owlrunkit 0.13.0 → 0.15.0

package/scripts/runkit-contract/lifecycle-orchestration.mjs

@@ -89,6 +89,98 @@ function ensureRegularDirectory(directoryPath, label) {
   return regularDirectory(directoryPath, label);
 }
 
+function verificationExecutableGate(executable) {
+  if (!path.isAbsolute(executable)) {
+    return {
+      valid: false,
+      issueCode: "verify_executable_absolute_path_required",
+      message: "verify executable after -- must be an absolute path.",
+    };
+  }
+  let stat;
+  try {
+    stat = lstatSync(executable);
+  } catch {
+    return {
+      valid: false,
+      issueCode: "verify_executable_missing",
+      message: "verify executable must be a regular file, not a symlink.",
+    };
+  }
+  if (stat.isSymbolicLink()) {
+    return {
+      valid: false,
+      issueCode: "verify_executable_symlink_rejected",
+      message: "verify executable must be a regular file, not a symlink.",
+    };
+  }
+  if (!stat.isFile()) {
+    return {
+      valid: false,
+      issueCode: "verify_executable_not_regular_file",
+      message: "verify executable must be a regular file, not a symlink.",
+    };
+  }
+  return { valid: true };
+}
+
+function recordRejectedVerificationPreflight({
+  workspaceRoot,
+  executionRoot,
+  runId,
+  verificationId,
+  executable,
+  commandArgv,
+  issueCode,
+}) {
+  const preflightsRoot = path.join(executionRoot, "verification-preflights");
+  const realRoot = ensureRegularDirectory(
+    preflightsRoot,
+    "Verification preflight directory",
+  );
+  if (
+    realRoot !== path.resolve(preflightsRoot)
+    || !within(realpathSync(executionRoot), realRoot)
+    || !within(realpathSync(workspaceRoot), realRoot)
+  ) {
+    throw new Error("Verification preflight directory must remain inside the execution.");
+  }
+  writeJsonExclusiveAtomically(path.join(realRoot, `${verificationId}.json`), {
+    schemaVersion: "OwlCodaRunKitVerificationPreflightV1",
+    runId,
+    verificationId,
+    status: "rejected",
+    issueCode,
+    executable,
+    commandArgvSha256: sha256(JSON.stringify(commandArgv)),
+    authorizationGranted: false,
+  });
+}
+
+function recordRejectedFinalizeAttempt({
+  workspaceRoot,
+  runId,
+  verificationId,
+  outputRoot,
+  finalizeRequestPath,
+  finalized,
+}) {
+  const relativeRequestPath = relativeToWorkspace(workspaceRoot, finalizeRequestPath);
+  const artifactPath = path.join(outputRoot, "finalize-result.json");
+  writeJsonExclusiveAtomically(artifactPath, {
+    schemaVersion: "OwlCodaRunKitVerificationFinalizeAttemptV1",
+    runId,
+    verificationId,
+    status: "rejected",
+    gateStatus: finalized.status,
+    finalizeRequestPath: relativeRequestPath,
+    finalizeRequestSha256: sha256(readFileSync(finalizeRequestPath)),
+    result: finalized,
+    authorizationGranted: false,
+  });
+  return relativeToWorkspace(workspaceRoot, artifactPath);
+}
+
 function gitVersion() {
   return execFileSync("git", ["--version"], { encoding: "utf8" })
     .trim()
@@ -203,6 +295,20 @@ function runHighLevelVerifyWithinControlTransaction({
   const { executionRoot, pinGate } = loadActiveExecution(workspaceRoot, runId);
   if (pinGate.status !== "valid") return { ...pinGate, authorizationGranted: false };
   regularDirectory(executionRoot, "Execution directory");
+  const [executable] = commandArgv;
+  const executableGate = verificationExecutableGate(executable);
+  if (!executableGate.valid) {
+    recordRejectedVerificationPreflight({
+      workspaceRoot,
+      executionRoot,
+      runId,
+      verificationId,
+      executable,
+      commandArgv,
+      issueCode: executableGate.issueCode,
+    });
+    throw new Error(executableGate.message);
+  }
   for (const [name, label, create] of [
     ["delivery-packets", "Delivery packet directory", false],
     ["snapshots", "Snapshot directory", true],
@@ -213,9 +319,6 @@ function runHighLevelVerifyWithinControlTransaction({
     if (create) ensureRegularDirectory(directoryPath, label);
     else regularDirectory(directoryPath, label);
   }
-  const [executable] = commandArgv;
-  if (!path.isAbsolute(executable)) throw new Error("verify executable after -- must be an absolute path.");
-  regularFile(executable, "verify executable");
   const realCwd = realpathSync(cwd === "." ? workspaceRoot : path.join(workspaceRoot, cwd));
   if (!within(workspaceRoot, realCwd)) throw new Error("verify cwd escapes the workspace through a symlink.");
   for (const outputPath of [
@@ -269,7 +372,19 @@ function runHighLevelVerifyWithinControlTransaction({
   };
   writeJsonExclusiveAtomically(finalizeRequestPath, finalizeRequest);
   const finalized = runFinalize({ workspaceRoot, runId, request: finalizeRequest });
-  if (finalized.status !== "accepted_passed") return finalized;
+  if (finalized.status !== "accepted_passed") {
+    return {
+      ...finalized,
+      finalizeResultPath: recordRejectedFinalizeAttempt({
+        workspaceRoot,
+        runId,
+        verificationId,
+        outputRoot,
+        finalizeRequestPath,
+        finalized,
+      }),
+    };
+  }
   return {
     status: "verified",
     exitCode: 0,