@synopackageland/cli 0.4.1 → 0.5.0

package/templates/native-go/backend/internal/helper/sdk_public_vm_linux_test.go

@@ -0,0 +1,129 @@
+//go:build linux && synopkgland_sdk_workers
+
+package helper
+
+import (
+	"bytes"
+	"dsmapp/internal/helper/jobcontract"
+	"encoding/json"
+	"os"
+	"os/exec"
+	"testing"
+	"time"
+)
+
+func sdkPublicCall(t *testing.T, p LinuxProcesses, cookie, method string, args any, into any) Code {
+	t.Helper()
+	inv, _ := json.Marshal(p.Expected)
+	raw, _ := json.Marshal(map[string]any{"method": method, "params": args})
+	cmd := exec.Command("/sdk-public-client", string(inv), cookie)
+	cmd.Stdin = bytes.NewReader(raw)
+	output, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("public client %v: %s", err, output)
+	}
+	var response struct {
+		Success bool            `json:"success"`
+		Data    json.RawMessage `json:"data"`
+		Error   struct {
+			Code Code `json:"code"`
+		} `json:"error"`
+	}
+	if json.Unmarshal(output, &response) != nil {
+		t.Fatalf("public envelope %s", output)
+	}
+	if !response.Success {
+		return response.Error.Code
+	}
+	if into != nil && json.Unmarshal(response.Data, into) != nil {
+		t.Fatalf("public data %s", output)
+	}
+	return ""
+}
+func TestLinuxSDKPublicRoutesExecuteAndExpireThroughProductionOwner(t *testing.T) {
+	p := sdkJobVMFixture(t, "/helper-sdk-public")
+	proc := startVMHelper(t, p)
+	var grant Grant
+	deadline := time.Now().Add(3 * time.Second)
+	for time.Now().Before(deadline) {
+		raw, _ := os.ReadFile(p.StateDir + "/grants.json")
+		store, c := DecodeGrantStore(bytes.NewReader(raw))
+		if c == "" && len(store.Grants) > 0 {
+			grant = store.Grants[len(store.Grants)-1]
+			break
+		}
+		time.Sleep(20 * time.Millisecond)
+	}
+	if grant.ID == "" {
+		t.Fatal("fixture root grant missing")
+	}
+	prepare := func() sdkPrepared {
+		var out sdkPrepared
+		amount := uint64(2 << 20)
+		c := sdkPublicCall(t, p, "sdk-vm-only", "jobs.prepare", sdkPrepareArgs{Worker: jobcontract.RevisionRef{ID: "scan", Revision: 1}, Parent: jobcontract.RevisionRef{ID: grant.ID, Revision: grant.Revision}, Input: jobcontract.Input{Steps: []jobcontract.Step{{Action: jobcontract.ReadStream, Segments: []string{"group"}, MaxBytes: &amount}}}}, &out)
+		if c != "" {
+			t.Fatal("prepare", c)
+		}
+		return out
+	}
+	for _, expire := range []bool{false, true} {
+		if expire {
+			os.WriteFile(sdkTestVMRoot+"/paced", nil, 0600)
+			os.WriteFile(sdkTestVMRoot+"/group", bytes.Repeat([]byte("x"), 1<<20), 0640)
+		}
+		prepared := prepare()
+		var lease sdkAttachReceipt
+		if c := sdkPublicCall(t, p, "sdk-vm-only", "jobs.submit", sdkSubmitArgs{prepared.IntentID, prepared.SummaryDigest}, &lease); c != "" {
+			t.Fatal("submit", c)
+		}
+		if lease.TTLMS != 6000 || lease.RenewAfterMS != 2000 {
+			t.Fatal(lease)
+		}
+		if c := sdkPublicCall(t, p, "foreign", "jobs.attach", sdkAttachArgs{lease.JobID, lease.AttachID}, nil); c != ErrDenied {
+			t.Fatal("foreign attach", c)
+		}
+		if !expire {
+			os.Remove(sdkTestVMRoot + "/hold")
+		}
+		deadline := time.Now().Add(9 * time.Second)
+		var found sdkJobDisplay
+		for time.Now().Before(deadline) {
