owlrunkit 0.18.2 → 0.18.3

package/packages/attest/schemas/quick-verification-receipt-v2.schema.json

@@ -0,0 +1,232 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://owlcoda.dev/schemas/runkit/trust/quick-verification-receipt-v2.schema.json",
+  "title": "OwlCoda Quick Verification Receipt V2",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schemaVersion",
+    "receiptId",
+    "assurance",
+    "authorizationGranted",
+    "coreIdentity",
+    "workspaceBefore",
+    "exactCommand",
+    "inputArtifacts",
+    "verificationContext",
+    "startedAt",
+    "finishedAt",
+    "exitResult",
+    "outputArtifacts",
+    "workspaceAfter",
+    "mutationDecision",
+    "issueCodes"
+  ],
+  "properties": {
+    "schemaVersion": {
+      "const": "OwlCodaQuickVerificationReceiptV2"
+    },
+    "receiptId": {
+      "type": "string",
+      "minLength": 1
+    },
+    "assurance": {
+      "const": "captured_verification"
+    },
+    "authorizationGranted": {
+      "const": false
+    },
+    "coreIdentity": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "contractVersion",
+        "coreVersion",
+        "coreManifestSha256"
+      ],
+      "properties": {
+        "contractVersion": {
+          "type": "string",
+          "minLength": 1
+        },
+        "coreVersion": {
+          "type": "string",
+          "minLength": 1
+        },
+        "coreManifestSha256": {
+          "type": "string",
+          "pattern": "^sha256:[0-9a-f]{64}$"
+        }
+      }
+    },
+    "workspaceBefore": {
+      "$ref": "workspace-snapshot-v1.schema.json"
+    },
+    "exactCommand": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "executable",
+        "argv",
+        "cwd"
+      ],
+      "properties": {
+        "executable": {
+          "type": "string",
+          "minLength": 1
+        },
+        "argv": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "cwd": {
+          "type": "string",
+          "minLength": 1
+        }
+      }
+    },
+    "inputArtifacts": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "stdin"
+      ],
+      "properties": {
+        "stdin": {
+          "$ref": "#/$defs/materialArtifact"
+        }
+      }
+    },
+    "verificationContext": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "platform",
+        "architecture",
+        "runtime"
+      ],
+      "properties": {
+        "platform": {
+          "type": "string",
+          "minLength": 1
+        },
+        "architecture": {
+          "type": "string",
+          "minLength": 1
+        },
+        "runtime": {
+          "type": "string",
+          "minLength": 1
+        }
+      }
+    },
+    "startedAt": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "finishedAt": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "exitResult": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "exitCode",
+        "signal"
+      ],
+      "properties": {
+        "exitCode": {
+          "type": [
+            "integer",
+            "null"
+          ]
+        },
+        "signal": {
+          "type": [
+            "string",
+            "null"
+          ]
+        }
+      }
+    },
+    "outputArtifacts": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "stdout",
+        "stderr"
+      ],
+      "properties": {
+        "stdout": {
+          "$ref": "#/$defs/materialArtifact"
+        },
+        "stderr": {
+          "$ref": "#/$defs/materialArtifact"
+        }
+      }
+    },
+    "workspaceAfter": {
+      "$ref": "workspace-snapshot-v1.schema.json"
+    },
+    "mutationDecision": {
+      "enum": [
+        "source_unchanged",
+        "invalidated_by_command_source_mutation"
+      ]
+    },
+    "issueCodes": {
+      "type": "array",
+      "uniqueItems": true,
+      "items": {
+        "type": "string",
+        "minLength": 1
+      }
+    },
+    "signatureRef": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "path",
+        "sha256"
+      ],
+      "properties": {
+        "path": {
+          "type": "string",
+          "minLength": 1
+        },
+        "sha256": {
+          "type": "string",
+          "pattern": "^sha256:[0-9a-f]{64}$"
+        }
+      }
+    }
+  },
+  "$defs": {
+    "materialArtifact": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "path",
+        "sha256",
+        "sizeBytes"
+      ],
+      "properties": {
+        "path": {
+          "type": "string",
+          "minLength": 1
+        },
+        "sha256": {
+          "type": "string",
+          "pattern": "^sha256:[0-9a-f]{64}$"
+        },
+        "sizeBytes": {
+          "type": "integer",
+          "minimum": 0
+        }
+      }
+    }
+  }
+}

