@momentiq/dark-factory-cli 2.11.0 → 2.13.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/commands/prove.d.ts.map +1 -1
- package/dist/commands/prove.js +3 -1
- package/dist/commands/prove.js.map +1 -1
- package/dist/commands/publish.d.ts +3 -0
- package/dist/commands/publish.d.ts.map +1 -1
- package/dist/commands/publish.js +49 -3
- package/dist/commands/publish.js.map +1 -1
- package/dist/cycle-doc-validator/validate_cycle_doc.py +135 -0
- package/dist/evidence/prove.d.ts.map +1 -1
- package/dist/evidence/prove.js +8 -1
- package/dist/evidence/prove.js.map +1 -1
- package/dist/evidence/transmit.d.ts +76 -0
- package/dist/evidence/transmit.d.ts.map +1 -0
- package/dist/evidence/transmit.js +165 -0
- package/dist/evidence/transmit.js.map +1 -0
- package/package.json +2 -2
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"prove.d.ts","sourceRoot":"","sources":["../../src/commands/prove.ts"],"names":[],"mappings":"AAeA,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,sBAAsB,CAAC;AAG9B,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAGD,MAAM,WAAW,SAAS;IACxB,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IAChF,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;
|
|
1
|
+
{"version":3,"file":"prove.d.ts","sourceRoot":"","sources":["../../src/commands/prove.ts"],"names":[],"mappings":"AAeA,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,sBAAsB,CAAC;AAG9B,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAGD,MAAM,WAAW,SAAS;IACxB,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IAChF,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAqHD,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,MAAM,EAAE,EACd,EAAE,EAAE,OAAO,EACX,IAAI,GAAE,SAAc,GACnB,OAAO,CAAC,MAAM,CAAC,CAuDjB"}
|
package/dist/commands/prove.js
CHANGED
|
@@ -87,7 +87,9 @@ const GLYPH = { proven: "✓", pending: "…", failed: "✗" };
|
|
|
87
87
|
function renderObjective(o) {
|
|
88
88
|
const lines = [];
|
|
89
89
|
const tag = o.enforced ? " [enforced]" : "";
|
|
90
|
-
|
|
90
|
+
// 2c: show source grounding when not the agent-asserted default.
|
|
91
|
+
const src = o.sourceVerification === "agent-asserted" ? "" : ` {${o.sourceVerification}}`;
|
|
92
|
+
lines.push(` ${GLYPH[o.status]} ${o.status.padEnd(7)} ${o.id}${tag}${src} ${o.text}`);
|
|
91
93
|
for (const b of o.bindings) {
|
|
92
94
|
const ptr = b.uploadId ? ` (cerebe:${b.uploadId})` : "";
|
|
93
95
|
lines.push(` ${b.kind}[${b.ref}] ${b.status} — ${b.detail}${ptr}`);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"prove.js","sourceRoot":"","sources":["../../src/commands/prove.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,2DAA2D;AAC3D,yEAAyE;AACzE,iFAAiF;AACjF,+CAA+C;AAC/C,EAAE;AACF,yDAAyD;AACzD,6EAA6E;AAC7E,gEAAgE;AAChE,8EAA8E;AAC9E,2BAA2B;AAC3B,EAAE;AACF,4EAA4E;AAC5E,kFAAkF;AAClF,sEAAsE;AACtE,OAAO,EACL,gBAAgB,EAChB,kBAAkB,GAEnB,MAAM,sBAAsB,CAAC;AAqB9B,MAAM,IAAI,GAAG;IACX,mFAAmF;IACnF,EAAE;IACF,QAAQ;IACR,gEAAgE;IAChE,EAAE;IACF,8EAA8E;IAC9E,6EAA6E;IAC7E,gFAAgF;IAChF,gFAAgF;IAChF,iEAAiE;IACjE,EAAE;IACF,0EAA0E;IAC1E,wEAAwE;IACxE,2BAA2B;IAC3B,EAAE;IACF,QAAQ;IACR,gFAAgF;IAChF,yEAAyE;IACzE,+EAA+E;IAC/E,iFAAiF;IACjF,sCAAsC;IACtC,EAAE;IACF,aAAa;IACb,8EAA8E;IAC9E,yEAAyE;IACzE,4EAA4E;IAC5E,yBAAyB;IACzB,EAAE;CACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,SAAS,cAAc,CAAC,IAAc;IACpC,IAAI,MAAM,GAAG,MAAM,CAAC;IACpB,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IACxB,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;YACnB,IAAI,GAAG,IAAI,CAAC;YACZ,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC;YACrB,MAAM,GAAG,IAAI,CAAC;YACd,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACzB,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChD,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,oBAAoB,EAAE,CAAC;YAC7C,CAAC;YACD,IAAI,CAAC,KAAK,UAAU;gBAAE,MAAM,GAAG,IAAI,CAAC;;gBAC/B,GAAG,GAAG,IAAI,CAAC;YAChB,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC9B,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YACrC,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3B,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC/B,SAAS;QACX,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,mCAAmC,CAAC,EAAE,EAAE,CAAC;IAC3D,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,KAAK,GAAgC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAEtF,SAAS,eAAe,CAAC,CAAiB;IACxC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5C,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;
|
|
1
|
+
{"version":3,"file":"prove.js","sourceRoot":"","sources":["../../src/commands/prove.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,2DAA2D;AAC3D,yEAAyE;AACzE,iFAAiF;AACjF,+CAA+C;AAC/C,EAAE;AACF,yDAAyD;AACzD,6EAA6E;AAC7E,gEAAgE;AAChE,8EAA8E;AAC9E,2BAA2B;AAC3B,EAAE;AACF,4EAA4E;AAC5E,kFAAkF;AAClF,sEAAsE;AACtE,OAAO,EACL,gBAAgB,EAChB,kBAAkB,GAEnB,MAAM,sBAAsB,CAAC;AAqB9B,MAAM,IAAI,GAAG;IACX,mFAAmF;IACnF,EAAE;IACF,QAAQ;IACR,gEAAgE;IAChE,EAAE;IACF,8EAA8E;IAC9E,6EAA6E;IAC7E,gFAAgF;IAChF,gFAAgF;IAChF,iEAAiE;IACjE,EAAE;IACF,0EAA0E;IAC1E,wEAAwE;IACxE,2BAA2B;IAC3B,EAAE;IACF,QAAQ;IACR,gFAAgF;IAChF,yEAAyE;IACzE,+EAA+E;IAC/E,iFAAiF;IACjF,sCAAsC;IACtC,EAAE;IACF,aAAa;IACb,8EAA8E;IAC9E,yEAAyE;IACzE,4EAA4E;IAC5E,yBAAyB;IACzB,EAAE;CACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,SAAS,cAAc,CAAC,IAAc;IACpC,IAAI,MAAM,GAAG,MAAM,CAAC;IACpB,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IACxB,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;YACnB,IAAI,GAAG,IAAI,CAAC;YACZ,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC;YACrB,MAAM,GAAG,IAAI,CAAC;YACd,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACzB,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChD,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,oBAAoB,EAAE,CAAC;YAC7C,CAAC;YACD,IAAI,CAAC,KAAK,UAAU;gBAAE,MAAM,GAAG,IAAI,CAAC;;gBAC/B,GAAG,GAAG,IAAI,CAAC;YAChB,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC9B,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YACrC,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3B,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC/B,SAAS;QACX,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,mCAAmC,CAAC,EAAE,EAAE,CAAC;IAC3D,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,KAAK,GAAgC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAEtF,SAAS,eAAe,CAAC,CAAiB;IACxC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5C,iEAAiE;IACjE,MAAM,GAAG,GAAG,CAAC,CAAC,kBAAkB,KAAK,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,kBAAkB,GAAG,CAAC;IAC1F,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,GAAG,GAAG,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACxF,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,eAAe,CAAC,MAAwB;IAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACzC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,0CAA0C,KAAK,EAAE,CAAC,CAAC;IAC9D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU;QAAE,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC;IACzB,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACjF,KAAK,CAAC,IAAI,CACR,YAAY,CAAC,CAAC,MAAM,aAAa,CAAC,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,YAAY,CAAC,CAAC,KAAK,UAAU,IAAI,EAAE,CACpG,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,gFAAgF;AAChF,2BAA2B;AAC3B,SAAS,gBAAgB,CAAC,MAAwB,EAAE,MAAe;IACjE,OAAO,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,IAAc,EACd,EAAW,EACX,OAAkB,EAAE;IAEpB,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,EAAE,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;QACtB,EAAE,CAAC,MAAM,CAAC,aAAa,MAAM,CAAC,KAAK,wCAAwC,CAAC,CAAC;QAC7E,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,kBAAkB,CAAC;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAEzD,IAAI,SAAsC,CAAC;IAC3C,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,EAAE,CAAC,MAAM,CAAC,aAAc,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC;QACnD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,EAAE,CAAC,MAAM,CAAC,8FAA8F,CAAC,CAAC;QAC1G,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAE7E,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,EAAE,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC;SAAM,CAAC;QACN,EAAE,CAAC,MAAM,CAAC,GAAG,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC;IAED,iFAAiF;IACjF,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;IAC7D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,EAAE,CAAC,MAAM,CACP,aAAa,QAAQ,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,4BAA4B,QAAQ;aACjG,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;aACnC,IAAI,CAAC,IAAI,CAAC,KAAK,CACnB,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC;QACvG,EAAE,CAAC,MAAM,CACP,SAAS;YACP,CAAC,CAAC,aAAa,KAAK,YAAY;YAChC,CAAC,CAAC,uFAAuF,CAC5F,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}
