@synopackageland/cli 0.4.0 → 0.5.0

package/templates/native-go/backend/internal/helper/sdk_job_vm_linux_test.go

@@ -0,0 +1,343 @@
+//go:build linux && synopkgland_sdk_workers
+
+package helper
+
+import (
+	"bytes"
+	"context"
+	"crypto/sha256"
+	"dsmapp/internal/helper/jobcontract"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"syscall"
+	"testing"
+	"time"
+)
+
+const sdkTestVMRoot = "/tmp/m3-sdk-jobs"
+
+type sdkVMTestCommand struct {
+	Op      string `json:"op"`
+	Plan    string `json:"plan"`
+	JobID   string `json:"jobId"`
+	Foreign bool   `json:"foreign"`
+}
+type sdkVMTestResponse struct {
+	Code     Code          `json:"code"`
+	Job      sdkJobReceipt `json:"job"`
+	Started  uint64        `json:"started"`
+	Reaped   uint64        `json:"reaped"`
+	Children int           `json:"children"`
+}
+
+func sdkJobVMFixture(t *testing.T, source string) LinuxProcesses {
+	t.Helper()
+	if os.Getenv("M3_S2_FIXTURE") == "" {
+		t.Skip("NIC-free S2 root VM")
+	}
+	if source == "" {
+		source = os.Getenv("M3_S2_FIXTURE")
+	}
+	digest, err := executableDigest(source)
+	if err != nil {
+		t.Fatal(err)
+	}
+	registryPath := "/sdk-registry.json"
+	if _, err := os.Stat(source + "-registry.json"); err == nil {
+		registryPath = source + "-registry.json"
+	}
+	registry, err := os.ReadFile(registryPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	sum := sha256.Sum256(registry)
+	i := Inventory{Package: "root", Version: "1.0.0-0001", Protocol: 2, PayloadDigest: digest, RegistryDigest: hex.EncodeToString(sum[:]), DataAccess: "relaxed"}
+	if source == "/helper-fixture" {
+		i.Protocol = 1
+		i.DataAccess = ""
+		i.RegistryDigest = strings.Repeat("b", 64)
+	}
+	c := NewClient(i)
+	for _, dir := range []string{c.StateDir, c.RunDir, sdkTestVMRoot} {
+		if err := os.Mkdir(dir, 0700); err != nil {
+			t.Fatal(err)
+		}
+		t.Cleanup(func() { os.RemoveAll(dir) })
+	}
+	if err := os.Chmod(sdkTestVMRoot, 0755); err != nil {
+		t.Fatal(err)
+	}
+	file := sdkTestVMRoot + "/group"
+	if err := os.WriteFile(file, bytes.Repeat([]byte("group-only;"), 800), 0640); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Chown(file, 0, 105); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(sdkTestVMRoot+"/denied", []byte("root-only-canary"), 0600); err != nil {
+		t.Fatal(err)
+	}
+	binary := filepath.Join(c.StateDir, "payload-"+digest)
+	data, err := os.ReadFile(source)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err = os.WriteFile(binary, data, 0700); err != nil {
+		t.Fatal(err)
+	}
+	vmUnit(t, "start")
+	return LinuxProcesses{Client: c, Binary: binary}
+}
+func sdkVMCall(t *testing.T, p LinuxProcesses, cmd sdkVMTestCommand) sdkVMTestResponse {
+	t.Helper()
+	os.Remove(p.RunDir + "/sdk-response")
+	data, _ := json.Marshal(cmd)
+	if err := os.WriteFile(p.RunDir+"/sdk-command", data, 0600); err != nil {
+		t.Fatal(err)
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 4*time.Second)
+	defer cancel()
+	var res sdkVMTestResponse
+	if err := waitHealthy(ctx, func(context.Context) bool {
+		data, err := os.ReadFile(p.RunDir + "/sdk-response")
+		return err == nil && json.Unmarshal(data, &res) == nil
+	}); err != nil {
+		record, _ := readRecord(p.StateDir, 0)
+		t.Fatalf("SDK fixture command %s timed out; lifecycle=%+v", cmd.Op, record.Lifecycle)
+	}
+	return res
+}
+func sdkVMWaitJob(t *testing.T, p LinuxProcesses, id string, want func(sdkVMTestResponse) bool) sdkVMTestResponse {
