Skip to content

feat(runs): record base SHA provenance #166

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jungle-lethanh wants to merge 1 commit into
base: main
Choose a base branch
from
Open

feat(runs): record base SHA provenance #166

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 9 additions & 1 deletion packages/cli/templates/receipts/collect.mjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,8 @@ export function collectReceipt(env = process.env, now = new Date()) {
const engine = parseEngineEvidence(env.FACILITY_RECEIPT_ENGINE_JSONL);
const checkEvidence = parseChecks(env.FACILITY_RECEIPT_CHECKS_FILE);
const target = githubTarget(env.GITHUB_EVENT_PATH);
const git = gitActivity(env.FACILITY_RECEIPT_BASE_SHA, env.GITHUB_WORKSPACE);
const baseSha = gitCommitSha(env.FACILITY_RECEIPT_BASE_SHA);
const git = gitActivity(baseSha, env.GITHUB_WORKSPACE);
const actor = env.GITHUB_ACTOR;
const receipt = {
schema: "facility.run.v1",
Expand Down Expand Up @@ -59,6 +60,7 @@ export function collectReceipt(env = process.env, now = new Date()) {
repo: env.GITHUB_REPOSITORY?.split("/")[1],
issue: target.issue,
pr: target.pr,
...(baseSha ? { base_sha: baseSha } : {}),
...(actor ? { actor_sha256: sha256(actor) } : {}),
},
timing: {
Expand Down Expand Up @@ -250,6 +252,12 @@ function normalizeResult(value) {
return "failed";
}

function gitCommitSha(value) {
return typeof value === "string" && /^[0-9a-f]{40}$/i.test(value)
? value.toLowerCase()
: undefined;
}

function requiredChoice(value, choices, name) {
if (!value || !choices.has(value))
throw new Error(`FACILITY_RECEIPT_${name.toUpperCase()} is invalid`);
Expand Down
3 changes: 3 additions & 0 deletions packages/cli/test/receipts.test.mjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,7 @@ test("collects a privacy-preserving, tamper-evident agent receipt", async () =>
FACILITY_RECEIPT_RESULT: "success",
FACILITY_RECEIPT_STARTED_AT: "2026-07-19T00:00:00.000Z",
FACILITY_RECEIPT_ENGINE_JSONL: enginePath,
FACILITY_RECEIPT_BASE_SHA: "a".repeat(40),
FACILITY_RECEIPT_OUTPUT: outputPath,
GITHUB_EVENT_PATH: eventPath,
GITHUB_REPOSITORY: "theam/mirror",
Expand All @@ -40,6 +41,7 @@ test("collects a privacy-preserving, tamper-evident agent receipt", async () =>
const receipt = collectReceipt(env, new Date("2026-07-19T00:01:00.000Z"));
assert.equal(receipt.schema, "facility.run.v1");
assert.equal(receipt.github.pr, 42);
assert.equal(receipt.github.base_sha, "a".repeat(40));
assert.equal(receipt.usage.input_tokens, 10);
assert.equal(receipt.activity.turns, 1);
