@lqc123qwe/car-runtime 1.9.0 → 1.10.0

package/native/landlock-run/landlock-run.c

@@ -1,162 +0,0 @@
-/**
- * landlock-run — CAR F3 沙箱 Linux 后端（self-restrict-then-exec，fail-closed）
- *
- * 接口契约（src/sandbox/sandbox.ts 调用面，不得单方面变更）：
- *   landlock-run --probe                     探测内核 Landlock 可用性：可用 exit 0，不可用 exit 1
- *   landlock-run --ro -- argv...             只读沙箱：全盘可读可执行，任何写一律拒绝
- *   landlock-run --rw -- argv...             工作区写沙箱：仅当前工作目录（cwd）可写，其余全盘只读
- *
- * 语义（《系统设计》F3 / 安全设计 §5.3 / M3部署设计增补 §2.1.2）：
- *   - allowlist 制：Landlock ruleset 未覆盖路径的 handled 访问位一律拒绝（fail-closed）；
- *   - handled 位 = ABI1 全集（EXECUTE/WRITE_FILE/READ_FILE/READ_DIR/REMOVE_DIR/REMOVE_FILE/
- *     MAKE_CHAR/MAKE_DIR/MAKE_REG/MAKE_SOCK/MAKE_FIFO/MAKE_TRANS/MAKE_SYM）
- *     + ABI≥3 追加 TRUNCATE；
- *     ABI2 REFER 不处理（跨目录 re-link 由内核默认拒绝——逃逸面收紧而非放松）；
- *   - PR_SET_NO_NEW_PRIVS 先置位再 restrict_self（setuid 提权失效）；
- *   - 用例/审计要求：任何一条访问位拒绝都表现为目标系统调用的 EACCES，由上层用例断言。
- *
- * ABI 兼容：直接 syscall（x86_64: 444/445/446），不依赖 glibc 封装（glibc < 2.34 也可编译）。
- * 构建单源（M3 §2.1.2）：J-01 单点编译 linux-x64-gnu，J-05/J-17 消费同一二进制，禁止平台内重编译。
- */
-#define _GNU_SOURCE
-#include <errno.h>
-#include <fcntl.h>
-#include <linux/prctl.h>
-#include <sched.h>
-#include <stdint.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <sys/prctl.h>
-#include <sys/stat.h>
-#include <sys/syscall.h>
-#include <unistd.h>
-
-/* ── Landlock ABI（x86_64 syscall numbers，内核 ≥ 5.15 环境，J-17 环境自检兜底） ── */
-#define SYS_LANDLOCK_CREATE_RULESET 444
-#define SYS_LANDLOCK_ADD_RULE       445
-#define SYS_LANDLOCK_RESTRICT_SELF  446
-
-#define LANDLOCK_CREATE_RULESET_VERSION 1U
-
-/* Landlock FS 访问位（linux/landlock.h 同值，手工定义以摆脱头文件版本依赖） */
-#define LL_FS_EXECUTE    (1ULL << 0)
-#define LL_FS_WRITE_FILE (1ULL << 1)
-#define LL_FS_READ_FILE  (1ULL << 2)
-#define LL_FS_READ_DIR   (1ULL << 3)
-#define LL_FS_REMOVE_DIR (1ULL << 4)
-#define LL_FS_REMOVE_FILE (1ULL << 5)
-#define LL_FS_MAKE_CHAR  (1ULL << 6)
-#define LL_FS_MAKE_DIR   (1ULL << 7)
-#define LL_FS_MAKE_REG   (1ULL << 8)
-#define LL_FS_MAKE_SOCK  (1ULL << 9)
-#define LL_FS_MAKE_FIFO  (1ULL << 10)
-#define LL_FS_MAKE_TRANS (1ULL << 11)
-#define LL_FS_MAKE_SYM   (1ULL << 12)
-/* ABI v2 (1<<13 REFER) 有跨目录授权约束，不纳入 handled（跨目录 mv/link 默认拒绝，收紧面） */
-#define LL_FS_TRUNCATE   (1ULL << 14) /* ABI v3 (kernel ≥ 6.2) */
-
-#define LL_ABI1_WRITE_BITS (LL_FS_WRITE_FILE | LL_FS_REMOVE_DIR | LL_FS_REMOVE_FILE | \
-                            LL_FS_MAKE_CHAR | LL_FS_MAKE_DIR | LL_FS_MAKE_REG | \
-                            LL_FS_MAKE_SOCK | LL_FS_MAKE_FIFO | LL_FS_MAKE_TRANS | \
-                            LL_FS_MAKE_SYM)
-#define LL_ABI3_EXTRA      LL_FS_TRUNCATE
-
-#define LANDLOCK_RULE_PATH_BENEATH 1U /* linux/landlock.h 同值 */
-
-struct ll_ruleset_attr { uint64_t handled_access_fs; };
-struct ll_path_beneath_attr { uint64_t allowed_access; int parent_fd; };
-
-static int ll_create_ruleset(uint64_t handled, uint32_t *abi_out) {
-  /* 先查 ABI 版本（不创建 ruleset） */
-  int abi = (int)syscall(SYS_LANDLOCK_CREATE_RULESET, NULL, 0,
-                         LANDLOCK_CREATE_RULESET_VERSION);
-  if (abi < 0) return -1; /* EOPNOTSUPP: LSM 未启用 / ENOSYS: 内核过旧 / EINVAL */
-  *abi_out = (uint32_t)abi;
-
-  struct ll_ruleset_attr attr = { .handled_access_fs = handled };
-  return (int)syscall(SYS_LANDLOCK_CREATE_RULESET, &attr, sizeof(attr), 0U);
-}
-
-static int ll_add_path_rule(int ruleset_fd, uint64_t access, const char *path) {
-  int fd = open(path, O_PATH | O_CLOEXEC);
-  if (fd < 0) return -1;
-  struct ll_path_beneath_attr rule = { .allowed_access = access, .parent_fd = fd };
