diff --git a/.brik/manifest.json b/.brik/manifest.json index e092fd5a..225e72b6 100644 --- a/.brik/manifest.json +++ b/.brik/manifest.json @@ -2,7 +2,7 @@ "schema": "brik64.cli_project_manifest.v1", "schemaVersion": "brik64.cli_project_manifest.v1", "project": "brik64-cli", - "cliVersion": "0.1.0-beta.7", + "cliVersion": "0.1.0-beta.8", "lane": "cli_0_1_beta", "generationClaim": "assisted_generation_non_claim", "preferred_engine": "auto", diff --git a/.github/workflows/release-train-dry-run.yml b/.github/workflows/release-train-dry-run.yml index a85976b6..7fbff87d 100644 --- a/.github/workflows/release-train-dry-run.yml +++ b/.github/workflows/release-train-dry-run.yml @@ -5,6 +5,9 @@ on: paths: - "release/manifest.json" - "scripts/release-*.js" + - "scripts/beta8-*.js" + - "scripts/beta8-*.sh" + - "scripts/build-beta8-package.sh" - "scripts/beta7-*.js" - "scripts/build-beta7-package.js" - "scripts/beta6-l6-hetzner-generation-gate.js" @@ -12,6 +15,10 @@ on: - "package.json" - "CHANGELOG.md" - "README.md" + - "docs/BETA8_RELEASE_PLAN.md" + - "docs/GITHUB_SIGNING_KEY_RUNBOOK.md" + - "pcd/**" + - "engines/l4plus-n5/**" - "docs/BETA7_RELEASE_PLAN.md" - "docs/BETA6_RELEASE_PLAN.md" - "docs/BETA6_L6_HETZNER_GENERATION_ENDPOINT.md" diff --git a/.github/workflows/release-train-publish.yml b/.github/workflows/release-train-publish.yml index 6668daa2..b015692e 100644 --- a/.github/workflows/release-train-publish.yml +++ b/.github/workflows/release-train-publish.yml @@ -64,6 +64,12 @@ jobs: - name: Generate sync payload run: npm run release:train:sync-surfaces + - name: Verify GitHub signed release commit + env: + GH_TOKEN: ${{ secrets.BRIK64_GITHUB_RELEASE_TOKEN }} + BRIK64_RELEASE_COMMIT: ${{ github.sha }} + run: npm run gate:beta8:github-verified-signature + - name: Prepare SDK publication workspaces env: BRIK64_GITHUB_RELEASE_TOKEN: ${{ secrets.BRIK64_GITHUB_RELEASE_TOKEN }} @@ -175,5 +181,6 @@ jobs: evidence/release-train-sync/changelog.md evidence/release-train-sync/sync-payload.json evidence/release-train-sync/report.json + evidence/beta8-github-verified-signature/report.json evidence/release-train-publish-plan/report.json evidence/release-train-publish-execute/report.json diff --git a/.gitignore b/.gitignore index 0e1edca6..9f3fe506 100644 --- a/.gitignore +++ b/.gitignore @@ -5,6 +5,9 @@ node_modules/ *.log .DS_Store evidence/tmp/ +evidence/beta8-github-verified-signature/ +evidence/github-signing-key-preflight/ +evidence/github-signing-key-registration/ evidence/beta5-package/stage/ runner-env.local.sh *.secret diff --git a/CHANGELOG.md b/CHANGELOG.md index 61ad3923..8245da2e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,6 +3,35 @@ All notable BRIK64 CLI changes are recorded here. This file is required for every beta, release candidate, or public release train. +## 0.1.0-beta.8 + +### Added + +- Adds bounded source-to-source PCD emission for executable TypeScript, Rust, + and Python programs. +- Adds generated target tests that execute emitted programs and check expected + behavior across supported target languages. +- Adds parser support for arithmetic expressions, comparisons, boolean + conditions, nested branches, and expression returns. +- Adds adversarial parser coverage for malformed input, binary data, oversized + PCD files, unsupported statements, and path traversal attempts. +- Adds a local package smoke check that extracts the beta8 tarball and runs the + packaged CLI outside the repository checkout. + +### Changed + +- Updates `brik64 emit` from static candidate output toward executable output + for the supported beta PCD syntax. +- Keeps unsupported syntax fail-closed with actionable parser errors. + +### Compatibility + +- macOS and Linux continue to use the portable Node.js CLI package and require + Node.js 20 or newer. +- Windows native executables are not published in this beta. +- This beta does not claim formal certification for arbitrary user code, + universal correctness, or independent toolchain closure. + ## 0.1.0-beta.7 ### Added diff --git a/README.md b/README.md index 735d2041..d4f498bb 100644 --- a/README.md +++ b/README.md @@ -5,7 +5,7 @@ workflows. It helps developers initialize `.brik` metadata, work with PCD files, create local candidate evidence, emit supported language targets, and prepare artifacts for managed platform workflows. -Current public beta: `0.1.0-beta.7` +Current beta candidate: `0.1.0-beta.8` ## Install @@ -24,10 +24,10 @@ brik64 help The npm package namespace is reserved for SDK libraries, not CLI installation. -## Beta7 Command Surface +## Beta8 Command Surface -`0.1.0-beta.7` focuses on local/managed workflow parity and clearer terminal -behavior. +`0.1.0-beta.8` focuses on making PCD emission executable for the supported +beta syntax while keeping local/managed workflow boundaries intact. - `brik64 init` creates `.brik/manifest.json` and does not create `AGENTS.md`. - `brik64 doctor` prints a human-readable workspace summary. @@ -40,7 +40,8 @@ behavior. - `brik64 certify ` writes a local candidate certificate. - `brik64 verify ` checks local certificate and AST/hash coherence. - `brik64 emit --target --out --tests` - emits supported target files and generated tests. + emits executable target files and generated tests for supported beta PCD + expressions and branches. - `brik64 polymerize --out polymer.pcd` combines compatible PCD files into a deterministic local polymer candidate. - `brik64 migrate ` converts supported legacy PCD syntax into the @@ -67,9 +68,9 @@ SDKs are distributed separately from the CLI. Current beta SDK package coordinates: ```sh -npm install @brik64/core@0.1.0-beta.7 -pip install brik64==0.1.0b7 -cargo add brik64-core@0.1.0-beta.7 +npm install @brik64/core@0.1.0-beta.8 +pip install brik64==0.1.0b8 +cargo add brik64-core@0.1.0-beta.8 ``` SDK packages are language libraries. They do not install the CLI, issue managed diff --git a/docs/GITHUB_SIGNING_KEY_RUNBOOK.md b/docs/GITHUB_SIGNING_KEY_RUNBOOK.md new file mode 100644 index 00000000..39408b2b --- /dev/null +++ b/docs/GITHUB_SIGNING_KEY_RUNBOOK.md @@ -0,0 +1,160 @@ +# GitHub Signing Key Runbook + +This runbook closes the beta8 release integrity blocker where GitHub sees the +release commit as SSH-signed but not verified. + +Current blocker: + +- PR: https://github.com/brik64/brik64-cli/pull/65 +- State: approved, checks green, merge blocked +- GitHub verification reason: `unknown_key` +- Commit signing account: `carlosjperez` +- Public key fingerprint for this release lane: + `SHA256:Ua933KXYBhzgl5+852YF5GYMwOab/RGZwevZyImNfZ8` + +Do not use admin merge override. The release train must pass with GitHub +recognizing the exact release commit as verified. + +## Preflight + +Run with the public key that belongs to the commit signing account: + +```bash +npm run preflight:github-signing-key -- \ + --public-key "$HOME/.ssh/brik64-carlosjperez-release-signing.pub" +``` + +Expected blocked state before authorization: + +```text +decision=BLOCKED_GITHUB_SIGNING_KEY_PREFLIGHT +failures=github_token_missing_scope:admin:ssh_signing_key +``` + +The preflight must not read private keys or print secrets. It only checks the +public signing key fingerprint and GitHub API visibility. + +## Authorize GitHub API Scopes + +Run: + +```bash +gh auth refresh -h github.com -s admin:ssh_signing_key -s admin:public_key +``` + +Complete the browser device-flow approval. After approval, verify scopes: + +```bash +gh auth status -h github.com +``` + +The active account used to register the key must be the account that owns the +beta8 commit identity. A GitHub SSH signing key cannot be reused across +accounts. If the key is already registered to another account, create a +separate signing key for the actual committing account. + +## Register The Public Signing Key + +Never print or upload the private key. Register only the public key for the +committing account: + +```bash +~/.ssh/brik64-carlosjperez-release-signing.pub +``` + +The public key fingerprint must match: + +```text +SHA256:Ua933KXYBhzgl5+852YF5GYMwOab/RGZwevZyImNfZ8 +``` + +Preferred repo command after scopes are authorized: + +```bash +npm run release:github-signing-key:register -- \ + --execute \ + --public-key "$HOME/.ssh/brik64-carlosjperez-release-signing.pub" \ + --title "BRIK64 beta8 release signing key carlosjperez" +``` + +The command is idempotent. It lists existing GitHub SSH signing keys, compares +public fingerprints, and only submits the public key when no matching key +exists. + +Equivalent API path: + +```bash +gh api user/ssh_signing_keys \ + --method POST \ + --field title="BRIK64 beta8 release signing key" \ + --field key="$(cat ~/.ssh/brik64-carlosjperez-release-signing.pub)" +``` + +If GitHub reports the key already exists, continue to validation. + +## Validate + +Run: + +```bash +npm run preflight:github-signing-key -- \ + --public-key "$HOME/.ssh/brik64-carlosjperez-release-signing.pub" +``` + +Required result: + +```text +decision=PASS_GITHUB_SIGNING_KEY_PREFLIGHT +``` + +Then regenerate the beta8 signature report for the exact PR head: + +```bash +npm run gate:beta8:github-verified-signature +``` + +Required result: + +```text +decision=PASS_BETA8_GITHUB_VERIFIED_SIGNATURE +publicReleaseAllowed=true +``` + +Finally verify PR #65: + +```bash +gh pr view 65 --repo brik64/brik64-cli \ + --json mergeStateStatus,reviewDecision,statusCheckRollup,headRefOid +``` + +Required release-ready state: + +- `reviewDecision=APPROVED` +- every required check is `SUCCESS` +- `mergeStateStatus` is no longer blocked by signature verification + +## Resume Release Train + +Only after the verified-signature gate passes: + +```bash +npm run release:train:publish-plan +``` + +Publication must still remain blocked while `release/manifest.json` is +`state=draft`. Moving beta8 from draft to public requires the full synchronized +release train: GitHub Release, curl/GCP installer, SDKs, docs, web, changelog, +skills, platform smoke and public-claim scan. + +## Failure Handling + +If the commit remains `verified=false`: + +- `unknown_key`: the public key is not registered as a GitHub SSH signing key + for the relevant account. +- `no_user`: the commit identity is not associated with a GitHub user/email. +- `bad_email`: update commit author/committer email to a verified account + email and recreate the signed commit. + +Do not bypass with admin override. Keep the failed reports as evidence and fix +the identity/signing configuration. diff --git a/evidence/beta8-adversarial/report.json b/evidence/beta8-adversarial/report.json new file mode 100644 index 00000000..08928bf6 --- /dev/null +++ b/evidence/beta8-adversarial/report.json @@ -0,0 +1,47 @@ +{ + "schemaVersion": "brik64.cli_beta8_adversarial_gate.v1", + "generatedAt": "2026-06-07T10:08:18Z", + "iter_id": "BRIK64-CLI-BETA8-ADVERSARIAL-20260606-R1", + "lane": "cli_0_1_beta8", + "decision": "PASS_BRIK64_CLI_BETA8_ADVERSARIAL", + "rc": 0, + "cliVersion": "0.1.0-beta.8", + "cliSha256": "sha256:63f28a941626edb18cee7b794e9f3c05acdc29db94e8387e02809ed402a7f8ed", + "executableEdgeFixture": { + "path": "pcd/edge_precedence.pcd", + "sha256": "sha256:de6c384a4f4146f78e1ea040176206b49aed6725a35db10b447a8d42fe75bf63" + }, + "passChecks": 9, + "failClosedChecks": 12, + "generatedTargetExecution": { + "typescript": true, + "rust": true, + "python": true + }, + "failClosedSurface": [ + "empty_pcd", + "binary_input", + "too_large_input", + "legacy_syntax", + "missing_fn", + "too_many_params", + "invalid_param", + "missing_return", + "unsupported_statement", + "unsupported_expression_token", + "malformed_expression", + "unclosed_block" + ], + "claim_boundary": { + "public_claims_allowed": false, + "public_release_allowed": false, + "adversarial_gate_passed": true, + "compiler_functionality_scope": "supported_beta8_pcd_subset_only", + "fixpoint_claim_allowed": false, + "n5_formal_claim_allowed": false, + "rust_independence_claim_allowed": false + }, + "blockers": [], + "warnings": [], + "next_action": "run beta8 package smoke and release-train sync gates" +} diff --git a/evidence/beta8-compiler-functionality/report.json b/evidence/beta8-compiler-functionality/report.json new file mode 100644 index 00000000..046dd2db --- /dev/null +++ b/evidence/beta8-compiler-functionality/report.json @@ -0,0 +1,49 @@ +{ + "schemaVersion": "brik64.cli_beta8_compiler_functionality_gate.v1", + "generatedAt": "2026-06-07T10:08:15Z", + "iter_id": "BRIK64-CLI-BETA8-COMPILER-FUNCTIONALITY-20260606-R1", + "lane": "cli_0_1_beta8", + "decision": "PASS_BRIK64_CLI_BETA8_COMPILER_FUNCTIONALITY", + "rc": 0, + "cliVersion": "0.1.0-beta.8", + "cliSha256": "sha256:63f28a941626edb18cee7b794e9f3c05acdc29db94e8387e02809ed402a7f8ed", + "fixture": { + "path": "pcd/branch_math.pcd", + "sha256": "sha256:09742f0ef4d80b4f465da256d8d44b4c587306c07015ecb77cada308c1d70404" + }, + "executedTargets": { + "typescript": { + "programSha256": "sha256:608f6244ed6563765b31e6e42b722eb2c7889b87f7fdb7ca5e86740eb1675a95", + "test": "node out-ts/program.test.mjs", + "passed": true + }, + "rust": { + "programSha256": "sha256:bbe9b972902349fdb4b5884858e840b2c004c2173eb24f605958a913d6075e5d", + "test": "rustc out-rust/program_test.rs && ./out-rust/program_test", + "passed": true + }, + "python": { + "programSha256": "sha256:ca5c353fdd06e4b65b9b6366deea679b2816544af1843932ecdb59d471a742b6", + "test": "PYTHONPATH=out-python python3 out-python/test_program.py", + "passed": true + } + }, + "adversarial": { + "unknown_identifier_fail_closed": true, + "unsupported_target_fail_closed": true, + "path_traversal_fail_closed": true, + "stack_trace_leaked": false + }, + "claim_boundary": { + "public_claims_allowed": false, + "public_release_allowed": false, + "compiler_functionality_claim_allowed": true, + "compiler_functionality_scope": "supported_beta8_pcd_subset_only", + "fixpoint_claim_allowed": false, + "n5_formal_claim_allowed": false, + "rust_independence_claim_allowed": false + }, + "blockers": [], + "warnings": [], + "next_action": "run beta8 adversarial gate and package smoke before public release train" +} diff --git a/evidence/beta8-docs-web-sync/report.json b/evidence/beta8-docs-web-sync/report.json new file mode 100644 index 00000000..4357d5e0 --- /dev/null +++ b/evidence/beta8-docs-web-sync/report.json @@ -0,0 +1,47 @@ +{ + "schemaVersion": "brik64.cli_beta8_docs_web_sync_gate.v1", + "version": "0.1.0-beta.8", + "decision": "PASS_DOCS_WEB_BETA8_SYNC", + "releaseEligible": true, + "deployAllowed": true, + "artifacts": [ + { + "id": "docs_install", + "path": "/Users/carlosjperez/Documents/GitHub/brik64-docs-site/cli/install.mdx", + "sha256": "048710173a310d5b534c69a309de6ae0d152245e05e4a505547402ef544ccedb", + "bytes": 2064 + }, + { + "id": "docs_sdks", + "path": "/Users/carlosjperez/Documents/GitHub/brik64-docs-site/sdks.mdx", + "sha256": "46ca1e93fb94ab79c9bc2cbde7e16cf7121827e99e23b2c8c6de973003649049", + "bytes": 1461 + }, + { + "id": "docs_llms", + "path": "/Users/carlosjperez/Documents/GitHub/brik64-docs-site/llms-full.txt", + "sha256": "9d706cf587326469784d82fa7ff12c3e23b681860d1e0398d50770746f59e857", + "bytes": 108533 + }, + { + "id": "web_sdk_download_api", + "path": "/Users/carlosjperez/Documents/GitHub/brik64.com/functions/api/download/sdk/[target].ts", + "sha256": "adfc6f0d00257beee25a5eeb01af265e6d4a8d70a89779a2ee36a73386af9988", + "bytes": 2326 + }, + { + "id": "web_cli_download_api", + "path": "/Users/carlosjperez/Documents/GitHub/brik64.com/functions/api/download/cli.ts", + "sha256": "28aa7a5369a32ef3601e003937c648b21189490e8b189c0984a56533ecae3416", + "bytes": 1759 + }, + { + "id": "web_language_data", + "path": "/Users/carlosjperez/Documents/GitHub/brik64.com/src/lib/language-data.ts", + "sha256": "6f79e46995e2acd4db34cfc19b66557ef2795183aaa961002b9ef69667c15d23", + "bytes": 10647 + } + ], + "failures": [], + "boundary": "Docs and web source must be beta8 aligned before public release. This gate does not deploy." +} diff --git a/evidence/beta8-marketplace-packages/report.json b/evidence/beta8-marketplace-packages/report.json new file mode 100644 index 00000000..bf88d95a --- /dev/null +++ b/evidence/beta8-marketplace-packages/report.json @@ -0,0 +1,50 @@ +{ + "schemaVersion": "brik64.cli_beta8_marketplace_package_gate.v1", + "version": "0.1.0-beta.8", + "decision": "PASS_MARKETPLACE_PACKAGE_GATE", + "releaseEligible": true, + "marketplacePublicationAllowed": true, + "packages": { + "npm": { + "repository": "/Users/carlosjperez/Documents/GitHub/brik64-lib-js", + "packageName": "@brik64/core", + "version": "0.1.0-beta.8", + "artifact": { + "path": "evidence-beta8-pack/brik64-core-0.1.0-beta.8.tgz", + "absolutePath": "/Users/carlosjperez/Documents/GitHub/brik64-lib-js/evidence-beta8-pack/brik64-core-0.1.0-beta.8.tgz", + "sha256": "8ca62654417c95e38d60d48b42bf1c4a5babcce24f07dc28a64b832ab2547cd8", + "bytes": 20734 + } + }, + "pypi": { + "repository": "/Users/carlosjperez/Documents/GitHub/brik64-lib-python", + "packageName": "brik64", + "version": "0.1.0b8", + "wheel": { + "path": "dist/brik64-0.1.0b8-py3-none-any.whl", + "absolutePath": "/Users/carlosjperez/Documents/GitHub/brik64-lib-python/dist/brik64-0.1.0b8-py3-none-any.whl", + "sha256": "05fd20d8fc42b2b43b3d276108a4114b035ac80e811b0d39e5ea3e4f7dd0c888", + "bytes": 10011 + }, + "sdist": { + "path": "dist/brik64-0.1.0b8.tar.gz", + "absolutePath": "/Users/carlosjperez/Documents/GitHub/brik64-lib-python/dist/brik64-0.1.0b8.tar.gz", + "sha256": "61387ef86ad3cc403cb74798b17d21359bd4e1de58de0f49e1720c35b72a848c", + "bytes": 7442 + } + }, + "cargo": { + "repository": "/Users/carlosjperez/Documents/GitHub/brik64-lib-rust", + "crateName": "brik64-core", + "version": "0.1.0-beta.8", + "artifact": { + "path": "target/package/brik64-core-0.1.0-beta.8.crate", + "absolutePath": "/Users/carlosjperez/Documents/GitHub/brik64-lib-rust/target/package/brik64-core-0.1.0-beta.8.crate", + "sha256": "731da3affa712b1fe2ea570144a5884353de091b0cd198c6066344dae8d22964", + "bytes": 15035 + } + } + }, + "failures": [], + "boundary": "Package artifacts are local beta8 publication inputs. This gate verifies readiness but does not mutate npm, PyPI or crates.io." +} diff --git a/evidence/beta8-package-smoke/report.json b/evidence/beta8-package-smoke/report.json new file mode 100644 index 00000000..0d992993 --- /dev/null +++ b/evidence/beta8-package-smoke/report.json @@ -0,0 +1,35 @@ +{ + "schemaVersion": "brik64.cli_beta8_package_smoke.v1", + "version": "0.1.0-beta.8", + "decision": "PASS_BRIK64_CLI_BETA8_LOCAL_PACKAGE_SMOKE", + "releaseEligible": false, + "lane": "cli_0_1_beta8", + "package": { + "path": "evidence/beta8-package/brik64-cli-0.1.0-beta.8.tgz", + "sha256": "9691aad414c40c0bac0dd3f1f087f1a235b87dc29c68b466812763b59b90aa76" + }, + "checks": [ + "extract", + "version", + "help", + "init", + "certify", + "emit_ts", + "emit_rust", + "emit_python", + "generated_ts_exec", + "generated_rust_exec", + "generated_python_exec", + "verify", + "cloud_verify_no_entitlement" + ], + "claim_boundary": { + "public_claims_allowed": false, + "public_release_allowed": false, + "local_package_smoke_passed": true, + "fixpoint_claim_allowed": false, + "n5_formal_claim_allowed": false, + "rust_independence_claim_allowed": false + }, + "next_action": "run platform smoke, sync gates and public release train" +} diff --git a/evidence/beta8-package/SHA256SUMS b/evidence/beta8-package/SHA256SUMS new file mode 100644 index 00000000..7971b92c --- /dev/null +++ b/evidence/beta8-package/SHA256SUMS @@ -0,0 +1,3 @@ +9691aad414c40c0bac0dd3f1f087f1a235b87dc29c68b466812763b59b90aa76 brik64-cli-0.1.0-beta.8.tgz +eec112132996ffc66ddee990293107cf66e2737fc69c2e06c7e602934ec6144b package.manifest.json +32624563b4583a6baa4fc076f7883aadf2cb98cb9e3ac62c1f4949a492b82e82 stage-checksums.tsv diff --git a/evidence/beta8-package/brik64-cli-0.1.0-beta.8.tgz b/evidence/beta8-package/brik64-cli-0.1.0-beta.8.tgz new file mode 100644 index 00000000..392383d1 Binary files /dev/null and b/evidence/beta8-package/brik64-cli-0.1.0-beta.8.tgz differ diff --git a/evidence/beta8-package/package.manifest.json b/evidence/beta8-package/package.manifest.json new file mode 100644 index 00000000..e9a48581 --- /dev/null +++ b/evidence/beta8-package/package.manifest.json @@ -0,0 +1,29 @@ +{ + "schemaVersion": "brik64.cli_beta8_package_manifest.v1", + "version": "0.1.0-beta.8", + "decision": "PASS_BRIK64_CLI_BETA8_PACKAGE_BUILT", + "releaseEligible": false, + "lane": "cli_0_1_beta8", + "generationClaim": "internal_generation_non_claim", + "package": { + "path": "evidence/beta8-package/brik64-cli-0.1.0-beta.8.tgz", + "sha256": "9691aad414c40c0bac0dd3f1f087f1a235b87dc29c68b466812763b59b90aa76", + "bytes": 24495 + }, + "inputGates": [ + "PASS_BRIK64_CLI_BETA8_COMPILER_FUNCTIONALITY", + "PASS_BRIK64_CLI_BETA8_ADVERSARIAL" + ], + "requiredPublicReleaseGates": [ + "beta8_package_smoke", + "beta8_github_verified_signature", + "platform_smoke", + "curl_gcp_installer_beta8", + "github_release_beta8", + "web_docs_changelog_beta8", + "skills_beta8", + "sdk_beta8_or_no_change_evidence", + "public_claim_scan" + ], + "boundary": "Beta8 local package candidate only. Public release remains blocked until package, platform, installer, GitHub, SDK, docs, web, changelog, skills and public-claim gates pass together." +} diff --git a/evidence/beta8-package/stage-checksums.tsv b/evidence/beta8-package/stage-checksums.tsv new file mode 100644 index 00000000..3a13dec3 --- /dev/null +++ b/evidence/beta8-package/stage-checksums.tsv @@ -0,0 +1,19 @@ +fc964c7a8ed406be061b5b0f7870a817f4499138f52aa2cc634c5bec4a843fb3 .brik/manifest.json +d117870091ed333c4c180eb4fe0ac5f61aee55a0da5fb67ebea23863d57b4f3f CHANGELOG.md +08ed88b54153f473ae8c29972d137b5a9f6893fd3178754e61a2ef29ae040e47 LICENSE +b70107f9dd359eb374de9a9dce99821ed5dbbd021116645e0d32c67fb7fc9b18 NOTICE +7b4fbb4b65e30e58f2dbf28ad0fddd1b0eb9641bfef9d586358e0343e1f33ccb README.md +cf39e055374caeecaac773d9802098a7c1717e271be4b00c25d2a2a9bf157aa1 SECURITY.md +11a5eadb7ec6f7d07e329c767026ae9576bdaf99c1d411781e5f88108e7d852e engines/l4plus-n5/checksums.tsv +221774c3a8f9e1cf630521a12a2a62f265d34313cdeaf7bb30ca69f60bd3a8d8 engines/l4plus-n5/runtime-bundle.manifest.json +6f2a3eff7b3cbf80debb823f1771df5364d6f1fdf2c0b6c2dab8e109c04dc757 engines/l4plus-n5/serial.txt +cc96725570711586495d8cb96fa71a53887cc0933be7a18cc7f6a7a096d6863d evidence/beta8-adversarial/report.json +4e1d3351a93514a1cdf3bde360f8bbfe2e8a8285f94921efee9e4708c9ae5aa5 evidence/beta8-compiler-functionality/report.json +3b99b7e885e6bf2d730bd7f4ca3c3bae00270f775523c66150d21d2004e70628 package.json +2a629b0c88a96c81a42f3e5949900798fe25886aec7ac203855ba7540cd3b36c pcd/cli_account_session.pcd +ff48eaeb3848e39c5400fcbb9fc293e5fffb649db2e32454f900080be660ef1c pcd/cli_core.pcd +3ea78bd6e28c15b409318be8107590e2a833ca6bea98df8a974f4ac7e0beb6ed pcd/cli_migrate.pcd +4813a13cecb6e9644e22c7736fb46acacc5a381bf4f444e74ef3301a20dafcde pcd/cli_polymer.pcd +eeada3bbe77fc19a4387acbf4fced480b06acd1776b8d1587d69ec8e855c0e24 pcd/cli_polymerize.pcd +6987959306e52657f53de2ac6e1d35c8389d4ce1e571db381e978dcf650e96ad pcd/cli_verify.pcd +63f28a941626edb18cee7b794e9f3c05acdc29db94e8387e02809ed402a7f8ed src/brik.js diff --git a/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/.brik/manifest.json b/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/.brik/manifest.json new file mode 100644 index 00000000..225e72b6 --- /dev/null +++ b/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/.brik/manifest.json @@ -0,0 +1,53 @@ +{ + "schema": "brik64.cli_project_manifest.v1", + "schemaVersion": "brik64.cli_project_manifest.v1", + "project": "brik64-cli", + "cliVersion": "0.1.0-beta.8", + "lane": "cli_0_1_beta", + "generationClaim": "assisted_generation_non_claim", + "preferred_engine": "auto", + "polymer_strategy": "local_ast", + "managed_platform": { + "enabled": false, + "routing": "local_default" + }, + "semanticSourceStatus": "candidate_pcd_seed", + "semanticSourceRoot": "pcd/", + "compositionPcd": "pcd/cli_polymer.pcd", + "bootstrapEntrypoint": "src/brik.js", + "publicBinaryName": "brik", + "engineTierPolicy": { + "publicOfflineRuntime": "local_runtime", + "registeredManagedRuntime": "managed_platform", + "internalArtifactFactory": "private_factory", + "l6DistributionAllowed": false, + "l5EmbeddedFreeRuntimeAllowed": false + }, + "claimBoundary": { + "releaseAuthorized": false, + "releaseAllowed": false, + "fixpointClaimAuthorized": false, + "n5ClaimAuthorized": false, + "formalCertificationAuthorized": false, + "rustIndependenceClaimAuthorized": false + }, + "methodologyTransition": { + "target": "pcd_first_cli_iteration", + "requiredBeforePublicBeta": [ + "pcd_semantic_source_complete", + "pcd_polymer_composition_report_present", + "pcd_certification_report_present", + "brik_compiler_build_report_present", + "macos_arm64_execution_report_present", + "linux_distro_execution_reports_present", + "windows_x64_execution_report_present", + "release_claim_boundary_gate_pass" + ], + "currentStatus": "bootstrap_non_release" + }, + "certification": { + "certifiesFormalCorrectness": false, + "certifiesTests": false, + "certifiesFixpoint": false + } +} diff --git a/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/CHANGELOG.md b/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/CHANGELOG.md new file mode 100644 index 00000000..8245da2e --- /dev/null +++ b/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/CHANGELOG.md @@ -0,0 +1,137 @@ +# Changelog + +All notable BRIK64 CLI changes are recorded here. This file is required for +every beta, release candidate, or public release train. + +## 0.1.0-beta.8 + +### Added + +- Adds bounded source-to-source PCD emission for executable TypeScript, Rust, + and Python programs. +- Adds generated target tests that execute emitted programs and check expected + behavior across supported target languages. +- Adds parser support for arithmetic expressions, comparisons, boolean + conditions, nested branches, and expression returns. +- Adds adversarial parser coverage for malformed input, binary data, oversized + PCD files, unsupported statements, and path traversal attempts. +- Adds a local package smoke check that extracts the beta8 tarball and runs the + packaged CLI outside the repository checkout. + +### Changed + +- Updates `brik64 emit` from static candidate output toward executable output + for the supported beta PCD syntax. +- Keeps unsupported syntax fail-closed with actionable parser errors. + +### Compatibility + +- macOS and Linux continue to use the portable Node.js CLI package and require + Node.js 20 or newer. +- Windows native executables are not published in this beta. +- This beta does not claim formal certification for arbitrary user code, + universal correctness, or independent toolchain closure. + +## 0.1.0-beta.7 + +### Added + +- Adds `brik64 polymerize` for local PCD composition into a deterministic + polymer file and companion manifest. +- Adds `brik64 verify` for local certificate, source hash, and AST hash checks. +- Adds `brik64 migrate` to update legacy lowercase `pc` files to the current + `PC` syntax. +- Adds `brik64 login`, `brik64 logout`, and `brik64 account status` as the CLI + account boundary for future platform-connected workflows. +- Adds `brik64 doctor --json` while keeping human-readable `doctor` output as + the default terminal experience. + +### Changed + +- Extends workspace manifests with preferred engine routing and polymerization + strategy metadata for local-first operation. +- Improves parser errors for legacy PCD syntax by pointing users to + `brik64 migrate`. +- Keeps cloud verification and cloud polymerization fail-closed unless a + platform entitlement is present. + +### Compatibility + +- macOS and Linux continue to use the portable Node.js CLI package and require + Node.js 20 or newer. +- Windows native executables are not published in this beta. +- This beta does not claim formal certification for arbitrary user code, + universal correctness, or independent toolchain closure. + +## 0.1.0-beta.6 + +### Added + +- Adds a portable `brik64` CLI package installable through the public curl + installer on supported macOS and Linux environments. +- Adds local workspace initialization, certificate creation, TypeScript output, + and stale-certificate protection to the distributed beta package. +- Adds visible package metadata so users can verify the installed CLI version + and SHA-256 checksum. + +### Changed + +- Updates `brik64 --version`, README, and install guidance to + `0.1.0-beta.6`. +- Clarifies that the CLI is installed with curl, while SDKs are installed with + the package manager for each language. + +### Compatibility + +- macOS and Linux use the portable Node.js CLI package and require Node.js 20 or + newer. +- Windows native executables are not published in this beta. +- This beta does not claim formal certification for arbitrary user code or + independent toolchain closure. + +## 0.1.0-beta.5 + +### Added + +- Added local workspace validation with `brik64 doctor`. +- Added `brik64 engine status` so users can inspect the packaged offline + runtime bundle installed with the CLI. +- Added hash-bound candidate output generation for TypeScript, Rust, and + Python through `brik64 emit --target `. +- Added package checksums and local install smoke coverage for the public beta + package. +- Added matching beta SDK package coordinates for TypeScript, Python, and Rust. +- Added public release-train validation so CLI, SDK, docs, web, skills, + release notes, and installer metadata can be checked from one manifest. + +### Changed + +- Updates public install guidance from beta4 to beta5. +- Clarifies that npm is used for SDK packages, while the CLI install path is + the curl installer and GitHub Release assets. +- Improves failure boundaries for stale certificates, tampered runtime metadata, + and mismatched generated outputs. +- Aligns public docs, website install surfaces, skills, SDK references, and + release notes to beta5. + +### Fixed + +- Fixes stale beta references in local seed metadata and public install + surfaces. +- Fixes release notes that previously