owlrunkit 0.18.3 → 0.18.4

package/scripts/runkit-contract/assurance-router.mjs

@@ -56,9 +56,9 @@ function incompleteReasons(input) {
   return [...new Set(reasons)].sort();
 }
 
-function result({ lane, riskMode, reasonCodes, nextCommand }) {
+function result({ schemaVersion, lane, riskMode, reasonCodes, nextCommand }) {
   return {
-    schemaVersion: "OwlCodaRunKitAssuranceRouteV1",
+    schemaVersion,
     status: "routed",
     lane,
     riskMode,
@@ -68,14 +68,15 @@ function result({ lane, riskMode, reasonCodes, nextCommand }) {
   };
 }
 
-export function routeRunKitAssuranceV1(input) {
+function routeRunKitAssurance(input, { schemaVersion, commandPrefix }) {
   const incomplete = incompleteReasons(input);
   if (incomplete.length > 0) {
     return result({
+      schemaVersion,
       lane: "formal",
       riskMode: "full",
       reasonCodes: ["assurance_input_incomplete", ...incomplete],
-      nextCommand: "owlrunkit formal start",
+      nextCommand: `${commandPrefix} formal start`,
     });
   }
 
@@ -95,15 +96,17 @@ export function routeRunKitAssuranceV1(input) {
   ];
   if (formalReasons.length > 0) {
     return result({
+      schemaVersion,
       lane: "formal",
       riskMode: "full",
       reasonCodes: [...new Set(formalReasons)].sort(),
-      nextCommand: "owlrunkit formal start",
+      nextCommand: `${commandPrefix} formal start`,
     });
   }
 
   if (!input.needsDurableEvidence) {
     return result({
+      schemaVersion,
       lane: "none",
       riskMode: "lightweight",
       reasonCodes: ["durable_evidence_not_required"],
@@ -113,6 +116,7 @@ export function routeRunKitAssuranceV1(input) {
 
   if (input.exactCommandCount !== 1) {
     return result({
+      schemaVersion,
       lane: "none",
       riskMode: "lightweight",
       reasonCodes: ["quick_exact_command_required"],
@@ -121,9 +125,24 @@ export function routeRunKitAssuranceV1(input) {
   }
 
   return result({
+    schemaVersion,
     lane: "quick",
     riskMode: "lightweight",
     reasonCodes: ["single_bounded_verification"],
-    nextCommand: "owlrunkit quick-verify",
+    nextCommand: `${commandPrefix} quick-verify`,
+  });
+}
+
+export function routeRunKitAssuranceV1(input) {
+  return routeRunKitAssurance(input, {
+    schemaVersion: "OwlCodaRunKitAssuranceRouteV1",
+    commandPrefix: "owlrunkit",
+  });
+}
+
+export function routeRunKitAssuranceV2(input) {
+  return routeRunKitAssurance(input, {
+    schemaVersion: "OwlCodaRunKitAssuranceRouteV2",
+    commandPrefix: "npx --no-install owlrunkit",
   });
 }

package/scripts/runkit-contract/core-contract.mjs

@@ -14,7 +14,7 @@ import { fileURLToPath } from "node:url";
 import { parseProjectControlState } from "./project-control-parser.mjs";
 
 export const CONTRACT_VERSION = "0.2";
-export const CORE_VERSION = "0.18.3";
+export const CORE_VERSION = "0.18.4";
 export const RUNTIME_ROOT = ".owlcoda/runkit";
 
