bootproof 0.1.0 → 0.4.0

package/docs/schemas/ci-context-v1.schema.json

@@ -0,0 +1,63 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://bootproof.dev/schemas/ci-context-v1.schema.json",
+  "title": "BootProof CI Context v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "repository",
+    "workflow",
+    "runId",
+    "runAttempt",
+    "sha",
+    "ref",
+    "actor",
+    "eventName",
+    "job",
+    "serverUrl",
+    "githubActions",
+    "oidcSigned"
+  ],
+  "properties": {
+    "schema": {
+      "const": "bootproof/ci-context/v1"
+    },
+    "repository": {
+      "type": "string"
+    },
+    "workflow": {
+      "type": "string"
+    },
+    "runId": {
+      "type": "string"
+    },
+    "runAttempt": {
+      "type": "string"
+    },
+    "sha": {
+      "type": "string"
+    },
+    "ref": {
+      "type": "string"
+    },
+    "actor": {
+      "type": "string"
+    },
+    "eventName": {
+      "type": "string"
+    },
+    "job": {
+      "type": "string"
+    },
+    "serverUrl": {
+      "type": "string"
+    },
+    "githubActions": {
+      "type": "boolean"
+    },
+    "oidcSigned": {
+      "const": false
+    }
+  }
+}

package/docs/schemas/diff-result-v1.schema.json

@@ -0,0 +1,66 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://bootproof.dev/schemas/diff-result-v1.schema.json",
+  "title": "BootProof Infrastructure Diff Result v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "base",
+    "head",
+    "changedFiles",
+    "addedServices",
+    "removedServices",
+    "addedPorts",
+    "removedPorts",
+    "addedEnvVars",
+    "removedEnvVars",
+    "changedCommands",
+    "changedPackageManagers",
+    "riskLevel",
+    "proofRequired",
+    "suggestedReviewNotes",
+    "redactionsApplied"
+  ],
+  "properties": {
+    "schema": { "const": "bootproof/diff-result/v1" },
+    "base": { "type": "string", "minLength": 1 },
+    "head": { "type": "string", "minLength": 1 },
+    "changedFiles": { "$ref": "#/$defs/stringArray" },
+    "addedServices": { "$ref": "#/$defs/stringArray" },
+    "removedServices": { "$ref": "#/$defs/stringArray" },
+    "addedPorts": { "$ref": "#/$defs/stringArray" },
+    "removedPorts": { "$ref": "#/$defs/stringArray" },
+    "addedEnvVars": { "$ref": "#/$defs/stringArray" },
+    "removedEnvVars": { "$ref": "#/$defs/stringArray" },
+    "changedCommands": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/change" }
+    },
+    "changedPackageManagers": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/change" }
+    },
+    "riskLevel": { "enum": ["low", "medium", "high"] },
+    "proofRequired": { "type": "boolean" },
+    "suggestedReviewNotes": { "$ref": "#/$defs/stringArray" },
+    "redactionsApplied": { "$ref": "#/$defs/stringArray" }
+  },
+  "$defs": {
+    "stringArray": {
+      "type": "array",
+      "items": { "type": "string" },
+      "uniqueItems": true
+    },
+    "change": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["source", "before", "after"],
+      "properties": {
+        "source": { "type": "string", "minLength": 1 },
+        "before": { "type": ["string", "null"] },
+        "after": { "type": ["string", "null"] }
+      }
+    }
+  }
+}

package/docs/schemas/federated-receipt-v1.schema.json

@@ -0,0 +1,51 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://bootproof.dev/schemas/federated-receipt-v1.schema.json",
+  "title": "BootProof Federated Receipt v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "createdAt",
+    "registryEntry",
+    "attestationHash",
+    "publicRepoDeclaration",
+    "crawlerHint",
+    "redactionsApplied",
+    "noSecretsIncluded"
+  ],
+  "properties": {
+    "schema": { "const": "bootproof/federated-receipt/v1" },
+    "createdAt": { "type": "string", "format": "date-time" },
+    "registryEntry": { "$ref": "registry-entry-v1.schema.json" },
+    "attestationHash": { "$ref": "#/$defs/hash" },
+    "repairReceiptHash": { "$ref": "#/$defs/hash" },
+    "signature": { "$ref": "#/$defs/signature" },
+    "publicRepoDeclaration": { "const": true },
+    "crawlerHint": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["commitHash", "branch"],
+      "properties": {
+        "repoUrl": { "type": "string", "format": "uri" },
+        "commitHash": { "type": ["string", "null"] },
+        "branch": { "type": ["string", "null"] }
+      }
+    },
+    "redactionsApplied": { "type": "array", "items": { "type": "string" }, "uniqueItems": true },
+    "noSecretsIncluded": { "const": true }
+  },
+  "$defs": {
+    "hash": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
+    "signature": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["algorithm", "publicKey", "value"],
+      "properties": {
+        "algorithm": { "const": "ed25519" },
+        "publicKey": { "type": "string" },
+        "value": { "type": "string" }
+      }
+    }
+  }
+}