-  int rc = (int)syscall(SYS_LANDLOCK_ADD_RULE, ruleset_fd,
-                        LANDLOCK_RULE_PATH_BENEATH, &rule, 0U);
-  /* LANDLOCK_RULE_PATH_BENEATH = 1（linux/landlock.h） */
-  close(fd);
-  return rc;
-}
-
-static int ll_restrict(int ruleset_fd) {
-  if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) != 0) return -1;
-  return (int)syscall(SYS_LANDLOCK_RESTRICT_SELF, ruleset_fd, 0U);
-}
-
-/* probe：Landlock 可探测（内核 ≥ 5.13 + LSM 启用）exit 0，否则 exit 1 */
-static int do_probe(void) {
-  uint32_t abi = 0;
-  int fd = ll_create_ruleset(LL_FS_EXECUTE | LL_FS_WRITE_FILE, &abi);
-  if (fd < 0) return 1;
-  close(fd);
-  return 0;
-}
-
-static void usage_exit(void) {
-  fprintf(stderr,
-    "usage: landlock-run --probe\n"
-    "       landlock-run --ro -- argv...\n"
-    "       landlock-run --rw -- argv...\n");
-  exit(64); /* 契约：非法用法固定 64（逃逸矩阵 E 类断言面） */
-}
-
-int main(int argc, char **argv) {
-  if (argc < 2) usage_exit();
-
-  if (strcmp(argv[1], "--probe") == 0) return do_probe();
-
-  int rw;
-  if (strcmp(argv[1], "--ro") == 0) rw = 0;
-  else if (strcmp(argv[1], "--rw") == 0) rw = 1;
-  else usage_exit();
-
-  if (argc < 4 || strcmp(argv[2], "--") != 0) usage_exit();
-  char **cmd = &argv[3];
-
-  uint32_t abi = 0;
-  uint64_t handled = LL_FS_EXECUTE | LL_FS_READ_FILE | LL_FS_READ_DIR | LL_ABI1_WRITE_BITS;
-  /* 建 ruleset；ABI≥3 时重建以纳入 TRUNCATE（否则 truncate 不受控 = 收窄覆盖面） */
-  int fd = ll_create_ruleset(handled, &abi);
-  if (fd < 0) { perror("landlock-run: create_ruleset"); return 65; }
-  if (abi >= 3) {
-    close(fd);
-    handled |= LL_ABI3_EXTRA;
-    fd = ll_create_ruleset(handled, &abi);
-    if (fd < 0) { perror("landlock-run: create_ruleset(abi3)"); return 65; }
-  }
-
-  /* 全盘读/执行放行（运行面），未覆盖写位 = 全盘默认拒绝（fail-closed） */
-  if (ll_add_path_rule(fd, LL_FS_EXECUTE | LL_FS_READ_FILE | LL_FS_READ_DIR, "/") != 0) {
-    perror("landlock-run: add rule /"); return 65;
-  }
-  /* /dev/null 写放行：null 设备无逃逸面，是 shell 重定向/工具链运行必需（dsh 同款惯例） */
-  uint64_t null_bits = LL_FS_WRITE_FILE | (abi >= 3 ? LL_FS_TRUNCATE : 0);
-  if (ll_add_path_rule(fd, null_bits, "/dev/null") != 0) {
-    perror("landlock-run: add rule /dev/null"); return 65;
-  }
-  if (rw) {
-    uint64_t write_bits = LL_ABI1_WRITE_BITS | (abi >= 3 ? LL_ABI3_EXTRA : 0);
-    /* 仅 cwd（工作区）可写——M3 §2.1.1 步骤 4 强约束：用例必须在原生 FS 工作区内跑 */
-    if (ll_add_path_rule(fd, write_bits, ".") != 0) {
-      perror("landlock-run: add rule ."); return 65;
-    }
-  }
-
-  if (ll_restrict(fd) != 0) { perror("landlock-run: restrict_self"); return 65; }
-  close(fd);
-
-  execvp(cmd[0], cmd);
-  perror("landlock-run: execvp");
-  return 66;
-}

package/scripts/contract-check.ts

@@ -1,56 +0,0 @@
-/**
- * J-09 contract · SessionEventMap 快照只增不删 + 公共 API 兼容（M2部署设计增补 §2.3）
- *
- * 口径：golden 基线（test/contract/eventmap.golden.json）⊆ 当前签名——
- *   删键/改语义 = FAIL（破坏跨宿主与审计回放兼容）；加键 = PASS（演进合法）。
- * 断言源 = src/session/log.ts 的运行时签名（用 SessionLog 实例与类型导出反射，非正则扫源码）。
- */
-import { SessionLog, type SessionEvent } from '../src/session/log.ts'
-import { readFileSync } from 'node:fs'
-
-const golden = JSON.parse(readFileSync('test/contract/eventmap.golden.json', 'utf8')) as {
-  eventKinds: string[]; actors: string[]; sessionEventFields: string[]; sessionLogApi: string[]
-}
-
-let failed = 0
-const check = (name: string, ok: boolean, detail?: string) => {
-  console.log(`[${ok ? 'PASS' : 'FAIL'}] ${name}${detail ? '  ' + detail : ''}`)
-  if (!ok) failed++
-}
-
-// ① 运行时反射：真实 append 路径产生的字段集
-const log = new SessionLog('contract-check')
-const ev: SessionEvent = log.append('user', 'user', 'T0', { text: 'x' })
