owlrunkit 0.13.0

package/scripts/runkit-contract/source-fingerprint.mjs

@@ -0,0 +1,404 @@
+#!/usr/bin/env node
+
+import { spawnSync } from 'node:child_process'
+import { createHash } from 'node:crypto'
+import { lstatSync, readFileSync, realpathSync } from 'node:fs'
+import { isAbsolute, relative, resolve, win32 } from 'node:path'
+import { isDirectExecution, isReservedRuntimePath } from './core-contract.mjs'
+
+const SHA256_PATTERN = /^[a-f0-9]{64}$/i
+
+function isRecord(value) {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+function sha256(value) {
+  return createHash('sha256').update(value).digest('hex')
+}
+
+function compareUnicodeCodeUnits(left, right) {
+  if (left < right) return -1
+  if (left > right) return 1
+  return 0
+}
+
+function canonicalSourceStream(files) {
+  return Object.entries(files)
+    .sort(([left], [right]) => compareUnicodeCodeUnits(left, right))
+    .map(([path, hash]) => `${path}\tsha256:${hash.toLowerCase()}\n`)
+    .join('')
+}
+
+export function canonicalSourceFingerprint(files) {
+  return sha256(canonicalSourceStream(files))
+}
+
+function malformedResult(issues, extra = {}) {
+  return {
+    status: 'malformed_packet',
+    exitCode: 3,
+    issues,
+    ...extra,
+  }
+}
+
+function safePacketPath(path) {
+  if (typeof path !== 'string' || !path || isAbsolute(path) || win32.parse(path).root) return false
+  if (path.includes('\\') || path.includes('\0')) return false
+  const segments = path.split('/')
+  return !segments.includes('..') && !segments.includes('.') && segments.every(Boolean) && !isReservedRuntimePath(path)
+}
+
+function withinRoot(root, candidate) {
+  const remainder = relative(root, candidate)
+  return remainder === '' || (!remainder.startsWith('../') && remainder !== '..' && !isAbsolute(remainder))
+}
+
+function validOwnedRule(value) {
+  if (typeof value !== 'string' || !value) return false
+  if (!value.endsWith('/**')) return safePacketPath(value)
+  const prefix = value.slice(0, -3)
+  return safePacketPath(prefix)
+}
+
+function matchesOwnedRule(filePath, rule) {
+  if (rule.endsWith('/**')) {
+    const prefix = rule.slice(0, -3)
+    return filePath === prefix || filePath.startsWith(`${prefix}/`)
+  }
+  return filePath === rule
+}
+
+function ownedStatusRecords(workspaceRoot, ownedPaths) {
+  const completed = spawnSync('git', [
+    '-C', workspaceRoot,
+    'status',
+    '--porcelain=v1',
+    '-z',
+    '--untracked-files=all',
+    '--',
+    '.',
+    ':(exclude).owlcoda/runkit/**',
+  ], {
+    encoding: 'utf8',
+    maxBuffer: 64 * 1024 * 1024,
+  })
+  if (completed.error) throw completed.error
+  if (completed.status !== 0) throw new Error(completed.stderr.trim() || 'Git status failed')
+  const entries = completed.stdout.split('\0')
+  const records = []
+  for (let index = 0; index < entries.length; index += 1) {
+    const entry = entries[index]
+    if (!entry) continue
+    if (entry.length < 4 || entry[2] !== ' ') throw new Error('Git status emitted a malformed entry')
+    const status = entry.slice(0, 2)
+    const currentPath = entry.slice(3)
+    const paths = [currentPath]
+    if (status.includes('R') || status.includes('C')) {
+      const priorPath = entries[index + 1]
+      if (!priorPath) throw new Error('Git status rename entry is incomplete')
+      paths.push(priorPath)
+      index += 1
+    }
+    if (!paths.some(filePath => ownedPaths.some(rule => matchesOwnedRule(filePath, rule)))) continue
+    records.push({ status, paths })
+  }
+  return records.sort((left, right) =>
+    JSON.stringify(left.paths).localeCompare(JSON.stringify(right.paths)))
+}
+
+function boundLease({ root, packet }) {
+  if (typeof packet.discovery?.leasePath !== 'string'
+    || typeof packet.discovery?.fromLease !== 'string') {
+    return null
+  }
+  const leaseCandidate = resolve(root, packet.discovery.leasePath)
+  if (!withinRoot(root, leaseCandidate)) {
