feat(nono): add isolated evidence harness

2026-08-27 02:23:29 -04:00
parent 4bbd6a6d06
commit 54c20e2012
20 changed files with 3332 additions and 0 deletions
@@ -0,0 +1,94 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://jb.codes/harness-tools/nono/evidence.schema.json",
+  "title": "Nono evidence summary",
+  "description": "Schema-v1 for secret-free, redacted Slice 2 policy evidence. Raw command material is retained separately under the injected XDG_STATE_HOME root.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schemaVersion",
+    "runId",
+    "testId",
+    "suite",
+    "repositoryCommit",
+    "policySnapshotDigest",
+    "installedSnapshotDigest",
+    "nonoVersion",
+    "status",
+    "approver",
+    "startedAt",
+    "finishedAt",
+    "rawEvidence",
+    "resultHashes",
+    "observations"
+  ],
+  "properties": {
+    "schemaVersion": { "const": 1 },
+    "runId": { "$ref": "#/$defs/id" },
+    "testId": { "$ref": "#/$defs/id" },
+    "suite": { "enum": ["hermetic", "host", "live"] },
+    "repositoryCommit": { "type": "string", "pattern": "^[0-9a-f]{40}$" },
+    "policySnapshotDigest": { "$ref": "#/$defs/sha256" },
+    "installedSnapshotDigest": { "$ref": "#/$defs/sha256" },
+    "nonoVersion": { "type": "string", "pattern": "^0\\.74\\.[0-9]+$" },
+    "status": { "enum": ["passed", "failed", "blocked", "not-run"] },
+    "approver": { "type": ["string", "null"] },
+    "startedAt": { "$ref": "#/$defs/utcTimestamp" },
+    "finishedAt": { "$ref": "#/$defs/utcTimestamp" },
+    "rawEvidence": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["sha256", "retainedUntil"],
+      "properties": {
+        "sha256": { "$ref": "#/$defs/sha256" },
+        "retainedUntil": { "$ref": "#/$defs/utcTimestamp" }
+      }
+    },
+    "resultHashes": {
+      "type": "object",
+      "propertyNames": { "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$" },
+      "additionalProperties": { "$ref": "#/$defs/sha256" }
+    },
+    "observations": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/observation" }
+    }
+  },
+  "allOf": [
+    {
+      "if": { "properties": { "suite": { "const": "live" } } },
+      "then": {
+        "properties": {
+          "approver": { "type": "string", "minLength": 1 }
+        }
+      }
+    }
+  ],
+  "$defs": {
+    "id": {
+      "type": "string",
+      "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$"
+    },
+    "sha256": {
+      "type": "string",
+      "pattern": "^[0-9a-f]{64}$"
+    },
+    "utcTimestamp": {
+      "type": "string",
+      "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d{1,6})?Z$"
+    },
+    "observation": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "capability", "expected", "actual", "status", "hash"],
+      "properties": {
+        "id": { "$ref": "#/$defs/id" },
+        "capability": { "$ref": "#/$defs/id" },
+        "expected": { "enum": ["allowed", "denied", "unknown", "not-run"] },
+        "actual": { "enum": ["allowed", "denied", "unknown", "not-run"] },
+        "status": { "enum": ["passed", "failed", "blocked", "not-run"] },
+        "hash": { "$ref": "#/$defs/sha256" }
+      }
+    }
+  }
+}