@codyswann/lisa 4.84.7 → 4.84.8

package/all/copy-overwrite/scripts/lib/completion-proof-shape.mjs

@@ -0,0 +1,374 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/** Strict shared data contract for accepted-for-completion records. */
+import { createHash } from "node:crypto";
+import {
+  markdownSection,
+  topLevelLines,
+} from "./completion-proof-markdown.mjs";
+import {
+  canonicalCompletionBlock,
+  usageSpecRemainder,
+} from "./completion-proof-projection.mjs";
+import {
+  CompletionProofError,
+  requireProof,
+} from "./completion-proof-errors.mjs";
+
+const CLI_OUTPUT = "cli-output";
+const TEST_RUN_LOG = "test-run-log";
+
+export {
+  CompletionProofError,
+  requireProof,
+} from "./completion-proof-errors.mjs";
+
+export const PROOF_MARKER = "[lisa-completion-authorization]";
+export const PROOF_KIND = "lisa-completion-authorization";
+export const MAX_RECORD_BYTES = 2 * 1024 * 1024;
+// Native subjects and slurped listings have an independent byte ceiling. The
+// separate page/row ceilings do not promise that arbitrarily large rows fit.
+export const MAX_NATIVE_JSON_BYTES = 16 * 1024 * 1024;
+export const MAX_ATTACHMENT_BYTES = 64 * 1024 * 1024;
+export const MAX_TOTAL_BYTES = 256 * 1024 * 1024;
+export const KINDS = [
+  "screenshot",
+  "recording",
+  "http-transcript",
+  CLI_OUTPUT,
+  "log-snippet",
+  "db-query-output",
+  "perf-trace",
+  TEST_RUN_LOG,
+  "deploy-log",
+  "state-dump",
+];
+export const BOUNDARIES = {
+  "code-unit": [TEST_RUN_LOG],
+  browser: ["screenshot", "recording"],
+  "http-api": ["http-transcript"],
+  cli: [CLI_OUTPUT],
+  data: ["db-query-output", "state-dump"],
+  "deploy-health": ["deploy-log"],
+  performance: ["perf-trace"],
+  "standards-compat": [CLI_OUTPUT, TEST_RUN_LOG],
+};
+
+/** Hash actual bytes, never a caller's claimed digest. */
+export function sha256(bytes) {
+  return createHash("sha256").update(bytes).digest("hex");
+}
+
+/** Unambiguous typed fields used by the producer and reader. */
+export const isObject = value =>
+  value !== null && typeof value === "object" && !Array.isArray(value);
+export const isText = value =>
+  typeof value === "string" && value.trim().length > 0;
+export const isDigest = value =>
+  typeof value === "string" && /^[a-f0-9]{64}$/.test(value);
+export const isOid = value =>
+  typeof value === "string" && /^[a-f0-9]{40}$/.test(value);
+export const isId = value => Number.isSafeInteger(value) && value > 0;
+export const isTime = value =>
+  typeof value === "string" &&
+  /(?:Z|\+00:00)$/.test(value) &&
+  Number.isFinite(Date.parse(value));
+
+/** Remove only exact canonical machine-owned sections, retaining unknown prose. */
+export function primarySpecProjection(body) {
+  requireProof(
+    typeof body === "string",
+    "The primary work-item description is unreadable."
+  );
+  const headings = topLevelLines(body).filter(row => row.heading);
+  const usage = headings.filter(row => row.text === "## Lisa Usage");
+  requireProof(
+    usage.length <= 1,
+    "Duplicate canonical usage sections make the primary specification ambiguous."
