@ionivetech/mugiwara 0.8.0 → 0.8.1

package/src/sign.ts

@@ -13,6 +13,7 @@ import { createPrivateKey, createPublicKey, generateKeyPairSync, sign, verify }
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { readConfig } from './config.ts';
+import { loadPolicy } from './policy.ts';
 
 export function signArgs(reportPath: string, secretKey: string): string[] {
   return ['-Sm', reportPath, '-s', secretKey];
@@ -192,6 +193,42 @@ export function signReport(projectDir: string, missionDir: string): { ok: boolea
   return { ok: true, message: `signed ${report}.mugisig (pure ed25519, key: ${join(dir, 'mugiwara.key')})` };
 }
 
+function normalizePubkey(pk: string): string {
+  const t = pk.trim();
+  return t.startsWith('ed25519:') ? t.slice('ed25519:'.length).trim() : t;
+}
+
+function checkTrust(projectDir: string, signerPubB64: string): { ok: boolean; message?: string } {
+  try {
+    const policy = loadPolicy(projectDir);
+    const att = policy?.attestation;
+    if (!att) return { ok: true };
+    const trusted = att.trusted_keys ?? [];
+    const revoked = att.revoked ?? [];
+    const signer = signerPubB64.trim();
+    // revoked by pubkey direct match (before trusted check, so revoked is authoritative)
+    const directlyRevoked = revoked.some((r) => {
+      const rpk = (r as { pubkey?: string }).pubkey;
+      if (!rpk) return false;
+      return normalizePubkey(rpk) === signer;
+    });
+    if (directlyRevoked) return { ok: false, message: 'signature valid but signer revoked (pubkey in revoked list)' };
+
+    if (trusted.length === 0) {
+      // No trust list → only signature validity matters; revoked already checked
+      return { ok: true };
+    }
+    const match = trusted.find((e) => normalizePubkey(e.pubkey) === signer);
+    if (!match) return { ok: false, message: 'signature valid but signer untrusted (pub not in trusted_keys)' };
+    // check revoked by id (revoked id means that trusted id is revoked)
+    const revokedById = revoked.some((r) => r.id === match.id);
+    if (revokedById) return { ok: false, message: `signature valid but signer revoked (id: ${match.id})` };
+    return { ok: true };
+  } catch {
+    return { ok: true };
+  }
+}
+
 export function verifyReport(projectDir: string, missionDir: string): { ok: boolean; message: string } {
   const report = join(missionDir, 'report.md');
   const minisig = `${report}.minisig`;
@@ -208,6 +245,10 @@ export function verifyReport(projectDir: string, missionDir: string): { ok: bool
     const pubKey = existsSync(defaultKey('public')) ? defaultKey('public') : null;
     try {
       execFileSync('minisign', verifyArgs(report, pubKey), { cwd: projectDir, stdio: 'pipe' });
+      // trust check for pure is not applied to minisig (MVP: pure-only trust).
+      // If a .mugisig also exists alongside minisig, still trust-check the pure pub for completeness,
+      // but minisig verification already succeeded — treat as ok.
+      // For strict attestation, operator should use pure backend when trusted_keys is configured.
       return { ok: true, message: 'signature verifies against report.md (minisig)' };
     } catch {
       return { ok: false, message: 'SIGNATURE INVALID — report.md changed after signing (minisig)' };
@@ -219,9 +260,10 @@ export function verifyReport(projectDir: string, missionDir: string): { ok: bool
     const parsed = JSON.parse(readFileSafe(mugisig) ?? '{}') as PureSig;
     const content = readFileSafe(report);
     if (content === null || parsed.algo !== 'ed25519-pure') return { ok: false, message: 'invalid .mugisig file' };
-    return pureVerify(content, parsed)
-      ? { ok: true, message: 'signature verifies against report.md (mugisig, ed25519-pure)' }
-      : { ok: false, message: 'SIGNATURE INVALID — report.md changed after signing (mugisig)' };
+    if (!pureVerify(content, parsed)) return { ok: false, message: 'SIGNATURE INVALID — report.md changed after signing (mugisig)' };
+    const trust = checkTrust(projectDir, parsed.pub);
+    if (!trust.ok) return { ok: false, message: trust.message! };
+    return { ok: true, message: 'signature verifies against report.md (mugisig, ed25519-pure)' };
   } catch {
     return { ok: false, message: 'invalid .mugisig file' };
   }

