owlrunkit 0.13.0

package/packages/attest/README.md

@@ -0,0 +1,63 @@
+# `@owlcoda/attest`
+
+`@owlcoda/attest` is OwlCoda RunKit's unsigned, read-only verification plane.
+It verifies Quick Receipt V1 artifacts, Formal public verification bundles, and
+local `OwlCodaAttestationRefV1` references without importing the private
+mutation Core.
+
+The package is an unsigned V1 distribution candidate. It is intentionally
+marked private until naming clearance and release authorization exist.
+`consumer-surface-v1.json` freezes the complete command, schema, reference,
+issue-code, compatibility, privacy, metrics, and unsupported-claim covenant.
+
+## CLI
+
+```text
+owlcoda-attest attest <receipt-or-bundle.json> [--workspace <path>] [--json]
+owlcoda-attest resolve <attestation-ref.json> --store <path> [--store <path>...] [--workspace <path>] [--json]
+```
+
+Resolution searches only the explicitly supplied local stores. Both commands
+perform zero network requests and always report `authorizationGranted: false`.
+`owlcoda-attest --help` is the complete installed consumer entry point.
+Without `--workspace`, an otherwise-valid Quick receipt is `INDETERMINATE`: the
+verifier checks receipt-internal relationships, does not read receipt-declared
+output paths, and reports `current_workspace_not_checked`. A deterministically
+invalid receipt remains `NO_GO`. Supply `--workspace` for a `GO` that checks the
+selected current checkout and bound output materials. Formal public bundles
+remain self-contained.
+
+## API
+
+```js
+import {
+  attestFile,
+  createOfflineAttestationBundle,
+  createAttestationRef,
+  parseOfflineAttestationBundle,
+  parseAttestationRef,
+  resolveAttestationRef,
+  verifyBundle,
+} from "@owlcoda/attest";
+```
+
+Offline bundle helpers are pure and read-only. Producer-side file export and
+store import are exposed by `owlcoda runkit store`; this public package never
+writes a receipt store.
+
+Quick `GO` means the captured command, receipt material, receipt-bound source
+relationship, runtime context, and supported Core identity verify under the
+unsigned Quick policy. When `--workspace` is supplied, it also binds the
+selected current checkout. It does not mean Formal acceptance, independent
+review, Git authority, release authority, or business-action authority.
+
+The N/N-1 covenant, honest unsigned limits, and upgrade procedure are defined
+in the repository documentation under
+`docs/architecture/runkit-attestation-v1/`. Rollback preserves historical
+receipts but does not require N-1 to trust an unknown future Core identity.
+
+The packed candidate includes its GPL-3.0-or-later license, a package-level
+SPDX 2.3 SBOM, and the frozen Consumer Surface V1 manifest. Local metrics never
+send telemetry and are not a performance target. They describe local receipt
+state; separate consumption must be evidenced by a caller-owned attestation
+result.

