@crvouga/dev-fleet 0.7.0 → 0.9.0

package/src/platform/manager-host.ts

@@ -15,6 +15,14 @@ export interface BootItem {
   detail: string;
 }
 
+/** `notApplicable` names settings the machine lacks (a virtual Mac has no
+ * womp): the playbook skips them, so they are not drift.
+ */
+export interface PowerDrift {
+  drifted: string[];
+  notApplicable: string[];
+}
+
 /** Where the manager runs, behind one interface: how it is named, how it is
  * kept awake, how its services are supervised and where they keep data. The
  * macOS host is the default and the reference.
@@ -29,8 +37,9 @@ export interface ManagerHost {
   dataDirectory(home: string): string;
   /** The machine's local host name, as `manager.id` must name it. */
   localHostName(run: Runner): Promise<string | null>;
-  /** The power settings that differ from the manager's policy. */
-  powerDrift(run: Runner): Promise<string[]>;
+  /** The power settings that differ from the manager's policy, and those
+   * this machine does not have at all. */
+  powerDrift(run: Runner): Promise<PowerDrift>;
   /** What brings the manager's services back after a power cut, unattended. */
   bootRecovery(run: Runner, home: string): Promise<BootItem[]>;
   /** How a person applies what bootRecovery measures. */
@@ -78,10 +87,18 @@ export const MACOS_MANAGER: ManagerHost = {
     return result.ok ? hostId(result.stdout.trim()) : null;
   },
   async powerDrift(run) {
-    const observed = await acPower(run);
-    return Object.entries(macos.pmset)
-      .filter(([key, value]) => observed(key) !== value)
-      .map(([key]) => key);
+    const result = await run(['pmset', '-g', 'custom']);
+    const ac = result.ok ? result.stdout.split('AC Power:')[1] : undefined;
+    const observed = (key: string) =>
+      new RegExp(`^\\s*${key}\\s+(\\S+)`, 'm').exec(ac ?? '')?.[1];
+    const absent = (key: string) =>
+      ac !== undefined && observed(key) === undefined;
+    return {
+      drifted: Object.entries(macos.pmset)
+        .filter(([key, value]) => !absent(key) && observed(key) !== value)
+        .map(([key]) => key),
+      notApplicable: Object.keys(macos.pmset).filter(absent),
+    };
   },
   async bootRecovery(run, home) {
     const observed = await acPower(run);
@@ -126,7 +143,7 @@ export const MACOS_MANAGER: ManagerHost = {
     ];
   },
   bootRemedy: (workspace) =>
-    `Apply the manager policy, as an administrator: cd ${workspace} && ${ansibleCommand('darwin').join(' ')} -K ansible/macos/manager.yml (autorestart, Docker Desktop at login), then fleet-sync (LaunchAgents). FileVault and automatic login are a person’s choice: docs/manager-recovery.md.`,
+    `fleet-sync applies ansible/macos/manager.yml on every run (autorestart, Docker Desktop at login, LaunchAgents); autorestart needs the one grant an administrator gives: cd ${workspace} && ${ansibleCommand('darwin').join(' ')} -e user=$(id -un) -K ansible/macos/manager-privilege.yml. FileVault and automatic login are a person’s choice: docs/manager-recovery.md.`,
 };
 
 /** The sleep states a Linux manager must never enter. */
@@ -153,7 +170,7 @@ export const LINUX_MANAGER: ManagerHost = {
       const result = await run(['systemctl', 'is-enabled', target]);
       if (result.stdout.trim() !== 'masked') drifted.push(target);
     }
-    return drifted;
+    return { drifted, notApplicable: [] };
   },
   async bootRecovery(run) {
     const user = userInfo().username;

package/src/platform/resource-verify.ts

@@ -1,4 +1,4 @@
-import policy from '../../ansible/ubuntu/policy.json';
+import { threshold } from '../worker-sizing';
 import type { Check, Runner } from '../types';
 
 const AGENT_DROP_IN =
@@ -9,7 +9,6 @@ const GUARDS = [
   'personal-fleet-disk-gc.timer',
 ];
 const MIB = 1024 * 1024;
-const FLOOR_MIB = policy.resourceSafety.diskGuardFloorMiB;
 
