@mogragsigma/dsh-dual-host-plugin 0.0.0-stage → 0.33.2

package/bundle/delivery-process-receipts.js

@@ -0,0 +1,90 @@
+// Private durable supervisor evidence. Not a signature or OS identity boundary:
+// an administrator able to rewrite the journal and state directory remains trusted.
+import {mkdirSync,lstatSync,realpathSync,openSync,closeSync,fstatSync,readSync,readFileSync,constants} from 'node:fs';
+import {join} from 'node:path';
+import {randomBytes} from 'node:crypto';
+import {canonical,digest} from './approval-ledger.js';
+import {validateProcessReport} from './delivery-process.js';
+const fail=c=>{throw Error('DELIVERY_RECEIPT_'+c);};
+const same=(a,b)=>canonical(a)===canonical(b);
+const stamp=s=>[s.dev,s.ino,s.mode,s.uid,s.nlink,s.size,s.mtimeNs,s.ctimeNs].map(String).join(':');
+const sha=x=>typeof x==='string'&&/^[a-f0-9]{64}$/.test(x);
+const uuid=x=>typeof x==='string'&&/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(x);
+export function bootId(){const id=readFileSync('/proc/sys/kernel/random/boot_id','ascii').trim();if(!uuid(id))fail('BOOT_UNKNOWN');return id;}
+export function supervisorLive(pid,start,boot){
+ if(bootId()!==boot)return false;
+ let raw;try{raw=readFileSync('/proc/'+pid+'/stat','ascii');}catch(e){if(e.code==='ENOENT')return false;throw e;}
+ const rest=raw.slice(raw.lastIndexOf(')')+2).split(' ');
+ if(rest.length<20||!/^\d+$/.test(rest[19])||!rest[0])fail('SUPERVISOR_UNKNOWN');
+ return rest[19]===start&&!['Z','X'].includes(rest[0]);
+}
+export function validateReceiptBinding(v){
+ if(!v||Object.keys(v).sort().join(',')!=='action_id,binding_hash,boot_id,directory,epoch,intent_fingerprint,nonce,operation_id,plan_fingerprint,schema'||v.schema!==1||
+  !/^delivery-op-[a-f0-9-]{36}$/.test(v.operation_id??'')||!/^delivery-[a-f0-9-]{36}$/.test(v.action_id??'')||
+  !Number.isSafeInteger(v.epoch)||v.epoch<1||![v.binding_hash,v.nonce,v.intent_fingerprint,v.plan_fingerprint].every(sha)||!uuid(v.boot_id)||
+  !v.directory||Object.keys(v.directory).sort().join(',')!=='device,inode,path'||typeof v.directory.path!=='string'||!v.directory.path.startsWith('/')||
+  v.directory.path.length>2048||/[\x00-\x1f\x7f]/.test(v.directory.path)||!/^\d{1,30}$/.test(v.directory.device)||!/^\d{1,30}$/.test(v.directory.inode))fail('BINDING_INVALID');
+ const {binding_hash,...body}=v;if(digest(body)!==binding_hash)fail('BINDING_INVALID');return v;
+}
+export class DeliveryProcessReceipts {
+ constructor({journal,directory,enabled=false},io={}){
+  this.j=journal;this.db=journal.db;this.directory=directory;this.enabled=enabled;this.boot=io.bootId??bootId;this.live=io.supervisorLive??supervisorLive;
+  if(enabled!==true)fail('DISABLED');
+  if(typeof directory!=='string'||!directory.startsWith('/'))fail('DIRECTORY_INVALID');
+  try{mkdirSync(directory,{mode:0o700});}catch(e){if(e.code!=='EEXIST')throw e;}this.directoryIdentity=this.checkDirectory();
+  this.db.exec(`CREATE TABLE IF NOT EXISTS delivery_process_receipts(operation_id TEXT PRIMARY KEY,nonce TEXT UNIQUE NOT NULL,
+   binding TEXT NOT NULL,created INTEGER NOT NULL);`);
+ }
+ checkDirectory(expected){
+  const s=lstatSync(this.directory,{bigint:true});
+  if(!s.isDirectory()||s.isSymbolicLink()||realpathSync(this.directory)!==this.directory||(s.mode&0o077n)!==0n||s.uid!==BigInt(process.getuid()))fail('DIRECTORY_CHANGED');
+  const v={path:this.directory,device:String(s.dev),inode:String(s.ino)};if(expected&&!same(v,expected))fail('DIRECTORY_CHANGED');return v;
+ }
+ prepare(operation_id){
+  if(this.enabled!==true)fail('DISABLED');
+  const o=this.j.operation(operation_id),i=this.j.effectAuthority(o.action_id,o.epoch);
+  if(o.kind!=='push'||o.state!=='intent'||o.pid!==null||i.kind!=='push-execution-intent-v1')fail('OPERATION_INVALID');
+  this.checkDirectory(this.directoryIdentity);
+  const body={schema:1,operation_id,action_id:o.action_id,epoch:o.epoch,intent_fingerprint:i.fingerprint,plan_fingerprint:i.plan.fingerprint,
+   nonce:randomBytes(32).toString('hex'),boot_id:this.boot(),directory:this.directoryIdentity};
+  const b=validateReceiptBinding({...body,binding_hash:digest(body)});
+  this.db.prepare('INSERT INTO delivery_process_receipts VALUES (?,?,?,?)').run(operation_id,b.nonce,canonical(b),this.j.now());return b;
+ }
+ binding(operation_id){
+  if(this.enabled!==true)fail('DISABLED');
+  const row=this.db.prepare('SELECT * FROM delivery_process_receipts WHERE operation_id=?').get(operation_id);if(!row)fail('BINDING_REQUIRED');
+  const b=validateReceiptBinding(JSON.parse(row.binding)),o=this.j.operation(operation_id),i=this.j.intent(this.j.row(o.action_id));
+  if(b.operation_id!==operation_id||row.nonce!==b.nonce||b.action_id!==o.action_id||b.epoch!==o.epoch||o.kind!=='push'||
+   b.intent_fingerprint!==i.fingerprint||b.plan_fingerprint!==i.plan.fingerprint||!same(b.directory,this.directoryIdentity))fail('OPERATION_CHANGED');
+  this.checkDirectory(b.directory);return {b,o};
+ }
+ inspect(operation_id){
+  const {b,o}=this.binding(operation_id),path=join(this.directory,b.nonce+'.json'),before=lstatSync(path,{bigint:true});
+  if(!before.isFile()||before.isSymbolicLink()||before.nlink!==1n||(before.mode&0o077n)!==0n||before.uid!==BigInt(process.getuid())||before.size<1n||before.size>16384n)fail('FILE_INVALID');
