@casecore/release-agent 0.1.4 → 0.1.6

package/README.md

@@ -13,7 +13,7 @@
 ## Подключение
 
 ```sh
-pnpm add --save-exact @casecore/release-agent@0.1.0
+pnpm add --save-exact @casecore/release-agent@0.1.6
 ```
 
 В проекте фиксируются точная версия и `pnpm-lock.yaml`. Поддерживается Node.js
@@ -281,3 +281,45 @@ RELEASE_AGENT_TARBALL=/absolute/path/casecore-release-agent-0.1.0.tgz \
 
 Запуск проверок и сборок должен учитывать действующее разрешение владельца задачи;
 наличие команд и тестов не является подтверждением их успешного выполнения.
+
+## Завершение исходной попытки публикации
+
+Начиная с 0.1.6 адаптер может реализовать `publicationTerminal(command, context)`.
+Движок вызывает его после сохранения подтверждённого результата `deployed` либо
+штатного `failed` до установки. Адаптер закрывает свой исходный журнал под своей
+блокировкой; общий движок и исходные часы выполнения остаются единственными.
+
+`readPublicationTerminalAuthority(context.authority, context.bindings)` возвращает
+подтверждённый результат с точной исходной командой, исполнителем, кандидатом и
+исходными часами. Поле `artifactIdentity` отдельно хранит подписанную идентичность
+артефакта: её SHA может отличаться от SHA исходных изменений. Authority действует
+только внутри ограниченного 30 секундами callback; скопированный объект, snapshot
+или digest полномочия не дают. Перед записью адаптер проверяет `context.signal`.
+
+Ошибка callback сохраняет фактический результат установки и записывается в
+диагностику; она не подтверждает закрытие исходного журнала. Повторный
+`reconcile(commandId)` и восстановление после перезапуска получают новое
+полномочие только после свежей независимой проверки production либо штатного
+восстановления FAILED с native ACK. Запись адаптера должна быть идемпотентной для
+той же исходной попытки. Публикация 0.1.6 и обновление установок проверяются отдельно
+от локальной готовности этого исходного контракта.
+
+Для первой установки уже собранного артефакта тот же callback вызывается с
+`bindings.action: 'deploy'`. Его `repository` и `ref` берутся из сохранённого
+артефактного кандидата; исходные шесть полей `delivery` остаются неизменными.
+Адаптер обязан реализовать `verifyArtifactDelivery(command, identity, delivery,
+source, context)` и подтвердить подпись, исходную операцию и происхождение
+артефакта. `context.completedAt` — сохранённое время завершения установки.
+Повторное подтверждение после истечения срока проверяет этот результат и свежий
+production readback; новую установку или продление срока оно не разрешает.
+
+`await sealPublicationTerminalReceipt(authority, bindings, managementToken)`
+сохраняет заверенный результат в существующем журнале движка перед возвратом.
+`verifyPublicationTerminalReceipt(receipt, managementToken)` проверяет HMAC и
+возвращает данные, которые не являются authority. Токен управления уже должен
+быть настроен у обоих участников; передавать его с результатом нельзя.
+Авторизованный `GET /v1/release-control/publications/:commandId/terminal` читает
+сохранённый результат без нового workflow claim или запуска. Для результата,
+принятого через существующий report, адаптер может предоставить
+`readTerminalReceipt(commandId)`. Неизвестный результат возвращает 404;
+неподтверждённые ошибки установки не получают такой результат.

package/dist/exclusive-operation.mjs

@@ -18,6 +18,9 @@ function metadata(producer) {
   assert.ok(state, 'DELIVERY_OPERATION_BARRIER_REQUIRED');
   return state;
 }
+export function assertProducerOperation(producer) {
+  assert.ok(metadata(producer).activity > 0, 'DELIVERY_OPERATION_AUTHORITY_REQUIRED');
+}
 function pendingFailures(producer, state) {
   return [
     ...Object.values(producer.state.commands),

package/dist/producer-admission.mjs

@@ -151,6 +151,9 @@ export class ProducerAdmission extends ProducerState {
         command: structuredClone(input),
         baseline: structuredClone(current.installed),
         ...(publication && candidate ? { sourceCandidate: structuredClone(candidate) } : {}),
+        ...(!publication && input.action === 'deploy' && candidate?.deliveryExecution
+          ? { artifactCandidate: structuredClone(candidate) }
+          : {}),
         ...(candidate?.deliveryExecution ? { deliveryExecution: candidate.deliveryExecution } : {}),
         ack,
       };

package/dist/producer-delivery.mjs

@@ -6,7 +6,7 @@ export async function verifyPublicationDelivery(
   producer,
   command,
   delivery,
-  { fresh = true } = {}
+  { fresh = true, verification } = {}
 ) {
   assert.equal(command.action, 'publish');
   validateOriginalDelivery(delivery, command.expectedSource.sourceCommit);
@@ -19,7 +19,7 @@ export async function verifyPublicationDelivery(
     assert.deepEqual(item.deliveryExecution, delivery, 'Original published delivery changed');
   if (typeof producer.provider.verifyPublicationDelivery === 'function')
     assert.equal(
-      await producer.provider.verifyPublicationDelivery(command, delivery),
+      await producer.provider.verifyPublicationDelivery(command, delivery, verification),
       true,
       'Original delivery correlation was not verified'
     );

package/dist/producer-execution.mjs

@@ -1,4 +1,5 @@
 import assert from 'node:assert/strict';
+import { notifyPublicationTerminal } from './publication-terminal.mjs';
 import { canonical } from './protocol-internals.mjs';
 import { sameIdentity, acceptedProduction } from './protocol.mjs';
 import { blocker, failureMessage, failedProduction } from './producer-support.mjs';
@@ -6,10 +7,7 @@ import { ProducerPublication } from './producer-publication.mjs';
 