package/packages/attest/src/index.mjs

@@ -41,7 +41,10 @@ function readSubject(subjectPath) {
 
 export function attestFile({ subjectPath, workspaceRoot }) {
   const subject = readSubject(subjectPath);
-  if (subject.value.schemaVersion === "OwlCodaQuickVerificationReceiptV1") {
+  if (new Set([
+    "OwlCodaQuickVerificationReceiptV1",
+    "OwlCodaQuickVerificationReceiptV2",
+  ]).has(subject.value.schemaVersion)) {
     const details = attestQuickReceiptDetailsFromBytes({
       receiptPath: subject.absolutePath,
       receiptBytes: subject.bytes,

package/packages/attest/src/quick-receipt-contract.mjs

@@ -110,10 +110,14 @@ function validOutputArtifact(value) {
 }
 
 export function validQuickReceiptShape(receipt) {
-  if (!hasExactKeys(receipt, RECEIPT_REQUIRED_KEYS, ["signatureRef"])) return false;
+  const receiptV1 = receipt?.schemaVersion === "OwlCodaQuickVerificationReceiptV1";
+  const receiptV2 = receipt?.schemaVersion === "OwlCodaQuickVerificationReceiptV2";
+  const requiredKeys = receiptV2
+    ? [...RECEIPT_REQUIRED_KEYS, "inputArtifacts"]
+    : RECEIPT_REQUIRED_KEYS;
+  if (!(receiptV1 || receiptV2) || !hasExactKeys(receipt, requiredKeys, ["signatureRef"])) return false;
   if (
-    receipt.schemaVersion !== "OwlCodaQuickVerificationReceiptV1"
-    || typeof receipt.receiptId !== "string"
+    typeof receipt.receiptId !== "string"
     || receipt.receiptId.length === 0
     || receipt.assurance !== "captured_verification"
     || receipt.authorizationGranted !== false
@@ -145,6 +149,12 @@ export function validQuickReceiptShape(receipt) {
   ) {
     return false;
   }
+  if (receiptV2 && (
+    !hasExactKeys(receipt.inputArtifacts, ["stdin"])
+    || !validOutputArtifact(receipt.inputArtifacts.stdin)
+  )) {
+    return false;
+  }
   if (receipt.signatureRef !== undefined) {
     if (!hasExactKeys(receipt.signatureRef, ["path", "sha256"])
       || typeof receipt.signatureRef.path !== "string"

package/packages/attest/src/quick.mjs

@@ -18,6 +18,11 @@ import { captureWorkspaceSnapshot } from "./workspace-snapshot.mjs";
 export { validQuickReceiptShape } from "./quick-receipt-contract.mjs";
 
 export const SUPPORTED_QUICK_CORE_IDENTITIES = Object.freeze([
+  {
+    contractVersion: "0.2",
+    coreVersion: "0.18.3",
+    coreManifestSha256: "sha256:cc7a923649592084150828f24f0d90f280af92514bafdbc4999f4015b3175d5c",
+  },
   {
     contractVersion: "0.2",
     coreVersion: "0.18.2",
@@ -194,7 +199,11 @@ export function attestQuickReceiptDetailsFromBytes({
     throw error;
   }
 
