@synopackageland/cli 0.4.1 → 0.5.0

package/dist/templates/native-go/backend/internal/helper/sdk_grant_repository_linux.go

@@ -0,0 +1,417 @@
+//go:build linux && synopkgland_sdk_workers
+
+package helper
+
+import (
+	"bytes"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+
+	"golang.org/x/sys/unix"
+)
+
+// FileGrantRepository pins a protected local directory and one root supervisor
+// owner using a lifetime flock. It is Linux/root-only; no injected UID bypass.
+// Lock paths, files and all parents are opened no-follow and checked by FD.
+type FileGrantRepository struct {
+	mu                         sync.Mutex
+	journalKnown               map[string]string
+	journalReady               bool
+	dir, owner, policy, grants *os.File
+	expected                   Inventory
+	known                      string // exact last observed/committed snapshot; detects online replay
+	poisoned, closed           bool
+	fault                      func(string) error // tests only; nil in production
+}
+
+func OpenFileGrantRepository(stateDir string, expected Inventory) (*FileGrantRepository, Code) {
+	if os.Geteuid() != 0 {
+		return nil, ErrDenied
+	}
+	if !expected.Valid() || expected.Protocol != DataProtocol {
+		return nil, ErrIncompatible
+	}
+	dir, err := openGrantDirectory(stateDir)
+	if err != nil {
+		return nil, ErrUnavailable
+	}
+	r := &FileGrantRepository{dir: dir, expected: expected}
+	fail := func(c Code) (*FileGrantRepository, Code) { r.Close(); return nil, c }
+	r.owner, err = r.openLock("grants-owner.lock")
+	if err != nil {
+		return fail(ErrUnavailable)
+	}
+	if err = unix.Flock(int(r.owner.Fd()), unix.LOCK_EX|unix.LOCK_NB); err != nil {
+		return fail(ErrBusy)
+	}
+	r.policy, err = r.openLock("policy.lock")
+	if err != nil {
+		return fail(ErrUnavailable)
+	}
+	r.grants, err = r.openLock("grants.lock")
+	if err != nil {
+		return fail(ErrUnavailable)
+	}
+	if c := r.cleanGrantTemps(); c != "" {
+		return fail(c)
+	}
+	if err = r.dir.Sync(); err != nil {
+		return fail(ErrUnavailable)
+	}
+	return r, ""
+}
+func openGrantDirectory(path string) (*os.File, error) {
+	if !filepath.IsAbs(path) || path != filepath.Clean(path) {
+		return nil, errTrust
+	}
+	fd, err := unix.Open("/", unix.O_RDONLY|unix.O_DIRECTORY|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0)
+	if err != nil {
+		return nil, err
+	}
+	check := func(fd int) error {
+		var st unix.Stat_t
+		if err := unix.Fstat(fd, &st); err != nil {
+			return err
+		}
+		if st.Uid != 0 || st.Gid != 0 || st.Mode&unix.S_IFMT != unix.S_IFDIR || st.Mode&0022 != 0 {
+			return errTrust
+		}
+		return nil
+	}
+	if err = check(fd); err != nil {
+		unix.Close(fd)
+		return nil, err
+	}
+	for _, component := range strings.Split(strings.TrimPrefix(path, "/"), "/") {
+		if component == "" {
+			continue
+		}
+		next, e := unix.Openat(fd, component, unix.O_RDONLY|unix.O_DIRECTORY|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0)
+		unix.Close(fd)
+		if e != nil {
+			return nil, e
+		}
+		fd = next