-const evFields = Object.keys(ev).sort()
-const missingFields = golden.sessionEventFields.filter(f => !evFields.includes(f))
-check('SessionEvent 字段只增不删', missingFields.length === 0, missingFields.length ? `缺失: ${missingFields.join(',')}` : `当前: ${evFields.length} 字段`)
-
-// ② SessionLog 公共方法面（golden 中每个 API 必须仍存在且可调用签名合法）
-const missingApi = golden.sessionLogApi.filter(m => typeof (log as unknown as Record<string, unknown>)[m] !== 'function'
-  && typeof (SessionLog as unknown as Record<string, unknown>)[m] !== 'function')
-check('SessionLog 公共 API 只增不删', missingApi.length === 0, missingApi.length ? `缺失: ${missingApi.join(',')}` : `${golden.sessionLogApi.length} 项全在`)
-
-// ③ EventKind/Actor 枚举面：golden 的每个 kind 必须仍可 append 且进入投影
-// （编译期联合类型无法运行时枚举——用 golden 驱动正向验证：每个 kind append 成功 + deriveMessages 投影语义不变）
-let kindsOk = true
-for (const kind of golden.eventKinds) {
-  try {
-    const l = new SessionLog('kc-' + kind)
-    const actor = kind === 'user' ? 'user' : kind === 'assistant' ? 'model' : 'runtime'
-    l.append(actor as never, kind as never, 'T', { probe: kind })
-  } catch { kindsOk = false }
-}
-check('EventKind 枚举全兼容', kindsOk)
-
-// ④ 投影语义（CLI/宿主消费的 Envelope 面）：四类消息映射规则不变
-const l2 = new SessionLog('proj')
-l2.append('user', 'user', 'T', { text: 'u' })
-l2.append('model', 'assistant', 'T', { text: 'a' })
-l2.append('model', 'toolCall', 'T', { name: 't' })
-l2.append('runtime', 'toolResult', 'T', { ok: true })
-const proj = l2.deriveMessages()
-const roles = proj.map(m => m.role)
-check('deriveMessages 投影语义不变', JSON.stringify(roles) === JSON.stringify(['user', 'assistant', 'assistant', 'toolResult']), roles.join(','))
-
-console.log(`----\ncontract: ${4 - failed}/4 PASS, ${failed} FAIL`)
-process.exit(failed === 0 ? 0 : 1)

package/scripts/invariant-n1.ts

@@ -1,96 +0,0 @@
-/**
- * J-08 invariant-n1 · N1 不变量常驻门禁（M2部署设计增补 §2.3）
- *
- * 口径：N1 =「Model-visible means logged」（F2）——请求时快照 === 日志前缀投影。
- * 本脚本为 CI 承载体：100 个确定性回放 fixtures（固定种子 PRNG）× 三类断言：
- *   ① 正向：每 fixture 的全部快照与当前日志前缀投影逐字节一致（assertModelVisibleLogged）
- *   ② 哈希链：verifyChain 全绿；篡改任一事件 payload 必然断链（防假绿自检——G-11 教训：
- *      「看起来在测」的门禁必须先证明它能 FAIL）
- *   ③ 事件种类覆盖：8 种 EventKind 在 100 fixtures 上全覆盖（≥95% 判据按 8/8 执行）
- * 任一失败 exit 1；输出 JSONL 明细 + 汇总行（审计口径与 J-05/J-18 一致）。
- */
-import { SessionLog } from '../src/session/log.ts'
-import { writeFileSync, mkdirSync } from 'node:fs'
-
-/** 固定种子 PRNG（mulberry32）——fixtures 可复现，重跑不漂移 */
-function prng(seed: number): () => number {
-  let a = seed >>> 0
-  return () => {
-    a |= 0; a = (a + 0x6d2b79f5) | 0
-    let t = Math.imul(a ^ (a >>> 15), 1 | a)
-    t = (t + Math.imul(t ^ (t >>> 7), 61 | t)) ^ t
-    return ((t ^ (t >>> 14)) >>> 0) / 4294967296
-  }
-}
-
-const KINDS = ['user', 'assistant', 'toolCall', 'toolResult', 'turnEnd', 'goalUpdate', 'hostRaw', 'fork'] as const
-type Kind = (typeof KINDS)[number]
-
-const ACTOR_BY_KIND: Record<Kind, string> = {
-  user: 'user', assistant: 'model', toolCall: 'model', toolResult: 'runtime',
-  turnEnd: 'runtime', goalUpdate: 'runtime', hostRaw: 'runtime', fork: 'runtime',
-}
-
-function payloadFor(kind: Kind, i: number): unknown {
-  switch (kind) {
-    case 'user': return { text: `msg-${i}` }
-    case 'assistant': return { text: `reply-${i}` }
-    case 'toolCall': return { name: 'tool', args: { n: i } }
-    case 'toolResult': return { ok: true, value: i }
-    case 'turnEnd': return { reason: 'end_turn' }
-    case 'goalUpdate': return { goal: `g-${i}` }
-    case 'hostRaw': return { raw: `r-${i}` }
