owlrunkit 0.19.2 → 0.21.0

package/scripts/runkit-contract/project-cli-resolver.mjs

@@ -15,10 +15,21 @@ const MAX_CORE_TOTAL_BYTES = 67_108_864;
 const PACKAGE_NAME = "owlrunkit";
 const OFFICIAL_CLI_ENTRYPOINT =
   "scripts/runkit-contract/runkit-bootstrap.mjs";
-const SELF_NORMALIZED_QUICK_CORE_VERSIONS = new Set(["0.19.2"]);
+const SELF_NORMALIZED_QUICK_CORE_VERSIONS = new Set([
+  "0.19.2",
+  "0.20.0",
+  "0.20.1",
+  "0.21.0",
+]);
 const EXACT_VERSION = /^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?$/;
 const SHA256_REF = /^sha256:[a-f0-9]{64}$/;
 const TRUSTED_PRIOR_CORE_IDENTITIES = new Map([
+  ["0.20.0", new Set([
+    "sha256:30098aa9344c17c1ed0b5ed45ef1c590b3214b824402f584029c1ecb38ca7a70",
+  ])],
+  ["0.19.2", new Set([
+    "sha256:c46ae9d8ed0572e5636ab5725f922f8db3ee5bf0f966b200bce7b2287c9267c8",
+  ])],
   ["0.19.1", new Set([
     "sha256:291ef97c93a513eed24a29f75c400b61cefd6a8c0ab228401cf2c6a73ea9e622",
   ])],

package/scripts/runkit-contract/quick-metrics.mjs

@@ -22,12 +22,13 @@ const INVALID_ATTESTATION_ISSUES = new Set([
   "attestation_material_missing",
   "receipt_material_hash_mismatch",
 ]);
-const V3_MUTATION_ISSUES = new Set([
+const SUCCESSOR_MUTATION_ISSUES = new Set([
   "source_mutated_during_verification",
   "bound_ignored_path_mutated_during_verification",
   "dependency_environment_mutated_during_verification",
   "consumer_source_mutated_during_verification",
   "quick_isolation_cleanup_failed",
+  "foreign_workspace_mutated_during_verification",
 ]);
 
 function readHistoricalReceipt(receiptPath) {
@@ -38,11 +39,14 @@ function readHistoricalReceipt(receiptPath) {
     && quickSnapshotFingerprintValid(receipt.workspaceAfter);
   const sourceChanged = receipt.workspaceBefore.sourceFingerprint
     !== receipt.workspaceAfter.sourceFingerprint;
-  const receiptV3 = receipt.schemaVersion === "OwlCodaQuickVerificationReceiptV3";
+  const successorReceipt = [
+    "OwlCodaQuickVerificationReceiptV3",
+    "OwlCodaQuickVerificationReceiptV4",
+  ].includes(receipt.schemaVersion);
   const mutationBindingValid = receipt.mutationDecision === "source_unchanged"
-    ? !sourceChanged && !receipt.issueCodes.some(issue => V3_MUTATION_ISSUES.has(issue))
-    : receiptV3
-      ? receipt.issueCodes.some(issue => V3_MUTATION_ISSUES.has(issue))
+    ? !sourceChanged && !receipt.issueCodes.some(issue => SUCCESSOR_MUTATION_ISSUES.has(issue))
+    : successorReceipt
+      ? receipt.issueCodes.some(issue => SUCCESSOR_MUTATION_ISSUES.has(issue))
       : sourceChanged && receipt.issueCodes.includes("source_mutated_during_verification");
   if (!snapshotsValid || !mutationBindingValid) {
     throw new Error("quick_receipt_source_binding_invalid");

package/scripts/runkit-contract/quick-verify.mjs

@@ -24,6 +24,10 @@ import {
   captureWorkspaceSnapshot,
   workspaceSourceStateFingerprint,
 } from "./quick-workspace-snapshot.mjs";
+import {
+  captureCanonicalCandidateIdentityV1,
+  captureForeignWorkspaceFilesystemIdentityV1,
+} from "../../packages/attest/src/candidate-identity.mjs";
 import {
   captureRuntimeTransition,
   runtimeReportPath,
@@ -81,7 +85,13 @@ function inputArtifactResult(stdinArtifact) {
     : { inputArtifacts: { stdin: stdinArtifact } };
 }
 
