@synopackageland/cli 0.5.3 → 0.6.1

package/templates/native-go/backend/internal/helper/managed_pilot.go

@@ -1,284 +0,0 @@
-package helper
-
-import (
-	"context"
-	"math"
-	"slices"
-	"strings"
-	"time"
-	"unicode/utf8"
-)
-
-// B is a distinct, explicit opt-in contract. These adapters are root-owned and
-// cannot be populated by browser/package claims. No shipped bridge is installed.
-type managedPilotObservation struct {
-	Account                                    LocalAccount
-	SessionRef, BoundaryRef                    string
-	BoundaryProven, SessionsPurged, FreshLogin bool
-	CheckedAt                                  time.Time
-}
-type managedPilotBridge interface {
-	Observe(context.Context, SessionCarriers) (managedPilotObservation, Code)
-}
-
-// Durable disable must survive a failed/uncertain transaction; restart never
-// restores an enabled enrollment. Secret session carriers must never be stored.
-type managedPilotStore interface {
-	Load(context.Context) (managedPilotRecord, Code)
-	Save(context.Context, managedPilotRecord) Code
-}
-type managedPilotRecord struct {
-	Enabled         bool   `json:"enabled"`
-	Epoch           string `json:"epoch"`
-	ApprovalBinding string `json:"approvalBinding"`
-	SubjectRef      string `json:"subjectRef"`
-	Generation      string `json:"generation"`
-	SessionRef      string `json:"sessionRef"`
-	Username        string `json:"username"`
-	BoundaryRef     string `json:"boundaryRef"`
-}
-type managedPilot struct {
-	authority *GrantAuthority
-	bridge    managedPilotBridge
-	store     managedPilotStore
-	record    managedPilotRecord
-	baseline  LocalAccount
-}
-
-func newManagedPilotProvider(b managedPilotBridge, s managedPilotStore) *NativeProvider {
-	return &NativeProvider{managed: &managedPilot{bridge: b, store: s}, now: time.Now}
-}
-func (m *managedPilot) bind(a *GrantAuthority) Code {
-	if m == nil || a == nil || m.bridge == nil || m.store == nil {
-		return ErrUnavailable
-	}
-	if m.authority != nil {
-		return ErrBusy
-	}
-	m.authority = a
-	// Durably reset opt-in on every new owner. No historical enabled record is
-	// adopted, even if approval/epoch bytes survived a restart or restore.
-	ctx, cancel := context.WithTimeout(context.Background(), NativeProofFreshness)
-	defer cancel()
-	a.mu.Lock()
-	c := safeGrantCode(m.store.Save(ctx, managedPilotRecord{}))
-	if c != "" {
-		a.fenced = true
-	}
-	a.mu.Unlock()
-	return c
-}
-func pilotAccountValid(o managedPilotObservation, now time.Time) bool {
-	a := o.Account
-	return o.BoundaryProven && o.SessionsPurged && o.FreshLogin && allReferences(o.SessionRef, o.BoundaryRef) && nativeFresh(o.CheckedAt, now) && nativeFresh(a.CheckedAt, now) && a.Principal.Kind == "local" && a.Principal.InstanceRef == "" && a.Enabled && a.UID != 0 && a.Groups != nil && len(a.Groups) <= 1024 && a.Username != "" && len(a.Username) <= MaxSegmentBytes && utf8.ValidString(a.Username) && !strings.ContainsAny(a.Username, "\x00\r\n/\\")
-}
-func pilotAccountSame(a, b LocalAccount) bool {
-	return a.Username == b.Username && a.UID == b.UID && a.GID == b.GID && a.Enabled == b.Enabled && a.Admin == b.Admin && slices.Equal(a.Groups, b.Groups)
-}
-func pilotOwnedAccount(a LocalAccount) LocalAccount {
-	a.Groups = slices.Clone(a.Groups)
-	slices.Sort(a.Groups)
-	a.Groups = slices.Compact(a.Groups)
-	return a
-}
-func (m *managedPilot) enableAndApprove(ctx context.Context, admin, subject SessionCarriers, acknowledged bool) Code {
-	if !acknowledged {
-		return ErrDenied
-	}
-	if m == nil || m.authority == nil || m.bridge == nil || m.store == nil {
-		return ErrUnavailable
-	}
-	ctx, cancel := context.WithTimeout(ctx, NativeProofFreshness)
-	defer cancel()
-	a := m.authority
-	fail := func(code Code) Code {
-		if c := m.invalidate(context.Background()); c != "" {
-			return ErrCleanupRequired
-		}
-		return code
-	}
-	// A browser flag is not admin proof. The trusted native bridge must freshly
-	// prove local admin and the unbroken managed boundary, including session reset.
