@osstack/protocol 0.13.0 → 0.20.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/generate.d.ts +1 -0
- package/dist/generate.d.ts.map +1 -1
- package/dist/generate.js +43 -1
- package/dist/generate.js.map +1 -1
- package/dist/graph-checkpoint.d.ts +409 -0
- package/dist/graph-checkpoint.d.ts.map +1 -0
- package/dist/graph-checkpoint.js +91 -0
- package/dist/graph-checkpoint.js.map +1 -0
- package/dist/graph-worker.d.ts +1663 -0
- package/dist/graph-worker.d.ts.map +1 -0
- package/dist/graph-worker.js +152 -0
- package/dist/graph-worker.js.map +1 -0
- package/dist/graph.d.ts +12875 -0
- package/dist/graph.d.ts.map +1 -0
- package/dist/graph.js +423 -0
- package/dist/graph.js.map +1 -0
- package/dist/index.d.ts +7 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +7 -2
- package/dist/index.js.map +1 -1
- package/dist/run.d.ts +2 -2
- package/dist/session-continuation-grant.d.ts +414 -0
- package/dist/session-continuation-grant.d.ts.map +1 -0
- package/dist/session-continuation-grant.js +59 -0
- package/dist/session-continuation-grant.js.map +1 -0
- package/dist/session-continuation.d.ts +129 -0
- package/dist/session-continuation.d.ts.map +1 -0
- package/dist/session-continuation.js +30 -0
- package/dist/session-continuation.js.map +1 -0
- package/dist/task.d.ts +2 -2
- package/package.json +2 -2
- package/schemas/continuation-grant-body.schema.json +189 -0
- package/schemas/continuation-output-check.schema.json +65 -0
- package/schemas/graph-checkpoint-request.schema.json +222 -0
- package/schemas/graph-checkpoint-response.schema.json +258 -0
- package/schemas/graph-worker.schema.json +546 -0
- package/schemas/graph.schema.json +1768 -0
- package/schemas/session-continuation-request.schema.json +62 -0
- package/schemas/session-decision.schema.json +107 -0
- package/schemas/signed-continuation-grant.schema.json +209 -0
- package/dist/autonomy.test.d.ts +0 -2
- package/dist/autonomy.test.d.ts.map +0 -1
- package/dist/autonomy.test.js +0 -201
- package/dist/autonomy.test.js.map +0 -1
- package/dist/protocol.test.d.ts +0 -2
- package/dist/protocol.test.d.ts.map +0 -1
- package/dist/protocol.test.js +0 -251
- package/dist/protocol.test.js.map +0 -1
- package/dist/schemas.test.d.ts +0 -2
- package/dist/schemas.test.d.ts.map +0 -1
- package/dist/schemas.test.js +0 -39
- package/dist/schemas.test.js.map +0 -1
|
@@ -0,0 +1,62 @@
|
|
|
1
|
+
{
|
|
2
|
+
"$schema": "http://json-schema.org/draft-07/schema#",
|
|
3
|
+
"title": "Osstack Session Continuation Request",
|
|
4
|
+
"$comment": "Agent-reported request only. Evidence references must be independently verified and this object never authorizes an action.",
|
|
5
|
+
"type": "object",
|
|
6
|
+
"properties": {
|
|
7
|
+
"version": {
|
|
8
|
+
"type": "number",
|
|
9
|
+
"const": 1
|
|
10
|
+
},
|
|
11
|
+
"gate_kind": {
|
|
12
|
+
"type": "string",
|
|
13
|
+
"enum": [
|
|
14
|
+
"phase_continue",
|
|
15
|
+
"task_authorization",
|
|
16
|
+
"risk_approval",
|
|
17
|
+
"external_input"
|
|
18
|
+
]
|
|
19
|
+
},
|
|
20
|
+
"phase": {
|
|
21
|
+
"type": "string",
|
|
22
|
+
"minLength": 1,
|
|
23
|
+
"maxLength": 256
|
|
24
|
+
},
|
|
25
|
+
"next_action": {
|
|
26
|
+
"type": "string",
|
|
27
|
+
"minLength": 1,
|
|
28
|
+
"maxLength": 1000
|
|
29
|
+
},
|
|
30
|
+
"evidence_refs": {
|
|
31
|
+
"type": "array",
|
|
32
|
+
"items": {
|
|
33
|
+
