@arjunkhera/atlas 0.4.42 → 0.4.43

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "atlas",
-  "version": "0.4.42",
+  "version": "0.4.43",
   "description": "Atlas: the delivery lifecycle, its crews and the Atlas tools, for any repository.",
   "author": {
     "name": "Arjun Khera"

package/door/lib/approve.mjs

@@ -34,6 +34,7 @@ import { ghApi, pinnedRuns } from './gate.mjs';
 import { GATE_CHECK } from './gate-check.mjs';
 import {
   ACTS, MAX_ACTS, AUDIT_CHECK, AUDIT_TEST, NAMESPACE, SIGNERS_FILE, payloadText, blockText, parseSigners, verifyBlock, verifyTexts, fingerprint, wordsFingerprint, SignedActError,
+  preKeyKeys,
 } from './signed-act.mjs';
 
 export class ApproveError extends Error {}
@@ -303,7 +304,7 @@ export function auditCause(deps, repo, { run, sha, pr, main }) {
 
 // One open audit issue, read from GitHub: the pull request that made the
 // merge, its head, and the red audit run. `skip` says why it is not signed.
-export function auditRow(deps, repo, issue, main, kinds = new Map()) {
+export async function auditRow(deps, repo, issue, main, kinds = new Map()) {
   const sha = AUDIT_ISSUE.exec(String(issue.title ?? ''))[1];
   const row = { issue: Number(issue.number), sha };
   const pull = (deps.gh('GET', `repos/${repo}/commits/${sha}/pulls`) ?? []).find((each) => each?.merged_at && each.merge_commit_sha === sha);
@@ -327,9 +328,17 @@ export function auditRow(deps, repo, issue, main, kinds = new Map()) {
   if (own) return { ...row, skip: `the merge changed ${own}, so its audit ran its own code: sign it by hand` };
   const parent = String(commit?.parents?.[0]?.sha ?? '');
   if (!/^[0-9a-f]{40}$/.test(parent)) return { ...row, skip: 'GitHub gave no parent of the merge commit' };
-  const keys = mergeKeys(deps, repo, parent, head);
-  if (!keys.length) return { ...row, skip: `${SIGNERS_FILE} on the base of this merge holds no owner key, so no act can count: close the issue by hand` };
-  return { ...row, run: String(run.id), keys };
+  let keys = mergeKeys(deps, repo, parent, head);
+  // Item 65c6c907: a merge made before the first owner key takes the keys
+  // at the tip of the default branch, within the limits of preKeyKeys.
+  let first = null;
+  if (!keys.length) {
+    const read = (path) => { try { return deps.gh('GET', path); } catch (error) { if (error?.status === 404 || /HTTP 404|Not Found/i.test(String(error?.message ?? ''))) return null; throw error; } };
+    try { first = await preKeyKeys(read, repo, { parent, branch: main }); } catch (error) { first = { why: `GitHub refused a read of the key file history (${plainText(error?.message ?? error).slice(0, 120)})` }; }
+    if (first.keys) keys = first.keys;
+  }
+  if (!keys.length) return { ...row, skip: `${SIGNERS_FILE} on the base of this merge holds no owner key, so no act can count: close the issue by hand. No first key counts: ${first?.why ?? 'no reason'}` };
+  return { ...row, run: String(run.id), keys, ...(first?.from ? { first_key: first.from } : {}) };
 }
 