+  const fd=openSync(path,constants.O_RDONLY|constants.O_NOFOLLOW|constants.O_NONBLOCK);let data;
+  try{
+   if(stamp(fstatSync(fd,{bigint:true}))!==stamp(before))fail('FILE_CHANGED');
+   const bytes=Buffer.alloc(Number(before.size)+1);let n=0,k;while(n<bytes.length&&(k=readSync(fd,bytes,n,bytes.length-n,null))>0)n+=k;
+   if(n!==Number(before.size)||stamp(fstatSync(fd,{bigint:true}))!==stamp(before)||stamp(lstatSync(path,{bigint:true}))!==stamp(before))fail('FILE_CHANGED');data=bytes.subarray(0,n);
+  }finally{closeSync(fd);}
+  this.checkDirectory(b.directory);let r;try{r=JSON.parse(data.toString('utf8'));}catch{fail('FILE_INVALID');}
+  if(!r||Object.keys(r).sort().join(',')!=='binding_hash,boot_id,kind,operation_id,pid,report,schema,start_ticks'||r.schema!==1||r.kind!=='sealed-process-receipt-v1'||
+   r.binding_hash!==b.binding_hash||r.boot_id!==b.boot_id||r.operation_id!==operation_id||r.pid!==o.pid||!Number.isSafeInteger(r.pid)||r.pid<1||
+   typeof r.start_ticks!=='string'||!/^\d{1,30}$/.test(r.start_ticks)||!r.report||Object.keys(r.report).sort().join(',')!=='cause,code,drained,nonce,reaped,schema,signal,started')fail('REPORT_INVALID');
+  // Receipt has no stdout/stderr, argv, environment or credential paths.
+  const report=validateProcessReport(JSON.stringify({...r.report,stdout:''}),b.nonce,0,null);
+  const live=this.live(r.pid,r.start_ticks,r.boot_id);if(typeof live!=='boolean')fail('SUPERVISOR_UNKNOWN');
+  const proof={operation_id,action_id:b.action_id,epoch:b.epoch,binding_hash:b.binding_hash,receipt_sha256:digest(data.toString('utf8')),
+   state:live?'supervisor_live':'terminal_verified',code:report.code,signal:report.signal,cause:report.cause,started:report.started,reaped:report.reaped,grants_execution:false};
+  return {...proof,fingerprint:digest({...proof,file_stamp:stamp(before)})};
+ }
+ reconcile(operation_id,expectedFingerprint){
+  if(!sha(expectedFingerprint))fail('EVIDENCE_REQUIRED');
+  const {o}=this.binding(operation_id),row=this.j.fence(o.action_id,o.epoch,['needs_review']);
+  if(this.j.store.task(row.task_id).revision!==this.j.intent(row).task_revision)fail('TASK_REVISION_CHANGED');
+  const proof=this.inspect(operation_id);
+  if(proof.state!=='terminal_verified'||proof.fingerprint!==expectedFingerprint)fail('EVIDENCE_CHANGED');
+  this.j.closed(operation_id,{code:proof.code,signal:proof.signal,evidence:{kind:'sealed-process-receipt-v1',binding_hash:proof.binding_hash,receipt_sha256:proof.receipt_sha256}});
+  return {operation_id,state:'closed',task_released:false,retry_authorized:false};
+ }
+}

package/bundle/delivery-process.js

@@ -0,0 +1,46 @@
+// Private Linux supervisor client. Direct-child close alone does not close the
+// durable operation: require the nonce-bound ECHILD + pipe-drain report as well.
+import {spawn} from 'node:child_process';
+import {fileURLToPath} from 'node:url';
+import {randomBytes} from 'node:crypto';
+const fail=c=>Object.assign(Error('DELIVERY_PROCESS_'+c),{drained:false});
+const causes=new Set([null,'ABORTED','SPAWN_FAILED','ORPHANED_DESCENDANT','TIMEOUT','OUTPUT_LIMIT']);
+export function validateProcessReport(raw,nonce,exitCode,signal){
+ let r;try{r=JSON.parse(raw);}catch{throw fail('REPORT_INVALID');}
+ if(!r||Object.keys(r).sort().join(',')!=='cause,code,drained,nonce,reaped,schema,signal,started,stdout'||exitCode!==0||signal!==null||r.schema!==1||r.nonce!==nonce||r.drained!==true||typeof r.started!=='boolean'||
+  !Number.isSafeInteger(r.reaped)||r.reaped<(r.started?1:0)||!causes.has(r.cause)||
+  !(r.code===null||Number.isSafeInteger(r.code)&&r.code>=0&&r.code<=255)||
+  !(r.signal===null||typeof r.signal==='string'&&/^SIG[A-Z0-9]{1,24}$/.test(r.signal))||
+  (r.code===null&&r.signal===null&&r.started)||r.code!==null&&r.signal!==null||
+  typeof r.stdout!=='string'||r.stdout.length>1398104||Buffer.from(r.stdout,'base64').toString('base64')!==r.stdout)throw fail('DRAIN_UNKNOWN');
+ if(!r.started&&(r.code!==null||r.signal!==null||r.reaped!==0||r.stdout!==''||!['ABORTED','SPAWN_FAILED'].includes(r.cause)))throw fail('REPORT_INVALID');
+ return {...r,stdout:Buffer.from(r.stdout,'base64')};
+}
+export function runSupervised(argv,{cwd,env,timeout=20,limit=1048576,signal,onSpawn,onDrained,receipt}={},io={}){
+ if((io.platform??process.platform)!=='linux')return Promise.reject(fail('PLATFORM_UNSUPPORTED'));
+ if(signal?.aborted)return Promise.reject(Object.assign(fail('ABORTED'),{drained:true}));
+ const nonce=receipt?.nonce??randomBytes(32).toString('hex'),request=JSON.stringify({argv,cwd,env,timeout,limit,nonce,parent_pid:process.pid,...(receipt?{receipt}: {})});
+ if(request.length>131072)return Promise.reject(fail('INPUT_LIMIT'));
+ return new Promise((resolve,reject)=>{
+  let child,output='',invalid=false;
+  const abort=()=>{try{child.kill('SIGTERM');}catch{invalid=true;}};
+  try{
+   child=(io.spawn??spawn)('/usr/bin/python3',['-I','-B',fileURLToPath(new URL('./delivery-process.py',import.meta.url))],{
+    cwd,env:{PATH:'/usr/bin:/bin',LC_ALL:'C'},stdio:['pipe','pipe','pipe']});
+   child.stdout.on('data',b=>{if(output.length+b.length>1500000){invalid=true;abort();}else output+=b.toString('utf8');});
+   child.stderr.on('data',()=>{}); // Never log inherited diagnostics/credentials.
