owlrunkit 0.13.0

package/scripts/runkit-contract/profile-impact.mjs

@@ -0,0 +1,223 @@
+import { isAbsolute, win32 } from "node:path"
+import { isDirectExecution, isReservedRuntimePath } from "./core-contract.mjs"
+
+const FULL_PROFILE_REQUIRED = "full_profile_required"
+const TARGETED_PROFILES = "targeted_profiles"
+
+export function resolveProfileImpact(input) {
+	if (!isRecord(input) || !Array.isArray(input.changedPaths) || !Array.isArray(input.profiles)) {
+		throw new Error("Profile impact input requires changedPaths and profiles arrays.")
+	}
+	const changedPaths = sortedUniqueStrings(input.changedPaths, "Changed paths must be non-empty strings.")
+	for (const changedPath of changedPaths) validateRepoRelativePath(changedPath, "Changed path")
+	const profiles = input.profiles.map(profile => normalizeProfile(profile))
+	const matchedProfileIds = new Set()
+	const uncoveredPaths = []
+
+	for (const changedPath of changedPaths) {
+		let covered = false
+		for (const profile of profiles) {
+			if (!profile.paths.some(rule => matchesRule(changedPath, rule))) continue
+			covered = true
+			matchedProfileIds.add(profile.id)
+		}
+		if (!covered) uncoveredPaths.push(changedPath)
+	}
+
+	if (uncoveredPaths.length > 0) {
+		return {
+			decision: FULL_PROFILE_REQUIRED,
+			profileIds: [],
+			uncoveredPaths,
+		}
+	}
+	return {
+		decision: TARGETED_PROFILES,
+		profileIds: [...matchedProfileIds].sort(),
+		uncoveredPaths: [],
+	}
+}
+
+export function resolveProfileImpactDetailed(input) {
+	if (!isRecord(input) || !Array.isArray(input.changedPaths) || !Array.isArray(input.profiles)) {
+		throw new Error("Detailed profile impact input requires changedPaths and profiles arrays.")
+	}
+	const changedPaths = sortedUniqueStrings(input.changedPaths, "Changed paths must be non-empty strings.")
+	for (const changedPath of changedPaths) validateRepoRelativePath(changedPath, "Changed path")
+	const profiles = input.profiles.map(profile => normalizeDetailedProfile(profile))
+	const profileById = new Map()
+	for (const profile of profiles) {
+		if (profileById.has(profile.id)) throw new Error(`Detailed profile ids must be unique: ${profile.id}`)
+		profileById.set(profile.id, profile)
+	}
+
+	const directProfileIds = new Set()
+	const supportingProfileIds = new Set()
+	const uncoveredPaths = []
+	const warnings = []
+	const specificityByProfileId = new Map()
+	for (const changedPath of changedPaths) {
+		const directMatches = []
+		const supportingMatches = []
+		for (const profile of profiles) {
+			const specificity = Math.max(
+				-1,
+				...profile.paths
+					.filter(rule => matchesRule(changedPath, rule))
+					.map(rule => rule.endsWith("/**") ? rule.length - 3 : rule.length + 1_000_000),
+			)
+			if (specificity < 0) continue
+			if (profile.role === "supporting") supportingMatches.push(profile)
+			else directMatches.push(profile)
+			const prior = specificityByProfileId.get(profile.id) ?? -1
+			if (specificity > prior) specificityByProfileId.set(profile.id, specificity)
+		}
+		for (const profile of supportingMatches) supportingProfileIds.add(profile.id)
+		if (directMatches.length === 0) {
+			uncoveredPaths.push(changedPath)
+			if (supportingMatches.length > 0) warnings.push(`supporting_only_match:${changedPath}`)
+			continue
+		}
+		for (const profile of directMatches) directProfileIds.add(profile.id)
+	}
+
+	const transitiveProfileIds = new Set()
+	const queue = [...directProfileIds].sort()
+	while (queue.length > 0) {
+		const profileId = queue.shift()
+		const profile = profileById.get(profileId)
+		for (const requiredId of profile.requiresProfileIds) {
+			if (!profileById.has(requiredId)) throw new Error(`Required profile does not exist: ${requiredId}`)
+			if (directProfileIds.has(requiredId) || transitiveProfileIds.has(requiredId)) continue
+			transitiveProfileIds.add(requiredId)
+			queue.push(requiredId)
+			queue.sort()
+		}
+	}
+
+	const direct = [...directProfileIds].sort()
+	if (direct.length > 10) warnings.push(`broad_profile_match:${direct.length}`)
+	const flaggedPrimaryIds = direct.filter(profileId => profileById.get(profileId).primary)
+	let primaryProfileId = null
+	if (flaggedPrimaryIds.length === 1) primaryProfileId = flaggedPrimaryIds[0]
+	else if (flaggedPrimaryIds.length > 1) warnings.push(`ambiguous_primary_profile:${flaggedPrimaryIds.join(",")}`)
+	else if (direct.length === 1) primaryProfileId = direct[0]
