technical-debt-engine-runtime 0.1.0__py3-none-any.whl

tde_runtime/release_publication.py

@@ -0,0 +1,114 @@
+"""Read-only validation for publication of a certified release bundle."""
+from __future__ import annotations
+
+from hashlib import sha256
+import json
+from pathlib import Path
+from typing import Any, Mapping
+
+from .release_bundle import digest, verify
+
+
+PUBLICATION_TARGETS = frozenset({"github_release", "pypi", "docker_hub"})
+REQUIRED_CONTENT_KINDS = frozenset({
+    "wheel", "source_distribution", "oci_archive", "docker_provenance",
+    "release_manifest", "release_qualification", "release_certification", "release_evidence",
+})
+
+
+def canonical(value: Mapping[str, Any]) -> bytes:
+    return (json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=True) + "\n").encode("utf-8")
+
+
+def validate_authorization(value: object, candidate_sha: str, release_version: str,
+                           bundle_id: str, bundle_checksum: str) -> list[str]:
+    """Validate the shape and binding of an authorization assertion, not its approval."""
+    if not isinstance(value, dict):
+        return ["authorization must be a JSON object"]
+    errors = []
+    for key in ("authorizedBy", "authorizedAt", "candidateSha", "releaseVersion", "bundleId", "bundleChecksum", "targets"):
+        if key not in value: errors.append(f"authorization is missing {key}")
+    if errors: return errors
+    if not isinstance(value["authorizedBy"], str) or not value["authorizedBy"].strip(): errors.append("authorization authorizedBy must be non-empty")
+    if not isinstance(value["authorizedAt"], str) or not value["authorizedAt"].strip(): errors.append("authorization authorizedAt must be non-empty")
+    expected = {"candidateSha": candidate_sha, "releaseVersion": release_version,
+                "bundleId": bundle_id, "bundleChecksum": bundle_checksum}
+    for key, expected_value in expected.items():
+        if value[key] != expected_value: errors.append(f"authorization {key} does not bind the selected bundle")
+    if not isinstance(value["targets"], list) or set(value["targets"]) != PUBLICATION_TARGETS or len(value["targets"]) != len(PUBLICATION_TARGETS):
+        errors.append("authorization targets must be exactly github_release, pypi, and docker_hub")
+    return errors
+
+
+def validate_authorization_record(value: object, candidate_sha: str, release_version: str,
+                                  bundle_id: str, bundle_checksum: str) -> list[str]:
+    """Validate an immutable, target-specific human authorization record."""
+    if not isinstance(value, dict): return ["authorization record must be a JSON object"]
+    errors = validate_authorization(value, candidate_sha, release_version, bundle_id, bundle_checksum)
+    if value.get("schemaId") != "tde.internal-release-authorization": errors.append("authorization record has an invalid schema")
+    for key in ("authorizationId", "approvedGitTag", "approvedGitHubRelease", "approvedPyPI", "approvedDockerHub", "protectedEnvironment", "publicationWorkflow"):
+        if key not in value: errors.append(f"authorization record is missing {key}")
+    approvals = value.get("targetApprovals")
+    if not isinstance(approvals, dict):
+        errors.append("authorization record must contain targetApprovals")
+    elif set(approvals) != PUBLICATION_TARGETS or any(item is not True for item in approvals.values()):
+        errors.append("every publication target requires an explicit approved state")
+    expected = {"approvedGitTag": release_version, "approvedGitHubRelease": release_version,
+                "approvedPyPI": release_version, "approvedDockerHub": f"docker.io/pcvantol/technical-debt-engine:{release_version}"}
+    for key, expected_value in expected.items():
+        if value.get(key) != expected_value: errors.append(f"authorization record {key} does not match the approved release")
+    if value.get("protectedEnvironment") != "internal-release": errors.append("authorization record does not bind internal-release")
+    if value.get("publicationWorkflow") != ".github/workflows/internal-release-publish.yml": errors.append("authorization record does not bind the publication workflow")
+    unsigned = {key: item for key, item in value.items() if key != "authorizationId"}
+    expected_id = "authorization.sha256." + sha256(canonical(unsigned)).hexdigest()
+    if value.get("authorizationId") != expected_id: errors.append("authorization record identity does not match its immutable content")
+    return errors
+
+
+def _report(value: object) -> Mapping[str, Any]:
+    if not isinstance(value, dict): raise ValueError("evidence must be a JSON object")
+    return value.get("releaseQualificationEvidence", value) if isinstance(value.get("releaseQualificationEvidence", value), dict) else value
+
+
+def verify_publication_bundle(root: str | Path, candidate_sha: str, release_version: str,
+                              authorization: object) -> dict[str, Any]:
+    """Validate existing bundle/evidence and return deterministic preflight evidence."""
