@kungfu-tech/buildchain 3.0.4-alpha.0 → 3.0.4-alpha.10

package/scripts/auditable-demo.mjs

@@ -7,6 +7,10 @@ import os from "node:os";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
+import {
+  validateRenditionSet,
+  validateTerminalCapture,
+} from "./auditable-demo-renditions.mjs";
 
 const UTF8 = new TextDecoder("utf-8", { fatal: true });
 const IMAGE_PATTERN = /^[a-z0-9][a-z0-9./_-]*@sha256:[0-9a-f]{64}$/;
@@ -22,19 +26,16 @@ const REQUIRED_ADAPTER_FILES = [
   "public-projection.json",
   "scene.json",
 ];
-const OPTIONAL_ADAPTER_FILES = ["terminal-capture.json"];
+const OPTIONAL_ADAPTER_FILES = [
+  "terminal-capture.json",
+  "complete-transcript-720p.txt",
+  "public-projection-720p.json",
+  "scene-720p.json",
+  "terminal-capture-720p.json",
+  "rendition-set.json",
+];
 const MAX_TERMINAL_CAPTURE_BYTES = 4 * 1024 * 1024;
 const MAX_TERMINAL_CAPTURE_EVENTS = 10_000;
-const TERMINAL_CAPTURE_NON_AUTHORITIES = [
-  "first-party-identity",
-  "system-identity",
-  "kfd-compliance",
-  "product-system-metadata",
-  "package-metadata",
-  "registry-history",
-  "scan-output",
-  "standalone-generation",
-];
 
 function invariant(condition, message) {
   if (!condition) throw new Error(message);
@@ -249,80 +250,11 @@ function validateProjection(value, scene, transcriptLineCount) {
   };
 }
 
-function validateTerminalCapture(value, scene) {
-  exactKeys(
-    value,
-    [
-      "schema",
-      "command",
-      "dimensions",
-      "durationMs",
-      "encoding",
-      "events",
-      "completion",
-      "exitCode",
-      "authority",
-    ],
-    [],
-    "terminalCapture",
-  );
-  invariant(value.schema === "kungfu.terminal-capture/v1", "unsupported terminal capture schema");
-  text(value.command, 1, 160, "terminalCapture.command");
-  exactKeys(value.dimensions, ["columns", "rows"], [], "terminalCapture.dimensions");
-  integer(value.dimensions.columns, 80, 200, "terminalCapture.dimensions.columns");
-  integer(value.dimensions.rows, 24, 80, "terminalCapture.dimensions.rows");
-  const durationMs = integer(value.durationMs, 500, 60000, "terminalCapture.durationMs");
-  invariant(
-    durationMs <= scene.durationMs && scene.durationMs - durationMs <= 2000,
-    "terminal capture duration must end within two seconds of the scene",
-  );
-  invariant(value.encoding === "base64", "terminalCapture.encoding must be base64");
-  invariant(
-    Array.isArray(value.events)
-      && value.events.length > 0
-      && value.events.length <= MAX_TERMINAL_CAPTURE_EVENTS,
-    `terminalCapture.events must contain 1 through ${MAX_TERMINAL_CAPTURE_EVENTS} events`,
-  );
-  let previousAtMs = -1;
-  let totalBytes = 0;
-  for (const [index, event] of value.events.entries()) {
-    exactKeys(event, ["atMs", "data"], [], `terminalCapture.events[${index}]`);
-    const atMs = integer(event.atMs, 0, durationMs - 1, `terminalCapture.events[${index}].atMs`);
-    invariant(atMs >= previousAtMs, "terminal capture event timestamps must be monotonic");
-    invariant(index > 0 || atMs === 0, "the first terminal capture event must start at zero");
-    previousAtMs = atMs;
-    totalBytes += decodeBase64(event.data, `terminalCapture.events[${index}].data`).length;
-    invariant(totalBytes <= MAX_TERMINAL_CAPTURE_BYTES, "terminal capture exceeds the 4 MiB byte bound");
-  }
-  exactKeys(
-    value.completion,
-    ["schema", "status", "reportRoot", "eventCount"],
-    [],
-    "terminalCapture.completion",
-  );
-  invariant(
-    value.completion.schema === "kungfu.agent-work-lab.tui-autoplay/v1"
-      && value.completion.status === "qualified"
-      && DIGEST_PATTERN.test(value.completion.reportRoot),
-    "terminal capture completion sentinel is not a qualified Agent Work Lab autoplay",
-  );
-  integer(value.completion.eventCount, 1, 100_000, "terminalCapture.completion.eventCount");
-  invariant(value.exitCode === 0, "terminal capture exitCode must be zero");
-  exactKeys(value.authority, ["classification", "grants", "nonAuthorities"], [], "terminalCapture.authority");
-  invariant(
-    value.authority.classification === "volatile-terminal-observation",
-    "terminal capture authority classification must remain observation-only",
-  );
-  invariant(
-    Array.isArray(value.authority.grants) && value.authority.grants.length === 0,
-    "terminal capture must not grant authority",
-  );
-  invariant(
-    JSON.stringify(value.authority.nonAuthorities) === JSON.stringify(TERMINAL_CAPTURE_NON_AUTHORITIES),
-    "terminal capture must declare every identity and metadata non-authority",
-  );
-  return value;
-}
+const RENDITION_VALIDATION_HELPERS = {
+  decodeBase64, decodeUtf8, digestPattern: DIGEST_PATTERN, exactKeys, integer, invariant,
+  maxBytes: MAX_TERMINAL_CAPTURE_BYTES, maxEvents: MAX_TERMINAL_CAPTURE_EVENTS,
+  readJson, readRegular, sha256, text, validateProjection, validateScene,
+};
 
