@synopackageland/cli 0.4.0 → 0.5.0

package/templates/native-go/backend/internal/app/shared_folder.go

@@ -0,0 +1,144 @@
+package app
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+	"syscall"
+)
+
+// The install wizard stores the chosen Shared Folder's *name* in
+// <DataDir>/config.json (see dsm-package.yaml install.sharedFolder). The path
+// is resolved on every call, so a Shared Folder moved to another volume keeps
+// working. config.json is written by the package's postinst/postupgrade, not
+// by the app.
+
+var (
+	ErrSharedFolderNotFound  = errors.New("shared folder not found on any volume")
+	ErrSharedFolderAmbiguous = errors.New("shared folder name matches more than one volume")
+)
+
+// SharedFolder says where one configured Shared Folder is right now and what
+// the package account may do there.
+type SharedFolder struct {
+	Key      string `json:"key"`
+	Name     string `json:"name"`
+	Path     string `json:"path,omitempty"`
+	Exists   bool   `json:"exists"`
+	Readable bool   `json:"readable"`
+	Writable bool   `json:"writable"`
+	Error    string `json:"error,omitempty"`
+}
+
+func validShareName(name string) bool {
+	return name != "" && !strings.ContainsAny(name, "/\\\x00") && !strings.Contains(name, "..") &&
+		!strings.HasPrefix(name, "@") && !strings.HasPrefix(name, ".")
+}
+
+// ReadSharedFolders returns the Shared Folder names the installer stored, by
+// key. A package without config.json has none.
+func ReadSharedFolders(dataDir string) (map[string]string, error) {
+	data, err := os.ReadFile(filepath.Join(dataDir, "config.json"))
+	if errors.Is(err, fs.ErrNotExist) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	var cfg struct {
+		Schema        int               `json:"schema"`
+		SharedFolders map[string]string `json:"shared_folders"`
+	}
+	if err := json.Unmarshal(data, &cfg); err != nil {
+		return nil, fmt.Errorf("config.json: %w", err)
+	}
+	if cfg.Schema != 1 {
+		return nil, fmt.Errorf("config.json: unsupported schema %d", cfg.Schema)
+	}
+	for key, name := range cfg.SharedFolders {
+		if !validShareName(name) {
+			return nil, fmt.Errorf("config.json: invalid shared folder name for %q", key)
+		}
+	}
+	return cfg.SharedFolders, nil
+}
+
+// ResolveSharedFolder finds /volumeN/<name> under root ("/" on a NAS).
+func ResolveSharedFolder(root, name string) (string, error) {
+	if !validShareName(name) {
+		return "", fmt.Errorf("invalid shared folder name %q", name)
+	}
+	volumes, err := filepath.Glob(filepath.Join(root, "volume[0-9]*"))
+	if err != nil {
+		return "", err
+	}
+	var found []string
+	for _, volume := range volumes {
+		path := filepath.Join(volume, name)
+		if info, err := os.Stat(path); err == nil && info.IsDir() {
+			found = append(found, path)
+		}
+	}
+	switch len(found) {
+	case 0:
+		return "", ErrSharedFolderNotFound
+	case 1:
+		return found[0], nil
+	}
+	return "", ErrSharedFolderAmbiguous
+}
+
+const (
+	accessRead  = 0x4 // R_OK
+	accessWrite = 0x2 // W_OK
+	accessExec  = 0x1 // X_OK
+)
+
+// SharedFolders reports every configured Shared Folder, sorted by key. The
+// error is a corrupt config.json.
+func (cfg Config) SharedFolders() ([]SharedFolder, error) {
+	names, err := ReadSharedFolders(cfg.DataDir)
+	if err != nil {
+		return nil, err
+	}
+	root := cfg.VolumeRoot
+	if root == "" {
+		root = "/"
+	}
+	keys := make([]string, 0, len(names))
+	for key := range names {
+		keys = append(keys, key)
+	}
+	sort.Strings(keys)
+	folders := make([]SharedFolder, 0, len(keys))
+	for _, key := range keys {
+		folder := SharedFolder{Key: key, Name: names[key]}
+		path, err := ResolveSharedFolder(root, folder.Name)
+		if err != nil {
+			folder.Error = err.Error()
+		} else {
+			folder.Path, folder.Exists = path, true
+			folder.Readable = syscall.Access(path, accessRead|accessExec) == nil
+			folder.Writable = syscall.Access(path, accessWrite|accessExec) == nil
+		}
+		folders = append(folders, folder)
+	}
+	return folders, nil
+}
+
+// withSharedFolders adds the configured Shared Folders to an app.status
+// answer; a package that configures none is answered exactly as before.