|
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
import { type CerebeConfig } from "../evidence/cerebe.js";
|
|
2
2
|
import { type EvidenceUploader } from "../evidence/publish.js";
|
|
3
|
+
import { transmitEvidence, type TransmitConfig } from "../evidence/transmit.js";
|
|
3
4
|
export interface PublishIo {
|
|
4
5
|
stdout: (s: string) => void;
|
|
5
6
|
stderr: (s: string) => void;
|
|
@@ -8,6 +9,8 @@ export interface PublishDeps {
|
|
|
8
9
|
env?: Record<string, string | undefined>;
|
|
9
10
|
resolveCerebe?: (env: Record<string, string | undefined>) => CerebeConfig | null;
|
|
10
11
|
makeUploader?: (config: CerebeConfig) => EvidenceUploader;
|
|
12
|
+
resolveTransmit?: (env: Record<string, string | undefined>) => TransmitConfig | null;
|
|
13
|
+
transmit?: typeof transmitEvidence;
|
|
11
14
|
}
|
|
12
15
|
export declare function cmdPublish(rest: string[], io: PublishIo, deps?: PublishDeps): Promise<number>;
|
|
13
16
|
//# sourceMappingURL=publish.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"publish.d.ts","sourceRoot":"","sources":["../../src/commands/publish.ts"],"names":[],"mappings":"AAkBA,OAAO,EAGL,KAAK,YAAY,EAClB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,wBAAwB,CAAC;
|
|
1
|
+
{"version":3,"file":"publish.d.ts","sourceRoot":"","sources":["../../src/commands/publish.ts"],"names":[],"mappings":"AAkBA,OAAO,EAGL,KAAK,YAAY,EAClB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAGL,gBAAgB,EAChB,KAAK,cAAc,EACpB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAID,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,KAAK,YAAY,GAAG,IAAI,CAAC;IACjF,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,gBAAgB,CAAC;IAG1D,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,KAAK,cAAc,GAAG,IAAI,CAAC;IACrF,QAAQ,CAAC,EAAE,OAAO,gBAAgB,CAAC;CACpC;AAkGD,wBAAsB,UAAU,CAC9B,IAAI,EAAE,MAAM,EAAE,EACd,EAAE,EAAE,SAAS,EACb,IAAI,GAAE,WAAgB,GACrB,OAAO,CAAC,MAAM,CAAC,CAkHjB"}
|
package/dist/commands/publish.js
CHANGED
|
@@ -17,11 +17,12 @@ import { loadAgentReviewConfig } from "../policy/config.js";
|
|
|
17
17
|
import { resolveCommit } from "../git.js";
|
|
18
18
|
import { CerebeStorage, resolveCerebeConfig, } from "../evidence/cerebe.js";
|
|
19
19
|
import { buildPublishManifest, collectPublishArtifacts, } from "../evidence/publish.js";
|
|
20
|
+
import { resolveTransmitConfig, resolveTransmitRepository, transmitEvidence, } from "../evidence/transmit.js";
|
|
20
21
|
const HELP = [
|
|
21
22
|
"df publish — upload the `df verify` evidence bundle to Cerebe + emit pointers.",
|
|
22
23
|
"",
|
|
23
24
|
"Usage:",
|
|
24
|
-
" df publish [--commit <ref>] [--cwd <path>] [--out <file>]",
|
|
25
|
+
" df publish [--commit <ref>] [--cwd <path>] [--out <file>] [--repository <owner/repo>]",
|
|
25
26
|
"",
|
|
26
27
|
"Reads the per-SHA quality-gate evidence `df verify` wrote (the diffHash-bound",
|
|
27
28
|
"gate JSON + any UI screenshots), uploads each artifact to Cerebe object",
|
|
@@ -36,6 +37,16 @@ const HELP = [
|
|
|
36
37
|
" CEREBE_USER_ID Optional upload identity (multipart `user_id`; default",
|
|
37
38
|
" `dark-factory`). Set it to your CI service identity.",
|
|
38
39
|
"",
|
|
40
|
+
"Transmit (optional) — PUSH the manifest to an HTTP evidence-ingest endpoint,",
|
|
41
|
+
"HMAC-signed, so a hosted worker can join it server-side. Activated only when",
|
|
42
|
+
"both vars are set; degrade-and-pass (a transmit failure never blocks the merge):",
|
|
43
|
+
" DF_EVIDENCE_INGEST_URL Endpoint the `{repository, evidence}` envelope is",
|
|
44
|
+
" POSTed to.",
|
|
45
|
+
" DF_EVIDENCE_INGEST_SECRET HMAC-SHA256 key; sent as `X-Hub-Signature-256:",
|
|
46
|
+
" sha256=<hex>` over the raw body (GitHub convention).",
|
|
47
|
+
" GITHUB_REPOSITORY `owner/repo` the evidence is attributed to (auto-set",
|
|
48
|
+
" by GitHub Actions); override with --repository.",
|
|
49
|
+
"",
|
|
39
50
|
"When Cerebe is not configured, or an upload fails, publish emits a",
|
|
40
51
|
'`status: "degraded"` manifest and still exits 0 (degrade-and-pass) — the',
|
|
41
52
|
"merge verdict is never blocked by a storage outage.",
|
|
@@ -44,6 +55,8 @@ const HELP = [
|
|
|
44
55
|
" --commit <ref> Commit ref (anything `git rev-parse` accepts; default HEAD).",
|
|
45
56
|
" --cwd <path> Repository root to operate in (default: process cwd).",
|
|
46
57
|
" --out <file> Write the manifest to <file> (default: stdout).",
|
|
58
|
+
" --repository <owner/repo> Repository to attribute transmitted evidence to",
|
|
59
|
+
" (default: GITHUB_REPOSITORY). Only used when transmit is on.",
|
|
47
60
|
" --help, -h Show this message.",
|
|
48
61
|
"",
|
|
49
62
|
"Exit codes:",
|
|
@@ -56,9 +69,10 @@ function parsePublishArgs(rest) {
|
|
|
56
69
|
let commit = "HEAD";
|
|
57
70
|
let cwd = process.cwd();
|
|
58
71
|
let out = null;
|
|
72
|
+
let repository = null;
|
|
59
73
|
for (let i = 0; i < rest.length; i++) {
|
|
60
74
|
const a = rest[i] ?? "";
|
|
61
|
-
if (a === "--commit" || a === "--cwd" || a === "--out") {
|
|
75
|
+
if (a === "--commit" || a === "--cwd" || a === "--out" || a === "--repository") {
|
|
62
76
|
const next = rest[i + 1];
|
|
63
77
|
if (next === undefined || next.startsWith("--")) {
|
|
64
78
|
return { error: `${a} requires a value.` };
|
|
@@ -67,6 +81,8 @@ function parsePublishArgs(rest) {
|
|
|
67
81
|
commit = next;
|
|
68
82
|
else if (a === "--cwd")
|
|
69
83
|
cwd = next;
|
|
84
|
+
else if (a === "--repository")
|
|
85
|
+
repository = next;
|
|
70
86
|
else
|
|
71
87
|
out = next;
|
|
72
88
|
i++;
|
|
@@ -84,9 +100,13 @@ function parsePublishArgs(rest) {
|
|
|
84
100
|
out = a.slice("--out=".length);
|
|
85
101
|
continue;
|
|
86
102
|
}
|
|
103
|
+
if (a.startsWith("--repository=")) {
|
|
104
|
+
repository = a.slice("--repository=".length);
|
|
105
|
+
continue;
|
|
106
|
+
}
|
|
87
107
|
return { error: `unknown flag or positional arg: ${a}` };
|
|
88
108
|
}
|
|
89
|
-
return { commit, cwd, out };
|
|
109
|
+
return { commit, cwd, out, repository };
|
|
90
110
|
}
|
|
91
111
|
export async function cmdPublish(rest, io, deps = {}) {
|
|
92
112
|
if (rest.includes("--help") || rest.includes("-h")) {
|
|
@@ -163,6 +183,32 @@ export async function cmdPublish(rest, io, deps = {}) {
|
|
|
163
183
|
else {
|
|
164
184
|
io.stderr(`df publish: status=complete (${short}) — ${uploaded} artifact(s) uploaded.\n`);
|
|
165
185
|
}
|
|
186
|
+
// ---- Transmit (Cycle 23) -------------------------------------------------
|
|
187
|
+
// When an evidence-ingest endpoint is configured, PUSH the manifest to it,
|
|
188
|
+
// HMAC-signed, so a hosted worker can join it server-side. Degrade-and-pass:
|
|
189
|
+
// a transmit failure is logged but NEVER changes the exit code (mirrors the
|
|
190
|
+
// Cerebe upload posture — the merge verdict is not blocked by transmit).
