@enwithai/product-check 0.1.0 → 0.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (102) hide show
  1. package/ATTRIBUTION.md +6 -6
  2. package/CHANGELOG.md +66 -0
  3. package/NOTICE.md +5 -3
  4. package/README.md +34 -19
  5. package/SECURITY.md +5 -1
  6. package/dashboard/assurance.css +71 -0
  7. package/dashboard/assurance.js +21 -0
  8. package/dashboard/dashboard.css +6 -0
  9. package/dist/assurance/adapters.d.ts +32 -0
  10. package/dist/assurance/adapters.js +76 -0
  11. package/dist/assurance/approvals.d.ts +34 -0
  12. package/dist/assurance/approvals.js +133 -0
  13. package/dist/assurance/cli.d.ts +13 -0
  14. package/dist/assurance/cli.js +863 -0
  15. package/dist/assurance/dashboard.d.ts +18 -0
  16. package/dist/assurance/dashboard.js +267 -0
  17. package/dist/assurance/diff.d.ts +20 -0
  18. package/dist/assurance/diff.js +99 -0
  19. package/dist/assurance/evidence-log.d.ts +20 -0
  20. package/dist/assurance/evidence-log.js +100 -0
  21. package/dist/assurance/fix-packets.d.ts +12 -0
  22. package/dist/assurance/fix-packets.js +178 -0
  23. package/dist/assurance/gate.d.ts +37 -0
  24. package/dist/assurance/gate.js +324 -0
  25. package/dist/assurance/lanes.d.ts +61 -0
  26. package/dist/assurance/lanes.js +380 -0
  27. package/dist/assurance/policy.d.ts +10 -0
  28. package/dist/assurance/policy.js +85 -0
  29. package/dist/assurance/proof.d.ts +35 -0
  30. package/dist/assurance/proof.js +146 -0
  31. package/dist/assurance/register.d.ts +41 -0
  32. package/dist/assurance/register.js +480 -0
  33. package/dist/assurance/render-md.d.ts +17 -0
  34. package/dist/assurance/render-md.js +212 -0
  35. package/dist/assurance/repo-state.d.ts +15 -0
  36. package/dist/assurance/repo-state.js +79 -0
  37. package/dist/assurance/review.d.ts +52 -0
  38. package/dist/assurance/review.js +408 -0
  39. package/dist/assurance/risk.d.ts +21 -0
  40. package/dist/assurance/risk.js +184 -0
  41. package/dist/assurance/types.d.ts +573 -0
  42. package/dist/assurance/types.js +6 -0
  43. package/dist/assurance/util.d.ts +24 -0
  44. package/dist/assurance/util.js +89 -0
  45. package/dist/assurance/verification.d.ts +30 -0
  46. package/dist/assurance/verification.js +212 -0
  47. package/dist/assurance/verify.d.ts +26 -0
  48. package/dist/assurance/verify.js +304 -0
  49. package/dist/blueprint/build.d.ts +3 -1
  50. package/dist/blueprint/build.js +41 -5
  51. package/dist/cli/run.js +103 -5
  52. package/dist/contract/contract.d.ts +4 -0
  53. package/dist/contract/contract.js +16 -0
  54. package/dist/dashboard/render.d.ts +5 -0
  55. package/dist/dashboard/render.js +107 -3
  56. package/dist/discovery/pops.d.ts +2 -0
  57. package/dist/discovery/pops.js +7 -5
  58. package/dist/exec/process.d.ts +27 -0
  59. package/dist/exec/process.js +175 -0
  60. package/dist/importers/operational.d.ts +56 -0
  61. package/dist/importers/operational.js +217 -0
  62. package/dist/importers/reports.d.ts +24 -0
  63. package/dist/importers/reports.js +37 -1
  64. package/dist/inspectors/source/surface.d.ts +30 -0
  65. package/dist/inspectors/source/surface.js +529 -0
  66. package/dist/parse/yaml.d.ts +4 -0
  67. package/dist/parse/yaml.js +39 -0
  68. package/dist/reporting/markdown.d.ts +1 -0
  69. package/dist/reporting/markdown.js +18 -1
  70. package/dist/reporting/spec-markdown.d.ts +9 -0
  71. package/dist/reporting/spec-markdown.js +144 -0
  72. package/dist/run.d.ts +2 -0
  73. package/dist/run.js +52 -2
  74. package/dist/schema/registry.js +10 -0
  75. package/dist/scoring/score.js +1 -1
  76. package/dist/spec/build.d.ts +28 -0
  77. package/dist/spec/build.js +278 -0
  78. package/dist/types.d.ts +78 -2