+			time.Sleep(600 * time.Millisecond)
+			var page sdkJobPage
+			c := sdkPublicCall(t, p, "sdk-vm-only", "jobs.status", sdkStatusArgs{}, &page)
+			if c == ErrBusy {
+				continue
+			}
+			if c != "" {
+				t.Fatal("status", c)
+			}
+			for _, item := range page.Items {
+				if item.JobID == lease.JobID {
+					found = item
+				}
+			}
+			if found.Drained {
+				break
+			}
+		}
+		if !found.Drained {
+			t.Fatal("no Q", found)
+		}
+		want := jobcontract.Succeeded
+		if expire {
+			want = jobcontract.Canceled
+		}
+		if found.State != want {
+			t.Fatal("terminal", found)
+		}
+		if expire {
+			if c := sdkPublicCall(t, p, "sdk-vm-only", "jobs.attach", sdkAttachArgs{lease.JobID, lease.AttachID}, nil); c == "" {
+				t.Fatal("late renewal accepted")
+			}
+		}
+		if len(processChildren(proc.PID)) != 1 {
+			t.Fatal("unreaped child")
+		}
+		time.Sleep(time.Second)
+	}
+}

package/templates/native-go/backend/internal/helper/sdk_relaxed_invalidation.go

@@ -0,0 +1,242 @@
+//go:build synopkgland_sdk_workers
+
+package helper
+
+import (
+	"context"
+	"math"
+)
+
+// A deleted account cannot supply its former UID. Select its recorded identity
+// by the validated native name, never drop invalidation because lookup failed.
+func (r *relaxedProvider) invalidateName(ctx context.Context, name string, observed ...RelaxedIdentity) Code {
+	a := r.authority
+	a.mu.Lock()
+	selected := map[RelaxedIdentity]bool{}
+	related := func(id RelaxedIdentity) bool {
+		if id.Username == name {
+			return true
+		}
+		for _, current := range observed {
+			if validRelaxedIdentity(current) && relaxedRelated(id, current) {
+				return true
+			}
+		}
+		return false
+	}
+	for id := range r.principals {
+		if related(id) {
+			selected[id] = true
+		}
+	}
+	code := a.transaction(func(s *GrantStore) (bool, Code) {
+		for _, g := range s.Grants {
+			for _, p := range []Principal{g.Owner, g.Issuer} {
+				if p.IdentityBasis == "uid-username" && related(relaxedPrincipalIdentity(p)) {
+					selected[relaxedPrincipalIdentity(p)] = true
+				}
+			}
+		}
+		return false, ""
+	})
+	if code != "" {
+		a.mu.Unlock()
+		return ErrCleanupRequired
+	}
+	if a.sdkJobs != nil || a.sdkBackground != nil {
+		records, c := a.sdkIdentitiesLocked()
+		if c != "" {
+			a.fenced = true
+			a.mu.Unlock()
+			return ErrCleanupRequired
+		}
+		for _, id := range records {
+			if related(id) {
+				selected[id] = true
+			}
+		}
+	}
+	if len(selected) == 0 {
+		a.mu.Unlock()
+		return ""
+	}
+	ids := make([]RelaxedIdentity, 0, len(selected))
+	for id := range selected {
+		ids = append(ids, id)
+	}
+	return r.invalidateLocked(ctx, ids)
+}
+
+// Observed identity changes use the existing S3 transaction/order, never an
+// auxiliary store. Old generations are denied before R and never reused.
+func (r *relaxedProvider) invalidate(ctx context.Context, ids []RelaxedIdentity) Code {
+	if r == nil || r.authority == nil {
+		return ErrUnavailable
+	}
+	r.authority.mu.Lock()
+	return r.invalidateLocked(ctx, ids)
+}
+
+// Takes ownership of the held admission lock; all exit paths release it.
