owlrunkit 0.19.0 → 0.19.2

package/scripts/runkit-contract/schemas/formal-check-v2.schema.json

@@ -0,0 +1,231 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://owlcoda.dev/schemas/runkit/formal-check-v2.json",
+  "title": "OwlCoda RunKit Formal Check V2",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schemaVersion",
+    "runId",
+    "checkId",
+    "sequence",
+    "status",
+    "candidatePath",
+    "candidateSha256",
+    "payloadSha256",
+    "sourceFingerprint",
+    "verificationContext",
+    "verificationContextFingerprint",
+    "snapshotRequestPath",
+    "snapshotPath",
+    "commandExitCode",
+    "verificationCommandPolicy",
+    "envelopePath",
+    "envelopeSha256",
+    "envelopeReceiptPath",
+    "envelopeReceiptSha256",
+    "envelopeFormalEligible",
+    "failureCategory",
+    "failureDetail",
+    "finalized",
+    "authorizationGranted",
+    "formalCheckSha256"
+  ],
+  "properties": {
+    "schemaVersion": { "const": "OwlCodaRunKitFormalCheckV2" },
+    "runId": { "$ref": "#/$defs/id" },
+    "checkId": { "$ref": "#/$defs/id" },
+    "sequence": { "type": "integer", "minimum": 1 },
+    "status": { "enum": ["formal_check_passed", "formal_check_failed"] },
+    "candidatePath": { "type": "string", "minLength": 1 },
+    "candidateSha256": { "$ref": "#/$defs/prefixedHash" },
+    "payloadSha256": { "$ref": "#/$defs/prefixedHash" },
+    "sourceFingerprint": { "$ref": "#/$defs/hash" },
+    "verificationContext": { "$ref": "#/$defs/verificationContext" },
+    "verificationContextFingerprint": { "$ref": "#/$defs/hash" },
+    "snapshotRequestPath": { "type": "string", "minLength": 1 },
+    "snapshotPath": { "type": "string", "minLength": 1 },
+    "commandExitCode": { "enum": [0, 2] },
+    "verificationCommandPolicy": { "$ref": "#/$defs/verificationCommandPolicy" },
+    "envelopePath": { "type": "string", "minLength": 1 },
+    "envelopeSha256": { "$ref": "#/$defs/hash" },
+    "envelopeReceiptPath": { "type": "string", "minLength": 1 },
+    "envelopeReceiptSha256": { "$ref": "#/$defs/hash" },
+    "envelopeFormalEligible": { "type": "boolean" },
+    "failureCategory": {
+      "type": ["string", "null"],
+      "enum": [
+        null,
+        "source_check_failed",
+        "envelope_capability_missing",
+        "toolchain_resolution_failed",
+        "network_policy_blocked"
+      ]
+    },
+    "failureDetail": { "type": ["string", "null"] },
+    "finalized": { "const": false },
+    "authorizationGranted": { "const": false },
+    "formalCheckSha256": { "$ref": "#/$defs/prefixedHash" }
+  },
+  "allOf": [
+    {
+      "if": { "properties": { "status": { "const": "formal_check_passed" } }, "required": ["status"] },
+      "then": {
+        "properties": {
+          "failureCategory": { "const": null },
+          "failureDetail": { "const": null },
+          "envelopeFormalEligible": { "const": true }
+        }
+      },
+      "else": {
+        "properties": {
+          "failureCategory": { "enum": ["source_check_failed", "envelope_capability_missing", "toolchain_resolution_failed", "network_policy_blocked"] },
+          "failureDetail": { "type": "string", "minLength": 1 }
+        }
+      }
+    }
+  ],
+  "$defs": {
+    "id": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]*$" },
+    "hash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+    "prefixedHash": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+    "nonempty": { "type": "string", "minLength": 1 },
+    "nameVersion": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["name", "version"],
+      "properties": {
+        "name": { "$ref": "#/$defs/nonempty" },
+        "version": { "$ref": "#/$defs/nonempty" }
+      }
+    },
+    "pathHash": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["path", "sha256"],
+      "properties": {
+        "path": { "$ref": "#/$defs/nonempty" },
+        "sha256": { "$ref": "#/$defs/hash" }
+      }
+    },
+    "idHash": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "sha256"],
+      "properties": {
+        "id": { "$ref": "#/$defs/nonempty" },
+        "sha256": { "$ref": "#/$defs/hash" }
+      }
+    },
+    "verificationContext": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["schemaVersion", "reusePolicy", "platform", "toolchains", "lockfiles", "fixtures", "services", "environment"],
+      "properties": {
+        "schemaVersion": { "const": "OwlCodaRunKitVerificationContextV1" },
