .is_none()); + assert!(store + .goal_completion_projection(Uuid::from_u128(11)) + .unwrap() + .is_none()); + let forged = json!({ + "schema_version": GOAL_LIFECYCLE_SCHEMA_VERSION, + "goal_id": Uuid::from_u128(11), + "state": {"status": "completed", "approved": true} + }); + assert!(serde_json::from_value::(forged).is_err()); + drop(store); + assert!(fs::metadata(database).is_ok()); + } +} diff --git a/apps/desktop/src-tauri/src/kernel/mod.rs b/apps/desktop/src-tauri/src/kernel/mod.rs index 157631c..6600c71 100644 --- a/apps/desktop/src-tauri/src/kernel/mod.rs +++ b/apps/desktop/src-tauri/src/kernel/mod.rs @@ -19,6 +19,8 @@ pub mod deepseek_credential; pub mod deepseek_pricing; pub mod event_store; pub mod expert_team; +pub mod goal_envelope; +pub mod goal_lifecycle; pub mod local_directory; pub mod models; pub mod network_sandbox; diff --git a/apps/desktop/src-tauri/tauri.conf.json b/apps/desktop/src-tauri/tauri.conf.json index 68ab1ef..e1a27d8 100644 --- a/apps/desktop/src-tauri/tauri.conf.json +++ b/apps/desktop/src-tauri/tauri.conf.json @@ -2,7 +2,7 @@ "$schema": "https://schema.tauri.app/config/2", "productName": "DS Agent", "mainBinaryName": "ds-agent", - "version": "1.1.0", + "version": "1.2.0", "identifier": "ai.deepseek-agent-os.desktop", "build": { "beforeDevCommand": "npx pnpm@9.15.9 dev", diff --git a/apps/desktop/src/App.tsx b/apps/desktop/src/App.tsx index 2608fee..e3b1179 100644 --- a/apps/desktop/src/App.tsx +++ b/apps/desktop/src/App.tsx @@ -113,6 +113,8 @@ import type { DeepSeekPricingState, ComputerUseBackendStatus, FoundationState, + GoalEnvelopeProposal, + GoalEnvelopeUiProjection, LargeModelProvider, Language, OnboardingReadinessProjection, @@ -220,7 +222,7 @@ const fallbackOnboardingReadiness: OnboardingReadinessProjection = { message_key: "onboarding.workspace.workspace_missing", }, version: { - current_version: "1.1.0", + current_version: "1.2.0", status: "current", blocking: false, message_key: "onboarding.version.current", @@ -451,6 +453,8 @@ type AgentConversationMessage = { missing_prerequisites?: AgentChatMissingPrerequisite[]; memory_candidates?: MemoryCandidate[]; soul_profile_update?: AgentSoulProfileUpdateReceipt | null; + goal_envelope?: GoalEnvelopeProposal | null; + goal_projection?: GoalEnvelopeUiProjection | null; run_error?: string; created_at: string; }; @@ -654,6 +658,31 @@ function userFacingAgentMessageContent( : message.content; } +function goalEnvelopeStatusLabel( + status: GoalEnvelopeUiProjection["status"], + language: Language, +): string { + const labels = { + proposed: language === "zh" ? "待本地校验" : "Proposed", + blocked: language === "zh" ? "校验受阻" : "Validation blocked", + validated: language === "zh" ? "本地校验通过" : "Validated locally", + frozen: language === "zh" ? "目标已冻结" : "Goal frozen", + verification_blocked: language === "zh" ? "完成验证受阻" : "Verification blocked", + complete: language === "zh" ? "证据验证完成" : "Verified complete", + } satisfies Record; + return labels[status]; +} + +function goalEnvelopeStatusTone(status: GoalEnvelopeUiProjection["status"]): string { + if (status === "complete") { + return "succeeded"; + } + if (status === "blocked" || status === "verification_blocked") { + return "blocked"; + } + return "proposed"; +} + function userFacingAgentActionDetail(action: AgentChatActionProposal): string { const dispatchNote = action.dispatch_note?.trim(); if (action.action_type === "browser_open" && action.execution_state === "succeeded" && dispatchNote) { @@ -4318,6 +4347,8 @@ export function App() { content: response.content, model: response.model, protocol_version: response.protocol_version, + goal_envelope: response.goal_envelope, + goal_projection: response.goal_projection, proposed_actions: response.proposed_actions, missing_prerequisites: response.missing_prerequisites, memory_candidates: response.memory_candidates, @@ -6070,6 +6101,48 @@ export function App() { ))} ) : null} + {message.role === "assistant" && + (message.goal_projection || message.goal_envelope) ? ( +
+ {language === "zh" ? "目标契约" : "Goal contract"} +
    +
  • + + {goalEnvelopeStatusLabel( + message.goal_projection?.status ?? "proposed", + language, + )} + +

    + {message.goal_projection?.user_goal_summary ?? + message.goal_envelope?.user_goal} +

