owlrunkit 0.15.0 → 0.16.0

package/scripts/runkit-contract/sync-core016-release-identity.mjs

@@ -0,0 +1,161 @@
+#!/usr/bin/env node
+
+import {
+  readFileSync,
+  renameSync,
+  writeFileSync,
+} from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { currentCoreIdentity } from "./core-contract.mjs";
+
+const RELEASE_FILES = Object.freeze({
+  packageManifest: "packages/runkit/package.json",
+  attestManifest: "packages/attest/distribution-manifest-v1.json",
+  attestRuntime: "packages/attest/src/quick.mjs",
+  skillMarkdown: "integrations/codex/skills/owlcoda-runkit/SKILL.md",
+  skillConfig:
+    "integrations/codex/skills/owlcoda-runkit/assets/templates/config.json",
+});
+
+const ATTEST_RUNTIME_CORE016 =
+  /(coreVersion:\s*"0\.16\.0",\s*coreManifestSha256:\s*")sha256:[a-f0-9]{64}("\s*,?)/gu;
+
+function readJson(ref) {
+  return JSON.parse(readFileSync(ref, "utf8"));
+}
+
+function bytes(value) {
+  return `${JSON.stringify(value, null, 2)}\n`;
+}
+
+function writeAtomic(ref, value) {
+  const temporary = `${ref}.sync-${process.pid}`;
+  writeFileSync(temporary, value, { flag: "wx" });
+  renameSync(temporary, ref);
+}
+
+function exactCore(actual, expected, includeSourceRef) {
+  return actual?.contractVersion === expected.contractVersion
+    && actual?.coreVersion === expected.coreVersion
+    && actual?.coreManifestSha256 === expected.coreManifestSha256
+    && (
+      !includeSourceRef
+      || actual?.coreSourceRef === expected.coreSourceRef
+    );
+}
+
+export function synchronizeCore016ReleaseIdentityV1({
+  repositoryRoot,
+  core,
+  write = false,
+}) {
+  const root = path.resolve(repositoryRoot);
+  if (
+    core?.contractVersion !== "0.2"
+    || core?.coreVersion !== "0.16.0"
+    || !/^sha256:[a-f0-9]{64}$/u.test(
+      core?.coreManifestSha256 ?? "",
+    )
+    || core?.coreSourceRef !== `artifact:${core.coreManifestSha256}`
+  ) throw new Error("core016_release_identity_invalid");
+  const refs = Object.fromEntries(Object.entries(RELEASE_FILES).map(
+    ([key, relative]) => [key, path.join(root, relative)],
+  ));
+  const packageManifest = readJson(refs.packageManifest);
+  if (
+    packageManifest.name !== "owlrunkit"
+    || packageManifest.version !== "0.16.0"
+  ) throw new Error("core016_release_package_invalid");
+  const attestManifest = readJson(refs.attestManifest);
+  const candidateIndexes = attestManifest.supportedProducerCoreIdentities
+    ?.map((identity, index) => ({ identity, index }))
+    .filter(({ identity }) => identity?.coreVersion === "0.16.0") ?? [];
+  if (candidateIndexes.length !== 1) {
+    throw new Error("core016_release_attest_candidate_ambiguous");
+  }
+  const attestRuntime = readFileSync(refs.attestRuntime, "utf8");
