@markdown-ai/cli 1.0.0-rc.3 → 1.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/HOW-TO-USE.md +279 -173
- package/README.md +103 -34
- package/dist/cli.js +3488 -272
- package/dist/conformance/compile/46-basic-targets/expected/AGENTS.md +20 -0
- package/dist/conformance/compile/46-basic-targets/expected/MCP-SERVER.md +20 -0
- package/dist/conformance/compile/46-basic-targets/expected/SKILL.md +19 -0
- package/dist/conformance/compile/46-basic-targets/expected/mcp-server.json +5 -0
- package/dist/conformance/compile/46-basic-targets/input.mda +18 -0
- package/dist/conformance/manifest.yaml +55 -49
- package/dist/conformance/valid/27-trust-policy-github-actions.json +14 -11
- package/dist/schemas/mda-trust-policy.schema.json +144 -111
- package/package.json +47 -46
|
@@ -0,0 +1,20 @@
|
|
|
1
|
+
---
|
|
2
|
+
name: compile-basic
|
|
3
|
+
description: Basic compiler conformance fixture.
|
|
4
|
+
metadata:
|
|
5
|
+
snoai-llmix:
|
|
6
|
+
module: search_summary
|
|
7
|
+
preset: openai_fast
|
|
8
|
+
common:
|
|
9
|
+
provider: openai
|
|
10
|
+
model: gpt-5-mini
|
|
11
|
+
claude-code:
|
|
12
|
+
allowed-tools: Read Bash(echo:*)
|
|
13
|
+
mda:
|
|
14
|
+
requires:
|
|
15
|
+
network: none
|
|
16
|
+
---
|
|
17
|
+
|
|
18
|
+
# Compile basic
|
|
19
|
+
|
|
20
|
+
Use this fixture to confirm target projection.
|
|
@@ -0,0 +1,20 @@
|
|
|
1
|
+
---
|
|
2
|
+
name: compile-basic
|
|
3
|
+
description: Basic compiler conformance fixture.
|
|
4
|
+
metadata:
|
|
5
|
+
snoai-llmix:
|
|
6
|
+
module: search_summary
|
|
7
|
+
preset: openai_fast
|
|
8
|
+
common:
|
|
9
|
+
provider: openai
|
|
10
|
+
model: gpt-5-mini
|
|
11
|
+
claude-code:
|
|
12
|
+
allowed-tools: Read Bash(echo:*)
|
|
13
|
+
mda:
|
|
14
|
+
requires:
|
|
15
|
+
network: none
|
|
16
|
+
---
|
|
17
|
+
|
|
18
|
+
# Compile basic
|
|
19
|
+
|
|
20
|
+
Use this fixture to confirm target projection.
|
|
@@ -0,0 +1,19 @@
|
|
|
1
|
+
---
|
|
2
|
+
name: compile-basic
|
|
3
|
+
description: Basic compiler conformance fixture.
|
|
4
|
+
allowed-tools: Read Bash(echo:*)
|
|
5
|
+
metadata:
|
|
6
|
+
snoai-llmix:
|
|
7
|
+
module: search_summary
|
|
8
|
+
preset: openai_fast
|
|
9
|
+
common:
|
|
10
|
+
provider: openai
|
|
11
|
+
model: gpt-5-mini
|
|
12
|
+
mda:
|
|
13
|
+
requires:
|
|
14
|
+
network: none
|
|
15
|
+
---
|
|
16
|
+
|
|
17
|
+
# Compile basic
|
|
18
|
+
|
|
19
|
+
Use this fixture to confirm target projection.
|
|
@@ -0,0 +1,18 @@
|
|
|
1
|
+
---
|
|
2
|
+
name: compile-basic
|
|
3
|
+
description: Basic compiler conformance fixture.
