@piagent/platform 1.6.1 → 1.8.0

package/schemas/scoped-project-verification-receipt-v2.schema.json

@@ -0,0 +1,83 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://piagent.io.vn/schemas/scoped-project-verification-receipt-v2.schema.json",
+  "title": "Piagent scoped project-verification signed envelope v2",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["receipt", "signature"],
+  "properties": {
+    "receipt": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["version", "kind", "protocol", "verificationId", "action", "attemptId", "broker", "manifestSha256", "capabilityDigest", "planDigest", "requestDigest", "sourceDigest", "environmentDigest", "verifierDigest", "worker", "status", "verdict", "cleanup", "evidence", "startedAtMs", "deadlineAtMs", "settledAtMs", "completionAllowed"],
+      "properties": {
+        "version": { "const": 2 },
+        "kind": { "const": "scoped-project-verification-receipt-v2" },
+        "protocol": { "const": "scoped-project-verifier-v1" },
+        "verificationId": { "$ref": "#/$defs/id" },
+        "action": { "type": "integer", "minimum": 1 },
+        "attemptId": { "$ref": "#/$defs/uuidV4" },
+        "broker": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["identitySha256", "sourceSha256"],
+          "properties": {
+            "identitySha256": { "$ref": "#/$defs/sha256" },
+            "sourceSha256": { "$ref": "#/$defs/sha256" }
+          }
+        },
+        "manifestSha256": { "$ref": "#/$defs/sha256" },
+        "capabilityDigest": { "$ref": "#/$defs/sha256" },
+        "planDigest": { "$ref": "#/$defs/sha256" },
+        "requestDigest": { "$ref": "#/$defs/sha256" },
+        "sourceDigest": { "$ref": "#/$defs/sha256" },
+        "environmentDigest": { "$ref": "#/$defs/sha256" },
+        "verifierDigest": { "$ref": "#/$defs/sha256" },
+        "worker": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["runId", "version"],
+          "properties": {
+            "runId": { "$ref": "#/$defs/uuidV4" },
+            "version": { "type": ["string", "null"], "enum": ["scoped-project-verifier-worker-v1", null] }
+          }
+        },
+        "status": { "enum": ["completed", "timeout", "cancelled", "error"] },
+        "verdict": { "enum": ["observation-recorded", "observation-unavailable"] },
+        "cleanup": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["confirmed"],
+          "properties": { "confirmed": { "type": "boolean" } }
+        },
+        "evidence": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["executionSha256", "observationSha256", "reason", "outcome", "failedCommands"],
+          "properties": {
+            "executionSha256": { "$ref": "#/$defs/sha256" },
+            "observationSha256": { "anyOf": [{ "$ref": "#/$defs/sha256" }, { "type": "null" }] },
+            "reason": { "type": ["string", "null"], "pattern": "^[a-z0-9-]{1,80}$" },
+            "outcome": { "type": ["string", "null"], "enum": ["passed", "failed", null] },
+            "failedCommands": {
+              "type": "array",
+              "maxItems": 4,
+              "uniqueItems": true,
+              "items": { "enum": ["type-check", "lint", "test", "test:e2e"] }
+            }
+          }
+        },
+        "startedAtMs": { "type": "integer", "minimum": 0 },
+        "deadlineAtMs": { "type": "integer", "minimum": 0 },
+        "settledAtMs": { "type": "integer", "minimum": 0 },
+        "completionAllowed": { "const": false }
+      }
+    },
+    "signature": { "type": "string", "minLength": 88, "maxLength": 88, "pattern": "^[A-Za-z0-9+/]{86}==$" }
+  },
+  "$defs": {
+    "sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+    "id": { "type": "string", "minLength": 1, "maxLength": 160, "pattern": "^[A-Za-z0-9_.:-]+$" },
+    "uuidV4": { "type": "string", "pattern": "^[a-f0-9]{8}-[a-f0-9]{4}-4[a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$" }
+  }
+}

