@rpamis/comet 0.4.0-beta.10 → 0.4.0-beta.11

package/eval/local/tasks/comet-native-workflow/validation/test_native_workflow.py

@@ -310,7 +310,7 @@ def _validate_v2_verification(archived: Path, state: dict, evidence_ref: str):
         raise ValueError("Verification evidence file is missing or unsafe")
     evidence = json.loads(evidence_file.read_text(encoding="utf-8"))
     if (
-        state.get("verification_protocol") != "signed-v2"
+        state.get("verification_protocol") != "legacy-v1"
         or evidence.get("schema") != "comet.native.verification-evidence.v2"
         or evidence.get("envelopeHash") != evidence_match.group(1)
         or _content_hash(
@@ -319,7 +319,7 @@ def _validate_v2_verification(archived: Path, state: dict, evidence_ref: str):
         != evidence.get("envelopeHash")
         or evidence.get("result") != "pass"
     ):
-        raise ValueError("Archive does not contain passing signed-v2 verification evidence")
+        raise ValueError("Archive does not contain passing v2 verification evidence")
 
     trace = evidence.get("acceptanceTrace")
     entries = trace.get("entries") if isinstance(trace, dict) else None

package/eval/local/tests/conftest.py

@@ -490,7 +490,7 @@ def _copy_trusted_native_review_fixture(
     environment_dir: Path,
     test_dir: Path,
 ) -> None:
-    """Provision controller-owned signed-v2 trust without exposing a controller private key."""
+    """Provision external review trust without exposing private keys."""
     marker = environment_dir / TRUSTED_NATIVE_REVIEW_FIXTURE_MARKER
     if not marker.is_file():
         return
@@ -563,35 +563,15 @@ const policy={
   controllerSignature:proof(controller,policyHash)
 };
 const projectRootHash=hash('comet.native.controller-project-root.v1','/workspace');
-const authorizationContent={
-  schema:'comet.native.creation-authorization.v1',
-  controllerKeyId:controller.identity.keyId,
-  projectRootHash,
-  policyHash,
-  protocol:'signed-v2',
-  change,
-  issuedAt:'2026-07-28T00:00:00.000Z'
-};
-const authorizationHash=hash(
-  'comet.native.creation-authorization.v1',
-  authorizationContent
-);
-const authorization={
-  ...authorizationContent,
-  authorizationHash,
-  controllerSignature:proof(controller,authorizationHash)
-};
 const store={
   schema:'comet.native.controller-trust-store.v1',
   projects:[{
     projectRootHash,
     controllerIdentity:controller.identity,
-    legacyChanges:[]
   }]
 };
 process.stdout.write(JSON.stringify({
   policy,
-  authorization,
   store,
   identities:{
     implementation:implementation.identity,
@@ -625,10 +605,6 @@ process.stdout.write(JSON.stringify({
     project_policy = test_dir / ".comet" / "native-review-trust.json"
     project_policy.parent.mkdir(parents=True, exist_ok=True)
     shutil.copyfile(policy_file, project_policy)
-    authorization_name = f"{change}-creation-authorization.json"
-    (oracle_root / authorization_name).write_text(
-        json.dumps(fixture["authorization"], indent=2) + "\n", encoding="utf-8"
-    )
     for role, identity in fixture["identities"].items():
         (oracle_root / f"{role}-identity.json").write_text(
             json.dumps(identity, indent=2) + "\n", encoding="utf-8"
@@ -688,7 +664,6 @@ process.stdout.write(result.stdout??'');
         "schema": TRUSTED_NATIVE_REVIEW_FIXTURE_SCHEMA,
         "change": change,
         "policyHash": fixture["policy"]["policyHash"],
-        "creationAuthorization": f"/workspace/_eval_trusted_oracles/{authorization_name}",
         "signer": "/workspace/_eval_trusted_oracles/native-review-signer.mjs",
         "signerMode": "external-verifier-sidecar",
         "roles": ["implementation", "reviewer", "waiver"],

