@vela-science/canopus 0.6.5 → 0.8.0

package/dist/src/product/replay.js

@@ -2,11 +2,9 @@ import { mkdtemp, realpath, rm } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import { BudgetTracker } from "../budget/enforce.js";
-import { parseMission } from "../contracts/mission.js";
 import { validateMissionBundle } from "../mission/prepare.js";
-import { parseDiagnosticRunRecord } from "../projection/diagnostic.js";
-import { parseRunRecord } from "../projection/run.js";
-import { contentDigest } from "../util/canonical.js";
+import { parseRetainedMission } from "../projection/retained-mission.js";
+import { parseRetainedRunRecord } from "../projection/retained-run.js";
 import { readBoundedRegularFile } from "../util/files.js";
 import { runVerifier } from "../verifier/run.js";
 import { cleanupWorkspace, prepareWorkspace } from "../workspace/prepare.js";
@@ -17,16 +15,17 @@ export async function replayProduct(runFile, dockerBinary = "docker") {
     const schema = typeof raw === "object" && raw !== null && !Array.isArray(raw)
         ? raw.schema
         : undefined;
-    const record = schema === "canopus.diagnostic-run.v1"
-        ? parseDiagnosticRunRecord(raw)
-        : parseRunRecord(raw);
+    if (schema !== "canopus.run.v2") {
+        throw new Error("current Canopus replays only canopus.run.v2; use the exact historical release for older Run schemas");
+    }
+    const record = parseRetainedRunRecord(raw).record;
     const bundleRoot = await realpath(path.join(runRoot, "..", "mission"));
-    const mission = parseMission(JSON.parse((await readBoundedRegularFile(path.join(bundleRoot, "mission.json"), 8 * 1024 * 1024)).toString("utf8")));
-    if (mission.schema !== "canopus.mission.v1")
-        throw new Error("product replay requires Mission v1");
-    await validateMissionBundle(mission, bundleRoot);
-    if (contentDigest(mission) !== record.mission.digest)
+    const retainedMission = parseRetainedMission(JSON.parse((await readBoundedRegularFile(path.join(bundleRoot, "mission.json"), 8 * 1024 * 1024)).toString("utf8")));
+    const mission = retainedMission.mission;
+    await validateMissionBundle(mission, bundleRoot, retainedMission.exactRoot);
+    if (retainedMission.exactRoot !== record.mission.digest) {
         throw new Error("run and mission roots disagree");
+    }
     const artifacts = record.candidate.artifacts.map((artifact) => ({
         artifact,
         frozenPath: path.join(runRoot, "artifacts", artifact.digest.slice("sha256:".length)),

package/dist/src/product/run.d.ts

@@ -1,22 +1,19 @@
-import { type CanopusDiagnosticRunResult, type CanopusRunResult } from "../run.js";
+import { type CanopusCurrentRunResult } from "../run.js";
 import { type CommandRunner } from "../util/command.js";
 import { type ProductDoctorResult } from "./doctor.js";
 export interface ProductRunResult {
-    run: CanopusRunResult | CanopusDiagnosticRunResult;
+    run: CanopusCurrentRunResult;
     doctor: ProductDoctorResult;
     output_root: string;
     bundle_root: string;
     evidence_manifest: string;
     evidence_root: string;
-    source_publication: {
-        state: "committed_local";
-        commit: string;
-        tree: string;
-    } | {
-        state: "unchanged_no_land";
+    source_state: {
+        state: "unchanged";
         commit: string;
         tree: string;
     };
+    submission: null;
 }
 export declare function defaultProductOutput(frontier: string): string;
 export declare function assertToolUsingMissionPlatform(platform?: NodeJS.Platform): void;
@@ -26,6 +23,5 @@ export declare function runProduct(options: {
     requestedTarget?: string;
     outputRoot?: string;
     codexHome?: string;
-    noLand?: boolean;
     runner?: CommandRunner;
 }): Promise<ProductRunResult>;