+    directory = Path(root)
+    verified = verify(directory)
+    bundle = verified["bundle"]
+    errors: list[str] = []
+    if not verified["integrity"]: errors.append("bundle checksum or required bundle files are invalid")
+    if not verified["complete"]: errors.append("bundle is incomplete")
+    if bundle.get("candidateSha") != candidate_sha: errors.append("bundle candidate SHA does not match workflow input")
+    if bundle.get("bundleVersion") != release_version: errors.append("bundle version does not match workflow input")
+    contents = bundle.get("contents", [])
+    by_kind = {item.get("kind"): item for item in contents if isinstance(item, dict)} if isinstance(contents, list) else {}
+    missing = sorted(REQUIRED_CONTENT_KINDS - set(by_kind))
+    if missing: errors.append("bundle is missing required identities: " + ", ".join(missing))
+    for kind, item in by_kind.items():
+        filename, expected = item.get("filename"), item.get("digest")
+        if not isinstance(filename, str) or not isinstance(expected, str) or not (directory / filename).is_file() or digest(directory / filename) != expected:
+            errors.append(f"artifact identity is invalid: {kind}")
+    qualification = certification = {}
+    try:
+        qualification = _report(json.loads((directory / by_kind["release_qualification"]["filename"]).read_text(encoding="utf-8")))
+        certification = _report(json.loads((directory / by_kind["release_certification"]["filename"]).read_text(encoding="utf-8")))
+        if qualification.get("decision") != "RELEASE_QUALIFIED" or qualification.get("releaseDecision") != "READY": errors.append("release qualification is not READY")
+        qualified_sha = qualification.get("releaseCandidate", {}).get("sha")
+        certified_sha = certification.get("candidate", {}).get("sha")
+        if qualified_sha != candidate_sha or certified_sha != candidate_sha: errors.append("qualification or certification candidate identity does not match")
+        if certification.get("decision") != "RELEASE_CERTIFIED": errors.append("release certification is not certified")
+    except (OSError, KeyError, TypeError, ValueError, json.JSONDecodeError):
+        errors.append("release qualification or certification evidence is unreadable")
+    errors.extend(validate_authorization(authorization, candidate_sha, release_version,
+                                         str(bundle.get("bundleId", "")), str(bundle.get("bundleChecksum", ""))))
+    evidence = {"schemaId": "tde.internal-release-publication-preflight", "schemaVersion": "1.0.0",
+                "candidateSha": candidate_sha, "releaseVersion": release_version,
+                "bundleId": bundle.get("bundleId"), "bundleChecksum": bundle.get("bundleChecksum"),
+                "bundleIntegrity": verified["integrity"], "bundleComplete": verified["complete"],
+                "publicationTargets": sorted(PUBLICATION_TARGETS), "dryRun": True,
+                "authorizationStructureValid": not validate_authorization(authorization, candidate_sha, release_version, str(bundle.get("bundleId", "")), str(bundle.get("bundleChecksum", ""))),
+                "decision": "PUBLICATION_PREFLIGHT_READY" if not errors else "PUBLICATION_PREFLIGHT_BLOCKED", "errors": errors}
+    unsigned = dict(evidence)
+    evidence["publicationEvidenceId"] = "publication-preflight.sha256." + sha256(canonical(unsigned)).hexdigest()
+    return evidence

tde_runtime/release_qualification.py

@@ -0,0 +1,115 @@
+"""Evidence-only release qualification with explicit capability selection."""
