ci: harden workflows and contract registry validation

.github/dependabot.yml

@@ -8,3 +8,11 @@ updates:
       all:
         patterns:
           - "*"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      all:
+        patterns:
+          - "*"

.github/workflows/codeql.yml

@@ -8,6 +8,7 @@ jobs:
   analyze:
     name: Analyze
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     permissions:
       actions: read
       contents: read

.github/workflows/contract-registry-live.yml

@@ -0,0 +1,41 @@
+name: Contract registry live drift
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "17 5 * * 1"
+
+permissions:
+  contents: read
+
+jobs:
+  verify-v1-1:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - name: Compare published v1.1.1 release with vendored contracts
+        env:
+          REGISTRY_BASE: https://coding-autopilot-system.github.io/cas-contracts/registry
+          PINNED_VERSION: 1.1.1
+          VENDORED_ROOT: tests/contracts/cas-contracts/v1.1.1
+        shell: python
+        run: |
+          import hashlib, json, os, pathlib, urllib.request
+          base = os.environ["REGISTRY_BASE"]
+          version = os.environ["PINNED_VERSION"]
+          root = pathlib.Path(os.environ["VENDORED_ROOT"])
+          with urllib.request.urlopen(f"{base}/index.json", timeout=20) as response:
+              index = json.load(response)
+          if version not in index.get("releases", []):
+              raise SystemExit(f"published registry is missing release {version}")
+          with urllib.request.urlopen(f"{base}/releases/v{version}/manifest.json", timeout=20) as response:
+              manifest = json.load(response)
+          for entry in manifest["schemas"]:
+              local = (root / entry["path"]).read_bytes()
+              if hashlib.sha256(local).hexdigest() != entry["sha256"]:
+                  raise SystemExit(f"vendored digest drift: {entry['path']}")
+              with urllib.request.urlopen(f"{base}/releases/v{version}/{entry['path']}", timeout=20) as response:
+                  published = response.read()
+              if published != local:
+                  raise SystemExit(f"published content drift: {entry['path']}")

.github/workflows/pages.yml

@@ -6,14 +6,13 @@ on:
       - master
 permissions:
   contents: read
-  pages: write
-  id-token: write
 concurrency:
   group: "pages"
   cancel-in-progress: false
 jobs:
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
@@ -25,10 +24,14 @@ jobs:
         with:
           path: ./site
   deploy:
+    permissions:
+      pages: write
+      id-token: write
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     needs: build
     steps:
       - name: Deploy to GitHub Pages

.github/workflows/pr-lint.yml

@@ -9,6 +9,9 @@ on:
 jobs:
   main:
     runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      pull-requests: read
     steps:
       - uses: amannn/action-semantic-pull-request@v5
         env:

.github/workflows/stale.yml

@@ -6,6 +6,10 @@ on:
 jobs:
   stale:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      issues: write
+      pull-requests: write
     steps:
       - uses: actions/stale@v8
         with:

maf_starter/loop_worker_cli.py

@@ -14,6 +14,8 @@
     run_bounded_specialists,
 )
 
+MAX_REQUEST_BYTES = 1_000_000
+
 
 @dataclass(frozen=True)
 class WorkerEnvelope:
@@ -68,7 +70,15 @@ def main() -> int:
     parser.add_argument("--request", help="JSON worker request; stdin is used when omitted")
     args = parser.parse_args()
     try:
-        payload = json.loads(args.request if args.request is not None else sys.stdin.read())
+        if args.request is not None:
+            request_text = args.request
+            request_size = len(request_text.encode("utf-8"))
+        else:
+            request_text = sys.stdin.read(MAX_REQUEST_BYTES + 1)
+            request_size = len(request_text.encode("utf-8"))
+        if request_size > MAX_REQUEST_BYTES:
+            raise ValueError(f"Worker request exceeds {MAX_REQUEST_BYTES} bytes")
+        payload = json.loads(request_text)
         result = asyncio.run(execute_request(payload))
     except (ValueError, json.JSONDecodeError) as error:
         print(json.dumps({"error": str(error)}), file=sys.stderr)

tests/contracts/cas-contracts/v1.1.0/common.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://schemas.coding-autopilot.dev/v1.1/common.schema.json",
+  "$id": "https://schemas.coding-autopilot.dev/v1.1/common.schema.json",
   "title": "CAS Common Definitions v1.1",
   "$defs": {
     "actor": {

