@codyswann/lisa 4.70.4 → 4.71.1

package/all/copy-overwrite/scripts/lib/automation-provenance-contract.mjs

@@ -0,0 +1,174 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/** Closed canonical schemas and committed npm policy remain independent of local proof IO. */
+import { requireProof } from "./github-attestation-verifier.mjs";
+
+const FILES = ["package-lock.json", "package.json"];
+const DESCRIPTOR_KEYS = [
+  "author",
+  "claimCommentId",
+  "claimSha256",
+  "committer",
+  "files",
+  "messageSha256",
+  "parent",
+  "policySha256",
+  "proposalKey",
+  "queue",
+  "runAttempt",
+  "runId",
+  "tree",
+  "updates",
+  "version",
+  "workItem",
+];
+const HEX = /^[0-9a-f]{64}$/;
+const OBJECT_ID = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/;
+
+/** Canonical bytes are shared by allocator and consumer, not inferred hashes. */
+export function canonicalJson(value) {
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+  if (value !== null && typeof value === "object") {
+    return `{${Object.keys(value)
+      .sort()
+      .map(key => `${JSON.stringify(key)}:${canonicalJson(value[key])}`)
+      .join(",")}}`;
+  }
+  requireProof(
+    ["string", "boolean", "number"].includes(typeof value) || value === null,
+    "unsupported canonical value"
+  );
+  requireProof(
+    typeof value !== "number" || Number.isFinite(value),
+    "invalid canonical number"
+  );
+  return JSON.stringify(value);
+}
+
+/** Exact keys prevent an unsigned path/command override hiding in a descriptor. */
+export function exactKeys(value, keys, subject) {
+  requireProof(
+    value !== null && typeof value === "object" && !Array.isArray(value),
+    `${subject} is not an object`
+  );
+  requireProof(
+    Object.keys(value).sort().join("\n") === [...keys].sort().join("\n"),
+    `${subject} fields differ`
+  );
+}
+
+/** Policy is committed at the actual proposal base, never a local/env override. */
+export function trustedConfiguration(git) {
+  const config = JSON.parse(git(["show", "HEAD:.lisa.config.json"]));
+  const policy = config.automationProvenance;
+  requireProof(
+    policy?.enabled === true && policy.version === 1,
+    "trusted automation policy is absent"
+  );
+  requireProof(
+    typeof policy.repository === "string" &&
+      /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(policy.repository),
+    "invalid policy repository"
+  );
+  requireProof(
+    [policy.repositoryId, policy.ownerId, policy.claimActorId].every(value =>
+      /^[1-9]\d*$/.test(value)
+    ),
+    "invalid policy identity"
+  );
+  requireProof(
+    typeof policy.signerWorkflow === "string" &&
+      policy.signerWorkflow.endsWith("/.github/workflows/npm-updater.yml") &&
+      OBJECT_ID.test(policy.signerDigest),
+    "invalid trusted signer"
+  );
+  requireProof(
+    typeof policy.callerWorkflow === "string" &&
+      policy.callerWorkflow.startsWith(
+        `${policy.repository}/.github/workflows/`
+      ) &&
+      policy.callerWorkflow.endsWith(".yml"),
+    "invalid caller workflow"
+  );
+  requireProof(
+    Array.isArray(policy.allowedTriggers) &&
+      policy.allowedTriggers.length > 0 &&
+      policy.allowedTriggers.every(value =>
+        ["push", "schedule", "workflow_dispatch"].includes(value)
+      ),
+    "invalid trigger policy"
+  );
+  requireProof(
+    Number.isInteger(policy.maxAgeSeconds) &&
+      policy.maxAgeSeconds > 0 &&
+      policy.maxAgeSeconds <= 86400,
+    "invalid authorization age"
+  );
+  requireProof(HEX.test(policy.ghSha256), "missing official verifier identity");
+  return { config, policy };
+}
+
