@codyswann/lisa 4.84.7 → 4.84.8

package/all/copy-overwrite/scripts/lib/completion-authorization.mjs

@@ -0,0 +1,282 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/** Shared terminal precondition for GitHub direct/sweep and Linear direct. */
+import {
+  CompletionProofError,
+  MAX_ATTACHMENT_BYTES,
+  MAX_TOTAL_BYTES,
+  declaredScope,
+  sha256,
+  requireProof,
+  primarySpecProjection,
+  isDigest,
+  isId,
+  isTime,
+  isOid,
+} from "./completion-proof-shape.mjs";
+import { githubProofTransport } from "./completion-proof-github.mjs";
+import {
+  readTrustedRecord,
+  recordFingerprint,
+  locatorHistoryFingerprint,
+} from "./completion-proof-reader.mjs";
+import {
+  validateTypedBytes,
+  validateVerdict,
+  validateManifest,
+  validateObligations,
+  validateVerifyUsage,
+} from "./completion-proof-content.mjs";
+import {
+  validateSource,
+  validateFrontier,
+  validateDelivery,
+} from "./completion-proof-source.mjs";
+import { validateConformance } from "./completion-proof-conformance.mjs";
+
+const PENDING_PROOF = "pending-proof";
+
+/** Stable user-facing next action, without declaring merely pending delivery failed. */
+const NEXT =
+  "Run canonical Verify/evidence, publish the accepted completion proof, then retry completion.";
+
+/** Fetch each native attachment positively; missing or wrong-type bytes refuse. */
+function validateAttachments(record, transport) {
+  let total = 0;
+  const evidence = new Map();
+  for (const item of record.evidence) {
+    requireProof(
+      typeof item.evidence_id === "string" &&
+        !evidence.has(item.evidence_id) &&
+        isId(item.asset_id) &&
+        isDigest(item.sha256) &&
+        isTime(item.captured_at) &&
+        isOid(item.artifact_head_sha) &&
+        Number.isSafeInteger(item.bytes) &&
+        item.bytes > 0,
+      "A typed proof attachment has an ambiguous identity, digest, capture time or byte count."
+    );
+    const asset = transport.asset(
+      item.asset_id,
+      Math.min(MAX_ATTACHMENT_BYTES, MAX_TOTAL_BYTES - total)
+    );
+    total += asset.bytes.length;
+    requireProof(
+      asset.bytes.length === item.bytes && sha256(asset.bytes) === item.sha256,
+      `Evidence ${item.evidence_id} has changed bytes or an incomplete attachment.`
+    );
+    validateTypedBytes(item.kind, asset.bytes, item.evidence_id);
+    evidence.set(item.evidence_id, item);
+  }
+  const verdicts = [];
+  for (const item of record.verdicts) {
+    requireProof(
+      isId(item.asset_id) && isDigest(item.sha256),
+      "A required verdict has no native immutable attachment."
+    );
+    const asset = transport.asset(
+      item.asset_id,
+      Math.min(MAX_ATTACHMENT_BYTES, MAX_TOTAL_BYTES - total)
+    );
+    total += asset.bytes.length;
+    requireProof(
+      sha256(asset.bytes) === item.sha256 && asset.bytes.length === item.bytes,
+      "The required verification verdict's bytes do not match its accepted digest."
+    );
+    try {
+      verdicts.push({
+        value: JSON.parse(asset.bytes.toString("utf8")),
+        role: item.role,
+      });
+    } catch {
+      throw new CompletionProofError(
+        "invalid-proof",
+        "The required verification verdict is malformed JSON."
+      );
+    }
+  }
+  return { evidence, verdicts };
+}
+
+/** Complete evaluation of exact native requirements, not an advisory local stop. */
+export function evaluateAcceptedRecord(chosen, context, subject, transport) {
+  const { record } = chosen;
+  requireProof(
+    record.state !== "revoked",
+    "The latest trusted completion proof was revoked."
+  );
+  requireProof(
+    record.state === "accepted-for-completion",
+    "Delivery/runtime verification proof is still pending.",
+    PENDING_PROOF
+  );
+  requireProof(
+    record.environment === context.environment &&
+      record.branch === context.branch &&
+      record.spec_sha256 === sha256(primarySpecProjection(subject.body)),
+    "The accepted proof does not match the current full primary specification or target environment."