package/dist/src/product/run.js

@@ -6,12 +6,12 @@ import { CodexToolsNativeEngine } from "../engines/codex-tools-native.js";
 import { prepareMission } from "../mission/prepare.js";
 import { runCanopus, } from "../run.js";
 import { canonicalJson, contentDigest, sha256Bytes } from "../util/canonical.js";
-import { isolatedEnvironment, runCommand } from "../util/command.js";
+import { runCommand } from "../util/command.js";
 import { readBoundedRegularFile } from "../util/files.js";
 import { VelaClient } from "../vela/cli.js";
 import { doctorProduct } from "./doctor.js";
+import { assertMissionNotCovered } from "./coverage.js";
 import { loadProfileDraft, loadProfileResultContract, packagedWorkerProfile, stageProfileCapsule, } from "./profile.js";
-import { retainWithdrawalCapability } from "../capability/withdrawal.js";
 function packageFile(relative) {
     return fileURLToPath(new URL(`../../../${relative}`, import.meta.url));
 }
@@ -39,58 +39,6 @@ async function assertFreshOutput(outputRoot, sourceRoot) {
     }
     await mkdir(output, { recursive: true, mode: 0o700 });
 }
-async function gitText(options) {
-    const result = await options.runner({
-        argv: ["git", ...options.argv],
-        cwd: options.cwd,
-        env: isolatedEnvironment(options.home),
-        timeoutMs: 120_000,
-        maxOutputBytes: 8 * 1024 * 1024,
-    });
-    if (result.exitCode !== 0 || result.stderr.length !== 0) {
-        throw new Error(`git ${options.argv.join(" ")} failed: stdout_sha256=${sha256Bytes(result.stdout)}; ` +
-            `stderr_sha256=${sha256Bytes(result.stderr)}`);
-    }
-    return result.stdout.toString("utf8").trim();
-}
-async function publishVerifiedLanding(options) {
-    const [head, status] = await Promise.all([
-        gitText({ argv: ["rev-parse", "--verify", "HEAD^{commit}"], cwd: options.source, home: options.home, runner: options.runner }),
-        gitText({ argv: ["status", "--porcelain=v1", "--untracked-files=all"], cwd: options.source, home: options.home, runner: options.runner }),
-    ]);
-    if (head !== options.expectedStart || status !== "") {
-        throw new Error("source frontier changed while the bounded run was executing");
-    }
-    const landingHead = await gitText({
-        argv: ["rev-parse", "--verify", "canopus-landing^{commit}"],
-        cwd: options.landing,
-        home: options.home,
-        runner: options.runner,
-    });
-    if (landingHead !== options.expectedFinal)
-        throw new Error("landing clone final commit drifted");
-    await gitText({
-        argv: ["fetch", "--quiet", "--no-tags", options.landing, "canopus-landing"],
-        cwd: options.source,
-        home: options.home,
-        runner: options.runner,
-    });
-    await gitText({
-        argv: ["merge", "--ff-only", "--no-edit", "FETCH_HEAD"],
-        cwd: options.source,
-        home: options.home,
-        runner: options.runner,
-    });
-    const [commit, tree, finalStatus] = await Promise.all([
-        gitText({ argv: ["rev-parse", "--verify", "HEAD^{commit}"], cwd: options.source, home: options.home, runner: options.runner }),
-        gitText({ argv: ["rev-parse", "--verify", "HEAD^{tree}"], cwd: options.source, home: options.home, runner: options.runner }),
-        gitText({ argv: ["status", "--porcelain=v1", "--untracked-files=all"], cwd: options.source, home: options.home, runner: options.runner }),
-    ]);
-    if (commit !== options.expectedFinal || tree !== options.expectedTree || finalStatus !== "") {
-        throw new Error("source publication did not reproduce the verified landing roots");
-    }
-    return { state: "committed_local", commit, tree };
-}
 async function writeEvidenceManifest(run, missionDigest) {
     const root = run.paths.root;
     const files = {
@@ -115,10 +63,8 @@ async function writeEvidenceManifest(run, missionDigest) {
         files: digests,
         artifact_roots: run.record.candidate.artifacts.map((artifact) => artifact.digest).sort(),
         verifier_root: contentDigest(run.record.verifier),
-        receipt_root: run.record.landing?.receipt_root ?? null,
-        final_roots: "final_roots" in run.record
-            ? run.record.final_roots
-            : run.record.mission.starting_roots,
