progmune-runtime 2.1.5 → 3.2.0

package/dist/certify.js

@@ -0,0 +1,326 @@
+"use strict";
+/**
+ * Phase 9: AI Code Certificate
+ *
+ * The minimal closed-loop product: certify that a file was AI-generated
+ * and passed protocol security verification.
+ *
+ * Usage:
+ *   progmune certify <file.ts>
+ *
+ * Output: a human-readable certificate suitable for audit, compliance,
+ * and regulatory evidence.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.certify = certify;
+exports.formatCertificate = formatCertificate;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+// ── Core ──
+function certify(filePath) {
+    const absPath = path.resolve(filePath);
+    if (!fs.existsSync(absPath)) {
+        throw new Error(`File not found: ${absPath}`);
+    }
+    // 1. Parse @progmune-generated marker (first 5 lines)
+    const content = fs.readFileSync(absPath, "utf-8");
+    const head = content.split("\n").slice(0, 5).join("\n");
+    const markerMatch = head.match(/@progmune-generated\s+session=(\S+)(?:\s+timestamp=(\S+))?(?:\s+ruleHash=(\S+))?/);
+    if (!markerMatch) {
+        throw new Error(`No @progmune-generated marker found in ${filePath}.\n` +
+            `This file was not generated through Progmune's immune pipeline.`);
+    }
+    const sessionId = markerMatch[1];
+    const markerTimestamp = markerMatch[2];
+    // 2. Load session from corpus
+    const { getAllSessions } = require("./failure-corpus");
+    const sessions = getAllSessions();
+    const session = sessions.find((s) => s.sessionId === sessionId || s.sessionId?.startsWith(sessionId));
+    // 3. Collect transitions
+    let allTransitions = [];
+    let generatedBy = "AI (Progmune)";
+    if (session) {
+        for (const a of session.attempts || []) {
+            allTransitions = allTransitions.concat(a.transitions || []);
+            if (a.plannerSeed && !a.plannerSeed.includes("fallback")) {
+                generatedBy = "AI (LLM via Progmune)";
+            }
+        }
+    }
+    // 4. Check ledger consistency
+    let validated = false;
+    let violations = 0;
+    try {
+        if (session && allTransitions.length > 0) {
+            const { checkLedgerConsistency } = require("./ssg-validator");
+            const { getNsInit } = require("./protocol-registry");
+            const result = checkLedgerConsistency(allTransitions, getNsInit());
+            validated = result.consistent;
+            violations = (result.violations || []).length;
+        }
+        else if (session) {
+            validated = true; // No transitions = no violations possible
+        }
+    }
+    catch {
+        validated = false;
+    }
+    // 5. Verify fingerprint
+    let fingerprint = "";
+    let provenanceIntact = true;
+    try {
+        const { verifyFingerprint } = require("./ledger-registry");
+        const fp = verifyFingerprint(sessionId, allTransitions);
+        fingerprint = fp.stored?.ledgerHash || fp.stored?.ledgerHash || "";
+        if (!fingerprint) {
+            const { getFingerprint } = require("./ledger-registry");
+            const fp2 = getFingerprint(sessionId);
+            fingerprint = fp2?.ledgerHash || "";
+        }
+        provenanceIntact = !fp.tampered;
+    }
+    catch {
+        // No fingerprint — still valid, just unregistered
+    }
+    // 6. PLSB coverage
+    let plsbVersion = "1.0";
+    let plsbCoverage = "unknown";
+    let plsbRecall = 0;
+    try {
+        const { buildPLSB, PROTOCOL_WEAKNESS_TAXONOMY } = require("./plsb-benchmark");
+        const benchmark = buildPLSB();
+        plsbVersion = benchmark.version || "1.0";
+        plsbRecall = benchmark.metadata?.recall || 0;
+        const taxonomy = PROTOCOL_WEAKNESS_TAXONOMY;
+        const byPLS = benchmark.metadata?.byPLS || {};
+        const covered = taxonomy.filter((t) => (byPLS[t.id] || 0) > 0).length;
+        plsbCoverage = `${covered}/${taxonomy.length}`;
+    }
+    catch {
+        // PLSB not available
+    }
+    // 7. Detect degraded generation
+    let degraded = false;
+    if (session) {
+        degraded = session.attempts?.some((a) => a.plannerSeed?.includes("fallback") || a.outcome === "constraint_violation") || false;
