release-skill 0.9.36 → 0.9.38

package/src/commands/route.mjs

@@ -1,3 +1,4 @@
+import { isProvenPreAuthorityFailure } from '../core/pre-authority-failure.mjs';
 /**
  * release-route command: Deterministic quickstart routing for workflow profiles.
  *
@@ -46,7 +47,6 @@ import {
   validateRunCheckpointMapping,
 } from '../core/run.mjs';
 import { computePlanDigest, validatePlan } from '../core/plan.mjs';
-import { resolveProducerVersion } from '../core/evidence.mjs';
 import { normalizePostPublishView, postPublishActionId } from '../core/postpublish.mjs';
 
 const WORKFLOW_KINDS = Object.freeze([
@@ -732,170 +732,13 @@ async function inspectStateDirectory(statesPath) {
   return { ok: true, entries };
 }
 
-async function isProvenPreAuthorityFailure(runDir, runName) {
-  if (!/^publish-/.test(runName)) return false;
-  const summaryPath = join(runDir, 'summary.json');
-  const evidencePath = join(runDir, 'evidence.jsonl');
-  let summary;
-  let events;
-  try {
-    summary = JSON.parse(await readFile(summaryPath, 'utf8'));
-    events = (await readFile(evidencePath, 'utf8')).trim().split('\n').filter(Boolean).map((line) => JSON.parse(line));
-  } catch {
-    return false;
-  }
-
-  // The v1 writer (used before the producer-bound v2 envelope) created the
-  // run directory and appended safety-gate events before its first
-  // `release-run.json` state. A failed global preflight then appended only a
-  // generic `publish` failure and sealed a summary. This branch deliberately
-  // accepts that historical shape only when every byte still proves the same
-  // pre-authority boundary. It never infers safety from a directory name,
-  // mtime, summary alone, or a loosely similar phase.
-  const legacyPreAuthorityPhases = new Set([
-    'safety-gate',
-    'global-preflight-arbitration',
-    're-observe-previous-public-baseline',
-  ]);
-  const legacyInputFailure = /(?:global preflight failed|source authority .*failed|cannot read (?:release plan|approval record)|production (?:publish|commands) require|plan (?:digest mismatch|action completeness gate failed|is not valid|requires)|baseline (?:changed|check failed)|previous-public-baseline|adapter .*failed)/i;
-  const legacyUnsafeFailure = /(?:remote (?:tag|branch|release) .*already exists|human intervention required|remote conflict|external write)/i;
-  const legacyPreAuthorityGates = new Set([
-    'plan-load',
-    'plan-schema',
-    'plan-digest',
-    'action-completeness',
-    'approval-load',
-    'adapter-availability',
-    'baseline-check',
-    'source-authority',
-  ]);
-  const validLegacyTimestamp = (value) => typeof value === 'string'
-    && /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/.test(value)
-    && Number.isFinite(Date.parse(value));
-  const validLegacyError = (error) => error && typeof error === 'object' && !Array.isArray(error)
-    && typeof error.code === 'string' && error.code.length > 0
-    && (error.message === undefined || typeof error.message === 'string');
-  const validLegacyEvent = (event, runId) => event && typeof event === 'object' && !Array.isArray(event)
-    && event.schemaVersion === 1
-    && !Object.hasOwn(event, 'producer')
-    && typeof event.runId === 'string' && event.runId === runId
-    && Number.isSafeInteger(event.sequence) && event.sequence >= 1
-    && validLegacyTimestamp(event.timestamp)
-    && event.command === 'publish'
-    && typeof event.phase === 'string'
-    && (legacyPreAuthorityPhases.has(event.phase) || event.phase === 'publish')
-    && typeof event.status === 'string' && event.status.length > 0
-    && (event.error === undefined || event.error === null || validLegacyError(event.error))
-    && (event.duration === undefined || Number.isSafeInteger(event.duration) && event.duration >= 0)
-    && (event.details === undefined || event.details !== null
-      && typeof event.details === 'object' && !Array.isArray(event.details));
-  const legacyRunId = basename(runDir);
-  const legacyTerminal = events.at(-1);
-  const legacyValid = summary && summary.status === 'FAILED'
-    && validLegacyError(summary.error)
-    && typeof summary.error.message === 'string' && legacyInputFailure.test(summary.error.message)
-    && !legacyUnsafeFailure.test(summary.error.message)
-    && (summary.recoveryActionCode === undefined || summary.recoveryActionCode === 'RETRY_COMMAND')
-    && summary.runPath === undefined
-    && summary.finalRunDigest === undefined
-    && summary.latestStatePath === undefined
-    && summary.checkpointStatuses === undefined
-    && Array.isArray(events) && events.length >= 2
-    && events.every((event, index) => validLegacyEvent(event, legacyRunId)
-      && event.sequence === index + 1)
-    && legacyTerminal.phase === 'publish'
