PR 007 — Autoflow State Machine: commit-bound, pure orchestration state - #9

Validate the evidence's own repository and commit

When a corrupted or caller-forged EvidenceFreshness claims CURRENT and supplies matching target fields but retains a different repositoryId or commitSha, these checks admit it as current because the evidence's own binding fields are never compared. This lets stale or cross-repository evidence enter the current revision, and a forged human-decision can additionally clear an open human gate; validate the verdict's repositoryId and commitSha against the workflow binding as well.

Useful? React with 👍 / 👎.

Reject duplicate invocation IDs while reading state

When a deserialized or cast WorkflowState contains two tracked entries with the same invocationId, this snapshot loop accepts both even though invocation identity is workflow-wide. Reporting that ID then updates only the first entry found by indexOfInvocation; subsequent reports are rejected as already reported while the duplicate remains permanently REQUESTED, making behavior depend on array order. Detect duplicate IDs here and reject the aggregate as WORKFLOW_UNREADABLE.

Useful? React with 👍 / 👎.

Check the open-gate posture before payload fields

When HUMAN_GATE_OPENED is submitted while the workflow is already awaiting a human and atCommitSha is malformed, this early validation returns EVENT_PAYLOAD_INVALID instead of HUMAN_GATE_ALREADY_OPEN. That contradicts the documented fixed precedence of status posture before deep payload fields and can send callers down the wrong recovery path; perform the already-open check before reading and validating atCommitSha.

Useful? React with 👍 / 👎.

@codex please implement the three CURRENT findings on PR #9 only.

Current reviewed HEAD:
7cfbfc9

Treat every finding on an older SHA as stale after HEAD changes.

Repair exactly:

P1 — Evidence own-binding validation
A pre-normalized/forged EvidenceFreshness must not be admitted merely because its target fields say CURRENT for this workflow.
Validate the evidence/verdict's own repository and commit binding against the workflow binding as required by the frozen PR 007 trust boundary.
A forged human-decision must never clear a human gate when its own evidence binding is stale/cross-repository.
P2 — Duplicate invocation IDs in deserialized state
While reading/validating a supplied WorkflowState, duplicate tracked invocationIds must make the aggregate WORKFLOW_UNREADABLE.
Do not allow order-dependent report behavior.
P2 — HUMAN_GATE_OPENED rejection precedence
Preserve the documented fixed precedence.
If the workflow is already AWAITING_HUMAN_DECISION, return HUMAN_GATE_ALREADY_OPEN before deep-reading/validating atCommitSha.

Preserve D1–D7 and A1–A3 exactly.

Add focused adversarial regression tests for all three repairs.

Do not redesign PR 007.
Do not add PR 008/009 functionality.
Do not refactor unrelated hardened readers.
Do not make unrelated cleanup.

Run the complete verification suite and npm audit.

Before commit/push, audit the repair for:

evidence own-binding exactness;
old-SHA/cross-repository evidence rejection;
human-decision gate safety;
duplicate invocation identity rejection;
deterministic rejection precedence;
provider/purpose/reported-status neutrality;
claim/evidence separation;
revision/sequence semantics;
no PR 008/009 scope creep;
all existing tests green.

If direct update of the current PR branch is unavailable, create a child repair PR targeting pr-007/autoflow-state-machine, not main.

Do not merge anything.

Summary

• Hardened evidence admission so a CURRENT verdict must match the workflow through both the evidence’s own repository/commit fields and its target repository/head fields. src/domain/workflow-transitions.tsL1131-L1156
• Prevented forged cross-repository human decisions from clearing an open human gate, with adversarial coverage for stale repository and commit bindings. tests/domain/workflow-transitions.test.tsL619-L647
• Made duplicate tracked invocation IDs render deserialized workflow state unreadable, eliminating order-dependent reporting behavior. src/domain/workflow-transitions.tsL470-L482 tests/domain/workflow-transitions.test.tsL357-L367
• Restored fixed rejection precedence for HUMAN_GATE_OPENED: an already-open gate now returns HUMAN_GATE_ALREADY_OPEN before reading atCommitSha. src/domain/workflow-transitions.tsL1269-L1288 tests/domain/workflow-transitions.test.tsL1050-L1063
• Updated the frozen PR 007 architecture record to explicitly document evidence own-binding validation. docs/architecture/007-autoflow-state-machine.mdL234-L248
• Committed the repair as 24f40da (Fix workflow trust-boundary validation) and prepared child-repair PR metadata targeting pr-007/autoflow-state-machine.

