bootproof 0.3.0 → 0.4.1

package/docs/schemas/federated-receipt-v1.schema.json

@@ -0,0 +1,51 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://bootproof.dev/schemas/federated-receipt-v1.schema.json",
+  "title": "BootProof Federated Receipt v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "createdAt",
+    "registryEntry",
+    "attestationHash",
+    "publicRepoDeclaration",
+    "crawlerHint",
+    "redactionsApplied",
+    "noSecretsIncluded"
+  ],
+  "properties": {
+    "schema": { "const": "bootproof/federated-receipt/v1" },
+    "createdAt": { "type": "string", "format": "date-time" },
+    "registryEntry": { "$ref": "registry-entry-v1.schema.json" },
+    "attestationHash": { "$ref": "#/$defs/hash" },
+    "repairReceiptHash": { "$ref": "#/$defs/hash" },
+    "signature": { "$ref": "#/$defs/signature" },
+    "publicRepoDeclaration": { "const": true },
+    "crawlerHint": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["commitHash", "branch"],
+      "properties": {
+        "repoUrl": { "type": "string", "format": "uri" },
+        "commitHash": { "type": ["string", "null"] },
+        "branch": { "type": ["string", "null"] }
+      }
+    },
+    "redactionsApplied": { "type": "array", "items": { "type": "string" }, "uniqueItems": true },
+    "noSecretsIncluded": { "const": true }
+  },
+  "$defs": {
+    "hash": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
+    "signature": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["algorithm", "publicKey", "value"],
+      "properties": {
+        "algorithm": { "const": "ed25519" },
+        "publicKey": { "type": "string" },
+        "value": { "type": "string" }
+      }
+    }
+  }
+}

package/docs/schemas/registry-entry-v1.schema.json

@@ -0,0 +1,95 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://bootproof.dev/schemas/registry-entry-v1.schema.json",
+  "title": "BootProof Registry Entry v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "createdAt",
+    "bootproofVersion",
+    "source",
+    "registryMode",
+    "repoFingerprint",
+    "repoHost",
+    "repoOwnerHash",
+    "repoNameHash",
+    "commitHash",
+    "branch",
+    "os",
+    "arch",
+    "platform",
+    "packageManager",
+    "detectedStack",
+    "detectedServices",
+    "selectedCommandHash",
+    "selectedCommandRedacted",
+    "failureClass",
+    "failureEvidenceFingerprint",
+    "evidenceHeadRedacted",
+    "evidenceTailRedacted",
+    "healthStatus",
+    "healthUrlPattern",
+    "healthRedirectLocationPattern",
+    "verified",
+    "attestationHash",
+    "redactionsApplied",
+    "optInRequired"
+  ],
+  "properties": {
+    "schema": { "const": "bootproof/registry-entry/v1" },
+    "createdAt": { "type": "string", "format": "date-time" },
+    "bootproofVersion": { "type": "string", "minLength": 1 },
+    "source": { "const": "local_cli" },
+    "registryMode": {
+      "enum": ["local_export", "federated_public_candidate", "cloud_upload_candidate"]
+    },
+    "repoFingerprint": { "$ref": "#/$defs/hash" },
+    "repoHost": { "type": ["string", "null"] },
+    "repoOwnerHash": { "$ref": "#/$defs/hash" },
+    "repoNameHash": { "$ref": "#/$defs/hash" },
+    "publicRepoHint": { "type": "string", "format": "uri" },
+    "commitHash": { "type": ["string", "null"] },
+    "branch": { "type": ["string", "null"] },
+    "os": { "type": "string" },
+    "arch": { "type": "string" },
+    "platform": { "type": "string" },
+    "packageManager": { "type": "string" },
+    "detectedStack": { "type": "array", "items": { "type": "string" }, "uniqueItems": true },
+    "detectedServices": { "type": "array", "items": { "type": "string" }, "uniqueItems": true },
+    "selectedCommandHash": { "anyOf": [{ "$ref": "#/$defs/hash" }, { "type": "null" }] },
+    "selectedCommandRedacted": { "type": ["string", "null"] },
+    "failureClass": { "type": ["string", "null"] },
+    "failureEvidenceFingerprint": { "anyOf": [{ "$ref": "#/$defs/hash" }, { "type": "null" }] },
+    "evidenceHeadRedacted": { "type": ["string", "null"] },
+    "evidenceTailRedacted": { "type": ["string", "null"] },
+    "healthStatus": { "enum": ["healthy", "unhealthy", "connection_error", "not_observed"] },
+    "healthUrlPattern": { "type": ["string", "null"] },
+    "healthRedirectLocationPattern": { "type": ["string", "null"] },
+    "repairActionType": { "enum": ["repo-diff", "plan-step", "environment"] },
+    "repairCommandHash": { "$ref": "#/$defs/hash" },
+    "repairCommandRedacted": { "type": "string" },
+    "beforeFailureClass": { "type": "string" },
+    "afterFailureClass": { "type": "string" },
+    "progressed": { "type": "boolean" },
+    "verified": { "type": "boolean" },
+    "attestationHash": { "$ref": "#/$defs/hash" },
+    "repairReceiptHash": { "$ref": "#/$defs/hash" },
+    "redactionsApplied": { "type": "array", "items": { "type": "string" }, "uniqueItems": true },
+    "signature": { "$ref": "#/$defs/signature" },
+    "optInRequired": { "const": true }
+  },
+  "$defs": {
+    "hash": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
+    "signature": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["algorithm", "publicKey", "value"],
+      "properties": {
+        "algorithm": { "const": "ed25519" },
+        "publicKey": { "type": "string" },
+        "value": { "type": "string" }
+      }
+    }
+  }
+}