+   child.on('error',()=>{invalid=true;});child.stdin.on('error',()=>{invalid=true;});
+   child.once('close',(code,closedSignal)=>{
+    signal?.removeEventListener('abort',abort);
+    try{if(invalid)throw fail('DRAIN_UNKNOWN');const r=validateProcessReport(output,nonce,code,closedSignal);
+     onDrained?.({code:r.code,signal:r.signal,started:r.started,cause:r.cause,reaped:r.reaped});resolve(r);
+    }catch{reject(fail('DRAIN_UNKNOWN'));}
+   });
+   if(Number.isSafeInteger(child.pid))onSpawn?.({pid:child.pid});
+   signal?.addEventListener('abort',abort,{once:true});if(signal?.aborted)abort();
+   child.stdin.end(request);
+  }catch{
+   if(child){invalid=true;abort();}else reject(fail('START_FAILED'));
+  }
+ });
+}

package/bundle/delivery-process.py

@@ -0,0 +1,228 @@
+"""Private Linux child-tree supervisor. No shell, retries, or PID-disappearance proof.
+
+The parent journals the supervisor before use. Only this supervisor's ECHILD after
+waitpid reaping, plus closed output pipes, proves its managed descendants drained.
+An absent/invalid final report never proves drainage, even if this process exited.
+"""
+import base64
+import ctypes
+import hashlib
+import json
+import os
+import re
+import selectors
+import signal
+import stat
+import subprocess
+import sys
+import time
+
+
+def supervise(argv, cwd, env, timeout=20.0, limit=1048576, expected_parent=None):
+    if sys.platform != 'linux':
+        raise RuntimeError('PLATFORM_UNSUPPORTED')
+    libc = ctypes.CDLL(None, use_errno=True)
+    if libc.prctl(36, 1, 0, 0, 0) != 0:  # PR_SET_CHILD_SUBREAPER
+        raise RuntimeError('SUBREAPER_UNAVAILABLE')
+    enabled = ctypes.c_int()
+    if libc.prctl(37, ctypes.byref(enabled), 0, 0, 0) != 0 or enabled.value != 1:
+        raise RuntimeError('SUBREAPER_UNAVAILABLE')
+    stopping = [False]
+    signal.signal(signal.SIGTERM, lambda *_: stopping.__setitem__(0, True))
+    signal.signal(signal.SIGINT, lambda *_: stopping.__setitem__(0, True))
+    parent = os.getppid()
+    if libc.prctl(1, signal.SIGTERM, 0, 0, 0) != 0:  # PR_SET_PDEATHSIG
+        raise RuntimeError('PARENT_SIGNAL_UNAVAILABLE')
+    if os.getppid() != parent or expected_parent is not None and parent != expected_parent:
+        stopping[0] = True
+    if stopping[0]:
+        return dict(drained=True, started=False, code=None, signal=None, cause='ABORTED', stdout='', reaped=0)
+    child = None
+    pipes = selectors.DefaultSelector()
+    out, total, reaped, code, main_done = bytearray(), 0, 0, None, False
+    cause, kill_since = None, None
+    start = time.monotonic()
+    try:
+        try:
+            child = subprocess.Popen(argv, cwd=cwd, env=env, stdin=subprocess.DEVNULL,
+                                     stdout=subprocess.PIPE, stderr=subprocess.PIPE,
+                                     shell=False, start_new_session=True, close_fds=True)
+        except OSError:
+            return dict(drained=True, started=False, code=None, signal=None, cause='SPAWN_FAILED', stdout='', reaped=0)
+        for stream, label in [(child.stdout, 'out'), (child.stderr, 'err')]:
+            os.set_blocking(stream.fileno(), False)
+            pipes.register(stream, selectors.EVENT_READ, label)
+        while True:
+            empty = False
+            while True:
+                try:
+                    pid, status = os.waitpid(-1, os.WNOHANG)
+                except ChildProcessError:  # ECHILD, not kill(pid, 0) or /proc absence.
+                    empty = True
+                    break
+                if pid == 0:
+                    break
+                reaped += 1
+                if pid == child.pid:
+                    code = os.waitstatus_to_exitcode(status)
+                    child.returncode = code
+                    main_done = True
+                else:
+                    cause = cause or 'ORPHANED_DESCENDANT'
+            now = time.monotonic()
+            if stopping[0]:
+                cause = cause or 'ABORTED'
+            if now - start >= timeout:
+                cause = cause or 'TIMEOUT'
+            if main_done and not empty:
+                cause = cause or 'ORPHANED_DESCENDANT'
+            if cause and not empty:
+                kill_since = kill_since or now
+                # Only our unreaped direct/adopted children. Do not kill a cached
+                # process-group ID that could be reused after its leader was reaped.
