owlrunkit 0.18.1 → 0.18.3

package/packages/attest/schemas/quick-verification-receipt-v2.schema.json

@@ -0,0 +1,232 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://owlcoda.dev/schemas/runkit/trust/quick-verification-receipt-v2.schema.json",
+  "title": "OwlCoda Quick Verification Receipt V2",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schemaVersion",
+    "receiptId",
+    "assurance",
+    "authorizationGranted",
+    "coreIdentity",
+    "workspaceBefore",
+    "exactCommand",
+    "inputArtifacts",
+    "verificationContext",
+    "startedAt",
+    "finishedAt",
+    "exitResult",
+    "outputArtifacts",
+    "workspaceAfter",
+    "mutationDecision",
+    "issueCodes"
+  ],
+  "properties": {
+    "schemaVersion": {
+      "const": "OwlCodaQuickVerificationReceiptV2"
+    },
+    "receiptId": {
+      "type": "string",
+      "minLength": 1
+    },
+    "assurance": {
+      "const": "captured_verification"
+    },
+    "authorizationGranted": {
+      "const": false
+    },
+    "coreIdentity": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "contractVersion",
+        "coreVersion",
+        "coreManifestSha256"
+      ],
+      "properties": {
+        "contractVersion": {
+          "type": "string",
+          "minLength": 1
+        },
+        "coreVersion": {
+          "type": "string",
+          "minLength": 1
+        },
+        "coreManifestSha256": {
+          "type": "string",
+          "pattern": "^sha256:[0-9a-f]{64}$"
+        }
+      }
+    },
+    "workspaceBefore": {
+      "$ref": "workspace-snapshot-v1.schema.json"
+    },
+    "exactCommand": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "executable",
+        "argv",
+        "cwd"
+      ],
+      "properties": {
+        "executable": {
+          "type": "string",
+          "minLength": 1
+        },
+        "argv": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "cwd": {
+          "type": "string",
+          "minLength": 1
+        }
+      }
+    },
+    "inputArtifacts": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "stdin"
+      ],
+      "properties": {
+        "stdin": {
+          "$ref": "#/$defs/materialArtifact"
+        }
+      }
+    },
+    "verificationContext": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "platform",
+        "architecture",
+        "runtime"
+      ],
+      "properties": {
+        "platform": {
+          "type": "string",
+          "minLength": 1
+        },
+        "architecture": {
+          "type": "string",
+          "minLength": 1
+        },
+        "runtime": {
+          "type": "string",
+          "minLength": 1
+        }
+      }
+    },
+    "startedAt": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "finishedAt": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "exitResult": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "exitCode",
+        "signal"
+      ],
+      "properties": {
+        "exitCode": {
+          "type": [
+            "integer",
+            "null"
+          ]
+        },
+        "signal": {
+          "type": [
+            "string",
+            "null"
+          ]
+        }
+      }
+    },
+    "outputArtifacts": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "stdout",
+        "stderr"
+      ],
+      "properties": {
+        "stdout": {
+          "$ref": "#/$defs/materialArtifact"
+        },
+        "stderr": {
+          "$ref": "#/$defs/materialArtifact"
+        }
+      }
+    },
+    "workspaceAfter": {
+      "$ref": "workspace-snapshot-v1.schema.json"
+    },
+    "mutationDecision": {
+      "enum": [
+        "source_unchanged",
+        "invalidated_by_command_source_mutation"
+      ]
+    },
+    "issueCodes": {
+      "type": "array",
+      "uniqueItems": true,
+      "items": {
+        "type": "string",
+        "minLength": 1
+      }
+    },
+    "signatureRef": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "path",
+        "sha256"
+      ],
+      "properties": {
+        "path": {
+          "type": "string",
+          "minLength": 1
+        },
+        "sha256": {
+          "type": "string",
+          "pattern": "^sha256:[0-9a-f]{64}$"
+        }
+      }
+    }
+  },
+  "$defs": {
+    "materialArtifact": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "path",
+        "sha256",
+        "sizeBytes"
+      ],
+      "properties": {
+        "path": {
+          "type": "string",
+          "minLength": 1
+        },
+        "sha256": {
+          "type": "string",
+          "pattern": "^sha256:[0-9a-f]{64}$"
+        },
+        "sizeBytes": {
+          "type": "integer",
+          "minimum": 0
+        }
+      }
+    }
+  }
+}

package/packages/attest/src/index.mjs

@@ -41,7 +41,10 @@ function readSubject(subjectPath) {
 
 export function attestFile({ subjectPath, workspaceRoot }) {
   const subject = readSubject(subjectPath);
-  if (subject.value.schemaVersion === "OwlCodaQuickVerificationReceiptV1") {
+  if (new Set([
+    "OwlCodaQuickVerificationReceiptV1",
+    "OwlCodaQuickVerificationReceiptV2",
+  ]).has(subject.value.schemaVersion)) {
     const details = attestQuickReceiptDetailsFromBytes({
       receiptPath: subject.absolutePath,
       receiptBytes: subject.bytes,

