@microck/raft 0.0.0-stage → 0.2.1

package/deploy/verify-release.py

@@ -0,0 +1,132 @@
+"""Inspect built release artifacts for local metadata and private path leakage.
+
+This complements a secret scanner and manual history review. It is not a proof
+that every possible personal identifier has been removed.
+"""
+
+import json
+from pathlib import Path, PurePosixPath
+import re
+import subprocess
+import sys
+import tempfile
+import tarfile
+import zipfile
+
+ROOT = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(ROOT))
+from raft import __version__  # noqa: E402
+
+FORBIDDEN = {".git", ".jj", ".venv", ".ruff_cache", "__pycache__"}
+PRIVATE_TEXT = re.compile(r"/(?:home|Users)/[^\s<>]+|[\w.+-]+@[\w.-]+\.[A-Za-z]{2,}")
+
+
+def inspect(name, content):
+    path = PurePosixPath(name)
+    if path.is_absolute() or ".." in path.parts or FORBIDDEN.intersection(path.parts):
+        raise ValueError("Private metadata or unsafe archive member: " + name)
+    if path.suffix == ".pyc":
+        raise ValueError("Compiled cache in release: " + name)
+    # Source archives also contain binary branding assets; scan their readable bytes.
+    match = PRIVATE_TEXT.search(content.decode("utf-8", errors="replace"))
+    if match:
+        raise ValueError("Private path or email in release member: " + name)
+
+
+def verify_cli(executable, directory):
+    version = subprocess.check_output([str(executable), "--version"], cwd=directory, text=True)
+    if version.strip() != __version__:
+        raise ValueError("Installed CLI version differs from release source")
+    for command in [["--help"], ["upload", "--help"], ["new", "--help"], ["prune", "--help"]]:
+        output = subprocess.check_output([str(executable), *command], cwd=directory, text=True)
+        if command[0] == "upload" and "--recursive" not in output:
+            raise ValueError("Installed CLI lacks recursive transfers")
+        if command[0] == "new" and "--disposable" not in output:
+            raise ValueError("Installed CLI lacks disposable lifecycle")
+    invalid = subprocess.run([str(executable), "new", "--from"], cwd=directory, capture_output=True)
+    if invalid.returncode != 2:
+        raise ValueError("Installed CLI did not preserve argument-error exit status")
+
+
+def verify_npm():
+    metadata = json.loads((ROOT / "package.json").read_text())
+    if metadata["version"] != __version__:
+        raise ValueError("npm version differs from Python release version")
+    packed = json.loads(
+        subprocess.check_output(
+            ["npm", "pack", "--json", "--ignore-scripts", "--pack-destination", str(ROOT / "dist")],
+            cwd=ROOT,
+            text=True,
+        )
+    )[0]
+    package = ROOT / "dist" / packed["filename"]
+    with tarfile.open(package) as archive:
+        names = set()
+        for member in archive.getmembers():
+            if not member.isfile():
+                raise ValueError("Unexpected npm archive member: " + member.name)
+            content = archive.extractfile(member).read()
+            inspect(member.name, content)
+            names.add(member.name)
+            if member.name in {"package/raft.py", "package/raft_files.py"}:
+                if content != (ROOT / PurePosixPath(member.name).name).read_bytes():
+                    raise ValueError("npm runtime differs from canonical Python source")
+        required = {
+            "package/raft.py",
+            "package/raft_files.py",
+            "package/LICENSE",
+            "package/deploy/deploy.py",
+            "package/images/incus/build.sh",
+            "package/docs/incus.example.json",
+            "package/skills/raft-cli/SKILL.md",
+        }
+        if not required <= names:
+            raise ValueError("npm package lacks required runtime files")
+    with tempfile.TemporaryDirectory(prefix="raft-npm-") as work:
+        subprocess.run(
+            ["npm", "install", "--global", "--prefix", work, "--ignore-scripts", str(package)],
+            cwd=work,
+            check=True,
+            capture_output=True,
+        )
+        verify_cli(Path(work) / "bin/raft", work)
+    print("npm archive and isolated executable installation passed")
+
+
+def main():
+    sources = list((ROOT / "dist").glob("*.tar.gz"))
+    wheels = list((ROOT / "dist").glob("*.whl"))
+    if len(sources) != 1 or len(wheels) != 1:
+        raise ValueError("Build exactly one source archive and wheel before checking")
+    with tarfile.open(sources[0]) as archive:
+        members = archive.getmembers()
+        for member in members:
+            if not member.isfile():
+                raise ValueError("Unexpected non-file member: " + member.name)
+            inspect(member.name, archive.extractfile(member).read())
+        names = {PurePosixPath(member.name).parts[1] for member in members}
+        if not {"raft.py", "deploy", "docs", "images", "skills", "LICENSE"} <= names:
+            raise ValueError("Source archive missing installation resources")
+    with zipfile.ZipFile(wheels[0]) as archive:
+        for name in archive.namelist():
+            inspect(name, archive.read(name))
+        if not {"raft.py", "raft_files.py"} <= set(archive.namelist()):
+            raise ValueError("Wheel missing CLI module")
+    # A new environment avoids both editable checkouts and uv's cached same-version
+    # tool environments. Run the installed entry point outside the source tree.
