owlrunkit 0.16.1 → 0.17.0

package/scripts/runkit-contract/schemas/team-project-status-v1.schema.json

@@ -0,0 +1,50 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://owlcoda.com/schemas/runkit/team-project-status-v1.schema.json",
+  "title": "OwlCoda RunKit Team Project Status V1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "status", "projectId", "objective", "overall", "counts", "milestones", "workstreams", "workItems", "agents", "readyQueue", "criticalWorkItems", "openDecisions", "resolvedDecisions", "integrationGates", "dataCandidates", "projectTruthHash", "authorizationGranted", "exitCode"],
+  "properties": {
+    "schemaVersion": { "const": "OwlCodaRunKitTeamProjectStatusV1" },
+    "status": { "const": "team_project_status" },
+    "projectId": { "type": "string", "minLength": 1 },
+    "objective": { "type": "string", "minLength": 1 },
+    "overall": { "enum": ["planned", "active", "active_with_blockers", "completed"] },
+    "counts": { "type": "object" },
+    "milestones": { "type": "array", "items": { "type": "object" } },
+    "workstreams": { "type": "array", "items": { "type": "object" } },
+    "workItems": { "type": "array", "items": { "type": "object" } },
+    "agents": { "type": "array", "items": { "type": "object" } },
+    "readyQueue": { "type": "array", "items": { "type": "string" } },
+    "criticalWorkItems": { "type": "array", "items": { "type": "string" } },
+    "openDecisions": { "type": "array", "items": { "type": "object" } },
+    "resolvedDecisions": { "type": "array", "items": { "type": "object" } },
+    "integrationGates": { "type": "array", "items": { "type": "object" } },
+    "dataCandidates": { "type": "array", "items": { "type": "object" } },
+    "projectTruthHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+    "authorizationGranted": { "const": false },
+    "exitCode": { "const": 0 }
+  },
+  "examples": [{
+    "schemaVersion": "OwlCodaRunKitTeamProjectStatusV1",
+    "status": "team_project_status",
+    "projectId": "release-017",
+    "objective": "Ship OwlRunKit 0.17",
+    "overall": "active",
+    "counts": {},
+    "milestones": [],
+    "workstreams": [],
+    "workItems": [],
+    "agents": [],
+    "readyQueue": [],
+    "criticalWorkItems": [],
+    "openDecisions": [],
+    "resolvedDecisions": [],
+    "integrationGates": [],
+    "dataCandidates": [],
+    "projectTruthHash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "authorizationGranted": false,
+    "exitCode": 0
+  }]
+}

package/scripts/runkit-contract/schemas/verification-envelope-v1.schema.json

@@ -0,0 +1,102 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://owlcoda.com/schemas/runkit/verification-envelope-v1.schema.json",
+  "title": "OwlCoda RunKit Verification Envelope V1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "envelopeId", "cwd", "lockfiles", "paths", "environment", "network", "process", "phases"],
+  "properties": {
+    "schemaVersion": { "const": "OwlCodaRunKitVerificationEnvelopeV1" },
+    "envelopeId": { "$ref": "#/$defs/id" },
+    "cwd": { "type": "string", "minLength": 1 },
+    "lockfiles": { "$ref": "#/$defs/strings" },
+    "paths": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["immutableSource", "declaredOutput", "disposableScratch", "forbidden"],
+      "properties": {
+        "immutableSource": { "type": "array", "minItems": 1, "uniqueItems": true, "items": { "type": "string", "minLength": 1 } },
+        "declaredOutput": { "$ref": "#/$defs/strings" },
+        "disposableScratch": { "$ref": "#/$defs/strings" },
+        "forbidden": { "$ref": "#/$defs/strings" }
+      }
+    },
+    "environment": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["allowNames", "values"],