|
|
191
|
+
// Skipped silently when unconfigured (no DF_EVIDENCE_INGEST_* env).
|
|
192
|
+
const resolveTransmit = deps.resolveTransmit ?? resolveTransmitConfig;
|
|
193
|
+
const transmit = deps.transmit ?? transmitEvidence;
|
|
194
|
+
const transmitConfig = resolveTransmit(env);
|
|
195
|
+
if (transmitConfig !== null) {
|
|
196
|
+
const repository = resolveTransmitRepository(env, parsed.repository);
|
|
197
|
+
if (repository === null) {
|
|
198
|
+
io.stderr("df publish: evidence-ingest configured (DF_EVIDENCE_INGEST_URL) but no repository — " +
|
|
199
|
+
"pass --repository <owner/repo> or set GITHUB_REPOSITORY; skipping transmit.\n");
|
|
200
|
+
}
|
|
201
|
+
else {
|
|
202
|
+
try {
|
|
203
|
+
const result = await transmit({ config: transmitConfig, repository, evidence: manifest });
|
|
204
|
+
io.stderr(`df publish: transmitted evidence for ${repository}@${short} → HTTP ${result.status}.\n`);
|
|
205
|
+
}
|
|
206
|
+
catch (err) {
|
|
207
|
+
io.stderr("df publish: evidence transmit failed (degrade-and-pass — merge not blocked): " +
|
|
208
|
+
`${err.message}\n`);
|
|
209
|
+
}
|
|
210
|
+
}
|
|
211
|
+
}
|
|
166
212
|
return 0;
|
|
167
213
|
}
|
|
168
214
|
//# sourceMappingURL=publish.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"publish.js","sourceRoot":"","sources":["../../src/commands/publish.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,2EAA2E;AAC3E,EAAE;AACF,uEAAuE;AACvE,8EAA8E;AAC9E,2EAA2E;AAC3E,0EAA0E;AAC1E,0CAA0C;AAC1C,EAAE;AACF,6EAA6E;AAC7E,+EAA+E;AAC/E,+EAA+E;AAC/E,+EAA+E;AAC/E,6CAA6C;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAExC,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EACL,aAAa,EACb,mBAAmB,GAEpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,oBAAoB,EACpB,uBAAuB,GAExB,MAAM,wBAAwB,CAAC;
|
|
1
|
+
{"version":3,"file":"publish.js","sourceRoot":"","sources":["../../src/commands/publish.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,2EAA2E;AAC3E,EAAE;AACF,uEAAuE;AACvE,8EAA8E;AAC9E,2EAA2E;AAC3E,0EAA0E;AAC1E,0CAA0C;AAC1C,EAAE;AACF,6EAA6E;AAC7E,+EAA+E;AAC/E,+EAA+E;AAC/E,+EAA+E;AAC/E,6CAA6C;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAExC,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EACL,aAAa,EACb,mBAAmB,GAEpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,oBAAoB,EACpB,uBAAuB,GAExB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,qBAAqB,EACrB,yBAAyB,EACzB,gBAAgB,GAEjB,MAAM,yBAAyB,CAAC;AA2BjC,MAAM,IAAI,GAAG;IACX,gFAAgF;IAChF,EAAE;IACF,QAAQ;IACR,yFAAyF;IACzF,EAAE;IACF,+EAA+E;IAC/E,yEAAyE;IACzE,8EAA8E;IAC9E,8EAA8E;IAC9E,WAAW;IACX,EAAE;IACF,2CAA2C;IAC3C,8EAA8E;IAC9E,uEAAuE;IACvE,wEAAwE;IACxE,2EAA2E;IAC3E,yEAAyE;IACzE,EAAE;IACF,8EAA8E;IAC9E,8EAA8E;IAC9E,kFAAkF;IAClF,gFAAgF;IAChF,yCAAyC;IACzC,6EAA6E;IAC7E,mFAAmF;IACnF,mFAAmF;IACnF,8EAA8E;IAC9E,EAAE;IACF,oEAAoE;IACpE,0EAA0E;IAC1E,qDAAqD;IACrD,EAAE;IACF,QAAQ;IACR,gFAAgF;IAChF,yEAAyE;IACzE,mEAAmE;IACnE,8EAA8E;IAC9E,gFAAgF;IAChF,sCAAsC;IACtC,EAAE;IACF,aAAa;IACb,qEAAqE;IACrE,4CAA4C;IAC5C,yBAAyB;IACzB,EAAE;CACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,SAAS,gBAAgB,CAAC,IAAc;IACtC,IAAI,MAAM,GAAG,MAAM,CAAC;IACpB,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IACxB,IAAI,GAAG,GAAkB,IAAI,CAAC;IAC9B,IAAI,UAAU,GAAkB,IAAI,CAAC;IACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,cAAc,EAAE,CAAC;YAC/E,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACzB,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChD,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,oBAAoB,EAAE,CAAC;YAC7C,CAAC;YACD,IAAI,CAAC,KAAK,UAAU;gBAAE,MAAM,GAAG,IAAI,CAAC;iBAC/B,IAAI,CAAC,KAAK,OAAO;gBAAE,GAAG,GAAG,IAAI,CAAC;iBAC9B,IAAI,CAAC,KAAK,cAAc;gBAAE,UAAU,GAAG,IAAI,CAAC;;gBAC5C,GAAG,GAAG,IAAI,CAAC;YAChB,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC9B,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YACrC,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3B,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC/B,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3B,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC/B,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YAClC,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YAC7C,SAAS;QACX,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,mCAAmC,CAAC,EAAE,EAAE,CAAC;IAC3D,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAc,EACd,EAAa,EACb,OAAoB,EAAE;IAEtB,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,EAAE,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;QACtB,EAAE,CAAC,MAAM,CAAC,eAAe,MAAM,CAAC,KAAK,0CAA0C,CAAC,CAAC;QACjF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,qBAAqB,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,EAAE,CAAC,MAAM,CAAC,eAAgB,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC;QACrD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,EAAE,CAAC,MAAM,CAAC,eAAgB,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC;QACrD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAE/B,IAAI,SAAS,CAAC;IACd,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,uBAAuB,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,EAAE,CAAC,MAAM,CAAC,2CAA2C,KAAK,KAAM,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC;QAC3F,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,EAAE,CAAC,MAAM,CACP,kDAAkD,KAAK,mDAAmD,CAC3G,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,mBAAmB,CAAC;IAChE,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,MAAoB,EAAE,EAAE,CAAC,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IAChG,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEtD,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC;QAC1C,MAAM,EAAE,GAAG;QACX,GAAG,CAAC,SAAS,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,QAAQ;QACR,SAAS,EAAE,cAAc,KAAK,EAAE;QAChC,MAAM,EAAE,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,cAAc,CAAC,CAAC,IAAI,EAAE,IAAI,cAAc;KAC3E,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;IAC5D,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,aAAa,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,EAAE,CAAC,MAAM,CAAC,+BAA+B,MAAM,CAAC,GAAG,KAAM,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC;YACpF,OAAO,CAAC,CAAC;QACX,CAAC;QACD,EAAE,CAAC,MAAM,CAAC,iCAAiC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;IAC7D,CAAC;SAAM,CAAC;QACN,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC;IAED,MAAM,QAAQ,GACZ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC7E,IAAI,QAAQ,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACnC,EAAE,CAAC,MAAM,CACP,gCAAgC,KAAK,OAAO,QAAQ,CAAC,cAAc,IAAI,gBAAgB,IAAI,CAC5F,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,EAAE,CAAC,MAAM,CAAC,gCAAgC,KAAK,OAAO,QAAQ,0BAA0B,CAAC,CAAC;IAC5F,CAAC;IAED,6EAA6E;IAC7E,2EAA2E;IAC3E,6EAA6E;IAC7E,4EAA4E;IAC5E,yEAAyE;IACzE,oEAAoE;IACpE,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,qBAAqB,CAAC;IACtE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,gBAAgB,CAAC;IACnD,MAAM,cAAc,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,yBAAyB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QACrE,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,EAAE,CAAC,MAAM,CACP,sFAAsF;gBACpF,+EAA+E,CAClF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAC1F,EAAE,CAAC,MAAM,CACP,wCAAwC,UAAU,IAAI,KAAK,WAAW,MAAM,CAAC,MAAM,KAAK,CACzF,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,EAAE,CAAC,MAAM,CACP,+EAA+E;oBAC7E,GAAI,GAAa,CAAC,OAAO,IAAI,CAChC,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,CAAC,CAAC;AACX,CAAC"}
|
|
@@ -94,11 +94,13 @@ from __future__ import annotations
|
|
|
94
94
|
|
|
95
95
|
import argparse
|
|
96
96
|
import base64
|
|
97
|
+
import hashlib
|
|
97
98
|
import json
|
|
98
99
|
import os
|
|
99
100
|
import re
|
|
100
101
|
import subprocess
|
|
101
102
|
import sys
|
|
103
|
+
import unicodedata
|
|
102
104
|
from dataclasses import dataclass, field
|
|
103
105
|
from pathlib import Path
|
|
104
106
|
from typing import Iterable
|
|
@@ -1068,6 +1070,87 @@ def _declared_refs(trailers: "Trailers") -> set[str]:
