@ouro.bot/cli 0.1.0-alpha.816 → 0.1.0-alpha.817

package/dist/heart/daemon/sanctuary-host-linux-kernel.js

@@ -0,0 +1,334 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LinuxSanctuaryHostSupervisorKernel = void 0;
+const node_child_process_1 = require("node:child_process");
+const node_crypto_1 = require("node:crypto");
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const runtime_1 = require("../../nerves/runtime");
+const OUTPUT_LIMIT = 64 * 1024;
+function requireRootOwnedProgram(filePath, links = new Set()) {
+    const parts = path.resolve(filePath).split("/").filter(Boolean);
+    let current = "/";
+    let stat = fs.lstatSync(current);
+    for (let index = 0; index < parts.length; index += 1) {
+        current = path.join(current, parts[index]);
+        stat = fs.lstatSync(current);
+        if (stat.uid !== 0)
+            throw new Error("Sanctuary host program path must be root-owned");
+        if (stat.isSymbolicLink()) {
+            if (links.has(current))
+                throw new Error("Sanctuary host program path has a symlink cycle");
+            links.add(current);
+            return requireRootOwnedProgram(path.resolve(path.dirname(current), fs.readlinkSync(current), ...parts.slice(index + 1)), links);
+        }
+        if ((stat.mode & 0o022) !== 0 || (index < parts.length - 1 && !stat.isDirectory())) {
+            throw new Error("Sanctuary host program path must be root-owned and non-writable by other users");
+        }
+    }
+    if (!stat.isFile() || (stat.mode & 0o111) === 0)
+        throw new Error("Sanctuary host program must be an executable regular file");
+}
+function sleep(milliseconds) {
+    return new Promise((resolve) => setTimeout(resolve, milliseconds));
+}
+function cgroupEmpty(cgroupPath) {
+    const events = fs.readFileSync(path.join(cgroupPath, "cgroup.events"), "utf8");
+    const populated = events.split("\n").find((line) => line.startsWith("populated "));
+    if (!populated)
+        throw new Error("Sanctuary host cgroup populated state is unavailable");
+    return populated === "populated 0";
+}
+function defaultProcessCgroup(pid) {
+    try {
+        return fs.readFileSync(`/proc/${pid}/cgroup`, "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+}
+function processInCgroup(value, cgroupPath) {
+    const relative = cgroupPath.startsWith("/sys/fs/cgroup")
+        ? cgroupPath.slice("/sys/fs/cgroup".length)
+        : cgroupPath;
+    return value.split("\n").some((line) => line.endsWith(`:${relative}`));
+}
+function fileDigest(filePath) {
+    const stat = fs.lstatSync(filePath);
+    if (!stat.isFile() || stat.isSymbolicLink())
+        throw new Error("Sanctuary host verification target is not a regular file");
+    const descriptor = fs.openSync(filePath, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+    const hash = (0, node_crypto_1.createHash)("sha256");
+    const buffer = Buffer.allocUnsafe(64 * 1024);
+    try {
+        let count;
+        do {
+            count = fs.readSync(descriptor, buffer, 0, buffer.length, null);
+            if (count > 0)
+                hash.update(buffer.subarray(0, count));
+        } while (count > 0);
+    }
+    finally {
+        fs.closeSync(descriptor);
+    }
+    return `sha256:${hash.digest("hex")}`;
+}
+function outputCollector(child, timeoutMs) {
+    let stdout = Buffer.alloc(0);
+    let stderr = Buffer.alloc(0);
+    let stdoutBytes = 0;
+    let stderrBytes = 0;
+    const stdoutHash = (0, node_crypto_1.createHash)("sha256");
+    const stderrHash = (0, node_crypto_1.createHash)("sha256");
+    let overflowed = false;
+    let settle;
+    let reject;
+    let settled = false;
+    const completion = new Promise((resolve, rejectPromise) => {
+        settle = resolve;
+        reject = rejectPromise;
+    });
+    let settleDrained;
+    let rejectDrained;
+    const drained = new Promise((resolve, rejectPromise) => {
+        settleDrained = resolve;
+        rejectDrained = rejectPromise;
+    });
+    const finish = (value) => {
+        if (settled)
+            return;
+        settled = true;
+        clearTimeout(deadline);
