@synopackageland/cli 0.5.3 → 0.6.1

package/dist/templates/native-go/backend/internal/helper/sdk_job_vm_linux_test.go

@@ -1,343 +0,0 @@
-//go:build linux && synopkgland_sdk_workers
-
-package helper
-
-import (
-	"bytes"
-	"context"
-	"crypto/sha256"
-	"dsmapp/internal/helper/jobcontract"
-	"encoding/hex"
-	"encoding/json"
-	"fmt"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
-	"syscall"
-	"testing"
-	"time"
-)
-
-const sdkTestVMRoot = "/tmp/m3-sdk-jobs"
-
-type sdkVMTestCommand struct {
-	Op      string `json:"op"`
-	Plan    string `json:"plan"`
-	JobID   string `json:"jobId"`
-	Foreign bool   `json:"foreign"`
-}
-type sdkVMTestResponse struct {
-	Code     Code          `json:"code"`
-	Job      sdkJobReceipt `json:"job"`
-	Started  uint64        `json:"started"`
-	Reaped   uint64        `json:"reaped"`
-	Children int           `json:"children"`
-}
-
-func sdkJobVMFixture(t *testing.T, source string) LinuxProcesses {
-	t.Helper()
-	if os.Getenv("M3_S2_FIXTURE") == "" {
-		t.Skip("NIC-free S2 root VM")
-	}
-	if source == "" {
-		source = os.Getenv("M3_S2_FIXTURE")
-	}
-	digest, err := executableDigest(source)
-	if err != nil {
-		t.Fatal(err)
-	}
-	registryPath := "/sdk-registry.json"
-	if _, err := os.Stat(source + "-registry.json"); err == nil {
-		registryPath = source + "-registry.json"
-	}
-	registry, err := os.ReadFile(registryPath)
-	if err != nil {
-		t.Fatal(err)
-	}
-	sum := sha256.Sum256(registry)
-	i := Inventory{Package: "root", Version: "1.0.0-0001", Protocol: 2, PayloadDigest: digest, RegistryDigest: hex.EncodeToString(sum[:]), DataAccess: "relaxed"}
-	if source == "/helper-fixture" {
-		i.Protocol = 1
-		i.DataAccess = ""
-		i.RegistryDigest = strings.Repeat("b", 64)
-	}
-	c := NewClient(i)
-	for _, dir := range []string{c.StateDir, c.RunDir, sdkTestVMRoot} {
-		if err := os.Mkdir(dir, 0700); err != nil {
-			t.Fatal(err)
-		}
-		t.Cleanup(func() { os.RemoveAll(dir) })
-	}
-	if err := os.Chmod(sdkTestVMRoot, 0755); err != nil {
-		t.Fatal(err)
-	}
-	file := sdkTestVMRoot + "/group"
-	if err := os.WriteFile(file, bytes.Repeat([]byte("group-only;"), 800), 0640); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.Chown(file, 0, 105); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(sdkTestVMRoot+"/denied", []byte("root-only-canary"), 0600); err != nil {
-		t.Fatal(err)
-	}
-	binary := filepath.Join(c.StateDir, "payload-"+digest)
-	data, err := os.ReadFile(source)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err = os.WriteFile(binary, data, 0700); err != nil {
-		t.Fatal(err)
-	}
-	vmUnit(t, "start")
-	return LinuxProcesses{Client: c, Binary: binary}
-}
-func sdkVMCall(t *testing.T, p LinuxProcesses, cmd sdkVMTestCommand) sdkVMTestResponse {
-	t.Helper()
-	os.Remove(p.RunDir + "/sdk-response")
-	data, _ := json.Marshal(cmd)