"type": "object",
|
|
34
|
+
"properties": {
|
|
35
|
+
"evidence_id": {
|
|
36
|
+
"type": "string",
|
|
37
|
+
"minLength": 1,
|
|
38
|
+
"maxLength": 256
|
|
39
|
+
},
|
|
40
|
+
"sha256": {
|
|
41
|
+
"type": "string",
|
|
42
|
+
"pattern": "^[a-f0-9]{64}$"
|
|
43
|
+
}
|
|
44
|
+
},
|
|
45
|
+
"required": [
|
|
46
|
+
"evidence_id",
|
|
47
|
+
"sha256"
|
|
48
|
+
],
|
|
49
|
+
"additionalProperties": false
|
|
50
|
+
},
|
|
51
|
+
"maxItems": 32
|
|
52
|
+
}
|
|
53
|
+
},
|
|
54
|
+
"required": [
|
|
55
|
+
"version",
|
|
56
|
+
"gate_kind",
|
|
57
|
+
"phase",
|
|
58
|
+
"next_action",
|
|
59
|
+
"evidence_refs"
|
|
60
|
+
],
|
|
61
|
+
"additionalProperties": false
|
|
62
|
+
}
|
|
@@ -0,0 +1,107 @@
|
|
|
1
|
+
{
|
|
2
|
+
"$schema": "http://json-schema.org/draft-07/schema#",
|
|
3
|
+
"title": "Osstack Session Decision Request",
|
|
4
|
+
"$comment": "Choice ID uniqueness is additionally enforced by Zod. The optional continuation is an untrusted request, not an approval.",
|
|
5
|
+
"type": "object",
|
|
6
|
+
"properties": {
|
|
7
|
+
"decision_id": {
|
|
8
|
+
"type": "string",
|
|
9
|
+
"minLength": 1,
|
|
10
|
+
"maxLength": 256
|
|
11
|
+
},
|
|
12
|
+
"question": {
|
|
13
|
+
"type": "string",
|
|
14
|
+
"minLength": 1,
|
|
15
|
+
"maxLength": 1000
|
|
16
|
+
},
|
|
17
|
+
"choices": {
|
|
18
|
+
"type": "array",
|
|
19
|
+
"items": {
|
|
20
|
+
"type": "object",
|
|
21
|
+
"properties": {
|
|
22
|
+
"choice_id": {
|
|
23
|
+
"type": "string",
|
|
24
|
+
"minLength": 1,
|
|
25
|
+
"maxLength": 256
|
|
26
|
+
},
|
|
27
|
+
"label": {
|
|
28
|
+
"type": "string",
|
|
29
|
+
"minLength": 1,
|
|
30
|
+
"maxLength": 160
|
|
31
|
+
}
|
|
32
|
+
},
|
|
33
|
+
"required": [
|
|
34
|
+
"choice_id",
|
|
35
|
+
"label"
|
|
36
|
+
],
|
|
37
|
+
"additionalProperties": false
|
|
38
|
+
},
|
|
39
|
+
"maxItems": 8
|
|
40
|
+
},
|
|
41
|
+
"continuation": {
|
|
42
|
+
"type": "object",
|
|
43
|
+
"properties": {
|
|
44
|
+
"version": {
|
|
45
|
+
"type": "number",
|
|
46
|
+
"const": 1
|
|
47
|
+
},
|
|
48
|
+
"gate_kind": {
|
|
49
|
+
"type": "string",
|
|
50
|
+
"enum": [
|
|
51
|
+
"phase_continue",
|
|
52
|
+
"task_authorization",
|
|
53
|
+
"risk_approval",
|
|
54
|
+
"external_input"
|
|
55
|
+
]
|
|
56
|
+
},
|
|
57
|
+
"phase": {
|
|
58
|
+
"type": "string",
|
|
59
|
+
"minLength": 1,
|
|
60
|
+
"maxLength": 256
|
|
61
|
+
},
|
|
62
|
+
"next_action": {
|
|
63
|
+
"type": "string",
|
|
64
|
+
"minLength": 1,
|
|
65
|
+
"maxLength": 1000
|
|
66
|
+
},
|
|
67
|
+
"evidence_refs": {
|
|
68
|
+
"type": "array",
|
|
69
|
+
"items": {
|
|
70
|
+
"type": "object",
|
|
71
|
+
"properties": {
|
|
72
|
+
"evidence_id": {
|
|
73
|
+
"type": "string",
|
|
74
|
+
"minLength": 1,
|
|
75
|
+
"maxLength": 256
|
|
76
|
+
},
|
|
77
|
+
"sha256": {
|
|
78
|
+
"type": "string",
|
|
79
|
+
"pattern": "^[a-f0-9]{64}$"
|
|
80
|
+
}
|
|
81
|
+
},
|
|
82
|
+
"required": [
|
|
83
|
+
"evidence_id",
|
|
84
|
+
"sha256"
|
|
85
|
+
],
|
|
86
|
+
"additionalProperties": false
|
|
87
|
+
},
|
|
88
|
+
"maxItems": 32
|
|
89
|
+
}
|
|
90
|
+
},
|
|
91
|
+
"required": [
|
|
92
|
+
"version",
|
|
93
|
+
"gate_kind",
|
|
94
|
+
"phase",
|
|
95
|
+
"next_action",
|
|
96
|
+
"evidence_refs"
|
|
97
|
+
],
|
|
98
|
+
"additionalProperties": false
|
|
99
|
+
}
|
|
100
|
+
},
|
|
101
|
+
"required": [
|
|
102
|
+
"decision_id",
|
|
