Workflow enforcement: refuse invalid packages at commit, push, and set_remote (#753)

Author: fiskus

Cargo.lock

@@ -58,9 +58,11 @@ getrandom = "0.4"
 gitignores = "4.8"
 hex = "0.4.3"
 ignore = "0.4"
+jsonschema = { version = "0.47.0", default-features = false }
 multibase = "0.9.3"
 multihash = "0.19.5"
 percent-encoding = "2.3.2"
+regex = "1.12.4"
 reqwest = { version = "0.13.4", features = ["form", "json"] }
 reqwest-middleware = { version = "0.5.2", features = ["form", "json"] }
 reqwest-retry = "0.9.1"

Cargo.toml

@@ -60,10 +60,12 @@ still addresses.
 The workspace splits along an I/O boundary:
 
 - **WASM-safe leaf crates** (`quilt-uri` today): no I/O, compile to
-  `wasm32-unknown-unknown`. We expect 1–2 more such extractions —
-  likely candidates are checksum / hashing helpers and manifest
-  types — but the bar is "clean API and reuse value", not a default
-  path for every portable subset.
+  `wasm32-unknown-unknown`. We expect a few more such extractions —
+  likely candidates are checksum / hashing helpers, manifest types, and
+  workflow validation (a pure `quilt-workflow`: the config model plus
+  the rules-checking gate, no I/O — with reuse value for live
+  client-side validation in the UI) — but the bar is "clean API and
+  reuse value", not a default path for every portable subset.
 - **`quilt-rs`**: native-only library; depends on the leaf crates plus
   `aws-sdk-s3`, `tempfile`, `ignore`, `tokio`.
 - **Native consumers**: `quilt-cli`, `quilt-sync/src-tauri`.

docs/architecture.md

@@ -9,6 +9,12 @@
 <!-- markdownlint-disable MD013 -->
 # Changelog
 
+## [v0.27.1-alpha4] - 2026-07-08
+
+### Changed
+
+- Committing or publishing a package that fails its bucket's workflow is now refused, naming the rule it violated, including when a first `quilt push` attaches the remote (<https://github.com/quiltdata/quilt-rs/pull/753>)
+
 ## [v0.27.1-alpha3] - 2026-07-08
 
 ### Changed

quilt-cli/CHANGELOG.md

@@ -2,7 +2,7 @@
 name = "quilt-cli"
 description = "Command-line interface for Quilt data packages"
 
-version = "0.27.1-alpha3"
+version = "0.27.1-alpha4"
 
 # Inherit from workspace
 edition.workspace = true
@@ -32,6 +32,10 @@ tracing.workspace = true
 tracing-subscriber.workspace = true
 
 [dev-dependencies]
+# Pull quilt-rs with the `testing` feature so CLI tests can drive flows against
+# the in-memory mock remote. Kept out of the normal dependency above so the
+# mock never leaks into release builds.
+quilt-rs = { path = "../quilt-rs", version = "0.33.0-alpha1", features = ["testing"] }
 test-log.workspace = true
 
 # pkg-url overridden: workspace tags as `quilt-cli/v<version>`, not

quilt-cli/Cargo.toml

@@ -176,6 +176,55 @@ mod tests {
         Ok(())
     }
 
+    /// A commit that violates its workflow's `metadata_schema` must surface a
+    /// clear CLI error. The `my-workflow` gate requires `Date`/`Name`/`Owner`/
+    /// `Type` in the package metadata; committing with `Clear` (no metadata)
+    /// against that same workflow is rejected, and the message the user sees
+    /// must name the failing rule (`metadata_schema`) and every missing field.
+    #[test(tokio::test)]
+    async fn test_commit_rejected_by_workflow_surfaces_clear_error() -> Result<(), Error> {
+        use crate::cli::fixtures::packages::my_workflow as pkg;
+
+        let uri = pkg::URI;
+        let (m, _installed_package, _tempdir) = install_package_into_temp_dir(uri).await?;
+        let local_domain = m.get_local_domain();
+
+        let err = model(
+            local_domain,
+            Input {
+                message: pkg::MESSAGE.to_string(),
+                namespace: pkg::NAMESPACE.into(),
+                user_meta: UserMeta::Clear,
+                workflow: WorkflowIntent::Named("my-workflow".to_string()),
+                host_config: None,
+            },
+        )
+        .await
+        .unwrap_err();
+
+        let message = err.to_string();
+        // The CLI wraps the quilt-rs error transparently, so the validator's own
+        // wording reaches the user verbatim.
+        assert!(
+            message.starts_with("quilt_rs error: package does not satisfy the workflow"),
+            "message must announce a workflow rejection, got: {message}"
+        );
+        // Names the failing rule …
+        assert!(
+            message.contains("metadata_schema"),
+            "message must name the failing rule, got: {message}"
+        );
+        // … and every field the schema requires (order-independent).
+        for field in ["Date", "Name", "Owner", "Type"] {
+            assert!(
+                message.contains(field),
+                "message must name the missing field {field}, got: {message}"
+            );
+        }
+
+        Ok(())
+    }
+
     #[test(tokio::test)]
     async fn test_commit_package_with_workflow_and_meta() -> Result<(), Error> {
         use crate::cli::fixtures::packages::my_workflow as pkg;

