@codyswann/lisa 4.70.4 → 4.71.1

package/all/copy-overwrite/scripts/lib/npm-update-publication.mjs

@@ -0,0 +1,258 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/** Current-head checks and human approval retain their real integration and reviewer identities. @module npm-updater */
+import { workItemLines } from "../lisa-work-item.mjs";
+import { required } from "./npm-update-contract.mjs";
+import {
+  sha256,
+  verifyDescriptorAttestation,
+  verifyCurrentProvider,
+} from "./github-attestation-verifier.mjs";
+import { canonicalJson } from "../lisa-automation-provenance.mjs";
+import { readJson, readBytes } from "./npm-update-process.mjs";
+import { existsSync } from "node:fs";
+import { verifyRecoveryOrigin } from "./github-attestation-recovery.mjs";
+
+/** Fixed distinct proof slots select origin or recovery; partial authority always refuses. */
+export function publicationProof(
+  api,
+  descriptor,
+  proof,
+  proposal,
+  policy,
+  issue,
+  commit
+) {
+  required(
+    canonicalJson(readJson(proof.descriptor, 65_536)) ===
+      canonicalJson(descriptor),
+    "publication descriptor bytes differ"
+  );
+  const digest = sha256(readBytes(proof.descriptor, 65_536));
+  const recovery = Boolean(proof.recovery && existsSync(proof.recovery));
+  const bundle = Boolean(
+    proof.recoveryBundle && existsSync(proof.recoveryBundle)
+  );
+  required(recovery === bundle, "partial publication recovery authority");
+  if (recovery) {
+    verifyRecoveryOrigin(
+      api.policy,
+      descriptor,
+      readJson(proof.recovery, 65_536),
+      digest,
+      proof,
+      {
+        npmPolicySha256: proposal.policySha256,
+        proposalKey: proposal.key,
+        leafBodySha256: sha256(issue.body),
+        commit: commit.sha,
+        maintainer: policy.maintainer,
+        recoverySha256: sha256(readBytes(proof.recovery, 65_536)),
+      }
+    );
+  } else {
+    verifyDescriptorAttestation(api.policy, descriptor, proof, digest);
+    verifyCurrentProvider(api.policy, descriptor);
+  }
+}
+
+/** The publisher consumes evidence of the actual ordinary commit and both original hook streams. */
+export function ordinaryGateReceipt(
+  context,
+  object,
+  hook,
+  streams,
+  destination,
+  remote
+) {
+  return {
+    raw: object.raw.toString("base64"),
+    receipt: {
+      version: 1,
+      proposalKey: context.proposal.key,
+      parent: context.proposal.parent,
+      tree: context.preview.descriptor.tree,
+      commit: object.head,
+      commitExit: object.committed.code,
+      pushExit: streams.destination.exit,
+      refs: streams.destination.refs,
+      audit: streams.audit,
+      destination: streams.destination,
+      destinationHead: destination.expectedBranchHead,
+      remote,
+      range: object.ranges,
+      hookSha256: hook.sourceSha256,
+      hookManager: hook.manager,
+      hookSource: hook.source,
+      hookWrapperSha256: hook.wrapperSha256,
+      commitLogSha256: sha256(
+        Buffer.concat([object.committed.stdout, object.committed.stderr])
+      ),
+      pushLogSha256: streams.destination.logSha256,
+    },
+  };
+}
+
+/** Original writer commands retain independent current authorization at each boundary. */
+export async function publicationBacklink(
+  { api, cwd, proposal, allocation, commit, authorize, controller },
+  pr
+) {
+  await authorize();
+  await api.workItem(
+    cwd,
+    ["backlink", "--ref", allocation.workItem, "--pr-url", pr.html_url],
+    { ...controller, proposal, allocation, commit, pr }
+  );
+  await authorize();
+  await api.workItem(
+    cwd,
+    [
+      "validate-pr",
+      "--base",
+      proposal.parent,
+      "--head",
+      commit.sha,
+      "--pr-number",
+      String(pr.number),
+      "--repo",
+      proposal.repository,
+      "--pr-url",
+      pr.html_url,
+    ],
+    { ...controller, proposal, allocation, commit, pr }
+  );
+}
+
+/** A fixed snapshot refuses foreign existing refs or PRs before any mutation. */
+export async function destinationSnapshot(api, proposal, allocation, commit) {
+  const branch = `lisa/npm-${proposal.key}`;