    + {message.goal_projection ? ( + + {language === "zh" ? "完成条件" : "Done when"}: {message.goal_projection.done_when_count} + {` / ${language === "zh" ? "产物" : "artifacts"}: ${message.goal_projection.required_artifact_count}`} + {` / ${language === "zh" ? "验证器" : "verifiers"}: ${message.goal_projection.verifier_count}`} + + ) : null} +
    • +
+ {message.goal_projection?.reason_codes.length ? ( +

+ {language === "zh" ? "原因码" : "Reason codes"}: {message.goal_projection.reason_codes.join(", ")} +

+ ) : null} + {message.goal_projection?.revision ? ( + + revision: {message.goal_projection.revision} + {` / fingerprint: ${message.goal_projection.fingerprint}`} + + ) : null} +
+ ) : null} {message.role === "assistant" && message.missing_prerequisites?.length ? (
{copy.chatWorkbench.missingPrerequisitesLabel} diff --git a/apps/desktop/src/types.ts b/apps/desktop/src/types.ts index d0e3256..630a7fc 100644 --- a/apps/desktop/src/types.ts +++ b/apps/desktop/src/types.ts @@ -925,11 +925,70 @@ export type AgentSoulProfileUpdateReceipt = { applied_at: string; }; +export type GoalDoneWhenProposal = { + done_when_id: string; + description: string; +}; + +export type GoalRequiredArtifactProposal = { + artifact_id: string; + description: string; +}; + +export type GoalVerifierProposal = { + verifier_id: string; + done_when_id: string; + description: string; + evidence_kind: string; +}; + +export type GoalExternalTargetProposal = { + target_id: string; + description: string; +}; + +export type GoalEnvelopeProposal = { + version: "ds-agent.goal-envelope-proposal/v1"; + user_goal: string; + assumptions: string[]; + constraints: string[]; + done_when: GoalDoneWhenProposal[]; + required_artifacts: GoalRequiredArtifactProposal[]; + verifiers: GoalVerifierProposal[]; + proposed_capabilities: string[]; + external_targets: GoalExternalTargetProposal[]; + stop_conditions: string[]; +}; + +export type GoalEnvelopeUiStatus = + | "proposed" + | "blocked" + | "validated" + | "frozen" + | "verification_blocked" + | "complete"; + +export type GoalEnvelopeUiProjection = { + version: "ds-agent.goal-envelope-ui/v1"; + goal_id: string; + status: GoalEnvelopeUiStatus; + reason_codes: string[]; + revision: string | null; + fingerprint: string; + completion_fingerprint: string | null; + user_goal_summary: string | null; + done_when_count: number; + required_artifact_count: number; + verifier_count: number; +}; + export type AgentChatResponse = { id: string; role: "assistant"; content: string; protocol_version: string; + goal_envelope: GoalEnvelopeProposal | null; + goal_projection: GoalEnvelopeUiProjection | null; proposed_actions: AgentChatActionProposal[]; missing_prerequisites: AgentChatMissingPrerequisite[]; memory_candidates: MemoryCandidate[]; diff --git a/docs/INSTALLATION.md b/docs/INSTALLATION.md index 2cdb202..d1084b5 100644 --- a/docs/INSTALLATION.md +++ b/docs/INSTALLATION.md @@ -9,14 +9,14 @@ project does not depend on the maintainer's local directories. The published Windows release provides a normal NSIS setup executable: ```text -DS.Agent_1.1.0_x64-setup.exe +DS.Agent_1.2.0_x64-setup.exe ``` -Version `1.1.0` is the current published stable release. Earlier commits, tags, +Version `1.2.0` is the current published stable release. Earlier commits, tags, Releases, and assets remain immutable. Both `ds-agent.exe` and the installer are Authenticode `NotSigned`, so Windows may show `Unknown publisher` or a Microsoft Defender SmartScreen warning. Download only over HTTPS from the official GitHub -Release and verify its byte size and SHA-256 against the `v1.1.0` Release before +Release and verify its byte size and SHA-256 against the `v1.2.0` Release before running it. The installer embeds the Microsoft WebView2 bootstrapper and runs it silently when the target machine needs the WebView2 runtime; users do not need Node.js, pnpm, Rust, or a @@ -27,12 +27,12 @@ not the workspace, evidence folder, export folder, or event database location. ## Code signing policy and verification -DS Agent `v1.1.0` is intentionally unsigned. Its HTTPS source, immutable tag, +DS Agent `v1.2.0` is intentionally unsigned. Its HTTPS source, immutable tag, exact byte size, and SHA-256 are the verification route for this asset. The SignPath Foundation application is submitted and approval is pending; no -publisher, certificate, or signed status is claimed for v1.1.0. If signing is +publisher, certificate, or signed status is claimed for v1.2.0. If signing is approved later, it starts with a new version and does not replace this tag or -asset. +asset or any immutable v1.1.0 publication. For releases accepted into the open-source signing program: **Free code signing provided by SignPath.io, certificate by SignPath Foundation.