|
|
4
|
+
allowed-tools: 'Read Bash(echo:*)'
|
|
5
|
+
requires:
|
|
6
|
+
network: none
|
|
7
|
+
metadata:
|
|
8
|
+
snoai-llmix:
|
|
9
|
+
module: search_summary
|
|
10
|
+
preset: openai_fast
|
|
11
|
+
common:
|
|
12
|
+
provider: openai
|
|
13
|
+
model: gpt-5-mini
|
|
14
|
+
---
|
|
15
|
+
|
|
16
|
+
# Compile basic
|
|
17
|
+
|
|
18
|
+
Use this fixture to confirm target projection.
|
|
@@ -7,14 +7,14 @@ spec: v1.0
|
|
|
7
7
|
|
|
8
8
|
fixtures:
|
|
9
9
|
# ─── valid (source-side acceptance) ───────────────────────────────────────
|
|
10
|
-
- id:
|
|
10
|
+
- id: '01-frontmatter-minimal'
|
|
11
11
|
path: valid/01-frontmatter-minimal.mda
|
|
12
12
|
against: [schemas/frontmatter-source.schema.json]
|
|
13
13
|
verdict: accept
|
|
14
14
|
rules: [§02-2.1, §02-2.2]
|
|
15
15
|
description: Minimal valid source — only `name` and `description`.
|
|
16
16
|
|
|
17
|
-
- id:
|
|
17
|
+
- id: '03-relationships-with-mirror'
|
|
18
18
|
path: valid/03-relationships-with-mirror.mda
|
|
19
19
|
against:
|
|
20
20
|
- schemas/frontmatter-source.schema.json
|
|
@@ -23,7 +23,7 @@ fixtures:
|
|
|
23
23
|
rules: [§03-2, §03-4]
|
|
24
24
|
description: Source with footnote relationships AND a metadata.mda.relationships mirror (mirror is optional in source but encouraged).
|
|
25
25
|
|
|
26
|
-
- id:
|
|
26
|
+
- id: '04-depends-on-and-requires'
|
|
27
27
|
path: valid/04-depends-on-and-requires.mda
|
|
28
28
|
against:
|
|
29
29
|
- schemas/frontmatter-source.schema.json
|
|
@@ -34,7 +34,7 @@ fixtures:
|
|
|
34
34
|
rules: [§03-3, §03-3.2, §10-2]
|
|
35
35
|
description: Source declaring metadata.mda.depends-on (with caret range and digest pinning) and metadata.mda.requires (with standard keys).
|
|
36
36
|
|
|
37
|
-
- id:
|
|
37
|
+
- id: '05-integrity-sha256'
|
|
38
38
|
path: valid/05-integrity-sha256.mda
|
|
39
39
|
against:
|
|
40
40
|
- schemas/frontmatter-source.schema.json
|
|
@@ -43,7 +43,7 @@ fixtures:
|
|
|
43
43
|
rules: [§02-2.7, §08-2]
|
|
44
44
|
description: Source declaring a top-level integrity field with a valid sha256 digest shape.
|
|
45
45
|
|
|
46
|
-
- id:
|
|
46
|
+
- id: '06-sigstore-signed'
|
|
47
47
|
path: valid/06-sigstore-signed.mda
|
|
48
48
|
against:
|
|
49
49
|
- schemas/frontmatter-source.schema.json
|
|
@@ -54,7 +54,7 @@ fixtures:
|
|
|
54
54
|
rules: [§02-2.8, §09-2, §09-4]
|
|
55
55
|
description: Source declaring a Sigstore-OIDC signature; payload-digest matches integrity.digest; rekor coordinates present.
|
|
56
56
|
|
|
57
|
-
- id:
|
|
57
|
+
- id: '07-did-web-signed'
|
|
58
58
|
path: valid/07-did-web-signed.mda
|
|
59
59
|
against:
|
|
60
60
|
- schemas/frontmatter-source.schema.json
|
|
@@ -65,14 +65,14 @@ fixtures:
|
|
|
65
65
|
rules: [§09-2, §09-5]
|
|
66
66
|
description: Source declaring a did:web signature for the air-gap signing path; no rekor coordinates required.
