owlrunkit 0.18.2 → 0.18.4

package/packages/attest/schemas/quick-verification-receipt-v2.schema.json

@@ -0,0 +1,232 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://owlcoda.dev/schemas/runkit/trust/quick-verification-receipt-v2.schema.json",
+  "title": "OwlCoda Quick Verification Receipt V2",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schemaVersion",
+    "receiptId",
+    "assurance",
+    "authorizationGranted",
+    "coreIdentity",
+    "workspaceBefore",
+    "exactCommand",
+    "inputArtifacts",
+    "verificationContext",
+    "startedAt",
+    "finishedAt",
+    "exitResult",
+    "outputArtifacts",
+    "workspaceAfter",
+    "mutationDecision",
+    "issueCodes"
+  ],
+  "properties": {
+    "schemaVersion": {
+      "const": "OwlCodaQuickVerificationReceiptV2"
+    },
+    "receiptId": {
+      "type": "string",
+      "minLength": 1
+    },
+    "assurance": {
+      "const": "captured_verification"
+    },
+    "authorizationGranted": {
+      "const": false
+    },
+    "coreIdentity": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "contractVersion",
+        "coreVersion",
+        "coreManifestSha256"
+      ],
+      "properties": {
+        "contractVersion": {
+          "type": "string",
+          "minLength": 1
+        },
+        "coreVersion": {
+          "type": "string",
+          "minLength": 1
+        },
+        "coreManifestSha256": {
+          "type": "string",
+          "pattern": "^sha256:[0-9a-f]{64}$"
+        }
+      }
+    },
+    "workspaceBefore": {
+      "$ref": "workspace-snapshot-v1.schema.json"
+    },
+    "exactCommand": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "executable",
+        "argv",
+        "cwd"
+      ],
+      "properties": {
+        "executable": {
+          "type": "string",
+          "minLength": 1
+        },
+        "argv": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "cwd": {
+          "type": "string",
+          "minLength": 1
+        }
+      }
+    },
+    "inputArtifacts": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "stdin"
+      ],
+      "properties": {
+        "stdin": {
+          "$ref": "#/$defs/materialArtifact"
+        }
+      }
+    },
+    "verificationContext": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "platform",
+        "architecture",
+        "runtime"
+      ],
+      "properties": {
+        "platform": {
+          "type": "string",
+          "minLength": 1
+        },
+        "architecture": {
+          "type": "string",
+          "minLength": 1
+        },
+        "runtime": {
+          "type": "string",
+          "minLength": 1
+        }
+      }
+    },
+    "startedAt": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "finishedAt": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "exitResult": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "exitCode",
+        "signal"
+      ],
+      "properties": {
+        "exitCode": {
+          "type": [
+            "integer",
+            "null"
+          ]
+        },
+        "signal": {
+          "type": [
+            "string",
+            "null"
+          ]
+        }
+      }
+    },
+    "outputArtifacts": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "stdout",
+        "stderr"
+      ],
+      "properties": {
+        "stdout": {
+          "$ref": "#/$defs/materialArtifact"
+        },
+        "stderr": {
+          "$ref": "#/$defs/materialArtifact"
+        }
+      }
+    },
+    "workspaceAfter": {
+      "$ref": "workspace-snapshot-v1.schema.json"
+    },
+    "mutationDecision": {
+      "enum": [
+        "source_unchanged",
+        "invalidated_by_command_source_mutation"
+      ]
+    },
+    "issueCodes": {
+      "type": "array",
+      "uniqueItems": true,
+      "items": {
+        "type": "string",
+        "minLength": 1
+      }
+    },
+    "signatureRef": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "path",
+        "sha256"
+      ],
+      "properties": {
+        "path": {
+          "type": "string",
+          "minLength": 1
+        },
+        "sha256": {
+          "type": "string",
+          "pattern": "^sha256:[0-9a-f]{64}$"
+        }
+      }
+    }
+  },
+  "$defs": {
+    "materialArtifact": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "path",
+        "sha256",
+        "sizeBytes"
+      ],
+      "properties": {
+        "path": {
+          "type": "string",
+          "minLength": 1
+        },
+        "sha256": {
+          "type": "string",
+          "pattern": "^sha256:[0-9a-f]{64}$"
+        },
+        "sizeBytes": {
+          "type": "integer",
+          "minimum": 0
+        }
+      }
+    }
+  }
+}