+        settle(value);
+    };
+    const append = (current, value) => {
+        const remaining = Math.max(0, OUTPUT_LIMIT - current.length);
+        const next = remaining > 0 ? Buffer.concat([current, value.subarray(0, remaining)]) : current;
+        return { bytes: next, overflow: value.length > remaining };
+    };
+    const finishOverflow = () => {
+        if (overflowed)
+            return;
+        overflowed = true;
+        finish({
+            exitCode: null,
+            signal: null,
+            stdout: stdout.toString("utf8"),
+            stderr: stderr.toString("utf8"),
+            outputOverflow: true,
+            migrationSuspected: false,
+            deadlineExpired: false,
+        });
+    };
+    child.stdout?.on("data", (value) => {
+        stdoutHash.update(value);
+        stdoutBytes += value.length;
+        const next = append(stdout, value);
+        stdout = next.bytes;
+        if (next.overflow)
+            finishOverflow();
+    });
+    child.stderr?.on("data", (value) => {
+        stderrHash.update(value);
+        stderrBytes += value.length;
+        const next = append(stderr, value);
+        stderr = next.bytes;
+        if (next.overflow)
+            finishOverflow();
+    });
+    const deadline = setTimeout(() => finish({
+        exitCode: null,
+        signal: null,
+        stdout: stdout.toString("utf8"),
+        stderr: stderr.toString("utf8"),
+        outputOverflow: overflowed,
+        migrationSuspected: false,
+        deadlineExpired: true,
+    }), timeoutMs);
+    deadline.unref();
+    child.once("error", (error) => {
+        if (settled)
+            return;
+        settled = true;
+        clearTimeout(deadline);
+        reject(error);
+        rejectDrained(error);
+    });
+    child.once("close", (exitCode, signal) => {
+        finish({
+            exitCode,
+            signal,
+            stdout: stdout.toString("utf8"),
+            stderr: stderr.toString("utf8"),
+            outputOverflow: overflowed,
+            migrationSuspected: false,
+            deadlineExpired: false,
+        });
+        settleDrained({
+            stdout: stdout.toString("utf8"),
+            stderr: stderr.toString("utf8"),
+            stdoutDigest: `sha256:${stdoutHash.digest("hex")}`,
+            stderrDigest: `sha256:${stderrHash.digest("hex")}`,
+            stdoutBytes,
+            stderrBytes,
+        });
+    });
+    return { completion, drained };
+}
+class LinuxSanctuaryHostSupervisorKernel {
+    #options;
+    constructor(options) {
+        for (const value of [options.cgroupRoot, options.shellPath, options.launcherPath, options.prlimitPath, options.setsidPath]) {
+            if (!path.isAbsolute(value))
+                throw new Error("Sanctuary host Linux kernel paths must be absolute");
+        }
+        this.#options = options;
+    }
+    async prepareCgroup(permitId, limits) {
+        const cgroupPath = path.join(this.#options.cgroupRoot, permitId);
+        fs.mkdirSync(cgroupPath, { recursive: false, mode: 0o700 });
+        fs.writeFileSync(path.join(cgroupPath, "cpu.max"), limits.cpuMax, "utf8");
+        fs.writeFileSync(path.join(cgroupPath, "memory.max"), limits.memoryMax, "utf8");
+        fs.writeFileSync(path.join(cgroupPath, "pids.max"), limits.pidsMax, "utf8");
+        return cgroupPath;
+    }
+    async launch(input) {
+        requireRootOwnedProgram(input.executable);
+        const spawnImpl = this.#options.spawn ?? node_child_process_1.spawn;
+        const child = spawnImpl(this.#options.shellPath, [
+            this.#options.launcherPath,
+            path.join(input.cgroupPath, "cgroup.procs"),
+            this.#options.prlimitPath,
+            this.#options.setsidPath,
+            input.executable,
+            ...input.arguments,
+        ], {
+            cwd: input.cwd,
+            env: input.environment,
+            detached: false,
+            stdio: ["ignore", "pipe", "pipe", "pipe"],
+        });
+        if (!child.pid || !child.stdio[3])
+            throw new Error("Sanctuary host launcher failed to start");