|
|
67
67
|
|
|
68
|
-
- id:
|
|
68
|
+
- id: '08-agents-md-frontmatter-free'
|
|
69
69
|
path: valid/08-agents-md-frontmatter-free.md
|
|
70
70
|
against: [schemas/frontmatter-agents-md.schema.json]
|
|
71
71
|
verdict: accept
|
|
72
72
|
rules: [§06-targets/agents-md §06-3]
|
|
73
73
|
description: Pure-Markdown AGENTS.md with no frontmatter; conformant per the optional-frontmatter rule.
|
|
74
74
|
|
|
75
|
-
- id:
|
|
75
|
+
- id: '09-agents-md-with-frontmatter'
|
|
76
76
|
path: valid/09-agents-md-with-frontmatter.md
|
|
77
77
|
against: [schemas/frontmatter-agents-md.schema.json]
|
|
78
78
|
verdict: accept
|
|
@@ -80,7 +80,7 @@ fixtures:
|
|
|
80
80
|
description: AGENTS.md with optional frontmatter; MDA-extended fields nested under metadata.mda.*.
|
|
81
81
|
|
|
82
82
|
# ─── valid (§02-1.1 frontmatter extraction algorithm) ─────────────────────
|
|
83
|
-
- id:
|
|
83
|
+
- id: '20-bom-prefixed'
|
|
84
84
|
path: valid/20-bom-prefixed.mda
|
|
85
85
|
against: [schemas/frontmatter-source.schema.json]
|
|
86
86
|
extraction-expected: ok
|
|
@@ -88,7 +88,7 @@ fixtures:
|
|
|
88
88
|
rules: [§02-1.1 step 1]
|
|
89
89
|
description: File begins with UTF-8 BOM (0xEF 0xBB 0xBF); extractor MUST strip the BOM in step 1 and parse normally.
|
|
90
90
|
|
|
91
|
-
- id:
|
|
91
|
+
- id: '21-crlf-line-endings'
|
|
92
92
|
path: valid/21-crlf-line-endings.mda
|
|
93
93
|
against: [schemas/frontmatter-source.schema.json]
|
|
94
94
|
extraction-expected: ok
|
|
@@ -96,7 +96,7 @@ fixtures:
|
|
|
96
96
|
rules: [§02-1.1 step 3]
|
|
97
97
|
description: File uses CRLF line terminators throughout; extractor MUST normalize CRLF to LF in step 3 before scanning for the closing fence.
|
|
98
98
|
|
|
99
|
-
- id:
|
|
99
|
+
- id: '22-body-with-horizontal-rule'
|
|
100
100
|
path: valid/22-body-with-horizontal-rule.mda
|
|
101
101
|
against: [schemas/frontmatter-source.schema.json]
|
|
102
102
|
extraction-expected: ok
|
|
@@ -104,7 +104,7 @@ fixtures:
|
|
|
104
104
|
rules: [§02-1.1 step 5, §02-1.1 step 6]
|
|
105
105
|
description: Body contains Markdown horizontal rules (`---`); the FIRST `---` line after the opening fence is the closing fence — later `---` lines remain in the body.
|
|
106
106
|
|
|
107
|
-
- id:
|
|
107
|
+
- id: '23-empty-body'
|
|
108
108
|
path: valid/23-empty-body.mda
|
|
109
109
|
against: [schemas/frontmatter-source.schema.json]
|
|
110
110
|
extraction-expected: ok
|
|
@@ -112,35 +112,35 @@ fixtures:
|
|
|
112
112
|
rules: [§02-1.1 step 7, §08-3.3]
|
|
113
113
|
description: Frontmatter-only source with an empty body string after the closing fence; the empty body is conformant and §08-3.3 emits no terminating newline.