 /** A failure code and remedy, or undefined when the probe passes. */
 type Probe = (run: Runner) => Promise<[string, string] | undefined>;
@@ -61,17 +60,29 @@ const swapActive: Probe = async (run) => {
       ];
 };
 
+/** The disk guard's floor scales with the filesystem
+ * (`sizing.thresholds.diskGuardFloor`); one of unknown size gets the upper
+ * bound. */
 const diskAboveFloor =
   (path: string): Probe =>
   async (run) => {
-    const df = await run(['df', '--output=avail', '-B1', path]);
-    const free = Number(df.stdout.trim().split('\n').at(-1));
-    if (!df.ok || !Number.isSafeInteger(free))
+    const df = await run(['df', '--output=avail,size', '-B1', path]);
+    const [free, size] = (df.stdout.trim().split('\n').at(-1) ?? '')
+      .trim()
+      .split(/\s+/)
+      .map(Number);
+    if (!df.ok || free === undefined || !Number.isSafeInteger(free))
       return ['DISK_FREE_UNREADABLE', `Free space on ${path} is unreadable.`];
-    if (free >= FLOOR_MIB * MIB) return undefined;
+    const floor = threshold(
+      'diskGuardFloor',
+      size !== undefined && Number.isSafeInteger(size)
+        ? Math.floor(size / MIB)
+        : Number.MAX_SAFE_INTEGER
+    );
+    if (free >= floor * MIB) return undefined;
     return [
       'DISK_FREE_BELOW_FLOOR',
-      `${path} has ${Math.floor(free / MIB)} MiB free, under the ${FLOOR_MIB} MiB floor. The disk GC already removed idle build output and caches; remove stale worktrees or data, or run "sudo systemctl start personal-fleet-disk-gc.service" and read its journal.`,
+      `${path} has ${Math.floor(free / MIB)} MiB free, under the ${floor} MiB floor. The disk GC already removed idle build output and caches; remove stale worktrees or data, or run "sudo systemctl start personal-fleet-disk-gc.service" and read its journal.`,
     ];
   };
 

package/src/platform/t3-policy.ts

@@ -8,27 +8,40 @@ import { rename, rm, symlink } from 'node:fs/promises';
 import { userInfo } from 'node:os';
 import type { Runner, Check } from '../types';
 
+/** The administrator policy a worker's T3 runs: the fleet's
+ * (`ansible/ubuntu/t3/policy.json`, which keeps linked environments on so
+ * the manager pairs with a replaced worker without a person) with the
+ * worker's provider instances locked.
+ */
+export function workerPolicy(instances: Record<string, unknown>) {
+  return {
+    ...policy,
+    settings: {
+      ...policy.settings,
+      ...Object.fromEntries(
+        Object.entries(instances).map(([id, value]) => [
+          `providerInstances.${id}`,
+          { value, locked: true },
+        ])
+      ),
+    },
+  };
+}
+
 export async function stageT3Policy(
   root: string,
   executable: string,
   run: Runner,
-  node: string
+  target: { node: string; restartBusy?: boolean }
 ): Promise<Check> {
+  const { node } = target;
   const instances = await desired(
     resolve(root, 'agents/t3.json'),
     await stableWorkspace(root),
     node
   );
   const user = userInfo();
-  const document = {
-    ...policy,
-    settings: Object.fromEntries(
-      Object.entries(instances).map(([id, value]) => [
-        `providerInstances.${id}`,
-        { value, locked: true },
-      ])
-    ),
-  };
+  const document = workerPolicy(instances);
   const result = await runAnsible(run, 't3-policy.yml', {
     cwd: resolve(root, 'ansible/ubuntu'),
     input: JSON.stringify({
@@ -37,6 +50,7 @@ export async function stageT3Policy(
       development_user: user.username,
       development_uid: user.uid,
       development_home: user.homedir,
+      t3_restart_busy: target.restartBusy === true,
     }),
     timeoutMs: 120_000,
   });

