@amalgm/shell 0.1.164-preview.34226938713 → 0.1.164-preview.34240142223

package/PURPOSE.md

@@ -70,12 +70,17 @@ Fixture cleanup preserves the original failure and every cleanup failure; instal
 state remains available when its native owner cannot be removed.
 A fixture's process lease covers its final writes, and its native release fences
 cleanup after either cooperative or forced exit.
+Fixture termination is proved by releasing its owned native resources; an HTTP
+stop acknowledgement or transport failure cannot substitute for that proof.
 A fixture publishes file-based readiness only after its complete evidence is
 atomically visible to the observing process.
 Native certification runs independent fixture files serially on its shared host,
 while each fixture retains the concurrent load required by its examination.
 The certifying producer owns fixture orchestration and loads production adapters
 from the exact installed archive, without modifying that archive's bytes.
+An outer fixture owner removes a temporary package only after the process loading
+its native libraries has closed and the package's native service owners have stopped.
+The final examination proof includes process completion and temporary-file cleanup.
 
 Shell owns both the internal `@amalgm/shell` package and the public `amalgm`
 distribution. One tested build supplies both archives; only package identity,

package/examinations/runtime-examination-process.mjs

@@ -0,0 +1,58 @@
+import assert from 'node:assert/strict';
+import { spawn } from 'node:child_process';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+/** The archive's owner never loads its native libraries. Only actual worker
+ * closure and successful native-owner cleanup permit removing its files. */
+export async function certifyRuntimeProcess(directory, signal,
+  script = fileURLToPath(new URL('./runtime-upgrade.native-test.mjs', import.meta.url))) {
+  const temporary = await fs.mkdtemp(path.join(os.tmpdir(), 'amalgm-native-runtime-update-'));
+  const errors = [];
+  let proof = { passed: false };
+  try {
+    await new Promise((resolve, reject) => {
+      // Invoke the worker directly: its close must belong to the process that
+      // imports the installed archive, rather than another test-runner parent.
+      const env = { ...process.env };
+      delete env.NODE_TEST_CONTEXT; // The direct worker reports its own tests, not its parent's binary test protocol.
+      const child = spawn(process.execPath, [script, '--runtime-examination-worker', temporary],
+        { env, stdio: 'inherit', windowsHide: true });
+      let launchError;
+      const cancel = () => child.kill('SIGKILL');
+      signal.addEventListener('abort', cancel, { once: true });
+      child.once('error', error => { launchError = error; });
+      child.once('close', (code, exitSignal) => {
+        signal.removeEventListener('abort', cancel);
+        if (launchError) reject(launchError);
+        else if (signal.aborted) reject(signal.reason);
+        else if (code !== 0) reject(new Error(`Native runtime examination process failed (${exitSignal ?? code}); see its output above`));
+        else resolve();
+      });
+      if (signal.aborted) cancel();
+    });
+  } catch (error) { errors.push(error); }
+  try {
+    const observed = JSON.parse(await fs.readFile(path.join(temporary, 'proof.json'), 'utf8'));
+    assert.ok(observed && typeof observed === 'object' && !Array.isArray(observed), 'The worker must leave an examination proof');
+    proof = observed;
+    assert.equal(typeof proof.passed, 'boolean');
+    assert.equal(proof.cleanupComplete, true, 'Native fixture owners did not prove cleanup; temporary package retained');
+    if (!proof.passed) errors.push(new Error('Native runtime examination did not pass'));
+    // Database close cannot unload a native DLL; worker close above supplies
+    // that lifetime fence. Retry counts do not substitute for this ordering.
+    await fs.rm(temporary, { recursive: true, force: true });
+  } catch (error) {
+    errors.push(error);
+    proof.retainedTemporary = temporary;
+  }
+  proof.passed = proof.passed === true && errors.length === 0;
+  if (errors.length) proof.processErrors = errors.map(error => String(error.message));
+  try {
+    await fs.writeFile(path.join(directory, `runtime-update-${process.platform}.json`), JSON.stringify(proof, null, 2) + '\n');
+  } catch (error) { errors.push(error); }
+  if (errors.length) throw new AggregateError(errors, 'Native runtime examination process or package cleanup failed');
+  return proof;
+}

package/examinations/runtime-upgrade.native-test.mjs

@@ -3,7 +3,6 @@ import assert from 'node:assert/strict';
 import crypto from 'node:crypto';
 import fs from 'node:fs/promises';
 import { constants, createWriteStream } from 'node:fs';
-import os from 'node:os';
 import path from 'node:path';
 import { createRequire } from 'node:module';
 import { pathToFileURL } from 'node:url';
@@ -17,6 +16,7 @@ import { examineArchive, hashFile, runIsolated } from '../dist/updates/artifacts
 import { runtimeHost } from '../dist/updates/store.js';
 import { canonicalHost, startNetworkView } from './network-view.mjs';
 import { nativeInstalledService } from './native-service.mjs';
+import { certifyRuntimeProcess } from './runtime-examination-process.mjs';
 
 const encode = value => Buffer.from(JSON.stringify(value) + '\n');
 const digest = value => crypto.createHash('sha256').update(encode(value)).digest('hex');
@@ -166,13 +166,15 @@ export function runtimeExaminationView(examination, baselineReceipt) {
   return { baseline, candidate, immutable, previous: view(examination.previous), candidateView: view(examination.candidate), events: `${scope}/events` };
 }
 