+        (0, runtime_1.emitNervesEvent)({ component: "daemon", event: "daemon.sanctuary_host_launcher_spawned", message: "Sanctuary host launcher spawned; handshake pending" });
+        const handshake = child.stdio[3];
+        const ready = new Promise((resolve, reject) => {
+            let bytes = "";
+            handshake.setEncoding("utf8");
+            handshake.on("data", (value) => { bytes += value; });
+            handshake.once("error", reject);
+            handshake.once("close", () => {
+                if (bytes === "ready\n")
+                    resolve();
+                else
+                    reject(new Error("Sanctuary host launcher handshake is invalid"));
+            });
+        });
+        const { completion, drained } = outputCollector(child, input.timeoutMs);
+        const processCgroup = this.#options.processCgroup ?? defaultProcessCgroup;
+        let migrationSuspected = false;
+        const inspectCgroup = () => {
+            try {
+                const cgroup = processCgroup(child.pid);
+                if (cgroup !== null && !processInCgroup(cgroup, input.cgroupPath))
+                    migrationSuspected = true;
+            }
+            catch {
+                migrationSuspected = true;
+            }
+        };
+        inspectCgroup();
+        const migrationMonitor = setInterval(inspectCgroup, this.#options.pollIntervalMs ?? 25);
+        migrationMonitor.unref();
+        const observedCompletion = completion.then((value) => {
+            inspectCgroup();
+            return {
+                ...value,
+                migrationSuspected,
+            };
+        }).finally(() => clearInterval(migrationMonitor));
+        return {
+            pid: child.pid,
+            bootId: this.#options.bootId?.() ?? fs.readFileSync("/proc/sys/kernel/random/boot_id", "utf8").trim(),
+            processStartTime: this.#options.processStartTime?.(child.pid)
+                ?? fs.readFileSync(`/proc/${child.pid}/stat`, "utf8").trim().split(" ")[21]
+                ?? "",
+            ready,
+            completion: observedCompletion,
+            drained,
+            signalGroup: (signal) => {
+                try {
+                    (this.#options.kill ?? process.kill)(-child.pid, signal);
+                }
+                catch (error) {
+                    if (error.code !== "ESRCH")
+                        throw error;
+                }
+            },
+        };
+    }
+    async waitForCgroupEmpty(cgroupPath, timeoutMs) {
+        const interval = this.#options.pollIntervalMs ?? 25;
+        const attempts = Math.max(1, Math.ceil(timeoutMs / interval));
+        for (let index = 0; index < attempts; index += 1) {
+            if (cgroupEmpty(cgroupPath))
+                return true;
+            await (this.#options.sleep ?? sleep)(interval);
+        }
+        return false;
+    }
+    async killCgroup(cgroupPath) {
+        fs.writeFileSync(path.join(cgroupPath, "cgroup.kill"), "1", "utf8");
+    }
+    async removeCgroup(cgroupPath) {
+        fs.rmdirSync(cgroupPath);
+    }
+    async sleep(milliseconds) {
+        await (this.#options.sleep ?? sleep)(milliseconds);
+    }
+    now() {
+        return this.#options.now?.() ?? new Date().toISOString();
+    }
+    async verify(request, phase, permit) {
+        if (request.profile !== "file.digest.v1")
+            throw new Error("Sanctuary host verification profile is unsupported");
+        const digest = fileDigest(permit.targetResource);
+        return phase === "before" ? { digest } : { matches: digest === request.expectedStateDigest, digest };
+    }
+}
+exports.LinuxSanctuaryHostSupervisorKernel = LinuxSanctuaryHostSupervisorKernel;

package/dist/heart/daemon/sanctuary-host-supervisor-entry.js

@@ -0,0 +1,207 @@
+#!/usr/bin/env node
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runSanctuaryHostSupervisor = runSanctuaryHostSupervisor;
+exports.runSanctuaryHostSupervisorCli = runSanctuaryHostSupervisorCli;
+const node_crypto_1 = require("node:crypto");
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const runtime_1 = require("../../nerves/runtime");