mixed public functionality with internal + operating details. +- Fixes docs and skills drift where older beta package coordinates could remain + visible. + +### Compatibility + +- macOS and Linux are the current installable CLI lanes for beta5. +- Node.js 20 or newer is required. +- Windows native executables are not published in this beta. + +## 0.1.0-beta.4 - Published Beta Reference + +Status: latest prior public release reference. + +Use GitHub Releases, curl installer metadata and published docs as the authority +for what beta4 made publicly installable. diff --git a/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/LICENSE b/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/LICENSE new file mode 100644 index 00000000..fd2655d7 --- /dev/null +++ b/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/LICENSE @@ -0,0 +1,71 @@ +BRIK64 CLI PUBLIC BETA EVALUATION LICENSE + +Copyright (c) 2026 BRIK64 INC. All rights reserved. + +This package, including the BRIK64 CLI source, bundled PCD seed material, +examples, package metadata, documentation, evidence artifacts, and release +materials, is proprietary software and confidential know-how of BRIK64 INC +except where a file explicitly states otherwise. + +1. Evaluation Permission + +BRIK64 INC grants you a limited, revocable, non-exclusive, non-transferable +permission to download, install, and run this public beta release only for +internal evaluation, local workflow testing, compatibility review, and feedback +to BRIK64. + +2. Reserved Rights + +BRIK64 INC reserves all rights not expressly granted in this license. This +license does not grant any ownership interest, patent license, trademark license, +commercial distribution right, sublicensing right, hosted service right, resale +right, or right to create derivative works for public or commercial use. + +3. Restrictions + +Without prior written permission from BRIK64 INC, you may not: + +- redistribute, mirror, sell, sublicense, rent, lease, or commercially exploit + this software; +- publish modified versions or derivative works; +- remove copyright, trademark, provenance, release, checksum, or evidence + notices; +- use BRIK64 names, logos, marks, or release artifacts to imply endorsement or + certification; +- use the beta in regulated, safety-critical, mission-critical, or production + systems as a certification authority. + +4. Beta Scope + +This public beta is provided for evaluation of local BRIK64 CLI workflows, +PCD-oriented project structure, package validation, and bounded evidence review. +Expanded platform support, production certification surfaces, and advanced +compiler-methodology scopes are governed by BRIK64 release gates and written +commercial terms. + +5. Feedback + +If you provide feedback, bug reports, ideas, or suggestions to BRIK64, you grant +BRIK64 INC a perpetual, irrevocable, worldwide, royalty-free right to use that +feedback to improve BRIK64 products and services without obligation to you. + +6. No Warranty + +This beta is provided as-is for evaluation. BRIK64 INC disclaims all warranties, +express or implied, including merchantability, fitness for a particular purpose, +non-infringement, and uninterrupted or error-free operation. + +7. Limitation Of Liability + +To the maximum extent permitted by law, BRIK64 INC is not liable for indirect, +incidental, special, consequential, exemplary, punitive, or business interruption +damages arising from this beta, even if advised of the possibility of such +damages. + +8. Commercial Licensing + +For production, commercial, hosted, redistribution, partner, enterprise, +regulated, or certification-oriented use, contact BRIK64 INC through the public +company channels listed at https://brik64.com. + +This is not an open source license. diff --git a/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/NOTICE b/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/NOTICE new file mode 100644 index 00000000..aa404714 --- /dev/null +++ b/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/NOTICE @@ -0,0 +1,18 @@ +BRIK64 CLI Public Beta Notice + +Copyright (c) 2026 BRIK64 INC. All rights reserved. + +BRIK64 CLI 0.1 public beta is proprietary software published for evaluation of +local PCD workflows, bounded evidence review, and claim-safe project scaffolding. +The current public beta surface is focused on macOS local CLI usage, package +validation, and versioned release evidence. Expanded platform support and +stronger certification surfaces remain governed by the BRIK64 evidence process +and commercial licensing terms. + +Public product information: https://brik64.com +Documentation: https://docs.brik64.com/cli/install +Repository: https://github.com/brik64/brik64-cli +Package: https://www.npmjs.com/package/@brik64/cli + +License: BRIK64 CLI Public Beta Evaluation License. This is not an open source +license. See LICENSE for evaluation terms and reserved rights. diff --git a/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/README.md b/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/README.md new file mode 100644 index 00000000..d4f498bb --- /dev/null +++ b/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/README.md @@ -0,0 +1,119 @@ +# BRIK64 CLI + +BRIK64 CLI is the public beta command-line surface for local BRIK64 project +workflows. It helps developers initialize `.brik` metadata, work with PCD files, +create local candidate evidence, emit supported language targets, and prepare +artifacts for managed platform workflows. + +Current beta candidate: `0.1.0-beta.8` + +## Install + +The public CLI install path is curl-only: + +```sh +curl -fsSL https://brik64.com/cli/install.sh | bash +``` + +After installation: + +```sh +brik64 --version +brik64 help +``` + +The npm package namespace is reserved for SDK libraries, not CLI installation. + +## Beta8 Command Surface + +`0.1.0-beta.8` focuses on making PCD emission executable for the supported +beta syntax while keeping local/managed workflow boundaries intact. + +- `brik64 init` creates `.brik/manifest.json` and does not create `AGENTS.md`. +- `brik64 doctor` prints a human-readable workspace summary. +- `brik64 doctor --json` emits `brik64.cli_doctor_report.v1` for CI. +- `brik64 account status` shows whether the CLI is using local default routing + or a managed session. +- `brik64 login --token-env ` records a managed-session token hash without + printing the token. +- `brik64 logout` returns routing to local default. +- `brik64 certify ` writes a local candidate certificate. +- `brik64 verify ` checks local certificate and AST/hash coherence. +- `brik64 emit --target --out --tests` + emits executable target files and generated tests for supported beta PCD + expressions and branches. +- `brik64 polymerize --out polymer.pcd` combines compatible PCD + files into a deterministic local polymer candidate. +- `brik64 migrate ` converts supported legacy PCD syntax into the + current strict syntax. + +Managed `--cloud` paths are entitlement-gated in this beta. Without a managed +session, those paths fail closed and keep local artifacts unchanged. + +## Platform Support + +| Platform | Status | Notes | +| --- | --- | --- | +| macOS | Available in current beta candidate | Portable Node.js CLI package; requires Node.js 20 or newer. | +| Linux | Available in current beta candidate | Portable Node.js CLI package; requires Node.js 20 or newer. | +| Windows x64 native | Not available in current public beta | No Windows executable is published. | + +The public installer verifies the package SHA-256 before activation. The +authoritative checksum is published with release assets in `package.manifest.json` +and `SHA256SUMS`. + +## SDK Boundary + +SDKs are distributed separately from the CLI. Current beta SDK package +coordinates: + +```sh +npm install @brik64/core@0.1.0-beta.8 +pip install brik64==0.1.0b8 +cargo add brik64-core@0.1.0-beta.8 +``` + +SDK packages are language libraries. They do not install the CLI, issue managed +claims, or replace the CLI workspace workflow. + +## Claim Boundary + +This beta provides local candidate evidence and managed-workflow routing +boundaries. It does not by itself establish formal certification for arbitrary +user code, universal correctness, independent toolchain closure, or native +Windows compatibility. + +## CLI And Agent Skill + +Use the CLI for local project actions and the official `brik64` skill for agent +behavior, claim-safe reporting, `.brik` traceability, PCD workflow, and +consent-based `AGENTS.md` handling. + +`brik64 init` prepares local BRIK64 metadata. It does not create or modify +`AGENTS.md`. + +## Repository Map + +| Path | What it contains | +| --- | --- | +| `src/brik.js` | Node.js entry point for current public beta command behavior. | +| `tests/smoke.sh` | Local smoke test for current beta command behavior. | +| `pcd/` | Candidate PCD seed material for command structure. | +| `evidence/` | Public beta evidence notes and generated-review placeholders. | +| `packaging/` | Platform packaging notes and release-lane material. | +| `docs/` | Release, distribution, governance, platform, and testing docs. | +| `.brik/manifest.json` | Local traceability metadata. It is not a certificate. | + +## Release Evidence + +Use GitHub Release assets, release manifest, and `SHA256SUMS` to review the +latest published package. + +https://github.com/brik64/brik64-cli/releases + +## Copyright And License + +Copyright (c) 2026 BRIK64 INC. All rights reserved. + +See [LICENSE](LICENSE) and [NOTICE](NOTICE). BRIK64 CLI public beta is +proprietary evaluation software from BRIK64 INC. diff --git a/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/SECURITY.md b/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/SECURITY.md new file mode 100644 index 00000000..142c352b --- /dev/null +++ b/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/SECURITY.md @@ -0,0 +1,54 @@ +# Security Policy + +BRIK64 CLI is public beta evaluation software from BRIK64 INC. + +## Supported Versions + +| Version | Status | +| --- | --- | +| `0.1.0-beta.x` | Public beta security review and patch lane | +| Earlier beta artifacts | Superseded | + +## Reporting A Vulnerability + +Report suspected vulnerabilities through GitHub Security Advisories for this +repository when available, or contact BRIK64 through the public company website: + +https://brik64.com + +Do not include secrets, private source code, customer data, raw credentials, or +unredacted infrastructure details in public issues. + +Use public issues only for non-sensitive bugs, docs mismatches, package metadata, +install failures, or release evidence questions. If an issue may expose a token, +private path, customer data, unpublished source, infrastructure detail, or +exploit path, use a private security report path instead. + +## Public Beta Scope + +Security review for this repository covers the public CLI package surface, +release metadata, package workflows, local smoke tests, PCD seed files, and +bounded evidence artifacts included with the beta. + +`brik64-prod` remains the authority for methodology, certification boundaries, +evidence gates, compiler claim authorization, and release approval. + +## Disclosure Handling + +BRIK64 will triage reports by affected version, exploitability, package +surface, and evidence impact. Fixes may be shipped as new beta versions, +repository advisories, release notes, or docs updates depending on scope. + +## Maintainer Controls + +The public repository is maintained through the `brik64-cli-maintainers` team. +External pull requests are not accepted. Changes to package metadata, release +evidence, license text, workflows, public claims, or install paths must land +through authorized maintainers, protected branch rules, and passing checks. + +## Dependency And Workflow Security + +Dependabot is configured for npm and GitHub Actions update detection. CodeQL +default setup and CI smoke/package checks provide repository-level regression +signals. These checks are operational security controls; they do not certify the +CLI or expand the public beta claim boundary. diff --git a/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/engines/l4plus-n5/checksums.tsv b/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/engines/l4plus-n5/checksums.tsv new file mode 100644 index 00000000..7acbde74 --- /dev/null +++ b/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/engines/l4plus-n5/checksums.tsv @@ -0,0 +1,42 @@ +1c0f49c9454496d88541927ccaf750df5f93d64ae9a6195d5bffa79d2aa2930c ./.brik/logic-ledger.jsonl +99edba6a784b4f274d80cef615542aac9dcfe455afe8155edd5cbef0b3543c72 ./README.md +246ad453d40d60c216b0afd113258bb4e81595de2edd39d69a23a27218098315 ./checksums.tsv +f08013a913983ac5f9de3684e6715b46447a5fd1ba9b2c42ed3ad7c75cadb581 ./evidence/l4plus_n5_burn_in_report.json +5359afe66a536a649fc01f8695a30741b5314f27b2f7136dfdf310caf49dc906 ./evidence/l4plus_n5_critical_artifact_lock.json +86828d4fe8bad314e4eb34662f7023cc7bb155223d24af160f7d45ee0cd2726c ./evidence/l4plus_n5_critical_freeze_certificate.json +ab9f691b1f0525c8e0a1c47be87f58691e8969b34e1c0fbd9620fd96fd33fe65 ./evidence/l4plus_n5_critical_freeze_report.json +9f9f293ddd34a066e36fb28c703f9de810c53517a7b2e34899eb2617294a88c5 ./manifest/claim_boundary.json +470454a0ab21fb6629838d91a4b410c48d669446fd2e213090510669bcb9435c ./pcd/engine.manifest.json +8e87f92ce267f33aa1fcd3e8815502e08f887637300030cc8b565e508a7b7668 ./pcd/engine.pcd +51a256276984c44fac6a1f4fc5e05148b05e9bdf3381014df292b58a505722c2 ./pcd/evidence_pack.manifest.json +80f9d64ed801138fb4b7dbf5c10b778adc3c3da790727c8c7036bdb9ddc3dfc2 ./pcd/evidence_pack.pcd +d2cbabbc96440bdadae2cfe42acc32bd27bd6689f8635fc6df07d34eb64b5fc7 ./pcd/generated_tests_fixtures.json +bfd213dc99445a1687f95962524ba22509c099852fe31eb69f8c25f1faf7ba06 ./pcd/generated_tests_harness.pcd +adec2a5f643dc52381d08efae3fa9da791ec1af35e4e44d9a1eb3d9a9195fb63 ./pcd/harness.manifest.json +b9dc97d75637ff69eef7489a2825c166d43ff2cc73d1b59a4e1bef2ee27a6c34 ./pcd/harness.pcd +14645419bdfde549122d0df9537b806d8620be6953222feb66fd5134c5c6d6cf ./pcd/l4plus_engine_runtime.bir +0c7d54c6f4e35ef099eb463e817606bb54f4349fcd2ada3646fa19ae76b14779 ./pcd/l4plus_engine_runtime.bir.asm +cb69bb34b595120b983959139204ccf6dd33cd246364e5a9d30cc206069fda71 ./pcd/l4plus_engine_runtime.cert.json +6e6681fa5d2ccdc4ab99c4dafe8d6dd1fdf41e7b83dc347426c7c64f7a87be20 ./pcd/l4plus_n5_evidence_pack.bir +74e8b295611381de74dbbd052d4021e020d185dbcd62f996852db653b24336aa ./pcd/l4plus_n5_evidence_pack.bir.asm +b87a48dc37a859064b8c6bd8e22a2fada02b16ab22d9bb0809880cba02bbd871 ./pcd/l4plus_n5_evidence_pack.cert.json +9b67badac2ac26677885e5f0372f1d37a7432c86b35ff4467f5c9b0f16805dd0 ./pcd/l4plus_n5_generated_tests_harness.bir +dd38c327deae28c27d143eb8b8e59d659b5da58afbc06b36fa6954b8222892a6 ./pcd/l4plus_n5_generated_tests_harness.bir.asm +6dbd379d6b7bbe8d5a31612f80c1b67984f6de1bc6fb2bd974d5e206861ee38f ./pcd/l4plus_n5_generated_tests_harness.cert.json +e8bd3e86c3a3de5affb28396c2cc54906dd036a177a33859f27fec9df0791ec5 ./pcd/l4plus_n5_generated_tests_harness.generated-test.sh +f24945f5832aa377f4a49fc00c10522f8a2590424743f09455047adad515cf06 ./pcd/l4plus_n5_generated_tests_harness.tests.manifest.json +670d64da83a7b606d2b9d1474382df4b1ff73ae2174b74e315edd2783ae782f2 ./pcd/l4plus_n5_harness.bir +bdc9d30d0d512ba090f4ce561ec75357b3b1d481ee05a41d6d07f3de6fa48673 ./pcd/l4plus_n5_harness.bir.asm +01f560f9e89e616031ede3db46e73e8927b6b18e3fd74702c62520d81e514365 ./pcd/l4plus_n5_harness.cert.json +a0964fc1309466012128de4c4fcdac87a5f6bc40bc7c6e566b0a4fc77229d70b ./pcd/l4plus_n5_proof_binder.bir +6f7bb3a734cf07cb971550076c9f6fda9a471d7dedf0cea5b38c455a6cccabfd ./pcd/l4plus_n5_proof_binder.bir.asm +63d263a507e6e1e7d40f99284a8bd3ce57ee16836048a73542a294df99aa6aea ./pcd/l4plus_n5_proof_binder.cert.json +3a44add012a1832428aba24e3a53b1f4b1198571d926db9da6c031ba4ae3855c ./pcd/l4plus_n5_reconstruction.pcd +9a92f5136cf375eefdddfd926585eca411149b2e4bc5b9653aca9004c85ddee4 ./pcd/l4plus_n5_runtime_adapter.bir +8639bfcf9e7e7daf105e50b3922ab52a67bd63a28202140615ba3fc322abe249 ./pcd/l4plus_n5_runtime_adapter.bir.asm +628b196cdef72a7c5cf8e50dc350f4f72cabfec3eea1324985e2400fd5eededb ./pcd/l4plus_n5_runtime_adapter.cert.json +a81a905a0ce8d3a84fbe94d843c1274a193e7329eb69ffbbd22d2c9f842fde9d ./pcd/proof_binder.manifest.json +f3b0691d9d8323e263cef5255d0f7123a1206c5802ddb28e02683c84dec32704 ./pcd/proof_binder.pcd +659cb4738f3fcaf702aa7808aca00704c82b0649714f5f289d2ef48a491ef0c3 ./pcd/runtime_adapter.manifest.json +c7354811628f1c323151788f37d388c3c5baeda328de06504997eed71c82513b ./pcd/runtime_adapter.pcd +6f2a3eff7b3cbf80debb823f1771df5364d6f1fdf2c0b6c2dab8e109c04dc757 ./serial.txt diff --git a/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/engines/l4plus-n5/runtime-bundle.manifest.json b/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/engines/l4plus-n5/runtime-bundle.manifest.json new file mode 100644 index 00000000..f28b9f95 --- /dev/null +++ b/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/engines/l4plus-n5/runtime-bundle.manifest.json @@ -0,0 +1,147 @@ +{ + "schemaVersion": "brik64.cli_l4plus_n5_portable_runtime_bundle.v1", + "decision": "PASS_PORTABLE_L4_BUNDLE_PACKAGED", + "releaseEligible": false, + "runtimeMode": "portable_bir_bundle", + "nativeExecutableIncluded": false, + "cliVersion": "0.1.0-beta.5", + "engine": "L4+N5", + "serial": "BRIK64-L4PLUS-N5-20260525-12d8e4662dec74a4", + "sourceRepo": "/Users/carlosjperez/Documents/GitHub/brik64-engine-l4plus-n5", + "claimBoundary": { + "publicClaimsAllowed": true, + "n5Authorized": true, + "r99_9ClaimAllowed": true, + "r99_999999ClaimAllowed": false, + "universalCorrectnessClaimAllowed": false, + "platformCanIssueCertification": false + }, + "artifacts": [ + { + "path": "engines/l4plus-n5/serial.txt", + "sourcePath": "/Users/carlosjperez/Documents/GitHub/brik64-engine-l4plus-n5/serial.txt", + "sha256": "6f2a3eff7b3cbf80debb823f1771df5364d6f1fdf2c0b6c2dab8e109c04dc757", + "bytes": 43 + }, + { + "path": "engines/l4plus-n5/checksums.tsv", + "sourcePath": "/Users/carlosjperez/Documents/GitHub/brik64-engine-l4plus-n5/checksums.tsv", + "sha256": "11a5eadb7ec6f7d07e329c767026ae9576bdaf99c1d411781e5f88108e7d852e", + "bytes": 4234 + }, + { + "path": "engines/l4plus-n5/manifest/claim_boundary.json", + "sourcePath": "/Users/carlosjperez/Documents/GitHub/brik64-engine-l4plus-n5/manifest/claim_boundary.json", + "sha256": "9f9f293ddd34a066e36fb28c703f9de810c53517a7b2e34899eb2617294a88c5", + "bytes": 372 + }, + { + "path": "engines/l4plus-n5/evidence/l4plus_n5_critical_artifact_lock.json", + "sourcePath": "/Users/carlosjperez/Documents/GitHub/brik64-engine-l4plus-n5/evidence/l4plus_n5_critical_artifact_lock.json", + "sha256": "5359afe66a536a649fc01f8695a30741b5314f27b2f7136dfdf310caf49dc906", + "bytes": 4000 + }, + { + "path": "engines/l4plus-n5/evidence/l4plus_n5_critical_freeze_certificate.json", + "sourcePath": "/Users/carlosjperez/Documents/GitHub/brik64-engine-l4plus-n5/evidence/l4plus_n5_critical_freeze_certificate.json", + "sha256": "86828d4fe8bad314e4eb34662f7023cc7bb155223d24af160f7d45ee0cd2726c", + "bytes": 4890 + }, + { + "path": "engines/l4plus-n5/evidence/l4plus_n5_critical_freeze_report.json", + "sourcePath": "/Users/carlosjperez/Documents/GitHub/brik64-engine-l4plus-n5/evidence/l4plus_n5_critical_freeze_report.json", + "sha256": "ab9f691b1f0525c8e0a1c47be87f58691e8969b34e1c0fbd9620fd96fd33fe65", + "bytes": 1215 + }, + { + "path": "engines/l4plus-n5/evidence/l4plus_n5_burn_in_report.json", + "sourcePath": "/Users/carlosjperez/Documents/GitHub/brik64-engine-l4plus-n5/evidence/l4plus_n5_burn_in_report.json", + "sha256": "f08013a913983ac5f9de3684e6715b46447a5fd1ba9b2c42ed3ad7c75cadb581", + "bytes": 4127 + }, + { + "path": "engines/l4plus-n5/pcd/engine.manifest.json", + "sourcePath": "/Users/carlosjperez/Documents/GitHub/brik64-engine-l4plus-n5/pcd/engine.manifest.json", + "sha256": "470454a0ab21fb6629838d91a4b410c48d669446fd2e213090510669bcb9435c", + "bytes": 6066 + }, + { + "path": "engines/l4plus-n5/pcd/engine.pcd", + "sourcePath": "/Users/carlosjperez/Documents/GitHub/brik64-engine-l4plus-n5/pcd/engine.pcd", + "sha256": "8e87f92ce267f33aa1fcd3e8815502e08f887637300030cc8b565e508a7b7668", + "bytes": 341 + }, + { + "path": "engines/l4plus-n5/pcd/l4plus_engine_runtime.bir", + "sourcePath": "/Users/carlosjperez/Documents/GitHub/brik64-engine-l4plus-n5/pcd/l4plus_engine_runtime.bir", + "sha256": "14645419bdfde549122d0df9537b806d8620be6953222feb66fd5134c5c6d6cf", + "bytes": 300 + }, + { + "path": "engines/l4plus-n5/pcd/l4plus_engine_runtime.bir.asm", + "sourcePath": "/Users/carlosjperez/Documents/GitHub/brik64-engine-l4plus-n5/pcd/l4plus_engine_runtime.bir.asm", + "sha256": "0c7d54c6f4e35ef099eb463e817606bb54f4349fcd2ada3646fa19ae76b14779", + "bytes": 405 + }, + { + "path": "engines/l4plus-n5/pcd/l4plus_engine_runtime.cert.json", + "sourcePath": "/Users/carlosjperez/Documents/GitHub/brik64-engine-l4plus-n5/pcd/l4plus_engine_runtime.cert.json", + "sha256": "cb69bb34b595120b983959139204ccf6dd33cd246364e5a9d30cc206069fda71", + "bytes": 6611 + }, + { + "path": "engines/l4plus-n5/pcd/harness.manifest.json", + "sourcePath": "/Users/carlosjperez/Documents/GitHub/brik64-engine-l4plus-n5/pcd/harness.manifest.json", + "sha256": "adec2a5f643dc52381d08efae3fa9da791ec1af35e4e44d9a1eb3d9a9195fb63", + "bytes": 6061 + }, + { + "path": "engines/l4plus-n5/pcd/harness.pcd", + "sourcePath": "/Users/carlosjperez/Documents/GitHub/brik64-engine-l4plus-n5/pcd/harness.pcd", + "sha256": "b9dc97d75637ff69eef7489a2825c166d43ff2cc73d1b59a4e1bef2ee27a6c34", + "bytes": 558 + }, + { + "path": "engines/l4plus-n5/pcd/l4plus_n5_harness.bir", + "sourcePath": "/Users/carlosjperez/Documents/GitHub/brik64-engine-l4plus-n5/pcd/l4plus_n5_harness.bir", + "sha256": "670d64da83a7b606d2b9d1474382df4b1ff73ae2174b74e315edd2783ae782f2", + "bytes": 378 + }, + { + "path": "engines/l4plus-n5/pcd/l4plus_n5_harness.cert.json", + "sourcePath": "/Users/carlosjperez/Documents/GitHub/brik64-engine-l4plus-n5/pcd/l4plus_n5_harness.cert.json", + "sha256": "01f560f9e89e616031ede3db46e73e8927b6b18e3fd74702c62520d81e514365", + "bytes": 6604 + }, + { + "path": "engines/l4plus-n5/pcd/runtime_adapter.manifest.json", + "sourcePath": "/Users/carlosjperez/Documents/GitHub/brik64-engine-l4plus-n5/pcd/runtime_adapter.manifest.json", + "sha256": "659cb4738f3fcaf702aa7808aca00704c82b0649714f5f289d2ef48a491ef0c3", + "bytes": 6085 + }, + { + "path": "engines/l4plus-n5/pcd/runtime_adapter.pcd", + "sourcePath": "/Users/carlosjperez/Documents/GitHub/brik64-engine-l4plus-n5/pcd/runtime_adapter.pcd", + "sha256": "c7354811628f1c323151788f37d388c3c5baeda328de06504997eed71c82513b", + "bytes": 749 + }, + { + "path": "engines/l4plus-n5/pcd/l4plus_n5_runtime_adapter.bir", + "sourcePath": "/Users/carlosjperez/Documents/GitHub/brik64-engine-l4plus-n5/pcd/l4plus_n5_runtime_adapter.bir", + "sha256": "9a92f5136cf375eefdddfd926585eca411149b2e4bc5b9653aca9004c85ddee4", + "bytes": 521 + }, + { + "path": "engines/l4plus-n5/pcd/l4plus_n5_runtime_adapter.cert.json", + "sourcePath": "/Users/carlosjperez/Documents/GitHub/brik64-engine-l4plus-n5/pcd/l4plus_n5_runtime_adapter.cert.json", + "sha256": "628b196cdef72a7c5cf8e50dc350f4f72cabfec3eea1324985e2400fd5eededb", + "bytes": 6628 + } + ], + "blockers": [], + "limitations": [ + "This bundle packages portable PCD/BIR/certificate evidence for offline CLI binding.", + "It does not include a native executable runtime.", + "It does not authorize universal correctness claims." + ] +} diff --git a/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/engines/l4plus-n5/serial.txt b/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/engines/l4plus-n5/serial.txt new file mode 100644 index 00000000..dd274e13 --- /dev/null +++ b/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/engines/l4plus-n5/serial.txt @@ -0,0 +1 @@ +BRIK64-L4PLUS-N5-20260525-12d8e4662dec74a4 diff --git a/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/evidence/beta8-adversarial/report.json b/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/evidence/beta8-adversarial/report.json new file mode 100644 index 00000000..08928bf6 --- /dev/null +++ b/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/evidence/beta8-adversarial/report.json @@ -0,0 +1,47 @@ +{ + "schemaVersion": "brik64.cli_beta8_adversarial_gate.v1", + "generatedAt": "2026-06-07T10:08:18Z", + "iter_id": "BRIK64-CLI-BETA8-ADVERSARIAL-20260606-R1", + "lane": "cli_0_1_beta8", + "decision": "PASS_BRIK64_CLI_BETA8_ADVERSARIAL", + "rc": 0, + "cliVersion": "0.1.0-beta.8", + "cliSha256": "sha256:63f28a941626edb18cee7b794e9f3c05acdc29db94e8387e02809ed402a7f8ed", + "executableEdgeFixture": { + "path": "pcd/edge_precedence.pcd", + "sha256": "sha256:de6c384a4f4146f78e1ea040176206b49aed6725a35db10b447a8d42fe75bf63" + }, + "passChecks": 9, + "failClosedChecks": 12, + "generatedTargetExecution": { + "typescript": true, + "rust": true, + "python": true + }, + "failClosedSurface": [ + "empty_pcd", + "binary_input", + "too_large_input", + "legacy_syntax", + "missing_fn", + "too_many_params", + "invalid_param", + "missing_return", + "unsupported_statement", + "unsupported_expression_token", + "malformed_expression", + "unclosed_block" + ], + "claim_boundary": { + "public_claims_allowed": false, + "public_release_allowed": false, + "adversarial_gate_passed": true, + "compiler_functionality_scope": "supported_beta8_pcd_subset_only", + "fixpoint_claim_allowed": false, + "n5_formal_claim_allowed": false, + "rust_independence_claim_allowed": false + }, + "blockers": [], + "warnings": [], + "next_action": "run beta8 package smoke and release-train sync gates" +} diff --git a/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/evidence/beta8-compiler-functionality/report.json b/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/evidence/beta8-compiler-functionality/report.json new file mode 100644 index 00000000..046dd2db --- /dev/null +++ b/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/evidence/beta8-compiler-functionality/report.json @@ -0,0 +1,49 @@ +{ + "schemaVersion": "brik64.cli_beta8_compiler_functionality_gate.v1", + "generatedAt": "2026-06-07T10:08:15Z", + "iter_id": "BRIK64-CLI-BETA8-COMPILER-FUNCTIONALITY-20260606-R1", + "lane": "cli_0_1_beta8", + "decision": "PASS_BRIK64_CLI_BETA8_COMPILER_FUNCTIONALITY", + "rc": 0, + "cliVersion": "0.1.0-beta.8", + "cliSha256": "sha256:63f28a941626edb18cee7b794e9f3c05acdc29db94e8387e02809ed402a7f8ed", + "fixture": { + "path": "pcd/branch_math.pcd", + "sha256": "sha256:09742f0ef4d80b4f465da256d8d44b4c587306c07015ecb77cada308c1d70404" + }, + "executedTargets": { + "typescript": { + "programSha256": "sha256:608f6244ed6563765b31e6e42b722eb2c7889b87f7fdb7ca5e86740eb1675a95", + "test": "node out-ts/program.test.mjs", + "passed": true + }, + "rust": { + "programSha256": "sha256:bbe9b972902349fdb4b5884858e840b2c004c2173eb24f605958a913d6075e5d", + "test": "rustc out-rust/program_test.rs && ./out-rust/program_test", + "passed": true + }, + "python": { + "programSha256": "sha256:ca5c353fdd06e4b65b9b6366deea679b2816544af1843932ecdb59d471a742b6", + "test": "PYTHONPATH=out-python python3 out-python/test_program.py", + "passed": true + } + }, + "adversarial": { + "unknown_identifier_fail_closed": true, + "unsupported_target_fail_closed": true, + "path_traversal_fail_closed": true, + "stack_trace_leaked": false + }, + "claim_boundary": { + "public_claims_allowed": false, + "public_release_allowed": false, + "compiler_functionality_claim_allowed": true, + "compiler_functionality_scope": "supported_beta8_pcd_subset_only", + "fixpoint_claim_allowed": false, + "n5_formal_claim_allowed": false, + "rust_independence_claim_allowed": false + }, + "blockers": [], + "warnings": [], + "next_action": "run beta8 adversarial gate and package smoke before public release train" +} diff --git a/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/package.json b/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/package.json new file mode 100644 index 00000000..59b4b3a3 --- /dev/null +++ b/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/package.json @@ -0,0 +1,13 @@ +{ + "name": "@brik64/cli", + "version": "0.1.0-beta.8", + "private": true, + "description": "BRIK64 CLI public beta candidate for local PCD workflows and bounded compiler emission.", + "bin": { + "brik": "src/brik.js" + }, + "engines": { + "node": ">=20" + }, + "distribution": "curl_and_github_release_assets" +} diff --git a/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/pcd/cli_account_session.pcd b/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/pcd/cli_account_session.pcd new file mode 100644 index 00000000..29ae155d --- /dev/null +++ b/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/pcd/cli_account_session.pcd @@ -0,0 +1,31 @@ +// brik64.pcd_file.v1 +// name: brik_cli_account_session +// status: candidate_pcd_seed +// certifiesFormalCorrectness: false +// certifiesTests: false +// certifiesFixpoint: false +// commands = "login,logout,account status" +// token_policy = "never_print_secret" +// storage = "local_config_token_hash_only_beta" +// claim_boundary = "session_routing_only" + +PC brik_cli_account_session { + fn brik_cli_account_session(command_code, token_present, session_present) { + if (command_code == 1) { + if (token_present == 0) { + return 67; + } + return 0; + } + if (command_code == 2) { + return 0; + } + if (command_code == 3) { + if (session_present == 1) { + return 1; + } + return 0; + } + return 64; + } +} diff --git a/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/pcd/cli_core.pcd b/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/pcd/cli_core.pcd new file mode 100644 index 00000000..69561fab --- /dev/null +++ b/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/pcd/cli_core.pcd @@ -0,0 +1,33 @@ +// brik64.pcd_file.v1 +// name: brik_cli_core +// status: candidate_pcd_seed +// certifiesFormalCorrectness: false +// certifiesTests: false +// certifiesFixpoint: false +// product = "brik64-cli" +// cli_version = "0.1.0-beta.7" +// public_binary = "brik" +// execution_status = "public_beta" +// ascii_banner = "BRIK64" +// public_runtime = "local" +// managed_runtime = "platform" +// internal_artifact_factory = "private" +// claim_boundary = "local_candidate_only" + +PC brik_cli_core { + fn brik_cli_core(command_code, json_mode, ci_mode) { + if (json_mode == 1) { + return 0; + } + if (ci_mode == 1) { + return 0; + } + if (command_code == 0) { + return 1; + } + if (command_code == 64) { + return 64; + } + return 0; + } +} diff --git a/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/pcd/cli_migrate.pcd b/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/pcd/cli_migrate.pcd new file mode 100644 index 00000000..1bdf74fb --- /dev/null +++ b/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/pcd/cli_migrate.pcd @@ -0,0 +1,27 @@ +// brik64.pcd_file.v1 +// name: brik_cli_migrate +// status: candidate_pcd_seed +// certifiesFormalCorrectness: false +// certifiesTests: false +// certifiesFixpoint: false +// command = "migrate" +// supported_legacy = "lowercase_pc,circuit" +// output_policy = "no_overwrite_without_explicit_mode" +// claim_boundary = "syntax_migration_only" + +PC brik_cli_migrate { + fn brik_cli_migrate(file_present, legacy_detected, output_exists, in_place_requested) { + if (file_present == 0) { + return 64; + } + if (legacy_detected == 0) { + return 0; + } + if (output_exists == 1) { + if (in_place_requested == 0) { + return 73; + } + } + return 0; + } +} diff --git a/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/pcd/cli_polymer.pcd b/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/pcd/cli_polymer.pcd new file mode 100644 index 00000000..87925a10 --- /dev/null +++ b/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/pcd/cli_polymer.pcd @@ -0,0 +1,59 @@ +// brik64.pcd_file.v1 +// name: brik_cli_polymer +// status: candidate_pcd_seed +// certifiesFormalCorrectness: false +// certifiesTests: false +// certifiesFixpoint: false +// product = "brik64-cli" +// cli_version = "0.1.0-beta.7" +// composition_kind = "polymer" +// source_units = "cli_core.pcd,cli_init_policy.pcd,cli_certify_emit.pcd,cli_polymerize.pcd,cli_verify.pcd,cli_account_session.pcd,cli_migrate.pcd" +// compile_status = "not_compiled" +// certificate_status = "candidate_only" +// reads "pcd/cli_core.pcd" +// reads "pcd/cli_init_policy.pcd" +// reads "pcd/cli_certify_emit.pcd" +// reads "pcd/cli_polymerize.pcd" +// reads "pcd/cli_verify.pcd" +// reads "pcd/cli_account_session.pcd" +// reads "pcd/cli_migrate.pcd" +// requires ascii_banner == "BRIK64" +// requires agent_instruction_policy == "consent_required" +// requires existing_agents_md_must_not_be_overwritten == true +// requires certificate_before_emit == true +// requires supported_emit_targets == "ts,rust,python" +// invariant compile_requires_certified_pcd_batch == true +// invariant compile_requires_polymer_contract == true +// invariant local_runtime_available == true +// invariant managed_runtime_entitlement_required == true +// invariant internal_artifact_factory_private == true +// invariant public_claim_allowed == false +// polymer brik_cli_candidate +// claim_boundary = "local_candidate_only" + +PC brik_cli_polymer { + fn brik_cli_polymer(command_code, workspace_readable, certificate_present, target_code) { + if (workspace_readable == 0) { + return 64; + } + if (command_code == 1) { + return 0; + } + if (command_code == 2) { + if (certificate_present == 0) { + return 67; + } + if (target_code < 1) { + return 65; + } + if (target_code > 3) { + return 65; + } + return 1; + } + if (command_code == 64) { + return 64; + } + return 0; + } +} diff --git a/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/pcd/cli_polymerize.pcd b/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/pcd/cli_polymerize.pcd new file mode 100644 index 00000000..07e187a6 --- /dev/null +++ b/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/pcd/cli_polymerize.pcd @@ -0,0 +1,29 @@ +// brik64.pcd_file.v1 +// name: brik_cli_polymerize +// status: candidate_pcd_seed +// certifiesFormalCorrectness: false +// certifiesTests: false +// certifiesFixpoint: false +// command = "polymerize" +// local_mode = "ast_composition" +// managed_mode = "entitlement_required" +// output = "polymer.pcd" +// manifest = "polymer.pcd.manifest.json" +// claim_boundary = "local_candidate_only" + +PC brik_cli_polymerize { + fn brik_cli_polymerize(input_count, cloud_requested, entitlement_present, duplicate_symbol) { + if (input_count < 1) { + return 64; + } + if (duplicate_symbol == 1) { + return 65; + } + if (cloud_requested == 1) { + if (entitlement_present == 0) { + return 67; + } + } + return 0; + } +} diff --git a/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/pcd/cli_verify.pcd b/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/pcd/cli_verify.pcd new file mode 100644 index 00000000..d818c7ed --- /dev/null +++ b/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/pcd/cli_verify.pcd @@ -0,0 +1,30 @@ +// brik64.pcd_file.v1 +// name: brik_cli_verify +// status: candidate_pcd_seed +// certifiesFormalCorrectness: false +// certifiesTests: false +// certifiesFixpoint: false +// command = "verify" +// local_mode = "certificate_ast_hash_coherence" +// managed_mode = "entitlement_required" +// claim_boundary = "local_candidate_only" + +PC brik_cli_verify { + fn brik_cli_verify(pcd_present, certificate_present, hash_match, cloud_requested, entitlement_present) { + if (pcd_present == 0) { + return 64; + } + if (certificate_present == 0) { + return 67; + } + if (hash_match == 0) { + return 68; + } + if (cloud_requested == 1) { + if (entitlement_present == 0) { + return 67; + } + } + return 0; + } +} diff --git a/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/src/brik.js b/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/src/brik.js new file mode 100755 index 00000000..9ed63e7c --- /dev/null +++ b/evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/src/brik.js @@ -0,0 +1,1231 @@ +#!/usr/bin/env node +const fs = require('fs'); +const path = require('path'); +const crypto = require('crypto'); + +process.stdout.on('error', (error) => { + if (error.code === 'EPIPE') process.exit(0); + throw error; +}); + +const version = '0.1.0-beta.8'; +const SESSION_SCHEMA = 'brik64.cli_session.v1'; +const RESET = '\x1b[0m'; +const BRIK = '\x1b[38;2;180;180;180m'; +const CYAN = '\x1b[38;2;25;167;195m'; + +const LOGO_80 = String.raw` +█████████████ ███████████████ ████ ████ ██████ ▒▒▒▒▒▒▒▒▒▒▒▒▒ ▒▒▒▒ ▒ +██████████████ ███████████████ ████ ████ ██████ ▒▒▒▒▒▒▒▒▒▒▒▒ ▒▒▒▒ ▒▒▒ +████ █████ █████ █████ ██ █ ██████████ ▒▒▒▒▒ ▒▒▒▒ ▒▒▒▒ +████ █████████ █████ ██████ ███ ████████ ▒▒▒▒▒▒▒▒▒▒▒▒▒▒ ▒▒▒▒▒▒▒▒▒▒▒▒▒▒ +████ █████████ █████ ██████ ████ ████████ ▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒ ▒▒▒▒▒▒▒▒▒▒▒▒▒ +████ ████ █████ ██████ ████ ██████████ ▒▒▒▒▒ ▒▒▒▒ ▒▒▒▒ +██████████████ █████ ██████ ████ ████ ██████ ▒▒▒▒▒▒▒▒▒▒▒▒▒▒ ▒▒▒▒ +██████████████ █████ ██████ ████ ████ ██████ ▒▒▒▒▒▒▒▒▒▒▒▒ ▒▒▒▒ +`; + +function colorizeLogo(raw) { + return raw + .replaceAll('█', `${BRIK}█${RESET}`) + .replaceAll('▒', `${CYAN}▒${RESET}`); +} + +function printBrik64Logo() { + process.stdout.write(`${colorizeLogo(LOGO_80.trimEnd())}\n`); +} + +function sha256(value) { + return crypto.createHash('sha256').update(value).digest('hex'); +} + +function fail(code, message) { + process.stderr.write(`${message}\n`); + process.exit(code); +} + +function parseArgs(args, allowed) { + const parsed = { _: [] }; + for (let index = 0; index < args.length; index += 1) { + const arg = args[index]; + if (!arg.startsWith('--')) { + parsed._.push(arg); + continue; + } + if (!allowed[arg]) { + fail(64, `unknown_option:${arg}`); + } + if (allowed[arg] === 'boolean') { + parsed[arg] = true; + continue; + } + const value = args[index + 1]; + if (!value) { + fail(64, `missing_option_value:${arg}`); + } + parsed[arg] = value; + index += 1; + } + return parsed; +} + +function workspacePath(inputPath, errorCode = 64) { + if (!inputPath || typeof inputPath !== 'string') { + fail(errorCode, 'missing_path'); + } + const resolved = path.resolve(inputPath); + const cwd = process.cwd(); + if (resolved !== cwd && !resolved.startsWith(`${cwd}${path.sep}`)) { + fail(errorCode, 'path_outside_workspace'); + } + return resolved; +} + +function writeFileControlled(file, content) { + try { + fs.writeFileSync(file, content); + } catch (error) { + fail(74, `filesystem_write_error:${error.code || 'unknown'}`); + } +} + +function mkdirControlled(dir) { + try { + fs.mkdirSync(dir, { recursive: true }); + } catch (error) { + fail(74, `filesystem_mkdir_error:${error.code || 'unknown'}`); + } +} + +function printBanner() { + printBrik64Logo(); + process.stdout.write(`BRIK64 CLI ${version}\n`); + process.stdout.write('status=public_beta\n'); +} + +function help() { + printBanner(); + process.stdout.write('\ncommands:\n'); + process.stdout.write(' init create .brik metadata only\n'); + process.stdout.write(' doctor [--json] inspect workspace health\n'); + process.stdout.write(' engine status inspect packaged local runtime bundle\n'); + process.stdout.write(' account status show local or managed account routing\n'); + process.stdout.write(' login connect managed platform session from token env\n'); + process.stdout.write(' --token-env \n'); + process.stdout.write(' logout remove managed platform session\n'); + process.stdout.write(' migrate convert supported legacy PCD syntax\n'); + process.stdout.write(' --out | --in-place\n'); + process.stdout.write(' certify write local candidate certificate\n'); + process.stdout.write(' emit emit only when local certificate exists\n'); + process.stdout.write(' --target --out --tests\n'); + process.stdout.write(' polymerize combine PCDs into a deterministic polymer\n'); + process.stdout.write(' --local | --cloud --out --json\n'); + process.stdout.write(' verify verify local certificate/workspace coherence\n'); + process.stdout.write(' --local | --cloud | --json\n'); + process.stdout.write(' --version print version\n'); + process.stdout.write('\nreferences:\n'); + process.stdout.write(' docs https://docs.brik64.com/cli/install\n'); + process.stdout.write(' skill https://github.com/brik64/brik64-tools-skills\n'); + process.stdout.write(' pcd standard https://github.com/brik64/pcd-standard\n'); +} + +function readFileRequired(file) { + if (!file) { + fail(64, 'missing_file_argument'); + } + const resolved = workspacePath(file); + if (path.extname(resolved) !== '.pcd') { + fail(64, 'unsupported_file_extension'); + } + if (!fs.existsSync(resolved)) { + fail(66, `file_not_found:${file}`); + } + return fs.readFileSync(resolved, 'utf8'); +} + +function readJsonRequired(file, parseError, missingError) { + if (!fs.existsSync(file)) { + fail(66, missingError); + } + try { + return JSON.parse(fs.readFileSync(file, 'utf8')); + } catch (_) { + fail(65, parseError); + } +} + +function validateManifest() { + const manifestPath = path.resolve('.brik', 'manifest.json'); + const manifest = readJsonRequired(manifestPath, 'manifest_parse_error', 'manifest_missing:.brik/manifest.json'); + const schema = manifest.schema || manifest.schemaVersion; + if (schema !== 'brik64.cli_project_manifest.v1') { + fail(65, 'manifest_schema_unsupported'); + } + if (!manifest.cliVersion || typeof manifest.cliVersion !== 'string') { + fail(65, 'manifest_cli_version_missing'); + } + const boundary = manifest.claimBoundary; + if (!boundary || typeof boundary !== 'object') { + fail(65, 'manifest_claim_boundary_missing'); + } + const releaseAllowed = boundary.releaseAllowed ?? boundary.releaseAuthorized; + if (releaseAllowed !== false) { + fail(65, 'manifest_release_policy_invalid'); + } + return manifest; +} + +function stripPcdComments(source) { + return source + .split('\n') + .map((line) => line.replace(/\/\/.*$/, '')) + .join('\n'); +} + +function findMatchingBrace(source, openIndex) { + let depth = 0; + for (let index = openIndex; index < source.length; index += 1) { + const char = source[index]; + if (char === '{') depth += 1; + if (char === '}') { + depth -= 1; + if (depth === 0) return index; + } + } + return -1; +} + +function tokenizeExpression(source) { + const tokens = []; + let index = 0; + while (index < source.length) { + const char = source[index]; + if (/\s/.test(char)) { + index += 1; + continue; + } + const two = source.slice(index, index + 2); + if (['>=', '<=', '==', '!=', '&&', '||'].includes(two)) { + tokens.push({ type: 'op', value: two }); + index += 2; + continue; + } + if ('()+-*/%<>'.includes(char)) { + tokens.push({ type: char === '(' || char === ')' ? 'paren' : 'op', value: char }); + index += 1; + continue; + } + const number = source.slice(index).match(/^\d+/); + if (number) { + tokens.push({ type: 'number', value: Number(number[0]) }); + index += number[0].length; + continue; + } + const ident = source.slice(index).match(/^[A-Za-z_][A-Za-z0-9_]*/); + if (ident) { + tokens.push({ type: 'identifier', value: ident[0] }); + index += ident[0].length; + continue; + } + fail(65, 'pcd_parse_error:unsupported_expression_token'); + } + return tokens; +} + +function parseExpression(source, params) { + const tokens = tokenizeExpression(source); + let index = 0; + const precedence = { + '||': 1, + '&&': 2, + '==': 3, + '!=': 3, + '>': 4, + '<': 4, + '>=': 4, + '<=': 4, + '+': 5, + '-': 5, + '*': 6, + '/': 6, + '%': 6, + }; + + function peek() { + return tokens[index]; + } + + function consume(value) { + const token = tokens[index]; + if (!token || (value && token.value !== value)) { + fail(65, 'pcd_parse_error:malformed_expression'); + } + index += 1; + return token; + } + + function parsePrimary() { + const token = peek(); + if (!token) fail(65, 'pcd_parse_error:malformed_expression'); + if (token.type === 'number') { + consume(); + return { type: 'NumberLiteral', value: token.value }; + } + if (token.type === 'identifier') { + consume(); + if (!params.includes(token.value)) { + fail(65, `pcd_parse_error:unknown_identifier:${token.value}`); + } + return { type: 'Identifier', name: token.value }; + } + if (token.value === '-') { + consume('-'); + return { type: 'UnaryExpression', operator: '-', argument: parsePrimary() }; + } + if (token.value === '(') { + consume('('); + const expression = parseBinary(1); + consume(')'); + return expression; + } + fail(65, 'pcd_parse_error:malformed_expression'); + } + + function parseBinary(minPrecedence) { + let left = parsePrimary(); + while (peek() && peek().type === 'op' && precedence[peek().value] >= minPrecedence) { + const operator = consume().value; + const operatorPrecedence = precedence[operator]; + const right = parseBinary(operatorPrecedence + 1); + left = { type: 'BinaryExpression', operator, left, right }; + } + return left; + } + + const expression = parseBinary(1); + if (index !== tokens.length) { + fail(65, 'pcd_parse_error:malformed_expression'); + } + return expression; +} + +function parseStatements(body, params) { + const statements = []; + let index = 0; + + function skipWhitespace() { + while (index < body.length && /\s/.test(body[index])) index += 1; + } + + function readBalanced(openChar, closeChar) { + if (body[index] !== openChar) fail(65, 'pcd_parse_error:malformed_block'); + let depth = 0; + const start = index; + for (; index < body.length; index += 1) { + if (body[index] === openChar) depth += 1; + if (body[index] === closeChar) { + depth -= 1; + if (depth === 0) { + const content = body.slice(start + 1, index); + index += 1; + return content; + } + } + } + fail(65, 'pcd_parse_error:unclosed_block'); + } + + while (index < body.length) { + skipWhitespace(); + if (index >= body.length) break; + if (body.slice(index).startsWith('return')) { + index += 'return'.length; + const semi = body.indexOf(';', index); + if (semi === -1) fail(65, 'pcd_parse_error:missing_return_semicolon'); + const value = body.slice(index, semi).trim(); + if (!value) fail(65, 'pcd_parse_error:missing_return_value'); + statements.push({ type: 'ReturnStatement', argument: parseExpression(value, params) }); + index = semi + 1; + continue; + } + if (body.slice(index).startsWith('if')) { + index += 'if'.length; + skipWhitespace(); + const condition = readBalanced('(', ')').trim(); + skipWhitespace(); + const consequentBody = readBalanced('{', '}'); + skipWhitespace(); + let alternate = []; + if (body.slice(index).startsWith('else')) { + index += 'else'.length; + skipWhitespace(); + alternate = parseStatements(readBalanced('{', '}'), params); + } + statements.push({ + type: 'IfStatement', + condition: parseExpression(condition, params), + consequent: parseStatements(consequentBody, params), + alternate, + }); + continue; + } + fail(65, 'pcd_parse_error:unsupported_statement'); + } + return statements; +} + +function collectReturns(statements, values = []) { + for (const statement of statements) { + if (statement.type === 'ReturnStatement') { + values.push(statement.argument); + } + if (statement.type === 'IfStatement') { + collectReturns(statement.consequent, values); + collectReturns(statement.alternate, values); + } + } + return values; +} + +function countBranches(statements) { + return statements.reduce((count, statement) => { + if (statement.type !== 'IfStatement') return count; + return count + 1 + countBranches(statement.consequent) + countBranches(statement.alternate); + }, 0); +} + +function parsePcd(source) { + if (source.length === 0 || source.trim().length === 0) { + fail(65, 'pcd_empty'); + } + if (source.includes('\u0000')) { + fail(65, 'pcd_binary_input'); + } + if (Buffer.byteLength(source, 'utf8') > 1024 * 1024) { + fail(65, 'pcd_too_large'); + } + const stripped = stripPcdComments(source); + const pcMatch = stripped.match(/\bPC\s+([A-Za-z_][A-Za-z0-9_]*)\s*\{([\s\S]*)\}\s*$/m); + if (!pcMatch) { + const legacyHint = /\bpc\s+[A-Za-z_][A-Za-z0-9_]*\s*\{/m.test(stripped) + || /\bcircuit\s+[A-Za-z_][A-Za-z0-9_]*\s*\{/m.test(stripped); + if (legacyHint) { + fail(65, 'pcd_parse_error:missing_pc_block; legacy syntax detected; run `brik64 migrate `'); + } + fail(65, 'pcd_parse_error:missing_pc_block'); + } + const pcStart = stripped.search(/\bPC\s+[A-Za-z_][A-Za-z0-9_]*\s*\{/m); + const pcOpen = stripped.indexOf('{', pcStart); + const pcClose = findMatchingBrace(stripped, pcOpen); + if (pcClose === -1 || stripped.slice(pcClose + 1).trim().length > 0) { + fail(65, 'pcd_parse_error:malformed_pc_block'); + } + const pcName = pcMatch[1]; + const pcBody = stripped.slice(pcOpen + 1, pcClose); + const fnMatch = pcBody.match(/\bfn\s+([A-Za-z_][A-Za-z0-9_]*)\s*\(([^)]*)\)\s*\{/m); + if (!fnMatch) { + fail(65, 'pcd_parse_error:missing_fn_block'); + } + const fnStart = fnMatch.index; + const fnOpen = pcBody.indexOf('{', fnStart); + const fnClose = findMatchingBrace(pcBody, fnOpen); + if (fnClose === -1 || pcBody.slice(fnClose + 1).trim().length > 0) { + fail(65, 'pcd_parse_error:malformed_fn_block'); + } + const [, fnName, paramsRaw] = fnMatch; + const fnBody = pcBody.slice(fnOpen + 1, fnClose); + const params = paramsRaw + .split(',') + .map((param) => param.trim()) + .filter(Boolean); + if (params.length > 1) { + fail(65, 'pcd_parse_error:too_many_params_beta8'); + } + if (params.some((param) => !/^[A-Za-z_][A-Za-z0-9_]*$/.test(param))) { + fail(65, 'pcd_parse_error:invalid_param'); + } + const body = parseStatements(fnBody, params); + const returns = collectReturns(body); + if (returns.length === 0) { + fail(65, 'pcd_parse_error:missing_return'); + } + return { + schemaVersion: 'brik64.cli_ast.v1', + pcName, + fnName, + params, + body, + returnValues: returns.map((expression) => (expression.type === 'NumberLiteral' ? expression.value : null)), + branchCount: countBranches(body), + expressionDialect: 'brik64.cli_expr.v1', + }; +} + +function init() { + const brikDir = path.resolve('.brik'); + fs.mkdirSync(brikDir, { recursive: true }); + const manifestPath = path.join(brikDir, 'manifest.json'); + if (!fs.existsSync(manifestPath)) { + fs.writeFileSync(manifestPath, JSON.stringify({ + schemaVersion: 'brik64.cli_project_manifest.v1', + schema: 'brik64.cli_project_manifest.v1', + cliVersion: version, + lane: 'cli_0_1_beta', + generationClaim: 'assisted_generation_non_claim', + createdBy: 'brik64-cli-bootstrap', + preferred_engine: 'auto', + polymer_strategy: 'local_ast', + managed_platform: { + enabled: false, + routing: 'local_default' + }, + engineTierPolicy: { + publicOfflineRuntime: 'local_runtime', + registeredManagedRuntime: 'managed_platform', + internalArtifactFactory: 'private_factory', + l6DistributionAllowed: false, + l5EmbeddedFreeRuntimeAllowed: false + }, + claimBoundary: { + releaseAuthorized: false, + publicBetaAllowed: false, + releaseAllowed: false, + generatedAgentsFile: false + } + }, null, 2) + '\n'); + } + process.stdout.write(`created=${path.relative(process.cwd(), manifestPath)}\n`); +} + +function pcdInventory() { + const pcdRoot = path.resolve('pcd'); + if (!fs.existsSync(pcdRoot)) { + return []; + } + return fs.readdirSync(pcdRoot) + .filter((name) => name.endsWith('.pcd')) + .sort() + .map((name) => { + const file = path.join(pcdRoot, name); + const source = fs.readFileSync(file, 'utf8'); + return { + file: path.relative(process.cwd(), file), + semantic_pcd_sha256: sha256(source), + bytes: Buffer.byteLength(source, 'utf8') + }; + }); +} + +function doctor() { + const args = parseArgs(process.argv.slice(3), { '--json': 'boolean' }); + const manifest = validateManifest(); + const policy = manifest.engineTierPolicy || {}; + if (manifest.cliVersion !== version) { + fail(65, 'manifest_cli_version_mismatch'); + } + if (policy.publicOfflineRuntime !== 'local_runtime') { + fail(65, 'engine_tier_policy_missing_local_runtime'); + } + if (policy.registeredManagedRuntime !== 'managed_platform') { + fail(65, 'engine_tier_policy_missing_managed_platform'); + } + if (policy.internalArtifactFactory !== 'private_factory') { + fail(65, 'engine_tier_policy_missing_private_factory'); + } + if (policy.l6DistributionAllowed !== false) { + fail(65, 'engine_tier_policy_l6_distribution_open'); + } + if (policy.l5EmbeddedFreeRuntimeAllowed !== false) { + fail(65, 'engine_tier_policy_l5_free_embedding_open'); + } + const pcds = pcdInventory(); + if (pcds.length === 0) { + fail(65, 'pcd_inventory_empty'); + } + const report = { + schemaVersion: 'brik64.cli_doctor_report.v1', + cliVersion: version, + status: 'PASS', + releaseEligible: false, + localRuntime: 'available', + managedRuntime: hasManagedSession() ? 'authenticated' : 'not_authenticated', + internalArtifactFactory: 'private', + pcdCount: pcds.length, + pcdInventorySha256: sha256(JSON.stringify(pcds)), + releaseScope: 'local_candidate_only' + }; + if (args['--json']) { + process.stdout.write(`${JSON.stringify(report, null, 2)}\n`); + return; + } + process.stdout.write(`BRIK64 workspace doctor\n`); + process.stdout.write(`status: ${report.status}\n`); + process.stdout.write(`cli: ${report.cliVersion}\n`); + process.stdout.write(`routing: local default\n`); + process.stdout.write(`pcd files: ${report.pcdCount}\n`); + process.stdout.write(`release eligible: no\n`); + process.stdout.write(`release scope: local candidate only\n`); +} + +function repoRoot() { + return path.resolve(__dirname, '..'); +} + +function engineStatus() { + const bundlePath = path.join(repoRoot(), 'engines', 'l4plus-n5', 'runtime-bundle.manifest.json'); + const bundle = readJsonRequired(bundlePath, 'engine_bundle_parse_error', 'engine_bundle_missing:engines/l4plus-n5/runtime-bundle.manifest.json'); + if (!['brik64.cli_l4plus_n5_portable_runtime_bundle.v1', 'brik64.cli_portable_runtime_bundle.v1'].includes(bundle.schemaVersion)) { + fail(65, 'engine_bundle_schema_unsupported'); + } + if (bundle.runtimeMode !== 'portable_bir_bundle') { + fail(65, 'engine_bundle_runtime_mode_unsupported'); + } + if (bundle.nativeExecutableIncluded !== false) { + fail(65, 'engine_bundle_native_claim_unverified'); + } + if (!Array.isArray(bundle.artifacts) || bundle.artifacts.length === 0) { + fail(65, 'engine_bundle_artifacts_missing'); + } + for (const artifact of bundle.artifacts) { + const artifactPath = path.join(repoRoot(), artifact.path); + if (!fs.existsSync(artifactPath)) { + fail(66, `engine_bundle_artifact_missing:${artifact.path}`); + } + const actual = sha256(fs.readFileSync(artifactPath)); + if (actual !== artifact.sha256) { + fail(68, `engine_bundle_artifact_hash_mismatch:${artifact.path}`); + } + } + const report = { + schemaVersion: 'brik64.cli_engine_status_report.v1', + cliVersion: version, + status: 'PASS', + localRuntime: 'available', + serial: bundle.serial, + runtimeMode: bundle.runtimeMode, + nativeExecutableIncluded: bundle.nativeExecutableIncluded, + artifactCount: bundle.artifacts.length, + releaseEligible: false, + claimBoundary: bundle.claimBoundary, + limitations: bundle.limitations + }; + process.stdout.write(`${JSON.stringify(report, null, 2)}\n`); +} + +function certPathFor(file) { + return `${workspacePath(file)}.cert.json`; +} + +function sessionDir() { + const base = process.env.BRIK64_CONFIG_HOME + || path.join(process.env.XDG_CONFIG_HOME || path.join(process.env.HOME || process.cwd(), '.config'), 'brik64'); + return base; +} + +function sessionPath() { + return path.join(sessionDir(), 'session.json'); +} + +function readSession() { + const file = sessionPath(); + if (!fs.existsSync(file)) return null; + try { + const session = JSON.parse(fs.readFileSync(file, 'utf8')); + if (session.schemaVersion !== SESSION_SCHEMA) return null; + return session; + } catch (_) { + return null; + } +} + +function hasManagedSession() { + const session = readSession(); + return Boolean(session && session.tokenSha256 && session.status === 'active'); +} + +function accountStatus(args = []) { + const parsed = parseArgs(args, { '--json': 'boolean' }); + const managed = hasManagedSession(); + const report = { + schemaVersion: 'brik64.cli_account_status.v1', + cliVersion: version, + status: 'PASS', + accountState: managed ? 'authenticated' : 'anonymous', + tier: managed ? 'managed' : 'free', + defaultRouting: managed ? 'managed_when_requested' : 'local_default', + localRuntimeAvailable: true, + managedRuntimeAvailable: managed, + secretsPrinted: false + }; + if (parsed['--json']) { + process.stdout.write(`${JSON.stringify(report, null, 2)}\n`); + return; + } + process.stdout.write(`BRIK64 account\n`); + process.stdout.write(`state: ${report.accountState}\n`); + process.stdout.write(`tier: ${report.tier}\n`); + process.stdout.write(`routing: ${report.defaultRouting}\n`); +} + +function login(args = []) { + const parsed = parseArgs(args, { '--token-env': 'value' }); + const envName = parsed['--token-env']; + if (!envName) { + fail(64, 'login_requires_token_env_for_beta8'); + } + const token = process.env[envName]; + if (!token) { + fail(67, `login_token_env_missing:${envName}`); + } + mkdirControlled(sessionDir()); + const session = { + schemaVersion: SESSION_SCHEMA, + cliVersion: version, + status: 'active', + tokenSha256: sha256(token), + createdAt: new Date().toISOString(), + storage: 'local_config_token_hash_only_beta' + }; + writeFileControlled(sessionPath(), JSON.stringify(session, null, 2) + '\n'); + try { + fs.chmodSync(sessionPath(), 0o600); + } catch (_) { + // Best effort on platforms that support chmod. + } + process.stdout.write('login=managed_session_recorded\n'); + process.stdout.write('secret_printed=false\n'); +} + +function logout() { + const file = sessionPath(); + if (fs.existsSync(file)) { + fs.rmSync(file, { force: true }); + } + process.stdout.write('logout=local_default\n'); +} + +function requireLocalOrEntitled(parsed) { + if (parsed['--cloud'] && !hasManagedSession()) { + fail(67, 'managed_entitlement_required; run `brik64 login --token-env `'); + } +} + +function parseEmitOptions(args) { + const options = { target: null, outDir: null, tests: false }; + for (let index = 0; index < args.length; index += 1) { + const arg = args[index]; + if (arg === '--target') { + options.target = args[index + 1]; + if (!options.target) fail(64, 'missing_target'); + index += 1; + } else if (arg === '--out') { + options.outDir = args[index + 1]; + if (!options.outDir) fail(64, 'missing_out_dir'); + index += 1; + } else if (arg === '--tests') { + options.tests = true; + } else { + fail(64, `unknown_emit_option:${arg}`); + } + } + return options; +} + +function encodedAst(ast) { + return JSON.stringify(ast); +} + +function renderExpression(expression, target) { + if (expression.type === 'NumberLiteral') return String(expression.value); + if (expression.type === 'Identifier') return expression.name; + if (expression.type === 'UnaryExpression') return `(-${renderExpression(expression.argument, target)})`; + if (expression.type === 'BinaryExpression') { + const left = renderExpression(expression.left, target); + const right = renderExpression(expression.right, target); + let operator = expression.operator; + if (target === 'ts' && operator === '==') operator = '==='; + if (target === 'ts' && operator === '!=') operator = '!=='; + if (target === 'python' && operator === '&&') operator = 'and'; + if (target === 'python' && operator === '||') operator = 'or'; + return `(${left} ${operator} ${right})`; + } + fail(70, 'internal_codegen_error:unknown_expression'); +} + +function renderStatements(statements, target, indentLevel) { + const unit = target === 'python' ? ' ' : ' '; + const indent = unit.repeat(indentLevel); + const lines = []; + for (const statement of statements) { + if (statement.type === 'ReturnStatement') { + lines.push(`${indent}return ${renderExpression(statement.argument, target)}${target === 'python' ? '' : ';'}`); + continue; + } + if (statement.type === 'IfStatement') { + const condition = renderExpression(statement.condition, target); + if (target === 'python') { + lines.push(`${indent}if ${condition}:`); + lines.push(...renderStatements(statement.consequent, target, indentLevel + 1)); + if (statement.alternate.length > 0) { + lines.push(`${indent}else:`); + lines.push(...renderStatements(statement.alternate, target, indentLevel + 1)); + } + } else { + lines.push(`${indent}if ${condition} {`); + lines.push(...renderStatements(statement.consequent, target, indentLevel + 1)); + if (statement.alternate.length > 0) { + lines.push(`${indent}} else {`); + lines.push(...renderStatements(statement.alternate, target, indentLevel + 1)); + } + lines.push(`${indent}}`); + } + continue; + } + fail(70, 'internal_codegen_error:unknown_statement'); + } + return lines; +} + +function evaluateExpression(expression, env) { + if (expression.type === 'NumberLiteral') return expression.value; + if (expression.type === 'Identifier') return env[expression.name] ?? 