@synopackageland/cli 0.4.0 → 0.5.0

package/templates/native-go/backend/internal/helper/grant_snapshot.go

@@ -0,0 +1,78 @@
+//go:build !synopkgland_sdk_workers
+
+//line dsmapp/internal/helper/grant_snapshot.go:1
+package helper
+
+import (
+	"math"
+	"reflect"
+	"slices"
+)
+
+// Pure snapshot invariants shared by the ordering owner and Linux persistence.
+func findGrant(s *GrantStore, id string) *Grant {
+	for n := range s.Grants {
+		if s.Grants[n].ID == id {
+			return &s.Grants[n]
+		}
+	}
+	return nil
+}
+func cloneAuthorityGrant(g Grant) Grant {
+	g.Actions = slices.Clone(g.Actions)
+	g.Scope.Segments = slices.Clone(g.Scope.Segments)
+	return g
+}
+
+func cloneAuthorityStore(s GrantStore) GrantStore { s.Grants = slicesCloneGrants(s.Grants); return s }
+func slicesCloneGrants(gs []Grant) []Grant {
+	out := make([]Grant, len(gs))
+	for i, g := range gs {
+		out[i] = cloneAuthorityGrant(g)
+	}
+	return out
+}
+
+// Root callback mistakes cannot drop tombstones, un-suspend, overwrite a grant's
+// scope/owner/actions, reuse IDs, or roll revisions back. Offline root disk
+// rollback remains outside the threat model; restart still suspends active.
+func validateGrantTransition(old, next GrantStore, p GrantPolicy) Code {
+	if reflect.DeepEqual(old, next) {
+		return ""
+	}
+	if old.Revision == math.MaxUint64 || next.Revision != old.Revision+1 {
+		return ErrStale
+	}
+	for _, before := range old.Grants {
+		after := findGrant(&next, before.ID)
+		if after == nil {
+			return ErrDenied
+		}
+		if reflect.DeepEqual(before, *after) {
+			continue
+		}
+		if before.State == GrantRevoked || before.Revision == math.MaxUint64 || after.Revision != before.Revision+1 {
+			return ErrDenied
+		}
+		if after.State != GrantRevoked && (before.State != GrantActive || after.State != GrantSuspended) {
+			return ErrDenied
+		}
+		normalized := cloneAuthorityGrant(*after)
+		normalized.Revision = before.Revision
+		normalized.State = before.State
+		normalized.Reason = before.Reason
+		normalized.RevokedAt = before.RevokedAt
+		if !reflect.DeepEqual(before, normalized) {
+			return ErrDenied
+		}
+	}
+	for _, g := range next.Grants {
+		if findGrant(&old, g.ID) == nil && (g.State != GrantActive || g.Revision != 1 || g.Inventory != p.Inventory || g.ApprovalBinding != p.ApprovalBinding || g.CapabilityDigest != p.CapabilityDigest || g.LastValidated.Epoch != p.Epoch || !p.Enabled) {
+			return ErrDenied
+		}
+	}
+	return ""
+}
+func completeQuiescence(q GrantQuiescence) bool {
+	return (q.Cohort == nil || (q.Cohort.Key == q.Key && q.Cohort.valid())) && allReferences(q.Key.Epoch, q.Key.GrantID) && q.Key.Revision > 0 && q.ChildrenReaped && q.RelayClosed && q.LeasesClosed && q.FDsClosed && q.EffectsRecorded
+}

package/templates/native-go/backend/internal/helper/grant_supervisor_linux.go

@@ -0,0 +1,134 @@
+package helper
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/hex"
+	"encoding/json"
+	"net"
+	"os"
+	"path/filepath"
+	"time"
+)
+
+// Fixed S1/S5 integration point. No environment/plugin/CGI installs adapters.
+// Until current account, App permission and ACL continuity are proved,
+// native/consent/operation/output adapters remain unavailable in shipped builds.
+func supervisorGrantAdapters(c Client) supervisorGrantServices {
+	if c.Expected.Protocol == DataProtocol && c.Expected.DataAccess == "relaxed" {
+		// t-0049 identifies candidates, not certified target-build adapters.
+		// Missing registration/session/state/groups/ACL proof stays unavailable.