 // `atlas approve audit [<pr>...]`. Exit 0 when each listed red got its act.
@@ -369,7 +378,7 @@ export async function approveAudit({ prs = [], repo, root, key, provider, yes =
   line(`  ${issues.length} open audit issue(s) of an owner merge with no touch. Each one can take about 5 seconds.`);
   const rows = [];
   for (const issue of issues) {
-    const row = auditRow(deps, name, issue, main, kinds);
+    const row = await auditRow(deps, name, issue, main, kinds);
     if (only.size && !only.has(row.pr)) continue;
     rows.push(row);
   }
@@ -378,6 +387,7 @@ export async function approveAudit({ prs = [], repo, root, key, provider, yes =
   for (const row of rows) {
     line(`  issue #${row.issue}  ${row.pr ? `#${row.pr}` : row.sha.slice(0, 7)}${row.head ? ` at ${row.head.slice(0, 7)}` : ''}${row.merged_at ? `  merged ${row.merged_at}` : ''}  ${row.skip ? 'NOT SIGNED' : 'SIGN'}  ${row.title ?? ''}`.trimEnd());
     if (row.skip) line(`      ${row.skip}`);
+    else if (row.first_key) line(`      merged before the first owner key: the act counts against the keys at the tip of ${main}, ${row.first_key.slice(0, 7)}`);
   }
   if (only.size) for (const pr of only) if (!rows.some((row) => row.pr === pr)) line(`  #${pr} has no open audit issue: nothing to accept.`);
   if (!sign.length) { line('Nothing to sign: no open audit red can take an act.'); return 1; }

package/door/lib/signed-act.mjs

@@ -351,3 +351,67 @@ export function findAct(verified, want) {
   }
   return null;
 }
+
+// Item 65c6c907: the owner keys for a merge made before the first owner key.
+// Such a merge can take no act against the keys of its base, so its audit
+// red would block its item for good. It may take an accept act against the
+// keys of the default branch at its tip now, within four limits:
+//   1. No version of the key file in the history of the base held a key, so
+//      a key that was removed later never opens this path. A version that
+//      cannot be read counts as one that held a key.
+//   2. The tip is the branch ref, resolved to a commit (refs/heads only, so a
+//      tag with the same name changes nothing). The caller passes the default
+//      branch of the repo.
+//   3. Only a tip key that every keyed version of the file in the history of
+//      the tip holds counts. A key pushed after the first owner key, by anyone
+//      who can push to the branch, never counts here (security round 2, S2).
+//   4. A history that cannot be read in full counts as no history: no keys.
+// GitHub's history of a path leaves out a commit whose change did not reach
+// the branch line (history simplification); limits 1 and 3 hold for the rest.
+// `read(path)` answers GitHub's JSON for a GET, or null for a 404; it may
+// answer a promise. Returns { keys, from } or { why }.
+export const HISTORY_PAGES = 3;
+export const signersHistoryPath = (repo, sha, page) => `repos/${repo}/commits?path=${encodeURIComponent(SIGNERS_FILE)}&sha=${sha}&per_page=100&page=${page}`;