+  );
+  const scope = declaredScope(subject.body, context.environment);
+  const { evidence, verdicts } = validateAttachments(record, transport);
+  const claims = new Map();
+  for (const { value: verdict, role } of verdicts) {
+    requireProof(
+      ["remote", "quality"].includes(role) &&
+        verdict.artifact?.repository === context.repository,
+      "The verdict has an unknown role or was captured for another repository."
+    );
+    if (role === "remote")
+      requireProof(
+        verdict.artifact.environment === context.environment &&
+          verdict.artifact.head_sha === record.source.delivered_sha,
+        "Remote verification was not captured against the accepted delivered source/environment."
+      );
+    else
+      requireProof(
+        [record.source.tested_head, record.source.pr_head].includes(
+          verdict.artifact.head_sha
+        ),
+        "The quality verdict does not identify its actual reconciled tested execution head."
+      );
+    for (const [id, claim] of validateVerdict(
+      verdict,
+      evidence,
+      scope.runtime
+    )) {
+      requireProof(
+        !claims.has(id),
+        `Required claim ${id} is ambiguous across verdicts.`
+      );
+      claims.set(id, { ...claim, verification_role: role });
+    }
+  }
+  validateManifest(record, subject.body, evidence);
+  validateObligations(record, scope, claims);
+  validateConformance(record, context, subject, transport);
+  for (const obligation of Object.values(record.obligations)) {
+    if (obligation.evidence_refs)
+      requireProof(
+        obligation.evidence_refs.every(id => evidence.has(id)),
+        "A required completion obligation cites an unattached evidence record."
+      );
+  }
+  validateVerifyUsage(
+    [subject.body, ...(subject.comments ?? []).map(row => row.body)],
+    context.ref,
+    record.obligations.usage.entry_ids,
+    context
+  );
+  const primary = validateSource(record, context, transport);
+  requireProof(
+    context.hasBacklink(subject, primary.html_url),
+    "The exact primary PR has no verified native or managed work-item backlink."
+  );
+  validateDelivery(record, context, transport);
+  validateFrontier(record, context, transport);
+  return { primary, scope };
+}
+
+/** Fresh checks run after byte validation and before any terminal mutation. */
+export function authorizeCompletion(context) {
+  try {
+    let subject = context.readSubject();
+    if ((subject.comments ?? []).length > 0)
+      subject = { ...subject, comments: context.readComments() };
+    const hints = subject.comments ?? [];
+    if (
+      !hints.some(row =>
+        row.body?.startsWith("[lisa-completion-authorization]\n")
+      )
+    ) {
+      return {
+        category: PENDING_PROOF,
+        applied: false,
+        native: subject,
+        reason: `Required delivery/runtime verification and accepted evidence proof are pending. ${NEXT}`,
+      };
+    }
+    const transport = githubProofTransport(
+      context.run,
+      context.repository,
+      context.policy
+    );
+    const chosen = readTrustedRecord(context, subject, transport);
+    requireProof(
+      chosen,
+      `Accepted delivery/runtime evidence proof is absent or has no eligible publisher. ${NEXT}`,
+      PENDING_PROOF
+    );
+    // Full native comments include canonical usage and the complete locator history.
+    subject = { ...subject, comments: context.readComments() };
+    const evaluated = evaluateAcceptedRecord(
+      chosen,
+      context,
+      subject,
+      transport
+    );
+    validateSource(chosen.record, context, transport);
+    validateDelivery(chosen.record, context, transport);
+    validateFrontier(chosen.record, context, transport);
+    const current = readTrustedRecord(context, subject, transport);
+    requireProof(
+      current && recordFingerprint(current) === recordFingerprint(chosen),
+      "Completion proof changed while it was being verified; run canonical Verify/evidence again.",
+      PENDING_PROOF
+    );
+    // All slow source, delivery, asset and issuer reads precede these final
+    // native reads. No provider read intervenes between local final checks and
+    // the caller's lifecycle-policy check/first terminal write.
