@iislee/opencodex 2.11.0 → 2.35.0

package/src/lab/public/purge.ts

@@ -0,0 +1,223 @@
+import { createPrivateKey, createPublicKey } from "node:crypto";
+import {
+  closeSync,
+  constants as fsConstants,
+  fsyncSync,
+  openSync,
+  readdirSync,
+  rmSync,
+  unlinkSync,
+} from "node:fs";
+import { join } from "node:path";
+import {
+  ensureLabDirs,
+  labCommunityDir,
+  labExportDir,
+  labPublicOriginDir,
+  labPublicPublisherKeyPath,
+} from "../paths";
+import {
+  isCommunityRevocationFileName,
+  parseCommunityBundleFileName,
+} from "./community-files";
+import { readPrivateRegularFile } from "./file-safety";
+import { publicEvidenceId } from "./ids";
+import { withPublicEvidenceMutationLock } from "./mutation-lock";
+import { clearLocalPublicOrigins } from "./origin";
+import { recoverPublicOriginsForPurge } from "./origin-purge";
+import { publicEvidencePurgeFaultForTests } from "./purge-test-fault";
+import { readPublicEvidenceBundle } from "./storage";
+import { parseStrictPublicJson } from "./strict-json";
+import { PublicEvidenceValidationError } from "./validate";
+
+const MAX_PRIVATE_KEY_BYTES = 8 * 1024;
+const MAX_COMMUNITY_OBJECT_BYTES = 2 * 1024 * 1024;
+const EXPORT_FILE_RE = /^([0-9a-f]{64})\.json$/;
+
+function syncPurgeDirectory(dir: string, label: "export" | "community" | "origin"): void {
+  if (process.platform === "win32") return;
+  if (label === "export" && publicEvidencePurgeFaultForTests() === "export_directory_sync") {
+    throw new Error("synthetic public export directory sync failure");
+  }
+  let fd: number | null = null;
+  try {
+    fd = openSync(dir, fsConstants.O_RDONLY);
+    fsyncSync(fd);
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    throw new Error(`public ${label} purge directory sync failed: ${detail}`);
+  } finally {
+    if (fd !== null) closeSync(fd);
+  }
+}
+
+/**
+ * Publisher provenance is useful only for classifying local community copies. A corrupt
+ * key must never block deletion of sensitive exports, so classification fails closed to
+ * "unknown publisher" while the purge continues.
+ */
+function readExistingPublisherKeyId(configDir?: string): string | null {
+  const path = labPublicPublisherKeyPath(configDir);
+  try {
+    const pem = readPrivateRegularFile(path, {
+      maxBytes: MAX_PRIVATE_KEY_BYTES,
+      errorCode: "public_publisher_key_unsafe",
+      errorMessage: "public publisher key is unsafe during purge",
+      requireMode600: true,
+    }).toString("utf8");
+    if (!pem.includes("BEGIN PRIVATE KEY")) return null;
+    const privateKey = createPrivateKey(pem);
+    if (privateKey.asymmetricKeyType !== "ed25519") return null;
+    const publicKey = createPublicKey(pem);
+    const publicKeyDer = publicKey.export({ type: "spki", format: "der" }).toString("base64");
+    return publicEvidenceId("publisher_key", { algorithm: "ed25519", publicKey: publicKeyDer });
+  } catch {
+    return null;
+  }
+}
+
+function publicIdentity(publisherKeyId: string, bundleId: string): string {
+  return `${publisherKeyId}:${bundleId}`;
+}
+
+/** Best-effort legacy classification only. Malformed exports are still deleted below. */
+function localExportIdentities(configDir?: string): Set<string> {
+  const identities = new Set<string>();
+  for (const entry of readdirSync(labExportDir(configDir), { withFileTypes: true })) {
+    const match = EXPORT_FILE_RE.exec(entry.name);
+    if (!match) continue;
+    try {
+      const bundle = readPublicEvidenceBundle(match[1]!, configDir);
+      identities.add(publicIdentity(bundle.publisher.keyId, bundle.bundleId));
+    } catch {
+      // Durable origin markers are the primary provenance source. Never retain a
+      // malformed export merely because legacy recovery can no longer parse it.
