zeph-core 0.22.3

// SPDX-FileCopyrightText: 2026 Andrei G <bug-ops>
// SPDX-License-Identifier: MIT OR Apache-2.0

use tracing::Instrument as _;

use super::super::{Agent, Channel};

impl<C: Channel> Agent<C> {
    pub(crate) async fn check_trust_transition(&self, skill_name: &str) {
        let span = tracing::info_span!("core.learning.check_trust_transition", skill = skill_name);
        async move {
            if let Err(_elapsed) = tokio::time::timeout(
                std::time::Duration::from_secs(2),
                self.check_trust_transition_inner(skill_name),
            )
            .await
            {
                tracing::warn!(
                    skill = skill_name,
                    "check_trust_transition timed out after 2s"
                );
            }
        }
        .instrument(span)
        .await;
    }

    async fn check_trust_transition_inner(&self, skill_name: &str) {
        let span = tracing::info_span!(
            "core.learning.check_trust_transition_inner",
            skill = skill_name
        );
        async move {
            let Some(memory) = &self.services.memory.persistence.memory else {
                return;
            };
            let Some(config) = &self.services.learning_engine.config else {
                return;
            };
            let Ok(Some(metrics)) = memory.sqlite().skill_metrics(skill_name).await else {
                return;
            };
            let successes = u32::try_from(metrics.successes).unwrap_or(0);
            let failures = u32::try_from(metrics.failures).unwrap_or(0);
            let total = u32::try_from(metrics.total).unwrap_or(0);
            let posterior = zeph_skills::trust_score::posterior_mean(successes, failures);

            if total >= config.auto_promote_min_uses && posterior > config.auto_promote_threshold {
                if !cross_session_rollout_ok(
                    memory,
                    skill_name,
                    config.cross_session_rollout,
                    config.min_sessions_before_promote,
                    "promotion",
                )
                .await
                {
                    return;
                }
                try_auto_promote(memory, skill_name, posterior, total).await;
            }

            if total >= config.auto_demote_min_uses && posterior < config.auto_demote_threshold {
                if !cross_session_rollout_ok(
                    memory,
                    skill_name,
                    config.cross_session_rollout,
                    config.min_sessions_before_demote,
                    "demotion",
                )
                .await
                {
                    return;
                }
                try_auto_demote(memory, skill_name, posterior, total).await;
            }
        }
        .instrument(span)
        .await;
    }
}

/// Returns `true` when cross-session rollout is disabled or enough sessions exist for the
/// given `action` ("promotion" or "demotion").
async fn cross_session_rollout_ok(
    memory: &zeph_memory::semantic::SemanticMemory,
    skill_name: &str,
    cross_session_rollout: bool,
    min_sessions: u32,
    action: &str,
) -> bool {
    if !cross_session_rollout {
        return true;
    }
    match memory.sqlite().distinct_session_count(skill_name).await {
        Ok(sessions) if sessions < i64::from(min_sessions) => {
            tracing::debug!(
                skill = skill_name,
                sessions,
                required = min_sessions,
                "cross-session rollout: insufficient sessions for {action}"
            );
            false
        }
        Ok(_) => true,
        Err(e) => {
            tracing::warn!("cross-session count query failed for {skill_name}: {e:#}");
            true
        }
    }
}

/// Promote a skill to trusted if it is not already trusted or blocked.
async fn try_auto_promote(
    memory: &zeph_memory::semantic::SemanticMemory,
    skill_name: &str,
    posterior: f64,
    total: u32,
) {
    let trust_level = memory
        .sqlite()
        .load_skill_trust(skill_name)
        .await
        .ok()
        .flatten()
        .map(|r| r.trust_level);
    // Skip promotion only if explicitly blocked; promote even if no record exists.
    if trust_level != Some(zeph_common::SkillTrustLevel::Trusted)
        && trust_level != Some(zeph_common::SkillTrustLevel::Blocked)
    {
        tracing::info!(
            skill = skill_name,
            posterior = format!("{posterior:.3}"),
            total,
            "auto-promoting skill to trusted"
        );
        if trust_level.is_none() {
            // No existing record — create one via upsert.
            let _ = memory
                .sqlite()
                .upsert_skill_trust(
                    skill_name,
                    zeph_common::SkillTrustLevel::Trusted,
                    zeph_memory::store::SourceKind::Local,
                    None,
                    None,
                    "",
                )
                .await;
        } else {
            let _ = memory
                .sqlite()
                .set_skill_trust_level(skill_name, zeph_common::SkillTrustLevel::Trusted)
                .await;
        }
    }
}