+func (cfg Config) withSharedFolders(status map[string]any) map[string]any {
+	folders, err := cfg.SharedFolders()
+	if err != nil {
+		status["shared_folders_error"] = err.Error()
+	} else if len(folders) > 0 {
+		status["shared_folders"] = folders
+	}
+	return status
+}

package/templates/native-go/backend/internal/app/shared_folder_test.go

@@ -0,0 +1,158 @@
+package app
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func writeConfig(t *testing.T, dir, body string) {
+	t.Helper()
+	if err := os.WriteFile(filepath.Join(dir, "config.json"), []byte(body), 0o600); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestReadSharedFoldersWithoutConfigIsEmpty(t *testing.T) {
+	got, err := ReadSharedFolders(t.TempDir())
+	if err != nil || len(got) != 0 {
+		t.Fatalf("got %v %v", got, err)
+	}
+}
+
+func TestReadSharedFoldersReturnsNamesByKey(t *testing.T) {
+	dir := t.TempDir()
+	writeConfig(t, dir, `{"schema":1,"shared_folders":{"media":"Family Photos"}}`)
+	got, err := ReadSharedFolders(dir)
+	if err != nil || got["media"] != "Family Photos" || len(got) != 1 {
+		t.Fatalf("got %v %v", got, err)
+	}
+}
+
+func TestReadSharedFoldersRefusesUnknownSchemaAndBadNames(t *testing.T) {
+	for _, body := range []string{
+		`{"schema":2,"shared_folders":{"media":"x"}}`,
+		`{"schema":1,"shared_folders":{"media":"a/b"}}`,
+		`{"schema":1,"shared_folders":{"media":".."}}`,
+		`{"schema":1,"shared_folders":{"media":"@appdata"}}`,
+		`{"schema":1,"shared_folders":{"media":""}}`,
+		`not json`,
+	} {
+		dir := t.TempDir()
+		writeConfig(t, dir, body)
+		if _, err := ReadSharedFolders(dir); err == nil {
+			t.Errorf("%s: want an error", body)
+		}
+	}
+}
+
+func TestResolveSharedFolderFindsTheNameOnItsVolume(t *testing.T) {
+	root := t.TempDir()
+	for _, d := range []string{"volume1/other", "volume2/Photos", "volume2/@appdata"} {
+		if err := os.MkdirAll(filepath.Join(root, d), 0o755); err != nil {
+			t.Fatal(err)
+		}
+	}
+	got, err := ResolveSharedFolder(root, "Photos")
+	if err != nil || got != filepath.Join(root, "volume2", "Photos") {
+		t.Fatalf("got %q %v", got, err)
+	}
+}
+
+func TestResolveSharedFolderFollowsAMovedShare(t *testing.T) {
+	root := t.TempDir()
+	os.MkdirAll(filepath.Join(root, "volume1", "Photos"), 0o755)
+	first, _ := ResolveSharedFolder(root, "Photos")
+	os.Rename(filepath.Join(root, "volume1", "Photos"), filepath.Join(root, "Photos.tmp"))
+	os.MkdirAll(filepath.Join(root, "volume2"), 0o755)
+	os.Rename(filepath.Join(root, "Photos.tmp"), filepath.Join(root, "volume2", "Photos"))
+	second, err := ResolveSharedFolder(root, "Photos")
+	if err != nil || first == second || second != filepath.Join(root, "volume2", "Photos") {
+		t.Fatalf("%q -> %q %v", first, second, err)
+	}
+}
+
+func TestResolveSharedFolderErrors(t *testing.T) {
+	root := t.TempDir()
+	if _, err := ResolveSharedFolder(root, "Missing"); !errors.Is(err, ErrSharedFolderNotFound) {
+		t.Fatalf("missing: %v", err)
+	}
+	os.MkdirAll(filepath.Join(root, "volume1", "Dup"), 0o755)
+	os.MkdirAll(filepath.Join(root, "volume2", "Dup"), 0o755)
+	if _, err := ResolveSharedFolder(root, "Dup"); !errors.Is(err, ErrSharedFolderAmbiguous) {
+		t.Fatalf("ambiguous: %v", err)
+	}
+	for _, bad := range []string{"", "..", "a/b", "@appdata", ".x"} {