package/packages/attest/cli/owlcoda-attest.mjs

@@ -0,0 +1,155 @@
+#!/usr/bin/env node
+
+import { readFileSync, realpathSync } from "node:fs";
+
+import {
+  attestFile,
+  parseJsonStrict,
+  resolveAttestationRef,
+} from "../src/index.mjs";
+
+const HELP = `Usage:
+  owlcoda-attest attest <receipt-or-bundle.json> [--workspace <path>] [--json]
+  owlcoda-attest resolve <attestation-ref.json> --store <path> [--store <path>...] [--workspace <path>] [--json]
+
+Read-only unsigned V1 verifier.
+Otherwise-valid Quick without --workspace: INDETERMINATE; current checkout/output bytes not checked.
+Authorization granted: false
+Network requests: 0
+`;
+
+function inputError(message) {
+  const error = new Error(message);
+  error.code = "receipt_schema_invalid";
+  return error;
+}
+
+function publicIssueCode(error) {
+  if (error?.code === "DUPLICATE_OBJECT_KEY") return "receipt_duplicate_key";
+  if (error?.code === "ENOENT") return "attestation_material_missing";
+  const supported = new Set([
+    "attestation_material_missing",
+    "receipt_duplicate_key",
+    "receipt_schema_invalid",
+  ]);
+  return supported.has(error?.code) ? error.code : "receipt_schema_invalid";
+}
+
+function parseOptions(args, { valueNames }) {
+  const values = new Map();
+  let json = false;
+  for (let index = 0; index < args.length; index += 1) {
+    const entry = args[index];
+    if (entry === "--json") {
+      json = true;
+      continue;
+    }
+    if (!valueNames.has(entry)) {
+      throw inputError(`unknown option: ${entry}`);
+    }
+    const value = args[index + 1];
+    if (value === undefined || value.startsWith("--")) {
+      throw inputError(`${entry} requires a value`);
+    }
+    const existing = values.get(entry) ?? [];
+    existing.push(value);
+    values.set(entry, existing);
+    index += 1;
+  }
+  return { json, values };
+}
+
+function printHuman(result) {
+  const decision = result.decision ?? result.attestation?.decision ?? result.status;
+  process.stdout.write(`${decision}: ${result.status}\n`);
+  process.stdout.write(`authorization: false\n`);
+  process.stdout.write(`network requests: ${result.networkRequests ?? 0}\n`);
+  if (Array.isArray(result.issueCodes)) {
+    process.stdout.write(`issues: ${result.issueCodes.join(", ") || "none"}\n`);
+  }
+  if (result.nextAllowedAction) {
+    process.stdout.write(`next: ${result.nextAllowedAction}\n`);
+  }
+}
+
+function emit(result, json) {
+  if (json) {
+    process.stdout.write(`${JSON.stringify(result)}\n`);
+  } else {
+    printHuman(result);
+  }
+  return result.exitCode;
+}
+
+function runAttest(args) {
+  const subjectPath = args[0];
+  if (!subjectPath || subjectPath.startsWith("--")) {
+    throw inputError("usage: owlcoda-attest attest <receipt-or-bundle.json> [--workspace <path>] [--json]");
+  }
+  const { json, values } = parseOptions(args.slice(1), {
+    valueNames: new Set(["--workspace"]),
+  });
+  const workspace = values.get("--workspace")?.[0];
+  const result = attestFile({
+    subjectPath,
+    workspaceRoot: workspace === undefined ? undefined : realpathSync(workspace),
+  });
+  return emit(result, json);
+}
+
+function runResolve(args) {
+  const referencePath = args[0];
+  if (!referencePath || referencePath.startsWith("--")) {
+    throw inputError("usage: owlcoda-attest resolve <attestation-ref.json> --store <path> [--store <path>...] [--workspace <path>] [--json]");
+  }
+  const { json, values } = parseOptions(args.slice(1), {
+    valueNames: new Set(["--store", "--workspace"]),
+  });
+  const stores = values.get("--store") ?? [];
+  if (stores.length === 0) {
+    throw inputError("resolve requires at least one --store");
+  }
+  const workspace = values.get("--workspace")?.[0];
+  if ((values.get("--workspace")?.length ?? 0) > 1) {
+    throw inputError("--workspace may be supplied only once");
+  }
+  const reference = parseJsonStrict(readFileSync(referencePath, "utf8"));
+  const result = resolveAttestationRef({
+    reference,
+    stores,
+    workspaceRoot: workspace === undefined ? undefined : realpathSync(workspace),
+  });
+  return emit(result, json);
+}
+
+export function run(argv) {
+  const [command, ...args] = argv;
+  if (command === "--help" || command === "-h" || command === "help") {
+    process.stdout.write(HELP);
+    return 0;
+  }
+  if (command === "attest") return runAttest(args);
+  if (command === "resolve") return runResolve(args);
+  throw inputError("usage: owlcoda-attest <attest|resolve> ...");
+}
+
+try {
+  process.exitCode = run(process.argv.slice(2));
+} catch (error) {
+  const result = {
+    schemaVersion: "OwlCodaAttestCommandErrorV1",
+    status: "input_invalid",
+    exitCode: 3,
+    issueCodes: [publicIssueCode(error)],
+    message: error instanceof Error ? error.message : String(error),
+    authorizationGranted: false,
+    networkRequests: 0,
+  };
+  const json = process.argv.includes("--json");
+  if (json) {
+    process.stdout.write(`${JSON.stringify(result)}\n`);
+  } else {
+    process.stderr.write(`${result.message}\n`);
+  }
+  process.exitCode = result.exitCode;
+}

