@synopackageland/cli 0.5.3 → 0.6.1

package/templates/native-go/backend/internal/helper/sdk_grant_repository_linux.go

@@ -1,417 +0,0 @@
-//go:build linux && synopkgland_sdk_workers
-
-package helper
-
-import (
-	"bytes"
-	"crypto/sha256"
-	"encoding/hex"
-	"encoding/json"
-	"errors"
-	"io"
-	"os"
-	"path/filepath"
-	"strings"
-	"sync"
-
-	"golang.org/x/sys/unix"
-)
-
-// FileGrantRepository pins a protected local directory and one root supervisor
-// owner using a lifetime flock. It is Linux/root-only; no injected UID bypass.
-// Lock paths, files and all parents are opened no-follow and checked by FD.
-type FileGrantRepository struct {
-	mu                         sync.Mutex
-	journalKnown               map[string]string
-	journalReady               bool
-	dir, owner, policy, grants *os.File
-	expected                   Inventory
-	known                      string // exact last observed/committed snapshot; detects online replay
-	poisoned, closed           bool
-	fault                      func(string) error // tests only; nil in production
-}
-
-func OpenFileGrantRepository(stateDir string, expected Inventory) (*FileGrantRepository, Code) {
-	if os.Geteuid() != 0 {
-		return nil, ErrDenied
-	}
-	if !expected.Valid() || expected.Protocol != DataProtocol {
-		return nil, ErrIncompatible
-	}
-	dir, err := openGrantDirectory(stateDir)
-	if err != nil {
-		return nil, ErrUnavailable
-	}
-	r := &FileGrantRepository{dir: dir, expected: expected}
-	fail := func(c Code) (*FileGrantRepository, Code) { r.Close(); return nil, c }
-	r.owner, err = r.openLock("grants-owner.lock")
-	if err != nil {
-		return fail(ErrUnavailable)
-	}
-	if err = unix.Flock(int(r.owner.Fd()), unix.LOCK_EX|unix.LOCK_NB); err != nil {
-		return fail(ErrBusy)
-	}
-	r.policy, err = r.openLock("policy.lock")
-	if err != nil {
-		return fail(ErrUnavailable)
-	}
-	r.grants, err = r.openLock("grants.lock")
-	if err != nil {
-		return fail(ErrUnavailable)
-	}
-	if c := r.cleanGrantTemps(); c != "" {
-		return fail(c)
-	}
-	if err = r.dir.Sync(); err != nil {
-		return fail(ErrUnavailable)
-	}
-	return r, ""
-}
-func openGrantDirectory(path string) (*os.File, error) {
-	if !filepath.IsAbs(path) || path != filepath.Clean(path) {
-		return nil, errTrust
-	}
-	fd, err := unix.Open("/", unix.O_RDONLY|unix.O_DIRECTORY|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0)
-	if err != nil {
-		return nil, err
-	}
-	check := func(fd int) error {
-		var st unix.Stat_t
-		if err := unix.Fstat(fd, &st); err != nil {
-			return err
-		}
-		if st.Uid != 0 || st.Gid != 0 || st.Mode&unix.S_IFMT != unix.S_IFDIR || st.Mode&0022 != 0 {
-			return errTrust
-		}
-		return nil
-	}
-	if err = check(fd); err != nil {
-		unix.Close(fd)
-		return nil, err
-	}
-	for _, component := range strings.Split(strings.TrimPrefix(path, "/"), "/") {
-		if component == "" {
-			continue
-		}
-		next, e := unix.Openat(fd, component, unix.O_RDONLY|unix.O_DIRECTORY|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0)
-		unix.Close(fd)
-		if e != nil {
