@synopackageland/cli 0.4.1 → 0.5.0

package/templates/native-go/backend/internal/helper/stale_management_linux_test.go

@@ -0,0 +1,126 @@
+package helper
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"syscall"
+	"testing"
+)
+
+func TestLinuxStaleManagementPackageUser(t *testing.T) {
+	if raw := os.Getenv("T0059_MANAGEMENT_CLIENT"); raw != "" {
+		var c Client
+		if json.Unmarshal([]byte(raw), &c) != nil {
+			t.Fatal("bad child config")
+		}
+		if os.Geteuid() == 0 {
+			t.Fatal("child remained root")
+		}
+		if b, err := os.ReadFile(filepath.Join(c.StateDir, "approval.json")); err != nil || len(b) == 0 {
+			t.Fatal("approval unreadable", err)
+		}
+		r, err := readRecord(c.StateDir, 0)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if _, err := os.ReadFile(filepath.Join(c.StateDir, "completion-"+r.Lifecycle.Epoch+".json")); !os.IsPermission(err) {
+			t.Fatal("private proof was readable", err)
+		}
+		s := c.Status(context.Background())
+		if s.Reason != "inventory-mismatch" {
+			t.Fatal(s)
+		}
+		err = c.CheckStopped(context.Background())
+		if (err == nil) != (os.Getenv("T0059_EXPECT_STOPPED") == "yes") {
+			t.Fatal("package user decision", err)
+		}
+		return
+	}
+	if os.Geteuid() != 0 {
+		t.Skip("requires disposable Linux root container")
+	}
+	c := stoppedStaleFixture(t)
+	// Publish fixture under directly traversable /tmp, retaining private proof modes.
+	state, err := os.MkdirTemp("/tmp", "t0059-state-")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(state)
+	entries, err := os.ReadDir(c.StateDir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	// Rename each file to preserve the lease's device/inode witness.
+	for _, entry := range entries {
+		if err := os.Rename(filepath.Join(c.StateDir, entry.Name()), filepath.Join(state, entry.Name())); err != nil {
+			t.Fatal(err)
+		}
+	}
+	c.StateDir = state
+	os.Chmod(c.StateDir, 0755)
+	os.Chmod(c.RunDir, 0755)
+	exe, err := os.Executable()
+	if err != nil {
+		t.Fatal(err)
+	}
+	bin, err := os.CreateTemp("/tmp", "t0059-test-")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.Remove(bin.Name())
+	data, err := os.ReadFile(exe)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err = bin.Write(data); err != nil {
+		t.Fatal(err)
+	}
+	bin.Chmod(0755)
+	bin.Close()
+	// Client.Peer is a function; use only the public filesystem client fields.
+	raw, err := json.Marshal(struct {
+		Expected         Inventory
+		StateDir, RunDir string
+		Owner            uint32
+	}{c.Expected, c.StateDir, c.RunDir, c.Owner})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, kind := range []string{"sealed", "residue", "foreign", "noncanonical", "lease-replaced"} {
+		t.Run(kind, func(t *testing.T) {
+			approval := filepath.Join(c.StateDir, "approval.json")
+			original, _ := os.ReadFile(approval)
+			r, _ := readRecord(c.StateDir, c.Owner)
+			switch kind {
+			case "residue":
+				os.WriteFile(filepath.Join(c.RunDir, "process.json"), []byte("private"), 0600)
+				defer os.Remove(filepath.Join(c.RunDir, "process.json"))
+			case "foreign":
+				r.Inventory.Package = "Foreign"
+				record(t, c, r)
+				defer os.WriteFile(approval, original, 0644)
+			case "noncanonical":
+				os.WriteFile(approval, append(original, '\n'), 0644)
+				defer os.WriteFile(approval, original, 0644)
+			case "lease-replaced":
+				p := leasePath(c, r.Lifecycle)
+				os.Rename(p, p+".old")
+				os.WriteFile(p, []byte(r.Lifecycle.Epoch), 0600)
+				defer os.Rename(p+".old", p)
+			}
+			want := "no"
+			if kind == "sealed" {
+				want = "yes"
+			}
+			cmd := exec.Command(bin.Name(), "-test.run=^TestLinuxStaleManagementPackageUser$", "-test.v")
+			cmd.Env = append(os.Environ(), "T0059_MANAGEMENT_CLIENT="+string(raw), "T0059_EXPECT_STOPPED="+want)
+			cmd.SysProcAttr = &syscall.SysProcAttr{Credential: &syscall.Credential{Uid: 65534, Gid: 65534}}
+			if out, err := cmd.CombinedOutput(); err != nil {
+				t.Fatalf("nonprivileged hook: %v\n%s", err, out)
+			}
+		})
+	}
+}