 const CORE_FILES = [
@@ -43,6 +43,7 @@ const CORE_FILES = [
   "project-cli-resolver.mjs",
   "project-control-parser.mjs",
   "project-control-state.mjs",
+  "project-external-delivery.mjs",
   "provenance-common.mjs",
   "quick-attest.mjs",
   "quick-canonical.mjs",
@@ -76,6 +77,7 @@ const CORE_FILES = [
   "verification-plan.mjs",
   "visual-smoke.mjs",
   "schemas/assurance-route-v1.schema.json",
+  "schemas/assurance-route-v2.schema.json",
   "schemas/closeout-receipt-v2.schema.json",
   "schemas/adoption-evidence-v1.schema.json",
   "schemas/coverage-adopt-request-v1.schema.json",
@@ -102,6 +104,7 @@ const CORE_FILES = [
   "schemas/owner-deployment-decision-v1.schema.json",
   "schemas/profile-apply-receipt-v1.schema.json",
   "schemas/profile-detection-v2.schema.json",
+  "schemas/profile-detection-v3.schema.json",
   "schemas/profile-reconcile-plan-v1.schema.json",
   "schemas/profile-reconcile-receipt-v1.schema.json",
   "schemas/project-config.schema.json",
@@ -127,9 +130,12 @@ const CORE_FILES = [
   "schemas/team-project-definition-v1.schema.json",
   "schemas/team-project-event-v1.schema.json",
   "schemas/team-project-event-v2.schema.json",
+  "schemas/team-project-event-v3.schema.json",
   "schemas/team-project-successor-receipt-v1.schema.json",
   "schemas/team-project-status-v1.schema.json",
+  "schemas/team-project-status-v2.schema.json",
   "schemas/usage-mode-recommendation-v1.schema.json",
+  "schemas/usage-mode-recommendation-v2.schema.json",
   "schemas/verification-envelope-v1.schema.json",
   "schemas/verification-finalize-attempt-v1.schema.json",
   "schemas/verification-preflight-v1.schema.json",
@@ -161,10 +167,12 @@ const CORE_FILES = [
 ];
 
 const CORE_DEPENDENCY_FILES = [
+  "packages/attest/schemas/workspace-snapshot-v1.schema.json",
   "packages/attest/src/formal.mjs",
   "packages/attest/src/offline-bundle.mjs",
   "packages/attest/src/quick-receipt-contract.mjs",
   "packages/attest/src/reference-contract.mjs",
+  "packages/attest/src/workspace-snapshot.mjs",
 ];
 
 function sha256(value) {

package/scripts/runkit-contract/onboarding-doctor.mjs

@@ -818,7 +818,7 @@ export function formatDoctorHuman(report) {
       : []),
     ...(otherWarnings.length > 0 ? [`Warnings: ${otherWarnings.join(", ")}`] : []),
     `Next: ${report.nextAllowedAction === "adopt_current_release"
-      ? `owlrunkit adopt --workspace . --exact ${PACKAGE_NAME}@${EXPECTED_VERSION}`
+      ? `npx --no-install owlrunkit adopt --workspace . --exact ${PACKAGE_NAME}@${EXPECTED_VERSION}`
       : report.nextAllowedAction}`,
     ...(report.maintenanceNextAction
       ? [`Maintenance: ${report.maintenanceNextAction}`]

package/scripts/runkit-contract/profile-onboarding.mjs

@@ -1,3 +1,4 @@
+import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import {
   existsSync,
@@ -765,7 +766,7 @@ function bindCommandsToProjectTool(profiles, toolBinding) {
   }));
 }
 
-function proposedProfileDocument(candidates, inputManifest) {
+function proposedProfileDocument(candidates, inputManifest, detectedSurfacePaths = []) {
   const actionable = candidates.filter(profile => profile.commands.length > 0);
   const selectedPrimary = actionable.find(profile => profile.id === "node-quality")
     ?? actionable[0]
@@ -779,13 +780,162 @@ function proposedProfileDocument(candidates, inputManifest) {
       ...profile,
       paths: [...new Set([
         ...profile.paths,
-        ...(profile.id === selectedPrimary?.id ? rootSurfacePaths : []),
+        ...(profile.id === selectedPrimary?.id
+          ? [...rootSurfacePaths, ...detectedSurfacePaths]
+          : []),
       ])].sort(),
       primary: profile.id === selectedPrimary?.id,
     })),
   };
 }
 
