@synopackageland/cli 0.5.3 → 0.6.1

package/templates/native-go/backend/internal/helper/cohort.go

@@ -1,393 +0,0 @@
-package helper
-
-import (
-	"context"
-	"syscall"
-	"time"
-)
-
-// Staged root-side API. Only the supervisor owner loop calls these methods;
-// native adapters, grant/ACL authority and a public data transport are NOT installed.
-// Operation children are fixed synthetic operations, never caller executables.
-type operationBinding struct {
-	Inventory     Inventory `json:"inventory"`
-	Epoch         string    `json:"epoch"`
-	OperationID   string    `json:"operationId"`
-	Nonce         string    `json:"nonce"`
-	GrantID       string    `json:"grantId"`
-	GrantRevision uint64    `json:"grantRevision"`
-}
-type operationPeer struct {
-	PID int
-	UID uint32
-}
-type operationProcess interface {
-	supervisedChild
-	chunk(uint32) error
-	idle() (bool, error)
-	stopRelay()
-	relayStopped() bool
-}
-type cohortOperation struct {
-	binding        operationBinding
-	actor          NativeActor
-	process        operationProcess
-	bytes          uint64
-	canceled       bool
-	admittedAt     time.Time
-	lastActivity   time.Time
-	maxBytes       uint64
-	segments       []string
-	commitReserved bool
-	writeWork      *writeWork
-	work           *readOnlyWork
-	root           readOnlyRootWitness
-}
-type CohortCompletion struct {
-	Started             uint64 `json:"started"`
-	Reaped              uint64 `json:"reaped"`
-	WriteIntents        uint64 `json:"writeIntents,omitempty"`
-	WriteEffectsUnknown bool   `json:"writeEffectsUnknown,omitempty"`
-	RelaysStopped       bool   `json:"relaysStopped"`
-}
-
-func (q CohortCompletion) valid() bool {
-	return q.Started > 0 && q.Started <= MaxReplayEntries && q.Started == q.Reaped && q.RelaysStopped && q.WriteIntents <= q.Started && (!q.WriteEffectsUnknown || q.WriteIntents > 0)
-}
-
-type operationCohort struct {
-	inventory       Inventory
-	epoch           string
-	helperPID       int
-	helperLive      func() bool
-	gate            *admission
-	now             func() time.Time
-	startChild      func(NativeActor, operationBinding) (operationProcess, error)
-	operations      map[string]*cohortOperation
-	seen            map[string]bool
-	started, reaped uint64
-	receipts        map[string]cohortReceipt
-	fenced          bool
-}
-
-func newOperationCohort(i Inventory, epoch string, pid int, g *admission, live func() bool) *operationCohort {
-	return &operationCohort{inventory: i, epoch: epoch, helperPID: pid, gate: g, helperLive: live, now: time.Now, operations: map[string]*cohortOperation{}, seen: map[string]bool{}, receipts: map[string]cohortReceipt{}}
-}
-func (c *operationCohort) peerAllowed(p operationPeer) bool {
-	return c.helperPID > 1 && p.PID == c.helperPID && p.UID == 0 && c.helperLive != nil && c.helperLive()
-}
-func (c *operationCohort) bound(b operationBinding) bool {
-	return c.inventory.Protocol == DataProtocol && c.inventory.Valid() && b.Inventory == c.inventory && b.Epoch == c.epoch && digestPattern.MatchString(c.epoch) && digestPattern.MatchString(b.OperationID) && digestPattern.MatchString(b.Nonce) && digestPattern.MatchString(b.GrantID) && b.GrantRevision > 0
-}
-
-// Called with the observer's mutex held, including child/lease admission.
-func (c *operationCohort) allowed() bool {
-	if c.now().Before(c.gate.seen) {
-		c.gate.fenceLocked("observation-expired")
-	}
-	return !c.fenced && c.gate.allowLocked(c.now())
-}
-func (c *operationCohort) start(ctx context.Context, peer operationPeer, p *NativeProvider, carriers SessionCarriers, old NativeActor, b operationBinding) Code {
-	if c.fenced {
-		return ErrFenced
-	}
-	if !c.peerAllowed(peer) {
-		return ErrDenied
-	}
-	if !c.bound(b) {
-		return ErrInvalid
-	}
-	if !old.valid || old.UID() == 0 || old.GID() == 0 || old.account.Groups == nil {
-		return ErrDenied
-	}
-	actor, code := p.Revalidate(ctx, carriers, old)
-	if code != "" {
-		return code
-	}
-	c.gate.mu.Lock()
-	op, code := c.reserveLocked(actor, b)
-	c.gate.mu.Unlock()
-	if code != "" {
-		return code
-	}
-	return c.launchReserved(op)
-}
-
-// Only registers a slot and replay history. No child/bootstrap/I/O under locks.