-	approver, c := m.bridge.Observe(ctx, admin)
-	if c = nativeObservationCode(ctx, c); c != "" || !pilotAccountValid(approver, a.now()) || !approver.Account.Admin {
-		return fail(ErrDenied)
-	}
-	user, c := m.bridge.Observe(ctx, subject)
-	if c = nativeObservationCode(ctx, c); c != "" || !pilotAccountValid(user, a.now()) || user.BoundaryRef != approver.BoundaryRef {
-		return fail(ErrUnavailable)
-	}
-	again, c := m.bridge.Observe(ctx, admin)
-	if c = nativeObservationCode(ctx, c); c != "" || !pilotAccountValid(again, a.now()) || again.SessionRef != approver.SessionRef || again.BoundaryRef != approver.BoundaryRef || !pilotAccountSame(pilotOwnedAccount(approver.Account), pilotOwnedAccount(again.Account)) {
-		return fail(ErrStale)
-	}
-	generation, c := randomGrantID()
-	if c != "" {
-		return fail(c)
-	}
-	subjectRef, c := randomGrantID()
-	if c != "" {
-		return fail(c)
-	}
-	a.mu.Lock()
-	if a.fenced || m.record.Enabled {
-		a.mu.Unlock()
-		return ErrFenced
-	}
-	if c = nativeContextCode(ctx); c != "" || !nativeFresh(user.CheckedAt, a.now()) || !nativeFresh(user.Account.CheckedAt, a.now()) {
-		a.mu.Unlock()
-		return fail(ErrStale)
-	}
-	record := managedPilotRecord{Enabled: true, Epoch: a.policy.Epoch, ApprovalBinding: a.policy.ApprovalBinding, SubjectRef: subjectRef, Generation: generation, SessionRef: user.SessionRef, Username: user.Account.Username, BoundaryRef: user.BoundaryRef}
-	// SAME S3 ordering mutex brackets durable opt-in and publication.
-	c = nativeObservationCode(ctx, m.store.Save(ctx, record))
-	if c == "" && (!nativeFresh(user.CheckedAt, a.now()) || !nativeFresh(user.Account.CheckedAt, a.now()) || !nativeFresh(again.CheckedAt, a.now()) || !nativeFresh(again.Account.CheckedAt, a.now())) {
-		c = ErrStale
-	}
-	if c == "" {
-		m.record = record
-		m.baseline = pilotOwnedAccount(user.Account)
-	}
-	a.mu.Unlock()
-	if c != "" {
-		return fail(c)
-	}
-	return ""
-}
-func (m *managedPilot) resolve(ctx context.Context, carriers SessionCarriers) (NativeActor, Code) {
-	if m == nil || m.authority == nil || m.bridge == nil || m.store == nil {
-		return NativeActor{}, ErrUnavailable
-	}
-	ctx, cancel := context.WithTimeout(ctx, NativeProofFreshness)
-	defer cancel()
-	a := m.authority
-	fail := func(code Code) (NativeActor, Code) {
-		if c := m.invalidate(context.Background()); c != "" {
-			return NativeActor{}, ErrCleanupRequired
-		}
-		return NativeActor{}, code
-	}
-	if carriers.Cookie == "" {
-		return fail(ErrDenied)
-	}
-	persisted, c := m.store.Load(ctx)
-	if c = nativeObservationCode(ctx, c); c != "" {
-		return fail(c)
-	}
-	o, c := m.bridge.Observe(ctx, carriers)
-	if c = nativeObservationCode(ctx, c); c != "" {
-		return fail(c)
-	}
-	a.mu.Lock()
-	record := m.record
-	account := pilotOwnedAccount(o.Account)
-	valid := !a.fenced && record.Enabled && persisted == record && record.Epoch == a.policy.Epoch && record.ApprovalBinding == a.policy.ApprovalBinding && pilotAccountValid(o, a.now()) && o.SessionRef == record.SessionRef && o.BoundaryRef == record.BoundaryRef && pilotAccountSame(account, m.baseline)
-	if !valid {
-		a.mu.Unlock()
-		return fail(ErrSuspended)
-	}
-	account.Principal = Principal{Kind: "local", SubjectRef: record.SubjectRef, InstanceRef: record.Generation}
-	if o.CheckedAt.Before(account.CheckedAt) {
-		account.CheckedAt = o.CheckedAt
-	}
-	actor := NativeActor{managed: m, account: account, sessionRef: o.SessionRef, valid: true}
-	a.mu.Unlock()
-	return actor, ""
-}
-
-// Invalidate is sticky for the whole epoch. All grants are conservatively revoked
-// through S3 and drained through the existing S2 owner; failed R is never Q.
