feat: stabilize WOR-105 legacy WorkBundle

.github/workflows/ci.yml

@@ -24,18 +24,15 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v5
+        with:
+          # The frozen native-transition oracle verifies a historical kernel tree.
+          fetch-depth: 0
 
       - name: Set up uv
         uses: astral-sh/setup-uv@v9.0.0
         with:
           python-version: "3.13"
           enable-cache: false
 
-      - name: Run full tests
-        run: >-
-          uvx --python 3.13 --from pytest==9.1.1
-          --with pyyaml==6.0.3 --with sqlite-vec==0.1.9
-          --with fastembed==0.8.0 pytest -q
-
-      - name: Validate skill packages
-        run: bin/work-bundle-skill validate
+      - name: Run canonical release gate
+        run: bin/work-bundle-ci

bin/work-bundle-ci

@@ -0,0 +1,127 @@
+#!/usr/bin/env python3
+from __future__ import annotations
+
+import os
+import subprocess
+import sys
+from collections.abc import Callable, Sequence
+from pathlib import Path
+from typing import Any
+
+
+PYTHON_VERSION = "3.13"
+PINNED_PACKAGES = (
+    "pytest==9.1.1",
+    "pyyaml==6.0.3",
+    "sqlite-vec==0.1.9",
+    "fastembed==0.8.0",
+)
+
+
+def _repo_root() -> Path:
+    return Path(__file__).resolve().parents[1]
+
+
+def _relative_test_path(repo_root: Path, path: Path) -> str:
+    candidate = path if path.is_absolute() else repo_root / path
+    return candidate.resolve().relative_to(repo_root.resolve()).as_posix()
+
+
+def run_release_gate(
+    repo_root: Path,
+    *,
+    python_executable: str,
+    test_files: Sequence[Path] | None = None,
+    run_command: Callable[..., subprocess.CompletedProcess[str]] = subprocess.run,
+    emit: Callable[[str], Any] = print,
+) -> dict[str, object]:
+    repo_root = repo_root.resolve()
+    modules = sorted(
+        _relative_test_path(repo_root, path)
+        for path in (test_files if test_files is not None else (repo_root / "tests").glob("test_*.py"))
+    )
+    failed_modules: list[str] = []
+    environment = {**os.environ, "PYTHONDONTWRITEBYTECODE": "1"}
+    emit(
+        "WB_CI_RUNTIME "
+        f"python={PYTHON_VERSION} "
+        + " ".join(package.replace("==", "=") for package in PINNED_PACKAGES)
+    )
+
+    for module in modules:
+        completed = run_command(
+            [python_executable, "-m", "pytest", "-q", module],
+            cwd=repo_root,
+            env=environment,
+            text=True,
+            capture_output=True,
+            check=False,
+        )
+        status = "PASS" if completed.returncode == 0 else "FAIL"
+        emit(f"WB_CI_MODULE {status} {module}")
+        if completed.returncode != 0:
+            failed_modules.append(module)
+            emit(f"WB_CI_FAILURE_BEGIN {module}")
+            detail = (completed.stdout + completed.stderr).rstrip()
+            if detail:
+                emit(detail)
+            emit(f"WB_CI_FAILURE_END {module}")
+
+    skill_command = [str(repo_root / "bin" / "work-bundle-skill"), "validate"]
+    skill_result = run_command(
+        skill_command,
+        cwd=repo_root,
+        env=environment,
+        text=True,
+        capture_output=True,
+        check=False,
+    )
+    skill_status = "passed" if skill_result.returncode == 0 else "failed"
+    emit(f"WB_CI_SKILLS {'PASS' if skill_result.returncode == 0 else 'FAIL'}")
+    if skill_result.returncode != 0:
+        emit("WB_CI_FAILURE_BEGIN skills")
+        detail = (skill_result.stdout + skill_result.stderr).rstrip()
+        if detail:
+            emit(detail)
+        emit("WB_CI_FAILURE_END skills")
+
+    passed_modules = len(modules) - len(failed_modules)
+    exit_code = 1 if failed_modules or skill_result.returncode != 0 else 0
+    emit(
+        "WB_CI_SUMMARY "
+        f"modules={len(modules)} passed={passed_modules} failed={len(failed_modules)} "
+        f"skills={skill_status}"
+    )
+    emit(f"WB_CI_RESULT {'PASS' if exit_code == 0 else 'FAIL'}")
+    return {
+        "exit_code": exit_code,
+        "modules": modules,
+        "failed_modules": failed_modules,
+        "skills": skill_status,
+    }
+
+
+def _bootstrap_command() -> list[str]:
+    command = ["uvx", "--python", PYTHON_VERSION, "--from", PINNED_PACKAGES[0]]
+    for package in PINNED_PACKAGES[1:]:
+        command.extend(["--with", package])
+    command.extend(["python", str(Path(__file__).resolve()), "--internal"])
+    return command
+
+
+def main(argv: Sequence[str] | None = None) -> int:
+    arguments = list(sys.argv[1:] if argv is None else argv)
+    repo_root = _repo_root()
+    if arguments == ["--internal"]:
+        return int(
+            run_release_gate(repo_root, python_executable=sys.executable)["exit_code"]
+        )
+    if arguments:
+        print("usage: work-bundle-ci", file=sys.stderr)
+        return 2
+    completed = subprocess.run(_bootstrap_command(), cwd=repo_root, check=False)
+    return completed.returncode
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

evals/wor105/adversarial-result-v1.schema.json

@@ -0,0 +1,31 @@
+{
+  "$schema":"https://json-schema.org/draft/2020-12/schema","$id":"urn:work-bundle:wor105:adversarial-result:v1","x-enforcement-mode":"bootstrap_policy","x-bootstrap-profile-sha256":"8d38967b95406362fe0db327309f53fca1b1b1906dbdfbdad8c30c13e03d87ad",
+  "$defs":{"sha":{"type":"string","pattern":"^[0-9a-f]{64}$"},"oid":{"type":"string","pattern":"^[0-9a-f]{40}$"},"id":{"type":"string","minLength":1},"ids":{"type":"array","items":{"$ref":"#/$defs/id"}},"text":{"type":"string","minLength":1}},
+  "type":"object","additionalProperties":false,"required":["fixture_id","fixture_sha256","expected_decision","actual_decision","product_tree","specification_sha256","plan_sha256","task_identity","evaluation_id","component_digests","raw_evidence_sha256","adjudication_sha256","event_ids","proof","passed"],
+  "properties":{"fixture_id":{"type":"string","pattern":"^ADV-(0[1-9]|1[0-2])$"},"fixture_sha256":{"$ref":"#/$defs/sha"},"expected_decision":{"$ref":"#/$defs/text"},"actual_decision":{"$ref":"#/$defs/text"},"product_tree":{"$ref":"#/$defs/oid"},"specification_sha256":{"$ref":"#/$defs/sha"},"plan_sha256":{"$ref":"#/$defs/sha"},"task_identity":{"$ref":"#/$defs/id"},"evaluation_id":{"$ref":"#/$defs/id"},"component_digests":{"type":"object","additionalProperties":false,"required":["profile","fixtures","runner","verifier","result_schema","semantic_schema","instructions","evidence_capabilities"],"properties":{"profile":{"$ref":"#/$defs/sha"},"fixtures":{"$ref":"#/$defs/sha"},"runner":{"$ref":"#/$defs/sha"},"verifier":{"$ref":"#/$defs/sha"},"result_schema":{"$ref":"#/$defs/sha"},"semantic_schema":{"$ref":"#/$defs/sha"},"instructions":{"$ref":"#/$defs/sha"},"evidence_capabilities":{"$ref":"#/$defs/sha"}}},"raw_evidence_sha256":{"$ref":"#/$defs/sha"},"adjudication_sha256":{"$ref":"#/$defs/sha"},"event_ids":{"$ref":"#/$defs/ids"},"passed":{"const":true},
