@synopackageland/cli 0.4.1 → 0.5.3

package/templates/native-go/backend/internal/helper/query_pending_diagnostic_test.go

@@ -0,0 +1,254 @@
+package helper
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+func TestQueryPendingDiagnosticSnapshotIsBoundedAndDetached(t *testing.T) {
+	g := newAdmission(testBinding())
+	now := time.Now().In(time.FixedZone("fixture", 8*60*60))
+	g.queryPending = &observerQueryPending{StartedAt: now, PendingAt: now.Add(500 * time.Millisecond), Outcome: "pending", Phase: "get-unit", ErrorClass: "deadline"}
+	for n := 0; n < observerEventLimit+20; n++ {
+		g.recordObserver(observerEvent{Kind: "query-phase"})
+	}
+	d := g.observerDiagnostic(strings.Repeat("e", 64))
+	if d.QueryPending == nil || !d.QueryPending.StartedAt.Equal(now) {
+		t.Fatalf("missing pinned period: %+v", d)
+	}
+	if d.QueryPending.StartedAt.Location() != time.UTC || d.QueryPending.PendingAt.Location() != time.UTC {
+		t.Fatal("diagnostic timestamps are not UTC")
+	}
+	d.QueryPending.Outcome = "mutated"
+	if g.observerDiagnostic(d.Epoch).QueryPending.Outcome != "pending" {
+		t.Fatal("snapshot aliases period")
+	}
+	payload, err := json.Marshal(d)
+	if err != nil || len(payload) > observerDiagnosticLimit {
+		t.Fatalf("size %d: %v", len(payload), err)
+	}
+	var decoded observerDiagnostic
+	if err := json.Unmarshal(payload, &decoded); err != nil || decoded.QueryPending == nil || !decoded.QueryPending.StartedAt.Equal(now) {
+		t.Fatalf("period roundtrip: %+v %v", decoded, err)
+	}
+}
+
+func TestQueryPendingDiagnosticPeriodLifecycle(t *testing.T) {
+	for _, outcome := range []string{"ready", "fence", "signal-fence", "reload-fence"} {
+		t.Run(outcome, func(t *testing.T) {
+			start := time.Now()
+			g := newAdmission(testBinding())
+			g.observeUnit(testBinding(), 7, "", false, true, 0, start)
+			e := observerEvent{Phase: "get-owner", ErrorClass: "deadline", QuerySerial: 0}
+			if !g.deferUnitDeadline(0, start, start.Add(500*time.Millisecond), e) {
+				t.Fatal("first timeout fenced")
+			}
+			first := g.observerDiagnostic("").QueryPending
+			if first == nil || !first.StartedAt.Equal(start) || !first.PendingAt.Equal(start.Add(500*time.Millisecond)) || first.Outcome != "pending" || first.Phase != "get-owner" || first.ElapsedNS != 0 {
+				t.Fatalf("wrong first query: %+v", first)
+			}
+			e.Phase = "get-all"
+			if !g.deferUnitDeadline(0, start.Add(750*time.Millisecond), start.Add(time.Second), e) {
+				t.Fatal("retry fenced")
+			}
+			for n := 0; n < observerEventLimit+20; n++ {
+				g.recordObserver(observerEvent{Kind: "query-phase"})
+			}
+			end := start.Add(1500 * time.Millisecond)
+			want := outcome
+			switch outcome {
+			case "ready":
+				g.observeUnit(testBinding(), 7, "", false, true, 0, end)
+			case "fence":
+				end = start.Add(unitQueryRecoveryBudget)
+				g.fenced(end)
+			case "signal-fence":
+				want = "fence"
+				g.fenceObserver("bus-owner-changed", observerEvent{At: end, Detail: "owner-signal"})
+			case "reload-fence":
+				want = "fence"
+				g.requestUnitCheck(true, start.Add(time.Second))
+				end = start.Add(unitQueryRecoveryBudget)
+				g.fenced(end)
+			}
+			d := g.observerDiagnostic("")
+			p := d.QueryPending
+			if p == nil || !p.StartedAt.Equal(start) || !p.PendingAt.Equal(start.Add(500*time.Millisecond)) || !p.EndedAt.Equal(end) || p.Outcome != want || p.ElapsedNS != int64(end.Sub(start)) || p.Phase != "get-owner" {
