@synopackageland/cli 0.4.0 → 0.4.1

package/templates/native-go/backend/internal/helper/supervisor_frame_linux_test.go

@@ -0,0 +1,69 @@
+package helper
+
+import (
+	"context"
+	"encoding/json"
+	"net"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestLinuxSupervisorFrameWaitPreservesStopFence(t *testing.T) {
+	p := linuxFixture(t)
+	process := startVMHelper(t, p)
+	conn, err := net.Dial("unix", filepath.Join(p.RunDir, "supervisor.sock"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer conn.Close()
+	time.Sleep(50 * time.Millisecond)
+	vmUnit(t, "stop")
+	ctx, cancel := context.WithTimeout(context.Background(), 4*time.Second)
+	defer cancel()
+	if err = waitHealthy(ctx, func(context.Context) bool {
+		r, e := readRecord(p.StateDir, 0)
+		return e == nil && r.Lifecycle.Phase == "stopped" && r.Lifecycle.Completion != ""
+	}); err != nil {
+		t.Fatal("stalled peer prevented owned fence/completion", err)
+	}
+	record, err := readRecord(p.StateDir, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	proof, err := completionRecord(p.Client, record)
+	if err != nil || proof.Process != process {
+		t.Fatal("wrong completion", err)
+	}
+	t.Logf("stalled root peer lifecycle reason=%s", record.Lifecycle.Reason)
+	vmUnit(t, "start")
+	if p.Client.Status(context.Background()).State == "ready" {
+		t.Fatal("later active revived stopped epoch")
+	}
+}
+
+func TestLinuxSupervisorRejectsForeignFrameAfterWait(t *testing.T) {
+	p := linuxFixture(t)
+	process := startVMHelper(t, p)
+	conn, err := net.Dial("unix", filepath.Join(p.RunDir, "supervisor.sock"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer conn.Close()
+	time.Sleep(150 * time.Millisecond)
+	foreign := process
+	foreign.Start = "foreign"
+	req := supervisorRequest{Process: foreign, Op: "admit", Nonce: strings.Repeat("a", 64)}
+	conn.SetDeadline(time.Now().Add(time.Second))
+	if err = json.NewEncoder(conn).Encode(req); err != nil {
+		t.Fatal(err)
+	}
+	var response Response
+	if err = json.NewDecoder(conn).Decode(&response); err == nil || response.OK {
+		t.Fatal("foreign Process frame accepted", response)
+	}
+	if p.Client.Status(context.Background()).State != "ready" {
+		t.Fatal("foreign frame changed valid epoch")
+	}
+}

