@synopackageland/cli 0.5.3 → 0.6.0

package/dist/templates/native-go/backend/internal/helper/s1r_actor_fixture_linux_test.go

@@ -1,184 +0,0 @@
-package helper
-
-// Disposable Linux VM fixtures only. No account lookup or ACL adapter is
-// installed into the shipped helper, and no business FD is opened by the parent.
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"fmt"
-	"os"
-	"os/exec"
-	"runtime"
-	"strings"
-	"syscall"
-	"testing"
-	"time"
-
-	"golang.org/x/sys/unix"
-)
-
-const (
-	s1rAlice    = 23001
-	s1rBob      = 23002
-	s1rAliceGID = 24001
-	s1rBobGID   = 24002
-	s1rShared   = 24003
-	s1rExtra    = 24004
-)
-
-func s1rMust(t *testing.T, err error) {
-	t.Helper()
-	if err != nil {
-		t.Fatal(err)
-	}
-}
-
-func s1rACL(t *testing.T, path, acl string) {
-	t.Helper()
-	b, err := exec.Command("/usr/bin/setfacl", "-m", acl, path).CombinedOutput()
-	if err != nil {
-		t.Fatalf("setfacl %s: %v %s", path, err, b)
-	}
-}
-
-func s1rFixture(t *testing.T) string {
-	t.Helper()
-	root, err := os.MkdirTemp("/tmp", "s1r-vm-")
-	s1rMust(t, err)
-	t.Cleanup(func() { s1rMust(t, os.RemoveAll(root)) })
-	s1rMust(t, os.Chmod(root, 0755))
-	for _, name := range []string{"alice", "bob", "supplementary", "acl-allow", "acl-mask", "acl-file-mask", "acl-group", "acl-group-mask", "inherit", "readonly", "race"} {
-		dir := root + "/" + name
-		s1rMust(t, os.Mkdir(dir, 0700))
-		s1rMust(t, os.WriteFile(dir+"/file", []byte("canary:"+name), 0600))
-	}
-	for _, p := range []struct {
-		name     string
-		uid, gid int
-	}{{"alice", s1rAlice, s1rAliceGID}, {"bob", s1rBob, s1rBobGID}, {"race", s1rAlice, s1rAliceGID}} {
-		for _, path := range []string{root + "/" + p.name, root + "/" + p.name + "/file"} {
-			s1rMust(t, os.Chown(path, p.uid, p.gid))
-		}
-	}
-	for _, path := range []string{root + "/supplementary", root + "/supplementary/file"} {
-		s1rMust(t, os.Chown(path, 0, s1rShared))
-	}
-	s1rMust(t, unix.Chmod(root+"/supplementary", 02770))
-	s1rMust(t, os.Chmod(root+"/supplementary/file", 0660))
-	for _, name := range []string{"acl-allow", "acl-file-mask", "inherit"} {
-		s1rACL(t, root+"/"+name, fmt.Sprintf("u:%d:rwx,m::rwx", s1rAlice))
-		s1rACL(t, root+"/"+name+"/file", fmt.Sprintf("u:%d:rw-,m::rw-", s1rAlice))
-	}
-	s1rACL(t, root+"/acl-mask", fmt.Sprintf("u:%d:rwx,m::---", s1rAlice))
-	s1rACL(t, root+"/acl-mask/file", fmt.Sprintf("u:%d:rw-,m::---", s1rAlice))
-	s1rACL(t, root+"/acl-file-mask/file", "m::---")
-	for _, name := range []string{"acl-group", "acl-group-mask"} {
-		s1rACL(t, root+"/"+name, fmt.Sprintf("g:%d:rwx,m::rwx", s1rShared))
-		s1rACL(t, root+"/"+name+"/file", fmt.Sprintf("g:%d:rw-,m::rw-", s1rShared))
-	}
-	s1rACL(t, root+"/acl-group-mask", "m::r-x")
-	s1rACL(t, root+"/acl-group-mask/file", "m::r--")
-	s1rACL(t, root+"/inherit", fmt.Sprintf("u:%d:r-x,d:u::rwx,d:u:%d:rwx,d:u:%d:r-x,d:g::---,d:m::rwx,d:o::---", s1rBob, s1rAlice, s1rBob))
-	s1rACL(t, root+"/inherit/file", fmt.Sprintf("u:%d:r--,m::rw-", s1rBob))
-	s1rMust(t, os.Chmod(root+"/readonly", 0555))
-	s1rMust(t, os.Chmod(root+"/readonly/file", 0444))
-	return root
-}
-
-type s1rActorSpec struct {
-	UID, GID       uint32
-	Groups         []uint32
-	Root, Scenario string
-}
-
-// Run a fresh test process as root, invoke the REAL permanent drop routine, and
-// proxy ONLY mount metadata using the production packet/FD routines. The parent
-// pins the child's proc directory before permitting its credential transition.
