@codyswann/lisa 4.71.9 → 4.71.11

package/all/copy-overwrite/scripts/lib/github-attestation-recovery.mjs

@@ -17,6 +17,20 @@ import {
   RECOVERY_PREDICATE,
 } from "./github-attestation-verifier.mjs";
 
+/** An active run's update is not completion; invalid provider chronology has no usable bounds. */
+export function observedRunChronology(run, now) {
+  const start = Date.parse(run.run_started_at);
+  const updated = Date.parse(run.updated_at);
+  if (
+    ![now, start, updated].every(Number.isFinite) ||
+    !["in_progress", "completed"].includes(run.status) ||
+    start > updated ||
+    updated > now + 60_000
+  )
+    return null;
+  return { start, end: run.status === "in_progress" ? now : updated };
+}
+
 /** Historical origin authenticates bytes only within witnessed provider chronology. */
 export function assertHistoricalAttestation(
   results,
@@ -35,15 +49,13 @@ export function assertHistoricalAttestation(
     PROPOSAL_PREDICATE,
     "descriptor.json"
   );
-  const start = Date.parse(run.run_started_at),
-    updated = Date.parse(run.updated_at),
-    claimed = Date.parse(claim.created_at);
+  const chronology = observedRunChronology(run, now);
+  const claimed = Date.parse(claim.created_at);
   requireProof(
-    [start, updated, claimed].every(Number.isFinite) &&
-      start <= updated &&
-      updated <= now + 60_000,
+    chronology && Number.isFinite(claimed),
     "missing/invalid historical provider chronology"
   );
+  const { start, end } = chronology;
   // Official signature/timestamp verification already authenticates these times.
   matchSigningTime(
     result.verifiedTimestamps,
@@ -55,7 +67,7 @@ export function assertHistoricalAttestation(
     requireProof(
       signed >= start - 60_000 &&
         signed >= claimed - 60_000 &&
-        signed <= updated + 60_000,
+        signed <= end + 60_000,
       "origin signed outside provider chronology"
     );
   }

package/all/copy-overwrite/scripts/lib/npm-update-cancel-origin.mjs

@@ -27,7 +27,10 @@ import {
 } from "./npm-update-leaf.mjs";
 import { sha256 } from "./github-attestation-verifier.mjs";
 import { verifyStaleOriginProvider } from "./github-attestation-provider.mjs";
-import { verifyHistoricalDescriptor } from "./github-attestation-recovery.mjs";
+import {
+  observedRunChronology,
+  verifyHistoricalDescriptor,
+} from "./github-attestation-recovery.mjs";
 import {
   DESCRIPTOR_KEYS,
   optionalLockFields,
@@ -98,13 +101,16 @@ function originCheckpoint(issue) {
 }
 
 /** Original chunk bytes must be the unedited Bot's posts during its witnessed run, not later copied markers. */
-export function assertOriginTransport(comments, digest, policy, run) {
-  const start = Date.parse(run.run_started_at),
-    end = Date.parse(run.updated_at);
-  required(
-    Number.isFinite(start) && Number.isFinite(end) && start <= end,
-    "invalid original transport chronology"
-  );
+export function assertOriginTransport(
+  comments,
+  digest,
+  policy,
+  run,
+  now = Date.now()
+) {
+  const chronology = observedRunChronology(run, now);
+  required(chronology, "invalid original transport chronology");
+  const { start, end } = chronology;
   const selected = comments.filter(comment =>
     comment.body?.startsWith(`[lisa-npm-checkpoint] v1 ${digest} `)
   );

package/all/copy-overwrite/scripts/lib/npm-update-cancellation-proof.mjs

@@ -4,6 +4,7 @@
 /** A manual cancellation is a third fixed signing purpose, never publication or review authority. */
 import { canonicalJson } from "../lisa-automation-provenance.mjs";
 import { required, keys, FILES, OBJECT } from "./npm-update-contract.mjs";
+import { observedRunChronology } from "./github-attestation-recovery.mjs";
 import {
   verifiedRole,
   matchSigningTime,
@@ -276,14 +277,9 @@ export function assertRecordedCancellation(
     CANCELLATION_PREDICATE,
     "cancellation.json"
   );
-  const started = Date.parse(run.run_started_at);
-  const updated = Date.parse(run.updated_at);
-  required(
-    [started, updated].every(Number.isFinite) &&
-      started <= updated &&
-      updated <= now + 60_000,
-    "invalid cancellation provider chronology"
-  );
+  const chronology = observedRunChronology(run, now);
+  required(chronology, "invalid cancellation provider chronology");
+  const { start, end } = chronology;
   matchSigningTime(
     result.verifiedTimestamps,
     { ...policy, maxAgeSeconds: Number.MAX_SAFE_INTEGER },
@@ -292,7 +288,7 @@ export function assertRecordedCancellation(
   for (const time of result.verifiedTimestamps) {
     const signed = Date.parse(time.timestamp);
     required(
-      signed >= started - 60_000 && signed <= updated + 60_000,
+      signed >= start - 60_000 && signed <= end + 60_000,
       "cancellation signed outside provider chronology"
     );
   }