package/templates/native-go/backend/internal/helper/supervisor_frame_test.go

@@ -0,0 +1,107 @@
+package helper
+
+import (
+	"encoding/json"
+	"net"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestSupervisorReceivePhases(t *testing.T) {
+	req := supervisorRequest{Op: "grants", Nonce: strings.Repeat("a", 64), Data: json.RawMessage(`{}`)}
+	frame, _ := json.Marshal(req)
+	for _, kind := range []string{"delayed-attestation", "late-attestation", "buffered-large", "empty-eof", "silent", "partial", "drip", "trailing", "oversize", "duplicate", "valid"} {
+		t.Run(kind, func(t *testing.T) {
+			server, client := supervisorSocketPair(t)
+			defer server.Close()
+			defer client.Close()
+			// Legacy server starts its receive clock before the caller's full hash.
+			if err := server.SetDeadline(time.Now().Add(100 * time.Millisecond)); err != nil {
+				t.Fatal(err)
+			}
+			done := make(chan struct{})
+			go func() {
+				defer close(done)
+				switch kind {
+				case "silent":
+					return
+				case "late-attestation":
+					time.Sleep(1100 * time.Millisecond)
+					client.Write(frame)
+				case "buffered-large":
+					large := req
+					large.Data = json.RawMessage(`{"padding":"` + strings.Repeat("a", 8192) + `"}`)
+					raw, _ := json.Marshal(large)
+					client.Write(raw)
+				case "empty-eof":
+				case "delayed-attestation":
+					time.Sleep(150 * time.Millisecond)
+					client.Write(frame)
+				case "partial":
+					client.Write([]byte("{"))
+					time.Sleep(200 * time.Millisecond)
+				case "drip":
+					for n := 0; n < 8; n++ {
+						if _, e := client.Write([]byte(" ")); e != nil {
+							return
+						}
+						time.Sleep(30 * time.Millisecond)
+					}
+				case "trailing":
+					client.Write(append(frame, []byte(`{}`)...))
+				case "oversize":
+					client.Write(append(frame, []byte(strings.Repeat(" ", MaxControlBytes))...))
+				case "duplicate":
+					client.Write([]byte(`{"op":"grants","op":"grants","nonce":"` + req.Nonce + `","data":{}}`))
+				default:
+					client.Write(frame)
+				}
+				client.CloseWrite()
+			}()
+			started := time.Now()
+			got, code := receiveSupervisorRequest(server)
+			elapsed := time.Since(started)
+			server.Close()
+			client.Close()
+			<-done
+			if kind == "valid" || kind == "delayed-attestation" || kind == "buffered-large" {
+				if code != "" || got.Nonce != req.Nonce {
+					t.Fatalf("valid delayed/buffered frame refused: %s", code)
+				}
+			} else if code == "" {
+				t.Fatal("invalid/stalled frame accepted")
+			}
+			if kind == "silent" && (elapsed < 900*time.Millisecond || elapsed > 1500*time.Millisecond) {
+				t.Fatalf("first-byte bound: %s", elapsed)
+			}
+			if (kind == "partial" || kind == "drip") && elapsed > 180*time.Millisecond {
+				t.Fatalf("frame deadline was extended: %s", elapsed)
+			}
+		})
+	}
+}
+
+func TestSupervisorFrameBudgetAlsoBoundsLegacyReply(t *testing.T) {
+	// Keep the synchronous pipe here: an unread small Unix socket reply fits in
+	// the kernel buffer and would not exercise the bounded blocked-write path.
+	server, client := net.Pipe()
+	defer server.Close()
+	defer client.Close()
+	// A watchdog protects the test if reply writes accidentally lose their bound.
+	server.SetWriteDeadline(time.Now().Add(2 * time.Second))
+	req := supervisorRequest{Op: "admit", Nonce: strings.Repeat("b", 64)}
+	frame, _ := json.Marshal(req)
+	sent := make(chan struct{})
+	go func() { defer close(sent); time.Sleep(150 * time.Millisecond); client.Write(frame) }()
+	if _, code := receiveSupervisorRequest(server); code != "" {
+		t.Fatal(code)
+	}
+	<-sent
+	started := time.Now()
+	_, err := server.Write([]byte(`{"ok":true}`))
+	elapsed := time.Since(started)
+	if e, ok := err.(net.Error); !ok || !e.Timeout() || elapsed < 70*time.Millisecond || elapsed > 350*time.Millisecond {
+		t.Fatalf("unbounded/expired legacy reply: %s %v", elapsed, err)
+	}
+}

package/templates/native-go/backend/internal/helper/supervisor_linux.go

@@ -6,7 +6,6 @@ import (
 	"encoding/hex"
 	"encoding/json"
 	"errors"
-	"io"
 	"net"
 	"os"
 	"os/exec"
@@ -57,21 +56,39 @@ func (c *ownedLinuxChild) signal(s syscall.Signal) error {
 	return syscall.Kill(c.process.Pid, s)
 }
 
