owlrunkit 0.14.0 → 0.15.0

package/scripts/runkit-contract/registry-adoption-gate.mjs

@@ -21,6 +21,45 @@ const RELEASE_EVIDENCE_FIELDS = Object.freeze([
   "version",
 ]);
 
+const STORED_EVIDENCE_FIELDS = Object.freeze([
+  "authorizationGranted",
+  "authority",
+  "decision",
+  "exactSpec",
+  "installedBinding",
+  "packageName",
+  "registryRelease",
+  "schemaVersion",
+  "status",
+  "version",
+]);
+
+const STORED_RELEASE_FIELDS = Object.freeze([
+  "integrity",
+  "packageName",
+  "registry",
+  "shasum",
+  "tarballUrl",
+  "version",
+]);
+
+const STORED_INSTALL_FIELDS = Object.freeze([
+  "integrity",
+  "packageName",
+  "requestedSpec",
+  "resolved",
+  "version",
+]);
+
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function hasExactFields(value, fields) {
+  return isRecord(value)
+    && Object.keys(value).sort().join("\n") === [...fields].sort().join("\n");
+}
+
 function decision(policy, issueCodes) {
   return {
     schemaVersion: "OwlCodaRunKitRegistryAdoptionDecisionV1",
@@ -45,6 +84,78 @@ export function isCanonicalSha512Integrity(value) {
   return bytes.length === 64 && bytes.toString("base64") === match[1];
 }
 
+export function validateStoredRegistryAdoptionEvidence({
+  evidence,
+  packageName,
+  version,
+  localInstall,
+}) {
+  const issues = [];
+  const exactSpec = `${packageName}@${version}`;
+  const expectedTarball = expectedRegistryTarballUrl(packageName, version);
+  if (
+    !hasExactFields(evidence, STORED_EVIDENCE_FIELDS)
+    || evidence.schemaVersion !== "OwlCodaRunKitRegistryAdoptionEvidenceV1"
+    || evidence.status !== "adopted"
+    || evidence.decision !== "ELIGIBLE"
+    || evidence.packageName !== packageName
+    || evidence.version !== version
+    || evidence.exactSpec !== exactSpec
+    || evidence.authorizationGranted !== false
+  ) {
+    issues.push("adoption_evidence_invalid");
+  }
+  const release = evidence?.registryRelease;
+  if (
+    !hasExactFields(release, STORED_RELEASE_FIELDS)
+    || release.registry !== OFFICIAL_NPM_REGISTRY
+    || release.packageName !== packageName
+    || release.version !== version
+    || !/^[0-9a-f]{40}$/i.test(release.shasum)
+    || !isCanonicalSha512Integrity(release.integrity)
+    || release.tarballUrl !== expectedTarball
+  ) {
+    issues.push("adoption_registry_binding_invalid");
+  }
+  const installed = evidence?.installedBinding;
+  if (
+    !hasExactFields(installed, STORED_INSTALL_FIELDS)
+    || installed.requestedSpec !== exactSpec
+    || installed.packageName !== packageName
+    || installed.version !== version
+    || installed.integrity !== release?.integrity
+    || installed.resolved !== expectedTarball
+  ) {
+    issues.push("adoption_installed_binding_invalid");
+  }
+  if (
+    !hasExactFields(evidence?.authority, ["foreignProjectWrite", "git", "release"])
+    || evidence.authority.git !== false
+    || evidence.authority.release !== false
+    || evidence.authority.foreignProjectWrite !== false
+  ) {
+    issues.push("adoption_authority_invalid");
+  }
+  if (
+    localInstall !== undefined
+    && (
+      localInstall.status !== "bound"
+      || localInstall.requestedSpec !== exactSpec
+      || localInstall.packageName !== packageName
+      || localInstall.version !== version
+      || localInstall.integrity !== release?.integrity
+      || localInstall.resolved !== expectedTarball
+    )
+  ) {
+    issues.push("adoption_local_install_drift");
+  }
+  const issueCodes = [...new Set(issues)].sort();
+  return {
+    valid: issueCodes.length === 0,
+    issueCodes,
+  };
+}
+
 function validReleaseEvidence(policy, release) {
   if (
     policy.registry !== OFFICIAL_NPM_REGISTRY

