@hasna/infinity 0.1.0

package/LICENSE

@@ -0,0 +1,3 @@
+Copyright (c) 2026 Hasna. All rights reserved.
+
+Private and confidential. Unauthorized use or distribution is prohibited.

package/README.md

@@ -0,0 +1,331 @@
+# Infinity V1 reference authority
+
+`infinity` is a private Bun/TypeScript reference implementation of the frozen
+Infinity V1 Run Authority contract. It deliberately contains no repository
+checkout, task execution, subprocess, Git, provider SDK, credential resolver,
+or arbitrary host-path capability in the authority/API dependency graph.
+
+This bootstrap slice provides:
+
+- closed RunSpec, semantically checked Run/Attempt/operation/event/outbox DTOs,
+  and the versioned full broker-fence wire tuple;
+- a deterministic in-memory authority with permanent admission keys,
+  idempotent mutations, queue fairness, immutable attempt/lease history,
+  cancellation, retry, exact human discard, approval, and held transactional
+  outbox behavior;
+- a deterministic append-only effect journal with stable semantic step IDs,
+  immutable execution-record identities, typed outcomes, Ed25519-signed
+  contiguous anchors, independently authorized receipts, and stored-member
+  `reconciliation_blocked` to `quarantined` mapping;
+- a frozen-shaped Accounts eligibility envelope (including issuer/audience,
+  evidence windows, access-target union, request digest, generations, and
+  policy evidence) and exact-resource Sandboxes lifecycle ports with
+  fail-closed, idempotent deterministic fakes;
+- a versioned PostgreSQL migration, normalized authority tables and constraints,
+  separated migration/runtime/reconciler roles, a transactional PostgreSQL
+  authority adapter, and restart-safe outbox/effect reconciliation;
+- the fixed-loopback `infinity` CLI, owner-only SQLite pre-dispatch operation
+  journal, truthful capability discovery, bounded Run wait/event cursors, and a
+  separate local `infinity-api` artifact;
+- a durable Postgres checkpoint/Git broker composition with exact-fence
+  idempotency, externally anchored provider effects, signed provenance and
+  result-authority boundaries, version-pinned provenance evidence, domain-
+  separated prehashed manifest signatures with authority-signed, fresh,
+  non-replayable trust observations, append-only revocation history, a
+  transaction-locked final trust-head CAS, sealed pre/post/final trust
+  witnesses, atomically current-trust-authorized passing receipts, clean
+  verification, and currentness-rechecked expected-base GitHub App promotion;
+- a schema-only reviewed MCP tool registry. It has no MCP transport or hidden
+  generic mutation route.
+
+## Verify
+
+```sh
+bun install --frozen-lockfile
+bun test
+bun run typecheck
+bun run build
+bun run audit
+```
+
+The PostgreSQL tests are opt-in so the ordinary unit suite remains hermetic.
+Point them at a disposable migrated database to run the live role, constraint,
+API restart, outbox recovery, and signed-frontier cases:
+
+```sh
+INFINITY_TEST_POSTGRES_URL='postgresql://USER@127.0.0.1:5432/DISPOSABLE_DB' bun test tests/postgres-persistence.test.ts
+```
+
+Schema changes use a migration-only connection. The command never prints the
+connection string:
+
+```sh
+INFINITY_MIGRATOR_DATABASE_URL='postgresql://MIGRATOR@DB/INFINITY' bun run migrate
+```
+
+The local API binds only `127.0.0.1` and uses a fixed injected principal. It is
+a development reference, not production authentication or persistence:
+
+```sh
+bun run dist/http-api.js --port 18787
+bun run dist/cli.js --output json doctor
+```
+
+## Self-hosted runtime
+
+`infinity-self-hosted` is the network-bindable control-plane artifact for the
+internal AWS self-hosted deployment. It composes the existing PostgreSQL Run
+Authority with distinct runtime, reconciler, journal-acker, and external
+mutation-journal sessions. It does not execute tasks, spawn subprocesses, load
+plugins, or directly hold provider credentials. The default executable has no
+provider adapter and its provider authorization route fails closed with
+production admission reported as `false`. An embedding executable may call
+`startSelfHostedServer` with explicit E2B/Daytona production-dispatch ports; no
+runtime path or dynamic module is loaded from configuration. These are distinct
+from the authorization-only Sandboxes ports, whose production admission remains
+permanently `false`.