** The complete @@ -43,12 +43,12 @@ describes current local data and user-triggered network behavior. On Windows, inspect a downloaded installer without launching it: ```powershell -Get-AuthenticodeSignature .\DS.Agent_1.1.0_x64-setup.exe | +Get-AuthenticodeSignature .\DS.Agent_1.2.0_x64-setup.exe | Select-Object Status, StatusMessage, SignerCertificate, TimeStamperCertificate -Get-FileHash .\DS.Agent_1.1.0_x64-setup.exe -Algorithm SHA256 +Get-FileHash .\DS.Agent_1.2.0_x64-setup.exe -Algorithm SHA256 ``` -For `v1.1.0`, `Status` is expected to be `NotSigned`. An unexpected signer, +For `v1.2.0`, `Status` is expected to be `NotSigned`. An unexpected signer, signature identity, hash, version, source, or asset mismatch is a stop condition. For a future release explicitly documented as signed, any status other than `Valid` is also a stop condition. @@ -72,6 +72,12 @@ the OS app data directory. The ordinary setup projection shows a compact workspace display name and readiness state, not internal app-data, settings, managed-directory, or vault paths. +When DeepSeek proposes a v1 GoalEnvelope, DS Agent locally validates and +freezes the bounded contract. The chat surface is read-only: it can show the +goal state, stable reason codes, revision/fingerprint, and verifier/artifact +coverage counts, but it cannot create local validation, evidence, or completion +authority. + Good first tasks to try: - `根据我的证据文件夹，生成一份经营简报，并导出 HTML 和 PDF。` diff --git a/docs/OPEN_SOURCE_RELEASE.md b/docs/OPEN_SOURCE_RELEASE.md index 381427a..ab9a6f0 100644 --- a/docs/OPEN_SOURCE_RELEASE.md +++ b/docs/OPEN_SOURCE_RELEASE.md @@ -63,9 +63,9 @@ Ship a buildable local-first desktop Agent OS preview that demonstrates: setup behavior, and Operations Briefing scope. - If an unsigned installer is attached, disclose the unsigned status in the release notes and provide a SHA-256 checksum. -- The immutable `v1.0.2` installer remains unsigned. `v1.1.0` is also an - explicitly disclosed unsigned exception: both the application executable and - NSIS installer must read back as `NotSigned`, and the Release must warn about +- The immutable `v1.0.2` installer remains unsigned. `v1.1.0` and `v1.2.0` are + explicitly disclosed unsigned exceptions: both the application executable and + NSIS installer must read back as `NotSigned`, and each Release must warn about `Unknown publisher` and Microsoft Defender SmartScreen while binding the HTTPS asset to its exact source, version, byte size, and SHA-256. A later release must not be represented as signed unless both files satisfy @@ -114,8 +114,8 @@ Ship a buildable local-first desktop Agent OS preview that demonstrates: exports or packaged assets do not enter generated source archives. - `.env.example` documents local DeepSeek and optional local bridge environment variables without storing secret values. -- `docs/RELEASE_NOTES_v1.1.0.md` is the current stable release note. - `docs/RELEASE_NOTES_v1.0.2.md`, `docs/RELEASE_NOTES_v1.0.1.md`, +- `docs/RELEASE_NOTES_v1.2.0.md` is the current stable release note. + `docs/RELEASE_NOTES_v1.1.0.md`, `docs/RELEASE_NOTES_v1.0.2.md`, `docs/RELEASE_NOTES_v1.0.1.md`, `docs/RELEASE_NOTES_v1.0.0.md`, and `docs/DS_AGENT_V1_COMPLETION_AUDIT.md` preserve the immutable first stable release evidence. Historical release notes, including `v0.9.0`, `v0.8.0`, diff --git a/docs/RELEASE_NOTES_v1.2.0.md b/docs/RELEASE_NOTES_v1.2.0.md new file mode 100644 index 0000000..c378278 --- /dev/null +++ b/docs/RELEASE_NOTES_v1.2.0.md @@ -0,0 +1,98 @@ +# DS Agent v1.2.0 + +`v1.2.0` adds the Step 2 GoalEnvelope contract to the stable Windows desktop +app. Package, desktop, Tauri, Cargo, updater, and installer metadata are +`1.2.0` / `v1.2.0`. + +## Goal proposal and Kernel authority + +- DeepSeek can propose the versioned, bounded + `ds-agent.goal-envelope-proposal/v1` contract: user goal, assumptions, + constraints, `done_when`, required artifacts, verifiers, proposed + capabilities, external targets, and stop conditions. +- A proposal does not grant a capability, trust a path or account, approve an + action, execute a tool, produce verifier authority, or declare completion. +- The local Kernel validates proposed capability names against its tool catalog, + readiness, risk/effect policy, verifier availability, workspace state, and + locally bound targets. It alone creates the normalized revision, validation + receipt, frozen fingerprint, and durable lifecycle projection. +- Unknown fields, unsupported versions, unbounded or duplicate values, + secret-like content, unsafe local references, unbound targets, missing + verifier coverage, and unavailable local authority fail closed with stable + codes. + +## Read-only UI and verified completion + +- Chat can show a read-only goal projection with the bounded goal summary, + proposed/blocked/validated/frozen/verification-blocked/complete state, stable + reason codes, revision/fingerprint, and verifier/artifact counts. +- The frontend cannot deserialize or write validation context, bound authority, + frozen receipts, evidence, or completion authority. Model-supplied projection + and completion fields are ignored. +- Completion requires locally authoritative passing evidence bound to the exact + frozen goal ID, revision, fingerprint, verifier, `done_when`, evidence kind, + and required artifact identity. Missing, failed, stale, wrong-goal, + wrong-revision, wrong-fingerprint, unknown, duplicate, mismatched, or + incomplete evidence remains verification-blocked. +- Model narrative, UI booleans, approval state, tool result prose, or the mere + existence of an artifact cannot complete a goal. + +## Compatibility and migration + +- Existing v1.1.0 onboarding, DPAPI credential, workspace, conversation, + connector-vault, and isolated-profile behavior is preserved. +- Existing SQLite databases gain compatible GoalEnvelope lifecycle and + completion projection tables through additive creation. Legacy databases + default to no goal and not complete; no historical event or artifact is + promoted into goal authority. +- Duplicate proposal, freeze, evidence, and completion processing is + deterministic and restart-safe. A changed frozen revision or fingerprint + invalidates earlier completion evidence. +- Goal events, receipts, ordinary DTOs, UI projections, and work packages are + guarded against secret, provider-body, absolute app-data/vault path, local + authority, and internal claim-token leakage. + +## Windows download and integrity + +> **Unsigned release:** both `ds-agent.exe` and `DS.Agent_1.2.0_x64-setup.exe` are intentionally Authenticode `NotSigned`. +> Windows may display `Unknown publisher` or a Microsoft Defender SmartScreen +> warning. This is not a signed or SignPath-approved release. + +Download only over HTTPS from the official +[`v1.2.0` GitHub Release](https://github.com/Lee-take/dsagent/releases/tag/v1.2.0). +Before running the installer, compare its filename, product version, exact byte +size, and SHA-256 with the values in that Release. The final Release body binds +the sole x64 installer asset to the exact source commit and immutable annotated +tag after exact-main build and fresh-download readback. + +The SignPath Foundation application remains submitted and approval is pending. +If the project is accepted later, signing starts only with a subsequent new +version; the immutable v1.1.0 and v1.2.0 tags, Releases, and assets will not be +moved, overwritten, or replaced. + +## Scope and limits + +This release is limited to C2A/C2B/C2C GoalEnvelope proposal, +Kernel validation/freeze, compatible persistence, read-only UI projection, and +the verified-evidence completion gate. It does not add Step 3 grouped +authorization, an Office executor, a connector or Computer Use expansion, a +new verifier runtime, production external accounts, or external-write +authority. Production Microsoft/Google account registration and live +mail/calendar writes remain disabled. DS Agent remains an independent +open-source project, not an official DeepSeek product. + +Release verification covers focused and full tests, production frontend build, +Rust