|
|
|
1068
1070
|
return refs
|
|
1069
1071
|
|
|
1070
1072
|
|
|
1073
|
+
# Cycle 331.1 2c (#207) — source-criterion binding. These mirror the TS
|
|
1074
|
+
# contract in @momentiq/dark-factory-schemas (SOURCE_LOCATOR_RE +
|
|
1075
|
+
# canonicalizeCriterion); the canonicalization is pinned byte-for-byte by a
|
|
1076
|
+
# cross-impl fixture test so the Python (verify) and TS (author) sides can't drift.
|
|
1077
|
+
SOURCE_LOCATOR_RE = re.compile(r"^[a-z0-9_]+#[a-z0-9._-]+$", re.IGNORECASE)
|
|
1078
|
+
SHA256_HEX_RE = re.compile(r"^[0-9a-f]{64}$")
|
|
1079
|
+
|
|
1080
|
+
|
|
1081
|
+
def canonicalize_criterion(text: str) -> str:
|
|
1082
|
+
"""Canonicalize a source criterion's text for hashing (mirror of the TS
|
|
1083
|
+
``canonicalizeCriterion``). Strips a list marker + criterion label + markdown
|
|
1084
|
+
emphasis and folds whitespace; preserves meaning-bearing text."""
|
|
1085
|
+
s = unicodedata.normalize("NFC", text)
|
|
1086
|
+
s = re.sub(r"^\s*(?:[-*+]|\d+[.)])\s+", "", s) # list marker
|
|
1087
|
+
s = re.sub(r"^\s*\*{0,2}[A-Za-z]+\d+[A-Za-z0-9]*\*{0,2}\s*[:.)–—-]\s+", "", s) # label
|
|
1088
|
+
s = re.sub(r"[*`]", "", s) # emphasis / code tokens
|
|
1089
|
+
s = re.sub(r"\s+", " ", s).strip() # whitespace
|
|
1090
|
+
return s
|
|
1091
|
+
|
|
1092
|
+
|
|
1093
|
+
def _slug_heading(h: str) -> str:
|
|
1094
|
+
return re.sub(r"[^a-z0-9]+", "_", h.strip().lower()).strip("_")
|
|
1095
|
+
|
|
1096
|
+
|
|
1097
|
+
def _doc_body(path: Path) -> str:
|
|
1098
|
+
text = path.read_text(encoding="utf-8")
|
|
1099
|
+
m = re.match(r"^---\n.*?\n---\n", text, re.DOTALL)
|
|
1100
|
+
return text[m.end():] if m else text
|
|
1101
|
+
|
|
1102
|
+
|
|
1103
|
+
def _h2_sections(body: str) -> dict[str, str]:
|
|
1104
|
+
sections: dict[str, list[str]] = {}
|
|
1105
|
+
slug: str | None = None
|
|
1106
|
+
for line in body.splitlines():
|
|
1107
|
+
m = re.match(r"^##\s+(.+)$", line) # h2 only (### has no space after ##)
|
|
1108
|
+
if m:
|
|
1109
|
+
slug = _slug_heading(m.group(1))
|
|
1110
|
+
sections.setdefault(slug, [])
|
|
1111
|
+
elif slug is not None:
|
|
1112
|
+
sections[slug].append(line)
|
|
1113
|
+
return {k: "\n".join(v).strip() for k, v in sections.items()}
|
|
1114
|
+
|
|
1115
|
+
|
|
1116
|
+
def _list_items(section_body: str) -> list[str]:
|
|
1117
|
+
return [ln for ln in section_body.splitlines() if re.match(r"^\s*(?:[-*+]|\d+[.)])\s+", ln)]
|
|
1118
|
+
|
|
1119
|
+
|
|
1120
|
+
def _find_criterion(section_body: str, crit_id: str) -> str | None:
|
|
1121
|
+
items = _list_items(section_body)
|
|
1122
|
+
label = re.compile(
|
|
1123
|
+
rf"^\s*(?:[-*+]|\d+[.)])\s*\*{{0,2}}{re.escape(crit_id)}\*{{0,2}}\s*[:.)–—-]",
|
|
1124
|
+
re.IGNORECASE,
|
|
1125
|
+
)
|
|
1126
|
+
for it in items: # 1) explicit label match (e.g. "- **EC1**: ...")
|
|
1127
|
+
if label.match(it):
|
|
1128
|
+
return it
|
|
1129
|
+
m = re.search(r"(\d+)$", crit_id) # 2) position fallback (ecN → Nth item)
|
|
1130
|
+
if m:
|
|
1131
|
+
idx = int(m.group(1)) - 1
|
|
1132
|
+
if 0 <= idx < len(items):
|
|
1133
|
+
return items[idx]
|
|
1134
|
+
return None
|
|
1135
|
+
|
|
1136
|
+
|
|
1137
|
+
def _resolve_criterion(cycle_id: str, locator: str) -> tuple[str, str | None]:
|
|
1138
|
+
"""Resolve a text-hash locator against an IN-REPO cycle doc. Returns
|
|
1139
|
+
(status, text) where status is 'ok' | 'no-doc' | 'no-criterion'. 'no-doc'
|
|
1140
|
+
(source not resolvable locally) is the non-blocking path."""
|
|
1141
|
+
doc = find_cycle_doc(cycle_id)
|
|
1142
|
+
if doc is None:
|
|
1143
|
+
return ("no-doc", None)
|
|
1144
|
+
section_slug, _, crit_id = locator.partition("#")
|
|
1145
|
+
# SOURCE_LOCATOR_RE is case-insensitive but section slugs are lowercased
|
|
1146
|
+
# (_slug_heading), so normalize the lookup to avoid a false "not found".
|
|
1147
|
+
section = _h2_sections(_doc_body(doc.path)).get(section_slug.lower())
|
|
1148
|
+
if section is None:
|
|
1149
|
+
return ("no-criterion", None)
|
|
1150
|
+
text = _find_criterion(section, crit_id)
|
|
1151
|
+
return ("ok", text) if text is not None else ("no-criterion", None)
|
|
1152
|
+
|
|
1153
|
+
|
|
1071
1154
|
def validate_objectives(
|
|
1072
1155
|
repo_root: Path, trailers: "Trailers", changed_files: Iterable[str]
|
|
1073
1156
|
) -> list[str]:
|
|
@@ -1198,6 +1281,58 @@ def validate_objectives(
|
|
|
1198
1281
|
errors.append(
|
|
1199
1282
|
f"{bloc}.kind: expected 'route' | 'critic' | 'test', got {bkind!r}"
|
|
1200
1283
|
)
