@gate-forge/core 0.1.0

package/dist/schemas/obligation.js

@@ -0,0 +1,46 @@
+/**
+ * Obligation schema (plan §4.5): a concrete test requirement generated
+ * from a resource and a policy. Obligation ids are
+ * `<resourceId>:<contract>` (e.g. `tenant.accounts:crud:update`) and the
+ * fingerprint over their identity is what baselines store (pin #2).
+ *
+ * Id grammar: the id splits at the FIRST colon — `resourceId` never
+ * contains a colon, `contract` may (e.g. `crud:update`).
+ */
+import { z } from 'zod';
+import { ContractNameSchema, SchemaVersionField } from './common.js';
+import { LifecycleSchema } from './classification.js';
+/**
+ * The obligation artifact. `lifecycle` carries the classification
+ * lifecycle attributes relevant to this obligation — it is part of the
+ * fingerprint identity (pin #2), so it must travel with the obligation.
+ */
+export const ObligationSchema = z
+    .object({
+    schemaVersion: SchemaVersionField,
+    /** `<resourceId>:<contract>`. */
+    id: z.string().min(1),
+    /** Resource the obligation attaches to (no colons — it is the id prefix). */
+    resourceId: z
+        .string()
+        .min(1)
+        .regex(/^[^:]+$/, "resourceId must not contain ':' (ids split at the first colon)"),
+    /** Contract name required by the policy, e.g. `crud:update`. */
+    contract: ContractNameSchema,
+    /** Policy id that generated this obligation. */
+    policyId: z.string().min(1),
+    /** Classification lifecycle attributes relevant to this contract. */
+    lifecycle: LifecycleSchema,
+})
+    .strict()
+    .superRefine((obligation, ctx) => {
+    const expected = `${obligation.resourceId}:${obligation.contract}`;
+    if (obligation.id !== expected) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['id'],
+            message: `obligation id must be '<resourceId>:<contract>': expected '${expected}', got '${obligation.id}'`,
+        });
+    }
+});
+//# sourceMappingURL=obligation.js.map

package/dist/schemas/obligation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"obligation.js","sourceRoot":"","sources":["../../src/schemas/obligation.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,aAAa,EAAE,kBAAkB;IACjC,iCAAiC;IACjC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,6EAA6E;IAC7E,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,KAAK,CAAC,SAAS,EAAE,gEAAgE,CAAC;IACrF,gEAAgE;IAChE,QAAQ,EAAE,kBAAkB;IAC5B,gDAAgD;IAChD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,qEAAqE;IACrE,SAAS,EAAE,eAAe;CAC3B,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE;IAC/B,MAAM,QAAQ,GAAG,GAAG,UAAU,CAAC,UAAU,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;IACnE,IAAI,UAAU,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;QAC/B,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,IAAI,CAAC;YACZ,OAAO,EAAE,8DAA8D,QAAQ,WAAW,UAAU,CAAC,EAAE,GAAG;SAC3G,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/schemas/plugin.d.ts

@@ -0,0 +1,19 @@
+/**
+ * PluginRegistration schema: the pinned identity of a plugin as it
+ * appears in run manifests (pin #4) and the GPP/3 handshake (pin #5).
+ * Mismatch between the registered and the answering plugin identity is
+ * a fail-closed protocol error (GF-12/18, enforced by plugin-protocol).
+ */
+import { z } from 'zod';
+/** Pinned plugin identity. */
+export declare const PluginRegistrationSchema: z.ZodObject<{
+    id: z.ZodString;
+    version: z.ZodString;
+    transport: z.ZodEnum<{
+        subprocess: "subprocess";
+        "in-process": "in-process";
+    }>;
+}, z.core.$strict>;
+/** Inferred plugin-registration shape. */
+export type PluginRegistration = z.infer<typeof PluginRegistrationSchema>;
+//# sourceMappingURL=plugin.d.ts.map

package/dist/schemas/plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../src/schemas/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,8BAA8B;AAC9B,eAAO,MAAM,wBAAwB;;;;;;;kBAS1B,CAAC;AAEZ,0CAA0C;AAC1C,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}