tests/contracts/cas-contracts/v1.1.0/manifest.json

@@ -4,32 +4,32 @@
     {
       "id": "https://schemas.coding-autopilot.dev/v1.1/common.schema.json",
       "path": "common.schema.json",
-      "sha256": "078026d60c219658fe0fc5cf7c4f786acdcf0c492121f7d688d5078b33ca25af"
+      "sha256": "75d300c99779327d90872373bfc1661ba04ca1bb52335dec45fe926594ea5d7b"
     },
     {
       "id": "https://schemas.coding-autopilot.dev/v1.1/phase-execution-request.schema.json",
       "path": "phase-execution-request.schema.json",
-      "sha256": "927ffda5ba809e58627ba25b3275355644b510b0ae1c76f446aa7b7f291f08fd"
+      "sha256": "4577f1dc99bd04b0ccd84255d4f34935a686273f4ed4cd030ba32e2caf54315a"
     },
     {
       "id": "https://schemas.coding-autopilot.dev/v1.1/phase-execution-result.schema.json",
       "path": "phase-execution-result.schema.json",
-      "sha256": "1d353e20cf6338c2de4a9bec0bad83ca0dec6c9feb5434c5e6264fdc075e7c25"
+      "sha256": "bcffcbcf4e502a1d578ccce3ba0326e91f5562cd1979a83489b394cdeb4b50e1"
     },
     {
       "id": "https://schemas.coding-autopilot.dev/v1.1/phase-verification-result.schema.json",
       "path": "phase-verification-result.schema.json",
-      "sha256": "ec5b97a2bf75892530442f666d23a8b6dbb8f13bda0efe49553d3f64cd41b995"
+      "sha256": "ec84a47574424a5c148030f87d8a3f3cdd3041ce24056242fb6f81ddfd3c1340"
     },
     {
       "id": "https://schemas.coding-autopilot.dev/v1.1/sdlc-lifecycle-event.schema.json",
       "path": "sdlc-lifecycle-event.schema.json",
-      "sha256": "bd955637761679d3b6e8ee09fb7b693b1d0362615b0865204c5ae3bacb3809dc"
+      "sha256": "6e397fb7f76703593fcecb95c1b53d6de0657157d7b99272ca2bb310de5d780f"
     },
     {
       "id": "https://schemas.coding-autopilot.dev/v1.1/sdlc-profile.schema.json",
       "path": "sdlc-profile.schema.json",
-      "sha256": "f4974e911e7cb88191c1a331470c8cd7a79d1c7311c963dd70cd9c8f524ebe45"
+      "sha256": "c435ceadceb9bde7f5c698f9ce896c12f6e5adba3811191a820e472d151ef971"
     }
   ]
 }

tests/contracts/cas-contracts/v1.1.0/phase-execution-request.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://schemas.coding-autopilot.dev/v1.1/phase-execution-request.schema.json",
+  "$id": "https://schemas.coding-autopilot.dev/v1.1/phase-execution-request.schema.json",
   "title": "PhaseExecutionRequest",
   "type": "object",
   "allOf": [

tests/contracts/cas-contracts/v1.1.0/phase-execution-result.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://schemas.coding-autopilot.dev/v1.1/phase-execution-result.schema.json",
+  "$id": "https://schemas.coding-autopilot.dev/v1.1/phase-execution-result.schema.json",
   "title": "PhaseExecutionResult",
   "type": "object",
   "allOf": [

tests/contracts/cas-contracts/v1.1.0/phase-verification-result.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://schemas.coding-autopilot.dev/v1.1/phase-verification-result.schema.json",
+  "$id": "https://schemas.coding-autopilot.dev/v1.1/phase-verification-result.schema.json",
   "title": "PhaseVerificationResult",
   "type": "object",
   "allOf": [

tests/contracts/cas-contracts/v1.1.0/sdlc-lifecycle-event.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://schemas.coding-autopilot.dev/v1.1/sdlc-lifecycle-event.schema.json",
+  "$id": "https://schemas.coding-autopilot.dev/v1.1/sdlc-lifecycle-event.schema.json",
   "title": "SdlcLifecycleEvent",
   "type": "object",
   "allOf": [

tests/contracts/cas-contracts/v1.1.0/sdlc-profile.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://schemas.coding-autopilot.dev/v1.1/sdlc-profile.schema.json",
+  "$id": "https://schemas.coding-autopilot.dev/v1.1/sdlc-profile.schema.json",
   "title": "SdlcProfile",
   "type": "object",
   "allOf": [