+
+The no-contact authorization surface remains
+`POST /v1/sandbox-dispatch-authorizations`. Effectful adapters are reachable
+only through the distinct `POST /v1/production-sandbox-dispatches` surface;
+the default executable configures neither production adapter nor production
+route handler. A configured service allowlists one operator principal, enforces
+that principal before parsing or adapter entry, and advertises
+`sandbox.dispatch.production` only to that principal while the exact activation
+and verified service remain present.
+
+The Infinity core remains restricted to a disabled, empty provider-effect
+frontier. Startup rejects any nonzero core frontier, and its signed in-memory
+zero head is only a disabled-state guard. An injected trusted production
+adapter owns provider contact and its separate durable provider-effect journal;
+those effects are not Infinity-core effects.
+
+Provider activation is controlled by the closed
+`infinity.provider-production-activation/v1` manifest referenced through
+`INFINITY_PROVIDER_ACTIVATION_MANIFEST_FILE`. Absence means both providers are
+disabled. Each provider has an independent activation request and must match
+the exact Infinity commit, Sandboxes commit, and evidence-manifest SHA-256
+compiled into the artifact. The packaged E2B and Daytona manifests record the
+reviewed receipt-bound live allocation, command, checkpoint-restart, and exact
+cleanup proofs. Both providers still default to disabled; an explicit manifest
+can make only the provider carrying its exact reviewed digest eligible. Stale
+Infinity or Sandboxes pins and arbitrary well-shaped hashes are rejected. This
+eligibility alone does not change production admission. Admission becomes true
+only when the matching verified manifest and an injected production adapter
+both exist. The production gate binds the authenticated principal, dispatch
+request, embedded runtime revision, tested source pins, and adapter artifact
+digest before entering only the selected adapter once. A successful adapter
+result must attest `provider_contacted: true`, preserve every prepared binding,
+and return a provider-effect-journal receipt digest bound to the exact
+admission. Infinity format-checks and binds that digest attestation; the trusted
+adapter owns and verifies the receipt preimage. Authorization-only results
+cannot be relabeled as production dispatches.
+
+Startup is deliberately verify-only. Apply the packaged primary and external
+journal migrations with dedicated migration identities before starting the
+service. The service compares the complete primary migration ledger with its
+compiled checksum manifest and refuses traffic on any missing, unknown, or
+changed migration. Runtime identities receive no migration authority on the
+Infinity schemas; broader database hardening remains part of the deployment
+bootstrap and is not claimed by this package.
+
+The one-shot `infinity-self-hosted-migrate` artifact applies both immutable
+migration manifests, configures all four NOLOGIN least-privilege role groups,
+and initializes or verifies the external journal's immutable protection tuple.
+It accepts `INFINITY_MIGRATOR_DATABASE_URL_FILE` and
+`INFINITY_EXTERNAL_JOURNAL_MIGRATOR_DATABASE_URL_FILE`; direct migrator URLs are
+rejected. The signing-key file and public journal identity variables are the
+same ones used by the runtime. Close the migration task before starting API
+tasks so its database-owner connections and key material are not resident in
+the serving process.
+
+The repository Dockerfile produces only a `linux/arm64` runtime from a
+digest-pinned Bun image. It embeds the exact source revision in both the
+compiled runtime report and the OCI revision label, runs as numeric uid/gid
+`10001`, and is compatible with a read-only root filesystem:
+
+```sh
+docker buildx build --platform linux/arm64 \
+  --build-arg INFINITY_BUILD_REVISION="$(git rev-parse HEAD)" \
+  -t infinity:self-hosted .
+```
+
+The build accepts no credentials. Runtime secret files must be mounted only
+when the serving or one-shot migration container is started. Override the
+default command with `bun /app/dist/self-hosted-migrate.js` for that migration
+task; do not grant migration identities to the long-running serving task.
+
+For the final station01 release check, run the repository-only proof harness:
+
+```sh
+bun scripts/station01-final-proof.ts
+```
+
+The default proof is provider- and model-free. It builds the exact checked-out
+revision, creates distinct disposable primary and external-journal PostgreSQL
+clusters, migrates through owner-only files, starts the self-hosted service on
+a loopback test port with the production activation gate configured, proves
+liveness/readiness/authentication/revision binding, and registers an outbound
+node agent against the in-process control plane. It then stops the service and
+both clusters and removes the private temporary root.
+
+`bun scripts/station01-final-proof.ts --describe-hooks` prints the closed hook
+contract for the API, E2B, Daytona, and subscription proof lanes. Hooks remain
+disabled unless both `--run-hooks` and a repository-contained absolute
+`--hook-<lane>=...` executable are supplied. A hook receives one owner-only
+context-file path and must return the closed evidence-manifest result; the
+harness never prints the context, bearer token, database URLs, or hook output.