package/schemas/scoped-project-verification-receipt-v3.schema.json

@@ -0,0 +1,295 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://piagent.io.vn/schemas/scoped-project-verification-receipt-v3.schema.json",
+  "title": "Piagent scoped configured-docs signed envelope v3",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "receipt",
+    "signature"
+  ],
+  "properties": {
+    "receipt": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "version",
+        "kind",
+        "protocol",
+        "verificationId",
+        "action",
+        "attemptId",
+        "broker",
+        "manifestSha256",
+        "capabilityDigest",
+        "planDigest",
+        "requestDigest",
+        "sourceDigest",
+        "environmentDigest",
+        "verifierDigest",
+        "worker",
+        "status",
+        "verdict",
+        "cleanup",
+        "evidence",
+        "startedAtMs",
+        "deadlineAtMs",
+        "settledAtMs",
+        "completionAllowed",
+        "scope"
+      ],
+      "properties": {
+        "version": {
+          "const": 3
+        },
+        "kind": {
+          "const": "scoped-project-verification-receipt-v3"
+        },
+        "protocol": {
+          "const": "scoped-project-verifier-v1"
+        },
+        "verificationId": {
+          "$ref": "#/$defs/id"
+        },
+        "action": {
+          "type": "integer",
+          "minimum": 1
+        },
+        "attemptId": {
+          "$ref": "#/$defs/uuidV4"
+        },
+        "broker": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "identitySha256",
+            "sourceSha256"
+          ],
+          "properties": {
+            "identitySha256": {
+              "$ref": "#/$defs/sha256"
+            },
+            "sourceSha256": {
+              "$ref": "#/$defs/sha256"
+            }
+          }
+        },
+        "manifestSha256": {
+          "$ref": "#/$defs/sha256"
+        },
+        "capabilityDigest": {
+          "$ref": "#/$defs/sha256"
+        },
+        "planDigest": {
+          "$ref": "#/$defs/sha256"
+        },
+        "requestDigest": {
+          "$ref": "#/$defs/sha256"
+        },
+        "sourceDigest": {
+          "$ref": "#/$defs/sha256"
+        },
+        "environmentDigest": {
+          "$ref": "#/$defs/sha256"
+        },
+        "verifierDigest": {
+          "$ref": "#/$defs/sha256"
+        },
+        "worker": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "runId",
+            "version"
+          ],
+          "properties": {
+            "runId": {
+              "$ref": "#/$defs/uuidV4"
+            },
+            "version": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "enum": [
+                "scoped-configured-docs-worker-v1",
+                null
+              ]
+            }
+          }
+        },
+        "status": {
+          "enum": [
+            "completed",
+            "timeout",
+            "cancelled",
+            "error"
+          ]
+        },
+        "verdict": {
+          "enum": [
+            "observation-recorded",
+            "observation-unavailable"
+          ]
+        },
+        "cleanup": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "confirmed"
+          ],
+          "properties": {
+            "confirmed": {
+              "type": "boolean"
+            }
+          }
+        },
+        "evidence": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "executionSha256",
+            "observationSha256",
+            "reason",
+            "outcome",
+            "failedCommands"
+          ],
+          "properties": {
+            "executionSha256": {
+              "$ref": "#/$defs/sha256"
+            },
+            "observationSha256": {
+              "anyOf": [
+                {
+                  "$ref": "#/$defs/sha256"
+                },
+                {
+                  "type": "null"
+                }
+              ]
+            },
+            "reason": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "pattern": "^[a-z0-9-]{1,80}$"
+            },
+            "outcome": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "enum": [
+                "passed",
+                "failed",
+                null
+              ]
+            },
+            "failedCommands": {
+              "type": "array",
+              "maxItems": 2,
+              "uniqueItems": true,
+              "items": {
+                "enum": [
+                  "git-diff-check",
+                  "conditional-project-test"
+                ]
+              }
+            }
+          }
+        },
+        "startedAtMs": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "deadlineAtMs": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "settledAtMs": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "completionAllowed": {
+          "const": false
+        },
+        "scope": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "kind",
+            "commands",
+            "frozenSourceDigest",
+            "files"
+          ],
+          "properties": {
+            "kind": {
+              "const": "configured-docs-current-v1"
+            },
+            "commands": {
+              "const": [
+                "git diff --check",
+                "if test -f package.json && node -e \"const s=require('./package.json').scripts||{}; process.exit(s.test?0:1)\"; then npm test; else test -s README.md || test -d docs; fi"
+              ]
+            },
+            "frozenSourceDigest": {
+              "$ref": "#/$defs/sha256"
+            },
+            "files": {
+              "type": "array",
+              "minItems": 1,
+              "maxItems": 8,
+              "items": {
+                "type": "object",
+                "additionalProperties": false,
+                "required": [
+                  "relativePath",
+                  "byteLength",
+                  "sha256"
+                ],
+                "properties": {
+                  "relativePath": {
+                    "type": "string",
+                    "maxLength": 1024,
+                    "pattern": "^docs/[A-Za-z0-9_./-]+\\.md$"
+                  },
+                  "byteLength": {
+                    "type": "integer",
+                    "minimum": 0,
+                    "maximum": 65536
+                  },
+                  "sha256": {
+                    "$ref": "#/$defs/sha256"
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "signature": {
+      "type": "string",
+      "minLength": 88,
+      "maxLength": 88,
+      "pattern": "^[A-Za-z0-9+/]{86}==$"
+    }
+  },
+  "$defs": {
+    "sha256": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{64}$"
+    },
+    "id": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 160,
+      "pattern": "^[A-Za-z0-9_.:-]+$"
+    },
+    "uuidV4": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{8}-[a-f0-9]{4}-4[a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$"
+    }
+  }
+}