+		if _, err := ResolveSharedFolder(root, bad); err == nil {
+			t.Errorf("%q: want an error", bad)
+		}
+	}
+}
+
+func TestResolveSharedFolderIgnoresAFileOfThatName(t *testing.T) {
+	root := t.TempDir()
+	os.MkdirAll(filepath.Join(root, "volume1"), 0o755)
+	os.WriteFile(filepath.Join(root, "volume1", "Notes"), nil, 0o644)
+	if _, err := ResolveSharedFolder(root, "Notes"); !errors.Is(err, ErrSharedFolderNotFound) {
+		t.Fatalf("got %v", err)
+	}
+}
+
+func TestStatusOmitsSharedFoldersWhenNoneConfigured(t *testing.T) {
+	_, out := call(t, testConfig(t), bob, "app.status", `{}`)
+	if _, present := out["data"].(map[string]any)["shared_folders"]; present {
+		t.Fatalf("unexpected shared_folders: %v", out)
+	}
+}
+
+func TestStatusReportsEachConfiguredSharedFolder(t *testing.T) {
+	cfg := testConfig(t)
+	cfg.VolumeRoot = t.TempDir()
+	os.MkdirAll(filepath.Join(cfg.VolumeRoot, "volume1", "Photos"), 0o755)
+	writeConfig(t, cfg.DataDir, `{"schema":1,"shared_folders":{"media":"Photos","gone":"Missing"}}`)
+	_, out := call(t, cfg, bob, "app.status", `{}`)
+	rows := out["data"].(map[string]any)["shared_folders"].([]any)
+	if len(rows) != 2 {
+		t.Fatalf("rows: %v", rows)
+	}
+	byKey := map[string]map[string]any{}
+	for _, r := range rows {
+		m := r.(map[string]any)
+		byKey[m["key"].(string)] = m
+	}
+	media, gone := byKey["media"], byKey["gone"]
+	if media["name"] != "Photos" || media["exists"] != true || media["readable"] != true || media["writable"] != true || media["path"] != filepath.Join(cfg.VolumeRoot, "volume1", "Photos") {
+		t.Fatalf("media: %v", media)
+	}
+	if gone["exists"] != false || gone["readable"] != false || gone["writable"] != false || gone["error"] == nil || gone["path"] != nil {
+		t.Fatalf("gone: %v", gone)
+	}
+}
+
+func TestStatusReportsAFolderThePackageAccountCannotWrite(t *testing.T) {
+	if os.Geteuid() == 0 {
+		t.Skip("root ignores directory modes")
+	}
+	cfg := testConfig(t)
+	cfg.VolumeRoot = t.TempDir()
+	dir := filepath.Join(cfg.VolumeRoot, "volume1", "Locked")
+	os.MkdirAll(dir, 0o755)
+	os.Chmod(dir, 0o555)
+	t.Cleanup(func() { os.Chmod(dir, 0o755) })
+	writeConfig(t, cfg.DataDir, `{"schema":1,"shared_folders":{"media":"Locked"}}`)
+	_, out := call(t, cfg, bob, "app.status", `{}`)
+	row := out["data"].(map[string]any)["shared_folders"].([]any)[0].(map[string]any)
+	if row["exists"] != true || row["readable"] != true || row["writable"] != false {
+		t.Fatalf("row: %v", row)
+	}
+}
+
+func TestStatusReportsACorruptConfigWithoutFailing(t *testing.T) {
+	cfg := testConfig(t)
+	writeConfig(t, cfg.DataDir, `not json`)
+	code, out := call(t, cfg, bob, "app.status", `{}`)
+	if code != "" || out["data"].(map[string]any)["shared_folders_error"] == nil {
+		t.Fatalf("%q %v", code, out)
+	}
+}

package/templates/native-go/backend/internal/background/access.go

@@ -0,0 +1,57 @@
+package background
+
+import (
+	"strconv"
+	"time"
+)
+
+// Valid requires a resolved, non-root numeric UID. Unknown legacy owners remain
+// visible only to administrators.
+func (o Submitter) Valid() bool {
+	uid, err := strconv.ParseUint(o.UID, 10, 32)
+	return o.User != "" && err == nil && uid > 0 && strconv.FormatUint(uid, 10) == o.UID
+}
+
+// Access is constructed only by the authenticated backend, never JSON params.