package/packages/attest/src/index.mjs

@@ -41,7 +41,10 @@ function readSubject(subjectPath) {
 
 export function attestFile({ subjectPath, workspaceRoot }) {
   const subject = readSubject(subjectPath);
-  if (subject.value.schemaVersion === "OwlCodaQuickVerificationReceiptV1") {
+  if (new Set([
+    "OwlCodaQuickVerificationReceiptV1",
+    "OwlCodaQuickVerificationReceiptV2",
+  ]).has(subject.value.schemaVersion)) {
     const details = attestQuickReceiptDetailsFromBytes({
       receiptPath: subject.absolutePath,
       receiptBytes: subject.bytes,

package/packages/attest/src/quick-receipt-contract.mjs

@@ -54,7 +54,7 @@ function validCoreIdentity(value) {
     && isSha256Ref(value.coreManifestSha256);
 }
 
-function validSnapshot(value) {
+export function validWorkspaceSnapshotShape(value) {
   if (!hasExactKeys(value, SNAPSHOT_REQUIRED_KEYS)) return false;
   if (
     value.schemaVersion !== "OwlCodaWorkspaceSnapshotV1"
@@ -110,16 +110,20 @@ function validOutputArtifact(value) {
 }
 
 export function validQuickReceiptShape(receipt) {
-  if (!hasExactKeys(receipt, RECEIPT_REQUIRED_KEYS, ["signatureRef"])) return false;
+  const receiptV1 = receipt?.schemaVersion === "OwlCodaQuickVerificationReceiptV1";
+  const receiptV2 = receipt?.schemaVersion === "OwlCodaQuickVerificationReceiptV2";
+  const requiredKeys = receiptV2
+    ? [...RECEIPT_REQUIRED_KEYS, "inputArtifacts"]
+    : RECEIPT_REQUIRED_KEYS;
+  if (!(receiptV1 || receiptV2) || !hasExactKeys(receipt, requiredKeys, ["signatureRef"])) return false;
   if (
-    receipt.schemaVersion !== "OwlCodaQuickVerificationReceiptV1"
-    || typeof receipt.receiptId !== "string"
+    typeof receipt.receiptId !== "string"
     || receipt.receiptId.length === 0
     || receipt.assurance !== "captured_verification"
     || receipt.authorizationGranted !== false
     || !validCoreIdentity(receipt.coreIdentity)
-    || !validSnapshot(receipt.workspaceBefore)
-    || !validSnapshot(receipt.workspaceAfter)
+    || !validWorkspaceSnapshotShape(receipt.workspaceBefore)
+    || !validWorkspaceSnapshotShape(receipt.workspaceAfter)
     || !hasExactKeys(receipt.exactCommand, ["executable", "argv", "cwd"])
     || typeof receipt.exactCommand.executable !== "string"
     || receipt.exactCommand.executable.length === 0
@@ -145,6 +149,12 @@ export function validQuickReceiptShape(receipt) {
   ) {
     return false;
   }
+  if (receiptV2 && (
+    !hasExactKeys(receipt.inputArtifacts, ["stdin"])
+    || !validOutputArtifact(receipt.inputArtifacts.stdin)
+  )) {
+    return false;
+  }
   if (receipt.signatureRef !== undefined) {
     if (!hasExactKeys(receipt.signatureRef, ["path", "sha256"])
       || typeof receipt.signatureRef.path !== "string"

package/packages/attest/src/quick.mjs

@@ -18,6 +18,16 @@ import { captureWorkspaceSnapshot } from "./workspace-snapshot.mjs";
 export { validQuickReceiptShape } from "./quick-receipt-contract.mjs";
 