+                try:
+                    with open(f'/proc/self/task/{os.getpid()}/children', encoding='ascii') as f:
+                        children = [int(x) for x in f.read().split()]
+                    for pid in children:
+                        try:
+                            os.kill(pid, signal.SIGKILL)
+                        except ProcessLookupError:
+                            pass
+                except OSError:
+                    cause = 'DRAIN_UNKNOWN'
+                    break
+                if now - kill_since > 5:
+                    cause = 'DRAIN_UNKNOWN'
+                    break
+            for key, _ in pipes.select(0.02):
+                try:
+                    data = os.read(key.fileobj.fileno(), 65536)
+                except BlockingIOError:
+                    continue
+                if not data:
+                    pipes.unregister(key.fileobj)
+                    key.fileobj.close()
+                    continue
+                total += len(data)
+                if total > limit:
+                    cause = cause or 'OUTPUT_LIMIT'
+                elif key.data == 'out':
+                    out.extend(data)
+            if empty and main_done and not pipes.get_map():
+                return dict(drained=True, started=True, code=code if code >= 0 else None,
+                            signal=signal.Signals(-code).name if code < 0 else None,
+                            cause=cause, stdout=base64.b64encode(out).decode('ascii'), reaped=reaped)
+            if now - start > timeout + 6:
+                cause = 'DRAIN_UNKNOWN'
+                break
+        return dict(drained=False, started=True, code=None, signal=None, cause='DRAIN_UNKNOWN', stdout='', reaped=reaped)
+    finally:
+        for key in list(pipes.get_map().values()):
+            key.fileobj.close()
+        pipes.close()
+
+
+def receipt_directory(binding, nonce):
+    keys = {'schema', 'operation_id', 'action_id', 'epoch', 'intent_fingerprint',
+            'plan_fingerprint', 'nonce', 'boot_id', 'directory', 'binding_hash'}
+    if not isinstance(binding, dict) or set(binding) != keys:
+        raise ValueError()
+    body = {k: v for k, v in binding.items() if k != 'binding_hash'}
+    encoded = json.dumps(body, sort_keys=True, ensure_ascii=False, separators=(',', ':')).encode()
+    directory = binding['directory']
+    if (binding['schema'] != 1 or binding['nonce'] != nonce or
+            not re.fullmatch(r'delivery-op-[a-f0-9-]{36}', binding['operation_id']) or
+            not re.fullmatch(r'delivery-[a-f0-9-]{36}', binding['action_id']) or
+            type(binding['epoch']) is not int or not 1 <= binding['epoch'] <= 9007199254740991 or
+            any(not isinstance(binding[k], str) or not re.fullmatch(r'[a-f0-9]{64}', binding[k])
+                for k in ['intent_fingerprint', 'plan_fingerprint', 'nonce', 'binding_hash']) or
+            hashlib.sha256(encoded).hexdigest() != binding['binding_hash'] or
+            not isinstance(directory, dict) or set(directory) != {'path', 'device', 'inode'} or
+            not isinstance(directory['path'], str) or not directory['path'].startswith('/') or
+            len(directory['path']) > 2048 or os.path.realpath(directory['path']) != directory['path']):
+        raise ValueError()
+    with open('/proc/sys/kernel/random/boot_id', encoding='ascii') as source:
+        if source.read().strip() != binding['boot_id']:
+            raise ValueError()
+    fd = os.open(directory['path'], os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW)
+    try:
+        current = os.fstat(fd)
+        if (not stat.S_ISDIR(current.st_mode) or current.st_mode & 0o077 or
+                current.st_uid != os.geteuid() or str(current.st_dev) != directory['device'] or
+                str(current.st_ino) != directory['inode']):
+            raise ValueError()
+        return fd
+    except Exception:
+        os.close(fd)
+        raise
+
+
+def seal_receipt(fd, binding, result):
+    # Called only after supervise returned ECHILD + closed descendant pipes.
+    # No child is ever started after this point. Publish once, without replacing
+    # any existing report; fsync bytes and directory before stdout acknowledgement.
+    if result['drained'] is not True:
+        return
+    with open('/proc/self/stat', encoding='ascii') as source:
+        start_ticks = source.read().rsplit(')', 1)[1].strip().split()[19]
+    report = {k: v for k, v in result.items() if k != 'stdout'}
+    data = json.dumps({'schema': 1, 'kind': 'sealed-process-receipt-v1',
+                       'operation_id': binding['operation_id'], 'binding_hash': binding['binding_hash'],
+                       'boot_id': binding['boot_id'], 'pid': os.getpid(), 'start_ticks': start_ticks,
+                       'report': {'schema': 1, 'nonce': binding['nonce'], **report}},
+                      sort_keys=True, separators=(',', ':')).encode()
+    if len(data) > 16384:
+        raise ValueError()
+    temporary, final = '.'+binding['nonce']+'.tmp', binding['nonce']+'.json'
+    output = os.open(temporary, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW, 0o600, dir_fd=fd)
+    try:
+        with os.fdopen(output, 'wb') as stream:
+            stream.write(data)
+            stream.flush()
+            os.fsync(stream.fileno())
+        os.link(temporary, final, src_dir_fd=fd, dst_dir_fd=fd, follow_symlinks=False)
+        os.unlink(temporary, dir_fd=fd)
+        os.fsync(fd)
+    except Exception:
+        # Retain an incomplete private file for diagnosis, never overwrite/adopt it.
+        raise
+
+
+def main():
+    # Private IPC only. The public plugin accepts opaque plans, never argv/env.