package/templates/native-go/backend/internal/helper/stale_management_test.go

@@ -0,0 +1,122 @@
+package helper
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"strings"
+	"syscall"
+	"testing"
+)
+
+func stoppedStaleFixture(t *testing.T) Client {
+	t.Helper()
+	c, _, _ := repairFixture(t)
+	if err := c.Control(context.Background(), "repair"); err != nil {
+		t.Fatal(err)
+	}
+	c.Expected.Version = "1.0.0-0002"
+	c.Expected.PayloadDigest = strings.Repeat("c", 64)
+	return c.Client
+}
+func TestStaleApprovalManagementQuiescence(t *testing.T) {
+	c := stoppedStaleFixture(t)
+	before, _ := os.ReadFile(filepath.Join(c.StateDir, "approval.json"))
+	s := c.Status(context.Background())
+	if s.State != "incompatible" || s.Reason != "inventory-mismatch" {
+		t.Fatal(s)
+	}
+	if err := c.CheckStopped(context.Background()); err != nil {
+		t.Fatal("sealed old approval vetoed normal management", err)
+	}
+	after, _ := os.ReadFile(filepath.Join(c.StateDir, "approval.json"))
+	if string(before) != string(after) {
+		t.Fatal("management mutated approval")
+	}
+}
+func TestStaleApprovalManagementRejectsUntrustedProof(t *testing.T) {
+	for _, kind := range []string{"foreign", "residual", "running", "fenced", "no-completion", "no-lease", "legacy", "completion-corrupt", "completion-mode", "completion-symlink", "lease-missing", "lease-replaced", "lease-busy", "lease-mode", "record-mode", "record-duplicate", "runtime-mode", "process.json", "helper.sock", "supervisor.sock"} {
+		t.Run(kind, func(t *testing.T) {
+			c := stoppedStaleFixture(t)
+			r, err := readRecord(c.StateDir, c.Owner)
+			if err != nil {
+				t.Fatal(err)
+			}
+			approval := filepath.Join(c.StateDir, "approval.json")
+			proof := filepath.Join(c.StateDir, "completion-"+r.Lifecycle.Epoch+".json")
+			lease := leasePath(c, r.Lifecycle)
+			switch kind {
+			case "foreign":
+				c.Expected.Package = "Foreign"
+			case "residual":
+				r.Residual = true
+				record(t, c, r)
+			case "running", "fenced":
+				r.Lifecycle.Phase = kind
+				r.Lifecycle.Completion = ""
+				record(t, c, r)
+			case "no-completion":
+				r.Lifecycle.Completion = ""
+				record(t, c, r)
+			case "no-lease":
+				r.Lifecycle.Lease = nil
+				record(t, c, r)
+			case "legacy":
+				r.Schema = 0
+				r.Lifecycle = nil
+				record(t, c, r)
+			case "completion-corrupt":
+				os.WriteFile(proof, []byte(`{}`), 0600)
+			case "completion-mode":
+				os.Chmod(proof, 0644)
+			case "completion-symlink":
+				os.Rename(proof, proof+".old")
+				os.Symlink(proof+".old", proof)
+			case "lease-missing":
+				os.Remove(lease)
+			case "lease-replaced":
+				os.Rename(lease, lease+".old")
+				os.WriteFile(lease, []byte(r.Lifecycle.Epoch), 0600)
+			case "lease-busy":
+				f, e := acquireLifetime(c, r.Lifecycle)
+				if e != nil {
+					t.Fatal(e)
+				}
+				defer f.Close()
+			case "lease-mode":
+				os.Chmod(lease, 0644)
+			case "record-mode":
+				os.Chmod(approval, 0666)
+			case "record-duplicate":
+				b, _ := os.ReadFile(approval)
+				os.WriteFile(approval, append([]byte(`{"enabled":true,`), b[1:]...), 0644)
+			case "runtime-mode":
+				os.Chmod(c.RunDir, 0777)
+			default:
+				os.WriteFile(filepath.Join(c.RunDir, kind), []byte("residue"), 0600)
+			}
+			if c.CheckStopped(context.Background()) == nil {
+				t.Fatal("unsafe management admitted", kind)
+			}
+		})
+	}
+}
+
+// Ensure the test really exercises an OS lock, not a synthetic busy flag.
+func TestStaleLeaseLockIsKernelHeld(t *testing.T) {
+	c := stoppedStaleFixture(t)
+	r, _ := readRecord(c.StateDir, c.Owner)
+	f, err := acquireLifetime(c, r.Lifecycle)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer f.Close()
+	other, err := os.OpenFile(leasePath(c, r.Lifecycle), os.O_RDWR, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer other.Close()
+	if syscall.Flock(int(other.Fd()), syscall.LOCK_EX|syscall.LOCK_NB) == nil {
+		t.Fatal("fixture lease not held")
+	}
+}