103
|
+
"question",
|
|
104
|
+
"choices"
|
|
105
|
+
],
|
|
106
|
+
"additionalProperties": false
|
|
107
|
+
}
|
|
@@ -0,0 +1,209 @@
|
|
|
1
|
+
{
|
|
2
|
+
"$schema": "http://json-schema.org/draft-07/schema#",
|
|
3
|
+
"title": "Osstack Signed Session Continuation Grant",
|
|
4
|
+
"$comment": "Ed25519 signs UTF-8 canonical JSON of the strictly parsed body (defaults included, object keys sorted, array order preserved). Zod additionally rejects NUL in repo_path and whitespace-only instructions without rewriting their contents. Signature and trusted-key verification are required at runtime. This grant carries no R3 or GitHub approval authority.",
|
|
5
|
+
"type": "object",
|
|
6
|
+
"properties": {
|
|
7
|
+
"body": {
|
|
8
|
+
"type": "object",
|
|
9
|
+
"properties": {
|
|
10
|
+
"version": {
|
|
11
|
+
"type": "number",
|
|
12
|
+
"const": 1
|
|
13
|
+
},
|
|
14
|
+
"grant_id": {
|
|
15
|
+
"type": "string",
|
|
16
|
+
"minLength": 1,
|
|
17
|
+
"maxLength": 256
|
|
18
|
+
},
|
|
19
|
+
"session_id": {
|
|
20
|
+
"type": "string",
|
|
21
|
+
"minLength": 1,
|
|
22
|
+
"maxLength": 256
|
|
23
|
+
},
|
|
24
|
+
"runtime_id": {
|
|
25
|
+
"type": "string",
|
|
26
|
+
"minLength": 1,
|
|
27
|
+
"maxLength": 256
|
|
28
|
+
},
|
|
29
|
+
"runtime_policy_sha256": {
|
|
30
|
+
"type": "string",
|
|
31
|
+
"pattern": "^[a-f0-9]{64}$"
|
|
32
|
+
},
|
|
33
|
+
"repo_path": {
|
|
34
|
+
"type": "string",
|
|
35
|
+
"maxLength": 4096,
|
|
36
|
+
"pattern": "^(?:\\/|[A-Za-z]:[\\\\/]|\\\\\\\\[^\\\\/]+[\\\\/][^\\\\/]+(?:[\\\\/]|$))"
|
|
37
|
+
},
|
|
38
|
+
"initial_turn_id": {
|
|
39
|
+
"type": "string",
|
|
40
|
+
"minLength": 1,
|
|
41
|
+
"maxLength": 256
|
|
42
|
+
},
|
|
43
|
+
"initial_version": {
|
|
44
|
+
"type": "integer",
|
|
45
|
+
"minimum": 1
|
|
46
|
+
},
|
|
47
|
+
"issued_at": {
|
|
48
|
+
"type": "string",
|
|
49
|
+
"format": "date-time"
|
|
50
|
+
},
|
|
51
|
+
"expires_at": {
|
|
52
|
+
"type": "string",
|
|
53
|
+
"format": "date-time"
|
|
54
|
+
},
|
|
55
|
+
"max_resumes": {
|
|
56
|
+
"type": "integer",
|
|
57
|
+
"minimum": 1,
|
|
58
|
+
"maximum": 32
|
|
59
|
+
},
|
|
60
|
+
"max_checks": {
|
|
61
|
+
"type": "integer",
|
|
62
|
+
"minimum": 1,
|
|
63
|
+
"maximum": 64
|
|
64
|
+
},
|
|
65
|
+
"turn_timeout_ms": {
|
|
66
|
+
"type": "integer",
|
|
67
|
+
"minimum": 100,
|
|
68
|
+
"maximum": 300000
|
|
69
|
+
},
|
|
70
|
+
"steps": {
|
|
71
|
+
"type": "array",
|
|
72
|
+
"items": {
|
|
73
|
+
"type": "object",
|
|
74
|
+
"properties": {
|
|
75
|
+
"phase": {
|
|
76
|
+
"type": "string",
|
|
77
|
+
"minLength": 1,
|
|
78
|
+
"maxLength": 256
|
|
79
|
+
},
|
|
80
|
+
"instruction": {
|
|
81
|
+
"type": "string",
|
|
82
|
+
"minLength": 1,
|
|
83
|
+
"maxLength": 16000
|
|
84
|
+
},
|
|
85
|
+
"checks": {
|
|
86
|
+
"type": "array",
|
|
87
|
+
"items": {
|
|
88
|
+
"anyOf": [
|
|
89
|
+
{
|
|
90
|
+
"type": "object",
|
|
91
|
+
"properties": {
|
|
92
|
+
"kind": {
|
|
93
|
+
"type": "string",
|
|
94
|
+
"const": "text_equals"
|
|
95
|
+
},
|
|
96
|
+
"expected": {
|
|
97
|
+
"type": "string",
|
|
98
|
+
"maxLength": 4000
|
|
99
|
+
}
|
|
100
|
+
},
|
|
101
|
+
"required": [
|
|
102
|
+
"kind",
|
|
103
|
+
"expected"
|
|
104
|
+
],
|
|
105
|
+
"additionalProperties": false
|
|
106
|
+
},
|
|
107
|
+
{
|
|
108
|
+
"type": "object",
|
|
109
|
+
"properties": {
|
|
110
|
+
"kind": {