package/src/platform/t3-service.ts

@@ -1,20 +1,41 @@
 import policy from '../../ansible/ubuntu/policy.json';
 import type { Runner, Check } from '../types';
+import type { Session } from '../../bootstrap/worker-features';
 
 /** The user unit that runs the pinned desktop app (UI and embedded server). */
 export const T3_DESKTOP_UNIT = 't3code-desktop.service';
+/** The lingering user unit that runs the pinned native server on a headless
+ * worker (`t3-headless.yml`). */
+export const T3_HEADLESS_UNIT = 't3code-headless.service';
 
-/** Workers run one T3 process: the desktop app, started with the auto-login
- * graphical session. `t3-desktop.yml` installs it, retires the former headless
- * server and starts the app; this only refuses a foreign launcher beforehand
+/** The unit that runs T3 for a session type. */
+export function t3Unit(session: Session = 'desktop'): string {
+  return session === 'headless' ? T3_HEADLESS_UNIT : T3_DESKTOP_UNIT;
+}
+
+/** Workers run one T3 process: on a desktop worker the desktop app, started
+ * with the auto-login graphical session (`t3-desktop.yml`); on a headless
+ * worker the pinned native server as a lingering user service
+ * (`t3-headless.yml`). The play installs it, retires the other session
+ * type's unit and starts it; this only refuses a foreign launcher beforehand
  * and measures the result afterwards.
  */
 export async function convergeT3Service(
   artifact: { path: string; version: string },
   run: Runner,
-  prepare: () => Promise<Check[]> = async () => [],
-  install: () => Promise<boolean> = async () => true
+  steps: {
+    /** Stages the policy; any check it returns stops here. */
+    prepare?: () => Promise<Check[]>;
+    /** Applies the session type's playbook. */
+    install?: () => Promise<boolean>;
+    session?: Session;
+  } = {}
 ): Promise<Check[]> {
+  const {
+    prepare = async () => [],
+    install = async () => true,
+    session = 'desktop',
+  } = steps;
   const existing = await run(['t3', '--version']);
   if (conflictingVersion(existing, artifact.version))
     return pending(
@@ -23,27 +44,55 @@ export async function convergeT3Service(
     );
   const preparation = await prepare();
   if (preparation.length) return preparation;
-  if (!(await install()))
-    return pending(
+  const words = SESSION_WORDS[session];
+  if (!(await install())) return pending(...words.installFailed);
+  const unit = t3Unit(session);
+  const active = await userctl(run, 'is-active', unit);
+  const enabled = await userctl(run, 'is-enabled', unit);
+  if (!active.ok || !enabled.ok) return pending(...words.stopped(unit));
+  return [{ id: 't3:service', status: 'pass', summary: words.running }];
+}
+
+/** How a worker's T3 restarts for a new release or policy, as the manager's
+ * bootstrap passes it on to node convergence (`fleet-sync --restart-busy`).
+ * The words cross from one revision's script to another: an interface.
+ */
+export const T3_RESTART_MODES = ['keep-turns', 'restart-busy'] as const;
+
+/** What the check says of each session type: its codes and remedies. */
+const SESSION_WORDS: Record<
+  Session,
+  {
+    installFailed: [string, string];
+    stopped: (unit: string) => [string, string];
+    running: string;
+  }
+> = {
+  desktop: {
+    installFailed: [
       'T3_DESKTOP_INSTALL_FAILED',
-      'Inspect the t3-desktop.yml Ansible output (package download, apt, GDM auto-login, user unit). T3 data in ~/.t3 is untouched.'
-    );
-  const active = await userctl(run, 'is-active', T3_DESKTOP_UNIT);
-  const enabled = await userctl(run, 'is-enabled', T3_DESKTOP_UNIT);
-  if (!active.ok || !enabled.ok)
-    return pending(
+      'Inspect the t3-desktop.yml Ansible output (package download, apt, GDM auto-login, user unit). T3 data in ~/.t3 is untouched.',
+    ],
+    stopped: (unit) => [
       'T3_DESKTOP_STOPPED',
-      `The desktop app needs the auto-login graphical session. Reboot or log in on the machine, then inspect journalctl --user -u ${T3_DESKTOP_UNIT}; ~/.t3 is preserved.`
-    );
-  return [
-    {
-      id: 't3:service',
-      status: 'pass',
-      summary:
-        'Pinned T3 desktop app is enabled for the auto-login session and running. Private routing, policy and pairing remain separate checks.',
-    },
-  ];
-}
+      `The desktop app needs the auto-login graphical session. Reboot or log in on the machine, then inspect journalctl --user -u ${unit}; ~/.t3 is preserved.`,
+    ],
+    running:
+      'Pinned T3 desktop app is enabled for the auto-login session and running. Private routing, policy and pairing remain separate checks.',
+  },
+  headless: {
+    installFailed: [
+      'T3_SERVER_INSTALL_FAILED',
+      'Inspect the t3-headless.yml Ansible output (the pinned server in the toolchain, the user unit). T3 data in ~/.t3 is untouched.',
+    ],
+    stopped: (unit) => [
+      'T3_SERVER_STOPPED',
+      `The T3 server is a lingering user service and needs no login. Inspect journalctl --user -u ${unit} and loginctl show-user for Linger=yes; ~/.t3 is preserved.`,
+    ],
+    running:
+      'Pinned T3 server is enabled as a lingering user service and running, with no display. Private routing, policy and pairing remain separate checks.',
+  },
+};
 
