owlrunkit 0.18.3 → 0.19.0

package/packages/attest/src/workspace-snapshot.mjs

@@ -1,10 +1,12 @@
 import { execFileSync } from "node:child_process";
-import { lstatSync, readFileSync, readlinkSync, realpathSync } from "node:fs";
+import { lstatSync, readFileSync, readdirSync, readlinkSync, realpathSync } from "node:fs";
 import path from "node:path";
 
 import { sha256Bytes, sha256Canonical } from "./formal.mjs";
 
 const CONTROL_ROOT = ".owlcoda/runkit";
+const MAX_BOUND_IGNORED_FILES = 10_000;
+const MAX_BOUND_IGNORED_BYTES = 512 * 1024 * 1024;
 const LOCKFILE_NAMES = new Set([
   "bun.lock",
   "bun.lockb",
@@ -76,7 +78,16 @@ function parseStatus(root) {
     if (!field) continue;
     const status = field.slice(0, 2);
     const currentPath = normalizePath(field.slice(3));
-    if (status.includes("R") || status.includes("C")) index += 1;
+    let priorPath = null;
+    if (status.includes("R") || status.includes("C")) {
+      const prior = fields[index + 1];
+      if (!prior) throw new Error("Git status rename entry is incomplete.");
+      priorPath = normalizePath(prior);
+      index += 1;
+    }
+    if (status.includes("R") && priorPath && !isControlPath(priorPath)) {
+      entries.set(priorPath, { path: priorPath, state: "deleted", sha256: null });
+    }
     if (!currentPath || isControlPath(currentPath)) continue;
     let state = "modified";
     if (status === "??") state = "untracked";
@@ -148,12 +159,117 @@ function trackedTreeIdentity(root, headCommit) {
   });
 }
 
