@iislee/opencodex 2.11.0 → 2.31.0

package/src/lab/observe/from-conformance.ts

@@ -0,0 +1,301 @@
+/**
+ * Persistence seam: transform CL-01 conformance results into valid observation events.
+ * Deterministic harness execution stays separate from ledger persistence.
+ */
+import { createArtifactStore, type ArtifactStore } from "../artifacts/store";
+import { sanitizeDiagnostic, truncateUtf8 } from "../artifacts/sanitize";
+import {
+  LAB_EVENT_SCHEMA_VERSION,
+  LAB_PRODUCER,
+  LAB_PRODUCER_VERSION,
+  type ObservationOutcome,
+} from "../constants";
+import {
+  scenarioManifestDigest,
+  subjectIdForSubject,
+  suiteManifestDigest,
+} from "../digest";
+import type { ObservationEvent } from "../events/types";
+import { assignEventId } from "../events/validate";
+import { withLedgerMutation } from "../ledger/store";
+import { ensureLabDirs } from "../paths";
+import type {
+  CaseAuthority,
+  CaseRecord,
+  ProtocolExecutionContextV1,
+  ScenarioRunResult,
+} from "../conformance/types";
+import { expandScenario } from "../conformance/manifest";
+import { suiteManifestObjectForCase } from "../conformance/suite-manifest";
+import { fixtureDigest } from "../conformance/digest";
+import { resolveProtocolExecutionContext } from "../conformance/executor";
+import {
+  buildProtocolSubjectV1,
+  protocolBehaviorFingerprintV1,
+} from "../subject/protocol-subject";
+
+export interface PersistConformanceOptions {
+  configDir?: string;
+  recordedAt?: number;
+  /** Optional explicit override for the runner-provided execution timestamps. */
+  startedAt?: number;
+  completedAt?: number;
+  producerVersion?: string;
+  artifactStore?: ArtifactStore;
+}
+
+export interface PersistedConformanceObservation {
+  event: ObservationEvent;
+  ledgerPath: string;
+}
+
+function validateExecutionContext(
+  caseRecord: CaseRecord,
+  ctx: ProtocolExecutionContextV1,
+): ProtocolExecutionContextV1 {
+  const checks: Array<[string, string[], string]> = [
+    ["inboundProtocols", caseRecord.requirements.inboundProtocols, ctx.inboundProtocol],
+    ["upstreamProtocols", caseRecord.requirements.upstreamProtocols, ctx.upstreamProtocol],
+    ["surfaces", caseRecord.requirements.surfaces, ctx.surface],
+  ];
+  for (const [name, declared, actual] of checks) {
+    if (declared.length === 0) throw new Error(`case ${caseRecord.id} has empty ${name}`);
+    if (!declared.includes(actual)) {
+      throw new Error(`case ${caseRecord.id} execution context violates ${name}`);
+    }
+  }
+  return ctx;
+}
+
+function behaviorFingerprintForCase(
+  caseRecord: CaseRecord,
+  executionContext?: ProtocolExecutionContextV1,
+): string {
+  const ctx = validateExecutionContext(
+    caseRecord,
+    executionContext ?? resolveProtocolExecutionContext(caseRecord),
+  );
+  return protocolBehaviorFingerprintV1(ctx);
+}
+
+function protocolSubject(caseRecord: CaseRecord, result: ScenarioRunResult) {
+  const ctx = validateExecutionContext(
+    caseRecord,
+    result.executionContext ?? resolveProtocolExecutionContext(caseRecord),
+  );
+  return buildProtocolSubjectV1(ctx);
+}
+
+function outcomeFromResult(result: ScenarioRunResult): ObservationOutcome {
+  if (result.passed) return "pass";
+  switch (result.classification) {
+    case "timeout":
+    case "inactivity_timeout":
+    case "budget_exhausted":
+    case "sandbox_violation":
+    case "authentication_blocked":
+    case "quota_blocked":
+    case "region_blocked":
+    case "network_failure":
+    case "provider_transient":
+      return "blocked";
+    case "inconclusive":
+    case "harness_failure":
+    case "malformed_producer_outcome":
+    case "layer_subject_mismatch":
+      return "inconclusive";
+    case "protocol_failure":
+    case "capability_failure":
+    case "behavioral_failure":
+      return "fail";
+    default: {
+      const _never: never = result.classification;
+      throw new Error(`unmapped failure classification: ${String(_never)}`);
+    }
+  }
+}
+
+function requireExecutionTimes(
+  result: ScenarioRunResult,
+  opts: PersistConformanceOptions,
+): { startedAt: number; completedAt: number } {
+  const startedAt = opts.startedAt ?? result.startedAt;
+  const completedAt = opts.completedAt ?? result.completedAt;
+  if (!Number.isInteger(startedAt) || !Number.isInteger(completedAt)) {
+    throw new Error("real startedAt/completedAt are required for persisted conformance evidence");
+  }
+  if (startedAt < 0 || completedAt < startedAt) {
+    throw new Error("invalid persisted conformance execution timestamps");
+  }
+  return { startedAt, completedAt };
+}
+
+/**
+ * Build a valid protocol_conformance observation from one CL-01 scenario result.