 /** The recovery script, installed outside every revision (`tasks/recovery.yml`). */
 export const T3_HEALTH_SCRIPT = '/usr/local/lib/personal-fleet/t3-health.sh';
@@ -85,7 +134,8 @@ export async function restartDeferral(
 export async function runningVersionCheck(
   run: Runner,
   uid: number,
-  now: number = Date.now()
+  now: number = Date.now(),
+  session: Session = 'desktop'
 ): Promise<Check> {
   const server = await run(
     [
@@ -98,11 +148,8 @@ export async function runningVersionCheck(
     ],
     { timeoutMs: 15_000 }
   );
-  const installed = await run(['cat', T3_DESKTOP_RELEASE]);
   const running = serverVersion(server.ok ? server.stdout : '');
-  const release = /^T3-Code-(.+)-[a-z0-9]+\.deb$/.exec(
-    installed.ok ? installed.stdout.trim() : ''
-  )?.[1];
+  const release = await installedRelease(run, session);
   const id = 't3:running-version';
   if (!running || !release)
     return {
@@ -111,7 +158,7 @@ export async function runningVersionCheck(
       summary: 'T3_RUNNING_VERSION_UNKNOWN',
       remedy: {
         action:
-          'The running server or the installed release could not be read. Check worker:t3-health, then rerun fleet-sync to reinstall the pinned desktop app.',
+          'The running server or the installed release could not be read. Check worker:t3-health, then rerun fleet-sync to reinstall the pinned T3.',
       },
     };
   if (running === release)
@@ -127,12 +174,37 @@ export async function runningVersionCheck(
     summary: 'T3_RESTART_PENDING',
     remedy: {
       action: deferral.overdue
-        ? `T3 still runs ${running} after ${policy.t3RestartMaxDeferralHours} hours because agent turns kept running. Finish or stop them, or restart ${T3_DESKTOP_UNIT} on the worker (this ends its running turns).`
+        ? `T3 still runs ${running} after ${policy.t3RestartMaxDeferralHours} hours because agent turns kept running. Finish or stop them, or restart ${t3Unit(session)} on the worker (this ends its running turns).`
         : `T3 runs ${running}; ${release} is installed. personal-worker-recovery restarts it at the first check with no agent turn running.`,
     },
   };
 }
 