-func (c *operationCohort) reserveLocked(actor NativeActor, b operationBinding) (*cohortOperation, Code) {
-	if !c.allowed() {
-		return nil, ErrFenced
-	}
-	if !c.bound(b) || !actor.valid || actor.UID() == 0 || actor.GID() == 0 || actor.account.Groups == nil {
-		return nil, ErrDenied
-	}
-	if !nativeFresh(actor.account.CheckedAt, c.now()) {
-		return nil, ErrStale
-	}
-	if c.seen["op:"+b.OperationID] || c.seen["nonce:"+b.Nonce] {
-		return nil, ErrReplay
-	}
-	count := 0
-	for _, op := range c.operations {
-		if op.actor.Principal().SubjectRef == actor.Principal().SubjectRef {
-			count++
-		}
-	}
-	if len(c.operations) >= MaxPackageOperations || count >= MaxSubjectOperations || len(c.seen) >= 2*MaxReplayEntries {
-		return nil, ErrBusy
-	}
-	if c.startChild == nil {
-		return nil, ErrUnavailable
-	}
-	op := &cohortOperation{binding: b, actor: actor, admittedAt: c.now(), maxBytes: MaxBoundedBytes}
-	c.operations[b.OperationID] = op
-	c.seen["op:"+b.OperationID] = true
-	c.seen["nonce:"+b.Nonce] = true
-	return op, ""
-}
-func (c *operationCohort) launchReserved(op *cohortOperation) Code {
-	c.gate.mu.Lock()
-	exists := c.operations[op.binding.OperationID] == op && !op.canceled && c.allowed()
-	if !exists {
-		delete(c.operations, op.binding.OperationID)
-	}
-	c.gate.mu.Unlock()
-	if !exists {
-		return ErrFenced
-	}
-	child, err := c.startChild(op.actor, op.binding)
-	c.gate.mu.Lock()
-	defer c.gate.mu.Unlock()
-	if child == nil {
-		delete(c.operations, op.binding.OperationID)
-		return ErrUnavailable
-	}
-	c.started++
-	op.process = child
-	if !c.allowed() {
-		op.canceled = true
-		child.stopRelay()
-		return ErrFenced
-	}
-	if err != nil {
-		op.canceled = true
-		child.stopRelay()
-		return ErrCleanupRequired
-	}
-	return ""
-}
-func (c *operationCohort) chunk(ctx context.Context, peer operationPeer, p *NativeProvider, carriers SessionCarriers, b operationBinding, n uint32) Code {
-	if c.fenced || !c.gate.allow(c.now()) {
-		return ErrFenced
-	}
-	if !c.peerAllowed(peer) {
-		return ErrDenied
-	}
-	op := c.operations[b.OperationID]
-	if op == nil || op.binding != b {
-		return ErrDenied
-	}
-	if op.canceled {
-		return ErrCanceled
-	}
-	if op.expired(c.now()) {
-		op.canceled = true
-		op.process.stopRelay()
-		return ErrTimeout
-	}
-	actor, code := p.Revalidate(ctx, carriers, op.actor)
-	if code != "" {
-		op.canceled = true
-		op.process.stopRelay()
-		return code
-	}
-	c.gate.mu.Lock()
-	code = c.reserveChunkLocked(op, actor, n)
-	c.gate.mu.Unlock()
-	if code != "" {
-		return code
-	}
-	return c.deliverChunk(op, n)
-}
-func (c *operationCohort) reserveChunkLocked(op *cohortOperation, actor NativeActor, n uint32) Code {
-	if !c.allowed() {
-		return ErrFenced
-	}
-	if op.process == nil || op.canceled {
-		return ErrCanceled
-	}
-	if op.expired(c.now()) {
-		op.canceled = true
-		op.process.stopRelay()
-		return ErrTimeout
-	}
-	if !nativeFresh(actor.account.CheckedAt, c.now()) {
-		op.canceled = true
-		op.process.stopRelay()
-		return ErrStale
-	}
-	ceiling := op.maxBytes
-	if ceiling == 0 {
-		ceiling = MaxBoundedBytes
-	}
-	if n == 0 || n > MaxChunkBytes || uint64(n) > ceiling || op.bytes > ceiling-uint64(n) {
-		return ErrLimit
-	}
-	idle, err := op.process.idle()
-	if err != nil {
-		op.canceled = true
-		op.process.stopRelay()
-		return ErrCleanupRequired
-	}
-	if !idle {
-		return ErrBusy
-	}
-	op.bytes += uint64(n)
-	op.actor = actor
-	op.lastActivity = c.now()
-	return ""
-}
-func (c *operationCohort) deliverChunk(op *cohortOperation, n uint32) Code {
-	if op.canceled {
-		return ErrCanceled
-	}
-	var err error
-	if p, ok := op.process.(interface {
-		chunkWithActor(uint32, NativeActor) error
-	}); ok {