-	if err := os.WriteFile(p.RunDir+"/sdk-command", data, 0600); err != nil {
-		t.Fatal(err)
-	}
-	ctx, cancel := context.WithTimeout(context.Background(), 4*time.Second)
-	defer cancel()
-	var res sdkVMTestResponse
-	if err := waitHealthy(ctx, func(context.Context) bool {
-		data, err := os.ReadFile(p.RunDir + "/sdk-response")
-		return err == nil && json.Unmarshal(data, &res) == nil
-	}); err != nil {
-		record, _ := readRecord(p.StateDir, 0)
-		t.Fatalf("SDK fixture command %s timed out; lifecycle=%+v", cmd.Op, record.Lifecycle)
-	}
-	return res
-}
-func sdkVMWaitJob(t *testing.T, p LinuxProcesses, id string, want func(sdkVMTestResponse) bool) sdkVMTestResponse {
-	t.Helper()
-	ctx, cancel := context.WithTimeout(context.Background(), 6*time.Second)
-	defer cancel()
-	var res sdkVMTestResponse
-	if err := waitHealthy(ctx, func(context.Context) bool {
-		res = sdkVMCall(t, p, sdkVMTestCommand{Op: "status", JobID: id})
-		return want(res)
-	}); err != nil {
-		t.Fatalf("job did not reach expected state: %+v", res)
-	}
-	return res
-}
-func sdkVMSubmit(t *testing.T, p LinuxProcesses, plan string) string {
-	t.Helper()
-	r := sdkVMCall(t, p, sdkVMTestCommand{Op: "submit", Plan: plan})
-	if r.Code != "" || r.Job.Job.Binding.Job.ID == "" {
-		t.Fatalf("submit: %+v", r)
-	}
-	return r.Job.Job.Binding.Job.ID
-}
-func TestLinuxSDKProductionDefaultAndTaggedRefuseUntrustedChild(t *testing.T) {
-	for _, source := range []string{"/helper-fixture", "/helper-sdk-production"} {
-		t.Run(filepath.Base(source), func(t *testing.T) {
-			p := sdkJobVMFixture(t, source)
-			cmd := exec.Command(p.Binary, "sdk-job-child")
-			output, err := cmd.CombinedOutput()
-			if err == nil || !bytes.Contains(output, []byte("helper lifecycle refused")) {
-				t.Fatalf("production dispatched or wrong refusal: %v %s", err, output)
-			}
-			if _, err := os.Stat(p.RunDir + "/supervisor.sock"); !os.IsNotExist(err) {
-				t.Fatal("production job action created supervisor")
-			}
-		})
-	}
-}
-func TestLinuxSDKJobDirectChildCredentialsCheckpointResultAndReap(t *testing.T) {
-	p := sdkJobVMFixture(t, "")
-	proc := startVMHelper(t, p)
-	if err := os.WriteFile(sdkTestVMRoot+"/hold", nil, 0600); err != nil {
-		t.Fatal(err)
-	}
-	id := sdkVMSubmit(t, p, "all")
-	sdkVMWaitJob(t, p, id, func(r sdkVMTestResponse) bool { return r.Job.Job.State == jobcontract.Running })
-	children := processChildren(proc.PID)
-	if len(children) != 2 {
-		t.Fatalf("job is not one direct child beside helper: %v", children)
-	}
-	child := supervisedPIDByMode(t, proc.PID, "sdk-job-child")
-	status, err := os.ReadFile(fmt.Sprintf("/proc/%d/status", child))
-	if err != nil {
-		t.Fatal(err)
-	}
-	// Credential-ready also requires the child's actual PR_GET_NO_NEW_PRIVS
-	// readback. The additional proc field is unavailable in the 4.4 fixture.