-    case 'fork': return { from: `s-${i}` }
-  }
-}
-
-/** 构造一个含随机事件序列与随机快照点的 fixture */
-function buildFixture(seed: number): { log: SessionLog; kindsSeen: Set<Kind> } {
-  const rand = prng(seed)
-  const log = new SessionLog(`N1-F${String(seed).padStart(3, '0')}`)
-  const kindsSeen = new Set<Kind>()
-  const turns = 3 + Math.floor(rand() * 10)
-  for (let t = 0; t < turns; t++) {
-    // 每轮先随机登记 0-2 个快照（快照点 = 当前事件数，投影边界随机化）
-    const snaps = Math.floor(rand() * 3)
-    for (let s = 0; s < snaps; s++) log.snapshotModelRequest()
-    const events = 1 + Math.floor(rand() * 6)
-    for (let e = 0; e < events; e++) {
-      const kind = KINDS[Math.floor(rand() * KINDS.length)]
-      kindsSeen.add(kind)
-      log.append(ACTOR_BY_KIND[kind] as never, kind, `T${t}`, payloadFor(kind, log.events.length))
-    }
-  }
-  log.snapshotModelRequest() // 收尾快照：覆盖最后一条事件之后的前缀
-  return { log, kindsSeen }
-}
-
-// ── 主流程 ──
-const REPLAYS = 100
-const results: Array<{ fixture: string; events: number; snapshots: number; ok: boolean; chainOk: boolean; tamperDetected: boolean }> = []
-const kindCoverage = new Map<Kind, number>(KINDS.map(k => [k, 0]))
-let failed = 0
-
-for (let i = 0; i < REPLAYS; i++) {
-  const { log, kindsSeen } = buildFixture(i)
-  const fwd = log.assertModelVisibleLogged()
-  const chainOk = log.verifyChain() === null
-
-  // 防假绿自检：篡改中间事件 payload 必须被 verifyChain 检出
-  const tampered = SessionLog.fromEvents(log.sessionId, log.events.map((e, idx) =>
-    idx === Math.min(1, e.seq) ? { ...e, payload: { TAMPERED: true } } : e))
-  const tamperDetected = tampered.verifyChain() !== null
-
-  for (const k of kindsSeen) kindCoverage.set(k, (kindCoverage.get(k) ?? 0) + 1)
-  const ok = fwd.ok && chainOk && tamperDetected
-  if (!ok) failed++
-  results.push({ fixture: log.sessionId, events: log.events.length, snapshots: log.stats().snapshots, ok: fwd.ok, chainOk, tamperDetected })
-}
-
-const covered = [...kindCoverage.values()].filter(n => n > 0).length
-const coverage = covered / KINDS.length
-const summary = { gate: 'J-08-invariant-n1', replays: REPLAYS, passed: REPLAYS - failed, failed, kindCoverage: `${covered}/${KINDS.length}`, coverage, ok: failed === 0 && coverage >= 0.95, ts: Date.now() }
-console.log(JSON.stringify(summary))
-mkdirSync('dist/ci', { recursive: true })
-writeFileSync('dist/ci/invariant-n1.jsonl', results.map(r => JSON.stringify(r)).join('\n') + '\n')
-process.exit(summary.ok ? 0 : 1)

package/scripts/package-check.ts

@@ -1,29 +0,0 @@
-/**
- * J-13/14/15 package-* · npm pack 干跑 + 内容断言（M2部署设计增补 §2.3 / §3）
- *
- * 三平台同名同判据（files 白名单语义平台无关）；断言：
- *   ① pack 退出码 0（干跑可打包）；
- *   ② 文件数 ≥ 50（rc.1 基线 54 files——塌方即 FAIL，防 files 白名单被误改）；
- *   ③ 包名 = package.json name（防命名漂移——rc.1 tag 落后包名事故的常驻防线）。
- */
-import { execFileSync } from 'node:child_process'
-import { readFileSync } from 'node:fs'
-
-const pkg = JSON.parse(readFileSync('package.json', 'utf8'))
-const out = execFileSync(process.platform === 'win32' ? 'npm.cmd' : 'npm',
-  ['pack', '--dry-run', '--json'], { encoding: 'utf8', shell: process.platform === 'win32' })
-const info = JSON.parse(out)[0]
-
-const checks: Array<[string, boolean, string]> = [
-  ['pack exit 0', true, `${info.name}@${info.version}`],
-  ['file count >= 50', (info.files?.length ?? 0) >= 50, `${info.files?.length ?? 0} files / ${info.size} bytes`],
-  ['name no-drift', info.name === pkg.name, `${info.name} == ${pkg.name}`],
-]
-
-let failed = 0
-for (const [name, ok, detail] of checks) {
-  console.log(`[${ok ? 'PASS' : 'FAIL'}] ${name}  ${detail}`)
-  if (!ok) failed++
-}