package/eval/local/tests/scaffold/test_native_wave_evaluations.py

@@ -597,11 +597,6 @@ def test_controller_provisions_immutable_native_review_fixture(tmp_path: Path):
         (oracle / "native-review-fixture.json").read_text(encoding="utf-8")
     )
     policy = json.loads((oracle / "native-review-trust.json").read_text(encoding="utf-8"))
-    authorization = json.loads(
-        (oracle / "sentence-counting-creation-authorization.json").read_text(
-            encoding="utf-8"
-        )
-    )
     store = json.loads(
         (oracle / "controller-home/native-controller-trust.json").read_text(
             encoding="utf-8"
@@ -611,16 +606,13 @@ def test_controller_provisions_immutable_native_review_fixture(tmp_path: Path):
     assert public_fixture["change"] == "sentence-counting"
     assert public_fixture["signerMode"] == "external-verifier-sidecar"
     assert policy["schema"] == "comet.native.review-trust-policy.v2"
-    assert authorization["schema"] == "comet.native.creation-authorization.v1"
-    assert authorization["policyHash"] == policy["policyHash"]
-    assert authorization["projectRootHash"] == canonical_hash(
+    project_root_hash = canonical_hash(
         "comet.native.controller-project-root.v1", "/workspace"
     )
     assert store["projects"] == [
         {
-            "projectRootHash": authorization["projectRootHash"],
+            "projectRootHash": project_root_hash,
             "controllerIdentity": store["projects"][0]["controllerIdentity"],
-            "legacyChanges": [],
         }
     ]
     assert (workspace / ".comet/native-review-trust.json").read_bytes() == (
@@ -633,13 +625,6 @@ def test_controller_provisions_immutable_native_review_fixture(tmp_path: Path):
         policy["policyHash"],
         "Controller policy",
     )
-    validator._validate_signature(
-        authorization["controllerSignature"],
-        store["projects"][0]["controllerIdentity"],
-        authorization["authorizationHash"],
-        "Controller authorization",
-    )
-
     secrets_root = workspace.with_name(f".{workspace.name}-native-review-secrets")
     secret_documents = [
         json.loads((secrets_root / f"{role}-key.json").read_text(encoding="utf-8"))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rpamis/comet",
-  "version": "0.4.0-beta.10",
+  "version": "0.4.0-beta.11",
   "description": "Agent Skill Harness For Turning Ideas Into Evaluated Workflows",
   "keywords": [
     "comet",

package/dist/domains/comet-native/native-creation-authorization.d.ts

@@ -1,30 +0,0 @@
-import { type NativeReviewIdentity, type NativeReviewSignature } from './native-review-identity.js';
-import type { NativeProjectPaths } from './native-types.js';
-export declare const NATIVE_CREATION_AUTHORIZATION_SCHEMA: "comet.native.creation-authorization.v1";
-export interface NativeCreationAuthorization {
-    schema: typeof NATIVE_CREATION_AUTHORIZATION_SCHEMA;
-    controllerKeyId: string;
-    projectRootHash: string;
-    policyHash: string;
-    protocol: 'signed-v2';
-    change: string;
-    issuedAt: string;
-    authorizationHash: string;
-    controllerSignature: NativeReviewSignature;
-}
-export declare function buildNativeCreationAuthorization(input: {
-    controllerIdentity: NativeReviewIdentity;
-    controllerPrivateKey: string;
-    projectRootHash: string;
-    policyHash: string;
-    change: string;
-    now?: Date;
-}): NativeCreationAuthorization;
-export declare function parseNativeCreationAuthorization(value: unknown): NativeCreationAuthorization;
-export declare function verifyNativeCreationAuthorization(options: {
-    paths: NativeProjectPaths;
-    policyHash: string;
-    authorization: unknown;
-    change: string;
-}): Promise<NativeCreationAuthorization>;
-//# sourceMappingURL=native-creation-authorization.d.ts.map

package/dist/domains/comet-native/native-creation-authorization.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"native-creation-authorization.d.ts","sourceRoot":"","sources":["../../../domains/comet-native/native-creation-authorization.ts"],"names":[],"mappings":"AAKA,OAAO,EAIL,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC3B,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,eAAO,MAAM,oCAAoC,EAC/C,wCAAiD,CAAC;AAIpD,MAAM,WAAW,2BAA2B;IAC1C,MAAM,EAAE,OAAO,oCAAoC,CAAC;IACpD,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,WAAW,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,mBAAmB,EAAE,qBAAqB,CAAC;CAC5C;AAqBD,wBAAgB,gCAAgC,CAAC,KAAK,EAAE;IACtD,kBAAkB,EAAE,oBAAoB,CAAC;IACzC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GAAG,2BAA2B,CAoB9B;AAED,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,OAAO,GAAG,2BAA2B,CAwD5F;AAED,wBAAsB,iCAAiC,CAAC,OAAO,EAAE;IAC/D,KAAK,EAAE,kBAAkB,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,OAAO,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAqBvC"}