-func (m *managedPilot) invalidate(ctx context.Context) Code {
-	if m == nil || m.authority == nil {
-		return ErrUnavailable
-	}
-	a := m.authority
-	ctx, cancel := context.WithTimeout(ctx, MetadataTimeout)
-	defer cancel()
-	a.mu.Lock()
-	a.fenced = true
-	if a.gate != nil {
-		a.gate.fenceLocked("managed-account-uncertain")
-	}
-	clear(a.intents)
-	m.record.Enabled = false
-	disabled := safeGrantCode(m.store.Save(ctx, m.record))
-	keys := []GrantDrainKey{}
-	c := safeGrantCode(a.repository.Transact(func(p GrantPolicy, s *GrantStore) (bool, Code) {
-		if p.Inventory != a.policy.Inventory || p.Epoch != a.policy.Epoch || p.ApprovalBinding != a.policy.ApprovalBinding {
-			return false, ErrStale
-		}
-		// Compute every key before editing, so overflow cannot partially revoke.
-		for _, g := range s.Grants {
-			rev := g.Revision
-			if g.State != GrantRevoked {
-				if rev == math.MaxUint64 {
-					return false, ErrLimit
-				}
-				rev++
-			}
-			keys = append(keys, GrantDrainKey{p.Epoch, g.ID, rev})
-		}
-		changed := false
-		for i := range s.Grants {
-			g := &s.Grants[i]
-			if g.State == GrantRevoked {
-				continue
-			}
-			g.State = GrantRevoked
-			g.Reason = ErrRevoked
-			g.RevokedAt = max(g.CreatedAt, a.now().UnixMilli())
-			g.Revision++
-			changed = true
-		}
-		if changed {
-			if s.Revision == math.MaxUint64 {
-				return false, ErrLimit
-			}
-			s.Revision++
-		}
-		return changed, ""
-	}))
-	a.mu.Unlock()
-	complete := c == "" && disabled == ""
-	for _, key := range keys {
-		q, code := a.drain(ctx, key)
-		if code != "" {
-			complete = false
-			continue
-		}
-		if c == "" {
-			a.mu.Lock()
-			saved := safeGrantCode(a.repository.SaveQuiescence(q))
-			a.mu.Unlock()
-			if saved != "" {
-				complete = false
-			}
-		}
-	}
-	if !complete {
-		return ErrCleanupRequired
-	}
-	return ""
-}
-
-// Call BEFORE any account mutation in the managed maintenance workflow. Only a
-// successful result permits the separately authorized maintenance to proceed.
-// This does not mutate DSM accounts or establish native logout-all evidence.
-func (m *managedPilot) beginMaintenance(ctx context.Context) Code {
-	return m.invalidate(ctx)
-}
-
-// The origin is observable, but the private pointer is never serialized or
-// reconstructed. Managed generation is NOT a native account incarnation.
-func (a NativeActor) IdentityBasis() string {
-	if !a.valid {
-		return "unknown"
-	}
-	if a.managed != nil {
-		return "managed-enrollment"
-	}
-	if a.relaxed != nil {
-		return "uid-username"
-	}
-	return "native-incarnation"
-}

package/templates/native-go/backend/internal/helper/managed_pilot_repository_linux.go

@@ -1,74 +0,0 @@
-package helper
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"errors"
-	"golang.org/x/sys/unix"
-)
-
-// Reuses the exact root-owned S3 directory, lifetime owner, protected file
-// checks, policy/grant locks and atomic fsync+rename; never a new grant owner.