+  const runtimeMatches = [...attestRuntime.matchAll(ATTEST_RUNTIME_CORE016)];
+  if (runtimeMatches.length !== 1) {
+    throw new Error("core016_release_attest_runtime_candidate_ambiguous");
+  }
+  const skillMarkdown = readFileSync(refs.skillMarkdown, "utf8");
+  const skillHashes = skillMarkdown.match(/sha256:[a-f0-9]{64}/gu) ?? [];
+  if (skillHashes.length !== 1) {
+    throw new Error("core016_release_skill_identity_ambiguous");
+  }
+  const skillConfig = readJson(refs.skillConfig);
+  const mismatches = [];
+  if (!exactCore(candidateIndexes[0].identity, core, false)) {
+    mismatches.push("attest");
+  }
+  if (!runtimeMatches[0][0].includes(core.coreManifestSha256)) {
+    mismatches.push("attest_runtime");
+  }
+  if (skillHashes[0] !== core.coreManifestSha256) {
+    mismatches.push("skill_markdown");
+  }
+  if (!exactCore(skillConfig.core, core, true)) {
+    mismatches.push("skill_config");
+  }
+  if (write && mismatches.length > 0) {
+    attestManifest.supportedProducerCoreIdentities[
+      candidateIndexes[0].index
+    ] = {
+      contractVersion: core.contractVersion,
+      coreVersion: core.coreVersion,
+      coreManifestSha256: core.coreManifestSha256,
+    };
+    writeAtomic(refs.attestManifest, bytes(attestManifest));
+    writeAtomic(
+      refs.attestRuntime,
+      attestRuntime.replace(
+        ATTEST_RUNTIME_CORE016,
+        `$1${core.coreManifestSha256}$2`,
+      ),
+    );
+    writeAtomic(
+      refs.skillMarkdown,
+      skillMarkdown.replace(skillHashes[0], core.coreManifestSha256),
+    );
+    writeAtomic(refs.skillConfig, bytes({
+      ...skillConfig,
+      core: structuredClone(core),
+    }));
+  }
+  return {
+    status: mismatches.length === 0 ? "exact" : write ? "synchronized" : "drifted",
+    core: structuredClone(core),
+    mismatches,
+    changed: write ? mismatches : [],
+  };
+}
+
+function main(argv) {
+  const write = argv.includes("--write");
+  const rootIndex = argv.indexOf("--repository-root");
+  const repositoryRoot = rootIndex === -1
+    ? path.resolve(fileURLToPath(new URL("../..", import.meta.url)))
+    : argv[rootIndex + 1];
+  if (!repositoryRoot) throw new Error("repository_root_required");
+  const result = synchronizeCore016ReleaseIdentityV1({
+    repositoryRoot,
+    core: currentCoreIdentity(),
+    write,
+  });
+  process.stdout.write(`${JSON.stringify(result)}\n`);
+  if (!write && result.status !== "exact") process.exitCode = 2;
+}
+
+if (process.argv[1]
+  && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  try {
+    main(process.argv.slice(2));
+  } catch (error) {
+    process.stderr.write(
+      `${error instanceof Error ? error.stack : String(error)}\n`,
+    );
+    process.exitCode = 1;
+  }
+}