+		return supervisorGrantServices{native: NewRelaxedNativeProvider(RelaxedAdapters{})}
+	}
+	return supervisorGrantServices{}
+}
+
+func openSupervisorGrants(c Client, binary string, cohort *operationCohort) (*supervisorGrants, *FileGrantRepository, Code) {
+	repo, code := OpenFileGrantRepository(c.StateDir, c.Expected)
+	if code != "" {
+		return nil, nil, code
+	}
+	services := supervisorGrantAdapters(c)
+	s, code := newSupervisorGrants(repo, cohort, services)
+	if code != "" {
+		repo.Close()
+		return nil, nil, code
+	}
+	if services.writes.Create && services.writeIntents == nil {
+		services.writeIntents = fileWriteIntents{repo}
+		s.services.writeIntents = services.writeIntents
+	}
+	cohort.startChild = func(a NativeActor, b operationBinding) (operationProcess, error) {
+		if services.output == nil {
+			return nil, errTrust
+		}
+		out, code := services.output(b)
+		if code != "" || out == nil {
+			return nil, errTrust
+		}
+		op := cohort.operations[b.OperationID]
+		if op == nil || op.binding != b || op.work == nil && op.writeWork == nil {
+			out.Close()
+			return nil, errTrust
+		}
+		pin, ok := op.root.(*pinnedReadOnlyRoot)
+		if !ok || pin == nil {
+			out.Close()
+			return nil, ErrUnavailable
+		}
+		if op.writeWork != nil {
+			process, err := startLinuxWriteOperation(c, binary, a, b, pin, *op.writeWork, out)
+			if err != nil && process == nil {
+				out.Close()
+			}
+			return process, err
+		}
+		process, err := startLinuxReadOnlyOperation(c, binary, a, b, pin, *op.work, out)
+		if err != nil && process == nil {
+			out.Close()
+		}
+		return process, err
+	}
+	return s, repo, ""
+}
+
+// Root helper only. Verify the pinned parent both before and after connecting;
+// actual SO_PEERCRED must equal that parent. No package-side grant endpoint.
+func callSupervisorGrantRPC(c Client, request supervisorGrantRequest) (supervisorGrantResponse, Code) {
+	var res supervisorGrantResponse
+	want, err := readProcess(c.RunDir, 0)
+	if err != nil || want.PID != os.Getppid() || want.Inventory != c.Expected {
+		return res, ErrDenied
+	}
+	actual, err := inspectSupervisor(want.PID, c.Expected)
+	if err != nil || actual != want {
+		return res, ErrDenied
+	}
+	conn, err := net.DialUnix("unix", nil, &net.UnixAddr{Name: filepath.Join(c.RunDir, "supervisor.sock"), Net: "unix"})
+	if err != nil {
+		return res, ErrUnavailable
+	}
+	defer conn.Close()
+	peer, err := peerCredentials(conn)
+	if err != nil || peer.Uid != 0 || int(peer.Pid) != want.PID {
+		return res, ErrDenied
+	}
+	actual, err = inspectSupervisor(want.PID, c.Expected)
+	if err != nil || actual != want {
+		return res, ErrDenied
+	}
+	conn.SetDeadline(time.Now().Add(3 * time.Second))
+	var nonce [32]byte
+	if _, err = rand.Read(nonce[:]); err != nil {
+		return res, ErrUnavailable
+	}
+	raw, err := json.Marshal(request)
+	if err != nil {
+		return res, ErrInvalid
+	}
+	req := supervisorRequest{Process: want, Op: "grants", Nonce: hex.EncodeToString(nonce[:]), Data: raw}
+	frame, err := json.Marshal(req)
+	if err != nil || len(frame) > MaxControlBytes {
+		return res, ErrLimit
+	}
+	if _, err = conn.Write(frame); err != nil {
+		return res, ErrUnavailable
+	}
+	if err = conn.CloseWrite(); err != nil {
+		return res, ErrUnavailable
+	}
+	if code := decodeDataObject(conn, &res, MaxControlBytes); code != "" {
+		return res, code
+	}
+	if res.Nonce != req.Nonce {
+		return supervisorGrantResponse{}, ErrDenied
+	}
+	return res, ""
+}
+
+func dispatchSupervisorGrant(ctx context.Context, s *supervisorGrants, peer operationPeer, req supervisorRequest) supervisorGrantResponse {
+	if s == nil {
+		return supervisorGrantResponse{Nonce: req.Nonce, Code: ErrUnavailable}
+	}
+	return s.dispatch(ctx, peer, req.Nonce, req.Data)
+}

package/templates/native-go/backend/internal/helper/grant_supervisor_linux_test.go

@@ -0,0 +1,254 @@
+package helper
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"net"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+)
+
+func TestSupervisorGrantFrameBounds(t *testing.T) {
+	req := supervisorRequest{Op: "grants", Nonce: grantRef('a'), Data: json.RawMessage(`{"epoch":"fixture"}`)}
+	b, _ := json.Marshal(req)
+	if _, code := decodeSupervisorRequest(bytes.NewReader(b)); code != "" {
+		t.Fatal(code)
+	}