package/schemas/scoped-verification-receipt-v1.schema.json

@@ -0,0 +1,76 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://piagent.io.vn/schemas/scoped-verification-receipt-v1.schema.json",
+  "title": "Piagent scoped verification signed envelope v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["receipt", "signature"],
+  "properties": {
+    "receipt": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["version", "kind", "protocol", "verificationId", "action", "attemptId", "broker", "manifestSha256", "capabilityDigest", "planDigest", "requestDigest", "sourceDigest", "imageId", "verifierDigest", "worker", "status", "verdict", "cleanup", "evidence", "startedAtMs", "deadlineAtMs", "settledAtMs", "completionAllowed"],
+      "properties": {
+        "version": { "const": 1 },
+        "kind": { "const": "scoped-verification-receipt-v1" },
+        "protocol": { "const": "scoped-isolated-contract-v1" },
+        "verificationId": { "$ref": "#/$defs/id" },
+        "action": { "type": "integer", "minimum": 1 },
+        "attemptId": { "$ref": "#/$defs/uuidV4" },
+        "broker": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["identitySha256", "sourceSha256"],
+          "properties": {
+            "identitySha256": { "$ref": "#/$defs/sha256" },
+            "sourceSha256": { "$ref": "#/$defs/sha256" }
+          }
+        },
+        "manifestSha256": { "$ref": "#/$defs/sha256" },
+        "capabilityDigest": { "$ref": "#/$defs/sha256" },
+        "planDigest": { "$ref": "#/$defs/sha256" },
+        "requestDigest": { "$ref": "#/$defs/sha256" },
+        "sourceDigest": { "$ref": "#/$defs/sha256" },
+        "imageId": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+        "verifierDigest": { "$ref": "#/$defs/sha256" },
+        "worker": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["runId", "version"],
+          "properties": {
+            "runId": { "$ref": "#/$defs/uuidV4" },
+            "version": { "type": ["string", "null"], "enum": ["quickjs-contract-worker-v9", null] }
+          }
+        },
+        "status": { "enum": ["completed", "timeout", "cancelled", "error"] },
+        "verdict": { "enum": ["observation-recorded", "observation-unavailable"] },
+        "cleanup": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["confirmed"],
+          "properties": { "confirmed": { "type": "boolean" } }
+        },
+        "evidence": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["executionSha256", "observationSha256", "reason"],
+          "properties": {
+            "executionSha256": { "$ref": "#/$defs/sha256" },
+            "observationSha256": { "anyOf": [{ "$ref": "#/$defs/sha256" }, { "type": "null" }] },
+            "reason": { "type": ["string", "null"], "pattern": "^[a-z0-9-]{1,80}$" }
+          }
+        },
+        "startedAtMs": { "type": "integer", "minimum": 0 },
+        "deadlineAtMs": { "type": "integer", "minimum": 0 },
+        "settledAtMs": { "type": "integer", "minimum": 0 },
+        "completionAllowed": { "const": false }
+      }
+    },
+    "signature": { "type": "string", "minLength": 88, "maxLength": 88, "pattern": "^[A-Za-z0-9+/]{86}==$" }
+  },
+  "$defs": {
+    "sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+    "id": { "type": "string", "minLength": 1, "maxLength": 160, "pattern": "^[A-Za-z0-9_.:-]+$" },
+    "uuidV4": { "type": "string", "pattern": "^[a-f0-9]{8}-[a-f0-9]{4}-4[a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$" }
+  }
+}