+    return { malformed: 'ownedPathState leasePath escapes workspace' }
+  }
+  try {
+    const stat = lstatSync(leaseCandidate)
+    if (stat.isSymbolicLink() || !stat.isFile()) {
+      return { malformed: 'ownedPathState leasePath must be a regular file' }
+    }
+    const realLease = realpathSync(leaseCandidate)
+    if (!withinRoot(root, realLease)) {
+      return { malformed: 'ownedPathState leasePath resolves outside workspace' }
+    }
+    const lease = JSON.parse(readFileSync(realLease, 'utf8'))
+    if (lease.workItemId !== packet.discovery.fromLease
+      || !Array.isArray(lease.ownedPaths)
+      || lease.ownedPaths.length === 0
+      || new Set(lease.ownedPaths).size !== lease.ownedPaths.length
+      || lease.ownedPaths.some(rule => !validOwnedRule(rule))) {
+      return { malformed: 'ownedPathState lease artifact is invalid' }
+    }
+    return { lease }
+  } catch {
+    return { malformed: 'ownedPathState lease artifact is unreadable' }
+  }
+}
+
+function validateOwnedPathState({ root, packet, declaredFiles }) {
+  const state = packet?.discovery?.ownedPathState
+  const leaseBinding = boundLease({ root, packet })
+  if (state === undefined) {
+    if (leaseBinding === null) return { issues: [] }
+    if (leaseBinding.malformed) return { malformed: [leaseBinding.malformed] }
+    let current
+    try {
+      current = ownedStatusRecords(root, leaseBinding.lease.ownedPaths)
+    } catch {
+      return { malformed: ['legacy DeliveryPacket requires readable Git status'] }
+    }
+    const declaredPaths = Object.keys(declaredFiles).sort()
+    const currentPaths = current.map(record => record.paths[0]).sort()
+    return JSON.stringify(currentPaths) === JSON.stringify(declaredPaths)
+      ? { issues: [] }
+      : { issues: ['owned workspace status paths changed since legacy DeliveryPacket creation'] }
+  }
+  if (!isRecord(state)
+    || state.schemaVersion !== 'OwlCodaRunKitOwnedPathStateV1'
+    || state.statusMode !== 'porcelain-v1-z-untracked-all-runkit-excluded'
+    || !Array.isArray(state.ownedPaths)
+    || state.ownedPaths.length === 0
+    || !Array.isArray(state.records)) {
+    return { malformed: ['ownedPathState is malformed'] }
+  }
+  if (state.ownedPaths.some(rule => !validOwnedRule(rule))
+    || new Set(state.ownedPaths).size !== state.ownedPaths.length) {
+    return { malformed: ['ownedPathState ownedPaths are invalid'] }
+  }
+  for (const record of state.records) {
+    if (!isRecord(record)
+      || typeof record.status !== 'string'
+      || record.status.length !== 2
+      || !Array.isArray(record.paths)
+      || record.paths.length === 0
+      || record.paths.some(filePath => !safePacketPath(filePath))
+      || !record.paths.some(filePath =>
+        state.ownedPaths.some(rule => matchesOwnedRule(filePath, rule)))) {
+      return { malformed: ['ownedPathState records are invalid'] }
+    }
+  }
+  if (leaseBinding === null) {
+    return { malformed: ['ownedPathState requires leasePath and fromLease'] }
+  }
+  if (leaseBinding.malformed) return { malformed: [leaseBinding.malformed] }
+  if (JSON.stringify(leaseBinding.lease.ownedPaths) !== JSON.stringify(state.ownedPaths)) {
+    return { malformed: ['ownedPathState does not match its lease artifact'] }
+  }
+  const declaredPaths = Object.keys(declaredFiles).sort()
+  const recordedCurrentPaths = state.records
+    .map(record => record.paths[0])
+    .sort()
+  if (JSON.stringify(recordedCurrentPaths) !== JSON.stringify(declaredPaths)) {
+    return { malformed: ['ownedPathState records do not match declared changed files'] }
+  }
+  let current
+  try {
+    current = ownedStatusRecords(root, state.ownedPaths)
+  } catch {
+    return { malformed: ['ownedPathState requires readable Git status'] }
+  }
+  return JSON.stringify(current) === JSON.stringify(state.records)
+    ? { issues: [] }