-type fileManagedPilotStore struct{ repository *FileGrantRepository }
-
-func validManagedPilotRecord(r managedPilotRecord, p GrantPolicy) bool {
-	if !r.Enabled {
-		return true
-	}
-	return p.Enabled && r.Epoch == p.Epoch && r.ApprovalBinding == p.ApprovalBinding && allReferences(r.SubjectRef, r.Generation, r.SessionRef, r.BoundaryRef) && nativeDisplayName(r.Username)
-}
-func (s fileManagedPilotStore) Load(ctx context.Context) (managedPilotRecord, Code) {
-	if s.repository == nil {
-		return managedPilotRecord{}, ErrUnavailable
-	}
-	var record managedPilotRecord
-	c := s.repository.withLocks(func() Code {
-		if c := nativeContextCode(ctx); c != "" {
-			return c
-		}
-		p, c := s.repository.readPolicy()
-		if c != "" {
-			return c
-		}
-		b, err := s.repository.read("managed-pilot.json", 0600, 4096)
-		if errors.Is(err, unix.ENOENT) {
-			return ""
-		}
-		if err != nil {
-			return ErrUnavailable
-		}
-		if c = decodeDataObject(bytes.NewReader(b), &record, 4096); c != "" {
-			return c
-		}
-		if !validManagedPilotRecord(record, p) {
-			return ErrFenced
-		}
-		return nativeContextCode(ctx)
-	})
-	return record, safeGrantCode(c)
-}
-func (s fileManagedPilotStore) Save(ctx context.Context, record managedPilotRecord) Code {
-	if s.repository == nil {
-		return ErrUnavailable
-	}
-	return s.repository.withLocks(func() Code {
-		if c := nativeContextCode(ctx); c != "" {
-			return c
-		}
-		p, c := s.repository.readPolicy()
-		if c != "" {
-			return c
-		}
-		if !validManagedPilotRecord(record, p) {
-			return ErrFenced
-		}
-		b, err := json.Marshal(record)
-		if err != nil || len(b) > 4096 {
-			return ErrInvalid
-		}
-		// Uncertainty cannot restore this process's sticky memory fence, and a new
-		// owner never loads enabled state. Grant R/Q is still attempted independently.
-		return s.repository.commit("managed-pilot.json", b)
-	})
-}

package/templates/native-go/backend/internal/helper/managed_pilot_repository_linux_test.go

@@ -1,40 +0,0 @@
-package helper
-
-import (
-	"context"
-	"os"
-	"testing"
-)
-
-func TestManagedPilotProtectedDurableStore(t *testing.T) {
-	dir, i, _ := rootGrantFixture(t)
-	r := openRootGrantRepository(t, dir, i)
-	p, _ := diskGrantSnapshot(t, r)
-	s := fileManagedPilotStore{r}
-	ctx := context.Background()
-	record := managedPilotRecord{Enabled: true, Epoch: p.Epoch, ApprovalBinding: p.ApprovalBinding, SubjectRef: grantRef('a'), Generation: grantRef('b'), SessionRef: grantRef('c'), Username: "normal3", BoundaryRef: grantRef('d')}
-	if c := s.Save(ctx, record); c != "" {
-		t.Fatal(c)
-	}
-	got, c := s.Load(ctx)
-	if c != "" || got != record {
-		t.Fatal(c, got)
-	}
-	st, err := os.Stat(dir + "/managed-pilot.json")
-	if err != nil || st.Mode().Perm() != 0600 {
-		t.Fatal(st, err)
-	}
-	record.Enabled = false
-	if c = s.Save(ctx, record); c != "" {
-		t.Fatal(c)
-	}
-	got, c = s.Load(ctx)
-	if c != "" || got.Enabled {
-		t.Fatal("disable not durable", c)
-	}
-	os.Remove(dir + "/managed-pilot.json")
-	os.Symlink("approval.json", dir+"/managed-pilot.json")
-	if _, c = s.Load(ctx); c == "" {
-		t.Fatal("followed pilot symlink")
-	}
-}

package/templates/native-go/backend/internal/helper/managed_pilot_test.go

@@ -1,210 +0,0 @@
-package helper
-
-import (
-	"context"
-	"strings"
-	"testing"
-	"time"
-)
-
-type pilotMemory struct {
-	record    managedPilotRecord
-	failure   Code
-	afterSave func(managedPilotRecord)
-}
-
-func (s *pilotMemory) Load(context.Context) (managedPilotRecord, Code) { return s.record, s.failure }
-func (s *pilotMemory) Save(_ context.Context, r managedPilotRecord) Code {
-	if s.failure != "" {
-		return s.failure
-	}
-	s.record = r
-	if s.afterSave != nil {
-		s.afterSave(r)
-	}
-	return ""
-}
-
-func TestManagedPilotExpiredDuringDurableApprovalRefuses(t *testing.T) {
-	p, a, _, s, _, c := pilotFixture(t)