 export class ProducerExecution extends ProducerPublication {
   async qualifyForwardRecovery(run, command) {
-    if (
-      command.action === 'publish' &&
-      !this.state.commands[command.commandId]?.artifactIdentity
-    )
+    if (command.action === 'publish' && !this.state.commands[command.commandId]?.artifactIdentity)
       return;
     command = this.resolvedCommand(command);
     if (
@@ -49,33 +47,27 @@ export class ProducerExecution extends ProducerPublication {
           run.committedReadback = fact;
           run.completedAt ??= this.now().toISOString();
           for (const row of run.stages.filter((s) =>
-            ['running', 'unverified'].includes(s.status),
+            ['running', 'unverified'].includes(s.status)
           )) {
             row.status = 'failed';
             row.completedAt ??= run.completedAt;
             row.elapsedMs = row.startedAt
-              ? Math.max(
-                  0,
-                  Date.parse(row.completedAt) - Date.parse(row.startedAt),
-                )
+              ? Math.max(0, Date.parse(row.completedAt) - Date.parse(row.startedAt))
               : null;
-            row.failure = blocker(
-              'INTERRUPTED_PROOF',
-              'Подтверждение результата было прервано',
-            );
+            row.failure = blocker('INTERRUPTED_PROOF', 'Подтверждение результата было прервано');
           }
           run.blockers.push(
             blocker(
               'FORWARD_CORRECTION_REQUIRED',
-              'Установка завершена, приёмка не пройдена; требуется исправляющий релиз',
-            ),
+              'Установка завершена, приёмка не пройдена; требуется исправляющий релиз'
+            )
           );
           this.event(
             run.id,
             null,
             'failure',
             'Разрешён исправляющий релиз; исходная выкатка завершилась ошибкой',
-            'error',
+            'error'
           );
         }
       } catch (qualificationError) {
@@ -87,13 +79,12 @@ export class ProducerExecution extends ProducerPublication {
   }
   async execute(command, { activated = false } = {}) {
     const run = this.state.runs.find((r) => r.commandId === command.commandId);
-    const remaining = () =>
-      Date.parse(command.deadlineAt) - this.now().getTime();
+    const remaining = () => Date.parse(command.deadlineAt) - this.now().getTime();
     let suspended = false;
     const stage = async (
       id,
       operation,
-      { inputsDigest = null, reusedFromRunId = null, queuedAt = null } = {},
+      { inputsDigest = null, reusedFromRunId = null, queuedAt = null } = {}
     ) => {
       assert.ok(remaining() > 0, 'Original deadline exceeded');
       if (id === 'deploy') run.recoveryState = 'unverified';
@@ -103,8 +94,7 @@ export class ProducerExecution extends ProducerPublication {
         command.action === 'publish' &&
         this.provider.remotePublication === true &&
         row.startedAt !== null;
-      if (!retained || !['passed', 'reused'].includes(row.status))
-        row.status = 'running';
+      if (!retained || !['passed', 'reused'].includes(row.status)) row.status = 'running';
       if (!retained) row.startedAt = this.now().toISOString();
       if (!retained) row.inputsDigest = inputsDigest;
       if (!retained)
@@ -149,10 +139,7 @@ export class ProducerExecution extends ProducerPublication {
       } finally {
         if (!suspended) {
           row.completedAt = this.now().toISOString();
-          row.elapsedMs = Math.max(
-            0,
-            Date.parse(row.completedAt) - Date.parse(row.startedAt),
-          );
+          row.elapsedMs = Math.max(0, Date.parse(row.completedAt) - Date.parse(row.startedAt));
           this.event(run.id, id, 'stage', `${row.title}: ${row.status}`);
         }
         await this.save();
@@ -160,21 +147,15 @@ export class ProducerExecution extends ProducerPublication {
     };
     try {
       if (command.lane === 'scheduled' && !activated) {
-        assert.ok(
-          this.provider.announce,
-          'Scheduled notice transport is not configured',
-        );
+        assert.ok(this.provider.announce, 'Scheduled notice transport is not configured');
         await this.provider.announce(command);
         run.noticeAt = this.now().toISOString();
-        if (
-          Date.parse(command.activationAt) <
-          Date.parse(run.noticeAt) + 86400000
-        ) {
+        if (Date.parse(command.activationAt) < Date.parse(run.noticeAt) + 86400000) {
           run.status = 'blocked';
           run.blockers = [
             blocker(
               'NOTICE_WINDOW_TOO_SHORT',
-              'От фактического уведомления до установки должно пройти минимум 24 часа',
+              'От фактического уведомления до установки должно пройти минимум 24 часа'
             ),
           ];
           await this.save();
@@ -184,11 +165,7 @@ export class ProducerExecution extends ProducerPublication {
         // Scheduling is durable; reconciliation resumes after the activation time.
         run.status = 'queued';
         run.blockers = [
-          blocker(
-            'SCHEDULED_ACTIVATION',
-            'Ожидается согласованное окно установки',
-            true,
-          ),
+          blocker('SCHEDULED_ACTIVATION', 'Ожидается согласованное окно установки', true),
         ];
         await this.save();
         return;
@@ -202,27 +179,23 @@ export class ProducerExecution extends ProducerPublication {
         admitted?.ack.state === 'accepted' &&
         canonical(admitted.command) === canonical(command) &&
         Number.isFinite(Date.parse(run.noticeAt)) &&
-        Date.parse(command.activationAt) >=
-          Date.parse(run.noticeAt) + 86400000 &&
+        Date.parse(command.activationAt) >= Date.parse(run.noticeAt) + 86400000 &&
         Date.parse(command.activationAt) <= this.now().getTime();
       await this.provider.execute(command, {
         stage,
         remainingMs: remaining,
         admittedScheduled,
-        bindDelivery: (delivery) =>
-          this.bindPublicationDelivery(command, delivery),
+        bindDelivery: (delivery) => this.bindPublicationDelivery(command, delivery),
         bindArtifact: (identity, options) =>
           this.bindPublicationArtifact(command, identity, options),
         event: async (fact) => {
-          assert.ok(
-            ['source_ready', 'quality', 'source_merge'].includes(fact.stage),
-          );
+          assert.ok(['source_ready', 'quality', 'source_merge'].includes(fact.stage));
           assert.ok(['running', 'completed', 'failed'].includes(fact.status));
           this.event(
             run.id,
             fact.stage === 'source_ready' ? 'source_ready' : 'ci',
             'log',
-            `${fact.stage}: ${fact.status}`,
+            `${fact.stage}: ${fact.status}`
           );
           await this.save();
         },
@@ -232,7 +205,7 @@ export class ProducerExecution extends ProducerPublication {
         run.stages
           .filter((s) => s.id !== 'production_acceptance')
           .every((s) => ['passed', 'reused'].includes(s.status)),
-        'Every prerequisite stage needs actual proof',
+        'Every prerequisite stage needs actual proof'
       );
       const readback = await stage('production_acceptance', async (signal) => {
         const fact = await this.provider.readProduction(resolved, { signal });
@@ -243,15 +216,13 @@ export class ProducerExecution extends ProducerPublication {
         }
         assert.ok(
           acceptedProduction(fact, resolved, this.now()),
-          'Independent production identity and functional proof required',
+          'Independent production identity and functional proof required'
         );
         return fact;
       });
       run.recoveryState = 'verified';
       if (command.action === 'rollback') {
-        const previous = this.state.runs.find(
-          (r) => r.id === command.previousRunId,
-        );
+        const previous = this.state.runs.find((r) => r.id === command.previousRunId);
         if (previous) {
           previous.status = 'failed';
           previous.recoveryState = 'verified';
@@ -259,7 +230,7 @@ export class ProducerExecution extends ProducerPublication {
           previous.blockers = [
             blocker(
               'RECOVERY_VERIFIED',
-              'Предыдущая установка восстановлена; исходная выкатка завершилась ошибкой',
+              'Предыдущая установка восстановлена; исходная выкатка завершилась ошибкой'
             ),
           ];
         }
@@ -270,7 +241,7 @@ export class ProducerExecution extends ProducerPublication {
         run.id,
         null,
         'readback',
-        'Производственная версия и функциональная проверка подтверждены',
+        'Производственная версия и функциональная проверка подтверждены'
       );
     } catch (error) {
       if (
@@ -288,19 +259,17 @@ export class ProducerExecution extends ProducerPublication {
           remaining() <= 0 ? 'DEADLINE_EXCEEDED' : 'RECONCILIATION_REQUIRED',
           remaining() <= 0
             ? 'Исходный срок выполнения истёк'
-            : 'Выполнение требует проверки фактического результата',
+            : 'Выполнение требует проверки фактического результата'
         ),
       ];
       this.event(run.id, null, 'failure', run.blockers[0].message, 'error');
       await this.qualifyForwardRecovery(run, command);
     } finally {
-      if (
-        !suspended &&
-        !run.blockers.some((b) => b.code === 'SCHEDULED_ACTIVATION')
-      )
+      if (!suspended && !run.blockers.some((b) => b.code === 'SCHEDULED_ACTIVATION'))
         run.completedAt = this.now().toISOString();
       await this.save();
     }
+    await notifyPublicationTerminal(this, this.state.commands[command.commandId], run);
   }
   async resumeScheduled() {
     if (this.scheduling) return;
@@ -310,11 +279,11 @@ export class ProducerExecution extends ProducerPublication {
         (r) =>
           r.status === 'queued' &&
           r.lane === 'scheduled' &&
-          Date.parse(r.activationAt) <= this.now().getTime(),
+          Date.parse(r.activationAt) <= this.now().getTime()
       )) {
         const command = this.state.commands[run.commandId].command;
         const candidate = (await this.snapshot()).candidates.find(
-          (c) => c.id === command.candidateId,
+          (c) => c.id === command.candidateId
         );
         if (
           Date.parse(command.deadlineAt) <= this.now().getTime() ||
@@ -325,22 +294,19 @@ export class ProducerExecution extends ProducerPublication {
           run.blockers = [
             blocker(
               'SCHEDULED_CANDIDATE_INVALID',
-              'Срок истёк или подготовленный кандидат изменился',
+              'Срок истёк или подготовленный кандидат изменился'
             ),
           ];
           await this.save();
           continue;
         }
         run.blockers = [];
-        if (
-          Date.parse(command.activationAt) <
-          Date.parse(run.noticeAt) + 86400000
-        ) {
+        if (Date.parse(command.activationAt) < Date.parse(run.noticeAt) + 86400000) {
           run.status = 'blocked';
           run.blockers = [
             blocker(
               'NOTICE_WINDOW_TOO_SHORT',
-              'Недостаточно времени после фактического уведомления',
+              'Недостаточно времени после фактического уведомления'
             ),
           ];
           await this.save();