+    "proof":{"type":"object","additionalProperties":false,"properties":{
+      "source_sentinel_before_sha256":{"$ref":"#/$defs/sha"},"source_sentinel_after_sha256":{"$ref":"#/$defs/sha"},"control_sentinel_before_sha256":{"$ref":"#/$defs/sha"},"control_sentinel_after_sha256":{"$ref":"#/$defs/sha"},"denial_classes":{"type":"array","minItems":5,"maxItems":5,"items":{"const":"permission_denied"}},"allowed_read_output_sha256":{"$ref":"#/$defs/sha"},"validator_output_sha256":{"$ref":"#/$defs/sha"},"event_ids":{"type":"array","minItems":2,"maxItems":2,"uniqueItems":true,"items":{"$ref":"#/$defs/id"}},
+      "original_evidence_sha256":{"$ref":"#/$defs/sha"},"expansion_event_ids":{"type":"array","minItems":2,"maxItems":2,"items":{"$ref":"#/$defs/id"}},"binding_state":{"const":"repair_owned"},"reslice_artifact_sha256":{"$ref":"#/$defs/sha"},"return_owner":{"const":"plan_owner"},
+      "rejected_record_sha256":{"$ref":"#/$defs/sha"},"canonical_finding_sha256":{"$ref":"#/$defs/sha"},"validation_error_code":{"enum":["finding_route_mismatch","blocking_basis_required","placeholder_remote_forbidden"]},"advisory_id":{"$ref":"#/$defs/id"},"stage_state_before_sha256":{"$ref":"#/$defs/sha"},"stage_state_after_sha256":{"$ref":"#/$defs/sha"},
+      "old_digest":{"$ref":"#/$defs/sha"},"new_digest":{"$ref":"#/$defs/sha"},"stale_run_id":{"$ref":"#/$defs/id"},"invalidation_id":{"$ref":"#/$defs/id"},"raw_response_before_sha256":{"$ref":"#/$defs/sha"},"raw_response_after_sha256":{"$ref":"#/$defs/sha"},"raw_trace_before_sha256":{"$ref":"#/$defs/sha"},"raw_trace_after_sha256":{"$ref":"#/$defs/sha"},
+      "product_tree_before":{"$ref":"#/$defs/oid"},"product_tree_after":{"$ref":"#/$defs/oid"},"observation_before_sha256":{"$ref":"#/$defs/sha"},"observation_after_sha256":{"$ref":"#/$defs/sha"},"packaging_before":{"$ref":"#/$defs/oid"},"packaging_after":{"$ref":"#/$defs/oid"},"valid":{"const":true},
+      "review_id":{"$ref":"#/$defs/id"},"target_before_sha256":{"$ref":"#/$defs/sha"},"target_after_sha256":{"$ref":"#/$defs/sha"},"staleness_reason":{"const":"target_identity_changed"},"countable_stage_reviews":{"const":0},"request_ids":{"type":"array","minItems":2,"maxItems":2,"uniqueItems":true,"items":{"$ref":"#/$defs/id"}},"subprocess_invocation_count":{"const":1},"observation_id":{"$ref":"#/$defs/id"},"reuse_of":{"$ref":"#/$defs/id"},
+      "before_snapshot_sha256":{"$ref":"#/$defs/sha"},"after_snapshot_sha256":{"$ref":"#/$defs/sha"},"denial_event_ids":{"type":"array","minItems":2,"items":{"$ref":"#/$defs/id"}},"original_owner":{"$ref":"#/$defs/id"},"original_reason":{"$ref":"#/$defs/text"},"validation_error_codes":{"type":"array","minItems":4,"maxItems":4,"items":{"const":"reviewer_not_independent"}},"rejected_review_ids":{"type":"array","minItems":4,"maxItems":4,"uniqueItems":true,"items":{"$ref":"#/$defs/id"}},
+      "public_contract_test_output_sha256":{"$ref":"#/$defs/sha"},"byte_oracle_failure_sha256":{"$ref":"#/$defs/sha"},"routed_finding_sha256":{"$ref":"#/$defs/sha"},"product_revision_before":{"$ref":"#/$defs/oid"},"product_revision_after":{"$ref":"#/$defs/oid"},"member_snapshot_sha256":{"$ref":"#/$defs/sha"},"checkout_absent":{"const":true},"origin_absent":{"const":true},"first_apply_state_sha256":{"$ref":"#/$defs/sha"},"replay_state_sha256":{"$ref":"#/$defs/sha"}
