@dsh-enhanced/plugin-control-plane 0.1.49 → 0.1.53

package/lib/service.js

@@ -26,6 +26,9 @@ import { adoptSourceRelease, validateSourceAdoptionConfig } from './source-adopt
 import { Ed25519ApprovalAuthority } from './approval.js';
 import { ControlPlaneStore, MODIFY_GENERATOR_DIGEST, controlPlaneDigest } from './store.js';
 import { runDockerPreparedChecks, validateSourceBuildConfig } from './source-build.js';
+import { runNativePreparedChecks } from './native-source-build.js';
+import { NativeMacVerifierRunner } from '@dsh-enhanced/assistant-isolation';
+import { NATIVE_SOURCE_COMPILER } from './native-source-build-worker.js';
 import { awaitSourceSignal, inspectSourceContext, inspectSourceTargetsContext } from './source-context.js';
 import { inspectSourceRevisionContext, prepareRevisedPluginWorkspace, verifyRevisedPluginWorkspace } from './source-revision.js';
 import { inspectSourceCreationContext, prepareCreatedPluginWorkspace, validateSourceCreationFiles, verifyCreatedPluginWorkspace } from './source-creation.js';
@@ -133,6 +136,13 @@ export function normalizeControlPlaneConfig(input) {
         validateSourceApprovalClientConfig(config.sourceApprovals);
     if (config.sourceBuild !== undefined)
         validateSourceBuildConfig(config.sourceBuild);
+    if (config.sourceBuild !== undefined && 'backend' in config.sourceBuild) {
+        if (!config.sourceJobs?.allowedModes || config.sourceJobs.allowedModes.some(mode => mode === 'modify')
+            || config.sourceReleases !== undefined || config.sourceReleaseExecution !== undefined
+            || config.sourceAdoptions !== undefined || config.sourceApprovals !== undefined) {
+            throw new Error('plugin-control-plane: native source build only supports Host-scaffolded create/revise-created');
+        }
+    }
     if (config.sourceReleases !== undefined) {
         validateSourceReleaseClientConfig(config.sourceReleases);
         if (!config.sourceApprovals || config.sourceBuild?.versioning !== 'patch')
@@ -251,6 +261,7 @@ export class PluginControlPlaneService extends Service {
     liveRuntime;
     assertLiveRuntime;
     sourceRuntime;
+    nativeSourceRunner;
     sourceRuntimes = new Set();
     creationCapabilityRuntime;
     creationCapabilityRuntimes = new Set();
@@ -618,68 +629,109 @@ export class PluginControlPlaneService extends Service {
                             throw error;
                         }
                     }
-                    const runtime = new SourceJobRuntime({ config: this.config.sourceJobs, build: this.config.sourceBuild, statePath: this.config.statePath, store: this.store,
-                        ports: {
-                            automations: {
-                                registerHostExecutor: executor => current('automations').registerHostExecutor(executor),
-                                reconcileSystem: request => current('automations').reconcileSystem(request),
-                                reconcileSystemExact: request => current('automations').reconcileSystemExact(request),
-                                pauseSystemOwned: request => current('automations').pauseSystemOwned(request),
-                                inspectSystemOwnedActivation: request => current('automations').inspectSystemOwnedActivation(request),
-                                inspectSystemOwned: request => current('automations').inspectSystemOwned(request),
-                            },
-                            delivery: { validateOwnerRoute: request => current('delivery').validateOwnerRoute(request) },
-                        }, withGapSourceFence: (gapId, owner, callback) => this.taskGaps.withCurrent(gapId, owner, callback),
-                        assertGrowthRun: (run, gapId, owner, generation) => this.assertSourceGrowthRun(run, gapId, owner, generation),
-                        ...(this.config.revisionVerifications ? { inspectRevisionParent: this.inspectRevisionParent,
-                            verifyPreparedRevision: (job, signal) => this.verifyPreparedRevision(job, signal, () => jobsCtx.get('assistantVerifier')) } : {}),
-                        ...(this.config.revisionRegressions ? { verifyPreparedRevisionRegression: (job, signal) => this.verifyPreparedRevisionRegression(job, signal, () => jobsCtx.get('assistantVerifier')) } : {}),
-                        ...(this.config.creationVerifications ? { verifyPreparedCreation: (job, signal) => this.verifyPreparedCreation(job, signal, () => jobsCtx.get('assistantVerifier')) } : {}),
-                        ...(capabilities ? { creationAdoptionEligible: (planId) => capabilities.eligible(planId),
-                            adoptVerifiedCreation: async (job, signal) => {
-                                if (!job.planId)
-                                    throw new Error('created capability has no prepared source plan');
-                                await capabilities.adopt(job.planId, signal);