+  const ref = await api.maybe(
+    `repos/${proposal.repository}/git/ref/heads/${branch}`
+  );
+  required(
+    !ref ||
+      (ref.ref === `refs/heads/${branch}` &&
+        ref.object?.type === "commit" &&
+        ref.object.sha === commit),
+    "foreign proposal branch is preserved"
+  );
+  const pulls = await api.list(
+    `repos/${proposal.repository}/pulls?state=all&head=${encodeURIComponent(`${proposal.repository.split("/")[0]}:${branch}`)}`
+  );
+  required(pulls.length <= 1, "ambiguous proposal PRs are preserved");
+  const pr = pulls[0];
+  if (pr)
+    required(
+      ref &&
+        Number.isSafeInteger(pr.number) &&
+        pr.number > 0 &&
+        pr.html_url ===
+          `https://github.com/${proposal.repository}/pull/${pr.number}` &&
+        pr.state === "open" &&
+        pr.head?.sha === commit &&
+        pr.head?.ref === branch &&
+        pr.head?.repo?.full_name === proposal.repository &&
+        pr.base?.ref === "main" &&
+        pr.base?.repo?.full_name === proposal.repository &&
+        pr.body === publicationBody(allocation),
+      "foreign/closed/changed proposal PR is preserved"
+    );
+  return {
+    branch,
+    expectedBranchHead: ref?.object.sha ?? null,
+    prNumber: pr?.number ?? null,
+    expectedPrHead: pr?.head.sha ?? null,
+  };
+}
+
+/** The declaration is complete and the relationship waits for postmerge verification. */
+export function publicationBody(allocation) {
+  const body = `${allocation.draft.body}\nWork-Item: ${allocation.workItem}\n\nRelates to https://github.com/${allocation.workItem.replace("#", "/issues/")}\n`;
+  const closing = [
+    ...body.matchAll(/\b(?:close[sd]?|fix(?:e[sd])?|resolve[sd]?)\s+/gi),
+  ];
+  const references = [
+    /^#[1-9]\d*\b/,
+    /^[\w.-]+\/[\w.-]+#[1-9]\d*\b/,
+    /^https:\/\/github\.com\/[\w.-]+\/[\w.-]+\/issues\/[1-9]\d*\b/,
+  ];
+  required(
+    !closing.some(match =>
+      references.some(expression =>
+        expression.test(body.slice(match.index + match[0].length))
+      )
+    ),
+    "premature closing relationship is forbidden"
+  );
+  const declaredReferences = workItemLines(body);
+  required(
+    declaredReferences.length === 1 &&
+      declaredReferences[0] === allocation.workItem,
+    "complete PR declaration differs"
+  );
+  return body;
+}
+
+/** Default Actions policy may forbid creation; activation belongs to the operator. */
+export function assertPublicationPolicy(value) {
+  required(
+    value.can_approve_pull_request_reviews === true,
+    "Actions pull-request creation is disabled; explicitly activate repository Actions PR creation before retrying"
+  );
+}
+
+/** Current-head success and real human approval cannot be supplied by stale/skip records. */
+export function assertPublication(pr, checks, reviews, sha, requirements = []) {
+  required(
+    pr.state === "open" && pr.head?.sha === sha && pr.base?.ref === "main",
+    "current-head PR differs"
+  );
+  required(
+    checks.length > 0 && requirements.length > 0,
+    "required current-head checks are not qualified"
+  );
+  required(
+    requirements.every(requirement =>
+      successfulCheck(checks, requirement, sha)
+    ),
+    "required current-head checks are incomplete"
+  );
+  const latest = new Map();
+  for (const review of [...reviews].sort((left, right) => left.id - right.id))
+    if (review.user?.type === "User") latest.set(review.user.id, review);
+  required(
+    ![...latest.values()].some(
+      review => review.state === "CHANGES_REQUESTED"
+    ) &&
+      [...latest.values()].some(
+        review => review.state === "APPROVED" && review.commit_id === sha
+      ),
+    "genuine current-head human approval is pending"
+  );
+}
+
+/** The newest run from the exact required integration must succeed on this head. */
+function successfulCheck(checks, requirement, sha) {
+  required(
+    requirement &&
+      typeof requirement.name === "string" &&
+      Number.isSafeInteger(requirement.appId) &&
+      requirement.appId > 0,
+    "required check integration identity is unresolved"
+  );