package/dist/producer-journal.mjs

@@ -1,6 +1,7 @@
 import assert from 'node:assert/strict';
 import { hash, canonical, keys, uuid } from './protocol-internals.mjs';
 import { validateRunnerCommand, validateProducerSnapshot } from './protocol.mjs';
+import { validatePublicationTerminalReceipt } from './publication-terminal-receipt.mjs';
 import {
   validatePublicationFailureRecord,
   validatePublicationFailureReadback,
@@ -29,6 +30,46 @@ export function validProducerState(state, installationKey, sourcePolicy) {
       assert.equal(item.ack.protocolVersion, 1);
       assert.ok(['accepted', 'rejected'].includes(item.ack.state));
       assert.match(item.ack.runId, uuid);
+      if (item.artifactCandidate) {
+        assert.equal(item.command.action, 'deploy');
+        assert.equal(
+          canonical(item.artifactCandidate.identity),
+          canonical(item.command.expectedIdentity)
+        );
+        assert.equal(
+          canonical(item.artifactCandidate.deliveryExecution),
+          canonical(item.deliveryExecution)
+        );
+      }
+      if (item.deliveryTerminalReceipt) {
+        const proof = validatePublicationTerminalReceipt(item.deliveryTerminalReceipt).proof;
+        assert.equal(proof.bindings.commandId, id);
+        assert.equal(proof.bindings.runId, item.ack.runId);
+        assert.equal(proof.bindings.installationKey, installationKey);
+        assert.equal(proof.bindings.action, item.command.action);
+        assert.equal(proof.bindings.candidateId, item.command.candidateId);
+        assert.equal(proof.bindings.provider, item.command.executionProvider);
+        assert.equal(canonical(proof.bindings.delivery), canonical(item.deliveryExecution));
+        const source =
+          item.command.action === 'publish'
+            ? item.command.expectedSource
+            : item.artifactCandidate?.source;
+        assert.equal(proof.bindings.repository, source?.repository);
+        assert.equal(proof.bindings.ref, source?.ref);
+        assert.equal(
+          canonical({ identity: proof.artifactIdentity }),
+          canonical({
+            identity:
+              item.command.action === 'publish'
+                ? (item.artifactIdentity ?? null)
+                : item.command.expectedIdentity,
+          })
+        );
+        const run = state.runs.find((value) => value.id === item.ack.runId);
+        assert.equal(run?.status, proof.status);
+        assert.equal(run?.completedAt, proof.completedAt);
+        assert.equal(run?.recoveryState, 'verified');
+      }
       if (item.publicationFailureReconciliation !== undefined)
         validatePublicationFailureRecord(
           item.publicationFailureReconciliation,

package/dist/producer-publication-failure.mjs

@@ -11,6 +11,7 @@ import { acceptedProduction, sameIdentity } from './protocol.mjs';
 import { validateOriginalDelivery, blocker } from './producer-support.mjs';
 import { verifyPublicationDelivery } from './producer-delivery.mjs';
 import { reservePublicationFailureReconciliation } from './exclusive-operation.mjs';
+import { notifyPublicationTerminal } from './publication-terminal.mjs';
 
 const stages = ['source_ready', 'ci', 'build', 'verify', 'publish'];
 export function publicationFailureProofDigest(fact, baselineReadback) {
@@ -97,10 +98,20 @@ export function validatePublicationFailureRecord(record, command, delivery, base
     assert.ok(record.baselineReadback, 'Settled recovery requires its production baseline proof');
 }
 
-export async function reconcilePublicationFailure(producer, item, run) {
+export async function reconcilePublicationFailure(
+  producer,
+  item,
+  run,
+  { terminalRetry = false } = {}
+) {
   assert.equal(item.ack.state, 'accepted');
   assert.equal(item.command.action, 'publish');
-  assert.equal(run.status, 'blocked');
+  assert.ok(
+    run.status === 'blocked' ||
+      (terminalRetry &&
+        run.status === 'failed' &&
+        item.publicationFailureReconciliation?.state === 'settled')
+  );
   assert.ok(!item.artifactIdentity);
   for (const id of ['deploy', 'production_acceptance']) {
     const row = run.stages.find((stage) => stage.id === id);
@@ -137,7 +148,9 @@ export async function reconcilePublicationFailure(producer, item, run) {
       fact: null,
       baselineReadback: null,
     };
+    if (terminalRetry) item.publicationFailureReconciliation.state = 'pending';
     assert.equal(item.publicationFailureReconciliation.state, 'pending');
+    run.status = 'blocked';
     run.recoveryState = 'unverified';
     run.completedAt = null;
     await bounded(producer.save());
@@ -267,4 +280,5 @@ export async function reconcilePublicationFailure(producer, item, run) {
     if (guard && !settled && !releasing && typeof guard.release === 'function') void cleanup(guard);
     lease.release({ resolved: settled });
   }
+  if (settled) await notifyPublicationTerminal(producer, item, run);
 }

package/dist/producer-server.mjs

@@ -2,11 +2,10 @@ import assert from 'node:assert/strict';
 import { timingSafeEqual } from 'node:crypto';
 import { createServer } from 'node:http';
 import { configurationHook } from './configuration-hook.mjs';
+import { verifyPublicationTerminalReceipt } from './publication-terminal-receipt.mjs';
 
