@runuai/host 0.9.13 → 0.9.42

package/lib/release-trust.ts

@@ -0,0 +1,28 @@
+import type { PinnedReleaseManifestKey } from "./release-manifest";
+
+/**
+ * Stable manifest location for the public, release-artifact-only feed.
+ *
+ * The release coordinator provisions the first production key in this map in
+ * the same reviewed change that enables publishing. Keeping the empty map in
+ * source makes an unprovisioned updater fail closed; no network-provided key
+ * or environment variable can become a trust anchor.
+ */
+export const STABLE_RELEASE_MANIFEST_URL =
+  "https://github.com/runuai/uai-host-releases/releases/latest/download/host-runtime-manifest.json";
+
+/**
+ * Deliberate public-release latch for ADR-099.
+ *
+ * Provisioning a key is necessary but not sufficient to advertise or serve
+ * the one-line installer. The release coordinator flips this only in the same
+ * reviewed change that publishes the complete, version-matched four-platform
+ * release. Keeping it false while this stack is under review makes accidental
+ * key/feed provisioning fail closed.
+ */
+export const HOST_INSTALLER_RELEASE_PROMOTED = false;
+
+export const PINNED_RELEASE_MANIFEST_KEYS: ReadonlyMap<
+  string,
+  PinnedReleaseManifestKey
+> = new Map();