+    receipt_fd = None
+    try:
+        raw = sys.stdin.buffer.read(131073)
+        if len(raw) > 131072:
+            raise ValueError()
+        request = json.loads(raw)
+        keys = {'argv', 'cwd', 'env', 'timeout', 'limit', 'nonce', 'parent_pid'}
+        if set(request) not in (keys, keys | {'receipt'}):
+            raise ValueError()
+        argv, env = request['argv'], request['env']
+        if (not isinstance(argv, list) or not 1 <= len(argv) <= 100 or
+                any(not isinstance(x, str) or '\0' in x or len(x) > 8192 for x in argv) or
+                not argv[0].startswith('/') or not isinstance(env, dict) or len(env) > 100 or
+                any(not isinstance(k, str) or not isinstance(v, str) or '=' in k or '\0' in k+v for k, v in env.items()) or
+                not isinstance(request['cwd'], str) or not request['cwd'].startswith('/') or
+                not 0.05 <= request['timeout'] <= 60 or not 1 <= request['limit'] <= 1048576 or
+                not isinstance(request['parent_pid'], int) or request['parent_pid'] < 1 or
+                not isinstance(request['nonce'], str) or not re.fullmatch(r'[a-f0-9]{64}', request['nonce'])):
+            raise ValueError()
+        if 'receipt' in request:
+            receipt_fd = receipt_directory(request['receipt'], request['nonce'])
+        result = supervise(argv, request['cwd'], env, request['timeout'], request['limit'], request['parent_pid'])
+        if receipt_fd is not None:
+            seal_receipt(receipt_fd, request['receipt'], result)
+        print(json.dumps({'schema': 1, 'nonce': request['nonce'], **result}), flush=True)
+    except Exception:
+        # Never expose argv, keys, environment, Git stderr or exception strings.
+        print(json.dumps({'schema': 1, 'drained': False, 'cause': 'SUPERVISOR_FAILED'}), flush=True)
+        raise SystemExit(1)
+    finally:
+        if receipt_fd is not None:
+            os.close(receipt_fd)
+
+
+if __name__ == '__main__':
+    main()

package/bundle/delivery-push-approval.js

@@ -0,0 +1,89 @@
+// Separate push authority over a completed local commit. No Git/network effects.
+// Reuses the same ledger and trusted decision verifier; a commit approval never
+// authorizes push, and an old remote observation is not an execution preflight.
+import {randomUUID} from 'node:crypto';
+import {canonical,digest} from './approval-ledger.js';
+const fail=c=>{throw Error('DELIVERY_PUSH_APPROVAL_'+c);};
+const same=(a,b)=>canonical(a)===canonical(b);
+const proofHash=r=>digest({task_id:r.task_id,spec_revision:r.spec_revision,task_hash:r.task_hash,proposal:JSON.parse(r.proposal),repository_revision:r.repository_revision,expires:r.expires});
+export class DeliveryPushApproval {
+ constructor({commit,journal,enabled=false}){
+  this.commit=commit;this.j=journal;this.l=commit.l;this.db=this.l.db;this.enabled=enabled;
+  if(journal.db!==this.db)fail('DATABASE_MISMATCH');
+  this.db.exec(`CREATE TABLE IF NOT EXISTS delivery_push_plans(id TEXT PRIMARY KEY,event_id TEXT UNIQUE NOT NULL,
+   task_id TEXT NOT NULL,event_fingerprint TEXT NOT NULL,snapshot TEXT NOT NULL,created INTEGER NOT NULL);`);
+ }
+ source(task,action){
+  const r=this.j.row(action),i=this.j.intent(r),a=this.l.row(r.approval_id),p=JSON.parse(a.proposal),d=p.delivery;
+  if(r.task_id!==task||r.state!=='completed'||i.kind!=='commit-execution-intent-v1'||a.task_id!==task||
+   !same(p.scopes,['commit'])||d?.kind!=='commit-execution-v1'||proofHash(a)!==a.proposal_hash)fail('SOURCE_REQUIRED');
+  const s=this.commit.stored(task,d.plan_id,d.fingerprint);this.commit.current(s,a.spec_revision);
+  if(!same(this.commit.snapshot(s),d)||!same(s.intent,i)||!same(s.policy,p.model_policy)||!same(s.repository,p.repository)||
+   !this.l.repositories?.matches(task,a.repository_revision,p.repository)||p.repository?.provider!=='gitee'||
+   !Number.isSafeInteger(p.repository.repository_id)||p.repository.repository_id<1)fail('SOURCE_CHANGED');
+  return {row:r,intent:i,result:JSON.parse(r.result),repository:p.repository,policy:p.model_policy,approval_hash:a.proposal_hash};
+ }
+ stage({event_id,task_id,resource,workspace_identity,plan}){
+  if(this.enabled!==true)fail('DISABLED');
+  if(typeof event_id!=='string'||!event_id.trim()||event_id.length>256||/[\x00-\x1f\x7f]/.test(event_id))fail('INVALID_EVENT');
+  return this.l.store.tx(()=>{
+   const intent=this.j.prepare({task_id,resource,workspace_identity,plan}),event_fingerprint=digest(intent);
+   const old=this.db.prepare('SELECT * FROM delivery_push_plans WHERE event_id=?').get(event_id);
+   if(old){if(old.event_fingerprint!==event_fingerprint)fail('EVENT_CONFLICT');const s=this.stored(task_id,old.id,JSON.parse(old.snapshot).fingerprint);return {reference:this.reference(s),replayed:true,grants_execution:false};}
+   const source=this.source(task_id,plan.source_action_id),h=this.l.catalog.head(task_id);
+   if(h.legacy||this.l.store.task(task_id).blocked||source.repository.url!==resource||source.repository.repository_id!==plan.repository_id)fail('SOURCE_CHANGED');
+   this.j.readiness(intent); // A private, fresh, read-only preflight was primed before this transaction.