-	if !statusHasCredentials(status, 1001, 100, []uint32{101, 105}) || !bytes.Contains(status, []byte("CapEff:\t0000000000000000")) || bytes.Contains(status, []byte("NoNewPrivs:")) && !bytes.Contains(status, []byte("NoNewPrivs:\t1")) {
-		t.Fatalf("credentials not permanent/complete: %s", status)
-	}
-	os.Remove(sdkTestVMRoot + "/hold")
-	r := sdkVMWaitJob(t, p, id, func(r sdkVMTestResponse) bool { return r.Job.Job.FinishedAt != nil })
-	if r.Job.Job.State != jobcontract.Succeeded || !r.Job.Job.Drained || r.Job.Result == nil || r.Job.Result.CompletedSteps != 4 || r.Job.Result.BytesRead != 17600 || r.Started != 1 || r.Reaped != 1 || r.Children != 0 {
-		t.Fatalf("invalid completion: %+v", r)
-	}
-	if _, err := os.Stat(fmt.Sprintf("/proc/%d", child)); !os.IsNotExist(err) {
-		t.Fatal("receipt before actual Wait4")
-	}
-	data, err := os.ReadFile(p.StateDir + "/sdk-receipt-" + id + ".json")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if bytes.Contains(data, []byte("group-only")) || bytes.Contains(data, []byte("root-only-canary")) || bytes.Contains(data, []byte("sdk-vm-only")) {
-		t.Fatal("file contents or carriers leaked")
-	}
-	var receipt sdkJobReceipt
-	if json.Unmarshal(data, &receipt) != nil || !receipt.Job.Drained {
-		t.Fatal("missing durable terminal receipt")
-	}
-}
-func TestLinuxSDKJobForeignPeerBusyBootstrapAndCancel(t *testing.T) {
-	p := sdkJobVMFixture(t, "")
-	proc := startVMHelper(t, p)
-	r := sdkVMCall(t, p, sdkVMTestCommand{Op: "submit", Foreign: true})
-	if r.Code != ErrDenied || r.Started != 0 {
-		t.Fatal("foreign peer spawned", r)
-	}
-	os.WriteFile(sdkTestVMRoot+"/slow-bootstrap", nil, 0600)
-	first := sdkVMSubmit(t, p, "read")
-	second := sdkVMSubmit(t, p, "read")
-	r = sdkVMCall(t, p, sdkVMTestCommand{Op: "submit", Plan: "read"})
-	if r.Code != ErrBusy || r.Started != 2 {
-		t.Fatalf("bootstrap bypassed slots: %+v", r)
-	}
-	r = sdkVMCall(t, p, sdkVMTestCommand{Op: "status", JobID: first})
-	if r.Job.Job.State == jobcontract.Running {
-		t.Fatal("running before credential-ready")
-	}
-	os.Remove(sdkTestVMRoot + "/slow-bootstrap")
-	for _, id := range []string{first, second} {
-		sdkVMWaitJob(t, p, id, func(r sdkVMTestResponse) bool { return r.Job.Job.FinishedAt != nil })
-	}
-	if len(processChildren(proc.PID)) != 1 {
-		t.Fatal("bootstrap children not reaped")
-	}
-	os.WriteFile(sdkTestVMRoot+"/hold", nil, 0600)
-	id := sdkVMSubmit(t, p, "read")
-	sdkVMWaitJob(t, p, id, func(r sdkVMTestResponse) bool { return r.Job.Job.State == jobcontract.Running })
-	r = sdkVMCall(t, p, sdkVMTestCommand{Op: "cancel", JobID: id})
-	if r.Code != "" || r.Job.Job.State != jobcontract.Canceled || !r.Job.Job.Drained || r.Children != 0 {
-		t.Fatalf("cancel lacked real Q: %+v", r)
-	}
-	id = sdkVMSubmit(t, p, "read")
-	sdkVMWaitJob(t, p, id, func(r sdkVMTestResponse) bool { return r.Job.Job.State == jobcontract.Running })
-	os.WriteFile(sdkTestVMRoot+"/logout", nil, 0600)
-	r = sdkVMCall(t, p, sdkVMTestCommand{Op: "disconnect", JobID: id})
-	if r.Code != "" || r.Job.Job.State != jobcontract.Canceled || !r.Job.Job.Drained {
-		t.Fatalf("EOF required fresh login to stop child: %+v", r)
-	}
-}
-
-func TestLinuxSDKJobParentRevokeDrainsAllDerivedChildren(t *testing.T) {
-	p := sdkJobVMFixture(t, "")
-	proc := startVMHelper(t, p)
-	os.WriteFile(sdkTestVMRoot+"/hold", nil, 0600)
-	first := sdkVMSubmit(t, p, "read")
-	second := sdkVMSubmit(t, p, "read")
-	for _, id := range []string{first, second} {
-		sdkVMWaitJob(t, p, id, func(r sdkVMTestResponse) bool { return r.Job.Job.State == jobcontract.Running })
-	}
-	r := sdkVMCall(t, p, sdkVMTestCommand{Op: "revoke"})
-	if r.Code != "" || r.Started != 2 || r.Reaped != 2 || r.Children != 0 {
-		t.Fatalf("parent R did not use common Q: %+v", r)
-	}
-	if len(processChildren(proc.PID)) != 1 {
-		t.Fatal("derived child survived parent revocation")
-	}
-	for _, id := range []string{first, second} {