package/docs/schemas/registry-seed-example-v1.schema.json

@@ -0,0 +1,102 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://bootproof.dev/schemas/registry-seed-example-v1.schema.json",
+  "title": "BootProof real-world registry seed example",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "name",
+    "source",
+    "structuralMarkers",
+    "expectedBootProof",
+    "safeNextStep",
+    "repairDisposition",
+    "externallyOrchestrated",
+    "evidenceOutcome",
+    "verificationBasis",
+    "redactionsApplied"
+  ],
+  "properties": {
+    "schema": {
+      "const": "bootproof/registry-seed-example/v1"
+    },
+    "name": {
+      "type": "string",
+      "minLength": 1
+    },
+    "source": {
+      "const": "synthetic_minimal_fixture"
+    },
+    "structuralMarkers": {
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "items": {
+        "type": "string",
+        "minLength": 1
+      }
+    },
+    "expectedBootProof": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "kind",
+        "values"
+      ],
+      "properties": {
+        "kind": {
+          "enum": [
+            "classification",
+            "inference",
+            "classification_and_inference",
+            "agent_plan"
+          ]
+        },
+        "values": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": {
+            "type": "string",
+            "minLength": 1
+          }
+        }
+      }
+    },
+    "safeNextStep": {
+      "type": "string",
+      "minLength": 1
+    },
+    "repairDisposition": {
+      "enum": [
+        "automatic",
+        "approval_required",
+        "refused"
+      ]
+    },
+    "externallyOrchestrated": {
+      "type": "boolean"
+    },
+    "evidenceOutcome": {
+      "enum": [
+        "verified_boot_possible",
+        "diagnostic_only"
+      ]
+    },
+    "verificationBasis": {
+      "type": "string",
+      "minLength": 1
+    },
+    "redactionsApplied": {
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "items": {
+        "type": "string",
+        "minLength": 1
+      }
+    }
+  }
+}
+