+    : { issues: ['owned workspace status changed since DeliveryPacket creation'] }
+}
+
+function extractDeclaredFiles(packet) {
+  if (!isRecord(packet) || !isRecord(packet.changedFiles)) {
+    return { issues: ['changedFiles must be an object'] }
+  }
+  const shapes = []
+  for (const key of ['files', 'wholeFileSha256']) {
+    if (!(key in packet.changedFiles)) continue
+    const value = packet.changedFiles[key]
+    if (!isRecord(value)) return { issues: [`changedFiles.${key} must be an object`] }
+    shapes.push([key, value])
+  }
+  if (shapes.length === 0) {
+    return { issues: ['changedFiles.files or changedFiles.wholeFileSha256 is required'] }
+  }
+  if (shapes.length > 1) {
+    return { issues: ['packet must declare exactly one changed file hash shape'] }
+  }
+
+  const files = {}
+  const issues = []
+  const [shape, entries] = shapes[0]
+  for (const [path, hash] of Object.entries(entries)) {
+    if (!safePacketPath(path)) {
+      issues.push(isReservedRuntimePath(path) ? `reserved runtime path: ${path}` : `unsafe scoped path: ${path}`)
+    }
+    if (typeof hash !== 'string' || !SHA256_PATTERN.test(hash)) {
+      issues.push(`invalid SHA-256 for ${path} in changedFiles.${shape}`)
+      continue
+    }
+    files[path] = hash.toLowerCase()
+  }
+  if (Object.keys(files).length === 0) issues.push('at least one scoped path is required')
+  return issues.length > 0 ? { issues } : { files }
+}
+
+function inspectWorkspaceFile(root, path) {
+  let current = root
+  const segments = path.split('/')
+  for (let index = 0; index < segments.length; index += 1) {
+    current = resolve(current, segments[index])
+    let stat
+    try {
+      stat = lstatSync(current)
+    } catch (error) {
+      if (error && typeof error === 'object' && error.code === 'ENOENT') return { status: 'missing' }
+      return { status: 'unreadable' }
+    }
+    if (stat.isSymbolicLink()) return { status: 'malformed', issue: `scoped path traverses a symlink: ${path}` }
+    const isLeaf = index === segments.length - 1
+    if (!isLeaf && !stat.isDirectory()) {
+      return { status: 'malformed', issue: `scoped path has a non-directory parent: ${path}` }
+    }
+    if (isLeaf && !stat.isFile()) {
+      return { status: 'malformed', issue: `scoped path is not a regular file: ${path}` }
+    }
+  }
+  return { status: 'regular_file', path: current }
+}
+
+function extractDeclaredFingerprint(packet) {
+  const declarations = []
+  for (const key of ['productSourceFingerprint', 'sourceFingerprint']) {
+    if (!(key in packet)) continue
+    if (!isRecord(packet[key]) || typeof packet[key].sha256 !== 'string') {
+      return { issues: [`${key}.sha256 must be a string`] }
+    }
+    declarations.push([key, packet[key].sha256])
+  }
+  if (declarations.length === 0) {
+    return { issues: ['productSourceFingerprint.sha256 or sourceFingerprint.sha256 is required'] }
+  }
+  if (declarations.length > 1) {
+    return { issues: ['packet must declare exactly one source fingerprint shape'] }
+  }
+  const [shape, fingerprint] = declarations[0]
+  if (!SHA256_PATTERN.test(fingerprint)) {
+    return { issues: [`${shape}.sha256 must be a 64-character SHA-256`] }
+  }
+  return { fingerprint: fingerprint.toLowerCase(), shape }
+}
+
+export function verifyDeliveryPacket({ workspaceRoot, packet }) {
+  if (typeof workspaceRoot !== 'string' || !workspaceRoot) {
+    return malformedResult(['workspaceRoot is required'])
+  }
+
+  let root
+  try {
+    root = realpathSync(workspaceRoot)
+  } catch {
+    return malformedResult(['workspaceRoot does not exist'])
+  }
+
+  const declaredFiles = extractDeclaredFiles(packet)
+  if (declaredFiles.issues) return malformedResult(declaredFiles.issues)
+  const declaredFingerprint = extractDeclaredFingerprint(packet)
+  if (declaredFingerprint.issues) return malformedResult(declaredFingerprint.issues)
+  const ownedPathState = validateOwnedPathState({