-		r = sdkVMWaitJob(t, p, id, func(r sdkVMTestResponse) bool { return r.Job.Job.FinishedAt != nil })
-		if r.Job.Job.State == jobcontract.Succeeded || r.Job.Result != nil {
-			t.Fatal("revoked job returned result")
-		}
-	}
-}
-func TestLinuxSDKJobRefusesActorACLAndMalformedProgress(t *testing.T) {
-	for _, kind := range []string{"denied", "bad-progress", "logout", "groups-changed", "acl-denied", "finish-fsync-fail"} {
-		t.Run(kind, func(t *testing.T) {
-			p := sdkJobVMFixture(t, "")
-			startVMHelper(t, p)
-			if kind == "bad-progress" || kind == "finish-fsync-fail" {
-				os.WriteFile(sdkTestVMRoot+"/"+kind, nil, 0600)
-			}
-			if kind == "logout" || kind == "groups-changed" || kind == "acl-denied" {
-				os.WriteFile(sdkTestVMRoot+"/hold", nil, 0600)
-			}
-			plan := "read"
-			if kind == "denied" {
-				plan = "denied"
-			}
-			id := sdkVMSubmit(t, p, plan)
-			if kind == "logout" || kind == "groups-changed" || kind == "acl-denied" {
-				sdkVMWaitJob(t, p, id, func(r sdkVMTestResponse) bool { return r.Job.Job.State == jobcontract.Running })
-				os.WriteFile(sdkTestVMRoot+"/"+kind, nil, 0600)
-				os.Remove(sdkTestVMRoot + "/hold")
-			}
-			if kind == "finish-fsync-fail" {
-				ctx, cancel := context.WithTimeout(context.Background(), 4*time.Second)
-				defer cancel()
-				if err := waitHealthy(ctx, func(context.Context) bool {
-					r, e := readRecord(p.StateDir, 0)
-					return e == nil && r.Lifecycle != nil && r.Lifecycle.Reason == "sdk-job-journal-uncertain"
-				}); err != nil {
-					t.Fatal("journal failure did not fence shared authority", err)
-				}
-				if _, err := os.Stat(p.StateDir + "/sdk-receipt-" + id + ".json"); !os.IsNotExist(err) {
-					t.Fatal("uncertain job has terminal receipt", err)
-				}
-				return
-			}
-			r := sdkVMWaitJob(t, p, id, func(r sdkVMTestResponse) bool {
-				return r.Job.Job.FinishedAt != nil || r.Job.Job.State == jobcontract.CleanupRequired
-			})
-			if r.Job.Job.State == jobcontract.Succeeded || r.Job.Result != nil {
-				t.Fatalf("unsafe success: %+v", r)
-			}
-		})
-	}
-}
-func TestLinuxSDKJobHelperDeathObserverStopAndParentDeath(t *testing.T) {
-	for _, kind := range []string{"helper-death", "unit-stop", "supervisor-death"} {
-		t.Run(kind, func(t *testing.T) {
-			p := sdkJobVMFixture(t, "")
-			proc := startVMHelper(t, p)
-			os.WriteFile(sdkTestVMRoot+"/hold", nil, 0600)
-			id := sdkVMSubmit(t, p, "read")
-			sdkVMWaitJob(t, p, id, func(r sdkVMTestResponse) bool { return r.Job.Job.State == jobcontract.Running })
-			child := supervisedPIDByMode(t, proc.PID, "sdk-job-child")
-			switch kind {
-			case "helper-death":
-				syscall.Kill(supervisedPIDByMode(t, proc.PID, "serve-child"), syscall.SIGKILL)
-			case "unit-stop":
-				vmUnit(t, "stop")
-			case "supervisor-death":
-				syscall.Kill(proc.PID, syscall.SIGKILL)
-			}
-			waitPIDExit(t, child)
-			if kind == "supervisor-death" {
-				r, err := readRecord(p.StateDir, 0)
-				if err != nil {
-					t.Fatal(err)
-				}
-				if _, err = completionRecord(p.Client, r); err == nil {
-					t.Fatal("PDEATHSIG was fabricated as Q")
-				}
-			} else {
-				ctx, cancel := context.WithTimeout(context.Background(), 4*time.Second)
-				defer cancel()
-				if err := waitHealthy(ctx, func(context.Context) bool {
-					r, e := readRecord(p.StateDir, 0)
-					if e != nil {
-						return false
-					}
-					q, e := completionRecord(p.Client, r)
-					return e == nil && q.Cohort != nil && q.Cohort.Started == 1 && q.Cohort.Reaped == 1 && q.Cohort.RelaysStopped
-				}); err != nil {
-					t.Fatal("owner did not publish actual cohort Q")
-				}
-			}
-		})
-	}
-}

package/dist/templates/native-go/backend/internal/helper/sdk_journal.go

@@ -1,77 +0,0 @@
-//go:build synopkgland_sdk_workers
-
-package helper
-
-import (
-	"bytes"
-	"dsmapp/internal/helper/jobcontract"
-	"encoding/json"
-)
-
-// Retained artifacts explain history, never authorize execution. The file
-// implementation belongs to the SAME FileGrantRepository and owner lock.