package/all/copy-overwrite/scripts/lisa-work-item.mjs

@@ -3409,7 +3409,7 @@ function parsePushGroups(input, remote) {
   // scoped to branch-authored commits (issue #1956).
   const defaultRef = remoteDefaultRef(remote);
   for (const line of input.trim().split(/\r?\n/).filter(Boolean)) {
-    const [localRef, localOid, , remoteOid] = line.trim().split(/\s+/);
+    const [localRef, localOid, remoteRef, remoteOid] = line.trim().split(/\s+/);
     if (!localOid || ZERO_OID.test(localOid)) continue;
     const existing = Boolean(remoteOid) && !ZERO_OID.test(remoteOid);
     const args = existing
@@ -3430,6 +3430,7 @@ function parsePushGroups(input, remote) {
         ? `${localRef} ${abbreviate(remoteOid)}..${abbreviate(localOid)}`
         : `${localRef} (new branch) ${abbreviate(localOid)}`,
       localRef,
+      remoteRef,
       scope: args,
     });
   }
@@ -6094,6 +6095,7 @@ function pushGroups(input, remote) {
           commits: [],
           examinedScope: parsed[0]?.examinedScope ?? HEAD_FALLBACK_SCOPE,
           localRef: parsed[0]?.localRef,
+          remoteRef: parsed[0]?.remoteRef,
           // Empty on purpose: `ancestryUnreachable` asks a question OF A RANGE,
           // and there is no range here. `examinedScope` above is the separate,
           // human-readable answer to "what did this verdict look at".
@@ -6200,6 +6202,11 @@ export function unreachableAncestryRefusal(localRef) {
  */
 function prTargetGroup(groups, pr) {
   if (!pr) return undefined;
+  const destination = groups.find(
+    group =>
+      pr.headRefName && group.remoteRef === `${HEADS_PREFIX}${pr.headRefName}`
+  );
+  if (destination) return destination;
   if (groups.length === 1) return groups[0];
   const branch = activeBranch();
   return groups.find(
@@ -6207,6 +6214,51 @@ function prTargetGroup(groups, pr) {
   );
 }
 
+/**
+ * Keep a stacked PR's inherited base work out of its body declaration.
+ *
+ * The raw push scope still governs ancestry validation. Only the matching
+ * child destination's declaration scope is intersected with the immutable base
+ * commit GitHub reported; other pushed branches and deploy bases retain their
+ * existing scope. An unavailable base refuses instead of guessing from a
+ * possibly stale local branch name.
+ * @param {object} group Raw pushed ref and its commits.
+ * @param {object|undefined} pr Current branch's pull request.
+ * @param {string} remote Push destination.
+ * @returns {object} The declaration scope for this push.
+ */
+function stackedPrPushGroup(group, pr, remote) {
+  if (
+    !pr?.baseRefName ||
+    deployBranchNames(remote).has(pr.baseRefName) ||
+    !pr.headRefName ||
+    group.remoteRef !== `${HEADS_PREFIX}${pr.headRefName}` ||
+    group.commits.length === 0
+  )
+    return group;
+  const base = pr.baseRefOid;
+  if (typeof base !== "string" || !/^[a-f0-9]{40}$/i.test(base))
+    throw new TrackingError(
+      "The stacked pull request's base commit could not be read. Refresh its GitHub metadata before pushing."
+    );
+  const available = run("git", ["cat-file", "-e", `${base}^{commit}`], {
+    allowFailure: true,
+  });
+  if (available.status !== 0)
+    throw new TrackingError(
+      "The stacked pull request's base commit is not available locally. Fetch the pull request's base branch, then push again."
+    );
+  // Put the exclusion before any --not toggle in the original argv. This
+  // preserves the existing incremental range and avoids walking the whole PR.
+  const scope = ["rev-list", `^${base}`, ...group.scope.slice(1)];
+  return {
+    ...group,
+    commits: git(scope).split("\n").filter(Boolean),
+    examinedScope: `${group.examinedScope}; excluding PR base ${abbreviate(base)}`,
+    scope,
+  };
+}
+
 /**
  * What a push could not prove here, named rather than left to CI to reveal.
  *
@@ -6371,7 +6423,11 @@ function validatePush(args) {
   // anything, but so could a `--no-verify`; CI is the enforcing copy.
   const configRef = remoteDefaultRef(remote);
   const groups = pushGroups(input, remote);
-  const pr = currentPullRequest();
+  const pr = currentPullRequest(
+    undefined,
+    undefined,
+    "url,body,state,baseRefName,baseRefOid,headRefName"
+  );
   const target = prTargetGroup(groups, pr);
   for (const group of groups) {
     // BEFORE the commits are judged, not after: every verdict below is computed
@@ -6380,12 +6436,17 @@ function validatePush(args) {
     // produced a refusal naming a stranger's closed ticket (#3719).
     if (ancestryUnreachable(group, remote))
       throw unreachableAncestryRefusal(group.localRef);
-    const outcome = commitOutcome(group.commits, configRef, remote);
+    const declaration = stackedPrPushGroup(
+      group,
+      group === target ? pr : undefined,
+      remote
+    );
+    const outcome = commitOutcome(declaration.commits, configRef, remote);
     reportPushGroup(
       outcome,
       group === target ? pr : undefined,
       groups.length > 1 ? `${group.localRef ?? "(stdin)"}: ` : "",
-      group.examinedScope
+      declaration.examinedScope
     );
   }
 }