+    }
+    // 8. Compute confidence
+    const confidence = computeConfidence({
+        validated,
+        hasFingerprint: !!fingerprint && !fingerprint.includes("pending"),
+        provenanceIntact,
+        hasSession: !!session,
+        hasTransitions: allTransitions.length > 0,
+        plsbRecall,
+        degraded,
+        violations,
+    });
+    // 9. Determine validator
+    let validator = "SSG Protocol Verification";
+    if (validated && fingerprint && !fingerprint.includes("pending")) {
+        validator += " + Ledger Fingerprint";
+    }
+    if (degraded) {
+        validator += " (fallback — reduced reliability)";
+    }
+    const validTrans = allTransitions.filter((t) => t.valid !== false).length;
+    // 10. Query Knowledge Base for matching protocol assets
+    let kbVersion;
+    let kbAssets;
+    try {
+        const { buildKnowledgeBase } = require("./protocol-knowledge");
+        const kb = buildKnowledgeBase();
+        kbVersion = kb.version;
+        const stableAssets = kb.units.filter((u) => u.maturity === "stable");
+        kbAssets = stableAssets.map((u) => ({
+            id: u.id, name: u.name, version: u.currentVersion,
+            confidence: u.confidence, rfc: u.rfcReference,
+        }));
+    }
+    catch { /* KB unavailable */ }
+    return {
+        file: absPath,
+        generatedBy,
+        sessionId,
+        validated,
+        validator,
+        plsbVersion,
+        plsbCoverage,
+        plsbRecall,
+        fingerprint: fingerprint || "(pending — run 'npm run check')",
+        timestamp: markerTimestamp || new Date().toISOString(),
+        transitions: allTransitions.length,
+        validTransitions: validTrans,
+        violations,
+        provenanceIntact,
+        confidence,
+        degraded,
+        kbVersion,
+        kbAssets,
+    };
+}
+function computeConfidence(input) {
+    // LOW: degraded generation or no session data at all
+    if (input.degraded)
+        return "low";
+    if (!input.hasSession)
+        return "low";
+    // If no transitions to check, can't be high confidence
+    if (!input.hasTransitions)
+        return "medium";
+    // HIGH requires: validated + fingerprint intact + provenance intact + PLSB recall >= 0.7
+    if (input.validated &&
+        input.hasFingerprint &&
+        input.provenanceIntact &&
+        input.plsbRecall >= 0.7 &&
+        input.violations === 0) {
+        return "high";
+    }
+    // MEDIUM: validated but missing some signals
+    if (input.validated)
+        return "medium";
+    // Failed validation → low
+    return "low";
+}
+// ── Formatter ──
+const C = {
+    reset: "\x1b[0m",
+    bold: "\x1b[1m",
+    dim: "\x1b[2m",
+    green: "\x1b[32m",
+    red: "\x1b[31m",
+    yellow: "\x1b[33m",
+    cyan: "\x1b[36m",
+};
+const W = 52;
+function formatCertificate(cert) {
+    const validatedIcon = cert.validated
+        ? `${C.green}✅ PASS${C.reset}`
+        : `${C.red}❌ FAIL${C.reset}`;
+    const provenanceIcon = cert.provenanceIntact
+        ? `${C.green}✅ INTACT${C.reset}`
+        : `${C.yellow}⚠️  CHANGED${C.reset}`;
+    // Confidence display
+    const confColor = cert.confidence === "high" ? C.green
+        : cert.confidence === "medium" ? C.yellow : C.red;
+    const confIcon = cert.confidence === "high" ? "🟢 HIGH"
+        : cert.confidence === "medium" ? "🟡 MEDIUM"
+            : "🔴 LOW";
+    const confNote = cert.confidence === "high"
+        ? "Fully verified — suitable for audit evidence"
+        : cert.confidence === "medium"
+            ? "Verified with limited coverage — recommend human review"
+            : "Degraded or unverified — human review required";
+    const boxTop = `${C.bold}${C.cyan}╔${"═".repeat(W)}╗${C.reset}`;
+    const boxMid = `${C.bold}${C.cyan}╠${"═".repeat(W)}╣${C.reset}`;
+    const boxBot = `${C.bold}${C.cyan}╚${"═".repeat(W)}╝${C.reset}`;
+    const boxV = `${C.bold}${C.cyan}║${C.reset}`;
+    const row = (label, value) => {
+        const valStr = String(value);
+        const pad = Math.max(0, W - 17 - valStr.length);
+        return `${boxV} ${C.bold}${label.padEnd(14)}${C.reset}${valStr}${" ".repeat(pad)}${boxV}`;