+        "reusePolicy": { "enum": ["portable", "platform_bound", "environment_bound"] },
+        "platform": {
+          "oneOf": [
+            { "type": "null" },
+            {
+              "type": "object",
+              "additionalProperties": false,
+              "required": ["os", "arch"],
+              "properties": {
+                "os": { "$ref": "#/$defs/nonempty" },
+                "arch": { "$ref": "#/$defs/nonempty" }
+              }
+            }
+          ]
+        },
+        "toolchains": { "type": "array", "items": { "$ref": "#/$defs/nameVersion" } },
+        "lockfiles": { "type": "array", "items": { "$ref": "#/$defs/pathHash" } },
+        "fixtures": { "type": "array", "items": { "$ref": "#/$defs/idHash" } },
+        "services": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["id", "identity"],
+            "properties": {
+              "id": { "$ref": "#/$defs/nonempty" },
+              "identity": { "$ref": "#/$defs/nonempty" }
+            }
+          }
+        },
+        "environment": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["name", "valueSha256"],
+            "properties": {
+              "name": { "$ref": "#/$defs/nonempty" },
+              "valueSha256": { "$ref": "#/$defs/hash" }
+            }
+          }
+        }
+      }
+    },
+    "verificationCommandPolicy": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["schemaVersion", "mode", "riskClassification", "profileCommandIds", "envelopeSha256", "envelopeReceiptSha256", "authorizationGranted"],
+      "properties": {
+        "schemaVersion": { "const": "OwlCodaRunKitFormalVerificationCommandPolicyV1" },
+        "mode": { "const": "verification_envelope_v1" },
+        "riskClassification": { "const": "enforced_verification_envelope" },
+        "profileCommandIds": { "const": [] },
+        "envelopeSha256": { "$ref": "#/$defs/hash" },
+        "envelopeReceiptSha256": { "$ref": "#/$defs/hash" },
+        "authorizationGranted": { "const": false }
+      }
+    }
+  },
+  "examples": [
+    {
+      "schemaVersion": "OwlCodaRunKitFormalCheckV2",
+      "runId": "release-001",
+      "checkId": "quality",
+      "sequence": 1,
+      "status": "formal_check_failed",
+      "candidatePath": ".owlcoda/runkit/executions/release-001/source-candidates/quality.json",
+      "candidateSha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+      "payloadSha256": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+      "sourceFingerprint": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+      "verificationContext": {
+        "schemaVersion": "OwlCodaRunKitVerificationContextV1",
+        "reusePolicy": "portable",
+        "platform": null,
+        "toolchains": [],
+        "lockfiles": [],
+        "fixtures": [],
+        "services": [],
+        "environment": []
+      },
+      "verificationContextFingerprint": "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
+      "snapshotRequestPath": ".owlcoda/runkit/executions/release-001/formal-check-requests/quality.json",
+      "snapshotPath": ".owlcoda/runkit/executions/release-001/snapshots/quality-snapshot.json",
+      "commandExitCode": 2,
+      "verificationCommandPolicy": {
+        "schemaVersion": "OwlCodaRunKitFormalVerificationCommandPolicyV1",
+        "mode": "verification_envelope_v1",
+        "riskClassification": "enforced_verification_envelope",
+        "profileCommandIds": [],
+        "envelopeSha256": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+        "envelopeReceiptSha256": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+        "authorizationGranted": false
+      },
+      "envelopePath": ".owlcoda/runkit/executions/release-001/formal-envelopes/quality.json",
+      "envelopeSha256": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+      "envelopeReceiptPath": ".owlcoda/runkit/executions/release-001/verification-envelopes/quality/verification-envelope-receipt.json",
+      "envelopeReceiptSha256": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+      "envelopeFormalEligible": false,
+      "failureCategory": "source_check_failed",
+      "failureDetail": "verification_command_returned_nonzero",
+      "finalized": false,
+      "authorizationGranted": false,
+      "formalCheckSha256": "sha256:9999999999999999999999999999999999999999999999999999999999999999"
+    }
+  ]
+}

package/scripts/runkit-contract/schemas/formal-envelope-preflight-v1.schema.json