package/packages/attest/consumer-surface-v1.json

@@ -0,0 +1,255 @@
+{
+  "schemaVersion": "OwlCodaRunKitConsumerSurfaceManifestV1",
+  "consumerSurface": "unsigned_v1",
+  "status": "frozen_candidate",
+  "commands": [
+    {
+      "id": "quick_verify",
+      "invocation": "owlcoda runkit verify -- <executable> [args...]",
+      "lane": "Quick Verification",
+      "mutation": "writes one project-local Quick receipt and bound output artifacts",
+      "runKitControlPlaneNetworkRequests": 0,
+      "childCommandNetworkPolicy": "caller_owned_not_restricted_or_measured",
+      "authorizationGranted": false
+    },
+    {
+      "id": "attest",
+      "invocation": "owlcoda attest <receipt> --workspace <path> [--json]",
+      "lane": "read-only consumer",
+      "mutation": "none",
+      "networkRequests": 0,
+      "authorizationGranted": false
+    },
+    {
+      "id": "resolve",
+      "invocation": "owlcoda resolve <reference> --store <path> [--store <path>...] [--workspace <path>] [--json]",
+      "lane": "read-only consumer",
+      "mutation": "none",
+      "networkRequests": 0,
+      "authorizationGranted": false
+    },
+    {
+      "id": "repair",
+      "invocation": "owlcoda runkit repair --run-id <run-id> [--json]",
+      "lane": "Formal Delivery recovery",
+      "mutation": "appends a repair plan, attempt, replacement packet, and receipt lineage when authorized by the active execution",
+      "runKitControlPlaneNetworkRequests": 0,
+      "childCommandNetworkPolicy": "caller_owned_not_restricted_or_measured",
+      "authorizationGranted": false
+    },
+    {
+      "id": "store_export",
+      "invocation": "owlcoda runkit store export --receipt <path> --output <path> [--json]",
+      "lane": "offline transfer producer",
+      "mutation": "creates one new exact-byte offline bundle and refuses overwrite",
+      "networkRequests": 0,
+      "authorizationGranted": false
+    },
+    {
+      "id": "store_import",
+      "invocation": "owlcoda runkit store import --bundle <path> --store <path> [--json]",
+      "lane": "offline transfer consumer",
+      "mutation": "imports exact receipt bytes idempotently and refuses byte conflicts",
+      "networkRequests": 0,
+      "authorizationGranted": false
+    },
+    {
+      "id": "local_metrics",
+      "invocation": "owlcoda runkit metrics --local [--json]",
+      "lane": "local inspection",
+      "mutation": "none",
+      "networkRequests": 0,
+      "authorizationGranted": false
+    },
+    {
+      "id": "standalone_attest",
+      "invocation": "owlcoda-attest attest <receipt-or-bundle.json> [--workspace <path>] [--json]",
+      "lane": "standalone read-only consumer",
+      "mutation": "none",
+      "networkRequests": 0,
+      "authorizationGranted": false
+    },
+    {
+      "id": "standalone_resolve",
+      "invocation": "owlcoda-attest resolve <attestation-ref.json> --store <path> [--store <path>...] [--workspace <path>] [--json]",
+      "lane": "standalone read-only consumer",
+      "mutation": "none",
+      "networkRequests": 0,
+      "authorizationGranted": false
+    }
+  ],
+  "schemas": [
+    "OwlCodaAttestationRefV1",
+    "OwlCodaAttestationResultV1",
+    "OwlCodaOfflineAttestationBundleV1",
+    "OwlCodaQuickVerificationReceiptV1",
+    "OwlCodaRunKitPublicVerificationBundleV1",
+    "OwlCodaWorkspaceSnapshotV1"
+  ],
+  "attestationReference": {
+    "schemaVersion": "OwlCodaAttestationRefV1",
+    "requiredKeys": [
+      "schemaVersion",
+      "receiptId",
+      "receiptSha256",
+      "coreIdentity"
+    ],
+    "coreIdentityRequiredKeys": [
+      "contractVersion",
+      "coreManifestSha256"
+    ],
+    "additionalProperties": false,
+    "locationHints": false
+  },
+  "outcomes": {
+    "attestationDecisions": [
+      "GO",
+      "NO_GO",
+      "INDETERMINATE"
+    ],
+    "resolutionStatuses": {
+      "resolved_valid": 0,
+      "resolved_invalid": 1,
+      "resolved_indeterminate": 3,
+      "ambiguous": 1,
+      "not_found": 3
+    }
+  },
+  "assurance": {
+    "quickLane": "captured_verification",
+    "formalLane": "receipt_backed_delivery",
+    "quickCanSatisfyFormalAcceptance": false,
+    "signatureRequired": false,
+    "signatureAbsentIssueCode": "signature_absent",
+    "quickWithoutWorkspace": {
+      "otherwiseValidDecision": "INDETERMINATE",
+      "deterministicallyInvalidDecision": "NO_GO"
+    },
+    "independentReviewRequiredForFormalHighRisk": true,
+    "authorizationDerivedFromReceipt": false
+  },
+  "compatibility": {
+    "policy": "N verifies N and declared N-1 producer identities; N-1 is not required to trust an undeclared future producer identity",
+    "historicalBytesRewritten": false,
+    "scenarios": [
+      {
+        "id": "clean_first_use",
+        "evidencePath": "scripts/runkit-wave1-fresh-checkout-smoke.mjs"
+      },
+      {
+        "id": "dirty_workspace",
+        "evidencePath": "tests/runkit-contract/quick-verification.workflow.test.mjs"
+      },
+      {
+        "id": "offline_export_import_resolve",
+        "evidencePath": "tests/runkit-contract/wave4-offline-store.test.mjs"
+      },
+      {
+        "id": "n_minus_one_upgrade",
+        "evidencePath": "tests/runkit-contract/wave4-distribution-compatibility.test.mjs"
+      },
+      {
+        "id": "rollback",
+        "evidencePath": "tests/runkit-contract/wave4-distribution-compatibility.test.mjs"
+      },
+      {
+        "id": "historical_unsigned_receipt",
+        "evidencePath": "tests/runkit-contract/wave4-distribution-compatibility.test.mjs"
+      },
+      {
+        "id": "source_drift_repair",
+        "evidencePath": "tests/runkit-contract/repair-execution.workflow.test.mjs"
+      },
+      {
+        "id": "failed_repair_lineage",
+        "evidencePath": "tests/runkit-contract/repair-execution.workflow.test.mjs"
+      }
+    ]
+  },
+  "privacy": {
+    "defaultNetworkRequests": 0,
+    "defaultNetworkRequestsScope": "RunKit control plane only; a captured or replayed child command is caller-owned, unrestricted, and unmeasured",
+    "telemetry": false,
+    "credentialsRequired": false,
+    "hostedServiceRequired": false,
+    "receiptContentsMayContainCommandArgumentsAndPaths": true,