-function mutationTruth({ workspaceBefore, workspaceAfter, isolationResult, cleanupStatus }) {
+function mutationTruth({
+  workspaceBefore,
+  workspaceAfter,
+  isolationResult,
+  cleanupStatus,
+  foreignWorkspace = null,
+}) {
   const workspaceSourceChanged = workspaceSourceStateFingerprint(workspaceBefore)
     !== workspaceSourceStateFingerprint(workspaceAfter);
   const boundIgnoredChanged = workspaceBefore.ignoredPathsBound === true
@@ -89,12 +99,15 @@ function mutationTruth({ workspaceBefore, workspaceAfter, isolationResult, clean
   const dependencyChanged = isolationResult?.dependencyChanged === true;
   const consumerSourceChanged = (isolationResult?.consumerDelta.sourcePaths.length ?? 0) > 0;
   const cleanupFailed = cleanupStatus === "cleanup_failed";
+  const foreignChanged = foreignWorkspace !== null
+    && foreignWorkspace.zeroWriteObserved !== true;
   const issueCodes = [
     ...(workspaceSourceChanged ? ["source_mutated_during_verification"] : []),
     ...(boundIgnoredChanged ? ["bound_ignored_path_mutated_during_verification"] : []),
     ...(dependencyChanged ? ["dependency_environment_mutated_during_verification"] : []),
     ...(consumerSourceChanged ? ["consumer_source_mutated_during_verification"] : []),
     ...(cleanupFailed ? ["quick_isolation_cleanup_failed"] : []),
+    ...(foreignChanged ? ["foreign_workspace_mutated_during_verification"] : []),
   ];
   const decisions = [
     ...(workspaceSourceChanged ? ["invalidated_by_command_source_mutation"] : []),
@@ -102,6 +115,7 @@ function mutationTruth({ workspaceBefore, workspaceAfter, isolationResult, clean
     ...(dependencyChanged ? ["invalidated_by_dependency_environment_mutation"] : []),
     ...(consumerSourceChanged ? ["invalidated_by_consumer_source_mutation"] : []),
     ...(cleanupFailed ? ["invalidated_by_isolation_cleanup_failure"] : []),
+    ...(foreignChanged ? ["invalidated_by_foreign_workspace_mutation"] : []),
   ];
   return {
     mutationDecision: decisions.length === 0
@@ -125,10 +139,26 @@ function mutationTruth({ workspaceBefore, workspaceAfter, isolationResult, clean
       consumerIgnoredArtifacts: (isolationResult?.consumerDelta.ignoredPaths.length ?? 0) > 0
         ? "changed_and_discarded"
         : isolationResult === null ? "not_isolated" : "none",
+      ...(foreignWorkspace === null
+        ? {}
+        : { foreignTarget: foreignChanged ? "changed" : "unchanged" }),
     },
   };
 }
 
+function rootsOverlap(left, right) {
+  const leftToRight = path.relative(left, right);
+  const rightToLeft = path.relative(right, left);
+  return leftToRight === ""
+    || rightToLeft === ""
+    || (leftToRight !== ".."
+      && !leftToRight.startsWith(`..${path.sep}`)
+      && !path.isAbsolute(leftToRight))
+    || (rightToLeft !== ".."
+      && !rightToLeft.startsWith(`..${path.sep}`)
+      && !path.isAbsolute(rightToLeft));
+}
+
 function isolationReceipt(isolation, isolationResult, cleanupStatus) {
   if (isolation === null) return null;
   return {
@@ -150,6 +180,7 @@ function isolationReceipt(isolation, isolationResult, cleanupStatus) {
 