-    && legacyTerminal.status === 'failed'
-    && validLegacyError(legacyTerminal.error)
-    && legacyTerminal.error.code === summary.error.code
-    && events.slice(0, -1).filter((event) => event.status === 'failed').every((event) =>
-      event.phase === 'safety-gate'
-      && legacyPreAuthorityGates.has(event.gate)
-      && validLegacyError(event.error))
-    && !events.some((event) => event.phase === 'global-preflight-arbitration'
-      && event.status !== 'pre-observe')
-    && !events.slice(0, -1).some((event) => event.phase === 'publish'
-      || /checkpoint|execute|postpublish/i.test(event.phase)
-      || Object.hasOwn(event, 'prePersistedRunPath')
-      || Object.hasOwn(event, 'checkpointCount')
-      || Object.hasOwn(event, 'checkpointStatuses'));
-  if (legacyValid) return true;
-
-  const producerVersion = resolveProducerVersion();
-  const sameProducer = (value) => value && typeof value === 'object' && !Array.isArray(value)
-    && Object.keys(value).length === 2
-    && value.name === 'release-skill' && value.version === producerVersion;
-  const envelopeKeys = new Set([
-    'schemaVersion', 'runId', 'sequence', 'timestamp', 'command', 'producer',
-    'phase', 'status', 'error', 'duration', 'details',
-  ]);
-  const validTimestamp = (value) => typeof value === 'string'
-    && /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/.test(value)
-    && Number.isFinite(Date.parse(value));
-  const detailValidators = {
-    unitId: (value) => typeof value === 'string',
-    gate: (value) => typeof value === 'string',
-    hookName: (value) => typeof value === 'string',
-    actionId: (value) => typeof value === 'string',
-    step: (value) => typeof value === 'string',
-    hookId: (value) => typeof value === 'string',
-    tagCommit: (value) => typeof value === 'string',
-    cached: (value) => typeof value === 'boolean',
-    testSelection: (value) => typeof value === 'string',
-    cacheKey: (value) => typeof value === 'string',
-    durationMs: (value) => value === null || Number.isSafeInteger(value) && value >= 0,
-    exitCode: (value) => Number.isSafeInteger(value),
-    findingCount: (value) => Number.isSafeInteger(value) && value >= 0,
-  };
-  const validDetails = (value) => value === undefined
-    || value !== null && typeof value === 'object' && !Array.isArray(value)
-      && Object.entries(value).every(([key, detail]) => !detailValidators[key] || detailValidators[key](detail));
-  const validEnvelope = (event) => event && typeof event === 'object'
-    && Object.keys(event).every((key) => envelopeKeys.has(key))
-    && event.schemaVersion === 2
-    && typeof event.runId === 'string' && event.runId === basename(runDir)
-    && Number.isSafeInteger(event.sequence) && event.sequence >= 1
-    && validTimestamp(event.timestamp)
-    && event.command === 'publish'
-    && typeof event.phase === 'string' && event.phase.length > 0
-    && typeof event.status === 'string' && event.status.length > 0
-    && sameProducer(event.producer)
-    && (event.error === undefined || event.error === null
-      || (typeof event.error === 'object' && !Array.isArray(event.error)
-        && Object.keys(event.error).every((key) => key === 'code' || key === 'message')
-        && typeof event.error.code === 'string' && event.error.code.length > 0
-        && (event.error.message === undefined || typeof event.error.message === 'string')))
-    && (event.duration === undefined || Number.isSafeInteger(event.duration) && event.duration >= 0)
-    && validDetails(event.details);
-  if (summary.status !== 'FAILED' || summary.recoveryActionCode !== 'RETRY_COMMAND'
-    || summary.evidencePath !== 'evidence.jsonl' || !sameProducer(summary.producer)
-    || !Array.isArray(events) || events.length === 0) return false;
-  let previousSequence = 0;
-  let firstFailure = null;
-  let genericFailure = null;
-  for (const event of events) {
-    if (!validEnvelope(event) || event.sequence !== previousSequence + 1) return false;
-    previousSequence = event.sequence;
-    if (event.status === 'failed' && firstFailure === null) firstFailure = event;
-    if (event.phase === 'publish') {
-      if (event.status !== 'failed' || genericFailure !== null || event.details?.prePersistedRunPath
-        || event.details?.recoveryActionCode !== summary.recoveryActionCode) return false;
-      genericFailure = event;
-    } else if (!['safety-gate', 'global-preflight-arbitration'].includes(event.phase)) {
-      return false;
-    }
-  }
-  if (!firstFailure || !genericFailure || events.at(-1) !== genericFailure
-    || summary.evidenceSequence !== firstFailure.sequence
-    || summary.stablePhase !== firstFailure.phase) return false;
-  return !events.some((event) => event.details?.prePersistedRunPath);
-}
 
