owlrunkit 0.13.0

package/packages/attest/src/index.mjs

@@ -0,0 +1,113 @@
+import {
+  PUBLIC_VERIFIER_LIMITS,
+  canonicalJson,
+  decodeUtf8Strict,
+  hasExactKeys,
+  isPlainJsonObject,
+  isPlainObject,
+  isSha256Ref,
+  parseJsonStrict,
+  readFileBytesBounded,
+  sha256Bytes,
+  sha256Canonical,
+  verifyBundle,
+} from "./formal.mjs";
+import {
+  SUPPORTED_QUICK_CORE_IDENTITIES,
+  attestQuickReceipt,
+  attestQuickReceiptDetails,
+  attestQuickReceiptDetailsFromBytes,
+  validQuickReceiptShape,
+} from "./quick.mjs";
+import {
+  createAttestationRef,
+  parseAttestationRef,
+  resolveAttestationRef,
+} from "./reference.mjs";
+import {
+  createOfflineAttestationBundle,
+  parseOfflineAttestationBundle,
+} from "./offline-bundle.mjs";
+import { captureWorkspaceSnapshot } from "./workspace-snapshot.mjs";
+
+function readSubject(subjectPath) {
+  const { absolutePath, bytes } = readFileBytesBounded(subjectPath);
+  return {
+    absolutePath,
+    bytes,
+    value: parseJsonStrict(decodeUtf8Strict(bytes)),
+  };
+}
+
+export function attestFile({ subjectPath, workspaceRoot }) {
+  const subject = readSubject(subjectPath);
+  if (subject.value.schemaVersion === "OwlCodaQuickVerificationReceiptV1") {
+    const details = attestQuickReceiptDetailsFromBytes({
+      receiptPath: subject.absolutePath,
+      receiptBytes: subject.bytes,
+      workspaceRoot,
+    });
+    return {
+      schemaVersion: "OwlCodaAttestCommandResultV1",
+      status: "quick_attestation",
+      decision: details.attestation.decision,
+      exitCode: details.exitCode,
+      receiptPath: subject.absolutePath,
+      receiptSha256: sha256Bytes(subject.bytes),
+      sourceFingerprint: details.sourceFingerprint,
+      attestation: details.attestation,
+      nextAllowedAction: details.attestation.decision === "GO"
+        ? "consume_attestation"
+        : "repair_or_replace_evidence",
+      authorizationGranted: false,
+      networkRequests: 0,
+    };
+  }
+  if (subject.value.schemaVersion === "OwlCodaRunKitPublicVerificationBundleV1") {
+    const formalVerification = verifyBundle(subject.value);
+    const accepted = formalVerification.valid
+      && formalVerification.decision === "accepted";
+    return {
+      schemaVersion: "OwlCodaAttestCommandResultV1",
+      status: "formal_attestation",
+      decision: accepted ? "GO" : "NO_GO",
+      exitCode: accepted ? 0 : 1,
+      subjectPath: subject.absolutePath,
+      subjectSha256: sha256Bytes(subject.bytes),
+      formalVerification,
+      nextAllowedAction: accepted
+        ? "consume_attestation"
+        : formalVerification.valid
+          ? "honor_formal_decision"
+          : "repair_or_replace_evidence",
+      authorizationGranted: false,
+      networkRequests: 0,
+    };
+  }
+  const error = new Error("unsupported attestation subject schemaVersion");
+  error.code = "receipt_schema_invalid";
+  throw error;
+}
+
+export {
+  PUBLIC_VERIFIER_LIMITS,
+  SUPPORTED_QUICK_CORE_IDENTITIES,
+  attestQuickReceipt,
+  attestQuickReceiptDetails,
+  canonicalJson,
+  captureWorkspaceSnapshot,
+  createAttestationRef,
+  createOfflineAttestationBundle,
+  hasExactKeys,
+  isPlainJsonObject,
+  isPlainObject,
+  isSha256Ref,
+  parseAttestationRef,
+  parseOfflineAttestationBundle,
