@synopackageland/cli 0.4.0 → 0.5.0

package/templates/native-go/backend/internal/helper/s1r_actor_fixture_linux_test.go

@@ -0,0 +1,184 @@
+package helper
+
+// Disposable Linux VM fixtures only. No account lookup or ACL adapter is
+// installed into the shipped helper, and no business FD is opened by the parent.
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"os/exec"
+	"runtime"
+	"strings"
+	"syscall"
+	"testing"
+	"time"
+
+	"golang.org/x/sys/unix"
+)
+
+const (
+	s1rAlice    = 23001
+	s1rBob      = 23002
+	s1rAliceGID = 24001
+	s1rBobGID   = 24002
+	s1rShared   = 24003
+	s1rExtra    = 24004
+)
+
+func s1rMust(t *testing.T, err error) {
+	t.Helper()
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
+func s1rACL(t *testing.T, path, acl string) {
+	t.Helper()
+	b, err := exec.Command("/usr/bin/setfacl", "-m", acl, path).CombinedOutput()
+	if err != nil {
+		t.Fatalf("setfacl %s: %v %s", path, err, b)
+	}
+}
+
+func s1rFixture(t *testing.T) string {
+	t.Helper()
+	root, err := os.MkdirTemp("/tmp", "s1r-vm-")
+	s1rMust(t, err)
+	t.Cleanup(func() { s1rMust(t, os.RemoveAll(root)) })
+	s1rMust(t, os.Chmod(root, 0755))
+	for _, name := range []string{"alice", "bob", "supplementary", "acl-allow", "acl-mask", "acl-file-mask", "acl-group", "acl-group-mask", "inherit", "readonly", "race"} {
+		dir := root + "/" + name
+		s1rMust(t, os.Mkdir(dir, 0700))
+		s1rMust(t, os.WriteFile(dir+"/file", []byte("canary:"+name), 0600))
+	}
+	for _, p := range []struct {
+		name     string
+		uid, gid int
+	}{{"alice", s1rAlice, s1rAliceGID}, {"bob", s1rBob, s1rBobGID}, {"race", s1rAlice, s1rAliceGID}} {
+		for _, path := range []string{root + "/" + p.name, root + "/" + p.name + "/file"} {
+			s1rMust(t, os.Chown(path, p.uid, p.gid))
+		}
+	}
+	for _, path := range []string{root + "/supplementary", root + "/supplementary/file"} {
+		s1rMust(t, os.Chown(path, 0, s1rShared))
+	}
+	s1rMust(t, unix.Chmod(root+"/supplementary", 02770))
+	s1rMust(t, os.Chmod(root+"/supplementary/file", 0660))
+	for _, name := range []string{"acl-allow", "acl-file-mask", "inherit"} {
+		s1rACL(t, root+"/"+name, fmt.Sprintf("u:%d:rwx,m::rwx", s1rAlice))
+		s1rACL(t, root+"/"+name+"/file", fmt.Sprintf("u:%d:rw-,m::rw-", s1rAlice))
+	}
+	s1rACL(t, root+"/acl-mask", fmt.Sprintf("u:%d:rwx,m::---", s1rAlice))
+	s1rACL(t, root+"/acl-mask/file", fmt.Sprintf("u:%d:rw-,m::---", s1rAlice))
+	s1rACL(t, root+"/acl-file-mask/file", "m::---")
+	for _, name := range []string{"acl-group", "acl-group-mask"} {
+		s1rACL(t, root+"/"+name, fmt.Sprintf("g:%d:rwx,m::rwx", s1rShared))
+		s1rACL(t, root+"/"+name+"/file", fmt.Sprintf("g:%d:rw-,m::rw-", s1rShared))
+	}
+	s1rACL(t, root+"/acl-group-mask", "m::r-x")
+	s1rACL(t, root+"/acl-group-mask/file", "m::r--")
+	s1rACL(t, root+"/inherit", fmt.Sprintf("u:%d:r-x,d:u::rwx,d:u:%d:rwx,d:u:%d:r-x,d:g::---,d:m::rwx,d:o::---", s1rBob, s1rAlice, s1rBob))
+	s1rACL(t, root+"/inherit/file", fmt.Sprintf("u:%d:r--,m::rw-", s1rBob))
+	s1rMust(t, os.Chmod(root+"/readonly", 0555))
+	s1rMust(t, os.Chmod(root+"/readonly/file", 0444))
+	return root
+}
+
+type s1rActorSpec struct {
+	UID, GID       uint32
+	Groups         []uint32
+	Root, Scenario string
+}
+
+// Run a fresh test process as root, invoke the REAL permanent drop routine, and
+// proxy ONLY mount metadata using the production packet/FD routines. The parent
+// pins the child's proc directory before permitting its credential transition.