+    "operatorMustReviewBeforeExternalSharing": true
+  },
+  "metrics": {
+    "command": "owlcoda runkit metrics --local [--json]",
+    "localOnly": true,
+    "optInInspection": true,
+    "telemetry": false,
+    "networkRequests": 0,
+    "performanceTarget": false,
+    "automaticallyRecordsIndependentConsumption": false,
+    "statement": "Local totals describe project receipt state; independent consumption is evidenced by caller-owned attestation results, never hidden instrumentation."
+  },
+  "issueCodes": {
+    "ACCEPTED_AUTHORITY_GRANTED": "A Formal bundle marked accepted while its closeout grants authority.",
+    "ACCEPTED_RECEIPT_NOT_PASSED": "A Formal bundle marked accepted while its active receipt did not pass.",
+    "ACTIVE_RECEIPT_CONTEXT_BINDING_MISMATCH": "The active Formal receipt context does not match the declared verification context.",
+    "ACTIVE_RECEIPT_SOURCE_BINDING_MISMATCH": "The active Formal receipt source does not match the declared source fingerprint.",
+    "CANONICAL_JSON_INVALID": "Canonical JSON computation failed at a public Formal artifact boundary.",
+    "CLOSEOUT_ACTIVE_RECEIPT_MISMATCH": "The Formal closeout does not bind the active receipt.",
+    "CLOSEOUT_CONTEXT_BINDING_MISMATCH": "The Formal closeout context does not bind the declared verification context.",
+    "CLOSEOUT_SOURCE_BINDING_MISMATCH": "The Formal closeout source does not bind the declared source fingerprint.",
+    "DUPLICATE_OBJECT_KEY": "A Formal JSON input contains a duplicate object key.",
+    "EXTERNAL_AUTHORITY_GRANTED": "A public Formal bundle attempts to grant external authority.",
+    "INPUT_FILE_INVALID": "A Formal verifier input file cannot be read under the public file boundary.",
+    "INPUT_JSON_INVALID": "A Formal verifier input is not strict valid JSON.",
+    "INPUT_SIZE_LIMIT_EXCEEDED": "A Formal verifier input exceeds the deterministic byte limit.",
+    "JSON_NESTING_LIMIT_EXCEEDED": "A Formal verifier input exceeds the deterministic nesting limit.",
+    "JSON_NODE_LIMIT_EXCEEDED": "A Formal verifier input exceeds the deterministic JSON node limit.",
+    "PUBLIC_BUNDLE_SHAPE_INVALID": "A Formal public bundle has an unknown, missing, or extra field.",
+    "RECEIPT_AUTHORITY_GRANTED": "A Formal receipt attempts to grant external authority.",
+    "RECEIPT_COUNT_LIMIT_EXCEEDED": "A Formal bundle exceeds the deterministic receipt-count limit.",
+    "RECEIPT_ID_DUPLICATE": "A Formal receipt identifier appears more than once.",
+    "RECEIPT_LINEAGE_CYCLE": "Formal replacement lineage contains a cycle.",
+    "RECEIPT_LINEAGE_MULTIPLE_ACTIVE_LEAVES": "Formal replacement lineage has more than one active leaf.",
+    "RECEIPT_LINEAGE_NO_ACTIVE_LEAF": "Formal replacement lineage has no active leaf.",
+    "RECEIPT_LINEAGE_ORPHAN": "A Formal replacement references a parent absent from earlier append-only lineage.",
+    "SOURCE_FINGERPRINT_MISMATCH": "The Formal source payload does not match its declared fingerprint.",
+    "VERIFICATION_CONTEXT_FINGERPRINT_MISMATCH": "The Formal verification context does not match its declared fingerprint.",
+    "anchor_absent": "No external checkpoint or timestamp anchor was checked; unsigned V1 remains usable under local policy.",
+    "attestation_material_missing": "A receipt-bound output material is unavailable, so the result is indeterminate rather than silently accepted.",
+    "attestation_target_ambiguous": "More than one byte-distinct local receipt matches the reference.",
+    "attestation_target_not_found": "No receipt matching the exact local reference was found in the supplied stores.",
+    "core_identity_mismatch": "The receipt producer Core identity is not declared by this verifier.",
+    "current_workspace_not_checked": "No explicit workspace was selected, so Quick attestation did not read output paths or compare current checkout bytes.",
+    "quick_ignored_artifact_unbound": "Git-ignored outputs are not bound unless an explicit artifact contract names and hashes them.",
+    "quick_receipt_store_invalid": "The project-local receipt store failed its path or file integrity boundary.",
+    "receipt_duplicate_key": "The receipt contains a duplicate JSON object key.",
+    "receipt_material_hash_mismatch": "A receipt-bound material differs from its recorded bytes, hash, or size.",
+    "receipt_schema_invalid": "The receipt does not satisfy the strict supported schema.",
+    "receipt_source_mismatch": "The selected workspace source does not match the receipt-bound source.",
+    "repair_plan_incomplete": "A deterministic repair plan cannot safely replay every required command and binding.",
+    "repair_replay_failed": "A replay command failed; the failed attempt and earlier lineage remain append-only.",
+    "signature_absent": "No receipt signature is present or checked; this is expected under unsigned V1 and proves no signer identity.",
+    "source_mutated_during_verification": "Source bytes changed while the command was running.",
+    "verification_command_failed": "The captured verification command did not exit successfully.",
+    "verification_context_mismatch": "The current runtime context differs from the receipt-bound runtime context."
+  },
+  "unsupportedClaims": [
+    "unsigned_receipt_proves_signer_identity",
+    "unsigned_receipt_proves_independent_machine_or_organization",
+    "issued_at_proves_trusted_wall_clock_time",
+    "unsigned_receipt_proves_external_existence_before_a_time",
+    "ignored_artifact_is_bound_without_explicit_artifact_contract",
+    "quick_receipt_proves_formal_acceptance",
+    "receipt_grants_git_release_or_business_authority",
+    "captured_or_replayed_child_command_has_zero_network",
+    "local_metrics_are_independent_consumption_events"
+  ],
+  "integration": {
+    "persist": "OwlCodaAttestationRefV1 plus the referenced receipt bytes",
+    "consume": "attest or resolve through a declared command or the standalone package",
+    "doNotImport": [
+      "private RunKit mutation Core",
+      "Desktop or App Server internals",
+      "project-private receipt-store layout"
+    ],
+    "futureSignedProfile": "additive; producer command and AttestationRefV1 shape remain unchanged"
+  },
+  "authorizationGranted": false
+}