package/docs/schemas/registry-entry-v1.schema.json

@@ -0,0 +1,95 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://bootproof.dev/schemas/registry-entry-v1.schema.json",
+  "title": "BootProof Registry Entry v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "createdAt",
+    "bootproofVersion",
+    "source",
+    "registryMode",
+    "repoFingerprint",
+    "repoHost",
+    "repoOwnerHash",
+    "repoNameHash",
+    "commitHash",
+    "branch",
+    "os",
+    "arch",
+    "platform",
+    "packageManager",
+    "detectedStack",
+    "detectedServices",
+    "selectedCommandHash",
+    "selectedCommandRedacted",
+    "failureClass",
+    "failureEvidenceFingerprint",
+    "evidenceHeadRedacted",
+    "evidenceTailRedacted",
+    "healthStatus",
+    "healthUrlPattern",
+    "healthRedirectLocationPattern",
+    "verified",
+    "attestationHash",
+    "redactionsApplied",
+    "optInRequired"
+  ],
+  "properties": {
+    "schema": { "const": "bootproof/registry-entry/v1" },
+    "createdAt": { "type": "string", "format": "date-time" },
+    "bootproofVersion": { "type": "string", "minLength": 1 },
+    "source": { "const": "local_cli" },
+    "registryMode": {
+      "enum": ["local_export", "federated_public_candidate", "cloud_upload_candidate"]
+    },
+    "repoFingerprint": { "$ref": "#/$defs/hash" },
+    "repoHost": { "type": ["string", "null"] },
+    "repoOwnerHash": { "$ref": "#/$defs/hash" },
+    "repoNameHash": { "$ref": "#/$defs/hash" },
+    "publicRepoHint": { "type": "string", "format": "uri" },
+    "commitHash": { "type": ["string", "null"] },
+    "branch": { "type": ["string", "null"] },
+    "os": { "type": "string" },
+    "arch": { "type": "string" },
+    "platform": { "type": "string" },
+    "packageManager": { "type": "string" },
+    "detectedStack": { "type": "array", "items": { "type": "string" }, "uniqueItems": true },
+    "detectedServices": { "type": "array", "items": { "type": "string" }, "uniqueItems": true },
+    "selectedCommandHash": { "anyOf": [{ "$ref": "#/$defs/hash" }, { "type": "null" }] },
+    "selectedCommandRedacted": { "type": ["string", "null"] },
+    "failureClass": { "type": ["string", "null"] },
+    "failureEvidenceFingerprint": { "anyOf": [{ "$ref": "#/$defs/hash" }, { "type": "null" }] },
+    "evidenceHeadRedacted": { "type": ["string", "null"] },
+    "evidenceTailRedacted": { "type": ["string", "null"] },
+    "healthStatus": { "enum": ["healthy", "unhealthy", "connection_error", "not_observed"] },
+    "healthUrlPattern": { "type": ["string", "null"] },
+    "healthRedirectLocationPattern": { "type": ["string", "null"] },
+    "repairActionType": { "enum": ["repo-diff", "plan-step", "environment"] },
+    "repairCommandHash": { "$ref": "#/$defs/hash" },
+    "repairCommandRedacted": { "type": "string" },
+    "beforeFailureClass": { "type": "string" },
+    "afterFailureClass": { "type": "string" },
+    "progressed": { "type": "boolean" },
+    "verified": { "type": "boolean" },
+    "attestationHash": { "$ref": "#/$defs/hash" },
+    "repairReceiptHash": { "$ref": "#/$defs/hash" },
+    "redactionsApplied": { "type": "array", "items": { "type": "string" }, "uniqueItems": true },
+    "signature": { "$ref": "#/$defs/signature" },
+    "optInRequired": { "const": true }
+  },
+  "$defs": {
+    "hash": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
+    "signature": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["algorithm", "publicKey", "value"],
+      "properties": {
+        "algorithm": { "const": "ed25519" },
+        "publicKey": { "type": "string" },
+        "value": { "type": "string" }
+      }
+    }
+  }
+}

package/docs/schemas/registry-seed-example-v1.schema.json

@@ -0,0 +1,102 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://bootproof.dev/schemas/registry-seed-example-v1.schema.json",
+  "title": "BootProof real-world registry seed example",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "name",
+    "source",
+    "structuralMarkers",
+    "expectedBootProof",
+    "safeNextStep",
+    "repairDisposition",
+    "externallyOrchestrated",
+    "evidenceOutcome",
+    "verificationBasis",
+    "redactionsApplied"
+  ],
+  "properties": {
+    "schema": {
+      "const": "bootproof/registry-seed-example/v1"
+    },
+    "name": {
+      "type": "string",
+      "minLength": 1
+    },
+    "source": {
+      "const": "synthetic_minimal_fixture"
+    },
+    "structuralMarkers": {
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "items": {
+        "type": "string",
+        "minLength": 1
+      }
+    },
+    "expectedBootProof": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "kind",
+        "values"
+      ],
+      "properties": {
+        "kind": {
+          "enum": [
+            "classification",
+            "inference",
+            "classification_and_inference",
+            "agent_plan"
+          ]
+        },
+        "values": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": {
+            "type": "string",
+            "minLength": 1
+          }
+        }
+      }
+    },
+    "safeNextStep": {
+      "type": "string",
+      "minLength": 1
+    },
+    "repairDisposition": {
+      "enum": [
+        "automatic",
+        "approval_required",
+        "refused"
+      ]
+    },
+    "externallyOrchestrated": {
+      "type": "boolean"
+    },
+    "evidenceOutcome": {
+      "enum": [
+        "verified_boot_possible",
+        "diagnostic_only"
+      ]
+    },
+    "verificationBasis": {
+      "type": "string",
+      "minLength": 1
+    },
+    "redactionsApplied": {
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "items": {
+        "type": "string",
+        "minLength": 1
+      }
+    }
+  }
+}
+