-type sdkRetainedJournal interface {
-	sdkJobJournal
-	Records() ([]sdkJournalRecord, Code)
-}
-type sdkJournalRecord struct {
-	Schema  int            `json:"schema"`
-	Intent  sdkJobIntent   `json:"intent"`
-	State   string         `json:"state"` // pending/canceled/finished/interrupted
-	Receipt *sdkJobReceipt `json:"receipt,omitempty"`
-}
-
-func decodeSDKJournal(b []byte) (sdkJournalRecord, Code) {
-	var r sdkJournalRecord
-	if c := decodeDataObject(bytes.NewReader(b), &r, jobcontract.MaxArtifactBytes); c != "" {
-		return r, c
-	}
-	if r.Schema != 1 {
-		return r, ErrIncompatible
-	}
-	i := r.Intent
-	bnd := i.Request.Control.Binding
-	if _, c := cloneSDKRequest(i.Request); c != "" {
-		return r, c
-	}
-	if i.Request.Control.Op != "jobs.submit" || i.Actor.IdentityBasis != "uid-username" || !validRelaxedIdentity(RelaxedIdentity{UID: i.Actor.UID, Username: i.Actor.Username}) {
-		return r, ErrInvalid
-	}
-	if bnd.Mode == jobcontract.Interactive {
-		if !allReferences(i.SessionRef) {
-			return r, ErrInvalid
-		}
-	} else if i.SessionRef != "" {
-		return r, ErrInvalid
-	}
-	digest, why := jobcontract.InputDigest(i.Request.Input, bnd.InputSchemaDigest)
-	if why != "" || digest != bnd.InputDigest {
-		return r, ErrInvalid
-	}
-	switch r.State {
-	case "pending", "canceled", "interrupted":
-		if r.Receipt != nil {
-			return r, ErrInvalid
-		}
-	case "finished":
-		if r.Receipt == nil || jobcontract.CompareBinding(r.Receipt.Job.Binding, bnd) != "" || jobcontract.ValidateJob(r.Receipt.Job) != "" || !r.Receipt.Job.Drained || r.Receipt.Job.FinishedAt == nil {
-			return r, ErrInvalid
-		}
-		if r.Receipt.Result != nil && (r.Receipt.Job.State != jobcontract.Succeeded || jobcontract.ValidateResult(*r.Receipt.Result) != "") {
-			return r, ErrInvalid
-		}
-	default:
-		return r, ErrInvalid
-	}
-	return r, ""
-}
-func encodeSDKJournal(r sdkJournalRecord) ([]byte, Code) {
-	b, err := json.Marshal(r)
-	if err != nil {
-		return nil, ErrInvalid
-	}
-	if _, c := decodeSDKJournal(b); c != "" {
-		return nil, c
-	}
-	return b, ""
-}

package/dist/templates/native-go/backend/internal/helper/sdk_journal_linux.go

@@ -1,244 +0,0 @@
-//go:build linux && synopkgland_sdk_workers
-
-package helper
-
-import (
-	"dsmapp/internal/helper/jobcontract"
-	"io"
-	"os"
-	"sort"
-	"strings"
-
-	"golang.org/x/sys/unix"
-)
-
-type sdkFileJobJournal struct{ repository *FileGrantRepository }
-
-// Called once by the root ordering owner, before enabling any SDK admissions.
-// Restart retains execution keys and interrupts every nonterminal intent. There
-// is no resume API, even when the inventory and epoch bytes have not changed.