+from __future__ import annotations
+
+from hashlib import sha256
+import json
+import os
+from pathlib import Path
+import subprocess
+from typing import Any, Mapping, Sequence
+
+from .runtime import EVIDENCE_SCHEMA_VERSION, RUNTIME_VERSION
+from .software_assurance import SoftwareAssurance
+from .trusted_delivery import TrustedDelivery
+
+
+def _git(root: Path, *args: str) -> str:
+    return subprocess.run(["git", "-C", str(root), *args], text=True, capture_output=True, check=False).stdout.strip()
+
+
+def _candidate_branch(root: Path) -> str:
+    """Preserve the validated mainline branch when an exact SHA is detached."""
+    return _git(root, "branch", "--show-current") or os.environ.get("TDE_CANDIDATE_SOURCE_BRANCH", "")
+
+
+def _canonical(value: Mapping[str, Any]) -> bytes:
+    return (json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=True) + "\n").encode()
+
+
+def _write(path: Path, value: Mapping[str, Any]) -> str:
+    raw = _canonical(value)
+    if path.exists() and path.read_bytes() != raw:
+        raise ValueError(f"refusing to overwrite immutable release evidence: {path}")
+    path.write_bytes(raw)
+    return "sha256:" + sha256(raw).hexdigest()
+
+
+class ReleaseQualification:
+    """Compose already-generated evidence into a qualified, immutable release record."""
+
+    def qualify(self, root: str | Path, runtime_evidence: Mapping[str, Any], artifact_directories: Sequence[str | Path],
+                manifest_output: str | Path, selected_capabilities: Sequence[str] = (), docker_artifact_directory: str | Path | None = None) -> dict[str, Any]:
+        root = Path(root).resolve()
+        output = Path(manifest_output).resolve()
+        output.parent.mkdir(parents=True, exist_ok=True)
+        selection = sorted(set(selected_capabilities))
+        candidate = {
+            "sha": _git(root, "rev-parse", "HEAD"),
+            "repository": _git(root, "config", "--get", "remote.origin.url") or "local",
+            "branch": _candidate_branch(root),
+            "runtimeVersion": RUNTIME_VERSION,
+            "schemaVersion": EVIDENCE_SCHEMA_VERSION,
+            "selectedCapabilities": selection,
+            "policyVersion": runtime_evidence.get("policyEvidence", {}).get("policy", {}).get("version"),
+        }
+        assurance = SoftwareAssurance().assure(root, list(artifact_directories), docker_artifact_directory)
+        artifacts = [item for record in assurance["artifacts"]["records"] for item in record["artifacts"]]
+        delivery_manifest = {"schemaId": "tde.trusted-delivery-manifest", "schemaVersion": "1.0.0",
+                             "candidate": {key: candidate[key] for key in ("sha", "repository", "branch")}, "artifacts": artifacts}
+        delivery_path = output.with_name(output.stem + ".trusted-delivery.json")
+        _write(delivery_path, delivery_manifest)
+        delivery = TrustedDelivery().validate(root, runtime_evidence, assurance, delivery_path)
+        qualification = runtime_evidence.get("runtimeQualification", {})
+        policy = runtime_evidence.get("policyEvidence", {})
+        executed = set(runtime_evidence.get("executionEvidence", {}).get("executedCapabilities", []))
+        required_executed = bool(selection) and set(selection).issubset(executed)
+        checks = {
+            "candidateIdentity": bool(candidate["sha"]),
+            "capabilitySelection": bool(selection),
+            "artifactIntegrity": assurance["checks"]["artifactIntegrity"],
+            "buildReproducibility": assurance["checks"]["buildProvenanceVerification"],
