@abelxiaoxing/cadence 1.6.0 → 1.8.0

package/src/durable-contracts.ts

@@ -1,5 +1,8 @@
 import type { ArtifactStore } from "./artifact-store.ts";
-import type { StructuredVerificationContract } from "./contracts.ts";
+import type {
+  StructuredVerificationContract,
+  VerificationInputObservation,
+} from "./contracts.ts";
 import type { ImplementPlan, PlanTaskDraft } from "./delivery-compiler.ts";
 import type { RoutePolicy, WorkerRoutePolicy } from "./route-policy.ts";
 
@@ -15,6 +18,7 @@ import type {
   WorkflowContextRequest,
   WorkflowDeliverySource,
   WorkflowRecoveryFeedback,
+  WorkflowVerificationPrerequisite,
 } from "./workflow-policy.ts";
 
 import type { WorkspaceStore } from "./workspace-store.ts";
@@ -38,6 +42,7 @@ export type DurablePhaseVerificationResult =
       ok: false;
       kind: "paused" | "retryable" | "approval-needed";
       code: string;
+      inputObservation?: VerificationInputObservation;
     };
 
 export type DurableChangeVerificationResult =
@@ -60,6 +65,7 @@ export type DurableChangeVerificationResult =
       code: string;
       failureIdentities?: string[];
       attributionReliable?: boolean;
+      inputObservation?: VerificationInputObservation;
     };
 
 export interface DurableVerificationObservation {
@@ -68,6 +74,8 @@ export interface DurableVerificationObservation {
   failureIdentities: string[];
   code?: string;
   attributionReliable?: boolean;
+  /** Code-owned comparable verification obligation, excluding display identity. */
+  contractIdentity?: string;
 }
 
 export interface DurableVerificationBaseline {
@@ -89,7 +97,11 @@ export type DurableObservedVerification =
   | {
       ok: false;
       outcome:
-        | { kind: "paused"; code: string }
+        | {
+            kind: "paused";
+            code: string;
+            prerequisite?: WorkflowVerificationPrerequisite;
+          }
         | { kind: "approval-needed"; code: string }
         | { kind: "operation-cancelled"; code: "cancelled" };
     };
@@ -161,6 +173,8 @@ export interface DurableWorkflowEngineOptions {
   leaseTtlMs?: number;
   workHardLimit?: number;
   verificationPolicy?: string;
+  /** Real process executors must settle cancellation before post-apply cleanup. */
+  awaitPostApplySettlement?: boolean;
   verificationEnvironment?(
     plan: ImplementPlan,
     signal: AbortSignal,
@@ -175,11 +189,15 @@ export interface DurableExecutionResources {
   artifacts: ArtifactStore;
   workspaces: WorkspaceStore;
   ledgers: Map<number, TaskLedger>;
+  /** Run-shared original-baseline observations, independent of delivery revision. */
+  baselineLedger?: TaskLedger;
   baselineRevisionId: string;
+  /** Root capture before any authorized boundary expansion; immutable evidence source. */
+  originalBaselineRevisionId?: string;
   currentRevisionId: string;
   mergeTail: Promise<void>;
   verificationFact?: object;
-  baselinePromises: Map<number, Promise<DurableBaselineResult>>;
+  baselinePromises: Map<string | number, Promise<DurableBaselineResult>>;
   environmentIdentity?: string;
 }
 

package/src/durable-workflow.ts

@@ -1,16 +1,13 @@
-import {
-  ChangeVerification,
-  parseVerificationBaseline,
-  sha256Bytes,
-  verificationBaselineFact,
-} from "./change-verification.ts";
+import { ChangeVerification, sha256Bytes } from "./change-verification.ts";
 import type {
   DurableExecutionResources,
   DurablePhaseFact,
   DurableResourceInput,
   DurableWorkflowEngineOptions,
 } from "./durable-contracts.ts";
+import { assertExecutionsSettled } from "./execution-retention.ts";
 import { PhaseExecution } from "./phase-execution.ts";
+import { removePathSync } from "./remove-path.ts";
 
 export type {
   DurableChangeVerificationResult,
@@ -23,7 +20,7 @@ interface DurableRunResources extends DurableExecutionResources {
   closed: boolean;
 }
 