package/templates/native-go/backend/internal/helper/startup_diagnostic.go

@@ -0,0 +1,68 @@
+package helper
+
+import (
+	"encoding/json"
+	"io"
+	"os"
+	"path/filepath"
+	"syscall"
+)
+
+// StartupFailure contains only fixed branch names and protocol codes. It is
+// intentionally separate from State, which is exposed to every signed-in user.
+type StartupFailure struct {
+	Stage string `json:"stage"`
+	Code  Code   `json:"code"`
+}
+
+func startupStageValid(stage string) bool {
+	switch stage {
+	case "grants-open", "jobs-registry", "jobs-journal-load", "journal-decode", "jobs-owner", "background-index", "session-history", "startup-unknown":
+		return true
+	}
+	return false
+}
+
+func (g *admission) fenceStartup(stage string, code Code) {
+	if !startupStageValid(stage) {
+		stage = "startup-unknown"
+	}
+	if !code.Valid() {
+		code = ErrUnavailable
+	}
+	g.fenceObserver("grant-authority-unavailable", observerEvent{Detail: "grant-authority-unavailable", Stage: stage, Code: code})
+}
+
+// StartupDiagnostic is an explicit root-only diagnostic, also available after
+// runtime teardown. It never authorizes readiness or recovery. The CLI calls it
+// using LocalClient so the diagnostic must match this build and approval epoch.
+func (c Client) StartupDiagnostic() (StartupFailure, error) {
+	var out StartupFailure
+	if os.Geteuid() != 0 || c.Owner != 0 {
+		return out, errTrust
+	}
+	r, err := readRecord(c.StateDir, 0)
+	if err != nil || r.Inventory != c.Expected || r.Lifecycle == nil || r.Lifecycle.Reason != "grant-authority-unavailable" {
+		return out, errTrust
+	}
+	f, err := os.OpenFile(filepath.Join(c.StateDir, "observer-diagnostic.json"), os.O_RDONLY|syscall.O_NOFOLLOW, 0)
+	if err != nil {
+		return out, errTrust
+	}
+	defer f.Close()
+	st, err := f.Stat()
+	if err != nil {
+		return out, errTrust
+	}
+	owner, ok := st.Sys().(*syscall.Stat_t)
+	if !ok || owner.Uid != 0 || !st.Mode().IsRegular() || st.Mode().Perm() != 0600 || st.Size() > observerDiagnosticLimit {
+		return out, errTrust
+	}
+	var d observerDiagnostic
+	decoder := json.NewDecoder(io.LimitReader(f, observerDiagnosticLimit+1))
+	decoder.DisallowUnknownFields()
+	if decoder.Decode(&d) != nil || decoder.Decode(&struct{}{}) != io.EOF || d.Schema != 1 || d.Epoch != r.Lifecycle.Epoch || d.Reason != r.Lifecycle.Reason || d.Fence.Kind != "fence" || !startupStageValid(d.Fence.Stage) || !d.Fence.Code.Valid() {
+		return out, errTrust
+	}
+	return StartupFailure{Stage: d.Fence.Stage, Code: d.Fence.Code}, nil
+}

package/templates/native-go/backend/internal/helper/startup_diagnostic_linux_test.go