+				t.Fatalf("wrong ended period: %+v", p)
+			}
+			if want == "ready" {
+				if !g.allow(end) {
+					t.Fatal("recovered admission denied")
+				}
+				later := end.Add(100 * time.Millisecond)
+				g.deferUnitDeadline(0, later, later.Add(500*time.Millisecond), e)
+				if p = g.observerDiagnostic("").QueryPending; !p.StartedAt.Equal(later) || p.Outcome != "pending" || !p.EndedAt.IsZero() || p.ElapsedNS != 0 {
+					t.Fatalf("latest cycle not replaced: %+v", p)
+				}
+			} else {
+				g.observeUnit(testBinding(), 7, "", false, true, g.unitSerial, end)
+				if g.allow(end) || g.observerDiagnostic("").QueryPending.ElapsedNS != p.ElapsedNS {
+					t.Fatal("terminal period or fence changed")
+				}
+			}
+		})
+	}
+}
+
+func TestQueryPendingDiagnosticDiscardedProbeDoesNotStartOrEndPeriod(t *testing.T) {
+	start := time.Now()
+	g := newAdmission(testBinding())
+	if g.deferUnitDeadline(0, start, start, observerEvent{}) || g.observerDiagnostic("").QueryPending != nil {
+		t.Fatal("startup acquired pending")
+	}
+	g.observeUnit(testBinding(), 7, "", false, true, 0, start)
+	g.requestUnitCheck(true, start)
+	if g.deferUnitDeadline(0, start, start, observerEvent{}) || g.observerDiagnostic("").QueryPending != nil {
+		t.Fatal("obsolete probe started pending")
+	}
+	g.requestUnitCheck(false, start)
+	g.deferUnitDeadline(g.unitSerial, start, start.Add(500*time.Millisecond), observerEvent{Phase: "get-unit", ErrorClass: "deadline"})
+	g.observeUnit(testBinding(), 7, "", false, true, 0, start.Add(time.Second))
+	if p := g.observerDiagnostic("").QueryPending; p == nil || p.Outcome != "pending" {
+		t.Fatalf("obsolete success ended pending: %+v", p)
+	}
+}
+
+func TestQueryPendingDiagnosticPersistsWhileOwnerLives(t *testing.T) {
+	for _, fail := range []bool{false, true} {
+		t.Run(map[bool]string{false: "private-file", true: "write-failure"}[fail], func(t *testing.T) {
+			c := fixture(t)
+			path := filepath.Join(c.StateDir, "observer-diagnostic.json")
+			if fail {
+				if err := os.Mkdir(path, 0700); err != nil {
+					t.Fatal(err)
+				}
+			}
+			start := time.Now()
+			g := newAdmission(testBinding())
+			g.observeUnit(testBinding(), 7, "", false, true, 0, start)
+			stop := startObserverDiagnostics(c, strings.Repeat("e", 64), g)
+			defer stop()
+			g.deferUnitDeadline(0, start, start.Add(500*time.Millisecond), observerEvent{Phase: "get-all", ErrorClass: "deadline"})
+			read := func(want string) observerDiagnostic {
+				t.Helper()
+				deadline := time.Now().Add(2 * time.Second)
+				for time.Now().Before(deadline) {
+					b, err := os.ReadFile(path)
+					var d observerDiagnostic
+					if err == nil && json.Unmarshal(b, &d) == nil && d.QueryPending != nil && d.QueryPending.Outcome == want {
+						return d
+					}
+					time.Sleep(time.Millisecond)
+				}
+				t.Fatalf("live %s diagnostic not persisted", want)
+				return observerDiagnostic{}
+			}
+			if !fail {
+				read("pending")
+			}
+			end := start.Add(750 * time.Millisecond)
+			g.observeUnit(testBinding(), 7, "", false, true, 0, end)
+			if !g.allow(end) {
+				t.Fatal("write failure changed recovery")
+			}
+			if !fail {
+				d := read("ready")
+				if d.Reason != "" || d.Epoch != strings.Repeat("e", 64) || d.QueryPending.ElapsedNS != int64(750*time.Millisecond) {