+    root,
+    packet,
+    declaredFiles: declaredFiles.files,
+  })
+  if (ownedPathState.malformed) return malformedResult(ownedPathState.malformed)
+
+  const issues = [...ownedPathState.issues]
+  const actualFiles = {}
+  const declaredCanonicalStream = canonicalSourceStream(declaredFiles.files)
+  const fingerprintFromDeclaredHashes = sha256(declaredCanonicalStream)
+  if (fingerprintFromDeclaredHashes !== declaredFingerprint.fingerprint) {
+    issues.push('declared fingerprint does not match the canonical declared file hashes')
+  }
+
+  for (const [path, expectedHash] of Object.entries(declaredFiles.files).sort(([left], [right]) => compareUnicodeCodeUnits(left, right))) {
+    const candidate = resolve(root, path)
+    if (!withinRoot(root, candidate)) {
+      return malformedResult([`scoped path escapes workspace: ${path}`])
+    }
+    const inspected = inspectWorkspaceFile(root, path)
+    if (inspected.status === 'malformed') return malformedResult([inspected.issue])
+    if (inspected.status === 'missing') {
+      issues.push(`missing scoped file: ${path}`)
+      continue
+    }
+    if (inspected.status === 'unreadable') {
+      issues.push(`unreadable scoped file: ${path}`)
+      continue
+    }
+    let realCandidate
+    try {
+      realCandidate = realpathSync(inspected.path)
+    } catch {
+      issues.push(`unreadable scoped file: ${path}`)
+      continue
+    }
+    if (!withinRoot(root, realCandidate)) {
+      return malformedResult([`scoped path resolves outside workspace: ${path}`])
+    }
+    try {
+      const actualHash = sha256(readFileSync(realCandidate))
+      actualFiles[path] = actualHash
+      if (actualHash !== expectedHash) issues.push(`whole-file hash mismatch: ${path}`)
+    } catch {
+      issues.push(`unreadable scoped file: ${path}`)
+    }
+  }
+
+  const hasAllActualFiles = Object.keys(actualFiles).length === Object.keys(declaredFiles.files).length
+  const actualCanonicalStream = hasAllActualFiles ? canonicalSourceStream(actualFiles) : null
+  const recomputedFingerprint = actualCanonicalStream ? sha256(actualCanonicalStream) : null
+  if (recomputedFingerprint && recomputedFingerprint !== declaredFingerprint.fingerprint) {
+    issues.push('recomputed workspace fingerprint does not match the packet declaration')
+  }
+
+  const status = issues.length === 0 ? 'valid' : 'invalidated_by_concurrent_write'
+  return {
+    status,
+    exitCode: status === 'valid' ? 0 : 2,
+    fileCount: Object.keys(declaredFiles.files).length,
+    fingerprintShape: declaredFingerprint.shape,
+    declaredFingerprint: declaredFingerprint.fingerprint,
+    fingerprintFromDeclaredHashes,
+    recomputedFingerprint,
+    canonicalStream: actualCanonicalStream ?? declaredCanonicalStream,
+    issues,
+  }
+}
+
+function parseCliArguments(argv) {
+  const result = {}
+  for (let index = 0; index < argv.length; index += 2) {
+    const flag = argv[index]
+    const value = argv[index + 1]
+    if ((flag !== '--workspace' && flag !== '--packet') || !value) return null
+    if (flag === '--workspace') result.workspaceRoot = value
+    if (flag === '--packet') result.packetPath = value
+  }
+  return result.workspaceRoot && result.packetPath ? result : null
+}
+
+function runCli(argv) {
+  const input = parseCliArguments(argv)
+  if (!input) return malformedResult(['usage: source-fingerprint.mjs --workspace <root> --packet <packet.json>'])
+  let packet
+  try {
+    packet = JSON.parse(readFileSync(input.packetPath, 'utf8'))
+  } catch {
+    return malformedResult(['packet must exist and contain valid JSON'])
+  }
+  return verifyDeliveryPacket({ workspaceRoot: input.workspaceRoot, packet })
+}
+
+if (isDirectExecution(import.meta.url)) {
+  const result = runCli(process.argv.slice(2))
+  process.stdout.write(`${JSON.stringify(result)}\n`)
+  process.exitCode = result.exitCode
+}