  79. package/dist/types.js +6 -1
  80. package/dist/validation/catalog.d.ts +1 -1
  81. package/dist/validation/catalog.js +125 -2
  82. package/dist/validation/context.d.ts +6 -1
  83. package/dist/validation/import-evaluators.js +37 -3
  84. package/dist/validation/integrity.js +4 -0
  85. package/dist/validation/operational-evaluators.d.ts +3 -0
  86. package/dist/validation/operational-evaluators.js +153 -0
  87. package/dist/validation/source-evaluators.js +1 -1
  88. package/package.json +4 -1
  89. package/schemas/approval.schema.json +98 -0
  90. package/schemas/as-built-spec.schema.json +356 -0
  91. package/schemas/assurance-common.schema.json +291 -0
  92. package/schemas/assurance-policy.schema.json +185 -0
  93. package/schemas/blueprint.schema.json +3 -0
  94. package/schemas/change-review.schema.json +711 -0
  95. package/schemas/closure-register.schema.json +499 -0
  96. package/schemas/evidence-record.schema.json +94 -0
  97. package/schemas/fix-packet.schema.json +272 -0
  98. package/schemas/release-gate.schema.json +308 -0
  99. package/schemas/reviewer-findings.schema.json +49 -0
  100. package/schemas/scan-contract.schema.json +20 -0
  101. package/schemas/scorecard.schema.json +1 -1
  102. package/schemas/verification-run.schema.json +199 -0
@@ -0,0 +1,98 @@
1
+ {
2
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
3
+ "$id": "https://github.com/enwithai/product-check/schemas/approval.schema.json",
4
+ "title": "Product Check approval",
5
+ "description": "A signed accountable decision. Counts only when the Ed25519 signature verifies against an approver key in the policy, the approver is human, the scope matches and reviewed_sha is the current commit.",
6
+ "type": "object",
7
+ "additionalProperties": false,
8
+ "required": [
9
+ "schema_version",
10
+ "kind",
11
+ "approval_id",
12
+ "approver",
13
+ "scope",
14
+ "reviewed_sha",
15
+ "decision",
16
+ "comment",
17
+ "created_at",
18
+ "signature"
19
+ ],
20
+ "properties": {
21
+ "schema_version": {
22
+ "$ref": "assurance-common.schema.json#/$defs/schema_version"
23
+ },
24
+ "kind": {
25
+ "const": "approval"
26
+ },
27
+ "approval_id": {
28
+ "type": "string",
29
+ "pattern": "^AP-[0-9A-F]{12}$"
30
+ },
31
+ "approver": {
32
+ "type": "object",
33
+ "additionalProperties": false,
34
+ "required": ["id", "type"],
35
+ "properties": {
36
+ "id": {
37
+ "type": "string",
38
+ "minLength": 1
39
+ },
40
+ "type": {
41
+ "enum": ["human", "bot"]
42
+ }
43
+ }
44
+ },
45
+ "scope": {
46
+ "type": "object",
47
+ "additionalProperties": false,
48
+ "required": ["type", "ref"],
49
+ "properties": {
50
+ "type": {
51
+ "enum": ["change", "closure", "risk-acceptance", "false-positive", "release", "continue"]
52
+ },
53
+ "ref": {
54
+ "type": "string",
55
+ "minLength": 1
56
+ }
57
+ }
58
+ },
59
+ "reviewed_sha": {
60
+ "type": "string",
61
+ "minLength": 7
62
+ },
63
+ "decision": {
64
+ "enum": ["approve", "reject"]
65
+ },
66
+ "comment": {
67
+ "type": "string"
68
+ },
69
+ "created_at": {
70
+ "type": "string",
71
+ "format": "date-time"
72
+ },
73
+ "signature": {
74
+ "oneOf": [
75
+ {
76
+ "type": "null"
77
+ },
78
+ {
79
+ "type": "object",
80
+ "additionalProperties": false,
81
+ "required": ["algorithm", "key_id", "value"],
82
+ "properties": {
83
+ "algorithm": {
84
+ "const": "ed25519"
85
+ },
86
+ "key_id": {
87
+ "type": "string",
88
+ "pattern": "^[0-9a-f]{16}$"
89
+ },
90
+ "value": {
91
+ "type": "string"
92
+ }
93
+ }
94
+ }
95
+ ]
96
+ }
97
+ }
98
+ }
@@ -0,0 +1,356 @@
1
+ {
2
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
3
+ "$id": "https://github.com/enwithai/product-check/schemas/as-built-spec.schema.json",
4