-  const issues = [...receipt.issueCodes, "signature_absent", "anchor_absent"];
+  const issues = [
+    ...receipt.issueCodes.filter((issue) => issue !== "quick_ignored_artifact_unbound"),
+    "signature_absent",
+    "anchor_absent",
+  ];
   const materials = [];
   let materialMissing = false;
   let materialMismatch = false;
@@ -233,7 +242,12 @@ export function attestQuickReceiptDetailsFromBytes({
   const commandWorkspaceMatches = selectedWorkspaceRoot !== undefined
     && receiptWorkspaceRoot === selectedWorkspaceRoot;
   if (commandWorkspaceMatches) {
-    for (const artifact of [receipt.outputArtifacts.stdout, receipt.outputArtifacts.stderr]) {
+    const boundArtifacts = [
+      ...(receipt.inputArtifacts === undefined ? [] : [receipt.inputArtifacts.stdin]),
+      receipt.outputArtifacts.stdout,
+      receipt.outputArtifacts.stderr,
+    ];
+    for (const artifact of boundArtifacts) {
       try {
         const materialPath = resolveBoundMaterial(receiptWorkspaceRoot, artifact.path);
         const { bytes } = readFileBytesBounded(materialPath);

package/registry-release-policy-v1.json

@@ -2,7 +2,7 @@
   "schemaVersion": "OwlCodaRunKitRegistryReleasePolicyV1",
   "status": "release_candidate_unpublished",
   "packageName": "owlrunkit",
-  "candidateVersion": "0.18.2",
+  "candidateVersion": "0.18.3",
   "registry": "https://registry.npmjs.org",
   "registryRequiredBeforeAdoption": true,
   "exactVersionRequired": true,
@@ -23,10 +23,10 @@
   ],
   "currentPublishedRelease": {
     "packageName": "owlrunkit",
-    "version": "0.18.1",
-    "shasum": "6d35c15f90ed775c583356754b831856d1a3c0a6",
-    "integrity": "sha512-07wWnSfY6RUavcb+ZpUbZ1S0nBjN7/8VIFHyP6blOB+PIrDnnST/8f7CoLgADYpfwjZiF5gR9U6XFwXa0kgVrg==",
-    "tarballUrl": "https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.18.1.tgz"
+    "version": "0.18.2",
+    "shasum": "4a85e31dad306260e4a6b1fcbccb3807e8647a0a",
+    "integrity": "sha512-Clpr8UQdNitzMMmQHUtjs9mesmukUqZrQ5nrda+Ryo8SuvECH8eBiis378NnzV1lI79kmljv49ToRRe867zlBg==",
+    "tarballUrl": "https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.18.2.tgz"
   },
   "registryRelease": null,
   "registryEvidenceMustBeExternal": true,

package/sbom.spdx.json

@@ -2,8 +2,8 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "owlrunkit-0.18.2",
-  "documentNamespace": "https://owlcoda.com/spdx/owlrunkit/0.18.2",
+  "name": "owlrunkit-0.18.3",
+  "documentNamespace": "https://owlcoda.com/spdx/owlrunkit/0.18.3",
   "creationInfo": {
     "created": "2026-07-29T00:00:00Z",
     "creators": [
@@ -14,8 +14,8 @@
     {
       "name": "owlrunkit",
       "SPDXID": "SPDXRef-Package-OwlRunKit",
-      "versionInfo": "0.18.2",
-      "downloadLocation": "https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.18.2.tgz",
+      "versionInfo": "0.18.3",
+      "downloadLocation": "https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.18.3.tgz",
       "filesAnalyzed": false,
       "licenseConcluded": "GPL-3.0-or-later",
       "licenseDeclared": "GPL-3.0-or-later",
@@ -24,7 +24,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/owlrunkit@0.18.2"
+          "referenceLocator": "pkg:npm/owlrunkit@0.18.3"
         }
       ]
     }

package/scripts/runkit-contract/core-contract.mjs

@@ -14,7 +14,7 @@ import { fileURLToPath } from "node:url";
 import { parseProjectControlState } from "./project-control-parser.mjs";
 
 export const CONTRACT_VERSION = "0.2";
-export const CORE_VERSION = "0.18.2";
+export const CORE_VERSION = "0.18.3";
 export const RUNTIME_ROOT = ".owlcoda/runkit";
 