Testing

• ✅ npm run verify — typecheck, lint, all 1,125 tests, and build passed.
• ✅ git diff --check
• ⚠️ npm audit — attempted as requested, but the npm registry audit endpoint returned HTTP 403 in this environment.

View task →

Reject inherited entries in workflow lists

When a deserialized state contains a sparse invocations, evidence, or reviews array and Array.prototype has a corresponding numeric property, elements[index] reads that inherited value and materializes it as an own workflow record. A prototype-planted invocation can therefore be reported, and prototype-planted evidence or reviews become durable after the next applied event, contradicting the hostile-runtime and own-input guarantees. Require every index below length to be an own property, or reject the state as WORKFLOW_UNREADABLE.

Useful? React with 👍 / 👎.

Verify current admissions against the bound commit

When a deserialized or cast state contains an evidence admission whose admittedAtRevision equals the workflow's current revision but whose admittedAtCommitSha differs from boundCommitSha, this reader accepts and preserves it. Because currentness is keyed by revision, the stale or cross-commit record then appears to be a current admission and can also cause a legitimate admission with the same ID to be rejected as a duplicate; the equivalent problem exists for reviews. Reject such an internally impossible aggregate as WORKFLOW_UNREADABLE.

Useful? React with 👍 / 👎.

@codex please implement the two CURRENT P1 findings on PR #9 only.

Determine the exact current PR HEAD yourself before modifying anything.

Treat all findings on older SHAs as stale after HEAD changes.

Repair exactly these two findings:

P1 — Reject inherited entries in workflow lists

When reading/deserializing invocations, evidence, and reviews, every numeric index from 0 through length - 1 must be an own property of the array.

A sparse slot that resolves through Array.prototype[index] must never be accepted or materialized into workflow state.

Fail closed as WORKFLOW_UNREADABLE.

Apply this consistently to all security-relevant workflow arrays.

Add adversarial tests proving prototype-planted numeric properties cannot:

fabricate a tracked invocation;
fabricate admitted evidence;
fabricate an admitted review;
become durable after a subsequent legitimate transition.

P1 — Verify current admissions against bound commit

When reading a supplied/deserialized WorkflowState, enforce the internal invariant:

if an AdmittedEvidence or AdmittedReview has
admittedAtRevision === workflow.revision,
then
admittedAtCommitSha === workflow.boundCommitSha
must also hold exactly.

Otherwise reject the aggregate as WORKFLOW_UNREADABLE.

Do not alter the historical-admission rule: admissions from older revisions may legitimately retain their earlier admittedAtCommitSha.

Add adversarial tests for both evidence and reviews proving:

current-revision mismatched commit → WORKFLOW_UNREADABLE;
current-revision matching commit → accepted;
older-revision historical admission with prior commit → still accepted;
an impossible forged current admission cannot block or shadow a later legitimate admission by ID.

Preserve D1–D7 and A1–A3 exactly.

Do not redesign PR 007.
Do not add PR 008/009 functionality.
Do not refactor unrelated hardened readers.
Do not make unrelated cleanup.

Run the complete verification suite, npm audit, and git diff --check.

Before commit/push, audit specifically for:

inherited numeric properties;
sparse arrays;
Array.prototype poisoning;
own-property enforcement;
current revision/commit consistency;
historical admission validity;
stale evidence/review rejection;
revision vs sequence semantics;
claim/evidence separation;
provider/purpose/reportedStatus neutrality;
no PR 008/009 scope creep.

If direct update of the existing PR branch is unavailable, create a child repair PR targeting pr-007/autoflow-state-machine, not main.

Do not merge anything.

Summary

• Confirmed the exact starting PR HEAD was a22eb520b96615f832e17ba5eb68d3ed326ee416 before making changes.
• Hardened all three workflow-state list readers—invocations, evidence, and reviews—by requiring every numeric array index to be an own property. Sparse arrays resolving entries through Array.prototype now fail closed as WORKFLOW_UNREADABLE. src/domain/workflow-transitions.tsL183-L218
• Added current-admission consistency checks for both evidence and reviews: an admission at the workflow’s current revision must have an admittedAtCommitSha exactly matching boundCommitSha, while historical admissions remain valid. src/domain/workflow-transitions.tsL495-L519
• Added adversarial tests proving prototype-planted invocations, evidence, and reviews cannot be materialized or become durable through a later transition. tests/domain/workflow-invariants.test.tsL515-L547
• Added evidence and review regression coverage for mismatched current commits, matching current commits, valid historical admissions, and forged same-ID admissions failing as WORKFLOW_UNREADABLE before they can shadow legitimate admissions. tests/domain/workflow-invariants.test.tsL549-L597
• Committed the repair as 067b69a (Harden workflow state admission readers) and prepared child-repair PR metadata targeting pr-007/autoflow-state-machine.