+		if err = check(fd); err != nil {
+			unix.Close(fd)
+			return nil, err
+		}
+	}
+	f := os.NewFile(uintptr(fd), path)
+	if err = lifetimeFilesystem(f); err != nil {
+		f.Close()
+		return nil, err
+	}
+	return f, nil
+}
+func (r *FileGrantRepository) openLock(name string) (*os.File, error) {
+	fd, err := unix.Openat(int(r.dir.Fd()), name, unix.O_CREAT|unix.O_RDWR|unix.O_NOFOLLOW|unix.O_NONBLOCK|unix.O_CLOEXEC, 0600)
+	if err != nil {
+		return nil, err
+	}
+	f := os.NewFile(uintptr(fd), name)
+	if _, err = grantFileStat(f, 0600, 0); err != nil {
+		f.Close()
+		return nil, err
+	}
+	return f, nil
+}
+func grantFileStat(f *os.File, mode uint32, limit int64) (unix.Stat_t, error) {
+	var st unix.Stat_t
+	if err := unix.Fstat(int(f.Fd()), &st); err != nil {
+		return st, err
+	}
+	if st.Uid != 0 || st.Gid != 0 || st.Mode&unix.S_IFMT != unix.S_IFREG || st.Mode&07777 != mode || st.Nlink != 1 || st.Size < 0 || st.Size > limit {
+		return st, errTrust
+	}
+	return st, nil
+}
+func (r *FileGrantRepository) checkLock(f *os.File) error {
+	st, err := grantFileStat(f, 0600, 0)
+	if err != nil {
+		return err
+	}
+	var path unix.Stat_t
+	if err := unix.Fstatat(int(r.dir.Fd()), f.Name(), &path, unix.AT_SYMLINK_NOFOLLOW); err != nil {
+		return err
+	}
+	if path.Dev != st.Dev || path.Ino != st.Ino || path.Mode != st.Mode || path.Nlink != 1 {
+		return errTrust
+	}
+	return nil
+}
+func (r *FileGrantRepository) withLocks(fn func() Code) Code {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	if r.closed || r.poisoned {
+		return ErrFenced
+	}
+	var st unix.Stat_t
+	if unix.Fstat(int(r.dir.Fd()), &st) != nil || st.Uid != 0 || st.Gid != 0 || st.Mode&0022 != 0 || st.Mode&unix.S_IFMT != unix.S_IFDIR {
+		r.poisoned = true
+		return ErrUnavailable
+	}
+	for _, f := range []*os.File{r.owner, r.policy, r.grants} {
+		if r.checkLock(f) != nil {
+			r.poisoned = true
+			return ErrUnavailable
+		}
+	}
+	if unix.Flock(int(r.policy.Fd()), unix.LOCK_EX|unix.LOCK_NB) != nil {
+		return ErrBusy
+	}
+	defer unix.Flock(int(r.policy.Fd()), unix.LOCK_UN)
+	if unix.Flock(int(r.grants.Fd()), unix.LOCK_EX|unix.LOCK_NB) != nil {
+		return ErrBusy
+	}
+	defer unix.Flock(int(r.grants.Fd()), unix.LOCK_UN)
+	return fn()
+}
+func (r *FileGrantRepository) read(name string, mode uint32, limit int64) ([]byte, error) {
+	fd, err := unix.Openat(int(r.dir.Fd()), name, unix.O_RDONLY|unix.O_NOFOLLOW|unix.O_NONBLOCK|unix.O_CLOEXEC, 0)
+	if err != nil {
+		return nil, err
+	}
+	f := os.NewFile(uintptr(fd), name)
+	defer f.Close()
+	if _, err := grantFileStat(f, mode, limit); err != nil {
+		return nil, err
+	}
+	b, err := io.ReadAll(io.LimitReader(f, limit+1))
+	if err != nil {
+		return nil, err
+	}
+	if int64(len(b)) > limit {
+		return nil, errTrust
+	}
+	return b, nil
+}
+func (r *FileGrantRepository) readPolicy() (GrantPolicy, Code) {
+	// Existing approval snapshots are root:root 0644; they have no credentials.
+	// Decode strict schema 2 independently from the grant schema 1 authority.