-			return nil, e
-		}
-		fd = next
-		if err = check(fd); err != nil {
-			unix.Close(fd)
-			return nil, err
-		}
-	}
-	f := os.NewFile(uintptr(fd), path)
-	if err = lifetimeFilesystem(f); err != nil {
-		f.Close()
-		return nil, err
-	}
-	return f, nil
-}
-func (r *FileGrantRepository) openLock(name string) (*os.File, error) {
-	fd, err := unix.Openat(int(r.dir.Fd()), name, unix.O_CREAT|unix.O_RDWR|unix.O_NOFOLLOW|unix.O_NONBLOCK|unix.O_CLOEXEC, 0600)
-	if err != nil {
-		return nil, err
-	}
-	f := os.NewFile(uintptr(fd), name)
-	if _, err = grantFileStat(f, 0600, 0); err != nil {
-		f.Close()
-		return nil, err
-	}
-	return f, nil
-}
-func grantFileStat(f *os.File, mode uint32, limit int64) (unix.Stat_t, error) {
-	var st unix.Stat_t
-	if err := unix.Fstat(int(f.Fd()), &st); err != nil {
-		return st, err
-	}
-	if st.Uid != 0 || st.Gid != 0 || st.Mode&unix.S_IFMT != unix.S_IFREG || st.Mode&07777 != mode || st.Nlink != 1 || st.Size < 0 || st.Size > limit {
-		return st, errTrust
-	}
-	return st, nil
-}
-func (r *FileGrantRepository) checkLock(f *os.File) error {
-	st, err := grantFileStat(f, 0600, 0)
-	if err != nil {
-		return err
-	}
-	var path unix.Stat_t
-	if err := unix.Fstatat(int(r.dir.Fd()), f.Name(), &path, unix.AT_SYMLINK_NOFOLLOW); err != nil {
-		return err
-	}
-	if path.Dev != st.Dev || path.Ino != st.Ino || path.Mode != st.Mode || path.Nlink != 1 {
-		return errTrust
-	}
-	return nil
-}
-func (r *FileGrantRepository) withLocks(fn func() Code) Code {
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	if r.closed || r.poisoned {
-		return ErrFenced
-	}
-	var st unix.Stat_t
-	if unix.Fstat(int(r.dir.Fd()), &st) != nil || st.Uid != 0 || st.Gid != 0 || st.Mode&0022 != 0 || st.Mode&unix.S_IFMT != unix.S_IFDIR {
-		r.poisoned = true
-		return ErrUnavailable
-	}
-	for _, f := range []*os.File{r.owner, r.policy, r.grants} {
-		if r.checkLock(f) != nil {
-			r.poisoned = true
-			return ErrUnavailable
-		}
-	}
-	if unix.Flock(int(r.policy.Fd()), unix.LOCK_EX|unix.LOCK_NB) != nil {
-		return ErrBusy
-	}
-	defer unix.Flock(int(r.policy.Fd()), unix.LOCK_UN)
-	if unix.Flock(int(r.grants.Fd()), unix.LOCK_EX|unix.LOCK_NB) != nil {
-		return ErrBusy
-	}
-	defer unix.Flock(int(r.grants.Fd()), unix.LOCK_UN)
-	return fn()
-}
-func (r *FileGrantRepository) read(name string, mode uint32, limit int64) ([]byte, error) {
-	fd, err := unix.Openat(int(r.dir.Fd()), name, unix.O_RDONLY|unix.O_NOFOLLOW|unix.O_NONBLOCK|unix.O_CLOEXEC, 0)
-	if err != nil {
-		return nil, err
-	}
-	f := os.NewFile(uintptr(fd), name)
-	defer f.Close()
-	if _, err := grantFileStat(f, mode, limit); err != nil {
-		return nil, err
-	}
-	b, err := io.ReadAll(io.LimitReader(f, limit+1))
-	if err != nil {
-		return nil, err
-	}
-	if int64(len(b)) > limit {
-		return nil, errTrust
-	}
-	return b, nil
-}
-func (r *FileGrantRepository) readPolicy() (GrantPolicy, Code) {
-	// Existing approval snapshots are root:root 0644; they have no credentials.
-	// Decode strict schema 2 independently from the grant schema 1 authority.