 function validateSourceCoordinate(value) {
   exactKeys(
@@ -379,8 +311,17 @@ function validateAdapterOutput(output, strict = true) {
   );
   const terminalCapturePath = path.join(output, "terminal-capture.json");
   const terminalCapture = fs.existsSync(terminalCapturePath)
-    ? validateTerminalCapture(readJson(terminalCapturePath, "terminal capture"), scene)
+    ? validateTerminalCapture(
+      readJson(terminalCapturePath, "terminal capture"),
+      scene,
+      RENDITION_VALIDATION_HELPERS,
+    )
     : null;
+  const renditionSet = validateRenditionSet(output, RENDITION_VALIDATION_HELPERS);
+  invariant(
+    !renditionSet || terminalCapture,
+    "rendition set requires the primary terminal capture",
+  );
   if (strict) {
     const allowed = new Set([...REQUIRED_ADAPTER_FILES, ...OPTIONAL_ADAPTER_FILES]);
     for (const member of listFiles(output)) invariant(allowed.has(member), `undeclared adapter output: ${member}`);
@@ -391,6 +332,7 @@ function validateAdapterOutput(output, strict = true) {
     scene,
     projection,
     terminalCapture,
+    renditionSet,
   };
 }
 
@@ -1047,6 +989,21 @@ function verifyRendererOutput(renderOutput, expectedImage, expectedInputs, optio
     const observed = manifest.inputs?.[key]?.root;
     invariant(observed === sha256(readRegular(filePath, `${key} input`)), `renderer ${key} input root mismatch`);
   }
+  if (expectedInputs.renditionSet) {
+    invariant(
+      manifest.derivation?.policy === "independent-native-frame-sets/v1",
+      "renderer did not use independent native frame sets",
+    );
+    invariant(
+      Array.isArray(manifest.inputs?.renditions)
+        && manifest.inputs.renditions.length === 2
+        && manifest.inputs.renditions[0]?.role === "primary"
+        && manifest.inputs.renditions[1]?.role === "responsive"
+        && manifest.inputs.renditions[0]?.terminalCapture?.root
+          !== manifest.inputs.renditions[1]?.terminalCapture?.root,
+      "renderer native rendition inputs are not independently bound",
+    );
+  }
   const probe = readJson(path.join(renderOutput, "media-probe.json"), "media probe");
   invariant(probe.schema === "build-images.demo-media-probe/v1" && probe.passed === true, "renderer media probe failed");
   const qualification = qualifyRendererOutput(
@@ -1099,11 +1056,10 @@ function finalizeGate(values) {
   fs.writeFileSync(path.join(output, "complete-transcript.txt"), normalized.transcript);
   writeJson(path.join(output, "scene.json"), normalized.scene);
   writeJson(path.join(output, "public-projection.json"), normalized.projection);
-  if (normalized.terminalCapture) {
-    copyFile(
-      path.join(adapterOutput, "terminal-capture.json"),
-      path.join(output, "terminal-capture.json"),
-    );
+  for (const name of OPTIONAL_ADAPTER_FILES) {
+    if (fs.existsSync(path.join(adapterOutput, name))) {
+      copyFile(path.join(adapterOutput, name), path.join(output, name));
+    }
   }
   copyFile(sourceCoordinatePath, path.join(output, "source-artifact.json"));
   copyFile(path.join(diagnostics, "adapter.json"), path.join(output, "adapter.json"));
@@ -1148,6 +1104,22 @@ function finalizeGate(values) {