+					t.Fatalf("bad live recovery: %+v", d)
+				}
+				st, err := os.Stat(path)
+				if err != nil || st.Mode().Perm() != 0600 || st.Size() > observerDiagnosticLimit {
+					t.Fatalf("bad private bounded file: %v %v", st, err)
+				}
+				g.deferUnitDeadline(0, end, end.Add(500*time.Millisecond), observerEvent{Phase: "get-unit", ErrorClass: "deadline"})
+				g.fenced(end.Add(unitQueryRecoveryBudget))
+				d = read("fence")
+				if d.QueryPending.ElapsedNS != int64(unitQueryRecoveryBudget) || d.Fence.Detail != "query-deadline" {
+					t.Fatalf("bad live fence: %+v", d)
+				}
+			}
+		})
+	}
+}
+
+func TestQueryPendingDiagnosticSlowWriterCannotDelayAdmission(t *testing.T) {
+	g := newAdmission(testBinding())
+	start := time.Now()
+	g.observeUnit(testBinding(), 7, "", false, true, 0, start)
+	entered := make(chan struct{})
+	release := make(chan struct{})
+	var writes atomic.Int32
+	stop := startObserverDiagnosticWriter(g, func() {
+		if writes.Add(1) == 1 {
+			close(entered)
+			<-release
+		}
+	})
+	// Always release before shutdown, including a failing assertion.
+	defer stop()
+	defer close(release)
+	select {
+	case <-entered:
+	case <-time.After(time.Second):
+		t.Fatal("writer not started")
+	}
+	done := make(chan struct{})
+	go func() {
+		// Repeated periods while storage is stalled must coalesce in bounded memory.
+		for n := 0; n < observerEventLimit*2; n++ {
+			at := start.Add(time.Duration(n) * time.Millisecond)
+			g.deferUnitDeadline(0, at, at.Add(time.Microsecond), observerEvent{Phase: "get-unit", ErrorClass: "deadline"})
+			g.observeUnit(testBinding(), 7, "", false, true, 0, at.Add(2*time.Microsecond))
+		}
+		g.deferUnitDeadline(0, start, start.Add(500*time.Millisecond), observerEvent{Phase: "get-unit", ErrorClass: "deadline"})
+		g.fenced(start.Add(unitQueryRecoveryBudget))
+		close(done)
+	}()
+	select {
+	case <-done:
+	case <-time.After(time.Second):
+		t.Fatal("storage blocked admission")
+	}
+	d := g.observerDiagnostic("")
+	if d.QueryPending == nil || d.QueryPending.Outcome != "fence" || d.QueryPending.ElapsedNS != int64(unitQueryRecoveryBudget) || len(d.Events) != observerEventLimit {
+		t.Fatalf("latest period lost: %+v", d)
+	}
+}
+
+func TestQueryPendingDiagnosticShutdownFlushesLatest(t *testing.T) {
+	g := newAdmission(testBinding())
+	start := time.Now()
+	g.observeUnit(testBinding(), 7, "", false, true, 0, start)
+	entered, release := make(chan struct{}), make(chan struct{})
+	var latest atomic.Pointer[observerDiagnostic]
+	var writes atomic.Int32
+	stop := startObserverDiagnosticWriter(g, func() {
+		if writes.Add(1) == 1 {
+			close(entered)
+			<-release
+		}
+		d := g.observerDiagnostic(strings.Repeat("e", 64))
+		latest.Store(&d)
+	})
+	defer stop()
+	select {
+	case <-entered:
+	case <-time.After(time.Second):
+		close(release)
+		t.Fatal("writer not started")
+	}
+	g.deferUnitDeadline(0, start, start.Add(500*time.Millisecond), observerEvent{Phase: "get-unit", ErrorClass: "deadline"})
+	g.observeUnit(testBinding(), 7, "", false, true, 0, start.Add(750*time.Millisecond))
+	close(release)
+	stop()
+	d := latest.Load()
+	if d == nil || d.QueryPending == nil || d.QueryPending.Outcome != "ready" || d.QueryPending.ElapsedNS != int64(750*time.Millisecond) {
+		t.Fatalf("shutdown lost latest: %+v", d)
+	}
+}

