@moondeck/station 0.0.1 → 1.0.1

package/lib/task-machine-credentials-activation.ts

@@ -0,0 +1,95 @@
+/**
+ * Fresh-incarnation proof for the task-machine cloud-credential cutover.
+ *
+ * Owned runners retire their legacy task runtimes during activation. A Uai
+ * Cloud sidecar cannot use that planner: its task environment is the machine
+ * itself, which deliberately has no removable local container runtime. The
+ * cloud therefore marks an incarnation v1-required when it is launched. The
+ * sidecar may activate only before that incarnation has ever admitted a task,
+ * with no task process beside the runner and with Files-v1's local safety
+ * boundary fully installed. The proof is checked once before local commit and
+ * again after the v0 lease/store work has drained.
+ */
+
+import { TASK_MACHINE_CREDENTIALS_V1_ENV } from "../src/cloud-credentials";
+
+export interface TaskMachineCredentialsActivationPlan {
+  readonly kind: "fresh-task-machine";
+  readonly taskId: string;
+  readonly machineBootId: string;
+}
+
+export interface TaskMachineCredentialsActivationDeps {
+  required(): boolean;
+  taskId(): string | null;
+  machineBootId(): string;
+  filesReady(): boolean;
+  retirementReady(): boolean;
+  taskRows(): readonly { taskId: string }[];
+  /** Processes in the sidecar's service cgroup that this runner did not
+   *  start (its own helpers, such as tsx's esbuild service, never count). */
+  peerProcessIds(): readonly number[];
+}
+
+/** Exact opt-in from root-owned task-machine launch state. */
+export function taskMachineCredentialsV1Required(
+  environment: NodeJS.ProcessEnv = process.env,
+): boolean {
+  return environment[TASK_MACHINE_CREDENTIALS_V1_ENV] === "1";
+}
+
+export function planFreshTaskMachineCredentialsActivation(
+  deps: TaskMachineCredentialsActivationDeps,
+): TaskMachineCredentialsActivationPlan {
+  if (!deps.required()) {
+    throw new Error("this task-machine incarnation is not v1-required");
+  }
+  const taskId = deps.taskId();
+  if (taskId === null) {
+    throw new Error("the v1 task machine has no exact task assignment");
+  }
+  if (!deps.filesReady()) {
+    throw new Error("the v1 task machine cannot install its Files session");
+  }
+  if (!deps.retirementReady()) {
+    throw new Error("the v1 task machine cannot durably retire itself");
+  }
+  const rows = deps.taskRows();
+  if (rows.length > 0) {
+    throw new Error(
+      `the v1 task-machine incarnation is not fresh: it already has task state for ${rows
+        .map((row) => row.taskId)
+        .join(", ")}`,
+    );
+  }
+  const peers = deps.peerProcessIds();
+  if (peers.length > 0) {
+    throw new Error(
+      `the v1 task-machine incarnation is not quiescent: process ${peers.join(", ")} is still in its service cgroup`,
+    );
+  }
+  return {
+    kind: "fresh-task-machine",
+    taskId,
+    machineBootId: deps.machineBootId(),
+  };
+}
+
+/**
+ * Re-prove the same incarnation after local commit and after all v0 work has
+ * drained. Nothing may have slipped between the first proof and that drain.
+ */
+export function verifyFreshTaskMachineCredentialsActivation(
+  plan: TaskMachineCredentialsActivationPlan,
+  deps: TaskMachineCredentialsActivationDeps,
+): void {
+  const current = planFreshTaskMachineCredentialsActivation(deps);
+  if (
+    current.taskId !== plan.taskId ||
+    current.machineBootId !== plan.machineBootId
+  ) {
+    throw new Error(
+      "the v1 task-machine incarnation changed during credential activation",
+    );
+  }
+}