@codyswann/lisa 4.70.4 → 4.71.0

package/scripts/generate-npm-updater-helper-graph.mjs

@@ -0,0 +1,184 @@
+#!/usr/bin/env node
+/** Reproduce the updater's fixed source graph from actual bounded bytes; this grants no runtime authority. */
+import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
+import { lstatSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
+import { isBuiltin } from "node:module";
+import { dirname, join, posix, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { __debug } from "prettier";
+import { invokedAsScript } from "./lib/invoked-as-script.mjs";
+import {
+  managedTemplateMembers,
+  validateHelperManifest,
+  auditControllerClosure,
+  helperManifest,
+} from "../all/copy-overwrite/scripts/lib/npm-update-helper-graph.mjs";
+import {
+  HELPER_CONTROLS,
+  HELPER_PACKAGE_MEMBERS,
+} from "../all/copy-overwrite/scripts/lib/npm-update-helper-inventory.mjs";
+
+const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const OUTPUT = "all/copy-overwrite/scripts/npm-updater-helper-graph.json";
+
+/** Source coordinates bind exceptional nonliteral import handling to exactly the existing canonical expression. */
+function sourceSpan(text, node) {
+  assert(
+    Number.isSafeInteger(node.start) && Number.isSafeInteger(node.end),
+    "genuine AST source coordinates required"
+  );
+  return text.slice(node.start, node.end).replace(/\s/g, "");
+}
+
+function addEdges(node, member, text, target, result) {
+  if (
+    [
+      "ImportDeclaration",
+      "ExportNamedDeclaration",
+      "ExportAllDeclaration",
+    ].includes(node.type) &&
+    node.source
+  )
+    result.staticImports.push(target(node.source.value));
+  const dynamic =
+    node.type === "ImportExpression"
+      ? node.source
+      : node.type === "CallExpression" && node.callee?.type === "Import"
+        ? node.arguments?.[0]
+        : undefined;
+  if (dynamic) {
+    if (["StringLiteral", "Literal"].includes(dynamic.type))
+      result.dynamicImports.push(target(dynamic.value));
+    else {
+      assert(
+        member === "lib/npm-update-helper.mjs" &&
+          sourceSpan(text, node) ===
+            "import(pathToFileURL(join(owner.root,MEMBERS[0])).href)",
+        "unqualified nonliteral helper import"
+      );
+      result.dynamicImports.push(
+        "package/plugins/lisa/scripts/intake-blocker-reprobe.mjs"
+      );
+    }
+  }
+  const child = node.arguments?.[0],
+    base = node.arguments?.[1];
+  if (
+    node.type === "NewExpression" &&
+    node.callee?.name === "URL" &&
+    ["StringLiteral", "Literal"].includes(child?.type) &&
+    typeof child.value === "string" &&
+    base &&
+    sourceSpan(text, base) === "import.meta.url"
+  )
+    result.children.push(target(child.value));
+}
+
+/** The genuine parser supplies all imports and canonical URL children without evaluating member code. */
+export async function auditedHelperEdges(member, bytes) {
+  const text = new TextDecoder("utf8", { fatal: true }).decode(bytes);
+  const result = { staticImports: [], dynamicImports: [], children: [] };
+  const target = specifier =>
+    isBuiltin(specifier)
+      ? specifier.startsWith("node:")
+        ? specifier
+        : `node:${specifier}`
+      : posix.normalize(posix.join(posix.dirname(member), specifier));
+  const visited = new WeakSet();
+  const visit = value => {
+    if (!value || typeof value !== "object" || visited.has(value)) return;
+    visited.add(value);
+    addEdges(value, member, text, target, result);
+    for (const [key, child] of Object.entries(value))
+      if (!["comments", "tokens", "loc", "extra"].includes(key)) {
+        if (Array.isArray(child)) child.forEach(visit);
+        else visit(child);
+      }
+  };
+  if (member.endsWith(".mjs"))
+    visit((await __debug.parse(text, { parser: "babel" })).ast);
+  if (member === "lisa-rails-prepush.mjs") {
+    assert(
+      text.includes('const name = "lisa-work-item.mjs";') &&
+        text.includes("[join(scripts, name), ...args]"),
+      "canonical Rails child declaration changed"
+    );
+    result.children.push("lisa-work-item.mjs");
+  }
+  for (const field of Object.keys(result))
+    result[field] = [...new Set(result[field])].sort((a, b) =>
+      a.localeCompare(b)
+    );
+  return result;
+}
+
+/** Read only fixed current source files. Missing packaged members, aliases and oversized files refuse. */
+function sourceBytes(root, file) {
+  const path = join(root, file),
+    stat = lstatSync(path);
+  assert(
+    path === realpathSync(path) &&
+      stat.isFile() &&
+      !stat.isSymbolicLink() &&
+      stat.size <= 1_048_576,
+    "helper source is missing, aliased or unbounded"
+  );
+  const bytes = readFileSync(path);
+  assert(bytes.length <= 1_048_576, "helper source grew beyond bound");
+  return bytes;
+}
+
+/** Independent controls omit self-inclusive hashes; runtime callers still authenticate them from the pinned owner. */
+export async function generatedHelperGraph(root = ROOT) {
+  const inventory = new Map([
+    ...managedTemplateMembers(),
+    ...HELPER_PACKAGE_MEMBERS.map(member => [
+      member,
+      member.slice("package/".length),
+    ]),
+  ]);
+  const manifest = { version: 1, controls: {}, members: {} },
+    authenticated = new Map();
+  for (const [member, file] of [...inventory].sort(([a], [b]) =>
+    a.localeCompare(b)
+  )) {
+    const bytes = sourceBytes(root, file),
+      edges = await auditedHelperEdges(member, bytes);
+    authenticated.set(member, bytes);
+    if (HELPER_CONTROLS.includes(member)) manifest.controls[member] = edges;
+    else
+      manifest.members[member] = {
+        sha256: createHash("sha256").update(bytes).digest("hex"),
+        ...edges,
+      };
+  }
+  validateHelperManifest(manifest);
+  auditControllerClosure(manifest, authenticated);
+  const bytes = Buffer.from(`${JSON.stringify(manifest, null, 2)}\n`);
+  helperManifest(bytes);
+  return bytes;
+}
+
+async function main() {
+  assert(
+    process.argv.length <= 3 &&
+      (process.argv[2] === undefined || process.argv[2] === "--check"),
+    "usage: generate-npm-updater-helper-graph.mjs [--check]"
+  );
+  const bytes = await generatedHelperGraph();
+  if (process.argv[2] === "--check")
+    assert(
+      readFileSync(join(ROOT, OUTPUT)).equals(bytes),
+      "updater helper graph is stale; regenerate it"
+    );
+  else writeFileSync(join(ROOT, OUTPUT), bytes);
+}
+
+if (invokedAsScript(import.meta.url))
+  main().catch(error => {
+    process.stderr.write(
+      `updater helper graph generation failed: ${error.message}\n`
+    );
+    process.exitCode = 1;
+  });