+    }
+  }
+  return identities;
+}
+
+function purgeAllExports(configDir?: string): number {
+  if (publicEvidencePurgeFaultForTests() === "before_export_delete") {
+    throw new Error("synthetic public export purge failure");
+  }
+  let deleted = 0;
+  const exportDir = labExportDir(configDir);
+  for (const entry of readdirSync(exportDir, { withFileTypes: true })) {
+    rmSync(join(exportDir, entry.name), { recursive: entry.isDirectory(), force: true });
+    deleted += 1;
+  }
+  // A previous attempt may already have removed all names but failed its directory
+  // fsync. Re-sync even when this retry deletes zero entries before reporting success.
+  syncPurgeDirectory(exportDir, "export");
+  return deleted;
+}
+
+/**
+ * Provenance classification happens before this call. Purge removes only the exact
+ * community cache pathname, so a symlink or hardlink cannot redirect deletion to a peer.
+ */
+function unlinkLocalCommunityFile(path: string): boolean {
+  try {
+    unlinkSync(path);
+    return true;
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return false;
+    throw error;
+  }
+}
+
+function communityObjectPublisherKeyId(path: string): string | null {
+  try {
+    const raw = parseStrictPublicJson(
+      readPrivateRegularFile(path, {
+        maxBytes: MAX_COMMUNITY_OBJECT_BYTES,
+        errorCode: "community_unsafe_target",
+        errorMessage: "community object is unsafe during purge",
+      }),
+      "community object during purge",
+    );
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
+    const publisher = (raw as { publisher?: unknown }).publisher;
+    if (!publisher || typeof publisher !== "object" || Array.isArray(publisher)) return null;
+    const keyId = (publisher as { keyId?: unknown }).keyId;
+    return typeof keyId === "string" && /^[0-9a-f]{64}$/.test(keyId) ? keyId : null;
+  } catch {
+    return null;
+  }
+}
+
+function purgeLocalPublicEvidenceCopiesLocked(configDir?: string): {
+  deletedExports: number;
+  deletedCommunityBundles: number;
+  deletedCommunityRevocations: number;
+} {
+  const exportedIdentities = localExportIdentities(configDir);
+  const originRecovery = recoverPublicOriginsForPurge(configDir);
+  const localPublisherKeyIds = new Set<string>();
+  for (const origin of originRecovery.identities) {
+    exportedIdentities.add(publicIdentity(origin.publisherKeyId, origin.bundleId));
+    localPublisherKeyIds.add(origin.publisherKeyId);
+  }
+  const currentPublisherKeyId = readExistingPublisherKeyId(configDir);
+  if (currentPublisherKeyId) localPublisherKeyIds.add(currentPublisherKeyId);
+  const communityDir = labCommunityDir(configDir);
+
+  // Sensitive local exports are the mandatory deletion target. Provenance is captured
+  // before this point, so cleanup remains possible even after the export bytes disappear.
+  const deletedExports = purgeAllExports(configDir);
+
+  let deletedCommunityBundles = 0;
+  let deletedCommunityRevocations = 0;
+  for (const entry of readdirSync(communityDir, { withFileTypes: true })) {
+    const bundleIdentity = parseCommunityBundleFileName(entry.name);
+    if (bundleIdentity) {
+      const { publisherKeyId, bundleId } = bundleIdentity;
+      const locallyOriginated = exportedIdentities.has(publicIdentity(publisherKeyId, bundleId))
+        || localPublisherKeyIds.has(publisherKeyId);
+      if (locallyOriginated && unlinkLocalCommunityFile(join(communityDir, entry.name))) {
+        deletedCommunityBundles += 1;
+      }
+      continue;
+    }
+
+    if (isCommunityRevocationFileName(entry.name)) {
+      const path = join(communityDir, entry.name);
+      const publisherKeyId = communityObjectPublisherKeyId(path);
+      if (publisherKeyId && localPublisherKeyIds.has(publisherKeyId)
+        && unlinkLocalCommunityFile(path)) {
+        deletedCommunityRevocations += 1;
+      }
+    }
+  }
+  // As with exports, a retry after a failed directory fsync may have no remaining
+  // names to unlink. Re-sync the directory unconditionally before success.