+    with tempfile.TemporaryDirectory(prefix="raft-wheel-") as work:
+        environment = Path(work) / "venv"
+        python = environment / "bin/python"
+        subprocess.run(["uv", "venv", "--python", sys.executable, str(environment)], check=True)
+        subprocess.run(
+            ["uv", "pip", "install", "--no-cache", "--python", str(python), str(wheels[0])],
+            check=True,
+        )
+        verify_cli(environment / "bin/raft", work)
+        subprocess.run([str(python), "-I", "-c", "import raft, raft_files"], cwd=work, check=True)
+    verify_npm()
+    print("Release archives and isolated wheel installation passed")
+
+
+if __name__ == "__main__":
+    main()

package/deploy/verify-tools.py

@@ -0,0 +1,105 @@
+"""Execute real language programs as the guest developer, without model calls."""
+
+import argparse
+import json
+from pathlib import Path
+import sys
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
+from raft import execute, instance, parse_handle  # noqa: E402
+
+PROBE = r"""
+import json, os, subprocess, tempfile
+from pathlib import Path
+
+checks = {
+ "node": ["node", "-e", "console.log('raft-tool-ok')"],
+ "npm": ["bash", "-ec", "cd npm-project; npm install --offline --ignore-scripts; npm run proof"],
+ "pnpm": ["bash", "-ec", "cd pnpm-project; pnpm install --offline --ignore-scripts; pnpm run proof"],
+ "bun": ["bun", "-e", "console.log('raft-tool-ok')"],
+ "deno": ["deno", "eval", "console.log('raft-tool-ok')"],
+ "python": ["python3", "-c", "import ssl,sqlite3,venv; print('raft-tool-ok')"],
+ "uv": ["bash", "-ec", "uv venv --no-project venv; venv/bin/python -c \"print('raft-tool-ok')\""],
+ "go": ["bash", "-ec", "go build -o hello-go hello.go; ./hello-go"],
+ "rust": ["bash", "-ec", "rustc hello.rs -o hello-rust; ./hello-rust"],
+ "cargo": ["cargo", "run", "--offline", "--quiet", "--manifest-path", "cargo-project/Cargo.toml"],
+ "java": ["bash", "-ec", "javac Hello.java; java Hello"],
+ "maven": ["bash", "-ec", "mvn -q -f maven-project/pom.xml package; java -cp maven-project/target/classes Hello"],
+ "gradle": ["gradle", "--no-daemon", "--console=plain", "-p", "gradle-project", "proof"],
+ "kotlin": ["bash", "-ec", "kotlinc hello.kt -include-runtime -d hello-kotlin.jar; java -jar hello-kotlin.jar"],
+ "scala": ["bash", "-ec", "scalac Hello.scala; scala -nc HelloScala"],
+ "ruby": ["ruby", "-e", "puts 'raft-tool-ok'"],
+ "bundler": ["bash", "-ec", "export BUNDLE_GEMFILE=$PWD/bundler-project/Gemfile; bundle install --local; bundle exec ruby -e \"puts 'raft-tool-ok'\""],
+ "php": ["php", "-r", "echo 'raft-tool-ok';"],
+ "composer": ["composer", "--working-dir=composer-project", "run", "proof"],
+ "elixir": ["elixir", "-e", 'IO.puts("raft-tool-ok")'],
+ "R": ["Rscript", "-e", 'cat("raft-tool-ok")'],
+ "gcc": ["bash", "-ec", "gcc hello.c -o hello-c; ./hello-c"],
+ "clang": ["bash", "-ec", "clang hello.c -o hello-clang; ./hello-clang"],
+ "cpp": ["bash", "-ec", "g++ hello.cpp -o hello-cpp; ./hello-cpp"],