+   const body={schema:1,kind:'push-approval-plan-v1',id:'push-plan-'+randomUUID(),task_id,spec_revision:h.spec_revision,task_hash:digest(h.goal),
+    repository:structuredClone(source.repository),policy:structuredClone(source.policy),source_approval_hash:source.approval_hash,intent,created:this.l.now()};
+   const s={...body,fingerprint:digest(body)};
+   this.db.prepare('INSERT INTO delivery_push_plans VALUES (?,?,?,?,?,?)').run(s.id,event_id,task_id,event_fingerprint,canonical(s),s.created);
+   return {reference:this.reference(s),replayed:false,grants_execution:false};
+  });
+ }
+ reference(s){return {kind:'push-execution-reference-v1',plan_id:s.id,fingerprint:s.fingerprint};}
+ stored(task,id,fingerprint){
+  const row=this.db.prepare('SELECT * FROM delivery_push_plans WHERE id=?').get(id);if(!row||row.task_id!==task)fail('PLAN_NOT_FOUND');
+  const s=JSON.parse(row.snapshot),{fingerprint:hash,...body}=s;
+  if(s.id!==id||s.task_id!==task||s.kind!=='push-approval-plan-v1'||s.schema!==1||hash!==fingerprint||digest(body)!==hash)fail('PLAN_CHANGED');
+  if(!same(this.j.prepare(s.intent),s.intent))fail('SOURCE_CHANGED');return s;
+ }
+ current(s,revision){
+  const h=this.l.catalog.head(s.task_id),source=this.source(s.task_id,s.intent.plan.source_action_id);
+  if(h.spec_revision!==revision||s.spec_revision!==revision||digest(h.goal)!==s.task_hash||
+   !same(source.repository,s.repository)||!same(source.policy,s.policy)||source.approval_hash!==s.source_approval_hash)fail('SOURCE_CHANGED');
+ }
+ snapshot(s){
+  const p=s.intent.plan;
+  return {kind:'push-execution-v1',plan_id:s.id,fingerprint:s.fingerprint,intent_fingerprint:s.intent.fingerprint,plan_fingerprint:p.fingerprint,
+   source_action_id:p.source_action_id,source_approval_hash:s.source_approval_hash,task_revision:s.spec_revision,workspace_revision:s.intent.task_revision,
+   repository_id:p.repository_id,repository_url:p.url,repository_fingerprint:s.repository.fingerprint,workspace_branch:p.branch,ref:p.ref,
+   expected_remote_oid:p.expected_remote_oid,commit_oid:p.commit_oid,tree_oid:p.tree_oid,manifest_sha256:p.manifest_sha256,
+   tested_content:structuredClone(p.tested_content),prepared_at:s.created,execution:'requires_runtime_gate',max_pushes:1,
+   hooks:false,signed:false,rewrite:false,delete:false,tags:false,commit:false,publish:false,deploy:false};
+ }
+ approvalSnapshot(task,revision,reference,repository,policy){
+  if(reference.kind!=='push-execution-reference-v1')return this.commit.approvalSnapshot(task,revision,reference,repository,policy);
+  if(this.enabled!==true)fail('DISABLED');const s=this.stored(task,reference.plan_id,reference.fingerprint);this.current(s,revision);
+  if(!same(s.repository,repository)||!same(s.policy,policy))fail('BINDING_CHANGED');
+  // Human approval can arrive later. No network I/O or freshness renewal here;
+  // acquisition and transmission must obtain a new preflight for this exact baseline.
+  return this.snapshot(s);
+ }
+ matches(task,revision,plan){
+  if(plan?.kind!=='push-execution-v1')return this.commit.matches(task,revision,plan);
+  try{if(this.enabled!==true)return false;const s=this.stored(task,plan.plan_id,plan.fingerprint);this.current(s,revision);return same(this.snapshot(s),plan);}catch{return false;}
+ }
+ authorize(a){
+  if(a.intent?.kind!=='push-execution-intent-v1')return this.commit.authorize(a);
+  if(this.enabled!==true)fail('DISABLED');
+  return this.commit.readSnapshot(()=>{
+   const r=this.l.row(a.approval_id),v=this.l.view(r.id),p=v.proposal.delivery;
+   if(v.state!=='approved'||!same(v.proposal.scopes,['push'])||p?.kind!=='push-execution-v1'||proofHash(r)!==r.proposal_hash)fail('EXECUTION_APPROVAL_REQUIRED');
+   const s=this.stored(r.task_id,p.plan_id,p.fingerprint);
+   if(!same(s.intent,a.intent)||!same(s.policy,v.proposal.model_policy)||!same(s.repository,v.proposal.repository))fail('INTENT_CHANGED');
+   const proof=this.commit.decisionProof(r);
+   return {kind:'delivery-execution-v1',scope:'push',execution:true,approval_id:r.id,task_id:r.task_id,task_revision:a.intent.task_revision,
+    intent_fingerprint:a.intent.fingerprint,authority_hash:digest({approval_id:r.id,proposal_hash:r.proposal_hash,intent_fingerprint:a.intent.fingerprint,...proof})};
+  });
+ }
+}

package/bundle/delivery-push-plan.js

@@ -0,0 +1,98 @@
+import {managedTaskBranch} from './task-branch.js';
+// Internal push contract. No filesystem, process, credential or network access.
+// A verified local commit is evidence, never authority to update a remote ref.