+  syncPurgeDirectory(communityDir, "community");
+
+  if (originRecovery.skipped > 0) {
+    // Preserve provenance markers for operator recovery. Sensitive exports are already
+    // durably gone, but unknown community copies cannot be reported as fully purged.
+    throw new PublicEvidenceValidationError(
+      "public_origin_incomplete",
+      `public origin classification incomplete: ${originRecovery.skipped} marker(s) could not be validated`,
+    );
+  }
+
+  // Markers are purge-owned public provenance only. Remove them last, then establish
+  // deletion durability before the caller may record an export purge tombstone.
+  clearLocalPublicOrigins(configDir);
+  syncPurgeDirectory(labPublicOriginDir(configDir), "origin");
+  return { deletedExports, deletedCommunityBundles, deletedCommunityRevocations };
+}
+
+export function purgeLocalPublicEvidenceCopies(configDir?: string): {
+  deletedExports: number;
+  deletedCommunityBundles: number;
+  deletedCommunityRevocations: number;
+} {
+  ensureLabDirs(configDir);
+  return withPublicEvidenceMutationLock(
+    configDir,
+    () => purgeLocalPublicEvidenceCopiesLocked(configDir),
+  );
+}

package/src/lab/public/registry.ts

@@ -0,0 +1,44 @@
+import { publicEvidenceId } from "./ids";
+import {
+  PUBLIC_ROUTE_REGISTRY_SCHEMA_VERSION,
+  type PublicAdapterFamily,
+  type PublicRouteRegistryEntryV1,
+  type PublicRouteRegistryManifestV1,
+} from "./types";
+
+// Repository-authoritative provider/model/adapter snapshot. The public manifest
+// itself is independently content-addressed by manifestDigest below.
+const PUBLIC_ROUTE_REGISTRY_SOURCE_COMMIT = "75a21417657ba5a3033198be0d8ae949de723d11";
+
+const entries: PublicRouteRegistryEntryV1[] = [
+  {
+    providerId: "openai",
+    modelId: "gpt-5.6-sol",
+    adapterFamilies: ["openai-responses"],
+  },
+];
+
+const manifestWithoutDigest = {
+  schemaVersion: PUBLIC_ROUTE_REGISTRY_SCHEMA_VERSION,
+  registryVersion: "2026-08-13.v2",
+  sourceCommit: PUBLIC_ROUTE_REGISTRY_SOURCE_COMMIT,
+  entries,
+};
+
+export const PUBLIC_ROUTE_REGISTRY_V1: PublicRouteRegistryManifestV1 = Object.freeze({
+  ...manifestWithoutDigest,
+  entries: Object.freeze(entries.map((entry) => Object.freeze({
+    ...entry,
+    adapterFamilies: Object.freeze([...entry.adapterFamilies]) as unknown as PublicAdapterFamily[],
+  }))) as unknown as PublicRouteRegistryEntryV1[],
+  manifestDigest: publicEvidenceId("route_registry", manifestWithoutDigest),
+});
+
+export function findPublicRouteRegistryEntry(
+  providerId: string,
+  modelId: string,
+): PublicRouteRegistryEntryV1 | undefined {
+  return PUBLIC_ROUTE_REGISTRY_V1.entries.find(
+    (entry) => entry.providerId === providerId && entry.modelId === modelId,
+  );
+}

package/src/lab/public/revocation.ts

@@ -0,0 +1,252 @@
+import { createPublicKey, verify as verifyBytes } from "node:crypto";
+import { publicEvidenceId } from "./ids";
+import {
+  loadExistingPublicPublisher,
+  signPublicPublisherDigest,
+  verifyPublicEvidenceBundle,
+} from "./signature";
+import {
+  PUBLIC_EVIDENCE_REVOCATION_SCHEMA_VERSION,
+  type PublicEvidenceBundleV1,
+  type PublicEvidenceRevocationV1,
+  type PublicPublisherV1,
+  type PublicRevocationReasonV1,
+  type PublicRevocationTargetV1,
+  type PublicRevocationVerificationResult,