+  parseJsonStrict,
+  resolveAttestationRef,
+  sha256Bytes,
+  sha256Canonical,
+  validQuickReceiptShape,
+  verifyBundle,
+};

package/packages/attest/src/offline-bundle.mjs

@@ -0,0 +1,108 @@
+import {
+  decodeUtf8Strict,
+  hasExactKeys,
+  parseJsonStrict,
+  readFileBytesBounded,
+  sha256Bytes,
+} from "./formal.mjs";
+import {
+  createAttestationRef,
+  parseAttestationRef,
+} from "./reference-contract.mjs";
+import { validQuickReceiptShape } from "./quick-receipt-contract.mjs";
+
+const REQUIRED_KEYS = [
+  "schemaVersion",
+  "reference",
+  "receiptByteLength",
+  "receiptBytesBase64",
+];
+
+function bundleError(code, message) {
+  const error = new Error(message);
+  error.code = code;
+  return error;
+}
+
+function decodeBase64Strict(value) {
+  if (
+    typeof value !== "string"
+    || value.length === 0
+    || value.length % 4 !== 0
+    || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(value)
+  ) {
+    throw bundleError("offline_bundle_invalid", "offline receipt bytes must use canonical base64");
+  }
+  const bytes = Buffer.from(value, "base64");
+  if (bytes.toString("base64") !== value) {
+    throw bundleError("offline_bundle_invalid", "offline receipt bytes must use canonical base64");
+  }
+  return bytes;
+}
+
+function validateReceiptBinding(reference, receiptBytes) {
+  if (sha256Bytes(receiptBytes) !== reference.receiptSha256) {
+    throw bundleError("offline_bundle_hash_mismatch", "offline receipt bytes do not match the reference hash");
+  }
+  let receipt;
+  try {
+    receipt = parseJsonStrict(decodeUtf8Strict(receiptBytes));
+  } catch (error) {
+    if (error?.code === "DUPLICATE_OBJECT_KEY") error.code = "receipt_duplicate_key";
+    throw error;
+  }
+  if (
+    !validQuickReceiptShape(receipt)
+    || receipt.receiptId !== reference.receiptId
+    || receipt.coreIdentity.contractVersion !== reference.coreIdentity.contractVersion
+    || receipt.coreIdentity.coreManifestSha256 !== reference.coreIdentity.coreManifestSha256
+  ) {
+    throw bundleError("offline_bundle_reference_mismatch", "offline receipt identity does not match its reference");
+  }
+}
+
+export function createOfflineAttestationBundle(receiptPath) {
+  const reference = createAttestationRef(receiptPath);
+  const { bytes } = readFileBytesBounded(receiptPath);
+  validateReceiptBinding(reference, bytes);
+  return {
+    schemaVersion: "OwlCodaOfflineAttestationBundleV1",
+    reference,
+    receiptByteLength: bytes.byteLength,
+    receiptBytesBase64: bytes.toString("base64"),
+  };
+}
+
+export function parseOfflineAttestationBundle(input) {
+  let value;
+  try {
+    value = typeof input === "string" ? parseJsonStrict(input) : input;
+  } catch (error) {
+    if (error?.code === "DUPLICATE_OBJECT_KEY") error.code = "receipt_duplicate_key";
+    throw error;
+  }
+  if (
+    !hasExactKeys(value, REQUIRED_KEYS)
+    || value.schemaVersion !== "OwlCodaOfflineAttestationBundleV1"
+    || !Number.isSafeInteger(value.receiptByteLength)
+    || value.receiptByteLength < 1
+  ) {
+    throw bundleError("offline_bundle_invalid", "bundle does not satisfy OwlCodaOfflineAttestationBundleV1");
+  }
+  let reference;
+  try {
+    reference = parseAttestationRef(value.reference);
+  } catch {