package/all/copy-overwrite/scripts/npm-updater-helper-graph.json

@@ -91,7 +91,7 @@
       "children": []
     },
     "lib/github-attestation-recovery.mjs": {
-      "sha256": "adb3e7bbc8d3986a84c2934181b5518c96a2690e7cfef7d6ff77a405c6a957d7",
+      "sha256": "ff89d72300035a2554cf3e406b1054ca3c8a494d6a5768ea4981f4c87c50e981",
       "staticImports": [
         "lib/automation-provenance-local.mjs",
         "lib/bounded-spawn.mjs",
@@ -246,7 +246,7 @@
       "children": []
     },
     "lib/npm-update-cancel-origin.mjs": {
-      "sha256": "635dd82d23042337d68e441b43cec26c171fef9ac57c7e9c5de14af0587d7e43",
+      "sha256": "aff226288a26dcbb53a42cd6555ebe15ef7250d3b2b2c291be702d8ddd3bac3a",
       "staticImports": [
         "lib/automation-provenance-contract.mjs",
         "lib/github-attestation-provider.mjs",
@@ -264,8 +264,9 @@
       "children": []
     },
     "lib/npm-update-cancellation-proof.mjs": {
-      "sha256": "9262c81836683572d1135112b8cfd0f43abcb050c9f8d84ef7dfb77b8caac59c",
+      "sha256": "e40fed4696ee91d8e73f1abd4d307d8ad6aa484ac3d24262120a5e048ba96b7b",
       "staticImports": [
+        "lib/github-attestation-recovery.mjs",
         "lib/github-attestation-verifier.mjs",
         "lib/npm-update-contract.mjs",
         "lisa-automation-provenance.mjs"
@@ -1129,7 +1130,7 @@
       "children": []
     },
     "lisa-work-item.mjs": {
-      "sha256": "b396e85f1652e07e8b64e32cb310331156ee1bb61fb1d8a7973b896dd2522004",
+      "sha256": "64f01819287d902ed830285c256dd0a589330bce5be9c7b8b1f2563d811db287",
       "staticImports": [
         "lib/invoked-as-script.mjs",
         "node:child_process",

package/dist/core/lisa-owned-hash-ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lisa-owned-hash-ledger.d.ts","sourceRoot":"","sources":["../../src/core/lisa-owned-hash-ledger.ts"],"names":[],"mappings":"AACA,6EAA6E;AAE7E;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAC3C,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CA00DjC,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,+BAA+B,EAAE,QAAQ,CACpD,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CA6uDjC,CAAC"}
+{"version":3,"file":"lisa-owned-hash-ledger.d.ts","sourceRoot":"","sources":["../../src/core/lisa-owned-hash-ledger.ts"],"names":[],"mappings":"AACA,6EAA6E;AAE7E;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAC3C,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAi1DjC,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,+BAA+B,EAAE,QAAQ,CACpD,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAovDjC,CAAC"}

