@cotal-ai/delivery 0.35.0 → 0.37.0

package/dist/sys-creds.js

@@ -0,0 +1,163 @@
+import { credsClaims } from "@cotal-ai/core";
+import { assertSingleSpaceBroker, authDir, connectionEvictorCredsKey, CONNECTION_EVICTOR_CREDS_KIND, membershipObserverCredsKey, MEMBERSHIP_OBSERVER_CREDS_KIND, segmentedKey, } from "@cotal-ai/workspace";
+/** The broker-wide operation `repairAdvice` would send a workstation operator to, phrased so the
+ *  guard's own refusal reads as a sentence when it is quoted back. */
+const ROTATE_SYS = "re-minting the $SYS pair (`cotal up --rotate-sys`)";
+/** Why the rotation would refuse on this root, or `undefined` if it would run.
+ *
+ *  ASKED OF THE GUARD ITSELF, never re-derived from a tenant count read here. The advice is only
+ *  honest if it agrees with the thing that actually refuses, and a second implementation of the
+ *  single-space rule is a second thing to drift. Every throw counts as a refusal, including the
+ *  fail-CLOSED corrupt-inventory one: an operator sent to a command that refuses for a reason this
+ *  function could not read is in exactly the state this check exists to end. */
+function rotationRefusal(root) {
+    try {
+        assertSingleSpaceBroker(authDir(root), ROTATE_SYS);
+        return undefined;
+    }
+    catch (e) {
+        return e.message;
+    }
+}
+/** Repair advice for missing/unusable `$SYS` material, in the reader's own idiom.
+ *
+ *  The DIAGNOSIS half (which key, which account) is identical in both compositions and is built by
+ *  the caller; only this repair TAIL forks. On a workstation the repair is a real command; against a
+ *  hosted store it is the mint window plus the key to `put` under, because `cotal up --rotate-sys`
+ *  is unactionable there — and emitting it into a hosted log degrades the diagnosis even when the
+ *  failure semantics are right. Both halves say the same true thing: the `$SYS` pair can only be
+ *  minted while the never-persisted system signing seed is in memory.
+ *
+ *  THERE IS A THIRD CASE, and until now this function could not see it: on a root hosting several
+ *  spaces the workstation advice names two verbs that BOTH refuse. `cotal up --rotate-sys` and
+ *  `cotal down` are broker-wide and `assertSingleSpaceBroker` turns them away naming the tenants,
+ *  so the operator whose observer is missing is handed a command, runs it, and is refused — with
+ *  the refusal itself explaining that the remedy does not exist yet. That is advice which cannot
+ *  succeed, the same defect `healMembershipDataCreds`'s own comment records, and it was reachable
+ *  on a real root (`docs/design/space-segmentation-p7-p1.md` §6, probe-executed).
+ *
+ *  So the workstation arm consults the guard before naming its command, and where the guard would
+ *  refuse it states the truth instead: the guard's own words, then the reason no other command can
+ *  substitute. NAMING NOTHING IS THE POINT — there is no verb to offer here, and inventing a
+ *  gentler-sounding one would restore the defect.
+ *
+ *  This makes the function read the filesystem on the workstation arm, which is why the callers
+ *  pass it as a THUNK: it is built only on a path that has already failed, never on a healthy one. */
+export function repairAdvice(source, kinds) {
+    const named = kinds.length ? kinds.join(" + ") : "the $SYS pair";
+    // The hosted arm names a KEY to `put` under, so it must name the SEGMENTED one — the kind alone is
+    // the pre-P7 key and putting there would leave the daemon still reading an empty location. The
+    // workstation arm names a command, not a key, so it keeps the kinds an operator recognises.
+    // Non-migrating on purpose: this builds a STRING for a store the process cannot reach.
+    if (source.injected)
+        return `re-mint the $SYS pair at a system-account rotation (the seed is in memory only at that moment) and \`put\` it under ${kinds.length ? kinds.map((k) => segmentedKey(k, source.space)).join(" + ") : "the $SYS pair's per-space keys"}`;
+    const refusal = rotationRefusal(source.root);
+    if (refusal === undefined)
+        return "re-mint it with `cotal down` then `cotal up --rotate-sys`";
+    return (`${refusal}. There is no other command that mints ${named}: the $SYS signing seed is discarded at provisioning, ` +
+        "so nothing can re-sign it on this root until per-space segmentation lands");
+}
+/** The DATA account an observer cred is scoped to, read out of its own `$SYS.REQ.ACCOUNT.<id>.CONNZ`
+ *  publish permission, or `undefined` if it carries none.
+ *
+ *  This is a LOCAL read of a signed document, and it buys the DIAGNOSIS, not the guarantee: the
+ *  broker independently refuses a CONNZ request for any other account, because the permission is in
+ *  the JWT it validates. Doing it here, before connecting, is what turns that refusal from a bare
+ *  "Authorization Violation" into a line naming both accounts (design §4.3). */
+export function connzAccountOf(observerCreds) {
+    for (const subject of credsClaims(observerCreds).nats?.pub?.allow ?? []) {
+        const m = /^\$SYS\.REQ\.ACCOUNT\.(A[A-Z2-7]{55})\.CONNZ$/.exec(subject);
+        if (m)
+            return m[1];
+    }
+    return undefined;
+}
+/**
+ * THE TENANCY CHECK — the guard that replaces the eliminated `membership.json` cross-check.