+ * Does not append; use persistConformanceResult for ledger write.
+ */
+export function observationFromConformanceResult(
+  result: ScenarioRunResult,
+  caseRecord: CaseRecord,
+  authority: CaseAuthority,
+  opts: PersistConformanceOptions = {},
+): { event: ObservationEvent; artifacts: ReturnType<ArtifactStore["put"]>[] } {
+  const paths = ensureLabDirs(opts.configDir);
+  const ownsStore = !opts.artifactStore;
+  const store = opts.artifactStore ?? createArtifactStore(paths.artifactsDir);
+  try {
+    const { startedAt, completedAt } = requireExecutionTimes(result, opts);
+    const recordedAt = opts.recordedAt ?? completedAt;
+
+    const expandedScenario = expandScenario(caseRecord, authority);
+    const scenarioDigest = scenarioManifestDigest(expandedScenario);
+    const suiteExpanded = suiteManifestObjectForCase(caseRecord, authority);
+    const suiteDigest = suiteManifestDigest(suiteExpanded);
+
+    const fixtureDigests: string[] = [];
+    const artifacts: ReturnType<ArtifactStore["put"]>[] = [];
+
+    const putFixture = (fixture: CaseRecord["fixture"]) => {
+      const bytes = new TextEncoder().encode(fixture.bytesUtf8);
+      const digest = fixtureDigest(bytes);
+      fixtureDigests.push(digest);
+      artifacts.push(
+        store.put({
+          artifactClass: "fixture",
+          payload: bytes,
+          expectedDigest: digest,
+          mediaType: fixture.mediaType,
+        }),
+      );
+    };
+    putFixture(caseRecord.fixture);
+    if (caseRecord.initiatingRequest) putFixture(caseRecord.initiatingRequest);
+
+    artifacts.push(
+      store.put({
+        artifactClass: "scenario_manifest",
+        payload: expandedScenario,
+        expectedDigest: scenarioDigest,
+      }),
+    );
+    artifacts.push(
+      store.put({
+        artifactClass: "suite_manifest",
+        payload: suiteExpanded,
+        expectedDigest: suiteDigest,
+      }),
+    );
+
+    const assertionReport = store.put({
+      artifactClass: "assertion_report",
+      payload: {
+        scenarioId: result.scenarioId,
+        passed: result.passed,
+        classification: result.classification,
+        assertions: result.assertionResults.map((a) => ({
+          id: a.id,
+          operator: a.operator,
+          required: a.required,
+          passed: a.passed,
+          observedSummary: a.observedSummary,
+          reason: a.reason,
+        })),
+      },
+    });
+    artifacts.push(assertionReport);
+
+    const subject = protocolSubject(caseRecord, result);
+    const subjectId = subjectIdForSubject(subject);
+    const outcome = outcomeFromResult(result);
+    const authorityLimits = authority.manifestDefaults.executionLimits;
+
+    const eventWithoutId = {
+      schemaVersion: LAB_EVENT_SCHEMA_VERSION,
+      eventKind: "observation" as const,
+      recordedAt,
+      producer: LAB_PRODUCER,
+      producerVersion: opts.producerVersion ?? LAB_PRODUCER_VERSION,
+      evidenceLayer: "protocol_conformance" as const,
+      scenarioId: caseRecord.id,
+      scenarioVersion: String(authority.manifestDefaults.version),
+      scenarioManifestDigest: scenarioDigest,
+      suiteId: caseRecord.suite,
+      suiteVersion: String(authority.manifestDefaults.suiteVersion),
+      suiteManifestDigest: suiteDigest,
+      fixtureDigests,
+      subject,
+      subjectId,
+      startedAt,
+      completedAt,
+      executionMode: "fixture" as const,
+      attempt: 1,
+      limits: { ...authorityLimits },
+      outcome,
+      assertions: result.assertionResults.map((a) => ({
+        id: a.id,
+        operator: a.operator,
+        required: a.required,
+        passed: a.passed,
+        expectedSummary: "see_assertion_report",
+        // Sanitize before truncating; see from-live.ts for the same boundary.