 export function producerServer(producer, token, publication = {}) {
-  assert.ok(
-    typeof token === 'string' && token.length >= 43 && !/\s/.test(token),
-  );
+  assert.ok(typeof token === 'string' && token.length >= 43 && !/\s/.test(token));
   const expected = Buffer.from(`Bearer ${token}`);
   const server = createServer(async (req, res) => {
     const reply = (code, body) => {
@@ -17,31 +16,29 @@ export function producerServer(producer, token, publication = {}) {
       res.end(JSON.stringify(body));
     };
     const supplied = Buffer.from(req.headers.authorization ?? '');
-    if (
-      supplied.length !== expected.length ||
-      !timingSafeEqual(supplied, expected)
-    )
+    if (supplied.length !== expected.length || !timingSafeEqual(supplied, expected))
       return reply(401, { error: 'Unauthorized' });
     try {
       const url = new URL(req.url, 'http://localhost');
       if (await configurationHook(req, url, producer, publication, reply)) return;
-      if (
-        req.method === 'GET' &&
-        url.pathname === '/v1/release-control/snapshot'
-      ) {
-        assert.equal(
-          url.searchParams.get('installationKey'),
-          producer.installationKey,
-        );
-        return reply(
-          200,
-          await producer.snapshot(url.searchParams.get('after') ?? '0'),
-        );
+      const terminal = url.pathname.match(
+        /^\/v1\/release-control\/publications\/([a-f\d-]{36})\/terminal$/i
+      );
+      if (req.method === 'GET' && terminal && !url.search) {
+        const receipt = publication.readTerminalReceipt
+          ? await publication.readTerminalReceipt(terminal[1])
+          : producer.journal.read().commands[terminal[1]]?.deliveryTerminalReceipt;
+        if (!receipt) return reply(404, { error: 'Terminal receipt unavailable' });
+        const verified = verifyPublicationTerminalReceipt(receipt, token);
+        assert.equal(verified.proof.bindings.commandId, terminal[1]);
+        assert.equal(verified.proof.bindings.installationKey, producer.installationKey);
+        return reply(200, verified);
+      }
+      if (req.method === 'GET' && url.pathname === '/v1/release-control/snapshot') {
+        assert.equal(url.searchParams.get('installationKey'), producer.installationKey);
+        return reply(200, await producer.snapshot(url.searchParams.get('after') ?? '0'));
       }
-      if (
-        req.method === 'POST' &&
-        url.pathname === '/v1/release-control/commands'
-      ) {
+      if (req.method === 'POST' && url.pathname === '/v1/release-control/commands') {
         let bytes = 0;
         const chunks = [];
         for await (const chunk of req) {
@@ -51,37 +48,21 @@ export function producerServer(producer, token, publication = {}) {
         }
         return reply(
           200,
-          await producer.command(
-            JSON.parse(Buffer.concat(chunks).toString('utf8')),
-          ),
+          await producer.command(JSON.parse(Buffer.concat(chunks).toString('utf8')))
         );
       }
       const publicationMatch = url.pathname.match(
-        /^\/v1\/release-control\/publications\/([a-f\d-]{36})(\/report)?$/i,
+        /^\/v1\/release-control\/publications\/([a-f\d-]{36})(\/report)?$/i
       );
       if (publicationMatch && !url.search) {
-        if (
-          req.method === 'GET' &&
-          !publicationMatch[2] &&
-          publication.claimPublication
-        ) {
+        if (req.method === 'GET' && !publicationMatch[2] && publication.claimPublication) {
           const rawRun = req.headers[publication.workflowRunHeader ?? 'x-myrobotica-workflow-run'];
           assert.ok(typeof rawRun === 'string' && /^[1-9]\d*$/.test(rawRun));
           const workflowRunId = Number(rawRun);
           assert.ok(Number.isSafeInteger(workflowRunId));
-          return reply(
-            200,
-            await publication.claimPublication(
-              publicationMatch[1],
-              workflowRunId,
-            ),
-          );
+          return reply(200, await publication.claimPublication(publicationMatch[1], workflowRunId));
         }
-        if (
-          req.method === 'POST' &&
-          publicationMatch[2] &&
-          publication.reportPublication
-        ) {
+        if (req.method === 'POST' && publicationMatch[2] && publication.reportPublication) {
           let bytes = 0;
           const chunks = [];
           for await (const chunk of req) {
@@ -93,17 +74,14 @@ export function producerServer(producer, token, publication = {}) {
             200,
             await publication.reportPublication(
               publicationMatch[1],
-              JSON.parse(Buffer.concat(chunks).toString('utf8')),
-            ),
+              JSON.parse(Buffer.concat(chunks).toString('utf8'))
+            )
           );
         }
       }
-      const match = url.pathname.match(
-        /^\/v1\/release-control\/commands\/([a-f\d-]{36})$/i,
-      );
+      const match = url.pathname.match(/^\/v1\/release-control\/commands\/([a-f\d-]{36})$/i);
       if (req.method === 'GET' && match) {
-        if (!producer.acknowledgement(match[1]))
-          return reply(404, { error: 'Unknown command' });
+        if (!producer.acknowledgement(match[1])) return reply(404, { error: 'Unknown command' });
         const ack = await producer.reconcile(match[1]);
         return reply(ack ? 200 : 404, ack ?? { error: 'Unknown command' });
       }

package/dist/producer-state.mjs

@@ -3,16 +3,18 @@ import { blocker, smokeScenarios, safeStatus } from './producer-support.mjs';
 import path from 'node:path';
 import { createProtectedJsonStore } from './journal.mjs';
 import { validProducerState } from './producer-journal.mjs';
-import { installOperationBarrier, markOperationStateLoaded, reserveExclusiveOperation } from './exclusive-operation.mjs';
+import {
+  installOperationBarrier,
+  markOperationStateLoaded,
+  reserveExclusiveOperation,
+} from './exclusive-operation.mjs';
 
 export class ProducerState {
-  constructor({
-    installationKey,
-    journalFile,
-    provider,
-    now = () => new Date(),
-    sourcePolicy,
-  }) {
+  #engineInstance;
+  static isEngineInstance(value) {
+    return value !== null && typeof value === 'object' && #engineInstance in value;
+  }
+  constructor({ installationKey, journalFile, provider, now = () => new Date(), sourcePolicy }) {
     assert.match(installationKey, /^[\w.-]{1,200}$/);
     assert.ok(path.isAbsolute(journalFile));
     Object.assign(this, { installationKey, journalFile, provider, now, sourcePolicy });
@@ -26,7 +28,7 @@ export class ProducerState {
         (Number.isSafeInteger(provider.snapshotTimeoutMs) &&
           provider.snapshotTimeoutMs > 0 &&
           provider.snapshotTimeoutMs <= 30000),
-      'Invalid fixed provider snapshot budget',
+      'Invalid fixed provider snapshot budget'
     );
     this.state = {
       schema: 1,
@@ -47,9 +49,7 @@ export class ProducerState {
   async initialize() {
     this.state = this.journal.read();
     // A restarted process must reconcile a previously admitted mutation first.
-    for (const run of this.state.runs.filter((r) =>
-      ['running', 'queued'].includes(r.status),
-    )) {
+    for (const run of this.state.runs.filter((r) => ['running', 'queued'].includes(r.status))) {
       if (
         run.status === 'queued' &&
         run.lane === 'scheduled' &&
@@ -62,7 +62,7 @@ export class ProducerState {
         blocker(
           'RECONCILIATION_REQUIRED',
           'Предыдущее выполнение требует проверки фактического состояния',
-          true,
+          true
         ),
       ];
     }
@@ -108,15 +108,9 @@ export class ProducerState {
       occurredAt: this.now().toISOString(),
       code,
       frames,
-      ...(smokeScenarios.has(error?.scenario)
-        ? { scenario: error.scenario }
-        : {}),
-      ...(safeStatus(error?.expectedStatus)
-        ? { expectedStatus: error.expectedStatus }
-        : {}),
-      ...(safeStatus(error?.actualStatus)
-        ? { actualStatus: error.actualStatus }
-        : {}),
+      ...(smokeScenarios.has(error?.scenario) ? { scenario: error.scenario } : {}),
+      ...(safeStatus(error?.expectedStatus) ? { expectedStatus: error.expectedStatus } : {}),
+      ...(safeStatus(error?.actualStatus) ? { actualStatus: error.actualStatus } : {}),
       ...([
         'ENOTFOUND',
         'EAI_AGAIN',
@@ -131,9 +125,7 @@ export class ProducerState {
         ? { transportCode: error.transportCode }
         : {}),
     };
-    this.state.diagnostics = [...(this.state.diagnostics ?? []), item].slice(
-      -200,
-    );
+    this.state.diagnostics = [...(this.state.diagnostics ?? []), item].slice(-200);
     return code;
   }
   async snapshot(after = '0', { deadlineAt } = {}) {
@@ -144,8 +136,8 @@ export class ProducerState {
         this.provider.snapshotTimeoutMs ?? 10000,
         deadlineAt
           ? Date.parse(deadlineAt) - this.now().getTime()
-          : (this.provider.snapshotTimeoutMs ?? 10000),
-      ),
+          : (this.provider.snapshotTimeoutMs ?? 10000)
+      )
     );
     const controller = new AbortController();
     let timer;
@@ -155,22 +147,17 @@ export class ProducerState {
         reject(
           Object.assign(Error('Producer status read timed out'), {
             code: 'PRODUCER_STATUS_TIMEOUT',
-          }),
+          })
         );
       }, limit);
     });
     let data;
     try {
-      data = await Promise.race([
-        this.provider.snapshot({ signal: controller.signal }),
-        timeout,
-      ]);
+      data = await Promise.race([this.provider.snapshot({ signal: controller.signal }), timeout]);
     } finally {
       clearTimeout(timer);
     }
-    const candidates = new Map(
-      data.candidates.map((candidate) => [candidate.id, candidate]),
-    );
+    const candidates = new Map(data.candidates.map((candidate) => [candidate.id, candidate]));
     for (const item of Object.values(this.state.commands)) {
       if (
         item.command.action !== 'publish' ||