+	for _, raw := range [][]byte{append(append([]byte{}, b...), b...), bytes.Replace(b, []byte(`"op":"grants"`), []byte(`"op":"grants","op":"admit"`), 1), append(bytes.Repeat([]byte(" "), MaxControlBytes), b...)} {
+		if _, code := decodeSupervisorRequest(bytes.NewReader(raw)); code == "" {
+			t.Fatal("invalid frame accepted")
+		}
+	}
+	legacy := supervisorRequest{Op: "admit", Nonce: grantRef('b')}
+	frame, _ := json.Marshal(legacy)
+	if _, code := decodeSupervisorRequest(bytes.NewReader(frame)); code != "" {
+		t.Fatal("legacy frame", code)
+	}
+	if _, code := decodeSupervisorRequest(bytes.NewReader(append(bytes.Repeat([]byte(" "), 4096), frame...))); code == "" {
+		t.Fatal("legacy frame limit ignored leading whitespace")
+	}
+
+	req.Op = "admit"
+	b, _ = json.Marshal(req)
+	if _, code := decodeSupervisorRequest(bytes.NewReader(b)); code != ErrInvalid {
+		t.Fatal(code)
+	}
+}
+func grantVMFixture(t *testing.T) LinuxProcesses {
+	t.Helper()
+	source := os.Getenv("M2_GRANT_FIXTURE")
+	if source == "" {
+		t.Skip("requires NIC-free Linux root VM")
+	}
+	t.Setenv("M1C_HELPER_FIXTURE", source)
+	p := linuxFixture(t)
+	p.Expected.Protocol = DataProtocol
+	return p
+}
+func grantVMCall(t *testing.T, p LinuxProcesses, method string, args any) supervisorGrantResponse {
+	t.Helper()
+	record, err := readRecord(p.StateDir, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	raw, _ := json.Marshal(args)
+	req := supervisorGrantRequest{Epoch: record.Lifecycle.Epoch, Method: method, Args: raw}
+	b, _ := json.Marshal(req)
+	os.Remove(filepath.Join(p.RunDir, "grant-result"))
+	// The owned helper polls and removes this name. Publishing with WriteFile
+	// exposed a truncated/partial control and produced intermittent ErrInvalid
+	// before the write completed. Publish the complete fixture frame by rename.
+	tmp := filepath.Join(p.RunDir, "grant-command.tmp")
+	if err := os.WriteFile(tmp, b, 0600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Rename(tmp, filepath.Join(p.RunDir, "grant-command")); err != nil {
+		t.Fatal(err)
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 4*time.Second)
+	defer cancel()
+	var res supervisorGrantResponse
+	if waitHealthy(ctx, func(context.Context) bool {
+		b, err := os.ReadFile(filepath.Join(p.RunDir, "grant-result"))
+		return err == nil && json.Unmarshal(b, &res) == nil
+	}) != nil {
+		t.Fatal("owned helper did not complete grant RPC", method)
+	}
+	return res
+}
+func grantVMCreate(t *testing.T, p LinuxProcesses) Grant {
+	t.Helper()
+	res := grantVMCall(t, p, "prepare", grantPrepareArgs{grantRef('c'), ScopePersonal, []Action{ActionRead}})
+	if res.Code != "" || res.Intent == nil {
+		t.Fatal(res)
+	}
+	b, err := os.ReadFile(filepath.Join(p.StateDir, "grants.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	store, code := DecodeGrantStore(bytes.NewReader(b))
+	if code != "" {
+		t.Fatal(code)
+	}
+	res = grantVMCall(t, p, "confirm", grantConfirmArgs{res.Intent.ID, res.Intent.SummaryDigest, store.Revision})
+	if res.Code != "" || res.Grant == nil {
+		t.Fatal(res)
+	}
+	return *res.Grant
+}
+func TestLinuxGrantRPCRevokeUsesS2DrainAndIsolatesGrants(t *testing.T) {
+	p := grantVMFixture(t)
+	proc := startVMHelper(t, p)
+	g := grantVMCreate(t, p)
+	other := grantVMCreate(t, p)
+	request := grantControl(t, g, '1', '2', '3', MaxBoundedBytes)
+	if res := grantVMCall(t, p, "operation.start", request); res.Code != "" {
+		t.Fatal(res)
+	}
+	grantVMMetadata(t, p, request)
+	if res := grantVMCall(t, p, "operation.chunk", grantControl(t, g, '1', '4', '5', MaxChunkBytes)); res.Code != "" {
+		t.Fatal(res)
+	}
+	if res := grantVMCall(t, p, "operation.start", grantControl(t, other, '6', '7', '8', MaxBoundedBytes)); res.Code != "" {
+		t.Fatal(res)
+	}
+	grantVMMetadata(t, p, grantControl(t, other, '6', '7', '8', MaxBoundedBytes))
+	children := processChildren(proc.PID)
+	if len(children) != 3 {
+		t.Fatal("missing real operations", children)
+	}
+	for _, pid := range children {
+		if pid == supervisedPIDByMode(t, proc.PID, "serve-child") {
+			continue
+		}
+		b, err := os.ReadFile(fmt.Sprintf("/proc/%d/status", pid))
+		if err != nil || !statusHasCredentials(b, 1001, 100, []uint32{101, 105}) {
+			t.Fatal("credentials", pid, err)
+		}
+	}
+	// A different root process knows the pinned identity but cannot mutate grants.