+	t.Helper()
+	ctx, cancel := context.WithTimeout(context.Background(), 6*time.Second)
+	defer cancel()
+	var res sdkVMTestResponse
+	if err := waitHealthy(ctx, func(context.Context) bool {
+		res = sdkVMCall(t, p, sdkVMTestCommand{Op: "status", JobID: id})
+		return want(res)
+	}); err != nil {
+		t.Fatalf("job did not reach expected state: %+v", res)
+	}
+	return res
+}
+func sdkVMSubmit(t *testing.T, p LinuxProcesses, plan string) string {
+	t.Helper()
+	r := sdkVMCall(t, p, sdkVMTestCommand{Op: "submit", Plan: plan})
+	if r.Code != "" || r.Job.Job.Binding.Job.ID == "" {
+		t.Fatalf("submit: %+v", r)
+	}
+	return r.Job.Job.Binding.Job.ID
+}
+func TestLinuxSDKProductionDefaultAndTaggedRefuseUntrustedChild(t *testing.T) {
+	for _, source := range []string{"/helper-fixture", "/helper-sdk-production"} {
+		t.Run(filepath.Base(source), func(t *testing.T) {
+			p := sdkJobVMFixture(t, source)
+			cmd := exec.Command(p.Binary, "sdk-job-child")
+			output, err := cmd.CombinedOutput()
+			if err == nil || !bytes.Contains(output, []byte("helper lifecycle refused")) {
+				t.Fatalf("production dispatched or wrong refusal: %v %s", err, output)
+			}
+			if _, err := os.Stat(p.RunDir + "/supervisor.sock"); !os.IsNotExist(err) {
+				t.Fatal("production job action created supervisor")
+			}
+		})
+	}
+}
+func TestLinuxSDKJobDirectChildCredentialsCheckpointResultAndReap(t *testing.T) {
+	p := sdkJobVMFixture(t, "")
+	proc := startVMHelper(t, p)
+	if err := os.WriteFile(sdkTestVMRoot+"/hold", nil, 0600); err != nil {
+		t.Fatal(err)
+	}
+	id := sdkVMSubmit(t, p, "all")
+	sdkVMWaitJob(t, p, id, func(r sdkVMTestResponse) bool { return r.Job.Job.State == jobcontract.Running })
+	children := processChildren(proc.PID)
+	if len(children) != 2 {
+		t.Fatalf("job is not one direct child beside helper: %v", children)
+	}
+	child := supervisedPIDByMode(t, proc.PID, "sdk-job-child")
+	status, err := os.ReadFile(fmt.Sprintf("/proc/%d/status", child))
+	if err != nil {
+		t.Fatal(err)
+	}
+	// Credential-ready also requires the child's actual PR_GET_NO_NEW_PRIVS
+	// readback. The additional proc field is unavailable in the 4.4 fixture.
+	if !statusHasCredentials(status, 1001, 100, []uint32{101, 105}) || !bytes.Contains(status, []byte("CapEff:\t0000000000000000")) || bytes.Contains(status, []byte("NoNewPrivs:")) && !bytes.Contains(status, []byte("NoNewPrivs:\t1")) {
+		t.Fatalf("credentials not permanent/complete: %s", status)
+	}
+	os.Remove(sdkTestVMRoot + "/hold")
+	r := sdkVMWaitJob(t, p, id, func(r sdkVMTestResponse) bool { return r.Job.Job.FinishedAt != nil })
+	if r.Job.Job.State != jobcontract.Succeeded || !r.Job.Job.Drained || r.Job.Result == nil || r.Job.Result.CompletedSteps != 4 || r.Job.Result.BytesRead != 17600 || r.Started != 1 || r.Reaped != 1 || r.Children != 0 {
+		t.Fatalf("invalid completion: %+v", r)
+	}
+	if _, err := os.Stat(fmt.Sprintf("/proc/%d", child)); !os.IsNotExist(err) {
+		t.Fatal("receipt before actual Wait4")
+	}
+	data, err := os.ReadFile(p.StateDir + "/sdk-receipt-" + id + ".json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if bytes.Contains(data, []byte("group-only")) || bytes.Contains(data, []byte("root-only-canary")) || bytes.Contains(data, []byte("sdk-vm-only")) {
+		t.Fatal("file contents or carriers leaked")
+	}
+	var receipt sdkJobReceipt