assert.equal(receipt.activity.shell_commands, 1);
Expand Down Expand Up @@ -85,5 +87,6 @@ test("reports the full check count when receipt details are bounded", async () =
assert.equal(receipt.checks_truncated, true);
assert.equal(receipt.checks[0].name, "check-1");
assert.equal(receipt.checks.at(-1).name, "check-200");
assert.equal(receipt.github.base_sha, undefined);
assert.equal(verifyReceipt(receipt), true);
});
9 changes: 9 additions & 0 deletions packages/core/src/receipts.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,6 +51,10 @@ export const FacilityReceiptSchema = z.object({
repo: z.string().optional(),
issue: z.number().int().optional(),
pr: z.number().int().optional(),
base_sha: z
.string()
.regex(/^[0-9a-f]{40}$/i)
.optional(),
actor_sha256: z.string().optional(),
})
.optional(),
Expand Down Expand Up @@ -155,6 +159,10 @@ const LegacyAgentReceiptSchema = z.object({
repo: z.string().optional(),
issue: z.number().int().optional(),
pr: z.number().int().optional(),
base_sha: z
.string()
.regex(/^[0-9a-f]{40}$/i)
.optional(),
actor: z.string().optional(),
actor_sha256: z.string().optional(),
})
Expand Down Expand Up @@ -206,6 +214,7 @@ export function parseLegacyAgentReceipt(json: unknown): FacilityReceipt {
repo: receipt.github.repo,
issue: receipt.github.issue,
pr: receipt.github.pr,
base_sha: receipt.github.base_sha,
actor_sha256:
receipt.github.actor_sha256 ??
(receipt.github.actor ? hashActor(receipt.github.actor) : undefined),
Expand Down
26 changes: 25 additions & 1 deletion packages/core/test/core.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -404,13 +404,14 @@ describe("receipts", () => {
result: "succeeded",
usage: { input_tokens: 100, output_tokens: 50, cost_usd: 1.235, cost_source: "provider" },
activity: { turns: 2, shell_commands: 1, file_changes: 3, mcp_tool_calls: 0, errors: 0 },
github: { owner: "example", repo: "product", actor: "octo" },
github: { owner: "example", repo: "product", base_sha: "b".repeat(40), actor: "octo" },
timing: { started_at: "2026-01-01T00:00:00Z", duration_ms: 1000 },
checks: [{ name: "pnpm test", status: "passed", source: "platform", exit_code: 0 }],
});
expect(receipt.schema).toBe("facility.run.v1");
expect(receipt.usage.cost_cents).toBe(124);
expect(receipt.github?.actor_sha256).toMatch(/^[0-9a-f]{64}$/);
expect(receipt.github?.base_sha).toBe("b".repeat(40));
expect(receipt.checks).toEqual([
{ name: "pnpm test", status: "passed", source: "platform", exit_code: 0 },
]);
Expand Down Expand Up @@ -444,4 +445,27 @@ describe("receipts", () => {
}),
).toBe(false);
});