@@ -0,0 +1,212 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://owlcoda.dev/schemas/runkit/formal-envelope-preflight-v1.json",
+  "title": "OwlCoda RunKit Formal Envelope Preflight V1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "status", "exitCode", "envelopeId", "envelopeSha256", "backend", "phases", "runtimeIsolation", "issues", "nextAllowedAction", "authorizationGranted"],
+  "properties": {
+    "schemaVersion": { "const": "OwlCodaRunKitFormalEnvelopePreflightV1" },
+    "status": { "enum": ["ready", "blocked"] },
+    "exitCode": { "enum": [0, 2] },
+    "envelopeId": { "$ref": "#/$defs/id" },
+    "envelopeSha256": { "$ref": "#/$defs/hash" },
+    "backend": { "$ref": "#/$defs/backend" },
+    "phases": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 3,
+      "items": { "$ref": "#/$defs/phase" }
+    },
+    "runtimeIsolation": { "$ref": "#/$defs/runtimeIsolation" },
+    "issues": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/issue" }
+    },
+    "nextAllowedAction": { "enum": ["repair_envelope_and_repeat_preflight", "run_formal_check_with_exact_envelope"] },
+    "authorizationGranted": { "const": false }
+  },
+  "examples": [
+    {
+      "schemaVersion": "OwlCodaRunKitFormalEnvelopePreflightV1",
+      "status": "ready",
+      "exitCode": 0,
+      "envelopeId": "focused-tests",
+      "envelopeSha256": "0000000000000000000000000000000000000000000000000000000000000000",
+      "backend": {
+        "id": "macos-sandbox-exec",
+        "available": true,
+        "executable": "/usr/bin/sandbox-exec",
+        "capabilities": {
+          "fileWritePolicy": "enforced",
+          "forbiddenReadPolicy": "enforced",
+          "networkPolicy": "enforced",
+          "processExecPolicy": "enforced",
+          "processCleanup": "verified"
+        }
+      },
+      "phases": [
+        {
+          "name": "check",
+          "executable": "/usr/bin/node",
+          "argv": ["--test", "tests/focused.test.mjs"],
+          "effectiveTool": "node",
+          "packageScript": null,
+          "packageScriptCommand": null,
+          "detectedTools": ["node"],
+          "requiredExecutables": ["/usr/bin/node"],
+          "temporaryDirectory": {
+            "needed": false,
+            "environmentName": "TMPDIR",
+            "declaredValue": null,
+            "resolvedPath": null,
+            "scratchRoot": null,
+            "disposition": "not_required"
+          },
+          "runtimeScan": {
+            "scanRoot": ".",
+            "protectedRuntimeRoot": ".owlcoda/runkit",
+            "canReachProtectedRuntime": false,
+            "collectorDetected": false,
+            "affectedScripts": []
+          }
+        }
+      ],
+      "runtimeIsolation": {
+        "status": "ok",
+        "affectedScripts": [],
+        "recommendedIgnore": ".owlcoda/runkit/"
+      },
+      "issues": [],
+      "nextAllowedAction": "run_formal_check_with_exact_envelope",
+      "authorizationGranted": false
+    }
+  ],
+  "allOf": [
+    {
+      "if": { "properties": { "status": { "const": "ready" } }, "required": ["status"] },
+      "then": {
+        "properties": {
+          "exitCode": { "const": 0 },
+          "nextAllowedAction": { "const": "run_formal_check_with_exact_envelope" }
+        }
+      },
+      "else": {
+        "properties": {
+          "exitCode": { "const": 2 },
+          "nextAllowedAction": { "const": "repair_envelope_and_repeat_preflight" }
+        }
+      }
+    }
+  ],
+  "$defs": {
+    "id": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]*$" },
+    "hash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+    "nonempty": { "type": "string", "minLength": 1 },
+    "capabilities": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["fileWritePolicy", "forbiddenReadPolicy", "networkPolicy", "processExecPolicy", "processCleanup"],
+      "properties": {
+        "fileWritePolicy": { "enum": ["enforced", "unavailable"] },
+        "forbiddenReadPolicy": { "enum": ["enforced", "unavailable"] },
+        "networkPolicy": { "enum": ["enforced", "unavailable"] },
+        "processExecPolicy": { "enum": ["enforced", "unavailable"] },
+        "processCleanup": { "enum": ["verified", "unavailable"] }
+      }
+    },
+    "backend": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "available", "capabilities"],
+      "properties": {
+        "id": { "$ref": "#/$defs/nonempty" },
+        "available": { "type": "boolean" },