-	b, err := r.read("approval.json", 0644, 4096)
-	if err != nil {
-		return GrantPolicy{}, ErrUnavailable
-	}
-	var record Record
-	if c := decodeDataObject(bytes.NewReader(b), &record, 4096); c != "" {
-		return GrantPolicy{}, c
-	}
-	if record.Schema != 2 || record.Inventory != r.expected || record.Lifecycle == nil || !record.Lifecycle.valid() {
-		return GrantPolicy{}, ErrIncompatible
-	}
-	canonical, err := json.Marshal(record)
-	if err != nil {
-		return GrantPolicy{}, ErrInternal
-	}
-	sum := sha256.Sum256(canonical)
-	p := GrantPolicy{Inventory: record.Inventory, Epoch: record.Lifecycle.Epoch, ApprovalBinding: hex.EncodeToString(sum[:]), CapabilityDigest: record.Inventory.RegistryDigest, Enabled: record.Enabled && !record.Residual && record.Lifecycle.Phase == "running"}
-	return p, ""
-}
-func snapshotDigest(b []byte) string { sum := sha256.Sum256(b); return hex.EncodeToString(sum[:]) }
-func (r *FileGrantRepository) load() (GrantStore, Code) {
-	b, err := r.read("grants.json", 0600, MaxGrantStoreBytes)
-	if errors.Is(err, unix.ENOENT) && r.known == "" {
-		return GrantStore{Schema: GrantSchema, Revision: 1, Grants: []Grant{}}, ""
-	}
-	if err != nil {
-		r.poisoned = true
-		return GrantStore{}, ErrUnavailable
-	}
-	digest := snapshotDigest(b)
-	if r.known != "" && digest != r.known {
-		r.poisoned = true
-		return GrantStore{}, ErrStale
-	}
-	s, c := DecodeGrantStore(bytes.NewReader(b))
-	if c != "" {
-		r.poisoned = true
-		return GrantStore{}, c
-	}
-	r.known = digest
-	return s, ""
-}
-func (r *FileGrantRepository) Transact(fn func(GrantPolicy, *GrantStore) (bool, Code)) Code {
-	if fn == nil {
-		return ErrInvalid
-	}
-	return r.withLocks(func() Code {
-		p, c := r.readPolicy()
-		if c != "" {
-			r.poisoned = true
-			return c
-		}
-		s, c := r.load()
-		if c != "" {
-			return c
-		}
-		old := cloneAuthorityStore(s)
-		write, c := fn(p, &s)
-		if c = safeGrantCode(c); c != "" {
-			return c
-		}
-		if !write {
-			return ""
-		}
-		b, err := json.Marshal(s)
-		if err != nil {
-			return ErrInvalid
-		}
-		if _, c := DecodeGrantStore(bytes.NewReader(b)); c != "" {
-			return c
-		}
-		if c := validateGrantTransition(old, s, p); c != "" {
-			return c
-		}
-		c = r.commit("grants.json", b)
-		if c != "" {
-			r.poisoned = true
-			return c
-		}
-		r.known = snapshotDigest(b)
-		return ""
-	})
-}
-func (r *FileGrantRepository) atStage(stage string) error {
-	if r.fault != nil {
-		return r.fault(stage)
-	}
-	return nil
-}
-func (r *FileGrantRepository) commit(name string, b []byte) Code {
-	id, c := randomGrantID()
-	if c != "" {
-		return c
-	}
-	temp := ".grant-transition-" + id
-	fd, err := unix.Openat(int(r.dir.Fd()), temp, unix.O_CREAT|unix.O_EXCL|unix.O_WRONLY|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0600)
-	if err != nil {
-		return ErrUnavailable
-	}
-	f := os.NewFile(uintptr(fd), temp)
-	defer f.Close()
-	defer unix.Unlinkat(int(r.dir.Fd()), temp, 0)
-	if err = f.Chmod(0600); err != nil {
-		return ErrUnavailable
-	}
-	if err = r.atStage("write"); err != nil {
-		return ErrUnavailable
-	}
-	if n, err := f.Write(b); err != nil || n != len(b) {
-		return ErrUnavailable
-	}
-	if err = r.atStage("file-sync"); err != nil {
-		return ErrUnavailable
-	}
-	if err = f.Sync(); err != nil {
-		return ErrUnavailable
-	}
-	if err = f.Close(); err != nil {
-		return ErrUnavailable
-	}
-	if err = r.atStage("rename"); err != nil {
-		return ErrUnavailable
-	}
-	if err = unix.Renameat(int(r.dir.Fd()), temp, int(r.dir.Fd()), name); err != nil {
-		return ErrUnavailable
-	}
-	if err = r.atStage("after-rename"); err != nil {
-		return ErrCommitUncertain
-	}
-	if err = r.atStage("directory-sync"); err != nil {
-		return ErrCommitUncertain
-	}
-	if err = r.dir.Sync(); err != nil {
-		return ErrCommitUncertain
-	}
-	return ""
-}
-func (r *FileGrantRepository) SaveQuiescence(q GrantQuiescence) Code {
-	if !completeQuiescence(q) {
-		return ErrInvalid
-	}
-	return r.withLocks(func() Code {
-		p, c := r.readPolicy()
-		if c != "" {
-			r.poisoned = true
-			return c
-		}
-		if q.Key.Epoch != p.Epoch {
-			return ErrStale
-		}
-		s, c := r.load()
-		if c != "" {
-			return c
-		}
-		g := findGrant(&s, q.Key.GrantID)
-		if g == nil || g.State != GrantRevoked || g.Revision != q.Key.Revision {
-			return ErrStale
-		}
-		// One opaque-name proof per tombstone, <=256; never authority on restart.