it("keeps the optional base commit inside receipt integrity", () => {
const baseSha = "c".repeat(40);
const receipt = parseLegacyAgentReceipt({
schema: "example.agent_sdlc.run.v1",
provider: "codex_cli",
mode: "builder",
result: "succeeded",
usage: { input_tokens: 1, output_tokens: 1, cost_source: "provider" },
activity: {},
github: { base_sha: baseSha },
timing: { started_at: "2026-08-16T00:00:00.000Z" },
});
const sealed = sealFacilityReceipt(receipt, null);

expect(verifyFacilityReceipt(sealed)).toBe(true);
expect(
verifyFacilityReceipt({
...sealed,
github: { ...sealed.github, base_sha: "d".repeat(40) },
}),
).toBe(false);
});
});
5 changes: 5 additions & 0 deletions packages/db/migrations/0042_run_base_sha_provenance.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
ALTER TABLE runs
ADD COLUMN workspace_base_sha text;

ALTER TABLE run_deliveries
ADD COLUMN base_sha text;
2 changes: 2 additions & 0 deletions packages/db/src/schema.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -492,6 +492,7 @@ export const runs = pgTable(
ciRepairKey: text("ci_repair_key"),
transcriptUri: text("transcript_uri"),
sessionStateUri: text("session_state_uri"),
workspaceBaseSha: text("workspace_base_sha"),
error: text("error"),
queuedAt: timestamp("queued_at", { withTimezone: true }).defaultNow().notNull(),
startedAt: timestamp("started_at", { withTimezone: true }),
Expand Down Expand Up @@ -550,6 +551,7 @@ export const runDeliveries = pgTable(
repoName: text("repo_name").notNull(),
headBranch: text("head_branch").notNull(),
expectedHeadSha: text("expected_head_sha").notNull(),
baseSha: text("base_sha"),
baseBranch: text("base_branch").notNull(),
title: text("title").notNull(),
body: text("body").notNull(),
Expand Down
8 changes: 7 additions & 1 deletion packages/db/test/db.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -743,6 +743,8 @@ describe("db", async () => {
OR (table_name = 'spend_counters' AND column_name = 'spent_cents')
OR (table_name = 'analytics_daily' AND column_name IN ('cost_cents', 'outcomes_assessed', 'outcomes_accepted'))
OR (table_name = 'provider_credentials' AND column_name = 'auth_mode')
OR (table_name = 'runs' AND column_name = 'workspace_base_sha')
OR (table_name = 'run_deliveries' AND column_name = 'base_sha')
`,
)) as Iterable<{ table_name: string; column_name: string; data_type: string }>;
const columnTypes = new Map(
Expand All @@ -757,6 +759,8 @@ describe("db", async () => {
expect(columnTypes.get("analytics_daily.outcomes_assessed")).toBe("integer");
expect(columnTypes.get("analytics_daily.outcomes_accepted")).toBe("integer");
expect(columnTypes.get("provider_credentials.auth_mode")).toBe("text");
expect(columnTypes.get("runs.workspace_base_sha")).toBe("text");
expect(columnTypes.get("run_deliveries.base_sha")).toBe("text");
const indexes = (await db.execute(
sql`
SELECT indexname
Expand Down Expand Up @@ -874,7 +878,9 @@ describe("db", async () => {
// A developer database can include later migrations from another worktree;
// assert this checkout's latest migration was applied without assuming it
// is the newest row in that shared database.
expect(Array.from(applied).map((row) => row.name)).toContain("0041_github_ci_story_events.sql");
expect(Array.from(applied).map((row) => row.name)).toContain(
"0042_run_base_sha_provenance.sql",
);
const providerCredentialChecks = (await db.execute(
sql`
SELECT conname
Expand Down
40 changes: 40 additions & 0 deletions packages/sdk/openapi.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6639,6 +6639,10 @@
"nullable": true,
"type": "string"
},
"workspaceBaseSha": {
"nullable": true,
"type": "string"
},
"error": {
"nullable": true,
"type": "string"
Expand Down Expand Up @@ -6685,6 +6689,7 @@
"engineSessionId",
"transcriptUri",
"sessionStateUri",
"workspaceBaseSha",
"error",
"queuedAt",
"startedAt",
Expand Down Expand Up @@ -6968,6 +6973,10 @@
"nullable": true,
"type": "string"
},
"workspaceBaseSha": {
"nullable": true,
"type": "string"
},
"error": {
"nullable": true,
"type": "string"
Expand Down Expand Up @@ -7014,6 +7023,7 @@
"engineSessionId",
"transcriptUri",
"sessionStateUri",
"workspaceBaseSha",
"error",
"queuedAt",
"startedAt",
Expand Down Expand Up @@ -7463,6 +7473,10 @@
"nullable": true,