package/templates/native-go/backend/internal/helper/relaxed_invalidation.go

@@ -1,3 +1,6 @@
+//go:build !synopkgland_sdk_workers
+
+//line dsmapp/internal/helper/relaxed_invalidation.go:1
 package helper
 
 import (

package/templates/native-go/backend/internal/helper/revoke.go

@@ -0,0 +1,109 @@
+package helper
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"io"
+	"io/fs"
+	"net"
+	"os"
+	"path/filepath"
+	"syscall"
+	"time"
+)
+
+// Called by the already approved root child after SO_PEERCRED authorization.
+// This endpoint can only withdraw the exact installed build's authority. It
+// cannot start a process, select a path, signal a PID, or replace an inventory.
+func packageRevoke(c Client, req Request) error {
+	if req.Op != "revoke" || req.Inventory != c.Expected || !c.Expected.Valid() || !digestPattern.MatchString(req.Nonce) {
+		return errTrust
+	}
+	if err := protected(c.StateDir, c.Owner, true); err != nil {
+		return err
+	}
+	f, err := os.OpenFile(filepath.Join(c.StateDir, "control.lock"), os.O_CREATE|os.O_RDWR|syscall.O_NOFOLLOW, 0600)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+	if err := protected(f.Name(), c.Owner, false); err != nil {
+		return err
+	}
+	if syscall.Flock(int(f.Fd()), syscall.LOCK_EX|syscall.LOCK_NB) != nil {
+		return errBusy
+	}
+	defer syscall.Flock(int(f.Fd()), syscall.LOCK_UN)
+	return policyUpdate(c, func(r *Record) error {
+		if r.Inventory != c.Expected || r.Lifecycle == nil || r.Lifecycle.Phase != "running" || !r.Enabled {
+			return errTrust
+		}
+		r.Enabled = false
+		r.Residual = true
+		r.Lifecycle.Phase = "fenced"
+		r.Lifecycle.Completion = ""
+		r.Lifecycle.Reason = "package-revoke"
+		return nil
+	})
+}
+
+// Revoke runs as the package UID. A socket acknowledgement proves only durable
+// withdrawal; success additionally requires the owning supervisor's sealed
+// terminal publication and absent runtime. No missing-socket shortcut.
+func (c Client) Revoke(ctx context.Context) error {
+	ctx, cancel := context.WithTimeout(ctx, 10*time.Second)
+	defer cancel()
+	r, err := readRecord(c.StateDir, c.Owner)
+	if errors.Is(err, fs.ErrNotExist) {
+		return c.CheckStopped(ctx)
+	}
+	// The new build may manage the old disabled terminal publication without
+	// acquiring its authority or mutating it. This keeps uninstall possible
+	// before the user has approved the upgraded build.
+	if err == nil && !r.Enabled && c.managementStopped(r) {
+		return nil
+	}
+	if err != nil || r.Inventory != c.Expected {
+		return errTrust
+	}
+	if !r.Enabled {
+		if c.managementStopped(r) {
+			return nil
+		}
+		return errTrust
+	}
+	if r.Lifecycle == nil || r.Lifecycle.Phase != "running" {
+		return errTrust
+	}
+	dialer := net.Dialer{Timeout: time.Second}
+	conn, err := dialer.DialContext(ctx, "unix", filepath.Join(c.RunDir, "helper.sock"))
+	if err != nil {
+		return err
+	}
+	defer conn.Close()
+	if c.Peer == nil || c.Peer(conn.(*net.UnixConn)) != nil {
+		return errTrust
+	}
+	conn.SetDeadline(time.Now().Add(time.Second))
+	var nonce [32]byte
+	if _, err := rand.Read(nonce[:]); err != nil {
+		return err
+	}
+	req := Request{Inventory: c.Expected, Op: "revoke", Nonce: hex.EncodeToString(nonce[:])}
+	if err := json.NewEncoder(conn).Encode(req); err != nil {
+		return err
+	}
+	var res Response
+	d := json.NewDecoder(io.LimitReader(conn, 4097))
+	d.DisallowUnknownFields()
+	if d.Decode(&res) != nil || res.Inventory != c.Expected || res.Nonce != req.Nonce || !res.OK || res.Error != "" {
+		return errTrust
+	}
+	return waitHealthy(ctx, func(context.Context) bool {
+		r, err := readRecord(c.StateDir, c.Owner)
+		return err == nil && r.Inventory == c.Expected && !r.Enabled && c.managementStopped(r)
+	})
+}