+	if json.Unmarshal(data, &receipt) != nil || !receipt.Job.Drained {
+		t.Fatal("missing durable terminal receipt")
+	}
+}
+func TestLinuxSDKJobForeignPeerBusyBootstrapAndCancel(t *testing.T) {
+	p := sdkJobVMFixture(t, "")
+	proc := startVMHelper(t, p)
+	r := sdkVMCall(t, p, sdkVMTestCommand{Op: "submit", Foreign: true})
+	if r.Code != ErrDenied || r.Started != 0 {
+		t.Fatal("foreign peer spawned", r)
+	}
+	os.WriteFile(sdkTestVMRoot+"/slow-bootstrap", nil, 0600)
+	first := sdkVMSubmit(t, p, "read")
+	second := sdkVMSubmit(t, p, "read")
+	r = sdkVMCall(t, p, sdkVMTestCommand{Op: "submit", Plan: "read"})
+	if r.Code != ErrBusy || r.Started != 2 {
+		t.Fatalf("bootstrap bypassed slots: %+v", r)
+	}
+	r = sdkVMCall(t, p, sdkVMTestCommand{Op: "status", JobID: first})
+	if r.Job.Job.State == jobcontract.Running {
+		t.Fatal("running before credential-ready")
+	}
+	os.Remove(sdkTestVMRoot + "/slow-bootstrap")
+	for _, id := range []string{first, second} {
+		sdkVMWaitJob(t, p, id, func(r sdkVMTestResponse) bool { return r.Job.Job.FinishedAt != nil })
+	}
+	if len(processChildren(proc.PID)) != 1 {
+		t.Fatal("bootstrap children not reaped")
+	}
+	os.WriteFile(sdkTestVMRoot+"/hold", nil, 0600)
+	id := sdkVMSubmit(t, p, "read")
+	sdkVMWaitJob(t, p, id, func(r sdkVMTestResponse) bool { return r.Job.Job.State == jobcontract.Running })
+	r = sdkVMCall(t, p, sdkVMTestCommand{Op: "cancel", JobID: id})
+	if r.Code != "" || r.Job.Job.State != jobcontract.Canceled || !r.Job.Job.Drained || r.Children != 0 {
+		t.Fatalf("cancel lacked real Q: %+v", r)
+	}
+	id = sdkVMSubmit(t, p, "read")
+	sdkVMWaitJob(t, p, id, func(r sdkVMTestResponse) bool { return r.Job.Job.State == jobcontract.Running })
+	os.WriteFile(sdkTestVMRoot+"/logout", nil, 0600)
+	r = sdkVMCall(t, p, sdkVMTestCommand{Op: "disconnect", JobID: id})
+	if r.Code != "" || r.Job.Job.State != jobcontract.Canceled || !r.Job.Job.Drained {
+		t.Fatalf("EOF required fresh login to stop child: %+v", r)
+	}
+}
+
+func TestLinuxSDKJobParentRevokeDrainsAllDerivedChildren(t *testing.T) {
+	p := sdkJobVMFixture(t, "")
+	proc := startVMHelper(t, p)
+	os.WriteFile(sdkTestVMRoot+"/hold", nil, 0600)
+	first := sdkVMSubmit(t, p, "read")
+	second := sdkVMSubmit(t, p, "read")
+	for _, id := range []string{first, second} {
+		sdkVMWaitJob(t, p, id, func(r sdkVMTestResponse) bool { return r.Job.Job.State == jobcontract.Running })
+	}
+	r := sdkVMCall(t, p, sdkVMTestCommand{Op: "revoke"})
+	if r.Code != "" || r.Started != 2 || r.Reaped != 2 || r.Children != 0 {
+		t.Fatalf("parent R did not use common Q: %+v", r)
+	}
+	if len(processChildren(proc.PID)) != 1 {
+		t.Fatal("derived child survived parent revocation")
+	}
+	for _, id := range []string{first, second} {
+		r = sdkVMWaitJob(t, p, id, func(r sdkVMTestResponse) bool { return r.Job.Job.FinishedAt != nil })
+		if r.Job.Job.State == jobcontract.Succeeded || r.Job.Result != nil {
+			t.Fatal("revoked job returned result")
+		}
+	}
+}
+func TestLinuxSDKJobRefusesActorACLAndMalformedProgress(t *testing.T) {
+	for _, kind := range []string{"denied", "bad-progress", "logout", "groups-changed", "acl-denied", "finish-fsync-fail"} {
+		t.Run(kind, func(t *testing.T) {
+			p := sdkJobVMFixture(t, "")
+			startVMHelper(t, p)
+			if kind == "bad-progress" || kind == "finish-fsync-fail" {
+				os.WriteFile(sdkTestVMRoot+"/"+kind, nil, 0600)