quilt-cli/src/cli/commit.rs

@@ -137,6 +137,157 @@ mod tests {
         Ok(())
     }
 
+    /// A push re-validates the revision against the destination bucket's
+    /// **current** workflow config, not the version-pinned config the commit
+    /// resolved against. A package committed valid under a permissive config is
+    /// rejected once the bucket owner tightens that config — and the rejection
+    /// surfaces at the CLI boundary with the validator's own wording, naming the
+    /// failing rule (`metadata_schema`) and the missing field (`owner`).
+    ///
+    /// This drives `InstalledPackage::push` (the call `push::model` makes)
+    /// against an in-memory mock bucket, exposed by quilt-rs's `testing`
+    /// feature — the only way to script the "config mutates between commit and
+    /// push" scenario a live bucket cannot reproduce. It mirrors the commit-side
+    /// `test_commit_rejected_by_workflow_surfaces_clear_error`.
+    #[test(tokio::test)]
+    async fn test_push_rejected_by_mutated_workflow_surfaces_clear_error() -> Result<(), Error> {
+        use quilt_rs::InstalledPackage;
+        use quilt_rs::io::remote::Remote;
+        use quilt_rs::io::remote::mocks::MockRemote;
+        use quilt_rs::lineage::DomainLineageIo;
+        use quilt_rs::lineage::Home;
+        use quilt_rs::lineage::PackageLineageIo;
+        use quilt_rs::manifest::Workflow;
+        use quilt_rs::manifest::WorkflowId;
+        use quilt_rs::paths::DomainPaths;
+        use quilt_uri::S3Uri;
+        use tempfile::TempDir;
+
+        let home_dir = TempDir::new()?;
+        let paths_dir = TempDir::new()?;
+        let storage = LocalStorage::new();
+        let remote = MockRemote::default();
+        let namespace: Namespace = ("reference", "push-gate").into();
+        let home = Home::new(home_dir.path().to_path_buf());
+        let paths = DomainPaths::new(paths_dir.path().to_path_buf());
+
+        paths
+            .scaffold_for_installing(&storage, &home, &namespace)
+            .await?;
+
+        // A brand-new local package: a commit will be stamped below, and only
+        // then is the remote attached, mirroring `create → commit → set-remote`.
+        let lineage_json = format!(
+            r#"{{
+                "packages": {{
+                    "reference/push-gate": {{
+                        "commit": null,
+                        "remote": null,
+                        "base_hash": "",
+                        "latest_hash": "",
+                        "paths": {{}}
+                    }}
+                }},
+                "home": "{}"
+            }}"#,
+            home_dir.path().display()
+        );
+        storage
+            .write_byte_stream(&paths.lineage(), lineage_json.as_bytes().to_vec().into())
+            .await?;
+
+        let config_uri = S3Uri::try_from("s3://b/.quilt/workflows/config.yml")?;
+        // Config v1: a permissive `gate` workflow with no metadata_schema.
+        remote
+            .put_object(
+                &None,
+                &config_uri,
+                b"version: \"1\"\nworkflows:\n  gate:\n    name: Gate\n".to_vec(),
+            )
+            .await?;
+
+        let package = InstalledPackage {
+            lineage: PackageLineageIo::new(
+                DomainLineageIo::new(paths.lineage()),
+                namespace.clone(),
+            ),
+            paths,
+            remote,
+            storage,
+            namespace: namespace.clone(),
+        };
+
+        // Commit valid under v1: the `gate` workflow (which declares no
+        // metadata_schema) is stamped into the header, so clearing the
+        // package metadata passes the commit-time gate.
+        let workflow = Workflow {
+            config: config_uri.to_string().parse()?,
+            id: Some(WorkflowId {
+                id: "gate".to_string(),
+                metadata: None,
+            }),
+        };
+        package
+            .commit(
+                "governed commit".to_string(),
+                UserMeta::Clear,
+                Some(workflow),
+                None,
+            )
+            .await?;
+
+        // Attach the governed bucket `b` now, first-push (no remote hash yet),
+        // so push skips the remote-manifest browse and reaches the gate.
+        package
+            .set_remote("b".to_string(), None, WorkflowIntent::BucketDefault)
+            .await?;
+
+        // The bucket owner tightens the *current* config: `gate` now requires an
+        // `owner` key the committed (cleared) metadata lacks. Removing this
+        // mutation is the discriminating (RED-equivalent) run: the push then
+        // clears the gate and succeeds, and the rejection assertions fail.
+        package
+            .remote
+            .put_object(
+                &None,
+                &config_uri,
+                b"version: \"1\"\nworkflows:\n  gate:\n    name: Gate\n    metadata_schema: meta\nschemas:\n  meta:\n    url: s3://b/schemas/meta.json\n".to_vec(),
+            )
+            .await?;
+        package
+            .remote
+            .put_object(
+                &None,
+                &S3Uri::try_from("s3://b/schemas/meta.json")?,
+                br#"{"type": "object", "required": ["owner"]}"#.to_vec(),
+            )
+            .await?;
+
+        // Push re-resolves the current config and rejects the identical
+        // manifest. The CLI wraps the quilt-rs error transparently, so the
+        // validator's own wording reaches the user verbatim.
+        let Err(err) = package.push(None).await else {
+            return Err(Error::Test(
+                "push must be rejected by the tightened workflow config".to_string(),
+            ));
+        };
+        let message = Error::from(err).to_string();
+        assert!(
+            message.starts_with("quilt_rs error: package does not satisfy the workflow"),
+            "message must announce a workflow rejection, got: {message}"
+        );
+        assert!(
+            message.contains("metadata_schema"),
+            "message must name the failing rule, got: {message}"
+        );
+        assert!(
+            message.contains("owner"),
+            "message must name the missing field, got: {message}"
+        );
+
+        Ok(())
+    }
+
     /// Verifies that push command returns error when there are no commits:
     ///   * installs a package but makes no commits
     ///   * attempts to push without commits