package/dist/schemas/plugin.js

@@ -0,0 +1,20 @@
+/**
+ * PluginRegistration schema: the pinned identity of a plugin as it
+ * appears in run manifests (pin #4) and the GPP/3 handshake (pin #5).
+ * Mismatch between the registered and the answering plugin identity is
+ * a fail-closed protocol error (GF-12/18, enforced by plugin-protocol).
+ */
+import { z } from 'zod';
+import { TransportSchema } from './common.js';
+/** Pinned plugin identity. */
+export const PluginRegistrationSchema = z
+    .object({
+    /** Plugin id, e.g. `gateforge.pack-sqlalchemy`. */
+    id: z.string().min(1),
+    /** Plugin version string (semver recommended, not required). */
+    version: z.string().min(1),
+    /** How the engine talks to this plugin (ADR 0002). */
+    transport: TransportSchema,
+})
+    .strict();
+//# sourceMappingURL=plugin.js.map

package/dist/schemas/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../src/schemas/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,8BAA8B;AAC9B,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACtC,MAAM,CAAC;IACN,mDAAmD;IACnD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,gEAAgE;IAChE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,sDAAsD;IACtD,SAAS,EAAE,eAAe;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC"}

package/dist/schemas/policy.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Policy schemas (plan §4.4): declarative YAML mapping resource
+ * attributes to required test obligations. Policies are pure data —
+ * there is no code escape hatch (ADR 0002).
+ */
+import { z } from 'zod';
+/**
+ * Attribute matchers a resource must satisfy for the policy to apply.
+ * All provided matchers must match (AND semantics); omitted matchers are
+ * wildcard.
+ */
+export declare const PolicyWhenSchema: z.ZodObject<{
+    kind: z.ZodOptional<z.ZodString>;
+    exposure: z.ZodOptional<z.ZodEnum<{
+        "user-facing": "user-facing";
+        internal: "internal";
+    }>>;
+    plane: z.ZodOptional<z.ZodEnum<{
+        tenant: "tenant";
+        master: "master";
+        global: "global";
+    }>>;
+    capability: z.ZodOptional<z.ZodString>;
+    consumed: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+/** Inferred policy matcher shape. */
+export type PolicyWhen = z.infer<typeof PolicyWhenSchema>;
+/** One policy: when matched, require the listed contracts as obligations. */
+export declare const PolicySchema: z.ZodObject<{
+    id: z.ZodString;
+    when: z.ZodObject<{
+        kind: z.ZodOptional<z.ZodString>;
+        exposure: z.ZodOptional<z.ZodEnum<{
+            "user-facing": "user-facing";
+            internal: "internal";
+        }>>;
+        plane: z.ZodOptional<z.ZodEnum<{
+            tenant: "tenant";
+            master: "master";
+            global: "global";
+        }>>;
+        capability: z.ZodOptional<z.ZodString>;
+        consumed: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>;
+    require: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+/** Inferred single-policy shape. */
+export type Policy = z.infer<typeof PolicySchema>;
+/** The policies document loaded from the path in `.gateforge.yml`. */
+export declare const PolicyFileSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    policies: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        when: z.ZodObject<{
+            kind: z.ZodOptional<z.ZodString>;
+            exposure: z.ZodOptional<z.ZodEnum<{
+                "user-facing": "user-facing";
+                internal: "internal";
+            }>>;
+            plane: z.ZodOptional<z.ZodEnum<{
+                tenant: "tenant";
+                master: "master";
+                global: "global";
+            }>>;
+            capability: z.ZodOptional<z.ZodString>;
+            consumed: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strict>;
+        require: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+/** Inferred policies-document shape. */
+export type PolicyFile = z.infer<typeof PolicyFileSchema>;
+//# sourceMappingURL=policy.d.ts.map

package/dist/schemas/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/schemas/policy.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;GAIG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;kBAalB,CAAC;AAEZ,qCAAqC;AACrC,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,6EAA6E;AAC7E,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;kBASd,CAAC;AAEZ,oCAAoC;AACpC,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAElD,sEAAsE;AACtE,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;kBAMlB,CAAC;AAEZ,wCAAwC;AACxC,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC"}