-type supervisorRequest struct {
-	Process Process `json:"process"`
-	Op      string  `json:"op"`
-	Nonce   string  `json:"nonce"`
-}
-
 // The thread creating the child must remain alive: PDEATHSIG is tied to that
 // Linux thread, not merely the supervisor's thread group / Go process.
 func superviseLinux(c Client, binary string) error {
 	runtime.LockOSThread()
 	defer runtime.UnlockOSThread()
 	r, err := readRecord(c.StateDir, 0)
-	if err != nil || !r.Enabled || r.Inventory != c.Expected {
+	if err != nil || !r.Enabled || r.Inventory != c.Expected || r.Lifecycle == nil || r.Lifecycle.Phase != "running" {
+		return errTrust
+	}
+	lease, err := acquireLifetime(c, r.Lifecycle)
+	if err != nil {
+		return err
+	}
+	processLifetime = lease
+	// Recheck under the witness: repair may have fenced between the first
+	// approval read and lock acquisition. No child exists before this point.
+	current, err := readRecord(c.StateDir, 0)
+	if err != nil || !current.Enabled || current.Inventory != r.Inventory || current.Lifecycle == nil || current.Lifecycle.Epoch != r.Lifecycle.Epoch || current.Lifecycle.Phase != "running" {
+		return errTrust
+	}
+	o, err := openUnitObserver(context.Background(), c.Expected)
+	if err != nil {
+		return err
+	}
+	defer o.conn.Close()
+	if o.gate.binding != r.Lifecycle.Binding {
 		return errTrust
 	}
+	watcher, cancelWatcher := context.WithCancel(context.Background())
+	defer cancelWatcher()
+	go o.watch(watcher)
+	epoch := r.Lifecycle.Epoch
+	defer persistObserverDiagnostic(c, epoch, o.gate)
 	identity, err := inspectSupervisor(os.Getpid(), c.Expected)
 	if err != nil {
 		return err
@@ -90,6 +107,7 @@ func superviseLinux(c Client, binary string) error {
 		return err
 	}
 	cmd := exec.Command(binary, "serve-child")
+	cmd.ExtraFiles = []*os.File{lease}
 	cmd.Env = []string{"PATH=/usr/sbin:/usr/bin:/sbin:/bin", "SYNOPKGLAND_PARENT=" + strconv.Itoa(os.Getpid())}
 	// Go sets prctl before exec and rechecks the parent immediately afterward.
 	cmd.SysProcAttr = &syscall.SysProcAttr{Pdeathsig: syscall.SIGKILL}
@@ -97,10 +115,114 @@ func superviseLinux(c Client, binary string) error {
 		return err
 	}
 	child := &ownedLinuxChild{process: cmd.Process}
+	cohort := newOperationCohort(c.Expected, epoch, child.process.Pid, o.gate, func() bool { return !child.reaped })
+	defer func() {
+		ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+		defer cancel()
+		_ = cohort.drain(ctx, time.Second)
+		_ = stopChild(ctx, child, time.Second)
+	}()
+	var grants *supervisorGrants
+	var grantRepo *FileGrantRepository
+	defer func() {
+		if grantRepo != nil {
+			grantRepo.Close()
+		}
+	}()
+	// M1 Start first observes the health handshake, then finalizeStart clears
+	// residual under policy.lock. Pin S3's COMPLETE approval only after that
+	// handoff; constructing against residual=true would permanently fence it.
+	initializeGrants := func() {
+		if c.Expected.Protocol != DataProtocol || grants != nil || !o.gate.allow(time.Now()) {
+			return
+		}
+		approval, e := readRecord(c.StateDir, 0)
+		if e != nil || !approval.Enabled || approval.Inventory != c.Expected || approval.Lifecycle == nil || approval.Lifecycle.Epoch != epoch || approval.Lifecycle.Phase != "running" {
+			o.gate.fence("grant-approval-unavailable")
+			return
+		}
+		if approval.Residual {
+			return
+		} // health-only handshake; no grant authority yet
+		var code Code
+		grants, grantRepo, code = openSupervisorGrants(c, binary, cohort)
+		if code != "" {
+			o.gate.fence("grant-authority-unavailable")
+		}
+	}
+	fenceRetryExhausted := false
 	// No cmd.Wait goroutine: reaping and signalling are serialized below.
 	for {
-		if _, err := child.exited(); err != nil {
-			return err
+		current, readErr := readRecord(c.StateDir, 0)
+		if readErr != nil || current.Lifecycle == nil || current.Lifecycle.Epoch != epoch {
+			o.gate.fence("approval-unavailable")
+		} else if !current.Enabled || current.Lifecycle.Phase != "running" {
+			o.gate.fence("admin-stop")
+		}
+		initializeGrants()
+		// Reload verification denies requests without retiring this epoch.
+		if o.gate.fenced(time.Now()) {
+			if grants != nil {
+				grants.authority.Fence()
+			}
+			cohort.deny()
+			// NB policy.lock keeps the owner loop and admin stop responsive. No
+			// graceful stop before the irreversible durable fence transaction.
+			err := errBusy
+			if !fenceRetryExhausted {