-console.log(`----\npackage-check(${process.platform}): ${checks.length - failed}/${checks.length} PASS`)
-process.exit(failed === 0 ? 0 : 1)

package/scripts/ptc-baseline/run-baseline.ts

@@ -1,118 +0,0 @@
-/**
- * T-7 · PTC 成功率评测基线（M4-S19 实装，S20 使用）
- *
- * 口径（M4系统设计增补 T-7 / PRD P1-4 验收：PTC 成功率 ≥ 非 PTC 基线）：
- *  - 12 任务 × 五类（纯计算 2 / 单工具 2 / 多工具编排 3 / 错误恢复 3 / 预算边界 2）；
- *    判定口径：E 类（预算边界）= 护栏正确触发即成功（两侧对称）；
- *  - 每任务每形态 ≥N 次（默认 5，--runs 调整）；对照组 = 等价非 PTC 逐步工具调用（同一工具注册表）；
- *  - 输出：JSONL 逐次明细 + 汇总（PTC 成功率 vs 非 PTC 基线 + P1-4 判定）；
- *  - 运行：node --experimental-transform-types scripts/ptc-baseline/run-baseline.ts [--runs 5]
- */
-import { writeFileSync, mkdirSync } from 'node:fs'
-import { runCode, makePtcToolDefinition, type ToolBridge } from '../../src/ptc/runCode.ts'
-import { convergeBudget } from '../../src/ptc/budget.ts'
-
-// ── 评测工具注册表（与 PTC/非 PTC 两侧共享——对照公平性） ──
-const TOOLS = new Map<string, ToolBridge & { description?: string; paramHint?: string }>([
-  ['math_add', { run: async (a: unknown) => { const p = a as { x: number; y: number }; return p.x + p.y }, description: '加法', paramHint: 'args: { x: number; y: number }' }],
-  ['math_mul', { run: async (a: unknown) => { const p = a as { x: number; y: number }; return p.x * p.y }, description: '乘法' }],
-  ['str_len', { run: async (a: unknown) => (a as { s: string }).s.length, description: '字符串长度' }],
-  ['flaky', { run: async (a: unknown) => { if ((a as { fail?: boolean }).fail) throw new Error('simulated failure'); return 'recovered' }, description: '可失败工具' }],
-])
-
-interface Task {
-  id: string; cls: 'compute' | 'single-tool' | 'orchestration' | 'error-recovery' | 'budget-edge'
-  name: string
-  /** PTC 程序体（erasable async 函数体） */
-  code: string
-  description: string
-  /** 期望判定：结果语义正确；E 类 = 护栏正确触发 */
-  expect: (result: unknown, error?: string) => boolean
-  /** 等 PTC 护栏触发后判成功的 E 类，非 PTC 对照跳过（无对应逐步语义） */
-  ptcOnly?: boolean
-  budget?: { maxWallMs?: number; maxOutputBytes?: number }
-}
-
-const TASKS: Task[] = [
-  { id: 'C1', cls: 'compute', name: '纯计算-算术', code: 'const a = 6 * 7\nreturn { answer: a }', description: '纯算术验证', expect: r => (r as { answer: number }).answer === 42 },
-  { id: 'C2', cls: 'compute', name: '纯计算-字符串', code: 'const s = "car-runtime"\nreturn { len: s.length, upper: s.toUpperCase() }', description: '字符串处理', expect: r => (r as { len: number }).len === 11 },
-  { id: 'S1', cls: 'single-tool', name: '单工具-加法', code: 'const r = await tools.math_add({ x: 20, y: 22 })\nreturn { sum: r }', description: '单工具调用', expect: r => (r as { sum: number }).sum === 42 },
-  { id: 'S2', cls: 'single-tool', name: '单工具-字符串', code: 'const n = await tools.str_len({ s: "hello" })\nreturn { n }', description: '单工具调用', expect: r => (r as { n: number }).n === 5 },
-  { id: 'O1', cls: 'orchestration', name: '编排-串行依赖', code: 'const a = await tools.math_add({ x: 2, y: 3 })\nconst b = await tools.math_mul({ x: a, y: 4 })\nreturn { b }', description: '串行依赖链', expect: r => (r as { b: number }).b === 20 },
-  { id: 'O2', cls: 'orchestration', name: '编排-并行', code: 'const [a, b] = await Promise.all([tools.math_add({ x: 1, y: 1 }), tools.math_mul({ x: 3, y: 3 })])\nreturn { a, b }', description: 'Promise.all 并行', expect: r => (r as { a: number; b: number }).a === 2 && (r as { a: number; b: number }).b === 9 },
-  { id: 'O3', cls: 'orchestration', name: '编排-混合', code: 'const parts = []\nfor (const p of [{ x: 1, y: 2 }, { x: 3, y: 4 }]) parts.push(await tools.math_add(p))\nreturn { parts, total: parts[0] + parts[1] }', description: '循环+聚合', expect: r => (r as { total: number }).total === 10 },