+    throw bundleError("offline_bundle_invalid", "bundle contains an invalid AttestationRefV1");
+  }
+  const receiptBytes = decodeBase64Strict(value.receiptBytesBase64);
+  if (receiptBytes.byteLength !== value.receiptByteLength) {
+    throw bundleError("offline_bundle_size_mismatch", "offline receipt byte length does not match");
+  }
+  validateReceiptBinding(reference, receiptBytes);
+  return {
+    bundle: value,
+    reference,
+    receiptBytes,
+  };
+}

package/packages/attest/src/quick-receipt-contract.mjs

@@ -0,0 +1,156 @@
+import {
+  hasExactKeys,
+  isSha256Ref,
+  sha256Canonical,
+} from "./formal.mjs";
+
+const RECEIPT_REQUIRED_KEYS = [
+  "schemaVersion",
+  "receiptId",
+  "assurance",
+  "authorizationGranted",
+  "coreIdentity",
+  "workspaceBefore",
+  "exactCommand",
+  "verificationContext",
+  "startedAt",
+  "finishedAt",
+  "exitResult",
+  "outputArtifacts",
+  "workspaceAfter",
+  "mutationDecision",
+  "issueCodes",
+];
+const SNAPSHOT_REQUIRED_KEYS = [
+  "schemaVersion",
+  "repositoryIdentity",
+  "headCommit",
+  "trackedTreeIdentity",
+  "submodules",
+  "dirtyOverlay",
+  "dependencyLockfiles",
+  "excludedRoots",
+  "ignoredPathsBound",
+  "policyVersion",
+  "sourceFingerprint",
+];
+const KNOWN_RECEIPT_ISSUES = new Set([
+  "quick_ignored_artifact_unbound",
+  "source_mutated_during_verification",
+]);
+
+function validDateTime(value) {
+  return typeof value === "string"
+    && /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/.test(value)
+    && Number.isFinite(Date.parse(value));
+}
+
+function validCoreIdentity(value) {
+  return hasExactKeys(value, ["contractVersion", "coreVersion", "coreManifestSha256"])
+    && typeof value.contractVersion === "string"
+    && value.contractVersion.length > 0
+    && typeof value.coreVersion === "string"
+    && value.coreVersion.length > 0
+    && isSha256Ref(value.coreManifestSha256);
+}
+
+function validSnapshot(value) {
+  if (!hasExactKeys(value, SNAPSHOT_REQUIRED_KEYS)) return false;
+  if (
+    value.schemaVersion !== "OwlCodaWorkspaceSnapshotV1"
+    || typeof value.repositoryIdentity !== "string"
+    || value.repositoryIdentity.length === 0
+    || !(value.headCommit === null || /^[0-9a-f]{40}(?:[0-9a-f]{24})?$/.test(value.headCommit))
+    || !isSha256Ref(value.trackedTreeIdentity)
+    || value.ignoredPathsBound !== false
+    || value.policyVersion !== "workspace-snapshot-v1"
+    || !isSha256Ref(value.sourceFingerprint)
+    || !Array.isArray(value.submodules)
+    || !Array.isArray(value.dirtyOverlay)
+    || !Array.isArray(value.dependencyLockfiles)
+    || !Array.isArray(value.excludedRoots)
+    || !value.excludedRoots.includes(".owlcoda/runkit")
+  ) {
+    return false;
+  }
+  if (!value.submodules.every((entry) =>
+    hasExactKeys(entry, ["path", "commit"])
+    && typeof entry.path === "string"
+    && /^[0-9a-f]{40}(?:[0-9a-f]{24})?$/.test(entry.commit))) {
+    return false;
+  }
+  if (!value.dirtyOverlay.every((entry) =>
+    hasExactKeys(entry, ["path", "state", "sha256"])
+    && typeof entry.path === "string"
+    && ["modified", "untracked", "deleted"].includes(entry.state)
+    && (entry.sha256 === null || isSha256Ref(entry.sha256)))) {
+    return false;
+  }
+  if (!value.dependencyLockfiles.every((entry) =>
+    hasExactKeys(entry, ["path", "sha256"])