+        "executable": { "type": "string", "minLength": 1 },
+        "reason": { "$ref": "#/$defs/nonempty" },
+        "capabilities": { "$ref": "#/$defs/capabilities" }
+      },
+      "allOf": [
+        {
+          "if": { "properties": { "available": { "const": true } }, "required": ["available"] },
+          "then": { "required": ["executable"], "not": { "required": ["reason"] } },
+          "else": { "required": ["reason"], "not": { "required": ["executable"] } }
+        }
+      ]
+    },
+    "affectedScript": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["ignoreFile", "script", "tool"],
+      "properties": {
+        "ignoreFile": { "$ref": "#/$defs/nonempty" },
+        "script": { "$ref": "#/$defs/nonempty" },
+        "tool": { "$ref": "#/$defs/nonempty" }
+      }
+    },
+    "runtimeIsolation": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["status", "affectedScripts", "recommendedIgnore"],
+      "properties": {
+        "status": { "enum": ["ok", "warning", "unknown"] },
+        "affectedScripts": { "type": "array", "items": { "$ref": "#/$defs/affectedScript" } },
+        "recommendedIgnore": { "const": ".owlcoda/runkit/" }
+      }
+    },
+    "temporaryDirectory": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["needed", "environmentName", "declaredValue", "resolvedPath", "scratchRoot", "disposition"],
+      "properties": {
+        "needed": { "type": "boolean" },
+        "environmentName": { "const": "TMPDIR" },
+        "declaredValue": { "type": ["string", "null"] },
+        "resolvedPath": { "type": ["string", "null"] },
+        "scratchRoot": { "type": ["string", "null"] },
+        "disposition": { "enum": ["not_required", "not_declared", "bound_to_disposable_scratch", "outside_disposable_scratch_tree"] }
+      }
+    },
+    "runtimeScan": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["scanRoot", "protectedRuntimeRoot", "canReachProtectedRuntime", "collectorDetected", "affectedScripts"],
+      "properties": {
+        "scanRoot": { "$ref": "#/$defs/nonempty" },
+        "protectedRuntimeRoot": { "$ref": "#/$defs/nonempty" },
+        "canReachProtectedRuntime": { "type": "boolean" },
+        "collectorDetected": { "type": "boolean" },
+        "affectedScripts": { "type": "array", "items": { "$ref": "#/$defs/affectedScript" } }
+      }
+    },
+    "phase": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["name", "executable", "argv", "effectiveTool", "packageScript", "packageScriptCommand", "detectedTools", "requiredExecutables", "temporaryDirectory", "runtimeScan"],
+      "properties": {
+        "name": { "enum": ["setup", "check", "teardown"] },
+        "executable": { "$ref": "#/$defs/nonempty" },
+        "argv": { "type": "array", "items": { "type": "string" } },
+        "effectiveTool": { "$ref": "#/$defs/nonempty" },
+        "packageScript": { "type": ["string", "null"] },
+        "packageScriptCommand": { "type": ["string", "null"] },
+        "detectedTools": { "type": "array", "items": { "$ref": "#/$defs/nonempty" }, "uniqueItems": true },
+        "requiredExecutables": { "type": "array", "items": { "$ref": "#/$defs/nonempty" }, "uniqueItems": true },
+        "temporaryDirectory": { "$ref": "#/$defs/temporaryDirectory" },
+        "runtimeScan": { "$ref": "#/$defs/runtimeScan" }
+      }
+    },
+    "issue": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["code", "severity", "phase", "message", "repairCommand"],
+      "properties": {
+        "code": { "$ref": "#/$defs/nonempty" },
+        "severity": { "enum": ["blocker", "warning"] },
+        "phase": { "enum": [null, "setup", "check", "teardown"] },
+        "message": { "$ref": "#/$defs/nonempty" },
+        "repairCommand": { "$ref": "#/$defs/nonempty" }
+      }
+    }
+  }
+}

package/scripts/runkit-contract/schemas/formal-evidence-summary-v1.schema.json

@@ -0,0 +1,114 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://owlcoda.dev/schemas/runkit/formal-evidence-summary-v1.json",
+  "title": "OwlCoda RunKit Formal Evidence Summary V1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "runId", "summaryId", "sourceBinding", "formalChecks", "supplementalEvidence", "staleFormalCheckCount", "staleSupplementalEvidenceCount", "formalAcceptanceDerivedOnlyFromFormalChecks", "limitations", "authorizationGranted", "evidenceSummarySha256"],
+  "properties": {
+    "schemaVersion": { "const": "OwlCodaRunKitFormalEvidenceSummaryV1" },
+    "runId": { "$ref": "#/$defs/id" },
