@intentius/chant 0.102.0 → 0.104.1

package/src/workspace/runs-write.schema.json

@@ -1,8 +1,8 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://intentius.io/chant/schemas/workspace/runs-write/v1/runs-write.schema.json",
-  "title": "chant workspace runs start, end and record output",
-  "description": "What `chant workspace runs start|end|record` print (#3033, ws-076): the run as the ledger now holds it, the Chant-Run trailer its commits carry, and where the line went on chant/lifecycle. A failure writes nothing. Version 1 of the read contract's write documents. The error codes are a closed list, each in the one closed list of `reason-codes.ts`.",
+  "title": "chant workspace runs start, end, record and sign output",
+  "description": "What `chant workspace runs start|end|record|sign` print (#3033, ws-076, #3192): the run as the ledger now holds it, the Chant-Run trailer its commits carry, and where the line went on chant/lifecycle. A failure writes nothing. Version 1 of the read contract's write documents. The error codes are a closed list, each in the one closed list of `reason-codes.ts`.",
   "oneOf": [
     {
       "$ref": "#/$defs/result"
@@ -33,7 +33,8 @@
           "enum": [
             "start",
             "end",
-            "record"
+            "record",
+            "sign"
           ]
         },
         "run": {
@@ -66,6 +67,37 @@
             "pushed": {
               "type": "boolean",
               "description": "Whether chant/lifecycle reached the remote; false with no remote too."
+            },
+            "notPushed": {
+              "type": "string",
+              "description": "Why chant/lifecycle did not reach the remote, present only when pushed is false (#3391): the repository has no remote, the remote holds commits this checkout has not fetched, or git refused the push (its first line follows)."
+            }
+          }
+        },
+        "statement": {
+          "type": "object",
+          "description": "For sign: the statement it stored and who signed it (#3192).",
+          "required": [
+            "signer",
+            "class",
+            "keyid",
+            "envelope"
+          ],
+          "properties": {
+            "signer": {
+              "type": "string"
+            },
+            "class": {
+              "enum": [
+                "runner",
+                "service"
+              ]
+            },
+            "keyid": {
+              "type": "string"
+            },
+            "envelope": {
+              "$ref": "#/$defs/envelope"
             }
           }
         }
@@ -92,6 +124,7 @@
             "start",
             "end",
             "record",
+            "sign",
             null
           ]
         },
@@ -117,7 +150,18 @@
                 "write-input-invalid",
                 "run-exists",
                 "run-unknown",
-                "run-ended"
+                "run-ended",
+                "run-not-ended",
+                "trust-policy-unreadable",
+                "runner-key-invalid",
+                "runner-key-is-signer",
+                "runner-key-unlisted",
+                "envelope-unreadable",
+                "envelope-invalid",
+                "envelope-untrusted",
+                "run-statement-invalid",
+                "run-statement-signer-mismatch",
+                "run-statement-mismatch"
               ]
             },
             "message": {
@@ -151,7 +195,9 @@
         "transcript",
         "commits",
         "decisions",
-        "ledger"
+        "ledger",
+        "record",
+        "statements"
       ],
       "properties": {
         "id": {
@@ -387,6 +433,49 @@
         "ledger": {
           "type": "string",
           "description": "Its file on chant/lifecycle."
+        },
+        "record": {
+          "oneOf": [
+            {
+              "type": "null"
+            },
+            {
+              "type": "object",
+              "required": [
+                "sha256"
+              ],
+              "properties": {
+                "sha256": {
+                  "type": "string",
+                  "pattern": "^[0-9a-f]{64}$"
+                }
+              }
+            }
+          ],
+          "description": "The SHA-256 a statement signs: of the canonical JSON of [start line, end line]. Null until the run ends (#3192)."
+        },
+        "statements": {
+          "type": "array",
+          "description": "The signed statements the ledger holds for the run, oldest first (#3192).",
+          "items": {
+            "type": "object",
+            "required": [
+              "at",
+              "envelope"
+            ],
+            "properties": {
+              "at": {
+                "type": "string"
+              },
+              "envelope": {
+                "$ref": "#/$defs/envelope"
+              }
+            }
+          }
+        },
+        "attestation": {
+          "$ref": "#/$defs/attestation",
+          "description": "Its statements judged against the runner keys at base. Present on runs sign."
         }
       }
     },
@@ -578,6 +667,328 @@
           "minimum": 1
         }
       }
+    },
+    "envelope": {
+      "type": "object",
+      "description": "A DSSE v1 envelope (https://github.com/secure-systems-lab/dsse).",
+      "required": [
+        "payloadType",
+        "payload",
+        "signatures"
+      ],
+      "properties": {
+        "payloadType": {
+          "type": "string"
+        },
+        "payload": {
+          "type": "string",
+          "description": "Base64 of the payload bytes."
+        },
+        "signatures": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "required": [
+              "keyid",
+              "sig"
+            ],
+            "properties": {
+              "keyid": {
+                "type": "string",
+                "description": "The signing key's ssh fingerprint, SHA256:..."