+  );
+  let result = body;
+  if (usage.length) {
+    const start = usage[0].start;
+    const end = headings.find(row => row.start > start)?.start ?? body.length;
+    result =
+      body.slice(0, start) +
+      usageSpecRemainder(body.slice(start, end)) +
+      body.slice(end);
+  }
+  for (const name of ["authorization", "postcondition"]) {
+    const start = `<!-- lisa:completion-${name}:start -->`;
+    const end = `<!-- lisa:completion-${name}:end -->`;
+    const rows = topLevelLines(result);
+    const starts = rows.filter(row => row.text === start);
+    const ends = rows.filter(row => row.text === end);
+    if (!starts.length && !ends.length) continue;
+    requireProof(
+      starts.length === 1 &&
+        ends.length === 1 &&
+        ends[0].start > starts[0].start,
+      `The canonical completion ${name} block has ambiguous boundaries.`
+    );
+    if (
+      !canonicalCompletionBlock(
+        name,
+        result.slice(starts[0].end, ends[0].start).trim()
+      )
+    )
+      continue;
+    result = result.slice(0, starts[0].start) + result.slice(ends[0].end);
+  }
+  return result;
+}
+
+/** Read the maximal code-fence run without letting its suffix repartition it. */
+function claimingFence(line) {
+  let start = 0;
+  while (start < 3 && line[start] === " ") start += 1;
+  const character = line[start];
+  if (character !== "`" && character !== "~") return null;
+  let end = start;
+  while (line[end] === character) end += 1;
+  if (end - start < 3) return null;
+  const suffix = line.slice(end);
+  if (/[\r\n\u2028\u2029]/.test(suffix)) return null;
+  return { character, length: end - start, suffix };
+}
+
+/** Remove comment contents while preserving text on both sides of their ends. */
+function withoutClaimingComments(line, state) {
+  let visible = "";
+  let offset = 0;
+  while (offset < line.length) {
+    const boundary = line.indexOf(state.comment ? "-->" : "<!--", offset);
+    if (boundary < 0) {
+      if (!state.comment) visible += line.slice(offset);
+      break;
+    }
+    if (!state.comment) visible += line.slice(offset, boundary);
+    offset = boundary + (state.comment ? 3 : 4);
+    state.comment = !state.comment;
+  }
+  return visible;
+}
+
+/** Fence and comment contents cannot change the other construct's state. */
+function claimingLine(line, state) {
+  const marker = claimingFence(line);
+  if (state.fence) {
+    if (
+      marker &&
+      marker.character === state.fence.character &&
+      marker.length >= state.fence.length &&
+      !marker.suffix.trim()
+    )
+      state.fence = null;
+    return "";
+  }
+  if (!state.comment) {
+    if (/^ {4}|^\t/.test(line)) return "";
+    if (marker && !(marker.character === "`" && marker.suffix.includes("`"))) {
+      state.fence = marker;
+      return "";
+    }
+  }
+  return withoutClaimingComments(line, state);
+}
+
+/** Claim discovery keeps closing-line suffixes; full-spec projection is separate. */
+function claimingText(body) {
+  const state = { comment: false, fence: null };
+  return body
+    .split("\n")
+    .map(raw =>
+      claimingLine(raw.endsWith("\r") ? raw.slice(0, -1) : raw, state)
+    )
+    .join("\n");
+}
+
+/** Exact visible claiming markers; examples and other-item refs do not claim. */
+export function localMarkers(body) {
+  const text = claimingText(body);
+  const matches = [
+    ...text.matchAll(/\[EVIDENCE:\s*([a-z-]+):\s*([a-z][a-z0-9-]*)\s*\]/g),
+  ];
+  const legacy = [...text.matchAll(/\[SCREENSHOT:\s*([a-z][a-z0-9-]*)\s*\]/g)];
+  requireProof(
+    matches.length === (text.match(/\[EVIDENCE:/g) ?? []).length,
+    "A local evidence declaration is malformed; repair its type and name."
+  );
+  const markers = [
+    ...matches.map(row => ({ kind: row[1], name: row[2] })),
+    ...legacy.map(row => ({ kind: "screenshot", name: row[1] })),
+  ];
+  requireProof(
+    markers.every(row => KINDS.includes(row.kind)),
+    "A local evidence declaration has an unsupported type."
+  );
+  requireProof(
+    new Set(markers.map(row => row.name)).size === markers.length,
+    "Local evidence declarations must have unique names."
