Add governed foreground work to repository flows

Author: bigboateng

.github/tests/test_detached_supervision.py

@@ -435,7 +435,7 @@ def test_one_delivery_context_rematerializes_repository_authority_after_initiali
         self.assertEqual(bound["decision"]["kind"], "PRESCRIBED")
         self.assertEqual(bound["decision"]["transition"]["id"], "plan.create")
 
-    def test_repository_authority_rematerialization_fails_closed_without_verified_config(self) -> None:
+    def test_repository_authority_rematerialization_waits_for_verified_config(self) -> None:
         # control-law: repository-authority-requires-exact-verified-fingerprint
         root = Path(self.work.name) / "unverified"
         root.mkdir()
@@ -446,19 +446,18 @@ def test_repository_authority_rematerialization_fails_closed_without_verified_co
         self._git(root, "add", "README.md")
         self._git(root, "commit", "-m", "fixture")
         before = self.porcelain(root)
-        result = self.run_helper(
+        result = self.helper_json(
             "next", "--repo", root,
             "--objective-id", "unverified-authority",
             "--target-id", "open-or-updated-pr",
             "--delivery", "unverified-authority",
             "--run-id", "flow-unverified-authority",
             "--human", "contract", "--repository-authority",
-            cwd=root, expected=1,
-        )
-        self.assertIn(
-            "repository authority requires current verified configuration evidence",
-            result.stderr,
+            cwd=root,
         )
+        self.assertEqual(result["decision"]["kind"], "CANDIDATE")
+        self.assertEqual(result["decision"]["transition"]["id"], "installation.initialize")
+        self.assertNotIn('"repository-policy"', json.dumps(result))
         self.assertEqual(self.porcelain(root), before)
 
 

boatstack/cmd/boatstack-helper/delegation_command.go

@@ -19,6 +19,10 @@ import (
 	"github.com/operatorstack/boatstack/boatstack/internal/softwaredelivery/surfaces"
 )
 
+var resolveGitHubProviderAuthority = func(ctx context.Context, repository, previewFingerprint string, now time.Time) (protocol.AuthorityReceipt, error) {
+	return effects.NewNativeBoundary().ResolveGitHubProviderAuthority(ctx, repository, previewFingerprint, now)
+}
+
 func runFlowAuthorize(arguments []string) error {
 	flags := flag.NewFlagSet("flow authorize", flag.ContinueOnError)
 	flags.SetOutput(os.Stderr)
@@ -258,7 +262,13 @@ func executeContinuationStep(ctx context.Context, options commandOptions) (surfa
 		if err != nil {
 			return resolved, err
 		}
-		rebound, changed, rebindErr := bindContinuationCandidate(ctx, bound, resolved)
+		rebound, changed, rebindErr := bindTrustedProviderCandidate(ctx, bound, resolved)
+		if rebindErr != nil {
+			return surfaces.Response{}, rebindErr
+		}
+		if !changed {
+			rebound, changed, rebindErr = bindContinuationCandidate(ctx, bound, resolved)
+		}
 		if rebindErr != nil {
 			return surfaces.Response{}, rebindErr
 		}
@@ -335,6 +345,21 @@ func executeContinuationStep(ctx context.Context, options commandOptions) (surfa
 	return applied, nil
 }
 
+func bindTrustedProviderCandidate(ctx context.Context, bound commandOptions, response surfaces.Response) (commandOptions, bool, error) {
+	if bound.transitionID != "" || response.Prescription != nil || response.Decision == nil ||
+		(response.Decision.Kind != supervisor.DecisionFrontier && response.Decision.Kind != supervisor.DecisionCandidate) ||
+		len(response.Decision.Candidates) != 1 || response.Decision.Candidates[0] != "publication.execute" {
+		return bound, false, nil
+	}
+	rebound := bound
+	rebound.transitionID = "publication.execute"
+	rebound, err := bindFlowEntry(ctx, rebound)
+	if err != nil {
+		return commandOptions{}, false, err
+	}
+	return rebound, true, nil
+}
+
 func bindContinuationCandidate(ctx context.Context, bound commandOptions, response surfaces.Response) (commandOptions, bool, error) {
 	if bound.transitionID != "" || response.Prescription != nil || response.Decision == nil || response.Decision.Kind != supervisor.DecisionCandidate || response.Decision.Transition == nil || len(response.Decision.Candidates) != 1 {
 		return bound, false, nil
@@ -381,5 +406,6 @@ func advanceContinuation(options *commandOptions, response surfaces.Response) er
 	options.requiredCapabilities = nil
 	options.effectiveCapabilities = nil
 	options.idempotencyKey = ""
+	options.trustedAuthorityReceipts = nil
 	return nil
 }

boatstack/cmd/boatstack-helper/flow_command.go

@@ -21,7 +21,7 @@ import (
 	boatstackruntime "github.com/operatorstack/boatstack/boatstack/internal/runtime"
 )
 