+func s1rRunActor(t *testing.T, spec s1rActorSpec) {
+	t.Helper()
+	pair, err := syscall.Socketpair(syscall.AF_UNIX, syscall.SOCK_SEQPACKET|syscall.SOCK_CLOEXEC, 0)
+	s1rMust(t, err)
+	left := os.NewFile(uintptr(pair[0]), "s1r-parent")
+	right := os.NewFile(uintptr(pair[1]), "s1r-child")
+	defer left.Close()
+	defer right.Close()
+	control, err := operationSocket(left)
+	s1rMust(t, err)
+	defer control.Close()
+	s1rMust(t, enableCredentials(control))
+	exe, err := os.Executable()
+	s1rMust(t, err)
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+	cmd := exec.CommandContext(ctx, exe, "-test.run=^TestS1RActorProcess$", "-test.v")
+	b, err := json.Marshal(spec)
+	s1rMust(t, err)
+	cmd.Env = append(os.Environ(), "S1R_ACTOR_SPEC="+string(b))
+	cmd.ExtraFiles = []*os.File{right}
+	// Deliberately inherit unrelated/root/supplementary groups. The production
+	// Setgroups call must replace these, including when the requested set is empty.
+	cmd.SysProcAttr = &syscall.SysProcAttr{Credential: &syscall.Credential{Uid: 0, Gid: 0, Groups: []uint32{0, s1rShared, 24005}}}
+	var out bytes.Buffer
+	cmd.Stdout = &out
+	cmd.Stderr = &out
+	s1rMust(t, cmd.Start())
+	defer func() {
+		if cmd.ProcessState == nil {
+			cmd.Process.Kill()
+			cmd.Wait()
+		}
+	}()
+	info, err := openOperationFDInfo(cmd.Process.Pid)
+	s1rMust(t, err)
+	defer info.Close()
+	s1rMust(t, writeOperationPacket(control, true))
+	done := make(chan error, 1)
+	go func() {
+		var sequence uint64
+		for {
+			var packet readOnlyPacket
+			cred, err := readOperationPacketBound(control, &packet, MaxControlBytes, 30*time.Second)
+			if err != nil {
+				done <- nil
+				return
+			} // process exit closes the private socket
+			if cred == nil || int(cred.Pid) != cmd.Process.Pid || cred.Uid != spec.UID || cred.Gid != spec.GID || packet.Token != strings.Repeat("a", 64) || packet.MountFD == nil || packet.MountSequence != sequence+1 {
+				done <- fmt.Errorf("invalid actor mount query")
+				return
+			}
+			sequence++
+			id, code := operationFDInfoMount(info, *packet.MountFD)
+			if err := writeOperationPacket(control, readOnlyMountReply{Token: packet.Token, Sequence: sequence, Mount: id, Code: code}); err != nil {
+				done <- err
+				return
+			}
+		}
+	}()
+	err = cmd.Wait()
+	control.Close()
+	proxyErr := <-done
+	if err != nil || proxyErr != nil {
+		t.Fatalf("actor %s: %v proxy=%v\n%s", spec.Scenario, err, proxyErr, out.String())
+	}
+	t.Log(out.String())
+}
+
+func s1rDropActor(t *testing.T, spec s1rActorSpec) {
+	t.Helper()
+	runtime.LockOSThread() // like operationChildLinux; subprocess exits when finished
+	f := os.NewFile(3, "s1r-control")
+	defer f.Close()
+	control, err := operationSocket(f)
+	s1rMust(t, err)
+	t.Cleanup(func() { control.Close() })
+	var ready bool
+	_, err = readOperationPacketBound(control, &ready, MaxHealthBytes, 5*time.Second)
+	s1rMust(t, err)
+	if !ready {
+		t.Fatal("parent did not pin proc witness")