package/docs/schemas/repair-action-v1.schema.json

@@ -0,0 +1,136 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://bootproof.dev/schemas/repair-action-v1.schema.json",
+  "title": "BootProof Repair Action v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "actionType",
+    "mutationScope",
+    "riskLevel",
+    "requiresApproval",
+    "approvalPrompt",
+    "blockedReason",
+    "verificationStep",
+    "command",
+    "patch",
+    "instruction",
+    "explanation",
+    "evidenceRefs",
+    "deterministic",
+    "source"
+  ],
+  "properties": {
+    "schema": { "const": "bootproof/repair-action/v1" },
+    "actionType": { "enum": ["command", "patch", "instruction"] },
+    "mutationScope": { "enum": ["none", "repo_only", "project_cache", "container_runtime", "host_tool_install", "host_network", "kubernetes_cluster", "database", "service", "credentials", "unknown"] },
+    "riskLevel": { "enum": ["none", "low", "medium", "high", "blocked"] },
+    "requiresApproval": { "type": "boolean", "default": true },
+    "approvalPrompt": { "type": "string", "minLength": 1 },
+    "blockedReason": { "type": "string" },
+    "verificationStep": { "type": "string", "minLength": 1 },
+    "command": {
+      "anyOf": [
+        { "$ref": "#/$defs/command" },
+        { "type": "null" }
+      ]
+    },
+    "patch": {
+      "anyOf": [
+        { "$ref": "#/$defs/patch" },
+        { "type": "null" }
+      ]
+    },
+    "instruction": { "type": ["string", "null"] },
+    "explanation": { "type": "string", "minLength": 1 },
+    "evidenceRefs": {
+      "type": "array",
+      "items": { "type": "string" },
+      "uniqueItems": true
+    },
+    "deterministic": { "type": "boolean" },
+    "source": { "enum": ["deterministic_playbook", "ai_suggested"] }
+  },
+  "allOf": [
+    {
+      "if": { "properties": { "actionType": { "const": "command" } } },
+      "then": {
+        "properties": {
+          "command": { "$ref": "#/$defs/command" },
+          "patch": { "type": "null" },
+          "instruction": { "type": "null" },
+          "mutationScope": { "enum": ["none", "repo_only", "project_cache", "container_runtime", "host_tool_install", "host_network", "kubernetes_cluster", "database", "service", "credentials", "unknown"] }
+        }
+      }
+    },
+    {
+      "if": { "properties": { "actionType": { "const": "patch" } } },
+      "then": {
+        "properties": {
+          "command": { "type": "null" },
+          "patch": { "$ref": "#/$defs/patch" },
+          "instruction": { "type": "null" },
+          "mutationScope": { "const": "repo_only" },
+          "requiresApproval": { "const": true }
+        }
+      }
+    },
+    {
+      "if": { "properties": { "actionType": { "const": "instruction" } } },
+      "then": {
+        "properties": {
+          "command": { "type": "null" },
+          "patch": { "type": "null" },
+          "instruction": { "type": "string", "minLength": 1 }
+        }
+      }
+    },
+    {
+      "if": { "properties": { "riskLevel": { "enum": ["medium", "high"] } } },
+      "then": {
+        "properties": {
+          "requiresApproval": { "const": true }
+        }
+      }
+    },
+    {
+      "if": { "properties": { "source": { "const": "deterministic_playbook" } } },
+      "then": { "properties": { "deterministic": { "const": true } } }
+    },
+    {
+      "if": { "properties": { "source": { "const": "ai_suggested" } } },
+      "then": { "properties": { "deterministic": { "const": false } } }
+    }
+  ],
+  "$defs": {
+    "command": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["executable", "args", "display"],
+      "properties": {
+        "executable": { "type": "string", "minLength": 1 },
+        "args": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "display": { "type": "string", "minLength": 1 }
+      }
+    },
+    "patch": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["format", "content", "files"],
+      "properties": {
+        "format": { "const": "unified-diff" },
+        "content": { "type": "string", "minLength": 1 },
+        "files": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": { "type": "string", "minLength": 1 }
+        }
+      }
+    }
+  }
+}