+ "title": "Product Check as-built specification",
5
+ "description": "A specification reverse-engineered from a repository's structure: the discovered surface (pages, endpoints, entities, integrations, configuration names, authentication boundaries, test titles) with evidence, the requirements derived from it with their certainty, and the clarifications the code cannot answer. Nothing was executed.",
6
+ "type": "object",
7
+ "additionalProperties": false,
8
+ "required": [
9
+ "schema_version",
10
+ "kind",
11
+ "generated_at",
12
+ "tool",
13
+ "target",
14
+ "surface",
15
+ "stories",
16
+ "requirements",
17
+ "non_functional",
18
+ "success_criteria",
19
+ "edge_cases",
20
+ "clarifications",
21
+ "uncertainties",
22
+ "evidence",
23
+ "limitations"
24
+ ],
25
+ "properties": {
26
+ "schema_version": {
27
+ "$ref": "common.schema.json#/$defs/schema_version"
28
+ },
29
+ "kind": {
30
+ "const": "as-built-spec"
31
+ },
32
+ "generated_at": {
33
+ "$ref": "common.schema.json#/$defs/timestamp"
34
+ },
35
+ "tool": {
36
+ "type": "object",
37
+ "additionalProperties": false,
38
+ "required": ["name", "version"],
39
+ "properties": {
40
+ "name": {
41
+ "const": "product-check"
42
+ },
43
+ "version": {
44
+ "type": "string"
45
+ }
46
+ }
47
+ },
48
+ "target": {
49
+ "type": "object",
50
+ "additionalProperties": false,
51
+ "required": ["name", "repository", "commit", "ref"],
52
+ "properties": {
53
+ "name": {
54
+ "type": "string"
55
+ },
56
+ "repository": {
57
+ "type": "string"
58
+ },
59
+ "commit": {
60
+ "type": ["string", "null"]
61
+ },
62
+ "ref": {
63
+ "type": ["string", "null"]
64
+ }
65
+ }
66
+ },
67
+ "surface": {
68
+ "type": "array",
69
+ "items": {
70
+ "$ref": "#/$defs/surface_entry"
71
+ }
72
+ },
73
+ "stories": {
74
+ "type": "array",
75
+ "items": {
76
+ "$ref": "#/$defs/story"
77
+ }
78
+ },
79
+ "requirements": {
80
+ "type": "array",
81
+ "items": {
82
+ "$ref": "#/$defs/requirement"
83
+ }
84
+ },
85
+ "non_functional": {
86
+ "type": "array",
87
+ "items": {
88
+ "$ref": "#/$defs/requirement"
89
+ }
90
+ },
91
+ "success_criteria": {
92
+ "type": "array",
93
+ "items": {
94
+ "$ref": "#/$defs/requirement"
95
+ }
96
+ },
97
+ "edge_cases": {
98
+ "type": "array",
99
+ "items": {
100
+ "$ref": "#/$defs/requirement"
101
+ }
102
+ },
103
+ "clarifications": {
104
+ "type": "array",
105
+ "items": {
106
+ "type": "string"
107
+ }
108
+ },
109
+ "uncertainties": {
110
+ "type": "array",
111
+ "items": {
112
+ "type": "string"
113
+ }
114
+ },
115
+ "evidence": {
116
+ "type": "array",
117
+ "items": {
118
+ "$ref": "evidence.schema.json"
119
+ }
120
+ },
121
+ "limitations": {
122
+ "type": "array",
123
+ "items": {
124
+ "type": "object",
125
+ "additionalProperties": false,
126
+ "required": ["code", "message", "count", "paths"],
127
+ "properties": {
128
+ "code": {
129
+ "type": "string"
130
+ },
131
+ "message": {
132
+ "type": "string"
133
+ },
134
+ "count": {
135
+ "type": "integer",
136
+ "minimum": 0
137
+ },
138
+ "paths": {
139
+ "type": "array",
140
+ "items": {
141
+ "type": "string"
142
+ }
143
+ }
144
+ }
145
+ }
146
+ }
147
+ },
148
+ "$defs": {
149
+ "surface_entry": {
150
+ "type": "object",
151
+ "additionalProperties": false,
152
+ "required": [
153
+ "id",
154
+ "kind",
155
+ "name",
156
+ "method",
157
+ "area",
158
+ "detail",
159
+ "location",
160
+ "certainty",
161
+ "auth_hint",
162
+ "evidence_ids"
163
+ ],
164
+ "properties": {
165
+ "id": {
166
+ "type": "string",
167
+ "pattern": "^SRF-[0-9A-F]{10}$"
168
+ },
169
+ "kind": {
170
+ "enum": ["page", "endpoint", "entity", "config", "integration", "auth-boundary", "test"]
171
+ },
172
+ "name": {
173
+ "type": "string"
174
+ },
