@ethernity-cloud/sdk-js 1.7.14 → 1.7.17

package/README.md

@@ -44,9 +44,9 @@ The sdk has been tested on the following operating systems:
       `ecld-publish` registers the image in the ImageRegistry
       (ECImageRegistryV3, `0xa372a6e1...`) before anything discloses its
       name, which makes the name the publishing wallet's; then registers the
-      securelock session on-chain in the SessionRegistry (`0x44442968...`, see
+      securelock session on-chain in the SessionRegistry (`0x78f0c5E9...`, see
       `cas/config.js`), which takes it only from that wallet, resolves a CAS
-      from the ValidatorRegistry (`0x0014aB10...`, or `ECLD_CAS_ADDR=host:port`)
+      from the ValidatorRegistry (`0x8CC8B1dc...`, or `ECLD_CAS_ADDR=host:port`)
       for the compose and the certificate harvest, takes the trustedzone
       session name from the ImageRegistry, and links the session to the
       published image. `ecld-build` signs the securelock `--production`.
@@ -182,6 +182,11 @@ sets the enclave heap (default `1024M`).
   `--network`/`--securelock`/`--trustedzone`; the signing key is `PRIVATE_KEY`
   (or `ECLD_PRIVATE_KEY`) — a funded `0x` key that pays for the order. Resources
   are tunable with `--task-price`/`--cpu`/`--memory`/`--storage`/`--bandwidth`/`--duration`/`--validators`.
+  `--input <file>` / `--input-text <string>` send the task's input dataset, read
+  as `___etny_data_set___`; it travels encrypted, and the trustedzone checks it
+  against the sha256 the request carries. Exit code 0 on a `SUCCESS` task result,
+  1 otherwise; a task that raised in the enclave prints its task code (e.g.
+  `4 (BASE_EXCEPTION)`) and the enclave's error report as its result.
   `--ipfs intake` (the default) delivers the payload to the bootnode's payload
   intake once the request is on chain; `--ipfs <url>` writes and reads through
   that IPFS RPC API instead, with `ECLD_IPFS_TOKEN` (or `IPFS_TOKEN`) as its

package/cas/config.js

@@ -120,8 +120,19 @@ const renderCompose = (content, cas, unsafe) => content
   .map((line) => line.replace(/\s*# __(?:CAS|NO_CAS|SAFE)_ONLY__$/, ''))
   .join('\n');
 
+// The securelock session's ESR environment entry. A CAS-provisioned enclave
+// takes its environment from the session, not from the image's ENV, so the
+// registry address the build baked must also be set here; without ESR (or
+// without an address) the entry is a YAML comment.
+const esrSessionEnvironment = (env) => {
+  const enabled = /^(1|true|yes)$/i.test(String(env.ESR_ENABLED || '').trim());
+  const address = String(env.ESR_CONTRACT_ADDRESS || '').trim();
+  if (!enabled || !/^0x[0-9a-fA-F]{40}$/.test(address)) return '# ESR not enabled';
+  return `ESR_CONTRACT_ADDRESS: "${address}"`;
+};
+
 module.exports = {
   VALIDATOR_REGISTRY, SESSION_REGISTRY, CHAIN, casProvisioned, isMainnetNetwork,
   UNSAFE_NETWORKS, isUnsafeNetwork, TESTNETS, isTestnetNetwork, sessionAttestation,
-  nameOnNetwork, sessionTag, renderCompose,
+  nameOnNetwork, sessionTag, renderCompose, esrSessionEnvironment,
 };

package/nodenithy/build/securelock/src/ecld_state.js

@@ -72,6 +72,7 @@ function configure({ identityPriv, swiftStreamService, bucket, contractAddress,
   _provider = provider;
   _esrLedger = [];
   _taskNonces = {};
+  _taskWrites = {};
   _taskRelayNonces = {};
   _taskLedger = {};
   _taskCaller = normAddr(caller);
@@ -116,6 +117,13 @@ class StateNonceError extends Error {}
 // task code 38 (ESR_COMMIT_LIMIT_EXCEEDED).
 const MAX_COMMITS_PER_TASK = 256;
 