-		err = p.chunkWithActor(n, op.actor)
-	} else {
-		err = op.process.chunk(n)
-	}
-	if err != nil {
-		op.canceled = true
-		op.process.stopRelay()
-		return ErrCleanupRequired
-	}
-	return ""
-}
-func (c *operationCohort) poll() error {
-	for id, op := range c.operations {
-		if op.process == nil {
-			if op.canceled {
-				delete(c.operations, id)
-			}
-			continue
-		}
-		if op.expired(c.now()) {
-			op.canceled = true
-			op.process.stopRelay()
-		}
-		if _, relayErr := op.process.idle(); relayErr != nil {
-			op.canceled = true
-			op.process.stopRelay()
-		}
-		done, err := op.process.exited()
-		if err != nil {
-			return err
-		}
-		if op.canceled && !done {
-			if err := op.process.signal(syscall.SIGKILL); err != nil {
-				return err
-			}
-		}
-		if done {
-			op.process.stopRelay()
-			if op.process.relayStopped() {
-				c.retire(id, op)
-			}
-		}
-	}
-	return nil
-}
-func (c *operationCohort) deny() {
-	c.fenced = true
-	for _, op := range c.operations {
-		op.canceled = true
-		if op.process != nil {
-			op.process.stopRelay()
-		}
-	}
-}
-func (c *operationCohort) drain(ctx context.Context, grace time.Duration) error {
-	c.deny()
-	return c.drainSelected(ctx, grace, func(*cohortOperation) bool { return true })
-}
-
-// S3 calls this after durable R; other grants keep running. This is only Q proof.
-func (c *operationCohort) cancelGrant(ctx context.Context, id string, revision uint64) error {
-	return c.drainSelected(ctx, TerminateGrace, func(op *cohortOperation) bool {
-		return op.binding.GrantID == id && op.binding.GrantRevision <= revision
-	})
-}
-func (c *operationCohort) drainSelected(ctx context.Context, grace time.Duration, selected func(*cohortOperation) bool) error {
-	if err := ctx.Err(); err != nil {
-		return err
-	}
-	killed := map[string]bool{}
-	term := map[string]bool{}
-	escalate := time.Now().Add(grace)
-	for {
-		pending := false
-		for id, op := range c.operations {
-			if !selected(op) {
-				continue
-			}
-			op.canceled = true
-			if op.process == nil {
-				delete(c.operations, id)
-				continue
-			}
-			op.process.stopRelay()
-			done, err := op.process.exited()
-			if err != nil {
-				return err
-			}
-			if done {
-				if op.process.relayStopped() {
-					c.retire(id, op)
-					continue
-				}
-			} else if !term[id] {
-				if err := op.process.signal(syscall.SIGTERM); err != nil {
-					return err
-				}
-				term[id] = true
-			} else if !killed[id] && !time.Now().Before(escalate) {
-				if err := op.process.signal(syscall.SIGKILL); err != nil {
-					return err
-				}
-				killed[id] = true
-			}
-			pending = true
-		}
-		if !pending {
-			return nil
-		}
-		timer := time.NewTimer(time.Millisecond)
-		select {
-		case <-ctx.Done():
-			timer.Stop()
-			return ctx.Err()
-		case <-timer.C:
-		}
-	}
-}
-func (c *operationCohort) proof() (*CohortCompletion, error) {
-	if !c.fenced || len(c.operations) != 0 || c.started != c.reaped {
-		return nil, errTrust
-	}
-	if c.started == 0 {
-		return nil, nil
-	}
-	proof := &CohortCompletion{Started: c.started, Reaped: c.reaped, RelaysStopped: true}
-	for _, r := range c.receipts {
-		if r.write != nil {
-			proof.WriteIntents++
-			if r.write.unknown || r.write.code == ErrCommitUncertain {
-				proof.WriteEffectsUnknown = true
-			}
-		}
-	}
-	return proof, nil
-}

package/templates/native-go/backend/internal/helper/cohort_publication.go

@@ -1,18 +0,0 @@
-package helper
-
-import (
-	"context"
-	"errors"
-)
-
-// Match the controller's completion-publication handoff: only a busy lock may
-// be retried, with the caller's finite budget. The transaction re-reads and
-// validates authority after acquiring policy.lock. Expiry preserves refusal.