+/** The release installed for the session: the desktop package the app was
+ * unpacked from, or the versioned directory the server unit runs. */
+async function installedRelease(
+  run: Runner,
+  session: Session
+): Promise<string | undefined> {
+  if (session === 'headless') {
+    const shown = await run([
+      'systemctl',
+      '--user',
+      'show',
+      '--property=ExecStart',
+      '--value',
+      T3_HEADLESS_UNIT,
+    ]);
+    return shown.ok
+      ? /\/t3-([\w.+-]+?)-linux-[a-z0-9]+\/t3\b/.exec(shown.stdout)?.[1]
+      : undefined;
+  }
+  const installed = await run(['cat', T3_DESKTOP_RELEASE]);
+  return /^T3-Code-(.+)-[a-z0-9]+\.deb$/.exec(
+    installed.ok ? installed.stdout.trim() : ''
+  )?.[1];
+}
+
 function serverVersion(body: string): string | undefined {
   try {
     const value: unknown = JSON.parse(body);
@@ -148,15 +220,18 @@ function serverVersion(body: string): string | undefined {
   }
 }
 
-/** When the desktop app last started; changes exactly when it restarts. */
-export async function t3StartedAt(run: Runner): Promise<string> {
+/** When T3 last started; changes exactly when it restarts. */
+export async function t3StartedAt(
+  run: Runner,
+  session: Session = 'desktop'
+): Promise<string> {
   const shown = await run([
     'systemctl',
     '--user',
     'show',
     '--property=ActiveEnterTimestampMonotonic',
     '--value',
-    T3_DESKTOP_UNIT,
+    t3Unit(session),
   ]);
   return shown.ok ? shown.stdout.trim() : '';
 }

package/src/platform/ubuntu-release.ts

@@ -9,6 +9,11 @@ export interface UbuntuRelease {
   architectures: string[];
   /** Pins of this release that differ from the policy's `packages`. */
   packages?: Record<string, string>;
+  /** Pins of this release that differ from the policy's `browser.packages`. */
+  browserPackages?: Record<string, string>;
+  /** The digest of the key Tailscale signs this release's suite with, when
+   * it is not the policy's `tailscale.keySha256`. */
+  tailscaleKeySha256?: string;
 }
 
 export const UBUNTU_RELEASES: readonly UbuntuRelease[] = policy.releases;
@@ -21,6 +26,25 @@ export function packagePins(
   return { ...policy.packages, ...release?.packages };
 }
 
+/** The browser library pins of one release, combined the same way. */
+export function browserPackagePins(
+  release: UbuntuRelease | undefined
+): Record<string, string> {
+  return { ...policy.browser.packages, ...release?.browserPackages };
+}
+
+/** The Tailscale version and the digest of the key that signs one release's
+ * suite (as tasks/release.yml selects it for Ansible). */
+export function tailscalePins(release: UbuntuRelease | undefined): {
+  version: string;
+  keySha256: string;
+} {
+  return {
+    version: policy.tailscale.version,
+    keySha256: release?.tailscaleKeySha256 ?? policy.tailscale.keySha256,
+  };
+}
+
 /** `uname -m` for each Debian architecture name. */
 const KERNEL_ARCHITECTURES: Record<string, string> = {
   amd64: 'x86_64',

package/src/platform/ubuntu-verify.ts

@@ -1,9 +1,13 @@
 import type { Check, Runner } from '../types';
+import type { MachineClass } from '../machine/machine-class';
 