package/dist/schemas/policy.js

@@ -0,0 +1,46 @@
+/**
+ * Policy schemas (plan §4.4): declarative YAML mapping resource
+ * attributes to required test obligations. Policies are pure data —
+ * there is no code escape hatch (ADR 0002).
+ */
+import { z } from 'zod';
+import { ContractNameSchema, ExposureSchema, PlaneSchema, SchemaVersionField } from './common.js';
+/**
+ * Attribute matchers a resource must satisfy for the policy to apply.
+ * All provided matchers must match (AND semantics); omitted matchers are
+ * wildcard.
+ */
+export const PolicyWhenSchema = z
+    .object({
+    /** Resource kind, e.g. `sqlalchemy.table`. */
+    kind: z.string().min(1).optional(),
+    /** Resource exposure. */
+    exposure: ExposureSchema.optional(),
+    /** Resource plane. */
+    plane: PlaneSchema.optional(),
+    /** Endpoint capability match: true when the resource's `capabilities` attribute contains this value. Non-endpoint resources never match. */
+    capability: z.string().min(1).optional(),
+    /** Endpoint consumption match: `true` matches resources whose `frontendConsumed` attribute is exactly `true`; `false` matches everything else (including non-endpoints). Omitted = wildcard. */
+    consumed: z.boolean().optional(),
+})
+    .strict();
+/** One policy: when matched, require the listed contracts as obligations. */
+export const PolicySchema = z
+    .object({
+    /** Stable policy id; appears in obligation ids, reports, and SARIF rules. */
+    id: z.string().min(1),
+    /** Attribute matchers selecting the resources this policy applies to. */
+    when: PolicyWhenSchema,
+    /** Contract names to require (each becomes `<resourceId>:<contract>`). */
+    require: z.array(ContractNameSchema).min(1),
+})
+    .strict();
+/** The policies document loaded from the path in `.gateforge.yml`. */
+export const PolicyFileSchema = z
+    .object({
+    schemaVersion: SchemaVersionField,
+    /** Policy list, evaluated in order. */
+    policies: z.array(PolicySchema).min(1),
+})
+    .strict();
+//# sourceMappingURL=policy.js.map

package/dist/schemas/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/schemas/policy.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAElG;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,8CAA8C;IAC9C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,yBAAyB;IACzB,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE;IACnC,sBAAsB;IACtB,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE;IAC7B,4IAA4I;IAC5I,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,gMAAgM;IAChM,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ,6EAA6E;AAC7E,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,6EAA6E;IAC7E,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,yEAAyE;IACzE,IAAI,EAAE,gBAAgB;IACtB,0EAA0E;IAC1E,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5C,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ,sEAAsE;AACtE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,aAAa,EAAE,kBAAkB;IACjC,uCAAuC;IACvC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACvC,CAAC;KACD,MAAM,EAAE,CAAC"}

package/dist/schemas/resource.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Resource schema (plan §4.2): a stable, code-derived object that may
+ * carry obligations. Produced by detectors, keyed by a stable resource id.
+ */
+import { z } from 'zod';
+/**
+ * A discovered resource. `attributes` is detector-defined payload data
+ * (e.g. table name, framework style) and is deliberately open — detectors
+ * own their attribute vocabulary. Identity, kind, and provenance are not.
+ */
+export declare const ResourceSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    id: z.ZodString;
+    kind: z.ZodString;
+    source: z.ZodString;
+    location: z.ZodObject<{
+        file: z.ZodString;
+        line: z.ZodNumber;
+        col: z.ZodNumber;
+    }, z.core.$strict>;
+    detectorVersion: z.ZodString;
+    attributes: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+}, z.core.$strict>;
+/** Inferred resource shape. */
+export type Resource = z.infer<typeof ResourceSchema>;
+//# sourceMappingURL=resource.d.ts.map

package/dist/schemas/resource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../../src/schemas/resource.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;GAIG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;kBAgBhB,CAAC;AAEZ,+BAA+B;AAC/B,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC"}

package/dist/schemas/resource.js

@@ -0,0 +1,29 @@
+/**
+ * Resource schema (plan §4.2): a stable, code-derived object that may
+ * carry obligations. Produced by detectors, keyed by a stable resource id.
+ */
+import { z } from 'zod';
+import { LocationSchema, SchemaVersionField } from './common.js';
+/**
+ * A discovered resource. `attributes` is detector-defined payload data
+ * (e.g. table name, framework style) and is deliberately open — detectors
+ * own their attribute vocabulary. Identity, kind, and provenance are not.
+ */
+export const ResourceSchema = z
+    .object({
+    schemaVersion: SchemaVersionField,
+    /** Stable resource id, e.g. `tenant.accounts`. */
+    id: z.string().min(1),
+    /** Detector framework kind, e.g. `sqlalchemy.table`. */
+    kind: z.string().min(1),
+    /** Repo-root-relative path of the file the resource was found in. */
+    source: z.string().min(1),
+    /** Exact source location of the declaration. */
+    location: LocationSchema,
+    /** Version of the detector that produced this resource. */
+    detectorVersion: z.string().min(1),
+    /** Detector-specific discovered attributes (open payload). */
+    attributes: z.record(z.string(), z.unknown()),
+})
+    .strict();
+//# sourceMappingURL=resource.js.map