-func s1rRunActor(t *testing.T, spec s1rActorSpec) {
-	t.Helper()
-	pair, err := syscall.Socketpair(syscall.AF_UNIX, syscall.SOCK_SEQPACKET|syscall.SOCK_CLOEXEC, 0)
-	s1rMust(t, err)
-	left := os.NewFile(uintptr(pair[0]), "s1r-parent")
-	right := os.NewFile(uintptr(pair[1]), "s1r-child")
-	defer left.Close()
-	defer right.Close()
-	control, err := operationSocket(left)
-	s1rMust(t, err)
-	defer control.Close()
-	s1rMust(t, enableCredentials(control))
-	exe, err := os.Executable()
-	s1rMust(t, err)
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-	defer cancel()
-	cmd := exec.CommandContext(ctx, exe, "-test.run=^TestS1RActorProcess$", "-test.v")
-	b, err := json.Marshal(spec)
-	s1rMust(t, err)
-	cmd.Env = append(os.Environ(), "S1R_ACTOR_SPEC="+string(b))
-	cmd.ExtraFiles = []*os.File{right}
-	// Deliberately inherit unrelated/root/supplementary groups. The production
-	// Setgroups call must replace these, including when the requested set is empty.
-	cmd.SysProcAttr = &syscall.SysProcAttr{Credential: &syscall.Credential{Uid: 0, Gid: 0, Groups: []uint32{0, s1rShared, 24005}}}
-	var out bytes.Buffer
-	cmd.Stdout = &out
-	cmd.Stderr = &out
-	s1rMust(t, cmd.Start())
-	defer func() {
-		if cmd.ProcessState == nil {
-			cmd.Process.Kill()
-			cmd.Wait()
-		}
-	}()
-	info, err := openOperationFDInfo(cmd.Process.Pid)
-	s1rMust(t, err)
-	defer info.Close()
-	s1rMust(t, writeOperationPacket(control, true))
-	done := make(chan error, 1)
-	go func() {
-		var sequence uint64
-		for {
-			var packet readOnlyPacket
-			cred, err := readOperationPacketBound(control, &packet, MaxControlBytes, 30*time.Second)
-			if err != nil {
-				done <- nil
-				return
-			} // process exit closes the private socket
-			if cred == nil || int(cred.Pid) != cmd.Process.Pid || cred.Uid != spec.UID || cred.Gid != spec.GID || packet.Token != strings.Repeat("a", 64) || packet.MountFD == nil || packet.MountSequence != sequence+1 {
-				done <- fmt.Errorf("invalid actor mount query")
-				return
-			}
-			sequence++
-			id, code := operationFDInfoMount(info, *packet.MountFD)
-			if err := writeOperationPacket(control, readOnlyMountReply{Token: packet.Token, Sequence: sequence, Mount: id, Code: code}); err != nil {
-				done <- err
-				return
-			}
-		}
-	}()
-	err = cmd.Wait()
-	control.Close()
-	proxyErr := <-done
-	if err != nil || proxyErr != nil {
-		t.Fatalf("actor %s: %v proxy=%v\n%s", spec.Scenario, err, proxyErr, out.String())
-	}
-	t.Log(out.String())
-}
-
-func s1rDropActor(t *testing.T, spec s1rActorSpec) {
-	t.Helper()
-	runtime.LockOSThread() // like operationChildLinux; subprocess exits when finished
-	f := os.NewFile(3, "s1r-control")
-	defer f.Close()
-	control, err := operationSocket(f)
-	s1rMust(t, err)
-	t.Cleanup(func() { control.Close() })
-	var ready bool
-	_, err = readOperationPacketBound(control, &ready, MaxHealthBytes, 5*time.Second)
-	s1rMust(t, err)
-	if !ready {
-		t.Fatal("parent did not pin proc witness")