tests/contracts/cas-contracts/v1.1.1/common.schema.json

@@ -0,0 +1,103 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schemas.coding-autopilot.dev/v1.1/common.schema.json",
+  "title": "CAS Common Definitions v1.1",
+  "$defs": {
+    "actor": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "type"],
+      "properties": {
+        "id": { "type": "string", "minLength": 1, "maxLength": 256 },
+        "type": {
+          "type": "string",
+          "enum": ["human", "agent", "service", "workflow"]
+        },
+        "displayName": { "type": "string", "minLength": 1, "maxLength": 256 }
+      }
+    },
+    "traceContext": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["traceparent"],
+      "properties": {
+        "traceparent": {
+          "type": "string",
+          "pattern": "^[\\da-f]{2}-[\\da-f]{32}-[\\da-f]{16}-[\\da-f]{2}$"
+        },
+        "tracestate": { "type": "string", "maxLength": 512 }
+      }
+    },
+    "lifecycleMetadata": {
+      "type": "object",
+      "required": [
+        "correlationId",
+        "promptId",
+        "runId",
+        "repo",
+        "actor",
+        "timestamp",
+        "schemaVersion",
+        "traceContext"
+      ],
+      "properties": {
+        "correlationId": { "type": "string", "minLength": 1, "maxLength": 128 },
+        "promptId": { "type": "string", "minLength": 1, "maxLength": 128 },
+        "runId": { "type": "string", "minLength": 1, "maxLength": 128 },
+        "repo": {
+          "type": "string",
+          "pattern": "^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$"
+        },
+        "actor": { "$ref": "#/$defs/actor" },
+        "timestamp": { "type": "string", "format": "date-time" },
+        "schemaVersion": { "const": "1.1.0" },
+        "traceContext": { "$ref": "#/$defs/traceContext" }
+      }
+    },
+    "evidence": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["kind", "uri"],
+      "properties": {
+        "kind": { "type": "string", "minLength": 1, "maxLength": 64 },
+        "uri": { "type": "string", "format": "uri" },
+        "sha256": { "type": "string", "pattern": "^[\\da-f]{64}$" }
+      }
+    },
+    "phaseId": {
+      "type": "string",
+      "enum": [
+        "understand",
+        "research",
+        "analyze",
+        "plan",
+        "risk-assessment",
+        "implement",
+        "verify",
+        "review",
+        "improve",
+        "document",
+        "update-memory",
+        "finished"
+      ]
+    },
+    "executionBatch": {
+      "type": "string",
+      "enum": ["discovery", "design", "change", "assurance", "closure"]
+    },
+    "phaseStatus": {
+      "type": "string",
+      "enum": [
+        "pending",
+        "ready",
+        "running",
+        "passed",
+        "failed",
+        "invalidated",
+        "rolled-back",
+        "waiting",
+        "terminal"
+      ]
+    }
+  }
+}

tests/contracts/cas-contracts/v1.1.1/manifest.json

@@ -0,0 +1,35 @@
+{
+  "version": "1.1.1",
+  "schemas": [
+    {
+      "id": "https://schemas.coding-autopilot.dev/v1.1/common.schema.json",
+      "path": "common.schema.json",
+      "sha256": "e3173585d5e04eb2f4455de7d821903a45cf2d8edff3b33bbc81f43e97b2aa82"
+    },
+    {
+      "id": "https://schemas.coding-autopilot.dev/v1.1/phase-execution-request.schema.json",
+      "path": "phase-execution-request.schema.json",
+      "sha256": "6ca1e9cc51877d412e059546722d0b82654c7f925fce1616f4961ebae1142cbb"
+    },
+    {
+      "id": "https://schemas.coding-autopilot.dev/v1.1/phase-execution-result.schema.json",
+      "path": "phase-execution-result.schema.json",
+      "sha256": "d756f56a484972b379f520b0bd38bbcb07d948a884d4f373939867700eb03e5b"
+    },
+    {
+      "id": "https://schemas.coding-autopilot.dev/v1.1/phase-verification-result.schema.json",
+      "path": "phase-verification-result.schema.json",
+      "sha256": "704b05f99d67323eddf4599536a545dbb50412654248aa58abad0af5dae25b3c"
+    },
+    {
+      "id": "https://schemas.coding-autopilot.dev/v1.1/sdlc-lifecycle-event.schema.json",
+      "path": "sdlc-lifecycle-event.schema.json",
+      "sha256": "6f0bc68f7b74966bb1f654250463291b19398cc80d73a9bbae5aaba8ca1d226a"
+    },
+    {
+      "id": "https://schemas.coding-autopilot.dev/v1.1/sdlc-profile.schema.json",
+      "path": "sdlc-profile.schema.json",
+      "sha256": "c9a643302f8762848ab1b5063ac07d344fb30f2904fc162fb55ae2f4552b6904"
+    }
+  ]
+}