+	}
+	boot := operationBootstrap{UID: spec.UID, GID: spec.GID, Groups: spec.Groups, Token: strings.Repeat("a", 64)}
+	s1rMust(t, dropOperationCredentials(os.Getppid(), boot))
+	operationMountIDFallback = operationMountIDProxy(control, boot)
+}

package/templates/native-go/backend/internal/helper/s1r_actor_races_linux_test.go

@@ -0,0 +1,250 @@
+package helper
+
+import (
+	"context"
+	"errors"
+	"os"
+	"strings"
+	"testing"
+
+	"golang.org/x/sys/unix"
+)
+
+func s1rActorRaces(t *testing.T, spec s1rActorSpec, kind string) {
+	root := spec.Root + "/race"
+	pin, code := pinReadOnlyRoot(root)
+	if code != "" {
+		t.Fatal(code)
+	}
+	defer pin.Close()
+	ctx := context.Background()
+	switch kind {
+	case "symlink":
+		for _, link := range []struct{ name, target string }{{"inside-link", "file"}, {"outside-link", "../bob/file"}, {"dir-link", "../bob"}} {
+			s1rMust(t, os.Symlink(link.target, root+"/"+link.name))
+		}
+		for _, action := range []Action{ActionStat, ActionRead, ActionList, ActionReadStream} {
+			segments := []string{"outside-link"}
+			if action == ActionList {
+				segments = []string{"dir-link"}
+			}
+			work := readWork(pin, segments...)
+			work.Action = action
+			if action == ActionList {
+				work.MaxBytes = 0
+				work.Limit = 20
+			}
+			if action == ActionStat {
+				work.MaxBytes = 0
+			}
+			if action == ActionReadStream {
+				x, r := openActorReadTransfer(ctx, pin, work, fixtureReadOnlyACL{})
+				if x != nil {
+					x.Close()
+				}
+				if r.Code != ErrDenied || r.Bytes != 0 {
+					t.Fatal("symlink stream", r)
+				}
+			} else {
+				r, b := executeReadOnly(ctx, pin, work, fixtureReadOnlyACL{})
+				if r.Code != ErrDenied || len(b) > 0 || r.Entry != nil || r.List != nil {
+					t.Fatal("symlink metadata/read", action, r)
+				}
+			}
+		}
+		r, b := executeReadOnly(ctx, pin, readWork(pin, "inside-link"), fixtureReadOnlyACL{})
+		if r.Code != ErrDenied || len(b) > 0 {
+			t.Fatal("internal symlink followed", r)
+		}
+		r, _ = executeReadOnly(ctx, pin, readOnlyWork{RootPath: root, Action: ActionList, Segments: []string{}, Limit: 20}, fixtureReadOnlyACL{})
+		if r.Code != "" || r.List == nil || len(r.List.Entries) != 1 || r.List.Entries[0].Name != "file" {
+			t.Fatal("symlink names leaked by list", r)
+		}
+		for _, segments := range [][]string{{"outside-link"}, {"dir-link", "new"}} {
+			x, c := openActorWriteTransfer(ctx, pin, writeWork{RootPath: root, Action: ActionCreate, Segments: segments, MaxBytes: 3}, fixtureReadOnlyACL{})
+			if x != nil {
+				x.Close()
+			}
+			if c != ErrDenied {
+				t.Fatal("symlink create", c)
+			}
+		}
+		t.Log("stat/list/read/stream/create reject symlinks; list filters symlink names")
+	case "stat-rename", "list-rename", "read-rename":
+		s1rMust(t, os.Mkdir(root+"/sub", 0700))
+		s1rMust(t, os.WriteFile(root+"/sub/file", []byte("original"), 0600))
+		mutated := false
+		acl := fixtureReadOnlyACL{hook: func() {
+			if mutated {