package/packages/attest/distribution-manifest-v1.json

@@ -0,0 +1,104 @@
+{
+  "schemaVersion": "OwlCodaRunKitDistributionManifestV1",
+  "consumerSurface": "unsigned_v1",
+  "current": {
+    "packageName": "@owlcoda/attest",
+    "packageVersion": "0.2.0",
+    "commands": [
+      "owlcoda-attest attest",
+      "owlcoda-attest resolve"
+    ],
+    "schemaVersions": [
+      "OwlCodaAttestationRefV1",
+      "OwlCodaAttestationResultV1",
+      "OwlCodaOfflineAttestationBundleV1",
+      "OwlCodaQuickVerificationReceiptV1",
+      "OwlCodaRunKitPublicVerificationBundleV1",
+      "OwlCodaWorkspaceSnapshotV1"
+    ]
+  },
+  "nMinusOne": {
+    "packageName": "@owlcoda/attest",
+    "packageVersion": "0.1.0",
+    "tarballSha256": "sha256:5a6bb0aa76a11c70d2539abde1499a4a01f3d2fe5ae6a36dd9b5f8e782312380"
+  },
+  "consumerSurfaceManifest": {
+    "path": "consumer-surface-v1.json",
+    "sha256": "sha256:66766ee292b0162869c617b8e8dff2d985336a845f4cfc596e7262f6311729e4"
+  },
+  "sbom": {
+    "path": "sbom.spdx.json",
+    "sha256": "sha256:8346b0d642224f78319da8ac7016f7b41f9807240304a80bbd1d9c89663a2eeb"
+  },
+  "license": {
+    "path": "LICENSE",
+    "spdx": "GPL-3.0-or-later",
+    "sha256": "sha256:3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986"
+  },
+  "supportedProducerCoreIdentities": [
+    {
+      "contractVersion": "0.2",
+      "coreVersion": "0.13.0",
+      "coreManifestSha256": "sha256:0e3233a417365afb4e2ce22db5260608a9c697a819cd5c02897276d6454dde1f"
+    },
+    {
+      "contractVersion": "0.2",
+      "coreVersion": "0.13.0",
+      "coreManifestSha256": "sha256:037c012751b32abbbb48ce8a8d2cd8faa4fc2c38d6797db391205477e667065f"
+    },
+    {
+      "contractVersion": "0.2",
+      "coreVersion": "0.12.0",
+      "coreManifestSha256": "sha256:c415b10cb00d2a7891744b7257774fa501ddf40f8ec2f290356505a17fefb40f"
+    },
+    {
+      "contractVersion": "0.2",
+      "coreVersion": "0.12.0",
+      "coreManifestSha256": "sha256:be4b079fb0bc29e71858af03a1e579f864d4414c815ac612c3b514d8d663d07b"
+    },
+    {
+      "contractVersion": "0.2",
+      "coreVersion": "0.13.0",
+      "coreManifestSha256": "sha256:2f840d1884b34656902f8f23af3bd8052dde3212aa516dac2cbb0e0b29627ea1"
+    },
+    {
+      "contractVersion": "0.2",
+      "coreVersion": "0.13.0",
+      "coreManifestSha256": "sha256:febf2551317fce9e4bb412b833a392a20376d702dda09c57d6116e8a3ca4f857"
+    },
+    {
+      "contractVersion": "0.2",
+      "coreVersion": "0.13.0",
+      "coreManifestSha256": "sha256:4b72f572b6964f149c4a6fe5c2c9da85f73b8060c88023dc96ba5ca50a036972"
+    },
+    {
+      "contractVersion": "0.2",
+      "coreVersion": "0.13.0",
+      "coreManifestSha256": "sha256:0455c847bf2df77703583c6f19c20cf103206bafc4f122795bf34d3f85f0263d"
+    }
+  ],
+  "includedRoots": [
+    "cli/",
+    "consumer-surface-v1.json",
+    "fixtures/",
+    "LICENSE",
+    "schemas/",
+    "sbom.spdx.json",
+    "src/",
+    "README.md",
+    "distribution-manifest-v1.json",
+    "package.json"
+  ],
+  "forbiddenPatterns": [
+    ".owlcoda/",
+    "credential",
+    "desktop/",
+    "execution-prompts/",
+    "private-engine",
+    "scripts/runkit-contract/",
+    "src/native/"
+  ],
+  "networkRequests": 0,
+  "signatureRequired": false,
+  "authorizationGranted": false
+}