+// How long a read waits for the node to stage a state object the chain names
+// before the task fails, and how often it looks for it: the node writes the
+// objects pinned on it within seconds of the order's start and the ones it has
+// to fetch from the network as they arrive.
+const STATE_STAGE_WAIT_MS = 120000;
+const STATE_STAGE_POLL_MS = 2000;
+
 class StateLimitError extends Error {}
 
 function unwrapStored(stored) {
@@ -260,15 +268,86 @@ function stateKey() {
   return keccak256(Buffer.concat([Buffer.from(DOMAIN_SEP_STATE, 'utf8'), material]));
 }
 
+// A state object is stored as the node's Kubo stores it with `add
+// --cid-version=1 --raw-leaves` and its default chunker: in raw sha256 blocks
+// of BLOCK_SIZE bytes (the last one shorter), a single block as it is, several
+// under a balanced UnixFS tree of at most LINKS_PER_NODE blocks per node.
+// unixfsCid() computes the resulting CID from the bytes, so the enclave
+// commits a CID it derived itself rather than one a node handed it, and the
+// node stores the object under that CID (mvp-pox-node utils.py unixfs_cid).
+const BLOCK_SIZE = 262144;
+const LINKS_PER_NODE = 174;
+
+function cidB32(cid) {
+  return 'b' + base32Encode(cid).toLowerCase().replace(/=+$/, '');
+}
+
+function pbVarint(n) {
+  const out = [];
+  for (;;) {
+    const byte = n % 128;
+    n = Math.floor(n / 128);
+    if (n === 0) {
+      out.push(byte);
+      return Buffer.from(out);
+    }
+    out.push(byte | 0x80);
+  }
+}
+
+// A protobuf field: varint (wire 0) or length-delimited (wire 2).
+function pbField(number, wire, payload) {
+  const tag = pbVarint(number * 8 + wire);
+  return wire === 2 ? Buffer.concat([tag, pbVarint(payload.length), payload]) : Buffer.concat([tag, payload]);
+}
+
+// CIDv1, codec raw (0x55), sha2-256 (0x12, 32 bytes).
+function pbRawCid(content) {
+  return Buffer.concat([Buffer.from([0x01, 0x55, 0x12, 0x20]), crypto.createHash('sha256').update(content).digest()]);
+}
+
+// A dag-pb UnixFS File node over `children`, each [cid, tsize, filesize];
+// returns [cid, tsize, filesize]. Links come before Data in dag-pb; a link
+// carries the child's CID, an empty Name and its Tsize, the size of the
+// child's subtree; Data is UnixFS Type=File(2), filesize, blocksizes.
+function pbFileNode(children) {
+  const links = Buffer.concat(children.map(([cid, tsize]) =>
+    pbField(2, 2, Buffer.concat([pbField(1, 2, cid), pbField(2, 2, Buffer.alloc(0)), pbField(3, 0, pbVarint(tsize))]))));
+  const filesize = children.reduce((n, [, , size]) => n + size, 0);
+  const data = Buffer.concat([pbField(1, 0, pbVarint(2)), pbField(3, 0, pbVarint(filesize)),
+    ...children.map(([, , size]) => pbField(4, 0, pbVarint(size)))]);
+  const block = Buffer.concat([links, pbField(1, 2, data)]);
+  const cid = Buffer.concat([Buffer.from([0x01, 0x70, 0x12, 0x20]), crypto.createHash('sha256').update(block).digest()]);
+  return [cid, block.length + children.reduce((n, [, tsize]) => n + tsize, 0), filesize];
+}
+
 /**
- * CIDv1/raw/sha2-256 for `content`, computed without touching IPFS.
- * Matches `ipfs add --cid-version=1 --raw-leaves`, which is what lets the
- * enclave commit a CID it derived itself rather than one a node handed it.
+ * The CID the node's Kubo gives `content`: the raw block's CID up to one
+ * block, else the root of the balanced UnixFS tree over the blocks,
+ * LINKS_PER_NODE to a node, every node full but the last.
+ */
+function unixfsCid(content, blockSize = BLOCK_SIZE) {
+  const buf = Buffer.isBuffer(content) ? content : Buffer.from(content);
+  if (buf.length <= blockSize) return cidB32(pbRawCid(buf));
+  let nodes = [];
+  for (let i = 0; i < buf.length; i += blockSize) {
+    const chunk = buf.subarray(i, i + blockSize);
+    nodes.push([pbRawCid(chunk), chunk.length, chunk.length]);
+  }
+  while (nodes.length > 1) {
+    const next = [];
+    for (let i = 0; i < nodes.length; i += LINKS_PER_NODE) next.push(pbFileNode(nodes.slice(i, i + LINKS_PER_NODE)));
+    nodes = next;
+  }
+  return cidB32(nodes[0][0]);
+}
+
+/**
+ * CIDv1/raw/sha2-256 for `content`: its CID as one raw block, which is its CID
+ * through the node's Kubo up to BLOCK_SIZE bytes.
  */
 function cidv1Raw(content) {
-  const digest = crypto.createHash('sha256').update(content).digest();
-  const raw = Buffer.concat([Buffer.from([0x01, 0x55, 0x12, 0x20]), digest]);
-  return 'b' + base32Encode(raw).toLowerCase().replace(/=+$/, '');
+  return cidB32(pbRawCid(content));
 }
 