+            "softwareAssurance": assurance["decision"] == "PASS",
+            "trustedDelivery": delivery["decision"] == "PASS",
+            "runtimeEvidence": runtime_evidence.get("validation", {}).get("status") == "VALID",
+            "requiredCapabilitiesExecuted": required_executed,
+            "runtimeQualification": qualification.get("level") == "QUALIFIED",
+            "policyEvidence": policy.get("decision") in {"PASS", "PASS_WITH_WARNINGS"},
+            "dockerArtifact": docker_artifact_directory is None or bool(assurance["artifacts"].get("docker", {}).get("verified")),
+        }
+        ready = all(checks.values())
+        decision = "RELEASE_QUALIFIED" if ready else "RELEASE_BLOCKED"
+        runtime_record = {
+            "selection": selection,
+            "evidenceId": runtime_evidence.get("integrity", {}).get("contentDigest"),
+            "validation": runtime_evidence.get("validation", {}),
+            "execution": runtime_evidence.get("executionEvidence", {}),
+            "qualification": qualification,
+        }
+        policy_record = {"decision": policy.get("decision"), "policy": policy.get("policy"),
+                         "triggeredRules": policy.get("triggeredRules", []), "evidenceId": runtime_record["evidenceId"]}
+        release_evidence = {
+            "schemaId": "tde.release-evidence", "schemaVersion": "1.0.0", "candidate": candidate,
+            "artifacts": artifacts, "runtimeQualification": runtime_record, "policyEvidence": policy_record,
+            "softwareAssurance": {"assuranceId": assurance["assuranceId"], "decision": assurance["decision"]},
+            "trustedDelivery": {"trustedDeliveryId": delivery["trustedDeliveryId"], "decision": delivery["decision"]},
+            "releaseQualification": {"decision": decision, "releaseDecision": "READY" if ready else "NOT_READY", "checks": checks},
+        }
+        release_evidence["releaseEvidenceId"] = "release-evidence.sha256." + sha256(_canonical(release_evidence)).hexdigest()
+        evidence_path = output.with_name(output.stem + ".release-evidence.json")
+        evidence_digest = _write(evidence_path, release_evidence)
+        manifest = {
+            "schemaId": "tde.release-qualification-manifest", "schemaVersion": "1.0.0", "candidate": candidate,
+            "artifacts": artifacts, "softwareAssuranceId": assurance["assuranceId"], "trustedDeliveryId": delivery["trustedDeliveryId"],
+            "releaseEvidence": {"path": str(evidence_path), "digest": evidence_digest, "id": release_evidence["releaseEvidenceId"], "integrity": True},
+            "qualification": {"decision": decision, "checks": checks},
+        }
+        digest = _write(output, manifest)
+        return {
+            "schemaId": "tde.release-qualification", "schemaVersion": "1.0.0", "releaseCandidate": candidate,
+            "manifest": {"path": str(output), "digest": digest, "integrity": True}, "artifacts": artifacts,
+            "softwareAssurance": release_evidence["softwareAssurance"], "trustedDelivery": release_evidence["trustedDelivery"],
+            "runtimeEvidence": {"validation": runtime_record["validation"], "policyDecision": policy_record["decision"],
+                                "runtimeQualification": qualification.get("level"), "identity": runtime_record["evidenceId"]},
+            "releaseEvidence": manifest["releaseEvidence"], "checks": checks,
+            "releaseDecision": "READY" if ready else "NOT_READY", "decision": decision,
+        }

tde_runtime/runtime.py

@@ -0,0 +1,193 @@
+"""Generic orchestration pipeline for the Technical Debt Engine runtime foundation."""