|
|
111
|
+
"type": "string",
|
|
112
|
+
"const": "json_value_equals"
|
|
113
|
+
},
|
|
114
|
+
"path": {
|
|
115
|
+
"type": "array",
|
|
116
|
+
"items": {
|
|
117
|
+
"type": "string",
|
|
118
|
+
"maxLength": 256
|
|
119
|
+
},
|
|
120
|
+
"maxItems": 8
|
|
121
|
+
},
|
|
122
|
+
"expected": {
|
|
123
|
+
"anyOf": [
|
|
124
|
+
{
|
|
125
|
+
"type": "null"
|
|
126
|
+
},
|
|
127
|
+
{
|
|
128
|
+
"type": "string",
|
|
129
|
+
"maxLength": 4000
|
|
130
|
+
},
|
|
131
|
+
{
|
|
132
|
+
"type": "number"
|
|
133
|
+
},
|
|
134
|
+
{
|
|
135
|
+
"type": "boolean"
|
|
136
|
+
}
|
|
137
|
+
]
|
|
138
|
+
}
|
|
139
|
+
},
|
|
140
|
+
"required": [
|
|
141
|
+
"kind",
|
|
142
|
+
"path",
|
|
143
|
+
"expected"
|
|
144
|
+
],
|
|
145
|
+
"additionalProperties": false
|
|
146
|
+
}
|
|
147
|
+
]
|
|
148
|
+
},
|
|
149
|
+
"minItems": 1,
|
|
150
|
+
"maxItems": 16
|
|
151
|
+
},
|
|
152
|
+
"retry_instruction": {
|
|
153
|
+
"type": "string",
|
|
154
|
+
"minLength": 1,
|
|
155
|
+
"maxLength": 16000
|
|
156
|
+
},
|
|
157
|
+
"max_retries": {
|
|
158
|
+
"type": "integer",
|
|
159
|
+
"minimum": 0,
|
|
160
|
+
"maximum": 3,
|
|
161
|
+
"default": 0
|
|
162
|
+
}
|
|
163
|
+
},
|
|
164
|
+
"required": [
|
|
165
|
+
"phase",
|
|
166
|
+
"instruction",
|
|
167
|
+
"checks"
|
|
168
|
+
],
|
|
169
|
+
"additionalProperties": false
|
|
170
|
+
},
|
|
171
|
+
"minItems": 1,
|
|
172
|
+
"maxItems": 16
|
|
173
|
+
}
|
|
174
|
+
},
|
|
175
|
+
"required": [
|
|
176
|
+
"version",
|
|
177
|
+
"grant_id",
|
|
178
|
+
"session_id",
|
|
179
|
+
"runtime_id",
|
|
180
|
+
"runtime_policy_sha256",
|
|
181
|
+
"repo_path",
|
|
182
|
+
"initial_turn_id",
|
|
183
|
+
"initial_version",
|
|
184
|
+
"issued_at",
|
|
185
|
+
"expires_at",
|
|
186
|
+
"max_resumes",
|
|
187
|
+
"max_checks",
|
|
188
|
+
"turn_timeout_ms",
|
|
189
|
+
"steps"
|
|
190
|
+
],
|
|
191
|
+
"additionalProperties": false
|
|
192
|
+
},
|
|
193
|
+
"key_id": {
|
|
194
|
+
"type": "string",
|
|
195
|
+
"minLength": 1,
|
|
196
|
+
"maxLength": 256
|
|
197
|
+
},
|
|
198
|
+
"signature": {
|
|
199
|
+
"type": "string",
|
|
200
|
+
"pattern": "^[A-Za-z0-9+/]{85}[AQgw]==$"
|
|
201
|
+
}
|
|
202
|
+
},
|
|
203
|
+
"required": [
|
|
204
|
+
"body",
|
|
205
|
+
"key_id",
|
|
206
|
+
"signature"
|
|
207
|
+
],
|
|
208
|
+
"additionalProperties": false
|
|
209
|
+
}
|
package/dist/autonomy.test.d.ts
DELETED
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"autonomy.test.d.ts","sourceRoot":"","sources":["../src/autonomy.test.ts"],"names":[],"mappings":""}
|
package/dist/autonomy.test.js
DELETED
|
@@ -1,201 +0,0 @@
|
|
|
1
|
-
import { describe, expect, it } from "vitest";
|
|
2
|
-
import { AUTONOMY_EMPTY_DIFF_SHA256, AutonomyRiskDecision, AutonomyRiskLevel, AutonomyRunState, parseInboundScopedApprovalDecision, ScopedApprovalDecision, ScopedApprovalRequest, validateScopedApprovalDecisionForRequest, } from "./autonomy.js";
|
|
3
|
-
const SHA_A = "a".repeat(64);
|
|
4
|
-
const SHA_B = "b".repeat(64);
|
|
5
|
-
const SHA_C = "c".repeat(64);
|
|
6
|
-
const SIGNATURE = "A".repeat(86);
|
|
7
|
-
function approvalRequest() {
|
|
8
|
-
return {
|
|
9
|
-
approval_id: "approval-1",
|
|
10
|
-
autonomy_run_id: "run-1",
|
|
11
|
-
phase: "post_diff",
|
|
12
|
-
contract_sha256: SHA_A,
|
|
13
|
-
diff_sha256: SHA_B,
|
|
14
|
-
action_scope: ["commit", "open_pr", "push"],