+/** Updates must be exactly the declared direct npm version changes. */
+export function npmProposal(descriptor, git) {
+  const before = JSON.parse(git(["show", "HEAD:package.json"]));
+  const after = JSON.parse(git(["show", ":package.json"]));
+  const lock = JSON.parse(git(["show", ":package-lock.json"]));
+  requireProof(
+    [2, 3].includes(lock.lockfileVersion) && lock.packages?.[""],
+    "unsupported npm lock"
+  );
+  requireProof(
+    Array.isArray(descriptor.updates) &&
+      descriptor.updates.length > 0 &&
+      descriptor.updates.length <= 64,
+    "invalid update set"
+  );
+  const seen = new Set();
+  for (const update of descriptor.updates) {
+    exactKeys(update, ["name", "section", "from", "to"], "npm update");
+    requireProof(
+      typeof update.name === "string" &&
+        update.name.length <= 214 &&
+        /^(?:@[a-z0-9][a-z0-9_.-]*\/)?[a-z0-9][a-z0-9_.-]*$/.test(update.name),
+      "invalid npm package name"
+    );
+    requireProof(
+      ["dependencies", "devDependencies", "optionalDependencies"].includes(
+        update.section
+      ),
+      "unsupported npm section"
+    );
+    requireProof(
+      [update.from, update.to].every(
+        value =>
+          typeof value === "string" &&
+          /^[~^]?\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/.test(value)
+      ) && update.from !== update.to,
+      "unsupported npm version change"
+    );
+    requireProof(
+      !seen.has(`${update.section}/${update.name}`) &&
+        before[update.section]?.[update.name] === update.from,
+      "duplicate/stale npm update"
+    );
+    seen.add(`${update.section}/${update.name}`);
+    before[update.section][update.name] = update.to;
+    requireProof(
+      lock.packages[""][update.section]?.[update.name] === update.to &&
+        lock.packages[`node_modules/${update.name}`]?.version ===
+          update.to.replace(/^[~^]/, ""),
+      "manifest/lock version differs"
+    );
+  }
+  requireProof(
+    canonicalJson(before) === canonicalJson(after),
+    "manifest changes undeclared fields"
+  );
+  requireProof(
+    lock.name === after.name && lock.version === after.version,
+    "lock root identity differs"
+  );
+}
+
+export { FILES, DESCRIPTOR_KEYS, HEX, OBJECT_ID };

package/all/copy-overwrite/scripts/lib/automation-provenance-local.mjs

@@ -0,0 +1,279 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/** Local proof snapshots and the genuine canonical resolver preserve exact final-read authority. */
+import {
+  constants,
+  closeSync,
+  fstatSync,
+  lstatSync,
+  openSync,
+  readSync,
+} from "node:fs";
+import { dirname, resolve } from "node:path";
+import { TextDecoder } from "node:util";
+import { resolveWorkItemContext, run } from "../lisa-work-item.mjs";
+import { requireProof, sha256 } from "./github-attestation-verifier.mjs";
+import { boundedSpawnSync } from "./bounded-spawn.mjs";
+import {
+  canonicalJson,
+  exactKeys,
+  FILES,
+  DESCRIPTOR_KEYS,
+  HEX,
+  OBJECT_ID,
+} from "./automation-provenance-contract.mjs";
+
+/** Refuse aliases and oversize files; snapshots remain private, regular files. */
+export function privateBytes(file, maximum, privateFile = true) {
+  const fd = openSync(file, constants.O_RDONLY | constants.O_NOFOLLOW);
+  try {
+    const stat = fstatSync(fd);
+    requireProof(
+      stat.isFile() &&
+        stat.size <= maximum &&
+        (!privateFile || (stat.mode & 0o077) === 0),
+      "invalid regular bounded proof file"
+    );
+    const bytes = Buffer.alloc(maximum + 1);
+    let count = 0;
+    while (count < bytes.length) {
+      const added = readSync(fd, bytes, count, bytes.length - count, null);