+const sanctuary_authority_codec_1 = require("./sanctuary-authority-codec");
+const sanctuary_host_linux_kernel_1 = require("./sanctuary-host-linux-kernel");
+const sanctuary_host_supervisor_1 = require("./sanctuary-host-supervisor");
+const DIGEST = /^sha256:[a-f0-9]{64}$/u;
+function digest(bytes) {
+    return `sha256:${(0, node_crypto_1.createHash)("sha256").update(bytes).digest("hex")}`;
+}
+function readPrivateSpec(specPath, expectedUid) {
+    if (!path.isAbsolute(specPath))
+        throw new Error("Sanctuary host supervisor spec path must be absolute");
+    const stat = fs.lstatSync(specPath);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.uid !== expectedUid || (stat.mode & 0o777) !== 0o600) {
+        throw new Error("Sanctuary host supervisor spec metadata is invalid");
+    }
+    const descriptor = fs.openSync(specPath, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+    try {
+        const bytes = fs.readFileSync(descriptor, "utf8");
+        const spec = JSON.parse(bytes);
+        if (spec.schemaVersion !== 1
+            || spec.permitId !== spec.permitArtifact?.payload?.permitId
+            || !Array.isArray(spec.arguments)
+            || spec.cwd !== "/"
+            || !Number.isSafeInteger(spec.timeoutMs)
+            || spec.timeoutMs < 1_000
+            || spec.timeoutMs > 900_000) {
+            throw new Error("Sanctuary host supervisor spec is invalid");
+        }
+        return { bytes, spec };
+    }
+    finally {
+        fs.closeSync(descriptor);
+    }
+}
+function assertDigest(filePath, expectedDigest, expectedUid, kind = "executable") {
+    const actual = kind === "system" ? fs.realpathSync(filePath) : filePath;
+    const stat = fs.lstatSync(actual);
+    if (!DIGEST.test(expectedDigest)
+        || !stat.isFile()
+        || stat.isSymbolicLink()
+        || stat.uid !== expectedUid
+        || (kind !== "source" && (stat.mode & 0o111) === 0)
+        || (stat.mode & 0o022) !== 0) {
+        throw new Error(`Sanctuary host supervisor primitive metadata is invalid: ${filePath}`);
+    }
+    const descriptor = fs.openSync(actual, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+    try {
+        if (digest(fs.readFileSync(descriptor)) === expectedDigest)
+            return;
+    }
+    finally {
+        fs.closeSync(descriptor);
+    }
+    {
+        throw new Error(`Sanctuary host supervisor primitive digest changed: ${filePath}`);
+    }
+}
+function writePrivateJson(filePath, value) {
+    fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });
+    fs.chmodSync(path.dirname(filePath), 0o700);
+    const temporaryPath = `${filePath}.${process.pid}.tmp`;
+    const descriptor = fs.openSync(temporaryPath, fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_WRONLY | fs.constants.O_NOFOLLOW, 0o600);
+    try {
+        fs.writeFileSync(descriptor, `${JSON.stringify(value)}\n`, "utf8");
+        fs.fsyncSync(descriptor);
+    }
+    finally {
+        fs.closeSync(descriptor);
+    }
+    fs.renameSync(temporaryPath, filePath);
+    (0, runtime_1.emitNervesEvent)({ component: "daemon", event: "daemon.sanctuary_host_supervisor_state_written", message: "Sanctuary host supervisor state atomically written" });
+    fs.chmodSync(filePath, 0o600);
+}
+async function waitForStart(filePath, permitId, specDigest) {
+    for (let attempt = 0; attempt < 200; attempt += 1) {
+        if (fs.existsSync(filePath)) {
+            const value = JSON.parse(fs.readFileSync(filePath, "utf8"));
+            if (value.schemaVersion !== 1 || value.permitId !== permitId || value.specDigest !== specDigest) {
+                throw new Error("Sanctuary host supervisor start gate is invalid");
+            }
+            return;
+        }
+        await new Promise((resolve) => setTimeout(resolve, 25));
+    }
+    throw new Error("Sanctuary host supervisor start gate timed out");
+}
+async function runSanctuaryHostSupervisor(specPath, options = {}) {
+    const expectedUid = options.expectedUid ?? 0;
+    if ((options.getuid ?? process.getuid)() !== expectedUid)
+        throw new Error("Sanctuary host supervisor must run as root");