-	}
-	boot := operationBootstrap{UID: spec.UID, GID: spec.GID, Groups: spec.Groups, Token: strings.Repeat("a", 64)}
-	s1rMust(t, dropOperationCredentials(os.Getppid(), boot))
-	operationMountIDFallback = operationMountIDProxy(control, boot)
-}

package/dist/templates/native-go/backend/internal/helper/s1r_actor_races_linux_test.go

@@ -1,250 +0,0 @@
-package helper
-
-import (
-	"context"
-	"errors"
-	"os"
-	"strings"
-	"testing"
-
-	"golang.org/x/sys/unix"
-)
-
-func s1rActorRaces(t *testing.T, spec s1rActorSpec, kind string) {
-	root := spec.Root + "/race"
-	pin, code := pinReadOnlyRoot(root)
-	if code != "" {
-		t.Fatal(code)
-	}
-	defer pin.Close()
-	ctx := context.Background()
-	switch kind {
-	case "symlink":
-		for _, link := range []struct{ name, target string }{{"inside-link", "file"}, {"outside-link", "../bob/file"}, {"dir-link", "../bob"}} {
-			s1rMust(t, os.Symlink(link.target, root+"/"+link.name))
-		}
-		for _, action := range []Action{ActionStat, ActionRead, ActionList, ActionReadStream} {
-			segments := []string{"outside-link"}
-			if action == ActionList {
-				segments = []string{"dir-link"}
-			}
-			work := readWork(pin, segments...)
-			work.Action = action
-			if action == ActionList {
-				work.MaxBytes = 0
-				work.Limit = 20
-			}
-			if action == ActionStat {
-				work.MaxBytes = 0
-			}
-			if action == ActionReadStream {
-				x, r := openActorReadTransfer(ctx, pin, work, fixtureReadOnlyACL{})
-				if x != nil {
-					x.Close()
-				}
-				if r.Code != ErrDenied || r.Bytes != 0 {
-					t.Fatal("symlink stream", r)
-				}
-			} else {
-				r, b := executeReadOnly(ctx, pin, work, fixtureReadOnlyACL{})
-				if r.Code != ErrDenied || len(b) > 0 || r.Entry != nil || r.List != nil {
-					t.Fatal("symlink metadata/read", action, r)
-				}
-			}
-		}
-		r, b := executeReadOnly(ctx, pin, readWork(pin, "inside-link"), fixtureReadOnlyACL{})
-		if r.Code != ErrDenied || len(b) > 0 {
-			t.Fatal("internal symlink followed", r)
-		}
-		r, _ = executeReadOnly(ctx, pin, readOnlyWork{RootPath: root, Action: ActionList, Segments: []string{}, Limit: 20}, fixtureReadOnlyACL{})
-		if r.Code != "" || r.List == nil || len(r.List.Entries) != 1 || r.List.Entries[0].Name != "file" {
-			t.Fatal("symlink names leaked by list", r)
-		}
-		for _, segments := range [][]string{{"outside-link"}, {"dir-link", "new"}} {
-			x, c := openActorWriteTransfer(ctx, pin, writeWork{RootPath: root, Action: ActionCreate, Segments: segments, MaxBytes: 3}, fixtureReadOnlyACL{})
-			if x != nil {
-				x.Close()
-			}
-			if c != ErrDenied {
-				t.Fatal("symlink create", c)
-			}
-		}
-		t.Log("stat/list/read/stream/create reject symlinks; list filters symlink names")
-	case "stat-rename", "list-rename", "read-rename":
-		s1rMust(t, os.Mkdir(root+"/sub", 0700))
-		s1rMust(t, os.WriteFile(root+"/sub/file", []byte("original"), 0600))
-		mutated := false
-		acl := fixtureReadOnlyACL{hook: func() {
