bootproof 0.1.0 → 0.4.0

package/docs/examples/registry-seeds/monorepo-ambiguous-health.json

@@ -0,0 +1,29 @@
+{
+  "schema": "bootproof/registry-seed-example/v1",
+  "name": "monorepo-ambiguous-health",
+  "source": "synthetic_minimal_fixture",
+  "structuralMarkers": [
+    "root package.json workspaces",
+    "parallel root dev command",
+    "apps/web/package.json",
+    "apps/docs/package.json",
+    "multiple plausible health ports"
+  ],
+  "expectedBootProof": {
+    "kind": "classification",
+    "values": [
+      "workspace_ambiguous"
+    ]
+  },
+  "safeNextStep": "Select one reviewed workspace explicitly and rerun BootProof against that application instead of guessing among parallel services.",
+  "repairDisposition": "refused",
+  "externallyOrchestrated": false,
+  "evidenceOutcome": "diagnostic_only",
+  "verificationBasis": "Ambiguous workspace markers justify refusal only; no workspace can be marked verified until its own health response is observed.",
+  "redactionsApplied": [
+    "workspace names are generic",
+    "no repository source included",
+    "no environment values included"
+  ]
+}
+

package/docs/examples/registry-seeds/php-composer.json

@@ -0,0 +1,33 @@
+{
+  "schema": "bootproof/registry-seed-example/v1",
+  "name": "php-composer",
+  "source": "synthetic_minimal_fixture",
+  "structuralMarkers": [
+    "composer.json",
+    "composer.lock",
+    "php command not found",
+    "composer command not found",
+    "lock file package PHP constraint mismatch",
+    "vendor/autoload.php missing"
+  ],
+  "expectedBootProof": {
+    "kind": "classification",
+    "values": [
+      "missing_php_runtime",
+      "missing_composer",
+      "unsupported_php_version_for_composer_lock",
+      "missing_php_vendor_autoload"
+    ]
+  },
+  "safeNextStep": "Select a PHP version compatible with composer.lock, install Composer through the documented local method, and run composer install without editing the lockfile as the first step.",
+  "repairDisposition": "refused",
+  "externallyOrchestrated": false,
+  "evidenceOutcome": "diagnostic_only",
+  "verificationBasis": "Runtime and dependency evidence can support only a failed diagnostic receipt until a separate application health check succeeds.",
+  "redactionsApplied": [
+    "no package registry credentials included",
+    "no private package names included",
+    "no local filesystem paths included"
+  ]
+}
+

package/docs/examples/registry-seeds/rails-bundler.json

@@ -0,0 +1,32 @@
+{
+  "schema": "bootproof/registry-seed-example/v1",
+  "name": "rails-bundler",
+  "source": "synthetic_minimal_fixture",
+  "structuralMarkers": [
+    "Gemfile",
+    "bin/rails",
+    "config/database.yml example marker",
+    "rbenv version is not installed",
+    "Gem::Ext::BuildError",
+    "Failed to build gem native extension"
+  ],
+  "expectedBootProof": {
+    "kind": "classification_and_inference",
+    "values": [
+      "ruby-backend",
+      "missing_ruby_version",
+      "native_extension_compile_failed"
+    ]
+  },
+  "safeNextStep": "Approve installation of the exact repository-required Ruby version or evidenced native build dependency, rerun dependency installation, then require observed Rails HTTP health.",
+  "repairDisposition": "approval_required",
+  "externallyOrchestrated": false,
+  "evidenceOutcome": "verified_boot_possible",
+  "verificationBasis": "An observed Rails HTTP response, including an accepted authentication redirect, may verify boot; successful Bundler installation is not proof.",
+  "redactionsApplied": [
+    "no Bundler credentials included",
+    "no database values included",
+    "no copied application configuration included"
+  ]
+}
+