 const CORE_FILES = [
@@ -126,6 +126,7 @@ const CORE_FILES = [
   "schemas/verification-context-v1.schema.json",
   "schemas/team-project-definition-v1.schema.json",
   "schemas/team-project-event-v1.schema.json",
+  "schemas/team-project-event-v2.schema.json",
   "schemas/team-project-successor-receipt-v1.schema.json",
   "schemas/team-project-status-v1.schema.json",
   "schemas/usage-mode-recommendation-v1.schema.json",

package/scripts/runkit-contract/quick-metrics.mjs

@@ -59,7 +59,7 @@ function trustedReceiptRoot(workspaceRoot) {
   return { status: "valid", root };
 }
 
-export function readLocalQuickMetrics(workspaceRoot) {
+export function readLocalQuickMetrics(workspaceRoot, { verbose = false } = {}) {
   const selected = trustedReceiptRoot(workspaceRoot);
   if (selected.status === "invalid") {
     return {
@@ -68,7 +68,7 @@ export function readLocalQuickMetrics(workspaceRoot) {
       schemaVersion: "OwlCodaRunKitLocalMetricsV1",
       telemetry: false,
       networkRequests: 0,
-      inputs: [],
+      ...(verbose ? { inputs: [] } : {}),
       quick: {
         total: 0,
         passed: 0,
@@ -117,7 +117,7 @@ export function readLocalQuickMetrics(workspaceRoot) {
     schemaVersion: "OwlCodaRunKitLocalMetricsV1",
     telemetry: false,
     networkRequests: 0,
-    inputs: receiptPaths,
+    ...(verbose ? { inputs: receiptPaths } : {}),
     quick: totals,
     authorizationGranted: false,
   };

package/scripts/runkit-contract/quick-receipt.mjs

@@ -97,20 +97,36 @@ function cleanOutputLine(line) {
     .trim();
 }
 
-function summarizeOutputBytes(bytes) {
-  const start = Math.max(0, bytes.byteLength - OUTPUT_SUMMARY_BYTES);
-  let text = bytes.subarray(start).toString("utf8");
-  if (start > 0) {
-    const firstLineBreak = text.indexOf("\n");
-    if (firstLineBreak >= 0) text = text.slice(firstLineBreak + 1);
-  }
-  const lines = text
+function cleanOutputLines(text) {
+  return text
     .split(/\r?\n/u)
     .map(cleanOutputLine)
     .filter(Boolean);
+}
+
+function summarizeOutputBytes(bytes) {
+  if (bytes.byteLength <= OUTPUT_SUMMARY_BYTES) {
+    const lines = cleanOutputLines(bytes.toString("utf8"));
+    return {
+      headLines: lines.slice(0, OUTPUT_SUMMARY_LINES),
+      tailLines: lines.slice(-OUTPUT_SUMMARY_LINES),
+      truncated: lines.length > OUTPUT_SUMMARY_LINES * 2,
+    };
+  }
+
+  const windowBytes = Math.floor(OUTPUT_SUMMARY_BYTES / 2);
+  let headText = bytes.subarray(0, windowBytes).toString("utf8");
+  const lastHeadBreak = headText.lastIndexOf("\n");
+  if (lastHeadBreak >= 0) headText = headText.slice(0, lastHeadBreak + 1);
+
+  let tailText = bytes.subarray(bytes.byteLength - windowBytes).toString("utf8");
+  const firstTailBreak = tailText.indexOf("\n");
+  if (firstTailBreak >= 0) tailText = tailText.slice(firstTailBreak + 1);
+
   return {
-    lines: lines.slice(-OUTPUT_SUMMARY_LINES),
-    truncated: start > 0 || lines.length > OUTPUT_SUMMARY_LINES,
+    headLines: cleanOutputLines(headText).slice(0, OUTPUT_SUMMARY_LINES),
+    tailLines: cleanOutputLines(tailText).slice(-OUTPUT_SUMMARY_LINES),
+    truncated: true,
   };
 }
 