+			}
+			if kind == "logout" || kind == "groups-changed" || kind == "acl-denied" {
+				os.WriteFile(sdkTestVMRoot+"/hold", nil, 0600)
+			}
+			plan := "read"
+			if kind == "denied" {
+				plan = "denied"
+			}
+			id := sdkVMSubmit(t, p, plan)
+			if kind == "logout" || kind == "groups-changed" || kind == "acl-denied" {
+				sdkVMWaitJob(t, p, id, func(r sdkVMTestResponse) bool { return r.Job.Job.State == jobcontract.Running })
+				os.WriteFile(sdkTestVMRoot+"/"+kind, nil, 0600)
+				os.Remove(sdkTestVMRoot + "/hold")
+			}
+			if kind == "finish-fsync-fail" {
+				ctx, cancel := context.WithTimeout(context.Background(), 4*time.Second)
+				defer cancel()
+				if err := waitHealthy(ctx, func(context.Context) bool {
+					r, e := readRecord(p.StateDir, 0)
+					return e == nil && r.Lifecycle != nil && r.Lifecycle.Reason == "sdk-job-journal-uncertain"
+				}); err != nil {
+					t.Fatal("journal failure did not fence shared authority", err)
+				}
+				if _, err := os.Stat(p.StateDir + "/sdk-receipt-" + id + ".json"); !os.IsNotExist(err) {
+					t.Fatal("uncertain job has terminal receipt", err)
+				}
+				return
+			}
+			r := sdkVMWaitJob(t, p, id, func(r sdkVMTestResponse) bool {
+				return r.Job.Job.FinishedAt != nil || r.Job.Job.State == jobcontract.CleanupRequired
+			})
+			if r.Job.Job.State == jobcontract.Succeeded || r.Job.Result != nil {
+				t.Fatalf("unsafe success: %+v", r)
+			}
+		})
+	}
+}
+func TestLinuxSDKJobHelperDeathObserverStopAndParentDeath(t *testing.T) {
+	for _, kind := range []string{"helper-death", "unit-stop", "supervisor-death"} {
+		t.Run(kind, func(t *testing.T) {
+			p := sdkJobVMFixture(t, "")
+			proc := startVMHelper(t, p)
+			os.WriteFile(sdkTestVMRoot+"/hold", nil, 0600)
+			id := sdkVMSubmit(t, p, "read")
+			sdkVMWaitJob(t, p, id, func(r sdkVMTestResponse) bool { return r.Job.Job.State == jobcontract.Running })
+			child := supervisedPIDByMode(t, proc.PID, "sdk-job-child")
+			switch kind {
+			case "helper-death":
+				syscall.Kill(supervisedPIDByMode(t, proc.PID, "serve-child"), syscall.SIGKILL)
+			case "unit-stop":
+				vmUnit(t, "stop")
+			case "supervisor-death":
+				syscall.Kill(proc.PID, syscall.SIGKILL)
+			}
+			waitPIDExit(t, child)
+			if kind == "supervisor-death" {
+				r, err := readRecord(p.StateDir, 0)
+				if err != nil {
+					t.Fatal(err)
+				}
+				if _, err = completionRecord(p.Client, r); err == nil {
+					t.Fatal("PDEATHSIG was fabricated as Q")
+				}
+			} else {
+				ctx, cancel := context.WithTimeout(context.Background(), 4*time.Second)
+				defer cancel()
+				if err := waitHealthy(ctx, func(context.Context) bool {
+					r, e := readRecord(p.StateDir, 0)
+					if e != nil {
+						return false
+					}
+					q, e := completionRecord(p.Client, r)
+					return e == nil && q.Cohort != nil && q.Cohort.Started == 1 && q.Cohort.Reaped == 1 && q.Cohort.RelaysStopped
+				}); err != nil {
+					t.Fatal("owner did not publish actual cohort Q")
+				}
+			}
+		})
+	}
+}

package/templates/native-go/backend/internal/helper/sdk_journal.go

@@ -0,0 +1,77 @@
+//go:build synopkgland_sdk_workers
+
+package helper
+
+import (
+	"bytes"
+	"dsmapp/internal/helper/jobcontract"
+	"encoding/json"
+)
+
+// Retained artifacts explain history, never authorize execution. The file
+// implementation belongs to the SAME FileGrantRepository and owner lock.