package/dist/schemas/resource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource.js","sourceRoot":"","sources":["../../src/schemas/resource.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjE;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,MAAM,CAAC;IACN,aAAa,EAAE,kBAAkB;IACjC,kDAAkD;IAClD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,wDAAwD;IACxD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,qEAAqE;IACrE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,gDAAgD;IAChD,QAAQ,EAAE,cAAc;IACxB,2DAA2D;IAC3D,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,8DAA8D;IAC9D,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;CAC9C,CAAC;KACD,MAAM,EAAE,CAAC"}

package/dist/schemas/run-manifest.d.ts

@@ -0,0 +1,72 @@
+/**
+ * RunManifest schema (pin #4): identity of a single gateforge run. Every
+ * verdict and every witnessed evidence record references its run.
+ *
+ * `startedAt` comes from the injected clock (deterministic tests), never
+ * the wall clock. At shutdown the witness service appends the record ids
+ * it issued to the manifest (pin #7).
+ */
+import { z } from 'zod';
+/** Which changed-file provider backs the run (pin #5 of architecture contracts). */
+export declare const ChangedProviderSchema: z.ZodEnum<{
+    "local-staged": "local-staged";
+    "github-pr": "github-pr";
+    "gitlab-mr": "gitlab-mr";
+    "all-files": "all-files";
+}>;
+/** Inferred changed-provider shape. */
+export type ChangedProvider = z.infer<typeof ChangedProviderSchema>;
+/**
+ * V2 evidence attestation envelope (plan §11.3): the witness's signed
+ * statement of its run context and issued record set. `attestationVersion`
+ * is an explicit literal — never a reinterpreted legacy field — so an old
+ * `{runId, recordIds}` MAC cannot authorize evidence even when it
+ * verifies under its own format.
+ */
+export declare const AttestationSchema: z.ZodObject<{
+    attestationVersion: z.ZodLiteral<2>;
+    runId: z.ZodUUID;
+    invocationId: z.ZodUUID;
+    inputDigest: z.ZodString;
+    recordIds: z.ZodArray<z.ZodString>;
+    mac: z.ZodString;
+}, z.core.$strict>;
+/** Inferred v2 attestation envelope shape. */
+export type Attestation = z.infer<typeof AttestationSchema>;
+/** The run manifest artifact. */
+export declare const RunManifestSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    runId: z.ZodUUID;
+    startedAt: z.ZodISODateTime;
+    gitSha: z.ZodNullable<z.ZodString>;
+    provider: z.ZodEnum<{
+        "local-staged": "local-staged";
+        "github-pr": "github-pr";
+        "gitlab-mr": "gitlab-mr";
+        "all-files": "all-files";
+    }>;
+    plugins: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        version: z.ZodString;
+        transport: z.ZodEnum<{
+            subprocess: "subprocess";
+            "in-process": "in-process";
+        }>;
+    }, z.core.$strict>>;
+    attestationScope: z.ZodNullable<z.ZodString>;
+    recordIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    recordIdsMac: z.ZodOptional<z.ZodString>;
+    invocationId: z.ZodOptional<z.ZodUUID>;
+    inputDigest: z.ZodOptional<z.ZodString>;
+    attestation: z.ZodOptional<z.ZodObject<{
+        attestationVersion: z.ZodLiteral<2>;
+        runId: z.ZodUUID;
+        invocationId: z.ZodUUID;
+        inputDigest: z.ZodString;
+        recordIds: z.ZodArray<z.ZodString>;
+        mac: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+/** Inferred run-manifest shape. */
+export type RunManifest = z.infer<typeof RunManifestSchema>;
+//# sourceMappingURL=run-manifest.d.ts.map

