@synopackageland/cli 0.4.1 → 0.5.3

package/dist/templates/native-go/backend/internal/helper/observation_health_test.go

@@ -89,7 +89,7 @@ func TestPendingReplyNeverCertifiesAdmissionOrStop(t *testing.T) {
 		res  Response
 		want string
 	}{
-		{Response{OK: true}, "ready"}, {Response{Error: "reload-revalidating"}, "reload-revalidating"},
+		{Response{OK: true}, "ready"}, {Response{Error: "query-revalidating"}, "query-revalidating"}, {Response{OK: true, Error: "query-revalidating"}, "fenced"}, {Response{Error: "reload-revalidating"}, "reload-revalidating"},
 		{Response{OK: true, Error: "reload-revalidating"}, "fenced"}, {Response{Error: "fenced"}, "fenced"}, {Response{}, "fenced"},
 	} {
 		if got := supervisorReadiness(tc.res, nil); got != tc.want {
@@ -113,3 +113,15 @@ func TestPendingReplyNeverCertifiesAdmissionOrStop(t *testing.T) {
 		}
 	}
 }
+
+func TestQueryPendingReplyNeverCertifiesStop(t *testing.T) {
+	i := fixture(t).Expected
+	res := Response{Inventory: i, Nonce: "nonce", Error: "query-revalidating"}
+	data, _ := json.Marshal(res)
+	if readSupervisorReply(bytes.NewReader(data), i, "nonce") == nil {
+		t.Fatal("query pending certified ACK")
+	}
+	if supervisorReadiness(res, errTrust) != "fenced" {
+		t.Fatal("unauthenticated query pending")
+	}
+}

package/dist/templates/native-go/backend/internal/helper/observer_diagnostic.go

@@ -12,6 +12,8 @@ const observerDiagnosticLimit = 32768
 // Only fixed branch names and transport metadata belong here. Never store a
 // signal body, query value, installation identity, or an error's text.
 type observerEvent struct {
+	Stage          string    `json:"stage,omitempty"`
+	Code           Code      `json:"code,omitempty"`
 	At             time.Time `json:"at"`
 	Kind           string    `json:"kind"`
 	Detail         string    `json:"detail,omitempty"`
@@ -23,12 +25,27 @@ type observerEvent struct {
 	SignalSequence uint64    `json:"signalSequence,omitempty"`
 	QuerySerial    uint64    `json:"querySerial,omitempty"`
 }
+
+// One pinned period survives ring wrap. Timestamps contain no query values;
+// elapsed time is measured before UTC serialization, using Go's monotonic clock.
+type observerQueryPending struct {
+	StartedAt   time.Time `json:"startedAt"`
+	PendingAt   time.Time `json:"pendingAt"`
+	EndedAt     time.Time `json:"endedAt"`
+	Outcome     string    `json:"outcome"`
+	ElapsedNS   int64     `json:"elapsedNs"`
+	Phase       string    `json:"phase"`
+	ErrorClass  string    `json:"errorClass"`
+	QuerySerial uint64    `json:"querySerial"`
+}
+
 type observerDiagnostic struct {
-	Schema int             `json:"schema"`
-	Epoch  string          `json:"epoch"`
-	Reason string          `json:"reason"`
-	Fence  observerEvent   `json:"fence"`
-	Events []observerEvent `json:"events"`
+	QueryPending *observerQueryPending `json:"queryPending,omitempty"`
+	Schema       int                   `json:"schema"`
+	Epoch        string                `json:"epoch"`
+	Reason       string                `json:"reason"`
+	Fence        observerEvent         `json:"fence"`
+	Events       []observerEvent       `json:"events"`
 }
 