+        observedSummary: truncateUtf8(sanitizeDiagnostic(a.observedSummary), 512),
+        ...(a.reason ? { reason: a.reason } : {}),
+      })),
+      ...(caseRecord.expectedFailure
+        ? { expectedFailure: { ...caseRecord.expectedFailure } }
+        : {}),
+      environment: {
+        runtime: {
+          platform: process.platform,
+          arch: process.arch,
+          bunVersion: process.versions.bun ?? Bun.version,
+        },
+      },
+      artifactRefs: artifacts,
+      ...(result.passed
+        ? {}
+        : {
+            failure: {
+              class: result.classification,
+              code: result.secondaryCode ?? result.classification,
+              retryable: false,
+              attribution:
+                result.classification === "harness_failure"
+                  ? ("harness" as const)
+                  : ("opencodex" as const),
+            },
+          }),
+    };
+
+    const event = assignEventId(eventWithoutId) as ObservationEvent;
+    return { event, artifacts };
+  } finally {
+    if (ownsStore) store.close();
+  }
+}
+
+/** Transform → validate → append one CL-01 result into the canonical JSONL ledger. */
+export function persistConformanceResult(
+  result: ScenarioRunResult,
+  caseRecord: CaseRecord,
+  authority: CaseAuthority,
+  opts: PersistConformanceOptions = {},
+): PersistedConformanceObservation {
+  const paths = ensureLabDirs(opts.configDir);
+  const ownsStore = !opts.artifactStore;
+  const store = opts.artifactStore ?? createArtifactStore(paths.artifactsDir);
+  try {
+    return withLedgerMutation(paths.ledgerPath, (ledger) => {
+      const { event } = observationFromConformanceResult(result, caseRecord, authority, {
+        ...opts,
+        artifactStore: store,
+      });
+      ledger.append(event);
+      return { event, ledgerPath: paths.ledgerPath };
+    });
+  } finally {
+    if (ownsStore) store.close();
+  }
+}
+
+export { behaviorFingerprintForCase };

package/src/lab/observe/from-live.ts

@@ -0,0 +1,117 @@
+// CL-03 live result -> CL-02 immutable observation persistence.
+import { createArtifactStore, type ArtifactStore } from "../artifacts/store";
+import { sanitizeDiagnostic, truncateUtf8 } from "../artifacts/sanitize";
+import { LAB_EVENT_SCHEMA_VERSION, LAB_PRODUCER, LAB_PRODUCER_VERSION, OBSERVATION_LIMIT_NAMES, type ObservationOutcome } from "../constants";
+import { fixtureDigest, scenarioManifestDigest, subjectIdForSubject, suiteManifestDigest } from "../digest";
+import type { FailureRecordV1, ObservationEvent } from "../events/types";
+import { assignEventId } from "../events/validate";
+import { withLedgerMutation } from "../ledger/store";
+import { ensureLabDirs } from "../paths";
+import type { CaseAuthority, CaseRecord } from "../conformance/types";
+import { trustedLiveResultRetryable } from "../live/executor";
+import { expandLiveScenario } from "../live/manifest";
+import { liveSuiteManifestObjectForCase } from "../live/suite-manifest";
+import type { LiveScenarioRunResult } from "../live/types";
+
+export interface PersistLiveOptions { configDir?: string; recordedAt?: number; startedAt?: number; completedAt?: number; producerVersion?: string; artifactStore?: ArtifactStore }
+export interface PersistedLiveObservation { event: ObservationEvent; ledgerPath: string }
+
+function outcomeFromLiveResult(result: LiveScenarioRunResult): ObservationOutcome {
+  if (result.passed) return "pass";
+  switch (result.classification) {
+    case "timeout":
+    case "inactivity_timeout":
+    case "budget_exhausted":
+    case "sandbox_violation":
+    case "authentication_blocked":
+    case "quota_blocked":
+    case "region_blocked":
+    case "network_failure":
+    case "provider_transient":
+      return "blocked";
+    case "protocol_failure":
+    case "capability_failure":
+    case "behavioral_failure":
+      return "fail";
+    case "inconclusive":
+    case "harness_failure":
+    case "malformed_producer_outcome":
+    case "layer_subject_mismatch":
+      return "inconclusive";
+    default: {
+      const _never: never = result.classification;
+      throw new Error(`unmapped failure classification: ${String(_never)}`);
+    }
+  }
+}
+
+function failureFromLiveResult(result: LiveScenarioRunResult, retryable: boolean): FailureRecordV1 | undefined {
+  if (result.passed || result.classification === "inconclusive") return undefined;