package/scripts/runkit-contract/templates/assurance-request.json

@@ -0,0 +1,13 @@
+{
+  "needsDurableEvidence": true,
+  "needsFormalAcceptance": false,
+  "mayMutateProject": false,
+  "externalSideEffects": false,
+  "longRunning": false,
+  "interruptionRecovery": false,
+  "dirtyParallelWorkspace": false,
+  "exactCommandCount": 1,
+  "writerCount": 0,
+  "riskCategories": [],
+  "authorizationGranted": false
+}

package/scripts/runkit-contract/templates/core-successor-owner-authority.json

@@ -0,0 +1,15 @@
+{
+  "schemaVersion": "OwlCodaRunKitOwnerMigrationAuthorityV2",
+  "authorityId": "replace-with-owner-authority-id",
+  "decision": "approved",
+  "scope": "migrate_declared_core_successor_fleet",
+  "planSha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "fromCoreSetSha256": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+  "toCoreManifestSha256": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+  "fleetManifestSha256": "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
+  "signerKeyId": "replace-with-owner-key-id",
+  "signatureAlgorithm": "ed25519",
+  "authorizationGranted": false,
+  "authoritySha256": "sha256:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+  "signature": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="
+}

package/scripts/runkit-contract/templates/deployment-execute-request.json

@@ -0,0 +1,39 @@
+{
+  "schemaVersion": "OwlCodaRunKitDeploymentExecuteRequestV1",
+  "executeRunId": "replace-with-execute-run-id",
+  "executeGoal": {
+    "path": ".owlcoda/runkit/executions/replace-with-execute-run-id/goal-contract.json",
+    "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+  },
+  "prepareReceiptSha256": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+  "target": {
+    "schemaVersion": "OwlCodaRunKitRemoteTargetV1",
+    "targetId": "replace-with-target-id",
+    "environment": "production",
+    "host": "replace.example.invalid",
+    "port": 22,
+    "user": "deploy",
+    "hostKeySha256": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+    "machineIdentitySha256": "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"
+  },
+  "ownerAuthority": {
+    "path": "authorities/replace-with-execute-run-id.json",
+    "sha256": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee"
+  },
+  "ownerDecision": {
+    "path": "authorities/replace-with-owner-decision-id.json",
+    "sha256": "1111111111111111111111111111111111111111111111111111111111111111"
+  },
+  "ownerDecisionSnapshot": {
+    "path": ".owlcoda/runkit/deployments/replace-with-execute-run-id/owner-decision-snapshot.json",
+    "sha256": "2222222222222222222222222222222222222222222222222222222222222222"
+  },
+  "workItemId": "deployment-execute",
+  "profileId": "deployment",
+  "resourcePreflight": {
+    "path": ".owlcoda/runkit/executions/replace-with-execute-run-id/resource-preflights/replace-with-preflight-id.json",
+    "sha256": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
+  },
+  "deploy": true,
+  "destructive": false
+}

package/scripts/runkit-contract/templates/deployment-owner-authority.json

@@ -0,0 +1,23 @@
+{
+  "schemaVersion": "OwlCodaRunKitOwnerDeploymentAuthorityV2",
+  "authorityId": "replace-with-owner-authority-id",
+  "decision": "approved",
+  "scope": "execute_exact_remote_deployment",
+  "executeRunId": "replace-with-execute-run-id",
+  "prepareReceiptSha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "targetSha256": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+  "artifactSha256": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+  "remoteManifestFileSha256": "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
+  "remoteDeploymentIntentSha256": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+  "ownerDecisionId": "replace-with-owner-decision-id",
+  "ownerDecisionSha256": "1111111111111111111111111111111111111111111111111111111111111111",
+  "signerKeyId": "replace-with-owner-key-id",
+  "signatureAlgorithm": "ed25519",
+  "permissions": {
+    "deploy": true,
+    "destructive": false
+  },
+  "authorizationGranted": false,
+  "authoritySha256": "sha256:ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+  "signature": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="
+}

package/scripts/runkit-contract/templates/deployment-owner-decision.json

@@ -0,0 +1,26 @@
+{
+  "schemaVersion": "OwlCodaRunKitOwnerDeploymentDecisionV1",
+  "decisionId": "replace-with-owner-decision-id",
+  "decisionVersion": 1,
+  "provenance": {
+    "kind": "owner_explicit",
+    "sourceRef": "replace-with-owner-controlled-source-ref",
+    "recordedAt": "2026-08-01T00:00:00.000Z"
+  },
+  "project": {
+    "projectId": "replace-with-project-id",
+    "scope": "replace-with-deployment-scope"
+  },
+  "supersedesDecisionSha256": null,
+  "deploymentMode": "clean_install",
+  "existingProjectAssets": "replace",
+  "legacyRollbackAllowed": false,
+  "dataAuthority": {
+    "mode": "initialize_new",
+    "sourceRef": "replace-with-owner-controlled-data-authority-ref"
+  },
+  "serviceActivationAuthorized": false,
+  "baselineCutAuthorized": false,
+  "destructiveScope": [],
+  "decisionSha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+}