+import {canonical,digest} from './approval-ledger.js';
+import {repositoryURL} from './repository-gitee.js';
+const fail=c=>{throw Error('DELIVERY_PUSH_'+c);};
+const same=(a,b)=>canonical(a)===canonical(b);
+const sha=x=>typeof x==='string'&&/^[a-f0-9]{64}$/.test(x);
+const oid=x=>typeof x==='string'&&/^[a-f0-9]{40}$/.test(x);
+const branch=managedTaskBranch;
+const action=x=>typeof x==='string'&&/^delivery-[a-f0-9-]{36}$/.test(x);
+const hashed=v=>{if(!v||typeof v!=='object'||Array.isArray(v))return false;const {fingerprint,...b}=v;return sha(fingerprint)&&digest(b)===fingerprint;};
+const fields=(v,keys)=>v&&typeof v==='object'&&!Array.isArray(v)&&Object.keys(v).sort().join(',')===keys.split(',').sort().join(',');
+const keys='schema,kind,source_action_id,source_intent_fingerprint,source_result_fingerprint,repository_id,url,format,branch,ref,commit_oid,parent_oid,tree_oid,manifest_sha256,tested_content,expected_remote_oid,max_pushes,rewrite,delete,tags,publish,deploy,grants_execution,fingerprint';
+export function validatePushPlan(p){
+ if(!fields(p,keys)||!hashed(p)||p.schema!==1||p.kind!=='push-commit-v1'||!action(p.source_action_id)||
+  !sha(p.source_intent_fingerprint)||!sha(p.source_result_fingerprint)||!Number.isSafeInteger(p.repository_id)||p.repository_id<1||
+  repositoryURL(p.url).url!==p.url||p.format!=='sha1'||!branch(p.branch)||p.ref!=='refs/heads/'+p.branch||
+  ![p.commit_oid,p.parent_oid,p.tree_oid].every(oid)||!sha(p.manifest_sha256)||
+  !(p.expected_remote_oid===null||oid(p.expected_remote_oid))||p.expected_remote_oid===p.commit_oid||
+  !fields(p.tested_content,'kind,sha256')||!['file_sha256','workspace_manifest_sha256'].includes(p.tested_content.kind)||!sha(p.tested_content.sha256)||
+  p.max_pushes!==1||[p.rewrite,p.delete,p.tags,p.publish,p.deploy,p.grants_execution].some(x=>x!==false))fail('PLAN_INVALID');
+ return p;
+}
+export function compilePush({source_action_id,commit_intent:i,commit_result:r,repository_id,expected_remote_oid}){
+ const p=i?.plan;
+ if(!action(source_action_id)||!hashed(i)||i.kind!=='commit-execution-intent-v1'||!hashed(p)||p.kind!=='commit-objects-v1'||
+  p.format!=='sha1'||p.persisted!==false||p.grants_execution!==false||r?.kind!=='commit-readback-v1'||r.drained!==true||
+  r.intent_fingerprint!==i.fingerprint||r.commit_oid!==p.computed_commit_oid||r.tree_oid!==p.tree_oid||r.branch!==p.branch||
+  r.manifest_sha256!==p.manifest_sha256||!same(r.tested_content,p.tested_content))fail('COMMIT_EVIDENCE_REQUIRED');
+ const body={schema:1,kind:'push-commit-v1',source_action_id,source_intent_fingerprint:i.fingerprint,source_result_fingerprint:digest(r),
+  repository_id,url:i.resource,format:p.format,branch:p.branch,ref:'refs/heads/'+p.branch,commit_oid:p.computed_commit_oid,
+  parent_oid:p.parent,tree_oid:p.tree_oid,manifest_sha256:p.manifest_sha256,tested_content:structuredClone(p.tested_content),
+  expected_remote_oid,max_pushes:1,rewrite:false,delete:false,tags:false,publish:false,deploy:false,grants_execution:false};
+ return validatePushPlan({...body,fingerprint:digest(body)});
+}
+export function pushIntent(store,{task_id,resource,workspace_identity,plan}){
+ validatePushPlan(plan);
+ const r=store.db.prepare('SELECT * FROM delivery_actions WHERE id=?').get(plan.source_action_id);
+ const i=r&&JSON.parse(r.intent),result=r?.result&&JSON.parse(r.result);
+ const e=r&&store.db.prepare("SELECT data FROM delivery_events WHERE action_id=? AND type='readback_completed' ORDER BY seq DESC LIMIT 1").get(r.id);
+ const proof=e&&JSON.parse(e.data);
+ if(!r||r.state!=='completed'||r.dispatched!==1||!Number.isSafeInteger(r.epoch)||r.task_id!==task_id||r.resource!==resource||
+  !hashed(i)||i.task_id!==task_id||i.resource!==resource||digest({event_id:r.event_id,approval_id:r.approval_id,intent:i})!==r.fingerprint||
+  proof?.epoch!==r.epoch||!same(proof.result,result)||store.db.prepare("SELECT 1 FROM delivery_operations WHERE action_id=? AND state<>'closed'").get(r.id)||
+  !same(compilePush({source_action_id:r.id,commit_intent:i,commit_result:result,repository_id:plan.repository_id,expected_remote_oid:plan.expected_remote_oid}),plan)||
+  !same(workspace_identity,i.workspace_identity)||resource!==plan.url||store.task(task_id).revision!==i.task_revision)fail('SOURCE_CHANGED');
+ const body={schema:1,kind:'push-execution-intent-v1',task_id,task_revision:i.task_revision,resource,
+  workspace_identity:structuredClone(workspace_identity),plan:structuredClone(plan)};
+ return validatePushIntent({...body,fingerprint:digest(body)});
+}
+export function validatePushIntent(i){
+ if(!fields(i,'schema,kind,task_id,task_revision,resource,workspace_identity,plan,fingerprint')||!hashed(i)||i.schema!==1||i.kind!=='push-execution-intent-v1'||
+  !Number.isSafeInteger(i.task_revision)||i.task_revision<0)fail('INTENT_INVALID');
+ validatePushPlan(i.plan);const w=i.workspace_identity;
+ if(i.resource!==i.plan.url||!fields(w,'root,url,branch,base_sha,directory,git_directory')||w.url!==i.resource||w.branch!==i.plan.branch||w.base_sha!==i.plan.parent_oid||