 // RFC4648 base32, no padding stripped here (the caller strips it).
@@ -356,6 +435,12 @@ let _esrLedger = [];
 // even before the node's relay lands on-chain.
 let _taskNonces = {};
 
+// Per-task memo of this task's last commit per key, [acl, data, version, cid]
+// as the chain shows them once the node's relay lands. A read prefers it while
+// the chain still shows an older version, so get() after commit() returns the
+// committed state and a second commit to the key builds on the first.
+let _taskWrites = {};
+
 // Per-task memo of the NEXT relay nonce per key hash, so multiple commits to
 // the same key within one task sign sequential relay nonces even while the
 // node is still relaying the earlier ones.
@@ -429,6 +514,10 @@ class StateRegistry {
   /** [acl, data, version, cid] for `key`; NO permission check here. */
   async _readContainer(key, fallback = {}) {
     const [cid, version] = await this._contract().getState(this.walletAddress, keyHash(key));
+    const own = _taskWrites[key];
+    if (own && own[2] > Number(version || 0)) {
+      return own;
+    }
     if (!version || !cid) {
       return [null, fallback, 0, null];
     }
@@ -579,7 +668,7 @@ class StateRegistry {
 
       const blob = encrypt(Buffer.from(JSON.stringify(stored), 'utf8'));
       // Compute the CID from OUR bytes — never accept one from the node.
-      const cid = cidv1Raw(blob);
+      const cid = unixfsCid(blob);
 
       // Hand the blob and the CID to the node for pinning. It verifies the CID
       // matches; it does not get to choose it. Fire-and-forget.
@@ -597,6 +686,7 @@ class StateRegistry {
         // results): this is what the chain shows once the relay lands.
         ledgerRecord(key, currentVersion + 1, cid, newData);
         _taskNonces[key] = finalNonce;
+        _taskWrites[key] = [nextAcl, newData, currentVersion + 1, cid];
         return [nextAcl, newData];
       } catch (e) {
         const msg = String(e && e.message ? e.message : e);
@@ -623,22 +713,40 @@ class StateRegistry {
    * the node stages state objects in the bucket. That makes the node the
    * delivery path but not a trusted one: content is checked against the CID the
    * chain records, so a substituted blob is rejected rather than decrypted.
+   *
+   * The node stages it as state.<cid>.enc, within seconds of the order's start
+   * when the object is pinned on it and as it arrives when it has to fetch it
+   * from the network, so the object is looked for every STATE_STAGE_POLL_MS
+   * for up to STATE_STAGE_WAIT_MS. state.<key>.enc is the last blob a commit
+   * of this key published, which matches only while no later commit was
+   * published; one that does not match is passed over.
    */
   async _fetch(key, cid) {
-    for (const name of [`state.${key}.enc`, `state.${cid}.enc`]) {
-      // eslint-disable-next-line no-await-in-loop
-      const data = await _swift.getFileContentBytes(_bucket, name).catch(() => null);
-      if (data && data.length) {
-        const buf = Buffer.isBuffer(data) ? data : Buffer.from(data);
-        if (cidv1Raw(buf) !== cid) {
-          throw new Error(
-            `State object ${name} does not match the committed CID ${cid} — refusing to use it`
-          );
+    const deadline = Date.now() + STATE_STAGE_WAIT_MS;
+    let mismatched = [];
+    for (;;) {
+      mismatched = [];
+      for (const name of [`state.${cid}.enc`, `state.${key}.enc`]) {
+        // eslint-disable-next-line no-await-in-loop
+        const data = await _swift.getFileContentBytes(_bucket, name).catch(() => null);
+        if (data && data.length) {
+          const buf = Buffer.isBuffer(data) ? data : Buffer.from(data);
+          if (unixfsCid(buf) === cid) {
+            return buf;
+          }
+          mismatched.push(name);
         }
-        return buf;
       }
+      if (Date.now() >= deadline) break;
+      // eslint-disable-next-line no-await-in-loop
+      await new Promise((resolve) => { setTimeout(resolve, STATE_STAGE_POLL_MS); });
+    }
+    if (mismatched.length) {
+      throw new Error(
+        `State object ${mismatched.join(' and ')} does not match the committed CID ${cid} — refusing to use it`
+      );
     }
-    throw new Error(`Could not read state object for '${key}' (${cid})`);
+    throw new Error(`Could not read state object for '${key}' (${cid}): not staged within ${STATE_STAGE_WAIT_MS / 1000} s`);
   }
 