@@ -145,10 +161,59 @@ function validateQuickReceiptStore(workspaceRoot, store) {
   assertStorePath(root, store.receiptRoot, store.receiptRootIdentity, "directory");
   assertStorePath(root, store.stdoutPath, store.stdoutIdentity, "file");
   assertStorePath(root, store.stderrPath, store.stderrIdentity, "file");
+  if (store.stdinPath !== undefined) {
+    assertStorePath(root, store.stdinPath, store.stdinIdentity, "file");
+    const bytes = readFileSync(store.stdinPath);
+    if (
+      bytes.byteLength !== store.stdinArtifact.sizeBytes
+      || sha256Bytes(bytes) !== store.stdinArtifact.sha256
+    ) {
+      throw new Error(`Quick receipt store stdin material changed: ${store.stdinPath}`);
+    }
+  }
+}
+
+export function persistQuickInputArtifact({ workspaceRoot, store, bytes }) {
+  if (!Buffer.isBuffer(bytes)) throw new Error("Quick stdin material must be bytes.");
+  validateQuickReceiptStore(workspaceRoot, store);
+  const stdinPath = path.join(store.receiptRoot, "stdin.bin");
+  writeFileSync(stdinPath, bytes, { flag: "wx", mode: 0o600 });
+  const stat = lstatSync(stdinPath);
+  if (stat.isSymbolicLink() || !stat.isFile()) {
+    throw new Error(`Quick receipt store stdin material is not trusted: ${stdinPath}`);
+  }
+  const root = realpathSync(workspaceRoot);
+  const resolved = realpathSync(stdinPath);
+  if (!withinRoot(root, resolved)) {
+    throw new Error(`Quick receipt store stdin material escapes the workspace: ${stdinPath}`);
+  }
+  store.stdinPath = stdinPath;
+  store.stdinIdentity = { dev: stat.dev, ino: stat.ino };
+  store.stdinArtifact = {
+    path: path.relative(root, resolved).split(path.sep).join("/"),
+    sha256: sha256Bytes(bytes),
+    sizeBytes: bytes.byteLength,
+  };
+  return {
+    artifact: store.stdinArtifact,
+    inputPath: stdinPath,
+  };
 }
 
 export function persistQuickReceipt({ workspaceRoot, store, receipt }) {
   validateQuickReceiptStore(workspaceRoot, store);
+  const receiptStdin = receipt.inputArtifacts?.stdin;
+  if (
+    (store.stdinArtifact === undefined) !== (receiptStdin === undefined)
+    || store.stdinArtifact !== undefined
+      && (
+        receiptStdin.path !== store.stdinArtifact.path
+        || receiptStdin.sha256 !== store.stdinArtifact.sha256
+        || receiptStdin.sizeBytes !== store.stdinArtifact.sizeBytes
+      )
+  ) {
+    throw new Error("Quick receipt stdin binding does not match the persisted material.");
+  }
   const stdout = outputArtifact(workspaceRoot, store.stdoutPath);
   const stderr = outputArtifact(workspaceRoot, store.stderrPath);
   const complete = {
@@ -164,8 +229,10 @@ export function persistQuickReceipt({ workspaceRoot, store, receipt }) {
     receiptPath: store.receiptPath,
     receiptSha256: sha256Bytes(readFileSync(store.receiptPath)),
     outputSummary: {
-      stdoutTail: stdout.summary.lines,
-      stderrTail: stderr.summary.lines,
+      stdoutHead: stdout.summary.headLines,
+      stdoutTail: stdout.summary.tailLines,
+      stderrHead: stderr.summary.headLines,
+      stderrTail: stderr.summary.tailLines,
       stdoutTruncated: stdout.summary.truncated,
       stderrTruncated: stderr.summary.truncated,
     },