+    "summaryId": { "$ref": "#/$defs/id" },
+    "sourceBinding": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["candidatePath", "candidateSha256", "sourceFingerprint"],
+      "properties": {
+        "candidatePath": { "type": "string", "minLength": 1 },
+        "candidateSha256": { "$ref": "#/$defs/prefixedHash" },
+        "sourceFingerprint": { "$ref": "#/$defs/hash" }
+      }
+    },
+    "formalChecks": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["checkId", "status", "failureCategory", "formalEligible", "snapshotPath", "envelopeReceiptPath"],
+        "properties": {
+          "checkId": { "$ref": "#/$defs/id" },
+          "status": { "enum": ["formal_check_passed", "formal_check_failed"] },
+          "failureCategory": {
+            "type": ["string", "null"],
+            "enum": [null, "source_check_failed", "envelope_capability_missing", "toolchain_resolution_failed", "network_policy_blocked"]
+          },
+          "formalEligible": { "type": "boolean" },
+          "snapshotPath": { "type": "string", "minLength": 1 },
+          "envelopeReceiptPath": { "type": ["string", "null"] }
+        },
+        "allOf": [{
+          "if": {
+            "properties": { "status": { "const": "formal_check_passed" } },
+            "required": ["status"]
+          },
+          "then": {
+            "properties": {
+              "failureCategory": { "const": null },
+              "formalEligible": { "const": true }
+            }
+          },
+          "else": {
+            "properties": {
+              "failureCategory": { "enum": ["source_check_failed", "envelope_capability_missing", "toolchain_resolution_failed", "network_policy_blocked"] },
+              "formalEligible": { "const": false }
+            }
+          }
+        }]
+      }
+    },
+    "supplementalEvidence": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["evidenceId", "kind", "classificationBasis", "evidencePath", "supplementalEvidenceSha256", "gating"],
+        "properties": {
+          "evidenceId": { "$ref": "#/$defs/id" },
+          "kind": { "enum": ["supplemental-local", "networked"] },
+          "classificationBasis": { "const": "operator_declared_not_attested" },
+          "evidencePath": { "type": "string", "minLength": 1 },
+          "supplementalEvidenceSha256": { "$ref": "#/$defs/hash" },
+          "gating": { "const": false }
+        }
+      }
+    },
+    "staleFormalCheckCount": { "type": "integer", "minimum": 0 },
+    "staleSupplementalEvidenceCount": { "type": "integer", "minimum": 0 },
+    "formalAcceptanceDerivedOnlyFromFormalChecks": { "const": true },
+    "limitations": { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 1 } },
+    "authorizationGranted": { "const": false },
+    "evidenceSummarySha256": { "$ref": "#/$defs/hash" }
+  },
+  "$defs": {
+    "id": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]*$" },
+    "hash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+    "prefixedHash": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" }
+  },
+  "examples": [
+    {
+      "schemaVersion": "OwlCodaRunKitFormalEvidenceSummaryV1",
+      "runId": "release-001",
+      "summaryId": "formal-final-evidence",
+      "sourceBinding": {
+        "candidatePath": ".owlcoda/runkit/executions/release-001/source-candidates/quality.json",
+        "candidateSha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+        "sourceFingerprint": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+      },
+      "formalChecks": [{
+        "checkId": "quality",
+        "status": "formal_check_passed",
+        "failureCategory": null,
+        "formalEligible": true,
+        "snapshotPath": ".owlcoda/runkit/executions/release-001/snapshots/quality.json",
+        "envelopeReceiptPath": null
+      }],
+      "supplementalEvidence": [],
+      "staleFormalCheckCount": 0,
+      "staleSupplementalEvidenceCount": 0,
+      "formalAcceptanceDerivedOnlyFromFormalChecks": true,
+      "limitations": ["supplemental_evidence_is_non_gating"],
+      "authorizationGranted": false,
+      "evidenceSummarySha256": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
+    }
+  ]
+}

package/scripts/runkit-contract/schemas/formal-supplemental-evidence-v1.schema.json

@@ -0,0 +1,103 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://owlcoda.dev/schemas/runkit/formal-supplemental-evidence-v1.json",