   async _sendCommit(keyHashHex, cid, expectedVersion, ownerAddr = null, nonce = 0) {
@@ -815,6 +923,7 @@ module.exports = {
   StatePermissionError,
   StateNonceError,
   StateLimitError,
+  unixfsCid,
   esrGrant,
   esrRevoke,
   esrSetPublicRead,

package/nodenithy/run/etny-securelock-test.yaml.tpl

@@ -20,6 +20,9 @@ services:
      pwd: /
      environment:
         GREETING: hello from ETNY SECURELOCK!!!!
+        # A CAS-provisioned enclave takes its environment from this session,
+        # not from the image's ENV; run.js fills in the ESR registry address.
+        __ESR_ENVIRONMENT__
 
 images:
    - name: application_image

package/nodenithy/run.js

@@ -311,7 +311,8 @@ const main = async () => {
     const replacementsSecurelock = {
         PREDECESSOR: PREDECESSOR_HASH_SECURELOCK === 'EMPTY' ? `# predecessor: ${PREDECESSOR_HASH_SECURELOCK}` : `predecessor: ${PREDECESSOR_HASH_SECURELOCK}`,
         MRENCLAVE: process.env.MRENCLAVE_SECURELOCK,
-        ENCLAVE_NAME: ENCLAVE_NAME_SECURELOCK
+        ENCLAVE_NAME: ENCLAVE_NAME_SECURELOCK,
+        ESR_ENVIRONMENT: casConfig.esrSessionEnvironment(process.env)
     };
     if (cas) {
         processYamlTemplate('etny-securelock-test.yaml.tpl', 'etny-securelock-test.yaml', replacementsSecurelock);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ethernity-cloud/sdk-js",
-  "version": "1.7.14",
+  "version": "1.7.17",
   "description": "A package to run ethernity cloud build scripts",
   "scripts": {
     "test": "node --test \"test/**/*.test.js\"",
@@ -32,6 +32,7 @@
     "test.js",
     "info.js",
     "run.js",
+    "runReport.js",
     "network.js",
     "localKubo.js",
     "revert.js",
@@ -39,7 +40,7 @@
     "!**/*.pyc"
   ],
   "dependencies": {
-    "@ethernity-cloud/runner": "^0.6.6",
+    "@ethernity-cloud/runner": "^0.6.12",
     "acorn": "^8.11.0",
     "adm-zip": "^0.5.14",
     "axios": "^1.7.2",

package/pynithy/build/securelock/src/ecld_state.py

@@ -46,6 +46,7 @@ import hashlib
 import io
 import json
 import os
+import time
 
 DOMAIN_SEP_STATE = b"ethernity-cloud/esr-encryption/v1"
 
