scene-capability-engine 3.6.45 → 3.6.46

package/scripts/release-asset-integrity-check.js

@@ -0,0 +1,216 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+function appendSummary(summaryPath, lines = []) {
+  if (!summaryPath) {
+    return;
+  }
+  fs.appendFileSync(summaryPath, `${lines.join('\n')}\n\n`, 'utf8');
+}
+
+function readValue(env, name, fallback = '') {
+  const value = env[name];
+  return value === undefined || value === null ? fallback : `${value}`.trim();
+}
+
+function parseBoolean(raw, fallback) {
+  const value = `${raw || ''}`.trim().toLowerCase();
+  if (!value) {
+    return fallback;
+  }
+  if (['1', 'true', 'yes', 'y', 'on'].includes(value)) {
+    return true;
+  }
+  if (['0', 'false', 'no', 'n', 'off'].includes(value)) {
+    return false;
+  }
+  return fallback;
+}
+
+function normalizeRequiredFiles(raw, tag) {
+  const defaultList = [
+    'release-gate-{tag}.json',
+    'release-gate-history-{tag}.json',
+    'release-gate-history-{tag}.md',
+    'governance-snapshot-{tag}.json',
+    'governance-snapshot-{tag}.md',
+    'weekly-ops-summary-{tag}.json',
+    'weekly-ops-summary-{tag}.md',
+    'release-risk-remediation-{tag}.json',
+    'release-risk-remediation-{tag}.md',
+    'release-risk-remediation-{tag}.lines'
+  ];
+  const source = raw
+    ? `${raw}`
+      .split(',')
+      .map(item => item.trim())
+      .filter(Boolean)
+    : defaultList;
+  const normalizedTag = `${tag || ''}`.trim();
+  return source.map(item => item.replace(/\{tag\}/g, normalizedTag));
+}
+
+function mergeGateReport(gateReportFile, payload) {
+  if (!gateReportFile) {
+    return;
+  }
+  let gatePayload = {};
+  try {
+    if (fs.existsSync(gateReportFile)) {
+      gatePayload = JSON.parse(fs.readFileSync(gateReportFile, 'utf8'));
+    }
+  } catch (_error) {
+    gatePayload = {};
+  }
+  gatePayload.asset_integrity = payload;
+  gatePayload.updated_at = payload.evaluated_at;
+  fs.writeFileSync(gateReportFile, `${JSON.stringify(gatePayload, null, 2)}\n`, 'utf8');
+}
+
+function evaluateReleaseAssetIntegrity(options = {}) {
+  const env = options.env && typeof options.env === 'object'
+    ? options.env
+    : process.env;
+  const now = typeof options.now === 'function'
+    ? options.now
+    : () => new Date().toISOString();
+
+  const tag = readValue(env, 'RELEASE_TAG', '');
+  const baseDir = readValue(env, 'RELEASE_ASSET_INTEGRITY_DIR', '.sce/reports/release-evidence');
+  const required = normalizeRequiredFiles(readValue(env, 'RELEASE_ASSET_INTEGRITY_REQUIRED_FILES', ''), tag);
+  const enforce = parseBoolean(readValue(env, 'RELEASE_ASSET_INTEGRITY_ENFORCE', ''), true);
+  const requireNonEmpty = parseBoolean(readValue(env, 'RELEASE_ASSET_INTEGRITY_REQUIRE_NON_EMPTY', ''), true);
+  const reportJsonFile = readValue(env, 'RELEASE_ASSET_INTEGRITY_REPORT_JSON', '');
+  const reportMarkdownFile = readValue(env, 'RELEASE_ASSET_INTEGRITY_REPORT_MD', '');
+  const gateReportFile = readValue(env, 'RELEASE_GATE_REPORT_FILE', '');
+  const summaryPath = readValue(env, 'GITHUB_STEP_SUMMARY', '');
+
+  const missingFiles = [];
+  const emptyFiles = [];
+  const presentFiles = [];
+
+  for (const rel of required) {
+    const absolute = path.resolve(baseDir, rel);
+    const exists = fs.existsSync(absolute);
+    if (!exists) {
+      missingFiles.push(rel);
+      continue;
+    }
+    const stat = fs.statSync(absolute);