 func (g *admission) recordObserver(e observerEvent) {
@@ -40,6 +57,7 @@ func (g *admission) recordObserverLocked(e observerEvent) {
 	if e.At.IsZero() {
 		e.At = time.Now().UTC()
 	}
+	e.At = e.At.UTC()
 	g.events[g.eventNext] = e
 	g.eventNext = (g.eventNext + 1) % observerEventLimit
 	if g.eventCount < observerEventLimit {
@@ -54,7 +72,7 @@ func (g *admission) fenceObserver(reason string, e observerEvent) {
 func (g *admission) fenceObserverLocked(reason string, e observerEvent) {
 	e.Kind = "fence"
 	if e.At.IsZero() {
-		e.At = time.Now().UTC()
+		e.At = time.Now()
 	}
 	if e.Detail == "" {
 		e.Detail = reason
@@ -62,6 +80,8 @@ func (g *admission) fenceObserverLocked(reason string, e observerEvent) {
 	if g.blocked == "" {
 		g.blocked = reason
 		g.firstFence = e
+		g.finishQueryPendingLocked("fence", e.At)
+		g.notifyObserverDiagnosticLocked()
 	}
 	g.recordObserverLocked(e)
 }
@@ -69,6 +89,14 @@ func (g *admission) observerDiagnostic(epoch string) observerDiagnostic {
 	g.mu.Lock()
 	defer g.mu.Unlock()
 	d := observerDiagnostic{Schema: 1, Epoch: epoch, Reason: g.blocked, Fence: g.firstFence, Events: make([]observerEvent, g.eventCount)}
+	if g.queryPending != nil {
+		period := *g.queryPending
+		period.StartedAt = period.StartedAt.UTC()
+		period.PendingAt = period.PendingAt.UTC()
+		period.EndedAt = period.EndedAt.UTC()
+		d.QueryPending = &period
+	}
+	d.Fence.At = d.Fence.At.UTC()
 	start := (g.eventNext - g.eventCount + observerEventLimit) % observerEventLimit
 	for n := range d.Events {
 		d.Events[n] = g.events[(start+n)%observerEventLimit]
@@ -76,12 +104,30 @@ func (g *admission) observerDiagnostic(epoch string) observerDiagnostic {
 	return d
 }
 
-// Diagnostics are independent of approval/completion authority. Write once on
-// owner return, after teardown attempts. A parked owner retains its lifecycle
-// sub-reason; a failed diagnostic write cannot change its fence or proof.
+// Coalesce notifications while storage is slow. The latest pinned period keeps
+// both endpoints even when a start and end arrive before the writer can run.
+func (g *admission) notifyObserverDiagnosticLocked() {
+	select {
+	case g.diagnosticWake <- struct{}{}:
+	default:
+	}
+}
+func (g *admission) finishQueryPendingLocked(outcome string, now time.Time) {
+	if g.queryPending == nil || g.queryPending.Outcome != "pending" {
+		return
+	}
+	g.queryPending.EndedAt = now
+	g.queryPending.Outcome = outcome
+	g.queryPending.ElapsedNS = int64(now.Sub(g.queryPending.StartedAt))
+	g.recordObserverLocked(observerEvent{At: now, Kind: "query-pending-ended", Detail: outcome, QuerySerial: g.unitSerial})
+	g.notifyObserverDiagnosticLocked()
+}
+
+// A write error cannot change a fence, admission, completion proof, or return
+// result. This fixed-size snapshot never stores signal bodies or query values.
 func persistObserverDiagnostic(c Client, epoch string, g *admission) {
 	d := g.observerDiagnostic(epoch)
-	if d.Reason == "" || !digestPattern.MatchString(epoch) {
+	if (d.Reason == "" && d.QueryPending == nil) || !digestPattern.MatchString(epoch) {
 		return
 	}
 	b, err := json.Marshal(d)

package/dist/templates/native-go/backend/internal/helper/observer_diagnostic_linux_test.go

@@ -67,6 +67,12 @@ func TestLinuxObserverQueryErrorClassification(t *testing.T) {
 			return Binding{}, nil, &unitSnapshotError{reason: "observation-unavailable", cause: c.err, phase: "get-unit"}
 		})
 		d := o.gate.observerDiagnostic("")
+		if c.want == "deadline" {
+			if err != nil || o.gate.readiness(time.Now()) != "query-revalidating" {
+				t.Fatalf("deadline not pending: %+v %v", d, err)
+			}
+			continue
+		}
 		if err == nil || d.Fence.Phase != "get-unit" || d.Fence.ErrorClass != c.want || d.Fence.Detail != "query-failed" {
 			t.Fatalf("classification %s: %+v %v", c.want, d, err)
 		}

package/dist/templates/native-go/backend/internal/helper/observer_diagnostic_writer.go