+func (r *relaxedProvider) invalidateLocked(ctx context.Context, ids []RelaxedIdentity, prospective ...RelaxedIdentity) Code {
+	ctx, cancel := context.WithTimeout(ctx, MetadataTimeout)
+	defer cancel()
+	a := r.authority
+	var closureCode Code
+	ids, closureCode = a.sdkIdentityClosureLocked(ids)
+	if closureCode != "" {
+		a.fenced = true
+		clear(a.intents)
+		if a.gate != nil {
+			a.gate.fenceLocked("sdk-identity-index-incomplete")
+		}
+		a.mu.Unlock()
+		return ErrCleanupRequired
+	}
+	selected := map[RelaxedIdentity]bool{}
+	blocked := map[RelaxedIdentity]bool{}
+	for _, id := range append(append([]RelaxedIdentity{}, ids...), prospective...) {
+		if !validRelaxedIdentity(id) || r.blocked[id] {
+			a.fenced = true
+			a.mu.Unlock()
+			return ErrCleanupRequired
+		}
+		blocked[id] = true
+	}
+	for id := range blocked {
+		r.blocked[id] = true
+	}
+	for _, id := range ids {
+		selected[id] = true
+		delete(r.principals, id)
+	}
+	for id, pending := range a.intents {
+		if selected[relaxedActorIdentity(pending.actor)] {
+			delete(a.intents, id)
+		}
+	}
+	keys := []GrantDrainKey{}
+	code := safeGrantCode(a.repository.Transact(func(policy GrantPolicy, s *GrantStore) (bool, Code) {
+		if policy != a.policy || !policy.Enabled || a.fenced {
+			return false, ErrFenced
+		}
+		// Plan all revisions first, so overflow or malformed authority cannot partly R.
+		indices := []int{}
+		for n, g := range s.Grants {
+			affected := false
+			for _, p := range []Principal{g.Owner, g.Issuer} {
+				if p.IdentityBasis == "uid-username" && selected[relaxedPrincipalIdentity(p)] {
+					affected = true
+				}
+			}
+			if !affected {
+				continue
+			}
+			revision := g.Revision
+			if g.State != GrantRevoked {
+				if revision == math.MaxUint64 || s.Revision == math.MaxUint64 {
+					return false, ErrLimit
+				}
+				revision++
+				indices = append(indices, n)
+			}
+			keys = append(keys, GrantDrainKey{policy.Epoch, g.ID, revision})
+		}
+		for _, n := range indices {
+			g := &s.Grants[n]
+			g.State = GrantRevoked
+			g.Reason = ErrRevoked
+			g.RevokedAt = max(g.CreatedAt, a.now().UnixMilli())
+			g.Revision++
+		}
+		derived, c := a.sdkInvalidateDerivedLocked(s, selected)
+		if c != "" {
+			return false, c
+		}
+		changed := len(indices) > 0 || derived
+		if changed {
+			if s.Revision == math.MaxUint64 {
+				return false, ErrLimit
+			}
+			s.Revision++
+		}
+		return changed, ""
+	}))
+	if code != "" {
+		a.fenced = true
+		clear(a.intents)
+	}
+	a.mu.Unlock()
+	complete := code == ""
+	// The caller's operations on foreign shared grants must stop without rewriting
+	// those grants. This seam must prove actual owned-child/relay completion.