-export function captureWorkspaceSnapshot(workspaceRoot) {
+function safeIgnoredPath(value) {
+  if (typeof value !== "string" || value.length === 0 || path.isAbsolute(value)) return false;
+  if (value.includes("\\") || value.includes("\0")) return false;
+  const segments = value.split("/");
+  return segments.every(segment => segment.length > 0 && segment !== "." && segment !== "..")
+    && !isControlPath(value);
+}
+
+function withinRoot(root, candidate) {
+  const relative = path.relative(root, candidate);
+  return relative === ""
+    || (relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative));
+}
+
+function assertIgnoredByGit(root, relativePath) {
+  const tracked = git(root, ["ls-files", "-z", "--", relativePath]);
+  if (tracked.length > 0) {
+    throw new Error(`Explicit ignored binding cannot replace tracked source binding: ${relativePath}`);
+  }
+  try {
+    git(root, ["check-ignore", "--no-index", "-q", "--", relativePath]);
+  } catch {
+    throw new Error(`Explicit ignored binding is not covered by Git ignore rules: ${relativePath}`);
+  }
+}
+
+function hashIgnoredTree(root, relativePath, budget) {
+  const absolute = path.resolve(root, ...relativePath.split("/"));
+  if (!withinRoot(root, absolute)) throw new Error(`Ignored binding escapes workspace: ${relativePath}`);
+  let stat;
+  try {
+    stat = lstatSync(absolute);
+  } catch (error) {
+    if (error?.code === "ENOENT") return { path: relativePath, state: "missing", sha256: null };
+    throw error;
+  }
+  if (stat.isSymbolicLink() || realpathSync(absolute) !== absolute) {
+    throw new Error(`Ignored binding cannot traverse a symlink: ${relativePath}`);
+  }
+  if (stat.isFile()) {
+    budget.files += 1;
+    budget.bytes += stat.size;
+    if (budget.files > MAX_BOUND_IGNORED_FILES || budget.bytes > MAX_BOUND_IGNORED_BYTES) {
+      throw new Error("Explicit ignored binding exceeds the bounded file or byte limit.");
+    }
+    return { path: relativePath, state: "file", sha256: sha256Bytes(readFileSync(absolute)) };
+  }
+  if (!stat.isDirectory()) {
+    throw new Error(`Ignored binding must be a regular file, directory, or missing path: ${relativePath}`);
+  }
+  const files = [];
+  const visit = (directory, prefix) => {
+    for (const name of readdirSync(directory).sort((left, right) => left.localeCompare(right, "en"))) {
+      const child = path.join(directory, name);
+      const childRelative = prefix ? `${prefix}/${name}` : name;
+      const childStat = lstatSync(child);
+      if (childStat.isSymbolicLink() || realpathSync(child) !== child) {
+        throw new Error(`Ignored binding cannot traverse a symlink: ${relativePath}/${childRelative}`);
+      }
+      if (childStat.isDirectory()) {
+        visit(child, childRelative);
+      } else if (childStat.isFile()) {
+        budget.files += 1;
+        budget.bytes += childStat.size;
+        if (budget.files > MAX_BOUND_IGNORED_FILES || budget.bytes > MAX_BOUND_IGNORED_BYTES) {
+          throw new Error("Explicit ignored binding exceeds the bounded file or byte limit.");
+        }
+        files.push({ path: childRelative, sha256: sha256Bytes(readFileSync(child)) });
+      } else {
+        throw new Error(`Ignored binding contains a special file: ${relativePath}/${childRelative}`);
+      }
+    }
+  };
+  visit(absolute, "");
+  return { path: relativePath, state: "directory", sha256: sha256Canonical(files) };
+}
+
+function bindIgnoredPaths(root, requestedPaths) {
+  if (!Array.isArray(requestedPaths)
+    || requestedPaths.length === 0
+    || requestedPaths.some(value => !safeIgnoredPath(value))) {
+    throw new Error("Explicit ignored bindings must be safe literal workspace-relative paths.");
+  }
+  const paths = [...new Set(requestedPaths)].sort((left, right) => left.localeCompare(right, "en"));
+  if (paths.length !== requestedPaths.length) {
+    throw new Error("Explicit ignored bindings must not contain duplicates.");
+  }
+  const budget = { files: 0, bytes: 0 };
+  return paths.map(relativePath => {
+    assertIgnoredByGit(root, relativePath);
+    return hashIgnoredTree(root, relativePath, budget);
+  });
+}
+
+export function workspaceSourceStateFingerprint(snapshot) {
+  return sha256Canonical({
+    repositoryIdentity: snapshot.repositoryIdentity,
+    headCommit: snapshot.headCommit,
+    trackedTreeIdentity: snapshot.trackedTreeIdentity,
+    submodules: snapshot.submodules,
+    dirtyOverlay: snapshot.dirtyOverlay,
+    dependencyLockfiles: snapshot.dependencyLockfiles,
+    excludedRoots: snapshot.excludedRoots,
+  });
+}
+
+export function captureWorkspaceSnapshot(workspaceRoot, { ignoredPaths = [] } = {}) {
   const root = realpathSync(workspaceRoot);
   git(root, ["rev-parse", "--is-inside-work-tree"]);
   const headCommit = optionalGit(root, ["rev-parse", "HEAD"]) || null;
-  const payload = {
-    schemaVersion: "OwlCodaWorkspaceSnapshotV1",
+  const base = {
     repositoryIdentity: repositoryIdentity(root),
     headCommit,
     trackedTreeIdentity: trackedTreeIdentity(root, headCommit),
@@ -161,8 +277,28 @@ export function captureWorkspaceSnapshot(workspaceRoot) {
     dirtyOverlay: parseStatus(root),
     dependencyLockfiles: dependencyLockfiles(root),
     excludedRoots: [CONTROL_ROOT],
-    ignoredPathsBound: false,
-    policyVersion: "workspace-snapshot-v1",
+  };
+  if (ignoredPaths.length === 0) {
+    const payload = {
+      schemaVersion: "OwlCodaWorkspaceSnapshotV1",
+      ...base,
+      ignoredPathsBound: false,
+      policyVersion: "workspace-snapshot-v1",
+    };
+    return {
+      ...payload,
+      sourceFingerprint: sha256Canonical(payload),
+    };
+  }
+  const ignoredPathBindings = bindIgnoredPaths(root, ignoredPaths);
+  const payload = {
+    schemaVersion: "OwlCodaWorkspaceSnapshotV2",
+    ...base,
+    ignoredPathsBound: true,
+    ignoredPathBindings,
+    ignoredPathsFingerprint: sha256Canonical(ignoredPathBindings),
+    sourceStateFingerprint: workspaceSourceStateFingerprint(base),
+    policyVersion: "workspace-snapshot-v2",
   };
   return {
     ...payload,