+    if (requireNonEmpty && (!stat || stat.size <= 0)) {
+      emptyFiles.push(rel);
+      continue;
+    }
+    presentFiles.push({
+      file: rel,
+      size: stat.size
+    });
+  }
+
+  const violations = [
+    ...missingFiles.map(item => `missing asset: ${item}`),
+    ...emptyFiles.map(item => `empty asset: ${item}`)
+  ];
+  const passed = violations.length === 0;
+  const blocked = enforce && !passed;
+  const evaluatedAt = now();
+
+  const payload = {
+    mode: 'release-asset-integrity-check',
+    evaluated_at: evaluatedAt,
+    tag: tag || null,
+    dir: baseDir,
+    enforce,
+    require_non_empty: requireNonEmpty,
+    required_count: required.length,
+    required_files: required,
+    present_count: presentFiles.length,
+    present_files: presentFiles,
+    missing_files: missingFiles,
+    empty_files: emptyFiles,
+    violations,
+    passed,
+    blocked
+  };
+
+  if (reportJsonFile) {
+    fs.mkdirSync(path.dirname(reportJsonFile), { recursive: true });
+    fs.writeFileSync(reportJsonFile, `${JSON.stringify(payload, null, 2)}\n`, 'utf8');
+  }
+
+  if (reportMarkdownFile) {
+    const lines = [
+      '# Release Asset Integrity Check',
+      '',
+      `- Tag: ${payload.tag || 'n/a'}`,
+      `- Directory: ${payload.dir}`,
+      `- Enforce: ${payload.enforce}`,
+      `- Require non-empty: ${payload.require_non_empty}`,
+      `- Passed: ${payload.passed}`,
+      `- Required: ${payload.required_count}`,
+      `- Present: ${payload.present_count}`,
+      `- Missing: ${payload.missing_files.length}`,
+      `- Empty: ${payload.empty_files.length}`
+    ];
+    if (payload.violations.length > 0) {
+      lines.push('', '## Violations');
+      payload.violations.forEach(item => lines.push(`- ${item}`));
+    }
+    fs.mkdirSync(path.dirname(reportMarkdownFile), { recursive: true });
+    fs.writeFileSync(reportMarkdownFile, `${lines.join('\n')}\n`, 'utf8');
+  }
+
+  mergeGateReport(gateReportFile, payload);
+
+  const summaryLines = [
+    '## Release Asset Integrity',
+    '',
+    `- enforce: ${enforce}`,
+    `- required assets: ${required.length}`,
+    `- present assets: ${presentFiles.length}`,
+    `- missing assets: ${missingFiles.length}`,
+    `- empty assets: ${emptyFiles.length}`,
+    `- passed: ${passed}`
+  ];
+  if (violations.length > 0) {
+    summaryLines.push('', '### Violations');
+    violations.forEach(item => summaryLines.push(`- ${item}`));
+  }
+  appendSummary(summaryPath, summaryLines);
+
+  console.log(
+    `[release-asset-integrity] enforce=${enforce} required=${required.length} present=${presentFiles.length} missing=${missingFiles.length} empty=${emptyFiles.length}`
+  );
+  if (!passed) {
+    console.error(`[release-asset-integrity] violations=${violations.join('; ')}`);
+  } else {
+    console.log('[release-asset-integrity] passed');
+  }
+  if (reportJsonFile) {
+    console.log(`[release-asset-integrity] json=${reportJsonFile}`);
+  }
+  if (reportMarkdownFile) {
+    console.log(`[release-asset-integrity] markdown=${reportMarkdownFile}`);
+  }
+
+  return {
+    exit_code: blocked ? 1 : 0,
+    blocked,
+    passed,
+    violations,
+    payload
+  };
+}
+
+if (require.main === module) {
+  const result = evaluateReleaseAssetIntegrity();
+  process.exit(result.exit_code);
+}
+
+module.exports = {
+  evaluateReleaseAssetIntegrity
+};
+

package/scripts/release-asset-nonempty-normalize.js