package/scripts/two-channel-couplings.json

@@ -4,6 +4,10 @@
     "quality.yml::scripts/generate-nightly-e2e-guard-certificate.mjs": "Lisa-source-only branch. Both reusable jobs require `github.repository == 'CodySwannGT/lisa'` before the step can start, and the run body repeats that exact repository guard before checking this artifact path. Ordinary and private host callers therefore skip the step without reading or fetching from their own tree. The scoped branch fetches only the immutable refs needed to behavior-test Lisa's own retained certificate inputs. Ratified because the caller-tree read is unreachable outside this repository, not because an undelivered host dependency is tolerated."
   },
   "staleness": {
+    "npm-updater.yml::scripts/lisa-npm-updater.mjs": {
+      "decision": "warranted",
+      "reason": "Verdict-bearing producer delivered through full Lisa apply, while the reusable workflow is independently pinned by its caller. Exact parent checkout, committed policy and authenticated helper hashes bind the installed producer closure, but do not establish agreement between that closure and this workflow's phase/artifact interface. A superseded installed producer can interpret an independently updated workflow differently. A workflow-to-producer contract handshake is warranted; the obligation is recorded without claiming that npm version selection or helper byte authentication already supplies one."
+    },
     "history-secrets.yml::scripts/lib/history-secret-policy.mjs": {
       "decision": "warranted",
       "reason": "Verdict-bearing required route delivered through full Lisa apply. An absent policy helper fails its import with static actionable guidance; the existence test chooses the emitted or Lisa-source directory and does not measure age. A successful historyPolicy import and required builtin resolution establish capability only. Neither the reusable workflow's contract major nor the pinned Gitleaks binary checksum/version establishes the installed policy/range helper's contract version. A superseded helper could interpret the declaration or required facade differently, so an artifact version handshake is warranted and remains an open obligation rather than a claimed handshake or exemption."
@@ -98,14 +102,14 @@
     }
   },
   "inspected": {
-    "workflows": 24,
-    "steps": 789,
-    "couplings": 34,
-    "inventory": 97
+    "workflows": 25,
+    "steps": 797,
+    "couplings": 35,
+    "inventory": 159
   },
   "counts": {
     "package-backed": 10,
-    "apply-lagged": 22,
+    "apply-lagged": 23,
     "never-delivered": 0,
     "undelivered": 2
   },
@@ -113,13 +117,13 @@
     "version-handshake": 4,
     "capability-probe": 0,
     "existence-only": 5,
-    "no-probe": 13,
+    "no-probe": 14,
     "unchecked": 2
   },
   "decisionCounts": {
     "handshake": 4,
     "not-needed": 11,
-    "warranted": 9
+    "warranted": 10
   },
   "couplings": [
     {
@@ -319,6 +323,26 @@
       ],
       "detail": "`nightly-e2e-tracking.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/reconcile-nightly-e2e-tracking.mjs` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (typescript/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. No existence test guards the read, which is ALL this scan examined of the step's control flow: it did not read anything that could absorb the failure. An absent path most likely fails the job loudly — the better of the two failures, because it is visible — but that is inferred from the missing guard, NOT MEASURED. The step's text carries none of the tokens this scan can see (`else-branch`, `exit-zero`, `exit-nonzero`, `error-annotation`, `notice-annotation`, `failure-suppression`), which is a statement about those names and not about the step's behaviour. STALENESS (a separate dimension from the delivery verdict above): `no-probe`. Neither an existence test nor a version probe bears on this read, so nothing here distinguishes a current artifact from an absent or a superseded one. None of the staleness tokens this scan can see (`artifact-declares-version`, `artifact-answers-version`, `step-requests-version`, `workflow-requests-version`) were found."