 export const SUPPORTED_QUICK_CORE_IDENTITIES = Object.freeze([
+  {
+    contractVersion: "0.2",
+    coreVersion: "0.18.4",
+    coreManifestSha256: "sha256:372d4c247e4b40b0fd2f3fe0f5bf928548095bfb7e2e92e9ac66790e2717f77d",
+  },
+  {
+    contractVersion: "0.2",
+    coreVersion: "0.18.3",
+    coreManifestSha256: "sha256:cc7a923649592084150828f24f0d90f280af92514bafdbc4999f4015b3175d5c",
+  },
   {
     contractVersion: "0.2",
     coreVersion: "0.18.2",
@@ -194,7 +204,11 @@ export function attestQuickReceiptDetailsFromBytes({
     throw error;
   }
 
-  const issues = [...receipt.issueCodes, "signature_absent", "anchor_absent"];
+  const issues = [
+    ...receipt.issueCodes.filter((issue) => issue !== "quick_ignored_artifact_unbound"),
+    "signature_absent",
+    "anchor_absent",
+  ];
   const materials = [];
   let materialMissing = false;
   let materialMismatch = false;
@@ -233,7 +247,12 @@ export function attestQuickReceiptDetailsFromBytes({
   const commandWorkspaceMatches = selectedWorkspaceRoot !== undefined
     && receiptWorkspaceRoot === selectedWorkspaceRoot;
   if (commandWorkspaceMatches) {
-    for (const artifact of [receipt.outputArtifacts.stdout, receipt.outputArtifacts.stderr]) {
+    const boundArtifacts = [
+      ...(receipt.inputArtifacts === undefined ? [] : [receipt.inputArtifacts.stdin]),
+      receipt.outputArtifacts.stdout,
+      receipt.outputArtifacts.stderr,
+    ];
+    for (const artifact of boundArtifacts) {
       try {
         const materialPath = resolveBoundMaterial(receiptWorkspaceRoot, artifact.path);
         const { bytes } = readFileBytesBounded(materialPath);

package/packages/attest/src/workspace-snapshot.mjs

@@ -76,7 +76,16 @@ function parseStatus(root) {
     if (!field) continue;
     const status = field.slice(0, 2);
     const currentPath = normalizePath(field.slice(3));
-    if (status.includes("R") || status.includes("C")) index += 1;
+    let priorPath = null;
+    if (status.includes("R") || status.includes("C")) {
+      const prior = fields[index + 1];
+      if (!prior) throw new Error("Git status rename entry is incomplete.");
+      priorPath = normalizePath(prior);
+      index += 1;
+    }
+    if (status.includes("R") && priorPath && !isControlPath(priorPath)) {
+      entries.set(priorPath, { path: priorPath, state: "deleted", sha256: null });
+    }
     if (!currentPath || isControlPath(currentPath)) continue;
     let state = "modified";
     if (status === "??") state = "untracked";

package/registry-release-policy-v1.json

@@ -2,7 +2,7 @@
   "schemaVersion": "OwlCodaRunKitRegistryReleasePolicyV1",
   "status": "release_candidate_unpublished",
   "packageName": "owlrunkit",
-  "candidateVersion": "0.18.2",
+  "candidateVersion": "0.18.4",
   "registry": "https://registry.npmjs.org",
   "registryRequiredBeforeAdoption": true,
   "exactVersionRequired": true,
@@ -23,10 +23,10 @@
   ],
   "currentPublishedRelease": {
     "packageName": "owlrunkit",
-    "version": "0.18.1",
-    "shasum": "6d35c15f90ed775c583356754b831856d1a3c0a6",
-    "integrity": "sha512-07wWnSfY6RUavcb+ZpUbZ1S0nBjN7/8VIFHyP6blOB+PIrDnnST/8f7CoLgADYpfwjZiF5gR9U6XFwXa0kgVrg==",
-    "tarballUrl": "https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.18.1.tgz"
+    "version": "0.18.3",
+    "shasum": "f8ba5ab3d426aea21bbdd8f459fd3dd5e89ff08a",
+    "integrity": "sha512-zcsWY8sSKW1uJpa28VDqBx9coEMYnADKix9sr0rPz+kyoV6K/NDHHRMPx+24oFDKH9zVFaNyVyq5OAgoaMm8/Q==",
+    "tarballUrl": "https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.18.3.tgz"
   },
   "registryRelease": null,
   "registryEvidenceMustBeExternal": true,