+  );
+  return markers;
+}
+
+/** Read an exact markdown section without discarding unknown source sections. */
+export function section(body, heading) {
+  return markdownSection(body, heading);
+}
+
+/** Preserve the first whitespace-delimited environment suffix in linear work. */
+function environmentValue(declaration) {
+  let whitespaceStart = -1;
+  for (let index = 0; index < declaration.length; index += 1) {
+    const character = declaration[index];
+    if (/\s/.test(character)) {
+      if (whitespaceStart < 0) whitespaceStart = index;
+    } else {
+      if (
+        whitespaceStart >= 0 &&
+        (character === "-" || character === "—") &&
+        /\s/.test(declaration[index + 1] ?? "")
+      )
+        return declaration.slice(0, whitespaceStart).trim();
+      whitespaceStart = -1;
+    }
+  }
+  return declaration.trim();
+}
+
+/** Exemptions are explicit declarations, never an absent environment. */
+export function declaredScope(body, environment) {
+  const declaration = section(body, "Target Backend Environment");
+  const exemption =
+    /^None\s*[—-]\s*no runtime behavior change:\s*(doc-only|config-only|type-only)\s*$/i.exec(
+      declaration
+    );
+  if (exemption) return { runtime: false, reason: exemption[1].toLowerCase() };
+  const value = environmentValue(
+    declaration.replace(/^(Assumption|Inferred|Confirmed):\s*/i, "")
+  );
+  requireProof(
+    value === environment,
+    `The primary item does not declare target environment ${environment}; run canonical verification for its actual target.`,
+    "pending-proof"
+  );
+  return { runtime: true, reason: null };
+}
+
+/** Positive shape validation before any network-selected record is interpreted. */
+export function validateRecordShape(record) {
+  requireProof(
+    isObject(record) &&
+      record.schema_version === 1 &&
+      record.kind === PROOF_KIND,
+    "The completion record schema is unsupported or malformed."
+  );
+  requireProof(
+    isText(record.record_id) &&
+      isId(record.revision) &&
+      ["accepted-for-completion", "pending", "revoked"].includes(
+        record.state
+      ) &&
+      isTime(record.captured_at) &&
+      (record.supersedes === null || isDigest(record.supersedes)),
+    "The completion record identity, revision, state or capture time is malformed."
+  );
+  requireProof(
+    isObject(record.subject) &&
+      ["github", "linear"].includes(record.subject.provider) &&
+      isText(record.subject.ref) &&
+      isText(String(record.subject.native_id ?? "")) &&
+      isText(record.subject.scope),
+    "The completion record must identify the exact native work item and provider scope."
+  );
+  requireProof(
+    isObject(record.repository) &&
+      isId(record.repository.id) &&
+      /^[^/\s]+\/[^/\s]+$/.test(record.repository.name ?? ""),
+    "The implementation repository identity is malformed."
+  );
+  requireProof(
+    isObject(record.producer) && isId(record.producer.github_actor_id),
+    "The completion record has no stable publisher identity."
+  );
+  requireProof(
+    isText(record.environment) &&
+      isText(record.branch) &&
+      isDigest(record.spec_sha256),
+    "The completion record environment, branch or full-spec digest is malformed."
+  );
+  if (record.state !== "accepted-for-completion") return record;
+  const source = record.source;
+  requireProof(
+    isObject(source) &&
+      isId(source.pull_request) &&
+      isOid(source.tested_head) &&
+      isOid(source.pr_head) &&
+      isOid(source.merge_sha) &&
+      isOid(source.production_snapshot_sha) &&
+      isOid(source.delivered_sha) &&
+      Array.isArray(source.declaring_commits) &&
+      source.declaring_commits.length > 0 &&
+      source.declaring_commits.every(isOid),
+    "The accepted record lacks exact primary PR, source, merge and delivered identities."
+  );
+  requireProof(
+    Array.isArray(record.manifest) &&
+      Array.isArray(record.verdicts) &&
+      record.verdicts.length > 0 &&
+      Array.isArray(record.evidence) &&
+      Array.isArray(record.requirements) &&
+      record.requirements.length > 0,
+    "The accepted record lacks an enumerable proof manifest, verdicts or requirement map."
