owlrunkit 0.18.4 → 0.19.1

package/scripts/runkit-contract/outcome-presentation.mjs

@@ -0,0 +1,171 @@
+const RUNTIME_LEVEL_BY_DECISION = Object.freeze({
+  external_transition_passed: "reported_passed",
+  external_transition_failed_recovered: "reported_failed_recovered",
+  external_transition_failed_unrecovered: "reported_failed_unrecovered",
+  external_transition_indeterminate: "reported_indeterminate",
+  external_transition_invalidated: "reported_indeterminate",
+});
+
+function verificationLevel(result) {
+  const status = result.quickVerificationStatus ?? result.status;
+  if (status === "quick_verification_passed") return "passed";
+  if (status === "quick_verification_failed") return "failed";
+  if (status === "quick_verification_source_mutated") return "invalidated";
+  return "not_proven";
+}
+
+function workspaceLevel(result) {
+  if (result.mutationDecision === "source_unchanged") return "unchanged";
+  if (typeof result.mutationDecision === "string") return "changed";
+  return "not_proven";
+}
+
+function candidateLevel(result) {
+  if (result.attestationDecision === "NO_GO") return "not_proven";
+  const verification = verificationLevel(result);
+  if (verification === "invalidated" || workspaceLevel(result) === "changed") {
+    return "invalidated";
+  }
+  return typeof result.receiptPath === "string" && workspaceLevel(result) === "unchanged"
+    ? "bound"
+    : "not_proven";
+}
+
+function runtimeLevel(result) {
+  const transition = result.runtimeTransition;
+  if (!transition || transition.status === "runtime_transition_invalid") return "not_proven";
+  return RUNTIME_LEVEL_BY_DECISION[transition.transitionDecision] ?? "reported_indeterminate";
+}
+
+function resultDecision(result) {
+  if (candidateLevel(result) === "invalidated") return "invalidated";
+  if (result.attestationDecision === "NO_GO"
+    || [
+      "quick_verification_control_invalid",
+      "quick_verification_input_invalid",
+      "quick_verification_runtime_truth_invalid",
+    ].includes(result.status)) {
+    return "indeterminate";
+  }
+  const verification = verificationLevel(result);
+  if (verification === "passed") return "pass";
+  if (verification === "failed") return "fail";
+  return "indeterminate";
+}
+
+function headline(result, acceptanceLevels) {
+  const decision = resultDecision(result);
+  if (decision === "invalidated") {
+    return "The verification candidate was invalidated by a workspace or execution-environment change.";
+  }
+  if (decision === "fail") {
+    return "The exact verification command failed for the bound source candidate.";
+  }
+  if (decision === "indeterminate") {
+    return "RunKit did not establish a reusable verification result.";
+  }
+  if (acceptanceLevels.deploymentRuntime === "reported_failed_recovered") {
+    return "Verification passed, and the exact command reported a failed external transition with successful rollback.";
+  }
+  if (acceptanceLevels.deploymentRuntime === "reported_failed_unrecovered") {
+    return "Verification passed, but the exact command reported an unrecovered external transition failure.";
+  }
+  if (acceptanceLevels.deploymentRuntime === "reported_passed") {
+    return "Verification passed, and the exact command reported a successful external transition.";
+  }
+  return "The exact verification command passed for the bound source candidate.";
+}
+
+export function projectQuickOutcomeV1(result) {
+  const acceptanceLevels = {
+    candidateIdentity: candidateLevel(result),
+    workspaceAttestation: workspaceLevel(result),
+    verificationCommand: verificationLevel(result),
+    productExperience: "not_proven",
+    deploymentRuntime: runtimeLevel(result),
+    productionBusiness: "not_proven",
+  };