-                            } } : {}),
-                        ...(this.config.sourceApprovals ? { approvePrepared: async (job, signal) => {
-                                if (!job.planId)
-                                    throw new Error('source job has no prepared plan');
-                                await this.requestOwnerSourceApproval({ planId: job.planId, signal, expectedTrustDigest: job.intent.trustDigest });
-                            } } : {}),
-                        ...(this.config.sourceReleases ? { releasePrepared: async (job, signal) => {
-                                if (!job.planId)
-                                    throw new Error('source job has no prepared plan');
-                                await this.requestOwnerSourceRelease({ planId: job.planId, signal, expectedTrustDigest: job.intent.trustDigest });
-                            } } : {}),
-                        ...(this.config.sourceReleaseExecution ? { releaseTimeoutMs: this.config.sourceReleaseExecution.timeoutMs,
-                            advanceReleased: async (job, signal) => {
-                                if (!job.planId)
-                                    throw new Error('source job has no release plan');
-                                await this.advanceOwnerSourceRelease({ planId: job.planId, signal, expectedTrustDigest: job.intent.trustDigest });
-                            } } : {}),
-                        ...(this.config.sourceAdoptions ? { adoptionTimeoutMs: this.config.sourceAdoptions.timeoutMs,
-                            adoptReleased: async (job, signal, assertCurrent) => {
-                                if (!job.planId)
-                                    throw new Error('source job has no released plan');
-                                await this.adoptOwnerSourceRelease({ sourcePlanId: job.planId, signal, expectedTrustDigest: job.intent.trustDigest, assertCurrent });
-                            } } : {}),
-                        trust: () => this.boundTrust(), prepare: (job, signal, assertCurrent) => this.prepareSourceJob(job, signal, assertCurrent), });
+                    const sourceBuild = this.config.sourceBuild;
+                    let nativeRunner;
+                    try {
+                        nativeRunner = 'backend' in sourceBuild ? new NativeMacVerifierRunner({ backend: 'macos-seatbelt',
+                            stateRoot: sourceBuild.stateRoot, authorityDigest: sourceBuild.authorityDigest,
+                            runtime: sourceBuild.runtime, source: NATIVE_SOURCE_COMPILER, expiresAt: sourceBuild.expiresAt,
+                            maxRuns: sourceBuild.maxRuns, maxTotalDurationMs: sourceBuild.maxTotalDurationMs,
+                            maxDurationMs: sourceBuild.timeoutMs, maxOutputBytes: sourceBuild.outputBytes }) : undefined;
+                    }
+                    catch (error) {
+                        unsubscribeTaskChanges?.();
+                        if (capabilities) {
+                            await capabilities.close();
+                            this.creationCapabilityRuntimes.delete(capabilities);
+                        }
+                        throw error;
+                    }
+                    this.nativeSourceRunner = nativeRunner;
+                    let runtime;
+                    try {
+                        runtime = new SourceJobRuntime({ config: this.config.sourceJobs, build: sourceBuild, statePath: this.config.statePath, store: this.store,
+                            ports: {
+                                automations: {
+                                    registerHostExecutor: executor => current('automations').registerHostExecutor(executor),
+                                    reconcileSystem: request => current('automations').reconcileSystem(request),
+                                    reconcileSystemExact: request => current('automations').reconcileSystemExact(request),
+                                    pauseSystemOwned: request => current('automations').pauseSystemOwned(request),
+                                    inspectSystemOwnedActivation: request => current('automations').inspectSystemOwnedActivation(request),
+                                    inspectSystemOwned: request => current('automations').inspectSystemOwned(request),
+                                },
+                                delivery: { validateOwnerRoute: request => current('delivery').validateOwnerRoute(request) },
+                            }, withGapSourceFence: (gapId, owner, callback) => this.taskGaps.withCurrent(gapId, owner, callback),
+                            assertGrowthRun: (run, gapId, owner, generation) => this.assertSourceGrowthRun(run, gapId, owner, generation),
+                            ...(this.config.revisionVerifications ? { inspectRevisionParent: this.inspectRevisionParent,