+  "title": "OwlCoda RunKit Formal Supplemental Evidence V1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "runId", "evidenceId", "kind", "classificationBasis", "status", "gating", "sourceBinding", "quickEvidence", "limitations", "frozenMaterials", "authorizationGranted", "supplementalEvidenceSha256"],
+  "properties": {
+    "schemaVersion": { "const": "OwlCodaRunKitFormalSupplementalEvidenceV1" },
+    "runId": { "$ref": "#/$defs/id" },
+    "evidenceId": { "$ref": "#/$defs/id" },
+    "kind": { "enum": ["supplemental-local", "networked"] },
+    "classificationBasis": { "const": "operator_declared_not_attested" },
+    "status": { "const": "attached" },
+    "gating": { "const": false },
+    "sourceBinding": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["candidatePath", "candidateSha256", "sourceFingerprint", "quickWorkspaceFingerprint"],
+      "properties": {
+        "candidatePath": { "type": "string", "minLength": 1 },
+        "candidateSha256": { "$ref": "#/$defs/prefixedHash" },
+        "sourceFingerprint": { "$ref": "#/$defs/hash" },
+        "quickWorkspaceFingerprint": { "$ref": "#/$defs/prefixedHash" }
+      }
+    },
+    "quickEvidence": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["receiptId", "receiptPath", "receiptSha256", "receiptSchemaVersion", "exactCommand", "attestationDecision", "attestationIssueCodes"],
+      "properties": {
+        "receiptId": { "type": "string", "minLength": 1 },
+        "receiptPath": { "type": "string", "minLength": 1 },
+        "receiptSha256": { "$ref": "#/$defs/prefixedHash" },
+        "receiptSchemaVersion": { "type": "string", "minLength": 1 },
+        "exactCommand": { "type": "object" },
+        "attestationDecision": { "const": "GO" },
+        "attestationIssueCodes": { "type": "array", "items": { "type": "string" } }
+      }
+    },
+    "limitations": { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 1 } },
+    "frozenMaterials": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["sourcePath", "evidenceObjectPath", "sha256", "sizeBytes"],
+        "properties": {
+          "sourcePath": { "type": "string", "minLength": 1 },
+          "evidenceObjectPath": { "type": "string", "pattern": "^\\.owlcoda/runkit/evidence/raw-sha256/[a-f0-9]{64}$" },
+          "sha256": { "$ref": "#/$defs/prefixedHash" },
+          "sizeBytes": { "type": "integer", "minimum": 0 }
+        }
+      }
+    },
+    "authorizationGranted": { "const": false },
+    "supplementalEvidenceSha256": { "$ref": "#/$defs/hash" }
+  },
+  "$defs": {
+    "id": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]*$" },
+    "hash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+    "prefixedHash": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" }
+  },
+  "examples": [
+    {
+      "schemaVersion": "OwlCodaRunKitFormalSupplementalEvidenceV1",
+      "runId": "release-001",
+      "evidenceId": "network-audit",
+      "kind": "networked",
+      "classificationBasis": "operator_declared_not_attested",
+      "status": "attached",
+      "gating": false,
+      "sourceBinding": {
+        "candidatePath": ".owlcoda/runkit/executions/release-001/source-candidates/quality.json",
+        "candidateSha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+        "sourceFingerprint": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+        "quickWorkspaceFingerprint": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
+      },
+      "quickEvidence": {
+        "receiptId": "quick-001",
+        "receiptPath": ".owlcoda/runkit/quick/receipts/quick-001/receipt.json",
+        "receiptSha256": "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
+        "receiptSchemaVersion": "OwlCodaQuickVerificationReceiptV3",
+        "exactCommand": {},
+        "attestationDecision": "GO",
+        "attestationIssueCodes": []
+      },
+      "limitations": [
+        "supplemental_evidence_is_not_formal_sandbox_evidence",
+        "network_classification_is_operator_declared_not_attested"
+      ],
+      "frozenMaterials": [{
+        "sourcePath": ".owlcoda/runkit/quick/receipts/quick-001/receipt.json",
+        "evidenceObjectPath": ".owlcoda/runkit/evidence/raw-sha256/dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
+        "sha256": "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
+        "sizeBytes": 100
+      }],
+      "authorizationGranted": false,
+      "supplementalEvidenceSha256": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee"
+    }
+  ]
+}