-			if mutated {
-				return
-			}
-			mutated = true
-			s1rMust(t, os.Rename(root+"/sub", root+"/moved"))
-			s1rMust(t, os.Mkdir(root+"/sub", 0700))
-			s1rMust(t, os.WriteFile(root+"/sub/file", []byte("foreign"), 0600))
-		}}
-		work := readWork(pin, "sub", "file")
-		if kind == "stat-rename" {
-			work.Action = ActionStat
-			work.MaxBytes = 0
-		}
-		if kind == "list-rename" {
-			work.Action = ActionList
-			work.MaxBytes = 0
-			work.Segments = []string{"sub"}
-			work.Limit = 20
-		}
-		r, b := executeReadOnly(ctx, pin, work, acl)
-		if r.Code != ErrStale || len(b) != 0 || r.Entry != nil || r.List != nil {
-			t.Fatal("renamed ancestry released bytes", r, string(b))
-		}
-		t.Log(kind + ": replacement after resolver open refuses bytes and metadata with stale")
-	case "stream-rename":
-		work := readWork(pin, "file")
-		work.Action = ActionReadStream
-		x, r := openActorReadTransfer(ctx, pin, work, fixtureReadOnlyACL{})
-		if r.Code != "" {
-			t.Fatal(r)
-		}
-		defer x.Close()
-		b, c := x.ReadChunk(ctx, 3)
-		if c != "" || string(b) != "can" {
-			t.Fatal(c, string(b))
-		}
-		s1rMust(t, os.Rename(root+"/file", root+"/old"))
-		s1rMust(t, os.Symlink("../bob/file", root+"/file"))
-		b, c = x.ReadChunk(ctx, 3)
-		if c != ErrDenied || len(b) != 0 {
-			t.Fatal("stream followed replacement", c, string(b))
-		}
-		t.Log("first fixed-FD stream chunk succeeds; symlink replacement refuses next chunk")
-	case "create-rename", "publish-rename", "publish-symlink":
-		s1rMust(t, os.Mkdir(root+"/sub", 0700))
-		staged := kind != "create-rename"
-		work := writeWork{RootPath: root, Action: ActionCreate, Segments: []string{"sub", "result"}, MaxBytes: 6}
-		if staged {
-			work.Action = ActionWriteStream
-			work.Staged = true
-		}
-		x, c := openActorWriteTransfer(ctx, pin, work, fixtureReadOnlyACL{})
-		if c != "" {
-			t.Fatal(c)
-		}
-		defer x.Close()
-		receipt, c := x.WriteChunk(ctx, []byte("abc"))
-		if c != "" || receipt.BytesWritten != 3 {
-			t.Fatal(receipt, c)
-		}
-		if kind == "publish-symlink" {
-			s1rMust(t, os.Symlink("../file", root+"/sub/result"))
-			receipt, c = x.Commit(ctx)
-			if c != ErrDenied || receipt.Published || receipt.Committed {
-				t.Fatal("publish replaced symlink", receipt, c)
-			}
-			target, e := os.Readlink(root + "/sub/result")
-			s1rMust(t, e)
-			if target != "../file" {
-				t.Fatal(target)
-			}
-		} else {
-			s1rMust(t, os.Rename(root+"/sub", root+"/moved"))
-			s1rMust(t, os.Mkdir(root+"/sub", 0700))
-			s1rMust(t, os.WriteFile(root+"/sub/result", []byte("foreign"), 0600))
-			if staged {
-				receipt, c = x.Commit(ctx)
-				if c != ErrStale || receipt.Published {
-					t.Fatal("publish after rename", receipt, c)
-				}
-			} else {
-				receipt, c = x.WriteChunk(ctx, []byte("def"))
-				if c != ErrPartial || receipt.BytesWritten != 3 {
-					t.Fatal("write after rename", receipt, c)
-				}
-			}
-			b, e := os.ReadFile(root + "/sub/result")
-			s1rMust(t, e)