+ "cmake-ninja": ["bash", "-ec", "cmake -S . -B build -G Ninja; cmake --build build; build/hello"],
+ "dotnet": ["bash", "-ec", "dotnet new console -o dotnet --no-restore; printf 'Console.WriteLine(\"raft-tool-ok\");' > dotnet/Program.cs; mkdir feed; dotnet restore dotnet --source \"$PWD/feed\"; dotnet run --project dotnet --no-restore"],
+ "git": ["bash", "-ec", "git init -q repo; git -C repo status --porcelain"],
+ "rg": ["rg", "raft-tool-ok", "hello.c"],
+ "jq": ["bash", "-ec", "printf '{\"ok\":true}' | jq -e .ok"],
+ "ffmpeg": ["ffmpeg", "-v", "error", "-f", "lavfi", "-i", "color=c=black:s=16x16:d=0.1", "-f", "null", "-"],
+ "chromium": ["chromium", "--headless", "--disable-dev-shm-usage", "--dump-dom", "data:text/html,<h1>raft-tool-ok</h1>"],
+}
+sources = {
+ "hello.go": 'package main\nimport "fmt"\nfunc main(){fmt.Println("raft-tool-ok")}\n',
+ "hello.rs": 'fn main(){println!("raft-tool-ok");}\n',
+ "Hello.java": 'public class Hello {public static void main(String[] args){System.out.println("raft-tool-ok");}}\n',
+ "hello.kt": 'fun main(){println("raft-tool-ok")}\n',
+ "Hello.scala": 'object HelloScala extends App {println("raft-tool-ok")}\n',
+ "hello.c": '#include <stdio.h>\nint main(){puts("raft-tool-ok");return 0;}\n',
+ "hello.cpp": '#include <iostream>\nint main(){std::cout << "raft-tool-ok";}\n',
+ "npm-project/package.json": json.dumps({"name": "raft-npm-proof", "version": "1.0.0", "scripts": {"proof": "node -e \"console.log('raft-tool-ok')\""}}),
+ "pnpm-project/package.json": json.dumps({"name": "raft-pnpm-proof", "version": "1.0.0", "scripts": {"proof": "node -e \"console.log('raft-tool-ok')\""}}),
+ "cargo-project/Cargo.toml": '[package]\nname="raft-proof"\nversion="0.1.0"\nedition="2021"\n',
+ "cargo-project/src/main.rs": 'fn main(){println!("raft-tool-ok");}\n',
+ "maven-project/pom.xml": '<project><modelVersion>4.0.0</modelVersion><groupId>dev.raft</groupId><artifactId>proof</artifactId><version>1</version><properties><maven.compiler.source>17</maven.compiler.source><maven.compiler.target>17</maven.compiler.target></properties></project>',
+ "maven-project/src/main/java/Hello.java": 'public class Hello {public static void main(String[] args){System.out.println("raft-tool-ok");}}\n',
+ "gradle-project/build.gradle": "apply plugin: 'java'\ntask proof(type: JavaExec) { dependsOn classes; main = 'Hello'; classpath = sourceSets.main.runtimeClasspath }\n",
+ "gradle-project/src/main/java/Hello.java": 'public class Hello {public static void main(String[] args){System.out.println("raft-tool-ok");}}\n',
+ "bundler-project/Gemfile": 'source "https://rubygems.org"\n',
+ "composer-project/composer.json": json.dumps({"name": "raft/proof", "scripts": {"proof": "php -r \"echo 'raft-tool-ok';\""}}),
+ "CMakeLists.txt": 'cmake_minimum_required(VERSION 3.10)\nproject(hello C)\nadd_executable(hello hello.c)\n',
+}
+# These three commands validate state or decode media rather than print the program marker.