package/scripts/runkit-contract/templates/coverage-adopt-request.json

@@ -0,0 +1,26 @@
+{
+  "schemaVersion": "OwlCodaRunKitCoverageAdoptRequestV1",
+  "coverageId": "replace-with-coverage-id",
+  "sources": [
+    {
+      "gateInputPath": ".owlcoda/runkit/executions/replace-with-source-run/verification-receipts/replace-with-receipt/verification-gate-input.json",
+      "gateInputSha256": "replace-with-lowercase-sha256",
+      "commandBindings": [
+        {
+          "receiptCommandId": "replace-with-receipt-command-id",
+          "profileId": "replace-with-profile-id",
+          "commandId": "replace-with-profile-command-id"
+        }
+      ],
+      "dependencyBindings": [
+        {
+          "dependencyId": "root-lockfile",
+          "source": {
+            "kind": "lockfile",
+            "identity": "package-lock.json"
+          }
+        }
+      ]
+    }
+  ]
+}

package/scripts/runkit-contract/templates/finalize-request.json

@@ -0,0 +1,18 @@
+{
+  "schemaVersion": "OwlCodaRunKitFinalizeRequestV1",
+  "receiptId": "replace-with-stable-receipt-id",
+  "deliveryPacketPath": ".owlcoda/runkit/executions/replace-with-run-id/delivery-packets/replace-with-packet.json",
+  "verificationContext": {
+    "schemaVersion": "OwlCodaRunKitVerificationContextV1",
+    "reusePolicy": "portable",
+    "platform": null,
+    "toolchains": [],
+    "lockfiles": [],
+    "fixtures": [],
+    "services": [],
+    "environment": []
+  },
+  "snapshotPaths": [
+    ".owlcoda/runkit/executions/replace-with-run-id/snapshots/replace-with-snapshot.json"
+  ]
+}

package/scripts/runkit-contract/templates/goal-contract.json

@@ -0,0 +1,11 @@
+{
+  "schemaVersion": "OwlCodaRunKitGoalContractV1",
+  "objective": "Replace with one measurable project outcome.",
+  "nonGoals": [],
+  "authorization": {
+    "git": false,
+    "publish": false,
+    "deploy": false,
+    "destructive": false
+  }
+}