@@ -75,6 +76,11 @@ _task_ledger = {}
 # get_nonce() right after a commit in the SAME task returns the fresh value
 # even though the node's relay (and thus the chain) has not landed yet.
 _task_nonces = {}
+# Per-task memo of this task's last commit per key, (acl, data, version, cid)
+# as the chain shows them once the node's relay lands. A read prefers it while
+# the chain still shows an older version, so get() after commit() returns the
+# committed state and a second commit to the key builds on the first.
+_task_writes = {}
 # Per-task memo of the NEXT relay nonce per key hash (hex), so multiple
 # commits to the same key within one task sign sequential relay nonces even
 # while the node is still relaying the earlier ones.
@@ -312,7 +318,7 @@ def configure(identity_priv, swift_stream_service, bucket, contract_address,
     value from the client payload or the node's .env.
     """
     global _identity_priv, _swift, _bucket, _contract_address, _web3, _esr_evidence
-    global _task_ledger, _task_nonces, _task_relay_nonces, _task_caller
+    global _task_ledger, _task_nonces, _task_writes, _task_relay_nonces, _task_caller
     _identity_priv = identity_priv
     _swift = swift_stream_service
     _bucket = bucket
@@ -320,6 +326,7 @@ def configure(identity_priv, swift_stream_service, bucket, contract_address,
     _web3 = web3
     _task_ledger = {}
     _task_nonces = {}
+    _task_writes = {}
     _task_relay_nonces = {}
     _esr_evidence = []
     _task_caller = _norm_addr(caller)
@@ -357,6 +364,13 @@ class StatePermissionError(RuntimeError):
 # 0x00 = 1 commit ... 0xFF = 256; an all-zero root means no commits at all).
 MAX_COMMITS_PER_TASK = 256
 
+# How long a read waits for the node to stage a state object the chain names
+# before the task fails, and how often it looks for it: the node writes the
+# objects pinned on it within seconds of the order's start and the ones it
+# has to fetch from the network as they arrive.
+STATE_STAGE_WAIT_SECONDS = 120
+STATE_STAGE_POLL_SECONDS = 2
+
 
 class StateLimitError(RuntimeError):
     """Raised when a task tries to make more than MAX_COMMITS_PER_TASK state
@@ -478,15 +492,77 @@ def looks_like_cid(value) -> bool:
     return False
 
 
-def cidv1_raw(content: bytes) -> str:
-    """CIDv1/raw/sha2-256 for `content`, computed without touching IPFS.
+# A state object is stored as the node's Kubo stores it with `add
+# --cid-version=1 --raw-leaves` and its default chunker: in raw sha256 blocks
+# of BLOCK_SIZE bytes (the last one shorter), a single block as it is, several
+# under a balanced UnixFS tree of at most LINKS_PER_NODE blocks per node.
+# unixfs_cid() computes the resulting CID from the bytes, so the enclave
+# commits a CID it derived itself rather than one a node handed it, and the
+# node stores the object under that CID (mvp-pox-node utils.py unixfs_cid).
+BLOCK_SIZE = 262144
+LINKS_PER_NODE = 174
 