package/templates/native-go/backend/internal/helper/revoke_test.go

@@ -0,0 +1,121 @@
+package helper
+
+import (
+	"context"
+	"net"
+	"os"
+	"path/filepath"
+	"strings"
+	"syscall"
+	"testing"
+	"time"
+)
+
+func TestPackageRevokeDurablyDisablesExactInventory(t *testing.T) {
+	c, _ := controlFixture(t)
+	r := Record{Inventory: c.Expected, Enabled: true, Lifecycle: testLifecycle("running")}
+	record(t, c.Client, r)
+	if err := packageRevoke(c.Client, Request{Inventory: c.Expected, Op: "revoke", Nonce: strings.Repeat("a", 64)}); err != nil {
+		t.Fatal(err)
+	}
+	got, err := readRecord(c.StateDir, c.Owner)
+	if err != nil || got.Enabled || !got.Residual || got.Lifecycle.Phase != "fenced" {
+		t.Fatalf("not durably revoked: %+v %v", got, err)
+	}
+	if c.CheckStopped(context.Background()) == nil {
+		t.Fatal("revocation acknowledgement accepted as completion")
+	}
+	if err := c.Control(context.Background(), "recover"); err == nil {
+		t.Fatal("revoked approval recovered")
+	}
+}
+
+func TestRevokeAcknowledgementCannotCertifyQuiescence(t *testing.T) {
+	c, _ := controlFixture(t)
+	live(t, c.Client, c.Expected, func(req Request) Response { return Response{Inventory: c.Expected, Nonce: req.Nonce, OK: true} })
+	ctx, cancel := context.WithTimeout(context.Background(), 100*time.Millisecond)
+	defer cancel()
+	if c.Revoke(ctx) == nil {
+		t.Fatal("socket acknowledgement certified live process")
+	}
+}
+
+func TestRevokeRejectsUntrustedPeerAndWrongNonce(t *testing.T) {
+	for _, which := range []string{"peer", "nonce"} {
+		t.Run(which, func(t *testing.T) {
+			c, _ := controlFixture(t)
+			live(t, c.Client, c.Expected, func(req Request) Response { return Response{Inventory: c.Expected, Nonce: "wrong", OK: true} })
+			if which == "peer" {
+				c.Peer = func(*net.UnixConn) error { return errTrust }
+			}
+			if c.Revoke(context.Background()) == nil {
+				t.Fatal("untrusted response accepted")
+			}
+		})
+	}
+}
+
+func TestRevokeNewBuildConsumesOldDisabledTerminalWithoutMutation(t *testing.T) {
+	c, f := controlFixture(t)
+	l := testLifecycle("fenced")
+	if err := createLifetime(c.Client, l); err != nil {
+		t.Fatal(err)
+	}
+	record(t, c.Client, Record{Schema: 2, Inventory: c.Expected, Enabled: false, Residual: true, Lifecycle: l})
+	if err := cleanRuntime(c.Client, true); err != nil {
+		t.Fatal(err)
+	}
+	if err := completeRecord(c.Client, l.Epoch, f.current); err != nil {
+		t.Fatal(err)
+	}
+	before, _ := os.ReadFile(filepath.Join(c.StateDir, "approval.json"))
+	c.Expected.Version = "1.0.0-0002"
+	if err := c.Revoke(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	after, _ := os.ReadFile(filepath.Join(c.StateDir, "approval.json"))
+	if string(before) != string(after) {
+		t.Fatal("new build rewrote old publication")
+	}
+	if err := os.Remove(filepath.Join(c.StateDir, "completion-"+l.Epoch+".json")); err != nil {
+		t.Fatal(err)
+	}
+	if c.Revoke(context.Background()) == nil {
+		t.Fatal("missing terminal proof accepted")
+	}
+}
+
+func TestPackageRevokeRejectsWrongBuildInvalidFrameAndConcurrentEnable(t *testing.T) {
+	for _, kind := range []string{"build", "nonce", "operation", "busy"} {
+		t.Run(kind, func(t *testing.T) {
+			c, _ := controlFixture(t)
+			r := Record{Inventory: c.Expected, Enabled: true, Lifecycle: testLifecycle("running")}
+			record(t, c.Client, r)
+			req := Request{Inventory: c.Expected, Op: "revoke", Nonce: strings.Repeat("a", 64)}
+			switch kind {
+			case "build":
+				req.Inventory.Version = "0.1.0-0002"
+			case "nonce":
+				req.Nonce = ""
+			case "operation":
+				req.Op = "enable"
+			case "busy":
+				f, err := os.OpenFile(filepath.Join(c.StateDir, "control.lock"), os.O_CREATE|os.O_RDWR, 0600)
+				if err != nil {
+					t.Fatal(err)
+				}
+				defer f.Close()
+				if err := syscall.Flock(int(f.Fd()), syscall.LOCK_EX|syscall.LOCK_NB); err != nil {
+					t.Fatal(err)
+				}
+			}
+			if packageRevoke(c.Client, req) == nil {
+				t.Fatal("unsafe revoke accepted")
+			}
+			got, _ := readRecord(c.StateDir, c.Owner)
+			if !got.Enabled || got.Residual || got.Lifecycle.Phase != "running" {
+				t.Fatal("rejected request changed approval")
+			}
+		})
+	}
+}