+
+from __future__ import annotations
+
+from hashlib import sha256
+import json
+from pathlib import Path
+import subprocess
+from tempfile import TemporaryDirectory
+from uuid import uuid4
+from typing import Any, Callable
+
+from .configuration import RuntimeConfiguration
+from .models import RuntimeContext, RuntimeQualification, RuntimeResult, StageResult, StageStatus, utc_now
+from .registries import AdapterRegistry, CapabilityRegistry, PolicyRegistry
+from .policy import PolicyEngine, PolicyError
+from .query import QueryEngine
+from .execution import CapabilityExecutionEngine
+from .runtime_qualification import RuntimeQualificationEngine
+
+RUNTIME_VERSION = "0.1.0"
+EVIDENCE_SCHEMA_VERSION = "1.0.0"
+
+
+class Runtime:
+    """Stable public API. A future CLI is a consumer of this class, not its owner."""
+
+    _stage_names = (
+        "repository-discovery", "repository-inspection", "language-detection",
+        "capability-planning", "adapter-planning", "execution-planning",
+        "execution-context", "pipeline-execution", "normalization", "validation",
+        "policy-evaluation", "qualification", "evidence", "reporting",
+    )
+
+    def __init__(self, capability_registry: CapabilityRegistry | None = None,
+                 adapter_registry: AdapterRegistry | None = None,
+                 policy_engine: PolicyEngine | None = None) -> None:
+        self._capability_registry = capability_registry or CapabilityRegistry()
+        self._adapter_registry = adapter_registry or AdapterRegistry()
+        self._policy_engine = policy_engine or PolicyEngine()
+        self._execution_engine = CapabilityExecutionEngine(self._capability_registry, self._adapter_registry)
+
+    def execute(self, repository_root: str | Path,
+                configuration: RuntimeConfiguration | dict[str, Any] | None = None) -> RuntimeResult:
+        config = configuration if isinstance(configuration, RuntimeConfiguration) else RuntimeConfiguration.load(configuration)
+        root = Path(repository_root).resolve()
+        if not root.is_dir():
+            raise ValueError("repository root must be an existing directory")
+        with TemporaryDirectory(prefix="tde-runtime-") as temporary:
+            context = self._context(root, config, Path(temporary))
+            stages: list[StageResult] = []
+            values: dict[str, Any] = {"capabilities": (), "adapters": ()}
+            for identifier in self._stage_names:
+                result = self._run_stage(identifier, context, values)
+                stages.append(result)
+                values[identifier] = result.outputs
+            validation = values["validation"]
+            evidence = values["evidence"]
+            report = values["reporting"]
+            qualification = RuntimeQualification.READY if values["qualification"]["status"] != "BLOCKED" else RuntimeQualification.FAILED
+            return RuntimeResult(context, tuple(stages), evidence, validation, qualification, report)
+
+    def query(self, evidence: dict[str, Any], query: dict[str, Any]) -> dict[str, Any]:
+        """Public read-only canonical-evidence query entrypoint."""
+        return QueryEngine().execute(evidence, query)
+
+    def _context(self, root: Path, config: RuntimeConfiguration, temporary: Path) -> RuntimeContext:
+        root_digest = self._repository_digest(root)
+        return RuntimeContext(
+            # Repository identity identifies the checkout; candidate identity identifies
+            # its source content.  Conflating the two makes every source revision an
+            # incompatible baseline and prevents repository-evolution comparisons.
+            repository_root=root, repository_id=self._repository_identity(root),
+            candidate={"id": f"candidate.content.{root_digest}", "identityType": "content_digest",
+                       "value": f"sha256:{root_digest}", "validationStatus": "VALID"},
+            configuration=config.as_dict(), runtime_version=RUNTIME_VERSION,
+            schema_version=EVIDENCE_SCHEMA_VERSION, execution_id=f"execution.{uuid4().hex}",
+            working_directory=root, temporary_directory=temporary,
+            execution_options=config.execution_options or {},
+        )
+
+    @staticmethod
+    def _repository_digest(root: Path) -> str:
+        """Identify source content independently of an absolute checkout path."""