package/dist/domains/comet-native/native-creation-authorization.js

@@ -1,110 +0,0 @@
-import { canonicalHash } from './native-canonical-hash.js';
-import { nativeControllerProjectRootHash, readNativeControllerTrustProject, } from './native-controller-trust.js';
-import { parseNativeReviewSignature, signNativeReviewPayloadHash, verifyNativeReviewPayloadHash, } from './native-review-identity.js';
-export const NATIVE_CREATION_AUTHORIZATION_SCHEMA = 'comet.native.creation-authorization.v1';
-const HASH_PATTERN = /^[a-f0-9]{64}$/u;
-const CHANGE_NAME_PATTERN = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/u;
-function record(value, label) {
-    if (!value || typeof value !== 'object' || Array.isArray(value)) {
-        throw new Error(`${label} must be an object`);
-    }
-    return value;
-}
-function exactKeys(value, expected, label) {
-    const actual = Object.keys(value).sort();
-    const canonical = [...expected].sort();
-    if (JSON.stringify(actual) !== JSON.stringify(canonical)) {
-        throw new Error(`${label} fields are invalid`);
-    }
-}
-export function buildNativeCreationAuthorization(input) {
-    const content = {
-        schema: NATIVE_CREATION_AUTHORIZATION_SCHEMA,
-        controllerKeyId: input.controllerIdentity.keyId,
-        projectRootHash: input.projectRootHash,
-        policyHash: input.policyHash,
-        protocol: 'signed-v2',
-        change: input.change,
-        issuedAt: (input.now ?? new Date()).toISOString(),
-    };
-    const authorizationHash = canonicalHash(NATIVE_CREATION_AUTHORIZATION_SCHEMA, content);
-    return parseNativeCreationAuthorization({
-        ...content,
-        authorizationHash,
-        controllerSignature: signNativeReviewPayloadHash({
-            identity: input.controllerIdentity,
-            privateKey: input.controllerPrivateKey,
-            payloadHash: authorizationHash,
-        }),
-    });
-}
-export function parseNativeCreationAuthorization(value) {
-    const root = record(value, 'Native creation authorization');
-    exactKeys(root, [
-        'schema',
-        'controllerKeyId',
-        'projectRootHash',
-        'policyHash',
-        'protocol',
-        'change',
-        'issuedAt',
-        'authorizationHash',
-        'controllerSignature',
-    ], 'Native creation authorization');
-    if (root.schema !== NATIVE_CREATION_AUTHORIZATION_SCHEMA ||
-        typeof root.controllerKeyId !== 'string' ||
-        !HASH_PATTERN.test(root.controllerKeyId) ||
-        typeof root.projectRootHash !== 'string' ||
-        !HASH_PATTERN.test(root.projectRootHash) ||
-        typeof root.policyHash !== 'string' ||
-        !HASH_PATTERN.test(root.policyHash) ||
-        root.protocol !== 'signed-v2' ||
-        typeof root.change !== 'string' ||
-        !CHANGE_NAME_PATTERN.test(root.change) ||
-        typeof root.issuedAt !== 'string' ||
-        Number.isNaN(Date.parse(root.issuedAt)) ||
-        typeof root.authorizationHash !== 'string' ||
-        !HASH_PATTERN.test(root.authorizationHash)) {
-        throw new Error('Native creation authorization is invalid');
-    }
-    const content = {
-        schema: NATIVE_CREATION_AUTHORIZATION_SCHEMA,
-        controllerKeyId: root.controllerKeyId,
-        projectRootHash: root.projectRootHash,
-        policyHash: root.policyHash,
-        protocol: 'signed-v2',
-        change: root.change,
-        issuedAt: root.issuedAt,
-    };
-    const authorizationHash = canonicalHash(NATIVE_CREATION_AUTHORIZATION_SCHEMA, content);
-    if (authorizationHash !== root.authorizationHash) {
-        throw new Error('Native creation authorization hash mismatch');
-    }
-    const controllerSignature = parseNativeReviewSignature(root.controllerSignature);
-    if (controllerSignature.keyId !== root.controllerKeyId ||
-        controllerSignature.payloadHash !== authorizationHash) {
-        throw new Error('Native creation authorization signature binding is invalid');
-    }
-    return { ...content, authorizationHash, controllerSignature };
-}
-export async function verifyNativeCreationAuthorization(options) {
-    const controllerTrust = await readNativeControllerTrustProject(options.paths.projectRoot);
-    if (!controllerTrust) {
-        throw new Error('Native project has no controller-owned trust root');
-    }
-    const authorization = parseNativeCreationAuthorization(options.authorization);
-    const projectRootHash = await nativeControllerProjectRootHash(options.paths.projectRoot);
-    if (authorization.controllerKeyId !== controllerTrust.controllerIdentity.keyId ||
-        authorization.projectRootHash !== projectRootHash ||
-        authorization.policyHash !== options.policyHash ||
-        authorization.change !== options.change) {
-        throw new Error('Native creation authorization does not match the trusted project/change');
-    }
-    verifyNativeReviewPayloadHash({
-        identity: controllerTrust.controllerIdentity,
-        payloadHash: authorization.authorizationHash,
-        proof: authorization.controllerSignature,
-    });
-    return authorization;
-}
-//# sourceMappingURL=native-creation-authorization.js.map