+type sdkRetainedJournal interface {
+	sdkJobJournal
+	Records() ([]sdkJournalRecord, Code)
+}
+type sdkJournalRecord struct {
+	Schema  int            `json:"schema"`
+	Intent  sdkJobIntent   `json:"intent"`
+	State   string         `json:"state"` // pending/canceled/finished/interrupted
+	Receipt *sdkJobReceipt `json:"receipt,omitempty"`
+}
+
+func decodeSDKJournal(b []byte) (sdkJournalRecord, Code) {
+	var r sdkJournalRecord
+	if c := decodeDataObject(bytes.NewReader(b), &r, jobcontract.MaxArtifactBytes); c != "" {
+		return r, c
+	}
+	if r.Schema != 1 {
+		return r, ErrIncompatible
+	}
+	i := r.Intent
+	bnd := i.Request.Control.Binding
+	if _, c := cloneSDKRequest(i.Request); c != "" {
+		return r, c
+	}
+	if i.Request.Control.Op != "jobs.submit" || i.Actor.IdentityBasis != "uid-username" || !validRelaxedIdentity(RelaxedIdentity{UID: i.Actor.UID, Username: i.Actor.Username}) {
+		return r, ErrInvalid
+	}
+	if bnd.Mode == jobcontract.Interactive {
+		if !allReferences(i.SessionRef) {
+			return r, ErrInvalid
+		}
+	} else if i.SessionRef != "" {
+		return r, ErrInvalid
+	}
+	digest, why := jobcontract.InputDigest(i.Request.Input, bnd.InputSchemaDigest)
+	if why != "" || digest != bnd.InputDigest {
+		return r, ErrInvalid
+	}
+	switch r.State {
+	case "pending", "canceled", "interrupted":
+		if r.Receipt != nil {
+			return r, ErrInvalid
+		}
+	case "finished":
+		if r.Receipt == nil || jobcontract.CompareBinding(r.Receipt.Job.Binding, bnd) != "" || jobcontract.ValidateJob(r.Receipt.Job) != "" || !r.Receipt.Job.Drained || r.Receipt.Job.FinishedAt == nil {
+			return r, ErrInvalid
+		}
+		if r.Receipt.Result != nil && (r.Receipt.Job.State != jobcontract.Succeeded || jobcontract.ValidateResult(*r.Receipt.Result) != "") {
+			return r, ErrInvalid
+		}
+	default:
+		return r, ErrInvalid
+	}
+	return r, ""
+}
+func encodeSDKJournal(r sdkJournalRecord) ([]byte, Code) {
+	b, err := json.Marshal(r)
+	if err != nil {
+		return nil, ErrInvalid
+	}
+	if _, c := decodeSDKJournal(b); c != "" {
+		return nil, c
+	}
+	return b, ""
+}

package/templates/native-go/backend/internal/helper/sdk_journal_linux.go

@@ -0,0 +1,244 @@
+//go:build linux && synopkgland_sdk_workers
+
+package helper
+
+import (
+	"dsmapp/internal/helper/jobcontract"
+	"io"
+	"os"
+	"sort"
+	"strings"
+
+	"golang.org/x/sys/unix"
+)
+
+type sdkFileJobJournal struct{ repository *FileGrantRepository }
+
+// Called once by the root ordering owner, before enabling any SDK admissions.
+// Restart retains execution keys and interrupts every nonterminal intent. There
+// is no resume API, even when the inventory and epoch bytes have not changed.