-	now := p.now()
-	s.afterSave = func(r managedPilotRecord) {
-		if r.Enabled {
-			a.now = func() time.Time { return now.Add(3 * time.Second) }
-		}
-	}
-	if code := p.managed.enableAndApprove(context.Background(), SessionCarriers{Cookie: "admin"}, c, true); code == "" {
-		t.Fatal("approval outlived native proof")
-	}
-	if s.record.Enabled || !a.fenced {
-		t.Fatal("stale durable approval remained enabled")
-	}
-}
-
-type pilotNativeFake struct {
-	admin, user managedPilotObservation
-	failure     Code
-}
-
-func (f *pilotNativeFake) Observe(_ context.Context, c SessionCarriers) (managedPilotObservation, Code) {
-	if c.Cookie == "admin" {
-		return f.admin, f.failure
-	}
-	return f.user, f.failure
-}
-func pilotFixture(t *testing.T) (*NativeProvider, *GrantAuthority, *memoryGrantRepository, *pilotMemory, *pilotNativeFake, SessionCarriers) {
-	t.Helper()
-	a, r, _, _, acct, _, _, now := grantAuthorityFixture(t)
-	observation := managedPilotObservation{Account: acct.value, SessionRef: grantRef('c'), BoundaryRef: grantRef('d'), BoundaryProven: true, SessionsPurged: true, FreshLogin: true, CheckedAt: now}
-	observation.Account.Principal.InstanceRef = ""
-	f := &pilotNativeFake{admin: observation, user: observation}
-	f.user.Account.Admin = false
-	store := &pilotMemory{}
-	p := newManagedPilotProvider(f, store)
-	p.now = func() time.Time { return now }
-	// Each provider binds exactly one authority and never adopts another epoch.
-	a.native = p
-	if c := p.managed.bind(a); c != "" {
-		t.Fatal(c)
-	}
-	return p, a, r, store, f, SessionCarriers{Cookie: "user"}
-}
-func TestManagedPilotExplicitOptInAndSeparateIdentity(t *testing.T) {
-	p, _, _, store, _, c := pilotFixture(t)
-	if actor, code := p.Resolve(context.Background(), c); code == "" || actor.valid {
-		t.Fatal("default enabled")
-	}
-	// A new authority is required after a denial fenced the old owner.
-	p, _, _, store, _, c = pilotFixture(t)
-	if code := p.managed.enableAndApprove(context.Background(), SessionCarriers{Cookie: "admin"}, c, false); code != ErrDenied {
-		t.Fatal(code)
-	}
-	if code := p.managed.enableAndApprove(context.Background(), SessionCarriers{Cookie: "admin"}, c, true); code != "" {
-		t.Fatal(code)
-	}
-	actor, code := p.Resolve(context.Background(), c)
-	if code != "" || !actor.valid || actor.IdentityBasis() != "managed-enrollment" || !store.record.Enabled {
-		t.Fatal(code, actor.IdentityBasis())
-	}
-	strict, _, _, _, _ := nativeFixture()
-	if _, code = strict.Revalidate(context.Background(), c, actor); code != ErrSuspended {
-		t.Fatal("pilot crossed strict contract", code)
-	}
-	store.record.Generation = strings.Repeat("f", 64)
-	if _, code = p.Resolve(context.Background(), c); code == "" {
-		t.Fatal("restored/substituted record accepted")
-	}
-}
-func TestManagedPilotProofFailuresNeverEnable(t *testing.T) {
-	for _, change := range []func(*pilotNativeFake){
-		func(f *pilotNativeFake) { f.admin.Account.Admin = false },
-		func(f *pilotNativeFake) { f.user.BoundaryProven = false },
-		func(f *pilotNativeFake) { f.user.SessionsPurged = false },
-		func(f *pilotNativeFake) { f.user.FreshLogin = false },
-		func(f *pilotNativeFake) { f.user.Account.Groups = nil },
-		func(f *pilotNativeFake) { f.user.Account.Enabled = false },
-		func(f *pilotNativeFake) { f.user.Account.Principal.Kind = "ldap" },
-		func(f *pilotNativeFake) { f.user.CheckedAt = f.user.CheckedAt.Add(-3 * time.Second) },
-	} {
-		p, _, _, s, f, c := pilotFixture(t)
-		change(f)
-		if code := p.managed.enableAndApprove(context.Background(), SessionCarriers{Cookie: "admin"}, c, true); code == "" || s.record.Enabled {
-			t.Fatal("unproved opt-in")
-		}
-	}
-	p, _, _, s, _, c := pilotFixture(t)
-	s.failure = ErrCommitUncertain
-	if code := p.managed.enableAndApprove(context.Background(), SessionCarriers{Cookie: "admin"}, c, true); code == "" {