package/registry-release-policy-v1.json

@@ -2,7 +2,7 @@
   "schemaVersion": "OwlCodaRunKitRegistryReleasePolicyV1",
   "status": "release_candidate_unpublished",
   "packageName": "owlrunkit",
-  "candidateVersion": "0.18.3",
+  "candidateVersion": "0.19.0",
   "registry": "https://registry.npmjs.org",
   "registryRequiredBeforeAdoption": true,
   "exactVersionRequired": true,
@@ -23,10 +23,10 @@
   ],
   "currentPublishedRelease": {
     "packageName": "owlrunkit",
-    "version": "0.18.2",
-    "shasum": "4a85e31dad306260e4a6b1fcbccb3807e8647a0a",
-    "integrity": "sha512-Clpr8UQdNitzMMmQHUtjs9mesmukUqZrQ5nrda+Ryo8SuvECH8eBiis378NnzV1lI79kmljv49ToRRe867zlBg==",
-    "tarballUrl": "https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.18.2.tgz"
+    "version": "0.18.4",
+    "shasum": "8f2ef01da287b76b545eeebd6973bc40449dd302",
+    "integrity": "sha512-L3cFuJnU39p/EhgrRaJbEIB7gTRFxKzEpNmANw3kwNFrTe9Fe8wtwgdFOBXldX6xCJY+W44/8cw4P/dtAxiCAA==",
+    "tarballUrl": "https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.18.4.tgz"
   },
   "registryRelease": null,
   "registryEvidenceMustBeExternal": true,

package/sbom.spdx.json

@@ -2,8 +2,8 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "owlrunkit-0.18.3",
-  "documentNamespace": "https://owlcoda.com/spdx/owlrunkit/0.18.3",
+  "name": "owlrunkit-0.19.0",
+  "documentNamespace": "https://owlcoda.com/spdx/owlrunkit/0.19.0",
   "creationInfo": {
     "created": "2026-07-29T00:00:00Z",
     "creators": [
@@ -14,8 +14,8 @@
     {
       "name": "owlrunkit",
       "SPDXID": "SPDXRef-Package-OwlRunKit",
-      "versionInfo": "0.18.3",
-      "downloadLocation": "https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.18.3.tgz",
+      "versionInfo": "0.19.0",
+      "downloadLocation": "https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.19.0.tgz",
       "filesAnalyzed": false,
       "licenseConcluded": "GPL-3.0-or-later",
       "licenseDeclared": "GPL-3.0-or-later",
@@ -24,7 +24,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/owlrunkit@0.18.3"
+          "referenceLocator": "pkg:npm/owlrunkit@0.19.0"
         }
       ]
     }

package/scripts/runkit-contract/assurance-router.mjs

@@ -56,9 +56,9 @@ function incompleteReasons(input) {
   return [...new Set(reasons)].sort();
 }
 
-function result({ lane, riskMode, reasonCodes, nextCommand }) {
+function result({ schemaVersion, lane, riskMode, reasonCodes, nextCommand }) {
   return {
-    schemaVersion: "OwlCodaRunKitAssuranceRouteV1",
+    schemaVersion,
     status: "routed",
     lane,
     riskMode,
@@ -68,14 +68,15 @@ function result({ lane, riskMode, reasonCodes, nextCommand }) {
   };
 }
 
-export function routeRunKitAssuranceV1(input) {
+function routeRunKitAssurance(input, { schemaVersion, commandPrefix }) {
   const incomplete = incompleteReasons(input);
   if (incomplete.length > 0) {
     return result({
+      schemaVersion,
       lane: "formal",
       riskMode: "full",
       reasonCodes: ["assurance_input_incomplete", ...incomplete],
-      nextCommand: "owlrunkit formal start",
+      nextCommand: `${commandPrefix} formal start`,
     });
   }
 