-		b, err := json.Marshal(q)
-		if err != nil {
-			return ErrInternal
-		}
-		c = r.commit("grant-q-"+g.ID+".json", b)
-		if c != "" {
-			r.poisoned = true
-		}
-		return c
-	})
-}
-func (r *FileGrantRepository) Close() error {
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	if r.closed {
-		return nil
-	}
-	r.closed = true
-	var err error
-	for _, f := range []*os.File{r.grants, r.policy, r.owner, r.dir} {
-		if f != nil {
-			err = errors.Join(err, f.Close())
-		}
-	}
-	return err
-}
-
-// The owner lock excludes every other writer. Orphan temp names are never
-// authority. Only exact generated names and protected, singly linked root files
-// are removed. Bound enumeration and refuse unknown/untrusted residues.
-func (r *FileGrantRepository) cleanGrantTemps() Code {
-	fd, err := unix.Openat(int(r.dir.Fd()), ".", unix.O_RDONLY|unix.O_DIRECTORY|unix.O_CLOEXEC, 0)
-	if err != nil {
-		return ErrUnavailable
-	}
-	listing := os.NewFile(uintptr(fd), "state-listing")
-	defer listing.Close()
-	names, err := listing.Readdirnames(4097)
-	if err != nil && err != io.EOF {
-		return ErrUnavailable
-	}
-	if len(names) > 4096 {
-		return ErrLimit
-	}
-	for _, name := range names {
-		if !strings.HasPrefix(name, ".grant-transition-") {
-			continue
-		}
-		if !allReferences(strings.TrimPrefix(name, ".grant-transition-")) {
-			return ErrCleanupRequired
-		}
-		if _, err := r.read(name, 0600, MaxGrantStoreBytes); err != nil {
-			return ErrCleanupRequired
-		}
-		if err := unix.Unlinkat(int(r.dir.Fd()), name, 0); err != nil {
-			return ErrCleanupRequired
-		}
-	}
-	return ""
-}

package/templates/native-go/backend/internal/helper/sdk_grant_snapshot.go

@@ -1,94 +0,0 @@
-//go:build synopkgland_sdk_workers
-
-package helper
-
-import (
-	"math"
-	"reflect"
-	"slices"
-)
-
-// Pure snapshot invariants shared by the ordering owner and Linux persistence.
-func findGrant(s *GrantStore, id string) *Grant {
-	for n := range s.Grants {
-		if s.Grants[n].ID == id {
-			return &s.Grants[n]
-		}
-	}
-	return nil
-}
-func cloneAuthorityGrant(g Grant) Grant {
-	g.Actions = slices.Clone(g.Actions)
-	g.Scope.Segments = slices.Clone(g.Scope.Segments)
-	return g
-}
-
-func cloneAuthorityStore(s GrantStore) GrantStore {
-	s.Grants = slicesCloneGrants(s.Grants)
-	s.Background = cloneSDKBackgrounds(s.Background)
-	return s
-}
-func slicesCloneGrants(gs []Grant) []Grant {
-	out := make([]Grant, len(gs))
-	for i, g := range gs {
-		out[i] = cloneAuthorityGrant(g)
-	}
-	return out
-}
-
-// Root callback mistakes cannot drop tombstones, un-suspend, overwrite a grant's
-// scope/owner/actions, reuse IDs, or roll revisions back. Offline root disk
-// rollback remains outside the threat model; restart still suspends active.
