owlrunkit 0.20.0 → 0.22.0

package/scripts/runkit-contract/quick-verify.mjs

@@ -24,6 +24,10 @@ import {
   captureWorkspaceSnapshot,
   workspaceSourceStateFingerprint,
 } from "./quick-workspace-snapshot.mjs";
+import {
+  captureCanonicalCandidateIdentityV1,
+  captureForeignWorkspaceFilesystemIdentityV1,
+} from "../../packages/attest/src/candidate-identity.mjs";
 import {
   captureRuntimeTransition,
   runtimeReportPath,
@@ -81,7 +85,13 @@ function inputArtifactResult(stdinArtifact) {
     : { inputArtifacts: { stdin: stdinArtifact } };
 }
 
-function mutationTruth({ workspaceBefore, workspaceAfter, isolationResult, cleanupStatus }) {
+function mutationTruth({
+  workspaceBefore,
+  workspaceAfter,
+  isolationResult,
+  cleanupStatus,
+  foreignWorkspace = null,
+}) {
   const workspaceSourceChanged = workspaceSourceStateFingerprint(workspaceBefore)
     !== workspaceSourceStateFingerprint(workspaceAfter);
   const boundIgnoredChanged = workspaceBefore.ignoredPathsBound === true
@@ -89,12 +99,15 @@ function mutationTruth({ workspaceBefore, workspaceAfter, isolationResult, clean
   const dependencyChanged = isolationResult?.dependencyChanged === true;
   const consumerSourceChanged = (isolationResult?.consumerDelta.sourcePaths.length ?? 0) > 0;
   const cleanupFailed = cleanupStatus === "cleanup_failed";
+  const foreignChanged = foreignWorkspace !== null
+    && foreignWorkspace.zeroWriteObserved !== true;
   const issueCodes = [
     ...(workspaceSourceChanged ? ["source_mutated_during_verification"] : []),
     ...(boundIgnoredChanged ? ["bound_ignored_path_mutated_during_verification"] : []),
     ...(dependencyChanged ? ["dependency_environment_mutated_during_verification"] : []),
     ...(consumerSourceChanged ? ["consumer_source_mutated_during_verification"] : []),
     ...(cleanupFailed ? ["quick_isolation_cleanup_failed"] : []),
+    ...(foreignChanged ? ["foreign_workspace_mutated_during_verification"] : []),
   ];
   const decisions = [
     ...(workspaceSourceChanged ? ["invalidated_by_command_source_mutation"] : []),
@@ -102,6 +115,7 @@ function mutationTruth({ workspaceBefore, workspaceAfter, isolationResult, clean
     ...(dependencyChanged ? ["invalidated_by_dependency_environment_mutation"] : []),
     ...(consumerSourceChanged ? ["invalidated_by_consumer_source_mutation"] : []),
     ...(cleanupFailed ? ["invalidated_by_isolation_cleanup_failure"] : []),
+    ...(foreignChanged ? ["invalidated_by_foreign_workspace_mutation"] : []),
   ];
   return {
     mutationDecision: decisions.length === 0
@@ -125,10 +139,26 @@ function mutationTruth({ workspaceBefore, workspaceAfter, isolationResult, clean
       consumerIgnoredArtifacts: (isolationResult?.consumerDelta.ignoredPaths.length ?? 0) > 0
         ? "changed_and_discarded"
         : isolationResult === null ? "not_isolated" : "none",
+      ...(foreignWorkspace === null
+        ? {}
+        : { foreignTarget: foreignChanged ? "changed" : "unchanged" }),
     },
   };
 }
 