+    }}
+  },
+  "allOf":[
+    {"if":{"properties":{"fixture_id":{"const":"ADV-01"}}},"then":{"properties":{"expected_decision":{"const":"deny_mutation_and_protected_reads_allow_bounded_evidence"},"actual_decision":{"const":"deny_mutation_and_protected_reads_allow_bounded_evidence"},"proof":{"required":["source_sentinel_before_sha256","source_sentinel_after_sha256","control_sentinel_before_sha256","control_sentinel_after_sha256","denial_classes","allowed_read_output_sha256","validator_output_sha256","event_ids"],"propertyNames":{"enum":["source_sentinel_before_sha256","source_sentinel_after_sha256","control_sentinel_before_sha256","control_sentinel_after_sha256","denial_classes","allowed_read_output_sha256","validator_output_sha256","event_ids"]}}}}},
+    {"if":{"properties":{"fixture_id":{"const":"ADV-02"}}},"then":{"properties":{"expected_decision":{"const":"pause_and_reslice_after_second_expansion"},"actual_decision":{"const":"pause_and_reslice_after_second_expansion"},"proof":{"required":["original_evidence_sha256","expansion_event_ids","binding_state","reslice_artifact_sha256","return_owner"],"propertyNames":{"enum":["original_evidence_sha256","expansion_event_ids","binding_state","reslice_artifact_sha256","return_owner"]}}}}},
+    {"if":{"properties":{"fixture_id":{"const":"ADV-03"}}},"then":{"properties":{"expected_decision":{"const":"reject_and_route_allocation_gap_to_plan_reslice"},"actual_decision":{"const":"reject_and_route_allocation_gap_to_plan_reslice"},"proof":{"required":["rejected_record_sha256","canonical_finding_sha256","validation_error_code"],"properties":{"validation_error_code":{"const":"finding_route_mismatch"}},"propertyNames":{"enum":["rejected_record_sha256","canonical_finding_sha256","validation_error_code"]}}}}},
+    {"if":{"properties":{"fixture_id":{"const":"ADV-04"}}},"then":{"properties":{"expected_decision":{"const":"reject_blocking_and_record_nonblocking_advisory"},"actual_decision":{"const":"reject_blocking_and_record_nonblocking_advisory"},"proof":{"required":["validation_error_code","advisory_id","stage_state_before_sha256","stage_state_after_sha256"],"properties":{"validation_error_code":{"const":"blocking_basis_required"}},"propertyNames":{"enum":["validation_error_code","advisory_id","stage_state_before_sha256","stage_state_after_sha256"]}}}}},
+    {"if":{"properties":{"fixture_id":{"const":"ADV-05"}}},"then":{"properties":{"expected_decision":{"const":"stale_run_append_invalidation_preserve_raw_evidence"},"actual_decision":{"const":"stale_run_append_invalidation_preserve_raw_evidence"},"proof":{"required":["old_digest","new_digest","stale_run_id","invalidation_id","raw_response_before_sha256","raw_response_after_sha256","raw_trace_before_sha256","raw_trace_after_sha256"],"propertyNames":{"enum":["old_digest","new_digest","stale_run_id","invalidation_id","raw_response_before_sha256","raw_response_after_sha256","raw_trace_before_sha256","raw_trace_after_sha256"]}}}}},
+    {"if":{"properties":{"fixture_id":{"const":"ADV-06"}}},"then":{"properties":{"expected_decision":{"const":"preserve_product_observation_update_packaging_only"},"actual_decision":{"const":"preserve_product_observation_update_packaging_only"},"proof":{"required":["product_tree_before","product_tree_after","observation_before_sha256","observation_after_sha256","packaging_before","packaging_after","valid"],"propertyNames":{"enum":["product_tree_before","product_tree_after","observation_before_sha256","observation_after_sha256","packaging_before","packaging_after","valid"]}}}}},