package/packages/attest/src/quick-receipt-contract.mjs

@@ -110,10 +110,14 @@ function validOutputArtifact(value) {
 }
 
 export function validQuickReceiptShape(receipt) {
-  if (!hasExactKeys(receipt, RECEIPT_REQUIRED_KEYS, ["signatureRef"])) return false;
+  const receiptV1 = receipt?.schemaVersion === "OwlCodaQuickVerificationReceiptV1";
+  const receiptV2 = receipt?.schemaVersion === "OwlCodaQuickVerificationReceiptV2";
+  const requiredKeys = receiptV2
+    ? [...RECEIPT_REQUIRED_KEYS, "inputArtifacts"]
+    : RECEIPT_REQUIRED_KEYS;
+  if (!(receiptV1 || receiptV2) || !hasExactKeys(receipt, requiredKeys, ["signatureRef"])) return false;
   if (
-    receipt.schemaVersion !== "OwlCodaQuickVerificationReceiptV1"
-    || typeof receipt.receiptId !== "string"
+    typeof receipt.receiptId !== "string"
     || receipt.receiptId.length === 0
     || receipt.assurance !== "captured_verification"
     || receipt.authorizationGranted !== false
@@ -145,6 +149,12 @@ export function validQuickReceiptShape(receipt) {
   ) {
     return false;
   }
+  if (receiptV2 && (
+    !hasExactKeys(receipt.inputArtifacts, ["stdin"])
+    || !validOutputArtifact(receipt.inputArtifacts.stdin)
+  )) {
+    return false;
+  }
   if (receipt.signatureRef !== undefined) {
     if (!hasExactKeys(receipt.signatureRef, ["path", "sha256"])
       || typeof receipt.signatureRef.path !== "string"

package/packages/attest/src/quick.mjs

@@ -18,6 +18,16 @@ import { captureWorkspaceSnapshot } from "./workspace-snapshot.mjs";
 export { validQuickReceiptShape } from "./quick-receipt-contract.mjs";
 
 export const SUPPORTED_QUICK_CORE_IDENTITIES = Object.freeze([
+  {
+    contractVersion: "0.2",
+    coreVersion: "0.18.3",
+    coreManifestSha256: "sha256:cc7a923649592084150828f24f0d90f280af92514bafdbc4999f4015b3175d5c",
+  },
+  {
+    contractVersion: "0.2",
+    coreVersion: "0.18.2",
+    coreManifestSha256: "sha256:abe17ff794b4019d8d476f09eb5d4105bae1070b1df0aab53e6c94c7ec8b65a6",
+  },
   {
     contractVersion: "0.2",
     coreVersion: "0.18.1",
@@ -189,7 +199,11 @@ export function attestQuickReceiptDetailsFromBytes({
     throw error;
   }
 
-  const issues = [...receipt.issueCodes, "signature_absent", "anchor_absent"];
+  const issues = [
+    ...receipt.issueCodes.filter((issue) => issue !== "quick_ignored_artifact_unbound"),
+    "signature_absent",
+    "anchor_absent",
+  ];
   const materials = [];
   let materialMissing = false;
   let materialMismatch = false;
@@ -228,7 +242,12 @@ export function attestQuickReceiptDetailsFromBytes({
   const commandWorkspaceMatches = selectedWorkspaceRoot !== undefined
     && receiptWorkspaceRoot === selectedWorkspaceRoot;
   if (commandWorkspaceMatches) {
-    for (const artifact of [receipt.outputArtifacts.stdout, receipt.outputArtifacts.stderr]) {
+    const boundArtifacts = [
+      ...(receipt.inputArtifacts === undefined ? [] : [receipt.inputArtifacts.stdin]),
+      receipt.outputArtifacts.stdout,
+      receipt.outputArtifacts.stderr,
+    ];
+    for (const artifact of boundArtifacts) {
       try {
         const materialPath = resolveBoundMaterial(receiptWorkspaceRoot, artifact.path);
         const { bytes } = readFileBytesBounded(materialPath);