 export async function runQuickVerification({
   workspaceRoot,
+  foreignWorkspaceRoot,
   commandArgv,
   stdinFile,
   isolate = false,
@@ -165,18 +196,27 @@ export async function runQuickVerification({
       authorizationGranted: false,
     };
   }
-  let root;
+  let controllerRoot;
+  let sourceRoot;
   try {
-    root = realpathSync(workspaceRoot);
+    controllerRoot = realpathSync(workspaceRoot);
+    sourceRoot = foreignWorkspaceRoot === undefined
+      ? controllerRoot
+      : realpathSync(foreignWorkspaceRoot);
+    if (foreignWorkspaceRoot !== undefined && rootsOverlap(controllerRoot, sourceRoot)) {
+      throw new Error("Controller and source workspace overlap.");
+    }
   } catch {
     return {
       status: "quick_verification_input_invalid",
       exitCode: 3,
-      issues: ["Workspace does not exist."],
+      issues: ["Controller or source workspace does not exist or is not safely separated."],
       authorizationGranted: false,
     };
   }
-  if (dependencyRoot !== undefined && isolate !== true) {
+  const foreignMode = foreignWorkspaceRoot !== undefined;
+  const effectiveIsolation = isolate === true || foreignMode;
+  if (dependencyRoot !== undefined && effectiveIsolation !== true) {
     return {
       status: "quick_verification_input_invalid",
       exitCode: 3,
@@ -184,6 +224,14 @@ export async function runQuickVerification({
       authorizationGranted: false,
     };
   }
+  if (foreignMode && captureRuntime === true) {
+    return {
+      status: "quick_verification_input_invalid",
+      exitCode: 3,
+      issues: ["Foreign Quick does not capture external runtime transitions."],
+      authorizationGranted: false,
+    };
+  }
   if (!Array.isArray(ignoredPaths) || ignoredPaths.some(value => typeof value !== "string")) {
     return {
       status: "quick_verification_input_invalid",
@@ -206,7 +254,7 @@ export async function runQuickVerification({
     try {
       const selected = path.isAbsolute(stdinFile)
         ? stdinFile
-        : path.resolve(root, stdinFile);
+        : path.resolve(sourceRoot, stdinFile);
       stdinBytes = readFileBytesBounded(selected).bytes;
     } catch (error) {
       return {
@@ -219,25 +267,32 @@ export async function runQuickVerification({
   }
 
   let workspaceBefore;
+  let foreignWorkspaceBefore = null;
   let store;
   let stdinArtifact = null;
   let persistedStdinPath;
   let isolation = null;
   try {
-    workspaceBefore = captureWorkspaceSnapshot(root, { ignoredPaths });
-    store = createQuickReceiptStore(root);
+    workspaceBefore = captureWorkspaceSnapshot(sourceRoot, { ignoredPaths });
+    if (foreignMode) {
+      foreignWorkspaceBefore = {
+        candidate: captureCanonicalCandidateIdentityV1(sourceRoot),
+        filesystem: captureForeignWorkspaceFilesystemIdentityV1(sourceRoot),
+      };
+    }
+    store = createQuickReceiptStore(controllerRoot);
     if (stdinBytes !== undefined) {
       const persistedInput = persistQuickInputArtifact({
-        workspaceRoot: root,
+        workspaceRoot: controllerRoot,
         store,
         bytes: stdinBytes,
       });
       stdinArtifact = persistedInput.artifact;
       persistedStdinPath = persistedInput.inputPath;
     }
-    if (isolate === true) {
-      isolation = prepareQuickIsolation({ workspaceRoot: root, dependencyRoot });
-      const stableSource = captureWorkspaceSnapshot(root, { ignoredPaths });
+    if (effectiveIsolation === true) {
+      isolation = prepareQuickIsolation({ workspaceRoot: sourceRoot, dependencyRoot });
+      const stableSource = captureWorkspaceSnapshot(sourceRoot, { ignoredPaths });
       if (stableSource.sourceFingerprint !== workspaceBefore.sourceFingerprint) {
         throw new Error("Source workspace changed while the temporary consumer was being prepared.");
       }
@@ -254,7 +309,7 @@ export async function runQuickVerification({
   }
 