           },
         }
         : {}),
+      ...(normalized.renditionSet
+        ? {
+          renditionSet: {
+            schema: normalized.renditionSet.schema,
+            root: sha256(readRegular(path.join(output, "rendition-set.json"), "rendition set")),
+            renditions: normalized.renditionSet.renditions.map((rendition) => ({
+              id: rendition.id,
+              role: rendition.role,
+              captureRoot: rendition.captureRoot,
+              sceneRoot: sha256(readRegular(path.join(output, rendition.scene), `${rendition.id} scene`)),
+              transcriptRoot: sha256(readRegular(path.join(output, rendition.transcript), `${rendition.id} transcript`)),
+              projectionRoot: sha256(readRegular(path.join(output, rendition.projection), `${rendition.id} projection`)),
+            })),
+          },
+        }
+        : {}),
       evidenceClass: normalized.projection.evidenceClass,
       claimBoundary: normalized.projection.claimBoundary,
     },
@@ -1198,6 +1170,27 @@ function verifyGate(values) {
       "gate terminal capture root mismatch",
     );
   }
+  const qualifiedRenditionSet = receipt.qualifiedInputs?.renditionSet;
+  invariant(
+    Boolean(qualifiedRenditionSet) === Boolean(normalized.renditionSet),
+    "gate rendition set presence drifted",
+  );
+  if (normalized.renditionSet) {
+    invariant(
+      qualifiedRenditionSet.schema === normalized.renditionSet.schema
+        && qualifiedRenditionSet.root === sha256(readRegular(path.join(bundle, "rendition-set.json"), "rendition set"))
+        && JSON.stringify(qualifiedRenditionSet.renditions)
+          === JSON.stringify(normalized.renditionSet.renditions.map((rendition) => ({
+            id: rendition.id,
+            role: rendition.role,
+            captureRoot: rendition.captureRoot,
+            sceneRoot: sha256(readRegular(path.join(bundle, rendition.scene), `${rendition.id} scene`)),
+            transcriptRoot: sha256(readRegular(path.join(bundle, rendition.transcript), `${rendition.id} transcript`)),
+            projectionRoot: sha256(readRegular(path.join(bundle, rendition.projection), `${rendition.id} projection`)),
+          }))),
+      "gate native rendition roots mismatch",
+    );
+  }
   invariant(receipt.qualifiedInputs.evidenceClass === normalized.projection.evidenceClass, "gate evidence class drifted");
 }
 
@@ -1228,6 +1221,7 @@ function finalizeMedia(values) {
     "--media-profile": mediaProfile,
   });
   const terminalCapturePath = path.join(gateBundle, "terminal-capture.json");
+  const renditionSetPath = path.join(gateBundle, "rendition-set.json");
   const verifiedRenderer = verifyRendererOutput(renderOutput, rendererImage, {
     scene: path.join(gateBundle, "scene.json"),
     transcript: path.join(gateBundle, "complete-transcript.txt"),
@@ -1235,6 +1229,9 @@ function finalizeMedia(values) {
     ...(fs.existsSync(terminalCapturePath)
       ? { terminalCapture: terminalCapturePath }
       : {}),
+    ...(fs.existsSync(renditionSetPath)
+      ? { renditionSet: renditionSetPath }
+      : {}),
   }, {
     mediaProfile,
     inspectMedia: mediaInspection?.inspectMedia,