 /**
  * Postverify is a downstream run type that predates the generic recovery
  * reader. Its completed and open records are consumable only when the summary
  * agrees with the sealed status and the verify parent is fully lineage-valid.
  */
-async function readLegacyPostverifyRecovery(runPath) {
+export async function readLegacyPostverifyRecovery(runPath) {
   try {
     const run = await loadRun(runPath, { requireDigest: true });
     const acceptedStatuses = new Set(['DISTRIBUTED', 'PARTIAL', 'BLOCKED', 'NEEDS_INPUT']);

package/src/commands/verify.mjs

@@ -57,7 +57,7 @@ import {
   consumePublicSourceAuthorityReceipt,
   verifySourceAuthorityReceipt,
 } from '../core/source-authority.mjs';
-import { verifyFrozenFile } from '../snapshot/frozen.mjs';
+import { computeFrozenSnapshot, resolveFrozenPath, verifyFrozenFile } from '../snapshot/frozen.mjs';
 import {
   deriveBaselineAdvances,
   applyBaselineAdvances,
@@ -87,6 +87,7 @@ import {
   checkSkillResourceClosure,
   createSkillResourceClosureReceipt,
   evaluateConsumerSkillResourceClosureReceipts,
+  TRANSPORT_EXCLUSIONS,
 } from '../core/skill-resource-closure.mjs';
 import { deriveSurfaceHostBinding, pluginRootFromManifestRelativePath } from '../core/surface-host-bindings.mjs';
 import { isRemoteWriteAction, isMarketplaceAction } from '../core/checkpoints.mjs';
@@ -131,6 +132,61 @@ export const VERIFICATION_RESOLVED_TYPES = Object.freeze({
   NOT_REQUIRED_UNCHANGED: 'NOT_REQUIRED_UNCHANGED',
 });
 