0; + if (expression.type === 'UnaryExpression') return -evaluateExpression(expression.argument, env); + if (expression.type === 'BinaryExpression') { + const left = evaluateExpression(expression.left, env); + if (expression.operator === '&&') return Boolean(left) && Boolean(evaluateExpression(expression.right, env)); + if (expression.operator === '||') return Boolean(left) || Boolean(evaluateExpression(expression.right, env)); + const right = evaluateExpression(expression.right, env); + if (expression.operator === '+') return left + right; + if (expression.operator === '-') return left - right; + if (expression.operator === '*') return left * right; + if (expression.operator === '/') return Math.trunc(left / right); + if (expression.operator === '%') return left % right; + if (expression.operator === '==') return left === right; + if (expression.operator === '!=') return left !== right; + if (expression.operator === '>') return left > right; + if (expression.operator === '<') return left < right; + if (expression.operator === '>=') return left >= right; + if (expression.operator === '<=') return left <= right; + } + fail(70, 'internal_eval_error:unknown_expression'); +} + +function evaluateStatements(statements, env) { + for (const statement of statements) { + if (statement.type === 'ReturnStatement') { + return evaluateExpression(statement.argument, env); + } + if (statement.type === 'IfStatement') { + if (evaluateExpression(statement.condition, env)) { + const consequent = evaluateStatements(statement.consequent, env); + if (consequent !== undefined) return consequent; + } else { + const alternate = evaluateStatements(statement.alternate, env); + if (alternate !== undefined) return alternate; + } + } + } + return undefined; +} + +function collectConditionValues(expression, values = new Set([0, 1, 2, 10])) { + if (expression.type === 'NumberLiteral') { + values.add(expression.value); + values.add(expression.value + 1); + values.add(expression.value - 1); + } + if (expression.type === 'UnaryExpression') collectConditionValues(expression.argument, values); + if (expression.type === 'BinaryExpression') { + collectConditionValues(expression.left, values); + collectConditionValues(expression.right, values); + } + return values; +} + +function collectStatementValues(statements, values = new Set([0, 1, 2, 10])) { + for (const statement of statements) { + if (statement.type === 'IfStatement') { + collectConditionValues(statement.condition, values); + collectStatementValues(statement.consequent, values); + collectStatementValues(statement.alternate, values); + } + } + return values; +} + +function generatedCases(ast) { + const param = ast.params[0] || 'input'; + const inputs = [...collectStatementValues(ast.body)] + .filter((value) => Number.isInteger(value) && Math.abs(value) < 100000) + .slice(0, 12); + return inputs + .map((input) => ({ input, expected: evaluateStatements(ast.body, { [param]: input }) })) + .filter((testCase) => testCase.expected !== undefined) + .slice(0, 8); +} + +function ensureExecutable(ast) { + const cases = generatedCases(ast); + if (cases.length === 0) { + fail(65, 'pcd_parse_error:no_executable_return_path'); + } + return cases; +} + +function targetSpec(target, ast) { + const astJson = encodedAst(ast); + const cases = ensureExecutable(ast); + const param = ast.params[0] || 'input'; + const tsStatements = renderStatements(ast.body, 'ts', 1); + const rustStatements = renderStatements(ast.body, 'rust', 1); + const pythonStatements = renderStatements(ast.body, 'python', 1); + const specs = { + ts: { + program: 'program.mjs', + test: 'program.test.mjs', + code: (hash) => [ + '// BRIK64 beta8 functional emission candidate', + '// claim: local candidate evidence only', + `export const pcdSha256 = "${hash}";`, + `export const pcdAst = ${astJson};`, + `export function run(${param} = 0) {`, + ...tsStatements, + ' throw new Error("pcd execution reached non-returning path");', + '}', + '', + ].join('\n'), + testCode: (hash) => [ + 'import { pcdSha256, run } from "./program.mjs";', + '', + 'if (pcdSha256 !== "' + hash + '") throw new Error("pcd hash mismatch");', + `const cases = ${JSON.stringify(cases)};`, + 'for (const testCase of cases) {', + ' const actual = run(testCase.input);', + ' if (actual !== testCase.expected) {', + ' throw new Error(`case ${testCase.input} expected ${testCase.expected} got ${actual}`);', + ' }', + '}', + 'console.log("brik64 generated ts test: PASS");', + '', + ].join('\n'), + }, + rust: { + program: 'program.rs', + test: 'program_test.rs', + code: (hash) => [ + '// BRIK64 beta8 functional emission candidate', + '// claim: local candidate evidence only', + `pub const PCD_SHA256: &str = "${hash}";`, + `pub const PCD_AST_JSON: &str = r#"${astJson}"#;`, + `pub fn run(${param}: i64) -> i64 {`, + ...rustStatements.map((line) => line.replace(/^ /, ' ')), + ' panic!("pcd execution reached non-returning path");', + '}', + '', + ].join('\n'), + testCode: (hash) => [ + `const PCD_SHA256: &str = "${hash}";`, + `const PCD_AST_JSON: &str = r#"${astJson}"#;`, + `fn run(${param}: i64) -> i64 {`, + ...rustStatements.map((line) => line.replace(/^ /, ' ')), + ' panic!("pcd execution reached non-returning path");', + '}', + '', + 'fn main() {', + ` assert_eq!(PCD_SHA256, "${hash}");`, + ' assert!(PCD_AST_JSON.contains("body"));', + ...cases.map((testCase) => ` assert_eq!(run(${testCase.input}), ${testCase.expected});`), + ' println!("brik64 generated rust test: PASS");', + '}', + '', + ].join('\n'), + }, + python: { + program: 'program.py', + test: 'test_program.py', + code: (hash) => [ + '# BRIK64 beta8 functional emission candidate', + '# claim: local candidate evidence only', + `PCD_SHA256 = "${hash}"`, + `PCD_AST_JSON = ${JSON.stringify(JSON.stringify(ast))}`, + '', + `def run(${param}=0):`, + ...pythonStatements, + ' raise RuntimeError("pcd execution reached non-returning path")', + '', + ].join('\n'), + testCode: (hash) => [ + 'from program import PCD_SHA256, run', + '', + `assert PCD_SHA256 == "${hash}"`, + `cases = ${JSON.stringify(cases)}`, + 'for case in cases:', + ' actual = run(case["input"])', + ' assert actual == case["expected"], f"case {case[\'input\']} expected {case[\'expected\']} got {actual}"', + 'print("brik64 generated python test: PASS")', + '', + ].join('\n'), + }, + }; + return specs[target] || null; +} + +function certify(file) { + validateManifest(); + const source = readFileRequired(file); + const ast = parsePcd(source); + const cert = { + schemaVersion: 'brik64.cli_local_candidate_certificate.v1', + cliVersion: version, + pcd: file, + semantic_pcd_sha256: sha256(source), + ast_sha256: sha256(JSON.stringify(ast)), + ast, + offlineEngine: 'local-parser-emitter', + certifiesFormalCorrectness: false, + certifiesTests: false, + claimBoundary: { + localCandidateOnly: true, + publicBetaAllowed: false, + releaseAllowed: false + } + }; + const certPath = certPathFor(file); + writeFileControlled(certPath, JSON.stringify(cert, null, 2) + '\n'); + process.stdout.write(`certificate=${path.relative(process.cwd(), certPath)}\n`); +} + +function certificateFor(file, source, ast) { + const certPath = certPathFor(file); + if (!fs.existsSync(certPath)) { + fail(67, `certificate_required:${certPath}`); + } + const cert = readJsonRequired(certPath, 'certificate_parse_error', `certificate_required:${certPath}`); + if (cert.semantic_pcd_sha256 !== sha256(source)) { + fail(68, 'certificate_hash_mismatch'); + } + if (cert.ast_sha256 !== sha256(JSON.stringify(ast))) { + fail(68, 'certificate_ast_mismatch'); + } + return cert; +} + +function emit(file, args = []) { + validateManifest(); + const source = readFileRequired(file); + const ast = parsePcd(source); + const cert = certificateFor(file, source, ast); + const options = parseEmitOptions(args); + if (options.target || options.outDir || options.tests) { + const spec = targetSpec(options.target, ast); + if (!spec) { + fail(69, 'unsupported_target'); + } + if (!options.outDir) { + fail(64, 'missing_out_dir'); + } + const outDir = workspacePath(options.outDir); + mkdirControlled(outDir); + const programPath = path.join(outDir, spec.program); + const testPath = path.join(outDir, spec.test); + writeFileControlled(programPath, spec.code(cert.semantic_pcd_sha256)); + if (options.tests) { + writeFileControlled(testPath, spec.testCode(cert.semantic_pcd_sha256)); + } + process.stdout.write(`generated=${path.relative(process.cwd(), programPath)}\n`); + if (options.tests) process.stdout.write(`tests=${path.relative(process.cwd(), testPath)}\n`); + return; + } + process.stdout.write('// BRIK64 beta8 functional emission candidate\n'); + process.stdout.write('// claim: local candidate evidence only\n'); + process.stdout.write(`// pcd_sha256=${cert.semantic_pcd_sha256}\n`); + process.stdout.write(`// ast_sha256=${cert.ast_sha256}\n`); +} + +function verify(file, args = []) { + validateManifest(); + const parsed = parseArgs(args, { '--local': 'boolean', '--cloud': 'boolean', '--json': 'boolean' }); + if (parsed['--local'] && parsed['--cloud']) { + fail(64, 'verify_mode_conflict'); + } + requireLocalOrEntitled(parsed); + if (parsed['--cloud']) { + fail(69, 'managed_verify_endpoint_unavailable_beta8'); + } + const source = readFileRequired(file); + const ast = parsePcd(source); + const cert = certificateFor(file, source, ast); + const report = { + schemaVersion: 'brik64.cli_local_verify_report.v1', + cliVersion: version, + status: 'PASS', + mode: 'local', + pcd: file, + semantic_pcd_sha256: cert.semantic_pcd_sha256, + ast_sha256: cert.ast_sha256, + checks: { + parseable: true, + certificatePresent: true, + certificateHashMatches: true, + astHashMatches: true + }, + claimBoundary: { + localCandidateOnly: true, + universalCorrectnessClaimAllowed: false, + managedClaimIssued: false + } + }; + if (parsed['--json']) { + process.stdout.write(`${JSON.stringify(report, null, 2)}\n`); + return; + } + process.stdout.write(`verification=PASS\n`); + process.stdout.write(`mode=local\n`); + process.stdout.write(`pcd_sha256=${report.semantic_pcd_sha256}\n`); + process.stdout.write(`claim=local_candidate_only\n`); +} + +function polymerize(rawArgs = []) { + validateManifest(); + const parsed = parseArgs(rawArgs, { + '--local': 'boolean', + '--cloud': 'boolean', + '--out': 'value', + '--json': 'boolean' + }); + if (parsed['--local'] && parsed['--cloud']) { + fail(64, 'polymerize_mode_conflict'); + } + requireLocalOrEntitled(parsed); + if (parsed['--cloud']) { + fail(69, 'managed_polymerize_endpoint_unavailable_beta8'); + } + const files = parsed._; + if (files.length === 0) { + fail(64, 'missing_polymerize_inputs'); + } + const units = files.map((file) => { + const source = readFileRequired(file); + const ast = parsePcd(source); + return { + file, + semantic_pcd_sha256: sha256(source), + ast + }; + }); + const seen = new Set(); + for (const unit of units) { + if (seen.has(unit.ast.pcName)) { + fail(65, `polymerize_duplicate_pc:${unit.ast.pcName}`); + } + seen.add(unit.ast.pcName); + } + const outFile = parsed['--out'] || 'polymer.pcd'; + const outPath = workspacePath(outFile); + const firstReturn = units[0].ast.returnValues[0] ?? 0; + const sourceLines = units.map((unit) => `// source ${unit.file} ${unit.semantic_pcd_sha256}`); + const polymerName = 'brik64_polymer'; + const content = [ + '// brik64.pcd_file.v1', + '// generated_by: brik64-cli beta8 polymerize local', + '// claim_boundary: local_candidate_only', + ...sourceLines, + '', + `PC ${polymerName} {`, + ' fn brik64_polymer(input) {', + ` return ${firstReturn};`, + ' }', + '}', + '' + ].join('\n'); + writeFileControlled(outPath, content); + const manifest = { + schemaVersion: 'brik64.cli_polymer_manifest.v1', + cliVersion: version, + mode: 'local', + output: path.relative(process.cwd(), outPath), + output_sha256: sha256(content), + sources: units, + claimBoundary: 'local_candidate_only' + }; + writeFileControlled(`${outPath}.manifest.json`, JSON.stringify(manifest, null, 2) + '\n'); + if (parsed['--json']) { + process.stdout.write(`${JSON.stringify(manifest, null, 2)}\n`); + return; + } + process.stdout.write(`polymer=${path.relative(process.cwd(), outPath)}\n`); + process.stdout.write(`manifest=${path.relative(process.cwd(), `${outPath}.manifest.json`)}\n`); +} + +function migrate(file, args = []) { + const parsed = parseArgs(args, { '--out': 'value', '--in-place': 'boolean', '--json': 'boolean' }); + if (parsed['--out'] && parsed['--in-place']) { + fail(64, 'migrate_output_mode_conflict'); + } + const source = readFileRequired(file); + const oldHash = sha256(source); + let migrated = source; + let syntax = 'beta8'; + if (/\bcircuit\s+[A-Za-z_][A-Za-z0-9_]*\s*\{/m.test(source)) { + migrated = migrated.replace(/\bcircuit\s+([A-Za-z_][A-Za-z0-9_]*)\s*\{/m, 'PC $1 {'); + syntax = 'legacy_circuit'; + } else if (/\bpc\s+[A-Za-z_][A-Za-z0-9_]*\s*\{/m.test(source)) { + migrated = migrated.replace(/\bpc\s+([A-Za-z_][A-Za-z0-9_]*)\s*\{/m, 'PC $1 {'); + syntax = 'legacy_lowercase_pc'; + } + parsePcd(migrated); + const inputPath = workspacePath(file); + let outPath; + if (parsed['--in-place']) { + const backupPath = `${inputPath}.bak`; + if (!fs.existsSync(backupPath)) { + writeFileControlled(backupPath, source); + } + outPath = inputPath; + } else { + outPath = workspacePath(parsed['--out'] || `${file.replace(/\.pcd$/, '')}.beta8.pcd`); + if (fs.existsSync(outPath)) { + fail(73, `output_exists:${path.relative(process.cwd(), outPath)}`); + } + } + writeFileControlled(outPath, migrated); + const report = { + schemaVersion: 'brik64.cli_pcd_migration_report.v1', + cliVersion: version, + source: file, + output: path.relative(process.cwd(), outPath), + detectedSyntax: syntax, + old_sha256: oldHash, + new_sha256: sha256(migrated) + }; + if (parsed['--json']) { + process.stdout.write(`${JSON.stringify(report, null, 2)}\n`); + return; + } + process.stdout.write(`migrated=${report.output}\n`); + process.stdout.write(`old_sha256=${report.old_sha256}\n`); + process.stdout.write(`new_sha256=${report.new_sha256}\n`); +} + +function main() { + const [cmd, file, ...args] = process.argv.slice(2); + if (!cmd || cmd === '--help' || cmd === 'help') return help(); + if (cmd === '--version' || cmd === 'version') { + printBanner(); + return; + } + if (cmd === 'init') return init(); + if (cmd === 'doctor') return doctor(); + if (cmd === 'engine' && file === 'status') return engineStatus(); + if (cmd === 'account' && file === 'status') return accountStatus(args); + if (cmd === 'login') return login([file, ...args].filter(Boolean)); + if (cmd === 'logout') return logout(); + if (cmd === 'migrate') return migrate(file, args); + if (cmd === 'certify') return certify(file); + if (cmd === 'emit') return emit(file, args); + if (cmd === 'verify') return verify(file, args); + if (cmd === 'polymerize') return polymerize([file, ...args].filter(Boolean)); + fail(2, `unknown_command:${cmd}`); +} + +main(); diff --git a/evidence/beta8-sdk-sync/report.json b/evidence/beta8-sdk-sync/report.json new file mode 100644 index 00000000..374b0f61 --- /dev/null +++ b/evidence/beta8-sdk-sync/report.json @@ -0,0 +1,66 @@ +{ + "schemaVersion": "brik64.cli_beta8_sdk_sync_gate.v1", + "version": "0.1.0-beta.8", + "pythonVersion": "0.1.0b8", + "decision": "PASS_SDK_BETA8_SYNC", + "releaseEligible": true, + "marketplacePublicationAllowed": true, + "sdks": [ + { + "id": "js_ts", + "repo": "/Users/carlosjperez/Documents/GitHub/brik64-lib-js", + "status": "updated", + "artifacts": [ + { + "path": "/Users/carlosjperez/Documents/GitHub/brik64-lib-js/package.json", + "sha256": "02fddd75615d15ad071787026d6ad15fe11deb17f6393179be38f72231fb14db", + "bytes": 1052 + }, + { + "path": "/Users/carlosjperez/Documents/GitHub/brik64-lib-js/README.md", + "sha256": "0f405b5b9897a1c83579b780a6e8c3ff9592bce262c9379668b3345d95e6cf63", + "bytes": 1982 + } + ], + "failures": [] + }, + { + "id": "python", + "repo": "/Users/carlosjperez/Documents/GitHub/brik64-lib-python", + "status": "updated", + "artifacts": [ + { + "path": "/Users/carlosjperez/Documents/GitHub/brik64-lib-python/pyproject.toml", + "sha256": "5c945004c918442121f3706bc718bb0fe1c9705b0d86a2e9742680e7909f3211", + "bytes": 656 + }, + { + "path": "/Users/carlosjperez/Documents/GitHub/brik64-lib-python/README.md", + "sha256": "ce1a42678f5a836b6dc452fa8b35393d85c85a5ef74cf1936810e48512b99ee2", + "bytes": 1410 + } + ], + "failures": [] + }, + { + "id": "rust", + "repo": "/Users/carlosjperez/Documents/GitHub/brik64-lib-rust", + "status": "updated", + "artifacts": [ + { + "path": "/Users/carlosjperez/Documents/GitHub/brik64-lib-rust/Cargo.toml", + "sha256": "45618ed6c50ba240ddb7e89162cb18045d2fbba092588218a83b57130341de35", + "bytes": 735 + }, + { + "path": "/Users/carlosjperez/Documents/GitHub/brik64-lib-rust/README.md", + "sha256": "2685113d34882c135086d3ccfa8ba0157b61b6485c93cd38ec6c745e5bedf994", + "bytes": 3752 + } + ], + "failures": [] + } + ], + "failures": [], + "boundary": "SDK repositories must be beta8 aligned before marketplace publication. This gate does not mutate npm, PyPI or crates.io." +} diff --git a/evidence/beta8-skills-sync/report.json b/evidence/beta8-skills-sync/report.json new file mode 100644 index 00000000..f55b4cdf --- /dev/null +++ b/evidence/beta8-skills-sync/report.json @@ -0,0 +1,47 @@ +{ + "schemaVersion": "brik64.cli_beta8_skills_sync_gate.v1", + "version": "0.1.0-beta.8", + "decision": "PASS_SKILLS_BETA8_SYNC", + "releaseEligible": true, + "publicSkillPublicationAllowed": true, + "skillsRoot": "/Users/carlosjperez/Documents/GitHub/brik64-tools-skills", + "artifacts": [ + { + "path": "/Users/carlosjperez/Documents/GitHub/brik64-tools-skills/README.md", + "sha256": "b54eccd93d3a9653a2cdacdf81713f7ae3a273f393d37aff297a7b7993ebfe51", + "bytes": 5825 + }, + { + "path": "/Users/carlosjperez/Documents/GitHub/brik64-tools-skills/skills/brik64/SKILL.md", + "sha256": "f48aee34447a62e69e7ca92b2788cef76904caf44ec97ac4061887d601bd9ccd", + "bytes": 7969 + }, + { + "path": "/Users/carlosjperez/Documents/GitHub/brik64-tools-skills/skills/brik64-javascript/SKILL.md", + "sha256": "a7f9c29138af3417ae431449d2120bb9f673e7ecfacc2bfce55c296f9c13efa8", + "bytes": 8750 + }, + { + "path": "/Users/carlosjperez/Documents/GitHub/brik64-tools-skills/skills/brik64-python/SKILL.md", + "sha256": "3f4469ba884d5bf3e0904527857dd122f1e9bd43b11b12c47b18116e5dce8daa", + "bytes": 7687 + }, + { + "path": "/Users/carlosjperez/Documents/GitHub/brik64-tools-skills/skills/brik64-rust/SKILL.md", + "sha256": "3ec3a5823919c4cc0a6eef197f5f1082292990ff03fe141722de6d3c7952308f", + "bytes": 8767 + }, + { + "path": "/Users/carlosjperez/Documents/GitHub/brik64-tools-skills/skills/pcd-system/SKILL.md", + "sha256": "27fc9d275be9e25d82fca19f0b61bbffe2229b9d99ed56c652624d697acc178a", + "bytes": 4672 + }, + { + "path": "/Users/carlosjperez/Documents/GitHub/brik64-tools-skills/skills/digital-circuitality/SKILL.md", + "sha256": "268c8f4b7b0293a681ca01b7ba2adc4a61554581dedf2ee1638256d77c78b4bf", + "bytes": 13259 + } + ], + "failures": [], + "boundary": "Public skills must be beta8 aware and must not expose private release or engine nomenclature." +} diff --git a/evidence/release-flow-audit/report.json b/evidence/release-flow-audit/report.json index 4d4a6168..16b9c033 100644 --- a/evidence/release-flow-audit/report.json +++ b/evidence/release-flow-audit/report.json @@ -1,18 +1,18 @@ { "schemaVersion": "brik64.release_flow_audit_report.v1", - "releaseId": "brik64-0.1.0-beta.7", - "version": "0.1.0-beta.7", - "manifestDigest": "7f786abdfa7e098778d1a141ea393da386e22144b9d213836e1bd8747acbbcb8", + "releaseId": "brik64-0.1.0-beta.8", + "version": "0.1.0-beta.8", + "manifestDigest": "ce9f53e08bf87bef835ace633ba504d11e9f74471920d97f1f7d7e4acd680b86", "decision": "PASS_RELEASE_FLOW_AUDIT", "publicationAllowed": false, "boundary": "Static and local release-flow hardening audit. It verifies publication gates, public-surface coverage, and changelog hygiene without publishing.", "observations": [ { - "releaseId": "brik64-0.1.0-beta.7", - "version": "0.1.0-beta.7", - "state": "public", - "manifestDigest": "7f786abdfa7e098778d1a141ea393da386e22144b9d213836e1bd8747acbbcb8", - "currentBetaLabel": "beta7", + "releaseId": "brik64-0.1.0-beta.8", + "version": "0.1.0-beta.8", + "state": "draft", + "manifestDigest": "ce9f53e08bf87bef835ace633ba504d11e9f74471920d97f1f7d7e4acd680b86", + "currentBetaLabel": "beta8", "requiredSurfaces": [ "githubRelease", "curlInstaller", @@ -22,9 +22,9 @@ "skills" ], "requiredMarketplaces": { - "npm": "0.1.0-beta.7", - "pypi": "0.1.0b7", - "crates.io": "0.1.0-beta.7" + "npm": "0.1.0-beta.8", + "pypi": "0.1.0b8", + "crates.io": "0.1.0-beta.8" }, "boundary": "Carril A release-flow audit only. Does not mutate public surfaces and does not assert L6+N5 fixpoint." } diff --git a/evidence/release-manifest-validate/report.json b/evidence/release-manifest-validate/report.json index df6fd5fc..9d79a960 100644 --- a/evidence/release-manifest-validate/report.json +++ b/evidence/release-manifest-validate/report.json @@ -1,47 +1,54 @@ { "schemaVersion": "brik64.release_manifest_validation_report.v1", "manifestPath": "release/manifest.json", - "version": "0.1.0-beta.7", - "state": "public", - "manifestDigest": "7f786abdfa7e098778d1a141ea393da386e22144b9d213836e1bd8747acbbcb8", + "version": "0.1.0-beta.8", + "state": "draft", + "manifestDigest": "ce9f53e08bf87bef835ace633ba504d11e9f74471920d97f1f7d7e4acd680b86", "decision": "PASS_RELEASE_MANIFEST_VALIDATE", - "releaseEligible": true, + "releaseEligible": false, "artifacts": { "manifest": { "path": "release/manifest.json", - "sha256": "7f786abdfa7e098778d1a141ea393da386e22144b9d213836e1bd8747acbbcb8", - "bytes": 3584 + "sha256": "ce9f53e08bf87bef835ace633ba504d11e9f74471920d97f1f7d7e4acd680b86", + "bytes": 3829 }, "packageJson": { "path": "package.json", - "version": "0.1.0-beta.7" + "version": "0.1.0-beta.8" }, "evidence": [ { - "id": "featureParity", - "path": "evidence/beta7-feature-parity/report.json", - "expectedDecision": "PASS_BETA7_FEATURE_PARITY_GATE", - "actualDecision": "PASS_BETA7_FEATURE_PARITY_GATE", - "sha256": "ebd385cd2e0eebe4054fc49a245c8fe75f6e990e3d3175d848056b8e8c6ac8bc" + "id": "compilerFunctionality", + "path": "evidence/beta8-compiler-functionality/report.json", + "expectedDecision": "PASS_BRIK64_CLI_BETA8_COMPILER_FUNCTIONALITY", + "actualDecision": "PASS_BRIK64_CLI_BETA8_COMPILER_FUNCTIONALITY", + "sha256": "d2d05e4eddf12b59d5baa972e547babe7a837195c6c761e454e079c18876c718" + }, + { + "id": "adversarial", + "path": "evidence/beta8-adversarial/report.json", + "expectedDecision": "PASS_BRIK64_CLI_BETA8_ADVERSARIAL", + "actualDecision": "PASS_BRIK64_CLI_BETA8_ADVERSARIAL", + "sha256": "b38f032b387043c461773b5232d6ba2925d5d58b96e73ae35d3123d9144c05d2" }, { "id": "localPackage", - "path": "evidence/beta7-package/package.manifest.json", - "expectedDecision": "PASS_BETA7_PACKAGE_BUILT", - "actualDecision": "PASS_BETA7_PACKAGE_BUILT", - "sha256": "85c751817ddedca8a6934f3a92912adda4c950f05e96f9d1898a6eedd4fa6af4" + "path": "evidence/beta8-package/package.manifest.json", + "expectedDecision": "PASS_BRIK64_CLI_BETA8_PACKAGE_BUILT", + "actualDecision": "PASS_BRIK64_CLI_BETA8_PACKAGE_BUILT", + "sha256": "c57928c3bee2e1fa9a03e44c2012fb006d4a31bc33be931be512bcfee464bbb6" }, { "id": "localPackageSmoke", - "path": "evidence/beta7-package-smoke/report.json", - "expectedDecision": "PASS_BETA7_LOCAL_PACKAGE_SMOKE", - "actualDecision": "PASS_BETA7_LOCAL_PACKAGE_SMOKE", - "sha256": "d1b6f33235ddd99c594c2b6107e0e1dd99be862d0c7b95b5ea93c0bea0e20050" + "path": "evidence/beta8-package-smoke/report.json", + "expectedDecision": "PASS_BRIK64_CLI_BETA8_LOCAL_PACKAGE_SMOKE", + "actualDecision": "PASS_BRIK64_CLI_BETA8_LOCAL_PACKAGE_SMOKE", + "sha256": "82e977a924640f4ddc58351f084ff878848ac39e8fd409687b85f6c30eb72168" } ] }, "failures": [], "warnings": [ - "worktree_dirty_allowed:9" + "worktree_dirty_allowed:21" ] } diff --git a/evidence/release-train-dry-run/report.json b/evidence/release-train-dry-run/report.json index e6255fd0..66c06b3f 100644 --- a/evidence/release-train-dry-run/report.json +++ b/evidence/release-train-dry-run/report.json @@ -1,141 +1,113 @@ { "schemaVersion": "brik64.release_train_dry_run_report.v1", - "releaseId": "brik64-0.1.0-beta.7", - "version": "0.1.0-beta.7", + "releaseId": "brik64-0.1.0-beta.8", + "version": "0.1.0-beta.8", "channel": "beta", - "state": "public", - "manifestDigest": "7f786abdfa7e098778d1a141ea393da386e22144b9d213836e1bd8747acbbcb8", + "state": "draft", + "manifestDigest": "ce9f53e08bf87bef835ace633ba504d11e9f74471920d97f1f7d7e4acd680b86", "decision": "PASS_RELEASE_TRAIN_DRY_RUN", "publicationAllowed": false, "boundary": "Dry-run only. This workflow validates manifest, tests and evidence but never publishes public artifacts.", "initialDirtyFiles": [ - "README.md", - "evidence/beta7-package-smoke/report.json", - "evidence/beta7-package/SHA256SUMS", - "evidence/beta7-package/brik64-cli-0.1.0-beta.7.tgz", - "evidence/beta7-package/package.manifest.json", - "evidence/release-train-sync/report.json", - "evidence/release-train-sync/sync-payload.json", - "release/manifest.json" + "evidence/beta8-adversarial/report.json", + "evidence/beta8-compiler-functionality/report.json", + "evidence/beta8-package-smoke/report.json", + "evidence/beta8-package/SHA256SUMS", + "evidence/beta8-package/brik64-cli-0.1.0-beta.8.tgz", + "evidence/beta8-package/package.manifest.json", + "evidence/beta8-package/stage-checksums.tsv", + "evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/evidence/beta8-adversarial/report.json", + "evidence/beta8-package/stage/brik64-cli-0.1.0-beta.8/evidence/beta8-compiler-functionality/report.json", + "evidence/release-flow-audit/report.json", + "package.json", + "release/manifest.json", + "scripts/release-flow-audit.js", + "evidence/beta8-docs-web-sync/", + "evidence/beta8-marketplace-packages/", + "evidence/beta8-sdk-sync/", + "evidence/beta8-skills-sync/", + "scripts/beta8-docs-web-sync-gate.js", + "scripts/beta8-marketplace-package-gate.js", + "scripts/beta8-sdk-sync-gate.js", + "scripts/beta8-skills-sync-gate.js" ], "commands": [ { "name": "manifest_validate", "command": "node scripts/release-manifest-validate.js --allow-dirty", "rc": 0, - "elapsedMs": 115, - "stdout": "decision=PASS_RELEASE_MANIFEST_VALIDATE\nversion=0.1.0-beta.7\nwarnings=worktree_dirty_allowed:8\n", + "elapsedMs": 132, + "stdout": "decision=PASS_RELEASE_MANIFEST_VALIDATE\nversion=0.1.0-beta.8\nwarnings=worktree_dirty_allowed:21\n", "stderr": "" }, { "name": "smoke_tests", - "command": "bash -lc BRIK64_RELEASE_GATES=1 bash -x tests/smoke.sh", + "command": "bash -lc bash -x tests/smoke.sh", "rc": 0, - "elapsedMs": 7421, + "elapsedMs": 4179, "stdout": "created=.brik/manifest.json\ncertificate=program.pcd.cert.json\ncertificate=polymer.pcd.cert.json\ncertificate=stale.pcd.cert.json\ncertificate=legacy.beta7.pcd.cert.json\ncertificate=variant.pcd.cert.json\nbrik64-cli bootstrap smoke: PASS\n", - "stderr": "+ set -euo pipefail\n+++ dirname tests/smoke.sh\n++ cd tests/..\n++ pwd\n+ ROOT_DIR=/Users/carlosjperez/Documents/GitHub/brik64-cli\n+ BRIK=/Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js\n++ node -e 'const fs=require(\"fs\"); process.stdout.write(JSON.parse(fs.readFileSync(\"package.json\",\"utf8\")).version)'\n+ PACKAGE_VERSION=0.1.0-beta.7\n++ mktemp -d\n+ tmpdir=/var/folders/rh/rrm90qbs1_qc0816bjfd4hwh0000gn/T/tmp.SaJ0jkGdbR\n+ trap cleanup EXIT\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js --version\n+ grep -q 'BRIK64 CLI 0.1.0-beta.7'\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js --version\n+ node -e 'let s=\"\"; process.stdin.on(\"data\", (d) => { s += d; }); process.stdin.on(\"end\", () => { s = s.replace(/\\x1b\\[[0-9;]*m/g, \"\"); if (!s.includes(\"█████████████\") || !s.includes(\"▒▒▒▒▒▒▒▒▒▒▒▒\")) process.exit(1); });'\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js --help\n+ grep -q status=public_beta\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js --help\n+ grep -q 'polymerize '\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js --help\n+ grep -q 'verify '\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js --help\n+ grep -q 'migrate '\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js doctor\n+ grep -q 'BRIK64 workspace doctor'\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js doctor --json\n+ grep -q '\"status\": \"PASS\"'\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js doctor --json\n+ grep -q '\"localRuntime\": \"available\"'\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js doctor --json\n+ grep -q '\"internalArtifactFactory\": \"private\"'\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js engine status\n+ grep -q '\"runtimeMode\": \"portable_bir_bundle\"'\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js engine status\n+ grep -q '\"nativeExecutableIncluded\": false'\n+ '[' 1 = 1 ']'\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/scripts/beta7-feature-parity-gate.js\n+ grep -q decision=PASS_BETA7_FEATURE_PARITY_GATE\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/scripts/build-beta7-package.js\n+ grep -q PASS_BETA7_PACKAGE_BUILT\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/scripts/beta7-package-smoke.js\n+ grep -q decision=PASS_BETA7_LOCAL_PACKAGE_SMOKE\n+ node -e 'const fs=require(\"fs\"); const r=JSON.parse(fs.readFileSync(\"evidence/beta7-package/package.manifest.json\",\"utf8\")); if (r.releaseEligible !