package/dist/producer.d.ts

@@ -13,6 +13,56 @@ export * from './protocol.js';
 export interface ProviderContext {
   signal: AbortSignal;
 }
+declare const publicationTerminalBrand: unique symbol;
+export interface PublicationTerminalAuthority {
+  readonly [publicationTerminalBrand]: true;
+}
+export interface PublicationTerminalBindings {
+  action: 'publish' | 'deploy';
+  commandId: string;
+  runId: string;
+  installationKey: string;
+  repository: string;
+  ref: string;
+  provider: RunnerCommand['executionProvider'];
+  candidateId: string;
+  delivery: OriginalDelivery;
+}
+export interface PublicationTerminalProof {
+  schema: 1;
+  bindings: PublicationTerminalBindings;
+  status: 'deployed' | 'failed';
+  completedAt: string;
+  artifactIdentity: ArtifactIdentity | null;
+  readback: ProductionReadback;
+  failure: PublicationFailureFact | null;
+}
+export function readPublicationTerminalAuthority(
+  authority: PublicationTerminalAuthority,
+  bindings: PublicationTerminalBindings
+): PublicationTerminalProof;
+export interface PublicationTerminalReceipt {
+  schema: 1;
+  kind: 'publication_terminal';
+  issuedAt: string;
+  proof: PublicationTerminalProof;
+  mac: string;
+}
+export function sealPublicationTerminalReceipt(
+  authority: PublicationTerminalAuthority,
+  bindings: PublicationTerminalBindings,
+  token: string
+): Promise<PublicationTerminalReceipt>;
+/** Authenticated data, never an execution capability. */
+export function verifyPublicationTerminalReceipt(
+  receipt: PublicationTerminalReceipt,
+  token: string
+): PublicationTerminalReceipt;
+export interface TerminalVerificationContext extends ProviderContext {
+  completedAt: string;
+  status: 'deployed' | 'failed';
+  artifactIdentity?: ArtifactIdentity;
+}
 export interface ExecutionContext {
   stage<T>(
     id: StageId,
@@ -39,6 +89,13 @@ export interface ReleaseProvider {
   actions: RunnerCommand['action'][];
   snapshotTimeoutMs?: number;
   remotePublication?: boolean;
+  publicationTerminal?(
+    command: RunnerCommand,
+    context: ProviderContext & {
+      authority: PublicationTerminalAuthority;
+      bindings: PublicationTerminalBindings;
+    }
+  ): Promise<void>;
   snapshot(context: ProviderContext): Promise<{
     connection: ProducerSnapshot['connection'];
     installed?: ProductionReadback | null;
@@ -56,9 +113,21 @@ export interface ReleaseProvider {
   verifyPublicationArtifact?(
     command: RunnerCommand,
     identity: ArtifactIdentity,
-    delivery: OriginalDelivery
+    delivery: OriginalDelivery,
+    context?: TerminalVerificationContext
+  ): Promise<boolean>;
+  verifyPublicationDelivery?(
+    command: RunnerCommand,
+    delivery: OriginalDelivery,
+    context?: TerminalVerificationContext
+  ): Promise<boolean>;
+  verifyArtifactDelivery?(
+    command: RunnerCommand,
+    identity: ArtifactIdentity,
+    delivery: OriginalDelivery,
+    source: { repository: string; ref: string; sourceCommit: string },
+    context: TerminalVerificationContext
   ): Promise<boolean>;
-  verifyPublicationDelivery?(command: RunnerCommand, delivery: OriginalDelivery): Promise<boolean>;
   reconcilePublicationFailure?(
     command: RunnerCommand,
     context: ProviderContext & { delivery: OriginalDelivery | null; recoveryDeadlineAt: number }
@@ -152,6 +221,7 @@ export function producerServer(
     workflowRunHeader?: string;
     claimPublication?(commandId: string, workflowRunId: number): Promise<unknown>;
     reportPublication?(commandId: string, report: unknown): Promise<unknown>;
+    readTerminalReceipt?(commandId: string): Promise<PublicationTerminalReceipt | null | undefined>;
     configure?(request: ConfigurationRequest): Promise<ConfigurationAcknowledgement | undefined>;
     reconcileConfiguration?(
       configurationId: string

package/dist/producer.mjs

@@ -3,6 +3,12 @@ import { sameIdentity, acceptedProduction } from './protocol.mjs';
 import { blocker, failureMessage, failedProduction } from './producer-support.mjs';
 import { ProducerExecution } from './producer-execution.mjs';
 import { reconcilePublicationFailure } from './producer-publication-failure.mjs';
+import { notifyPublicationTerminal } from './publication-terminal.mjs';
+export {
+  readPublicationTerminalAuthority,
+  sealPublicationTerminalReceipt,
+  verifyPublicationTerminalReceipt,
+} from './publication-terminal.mjs';
 export { publicationFailureProofDigest } from './producer-publication-failure.mjs';
 export {
   sameIdentity,
@@ -18,6 +24,43 @@ export class ReleaseControlProducer extends ProducerExecution {
     const item = this.state.commands[commandId];
     assert.ok(item, 'Unknown command');
     const run = this.state.runs.find((r) => r.commandId === commandId);
+    if (
+      ['publish', 'deploy'].includes(item.command.action) &&
+      typeof this.provider.publicationTerminal === 'function'
+    ) {
+      if (run?.status === 'failed' && item.publicationFailureReconciliation?.state === 'settled') {
+        await reconcilePublicationFailure(this, item, run, { terminalRetry: true });
+        return this.acknowledgement(commandId);
+      }
+      if (run?.status === 'deployed') {
+        const controller = new AbortController();
+        let timer;
+        try {
+          const fact = await Promise.race([
+            this.provider.readProduction(this.resolvedCommand(item.command), {
+              signal: controller.signal,
+            }),
+            new Promise((_, reject) => {
+              timer = setTimeout(() => {
+                controller.abort();
+                reject(Error('PUBLICATION_TERMINAL_READBACK_TIMEOUT'));
+              }, 30000);
+            }),
+          ]);
+          assert.ok(
+            acceptedProduction(fact, this.resolvedCommand(item.command), this.now()),
+            'PUBLICATION_TERMINAL_READBACK_REQUIRED'
+          );
+          run.readback = structuredClone(fact);
+          await this.save();
+          await notifyPublicationTerminal(this, item, run);
+        } finally {
+          controller.abort();
+          clearTimeout(timer);
+        }
+        return this.acknowledgement(commandId);
+      }
+    }
     if (
       item.command.action === 'publish' &&
       run?.status === 'blocked' &&
@@ -140,6 +183,7 @@ export class ReleaseControlProducer extends ProducerExecution {
         await this.save();
       }
     }
+    await notifyPublicationTerminal(this, item, run);
     return this.acknowledgement(commandId);
   }
 }