+	else if (direct.length > 1) {
+		const highestSpecificity = Math.max(...direct.map(profileId => specificityByProfileId.get(profileId) ?? -1))
+		const mostSpecific = direct.filter(profileId => specificityByProfileId.get(profileId) === highestSpecificity)
+		if (mostSpecific.length === 1) primaryProfileId = mostSpecific[0]
+		else warnings.push(`ambiguous_primary_profile:${mostSpecific.join(",")}`)
+	}
+
+	const selectedProfileIds = [...new Set([...directProfileIds, ...transitiveProfileIds])].sort()
+	return {
+		decision: uncoveredPaths.length > 0 ? FULL_PROFILE_REQUIRED : TARGETED_PROFILES,
+		primaryProfileId,
+		directProfileIds: direct,
+		transitiveProfileIds: [...transitiveProfileIds].sort(),
+		supportingProfileIds: [...supportingProfileIds].sort(),
+		selectedProfileIds,
+		uncoveredPaths: uncoveredPaths.sort(),
+		warnings: [...new Set(warnings)].sort(),
+	}
+}
+
+export function resolveProfileImpactProjection({ changedPaths, profiles, detailed = false }) {
+	if (!detailed) return resolveProfileImpact({ changedPaths, profiles })
+	const impact = resolveProfileImpactDetailed({ changedPaths, profiles })
+	return {
+		decision: impact.decision,
+		profileIds: impact.selectedProfileIds,
+		uncoveredPaths: impact.uncoveredPaths,
+		directProfileIds: impact.directProfileIds,
+		transitiveProfileIds: impact.transitiveProfileIds,
+	}
+}
+
+function normalizeProfile(value) {
+	if (!isRecord(value) || typeof value.id !== "string" || value.id.length === 0 || !Array.isArray(value.paths)) {
+		throw new Error("Each profile requires a non-empty id and paths array.")
+	}
+	const paths = sortedUniqueStrings(value.paths, "Profile paths must be non-empty strings.")
+	for (const rule of paths) validateRule(rule)
+	return { id: value.id, paths }
+}
+
+function normalizeDetailedProfile(value) {
+	const normalized = normalizeProfile(value)
+	const role = value.role ?? "primary"
+	if (!new Set(["primary", "supporting"]).has(role)) {
+		throw new Error("Detailed profile role must be primary or supporting.")
+	}
+	if (value.primary !== undefined && typeof value.primary !== "boolean") {
+		throw new Error("Detailed profile primary must be a boolean.")
+	}
+	const requiresProfileIds = value.requiresProfileIds === undefined
+		? []
+		: sortedUniqueStrings(value.requiresProfileIds, "requiresProfileIds must contain non-empty strings.")
+	return {
+		...normalized,
+		role,
+		primary: value.primary ?? false,
+		requiresProfileIds,
+	}
+}
+
+function validateRule(rule) {
+	const wildcardIndex = rule.indexOf("*")
+	if (wildcardIndex === -1) {
+		validateRepoRelativePath(rule, "Profile exact path rule")
+		return
+	}
+	if (!rule.endsWith("/**") || rule.slice(0, -3).includes("*")) {
+		throw new Error("Profile path rules support only exact paths and directory/**.")
+	}
+	validateRepoRelativePath(rule.slice(0, -3), "Profile directory rule prefix")
+}
+
+function validateRepoRelativePath(value, label) {
+	if (isAbsolute(value) || win32.isAbsolute(value) || value.includes("\\")) {
+		throw new Error(`${label} must be a safe repository-relative path.`)
+	}
+	const segments = value.split("/")
+	if (segments.some(segment => segment.length === 0 || segment === "." || segment === "..")) {
+		throw new Error(`${label} must not contain empty, dot, or parent segments.`)
+	}
+	if (value.includes("*")) {
+		throw new Error(`${label} must not contain wildcard segments.`)
+	}
+	if (isReservedRuntimePath(value)) {
+		throw new Error(`${label} uses the reserved runtime path .owlcoda/runkit.`)
+	}
+}
+
+function matchesRule(changedPath, rule) {
+	if (!rule.endsWith("/**")) return changedPath === rule
+	return changedPath.startsWith(`${rule.slice(0, -3)}/`)
+}
+
+function sortedUniqueStrings(values, message) {
+	if (values.some(value => typeof value !== "string" || value.length === 0)) throw new Error(message)
+	return [...new Set(values)].sort()
+}
+
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value)
+}
+
+async function runCli() {
+	try {
+		let raw = ""
+		for await (const chunk of process.stdin) raw += chunk
+		const result = resolveProfileImpact(JSON.parse(raw))
+		process.stdout.write(`${JSON.stringify(result)}\n`)
+	} catch (error) {
+		process.stdout.write(`${JSON.stringify({
+			decision: "invalid_input",
+			error: error instanceof Error ? error.message : String(error),
+		})}\n`)
+		process.exitCode = 3
+	}
+}
+
+if (isDirectExecution(import.meta.url)) await runCli()