+proof_tools = checks.keys() - {'git', 'jq', 'ffmpeg'}
+report = {}
+with tempfile.TemporaryDirectory(prefix='raft-tool-audit-') as work:
+ for filename, content in sources.items():
+  source = Path(work) / filename
+  source.parent.mkdir(parents=True, exist_ok=True)
+  source.write_text(content)
+ environment = {**os.environ, 'DOTNET_CLI_TELEMETRY_OPTOUT': '1', 'DOTNET_NOLOGO': '1'}
+ for tool, command in checks.items():
+  try:
+   result = subprocess.run(command, cwd=work, env=environment, capture_output=True, text=True, timeout=120)
+   report[tool] = {'passed': result.returncode == 0 and (tool not in proof_tools or 'raft-tool-ok' in result.stdout), 'exitCode': result.returncode,
+                   'output': (result.stdout + result.stderr)[-2000:]}
+  except (OSError, subprocess.TimeoutExpired) as error:
+   report[tool] = {'passed': False, 'output': str(error)}
+print(json.dumps(report))
+"""
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("box")
+    args = parser.parse_args()
+    location, name = parse_handle(args.box)
+    instance(location, name)
+    response = execute(
+        location, name, ["runuser", "-u", "developer", "--", "python3", "-c", PROBE], capture=True
+    )
+    if response.returncode:
+        raise RuntimeError(response.stderr.decode().strip())
+    report = json.loads(response.stdout)
+    print(json.dumps(report, indent=2))
+    return int(any(not check["passed"] for check in report.values()))
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/docs/benchmarks/amd64-native-ci.json

@@ -0,0 +1,137 @@
+{
+  "hostArchitecture": "x86_64",
+  "hostCpus": 4,
+  "guestCpus": 1,
+  "guestMemory": "2GiB",
+  "sshRoundTripSeconds": 0.252,
+  "scope": "Cached local image; includes controller CLI and SSH; no host reboot or download",
+  "samples": [
+    {
+      "create": {
+        "cliReturnSeconds": 0.692,
+        "commandReadySeconds": 1.375,
+        "dockerReadySeconds": 3.035,
+        "desktopStartSeconds": 1.604
+      },
+      "resume": {
+        "cliReturnSeconds": 0.81,
+        "commandReadySeconds": 1.477,
+        "dockerReadySeconds": 3.049,
+        "desktopStartSeconds": 1.587
+      }
+    },
+    {
+      "create": {
+        "cliReturnSeconds": 0.648,
+        "commandReadySeconds": 1.324,
+        "dockerReadySeconds": 3.131,
+        "desktopStartSeconds": 1.627
+      },
+      "resume": {
+        "cliReturnSeconds": 0.858,
+        "commandReadySeconds": 1.556,
+        "dockerReadySeconds": 2.995,
+        "desktopStartSeconds": 1.595
+      }
+    },
+    {
+      "create": {
+        "cliReturnSeconds": 0.659,
+        "commandReadySeconds": 1.334,
+        "dockerReadySeconds": 3.044,
+        "desktopStartSeconds": 1.592
+      },
+      "resume": {
+        "cliReturnSeconds": 0.803,
+        "commandReadySeconds": 1.489,
+        "dockerReadySeconds": 3.196,
+        "desktopStartSeconds": 1.567
+      }
+    },
+    {
+      "create": {
+        "cliReturnSeconds": 0.707,
+        "commandReadySeconds": 1.396,
+        "dockerReadySeconds": 2.815,
+        "desktopStartSeconds": 1.567
+      },
+      "resume": {
+        "cliReturnSeconds": 0.836,
+        "commandReadySeconds": 1.542,
+        "dockerReadySeconds": 3.204,
+        "desktopStartSeconds": 1.574
+      }
+    },
+    {
+      "create": {
+        "cliReturnSeconds": 0.653,
+        "commandReadySeconds": 1.434,