+func newSDKFileJobJournal(r *FileGrantRepository) (*sdkFileJobJournal, Code) {
+	j, code, _ := newSDKFileJobJournalDiagnostic(r)
+	return j, code
+}
+
+func newSDKFileJobJournalDiagnostic(r *FileGrantRepository) (*sdkFileJobJournal, Code, string) {
+	stage := "jobs-journal-load"
+	if r == nil {
+		return nil, ErrUnavailable, stage
+	}
+	j := &sdkFileJobJournal{r}
+	c := r.withLocks(func() Code {
+		if r.journalReady {
+			return ErrBusy
+		}
+		records, c, failingStage := j.loadLockedDiagnostic()
+		stage = failingStage
+		if c != "" {
+			r.poisoned = true
+			return c
+		}
+		stage = "jobs-journal-load"
+		r.journalKnown = map[string]string{}
+		for _, record := range records {
+			if record.State == "pending" || record.State == "canceled" {
+				record.State = "interrupted"
+				record.Receipt = nil
+				if c := j.saveLocked(record); c != "" {
+					return c
+				}
+			} else {
+				raw, _ := encodeSDKJournal(record)
+				r.journalKnown[record.Intent.Request.Control.Binding.Job.ID] = snapshotDigest(raw)
+			}
+		}
+		r.journalReady = true
+		return ""
+	})
+	if c != "" {
+		return nil, c, stage
+	}
+	return j, "", ""
+}
+func (j *sdkFileJobJournal) loadLocked() ([]sdkJournalRecord, Code) {
+	records, code, _ := j.loadLockedDiagnostic()
+	return records, code
+}
+
+func (j *sdkFileJobJournal) loadLockedDiagnostic() ([]sdkJournalRecord, Code, string) {
+	r := j.repository
+	fd, e := unix.Openat(int(r.dir.Fd()), ".", unix.O_RDONLY|unix.O_DIRECTORY|unix.O_CLOEXEC, 0)
+	if e != nil {
+		return nil, ErrUnavailable, "jobs-journal-load"
+	}
+	f := os.NewFile(uintptr(fd), "sdk-journal-listing")
+	defer f.Close()
+	names, e := f.Readdirnames(4097)
+	if e != nil && e != io.EOF {
+		return nil, ErrUnavailable, "jobs-journal-load"
+	}
+	if len(names) > 4096 {
+		return nil, ErrLimit, "jobs-journal-load"
+	}
+	sort.Strings(names)
+	out := []sdkJournalRecord{}
+	seen := map[string]bool{}
+	intents := map[string]bool{}
+	nonces := map[string]bool{}
+	tickets := map[string]bool{}
+	for _, name := range names {
+		if !strings.HasPrefix(name, "job-intent-") {
+			continue
+		}
+		id := strings.TrimSuffix(strings.TrimPrefix(name, "job-intent-"), ".json")
+		if !allReferences(id) || name != "job-intent-"+id+".json" {
+			return nil, ErrCleanupRequired, "jobs-journal-load"
+		}
+		if len(out) >= jobcontract.MaxExecutionKeys {
+			return nil, ErrLimit, "jobs-journal-load"
+		}
+		b, e := r.read(name, 0600, jobcontract.MaxArtifactBytes)
+		if e != nil {
+			return nil, ErrUnavailable, "jobs-journal-load"
+		}
+		rec, c := decodeSDKJournal(b)
+		if c != "" {
+			return nil, c, "journal-decode"
+		}
+		control := rec.Intent.Request.Control
+		if control.Binding.Job.ID != id || seen[id] || intents[control.Intent.ID] || nonces[control.Nonce] || tickets[control.Ticket] {
+			return nil, ErrReplay, "jobs-journal-load"
+		}
+		if r.journalKnown != nil && r.journalKnown[id] != snapshotDigest(b) {
+			return nil, ErrStale, "jobs-journal-load"
+		}
+		seen[id] = true
+		intents[control.Intent.ID] = true
+		nonces[control.Nonce] = true
+		tickets[control.Ticket] = true
+		out = append(out, rec)
+	}
+	if r.journalKnown != nil && len(seen) != len(r.journalKnown) {
+		return nil, ErrStale, "jobs-journal-load"
+	}
+	return out, "", ""
+}
+func (j *sdkFileJobJournal) saveLocked(record sdkJournalRecord) Code {