@@ -0,0 +1,126 @@
+//go:build linux && synopkgland_sdk_workers
+
+package helper
+
+import (
+	"encoding/json"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"syscall"
+	"testing"
+)
+
+func TestLinuxStartupJournalFailureStages(t *testing.T) {
+	for _, tc := range []struct {
+		name, contents, stage string
+		code                  Code
+	}{
+		{"malformed-json", "{", "journal-decode", ErrInvalid},
+		{"unsafe-name", "{}", "jobs-journal-load", ErrCleanupRequired},
+		{"unsupported-schema", `{"schema":99}`, "journal-decode", ErrIncompatible},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			dir, inv, _ := rootGrantFixture(t)
+			r := openRootGrantRepository(t, dir, inv)
+			name := "job-intent-" + grantRef('a') + ".json"
+			if tc.name == "unsupported-schema" {
+				raw, err := json.Marshal(sdkJournalRecord{Schema: 99, Intent: sdkJournalIntentFixture(t), State: "pending"})
+				if err != nil {
+					t.Fatal(err)
+				}
+				tc.contents = string(raw)
+			}
+			if tc.name == "unsafe-name" {
+				name = "job-intent-unsafe.json"
+			}
+			if err := os.WriteFile(filepath.Join(dir, name), []byte(tc.contents), 0600); err != nil {
+				t.Fatal(err)
+			}
+			_, code, stage := newSDKFileJobJournalDiagnostic(r)
+			if code != tc.code || stage != tc.stage {
+				t.Fatalf("got %s/%s want %s/%s", stage, code, tc.stage, tc.code)
+			}
+			// The real assembly must propagate the low-level decoder stage.
+			old := sdkCompiledRegistry
+			sdkCompiledRegistry = []byte(`{}`)
+			defer func() { sdkCompiledRegistry = old }()
+			r.Close()
+			r = openRootGrantRepository(t, dir, inv)
+			_, code, stage = openSDKJobs(Client{Expected: inv}, "", nil, r)
+			if code != tc.code || stage != tc.stage {
+				t.Fatalf("assembly lost stage: %s/%s", stage, code)
+			}
+		})
+	}
+}
+
+func TestLinuxStartupDiagnosticPrivateReadback(t *testing.T) {
+	dir, inv, r := rootGrantFixture(t)
+	c := Client{Expected: inv, StateDir: dir}
+	g := newAdmission(r.Lifecycle.Binding)
+	g.fenceStartup("journal-decode", ErrInvalid)
+	persistObserverDiagnostic(c, r.Lifecycle.Epoch, g)
+	if err := fenceRecord(c, r.Lifecycle.Epoch, g.reason()); err != nil {
+		t.Fatal(err)
+	}
+	got, err := c.StartupDiagnostic()
+	if err != nil || got.Stage != "journal-decode" || got.Code != ErrInvalid {
+		t.Fatalf("private read: %+v %v", got, err)
+	}
+	raw, _ := json.Marshal(got)
+	if string(raw) != `{"stage":"journal-decode","code":"invalid-request"}` {
+		t.Fatalf("unexpected export: %s", raw)
+	}
+	for _, change := range []string{"epoch", "code", "stage", "permissions", "symlink", "oversize"} {
+		t.Run(change, func(t *testing.T) {
+			path := filepath.Join(dir, "observer-diagnostic.json")
+			os.Remove(path)
+			d := g.observerDiagnostic(r.Lifecycle.Epoch)
+			switch change {
+			case "epoch":
+				d.Epoch = grantRef('f')
+			case "code":
+				d.Fence.Code = "secret"
+			case "stage":
+				d.Fence.Stage = "/private/path"
+			}
+			if err := writeProtected(dir, "observer-diagnostic.json", d); err != nil {
+				t.Fatal(err)
+			}
+			switch change {
+			case "permissions":
+				os.Chmod(path, 0644)
+			case "symlink":
+				os.Rename(path, path+".target")
+				os.Symlink(path+".target", path)
+			case "oversize":
+				os.WriteFile(path, make([]byte, observerDiagnosticLimit+1), 0600)
+			}
+			if _, err := c.StartupDiagnostic(); err == nil {
+				t.Fatal("untrusted diagnostic accepted")
+			}
+		})
+	}
+}
+
+func TestLinuxStartupDiagnosticRejectsNonroot(t *testing.T) {
+	if os.Getenv("T0092_DIAGNOSTIC_CHILD") == "1" {
+		if os.Geteuid() == 0 {
+			t.Fatal("credential drop failed")
+		}
+		if _, err := (Client{Owner: 0}).StartupDiagnostic(); err == nil {
+			t.Fatal("nonroot accepted")
+		}
+		return
+	}
+	if os.Geteuid() != 0 {
+		t.Skip("requires disposable Linux root VM")
+	}
+	cmd := exec.Command(os.Args[0], "-test.run=^TestLinuxStartupDiagnosticRejectsNonroot$")
+	cmd.Env = append(os.Environ(), "T0092_DIAGNOSTIC_CHILD=1")
+	cmd.SysProcAttr = &syscall.SysProcAttr{Credential: &syscall.Credential{Uid: 65534, Gid: 65534}}
+	if output, err := cmd.CombinedOutput(); err != nil {
+		t.Fatalf("nonroot diagnostic test failed: %s %v", output, err)
+	}
+}