+        "dockerReadySeconds": 2.916,
+        "desktopStartSeconds": 1.578
+      },
+      "resume": {
+        "cliReturnSeconds": 0.822,
+        "commandReadySeconds": 1.475,
+        "dockerReadySeconds": 2.685,
+        "desktopStartSeconds": 1.57
+      }
+    }
+  ],
+  "imageVolumeCachedAtStart": true,
+  "guestArchitecture": "amd64",
+  "imageSizeBytes": 1992633951,
+  "summary": {
+    "create": {
+      "cliReturnSeconds": {
+        "median": 0.659,
+        "min": 0.648,
+        "max": 0.707,
+        "p95": 0.707
+      },
+      "commandReadySeconds": {
+        "median": 1.375,
+        "min": 1.324,
+        "max": 1.434,
+        "p95": 1.434
+      },
+      "dockerReadySeconds": {
+        "median": 3.035,
+        "min": 2.815,
+        "max": 3.131,
+        "p95": 3.131
+      },
+      "desktopStartSeconds": {
+        "median": 1.592,
+        "min": 1.567,
+        "max": 1.627,
+        "p95": 1.627
+      }
+    },
+    "resume": {
+      "cliReturnSeconds": {
+        "median": 0.822,
+        "min": 0.803,
+        "max": 0.858,
+        "p95": 0.858
+      },
+      "commandReadySeconds": {
+        "median": 1.489,
+        "min": 1.475,
+        "max": 1.556,
+        "p95": 1.556
+      },
+      "dockerReadySeconds": {
+        "median": 3.049,
+        "min": 2.685,
+        "max": 3.204,
+        "p95": 3.204
+      },
+      "desktopStartSeconds": {
+        "median": 1.574,
+        "min": 1.567,
+        "max": 1.595,
+        "p95": 1.595
+      }
+    }
+  }
+}

package/docs/benchmarks/arm64-baseline-a.json

@@ -0,0 +1,108 @@
+{
+  "hostArchitecture": "aarch64",
+  "hostCpus": 2,
+  "guestCpus": 1,
+  "guestMemory": "2GiB",
+  "sshRoundTripSeconds": 0.397,
+  "scope": "Cached local image; includes controller CLI and SSH; no host reboot or download",
+  "samples": [
+    {
+      "create": {
+        "cliReturnSeconds": 0.844,
+        "commandReadySeconds": 2.591,
+        "dockerReadySeconds": 4.36,
+        "desktopStartSeconds": 2.888
+      },
+      "resume": {
+        "cliReturnSeconds": 1.547,
+        "commandReadySeconds": 3.907,
+        "dockerReadySeconds": 4.959,
+        "desktopStartSeconds": 2.305
+      }
+    },
+    {
+      "create": {
+        "cliReturnSeconds": 0.978,
+        "commandReadySeconds": 1.918,
+        "dockerReadySeconds": 3.941,
+        "desktopStartSeconds": 2.602
+      },
+      "resume": {
+        "cliReturnSeconds": 1.0,
+        "commandReadySeconds": 1.804,
+        "dockerReadySeconds": 3.917,
+        "desktopStartSeconds": 2.492
+      }
+    },
+    {
+      "create": {
+        "cliReturnSeconds": 0.864,
+        "commandReadySeconds": 1.724,
+        "dockerReadySeconds": 3.768,
+        "desktopStartSeconds": 2.511
+      },
+      "resume": {
+        "cliReturnSeconds": 1.056,
+        "commandReadySeconds": 1.851,
+        "dockerReadySeconds": 3.296,
+        "desktopStartSeconds": 2.43
+      }
+    }
+  ],
+  "guestArchitecture": "arm64",
+  "imageSizeBytes": 2626705196,
+  "summary": {
+    "create": {
+      "cliReturnSeconds": {
+        "median": 0.864,
+        "min": 0.844,
+        "max": 0.978,
+        "p95": 0.978
+      },
+      "commandReadySeconds": {
+        "median": 1.918,
+        "min": 1.724,
+        "max": 2.591,
+        "p95": 2.591
+      },
+      "dockerReadySeconds": {
+        "median": 3.941,
+        "min": 3.768,
+        "max": 4.36,