+} from "./types";
+import { PublicEvidenceValidationError } from "./validate";
+
+const REASONS = new Set<PublicRevocationReasonV1>([
+  "publisher_retracted",
+  "privacy_retraction",
+  "evidence_invalidated",
+  "superseded",
+]);
+const MAX_TARGETS = 256;
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+
+function closedKeys(value: Record<string, unknown>, keys: readonly string[]): boolean {
+  const allowed = new Set(keys);
+  return Object.keys(value).every((key) => allowed.has(key)) && keys.every((key) => key in value);
+}
+
+function validId(value: unknown): value is string {
+  return typeof value === "string" && /^[0-9a-f]{64}$/.test(value);
+}
+
+function validDay(value: unknown): value is string {
+  if (typeof value !== "string" || !/^\d{4}-\d{2}-\d{2}$/.test(value)) return false;
+  const date = new Date(`${value}T00:00:00.000Z`);
+  return Number.isFinite(date.getTime()) && date.toISOString().slice(0, 10) === value;
+}
+
+function targetKey(target: PublicRevocationTargetV1): string {
+  return `${target.kind}:${target.id}`;
+}
+
+function compareCanonicalText(a: string, b: string): number {
+  if (a < b) return -1;
+  if (a > b) return 1;
+  return 0;
+}
+
+function canonicalTargets(targets: readonly PublicRevocationTargetV1[]): PublicRevocationTargetV1[] {
+  if (targets.length === 0 || targets.length > MAX_TARGETS) {
+    throw new PublicEvidenceValidationError("revocation_targets", "revocation must contain 1..256 targets");
+  }
+  const normalized = targets.map((target) => {
+    if ((target.kind !== "bundle" && target.kind !== "record") || !validId(target.id)) {
+      throw new PublicEvidenceValidationError("revocation_target", "invalid revocation target");
+    }
+    return { kind: target.kind, id: target.id } as PublicRevocationTargetV1;
+  }).sort((a, b) => compareCanonicalText(targetKey(a), targetKey(b)));
+  if (new Set(normalized.map(targetKey)).size !== normalized.length) {
+    throw new PublicEvidenceValidationError("revocation_target_duplicate", "revocation targets must be unique");
+  }
+  return normalized;
+}
+
+function samePublisher(a: PublicPublisherV1, b: PublicPublisherV1): boolean {
+  return a.algorithm === b.algorithm && a.keyId === b.keyId && a.publicKey === b.publicKey;
+}
+
+function validateTargetsAgainstBundle(targets: readonly PublicRevocationTargetV1[], bundle: PublicEvidenceBundleV1): boolean {
+  const records = new Set(bundle.records.map((record) => record.recordId));
+  return targets.every((target) => target.kind === "bundle" ? target.id === bundle.bundleId : records.has(target.id));
+}
+
+function revocationPayload(
+  issuedDayUtc: string,
+  publisher: PublicPublisherV1,
+  targets: PublicRevocationTargetV1[],
+  reason: PublicRevocationReasonV1,
+): Record<string, unknown> {
+  return {
+    schemaVersion: PUBLIC_EVIDENCE_REVOCATION_SCHEMA_VERSION,
+    issuedDayUtc,
+    publisher,
+    targets,
+    reason,
+  };
+}
+
+export function createPublicEvidenceRevocation(input: {
+  configDir?: string;
+  targetBundle: PublicEvidenceBundleV1;
+  issuedDayUtc: string;
+  targets: PublicRevocationTargetV1[];
+  reason: PublicRevocationReasonV1;
+}): PublicEvidenceRevocationV1 {
+  // Validate the target and every caller-controlled field before touching publisher state.