+function visibleGitChangedPaths(root) {
+  try {
+    const gitRoot = realpathSync(execFileSync(
+      "git",
+      ["rev-parse", "--show-toplevel"],
+      {
+        cwd: root,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"],
+        env: { ...process.env, GIT_OPTIONAL_LOCKS: "0" },
+      },
+    ).trim());
+    const workspacePrefix = path.relative(gitRoot, root).split(path.sep).join("/");
+    if (workspacePrefix.startsWith("../") || workspacePrefix === "..") {
+      return { paths: [], issueCodes: ["profile_git_root_unusable"] };
+    }
+    const normalizeGitPath = (filePath) => {
+      const normalized = filePath.split(path.sep).join("/");
+      if (!workspacePrefix) return normalized;
+      const prefix = `${workspacePrefix}/`;
+      return normalized.startsWith(prefix) ? normalized.slice(prefix.length) : null;
+    };
+    const raw = execFileSync(
+      "git",
+      ["status", "--porcelain=v1", "-z", "--untracked-files=all", "--", "."],
+      {
+        cwd: root,
+        encoding: "utf8",
+        maxBuffer: 64 * 1024 * 1024,
+        stdio: ["ignore", "pipe", "pipe"],
+        env: { ...process.env, GIT_OPTIONAL_LOCKS: "0" },
+      },
+    );
+    const fields = raw.split("\0");
+    const paths = [];
+    for (let index = 0; index < fields.length; index += 1) {
+      const field = fields[index];
+      if (!field) continue;
+      const status = field.slice(0, 2);
+      const currentPath = normalizeGitPath(field.slice(3));
+      let priorPath = null;
+      if (status.includes("R") || status.includes("C")) {
+        const prior = fields[index + 1];
+        if (!prior) return { paths: [], issueCodes: ["profile_git_status_unusable"] };
+        priorPath = normalizeGitPath(prior);
+        index += 1;
+      }
+      if (currentPath === null || (status.includes("R") && priorPath === null)) {
+        return { paths: [], issueCodes: ["profile_git_path_outside_workspace"] };
+      }
+      const changedPaths = status.includes("R") ? [currentPath, priorPath] : [currentPath];
+      for (const filePath of changedPaths) {
+        if (!filePath
+          || filePath === ".owlcoda/runkit"
+          || filePath.startsWith(".owlcoda/runkit/")) continue;
+        try {
+          safeRelativePath(filePath, "profile changed path");
+          paths.push(filePath);
+        } catch {
+          return { paths: [], issueCodes: ["profile_changed_path_unusable"] };
+        }
+      }
+    }
+    return { paths: [...new Set(paths)].sort(), issueCodes: [] };
+  } catch {
+    return { paths: [], issueCodes: ["profile_git_status_unavailable"] };
+  }
+}
+
+function sourceCandidatePath(filePath) {
+  const segments = filePath.split("/");
+  const nonSourceSegments = new Set([
+    ".cache",
+    ".mypy_cache",
+    ".pytest_cache",
+    ".ruff_cache",
+    ".turbo",
+    ".vite",
+    ".vitest",
+    "__pycache__",
+    "node_modules",
+  ]);
+  if (segments.some(segment => nonSourceSegments.has(segment))) return false;
+  if ([".github", ".owlcoda", "docs"].includes(segments[0])) return false;
+  return !/\.(?:md|mdx|rst|txt)$/iu.test(filePath);
+}
+
+function shellQuote(value) {
+  return `'${String(value).replaceAll("'", `'"'"'`)}'`;
+}
+
+function profileCoveragePlan({ root, proposedProfiles, currentProfilesSha256 }) {
+  const changed = visibleGitChangedPaths(root);
+  const impact = resolveProfileImpactDetailed({
+    changedPaths: changed.paths,
+    profiles: proposedProfiles.profiles,
+  });
+  const uncoveredChangedPaths = [...impact.uncoveredPaths];
+  const uncoveredSourcePaths = uncoveredChangedPaths.filter(sourceCandidatePath);
+  const selectedPrimary = proposedProfiles.profiles.find(profile => profile.primary) ?? null;
+  const primaryBlockers = [];
+  if (selectedPrimary === null) primaryBlockers.push("actionable_primary_profile_missing");
+  if (uncoveredSourcePaths.length > 0) {
+    primaryBlockers.push(
+      `candidate_paths_do_not_cover_changed_source:${uncoveredSourcePaths.join(",")}`,
+    );
+  }
+  const minimalSuggestedProfile = selectedPrimary && uncoveredSourcePaths.length > 0
+    ? {
+        ...structuredClone(selectedPrimary),
+        paths: [...new Set([
+          ...selectedPrimary.paths,
+          ...uncoveredSourcePaths,
+        ])].sort(),
+        primary: true,
+      }
+    : null;
+  const repairedProfiles = minimalSuggestedProfile
+    ? {
+        ...structuredClone(proposedProfiles),
+        profiles: proposedProfiles.profiles.map(profile => (
+          profile.id === minimalSuggestedProfile.id
+            ? structuredClone(minimalSuggestedProfile)
+            : structuredClone(profile)
+        )),
+      }
+    : proposedProfiles;
+  const command = currentProfilesSha256 === null ? "detect" : "reconcile";
+  const workspace = shellQuote(root);
+  return {
+    status: primaryBlockers.length > 0 ? "profiles_insufficient" : "profiles_detected",
+    proposedProfiles: repairedProfiles,
+    changedPaths: changed.paths,
+    uncoveredChangedPaths,
+    uncoveredSourcePaths,
+    primaryBlockers: [...new Set(primaryBlockers)].sort(),
+    minimalSuggestedProfile,
+    repairCommands: {
+      preview: `npx --no-install owlrunkit profiles ${command} --workspace ${workspace} --dry-run`,
+      apply: minimalSuggestedProfile || primaryBlockers.length === 0
+        ? `npx --no-install owlrunkit profiles ${command} --workspace ${workspace} --apply`
+        : null,
+    },
+    issueCodes: changed.issueCodes,
+  };
+}
+
 function profilesFileHash(root) {
   const ref = path.join(root, ".owlcoda", "runkit", "profiles.json");
   if (!existsSync(ref)) return null;
@@ -944,10 +1094,10 @@ function recoverProfileApplyTransaction({
   return receipt;
 }
 