package/templates/native-go/backend/internal/helper/s1r_actor_races_linux_test.go

@@ -2,9 +2,12 @@ package helper
 
 import (
 	"context"
+	"errors"
 	"os"
 	"strings"
 	"testing"
+
+	"golang.org/x/sys/unix"
 )
 
 func s1rActorRaces(t *testing.T, spec s1rActorSpec, kind string) {
@@ -190,15 +193,31 @@ func s1rActorRaces(t *testing.T, spec s1rActorSpec, kind string) {
 		s1rMust(t, os.Chmod(root, 0500))
 		defer os.Chmod(root, 0700)
 		r, c := x.Commit(ctx)
-		// Current S7 maps linkat EACCES to unsupported; require the exact behavior,
-		// report it, and preserve the fail-closed publish gate.
-		if c != ErrUnsupported || r.Published || r.Committed || r.BytesWritten != 3 {
+		if c != ErrDenied || !r.Created || r.Published || r.Committed || r.BytesWritten != 3 {
 			t.Fatal("publish after parent chmod", r, c)
 		}
 		if _, e := os.Stat(root + "/result"); !os.IsNotExist(e) {
 			t.Fatal("publish wrote forbidden directory", e)
 		}
-		t.Log("parent write permission removed: kernel denies linkat; receipt retains staged bytes, published=false")
+		var st unix.Stat_t
+		s1rMust(t, unix.Fstat(int(x.file.Fd()), &st))
+		if st.Nlink != 0 || st.Size != 3 {
+			t.Fatal("anonymous stage changed after denial", st.Nlink, st.Size)
+		}
+		if retry, code := x.Commit(ctx); code != ErrReplay || retry != r {
+			t.Fatal("denied publish replay changed receipt", retry, code)
+		}
+		x.Close()
+		x.Close()
+		if _, e := x.file.Stat(); !errors.Is(e, os.ErrClosed) {
+			t.Fatal("stage descriptor still open", e)
+		}
+		entries, e := os.ReadDir(root)
+		s1rMust(t, e)
+		if len(entries) != 1 || entries[0].Name() != "file" {
+			t.Fatal("denied publish left a named stage", entries)
+		}
+		t.Log("parent write permission removed: publish denied; staged bytes and receipt retained; close leaves no named stage")
 	case "open-fd-write-permission-loss":
 		work := writeWork{RootPath: root, Action: ActionCreate, Segments: []string{"result"}, MaxBytes: 6}
 		x, c := openActorWriteTransfer(ctx, pin, work, fixtureReadOnlyACL{})