package/templates/native-go/backend/internal/helper/startup_diagnostic_test.go

@@ -0,0 +1,117 @@
+package helper
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestStartupDiagnosticStructure(t *testing.T) {
+	event := observerEvent{Stage: "journal-decode", Code: ErrInvalid}
+	raw, err := json.Marshal(event)
+	if err != nil || !strings.Contains(string(raw), `"stage":"journal-decode"`) || !strings.Contains(string(raw), `"code":"invalid-request"`) {
+		t.Fatalf("missing structured failure: %s %v", raw, err)
+	}
+	raw, err = json.Marshal(observerEvent{})
+	if err != nil || strings.Contains(string(raw), `"stage"`) || strings.Contains(string(raw), `"code"`) {
+		t.Fatalf("changed legacy event: %s %v", raw, err)
+	}
+}
+
+func TestStartupFenceFirstCausePrivacyAndPersistence(t *testing.T) {
+	for _, tc := range []struct {
+		stage     string
+		code      Code
+		wantStage string
+		wantCode  Code
+	}{
+		{"grants-open", ErrBusy, "grants-open", ErrBusy},
+		{"jobs-journal-load", ErrUnavailable, "jobs-journal-load", ErrUnavailable},
+		{"journal-decode", ErrInvalid, "journal-decode", ErrInvalid},
+		{"background-index", ErrCleanupRequired, "background-index", ErrCleanupRequired},
+		{"session-history", ErrStale, "session-history", ErrStale},
+		{"/sensitive/path", Code("secret credential"), "startup-unknown", ErrUnavailable},
+	} {
+		t.Run(tc.wantStage, func(t *testing.T) {
+			c := fixture(t)
+			g := newAdmission(testBinding())
+			g.fenceStartup(tc.stage, tc.code)
+			g.fenceStartup("grants-open", ErrDenied)
+			for n := 0; n < observerEventLimit+10; n++ {
+				g.recordObserver(observerEvent{Kind: "query-ok"})
+			}
+			d := g.observerDiagnostic(strings.Repeat("e", 64))
+			if d.Reason != "grant-authority-unavailable" || d.Fence.Stage != tc.wantStage || d.Fence.Code != tc.wantCode || g.allow(time.Now()) {
+				t.Fatalf("failure lost: %+v", d)
+			}
+			persistObserverDiagnostic(c, d.Epoch, g)
+			raw, err := os.ReadFile(filepath.Join(c.StateDir, "observer-diagnostic.json"))
+			if err != nil {
+				t.Fatal(err)
+			}
+			var saved observerDiagnostic
+			if json.Unmarshal(raw, &saved) != nil || saved.Fence.Stage != tc.wantStage || saved.Fence.Code != tc.wantCode || strings.Contains(string(raw), "sensitive") || strings.Contains(string(raw), "secret") {
+				t.Fatal("unsafe or missing saved failure")
+			}
+			public, _ := json.Marshal(c.Status(context.Background()))
+			if strings.Contains(string(public), `"stage"`) || strings.Contains(string(public), `"code"`) {
+				t.Fatal("public state leaked startup detail")
+			}
+		})
+	}
+	g := newAdmission(testBinding())
+	g.fence("admin-stop")
+	g.fenceStartup("journal-decode", ErrInvalid)
+	if d := g.observerDiagnostic(""); d.Reason != "admin-stop" || d.Fence.Stage != "" {
+		t.Fatal("overwrote earlier fence")
+	}
+}
+
+func TestStartupDiagnosticRequiresRoot(t *testing.T) {
+	c := fixture(t)
+	c.Owner = uint32(os.Geteuid())
+	if os.Geteuid() != 0 {
+		if _, err := c.StartupDiagnostic(); err == nil {
+			t.Fatal("nonroot diagnostic accepted")
+		}
+	}
+}
+
+func TestStartupDiagnosticWriteFailureKeepsFenceAndCompletion(t *testing.T) {
+	c := fixture(t)
+	binding := testBinding()
+	l, err := newLifecycle(binding)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err = writeProtected(c.StateDir, "approval.json", Record{Schema: 2, Inventory: c.Expected, Enabled: true, Lifecycle: l}); err != nil {
+		t.Fatal(err)
+	}
+	if err = os.Mkdir(filepath.Join(c.StateDir, "observer-diagnostic.json"), 0700); err != nil {
+		t.Fatal(err)
+	}
+	g := newAdmission(binding)
+	g.fenceStartup("journal-decode", ErrInvalid)
+	persistObserverDiagnostic(c, l.Epoch, g)
+	if g.readiness(time.Now()) != "fenced" || g.reason() != "grant-authority-unavailable" {
+		t.Fatal("diagnostic error changed admission")
+	}
+	if err = fenceRecord(c, l.Epoch, g.reason()); err != nil {
+		t.Fatal(err)
+	}
+	process := Process{Inventory: c.Expected, Mode: "supervised", Boot: binding.Boot, PID: 42, Start: "123", Inode: 9}
+	if err = completeRecord(c, l.Epoch, process); err != nil {
+		t.Fatal(err)
+	}
+	r, err := readRecord(c.StateDir, c.Owner)
+	if err != nil || r.Lifecycle.Phase != "stopped" || r.Lifecycle.Reason != "grant-authority-unavailable" {
+		t.Fatal("startup completion failed")
+	}
+	if _, err = completionRecord(c, r); err != nil {
+		t.Fatal(err)
+	}
+}