+        submission_root: null,
+        final_roots: run.record.mission.starting_roots,
     };
     const file = path.join(root, "evidence-manifest.json");
     await writeFile(file, canonicalJson(manifest), { flag: "wx", mode: 0o600 });
@@ -143,9 +89,6 @@ export async function runProduct(options) {
     const runner = options.runner ?? runCommand;
     const source = await realpath(options.frontier);
     const outputRoot = path.resolve(options.outputRoot ?? defaultProductOutput(source));
-    await assertFreshOutput(outputRoot, source);
-    const controlHome = path.join(outputRoot, "control-home");
-    await mkdir(controlHome, { mode: 0o700 });
     try {
         const diagnosis = await doctorProduct({
             frontier: source,
@@ -158,6 +101,9 @@ export async function runProduct(options) {
         if (!diagnosis.public.worker.mission_ready || codexRuntime === null || dockerRuntime === null) {
             throw new Error(diagnosis.public.next_action);
         }
+        const draft = await loadProfileDraft(diagnosis.profile);
+        await assertMissionNotCovered({ draft, frontier: source });
+        await assertFreshOutput(outputRoot, source);
         const staging = path.join(outputRoot, ".profile-staging");
         await mkdir(staging, { mode: 0o700 });
         await stageProfileCapsule({
@@ -165,7 +111,6 @@ export async function runProduct(options) {
             stagingRoot: staging,
         });
         const bundleRoot = path.join(outputRoot, "mission");
-        const draft = await loadProfileDraft(diagnosis.profile);
         const resultContract = await loadProfileResultContract(diagnosis.profile);
         const prepared = await prepareMission({
             draft: options.requestedTarget === undefined
@@ -202,6 +147,9 @@ export async function runProduct(options) {
             expectedVersion: prepared.mission.vela_version,
             expectedSha256: prepared.mission.vela_sha256,
             home: path.join(runRoot, "vela-home"),
+            ...(process.env.SSH_AUTH_SOCK === undefined
+                ? {}
+                : { repositoryAuthorityAgentSocket: process.env.SSH_AUTH_SOCK }),
             runner,
         });
         const engine = new CodexToolsNativeEngine({
@@ -220,33 +168,9 @@ export async function runProduct(options) {
             bundleRoot,
             dockerBinary: dockerRuntime.binary,
             verifierRunner: runner,
-            retainWithdrawalCapability: async (context) => {
-                await retainWithdrawalCapability({
-                    ...context,
-                    velaBinary: diagnosis.public.runtimes.vela.binary,
-                });
-            },
         };
-        const run = options.noLand === true
-            ? await runCanopus({ ...commonRun, noLand: true })
-            : await runCanopus(commonRun);
+        const run = await runCanopus(commonRun);
         const evidence = await writeEvidenceManifest(run, contentDigest(prepared.mission));
-        const publication = options.noLand === true
-            ? {
-                state: "unchanged_no_land",
-                commit: prepared.mission.roots.git_commit,
-                tree: prepared.mission.roots.git_tree,
-            }
-            : await publishVerifiedLanding({
-                source,
-                landing: run.paths.landing,
-                expectedStart: prepared.mission.roots.git_commit,
-                expectedFinal: run.record.final_roots.git_commit,
-                expectedTree: run.record.final_roots.git_tree,
-                home: controlHome,
-                runner,
-            });
-        await rm(controlHome, { recursive: true, force: true });
         return {
             run,
             doctor: diagnosis.public,
@@ -254,7 +178,12 @@ export async function runProduct(options) {
             bundle_root: bundleRoot,
             evidence_manifest: evidence.file,
             evidence_root: evidence.root,
-            source_publication: publication,
+            source_state: {
+                state: "unchanged",
+                commit: prepared.mission.roots.git_commit,
+                tree: prepared.mission.roots.git_tree,
+            },
+            submission: null,
         };
     }
     catch (error) {