package/schemas/task-contract.schema.json

@@ -474,6 +474,7 @@
     "mutationPolicy": {
       "enum": [
         "required",
+        "allowed",
         "forbidden"
       ]
     },
@@ -819,6 +820,14 @@
           "workingTreeDigest": {
             "type": "string",
             "pattern": "^wt-content-v2:[a-f0-9]{64}$"
+          },
+          "preWorkspaceRevisionDigest": {
+            "type": "string",
+            "pattern": "^workspace-revision-v1:[a-f0-9]{64}$"
+          },
+          "workspaceRevisionDigest": {
+            "type": "string",
+            "pattern": "^workspace-revision-v1:[a-f0-9]{64}$"
           }
         },
         "additionalProperties": false
@@ -839,6 +848,11 @@
             "failed"
           ]
         },
+        "terminalDisposition": {
+          "enum": [
+            "refused"
+          ]
+        },
         "friction": {
           "type": "string"
         },
@@ -850,6 +864,22 @@
           "format": "date-time"
         }
       },
+      "allOf": [
+        {
+          "if": {
+            "required": [
+              "terminalDisposition"
+            ]
+          },
+          "then": {
+            "properties": {
+              "outcome": {
+                "const": "blocked"
+              }
+            }
+          }
+        }
+      ],
       "additionalProperties": false
     },
     "failedAt": {

package/scripts/approve-independent-verification.mjs

@@ -0,0 +1,57 @@
+#!/usr/bin/env node
+import fs from "node:fs";
+import path from "node:path";
+import { prepareHostContractApproval, validateHostContractPlan, writeHostContractApproval } from "../packages/piagent-core/extensions/acceptance-host-configuration.js";
+
+const help = `Usage: piagent approve-verification --project PATH --plan FILE --directory NEW_PRIVATE_PATH [--approve]
+
+Without --approve, validate and preview a host-owned verification plan only.
+With --approve, create a new private authority outside the project. Never overwrite it.
+No command here executes project code, starts a worker, or calls a model provider.
+
+Plan schema: schemas/host-contract-plan.schema.json (legacy 1/2 or Node-profile 3/4).
+Every request in a set is exact and independently reviewed; duplicate request
+digests are rejected. A set does not authorize unlisted requests or new oracles.
+The operator must review the expected results independently of the candidate.
+Enable the approved plan by setting PIAGENT_INDEPENDENT_VERIFICATION_CONFIG to
+the returned approval.json path before starting the Pi runtime.
+`;
+
+try {
+  const args = process.argv.slice(2);
+  if (args.length === 1 && ["--help", "-h"].includes(args[0])) { process.stdout.write(help); process.exit(0); }
+  const options = {}, seen = new Set();
+  for (let index = 0; index < args.length; index += 1) {
+    const flag = args[index];
+    if (!["--project", "--plan", "--directory", "--approve"].includes(flag) || seen.has(flag)) throw new Error("Unknown or repeated option");
+    seen.add(flag);
+    if (flag === "--approve") { options.approved = true; continue; }
+    const value = args[++index];
+    if (!value || value.startsWith("--")) throw new Error(`Missing value for ${flag}`);
+    options[flag.slice(2)] = value;
+  }
+  if (!options.project || !options.plan || !options.directory) throw new Error("--project, --plan and --directory are required");
+  const fd = fs.openSync(path.resolve(options.plan), fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+  let plan;
+  try {
+    const stat = fs.fstatSync(fd);
+    if (!stat.isFile() || stat.size < 1 || stat.size > 2 * 1024 * 1024) throw new Error("Invalid plan file size or type");
+    plan = JSON.parse(fs.readFileSync(fd, "utf8"));
+  } finally { fs.closeSync(fd); }
+  validateHostContractPlan(plan);
+  const projectRoot = fs.realpathSync.native(options.project), installedRoot = path.resolve(import.meta.dirname, "..");
+  const directory = path.resolve(options.directory), parent = fs.realpathSync.native(path.dirname(directory));
+  if (parent !== path.dirname(directory)) throw new Error("Authority parent must be canonical");
+  const relative = path.relative(projectRoot, directory);
+  if (!relative || (!relative.startsWith(`..${path.sep}`) && relative !== ".." && !path.isAbsolute(relative))) throw new Error("Authority must be outside the candidate project");
+  const request = { projectRoot, installedRoot, ...([2, 4].includes(plan.schemaVersion) ? { plans: plan.plans }
+    : { operatorRequestDigest: plan.operatorRequestDigest, backend: plan.backend, contracts: plan.contracts }) };
+  const preview = prepareHostContractApproval(request);
+  const result = options.approved
+    ? { status: "approved", ...writeHostContractApproval({ ...request, directory, approved: true }) }
+    : { status: "preview-only", directory, payload: preview };
+  process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+} catch (error) {
+  process.stderr.write(`Independent verification approval failed: ${error.message}\n`);
+  process.exitCode = 1;
+}