package/templates/native-go/backend/internal/helper/status.go

@@ -119,6 +119,9 @@ func LocalClient(i Inventory) (Client, error) {
 
 func (c Client) CheckStopped(ctx context.Context) error {
 	s := c.Status(ctx)
+	if s.State == "incompatible" && s.Reason == "inventory-mismatch" && c.staleManagementStopped() {
+		return nil
+	}
 	if s.Cleanup != "" || (s.State != "not-enabled" && s.State != "stopped" && s.State != "needs-approval") {
 		return errors.New("approved helper teardown required")
 	}
@@ -212,17 +215,7 @@ func (c Client) Status(ctx context.Context) State {
 			return result("incompatible", "untrusted-runtime")
 		}
 		if r.Lifecycle.Completion != "" {
-			path := filepath.Join(c.StateDir, "completion-"+r.Lifecycle.Epoch+".json")
-			st, e := os.Lstat(path)
-			ok := e == nil && st.Mode().IsRegular() && st.Mode().Perm() == 0600
-			if ok {
-				s, valid := st.Sys().(*syscall.Stat_t)
-				ok = valid && s.Uid == c.Owner
-			}
-			if ok && uint32(os.Geteuid()) == c.Owner {
-				_, e = completionRecord(c, r)
-				ok = e == nil
-			}
+			ok := c.completionPublished(r)
 			if !ok {
 				s := result("failed", "invalid-completion")
 				s.Cleanup = "required"
@@ -321,8 +314,8 @@ func (c Client) probe(ctx context.Context, socket string) (string, string) {
 	if res.Nonce != req.Nonce || res.Inventory != c.Expected || res.Error == "incompatible" {
 		return "incompatible", "handshake-mismatch"
 	}
-	if !res.OK && res.Error == "reload-revalidating" {
-		return "pending", "reload-revalidating"
+	if !res.OK && (res.Error == "reload-revalidating" || res.Error == "query-revalidating") {
+		return "pending", res.Error
 	}
 	if !res.OK && res.Error == "fenced" {
 		return "failed", "lifecycle-fenced"
@@ -332,3 +325,19 @@ func (c Client) probe(ctx context.Context, socket string) (string, string) {
 	}
 	return "ready", "live-handshake"
 }
+
+// completionPublished preserves the private proof boundary for diagnostic callers.
+func (c Client) completionPublished(r Record) bool {
+	path := filepath.Join(c.StateDir, "completion-"+r.Lifecycle.Epoch+".json")
+	st, e := os.Lstat(path)
+	ok := e == nil && st.Mode().IsRegular() && st.Mode().Perm() == 0600
+	if ok {
+		s, valid := st.Sys().(*syscall.Stat_t)
+		ok = valid && s.Uid == c.Owner
+	}
+	if ok && uint32(os.Geteuid()) == c.Owner {