package/dist/schemas/run-manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-manifest.d.ts","sourceRoot":"","sources":["../../src/schemas/run-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,oFAAoF;AACpF,eAAO,MAAM,qBAAqB;;;;;EAKhC,CAAC;AAEH,uCAAuC;AACvC,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB;;;;;;;kBA6BnB,CAAC;AAEZ,8CAA8C;AAC9C,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,iCAAiC;AACjC,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAmEnB,CAAC;AAEZ,mCAAmC;AACnC,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}

package/dist/schemas/run-manifest.js

@@ -0,0 +1,125 @@
+/**
+ * RunManifest schema (pin #4): identity of a single gateforge run. Every
+ * verdict and every witnessed evidence record references its run.
+ *
+ * `startedAt` comes from the injected clock (deterministic tests), never
+ * the wall clock. At shutdown the witness service appends the record ids
+ * it issued to the manifest (pin #7).
+ */
+import { z } from 'zod';
+import { SchemaVersionField } from './common.js';
+import { PluginRegistrationSchema } from './plugin.js';
+/** Which changed-file provider backs the run (pin #5 of architecture contracts). */
+export const ChangedProviderSchema = z.enum([
+    'local-staged',
+    'github-pr',
+    'gitlab-mr',
+    'all-files',
+]);
+/**
+ * V2 evidence attestation envelope (plan §11.3): the witness's signed
+ * statement of its run context and issued record set. `attestationVersion`
+ * is an explicit literal — never a reinterpreted legacy field — so an old
+ * `{runId, recordIds}` MAC cannot authorize evidence even when it
+ * verifies under its own format.
+ */
+export const AttestationSchema = z
+    .object({
+    /** Envelope version; only `2` is produced or honored. */
+    attestationVersion: z.literal(2),
+    /** Witness run UUID this envelope attests. */
+    runId: z.uuid(),
+    /** Fresh invocation UUID minted by the trusted test-gates caller. */
+    invocationId: z.uuid(),
+    /** 64-char lowercase hex digest of the canonical input snapshot. */
+    inputDigest: z.string().regex(/^[0-9a-f]{64}$/, 'inputDigest must be 64-char lowercase hex'),
+    /** Issued record ids, sorted codepoint-wise and unique. */
+    recordIds: z
+        .array(z.string().regex(/^[0-9a-f]{64}$/, 'recordId must be 64-char lowercase hex'))
+        .superRefine((ids, ctx) => {
+        for (let index = 1; index < ids.length; index += 1) {
+            const previous = ids[index - 1];
+            const current = ids[index];
+            if (previous >= current) {
+                ctx.addIssue({
+                    code: 'custom',
+                    message: 'recordIds must be sorted codepoint-wise and unique',
+                });
+                return;
+            }
+        }
+    }),
+    /** HMAC-SHA256 over the v2 body with domain `gateforge.ledger.v2`. */
+    mac: z.string().regex(/^[0-9a-f]{64}$/, 'mac must be a 64-char lowercase hex HMAC'),
+})
+    .strict();
+/** The run manifest artifact. */
+export const RunManifestSchema = z
+    .object({
+    schemaVersion: SchemaVersionField,
+    /** UUIDv4 identifying this run. */
+    runId: z.uuid(),
+    /** Run start instant, ISO-8601, from the injected clock. */
+    startedAt: z.iso.datetime(),
+    /** HEAD git sha of the repo under test, or null when unavailable. */
+    gitSha: z.string().regex(/^[0-9a-f]{40}$/, 'gitSha must be a 40-char lowercase sha1 hex').nullable(),
+    /** Changed-file provider backing this run. */
+    provider: ChangedProviderSchema,
+    /** Plugin set with pinned versions (handshake identity, pin #5). */
+    plugins: z.array(PluginRegistrationSchema),
+    /** Disposable-environment attestation scope, or null when unset. */
+    attestationScope: z.string().nullable(),
+    /**
+     * Record ids the witness issued this run (pin #7), appended at
+     * witness shutdown. Optional: the CLI writes the manifest without it
+     * before the suite runs; an unappended manifest (witness never
+     * finished) is still schema-valid but proves no issuance.
+     *
+     * TRUST: this list lives in the suite-writable state directory, so
+     * on its own it proves nothing — a hostile suite can write ids here
+     * as easily as it can fabricate records. It is trusted only through
+     * the v2 `attestation` envelope below (plan §11.3); this bare list
+     * never authorizes evidence.
+     */
+    recordIds: z.array(z.string().regex(/^[0-9a-f]{64}$/, 'recordId must be 64-char lowercase hex')).optional(),
+    /**
+     * LEGACY v1 HMAC-SHA256 (verifier-key keyed) over the canonical
+     * `{runId, recordIds}`. Readable for diagnostics only: it NEVER
+     * authorizes evidence (plan §11.3/§11.6). A verifying v1 MAC over a
+     * matching id set still demotes every witnessed record — only the
+     * v2 `attestation` envelope can authorize. New writers must not
+     * emit this field.
+     */
+    recordIdsMac: z
+        .string()
+        .regex(/^[0-9a-f]{64}$/, 'recordIdsMac must be a 64-char lowercase hex HMAC')
+        .optional(),
+    /**
+     * Fresh invocation UUID minted by the trusted test-gates caller for
+     * this run (plan §11.4). Stored publicly; its authenticity is
+     * established only by the v2 `attestation` MAC covering it. A new
+     * suite invocation mints a new value, so a previous invocation's
+     * records cannot satisfy the new run.
+     */
+    invocationId: z.uuid().optional(),
+    /**
+     * 64-char lowercase hex digest of the canonical input snapshot
+     * (plan §11.2) computed for this run's tested inputs. Stored
+     * publicly; authenticity comes from the v2 `attestation` MAC.
+     */
+    inputDigest: z
+        .string()
+        .regex(/^[0-9a-f]{64}$/, 'inputDigest must be 64-char lowercase hex')
+        .optional(),
+    /**
+     * The v2 evidence attestation envelope (plan §11.3), written by the
+     * witness at shutdown from its frozen bound context plus the ids it
+     * actually issued — never by reading suite-writable state. The live
+     * `GET /ledger-attestation` endpoint serves the same signed object.
+     * Absent (or invalid) means no evidence authorizes: evaluation fails
+     * closed for witnessed records.
+     */
+    attestation: AttestationSchema.optional(),
+})
+    .strict();
+//# sourceMappingURL=run-manifest.js.map