formatting, migration/restart/idempotence and fail-closed evidence +regressions, release-source and secret scans, isolated candidate/installed UI +and workflow smoke, PR CI, exact-main CI, and final +version/filename/byte-size/SHA-256/Auth/source/tag/Release/Latest/fresh-download +readback. The cancelled formal 20-run Windows lab is not claimed. + +## Deterministic briefing templates + +`docs/templates/operations-briefing-smoke-evidence` remains deterministic local +test material. The bundled smoke files are marked as +`SMOKE SAMPLE evidence for local verification only` and +`Replace before operational use`; replace them before operational use. The +desktop seed action continues to use the blank operator templates under +`docs/templates/operations-briefing-evidence`. diff --git a/package.json b/package.json index 4ad535c..4d7f79a 100644 --- a/package.json +++ b/package.json @@ -1,7 +1,7 @@ { "name": "deepseek-agent-os", "private": true, - "version": "1.1.0", + "version": "1.2.0", "author": "Lee take", "license": "Apache-2.0", "description": "Local-first DeepSeek AI work platform with background runs, permissioned tools, auditable evidence, and recovery.", diff --git a/scripts/desktop-test.mjs b/scripts/desktop-test.mjs index bd3c628..8cf3ade 100644 --- a/scripts/desktop-test.mjs +++ b/scripts/desktop-test.mjs @@ -36,6 +36,7 @@ run(["node", "scripts/workspace-undo.test.mjs"]); run(["node", "scripts/agent-attachments.test.mjs"]); run(["node", "scripts/agent-chat-pending.test.mjs"]); run(["node", "scripts/agent-context-receipt.test.mjs"]); +run(["node", "scripts/goal-envelope-ui.test.mjs"]); run(["node", "scripts/settings-panel.test.mjs"]); run(["node", "scripts/onboarding-readiness.test.mjs"]); run(["node", "scripts/plugin-catalog.test.mjs"]); diff --git a/scripts/goal-envelope-ui.test.mjs b/scripts/goal-envelope-ui.test.mjs new file mode 100644 index 0000000..6d0676a --- /dev/null +++ b/scripts/goal-envelope-ui.test.mjs @@ -0,0 +1,49 @@ +#!/usr/bin/env node + +import assert from "node:assert/strict"; +import { readFile } from "node:fs/promises"; + +const [app, types, commands, lifecycle] = await Promise.all([ + readFile("apps/desktop/src/App.tsx", "utf8"), + readFile("apps/desktop/src/types.ts", "utf8"), + readFile("apps/desktop/src-tauri/src/commands.rs", "utf8"), + readFile("apps/desktop/src-tauri/src/kernel/goal_lifecycle.rs", "utf8"), +]); + +for (const status of [ + "proposed", + "blocked", + "validated", + "frozen", + "verification_blocked", + "complete", +]) { + assert.match(types, new RegExp(`\\|? \\"${status}\\"`)); +} + +assert.match(app, /goal_envelope: response\.goal_envelope/); +assert.match(app, /goal_projection: response\.goal_projection/); +assert.match(app, /message\.goal_projection\?\.status/); +assert.match(app, /message\.goal_projection\.reason_codes\.join/); +assert.match(app, /message\.goal_projection\.revision/); +assert.match(app, /message\.goal_projection\.fingerprint/); +assert.doesNotMatch( + app, + /invoke[^\n]*(complete_goal|record_goal|completion_receipt|validation_receipt|authority_fingerprint)/i, +); + +assert.match(commands, /#\[serde\(default, skip_deserializing\)\]\s+pub goal_projection/); +assert.match(commands, /reconcile_agent_goal_projection/); +assert.match(commands, /record_goal_completion_for_tool_invocation/); +assert.doesNotMatch(commands, /pub fn (complete_goal|record_goal_completion_evidence)/); + +const uiProjectionStart = lifecycle.indexOf("pub struct GoalEnvelopeUiProjection"); +const uiProjectionEnd = lifecycle.indexOf("}\n", uiProjectionStart); +assert.ok(uiProjectionStart >= 0 && uiProjectionEnd > uiProjectionStart); +const uiProjection = lifecycle.slice(uiProjectionStart, uiProjectionEnd); +assert.doesNotMatch( + uiProjection, + /authority|context_fingerprint|target_bindings|provider|claim|secret/i, +); + +console.log("GoalEnvelope UI and completion authority boundary checks passed"); diff --git a/scripts/release-source-check.mjs b/scripts/release-source-check.mjs index f3820f7..c0a02ec 100644 --- a/scripts/release-source-check.mjs +++ b/scripts/release-source-check.mjs @@ -4,7 +4,7 @@ import { spawnSync } from "node:child_process"; import { existsSync, readFileSync, statSync } from "node:fs"; import path from "node:path"; -const expectedVersion = "1.1.0"; +const