+function rootsOverlap(left, right) {
+  const leftToRight = path.relative(left, right);
+  const rightToLeft = path.relative(right, left);
+  return leftToRight === ""
+    || rightToLeft === ""
+    || (leftToRight !== ".."
+      && !leftToRight.startsWith(`..${path.sep}`)
+      && !path.isAbsolute(leftToRight))
+    || (rightToLeft !== ".."
+      && !rightToLeft.startsWith(`..${path.sep}`)
+      && !path.isAbsolute(rightToLeft));
+}
+
 function isolationReceipt(isolation, isolationResult, cleanupStatus) {
   if (isolation === null) return null;
   return {
@@ -150,6 +180,7 @@ function isolationReceipt(isolation, isolationResult, cleanupStatus) {
 
 export async function runQuickVerification({
   workspaceRoot,
+  foreignWorkspaceRoot,
   commandArgv,
   stdinFile,
   isolate = false,
@@ -165,18 +196,27 @@ export async function runQuickVerification({
       authorizationGranted: false,
     };
   }
-  let root;
+  let controllerRoot;
+  let sourceRoot;
   try {
-    root = realpathSync(workspaceRoot);
+    controllerRoot = realpathSync(workspaceRoot);
+    sourceRoot = foreignWorkspaceRoot === undefined
+      ? controllerRoot
+      : realpathSync(foreignWorkspaceRoot);
+    if (foreignWorkspaceRoot !== undefined && rootsOverlap(controllerRoot, sourceRoot)) {
+      throw new Error("Controller and source workspace overlap.");
+    }
   } catch {
     return {
       status: "quick_verification_input_invalid",
       exitCode: 3,
-      issues: ["Workspace does not exist."],
+      issues: ["Controller or source workspace does not exist or is not safely separated."],
       authorizationGranted: false,
     };
   }
-  if (dependencyRoot !== undefined && isolate !== true) {
+  const foreignMode = foreignWorkspaceRoot !== undefined;
+  const effectiveIsolation = isolate === true || foreignMode;
+  if (dependencyRoot !== undefined && effectiveIsolation !== true) {
     return {
       status: "quick_verification_input_invalid",
       exitCode: 3,
@@ -184,6 +224,14 @@ export async function runQuickVerification({
       authorizationGranted: false,
     };
   }
+  if (foreignMode && captureRuntime === true) {
+    return {
+      status: "quick_verification_input_invalid",
+      exitCode: 3,
+      issues: ["Foreign Quick does not capture external runtime transitions."],
+      authorizationGranted: false,
+    };
+  }
   if (!Array.isArray(ignoredPaths) || ignoredPaths.some(value => typeof value !== "string")) {
     return {
       status: "quick_verification_input_invalid",
@@ -206,7 +254,7 @@ export async function runQuickVerification({
     try {
       const selected = path.isAbsolute(stdinFile)
         ? stdinFile
-        : path.resolve(root, stdinFile);
+        : path.resolve(sourceRoot, stdinFile);
       stdinBytes = readFileBytesBounded(selected).bytes;
     } catch (error) {
       return {
@@ -219,25 +267,32 @@ export async function runQuickVerification({
   }
 
   let workspaceBefore;
+  let foreignWorkspaceBefore = null;
   let store;
   let stdinArtifact = null;
   let persistedStdinPath;
   let isolation = null;
   try {
-    workspaceBefore = captureWorkspaceSnapshot(root, { ignoredPaths });
-    store = createQuickReceiptStore(root);
+    workspaceBefore = captureWorkspaceSnapshot(sourceRoot, { ignoredPaths });
+    if (foreignMode) {
+      foreignWorkspaceBefore = {
+        candidate: captureCanonicalCandidateIdentityV1(sourceRoot),
+        filesystem: captureForeignWorkspaceFilesystemIdentityV1(sourceRoot),
+      };
+    }
+    store = createQuickReceiptStore(controllerRoot);
     if (stdinBytes !== undefined) {
       const persistedInput = persistQuickInputArtifact({
-        workspaceRoot: root,
+        workspaceRoot: controllerRoot,
         store,
         bytes: stdinBytes,
       });
       stdinArtifact = persistedInput.artifact;
       persistedStdinPath = persistedInput.inputPath;
     }
-    if (isolate === true) {
-      isolation = prepareQuickIsolation({ workspaceRoot: root, dependencyRoot });
-      const stableSource = captureWorkspaceSnapshot(root, { ignoredPaths });
+    if (effectiveIsolation === true) {
+      isolation = prepareQuickIsolation({ workspaceRoot: sourceRoot, dependencyRoot });
+      const stableSource = captureWorkspaceSnapshot(sourceRoot, { ignoredPaths });
       if (stableSource.sourceFingerprint !== workspaceBefore.sourceFingerprint) {
         throw new Error("Source workspace changed while the temporary consumer was being prepared.");
       }
@@ -254,7 +309,7 @@ export async function runQuickVerification({
   }
 