-		t.Fatal("uncertain enable accepted")
-	}
-}
-func TestManagedPilotUnknownRevokesAndDrainsThroughAuthority(t *testing.T) {
-	p, a, r, s, f, c := pilotFixture(t)
-	if code := p.managed.enableAndApprove(context.Background(), SessionCarriers{Cookie: "admin"}, c, true); code != "" {
-		t.Fatal(code)
-	}
-	actor, code := p.Resolve(context.Background(), c)
-	if code != "" {
-		t.Fatal(code)
-	}
-	gstore, code := DecodeGrantStore(bytesReader(dataFixture(t, "grant-store")))
-	if code != "" {
-		t.Fatal(code)
-	}
-	g := gstore.Grants[0]
-	g.Owner = actor.Principal()
-	g.Issuer = actor.Principal()
-	r.store.Grants = []Grant{g}
-	f.user.Account.UID++
-	if _, code = p.Resolve(context.Background(), c); code == "" {
-		t.Fatal("mutation accepted")
-	}
-	if !a.fenced || s.record.Enabled || r.store.Grants[0].State != GrantRevoked || !completeQuiescence(r.q) {
-		t.Fatal("missing R/Q fence", r.store, r.q)
-	}
-	if code = a.WithGrantAdmission(GrantAdmission{Actor: actor, GrantID: g.ID, Revision: g.Revision, Action: ActionRead, Binding: g.LastValidated, Continuous: true}, func(Grant, NativeActor) Code { t.Fatal("reserved after fence"); return "" }); code == "" {
-		t.Fatal(code)
-	}
-	if code = p.managed.enableAndApprove(context.Background(), SessionCarriers{Cookie: "admin"}, c, true); code == "" {
-		t.Fatal("fenced epoch re-enabled")
-	}
-}
-
-func TestManagedPilotCleanupFailureNeverClaimsQuiescence(t *testing.T) {
-	p, a, r, s, f, c := pilotFixture(t)
-	if code := p.managed.enableAndApprove(context.Background(), SessionCarriers{Cookie: "admin"}, c, true); code != "" {
-		t.Fatal(code)
-	}
-	actor, code := p.Resolve(context.Background(), c)
-	if code != "" {
-		t.Fatal(code)
-	}
-	store, code := DecodeGrantStore(bytesReader(dataFixture(t, "grant-store")))
-	if code != "" {
-		t.Fatal(code)
-	}
-	g := store.Grants[0]
-	g.Owner = actor.Principal()
-	g.Issuer = g.Owner
-	r.store.Grants = []Grant{g}
-	r.qFailure = ErrBusy
-	f.user.BoundaryProven = false
-	if _, code = p.Resolve(context.Background(), c); code != ErrCleanupRequired {
-		t.Fatal(code)
-	}
-	if !a.fenced || s.record.Enabled || r.store.Grants[0].State != GrantRevoked {
-		t.Fatal("failed cleanup restored authority")
-	}
-}
-
-func TestManagedPilotMaintenanceFencesSharedReservationOrder(t *testing.T) {
-	p, a, r, _, _, c := pilotFixture(t)
-	if code := p.managed.enableAndApprove(context.Background(), SessionCarriers{Cookie: "admin"}, c, true); code != "" {
-		t.Fatal(code)
-	}
-	actor, code := p.Resolve(context.Background(), c)
-	if code != "" {
-		t.Fatal(code)
-	}
-	store, code := DecodeGrantStore(bytesReader(dataFixture(t, "grant-store")))
-	if code != "" {
-		t.Fatal(code)
-	}
-	g := store.Grants[0]
-	g.Owner = actor.Principal()
-	g.Issuer = g.Owner
-	r.store.Grants = []Grant{g}
-	gate := newAdmission(Binding{Boot: "b", Install: "i"})
-	gate.observe(gate.binding, 1, true, a.now())
-	a.mu = &gate.mu
-	a.gate = gate
-	if code = p.managed.beginMaintenance(context.Background()); code != "" {
-		t.Fatal(code)
-	}
-	if gate.allow(a.now()) {
-		t.Fatal("lifecycle/relay gate remained open")
-	}
-	if code = a.WithGrantAdmission(GrantAdmission{Actor: actor, GrantID: g.ID, Revision: g.Revision, Action: ActionRead, Binding: g.LastValidated, Continuous: true}, func(Grant, NativeActor) Code { t.Fatal("reservation after maintenance"); return "" }); code == "" {
-		t.Fatal(code)
-	}
-}

package/templates/native-go/backend/internal/helper/management.go

@@ -1,86 +0,0 @@
-package helper
-
-import (
-	"bytes"
-	"encoding/json"
-	"errors"
-	"io"
-	"io/fs"
-	"os"
-	"path/filepath"
-	"syscall"
-)
-
-// A different build cannot acquire authority from this record. Management only
-// consumes the old owner's terminal publication; it never rewrites approval or
-// starts/signals a process. Private completion contents stay private to root.