@@ -0,0 +1,40 @@
+package helper
+
+import "sync"
+
+// Diagnostics are independent of approval/completion authority. A single
+// worker does live writes; the signal/admission ordering point never does I/O.
+// Shutdown retains the existing best-effort final snapshot after teardown.
+func startObserverDiagnostics(c Client, epoch string, g *admission) func() {
+	return startObserverDiagnosticWriter(g, func() { persistObserverDiagnostic(c, epoch, g) })
+}
+
+func startObserverDiagnosticWriter(g *admission, persist func()) func() {
+	wake, stop, done := make(chan struct{}, 1), make(chan struct{}), make(chan struct{})
+	g.mu.Lock()
+	g.diagnosticWake = wake
+	g.mu.Unlock()
+	go func() {
+		defer close(done)
+		persist()
+		for {
+			select {
+			case <-wake:
+				persist()
+			case <-stop:
+				persist()
+				return
+			}
+		}
+	}()
+	var once sync.Once
+	return func() {
+		once.Do(func() {
+			g.mu.Lock()
+			g.diagnosticWake = nil
+			g.mu.Unlock()
+			close(stop)
+			<-done
+		})
+	}
+}

package/dist/templates/native-go/backend/internal/helper/process_linux.go

@@ -1,3 +1,6 @@
+//go:build !synopkgland_sdk_workers
+
+//line dsmapp/internal/helper/process_linux.go:1
 package helper
 
 import (

package/dist/templates/native-go/backend/internal/helper/purge.go

@@ -0,0 +1,115 @@
+package helper
+
+import (
+	"io/fs"
+	"os"
+	"path/filepath"
+	"regexp"
+	"syscall"
+)
+
+var terminalFile = regexp.MustCompile(`^(completion-[a-f0-9]{64}\.json|lifetime-[a-f0-9]{64}\.lock)$`)
+var cachedPayload = regexp.MustCompile(`^payload-[a-f0-9]{64}$`)
+
+// Purge is a separate fixed, administrator-approved operation. Never expose
+// deletion through the package socket. Unknown files (including data/grants)
+// are retained and cause refusal; only terminal lifecycle metadata is removed.
+func (c Client) Purge() error {
+	r, err := readRecord(c.StateDir, c.Owner)
+	if err != nil || r.Enabled || r.Inventory != c.Expected || !c.managementStopped(r) {
+		return errTrust
+	}
+	locks := []*os.File{}
+	defer func() {
+		for _, f := range locks {
+			f.Close()
+		}
+	}()
+	lock := func(name string) error {
+		f, err := os.OpenFile(filepath.Join(c.StateDir, name), os.O_CREATE|os.O_RDWR|syscall.O_NOFOLLOW, 0600)
+		if err != nil {
+			return err
+		}
+		locks = append(locks, f)
+		if err := protected(f.Name(), c.Owner, false); err != nil {
+			return err
+		}
+		if syscall.Flock(int(f.Fd()), syscall.LOCK_EX|syscall.LOCK_NB) != nil {
+			return errBusy
+		}
+		return nil
+	}
+	for _, name := range []string{"control.lock", "policy.lock"} {
+		if err := lock(name); err != nil {
+			return err
+		}
+	}
+	// Recheck after serialization against enable and the terminal publisher.
+	r, err = readRecord(c.StateDir, c.Owner)
+	if err != nil || r.Enabled || r.Inventory != c.Expected || !c.managementStopped(r) {
+		return errTrust
+	}
+	entries, err := os.ReadDir(c.StateDir)
+	if err != nil || len(entries) > 512 {
+		return errTrust
+	}
+	for _, entry := range entries {
+		name := entry.Name()
+		mode := fs.FileMode(0600)
+		switch {
+		case name == "approval.json":
+			mode = 0644
+		case cachedPayload.MatchString(name):
+			mode = 0700
+		case terminalFile.MatchString(name), name == "control.lock", name == "policy.lock", name == "observer-diagnostic.json":
+		default:
+			return errTrust
+		}
+		st, err := os.Lstat(filepath.Join(c.StateDir, name))
+		if err != nil {
+			return err
+		}
+		stat, ok := st.Sys().(*syscall.Stat_t)
+		if !ok || !st.Mode().IsRegular() || st.Mode().Perm() != mode || stat.Uid != c.Owner || stat.Nlink != 1 {
+			return errTrust
+		}
+		if filepath.Ext(name) == ".lock" && name != "control.lock" && name != "policy.lock" {
+			if err := lock(name); err != nil {
+				return err
+			}
+		}
+	}
+	// No recursive removal. A socket/process/foreign file prevents all deletion.
+	if err := protected(c.RunDir, c.Owner, true); err != nil {
+		return err
+	}
+	runtime, err := os.ReadDir(c.RunDir)
+	if err != nil || len(runtime) != 0 {
+		return errTrust
+	}
+	// If an I/O failure interrupts cleanup, retain a durable disabled gate and
+	// cleanup-required diagnostic. Remove that record only after other files.
+	r.Residual = true
+	if err := writeProtected(c.StateDir, "approval.json", r); err != nil {
+		return err
+	}
+	for _, entry := range entries {
+		if entry.Name() == "approval.json" {
+			continue
+		}
+		if err := os.Remove(filepath.Join(c.StateDir, entry.Name())); err != nil {
+			return err
+		}
+	}
+	if err := os.Remove(c.RunDir); err != nil {
+		return err
+	}
+	if err := os.Remove(filepath.Join(c.StateDir, "approval.json")); err != nil {
+		return err
+	}
+	if err := os.Remove(c.StateDir); err != nil {
+		_ = writeProtected(c.StateDir, "approval.json", r)
+		return err
+	}
+	return nil
+}