package/docs/examples/registry-seeds/sentry-devenv-direnv.json

@@ -0,0 +1,41 @@
+{
+  "schema": "bootproof/registry-seed-example/v1",
+  "name": "sentry-devenv-direnv",
+  "source": "synthetic_minimal_fixture",
+  "structuralMarkers": [
+    "pyproject.toml",
+    "Makefile",
+    "package.json",
+    "pnpm-lock.yaml",
+    "devservices/",
+    "scripts/do.sh mentions devenv",
+    "devenv sync",
+    "direnv allow"
+  ],
+  "expectedBootProof": {
+    "kind": "classification_and_inference",
+    "values": [
+      "python-backend",
+      "node-frontend",
+      "make-driven",
+      "devservices-backed",
+      "devenv-managed",
+      "large-hybrid-app",
+      "repo_requires_devenv",
+      "missing_devenv_tool",
+      "missing_direnv_tool",
+      "sentry_virtualenv_not_activated"
+    ]
+  },
+  "safeNextStep": "Install and configure the documented devenv and direnv tools, review and run devenv sync, activate with direnv allow, and rerun BootProof without automatic setup execution.",
+  "repairDisposition": "approval_required",
+  "externallyOrchestrated": false,
+  "evidenceOutcome": "diagnostic_only",
+  "verificationBasis": "Setup-path evidence supports conservative diagnosis only; verified boot requires a later observed application health response.",
+  "redactionsApplied": [
+    "no virtual environment contents included",
+    "no package registry credentials included",
+    "no copied vendor scripts included"
+  ]
+}
+

package/docs/schemas/action-verdict-v1.schema.json

@@ -0,0 +1,64 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://bootproof.dev/schemas/action-verdict-v1.schema.json",
+  "title": "BootProof GitHub Action Verdict v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "verified",
+    "shouldFail",
+    "failureReason",
+    "failureClass",
+    "bootproofExitCode",
+    "driftDetected",
+    "commandsExecuted",
+    "cloudUploadPerformed",
+    "federatedReceiptCommitted",
+    "agentActionsExecuted"
+  ],
+  "properties": {
+    "schema": {
+      "const": "bootproof/action-verdict/v1"
+    },
+    "verified": {
+      "type": "boolean"
+    },
+    "shouldFail": {
+      "type": "boolean"
+    },
+    "failureReason": {
+      "type": "string"
+    },
+    "failureClass": {
+      "type": "string"
+    },
+    "bootproofExitCode": {
+      "type": [
+        "integer",
+        "null"
+      ]
+    },
+    "driftDetected": {
+      "type": "boolean"
+    },
+    "commandsExecuted": {
+      "type": "array",
+      "items": {
+        "type": "array",
+        "items": {
+          "type": "string"
+        }
+      }
+    },
+    "cloudUploadPerformed": {
+      "const": false
+    },
+    "federatedReceiptCommitted": {
+      "const": false
+    },
+    "agentActionsExecuted": {
+      "const": false
+    }
+  }
+}