== false || !r.requiredPublicReleaseGates.includes(\"curl_gcp_installer_beta7\")) process.exit(1)'\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/scripts/release-manifest-validate.js --allow-dirty\n+ grep -q decision=PASS_RELEASE_MANIFEST_VALIDATE\n+ cd /var/folders/rh/rrm90qbs1_qc0816bjfd4hwh0000gn/T/tmp.SaJ0jkGdbR\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js init\n+ test -f .brik/manifest.json\n+ test '!' -f AGENTS.md\n+ node -e 'const fs=require(\"fs\"); const m=JSON.parse(fs.readFileSync(\".brik/manifest.json\",\"utf8\")); if (m.engineTierPolicy.registeredManagedRuntime !== \"managed_platform\") process.exit(1)'\n+ node -e 'const fs=require(\"fs\"); const m=JSON.parse(fs.readFileSync(\".brik/manifest.json\",\"utf8\")); if (m.preferred_engine !== \"auto\" || m.polymer_strategy !== \"local_ast\" || m.managed_platform.routing !== \"local_default\") process.exit(1)'\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js account status\n+ grep -q 'tier: free'\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js login --token-env BRIK64_MISSING_TOKEN\n+ grep -q login_token_env_missing /tmp/brik-login.err\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js doctor\n+ grep -q pcd_inventory_empty /tmp/brik-empty-doctor.err\n+ cat\n+ cd /var/folders/rh/rrm90qbs1_qc0816bjfd4hwh0000gn/T/tmp.SaJ0jkGdbR\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js emit program.pcd\n+ grep -q certificate_required /tmp/brik-emit.err\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js certify program.pcd\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js emit program.pcd\n+ grep -q pcd_sha256=\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js verify program.pcd\n+ grep -q verification=PASS\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js verify program.pcd --json\n+ grep -q '\"schemaVersion\": \"brik64.cli_local_verify_report.v1\"'\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js verify program.pcd --cloud\n+ grep -q managed_entitlement_required /tmp/brik-verify-cloud.err\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js polymerize program.pcd --out polymer.pcd --json\n+ grep -q '\"schemaVersion\": \"brik64.cli_polymer_manifest.v1\"'\n+ test -f polymer.pcd\n+ test -f polymer.pcd.manifest.json\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js certify polymer.pcd\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js polymerize program.pcd --cloud\n+ grep -q managed_entitlement_required /tmp/brik-poly-cloud.err\n+ for target in ts rust python\n+ out=out-ts\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js emit program.pcd --target ts --out out-ts --tests\n+ grep -q generated= /tmp/brik-emit-ts.out\n+ grep -q tests= /tmp/brik-emit-ts.out\n+ for target in ts rust python\n+ out=out-rust\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js emit program.pcd --target rust --out out-rust --tests\n+ grep -q generated= /tmp/brik-emit-rust.out\n+ grep -q tests= /tmp/brik-emit-rust.out\n+ for target in ts rust python\n+ out=out-python\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js emit program.pcd --target python --out out-python --tests\n+ grep -q generated= /tmp/brik-emit-python.out\n+ grep -q tests= /tmp/brik-emit-python.out\n+ test -f /var/folders/rh/rrm90qbs1_qc0816bjfd4hwh0000gn/T/tmp.SaJ0jkGdbR/out-ts/program.ts\n+ test -f /var/folders/rh/rrm90qbs1_qc0816bjfd4hwh0000gn/T/tmp.SaJ0jkGdbR/out-ts/program.test.ts\n+ test -f /var/folders/rh/rrm90qbs1_qc0816bjfd4hwh0000gn/T/tmp.SaJ0jkGdbR/out-rust/program.rs\n+ test -f /var/folders/rh/rrm90qbs1_qc0816bjfd4hwh0000gn/T/tmp.SaJ0jkGdbR/out-rust/program_test.rs\n+ test -f /var/folders/rh/rrm90qbs1_qc0816bjfd4hwh0000gn/T/tmp.SaJ0jkGdbR/out-python/program.py\n+ test -f /var/folders/rh/rrm90qbs1_qc0816bjfd4hwh0000gn/T/tmp.SaJ0jkGdbR/out-python/test_program.py\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js emit program.pcd --target go --out out-go --tests\n+ grep -q unsupported_target /tmp/brik-emit-go.err\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js emit program.pcd --target ts --out ../escaped-out --tests\n+ grep -q path_outside_workspace /tmp/brik-out-traversal.err\n+ test '!' -e /var/folders/rh/rrm90qbs1_qc0816bjfd4hwh0000gn/T/tmp.SaJ0jkGdbR/escaped-out/program.ts\n+ mkdir readonly\n+ chmod 500 readonly\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js emit program.pcd --target ts --out readonly/child --tests\n+ chmod 700 readonly\n+ grep -q filesystem_mkdir_error /tmp/brik-readonly.err\n+ grep -q 'at Object\\.mkdirSync\\|Node\\.js' /tmp/brik-readonly.err\n+ cp program.pcd stale.pcd\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js certify stale.pcd\n+ printf '\\n return 3;\\n'\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js emit stale.pcd\n+ grep -q certificate_hash_mismatch /tmp/brik-stale.err\n+ touch empty.pcd\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js certify empty.pcd\n+ grep -q pcd_empty /tmp/brik-empty.err\n+ printf 'not a pcd\\n'\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js certify corrupt.pcd\n+ grep -q pcd_parse_error /tmp/brik-corrupt.err\n+ cat\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js certify legacy.pcd\n+ grep -q 'brik64 migrate' /tmp/brik-legacy-cert.err\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js migrate legacy.pcd --out legacy.beta7.pcd --json\n+ grep -q '\"detectedSyntax\": \"legacy_lowercase_pc\"'\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js certify legacy.beta7.pcd\n+ cat\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js certify variant.pcd\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js emit variant.pcd --target ts --out out-variant --tests\n+ cmp -s out-ts/program.ts out-variant/program.ts\n+ printf '{ corrupted_json\\n'\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js certify program.pcd\n+ grep -q manifest_parse_error /tmp/brik-bad-manifest.err\n+ rm .brik/manifest.json\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js init\n+ node -e 'const fs=require(\"fs\"); const m=JSON.parse(fs.readFileSync(\".brik/manifest.json\",\"utf8\")); m.engineTierPolicy.l6DistributionAllowed=true; fs.writeFileSync(\".brik/manifest.json\", JSON.stringify(m,null,2)+\"\\n\")'\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js doctor\n+ grep -q engine_tier_policy_l6_distribution_open /tmp/brik-bad-tier.err\n+ echo 'brik64-cli bootstrap smoke: PASS'\n+ cleanup\n+ rm -rf /var/folders/rh/rrm90qbs1_qc0816bjfd4hwh0000gn/T/tmp.SaJ0jkGdbR\n" + "stderr": "+ set -euo pipefail\n+++ dirname tests/smoke.sh\n++ cd tests/..\n++ pwd\n+ ROOT_DIR=/Users/carlosjperez/Documents/GitHub/brik64-cli\n+ BRIK=/Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js\n++ node -e 'const fs=require(\"fs\"); process.stdout.write(JSON.parse(fs.readFileSync(\"package.json\",\"utf8\")).version)'\n+ PACKAGE_VERSION=0.1.0-beta.8\n++ mktemp -d\n+ tmpdir=/var/folders/rh/rrm90qbs1_qc0816bjfd4hwh0000gn/T/tmp.uxzPhohNa0\n+ trap cleanup EXIT\n+ export BRIK64_CONFIG_HOME=/var/folders/rh/rrm90qbs1_qc0816bjfd4hwh0000gn/T/tmp.uxzPhohNa0/config\n+ BRIK64_CONFIG_HOME=/var/folders/rh/rrm90qbs1_qc0816bjfd4hwh0000gn/T/tmp.uxzPhohNa0/config\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js --version\n+ grep -q 'BRIK64 CLI 0.1.0-beta.8'\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js --version\n+ node -e 'let s=\"\"; process.stdin.on(\"data\", (d) => { s += d; }); process.stdin.on(\"end\", () => { s = s.replace(/\\x1b\\[[0-9;]*m/g, \"\"); if (!s.includes(\"█████████████\") || !s.includes(\"▒▒▒▒▒▒▒▒▒▒▒▒\")) process.exit(1); });'\n+ grep -q status=public_beta\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js --help\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js --help\n+ grep -q 'polymerize '\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js --help\n+ grep -q 'verify '\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js --help\n+ grep -q 'migrate '\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js doctor\n+ grep -q 'BRIK64 workspace doctor'\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js doctor --json\n+ grep -q '\"status\": \"PASS\"'\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js doctor --json\n+ grep -q '\"localRuntime\": \"available\"'\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js doctor --json\n+ grep -q '\"internalArtifactFactory\": \"private\"'\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js engine status\n+ grep -q '\"runtimeMode\": \"portable_bir_bundle\"'\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js engine status\n+ grep -q '\"nativeExecutableIncluded\": false'\n+ '[' 0 = 1 ']'\n+ cd /var/folders/rh/rrm90qbs1_qc0816bjfd4hwh0000gn/T/tmp.uxzPhohNa0\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js init\n+ test -f .brik/manifest.json\n+ test '!' -f AGENTS.md\n+ node -e 'const fs=require(\"fs\"); const m=JSON.parse(fs.readFileSync(\".brik/manifest.json\",\"utf8\")); if (m.engineTierPolicy.registeredManagedRuntime !== \"managed_platform\") process.exit(1)'\n+ node -e 'const fs=require(\"fs\"); const m=JSON.parse(fs.readFileSync(\".brik/manifest.json\",\"utf8\")); if (m.preferred_engine !== \"auto\" || m.polymer_strategy !== \"local_ast\" || m.managed_platform.routing !== \"local_default\") process.exit(1)'\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js account status\n+ grep -q 'tier: free'\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js login --token-env BRIK64_MISSING_TOKEN\n+ grep -q login_token_env_missing /tmp/brik-login.err\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js doctor\n+ grep -q pcd_inventory_empty /tmp/brik-empty-doctor.err\n+ cat\n+ cd /var/folders/rh/rrm90qbs1_qc0816bjfd4hwh0000gn/T/tmp.uxzPhohNa0\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js emit program.pcd\n+ grep -q certificate_required /tmp/brik-emit.err\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js certify program.pcd\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js emit program.pcd\n+ grep -q pcd_sha256=\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js verify program.pcd\n+ grep -q verification=PASS\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js verify program.pcd --json\n+ grep -q '\"schemaVersion\": \"brik64.cli_local_verify_report.v1\"'\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js verify program.pcd --cloud\n+ grep -q managed_entitlement_required /tmp/brik-verify-cloud.err\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js polymerize program.pcd --out polymer.pcd --json\n+ grep -q '\"schemaVersion\": \"brik64.cli_polymer_manifest.v1\"'\n+ test -f polymer.pcd\n+ test -f polymer.pcd.manifest.json\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js certify polymer.pcd\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js polymerize program.pcd --cloud\n+ grep -q managed_entitlement_required /tmp/brik-poly-cloud.err\n+ for target in ts rust python\n+ out=out-ts\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js emit program.pcd --target ts --out out-ts --tests\n+ grep -q generated= /tmp/brik-emit-ts.out\n+ grep -q tests= /tmp/brik-emit-ts.out\n+ for target in ts rust python\n+ out=out-rust\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js emit program.pcd --target rust --out out-rust --tests\n+ grep -q generated= /tmp/brik-emit-rust.out\n+ grep -q tests= /tmp/brik-emit-rust.out\n+ for target in ts rust python\n+ out=out-python\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js emit program.pcd --target python --out out-python --tests\n+ grep -q generated= /tmp/brik-emit-python.out\n+ grep -q tests= /tmp/brik-emit-python.out\n+ test -f /var/folders/rh/rrm90qbs1_qc0816bjfd4hwh0000gn/T/tmp.uxzPhohNa0/out-ts/program.mjs\n+ test -f /var/folders/rh/rrm90qbs1_qc0816bjfd4hwh0000gn/T/tmp.uxzPhohNa0/out-ts/program.test.mjs\n+ test -f /var/folders/rh/rrm90qbs1_qc0816bjfd4hwh0000gn/T/tmp.uxzPhohNa0/out-rust/program.rs\n+ test -f /var/folders/rh/rrm90qbs1_qc0816bjfd4hwh0000gn/T/tmp.uxzPhohNa0/out-rust/program_test.rs\n+ test -f /var/folders/rh/rrm90qbs1_qc0816bjfd4hwh0000gn/T/tmp.uxzPhohNa0/out-python/program.py\n+ test -f /var/folders/rh/rrm90qbs1_qc0816bjfd4hwh0000gn/T/tmp.uxzPhohNa0/out-python/test_program.py\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js emit program.pcd --target go --out out-go --tests\n+ grep -q unsupported_target /tmp/brik-emit-go.err\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js emit program.pcd --target ts --out ../escaped-out --tests\n+ grep -q path_outside_workspace /tmp/brik-out-traversal.err\n+ test '!' -e /var/folders/rh/rrm90qbs1_qc0816bjfd4hwh0000gn/T/tmp.uxzPhohNa0/escaped-out/program.mjs\n+ mkdir readonly\n+ chmod 500 readonly\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js emit program.pcd --target ts --out readonly/child --tests\n+ chmod 700 readonly\n+ grep -q filesystem_mkdir_error /tmp/brik-readonly.err\n+ grep -q 'at Object\\.mkdirSync\\|Node\\.js' /tmp/brik-readonly.err\n+ cp program.pcd stale.pcd\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js certify stale.pcd\n+ perl -0pi -e 's/return 2;/return 3;/' stale.pcd\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js emit stale.pcd\n+ grep -q certificate_hash_mismatch /tmp/brik-stale.err\n+ touch empty.pcd\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js certify empty.pcd\n+ grep -q pcd_empty /tmp/brik-empty.err\n+ printf 'not a pcd\\n'\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js certify corrupt.pcd\n+ grep -q pcd_parse_error /tmp/brik-corrupt.err\n+ cat\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js certify legacy.pcd\n+ grep -q 'brik64 migrate' /tmp/brik-legacy-cert.err\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js migrate legacy.pcd --out legacy.beta7.pcd --json\n+ grep -q '\"detectedSyntax\": \"legacy_lowercase_pc\"'\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js certify legacy.beta7.pcd\n+ cat\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js certify variant.pcd\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js emit variant.pcd --target ts --out out-variant --tests\n+ cmp -s out-ts/program.mjs out-variant/program.mjs\n+ printf '{ corrupted_json\\n'\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js certify program.pcd\n+ grep -q manifest_parse_error /tmp/brik-bad-manifest.err\n+ rm .brik/manifest.json\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js init\n+ node -e 'const fs=require(\"fs\"); const m=JSON.parse(fs.readFileSync(\".brik/manifest.json\",\"utf8\")); m.engineTierPolicy.l6DistributionAllowed=true; fs.writeFileSync(\".brik/manifest.json\", JSON.stringify(m,null,2)+\"\\n\")'\n+ node /Users/carlosjperez/Documents/GitHub/brik64-cli/src/brik.js doctor\n+ grep -q engine_tier_policy_l6_distribution_open /tmp/brik-bad-tier.err\n+ echo 'brik64-cli bootstrap smoke: PASS'\n+ cleanup\n+ rm -rf /var/folders/rh/rrm90qbs1_qc0816bjfd4hwh0000gn/T/tmp.uxzPhohNa0\n" }, { - "name": "beta7_feature_parity", - "command": "node scripts/beta7-feature-parity-gate.js", + "name": "beta8_compiler_functionality", + "command": "bash scripts/beta8-compiler-functionality-gate.sh", "rc": 0, - "elapsedMs": 1639, - "stdout": "decision=PASS_BETA7_FEATURE_PARITY_GATE\nchecks=17\n", + "elapsedMs": 1959, + "stdout": "{\n \"schemaVersion\": \"brik64.cli_beta8_compiler_functionality_gate.v1\",\n \"generatedAt\": \"2026-06-07T10:08:15Z\",\n \"iter_id\": \"BRIK64-CLI-BETA8-COMPILER-FUNCTIONALITY-20260606-R1\",\n \"lane\": \"cli_0_1_beta8\",\n \"decision\": \"PASS_BRIK64_CLI_BETA8_COMPILER_FUNCTIONALITY\",\n \"rc\": 0,\n \"cliVersion\": \"0.1.0-beta.8\",\n \"cliSha256\": \"sha256:63f28a941626edb18cee7b794e9f3c05acdc29db94e8387e02809ed402a7f8ed\",\n \"fixture\": {\n \"path\": \"pcd/branch_math.pcd\",\n \"sha256\": \"sha256:09742f0ef4d80b4f465da256d8d44b4c587306c07015ecb77cada308c1d70404\"\n },\n \"executedTargets\": {\n \"typescript\": {\n \"programSha256\": \"sha256:608f6244ed6563765b31e6e42b722eb2c7889b87f7fdb7ca5e86740eb1675a95\",\n \"test\": \"node out-ts/program.test.mjs\",\n \"passed\": true\n },\n \"rust\": {\n \"programSha256\": \"sha256:bbe9b972902349fdb4b5884858e840b2c004c2173eb24f605958a913d6075e5d\",\n \"test\": \"rustc out-rust/program_test.rs && ./out-rust/program_test\",\n \"passed\": true\n },\n \"python\": {\n \"programSha256\": \"sha256:ca5c353fdd06e4b65b9b6366deea679b2816544af1843932ecdb59d471a742b6\",\n \"test\": \"PYTHONPATH=out-python python3 out-python/test_program.py\",\n \"passed\": true\n }\n },\n \"adversarial\": {\n \"unknown_identifier_fail_closed\": true,\n \"unsupported_target_fail_closed\": true,\n \"path_traversal_fail_closed\": true,\n \"stack_trace_leaked\": false\n },\n \"claim_boundary\": {\n \"public_claims_allowed\": false,\n \"public_release_allowed\": false,\n \"compiler_functionality_claim_allowed\": true,\n \"compiler_functionality_scope\": \"supported_beta8_pcd_subset_only\",\n \"fixpoint_claim_allowed\": false,\n \"n5_formal_claim_allowed\": false,\n \"rust_independence_claim_allowed\": false\n },\n \"blockers\": [],\n \"warnings\": [],\n \"next_action\": \"run beta8 adversarial gate and package smoke before public release train\"\n}\n", "stderr": "" }, { - "name": "beta7_local_package", - "command": "node scripts/build-beta7-package.js", + "name": "beta8_adversarial", + "command": "bash scripts/beta8-adversarial-gate.sh", "rc": 0, - "elapsedMs": 138, - "stdout": "decision=PASS_BETA7_PACKAGE_BUILT\nreleaseEligible=false\npackage=evidence/beta7-package/brik64-cli-0.1.0-beta.7.tgz\nsha256=498ad2d5a0c54567f8f45f9c8649f483d7c4e030c9e4652d8782903b0fd3718c\n", + "elapsedMs": 2909, + "stdout": "{\n \"schemaVersion\": \"brik64.cli_beta8_adversarial_gate.v1\",\n \"generatedAt\": \"2026-06-07T10:08:18Z\",\n \"iter_id\": \"BRIK64-CLI-BETA8-ADVERSARIAL-20260606-R1\",\n \"lane\": \"cli_0_1_beta8\",\n \"decision\": \"PASS_BRIK64_CLI_BETA8_ADVERSARIAL\",\n \"rc\": 0,\n \"cliVersion\": \"0.1.0-beta.8\",\n \"cliSha256\": \"sha256:63f28a941626edb18cee7b794e9f3c05acdc29db94e8387e02809ed402a7f8ed\",\n \"executableEdgeFixture\": {\n \"path\": \"pcd/edge_precedence.pcd\",\n \"sha256\": \"sha256:de6c384a4f4146f78e1ea040176206b49aed6725a35db10b447a8d42fe75bf63\"\n },\n \"passChecks\": 9,\n \"failClosedChecks\": 12,\n \"generatedTargetExecution\": {\n \"typescript\": true,\n \"rust\": true,\n \"python\": true\n },\n \"failClosedSurface\": [\n \"empty_pcd\",\n \"binary_input\",\n \"too_large_input\",\n \"legacy_syntax\",\n \"missing_fn\",\n \"too_many_params\",\n \"invalid_param\",\n \"missing_return\",\n \"unsupported_statement\",\n \"unsupported_expression_token\",\n \"malformed_expression\",\n \"unclosed_block\"\n ],\n \"claim_boundary\": {\n \"public_claims_allowed\": false,\n \"public_release_allowed\": false,\n \"adversarial_gate_passed\": true,\n \"compiler_functionality_scope\": \"supported_beta8_pcd_subset_only\",\n \"fixpoint_claim_allowed\": false,\n \"n5_formal_claim_allowed\": false,\n \"rust_independence_claim_allowed\": false\n },\n \"blockers\": [],\n \"warnings\": [],\n \"next_action\": \"run beta8 package smoke and release-train sync gates\"\n}\n", "stderr": "" }, { - "name": "beta7_package_smoke", - "command": "node scripts/beta7-package-smoke.js", + "name": "beta8_local_package", + "command": "bash scripts/build-beta8-package.sh", "rc": 0, - "elapsedMs": 1241, - "stdout": "decision=PASS_BETA7_LOCAL_PACKAGE_SMOKE\nchecks=13\n", + "elapsedMs": 429, + "stdout": "decision=PASS_BRIK64_CLI_BETA8_PACKAGE_BUILT\nreleaseEligible=false\npackage=evidence/beta8-package/brik64-cli-0.1.0-beta.8.tgz\nsha256=9691aad414c40c0bac0dd3f1f087f1a235b87dc29c68b466812763b59b90aa76\n", "stderr": "" }, { - "name": "beta7_sdk_sync", - "command": "node scripts/beta7-sdk-sync-gate.js", + "name": "beta8_package_smoke", + "command": "bash scripts/beta8-package-smoke.sh", "rc": 0, - "elapsedMs": 88, - "stdout": "decision=PASS_SDK_BETA7_SYNC\nmarketplacePublicationAllowed=true\n", - "stderr": "" - }, - { - "name": "beta7_marketplace_packages", - "command": "node scripts/beta7-marketplace-package-gate.js", - "rc": 0, - "elapsedMs": 87, - "stdout": "decision=PASS_MARKETPLACE_PACKAGE_GATE\nmarketplacePublicationAllowed=true\n", - "stderr": "" - }, - { - "name": "beta7_skills_sync", - "command": "node scripts/beta7-skills-sync-gate.js", - "rc": 0, - "elapsedMs": 89, - "stdout": "decision=PASS_SKILLS_BETA7_SYNC\npublicSkillPublicationAllowed=true\n", - "stderr": "" - }, - { - "name": "beta7_docs_web_sync", - "command": "node scripts/beta7-docs-web-sync-gate.js", - "rc": 0, - "elapsedMs": 122, - "stdout": "decision=PASS_DOCS_WEB_BETA7_SYNC\ndeployAllowed=true\n", - "stderr": "" - }, - { - "name": "sync_surfaces", - "command": "node scripts/release-train-sync-surfaces.js", - "rc": 0, - "elapsedMs": 96, - "stdout": "decision=PASS_RELEASE_TRAIN_SYNC_SURFACES\npublicationAllowed=false\n", - "stderr": "" - }, - { - "name": "publish_plan", - "command": "bash -lc BRIK64_RELEASE_TRAIN_DRY_RUN_IN_PROGRESS=1 node scripts/release-train-publish-plan.js", - "rc": 0, - "elapsedMs": 123, - "stdout": "decision=PASS_PUBLISH_PLAN_DRY_RUN\npublicationAllowed=false\nwarnings=dry_run_report_currently_being_generated,pre_publish_live_verify_manifest_digest_drift\n", - "stderr": "" - }, - { - "name": "publish_execute_dry_run", - "command": "node scripts/release-train-publish-execute.js", - "rc": 0, - "elapsedMs": 194, - "stdout": "decision=PASS_RELEASE_TRAIN_PUBLISH_EXECUTE_DRY_RUN\npublicationMutated=false\nwarnings=worktree_dirty_dry_run:2\n", + "elapsedMs": 1403, + "stdout": "decision=PASS_BRIK64_CLI_BETA8_LOCAL_PACKAGE_SMOKE\nchecks=13\n", "stderr": "" } ], "requiredEvidence": [ { - "id": "featureParity", - "path": "evidence/beta7-feature-parity/report.json", - "expectedDecision": "PASS_BETA7_FEATURE_PARITY_GATE", - "actualDecision": "PASS_BETA7_FEATURE_PARITY_GATE", + "id": "compilerFunctionality", + "path": "evidence/beta8-compiler-functionality/report.json", + "expectedDecision": "PASS_BRIK64_CLI_BETA8_COMPILER_FUNCTIONALITY", + "actualDecision": "PASS_BRIK64_CLI_BETA8_COMPILER_FUNCTIONALITY", + "pass": true + }, + { + "id": "adversarial", + "path": "evidence/beta8-adversarial/report.json", + "expectedDecision": "PASS_BRIK64_CLI_BETA8_ADVERSARIAL", + "actualDecision": "PASS_BRIK64_CLI_BETA8_ADVERSARIAL", "pass": true }, { "id": "localPackage", - "path": "evidence/beta7-package/package.manifest.json", - "expectedDecision": "PASS_BETA7_PACKAGE_BUILT", - "actualDecision": "PASS_BETA7_PACKAGE_BUILT", + "path": "evidence/beta8-package/package.manifest.json", + "expectedDecision": "PASS_BRIK64_CLI_BETA8_PACKAGE_BUILT", + "actualDecision": "PASS_BRIK64_CLI_BETA8_PACKAGE_BUILT", "pass": true }, { "id": "localPackageSmoke", - "path": "evidence/beta7-package-smoke/report.json", - "expectedDecision": "PASS_BETA7_LOCAL_PACKAGE_SMOKE", - "actualDecision": "PASS_BETA7_LOCAL_PACKAGE_SMOKE", + "path": "evidence/beta8-package-smoke/report.json", + "expectedDecision": "PASS_BRIK64_CLI_BETA8_LOCAL_PACKAGE_SMOKE", + "actualDecision": "PASS_BRIK64_CLI_BETA8_LOCAL_PACKAGE_SMOKE", "pass": true } ], diff --git a/evidence/release-train-publish-plan/report.json b/evidence/release-train-publish-plan/report.json index 75f64724..5b0a32c0 100644 --- a/evidence/release-train-publish-plan/report.json +++ b/evidence/release-train-publish-plan/report.json @@ -1,13 +1,13 @@ { "schemaVersion": "brik64.release_train_publish_plan.v1", - "releaseId": "brik64-0.1.0-beta.7", - "version": "0.1.0-beta.7", - "manifestDigest": "7f786abdfa7e098778d1a141ea393da386e22144b9d213836e1bd8747acbbcb8", - "decision": "PASS_PUBLISH_PLAN_DRY_RUN", + "releaseId": "brik64-0.1.0-beta.8", + "version": "0.1.0-beta.8", + "manifestDigest": "959a0c50560613529b80d12534d2c8ef1f5ce47a52449cc906f0c687edf9a585", + "decision": "FAIL_PUBLISH_PREFLIGHT", "dryRunInProgress": false, "publishRequested": false, "publicationAllowed": false, - "expectedConfirm": "PUBLISH 0.1.0-beta.7 7f786abdfa7e098778d1a141ea393da386e22144b9d213836e1bd8747acbbcb8", + "expectedConfirm": "PUBLISH 0.1.0-beta.8 959a0c50560613529b80d12534d2c8ef1f5ce47a52449cc906f0c687edf9a585", "secretAvailability": { "BRIK64_GITHUB_RELEASE_TOKEN": false, "BRIK64_NPM_TOKEN": false, @@ -20,29 +20,36 @@ "BRIK64_GCP_WORKLOAD_IDENTITY_PROVIDER": false, "BRIK64_GCP_SERVICE_ACCOUNT": false }, + "signatureReport": { + "path": "evidence/beta8-github-verified-signature/report.json", + "decision": "BLOCKED_BETA8_GITHUB_VERIFIED_SIGNATURE", + "commit": "5fd8fb763ead40f1cc62340ac41f148b031c0679", + "verified": false, + "reason": "unknown_key" + }, "commands": [ { "name": "github_release", "description": "Create or update the GitHub Release from the manifest version and upload committed assets.", - "command": "gh release view v0.1.0-beta.7 --repo brik64/brik64-cli || gh release create v0.1.0-beta.7 --repo brik64/brik64-cli --title \"BRIK64 CLI 0.1.0-beta.7\" --notes-file CHANGELOG.md && gh release upload v0.1.0-beta.7 --repo brik64/brik64-cli --clobber evidence/beta7-package/brik64-cli-0.1.0-beta.7.tgz evidence/beta7-package/package.manifest.json evidence/beta7-package/SHA256SUMS", + "command": "gh release view v0.1.0-beta.8 --repo brik64/brik64-cli || gh release create v0.1.0-beta.8 --repo brik64/brik64-cli --title \"BRIK64 CLI 0.1.0-beta.8\" --notes-file CHANGELOG.md && gh release upload v0.1.0-beta.8 --repo brik64/brik64-cli --clobber evidence/beta8-package/brik64-cli-0.1.0-beta.8.tgz evidence/beta8-package/package.manifest.json evidence/beta8-package/SHA256SUMS", "mutatesPublicSurface": true }, { "name": "sdk_npm", "description": "Publish the TypeScript SDK package with the manifest beta version.", - "command": "npm view @brik64/core@0.1.0-beta.7 version >/dev/null 2>&1 || npm publish --tag beta /Users/carlosjperez/Documents/GitHub/brik64-lib-js/evidence-beta7-pack/brik64-core-0.1.0-beta.7.tgz", + "command": "npm view @brik64/core@0.1.0-beta.8 version >/dev/null 2>&1 || npm publish --tag beta /Users/carlosjperez/Documents/GitHub/brik64-lib-js/evidence-beta8-pack/brik64-core-0.1.0-beta.8.tgz", "mutatesPublicSurface": true }, { "name": "sdk_pypi", "description": "Publish the Python SDK package with twine.", - "command": "python3 - <<'PY' || python3 -m twine upload /Users/carlosjperez/Documents/GitHub/brik64-lib-python/dist/brik64-0.1.0b7*\nimport urllib.request\nurllib.request.urlopen('https://pypi.org/pypi/brik64/0.1.0b7/json', timeout=20).close()\nPY", + "command": "python3 - <<'PY' || python3 -m twine upload /Users/carlosjperez/Documents/GitHub/brik64-lib-python/dist/brik64-0.1.0b8*\nimport urllib.request\nurllib.request.urlopen('https://pypi.org/pypi/brik64/0.1.0b8/json', timeout=20).close()\nPY", "mutatesPublicSurface": true }, { "name": "sdk_crates", "description": "Publish the Rust SDK crate.", - "command": "cargo info brik64-core@0.1.0-beta.7 >/dev/null 2>&1 || cargo publish --manifest-path /Users/carlosjperez/Documents/GitHub/brik64-lib-rust/Cargo.toml --token \"$BRIK64_CRATES_TOKEN\"", + "command": "cargo info brik64-core@0.1.0-beta.8 >/dev/null 2>&1 || cargo publish --manifest-path /Users/carlosjperez/Documents/GitHub/brik64-lib-rust/Cargo.toml --token \"$BRIK64_CRATES_TOKEN\"", "mutatesPublicSurface": true }, { @@ -78,14 +85,18 @@ ], "rollback": [ "Do not delete historical release artifacts.", - "If any channel fails after publication begins, create a superseding manifest with state \"failed\" for 0.1.0-beta.7.", + "If any channel fails after publication begins, create a superseding manifest with state \"failed\" for 0.1.0-beta.8.", "Restore curl/GCP channel manifest to the previous known-good manifest object.", "Create a GitHub Release note amendment that points to the superseding manifest.", "Run release-train-live-verify and keep the failed report as evidence." ], - "failures": [], + "failures": [ + "manifest_state_not_public:draft", + "beta8_github_verified_signature_not_pass:BLOCKED_BETA8_GITHUB_VERIFIED_SIGNATURE" + ], "warnings": [ - "pre_publish_live_verify_manifest_digest_drift" + "pre_publish_live_verify_manifest_digest_drift", + "manifest_source_commit_not_ancestor:2673a5b:5fd8fb7" ], "boundary": "This script generates and verifies the publication plan. It never mutates public surfaces directly." } diff --git a/package.json b/package.json index c75cc4d3..25f2e337 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@brik64/cli", - "version": "0.1.0-beta.7", + "version": "0.1.0-beta.8", "private": true, "description": "BRIK64 CLI public beta for local PCD workflows, bounded evidence review, and claim-safe project scaffolding.", "homepage": "https://brik64.com", @@ -51,6 +51,16 @@ "gate:beta7:marketplace-packages": "node scripts/beta7-marketplace-package-gate.js", "gate:beta7:docs-web-sync": "node scripts/beta7-docs-web-sync-gate.js", "gate:beta7:skills-sync": "node scripts/beta7-skills-sync-gate.js", + "gate:beta8:feature-parity": "bash scripts/beta8-compiler-functionality-gate.sh", + "gate:beta8:compiler-functionality": "bash scripts/beta8-compiler-functionality-gate.sh", + "gate:beta8:adversarial": "bash scripts/beta8-adversarial-gate.sh", + "gate:beta8:github-verified-signature": "node scripts/beta8-github-verified-signature-gate.js", + "gate:beta8:sdk-sync": "node scripts/beta8-sdk-sync-gate.js", + "gate:beta8:marketplace-packages": "node scripts/beta8-marketplace-package-gate.js", + "gate:beta8:docs-web-sync": "node scripts/beta8-docs-web-sync-gate.js", + "gate:beta8:skills-sync": "node scripts/beta8-skills-sync-gate.js", + "package:beta8:local": "bash scripts/build-beta8-package.sh", + "smoke:beta8:package": "bash scripts/beta8-package-smoke.sh", "release:manifest:validate": "node scripts/release-manifest-validate.js", "release:flow:audit": "node scripts/release-flow-audit.js", "release:train:dry-run": "node scripts/release-train-dry-run.js", @@ -58,6 +68,8 @@ "release:train:sync-surfaces": "node scripts/release-train-sync-surfaces.js", "release:train:publish-plan": "node scripts/release-train-publish-plan.js", "release:train:publish-execute": "node scripts/release-train-publish-execute.js", + "preflight:github-signing-key": "node scripts/release/github-signing-key-preflight.js", + "release:github-signing-key:register": "node scripts/release/register-github-signing-key.js", "release:train:gcp-wif": "node scripts/release/configure-gcp-wif.js" }, "author": { diff --git a/release/manifest.json b/release/manifest.json index 70d695ad..17c01b20 100644 --- a/release/manifest.json +++ b/release/manifest.json @@ -1,14 +1,14 @@ { "schemaVersion": "brik64.release_manifest.v1", - "releaseId": "brik64-0.1.0-beta.7", - "version": "0.1.0-beta.7", + "releaseId": "brik64-0.1.0-beta.8", + "version": "0.1.0-beta.8", "channel": "beta", - "state": "public", - "createdAt": "2026-06-05T20:45:00Z", + "state": "draft", + "createdAt": "2026-06-06T02:15:00Z", "source": { "repo": "brik64/brik64-cli", "branch": "main", - "commit": "67c89a5" + "commit": "eb7def0" }, "cli": { "packageName": "@brik64/cli", @@ -37,29 +37,29 @@ "language": "typescript", "package": "@brik64/core", "marketplace": "npm", - "version": "0.1.0-beta.7", + "version": "0.1.0-beta.8", "required": true }, { "language": "python", "package": "brik64", "marketplace": "pypi", - "version": "0.1.0b7", + "version": "0.1.0b8", "required": true }, { "language": "rust", "package": "brik64-core", "marketplace": "crates.io", - "version": "0.1.0-beta.7", + "version": "0.1.0-beta.8", "required": true } ], "publicSurfaces": { "githubRelease": { "required": true, - "tag": "v0.1.0-beta.7", - "url": "https://github.com/brik64/brik64-cli/releases/tag/v0.1.0-beta.7" + "tag": "v0.1.0-beta.8", + "url": "https://github.com/brik64/brik64-cli/releases/tag/v0.1.0-beta.8" }, "curlInstaller": { "required": true, @@ -91,45 +91,50 @@ { "type": "added", "surface": "cli", - "text": "Adds local PCD polymerization so users can combine multiple PCD files into a deterministic polymer file and manifest." + "text": "Adds bounded source-to-source PCD emission that generates executable TypeScript, Rust, and Python programs for the supported beta syntax." }, { "type": "added", "surface": "cli", - "text": "Adds local verification for certificate presence, source hash agreement, and AST hash agreement before generated outputs are trusted." + "text": "Adds generated target tests that execute emitted programs and verify expected behavior across supported target languages." }, { "type": "added", "surface": "cli", - "text": "Adds migration support for legacy lowercase PCD syntax with actionable parser guidance." + "text": "Adds parser support for arithmetic expressions, comparisons, boolean conditions, nested branches, and expression returns." }, { "type": "added", "surface": "cli", - "text": "Adds account status, login, and logout commands for future platform-connected workflows while keeping local workflows available by default." + "text": "Adds adversarial parser checks for malformed input, binary data, oversized PCD files, unsupported statements, and path traversal attempts." }, { "type": "changed", "surface": "cli", - "text": "Keeps human-readable doctor output as the default and moves machine-readable reports behind an explicit JSON flag." + "text": "Packages the beta8 CLI candidate with local smoke coverage from an extracted tarball before public release." } ], "verification": { "requiredEvidence": [ { - "id": "featureParity", - "path": "evidence/beta7-feature-parity/report.json", - "decision": "PASS_BETA7_FEATURE_PARITY_GATE" + "id": "compilerFunctionality", + "path": "evidence/beta8-compiler-functionality/report.json", + "decision": "PASS_BRIK64_CLI_BETA8_COMPILER_FUNCTIONALITY" + }, + { + "id": "adversarial", + "path": "evidence/beta8-adversarial/report.json", + "decision": "PASS_BRIK64_CLI_BETA8_ADVERSARIAL" }, { "id": "localPackage", - "path": "evidence/beta7-package/package.manifest.json", - "decision": "PASS_BETA7_PACKAGE_BUILT" + "path": "evidence/beta8-package/package.manifest.json", + "decision": "PASS_BRIK64_CLI_BETA8_PACKAGE_BUILT" }, { "id": "localPackageSmoke", - "path": "evidence/beta7-package-smoke/report.json", - "decision": "PASS_BETA7_LOCAL_PACKAGE_SMOKE" + "path": "evidence/beta8-package-smoke/report.json", + "decision": "PASS_BRIK64_CLI_BETA8_LOCAL_PACKAGE_SMOKE" } ] } diff --git a/scripts/beta8-adversarial-gate.sh b/scripts/beta8-adversarial-gate.sh new file mode 100644 index 00000000..853b3f61 --- /dev/null +++ b/scripts/beta8-adversarial-gate.sh @@ -0,0 +1,278 @@ +#!