+      if (added === 0) break;
+      count += added;
+    }
+    requireProof(count <= maximum, "proof file grew beyond limit");
+    return bytes.subarray(0, count);
+  } finally {
+    closeSync(fd);
+  }
+}
+
+/** Git reads always use the actual checkout and bounded shared runner. */
+export function git(args) {
+  return run("git", args, {
+    timeout: 30_000,
+    maxBuffer: 1_048_576,
+  }).stdout.trim();
+}
+
+/** Alias and exact staged-blob checks run after descriptor metadata validation. */
+function stagedFiles(descriptor) {
+  for (const file of FILES) {
+    const entry = git(["ls-files", "--stage", "--", file]);
+    requireProof(
+      entry.startsWith("100644 ") && entry.split("\n").length === 1,
+      "proposal file is not regular stage zero"
+    );
+    const bytes = run("git", ["show", `:${file}`], {
+      timeout: 30_000,
+      maxBuffer: 1_048_576,
+    }).stdout;
+    requireProof(
+      descriptor.files[file] === sha256(bytes),
+      "proposal blob differs"
+    );
+  }
+}
+
+/** Match complete message and Git metadata before any network/proof acceptance. */
+export function localDescriptor(descriptor, messageBytes, reference, policy) {
+  // Parsing never supplies the signed digest. Reject malformed UTF8 only on
+  // this present-proof path; preserve any BOM as part of the actual message.
+  const message = new TextDecoder("utf-8", {
+    fatal: true,
+    ignoreBOM: true,
+  }).decode(messageBytes);
+  exactKeys(descriptor, DESCRIPTOR_KEYS, "descriptor");
+  requireProof(
+    descriptor.version === 1 &&
+      descriptor.runId === reference.runId &&
+      descriptor.runAttempt === reference.runAttempt,
+    "run reference differs"
+  );
+  requireProof(
+    [
+      descriptor.messageSha256,
+      descriptor.claimSha256,
+      descriptor.proposalKey,
+      descriptor.policySha256,
+    ].every(value => typeof value === "string" && HEX.test(value)),
+    "invalid descriptor digest"
+  );
+  requireProof(
+    typeof descriptor.claimCommentId === "string" &&
+      /^[1-9]\d*$/.test(descriptor.claimCommentId),
+    "invalid claim reference"
+  );
+  requireProof(
+    typeof descriptor.queue === "string" &&
+      /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(descriptor.queue),
+    "invalid tracker queue"
+  );
+  requireProof(
+    descriptor.messageSha256 === sha256(messageBytes),
+    "final commit message differs"
+  );
+  requireProof(
+    !/^(?:Co-authored-by|AI-Agent|AI-Model|AI-Effort):/im.test(message),
+    "automation proposal contains AI attribution"
+  );
+  requireProof(
+    descriptor.policySha256 === sha256(canonicalJson(policy)),
+    "trusted policy differs"
+  );
+  requireProof(
+    descriptor.parent === git(["rev-parse", "HEAD"]),
+    "proposal parent differs"
+  );
+  requireProof(
+    OBJECT_ID.test(descriptor.tree) && descriptor.tree === git(["write-tree"]),
+    "final staged tree differs"
+  );
+  requireProof(
+    descriptor.author === git(["var", "GIT_AUTHOR_IDENT"]) &&
+      descriptor.committer === git(["var", "GIT_COMMITTER_IDENT"]),
+    "actual commit identity differs"
+  );
+  const changed = git(["diff", "--cached", "--name-only", "--no-renames"])
+    .split("\n")
+    .sort();
+  requireProof(
+    changed.join("\n") === FILES.join("\n"),
+    "proposal changes foreign files"
+  );
+  exactKeys(descriptor.files, FILES, "proposal files");
+  stagedFiles(descriptor);
+}
+
+/** Snapshot only fixed private proof slots, refusing partial recovery before any authority checks. */
+export function proofSnapshot() {
+  const directory = resolve(
+    git(["rev-parse", "--git-path", "lisa/automation-provenance"])