|
|
1284
|
+
# Cycle 331.1 2c (#207) — source-criterion binding. Verify a text-hash
|
|
1285
|
+
# against the IN-REPO cycle doc (blocking on mismatch / not-found);
|
|
1286
|
+
# human-reviewed is the escape; an unresolvable source (cross-repo cycle
|
|
1287
|
+
# doc, issue body) is a NON-BLOCKING note — no flaky network on the gate.
|
|
1288
|
+
sc = obj.get("sourceCriterion")
|
|
1289
|
+
if isinstance(sc, dict):
|
|
1290
|
+
sc_kind = sc.get("kind")
|
|
1291
|
+
if sc_kind == "human-reviewed":
|
|
1292
|
+
pass # accepted; surfaced by df prove as human-reviewed
|
|
1293
|
+
elif sc_kind == "text-hash":
|
|
1294
|
+
sloc, ssha = sc.get("locator"), sc.get("sha256")
|
|
1295
|
+
if not isinstance(sloc, str) or not SOURCE_LOCATOR_RE.match(sloc):
|
|
1296
|
+
errors.append(
|
|
1297
|
+
f"{loc}.sourceCriterion.locator: expected '<section-slug>#<criterion-id>', got {sloc!r}"
|
|
1298
|
+
)
|
|
1299
|
+
elif not isinstance(ssha, str) or not SHA256_HEX_RE.match(ssha):
|
|
1300
|
+
errors.append(
|
|
1301
|
+
f"{loc}.sourceCriterion.sha256: expected lowercase-hex SHA-256 (64 chars), got {ssha!r}"
|
|
1302
|
+
)
|
|
1303
|
+
elif kind == "cycle" and isinstance(ref, str):
|
|
1304
|
+
status, ctext = _resolve_criterion(normalize_cycle_id(ref) or ref, sloc)
|
|
1305
|
+
if status == "no-doc":
|
|
1306
|
+
print(
|
|
1307
|
+
f"[objectives] {loc}.sourceCriterion: cycle {ref!r} doc not in-repo — "
|
|
1308
|
+
"recorded, not verified (cross-repo verification deferred)",
|
|
1309
|
+
file=sys.stderr,
|
|
1310
|
+
)
|
|
1311
|
+
elif status == "no-criterion":
|
|
1312
|
+
errors.append(
|
|
1313
|
+
f"{loc}.sourceCriterion.locator: criterion {sloc!r} not found in the cycle doc"
|
|
1314
|
+
)
|
|
1315
|
+
elif ctext is not None:
|
|
1316
|
+
actual = hashlib.sha256(
|
|
1317
|
+
canonicalize_criterion(ctext).encode("utf-8")
|
|
1318
|
+
).hexdigest()
|
|
1319
|
+
if actual != ssha:
|
|
1320
|
+
errors.append(
|
|
1321
|
+
f"{loc}.sourceCriterion.sha256: does not match the source criterion "
|
|
1322
|
+
f"(recomputed {actual})"
|
|
1323
|
+
)
|
|
1324
|
+
else:
|
|
1325
|
+
print(
|
|
1326
|
+
f"[objectives] {loc}.sourceCriterion: {kind} source verification deferred "
|
|
1327
|
+
"(v1 verifies in-repo cycle docs) — recorded, not verified",
|
|
1328
|
+
file=sys.stderr,
|
|
1329
|
+
)
|
|
1330
|
+
else:
|
|
1331
|
+
errors.append(
|
|
1332
|
+
f"{loc}.sourceCriterion.kind: expected 'text-hash' | 'human-reviewed', got {sc_kind!r}"
|
|
1333
|
+
)
|
|
1334
|
+
elif sc is not None:
|
|
1335
|
+
errors.append(f"{loc}.sourceCriterion: expected a mapping")
|
|
1201
1336
|
return errors
|
|
1202
1337
|
|
|
1203
1338
|
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"prove.d.ts","sourceRoot":"","sources":["../../src/evidence/prove.ts"],"names":[],"mappings":"AAsBA,OAAO,EAGL,KAAK,gBAAgB,EACrB,KAAK,YAAY,EAEjB,KAAK,SAAS,
|
|
1
|
+
{"version":3,"file":"prove.d.ts","sourceRoot":"","sources":["../../src/evidence/prove.ts"],"names":[],"mappings":"AAsBA,OAAO,EAGL,KAAK,gBAAgB,EACrB,KAAK,YAAY,EAEjB,KAAK,SAAS,EAKd,KAAK,aAAa,EACnB,MAAM,gCAAgC,CAAC;AASxC,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAGD,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,CAAC,EAAE,aAAa,CAAC;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IAEf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,SAAS,EAAE,CAAC;IAExB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAEhD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAEnD,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpC;AAqED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,GAAG,gBAAgB,CA8B3F;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,WAAW,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;CACrB;AAQD,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAiEtC"}
|
package/dist/evidence/prove.js
CHANGED
|
@@ -86,7 +86,14 @@ export function buildProofRecord(inputs, generatedAt) {
|
|
|
86
86
|
// An objective with no bindings is declared-but-unbound → pending, never
|
|
87
87
|
// silently proven. Otherwise it's the worst of its bindings.
|
|
88
88
|
const status = bindings.length === 0 ? "pending" : worstOf(bindings.map((b) => b.status));
|
|
89
|
-
|
|
89
|
+
// 2c: surface whether the objective is grounded in its source. df prove
|
|
90
|
+
// reports the binding kind; the cycle-doc-validation gate is the verifier.
|
|
91
|
+
const sourceVerification = o.sourceCriterion === undefined
|
|
92
|
+
? "agent-asserted"
|
|
93
|
+
: o.sourceCriterion.kind === "human-reviewed"
|
|
94
|
+
? "human-reviewed"
|
|
95
|
+
: "source-bound";
|
|
96
|
+
return { id: o.id, text: o.text, enforced: o.enforced, status, bindings, sourceVerification };
|
|
90
97
|
});
|
|
91
98
|
const summary = { proven: 0, pending: 0, failed: 0, total: objectives.length };
|
|
92
99
|
for (const o of objectives)
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"prove.js","sourceRoot":"","sources":["../../src/evidence/prove.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,2EAA2E;AAC3E,gFAAgF;AAChF,kFAAkF;AAClF,4EAA4E;AAC5E,EAAE;AACF,qCAAqC;AACrC,iFAAiF;AACjF,8EAA8E;AAC9E,kFAAkF;AAClF,8BAA8B;AAC9B,EAAE;AACF,8EAA8E;AAC9E,kFAAkF;AAClF,mFAAmF;AACnF,sDAAsD;AAEtD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,EACL,uBAAuB,
|
|
1
|
+
{"version":3,"file":"prove.js","sourceRoot":"","sources":["../../src/evidence/prove.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,2EAA2E;AAC3E,gFAAgF;AAChF,kFAAkF;AAClF,4EAA4E;AAC5E,EAAE;AACF,qCAAqC;AACrC,iFAAiF;AACjF,8EAA8E;AAC9E,kFAAkF;AAClF,8BAA8B;AAC9B,EAAE;AACF,8EAA8E;AAC9E,kFAAkF;AAClF,mFAAmF;AACnF,sDAAsD;AAEtD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,EACL,uBAAuB,GAWxB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AA6B3D,MAAM,WAAW,GAAgC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;AAEtF,SAAS,OAAO,CAAC,QAAuB;IACtC,IAAI,KAAK,GAAgB,QAAQ,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC;YAAE,KAAK,GAAG,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CACvB,IAAsB,EACtB,GAAW,EACX,MAAmB;IAEnB,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC9D,MAAM,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;IACvF,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC7E,CAAC;IACD,MAAM,KAAK,GACT,MAAM,CAAC,gBAAgB,KAAK,SAAS;QACrC,MAAM,CAAC,YAAY,KAAK,SAAS;QACjC,MAAM,CAAC,gBAAgB,KAAK,MAAM,CAAC,YAAY,CAAC;IAClD,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IACzE,CAAC;IACD,OAAO;QACL,GAAG,IAAI;QACP,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,kEAAkE;KAC3E,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB,EAAE,MAAmB;IAC1D,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,QAAiB,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC3F,MAAM,CAAC,GAAG,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,qDAAqD,EAAE,CAAC;IACvG,CAAC;IACD,IAAI,CAAC,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QAC7B,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,CAAC,OAAO,KAAK,mBAAmB,EAAE,CAAC;QACtC,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAC3E,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,MAAM,kBAAkB,EAAE,CAAC;AACtF,CAAC;AAED,SAAS,cAAc,CAAC,CAAkB,EAAE,MAAmB;IAC7D,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,OAAO;YACV,OAAO,gBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACtD,KAAK,MAAM;YACT,OAAO,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACjD,KAAK,QAAQ;YACX,OAAO,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,uDAAuD;AACvD,MAAM,UAAU,gBAAgB,CAAC,MAAmB,EAAE,WAAmB;IACvE,MAAM,UAAU,GAAqB,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC/D,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACpE,yEAAyE;QACzE,6DAA6D;QAC7D,MAAM,MAAM,GACV,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7E,wEAAwE;QACxE,2EAA2E;QAC3E,MAAM,kBAAkB,GACtB,CAAC,CAAC,eAAe,KAAK,SAAS;YAC7B,CAAC,CAAC,gBAAgB;YAClB,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,KAAK,gBAAgB;gBAC3C,CAAC,CAAC,gBAAgB;gBAClB,CAAC,CAAC,cAAc,CAAC;QACvB,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC;IAChG,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAiB,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;IAC7F,KAAK,MAAM,CAAC,IAAI,UAAU;QAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAEnD,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,UAAU,EAAE,mBAAmB;QAC/B,WAAW;QACX,UAAU;QACV,OAAO;KACR,CAAC;AACJ,CAAC;AAOD,MAAM,uBAAuB,GAAG,8BAA8B,CAAC;AAE/D,iFAAiF;AACjF,gFAAgF;AAChF,gFAAgF;AAChF,wBAAwB;AACxB,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAW,EACX,MAAc;IAEd,+EAA+E;IAC/E,8EAA8E;IAC9E,IAAI,IAAI,GAAG,GAAG,CAAC;IACf,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,GAAG,CAAC;IACb,CAAC;IACD,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;IAC5D,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,QAAQ,GAAG,uBAAuB,CACtC,SAAS,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,EAC7C,uBAAuB,CACxB,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAE7C,0EAA0E;IAC1E,uEAAuE;IACvE,gBAAgB;IAChB,IAAI,YAAgC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACjD,YAAY,GAAG,QAAQ,CAAC,MAAM,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,YAAY,GAAG,SAAS,CAAC;IAC3B,CAAC;IAED,uBAAuB;IACvB,MAAM,WAAW,GAAuC,EAAE,CAAC;IAC3D,IAAI,gBAAoC,CAAC;IACzC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,uBAAuB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAChE,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACxC,gBAAgB,GAAG,QAAQ,CAAC,QAAQ,CAAC;QACrC,KAAK,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,CAAC;YACxE,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;QACpD,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,+BAA+B;IAC/B,MAAM,aAAa,GAAwC,EAAE,CAAC;IAC9D,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACnD,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;YACvC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG;gBAC1B,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM,EAAE;YACN,MAAM,EAAE,GAAG;YACX,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,WAAW;YACX,GAAG,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,aAAa;SACd;QACD,WAAW,EAAE,GAAG;KACjB,CAAC;AACJ,CAAC"}
|
|
@@ -0,0 +1,76 @@
|
|
|
1
|
+
import type { PublishedEvidence } from "@momentiq/dark-factory-schemas";
|
|
2
|
+
/** Resolved transmit config. `null` from {@link resolveTransmitConfig} is the
|
|
3
|
+
* "not configured" signal — the caller skips transmit and still exits 0. */
|
|
4
|
+
export interface TransmitConfig {
|
|
5
|
+
/** DF_EVIDENCE_INGEST_URL — the full endpoint URL the manifest is POSTed to. */
|
|
6
|
+
url: string;
|
|
7
|
+
/** DF_EVIDENCE_INGEST_SECRET — the HMAC key (shared with the endpoint). */
|
|
8
|
+
secret: string;
|
|
9
|
+
}
|
|
10
|
+
/** A signature/auth rejection (401/403). Distinct so the caller surfaces
|
|
11
|
+
* "check DF_EVIDENCE_INGEST_SECRET" instead of retrying a doomed request. */
|
|
12
|
+
export declare class TransmitAuthError extends Error {
|
|
13
|
+
constructor(message: string);
|
|
14
|
+
}
|
|
15
|
+
/** A non-auth transmit failure: a request-level 4xx (e.g. a 400 the endpoint
|
|
16
|
+
* returns for a malformed/invalid manifest), an exhausted transient-retry
|
|
17
|
+
* budget, or a network error. */
|
|
18
|
+
export declare class TransmitError extends Error {
|
|
19
|
+
readonly status?: number | undefined;
|
|
20
|
+
constructor(message: string, status?: number | undefined);
|
|
21
|
+
}
|
|
22
|
+
type FetchFn = (input: string, init?: RequestInit) => Promise<Response>;
|
|
23
|
+
export interface TransmitOptions {
|
|
24
|
+
fetch?: FetchFn;
|
|
25
|
+
maxRetries?: number;
|
|
26
|
+
retryBaseMs?: number;
|
|
27
|
+
sleep?: (ms: number) => Promise<void>;
|
|
28
|
+
}
|
|
29
|
+
/** Header + prefix the endpoint expects — GitHub webhook convention. */
|
|
30
|
+
export declare const SIGNATURE_HEADER = "x-hub-signature-256";
|
|
31
|
+
/** The POST envelope shape (the receiver narrows to exactly this). */
|
|
32
|
+
export interface TransmitEnvelope {
|
|
33
|
+
repository: string;
|
|
34
|
+
evidence: PublishedEvidence;
|
|
35
|
+
}
|
|
36
|
+
export interface TransmitResult {
|
|
37
|
+
/** The HTTP status the endpoint returned (2xx ⇒ accepted; 204 may mean
|
|
38
|
+
* accepted OR a server-side skip such as an unknown repo / no-pointer
|
|
39
|
+
* manifest — the endpoint, not the CLI, makes that call). */
|
|
40
|
+
status: number;
|
|
41
|
+
}
|
|
42
|
+
/**
|
|
43
|
+
* Resolve transmit config from the environment. Returns `null` when either
|
|
44
|
+
* DF_EVIDENCE_INGEST_URL or DF_EVIDENCE_INGEST_SECRET is missing/blank — the
|
|
45
|
+
* fail-soft signal that the caller should skip transmit rather than error.
|
|
46
|
+
*/
|
|
47
|
+
export declare function resolveTransmitConfig(env?: Record<string, string | undefined>): TransmitConfig | null;
|
|
48
|
+
/**
|
|
49
|
+
* Resolve the `repository` the envelope is attributed to: an explicit override
|
|
50
|
+
* (`--repository owner/repo`) wins, else `GITHUB_REPOSITORY` (set by GitHub
|
|
51
|
+
* Actions). Returns `null` when neither is available — the caller skips transmit
|
|
52
|
+
* with a diagnostic (the receiver resolves tenancy from `repository`, so it is
|
|
53
|
+
* required).
|
|
54
|
+
*/
|
|
55
|
+
export declare function resolveTransmitRepository(env?: Record<string, string | undefined>, override?: string | null): string | null;
|
|
56
|
+
/**
|
|
57
|
+
* Compute the canonical `sha256=<hex>` signature for a raw body + secret —
|
|
58
|
+
* byte-identical to the receiver's verification (HMAC-SHA256 over the UTF-8
|
|
59
|
+
* body, lowercase hex, `sha256=` prefix). Exposed for tests.
|
|
60
|
+
*/
|
|
61
|
+
export declare function computeSignature(secret: string, rawBody: string): string;
|
|
62
|
+
/**
|
|
63
|
+
* POST the `{ repository, evidence }` envelope to the configured endpoint,
|
|
64
|
+
* HMAC-signed. Throws {@link TransmitAuthError} on 401/403 (signature/secret
|
|
65
|
+
* mismatch), {@link TransmitError} on a non-auth 4xx or an exhausted transient
|
|
66
|
+
* retry budget. The CALLER is responsible for degrade-and-pass (catching these
|
|
67
|
+
* so transmit never blocks the merge verdict).
|
|
68
|
+
*/
|
|
69
|
+
export declare function transmitEvidence(args: {
|
|
70
|
+
config: TransmitConfig;
|
|
71
|
+
repository: string;
|
|
72
|
+
evidence: PublishedEvidence;
|
|
73
|
+
options?: TransmitOptions;
|
|
74
|
+
}): Promise<TransmitResult>;
|
|
75
|
+
export {};
|
|
76
|
+
//# sourceMappingURL=transmit.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"transmit.d.ts","sourceRoot":"","sources":["../../src/evidence/transmit.ts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAExE;4EAC4E;AAC5E,MAAM,WAAW,cAAc;IAC7B,gFAAgF;IAChF,GAAG,EAAE,MAAM,CAAC;IACZ,2EAA2E;IAC3E,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;6EAC6E;AAC7E,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,OAAO,EAAE,MAAM;CAI5B;AAED;;iCAEiC;AACjC,qBAAa,aAAc,SAAQ,KAAK;IAGpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM;gBADxB,OAAO,EAAE,MAAM,EACN,MAAM,CAAC,EAAE,MAAM,YAAA;CAK3B;AAED,KAAK,OAAO,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAExE,MAAM,WAAW,eAAe;IAE9B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,wEAAwE;AACxE,eAAO,MAAM,gBAAgB,wBAAwB,CAAC;AAMtD,sEAAsE;AACtE,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,iBAAiB,CAAC;CAC7B;AAED,MAAM,WAAW,cAAc;IAC7B;;iEAE6D;IAC7D,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,cAAc,GAAG,IAAI,CAKvB;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,EACrD,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GACvB,MAAM,GAAG,IAAI,CAKf;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAExE;AAUD;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,MAAM,EAAE,cAAc,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,OAAO,CAAC,EAAE,eAAe,CAAC;CAC3B,GAAG,OAAO,CAAC,cAAc,CAAC,CA8E1B"}
|
|
@@ -0,0 +1,165 @@
|
|
|
1
|
+
// Cycle 23 verifiable-objectives — the evidence TRANSMIT path. `df publish`
|
|
2
|
+
// already (a) uploads the `df verify` evidence bundle to Cerebe and (b) emits
|
|
3
|
+
// the `PublishedEvidence` pointer manifest. This module adds the missing third
|
|
4
|
+
// facet: PUSH that manifest to a configured HTTP evidence-ingest endpoint so a
|
|
5
|
+
// hosted worker can join it against `.darkfactory/objectives.yaml` without the
|
|
6
|
+
// consumer also having to ship the manifest out-of-band.