+        digest = sha256()
+        excluded = {".git", ".tde", "__pycache__", ".venv", "venv", "build", "dist"}
+        for path in sorted(item for item in root.rglob("*") if item.is_file() and not any(part in excluded for part in item.relative_to(root).parts)):
+            relative = path.relative_to(root).as_posix()
+            digest.update(relative.encode("utf-8"))
+            digest.update(b"\0")
+            # Git may materialize text files with CRLF on Windows.  Candidate
+            # identity represents source content, not checkout line endings.
+            digest.update(path.read_bytes().replace(b"\r\n", b"\n"))
+            digest.update(b"\0")
+        return digest.hexdigest()[:16]
+
+    @staticmethod
+    def _repository_identity(root: Path) -> str:
+        """Use the Git origin when available; absolute paths are only a local fallback."""
+        try:
+            origin = subprocess.run(
+                ["git", "-C", str(root), "config", "--get", "remote.origin.url"],
+                capture_output=True, text=True, timeout=2, check=False,
+            ).stdout.strip().removesuffix(".git").lower()
+        except (OSError, subprocess.SubprocessError):
+            origin = ""
+        value = origin or str(root)
+        kind = "git" if origin else "local"
+        return f"repository.{kind}.{sha256(value.encode()).hexdigest()[:16]}"
+
+    def _run_stage(self, identifier: str, context: RuntimeContext,
+                   values: dict[str, Any]) -> StageResult:
+        started = utc_now()
+        handlers: dict[str, Callable[[], dict[str, Any]]] = {
+            "repository-discovery": lambda: {"repositoryId": context.repository_id},
+            "repository-inspection": lambda: {"rootExists": context.repository_root.is_dir()},
+            "language-detection": lambda: {"languages": []},
+            "capability-planning": lambda: {"capabilities": list(self._capability_registry.discover())},
+            "adapter-planning": lambda: {"adapters": list(self._adapter_registry.discover())},
+            "execution-planning": lambda: self._execution_engine.plan(context),
+            "execution-context": lambda: {"executionId": context.execution_id},
+            "pipeline-execution": lambda: self._execution_engine.execute(context),
+            "normalization": lambda: values.get("pipeline-execution", {"measurements": [], "findings": []}),
+            "validation": lambda: self._validation(context, values.get("pipeline-execution", {})),
+            "policy-evaluation": lambda: self._policy(context, values.get("normalization", {})),
+            "qualification": lambda: self._qualification(values.get("policy-evaluation", {})),
+            "evidence": lambda: self._evidence(context, values.get("validation", self._validation(context, values.get("pipeline-execution", {}))), values.get("normalization", {}), values.get("policy-evaluation", {})),
+            "reporting": lambda: self._report(context, values),
+        }
+        outputs = handlers[identifier]()
+        return StageResult(identifier, {"executionId": context.execution_id}, outputs,
+                           StageStatus.SUCCESS, "completed", started, utc_now())
+
+    def _policy(self, context: RuntimeContext, normalized: dict[str, Any]) -> dict[str, Any]:
+        try:
+            policy = self._policy_engine.load(context.configuration, context.repository_root,
+                                              context.runtime_version, context.schema_version)
+            return self._policy_engine.evaluate(policy, normalized, context.configuration)
+        except PolicyError as error:
+            return {"policy": None, "decision": "BLOCKED", "decisionReason": str(error),
+                    "triggeredRules": [{"ruleId": "policy.validation", "outcome": "BLOCKED", "reason": str(error)}],
+                    "thresholds": {}, "affectedCapabilities": [],
+                    "qualificationReference": {"executionId": context.execution_id}, "qualificationInputs": {}}
+
+    @staticmethod
+    def _qualification(policy_evidence: dict[str, Any]) -> dict[str, Any]:
+        """Qualification is deliberately a projection of Policy Engine output only."""
