feat: add companion manifest, attestation, and evidence schemas v0

.github/workflows/ci.yml

@@ -0,0 +1,44 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
+        with:
+          version: 10
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        with:
+          node-version: 22
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm validate
+      - run: pnpm test
+
+  dco:
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+    steps:
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        with:
+          fetch-depth: 0
+      - name: Check DCO sign-off
+        run: |
+          set -euo pipefail
+          missing=0
+          while read -r sha; do
+            if ! git log -1 --format=%B "$sha" | grep -qE '^Signed-off-by: .+ <.+>$'; then
+              echo "Missing Signed-off-by: $sha"
+              missing=1
+            fi
+          done < <(git rev-list ${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }})
+          exit "$missing"

.gitignore

@@ -0,0 +1 @@
+node_modules/

CHECKLIST.md

@@ -9,24 +9,24 @@
 
 ## Companion manifest v0
 
-- [ ] Define component identity, namespace, owner, framework, and source model.
-- [ ] Define open-source, external-commercial, private-team, and hosted-commercial states.
-- [ ] Reference—not duplicate—the canonical shadcn install item.
+- [x] Define component identity, namespace, owner, framework, and source model.
+- [x] Define open-source, external-commercial, private-team, and hosted-commercial states.
+- [x] Reference—not duplicate—the canonical shadcn install item.
 - [ ] Define source repository, commit, license expression, and purchase-domain metadata.
-- [ ] Define immutable version and canonical digest rules.
+- [x] Define immutable version and canonical digest rules (draft; canonical vectors pending).
 
 ## Evidence and attestation v0
 
-- [ ] Define owner, source, signature, scan, build, review, and revocation evidence.
-- [ ] Document what every evidence state does and does not prove.
+- [x] Define owner, source, signature, scan, build, review, and revocation evidence.
+- [x] Document what every evidence state does and does not prove (limitations required for scans).
 - [ ] Define canonical JSON serialization and digest scope.
 - [ ] Define signing identity, key version, rotation, revocation, and cutoff semantics.
-- [ ] Define external commercial “Source not assessed” requirements.
+- [x] Define external commercial “Source not assessed” requirements.
 
 ## Conformance
 
-- [ ] Add JSON Schema validation.
-- [ ] Add valid and invalid fixtures.
+- [x] Add JSON Schema validation.
+- [x] Add valid and invalid fixtures.
 - [ ] Add oversized, traversal, Unicode-confusable, symlink, unsafe-target, and secret fixtures.
 - [ ] Generate TypeScript types.
 - [ ] Publish `@modulora/spec` through trusted publishing.

fixtures/invalid/attestation-bad-digest.json

@@ -0,0 +1,31 @@
+{
+  "schemaVersion": "0",
+  "canonicalization": "modulora-json-c14n-0",
+  "itemRef": {
+    "namespace": "northstar",
+    "name": "calendar",
+    "version": "1.2.0"
+  },
+  "releaseDigest": "sha256:xyz",
+  "sourceCommit": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+  "files": [
+    {
+      "path": "components/ui/calendar.tsx",
+      "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+    },
+    {
+      "path": "lib/utils.ts",
+      "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+    }
+  ],
+  "publisher": {
+    "identity": "github:northstar-ui/justin",
+    "authorizedAt": "2026-07-11T18:00:00Z"
+  },
+  "signature": {
+    "keyId": "modulora-platform-2026-01",
+    "algorithm": "ed25519",
+    "value": "QUJDREVG",
+    "signedAt": "2026-07-11T18:00:05Z"
+  }
+}

fixtures/invalid/evidence-scan-missing-limitations.json

@@ -0,0 +1,18 @@
+{
+  "schemaVersion": "0",
+  "itemRef": {
+    "namespace": "northstar",
+    "name": "calendar",
+    "version": "1.2.0"
+  },
+  "releaseDigest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "records": [
+    {
+      "type": "secret-scan",
+      "status": "passed",
+      "issuer": "x",
+      "timestamp": "2026-07-11T18:00:10Z",
+      "toolVersion": "g-8"
+    }
+  ]
+}

fixtures/invalid/item-bad-version.json

@@ -0,0 +1,25 @@
+{
+  "schemaVersion": "0",
+  "namespace": "northstar",
+  "name": "calendar",
+  "version": "1.2",
+  "framework": "react",
+  "sourceModel": "open-source",
+  "visibility": "public",
+  "owner": {
+    "kind": "organization",
+    "identifier": "northstar-ui"
+  },
+  "source": {
+    "repository": "https://github.com/northstar-ui/components",
+    "commit": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+  },
+  "shadcnItem": {
+    "url": "https://registry.modulora.dev/r/northstar/calendar/1.2.0/registry-item.json",
+    "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+  },
+  "license": {
+    "kind": "spdx",
+    "spdxExpression": "MIT"
+  }
+}