+  const matches = checks.filter(
+    check =>
+      check.name === requirement.name &&
+      check.app?.id === requirement.appId &&
+      check.head_sha === sha
+  );
+  required(
+    matches.every(check => Number.isSafeInteger(check.id) && check.id > 0) &&
+      new Set(matches.map(check => check.id)).size === matches.length,
+    "ambiguous current check execution"
+  );
+  const latest = matches.sort((left, right) => right.id - left.id)[0];
+  return latest?.status === "completed" && latest.conclusion === "success";
+}

package/all/copy-overwrite/scripts/lib/npm-update-publish.mjs

@@ -0,0 +1,254 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/** Durable proof and exact gated raw-object publication. @module npm-updater */
+import { canonicalJson } from "../lisa-automation-provenance.mjs";
+import {
+  required,
+  validateProposal,
+  validateRawCommit,
+} from "./npm-update-contract.mjs";
+import {
+  authorizeAllocation,
+  destinationSnapshot,
+} from "./npm-update-authorization.mjs";
+import { runProcess } from "./npm-update-process.mjs";
+import { descriptorFor } from "./npm-update-gate.mjs";
+import { assertGateTransport } from "./npm-update-gate-hooks.mjs";
+import {
+  publicationBody,
+  publicationBacklink,
+  publicationProof,
+} from "./npm-update-publication.mjs";
+export {
+  publicationBody,
+  assertPublicationPolicy,
+  assertPublication,
+} from "./npm-update-publication.mjs";
+
+/** Create an absent exact ref only after a second live destination and authority read. */
+async function destinationRef(api, proposal, allocation, commit, authorize) {
+  const path = `repos/${proposal.repository}`;
+  await authorize();
+  let snapshot = await destinationSnapshot(
+    api,
+    proposal,
+    allocation,
+    commit.sha
+  );
+  if (snapshot.expectedBranchHead === null) {
+    await authorize();
+    snapshot = await destinationSnapshot(api, proposal, allocation, commit.sha);
+    required(
+      snapshot.expectedBranchHead === null && snapshot.prNumber === null,
+      "publication destination changed before ref creation"
+    );
+    const ref = await api.request(`${path}/git/refs`, "POST", {
+      ref: `refs/heads/${snapshot.branch}`,
+      sha: commit.sha,
+    });
+    required(
+      ref.ref === `refs/heads/${snapshot.branch}` &&
+        ref.object?.type === "commit" &&
+        ref.object.sha === commit.sha,
+      "published ref differs"
+    );
+    snapshot = await destinationSnapshot(api, proposal, allocation, commit.sha);
+    required(
+      snapshot.expectedBranchHead === commit.sha,
+      "published ref readback differs"
+    );
+  }
+  return snapshot;
+}
+
+/** Resume the exact owned ref/PR and repair only its supported managed backlink. */
+export async function publishDestination({
+  api,
+  cwd,
+  proposal,
+  allocation,
+  commit,
+  authorize,
+  controller,
+}) {
+  const snapshot = await destinationRef(
+    api,
+    proposal,
+    allocation,
+    commit,
+    authorize
+  );
+  const path = `repos/${proposal.repository}`;
+  let pr;
+  if (snapshot.prNumber === null) {
+    await authorize();
+    const current = await destinationSnapshot(
+      api,
+      proposal,
+      allocation,
+      commit.sha
+    );
+    required(
+      current.prNumber === null,
+      "publication PR appeared before creation"
+    );
+    pr = await api.request(`${path}/pulls`, "POST", {
+      title: allocation.draft.title,
+      head: snapshot.branch,
+      base: "main",
+      body: publicationBody(allocation),
+    });
+  } else pr = await api.request(`${path}/pulls/${snapshot.prNumber}`);
+  const readback = await destinationSnapshot(
+    api,
+    proposal,
+    allocation,
+    commit.sha
+  );
+  required(
+    readback.prNumber === pr.number &&
+      pr.base?.sha === proposal.parent &&
+      pr.user?.type === "Bot" &&
+      pr.user.login === "github-actions[bot]",
+    "actual publisher identity or immutable PR base differs"
+  );
+  await publicationBacklink(
+    { api, cwd, proposal, allocation, commit, authorize, controller },
+    pr
+  );
+  return {