+const workerTemporary = process.argv[2] === '--runtime-examination-worker' ? process.argv[3] : undefined;
 test('the real native Shell service replaces its authorized package and survives OS restart with identity and state intact', {
-  skip: process.env.AMALGM_TEST_NATIVE_RUNTIME_UPDATES !== '1', timeout: 1_800_000,
+  skip: process.env.AMALGM_TEST_NATIVE_RUNTIME_UPDATES !== '1', timeout: workerTemporary ? undefined : 1_800_000,
 }, async t => {
   assert.equal(process.env.CI, 'true'); assert.equal(process.env.GITHUB_ACTIONS, 'true');
   assert.ok(['darwin', 'linux', 'win32'].includes(process.platform));
   assert.ok(process.env.AMALGM_RUNTIME_EXAMINATION_DIR, 'The producer must supply signed examination inputs');
   const directory = path.resolve(process.env.AMALGM_RUNTIME_EXAMINATION_DIR);
+  if (!workerTemporary) return await certifyRuntimeProcess(directory, t.signal);
   const examination = await readJson(path.join(directory, 'examination.json'));
   const baselineReceipt = examination.previous ? null : await readJson(path.join(directory, 'baseline.json'));
   const view = runtimeExaminationView(examination, baselineReceipt);
@@ -183,8 +185,8 @@ test('the real native Shell service replaces its authorized package and survives
     previousDigest: view.baseline.digest, candidateDigest: view.candidate.digest,
     bootstrapProof: examination.previous === null, legacyAdoptionCertified: false, passed: false,
     previousArtifact: artifact, candidateArtifact: nextArtifact, checkpoints: [] };
-  const temporary = await fs.mkdtemp(path.join(os.tmpdir(), 'amalgm-native-runtime-update-'));
-  let network; let service;
+  const temporary = path.resolve(workerTemporary);
+  let network; let service; let initializingFixtures = false;
   t.after(async () => {
     const errors = [];
     if (!proof.passed) {
@@ -197,9 +199,10 @@ test('the real native Shell service replaces its authorized package and survives
     }
     try { await service?.close(); } catch (error) { errors.push(error); }
     try { await network?.close(); } catch (error) { errors.push(error); }
+    if (initializingFixtures) errors.push(new Error('Native fixture initialization did not return every cleanup owner'));
+    proof.cleanupComplete = errors.length === 0;
     if (errors.length) { proof.passed = false; proof.cleanupErrors = errors.map(error => error.message); }
-    await fs.writeFile(path.join(directory, `runtime-update-${process.platform}.json`), JSON.stringify(proof, null, 2) + '\n');
-    await fs.rm(temporary, { recursive: true, force: true, maxRetries: 5 });
+    await fs.writeFile(path.join(temporary, 'proof.json'), JSON.stringify(proof, null, 2) + '\n');
     if (errors.length) throw new AggregateError(errors, 'Native runtime examination cleanup failed');
   });
   const archive = path.join(temporary, 'baseline.tgz');
@@ -217,9 +220,11 @@ test('the real native Shell service replaces its authorized package and survives
   assert.deepEqual(shippedRoot, examination.roots[shippedRoot.signed.version - 1], 'The package must carry the actual reviewed trust root');
   const npm = path.join(path.dirname(createRequire(import.meta.url).resolve('npm/package.json')), 'bin/npm-cli.js');
   await runIsolated(process.execPath, [npm, 'ci', '--omit=dev', '--strict-allow-scripts', '--no-audit', '--no-fund'], packageRoot, new AbortController().signal);
+  initializingFixtures = true;
   network = await startNetworkView({ temporary, immutable: view.immutable, previous: view.previous, candidate: view.candidateView,
     events: view.events, hint: { id: examination.id, sequence: examination.candidate.target.sequence }, serviceEnvironment: true });
   service = await nativeInstalledService({ packageRoot, label: examination.lane });
+  initializingFixtures = false;
   const baseline = await until('Verified installed baseline and native service health', async () => {
     const state = journal(service.identity); const status = await service.status();
     return state.policy?.active?.digest === view.baseline.digest && state.policy.activeHealthy

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@amalgm/shell",
-  "version": "0.1.164-preview.34226938713",
+  "version": "0.1.164-preview.34240142223",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@amalgm/shell",
-      "version": "0.1.164-preview.34226938713",
+      "version": "0.1.164-preview.34240142223",
       "license": "UNLICENSED",
       "dependencies": {
         "@amalgm/agents": "0.2.3-preview.34176069706",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amalgm/shell",
-  "version": "0.1.164-preview.34226938713",
+  "version": "0.1.164-preview.34240142223",
   "description": "The Amalgm runtime host assembled from the published @amalgm SDK capabilities.",
   "type": "module",
   "private": false,
@@ -151,11 +151,11 @@
       }
     ]
   },
-  "gitHead": "bb88f9e662f3fa9eaaf2750248400e7d1ad86380",
+  "gitHead": "898af33d9eb9c7b8cfb73cfe8fe0562e486925da",
   "amalgmSource": {
     "repository": "amalgm-inc/amalgm-shell",
     "branch": "preview",
-    "commit": "bb88f9e662f3fa9eaaf2750248400e7d1ad86380",
-    "occurrence": "34226938713"
+    "commit": "898af33d9eb9c7b8cfb73cfe8fe0562e486925da",
+    "occurrence": "34240142223"
   }
 }