+    const comments = context.readComments();
+    const fresh = { ...context.readSubject(), comments };
+    requireProof(
+      locatorHistoryFingerprint(comments) === current.history,
+      "The native completion locator history changed before the terminal write; retry canonical verification.",
+      PENDING_PROOF
+    );
+    requireProof(
+      sha256(primarySpecProjection(fresh.body)) === chosen.record.spec_sha256,
+      "Work-item requirements changed before the terminal write; fresh verification proof is pending.",
+      PENDING_PROOF
+    );
+    validateVerifyUsage(
+      [fresh.body, ...comments.map(row => row.body)],
+      context.ref,
+      chosen.record.obligations.usage.entry_ids,
+      context
+    );
+    requireProof(
+      context.hasBacklink(fresh, evaluated.primary.html_url),
+      "The primary pull-request backlink changed before the terminal write; restore canonical linkage.",
+      PENDING_PROOF
+    );
+    return {
+      category: "authorized",
+      applied: false,
+      native: fresh,
+      record: chosen.record,
+      primary: chosen.record.source.pull_request,
+    };
+  } catch (error) {
+    if (!(error instanceof CompletionProofError)) throw error;
+    return {
+      category: error.category,
+      applied: false,
+      reason: `${error.message} ${NEXT}`,
+    };
+  }
+}
+
+/** The same outcome vocabulary is consumed by direct CLI and workflow summaries. */
+export function completionDenial(ref, result) {
+  const prefix =
+    result.category === PENDING_PROOF
+      ? "work-item pending-proof"
+      : "work-item NOT completed";
+  return {
+    ...result,
+    terminal: null,
+    merged: [],
+    report: `${prefix}: ${ref} [${result.category}]\n${result.reason}`,
+  };
+}

package/all/copy-overwrite/scripts/lib/completion-proof-adapters.mjs

@@ -0,0 +1,213 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/** Provider-native proof discovery/publication adapters; credentials stay in CLI. */
+import {
+  CompletionProofError,
+  MAX_NATIVE_JSON_BYTES,
+  requireProof,
+} from "./completion-proof-shape.mjs";
+
+const READ_ERROR = "read-error";
+const WRITE_ERROR = "write-error";
+
+/** Construct the same strict authorizer context for supported lifecycle writers. */
+export function completionContext(options) {
+  const { ref, contract, run, declares, hasBacklink } = options;
+  const github = contract.provider === "github";
+  const repository = github ? ref.split("#")[0] : options.repository;
+  const number = ref.split("#")[1];
+  const environment = contract.lifecycle.productionEnvironment;
+  const branch = [...contract.deployBranches].find(
+    ([, env]) => env === environment
+  )?.[0];
+  requireProof(branch, "The configured production branch cannot be resolved.");
+  function linear(query, variables, purpose) {
+    try {
+      return options.linear(query, variables, purpose);
+    } catch (error) {
+      if (error instanceof CompletionProofError) throw error;
+      throw new CompletionProofError(
+        query.startsWith("mutation") ? WRITE_ERROR : READ_ERROR,
+        `The required native ${purpose} did not complete; restore Linear access and retry canonical verification.`
+      );
+    }
+  }
+  function gh(args, { write = false, input } = {}) {
+    const result = run("gh", args, {
+      allowFailure: true,
+      input,
+      maxBuffer: MAX_NATIVE_JSON_BYTES,
+    });
+    if (
+      result.status !== 0 ||
+      result.error ||
+      Buffer.byteLength(result.stdout ?? "") > MAX_NATIVE_JSON_BYTES
+    )
+      throw new CompletionProofError(
+        write ? WRITE_ERROR : READ_ERROR,
+        `The required native ${write ? "proof publication" : "work-item proof read"} did not complete.`
+      );
+    try {
+      return JSON.parse(result.stdout);
+    } catch {
+      throw new CompletionProofError(
+        READ_ERROR,
+        "A native work-item proof response is not complete JSON."
+      );
+    }
+  }
+  function readSubject() {
+    if (github) {
+      const issue = gh([
+        "issue",
+        "view",
+        number,
+        "--repo",
+        repository,
+        "--json",
+        "id,number,url,body,comments,labels,state,stateReason,assignees,updatedAt,closedByPullRequestsReferences",
+      ]);
+      requireProof(
+        String(issue.number) === number && Array.isArray(issue.comments),
+        "The native work-item proof read returned another item or unreadable comments."