+    && typeof entry.path === "string"
+    && isSha256Ref(entry.sha256))) {
+    return false;
+  }
+  return true;
+}
+
+export function quickSnapshotFingerprintValid(value) {
+  const { sourceFingerprint, ...payload } = value;
+  return sha256Canonical(payload) === sourceFingerprint;
+}
+
+function validOutputArtifact(value) {
+  return hasExactKeys(value, ["path", "sha256", "sizeBytes"])
+    && typeof value.path === "string"
+    && value.path.length > 0
+    && isSha256Ref(value.sha256)
+    && Number.isInteger(value.sizeBytes)
+    && value.sizeBytes >= 0;
+}
+
+export function validQuickReceiptShape(receipt) {
+  if (!hasExactKeys(receipt, RECEIPT_REQUIRED_KEYS, ["signatureRef"])) return false;
+  if (
+    receipt.schemaVersion !== "OwlCodaQuickVerificationReceiptV1"
+    || typeof receipt.receiptId !== "string"
+    || receipt.receiptId.length === 0
+    || receipt.assurance !== "captured_verification"
+    || receipt.authorizationGranted !== false
+    || !validCoreIdentity(receipt.coreIdentity)
+    || !validSnapshot(receipt.workspaceBefore)
+    || !validSnapshot(receipt.workspaceAfter)
+    || !hasExactKeys(receipt.exactCommand, ["executable", "argv", "cwd"])
+    || typeof receipt.exactCommand.executable !== "string"
+    || receipt.exactCommand.executable.length === 0
+    || !Array.isArray(receipt.exactCommand.argv)
+    || !receipt.exactCommand.argv.every((entry) => typeof entry === "string")
+    || typeof receipt.exactCommand.cwd !== "string"
+    || receipt.exactCommand.cwd.length === 0
+    || !hasExactKeys(receipt.verificationContext, ["platform", "architecture", "runtime"])
+    || !Object.values(receipt.verificationContext).every((entry) => typeof entry === "string" && entry.length > 0)
+    || !validDateTime(receipt.startedAt)
+    || !validDateTime(receipt.finishedAt)
+    || Date.parse(receipt.finishedAt) < Date.parse(receipt.startedAt)
+    || !hasExactKeys(receipt.exitResult, ["exitCode", "signal"])
+    || !(receipt.exitResult.exitCode === null || Number.isInteger(receipt.exitResult.exitCode))
+    || !(receipt.exitResult.signal === null || typeof receipt.exitResult.signal === "string")
+    || !hasExactKeys(receipt.outputArtifacts, ["stdout", "stderr"])
+    || !validOutputArtifact(receipt.outputArtifacts.stdout)
+    || !validOutputArtifact(receipt.outputArtifacts.stderr)
+    || !["source_unchanged", "invalidated_by_command_source_mutation"].includes(receipt.mutationDecision)
+    || !Array.isArray(receipt.issueCodes)
+    || new Set(receipt.issueCodes).size !== receipt.issueCodes.length
+    || !receipt.issueCodes.every((entry) => typeof entry === "string" && KNOWN_RECEIPT_ISSUES.has(entry))
+  ) {
+    return false;
+  }
+  if (receipt.signatureRef !== undefined) {
+    if (!hasExactKeys(receipt.signatureRef, ["path", "sha256"])
+      || typeof receipt.signatureRef.path !== "string"
+      || !isSha256Ref(receipt.signatureRef.sha256)) {
+      return false;
+    }
+  }
+  return true;
+}

package/packages/attest/src/quick.mjs

@@ -0,0 +1,274 @@
+import { lstatSync, realpathSync, statSync } from "node:fs";
+import path from "node:path";
+
+import {
+  isPlainJsonObject,
+  decodeUtf8Strict,
+  parseJsonStrict,
+  readFileBytesBounded,
+  resolveRegularFilePath,
+  sha256Bytes,
+} from "./formal.mjs";