-export function detectProfilesV2({
+function detectProfilesVersion({
   workspaceRoot,
   projectToolResolver,
-} = {}) {
+} = {}, { schemaVersion, includeCoverage }) {
   const root = resolveBoundedWorkspaceRoot(workspaceRoot);
   const manifest = readWorkspaceJsonBounded(root, "package.json");
   const discovered = discoverWorkspaces(root, manifest);
@@ -960,6 +1110,23 @@ export function detectProfilesV2({
     toolBinding.packageManager,
     true,
   );
+  const detectedSurfacePaths = includeCoverage
+    ? (() => {
+        const candidateSurfacePaths = new Set(
+          rawCandidates.flatMap(profile => profile.paths),
+        );
+        return profileCandidates(
+          root,
+          manifest,
+          toolBinding.executable,
+          discovered.workspaces,
+          toolBinding.packageManager,
+          true,
+          true,
+        ).flatMap(profile => profile.paths)
+          .filter(profilePath => !candidateSurfacePaths.has(profilePath));
+      })()
+    : [];
   const candidates = bindCommandsToProjectTool(rawCandidates, toolBinding);
   let inputManifest = [];
   const issueCodes = [
@@ -971,21 +1138,44 @@ export function detectProfilesV2({
   } catch (error) {
     issueCodes.push(error instanceof Error ? error.message : String(error));
   }
-  const proposedProfiles = proposedProfileDocument(candidates, inputManifest);
+  const initialProfiles = proposedProfileDocument(
+    candidates,
+    inputManifest,
+    detectedSurfacePaths,
+  );
+  const currentProfilesSha256 = profilesFileHash(root);
+  const coverage = includeCoverage
+    ? profileCoveragePlan({
+        root,
+        proposedProfiles: initialProfiles,
+        currentProfilesSha256,
+      })
+    : {
+        status: "profiles_detected",
+        proposedProfiles: initialProfiles,
+        changedPaths: [],
+        uncoveredChangedPaths: [],
+        uncoveredSourcePaths: [],
+        primaryBlockers: [],
+        minimalSuggestedProfile: null,
+        repairCommands: null,
+        issueCodes: [],
+      };
+  const proposedProfiles = coverage.proposedProfiles;
+  issueCodes.push(...coverage.issueCodes);
   issueCodes.push(...validateProfileDocument(proposedProfiles));
   const qualityIssues = [...new Set(issueCodes)].sort();
   const confidence = qualityIssues.length === 0 && toolBinding.confidence === "high"
     ? "high"
     : "review_required";
-  const currentProfilesSha256 = profilesFileHash(root);
   const applyStatus = currentProfilesSha256 !== null
     ? "profiles_already_exists"
     : confidence === "high"
       ? "ready_to_apply"
       : "review_required";
   const body = {
-    schemaVersion: "OwlCodaRunKitProfileDetectionV2",
-    status: "profiles_detected",
+    schemaVersion,
+    status: coverage.status,
     dryRun: true,
     writesPerformed: 0,
     confidence,
@@ -1009,6 +1199,16 @@ export function detectProfilesV2({
     currentProfilesSha256,
     detectedScripts: detectedScripts(manifest),
     detectedWorkspaces: discovered.workspaces,
+    ...(includeCoverage
+      ? {
+          changedPaths: coverage.changedPaths,
+          uncoveredChangedPaths: coverage.uncoveredChangedPaths,
+          uncoveredSourcePaths: coverage.uncoveredSourcePaths,
+          primaryBlockers: coverage.primaryBlockers,
+          minimalSuggestedProfile: coverage.minimalSuggestedProfile,
+          repairCommands: coverage.repairCommands,
+        }
+      : {}),
     authorizationGranted: false,
   };
   return {
@@ -1017,6 +1217,20 @@ export function detectProfilesV2({
   };
 }
 