+
+Non-loopback binding requires all of the following non-secret configuration:
+
+```text
+INFINITY_DEPLOYMENT_MODE=self-hosted
+INFINITY_HOST=0.0.0.0
+INFINITY_PORT=8080
+INFINITY_NON_LOOPBACK_ACTIVATION=self-hosted-v1
+INFINITY_STARTUP_MIGRATION_POLICY=verify-only
+INFINITY_BUILD_REVISION=<full 40-character lowercase Git revision>
+```
+
+Database URLs, the operator bearer token, and Ed25519 PKCS8 signing keys are
+accepted only through absolute owner-only regular-file references. Values are
+never emitted in startup errors, the immutable `/v1/runtime` report, request
+audit records, or lifecycle logs:
+
+```text
+INFINITY_RUNTIME_DATABASE_URL_FILE=/run/secrets/infinity-runtime-db-url
+INFINITY_RECONCILER_DATABASE_URL_FILE=/run/secrets/infinity-reconciler-db-url
+INFINITY_JOURNAL_ACKER_DATABASE_URL_FILE=/run/secrets/infinity-journal-acker-db-url
+INFINITY_EXTERNAL_JOURNAL_DATABASE_URL_FILE=/run/secrets/infinity-external-journal-db-url
+INFINITY_OPERATOR_TOKEN_FILE=/run/secrets/infinity-operator-token
+INFINITY_MUTATION_SIGNING_KEY_FILE=/run/secrets/infinity-mutation-signing-key.pem
+INFINITY_EFFECT_SIGNING_KEY_FILE=/run/secrets/infinity-effect-signing-key.pem
+```
+
+Every non-loopback PostgreSQL URL must set `sslmode=verify-full`. The HTTP
+listener expects TLS termination at the internal ALB and an ALB-only task
+security-group ingress rule; it is not safe to expose the task ENI directly.
+Audit records use server-generated request IDs and route templates, never raw
+caller IDs or path parameters.
+
+The remaining required values are public stable identities:
+
+```text
+INFINITY_OPERATOR_PRINCIPAL=service:self-hosted-operator
+INFINITY_AUTHORITY_RESTORE_DOMAIN_ID=restore-domain:authority:production
+INFINITY_EXTERNAL_JOURNAL_ID=journal:authority:production
+INFINITY_EXTERNAL_JOURNAL_RESTORE_DOMAIN_ID=restore-domain:journal:production
+INFINITY_EFFECT_JOURNAL_RESTORE_DOMAIN_ID=restore-domain:effect:production
+INFINITY_MUTATION_SIGNER_PRINCIPAL=service:authority-journal
+INFINITY_MUTATION_SIGNING_KEY_ID=authority-journal-key-v1
+INFINITY_EFFECT_SIGNER_PRINCIPAL=service:effect-journal
+INFINITY_EFFECT_SIGNING_KEY_ID=effect-journal-key-v1
+```
+
+`GET /health/live` and `GET /health/ready` are the only unauthenticated routes.
+Readiness stays closed until composition recovery completes, and then probes
+all four database sessions, the immutable migration ledger, pending mutation
+journal protection/head state, and the signed disabled-effect head. All `/v1/*`
+routes, including `/v1/runtime`, require `Authorization: Bearer …`. SIGTERM
+immediately removes readiness, stops accepting new requests, drains the Bun
+server, and closes every PostgreSQL pool.
+
+The CLI endpoint is fixed to `http://127.0.0.1:18787`; argv cannot override it.
+Structured RunSpecs use `--spec -` (stdin) only. Before network dispatch, every
+mutation is durably bound to its complete local tuple under
+`~/.local/state/infinity/operator-journal.sqlite` with owner-only permissions.
+
+Machine commands emit one `infinity.operator/v1` JSON or JSONL envelope. Mutations
+require explicit caller-observed authority epoch, revision/Attempt fencing as
+applicable, and an idempotency key. Never-leased Attempts omit the lease tuple;
+leased and post-lease Attempts carry an exact positive tuple and never use
+zero/null sentinels. The trusted CLI edge creates the opaque operation ID;
+`operation resolve` accepts only that ID.
+
+## Trusted-local subscription AuthCapsules
+
+The AuthCapsule surface keeps an owner's existing Codewith authentication
+profile on its attested subscription host. Infinity stores only a closed
+owner/node/generation descriptor; it never stores or transfers the profile,
+token, cookie, key, auth file, or credential path. API-key and workload-identity
+lanes remain sandbox-native and cannot be converted into AuthCapsules.