package/scripts/runkit-contract/provenance-common.mjs

@@ -0,0 +1,153 @@
+import { createHash, randomUUID } from "node:crypto";
+import {
+  lstatSync,
+  linkSync,
+  mkdirSync,
+  readFileSync,
+  realpathSync,
+  renameSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import path from "node:path";
+
+import {
+  RUNTIME_ROOT,
+  currentCoreIdentity,
+  validateExecutionPin,
+} from "./core-contract.mjs";
+
+export function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+export function sha256(value) {
+  return createHash("sha256").update(value).digest("hex");
+}
+
+export function readJson(filePath) {
+  return JSON.parse(readFileSync(filePath, "utf8"));
+}
+
+export function writeJsonExclusive(filePath, value) {
+  mkdirSync(path.dirname(filePath), { recursive: true });
+  writeFileSync(filePath, `${JSON.stringify(value, null, 2)}\n`, { flag: "wx" });
+}
+
+export function writeJsonExclusiveAtomically(filePath, value) {
+  mkdirSync(path.dirname(filePath), { recursive: true });
+  const temporaryPath = `${filePath}.tmp-${randomUUID()}`;
+  try {
+    writeFileSync(temporaryPath, `${JSON.stringify(value, null, 2)}\n`, { flag: "wx" });
+    linkSync(temporaryPath, filePath);
+  } finally {
+    rmSync(temporaryPath, { force: true });
+  }
+}
+
+export function writeJsonAtomically(filePath, value) {
+  mkdirSync(path.dirname(filePath), { recursive: true });
+  const temporaryPath = `${filePath}.tmp-${process.pid}`;
+  rmSync(temporaryPath, { force: true });
+  writeFileSync(temporaryPath, `${JSON.stringify(value, null, 2)}\n`, { flag: "wx" });
+  renameSync(temporaryPath, filePath);
+}
+
+export function assertAllowedKeys(value, label, allowedKeys) {
+  if (!isRecord(value)) throw new Error(`${label} must be an object.`);
+  const allowed = new Set(allowedKeys);
+  const unsupported = Object.keys(value).filter((key) => !allowed.has(key));
+  if (unsupported.length > 0) {
+    throw new Error(`${label} contains unsupported field: ${unsupported[0]}`);
+  }
+}
+
+export function safeIdentifier(value, label) {
+  if (typeof value !== "string"
+    || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(value)
+    || value === "."
+    || value === "..") {
+    throw new Error(`${label} must use letters, digits, dot, underscore, or hyphen without path separators.`);
+  }
+  return value;
+}
+
+function withinRoot(root, candidate) {
+  const remainder = path.relative(root, candidate);
+  return remainder === ""
+    || (!remainder.startsWith(`..${path.sep}`) && remainder !== ".." && !path.isAbsolute(remainder));
+}
+
+export function safeRelativePath(value, label, { allowDot = false } = {}) {
+  if (allowDot && value === ".") return value;
+  if (typeof value !== "string"
+    || value.length === 0
+    || path.isAbsolute(value)
+    || path.win32.isAbsolute(value)
+    || value.includes("\\")
+    || value.includes("\0")) {
+    throw new Error(`${label} must be a safe relative path.`);
+  }
+  const segments = value.split("/");
+  if (segments.some((segment) => segment.length === 0 || segment === "." || segment === "..")) {
+    throw new Error(`${label} must not contain empty, dot, or parent segments.`);
+  }
+  return value;
+}
+
+export function resolveExistingArtifact(workspaceRoot, value, label) {
+  const relativePath = safeRelativePath(value, label);
+  const candidate = path.resolve(workspaceRoot, relativePath);
+  if (!withinRoot(workspaceRoot, candidate)) throw new Error(`${label} escapes the workspace.`);
+  return realpathSync(candidate);
+}
+
+export function resolveWithinRoot(root, relativePath, label, options = {}) {
+  const safePath = safeRelativePath(relativePath, label, options);
+  const candidate = path.resolve(root, safePath);
+  if (!withinRoot(root, candidate)) throw new Error(`${label} escapes its root.`);
+  return candidate;
+}
+
+export function relativeToWorkspace(workspaceRoot, absolutePath) {
+  const relativePath = path.relative(workspaceRoot, absolutePath).split(path.sep).join("/");
+  if (!relativePath || relativePath.startsWith("../") || path.isAbsolute(relativePath)) {
+    throw new Error("Artifact path is outside the workspace.");
+  }
+  return relativePath;
+}
+
+export function loadActiveExecution(workspaceRoot, runId) {
+  const root = realpathSync(workspaceRoot);
+  const runtimeRoot = path.resolve(root, RUNTIME_ROOT);
+  const executionsRoot = path.join(runtimeRoot, "executions");
+  const executionRoot = path.join(executionsRoot, runId);
+  for (const [directoryPath, label] of [
+    [runtimeRoot, "RunKit runtime directory"],
+    [executionsRoot, "Executions directory"],
+    [executionRoot, "Execution directory"],
+  ]) {
+    const stat = lstatSync(directoryPath);
+    if (stat.isSymbolicLink() || !stat.isDirectory()) {
+      throw new Error(`${label} must be a real directory, not a symlink.`);
+    }
+    const realDirectory = realpathSync(directoryPath);
+    if (realDirectory !== path.resolve(directoryPath) || !withinRoot(root, realDirectory)) {
+      throw new Error(`${label} must remain inside the RunKit workspace without symlink ancestors.`);
+    }
+  }
+  const pin = readJson(path.join(executionRoot, "engine-pin.json"));
+  const pinGate = validateExecutionPin({ expected: pin, actual: currentCoreIdentity() });
+  return { executionRoot, pin, pinGate };
+}
+
+export function repositoryActionsFalse() {
+  return {
+    staged: false,
+    committed: false,
+    pushed: false,
+    tagged: false,
+    published: false,
+    deployed: false,
+  };
+}

