onto-mcp 0.4.11 → 0.4.13

package/dist/core-runtime/reconstruct/registry-verification-validation.js

@@ -1,7 +1,9 @@
 import crypto from "node:crypto";
 import fs from "node:fs/promises";
 import path from "node:path";
-import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
+import { parse as parseYaml } from "yaml";
+import { assertArrayField, atomicWriteYamlDocument as writeYamlDocument } from "../artifact-io.js";
+import { assertObligation } from "./obligation-assertion.js";
 import { loadReconstructContractRegistry, } from "./contract-registry.js";
 function isoNow() {
     return new Date().toISOString();
@@ -12,10 +14,6 @@ async function sha256File(filePath) {
         .update(await fs.readFile(filePath))
         .digest("hex");
 }
-async function writeYamlDocument(filePath, value) {
-    await fs.mkdir(path.dirname(filePath), { recursive: true });
-    await fs.writeFile(filePath, stringifyYaml(value), "utf8");
-}
 async function readYamlDocument(filePath) {
     return parseYaml(await fs.readFile(filePath, "utf8"));
 }
@@ -30,6 +28,10 @@ function evidenceRow(args) {
     };
 }
 export async function buildRegistryVerificationEvidenceArtifact(args) {
+    assertArrayField(args.contractRegistry.validation_gate_catalog, "contract-registry", "validation_gate_catalog");
+    assertArrayField(args.contractRegistry.validator_records, "contract-registry", "validator_records");
+    assertArrayField(args.contractRegistry.required_when_predicate_catalog, "contract-registry", "required_when_predicate_catalog");
+    assertArrayField(args.contractRegistry.source_profile_records, "contract-registry", "source_profile_records");
     const registryRef = path.resolve(args.registryPath);
     const registryHash = await sha256File(registryRef);
     const artifactAuthorityIds = Object.keys(args.contractRegistry.artifact_authorities)
@@ -106,19 +108,23 @@ function sortedArtifactAuthorityIds(registry) {
     return Object.keys(registry.artifact_authorities).sort();
 }
 function sortedValidationGateIds(registry) {
+    assertArrayField(registry.validation_gate_catalog, "contract-registry", "validation_gate_catalog");
     return registry.validation_gate_catalog.map((gate) => gate.gate_id).sort();
 }
 function sortedValidatorIds(registry) {
+    assertArrayField(registry.validator_records, "contract-registry", "validator_records");
     return registry.validator_records
         .map((validator) => validator.validator_id)
         .sort();
 }
 function sortedPredicateIds(registry) {
+    assertArrayField(registry.required_when_predicate_catalog, "contract-registry", "required_when_predicate_catalog");
     return registry.required_when_predicate_catalog
         .map((predicate) => predicate.predicate_id)
         .sort();
 }
 function sortedSourceProfileIds(registry) {
+    assertArrayField(registry.source_profile_records, "contract-registry", "source_profile_records");
     return registry.source_profile_records
         .map((profile) => profile.profile_id)
         .sort();
@@ -142,7 +148,30 @@ function violation(args) {
     };
 }
 export function validateRegistryVerificationEvidence(args) {
+    assertArrayField(args.evidence.evidence_rows, "registry-verification-evidence", "evidence_rows");
+    assertArrayField(args.evidence.active_artifact_authority_ids, "registry-verification-evidence", "active_artifact_authority_ids");
+    assertArrayField(args.evidence.active_validation_gate_ids, "registry-verification-evidence", "active_validation_gate_ids");
+    assertArrayField(args.evidence.active_validator_ids, "registry-verification-evidence", "active_validator_ids");
+    assertArrayField(args.evidence.required_when_predicate_ids, "registry-verification-evidence", "required_when_predicate_ids");
+    assertArrayField(args.evidence.source_profile_ids, "registry-verification-evidence", "source_profile_ids");
+    assertArrayField(args.contractRegistry.validator_records, "contract-registry", "validator_records");
+    assertArrayField(args.contractRegistry.validation_gate_catalog, "contract-registry", "validation_gate_catalog");
+    assertArrayField(args.contractRegistry.required_when_predicate_catalog, "contract-registry", "required_when_predicate_catalog");
     const violations = [];
+    // G(a) obligation recorder (INV-OBLIGATION-COVERAGE-1): record that control
+    // reached each enforcer block below. Unconditional, before any per-row/per-loop
+    // guard so a zero-row clean input still stamps every recorded obligation.
+    // (validate_registry_snapshot_hash_matches_current_registry_file is PARKED: the
+    // match check is gated on the caller-supplied optional expectedRegistrySha256,
+    // not enforced internally — see obligation-coverage-ledger.yaml.)
+    const assertedObligationIds = [];
+    assertObligation(assertedObligationIds, "validate_registry_snapshot_hash_is_recorded");
+    assertObligation(assertedObligationIds, "validate_active_artifact_gate_validator_predicate_and_source_profile_ids_are_unique");
+    assertObligation(assertedObligationIds, "validate_active_registry_subject_lists_match_current_registry_catalogs");
+    assertObligation(assertedObligationIds, "validate_every_active_gate_has_a_validator_record");
+    assertObligation(assertedObligationIds, "validate_every_validator_gate_ref_resolves_to_an_active_gate");
+    assertObligation(assertedObligationIds, "validate_every_active_gate_required_when_predicate_resolves");
+    assertObligation(assertedObligationIds, "require_evidence_row_for_each_current_registry_subject_id");
     const expectedRegistryRef = args.expectedRegistryRef
         ? path.resolve(args.expectedRegistryRef)
         : null;
@@ -339,10 +368,14 @@ export function validateRegistryVerificationEvidence(args) {
         validation_results: violations.length === 0
             ? ["registry_verification_evidence_valid"]
             : ["registry_verification_evidence_invalid"],
+        asserted_obligation_ids: assertedObligationIds,
         violations,
     };
 }
 export async function writeRegistryVerificationEvidenceArtifact(args) {
+    // Registry verification is the gate that proves the on-disk registry is
+    // well-formed, so it always loads from `registryPath` itself rather than
+    // accepting a threaded in-memory registry that could belong to another path.
     const contractRegistry = await loadReconstructContractRegistry({
         registryPath: args.registryPath,
     });
@@ -355,6 +388,9 @@ export async function writeRegistryVerificationEvidenceArtifact(args) {
     return artifact;
 }
 export async function writeRegistryVerificationEvidenceValidationArtifact(args) {
+    // Loads the registry from `registryPath` itself (never a threaded object):
+    // this gate hashes the on-disk file and compares it against the evidence, so
+    // the parsed IDs must come from the same path being hashed.
     const [evidence, contractRegistry] = await Promise.all([
         readYamlDocument(args.evidencePath),
         loadReconstructContractRegistry({ registryPath: args.registryPath }),