+      "properties": {
+        "allowNames": { "$ref": "#/$defs/strings" },
+        "values": { "type": "object" }
+      }
+    },
+    "network": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["mode"],
+      "properties": { "mode": { "enum": ["deny", "loopback"] } }
+    },
+    "process": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["allowSubprocesses", "allowedExecutables", "allowBackgroundAfterFinish"],
+      "properties": {
+        "allowSubprocesses": { "type": "boolean" },
+        "allowedExecutables": { "$ref": "#/$defs/strings" },
+        "allowBackgroundAfterFinish": { "const": false }
+      }
+    },
+    "phases": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["setup", "check", "teardown"],
+      "properties": {
+        "setup": { "oneOf": [{ "$ref": "#/$defs/command" }, { "type": "null" }] },
+        "check": { "$ref": "#/$defs/command" },
+        "teardown": { "oneOf": [{ "$ref": "#/$defs/command" }, { "type": "null" }] }
+      }
+    }
+  },
+  "$defs": {
+    "id": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]*$" },
+    "strings": { "type": "array", "uniqueItems": true, "items": { "type": "string", "minLength": 1 } },
+    "command": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["executable", "argv", "timeoutMs"],
+      "properties": {
+        "executable": { "type": "string", "minLength": 1 },
+        "argv": { "type": "array", "items": { "type": "string" } },
+        "timeoutMs": { "type": "integer", "minimum": 100, "maximum": 3600000 }
+      }
+    }
+  },
+  "examples": [{
+    "schemaVersion": "OwlCodaRunKitVerificationEnvelopeV1",
+    "envelopeId": "quality-v1",
+    "cwd": ".",
+    "lockfiles": ["package-lock.json"],
+    "paths": {
+      "immutableSource": ["src/**", "tests/**", "package-lock.json"],
+      "declaredOutput": ["dist/**", "coverage/**"],
+      "disposableScratch": [".tmp/**"],
+      "forbidden": [".env", ".ssh/**", ".owlcoda/**"]
+    },
+    "environment": { "allowNames": ["PATH"], "values": {} },
+    "network": { "mode": "deny" },
+    "process": {
+      "allowSubprocesses": false,
+      "allowedExecutables": [],
+      "allowBackgroundAfterFinish": false
+    },
+    "phases": {
+      "setup": null,
+      "check": {
+        "executable": "/absolute/path/to/node",
+        "argv": ["tests/run.mjs"],
+        "timeoutMs": 120000
+      },
+      "teardown": null
+    }
+  }]
+}

package/scripts/runkit-contract/sync-release-identity.mjs

@@ -0,0 +1,224 @@
+#!/usr/bin/env node
+
+import {
+  readFileSync,
+  renameSync,
+  writeFileSync,
+} from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { currentCoreIdentity } from "./core-contract.mjs";
+
+const RELEASE_FILES = Object.freeze({
+  packageManifest: "packages/runkit/package.json",
+  attestManifest: "packages/attest/distribution-manifest-v1.json",
+  attestRuntime: "packages/attest/src/quick.mjs",
+  skillMarkdown: "integrations/codex/skills/owlcoda-runkit/SKILL.md",
+  skillConfig: "integrations/codex/skills/owlcoda-runkit/assets/templates/config.json",
+});
+
+function readJson(ref) {
+  return JSON.parse(readFileSync(ref, "utf8"));
+}
+
+function bytes(value) {
+  return `${JSON.stringify(value, null, 2)}\n`;
+}
+
+function writeAtomic(ref, value) {
+  const temporary = `${ref}.sync-${process.pid}`;
+  writeFileSync(temporary, value, { flag: "wx" });
+  renameSync(temporary, ref);
+}
+
+function exactCore(actual, expected, includeSourceRef) {
+  return actual?.contractVersion === expected.contractVersion
+    && actual?.coreVersion === expected.coreVersion
+    && actual?.coreManifestSha256 === expected.coreManifestSha256