-func (c Client) staleManagementStopped() bool {
-	r, err := readRecord(c.StateDir, c.Owner)
-	if err != nil || !r.Enabled {
-		return false
-	}
-	return c.managementStopped(r)
-}
-
-func (c Client) managementStopped(r Record) bool {
-	if !c.Expected.Valid() || r.Inventory.Package != c.Expected.Package || r.Schema != 2 || r.Residual || r.Lifecycle == nil || r.Lifecycle.Phase != "stopped" || r.Lifecycle.Completion == "" || r.Lifecycle.Lease == nil {
-		return false
-	}
-	if !c.canonicalApproval(r) || !c.completionPublished(r) {
-		return false
-	}
-	if err := protected(c.RunDir, c.Owner, true); err != nil && !errors.Is(err, fs.ErrNotExist) {
-		return false
-	}
-	// Bind the historical lifetime witness even for package-user hooks that
-	// cannot read mode-0600 files. The sealed terminal publication attests that
-	// this epoch has exited; it is not inferred from missing /run files alone.
-	lease, err := os.Lstat(leasePath(c, r.Lifecycle))
-	if err != nil {
-		return false
-	}
-	stat, ok := lease.Sys().(*syscall.Stat_t)
-	if !ok || !lease.Mode().IsRegular() || lease.Mode().Perm() != 0600 || lease.Size() != 64 || stat.Uid != c.Owner || stat.Nlink != 1 || uint64(stat.Dev) != r.Lifecycle.Lease.Device || stat.Ino != r.Lifecycle.Lease.Inode {
-		return false
-	}
-	proof, err := os.Lstat(filepath.Join(c.StateDir, "completion-"+r.Lifecycle.Epoch+".json"))
-	if err != nil {
-		return false
-	}
-	st, ok := proof.Sys().(*syscall.Stat_t)
-	if !ok || st.Nlink != 1 || proof.Size() == 0 || proof.Size() > 4096 {
-		return false
-	}
-	if uint32(os.Geteuid()) == c.Owner {
-		// The owner additionally verifies private bytes and kernel quiescence.
-		lock, err := acquireLifetime(c, r.Lifecycle)
-		if err != nil {
-			return false
-		}
-		defer lock.Close()
-	}
-	// Recheck the exact protected publication after inspecting proof and runtime.
-	return runtimeAbsent(c) && c.canonicalApproval(r)
-}
-
-func (c Client) canonicalApproval(r Record) bool {
-	f, err := os.OpenFile(filepath.Join(c.StateDir, "approval.json"), os.O_RDONLY|syscall.O_NOFOLLOW, 0)
-	if err != nil {
-		return false
-	}
-	defer f.Close()
-	st, err := f.Stat()
-	if err != nil {
-		return false
-	}
-	stat, ok := st.Sys().(*syscall.Stat_t)
-	if !ok || !st.Mode().IsRegular() || st.Mode().Perm() != 0644 || stat.Uid != c.Owner || stat.Nlink != 1 || st.Size() > 4096 {
-		return false
-	}
-	got, err := io.ReadAll(io.LimitReader(f, 4097))
-	if err != nil {
-		return false
-	}
-	want, err := json.Marshal(r)
-	return err == nil && bytes.Equal(got, want)
-}