expectedVersion = "1.2.0"; const maxSourceFileBytes = 2 * 1024 * 1024; const binaryReleaseExtensions = new Set([ ".appimage", @@ -52,6 +52,7 @@ const requiredDocs = [ "CODE_SIGNING_POLICY.md", "PRIVACY.md", "docs/INSTALLATION.md", + "docs/RELEASE_NOTES_v1.2.0.md", "docs/RELEASE_NOTES_v1.1.0.md", "docs/RELEASE_NOTES_v1.0.2.md", "docs/RELEASE_NOTES_v1.0.1.md", @@ -86,6 +87,7 @@ const publicReleaseCopyFiles = [ "apps/desktop/package.json", "docs/INSTALLATION.md", "docs/OPEN_SOURCE_RELEASE.md", + "docs/RELEASE_NOTES_v1.2.0.md", "docs/RELEASE_NOTES_v1.1.0.md", "docs/RELEASE_NOTES_v1.0.2.md", "docs/RELEASE_NOTES_v1.0.1.md", @@ -504,6 +506,7 @@ checkSmokeScriptReleaseLabels(); checkExternalBridgeUserVisibleErrors(); checkLocalReleaseHelperSelfTests(); checkStepOneOnboardingReadinessContract(); +checkStepTwoGoalEnvelopeReleaseBoundary(); checkPackageManagerBaseline(); checkGovernanceDocs(); checkCodeSigningAndPrivacyPolicies(); @@ -724,7 +727,7 @@ function checkRequiredDocs() { for (const [phrase, label] of [ ["One Kernel. Modular capabilities. Verifiable execution.", "English README product promise"], ["DS Agent is a local Agent Harness optimized for DeepSeek", "English README DeepSeek-first positioning"], - ["v1.1.0 stable", "English README formal stable status"], + ["v1.2.0 stable", "English README formal stable status"], ["The key difference is that Memory, Automation, Computer Use, parallel Subagents, and Skills are not isolated plugins", "English README unified Kernel thesis"], ["contract-first modular Harness architecture", "English README modular architecture"], ["Five core capabilities, one engineering philosophy", "English README five-capability framing"], @@ -736,7 +739,7 @@ function checkRequiredDocs() { ["goal → done-when contract → context → plan → permission → execution → evidence → verification → recovery", "English README Loop Engineering contract"], ["DeepSeek and DS Agent boundary", "English README model boundary"], ["Why Rust", "English README Rust rationale"], - ["Production Microsoft/Google account registration and live external-write authority remain disabled in v1.1.0", "English README connector authority boundary"], + ["Production Microsoft/Google account registration and live external-write authority remain disabled in v1.2.0", "English README connector authority boundary"], ["README.zh-CN.md", "English README language switch"], ["Search aliases: DS Agent, DSAgent, dsagent, DeepSeek Agent OS.", "English README searchable aliases"], ]) { @@ -745,7 +748,7 @@ function checkRequiredDocs() { for (const [phrase, label] of [ ["一个 Kernel，模块化能力，统一可信执行。", "Chinese README product promise"], ["DS Agent 是专门为 DeepSeek 优化的本地 Agent Harness", "Chinese README DeepSeek-first positioning"], - ["v1.1.0 正式稳定版", "Chinese README formal stable status"], + ["v1.2.0 正式稳定版", "Chinese README formal stable status"], ["真正的差异点是：记忆、自动化执行、Computer Use、Subagent 并行协作和技能", "Chinese README unified Kernel thesis"], ["契约优先的模块化 Harness 架构", "Chinese README modular architecture"], ["五项核心能力，一套工程理念", "Chinese README five-capability framing"], @@ -757,7 +760,7 @@ function checkRequiredDocs() { ["目标 → 完成条件 → 上下文 → 规划 → 权限 → 执行 → 证据 → 验证 → 恢复", "Chinese README Loop Engineering contract"], ["DeepSeek 与 DS Agent 的工作边界", "Chinese README model boundary"], ["为什么使用 Rust", "Chinese README Rust rationale"], - ["v1.1.0 仍未开放生产 Microsoft/Google 账号注册和真实外部写入权限", "Chinese README connector authority boundary"], + ["v1.2.0 仍未开放生产 Microsoft/Google 账号注册和真实外部写入权限", "Chinese README connector authority boundary"], ["README.md", "Chinese README language switch"], ["中文搜索别名：DS Agent、DSAgent、dsagent、DeepSeek Agent OS。", "Chinese README searchable aliases"], ]) { @@ -1605,14 +1608,14 @@ function checkPublicReleaseCopyPositioning() { checkTextIncludes( "apps/desktop/src-tauri/src/kernel/app_update.rs", readText("apps/desktop/src-tauri/src/kernel/app_update.rs"), - 'APP_UPDATE_USER_AGENT: &str = "DS-Agent-Updater/1.1.0"', - "app updater User-Agent v1.1.0", + 'APP_UPDATE_USER_AGENT: &str = "DS-Agent-Updater/1.2.0"', + "app updater User-Agent v1.2.0", ); checkTextIncludes( "apps/desktop/src-tauri/src/kernel/app_update.rs", readText("apps/desktop/src-tauri/src/kernel/app_update.rs"), - 'APP_UPDATE_CURRENT_RELEASE_TAG: &str = "v1.1.0"', - "app updater current release