+type Access struct {
+	Owner Submitter
+	Admin bool
+}
+
+func (a Access) sees(job Job) bool {
+	return !job.PurgeRequested && (a.Admin || (a.Owner.Valid() && job.Submitter == a.Owner))
+}
+
+type PurgeAudit struct {
+	Owner    Submitter `json:"owner"`
+	Actor    string    `json:"actor"`
+	At       time.Time `json:"at"`
+	Removed  int       `json:"removed"`
+	Draining int       `json:"draining"`
+}
+
+// ownerUsage centralizes admission accounting for the package-private spool.
+func (j *journal) ownerUsage(owner Submitter) (pending int, bytes int64) {
+	for _, job := range j.Jobs {
+		if job.Submitter != owner {
+			continue
+		}
+		if !job.State.terminal() {
+			pending++
+			bytes += int64(job.InputBytes + resultReserve)
+		} else {
+			if job.CopyRetained {
+				bytes += int64(job.InputBytes)
+			}
+			if job.Result != nil {
+				bytes += resultReserve
+			}
+		}
+	}
+	for _, sc := range j.Schedules {
+		if sc.Owner == owner {
+			bytes += int64(sc.InputBytes)
+		}
+	}
+	return
+}

package/templates/native-go/backend/internal/background/owner_test.go

@@ -0,0 +1,126 @@
+package background
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"sync"
+	"testing"
+)
+
+func TestOwnerAdmissionIsAtomicAndGatePersists(t *testing.T) {
+	s, dir := newStore(t)
+	ctx := context.Background()
+	owner := Submitter{User: "normal", UID: "1025"}
+	req := SubmitRequest{Key: "one", Name: "a", Data: []byte("x"), Submitter: owner}
+	if _, _, err := s.Submit(ctx, req); !errors.Is(err, ErrOrdinaryDisabled) {
+		t.Fatalf("default gate: %v", err)
+	}
+	if err := s.SetOrdinaryUsers(ctx, true); err != nil {
+		t.Fatal(err)
+	}
+	fresh := NewStore(dir)
+	st, _ := fresh.Status(ctx)
+	if !st.AllowOrdinaryUsers {
+		t.Fatal("gate not durable")
+	}
+	var wg sync.WaitGroup
+	var mu sync.Mutex
+	accepted := 0
+	for i := 0; i < 8; i++ {
+		wg.Add(1)
+		go func(i int) {
+			defer wg.Done()
+			r := req
+			r.Key = fmt.Sprint(i)
+			_, _, err := fresh.Submit(ctx, r)
+			mu.Lock()
+			defer mu.Unlock()
+			if err == nil {
+				accepted++
+			} else if !errors.Is(err, ErrOwnerQueueFull) {
+				t.Errorf("admission: %v", err)
+			}
+		}(i)
+	}
+	wg.Wait()
+	if accepted != MaxOwnerPending {
+		t.Fatalf("concurrent owner jobs %d", accepted)
+	}
+	if err := fresh.SetOrdinaryUsers(ctx, false); err != nil {
+		t.Fatal(err)
+	}
+	if _, _, err := s.Submit(ctx, req); !errors.Is(err, ErrOrdinaryDisabled) {
+		t.Fatalf("gate changed after caller admission: %v", err)
+	}
+}
+func TestOwnerByteQuotaIncludesReservedResult(t *testing.T) {
+	s, _ := newStore(t)
+	ctx := context.Background()
+	submit(t, s, "one", make([]byte, MaxInputBytes))
+	_, _, err := s.Submit(ctx, SubmitRequest{Key: "two", Name: "a", Data: make([]byte, MaxInputBytes), Submitter: admin, Admin: true})
+	if !errors.Is(err, ErrOwnerQuota) {
+		t.Fatalf("owner byte quota: %v", err)
+	}
+	if _, _, err = s.Submit(ctx, SubmitRequest{Key: "two", Name: "a", Data: make([]byte, MaxInputBytes-2*resultReserve), Submitter: admin, Admin: true}); err != nil {
+		t.Fatal(err)
+	}
+}
+func TestPurgeRunningJobDrainsWithoutResultAndAuditSurvives(t *testing.T) {
+	s, dir := newStore(t)
+	ctx := context.Background()
+	job := submit(t, s, "one", []byte("x"))
+	_, _ = s.Claim(ctx)
+	audit, err := s.PurgeOwner(ctx, admin, "manager")
+	if err != nil || audit.Draining != 1 || audit.Removed != 0 {
+		t.Fatalf("%+v %v", audit, err)
+	}