+                                verifyPreparedRevision: (job, signal) => this.verifyPreparedRevision(job, signal, () => jobsCtx.get('assistantVerifier')) } : {}),
+                            ...(this.config.revisionRegressions ? { verifyPreparedRevisionRegression: (job, signal) => this.verifyPreparedRevisionRegression(job, signal, () => jobsCtx.get('assistantVerifier')) } : {}),
+                            ...(this.config.creationVerifications ? { verifyPreparedCreation: (job, signal) => this.verifyPreparedCreation(job, signal, () => jobsCtx.get('assistantVerifier')) } : {}),
+                            ...(capabilities ? { creationAdoptionEligible: (planId) => capabilities.eligible(planId),
+                                adoptVerifiedCreation: async (job, signal) => {
+                                    if (!job.planId)
+                                        throw new Error('created capability has no prepared source plan');
+                                    await capabilities.adopt(job.planId, signal);
+                                } } : {}),
+                            ...(this.config.sourceApprovals ? { approvePrepared: async (job, signal) => {
+                                    if (!job.planId)
+                                        throw new Error('source job has no prepared plan');
+                                    await this.requestOwnerSourceApproval({ planId: job.planId, signal, expectedTrustDigest: job.intent.trustDigest });
+                                } } : {}),
+                            ...(this.config.sourceReleases ? { releasePrepared: async (job, signal) => {
+                                    if (!job.planId)
+                                        throw new Error('source job has no prepared plan');
+                                    await this.requestOwnerSourceRelease({ planId: job.planId, signal, expectedTrustDigest: job.intent.trustDigest });
+                                } } : {}),
+                            ...(this.config.sourceReleaseExecution ? { releaseTimeoutMs: this.config.sourceReleaseExecution.timeoutMs,
+                                advanceReleased: async (job, signal) => {
+                                    if (!job.planId)
+                                        throw new Error('source job has no release plan');
+                                    await this.advanceOwnerSourceRelease({ planId: job.planId, signal, expectedTrustDigest: job.intent.trustDigest });
+                                } } : {}),
+                            ...(this.config.sourceAdoptions ? { adoptionTimeoutMs: this.config.sourceAdoptions.timeoutMs,
+                                adoptReleased: async (job, signal, assertCurrent) => {
+                                    if (!job.planId)
+                                        throw new Error('source job has no released plan');
+                                    await this.adoptOwnerSourceRelease({ sourcePlanId: job.planId, signal, expectedTrustDigest: job.intent.trustDigest, assertCurrent });
+                                } } : {}),
+                            trust: () => this.boundTrust(), prepare: (job, signal, assertCurrent) => this.prepareSourceJob(job, signal, assertCurrent),
+                            ...(nativeRunner ? { inspectNativeQuiescence: (key) => nativeRunner.inspectQuiescence(key) } : {}),
+                        });
+                    }
+                    catch (error) {
+                        if (this.nativeSourceRunner === nativeRunner)
+                            this.nativeSourceRunner = undefined;
+                        await nativeRunner?.close();
+                        unsubscribeTaskChanges?.();
+                        if (capabilities) {
+                            await capabilities.close();
+                            this.creationCapabilityRuntimes.delete(capabilities);
+                        }
+                        throw error;
+                    }
                     this.sourceRuntimes.add(runtime);
                     const close = async () => {
                         unsubscribeTaskChanges?.();
                         if (this.sourceRuntime === runtime)
                             this.sourceRuntime = undefined;
+                        let closeError;
                         try {
                             await runtime.close();
                         }
-                        finally {
-                            this.sourceRuntimes.delete(runtime);
-                            if (capabilities) {
-                                if (this.creationCapabilityRuntime === capabilities)
-                                    this.creationCapabilityRuntime = undefined;
-                                await capabilities.close();
-                                this.creationCapabilityRuntimes.delete(capabilities);
-                            }