+    const { bytes, spec } = readPrivateSpec(specPath, expectedUid);
+    const publicKey = (0, node_crypto_1.createPublicKey)(spec.publicKeyPem);
+    const permit = (0, sanctuary_authority_codec_1.verifyAuthorityPayload)({
+        artifact: spec.permitArtifact,
+        expectedDomain: "ouro.sanctuary.host-permit.v1",
+        expectedKeyId: spec.keyId,
+        publicKey,
+    });
+    const publicKeyDigest = `sha256:${(0, node_crypto_1.createHash)("sha256").update(publicKey.export({ type: "spki", format: "der" })).digest("hex")}`;
+    if (publicKeyDigest !== permit.publicKeyDigest) {
+        throw new Error("Sanctuary host supervisor permit key digest changed");
+    }
+    assertDigest(spec.launcherPath, spec.launcherDigest, expectedUid);
+    assertDigest(spec.prlimitPath, spec.prlimitDigest, expectedUid, "system");
+    assertDigest(spec.setsidPath, spec.setsidDigest, expectedUid, "system");
+    assertDigest(spec.shellPath, spec.shellDigest, expectedUid, "system");
+    assertDigest(spec.supervisorProgramPath, spec.supervisorProgramDigest, expectedUid, "source");
+    const specDigest = digest(bytes);
+    const processId = options.processId ?? process.pid;
+    const bootId = options.bootId?.() ?? fs.readFileSync("/proc/sys/kernel/random/boot_id", "utf8").trim();
+    const processStartTime = options.processStartTime?.(processId)
+        ?? fs.readFileSync(`/proc/${processId}/stat`, "utf8").trim().split(" ")[21]
+        ?? "";
+    const binding = {
+        schemaVersion: 1,
+        permitId: spec.permitId,
+        specDigest,
+        supervisorPid: processId,
+        bootId,
+        processStartTime,
+    };
+    await waitForStart(spec.startPath, spec.permitId, specDigest);
+    const lock = fs.openSync(spec.lockPath, fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_WRONLY | fs.constants.O_NOFOLLOW, 0o600);
+    try {
+        fs.writeFileSync(lock, `${JSON.stringify({ schemaVersion: 1, permitId: spec.permitId, supervisorPid: processId })}\n`, "utf8");
+        fs.fsyncSync(lock);
+        writePrivateJson(spec.readyPath, binding);
+        const kernel = options.kernel ?? new sanctuary_host_linux_kernel_1.LinuxSanctuaryHostSupervisorKernel({
+            cgroupRoot: spec.cgroupRoot,
+            shellPath: spec.shellPath,
+            launcherPath: spec.launcherPath,
+            prlimitPath: spec.prlimitPath,
+            setsidPath: spec.setsidPath,
+        });
+        const supervisor = new sanctuary_host_supervisor_1.KernelSanctuaryHostSupervisor(kernel);
+        const attempt = await supervisor.execute({
+            permit,
+            permitArtifact: spec.permitArtifact,
+            executable: spec.executable,
+            arguments: spec.arguments,
+            cwd: spec.cwd,
+            environment: spec.environment,
+            timeoutMs: spec.timeoutMs,
+        });
+        writePrivateJson(spec.terminalPath, { ...binding, attempt });
+        return attempt;
+    }
+    finally {
+        fs.closeSync(lock);
+        fs.rmSync(spec.lockPath, { force: true });
+    }
+}
+async function runSanctuaryHostSupervisorCli(argv = process.argv, run = runSanctuaryHostSupervisor) {
+    const index = argv.indexOf("--spec");
+    const specPath = index >= 0 ? argv[index + 1] : undefined;
+    if (!specPath)
+        throw new Error("Sanctuary host supervisor requires --spec");
+    await run(specPath);
+}
+/* v8 ignore next 6 -- executable guard delegates to the tested CLI runner @preserve */
+if (require.main === module) {
+    void runSanctuaryHostSupervisorCli().catch((error) => {
+        process.stderr.write(`${error instanceof Error ? error.message : "Sanctuary host supervisor failed"}\n`);
+        process.exitCode = 1;
+    });
+}

package/dist/heart/daemon/sanctuary-host-supervisor.js

@@ -0,0 +1,95 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KernelSanctuaryHostSupervisor = void 0;
+const runtime_1 = require("../../nerves/runtime");
+class KernelSanctuaryHostSupervisor {
+    #kernel;
+    #active = false;
+    constructor(kernel) {
+        this.#kernel = kernel;
+    }
+    async execute(input) {
+        if (this.#active)