-const flowCompilerVersion = "control-program.compiler.1"
+const flowCompilerVersion = "control-program.compiler.2"
 
 type flowCommandOptions struct {
 	repository string
@@ -33,7 +33,7 @@ type flowCommandOptions struct {
 
 func runFlowCommand(arguments []string) error {
 	if len(arguments) == 0 {
-		return fmt.Errorf("usage: boatstack flow <compile|check|authorize|revoke|run> [flags]")
+		return fmt.Errorf("usage: boatstack flow <compile|check|authorize|revoke|run|work> [flags]")
 	}
 	action := arguments[0]
 	if action == "authorize" {
@@ -45,6 +45,9 @@ func runFlowCommand(arguments []string) error {
 	if action == "run" {
 		return runFlowContinuation(arguments[1:])
 	}
+	if action == "work" {
+		return runFlowWork(arguments[1:])
+	}
 	flags := flag.NewFlagSet("flow "+action, flag.ContinueOnError)
 	flags.SetOutput(os.Stderr)
 	options := flowCommandOptions{}
@@ -116,7 +119,7 @@ func compileFlow(ctx context.Context, options flowCommandOptions) error {
 	if err != nil {
 		return err
 	}
-	compiled, err := controlprogram.Load(bytes.NewReader(rawIR), resolver)
+	compiled, err := controlprogram.LoadWithAssets(bytes.NewReader(rawIR), resolver, controlprogram.RepositoryAssetResolver{Repository: options.repository})
 	if err != nil {
 		return err
 	}
@@ -162,13 +165,29 @@ func compileFlow(ctx context.Context, options flowCommandOptions) error {
 	writes = append(writes, boatstackruntime.ProjectionWrite{
 		Path: artifactPath, Content: artifactRaw, Mode: 0o644, ExpectedPreviousSHA256: artifactPrevious, PublishLast: true,
 	})
-	if err := rejectProjectionInputOverlap(lockPath, writes, removals); err != nil {
-		return err
-	}
 	expectations := []boatstackruntime.ProjectionExpectation{
 		{Path: source, Exists: true, ExpectedSHA256: fileDigest(sourceRaw)},
 		{Path: lockPath, Exists: true, ExpectedSHA256: fileDigest(lockRaw)},
 	}
+	compileInputs := []string{source, lockPath}
+	assetPaths := make([]string, 0, len(artifact.Assets))
+	for relative := range artifact.Assets {
+		assetPaths = append(assetPaths, relative)
+	}
+	sort.Strings(assetPaths)
+	for _, relative := range assetPaths {
+		absolute, pathErr := exactRepositoryPath(options.repository, relative)
+		if pathErr != nil {
+			return pathErr
+		}
+		compileInputs = append(compileInputs, absolute)
+		expectations = append(expectations, boatstackruntime.ProjectionExpectation{
+			Path: absolute, Exists: true, ExpectedSHA256: artifact.Assets[relative],
+		})
+	}
+	if err := rejectProjectionInputOverlap(compileInputs, writes, removals); err != nil {
+		return err
+	}
 	artifactRelative, _ := filepath.Rel(options.repository, artifactPath)
 	nextOwnership := boatstackruntime.NewFlowProjectionOwnership(filepath.ToSlash(sourceRelative), filepath.ToSlash(artifactRelative), artifactRaw, skills)
 	if err := boatstackruntime.ApplyOwnedFlowProjection(options.repository, writes, removals, expectations, ownership, nextOwnership); err != nil {
@@ -177,16 +196,19 @@ func compileFlow(ctx context.Context, options flowCommandOptions) error {
 	return renderFlowResult("compiled", artifactPath, artifact)
 }
 
-func rejectProjectionInputOverlap(lockPath string, writes []boatstackruntime.ProjectionWrite, removals []boatstackruntime.ProjectionRemoval) error {
-	lockPath = filepath.Clean(lockPath)
+func rejectProjectionInputOverlap(inputs []string, writes []boatstackruntime.ProjectionWrite, removals []boatstackruntime.ProjectionRemoval) error {
+	bound := make(map[string]bool, len(inputs))
+	for _, input := range inputs {
+		bound[filepath.Clean(input)] = true
+	}
 	for _, write := range writes {
-		if filepath.Clean(write.Path) == lockPath {
-			return fmt.Errorf("FLOW_COMPILE_INPUT_OVERLAP: dependency lock is a projection output")
+		if bound[filepath.Clean(write.Path)] {
+			return fmt.Errorf("FLOW_COMPILE_INPUT_OVERLAP: compile input %s is a projection output", write.Path)
 		}
 	}
 	for _, removal := range removals {
-		if filepath.Clean(removal.Path) == lockPath {
-			return fmt.Errorf("FLOW_COMPILE_INPUT_OVERLAP: dependency lock is a retired projection output")
+		if bound[filepath.Clean(removal.Path)] {
+			return fmt.Errorf("FLOW_COMPILE_INPUT_OVERLAP: compile input %s is a retired projection output", removal.Path)
 		}
 	}
 	return nil