+	identityCohort, ok := a.cohort.(relaxedIdentityCohort)
+	if !ok {
+		complete = false
+	} else {
+		for id := range selected {
+			if c := nativeObservationCode(ctx, identityCohort.drainRelaxedIdentity(ctx, id)); c != "" {
+				complete = false
+			}
+		}
+	}
+	for _, key := range keys {
+		q, c := a.drain(ctx, key)
+		if c != "" {
+			complete = false
+			continue
+		}
+		if code == "" {
+			a.mu.Lock()
+			saved := safeGrantCode(a.repository.SaveQuiescence(q))
+			if saved == "" && a.sdkBackground != nil {
+				saved = a.sdkBackground.finishParentLocked(key.GrantID)
+			}
+			a.mu.Unlock()
+			if saved != "" {
+				complete = false
+			}
+		}
+	}
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	if complete && a.sdkBackground != nil {
+		if c := a.sdkBackground.finishIdentitiesLocked(selected); c != "" {
+			complete = false
+		}
+	}
+	if !complete {
+		a.fenced = true
+		clear(a.intents)
+		if a.gate != nil {
+			a.gate.fenceLocked("relaxed-identity-cleanup-required")
+		}
+		return ErrCleanupRequired
+	}
+	for id := range blocked {
+		delete(r.blocked, id)
+	}
+	// The revoked grants remain revoked; a subsequent Resolve gets a new opaque
+	// generation and consent must create a new grant. Completed Q is not consent.
+	return ""
+}
+
+// This is the existing S2 owner/reaper, not a new identity process manager.
+func (c *operationCohort) drainRelaxedIdentity(ctx context.Context, id RelaxedIdentity) Code {
+	ctx, cancel := context.WithTimeout(ctx, RevokeDrainTimeout)
+	defer cancel()
+	if err := c.drainSelected(ctx, TerminateGrace, func(op *cohortOperation) bool {
+		return op.actor.relaxed != nil && relaxedActorIdentity(op.actor) == id
+	}); err != nil {
+		return ErrCleanupRequired
+	}
+	if nativeContextCode(ctx) != "" {
+		return ErrCleanupRequired
+	}
+	for _, op := range c.operations {
+		if op.actor.relaxed != nil && relaxedActorIdentity(op.actor) == id {
+			return ErrCleanupRequired
+		}
+	}
+	return ""
+}

package/templates/native-go/backend/internal/helper/sdk_rpc.go

@@ -0,0 +1,299 @@
+//go:build synopkgland_sdk_workers
+
+package helper
+
+import (
+	"bytes"
+	"context"
+	"crypto/sha256"
+	"dsmapp/internal/helper/jobcontract"
+	"encoding/hex"
+	"encoding/json"
+	"strings"
+)
+
+// One fixed decoder shared by the CGI client, helper daemon, and root owner.
+// Unknown methods never acquire a generic handler or execute inert workers.
+func sdkArgs(method string, raw []byte) (any, Code) {
+	var dst any
+	switch method {
+	case "jobs.prepare":
+		dst = &sdkPrepareArgs{}
+	case "jobs.submit":
+		dst = &sdkSubmitArgs{}
+	case "jobs.status", "jobs.admin.status":
+		dst = &sdkStatusArgs{}
+	case "jobs.lookup":
+		dst = &sdkLookupArgs{}
+	case "jobs.result":
+		dst = &sdkResultArgs{}
+	case "jobs.cancel", "jobs.admin.cancel":
+		dst = &sdkCancelArgs{}
+	case "jobs.revoke":
+		dst = &sdkRevokeArgs{}
+	case "jobs.attach":
+		dst = &sdkAttachArgs{}
+	case "jobs.diagnose":
+		dst = &struct{}{}
+	default:
+		return nil, ErrUnsupported
+	}
+	if c := decodeDataObject(bytes.NewReader(raw), dst, MaxControlBytes); c != "" {
+		return nil, c
+	}
+	return dst, ""
+}
+func (o *sdkJobOwner) prepareInteractive(ctx context.Context, carriers SessionCarriers, in sdkPrepareArgs) (sdkPrepared, Code) {
+	a := o.grants.authority
+	w, ok := o.workers[in.Worker.ID]