     },
+    {
+      "key": "npm-updater.yml::scripts/lisa-npm-updater.mjs",
+      "workflow": "npm-updater.yml",
+      "path": "scripts/lisa-npm-updater.mjs",
+      "channel": "apply",
+      "verdict": "apply-lagged",
+      "remedy": "run-lisa-apply",
+      "guarded": false,
+      "handling": [
+        "exit-nonzero"
+      ],
+      "detection": "no-probe",
+      "stalenessSignals": [],
+      "decision": "warranted",
+      "reason": "Verdict-bearing producer delivered through full Lisa apply, while the reusable workflow is independently pinned by its caller. Exact parent checkout, committed policy and authenticated helper hashes bind the installed producer closure, but do not establish agreement between that closure and this workflow's phase/artifact interface. A superseded installed producer can interpret an independently updated workflow differently. A workflow-to-producer contract handshake is warranted; the obligation is recorded without claiming that npm version selection or helper byte authentication already supplies one.",
+      "lanes": [
+        "all/copy-overwrite"
+      ],
+      "detail": "`npm-updater.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/lisa-npm-updater.mjs` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (all/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. No existence test guards the read, which is ALL this scan examined of the step's control flow: it did not read anything that could absorb the failure. An absent path most likely fails the job loudly — the better of the two failures, because it is visible — but that is inferred from the missing guard, NOT MEASURED. The step's text does carry `exit-nonzero` — located in the step, deliberately NOT related to this read, and enough to make \"it skips silently\" a claim to check rather than assume. STALENESS (a separate dimension from the delivery verdict above): `no-probe`. Neither an existence test nor a version probe bears on this read, so nothing here distinguishes a current artifact from an absent or a superseded one. None of the staleness tokens this scan can see (`artifact-declares-version`, `artifact-answers-version`, `step-requests-version`, `workflow-requests-version`) were found."
+    },
     {
       "key": "publish-to-npm.yml::scripts/check-npm-publish-landed.mjs",
       "workflow": "publish-to-npm.yml",

package/typescript/copy-contents/.husky/commit-msg

@@ -119,6 +119,24 @@ if [ $? -ne 0 ]; then
   exit 1
 fi
 
+# A present automation reference is checked after the ordinary gates. It never
+# waives tracking or commitlint, and malformed proof cannot fall through to AI.
+if grep -qiE '^[[:space:]]*Automation-Provenance[[:space:]]*:' "$COMMIT_MSG_FILE"; then
+  AUTOMATION_SCRIPT="node_modules/@codyswann/lisa/all/copy-overwrite/scripts/lisa-automation-provenance.mjs"
+  if [ ! -f "$AUTOMATION_SCRIPT" ]; then
+    AUTOMATION_SCRIPT="scripts/lisa-automation-provenance.mjs"
+  fi
+  if [ ! -f "$AUTOMATION_SCRIPT" ]; then
+    AUTOMATION_SCRIPT="all/copy-overwrite/scripts/lisa-automation-provenance.mjs"
+  fi
+  if [ ! -f "$AUTOMATION_SCRIPT" ] || ! node "$AUTOMATION_SCRIPT" "$COMMIT_MSG_FILE"; then
+    echo "❌ Commit blocked: invalid automation provenance."
+    exit 1
+  fi
+  echo "Authenticated non-AI automation provenance verified."
+  exit 0
+fi
+
 # Check for Co-Authored-By line (skip for merge commits)
 COMMIT_MSG=$(cat "$COMMIT_MSG_FILE")
 # `printf '%s\n'`, never `echo "$COMMIT_MSG"`. Under a POSIX/XSI `echo` the

package/typescript/copy-overwrite/.prettierignore

@@ -89,6 +89,8 @@ scripts/lisa-gates.mjs
 scripts/lisa-history-secrets.mjs
 scripts/lisa-lint-staged-preflight.mjs
 scripts/lisa-mutation.mjs
+scripts/lisa-automation-provenance.mjs
+scripts/lisa-npm-updater.mjs
 scripts/lisa-postinstall.mjs
 scripts/lisa-rails-prepush.mjs
 scripts/lisa-reconcile-policy.mjs