package/dist/core/lisa-owned-hash-ledger.js

@@ -475,6 +475,7 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
     "scripts/lib/github-attestation-recovery.mjs": Object.freeze([
         "60d74d266cfacc582a3d6d6ff8be78e6b4e204370067955c2ec7a843a810f863",
         "adb3e7bbc8d3986a84c2934181b5518c96a2690e7cfef7d6ff77a405c6a957d7",
+        "ff89d72300035a2554cf3e406b1054ca3c8a494d6a5768ea4981f4c87c50e981",
     ]),
     "scripts/lib/github-attestation-verifier.mjs": Object.freeze([
         "68d69315436c7c60870b67f74efce36e979cf0823cdbbbb68b3e0a06ef017a4f",
@@ -541,12 +542,14 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
     "scripts/lib/npm-update-cancel-origin.mjs": Object.freeze([
         "331554c8d2201fb6fe6934d158f5f60d7da11bbb1d4aa938ef9437afe724b5ff",
         "635dd82d23042337d68e441b43cec26c171fef9ac57c7e9c5de14af0587d7e43",
+        "aff226288a26dcbb53a42cd6555ebe15ef7250d3b2b2c291be702d8ddd3bac3a",
     ]),
     "scripts/lib/npm-update-cancellation-proof.mjs": Object.freeze([
         "56365dbe20ef540b8a3d59a3ce9e0fa33c9c4efdfb27c2b69e27cbe60b2ba204",
         "9262c81836683572d1135112b8cfd0f43abcb050c9f8d84ef7dfb77b8caac59c",
         "afb25ab04fceb925931d62dab568b1633b16601d352ed1763190e344e319d2cd",
         "c4ca24d4fa152525c10993d563284bf8ea7b7b0799a78a38f8deec059ccaa2cd",
+        "e40fed4696ee91d8e73f1abd4d307d8ad6aa484ac3d24262120a5e048ba96b7b",
     ]),
     "scripts/lib/npm-update-cancellation.mjs": Object.freeze([
         "529122fd37117526d97277de116fe0080bce85557062585bd73ce7d8be2f88b9",
@@ -1630,6 +1633,7 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
         "62f53156d425198609564e996f3844f52ab110e63f99f22e8338fcf7a83f316d",
         "637741a9e5d2904aed24d48efd6bec1326c5573f718a13152807aa0e4b42f0a1",
         "645cbf7c17b14f44f85231495266d63e10272538ca2274dfbae3d3c4e836cfe8",
+        "64f01819287d902ed830285c256dd0a589330bce5be9c7b8b1f2563d811db287",
         "653252b0bbfd19bdffa046a2173c053e566ac6bf605c8d9060f9cf71ad7386de",
         "65fe3ab4e89a617345ccf0ee29c439442ed29d699f8598b28907c2cb8d38c1b3",
         "6714af0434131556203f024b68e0d4c8d50fd3f1e099e8abfeb84d9c93dc4643",
@@ -1789,6 +1793,7 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
         "2423c7c0f36a14f5aa66258713204d07fe82924d85796e488892d94acd52afc9",
         "29d6986ecf8b659f829517a1e0bac2ef456934633cb8e5842756abc37359d870",
         "322d4edf19711c6ff19d4152172669320bf4806a2190d3b5e2aa420901acebbb",
+        "381611fa7242751ab28617797c257b5137f928c8bff1041eec0821014638fbd5",
         "57d2072ff209a1188bcd89cf3276baadf626201182a672a4e477a96488bd3a0e",
         "5e8881466a13bdfcaefa5ae056c59e9fc869c85f83701ef3d770473aaece3b12",
         "617976fa328bde110f953967490e2cacb22fa3c13963b1ccece71b830feb929f",
@@ -1799,7 +1804,9 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
         "70117ada2fe96b4697f695f860547a0e47eb7d20e864eac929047722cb3e6e2c",
         "702b455a3157565b910904a3acfcdbf4722befc660d60242c649ff020fe96b3b",
         "7b1d6bba391f105b9d53b91773fd207c9a5e9b5bfcd638e1e6b579d507279d7d",
+        "8a3c46d3501797ebb53a081c8b35e78e0ceb2b060503332b48e44ccc30d6d0df",
         "9344207510f0c613088b4c82c9b3962a815ec79d0664886bf01f34b7a6f1f4ab",
+        "a114ac60b0e390ad2518bda5871aa1c9680755f10fe36ebae26de4ad170490d5",
         "a1ca3cd8fb9a9ed969c256bdcee5b4b4e740e58fe1cb43d38b7b4572823532b8",
         "b2f392ac7eb9f645583dfbe357d608ab266c19177230b9b4420baa8975573b2c",
         "b45d7b88eeadaf859ac312398aa49fc7e1f1882d1b5afcf58676178ea0695b58",