-func newSDKFileJobJournal(r *FileGrantRepository) (*sdkFileJobJournal, Code) {
-	j, code, _ := newSDKFileJobJournalDiagnostic(r)
-	return j, code
-}
-
-func newSDKFileJobJournalDiagnostic(r *FileGrantRepository) (*sdkFileJobJournal, Code, string) {
-	stage := "jobs-journal-load"
-	if r == nil {
-		return nil, ErrUnavailable, stage
-	}
-	j := &sdkFileJobJournal{r}
-	c := r.withLocks(func() Code {
-		if r.journalReady {
-			return ErrBusy
-		}
-		records, c, failingStage := j.loadLockedDiagnostic()
-		stage = failingStage
-		if c != "" {
-			r.poisoned = true
-			return c
-		}
-		stage = "jobs-journal-load"
-		r.journalKnown = map[string]string{}
-		for _, record := range records {
-			if record.State == "pending" || record.State == "canceled" {
-				record.State = "interrupted"
-				record.Receipt = nil
-				if c := j.saveLocked(record); c != "" {
-					return c
-				}
-			} else {
-				raw, _ := encodeSDKJournal(record)
-				r.journalKnown[record.Intent.Request.Control.Binding.Job.ID] = snapshotDigest(raw)
-			}
-		}
-		r.journalReady = true
-		return ""
-	})
-	if c != "" {
-		return nil, c, stage
-	}
-	return j, "", ""
-}
-func (j *sdkFileJobJournal) loadLocked() ([]sdkJournalRecord, Code) {
-	records, code, _ := j.loadLockedDiagnostic()
-	return records, code
-}
-
-func (j *sdkFileJobJournal) loadLockedDiagnostic() ([]sdkJournalRecord, Code, string) {
-	r := j.repository
-	fd, e := unix.Openat(int(r.dir.Fd()), ".", unix.O_RDONLY|unix.O_DIRECTORY|unix.O_CLOEXEC, 0)
-	if e != nil {
-		return nil, ErrUnavailable, "jobs-journal-load"
-	}
-	f := os.NewFile(uintptr(fd), "sdk-journal-listing")
-	defer f.Close()
-	names, e := f.Readdirnames(4097)
-	if e != nil && e != io.EOF {
-		return nil, ErrUnavailable, "jobs-journal-load"
-	}
-	if len(names) > 4096 {
-		return nil, ErrLimit, "jobs-journal-load"
-	}
-	sort.Strings(names)
-	out := []sdkJournalRecord{}
-	seen := map[string]bool{}
-	intents := map[string]bool{}
-	nonces := map[string]bool{}
-	tickets := map[string]bool{}
-	for _, name := range names {
-		if !strings.HasPrefix(name, "job-intent-") {
-			continue
-		}
-		id := strings.TrimSuffix(strings.TrimPrefix(name, "job-intent-"), ".json")
-		if !allReferences(id) || name != "job-intent-"+id+".json" {
-			return nil, ErrCleanupRequired, "jobs-journal-load"
-		}
-		if len(out) >= jobcontract.MaxExecutionKeys {
-			return nil, ErrLimit, "jobs-journal-load"
-		}
-		b, e := r.read(name, 0600, jobcontract.MaxArtifactBytes)
-		if e != nil {
-			return nil, ErrUnavailable, "jobs-journal-load"
-		}
-		rec, c := decodeSDKJournal(b)
-		if c != "" {
-			return nil, c, "journal-decode"
-		}
-		control := rec.Intent.Request.Control
-		if control.Binding.Job.ID != id || seen[id] || intents[control.Intent.ID] || nonces[control.Nonce] || tickets[control.Ticket] {
-			return nil, ErrReplay, "jobs-journal-load"
-		}
-		if r.journalKnown != nil && r.journalKnown[id] != snapshotDigest(b) {
-			return nil, ErrStale, "jobs-journal-load"
-		}
-		seen[id] = true
-		intents[control.Intent.ID] = true
-		nonces[control.Nonce] = true
-		tickets[control.Ticket] = true
-		out = append(out, rec)
-	}
-	if r.journalKnown != nil && len(seen) != len(r.journalKnown) {
-		return nil, ErrStale, "jobs-journal-load"
-	}
-	return out, "", ""
-}
-func (j *sdkFileJobJournal) saveLocked(record sdkJournalRecord) Code {