-			if string(b) != "foreign" {
-				t.Fatal("foreign destination overwritten", string(b))
-			}
-			if staged {
-				if _, e := os.Stat(root + "/moved/result"); !os.IsNotExist(e) {
-					t.Fatal("anonymous stage became visible", e)
-				}
-			} else {
-				b, e = os.ReadFile(root + "/moved/result")
-				s1rMust(t, e)
-				if string(b) != "abc" {
-					t.Fatal("partial bytes changed", string(b))
-				}
-			}
-		}
-		t.Logf("%s: refusal=%s receipt=%+v; foreign destination preserved", kind, c, receipt)
-	case "publish-permission-loss":
-		work := writeWork{RootPath: root, Action: ActionWriteStream, Segments: []string{"result"}, MaxBytes: 3, Staged: true}
-		x, c := openActorWriteTransfer(ctx, pin, work, fixtureReadOnlyACL{})
-		if c != "" {
-			t.Fatal(c)
-		}
-		defer x.Close()
-		_, c = x.WriteChunk(ctx, []byte("abc"))
-		if c != "" {
-			t.Fatal(c)
-		}
-		s1rMust(t, os.Chmod(root, 0500))
-		defer os.Chmod(root, 0700)
-		r, c := x.Commit(ctx)
-		if c != ErrDenied || !r.Created || r.Published || r.Committed || r.BytesWritten != 3 {
-			t.Fatal("publish after parent chmod", r, c)
-		}
-		if _, e := os.Stat(root + "/result"); !os.IsNotExist(e) {
-			t.Fatal("publish wrote forbidden directory", e)
-		}
-		var st unix.Stat_t
-		s1rMust(t, unix.Fstat(int(x.file.Fd()), &st))
-		if st.Nlink != 0 || st.Size != 3 {
-			t.Fatal("anonymous stage changed after denial", st.Nlink, st.Size)
-		}
-		if retry, code := x.Commit(ctx); code != ErrReplay || retry != r {
-			t.Fatal("denied publish replay changed receipt", retry, code)
-		}
-		x.Close()
-		x.Close()
-		if _, e := x.file.Stat(); !errors.Is(e, os.ErrClosed) {
-			t.Fatal("stage descriptor still open", e)
-		}
-		entries, e := os.ReadDir(root)
-		s1rMust(t, e)
-		if len(entries) != 1 || entries[0].Name() != "file" {
-			t.Fatal("denied publish left a named stage", entries)
-		}
-		t.Log("parent write permission removed: publish denied; staged bytes and receipt retained; close leaves no named stage")
-	case "open-fd-write-permission-loss":
-		work := writeWork{RootPath: root, Action: ActionCreate, Segments: []string{"result"}, MaxBytes: 6}
-		x, c := openActorWriteTransfer(ctx, pin, work, fixtureReadOnlyACL{})
-		if c != "" {
-			t.Fatal(c)
-		}
-		defer x.Close()
-		r, c := x.WriteChunk(ctx, []byte("abc"))
-		if c != "" {
-			t.Fatal(c)
-		}
-		s1rMust(t, x.file.Chmod(0000))
-		defer x.file.Chmod(0600)
-		r, c = x.WriteChunk(ctx, []byte("def"))
-		if c != "" || r.BytesWritten != 6 {
-			t.Fatal("Linux open-FD semantics", r, c)
-		}
-		r, c = x.Commit(ctx)
-		if c != "" || !r.Committed {
-			t.Fatal(r, c)
-		}
-		b, e := os.ReadFile(root + "/result")
-		if !os.IsPermission(e) || len(b) != 0 {
-			t.Fatal("new open bypassed chmod", e, string(b))
-		}
-		t.Log("chmod 000 denies a new open; previously opened writer FD still writes/commits under Linux semantics")
-	default:
-		t.Fatal("unknown race", strings.TrimSpace(kind))
-	}
-}

