@enwithai/product-check 0.1.0 → 0.3.0

package/schemas/assurance-common.schema.json

@@ -0,0 +1,291 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/enwithai/product-check/schemas/assurance-common.schema.json",
+  "title": "Product Check assurance shared definitions",
+  "description": "Enumerations and shapes shared by the CT3 v3.2 review and closure artifacts.",
+  "$defs": {
+    "schema_version": {
+      "const": "0.1.0"
+    },
+    "methodology_version": {
+      "const": "CT3 v3.2"
+    },
+    "verification_state": {
+      "enum": [
+        "SUSPECTED",
+        "EVIDENCE_COLLECTED",
+        "REPRODUCED",
+        "CORROBORATED",
+        "CONFIRMED",
+        "DISPROVEN",
+        "NEEDS_HUMAN_TRIAGE"
+      ]
+    },
+    "closure_state": {
+      "enum": [
+        "OPEN",
+        "ACKNOWLEDGED",
+        "IN_PROGRESS",
+        "FIX_PROPOSED",
+        "RETEST_REQUIRED",
+        "VERIFIED_FIXED",
+        "CLOSED",
+        "REJECTED_FALSE_POSITIVE",
+        "ACCEPTED_RISK",
+        "DEFERRED",
+        "REGRESSED"
+      ]
+    },
+    "risk_level": {
+      "enum": ["LOW", "MEDIUM", "HIGH", "UNDETERMINED"]
+    },
+    "gate_status": {
+      "enum": ["PASS", "CONDITIONAL", "BLOCK", "NOT_EVALUATED"]
+    },
+    "release_decision": {
+      "enum": ["GO", "CONDITIONAL_GO", "NO_GO", "UNKNOWN"]
+    },
+    "fix_status": {
+      "enum": ["PROPOSED", "IMPLEMENTED_UNVERIFIED", "VERIFIED", "REGRESSED"]
+    },
+    "lane": {
+      "enum": ["spec-outcome", "correctness", "impact", "trust-security", "experience", "operations"]
+    },
+    "phase": {
+      "enum": ["VC-P0", "VC-P1", "VC-P2", "VC-P3", "VC-P4", "VC-P5", "VC-P6", "VC-P7"]
+    },
+    "actor": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "type"],
+      "properties": {
+        "id": {
+          "type": "string",
+          "minLength": 1
+        },
+        "type": {
+          "enum": ["human", "agent", "system"]
+        }
+      }
+    },
+    "command_spec": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "argv", "purpose", "timeout_ms", "cwd", "source"],
+      "properties": {
+        "id": {
+          "type": "string",
+          "minLength": 1
+        },
+        "argv": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "minItems": 1
+        },
+        "purpose": {
+          "enum": ["build", "typecheck", "lint", "test", "smoke", "reproduction", "regression", "other"]
+        },
+        "timeout_ms": {
+          "type": "integer",
+          "minimum": 1
+        },
+        "cwd": {
+          "type": "string"
+        },
+        "source": {
+          "enum": ["policy", "fix", "corpus"]
+        }
+      }
+    },
+    "environment": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["environment_id", "runner", "lockfile_digest"],
+      "properties": {
+        "environment_id": {
+          "type": "string"
+        },
+        "runner": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["platform", "arch", "node_version", "tool_version"],
+          "properties": {
+            "platform": {
+              "type": "string"
+            },
+            "arch": {
+              "type": "string"
+            },
+            "node_version": {
+              "type": "string"
+            },
+            "tool_version": {
+              "type": "string"
+            }
+          }
+        },
+        "lockfile_digest": {
+          "type": ["string", "null"],
+          "pattern": "^[0-9a-f]{64}$"
+        }
+      }
+    },
+    "execution": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "execution_id",
+        "command_id",
+        "purpose",
+        "argv",
+        "cwd",
+        "status",
+        "exit_code",
+        "signal",
+        "duration_ms",
+        "started_at",
+        "environment_id",
+        "commit_sha",
+        "stdout_digest",
+        "stderr_digest",
+        "output_bytes",
+        "output_truncated",
+        "excerpt",
+        "reason",
+        "evidence_id"
+      ],
+      "properties": {
+        "execution_id": {
+          "type": "string"
+        },
+        "command_id": {
+          "type": "string"
+        },
+        "purpose": {
+          "enum": ["build", "typecheck", "lint", "test", "smoke", "reproduction", "regression", "other"]
+        },
+        "argv": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "cwd": {
+          "type": "string"
+        },
+        "status": {
+          "$ref": "common.schema.json#/$defs/validation_status"
+        },
+        "exit_code": {
+          "type": ["integer", "null"]
+        },
+        "signal": {
+          "type": ["string", "null"]
+        },
+        "duration_ms": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "started_at": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "environment_id": {
+          "type": "string"
+        },
+        "commit_sha": {
+          "type": ["string", "null"],
+          "pattern": "^[0-9a-f]{40}([0-9a-f]{24})?$"
+        },
+        "stdout_digest": {
+          "type": ["string", "null"],
+          "pattern": "^[0-9a-f]{64}$"
+        },
+        "stderr_digest": {
+          "type": ["string", "null"],
+          "pattern": "^[0-9a-f]{64}$"
+        },
+        "output_bytes": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "output_truncated": {
+          "type": "boolean"
+        },
+        "excerpt": {
+          "type": ["string", "null"],
+          "maxLength": 400
+        },
+        "reason": {
+          "type": ["string", "null"]
+        },
+        "evidence_id": {
+          "type": ["string", "null"]
+        }
+      }
+    },
+    "check": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["check", "result", "detail"],
+      "properties": {
+        "check": {
+          "type": "string"
+        },
+        "result": {
+          "enum": ["pass", "fail", "not-run"]
+        },
+        "detail": {
+          "type": "string"
+        }
+      }
+    },
+    "verification": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["state", "checks"],
+      "properties": {
+        "state": {
+          "$ref": "assurance-common.schema.json#/$defs/verification_state"
+        },
+        "checks": {
+          "type": "array",
+          "items": {
+            "$ref": "assurance-common.schema.json#/$defs/check"
+          }
+        }
+      }
+    },
+    "approval_evaluation": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["approval_id", "approver_id", "status", "reason"],
+      "properties": {
+        "approval_id": {
+          "type": "string"
+        },
+        "approver_id": {
+          "type": "string"
+        },
+        "status": {
+          "enum": [
+            "VALID",
+            "STALE",
+            "INVALID_SIGNATURE",
+            "UNSIGNED",
+            "UNKNOWN_APPROVER",
+            "NOT_HUMAN",
+            "SELF_APPROVAL",
+            "WRONG_SCOPE",
+            "REJECTED"
+          ]
+        },
+        "reason": {
+          "type": "string"
+        }
+      }
+    }
+  }
+}