@@ -0,0 +1,166 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+function resolveKind(filePath, explicitKind = 'auto') {
+  const kind = `${explicitKind || 'auto'}`.trim().toLowerCase();
+  if (kind && kind !== 'auto') {
+    return kind;
+  }
+  if (/\.jsonl$/i.test(filePath)) {
+    return 'jsonl';
+  }
+  if (/\.json$/i.test(filePath)) {
+    return 'json';
+  }
+  if (/\.lines$/i.test(filePath)) {
+    return 'lines';
+  }
+  return 'text';
+}
+
+function buildPlaceholder(filePath, kind, options = {}) {
+  const note = `${options.note || ''}`.trim();
+  const event = `${options.event || 'release-asset-placeholder'}`.trim();
+  const now = typeof options.now === 'function'
+    ? options.now
+    : () => new Date().toISOString();
+  const baseNote = note || `placeholder for ${path.basename(filePath)}`;
+  if (kind === 'json' || kind === 'jsonl') {
+    return `${JSON.stringify({
+      event,
+      note: baseNote,
+      generated_at: now()
+    })}\n`;
+  }
+  return `# ${baseNote}\n`;
+}
+
+function normalizeNonEmptyAssets(options = {}) {
+  const files = Array.isArray(options.files)
+    ? options.files.map(item => `${item || ''}`.trim()).filter(Boolean)
+    : [];
+  if (files.length === 0) {
+    throw new Error('at least one --file is required');
+  }
+
+  const dryRun = Boolean(options.dryRun);
+  const kindInput = options.kind || 'auto';
+  const details = [];
+
+  for (const file of files) {
+    const absolute = path.resolve(file);
+    const kind = resolveKind(absolute, kindInput);
+    const exists = fs.existsSync(absolute);
+    const size = exists ? fs.statSync(absolute).size : 0;
+    const needsPlaceholder = !exists || size <= 0;
+    let action = 'kept';
+    let writtenBytes = 0;
+
+    if (needsPlaceholder) {
+      action = exists ? 'filled-empty' : 'created-placeholder';
+      const content = buildPlaceholder(absolute, kind, options);
+      writtenBytes = Buffer.byteLength(content, 'utf8');
+      if (!dryRun) {
+        fs.mkdirSync(path.dirname(absolute), { recursive: true });
+        fs.writeFileSync(absolute, content, 'utf8');
+      }
+    }
+
+    details.push({
+      file,
+      absolute_path: absolute,
+      kind,
+      existed: exists,
+      previous_size: size,
+      action,
+      written_bytes: writtenBytes
+    });
+  }
+
+  const createdCount = details.filter(item => item.action === 'created-placeholder').length;
+  const filledCount = details.filter(item => item.action === 'filled-empty').length;
+  const keptCount = details.filter(item => item.action === 'kept').length;
+
+  return {
+    mode: 'release-asset-nonempty-normalize',
+    dry_run: dryRun,
+    total: details.length,
+    created_placeholders: createdCount,
+    filled_empty_files: filledCount,
+    kept_existing_files: keptCount,
+    details
+  };
+}
+
+function parseArgs(argv = []) {
+  const options = {
+    files: [],
+    kind: 'auto',
+    note: '',
+    event: '',
+    dryRun: false,
+    json: false
+  };
+
+  for (let i = 0; i < argv.length; i += 1) {
+    const token = argv[i];
+    if (token === '--file') {
+      options.files.push(argv[i + 1] || '');
+      i += 1;
+      continue;
+    }
+    if (token === '--kind') {
+      options.kind = argv[i + 1] || 'auto';
+      i += 1;
+      continue;
+    }
+    if (token === '--note') {
+      options.note = argv[i + 1] || '';
+      i += 1;
+      continue;
+    }
+    if (token === '--event') {
+      options.event = argv[i + 1] || '';