package/docs/schemas/agent-plan-v1.schema.json

@@ -0,0 +1,148 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://bootproof.dev/schemas/agent-plan-v1.schema.json",
+  "title": "BootProof Agent Plan v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "mode",
+    "classifications",
+    "currentFailureClass",
+    "observedEvidence",
+    "suspectedStack",
+    "missingTools",
+    "candidateNextActions",
+    "verificationSteps",
+    "stopConditions",
+    "canBootProofOrchestrateDirectly",
+    "canBootProofVerifyExternally"
+  ],
+  "properties": {
+    "schema": { "const": "bootproof/agent-plan/v1" },
+    "mode": { "const": "agent-plan" },
+    "classifications": {
+      "type": "array",
+      "uniqueItems": true,
+      "items": {
+        "enum": [
+          "airbyte_abctl_managed",
+          "large_orchestration_repo",
+          "external_orchestrator_required",
+          "kind_kubernetes_backed",
+          "helm_deployed",
+          "auth_required"
+        ]
+      }
+    },
+    "currentFailureClass": { "type": "string" },
+    "observedEvidence": {
+      "type": "array",
+      "uniqueItems": true,
+      "items": { "type": "string" }
+    },
+    "suspectedStack": {
+      "type": "array",
+      "uniqueItems": true,
+      "items": { "type": "string" }
+    },
+    "missingTools": {
+      "type": "array",
+      "uniqueItems": true,
+      "items": { "type": "string" }
+    },
+    "candidateNextActions": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/action" }
+    },
+    "verificationSteps": {
+      "type": "array",
+      "uniqueItems": true,
+      "items": { "type": "string" }
+    },
+    "stopConditions": {
+      "type": "array",
+      "uniqueItems": true,
+      "items": { "type": "string" }
+    },
+    "canBootProofOrchestrateDirectly": { "type": "boolean" },
+    "canBootProofVerifyExternally": { "type": "boolean" }
+  },
+  "$defs": {
+    "action": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "classification",
+        "actionType",
+        "command",
+        "reason",
+        "evidence",
+        "riskLevel",
+        "mutationScope",
+        "requiresApproval",
+        "approvalPrompt",
+        "blockedReason",
+        "verificationStep",
+        "stopCondition",
+        "secretSensitive"
+      ],
+      "properties": {
+        "classification": {
+          "enum": [
+            "host_tool_install_required",
+            "kubernetes_cluster_creation_required",
+            "heavy_orchestration_required",
+            "external_orchestrator_required",
+            "credential_required",
+            "auth_required",
+            "external_health_verification_required"
+          ]
+        },
+        "actionType": { "enum": ["command", "instruction"] },
+        "command": { "type": "string" },
+        "reason": { "type": "string", "minLength": 1 },
+        "evidence": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": { "type": "string" }
+        },
+        "riskLevel": { "enum": ["none", "low", "medium", "high", "blocked"] },
+        "mutationScope": { "enum": ["none", "repo_only", "project_cache", "container_runtime", "host_tool_install", "host_network", "kubernetes_cluster", "database", "service", "credentials", "unknown"] },
+        "requiresApproval": { "type": "boolean" },
+        "approvalPrompt": { "type": "string", "minLength": 1 },
+        "blockedReason": { "type": "string" },
+        "verificationStep": { "type": "string", "minLength": 1 },
+        "stopCondition": { "type": "string", "minLength": 1 },
+        "secretSensitive": { "type": "boolean" }
+      },
+      "allOf": [
+        {
+          "if": { "properties": { "actionType": { "const": "command" } } },
+          "then": { "properties": { "command": { "type": "string", "minLength": 1 } } }
+        },
+        {
+          "if": { "properties": { "actionType": { "const": "instruction" } } },
+          "then": { "properties": { "command": { "const": "" } } }
+        },
+        {
+          "if": { "properties": { "riskLevel": { "enum": ["medium", "high"] } } },
+          "then": { "properties": { "requiresApproval": { "const": true } } }
+        },
+        {
+          "if": { "properties": { "riskLevel": { "const": "blocked" } } },
+          "then": {
+            "properties": {
+              "requiresApproval": { "const": false },
+              "blockedReason": { "type": "string", "minLength": 1 }
+            }
+          }
+        },
+        {
+          "if": { "properties": { "mutationScope": { "const": "credentials" } } },
+          "then": { "properties": { "secretSensitive": { "const": true } } }
+        }
+      ]
+    }
+  }
+}