package/lib/runtime-activation-tail.ts

@@ -0,0 +1,232 @@
+export type RuntimeActivationAttemptResult = "complete" | "retry";
+
+type ActivationAttempt = () => Promise<RuntimeActivationAttemptResult>;
+type RetrySchedule = (callback: () => void, delayMs: number) => () => void;
+
+interface RuntimeRecoveryGateOptions {
+  isCurrent(): boolean;
+  recover(isCurrent: () => boolean): Promise<boolean>;
+  runtimeReady(): Promise<boolean>;
+  afterRecovery(): Promise<void>;
+}
+
+/** Keep the operational publication path strictly behind a true recovery
+ * verdict. A false verdict probes the daemon only to choose between normal
+ * no-runtime handling and a post-tail retry; it never calls `afterRecovery`. */
+export async function runRuntimeRecoveryGate(
+  options: RuntimeRecoveryGateOptions,
+): Promise<RuntimeActivationAttemptResult> {
+  const recovered = await options.recover(options.isCurrent);
+  if (!options.isCurrent()) return "complete";
+  if (!recovered) {
+    const ready = await options.runtimeReady();
+    return ready && options.isCurrent() ? "retry" : "complete";
+  }
+  await options.afterRecovery();
+  return "complete";
+}
+
+export type RuntimeMaintenanceVerdict = "ready" | "retry" | "stale";
+
+interface MaintainedRuntimeActivationOptions {
+  isCurrent(): boolean;
+  /** One-way rolling fence before the first shared-volume writer. */
+  beforeMaintenance(): Promise<RuntimeMaintenanceVerdict>;
+  maintenance(): Promise<RuntimeMaintenanceVerdict>;
+  recover(isCurrent: () => boolean): Promise<boolean>;
+  runtimeReady(): Promise<boolean>;
+  afterRecoveryBeforeFinalMaintenance(): Promise<void>;
+  publishOperational(): Promise<void>;
+}
+
+/**
+ * Keep both standard-image/shared-volume maintenance passes on the same side
+ * of the recovery and operational-publication fences. A live daemon plus a
+ * transient maintenance failure requests the activation tail's bounded retry;
+ * a stale daemon generation simply completes and lets its readiness edge own
+ * the next attempt.
+ */
+export async function runMaintainedRuntimeActivation(
+  options: MaintainedRuntimeActivationOptions,
+): Promise<RuntimeActivationAttemptResult> {
+  if (!options.isCurrent()) return "complete";
+  const prepared = await options.beforeMaintenance();
+  if (prepared !== "ready") {
+    return prepared === "retry" ? "retry" : "complete";
+  }
+  if (!options.isCurrent()) return "complete";
+  const initial = await options.maintenance();
+  if (initial !== "ready") {
+    return initial === "retry" ? "retry" : "complete";
+  }
+
+  let retryAfterRecovery = false;
+  const recoveryResult = await runRuntimeRecoveryGate({
+    isCurrent: options.isCurrent,
+    recover: options.recover,
+    runtimeReady: options.runtimeReady,
+    afterRecovery: async () => {
+      await options.afterRecoveryBeforeFinalMaintenance();
+      if (!options.isCurrent()) return;
+      const final = await options.maintenance();
+      if (final !== "ready") {
+        retryAfterRecovery = final === "retry";
+        return;
+      }
+      await options.publishOperational();
+    },
+  });
+  return retryAfterRecovery ? "retry" : recoveryResult;
+}
+
+interface RuntimeActivationTailOptions {
+  isCurrent(epoch: number): boolean;
+  retryDelayMs?: number;
+  maxRetries?: number;
+  schedule?: RetrySchedule;
+  onError?(error: unknown): void;
+  onExhausted?(epoch: number, attempts: number): void;
+}
+
+interface ActivationInFlight {
+  epoch: number;
+  promise: Promise<void>;
+}
+
+const defaultSchedule: RetrySchedule = (callback, delayMs) => {
+  const timer = setTimeout(callback, delayMs);
+  timer.unref?.();
+  return () => clearTimeout(timer);
+};
+
+/**
+ * Serialize runtime activation generations and turn a retry verdict into a
+ * bounded follow-up attempt. The retry timer is installed from the active
+ * promise's `finally`, after the tail has been cleared, so it cannot merely
+ * join the attempt that requested it.
+ */
+export class RuntimeActivationTail {
+  private readonly isCurrent: (epoch: number) => boolean;
+  private readonly retryDelayMs: number;
+  private readonly maxRetries: number;
+  private readonly schedule: RetrySchedule;
+  private readonly onError: (error: unknown) => void;
+  private readonly onExhausted: (epoch: number, attempts: number) => void;
+  private inFlight: ActivationInFlight | null = null;
+  private retryEpoch: number | null = null;
+  private retryAttempts = 0;
+  private cancelRetry: (() => void) | null = null;
+  private exhaustionReported = false;
+  private stopped = false;
+
+  constructor(options: RuntimeActivationTailOptions) {
+    this.isCurrent = options.isCurrent;
+    this.retryDelayMs = options.retryDelayMs ?? 20_000;
+    this.maxRetries = Math.max(0, options.maxRetries ?? 3);
+    this.schedule = options.schedule ?? defaultSchedule;
+    this.onError = options.onError ?? (() => {});
+    this.onExhausted = options.onExhausted ?? (() => {});
+  }
+
+  request(epoch: number, attempt: ActivationAttempt): Promise<void> {
+    if (this.stopped || !this.isCurrent(epoch)) return Promise.resolve();
+    if (this.inFlight?.epoch === epoch) return this.inFlight.promise;
+
+    this.selectEpoch(epoch);
+    // An explicit activation supersedes a delayed retry for the same epoch.
+    // Keep the consumed retry count so repeated external nudges cannot reset
+    // the bound without creating a new daemon generation.
+    this.cancelScheduledRetry();
+
+    const predecessor = this.inFlight?.promise;
+    let result: RuntimeActivationAttemptResult = "complete";
+    const run = async (): Promise<void> => {
+      if (this.stopped || !this.isCurrent(epoch)) return;
+      try {
+        result = await attempt();
+      } catch (error) {
+        result = "retry";
+        try {
+          this.onError(error);
+        } catch {
+          // Diagnostics must not break the retry tail.
+        }
+      }
+    };
+
+    let running!: Promise<void>;
+    running = (predecessor
+      ? predecessor.catch(() => {}).then(run)
+      : run()
+    ).finally(() => {
+      if (this.inFlight?.promise !== running) return;
+      this.inFlight = null;
+      if (
+        result === "retry" &&
+        !this.stopped &&
+        this.isCurrent(epoch)
+      ) {
+        this.scheduleRetry(epoch, attempt);
+      } else {
+        this.resolve(epoch);
+      }
+    });
+    this.inFlight = { epoch, promise: running };
+    return running;
+  }
+
+  /** Schedule a retry requested outside the activation tail (for example, by
+   * reconnect revalidation). An active attempt for the epoch already owns the
+   * verdict and will schedule its own retry if needed. */
+  scheduleRetry(epoch: number, attempt: ActivationAttempt): boolean {
+    if (this.stopped || !this.isCurrent(epoch)) return false;
+    if (this.inFlight?.epoch === epoch) return true;
+    this.selectEpoch(epoch);
+    if (this.cancelRetry) return true;
+    if (this.retryAttempts >= this.maxRetries) {
+      if (!this.exhaustionReported) {
+        this.exhaustionReported = true;
+        this.onExhausted(epoch, this.retryAttempts);
+      }
+      return false;
+    }
+
+    this.retryAttempts += 1;
+    let cancel!: () => void;
+    cancel = this.schedule(() => {
+      if (this.cancelRetry !== cancel) return;
+      this.cancelRetry = null;
+      if (this.stopped || !this.isCurrent(epoch)) return;
+      void this.request(epoch, attempt);
+    }, this.retryDelayMs);
+    this.cancelRetry = cancel;
+    return true;
+  }
+
+  /** Clear retry bookkeeping after another path proves the epoch operational. */
+  resolve(epoch: number): void {
+    if (this.retryEpoch !== epoch) return;
+    this.cancelScheduledRetry();
+    this.retryEpoch = null;
+    this.retryAttempts = 0;
+    this.exhaustionReported = false;
+  }
+
+  stop(): void {
+    this.stopped = true;
+    this.cancelScheduledRetry();
+  }
+
+  private selectEpoch(epoch: number): void {
+    if (this.retryEpoch === epoch) return;
+    this.cancelScheduledRetry();
+    this.retryEpoch = epoch;
+    this.retryAttempts = 0;
+    this.exhaustionReported = false;
+  }
+
+  private cancelScheduledRetry(): void {
+    this.cancelRetry?.();
+    this.cancelRetry = null;
+  }
+}