+  );
+  requireProof(
+    [
+      record.manifest,
+      record.verdicts,
+      record.evidence,
+      record.requirements,
+    ].every(rows => rows.every(isObject)),
+    "The accepted proof contains malformed attachment or requirement rows."
+  );
+  const names = [
+    "remote",
+    "conformance",
+    "typed_manifest",
+    "delivery",
+    "usage",
+    "linkage",
+    "acceptance",
+  ];
+  requireProof(
+    isObject(record.obligations) &&
+      Object.keys(record.obligations).sort().join() === names.sort().join(),
+    "The accepted record must explicitly account for every completion obligation."
+  );
+  return record;
+}
+
+/** Native locator content is discovery, never acceptance or a free-form URL. */
+export function parseLocator(body) {
+  if (typeof body !== "string" || !body.startsWith(`${PROOF_MARKER}\n`))
+    return null;
+  try {
+    const value = JSON.parse(body.slice(PROOF_MARKER.length).trim());
+    requireProof(
+      value.schema_version === 1 &&
+        isId(value.asset_id) &&
+        isDigest(value.sha256) &&
+        isId(value.revision) &&
+        isText(value.record_id) &&
+        isText(value.repository),
+      "The completion locator is malformed."
+    );
+    return value;
+  } catch (error) {
+    if (error instanceof CompletionProofError) throw error;
+    throw new CompletionProofError(
+      "invalid-proof",
+      "The completion locator is not readable structured JSON."
+    );
+  }
+}

package/all/copy-overwrite/scripts/lib/completion-proof-source.mjs

@@ -0,0 +1,174 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/** Native source/delivery reconciliation, independent of checkout credentials. */
+import { requireProof, isOid } from "./completion-proof-shape.mjs";
+
+const PENDING_PROOF = "pending-proof";
+
+/** Full native compare pagination; absence/truncation is never clean ancestry. */
+export function compareSource(transport, base, head) {
+  requireProof(
+    isOid(base) && isOid(head),
+    "The source comparison has an invalid commit identity."
+  );
+  const pages = transport.json(
+    `${transport.root}/compare/${base}...${head}?per_page=100`,
+    true
+  );
+  requireProof(
+    pages.length > 0 && pages.every(page => Array.isArray(page.commits)),
+    "Native source comparison pages are incomplete."
+  );
+  const first = pages[0];
+  const commits = pages.flatMap(page => page.commits);
+  requireProof(
+    ["ahead", "identical"].includes(first.status) &&
+      first.merge_base_commit?.sha === base &&
+      Number.isSafeInteger(first.total_commits) &&
+      commits.length === first.total_commits &&
+      new Set(commits.map(row => row.sha)).size === commits.length,
+    "The accepted source is not a completely observed ancestor of the delivered branch."
+  );
+  return commits;
+}
+
+/** The primary PR and its declaring commits outrank related timeline links. */
+export function validateSource(record, context, transport) {
+  const source = record.source;
+  const pr = transport.json(`${transport.root}/pulls/${source.pull_request}`);
+  requireProof(
+    pr.number === source.pull_request &&
+      pr.merged === true &&
+      pr.base?.ref === context.branch &&
+      pr.merge_commit_sha === source.merge_sha &&
+      pr.head?.sha === source.pr_head &&
+      context.declares(pr.body ?? "", context.ref),
+    "The accepted primary pull request does not declare this work item or match its merged production source."
+  );
+  if (context.suppliedPrUrl)
+    requireProof(
+      context.suppliedPrUrl === pr.html_url,
+      "The supplied pull request is not the accepted record's primary pull request; related work cannot choose authorization."
+    );
+  const merge = transport.json(`${transport.root}/commits/${source.merge_sha}`);
+  requireProof(
+    merge.parents?.some(row => row.sha === source.pr_head),
+    "The actual merge did not include the recorded primary PR head."