package/scripts/aws-windows-jit-controller-core.mjs

@@ -0,0 +1,269 @@
+// SPDX-License-Identifier: Apache-2.0
+
+import { digest } from "./aws-runner-burst-core.mjs";
+import {
+  WINDOWS_EC2_JIT,
+  windowsJitRunnerLabel,
+  windowsJitRunnerLabels,
+} from "./aws-windows-jit-core.mjs";
+
+export const AWS_WINDOWS_JIT_CONTROLLER_CONTRACT =
+  "kungfu-buildchain-aws-windows-jit-controller/v1";
+
+function exact(value, pattern, label) {
+  const normalized = String(value || "").trim();
+  if (!pattern.test(normalized)) {
+    throw new Error(`${label} is invalid`);
+  }
+  return normalized;
+}
+
+function exactSha(value) {
+  return exact(value, /^[0-9a-f]{40}$/i, "sourceSha").toLowerCase();
+}
+
+function iso(value, label) {
+  const parsed = new Date(value || "");
+  if (!Number.isFinite(parsed.getTime())) {
+    throw new Error(`${label} must be an ISO timestamp`);
+  }
+  return parsed.toISOString();
+}
+
+function qualificationId(value) {
+  return exact(
+    value,
+    /^win-(?:smoke|full-0[1-3]|cancel|timeout)$/,
+    "qualificationId",
+  );
+}
+
+function tag(key, value) {
+  return { Key: key, Value: String(value) };
+}
+
+export function createWindowsJitLaunchPlan(values = {}) {
+  const repository = exact(
+    values.repository || WINDOWS_EC2_JIT.repository,
+    /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/,
+    "repository",
+  );
+  if (repository !== WINDOWS_EC2_JIT.repository) {
+    throw new Error(`repository must be ${WINDOWS_EC2_JIT.repository}`);
+  }
+  const runId = exact(values.runId, /^\d+$/, "runId");
+  const runAttempt = exact(
+    values.runAttempt || "1",
+    /^[1-9]\d*$/,
+    "runAttempt",
+  );
+  const jobId = exact(values.jobId, /^\d+$/, "jobId");
+  const qualification = qualificationId(values.qualificationId);
+  const runnerLabel = windowsJitRunnerLabel(values.runnerLabel);
+  const expectedLabel = `${WINDOWS_EC2_JIT.labelPrefix}${qualification}`;
+  if (runnerLabel !== expectedLabel) {
+    throw new Error(`runnerLabel must be ${expectedLabel}`);
+  }
+  const runnerName = exact(
+    values.runnerName,
+    /^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/,
+    "runnerName",
+  );
+  const sourceSha = exactSha(values.sourceSha);
+  const sourceRef = exact(
+    values.sourceRef,
+    /^refs\/heads\/[A-Za-z0-9._/-]+$/,
+    "sourceRef",
+  );
+  const region = exact(
+    values.region || WINDOWS_EC2_JIT.region,
+    /^us-[a-z]+-\d$/,
+    "region",
+  );
+  if (region !== WINDOWS_EC2_JIT.region) {
+    throw new Error(`region must be ${WINDOWS_EC2_JIT.region}`);
+  }
+  const instanceType = exact(
+    values.instanceType || WINDOWS_EC2_JIT.instanceType,
+    /^[a-z0-9.]+$/,
+    "instanceType",
+  );
+  if (instanceType !== WINDOWS_EC2_JIT.instanceType) {
+    throw new Error(`instanceType must be ${WINDOWS_EC2_JIT.instanceType}`);
+  }
+  const amiId = exact(values.amiId, /^ami-[0-9a-f]+$/, "amiId");
+  const amiName = exact(values.amiName, /^[A-Za-z0-9._-]+$/, "amiName");
+  const subnetId = exact(values.subnetId, /^subnet-[0-9a-f]+$/, "subnetId");
+  const securityGroupId = exact(
+    values.securityGroupId,
+    /^sg-[0-9a-f]+$/,
+    "securityGroupId",
+  );
+  const instanceProfileName = exact(
+    values.instanceProfileName,
+    /^[A-Za-z0-9+=,.@_-]{1,128}$/,
+    "instanceProfileName",
+  );
+  const evidenceBucket = exact(
+    values.evidenceBucket,
+    /^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/,
+    "evidenceBucket",
+  );
+  const launchedAt = iso(values.launchedAt, "launchedAt");
+  const clientToken = `kungfu-${runId}-${runAttempt}-${qualification}`;
+  const jitParameterName =
+    String(values.jitParameterName || "").trim() ||
+    `${WINDOWS_EC2_JIT.jitParameterPrefix}${runId}/${runAttempt}/${qualification}`;
+  if (
+    !jitParameterName.startsWith(WINDOWS_EC2_JIT.jitParameterPrefix) ||
+    !/^\/[A-Za-z0-9._/-]+$/.test(jitParameterName)
+  ) {
+    throw new Error("jitParameterName must use the dedicated Windows prefix");
+  }
+
+  const ownershipTags = [
+    tag("kungfu:owner", "buildchain"),
+    tag("kungfu:plane", "aws-us-elastic-runner-burst"),