+        decision = policy_evidence.get("decision", "BLOCKED")
+        return {"status": decision, "policyDecision": decision, "policy": policy_evidence.get("policy"),
+                "triggeredRules": policy_evidence.get("triggeredRules", [])}
+
+    @staticmethod
+    def _validation(context: RuntimeContext, execution: dict[str, Any]) -> dict[str, Any]:
+        execution_evidence = execution.get("executionEvidence", {})
+        executed = execution_evidence.get("executedCapabilities", [])
+        complete = bool(executed) and not execution_evidence.get("blockedCapabilities")
+        return {"status": "VALID", "schema": "VALID", "candidateIdentity": "VALID",
+                "repositoryIdentity": "VALID", "adapter": "VALID" if complete else "NOT_APPLICABLE", "analyzer": "VALID" if complete else "NOT_APPLICABLE",
+                "completeness": "COMPLETE" if executed else "INCOMPLETE", "integrity": "VALID",
+                "warnings": [] if executed else ["no capability was executed"], "errors": []}
+
+    @staticmethod
+    def _evidence(context: RuntimeContext, validation: dict[str, Any], normalized: dict[str, Any], policy_evidence: dict[str, Any]) -> dict[str, Any]:
+        generated_at = utc_now()
+        stable_results = [{key: value for key, value in result.items() if key != "executionTiming"}
+                          for result in normalized.get("capabilityResults", [])]
+        seed = json.dumps({"repository": context.repository_id, "candidate": context.candidate,
+                           "configuration": RuntimeConfiguration.load(context.configuration).digest(),
+                           "capabilityResults": stable_results,
+                           "measurements": normalized.get("measurements", []), "findings": normalized.get("findings", []),
+                           "policy": policy_evidence}, sort_keys=True, separators=(",", ":"), default=str)
+        return {"schemaId": "tde.evidence", "schemaVersion": context.schema_version,
+                "runtime": {"id": "tde", "version": context.runtime_version},
+                "executionId": context.execution_id,
+                "repository": {"id": context.repository_id, "displayName": "local-repository"},
+                "candidate": context.candidate,
+                "configurationDigest": RuntimeConfiguration.load(context.configuration).digest(),
+                "capabilityResults": normalized.get("capabilityResults", []), "adapterResults": normalized.get("adapterResults", []), "measurements": normalized.get("measurements", []), "findings": normalized.get("findings", []), "executionEvidence": normalized.get("executionEvidence", {}), "validation": validation, "policyEvidence": policy_evidence, "runtimeQualification": RuntimeQualificationEngine().qualify({"validation":validation,"capabilityResults":normalized.get("capabilityResults",[]),"executionEvidence":normalized.get("executionEvidence",{}),"executionId":context.execution_id,"policyEvidence":policy_evidence,"integrity":{"contentDigest":seed}}),
+                "timestamps": {"executedAt": generated_at, "generatedAt": generated_at},
+                "integrity": {"algorithm": "sha-256", "contentDigest": f"sha256:{sha256(seed.encode()).hexdigest()}"}}
+
+    @staticmethod
+    def _report(context: RuntimeContext, values: dict[str, Any]) -> dict[str, Any]:
+        execution = values.get("pipeline-execution", {}).get("executionEvidence", {})
+        return {"runtimeSummary": {"status": "RUNTIME_READY", "runtimeVersion": context.runtime_version},
+                "executionSummary": {"executionId": context.execution_id, "workItems": len(execution.get("workItems", [])),
+                                     "plannedCapabilities": execution.get("plannedCapabilities", []),
+                                     "executedCapabilities": execution.get("executedCapabilities", []),
+                                     "plannedAdapters": execution.get("plannedAdapters", []),
+                                     "executedAdapters": execution.get("executedAdapters", [])},
+                "qualification": values.get("qualification", {}),
+                "environment": {"schemaVersion": context.schema_version, "capabilities": len(execution.get("plannedCapabilities", [])), "adapters": len(execution.get("plannedAdapters", [])),
+                                "policies": len(PolicyRegistry().discover())}}

tde_runtime/runtime_qualification.py

@@ -0,0 +1,63 @@
+"""Evidence-only, fail-closed assessment of Runtime analysis trustworthiness."""