package/content/skills/mugiwara-workflow/references/adaptive-budget-governor.md

@@ -1,5 +0,0 @@
-# Adaptive Budget & Circuit Breaker (Phase 7)
-
-Reserve expected max before expensive stages (Review/Security/Healing); continuously project `current + remaining required + expected conditional + possible healing` (§26); expand budget only with evidence (§27 valid: scope legitimately expanded, security-sensitive path, test surface larger, architecture dependency, legitimate healing; invalid: verbosity/reread/repeat/unnecessary code); respect progressive thresholds (§28: 60%→optimize, 75%→aggressive, 90%→protect, 100%→pause, 150%→warning, 300%→stop); trip breaker when `actual ≥ 2× expected` without progress/scope/evidence (§29, note: double-threshold); flag 5k-zero-progress anomaly (§24, re-consumes slop signal); record every non-ok verdict via `recordBudgetDecision` (§41).
-
-Honest boundary: verdicts-not-enforcement; crew acts. No new config; savepoint/lane-base untouched. Report/CLI budget ledger → Phase 8.

package/content/skills/mugiwara-workflow/references/benchmark-governor.md

@@ -1,53 +0,0 @@
-# Benchmark & Hardening — Full Checklist (Phase 9)
-
-Tracks `scripts/benchmark-governor.ts` harness (deterministic, no network).
-
-## Cost suite (§48) — 4 workloads
-- [ ] lean-trivial: projected 8000 + overhead 1000, context ≤20000, evidence ≥1, surface files 2 loc 50
-- [ ] standard-feature: projected 15000 + overhead 1500, context ≤40000, evidence ≥3
-- [ ] large-repo: projected 22000 + overhead 2200, context ≤80000, evidence ≥5, surface 50 files
-- [ ] long-mission: projected 23000 + overhead 2300, context ≤90000, 9 stages projection ≤ budget
-- Check: `measured.tokens ≤ projected + overhead` else fail; `measured.context ≤ max` else fail
-
-## Stop-Slop suite (§45) — 12 scenarios detect→classify→intervene
-- [ ] endless-exploration → investigation slop → stop
-- [ ] repeated-reads (3× no evidence) → context slop → stop; with concrete reason → tolerate
-- [ ] repeated-commands (same cmd+evidence fail) → retry slop → stop
-- [ ] repeated-failed-test → retry slop → stop
-- [ ] repeated-reasoning → reasoning slop → stop
-- [ ] unnecessary-abstraction → code slop → stop
-- [ ] unnecessary-dependency → code slop → stop
-- [ ] unrelated-refactor → scope slop → stop
-- [ ] verbose-output → output slop → stop
-- [ ] no-progress-healing (cycle ≥3, 0 fixes) → healing slop → stop
-- [ ] premature-completion → scope slop → escalate
-- [ ] excessive-context (repeated reads + duplicate chars) → context slop → stop
-
-## Stress (bench-only, no runtime)
-- [ ] large repository: 50 files within declared scope → pass (scope drift negative)
-- [ ] long mission: 9 stages, projectBudget max ≤ full budget 50000 → pass
-- [ ] runaway: actual 2× expected with no progress/scope/evidence → breaker tripped → fail (measures, not enforces)
-
-## Thresholds (ratchet, like retrieval-eval)
-- Thresholds live in `scripts/benchmark-thresholds.json` (or in-script THRESHOLDS const)
-- `tokens > projected + overhead` → harness fails workload
-- `context_chars > context_max` → fail
-- Thresholds only move on explicit fixture update (reviewed diff), never silently
-- `note: thresholds are fixture constants, not config — ratchet like retrieval-eval`
-
-## Regression (§49)
-- `checkRegression`: cost down but correctness/evidence/security/quality/scope down → fail
-- Baseline from thresholds `baselines` + workload `expected_*`; measured vs baseline pure comparison
-
-## Cross-platform & Determinism
-- Harness pure over explicit fixture inputs, no Date.now/Math.random/network, deterministic on all platforms
-- `scripts/conformance.ts` 12-platform parity proves cross-platform
-
-## CI Enforcement
-- `package.json:gate` includes `bun scripts/benchmark-governor.ts` (extend existing gate)
-- `scripts/gate-selftest.ts` tampers thresholds → harness must exit 1 (G3 — gate that cannot fail is not a gate)
-- note: harness measures, does not enforce — no runtime gate
-
-## Docs
-- `docs/concepts/cost.md` ## Benchmark & Hardening documents harness/threshold/stress contracts
-- `docs/cost-governor.md` hub links to cost.md for deep contracts