|
|
15
|
-
risk: "R3",
|
|
16
|
-
nonce: "nonce-1",
|
|
17
|
-
requested_at: "2026-07-28T20:00:00.000Z",
|
|
18
|
-
expires_at: "2026-07-28T20:15:00.000Z",
|
|
19
|
-
request_sha256: SHA_C,
|
|
20
|
-
};
|
|
21
|
-
}
|
|
22
|
-
function approvalDecision() {
|
|
23
|
-
return {
|
|
24
|
-
payload: {
|
|
25
|
-
approval_id: "approval-1",
|
|
26
|
-
request_sha256: SHA_C,
|
|
27
|
-
autonomy_run_id: "run-1",
|
|
28
|
-
phase: "post_diff",
|
|
29
|
-
contract_sha256: SHA_A,
|
|
30
|
-
diff_sha256: SHA_B,
|
|
31
|
-
action_scope: ["commit", "open_pr", "push"],
|
|
32
|
-
decision: "approve",
|
|
33
|
-
nonce: "nonce-1",
|
|
34
|
-
issued_at: "2026-07-28T20:01:00.000Z",
|
|
35
|
-
expires_at: "2026-07-28T20:15:00.000Z",
|
|
36
|
-
decided_by: { type: "human", id: "owner" },
|
|
37
|
-
},
|
|
38
|
-
signature: {
|
|
39
|
-
algorithm: "Ed25519",
|
|
40
|
-
key_id: "owner-primary",
|
|
41
|
-
value_base64url: SIGNATURE,
|
|
42
|
-
},
|
|
43
|
-
};
|
|
44
|
-
}
|
|
45
|
-
describe("guarded autonomy protocol contracts", () => {
|
|
46
|
-
it("parses every RISK-R0 through RISK-R4 level and rejects unknown levels", () => {
|
|
47
|
-
for (const level of ["R0", "R1", "R2", "R3", "R4"]) {
|
|
48
|
-
expect(AutonomyRiskLevel.parse(level)).toBe(level);
|
|
49
|
-
}
|
|
50
|
-
expect(AutonomyRiskLevel.safeParse("R5").success).toBe(false);
|
|
51
|
-
});
|
|
52
|
-
it("accepts the complete legal autonomy state set", () => {
|
|
53
|
-
const states = [
|
|
54
|
-
"queued",
|
|
55
|
-
"classifying",
|
|
56
|
-
"awaiting_approval",
|
|
57
|
-
"blocked",
|
|
58
|
-
"preparing",
|
|
59
|
-
"building",
|
|
60
|
-
"verifying",
|
|
61
|
-
"repairing",
|
|
62
|
-
"reviewing",
|
|
63
|
-
"post_classifying",
|
|
64
|
-
"candidate_proof",
|
|
65
|
-
"committing",
|
|
66
|
-
"pushing",
|
|
67
|
-
"opening_pr",
|
|
68
|
-
"waiting_ci",
|
|
69
|
-
"merging",
|
|
70
|
-
"deploying_staging",
|
|
71
|
-
"verifying_staging",
|
|
72
|
-
"deploying_production",
|
|
73
|
-
"health_checking",
|
|
74
|
-
"rolling_back",
|
|
75
|
-
"deploy_frozen",
|
|
76
|
-
"final_proof",
|
|
77
|
-
"blocked_delivery",
|
|
78
|
-
"delivery_evidence_failed",
|
|
79
|
-
"escalated",
|
|
80
|
-
"cancelled",
|
|
81
|
-
"completed",
|
|
82
|
-
];
|
|
83
|
-
for (const state of states) {
|
|
84
|
-
expect(AutonomyRunState.parse(state)).toBe(state);
|
|
85
|
-
}
|
|
86
|
-
expect(AutonomyRunState.safeParse("approved").success).toBe(false);
|
|
87
|
-
});
|
|
88
|
-
it("requires canonical deterministic risk signals and matching maximum level", () => {
|
|
89
|
-
const decision = {
|
|
90
|
-
phase: "post_diff",
|
|
91
|
-
level: "R3",
|
|
92
|
-
signals: [
|
|
93
|
-
{
|
|
94
|
-
rule_id: "protected-auth",
|
|
95
|
-
level: "R3",
|
|
96
|
-
message: "authentication surface changed",
|
|
97
|
-
path: "src/auth/session.ts",
|
|
98
|
-
},
|
|
99
|
-
],
|
|
100
|
-
policy_sha256: SHA_A,
|
|
101
|
-
input_sha256: SHA_B,
|
|
102
|
-
decided_at: "2026-07-28T20:00:00.000Z",
|
|
103
|
-
};
|
|
104
|
-
expect(AutonomyRiskDecision.parse(decision)).toEqual(decision);
|
|
105
|
-
expect(AutonomyRiskDecision.safeParse({ ...decision, level: "R2" }).success).toBe(false);
|
|
106
|
-
expect(AutonomyRiskDecision.safeParse({
|
|
107
|
-
...decision,
|
|
108
|
-
signals: [
|
|
109
|
-
{ ...decision.signals[0], rule_id: "z-rule" },
|
|
110
|
-
{ ...decision.signals[0], rule_id: "a-rule" },