package/sbom.spdx.json

@@ -2,8 +2,8 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "owlrunkit-0.18.2",
-  "documentNamespace": "https://owlcoda.com/spdx/owlrunkit/0.18.2",
+  "name": "owlrunkit-0.18.4",
+  "documentNamespace": "https://owlcoda.com/spdx/owlrunkit/0.18.4",
   "creationInfo": {
     "created": "2026-07-29T00:00:00Z",
     "creators": [
@@ -14,8 +14,8 @@
     {
       "name": "owlrunkit",
       "SPDXID": "SPDXRef-Package-OwlRunKit",
-      "versionInfo": "0.18.2",
-      "downloadLocation": "https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.18.2.tgz",
+      "versionInfo": "0.18.4",
+      "downloadLocation": "https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.18.4.tgz",
       "filesAnalyzed": false,
       "licenseConcluded": "GPL-3.0-or-later",
       "licenseDeclared": "GPL-3.0-or-later",
@@ -24,7 +24,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/owlrunkit@0.18.2"
+          "referenceLocator": "pkg:npm/owlrunkit@0.18.4"
         }
       ]
     }

package/scripts/runkit-contract/assurance-router.mjs

@@ -56,9 +56,9 @@ function incompleteReasons(input) {
   return [...new Set(reasons)].sort();
 }
 
-function result({ lane, riskMode, reasonCodes, nextCommand }) {
+function result({ schemaVersion, lane, riskMode, reasonCodes, nextCommand }) {
   return {
-    schemaVersion: "OwlCodaRunKitAssuranceRouteV1",
+    schemaVersion,
     status: "routed",
     lane,
     riskMode,
@@ -68,14 +68,15 @@ function result({ lane, riskMode, reasonCodes, nextCommand }) {
   };
 }
 
-export function routeRunKitAssuranceV1(input) {
+function routeRunKitAssurance(input, { schemaVersion, commandPrefix }) {
   const incomplete = incompleteReasons(input);
   if (incomplete.length > 0) {
     return result({
+      schemaVersion,
       lane: "formal",
       riskMode: "full",
       reasonCodes: ["assurance_input_incomplete", ...incomplete],
-      nextCommand: "owlrunkit formal start",
+      nextCommand: `${commandPrefix} formal start`,
     });
   }
 
@@ -95,15 +96,17 @@ export function routeRunKitAssuranceV1(input) {
   ];
   if (formalReasons.length > 0) {
     return result({
+      schemaVersion,
       lane: "formal",
       riskMode: "full",
       reasonCodes: [...new Set(formalReasons)].sort(),
-      nextCommand: "owlrunkit formal start",
+      nextCommand: `${commandPrefix} formal start`,
     });
   }
 
   if (!input.needsDurableEvidence) {
     return result({
+      schemaVersion,
       lane: "none",
       riskMode: "lightweight",
       reasonCodes: ["durable_evidence_not_required"],
@@ -113,6 +116,7 @@ export function routeRunKitAssuranceV1(input) {
 
   if (input.exactCommandCount !== 1) {
     return result({
+      schemaVersion,
       lane: "none",
       riskMode: "lightweight",
       reasonCodes: ["quick_exact_command_required"],
@@ -121,9 +125,24 @@ export function routeRunKitAssuranceV1(input) {
   }
 
   return result({
+    schemaVersion,
     lane: "quick",
     riskMode: "lightweight",
     reasonCodes: ["single_bounded_verification"],
-    nextCommand: "owlrunkit quick-verify",
+    nextCommand: `${commandPrefix} quick-verify`,
+  });
+}
+
+export function routeRunKitAssuranceV1(input) {
+  return routeRunKitAssurance(input, {
+    schemaVersion: "OwlCodaRunKitAssuranceRouteV1",
+    commandPrefix: "owlrunkit",
+  });
+}
+
+export function routeRunKitAssuranceV2(input) {
+  return routeRunKitAssurance(input, {
+    schemaVersion: "OwlCodaRunKitAssuranceRouteV2",
+    commandPrefix: "npx --no-install owlrunkit",
   });
 }