package/dist/provenance.json

@@ -1,31 +1,33 @@
 {
   "schema": 1,
   "package": "@casecore/release-agent",
-  "version": "0.1.4",
-  "sourceCommit": "a888a2b91e4f5797b2e18dd3ee0463ed56395923",
+  "version": "0.1.6",
+  "sourceCommit": "70442860e0f89db88c78142c6f6a7e8073414af5",
   "sourceVerified": true,
   "sourceDirty": false,
   "buildKind": "release",
-  "contentDigest": "sha256:492c711a81655001e6d77fb48c19363d2f8f27d24ef5afbe514bde6b26294000",
+  "contentDigest": "sha256:a41148b8adf594a5da507b1f8495b5b8c63e32b514d815c7bbce2634b0e6fb89",
   "files": {
     "src/configuration-hook.mjs": "sha256:1171bf982cbf7cb0092f63b633ef0b0a0947d8ed1106f88c9175c8add33d81b1",
-    "src/exclusive-operation.mjs": "sha256:5a1d0b7d3aa41b901132e239586d66d6c7aa2c16682a7db033a7aab91b1d781a",
+    "src/exclusive-operation.mjs": "sha256:d5c2718a2a4228d09559e914360329383ae276f034bb468c52642a4bd6aa0d99",
     "src/identity.mjs": "sha256:253021058fc79232d83f3ecba6f1023fd046f27aabdf9c129a103d3c9ccb07f5",
     "src/index.mjs": "sha256:76bda5e1dc376bb7033d8fdbddb0afa85c7c68bbe028aea078ffceaaa35ec75e",
     "src/journal.mjs": "sha256:35a2620d56084ec1aa164e09d77b8e77096413d9572f7b601da8ef7149b996bd",
     "src/pipeline.mjs": "sha256:7a2d39d235ce7160441d177200389c5f3eae1cc494ec36082a23e8d64a0abe3f",
-    "src/producer-admission.mjs": "sha256:975c7dac25d4c8f94423e5a4db2bd99c556afd6492b26fbda58e841f1df8fc3c",
-    "src/producer-delivery.mjs": "sha256:b20d9ae20dee90bbbe739245a84c9f4b91b1ab958b5e2995ff8705da24ba3988",
-    "src/producer-execution.mjs": "sha256:6d9fbca493e4386c92c4d853a66ece3677ec7ab644d6da15b68dd744f30186ef",
-    "src/producer-journal.mjs": "sha256:0934057702fb611b9a8d9dde58cb2c2024f436a49a4e5f6ab02f8884a320cea7",
-    "src/producer-publication-failure.mjs": "sha256:726b2b85880143b70219473896b894f64b25b1c495f77488f1e73ce950b839f6",
+    "src/producer-admission.mjs": "sha256:03d868141daf92351b3e1a4e70997c87fc39044624644536a374aa86d108d12d",
+    "src/producer-delivery.mjs": "sha256:04439a95afcb52d879cc83b99fa1d7716f4dff84bb7c07f88d31f534799e76a8",
+    "src/producer-execution.mjs": "sha256:e78724fa2f2fd4946ae8103bb5165b363eb968fab42add4fed572155f51871d9",
+    "src/producer-journal.mjs": "sha256:9ec7c5e4ae6add8c0b64644673c3243946175fb5cc2dafcd5f1fdee2c6485ffd",
+    "src/producer-publication-failure.mjs": "sha256:9db4effbeae8287070e3c27133abecf2bf435a8c6917c3162f0efd3189ea9445",
     "src/producer-publication.mjs": "sha256:c09fa07b37507093b71bbaff3af9df8ec2331c0cba24a4b936d247e9b35257f7",
-    "src/producer-server.mjs": "sha256:def28e10a17eb80fb04ba69b09050731bb005949f949a7f1fb46dae267323434",
-    "src/producer-state.mjs": "sha256:c3fcdace4c6579be092d39803cfb308e4bf88060b3f75bb7fc8b91284609b4ce",
+    "src/producer-server.mjs": "sha256:fc67ceced78239a1d159ff1af82b0061a407891523ad2a1a9139a3d4d158619c",
+    "src/producer-state.mjs": "sha256:61d6a914c268f94790c459562436bfe95efd07865ca1052b0b58760d9087d535",
     "src/producer-support.mjs": "sha256:0a10f6fa50cd8e729ba432640d0845004488ead2bcc1c9383f02548037f83d66",
-    "src/producer.mjs": "sha256:6d0b875a9901a14edf5b93c771356f5352e924ff7977c13b027343c9bdca42f4",
+    "src/producer.mjs": "sha256:d5a9fca0bcb14f8c757d7219fcb8f2d39a2bf7af05c9cce3b8f654fa3060552c",
     "src/protocol-internals.mjs": "sha256:d08a0c72079d091792c5327adafac5ffc38ea20138a6c44b88879e7157a890b3",
     "src/protocol.mjs": "sha256:1fe135a2e60922b517886a392c2b0c2250b773abda8b1a1fcd9af86df2be6dae",
+    "src/publication-terminal-receipt.mjs": "sha256:b4ecc620f7e4325ec9d42652b8f1620f609fad65b1400cd2810a0a2f7e7b6794",
+    "src/publication-terminal.mjs": "sha256:643663218b31526a47c88f6ea2475428d94e2450b49225c253f39d54de30fed2",
     "src/snapshot-validator.mjs": "sha256:1279aa19e0932776bc1998935f70ca6fae65391f96b60e2d65bcab3b2cb46036",
     "src/source-admission.mjs": "sha256:25e0e3cc163895c3f6b5057162538c4c313bd37e67956c63b2624df52517b437",
     "src/source-non-admission.mjs": "sha256:fd513148f9cd8beb1faddf9ad30189913d387a3cd6bc67f3308e7b0cbee46396",
@@ -34,7 +36,7 @@
     "types/index.d.ts": "sha256:92ef7b5600f05d52dcb646fc3e4d2b4944ead52ff1c9ee23bb9f4659bebf05a6",
     "types/journal.d.ts": "sha256:79beb61af50b00400588a87426a7f5b38bf38d4b8224284dc6e0631378aa244e",
     "types/pipeline.d.ts": "sha256:c9135e25fb852377c32a16ce781405393c5857886e3f77754b715747202c70a9",
-    "types/producer.d.ts": "sha256:980aad137365f6c131b6bfabfab411a73c4a2b2fb35a167152ef8ed446ec1ade",
+    "types/producer.d.ts": "sha256:f64ae58d8e5984caea148a97e2cdf7d52a77bc472fb17ec75b5af1350f763fcc",
     "types/protocol.d.ts": "sha256:02c06986c81bfc4214169f62da8e0566704b71a5add58434dfca92c673fad4ce",
     "types/source-store.d.ts": "sha256:ce2086dd682e8f57bc5e1581b411ec9fe1cf1cfba8dccafe38c22d102c2b9904",
     "types/types.d.ts": "sha256:cdc6664854bffc371a3da45f29bf1b31f14fd61b66e8f8bae8309dd836f6de6e"