-  { id: 'E1', cls: 'error-recovery', name: '恢复-try/catch', code: 'try { await tools.flaky({ fail: true }) } catch (e) { return { caught: true } }\nreturn { caught: false }', description: '工具异常捕获', expect: r => (r as { caught: boolean }).caught === true },
-  { id: 'E2', cls: 'error-recovery', name: '恢复-部分失败继续', code: 'const out: string[] = []\ntry { await tools.flaky({ fail: true }) } catch { out.push("skip") }\nout.push(await tools.flaky({}))\nreturn { out }', description: '部分失败继续', expect: r => (r as { out: string[] }).out.length === 2 },
-  { id: 'E3', cls: 'error-recovery', name: '恢复-重试语义', code: 'let ok = false\nfor (let i = 0; i < 3; i++) { try { ok = (await tools.flaky({ fail: i < 1 })) === "recovered"; if (ok) break } catch {} }\nreturn { ok }', description: '重试直至成功', expect: r => (r as { ok: boolean }).ok === true },
-  { id: 'B1', cls: 'budget-edge', name: '预算-输出上限', code: 'return { blob: "x".repeat(9 * 1024 * 1024) }', description: '输出超 8MiB 测试上限', budget: { maxOutputBytes: 8 * 1024 * 1024, maxWallMs: 10_000 }, expect: (_r, e) => !!e?.startsWith('budget-exceeded (maxOutputBytes'), ptcOnly: true },
-  { id: 'B2', cls: 'budget-edge', name: '预算-墙钟上限', code: 'while (true) { await new Promise(r => setTimeout(r, 10)) }\nreturn null', description: '死循环墙钟护栏', budget: { maxWallMs: 400 }, expect: (_r, e) => !!e?.startsWith('budget-exceeded (maxWallMs'), ptcOnly: true },
-]
-
-// ── 非 PTC 对照（逐步工具调用，与 PTC 侧同注册表） ──
-function nonPtcEquivalent(task: Task, run: (name: string, args: unknown) => Promise<unknown>): Promise<{ ok: boolean; error?: string }> {
-  const call = (n: string, a: unknown) => run(n, a)
-  switch (task.id) {
-    case 'C1': return call('math_mul', { x: 6, y: 7 }).then(v => ({ ok: (v as number) === 42 }))
-    case 'C2': return call('str_len', { s: 'car-runtime' }).then(v => ({ ok: (v as number) === 11 }))
-    case 'S1': return call('math_add', { x: 20, y: 22 }).then(v => ({ ok: (v as number) === 42 }))
-    case 'S2': return call('str_len', { s: 'hello' }).then(v => ({ ok: (v as number) === 5 }))
-    case 'O1': return call('math_add', { x: 2, y: 3 }).then(a => call('math_mul', { x: a, y: 4 })).then(b => ({ ok: (b as number) === 20 }))
-    case 'O2': return Promise.all([call('math_add', { x: 1, y: 1 }), call('math_mul', { x: 3, y: 3 })]).then(([a, b]) => ({ ok: a === 2 && b === 9 }))
-    case 'O3': return call('math_add', { x: 1, y: 2 }).then(a => call('math_add', { x: 3, y: 4 }).then(b => ({ ok: (a as number) + (b as number) === 10 })))
-    case 'E1': return call('flaky', { fail: true }).then(() => ({ ok: false }), e => ({ ok: String(e).includes('simulated failure') }))
-    case 'E2': return call('flaky', { fail: true }).catch(() => call('flaky', {})).then(v => ({ ok: v === 'recovered' }))
-    case 'E3': return call('flaky', { fail: true }).catch(() => call('flaky', {})).then(v => ({ ok: v === 'recovered' }))
-    default: return Promise.resolve({ ok: true }) // B 类 ptcOnly 跳过
-  }
-}
-
-async function main() {
-  const runs = Math.max(1, Number(process.argv[process.argv.indexOf('--runs') + 1] ?? 5) || 5)
-  const lines: Record<string, unknown>[] = []
-  const ptcDef = makePtcToolDefinition({ tools: TOOLS })
-  const summary: Record<string, { ptc: number; non: number; total: number }> = {}
-
-  for (const task of TASKS) {
-    let ok = 0
-    for (let i = 0; i < runs; i++) {
-      try {
-        if (task.cls === 'budget-edge') {
-          // E 类经 runCode 直接驱动（护栏触发即成功）
-          const r = await runCode({ code: task.code, description: task.description, toolCallId: `${task.id}-${i}`, budget: convergeBudget(task.budget) }, { tools: TOOLS })