+                        catch (error) {
+                            closeError = error;
+                        }
+                        if (this.nativeSourceRunner === nativeRunner)
+                            this.nativeSourceRunner = undefined;
+                        this.sourceRuntimes.delete(runtime);
+                        if (this.creationCapabilityRuntime === capabilities)
+                            this.creationCapabilityRuntime = undefined;
+                        const results = await Promise.allSettled([nativeRunner?.close(), capabilities?.close()]);
+                        if (capabilities)
+                            this.creationCapabilityRuntimes.delete(capabilities);
+                        const failures = results.filter((result) => result.status === 'rejected');
+                        if (closeError !== undefined || failures.length) {
+                            throw new AggregateError([...(closeError === undefined ? [] : [closeError]), ...failures.map(result => result.reason)], 'source runtime cleanup failed');
                         }
                     };
                     try {
@@ -2013,7 +2065,8 @@ export class PluginControlPlaneService extends Service {
         if (!Number.isSafeInteger(ttlMs) || ttlMs < 900_000 || ttlMs > 86_400_000) {
             throw new ControlPlaneCliError('INVALID_ARGUMENT', 'ttlMs must be an integer within 900000..86400000');
         }
-        const maximumTimeoutMs = this.config.sourceBuild?.profile === 'repository' ? 1_800_000 : 240_000;
+        const maximumTimeoutMs = this.config.sourceBuild !== undefined && !('backend' in this.config.sourceBuild)
+            && ['repository', 'portable-repository'].includes(this.config.sourceBuild.profile ?? '') ? 1_800_000 : 240_000;
         const timeoutMs = input.timeoutMs ?? 180_000;
         if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 60_000 || timeoutMs > maximumTimeoutMs) {
             throw new ControlPlaneCliError('INVALID_ARGUMENT', `timeoutMs must be an integer within 60000..${maximumTimeoutMs}`);
@@ -2057,12 +2110,21 @@ export class PluginControlPlaneService extends Service {
             // Only owner-bound creation jobs retain the exact package for the
             // independent verifier. Ordinary source tools never receive these bytes.
             const capturePack = (creating || revising) && this.store.getOwnerTaskFailureReference(input.gapId) !== undefined;
-            const checked = await runDockerPreparedChecks({ config: { ...configured, timeoutMs: Math.min(timeoutMs, configured.timeoutMs) },
-                worktree: isolated.worktree, baseCommit, name, scope: generated?.scope ?? [`plugins/${name}`], environment, signal,
-                assertCurrent, preparedAt: Date.now(), ...(creation === undefined ? {} : { creation }),
-                ...(revision === undefined ? {} : { revision: { binding: revision, parentSource: parent.source, parentCertificate: parent.certificate, files: input.files } }),
-                ...(capturePack ? { capturePack: true } : {}),
-                ...(sourceJob === undefined ? {} : { sourceJob: { id: sourceJob.id, containerName: sourceJob.intent.containerName } }) });
+            const common = { worktree: isolated.worktree, baseCommit, name, scope: generated?.scope ?? [`plugins/${name}`],
+                environment, signal, assertCurrent, preparedAt: Date.now(), ...(creation === undefined ? {} : { creation }),
+                ...(revision === undefined ? {} : { revision: { binding: revision, parentSource: parent.source,
+                        parentCertificate: parent.certificate, files: input.files } }), ...(capturePack ? { capturePack: true } : {}) };
+            const checked = 'backend' in configured
+                ? await (async () => {
+                    if ((!creating && !revising) || sourceJob === undefined || this.nativeSourceRunner === undefined
+                        || sourceJob.intent.nativeResource?.key !== sourceJob.id) {
+                        throw new ControlPlaneCliError('SOURCE_BOUNDARY', 'native source preparation requires a durable Host-scaffolded creation job');
+                    }
+                    return runNativePreparedChecks({ ...common, config: { ...configured, timeoutMs: Math.min(timeoutMs, configured.timeoutMs) },
+                        runner: this.nativeSourceRunner, sourceJob: { id: sourceJob.id } });
+                })()
+                : await runDockerPreparedChecks({ ...common, config: { ...configured, timeoutMs: Math.min(timeoutMs, configured.timeoutMs) },
+                    ...(sourceJob === undefined ? {} : { sourceJob: { id: sourceJob.id, containerName: sourceJob.intent.containerName } }) });
             await assertCurrent();
             if (capturePack && checked.packArtifact === undefined)
                 throw new ControlPlaneCliError('SOURCE_BOUNDARY', 'prepared creation artifact was not captured');