-import { lstatSync, mkdirSync, readFileSync, rmSync } from "node:fs";
+import { lstatSync, mkdirSync, readFileSync } from "node:fs";
 import path from "node:path";
 import { DatabaseSync } from "node:sqlite";
 import { ApplyTransaction } from "./apply-transaction.ts";
@@ -281,6 +278,7 @@ class DurableWorkflowComposition
     signal: AbortSignal,
   ): Promise<DurableRunResources> {
     signal.throwIfAborted();
+    assertExecutionsSettled(this.#options.stateRoot.rootDir);
     const pending = this.#initializing.get(input.runId);
     if (pending) return pending;
     if (
@@ -330,6 +328,7 @@ class DurableWorkflowComposition
     baselineRevisionId?: string;
     currentWorkspaceRevisionId?: string;
   }): DurableRunResources {
+    assertExecutionsSettled(this.#options.stateRoot.rootDir);
     const existing = this.#runs.get(input.runId);
     if (existing) {
       if (
@@ -358,7 +357,16 @@ class DurableWorkflowComposition
     const currentRevisionId = input.currentWorkspaceRevisionId;
     if (!baselineRevisionId || !currentRevisionId)
       throw new Error("workflow-workspace-revision-unavailable");
-    workspaces.getRevision(baselineRevisionId);
+    let originalBaseline = workspaces.getRevision(baselineRevisionId);
+    const ancestors = new Set<string>();
+    while (originalBaseline.parentRevisionId !== null) {
+      if (ancestors.has(originalBaseline.revisionId))
+        throw new Error("workflow-baseline-revision-conflict");
+      ancestors.add(originalBaseline.revisionId);
+      originalBaseline = workspaces.getRevision(
+        originalBaseline.parentRevisionId,
+      );
+    }
     workspaces.getRevision(currentRevisionId);
     let resources!: DurableRunResources;
     const transactions = new ApplyTransaction({
@@ -366,6 +374,7 @@ class DurableWorkflowComposition
       artifacts,
       workspaces,
       hooks: {
+        awaitPostApplySettlement: this.#options.awaitPostApplySettlement,
         postApply: ({ transactionId, root: verificationRoot, signal }) =>
           this.#verification.verifyPostApply(
             resources,
@@ -385,11 +394,13 @@ class DurableWorkflowComposition
       ledgers: new Map(),
       transactions,
       baselineRevisionId,
+      originalBaselineRevisionId: originalBaseline.revisionId,
       currentRevisionId,
       mergeTail: Promise.resolve(),
       baselinePromises: new Map(),
       closed: false,
     };
+    resources.baselineLedger = this.#ledger(resources, 1);
     this.#runs.set(input.runId, resources);
     return resources;
   }
@@ -729,37 +740,10 @@ class DurableWorkflowComposition
       }
       if (!grew) break;
     }
-    if (hasVerificationLifecycle(input.plan)) {
-      const retainedRevisions = new Set(
-        input.tasks
-          .filter((task) => !invalidated.has(task.taskId))
-          .map((task) => task.deliveryRevision),
-      );
-      for (const deliveryRevision of retainedRevisions) {
-        const ledger = this.#ledger(resources, deliveryRevision);
-        const stored = ledger.durableFact(
-          this.#verification.baselineFactKey(resources),
-        );
-        resources.baselinePromises.delete(deliveryRevision);
-        if (stored === undefined) continue;
-        const baseline = parseVerificationBaseline(stored, resources.artifacts);
-        if (baseline.revisionId === expandedBaseline.revisionId) continue;
-        if (baseline.revisionId !== input.baselineRevisionId) {
-          throw new Error("workflow-verification-baseline-conflict");
-        }
-        ledger.replaceDurableFact(
-          this.#verification.baselineFactKey(resources),
-          stored,
-          verificationBaselineFact(
-            {
-              ...baseline,
-              revisionId: expandedBaseline.revisionId,
-            },
-            resources.artifacts,
-          ),
-        );
-      }
-    }
+    // Boundary expansion changes candidate/apply inputs, never the root capture
+    // or its verification observations. Their contract-bound caches revalidate
+    // only the obligations changed by this delivery.
+    resources.baselinePromises.clear();
     resources.baselineRevisionId = expandedBaseline.revisionId;
     resources.currentRevisionId = rebuilt.revisionId;
     if (hasVerificationLifecycle(input.plan)) {
@@ -914,12 +898,13 @@ class DurableWorkflowComposition
   }
 
   cleanup(runId: string): void {
+    assertExecutionsSettled(this.#options.stateRoot.rootDir, true);
     const resources = this.#runs.get(runId);
     if (resources) {
       this.#closeResources(resources);
       this.#runs.delete(runId);
     }
-    rmSync(this.#runRoot(runId), { recursive: true, force: true });
+    removePathSync(this.#runRoot(runId), { recursive: true, force: true });
   }
 
   close(): void {
@@ -932,6 +917,36 @@ class DurableWorkflowComposition
   runAttempt(input: Parameters<WorkflowWorker["runAttempt"]>[0]) {
     return this.#phase.runAttempt(input);
   }
+
+  async prepareTask(input: Parameters<WorkflowWorker["runAttempt"]>[0]) {
+    const resources = await this.#prepareResources(input, input.signal);
+    const workspace = {
+      baselineRevisionId: resources.baselineRevisionId,
+      currentWorkspaceRevisionId: resources.currentRevisionId,
+    };
+    if (hasVerificationLifecycle(input.plan)) {
+      const captured = await this.#verification.ensureVerificationBaseline({
+        resources,
+        ledger: this.#ledger(resources, input.deliveryRevision),
+        taskId: input.taskId,
+        signal: input.signal,
+      });
+      if (!captured.ok)
+        return {
+          ...captured.outcome,
+          ...workspace,
+          ...(captured.outcome.kind === "paused"
+            ? {
+                verification: {
+                  scope: "baseline" as const,
+                  attribution: "environment" as const,
+                },
+              }
+            : {}),
+        };
+    }
+    return { kind: "prepared" as const, ...workspace };
+  }
   hasPendingVerification(input: Parameters<WorkflowWorker["runAttempt"]>[0]) {
     return this.#phase.hasPendingVerification(input);
   }

package/src/execution-profile.ts

@@ -1,8 +1,12 @@
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
 export interface ExecutionProfile {
-  mode: "isolated" | "local-trusted";
+  mode: "isolated" | "local-trusted" | "host-trusted";
   timeoutMs: number;
   bwrapPath: string;
   inheritEnvironment: string[];
+  windowsHelperPath?: string;
 }
 