-func validateGrantTransition(old, next GrantStore, p GrantPolicy) Code {
-	if old.Schema != next.Schema && (old.Schema != 1 || next.Schema != 2) {
-		return ErrIncompatible
-	}
-	if old.Schema == 1 && next.Schema == 2 {
-		for _, g := range next.Grants {
-			if g.State == GrantActive {
-				return ErrDenied
-			}
-		}
-	}
-	if c := validateSDKBackgroundTransition(old, next, p); c != "" {
-		return c
-	}
-	if reflect.DeepEqual(old, next) {
-		return ""
-	}
-	if old.Revision == math.MaxUint64 || next.Revision != old.Revision+1 {
-		return ErrStale
-	}
-	for _, before := range old.Grants {
-		after := findGrant(&next, before.ID)
-		if after == nil {
-			return ErrDenied
-		}
-		if reflect.DeepEqual(before, *after) {
-			continue
-		}
-		if before.State == GrantRevoked || before.Revision == math.MaxUint64 || after.Revision != before.Revision+1 {
-			return ErrDenied
-		}
-		if after.State != GrantRevoked && (before.State != GrantActive || after.State != GrantSuspended) {
-			return ErrDenied
-		}
-		normalized := cloneAuthorityGrant(*after)
-		normalized.Revision = before.Revision
-		normalized.State = before.State
-		normalized.Reason = before.Reason
-		normalized.RevokedAt = before.RevokedAt
-		if !reflect.DeepEqual(before, normalized) {
-			return ErrDenied
-		}
-	}
-	for _, g := range next.Grants {
-		if findGrant(&old, g.ID) == nil && (g.State != GrantActive || g.Revision != 1 || g.Inventory != p.Inventory || g.ApprovalBinding != p.ApprovalBinding || g.CapabilityDigest != p.CapabilityDigest || g.LastValidated.Epoch != p.Epoch || !p.Enabled) {
-			return ErrDenied
-		}
-	}
-	return ""
-}
-func completeQuiescence(q GrantQuiescence) bool {
-	return (q.Cohort == nil || (q.Cohort.Key == q.Key && q.Cohort.valid())) && allReferences(q.Key.Epoch, q.Key.GrantID) && q.Key.Revision > 0 && q.ChildrenReaped && q.RelayClosed && q.LeasesClosed && q.FDsClosed && q.EffectsRecorded
-}

package/templates/native-go/backend/internal/helper/sdk_history.go

@@ -1,80 +0,0 @@
-//go:build synopkgland_sdk_workers
-
-package helper
-
-import "dsmapp/internal/helper/jobcontract"
-
-func (v *sdkJobViews) retainedDisplays(delegations map[string]sdkDelegationDisplay) ([]sdkJobDisplay, Code) {
-	v.history = map[string]sdkJournalRecord{}
-	journal, ok := v.owner.services.Journal.(sdkRetainedJournal)
-	if !ok {
-		return nil, ""
-	}
-	records, code := journal.Records()
-	if code != "" {
-		return nil, code
-	}
-	out := []sdkJobDisplay{}
-	for _, record := range records {
-		id := record.Intent.Request.Control.Binding.Job.ID
-		if v.owner.jobs[id] != nil {
-			continue
-		}
-		if len(v.history)+len(v.owner.jobs) >= jobcontract.MaxExecutionKeys {
-			return nil, ErrLimit
-		}
-		if _, exists := v.history[id]; exists {
-			return nil, ErrInvalid
-		}
-		// Startup must reconcile every orphan before public admission/history.
-		if record.State != "finished" && record.State != "interrupted" {
-			return nil, ErrCleanupRequired
-		}
-		v.history[id] = record
-		item := sdkRetainedDisplay(id, record)
-		if d := record.Intent.Request.Control.Binding.Delegation; d != nil {
-			if value, exists := delegations[d.ID]; exists {
-				copy := value
-				item.Delegation = &copy
-			}
-		}
-		out = append(out, item)
-	}
-	return out, ""
-}
-func (v *sdkJobViews) owns(id string, a NativeActor) bool {
-	if j := v.owner.jobs[id]; j != nil {
-		return j.actor.Principal() == a.Principal()
-	}
-	if h, ok := v.history[id]; ok {
-		return sdkIdentity(h.Intent.Actor) == relaxedActorIdentity(a)
-	}
-	return false
-}
-func (v *sdkJobViews) intentID(id string) string {
-	if j := v.owner.jobs[id]; j != nil {
-		return j.request.Control.Intent.ID
-	}
-	if h, ok := v.history[id]; ok {
-		return h.Intent.Request.Control.Intent.ID
-	}
-	return ""
-}
-
-// sdkRetainedDisplay projects one retained journal record; callers add revision and delegation.