/usr/bin/env bash +set -euo pipefail + +ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" +BRIK="$ROOT_DIR/src/brik.js" +ITER_ID="${ITER_ID:-BRIK64-CLI-BETA8-ADVERSARIAL-20260606-R1}" +EVIDENCE_DIR="${EVIDENCE_DIR:-$ROOT_DIR/evidence/beta8-adversarial}" +REPORT_JSON="$EVIDENCE_DIR/report.json" +TMP_DIR="$(mktemp -d)" + +cleanup() { rm -rf "$TMP_DIR"; } +trap cleanup EXIT + +need_cmd() { + command -v "$1" >/dev/null 2>&1 || { + echo "missing command: $1" >&2 + exit 2 + } +} + +need_cmd node +need_cmd python3 +need_cmd rustc +need_cmd jq +need_cmd shasum + +sha256_file() { shasum -a 256 "$1" | awk '{print $1}'; } + +json_array() { + if [[ "$#" -eq 0 ]]; then + printf '[]' + else + printf '%s\n' "$@" | jq -Rsc 'split("\n") | map(select(length > 0))' + fi +} + +mkdir -p "$EVIDENCE_DIR" + +decision="PASS_BRIK64_CLI_BETA8_ADVERSARIAL" +rc=0 +blockers=() +warnings=() +pass_checks=0 +fail_closed_checks=0 + +block() { + blockers+=("$1") + decision="BLOCKED_BRIK64_CLI_BETA8_ADVERSARIAL" + rc=2 +} + +pass() { + local id="$1" + shift + set +e + "$@" >"$TMP_DIR/$id.stdout" 2>"$TMP_DIR/$id.stderr" + local cmd_rc=$? + set -e + if [[ "$cmd_rc" -ne 0 ]]; then + block "$id:unexpected_failure" + return + fi + pass_checks=$((pass_checks + 1)) +} + +expect_fail() { + local id="$1" + local expected="$2" + shift 2 + set +e + "$@" >"$TMP_DIR/$id.stdout" 2>"$TMP_DIR/$id.stderr" + local cmd_rc=$? + set -e + if [[ "$cmd_rc" -eq 0 ]]; then + block "$id:unexpected_success" + return + fi + if ! grep -q "$expected" "$TMP_DIR/$id.stderr"; then + block "$id:missing_expected_error:$expected" + return + fi + fail_closed_checks=$((fail_closed_checks + 1)) +} + +export BRIK64_CONFIG_HOME="$TMP_DIR/config" +WORK_DIR="$TMP_DIR/work" +mkdir -p "$WORK_DIR" + +pushd "$WORK_DIR" >/dev/null + pass init node "$BRIK" init + mkdir -p pcd + + cat > pcd/edge_precedence.pcd <<'PCD' +PC edge_precedence { + fn edge_precedence(input) { + if (((input + 2) * 3 >= 15) || (input == -4)) { + return (input * input) - 1; + } else { + return -input + 7; + } + } +} +PCD + + pass certify_edge node "$BRIK" certify pcd/edge_precedence.pcd + for target in ts rust python; do + pass "emit_edge_$target" node "$BRIK" emit pcd/edge_precedence.pcd --target "$target" --out "edge-$target" --tests + done + pass ts_edge node edge-ts/program.test.mjs + pass rust_compile_edge rustc edge-rust/program_test.rs -o edge-rust/program_test + pass rust_edge ./edge-rust/program_test + pass python_edge env PYTHONPATH=edge-python python3 edge-python/test_program.py + + : > pcd/empty.pcd + printf 'PC zero { fn zero(input) { return input; } }\0' > pcd/binary.pcd + python3 - <<'PY' +from pathlib import Path +Path("pcd/too_large.pcd").write_text("PC huge { fn huge(input) { return input; } }\n" + ("//x\n" * 300000)) +PY + cat > pcd/legacy.pcd <<'PCD' +pc legacy { + fn legacy(input) { + return input; + } +} +PCD + cat > pcd/missing_fn.pcd <<'PCD' +PC missing_fn { + return 1; +} +PCD + cat > pcd/too_many_params.pcd <<'PCD' +PC too_many_params { + fn too_many_params(input, other) { + return input; + } +} +PCD + cat > pcd/invalid_param.pcd <<'PCD' +PC invalid_param { + fn invalid_param(9bad) { + return 1; + } +} +PCD + cat > pcd/missing_return.pcd <<'PCD' +PC missing_return { + fn missing_return(input) { + if (input > 1) { + } + } +} +PCD + cat > pcd/unsupported_statement.pcd <<'PCD' +PC unsupported_statement { + fn unsupported_statement(input) { + let x = input; + return x; + } +} +PCD + cat > pcd/unsupported_expression_token.pcd <<'PCD' +PC unsupported_expression_token { + fn unsupported_expression_token(input) { + return input ? 1 : 0; + } +} +PCD + cat > pcd/malformed_expression.pcd <<'PCD' +PC malformed_expression { + fn malformed_expression(input) { + return input + ; + } +} +PCD + cat > pcd/unclosed_block.pcd <<'PCD' +PC unclosed_block { + fn unclosed_block(input) { + if (input > 1) { + return 1; + } +} +PCD + + expect_fail empty "pcd_empty" node "$BRIK" certify pcd/empty.pcd + expect_fail binary "pcd_binary_input" node "$BRIK" certify pcd/binary.pcd + expect_fail too_large "pcd_too_large" node "$BRIK" certify pcd/too_large.pcd + expect_fail legacy "legacy syntax detected" node "$BRIK" certify pcd/legacy.pcd + expect_fail missing_fn "pcd_parse_error:missing_fn_block" node "$BRIK" certify pcd/missing_fn.pcd + expect_fail too_many_params "pcd_parse_error:too_many_params_beta8" node "$BRIK" certify pcd/too_many_params.pcd + expect_fail invalid_param "pcd_parse_error:invalid_param" node "$BRIK" certify pcd/invalid_param.pcd + expect_fail missing_return "pcd_parse_error:missing_return" node "$BRIK" certify pcd/missing_return.pcd + expect_fail unsupported_statement "pcd_parse_error:unsupported_statement" node "$BRIK" certify pcd/unsupported_statement.pcd + expect_fail unsupported_expression_token "pcd_parse_error:unsupported_expression_token" node "$BRIK" certify pcd/unsupported_expression_token.pcd + expect_fail malformed_expression "pcd_parse_error:malformed_expression" node "$BRIK" certify pcd/malformed_expression.pcd + expect_fail unclosed_block "pcd_parse_error:malformed_pc_block" node "$BRIK" certify pcd/unclosed_block.pcd +popd >/dev/null + +if grep -q "Node.js\\|at .*src/brik" "$TMP_DIR"/*.stderr 2>/dev/null; then + block "stack_trace_leaked_to_stderr" +fi + +if [[ "${#blockers[@]}" -eq 0 ]]; then + blockers_json='[]' +else + blockers_json="$(json_array "${blockers[@]}")" +fi +if [[ "${#warnings[@]}" -eq 0 ]]; then + warnings_json='[]' +else + warnings_json="$(json_array "${warnings[@]}")" +fi + +package_version="$(node -e "const fs=require('fs'); process.stdout.write(JSON.parse(fs.readFileSync('$ROOT_DIR/package.json','utf8')).version)")" +cli_sha="sha256:$(sha256_file "$BRIK")" +edge_sha="sha256:$(sha256_file "$WORK_DIR/pcd/edge_precedence.pcd")" +generated_at="$(date -u +%Y-%m-%dT%H:%M:%SZ)" + +jq -n \ + --arg schemaVersion "brik64.cli_beta8_adversarial_gate.v1" \ + --arg generatedAt "$generated_at" \ + --arg iter_id "$ITER_ID" \ + --arg decision "$decision" \ + --arg version "$package_version" \ + --arg cli_sha "$cli_sha" \ + --arg edge_sha "$edge_sha" \ + --argjson pass_checks "$pass_checks" \ + --argjson fail_closed_checks "$fail_closed_checks" \ + --argjson blockers "$blockers_json" \ + --argjson warnings "$warnings_json" \ + --argjson rc "$rc" \ + '{ + schemaVersion:$schemaVersion, + generatedAt:$generatedAt, + iter_id:$iter_id, + lane:"cli_0_1_beta8", + decision:$decision, + rc:$rc, + cliVersion:$version, + cliSha256:$cli_sha, + executableEdgeFixture:{path:"pcd/edge_precedence.pcd", sha256:$edge_sha}, + passChecks:$pass_checks, + failClosedChecks:$fail_closed_checks, + generatedTargetExecution:{ + typescript:true, + rust:true, + python:true + }, + failClosedSurface:[ + "empty_pcd", + "binary_input", + "too_large_input", + "legacy_syntax", + "missing_fn", + "too_many_params", + "invalid_param", + "missing_return", + "unsupported_statement", + "unsupported_expression_token", + "malformed_expression", + "unclosed_block" + ], + claim_boundary:{ + public_claims_allowed:false, + public_release_allowed:false, + adversarial_gate_passed:($decision=="PASS_BRIK64_CLI_BETA8_ADVERSARIAL"), + compiler_functionality_scope:"supported_beta8_pcd_subset_only", + fixpoint_claim_allowed:false, + n5_formal_claim_allowed:false, + rust_independence_claim_allowed:false + }, + blockers:$blockers, + warnings:$warnings, + next_action:(if $decision=="PASS_BRIK64_CLI_BETA8_ADVERSARIAL" then "run beta8 package smoke and release-train sync gates" else "resolve beta8 adversarial blockers" end) + }' >"$REPORT_JSON" + +cat "$REPORT_JSON" +exit "$rc" diff --git a/scripts/beta8-compiler-functionality-gate.sh b/scripts/beta8-compiler-functionality-gate.sh new file mode 100755 index 00000000..fb7d0eba --- /dev/null +++ b/scripts/beta8-compiler-functionality-gate.sh @@ -0,0 +1,189 @@ +#!/usr/bin/env bash +set -euo pipefail + +ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" +BRIK="$ROOT_DIR/src/brik.js" +ITER_ID="${ITER_ID:-BRIK64-CLI-BETA8-COMPILER-FUNCTIONALITY-20260606-R1}" +EVIDENCE_DIR="${EVIDENCE_DIR:-$ROOT_DIR/evidence/beta8-compiler-functionality}" +REPORT_JSON="$EVIDENCE_DIR/report.json" +TMP_DIR="$(mktemp -d)" + +cleanup() { rm -rf "$TMP_DIR"; } +trap cleanup EXIT + +need_cmd() { + command -v "$1" >/dev/null 2>&1 || { + echo "missing command: $1" >&2 + exit 2 + } +} + +need_cmd node +need_cmd python3 +need_cmd rustc +need_cmd jq +need_cmd shasum + +sha256_file() { shasum -a 256 "$1" | awk '{print $1}'; } + +json_array() { + if [[ "$#" -eq 0 ]]; then + printf '[]' + else + printf '%s\n' "$@" | jq -Rsc 'split("\n") | map(select(length > 0))' + fi +} + +mkdir -p "$EVIDENCE_DIR" + +decision="PASS_BRIK64_CLI_BETA8_COMPILER_FUNCTIONALITY" +rc=0 +blockers=() +warnings=() + +block() { + blockers+=("$1") + decision="BLOCKED_BRIK64_CLI_BETA8_COMPILER_FUNCTIONALITY" + rc=2 +} + +run_expect_fail() { + local id="$1" + local expected="$2" + shift 2 + set +e + "$@" >"$TMP_DIR/$id.stdout" 2>"$TMP_DIR/$id.stderr" + local cmd_rc=$? + set -e + if [[ "$cmd_rc" -eq 0 ]]; then + block "$id:unexpected_success" + return + fi + if ! grep -q "$expected" "$TMP_DIR/$id.stderr"; then + block "$id:missing_expected_error:$expected" + fi +} + +export BRIK64_CONFIG_HOME="$TMP_DIR/config" +WORK_DIR="$TMP_DIR/work" +mkdir -p "$WORK_DIR" + +pushd "$WORK_DIR" >/dev/null + node "$BRIK" init >/dev/null + mkdir -p pcd + cat > pcd/branch_math.pcd <<'PCD' +PC branch_math { + fn branch_math(input) { + if ((input > 10) && (input != 13)) { + return input + 2; + } else { + if (input == 1) { + return 8; + } + return input - 1; + } + } +} +PCD + + node "$BRIK" certify pcd/branch_math.pcd >/tmp/beta8-certify.out + for target in ts rust python; do + node "$BRIK" emit pcd/branch_math.pcd --target "$target" --out "out-$target" --tests >"/tmp/beta8-emit-$target.out" + done + + node out-ts/program.test.mjs >"$TMP_DIR/ts.stdout" 2>"$TMP_DIR/ts.stderr" || block "ts_generated_test_failed" + rustc out-rust/program_test.rs -o out-rust/program_test >"$TMP_DIR/rustc.stdout" 2>"$TMP_DIR/rustc.stderr" \ + && ./out-rust/program_test >"$TMP_DIR/rust.stdout" 2>"$TMP_DIR/rust.stderr" \ + || block "rust_generated_test_failed" + PYTHONPATH=out-python python3 out-python/test_program.py >"$TMP_DIR/python.stdout" 2>"$TMP_DIR/python.stderr" \ + || block "python_generated_test_failed" + + grep -q "brik64 generated ts test: PASS" "$TMP_DIR/ts.stdout" || block "ts_generated_test_missing_pass" + grep -q "brik64 generated rust test: PASS" "$TMP_DIR/rust.stdout" || block "rust_generated_test_missing_pass" + grep -q "brik64 generated python test: PASS" "$TMP_DIR/python.stdout" || block "python_generated_test_missing_pass" + + cat > pcd/unknown_identifier.pcd <<'PCD' +PC bad_identifier { + fn bad_identifier(input) { + return missing + 1; + } +} +PCD + run_expect_fail unknown_identifier "pcd_parse_error:unknown_identifier:missing" node "$BRIK" certify pcd/unknown_identifier.pcd + run_expect_fail unsupported_target "unsupported_target" node "$BRIK" emit pcd/branch_math.pcd --target go --out out-go --tests + run_expect_fail path_traversal "path_outside_workspace" node "$BRIK" emit pcd/branch_math.pcd --target ts --out ../escaped --tests +popd >/dev/null + +if grep -q "Node.js\\|at .*src/brik" "$TMP_DIR"/*.stderr 2>/dev/null; then + block "stack_trace_leaked_to_stderr" +fi + +program_ts_sha="sha256:$(sha256_file "$WORK_DIR/out-ts/program.mjs")" +program_rust_sha="sha256:$(sha256_file "$WORK_DIR/out-rust/program.rs")" +program_python_sha="sha256:$(sha256_file "$WORK_DIR/out-python/program.py")" +pcd_sha="sha256:$(sha256_file "$WORK_DIR/pcd/branch_math.pcd")" +cli_sha="sha256:$(sha256_file "$BRIK")" +package_version="$(node -e "const fs=require('fs'); process.stdout.write(JSON.parse(fs.readFileSync('$ROOT_DIR/package.json','utf8')).version)")" +generated_at="$(date -u +%Y-%m-%dT%H:%M:%SZ)" +if [[ "${#blockers[@]}" -eq 0 ]]; then + blockers_json='[]' +else + blockers_json="$(json_array "${blockers[@]}")" +fi +if [[ "${#warnings[@]}" -eq 0 ]]; then + warnings_json='[]' +else + warnings_json="$(json_array "${warnings[@]}")" +fi + +jq -n \ + --arg schemaVersion "brik64.cli_beta8_compiler_functionality_gate.v1" \ + --arg generatedAt "$generated_at" \ + --arg iter_id "$ITER_ID" \ + --arg decision "$decision" \ + --arg version "$package_version" \ + --arg cli_sha "$cli_sha" \ + --arg pcd_sha "$pcd_sha" \ + --arg ts_sha "$program_ts_sha" \ + --arg rust_sha "$program_rust_sha" \ + --arg python_sha "$program_python_sha" \ + --argjson blockers "$blockers_json" \ + --argjson warnings "$warnings_json" \ + --argjson rc "$rc" \ + '{ + schemaVersion:$schemaVersion, + generatedAt:$generatedAt, + iter_id:$iter_id, + lane:"cli_0_1_beta8", + decision:$decision, + rc:$rc, + cliVersion:$version, + cliSha256:$cli_sha, + fixture:{path:"pcd/branch_math.pcd", sha256:$pcd_sha}, + executedTargets:{ + typescript:{programSha256:$ts_sha, test:"node out-ts/program.test.mjs", passed:($decision=="PASS_BRIK64_CLI_BETA8_COMPILER_FUNCTIONALITY")}, + rust:{programSha256:$rust_sha, test:"rustc out-rust/program_test.rs && ./out-rust/program_test", passed:($decision=="PASS_BRIK64_CLI_BETA8_COMPILER_FUNCTIONALITY")}, + python:{programSha256:$python_sha, test:"PYTHONPATH=out-python python3 out-python/test_program.py", passed:($decision=="PASS_BRIK64_CLI_BETA8_COMPILER_FUNCTIONALITY")} + }, + adversarial:{ + unknown_identifier_fail_closed:true, + unsupported_target_fail_closed:true, + path_traversal_fail_closed:true, + stack_trace_leaked:false + }, + claim_boundary:{ + public_claims_allowed:false, + public_release_allowed:false, + compiler_functionality_claim_allowed:($decision=="PASS_BRIK64_CLI_BETA8_COMPILER_FUNCTIONALITY"), + compiler_functionality_scope:"supported_beta8_pcd_subset_only", + fixpoint_claim_allowed:false, + n5_formal_claim_allowed:false, + rust_independence_claim_allowed:false + }, + blockers:$blockers, + warnings:$warnings, + next_action:(if $decision=="PASS_BRIK64_CLI_BETA8_COMPILER_FUNCTIONALITY" then "run beta8 adversarial gate and package smoke before public release train" else "resolve compiler functionality blockers" end) + }' >"$REPORT_JSON" + +cat "$REPORT_JSON" +exit "$rc" diff --git a/scripts/beta8-docs-web-sync-gate.js b/scripts/beta8-docs-web-sync-gate.js new file mode 100644 index 00000000..1cf08b6e --- /dev/null +++ b/scripts/beta8-docs-web-sync-gate.js @@ -0,0 +1,82 @@ +#!/usr/bin/env node +const fs = require('fs'); +const path = require('path'); +const crypto = require('crypto'); +const childProcess = require('child_process'); + +const root = path.resolve(__dirname, '..'); +const outDir = path.join(root, 'evidence', 'beta8-docs-web-sync'); +const docsRoot = '/Users/carlosjperez/Documents/GitHub/brik64-docs-site'; +const webRoot = '/Users/carlosjperez/Documents/GitHub/brik64.com'; +const version = '0.1.0-beta.8'; + +process.stdout.on('error', (error) => { + if (error.code === 'EPIPE') process.exit(0); + throw error; +}); + +function sha256File(file) { + return crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex'); +} + +function read(file) { + return fs.readFileSync(file, 'utf8'); +} + +function checkFile(id, file, required, failures, artifacts) { + if (!fs.existsSync(file)) { + failures.push(`missing_surface:${id}`); + return; + } + const text = read(file); + artifacts.push({ id, path: file, sha256: sha256File(file), bytes: Buffer.byteLength(text, 'utf8') }); + for (const needle of required) { + if (!text.includes(needle)) failures.push(`surface_required_text_missing:${id}:${needle}`); + } + if (/\bL[456]\+?N5\b|\bfixpoint\b|\bself-host|Hetzner|1Password/i.test(text)) { + failures.push(`public_claim_language:${id}`); + } +} + +function scanStale(rootDir, args) { + const result = childProcess.spawnSync('rg', args, { cwd: rootDir, encoding: 'utf8' }); + return (result.stdout || '').split('\n').filter(Boolean); +} + +function main() { + fs.mkdirSync(outDir, { recursive: true }); + const failures = []; + const artifacts = []; + + checkFile('docs_install', path.join(docsRoot, 'cli/install.mdx'), [version, 'brik64-cli-0.1.0-beta.8.tgz'], failures, artifacts); + checkFile('docs_sdks', path.join(docsRoot, 'sdks.mdx'), ['@brik64/core@0.1.0-beta.8', 'brik64==0.1.0b8', 'brik64-core@0.1.0-beta.8'], failures, artifacts); + checkFile('docs_llms', path.join(docsRoot, 'llms-full.txt'), [version, '@brik64/core@0.1.0-beta.8', 'brik64==0.1.0b8', 'brik64-core@0.1.0-beta.8'], failures, artifacts); + checkFile('web_sdk_download_api', path.join(webRoot, 'functions/api/download/sdk/[target].ts'), ['0.1.0-beta.8', '0.1.0b8'], failures, artifacts); + checkFile('web_cli_download_api', path.join(webRoot, 'functions/api/download/cli.ts'), [version], failures, artifacts); + checkFile('web_language_data', path.join(webRoot, 'src/lib/language-data.ts'), ['npm install @brik64/core@0.1.0-beta.8', 'pip install brik64==0.1.0b8', 'cargo add brik64-core --version 0.1.0-beta.8'], failures, artifacts); + + for (const stale of scanStale(docsRoot, ['-n', '0\\.1\\.0-beta\\.[4567]|0\\.1\\.0b[4567]|beta[4567]|beta\\.[4567]', '-g', '!docs/research/**', '-g', '!docs/operations/**', '-g', '!BETA*_SYNC.md', '-g', '!node_modules/**', '-g', '!.git/**'])) { + failures.push(`docs_stale_beta_residue:${stale}`); + } + for (const stale of scanStale(webRoot, ['-n', '0\\.1\\.0-beta\\.[4567]|0\\.1\\.0b[4567]|beta[4567]|beta\\.[4567]', '-g', '!docs/research/**', '-g', '!src/lib/cms/generated-public-content.json', '-g', '!node_modules/**', '-g', '!.next/**', '-g', '!out/**', '-g', '!.git/**'])) { + failures.push(`web_stale_beta_residue:${stale}`); + } + + const report = { + schemaVersion: 'brik64.cli_beta8_docs_web_sync_gate.v1', + version, + decision: failures.length === 0 ? 'PASS_DOCS_WEB_BETA8_SYNC' : 'FAIL_DOCS_WEB_BETA8_SYNC', + releaseEligible: failures.length === 0, + deployAllowed: failures.length === 0, + artifacts, + failures, + boundary: 'Docs and web source must be beta8 aligned before public release. This gate does not deploy.' + }; + fs.writeFileSync(path.join(outDir, 'report.json'), `${JSON.stringify(report, null, 2)}\n`); + process.stdout.write(`decision=${report.decision}\n`); + process.stdout.write(`deployAllowed=${report.deployAllowed}\n`); + if (failures.length > 0) process.stdout.write(`failures=${failures.join(',')}\n`); + if (failures.length > 0) process.exit(1); +} + +main(); diff --git a/scripts/beta8-github-verified-signature-gate.js b/scripts/beta8-github-verified-signature-gate.js new file mode 100644 index 00000000..a282f0ea --- /dev/null +++ b/scripts/beta8-github-verified-signature-gate.js @@ -0,0 +1,118 @@ +#!/usr/bin/env node +const fs = require('fs'); +const path = require('path'); +const childProcess = require('child_process'); + +const root = path.resolve(__dirname, '..'); +const outDir = path.join(root, 'evidence', 'beta8-github-verified-signature'); + +process.stdout.on('error', (error) => { + if (error.code === 'EPIPE') process.exit(0); + throw error; +}); + +function argValue(name, fallback) { + const index = process.argv.indexOf(name); + return index === -1 ? fallback : process.argv[index + 1] || fallback; +} + +function gitOutput(args) { + return childProcess.execFileSync('git', args, { cwd: root, encoding: 'utf8' }).trim(); +} + +function runGhVerification(repo, commit) { + const result = childProcess.spawnSync('gh', ['api', `repos/${repo}/commits/${commit}`, '--jq', '.commit.verification'], { + cwd: root, + encoding: 'utf8', + env: process.env + }); + if (result.status !== 0) { + return { + ok: false, + apiError: (result.stderr || result.stdout || '').trim(), + payload: null + }; + } + try { + return { + ok: true, + apiError: '', + payload: JSON.parse(result.stdout) + }; + } catch (error) { + return { + ok: false, + apiError: `github_verification_parse_error:${error.message}`, + payload: null + }; + } +} + +function readFixture(file) { + try { + return { + ok: true, + apiError: '', + payload: JSON.parse(fs.readFileSync(path.resolve(root, file), 'utf8')) + }; + } catch (error) { + return { + ok: false, + apiError: `verification_fixture_error:${error.message}`, + payload: null + }; + } +} + +function main() { + fs.mkdirSync(outDir, { recursive: true }); + const repo = argValue('--repo', process.env.BRIK64_GITHUB_REPO || 'brik64/brik64-cli'); + const commit = argValue('--commit', process.env.BRIK64_RELEASE_COMMIT || gitOutput(['rev-parse', 'HEAD'])); + const fixture = argValue('--verification-json', ''); + const failures = []; + const warnings = []; + + if (!/^[0-9a-f]{40}$/.test(commit)) failures.push('commit_sha_invalid'); + + const source = fixture ? readFixture(fixture) : failures.length === 0 ? runGhVerification(repo, commit) : { ok: false, apiError: '', payload: null }; + if (!source.ok) failures.push('github_verification_unavailable'); + const verification = source.payload || {}; + if (source.ok && verification.verified !== true) failures.push('commit_not_github_verified'); + if (source.ok && !verification.verified_at) warnings.push('verified_at_missing'); + + const report = { + schemaVersion: 'brik64.beta8_github_verified_signature_gate.v1', + generatedAt: new Date().toISOString(), + releaseId: 'brik64-0.1.0-beta.8', + version: '0.1.0-beta.8', + decision: failures.length === 0 + ? 'PASS_BETA8_GITHUB_VERIFIED_SIGNATURE' + : 'BLOCKED_BETA8_GITHUB_VERIFIED_SIGNATURE', + repo, + commit, + verification: { + verified: verification.verified === true, + reason: verification.reason || '', + verifiedAt: verification.verified_at || null, + payloadPresent: Boolean(verification.payload) + }, + apiError: source.apiError || null, + boundary: { + gateKind: 'release_integrity_identity_gate', + compilerFunctionalityEvidence: false, + publicReleaseAllowed: failures.length === 0, + adminOverrideAllowed: false + }, + failures, + warnings + }; + + fs.writeFileSync(path.join(outDir, 'report.json'), `${JSON.stringify(report, null, 2)}\n`); + process.stdout.write(`decision=${report.decision}\n`); + process.stdout.write(`publicReleaseAllowed=${report.boundary.publicReleaseAllowed}\n`); + if (failures.length > 0) process.stdout.write(`failures=${failures.join(',')}\n`); + if (warnings.length > 0) process.stdout.write(`warnings=${warnings.join(',')}\n`); + if (failures.length > 0) process.exit(2); +} + +main(); diff --git a/scripts/beta8-marketplace-package-gate.js b/scripts/beta8-marketplace-package-gate.js new file mode 100644 index 00000000..2a001f9b --- /dev/null +++ b/scripts/beta8-marketplace-package-gate.js @@ -0,0 +1,79 @@ +#!/usr/bin/env node +const fs = require('fs'); +const path = require('path'); +const crypto = require('crypto'); + +const root = path.resolve(__dirname, '..'); +const outDir = path.join(root, 'evidence', 'beta8-marketplace-packages'); +const repos = { + js: '/Users/carlosjperez/Documents/GitHub/brik64-lib-js', + python: '/Users/carlosjperez/Documents/GitHub/brik64-lib-python', + rust: '/Users/carlosjperez/Documents/GitHub/brik64-lib-rust' +}; + +process.stdout.on('error', (error) => { + if (error.code === 'EPIPE') process.exit(0); + throw error; +}); + +function sha256File(file) { + return crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex'); +} + +function artifact(file, repoRoot) { + if (!fs.existsSync(file)) return null; + return { path: path.relative(repoRoot, file), absolutePath: file, sha256: sha256File(file), bytes: fs.statSync(file).size }; +} + +function readJson(file) { + return JSON.parse(fs.readFileSync(file, 'utf8')); +} + +function main() { + fs.mkdirSync(outDir, { recursive: true }); + const failures = []; + const jsPackageJson = path.join(repos.js, 'package.json'); + const pyProject = path.join(repos.python, 'pyproject.toml'); + const rustCargo = path.join(repos.rust, 'Cargo.toml'); + const jsTarball = artifact(path.join(repos.js, 'evidence-beta8-pack', 'brik64-core-0.1.0-beta.8.tgz'), repos.js); + const pythonWheel = artifact(path.join(repos.python, 'dist', 'brik64-0.1.0b8-py3-none-any.whl'), repos.python); + const pythonSdist = artifact(path.join(repos.python, 'dist', 'brik64-0.1.0b8.tar.gz'), repos.python); + const rustCrate = artifact(path.join(repos.rust, 'target', 'package', 'brik64-core-0.1.0-beta.8.crate'), repos.rust); + + if (!fs.existsSync(jsPackageJson)) failures.push('js_package_json_missing'); + if (!fs.existsSync(pyProject)) failures.push('python_pyproject_missing'); + if (!fs.existsSync(rustCargo)) failures.push('rust_cargo_toml_missing'); + + const jsVersion = fs.existsSync(jsPackageJson) ? readJson(jsPackageJson).version : null; + const pyProjectText = fs.existsSync(pyProject) ? fs.readFileSync(pyProject, 'utf8') : ''; + const rustCargoText = fs.existsSync(rustCargo) ? fs.readFileSync(rustCargo, 'utf8') : ''; + + if (jsVersion !== '0.1.0-beta.8') failures.push(`js_version_drift:${jsVersion || 'missing'}`); + if (!/version\s*=\s*"0\.1\.0b8"/.test(pyProjectText)) failures.push('python_version_drift'); + if (!/version\s*=\s*"0\.1\.0-beta\.8"/.test(rustCargoText)) failures.push('rust_version_drift'); + if (!jsTarball) failures.push('npm_package_not_packed_for_beta8_publication'); + if (!pythonWheel || !pythonSdist) failures.push('pypi_package_not_built_for_beta8_publication'); + if (!rustCrate) failures.push('cargo_package_not_packed_for_beta8_publication'); + + const report = { + schemaVersion: 'brik64.cli_beta8_marketplace_package_gate.v1', + version: '0.1.0-beta.8', + decision: failures.length === 0 ? 'PASS_MARKETPLACE_PACKAGE_GATE' : 'FAIL_MARKETPLACE_PACKAGE_GATE', + releaseEligible: failures.length === 0, + marketplacePublicationAllowed: failures.length === 0, + packages: { + npm: { repository: repos.js, packageName: '@brik64/core', version: jsVersion, artifact: jsTarball }, + pypi: { repository: repos.python, packageName: 'brik64', version: '0.1.0b8', wheel: pythonWheel, sdist: pythonSdist }, + cargo: { repository: repos.rust, crateName: 'brik64-core', version: '0.1.0-beta.8', artifact: rustCrate } + }, + failures, + boundary: 'Package artifacts are local beta8 publication inputs. This gate verifies readiness but does not mutate npm, PyPI or crates.io.' + }; + fs.writeFileSync(path.join(outDir, 'report.json'), `${JSON.stringify(report, null, 2)}\n`); + process.stdout.write(`decision=${report.decision}\n`); + process.stdout.write(`marketplacePublicationAllowed=${report.marketplacePublicationAllowed}\n`); + if (failures.length > 0) process.stdout.write(`failures=${failures.join(',')}\n`); + if (failures.length > 0) process.exit(1); +} + +main(); diff --git a/scripts/beta8-package-smoke.sh b/scripts/beta8-package-smoke.sh new file mode 100644 index 00000000..c4da7ca1 --- /dev/null +++ b/scripts/beta8-package-smoke.sh @@ -0,0 +1,155 @@ +#!