+            throw new Error("Sanctuary host supervisor is already active");
+        this.#active = true;
+        const startedAt = this.#kernel.now();
+        const deadline = Date.parse(startedAt) + input.timeoutMs;
+        let cgroupPath = null;
+        try {
+            const verificationBefore = input.permit.verification
+                ? await this.#kernel.verify(input.permit.verification, "before", input.permit)
+                : null;
+            cgroupPath = await this.#kernel.prepareCgroup(input.permit.permitId, {
+                cpuMax: "50000 100000",
+                memoryMax: "1073741824",
+                pidsMax: "256",
+            });
+            const child = await this.#kernel.launch({ permit: input.permit, executable: input.executable, arguments: input.arguments, cwd: input.cwd, environment: input.environment, timeoutMs: input.timeoutMs, cgroupPath });
+            await child.ready;
+            const completion = await child.completion;
+            let timedOut = completion.deadlineExpired === true;
+            const remainingMs = Math.max(0, deadline - Date.parse(this.#kernel.now()));
+            let cleanupEmpty = !timedOut && await this.#kernel.waitForCgroupEmpty(cgroupPath, remainingMs);
+            if (!cleanupEmpty || completion.outputOverflow) {
+                timedOut = timedOut || !completion.outputOverflow;
+                await child.signalGroup("SIGTERM");
+                await this.#kernel.sleep(10_000);
+                await this.#kernel.killCgroup(cgroupPath);
+                cleanupEmpty = await this.#kernel.waitForCgroupEmpty(cgroupPath, 10_000);
+            }
+            if (cleanupEmpty)
+                await this.#kernel.removeCgroup(cgroupPath);
+            if (!cleanupEmpty)
+                throw new Error("Sanctuary host output drain cannot be proven");
+            const output = await Promise.race([
+                child.drained,
+                this.#kernel.sleep(10_000).then(() => {
+                    throw new Error("Sanctuary host output drain timed out");
+                }),
+            ]);
+            const verificationAfter = input.permit.verification
+                ? await this.#kernel.verify(input.permit.verification, "after", input.permit)
+                : null;
+            (0, runtime_1.emitNervesEvent)({ component: "daemon", event: "daemon.sanctuary_host_cleanup_observed", message: "Sanctuary host cgroup cleanup and output drain observed", meta: { timedOut, outputOverflow: completion.outputOverflow } });
+            return {
+                startedAt,
+                completedAt: this.#kernel.now(),
+                exitCode: completion.exitCode,
+                signal: completion.signal,
+                timedOut,
+                cancelled: false,
+                outputOverflow: completion.outputOverflow,
+                stdout: output.stdout,
+                stderr: output.stderr,
+                stdoutDigest: output.stdoutDigest,
+                stderrDigest: output.stderrDigest,
+                stdoutBytes: output.stdoutBytes,
+                stderrBytes: output.stderrBytes,
+                cleanup: "cgroup_empty",
+                containment: completion.migrationSuspected
+                    ? "unprovable_after_approved_root_migration"
+                    : "approved_root_may_escape",
+                verificationBefore,
+                verificationAfter,
+            };
+        }
+        catch (error) {
+            if (cgroupPath) {
+                try {
+                    await this.#kernel.killCgroup(cgroupPath);
+                    if (await this.#kernel.waitForCgroupEmpty(cgroupPath, 10_000)) {
+                        await this.#kernel.removeCgroup(cgroupPath);
+                    }
+                }
+                catch {
+                    // The caller records the failed dependency while startup reconciliation owns uncertain cgroup state.
+                }
+            }
+            throw error;
+        }
+        finally {
+            this.#active = false;
+        }
+    }
+}
+exports.KernelSanctuaryHostSupervisor = KernelSanctuaryHostSupervisor;