+  const attribution: FailureRecordV1["attribution"] = result.classification === "harness_failure"
+    ? "harness"
+    : ["authentication_blocked", "quota_blocked", "region_blocked", "network_failure", "provider_transient", "timeout", "inactivity_timeout", "budget_exhausted"].includes(result.classification)
+      ? "environment"
+      : "route";
+  return {
+    class: result.classification,
+    code: result.secondaryCode ?? result.classification,
+    retryable,
+    attribution,
+  };
+}
+
+function requireExecutionTimes(result: LiveScenarioRunResult, opts: PersistLiveOptions): { startedAt: number; completedAt: number } {
+  const startedAt = opts.startedAt ?? result.startedAt; const completedAt = opts.completedAt ?? result.completedAt;
+  if (!Number.isInteger(startedAt) || !Number.isInteger(completedAt) || startedAt < 0 || completedAt < startedAt) throw new Error("invalid persisted live execution timestamps");
+  return { startedAt, completedAt };
+}
+
+export function observationFromLiveResult(result: LiveScenarioRunResult, caseRecord: CaseRecord, authority: CaseAuthority, opts: PersistLiveOptions = {}): { event: ObservationEvent; artifacts: ReturnType<ArtifactStore["put"]>[] } {
+  const retryable = trustedLiveResultRetryable(result, caseRecord, authority);
+  if (!result.routeSubject) throw new Error("live evidence without an exact RouteSubjectV1 is not persistable");
+  const { startedAt, completedAt } = requireExecutionTimes(result, opts);
+  const paths = ensureLabDirs(opts.configDir); const ownsStore = !opts.artifactStore; const store = opts.artifactStore ?? createArtifactStore(paths.artifactsDir);
+  try {
+    const recordedAt = opts.recordedAt ?? completedAt;
+    const expandedScenario = expandLiveScenario(caseRecord, authority); const scenarioDigest = scenarioManifestDigest(expandedScenario);
+    const suiteExpanded = liveSuiteManifestObjectForCase(caseRecord, authority); const suiteDigest = suiteManifestDigest(suiteExpanded);
+    const fixtureDigests: string[] = []; const artifacts: ReturnType<ArtifactStore["put"]>[] = [];
+    const putFixture = (fixture: CaseRecord["fixture"]) => {
+      const bytes = new TextEncoder().encode(fixture.bytesUtf8); const digest = fixtureDigest(bytes); fixtureDigests.push(digest);
+      artifacts.push(store.put({ artifactClass: "fixture", payload: bytes, expectedDigest: digest, mediaType: fixture.mediaType }));
+    };
+    putFixture(caseRecord.fixture); if (caseRecord.initiatingRequest) putFixture(caseRecord.initiatingRequest);
+    artifacts.push(store.put({ artifactClass: "scenario_manifest", payload: expandedScenario, expectedDigest: scenarioDigest }));
+    artifacts.push(store.put({ artifactClass: "suite_manifest", payload: suiteExpanded, expectedDigest: suiteDigest }));
+    artifacts.push(store.put({ artifactClass: "assertion_report", payload: { scenarioId: result.scenarioId, passed: result.passed, classification: result.classification,
+      assertions: result.assertionResults.map((row) => ({ id: row.id, operator: row.operator, required: row.required, passed: row.passed, observedSummary: row.observedSummary, reason: row.reason })) } }));
+    const subject = result.routeSubject; const subjectId = subjectIdForSubject(subject); const authorityLimits = authority.manifestDefaults.executionLimits;
+    const limits: Record<string, number | null> = {}; for (const key of OBSERVATION_LIMIT_NAMES) if (key in authorityLimits) limits[key] = authorityLimits[key] ?? null;
+    const failure = failureFromLiveResult(result, retryable);
+    const eventWithoutId = {
+      schemaVersion: LAB_EVENT_SCHEMA_VERSION, eventKind: "observation" as const, recordedAt, producer: LAB_PRODUCER, producerVersion: opts.producerVersion ?? LAB_PRODUCER_VERSION,
+      evidenceLayer: "live_route_compatibility" as const, scenarioId: caseRecord.id, scenarioVersion: String(authority.manifestDefaults.version), scenarioManifestDigest: scenarioDigest,
+      suiteId: caseRecord.suite, suiteVersion: String(authority.manifestDefaults.suiteVersion), suiteManifestDigest: suiteDigest, fixtureDigests, subject, subjectId,
+      startedAt, completedAt, executionMode: "live" as const, attempt: 1, limits, outcome: outcomeFromLiveResult(result),
+      // Sanitize before truncating: the reverse order can split a redaction
+      // target and persist a fragment of the raw value.