+	if !ok || in.Worker.Revision != w.Revision {
+		return sdkPrepared{}, ErrIncompatible
+	}
+	if !allReferences(in.Parent.ID) || in.Parent.Revision == 0 {
+		return sdkPrepared{}, ErrInvalid
+	}
+	if c := jobcontract.ValidatePlan(w, in.Input, jobcontract.Interactive); c != "" {
+		return sdkPrepared{}, sdkCode(c)
+	}
+	ids := make([]string, 4)
+	for n := range ids {
+		var c Code
+		ids[n], c = sdkRandomRef()
+		if c != "" {
+			return sdkPrepared{}, c
+		}
+	}
+	digest, why := jobcontract.InputDigest(in.Input, w.InputSchemaDigest)
+	if why != "" {
+		return sdkPrepared{}, sdkCode(why)
+	}
+	p := a.policy
+	bind := jobcontract.Binding{Inventory: sdkInventory(p.Inventory), JobSchema: 1, Epoch: p.Epoch, Job: jobcontract.RevisionRef{ID: ids[0], Revision: 1}, Worker: in.Worker, ParentGrant: in.Parent, ApprovalBinding: p.ApprovalBinding, CapabilityDigest: p.CapabilityDigest, InputSchemaDigest: w.InputSchemaDigest, InputDigest: digest, Mode: jobcontract.Interactive}
+	request := sdkJobRequest{Control: jobcontract.Control{Op: "jobs.submit", Binding: bind, Intent: jobcontract.RevisionRef{ID: ids[1], Revision: 1}, Nonce: ids[2], Ticket: ids[3]}, Input: in.Input}
+	request, code := cloneSDKRequest(request)
+	if code != "" {
+		return sdkPrepared{}, code
+	}
+	j := &sdkJob{request: request, worker: w, carriers: carriers}
+	actor, proof, code := o.validate(ctx, j, sdkJobCheckpoint{Phase: "prepare"})
+	if code != "" {
+		return sdkPrepared{}, code
+	}
+	// No attach lease until submit. Preparation only reserves bounded consent.
+	raw, _ := json.Marshal(request)
+	sum := sha256.Sum256(raw)
+	summary := hex.EncodeToString(sum[:])
+	var out sdkPrepared
+	code = a.WithGrantAdmission(GrantAdmission{actor, in.Parent.ID, in.Parent.Revision, Action(in.Input.Steps[0].Action), proof.Continuity, proof.Continuous}, func(g Grant, current NativeActor) Code {
+		if c := nativeContextCode(ctx); c != "" {
+			return c
+		}
+		now := a.now()
+		if !nativeFresh(proof.CheckedAt, now) || !now.Before(proof.ExpiresAt) {
+			return ErrStale
+		}
+		for _, step := range in.Input.Steps {
+			if !containsAction(g.Actions, Action(step.Action)) {
+				return ErrDenied
+			}
+		}
+		count := 0
+		for id, pending := range a.intents {
+			if now.UnixMilli() >= pending.intent.ExpiresAt {
+				delete(a.intents, id)
+			} else if pending.intent.SubjectRef == current.Principal().SubjectRef {
+				count++
+			}
+		}
+		if count >= MaxLiveIntents || len(a.intents) >= MaxReplayEntries || len(o.jobs) >= jobcontract.MaxExecutionKeys {
+			return ErrBusy
+		}
+		mono := o.attachNow()
+		if mono < 0 {
+			return ErrExpired
+		}
+		out = sdkPrepared{ids[1], ids[0], summary, now.Add(IntentTTL).UnixMilli()}
+		a.intents[ids[1]] = pendingConsent{intent: Intent{ID: ids[1], Inventory: p.Inventory, Epoch: p.Epoch, SubjectRef: current.Principal().SubjectRef, SessionRef: current.SessionRef(), SummaryDigest: summary, ExpiresAt: out.ExpiresAt}, actor: current, interactive: &sdkInteractivePending{request, mono + IntentTTL}}
+		return ""
+	})
+	return out, code
+}
+func containsAction(actions []Action, want Action) bool {
+	for _, a := range actions {
+		if a == want {
+			return true
+		}
+	}
+	return false
+}
+func (o *sdkJobOwner) submitInteractive(ctx context.Context, peer operationPeer, carriers SessionCarriers, in sdkSubmitArgs) (sdkAttachReceipt, Code) {