+  );
+  if (source.tested_head !== source.pr_head) {
+    const tested = transport.json(
+      `${transport.root}/commits/${source.tested_head}`
+    );
+    requireProof(
+      tested.parents?.some(row => row.sha === source.pr_head),
+      "The tested execution head has no native reconciliation to the primary PR head."
+    );
+  }
+  for (const sha of source.declaring_commits) {
+    const commit = transport.json(`${transport.root}/commits/${sha}`);
+    requireProof(
+      commit.sha === sha &&
+        context.declares(commit.commit?.message ?? "", context.ref),
+      "A primary source commit does not declare this exact work item."
+    );
+    compareSource(transport, sha, source.merge_sha);
+  }
+  compareSource(transport, source.merge_sha, source.delivered_sha);
+  const afterDelivery = compareSource(
+    transport,
+    source.delivered_sha,
+    source.production_snapshot_sha
+  );
+  requireProof(
+    !afterDelivery.some(row =>
+      context.declares(row.commit?.message ?? "", context.ref)
+    ),
+    "Newer source for this work item precedes the accepted snapshot but has no delivered verification proof.",
+    PENDING_PROOF
+  );
+  return pr;
+}
+
+/** Later unrelated work is allowed; newer work for this item needs new proof. */
+export function validateFrontier(record, context, transport) {
+  const tip = transport.json(
+    `${transport.root}/branches/${encodeURIComponent(context.branch)}`
+  ).commit?.sha;
+  const later = compareSource(
+    transport,
+    record.source.production_snapshot_sha,
+    tip
+  );
+  requireProof(
+    !later.some(row =>
+      context.declares(row.commit?.message ?? "", context.ref)
+    ),
+    "Newer source for this work item is awaiting fresh remote verification and evidence.",
+    PENDING_PROOF
+  );
+  return tip;
+}
+
+/** Actual declared delivery mechanism, never a convenient auxiliary green run. */
+export function validateDelivery(record, context, transport) {
+  const delivery = record.obligations.delivery;
+  if (!delivery.required) return;
+  const configured = context.policy.delivery?.[context.environment];
+  requireProof(
+    configured &&
+      ["github-actions", "artifact", "external-deployment"].includes(
+        configured.mechanism
+      ),
+    "The actual delivery mechanism is not declared in verification.completion.delivery; configure it and run canonical Verify/evidence.",
+    PENDING_PROOF
+  );
+  requireProof(
+    delivery.mechanism === configured.mechanism,
+    "The accepted delivery mechanism differs from project configuration."
+  );
+  if (configured.mechanism !== "github-actions") {
+    requireProof(
+      Array.isArray(delivery.evidence_refs) &&
+        delivery.evidence_refs.length > 0 &&
+        delivery.verified_empirically === true,
+      "The declared artifact/external delivery has no empirically verified reaching record."
+    );
+    return;
+  }
+  requireProof(
+    Array.isArray(delivery.runs) &&
+      delivery.runs.length > 0 &&
+      typeof configured.workflow_path === "string" &&
+      Array.isArray(configured.events),
+    "The configured post-merge delivery workflow and run are missing."
+  );
+  for (const expected of delivery.runs) {
+    const run = transport.json(
+      `${transport.root}/actions/runs/${expected.run_id}`
+    );
+    requireProof(
+      run.repository?.id === record.repository.id &&
+        run.workflow_id === expected.workflow_id &&
+        run.path === configured.workflow_path &&
+        run.path === expected.workflow_path &&
+        configured.events.includes(run.event) &&
+        run.event === expected.event &&
+        run.head_branch === context.branch &&
+        run.head_sha === expected.head_sha &&
+        run.run_attempt === expected.attempt,
+      "The delivery run is not the configured post-merge workflow for this source and environment."
+    );
+    requireProof(
+      run.status === "completed",
+      "The required delivery workflow is still pending; finish canonical Verify/evidence.",
+      PENDING_PROOF
+    );
+    requireProof(
+      run.conclusion === "success",
+      "The required whole delivery workflow did not succeed."