+      assertions: result.assertionResults.map((row) => ({ id: row.id, operator: row.operator, required: row.required, passed: row.passed, expectedSummary: "see_assertion_report", observedSummary: truncateUtf8(sanitizeDiagnostic(row.observedSummary), 512), ...(row.reason ? { reason: row.reason } : {}) })),
+      ...(caseRecord.expectedFailure ? { expectedFailure: { ...caseRecord.expectedFailure } } : {}),
+      environment: { runtime: { platform: process.platform, arch: process.arch, bunVersion: process.versions.bun ?? Bun.version } }, artifactRefs: artifacts,
+      ...(failure ? { failure } : {}),
+    };
+    return { event: assignEventId(eventWithoutId) as ObservationEvent, artifacts };
+  } finally { if (ownsStore) store.close(); }
+}
+
+export function persistLiveResult(result: LiveScenarioRunResult, caseRecord: CaseRecord, authority: CaseAuthority, opts: PersistLiveOptions = {}): PersistedLiveObservation {
+  const paths = ensureLabDirs(opts.configDir); const ownsStore = !opts.artifactStore; const store = opts.artifactStore ?? createArtifactStore(paths.artifactsDir);
+  try {
+    return withLedgerMutation(paths.ledgerPath, (ledger) => {
+      const { event } = observationFromLiveResult(result, caseRecord, authority, { ...opts, artifactStore: store });
+      ledger.append(event);
+      return { event, ledgerPath: paths.ledgerPath };
+    });
+  }
+  finally { if (ownsStore) store.close(); }
+}

package/src/lab/paths.ts

@@ -0,0 +1,153 @@
+import { chmodSync, existsSync, mkdirSync, lstatSync, realpathSync } from "node:fs";
+import { basename, dirname, join, resolve, sep } from "node:path";
+import { getConfigDir } from "../config";
+
+/** Return true when path is the Lab root or a descendant path component. */
+function isAtOrBelowLabBoundary(path: string, labRootBoundary: string): boolean {
+  const normalizedPath = resolve(path);
+  const normalizedBoundary = resolve(labRootBoundary);
+  if (normalizedPath === normalizedBoundary) return true;
+  const prefix = normalizedBoundary + sep;
+  return normalizedPath.startsWith(prefix) && normalizedPath.length > normalizedBoundary.length;
+}
+
+/** Reject symlink, non-directory, and reparse-point substitutions for a Lab-owned component. */
+function assertRestrictedDirectoryComponent(path: string): void {
+  const componentStats = lstatSync(path);
+  if (componentStats.isSymbolicLink()) {
+    throw new Error(`restricted directory component is a symbolic link: ${path}`);
+  }
+  if (!componentStats.isDirectory()) {
+    throw new Error(`restricted path component is not a directory: ${path}`);
+  }
+  const canonical = resolve(realpathSync.native(path));
+  const canonicalParent = resolve(realpathSync.native(dirname(path)));
+  const expectedCanonical = resolve(join(canonicalParent, basename(path)));
+  if (canonical !== expectedCanonical) {
+    throw new Error(`restricted directory component contains a link or reparse-point substitution: ${path}`);
+  }
+}
+
+/**
+ * Create (or harden) a directory to mode 0o700 without following symlinks on Lab-owned
+ * components. Ancestors above labRootBoundary are treated as infrastructure and are not
+ * inspected for symlinks (for example macOS /var → /private/var).