+  );
+  const stat = lstatSync(directory);
+  requireProof(
+    stat.isDirectory() && !stat.isSymbolicLink() && (stat.mode & 0o077) === 0,
+    "invalid private proof directory"
+  );
+  requireProof(
+    !lstatSync(dirname(directory)).isSymbolicLink(),
+    "aliased proof parent"
+  );
+  const paths = {
+    recovery: resolve(directory, "recovery.json"),
+    recoveryBundle: resolve(directory, "recovery-bundle.json"),
+    descriptor: resolve(directory, "descriptor.json"),
+    bundle: resolve(directory, "bundle.json"),
+  };
+  const optional = [paths.recovery, paths.recoveryBundle].map(file => {
+    try {
+      lstatSync(file);
+      return true;
+    } catch (error) {
+      if (error.code === "ENOENT") return false;
+      throw error;
+    }
+  });
+  requireProof(optional[0] === optional[1], "partial recovery proof");
+  const bytes = privateBytes(paths.descriptor, 65_536);
+  const bundleBytes = privateBytes(paths.bundle, 1_048_576);
+  const descriptor = JSON.parse(bytes.toString("utf8"));
+  requireProof(
+    bytes.toString("utf8") === `${canonicalJson(descriptor)}\n`,
+    "noncanonical/duplicate descriptor fields"
+  );
+
+  return { paths, optional, bytes, bundleBytes, descriptor };
+}
+
+/** Reuse the shipped resolver and retain current canonical lifecycle requirements. */
+export function canonicalContext(message, config, policy, descriptor) {
+  const context = resolveWorkItemContext(message, {
+    config,
+    requireLive: true,
+    execute: (command, args, options) =>
+      run(command === "gh" ? policy.ghExecutable : command, args, {
+        ...options,
+        timeout: 30_000,
+        maxBuffer: 1_048_576,
+        env: { ...process.env, GH_HOST: "github.com" },
+      }),
+  });
+  requireProof(
+    context.provider === "github" &&
+      context.ref === descriptor.workItem &&
+      context.repository === descriptor.queue,
+    "canonical tracker scope differs"
+  );
+  requireProof(
+    context.issue.labels.some(
+      label => label.name === context.lifecycle.claimed
+    ),
+    "canonical leaf is not claimed"
+  );
+  requireProof(
+    !context.issue.labels.some(
+      label =>
+        context.lifecycle.roles.includes(label.name) &&
+        label.name !== context.lifecycle.claimed
+    ),
+    "canonical leaf has a competing lifecycle role"
+  );
+
+  return context;
+}
+
+/** Exact raw object prediction retains origin message, identities and epoch. */
+export function predictedCommit(descriptor, messageBytes) {
+  requireProof(
+    Buffer.isBuffer(messageBytes) &&
+      sha256(messageBytes) === descriptor.messageSha256,
+    "origin message bytes differ"
+  );
+  const headers = `tree ${descriptor.tree}\nparent ${descriptor.parent}\nauthor ${descriptor.author}\ncommitter ${descriptor.committer}\n\n`;
+  const raw = Buffer.concat([Buffer.from(headers), messageBytes]);
+  const options = {
+    encoding: "utf8",
+    timeout: 30_000,
+    maxBuffer: 128,
+  };
+  const format = boundedSpawnSync(
+    "git",
+    ["rev-parse", "--show-object-format"],
+    options
+  );
+  requireProof(
+    !format.error &&
+      !format.signal &&
+      format.status === 0 &&
+      ["sha1\n", "sha256\n"].includes(format.stdout),
+    "current Git object format is unavailable"
+  );
+  const width = format.stdout === "sha1\n" ? 40 : 64;
+  requireProof(
+    [descriptor.parent, descriptor.tree].every(
+      value =>
+        typeof value === "string" &&
+        /^[a-f0-9]+$/.test(value) &&
+        value.length === width
+    ),
+    "origin object format differs"
+  );
+  // Git computes its native identifier; without -w this writes no object.