+	r := j.repository
+	b, c := encodeSDKJournal(record)
+	if c != "" {
+		return c
+	}
+	id := record.Intent.Request.Control.Binding.Job.ID
+	if c = r.commit("job-intent-"+id+".json", b); c != "" {
+		r.poisoned = true
+		return c
+	}
+	r.journalKnown[id] = snapshotDigest(b)
+	return ""
+}
+func (j *sdkFileJobJournal) transaction(fn func(GrantPolicy, []sdkJournalRecord) Code) Code {
+	if j == nil || j.repository == nil {
+		return ErrUnavailable
+	}
+	r := j.repository
+	return r.withLocks(func() Code {
+		if !r.journalReady {
+			return ErrUnavailable
+		}
+		p, c := r.readPolicy()
+		if c != "" {
+			r.poisoned = true
+			return c
+		}
+		records, c := j.loadLocked()
+		if c != "" {
+			r.poisoned = true
+			return c
+		}
+		return fn(p, records)
+	})
+}
+func (j *sdkFileJobJournal) Records() ([]sdkJournalRecord, Code) {
+	var out []sdkJournalRecord
+	c := j.transaction(func(_ GrantPolicy, rs []sdkJournalRecord) Code { out = rs; return "" })
+	return out, c
+}
+func sdkJournalPolicy(b jobcontract.Binding, p GrantPolicy) bool {
+	return p.Enabled && b.Inventory == sdkInventory(p.Inventory) && b.Epoch == p.Epoch && b.ApprovalBinding == p.ApprovalBinding && b.CapabilityDigest == p.CapabilityDigest
+}
+func (j *sdkFileJobJournal) Reserve(i sdkJobIntent) Code {
+	raw, c := encodeSDKJournal(sdkJournalRecord{Schema: 1, Intent: i, State: "pending"})
+	if c != "" {
+		return c
+	}
+	record, c := decodeSDKJournal(raw)
+	if c != "" {
+		return c
+	}
+	return j.transaction(func(p GrantPolicy, rs []sdkJournalRecord) Code {
+		if !sdkJournalPolicy(i.Request.Control.Binding, p) {
+			return ErrFenced
+		}
+		for _, r := range rs {
+			x, y := r.Intent.Request.Control, i.Request.Control
+			if x.Binding.Job.ID == y.Binding.Job.ID || x.Intent.ID == y.Intent.ID || x.Nonce == y.Nonce || x.Ticket == y.Ticket {
+				return ErrReplay
+			}
+		}
+		if len(rs) >= jobcontract.MaxExecutionKeys {
+			return ErrLimit
+		}
+		return j.saveLocked(record)
+	})
+}
+func (j *sdkFileJobJournal) Cancel(b jobcontract.Binding) Code {
+	return j.transaction(func(p GrantPolicy, rs []sdkJournalRecord) Code {
+		if !sdkJournalPolicy(b, p) {
+			return ErrFenced
+		}
+		for _, r := range rs {
+			if r.Intent.Request.Control.Binding.Job.ID != b.Job.ID {
+				continue
+			}
+			if jobcontract.CompareBinding(b, r.Intent.Request.Control.Binding) != "" {
+				return ErrDenied
+			}
+			if r.State == "canceled" {
+				return ""
+			}
+			if r.State != "pending" {
+				return ErrStale
+			}
+			r.State = "canceled"
+			return j.saveLocked(r)
+		}
+		return ErrDenied
+	})
+}
+func (j *sdkFileJobJournal) Finish(receipt sdkJobReceipt) Code {
+	b := receipt.Job.Binding
+	return j.transaction(func(p GrantPolicy, rs []sdkJournalRecord) Code {
+		if !sdkJournalPolicy(b, p) {
+			return ErrFenced
+		}
+		for _, r := range rs {
+			if r.Intent.Request.Control.Binding.Job.ID != b.Job.ID {
+				continue
+			}
+			if jobcontract.CompareBinding(b, r.Intent.Request.Control.Binding) != "" {
+				return ErrDenied
+			}
+			if r.State != "pending" && r.State != "canceled" {
+				return ErrStale
+			}
+			if r.State == "canceled" && receipt.Job.State != jobcontract.Canceled {
+				return ErrDenied
+			}
+			r.State = "finished"
+			r.Receipt = &receipt
+			return j.saveLocked(r)
+		}
+		return ErrDenied
+	})
+}