@@ -95,15 +96,17 @@ export function routeRunKitAssuranceV1(input) {
   ];
   if (formalReasons.length > 0) {
     return result({
+      schemaVersion,
       lane: "formal",
       riskMode: "full",
       reasonCodes: [...new Set(formalReasons)].sort(),
-      nextCommand: "owlrunkit formal start",
+      nextCommand: `${commandPrefix} formal start`,
     });
   }
 
   if (!input.needsDurableEvidence) {
     return result({
+      schemaVersion,
       lane: "none",
       riskMode: "lightweight",
       reasonCodes: ["durable_evidence_not_required"],
@@ -113,6 +116,7 @@ export function routeRunKitAssuranceV1(input) {
 
   if (input.exactCommandCount !== 1) {
     return result({
+      schemaVersion,
       lane: "none",
       riskMode: "lightweight",
       reasonCodes: ["quick_exact_command_required"],
@@ -121,9 +125,24 @@ export function routeRunKitAssuranceV1(input) {
   }
 
   return result({
+    schemaVersion,
     lane: "quick",
     riskMode: "lightweight",
     reasonCodes: ["single_bounded_verification"],
-    nextCommand: "owlrunkit quick-verify",
+    nextCommand: `${commandPrefix} quick-verify`,
+  });
+}
+
+export function routeRunKitAssuranceV1(input) {
+  return routeRunKitAssurance(input, {
+    schemaVersion: "OwlCodaRunKitAssuranceRouteV1",
+    commandPrefix: "owlrunkit",
+  });
+}
+
+export function routeRunKitAssuranceV2(input) {
+  return routeRunKitAssurance(input, {
+    schemaVersion: "OwlCodaRunKitAssuranceRouteV2",
+    commandPrefix: "npx --no-install owlrunkit",
   });
 }

package/scripts/runkit-contract/core-contract.mjs

@@ -14,7 +14,7 @@ import { fileURLToPath } from "node:url";
 import { parseProjectControlState } from "./project-control-parser.mjs";
 
 export const CONTRACT_VERSION = "0.2";
-export const CORE_VERSION = "0.18.3";
+export const CORE_VERSION = "0.19.0";
 export const RUNTIME_ROOT = ".owlcoda/runkit";
 