+	if !allReferences(in.IntentID, in.SummaryDigest) {
+		return sdkAttachReceipt{}, ErrInvalid
+	}
+	a := o.grants.authority
+	actor, code := a.actor(ctx, carriers, nil)
+	if code != "" {
+		return sdkAttachReceipt{}, code
+	}
+	a.mu.Lock()
+	pending, ok := a.intents[in.IntentID]
+	if !ok || pending.interactive == nil {
+		a.mu.Unlock()
+		return sdkAttachReceipt{}, ErrReplay
+	}
+	if pending.actor.Principal() != actor.Principal() || pending.actor.SessionRef() != actor.SessionRef() || pending.intent.SummaryDigest != in.SummaryDigest {
+		a.mu.Unlock()
+		return sdkAttachReceipt{}, ErrDenied
+	}
+	if a.now().UnixMilli() >= pending.intent.ExpiresAt || o.attachNow() >= pending.interactive.expires || o.attachNow() < pending.interactive.expires-IntentTTL {
+		delete(a.intents, in.IntentID)
+		a.mu.Unlock()
+		return sdkAttachReceipt{}, ErrExpired
+	}
+	delete(a.intents, in.IntentID) // one attempt, including busy/bootstrap failure
+	a.mu.Unlock()
+	if code = o.submit(ctx, peer, carriers, pending.interactive.request); code != "" {
+		return sdkAttachReceipt{}, code
+	}
+	j := o.jobs[pending.interactive.request.Control.Binding.Job.ID]
+	v := newSDKJobViews(o)
+	if _, c := v.snapshot(); c != "" {
+		return sdkAttachReceipt{}, c
+	}
+	return sdkAttachReceipt{JobID: j.request.Control.Binding.Job.ID, Revision: v.revision, AttachID: j.attach.id, RenewAfterMS: sdkAttachRenewInterval.Milliseconds(), TTLMS: sdkAttachTTL.Milliseconds()}, ""
+}
+func (o *sdkJobOwner) dispatchSDK(ctx context.Context, peer operationPeer, raw []byte) sdkWireResponse {
+	res := sdkWireResponse{Inventory: o.grants.cohort.inventory}
+	if !o.grants.cohort.peerAllowed(peer) {
+		res.Code = ErrDenied
+		return res
+	}
+	var req sdkWireRequest
+	if res.Code = decodeDataObject(bytes.NewReader(raw), &req, MaxControlBytes); res.Code != "" {
+		return res
+	}
+	res.Nonce = req.Nonce
+	if req.Inventory != res.Inventory {
+		res.Code = ErrIncompatible
+		return res
+	}
+	if !allReferences(req.Nonce) || len(req.Carriers.Cookie) > 4096 || len(req.Carriers.SynoToken) > 4096 || len(req.Carriers.ClientAddress) > 256 {
+		res.Code = ErrInvalid
+		return res
+	}
+	args, code := sdkArgs(req.Method, req.Args)
+	if code != "" {
+		res.Code = code
+		return res
+	}
+	if o.session != nil {
+		value, c := o.session.dispatch(ctx, SessionCarriers{req.Carriers.Cookie, req.Carriers.SynoToken, req.Carriers.ClientAddress}, req.Method, req.Nonce, args)
+		if c == "" && (!o.session.ready() || ctx.Err() != nil) {
+			c = ErrFenced
+		}
+		if c == ErrFenced && ctx.Err() == nil {
+			c = o.session.refusalCode()
+		}
+		res.Code = safeGrantCode(c)
+		if c == "" {
+			data, e := json.Marshal(value)
+			if e != nil || len(data) > jobcontract.MaxStatusBytes-1024 {
+				res.Code = ErrLimit
+			} else {
+				res.Data = data
+			}
+		}
+		return res
+	}
+	v := newSDKJobViews(o)
+	if !v.enter() {
+		res.Code = ErrBusy
+		return res
+	}
+	defer v.leave()
+	carriers := SessionCarriers{req.Carriers.Cookie, req.Carriers.SynoToken, req.Carriers.ClientAddress}
+	if strings.HasPrefix(req.Method, "jobs.admin.") {
+		actor, c := v.actor(ctx, carriers)
+		if c != "" {
+			res.Code = c
+			return res
+		}
+		if !actor.Admin() {
+			res.Code = ErrDenied
+			return res
+		}
+	}
+	// Mutation replay is independent from status/attach read budgets.