+  if (verifyPublicEvidenceBundle(input.targetBundle).status !== "cryptographically_valid") {
+    throw new PublicEvidenceValidationError("revocation_target", "revocation target bundle is not cryptographically valid");
+  }
+  if (!validDay(input.issuedDayUtc)) {
+    throw new PublicEvidenceValidationError("revocation_day", "issuedDayUtc is invalid");
+  }
+  if (!REASONS.has(input.reason)) {
+    throw new PublicEvidenceValidationError("revocation_reason", "unsupported revocation reason");
+  }
+  const targets = canonicalTargets(input.targets);
+  if (!validateTargetsAgainstBundle(targets, input.targetBundle)) {
+    throw new PublicEvidenceValidationError("revocation_target", "revocation target is unknown to target bundle");
+  }
+
+  const handle = loadExistingPublicPublisher(input.configDir);
+  if (!handle || !samePublisher(handle.publisher, input.targetBundle.publisher)) {
+    throw new PublicEvidenceValidationError(
+      "revocation_publisher",
+      "revocation requires the existing publisher key that signed the target bundle",
+    );
+  }
+  const revocationId = publicEvidenceId(
+    "revocation",
+    revocationPayload(input.issuedDayUtc, handle.publisher, targets, input.reason),
+  );
+  const signature = signPublicPublisherDigest(handle, revocationId);
+  return Object.freeze({
+    schemaVersion: PUBLIC_EVIDENCE_REVOCATION_SCHEMA_VERSION,
+    revocationId,
+    issuedDayUtc: input.issuedDayUtc,
+    publisher: handle.publisher,
+    targets,
+    reason: input.reason,
+    signature: Object.freeze({ algorithm: "ed25519" as const, signedDigest: revocationId, signature }),
+  });
+}
+
+export function verifyPublicEvidenceRevocation(
+  raw: unknown,
+  targetBundle: PublicEvidenceBundleV1,
+): PublicRevocationVerificationResult {
+  try {
+    if (!isPlainObject(raw) || !closedKeys(raw, [
+      "schemaVersion", "revocationId", "issuedDayUtc", "publisher", "targets", "reason", "signature",
+    ])) {
+      return { status: "schema_rejected", detail: "closed revocation schema mismatch" };
+    }
+    if (
+      raw.schemaVersion !== PUBLIC_EVIDENCE_REVOCATION_SCHEMA_VERSION
+      || !validId(raw.revocationId)
+      || !validDay(raw.issuedDayUtc)
+      || !REASONS.has(raw.reason as PublicRevocationReasonV1)
+    ) {
+      return { status: "schema_rejected", detail: "revocation version/id/day/reason invalid" };
+    }
+    if (
+      !isPlainObject(raw.publisher)
+      || !closedKeys(raw.publisher, ["algorithm", "keyId", "publicKey"])
+      || raw.publisher.algorithm !== "ed25519"
+      || !validId(raw.publisher.keyId)
+      || typeof raw.publisher.publicKey !== "string"
+      || raw.publisher.publicKey.length > 1024
+    ) {
+      return { status: "schema_rejected", detail: "revocation publisher invalid" };
+    }
+    const publicKeyBytes = Buffer.from(raw.publisher.publicKey, "base64");
+    if (publicKeyBytes.toString("base64") !== raw.publisher.publicKey) {
+      return { status: "schema_rejected", detail: "revocation publisher key is non-canonical" };
+    }
+    const publisher: PublicPublisherV1 = {
+      algorithm: "ed25519",
+      keyId: raw.publisher.keyId,
+      publicKey: raw.publisher.publicKey,
+    };
+    if (publicEvidenceId("publisher_key", { algorithm: "ed25519", publicKey: publisher.publicKey }) !== publisher.keyId) {