+      );
+      return {
+        native_id: issue.id,
+        ref,
+        body: issue.body ?? "",
+        comments: issue.comments,
+        labels: (issue.labels ?? []).map(row =>
+          typeof row === "string" ? row : row.name
+        ),
+        state: issue.state,
+        reason: issue.stateReason ?? "",
+        assignees: issue.assignees ?? [],
+        raw: issue,
+      };
+    }
+    const issue = linear(
+      "query($id:String!){issue(id:$id){id identifier description updatedAt team{key states{nodes{id name type}}} state{id name type} attachments{nodes{url}} comments(first:100){nodes{id body createdAt updatedAt user{id}} pageInfo{hasNextPage endCursor}}}}",
+      { id: ref },
+      "Linear completion proof read"
+    ).issue;
+    requireProof(
+      issue?.identifier === ref && issue.team?.key === contract.teamKey,
+      "The native Linear completion read returned another item or team."
+    );
+    return {
+      native_id: issue.id,
+      ref,
+      body: issue.description ?? "",
+      comments: issue.comments?.nodes ?? [],
+      state: issue.state,
+      raw: issue,
+    };
+  }
+  function readComments() {
+    if (github) {
+      const pages = gh([
+        "api",
+        "--paginate",
+        "--slurp",
+        `repos/${repository}/issues/${number}/comments?per_page=100`,
+      ]);
+      requireProof(
+        Array.isArray(pages) &&
+          pages.length <= 100 &&
+          pages.every(Array.isArray) &&
+          pages.flat().length <= 10000 &&
+          pages.flat().every(row => typeof row.body === "string"),
+        "The native proof-locator comment pagination is incomplete or over its bound."
+      );
+      return pages.flat();
+    }
+    const comments = [];
+    const seen = new Set();
+    let after = null;
+    for (let page = 0; page < 100; page += 1) {
+      const result = linear(
+        "query($id:String!,$after:String){issue(id:$id){comments(first:100,after:$after){nodes{id body createdAt updatedAt user{id}} pageInfo{hasNextPage endCursor}}}}",
+        { id: ref, after },
+        "Linear completion locator pagination"
+      ).issue?.comments;
+      requireProof(
+        Array.isArray(result?.nodes) &&
+          typeof result.pageInfo?.hasNextPage === "boolean",
+        "The native Linear proof-locator pagination is incomplete."
+      );
+      comments.push(...result.nodes);
+      requireProof(
+        comments.length <= 10000,
+        "The Linear proof-locator pagination exceeds its bound."
+      );
+      if (!result.pageInfo.hasNextPage) return comments;
+      const cursor = result.pageInfo.endCursor;
+      requireProof(
+        typeof cursor === "string" && !seen.has(cursor),
+        "Linear proof-locator pagination repeated or omitted a cursor."
+      );
+      seen.add(cursor);
+      after = cursor;
+    }
+    throw new CompletionProofError(
+      READ_ERROR,
+      "The Linear proof-locator pagination exceeds its page bound."
+    );
+  }
+  return {
+    ref,
+    provider: contract.provider,
+    scope: github ? repository : `${contract.workspace}/${contract.teamKey}`,
+    repository,
+    environment,
+    branch,
+    suppliedPrUrl: options.prUrl,
+    policy: options.config.verification?.completion ?? {},
+    run,
+    declares,
+    readSubject,
+    readComments,
+    hasBacklink: (subject, url) =>
+      hasBacklink(
+        {
+          ...subject.raw,
+          comments: github ? subject.comments : { nodes: subject.comments },
+        },
+        url
+      ),
+    trackerActor(githubActor) {
+      return github
+        ? String(githubActor)
+        : String(
+            linear("query{viewer{id}}", {}, "Linear proof publisher lookup")
+              .viewer?.id
+          );
+    },
+    postLocator(body, nativeId) {
+      if (github)
+        return gh(
+          [
+            "api",
+            "--method",
+            "POST",
+            `repos/${repository}/issues/${number}/comments`,
+            "--input",
+            "-",
+          ],
+          { write: true, input: JSON.stringify({ body }) }
+        );
+      const result = linear(
+        "mutation($input:CommentCreateInput!){commentCreate(input:$input){success comment{id body createdAt updatedAt user{id}}}}",
+        { input: { issueId: nativeId, body } },
+        "Linear completion proof publication"
+      ).commentCreate;
+      requireProof(
+        result?.success === true && result.comment?.id,
+        "The native Linear completion-proof publication failed.",
+        WRITE_ERROR
+      );
+      return result.comment;
+    },
+  };
+}

package/all/copy-overwrite/scripts/lib/completion-proof-conformance.mjs

@@ -0,0 +1,115 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/** The accepted conformance map is itself a hash-pinned native attachment. */
+import {
+  requireProof,
+  isId,
+  isDigest,
+  isObject,
+  isText,
+  MAX_RECORD_BYTES,
+  sha256,
+  section,
+} from "./completion-proof-shape.mjs";
+
+/** Compare exact required conjunctions without depending on display order. */
+function groups(values) {
+  requireProof(
+    Array.isArray(values),
+    "The attached conformance requirement map is unreadable."