+      i += 1;
+      continue;
+    }
+    if (token === '--dry-run') {
+      options.dryRun = true;
+      continue;
+    }
+    if (token === '--json') {
+      options.json = true;
+      continue;
+    }
+    if (token === '-h' || token === '--help') {
+      console.log([
+        'Usage:',
+        '  node scripts/release-asset-nonempty-normalize.js --file <path> [--file <path> ...] [--kind auto|json|jsonl|lines|text] [--note <text>] [--event <event>] [--dry-run] [--json]'
+      ].join('\n'));
+      process.exit(0);
+    }
+  }
+  return options;
+}
+
+if (require.main === module) {
+  const options = parseArgs(process.argv.slice(2));
+  const payload = normalizeNonEmptyAssets(options);
+  if (options.json) {
+    process.stdout.write(`${JSON.stringify(payload, null, 2)}\n`);
+  } else {
+    process.stdout.write(
+      `[release-asset-nonempty-normalize] total=${payload.total} created=${payload.created_placeholders} filled=${payload.filled_empty_files} kept=${payload.kept_existing_files}\n`
+    );
+  }
+}
+
+module.exports = {
+  buildPlaceholder,
+  normalizeNonEmptyAssets,
+  parseArgs,
+  resolveKind
+};

package/scripts/release-drift-evaluate.js

@@ -0,0 +1,223 @@
+'use strict';
+
+const fs = require('fs');
+const {
+  buildReleaseDriftSignals,
+  parseBoolean,
+  resolveReleaseDriftThresholds
+} = require('./release-drift-signals');
+
+function appendSummary(summaryPath, lines = []) {
+  if (!summaryPath) {
+    return;
+  }
+  fs.appendFileSync(summaryPath, `${lines.join('\n')}\n\n`, 'utf8');
+}
+
+function buildThresholdPayload(thresholds) {
+  return {
+    fail_streak_min: thresholds.failStreakMin,
+    high_risk_share_min_percent: thresholds.highRiskShareMinPercent,
+    high_risk_share_delta_min_percent: thresholds.highRiskShareDeltaMinPercent,
+    preflight_block_rate_min_percent: thresholds.preflightBlockRateMinPercent,
+    hard_gate_block_streak_min: thresholds.hardGateBlockStreakMin,
+    preflight_unavailable_streak_min: thresholds.preflightUnavailableStreakMin,
+    capability_expected_unknown_rate_min_percent: thresholds.capabilityExpectedUnknownRateMinPercent,
+    capability_provided_unknown_rate_min_percent: thresholds.capabilityProvidedUnknownRateMinPercent
+  };
+}
+
+function evaluateReleaseDrift(options = {}) {
+  const env = options.env && typeof options.env === 'object'
+    ? options.env
+    : process.env;
+  const now = typeof options.now === 'function'
+    ? options.now
+    : () => new Date().toISOString();
+  const historyFile = env.RELEASE_DRIFT_HISTORY_FILE;
+  const gateReportFile = env.RELEASE_GATE_REPORT_FILE;
+  const summaryPath = env.GITHUB_STEP_SUMMARY;
+  const enforce = parseBoolean(env.RELEASE_DRIFT_ENFORCE, false);
+  const thresholds = resolveReleaseDriftThresholds(env);
+
+  if (!historyFile || !fs.existsSync(historyFile)) {
+    const msg = `[release-drift] history summary missing: ${historyFile || 'n/a'}`;
+    console.warn(msg);
+    appendSummary(summaryPath, ['## Release Drift Alerts', '', `- ${msg}`]);
+    return {
+      exit_code: 0,
+      blocked: false,
+      alerts: [],
+      warning: msg,
+      drift: null
+    };
+  }
+
+  let payload = null;
+  try {
+    payload = JSON.parse(fs.readFileSync(historyFile, 'utf8'));
+  } catch (error) {
+    const msg = `[release-drift] failed to parse history summary: ${error.message}`;
+    console.warn(msg);