package/docs/schemas/repair-receipt-v1.schema.json

@@ -0,0 +1,221 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://bootproof.dev/schemas/repair-receipt-v1.schema.json",
+  "title": "BootProof Repair Receipt v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "repairId",
+    "createdAt",
+    "bootproofVersion",
+    "source",
+    "beforeFailureClass",
+    "beforeEvidenceHash",
+    "proposedAction",
+    "actionType",
+    "mutationScope",
+    "riskLevel",
+    "userApprovalRequired",
+    "applyResult",
+    "progressed",
+    "verified",
+    "explanation",
+    "redactionsApplied"
+  ],
+  "properties": {
+    "schema": { "const": "bootproof/repair-receipt/v1" },
+    "repairId": { "type": "string", "minLength": 1 },
+    "createdAt": { "type": "string", "format": "date-time" },
+    "bootproofVersion": { "type": "string", "minLength": 1 },
+    "source": { "enum": ["deterministic_playbook", "ai_suggested"] },
+    "beforeFailureClass": { "type": "string", "minLength": 1 },
+    "beforeEvidenceHash": { "$ref": "#/$defs/hash" },
+    "proposedAction": { "$ref": "repair-action-v1.schema.json" },
+    "actionType": { "enum": ["command", "patch", "instruction"] },
+    "mutationScope": { "enum": ["none", "repo_only", "project_cache", "container_runtime", "host_tool_install", "host_network", "kubernetes_cluster", "database", "service", "credentials", "unknown"] },
+    "riskLevel": { "enum": ["none", "low", "medium", "high", "blocked"] },
+    "userApprovalRequired": { "type": "boolean" },
+    "approvedAt": { "type": "string", "format": "date-time" },
+    "appliedAt": { "type": "string", "format": "date-time" },
+    "applyResult": { "$ref": "#/$defs/applyResult" },
+    "afterFailureClass": { "type": "string", "minLength": 1 },
+    "progressed": { "type": "boolean" },
+    "verified": { "type": "boolean" },
+    "explanation": { "type": "string", "minLength": 1 },
+    "redactionsApplied": {
+      "type": "array",
+      "items": { "type": "string" },
+      "uniqueItems": true
+    },
+    "tool": { "type": "string" },
+    "repo": { "$ref": "#/$defs/repo" },
+    "environment": { "$ref": "#/$defs/environment" },
+    "failure": { "$ref": "#/$defs/failure" },
+    "repair": { "$ref": "#/$defs/legacyRepair" },
+    "verification": { "$ref": "#/$defs/verification" },
+    "aiEvidence": { "$ref": "#/$defs/aiEvidence" },
+    "startedAt": { "type": "string", "format": "date-time" },
+    "finishedAt": { "type": "string", "format": "date-time" },
+    "signer": {
+      "anyOf": [
+        { "$ref": "#/$defs/signer" },
+        { "type": "null" }
+      ]
+    },
+    "signature": { "type": ["string", "null"] }
+  },
+  "$defs": {
+    "hash": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
+    "applyResult": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["status", "exitCode", "filesChanged", "evidence"],
+      "properties": {
+        "status": { "enum": ["not_applied", "applied", "failed"] },
+        "exitCode": { "type": ["integer", "null"] },
+        "filesChanged": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "evidence": { "type": ["string", "null"] }
+      }
+    },
+    "repo": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["remote", "commit", "dirty"],
+      "properties": {
+        "remote": { "type": ["string", "null"] },
+        "commit": { "type": ["string", "null"] },
+        "dirty": { "type": ["boolean", "null"] }
+      }
+    },
+    "environment": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["os", "arch", "node"],
+      "properties": {
+        "os": { "type": "string" },
+        "arch": { "type": "string" },
+        "node": { "type": "string" }
+      }
+    },
+    "failure": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["class", "beforeAttestationSha256"],
+      "properties": {
+        "class": { "type": "string" },
+        "beforeAttestationSha256": { "$ref": "#/$defs/hash" }
+      }
+    },
+    "legacyRepair": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "id",
+        "kind",
+        "description",
+        "diff",
+        "filesChanged",
+        "fileChanges",
+        "preconditions",
+        "planDelta",
+        "envDelta"
+      ],
+      "properties": {
+        "id": { "type": "string" },
+        "kind": { "enum": ["repo-diff", "plan-step", "environment"] },
+        "description": { "type": "string" },
+        "diff": { "type": ["string", "null"] },
+        "filesChanged": { "type": "array", "items": { "type": "string" } },
+        "fileChanges": { "type": "array", "items": { "$ref": "#/$defs/fileChange" } },
+        "preconditions": { "type": "array", "items": { "$ref": "#/$defs/precondition" } },
+        "planDelta": { "type": ["string", "null"] },
+        "envDelta": { "type": ["string", "null"] }
+      }
+    },