+        "p95": 4.36
+      },
+      "desktopStartSeconds": {
+        "median": 2.602,
+        "min": 2.511,
+        "max": 2.888,
+        "p95": 2.888
+      }
+    },
+    "resume": {
+      "cliReturnSeconds": {
+        "median": 1.056,
+        "min": 1.0,
+        "max": 1.547,
+        "p95": 1.547
+      },
+      "commandReadySeconds": {
+        "median": 1.851,
+        "min": 1.804,
+        "max": 3.907,
+        "p95": 3.907
+      },
+      "dockerReadySeconds": {
+        "median": 3.917,
+        "min": 3.296,
+        "max": 4.959,
+        "p95": 4.959
+      },
+      "desktopStartSeconds": {
+        "median": 2.43,
+        "min": 2.305,
+        "max": 2.492,
+        "p95": 2.492
+      }
+    }
+  }
+}

package/docs/benchmarks/arm64-baseline-b.json

@@ -0,0 +1,108 @@
+{
+  "hostArchitecture": "aarch64",
+  "hostCpus": 2,
+  "guestCpus": 1,
+  "guestMemory": "2GiB",
+  "sshRoundTripSeconds": 3.556,
+  "scope": "Cached local image; includes controller CLI and SSH; no host reboot or download",
+  "samples": [
+    {
+      "create": {
+        "cliReturnSeconds": 2.906,
+        "commandReadySeconds": 7.408,
+        "dockerReadySeconds": 11.445,
+        "desktopStartSeconds": 7.344
+      },
+      "resume": {
+        "cliReturnSeconds": 4.224,
+        "commandReadySeconds": 8.213,
+        "dockerReadySeconds": 11.653,
+        "desktopStartSeconds": 7.734
+      }
+    },
+    {
+      "create": {
+        "cliReturnSeconds": 3.461,
+        "commandReadySeconds": 6.936,
+        "dockerReadySeconds": 10.753,
+        "desktopStartSeconds": 7.631
+      },
+      "resume": {
+        "cliReturnSeconds": 3.889,
+        "commandReadySeconds": 7.234,
+        "dockerReadySeconds": 11.291,
+        "desktopStartSeconds": 6.876
+      }
+    },
+    {
+      "create": {
+        "cliReturnSeconds": 2.219,
+        "commandReadySeconds": 6.221,
+        "dockerReadySeconds": 10.664,
+        "desktopStartSeconds": 7.659
+      },
+      "resume": {
+        "cliReturnSeconds": 3.701,
+        "commandReadySeconds": 8.341,
+        "dockerReadySeconds": 11.918,
+        "desktopStartSeconds": 7.669
+      }
+    }
+  ],
+  "guestArchitecture": "arm64",
+  "imageSizeBytes": 2626688616,
+  "summary": {
+    "create": {
+      "cliReturnSeconds": {
+        "median": 2.906,
+        "min": 2.219,
+        "max": 3.461,
+        "p95": 3.461
+      },
+      "commandReadySeconds": {
+        "median": 6.936,
+        "min": 6.221,
+        "max": 7.408,
+        "p95": 7.408
+      },
+      "dockerReadySeconds": {
+        "median": 10.753,
+        "min": 10.664,
+        "max": 11.445,
+        "p95": 11.445
+      },
+      "desktopStartSeconds": {
+        "median": 7.631,
+        "min": 7.344,
+        "max": 7.659,
+        "p95": 7.659
+      }
+    },
+    "resume": {
+      "cliReturnSeconds": {
+        "median": 3.889,
+        "min": 3.701,
+        "max": 4.224,
+        "p95": 4.224
+      },
+      "commandReadySeconds": {
+        "median": 8.213,
+        "min": 7.234,
+        "max": 8.341,
+        "p95": 8.341
+      },
+      "dockerReadySeconds": {
+        "median": 11.653,
+        "min": 11.291,
+        "max": 11.918,
+        "p95": 11.918
+      },
+      "desktopStartSeconds": {
+        "median": 7.669,
+        "min": 6.876,
+        "max": 7.734,
+        "p95": 7.734
+      }
+    }
+  }
+}