-          const pass = task.expect(r.result, r.error)
-          if (pass) ok++
-          lines.push({ task: task.id, cls: task.cls, run: i, ok: pass, error: r.error, budgetExceeded: r.budgetExceeded })
-        } else {
-          const r = await runCode({ code: task.code, description: task.description, toolCallId: `${task.id}-${i}`, budget: { maxWallMs: 10_000 } }, { tools: TOOLS })
-          const pass = r.ok && task.expect(r.result, r.error)
-          if (pass) ok++
-          lines.push({ task: task.id, cls: task.cls, run: i, ok: pass, error: r.error })
-        }
-      } catch (e) { lines.push({ task: task.id, cls: task.cls, run: i, ok: false, error: String(e) }) }
-    }
-    // 非 PTC 对照
-    let nonOk = 0
-    if (!task.ptcOnly) {
-      for (let i = 0; i < runs; i++) {
-        const r = await nonPtcEquivalent(task, (n, a) => (TOOLS.get(n) as ToolBridge).run(a))
-        if (r.ok) nonOk++
-      }
-    } else nonOk = runs // ptcOnly 不参与对照，按满分避免拉低基线
-    summary[task.cls] = summary[task.cls] ?? { ptc: 0, non: 0, total: 0 }
-    summary[task.cls].ptc += ok; summary[task.cls].non += nonOk; summary[task.cls].total += runs
-    console.log(`${task.id} ${task.name}: PTC ${ok}/${runs}${task.ptcOnly ? '（ptcOnly）' : ` | 非PTC ${nonOk}/${runs}`}`)
-  }
-
-  const totalPtc = Object.values(summary).reduce((s, v) => s + v.ptc, 0)
-  const totalNon = Object.values(summary).reduce((s, v) => s + v.non, 0)
-  const totalN = Object.values(summary).reduce((s, v) => s + v.total, 0)
-  const rate = (x: number) => ((x / totalN) * 100).toFixed(1) + '%'
-  console.log(`\n==== PTC 成功率 ${totalPtc}/${totalN} = ${rate(totalPtc)} ｜ 非 PTC 基线 ${totalNon}/${totalN} = ${rate(totalNon)} ====`)
-  console.log(`P1-4 判定：${totalPtc >= totalNon ? '✅ PTC ≥ 非 PTC 基线' : '❌ PTC < 非 PTC 基线（需分析失败任务）'}`)
-  mkdirSync('dist/ptc-baseline', { recursive: true })
-  writeFileSync('dist/ptc-baseline/detail.jsonl', lines.map(l => JSON.stringify(l)).join('\n') + '\n')
-  writeFileSync('dist/ptc-baseline/summary.json', JSON.stringify({ runs, ptc: totalPtc, non: totalNon, total: totalN, byClass: summary }, null, 2))
-  console.log('明细：dist/ptc-baseline/detail.jsonl ｜ 汇总：dist/ptc-baseline/summary.json')
-}
-
-main()

package/scripts/release-artifacts.ts

@@ -1,111 +0,0 @@
-/**
- * 1.3-S1 · 发布制品构建（W4）：本地 release-pipeline.ts 与 CI j16 双端复用的单一事实源
- *
- * 口径（1.3 规划 W4-1/W4-4 / D-14 / D-15）：
- *  - 同一仓树 → 逐字节同制品（git archive HEAD；G-11 教训：哈希对裸字节求）；
- *  - **资产集五件套**（releaseAssetNames 单一事实源——G-10 need-list、CI upload、测试三方同源）：
- *      car-runtime-<v>.tgz / car-runtime-<v>.tgz.sig.bundle / SHA256SUMS / sbom.json / release-audit.jsonl
- *    car-release.pub 自 1.3 移除（D-14：keyless 下验证锚 = bundle 证书 + Rekor，不再是本地公钥）；
- *  - **签名不在此层**（D-15 双轨）：bundle 由签名轨产出——本地 keypair no-tlog（预演态，
- *    release-pipeline G-08）/ CI keyless OIDC+Rekor（正式态，j16）；本脚本只构建与审计；
- *  - 构建审计：CLI 入口（CI 调用形态）写 release-audit.jsonl（archive/sbom/sha256 记录）；
- *    程序化调用（pipeline）经 onRecord 接入调用方审计流。
- *  - 零依赖（node:crypto/fs/child_process）。
- */
-import { execSync } from 'node:child_process'
-import { createHash } from 'node:crypto'
-import { mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from 'node:fs'
-import { join } from 'node:path'
-import { pathToFileURL } from 'node:url'
-
-export interface BuildRecord { stage: string; detail: string; ts: number }
-
-export interface BuildResult {
-  tgzPath: string
-  sha256: string
-  sumsPath: string
-  sbomPath: string
-  components: number
-  bytes: number
-  records: BuildRecord[]