package/dist/domains/comet-native/native-creation-authorization.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"native-creation-authorization.js","sourceRoot":"","sources":["../../../domains/comet-native/native-creation-authorization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EACL,+BAA+B,EAC/B,gCAAgC,GACjC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,EAC3B,6BAA6B,GAG9B,MAAM,6BAA6B,CAAC;AAGrC,MAAM,CAAC,MAAM,oCAAoC,GAC/C,wCAAiD,CAAC;AACpD,MAAM,YAAY,GAAG,iBAAiB,CAAC;AACvC,MAAM,mBAAmB,GAAG,kCAAkC,CAAC;AAc/D,SAAS,MAAM,CAAC,KAAc,EAAE,KAAa;IAC3C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,SAAS,CAChB,KAA8B,EAC9B,QAA2B,EAC3B,KAAa;IAEb,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,KAOhD;IACC,MAAM,OAAO,GAAG;QACd,MAAM,EAAE,oCAAoC;QAC5C,eAAe,EAAE,KAAK,CAAC,kBAAkB,CAAC,KAAK;QAC/C,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,QAAQ,EAAE,WAAoB;QAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;KAClD,CAAC;IACF,MAAM,iBAAiB,GAAG,aAAa,CAAC,oCAAoC,EAAE,OAAO,CAAC,CAAC;IACvF,OAAO,gCAAgC,CAAC;QACtC,GAAG,OAAO;QACV,iBAAiB;QACjB,mBAAmB,EAAE,2BAA2B,CAAC;YAC/C,QAAQ,EAAE,KAAK,CAAC,kBAAkB;YAClC,UAAU,EAAE,KAAK,CAAC,oBAAoB;YACtC,WAAW,EAAE,iBAAiB;SAC/B,CAAC;KACH,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,KAAc;IAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,+BAA+B,CAAC,CAAC;IAC5D,SAAS,CACP,IAAI,EACJ;QACE,QAAQ;QACR,iBAAiB;QACjB,iBAAiB;QACjB,YAAY;QACZ,UAAU;QACV,QAAQ;QACR,UAAU;QACV,mBAAmB;QACnB,qBAAqB;KACtB,EACD,+BAA+B,CAChC,CAAC;IACF,IACE,IAAI,CAAC,MAAM,KAAK,oCAAoC;QACpD,OAAO,IAAI,CAAC,eAAe,KAAK,QAAQ;QACxC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC;QACxC,OAAO,IAAI,CAAC,eAAe,KAAK,QAAQ;QACxC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC;QACxC,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ;QACnC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;QACnC,IAAI,CAAC,QAAQ,KAAK,WAAW;QAC7B,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;QAC/B,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;QACtC,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;QACjC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC,iBAAiB,KAAK,QAAQ;QAC1C,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAC1C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,OAAO,GAAG;QACd,MAAM,EAAE,oCAAoC;QAC5C,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,QAAQ,EAAE,WAAoB;QAC9B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC;IACF,MAAM,iBAAiB,GAAG,aAAa,CAAC,oCAAoC,EAAE,OAAO,CAAC,CAAC;IACvF,IAAI,iBAAiB,KAAK,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,mBAAmB,GAAG,0BAA0B,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACjF,IACE,mBAAmB,CAAC,KAAK,KAAK,IAAI,CAAC,eAAe;QAClD,mBAAmB,CAAC,WAAW,KAAK,iBAAiB,EACrD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,EAAE,GAAG,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,CAAC;AAChE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,OAKvD;IACC,MAAM,eAAe,GAAG,MAAM,gCAAgC,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC1F,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,aAAa,GAAG,gCAAgC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC9E,MAAM,eAAe,GAAG,MAAM,+BAA+B,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACzF,IACE,aAAa,CAAC,eAAe,KAAK,eAAe,CAAC,kBAAkB,CAAC,KAAK;QAC1E,aAAa,CAAC,eAAe,KAAK,eAAe;QACjD,aAAa,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU;QAC/C,aAAa,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EACvC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC7F,CAAC;IACD,6BAA6B,CAAC;QAC5B,QAAQ,EAAE,eAAe,CAAC,kBAAkB;QAC5C,WAAW,EAAE,aAAa,CAAC,iBAAiB;QAC5C,KAAK,EAAE,aAAa,CAAC,mBAAmB;KACzC,CAAC,CAAC;IACH,OAAO,aAAa,CAAC;AACvB,CAAC"}