+  const proven = [];
+  if (acceptanceLevels.candidateIdentity === "bound") {
+    proven.push("Quick evidence binds the exact command to the captured source candidate.");
+  }
+  if (acceptanceLevels.workspaceAttestation === "unchanged") {
+    proven.push("The bound workspace state remained unchanged during the command.");
+  }
+  if (acceptanceLevels.verificationCommand === "passed") {
+    proven.push("The exact verification command exited successfully.");
+  } else if (acceptanceLevels.verificationCommand === "failed") {
+    proven.push("The exact verification command failure was preserved.");
+  }
+  if (result.attestationDecision === "GO") {
+    proven.push("The Quick receipt attestation decision is GO.");
+  }
+  if (acceptanceLevels.deploymentRuntime !== "not_proven") {
+    proven.push("The exact command supplied a bounded external-runtime transition report.");
+  }
+  const notProven = [
+    ...(result.attestationDecision === "NO_GO"
+      ? ["Quick attestation did not establish a reusable candidate binding."]
+      : []),
+    "Product or UX acceptance was not performed by Quick Verification.",
+    ...(acceptanceLevels.deploymentRuntime === "not_proven"
+      ? ["Deployment or runtime activation was not proven."]
+      : ["RunKit did not independently observe the external runtime beyond the exact command report."]),
+    "Production or business effectiveness was not proven.",
+    "No Git, release, deployment, production, or business authority was granted.",
+  ];
+  return {
+    schemaVersion: "OwlCodaRunKitOutcomeSummaryV1",
+    result: resultDecision(result),
+    headline: headline(result, acceptanceLevels),
+    proofLevel: typeof result.receiptPath === "string"
+      ? "captured_verification"
+      : "no_reusable_evidence",
+    acceptanceLevels,
+    proven,
+    notProven,
+    nextAction: typeof result.nextAllowedAction === "string"
+      ? result.nextAllowedAction
+      : "inspect_result",
+    authorizationGranted: false,
+  };
+}
+
+function display(value) {
+  return value.replaceAll("_", " ");
+}
+
+function humanNextAction(nextAction) {
+  if (nextAction.includes(" quick-attest ")) return "Attest this Quick result.";
+  const friendly = {
+    consume_attestation: "Use the attested verification evidence at the next named gate.",
+    inspect_attestation_issues: "Inspect the attestation issues before relying on this result.",
+    inspect_output_and_rerun: "Inspect the failed command output, repair the cause, and rerun.",
+    restore_source_or_run_a_new_quick_verification: "Restore or freeze the intended candidate, then run a new verification.",
+    repair_runtime_report_and_run_a_new_quick_verification: "Repair the runtime report and run a new verification.",
+  };
+  return friendly[nextAction] ?? nextAction.replaceAll("_", " ");
+}
+
+export function formatQuickOutcomeHumanV1(outcome) {
+  const label = {
+    pass: "PASS",
+    fail: "FAIL",
+    invalidated: "INVALIDATED",
+    indeterminate: "INDETERMINATE",
+  }[outcome.result];
+  const levels = outcome.acceptanceLevels;
+  return [
+    `Result: ${label} — ${outcome.headline}`,
+    `Proved: ${outcome.proven.length > 0 ? outcome.proven.join(" ") : "No reusable verification claim."}`,
+    "Acceptance: "
+      + `Candidate: ${display(levels.candidateIdentity)}; `
+      + `workspace: ${display(levels.workspaceAttestation)}; `
+      + `verification: ${display(levels.verificationCommand)}; `
+      + "Product/UX: not proven; "
+      + `Deployment/runtime: ${display(levels.deploymentRuntime)}; `
+      + "Production/business: not proven.",
+    `Next: ${humanNextAction(outcome.nextAction)}`,
+    "Authority: no Git, release, deployment, production, or business authority granted.",
+  ].join("\n");
+}