-func retryCohortPolicy(ctx context.Context, commit func() error) error {
-	last := errBusy
-	_ = waitHealthy(ctx, func(context.Context) bool {
-		last = commit()
-		return !errors.Is(last, errBusy)
-	})
-	return last
-}

package/templates/native-go/backend/internal/helper/cohort_publication_test.go

@@ -1,105 +0,0 @@
-package helper
-
-import (
-	"context"
-	"errors"
-	"os"
-	"path/filepath"
-	"strings"
-	"syscall"
-	"testing"
-	"time"
-)
-
-func TestCohortPolicyRetryBusyOnlyAndBounded(t *testing.T) {
-	calls := 0
-	ctx, cancel := context.WithTimeout(context.Background(), 50*time.Millisecond)
-	defer cancel()
-	begin := time.Now()
-	if err := retryCohortPolicy(ctx, func() error { calls++; return errBusy }); !errors.Is(err, errBusy) {
-		t.Fatal(err)
-	}
-	if calls < 2 || time.Since(begin) > time.Second {
-		t.Fatal("unbounded or missing busy retry", calls)
-	}
-	calls = 0
-	if err := retryCohortPolicy(context.Background(), func() error { calls++; return errTrust }); !errors.Is(err, errTrust) || calls != 1 {
-		t.Fatal("nonbusy refusal retried", err, calls)
-	}
-	calls = 0
-	if err := retryCohortPolicy(context.Background(), func() error {
-		calls++
-		if calls == 1 {
-			return errBusy
-		}
-		return nil
-	}); err != nil || calls != 2 {
-		t.Fatal(err, calls)
-	}
-}
-func TestCohortFenceRetryRevalidatesUnderPolicyLock(t *testing.T) {
-	for _, change := range []string{"release", "epoch", "inventory", "stopped"} {
-		t.Run(change, func(t *testing.T) {
-			c, _ := controlFixture(t)
-			before, _ := readRecord(c.StateDir, c.Owner)
-			lock, err := os.OpenFile(filepath.Join(c.StateDir, "policy.lock"), os.O_CREATE|os.O_RDWR, 0600)
-			if err != nil {
-				t.Fatal(err)
-			}
-			defer lock.Close()
-			if err := syscall.Flock(int(lock.Fd()), syscall.LOCK_EX); err != nil {
-				t.Fatal(err)
-			}
-			attempted := make(chan struct{})
-			result := make(chan error, 1)
-			ctx, cancel := context.WithTimeout(context.Background(), time.Second)
-			defer cancel()
-			go func() {
-				once := false
-				result <- retryCohortPolicy(ctx, func() error {
-					err := fenceRecord(c.Client, before.Lifecycle.Epoch, "unit-stopped")
-					if !once {
-						once = true
-						close(attempted)
-					}
-					return err
-				})
-			}()
-			<-attempted
-			r, _ := readRecord(c.StateDir, c.Owner)
-			switch change {
-			case "epoch":
-				r.Lifecycle.Epoch = strings.Repeat("e", 64)
-			case "inventory":
-				r.Inventory.Version = "9.0.0-0001"
-			case "stopped":
-				r.Lifecycle.Phase = "stopped"
-			}
-			if err := writeProtected(c.StateDir, "approval.json", r); err != nil {
-				t.Fatal(err)
-			}
-			saved, _ := os.ReadFile(filepath.Join(c.StateDir, "approval.json"))
-			if err := syscall.Flock(int(lock.Fd()), syscall.LOCK_UN); err != nil {
-				t.Fatal(err)
-			}
-			err = <-result
-			if change == "release" {
-				if err != nil {
-					t.Fatal(err)
-				}
-				current, _ := readRecord(c.StateDir, c.Owner)
-				if current.Lifecycle.Phase != "fenced" {
-					t.Fatal(current)
-				}
-			} else {
-				if !errors.Is(err, errTrust) {
-					t.Fatal("changed authority retried/accepted", err)
-				}
-				after, _ := os.ReadFile(filepath.Join(c.StateDir, "approval.json"))
-				if string(after) != string(saved) {
-					t.Fatal("changed authority overwritten")
-				}
-			}
-		})
-	}
-}