package/dist/src/product/submission.d.ts

@@ -0,0 +1,40 @@
+export { verifySubmission, type IdentityBinding, type SubmissionV1, } from "@vela-science/protocol";
+import { projectCurrentRun } from "../projection/current-run.js";
+export interface SubmissionBundleManifest {
+    schema: "canopus.submission-bundle.v1";
+    run_id: string;
+    run_root: string;
+    source: {
+        git_commit: string;
+        git_tree: string;
+        vela_version: string;
+        vela_sha256: string;
+    };
+    producer: string;
+    submission_id: string;
+    submission_root: string;
+    identity_binding_id: string;
+    artifacts: Array<{
+        source: string;
+        frontier_path: string;
+        digest: string;
+        bytes: number;
+    }>;
+}
+export declare function exportSubmission(options: {
+    runFile: string;
+    outputRoot: string;
+    actor?: string;
+    correctedClaim?: string;
+    scopeLimit?: string;
+    now?: Date;
+}): Promise<{
+    schema: "canopus.export-result.v1";
+    ok: true;
+    run_id: string;
+    submission_id: string;
+    submission_root: string;
+    bundle: string;
+    manifest: string;
+}>;
+export declare function projectExportableRun(value: unknown): ReturnType<typeof projectCurrentRun>;

package/dist/src/product/submission.js

@@ -0,0 +1,217 @@
+import { generateKeyPairSync, sign, } from "node:crypto";
+import { constants } from "node:fs";
+import { chmod, copyFile, lstat, mkdir, realpath, rm, writeFile, } from "node:fs/promises";
+import path from "node:path";
+import { identityBindingPreimage, submissionPreimage, verifySubmission, } from "@vela-science/protocol";
+export { verifySubmission, } from "@vela-science/protocol";
+import { finalizeWorkerCaveat } from "../candidate/finalize.js";
+import { parseCurrentRunRecord, projectCurrentRun } from "../projection/current-run.js";
+import { parseRetainedMission } from "../projection/retained-mission.js";
+import { parseRetainedRunRecord } from "../projection/retained-run.js";
+import { canonicalJcs, canonicalJson, protocolDigest, sha256Bytes } from "../util/canonical.js";
+import { readBoundedRegularFile } from "../util/files.js";
+const ED25519_SPKI_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
+const STALE_VERIFIER_LANGUAGE = /verif(?:y|ication|ier).*(?:pending|has not run|not (?:been )?(?:performed|executed|run))|pending.*verif(?:y|ication|ier)/iu;
+const CONTROL_CHARACTER = /[\u0000-\u001f\u007f]/u;
+const CORRECTION_NOTICE = "The Submission wording corrects a stale post-run Claim after verifier passage; the immutable Run remains unchanged.";
+function rawPublicKey(publicKey) {
+    const der = publicKey.export({ type: "spki", format: "der" });
+    if (!Buffer.isBuffer(der) || der.length !== ED25519_SPKI_PREFIX.length + 32) {
+        throw new Error("generated Ed25519 public key has an unexpected encoding");
+    }
+    if (!der.subarray(0, ED25519_SPKI_PREFIX.length).equals(ED25519_SPKI_PREFIX)) {
+        throw new Error("generated public key is not Ed25519");
+    }
+    return der.subarray(ED25519_SPKI_PREFIX.length);
+}
+async function assertFreshDirectory(directory) {
+    try {
+        await lstat(directory);
+        throw new Error(`output already exists: ${directory}`);
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+}
+function missionFileFor(runFile) {
+    const runRoot = path.dirname(runFile);
+    return path.join(runRoot, "..", "mission", "mission.json");
+}
+export async function exportSubmission(options) {
+    const runFile = await realpath(options.runFile);
+    const runRoot = path.dirname(runFile);
+    const retainedRun = parseRetainedRunRecord(JSON.parse((await readBoundedRegularFile(runFile, 8 * 1024 * 1024)).toString("utf8")));
+    const retainedMission = parseRetainedMission(JSON.parse((await readBoundedRegularFile(missionFileFor(runFile), 8 * 1024 * 1024)).toString("utf8")));
+    const record = retainedRun.record;
+    const mission = retainedMission.mission;
+    if (record.mission.digest !== retainedMission.exactRoot) {