-    Matches `ipfs add --cid-version=1 --raw-leaves`, which is what lets the
-    enclave commit a CID it derived itself rather than one a node handed it.
-    """
-    digest = hashlib.sha256(content).digest()
-    raw = bytes([0x01, 0x55, 0x12, 0x20]) + digest
-    return "b" + base64.b32encode(raw).decode("ascii").lower().rstrip("=")
+
+def _cid_b32(cid: bytes) -> str:
+    return "b" + base64.b32encode(cid).decode("ascii").lower().rstrip("=")
+
+
+def _pb_varint(n: int) -> bytes:
+    out = bytearray()
+    while True:
+        byte = n & 0x7F
+        n >>= 7
+        if n:
+            out.append(byte | 0x80)
+        else:
+            out.append(byte)
+            return bytes(out)
+
+
+def _pb_field(number: int, wire: int, payload: bytes) -> bytes:
+    """A protobuf field: varint (wire 0) or length-delimited (wire 2)."""
+    tag = _pb_varint((number << 3) | wire)
+    return tag + (_pb_varint(len(payload)) + payload if wire == 2 else payload)
+
+
+def _pb_raw_cid(content: bytes) -> bytes:
+    """CIDv1, codec raw (0x55), sha2-256 (0x12, 32 bytes)."""
+    return bytes([0x01, 0x55, 0x12, 0x20]) + hashlib.sha256(content).digest()
+
+
+def _pb_file_node(children):
+    """A dag-pb UnixFS File node over `children`, each (cid, tsize, filesize);
+    returns (cid, tsize, filesize). Links come before Data in dag-pb; a link
+    carries the child's CID, an empty Name and its Tsize, the size of the
+    child's subtree; Data is UnixFS Type=File(2), filesize, blocksizes."""
+    links = b"".join(
+        _pb_field(2, 2, _pb_field(1, 2, cid) + _pb_field(2, 2, b"") + _pb_field(3, 0, _pb_varint(tsize)))
+        for cid, tsize, _ in children)
+    filesize = sum(size for _, _, size in children)
+    data = _pb_field(1, 0, _pb_varint(2)) + _pb_field(3, 0, _pb_varint(filesize))
+    data += b"".join(_pb_field(4, 0, _pb_varint(size)) for _, _, size in children)
+    block = links + _pb_field(1, 2, data)
+    cid = bytes([0x01, 0x70, 0x12, 0x20]) + hashlib.sha256(block).digest()
+    return cid, len(block) + sum(tsize for _, tsize, _ in children), filesize
+
+
+def unixfs_cid(content: bytes, block_size: int = BLOCK_SIZE) -> str:
+    """The CID the node's Kubo gives `content`: the raw block's CID up to one
+    block, else the root of the balanced UnixFS tree over the blocks,
+    LINKS_PER_NODE to a node, every node full but the last."""
+    if len(content) <= block_size:
+        return _cid_b32(_pb_raw_cid(content))
+    nodes = [(_pb_raw_cid(content[i:i + block_size]), len(content[i:i + block_size]), len(content[i:i + block_size]))
+             for i in range(0, len(content), block_size)]
+    while len(nodes) > 1:
+        nodes = [_pb_file_node(nodes[i:i + LINKS_PER_NODE]) for i in range(0, len(nodes), LINKS_PER_NODE)]
+    return _cid_b32(nodes[0][0])
+
+
+def cidv1_raw(content: bytes) -> str:
+    """CIDv1/raw/sha2-256 for `content`: its CID as one raw block, which is
+    its CID through the node's Kubo up to BLOCK_SIZE bytes."""
+    return _cid_b32(_pb_raw_cid(content))
 
 
 # AES-GCM nonce length, pinned explicitly. PyCryptodome defaults to 16 bytes
@@ -601,6 +677,9 @@ class StateRegistry:
         contract = self._contract()
         cid, version, _updated = contract.functions.getState(
             self.wallet_address, _key_hash(key)).call()
+        own = _task_writes.get(key)
+        if own is not None and own[2] > int(version or 0):
+            return own
         if not version or not cid:
             return None, default, 0, None
         if not looks_like_cid(cid):
@@ -747,7 +826,7 @@ class StateRegistry:
 
             blob = _encrypt(json.dumps(stored, separators=(",", ":")).encode("utf-8"))
             # Compute the CID from OUR bytes -- never accept one from the node.
-            cid = cidv1_raw(blob)
+            cid = unixfs_cid(blob)
 
             # Hand the blob and the CID to the node for pinning. It verifies the
             # CID matches; it does not get to choose it. Fire-and-forget: the
@@ -766,6 +845,7 @@ class StateRegistry:
                 # The ledger records the DATA -- the ACL never leaves in results.
                 _ledger_record(key, current_version + 1, cid, new_data)
                 _task_nonces[key] = final_nonce
+                _task_writes[key] = (new_acl, new_data, current_version + 1, cid)
                 return new_acl, new_data
             except Exception as e:
                 # A version race means someone else committed first: re-read and
@@ -805,17 +885,34 @@ class StateRegistry:
         delivery path -- but not a trusted one: the content is checked against
         the CID the chain records, so a substituted or corrupted blob is
         rejected rather than decrypted and returned as state.
+
+        The node stages it as state.<cid>.enc, within seconds of the order's
+        start when the object is pinned on it and as it arrives when it has
+        to fetch it from the network, so the object is looked for every
+        STATE_STAGE_POLL_SECONDS for up to STATE_STAGE_WAIT_SECONDS.
+        state.<key>.enc is the last blob a commit of this key published,
+        which matches only while no later commit was published; one that
+        does not match is passed over.
         """
-        candidates = (f"state.{key}.enc", f"state.{cid}.enc")
-        for name in candidates:
-            ok, data = _swift.get_file_content_bytes(_bucket, name)
-            if ok and data:
-                if cidv1_raw(data) != cid:
-                    raise RuntimeError(
-                        f"State object {name} does not match the committed CID "
-                        f"{cid} -- refusing to use it")
-                return data
-        raise RuntimeError(f"Could not read state object for '{key}' ({cid})")
+        deadline = time.monotonic() + STATE_STAGE_WAIT_SECONDS
+        while True:
+            mismatched = []
+            for name in (f"state.{cid}.enc", f"state.{key}.enc"):
+                ok, data = _swift.get_file_content_bytes(_bucket, name)
+                if ok and data:
+                    if unixfs_cid(data) == cid:
+                        return data
+                    mismatched.append(name)
+            if time.monotonic() >= deadline:
+                break
+            time.sleep(STATE_STAGE_POLL_SECONDS)
+        if mismatched:
+            raise RuntimeError(
+                f"State object {' and '.join(mismatched)} does not match the "
+                f"committed CID {cid} -- refusing to use it")
+        raise RuntimeError(
+            f"Could not read state object for '{key}' ({cid}): not staged "
+            f"within {STATE_STAGE_WAIT_SECONDS} s")
 