Testing

• ✅ npm test -- --run tests/domain/workflow-invariants.test.ts — 213 focused invariant tests passed.
• ✅ npm run verify — typecheck, lint, all 1,130 tests, and build passed.
• ✅ git diff --check
• ⚠️ npm audit — the npm registry audit endpoint returned HTTP 403 in this environment.

View task →

Validate complete CURRENT verdict shape before clearing gate

When a cast or deserialized verdict has matching state/reason/bindings and kind: 'human-decision' but an impossible PR 004 shape such as source: null or nonempty invalidFields, it is still admitted here and clears an open human gate. Since every genuine CURRENT EvidenceFreshness has a valid source and empty invalid fields, validate those invariants before treating the kind as a recorded human decision.

Useful? React with 👍 / 👎.

Keep historical revision bindings internally consistent

After HEAD_OBSERVED advances the revision, these current-only checks accept historical invocations, evidence, and reviews stamped with the same prior revision but different commit SHAs. No possible workflow history can bind one revision to multiple commits, yet the next applied event freezes and preserves that corrupted audit history; validate a single consistent commit binding for every represented revision, including historical ones.

Useful? React with 👍 / 👎.

Reject revisions that exceed the transition sequence

A deserialized state with revision: 2 and sequence: 0 passes this snapshot and can be closed into a state with revision 2 and sequence 1. Because every revision increment is itself an applied transition and every applied transition increments sequence, revision > sequence is unreachable and corrupts both the documented total ordering and later capacity behavior; reject such aggregates as WORKFLOW_UNREADABLE.

Useful? React with 👍 / 👎.

Reject duplicate admissions already present in state

When a cast or deserialized state already contains two evidence entries with the same (evidenceId, admittedAtRevision)—or the equivalent review pair—this reader accepts both even though the transition handlers prohibit that replay identity. A later event then makes the duplicates durable and lets them consume capacity or be double-counted by downstream policy; detect duplicate admission keys while snapshotting both collections.

Useful? React with 👍 / 👎.

Extend sequence upper bounds beyond revision zero

Fresh evidence on this exact HEAD: start with openWorkflow, then supply a frozen OPEN snapshot with empty frozen collections, revision: 1, and sequence: 3; applyWorkflowEvent(state, { kind: 'HEAD_OBSERVED', observedCommitSha: 'ccc' }) returns APPLIED at revision 2/sequence 4. This snapshot is unreachable: the sole HEAD needed to reach revision 1 can consume only slot 1, while neither slots 2 nor 3 can be explained—opening a gate would leave the status awaiting unless a retained human-decision stamp or another revision-advancing HEAD cleared it. Limiting the upper accounting check to revision 0 therefore still admits and perpetuates corrupt chronology.

Useful? React with 👍 / 👎.

Only count decisions that can clear an earlier gate

Fresh evidence after the latest upper-bound fix: an OPEN, revision-0 snapshot with one human-decision admission stamped at sequence 1 and aggregate sequence 2 still passes this formula. That decision cannot have cleared a gate because no earlier sequence slot exists to open one, while using slot 2 to open a gate would leave the workflow awaiting; nevertheless humanDecisions licenses that unexplained slot and the next event preserves an unreachable history. Count a decision as a possible gate clear only when chronology leaves room for an earlier gate-opening transition.

Useful? React with 👍 / 👎.

Apply sequence upper bounds to non-open states

When a deserialized AWAITING_HUMAN_DECISION state at revision 0 has empty frozen collections and sequence: 2, it passes the lower status-slot check and skips this upper bound; however, only the gate-opening transition can explain slot 1, leaving slot 2 unreachable. Checked against applyWorkflowEvent: a subsequent HEAD_OBSERVED is accepted and preserves the corrupt chronology at sequence 3. Extend the upper accounting to awaiting and closed states while reserving their required status-transition slots.

Useful? React with 👍 / 👎.

Match each clearing decision to a distinct gate slot

Fresh evidence after this eligibility fix is an OPEN, revision-0 snapshot with human-decision admissions at sequences 2 and 3 and aggregate sequence 4: both decisions count because each sees the same unstamped slot 1, so the state is accepted and can apply HEAD_OBSERVED. In any real history, the first decision clears the gate opened at slot 1, the second clears nothing, and a gate at slot 4 would leave the workflow awaiting; count decisions only when each can be paired with its own earlier, still-uncleared gate slot.

Useful? React with 👍 / 👎.