+ *
+ * Every sweep below resolves an ACCOUNT, and a complete, well-formed sweep of the WRONG account is
+ * indistinguishable from "the principal is gone": a healthy-looking answer that authorizes eviction.
+ * Note the asymmetry that makes this necessary — an observer scoped to A used with accountId B
+ * under-reports (broker-denied → `unknown`, safe), but observer A used with accountId A while the
+ * GATE lives on B is internally consistent and answers a confident, WRONG `gone`.
+ *
+ * Checking the observer against the account the daemon's OWN cred authenticates as is strictly
+ * stronger than the file it replaces: the file sat in the same `.cotal/` dir as the creds, so a root
+ * that was wrong was wrong for both, and its independence came from `expectedAccount` being derived
+ * from the cred anyway. The cred was always the real authority; the file was the thing being checked.
+ *
+ * An observer carrying NO CONNZ permission is refused rather than trusted: it cannot do the job, and
+ * treating "no account named" as "any account" is the exact failure this guard exists to stop.
+ */
+export function observerTenancyProblem(observerCreds, expectedAccount) {
+    let scoped;
+    try {
+        scoped = connzAccountOf(observerCreds);
+    }
+    catch (e) {
+        return `the $SYS observer cred is unreadable (${e.message})`;
+    }
+    if (scoped === undefined)
+        return "the $SYS observer cred carries no `$SYS.REQ.ACCOUNT.<id>.CONNZ` permission, so it names no account to sweep and cannot be checked against this daemon's own tenancy";
+    if (scoped !== expectedAccount)
+        return (`the $SYS observer cred is scoped to account ${scoped}, but this daemon's own credential authenticates as ${expectedAccount}. ` +
+            "That credential belongs to a different mesh, and sweeping it would return a confident, WRONG answer (a complete sweep of the wrong account is indistinguishable from a gone principal)");
+    return undefined;
+}
+/**
+ * THE TORN-ROTATION CHECK — two `$SYS` creds signed by DIFFERENT system accounts.
+ *
+ * `rotateSystemCreds` commits the trust record, then writes both creds, so a crash between the two
+ * leaves one of them on the RETIRED system account. The broker answers the same bare "Authorization
+ * Violation" either way, and the daemon cannot ask the trust record which account is current (it
+ * deliberately never loads the signer) — but it does not need to: the pair is written by ONE
+ * rotation, so two different issuers prove one of them is stale, with no signer read at all.
+ *
+ * Shared by both paths as of this change. It previously lived only in the feed, which left eviction
+ * — the path that actually kills connections — opening a half-rotated pair blind.
+ *
+ * `advice` is a THUNK because {@link repairAdvice} now reads the root's tenant list: both call sites
+ * sit on a healthy path (`loadCheckedSys` runs per eviction), and eagerly building advice nobody
+ * will read would put a directory listing on every successful call.
+ */
+export function tornRotationProblem(observerCreds, evictorCreds, advice) {
+    let obsIss, evIss;
+    try {
+        obsIss = credsClaims(observerCreds).iss;
+        evIss = credsClaims(evictorCreds).iss;
+    }
+    catch {
+        return undefined; // an undecodable cred is the health check's case, reported with its own message
+    }
+    if (obsIss === undefined || evIss === undefined || obsIss === evIss)
+        return undefined;
+    return (`the two $SYS creds are signed by DIFFERENT system accounts (observer ${obsIss.slice(0, 12)}…, evictor ${evIss.slice(0, 12)}…) - ` +
+        `a system-account rotation did not finish, so one of them is broker-dead: ${advice()} to land a complete generation`);
+}
+/** Read the `$SYS` pair through the store. Absence is reported; every other failure propagates.
+ *
+ *  The distinction is load-bearing: `undefined` means "not provisioned here", which each caller
+ *  answers in its own posture, whereas a KMS timeout or a revoked role is a REFUSAL that must not be
+ *  mistaken for an unprovisioned space and quietly degraded into deny-new-only.
+ *
+ *  Reading per call (rather than once at start) is strictly better than the `readFileSync` it
+ *  replaces: a hosted store re-keyed by a rotation is picked up on the next eviction with no daemon
+ *  restart. No renewal timer is added, and none is wanted — these stay `rotation-renewed`. */
+export async function loadSysPair(source, need) {
+    // The per-kind RESOLVERS (P7 §2 rule 1). The source's two arms ARE the composition they take, so
+    // a workstation daemon moves a legacy flat pair on this first touch and a hosted one never
+    // touches a filesystem. Reading the canonical location WITHOUT that move is the failure the
+    // resolver exists to stop: it answers `undefined`, which every caller here treats as "not
+    // provisioned", and sends an operator to a rotation for creds that are sitting on the same disk.