|
|
7
|
+
//
|
|
8
|
+
// Generic by design (Apache-2.0 / no platform coupling, mirroring cerebe.ts):
|
|
9
|
+
// the endpoint URL + shared secret come ENTIRELY from the environment
|
|
10
|
+
// (`DF_EVIDENCE_INGEST_URL` / `DF_EVIDENCE_INGEST_SECRET`). No hostnames, tenant
|
|
11
|
+
// model, or platform assumptions are baked in — any ingest endpoint that
|
|
12
|
+
// verifies a GitHub-style `X-Hub-Signature-256` HMAC over the raw body works.
|
|
13
|
+
//
|
|
14
|
+
// Wire contract (the receiver's half): POST a JSON envelope
|
|
15
|
+
// { "repository": "<owner>/<repo>", "evidence": <PublishedEvidence> }
|
|
16
|
+
// with header `X-Hub-Signature-256: sha256=<hex>` where the digest is
|
|
17
|
+
// HMAC-SHA256(secret, RAW_REQUEST_BODY). The signature MUST be computed over the
|
|
18
|
+
// exact serialized bytes that are sent (the receiver recomputes over the raw
|
|
19
|
+
// body before parsing), so this module serializes once and signs+sends that
|
|
20
|
+
// same string.
|
|
21
|
+
//
|
|
22
|
+
// `resolveTransmitConfig` returns `null` when the env is absent — the caller
|
|
23
|
+
// degrades-and-passes (the merge verdict is NEVER blocked by transmit, exactly
|
|
24
|
+
// like an unconfigured Cerebe). `transmitEvidence` retries transient failures
|
|
25
|
+
// (5xx/429/network) and distinguishes a signature/auth rejection
|
|
26
|
+
// (`TransmitAuthError`, never retried) from a non-auth failure
|
|
27
|
+
// (`TransmitError`).
|
|
28
|
+
import { createHmac } from "node:crypto";
|
|
29
|
+
/** A signature/auth rejection (401/403). Distinct so the caller surfaces
|
|
30
|
+
* "check DF_EVIDENCE_INGEST_SECRET" instead of retrying a doomed request. */
|
|
31
|
+
export class TransmitAuthError extends Error {
|
|
32
|
+
constructor(message) {
|
|
33
|
+
super(message);
|
|
34
|
+
this.name = "TransmitAuthError";
|
|
35
|
+
}
|
|
36
|
+
}
|
|
37
|
+
/** A non-auth transmit failure: a request-level 4xx (e.g. a 400 the endpoint
|
|
38
|
+
* returns for a malformed/invalid manifest), an exhausted transient-retry
|
|
39
|
+
* budget, or a network error. */
|
|
40
|
+
export class TransmitError extends Error {
|
|
41
|
+
status;
|
|
42
|
+
constructor(message, status) {
|
|
43
|
+
super(message);
|
|
44
|
+
this.status = status;
|
|
45
|
+
this.name = "TransmitError";
|
|
46
|
+
}
|
|
47
|
+
}
|
|
48
|
+
/** Header + prefix the endpoint expects — GitHub webhook convention. */
|
|
49
|
+
export const SIGNATURE_HEADER = "x-hub-signature-256";
|
|
50
|
+
const SIGNATURE_PREFIX = "sha256=";
|
|
51
|
+
const DEFAULT_MAX_RETRIES = 2;
|
|
52
|
+
const DEFAULT_RETRY_BASE_MS = 500;
|
|
53
|
+
/**
|
|
54
|
+
* Resolve transmit config from the environment. Returns `null` when either
|
|
55
|
+
* DF_EVIDENCE_INGEST_URL or DF_EVIDENCE_INGEST_SECRET is missing/blank — the
|
|
56
|
+
* fail-soft signal that the caller should skip transmit rather than error.
|
|
57
|
+
*/
|
|
58
|
+
export function resolveTransmitConfig(env = process.env) {
|
|
59
|
+
const url = (env["DF_EVIDENCE_INGEST_URL"] ?? "").trim();
|
|
60
|
+
const secret = (env["DF_EVIDENCE_INGEST_SECRET"] ?? "").trim();
|
|
61
|
+
if (url === "" || secret === "")
|
|
62
|
+
return null;
|
|
63
|
+
return { url, secret };
|
|
64
|
+
}
|
|
65
|
+
/**
|
|
66
|
+
* Resolve the `repository` the envelope is attributed to: an explicit override
|
|
67
|
+
* (`--repository owner/repo`) wins, else `GITHUB_REPOSITORY` (set by GitHub
|
|
68
|
+
* Actions). Returns `null` when neither is available — the caller skips transmit
|
|
69
|
+
* with a diagnostic (the receiver resolves tenancy from `repository`, so it is
|
|
70
|
+
* required).
|
|
71
|
+
*/
|
|
72
|
+
export function resolveTransmitRepository(env = process.env, override) {
|
|
73
|
+
const explicit = (override ?? "").trim();
|
|
74
|
+
if (explicit !== "")
|
|
75
|
+
return explicit;
|
|
76
|
+
const fromEnv = (env["GITHUB_REPOSITORY"] ?? "").trim();
|
|
77
|
+
return fromEnv !== "" ? fromEnv : null;
|
|
78
|
+
}
|
|
79
|
+
/**
|
|
80
|
+
* Compute the canonical `sha256=<hex>` signature for a raw body + secret —
|
|
81
|
+
* byte-identical to the receiver's verification (HMAC-SHA256 over the UTF-8
|
|
82
|
+
* body, lowercase hex, `sha256=` prefix). Exposed for tests.
|
|
83
|
+
*/
|
|
84
|
+
export function computeSignature(secret, rawBody) {
|
|
85
|
+
return SIGNATURE_PREFIX + createHmac("sha256", secret).update(rawBody, "utf8").digest("hex");
|
|
86
|
+
}
|
|
87
|
+
/** Parse a `Retry-After` header (delta-seconds form) to ms, or undefined. */
|
|
88
|
+
function retryAfterMs(res) {
|
|
89
|
+
const header = res.headers.get("retry-after");
|
|
90
|
+
if (header === null)
|
|
91
|
+
return undefined;
|
|
92
|
+
const seconds = Number.parseInt(header.trim(), 10);
|
|
93
|
+
return Number.isFinite(seconds) && seconds >= 0 ? seconds * 1000 : undefined;
|
|
94
|
+
}
|
|
95
|
+
/**
|
|
96
|
+
* POST the `{ repository, evidence }` envelope to the configured endpoint,
|
|
97
|
+
* HMAC-signed. Throws {@link TransmitAuthError} on 401/403 (signature/secret
|
|
98
|
+
* mismatch), {@link TransmitError} on a non-auth 4xx or an exhausted transient
|
|
99
|
+
* retry budget. The CALLER is responsible for degrade-and-pass (catching these
|
|
100
|
+
* so transmit never blocks the merge verdict).
|
|
101
|
+
*/
|
|
102
|
+
export async function transmitEvidence(args) {
|
|
103
|
+
const { config, repository, evidence } = args;
|
|
104
|
+
const opts = args.options ?? {};
|
|
105
|
+
const fetchFn = opts.fetch ?? globalThis.fetch;
|
|
106
|
+
const maxRetries = opts.maxRetries ?? DEFAULT_MAX_RETRIES;
|
|
107
|
+
const retryBaseMs = opts.retryBaseMs ?? DEFAULT_RETRY_BASE_MS;
|
|
108
|
+
const sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
|
|
109
|
+
// Serialize ONCE and sign the exact bytes we send — the receiver recomputes
|
|
110
|
+
// the HMAC over the raw request body before parsing.
|
|
111
|
+
const rawBody = JSON.stringify({ repository, evidence });
|
|
112
|
+
const signature = computeSignature(config.secret, rawBody);
|
|
113
|
+
let lastError;
|
|
114
|
+
for (let attempt = 0; attempt <= maxRetries; attempt++) {
|
|
115
|
+
let res;
|
|
116
|
+
try {
|
|
117
|
+
res = await fetchFn(config.url, {
|
|
118
|
+
method: "POST",
|
|
119
|
+
// Do NOT follow redirects: the signed body is single-use and bound to
|
|
120
|
+
// THIS url's secret, so re-POSTing it to a 3xx target would be both
|
|
121
|
+
// wrong (signature mismatch) and a body-disclosure risk. A 3xx surfaces
|
|
122
|
+
// as a non-2xx below and is rejected.