+  const result = boundedSpawnSync(
+    "git",
+    ["hash-object", "-t", "commit", "--stdin"],
+    { ...options, input: raw }
+  );
+  requireProof(
+    !result.error &&
+      !result.signal &&
+      result.status === 0 &&
+      typeof result.stdout === "string" &&
+      /^[a-f0-9]+\n$/.test(result.stdout) &&
+      result.stdout.length === width + 1,
+    "literal Git commit identity is unavailable"
+  );
+  return result.stdout.slice(0, -1);
+}

package/all/copy-overwrite/scripts/lib/gate-failure-diagnosis.mjs

@@ -854,13 +854,20 @@ function wasKilled(code) {
  * @param {number|null} code The exit code, or null when none was obtained.
  * @param {LoadReading|null} [load] The machine's load at diagnosis time, from
  *   {@link machineLoad}. Omitted or null when it could not be read.
+ * @param {string|null|undefined} nativeSignal Signal observed by the OS supervisor.
  * @returns {Diagnosis} The verdict.
  */
-function killedVerdict(code, load) {
+function killedVerdict(code, load, nativeSignal) {
   const named = SIGNAL_EXITS[code];
+  const observed =
+    code === null && Object.values(SIGNAL_EXITS).includes(nativeSignal)
+      ? nativeSignal
+      : undefined;
   const cause =
     named === undefined
-      ? "a signal, and the runner obtained no exit code for it"
+      ? observed === undefined
+        ? "a signal, and the runner obtained no exit code for it"
+        : `${observed} — native signal; no exit code was returned`
       : `${named} — exit ${code} is 128 + ${code - 128}`;
   return {
     kind: DIAGNOSIS.KILLED,
@@ -1176,8 +1183,8 @@ function emptyTranscriptVerdict() {
  * @param {LoadReading|null} load The machine's load at diagnosis time.
  * @returns {object} What the failure was, before it is attributed.
  */
-function classify(output, code, load, read, tempRoot) {
-  if (wasKilled(code)) return killedVerdict(code ?? null, load);
+function classify(output, code, load, read, tempRoot, nativeSignal) {
+  if (wasKilled(code)) return killedVerdict(code ?? null, load, nativeSignal);
 
   if (typeof output !== "string") return unavailableVerdict();
 
@@ -1636,7 +1643,7 @@ export function declaredFailure(output, declarations) {
  *   when the runner could not capture it.
  * @param {number|null|undefined} [code] The command's exit code. Omitted by a
  *   caller that has none; a caller that HAS one must pass it, because a kill is
- *   only legible in the exit code and never in the output.
+ *   only legible in native status/signal metadata and never in the output.
  * @param {LoadReading|null} [load] The machine's load, for a kill's evidence
  *   line. Defaults to reading this machine; pass `null` to suppress the line,
  *   or a fixed reading to make the output deterministic.
@@ -1663,6 +1670,8 @@ export function declaredFailure(output, declarations) {
  *   triggers a default. `null` is the documented suppression that keeps test
  *   output deterministic, so it must survive. Hence the resolution moved to
  *   the single consuming call site, where the two are still distinguishable.
+ * @param {string|null|undefined} [nativeSignal] Actual OS-observed termination
+ *   signal. It explains a null exit status without manufacturing a numeric one.
  * @returns {Diagnosis} What the failure was, and whose it was.
  */
 export function diagnoseFailure(
@@ -1670,9 +1679,10 @@ export function diagnoseFailure(
   code,
   load = machineLoad(),
   read = readSourceFile,
-  tempRoot
+  tempRoot,
+  nativeSignal
 ) {
-  const verdict = classify(output, code, load, read, tempRoot);
+  const verdict = classify(output, code, load, read, tempRoot, nativeSignal);
   // A verdict that already knows whose property it is keeps that answer. The
   // static table maps a KIND to a gate, which cannot express a failure whose
   // owner is whichever gate declared the shape that matched.