+    const observer = await source.secrets.get(membershipObserverCredsKey(source.space, source));
+    const evictor = need === "both" ? await source.secrets.get(connectionEvictorCredsKey(source.space, source)) : undefined;
+    // Reported as KINDS, never the segmented keys: `missing` is read by operators and compared
+    // against by callers (`membership.ts` filters the evictor out of its own diagnosis by name), and
+    // a `space.<hex>/` prefix would break both. The hosted arm's `put` key is named by `repairAdvice`.
+    const missing = [
+        observer === undefined ? MEMBERSHIP_OBSERVER_CREDS_KIND : undefined,
+        need === "both" && evictor === undefined ? CONNECTION_EVICTOR_CREDS_KIND : undefined,
+    ].filter((k) => k !== undefined);
+    return { ...(observer !== undefined ? { observer } : {}), ...(evictor !== undefined ? { evictor } : {}), missing };
+}
+//# sourceMappingURL=sys-creds.js.map

package/dist/sys-creds.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sys-creds.js","sourceRoot":"","sources":["../src/sys-creds.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAoB,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EACL,uBAAuB,EAAE,OAAO,EAAE,yBAAyB,EAAE,6BAA6B,EAC1F,0BAA0B,EAAE,8BAA8B,EAAE,YAAY,GACzE,MAAM,qBAAqB,CAAC;AA4C7B;sEACsE;AACtE,MAAM,UAAU,GAAG,oDAAoD,CAAC;AAExE;;;;;;gFAMgF;AAChF,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,CAAC;QACH,uBAAuB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,CAAC;QACnD,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAQ,CAAW,CAAC,OAAO,CAAC;IAC9B,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;sGAuBsG;AACtG,MAAM,UAAU,YAAY,CAAC,MAAsB,EAAE,KAAwB;IAC3E,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC;IACjE,mGAAmG;IACnG,+FAA+F;IAC/F,4FAA4F;IAC5F,uFAAuF;IACvF,IAAI,MAAM,CAAC,QAAQ;QACjB,OAAO,uHACL,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,gCAC/E,EAAE,CAAC;IACL,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,2DAA2D,CAAC;IAC9F,OAAO,CACL,GAAG,OAAO,0CAA0C,KAAK,wDAAwD;QACjH,2EAA2E,CAC5E,CAAC;AACJ,CAAC;AAED;;;;;;gFAMgF;AAChF,MAAM,UAAU,cAAc,CAAC,aAAqB;IAClD,KAAK,MAAM,OAAO,IAAI,WAAW,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;QACxE,MAAM,CAAC,GAAG,+CAA+C,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxE,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,sBAAsB,CAAC,aAAqB,EAAE,eAAuB;IACnF,IAAI,MAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,cAAc,CAAC,aAAa,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,yCAA0C,CAAW,CAAC,OAAO,GAAG,CAAC;IAC1E,CAAC;IACD,IAAI,MAAM,KAAK,SAAS;QACtB,OAAO,qKAAqK,CAAC;IAC/K,IAAI,MAAM,KAAK,eAAe;QAC5B,OAAO,CACL,+CAA+C,MAAM,uDAAuD,eAAe,IAAI;YAC/H,wLAAwL,CACzL,CAAC;IACJ,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mBAAmB,CAAC,aAAqB,EAAE,YAAoB,EAAE,MAAoB;IACnG,IAAI,MAA0B,EAAE,KAAyB,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,GAAG,WAAW,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC;QACxC,KAAK,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC,CAAC,gFAAgF;IACpG,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IACtF,OAAO,CACL,wEAAwE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO;QAClI,4EAA4E,MAAM,EAAE,gCAAgC,CACrH,CAAC;AACJ,CAAC;AAeD;;;;;;;;8FAQ8F;AAC9F,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAsB,EAAE,IAAkB;IAC1E,iGAAiG;IACjG,2FAA2F;IAC3F,4FAA4F;IAC5F,0FAA0F;IAC1F,iGAAiG;IACjG,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5F,MAAM,OAAO,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxH,2FAA2F;IAC3F,iGAAiG;IACjG,mGAAmG;IACnG,MAAM,OAAO,GAAG;QACd,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,SAAS;QACnE,IAAI,KAAK,MAAM,IAAI,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,SAAS;KACrF,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IAC9C,OAAO,EAAE,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;AACrH,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cotal-ai/delivery",
   "description": "Cotal delivery daemon: the server-side Plane-3 durable backstop (fan-out writer + trusted reader + membership/ACL authority), a scoped least-privilege NATS client co-located with the broker.",
-  "version": "0.35.0",
+  "version": "0.37.0",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -18,8 +18,8 @@
     }
   },
   "dependencies": {
-    "@cotal-ai/workspace": "0.35.0",
-    "@cotal-ai/core": "0.35.0"
+    "@cotal-ai/workspace": "0.37.0",
+    "@cotal-ai/core": "0.37.0"
   },
   "files": [
     "dist"
@@ -32,6 +32,7 @@
     "@cotal-ai/smoke-kit": "0.0.0"
   },
   "scripts": {
+    "test": "tsx smoke/delivery-store-boundary.smoke.ts",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "build": "tsc -p tsconfig.json"
   }