+import {
+  quickSnapshotFingerprintValid,
+  validQuickReceiptShape,
+} from "./quick-receipt-contract.mjs";
+import { captureWorkspaceSnapshot } from "./workspace-snapshot.mjs";
+
+export { validQuickReceiptShape } from "./quick-receipt-contract.mjs";
+
+export const SUPPORTED_QUICK_CORE_IDENTITIES = Object.freeze([
+  {
+    contractVersion: "0.2",
+    coreVersion: "0.12.0",
+    coreManifestSha256: "sha256:c415b10cb00d2a7891744b7257774fa501ddf40f8ec2f290356505a17fefb40f",
+  },
+  {
+    contractVersion: "0.2",
+    coreVersion: "0.12.0",
+    coreManifestSha256: "sha256:be4b079fb0bc29e71858af03a1e579f864d4414c815ac612c3b514d8d663d07b",
+  },
+  {
+    contractVersion: "0.2",
+    coreVersion: "0.13.0",
+    coreManifestSha256: "sha256:0e3233a417365afb4e2ce22db5260608a9c697a819cd5c02897276d6454dde1f",
+  },
+  {
+    contractVersion: "0.2",
+    coreVersion: "0.13.0",
+    coreManifestSha256: "sha256:037c012751b32abbbb48ce8a8d2cd8faa4fc2c38d6797db391205477e667065f",
+  },
+  {
+    contractVersion: "0.2",
+    coreVersion: "0.13.0",
+    coreManifestSha256: "sha256:2f840d1884b34656902f8f23af3bd8052dde3212aa516dac2cbb0e0b29627ea1",
+  },
+  {
+    contractVersion: "0.2",
+    coreVersion: "0.13.0",
+    coreManifestSha256: "sha256:febf2551317fce9e4bb412b833a392a20376d702dda09c57d6116e8a3ca4f857",
+  },
+  {
+    contractVersion: "0.2",
+    coreVersion: "0.13.0",
+    coreManifestSha256: "sha256:4b72f572b6964f149c4a6fe5c2c9da85f73b8060c88023dc96ba5ca50a036972",
+  },
+  {
+    contractVersion: "0.2",
+    coreVersion: "0.13.0",
+    coreManifestSha256: "sha256:0455c847bf2df77703583c6f19c20cf103206bafc4f122795bf34d3f85f0263d",
+  },
+]);
+
+function resolveBoundMaterial(root, relativePath) {
+  if (path.isAbsolute(relativePath) || relativePath.includes("\0")) {
+    throw new Error("material path must be workspace-relative");
+  }
+  const segments = relativePath.split(/[\\/]/);
+  if (segments.some((segment) => segment === "" || segment === "." || segment === "..")) {
+    throw new Error("material path contains unsafe segments");
+  }
+  let current = root;
+  for (const segment of segments) {
+    current = path.join(current, segment);
+    const stat = lstatSync(current);
+    if (stat.isSymbolicLink()) throw new Error("material path traverses a symlink");
+  }
+  const resolved = realpathSync(current);
+  const remainder = path.relative(root, resolved);
+  if (remainder === "" || remainder === ".." || remainder.startsWith(`..${path.sep}`) || path.isAbsolute(remainder)) {
+    throw new Error("material path escapes the workspace");
+  }
+  if (!statSync(resolved).isFile()) throw new Error("material must be a regular file");
+  return resolved;
+}
+
+function check(status, issueCode) {
+  return issueCode === undefined ? { status } : { status, issueCode };
+}
+
+function resultTemplate({ receipt, receiptPath, receiptSha256, decision, issues, checks, materials }) {
+  return {
+    schemaVersion: "OwlCodaAttestationResultV1",
+    decision,
+    subjectRef: {
+      schemaVersion: "OwlCodaAttestationRefV1",
+      receiptId: receipt.receiptId,
+      receiptSha256,
+      coreIdentity: {
+        contractVersion: receipt.coreIdentity.contractVersion,
+        coreManifestSha256: receipt.coreIdentity.coreManifestSha256,
+      },