+    status: "published-awaiting-review",
+    number: pr.number,
+    url: pr.html_url,
+    commit: commit.sha,
+    base: proposal.parent,
+    publisher: pr.user.login,
+  };
+}
+
+/** The publisher consumes signed/gated data and writes only an identical two-file commit. */
+export async function publishProposal({
+  api,
+  proposal,
+  policy,
+  config,
+  allocation,
+  descriptor,
+  proof,
+  receipt,
+  raw,
+  cwd,
+}) {
+  const deadline = Date.now() + 900_000;
+  validateProposal(proposal, policy);
+  const commit = validateRawCommit(raw, descriptor, cwd);
+  required(
+    descriptor.parent === proposal.parent &&
+      descriptor.proposalKey === proposal.bindingKey &&
+      canonicalJson(descriptor.files) === canonicalJson(proposal.hashes) &&
+      canonicalJson(descriptor.updates) === canonicalJson(proposal.updates) &&
+      descriptor.workItem === allocation.workItem &&
+      descriptor.claimCommentId === allocation.claimCommentId,
+    "signed proposal allocation differs"
+  );
+  required(
+    receipt.commit === commit.sha &&
+      receipt.tree === descriptor.tree &&
+      receipt.parent === proposal.parent &&
+      receipt.proposalKey === proposal.key &&
+      receipt.commitExit === 0 &&
+      receipt.pushExit === 0,
+    "ordinary gate receipt differs"
+  );
+  assertGateTransport(
+    receipt,
+    `lisa/npm-${proposal.key}`,
+    commit.sha,
+    proposal.parent,
+    receipt.destinationHead
+  );
+  required(
+    receipt.remote === `https://github.com/${policy.repository}.git` &&
+      receipt.refs === receipt.destination.refs &&
+      canonicalJson(receipt.range) === canonicalJson([commit.sha]),
+    "gated transport range differs"
+  );
+  const authorize = async () => {
+    const issue = await authorizeAllocation(
+      api,
+      proposal,
+      allocation,
+      policy,
+      config
+    );
+    await destinationSnapshot(api, proposal, allocation, commit.sha);
+    publicationProof(api, descriptor, proof, proposal, policy, issue, commit);
+    return issue;
+  };
+  await authorize();
+  await publicationObjects(
+    cwd,
+    proposal,
+    policy,
+    config,
+    allocation,
+    descriptor,
+    raw,
+    commit
+  );
+  await api.gitCommit(proposal, descriptor, commit, authorize, cwd);
+  return publishDestination({
+    api,
+    cwd,
+    proposal,
+    allocation,
+    commit,
+    authorize,
+    controller: { config, policy, descriptor, proof, deadline },
+  });
+}
+
+/** Reconstruct local objects as Git data so the original validator reads the complete range. */
+export async function publicationObjects(
+  cwd,
+  proposal,
+  policy,
+  config,
+  allocation,
+  descriptor,
+  raw,
+  commit
+) {
+  const preview = await descriptorFor({
+    cwd,
+    proposal,
+    policy,
+    automation: config.automationProvenance,
+    allocation,
+    runId: descriptor.runId,
+    runAttempt: descriptor.runAttempt,
+    epoch: Number(descriptor.author.split(" ").at(-2)),
+  });
+  required(
+    canonicalJson(preview.descriptor) === canonicalJson(descriptor),
+    "publisher original object reconstruction differs"
+  );
+  const result = await runProcess(
+    "git",
+    ["hash-object", "-t", "commit", "-w", "--stdin"],
+    {
+      cwd,
+      env: {
+        PATH: process.env.PATH,
+        HOME: "/nonexistent",
+        GIT_TERMINAL_PROMPT: "0",
+      },
+      input: raw,
+    }
+  );
+  required(
+    result.stdout.toString().trim() === commit.sha,
+    "publisher local raw object differs"
+  );
+}

package/all/copy-overwrite/scripts/lib/npm-update-quality.mjs

@@ -0,0 +1,153 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/** Twenty-five fixed writer checks retain semantic quality independently of storage. */
+import { required } from "./npm-update-contract.mjs";
+import { environment, buildDraft } from "./npm-update-leaf-contract.mjs";
+
+/** Core Task fields are validated independently of provider storage. */
+function coreChecks(draft, body, policy) {
+  return [
+    [
+      "S1",
+      Boolean(draft.title && body && policy.repository),
+      "complete Task core",