|
|
114
114
|
|
|
115
|
-
- id:
|
|
115
|
+
- id: '27-trust-policy-github-actions'
|
|
116
116
|
path: valid/27-trust-policy-github-actions.json
|
|
117
117
|
against: [schemas/mda-trust-policy.schema.json]
|
|
118
118
|
verdict: accept
|
|
119
119
|
rules: [§13-4]
|
|
120
120
|
description: Trusted runtime policy that pins both GitHub Actions issuer and repository/tag subject and configures Rekor by URL.
|
|
121
121
|
|
|
122
|
-
- id:
|
|
122
|
+
- id: '35-trust-policy-did-web'
|
|
123
123
|
path: valid/35-trust-policy-did-web.json
|
|
124
124
|
against: [schemas/mda-trust-policy.schema.json]
|
|
125
125
|
verdict: accept
|
|
126
126
|
rules: [§13-4]
|
|
127
127
|
description: Minimal did:web trust policy; no Rekor block is needed for non-Sigstore signers.
|
|
128
128
|
|
|
129
|
-
- id:
|
|
129
|
+
- id: '36-trust-policy-did-web-two-signatures'
|
|
130
130
|
path: valid/36-trust-policy-did-web-two-signatures.json
|
|
131
131
|
against: [schemas/mda-trust-policy.schema.json]
|
|
132
132
|
verdict: accept
|
|
133
133
|
rules: [§13-4]
|
|
134
134
|
description: did:web trust policy requiring two distinct trusted signer identities.
|
|
135
135
|
|
|
136
|
-
- id:
|
|
136
|
+
- id: '42-trust-policy-human-sigstore'
|
|
137
137
|
path: valid/42-trust-policy-human-sigstore.json
|
|
138
138
|
against: [schemas/mda-trust-policy.schema.json]
|
|
139
139
|
verdict: accept
|
|
140
140
|
rules: [§13-4]
|
|
141
141
|
description: Trusted runtime policy that pins a human Sigstore OIDC issuer and subject and configures Rekor by URL.
|
|
142
142
|
|
|
143
|
-
- id:
|
|
143
|
+
- id: '43-trusted-runtime-sigstore-signed'
|
|
144
144
|
path: valid/43-trusted-runtime-sigstore-signed.mda
|
|
145
145
|
against: [schemas/frontmatter-source.schema.json]
|
|
146
146
|
semantic-checks: [signature-digest-equality, trusted-runtime-policy]
|
|
@@ -148,28 +148,28 @@ fixtures:
|
|
|
148
148
|
verified-identities:
|
|
149
149
|
- signature-index: 0
|
|
150
150
|
type: sigstore-oidc
|
|
151
|
-
issuer:
|
|
152
|
-
subject:
|
|
151
|
+
issuer: 'https://accounts.google.com'
|
|
152
|
+
subject: 'maintainer@example.com'
|
|
153
153
|
verdict: accept
|
|
154
154
|
rules: [§13-2, §13-4]
|
|
155
155
|
description: A Sigstore signature whose verified OIDC identity matches the trust policy MUST satisfy trusted-runtime policy matching.
|
|
156
156
|
|
|
157
157
|
# ─── invalid (§02-1.1 frontmatter extraction algorithm) ───────────────────
|
|
158
|
-
- id:
|
|
158
|
+
- id: '24-unterminated-frontmatter'
|
|
159
159
|
path: invalid/24-unterminated-frontmatter.mda
|
|
160
160
|
extraction-expected: unterminated-frontmatter
|
|
161
161
|
verdict: reject
|
|
162
162
|
rules: [§02-1.1 step 5]
|
|
163
163
|
description: Opening `---` fence at offset 0 with no matching closing `---` line; extractor MUST refuse with `unterminated-frontmatter`.
|
|
164
164
|
|
|
165
|
-
- id:
|
|
165
|
+
- id: '25-invalid-utf8'
|
|
166
166
|
path: invalid/25-invalid-utf8.mda
|
|
167
167
|
extraction-expected: invalid-encoding
|
|
168
168
|
verdict: reject
|
|
169
169
|
rules: [§02-1.1 step 2]
|
|
170
170
|
description: File contains a stray 0xFF byte that is not a valid UTF-8 continuation; extractor MUST refuse with `invalid-encoding` before YAML parsing.