+      return { status: "schema_rejected", detail: "revocation publisher key id mismatch" };
+    }
+    if (!samePublisher(publisher, targetBundle.publisher)) {
+      return { status: "publisher_mismatch", detail: "revocation publisher does not match target bundle" };
+    }
+    if (!Array.isArray(raw.targets) || raw.targets.length === 0 || raw.targets.length > MAX_TARGETS) {
+      return { status: "schema_rejected", detail: "revocation targets invalid" };
+    }
+    const targets: PublicRevocationTargetV1[] = [];
+    for (const [index, value] of raw.targets.entries()) {
+      if (
+        !isPlainObject(value)
+        || !closedKeys(value, ["kind", "id"])
+        || (value.kind !== "bundle" && value.kind !== "record")
+        || !validId(value.id)
+      ) {
+        return { status: "schema_rejected", detail: `revocation target ${index} invalid` };
+      }
+      targets.push({ kind: value.kind, id: value.id });
+    }
+    const canonical = canonicalTargets(targets);
+    if (canonical.some((target, index) => target.kind !== targets[index]!.kind || target.id !== targets[index]!.id)) {
+      return { status: "schema_rejected", detail: "revocation targets must be sorted" };
+    }
+    if (!validateTargetsAgainstBundle(targets, targetBundle)) {
+      return { status: "unknown_target", detail: "revocation target not present in target bundle" };
+    }
+    if (
+      !isPlainObject(raw.signature)
+      || !closedKeys(raw.signature, ["algorithm", "signedDigest", "signature"])
+      || raw.signature.algorithm !== "ed25519"
+      || raw.signature.signedDigest !== raw.revocationId
+      || typeof raw.signature.signature !== "string"
+    ) {
+      return { status: "schema_rejected", detail: "revocation signature schema invalid" };
+    }
+    const expected = publicEvidenceId(
+      "revocation",
+      revocationPayload(raw.issuedDayUtc, publisher, targets, raw.reason as PublicRevocationReasonV1),
+    );
+    if (expected !== raw.revocationId) {
+      return { status: "digest_invalid", detail: "revocation id does not match canonical bytes" };
+    }
+    const key = createPublicKey({ key: publicKeyBytes, type: "spki", format: "der" });
+    if (key.asymmetricKeyType !== "ed25519") {
+      return { status: "signature_invalid", detail: "revocation publisher key is not Ed25519" };
+    }
+    const signatureBytes = Buffer.from(raw.signature.signature, "base64");
+    if (signatureBytes.toString("base64") !== raw.signature.signature) {
+      return { status: "signature_invalid", detail: "revocation signature is non-canonical" };
+    }
+    if (!verifyBytes(null, Buffer.from(raw.revocationId, "hex"), key, signatureBytes)) {
+      return { status: "signature_invalid", detail: "revocation signature invalid" };
+    }
+    return {
+      status: "cryptographically_valid",
+      revocation: {
+        schemaVersion: PUBLIC_EVIDENCE_REVOCATION_SCHEMA_VERSION,
+        revocationId: raw.revocationId,
+        issuedDayUtc: raw.issuedDayUtc,
+        publisher,
+        targets,
+        reason: raw.reason as PublicRevocationReasonV1,
+        signature: {
+          algorithm: "ed25519",
+          signedDigest: raw.revocationId,
+          signature: raw.signature.signature,
+        },
+      },
+    };
+  } catch (error) {
+    return { status: "schema_rejected", detail: error instanceof Error ? error.message : String(error) };
+  }
+}