+/** Ignore only write bits; retain type, size, content, and non-write mode bits. */
+const WRITE_BITS = 0o222;
+const PAYLOAD_CONFLICT_REPORT_CAP = 10;
+
+function transportIdentityEntries(entries) {
+  return entries.map(({ path, type, mode, size, contentDigest }) => ({
+    path,
+    type,
+    mode: mode & ~WRITE_BITS,
+    size,
+    contentDigest,
+  }));
+}
+
+function compareInstallToFrozenTransport(frozenEntries, installedEntries) {
+  const frozen = transportIdentityEntries(frozenEntries);
+  const installed = transportIdentityEntries(installedEntries);
+  const installedByPath = new Map(installed.map((entry) => [entry.path, entry]));
+  const conflicts = [];
+  for (const frozenEntry of frozen) {
+    const installedEntry = installedByPath.get(frozenEntry.path);
+    if (!installedEntry) {
+      conflicts.push(`missing: ${frozenEntry.path}`);
+      continue;
+    }
+    if (installedEntry.type !== frozenEntry.type) {
+      conflicts.push(`type mismatch: ${frozenEntry.path}`);
+    } else if (
+      installedEntry.size !== frozenEntry.size
+      || installedEntry.contentDigest !== frozenEntry.contentDigest
+    ) {
+      conflicts.push(`content mismatch: ${frozenEntry.path}`);
+    } else if (installedEntry.mode !== frozenEntry.mode) {
+      conflicts.push(`mode mismatch: ${frozenEntry.path}`);
+    }
+  }
+  const frozenPaths = new Set(frozen.map((entry) => entry.path));
+  for (const installedEntry of installed) {
+    if (!frozenPaths.has(installedEntry.path)) {
+      conflicts.push(`extra: ${installedEntry.path}`);
+    }
+  }
+  return conflicts;
+}
+
+function frozenSnapshotRelativePath(unit, actions, unitId) {
+  if (typeof unit?.frozenSnapshot?.path === 'string' && unit.frozenSnapshot.path.length > 0) {
+    return unit.frozenSnapshot.path;
+  }
+  const action = (actions ?? []).find((item) => item.unitId === unitId
+    && typeof item.parameters?.snapshotPath === 'string'
+    && item.parameters.snapshotPath.length > 0);
+  return action?.parameters?.snapshotPath ?? null;
+}
+
 /** Verify actionless Cursor distributions through their frozen host contract. */
 export async function verifyCursorHostDistributions({
   plan,
@@ -2265,25 +2321,75 @@ export async function verifyRelease(options) {
             );
           }
           // For single-plugin units (the root-surface distributions this
-          // design covers) the install payload IS the frozen snapshot, so the
-          // recomputed receipt must equal the frozen unit receipt field for
-          // field (checker version, input digest, surface/skill/reference/
-          // finding counts, receipt digest). Record-layer fields (preparedAt,
-          // exitCode) are carried from the frozen receipt — the same rule
-          // publish's recheck uses.
+          // design covers) the install payload IS the frozen snapshot.
+          // Frozen snapshot + original receipt stay on the strict prepare/
+          // publish rule. Install-versus-frozen comparison follows the
+          // existing transport policy (mode & ~0o222) so a sealed 0444
+          // tree may legally reappear as 0644 after marketplace extract.
           const pluginDistCount = (surface.unit?.distributions ?? [])
             .filter((d) => d.type !== 'npm').length;
           if (pluginDistCount === 1 && surface.frozenPluginRoot === '.') {
-            const observedReceipt = createSkillResourceClosureReceipt(closureResult, {
-              unitId: surface.unitId,
-              preparedAt: expectedUnitReceipt.preparedAt ?? null,
-              exitCode: expectedUnitReceipt.exitCode ?? 0,
-            });
-            assertSkillResourceClosureReceipt(
-              expectedUnitReceipt,
-              observedReceipt,
-              `unit "${surface.unitId}"`,
-            );
+            const frozenRel = frozenSnapshotRelativePath(surface.unit, actions, surface.unitId);
+            if (frozenRel) {
+              const frozenDir = await resolveFrozenPath(root, frozenRel, 'frozen snapshot path');
+              const frozenClosure = await checkSkillResourceClosure({
+                snapshotDir: frozenDir,
+                host: surface.host,
+                surfaceHostBindings: [{ surfaceId: surface.surfaceId, host: surface.host }],
+              });
+              const frozenReceipt = createSkillResourceClosureReceipt(frozenClosure, {
+                unitId: surface.unitId,
+                preparedAt: expectedUnitReceipt.preparedAt ?? null,
+                exitCode: expectedUnitReceipt.exitCode ?? 0,
+              });
+              assertSkillResourceClosureReceipt(
+                expectedUnitReceipt,
+                frozenReceipt,
+                `unit "${surface.unitId}"`,
+              );
+              const frozenSnap = await computeFrozenSnapshot(frozenDir, {
+                excludeRootEntries: TRANSPORT_EXCLUSIONS,
+              });
+              const installedSnap = await computeFrozenSnapshot(surface.installPath, {
+                excludeRootEntries: TRANSPORT_EXCLUSIONS,
+              });
+              const conflicts = compareInstallToFrozenTransport(
+                frozenSnap.entries,
+                installedSnap.entries,
+              );
+              await evidence.append({
+                phase: 'verify',
+                step: 'skill-resource-closure',
+                status: 'install-comparison',
+                unitId: surface.unitId,
+                frozenInputDigest: frozenSnap.digest,
+                installedInputDigest: installedSnap.digest,
+                frozenModes: frozenSnap.entries.map((entry) => ({ path: entry.path, mode: entry.mode })),
+                installedModes: installedSnap.entries.map((entry) => ({ path: entry.path, mode: entry.mode })),
+              });
+              if (conflicts.length > 0) {
+                const listed = conflicts.slice(0, PAYLOAD_CONFLICT_REPORT_CAP).join('; ');
+                const overflow = conflicts.length > PAYLOAD_CONFLICT_REPORT_CAP
+                  ? `; and ${conflicts.length - PAYLOAD_CONFLICT_REPORT_CAP} more conflicting path(s)`
+                  : '';
+                throw new ReleaseError(
+                  POST_PUBLISH_VERIFY_FAILED,
+                  `installed plugin root differs in path, bytes, size, or non-write mode bits for unit "${surface.unitId}": ${listed}${overflow}`,
+                  { unitId: surface.unitId, conflicts },
+                );
+              }
+            } else {
+              const observedReceipt = createSkillResourceClosureReceipt(closureResult, {
+                unitId: surface.unitId,
+                preparedAt: expectedUnitReceipt.preparedAt ?? null,
+                exitCode: expectedUnitReceipt.exitCode ?? 0,
+              });
+              assertSkillResourceClosureReceipt(
+                expectedUnitReceipt,
+                observedReceipt,
+                `unit "${surface.unitId}"`,
+              );
+            }
           }
         }
         skillResourceClosureReceipts.push(createSkillResourceClosureReceipt(