|
|
171
171
|
|
|
172
|
-
- id:
|
|
172
|
+
- id: '26-skill-md-body-only'
|
|
173
173
|
path: invalid/26-skill-md-body-only.md
|
|
174
174
|
against: [schemas/frontmatter-skill-md.schema.json]
|
|
175
175
|
extraction-expected: no-frontmatter
|
|
@@ -178,28 +178,28 @@ fixtures:
|
|
|
178
178
|
description: SKILL.md without an opening `---` fence; §02-1.1 step 4 says only AGENTS.md tolerates body-only — SKILL.md MUST refuse (`missing-required-frontmatter`).
|
|
179
179
|
|
|
180
180
|
# ─── invalid (source-side rejection) ──────────────────────────────────────
|
|
181
|
-
- id:
|
|
181
|
+
- id: '11-name-uppercase'
|
|
182
182
|
path: invalid/11-name-uppercase.mda
|
|
183
183
|
against: [schemas/frontmatter-source.schema.json]
|
|
184
184
|
verdict: reject
|
|
185
185
|
rules: [§02-2.1]
|
|
186
186
|
description: name field contains uppercase letters; violates kebab-case identifier shape.
|
|
187
187
|
|
|
188
|
-
- id:
|
|
188
|
+
- id: '12-description-over-1024'
|
|
189
189
|
path: invalid/12-description-over-1024.mda
|
|
190
190
|
against: [schemas/frontmatter-source.schema.json]
|
|
191
191
|
verdict: reject
|
|
192
192
|
rules: [§02-2.2]
|
|
193
193
|
description: description field exceeds 1024 chars.
|
|
194
194
|
|
|
195
|
-
- id:
|
|
195
|
+
- id: '14-signature-without-integrity'
|
|
196
196
|
path: invalid/14-signature-without-integrity.mda
|
|
197
197
|
against: [schemas/frontmatter-source.schema.json]
|
|
198
198
|
verdict: reject
|
|
199
199
|
rules: [§02-2.8, §09-2]
|
|
200
200
|
description: signatures[] present but integrity is missing; dependentRequired clause forces integrity.
|
|
201
201
|
|
|
202
|
-
- id:
|
|
202
|
+
- id: '15-version-range-compound'
|
|
203
203
|
path: invalid/15-version-range-compound.mda
|
|
204
204
|
against:
|
|
205
205
|
- schemas/frontmatter-source.schema.json
|
|
@@ -208,7 +208,7 @@ fixtures:
|
|
|
208
208
|
rules: [§03-3.2]
|
|
209
209
|
description: depends-on entry uses a compound version-range; v1.0 admits only exact and caret ranges.
|
|
210
210
|
|
|
211
|
-
- id:
|
|
211
|
+
- id: '18-integrity-bad-digest-length'
|
|
212
212
|
path: invalid/18-integrity-bad-digest-length.mda
|
|
213
213
|
against:
|
|
214
214
|
- schemas/frontmatter-source.schema.json
|
|
@@ -217,7 +217,7 @@ fixtures:
|
|
|
217
217
|
rules: [§08-2]
|
|
218
218
|
description: integrity.algorithm is sha256 but digest length does not match (6 hex chars vs required 64).
|
|
219
219
|
|
|
220
|
-
- id:
|
|
220
|
+
- id: '19-signature-digest-mismatch'
|
|
221
221
|
path: invalid/19-signature-digest-mismatch.mda
|
|
222
222
|
against:
|
|
223
223
|
- schemas/frontmatter-source.schema.json
|
|
@@ -228,56 +228,56 @@ fixtures:
|
|
|
228
228
|
rules: [§09-2]
|
|
229
229
|
description: integrity.digest and signatures[0].payload-digest are both well-formed but unequal; the cross-field rule MUST reject.