+export async function preKeyKeys(read, repo, { parent, branch }) {
+  const fileAt = async (sha) => {
+    const file = await read(`repos/${repo}/contents/${SIGNERS_FILE}?ref=${sha}`);
+    if (!file || typeof file.content !== 'string' || file.encoding !== 'base64') return null;
+    return parseSigners(Buffer.from(file.content, 'base64').toString('utf8')).keys;
+  };
+  // Each commit that changed the key file, from `sha` back; null when the
+  // history cannot be read in full.
+  const history = async (sha) => {
+    const shas = [];
+    for (let page = 1; page <= HISTORY_PAGES; page += 1) {
+      const rows = await read(signersHistoryPath(repo, sha, page));
+      if (!Array.isArray(rows) || rows.some((row) => !/^[0-9a-f]{40}$/.test(String(row?.sha ?? '')))) return null;
+      shas.push(...rows.map((row) => row.sha));
+      if (rows.length < 100) return shas;
+    }
+    return null;
+  };
+  if (!/^[0-9a-f]{40}$/.test(String(parent ?? ''))) return { why: 'no base commit is named' };
+  if (!/^[A-Za-z0-9._-]{1,100}$/.test(String(branch ?? '')) || String(branch).includes('..')) return { why: 'no branch is named' };
+  const before = await history(parent);
+  if (!before) return { why: `the history of ${SIGNERS_FILE} before the merge could not be read in full` };
+  for (const sha of before) {
+    const keys = await fileAt(sha);
+    if (keys === null) return { why: `${SIGNERS_FILE} at ${sha.slice(0, 7)}, before the merge, could not be read` };
+    if (keys.length) return { why: `${SIGNERS_FILE} held a key at ${sha.slice(0, 7)}, before the merge` };
+  }
+  const ref = await read(`repos/${repo}/git/ref/heads/${branch}`);
+  const tip = String(ref?.object?.sha ?? '');
+  if (ref?.ref !== `refs/heads/${branch}` || !/^[0-9a-f]{40}$/.test(tip)) return { why: `the tip of ${branch} could not be read` };
+  const atTip = await fileAt(tip);
+  if (!atTip?.length) return { why: `${SIGNERS_FILE} at the tip of ${branch} holds no owner key` };
+  const since = await history(tip);
+  if (!since) return { why: `the history of ${SIGNERS_FILE} at the tip of ${branch} could not be read in full` };
+  let keys = atTip;
+  for (const sha of since) {
+    const held = await fileAt(sha);
+    if (held === null) return { why: `${SIGNERS_FILE} at ${sha.slice(0, 7)}, before the tip of ${branch}, could not be read` };
+    if (held.length) keys = keys.filter((key) => held.some((one) => one.fingerprint === key.fingerprint));
+  }
+  if (!keys.length) return { why: `no key at the tip of ${branch} is in every keyed version of ${SIGNERS_FILE}` };
+  return { keys, from: tip };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arjunkhera/atlas",
-  "version": "0.4.42",
+  "version": "0.4.43",
   "description": "Atlas: the delivery lifecycle, its crews and the Atlas tools, as a Claude Code plugin for any repository.",
   "type": "module",
   "license": "UNLICENSED",