package/dist/publication-terminal-receipt.mjs

@@ -0,0 +1,119 @@
+import assert from 'node:assert/strict';
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { completeIdentity, keys, timestamp, uuid } from './protocol-internals.mjs';
+import { validateOriginalDelivery } from './producer-support.mjs';
+
+const domain = 'casecore.release-agent/publication-terminal/v1\0';
+const sorted = (value) => {
+  if (Array.isArray(value)) return value.map(sorted);
+  if (value && typeof value === 'object')
+    return Object.fromEntries(
+      Object.keys(value)
+        .sort()
+        .map((key) => [key, sorted(value[key])])
+    );
+  assert.ok(value === null || ['string', 'boolean', 'number'].includes(typeof value));
+  assert.ok(typeof value !== 'number' || Number.isFinite(value));
+  return value;
+};
+const body = (receipt) =>
+  JSON.stringify(
+    sorted({
+      schema: receipt.schema,
+      kind: receipt.kind,
+      issuedAt: receipt.issuedAt,
+      proof: receipt.proof,
+    })
+  );
+function secret(token) {
+  assert.ok(
+    typeof token === 'string' && token.length >= 43 && token.length <= 4096 && !/\s/.test(token),
+    'PUBLICATION_TERMINAL_TOKEN_REQUIRED'
+  );
+  return token;
+}
+export function validatePublicationTerminalReceipt(receipt) {
+  keys(receipt, ['schema', 'kind', 'issuedAt', 'proof', 'mac']);
+  assert.equal(receipt.schema, 1);
+  assert.equal(receipt.kind, 'publication_terminal');
+  timestamp(receipt.issuedAt);
+  assert.match(receipt.mac, /^[a-f0-9]{64}$/);
+  const proof = receipt.proof;
+  keys(proof, [
+    'schema',
+    'bindings',
+    'status',
+    'completedAt',
+    'artifactIdentity',
+    'readback',
+    'failure',
+  ]);
+  assert.equal(proof.schema, 1);
+  assert.ok(['deployed', 'failed'].includes(proof.status));
+  timestamp(proof.completedAt);
+  const bindings = proof.bindings;
+  keys(bindings, [
+    'action',
+    'commandId',
+    'runId',
+    'installationKey',
+    'repository',
+    'ref',
+    'provider',
+    'candidateId',
+    'delivery',
+  ]);
+  assert.ok(['publish', 'deploy'].includes(bindings.action));
+  assert.match(bindings.commandId, uuid);
+  assert.match(bindings.runId, uuid);
+  assert.match(bindings.installationKey, /^[\w.-]{1,200}$/);
+  assert.match(bindings.repository, /^[\w.-]+\/[\w.-]+$/);
+  assert.ok(
+    typeof bindings.ref === 'string' && bindings.ref.length > 0 && bindings.ref.length <= 200
+  );
+  assert.ok(['github', 'local'].includes(bindings.provider));
+  assert.ok(
+    typeof bindings.candidateId === 'string' &&
+      bindings.candidateId.length > 0 &&
+      bindings.candidateId.length <= 200
+  );
+  validateOriginalDelivery(bindings.delivery);
+  assert.ok(Date.parse(proof.completedAt) >= Date.parse(bindings.delivery.requestedAt));
+  if (proof.status === 'deployed') {
+    assert.ok(Date.parse(proof.completedAt) <= Date.parse(bindings.delivery.deadlineAt));
+    assert.ok(completeIdentity(proof.artifactIdentity));
+  } else assert.ok(proof.artifactIdentity === null || completeIdentity(proof.artifactIdentity));
+  assert.ok(proof.readback && typeof proof.readback === 'object');
+  assert.ok(proof.failure === null || (proof.failure && typeof proof.failure === 'object'));
+  assert.ok(Buffer.byteLength(body(receipt)) <= 262144, 'PUBLICATION_TERMINAL_RECEIPT_TOO_LARGE');
+  return receipt;
+}
+// Internal data constructor. Public sealing additionally requires the genuine
+// active engine capability and durably writes the existing command journal.
+export function createPublicationTerminalReceipt(proof, token) {
+  const receipt = {
+    schema: 1,
+    kind: 'publication_terminal',
+    issuedAt: new Date().toISOString(),
+    proof: structuredClone(proof),
+    mac: '',
+  };
+  receipt.mac = createHmac('sha256', secret(token))
+    .update(domain)
+    .update(body(receipt))
+    .digest('hex');
+  return validatePublicationTerminalReceipt(receipt);
+}
+/** Authenticated data only: this never creates or revives a WeakMap capability. */
+export function verifyPublicationTerminalReceipt(receipt, token) {
+  validatePublicationTerminalReceipt(receipt);
+  const expected = createHmac('sha256', secret(token))
+    .update(domain)
+    .update(body(receipt))
+    .digest();
+  assert.ok(
+    timingSafeEqual(expected, Buffer.from(receipt.mac, 'hex')),
+    'PUBLICATION_TERMINAL_RECEIPT_AUTHENTICATION_REQUIRED'
+  );
+  return structuredClone(receipt);
+}