|
|
123
|
+
redirect: "manual",
|
|
124
|
+
headers: {
|
|
125
|
+
"content-type": "application/json",
|
|
126
|
+
[SIGNATURE_HEADER]: signature,
|
|
127
|
+
},
|
|
128
|
+
body: rawBody,
|
|
129
|
+
});
|
|
130
|
+
}
|
|
131
|
+
catch (err) {
|
|
132
|
+
// Network/transport error — retryable.
|
|
133
|
+
lastError = new TransmitError(`network error transmitting evidence to ${config.url}: ${err.message}`);
|
|
134
|
+
if (attempt < maxRetries) {
|
|
135
|
+
await sleep(retryBaseMs * 2 ** attempt);
|
|
136
|
+
continue;
|
|
137
|
+
}
|
|
138
|
+
break;
|
|
139
|
+
}
|
|
140
|
+
if (res.status === 401 || res.status === 403) {
|
|
141
|
+
throw new TransmitAuthError(`evidence-ingest endpoint rejected the signature (HTTP ${res.status}) — ` +
|
|
142
|
+
`check DF_EVIDENCE_INGEST_SECRET matches the endpoint's secret.`);
|
|
143
|
+
}
|
|
144
|
+
if (res.status === 429 || res.status >= 500) {
|
|
145
|
+
// Transient — back off and retry, honoring Retry-After when present.
|
|
146
|
+
lastError = new TransmitError(`evidence-ingest transient failure (HTTP ${res.status})`, res.status);
|
|
147
|
+
if (attempt < maxRetries) {
|
|
148
|
+
await sleep(retryAfterMs(res) ?? retryBaseMs * 2 ** attempt);
|
|
149
|
+
continue;
|
|
150
|
+
}
|
|
151
|
+
break;
|
|
152
|
+
}
|
|
153
|
+
if (res.status < 200 || res.status >= 300) {
|
|
154
|
+
// Any other non-2xx that is neither transient (429/5xx, handled above) nor
|
|
155
|
+
// auth (401/403, handled above) — including a 3xx redirect or a 4xx like
|
|
156
|
+
// 400 (malformed/invalid manifest) — is a non-retryable failure. ONLY a
|
|
157
|
+
// 2xx counts as an accepted transmit.
|
|
158
|
+
throw new TransmitError(`evidence-ingest returned a non-2xx response (HTTP ${res.status}).`, res.status);
|
|
159
|
+
}
|
|
160
|
+
// 2xx — accepted (or a server-side skip the endpoint signals via 204).
|
|
161
|
+
return { status: res.status };
|
|
162
|
+
}
|
|
163
|
+
throw lastError ?? new TransmitError("evidence-ingest transmit failed (no response).");
|
|
164
|
+
}
|
|
165
|
+
//# sourceMappingURL=transmit.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"transmit.js","sourceRoot":"","sources":["../../src/evidence/transmit.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,8EAA8E;AAC9E,+EAA+E;AAC/E,+EAA+E;AAC/E,+EAA+E;AAC/E,yDAAyD;AACzD,EAAE;AACF,8EAA8E;AAC9E,sEAAsE;AACtE,iFAAiF;AACjF,yEAAyE;AACzE,8EAA8E;AAC9E,EAAE;AACF,4DAA4D;AAC5D,0EAA0E;AAC1E,sEAAsE;AACtE,iFAAiF;AACjF,6EAA6E;AAC7E,4EAA4E;AAC5E,eAAe;AACf,EAAE;AACF,6EAA6E;AAC7E,+EAA+E;AAC/E,8EAA8E;AAC9E,iEAAiE;AACjE,+DAA+D;AAC/D,qBAAqB;AAErB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAazC;6EAC6E;AAC7E,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED;;iCAEiC;AACjC,MAAM,OAAO,aAAc,SAAQ,KAAK;IAG3B;IAFX,YACE,OAAe,EACN,MAAe;QAExB,KAAK,CAAC,OAAO,CAAC,CAAC;QAFN,WAAM,GAAN,MAAM,CAAS;QAGxB,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AAaD,wEAAwE;AACxE,MAAM,CAAC,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AACtD,MAAM,gBAAgB,GAAG,SAAS,CAAC;AAEnC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAC9B,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAelC;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAA0C,OAAO,CAAC,GAAG;IAErD,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACzD,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,2BAA2B,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/D,IAAI,GAAG,KAAK,EAAE,IAAI,MAAM,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AACzB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAA0C,OAAO,CAAC,GAAG,EACrD,QAAwB;IAExB,MAAM,QAAQ,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,IAAI,QAAQ,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IACrC,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACxD,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,OAAe;IAC9D,OAAO,gBAAgB,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC/F,CAAC;AAED,6EAA6E;AAC7E,SAAS,YAAY,CAAC,GAAa;IACjC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC9C,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAKtC;IACC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;IAChC,MAAM,OAAO,GAAY,IAAI,CAAC,KAAK,IAAK,UAAU,CAAC,KAAiB,CAAC;IACrE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAC1D,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,qBAAqB,CAAC;IAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAE1F,4EAA4E;IAC5E,qDAAqD;IACrD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,QAAQ,EAA6B,CAAC,CAAC;IACpF,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE3D,IAAI,SAAoC,CAAC;IACzC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC;QACvD,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE;gBAC9B,MAAM,EAAE,MAAM;gBACd,sEAAsE;gBACtE,oEAAoE;gBACpE,wEAAwE;gBACxE,sCAAsC;gBACtC,QAAQ,EAAE,QAAQ;gBAClB,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,CAAC,gBAAgB,CAAC,EAAE,SAAS;iBAC9B;gBACD,IAAI,EAAE,OAAO;aACd,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,uCAAuC;YACvC,SAAS,GAAG,IAAI,aAAa,CAC3B,0CAA0C,MAAM,CAAC,GAAG,KAAM,GAAa,CAAC,OAAO,EAAE,CAClF,CAAC;YACF,IAAI,OAAO,GAAG,UAAU,EAAE,CAAC;gBACzB,MAAM,KAAK,CAAC,WAAW,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC;gBACxC,SAAS;YACX,CAAC;YACD,MAAM;QACR,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC7C,MAAM,IAAI,iBAAiB,CACzB,yDAAyD,GAAG,CAAC,MAAM,MAAM;gBACvE,gEAAgE,CACnE,CAAC;QACJ,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YAC5C,qEAAqE;YACrE,SAAS,GAAG,IAAI,aAAa,CAC3B,2CAA2C,GAAG,CAAC,MAAM,GAAG,EACxD,GAAG,CAAC,MAAM,CACX,CAAC;YACF,IAAI,OAAO,GAAG,UAAU,EAAE,CAAC;gBACzB,MAAM,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,WAAW,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC;gBAC7D,SAAS;YACX,CAAC;YACD,MAAM;QACR,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YAC1C,2EAA2E;YAC3E,yEAAyE;YACzE,wEAAwE;YACxE,sCAAsC;YACtC,MAAM,IAAI,aAAa,CACrB,qDAAqD,GAAG,CAAC,MAAM,IAAI,EACnE,GAAG,CAAC,MAAM,CACX,CAAC;QACJ,CAAC;QAED,uEAAuE;QACvE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,SAAS,IAAI,IAAI,aAAa,CAAC,gDAAgD,CAAC,CAAC;AACzF,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@momentiq/dark-factory-cli",
|
|
3
|
-
"version": "2.
|
|
3
|
+
"version": "2.13.0",
|
|
4
4
|
"description": "Dark Factory OSS CLI — multi-vendor adversarial critic orchestration (Cursor, Codex, Gemini, Grok) with min-complete-quorum aggregation and trusted-surface rebind",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"homepage": "https://momentiq.ai/dark-factory",
|
|
@@ -98,7 +98,7 @@
|
|
|
98
98
|
"@google/genai": "^2.2.0",
|
|
99
99
|
"@iarna/toml": "2.2.5",
|
|
100
100
|
"@modelcontextprotocol/sdk": "^1.29.0",
|
|
101
|
-
"@momentiq/dark-factory-schemas": "0.
|
|
101
|
+
"@momentiq/dark-factory-schemas": "0.12.0",
|
|
102
102
|
"@openai/codex-sdk": "^0.130.0",
|
|
103
103
|
"@yarnpkg/lockfile": "1.1.0",
|
|
104
104
|
"ajv": "^8.20.0",
|