package/schemas/assurance-policy.schema.json

@@ -0,0 +1,185 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/enwithai/product-check/schemas/assurance-policy.schema.json",
+  "title": "Product Check assurance policy",
+  "description": "Operator-owned policy: required checks (argv, no shell), approvers with Ed25519 public keys, risk routing, review convergence, release and execution settings. Never read implicitly from the scanned repository.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema_version",
+    "kind",
+    "policy_id",
+    "required_checks",
+    "approvers",
+    "risk",
+    "review",
+    "release",
+    "exec"
+  ],
+  "properties": {
+    "schema_version": {
+      "$ref": "assurance-common.schema.json#/$defs/schema_version"
+    },
+    "kind": {
+      "const": "assurance-policy"
+    },
+    "policy_id": {
+      "type": "string",
+      "minLength": 1
+    },
+    "required_checks": {
+      "type": "array",
+      "items": {
+        "$ref": "assurance-common.schema.json#/$defs/command_spec"
+      }
+    },
+    "approvers": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["id", "type", "roles", "public_key"],
+        "properties": {
+          "id": {
+            "type": "string",
+            "minLength": 1
+          },
+          "type": {
+            "enum": ["human", "bot"]
+          },
+          "roles": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "public_key": {
+            "type": "string",
+            "pattern": "BEGIN PUBLIC KEY"
+          }
+        }
+      }
+    },
+    "risk": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "protected_paths",
+        "high_risk_paths",
+        "low_risk_paths",
+        "trusted_authors",
+        "allow_low_risk_waiver",
+        "approvals"
+      ],
+      "properties": {
+        "protected_paths": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["pattern", "owners"],
+            "properties": {
+              "pattern": {
+                "type": "string",
+                "minLength": 1
+              },
+              "owners": {
+                "type": "array",
+                "items": {
+                  "type": "string"
+                }
+              }
+            }
+          }
+        },
+        "high_risk_paths": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "low_risk_paths": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "trusted_authors": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "allow_low_risk_waiver": {
+          "type": "boolean"
+        },
+        "approvals": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["LOW", "MEDIUM", "HIGH"],
+          "properties": {
+            "LOW": {
+              "type": "integer",
+              "minimum": 0
+            },
+            "MEDIUM": {
+              "type": "integer",
+              "minimum": 1
+            },
+            "HIGH": {
+              "type": "integer",
+              "minimum": 1
+            }
+          }
+        }
+      }
+    },
+    "review": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["max_cycles", "fail_closed_unverified_p0"],
+      "properties": {
+        "max_cycles": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 20
+        },
+        "fail_closed_unverified_p0": {
+          "type": "boolean"
+        }
+      }
+    },
+    "release": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["rollback_plan", "staged_rollout"],
+      "properties": {
+        "rollback_plan": {
+          "type": ["string", "null"]
+        },
+        "staged_rollout": {
+          "type": ["string", "null"]
+        }
+      }
+    },
+    "exec": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["env_allowlist", "max_output_bytes"],
+      "properties": {
+        "env_allowlist": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "pattern": "^[A-Za-z_][A-Za-z0-9_]*$"
+          }
+        },
+        "max_output_bytes": {
+          "type": "integer",
+          "minimum": 1024,
+          "maximum": 268435456
+        }
+      }
+    }
+  }
+}

package/schemas/blueprint.schema.json

@@ -62,6 +62,9 @@
           "items": {
             "type": "string"
           }
+        },
+        "as_built": {
+          "$ref": "as-built-spec.schema.json#/$defs/body"
         }
       }
     },