|
|
230
230
|
|
|
231
|
-
- id:
|
|
231
|
+
- id: '28-trust-policy-issuer-only'
|
|
232
232
|
path: invalid/28-trust-policy-issuer-only.json
|
|
233
233
|
against: [schemas/mda-trust-policy.schema.json]
|
|
234
234
|
verdict: reject
|
|
235
235
|
rules: [§13-4]
|
|
236
236
|
description: Sigstore trust policy gives an issuer without a subject; issuer-only trust is too broad and MUST reject.
|
|
237
237
|
|
|
238
|
-
- id:
|
|
238
|
+
- id: '32-trust-policy-sigstore-without-rekor'
|
|
239
239
|
path: invalid/32-trust-policy-sigstore-without-rekor.json
|
|
240
240
|
against: [schemas/mda-trust-policy.schema.json]
|
|
241
241
|
verdict: reject
|
|
242
242
|
rules: [§13-4]
|
|
243
243
|
description: Sigstore trust policy MUST configure Rekor verification.
|
|
244
244
|
|
|
245
|
-
- id:
|
|
245
|
+
- id: '33-trust-policy-sigstore-empty-rekor'
|
|
246
246
|
path: invalid/33-trust-policy-sigstore-empty-rekor.json
|
|
247
247
|
against: [schemas/mda-trust-policy.schema.json]
|
|
248
248
|
verdict: reject
|
|
249
249
|
rules: [§13-4]
|
|
250
250
|
description: Sigstore trust policy Rekor configuration MUST include a log URL.
|
|
251
251
|
|
|
252
|
-
- id:
|
|
252
|
+
- id: '34-trust-policy-sigstore-rekor-disabled'
|
|
253
253
|
path: invalid/34-trust-policy-sigstore-rekor-disabled.json
|
|
254
254
|
against: [schemas/mda-trust-policy.schema.json]
|
|
255
255
|
verdict: reject
|
|
256
256
|
rules: [§13-4]
|
|
257
257
|
description: Sigstore trust policy has no Rekor disable flag; unknown `rekor.required` MUST reject.
|
|
258
258
|
|
|
259
|
-
- id:
|
|
259
|
+
- id: '41-trust-policy-did-web-with-rekor'
|
|
260
260
|
path: invalid/41-trust-policy-did-web-with-rekor.json
|
|
261
261
|
against: [schemas/mda-trust-policy.schema.json]
|
|
262
262
|
verdict: reject
|
|
263
263
|
rules: [§13-4]
|
|
264
264
|
description: did:web-only trust policies MUST NOT include a Rekor block because Rekor applies only to Sigstore signers.
|
|
265
265
|
|
|
266
|
-
- id:
|
|
266
|
+
- id: '29-sigstore-signature-without-rekor'
|
|
267
267
|
path: invalid/29-sigstore-signature-without-rekor.mda
|
|
268
268
|
against: [schemas/frontmatter-source.schema.json]
|
|
269
269
|
verdict: reject
|
|
270
270
|
rules: [§09-2, §09-4]
|
|
271
271
|
description: Sigstore OIDC signatures MUST include Rekor log coordinates.
|
|
272
272
|
|
|
273
|
-
- id:
|
|
273
|
+
- id: '30-did-web-signature-with-rekor'
|
|
274
274
|
path: invalid/30-did-web-signature-with-rekor.mda
|
|
275
275
|
against: [schemas/frontmatter-source.schema.json]
|
|
276
276
|
verdict: reject
|
|
277
277
|
rules: [§09-2, §09-5]
|
|
278
278
|
description: did:web signatures MUST NOT include Sigstore-only Rekor log coordinates.
|
|
279
279
|
|
|
280
|
-
- id:
|
|
280
|
+
- id: '31-payload-type-jcs-suffix'
|
|
281
281
|
path: invalid/31-payload-type-jcs-suffix.mda
|
|
282
282
|
against: [schemas/frontmatter-source.schema.json]
|
|
283
283
|
verdict: reject
|
|
@@ -285,7 +285,7 @@ fixtures:
|
|
|
285
285
|
description: Vendor DSSE payload types use +json; +jcs+json is not an accepted structured suffix.