package/packages/attest/fixtures/bad/accepted-authority-leak.json

@@ -0,0 +1,7 @@
+{
+  "schemaVersion": "OwlCodaRunKitPublicVerificationBundleV1",
+  "source": {"fingerprintAlgorithm": "sha256-canonical-json-v1", "fingerprint": "sha256:6cbc7b5570b8ae2cf63857ade8fc9362bf78603488c594b6b3db9b647b6d1fac", "payload": {"manifestVersion": 1, "files": [{"path": "src/order.json", "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}]}},
+  "verificationContext": {"fingerprintAlgorithm": "sha256-canonical-json-v1", "fingerprint": "sha256:a617e3a705a0e45c4205b63635acff13a97d91707e63165fe9ac416e253befc4", "payload": {"platform": "darwin-arm64", "commands": [{"executable": "/usr/bin/node", "argv": ["--test", "fixtures"], "cwd": "."}]}},
+  "receipts": [{"schemaVersion": "OwlCodaRunKitPublicVerificationReceiptV1", "receiptId": "receipt-001", "status": "passed", "replacesReceiptId": null, "sourceFingerprint": "sha256:6cbc7b5570b8ae2cf63857ade8fc9362bf78603488c594b6b3db9b647b6d1fac", "verificationContextFingerprint": "sha256:a617e3a705a0e45c4205b63635acff13a97d91707e63165fe9ac416e253befc4", "authorizationGranted": false, "gitAuthorization": false, "releaseAuthorization": false, "artifactMutationAuthorization": false, "businessActionAuthorization": false}],
+  "closeout": {"schemaVersion": "OwlCodaRunKitPublicCloseoutV1", "decision": "accepted", "activeReceiptId": "receipt-001", "sourceFingerprint": "sha256:6cbc7b5570b8ae2cf63857ade8fc9362bf78603488c594b6b3db9b647b6d1fac", "verificationContextFingerprint": "sha256:a617e3a705a0e45c4205b63635acff13a97d91707e63165fe9ac416e253befc4", "authorizationGranted": false, "gitAuthorization": true, "releaseAuthorization": false, "artifactMutationAuthorization": false, "businessActionAuthorization": false}
+}