package/content/skills/mugiwara-workflow/references/cognitive-output-governor.md

@@ -1,5 +0,0 @@
-# Cognitive & Output Governor
-
-Reasoning stays focused — Question→Evidence→Decision→Action, no speculative architecture/hypothetical requirements/repeated reconsideration/unrelated implementations (§17); investigation terminates when acceptance_mapped+surface_understood+path_established or limits hit without concrete reason (§13); alternatives bounded to evidence-backed options (default 3).
-
-Output compressed to mission-focused structure (Decision/Action/Result/Evidence/Blocker, §18), duplicate explanations fingerprinted; every cognitive verdict lands as a `cognitive-governor` trail row in `.mugiwara/missions/<mission>/decisions.md` → `## Cost governor decisions`. savepoint/lane-base/config untouched.

package/content/skills/mugiwara-workflow/references/scope-code-governor.md

@@ -1,14 +0,0 @@
-# Scope & Code Governor
-
-Prefer the smallest correct scope — reuse existing code + local modification
-over new architecture (§14). An abstraction is justified only when used in ≥2
-places or required by contract, never speculatively (§15); a dependency is
-added only with explicit justification (§16); implementations are minimum
-sufficient, never minimum LOC at the expense of verification/quality
-(§15/§38).
-
-Code waste (unnecessary helper/abstraction/wrapper/interface/config/
-dependency/generated code/refactor) is named; the change surface is measured;
-every scope verdict lands as a `scope-governor` trail row in
-`.mugiwara/missions/<mission>/decisions.md` → `## Cost governor decisions`.
-savepoint/lane-base/config untouched.

package/content/skills/mugiwara-workflow/references/stop-slop-governor.md

@@ -1,14 +0,0 @@
-# Stop-Slop Governor
-
-Slop taxonomy (§21 eight kinds); detection signals (§22: repeated reads/commands,
-token-without-evidence, LOC-without-acceptance, abstraction-without-justification);
-progress measurement (§23: evidence/criteria/tests/code vs cost delta, slop when
-cost grows without progress); work-to-cost anomaly (§24 drop signal); intervention
-rules (§20 tolerate/stop/compress/escalate by severity); six category detectors
-(retry §21.6/§31 same-action-same-evidence-same-failure→STOP, healing §21.7/§32
-no-progress→stop, scope §21.8 out-of-scope-without-acceptance→reject, context
-§21.2 duplicate/irrelevant→discard/compress, investigation §21.1 unbounded-
-exploration→stop, code §21.5 unnecessary abstraction/dependency/boilerplate→
-remove/simplify). Every slop verdict lands as a `slop-governor` trail row in
-`.mugiwara/missions/<mission>/decisions.md` → `## Cost governor decisions`.
-savepoint/lane-base/config untouched.