+    {"if":{"properties":{"fixture_id":{"const":"ADV-07"}}},"then":{"properties":{"expected_decision":{"const":"mark_review_stale_and_remove_stage_credit"},"actual_decision":{"const":"mark_review_stale_and_remove_stage_credit"},"proof":{"required":["review_id","target_before_sha256","target_after_sha256","staleness_reason","countable_stage_reviews"],"propertyNames":{"enum":["review_id","target_before_sha256","target_after_sha256","staleness_reason","countable_stage_reviews"]}}}}},
+    {"if":{"properties":{"fixture_id":{"const":"ADV-08"}}},"then":{"properties":{"expected_decision":{"const":"execute_once_and_reuse_observation"},"actual_decision":{"const":"execute_once_and_reuse_observation"},"proof":{"required":["request_ids","subprocess_invocation_count","observation_id","reuse_of"],"propertyNames":{"enum":["request_ids","subprocess_invocation_count","observation_id","reuse_of"]}}}}},
+    {"if":{"properties":{"fixture_id":{"const":"ADV-09"}}},"then":{"properties":{"expected_decision":{"const":"deny_release_preserve_owner_reason_history"},"actual_decision":{"const":"deny_release_preserve_owner_reason_history"},"proof":{"required":["before_snapshot_sha256","after_snapshot_sha256","denial_event_ids","original_owner","original_reason"],"propertyNames":{"enum":["before_snapshot_sha256","after_snapshot_sha256","denial_event_ids","original_owner","original_reason"]}}}}},
+    {"if":{"properties":{"fixture_id":{"const":"ADV-10"}}},"then":{"properties":{"expected_decision":{"const":"reject_each_and_require_fresh_reviewer"},"actual_decision":{"const":"reject_each_and_require_fresh_reviewer"},"proof":{"required":["validation_error_codes","rejected_review_ids","countable_stage_reviews"],"propertyNames":{"enum":["validation_error_codes","rejected_review_ids","countable_stage_reviews"]}}}}},
+    {"if":{"properties":{"fixture_id":{"const":"ADV-11"}}},"then":{"properties":{"expected_decision":{"const":"route_validation_oracle_defect_without_product_rollback"},"actual_decision":{"const":"route_validation_oracle_defect_without_product_rollback"},"proof":{"required":["public_contract_test_output_sha256","byte_oracle_failure_sha256","routed_finding_sha256","product_revision_before","product_revision_after"],"propertyNames":{"enum":["public_contract_test_output_sha256","byte_oracle_failure_sha256","routed_finding_sha256","product_revision_before","product_revision_after"]}}}}},
+    {"if":{"properties":{"fixture_id":{"const":"ADV-12"}}},"then":{"properties":{"expected_decision":{"const":"reject_placeholder_apply_deferred_without_checkout_or_origin_and_replay_noop"},"actual_decision":{"const":"reject_placeholder_apply_deferred_without_checkout_or_origin_and_replay_noop"},"proof":{"required":["validation_error_code","member_snapshot_sha256","checkout_absent","origin_absent","first_apply_state_sha256","replay_state_sha256"],"properties":{"validation_error_code":{"const":"placeholder_remote_forbidden"}},"propertyNames":{"enum":["validation_error_code","member_snapshot_sha256","checkout_absent","origin_absent","first_apply_state_sha256","replay_state_sha256"]}}}}}
+  ]
+}