package/packages/attest/fixtures/bad/accepted-failed-receipt.json

@@ -0,0 +1,7 @@
+{
+  "schemaVersion": "OwlCodaRunKitPublicVerificationBundleV1",
+  "source": {"fingerprintAlgorithm": "sha256-canonical-json-v1", "fingerprint": "sha256:6cbc7b5570b8ae2cf63857ade8fc9362bf78603488c594b6b3db9b647b6d1fac", "payload": {"manifestVersion": 1, "files": [{"path": "src/order.json", "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}]}},
+  "verificationContext": {"fingerprintAlgorithm": "sha256-canonical-json-v1", "fingerprint": "sha256:a617e3a705a0e45c4205b63635acff13a97d91707e63165fe9ac416e253befc4", "payload": {"platform": "darwin-arm64", "commands": [{"executable": "/usr/bin/node", "argv": ["--test", "fixtures"], "cwd": "."}]}},
+  "receipts": [{"schemaVersion": "OwlCodaRunKitPublicVerificationReceiptV1", "receiptId": "receipt-001", "status": "failed", "replacesReceiptId": null, "sourceFingerprint": "sha256:6cbc7b5570b8ae2cf63857ade8fc9362bf78603488c594b6b3db9b647b6d1fac", "verificationContextFingerprint": "sha256:a617e3a705a0e45c4205b63635acff13a97d91707e63165fe9ac416e253befc4", "authorizationGranted": false, "gitAuthorization": false, "releaseAuthorization": false, "artifactMutationAuthorization": false, "businessActionAuthorization": false}],
+  "closeout": {"schemaVersion": "OwlCodaRunKitPublicCloseoutV1", "decision": "accepted", "activeReceiptId": "receipt-001", "sourceFingerprint": "sha256:6cbc7b5570b8ae2cf63857ade8fc9362bf78603488c594b6b3db9b647b6d1fac", "verificationContextFingerprint": "sha256:a617e3a705a0e45c4205b63635acff13a97d91707e63165fe9ac416e253befc4", "authorizationGranted": false, "gitAuthorization": false, "releaseAuthorization": false, "artifactMutationAuthorization": false, "businessActionAuthorization": false}
+}

package/packages/attest/fixtures/bad/active-context-binding-mismatch.json

@@ -0,0 +1,7 @@
+{
+  "schemaVersion": "OwlCodaRunKitPublicVerificationBundleV1",
+  "source": {"fingerprintAlgorithm": "sha256-canonical-json-v1", "fingerprint": "sha256:6cbc7b5570b8ae2cf63857ade8fc9362bf78603488c594b6b3db9b647b6d1fac", "payload": {"manifestVersion": 1, "files": [{"path": "src/order.json", "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}]}},
+  "verificationContext": {"fingerprintAlgorithm": "sha256-canonical-json-v1", "fingerprint": "sha256:a617e3a705a0e45c4205b63635acff13a97d91707e63165fe9ac416e253befc4", "payload": {"platform": "darwin-arm64", "commands": [{"executable": "/usr/bin/node", "argv": ["--test", "fixtures"], "cwd": "."}]}},
+  "receipts": [{"schemaVersion": "OwlCodaRunKitPublicVerificationReceiptV1", "receiptId": "receipt-001", "status": "passed", "replacesReceiptId": null, "sourceFingerprint": "sha256:6cbc7b5570b8ae2cf63857ade8fc9362bf78603488c594b6b3db9b647b6d1fac", "verificationContextFingerprint": "sha256:0000000000000000000000000000000000000000000000000000000000000000", "authorizationGranted": false, "gitAuthorization": false, "releaseAuthorization": false, "artifactMutationAuthorization": false, "businessActionAuthorization": false}],
+  "closeout": {"schemaVersion": "OwlCodaRunKitPublicCloseoutV1", "decision": "accepted", "activeReceiptId": "receipt-001", "sourceFingerprint": "sha256:6cbc7b5570b8ae2cf63857ade8fc9362bf78603488c594b6b3db9b647b6d1fac", "verificationContextFingerprint": "sha256:a617e3a705a0e45c4205b63635acff13a97d91707e63165fe9ac416e253befc4", "authorizationGranted": false, "gitAuthorization": false, "releaseAuthorization": false, "artifactMutationAuthorization": false, "businessActionAuthorization": false}
+}

package/packages/attest/fixtures/bad/active-source-binding-mismatch.json

@@ -0,0 +1,7 @@
+{
+  "schemaVersion": "OwlCodaRunKitPublicVerificationBundleV1",
+  "source": {"fingerprintAlgorithm": "sha256-canonical-json-v1", "fingerprint": "sha256:6cbc7b5570b8ae2cf63857ade8fc9362bf78603488c594b6b3db9b647b6d1fac", "payload": {"manifestVersion": 1, "files": [{"path": "src/order.json", "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}]}},
+  "verificationContext": {"fingerprintAlgorithm": "sha256-canonical-json-v1", "fingerprint": "sha256:a617e3a705a0e45c4205b63635acff13a97d91707e63165fe9ac416e253befc4", "payload": {"platform": "darwin-arm64", "commands": [{"executable": "/usr/bin/node", "argv": ["--test", "fixtures"], "cwd": "."}]}},
+  "receipts": [{"schemaVersion": "OwlCodaRunKitPublicVerificationReceiptV1", "receiptId": "receipt-001", "status": "passed", "replacesReceiptId": null, "sourceFingerprint": "sha256:0000000000000000000000000000000000000000000000000000000000000000", "verificationContextFingerprint": "sha256:a617e3a705a0e45c4205b63635acff13a97d91707e63165fe9ac416e253befc4", "authorizationGranted": false, "gitAuthorization": false, "releaseAuthorization": false, "artifactMutationAuthorization": false, "businessActionAuthorization": false}],
+  "closeout": {"schemaVersion": "OwlCodaRunKitPublicCloseoutV1", "decision": "accepted", "activeReceiptId": "receipt-001", "sourceFingerprint": "sha256:6cbc7b5570b8ae2cf63857ade8fc9362bf78603488c594b6b3db9b647b6d1fac", "verificationContextFingerprint": "sha256:a617e3a705a0e45c4205b63635acff13a97d91707e63165fe9ac416e253befc4", "authorizationGranted": false, "gitAuthorization": false, "releaseAuthorization": false, "artifactMutationAuthorization": false, "businessActionAuthorization": false}
+}