+    );
+    compareSource(transport, record.source.merge_sha, run.head_sha);
+    compareSource(transport, run.head_sha, record.source.delivered_sha);
+  }
+}

package/all/copy-overwrite/scripts/lib/history-secret-scanner.mjs

@@ -156,15 +156,30 @@ const pin = () => {
 export const provisionScanner = async destination => {
   const selected = pin();
   const archiveName = `gitleaks_${VERSION}_${process.platform}_${process.arch}.tar.gz`;
-  const response = await fetch(
-    `https://github.com/gitleaks/gitleaks/releases/download/v${VERSION}/${archiveName}`,
-    { signal: AbortSignal.timeout(120000) }
-  );
+  let response;
+  try {
+    response = await fetch(
+      `https://github.com/gitleaks/gitleaks/releases/download/v${VERSION}/${archiveName}`,
+      { signal: AbortSignal.timeout(120000) }
+    );
+  } catch {
+    throw new HistorySecretError(
+      "Pinned scanner download setup failed. Restore access to the official release and retry provisioning."
+    );
+  }
   if (!response.ok)
     throw new HistorySecretError(
       "Pinned scanner download failed. Restore access to the official release and retry provisioning."
     );
-  const bytes = Buffer.from(await response.arrayBuffer());
+  let body;
+  try {
+    body = await response.arrayBuffer();
+  } catch {
+    throw new HistorySecretError(
+      "Pinned scanner archive transfer failed. Restore access to the official release and retry provisioning."
+    );
+  }
+  const bytes = Buffer.from(body);
   if (digest(bytes) !== selected.archive)
     throw new HistorySecretError(
       "Scanner archive checksum mismatch. Discard the download and restore the official pinned release."

package/all/copy-overwrite/scripts/lib/npm-update-helper-inventory.mjs

@@ -13,6 +13,21 @@ const COMMON = [
   "lisa-test-node.mjs",
   "lib/invoked-as-script.mjs",
   "lib/bounded-spawn.mjs",
+  "lib/completion-authorization.mjs",
+  "lib/completion-proof-adapters.mjs",
+  "lib/completion-proof-conformance.mjs",
+  "lib/completion-proof-content.mjs",
+  "lib/completion-proof-errors.mjs",
+  "lib/completion-proof-github.mjs",
+  "lib/completion-proof-markdown.mjs",
+  "lib/completion-proof-projection.mjs",
+  "lib/completion-proof-publisher.mjs",
+  "lib/completion-proof-reader.mjs",
+  "lib/completion-proof-shape.mjs",
+  "lib/completion-proof-source.mjs",
+  "lib/usage-effectiveness.mjs",
+  "lib/usage-ledger-integrity.mjs",
+  "lib/usage-ledger.mjs",
   "lib/process-tree-runner.mjs",
   "lib/windows-process-job.mjs",
   "lib/windows-process-job.ps1",

package/all/copy-overwrite/scripts/lib/usage-effectiveness.d.mts

@@ -0,0 +1,27 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/** Four independent clocks and their provenance for one usage row. */
+export interface EffectivenessObservation {
+  readonly schema: 1;
+  readonly lisaVersion: string | null;
+  readonly workerConfigRevision: string | null;
+  readonly workerWallMs: number | null;
+  readonly feedbackMs: readonly number[] | null;
+  readonly workerSource: string | null;
+  readonly attention:
+    | readonly { readonly id: string; readonly source: string }[]
+    | null;
+  readonly readyAt: string | null;
+  readonly acceptedAt: string | null;
+  readonly lifecycleSources: readonly string[] | null;
+  readonly reworkSources: readonly string[] | null;
+}
+export declare function isEvidenceString(value: unknown): value is string;
+export declare function isEvidenceTime(value: unknown): value is string;
+export declare function parseEffectiveness(
+  value: unknown
+): EffectivenessObservation;
+export declare function parseEffectivenessTokens(
+  section: string
+): ReadonlyMap<string, EffectivenessObservation>;