fixtures/invalid/item-commercial-without-purchase.json

@@ -0,0 +1,21 @@
+{
+  "schemaVersion": "0",
+  "namespace": "northstar",
+  "name": "pro-table",
+  "version": "1.2.0",
+  "framework": "react",
+  "sourceModel": "external-commercial",
+  "visibility": "public",
+  "owner": {
+    "kind": "organization",
+    "identifier": "northstar-ui"
+  },
+  "shadcnItem": {
+    "url": "https://registry.modulora.dev/r/northstar/calendar/1.2.0/registry-item.json",
+    "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+  },
+  "license": {
+    "kind": "commercial",
+    "url": "https://northstar.dev/license"
+  }
+}

fixtures/invalid/item-missing-owner.json

@@ -0,0 +1,21 @@
+{
+  "schemaVersion": "0",
+  "namespace": "northstar",
+  "name": "calendar",
+  "version": "1.2.0",
+  "framework": "react",
+  "sourceModel": "open-source",
+  "visibility": "public",
+  "source": {
+    "repository": "https://github.com/northstar-ui/components",
+    "commit": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+  },
+  "shadcnItem": {
+    "url": "https://registry.modulora.dev/r/northstar/calendar/1.2.0/registry-item.json",
+    "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+  },
+  "license": {
+    "kind": "spdx",
+    "spdxExpression": "MIT"
+  }
+}

fixtures/invalid/item-open-source-commercial-license.json

@@ -0,0 +1,24 @@
+{
+  "schemaVersion": "0",
+  "namespace": "northstar",
+  "name": "calendar",
+  "version": "1.2.0",
+  "framework": "react",
+  "sourceModel": "open-source",
+  "visibility": "public",
+  "owner": {
+    "kind": "organization",
+    "identifier": "northstar-ui"
+  },
+  "source": {
+    "repository": "https://github.com/northstar-ui/components",
+    "commit": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+  },
+  "shadcnItem": {
+    "url": "https://registry.modulora.dev/r/northstar/calendar/1.2.0/registry-item.json",
+    "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+  },
+  "license": {
+    "kind": "commercial"
+  }
+}

fixtures/invalid/item-open-source-without-source.json

@@ -0,0 +1,21 @@
+{
+  "schemaVersion": "0",
+  "namespace": "northstar",
+  "name": "calendar",
+  "version": "1.2.0",
+  "framework": "react",
+  "sourceModel": "open-source",
+  "visibility": "public",
+  "owner": {
+    "kind": "organization",
+    "identifier": "northstar-ui"
+  },
+  "shadcnItem": {
+    "url": "https://registry.modulora.dev/r/northstar/calendar/1.2.0/registry-item.json",
+    "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+  },
+  "license": {
+    "kind": "spdx",
+    "spdxExpression": "MIT"
+  }
+}

fixtures/invalid/item-unknown-field.json

@@ -0,0 +1,26 @@
+{
+  "schemaVersion": "0",
+  "namespace": "northstar",
+  "name": "calendar",
+  "version": "1.2.0",
+  "framework": "react",
+  "sourceModel": "open-source",
+  "visibility": "public",
+  "owner": {
+    "kind": "organization",
+    "identifier": "northstar-ui"
+  },
+  "source": {
+    "repository": "https://github.com/northstar-ui/components",
+    "commit": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+  },
+  "shadcnItem": {
+    "url": "https://registry.modulora.dev/r/northstar/calendar/1.2.0/registry-item.json",
+    "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+  },
+  "license": {
+    "kind": "spdx",
+    "spdxExpression": "MIT"
+  },
+  "extra": "x"
+}

fixtures/malicious/attestation-absolute-path.json

@@ -0,0 +1,27 @@
+{
+  "schemaVersion": "0",
+  "canonicalization": "modulora-json-c14n-0",
+  "itemRef": {
+    "namespace": "northstar",
+    "name": "calendar",
+    "version": "1.2.0"
+  },
+  "releaseDigest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "sourceCommit": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+  "files": [
+    {
+      "path": "/etc/passwd",
+      "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+    }
+  ],
+  "publisher": {
+    "identity": "github:northstar-ui/justin",
+    "authorizedAt": "2026-07-11T18:00:00Z"
+  },
+  "signature": {
+    "keyId": "modulora-platform-2026-01",
+    "algorithm": "ed25519",
+    "value": "QUJDREVG",
+    "signedAt": "2026-07-11T18:00:05Z"
+  }
+}