package/dist/templates/native-go/backend/internal/helper/purge_test.go

@@ -0,0 +1,59 @@
+package helper
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func terminalPurgeFixture(t *testing.T) Client {
+	c, f := controlFixture(t)
+	l := testLifecycle("fenced")
+	if err := createLifetime(c.Client, l); err != nil {
+		t.Fatal(err)
+	}
+	record(t, c.Client, Record{Schema: 2, Inventory: c.Expected, Enabled: false, Residual: true, Lifecycle: l})
+	if err := cleanRuntime(c.Client, true); err != nil {
+		t.Fatal(err)
+	}
+	if err := completeRecord(c.Client, l.Epoch, f.current); err != nil {
+		t.Fatal(err)
+	}
+	return c.Client
+}
+func TestPurgeRemovesOnlyVerifiedDisabledTerminalState(t *testing.T) {
+	c := terminalPurgeFixture(t)
+	if err := c.Purge(); err != nil {
+		t.Fatal(err)
+	}
+	for _, path := range []string{c.StateDir, c.RunDir} {
+		if _, err := os.Lstat(path); !os.IsNotExist(err) {
+			t.Fatalf("residue %s: %v", path, err)
+		}
+	}
+}
+func TestPurgeRefusesLiveStateUnknownEntriesAndLinks(t *testing.T) {
+	for _, which := range []string{"live", "unknown", "link", "proof"} {
+		t.Run(which, func(t *testing.T) {
+			c := terminalPurgeFixture(t)
+			switch which {
+			case "live":
+				r, _ := readRecord(c.StateDir, c.Owner)
+				r.Enabled = true
+				record(t, c, r)
+			case "unknown":
+				os.WriteFile(filepath.Join(c.StateDir, "user-data"), []byte("retain"), 0600)
+			case "link":
+				os.Symlink("/etc/passwd", filepath.Join(c.StateDir, "payload-"+c.Expected.PayloadDigest))
+			case "proof":
+				os.Remove(filepath.Join(c.StateDir, "completion-"+testLifecycle("stopped").Epoch+".json"))
+			}
+			if c.Purge() == nil {
+				t.Fatal("unsafe purge accepted")
+			}
+			if _, err := os.Stat(filepath.Join(c.StateDir, "approval.json")); err != nil {
+				t.Fatal("refusal deleted approval")
+			}
+		})
+	}
+}

package/dist/templates/native-go/backend/internal/helper/query_deadline_linux_test.go