+				return
+			}
+			mutated = true
+			s1rMust(t, os.Rename(root+"/sub", root+"/moved"))
+			s1rMust(t, os.Mkdir(root+"/sub", 0700))
+			s1rMust(t, os.WriteFile(root+"/sub/file", []byte("foreign"), 0600))
+		}}
+		work := readWork(pin, "sub", "file")
+		if kind == "stat-rename" {
+			work.Action = ActionStat
+			work.MaxBytes = 0
+		}
+		if kind == "list-rename" {
+			work.Action = ActionList
+			work.MaxBytes = 0
+			work.Segments = []string{"sub"}
+			work.Limit = 20
+		}
+		r, b := executeReadOnly(ctx, pin, work, acl)
+		if r.Code != ErrStale || len(b) != 0 || r.Entry != nil || r.List != nil {
+			t.Fatal("renamed ancestry released bytes", r, string(b))
+		}
+		t.Log(kind + ": replacement after resolver open refuses bytes and metadata with stale")
+	case "stream-rename":
+		work := readWork(pin, "file")
+		work.Action = ActionReadStream
+		x, r := openActorReadTransfer(ctx, pin, work, fixtureReadOnlyACL{})
+		if r.Code != "" {
+			t.Fatal(r)
+		}
+		defer x.Close()
+		b, c := x.ReadChunk(ctx, 3)
+		if c != "" || string(b) != "can" {
+			t.Fatal(c, string(b))
+		}
+		s1rMust(t, os.Rename(root+"/file", root+"/old"))
+		s1rMust(t, os.Symlink("../bob/file", root+"/file"))
+		b, c = x.ReadChunk(ctx, 3)
+		if c != ErrDenied || len(b) != 0 {
+			t.Fatal("stream followed replacement", c, string(b))
+		}
+		t.Log("first fixed-FD stream chunk succeeds; symlink replacement refuses next chunk")
+	case "create-rename", "publish-rename", "publish-symlink":
+		s1rMust(t, os.Mkdir(root+"/sub", 0700))
+		staged := kind != "create-rename"
+		work := writeWork{RootPath: root, Action: ActionCreate, Segments: []string{"sub", "result"}, MaxBytes: 6}
+		if staged {
+			work.Action = ActionWriteStream
+			work.Staged = true
+		}
+		x, c := openActorWriteTransfer(ctx, pin, work, fixtureReadOnlyACL{})
+		if c != "" {
+			t.Fatal(c)
+		}
+		defer x.Close()
+		receipt, c := x.WriteChunk(ctx, []byte("abc"))
+		if c != "" || receipt.BytesWritten != 3 {
+			t.Fatal(receipt, c)
+		}
+		if kind == "publish-symlink" {
+			s1rMust(t, os.Symlink("../file", root+"/sub/result"))
+			receipt, c = x.Commit(ctx)
+			if c != ErrDenied || receipt.Published || receipt.Committed {
+				t.Fatal("publish replaced symlink", receipt, c)
+			}
+			target, e := os.Readlink(root + "/sub/result")
+			s1rMust(t, e)
+			if target != "../file" {
+				t.Fatal(target)
+			}
+		} else {
+			s1rMust(t, os.Rename(root+"/sub", root+"/moved"))
+			s1rMust(t, os.Mkdir(root+"/sub", 0700))
+			s1rMust(t, os.WriteFile(root+"/sub/result", []byte("foreign"), 0600))
+			if staged {
+				receipt, c = x.Commit(ctx)
+				if c != ErrStale || receipt.Published {
+					t.Fatal("publish after rename", receipt, c)
+				}
+			} else {
+				receipt, c = x.WriteChunk(ctx, []byte("def"))
+				if c != ErrPartial || receipt.BytesWritten != 3 {
+					t.Fatal("write after rename", receipt, c)
+				}
+			}
+			b, e := os.ReadFile(root + "/sub/result")
+			s1rMust(t, e)