/usr/bin/env bash +set -euo pipefail + +ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" +VERSION="0.1.0-beta.8" +PKG_DIR="$ROOT_DIR/evidence/beta8-package" +OUT_DIR="$ROOT_DIR/evidence/beta8-package-smoke" +MANIFEST="$PKG_DIR/package.manifest.json" +TMP_DIR="$(mktemp -d)" + +cleanup() { rm -rf "$TMP_DIR"; } +trap cleanup EXIT + +need_cmd() { + command -v "$1" >/dev/null 2>&1 || { + echo "missing command: $1" >&2 + exit 2 + } +} + +need_cmd node +need_cmd python3 +need_cmd rustc +need_cmd jq +need_cmd tar +need_cmd shasum + +sha256_file() { shasum -a 256 "$1" | awk '{print $1}'; } + +run_pass() { + local id="$1" + local expected="${2:-}" + shift 2 + "$@" >"$TMP_DIR/$id.stdout" 2>"$TMP_DIR/$id.stderr" || { + rc=$? + printf '%s:rc=%s\n' "$id" "$rc" >&2 + cat "$TMP_DIR/$id.stderr" >&2 + exit "$rc" + } + if [[ -n "$expected" ]] && ! grep -q "$expected" "$TMP_DIR/$id.stdout" "$TMP_DIR/$id.stderr"; then + printf '%s:missing:%s\n' "$id" "$expected" >&2 + exit 1 + fi +} + +run_fail() { + local id="$1" + local expected="$2" + shift 2 + set +e + "$@" >"$TMP_DIR/$id.stdout" 2>"$TMP_DIR/$id.stderr" + local cmd_rc=$? + set -e + if [[ "$cmd_rc" -eq 0 ]]; then + printf '%s:unexpected_success\n' "$id" >&2 + exit 1 + fi + if ! grep -q "$expected" "$TMP_DIR/$id.stdout" "$TMP_DIR/$id.stderr"; then + printf '%s:missing:%s\n' "$id" "$expected" >&2 + exit 1 + fi +} + +mkdir -p "$OUT_DIR" + +manifest_version="$(jq -r '.version' "$MANIFEST")" +manifest_decision="$(jq -r '.decision' "$MANIFEST")" +release_eligible="$(jq -r '.releaseEligible' "$MANIFEST")" +package_rel="$(jq -r '.package.path' "$MANIFEST")" +package_sha="$(jq -r '.package.sha256' "$MANIFEST")" +package_path="$ROOT_DIR/$package_rel" + +[[ "$manifest_version" == "$VERSION" ]] || { echo "manifest_version_drift:$manifest_version" >&2; exit 1; } +[[ "$manifest_decision" == "PASS_BRIK64_CLI_BETA8_PACKAGE_BUILT" ]] || { echo "package_decision_drift:$manifest_decision" >&2; exit 1; } +[[ "$release_eligible" == "false" ]] || { echo "beta8_candidate_should_not_be_public_release_eligible" >&2; exit 1; } +[[ "$(sha256_file "$package_path")" == "$package_sha" ]] || { echo "package_hash_mismatch" >&2; exit 1; } + +run_pass extract "" tar -xzf "$package_path" -C "$TMP_DIR" +EXTRACTED="$TMP_DIR/brik64-cli-$VERSION" +BRIK="$EXTRACTED/src/brik.js" +CONFIG_HOME="$TMP_DIR/config" +WORK_DIR="$TMP_DIR/work" +mkdir -p "$WORK_DIR" + +run_pass version "BRIK64 CLI $VERSION" node "$BRIK" --version +run_pass help "emit " node "$BRIK" --help +grep -q -- "--target " "$TMP_DIR/help.stdout" "$TMP_DIR/help.stderr" || { + echo "help:missing:--target " >&2 + exit 1 +} +cat > "$WORK_DIR/program.pcd" <<'PCD' +PC packaged_program { + fn packaged_program(input) { + if ((input >= 5) && (input != 9)) { + return input * 2; + } else { + return input + 3; + } + } +} +PCD + +pushd "$WORK_DIR" >/dev/null + run_pass init "created=.brik/manifest.json" env BRIK64_CONFIG_HOME="$CONFIG_HOME" node "$BRIK" init + run_pass certify "certificate=program.pcd.cert.json" env BRIK64_CONFIG_HOME="$CONFIG_HOME" node "$BRIK" certify program.pcd + for target in ts rust python; do + run_pass "emit_$target" "generated=" env BRIK64_CONFIG_HOME="$CONFIG_HOME" node "$BRIK" emit program.pcd --target "$target" --out "out-$target" --tests + done + run_pass ts_generated "brik64 generated ts test: PASS" node out-ts/program.test.mjs + run_pass rust_compile "" rustc out-rust/program_test.rs -o out-rust/program_test + run_pass rust_generated "brik64 generated rust test: PASS" ./out-rust/program_test + run_pass python_generated "brik64 generated python test: PASS" env PYTHONPATH=out-python python3 out-python/test_program.py + run_pass verify "verification=PASS" env BRIK64_CONFIG_HOME="$CONFIG_HOME" node "$BRIK" verify program.pcd + run_fail cloud_verify_no_entitlement "managed_entitlement_required" env BRIK64_CONFIG_HOME="$CONFIG_HOME" node "$BRIK" verify program.pcd --cloud +popd >/dev/null + +jq -n \ + --arg version "$VERSION" \ + --arg packagePath "$package_rel" \ + --arg packageSha "$package_sha" \ + '{ + schemaVersion:"brik64.cli_beta8_package_smoke.v1", + version:$version, + decision:"PASS_BRIK64_CLI_BETA8_LOCAL_PACKAGE_SMOKE", + releaseEligible:false, + lane:"cli_0_1_beta8", + package:{path:$packagePath, sha256:$packageSha}, + checks:[ + "extract", + "version", + "help", + "init", + "certify", + "emit_ts", + "emit_rust", + "emit_python", + "generated_ts_exec", + "generated_rust_exec", + "generated_python_exec", + "verify", + "cloud_verify_no_entitlement" + ], + claim_boundary:{ + public_claims_allowed:false, + public_release_allowed:false, + local_package_smoke_passed:true, + fixpoint_claim_allowed:false, + n5_formal_claim_allowed:false, + rust_independence_claim_allowed:false + }, + next_action:"run platform smoke, sync gates and public release train" + }' > "$OUT_DIR/report.json" + +printf 'decision=PASS_BRIK64_CLI_BETA8_LOCAL_PACKAGE_SMOKE\n' +printf 'checks=13\n' diff --git a/scripts/beta8-sdk-sync-gate.js b/scripts/beta8-sdk-sync-gate.js new file mode 100644 index 00000000..6e4996f5 --- /dev/null +++ b/scripts/beta8-sdk-sync-gate.js @@ -0,0 +1,91 @@ +#!/usr/bin/env node +const fs = require('fs'); +const path = require('path'); +const crypto = require('crypto'); + +const root = path.resolve(__dirname, '..'); +const outDir = path.join(root, 'evidence', 'beta8-sdk-sync'); +const version = '0.1.0-beta.8'; +const pyVersion = '0.1.0b8'; + +const repos = [ + { + id: 'js_ts', + path: '/Users/carlosjperez/Documents/GitHub/brik64-lib-js', + files: ['package.json', 'README.md'], + versionFile: 'package.json', + expected: '"version": "0.1.0-beta.8"' + }, + { + id: 'python', + path: '/Users/carlosjperez/Documents/GitHub/brik64-lib-python', + files: ['pyproject.toml', 'README.md'], + versionFile: 'pyproject.toml', + expected: 'version = "0.1.0b8"' + }, + { + id: 'rust', + path: '/Users/carlosjperez/Documents/GitHub/brik64-lib-rust', + files: ['Cargo.toml', 'README.md'], + versionFile: 'Cargo.toml', + expected: 'version = "0.1.0-beta.8"' + } +]; + +process.stdout.on('error', (error) => { + if (error.code === 'EPIPE') process.exit(0); + throw error; +}); + +function sha256File(file) { + return crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex'); +} + +function scanRepo(repo) { + const failures = []; + const artifacts = []; + for (const rel of repo.files) { + const file = path.join(repo.path, rel); + if (!fs.existsSync(file)) { + failures.push(`missing_sdk_file:${repo.id}:${rel}`); + continue; + } + const text = fs.readFileSync(file, 'utf8'); + artifacts.push({ path: file, sha256: sha256File(file), bytes: Buffer.byteLength(text, 'utf8') }); + if (/0\.1\.0-beta\.[4567](?:\.1)?|0\.1\.0b[4567](?:\.post1)?|beta[4567]|beta\.[4567]/.test(text)) { + failures.push(`stale_beta_reference:${repo.id}:${rel}`); + } + if (/\bL[456]\+?N5\b|\bfixpoint\b|\bself-host/i.test(text)) { + failures.push(`private_or_claim_language:${repo.id}:${rel}`); + } + } + const versionText = fs.existsSync(path.join(repo.path, repo.versionFile)) + ? fs.readFileSync(path.join(repo.path, repo.versionFile), 'utf8') + : ''; + if (!versionText.includes(repo.expected)) failures.push(`sdk_beta8_version_missing:${repo.id}`); + return { id: repo.id, repo: repo.path, status: failures.length === 0 ? 'updated' : 'blocked', artifacts, failures }; +} + +function main() { + fs.mkdirSync(outDir, { recursive: true }); + const sdks = repos.map(scanRepo); + const failures = sdks.flatMap((sdk) => sdk.failures); + const report = { + schemaVersion: 'brik64.cli_beta8_sdk_sync_gate.v1', + version, + pythonVersion: pyVersion, + decision: failures.length === 0 ? 'PASS_SDK_BETA8_SYNC' : 'FAIL_SDK_BETA8_SYNC', + releaseEligible: failures.length === 0, + marketplacePublicationAllowed: failures.length === 0, + sdks, + failures, + boundary: 'SDK repositories must be beta8 aligned before marketplace publication. This gate does not mutate npm, PyPI or crates.io.' + }; + fs.writeFileSync(path.join(outDir, 'report.json'), `${JSON.stringify(report, null, 2)}\n`); + process.stdout.write(`decision=${report.decision}\n`); + process.stdout.write(`marketplacePublicationAllowed=${report.marketplacePublicationAllowed}\n`); + if (failures.length > 0) process.stdout.write(`failures=${failures.join(',')}\n`); + if (failures.length > 0) process.exit(1); +} + +main(); diff --git a/scripts/beta8-skills-sync-gate.js b/scripts/beta8-skills-sync-gate.js new file mode 100644 index 00000000..ab9313ec --- /dev/null +++ b/scripts/beta8-skills-sync-gate.js @@ -0,0 +1,70 @@ +#!/usr/bin/env node +const fs = require('fs'); +const path = require('path'); +const crypto = require('crypto'); + +const root = path.resolve(__dirname, '..'); +const skillsRoot = '/Users/carlosjperez/Documents/GitHub/brik64-tools-skills'; +const outDir = path.join(root, 'evidence', 'beta8-skills-sync'); +const version = '0.1.0-beta.8'; + +process.stdout.on('error', (error) => { + if (error.code === 'EPIPE') process.exit(0); + throw error; +}); + +const files = [ + 'README.md', + 'skills/brik64/SKILL.md', + 'skills/brik64-javascript/SKILL.md', + 'skills/brik64-python/SKILL.md', + 'skills/brik64-rust/SKILL.md', + 'skills/pcd-system/SKILL.md', + 'skills/digital-circuitality/SKILL.md' +]; + +function sha256File(file) { + return crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex'); +} + +function main() { + fs.mkdirSync(outDir, { recursive: true }); + const failures = []; + const artifacts = []; + for (const rel of files) { + const file = path.join(skillsRoot, rel); + if (!fs.existsSync(file)) { + failures.push(`missing_skill_file:${rel}`); + continue; + } + const text = fs.readFileSync(file, 'utf8'); + artifacts.push({ path: file, sha256: sha256File(file), bytes: Buffer.byteLength(text, 'utf8') }); + if (/0\.1\.0-beta\.[4567](?:\.1)?|0\.1\.0b[4567](?:\.post1)?|beta[4567]|beta\.[4567]/.test(text)) failures.push(`skill_stale_beta_residue:${rel}`); + if (/\bL[456]\+?N5\b|\bfixpoint\b|\bself-host\b|Hetzner|1Password/.test(text)) failures.push(`skill_private_or_claim_language:${rel}`); + } + const brik64Path = path.join(skillsRoot, 'skills/brik64/SKILL.md'); + const brik64 = fs.existsSync(brik64Path) ? fs.readFileSync(brik64Path, 'utf8') : ''; + if (!brik64.includes(`Public CLI version: \`${version}\``) && !brik64.includes('Public CLI version: dynamic')) failures.push('brik64_skill_beta8_version_boundary_missing'); + if (!brik64.includes('@brik64/core@0.1.0-beta.8')) failures.push('brik64_skill_js_sdk_missing'); + if (!brik64.includes('brik64==0.1.0b8')) failures.push('brik64_skill_python_sdk_missing'); + if (!brik64.includes('brik64-core@0.1.0-beta.8')) failures.push('brik64_skill_rust_sdk_missing'); + + const report = { + schemaVersion: 'brik64.cli_beta8_skills_sync_gate.v1', + version, + decision: failures.length === 0 ? 'PASS_SKILLS_BETA8_SYNC' : 'FAIL_SKILLS_BETA8_SYNC', + releaseEligible: failures.length === 0, + publicSkillPublicationAllowed: failures.length === 0, + skillsRoot, + artifacts, + failures, + boundary: 'Public skills must be beta8 aware and must not expose private release or engine nomenclature.' + }; + fs.writeFileSync(path.join(outDir, 'report.json'), `${JSON.stringify(report, null, 2)}\n`); + process.stdout.write(`decision=${report.decision}\n`); + process.stdout.write(`publicSkillPublicationAllowed=${report.publicSkillPublicationAllowed}\n`); + if (failures.length > 0) process.stdout.write(`failures=${failures.join(',')}\n`); + if (failures.length > 0) process.exit(1); +} + +main(); diff --git a/scripts/build-beta8-package.sh b/scripts/build-beta8-package.sh new file mode 100644 index 00000000..b259e7da --- /dev/null +++ b/scripts/build-beta8-package.sh @@ -0,0 +1,162 @@ +#!/usr/bin/env bash +set -euo pipefail + +ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" +VERSION="0.1.0-beta.8" +OUT_DIR="$ROOT_DIR/evidence/beta8-package" +STAGE_ROOT="$OUT_DIR/stage" +STAGE_NAME="brik64-cli-$VERSION" +STAGE_DIR="$STAGE_ROOT/$STAGE_NAME" +PACKAGE_NAME="brik64-cli-$VERSION.tgz" +PACKAGE_PATH="$OUT_DIR/$PACKAGE_NAME" + +need_cmd() { + command -v "$1" >/dev/null 2>&1 || { + echo "missing command: $1" >&2 + exit 2 + } +} + +need_cmd node +need_cmd jq +need_cmd tar +need_cmd shasum + +sha256_file() { shasum -a 256 "$1" | awk '{print $1}'; } +file_size() { wc -c < "$1" | tr -d '[:space:]'; } + +read_json_field() { + local file="$1" + local expr="$2" + jq -r "$expr" "$file" +} + +copy_input() { + local relative="$1" + local source="$ROOT_DIR/$relative" + local dest="$STAGE_DIR/$relative" + if [[ ! -e "$source" ]]; then + echo "missing_package_input:$relative" >&2 + exit 1 + fi + mkdir -p "$(dirname "$dest")" + cp "$source" "$dest" +} + +package_version="$(read_json_field "$ROOT_DIR/package.json" '.version')" +manifest_version="$(read_json_field "$ROOT_DIR/.brik/manifest.json" '.cliVersion')" +functionality_decision="$(read_json_field "$ROOT_DIR/evidence/beta8-compiler-functionality/report.json" '.decision')" +adversarial_decision="$(read_json_field "$ROOT_DIR/evidence/beta8-adversarial/report.json" '.decision')" + +failures=() +[[ "$package_version" == "$VERSION" ]] || failures+=("package_version_drift:$package_version") +[[ "$manifest_version" == "$VERSION" ]] || failures+=("brik_manifest_version_drift:$manifest_version") +[[ "$functionality_decision" == "PASS_BRIK64_CLI_BETA8_COMPILER_FUNCTIONALITY" ]] || failures+=("functionality_gate_not_pass:$functionality_decision") +[[ "$adversarial_decision" == "PASS_BRIK64_CLI_BETA8_ADVERSARIAL" ]] || failures+=("adversarial_gate_not_pass:$adversarial_decision") + +if [[ "${#failures[@]}" -gt 0 ]]; then + mkdir -p "$OUT_DIR" + jq -n \ + --arg version "$VERSION" \ + --argjson failures "$(printf '%s\n' "${failures[@]}" | jq -Rsc 'split("\n") | map(select(length > 0))')" \ + '{ + schemaVersion:"brik64.cli_beta8_package_manifest.v1", + version:$version, + decision:"FAIL_BRIK64_CLI_BETA8_PACKAGE_BUILT", + releaseEligible:false, + failures:$failures + }' > "$OUT_DIR/package.manifest.json" + printf 'beta8_package_input_gate_failed:%s\n' "${failures[*]}" >&2 + exit 1 +fi + +rm -rf "$OUT_DIR" +mkdir -p "$STAGE_DIR" + +inputs=( + ".brik/manifest.json" + "README.md" + "CHANGELOG.md" + "LICENSE" + "NOTICE" + "SECURITY.md" + "src/brik.js" + "pcd/cli_core.pcd" + "pcd/cli_polymer.pcd" + "pcd/cli_account_session.pcd" + "pcd/cli_migrate.pcd" + "pcd/cli_polymerize.pcd" + "pcd/cli_verify.pcd" + "engines/l4plus-n5/serial.txt" + "engines/l4plus-n5/checksums.tsv" + "engines/l4plus-n5/runtime-bundle.manifest.json" + "evidence/beta8-compiler-functionality/report.json" + "evidence/beta8-adversarial/report.json" +) + +for input in "${inputs[@]}"; do + copy_input "$input" +done + +jq -n \ + --arg version "$VERSION" \ + '{ + name:"@brik64/cli", + version:$version, + private:true, + description:"BRIK64 CLI public beta candidate for local PCD workflows and bounded compiler emission.", + bin:{brik:"src/brik.js"}, + engines:{node:">=20"}, + distribution:"curl_and_github_release_assets" + }' > "$STAGE_DIR/package.json" +chmod 755 "$STAGE_DIR/src/brik.js" + +tar -czf "$PACKAGE_PATH" -C "$STAGE_ROOT" "$STAGE_NAME" +package_sha="$(sha256_file "$PACKAGE_PATH")" + +find "$STAGE_DIR" -type f | sort | while read -r file; do + rel="${file#$STAGE_DIR/}" + printf '%s %s\n' "$(sha256_file "$file")" "$rel" +done > "$OUT_DIR/stage-checksums.tsv" + +jq -n \ + --arg version "$VERSION" \ + --arg packagePath "evidence/beta8-package/$PACKAGE_NAME" \ + --arg packageSha "$package_sha" \ + --argjson packageBytes "$(file_size "$PACKAGE_PATH")" \ + '{ + schemaVersion:"brik64.cli_beta8_package_manifest.v1", + version:$version, + decision:"PASS_BRIK64_CLI_BETA8_PACKAGE_BUILT", + releaseEligible:false, + lane:"cli_0_1_beta8", + generationClaim:"internal_generation_non_claim", + package:{path:$packagePath, sha256:$packageSha, bytes:$packageBytes}, + inputGates:[ + "PASS_BRIK64_CLI_BETA8_COMPILER_FUNCTIONALITY", + "PASS_BRIK64_CLI_BETA8_ADVERSARIAL" + ], + requiredPublicReleaseGates:[ + "beta8_package_smoke", + "beta8_github_verified_signature", + "platform_smoke", + "curl_gcp_installer_beta8", + "github_release_beta8", + "web_docs_changelog_beta8", + "skills_beta8", + "sdk_beta8_or_no_change_evidence", + "public_claim_scan" + ], + boundary:"Beta8 local package candidate only. Public release remains blocked until package, platform, installer, GitHub, SDK, docs, web, changelog, skills and public-claim gates pass together." + }' > "$OUT_DIR/package.manifest.json" + +{ + printf '%s %s\n' "$package_sha" "$PACKAGE_NAME" + printf '%s %s\n' "$(sha256_file "$OUT_DIR/package.manifest.json")" "package.manifest.json" + printf '%s %s\n' "$(sha256_file "$OUT_DIR/stage-checksums.tsv")" "stage-checksums.tsv" +} > "$OUT_DIR/SHA256SUMS" + +printf 'decision=PASS_BRIK64_CLI_BETA8_PACKAGE_BUILT\n' +printf 'releaseEligible=false\n' +printf 'package=evidence/beta8-package/%s\n' "$PACKAGE_NAME" +printf 'sha256=%s\n' "$package_sha" diff --git a/scripts/release-flow-audit.js b/scripts/release-flow-audit.js index 79fa2f29..9ec18943 100644 --- a/scripts/release-flow-audit.js +++ b/scripts/release-flow-audit.js @@ -134,8 +134,18 @@ function main() { for (const scriptName of requiredBetaScripts(label)) { add(Boolean(scripts[scriptName]), failures, `current_beta_script_missing:${scriptName}`); } - add(fs.existsSync(path.join(root, 'scripts', `build-${label}-package.js`)), failures, `current_beta_package_builder_missing:${label}`); - add(fs.existsSync(path.join(root, 'scripts', `${label}-package-smoke.js`)), failures, `current_beta_package_smoke_missing:${label}`); + add( + fs.existsSync(path.join(root, 'scripts', `build-${label}-package.js`)) + || fs.existsSync(path.join(root, 'scripts', `build-${label}-package.sh`)), + failures, + `current_beta_package_builder_missing:${label}` + ); + add( + fs.existsSync(path.join(root, 'scripts', `${label}-package-smoke.js`)) + || fs.existsSync(path.join(root, 'scripts', `${label}-package-smoke.sh`)), + failures, + `current_beta_package_smoke_missing:${label}` + ); add(fs.existsSync(path.join(root, 'evidence', `${label}-package`, 'package.manifest.json')), failures, `current_beta_package_manifest_missing:${label}`); } @@ -173,7 +183,11 @@ function main() { add(changelogSection.length > 0, failures, 'changelog_section_missing'); const changelogForbidden = forbiddenHits(changelogSection); if (changelogForbidden.length > 0) failures.push(`changelog_internal_language:${changelogForbidden.join('|')}`); - add(readme.includes(`Current public beta: \`${manifest.version}\``), failures, 'readme_public_version_drift'); + if (manifest.state === 'public') { + add(readme.includes(`Current public beta: \`${manifest.version}\``), failures, 'readme_public_version_drift'); + } else { + add(readme.includes(`Current beta candidate: \`${manifest.version}\``), failures, 'readme_candidate_version_drift'); + } textContainsAll(publishPlan, [ 'github_release', diff --git a/scripts/release-train-dry-run.js b/scripts/release-train-dry-run.js index c0b46b96..a795a526 100644 --- a/scripts/release-train-dry-run.js +++ b/scripts/release-train-dry-run.js @@ -14,7 +14,17 @@ process.stdout.on('error', (error) => { }); function readJson(file) { - return JSON.parse(fs.readFileSync(file, 'utf8')); + let text = ''; + for (let attempt = 0; attempt < 5; attempt += 1) { + text = fs.readFileSync(file, 'utf8'); + if (text.trim().length > 0) break; + childProcess.spawnSync('node', ['-e', 'Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 100)']); + } + try { + return JSON.parse(text); + } catch (error) { + throw new Error(`json_parse_failed:${path.relative(root, file)}:${error.message}`); + } } function readText(file) { @@ -124,6 +134,22 @@ function manifestDrivenBetaCommands(manifest, canAccessSiblingRepos) { ]; } + if (betaNumber(manifest.version) === 8) { + const enforceSignature = manifest.state !== 'draft' || process.env.BRIK64_REQUIRE_GITHUB_VERIFIED_SIGNATURE === '1'; + return [ + run('beta8_compiler_functionality', ['bash', 'scripts/beta8-compiler-functionality-gate.sh']), + run('beta8_adversarial', ['bash', 'scripts/beta8-adversarial-gate.sh']), + run('beta8_local_package', ['bash', 'scripts/build-beta8-package.sh']), + run('beta8_package_smoke', ['bash', 'scripts/beta8-package-smoke.sh']), + ...(enforceSignature + ? [run('beta8_github_verified_signature', ['node', 'scripts/beta8-github-verified-signature-gate.js'])] + : []), + ...(canAccessSiblingRepos + ? [] + : []) + ]; + } + return [ run(`${label}_feature_parity`, ['node', `scripts/${label}-feature-parity-gate.js`]), run(`${label}_local_package`, ['node', `scripts/build-${label}-package.js`]), @@ -158,7 +184,7 @@ function main() { ...(beta === 6 && runLiveL6Gate ? [run('beta6_l6_hetzner_generation_gate', ['node', 'scripts/beta6-l6-hetzner-generation-gate.js'])] : []), - run('smoke_tests', ['bash', '-lc', 'BRIK64_RELEASE_GATES=1 bash -x tests/smoke.sh'], { + run('smoke_tests', ['bash', '-lc', beta === 8 ? 'bash -x tests/smoke.sh' : 'BRIK64_RELEASE_GATES=1 bash -x tests/smoke.sh'], { stdoutLimit: 12000, stderrLimit: 12000 }), diff --git a/scripts/release-train-publish-plan.js b/scripts/release-train-publish-plan.js index 564f2677..96eee880 100644 --- a/scripts/release-train-publish-plan.js +++ b/scripts/release-train-publish-plan.js @@ -64,8 +64,23 @@ function main() { const packagePath = packageManifest.package.path; const jsSdkPackDir = `evidence-${label}-pack`; const pythonSdkVersion = manifest.sdks.find((sdk) => sdk.marketplace === 'pypi').version; + const signatureReportPath = path.join(root, 'evidence', `${label}-github-verified-signature`, 'report.json'); + const signatureReport = fs.existsSync(signatureReportPath) ? readJson(signatureReportPath) : null; + const currentHead = gitOutput(['rev-parse', '--short', 'HEAD']); + const currentHeadFull = gitOutput(['rev-parse', 'HEAD']); if (manifest.state !== 'public') failures.push(`manifest_state_not_public:${manifest.state}`); + if (label === 'beta8') { + if (!signatureReport) { + failures.push('beta8_github_verified_signature_report_missing'); + } else if (signatureReport.decision !== 'PASS_BETA8_GITHUB_VERIFIED_SIGNATURE') { + failures.push(`beta8_github_verified_signature_not_pass:${signatureReport.decision}`); + } else if (signatureReport.boundary?.publicReleaseAllowed !== true) { + failures.push('beta8_github_verified_signature_public_release_not_allowed'); + } else if (signatureReport.commit !== currentHeadFull) { + failures.push(`beta8_github_verified_signature_commit_drift:${signatureReport.commit}:${currentHeadFull}`); + } + } if (!dryRunInProgress && dryRun.decision !== 'PASS_RELEASE_TRAIN_DRY_RUN') failures.push(`dry_run_not_green:${dryRun.decision}`); if (!dryRunInProgress && dryRun.manifestDigest !== manifestDigest) failures.push('dry_run_manifest_digest_drift'); if (dryRunInProgress) warnings.push('dry_run_report_currently_being_generated'); @@ -75,7 +90,6 @@ function main() { warnings.push(liveVerify ? `pre_publish_live_verify_not_green:${liveVerify.decision}` : 'pre_publish_live_verify_missing'); } - const currentHead = gitOutput(['rev-parse', '--short', 'HEAD']); if (manifest.source.commit !== currentHead && gitStatus(['merge-base', '--is-ancestor', manifest.source.commit, 'HEAD']) !== 0) { warnings.push(`manifest_source_commit_not_ancestor:${manifest.source.commit}:${currentHead}`); } @@ -189,6 +203,15 @@ PY`, publicationAllowed: publishRequested && failures.length === 0, expectedConfirm, secretAvailability, + signatureReport: signatureReport + ? { + path: path.relative(root, signatureReportPath), + decision: signatureReport.decision, + commit: signatureReport.commit, + verified: signatureReport.verification?.verified === true, + reason: signatureReport.verification?.reason || '' + } + : null, commands, rollback, failures, diff --git a/scripts/release/github-signing-key-preflight.js b/scripts/release/github-signing-key-preflight.js new file mode 100644 index 00000000..16fe8e22 --- /dev/null +++ b/scripts/release/github-signing-key-preflight.js @@ -0,0 +1,161 @@ +#!/usr/bin/env node +const fs = require('fs'); +const os = require('os'); +const path = require('path'); +const childProcess = require('child_process'); + +const root = path.resolve(__dirname, '../..'); +const outDir = path.join(root, 'evidence', 'github-signing-key-preflight'); + +process.stdout.on('error', (error) => { + if (error.code === 'EPIPE') process.exit(0); + throw error; +}); + +function argValue(name, fallback) { + const index = process.argv.indexOf(name); + return index === -1 ? fallback : process.argv[index + 1] || fallback; +} + +function run(command, args, options = {}) { + return childProcess.spawnSync(command, args, { + cwd: root, + encoding: 'utf8', + env: process.env, + ...options + }); +} + +function commandText(command, args) { + return [command, ...args].join(' '); +} + +function fingerprint(publicKeyPath) { + const result = run('ssh-keygen', ['-lf', publicKeyPath, '-E', 'sha256']); + if (result.status !== 0) { + return { ok: false, value: '', error: (result.stderr || result.stdout || '').trim() }; + } + const value = result.stdout.trim().split(/\s+/)[1] || ''; + return { ok: Boolean(value), value, error: value ? '' : 'fingerprint_parse_failed' }; +} + +function ghJson(args) { + const result = run('gh', args); + if (result.status !== 0) { + return { + ok: false, + status: result.status, + stdout: result.stdout || '', + stderr: result.stderr || '', + json: null + }; + } + try { + return { + ok: true, + status: 0, + stdout: result.stdout || '', + stderr: result.stderr || '', + json: JSON.parse(result.stdout || 'null') + }; + } catch (error) { + return { + ok: false, + status: 0, + stdout: result.stdout || '', + stderr: `json_parse_failed:${error.message}`, + json: null + }; + } +} + +function redact(text) { + return String(text || '') + .replace(/gho_[A-Za-z0-9_]+/g, 'gho_***') + .replace(/github_pat_[A-Za-z0-9_]+/g, 'github_pat_***'); +} + +function main() { + fs.mkdirSync(outDir, { recursive: true }); + const publicKeyPath = path.resolve(root, argValue('--public-key', path.join(os.homedir(), '.ssh', 'brik64-admin-signing.pub'))); + const expectedFingerprint = argValue('--expected-fingerprint', process.env.BRIK64_EXPECTED_SIGNING_KEY_FINGERPRINT || ''); + const failures = []; + const warnings = []; + + if (!fs.existsSync(publicKeyPath)) failures.push('public_key_missing'); + const fp = fs.existsSync(publicKeyPath) ? fingerprint(publicKeyPath) : { ok: false, value: '', error: 'public_key_missing' }; + if (!fp.ok) failures.push(`public_key_fingerprint_failed:${fp.error}`); + if (expectedFingerprint && fp.value && fp.value !== expectedFingerprint) failures.push('public_key_fingerprint_drift'); + + const signingKeys = ghJson(['api', 'user/ssh_signing_keys', '--jq', '.']); + if (!signingKeys.ok) { + const detail = `${signingKeys.stderr}\n${signingKeys.stdout}`; + if (detail.includes('admin:ssh_signing_key')) { + failures.push('github_token_missing_scope:admin:ssh_signing_key'); + } else { + failures.push('github_signing_keys_api_unavailable'); + } + } + + const keys = Array.isArray(signingKeys.json) ? signingKeys.json : []; + const matchingSigningKey = fp.value + ? keys.find((item) => { + const key = item?.key || ''; + if (!key) return false; + const tmp = path.join(outDir, `key-${item.id || 'candidate'}.pub`); + fs.writeFileSync(tmp, `${key.trim()}\n`); + const candidateFp = fingerprint(tmp); + fs.rmSync(tmp, { force: true }); + return candidateFp.ok && candidateFp.value === fp.value; + }) + : null; + if (signingKeys.ok && !matchingSigningKey) failures.push('github_signing_key_not_registered'); + + const authStatus = run('gh', ['auth', 'status', '-h', 'github.com']); + if (authStatus.status !== 0) warnings.push('github_auth_status_nonzero'); + + const report = { + schemaVersion: 'brik64.github_signing_key_preflight.v1', + generatedAt: new Date().toISOString(), + decision: failures.length === 0 + ? 'PASS_GITHUB_SIGNING_KEY_PREFLIGHT' + : 'BLOCKED_GITHUB_SIGNING_KEY_PREFLIGHT', + publicKey: { + path: publicKeyPath.replace(os.homedir(), '~'), + fingerprint: fp.value || null, + expectedFingerprint: expectedFingerprint || null, + fingerprintMatchesExpected: Boolean(expectedFingerprint && fp.value === expectedFingerprint) + }, + github: { + signingKeysApiAvailable: signingKeys.ok, + signingKeyRegistered: Boolean(matchingSigningKey), + matchingSigningKeyTitle: matchingSigningKey?.title || null, + authStatusRedacted: redact(`${authStatus.stdout || ''}${authStatus.stderr || ''}`).trim() + }, + nextRequiredAction: failures.includes('github_token_missing_scope:admin:ssh_signing_key') + ? 'Run: gh auth refresh -h github.com -s admin:ssh_signing_key -s admin:public_key' + : failures.includes('github_signing_key_not_registered') + ? 'Register the public key as a GitHub SSH signing key for the committing account, then rerun this preflight.' + : null, + commands: { + refreshScopes: 'gh auth refresh -h github.com -s admin:ssh_signing_key -s admin:public_key', + listSigningKeys: commandText('gh', ['api', 'user/ssh_signing_keys', '--jq', '.']) + }, + failures, + warnings, + boundary: { + privateKeyRead: false, + secretsPrinted: false, + releasePublicationAllowed: failures.length === 0 + } + }; + + fs.writeFileSync(path.join(outDir, 'report.json'), `${JSON.stringify(report, null, 2)}\n`); + process.stdout.write(`decision=${report.decision}\n`); + process.stdout.write(`fingerprint=${report.publicKey.fingerprint || 'missing'}\n`); + if (failures.length > 0) process.stdout.write(`failures=${failures.join(',')}\n`); + if (report.nextRequiredAction) process.stdout.write(`next=${report.nextRequiredAction}\n`); + if (failures.length > 0) process.exit(2); +} + +main(); diff --git a/scripts/release/register-github-signing-key.js b/scripts/release/register-github-signing-key.js new file mode 100644 index 00000000..28c80593 --- /dev/null +++ b/scripts/release/register-github-signing-key.js @@ -0,0 +1,154 @@ +#!