package/scripts/runkit-contract/quick-attest.mjs

@@ -0,0 +1,4 @@
+export {
+  attestQuickReceipt,
+  attestQuickReceiptDetails,
+} from "../../packages/attest/src/quick.mjs";

package/scripts/runkit-contract/quick-canonical.mjs

@@ -0,0 +1,41 @@
+import {
+  HASH_PATTERN,
+  PUBLIC_VERIFIER_LIMITS,
+  canonicalJson,
+  hasExactKeys,
+  isPlainJsonObject,
+  isPlainObject,
+  isSha256Ref,
+  parseJsonStrict as parsePublicJsonStrict,
+  sha256Bytes,
+  sha256Canonical,
+} from "../../packages/attest/src/formal.mjs";
+
+export const QUICK_INPUT_LIMITS = Object.freeze({
+  maxInputBytes: PUBLIC_VERIFIER_LIMITS.maxInputBytes,
+  maxNestingDepth: PUBLIC_VERIFIER_LIMITS.maxNestingDepth,
+  maxJsonNodes: PUBLIC_VERIFIER_LIMITS.maxJsonNodes,
+});
+
+export const SHA256_REF_PATTERN = HASH_PATTERN;
+
+export function parseJsonStrict(text) {
+  try {
+    return parsePublicJsonStrict(text);
+  } catch (error) {
+    if (error?.code === "DUPLICATE_OBJECT_KEY") {
+      error.code = "receipt_duplicate_key";
+    }
+    throw error;
+  }
+}
+
+export {
+  canonicalJson,
+  hasExactKeys,
+  isPlainJsonObject,
+  isPlainObject,
+  isSha256Ref,
+  sha256Bytes,
+  sha256Canonical,
+};