+			if string(b) != "foreign" {
+				t.Fatal("foreign destination overwritten", string(b))
+			}
+			if staged {
+				if _, e := os.Stat(root + "/moved/result"); !os.IsNotExist(e) {
+					t.Fatal("anonymous stage became visible", e)
+				}
+			} else {
+				b, e = os.ReadFile(root + "/moved/result")
+				s1rMust(t, e)
+				if string(b) != "abc" {
+					t.Fatal("partial bytes changed", string(b))
+				}
+			}
+		}
+		t.Logf("%s: refusal=%s receipt=%+v; foreign destination preserved", kind, c, receipt)
+	case "publish-permission-loss":
+		work := writeWork{RootPath: root, Action: ActionWriteStream, Segments: []string{"result"}, MaxBytes: 3, Staged: true}
+		x, c := openActorWriteTransfer(ctx, pin, work, fixtureReadOnlyACL{})
+		if c != "" {
+			t.Fatal(c)
+		}
+		defer x.Close()
+		_, c = x.WriteChunk(ctx, []byte("abc"))
+		if c != "" {
+			t.Fatal(c)
+		}
+		s1rMust(t, os.Chmod(root, 0500))
+		defer os.Chmod(root, 0700)
+		r, c := x.Commit(ctx)
+		if c != ErrDenied || !r.Created || r.Published || r.Committed || r.BytesWritten != 3 {
+			t.Fatal("publish after parent chmod", r, c)
+		}
+		if _, e := os.Stat(root + "/result"); !os.IsNotExist(e) {
+			t.Fatal("publish wrote forbidden directory", e)
+		}
+		var st unix.Stat_t
+		s1rMust(t, unix.Fstat(int(x.file.Fd()), &st))
+		if st.Nlink != 0 || st.Size != 3 {
+			t.Fatal("anonymous stage changed after denial", st.Nlink, st.Size)
+		}
+		if retry, code := x.Commit(ctx); code != ErrReplay || retry != r {
+			t.Fatal("denied publish replay changed receipt", retry, code)
+		}
+		x.Close()
+		x.Close()
+		if _, e := x.file.Stat(); !errors.Is(e, os.ErrClosed) {
+			t.Fatal("stage descriptor still open", e)
+		}
+		entries, e := os.ReadDir(root)
+		s1rMust(t, e)
+		if len(entries) != 1 || entries[0].Name() != "file" {
+			t.Fatal("denied publish left a named stage", entries)
+		}
+		t.Log("parent write permission removed: publish denied; staged bytes and receipt retained; close leaves no named stage")
+	case "open-fd-write-permission-loss":
+		work := writeWork{RootPath: root, Action: ActionCreate, Segments: []string{"result"}, MaxBytes: 6}
+		x, c := openActorWriteTransfer(ctx, pin, work, fixtureReadOnlyACL{})
+		if c != "" {
+			t.Fatal(c)
+		}
+		defer x.Close()
+		r, c := x.WriteChunk(ctx, []byte("abc"))
+		if c != "" {
+			t.Fatal(c)
+		}
+		s1rMust(t, x.file.Chmod(0000))
+		defer x.file.Chmod(0600)
+		r, c = x.WriteChunk(ctx, []byte("def"))
+		if c != "" || r.BytesWritten != 6 {
+			t.Fatal("Linux open-FD semantics", r, c)
+		}
+		r, c = x.Commit(ctx)
+		if c != "" || !r.Committed {
+			t.Fatal(r, c)
+		}
+		b, e := os.ReadFile(root + "/result")
+		if !os.IsPermission(e) || len(b) != 0 {
+			t.Fatal("new open bypassed chmod", e, string(b))
+		}
+		t.Log("chmod 000 denies a new open; previously opened writer FD still writes/commits under Linux semantics")
+	default:
+		t.Fatal("unknown race", strings.TrimSpace(kind))
+	}
+}