+				ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+				err = retryCohortPolicy(ctx, func() error {
+					return fenceRecord(c, epoch, o.gate.reason(), o.gate.observerDiagnostic(epoch).Fence.Detail)
+				})
+				cancel()
+			}
+			if err == nil {
+				ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+				err = cohort.drain(ctx, time.Second)
+				if err == nil {
+					err = stopChild(ctx, child, time.Second)
+				}
+				cancel()
+				if err != nil {
+					return err
+				}
+				if err = l.Close(); err != nil {
+					return err
+				}
+				p, e := readProcess(c.RunDir, 0)
+				if e != nil || p != identity {
+					return errTrust
+				}
+				if err = cleanRuntime(c, true); err != nil {
+					return err
+				}
+				q, err := cohort.proof()
+				if err != nil {
+					return err
+				}
+				// Completion is quiescence proof, published after close/reap/unlink.
+				ctx, cancel = context.WithTimeout(context.Background(), time.Second)
+				defer cancel()
+				return retryCohortPolicy(ctx, func() error { return completeRecord(c, epoch, identity, q) })
+			}
+			if !errors.Is(err, errBusy) {
+				return err
+			}
+			// Budget expiry parks the fenced owner, retaining the lifetime
+			// witness. Do not exit (PDEATHSIG), poll/signal canceled children,
+			// or restart automatic retries. An explicit root stop retries below.
+			fenceRetryExhausted = true
+		}
+		if !fenceRetryExhausted {
+			if err := cohort.poll(); err != nil {
+				return err
+			}
+			if done, err := child.exited(); err != nil {
+				return err
+			} else if done && cohort.started > 0 {
+				o.gate.fence("helper-exited")
+				continue
+			}
 		}
 		l.SetDeadline(time.Now().Add(20 * time.Millisecond))
 		conn, err := l.AcceptUnix()
@@ -110,21 +232,70 @@ func superviseLinux(c Client, binary string) error {
 			}
 			return err
 		}
-		conn.SetDeadline(time.Now().Add(3 * time.Second))
 		peer, err := peerCredentials(conn)
 		if err != nil || peer.Uid != 0 {
 			conn.Close()
 			continue
 		}
-		var req supervisorRequest
-		d := json.NewDecoder(io.LimitReader(conn, 4097))
-		d.DisallowUnknownFields()
-		if d.Decode(&req) != nil || req.Process != identity || req.Op != "stop" || len(req.Nonce) != 64 || !digestPattern.MatchString(req.Nonce) {
+		req, code := receiveSupervisorRequest(conn)
+		if code != "" || req.Process != identity {
+			conn.Close()
+			continue
+		}
+		if req.Op == "grants" {
+			initializeGrants()
+			conn.SetDeadline(time.Now().Add(3 * time.Second))
+			ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+			res := dispatchSupervisorGrant(ctx, grants, operationPeer{int(peer.Pid), peer.Uid}, req)
+			cancel()
+			json.NewEncoder(conn).Encode(res)
 			conn.Close()
+			if grants != nil {
+				grants.authority.mu.Lock()
+				fenced := grants.authority.fenced
+				grants.authority.mu.Unlock()
+				if fenced {
+					o.gate.fence("grant-authority-fenced")
+				}
+			}
 			continue
 		}
+		if req.Op == "admit" {
+			current, e := readRecord(c.StateDir, 0)
+			allowed := e == nil && current.Enabled && current.Inventory == c.Expected && current.Lifecycle != nil && current.Lifecycle.Epoch == epoch && current.Lifecycle.Phase == "running" && !child.reaped && int(peer.Pid) == child.process.Pid
+			readiness := "fenced"
+			if allowed {
+				readiness = o.gate.readiness(time.Now())
+			}
+			res := Response{Inventory: c.Expected, Nonce: req.Nonce, OK: readiness == "ready"}
+			if !res.OK {
+				res.Error = readiness
+			}
+			json.NewEncoder(conn).Encode(res)
+			conn.Close()
+			continue
+		}
+		conn.SetDeadline(time.Now().Add(3 * time.Second))
 		ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
-		err = stopChild(ctx, child, time.Second)
+		err = nil
+		if c.Expected.Protocol == DataProtocol || cohort.started > 0 || fenceRetryExhausted {
+			if grants != nil {
+				grants.authority.Fence()
+			}
+			cohort.deny()
+			fenceCtx, fenceCancel := context.WithTimeout(ctx, time.Second)
+			err = retryCohortPolicy(fenceCtx, func() error { return fenceRecord(c, epoch, "admin-stop") })
+			fenceCancel()
+		}
+		if err == nil {
+			err = cohort.drain(ctx, time.Second)
+		}
+		if err == nil {
+			err = stopChild(ctx, child, time.Second)
+		}
+		if err == nil {
+			_, err = cohort.proof()
+		}
 		cancel()
 		// Kernel process-exit fd cleanup is not ordered: close the listener
 		// before ACK, so connection EOF cannot race a still-listening socket.