package/scripts/runkit-contract/templates/fleet-manifest.json

@@ -0,0 +1,8 @@
+{
+  "schemaVersion": "OwlCodaRunKitFleetManifestV1",
+  "skillName": "owlcoda-runkit",
+  "workspaceRoots": [
+    "/replace/with/absolute/project/root"
+  ],
+  "authorizationGranted": false
+}

package/scripts/runkit-contract/templates/fleet-root-registry.json

@@ -0,0 +1,8 @@
+{
+  "schemaVersion": "OwlCodaRunKitFleetRootRegistryV1",
+  "coverageRoots": [
+    "/absolute/path/to/fleet"
+  ],
+  "authorizationGranted": false,
+  "registrySha256": "sha256:270e2fb1accb0e5a891f697c5a483b52881289849cfb75b4cd54a0443bcac8ec"
+}

package/scripts/runkit-contract/templates/owner-authority-trust.json

@@ -0,0 +1,16 @@
+{
+  "schemaVersion": "OwlCodaRunKitOwnerAuthorityTrustV1",
+  "keys": [
+    {
+      "keyId": "replace-with-owner-key-id",
+      "algorithm": "ed25519",
+      "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nreplace-with-ed25519-public-key\n-----END PUBLIC KEY-----\n",
+      "publicKeySha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+      "purposes": [
+        "core_successor",
+        "remote_deployment"
+      ],
+      "status": "active"
+    }
+  ]
+}

package/scripts/runkit-contract/templates/ready-for-commit-request.json

@@ -1,6 +1,6 @@
 {
-  "schemaVersion": "OwlCodaRunKitReadyForCommitRequestV1",
-  "deliveryPacketPath": ".owlcoda/runkit/executions/replace-with-run-id/delivery-packets/replace-with-packet.json",
+  "schemaVersion": "OwlCodaRunKitReadyForCommitRequestV2",
+  "sourceCandidatePath": ".owlcoda/runkit/executions/replace-with-run-id/source-candidates/replace-with-candidate.json",
   "verificationGateInputPath": ".owlcoda/runkit/executions/replace-with-run-id/verification-receipts/replace-with-receipt/verification-gate-input.json",
   "roots": [
     {