package/dist/templates/native-go/backend/internal/helper/s1r_fixture_contract_linux_test.go

@@ -1,18 +0,0 @@
-package helper
-
-import (
-	"os"
-	"testing"
-)
-
-func TestS1RFixtureContract(t *testing.T) {
-	if os.Geteuid() != 0 {
-		t.Skip("disposable root VM only")
-	}
-	root := s1rFixture(t)
-	for _, name := range []string{"alice", "bob", "supplementary", "acl-allow", "acl-mask", "acl-file-mask", "inherit", "readonly", "race"} {
-		if _, err := os.Stat(root + "/" + name + "/file"); err != nil {
-			t.Fatal(name, err)
-		}
-	}
-}

package/dist/templates/native-go/backend/internal/helper/sdk_assembly_linux.go

@@ -1,51 +0,0 @@
-//go:build linux && synopkgland_sdk_workers
-
-package helper
-
-import (
-	"context"
-	"dsmapp/internal/dsm"
-	"dsmapp/internal/filestation"
-)
-
-type unavailableSDKValidator struct{}
-
-func (unavailableSDKValidator) ValidateJob(context.Context, NativeActor, sdkJobRequest, Grant, sdkJobCheckpoint) (sdkJobProof, Code) {
-	return sdkJobProof{}, ErrUnavailable
-}
-
-// The sole owner calls this once, after the authority's startup reconciliation.
-// Native/POSIX services stay unavailable. Production uses only session-authenticated
-// File Station requests; explicit native VM fixtures retain their own test seam.
-func openSDKJobs(c Client, binary string, s *supervisorGrants, repo *FileGrantRepository) (*sdkJobOwner, Code, string) {
-	if len(sdkCompiledRegistry) == 0 {
-		return nil, ErrUnavailable, "jobs-registry"
-	}
-	journal, code, stage := newSDKFileJobJournalDiagnostic(repo)
-	if code != "" {
-		return nil, code, stage
-	}
-	var validator sdkJobValidator = unavailableSDKValidator{}
-	if v, ok := s.services.consent.(sdkJobValidator); ok {
-		validator = v
-	}
-	o, code := newSDKJobOwner(s, sdkCompiledRegistry, sdkJobServices{Validator: validator, Journal: journal, Start: func(a NativeActor, b operationBinding, p sdkJobPlan) (sdkJobProcess, error) {
-		return startLinuxSDKJob(c, binary, a, b, p)
-	}})
-	if code != "" {
-		return nil, code, "jobs-owner"
-	}
-	// Reuse the same retained journal/index for revocation. No observer, validator,
-	// ready/consume loop or background child bootstrap is installed.
-	if _, code = newSDKBackgroundOwner(o, nil, nil, journal, newSDKEpochClock()); code != "" {
-		return nil, code, "background-index"
-	}
-	if _, nativeFixture := s.services.consent.(sdkJobValidator); !nativeFixture {
-		o.session, code = newSDKSessionJobs(o, filestation.Local("/var/packages/"+c.Expected.Package+"/var"), dsm.NewAuthenticator())
-		if code != "" {
-			return nil, code, "session-history"
-		}
-	}
-	newSDKJobViews(o)
-	return o, "", ""
-}

package/dist/templates/native-go/backend/internal/helper/sdk_attach.go

@@ -1,83 +0,0 @@
-//go:build synopkgland_sdk_workers
-
-package helper
-
-import (
-	"context"
-	"time"
-)
-
-// Called only by the sole supervisor owner. The reference is bound to the
-// immutable job record; no persisted deadline can survive owner restart.