+        throw new Error("run and mission roots disagree");
+    }
+    if (retainedRun.exactStartingRoots !== retainedMission.exactRoots) {
+        throw new Error("run and mission exact starting roots disagree");
+    }
+    if (record.candidate.status !== "success" || record.verifier.status !== "passed") {
+        throw new Error("only a successful, verifier-passing Run can export a Submission");
+    }
+    if (record.candidate.artifacts.length === 0 || record.candidate.caveats.length === 0) {
+        throw new Error("Submission export requires at least one Artifact and one caveat");
+    }
+    if ((options.correctedClaim === undefined) !== (options.scopeLimit === undefined)) {
+        throw new Error("Submission correction requires both a corrected Claim and a scope limit");
+    }
+    const retainedClaimNeedsCorrection = STALE_VERIFIER_LANGUAGE.test(record.candidate.claim) ||
+        CONTROL_CHARACTER.test(record.candidate.claim);
+    if (retainedClaimNeedsCorrection && options.correctedClaim === undefined) {
+        throw new Error("Run Claim is stale after verifier passage or contains control bytes; export requires --claim and --scope-limit to author one corrected bounded Submission without changing the Run");
+    }
+    if (!retainedClaimNeedsCorrection && options.correctedClaim !== undefined) {
+        throw new Error("Submission correction is allowed only for a retained Run Claim that is stale or contains control bytes");
+    }
+    const assertion = options.correctedClaim ?? record.candidate.claim;
+    if (CONTROL_CHARACTER.test(assertion)) {
+        throw new Error("Submission Claim contains a control character");
+    }
+    if (STALE_VERIFIER_LANGUAGE.test(assertion)) {
+        throw new Error("Submission Claim contradicts the retained passing verifier outcome");
+    }
+    if (options.scopeLimit !== undefined && CONTROL_CHARACTER.test(options.scopeLimit)) {
+        throw new Error("Submission scope limit contains a control character");
+    }
+    const caveats = [...new Set([
+            ...record.candidate.caveats.map(finalizeWorkerCaveat),
+            ...(options.scopeLimit === undefined ? [] : [options.scopeLimit, CORRECTION_NOTICE]),
+        ])];
+    const actor = options.actor ?? mission.actor;
+    if (!actor.startsWith("agent:")) {
+        throw new Error("Canopus Submission export requires an agent: producer");
+    }
+    const outputRoot = path.resolve(options.outputRoot);
+    await assertFreshDirectory(outputRoot);
+    try {
+        const emittedAt = (options.now ?? new Date()).toISOString();
+        const keys = generateKeyPairSync("ed25519");
+        const publicKey = rawPublicKey(keys.publicKey);
+        let binding = {
+            schema: "vela.identity_binding.v0.1",
+            binding_id: "",
+            actor_id: actor,
+            actor_class: "agent",
+            public_key_hex: publicKey.toString("hex"),
+            created_at: emittedAt,
+            signature: "",
+        };
+        const bindingBytes = identityBindingPreimage(binding);
+        binding = {
+            ...binding,
+            binding_id: `vib_${sha256Bytes(bindingBytes).slice(7, 23)}`,
+            signature: sign(null, Buffer.from(bindingBytes), keys.privateKey).toString("hex"),
+        };
+        const artifactDirectory = path.join(outputRoot, "artifacts", "sha256");
+        await mkdir(artifactDirectory, { recursive: true, mode: 0o700 });
+        const manifestArtifacts = [];
+        const submissionArtifacts = [];
+        for (const artifact of record.candidate.artifacts) {
+            const hex = artifact.digest.slice("sha256:".length);
+            const source = path.join(runRoot, "artifacts", hex);
+            const observed = sha256Bytes(await readBoundedRegularFile(source, artifact.bytes + 1));
+            if (observed !== artifact.digest) {
+                throw new Error(`frozen Artifact ${artifact.digest} no longer matches the Run`);
+            }
+            const target = path.join(artifactDirectory, hex);