package/docs/schemas/agent-run-receipts-v1.schema.json

@@ -0,0 +1,192 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://bootproof.dev/schemas/agent-run-receipts-v1.schema.json",
+  "title": "BootProof Agent Run Receipts v1",
+  "oneOf": [
+    { "$ref": "#/$defs/initialReceipt" },
+    { "$ref": "#/$defs/planReceipt" },
+    { "$ref": "#/$defs/actionReceipt" },
+    { "$ref": "#/$defs/verificationReceipt" },
+    { "$ref": "#/$defs/finalSummary" }
+  ],
+  "$defs": {
+    "hash": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
+    "nullableHash": {
+      "oneOf": [
+        { "$ref": "#/$defs/hash" },
+        { "type": "null" }
+      ]
+    },
+    "runId": {
+      "type": "string",
+      "pattern": "^\\d{8}T\\d{9}Z-[0-9a-f]{12}$"
+    },
+    "redactions": {
+      "type": "array",
+      "uniqueItems": true,
+      "items": { "type": "string" }
+    },
+    "initialReceipt": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "schema", "receiptType", "runId", "timestamp", "previousReceiptHash",
+        "receiptHash", "redactionsApplied", "sourceAttestationHash",
+        "sourceSignatureValid", "attestation", "diagnosis"
+      ],
+      "properties": {
+        "schema": { "const": "bootproof/agent-run-initial/v1" },
+        "receiptType": { "const": "initial-attestation" },
+        "runId": { "$ref": "#/$defs/runId" },
+        "timestamp": { "type": "string", "format": "date-time" },
+        "previousReceiptHash": { "type": "null" },
+        "receiptHash": { "$ref": "#/$defs/hash" },
+        "redactionsApplied": { "$ref": "#/$defs/redactions" },
+        "sourceAttestationHash": { "$ref": "#/$defs/nullableHash" },
+        "sourceSignatureValid": { "type": "boolean" },
+        "attestation": {
+          "oneOf": [
+            { "type": "object" },
+            { "type": "null" }
+          ]
+        },
+        "diagnosis": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "failureClass", "observedEvidence", "verificationMode",
+            "bootproofOrchestrated", "healthVerified"
+          ],
+          "properties": {
+            "failureClass": { "type": ["string", "null"] },
+            "observedEvidence": {
+              "type": "array",
+              "items": { "type": "string" }
+            },
+            "verificationMode": { "type": "string" },
+            "bootproofOrchestrated": { "type": "boolean" },
+            "healthVerified": { "type": "boolean" }
+          }
+        }
+      }
+    },
+    "planReceipt": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "schema", "receiptType", "runId", "timestamp", "previousReceiptHash",
+        "receiptHash", "redactionsApplied", "plan"
+      ],
+      "properties": {
+        "schema": { "const": "bootproof/agent-run-plan/v1" },
+        "receiptType": { "const": "agent-plan" },
+        "runId": { "$ref": "#/$defs/runId" },
+        "timestamp": { "type": "string", "format": "date-time" },
+        "previousReceiptHash": { "$ref": "#/$defs/hash" },
+        "receiptHash": { "$ref": "#/$defs/hash" },
+        "redactionsApplied": { "$ref": "#/$defs/redactions" },
+        "plan": { "$ref": "agent-plan-v1.schema.json" }
+      }
+    },
+    "actionReceipt": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "schema", "receiptType", "runId", "timestamp", "previousReceiptHash",
+        "receiptHash", "redactionsApplied", "actionIndex", "classification",
+        "actionType", "command", "riskLevel", "mutationScope",
+        "approvalStatus", "executionStatus", "verificationResult",
+        "failureClassBefore", "failureClassAfter", "blockedReason",
+        "secretSensitive"
+      ],
+      "properties": {
+        "schema": { "const": "bootproof/agent-action-receipt/v1" },
+        "receiptType": { "const": "action" },
+        "runId": { "$ref": "#/$defs/runId" },
+        "timestamp": { "type": "string", "format": "date-time" },
+        "previousReceiptHash": { "$ref": "#/$defs/hash" },
+        "receiptHash": { "$ref": "#/$defs/hash" },
+        "redactionsApplied": { "$ref": "#/$defs/redactions" },
+        "actionIndex": { "type": "integer", "minimum": 0 },
+        "classification": { "type": "string", "minLength": 1 },
+        "actionType": { "enum": ["command", "instruction"] },
+        "command": { "type": "string" },
+        "riskLevel": { "enum": ["none", "low", "medium", "high", "blocked"] },
+        "mutationScope": { "enum": ["none", "repo_only", "project_cache", "container_runtime", "host_tool_install", "host_network", "kubernetes_cluster", "database", "service", "credentials", "unknown"] },
+        "approvalStatus": { "enum": ["not_required", "pending", "approved", "declined", "blocked"] },
+        "executionStatus": { "enum": ["not_executed", "executed", "failed"] },
+        "verificationResult": { "type": ["string", "null"] },
+        "failureClassBefore": { "type": ["string", "null"] },
+        "failureClassAfter": { "type": ["string", "null"] },
+        "blockedReason": { "type": "string" },
+        "secretSensitive": { "type": "boolean" }
+      }
+    },
+    "verificationReceipt": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "schema", "receiptType", "runId", "timestamp", "previousReceiptHash",
+        "receiptHash", "redactionsApplied", "verificationMode",
+        "bootproofOrchestrated", "result", "classification", "requestedUrl",
+        "observedStatus", "observedFinalUrl", "observedAt",
+        "healthObservation", "connectionError", "failureClassBefore",
+        "failureClassAfter", "attestationHash"
+      ],
+      "properties": {
+        "schema": { "const": "bootproof/agent-verification-receipt/v1" },
+        "receiptType": { "const": "verification" },
+        "runId": { "$ref": "#/$defs/runId" },
+        "timestamp": { "type": "string", "format": "date-time" },
+        "previousReceiptHash": { "$ref": "#/$defs/hash" },
+        "receiptHash": { "$ref": "#/$defs/hash" },
+        "redactionsApplied": { "$ref": "#/$defs/redactions" },
+        "verificationMode": { "enum": ["bootproof-orchestrated", "external-health"] },
+        "bootproofOrchestrated": { "type": "boolean" },
+        "result": { "enum": ["verified", "not_verified"] },
+        "classification": { "type": ["string", "null"] },
+        "requestedUrl": { "type": ["string", "null"] },
+        "observedStatus": { "type": ["integer", "null"] },
+        "observedFinalUrl": { "type": ["string", "null"] },
+        "observedAt": { "type": ["string", "null"] },
+        "healthObservation": { "type": ["string", "null"] },
+        "connectionError": { "type": ["string", "null"] },
+        "failureClassBefore": { "type": ["string", "null"] },
+        "failureClassAfter": { "type": ["string", "null"] },
+        "attestationHash": { "$ref": "#/$defs/hash" }
+      }
+    },
+    "finalSummary": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "schema", "runId", "createdAt", "updatedAt", "status",
+        "lastReceiptHash", "receiptCount", "chainValid",
+        "initialFailureClass", "currentFailureClass",
+        "bootproofOrchestrated", "verifiedExternalHealth", "onlyPlanned",
+        "stoppedForApproval", "stoppedDueBlockedAction", "verified",
+        "explanation", "redactionsApplied"
+      ],
+      "properties": {
+        "schema": { "const": "bootproof/agent-run-summary/v1" },
+        "runId": { "$ref": "#/$defs/runId" },
+        "createdAt": { "type": "string", "format": "date-time" },
+        "updatedAt": { "type": "string", "format": "date-time" },
+        "status": { "enum": ["planned", "stopped_for_approval", "stopped_blocked", "awaiting_verification", "verified_external_health", "verified_bootproof_orchestrated", "verification_failed"] },
+        "lastReceiptHash": { "$ref": "#/$defs/hash" },
+        "receiptCount": { "type": "integer", "minimum": 2 },
+        "chainValid": { "type": "boolean" },
+        "initialFailureClass": { "type": ["string", "null"] },
+        "currentFailureClass": { "type": ["string", "null"] },
+        "bootproofOrchestrated": { "type": "boolean" },
+        "verifiedExternalHealth": { "type": "boolean" },
+        "onlyPlanned": { "type": "boolean" },
+        "stoppedForApproval": { "type": "boolean" },
+        "stoppedDueBlockedAction": { "type": "boolean" },
+        "verified": { "type": "boolean" },
+        "explanation": { "type": "string", "minLength": 1 },
+        "redactionsApplied": { "$ref": "#/$defs/redactions" }
+      }
+    }
+  }
+}