+	if _, err := s.GetFor(ctx, job.ID, Access{Admin: true}); !errors.Is(err, ErrNotFound) {
+		t.Fatal("purged job is visible")
+	}
+	if job, err := s.Get(ctx, job.ID); err != nil || !job.CancelRequested {
+		t.Fatal("worker cannot see drain request")
+	}
+	if err := s.Finish(ctx, job.ID, Outcome{State: StateSucceeded, Result: &Result{Bytes: 1}}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := s.Get(ctx, job.ID); !errors.Is(err, ErrNotFound) {
+		t.Fatal("purged job retained after drain")
+	}
+	if _, err := os.Stat(filepath.Join(dir, "inputs", job.ID)); !errors.Is(err, os.ErrNotExist) {
+		t.Fatal("purged input remains")
+	}
+	fresh := NewStore(dir)
+	if err := fresh.withJournal(ctx, func(_ *os.Root, j *journal) (bool, error) {
+		if len(j.PurgeAudit) != 1 || j.PurgeAudit[0].Actor != "manager" {
+			t.Fatal("audit lost")
+		}
+		return false, nil
+	}); err != nil {
+		t.Fatal(err)
+	}
+}
+func TestLegacyUnknownOwnerIsAdminOnlyAndRecoveryCompletesPurge(t *testing.T) {
+	s, dir := newStore(t)
+	ctx := context.Background()
+	job := submit(t, s, "one", []byte("x"))
+	_, _ = s.Claim(ctx)
+	_ = s.withJournal(ctx, func(_ *os.Root, j *journal) (bool, error) { j.Jobs[0].Submitter.UID = ""; return true, nil })
+	if list, _ := s.ListFor(ctx, Access{Owner: Submitter{User: "admin", UID: "1024"}}); len(list) != 0 {
+		t.Fatal("legacy owner visible")
+	}
+	if list, _ := s.List(ctx); len(list) != 1 {
+		t.Fatal("legacy owner hidden from admin")
+	}
+	if _, err := s.PurgeOwner(ctx, Submitter{User: "admin"}, "manager"); err != nil {
+		t.Fatal(err)
+	}
+	if err := NewStore(dir).Recover(ctx); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := s.Get(ctx, job.ID); !errors.Is(err, ErrNotFound) {
+		t.Fatal("crashed purge recovered a result")
+	}
+}

package/templates/native-go/backend/internal/background/runner.go

@@ -0,0 +1,185 @@
+package background
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"errors"
+	"io"
+	"log"
+	"sync"
+	"time"
+)
+
+// Work is one fixed worker algorithm. It receives only the job's input bytes.
+type Work func(ctx context.Context, in io.Reader) (Result, error)
+
+// SHA256V1 is the only worker in this version: it hashes the imported copy.
+func SHA256V1(ctx context.Context, in io.Reader) (Result, error) {
+	h := sha256.New()
+	buf := make([]byte, 32*1024)
+	total := 0
+	for {
+		if err := ctx.Err(); err != nil {
+			return Result{}, err
+		}
+		n, err := in.Read(buf)
+		h.Write(buf[:n])
+		total += n
+		if errors.Is(err, io.EOF) {
+			return Result{SHA256: hex.EncodeToString(h.Sum(nil)), Bytes: total}, nil
+		}
+		if err != nil {
+			return Result{}, err
+		}
+	}
+}
+
+var errRefusedRoot = errors.New("the background worker refuses to run as root")
+
+// RefuseRoot keeps the worker on the package account.
+func RefuseRoot(uid int) error {
+	if uid == 0 {
+		return errRefusedRoot
+	}
+	return nil
+}
+
+var (
+	errCancelRequested = errors.New("cancel requested")
+	errTimeout         = errors.New("job time limit reached")
+)
+
+// Runner claims jobs from the Store and runs them one at a time.
+type Runner struct {
+	Store      *Store
+	Work       Work
+	Timeout    time.Duration
+	Poll       time.Duration
+	CancelPoll time.Duration
+	Beat       time.Duration
+	Info       WorkerInfo
+}
+
+// Run returns nil after ctx ends and the job in flight, if any, is recorded
+// as interrupted. Any other return is a spool failure.