   const [executable, ...argv] = commandArgv;
-  const executionCwd = isolation?.consumerRoot ?? root;
+  const executionCwd = isolation?.consumerRoot ?? sourceRoot;
   const expectedRuntimeReportPath = captureRuntime
     ? runtimeReportPath(store.receiptRoot)
     : null;
@@ -279,6 +334,7 @@ export async function runQuickVerification({
   const finishedAt = new Date().toISOString();
 
   let workspaceAfter;
+  let foreignWorkspace = null;
   let isolationResult = null;
   let cleanupStatus = "not_required";
   try {
@@ -286,7 +342,21 @@ export async function runQuickVerification({
       isolationResult = inspectQuickIsolation(isolation);
       cleanupStatus = removeQuickIsolation(isolation);
     }
-    workspaceAfter = captureWorkspaceSnapshot(root, { ignoredPaths });
+    workspaceAfter = captureWorkspaceSnapshot(sourceRoot, { ignoredPaths });
+    if (foreignMode) {
+      const candidateAfter = captureCanonicalCandidateIdentityV1(sourceRoot);
+      const filesystemAfter = captureForeignWorkspaceFilesystemIdentityV1(sourceRoot);
+      foreignWorkspace = {
+        candidateBefore: foreignWorkspaceBefore.candidate,
+        candidateAfter,
+        filesystemBefore: foreignWorkspaceBefore.filesystem,
+        filesystemAfter,
+        zeroWriteObserved: foreignWorkspaceBefore.candidate.candidateFingerprint
+            === candidateAfter.candidateFingerprint
+          && foreignWorkspaceBefore.filesystem.filesystemFingerprint
+            === filesystemAfter.filesystemFingerprint,
+      };
+    }
   } catch (error) {
     if (isolation !== null && cleanupStatus === "not_required") {
       removeQuickIsolation(isolation);
@@ -306,16 +376,20 @@ export async function runQuickVerification({
     workspaceAfter,
     isolationResult,
     cleanupStatus,
+    foreignWorkspace,
   });
   const sourceMutated = mutation.mutationDecision !== "source_unchanged";
-  const receiptV3 = isolate === true || ignoredPaths.length > 0;
+  const receiptV4 = foreignMode;
+  const receiptV3 = !receiptV4 && (effectiveIsolation === true || ignoredPaths.length > 0);
   let persisted;
   try {
     persisted = persistQuickReceipt({
-      workspaceRoot: root,
+      workspaceRoot: controllerRoot,
       store,
       receipt: {
-      schemaVersion: receiptV3
+      schemaVersion: receiptV4
+        ? "OwlCodaQuickVerificationReceiptV4"
+        : receiptV3
         ? "OwlCodaQuickVerificationReceiptV3"
         : stdinArtifact === null
         ? "OwlCodaQuickVerificationReceiptV1"
@@ -334,13 +408,19 @@ export async function runQuickVerification({
         argv,
         cwd: executionCwd,
       },
-      ...(receiptV3
+      ...(receiptV3 || receiptV4
         ? {
-            sourceWorkspaceRoot: root,
+            sourceWorkspaceRoot: sourceRoot,
             executionIsolation: isolationReceipt(isolation, isolationResult, cleanupStatus),
             mutationClasses: mutation.mutationClasses,
           }
         : {}),
+      ...(receiptV4
+        ? {
+            controllerWorkspaceRoot: controllerRoot,
+            foreignWorkspace,
+          }
+        : {}),
       ...(stdinArtifact === null
         ? {}
         : { inputArtifacts: { stdin: stdinArtifact } }),
@@ -382,7 +462,7 @@ export async function runQuickVerification({
   if (expectedRuntimeReportPath !== null) {
     try {
       runtimeTransition = captureRuntimeTransition({
-        workspaceRoot: root,
+        workspaceRoot: controllerRoot,
         quickReceiptPath: persisted.receiptPath,
         runtimeReportPath: expectedRuntimeReportPath,
       });
@@ -398,7 +478,7 @@ export async function runQuickVerification({
   const runtimeFields = runtimeTransition === null ? {} : { runtimeTransition };
 