+	conn, err := net.DialUnix("unix", nil, &net.UnixAddr{Name: filepath.Join(p.RunDir, "supervisor.sock"), Net: "unix"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	raw := grantRPC(t, "revoke", g.LastValidated.Epoch, SessionCarriers{Cookie: "fixture"}, grantRevokeArgs{g.ID, 1, 3})
+	conn.SetDeadline(time.Now().Add(time.Second))
+	json.NewEncoder(conn).Encode(supervisorRequest{Process: proc, Op: "grants", Nonce: grantRef('f'), Data: raw})
+	conn.CloseWrite()
+	var foreign supervisorGrantResponse
+	if code := decodeDataObject(conn, &foreign, MaxControlBytes); code != "" || foreign.Code != ErrDenied {
+		t.Fatal("foreign root admitted", foreign, code)
+	}
+	conn.Close()
+	res := grantVMCall(t, p, "revoke", grantRevokeArgs{g.ID, 1, 3})
+	if res.Code != "" || res.Revoke == nil || !res.Revoke.Revoked || !res.Revoke.Drained {
+		t.Fatal(res)
+	}
+	b, err := os.ReadFile(filepath.Join(p.StateDir, "grant-q-"+g.ID+".json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var q GrantQuiescence
+	if json.Unmarshal(b, &q) != nil || !completeQuiescence(q) || q.Cohort == nil || q.Cohort.Started != 1 || q.Cohort.Reaped != 1 || q.Cohort.AdmittedBytes != MaxChunkBytes {
+		t.Fatal("Q without actual S2 proof", q)
+	}
+	if res := grantVMCall(t, p, "operation.start", grantControl(t, g, '9', 'a', 'b', 1)); res.Code != ErrRevoked {
+		t.Fatal("work after R", res)
+	}
+	if res := grantVMCall(t, p, "operation.chunk", grantControl(t, other, '6', 'c', 'd', 1)); res.Code != "" {
+		t.Fatal("unrelated grant fenced", res)
+	}
+	survivors := processChildren(proc.PID)
+	if len(survivors) != 2 {
+		t.Fatal("individual revoke drained unrelated grant", survivors)
+	}
+	vmUnit(t, "stop")
+	ctx, cancel := context.WithTimeout(context.Background(), 4*time.Second)
+	defer cancel()
+	if waitHealthy(ctx, func(context.Context) bool {
+		r, e := readRecord(p.StateDir, 0)
+		return e == nil && r.Lifecycle.Phase == "stopped"
+	}) != nil {
+		t.Fatal("global fence incomplete")
+	}
+	r, err := readRecord(p.StateDir, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	proof, err := completionRecord(p.Client, r)
+	if err != nil || proof.Cohort == nil || proof.Cohort.Started != 2 || proof.Cohort.Reaped != 2 || !proof.Cohort.RelaysStopped {
+		t.Fatal(proof, err)
+	}
+	for _, pid := range children {
+		if _, e := os.Stat(fmt.Sprintf("/proc/%d", pid)); !os.IsNotExist(e) {
+			t.Fatal("child survived Q/fence", pid)
+		}
+	}
+	// Restart suspends only active authority; the prior revoked tombstone stays R.