-func sdkRetainedDisplay(id string, record sdkJournalRecord) sdkJobDisplay {
-	item := sdkJobDisplay{JobID: id, Mode: record.Intent.Request.Control.Binding.Mode, State: jobcontract.Interrupted, SafeReason: jobcontract.Suspended, EffectsUnknown: true, KnownEffects: jobcontract.Result{ResultSchema: 1}, Progress: jobcontract.Progress{Phase: "starting"}}
-	if r := record.Receipt; r != nil {
-		item.State, item.SafeReason = r.Job.State, r.Job.Reason
-		item.Progress = r.Job.Progress
-		item.Progress.TotalUnits = sdkCopyTime(r.Job.Progress.TotalUnits)
-		item.AcceptedAt = r.Job.AcceptedAt
-		item.StartedAt = sdkCopyTime(r.Job.StartedAt)
-		item.FinishedAt = sdkCopyTime(r.Job.FinishedAt)
-		item.CancelRequested, item.Drained, item.EffectsUnknown = r.Job.CancelRequested, r.Job.Drained, r.Job.EffectsUnknown
-		if r.Result != nil {
-			item.KnownEffects = *r.Result
-		}
-	}
-	return item
-}

package/templates/native-go/backend/internal/helper/sdk_history_test.go

@@ -1,76 +0,0 @@
-//go:build synopkgland_sdk_workers
-
-package helper
-
-import (
-	"context"
-	"dsmapp/internal/helper/jobcontract"
-	"encoding/json"
-	"strings"
-	"testing"
-)
-
-func TestSDKRetainedHistoryIsReadOnlyOwnerScopedAndNeverResumed(t *testing.T) {
-	f := sdkJobFixture(t)
-	actor, c := f.s.authority.actor(context.Background(), f.carriers, nil)
-	if c != "" {
-		t.Fatal(c)
-	}
-	record := sdkJournalRecord{Schema: 1, State: "interrupted", Intent: sdkJobIntent{Request: f.r, Actor: sdkPrincipal(actor), SessionRef: actor.SessionRef()}}
-	record.Intent.Request.Control.Binding.Epoch = grantRef('f')
-	f.o.services.Journal = &sdkMemoryJournal{records: []sdkJournalRecord{record}}
-	v := newSDKJobViews(f.o)
-	page, c := v.ownerPage(context.Background(), f.carriers, "")
-	if c != "" || len(page.Items) != 1 || page.Items[0].State != jobcontract.Interrupted || page.Items[0].Drained || !page.Items[0].EffectsUnknown {
-		t.Fatal(page, c)
-	}
-	v.counts = map[uint32]int{}
-	if d, code := v.diagnose(context.Background(), f.carriers, false); code != "" || d.Total != 1 {
-		t.Fatal(d, code)
-	}
-	v.counts = map[uint32]int{}
-	b, _ := json.Marshal(page)
-	for _, secret := range []string{"fixture", actor.Username(), "sessionRef", "inputDigest"} {
-		if strings.Contains(string(b), secret) {
-			t.Fatal("retained leak", secret)
-		}
-	}
-	if len(f.o.jobs) != 0 || len(f.children) != 0 {
-		t.Fatal("history restored execution")
-	}
-	if _, c = v.result(context.Background(), f.carriers, f.r.Control.Binding.Job.ID); c != ErrDenied {
-		t.Fatal("history restored result authority", c)
-	}
-	v.counts = map[uint32]int{}
-	record.Intent.Actor.Username = "different-owner"
-	f.o.services.Journal = &sdkMemoryJournal{records: []sdkJournalRecord{record}}
-	page, c = v.ownerPage(context.Background(), f.carriers, "")
-	if c != "" || len(page.Items) != 0 {
-		t.Fatal("cross-owner history", page, c)
-	}
-}
-
-func TestSDKRetainedBackgroundRevocationDoesNotInventQ(t *testing.T) {
-	f := newSDKBackgroundFixture(t)
-	f.confirm(t, f.prepare(t, 0))
-	for i := range f.journal2.records {
-		f.journal2.records[i].State = "interrupted"
-	}
-	f.o.jobs = map[string]*sdkJob{}
-	v := newSDKJobViews(f.o)
-	page, c := v.ownerPage(context.Background(), f.carriers, "")
-	if c != "" || len(page.Items) != 1 {
-		t.Fatal(page, c)
-	}
-	d := page.Items[0].Delegation
-	if d == nil {
-		t.Fatal("missing retained delegation")
-	}
-	result, c := v.revoke(context.Background(), f.carriers, page.Items[0].JobID, page.Revision, d.Revision, d.StoreRevision)
-	if c != ErrCleanupRequired || !result.Revoked || result.Drained || len(f.o.jobs) != 0 {
-		t.Fatal(result, c)
-	}
-	if f.repo.store.Background[0].State != "revoked" {
-		t.Fatal("retained consent not revoked")
-	}
-}