package/scripts/runkit-contract/quick-metrics.mjs

@@ -0,0 +1,86 @@
+import {
+  existsSync,
+  lstatSync,
+  readdirSync,
+  realpathSync,
+} from "node:fs";
+import path from "node:path";
+
+import { attestQuickReceipt } from "./quick-attest.mjs";
+import { quickReceiptRoot } from "./quick-receipt.mjs";
+
+function trustedReceiptRoot(workspaceRoot) {
+  const workspace = realpathSync(workspaceRoot);
+  const root = quickReceiptRoot(workspace);
+  let current = workspace;
+  for (const segment of path.relative(workspace, root).split(path.sep)) {
+    current = path.join(current, segment);
+    if (!existsSync(current)) return { status: "missing", root };
+    const stat = lstatSync(current);
+    if (stat.isSymbolicLink() || !stat.isDirectory()) return { status: "invalid", root };
+    const resolved = realpathSync(current);
+    const remainder = path.relative(workspace, resolved);
+    if (remainder === "" || remainder === ".."
+      || remainder.startsWith(`..${path.sep}`) || path.isAbsolute(remainder)) {
+      return { status: "invalid", root };
+    }
+  }
+  return { status: "valid", root };
+}
+
+export function readLocalQuickMetrics(workspaceRoot) {
+  const selected = trustedReceiptRoot(workspaceRoot);
+  if (selected.status === "invalid") {
+    return {
+      status: "quick_receipt_store_invalid",
+      exitCode: 3,
+      schemaVersion: "OwlCodaRunKitLocalMetricsV1",
+      telemetry: false,
+      networkRequests: 0,
+      inputs: [],
+      quick: {
+        total: 0,
+        passed: 0,
+        failed: 0,
+        sourceMutated: 0,
+        invalid: 0,
+      },
+      issueCodes: ["quick_receipt_store_invalid"],
+      authorizationGranted: false,
+    };
+  }
+  const receiptPaths = selected.status === "valid"
+    ? readdirSync(selected.root, { withFileTypes: true })
+      .filter((entry) => entry.isDirectory() && !entry.isSymbolicLink())
+      .map((entry) => path.join(selected.root, entry.name, "receipt.json"))
+      .filter(existsSync)
+      .sort()
+    : [];
+  const totals = {
+    total: receiptPaths.length,
+    passed: 0,
+    failed: 0,
+    sourceMutated: 0,
+    invalid: 0,
+  };
+  for (const receiptPath of receiptPaths) {
+    try {
+      const result = attestQuickReceipt({ receiptPath, workspaceRoot });
+      if (result.decision === "GO") totals.passed += 1;
+      else if (result.issueCodes.includes("receipt_source_mismatch")) totals.sourceMutated += 1;
+      else totals.failed += 1;
+    } catch {
+      totals.invalid += 1;
+    }
+  }
+  return {
+    status: "local_metrics",
+    exitCode: 0,
+    schemaVersion: "OwlCodaRunKitLocalMetricsV1",
+    telemetry: false,
+    networkRequests: 0,
+    inputs: receiptPaths,
+    quick: totals,
+    authorizationGranted: false,
+  };
+}