-}
-
-const sha256 = (s: string | Buffer) => createHash('sha256').update(s).digest('hex')
-
-function walk(dir: string, ext: string): string[] {
-  let out: string[] = []
-  for (const name of readdirSync(dir)) {
-    const p = join(dir, name)
-    if (statSync(p).isDirectory()) out = out.concat(walk(p, ext))
-    else if (p.endsWith(ext)) out.push(p)
-  }
-  return out
-}
-
-/** 资产集清单（五件套；D-14：car-release.pub 移除，签名 bundle 由签名轨产出后入列） */
-export function releaseAssetNames(version: string): string[] {
-  return [
-    `car-runtime-${version}.tgz`,
-    `car-runtime-${version}.tgz.sig.bundle`,
-    'SHA256SUMS',
-    'sbom.json',
-    'release-audit.jsonl',
-  ]
-}
-
-export function buildReleaseArtifacts(opts: {
-  version: string
-  root?: string
-  dist?: string
-  onRecord?: (stage: string, detail: string) => void
-}): BuildResult {
-  const root = opts.root ?? new URL('..', import.meta.url).pathname.replace(/^\/([A-Za-z]:)/, '$1')
-  const dist = opts.dist ?? join(root, 'dist')
-  const version = opts.version
-  const records: BuildRecord[] = []
-  const rec = (stage: string, detail: string) => {
-    const r = { stage, detail, ts: Date.now() }
-    records.push(r)
-    opts.onRecord?.(stage, detail)
-  }
-
-  mkdirSync(dist, { recursive: true })
-  const tgzPath = join(dist, `car-runtime-${version}.tgz`)
-  execSync(`git archive --format=tar.gz -o "${tgzPath}" HEAD`, { cwd: root })
-  const bytes = readFileSync(tgzPath)
-  rec('archive', `git archive HEAD → car-runtime-${version}.tgz（${bytes.length} bytes，树哈希锚定）`)
-
-  // SHA256SUMS + 自检（G-11 口径：对裸字节求哈希；门禁不可写死为 true——落盘读回复核）
-  const sumsPath = join(dist, 'SHA256SUMS')
-  writeFileSync(sumsPath, `${sha256(bytes)}  car-runtime-${version}.tgz\n`)
-  const [recorded, recordedName] = readFileSync(sumsPath, 'utf-8').trim().split(/\s+/)
-  if (recorded !== sha256(bytes) || recordedName !== `car-runtime-${version}.tgz`) {
-    throw new Error(`CAR-E-ARTIFACT: SHA256SUMS 自检失败——记录 ${recorded} ≠ 制品裸字节哈希（G-11 教训口径）`)
-  }
-  rec('sha256sums', `SHA256SUMS ${recorded!.slice(0, 16)}…（裸字节复核通过）`)
-
-  // SBOM（G-05 同构：TS 直跑形态制品清单 + 零运行时依赖）
-  const files = [...walk(join(root, 'src'), '.ts'), join(root, 'package.json'), join(root, 'README.md')]
-  const sbom = {
-    bomFormat: 'CAR-SBOM', specVersion: '0.1', version,
-    components: files.map(f => ({ type: 'file', path: f.replace(root, '').replace(/\\/g, '/'), sha256: sha256(readFileSync(f, 'utf-8')) })),
-    runtimeDependencies: [],
-  }
-  const sbomPath = join(dist, 'sbom.json')
-  writeFileSync(sbomPath, JSON.stringify(sbom, null, 2))
-  rec('sbom', `${files.length} 个组件（运行时依赖 0 项）`)
-
-  return { tgzPath, sha256: sha256(bytes), sumsPath, sbomPath, components: files.length, bytes: bytes.length, records }
-}
-
-/** CLI 入口（CI j16 调用形态）：构建 + 写构建审计 release-audit.jsonl（五件套之五） */
-function main(): void {
-  const version = (JSON.parse(readFileSync(join(new URL('..', import.meta.url).pathname.replace(/^\/([A-Za-z]:)/, '$1'), 'package.json'), 'utf-8')) as { version: string }).version
-  const result = buildReleaseArtifacts({ version })
-  const auditPath = join(result.tgzPath, '..', 'release-audit.jsonl')
-  writeFileSync(auditPath, result.records.map(r => JSON.stringify(r)).join('\n') + '\n')
-  console.log(`release artifacts: v${version} → tgz(${result.bytes}B, sha256 ${result.sha256.slice(0, 16)}…) + SHA256SUMS + sbom(${result.components} components) + release-audit.jsonl`)
-  console.log(`assets (D-14 五件套): ${releaseAssetNames(version).join(', ')}`)
-}
-
-if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) main()