|
|
286
286
|
|
|
287
287
|
# ─── invalid (trusted-runtime semantic rejection) ────────────────────────
|
|
288
|
-
- id:
|
|
288
|
+
- id: '37-trusted-runtime-missing-integrity'
|
|
289
289
|
path: invalid/37-trusted-runtime-missing-integrity.mda
|
|
290
290
|
against: [schemas/frontmatter-source.schema.json]
|
|
291
291
|
semantic-checks: [trusted-runtime-policy]
|
|
@@ -295,7 +295,7 @@ fixtures:
|
|
|
295
295
|
rules: [§13-2]
|
|
296
296
|
description: Schema-valid source without integrity MUST reject under trusted-runtime.
|
|
297
297
|
|
|
298
|
-
- id:
|
|
298
|
+
- id: '38-trusted-runtime-missing-signature'
|
|
299
299
|
path: invalid/38-trusted-runtime-missing-signature.mda
|
|
300
300
|
against: [schemas/frontmatter-source.schema.json]
|
|
301
301
|
semantic-checks: [trusted-runtime-policy]
|
|
@@ -305,7 +305,7 @@ fixtures:
|
|
|
305
305
|
rules: [§13-2]
|
|
306
306
|
description: Integrity-only source MUST reject under trusted-runtime because no signature is present.
|
|
307
307
|
|
|
308
|
-
- id:
|
|
308
|
+
- id: '39-trusted-runtime-duplicate-did-web-signature'
|
|
309
309
|
path: invalid/39-trusted-runtime-duplicate-did-web-signature.mda
|
|
310
310
|
against: [schemas/frontmatter-source.schema.json]
|
|
311
311
|
semantic-checks: [signature-digest-equality, trusted-runtime-policy]
|
|
@@ -315,7 +315,7 @@ fixtures:
|
|
|
315
315
|
rules: [§13-2, §13-4]
|
|
316
316
|
description: Two signature entries from the same did:web identity count as one trusted signer identity.
|
|
317
317
|
|
|
318
|
-
- id:
|
|
318
|
+
- id: '40-trusted-runtime-untrusted-did-web-signer'
|
|
319
319
|
path: invalid/40-trusted-runtime-untrusted-did-web-signer.mda
|
|
320
320
|
against: [schemas/frontmatter-source.schema.json]
|
|
321
321
|
semantic-checks: [signature-digest-equality, trusted-runtime-policy]
|
|
@@ -325,7 +325,7 @@ fixtures:
|
|
|
325
325
|
rules: [§13-2, §13-4]
|
|
326
326
|
description: A signed artifact whose signer is outside the trust policy MUST reject.
|
|
327
327
|
|
|
328
|
-
- id:
|
|
328
|
+
- id: '44-trusted-runtime-untrusted-sigstore-subject'
|
|
329
329
|
path: invalid/44-trusted-runtime-untrusted-sigstore-subject.mda
|
|
330
330
|
against: [schemas/frontmatter-source.schema.json]
|
|
331
331
|
semantic-checks: [signature-digest-equality, trusted-runtime-policy]
|
|
@@ -333,14 +333,14 @@ fixtures:
|
|
|
333
333
|
verified-identities:
|
|
334
334
|
- signature-index: 0
|
|
335
335
|
type: sigstore-oidc
|
|
336
|
-
issuer:
|
|
337
|
-
subject:
|
|
336
|
+
issuer: 'https://accounts.google.com'
|
|
337
|
+
subject: 'attacker@example.com'
|
|
338
338
|
expected-error: no-trusted-signature
|
|
339
339
|
verdict: reject
|
|
340
340
|
rules: [§13-2, §13-4]
|
|
341
341
|
description: A Sigstore signature with a trusted issuer but untrusted verified subject MUST reject.