   const [executable, ...argv] = commandArgv;
-  const executionCwd = isolation?.consumerRoot ?? root;
+  const executionCwd = isolation?.consumerRoot ?? sourceRoot;
   const expectedRuntimeReportPath = captureRuntime
     ? runtimeReportPath(store.receiptRoot)
     : null;
@@ -279,6 +334,7 @@ export async function runQuickVerification({
   const finishedAt = new Date().toISOString();
 
   let workspaceAfter;
+  let foreignWorkspace = null;
   let isolationResult = null;
   let cleanupStatus = "not_required";
   try {
@@ -286,7 +342,21 @@ export async function runQuickVerification({
       isolationResult = inspectQuickIsolation(isolation);
       cleanupStatus = removeQuickIsolation(isolation);
     }
-    workspaceAfter = captureWorkspaceSnapshot(root, { ignoredPaths });
+    workspaceAfter = captureWorkspaceSnapshot(sourceRoot, { ignoredPaths });
+    if (foreignMode) {
+      const candidateAfter = captureCanonicalCandidateIdentityV1(sourceRoot);
+      const filesystemAfter = captureForeignWorkspaceFilesystemIdentityV1(sourceRoot);
+      foreignWorkspace = {
+        candidateBefore: foreignWorkspaceBefore.candidate,
+        candidateAfter,
+        filesystemBefore: foreignWorkspaceBefore.filesystem,
+        filesystemAfter,
+        zeroWriteObserved: foreignWorkspaceBefore.candidate.candidateFingerprint
+            === candidateAfter.candidateFingerprint
+          && foreignWorkspaceBefore.filesystem.filesystemFingerprint
+            === filesystemAfter.filesystemFingerprint,
+      };
+    }
   } catch (error) {
     if (isolation !== null && cleanupStatus === "not_required") {
       removeQuickIsolation(isolation);
@@ -306,16 +376,20 @@ export async function runQuickVerification({
     workspaceAfter,
     isolationResult,
     cleanupStatus,
+    foreignWorkspace,
   });
   const sourceMutated = mutation.mutationDecision !== "source_unchanged";
-  const receiptV3 = isolate === true || ignoredPaths.length > 0;
+  const receiptV4 = foreignMode;
+  const receiptV3 = !receiptV4 && (effectiveIsolation === true || ignoredPaths.length > 0);
   let persisted;
   try {
     persisted = persistQuickReceipt({
-      workspaceRoot: root,
+      workspaceRoot: controllerRoot,
       store,
       receipt: {
-      schemaVersion: receiptV3
+      schemaVersion: receiptV4
+        ? "OwlCodaQuickVerificationReceiptV4"
+        : receiptV3
         ? "OwlCodaQuickVerificationReceiptV3"
         : stdinArtifact === null
         ? "OwlCodaQuickVerificationReceiptV1"
@@ -334,13 +408,19 @@ export async function runQuickVerification({
         argv,
         cwd: executionCwd,
       },
-      ...(receiptV3
+      ...(receiptV3 || receiptV4
         ? {
-            sourceWorkspaceRoot: root,
+            sourceWorkspaceRoot: sourceRoot,
             executionIsolation: isolationReceipt(isolation, isolationResult, cleanupStatus),
             mutationClasses: mutation.mutationClasses,
           }
         : {}),
+      ...(receiptV4
+        ? {
+            controllerWorkspaceRoot: controllerRoot,
+            foreignWorkspace,
+          }
+        : {}),
       ...(stdinArtifact === null
         ? {}
         : { inputArtifacts: { stdin: stdinArtifact } }),
@@ -382,7 +462,7 @@ export async function runQuickVerification({
   if (expectedRuntimeReportPath !== null) {
     try {
       runtimeTransition = captureRuntimeTransition({
-        workspaceRoot: root,
+        workspaceRoot: controllerRoot,
         quickReceiptPath: persisted.receiptPath,
         runtimeReportPath: expectedRuntimeReportPath,
       });
@@ -398,7 +478,7 @@ export async function runQuickVerification({
   const runtimeFields = runtimeTransition === null ? {} : { runtimeTransition };
 