+		_, e = completionRecord(c, r)
+		ok = e == nil
+	}
+	return ok
+}

package/templates/native-go/backend/internal/helper/status_test.go

@@ -286,3 +286,48 @@ func TestS1RInventoryModeIsProtocolTwoOnly(t *testing.T) {
 		t.Fatal("protocol 1 accepted relaxed")
 	}
 }
+
+func TestQueryPendingHealthRequiresTrustedRunningApproval(t *testing.T) {
+	for _, kind := range []string{"running", "missing", "legacy", "disabled", "residual", "fenced", "nonce", "inventory", "contradictory"} {
+		t.Run(kind, func(t *testing.T) {
+			c := fixture(t)
+			r := Record{Inventory: c.Expected, Enabled: true, Lifecycle: testLifecycle("running")}
+			switch kind {
+			case "legacy":
+				r.Lifecycle = nil
+			case "disabled":
+				r.Enabled = false
+			case "residual":
+				r.Residual = true
+			case "fenced":
+				r.Lifecycle.Phase = "fenced"
+			}
+			if kind != "missing" {
+				record(t, c, r)
+			}
+			live(t, c, c.Expected, func(req Request) Response {
+				res := Response{Inventory: c.Expected, Nonce: req.Nonce, Error: "query-revalidating"}
+				switch kind {
+				case "nonce":
+					res.Nonce = "replay"
+				case "inventory":
+					res.Inventory.Protocol++
+				case "contradictory":
+					res.OK = true
+				}
+				return res
+			})
+			got := c.Status(context.Background())
+			if kind == "running" {
+				if got.State != "pending" || got.Reason != "query-revalidating" || got.Cleanup != "" || got.PackageRunning != "running" {
+					t.Fatalf("%+v", got)
+				}
+				if c.CheckStopped(context.Background()) == nil {
+					t.Fatal("pending accepted as stopped")
+				}
+			} else if got.State == "pending" || got.State == "ready" {
+				t.Fatalf("untrusted pending: %+v", got)
+			}
+		})
+	}
+}

package/templates/native-go/backend/internal/helper/supervision.go

@@ -99,7 +99,7 @@ func supervisorReadiness(res Response, err error) string {
 		if res.OK && res.Error == "" {
 			return "ready"
 		}
-		if !res.OK && res.Error == "reload-revalidating" {
+		if !res.OK && (res.Error == "reload-revalidating" || res.Error == "query-revalidating") {
 			return res.Error
 		}
 	}

package/templates/native-go/backend/internal/helper/supervisor_frame.go

@@ -1,3 +1,6 @@
+//go:build !synopkgland_sdk_workers
+
+//line dsmapp/internal/helper/supervisor_frame.go:1
 package helper
 
 import (