+    tag("kungfu:provider", "windows-ec2-jit"),
+    tag("kungfu:github-run-id", runId),
+    tag("kungfu:github-run-attempt", runAttempt),
+    tag("kungfu:qualification-id", qualification),
+    tag("kungfu:source-sha", sourceSha),
+    tag("kungfu:runner-label", runnerLabel),
+  ];
+  const instanceTags = [
+    ...ownershipTags,
+    tag("kungfu:jit-parameter", jitParameterName),
+  ];
+  const volumeTags = [...ownershipTags];
+  const plan = {
+    schemaVersion: 1,
+    contract: AWS_WINDOWS_JIT_CONTROLLER_CONTRACT,
+    kind: "launch-plan",
+    repository,
+    source: { sha: sourceSha, ref: sourceRef },
+    github: {
+      runId,
+      runAttempt,
+      jobId,
+      qualificationId: qualification,
+      event: "workflow_dispatch",
+    },
+    runner: {
+      name: runnerName,
+      label: runnerLabel,
+      labels: windowsJitRunnerLabels(runnerLabel),
+      oneJobJit: true,
+    },
+    aws: {
+      region,
+      instanceType,
+      amiId,
+      amiName,
+      subnetId,
+      securityGroupId,
+      instanceProfileName,
+      evidenceBucket,
+      jitParameterName,
+      launchedAt,
+      clientToken,
+      rootVolume: {
+        deviceName: "/dev/sda1",
+        deleteOnTermination: true,
+        encrypted: true,
+        volumeSizeGiB: 120,
+        volumeType: "gp3",
+      },
+      metadata: {
+        httpEndpoint: "enabled",
+        httpTokens: "required",
+        httpPutResponseHopLimit: 1,
+        instanceMetadataTags: "disabled",
+      },
+      instanceTags,
+      volumeTags,
+    },
+    safety: {
+      applyMode: values.execute === true ? "execute" : "dry-run",
+      exactSourceRequired: true,
+      queuedJobRequired: true,
+      activeInstanceCeiling: WINDOWS_EC2_JIT.maxConcurrentInstances,
+      awsDryRunRequiredBeforeLaunch: true,
+      userDataTransport: "fileb://rendered-bootstrap",
+      jitConfigTransport: "0600-temporary-file-to-ssm-secure-string",
+      jitConfigInUserData: false,
+      jitConfigInArgv: false,
+      cleanupOnLaunchFailure: [
+        "ec2-instance",
+        "ssm-parameter",
+        "github-runner-registration",
+      ],
+    },
+  };
+  return { ...plan, digest: digest(plan) };
+}
+
+export function windowsRunInstancesArgs(
+  plan,
+  { bootstrapPath = "<rendered-bootstrap>", dryRun = false } = {},
+) {
+  if (plan?.contract !== AWS_WINDOWS_JIT_CONTROLLER_CONTRACT) {
+    throw new Error("Windows JIT launch plan contract is invalid");
+  }
+  const resolvedBootstrap = exact(
+    bootstrapPath,
+    /^(?:<rendered-bootstrap>|\/[^\0]+)$/,
+    "bootstrapPath",
+  );
+  const args = [
+    "ec2",
+    "run-instances",
+    "--image-id",
+    plan.aws.amiId,
+    "--instance-type",
+    plan.aws.instanceType,
+    "--count",
+    "1",
+    "--client-token",
+    plan.aws.clientToken,
+    "--iam-instance-profile",
+    JSON.stringify({ Name: plan.aws.instanceProfileName }),
+    "--subnet-id",
+    plan.aws.subnetId,
+    "--security-group-ids",
+    plan.aws.securityGroupId,
+    "--associate-public-ip-address",
+    "--user-data",
+    `fileb://${resolvedBootstrap}`,
+    "--block-device-mappings",
+    JSON.stringify([
+      {
+        DeviceName: plan.aws.rootVolume.deviceName,
+        Ebs: {
+          DeleteOnTermination: plan.aws.rootVolume.deleteOnTermination,
+          Encrypted: plan.aws.rootVolume.encrypted,
+          VolumeSize: plan.aws.rootVolume.volumeSizeGiB,
+          VolumeType: plan.aws.rootVolume.volumeType,
+        },
+      },
+    ]),
+    "--metadata-options",
+    JSON.stringify({
+      HttpEndpoint: plan.aws.metadata.httpEndpoint,
+      HttpTokens: plan.aws.metadata.httpTokens,
+      HttpPutResponseHopLimit: plan.aws.metadata.httpPutResponseHopLimit,
+      InstanceMetadataTags: plan.aws.metadata.instanceMetadataTags,
+    }),
+    "--instance-initiated-shutdown-behavior",
+    "terminate",
+    "--tag-specifications",
+    JSON.stringify([
+      { ResourceType: "instance", Tags: plan.aws.instanceTags },
+      { ResourceType: "volume", Tags: plan.aws.volumeTags },
+    ]),
+    "--output",
+    "json",
+  ];
+  if (dryRun) args.splice(2, 0, "--dry-run");
+  return args;
+}