+    "fileChange": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["path", "beforeSha256", "afterSha256", "beforeContent", "afterContent"],
+      "properties": {
+        "path": { "type": "string" },
+        "beforeSha256": {
+          "anyOf": [
+            { "$ref": "#/$defs/hash" },
+            { "type": "null" }
+          ]
+        },
+        "afterSha256": { "$ref": "#/$defs/hash" },
+        "beforeContent": { "type": ["string", "null"] },
+        "afterContent": { "type": "string" }
+      }
+    },
+    "precondition": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["path", "sha256"],
+      "properties": {
+        "path": { "type": "string" },
+        "sha256": { "$ref": "#/$defs/hash" }
+      }
+    },
+    "verification": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["before", "after"],
+      "properties": {
+        "before": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["booted", "failureClass", "attestationSha256"],
+          "properties": {
+            "booted": { "const": false },
+            "failureClass": { "type": "string" },
+            "attestationSha256": { "$ref": "#/$defs/hash" }
+          }
+        },
+        "after": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["booted", "bootproofOrchestrated", "healthObservation", "attestationSha256"],
+          "properties": {
+            "booted": { "type": "boolean" },
+            "bootproofOrchestrated": { "type": "boolean" },
+            "healthObservation": { "type": "string" },
+            "attestationSha256": { "$ref": "#/$defs/hash" }
+          }
+        }
+      }
+    },
+    "signer": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["publicKey", "algorithm"],
+      "properties": {
+        "publicKey": { "type": "string" },
+        "algorithm": { "const": "ed25519" }
+      }
+    },
+    "aiEvidence": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["provider", "model", "context", "suggestion"],
+      "description": "AI prompt and response evidence for auditability. Present only when source === 'ai_suggested'. The context is redacted before storage; the suggestion is the validated structured response.",
+      "properties": {
+        "provider": { "enum": ["openai", "anthropic"] },
+        "model": { "type": "string", "minLength": 1 },
+        "context": {
+          "type": "object",
+          "description": "The redacted bootproof/ai-repair-context/v1 object sent to the AI provider."
+        },
+        "suggestion": {
+          "type": "object",
+          "description": "The validated bootproof/ai-repair-suggestion/v1 object the AI returned."
+        }
+      }
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bootproof",
-  "version": "0.3.0",
+  "version": "0.4.1",
   "description": "The honest run button for repos. Boots unfamiliar code when it safely can, tells the truth when it cannot, and signs proof of what happened.",
   "license": "Apache-2.0",
   "type": "module",
@@ -15,25 +15,31 @@
   ],
   "scripts": {
     "clean": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\"",
-    "build": "npm run clean && tsc -p tsconfig.json",
+    "build": "npm run clean && tsc -p tsconfig.json && chmod +x dist/cli.js",
     "prepack": "npm run build",
     "pack:check": "node scripts/pack-smoke.mjs",
     "release:check": "npm test && npm run build && npm run pack:check && npm publish --dry-run",
     "lint": "tsc -p tsconfig.json --noEmit",
-    "test": "npm run build && node --test tests/unit.test.mjs tests/e2e.test.mjs",
+    "test": "npm run build && node --test tests/unit.test.mjs tests/action.test.mjs tests/e2e.test.mjs tests/receipt.test.mjs",
     "ci": "npm run lint && npm run test"
   },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/rossbuckley1990-hash/bootproof.git"
+    "url": "git+https://github.com/bootproof/bootproof.git"
   },
   "keywords": [
-    "devtools",
-    "onboarding",
-    "docker",
-    "run",
     "attestation",
-    "reproducibility"
+    "runtime-verification",
+    "ai-agents",
+    "claude-code",
+    "ci",
+    "signed",
+    "receipt",
+    "proof",
+    "health-check",
+    "supply-chain",
+    "provenance",
+    "verification"
   ],
   "engines": {
     "node": ">=20.11"
@@ -42,13 +48,17 @@
     "access": "public"
   },
   "devDependencies": {
+    "@noble/curves": "^1.6.0",
+    "@noble/hashes": "^1.5.0",
     "@types/node": "^22.19.20",
+    "esbuild": "^0.28.1",
+    "playwright": "^1.61.1",
     "typescript": "5.8.3"
   },
   "bugs": {
-    "url": "https://github.com/rossbuckley1990-hash/bootproof/issues"
+    "url": "https://github.com/bootproof/bootproof/issues"
   },
-  "homepage": "https://github.com/rossbuckley1990-hash/bootproof#readme",
+  "homepage": "https://github.com/bootproof/bootproof#readme",
   "dependencies": {
     "yaml": "^2.9.0"
   }