|
|
111
|
-
],
|
|
112
|
-
}).success).toBe(false);
|
|
113
|
-
});
|
|
114
|
-
it("supports preflight approval only against the empty-diff sentinel", () => {
|
|
115
|
-
const request = {
|
|
116
|
-
...approvalRequest(),
|
|
117
|
-
phase: "preflight",
|
|
118
|
-
diff_sha256: AUTONOMY_EMPTY_DIFF_SHA256,
|
|
119
|
-
action_scope: ["build", "verify"],
|
|
120
|
-
};
|
|
121
|
-
expect(ScopedApprovalRequest.parse(request)).toEqual(request);
|
|
122
|
-
expect(ScopedApprovalRequest.safeParse({ ...request, diff_sha256: SHA_B }).success).toBe(false);
|
|
123
|
-
});
|
|
124
|
-
it("accepts a signed post-diff RISK-R3 decision bound to request material", () => {
|
|
125
|
-
const request = ScopedApprovalRequest.parse(approvalRequest());
|
|
126
|
-
const decision = ScopedApprovalDecision.parse(approvalDecision());
|
|
127
|
-
expect(validateScopedApprovalDecisionForRequest(request, decision)).toEqual(decision);
|
|
128
|
-
});
|
|
129
|
-
it("rejects an agent actor even when the signed envelope is otherwise shaped correctly", () => {
|
|
130
|
-
const decision = approvalDecision();
|
|
131
|
-
expect(ScopedApprovalDecision.safeParse({
|
|
132
|
-
...decision,
|
|
133
|
-
payload: {
|
|
134
|
-
...decision.payload,
|
|
135
|
-
decided_by: { type: "agent", id: "builder" },
|
|
136
|
-
},
|
|
137
|
-
}).success).toBe(false);
|
|
138
|
-
});
|
|
139
|
-
it("rejects decisions whose contract or staged diff digest does not match the request", () => {
|
|
140
|
-
const request = ScopedApprovalRequest.parse(approvalRequest());
|
|
141
|
-
expect(() => validateScopedApprovalDecisionForRequest(request, {
|
|
142
|
-
...approvalDecision(),
|
|
143
|
-
payload: { ...approvalDecision().payload, contract_sha256: "d".repeat(64) },
|
|
144
|
-
})).toThrow(/contract_sha256/);
|
|
145
|
-
expect(() => validateScopedApprovalDecisionForRequest(request, {
|
|
146
|
-
...approvalDecision(),
|
|
147
|
-
payload: { ...approvalDecision().payload, diff_sha256: "e".repeat(64) },
|
|
148
|
-
})).toThrow(/diff_sha256/);
|
|
149
|
-
});
|
|
150
|
-
it("rejects a signed decision issued before its bound request", () => {
|
|
151
|
-
const request = ScopedApprovalRequest.parse(approvalRequest());
|
|
152
|
-
expect(() => validateScopedApprovalDecisionForRequest(request, {
|
|
153
|
-
...approvalDecision(),
|
|
154
|
-
payload: {
|
|
155
|
-
...approvalDecision().payload,
|
|
156
|
-
issued_at: "2026-07-28T19:59:59.000Z",
|
|
157
|
-
},
|
|
158
|
-
})).toThrow(/issued_at/);
|
|
159
|
-
});
|
|
160
|
-
it("has no RISK-R4 approval request contract", () => {
|
|
161
|
-
expect(ScopedApprovalRequest.safeParse({ ...approvalRequest(), risk: "R4" }).success).toBe(false);
|
|
162
|
-
});
|
|
163
|
-
it("keeps producers deep-strict while inbound consumers tolerate additive fields", () => {
|
|
164
|
-
const decision = {
|
|
165
|
-
...approvalDecision(),
|
|
166
|
-
future_top_level: true,
|
|
167
|
-
payload: {
|
|
168
|
-
...approvalDecision().payload,
|
|
169
|
-
future_payload_field: "vNext",
|
|
170
|
-
decided_by: {
|
|
171
|
-
...approvalDecision().payload.decided_by,
|
|
172
|
-
display_name: "Owner",
|
|
173
|
-
},
|
|
174
|
-
},
|
|
175
|
-
signature: {
|
|
176
|
-
...approvalDecision().signature,
|
|
177
|
-
future_signature_field: "vNext",
|
|
178
|
-
},
|
|
179
|
-
};
|
|
180
|
-