package/scripts/runkit-contract/profile-onboarding.mjs

@@ -1440,9 +1440,47 @@ export function applyDetectedProfilesV3(input = {}) {
   });
 }
 
+function mergeDetectedProfileDefinition(current, detected) {
+  current.commands ??= [];
+  const addedPaths = detected.paths
+    .filter((value) => !current.paths.includes(value))
+    .sort();
+  current.paths = [...new Set([...current.paths, ...detected.paths])].sort();
+  const commands = new Map(current.commands.map((entry) => [entry.id, entry]));
+  const addedCommandIds = [];
+  const updatedCommandIds = [];
+  for (const detectedCommand of detected.commands) {
+    const currentCommand = commands.get(detectedCommand.id);
+    if (!currentCommand) {
+      current.commands.push(structuredClone(detectedCommand));
+      commands.set(detectedCommand.id, detectedCommand);
+      addedCommandIds.push(detectedCommand.id);
+    } else if (canonicalJson(currentCommand) !== canonicalJson(detectedCommand)) {
+      const index = current.commands.findIndex((entry) => entry.id === detectedCommand.id);
+      current.commands[index] = structuredClone(detectedCommand);
+      commands.set(detectedCommand.id, detectedCommand);
+      updatedCommandIds.push(detectedCommand.id);
+    }
+  }
+  current.commands.sort((left, right) => left.id.localeCompare(right.id));
+  if (
+    addedPaths.length === 0
+    && addedCommandIds.length === 0
+    && updatedCommandIds.length === 0
+  ) return null;
+  return {
+    profileId: current.id,
+    addedPaths,
+    addedCommandIds: addedCommandIds.sort(),
+    updatedCommandIds: updatedCommandIds.sort(),
+  };
+}
+
 function mergeDetectedProfiles(currentProfiles, detectedProfiles) {
   const profiles = currentProfiles.profiles.map((profile) => structuredClone(profile));
   const byId = new Map(profiles.map((profile) => [profile.id, profile]));
+  const commandOwners = new Map(profiles.flatMap((profile) =>
+    (profile.commands ?? []).map((entry) => [entry.id, profile.id])));
   const addedProfileIds = [];
   const updatedProfiles = [];
   for (const detected of [...detectedProfiles.profiles]
@@ -1456,45 +1494,26 @@ function mergeDetectedProfiles(currentProfiles, detectedProfiles) {
       const primaryCoverageComplete = impact.uncoveredPaths.length === 0
         && !impact.warnings.some((warning) => warning.startsWith("supporting_only_match:"));
       if (primaryCoverageComplete) continue;
+      const existingCommandOwnerIds = [...new Set(detected.commands
+        .map((command) => commandOwners.get(command.id))
+        .filter(Boolean))];
+      if (existingCommandOwnerIds.length === 1) {
+        const owner = byId.get(existingCommandOwnerIds[0]);
+        const update = mergeDetectedProfileDefinition(owner, detected);
+        if (update !== null) updatedProfiles.push(update);
+        for (const command of owner.commands) commandOwners.set(command.id, owner.id);
+        continue;
+      }
       const added = { ...structuredClone(detected), primary: false };
       profiles.push(added);
       byId.set(added.id, added);
+      for (const command of added.commands) commandOwners.set(command.id, added.id);
       addedProfileIds.push(added.id);
       continue;
     }
-    const addedPaths = detected.paths
-      .filter((value) => !current.paths.includes(value))
-      .sort();
-    current.paths = [...new Set([...current.paths, ...detected.paths])].sort();
-    const commands = new Map(current.commands.map((entry) => [entry.id, entry]));
-    const addedCommandIds = [];
-    const updatedCommandIds = [];
-    for (const detectedCommand of detected.commands) {
-      const currentCommand = commands.get(detectedCommand.id);
-      if (!currentCommand) {
-        current.commands.push(structuredClone(detectedCommand));
-        commands.set(detectedCommand.id, detectedCommand);
-        addedCommandIds.push(detectedCommand.id);
-      } else if (canonicalJson(currentCommand) !== canonicalJson(detectedCommand)) {
-        const index = current.commands.findIndex((entry) => entry.id === detectedCommand.id);
-        current.commands[index] = structuredClone(detectedCommand);
-        commands.set(detectedCommand.id, detectedCommand);
-        updatedCommandIds.push(detectedCommand.id);
-      }
-    }
-    current.commands.sort((left, right) => left.id.localeCompare(right.id));
-    if (
-      addedPaths.length > 0
-      || addedCommandIds.length > 0
-      || updatedCommandIds.length > 0
-    ) {
-      updatedProfiles.push({
-        profileId: current.id,
-        addedPaths,
-        addedCommandIds: addedCommandIds.sort(),
-        updatedCommandIds: updatedCommandIds.sort(),
-      });
-    }
+    const update = mergeDetectedProfileDefinition(current, detected);
+    if (update !== null) updatedProfiles.push(update);
+    for (const command of current.commands) commandOwners.set(command.id, current.id);
   }
   return {
     proposedProfiles: {
@@ -1590,6 +1609,16 @@ function validateReconcileReceipt(receipt, reconcileSha256) {
   return receiptPath;
 }
 
+function isInitializationProfileScaffold(value) {
+  return value !== null
+    && typeof value === "object"
+    && !Array.isArray(value)
+    && value.schemaVersion === "OwlCodaRunKitProfilesV1"
+    && Array.isArray(value.profiles)
+    && value.profiles.length === 0
+    && Object.keys(value).sort().join(",") === "profiles,schemaVersion";
+}
+
 function recoverProfileReconcileTransaction(root) {
   const runtimeRoot = path.join(root, ".owlcoda", "runkit");
   if (!existsSync(runtimeRoot)) return null;
@@ -1710,6 +1739,7 @@ export function reconcileProfilesV2({
   let currentProfilesSha256;
   let currentProfiles;
   let currentProfilesBytes;
+  let replacesInitializationScaffold = false;
   try {
     currentProfilesSha256 = profilesFileHash(root);
     if (currentProfilesSha256 === null) {
@@ -1723,8 +1753,9 @@ export function reconcileProfilesV2({
       root,
       path.join(".owlcoda", "runkit", "profiles.json"),
     );
+    replacesInitializationScaffold = isInitializationProfileScaffold(currentProfiles);
     const documentIssues = validateProfileDocument(currentProfiles);
-    if (documentIssues.length > 0) {
+    if (documentIssues.length > 0 && !replacesInitializationScaffold) {
       return blockedReconcile(null, documentIssues, currentProfilesSha256, !apply);
     }
   } catch {
@@ -1749,7 +1780,15 @@ export function reconcileProfilesV2({
     return blockedReconcile(detection, detectionIssues, currentProfilesSha256, !apply);
   }
 
