owlrunkit 0.17.2 → 0.18.1

package/scripts/runkit-contract/quick-attest.mjs

@@ -1,4 +1,5 @@
 export {
   attestQuickReceipt,
   attestQuickReceiptDetails,
+  validQuickReceiptShape,
 } from "../../packages/attest/src/quick.mjs";

package/scripts/runkit-contract/quick-metrics.mjs

@@ -6,9 +6,40 @@ import {
 } from "node:fs";
 import path from "node:path";
 
-import { attestQuickReceipt } from "./quick-attest.mjs";
+import {
+  decodeUtf8Strict,
+  parseJsonStrict,
+  readFileBytesBounded,
+} from "../../packages/attest/src/formal.mjs";
+import { quickSnapshotFingerprintValid } from "../../packages/attest/src/quick-receipt-contract.mjs";
+import {
+  attestQuickReceipt,
+  validQuickReceiptShape,
+} from "./quick-attest.mjs";
 import { quickReceiptRoot } from "./quick-receipt.mjs";
 
+const INVALID_ATTESTATION_ISSUES = new Set([
+  "attestation_material_missing",
+  "receipt_material_hash_mismatch",
+]);
+
+function readHistoricalReceipt(receiptPath) {
+  const { bytes } = readFileBytesBounded(receiptPath);
+  const receipt = parseJsonStrict(decodeUtf8Strict(bytes));
+  if (!validQuickReceiptShape(receipt)) throw new Error("quick_receipt_schema_invalid");
+  const snapshotsValid = quickSnapshotFingerprintValid(receipt.workspaceBefore)
+    && quickSnapshotFingerprintValid(receipt.workspaceAfter);
+  const sourceChanged = receipt.workspaceBefore.sourceFingerprint
+    !== receipt.workspaceAfter.sourceFingerprint;
+  const mutationBindingValid = receipt.mutationDecision === "source_unchanged"
+    ? !sourceChanged && !receipt.issueCodes.includes("source_mutated_during_verification")
+    : sourceChanged && receipt.issueCodes.includes("source_mutated_during_verification");
+  if (!snapshotsValid || !mutationBindingValid) {
+    throw new Error("quick_receipt_source_binding_invalid");
+  }
+  return receipt;
+}
+
 function trustedReceiptRoot(workspaceRoot) {
   const workspace = realpathSync(workspaceRoot);
   const root = quickReceiptRoot(workspace);
@@ -65,10 +96,17 @@ export function readLocalQuickMetrics(workspaceRoot) {
   };
   for (const receiptPath of receiptPaths) {
     try {
-      const result = attestQuickReceipt({ receiptPath, workspaceRoot });
-      if (result.decision === "GO") totals.passed += 1;
-      else if (result.issueCodes.includes("receipt_source_mismatch")) totals.sourceMutated += 1;
-      else totals.failed += 1;
+      const receipt = readHistoricalReceipt(receiptPath);
+      const attestation = attestQuickReceipt({ receiptPath, workspaceRoot });
+      if (attestation.issueCodes.some((issue) => INVALID_ATTESTATION_ISSUES.has(issue))) {
+        totals.invalid += 1;
+      } else if (receipt.mutationDecision === "invalidated_by_command_source_mutation") {
+        totals.sourceMutated += 1;
+      } else if (receipt.exitResult.exitCode === 0 && receipt.exitResult.signal === null) {
+        totals.passed += 1;
+      } else {
+        totals.failed += 1;
+      }
     } catch {
       totals.invalid += 1;
     }

package/scripts/runkit-contract/quick-verify.mjs

@@ -9,6 +9,14 @@ import {
 } from "./quick-receipt.mjs";
 import { captureWorkspaceSnapshot } from "./quick-workspace-snapshot.mjs";
 
+function shellQuote(value) {
+  return `'${String(value).replaceAll("'", `'"'"'`)}'`;
+}
+
+function quickAttestCommand(workspaceRoot, receiptPath) {
+  return `owlrunkit quick-attest --workspace ${shellQuote(workspaceRoot)} --receipt ${shellQuote(receiptPath)}`;
+}
+
 function runExactCommand({ executable, argv, cwd, stdoutFd, stderrFd }) {
   return new Promise((resolve) => {
     let settled = false;
@@ -153,6 +161,7 @@ export async function runQuickVerification({ workspaceRoot, commandArgv }) {
   }
 
   if (sourceMutated) {
+    const attestCommand = quickAttestCommand(root, persisted.receiptPath);
     return {
       status: "quick_verification_source_mutated",
       exitCode: 2,
@@ -162,13 +171,14 @@ export async function runQuickVerification({ workspaceRoot, commandArgv }) {
       commandExitCode: execution.exitCode,
       mutationDecision: "invalidated_by_command_source_mutation",
       issueCodes,
-      attestCommand: `owlcoda attest ${persisted.receiptPath}`,
+      attestCommand,
       issues: [],
       nextAllowedAction: "restore_source_or_run_a_new_quick_verification",
       authorizationGranted: false,
     };
   }
   if (execution.launchError || execution.exitCode !== 0) {
+    const attestCommand = quickAttestCommand(root, persisted.receiptPath);
     return {
       status: "quick_verification_failed",
       exitCode: 1,
@@ -178,12 +188,13 @@ export async function runQuickVerification({ workspaceRoot, commandArgv }) {
       commandExitCode: execution.exitCode,
       mutationDecision: "source_unchanged",
       issueCodes,
-      attestCommand: `owlcoda attest ${persisted.receiptPath}`,
+      attestCommand,
       issues: execution.launchError ? [execution.launchError] : [],
       nextAllowedAction: "inspect_output_and_rerun",
       authorizationGranted: false,
     };
   }
+  const attestCommand = quickAttestCommand(root, persisted.receiptPath);
   return {
     status: "quick_verification_passed",
     exitCode: 0,
@@ -193,9 +204,9 @@ export async function runQuickVerification({ workspaceRoot, commandArgv }) {
     commandExitCode: 0,
     mutationDecision: "source_unchanged",
     issueCodes,
-    attestCommand: `owlcoda attest ${persisted.receiptPath}`,
+    attestCommand,
     issues: [],
-    nextAllowedAction: `owlcoda attest ${persisted.receiptPath}`,
+    nextAllowedAction: attestCommand,
     authorizationGranted: false,
   };
 }