 /** Operator configuration only. Unknown modes never silently disable isolation. */
@@ -10,7 +14,11 @@ export function executionProfile(
   env: NodeJS.ProcessEnv = process.env,
 ): ExecutionProfile {
   const mode = env.ABEL_EXECUTION_MODE ?? "isolated";
-  if (mode !== "isolated" && mode !== "local-trusted")
+  if (
+    mode !== "isolated" &&
+    mode !== "local-trusted" &&
+    mode !== "host-trusted"
+  )
     throw new Error("execution-mode-invalid");
   const timeoutMs = Number(env.ABEL_VERIFICATION_TIMEOUT_MS ?? 600_000);
   if (
@@ -29,10 +37,28 @@ export function executionProfile(
     throw new Error("verification-environment-names-invalid");
   if (mode === "isolated" && inheritEnvironment.length)
     throw new Error("verification-environment-requires-trusted-mode");
+  if (
+    mode === "host-trusted" &&
+    env.ABEL_WINDOWS_JOB_HELPER !== undefined &&
+    (!env.ABEL_WINDOWS_JOB_HELPER ||
+      env.ABEL_WINDOWS_JOB_HELPER.includes("\0") ||
+      !(
+        path.isAbsolute(env.ABEL_WINDOWS_JOB_HELPER) ||
+        path.win32.isAbsolute(env.ABEL_WINDOWS_JOB_HELPER)
+      ))
+  )
+    throw new Error("windows-job-helper-path-invalid");
   return {
     mode,
     timeoutMs,
     bwrapPath: env.ABEL_BWRAP_PATH ?? "/usr/bin/bwrap",
     inheritEnvironment,
+    ...(mode === "host-trusted"
+      ? {
+          windowsHelperPath:
+            env.ABEL_WINDOWS_JOB_HELPER ??
+            fileURLToPath(new URL("./windows-job.exe", import.meta.url)),
+        }
+      : {}),
   };
 }

package/src/execution-retention.ts

@@ -0,0 +1,77 @@
+import { randomUUID } from "node:crypto";
+import {
+  closeSync,
+  fsyncSync,
+  lstatSync,
+  openSync,
+  readdirSync,
+  unlinkSync,
+  writeFileSync,
+} from "node:fs";
+import path from "node:path";
+import { syncDirectory } from "./directory-sync.ts";
+
+const prefix = ".cadence-execution-";
+const active = new Set<string>();
+const retained = new Map<string, readonly string[]>();
+/** Written before launching a host process. Absence of a settlement receipt
+ * survives host loss; reopening must not infer ownership from a recycled PID. */
+export function retainExecution(ownerRoot: string, roots: readonly string[]) {
+  assertExecutionsSettled(ownerRoot);
+  const file = path.join(ownerRoot, `${prefix}${randomUUID()}.json`);
+  const fd = openSync(file, "wx", 0o600);
+  try {
+    writeFileSync(
+      fd,
+      JSON.stringify({
+        version: 1,
+        roots: roots.map((root) => path.resolve(root)),
+      }),
+    );
+    fsyncSync(fd);
+  } finally {
+    closeSync(fd);
+  }
+  syncDirectory(ownerRoot);
+  active.add(file);
+  retained.set(file, roots);
+  return {
+    settled() {
+      unlinkSync(file);
+      syncDirectory(ownerRoot);
+      active.delete(file);
+      retained.delete(file);
+    },
+    uncertain() {
+      active.delete(file);
+    },
+  };
+}
+export function assertExecutionsSettled(
+  ownerRoot: string,
+  includeActive = false,
+): void {
+  if (!lstatSync(ownerRoot, { throwIfNoEntry: false })) return;
+  if (
+    readdirSync(ownerRoot).some(
+      (name) =>
+        name.startsWith(prefix) &&
+        (includeActive || !active.has(path.join(ownerRoot, name))),
+    )
+  )
+    throw new Error("isolation-termination-unconfirmed");
+}
+export function isExecutionRetained(root: string): boolean {
+  const resolved = path.resolve(root);
+  return [...retained.values()].some((roots) =>
+    roots.some((candidate) => {
+      const relative = path.relative(resolved, path.resolve(candidate));
+      return (
+        relative === "" ||
+        (relative !== ".." &&
+          !relative.startsWith(`..${path.sep}`) &&
+          !path.isAbsolute(relative))
+      );
+    }),
+  );
+}