+    appendSummary(summaryPath, ['## Release Drift Alerts', '', `- ${msg}`]);
+    return {
+      exit_code: 0,
+      blocked: false,
+      alerts: [],
+      warning: msg,
+      drift: null
+    };
+  }
+
+  const signals = buildReleaseDriftSignals(payload, { thresholds });
+  const {
+    alerts,
+    failedStreak,
+    hardGateBlockedStreak,
+    highRiskDeltaPercent,
+    highRiskShare,
+    preflightUnavailableStreak,
+    recentCapabilityExpectedUnknownKnown,
+    recentCapabilityExpectedUnknownPositive,
+    recentCapabilityExpectedUnknownRate,
+    recentCapabilityProvidedUnknownKnown,
+    recentCapabilityProvidedUnknownPositive,
+    recentCapabilityProvidedUnknownRate,
+    recentPreflightBlocked,
+    recentPreflightBlockedRate,
+    recentPreflightKnown,
+    windows
+  } = signals;
+  const blocked = enforce && alerts.length > 0;
+  const evaluatedAt = now();
+
+  const driftPayload = {
+    enforce,
+    thresholds: buildThresholdPayload(thresholds),
+    metrics: {
+      failed_streak_latest5: failedStreak,
+      high_risk_share_latest5_percent: highRiskShare,
+      high_risk_share_delta_percent: highRiskDeltaPercent,
+      preflight_known_latest5: recentPreflightKnown,
+      preflight_blocked_latest5: recentPreflightBlocked,
+      preflight_blocked_rate_latest5_percent: recentPreflightBlockedRate,
+      hard_gate_blocked_streak_latest5: hardGateBlockedStreak,
+      preflight_unavailable_streak_latest5: preflightUnavailableStreak,
+      capability_expected_unknown_known_latest5: recentCapabilityExpectedUnknownKnown,
+      capability_expected_unknown_positive_latest5: recentCapabilityExpectedUnknownPositive,
+      capability_expected_unknown_positive_rate_latest5_percent: recentCapabilityExpectedUnknownRate,
+      capability_provided_unknown_known_latest5: recentCapabilityProvidedUnknownKnown,
+      capability_provided_unknown_positive_latest5: recentCapabilityProvidedUnknownPositive,
+      capability_provided_unknown_positive_rate_latest5_percent: recentCapabilityProvidedUnknownRate,
+      recent_window_size: windows.recent,
+      short_window_size: windows.short,
+      long_window_size: windows.long
+    },
+    alerts,
+    alert_count: alerts.length,
+    blocked,
+    evaluated_at: evaluatedAt
+  };
+
+  console.log(
+    `[release-drift] enforce=${enforce} fail_streak_threshold=${thresholds.failStreakMin} `
+    + `high_share_threshold=${thresholds.highRiskShareMinPercent}% `
+    + `high_delta_threshold=${thresholds.highRiskShareDeltaMinPercent}% `
+    + `preflight_block_rate_threshold=${thresholds.preflightBlockRateMinPercent}% `
+    + `hard_gate_block_streak_threshold=${thresholds.hardGateBlockStreakMin} `
+    + `preflight_unavailable_streak_threshold=${thresholds.preflightUnavailableStreakMin} `
+    + `cap_expected_unknown_rate_threshold=${thresholds.capabilityExpectedUnknownRateMinPercent}% `
+    + `cap_provided_unknown_rate_threshold=${thresholds.capabilityProvidedUnknownRateMinPercent}%`
+  );
+  console.log(
+    `[release-drift] metrics failed_streak=${failedStreak} high_share=${highRiskShare}% `
+    + `high_delta=${highRiskDeltaPercent}% `
+    + `preflight_block_rate=${recentPreflightBlockedRate === null ? 'n/a' : `${recentPreflightBlockedRate}%`} `
+    + `hard_gate_block_streak=${hardGateBlockedStreak} `
+    + `preflight_unavailable_streak=${preflightUnavailableStreak} `