package/scripts/runkit-contract/core-contract.mjs

@@ -14,7 +14,7 @@ import { fileURLToPath } from "node:url";
 import { parseProjectControlState } from "./project-control-parser.mjs";
 
 export const CONTRACT_VERSION = "0.2";
-export const CORE_VERSION = "0.18.2";
+export const CORE_VERSION = "0.18.4";
 export const RUNTIME_ROOT = ".owlcoda/runkit";
 
 const CORE_FILES = [
@@ -43,6 +43,7 @@ const CORE_FILES = [
   "project-cli-resolver.mjs",
   "project-control-parser.mjs",
   "project-control-state.mjs",
+  "project-external-delivery.mjs",
   "provenance-common.mjs",
   "quick-attest.mjs",
   "quick-canonical.mjs",
@@ -76,6 +77,7 @@ const CORE_FILES = [
   "verification-plan.mjs",
   "visual-smoke.mjs",
   "schemas/assurance-route-v1.schema.json",
+  "schemas/assurance-route-v2.schema.json",
   "schemas/closeout-receipt-v2.schema.json",
   "schemas/adoption-evidence-v1.schema.json",
   "schemas/coverage-adopt-request-v1.schema.json",
@@ -102,6 +104,7 @@ const CORE_FILES = [
   "schemas/owner-deployment-decision-v1.schema.json",
   "schemas/profile-apply-receipt-v1.schema.json",
   "schemas/profile-detection-v2.schema.json",
+  "schemas/profile-detection-v3.schema.json",
   "schemas/profile-reconcile-plan-v1.schema.json",
   "schemas/profile-reconcile-receipt-v1.schema.json",
   "schemas/project-config.schema.json",
@@ -126,9 +129,13 @@ const CORE_FILES = [
   "schemas/verification-context-v1.schema.json",
   "schemas/team-project-definition-v1.schema.json",
   "schemas/team-project-event-v1.schema.json",
+  "schemas/team-project-event-v2.schema.json",
+  "schemas/team-project-event-v3.schema.json",
   "schemas/team-project-successor-receipt-v1.schema.json",
   "schemas/team-project-status-v1.schema.json",
+  "schemas/team-project-status-v2.schema.json",
   "schemas/usage-mode-recommendation-v1.schema.json",
+  "schemas/usage-mode-recommendation-v2.schema.json",
   "schemas/verification-envelope-v1.schema.json",
   "schemas/verification-finalize-attempt-v1.schema.json",
   "schemas/verification-preflight-v1.schema.json",
@@ -160,10 +167,12 @@ const CORE_FILES = [
 ];
 
 const CORE_DEPENDENCY_FILES = [
+  "packages/attest/schemas/workspace-snapshot-v1.schema.json",
   "packages/attest/src/formal.mjs",
   "packages/attest/src/offline-bundle.mjs",
   "packages/attest/src/quick-receipt-contract.mjs",
   "packages/attest/src/reference-contract.mjs",
+  "packages/attest/src/workspace-snapshot.mjs",
 ];
 
 function sha256(value) {

package/scripts/runkit-contract/onboarding-doctor.mjs

@@ -818,7 +818,7 @@ export function formatDoctorHuman(report) {
       : []),
     ...(otherWarnings.length > 0 ? [`Warnings: ${otherWarnings.join(", ")}`] : []),
     `Next: ${report.nextAllowedAction === "adopt_current_release"
-      ? `owlrunkit adopt --workspace . --exact ${PACKAGE_NAME}@${EXPECTED_VERSION}`
+      ? `npx --no-install owlrunkit adopt --workspace . --exact ${PACKAGE_NAME}@${EXPECTED_VERSION}`
       : report.nextAllowedAction}`,
     ...(report.maintenanceNextAction
       ? [`Maintenance: ${report.maintenanceNextAction}`]