 const CORE_FILES = [
@@ -26,6 +26,7 @@ const CORE_FILES = [
   "delivery-create.mjs",
   "delivery-selection.mjs",
   "deployment-workflow.mjs",
+  "efficiency-metrics.mjs",
   "fleet-discovery.mjs",
   "finalize.mjs",
   "formal-workflow.mjs",
@@ -35,7 +36,9 @@ const CORE_FILES = [
   "lease-lifecycle.mjs",
   "lifecycle-orchestration.mjs",
   "offline-store.mjs",
+  "outcome-presentation.mjs",
   "onboarding-doctor.mjs",
+  "onboarding-bootstrap.mjs",
   "owner-authority-trust.mjs",
   "owner-deployment-decision.mjs",
   "profile-impact.mjs",
@@ -43,11 +46,16 @@ const CORE_FILES = [
   "project-cli-resolver.mjs",
   "project-control-parser.mjs",
   "project-control-state.mjs",
+  "project-external-delivery.mjs",
   "provenance-common.mjs",
   "quick-attest.mjs",
   "quick-canonical.mjs",
+  "quick-isolation.mjs",
   "quick-metrics.mjs",
   "quick-receipt.mjs",
+  "quick-evidence-reuse.mjs",
+  "evidence-store.mjs",
+  "runtime-transition.mjs",
   "quick-verify.mjs",
   "quick-workspace-snapshot.mjs",
   "ready-for-commit.mjs",
@@ -76,6 +84,7 @@ const CORE_FILES = [
   "verification-plan.mjs",
   "visual-smoke.mjs",
   "schemas/assurance-route-v1.schema.json",
+  "schemas/assurance-route-v2.schema.json",
   "schemas/closeout-receipt-v2.schema.json",
   "schemas/adoption-evidence-v1.schema.json",
   "schemas/coverage-adopt-request-v1.schema.json",
@@ -87,6 +96,8 @@ const CORE_FILES = [
   "schemas/deployment-execute-request-v1.schema.json",
   "schemas/deployment-lineage-v1.schema.json",
   "schemas/deployment-prepare-receipt-v1.schema.json",
+  "schemas/efficiency-event-v1.schema.json",
+  "schemas/efficiency-metrics-v1.schema.json",
   "schemas/engine-pin.schema.json",
   "schemas/engine-pin-v2.schema.json",
   "schemas/evidence-coverage-index-v1.schema.json",
@@ -94,6 +105,9 @@ const CORE_FILES = [
   "schemas/fleet-manifest-v1.schema.json",
   "schemas/fleet-root-registry-v1.schema.json",
   "schemas/human-status-v1.schema.json",
+  "schemas/onboarding-bootstrap-plan-v1.schema.json",
+  "schemas/onboarding-bootstrap-receipt-v1.schema.json",
+  "schemas/outcome-summary-v1.schema.json",
   "schemas/owner-authority-trust-v1.schema.json",
   "schemas/owner-migration-authority-v1.schema.json",
   "schemas/owner-migration-authority-v2.schema.json",
@@ -102,6 +116,7 @@ const CORE_FILES = [
   "schemas/owner-deployment-decision-v1.schema.json",
   "schemas/profile-apply-receipt-v1.schema.json",
   "schemas/profile-detection-v2.schema.json",
+  "schemas/profile-detection-v3.schema.json",
   "schemas/profile-reconcile-plan-v1.schema.json",
   "schemas/profile-reconcile-receipt-v1.schema.json",
   "schemas/project-config.schema.json",
@@ -119,6 +134,10 @@ const CORE_FILES = [
   "schemas/finalize-request-v1.schema.json",
   "schemas/ready-for-commit-v1.schema.json",
   "schemas/ready-for-commit-v2.schema.json",
+  "schemas/quick-evidence-reuse-plan-v1.schema.json",
+  "schemas/quick-evidence-reuse-receipt-v1.schema.json",
+  "schemas/external-runtime-report-v1.schema.json",
+  "schemas/runtime-transition-receipt-v1.schema.json",
   "schemas/snapshot-v1.schema.json",
   "schemas/source-candidate-v2.schema.json",
   "schemas/visual-smoke-request-v1.schema.json",
@@ -127,9 +146,13 @@ const CORE_FILES = [
   "schemas/team-project-definition-v1.schema.json",
   "schemas/team-project-event-v1.schema.json",
   "schemas/team-project-event-v2.schema.json",
+  "schemas/team-project-event-v3.schema.json",
+  "schemas/team-project-event-v4.schema.json",
   "schemas/team-project-successor-receipt-v1.schema.json",
   "schemas/team-project-status-v1.schema.json",
+  "schemas/team-project-status-v2.schema.json",
   "schemas/usage-mode-recommendation-v1.schema.json",
+  "schemas/usage-mode-recommendation-v2.schema.json",
   "schemas/verification-envelope-v1.schema.json",
   "schemas/verification-finalize-attempt-v1.schema.json",
   "schemas/verification-preflight-v1.schema.json",
@@ -161,10 +184,15 @@ const CORE_FILES = [
 ];
 
 const CORE_DEPENDENCY_FILES = [
+  "packages/attest/src/dependency-environment.mjs",
+  "packages/attest/schemas/workspace-snapshot-v1.schema.json",
+  "packages/attest/schemas/workspace-snapshot-v2.schema.json",
+  "packages/attest/schemas/quick-verification-receipt-v3.schema.json",
   "packages/attest/src/formal.mjs",
   "packages/attest/src/offline-bundle.mjs",
   "packages/attest/src/quick-receipt-contract.mjs",
   "packages/attest/src/reference-contract.mjs",
+  "packages/attest/src/workspace-snapshot.mjs",
 ];
 
 function sha256(value) {