   if (sourceMutated) {
-    const attestCommand = quickAttestCommand(root, persisted.receiptPath);
+    const attestCommand = quickAttestCommand(controllerRoot, persisted.receiptPath);
     return {
       status: "quick_verification_source_mutated",
       exitCode: 2,
@@ -408,6 +488,7 @@ export async function runQuickVerification({
       commandExitCode: execution.exitCode,
       mutationDecision: mutation.mutationDecision,
       issueCodes: mutation.issueCodes,
+      ...(foreignMode ? { targetZeroWrite: foreignWorkspace.zeroWriteObserved } : {}),
       ...inputArtifactResult(stdinArtifact),
       outputSummary,
       evidenceStorage,
@@ -419,7 +500,7 @@ export async function runQuickVerification({
     };
   }
   if (runtimeTransition?.status === "runtime_transition_invalid") {
-    const attestCommand = quickAttestCommand(root, persisted.receiptPath);
+    const attestCommand = quickAttestCommand(controllerRoot, persisted.receiptPath);
     return {
       status: "quick_verification_runtime_truth_invalid",
       exitCode: 1,
@@ -432,6 +513,7 @@ export async function runQuickVerification({
       commandExitCode: execution.exitCode,
       mutationDecision: "source_unchanged",
       issueCodes: mutation.issueCodes,
+      ...(foreignMode ? { targetZeroWrite: foreignWorkspace.zeroWriteObserved } : {}),
       ...inputArtifactResult(stdinArtifact),
       outputSummary,
       evidenceStorage,
@@ -443,7 +525,7 @@ export async function runQuickVerification({
     };
   }
   if (execution.launchError || execution.exitCode !== 0) {
-    const attestCommand = quickAttestCommand(root, persisted.receiptPath);
+    const attestCommand = quickAttestCommand(controllerRoot, persisted.receiptPath);
     return {
       status: "quick_verification_failed",
       exitCode: 1,
@@ -453,6 +535,7 @@ export async function runQuickVerification({
       commandExitCode: execution.exitCode,
       mutationDecision: "source_unchanged",
       issueCodes: mutation.issueCodes,
+      ...(foreignMode ? { targetZeroWrite: foreignWorkspace.zeroWriteObserved } : {}),
       ...inputArtifactResult(stdinArtifact),
       outputSummary,
       evidenceStorage,
@@ -463,7 +546,7 @@ export async function runQuickVerification({
       authorizationGranted: false,
     };
   }
-  const attestCommand = quickAttestCommand(root, persisted.receiptPath);
+  const attestCommand = quickAttestCommand(controllerRoot, persisted.receiptPath);
   return {
     status: "quick_verification_passed",
     exitCode: 0,
@@ -473,6 +556,7 @@ export async function runQuickVerification({
     commandExitCode: 0,
     mutationDecision: "source_unchanged",
     issueCodes: mutation.issueCodes,
+    ...(foreignMode ? { targetZeroWrite: foreignWorkspace.zeroWriteObserved } : {}),
     ...inputArtifactResult(stdinArtifact),
     outputSummary,
     evidenceStorage,