-const LOGIND = {
+/** What a lid does: a virtual machine has none, so these do not apply. */
+const LID = {
   HandleLidSwitch: 's "ignore"',
   HandleLidSwitchDocked: 's "ignore"',
   HandleLidSwitchExternalPower: 's "ignore"',
+};
+const LOGIND = {
   IdleAction: 's "ignore"',
   KillUserProcesses: 'b false',
   StopIdleSessionUSec: 't 18446744073709551615',
@@ -17,9 +21,33 @@ const POWER_FILES = [
  */
 export async function verifyUbuntuBoot(
   user: string,
-  run: Runner
+  run: Runner,
+  machine: MachineClass = 'physical'
+): Promise<Check[]> {
+  const virtual = machine === 'virtual';
+  // On a virtual machine the lid policy is not applicable; the sleep masks
+  // stay, since a guest can still be suspended by its own idle policy.
+  const lid: Check[] = virtual
+    ? [
+        {
+          id: 'ubuntu:lid-policy',
+          status: 'not-applicable',
+          summary: 'Not applicable: a virtual machine has no lid.',
+        },
+      ]
+    : [];
+  return [
+    ...lid,
+    ...(await bootPolicy(user, run, virtual ? LOGIND : { ...LID, ...LOGIND })),
+  ];
+}
+
+async function bootPolicy(
+  user: string,
+  run: Runner,
+  properties: Record<string, string>
 ): Promise<Check[]> {
-  for (const [property, expected] of Object.entries(LOGIND)) {
+  for (const [property, expected] of Object.entries(properties)) {
     const observed = await run([
       'busctl',
       'get-property',

package/src/platform/ubuntu-worker.ts

@@ -0,0 +1,58 @@
+import type { Runner } from '../types';
+import type { WorkerFeatures } from '../worker-features';
+import {
+  browserPackagePins,
+  kernelArchitectures,
+  packagePins,
+  tailscalePins,
+  UBUNTU_RELEASES,
+  ubuntuRelease,
+} from './ubuntu-release';
+import type { WorkerPlatform, WorkerRelease } from './worker-platform';
+
+/** Ubuntu: every release ansible/ubuntu/policy.json accepts, converged by
+ * the playbooks under ansible/ubuntu. A release's differences are data of
+ * its policy entry (tasks/release.yml selects it from the facts). */
+export const UBUNTU_WORKER: WorkerPlatform = {
+  family: 'ubuntu',
+  label: 'Ubuntu',
+  policy: 'ansible/ubuntu/policy.json',
+  playbooks: 'ansible/ubuntu',
+  releases: UBUNTU_RELEASES,
+  mismatch: 'UBUNTU_BASELINE_MISMATCH',
+  packageManager: 'apt',
+  packagePins: (release) => packagePins(ubuntuRelease(release?.release)),
+  browserPackagePins: (release) =>
+    browserPackagePins(ubuntuRelease(release?.release)),
+  tailscalePins: (release) => tailscalePins(ubuntuRelease(release?.release)),
+  serviceManager: 'systemd',
+  sessionModel: 'systemd-user-linger',
+  release: (version) => ubuntuRelease(version),
+  kernelArchitectures: (release: WorkerRelease) =>
+    kernelArchitectures(ubuntuRelease(release.release) ?? release),
+  // Loaded when used: the platform probe reads this module on the manager,
+  // and the host checks pull in what only a worker runs.
+  hostChecks: async (
+    user: string,
+    run: Runner,
+    features?: WorkerFeatures,
+    powerRecoveryNote?: string
+  ) =>
+    (await import('../worker-host-checks')).workerHostChecks(
+      user,
+      run,
+      features,
+      powerRecoveryNote
+    ),
+};
+
+/** Every platform a worker may run. A machine of any other family is
+ * refused by the first check that can tell (docs/support-matrix.md). */
+export const WORKER_PLATFORMS: readonly WorkerPlatform[] = [UBUNTU_WORKER];
+
+/** The platform of an `ID` from /etc/os-release, when workers may run it. */
+export function workerPlatform(
+  family: string | null | undefined
+): WorkerPlatform | undefined {
+  return WORKER_PLATFORMS.find((platform) => platform.family === family);
+}