expect(ScopedApprovalDecision.safeParse(decision).success).toBe(false);
|
|
181
|
-
expect(() => parseInboundScopedApprovalDecision(decision)).not.toThrow();
|
|
182
|
-
});
|
|
183
|
-
it("rejects non-canonical or replay-ambiguous scope and invalid validity windows", () => {
|
|
184
|
-
expect(ScopedApprovalRequest.safeParse({
|
|
185
|
-
...approvalRequest(),
|
|
186
|
-
action_scope: ["push", "commit"],
|
|
187
|
-
}).success).toBe(false);
|
|
188
|
-
expect(ScopedApprovalRequest.safeParse({
|
|
189
|
-
...approvalRequest(),
|
|
190
|
-
action_scope: ["commit", "commit"],
|
|
191
|
-
}).success).toBe(false);
|
|
192
|
-
expect(ScopedApprovalDecision.safeParse({
|
|
193
|
-
...approvalDecision(),
|
|
194
|
-
payload: {
|
|
195
|
-
...approvalDecision().payload,
|
|
196
|
-
issued_at: "2026-07-28T20:16:00.000Z",
|
|
197
|
-
},
|
|
198
|
-
}).success).toBe(false);
|
|
199
|
-
});
|
|
200
|
-
});
|
|
201
|
-
//# sourceMappingURL=autonomy.test.js.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"autonomy.test.js","sourceRoot":"","sources":["../src/autonomy.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,kCAAkC,EAClC,sBAAsB,EACtB,qBAAqB,EACrB,wCAAwC,GACzC,MAAM,eAAe,CAAC;AAEvB,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAC7B,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAC7B,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAC7B,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAEjC,SAAS,eAAe;IACtB,OAAO;QACL,WAAW,EAAE,YAAY;QACzB,eAAe,EAAE,OAAO;QACxB,KAAK,EAAE,WAAW;QAClB,eAAe,EAAE,KAAK;QACtB,WAAW,EAAE,KAAK;QAClB,YAAY,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC;QAC3C,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,SAAS;QAChB,YAAY,EAAE,0BAA0B;QACxC,UAAU,EAAE,0BAA0B;QACtC,cAAc,EAAE,KAAK;KACb,CAAC;AACb,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO;QACL,OAAO,EAAE;YACP,WAAW,EAAE,YAAY;YACzB,cAAc,EAAE,KAAK;YACrB,eAAe,EAAE,OAAO;YACxB,KAAK,EAAE,WAAW;YAClB,eAAe,EAAE,KAAK;YACtB,WAAW,EAAE,KAAK;YAClB,YAAY,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC;YAC3C,QAAQ,EAAE,SAAS;YACnB,KAAK,EAAE,SAAS;YAChB,SAAS,EAAE,0BAA0B;YACrC,UAAU,EAAE,0BAA0B;YACtC,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE;SAC3C;QACD,SAAS,EAAE;YACT,SAAS,EAAE,SAAS;YACpB,MAAM,EAAE,eAAe;YACvB,eAAe,EAAE,SAAS;SAC3B;KACO,CAAC;AACb,CAAC;AAED,QAAQ,CAAC,qCAAqC,EAAE,GAAG,EAAE;IACnD,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;QAC/E,KAAK,MAAM,KAAK,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YACnD,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,MAAM,GAAG;YACb,QAAQ;YACR,aAAa;YACb,mBAAmB;YACnB,SAAS;YACT,WAAW;YACX,UAAU;YACV,WAAW;YACX,WAAW;YACX,WAAW;YACX,kBAAkB;YAClB,iBAAiB;YACjB,YAAY;YACZ,SAAS;YACT,YAAY;YACZ,YAAY;YACZ,SAAS;YACT,mBAAmB;YACnB,mBAAmB;YACnB,sBAAsB;YACtB,iBAAiB;YACjB,cAAc;YACd,eAAe;YACf,aAAa;YACb,kBAAkB;YAClB,0BAA0B;YAC1B,WAAW;YACX,WAAW;YACX,WAAW;SACZ,CAAC;QAEF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,MAAM,QAAQ,GAAG;YACf,KAAK,EAAE,WAAW;YAClB,KAAK,EAAE,IAAI;YACX,OAAO,EAAE;gBACP;oBACE,OAAO,EAAE,gBAAgB;oBACzB,KAAK,EAAE,IAAI;oBACX,OAAO,EAAE,gCAAgC;oBACzC,IAAI,EAAE,qBAAqB;iBAC5B;aACF;YACD,aAAa,EAAE,KAAK;YACpB,YAAY,EAAE,KAAK;YACnB,UAAU,EAAE,0BAA0B;SACvC,CAAC;QAEF,MAAM,CAAC,oBAAoB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC/D,MAAM,CAAC,oBAAoB,CAAC,SAAS,CAAC,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzF,MAAM,CACJ,oBAAoB,CAAC,SAAS,CAAC;YAC7B,GAAG,QAAQ;YACX,OAAO,EAAE;