package/docs/schemas/repair-action-v1.schema.json

@@ -0,0 +1,136 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://bootproof.dev/schemas/repair-action-v1.schema.json",
+  "title": "BootProof Repair Action v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "actionType",
+    "mutationScope",
+    "riskLevel",
+    "requiresApproval",
+    "approvalPrompt",
+    "blockedReason",
+    "verificationStep",
+    "command",
+    "patch",
+    "instruction",
+    "explanation",
+    "evidenceRefs",
+    "deterministic",
+    "source"
+  ],
+  "properties": {
+    "schema": { "const": "bootproof/repair-action/v1" },
+    "actionType": { "enum": ["command", "patch", "instruction"] },
+    "mutationScope": { "enum": ["none", "repo_only", "project_cache", "container_runtime", "host_tool_install", "host_network", "kubernetes_cluster", "database", "service", "credentials", "unknown"] },
+    "riskLevel": { "enum": ["none", "low", "medium", "high", "blocked"] },
+    "requiresApproval": { "type": "boolean", "default": true },
+    "approvalPrompt": { "type": "string", "minLength": 1 },
+    "blockedReason": { "type": "string" },
+    "verificationStep": { "type": "string", "minLength": 1 },
+    "command": {
+      "anyOf": [
+        { "$ref": "#/$defs/command" },
+        { "type": "null" }
+      ]
+    },
+    "patch": {
+      "anyOf": [
+        { "$ref": "#/$defs/patch" },
+        { "type": "null" }
+      ]
+    },
+    "instruction": { "type": ["string", "null"] },
+    "explanation": { "type": "string", "minLength": 1 },
+    "evidenceRefs": {
+      "type": "array",
+      "items": { "type": "string" },
+      "uniqueItems": true
+    },
+    "deterministic": { "type": "boolean" },
+    "source": { "enum": ["deterministic_playbook", "ai_suggested"] }
+  },
+  "allOf": [
+    {
+      "if": { "properties": { "actionType": { "const": "command" } } },
+      "then": {
+        "properties": {
+          "command": { "$ref": "#/$defs/command" },
+          "patch": { "type": "null" },
+          "instruction": { "type": "null" },
+          "mutationScope": { "enum": ["none", "repo_only", "project_cache", "container_runtime", "host_tool_install", "host_network", "kubernetes_cluster", "database", "service", "credentials", "unknown"] }
+        }
+      }
+    },
+    {
+      "if": { "properties": { "actionType": { "const": "patch" } } },
+      "then": {
+        "properties": {
+          "command": { "type": "null" },
+          "patch": { "$ref": "#/$defs/patch" },
+          "instruction": { "type": "null" },
+          "mutationScope": { "const": "repo_only" },
+          "requiresApproval": { "const": true }
+        }
+      }
+    },
+    {
+      "if": { "properties": { "actionType": { "const": "instruction" } } },
+      "then": {
+        "properties": {
+          "command": { "type": "null" },
+          "patch": { "type": "null" },
+          "instruction": { "type": "string", "minLength": 1 }
+        }
+      }
+    },
+    {
+      "if": { "properties": { "riskLevel": { "enum": ["medium", "high"] } } },
+      "then": {
+        "properties": {
+          "requiresApproval": { "const": true }
+        }
+      }
+    },
+    {
+      "if": { "properties": { "source": { "const": "deterministic_playbook" } } },
+      "then": { "properties": { "deterministic": { "const": true } } }
+    },
+    {
+      "if": { "properties": { "source": { "const": "ai_suggested" } } },
+      "then": { "properties": { "deterministic": { "const": false } } }
+    }
+  ],
+  "$defs": {
+    "command": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["executable", "args", "display"],
+      "properties": {
+        "executable": { "type": "string", "minLength": 1 },
+        "args": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "display": { "type": "string", "minLength": 1 }
+      }
+    },
+    "patch": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["format", "content", "files"],
+      "properties": {
+        "format": { "const": "unified-diff" },
+        "content": { "type": "string", "minLength": 1 },
+        "files": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": { "type": "string", "minLength": 1 }
+        }
+      }
+    }
+  }
+}