package/docs/schemas/ai-repair-suggestion-v1.schema.json

@@ -0,0 +1,70 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://bootproof.dev/schemas/ai-repair-suggestion-v1.schema.json",
+  "title": "BootProof AI Repair Suggestion v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "confidence",
+    "failure_class",
+    "suggested_action_type",
+    "suggested_command",
+    "suggested_patch",
+    "explanation_for_user",
+    "risk_level",
+    "requires_human_approval",
+    "why_this_is_safe",
+    "what_to_check_after"
+  ],
+  "properties": {
+    "schema": { "const": "bootproof/ai-repair-suggestion/v1" },
+    "confidence": { "type": "number", "minimum": 0, "maximum": 1 },
+    "failure_class": { "type": "string", "minLength": 1 },
+    "suggested_action_type": { "enum": ["command", "patch", "instruction"] },
+    "suggested_command": {
+      "anyOf": [
+        { "$ref": "#/$defs/command" },
+        { "type": "null" }
+      ]
+    },
+    "suggested_patch": {
+      "anyOf": [
+        { "$ref": "#/$defs/patch" },
+        { "type": "null" }
+      ]
+    },
+    "explanation_for_user": { "type": "string", "minLength": 1 },
+    "risk_level": { "enum": ["none", "low", "medium", "high", "blocked"] },
+    "requires_human_approval": { "const": true },
+    "why_this_is_safe": { "type": "string", "minLength": 1 },
+    "what_to_check_after": { "type": "string", "minLength": 1 }
+  },
+  "$defs": {
+    "command": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["executable", "args", "display"],
+      "properties": {
+        "executable": { "type": "string", "minLength": 1 },
+        "args": { "type": "array", "items": { "type": "string" } },
+        "display": { "type": "string", "minLength": 1 }
+      }
+    },
+    "patch": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["format", "content", "files"],
+      "properties": {
+        "format": { "const": "unified-diff" },
+        "content": { "type": "string", "minLength": 1 },
+        "files": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": { "type": "string", "minLength": 1 }
+        }
+      }
+    }
+  }
+}