+    + `cap_expected_unknown_rate=${recentCapabilityExpectedUnknownRate === null ? 'n/a' : `${recentCapabilityExpectedUnknownRate}%`} `
+    + `cap_provided_unknown_rate=${recentCapabilityProvidedUnknownRate === null ? 'n/a' : `${recentCapabilityProvidedUnknownRate}%`}`
+  );
+  if (alerts.length > 0) {
+    alerts.forEach(item => console.warn(`[release-drift] alert=${item}`));
+  } else {
+    console.log('[release-drift] no drift alerts');
+  }
+
+  if (gateReportFile) {
+    let gatePayload = {};
+    try {
+      if (fs.existsSync(gateReportFile)) {
+        gatePayload = JSON.parse(fs.readFileSync(gateReportFile, 'utf8'));
+      }
+    } catch (_error) {
+      gatePayload = {};
+    }
+    gatePayload.drift = driftPayload;
+    gatePayload.updated_at = evaluatedAt;
+    fs.writeFileSync(gateReportFile, `${JSON.stringify(gatePayload, null, 2)}\n`, 'utf8');
+    console.log(`[release-drift] merged drift into gate report: ${gateReportFile}`);
+  }
+
+  const summaryLines = [
+    '## Release Drift Alerts',
+    '',
+    `- enforce: ${enforce}`,
+    `- fail streak threshold: ${thresholds.failStreakMin}`,
+    `- high risk share threshold: ${thresholds.highRiskShareMinPercent}%`,
+    `- high risk delta threshold: ${thresholds.highRiskShareDeltaMinPercent}%`,
+    `- release preflight blocked rate threshold: ${thresholds.preflightBlockRateMinPercent}%`,
+    `- hard-gate blocked streak threshold: ${thresholds.hardGateBlockStreakMin}`,
+    `- preflight unavailable streak threshold: ${thresholds.preflightUnavailableStreakMin}`,
+    `- capability expected unknown rate threshold: ${thresholds.capabilityExpectedUnknownRateMinPercent}%`,
+    `- capability provided unknown rate threshold: ${thresholds.capabilityProvidedUnknownRateMinPercent}%`,
+    `- failed streak (latest 5): ${failedStreak}`,
+    `- high risk share (latest 5): ${highRiskShare}%`,
+    `- high risk delta (short-long): ${highRiskDeltaPercent}%`,
+    `- release preflight blocked ratio (latest 5): ${
+      recentPreflightKnown === 0
+        ? 'n/a'
+        : `${recentPreflightBlocked}/${recentPreflightKnown} (${recentPreflightBlockedRate}%)`
+    }`,
+    `- hard-gate blocked streak (latest 5): ${hardGateBlockedStreak}`,
+    `- preflight unavailable streak (latest 5): ${preflightUnavailableStreak}`,
+    `- capability expected unknown ratio (latest 5): ${
+      recentCapabilityExpectedUnknownKnown === 0
+        ? 'n/a'
+        : `${recentCapabilityExpectedUnknownPositive}/${recentCapabilityExpectedUnknownKnown} (${recentCapabilityExpectedUnknownRate}%)`
+    }`,
+    `- capability provided unknown ratio (latest 5): ${
+      recentCapabilityProvidedUnknownKnown === 0
+        ? 'n/a'
+        : `${recentCapabilityProvidedUnknownPositive}/${recentCapabilityProvidedUnknownKnown} (${recentCapabilityProvidedUnknownRate}%)`
+    }`
+  ];
+  if (alerts.length === 0) {
+    summaryLines.push('', '- no alerts');
+  } else {
+    summaryLines.push('', '### Alerts');
+    alerts.forEach(item => summaryLines.push(`- ${item}`));
+  }
+  appendSummary(summaryPath, summaryLines);
+
+  if (blocked) {
+    console.error(`[release-drift] blocked by drift alerts: ${alerts.join('; ')}`);
+  }
+
+  return {
+    exit_code: blocked ? 1 : 0,
+    blocked,
+    alerts,
+    warning: null,
+    drift: driftPayload
+  };
+}
+
+if (require.main === module) {
+  const result = evaluateReleaseDrift();
+  process.exit(result.exit_code);
+}
+
+module.exports = {
+  evaluateReleaseDrift
+};