+	vmUnit(t, "start")
+	startVMHelper(t, p)
+
+	var store GrantStore
+	if waitHealthy(ctx, func(context.Context) bool {
+		b, e := os.ReadFile(filepath.Join(p.StateDir, "grants.json"))
+		if e != nil {
+			return false
+		}
+		var code Code
+		store, code = DecodeGrantStore(bytes.NewReader(b))
+		if code != "" {
+			return false
+		}
+		revoked, active := findGrant(&store, g.ID), findGrant(&store, other.ID)
+		return revoked != nil && active != nil && revoked.State == GrantRevoked && active.State == GrantSuspended
+	}) != nil {
+		t.Fatal("restart did not reconcile before grant admission", store)
+	}
+	suspended := *findGrant(&store, other.ID)
+	request = grantControl(t, suspended, 'e', 'f', '0', 1)
+	current, err := readRecord(p.StateDir, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	request.Epoch = current.Lifecycle.Epoch
+	if res := grantVMCall(t, p, "operation.start", request); res.Code != ErrSuspended {
+		t.Fatal("restart admitted suspended grant", res)
+	}
+
+}
+func TestLinuxGrantProductionAdaptersFailClosed(t *testing.T) {
+	p := grantVMFixture(t)
+	// VM fixture swaps only the trusted adapters; nil is the production default.
+	if s := supervisorGrantAdapters(p.Client); s.native != nil || s.consent != nil || s.operations != nil || s.output != nil {
+		t.Fatal("shipped adapters unexpectedly installed")
+	}
+}
+
+func TestLinuxGrantWaitsForDurableActivationHandoff(t *testing.T) {
+	p := grantVMFixture(t)
+	lifecycle := vmLifecycle(t, p)
+	record(t, p.Client, Record{Inventory: p.Expected, Enabled: true, Residual: true, Lifecycle: lifecycle})
+	if err := p.Start(p.Expected); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		(Controller{Client: p.Client, Processes: p, Observe: observeLinux}).Control(context.Background(), "disable")
+	})
+	args := grantPrepareArgs{grantRef('c'), ScopePersonal, []Action{ActionRead}}
+	if res := grantVMCall(t, p, "prepare", args); res.Code != ErrUnavailable {
+		t.Fatal("residual approval enabled grants", res)
+	}
+	if _, err := os.Stat(filepath.Join(p.StateDir, "grants.json")); !os.IsNotExist(err) {
+		t.Fatal("authority initialized against residual snapshot", err)
+	}
+	if err := finalizeStart(p.Client, lifecycle.Epoch); err != nil {
+		t.Fatal(err)
+	}
+	if res := grantVMCall(t, p, "prepare", args); res.Code != "" || res.Intent == nil {
+		t.Fatal("durable activation handoff fenced authority", res)
+	}
+}

package/templates/native-go/backend/internal/helper/jobcontract/bindings.go

@@ -0,0 +1,48 @@
+package jobcontract
+
+import (
+	"crypto/sha256"
+	"embed"
+	"encoding/binary"
+	"encoding/hex"
+)
+
+// Source-backed schema fingerprints deliberately overbind the S0 validator,
+// decoder and types. A semantic change cannot silently keep a version label.
+// Test files are excluded. Keep the file lists in sync with worker-registry.ts.
+//
+//go:embed decode.go digest.go types.go validate.go result.go stub.go
+var bindingSources embed.FS
+
+type WorkerSourceBindings struct {
+	HandlerBinding     string
+	InputSchemaDigest  string
+	OutputSchemaDigest string
+}
+
+var compiledSourceBindings = WorkerSourceBindings{
+	HandlerBinding:     sourceDigest("handler", "stub.go"),
+	InputSchemaDigest:  sourceDigest("input", "decode.go", "digest.go", "types.go", "validate.go"),
+	OutputSchemaDigest: sourceDigest("result", "decode.go", "result.go", "types.go", "validate.go"),
+}
+
+func CompiledBindings() WorkerSourceBindings { return compiledSourceBindings }
+
+// SHA256(domain NUL, then u32be name length/name and u32be bytes length/bytes).
+func sourceDigest(kind string, names ...string) string {
+	h := sha256.New()
+	h.Write([]byte("synopkgland/m3/" + kind + "/source-v1\x00"))
+	for _, name := range names {
+		b, err := bindingSources.ReadFile(name)
+		if err != nil {
+			panic("missing compiled worker source")
+		}
+		for _, chunk := range [][]byte{[]byte(name), b} {
+			var n [4]byte
+			binary.BigEndian.PutUint32(n[:], uint32(len(chunk)))
+			h.Write(n[:])
+			h.Write(chunk)
+		}
+	}
+	return hex.EncodeToString(h.Sum(nil))
+}