+	b, err := r.read("approval.json", 0644, 4096)
+	if err != nil {
+		return GrantPolicy{}, ErrUnavailable
+	}
+	var record Record
+	if c := decodeDataObject(bytes.NewReader(b), &record, 4096); c != "" {
+		return GrantPolicy{}, c
+	}
+	if record.Schema != 2 || record.Inventory != r.expected || record.Lifecycle == nil || !record.Lifecycle.valid() {
+		return GrantPolicy{}, ErrIncompatible
+	}
+	canonical, err := json.Marshal(record)
+	if err != nil {
+		return GrantPolicy{}, ErrInternal
+	}
+	sum := sha256.Sum256(canonical)
+	p := GrantPolicy{Inventory: record.Inventory, Epoch: record.Lifecycle.Epoch, ApprovalBinding: hex.EncodeToString(sum[:]), CapabilityDigest: record.Inventory.RegistryDigest, Enabled: record.Enabled && !record.Residual && record.Lifecycle.Phase == "running"}
+	return p, ""
+}
+func snapshotDigest(b []byte) string { sum := sha256.Sum256(b); return hex.EncodeToString(sum[:]) }
+func (r *FileGrantRepository) load() (GrantStore, Code) {
+	b, err := r.read("grants.json", 0600, MaxGrantStoreBytes)
+	if errors.Is(err, unix.ENOENT) && r.known == "" {
+		return GrantStore{Schema: GrantSchema, Revision: 1, Grants: []Grant{}}, ""
+	}
+	if err != nil {
+		r.poisoned = true
+		return GrantStore{}, ErrUnavailable
+	}
+	digest := snapshotDigest(b)
+	if r.known != "" && digest != r.known {
+		r.poisoned = true
+		return GrantStore{}, ErrStale
+	}
+	s, c := DecodeGrantStore(bytes.NewReader(b))
+	if c != "" {
+		r.poisoned = true
+		return GrantStore{}, c
+	}
+	r.known = digest
+	return s, ""
+}
+func (r *FileGrantRepository) Transact(fn func(GrantPolicy, *GrantStore) (bool, Code)) Code {
+	if fn == nil {
+		return ErrInvalid
+	}
+	return r.withLocks(func() Code {
+		p, c := r.readPolicy()
+		if c != "" {
+			r.poisoned = true
+			return c
+		}
+		s, c := r.load()
+		if c != "" {
+			return c
+		}
+		old := cloneAuthorityStore(s)
+		write, c := fn(p, &s)
+		if c = safeGrantCode(c); c != "" {
+			return c
+		}
+		if !write {
+			return ""
+		}
+		b, err := json.Marshal(s)
+		if err != nil {
+			return ErrInvalid
+		}
+		if _, c := DecodeGrantStore(bytes.NewReader(b)); c != "" {
+			return c
+		}
+		if c := validateGrantTransition(old, s, p); c != "" {
+			return c
+		}
+		c = r.commit("grants.json", b)
+		if c != "" {
+			r.poisoned = true
+			return c
+		}
+		r.known = snapshotDigest(b)
+		return ""
+	})
+}
+func (r *FileGrantRepository) atStage(stage string) error {
+	if r.fault != nil {
+		return r.fault(stage)
+	}
+	return nil
+}
+func (r *FileGrantRepository) commit(name string, b []byte) Code {
+	id, c := randomGrantID()
+	if c != "" {
+		return c
+	}
+	temp := ".grant-transition-" + id
+	fd, err := unix.Openat(int(r.dir.Fd()), temp, unix.O_CREAT|unix.O_EXCL|unix.O_WRONLY|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0600)
+	if err != nil {
+		return ErrUnavailable
+	}
+	f := os.NewFile(uintptr(fd), temp)
+	defer f.Close()
+	defer unix.Unlinkat(int(r.dir.Fd()), temp, 0)
+	if err = f.Chmod(0600); err != nil {
+		return ErrUnavailable
+	}
+	if err = r.atStage("write"); err != nil {
+		return ErrUnavailable
+	}
+	if n, err := f.Write(b); err != nil || n != len(b) {
+		return ErrUnavailable
+	}
+	if err = r.atStage("file-sync"); err != nil {
+		return ErrUnavailable
+	}
+	if err = f.Sync(); err != nil {
+		return ErrUnavailable
+	}
+	if err = f.Close(); err != nil {
+		return ErrUnavailable
+	}
+	if err = r.atStage("rename"); err != nil {
+		return ErrUnavailable
+	}
+	if err = unix.Renameat(int(r.dir.Fd()), temp, int(r.dir.Fd()), name); err != nil {
+		return ErrUnavailable
+	}
+	if err = r.atStage("after-rename"); err != nil {
+		return ErrCommitUncertain
+	}
+	if err = r.atStage("directory-sync"); err != nil {
+		return ErrCommitUncertain
+	}
+	if err = r.dir.Sync(); err != nil {
+		return ErrCommitUncertain
+	}
+	return ""
+}
+func (r *FileGrantRepository) SaveQuiescence(q GrantQuiescence) Code {
+	if !completeQuiescence(q) {
+		return ErrInvalid
+	}
+	return r.withLocks(func() Code {
+		p, c := r.readPolicy()
+		if c != "" {
+			r.poisoned = true
+			return c
+		}
+		if q.Key.Epoch != p.Epoch {
+			return ErrStale
+		}
+		s, c := r.load()
+		if c != "" {
+			return c
+		}
+		g := findGrant(&s, q.Key.GrantID)
+		if g == nil || g.State != GrantRevoked || g.Revision != q.Key.Revision {
+			return ErrStale
+		}
+		// One opaque-name proof per tombstone, <=256; never authority on restart.