+    ],
+    [
+      "S2",
+      draft.title.startsWith("Update ") &&
+        draft.title.length <= 100 &&
+        !draft.title.includes("\n"),
+      "imperative bounded title",
+    ],
+    [
+      "S3",
+      [
+        "Context / Business Value",
+        "Technical Approach",
+        "Acceptance Criteria",
+        "Out of Scope",
+      ].every(name => body.includes(`## ${name}\n`)),
+      "three audiences and scope",
+    ],
+    [
+      "S4",
+      /Scenario:.*\n {2}Given .*\n {2}When .*\n {2}Then /.test(body),
+      "Gherkin concrete proposal",
+    ],
+  ];
+}
+
+/** Runtime and repository scope retain the actual configured main mapping. */
+function runtimeChecks(body, config, policy, evidence) {
+  return [
+    [
+      "S8",
+      body.includes(
+        `Assumption: ${environment(config)} — remote default branch main`
+      ),
+      "runtime target derived",
+    ],
+    [
+      "S9",
+      body.includes(`Trusted maintainer: ${policy.maintainer}.`),
+      "role and runtime credential source",
+    ],
+    [
+      "S10",
+      body.includes(`## Repository\n\n${policy.repository}\n`),
+      "single configured repository",
+    ],
+    ["S11", body.includes("## Validation Journey\n"), "terminal journey"],
+    [
+      "S12",
+      ["Business rules:", "Visual:", "Flow:", "API/data:"].every(axis =>
+        body.includes(axis)
+      ),
+      "four authority axes",
+    ],
+    [
+      "S13",
+      Boolean(
+        evidence.history.command &&
+        evidence.history.result &&
+        evidence.search.query &&
+        Number.isInteger(evidence.search.total)
+      ),
+      "actual history and all-state search",
+    ],
+  ];
+}
+
+/** Declared evidence and fixed proposal fields must match actual prerequisite reads. */
+function evidenceChecks(draft, body, proposal, expected, config, evidence) {
+  return [
+    [
+      "S14",
+      body.includes("[EVIDENCE: cli-output: npm-ci]") &&
+        body.includes("[EVIDENCE: cli-output: rejected-publication]"),
+      "typed success and error manifest",
+    ],
+    ["S15", draft.build_ready === true, "standalone Task without child work"],
+    [
+      "S18",
+      body === expected.body && draft.title === expected.title,
+      "complete fixed proposal and stateless recipe",
+    ],
+    [
+      "S19",
+      body.includes(
+        `Derived from: Target Backend Environment ${environment(config)} via .lisa.config.json deploy.branches`
+      ),
+      "actual main mapping",
+    ],
+    ["F1", evidence.labels.includes("type:Task"), "Task label exists"],
+    [
+      "F4",
+      expected.labels.every(label => evidence.labels.includes(label)),
+      "priority and configured readiness exist",
+    ],
+    [
+      "F5",
+      evidence.main === proposal.parent &&
+        proposal.updates.every(update =>
+          evidence.registry.some(
+            item => item.name === update.name && item.version === update.to
+          )
+        ),
+      "actual base and selected registry versions",
+    ],
+  ];
+}
+
+/** These gates validate the bounded Task semantics, independently of API storage. */
+export function qualityGates(draft, proposal, policy, config, evidence) {
+  const expected = buildDraft(proposal, policy, config, evidence);
+  const body = draft.body ?? "";
+  const checks = [
+    ...coreChecks(draft, body, policy),
+    ...runtimeChecks(body, config, policy, evidence),
+    ...evidenceChecks(draft, body, proposal, expected, config, evidence),
+  ];
+  required(
+    checks.every(([, passed]) => passed),
+    "fixed Task quality gate failed"
+  );
+  const gates = checks.map(([id, , reason]) => ({
+    id,
+    verdict: "PASS",
+    reason,
+  }));
+  for (const [id, reason] of [
+    ["S5", "not Bug"],
+    ["S6", "not Spike"],
+    ["S7", "standalone build-ready Task"],
+    ["S16", "no PRD lineage"],
+    ["S17", "not Improvement"],
+    ["S20", "no existing red-before-green control"],
+    ["F2", "no parent declared"],
+    ["F3", "no linked issue declared"],
+  ])
+    gates.push({ id, verdict: "N/A", reason });
+  return gates;
+}