-  const merged = mergeDetectedProfiles(currentProfiles, detection.proposedProfiles);
+  const merged = replacesInitializationScaffold
+    ? {
+        proposedProfiles: structuredClone(detection.proposedProfiles),
+        addedProfileIds: detection.proposedProfiles.profiles
+          .map(profile => profile.id)
+          .sort(),
+        updatedProfiles: [],
+      }
+    : mergeDetectedProfiles(currentProfiles, detection.proposedProfiles);
   const proposedIssues = validateProfileDocumentWithDetectedSurfaces(
     root,
     merged.proposedProfiles,

package/scripts/runkit-contract/project-cli-resolver.mjs

@@ -18,6 +18,12 @@ const OFFICIAL_CLI_ENTRYPOINT =
 const EXACT_VERSION = /^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?$/;
 const SHA256_REF = /^sha256:[a-f0-9]{64}$/;
 const TRUSTED_PRIOR_CORE_IDENTITIES = new Map([
+  ["0.19.0", new Set([
+    "sha256:803fb7de76a6ccffd1ec5e0164eeff15a580209fa6dfbef9e561345ab616b403",
+  ])],
+  ["0.18.4", new Set([
+    "sha256:372d4c247e4b40b0fd2f3fe0f5bf928548095bfb7e2e92e9ac66790e2717f77d",
+  ])],
   ["0.18.3", new Set([
     "sha256:cc7a923649592084150828f24f0d90f280af92514bafdbc4999f4015b3175d5c",
   ])],
@@ -608,20 +614,32 @@ function verifyInstalledCoreBinding(root, packageRoot, version) {
   ) {
     throw new Error("project_cli_core_config_invalid");
   }
+  const installedCore = verifyInstalledCoreClosure(packageRoot, version);
+  const actualCoreManifestSha256 = installedCore.coreManifestSha256;
+  if (actualCoreManifestSha256 !== core.coreManifestSha256) {
+    throw new Error("project_cli_installed_core_drift");
+  }
+  return {
+    schemaVersion: "OwlCodaRunKitInstalledCoreBindingV1",
+    coreVersion: version,
+    coreManifestSha256: actualCoreManifestSha256,
+    trustedIdentitySource: installedCore.trustedIdentitySource,
+    configPath: ".owlcoda/runkit/config.json",
+  };
+}
+
+function verifyInstalledCoreClosure(packageRoot, version) {
   const actualCoreManifestSha256 = installedCoreManifestSha256(packageRoot);
   const trusted = trustedCoreManifestHashes(version);
   if (!trusted.hashes.has(actualCoreManifestSha256)) {
     throw new Error("project_cli_untrusted_core_identity");
   }
-  if (actualCoreManifestSha256 !== core.coreManifestSha256) {
-    throw new Error("project_cli_installed_core_drift");
-  }
   return {
     schemaVersion: "OwlCodaRunKitInstalledCoreBindingV1",
     coreVersion: version,
     coreManifestSha256: actualCoreManifestSha256,
     trustedIdentitySource: trusted.source,
-    configPath: ".owlcoda/runkit/config.json",
+    configPath: null,
   };
 }
 
@@ -629,6 +647,7 @@ export function resolveProjectCli({
   workspaceRoot,
   expectedVersion = null,
   requireEntrypoint = true,
+  requireProjectConfig = requireEntrypoint,
 } = {}) {
   let root;
   try {
@@ -692,7 +711,9 @@ export function resolveProjectCli({
       "project_cli_symlink_rejected",
     );
     const installedCoreBinding = requireEntrypoint
-      ? verifyInstalledCoreBinding(root, installed.packageRoot, version)
+      ? requireProjectConfig
+        ? verifyInstalledCoreBinding(root, installed.packageRoot, version)
+        : verifyInstalledCoreClosure(installed.packageRoot, version)
       : null;
     return {
       schemaVersion: "OwlCodaRunKitProjectCliBindingV1",