+		b, err := json.Marshal(q)
+		if err != nil {
+			return ErrInternal
+		}
+		c = r.commit("grant-q-"+g.ID+".json", b)
+		if c != "" {
+			r.poisoned = true
+		}
+		return c
+	})
+}
+func (r *FileGrantRepository) Close() error {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	if r.closed {
+		return nil
+	}
+	r.closed = true
+	var err error
+	for _, f := range []*os.File{r.grants, r.policy, r.owner, r.dir} {
+		if f != nil {
+			err = errors.Join(err, f.Close())
+		}
+	}
+	return err
+}
+
+// The owner lock excludes every other writer. Orphan temp names are never
+// authority. Only exact generated names and protected, singly linked root files
+// are removed. Bound enumeration and refuse unknown/untrusted residues.
+func (r *FileGrantRepository) cleanGrantTemps() Code {
+	fd, err := unix.Openat(int(r.dir.Fd()), ".", unix.O_RDONLY|unix.O_DIRECTORY|unix.O_CLOEXEC, 0)
+	if err != nil {
+		return ErrUnavailable
+	}
+	listing := os.NewFile(uintptr(fd), "state-listing")
+	defer listing.Close()
+	names, err := listing.Readdirnames(4097)
+	if err != nil && err != io.EOF {
+		return ErrUnavailable
+	}
+	if len(names) > 4096 {
+		return ErrLimit
+	}
+	for _, name := range names {
+		if !strings.HasPrefix(name, ".grant-transition-") {
+			continue
+		}
+		if !allReferences(strings.TrimPrefix(name, ".grant-transition-")) {
+			return ErrCleanupRequired
+		}
+		if _, err := r.read(name, 0600, MaxGrantStoreBytes); err != nil {
+			return ErrCleanupRequired
+		}
+		if err := unix.Unlinkat(int(r.dir.Fd()), name, 0); err != nil {
+			return ErrCleanupRequired
+		}
+	}
+	return ""
+}

package/dist/templates/native-go/backend/internal/helper/sdk_grant_snapshot.go

@@ -0,0 +1,94 @@
+//go:build synopkgland_sdk_workers
+
+package helper
+
+import (
+	"math"
+	"reflect"
+	"slices"
+)
+
+// Pure snapshot invariants shared by the ordering owner and Linux persistence.
+func findGrant(s *GrantStore, id string) *Grant {
+	for n := range s.Grants {
+		if s.Grants[n].ID == id {
+			return &s.Grants[n]
+		}
+	}
+	return nil
+}
+func cloneAuthorityGrant(g Grant) Grant {
+	g.Actions = slices.Clone(g.Actions)
+	g.Scope.Segments = slices.Clone(g.Scope.Segments)
+	return g
+}
+
+func cloneAuthorityStore(s GrantStore) GrantStore {
+	s.Grants = slicesCloneGrants(s.Grants)
+	s.Background = cloneSDKBackgrounds(s.Background)
+	return s
+}
+func slicesCloneGrants(gs []Grant) []Grant {
+	out := make([]Grant, len(gs))
+	for i, g := range gs {
+		out[i] = cloneAuthorityGrant(g)
+	}
+	return out
+}
+
+// Root callback mistakes cannot drop tombstones, un-suspend, overwrite a grant's
+// scope/owner/actions, reuse IDs, or roll revisions back. Offline root disk
+// rollback remains outside the threat model; restart still suspends active.