quilt-cli/src/cli/push.rs

@@ -9,6 +9,13 @@
 <!-- markdownlint-disable MD013 -->
 # Changelog
 
+## [v0.33.0-alpha5] - 2026-07-08
+
+### Added
+
+- A candidate package is now validated against its workflow (metadata and entries schemas, handle pattern, message-required, workflow-required) — the resolved workflow at commit and `set_remote`, the destination bucket's current workflow configuration at push — and an invalid package is refused with the failing rule while its previous state is left untouched (<https://github.com/quiltdata/quilt-rs/pull/753>)
+- A `.quilt/workflows/config.yml` is now validated against quilt3's config schema when loaded, so a malformed config (e.g. a mistyped field) is refused everywhere instead of silently disabling the rule the bucket owner expected to enforce (<https://github.com/quiltdata/quilt-rs/pull/753>)
+
 ## [v0.33.0-alpha4] - 2026-07-08
 
 ### Changed

quilt-rs/CHANGELOG.md

@@ -3,13 +3,18 @@ name = "quilt-rs"
 description = "Rust library for accessing Quilt data packages."
 
 # Inherit from workspace
-version = "0.33.0-alpha4"
+version = "0.33.0-alpha5"
 edition.workspace = true
 rust-version.workspace = true
 license.workspace = true
 repository.workspace = true
 homepage.workspace = true
 
+[features]
+# Exposes the in-memory mock `Remote`/`Storage` implementations so downstream
+# crates can drive quilt-rs flows against a fake bucket in their own tests.
+testing = []
+
 [dependencies]
 async-trait.workspace = true
 base64.workspace = true
@@ -24,9 +29,11 @@ getrandom.workspace = true
 gitignores.workspace = true
 hex.workspace = true
 ignore.workspace = true
+jsonschema.workspace = true
 multibase.workspace = true
 multihash.workspace = true
 percent-encoding.workspace = true
+regex.workspace = true
 reqwest.workspace = true
 reqwest-middleware.workspace = true
 reqwest-retry.workspace = true

quilt-rs/Cargo.toml

@@ -7,6 +7,7 @@ use reqwest::header::ToStrError;
 use thiserror::Error;
 
 use crate::io::remote::HostChecksums;
+use crate::workflow::WorkflowValidationError;
 use quilt_uri::Host;
 use quilt_uri::Namespace;
 use quilt_uri::UriError;
@@ -306,6 +307,9 @@ pub enum Error {
     #[error("UTF-8 error: {0}")]
     Utf8(#[from] Utf8Error),
 
+    #[error(transparent)]
+    WorkflowValidation(#[from] WorkflowValidationError),
+
     #[error("YAML error: {0}")]
     Yaml(#[from] serde_yaml::Error),
 }