+    && (!includeSourceRef || actual?.coreSourceRef === expected.coreSourceRef);
+}
+
+function escaped(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+}
+
+export function synchronizeReleaseIdentityV1({
+  repositoryRoot,
+  core,
+  write = false,
+}) {
+  const root = path.resolve(repositoryRoot);
+  if (core?.contractVersion !== "0.2"
+    || typeof core?.coreVersion !== "string"
+    || !/^\d+\.\d+\.\d+$/u.test(core.coreVersion)
+    || !/^sha256:[a-f0-9]{64}$/u.test(core?.coreManifestSha256 ?? "")
+    || core?.coreSourceRef !== `artifact:${core.coreManifestSha256}`) {
+    throw new Error("release_identity_core_invalid");
+  }
+  const refs = Object.fromEntries(Object.entries(RELEASE_FILES).map(
+    ([key, relative]) => [key, path.join(root, relative)],
+  ));
+  const packageManifest = readJson(refs.packageManifest);
+  if (packageManifest.name !== "owlrunkit"
+    || packageManifest.version !== core.coreVersion) {
+    throw new Error("release_identity_package_invalid");
+  }
+  const attestManifest = readJson(refs.attestManifest);
+  const candidateIndexes = attestManifest.supportedProducerCoreIdentities
+    ?.map((identity, index) => ({ identity, index }))
+    .filter(({ identity }) => identity?.coreVersion === core.coreVersion) ?? [];
+  if (candidateIndexes.length !== 1) {
+    throw new Error("release_identity_attest_candidate_ambiguous");
+  }
+  const attestRuntime = readFileSync(refs.attestRuntime, "utf8");
+  const runtimePattern = new RegExp(
+    `(coreVersion:\\s*"${escaped(core.coreVersion)}",`
+      + `\\s*coreManifestSha256:\\s*")sha256:[a-f0-9]{64}("\\s*,?)`,
+    "gu",
+  );
+  const runtimeMatches = [...attestRuntime.matchAll(runtimePattern)];
+  if (runtimeMatches.length !== 1) {
+    throw new Error("release_identity_attest_runtime_candidate_ambiguous");
+  }
+  const skillMarkdown = readFileSync(refs.skillMarkdown, "utf8");
+  const skillHashes = skillMarkdown.match(/sha256:[a-f0-9]{64}/gu) ?? [];
+  if (skillHashes.length !== 1) {
+    throw new Error("release_identity_skill_identity_ambiguous");
+  }
+  const skillConfig = readJson(refs.skillConfig);
+  const mismatches = [];
+  if (!exactCore(candidateIndexes[0].identity, core, false)) mismatches.push("attest");
+  if (!runtimeMatches[0][0].includes(core.coreManifestSha256)) mismatches.push("attest_runtime");
+  if (skillHashes[0] !== core.coreManifestSha256) mismatches.push("skill_markdown");
+  if (!exactCore(skillConfig.core, core, true)) mismatches.push("skill_config");
+  if (write && mismatches.length > 0) {
+    attestManifest.supportedProducerCoreIdentities[candidateIndexes[0].index] = {
+      contractVersion: core.contractVersion,
+      coreVersion: core.coreVersion,
+      coreManifestSha256: core.coreManifestSha256,
+    };
+    writeAtomic(refs.attestManifest, bytes(attestManifest));
+    writeAtomic(
+      refs.attestRuntime,
+      attestRuntime.replace(runtimePattern, `$1${core.coreManifestSha256}$2`),
+    );
+    writeAtomic(
+      refs.skillMarkdown,
+      skillMarkdown.replace(skillHashes[0], core.coreManifestSha256),
+    );
+    writeAtomic(refs.skillConfig, bytes({
+      ...skillConfig,
+      core: structuredClone(core),
+    }));
+  }
+  return {
+    status: mismatches.length === 0 ? "exact" : write ? "synchronized" : "drifted",
+    core: structuredClone(core),
+    mismatches,
+    changed: write ? mismatches : [],
+  };
+}
+
+function requireSurface(condition, surface) {
+  if (!condition) {
+    throw new Error(`release_identity_surface_mismatch:${surface}`);
+  }
+}
+
+export function verifyReleaseIdentitySurfacesV1(input) {
+  const core = input?.core;
+  requireSurface(
+    core?.contractVersion === "0.2"