+func validateGrantTransition(old, next GrantStore, p GrantPolicy) Code {
+	if old.Schema != next.Schema && (old.Schema != 1 || next.Schema != 2) {
+		return ErrIncompatible
+	}
+	if old.Schema == 1 && next.Schema == 2 {
+		for _, g := range next.Grants {
+			if g.State == GrantActive {
+				return ErrDenied
+			}
+		}
+	}
+	if c := validateSDKBackgroundTransition(old, next, p); c != "" {
+		return c
+	}
+	if reflect.DeepEqual(old, next) {
+		return ""
+	}
+	if old.Revision == math.MaxUint64 || next.Revision != old.Revision+1 {
+		return ErrStale
+	}
+	for _, before := range old.Grants {
+		after := findGrant(&next, before.ID)
+		if after == nil {
+			return ErrDenied
+		}
+		if reflect.DeepEqual(before, *after) {
+			continue
+		}
+		if before.State == GrantRevoked || before.Revision == math.MaxUint64 || after.Revision != before.Revision+1 {
+			return ErrDenied
+		}
+		if after.State != GrantRevoked && (before.State != GrantActive || after.State != GrantSuspended) {
+			return ErrDenied
+		}
+		normalized := cloneAuthorityGrant(*after)
+		normalized.Revision = before.Revision
+		normalized.State = before.State
+		normalized.Reason = before.Reason
+		normalized.RevokedAt = before.RevokedAt
+		if !reflect.DeepEqual(before, normalized) {
+			return ErrDenied
+		}
+	}
+	for _, g := range next.Grants {
+		if findGrant(&old, g.ID) == nil && (g.State != GrantActive || g.Revision != 1 || g.Inventory != p.Inventory || g.ApprovalBinding != p.ApprovalBinding || g.CapabilityDigest != p.CapabilityDigest || g.LastValidated.Epoch != p.Epoch || !p.Enabled) {
+			return ErrDenied
+		}
+	}
+	return ""
+}
+func completeQuiescence(q GrantQuiescence) bool {
+	return (q.Cohort == nil || (q.Cohort.Key == q.Key && q.Cohort.valid())) && allReferences(q.Key.Epoch, q.Key.GrantID) && q.Key.Revision > 0 && q.ChildrenReaped && q.RelayClosed && q.LeasesClosed && q.FDsClosed && q.EffectsRecorded
+}

package/dist/templates/native-go/backend/internal/helper/sdk_history.go

@@ -0,0 +1,80 @@
+//go:build synopkgland_sdk_workers
+
+package helper
+
+import "dsmapp/internal/helper/jobcontract"
+
+func (v *sdkJobViews) retainedDisplays(delegations map[string]sdkDelegationDisplay) ([]sdkJobDisplay, Code) {
+	v.history = map[string]sdkJournalRecord{}
+	journal, ok := v.owner.services.Journal.(sdkRetainedJournal)
+	if !ok {
+		return nil, ""
+	}
+	records, code := journal.Records()
+	if code != "" {
+		return nil, code
+	}
+	out := []sdkJobDisplay{}
+	for _, record := range records {
+		id := record.Intent.Request.Control.Binding.Job.ID
+		if v.owner.jobs[id] != nil {
+			continue
+		}
+		if len(v.history)+len(v.owner.jobs) >= jobcontract.MaxExecutionKeys {
+			return nil, ErrLimit
+		}
+		if _, exists := v.history[id]; exists {
+			return nil, ErrInvalid
+		}
+		// Startup must reconcile every orphan before public admission/history.
+		if record.State != "finished" && record.State != "interrupted" {
+			return nil, ErrCleanupRequired
+		}
+		v.history[id] = record
+		item := sdkRetainedDisplay(id, record)
+		if d := record.Intent.Request.Control.Binding.Delegation; d != nil {
+			if value, exists := delegations[d.ID]; exists {
+				copy := value
+				item.Delegation = &copy
+			}
+		}
+		out = append(out, item)
+	}
+	return out, ""
+}
+func (v *sdkJobViews) owns(id string, a NativeActor) bool {
+	if j := v.owner.jobs[id]; j != nil {
+		return j.actor.Principal() == a.Principal()
+	}
+	if h, ok := v.history[id]; ok {
+		return sdkIdentity(h.Intent.Actor) == relaxedActorIdentity(a)
+	}
+	return false
+}
+func (v *sdkJobViews) intentID(id string) string {
+	if j := v.owner.jobs[id]; j != nil {
+		return j.request.Control.Intent.ID
+	}
+	if h, ok := v.history[id]; ok {
+		return h.Intent.Request.Control.Intent.ID
+	}
+	return ""
+}
+
+// sdkRetainedDisplay projects one retained journal record; callers add revision and delegation.