package/templates/native-go/backend/internal/helper/s1r_fixture_contract_linux_test.go

@@ -0,0 +1,18 @@
+package helper
+
+import (
+	"os"
+	"testing"
+)
+
+func TestS1RFixtureContract(t *testing.T) {
+	if os.Geteuid() != 0 {
+		t.Skip("disposable root VM only")
+	}
+	root := s1rFixture(t)
+	for _, name := range []string{"alice", "bob", "supplementary", "acl-allow", "acl-mask", "acl-file-mask", "inherit", "readonly", "race"} {
+		if _, err := os.Stat(root + "/" + name + "/file"); err != nil {
+			t.Fatal(name, err)
+		}
+	}
+}

package/templates/native-go/backend/internal/helper/sdk_assembly_linux.go

@@ -0,0 +1,51 @@
+//go:build linux && synopkgland_sdk_workers
+
+package helper
+
+import (
+	"context"
+	"dsmapp/internal/dsm"
+	"dsmapp/internal/filestation"
+)
+
+type unavailableSDKValidator struct{}
+
+func (unavailableSDKValidator) ValidateJob(context.Context, NativeActor, sdkJobRequest, Grant, sdkJobCheckpoint) (sdkJobProof, Code) {
+	return sdkJobProof{}, ErrUnavailable
+}
+
+// The sole owner calls this once, after the authority's startup reconciliation.
+// Native/POSIX services stay unavailable. Production uses only session-authenticated
+// File Station requests; explicit native VM fixtures retain their own test seam.
+func openSDKJobs(c Client, binary string, s *supervisorGrants, repo *FileGrantRepository) (*sdkJobOwner, Code, string) {
+	if len(sdkCompiledRegistry) == 0 {
+		return nil, ErrUnavailable, "jobs-registry"
+	}
+	journal, code, stage := newSDKFileJobJournalDiagnostic(repo)
+	if code != "" {
+		return nil, code, stage
+	}
+	var validator sdkJobValidator = unavailableSDKValidator{}
+	if v, ok := s.services.consent.(sdkJobValidator); ok {
+		validator = v
+	}
+	o, code := newSDKJobOwner(s, sdkCompiledRegistry, sdkJobServices{Validator: validator, Journal: journal, Start: func(a NativeActor, b operationBinding, p sdkJobPlan) (sdkJobProcess, error) {
+		return startLinuxSDKJob(c, binary, a, b, p)
+	}})
+	if code != "" {
+		return nil, code, "jobs-owner"
+	}
+	// Reuse the same retained journal/index for revocation. No observer, validator,
+	// ready/consume loop or background child bootstrap is installed.
+	if _, code = newSDKBackgroundOwner(o, nil, nil, journal, newSDKEpochClock()); code != "" {
+		return nil, code, "background-index"
+	}
+	if _, nativeFixture := s.services.consent.(sdkJobValidator); !nativeFixture {
+		o.session, code = newSDKSessionJobs(o, filestation.Local("/var/packages/"+c.Expected.Package+"/var"), dsm.NewAuthenticator())
+		if code != "" {
+			return nil, code, "session-history"
+		}
+	}
+	newSDKJobViews(o)
+	return o, "", ""
+}

package/templates/native-go/backend/internal/helper/sdk_attach.go

@@ -0,0 +1,83 @@
+//go:build synopkgland_sdk_workers
+
+package helper
+
+import (
+	"context"
+	"time"
+)
+
+// Called only by the sole supervisor owner. The reference is bound to the
+// immutable job record; no persisted deadline can survive owner restart.