+export function detectProfilesV2(input = {}) {
+  return detectProfilesVersion(input, {
+    schemaVersion: "OwlCodaRunKitProfileDetectionV2",
+    includeCoverage: false,
+  });
+}
+
+export function detectProfilesV3(input = {}) {
+  return detectProfilesVersion(input, {
+    schemaVersion: "OwlCodaRunKitProfileDetectionV3",
+    includeCoverage: true,
+  });
+}
+
 function blockedApply(detection, issueCodes, currentProfilesSha256 = null) {
   return {
     schemaVersion: "OwlCodaRunKitProfilesApplyReceiptV1",
@@ -1032,13 +1246,19 @@ function blockedApply(detection, issueCodes, currentProfilesSha256 = null) {
 function verifyDetectionInputs(
   root,
   detection,
-  { allowedApplyStatuses = ["ready_to_apply"] } = {},
+  {
+    allowedApplyStatuses = ["ready_to_apply"],
+    schemaVersion = "OwlCodaRunKitProfileDetectionV2",
+    checkChangedPaths = false,
+  } = {},
 ) {
   const issues = [];
   const { detectionSha256, ...body } = detection;
   if (
-    detection.schemaVersion !== "OwlCodaRunKitProfileDetectionV2"
-    || detection.status !== "profiles_detected"
+    detection.schemaVersion !== schemaVersion
+    || !(schemaVersion === "OwlCodaRunKitProfileDetectionV3"
+      ? ["profiles_detected", "profiles_insufficient"].includes(detection.status)
+      : detection.status === "profiles_detected")
     || !/^[a-f0-9]{64}$/.test(detectionSha256 ?? "")
     || sha256(canonicalJson(body)) !== detectionSha256
   ) {
@@ -1073,13 +1293,22 @@ function verifyDetectionInputs(
       }
     }
   }
+  if (checkChangedPaths) {
+    const currentChangedPaths = visibleGitChangedPaths(root);
+    issues.push(...currentChangedPaths.issueCodes);
+    if (!Array.isArray(detection.changedPaths)) {
+      issues.push("profile_detection_invalid");
+    } else if (canonicalJson(currentChangedPaths.paths) !== canonicalJson(detection.changedPaths)) {
+      issues.push("profile_detection_changed_paths_drift");
+    }
+  }
   return [...new Set(issues)].sort();
 }
 