package/dist/publication-terminal.mjs

@@ -0,0 +1,251 @@
+import assert from 'node:assert/strict';
+import { ProducerState } from './producer-state.mjs';
+import { assertProducerOperation } from './exclusive-operation.mjs';
+import { canonical, hash } from './protocol-internals.mjs';
+import { acceptedProduction, sameIdentity, validateExpectedSource } from './protocol.mjs';
+import { verifyPublicationDelivery } from './producer-delivery.mjs';
+import { validatePublicationFailureReadback } from './producer-publication-failure.mjs';
+import { validateOriginalDelivery } from './producer-support.mjs';
+import {
+  createPublicationTerminalReceipt,
+  verifyPublicationTerminalReceipt,
+} from './publication-terminal-receipt.mjs';
+export { verifyPublicationTerminalReceipt } from './publication-terminal-receipt.mjs';
+
+const authorities = new WeakMap();
+
+/** The capability is valid only inside the engine's terminal callback. */
+export function readPublicationTerminalAuthority(authority, bindings) {
+  const record = authorities.get(authority);
+  assert.ok(record && Date.now() <= record.expiresAt, 'PUBLICATION_TERMINAL_AUTHORITY_REQUIRED');
+  assert.equal(
+    canonical(bindings),
+    canonical(record.proof.bindings),
+    'PUBLICATION_TERMINAL_BINDINGS_CHANGED'
+  );
+  return structuredClone(record.proof);
+}
+
+/** DEP-TERMINAL-V1: mint only inside the genuine current engine callback. */
+export async function sealPublicationTerminalReceipt(authority, bindings, token) {
+  const proof = readPublicationTerminalAuthority(authority, bindings);
+  const record = authorities.get(authority);
+  assertProducerOperation(record.producer);
+  assert.equal(
+    canonical(record.producer.journal.read().commands[bindings.commandId]),
+    canonical(record.item),
+    'PUBLICATION_TERMINAL_NOT_DURABLE'
+  );
+  assert.equal(
+    canonical(record.producer.journal.read().runs.find((run) => run.id === bindings.runId)),
+    record.durableRun,
+    'PUBLICATION_TERMINAL_NOT_DURABLE'
+  );
+  const receipt = createPublicationTerminalReceipt(proof, token);
+  const prior = record.item.deliveryTerminalReceipt;
+  if (prior) {
+    const existing = verifyPublicationTerminalReceipt(prior, token).proof;
+    for (const key of ['bindings', 'status', 'completedAt', 'artifactIdentity', 'failure'])
+      assert.equal(
+        canonical({ value: existing[key] }),
+        canonical({ value: proof[key] }),
+        'PUBLICATION_TERMINAL_RESULT_CHANGED'
+      );
+  }
+  record.item.deliveryTerminalReceipt = structuredClone(receipt);
+  await record.producer.save();
+  readPublicationTerminalAuthority(authority, bindings);
+  return structuredClone(receipt);
+}
+
+const fresh = (readback, now) =>
+  [readback.observedAt, readback.functionalSmoke.checkedAt].every((value) => {
+    const age = now.getTime() - Date.parse(value);
+    return age >= 0 && age <= 300000;
+  });
+
+// Internal issuance is deliberately absent from the package public exports.
+export async function notifyPublicationTerminal(producer, item, run) {
+  if (
+    !['publish', 'deploy'].includes(item.command.action) ||
+    (item.command.action === 'deploy' && !item.deliveryExecution) ||
+    typeof producer.provider.publicationTerminal !== 'function'
+  )
+    return;
+  if (!['deployed', 'failed'].includes(run.status) || run.recoveryState !== 'verified') return;
+  assert.ok(ProducerState.isEngineInstance(producer), 'PUBLICATION_ENGINE_INSTANCE_REQUIRED');
+  assertProducerOperation(producer);
+  let authority;
+  let controller;
+  let timer;
+  try {
+    controller = new AbortController();
+    const expiresAt = Date.now() + 30000;
+    const timeout = new Promise((_, reject) => {
+      timer = setTimeout(() => {
+        controller.abort();
+        reject(Error('PUBLICATION_TERMINAL_CALLBACK_TIMEOUT'));
+      }, 30000);
+    });
+    const bounded = (operation) => Promise.race([operation, timeout]);
+    assert.ok(
+      Date.parse(run.completedAt) >= Date.parse(item.command.requestedAt) &&
+        Date.parse(run.completedAt) <= producer.now().getTime(),
+      'PUBLICATION_TERMINAL_COMPLETION_REQUIRED'
+    );
+    if (run.status === 'deployed')
+      assert.ok(
+        Date.parse(run.completedAt) <= Date.parse(item.deliveryExecution.deadlineAt),
+        'PUBLICATION_TERMINAL_COMPLETION_LATE'
+      );
+    const verification = {
+      signal: controller.signal,
+      completedAt: run.completedAt,
+      status: run.status,
+      artifactIdentity: item.artifactIdentity ?? item.command.expectedIdentity,
+    };
+    let source;
+    const artifactIdentity =
+      item.command.action === 'publish' ? item.artifactIdentity : item.command.expectedIdentity;
+    if (item.command.action === 'publish') {
+      source = item.command.expectedSource;
+      await bounded(
+        verifyPublicationDelivery(producer, item.command, item.deliveryExecution, {
+          fresh: false,
+          verification,
+        })
+      );
+    } else {
+      validateOriginalDelivery(item.deliveryExecution);
+      assert.equal(
+        Date.parse(item.command.requestedAt),
+        Date.parse(item.deliveryExecution.requestedAt)
+      );
+      assert.equal(
+        Date.parse(item.command.deadlineAt),
+        Date.parse(item.deliveryExecution.deadlineAt)
+      );
+      assert.equal(item.ack.state, 'accepted');
+      assert.equal(item.fingerprint, hash(canonical(item.command)));
+      assert.ok(
+        item.artifactCandidate && sameIdentity(item.artifactCandidate.identity, artifactIdentity),
+        'PUBLICATION_ARTIFACT_CANDIDATE_REQUIRED'
+      );
+      source = {
+        repository: item.artifactCandidate.source.repository,
+        ref: item.artifactCandidate.source.ref,
+        sourceCommit: artifactIdentity.sourceCommit,
+      };
+      assert.ok(producer.sourcePolicy?.repository, 'PUBLICATION_ARTIFACT_REPOSITORY_REQUIRED');
+      assert.match(source.ref, /^[\w./-]{1,200}$/);
+      // A feature branch admission policy does not describe the signed artifact's
+      // real main/tag source. The mandatory product verifier owns that lineage.
+      validateExpectedSource(source, {
+        repository: producer.sourcePolicy.repository,
+        ref: source.ref,
+      });
+      assert.equal(
+        typeof producer.provider.verifyArtifactDelivery,
+        'function',
+        'PUBLICATION_ARTIFACT_DELIVERY_VERIFIER_REQUIRED'
+      );
+      assert.equal(
+        await bounded(
+          producer.provider.verifyArtifactDelivery(
+            item.command,
+            artifactIdentity,
+            item.deliveryExecution,
+            structuredClone(source),
+            verification
+          )
+        ),
+        true,
+        'PUBLICATION_LINEAGE_REQUIRED'
+      );
+    }
+    const saved = producer.journal.read();
+    assert.equal(
+      canonical(saved.commands[item.command.commandId]),
+      canonical(item),
+      'PUBLICATION_TERMINAL_NOT_DURABLE'
+    );
+    assert.equal(
+      canonical(saved.runs.find((value) => value.id === run.id)),
+      canonical(run),
+      'PUBLICATION_TERMINAL_NOT_DURABLE'
+    );
+    if (run.status === 'deployed') {
+      assert.ok(artifactIdentity, 'PUBLICATION_ARTIFACT_REQUIRED');
+      assert.ok(
+        acceptedProduction(run.readback, producer.resolvedCommand(item.command), producer.now()),
+        'PUBLICATION_TERMINAL_READBACK_REQUIRED'
+      );
+      assert.ok(fresh(run.readback, producer.now()), 'PUBLICATION_TERMINAL_READBACK_STALE');
+      if (item.command.action === 'publish')
+        assert.equal(
+          await bounded(
+            producer.provider.verifyPublicationArtifact(
+              item.command,
+              artifactIdentity,
+              item.deliveryExecution,
+              verification
+            )
+          ),
+          true,
+          'PUBLICATION_LINEAGE_REQUIRED'
+        );
+    } else {
+      // The existing independently owned pre-install failure guard remains the
+      // sole failure authority until artifact recovery has an equivalent guard.
+      assert.equal(
+        item.publicationFailureReconciliation?.state,
+        'settled',
+        'PUBLICATION_FAILURE_NOT_SETTLED'
+      );
+      validatePublicationFailureReadback(run.readback, item.command, item.baseline, producer.now());
+    }
+    const bindings = {
+      action: item.command.action,
+      commandId: item.command.commandId,
+      runId: run.id,
+      installationKey: item.command.installationKey,
+      repository: source.repository,
+      ref: source.ref,
+      provider: item.command.executionProvider,
+      candidateId: item.command.candidateId,
+      delivery: structuredClone(item.deliveryExecution),
+    };
+    const proof = {
+      schema: 1,
+      bindings,
+      status: run.status,
+      completedAt: run.completedAt,
+      artifactIdentity: structuredClone(artifactIdentity ?? null),
+      readback: structuredClone(run.readback),
+      failure: structuredClone(item.publicationFailureReconciliation?.fact ?? null),
+    };
+    authority = Object.freeze(Object.create(null));
+    controller.signal.throwIfAborted();
+    authorities.set(authority, { proof, expiresAt, producer, item, durableRun: canonical(run) });
+    await bounded(
+      Promise.resolve().then(() =>
+        producer.provider.publicationTerminal(structuredClone(item.command), {
+          authority,
+          bindings: structuredClone(bindings),
+          signal: controller.signal,
+        })
+      )
+    );
+  } catch (error) {
+    // The deployment result remains truthful. Product origin closure is unproven
+    // and must retry through fresh official reconciliation, never a raw snapshot.
+    producer.diagnostic(run.id, null, error);
+    await producer.save();
+    return false;
+  } finally {
+    if (authority) authorities.delete(authority);
+    controller?.abort();
+    clearTimeout(timer);
+  }
+  return true;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@casecore/release-agent",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "description": "Общий движок поставки CaseCore с адаптерами продуктов",
   "license": "UNLICENSED",
   "repository": {