package/dist/schemas/run-manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-manifest.js","sourceRoot":"","sources":["../../src/schemas/run-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAEvD,oFAAoF;AACpF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC1C,cAAc;IACd,WAAW;IACX,WAAW;IACX,WAAW;CACZ,CAAC,CAAC;AAKH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,yDAAyD;IACzD,kBAAkB,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAChC,8CAA8C;IAC9C,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE;IACf,qEAAqE;IACrE,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE;IACtB,oEAAoE;IACpE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,EAAE,2CAA2C,CAAC;IAC5F,2DAA2D;IAC3D,SAAS,EAAE,CAAC;SACT,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,EAAE,wCAAwC,CAAC,CAAC;SACnF,WAAW,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACxB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACnD,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,GAAG,CAAC,CAAW,CAAC;YAC1C,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAW,CAAC;YACrC,IAAI,QAAQ,IAAI,OAAO,EAAE,CAAC;gBACxB,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,oDAAoD;iBAC9D,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACJ,sEAAsE;IACtE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,EAAE,0CAA0C,CAAC;CACpF,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ,iCAAiC;AACjC,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,aAAa,EAAE,kBAAkB;IACjC,mCAAmC;IACnC,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE;IACf,4DAA4D;IAC5D,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;IAC3B,qEAAqE;IACrE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,EAAE,6CAA6C,CAAC,CAAC,QAAQ,EAAE;IACpG,8CAA8C;IAC9C,QAAQ,EAAE,qBAAqB;IAC/B,oEAAoE;IACpE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC;IAC1C,oEAAoE;IACpE,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC;;;;;;;;;;;OAWG;IACH,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,EAAE,wCAAwC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3G;;;;;;;OAOG;IACH,YAAY,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,KAAK,CAAC,gBAAgB,EAAE,mDAAmD,CAAC;SAC5E,QAAQ,EAAE;IACb;;;;;;OAMG;IACH,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACjC;;;;OAIG;IACH,WAAW,EAAE,CAAC;SACX,MAAM,EAAE;SACR,KAAK,CAAC,gBAAgB,EAAE,2CAA2C,CAAC;SACpE,QAAQ,EAAE;IACb;;;;;;;OAOG;IACH,WAAW,EAAE,iBAAiB,CAAC,QAAQ,EAAE;CAC1C,CAAC;KACD,MAAM,EAAE,CAAC"}