+              },
+              "sig": {
+                "type": "string"
+              }
+            }
+          }
+        }
+      }
+    },
+    "statement": {
+      "type": "object",
+      "description": "An in-toto Statement v1 with chant's agent-run predicate (#3192, ws-090).",
+      "required": [
+        "_type",
+        "subject",
+        "predicateType",
+        "predicate"
+      ],
+      "properties": {
+        "_type": {
+          "const": "https://in-toto.io/Statement/v1"
+        },
+        "subject": {
+          "type": "array",
+          "description": "The commits the run made, sorted by id.",
+          "items": {
+            "type": "object",
+            "required": [
+              "name",
+              "digest"
+            ],
+            "properties": {
+              "name": {
+                "type": "string",
+                "description": "The commit id."
+              },
+              "digest": {
+                "type": "object",
+                "required": [
+                  "gitCommit"
+                ],
+                "properties": {
+                  "gitCommit": {
+                    "type": "string"
+                  }
+                }
+              },
+              "annotations": {
+                "type": "object",
+                "properties": {
+                  "patchId": {
+                    "type": "string",
+                    "description": "git patch-id --stable of the commit."
+                  }
+                }
+              }
+            }
+          }
+        },
+        "predicateType": {
+          "const": "https://intentius.io/chant/agent-run/v1"
+        },
+        "predicate": {
+          "type": "object",
+          "required": [
+            "signer",
+            "run",
+            "unit",
+            "harness",
+            "model",
+            "provider",
+            "by"
+          ],
+          "properties": {
+            "signer": {
+              "type": "string",
+              "description": "The runner principal whose key signs: the one .chant/trust.json lists for that key."
+            },
+            "run": {
+              "type": "object",
+              "required": [
+                "id",
+                "record"
+              ],
+              "properties": {
+                "id": {
+                  "type": "string"
+                },
+                "record": {
+                  "type": "object",
+                  "required": [
+                    "sha256"
+                  ],
+                  "properties": {
+                    "sha256": {
+                      "type": "string",
+                      "pattern": "^[0-9a-f]{64}$"
+                    }
+                  }
+                }
+              }
+            },
+            "unit": {
+              "oneOf": [
+                {
+                  "type": "null"
+                },
+                {
+                  "type": "object",
+                  "required": [
+                    "id",
+                    "kind"
+                  ],
+                  "properties": {
+                    "id": {
+                      "type": "string"
+                    },
+                    "kind": {
+                      "type": [
+                        "string",
+                        "null"
+                      ]
+                    }
+                  }
+                }
+              ]
+            },
+            "harness": {
+              "type": "object",
+              "required": [
+                "name",
+                "version"
+              ],
+              "properties": {
+                "name": {
+                  "type": "string"
+                },
+                "version": {
+                  "type": [
+                    "string",
+                    "null"
+                  ]
+                }
+              }
+            },
+            "model": {
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "provider": {
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "by": {
+              "type": [
+                "string",
+                "null"
+              ]
+            }
+          }
+        }
+      }
+    },
+    "statementVerdict": {
+      "type": "object",
+      "description": "One stored statement, judged against the runner keys at base and the run's record.",
+      "required": [
+        "status",
+        "reason"
+      ],
+      "properties": {
+        "status": {
+          "enum": [
+            "verified",
+            "mismatch",
+            "untrusted",
+            "invalid"
+          ],
+          "description": "verified: a listed runner key signed it and it matches the record. mismatch: a listed key signed it and it does not match. untrusted: no listed key signed it. invalid: not a DSSE envelope, not an agent-run statement, or naming another signer."
+        },
+        "code": {
+          "enum": [
+            "envelope-invalid",
+            "envelope-untrusted",
+            "run-statement-invalid",
+            "run-statement-signer-mismatch",
+            "run-statement-mismatch"
+          ],
+          "description": "Why it does not verify. Absent when verified."
+        },
+        "reason": {
+          "type": "string"
+        },
+        "signer": {
+          "type": "string"
+        },
+        "class": {
+          "enum": [
+            "runner",
+            "service"
+          ]
+        },
+        "keyid": {
+          "type": "string"
+        },
+        "statement": {
+          "$ref": "#/$defs/statement",
+          "description": "The statement, when verified."
+        }
+      }
+    },
+    "attestation": {
+      "type": "object",
+      "description": "The run's statements judged against the runner keys at base (#3192).",
+      "required": [
+        "status",
+        "signer",
+        "class",
+        "keyid",
+        "code",
+        "reason",
+        "commits",
+        "statements"
+      ],
+      "properties": {
+        "status": {
+          "enum": [
+            "signed",
+            "unsigned",
+            "mismatch",
+            "untrusted",
+            "invalid"
+          ],
+          "description": "signed: a stored statement verifies. unsigned: the ledger holds none. Otherwise the best failure, mismatch before untrusted before invalid."
+        },
+        "signer": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "class": {
+          "enum": [
+            "runner",
+            "service",
+            null
+          ]
+        },
+        "keyid": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "code": {
+          "oneOf": [
+            {
+              "type": "null"
+            },
+            {
+              "enum": [
+                "envelope-invalid",
+                "envelope-untrusted",
+                "run-statement-invalid",
+                "run-statement-signer-mismatch",
+                "run-statement-mismatch"
+              ]
+            }
+          ],
+          "description": "The code of the failure status reports, or null when signed or unsigned."
+        },
+        "reason": {
+          "type": "string"
+        },
+        "commits": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "The commits the verified statement names. Empty unless signed."
+        },
+        "statements": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/statementVerdict"
+          },
+          "description": "One verdict per stored statement, in ledger order."
+        }
+      }
     }
   }
 }