package/scripts/runkit-contract/registry-adoption.mjs

@@ -10,6 +10,7 @@ import {
   OFFICIAL_NPM_REGISTRY,
   evaluateRegistryAdoption,
 } from "./registry-adoption-gate.mjs";
+import { CORE_VERSION } from "./core-contract.mjs";
 import {
   readLocalInstallBinding,
   readRegistryExact,
@@ -18,7 +19,7 @@ import {
 import { writeJsonExclusiveAtomically } from "./provenance-common.mjs";
 
 const PACKAGE_NAME = "owlrunkit";
-const CANDIDATE_VERSION = "0.14.0";
+const CANDIDATE_VERSION = CORE_VERSION;
 const EXACT_SPEC = `${PACKAGE_NAME}@${CANDIDATE_VERSION}`;
 
 const POLICY = Object.freeze({

package/scripts/runkit-contract/runkit-cli.mjs

@@ -15,6 +15,7 @@ import {
 import path from "node:path";
 
 import {
+  CORE_VERSION,
   RUNTIME_ROOT,
   acceptedCloseoutVerificationIssues,
   createCoreArtifact,
@@ -73,6 +74,8 @@ import {
 } from "./profile-onboarding.mjs";
 import {
   formatDoctorHuman,
+  readAdoptionReadiness,
+  readProfileLauncherReadiness,
   runDoctor,
 } from "./onboarding-doctor.mjs";
 import {
@@ -81,7 +84,7 @@ import {
 } from "./registry-adoption.mjs";
 import { OFFICIAL_NPM_REGISTRY } from "./registry-adoption-gate.mjs";
 
-const TOP_LEVEL_HELP = `OwlRunKit 0.14.0
+const TOP_LEVEL_HELP = `OwlRunKit ${CORE_VERSION}
 
 Usage:
   owlrunkit <command> [options]
@@ -89,7 +92,7 @@ Usage:
 Start here:
   owlrunkit doctor --workspace .
   owlrunkit profiles detect --workspace . --dry-run
-  owlrunkit adopt --workspace . --exact owlrunkit@0.14.0
+  owlrunkit adopt --workspace . --exact owlrunkit@${CORE_VERSION}
 
 Quick Verification
   owlrunkit quick-verify --workspace . -- <command> [args...]
@@ -121,23 +124,61 @@ function withHumanOutput(result, humanOutput) {
   return result;
 }
 
-function onboardingProjection() {
+function profilesReadiness(root) {
+  if (!root) return { valid: false, launcherWarnings: [] };
+  try {
+    const validation = validateProfiles({ workspaceRoot: root });
+    const launchers = readProfileLauncherReadiness({ workspaceRoot: root });
+    return {
+      valid: validation.valid === true && launchers.ready,
+      launcherWarnings: launchers.launcherWarnings,
+    };
+  } catch {
+    return { valid: false, launcherWarnings: [] };
+  }
+}
+
+function onboardingProjection(root, recovery = null) {
+  const profiles = profilesReadiness(root);
+  const adoption = root
+    ? readAdoptionReadiness({ workspaceRoot: root })
+    : { status: "missing" };
+  const profilesReady = profiles.valid;
+  const adoptionReady = adoption.status === "ok";
+  if (profilesReady && adoptionReady) {
+    return {
+      nextAllowedAction: recovery?.nextAllowedAction ?? "plan_new_execution",
+      completed: true,
+      steps: [],
+    };
+  }
+  const steps = [
+    {
+      id: "doctor",
+      command: "owlrunkit doctor --workspace .",
+    },
+    ...(!profilesReady
+      ? profiles.launcherWarnings.length > 0
+        ? [{
+            id: "profile_launchers_review",
+            command: "owlrunkit doctor --workspace .",
+          }]
+        : [{
+          id: "profiles_detect",
+          command: "owlrunkit profiles detect --workspace . --dry-run",
+        }]
+      : []),
+    ...(!adoptionReady
+      ? [{
+          id: "adopt_or_start",
+          command: `owlrunkit adopt --workspace . --exact owlrunkit@${CORE_VERSION} or owlrunkit start`,
+        }]
+      : []),
+  ];
   return {
     nextAllowedAction: "run_onboarding_diagnostics",
-    steps: [
-      {
-        id: "doctor",
-        command: "owlrunkit doctor --workspace .",
-      },
-      {
-        id: "profiles_detect",
-        command: "owlrunkit profiles detect --workspace . --dry-run",
-      },
-      {
-        id: "adopt_or_start",
-        command: "owlrunkit adopt --workspace . --exact owlrunkit@0.14.0 or owlrunkit start",
-      },
-    ],
+    completed: false,
+    steps,
   };
 }
 