@@ -2335,6 +2342,7 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
     "scripts/lib/github-attestation-recovery.mjs": Object.freeze([
         "60d74d266cfacc582a3d6d6ff8be78e6b4e204370067955c2ec7a843a810f863",
         "adb3e7bbc8d3986a84c2934181b5518c96a2690e7cfef7d6ff77a405c6a957d7",
+        "ff89d72300035a2554cf3e406b1054ca3c8a494d6a5768ea4981f4c87c50e981",
     ]),
     "scripts/lib/github-attestation-verifier.mjs": Object.freeze([
         "68d69315436c7c60870b67f74efce36e979cf0823cdbbbb68b3e0a06ef017a4f",
@@ -2401,12 +2409,14 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
     "scripts/lib/npm-update-cancel-origin.mjs": Object.freeze([
         "331554c8d2201fb6fe6934d158f5f60d7da11bbb1d4aa938ef9437afe724b5ff",
         "635dd82d23042337d68e441b43cec26c171fef9ac57c7e9c5de14af0587d7e43",
+        "aff226288a26dcbb53a42cd6555ebe15ef7250d3b2b2c291be702d8ddd3bac3a",
     ]),
     "scripts/lib/npm-update-cancellation-proof.mjs": Object.freeze([
         "56365dbe20ef540b8a3d59a3ce9e0fa33c9c4efdfb27c2b69e27cbe60b2ba204",
         "9262c81836683572d1135112b8cfd0f43abcb050c9f8d84ef7dfb77b8caac59c",
         "afb25ab04fceb925931d62dab568b1633b16601d352ed1763190e344e319d2cd",
         "c4ca24d4fa152525c10993d563284bf8ea7b7b0799a78a38f8deec059ccaa2cd",
+        "e40fed4696ee91d8e73f1abd4d307d8ad6aa484ac3d24262120a5e048ba96b7b",
     ]),
     "scripts/lib/npm-update-cancellation.mjs": Object.freeze([
         "529122fd37117526d97277de116fe0080bce85557062585bd73ce7d8be2f88b9",
@@ -3421,6 +3431,7 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
         "60bc3a715e02b5bf57f324f78e6da46dbb6dbb7769177c42139f7b7a2806eea6",
         "62f53156d425198609564e996f3844f52ab110e63f99f22e8338fcf7a83f316d",
         "645cbf7c17b14f44f85231495266d63e10272538ca2274dfbae3d3c4e836cfe8",
+        "64f01819287d902ed830285c256dd0a589330bce5be9c7b8b1f2563d811db287",
         "653252b0bbfd19bdffa046a2173c053e566ac6bf605c8d9060f9cf71ad7386de",
         "65fe3ab4e89a617345ccf0ee29c439442ed29d699f8598b28907c2cb8d38c1b3",
         "6714af0434131556203f024b68e0d4c8d50fd3f1e099e8abfeb84d9c93dc4643",
@@ -3579,6 +3590,7 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
         "2423c7c0f36a14f5aa66258713204d07fe82924d85796e488892d94acd52afc9",
         "29d6986ecf8b659f829517a1e0bac2ef456934633cb8e5842756abc37359d870",
         "322d4edf19711c6ff19d4152172669320bf4806a2190d3b5e2aa420901acebbb",
+        "381611fa7242751ab28617797c257b5137f928c8bff1041eec0821014638fbd5",
         "57d2072ff209a1188bcd89cf3276baadf626201182a672a4e477a96488bd3a0e",
         "5e8881466a13bdfcaefa5ae056c59e9fc869c85f83701ef3d770473aaece3b12",
         "617976fa328bde110f953967490e2cacb22fa3c13963b1ccece71b830feb929f",
@@ -3589,7 +3601,9 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
         "70117ada2fe96b4697f695f860547a0e47eb7d20e864eac929047722cb3e6e2c",
         "702b455a3157565b910904a3acfcdbf4722befc660d60242c649ff020fe96b3b",
         "7b1d6bba391f105b9d53b91773fd207c9a5e9b5bfcd638e1e6b579d507279d7d",
+        "8a3c46d3501797ebb53a081c8b35e78e0ceb2b060503332b48e44ccc30d6d0df",
         "9344207510f0c613088b4c82c9b3962a815ec79d0664886bf01f34b7a6f1f4ab",
+        "a114ac60b0e390ad2518bda5871aa1c9680755f10fe36ebae26de4ad170490d5",
         "a1ca3cd8fb9a9ed969c256bdcee5b4b4e740e58fe1cb43d38b7b4572823532b8",
         "b2f392ac7eb9f645583dfbe357d608ab266c19177230b9b4420baa8975573b2c",
         "b45d7b88eeadaf859ac312398aa49fc7e1f1882d1b5afcf58676178ea0695b58",