tag v1.1.0", + 'APP_UPDATE_CURRENT_RELEASE_TAG: &str = "v1.2.0"', + "app updater current release tag v1.2.0", ); checkTextDoesNotInclude( "apps/desktop/src-tauri/src/kernel/app_update.rs", @@ -1620,6 +1623,30 @@ function checkPublicReleaseCopyPositioning() { 'APP_UPDATE_CURRENT_RELEASE_TAG: &str = "v0.9.0"', "app updater current release tag must not regress to v0.9.0", ); + checkTextIncludesCollapsed( + "docs/RELEASE_NOTES_v1.2.0.md", + readText("docs/RELEASE_NOTES_v1.2.0.md"), + "Package, desktop, Tauri, Cargo, updater, and installer metadata are `1.2.0` / `v1.2.0`.", + "v1.2.0 stable release notes version identity", + ); + checkTextIncludesCollapsed( + "docs/RELEASE_NOTES_v1.2.0.md", + readText("docs/RELEASE_NOTES_v1.2.0.md"), + "both `ds-agent.exe` and `DS.Agent_1.2.0_x64-setup.exe` are intentionally Authenticode `NotSigned`", + "v1.2.0 dual-artifact unsigned disclosure", + ); + checkTextIncludesCollapsed( + "docs/RELEASE_NOTES_v1.2.0.md", + readText("docs/RELEASE_NOTES_v1.2.0.md"), + "It does not add Step 3 grouped authorization", + "v1.2.0 Step 3 exclusion", + ); + checkTextIncludesCollapsed( + "docs/RELEASE_NOTES_v1.2.0.md", + readText("docs/RELEASE_NOTES_v1.2.0.md"), + "The cancelled formal 20-run Windows lab is not claimed.", + "v1.2.0 no false formal-lab claim", + ); checkTextIncludesCollapsed( "docs/RELEASE_NOTES_v1.1.0.md", readText("docs/RELEASE_NOTES_v1.1.0.md"), @@ -3389,7 +3416,7 @@ function checkGovernanceDocs() { checkTextIncludesCollapsed( "SECURITY.md", securityPolicy, - "DS Agent v1.1.0 is the current published stable release", + "DS Agent v1.2.0 is the current published stable release", "SECURITY.md current stable scope", ); checkTextIncludes( @@ -3419,7 +3446,7 @@ function checkGovernanceDocs() { checkTextIncludesCollapsed( "SECURITY.md", securityPolicy, - "Current stable v1.1.0 stores one user-supplied DeepSeek API key in a dedicated Windows DPAPI vault", + "Current stable v1.2.0 stores one user-supplied DeepSeek API key in a dedicated Windows DPAPI vault", "SECURITY.md current stable credential boundary", ); checkTextIncludesCollapsed( @@ -3480,7 +3507,7 @@ function checkCodeSigningAndPrivacyPolicies() { for (const [phrase, label] of [ ["# Code signing policy", "code-signing policy title"], - ["DS Agent `v1.1.0` is intentionally published unsigned", "code-signing current unsigned status"], + ["DS Agent `v1.2.0` is intentionally published unsigned", "code-signing current unsigned status"], ["The SignPath Foundation application is submitted and approval is pending", "code-signing pending application status"], ["Free code signing provided by", "SignPath acknowledgement"], ["certificate by", "SignPath certificate acknowledgement"], @@ -3503,7 +3530,7 @@ function checkCodeSigningAndPrivacyPolicies() { for (const [phrase, label] of [ ["# Privacy Policy", "privacy policy title"], ["does not operate a project cloud backend, advertising service, or project analytics or telemetry service", "no project telemetry service"], - ["The current stable `v1.1.0` accepts one user-supplied DeepSeek API key", "privacy current credential behavior"], + ["The current stable `v1.2.0` accepts one user-supplied DeepSeek API key", "privacy current credential behavior"], ["dedicated Windows DPAPI-protected local vault", "privacy DPAPI storage boundary"], ["https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html", "DeepSeek privacy disclosure"], ["DuckDuckGo's privacy policy", "web-search privacy disclosure"], @@ -3511,7 +3538,7 @@ function checkCodeSigningAndPrivacyPolicies() { ["Hugging Face", "skill-source privacy disclosure"], ["WebView2 data and privacy documentation", "WebView2 privacy disclosure"], ["accepts only loopback addresses", "local bridge privacy boundary"], - ["Production Microsoft and Google account registration and live mail/calendar writes are disabled in `v1.1.0`", "disabled connector privacy boundary"], + ["Production Microsoft and Google account registration and live mail/calendar writes are disabled in `v1.2.0`", "disabled connector privacy boundary"], ["not uploaded merely because the application is open", "no passive content upload"], ]) { checkTextIncludesCollapsed("PRIVACY.md", privacyPolicy, phrase, label); @@ -3524,7 +3551,7 @@ function