+
+For an admitted native-session lane, the launcher verifies the actual Codewith
+binary, runtime profile, and canonical measured `infinity-agent` policy, uses
+an empty workspace, passes the task prompt on stdin, and pins the named auth
+profile without changing the active login. It requires Codewith's closed native
+AuthCapsule capability attestation before it opens the bridge or starts a model
+turn; older builds with local shell/filesystem tools fail closed. A required online-authority port
+rechecks Accounts denial/generations and the full run/attempt/lease/resource
+fence before a protected bridge is opened. The bridge is bound to the exact
+Sandboxes dispatch, canonical intent, prepare anchor, authority envelope,
+effect claim, provider, input/source manifests, and checkpoint policy.
+Repository files, edits, and commands remain remote sandbox operations exposed
+only by that narrow bridge.
+
+For reusable subscription credentials without modifying Codewith, run the
+launcher inside an isolated capsule. `LinuxBubblewrapCapsuleProvider` supplies
+an executable user/mount/PID/network-namespace implementation: it mounts no
+host repository, persists only the capsule root, and mounts the measured
+managed requirements at `/etc/codewith/requirements.toml`. Those requirements
+must deny model tools read access to `/capsule/codewith/auth_profiles`.
+`MacOsVmSubscriptionCapsuleProvider` defines the corresponding closed adapter
+contract for Tart, Lume, or a direct Virtualization.framework service. The VM
+image owns the persistent login and preprovisioned protected broker route; each
+task sends only the prompt. Attestation is bound to the Accounts capsule digest,
+capsule/node/placement/auth generations, and Codewith binary measurement.
+
+This package supplies the descriptor, validation, launch contracts, public API,
+and `infinity auth-capsule descriptor|binding --spec -` validation commands.
+Production admission additionally requires the capsule's measured
+`infinity-agent` policy, managed deny-read requirements, and protected bridge;
+ordinary Codewith local tools or the `full` policy are prohibited on a
+credential-bearing host or VM.
+
+## Outbound subscription-host node agent
+
+`NodeAgentDaemon` is the V1 trusted node-side protocol boundary. A Mac opens an
+outbound connection through the injected mTLS transport, pins the control-plane
+SPKI and Ed25519 command key, registers measured capsule capabilities and
+generations, and sends heartbeats. It accepts only closed signed launch/revoke
+commands bound to the exact owner, node, capsule, placement/auth generations,
+lease epoch, and live broker fence. Commands explicitly carry neither a
+credential nor a repository; `IsolatedRunnerNodeCapsuleRuntime` forwards the
+closed launch tuple to the existing OS-isolated AuthCapsule runner without a
+caller-selected path, mount, argv, environment, endpoint, or credential.
+
+`DurableNodeAgentJournal` atomically persists a command claim before capsule
+effects, maintains monotonic replay and revocation fences, and requires runtime
+reconciliation for an incomplete claim after restart. Receipts and structured
+audit events contain only identifiers, digests, generations, outcomes, and exit
+status—not prompts or process output. `MacOsLaunchdService` renders and manages
+both per-user LaunchAgent and system LaunchDaemon artifacts through an injected
+host port; tests use the in-process control plane and fake launchd host and do
+not mutate a fleet.
+
+Embedding executables use the closed `runNodeAgentServiceCli` surface with four
+short commands: `run`, `install --scope user|system ...`,
+`status --scope user|system`, and `uninstall --scope user|system`.
+`ComposedNodeAgentServiceCliRuntime` wires those commands only to an already
+constructed daemon and launchd host, so the CLI cannot dynamically load code or
+turn a config file into a new trust boundary.
+
+## Deliberate limits
+
+The local API executable still uses the deterministic authority and fixed test
+principal. The separate self-hosted artifact composes `PostgresRunAuthority`,
+`PostgresReconciler`, and authenticated transport through
+`createPostgresAuthorityComposition`. External authority
+epoch, mutation-journal, and effect-journal services are mandatory composition
+dependencies. PostgreSQL composition rejects transient mutation journals and
+pins the durable journal identity and restore domain in the authority database;
+every restart must reopen that same independently durable journal. The effect
+journal must expose an encrypted, restore-domain-separated
+source with fresh challenge-signed head/range receipts; startup imports only its
+verified missing suffix before admitting API traffic. Real authentication/WebAuthn, production
+attestation trust roots and online deny checks, brokers, checkpoint storage,
+clean verification, Git promotion, managed provider adapters, production AWS
+and GitHub clients, node transport, and MCP transport remain injected,
+separately reviewed boundaries. The package does not read ambient provider
+credentials or perform a live deployment by itself. No legacy implementation
+or history is included.