+    },
+    verifiedAt: new Date().toISOString(),
+    policy: {
+      id: "owlcoda-quick-minimum",
+      version: "1.0.0",
+    },
+    checks,
+    authorizationBoundary: {
+      authorizationGranted: false,
+      statement: "attestation_never_grants_repository_or_business_authority",
+    },
+    issueCodes: [...new Set(issues)].sort(),
+    verifiedMaterials: [
+      { path: receiptPath, sha256: receiptSha256 },
+      ...materials,
+    ],
+  };
+}
+
+export function attestQuickReceiptDetailsFromBytes({
+  receiptPath,
+  receiptBytes,
+  workspaceRoot,
+}) {
+  const absoluteReceiptPath = resolveRegularFilePath(receiptPath);
+  let receipt;
+  try {
+    receipt = parseJsonStrict(decodeUtf8Strict(receiptBytes));
+  } catch (error) {
+    if (error?.code === "DUPLICATE_OBJECT_KEY") {
+      error.code = "receipt_duplicate_key";
+    }
+    throw error;
+  }
+  if (!isPlainJsonObject(receipt) || !validQuickReceiptShape(receipt)) {
+    const error = new Error("Quick receipt does not satisfy the strict Wave 1 shape");
+    error.code = "receipt_schema_invalid";
+    throw error;
+  }
+
+  const issues = [...receipt.issueCodes, "signature_absent", "anchor_absent"];
+  const materials = [];
+  let materialMissing = false;
+  let materialMismatch = false;
+
+  const coreValid = SUPPORTED_QUICK_CORE_IDENTITIES.some((core) =>
+    receipt.coreIdentity.contractVersion === core.contractVersion
+    && receipt.coreIdentity.coreVersion === core.coreVersion
+    && receipt.coreIdentity.coreManifestSha256 === core.coreManifestSha256);
+  if (!coreValid) issues.push("core_identity_mismatch");
+  const contextValid = receipt.verificationContext.platform === process.platform
+    && receipt.verificationContext.architecture === process.arch
+    && receipt.verificationContext.runtime === process.version;
+  if (!contextValid) issues.push("verification_context_mismatch");
+
+  const snapshotBindingsValid = quickSnapshotFingerprintValid(receipt.workspaceBefore)
+    && quickSnapshotFingerprintValid(receipt.workspaceAfter);
+  const sourceUnchanged = receipt.workspaceBefore.sourceFingerprint
+    === receipt.workspaceAfter.sourceFingerprint;
+  const receiptSourceValid = receipt.mutationDecision === "source_unchanged"
+    ? snapshotBindingsValid && sourceUnchanged && !receipt.issueCodes.includes("source_mutated_during_verification")
+    : snapshotBindingsValid && !sourceUnchanged && receipt.issueCodes.includes("source_mutated_during_verification");
+  const selectedWorkspaceRoot = workspaceRoot === undefined
+    ? undefined
+    : realpathSync(workspaceRoot);
+  if (selectedWorkspaceRoot === undefined) {
+    issues.push("current_workspace_not_checked");
+  }
+  let receiptWorkspaceRoot;
+  if (selectedWorkspaceRoot !== undefined) {
+    try {
+      receiptWorkspaceRoot = realpathSync(receipt.exactCommand.cwd);
+    } catch {
+      receiptWorkspaceRoot = undefined;
+    }
+  }
+  const commandWorkspaceMatches = selectedWorkspaceRoot !== undefined
+    && receiptWorkspaceRoot === selectedWorkspaceRoot;
+  if (commandWorkspaceMatches) {
+    for (const artifact of [receipt.outputArtifacts.stdout, receipt.outputArtifacts.stderr]) {
+      try {
+        const materialPath = resolveBoundMaterial(receiptWorkspaceRoot, artifact.path);