/usr/bin/env node +const fs = require('fs'); +const os = require('os'); +const path = require('path'); +const childProcess = require('child_process'); + +const root = path.resolve(__dirname, '../..'); +const outDir = path.join(root, 'evidence', 'github-signing-key-registration'); + +process.stdout.on('error', (error) => { + if (error.code === 'EPIPE') process.exit(0); + throw error; +}); + +function argValue(name, fallback) { + const index = process.argv.indexOf(name); + return index === -1 ? fallback : process.argv[index + 1] || fallback; +} + +function hasFlag(name) { + return process.argv.includes(name); +} + +function run(command, args, input = '') { + return childProcess.spawnSync(command, args, { + cwd: root, + encoding: 'utf8', + input, + env: process.env + }); +} + +function fingerprint(publicKeyPath) { + const result = run('ssh-keygen', ['-lf', publicKeyPath, '-E', 'sha256']); + if (result.status !== 0) return { ok: false, value: '', error: (result.stderr || result.stdout || '').trim() }; + const value = result.stdout.trim().split(/\s+/)[1] || ''; + return { ok: Boolean(value), value, error: value ? '' : 'fingerprint_parse_failed' }; +} + +function ghJson(args, input = '') { + const result = run('gh', args, input); + if (result.status !== 0) { + return { ok: false, status: result.status, stdout: result.stdout || '', stderr: result.stderr || '', json: null }; + } + try { + return { ok: true, status: 0, stdout: result.stdout || '', stderr: result.stderr || '', json: JSON.parse(result.stdout || 'null') }; + } catch (error) { + return { ok: false, status: 0, stdout: result.stdout || '', stderr: `json_parse_failed:${error.message}`, json: null }; + } +} + +function redact(text) { + return String(text || '') + .replace(/gho_[A-Za-z0-9_]+/g, 'gho_***') + .replace(/github_pat_[A-Za-z0-9_]+/g, 'github_pat_***'); +} + +function fingerprintForKeyText(keyText, id) { + const tmp = path.join(outDir, `candidate-${id || 'key'}.pub`); + fs.writeFileSync(tmp, `${String(keyText).trim()}\n`); + const fp = fingerprint(tmp); + fs.rmSync(tmp, { force: true }); + return fp; +} + +function main() { + fs.mkdirSync(outDir, { recursive: true }); + const publicKeyPath = path.resolve(root, argValue('--public-key', path.join(os.homedir(), '.ssh', 'brik64-admin-signing.pub'))); + const title = argValue('--title', 'BRIK64 beta8 release signing key'); + const execute = hasFlag('--execute'); + const failures = []; + const warnings = []; + + if (!fs.existsSync(publicKeyPath)) failures.push('public_key_missing'); + const keyText = fs.existsSync(publicKeyPath) ? fs.readFileSync(publicKeyPath, 'utf8').trim() : ''; + const fp = keyText ? fingerprint(publicKeyPath) : { ok: false, value: '', error: 'public_key_missing' }; + if (!fp.ok) failures.push(`public_key_fingerprint_failed:${fp.error}`); + + const list = ghJson(['api', 'user/ssh_signing_keys', '--jq', '.']); + if (!list.ok) { + const detail = `${list.stderr}\n${list.stdout}`; + if (detail.includes('admin:ssh_signing_key')) failures.push('github_token_missing_scope:admin:ssh_signing_key'); + else failures.push('github_signing_keys_api_unavailable'); + } + + const keys = Array.isArray(list.json) ? list.json : []; + const existing = fp.value + ? keys.find((item) => { + const candidate = fingerprintForKeyText(item?.key || '', item?.id || 'existing'); + return candidate.ok && candidate.value === fp.value; + }) + : null; + + let created = null; + if (execute && failures.length === 0 && !existing) { + const payload = JSON.stringify({ title, key: keyText }); + const create = ghJson(['api', 'user/ssh_signing_keys', '--method', 'POST', '--input', '-'], payload); + if (!create.ok) { + const detail = `${create.stderr}\n${create.stdout}`; + if (detail.includes('already')) warnings.push('github_signing_key_already_exists'); + else failures.push('github_signing_key_create_failed'); + } else { + created = create.json; + } + } + + const registered = Boolean(existing || created); + if (!registered && !execute && failures.length === 0) warnings.push('dry_run_registration_not_executed'); + if (!registered && execute && failures.length === 0) failures.push('github_signing_key_not_registered_after_create'); + + const report = { + schemaVersion: 'brik64.github_signing_key_registration.v1', + generatedAt: new Date().toISOString(), + decision: failures.length === 0 + ? execute + ? 'PASS_GITHUB_SIGNING_KEY_REGISTRATION' + : 'PASS_GITHUB_SIGNING_KEY_REGISTRATION_DRY_RUN' + : 'BLOCKED_GITHUB_SIGNING_KEY_REGISTRATION', + execute, + publicKey: { + path: publicKeyPath.replace(os.homedir(), '~'), + fingerprint: fp.value || null + }, + github: { + signingKeysApiAvailable: list.ok, + signingKeyAlreadyRegistered: Boolean(existing), + signingKeyCreated: Boolean(created), + matchingSigningKeyTitle: existing?.title || created?.title || null + }, + nextRequiredAction: failures.includes('github_token_missing_scope:admin:ssh_signing_key') + ? 'Run: gh auth refresh -h github.com -s admin:ssh_signing_key -s admin:public_key' + : !execute && !registered + ? 'Re-run with --execute after confirming the public key fingerprint.' + : null, + failures, + warnings, + boundary: { + privateKeyRead: false, + secretsPrinted: false, + mutatesGitHub: execute && failures.length === 0 && !existing + } + }; + + fs.writeFileSync(path.join(outDir, 'report.json'), `${JSON.stringify(report, null, 2)}\n`); + process.stdout.write(`decision=${report.decision}\n`); + process.stdout.write(`fingerprint=${report.publicKey.fingerprint || 'missing'}\n`); + process.stdout.write(`execute=${execute}\n`); + if (failures.length > 0) process.stdout.write(`failures=${failures.join(',')}\n`); + if (warnings.length > 0) process.stdout.write(`warnings=${warnings.join(',')}\n`); + if (report.nextRequiredAction) process.stdout.write(`next=${report.nextRequiredAction}\n`); + if (failures.length > 0) process.exit(2); +} + +main(); diff --git a/src/brik.js b/src/brik.js index 615d6d7a..9ed63e7c 100755 --- a/src/brik.js +++ b/src/brik.js @@ -8,7 +8,7 @@ process.stdout.on('error', (error) => { throw error; }); -const version = '0.1.0-beta.7'; +const version = '0.1.0-beta.8'; const SESSION_SCHEMA = 'brik64.cli_session.v1'; const RESET = '\x1b[0m'; const BRIK = '\x1b[38;2;180;180;180m'; @@ -182,6 +182,218 @@ function stripPcdComments(source) { .join('\n'); } +function findMatchingBrace(source, openIndex) { + let depth = 0; + for (let index = openIndex; index < source.length; index += 1) { + const char = source[index]; + if (char === '{') depth += 1; + if (char === '}') { + depth -= 1; + if (depth === 0) return index; + } + } + return -1; +} + +function tokenizeExpression(source) { + const tokens = []; + let index = 0; + while (index < source.length) { + const char = source[index]; + if (/\s/.test(char)) { + index += 1; + continue; + } + const two = source.slice(index, index + 2); + if (['>=', '<=', '==', '!=', '&&', '||'].includes(two)) { + tokens.push({ type: 'op', value: two }); + index += 2; + continue; + } + if ('()+-*/%<>'.includes(char)) { + tokens.push({ type: char === '(' || char === ')' ? 'paren' : 'op', value: char }); + index += 1; + continue; + } + const number = source.slice(index).match(/^\d+/); + if (number) { + tokens.push({ type: 'number', value: Number(number[0]) }); + index += number[0].length; + continue; + } + const ident = source.slice(index).match(/^[A-Za-z_][A-Za-z0-9_]*/); + if (ident) { + tokens.push({ type: 'identifier', value: ident[0] }); + index += ident[0].length; + continue; + } + fail(65, 'pcd_parse_error:unsupported_expression_token'); + } + return tokens; +} + +function parseExpression(source, params) { + const tokens = tokenizeExpression(source); + let index = 0; + const precedence = { + '||': 1, + '&&': 2, + '==': 3, + '!=': 3, + '>': 4, + '<': 4, + '>=': 4, + '<=': 4, + '+': 5, + '-': 5, + '*': 6, + '/': 6, + '%': 6, + }; + + function peek() { + return tokens[index]; + } + + function consume(value) { + const token = tokens[index]; + if (!token || (value && token.value !== value)) { + fail(65, 'pcd_parse_error:malformed_expression'); + } + index += 1; + return token; + } + + function parsePrimary() { + const token = peek(); + if (!token) fail(65, 'pcd_parse_error:malformed_expression'); + if (token.type === 'number') { + consume(); + return { type: 'NumberLiteral', value: token.value }; + } + if (token.type === 'identifier') { + consume(); + if (!params.includes(token.value)) { + fail(65, `pcd_parse_error:unknown_identifier:${token.value}`); + } + return { type: 'Identifier', name: token.value }; + } + if (token.value === '-') { + consume('-'); + return { type: 'UnaryExpression', operator: '-', argument: parsePrimary() }; + } + if (token.value === '(') { + consume('('); + const expression = parseBinary(1); + consume(')'); + return expression; + } + fail(65, 'pcd_parse_error:malformed_expression'); + } + + function parseBinary(minPrecedence) { + let left = parsePrimary(); + while (peek() && peek().type === 'op' && precedence[peek().value] >= minPrecedence) { + const operator = consume().value; + const operatorPrecedence = precedence[operator]; + const right = parseBinary(operatorPrecedence + 1); + left = { type: 'BinaryExpression', operator, left, right }; + } + return left; + } + + const expression = parseBinary(1); + if (index !== tokens.length) { + fail(65, 'pcd_parse_error:malformed_expression'); + } + return expression; +} + +function parseStatements(body, params) { + const statements = []; + let index = 0; + + function skipWhitespace() { + while (index < body.length && /\s/.test(body[index])) index += 1; + } + + function readBalanced(openChar, closeChar) { + if (body[index] !== openChar) fail(65, 'pcd_parse_error:malformed_block'); + let depth = 0; + const start = index; + for (; index < body.length; index += 1) { + if (body[index] === openChar) depth += 1; + if (body[index] === closeChar) { + depth -= 1; + if (depth === 0) { + const content = body.slice(start + 1, index); + index += 1; + return content; + } + } + } + fail(65, 'pcd_parse_error:unclosed_block'); + } + + while (index < body.length) { + skipWhitespace(); + if (index >= body.length) break; + if (body.slice(index).startsWith('return')) { + index += 'return'.length; + const semi = body.indexOf(';', index); + if (semi === -1) fail(65, 'pcd_parse_error:missing_return_semicolon'); + const value = body.slice(index, semi).trim(); + if (!value) fail(65, 'pcd_parse_error:missing_return_value'); + statements.push({ type: 'ReturnStatement', argument: parseExpression(value, params) }); + index = semi + 1; + continue; + } + if (body.slice(index).startsWith('if')) { + index += 'if'.length; + skipWhitespace(); + const condition = readBalanced('(', ')').trim(); + skipWhitespace(); + const consequentBody = readBalanced('{', '}'); + skipWhitespace(); + let alternate = []; + if (body.slice(index).startsWith('else')) { + index += 'else'.length; + skipWhitespace(); + alternate = parseStatements(readBalanced('{', '}'), params); + } + statements.push({ + type: 'IfStatement', + condition: parseExpression(condition, params), + consequent: parseStatements(consequentBody, params), + alternate, + }); + continue; + } + fail(65, 'pcd_parse_error:unsupported_statement'); + } + return statements; +} + +function collectReturns(statements, values = []) { + for (const statement of statements) { + if (statement.type === 'ReturnStatement') { + values.push(statement.argument); + } + if (statement.type === 'IfStatement') { + collectReturns(statement.consequent, values); + collectReturns(statement.alternate, values); + } + } + return values; +} + +function countBranches(statements) { + return statements.reduce((count, statement) => { + if (statement.type !== 'IfStatement') return count; + return count + 1 + countBranches(statement.consequent) + countBranches(statement.alternate); + }, 0); +} + function parsePcd(source) { if (source.length === 0 || source.trim().length === 0) { fail(65, 'pcd_empty'); @@ -202,34 +414,50 @@ function parsePcd(source) { } fail(65, 'pcd_parse_error:missing_pc_block'); } - const [, pcName, pcBody] = pcMatch; - const fnMatch = pcBody.match(/\bfn\s+([A-Za-z_][A-Za-z0-9_]*)\s*\(([^)]*)\)\s*\{([\s\S]*)\}\s*$/m); + const pcStart = stripped.search(/\bPC\s+[A-Za-z_][A-Za-z0-9_]*\s*\{/m); + const pcOpen = stripped.indexOf('{', pcStart); + const pcClose = findMatchingBrace(stripped, pcOpen); + if (pcClose === -1 || stripped.slice(pcClose + 1).trim().length > 0) { + fail(65, 'pcd_parse_error:malformed_pc_block'); + } + const pcName = pcMatch[1]; + const pcBody = stripped.slice(pcOpen + 1, pcClose); + const fnMatch = pcBody.match(/\bfn\s+([A-Za-z_][A-Za-z0-9_]*)\s*\(([^)]*)\)\s*\{/m); if (!fnMatch) { fail(65, 'pcd_parse_error:missing_fn_block'); } - const [, fnName, paramsRaw, fnBody] = fnMatch; + const fnStart = fnMatch.index; + const fnOpen = pcBody.indexOf('{', fnStart); + const fnClose = findMatchingBrace(pcBody, fnOpen); + if (fnClose === -1 || pcBody.slice(fnClose + 1).trim().length > 0) { + fail(65, 'pcd_parse_error:malformed_fn_block'); + } + const [, fnName, paramsRaw] = fnMatch; + const fnBody = pcBody.slice(fnOpen + 1, fnClose); const params = paramsRaw .split(',') .map((param) => param.trim()) .filter(Boolean); - const returns = [...fnBody.matchAll(/\breturn\s+(-?\d+)\s*;/g)].map((match) => Number(match[1])); + if (params.length > 1) { + fail(65, 'pcd_parse_error:too_many_params_beta8'); + } + if (params.some((param) => !/^[A-Za-z_][A-Za-z0-9_]*$/.test(param))) { + fail(65, 'pcd_parse_error:invalid_param'); + } + const body = parseStatements(fnBody, params); + const returns = collectReturns(body); if (returns.length === 0) { fail(65, 'pcd_parse_error:missing_return'); } - const unsupported = fnBody - .replace(/\bif\s*\([^)]*\)\s*\{/g, '') - .replace(/\breturn\s+-?\d+\s*;/g, '') - .replace(/[{}\s;]/g, ''); - if (unsupported.length > 0) { - fail(65, 'pcd_parse_error:unsupported_tokens'); - } return { schemaVersion: 'brik64.cli_ast.v1', pcName, fnName, params, - returnValues: returns, - branchCount: (fnBody.match(/\bif\s*\(/g) || []).length, + body, + returnValues: returns.map((expression) => (expression.type === 'NumberLiteral' ? expression.value : null)), + branchCount: countBranches(body), + expressionDialect: 'brik64.cli_expr.v1', }; } @@ -443,7 +671,7 @@ function login(args = []) { const parsed = parseArgs(args, { '--token-env': 'value' }); const envName = parsed['--token-env']; if (!envName) { - fail(64, 'login_requires_token_env_for_beta7'); + fail(64, 'login_requires_token_env_for_beta8'); } const token = process.env[envName]; if (!token) { @@ -507,27 +735,176 @@ function encodedAst(ast) { return JSON.stringify(ast); } +function renderExpression(expression, target) { + if (expression.type === 'NumberLiteral') return String(expression.value); + if (expression.type === 'Identifier') return expression.name; + if (expression.type === 'UnaryExpression') return `(-${renderExpression(expression.argument, target)})`; + if (expression.type === 'BinaryExpression') { + const left = renderExpression(expression.left, target); + const right = renderExpression(expression.right, target); + let operator = expression.operator; + if (target === 'ts' && operator === '==') operator = '==='; + if (target === 'ts' && operator === '!=') operator = '!=='; + if (target === 'python' && operator === '&&') operator = 'and'; + if (target === 'python' && operator === '||') operator = 'or'; + return `(${left} ${operator} ${right})`; + } + fail(70, 'internal_codegen_error:unknown_expression'); +} + +function renderStatements(statements, target, indentLevel) { + const unit = target === 'python' ? ' ' : ' '; + const indent = unit.repeat(indentLevel); + const lines = []; + for (const statement of statements) { + if (statement.type === 'ReturnStatement') { + lines.push(`${indent}return ${renderExpression(statement.argument, target)}${target === 'python' ? '' : ';'}`); + continue; + } + if (statement.type === 'IfStatement') { + const condition = renderExpression(statement.condition, target); + if (target === 'python') { + lines.push(`${indent}if ${condition}:`); + lines.push(...renderStatements(statement.consequent, target, indentLevel + 1)); + if (statement.alternate.length > 0) { + lines.push(`${indent}else:`); + lines.push(...renderStatements(statement.alternate, target, indentLevel + 1)); + } + } else { + lines.push(`${indent}if ${condition} {`); + lines.push(...renderStatements(statement.consequent, target, indentLevel + 1)); + if (statement.alternate.length > 0) { + lines.push(`${indent}} else {`); + lines.push(...renderStatements(statement.alternate, target, indentLevel + 1)); + } + lines.push(`${indent}}`); + } + continue; + } + fail(70, 'internal_codegen_error:unknown_statement'); + } + return lines; +} + +function evaluateExpression(expression, env) { + if (expression.type === 'NumberLiteral') return expression.value; + if (expression.type === 'Identifier') return env[expression.name] ?? 0; + if (expression.type === 'UnaryExpression') return -evaluateExpression(expression.argument, env); + if (expression.type === 'BinaryExpression') { + const left = evaluateExpression(expression.left, env); + if (expression.operator === '&&') return Boolean(left) && Boolean(evaluateExpression(expression.right, env)); + if (expression.operator === '||') return Boolean(left) || Boolean(evaluateExpression(expression.right, env)); + const right = evaluateExpression(expression.right, env); + if (expression.operator === '+') return left + right; + if (expression.operator === '-') return left - right; + if (expression.operator === '*') return left * right; + if (expression.operator === '/') return Math.trunc(left / right); + if (expression.operator === '%') return left % right; + if (expression.operator === '==') return left === right; + if (expression.operator === '!=') return left !== right; + if (expression.operator === '>') return left > right; + if (expression.operator === '<') return left < right; + if (expression.operator === '>=') return left >= right; + if (expression.operator === '<=') return left <= right; + } + fail(70, 'internal_eval_error:unknown_expression'); +} + +function evaluateStatements(statements, env) { + for (const statement of statements) { + if (statement.type === 'ReturnStatement') { + return evaluateExpression(statement.argument, env); + } + if (statement.type === 'IfStatement') { + if (evaluateExpression(statement.condition, env)) { + const consequent = evaluateStatements(statement.consequent, env); + if (consequent !== undefined) return consequent; + } else { + const alternate = evaluateStatements(statement.alternate, env); + if (alternate !== undefined) return alternate; + } + } + } + return undefined; +} + +function collectConditionValues(expression, values = new Set([0, 1, 2, 10])) { + if (expression.type === 'NumberLiteral') { + values.add(expression.value); + values.add(expression.value + 1); + values.add(expression.value - 1); + } + if (expression.type === 'UnaryExpression') collectConditionValues(expression.argument, values); + if (expression.type === 'BinaryExpression') { + collectConditionValues(expression.left, values); + collectConditionValues(expression.right, values); + } + return values; +} + +function collectStatementValues(statements, values = new Set([0, 1, 2, 10])) { + for (const statement of statements) { + if (statement.type === 'IfStatement') { + collectConditionValues(statement.condition, values); + collectStatementValues(statement.consequent, values); + collectStatementValues(statement.alternate, values); + } + } + return values; +} + +function generatedCases(ast) { + const param = ast.params[0] || 'input'; + const inputs = [...collectStatementValues(ast.body)] + .filter((value) => Number.isInteger(value) && Math.abs(value) < 100000) + .slice(0, 12); + return inputs + .map((input) => ({ input, expected: evaluateStatements(ast.body, { [param]: input }) })) + .filter((testCase) => testCase.expected !== undefined) + .slice(0, 8); +} + +function ensureExecutable(ast) { + const cases = generatedCases(ast); + if (cases.length === 0) { + fail(65, 'pcd_parse_error:no_executable_return_path'); + } + return cases; +} + function targetSpec(target, ast) { const astJson = encodedAst(ast); + const cases = ensureExecutable(ast); + const param = ast.params[0] || 'input'; + const tsStatements = renderStatements(ast.body, 'ts', 1); + const rustStatements = renderStatements(ast.body, 'rust', 1); + const pythonStatements = renderStatements(ast.body, 'python', 1); const specs = { ts: { - program: 'program.ts', - test: 'program.test.ts', + program: 'program.mjs', + test: 'program.test.mjs', code: (hash) => [ - '// BRIK64 beta7 functional emission candidate', + '// BRIK64 beta8 functional emission candidate', '// claim: local candidate evidence only', `export const pcdSha256 = "${hash}";`, - `export const pcdAst = ${astJson} as const;`, - 'export function run(input = 0): string {', - ' return `brik:${pcdAst.pcName}:${pcdAst.fnName}:${pcdAst.returnValues.join(",")}:${input}:${pcdSha256}`;', + `export const pcdAst = ${astJson};`, + `export function run(${param} = 0) {`, + ...tsStatements, + ' throw new Error("pcd execution reached non-returning path");', '}', '', ].join('\n'), testCode: (hash) => [ - 'import { pcdAst, pcdSha256, run } from "./program";', + 'import { pcdSha256, run } from "./program.mjs";', '', 'if (pcdSha256 !== "' + hash + '") throw new Error("pcd hash mismatch");', - 'if (!run().includes(pcdAst.pcName)) throw new Error("run mismatch");', + `const cases = ${JSON.stringify(cases)};`, + 'for (const testCase of cases) {', + ' const actual = run(testCase.input);', + ' if (actual !== testCase.expected) {', + ' throw new Error(`case ${testCase.input} expected ${testCase.expected} got ${actual}`);', + ' }', + '}', 'console.log("brik64 generated ts test: PASS");', '', ].join('\n'), @@ -536,25 +913,28 @@ function targetSpec(target, ast) { program: 'program.rs', test: 'program_test.rs', code: (hash) => [ - '// BRIK64 beta7 functional emission candidate', + '// BRIK64 beta8 functional emission candidate', '// claim: local candidate evidence only', `pub const PCD_SHA256: &str = "${hash}";`, `pub const PCD_AST_JSON: &str = r#"${astJson}"#;`, - 'pub fn run() -> String {', - ' format!("brik:{}:{}", PCD_AST_JSON, PCD_SHA256)', + `pub fn run(${param}: i64) -> i64 {`, + ...rustStatements.map((line) => line.replace(/^ /, ' ')), + ' panic!("pcd execution reached non-returning path");', '}', '', ].join('\n'), testCode: (hash) => [ `const PCD_SHA256: &str = "${hash}";`, `const PCD_AST_JSON: &str = r#"${astJson}"#;`, - 'fn run() -> String {', - ' format!("brik:{}:{}", PCD_AST_JSON, PCD_SHA256)', + `fn run(${param}: i64) -> i64 {`, + ...rustStatements.map((line) => line.replace(/^ /, ' ')), + ' panic!("pcd execution reached non-returning path");', '}', '', 'fn main() {', ` assert_eq!(PCD_SHA256, "${hash}");`, - ' assert!(run().contains(PCD_AST_JSON));', + ' assert!(PCD_AST_JSON.contains("body"));', + ...cases.map((testCase) => ` assert_eq!(run(${testCase.input}), ${testCase.expected});`), ' println!("brik64 generated rust test: PASS");', '}', '', @@ -564,20 +944,24 @@ function targetSpec(target, ast) { program: 'program.py', test: 'test_program.py', code: (hash) => [ - '# BRIK64 beta7 functional emission candidate', + '# BRIK64 beta8 functional emission candidate', '# claim: local candidate evidence only', `PCD_SHA256 = "${hash}"`, - `PCD_AST = ${astJson}`, + `PCD_AST_JSON = ${JSON.stringify(JSON.stringify(ast))}`, '', - 'def run(input=0):', - ' return f"brik:{PCD_AST[\'pcName\']}:{PCD_AST[\'fnName\']}:{PCD_AST[\'returnValues\']}:{input}:{PCD_SHA256}"', + `def run(${param}=0):`, + ...pythonStatements, + ' raise RuntimeError("pcd execution reached non-returning path")', '', ].join('\n'), testCode: (hash) => [ - 'from program import PCD_AST, PCD_SHA256, run', + 'from program import PCD_SHA256, run', '', `assert PCD_SHA256 == "${hash}"`, - 'assert PCD_AST["pcName"] in run()', + `cases = ${JSON.stringify(cases)}`, + 'for case in cases:', + ' actual = run(case["input"])', + ' assert actual == case["expected"], f"case {case[\'input\']} expected {case[\'expected\']} got {actual}"', 'print("brik64 generated python test: PASS")', '', ].join('\n'), @@ -652,7 +1036,7 @@ function emit(file, args = []) { if (options.tests) process.stdout.write(`tests=${path.relative(process.cwd(), testPath)}\n`); return; } - process.stdout.write('// BRIK64 beta7 functional emission candidate\n'); + process.stdout.write('// BRIK64 beta8 functional emission candidate\n'); process.stdout.write('// claim: local candidate evidence only\n'); process.stdout.write(`// pcd_sha256=${cert.semantic_pcd_sha256}\n`); process.stdout.write(`// ast_sha256=${cert.ast_sha256}\n`); @@ -666,7 +1050,7 @@ function verify(file, args = []) { } requireLocalOrEntitled(parsed); if (parsed['--cloud']) { - fail(69, 'managed_verify_endpoint_unavailable_beta7'); + fail(69, 'managed_verify_endpoint_unavailable_beta8'); } const source = readFileRequired(file); const ast = parsePcd(source); @@ -714,7 +1098,7 @@ function polymerize(rawArgs = []) { } requireLocalOrEntitled(parsed); if (parsed['--cloud']) { - fail(69, 'managed_polymerize_endpoint_unavailable_beta7'); + fail(69, 'managed_polymerize_endpoint_unavailable_beta8'); } const files = parsed._; if (files.length === 0) { @@ -743,7 +1127,7 @@ function polymerize(rawArgs = []) { const polymerName = 'brik64_polymer'; const content = [ '// brik64.pcd_file.v1', - '// generated_by: brik64-cli beta7 polymerize local', + '// generated_by: brik64-cli beta8 polymerize local', '// claim_boundary: local_candidate_only', ...sourceLines, '', @@ -781,7 +1165,7 @@ function migrate(file, args = []) { const source = readFileRequired(file); const oldHash = sha256(source); let migrated = source; - let syntax = 'beta7'; + let syntax = 'beta8'; if (/\bcircuit\s+[A-Za-z_][A-Za-z0-9_]*\s*\{/m.test(source)) { migrated = migrated.replace(/\bcircuit\s+([A-Za-z_][A-Za-z0-9_]*)\s*\{/m, 'PC $1 {'); syntax = 'legacy_circuit'; @@ -799,7 +1183,7 @@ function migrate(file, args = []) { } outPath = inputPath; } else { - outPath = workspacePath(parsed['--out'] || `${file.replace(/\.pcd$/, '')}.beta7.pcd`); + outPath = workspacePath(parsed['--out'] || `${file.replace(/\.pcd$/, '')}.beta8.pcd`); if (fs.existsSync(outPath)) { fail(73, `output_exists:${path.relative(process.cwd(), outPath)}`); } diff --git a/tests/smoke.sh b/tests/smoke.sh index ec6f91b7..a2ecdec6 100755 --- a/tests/smoke.sh +++ b/tests/smoke.sh @@ -9,7 +9,7 @@ cleanup() { rm -rf "$tmpdir"; } trap cleanup EXIT export BRIK64_CONFIG_HOME="$tmpdir/config" -node "$BRIK" --version | grep -q "BRIK64 CLI 0.1.0-beta.7" +node "$BRIK" --version | grep -q "BRIK64 CLI 0.1.0-beta.8" node "$BRIK" --version | node -e 'let s=""; process.stdin.on("data", (d) => { s += d; }); process.stdin.on("end", () => { s = s.replace(/\x1b\[[0-9;]*m/g, ""); if (!s.includes("█████████████") || !s.includes("▒▒▒▒▒▒▒▒▒▒▒▒")) process.exit(1); });' node "$BRIK" --help | grep -q "status=public_beta" node "$BRIK" --help | grep -q "polymerize " @@ -23,10 +23,15 @@ node "$BRIK" engine status | grep -q '"runtimeMode": "portable_bir_bundle"' node "$BRIK" engine status | grep -q '"nativeExecutableIncluded": false' if [ "${BRIK64_RELEASE_GATES:-0}" = "1" ]; then - node "$ROOT_DIR/scripts/beta7-feature-parity-gate.js" | grep -q "decision=PASS_BETA7_FEATURE_PARITY_GATE" - node "$ROOT_DIR/scripts/build-beta7-package.js" | grep -q "PASS_BETA7_PACKAGE_BUILT" - node "$ROOT_DIR/scripts/beta7-package-smoke.js" | grep -q "decision=PASS_BETA7_LOCAL_PACKAGE_SMOKE" - node -e 'const fs=require("fs"); const r=JSON.parse(fs.readFileSync("evidence/beta7-package/package.manifest.json","utf8")); if (r.releaseEligible !== false || !r.requiredPublicReleaseGates.includes("curl_gcp_installer_beta7")) process.exit(1)' + beta8_functionality_out="$(bash "$ROOT_DIR/scripts/beta8-compiler-functionality-gate.sh")" + grep -q "PASS_BRIK64_CLI_BETA8_COMPILER_FUNCTIONALITY" <<<"$beta8_functionality_out" + beta8_adversarial_out="$(bash "$ROOT_DIR/scripts/beta8-adversarial-gate.sh")" + grep -q "PASS_BRIK64_CLI_BETA8_ADVERSARIAL" <<<"$beta8_adversarial_out" + beta8_package_out="$(bash "$ROOT_DIR/scripts/build-beta8-package.sh")" + grep -q "PASS_BRIK64_CLI_BETA8_PACKAGE_BUILT" <<<"$beta8_package_out" + beta8_package_smoke_out="$(bash "$ROOT_DIR/scripts/beta8-package-smoke.sh")" + grep -q "decision=PASS_BRIK64_CLI_BETA8_LOCAL_PACKAGE_SMOKE" <<<"$beta8_package_smoke_out" + node -e 'const fs=require("fs"); const r=JSON.parse(fs.readFileSync("evidence/beta8-package/package.manifest.json","utf8")); if (r.releaseEligible !== false || !r.requiredPublicReleaseGates.includes("curl_gcp_installer_beta8")) process.exit(1)' node "$ROOT_DIR/scripts/release-manifest-validate.js" --allow-dirty | grep -q "decision=PASS_RELEASE_MANIFEST_VALIDATE" fi @@ -98,8 +103,8 @@ for target in ts rust python; do grep -q "tests=" "/tmp/brik-emit-$target.out" done -test -f "$tmpdir/out-ts/program.ts" -test -f "$tmpdir/out-ts/program.test.ts" +test -f "$tmpdir/out-ts/program.mjs" +test -f "$tmpdir/out-ts/program.test.mjs" test -f "$tmpdir/out-rust/program.rs" test -f "$tmpdir/out-rust/program_test.rs" test -f "$tmpdir/out-python/program.py" @@ -116,7 +121,7 @@ if node "$BRIK" emit program.pcd --target ts --out ../escaped-out --tests >/tmp/ exit 1 fi grep -q "path_outside_workspace" /tmp/brik-out-traversal.err -test ! -e "$tmpdir/escaped-out/program.ts" +test ! -e "$tmpdir/escaped-out/program.mjs" mkdir readonly chmod 500 readonly @@ -134,7 +139,7 @@ fi cp program.pcd stale.pcd node "$BRIK" certify stale.pcd -printf '\n return 3;\n' >> stale.pcd +perl -0pi -e 's/return 2;/return 3;/' stale.pcd if node "$BRIK" emit stale.pcd >/tmp/brik-stale.out 2>/tmp/brik-stale.err; then echo "stale certificate should fail closed" >&2 exit 1 @@ -182,7 +187,7 @@ PC variant { PCD node "$BRIK" certify variant.pcd node "$BRIK" emit variant.pcd --target ts --out out-variant --tests >/tmp/brik-emit-variant.out -if cmp -s out-ts/program.ts out-variant/program.ts; then +if cmp -s out-ts/program.mjs out-variant/program.mjs; then echo "different valid PCDs should emit different outputs" >&2 exit 1 fi