+func sdkRetainedDisplay(id string, record sdkJournalRecord) sdkJobDisplay {
+	item := sdkJobDisplay{JobID: id, Mode: record.Intent.Request.Control.Binding.Mode, State: jobcontract.Interrupted, SafeReason: jobcontract.Suspended, EffectsUnknown: true, KnownEffects: jobcontract.Result{ResultSchema: 1}, Progress: jobcontract.Progress{Phase: "starting"}}
+	if r := record.Receipt; r != nil {
+		item.State, item.SafeReason = r.Job.State, r.Job.Reason
+		item.Progress = r.Job.Progress
+		item.Progress.TotalUnits = sdkCopyTime(r.Job.Progress.TotalUnits)
+		item.AcceptedAt = r.Job.AcceptedAt
+		item.StartedAt = sdkCopyTime(r.Job.StartedAt)
+		item.FinishedAt = sdkCopyTime(r.Job.FinishedAt)
+		item.CancelRequested, item.Drained, item.EffectsUnknown = r.Job.CancelRequested, r.Job.Drained, r.Job.EffectsUnknown
+		if r.Result != nil {
+			item.KnownEffects = *r.Result
+		}
+	}
+	return item
+}

package/dist/templates/native-go/backend/internal/helper/sdk_history_test.go

@@ -0,0 +1,76 @@
+//go:build synopkgland_sdk_workers
+
+package helper
+
+import (
+	"context"
+	"dsmapp/internal/helper/jobcontract"
+	"encoding/json"
+	"strings"
+	"testing"
+)
+
+func TestSDKRetainedHistoryIsReadOnlyOwnerScopedAndNeverResumed(t *testing.T) {
+	f := sdkJobFixture(t)
+	actor, c := f.s.authority.actor(context.Background(), f.carriers, nil)
+	if c != "" {
+		t.Fatal(c)
+	}
+	record := sdkJournalRecord{Schema: 1, State: "interrupted", Intent: sdkJobIntent{Request: f.r, Actor: sdkPrincipal(actor), SessionRef: actor.SessionRef()}}
+	record.Intent.Request.Control.Binding.Epoch = grantRef('f')
+	f.o.services.Journal = &sdkMemoryJournal{records: []sdkJournalRecord{record}}
+	v := newSDKJobViews(f.o)
+	page, c := v.ownerPage(context.Background(), f.carriers, "")
+	if c != "" || len(page.Items) != 1 || page.Items[0].State != jobcontract.Interrupted || page.Items[0].Drained || !page.Items[0].EffectsUnknown {
+		t.Fatal(page, c)
+	}
+	v.counts = map[uint32]int{}
+	if d, code := v.diagnose(context.Background(), f.carriers, false); code != "" || d.Total != 1 {
+		t.Fatal(d, code)
+	}
+	v.counts = map[uint32]int{}
+	b, _ := json.Marshal(page)
+	for _, secret := range []string{"fixture", actor.Username(), "sessionRef", "inputDigest"} {
+		if strings.Contains(string(b), secret) {
+			t.Fatal("retained leak", secret)
+		}
+	}
+	if len(f.o.jobs) != 0 || len(f.children) != 0 {
+		t.Fatal("history restored execution")
+	}
+	if _, c = v.result(context.Background(), f.carriers, f.r.Control.Binding.Job.ID); c != ErrDenied {
+		t.Fatal("history restored result authority", c)
+	}
+	v.counts = map[uint32]int{}
+	record.Intent.Actor.Username = "different-owner"
+	f.o.services.Journal = &sdkMemoryJournal{records: []sdkJournalRecord{record}}
+	page, c = v.ownerPage(context.Background(), f.carriers, "")
+	if c != "" || len(page.Items) != 0 {
+		t.Fatal("cross-owner history", page, c)
+	}
+}
+
+func TestSDKRetainedBackgroundRevocationDoesNotInventQ(t *testing.T) {
+	f := newSDKBackgroundFixture(t)
+	f.confirm(t, f.prepare(t, 0))
+	for i := range f.journal2.records {
+		f.journal2.records[i].State = "interrupted"
+	}
+	f.o.jobs = map[string]*sdkJob{}
+	v := newSDKJobViews(f.o)
+	page, c := v.ownerPage(context.Background(), f.carriers, "")
+	if c != "" || len(page.Items) != 1 {
+		t.Fatal(page, c)
+	}
+	d := page.Items[0].Delegation
+	if d == nil {
+		t.Fatal("missing retained delegation")
+	}
+	result, c := v.revoke(context.Background(), f.carriers, page.Items[0].JobID, page.Revision, d.Revision, d.StoreRevision)
+	if c != ErrCleanupRequired || !result.Revoked || result.Drained || len(f.o.jobs) != 0 {
+		t.Fatal(result, c)
+	}
+	if f.repo.store.Background[0].State != "revoked" {
+		t.Fatal("retained consent not revoked")
+	}
+}