@volter/twin-catalog 0.2.2

package/runner/provenance-fixture.mjs

@@ -0,0 +1,23 @@
+// A public tooling artifact exercises cryptographic provenance; it is not registered or admitted as a twin.
+import assert from 'node:assert/strict';
+import { verify } from 'sigstore';
+import { metadata, registryURL, verifyArtifact, verifiedProvenance } from '../lib/registry.mjs';
+import { write } from '../lib/model.mjs';
+assert.ok(process.env.VOLTER_WORLD, 'provenance fixture must run through a World');
+const registry = 'https://registry.npmjs.org';
+const name = '@sigstore/bundle', version = '4.0.0';
+const integrity = `sha512-${Buffer.from('3700a5e58d15e838b435ec6f913a9da157e68d3690c282ccdb7eabf3d284a231a6abf8cc96cf12fb36fbc8ec003dd5ef6f07ca0e53fe9665e000be2f292413f8', 'hex').toString('base64')}`;
+const doc = await metadata(name, version, registry);
+const downloaded = await fetch(registryURL(doc.dist.tarball, registry), { redirect: 'error' });
+assert.ok(downloaded.ok);
+const bytes = Buffer.from(await downloaded.arrayBuffer());
+verifyArtifact(bytes, { integrity }, doc);
+const fetched = await fetch(registryURL(doc.dist.attestations.url, registry), { redirect: 'error' });
+assert.ok(fetched.ok);
+const document = await fetched.json();
+const source = { repository: 'sigstore/sigstore-js', workflow: 'release.yml' };
+const receipt = await verifiedProvenance(document, source, bytes, verify);
+assert.equal(receipt.predicateType, 'https://slsa.dev/provenance/v1');
+await assert.rejects(() => verifiedProvenance(document, { ...source, repository: 'another/publisher' }, bytes, verify));
+await assert.rejects(() => verifiedProvenance(document, source, Buffer.from('substituted artifact'), verify));
+write('/work/provenance-report.json', { purpose: 'provenance-mechanism-fixture', passed: true, package: name, version, integrity, receipt, wrongSourceRefused: true, substitutedBytesRefused: true });

package/runner/verify-browser.mjs

@@ -0,0 +1,19 @@
+// Exercise the released browser transport in the same offline container as admission. This admits no package.
+import { join, resolve } from 'node:path';
+import { read, write, requireThat } from '../lib/model.mjs';
+import { withContainer } from '../lib/runner.mjs';
+const root = resolve('.'), policy = read(join(root, 'policy.json'));
+const output = join(root, 'assessment/browser.json');
+try {
+  const result = withContainer(root, { policy, purpose: 'browser-transport-fixture' }, output, ({ image, common, run, owner }) => {
+    run([...common, '--network', 'none', image, '-e', 'const fs=require("fs");fs.writeFileSync("/work/world.json",JSON.stringify({id:"catalog-browser-fixture",services:[],network:{egress:[]}}));fs.symlinkSync("/opt/catalog/node_modules","/work/node_modules");']);
+    const walked = run([...common, '--network', 'none', '--entrypoint', 'bun', image, '/opt/catalog/node_modules/@volter/world-runtime/src/cli.ts', 'run', '/work/world.json', '--root', '/work', '--env-out', '/work/world.env', '--owner', owner, '--', 'bun', '/opt/catalog/runner/browser-fixture.ts'], true);
+    const report = run([...common, '--network', 'none', image, '-e', 'process.stdout.write(require("fs").readFileSync("/work/browser-report.json","utf8"))'], true);
+    requireThat(walked.status === 0 && report.status === 0, 'released browser transport fixture failed; inspect browser diagnostics');
+    return { schemaVersion: 1, image, policy, ...JSON.parse(report.stdout) };
+  });
+  write(output, result);
+} catch (error) {
+  write(output, { schemaVersion: 1, ready: false, purpose: 'browser-transport-fixture', error: String(error.message ?? error) });
+  throw error;
+}