|
|
342
342
|
|
|
343
|
-
- id:
|
|
343
|
+
- id: '45-trusted-runtime-malformed-policy'
|
|
344
344
|
path: valid/07-did-web-signed.mda
|
|
345
345
|
against: [schemas/frontmatter-source.schema.json]
|
|
346
346
|
semantic-checks: [signature-digest-equality, trusted-runtime-policy]
|
|
@@ -351,26 +351,32 @@ fixtures:
|
|
|
351
351
|
description: A runtime policy that would match semantically but fails the trust-policy schema MUST reject before policy matching.
|
|
352
352
|
|
|
353
353
|
# ─── invalid (output-side rejection — compiled .md against target schema) ─
|
|
354
|
-
- id:
|
|
354
|
+
- id: '13-skill-output-mda-extended-toplevel'
|
|
355
355
|
path: invalid/13-skill-output-mda-extended-toplevel.md
|
|
356
356
|
against: [schemas/frontmatter-skill-md.schema.json]
|
|
357
357
|
verdict: reject
|
|
358
358
|
rules: [§06-targets/skill-md §06-3.3]
|
|
359
359
|
description: Compiled SKILL.md keeps `doc-id` at top level; must nest under metadata.mda.
|
|
360
360
|
|
|
361
|
-
- id:
|
|
361
|
+
- id: '16-agents-md-allowed-tools-toplevel'
|
|
362
362
|
path: invalid/16-agents-md-allowed-tools-toplevel.md
|
|
363
363
|
against: [schemas/frontmatter-agents-md.schema.json]
|
|
364
364
|
verdict: reject
|
|
365
365
|
rules: [§06-targets/agents-md §06-3.2]
|
|
366
366
|
description: AGENTS.md output places allowed-tools at the top level; the target forbids it (must nest under vendor namespace).
|
|
367
367
|
|
|
368
|
-
- id:
|
|
368
|
+
- id: '17-mcp-server-md-missing-name'
|
|
369
369
|
path: invalid/17-mcp-server-md-missing-name.md
|
|
370
370
|
against: [schemas/frontmatter-mcp-server-md.schema.json]
|
|
371
371
|
verdict: reject
|
|
372
372
|
rules: [§06-targets/mcp-server-md §06-3.1]
|
|
373
373
|
description: MCP-SERVER.md output omits the required top-level `name` field.
|
|
374
374
|
|
|
375
|
-
#
|
|
376
|
-
|
|
375
|
+
# ─── compile equality fixtures ───────────────────────────────────────────
|
|
376
|
+
- id: '46-compile-basic-targets'
|
|
377
|
+
input: compile/46-basic-targets/input.mda
|
|
378
|
+
expected_dir: compile/46-basic-targets/expected
|
|
379
|
+
targets: [SKILL.md, AGENTS.md, MCP-SERVER.md]
|
|
380
|
+
verdict: equal
|
|
381
|
+
rules: [§06-targets/skill-md, §06-targets/agents-md, §06-targets/mcp-server-md, §08]
|
|
382
|
+
description: Source compiles to SKILL.md, AGENTS.md, MCP-SERVER.md, and the MCP sidecar with target-specific metadata projection.
|
|
@@ -1,13 +1,16 @@
|
|
|
1
1
|
{
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
2
|
+
"version": 1,
|
|
3
|
+
"trustedSigners": [
|
|
4
|
+
{
|
|
5
|
+
"type": "sigstore-oidc",
|
|
6
|
+
"issuer": "https://token.actions.githubusercontent.com",
|
|
7
|
+
"subject": "repo:sno-ai/llmix:ref:refs/tags/v2.0.0",
|
|
8
|
+
"repository": "sno-ai/llmix",
|
|
9
|
+
"workflow": "release.yml",
|
|
10
|
+
"ref": "refs/tags/v2.0.0"
|
|
11
|
+
}
|
|
12
|
+
],
|
|
13
|
+
"rekor": {
|
|
14
|
+
"url": "https://rekor.sigstore.dev"
|
|
15
|
+
}
|
|
13
16
|
}
|