+func (o *sdkJobOwner) issueAttach(j *sdkJob) Code {
+	id, code := sdkRandomRef()
+	if code != "" {
+		return code
+	}
+	now := o.attachNow()
+	if now < 0 || now > time.Duration(1<<63-1)-sdkAttachTTL {
+		return ErrExpired
+	}
+	j.attach = &sdkAttachLease{id: id, principal: j.actor.Principal(), session: j.actor.SessionRef(), epoch: o.grants.cohort.epoch, last: now, deadline: now + sdkAttachTTL}
+	return ""
+}
+func (o *sdkJobOwner) attachExpired(j *sdkJob) bool {
+	a := j.attach
+	if a == nil || o.attachNow == nil {
+		return true
+	}
+	now := o.attachNow()
+	if a.denied || now < a.last || now >= a.deadline || a.epoch != o.grants.cohort.epoch {
+		a.denied = true
+		return true
+	}
+	a.last = now
+	return false
+}
+func (o *sdkJobOwner) renewAttach(ctx context.Context, carriers SessionCarriers, jobID, attachID string) Code {
+	j := o.jobs[jobID]
+	if j == nil || j.attach == nil || j.background != nil || !allReferences(attachID) || j.attach.id != attachID {
+		return ErrDenied
+	}
+	// Authenticate even denial paths, with no caller-selected identity or roles.
+	v := newSDKJobViews(o)
+	actor, code := v.actor(ctx, carriers)
+	if code != "" {
+		return code
+	}
+	if actor.Principal() != j.attach.principal || actor.SessionRef() != j.attach.session {
+		return ErrDenied
+	}
+	if j.terminal || j.failure != "" || j.receipt.Job.CancelRequested {
+		return ErrStale
+	}
+	expire := func() Code {
+		if code := o.cancelOwned(ctx, j); code != "" {
+			return code
+		}
+		return ErrExpired
+	}
+	if o.attachExpired(j) {
+		return expire()
+	}
+	if !o.grants.cohort.gate.allow(o.grants.cohort.now()) {
+		return ErrFenced
+	}
+	if code = v.budget(actor); code != "" {
+		return code
+	}
+	// Proof/budget work cannot renew a deadline which passed in the meantime.
+	if ctx.Err() != nil {
+		return nativeContextCode(ctx)
+	}
+	if o.attachExpired(j) {
+		return expire()
+	}
+	now := o.attachNow()
+	if now < j.attach.last || now >= j.attach.deadline || now > time.Duration(1<<63-1)-sdkAttachTTL {
+		j.attach.denied = true
+		return expire()
+	}
+	j.attach.last, j.attach.deadline = now, now+sdkAttachTTL
+	return ""
+}

package/templates/native-go/backend/internal/helper/sdk_attach_contract.go

@@ -0,0 +1,32 @@
+//go:build synopkgland_sdk_workers
+
+package helper
+
+import "time"
+
+// S7 interactive liveness: these are independent of worker total/checkpoint
+// deadlines. The owner holds the monotonic deadline only in this process.
+const sdkAttachRenewInterval = 2 * time.Second
+const sdkAttachTTL = 6 * time.Second
+
+const SDKAttachRenewMS = int64(sdkAttachRenewInterval / time.Millisecond)
+const SDKAttachTTLMS = int64(sdkAttachTTL / time.Millisecond)
+
+type sdkAttachLease struct {
+	id        string
+	principal Principal
+	session   string
+	epoch     string
+	deadline  time.Duration
+	last      time.Duration
+	denied    bool
+}
+
+// Public lease reference is an index, never a bearer authentication credential.
+type sdkAttachReceipt struct {
+	JobID        string `json:"jobId"`
+	Revision     uint64 `json:"revision"`
+	AttachID     string `json:"attachId"`
+	RenewAfterMS int64  `json:"renewAfterMs"`
+	TTLMS        int64  `json:"ttlMs"`
+}