   if (sourceMutated) {
-    const attestCommand = quickAttestCommand(root, persisted.receiptPath);
+    const attestCommand = quickAttestCommand(controllerRoot, persisted.receiptPath);
     return {
       status: "quick_verification_source_mutated",
       exitCode: 2,
@@ -408,6 +488,7 @@ export async function runQuickVerification({
       commandExitCode: execution.exitCode,
       mutationDecision: mutation.mutationDecision,
       issueCodes: mutation.issueCodes,
+      ...(foreignMode ? { targetZeroWrite: foreignWorkspace.zeroWriteObserved } : {}),
       ...inputArtifactResult(stdinArtifact),
       outputSummary,
       evidenceStorage,
@@ -419,7 +500,7 @@ export async function runQuickVerification({
     };
   }
   if (runtimeTransition?.status === "runtime_transition_invalid") {
-    const attestCommand = quickAttestCommand(root, persisted.receiptPath);
+    const attestCommand = quickAttestCommand(controllerRoot, persisted.receiptPath);
     return {
       status: "quick_verification_runtime_truth_invalid",
       exitCode: 1,
@@ -432,6 +513,7 @@ export async function runQuickVerification({
       commandExitCode: execution.exitCode,
       mutationDecision: "source_unchanged",
       issueCodes: mutation.issueCodes,
+      ...(foreignMode ? { targetZeroWrite: foreignWorkspace.zeroWriteObserved } : {}),
       ...inputArtifactResult(stdinArtifact),
       outputSummary,
       evidenceStorage,
@@ -443,7 +525,7 @@ export async function runQuickVerification({
     };
   }
   if (execution.launchError || execution.exitCode !== 0) {
-    const attestCommand = quickAttestCommand(root, persisted.receiptPath);
+    const attestCommand = quickAttestCommand(controllerRoot, persisted.receiptPath);
     return {
       status: "quick_verification_failed",
       exitCode: 1,
@@ -453,6 +535,7 @@ export async function runQuickVerification({
       commandExitCode: execution.exitCode,
       mutationDecision: "source_unchanged",
       issueCodes: mutation.issueCodes,
+      ...(foreignMode ? { targetZeroWrite: foreignWorkspace.zeroWriteObserved } : {}),
       ...inputArtifactResult(stdinArtifact),
       outputSummary,
       evidenceStorage,
@@ -463,7 +546,7 @@ export async function runQuickVerification({
       authorizationGranted: false,
     };
   }
-  const attestCommand = quickAttestCommand(root, persisted.receiptPath);
+  const attestCommand = quickAttestCommand(controllerRoot, persisted.receiptPath);
   return {
     status: "quick_verification_passed",
     exitCode: 0,
@@ -473,6 +556,7 @@ export async function runQuickVerification({
     commandExitCode: 0,
     mutationDecision: "source_unchanged",
     issueCodes: mutation.issueCodes,
+    ...(foreignMode ? { targetZeroWrite: foreignWorkspace.zeroWriteObserved } : {}),
     ...inputArtifactResult(stdinArtifact),
     outputSummary,
     evidenceStorage,