+func (r *Runner) Run(ctx context.Context) error {
+	if err := r.Store.Recover(ctx); err != nil {
+		return err
+	}
+	if err := r.Store.Heartbeat(ctx, r.Info); err != nil {
+		return err
+	}
+	var beats sync.WaitGroup
+	defer beats.Wait()
+	beats.Add(1)
+	go func() { defer beats.Done(); r.heartbeat(ctx) }()
+	for ctx.Err() == nil {
+		if err := r.Store.Tick(ctx); err != nil && ctx.Err() == nil {
+			log.Printf("schedule tick failed: %v", err)
+		}
+		job, err := r.Store.Claim(ctx)
+		if err != nil && ctx.Err() == nil {
+			log.Printf("claim failed: %v", err)
+		}
+		if job == nil || err != nil {
+			sleep(ctx, r.Poll)
+			continue
+		}
+		r.process(ctx, job)
+	}
+	return nil
+}
+
+func sleep(ctx context.Context, d time.Duration) {
+	select {
+	case <-ctx.Done():
+	case <-time.After(d):
+	}
+}
+
+func (r *Runner) heartbeat(ctx context.Context) {
+	for {
+		sleep(ctx, r.Beat)
+		if ctx.Err() != nil {
+			return
+		}
+		if err := r.Store.Heartbeat(ctx, r.Info); err != nil && ctx.Err() == nil {
+			log.Printf("heartbeat failed: %v", err)
+		}
+	}
+}
+
+func (r *Runner) process(parent context.Context, job *Job) {
+	ctx, cancel := context.WithCancelCause(parent)
+	defer cancel(nil)
+	timer := time.AfterFunc(r.Timeout, func() { cancel(errTimeout) })
+	defer timer.Stop()
+	var watcher sync.WaitGroup
+	watcher.Add(1)
+	go func() { defer watcher.Done(); r.watchCancel(ctx, job.ID, cancel) }()
+
+	result, err := r.run(ctx, job)
+	outcome := Outcome{State: StateSucceeded, Result: &result}
+	switch {
+	case parent.Err() != nil:
+		outcome = Outcome{State: StateInterrupted, ErrorCode: "worker-stopped"}
+	case errors.Is(context.Cause(ctx), errCancelRequested):
+		outcome = Outcome{State: StateCanceled}
+	case errors.Is(context.Cause(ctx), errTimeout):
+		outcome = Outcome{State: StateFailed, ErrorCode: "timeout"}
+	case errors.Is(err, errInputChanged):
+		outcome = Outcome{State: StateFailed, ErrorCode: "input-changed"}
+	case err != nil:
+		log.Printf("job %s failed: %v", job.ID, err)
+		outcome = Outcome{State: StateFailed, ErrorCode: "worker-error"}
+	}
+	cancel(nil)
+	watcher.Wait()
+	// The stop signal that ended parent must not prevent recording the outcome.
+	fin, done := context.WithTimeout(context.Background(), 10*time.Second)
+	defer done()
+	if err := r.Store.Finish(fin, job.ID, outcome); err != nil {
+		log.Printf("job %s outcome not recorded: %v", job.ID, err)
+	}
+}
+
+var errInputChanged = errors.New("stored input no longer matches its digest")
+
+func (r *Runner) run(ctx context.Context, job *Job) (Result, error) {
+	f, err := r.Store.OpenInput(job.ID)
+	if err != nil {
+		return Result{}, err
+	}
+	defer f.Close()
+	result, err := r.Work(ctx, io.LimitReader(f, MaxInputBytes+1))
+	if err != nil {
+		return Result{}, err
+	}
+	if result.SHA256 != job.InputDigest || result.Bytes != job.InputBytes {
+		return Result{}, errInputChanged
+	}
+	return result, nil
+}
+
+func (r *Runner) watchCancel(ctx context.Context, id string, cancel context.CancelCauseFunc) {
+	for {
+		sleep(ctx, r.CancelPoll)
+		if ctx.Err() != nil {
+			return
+		}
+		if job, err := r.Store.Get(ctx, id); err == nil && (job.CancelRequested || job.State != StateRunning) {
+			cancel(errCancelRequested)
+			return
+		}
+	}
+}
+
+// NewRunner is the production assembly: the fixed sha256-v1 worker over the
+// package-private spool at dir.
+func NewRunner(dir string, info WorkerInfo) *Runner {
+	return &Runner{
+		Store: NewStore(dir), Work: SHA256V1, Timeout: JobTimeout,
+		Poll: 500 * time.Millisecond, CancelPoll: 250 * time.Millisecond, Beat: 5 * time.Second, Info: info,
+	}
+}