"type": "string"
},
"workspaceBaseSha": {
"nullable": true,
"type": "string"
},
"error": {
"nullable": true,
"type": "string"
Expand Down Expand Up @@ -7509,6 +7523,7 @@
"engineSessionId",
"transcriptUri",
"sessionStateUri",
"workspaceBaseSha",
"error",
"queuedAt",
"startedAt",
Expand Down Expand Up @@ -7923,6 +7938,10 @@
"nullable": true,
"type": "string"
},
"workspaceBaseSha": {
"nullable": true,
"type": "string"
},
"error": {
"nullable": true,
"type": "string"
Expand Down Expand Up @@ -7989,6 +8008,7 @@
"engineSessionId",
"transcriptUri",
"sessionStateUri",
"workspaceBaseSha",
"error",
"queuedAt",
"startedAt",
Expand Down Expand Up @@ -8234,6 +8254,10 @@
"nullable": true,
"type": "string"
},
"workspaceBaseSha": {
"nullable": true,
"type": "string"
},
"error": {
"nullable": true,
"type": "string"
Expand Down Expand Up @@ -8280,6 +8304,7 @@
"engineSessionId",
"transcriptUri",
"sessionStateUri",
"workspaceBaseSha",
"error",
"queuedAt",
"startedAt",
Expand Down Expand Up @@ -8534,6 +8559,10 @@
"nullable": true,
"type": "string"
},
"workspaceBaseSha": {
"nullable": true,
"type": "string"
},
"error": {
"nullable": true,
"type": "string"
Expand Down Expand Up @@ -8580,6 +8609,7 @@
"engineSessionId",
"transcriptUri",
"sessionStateUri",
"workspaceBaseSha",
"error",
"queuedAt",
"startedAt",
Expand Down Expand Up @@ -9809,6 +9839,10 @@
"nullable": true,
"type": "string"
},
"workspaceBaseSha": {
"nullable": true,
"type": "string"
},
"error": {
"nullable": true,
"type": "string"
Expand Down Expand Up @@ -9855,6 +9889,7 @@
"engineSessionId",
"transcriptUri",
"sessionStateUri",
"workspaceBaseSha",
"error",
"queuedAt",
"startedAt",
Expand Down Expand Up @@ -13420,6 +13455,10 @@
"nullable": true,
"type": "string"
},
"workspaceBaseSha": {
"nullable": true,
"type": "string"
},
"error": {
"nullable": true,
"type": "string"
Expand Down Expand Up @@ -13466,6 +13505,7 @@
"engineSessionId",
"transcriptUri",
"sessionStateUri",
"workspaceBaseSha",
"error",
"queuedAt",
"startedAt",
Expand Down
8 changes: 8 additions & 0 deletions packages/sdk/src/schema.d.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6130,6 +6130,7 @@ export interface operations {
engineSessionId: string | null;
transcriptUri: string | null;
sessionStateUri: string | null;
workspaceBaseSha: string | null;
error: string | null;
/** Format: date-time */
queuedAt: string;
Expand Down Expand Up @@ -6295,6 +6296,7 @@ export interface operations {
engineSessionId: string | null;
transcriptUri: string | null;
sessionStateUri: string | null;
workspaceBaseSha: string | null;
error: string | null;
/** Format: date-time */
queuedAt: string;
Expand Down Expand Up @@ -6559,6 +6561,7 @@ export interface operations {
engineSessionId: string | null;
transcriptUri: string | null;
sessionStateUri: string | null;
workspaceBaseSha: string | null;
error: string | null;
/** Format: date-time */
queuedAt: string;
Expand Down Expand Up @@ -6809,6 +6812,7 @@ export interface operations {
engineSessionId: string | null;
transcriptUri: string | null;
sessionStateUri: string | null;
workspaceBaseSha: string | null;
error: string | null;
/** Format: date-time */
queuedAt: string;
Expand Down Expand Up @@ -6962,6 +6966,7 @@ export interface operations {
engineSessionId: string | null;
transcriptUri: string | null;
sessionStateUri: string | null;
workspaceBaseSha: string | null;
error: string | null;
/** Format: date-time */
queuedAt: string;
Expand Down Expand Up @@ -7113,6 +7118,7 @@ export interface operations {
engineSessionId: string | null;
transcriptUri: string | null;
sessionStateUri: string | null;
workspaceBaseSha: string | null;
error: string | null;
/** Format: date-time */
queuedAt: string;
Expand Down Expand Up @@ -7891,6 +7897,7 @@ export interface operations {
engineSessionId: string | null;
transcriptUri: string | null;
sessionStateUri: string | null;
workspaceBaseSha: string | null;
error: string | null;
/** Format: date-time */
queuedAt: string;
Expand Down Expand Up @@ -9663,6 +9670,7 @@ export interface operations {
engineSessionId: string | null;
transcriptUri: string | null;
sessionStateUri: string | null;
workspaceBaseSha: string | null;
error: string | null;
/** Format: date-time */
queuedAt: string;
Expand Down
Loading
Loading