175
+ "method": {
176
+ "type": ["string", "null"]
177
+ },
178
+ "area": {
179
+ "type": "string"
180
+ },
181
+ "detail": {
182
+ "type": "string"
183
+ },
184
+ "location": {
185
+ "type": "object",
186
+ "additionalProperties": false,
187
+ "required": ["path", "line"],
188
+ "properties": {
189
+ "path": {
190
+ "type": "string"
191
+ },
192
+ "line": {
193
+ "type": ["integer", "null"],
194
+ "minimum": 1
195
+ }
196
+ }
197
+ },
198
+ "certainty": {
199
+ "enum": ["observed", "inferred"]
200
+ },
201
+ "auth_hint": {
202
+ "type": "boolean"
203
+ },
204
+ "evidence_ids": {
205
+ "type": "array",
206
+ "items": {
207
+ "$ref": "common.schema.json#/$defs/evidence_id"
208
+ }
209
+ }
210
+ }
211
+ },
212
+ "story": {
213
+ "type": "object",
214
+ "additionalProperties": false,
215
+ "required": [
216
+ "id",
217
+ "area",
218
+ "title",
219
+ "critical_journey",
220
+ "surface_ids",
221
+ "requirement_ids",
222
+ "test_behaviours"
223
+ ],
224
+ "properties": {
225
+ "id": {
226
+ "type": "string",
227
+ "pattern": "^US-[0-9]+$"
228
+ },
229
+ "area": {
230
+ "type": "string"
231
+ },
232
+ "title": {
233
+ "type": "string"
234
+ },
235
+ "critical_journey": {
236
+ "type": ["string", "null"]
237
+ },
238
+ "surface_ids": {
239
+ "type": "array",
240
+ "items": {
241
+ "type": "string",
242
+ "pattern": "^SRF-[0-9A-F]{10}$"
243
+ }
244
+ },
245
+ "requirement_ids": {
246
+ "type": "array",
247
+ "items": {
248
+ "type": "string",
249
+ "pattern": "^FR-[0-9]{3,}$"
250
+ }
251
+ },
252
+ "test_behaviours": {
253
+ "type": "array",
254
+ "items": {
255
+ "type": "string"
256
+ }
257
+ }
258
+ }
259
+ },
260
+ "requirement": {
261
+ "type": "object",
262
+ "additionalProperties": false,
263
+ "required": ["id", "statement", "certainty", "surface_ids", "evidence_ids"],
264
+ "properties": {
265
+ "id": {
266
+ "type": "string",
267
+ "pattern": "^(FR|NFR|SC|EC)-[0-9]{3,}$"
268
+ },
269
+ "statement": {
270
+ "type": "string"
271
+ },
272
+ "certainty": {
273
+ "enum": ["observed", "inferred", "hypothesis"]
274
+ },
275
+ "surface_ids": {
276
+ "type": "array",
277
+ "items": {
278
+ "type": "string",
279
+ "pattern": "^SRF-[0-9A-F]{10}$"
280
+ }
281
+ },
282
+ "evidence_ids": {
283
+ "type": "array",
284
+ "items": {
285
+ "$ref": "common.schema.json#/$defs/evidence_id"
286
+ }
287
+ }
288
+ }
289
+ },
290
+ "body": {
291
+ "description": "The derived content of an as-built spec, as embedded in a blueprint (`as_is.as_built`).",
292
+ "type": "object",
293
+ "additionalProperties": false,
294
+ "required": [
295
+ "surface",
296
+ "stories",
297
+ "requirements",
298
+ "non_functional",
299
+ "success_criteria",
300
+ "edge_cases",
301
+ "clarifications",
302
+ "uncertainties"
303
+ ],
304
+ "properties": {
305
+ "surface": {
306
+ "type": "array",
307
+ "items": {
308
+ "$ref": "#/$defs/surface_entry"
309
+ }
310
+ },
311
+ "stories": {
312
+ "type": "array",
313
+ "items": {
314
+ "$ref": "#/$defs/story"
315
+ }
316
+ },
317
+ "requirements": {
318
+ "type": "array",
319
+ "items": {
320
+ "$ref": "#/$defs/requirement"
321
+ }
322
+ },
323
+ "non_functional": {
324
+ "type": "array",
325
+ "items": {
326
+ "$ref": "#/$defs/requirement"
327
+ }
328
+ },
329
+ "success_criteria": {
330
+ "type": "array",
331
+ "items": {
332
+ "$ref": "#/$defs/requirement"
333
+ }
334
+ },
335
+ "edge_cases": {
336
+ "type": "array",
337
+ "items": {
338
+ "$ref": "#/$defs/requirement"
339
+ }
340
+ },
341
+ "clarifications": {
342
+ "type": "array",
343
+ "items": {
344
+ "type": "string"
345
+ }
346
+ },
347
+ "uncertainties": {
348
+ "type": "array",
349
+ "items": {
350
+ "type": "string"
351
+ }
352
+ }
353
+ }
354
+ }
355
+ }
356
+ }