+      && /^\d+\.\d+\.\d+$/u.test(core?.coreVersion ?? "")
+      && /^sha256:[a-f0-9]{64}$/u.test(core?.coreManifestSha256 ?? "")
+      && core?.coreSourceRef === `artifact:${core.coreManifestSha256}`,
+    "core",
+  );
+  const packageExact = (manifest) => (
+    manifest?.name === "owlrunkit" && manifest?.version === core.coreVersion
+  );
+  const attestExact = (manifest) => (
+    manifest?.supportedProducerCoreIdentities?.some(
+      (identity) => exactCore(identity, core, false),
+    ) === true
+  );
+  const attestRuntimeExact = (source) => {
+    if (typeof source !== "string") return false;
+    const pattern = new RegExp(
+      `coreVersion:\\s*"${escaped(core.coreVersion)}",`
+        + `\\s*coreManifestSha256:\\s*"(sha256:[a-f0-9]{64})"`,
+      "gu",
+    );
+    const matches = [...source.matchAll(pattern)];
+    return matches.length === 1 && matches[0][1] === core.coreManifestSha256;
+  };
+  const skillExact = (markdown) => {
+    if (typeof markdown !== "string") return false;
+    const hashes = markdown.match(/sha256:[a-f0-9]{64}/gu) ?? [];
+    return hashes.length === 1
+      && hashes[0] === core.coreManifestSha256
+      && markdown.includes(`Bundled release: standalone \`owlrunkit@${core.coreVersion}\``)
+      && markdown.includes(`Core \`${core.coreVersion}\``)
+      && !/(?:It is not published|current published release remains)/iu.test(markdown);
+  };
+
+  requireSurface(packageExact(input.packageManifest), "package_manifest");
+  requireSurface(attestExact(input.attestManifest), "attest");
+  requireSurface(attestRuntimeExact(input.attestRuntime), "attest_runtime");
+  requireSurface(skillExact(input.skillMarkdown), "skill_markdown");
+  requireSurface(exactCore(input.skillConfig?.core, core, true), "skill_config");
+  requireSurface(packageExact(input.packed?.packageManifest), "packed_package_manifest");
+  requireSurface(attestExact(input.packed?.attestManifest), "packed_attest");
+  requireSurface(attestRuntimeExact(input.packed?.attestRuntime), "packed_attest_runtime");
+  requireSurface(skillExact(input.packed?.skillMarkdown), "packed_skill_markdown");
+  requireSurface(
+    exactCore(input.packed?.skillConfig?.core, core, true),
+    "packed_skill_config",
+  );
+  requireSurface(
+    input.binding?.packageName === "owlrunkit"
+      && input.binding?.version === core.coreVersion
+      && exactCore(input.binding?.core, core, true),
+    "release_binding",
+  );
+  requireSurface(
+    /^sha256:[a-f0-9]{64}$/u.test(input.binding?.tarball?.sha256 ?? "")
+      && input.retainedTarballSha256 === input.binding.tarball.sha256,
+    "retained_tarball",
+  );
+  return {
+    status: "exact",
+    packageName: "owlrunkit",
+    version: core.coreVersion,
+    core: structuredClone(core),
+    surfaceCount: 11,
+    retainedTarballSha256: input.retainedTarballSha256,
+  };
+}
+
+function main(argv) {
+  const write = argv.includes("--write");
+  const rootIndex = argv.indexOf("--repository-root");
+  const repositoryRoot = rootIndex === -1
+    ? path.resolve(fileURLToPath(new URL("../..", import.meta.url)))
+    : argv[rootIndex + 1];
+  if (!repositoryRoot) throw new Error("repository_root_required");
+  const result = synchronizeReleaseIdentityV1({
+    repositoryRoot,
+    core: currentCoreIdentity(),
+    write,
+  });
+  process.stdout.write(`${JSON.stringify(result)}\n`);
+  if (!write && result.status !== "exact") process.exitCode = 2;
+}
+
+if (process.argv[1]
+  && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  try {
+    main(process.argv.slice(2));
+  } catch (error) {
+    process.stderr.write(`${error instanceof Error ? error.stack : String(error)}\n`);
+    process.exitCode = 1;
+  }
+}