     def _send_commit(self, key_hash: bytes, cid: str, expected_version: int,
                      owner_addr: str = None, nonce: int = 0):

package/pynithy/run/etny-securelock-test.yaml.tpl

@@ -24,6 +24,9 @@ services:
         # libraries call os.path.expanduser('~') at startup and abort with
         # "$HOME is not defined" before the enclave emits its public key.
         HOME: /tmp
+        # A CAS-provisioned enclave takes its environment from this session,
+        # not from the image's ENV; run.js fills in the ESR registry address.
+        __ESR_ENVIRONMENT__
 
 images:
    - name: application_image

package/pynithy/run.js

@@ -309,7 +309,8 @@ const main = async () => {
     const replacementsSecurelock = {
         PREDECESSOR: PREDECESSOR_HASH_SECURELOCK === 'EMPTY' ? `# predecessor: ${PREDECESSOR_HASH_SECURELOCK}` : `predecessor: ${PREDECESSOR_HASH_SECURELOCK}`,
         MRENCLAVE: process.env.MRENCLAVE_SECURELOCK,
-        ENCLAVE_NAME: ENCLAVE_NAME_SECURELOCK
+        ENCLAVE_NAME: ENCLAVE_NAME_SECURELOCK,
+        ESR_ENVIRONMENT: casConfig.esrSessionEnvironment(process.env)
     };
     if (cas) {
         processYamlTemplate('etny-securelock-test.yaml.tpl', 'etny-securelock-test.yaml', replacementsSecurelock);

package/run.js

@@ -44,6 +44,7 @@ try { require('dotenv').config(); } catch (e) { /* dotenv optional */ }
 const casConfig = require('./cas/config.js');
 const { networkFor, unsafeVariant } = require('./network.js');
 const { PUBLIC_IPFS_HOST } = require('./localKubo.js');
+const { reportRun } = require('./runReport.js');
 
 // `--ipfs intake` (the default): the artefacts' CIDs are computed locally and
 // the bytes delivered to the bootnode's payload intake once the DO request is
@@ -116,20 +117,19 @@ async function main() {
   let input = null;
   if (opts.inputFile !== undefined) input = fs.readFileSync(opts.inputFile, 'utf8');
   else if (opts.inputText !== undefined) input = opts.inputText;
-  // The enclave executor exposes the input as ___etny_data_set___; the runner
-  // passes it as part of the code's scope, so a payload references it by name.
-  // ecld-run mirrors ecld-test: input is delivered via the payload call itself.
+  // The input is the task's input dataset (runner option inputData): sent
+  // sealed for the trustedzone and read in the payload as ___etny_data_set___.
 
   // ---- runner (ESM) ----
-  let EthernityCloudRunner, ECStatus, ECEvent, ECOrderTaskStatus, enums;
+  let EthernityCloudRunner, ECStatus, ECEvent, enums;
   try {
     const runnerMod = await import('@ethernity-cloud/runner');
     EthernityCloudRunner = runnerMod.default || runnerMod.EthernityCloudRunner;
     enums = await import('@ethernity-cloud/runner/enums.js');
-    ({ ECStatus, ECEvent, ECOrderTaskStatus } = enums);
+    ({ ECStatus, ECEvent } = enums);
   } catch (e) {
     console.error('ecld-run: the runner package is not installed or is too old '
-      + '(need @ethernity-cloud/runner >= 0.6.0): ' + e.message);
+      + '(need @ethernity-cloud/runner >= 0.6.11): ' + e.message);
     process.exit(1);
   }
 