+  typeof w.root!=='string'||!w.root.startsWith('/')||w.root.length>2048||/[\x00-\x1f\x7f]/.test(w.root))fail('IDENTITY_INVALID');
+ for(const v of [w.directory,w.git_directory])if(!fields(v,'device,inode')||!/^\d{1,30}$/.test(v.device)||!/^\d{1,30}$/.test(v.inode))fail('IDENTITY_INVALID');
+ return i;
+}
+export function validatePushReadiness(i,r,now){
+ validatePushIntent(i);const p=i.plan,b=r?.baseline;
+ if(r?.kind!=='push-preflight-v1'||r.intent_fingerprint!==i.fingerprint||r.drained!==true||r.local_commit_verified!==true||
+  r.fast_forward_verified!==(p.expected_remote_oid!==null)||!Number.isSafeInteger(r.observed_at)||r.observed_at>now||now-r.observed_at>5000||
+  !fields(b,'kind,intent_fingerprint,workspace_identity,repository_id,url,ref,remote_oid,commit_oid,tree_oid,manifest_sha256,local_snapshot_sha256,fingerprint')||
+  !hashed(b)||b.kind!=='push-state-v1'||b.intent_fingerprint!==i.fingerprint||!same(b.workspace_identity,i.workspace_identity)||
+  b.repository_id!==p.repository_id||b.url!==p.url||b.ref!==p.ref||b.remote_oid!==p.expected_remote_oid||
+  b.commit_oid!==p.commit_oid||b.tree_oid!==p.tree_oid||b.manifest_sha256!==p.manifest_sha256||!sha(b.local_snapshot_sha256))fail('PREFLIGHT_REQUIRED');
+ return structuredClone(b);
+}
+export function pushReadback(i,proof,now){
+ validatePushIntent(i);const p=i.plan;
+ if(proof?.kind!=='push-readback-v1'||proof.intent_fingerprint!==i.fingerprint||proof.drained!==true||
+  !Number.isSafeInteger(proof.observed_at)||proof.observed_at>now||now-proof.observed_at>5000||
+  proof.repository_id!==p.repository_id||proof.url!==p.url||proof.ref!==p.ref||proof.ref_oid!==p.commit_oid||
+  !same(proof.workspace_identity,i.workspace_identity))fail('READBACK_MISMATCH');
+ return {kind:'push-readback-v1',intent_fingerprint:i.fingerprint,repository_id:p.repository_id,url:p.url,ref:p.ref,
+  commit_oid:p.commit_oid,expected_remote_oid:p.expected_remote_oid,drained:true,observed_at:proof.observed_at,
+  remote_acceptance:'ref_observed',runtime_adoption:'not_observed',publish:false,deploy:false};
+}
+// Command construction is not execution. The eventual transport must independently
+// check ancestry before invoking the CAS lease: --force-with-lease alone permits rewrites.
+export function pushCommand(p){
+ validatePushPlan(p);const r=repositoryURL(p.url);
+ return ['push','--porcelain','--no-verify','--no-follow-tags','--signed=false','--recurse-submodules=no',
+  '--force-with-lease='+p.ref+':'+(p.expected_remote_oid??''),'--','git@gitee.com:'+r.owner+'/'+r.repo+'.git',p.commit_oid+':'+p.ref];
+}
+export function remoteReadCommand(p){
+ validatePushPlan(p);const r=repositoryURL(p.url);
+ return ['ls-remote','--refs','--exit-code','--','git@gitee.com:'+r.owner+'/'+r.repo+'.git',p.ref];
+}
+export function parseRemoteRef(p,{code,stdout}){
+ validatePushPlan(p);
+ if(typeof stdout!=='string'||stdout.length>1024)fail('REMOTE_UNKNOWN');
+ if(code===2&&stdout==='')return null;
+ const m=/^([a-f0-9]{40})\t(refs\/heads\/[^\r\n]+)\n$/.exec(stdout);
+ if(code!==0||!m||m[2]!==p.ref)fail('REMOTE_UNKNOWN');return m[1];
+}

package/bundle/delivery-push-recovery.js

@@ -0,0 +1,32 @@
+// Operator-only reconciliation, never invoked by startup, model tools or a timer.
+// Sealed process evidence can close an operation, not release a task or prove push.
+const fail=c=>{throw Error('DELIVERY_PUSH_RECOVERY_'+c);};
+export class DeliveryPushRecovery {
+ constructor({journal,receipts,executor,quiescent=()=>false,enabled=false}){Object.assign(this,{j:journal,receipts,executor,quiescent,enabled});}
+ guard(id,epoch){
+  if(this.enabled!==true)fail('DISABLED');if(this.quiescent()!==true)fail('NOT_QUIESCENT');
+  const r=this.j.fence(id,epoch,['needs_review']),i=this.j.intent(r);
+  if(i.kind!=='push-execution-intent-v1'||!r.dispatched||this.j.store.task(r.task_id).revision!==i.task_revision)fail('ACTION_INVALID');return i;
+ }
+ inspect(id,epoch){
+  this.guard(id,epoch);
+  return {action_id:id,epoch,operations:this.j.db.prepare('SELECT id,state FROM delivery_operations WHERE action_id=? ORDER BY rowid').all(id).map(o=>{
+   try{return {...o,evidence:this.receipts.inspect(o.id)};}catch{return {...o,evidence:null,error:'PROCESS_RECEIPT_UNVERIFIED'};}
+  }),remote_checked_now:false,task_released:false,retry_authorized:false};
+ }
+ closeOperation(id,epoch,operation_id,fingerprint){
+  this.guard(id,epoch);const o=this.j.operation(operation_id);
+  if(o.action_id!==id||o.epoch!==epoch)fail('OPERATION_MISMATCH');
+  return this.receipts.reconcile(operation_id,fingerprint);
+ }
+ async settle(id,epoch,{signal}={}){
+  const i=this.guard(id,epoch);if(this.j.unfinished(id))fail('DRAIN_REQUIRED');
+  try{
+   await this.executor.readback(i,{signal});this.guard(id,epoch);
+   return {...this.j.finish(id,epoch),retry_authorized:false};
+  }catch{
+   // Retain uncertainty without acquiring a new generation or repeating a send.
+   this.guard(id,epoch);this.j.event(id,'remote_readback_failed',{epoch,error:'REMOTE_READBACK_UNVERIFIED'});return {action_id:id,state:'needs_review',error:'REMOTE_READBACK_UNVERIFIED',task_released:false,retry_authorized:false};
+  }
+ }
+}