package/scripts/runkit-contract/registry-adoption-gate.mjs

@@ -61,12 +61,15 @@ function hasExactFields(value, fields) {
 }
 
 function decision(policy, issueCodes) {
+  const version = policy.schemaVersion === "OwlCodaRunKitRegistryReleasePolicyV2"
+    ? policy.artifactVersion
+    : policy.candidateVersion;
   return {
     schemaVersion: "OwlCodaRunKitRegistryAdoptionDecisionV1",
     decision: issueCodes.length === 0 ? "ELIGIBLE" : "INELIGIBLE",
     issueCodes,
     packageName: policy.packageName,
-    version: policy.candidateVersion,
+    version,
     authorizationGranted: false,
   };
 }
@@ -157,6 +160,9 @@ export function validateStoredRegistryAdoptionEvidence({
 }
 
 function validReleaseEvidence(policy, release) {
+  const version = policy.schemaVersion === "OwlCodaRunKitRegistryReleasePolicyV2"
+    ? policy.artifactVersion
+    : policy.candidateVersion;
   if (
     policy.registry !== OFFICIAL_NPM_REGISTRY
     || Object.keys(release).sort().join("\n") !== RELEASE_EVIDENCE_FIELDS.join("\n")
@@ -164,7 +170,7 @@ function validReleaseEvidence(policy, release) {
     || !isCanonicalSha512Integrity(release.integrity)
     || release.tarballUrl !== expectedRegistryTarballUrl(
       policy.packageName,
-      policy.candidateVersion,
+      version,
     )
   ) {
     return false;
@@ -198,13 +204,16 @@ export function evaluateRegistryAdoption({ policy, releaseEvidence, install }) {
   }
 
   const release = releaseEvidence;
+  const version = policy.schemaVersion === "OwlCodaRunKitRegistryReleasePolicyV2"
+    ? policy.artifactVersion
+    : policy.candidateVersion;
   if (!validReleaseEvidence(policy, release)) {
     return decision(policy, ["registry_release_evidence_invalid"]);
   }
   if (
     release.registry !== policy.registry
     || release.packageName !== policy.packageName
-    || release.version !== policy.candidateVersion
+    || release.version !== version
   ) {
     return decision(policy, ["registry_release_evidence_mismatch"]);
   }

package/scripts/runkit-contract/registry-adoption.mjs

@@ -23,10 +23,10 @@ const CANDIDATE_VERSION = CORE_VERSION;
 const EXACT_SPEC = `${PACKAGE_NAME}@${CANDIDATE_VERSION}`;
 
 const POLICY = Object.freeze({
-  schemaVersion: "OwlCodaRunKitRegistryReleasePolicyV1",
-  status: "registry_verified",
+  schemaVersion: "OwlCodaRunKitRegistryReleasePolicyV2",
+  status: "release_artifact_registry_gated",
   packageName: PACKAGE_NAME,
-  candidateVersion: CANDIDATE_VERSION,
+  artifactVersion: CANDIDATE_VERSION,
   registry: OFFICIAL_NPM_REGISTRY,
   registryRequiredBeforeAdoption: true,
   exactVersionRequired: true,
@@ -45,8 +45,13 @@ const POLICY = Object.freeze({
     "symlink",
     "workspace",
   ],
-  currentPublishedRelease: null,
-  registryRelease: null,
+  rollbackRelease: {
+    packageName: PACKAGE_NAME,
+    version: "0.21.0",
+    shasum: "f9ecfa41ad2ba3140258234b49d98798675651f2",
+    integrity: "sha512-hopLyvN5vp0y3xu0H0jQbMI6DxaDSWcGYcn7tAbCa0m2OqW2G8n5kJvnr217jqPYlArQwJ2TDPRLNmp4vPEhVQ==",
+    tarballUrl: "https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.21.0.tgz",
+  },
   registryEvidenceMustBeExternal: true,
   registryEvidenceSchemaVersion: "OwlCodaRunKitRegistryReleaseEvidenceV1",
   embeddedAttestComponentVersion: "0.2.0",

package/scripts/runkit-contract/runkit-bootstrap.mjs

@@ -15,6 +15,7 @@ const CURRENT_PACKAGE_COMMANDS = new Set([
   "bootstrap",
   "core-successor",
   "fleet",
+  "hook",
   "init",
 ]);