-export function applyDetectedProfilesV2({
+function applyDetectedProfilesVersion({
   workspaceRoot,
   detection,
-} = {}) {
+} = {}, { schemaVersion, checkChangedPaths }) {
   const root = resolveBoundedWorkspaceRoot(workspaceRoot);
   let currentProfilesSha256;
   try {
@@ -1087,7 +1316,10 @@ export function applyDetectedProfilesV2({
   } catch {
     return blockedApply(detection, ["profile_apply_directory_untrusted"]);
   }
-  const issues = verifyDetectionInputs(root, detection ?? {});
+  const issues = verifyDetectionInputs(root, detection ?? {}, {
+    schemaVersion,
+    checkChangedPaths,
+  });
   if (issues.length > 0) return blockedApply(detection, issues);
 
   const receiptPath = path.join(
@@ -1194,6 +1426,20 @@ export function applyDetectedProfilesV2({
   }
 }
 
+export function applyDetectedProfilesV2(input = {}) {
+  return applyDetectedProfilesVersion(input, {
+    schemaVersion: "OwlCodaRunKitProfileDetectionV2",
+    checkChangedPaths: false,
+  });
+}
+
+export function applyDetectedProfilesV3(input = {}) {
+  return applyDetectedProfilesVersion(input, {
+    schemaVersion: "OwlCodaRunKitProfileDetectionV3",
+    checkChangedPaths: true,
+  });
+}
+
 function mergeDetectedProfiles(currentProfiles, detectedProfiles) {
   const profiles = currentProfiles.profiles.map((profile) => structuredClone(profile));
   const byId = new Map(profiles.map((profile) => [profile.id, profile]));
@@ -1490,9 +1736,11 @@ export function reconcileProfilesV2({
     );
   }
 
-  const detection = detectProfilesV2({ workspaceRoot: root, projectToolResolver });
+  const detection = detectProfilesV3({ workspaceRoot: root, projectToolResolver });
   const detectionIssues = verifyDetectionInputs(root, detection, {
     allowedApplyStatuses: ["profiles_already_exists"],
+    schemaVersion: "OwlCodaRunKitProfileDetectionV3",
+    checkChangedPaths: true,
   });
   if (detection.currentProfilesSha256 !== currentProfilesSha256) {
     detectionIssues.push("profile_reconcile_detection_preimage_mismatch");

package/scripts/runkit-contract/project-cli-resolver.mjs

@@ -18,6 +18,12 @@ const OFFICIAL_CLI_ENTRYPOINT =
 const EXACT_VERSION = /^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?$/;
 const SHA256_REF = /^sha256:[a-f0-9]{64}$/;
 const TRUSTED_PRIOR_CORE_IDENTITIES = new Map([
+  ["0.18.3", new Set([
+    "sha256:cc7a923649592084150828f24f0d90f280af92514bafdbc4999f4015b3175d5c",
+  ])],
+  ["0.18.2", new Set([
+    "sha256:abe17ff794b4019d8d476f09eb5d4105bae1070b1df0aab53e6c94c7ec8b65a6",
+  ])],
   ["0.18.1", new Set([
     "sha256:349b4157d3d089462b172de1619ccd169b5c1669b9322e2580ac6ec4f8616b07",
   ])],