package/registry-release-policy-v1.json

@@ -2,7 +2,7 @@
   "schemaVersion": "OwlCodaRunKitRegistryReleasePolicyV1",
   "status": "release_candidate_unpublished",
   "packageName": "owlrunkit",
-  "candidateVersion": "0.18.1",
+  "candidateVersion": "0.18.3",
   "registry": "https://registry.npmjs.org",
   "registryRequiredBeforeAdoption": true,
   "exactVersionRequired": true,
@@ -23,10 +23,10 @@
   ],
   "currentPublishedRelease": {
     "packageName": "owlrunkit",
-    "version": "0.18.0",
-    "shasum": "ab2d9c9ed81f9dcccd4c1affa519cfca1cc32032",
-    "integrity": "sha512-asi4CKofzjzQ9gGxnv6/NDCM6rZcMMqpwd4uRStfUUwDetFLYHEPDMBv1JGvYotdUwwoODxwdJ3KMGXQSYorgA==",
-    "tarballUrl": "https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.18.0.tgz"
+    "version": "0.18.2",
+    "shasum": "4a85e31dad306260e4a6b1fcbccb3807e8647a0a",
+    "integrity": "sha512-Clpr8UQdNitzMMmQHUtjs9mesmukUqZrQ5nrda+Ryo8SuvECH8eBiis378NnzV1lI79kmljv49ToRRe867zlBg==",
+    "tarballUrl": "https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.18.2.tgz"
   },
   "registryRelease": null,
   "registryEvidenceMustBeExternal": true,

package/sbom.spdx.json

@@ -2,8 +2,8 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "owlrunkit-0.18.1",
-  "documentNamespace": "https://owlcoda.com/spdx/owlrunkit/0.18.1",
+  "name": "owlrunkit-0.18.3",
+  "documentNamespace": "https://owlcoda.com/spdx/owlrunkit/0.18.3",
   "creationInfo": {
     "created": "2026-07-29T00:00:00Z",
     "creators": [
@@ -14,8 +14,8 @@
     {
       "name": "owlrunkit",
       "SPDXID": "SPDXRef-Package-OwlRunKit",
-      "versionInfo": "0.18.1",
-      "downloadLocation": "https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.18.1.tgz",
+      "versionInfo": "0.18.3",
+      "downloadLocation": "https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.18.3.tgz",
       "filesAnalyzed": false,
       "licenseConcluded": "GPL-3.0-or-later",
       "licenseDeclared": "GPL-3.0-or-later",
@@ -24,7 +24,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/owlrunkit@0.18.1"
+          "referenceLocator": "pkg:npm/owlrunkit@0.18.3"
         }
       ]
     }

package/scripts/runkit-contract/assurance-router.mjs

@@ -14,7 +14,7 @@ const BOOLEAN_FACTS = [
   "schemaOrDataMigration",
 ];
 
-const RISK_CATEGORIES = new Set([
+export const RUNKIT_RISK_CATEGORIES = Object.freeze([
   "backtest",
   "deployment",
   "destructive",
@@ -26,6 +26,8 @@ const RISK_CATEGORIES = new Set([
   "release",
 ]);
 
+const RISK_CATEGORIES = new Set(RUNKIT_RISK_CATEGORIES);
+
 const MATERIAL_RISK_CATEGORIES = new Set([
   "destructive",
   "foreign_write",

package/scripts/runkit-contract/core-contract.mjs

@@ -14,7 +14,7 @@ import { fileURLToPath } from "node:url";
 import { parseProjectControlState } from "./project-control-parser.mjs";
 
 export const CONTRACT_VERSION = "0.2";
-export const CORE_VERSION = "0.18.1";
+export const CORE_VERSION = "0.18.3";
 export const RUNTIME_ROOT = ".owlcoda/runkit";
 
 const CORE_FILES = [
@@ -126,6 +126,7 @@ const CORE_FILES = [
   "schemas/verification-context-v1.schema.json",
   "schemas/team-project-definition-v1.schema.json",
   "schemas/team-project-event-v1.schema.json",
+  "schemas/team-project-event-v2.schema.json",
   "schemas/team-project-successor-receipt-v1.schema.json",
   "schemas/team-project-status-v1.schema.json",
   "schemas/usage-mode-recommendation-v1.schema.json",

package/scripts/runkit-contract/onboarding-doctor.mjs

@@ -190,11 +190,16 @@ function parseJsonStrict(text) {
 export function resolveBoundedWorkspaceRoot(workspaceRoot) {
   const requested = path.resolve(workspaceRoot);
   const stat = lstatSync(requested);
-  if (
-    stat.isSymbolicLink()
-    || !stat.isDirectory()
-    || realpathSync(requested) !== requested
-  ) {
+  const resolved = realpathSync(requested);
+  if ((stat.isSymbolicLink() || resolved !== requested)
+    && lstatSync(resolved).isDirectory()) {
+    const quoted = `'${resolved.replaceAll("'", `'"'"'`)}'`;
+    throw new Error(
+      "workspace root must be a real directory without symlink ancestors. "
+      + `Retry with --workspace ${quoted}.`,
+    );
+  }
+  if (!stat.isDirectory()) {
     throw new Error("workspace root must be a real directory without symlink ancestors");
   }
   return requested;
@@ -317,28 +322,51 @@ export function readLocalInstallBinding({ workspaceRoot } = {}) {
   };
 }
 