package/templates/native-go/backend/internal/helper/sdk_assembly_linux.go

@@ -0,0 +1,51 @@
+//go:build linux && synopkgland_sdk_workers
+
+package helper
+
+import (
+	"context"
+	"dsmapp/internal/dsm"
+	"dsmapp/internal/filestation"
+)
+
+type unavailableSDKValidator struct{}
+
+func (unavailableSDKValidator) ValidateJob(context.Context, NativeActor, sdkJobRequest, Grant, sdkJobCheckpoint) (sdkJobProof, Code) {
+	return sdkJobProof{}, ErrUnavailable
+}
+
+// The sole owner calls this once, after the authority's startup reconciliation.
+// Native/POSIX services stay unavailable. Production uses only session-authenticated
+// File Station requests; explicit native VM fixtures retain their own test seam.
+func openSDKJobs(c Client, binary string, s *supervisorGrants, repo *FileGrantRepository) (*sdkJobOwner, Code, string) {
+	if len(sdkCompiledRegistry) == 0 {
+		return nil, ErrUnavailable, "jobs-registry"
+	}
+	journal, code, stage := newSDKFileJobJournalDiagnostic(repo)
+	if code != "" {
+		return nil, code, stage
+	}
+	var validator sdkJobValidator = unavailableSDKValidator{}
+	if v, ok := s.services.consent.(sdkJobValidator); ok {
+		validator = v
+	}
+	o, code := newSDKJobOwner(s, sdkCompiledRegistry, sdkJobServices{Validator: validator, Journal: journal, Start: func(a NativeActor, b operationBinding, p sdkJobPlan) (sdkJobProcess, error) {
+		return startLinuxSDKJob(c, binary, a, b, p)
+	}})
+	if code != "" {
+		return nil, code, "jobs-owner"
+	}
+	// Reuse the same retained journal/index for revocation. No observer, validator,
+	// ready/consume loop or background child bootstrap is installed.
+	if _, code = newSDKBackgroundOwner(o, nil, nil, journal, newSDKEpochClock()); code != "" {
+		return nil, code, "background-index"
+	}
+	if _, nativeFixture := s.services.consent.(sdkJobValidator); !nativeFixture {
+		o.session, code = newSDKSessionJobs(o, filestation.Local("/var/packages/"+c.Expected.Package+"/var"), dsm.NewAuthenticator())
+		if code != "" {
+			return nil, code, "session-history"
+		}
+	}
+	newSDKJobViews(o)
+	return o, "", ""
+}

package/templates/native-go/backend/internal/helper/sdk_attach.go

@@ -0,0 +1,83 @@
+//go:build synopkgland_sdk_workers
+
+package helper
+
+import (
+	"context"
+	"time"
+)
+
+// Called only by the sole supervisor owner. The reference is bound to the
+// immutable job record; no persisted deadline can survive owner restart.
+func (o *sdkJobOwner) issueAttach(j *sdkJob) Code {
+	id, code := sdkRandomRef()
+	if code != "" {
+		return code
+	}
+	now := o.attachNow()
+	if now < 0 || now > time.Duration(1<<63-1)-sdkAttachTTL {
+		return ErrExpired
+	}
+	j.attach = &sdkAttachLease{id: id, principal: j.actor.Principal(), session: j.actor.SessionRef(), epoch: o.grants.cohort.epoch, last: now, deadline: now + sdkAttachTTL}
+	return ""
+}
+func (o *sdkJobOwner) attachExpired(j *sdkJob) bool {
+	a := j.attach
+	if a == nil || o.attachNow == nil {
+		return true
+	}
+	now := o.attachNow()
+	if a.denied || now < a.last || now >= a.deadline || a.epoch != o.grants.cohort.epoch {
+		a.denied = true
+		return true
+	}
+	a.last = now
+	return false
+}
+func (o *sdkJobOwner) renewAttach(ctx context.Context, carriers SessionCarriers, jobID, attachID string) Code {
+	j := o.jobs[jobID]
+	if j == nil || j.attach == nil || j.background != nil || !allReferences(attachID) || j.attach.id != attachID {
+		return ErrDenied
+	}
+	// Authenticate even denial paths, with no caller-selected identity or roles.
+	v := newSDKJobViews(o)
+	actor, code := v.actor(ctx, carriers)
+	if code != "" {
+		return code
+	}
+	if actor.Principal() != j.attach.principal || actor.SessionRef() != j.attach.session {
+		return ErrDenied
+	}
+	if j.terminal || j.failure != "" || j.receipt.Job.CancelRequested {
+		return ErrStale
+	}
+	expire := func() Code {
+		if code := o.cancelOwned(ctx, j); code != "" {
+			return code
+		}
+		return ErrExpired
+	}
+	if o.attachExpired(j) {
+		return expire()
+	}
+	if !o.grants.cohort.gate.allow(o.grants.cohort.now()) {
+		return ErrFenced
+	}
+	if code = v.budget(actor); code != "" {
+		return code
+	}
+	// Proof/budget work cannot renew a deadline which passed in the meantime.
+	if ctx.Err() != nil {
+		return nativeContextCode(ctx)
+	}
+	if o.attachExpired(j) {
+		return expire()
+	}
+	now := o.attachNow()
+	if now < j.attach.last || now >= j.attach.deadline || now > time.Duration(1<<63-1)-sdkAttachTTL {
+		j.attach.denied = true
+		return expire()
+	}
+	j.attach.last, j.attach.deadline = now, now+sdkAttachTTL
+	return ""
+}