+    };
+    const title = "AI Code Certificate";
+    const subtitle = "Progmune Runtime — Program Immune System";
+    const lines = [
+        "",
+        boxTop,
+        `${boxV}${C.bold}${C.cyan}  ${title}${C.reset}${" ".repeat(Math.max(0, W - title.length - 3))}${boxV}`,
+        `${boxV}  ${C.dim}${subtitle}${C.reset}${" ".repeat(Math.max(0, W - subtitle.length - 3))}${boxV}`,
+        boxMid,
+        row("File", path.basename(cert.file)),
+        row("Generated by", cert.generatedBy),
+        row("Session", cert.sessionId.slice(0, W - 17)),
+        boxMid,
+        row("Validated", validatedIcon),
+        row("Confidence", `${confColor}${confIcon}${C.reset}`),
+        row("Validator", cert.validator.slice(0, W - 17)),
+        row("Transitions", `${cert.validTransitions}/${cert.transitions} valid`),
+        row("Violations", cert.violations > 0 ? `${C.red}${cert.violations}${C.reset}` : "0"),
+        row("PLSB", `v${cert.plsbVersion} (${cert.plsbCoverage} categories, recall ${(cert.plsbRecall * 100).toFixed(0)}%)`),
+        boxMid,
+        row("Fingerprint", cert.fingerprint.slice(0, W - 17)),
+        row("Provenance", provenanceIcon),
+        boxMid,
+        row("Timestamp", cert.timestamp.slice(0, W - 17)),
+        boxBot,
+        "",
+        `  ${confColor}${confNote}${C.reset}`,
+        "",
+        cert.degraded
+            ? `  ${C.yellow}⚠️  This session used fallback generation — review code carefully.${C.reset}\n`
+            : "",
+        `  ${C.dim}Replay: npx ts-node src/ledger/cli.ts replay ${cert.sessionId.slice(0, 24)}${C.reset}`,
+        cert.kbVersion ? `  ${C.dim}Ontology: Protocol Knowledge Base v${cert.kbVersion} (${cert.kbAssets?.length || 0} stable assets)${C.reset}` : "",
+        cert.kbAssets?.length ? `  ${C.dim}Assets: ${cert.kbAssets.map(a => `${a.name} v${a.version} (${a.confidence}%)`).join(", ")}${C.reset}` : "",
+        `  ${C.dim}Report: npm run governance${C.reset}`,
+        "",
+    ];
+    return lines.join("\n");
+}
+// ── CLI Entry ──
+if (require.main === module) {
+    const args = process.argv.slice(2);
+    const filePath = args.find((a) => !a.startsWith("--"));
+    if (!filePath || args.includes("--help") || args.includes("-h")) {
+        console.log(`
+Progmune AI Code Certificate
+
+Usage:
+  npx ts-node src/certify.ts <file.ts>
+  npx ts-node src/certify.ts --json <file.ts>
+
+Examples:
+  npx ts-node src/certify.ts src/server.ts
+  npx ts-node src/certify.ts --json src/server.ts > certificate.json
+    `);
+        process.exit(0);
+    }
+    const useJson = args.includes("--json");
+    try {
+        const cert = certify(filePath);
+        if (useJson) {
+            console.log(JSON.stringify(cert, null, 2));
+        }
+        else {
+            console.log(formatCertificate(cert));
+        }
+    }
+    catch (e) {
+        console.error(`\n${C.red}❌ ${e.message}${C.reset}\n`);
+        process.exit(1);
+    }
+}

package/dist/check.js

@@ -100,7 +100,7 @@ if (cliArg === "--ledger") {
             }
         }
     }
-    catch { }
+    catch { /* check step — best-effort */ }
     const allTransitions = session.attempts.flatMap(a => a.transitions || []);
     if (allTransitions.length === 0) {
         console.log(`${D("No ledger data in this session.")}`);
@@ -346,7 +346,7 @@ step("4/6 Ledger 不变量");
                     }
                 }
             }
-            catch { }
+            catch { /* check step — best-effort */ }
         }
     }
     if (checked === 0) {
@@ -401,7 +401,7 @@ step("4/6 Ledger 不变量");
                     }
                 }
             }
-            catch { }
+            catch { /* check step — best-effort */ }
         }
         if (invariantFailed) {
             fail("PROGMUNE_STRICT=true — 严格不变量断言发现违规");
@@ -433,7 +433,7 @@ step("4/6 Ledger 不变量");
                     console.log(`     ${Y(`Replay divergence: ${sid.slice(0, 13)}... at index ${result.divergencePoint}`)}`);
                 }
             }
-            catch { }
+            catch { /* check step — best-effort */ }
         }
         if (replayed > 0) {
             const status = replayPassed === replayed