-func (o *sdkJobOwner) issueAttach(j *sdkJob) Code {
-	id, code := sdkRandomRef()
-	if code != "" {
-		return code
-	}
-	now := o.attachNow()
-	if now < 0 || now > time.Duration(1<<63-1)-sdkAttachTTL {
-		return ErrExpired
-	}
-	j.attach = &sdkAttachLease{id: id, principal: j.actor.Principal(), session: j.actor.SessionRef(), epoch: o.grants.cohort.epoch, last: now, deadline: now + sdkAttachTTL}
-	return ""
-}
-func (o *sdkJobOwner) attachExpired(j *sdkJob) bool {
-	a := j.attach
-	if a == nil || o.attachNow == nil {
-		return true
-	}
-	now := o.attachNow()
-	if a.denied || now < a.last || now >= a.deadline || a.epoch != o.grants.cohort.epoch {
-		a.denied = true
-		return true
-	}
-	a.last = now
-	return false
-}
-func (o *sdkJobOwner) renewAttach(ctx context.Context, carriers SessionCarriers, jobID, attachID string) Code {
-	j := o.jobs[jobID]
-	if j == nil || j.attach == nil || j.background != nil || !allReferences(attachID) || j.attach.id != attachID {
-		return ErrDenied
-	}
-	// Authenticate even denial paths, with no caller-selected identity or roles.
-	v := newSDKJobViews(o)
-	actor, code := v.actor(ctx, carriers)
-	if code != "" {
-		return code
-	}
-	if actor.Principal() != j.attach.principal || actor.SessionRef() != j.attach.session {
-		return ErrDenied
-	}
-	if j.terminal || j.failure != "" || j.receipt.Job.CancelRequested {
-		return ErrStale
-	}
-	expire := func() Code {
-		if code := o.cancelOwned(ctx, j); code != "" {
-			return code
-		}
-		return ErrExpired
-	}
-	if o.attachExpired(j) {
-		return expire()
-	}
-	if !o.grants.cohort.gate.allow(o.grants.cohort.now()) {
-		return ErrFenced
-	}
-	if code = v.budget(actor); code != "" {
-		return code
-	}
-	// Proof/budget work cannot renew a deadline which passed in the meantime.
-	if ctx.Err() != nil {
-		return nativeContextCode(ctx)
-	}
-	if o.attachExpired(j) {
-		return expire()
-	}
-	now := o.attachNow()
-	if now < j.attach.last || now >= j.attach.deadline || now > time.Duration(1<<63-1)-sdkAttachTTL {
-		j.attach.denied = true
-		return expire()
-	}
-	j.attach.last, j.attach.deadline = now, now+sdkAttachTTL
-	return ""
-}

package/dist/templates/native-go/backend/internal/helper/sdk_attach_contract.go

@@ -1,32 +0,0 @@
-//go:build synopkgland_sdk_workers
-
-package helper
-
-import "time"
-
-// S7 interactive liveness: these are independent of worker total/checkpoint
-// deadlines. The owner holds the monotonic deadline only in this process.
-const sdkAttachRenewInterval = 2 * time.Second
-const sdkAttachTTL = 6 * time.Second
-
-const SDKAttachRenewMS = int64(sdkAttachRenewInterval / time.Millisecond)
-const SDKAttachTTLMS = int64(sdkAttachTTL / time.Millisecond)
-
-type sdkAttachLease struct {
-	id        string
-	principal Principal
-	session   string
-	epoch     string
-	deadline  time.Duration
-	last      time.Duration
-	denied    bool
-}
-
-// Public lease reference is an index, never a bearer authentication credential.
-type sdkAttachReceipt struct {
-	JobID        string `json:"jobId"`
-	Revision     uint64 `json:"revision"`
-	AttachID     string `json:"attachId"`
-	RenewAfterMS int64  `json:"renewAfterMs"`
-	TTLMS        int64  `json:"ttlMs"`
-}