Documentation
¶
Overview ¶
Package evidence runs explicitly authorized verification commands in private commit snapshots. This isolates checkout state, not malicious code: execution is not an OS sandbox.
Index ¶
- func CandidateArtifacts(p *planning.Plan) []string
- func CandidateDeclaration(p planning.Plan, argv []string, cwd string) (bool, error)
- func MatchesCandidateCommand(p planning.Plan, argv []string, cwd string) bool
- func RepositoryIdentity(ctx context.Context, root string) (string, error)
- func Validate(r Record, root, revision string, p planning.Plan, criterion string, ...) error
- func ValidateCandidate(r Record, root string, c CandidateCheckpoint, p planning.Plan, ...) error
- func WrapperUnavailable(dir string, argv []string) string
- type CandidateBinding
- type CandidateCheckpoint
- type CandidateObservation
- func ObserveCandidate(ctx context.Context, dir string, argv []string, timeout time.Duration) (CandidateObservation, error)
- func ObserveCandidateAt(ctx context.Context, root, cwd string, argv []string, timeout time.Duration) (CandidateObservation, error)
- func ObserveCandidateReport(ctx context.Context, root, cwd string, argv []string, report string, ...) (CandidateObservation, error)
- type CandidateRun
- type Diagnosis
- type Record
- type SourceState
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func CandidateArtifacts ¶
CandidateArtifacts enumerates only exact declared JUnit output paths, which may be report directories. It does not exempt tracked inputs or undeclared directories from source validation.
func CandidateDeclaration ¶
func MatchesCandidateCommand ¶
func RepositoryIdentity ¶
RepositoryIdentity is shared by every clone and worktree of a repository (its root commits), so evidence recorded in an agent's worktree verifies in the main checkout. Directories without Git history fall back to their path.
func Validate ¶
func Validate(r Record, root, revision string, p planning.Plan, criterion string, command []string) error
Validate binds a stored record to its exact plan, commit, command and criterion. The checksum detects accidental edits; it is not authentication against a malicious database writer.
func ValidateCandidate ¶
func ValidateCandidate(r Record, root string, c CandidateCheckpoint, p planning.Plan, criterion string, argv []string) error
ValidateCandidate prevents branch records and observations of mutated source from satisfying candidate criteria. Approval is a local declaration, not auth.
func WrapperUnavailable ¶
WrapperUnavailable explains why a Gradle or Maven wrapper in dir would have to download its pinned distribution, which Radar never lets a run do: the wrapper fetches it before the build tool's offline mode applies. It reads the committed wrapper properties and the shared user homes as data and returns "" when the distribution is already cached.
Types ¶
type CandidateBinding ¶
type CandidateBinding struct {
Checkpoint CandidateCheckpoint `json:"checkpoint"`
SourceBefore string `json:"source_before"`
SourceAfter string `json:"source_after"`
SourceUnchanged bool `json:"source_unchanged"`
ConfigDigest string `json:"config_digest"`
ReviewDigest string `json:"review_digest"`
}
type CandidateCheckpoint ¶
type CandidateObservation ¶
type CandidateObservation struct {
Status model.Status `json:"status"`
ExitCode int `json:"exit_code"`
TestsRun int `json:"tests_run"`
TestsFailed int `json:"tests_failed"`
TestsSkipped int `json:"tests_skipped"`
Harness string `json:"harness,omitempty"`
OutputDigest string `json:"output_digest"`
FailedCases []string `json:"failed_cases,omitempty"`
Locations []model.Provenance `json:"locations,omitempty"`
Diagnosis *Diagnosis `json:"diagnosis,omitempty"`
}
CandidateObservation uses the same harness recognition, output bounds, private environment and process timeout policy as plan-declared tests. Raw output is deliberately absent; only source locations and identifier-shaped unittest case names are retained for agent repair guidance.
func ObserveCandidate ¶
func ObserveCandidate(ctx context.Context, dir string, argv []string, timeout time.Duration) (CandidateObservation, error)
ObserveCandidate requires explicit caller authorization and an already isolated candidate. It never consumes preexisting branch evidence.
func ObserveCandidateAt ¶
func ObserveCandidateAt(ctx context.Context, root, cwd string, argv []string, timeout time.Duration) (CandidateObservation, error)
ObserveCandidateAt executes only inside a validated candidate subdirectory.
func ObserveCandidateReport ¶
func ObserveCandidateReport(ctx context.Context, root, cwd string, argv []string, report string, timeout time.Duration) (CandidateObservation, error)
ObserveCandidateReport also reads the CWD-relative JUnit report the runner is known to write. The report must not exist before the command runs, so a committed or earlier report cannot stand in for this execution.
type CandidateRun ¶
type CandidateRun struct {
Record Record `json:"record"`
Observation CandidateObservation `json:"observation"`
}
func RunCandidate ¶
func RunCandidate(ctx context.Context, root string, c CandidateCheckpoint, p planning.Plan, argv []string, cwd string, timeout time.Duration) (CandidateRun, error)
RunCandidate runs exact reviewed plan declarations exclusively inside an already private candidate. Host dependency links are deliberately unsupported.
type Diagnosis ¶
type Diagnosis struct {
// Kind is runner_missing (python -m RUNNER could not find RUNNER, or a
// Maven/Gradle wrapper found no JVM),
// command_missing (the shell could not find a program), module_missing
// (an import or #include failed: a dependency absent from this
// environment, or a module or header a branch renamed or removed) or
// build_failed (the compiler rejected repository source; Name is the
// undefined symbol or the file).
Kind string `json:"kind"`
Name string `json:"name"`
Message string `json:"message"`
}
Diagnosis names why a command produced no test outcome or why the combined source failed to build, when its output matches a known shape. It is a fixed sentence built from a bounded name, never raw output, so persisted evidence keeps only the output digest.
func (*Diagnosis) Environment ¶
Environment reports whether the diagnosis is about the machine running the command rather than about the combined source.
type Record ¶
type Record struct {
CWD string `json:"cwd,omitempty"`
Candidate *CandidateBinding `json:"candidate,omitempty"`
SchemaVersion string `json:"schema_version"`
ID string `json:"id"`
Repository string `json:"repository"`
Revision string `json:"revision"`
PlanDigest string `json:"plan_digest"`
Command []string `json:"command"`
Criteria []string `json:"criteria"`
TestsRun int `json:"tests_run"`
TestsFailed int `json:"tests_failed,omitempty"`
TestsSkipped int `json:"tests_skipped,omitempty"`
Harness string `json:"harness,omitempty"`
Env []string `json:"env,omitempty"`
Phase string `json:"phase,omitempty"`
ExitCode int `json:"exit_code"`
Status model.Status `json:"status"`
StartedAt string `json:"started_at"`
FinishedAt string `json:"finished_at"`
OutputDigest string `json:"output_digest"`
IntegrityDigest string `json:"integrity_digest"`
// OutputTail is shown to the operator but never persisted or digested.
OutputTail string `json:"-"`
}
func InvalidateCandidateRecord ¶
InvalidateCandidateRecord revokes eligibility after a later suite command mutates the shared source state. Its checksum remains inspectable metadata.
type SourceState ¶
func InspectCandidateSource ¶
func InspectCandidateSource(ctx context.Context, root string, c CandidateCheckpoint, artifacts []string) (SourceState, error)
InspectCandidateSource compares every tracked byte against immutable objects and walks untracked inputs without truncated Git listings. Generated/cache directories and explicitly declared fresh JUnit artifacts are excluded only from NEW input detection; tracked files are always checked, including caches.
Source Files