package/scripts/runkit-contract/templates/ready-for-commit-request.json

@@ -0,0 +1,11 @@
+{
+  "schemaVersion": "OwlCodaRunKitReadyForCommitRequestV1",
+  "deliveryPacketPath": ".owlcoda/runkit/executions/replace-with-run-id/delivery-packets/replace-with-packet.json",
+  "verificationGateInputPath": ".owlcoda/runkit/executions/replace-with-run-id/verification-receipts/replace-with-receipt/verification-gate-input.json",
+  "roots": [
+    {
+      "role": "candidate",
+      "snapshotPath": ".owlcoda/runkit/executions/replace-with-run-id/snapshots/replace-with-root-snapshot.json"
+    }
+  ]
+}

package/scripts/runkit-contract/templates/resource-preflight-request.json

@@ -0,0 +1,56 @@
+{
+  "schemaVersion": "OwlCodaRunKitResourcePreflightRequestV1",
+  "preflightId": "resource-preflight-001",
+  "verificationPlanPath": ".owlcoda/runkit/executions/replace-run-id/verification-plans/replace-plan-id.json",
+  "verificationPlanSha256": "replace-with-lowercase-sha256",
+  "policy": {
+    "gateMode": "model_required",
+    "maxObservationAgeMs": 300000,
+    "unknownHandling": {
+      "availability": "fail_closed",
+      "quota": "fail_closed",
+      "resetTime": "fail_open",
+      "pricing": "fail_closed"
+    },
+    "limits": {
+      "maxCalls": 100,
+      "maxTotalTokens": 1000000,
+      "maxElapsedMs": 3600000,
+      "maxCostUsd": 10
+    }
+  },
+  "observations": [
+    {
+      "providerId": "replace-provider",
+      "modelId": "replace-model",
+      "adapter": {
+        "id": "owlcoda-model-resource-adapter",
+        "kind": "owlcoda_runtime",
+        "evidenceRef": "artifact:sha256:replace-with-source-reference",
+        "evidenceSha256": "replace-with-lowercase-sha256",
+        "observedAt": "2026-01-01T00:00:00.000Z"
+      },
+      "availability": {
+        "status": "unknown",
+        "reason": "adapter_has_no_verified_live_probe"
+      },
+      "quota": {
+        "remainingCalls": { "status": "unknown", "reason": "provider_not_exposed" },
+        "remainingTokens": { "status": "unknown", "reason": "provider_not_exposed" },
+        "resetAt": { "status": "unknown", "reason": "provider_not_exposed" }
+      },
+      "pricing": { "status": "unknown", "reason": "project_pricing_not_declared" }
+    }
+  ],
+  "workloads": [
+    {
+      "id": "replace-model-workload",
+      "providerId": "replace-provider",
+      "modelId": "replace-model",
+      "calls": 1,
+      "inputTokens": 0,
+      "outputTokens": 0,
+      "elapsedMs": 0
+    }
+  ]
+}

package/scripts/runkit-contract/templates/resume-request.json

@@ -0,0 +1,10 @@
+{
+  "schemaVersion": "OwlCodaRunKitResumeRequestV1",
+  "resumeId": "replace-with-resume-id",
+  "continuationRunId": "replace-with-new-run-id-or-null-for-active-source",
+  "reason": "replace-with-explicit-resume-reason",
+  "coverage": {
+    "coverageId": "replace-with-coverage-id",
+    "sources": []
+  }
+}