+        const { bytes } = readFileBytesBounded(materialPath);
+        const actualSha256 = sha256Bytes(bytes);
+        materials.push({ path: materialPath, sha256: actualSha256 });
+        if (actualSha256 !== artifact.sha256 || bytes.byteLength !== artifact.sizeBytes) {
+          materialMismatch = true;
+        }
+      } catch (error) {
+        if (error && typeof error === "object" && error.code === "ENOENT") {
+          materialMissing = true;
+        } else {
+          materialMismatch = true;
+        }
+      }
+    }
+  }
+  if (materialMissing) issues.push("attestation_material_missing");
+  if (materialMismatch) issues.push("receipt_material_hash_mismatch");
+  const currentSourceValid = selectedWorkspaceRoot === undefined
+    || commandWorkspaceMatches
+      && captureWorkspaceSnapshot(selectedWorkspaceRoot).sourceFingerprint
+        === receipt.workspaceAfter.sourceFingerprint;
+  const sourceValid = receiptSourceValid && currentSourceValid;
+  if (!sourceValid || receipt.mutationDecision !== "source_unchanged") {
+    issues.push("receipt_source_mismatch");
+  }
+  const commandPassed = receipt.exitResult.exitCode === 0 && receipt.exitResult.signal === null;
+  if (!commandPassed) issues.push("verification_command_failed");
+  const deterministicFailure = !coreValid
+    || !contextValid
+    || materialMismatch
+    || !sourceValid
+    || receipt.mutationDecision !== "source_unchanged"
+    || !commandPassed;
+  const decision = deterministicFailure
+    ? "NO_GO"
+    : selectedWorkspaceRoot === undefined || materialMissing
+      ? "INDETERMINATE"
+      : "GO";
+  const receiptSha256 = sha256Bytes(receiptBytes);
+
+  const attestation = resultTemplate({
+    receipt,
+    receiptPath: absoluteReceiptPath,
+    receiptSha256,
+    decision,
+    issues,
+    materials,
+    checks: {
+      schema: check("passed"),
+      canonicalization: check("passed"),
+      lineage: check("passed"),
+      source: selectedWorkspaceRoot === undefined
+        ? check("not_checked", "current_workspace_not_checked")
+        : sourceValid && receipt.mutationDecision === "source_unchanged"
+          ? check("passed")
+          : check("failed", "receipt_source_mismatch"),
+      context: !coreValid
+        ? check("failed", "core_identity_mismatch")
+        : contextValid
+          ? check("passed")
+          : check("failed", "verification_context_mismatch"),
+      signature: check("not_checked", "signature_absent"),
+      key: check("not_checked", "signature_absent"),
+      anchor: check("not_checked", "anchor_absent"),
+    },
+  });
+  return {
+    attestation,
+    sourceFingerprint: receipt.workspaceAfter.sourceFingerprint,
+    exitCode: decision === "GO"
+      ? 0
+      : !sourceValid || receipt.mutationDecision !== "source_unchanged"
+        ? 2
+        : decision === "INDETERMINATE"
+          ? 3
+          : 1,
+  };
+}
+
+export function attestQuickReceiptDetails({ receiptPath, workspaceRoot }) {
+  const { absolutePath, bytes } = readFileBytesBounded(receiptPath);
+  return attestQuickReceiptDetailsFromBytes({
+    receiptPath: absolutePath,
+    receiptBytes: bytes,
+    workspaceRoot,
+  });
+}
+
+export function attestQuickReceipt(options) {
+  return attestQuickReceiptDetails(options).attestation;
+}