+
+from __future__ import annotations
+
+from hashlib import sha256
+from typing import Any, Mapping
+
+
+class RuntimeQualificationEngine:
+    levels = ("QUALIFIED", "PARTIALLY_QUALIFIED", "BLOCKED", "NOT_SUPPORTED")
+
+    def qualify(self, evidence: Mapping[str, Any], capability: str | None = None) -> dict[str, Any]:
+        state = self._execution_state(evidence)
+        selected = [item for item in evidence.get("capabilityResults", []) if capability is None or item.get("capabilityId") == capability]
+        level = self._level(state, selected, capability)
+        if capability and not selected:
+            state["missingCapabilities"].append(capability)
+            state["limitations"].append("requested capability evidence is absent")
+        confidence = {"BLOCKED": 0.0, "NOT_SUPPORTED": 0.0, "PARTIALLY_QUALIFIED": 0.75}.get(level, 1.0)
+        identity = sha256(f"{evidence.get('integrity', {}).get('contentDigest')}:{capability}".encode()).hexdigest()[:16]
+        return {"qualificationId": f"runtime-qualification.{identity}", "level": level,
+                "confidence": {"analysis": confidence, "repository": confidence, "capability": confidence},
+                "limitations": state["limitations"], "missingCapabilities": sorted(set(state["missingCapabilities"])),
+                "missingAdapters": sorted(set(state["missingAdapters"])), "unsupportedLanguages": [],
+                "supportingEvidence": {"executionId": evidence.get("executionId"), "policy": evidence.get("policyEvidence", {}),
+                                       "capabilityCount": len(selected), "executedCapabilityCount": len(state["executed"]),
+                                       "executedAdapterCount": len(state["executedAdapters"]), "workItemCount": len(state["workItems"])}}
+
+    @staticmethod
+    def _execution_state(evidence: Mapping[str, Any]) -> dict[str, Any]:
+        limitations: list[str] = []
+        missing_capabilities: list[str] = []
+        execution = evidence.get("executionEvidence")
+        results = evidence.get("capabilityResults", [])
+        if evidence.get("validation", {}).get("status") != "VALID":
+            limitations.append("evidence validation failed")
+        if not isinstance(execution, Mapping):
+            limitations.append("execution evidence is missing")
+            execution = {}
+        planned = list(execution.get("plannedCapabilities", []))
+        executed = list(execution.get("executedCapabilities", []))
+        work_items = list(execution.get("workItems", []))
+        if not work_items:
+            limitations.append("execution work-item list is empty")
+        if not executed:
+            limitations.append("zero capabilities executed")
+        missing_capabilities.extend(identifier for identifier in planned if identifier not in executed or not any(item.get("capabilityId") == identifier for item in results))
+        planned_adapters = list(execution.get("plannedAdapters", []))
+        executed_adapters = list(execution.get("executedAdapters", []))
+        missing_adapters = [identifier for identifier in planned_adapters if identifier not in executed_adapters]
+        if missing_adapters:
+            limitations.append("required adapter evidence is missing")
+        return {"limitations": limitations, "missingCapabilities": missing_capabilities, "missingAdapters": missing_adapters,
+                "executed": executed, "executedAdapters": executed_adapters, "workItems": work_items}
+
+    @staticmethod
+    def _level(state: Mapping[str, Any], selected: list[Mapping[str, Any]], capability: str | None) -> str:
+        if capability and not selected:
+            return "BLOCKED"
+        blocked = any(item.get("status") in {"BLOCKED", "FAILED"} for item in selected)
+        if state["limitations"] or state["missingCapabilities"] or blocked:
+            return "BLOCKED"
+        return "PARTIALLY_QUALIFIED" if any(item.get("completeness", 1) < 1 or item.get("status") == "PARTIAL" for item in selected) else "QUALIFIED"