-	r := j.repository
-	b, c := encodeSDKJournal(record)
-	if c != "" {
-		return c
-	}
-	id := record.Intent.Request.Control.Binding.Job.ID
-	if c = r.commit("job-intent-"+id+".json", b); c != "" {
-		r.poisoned = true
-		return c
-	}
-	r.journalKnown[id] = snapshotDigest(b)
-	return ""
-}
-func (j *sdkFileJobJournal) transaction(fn func(GrantPolicy, []sdkJournalRecord) Code) Code {
-	if j == nil || j.repository == nil {
-		return ErrUnavailable
-	}
-	r := j.repository
-	return r.withLocks(func() Code {
-		if !r.journalReady {
-			return ErrUnavailable
-		}
-		p, c := r.readPolicy()
-		if c != "" {
-			r.poisoned = true
-			return c
-		}
-		records, c := j.loadLocked()
-		if c != "" {
-			r.poisoned = true
-			return c
-		}
-		return fn(p, records)
-	})
-}
-func (j *sdkFileJobJournal) Records() ([]sdkJournalRecord, Code) {
-	var out []sdkJournalRecord
-	c := j.transaction(func(_ GrantPolicy, rs []sdkJournalRecord) Code { out = rs; return "" })
-	return out, c
-}
-func sdkJournalPolicy(b jobcontract.Binding, p GrantPolicy) bool {
-	return p.Enabled && b.Inventory == sdkInventory(p.Inventory) && b.Epoch == p.Epoch && b.ApprovalBinding == p.ApprovalBinding && b.CapabilityDigest == p.CapabilityDigest
-}
-func (j *sdkFileJobJournal) Reserve(i sdkJobIntent) Code {
-	raw, c := encodeSDKJournal(sdkJournalRecord{Schema: 1, Intent: i, State: "pending"})
-	if c != "" {
-		return c
-	}
-	record, c := decodeSDKJournal(raw)
-	if c != "" {
-		return c
-	}
-	return j.transaction(func(p GrantPolicy, rs []sdkJournalRecord) Code {
-		if !sdkJournalPolicy(i.Request.Control.Binding, p) {
-			return ErrFenced
-		}
-		for _, r := range rs {
-			x, y := r.Intent.Request.Control, i.Request.Control
-			if x.Binding.Job.ID == y.Binding.Job.ID || x.Intent.ID == y.Intent.ID || x.Nonce == y.Nonce || x.Ticket == y.Ticket {
-				return ErrReplay
-			}
-		}
-		if len(rs) >= jobcontract.MaxExecutionKeys {
-			return ErrLimit
-		}
-		return j.saveLocked(record)
-	})
-}
-func (j *sdkFileJobJournal) Cancel(b jobcontract.Binding) Code {
-	return j.transaction(func(p GrantPolicy, rs []sdkJournalRecord) Code {
-		if !sdkJournalPolicy(b, p) {
-			return ErrFenced
-		}
-		for _, r := range rs {
-			if r.Intent.Request.Control.Binding.Job.ID != b.Job.ID {
-				continue
-			}
-			if jobcontract.CompareBinding(b, r.Intent.Request.Control.Binding) != "" {
-				return ErrDenied
-			}
-			if r.State == "canceled" {
-				return ""
-			}
-			if r.State != "pending" {
-				return ErrStale
-			}
-			r.State = "canceled"
-			return j.saveLocked(r)
-		}
-		return ErrDenied
-	})
-}
-func (j *sdkFileJobJournal) Finish(receipt sdkJobReceipt) Code {
-	b := receipt.Job.Binding
-	return j.transaction(func(p GrantPolicy, rs []sdkJournalRecord) Code {
-		if !sdkJournalPolicy(b, p) {
-			return ErrFenced
-		}
-		for _, r := range rs {
-			if r.Intent.Request.Control.Binding.Job.ID != b.Job.ID {
-				continue
-			}
-			if jobcontract.CompareBinding(b, r.Intent.Request.Control.Binding) != "" {
-				return ErrDenied
-			}
-			if r.State != "pending" && r.State != "canceled" {
-				return ErrStale
-			}
-			if r.State == "canceled" && receipt.Job.State != jobcontract.Canceled {
-				return ErrDenied
-			}
-			r.State = "finished"
-			r.Receipt = &receipt
-			return j.saveLocked(r)
-		}
-		return ErrDenied
-	})
-}