gBACP,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE;gBAC7C,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE;aAC9C;SACF,CAAC,CAAC,OAAO,CACX,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,OAAO,GAAG;YACd,GAAG,eAAe,EAAE;YACpB,KAAK,EAAE,WAAW;YAClB,WAAW,EAAE,0BAA0B;YACvC,YAAY,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC;SAClC,CAAC;QAEF,MAAM,CAAC,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9D,MAAM,CACJ,qBAAqB,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,CAC5E,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;QAC/E,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,sBAAsB,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAElE,MAAM,CAAC,wCAAwC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oFAAoF,EAAE,GAAG,EAAE;QAC5F,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;QACpC,MAAM,CACJ,sBAAsB,CAAC,SAAS,CAAC;YAC/B,GAAG,QAAQ;YACX,OAAO,EAAE;gBACP,GAAG,QAAQ,CAAC,OAAO;gBACnB,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE;aAC7C;SACF,CAAC,CAAC,OAAO,CACX,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mFAAmF,EAAE,GAAG,EAAE;QAC3F,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC;QAE/D,MAAM,CAAC,GAAG,EAAE,CACV,wCAAwC,CAAC,OAAO,EAAE;YAChD,GAAG,gBAAgB,EAAE;YACrB,OAAO,EAAE,EAAE,GAAG,gBAAgB,EAAE,CAAC,OAAO,EAAE,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE;SAC5E,CAAC,CACH,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAE7B,MAAM,CAAC,GAAG,EAAE,CACV,wCAAwC,CAAC,OAAO,EAAE;YAChD,GAAG,gBAAgB,EAAE;YACrB,OAAO,EAAE,EAAE,GAAG,gBAAgB,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE;SACxE,CAAC,CACH,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC;QAC/D,MAAM,CAAC,GAAG,EAAE,CACV,wCAAwC,CAAC,OAAO,EAAE;YAChD,GAAG,gBAAgB,EAAE;YACrB,OAAO,EAAE;gBACP,GAAG,gBAAgB,EAAE,CAAC,OAAO;gBAC7B,SAAS,EAAE,0BAA0B;aACtC;SACF,CAAC,CACH,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,CACJ,qBAAqB,CAAC,SAAS,CAAC,EAAE,GAAG,eAAe,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAC9E,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8EAA8E,EAAE,GAAG,EAAE;QACtF,MAAM,QAAQ,GAAG;YACf,GAAG,gBAAgB,EAAE;YACrB,gBAAgB,EAAE,IAAI;YACtB,OAAO,EAAE;gBACP,GAAG,gBAAgB,EAAE,CAAC,OAAO;gBAC7B,oBAAoB,EAAE,OAAO;gBAC7B,UAAU,EAAE;oBACV,GAAG,gBAAgB,EAAE,CAAC,OAAO,CAAC,UAAU;oBACxC,YAAY,EAAE,OAAO;iBACtB;aACF;YACD,SAAS,EAAE;gBACT,GAAG,gBAAgB,EAAE,CAAC,SAAS;gBAC/B,sBAAsB,EAAE,OAAO;aAChC;SACF,CAAC;QAEF,MAAM,CAAC,sBAAsB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,CAAC,GAAG,EAAE,CAAC,kCAAkC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8EAA8E,EAAE,GAAG,EAAE;QACtF,MAAM,CACJ,qBAAqB,CAAC,SAAS,CAAC;YAC9B,GAAG,eAAe,EAAE;YACpB,YAAY,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;SACjC,CAAC,CAAC,OAAO,CACX,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,MAAM,CACJ,qBAAqB,CAAC,SAAS,CAAC;YAC9B,GAAG,eAAe,EAAE;YACpB,YAAY,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;SACnC,CAAC,CAAC,OAAO,CACX,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,MAAM,CACJ,sBAAsB,CAAC,SAAS,CAAC;YAC/B,GAAG,gBAAgB,EAAE;YACrB,OAAO,EAAE;gBACP,GAAG,gBAAgB,EAAE,CAAC,OAAO;gBAC7B,SAAS,EAAE,0BAA0B;aACtC;SACF,CAAC,CAAC,OAAO,CACX,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
|
package/dist/protocol.test.d.ts
DELETED
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"protocol.test.d.ts","sourceRoot":"","sources":["../src/protocol.test.ts"],"names":[],"mappings":""}
|