package/runner/verify-evaluator.mjs

@@ -0,0 +1,16 @@
+// Owner-dispatched smoke assessment uses the same controller as admission; it grants no approval.
+import { join, resolve } from 'node:path';
+import { metadata } from '../lib/registry.mjs';
+import { read, validateSubmission, requireThat } from '../lib/model.mjs';
+import { evaluate } from '../lib/runner.mjs';
+const root = resolve('.'), policy = read(join(root, 'policy.json'));
+const doc = await metadata(process.env.CATALOG_PACKAGE, process.env.CATALOG_VERSION, policy.registry);
+const submission = { schemaVersion: 1, source: process.env.CATALOG_SOURCE, vendor: process.env.CATALOG_VENDOR, package: doc.name, version: doc.version, integrity: doc.dist.integrity };
+const source = validateSubmission(submission, read(join(root, 'sources.json')));
+const report = evaluate(root, { schemaVersion: 1, policy, source, submission, purpose: 'owner-dispatched-verification' }, join(root, 'assessment/evaluator.json'));
+const expected = process.env.CATALOG_EXPECTED_READINESS ?? 'ready';
+requireThat(['ready', 'reject-missing-provenance'].includes(expected), 'unknown verification expectation');
+if (expected === 'reject-missing-provenance') {
+  requireThat(report.status === 'changes-needed' && report.phase === 'artifact-preparation' && report.error?.includes('npm provenance required; this version has no attestation'), 'evaluator did not produce the specific expected missing-provenance refusal; inspect retained diagnostics');
+  console.log('Verified missing-provenance refusal. The artifact remains changes-needed and is not admitted.');
+} else requireThat(report.status === 'ready', 'isolated evaluator did not establish readiness; inspect the retained report and logs');

package/runner/verify-process.mjs

@@ -0,0 +1,16 @@
+// Process fixtures use only released runtime tooling and a disposable World. No platform checkout.
+import { mkdtempSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { read, write, requireThat } from '../lib/model.mjs';
+const root = resolve('.'), policy = read(join(root, 'policy.json'));
+const temp = mkdtempSync(join(tmpdir(), 'catalog-process-tools-'));
+write(join(temp, 'package.json'), { private: true, dependencies: { '@volter/world-runtime': policy.tools['@volter/world-runtime'], '@volter/world-core': policy.tools['@volter/world-core'] } });
+let result = spawnSync('npm', ['install', '--ignore-scripts', '--no-audit', '--no-fund', '--registry', policy.registry], { cwd: temp, stdio: 'inherit' });
+requireThat(result.status === 0, 'released process-tool installation failed');
+const config = join(temp, 'assessment.world.config.json');
+write(config, { id: 'catalog-process-verification', services: [], network: { egress: [] } });
+result = spawnSync('bun', [join(temp, 'node_modules/@volter/world-runtime/src/cli.ts'), 'run', config, '--root', temp, '--env-out', join(temp, 'assessment.env'), '--owner', 'catalog-process-verification', '--', 'node', '--test', join(root, 'test/process.test.mjs'), join(root, 'test/artifact.test.mjs')], { cwd: root, stdio: 'inherit' });
+write(join(root, 'assessment/process.json'), { exit: result.status, tools: policy.tools });
+process.exit(result.status ?? 1);

package/runner/verify-provenance.mjs

@@ -0,0 +1,20 @@
+import { join, resolve } from 'node:path';
+import { read, write } from '../lib/model.mjs';
+import { withContainer } from '../lib/runner.mjs';
+const root = resolve('.'), policy = read(join(root, 'policy.json'));
+const output = join(root, 'assessment/provenance.json');
+try {
+  const report = withContainer(root, { policy, purpose: 'provenance-mechanism-fixture' }, output, ({ image, common, run, owner }) => {
+    // Verification needs the registry and Sigstore trust services; candidate execution remains offline.
+    const destinations = ['https://registry.npmjs.org', 'https://tuf-repo-cdn.sigstore.dev', 'https://tuf-repo.sigstore.dev'];
+    const config = { id: 'catalog-provenance-fixture', services: [], network: { phase: 'build', egress: destinations, passthrough: destinations } };
+    run([...common, '--network', 'none', image, '-e', 'require("fs").writeFileSync("/work/world.json",process.argv[1])', JSON.stringify(config)]);
+    run([...common, '--entrypoint', 'bun', image, '/opt/catalog/node_modules/@volter/world-runtime/src/cli.ts', 'run', '/work/world.json', '--root', '/work', '--env-out', '/work/world.env', '--owner', owner, '--', 'node', '/opt/catalog/runner/provenance-fixture.mjs']);
+    const result = run([...common, '--network', 'none', image, '-e', 'process.stdout.write(require("fs").readFileSync("/work/provenance-report.json","utf8"))']);
+    return { schemaVersion: 1, image, policy, ...JSON.parse(result.stdout) };
+  });
+  write(output, report);
+} catch (error) {
+  write(output, { schemaVersion: 1, purpose: 'provenance-mechanism-fixture', passed: false, error: String(error.message ?? error) });
+  throw error;
+}

package/sources.json

@@ -0,0 +1,10 @@
+[
+  {
+    "name": "twin-packs-open",
+    "repository": "volter-ai/twin-packs-open",
+    "scope": "@volter",
+    "official": true,
+    "protocol": "3",
+    "workflow": "release.yml"
+  }
+]