package/scripts/runkit-contract/templates/remote-deployment-manifest.json

@@ -0,0 +1,108 @@
+{
+  "schemaVersion": "OwlCodaRunKitRemoteDeploymentManifestV1",
+  "deploymentId": "replace-with-deployment-id",
+  "deploymentLineageSha256": null,
+  "mode": "first",
+  "ownerDecision": {
+    "decisionId": "replace-with-owner-decision-id",
+    "decisionVersion": 1,
+    "decisionSha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "deploymentMode": "clean_install",
+    "existingProjectAssets": "replace",
+    "legacyRollbackAllowed": false,
+    "dataAuthority": {
+      "mode": "initialize_new",
+      "sourceRef": "replace-with-owner-controlled-data-authority-ref"
+    },
+    "serviceActivationAuthorized": false,
+    "baselineCutAuthorized": false,
+    "destructiveScope": []
+  },
+  "serviceActivation": false,
+  "baselineCut": false,
+  "target": {
+    "schemaVersion": "OwlCodaRunKitRemoteTargetV1",
+    "targetId": "replace-with-target-id",
+    "environment": "production",
+    "host": "replace.example.invalid",
+    "port": 22,
+    "user": "deploy",
+    "hostKeySha256": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+    "machineIdentitySha256": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
+  },
+  "adapter": {
+    "kind": "builtin_ssh",
+    "adapterId": "builtin-ssh-v1",
+    "version": "1.0.0",
+    "executable": "/replace/with/exact/owlrunkit/scripts/runkit-contract/ssh-remote-adapter.mjs",
+    "sha256": "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
+    "knownHostsPath": "/replace/with/exact/project/known_hosts",
+    "sshExecutable": "/usr/bin/ssh",
+    "sshExecutableSha256": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+    "remoteHelper": {
+      "path": "/usr/local/libexec/owlrunkit-remote-helper",
+      "protocol": "OwlCodaRunKitSshRemoteHelperV1",
+      "version": "1.0.0",
+      "capabilities": [
+        "execute",
+        "reconcile"
+      ]
+    },
+    "authentication": {
+      "mode": "agent",
+      "identityFile": null
+    },
+    "stageContracts": {
+      "install": {
+        "archiveFormat": "tar_gzip",
+        "releaseRoot": "/opt/owlapp/releases",
+        "currentSymlink": "/opt/owlapp/current"
+      },
+      "systemd": {
+        "unitName": "owlapp.service",
+        "unitFile": {
+          "sourcePath": "deploy/owlapp.service",
+          "destinationPath": "/etc/systemd/system/owlapp.service",
+          "sha256": "1111111111111111111111111111111111111111111111111111111111111111"
+        },
+        "daemonReload": true,
+        "enable": true,
+        "restart": true
+      },
+      "nginx": {
+        "siteName": "owlapp",
+        "configFile": {
+          "sourcePath": "deploy/owlapp.nginx.conf",
+          "destinationPath": "/etc/nginx/sites-available/owlapp.conf",
+          "sha256": "2222222222222222222222222222222222222222222222222222222222222222"
+        },
+        "enabledLinkPath": "/etc/nginx/sites-enabled/owlapp.conf",
+        "configTest": true,
+        "reload": true
+      },
+      "smoke": {
+        "checks": [
+          {
+            "checkId": "service-active",
+            "kind": "systemd_active",
+            "unitName": "owlapp.service"
+          }
+        ]
+      }
+    }
+  },
+  "credentialRef": "agent:replace/with/credential-reference",
+  "artifact": {
+    "path": "dist/replace-with-artifact.tgz",
+    "sha256": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+    "size": 0,
+    "mediaType": "application/gzip"
+  },
+  "upload": {
+    "remotePath": "/srv/releases/replace-with-artifact.tgz",
+    "createOnly": true
+  },
+  "priorDeployment": null,
+  "expectedRemoteFiles": [],
+  "deletionAllowlist": []
+}

package/scripts/runkit-contract/verification-receipt-gate.mjs

@@ -51,6 +51,33 @@ function isRisk(value) {
     ]).has(category));
 }
 
+function validateSourceArtifactShape(receipt, sourceGate) {
+  if (receipt.sourceArtifact === undefined) return [];
+  const artifact = receipt.sourceArtifact;
+  if (
+    !isRecord(artifact)
+    || !new Set(["delivery_packet_v1", "source_candidate_v2"])
+      .has(artifact.kind)
+    || artifact.runId !== receipt.runId
+    || typeof artifact.path !== "string"
+    || artifact.path.length === 0
+    || artifact.path.startsWith("/")
+    || artifact.path.split("/").some(segment => (
+      segment.length === 0 || segment === "." || segment === ".."
+    ))
+    || !isSha256(artifact.sha256)
+    || !isSha256(artifact.sourceFingerprint)
+    || artifact.sourceFingerprint !== receipt.sourceFingerprint
+    || artifact.sourceFingerprint !== sourceGate?.recomputedFingerprint
+  ) {
+    return [issue(
+      "source_artifact_binding_malformed",
+      "sourceArtifact must exactly bind the active run, source bytes, path, and fingerprint.",
+    )];
+  }
+  return [];
+}
+
 function sameRisk(left, right) {
   return left?.riskMode === right?.riskMode
     && JSON.stringify(left?.riskCategories) === JSON.stringify(right?.riskCategories);
@@ -425,6 +452,7 @@ export function validateVerificationReceiptGate({
   if (commandReceiptShapeIssues.length > 0) {
     return malformedResult(commandReceiptShapeIssues, lineage);
   }
+  issues.push(...validateSourceArtifactShape(activeReceipt, sourceGate));
 
   if (
     activeReceipt.sourceFingerprint.toLowerCase()