package/src/platform/worker-platform.ts

@@ -0,0 +1,72 @@
+import type { Check, Runner } from '../types';
+import type { WorkerFeatures } from '../worker-features';
+
+/** One release of a worker platform, as its policy names it. */
+export interface WorkerRelease {
+  /** `VERSION_ID` of /etc/os-release. */
+  release: string;
+  codename: string;
+  /** Debian architecture names, as `dpkg --print-architecture` reports them. */
+  architectures: string[];
+}
+
+/** What differs between the operating systems a worker may run. Everything
+ * the manager and the worker's own checks need to know about one platform is
+ * here; what a playbook needs is data of the platform's policy, selected on
+ * the machine from its facts. Ubuntu is the one implementation
+ * (`src/platform/ubuntu-worker.ts`); docs/support-matrix.md lists the
+ * platforms that are not, and what each would need.
+ */
+export interface WorkerPlatform {
+  /** `ID` of /etc/os-release, as the platform probe prints it. */
+  readonly family: string;
+  /** The name the support matrix gives it. */
+  readonly label: string;
+  /** The policy that names its releases and pins, from the package root. */
+  readonly policy: string;
+  /** The playbooks that converge it, from the package root. */
+  readonly playbooks: string;
+  /** The releases a worker may run, newest first. */
+  readonly releases: readonly WorkerRelease[];
+  /** The reason a machine of this family is refused before anything is
+   * installed: another release or another CPU. */
+  readonly mismatch: string;
+
+  /** Packages: the system package manager the pins are written for, and the
+   * exact pins of one release (common pins with the release's own over them). */
+  readonly packageManager: 'apt';
+  packagePins(release: WorkerRelease | undefined): Record<string, string>;
+  /** The libraries headless Chromium loads, pinned the same way. */
+  browserPackagePins(
+    release: WorkerRelease | undefined
+  ): Record<string, string>;
+  /** The Tailscale version and the digest of the key that signs this
+   * release's package suite. */
+  tailscalePins(release: WorkerRelease | undefined): {
+    version: string;
+    keySha256: string;
+  };
+
+  /** Service manager: what keeps the always-on system services and the
+   * developer's own units running and restarts them. */
+  readonly serviceManager: 'systemd';
+  /** Session model: how the developer's processes (T3, agents) outlive a
+   * login. `systemd-user-linger`: a lingering systemd user manager, started
+   * at boot without anyone logged in, never stopped by logind. */
+  readonly sessionModel: 'systemd-user-linger';
+
+  /** The release a probe reported, when the platform accepts it. */
+  release(version: string | null | undefined): WorkerRelease | undefined;
+  /** The `uname -m` names one release runs on. */
+  kernelArchitectures(release: WorkerRelease): string[];
+  /** Checks: the measured host evidence of a worker of this platform,
+   * read-only, run on the worker itself. What its declared features leave
+   * out is not applicable; so is a physical machine's power recovery on a
+   * virtual one, which `powerRecoveryNote` may say who provides. */
+  hostChecks(
+    user: string,
+    run: Runner,
+    features?: WorkerFeatures,
+    powerRecoveryNote?: string
+  ): Promise<Check[]>;
+}

package/src/protocol.ts

@@ -2,7 +2,7 @@ import { record } from './config';
 import { FINGERPRINT_FILES } from './input-hashes';
 import type { Check, Snapshot } from './types';
 
-const STATUSES = ['pass', 'warn', 'fail', 'skip'];
+const STATUSES = ['pass', 'warn', 'fail', 'skip', 'not-applicable'];
 
 export function validCheck(value: unknown): value is Check {
   if (