package/scripts/runkit-contract/templates/snapshot-request.json

@@ -0,0 +1,23 @@
+{
+  "schemaVersion": "OwlCodaRunKitSnapshotRequestV1",
+  "snapshotId": "replace-with-stable-snapshot-id",
+  "mode": "project",
+  "targetRoot": "replace-with-absolute-project-root",
+  "cwd": ".",
+  "executable": "replace-with-absolute-executable-path",
+  "argv": ["replace-with-exact-argument"],
+  "launcherVersion": "replace-with-launcher-version",
+  "toolVersions": [{ "name": "replace-with-tool-name", "version": "replace-with-tool-version" }],
+  "selectedPaths": ["replace-with-product-source-path"],
+  "statusMode": "porcelain-v1-z-untracked-all-runkit-excluded",
+  "verificationContext": {
+    "schemaVersion": "OwlCodaRunKitVerificationContextV1",
+    "reusePolicy": "portable",
+    "platform": null,
+    "toolchains": [],
+    "lockfiles": [],
+    "fixtures": [],
+    "services": [],
+    "environment": []
+  }
+}

package/scripts/runkit-contract/templates/verify-plan-request.json

@@ -0,0 +1,31 @@
+{
+  "schemaVersion": "OwlCodaRunKitVerifyPlanRequestV1",
+  "planId": "replace-with-plan-id",
+  "deliveryPacketPath": ".owlcoda/runkit/executions/replace-with-run-id/delivery-packets/replace-with-packet.json",
+  "statusMode": "porcelain-v1-z-untracked-all-runkit-excluded",
+  "dependencies": [
+    {
+      "id": "root-lockfile",
+      "path": "package-lock.json",
+      "baselineSha256": "replace-with-lowercase-sha256"
+    }
+  ],
+  "verificationContext": {
+    "schemaVersion": "OwlCodaRunKitVerificationContextV1",
+    "reusePolicy": "portable",
+    "platform": null,
+    "toolchains": [
+      {
+        "name": "node",
+        "version": "replace-with-exact-version"
+      }
+    ],
+    "lockfiles": [],
+    "fixtures": [],
+    "services": [],
+    "environment": []
+  },
+  "coverageIndexPath": ".owlcoda/runkit/executions/replace-with-run-id/coverage-indexes/replace-with-coverage-id.json",
+  "coverageIndexSha256": "replace-with-lowercase-sha256",
+  "globalGates": []
+}

package/scripts/runkit-contract/templates/visual-smoke-request.json

@@ -0,0 +1,32 @@
+{
+  "schemaVersion": "OwlCodaRunKitVisualSmokeRequestV1",
+  "smokeId": "replace-with-smoke-id",
+  "mode": "project",
+  "targetRoot": "/absolute/project/path",
+  "cwd": ".",
+  "executable": "/absolute/path/to/automation-runner",
+  "argv": ["--result", "/absolute/project/path/.owlcoda/runkit/executions/replace-with-run-id/visual-smoke-evidence/replace-with-smoke-id/result.json"],
+  "launcherVersion": "replace-with-version",
+  "toolVersions": [],
+  "selectedPaths": ["replace-with-source-path"],
+  "statusMode": "porcelain-v1-z-untracked-all-runkit-excluded",
+  "verificationContext": {
+    "schemaVersion": "OwlCodaRunKitVerificationContextV1",
+    "reusePolicy": "portable",
+    "platform": null,
+    "toolchains": [],
+    "lockfiles": [],
+    "fixtures": [],
+    "services": [],
+    "environment": []
+  },
+  "resultPath": ".owlcoda/runkit/executions/replace-with-run-id/visual-smoke-evidence/replace-with-smoke-id/result.json",
+  "automationManifest": {
+    "schemaVersion": "OwlCodaRunKitVisualAutomationManifestV1",
+    "surface": "browser",
+    "viewport": { "width": 1280, "height": 720 },
+    "assertionIds": ["replace-with-assertion-id"],
+    "consolePolicy": { "maxErrors": 0, "maxWarnings": 0, "maxExceptions": 0 },
+    "externalNavigationPolicy": "deny"
+  }
+}

package/scripts/runkit-contract/templates/worker-lease.json

@@ -0,0 +1,7 @@
+{
+  "schemaVersion": "OwlCodaRunKitWorkerLeaseV1",
+  "workItemId": "W1",
+  "attempt": 1,
+  "ownedPaths": ["src/example.ts"],
+  "state": "active"
+}