package/packages/attest/fixtures/bad/context-fingerprint-mismatch.json

@@ -0,0 +1,7 @@
+{
+  "schemaVersion": "OwlCodaRunKitPublicVerificationBundleV1",
+  "source": {"fingerprintAlgorithm": "sha256-canonical-json-v1", "fingerprint": "sha256:6cbc7b5570b8ae2cf63857ade8fc9362bf78603488c594b6b3db9b647b6d1fac", "payload": {"manifestVersion": 1, "files": [{"path": "src/order.json", "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}]}},
+  "verificationContext": {"fingerprintAlgorithm": "sha256-canonical-json-v1", "fingerprint": "sha256:0000000000000000000000000000000000000000000000000000000000000000", "payload": {"platform": "darwin-arm64", "commands": [{"executable": "/usr/bin/node", "argv": ["--test", "fixtures"], "cwd": "."}]}},
+  "receipts": [{"schemaVersion": "OwlCodaRunKitPublicVerificationReceiptV1", "receiptId": "receipt-001", "status": "passed", "replacesReceiptId": null, "sourceFingerprint": "sha256:6cbc7b5570b8ae2cf63857ade8fc9362bf78603488c594b6b3db9b647b6d1fac", "verificationContextFingerprint": "sha256:0000000000000000000000000000000000000000000000000000000000000000", "authorizationGranted": false, "gitAuthorization": false, "releaseAuthorization": false, "artifactMutationAuthorization": false, "businessActionAuthorization": false}],
+  "closeout": {"schemaVersion": "OwlCodaRunKitPublicCloseoutV1", "decision": "accepted", "activeReceiptId": "receipt-001", "sourceFingerprint": "sha256:6cbc7b5570b8ae2cf63857ade8fc9362bf78603488c594b6b3db9b647b6d1fac", "verificationContextFingerprint": "sha256:0000000000000000000000000000000000000000000000000000000000000000", "authorizationGranted": false, "gitAuthorization": false, "releaseAuthorization": false, "artifactMutationAuthorization": false, "businessActionAuthorization": false}
+}

package/packages/attest/fixtures/bad/duplicate-object-key.json

@@ -0,0 +1,8 @@
+{
+  "schemaVersion": "OwlCodaRunKitPublicVerificationBundleV1",
+  "schemaVersion": "OwlCodaRunKitPublicVerificationBundleV1",
+  "source": {"fingerprintAlgorithm": "sha256-canonical-json-v1", "fingerprint": "sha256:6cbc7b5570b8ae2cf63857ade8fc9362bf78603488c594b6b3db9b647b6d1fac", "payload": {"manifestVersion": 1, "files": [{"path": "src/order.json", "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}]}},
+  "verificationContext": {"fingerprintAlgorithm": "sha256-canonical-json-v1", "fingerprint": "sha256:a617e3a705a0e45c4205b63635acff13a97d91707e63165fe9ac416e253befc4", "payload": {"platform": "darwin-arm64", "commands": [{"executable": "/usr/bin/node", "argv": ["--test", "fixtures"], "cwd": "."}]}},
+  "receipts": [{"schemaVersion": "OwlCodaRunKitPublicVerificationReceiptV1", "receiptId": "receipt-001", "status": "passed", "replacesReceiptId": null, "sourceFingerprint": "sha256:6cbc7b5570b8ae2cf63857ade8fc9362bf78603488c594b6b3db9b647b6d1fac", "verificationContextFingerprint": "sha256:a617e3a705a0e45c4205b63635acff13a97d91707e63165fe9ac416e253befc4", "authorizationGranted": false, "gitAuthorization": false, "releaseAuthorization": false, "artifactMutationAuthorization": false, "businessActionAuthorization": false}],
+  "closeout": {"schemaVersion": "OwlCodaRunKitPublicCloseoutV1", "decision": "accepted", "activeReceiptId": "receipt-001", "sourceFingerprint": "sha256:6cbc7b5570b8ae2cf63857ade8fc9362bf78603488c594b6b3db9b647b6d1fac", "verificationContextFingerprint": "sha256:a617e3a705a0e45c4205b63635acff13a97d91707e63165fe9ac416e253befc4", "authorizationGranted": false, "gitAuthorization": false, "releaseAuthorization": false, "artifactMutationAuthorization": false, "businessActionAuthorization": false}
+}