package/scripts/runkit-contract/quick-receipt.mjs

@@ -0,0 +1,139 @@
+import { randomUUID } from "node:crypto";
+import {
+  closeSync,
+  existsSync,
+  fstatSync,
+  lstatSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  realpathSync,
+  renameSync,
+  writeFileSync,
+} from "node:fs";
+import path from "node:path";
+
+import { sha256Bytes } from "./quick-canonical.mjs";
+
+const QUICK_ROOT = ".owlcoda/runkit/quick";
+
+function withinRoot(root, candidate) {
+  const remainder = path.relative(root, candidate);
+  return remainder !== ""
+    && !remainder.startsWith(`..${path.sep}`)
+    && remainder !== ".."
+    && !path.isAbsolute(remainder);
+}
+
+function ensureDirectoryChain(workspaceRoot, relativeDirectory) {
+  const root = realpathSync(workspaceRoot);
+  let current = root;
+  for (const segment of relativeDirectory.split("/")) {
+    current = path.join(current, segment);
+    if (!existsSync(current)) mkdirSync(current);
+    const stat = lstatSync(current);
+    if (stat.isSymbolicLink() || !stat.isDirectory()) {
+      throw new Error(`Quick receipt store component must be a real directory: ${current}`);
+    }
+    const resolved = realpathSync(current);
+    if (!withinRoot(root, resolved)) {
+      throw new Error(`Quick receipt store escapes the workspace: ${current}`);
+    }
+  }
+  return current;
+}
+
+function atomicWriteJson(filePath, value) {
+  const temporary = `${filePath}.tmp-${process.pid}-${randomUUID()}`;
+  writeFileSync(temporary, `${JSON.stringify(value, null, 2)}\n`, { flag: "wx" });
+  renameSync(temporary, filePath);
+}
+
+export function createQuickReceiptStore(workspaceRoot, receiptId = `quick-${Date.now()}-${randomUUID()}`) {
+  if (!/^[a-zA-Z0-9._-]+$/.test(receiptId)) throw new Error("receiptId is unsafe");
+  const receiptRoot = ensureDirectoryChain(workspaceRoot, `${QUICK_ROOT}/receipts/${receiptId}`);
+  const stdoutPath = path.join(receiptRoot, "stdout.log");
+  const stderrPath = path.join(receiptRoot, "stderr.log");
+  const stdoutFd = openSync(stdoutPath, "wx", 0o600);
+  const stderrFd = openSync(stderrPath, "wx", 0o600);
+  const rootStat = lstatSync(receiptRoot);
+  const stdoutStat = fstatSync(stdoutFd);
+  const stderrStat = fstatSync(stderrFd);
+  return {
+    receiptId,
+    receiptRoot,
+    receiptPath: path.join(receiptRoot, "receipt.json"),
+    stdoutPath,
+    stderrPath,
+    stdoutFd,
+    stderrFd,
+    receiptRootIdentity: {
+      dev: rootStat.dev,
+      ino: rootStat.ino,
+    },
+    stdoutIdentity: {
+      dev: stdoutStat.dev,
+      ino: stdoutStat.ino,
+    },
+    stderrIdentity: {
+      dev: stderrStat.dev,
+      ino: stderrStat.ino,
+    },
+  };
+}
+
+export function closeQuickOutputFiles(store) {
+  closeSync(store.stdoutFd);
+  closeSync(store.stderrFd);
+}
+
+function outputArtifact(workspaceRoot, filePath) {
+  const bytes = readFileSync(filePath);
+  return {
+    path: path.relative(realpathSync(workspaceRoot), filePath).split(path.sep).join("/"),
+    sha256: sha256Bytes(bytes),
+    sizeBytes: bytes.byteLength,
+  };
+}
+
+function assertStorePath(root, filePath, expectedIdentity, expectedType) {
+  const stat = lstatSync(filePath);
+  if (stat.isSymbolicLink() || (expectedType === "file" ? !stat.isFile() : !stat.isDirectory())) {
+    throw new Error(`Quick receipt store ${expectedType} is not trusted: ${filePath}`);
+  }
+  if (stat.dev !== expectedIdentity.dev || stat.ino !== expectedIdentity.ino) {
+    throw new Error(`Quick receipt store ${expectedType} identity changed: ${filePath}`);
+  }
+  const resolved = realpathSync(filePath);
+  if (!withinRoot(root, resolved)) {
+    throw new Error(`Quick receipt store ${expectedType} escapes the workspace: ${filePath}`);
+  }
+}
+
+function validateQuickReceiptStore(workspaceRoot, store) {
+  const root = realpathSync(workspaceRoot);
+  assertStorePath(root, store.receiptRoot, store.receiptRootIdentity, "directory");
+  assertStorePath(root, store.stdoutPath, store.stdoutIdentity, "file");
+  assertStorePath(root, store.stderrPath, store.stderrIdentity, "file");
+}
+
+export function persistQuickReceipt({ workspaceRoot, store, receipt }) {
+  validateQuickReceiptStore(workspaceRoot, store);
+  const complete = {
+    ...receipt,
+    outputArtifacts: {
+      stdout: outputArtifact(workspaceRoot, store.stdoutPath),
+      stderr: outputArtifact(workspaceRoot, store.stderrPath),
+    },
+  };
+  atomicWriteJson(store.receiptPath, complete);
+  return {
+    receipt: complete,
+    receiptPath: store.receiptPath,
+    receiptSha256: sha256Bytes(readFileSync(store.receiptPath)),
+  };
+}
+
+export function quickReceiptRoot(workspaceRoot) {
+  return path.join(realpathSync(workspaceRoot), ...QUICK_ROOT.split("/"), "receipts");
+}