@@ -0,0 +1,115 @@
+package helper
+
+import (
+	"context"
+	"github.com/godbus/dbus/v5"
+	"testing"
+	"time"
+)
+
+// Shared systemd congestion caused by Alpha's upgrade must not kill Beta.
+// A real 500ms context expiry exercises the same GetUnit/GetAll error path.
+func TestLinuxQueryDeadlineCrossPackageRecovery(t *testing.T) {
+	for _, name := range []string{"Alpha", "Beta"} {
+		t.Run(name, func(t *testing.T) {
+			for _, phase := range []string{"get-unit", "get-all"} {
+				t.Run(phase, func(t *testing.T) {
+					o := diagnosticObserver(t)
+					o.unit = "pkgctl-" + name + ".service"
+					ctx, cancel := context.WithTimeout(context.Background(), 500*time.Millisecond)
+					defer cancel()
+					err := o.reconcileSnapshot(ctx, func(ctx context.Context) (Binding, map[string]dbus.Variant, error) {
+						<-ctx.Done()
+						return Binding{}, nil, &unitSnapshotError{reason: "observation-unavailable", cause: ctx.Err(), phase: phase}
+					})
+					if err != nil || o.gate.readiness(time.Now()) != "query-revalidating" || o.gate.allow(time.Now()) {
+						t.Fatalf("temporary deadline fenced instead of pending: %v %+v", err, o.gate.observerDiagnostic(""))
+					}
+					time.Sleep(250 * time.Millisecond)
+					if err := o.reconcileSnapshot(context.Background(), func(context.Context) (Binding, map[string]dbus.Variant, error) {
+						return testBinding(), activeUnitValues(o), nil
+					}); err != nil || !o.gate.allow(time.Now()) {
+						t.Fatalf("unchanged snapshot did not recover: %v", err)
+					}
+				})
+			}
+		})
+	}
+}
+
+func TestLinuxQueryDeadlineBoundAndStickyFence(t *testing.T) {
+	o := diagnosticObserver(t)
+	start := time.Now()
+	timeout := func(context.Context) (Binding, map[string]dbus.Variant, error) {
+		return Binding{}, nil, &unitSnapshotError{reason: "observation-unavailable", cause: context.DeadlineExceeded, phase: "get-unit"}
+	}
+	if err := o.reconcileSnapshot(context.Background(), timeout); err != nil {
+		t.Fatal("first deadline fenced", err)
+	}
+	for n := 0; n < 3; n++ {
+		if err := o.reconcileSnapshot(context.Background(), timeout); err != nil {
+			t.Fatal("retry fenced", err)
+		}
+	}
+	if o.gate.readiness(start.Add(2900*time.Millisecond)) != "query-revalidating" {
+		t.Fatal("missing bounded pending")
+	}
+	if !o.gate.fenced(start.Add(3100*time.Millisecond)) || o.gate.observerDiagnostic("").Fence.Detail != "query-deadline" {
+		t.Fatal("query budget extended", o.gate.observerDiagnostic(""))
+	}
+	_ = o.observeValues(testBinding(), activeUnitValues(o), o.gate.unitSerial, time.Now())
+	if o.gate.allow(time.Now()) {
+		t.Fatal("fence resurrected")
+	}
+}
+
+func TestLinuxQueryDeadlineCannotExtendReloadOrHideIdentity(t *testing.T) {
+	for _, kind := range []string{"reload-first", "query-first", "identity", "cancel", "initial"} {
+		t.Run(kind, func(t *testing.T) {
+			o := diagnosticObserver(t)
+			now := time.Now()
+			if kind == "initial" {
+				o.gate = newAdmission(testBinding())
+			}
+			if kind == "reload-first" {
+				o.gate.requestUnitCheck(true, now.Add(-9500*time.Millisecond))
+				o.gate.requestUnitCheck(false, now)
+			}
+			err := o.reconcileSnapshot(context.Background(), func(context.Context) (Binding, map[string]dbus.Variant, error) {
+				return Binding{}, nil, &unitSnapshotError{reason: "observation-unavailable", cause: context.DeadlineExceeded, phase: "get-all"}
+			})
+			if kind == "initial" {
+				if err == nil {
+					t.Fatal("initial failure acquired authority")
+				}
+				return
+			}
+			if err != nil {
+				t.Fatal("deadline fenced early", err)
+			}
+			switch kind {
+			case "query-first":
+				o.gate.requestUnitCheck(true, now.Add(time.Second))
+				if !o.gate.fenced(now.Add(3100 * time.Millisecond)) {
+					t.Fatal("reload extended query budget")
+				}
+			case "reload-first":
+				if !o.gate.fenced(now.Add(3100 * time.Millisecond)) {
+					t.Fatal("query extended verification")
+				}
+			case "identity":
+				v := activeUnitValues(o)
+				v["ActiveEnterTimestampMonotonic"] = dbus.MakeVariant(uint64(999))
+				if o.observeValues(testBinding(), v, o.gate.unitSerial, time.Now()) == nil {
+					t.Fatal("changed identity accepted")
+				}
+			case "cancel":
+				if o.reconcileSnapshot(context.Background(), func(context.Context) (Binding, map[string]dbus.Variant, error) {
+					return Binding{}, nil, context.Canceled
+				}) == nil {
+					t.Fatal("cancel retried")
+				}
+			}
+		})
+	}
+}