/// Caps a newly auto-improved skill version's trust at `Quarantined` before activation,
/// instead of letting it silently inherit the pre-existing (possibly `Trusted`) parent
/// trust level. Returns `true` when the cap was written successfully; `false` means the
/// caller must fail closed and skip activation (spec 084 NFR-001).
pub(crate) async fn cap_auto_version_trust(
    memory: &zeph_memory::semantic::SemanticMemory,
    skill_name: &str,
) -> bool {
    // Explicit match, not `.ok().flatten()`: a DB read `Err` must fail closed, not be
    // coerced into "no parent row" — that would silently raise an already-`Blocked` parent
    // to `Quarantined` on a transient read failure (NFR-001).
    let parent_level = match memory.sqlite().load_skill_trust(skill_name).await {
        Ok(row) => row.map(|r| r.trust_level),
        Err(e) => {
            tracing::warn!(
                skill = skill_name,
                error = %e,
                "cap_auto_version_trust: trust read failed, skipping activation (fail-closed)"
            );
            return false;
        }
    };
    let capped = match parent_level {
        Some(level) => level.min_trust(zeph_common::SkillTrustLevel::Quarantined),
        None => zeph_common::SkillTrustLevel::Quarantined,
    };

    let trust_write_result = if parent_level.is_some() {
        memory
            .sqlite()
            .set_skill_trust_level(skill_name, capped)
            .await
    } else {
        memory
            .sqlite()
            .upsert_skill_trust(
                skill_name,
                capped,
                zeph_memory::store::SourceKind::Local,
                None,
                None,
                "",
            )
            .await
            .map(|()| true)
    };

    match trust_write_result {
        Ok(true) => {
            tracing::info!(
                skill = skill_name,
                trust = %capped,
                "store_improved_version: capped auto-improved version trust"
            );
            true
        }
        Ok(false) => {
            tracing::warn!(
                skill = skill_name,
                "store_improved_version: trust write affected no rows, skipping activation (fail-closed)"
            );
            false
        }
        Err(e) => {
            tracing::warn!(
                skill = skill_name,
                error = %e,
                "store_improved_version: trust write failed, skipping activation (fail-closed)"
            );
            false
        }
    }
}

/// Runs the injection scan + trust cap gate that any write of a skill body to the live
/// `SKILL.md` must pass before activation. Shared by `activate_version_and_write`
/// (`/skill activate`, `/skill approve`, `/skill reset`) and ARISE's `arise_store_version` —
/// the choke points, besides `store_improved_version`, where a version can reach production.
///
/// Returns `true` when the caller may proceed to activate + write the body; `false` means
/// hard-blocked (injection scan matched) or fail-closed (trust write error), and the caller
/// must leave the prior activation state untouched.
pub(crate) async fn scan_and_cap_for_activation(
    memory: &zeph_memory::semantic::SemanticMemory,
    skill_name: &str,
    body: &str,
) -> bool {
    let scan = zeph_skills::scanner::scan_skill_body(body);
    if scan.has_matches() {
        tracing::warn!(
            skill = skill_name,
            patterns = ?scan.matched_patterns,
            "scan_and_cap_for_activation: hard-blocking activation, injection scan matched"
        );
        return false;
    }
    cap_auto_version_trust(memory, skill_name).await
}

/// Demote a skill to quarantined if it is currently trusted or verified.
async fn try_auto_demote(
    memory: &zeph_memory::semantic::SemanticMemory,
    skill_name: &str,
    posterior: f64,
    total: u32,
) {
    let Ok(Some(trust_row)) = memory.sqlite().load_skill_trust(skill_name).await else {
        return;
    };
    if trust_row.trust_level == zeph_common::SkillTrustLevel::Trusted
        || trust_row.trust_level == zeph_common::SkillTrustLevel::Verified
    {
        tracing::warn!(
            skill = skill_name,
            posterior = format!("{posterior:.3}"),
            total,
            "auto-demoting skill to quarantined"
        );
        let _ = memory
            .sqlite()
            .set_skill_trust_level(skill_name, zeph_common::SkillTrustLevel::Quarantined)
            .await;
    }
}