+function registryTransportFailure(error) {
+  const code = error?.cause?.code ?? error?.code ?? null;
+  if (error?.name === "TimeoutError"
+    || error?.name === "AbortError"
+    || code === "ETIMEDOUT") {
+    return { issueCode: "registry_timeout", retryable: true };
+  }
+  if (code === "ENOTFOUND" || code === "EAI_AGAIN") {
+    return { issueCode: "registry_dns_failed", retryable: true };
+  }
+  if (code === "ERR_INVALID_URL") {
+    return { issueCode: "registry_url_invalid", retryable: false };
+  }
+  return { issueCode: "registry_connection_failed", retryable: true };
+}
+
 export async function readRegistryExact({
   registryUrl,
   packageName = PACKAGE_NAME,
   version = EXPECTED_VERSION,
   timeoutMs = 1_500,
+  fetchImpl = fetch,
 } = {}) {
   const base = registryUrl.replace(/\/+$/, "");
   const url = `${base}/${encodeURIComponent(packageName)}/${encodeURIComponent(version)}`;
   let response;
-  try {
-    response = await fetch(url, {
-      headers: {
-        accept: "application/json",
-      },
-      redirect: "manual",
-      signal: AbortSignal.timeout(timeoutMs),
-    });
-  } catch {
-    return {
-      status: "unavailable",
-      issueCodes: ["registry_dns_or_timeout"],
-    };
+  for (let attempt = 0; attempt < 2; attempt += 1) {
+    try {
+      response = await fetchImpl(url, {
+        headers: {
+          accept: "application/json",
+        },
+        redirect: "manual",
+        signal: AbortSignal.timeout(timeoutMs),
+      });
+      break;
+    } catch (error) {
+      const failure = registryTransportFailure(error);
+      if (!failure.retryable || attempt === 1) {
+        return {
+          status: "unavailable",
+          issueCodes: [failure.issueCode],
+        };
+      }
+    }
   }
   if (response.status === 401 || response.status === 403) {
     return {

package/scripts/runkit-contract/profile-onboarding.mjs

@@ -1511,10 +1511,14 @@ export function reconcileProfilesV2({
   }
   const proposedProfilesBytes = `${JSON.stringify(merged.proposedProfiles, null, 2)}\n`;
   const proposedProfilesSha256 = sha256(proposedProfilesBytes);
+  const normalizationOnly = proposedProfilesSha256 !== currentProfilesSha256
+    && merged.addedProfileIds.length === 0
+    && merged.updatedProfiles.length === 0;
   const planBody = {
     detectionSha256: detection.detectionSha256,
     currentProfilesSha256,
     proposedProfilesSha256,
+    normalizationOnly,
     addedProfileIds: merged.addedProfileIds,
     updatedProfiles: merged.updatedProfiles,
   };

package/scripts/runkit-contract/project-cli-resolver.mjs

@@ -18,6 +18,9 @@ const OFFICIAL_CLI_ENTRYPOINT =
 const EXACT_VERSION = /^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?$/;
 const SHA256_REF = /^sha256:[a-f0-9]{64}$/;
 const TRUSTED_PRIOR_CORE_IDENTITIES = new Map([
+  ["0.18.1", new Set([
+    "sha256:349b4157d3d089462b172de1619ccd169b5c1669b9322e2580ac6ec4f8616b07",
+  ])],
   ["0.18.0", new Set([
     "sha256:72c481dbafe06a9c56cd940d74a3fe109a82b73a3c43d0bb54923ea6c584c04e",
   ])],

package/scripts/runkit-contract/quick-metrics.mjs

@@ -59,7 +59,7 @@ function trustedReceiptRoot(workspaceRoot) {
   return { status: "valid", root };
 }
 
-export function readLocalQuickMetrics(workspaceRoot) {
+export function readLocalQuickMetrics(workspaceRoot, { verbose = false } = {}) {
   const selected = trustedReceiptRoot(workspaceRoot);
   if (selected.status === "invalid") {
     return {
@@ -68,7 +68,7 @@ export function readLocalQuickMetrics(workspaceRoot) {
       schemaVersion: "OwlCodaRunKitLocalMetricsV1",
       telemetry: false,
       networkRequests: 0,
-      inputs: [],
+      ...(verbose ? { inputs: [] } : {}),
       quick: {
         total: 0,
         passed: 0,
@@ -117,7 +117,7 @@ export function readLocalQuickMetrics(workspaceRoot) {
     schemaVersion: "OwlCodaRunKitLocalMetricsV1",
     telemetry: false,
     networkRequests: 0,
-    inputs: receiptPaths,
+    ...(verbose ? { inputs: receiptPaths } : {}),
     quick: totals,
     authorizationGranted: false,
   };