+ */
+export function ensureRestrictedDir(dir: string, labRootBoundary: string): void {
+  const abs = resolve(dir);
+  const boundary = resolve(labRootBoundary);
+  const parts = abs.split(sep);
+  let current = parts[0] === "" ? sep : parts[0]!;
+  for (const part of parts.slice(1)) {
+    if (part === "") continue;
+    current = join(current, part);
+    try {
+      mkdirSync(current, { mode: 0o700 });
+    } catch (error) {
+      const code = (error as NodeJS.ErrnoException).code;
+      if (code !== "EEXIST") throw error;
+    }
+    if (isAtOrBelowLabBoundary(current, boundary)) {
+      assertRestrictedDirectoryComponent(current);
+    }
+  }
+  if (!existsSync(abs)) return;
+  if (!isAtOrBelowLabBoundary(abs, boundary)) return;
+  assertRestrictedDirectoryComponent(abs);
+  if (process.platform !== "win32") {
+    const mode = lstatSync(abs).mode & 0o777;
+    if (mode !== 0o700) chmodSync(abs, 0o700);
+  }
+}
+
+/** Canonical Compatibility Lab state root under the OpenCodex config dir. */
+export function labRoot(configDir = getConfigDir()): string {
+  return join(configDir, "lab");
+}
+
+export function labLedgerPath(configDir = getConfigDir()): string {
+  return join(labRoot(configDir), "compatibility.jsonl");
+}
+
+export function labSqlitePath(configDir = getConfigDir()): string {
+  return join(labRoot(configDir), "compatibility.sqlite");
+}
+
+export function labArtifactsDir(configDir = getConfigDir()): string {
+  return join(labRoot(configDir), "artifacts");
+}
+
+export function labScratchDir(configDir = getConfigDir()): string {
+  return join(labRoot(configDir), "scratch");
+}
+
+/** Shared Lab export directory. Public evidence bundles intentionally live here too. */
+export function labExportDir(configDir = getConfigDir()): string {
+  return join(labRoot(configDir), "export");
+}
+
+export function labCommunityDir(configDir = getConfigDir()): string {
+  return join(labRoot(configDir), "community");
+}
+
+export function labPublicOriginDir(configDir = getConfigDir()): string {
+  return join(labRoot(configDir), "public-origin-v1");
+}
+
+export const LAB_PUBLIC_PUBLISHER_KEY_FILE = "publisher-ed25519.pem";
+
+export function labPublicPublisherKeyPath(configDir = getConfigDir()): string {
+  return join(labRoot(configDir), LAB_PUBLIC_PUBLISHER_KEY_FILE);
+}
+
+/** Opaque per-installation salt for local fingerprinting (never exported as evidence). */
+export function labInstallationSaltPath(configDir = getConfigDir()): string {
+  return join(labRoot(configDir), "installation-salt.bin");
+}
+
+export function labAutomationPolicyPath(configDir = getConfigDir()): string {
+  return join(labRoot(configDir), "automation-policy.json");
+}
+
+export function labAutomationStatePath(configDir = getConfigDir()): string {
+  return join(labRoot(configDir), "automation-state.json");
+}
+
+export function labAutomationRoutesPath(configDir = getConfigDir()): string {
+  return join(labRoot(configDir), "automation-routes.json");
+}
+
+/** Ensure lab directories exist with restrictive permissions where the platform allows. */
+export function ensureLabDirs(configDir = getConfigDir()): {
+  root: string;
+  ledgerPath: string;
+  sqlitePath: string;
+  artifactsDir: string;
+  scratchDir: string;
+  exportDir: string;
+  communityDir: string;
+  publicOriginDir: string;
+} {
+  const root = labRoot(configDir);
+  const artifactsDir = labArtifactsDir(configDir);
+  const scratchDir = labScratchDir(configDir);
+  const exportDir = labExportDir(configDir);
+  const communityDir = labCommunityDir(configDir);
+  const publicOriginDir = labPublicOriginDir(configDir);
+  ensureRestrictedDir(root, root);
+  ensureRestrictedDir(artifactsDir, root);
+  ensureRestrictedDir(scratchDir, root);
+  ensureRestrictedDir(exportDir, root);
+  ensureRestrictedDir(communityDir, root);
+  ensureRestrictedDir(publicOriginDir, root);
+  return {
+    root,
+    ledgerPath: labLedgerPath(configDir),
+    sqlitePath: labSqlitePath(configDir),
+    artifactsDir,
+    scratchDir,
+    exportDir,
+    communityDir,
+    publicOriginDir,
+  };
+}