package/work/lib/delivery.mjs

@@ -16,7 +16,7 @@ import { refuse, text, isoDate, url, stringList, sha256, repoKinds, LIVE_KINDS }
 import { oneLine, ROW_LINE_MAX, priorityOrderOf, byPriority, orderNote, waitsOnLine, blockersOf, blocksOf, blockedPhrase, waitsShown } from './questions.mjs';
 import { parseYaml } from '../../shape/check.mjs';
 import { ACTIONS_APP_ID } from '../../door/lib/gate.mjs';
-import { MARKER as SIGNED_MARKER, SIGNERS_FILE, parseSigners, verifyTexts, findAct, wordsFingerprint, AUDIT_CHECK, AUDIT_CHECKS, AUDIT_TEST } from '../../door/lib/signed-act.mjs';
+import { MARKER as SIGNED_MARKER, SIGNERS_FILE, parseSigners, verifyTexts, findAct, wordsFingerprint, AUDIT_CHECK, AUDIT_CHECKS, AUDIT_TEST, preKeyKeys } from '../../door/lib/signed-act.mjs';
 
 export const DELIVERY_WRITE_VERBS = Object.freeze(['item_done', 'item_reopen']);
 export const DELIVERY_READ_VERBS = Object.freeze(['in_flight']);
@@ -462,8 +462,20 @@ export function createDeliveryVerbs(core) {
       return parseSigners(file && typeof file.content === 'string' ? Buffer.from(file.content, 'base64').toString('utf8') : '').keys;
     };
     const atFork = forkPoint.toLowerCase() === parent.toLowerCase() ? null : new Set((await keysAt(forkPoint)).map((key) => key.fingerprint));
-    const keys = (await keysAt(parent)).filter((key) => !atFork || atFork.has(key.fingerprint));
-    if (!keys.length) refuse(`accepted_red needs the owner's signed waiver, and ${SIGNERS_FILE} on the base of ${pull.url} holds no owner key`);
+    let keys = (await keysAt(parent)).filter((key) => !atFork || atFork.has(key.fingerprint));
+    // Item 65c6c907: a merge made before the first owner key. Only an accept
+    // act for the push audit red may count, against the keys at the tip of
+    // the default branch (preKeyKeys in signed-act.mjs holds the limits). The
+    // audit runs only on the default branch, so the merge must be into it.
+    let prekey = null;
+    if (!keys.length && check === AUDIT_CHECK && testName === AUDIT_TEST) {
+      const main = (await github(`repos/${pull.repo}`))?.default_branch;
+      prekey = typeof main === 'string' && main === pull.base
+        ? await preKeyKeys(githubOrNull, pull.repo, { parent, branch: main })
+        : { why: `${pull.url} did not merge into the default branch` };
+      if (prekey.keys) keys = prekey.keys;
+    }
+    if (!keys.length) refuse(`accepted_red needs the owner's signed waiver, and ${SIGNERS_FILE} on the base of ${pull.url} holds no owner key${prekey?.why ? `; no first key counts either: ${prekey.why}` : ''}`);
     const texts = [];
     for (let page = 1; page <= 10; page += 1) {
       const rows = await github(`repos/${pull.repo}/issues/${pull.number}/comments?per_page=100&page=${page}`);
@@ -472,7 +484,7 @@ export function createDeliveryVerbs(core) {
     }
     const verified = verifyTexts(texts, keys);
     const words = typeof decision.fields?.text === 'string' ? decision.fields.text : '';
-    let found = findAct(verified, { kind: 'waiver', repo: pull.repo, pr: pull.number, head, decision: decisionId, check });
+    let found = prekey ? null : findAct(verified, { kind: 'waiver', repo: pull.repo, pr: pull.number, head, decision: decisionId, check });
     // An accept act takes only the push audit's red of an owner merge
     // (security review S3). Its words name no decision, so exactly one
     // standing decision may hold them: a second decision with the same words
@@ -491,7 +503,7 @@ export function createDeliveryVerbs(core) {
       const why = verified.find((row) => row.error)?.error;
       refuse(`accepted_red needs the owner's signed waiver on ${pull.url} for check ${check}, head ${head.slice(0, 12)} and decision ${decisionId}; none counts${why ? ` (a block was refused: ${why})` : ''}. The owner runs: atlas approve act waiver, and posts the block on the pull request; or, for an audit red, atlas approve audit, and the decision holds the words it printed`);
     }
-    return { key: found.key, signed_at: found.signed_at, act: found.act.kind, ...(found.act.kind === 'accept' ? { run: String(found.act.run) } : {}) };
+    return { key: found.key, signed_at: found.signed_at, act: found.act.kind, ...(found.act.kind === 'accept' ? { run: String(found.act.run) } : {}), ...(prekey?.from ? { first_key: prekey.from } : {}) };
   }
 
   async function acceptedRed(value, pulls, item) {

package/work/mcp.mjs

@@ -221,6 +221,10 @@ export const GITHUB_READS = Object.freeze([
   // owner's key file on the base of its merge.
   new RegExp(`^repos/${REPO}/issues/\\d{1,9}/comments\\?per_page=100&page=\\d{1,2}$`),
   new RegExp(`^repos/${REPO}/contents/atlas/owner-signers\\?ref=[0-9a-fA-F]{40}$`),
+  // Item 65c6c907: for a merge made before the first owner key, the history
+  // of the key file on a commit, and the branch ref (heads only) of the tip.
+  new RegExp(`^repos/${REPO}/commits\\?path=atlas%2Fowner-signers&sha=[0-9a-f]{40}&per_page=100&page=[1-3]$`),
+  new RegExp(`^repos/${REPO}/git/ref/heads/${BRANCH}$`),
   // Roadmap R16: the numbers page past 100 pull requests, and read the
   // files of each merge to find a changed test.
   new RegExp(`^repos/${REPO}/pulls\\?state=all&sort=updated&direction=desc&per_page=\\d{1,3}&page=\\d{1,3}$`),