package/scripts/runkit-contract/registry-adoption-gate.mjs

@@ -61,12 +61,15 @@ function hasExactFields(value, fields) {
 }
 
 function decision(policy, issueCodes) {
+  const version = policy.schemaVersion === "OwlCodaRunKitRegistryReleasePolicyV2"
+    ? policy.artifactVersion
+    : policy.candidateVersion;
   return {
     schemaVersion: "OwlCodaRunKitRegistryAdoptionDecisionV1",
     decision: issueCodes.length === 0 ? "ELIGIBLE" : "INELIGIBLE",
     issueCodes,
     packageName: policy.packageName,
-    version: policy.candidateVersion,
+    version,
     authorizationGranted: false,
   };
 }
@@ -157,6 +160,9 @@ export function validateStoredRegistryAdoptionEvidence({
 }
 
 function validReleaseEvidence(policy, release) {
+  const version = policy.schemaVersion === "OwlCodaRunKitRegistryReleasePolicyV2"
+    ? policy.artifactVersion
+    : policy.candidateVersion;
   if (
     policy.registry !== OFFICIAL_NPM_REGISTRY
     || Object.keys(release).sort().join("\n") !== RELEASE_EVIDENCE_FIELDS.join("\n")
@@ -164,7 +170,7 @@ function validReleaseEvidence(policy, release) {
     || !isCanonicalSha512Integrity(release.integrity)
     || release.tarballUrl !== expectedRegistryTarballUrl(
       policy.packageName,
-      policy.candidateVersion,
+      version,
     )
   ) {
     return false;
@@ -198,13 +204,16 @@ export function evaluateRegistryAdoption({ policy, releaseEvidence, install }) {
   }
 
   const release = releaseEvidence;
+  const version = policy.schemaVersion === "OwlCodaRunKitRegistryReleasePolicyV2"
+    ? policy.artifactVersion
+    : policy.candidateVersion;
   if (!validReleaseEvidence(policy, release)) {
     return decision(policy, ["registry_release_evidence_invalid"]);
   }
   if (
     release.registry !== policy.registry
     || release.packageName !== policy.packageName
-    || release.version !== policy.candidateVersion
+    || release.version !== version
   ) {
     return decision(policy, ["registry_release_evidence_mismatch"]);
   }

package/scripts/runkit-contract/registry-adoption.mjs

@@ -23,10 +23,10 @@ const CANDIDATE_VERSION = CORE_VERSION;
 const EXACT_SPEC = `${PACKAGE_NAME}@${CANDIDATE_VERSION}`;
 
 const POLICY = Object.freeze({
-  schemaVersion: "OwlCodaRunKitRegistryReleasePolicyV1",
-  status: "registry_verified",
+  schemaVersion: "OwlCodaRunKitRegistryReleasePolicyV2",
+  status: "release_artifact_registry_gated",
   packageName: PACKAGE_NAME,
-  candidateVersion: CANDIDATE_VERSION,
+  artifactVersion: CANDIDATE_VERSION,
   registry: OFFICIAL_NPM_REGISTRY,
   registryRequiredBeforeAdoption: true,
   exactVersionRequired: true,
@@ -45,8 +45,13 @@ const POLICY = Object.freeze({
     "symlink",
     "workspace",
   ],
-  currentPublishedRelease: null,
-  registryRelease: null,
+  rollbackRelease: {
+    packageName: PACKAGE_NAME,
+    version: "0.20.0",
+    shasum: "b123f5ea33a4f500961a0df3226ed0ca409d111d",
+    integrity: "sha512-VcXUh+q8DwR6RoO9JDoUMEzFrpFRBpSvpqgHvIY15Z+Oo+A31Ij2kFO5wCFki80nd6Tl/YT70t7UV2aG0TZ0GQ==",
+    tarballUrl: "https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.20.0.tgz",
+  },
   registryEvidenceMustBeExternal: true,
   registryEvidenceSchemaVersion: "OwlCodaRunKitRegistryReleaseEvidenceV1",
   embeddedAttestComponentVersion: "0.2.0",