+	mutation := req.Method == "jobs.cancel" || req.Method == "jobs.admin.cancel" || req.Method == "jobs.revoke"
+	if mutation {
+		if o.grants.rpcNonces[req.Nonce] {
+			res.Code = ErrReplay
+			return res
+		}
+		if len(o.grants.rpcNonces) >= MaxReplayEntries {
+			res.Code = ErrBusy
+			return res
+		}
+		// No unauthenticated caller can burn the mutation window.
+		if _, c := v.actor(ctx, carriers); c != "" {
+			res.Code = c
+			return res
+		}
+		o.grants.rpcNonces[req.Nonce] = true
+	}
+	var value any
+	switch req.Method {
+	case "jobs.prepare":
+		value, code = o.prepareInteractive(ctx, carriers, *args.(*sdkPrepareArgs))
+	case "jobs.submit":
+		value, code = o.submitInteractive(ctx, peer, carriers, *args.(*sdkSubmitArgs))
+	case "jobs.status":
+		value, code = v.ownerPage(ctx, carriers, args.(*sdkStatusArgs).Cursor)
+	case "jobs.admin.status":
+		value, code = v.adminQuery(ctx, carriers, args.(*sdkStatusArgs).Cursor)
+	case "jobs.lookup":
+		value, code = v.lookupIntent(ctx, carriers, args.(*sdkLookupArgs).IntentID)
+	case "jobs.result":
+		value, code = v.result(ctx, carriers, args.(*sdkResultArgs).JobID)
+	case "jobs.cancel", "jobs.admin.cancel":
+		p := args.(*sdkCancelArgs)
+		code = v.cancel(ctx, carriers, p.JobID, p.Revision)
+		value = struct{}{}
+	case "jobs.revoke":
+		p := args.(*sdkRevokeArgs)
+		value, code = v.revoke(ctx, carriers, p.JobID, p.Revision, p.DelegationRevision, p.StoreRevision)
+	case "jobs.attach":
+		p := args.(*sdkAttachArgs)
+		code = o.renewAttach(ctx, carriers, p.JobID, p.AttachID)
+		value = struct{}{}
+	case "jobs.diagnose":
+		value, code = v.diagnose(ctx, carriers, false)
+	}
+	res.Code = safeGrantCode(code)
+	if code == "" {
+		data, err := json.Marshal(value)
+		if err != nil || len(data) > jobcontract.MaxStatusBytes-1024 {
+			res.Code = ErrLimit
+		} else {
+			res.Data = data
+		}
+	}
+	return res
+}
+
+// ValidateSDKEnvelope is a syntax guard only. CGI authentication and root native
+// proof still occur for every registered route, including unknown job methods.
+func ValidateSDKEnvelope(raw []byte) Code {
+	var r struct {
+		Method string          `json:"method"`
+		Params json.RawMessage `json:"params,omitempty"`
+	}
+	if c := decodeDataObject(bytes.NewReader(raw), &r, 1<<20); c != "" {
+		return c
+	}
+	if strings.HasPrefix(r.Method, "jobs.") && len(raw) > MaxControlBytes {
+		return ErrLimit
+	}
+	return ""
+}
+func ValidateSDKArgs(method string, raw []byte) Code { _, c := sdkArgs(method, raw); return c }