@@ -666,10 +707,11 @@ function closeoutGateRejected(runId, decision, issues) {
 }
 
 async function initialize(options) {
-  const initialized = await initializeProjectRunKit({ workspaceRoot: workspace(options) });
+  const root = workspace(options);
+  const initialized = await initializeProjectRunKit({ workspaceRoot: root });
   const result = {
     ...initialized,
-    onboarding: onboardingProjection(),
+    onboarding: onboardingProjection(root),
     nextAllowedAction: "run_onboarding_diagnostics",
   };
   if (options.json === true) return result;
@@ -681,7 +723,7 @@ async function initialize(options) {
       "Next:",
       "1. owlrunkit doctor --workspace .",
       "2. owlrunkit profiles detect --workspace . --dry-run",
-      "3. owlrunkit adopt --workspace . --exact owlrunkit@0.14.0 or owlrunkit start",
+      `3. owlrunkit adopt --workspace . --exact owlrunkit@${CORE_VERSION} or owlrunkit start`,
       "",
     ].join("\n"),
   );
@@ -936,7 +978,7 @@ function inspect(options) {
           execution: executions.find(execution => execution.runId === requestedRunId),
         }
       : { mode: "summary" };
-  return { ...result, summary, view, onboarding: onboardingProjection() };
+  return { ...result, summary, view, onboarding: onboardingProjection(root, recovery) };
 }
 
 function closeout(options) {
@@ -1128,9 +1170,9 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
       return withHumanOutput({
         status: "version",
         exitCode: 0,
-        version: "0.14.0",
+        version: CORE_VERSION,
         authorizationGranted: false,
-      }, "owlrunkit 0.14.0\n");
+      }, `owlrunkit ${CORE_VERSION}\n`);
     }
     const separatorIndex = rest.indexOf("--");
     if (separatorIndex >= 0 && command !== "verify" && command !== "quick-verify") {

package/scripts/runkit-contract/schemas/verification-finalize-attempt-v1.schema.json

@@ -0,0 +1,52 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://owlcoda.dev/schemas/runkit/verification-finalize-attempt-v1.json",
+  "title": "OwlCoda RunKit Verification Finalize Attempt V1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schemaVersion",
+    "runId",
+    "verificationId",
+    "status",
+    "gateStatus",
+    "finalizeRequestPath",
+    "finalizeRequestSha256",
+    "result",
+    "authorizationGranted"
+  ],
+  "properties": {
+    "schemaVersion": {
+      "const": "OwlCodaRunKitVerificationFinalizeAttemptV1"
+    },
+    "runId": {
+      "type": "string",
+      "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]*$"
+    },
+    "verificationId": {
+      "type": "string",
+      "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]*$"
+    },
+    "status": {
+      "const": "rejected"
+    },
+    "gateStatus": {
+      "type": "string",
+      "minLength": 1
+    },
+    "finalizeRequestPath": {
+      "type": "string",
+      "minLength": 1
+    },
+    "finalizeRequestSha256": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{64}$"
+    },
+    "result": {
+      "type": "object"
+    },
+    "authorizationGranted": {
+      "const": false
+    }
+  }
+}

package/scripts/runkit-contract/schemas/verification-preflight-v1.schema.json

@@ -0,0 +1,52 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://owlcoda.dev/schemas/runkit/verification-preflight-v1.json",
+  "title": "OwlCoda RunKit Verification Preflight V1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schemaVersion",
+    "runId",
+    "verificationId",
+    "status",
+    "issueCode",
+    "executable",
+    "commandArgvSha256",
+    "authorizationGranted"
+  ],
+  "properties": {
+    "schemaVersion": {
+      "const": "OwlCodaRunKitVerificationPreflightV1"
+    },
+    "runId": {
+      "type": "string",
+      "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]*$"
+    },
+    "verificationId": {
+      "type": "string",
+      "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]*$"
+    },
+    "status": {
+      "const": "rejected"
+    },
+    "issueCode": {
+      "enum": [
+        "verify_executable_absolute_path_required",
+        "verify_executable_missing",
+        "verify_executable_not_regular_file",
+        "verify_executable_symlink_rejected"
+      ]
+    },
+    "executable": {
+      "type": "string",
+      "minLength": 1
+    },
+    "commandArgvSha256": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{64}$"
+    },
+    "authorizationGranted": {
+      "const": false
+    }
+  }
+}