@@ -228,10 +228,9 @@ async function main() {
   const timeout = new Promise((resolve) => { timer = setTimeout(() => resolve('TIMEOUT'), timeoutMs); });
 
   try {
-    const runArgs = [resources, securelock, code, opts.node];
-    if (trustedzone) runArgs.push(trustedzone);
     // Fire the run; its own promise also settles on completion.
-    const runPromise = runner.run(...runArgs).catch((e) => ({ error: e.message }));
+    const runPromise = runner.run(resources, securelock, code, opts.node, trustedzone || null, { inputData: input })
+      .catch((e) => ({ error: e.message }));
     const outcome = await Promise.race([done, timeout, runPromise]);
     clearTimeout(timer);
 
@@ -239,28 +238,7 @@ async function main() {
       console.error(`\necld-run: no result after ${opts.timeout}s; the order may still process on-chain.`);
       process.exit(1);
     }
-    if (outcome && outcome.error) {
-      console.error(`\nstatus     : ERROR`);
-      console.error(`error      : ${outcome.error}`);
-      process.exit(1);
-    }
-
-    // SUCCESS
-    const result = await runner.getResult();
-    const typed = (runner.getStructuredResult && runner.getStructuredResult()) || null;
-    const taskCode = runner.resultTaskCode;
-    const taskName = runner.resultTaskCodeName
-      || (ECOrderTaskStatus && taskCode !== undefined ? ECOrderTaskStatus[taskCode] : undefined);
-
-    if (opts.json) {
-      console.log(JSON.stringify({ task_code: taskCode, task_code_name: taskName, value: result, structured: typed }, null, 2));
-    } else {
-      if (taskName && taskName !== 'SUCCESS') console.log(`task code  : ${taskCode} (${taskName})`);
-      console.log('result     :');
-      console.log(result);
-    }
-    // A non-zero enclave task code is a failed run even though the order landed.
-    process.exit(taskCode === undefined || taskCode === 0 ? 0 : 1);
+    process.exit(await reportRun(runner, outcome, { json: opts.json }));
   } catch (e) {
     clearTimeout(timer);
     console.error('ecld-run: run failed: ' + (e && e.stack ? e.stack : e));

package/runReport.js

@@ -0,0 +1,45 @@
+'use strict';
+
+/* ecld-run's report of a finished run.
+ *
+ * A run that delivered a result prints it; a task the enclave reported with a
+ * non-zero task code (an exception in the dApp, a checksum mismatch, ...)
+ * prints that code and its result, which is the enclave's error report. The
+ * runner signals such a task with its ERROR event, carrying getLastError().
+ */
+
+/**
+ * Print the outcome of a run and return the exit code.
+ * outcome: 'SUCCESS', or { error } from the ERROR event or a rejected run().
+ */
+async function reportRun(runner, outcome, { json = false, out = console.log, err = console.error } = {}) {
+  // { code, name } of the enclave's task code, or null when no result came.
+  const taskCode = runner.getResultTaskCode();
+  const error = outcome && outcome.error;
+  if (!taskCode && error) {
+    err('\nstatus     : ERROR');
+    err(`error      : ${error}`);
+    return 1;
+  }
+  const result = await runner.getResult();
+  const typed = (runner.getStructuredResult && runner.getStructuredResult()) || null;
+  if (json) {
+    out(JSON.stringify({
+      task_code: taskCode ? taskCode.code : undefined,
+      task_code_name: taskCode ? taskCode.name : undefined,
+      value: result,
+      structured: typed,
+    }, null, 2));
+  } else {
+    if (taskCode && taskCode.code !== 0) out(`task code  : ${taskCode.code} (${taskCode.name})`);
+    out('result     :');
+    out(result);
+  }
+  if (taskCode && taskCode.code !== 0) {
+    err(`error      : ${runner.getLastError() || error || taskCode.name}`);
+    return 1;
+  }
+  return error ? 1 : 0;
+}
+
+module.exports = { reportRun };

package/test.js

@@ -1,4 +1,4 @@
-#!/usr/bin/env node
+#!/usr/bin/env node
 /* ecld-test — run a Nodenithy payload locally, without SGX, exactly as the
  * enclave would.
  *