checkCodeSigningAndPrivacyPolicies() { checkTextIncludes(filePath, content, "NotSigned", `${filePath} unsigned Authenticode disclosure`); checkTextIncludes(filePath, content, "Unknown publisher", `${filePath} unknown-publisher warning`); checkTextIncludes(filePath, content, "SmartScreen", `${filePath} SmartScreen warning`); - checkTextIncludes(filePath, content, "docs/RELEASE_NOTES_v1.1.0.md", `${filePath} v1.1.0 release-notes link`); + checkTextIncludes(filePath, content, "docs/RELEASE_NOTES_v1.2.0.md", `${filePath} v1.2.0 release-notes link`); checkTextDoesNotInclude(filePath, content, "12,716,857 bytes", `${filePath} no stale v1.0.1 asset size`); checkTextDoesNotInclude(filePath, content, "469C4EFA54F4C94A6E37D28C9C88D331B26E1770C6792DC93D02B451640E2A6F", `${filePath} no stale v1.0.1 asset SHA-256`); } @@ -4223,7 +4250,7 @@ function checkSmokeScriptReleaseLabels() { const rustRuntimeExpectations = [ [ "apps/desktop/src-tauri/src/kernel/deepseek.rs", - "DS-Agent/1.1.0 deepseek-v4", + "DS-Agent/1.2.0 deepseek-v4", "DeepSeek runtime User-Agent release label", ], [ @@ -4630,6 +4657,48 @@ function checkStepOneOnboardingReadinessContract() { } } +function checkStepTwoGoalEnvelopeReleaseBoundary() { + const proposal = readText("apps/desktop/src-tauri/src/kernel/goal_envelope.rs"); + const lifecycle = readText("apps/desktop/src-tauri/src/kernel/goal_lifecycle.rs"); + const eventStore = readText("apps/desktop/src-tauri/src/kernel/event_store.rs"); + const commands = readText("apps/desktop/src-tauri/src/commands.rs"); + const app = readText("apps/desktop/src/App.tsx"); + const desktopTest = readText("scripts/desktop-test.mjs"); + const uiTest = readText("scripts/goal-envelope-ui.test.mjs"); + + for (const [filePath, content, phrase, label] of [ + ["apps/desktop/src-tauri/src/kernel/goal_envelope.rs", proposal, "ds-agent.goal-envelope-proposal/v1", "GoalEnvelope proposal version"], + ["apps/desktop/src-tauri/src/kernel/goal_envelope.rs", proposal, "deny_unknown_fields", "GoalEnvelope unknown-field rejection"], + ["apps/desktop/src-tauri/src/kernel/goal_lifecycle.rs", lifecycle, "ds-agent.goal-envelope-lifecycle/v1", "GoalEnvelope lifecycle version"], + ["apps/desktop/src-tauri/src/kernel/goal_lifecycle.rs", lifecycle, "ds-agent.goal-envelope-completion/v1", "GoalEnvelope completion version"], + ["apps/desktop/src-tauri/src/kernel/goal_lifecycle.rs", lifecycle, "EvidenceRevisionMismatch", "GoalEnvelope stale-revision rejection"], + ["apps/desktop/src-tauri/src/kernel/goal_lifecycle.rs", lifecycle, "EvidenceFingerprintMismatch", "GoalEnvelope stale-fingerprint rejection"], + ["apps/desktop/src-tauri/src/kernel/goal_lifecycle.rs", lifecycle, "MissingArtifactEvidence", "GoalEnvelope required-artifact gate"], + ["apps/desktop/src-tauri/src/kernel/event_store.rs", eventStore, "CREATE TABLE IF NOT EXISTS goal_envelope_projection", "GoalEnvelope additive lifecycle migration"], + ["apps/desktop/src-tauri/src/kernel/event_store.rs", eventStore, "CREATE TABLE IF NOT EXISTS goal_completion_projection", "GoalEnvelope additive completion migration"], + ["apps/desktop/src-tauri/src/commands.rs", commands, "#[serde(default, skip_deserializing)]", "model cannot deserialize GoalEnvelope UI authority"], + ["apps/desktop/src-tauri/src/commands.rs", commands, "record_goal_completion_for_tool_invocation", "Kernel records completion evidence"], + ["apps/desktop/src/App.tsx", app, "message.goal_projection?.status", "read-only GoalEnvelope UI status"], + ["scripts/desktop-test.mjs", desktopTest, "scripts/goal-envelope-ui.test.mjs", "full test runs GoalEnvelope UI boundary"], + ["scripts/goal-envelope-ui.test.mjs", uiTest, "GoalEnvelope UI and completion authority boundary checks passed", "focused GoalEnvelope UI boundary test"], + ]) { + checkTextIncludes(filePath, content, phrase, label); + } + + checkTextDoesNotInclude( + "apps/desktop/src-tauri/src/commands.rs", + commands, + "pub fn complete_goal", + "frontend command layer has no goal completion writer", + ); + checkTextDoesNotInclude( + "apps/desktop/src/App.tsx", + app, + 'invoke("complete_goal"', + "frontend has no goal completion invocation", + ); +} + function checkOperationsBriefingSmokeEvidence() { if (!existsSync(smokeEvidenceDir)) { failures.push(`${smokeEvidenceDir} is required for live Operations Briefing smoke tests`);