+  );
+  requireProof(
+    values.every(
+      row =>
+        isObject(row) &&
+        isText(row.requirement_id) &&
+        Array.isArray(row.claim_ids)
+    ),
+    "The attached conformance map contains malformed requirement rows."
+  );
+  return values
+    .map(row => ({
+      requirement_id: row.requirement_id,
+      operator: row.operator,
+      claim_ids: [...(row.claim_ids ?? [])].sort(),
+    }))
+    .sort((left, right) =>
+      left.requirement_id.localeCompare(right.requirement_id)
+    );
+}
+
+/** Match the original multiline Scenario grammar with one forward scan. */
+function scenarioNames(text) {
+  const names = [];
+  const lineBreak = character => /[\r\n\u2028\u2029]/.test(character);
+  let index = 0;
+  while (index < text.length) {
+    while (/\s/.test(text[index] ?? "")) index += 1;
+    const prefix = text.startsWith("Scenario Outline:", index)
+      ? "Scenario Outline:"
+      : "Scenario:";
+    if (text.startsWith(prefix, index)) {
+      const first = index + prefix.length;
+      let title = first;
+      while (/\s/.test(text[title] ?? "")) title += 1;
+      if (title === text.length) {
+        title -= 1;
+        while (title >= first && lineBreak(text[title])) title -= 1;
+      }
+      if (title >= first && title < text.length) {
+        let end = title;
+        while (end < text.length && !lineBreak(text[end])) end += 1;
+        names.push(text.slice(title, end).trim());
+        index = end;
+        continue;
+      }
+    }
+    while (index < text.length && !lineBreak(text[index])) index += 1;
+    index += 1;
+  }
+  return names;
+}
+
+/** CONFORMS text alone cannot replace the current complete coverage report. */
+export function validateConformance(record, context, subject, transport) {
+  const pointer = record.obligations.conformance.report;
+  requireProof(
+    isId(pointer?.asset_id) &&
+      isDigest(pointer.sha256) &&
+      Number.isSafeInteger(pointer.bytes),
+    "The required CONFORMS report has no immutable native attachment."
+  );
+  const asset = transport.asset(pointer.asset_id, MAX_RECORD_BYTES);
+  requireProof(
+    asset.bytes.length === pointer.bytes &&
+      sha256(asset.bytes) === pointer.sha256,
+    "The CONFORMS report does not match its accepted bytes."
+  );
+  let report;
+  try {
+    report = JSON.parse(asset.bytes.toString("utf8"));
+  } catch {
+    requireProof(false, "The CONFORMS report is not readable structured JSON.");
+  }
+  requireProof(
+    isObject(report) &&
+      report.verdict === "CONFORMS" &&
+      report.spec_sha256 === record.spec_sha256 &&
+      report.work_item === context.ref &&
+      Array.isArray(report.requirements) &&
+      report.requirements.every(
+        row => isObject(row) && row.status === "pass"
+      ) &&
+      JSON.stringify(groups(report.requirements)) ===
+        JSON.stringify(groups(record.requirements)),
+    "The attached CONFORMS report does not establish the exact current requirement conjunctions."
+  );
+  const scenarios = scenarioNames(section(subject.body, "Acceptance Criteria"));
+  requireProof(
+    Array.isArray(report.scenario_names) &&
+      new Set(report.scenario_names).size === report.scenario_names.length &&
+      scenarios.every(name => report.scenario_names.includes(name)),
+    "The attached conformance report omits a primary acceptance scenario."
+  );
+}