+            await copyFile(source, target, constants.COPYFILE_EXCL);
+            await chmod(target, 0o444);
+            const frontierPath = `records/artifacts/sha256/${hex}`;
+            manifestArtifacts.push({
+                source: `artifacts/sha256/${hex}`,
+                frontier_path: frontierPath,
+                digest: artifact.digest,
+                bytes: artifact.bytes,
+            });
+            submissionArtifacts.push({
+                kind: artifact.kind,
+                path: frontierPath,
+                digest: artifact.digest,
+            });
+        }
+        let submission = {
+            schema: "vela.submission.v1",
+            submission_id: "",
+            claim: {
+                assertion,
+                type: mission.claim_type,
+                conditions: [mission.completion_condition],
+            },
+            artifacts: submissionArtifacts,
+            caveats,
+            replayability: mission.replayability,
+            producer_checks: [],
+            verification_requirements: [
+                `Replay Canopus Run ${record.run_id} with verifier capsule ${mission.verifier.capsule_sha256}.`,
+            ],
+            requested_change: { kind: "add_claim" },
+            provenance: {
+                producer: actor,
+                source_system: "canopus",
+                source_run: record.run_id,
+                emitted_at: emittedAt,
+            },
+            ...(mission.execution_binding === undefined
+                ? {}
+                : { execution_binding: mission.execution_binding }),
+            authentication: {
+                algorithm: "ed25519",
+                identity_binding: binding,
+                signature: "",
+            },
+        };
+        const submissionBytes = submissionPreimage(submission);
+        submission = {
+            ...submission,
+            submission_id: `vsb_${sha256Bytes(submissionBytes).slice(7, 23)}`,
+            authentication: {
+                ...submission.authentication,
+                signature: sign(null, Buffer.from(submissionBytes), keys.privateKey).toString("hex"),
+            },
+        };
+        verifySubmission(submission);
+        const submissionRoot = protocolDigest(submission);
+        const submissionFile = path.join(outputRoot, "submission.json");
+        await writeFile(submissionFile, `${canonicalJcs(submission)}\n`, { flag: "wx", mode: 0o444 });
+        const manifest = {
+            schema: "canopus.submission-bundle.v1",
+            run_id: record.run_id,
+            run_root: retainedRun.exactRoot,
+            source: {
+                git_commit: mission.roots.git_commit,
+                git_tree: mission.roots.git_tree,
+                vela_version: mission.vela_version,
+                vela_sha256: mission.vela_sha256,
+            },
+            producer: actor,
+            submission_id: submission.submission_id,
+            submission_root: submissionRoot,
+            identity_binding_id: binding.binding_id,
+            artifacts: manifestArtifacts,
+        };
+        const manifestFile = path.join(outputRoot, "manifest.json");
+        await writeFile(manifestFile, canonicalJson(manifest), { flag: "wx", mode: 0o444 });
+        return {
+            schema: "canopus.export-result.v1",
+            ok: true,
+            run_id: record.run_id,
+            submission_id: submission.submission_id,
+            submission_root: submissionRoot,
+            bundle: outputRoot,
+            manifest: manifestFile,
+        };
+    }
+    catch (error) {
+        await rm(outputRoot, { recursive: true, force: true });
+        throw error;
+    }
+}
+export function projectExportableRun(value) {
+    return projectCurrentRun(parseCurrentRunRecord(value));
+}

package/dist/src/product/submit.d.ts

@@ -0,0 +1,22 @@
+import { type CommandRunner } from "../util/command.js";
+export declare function submitBundle(options: {
+    bundle: string;
+    frontier: string;
+    velaBinary?: string;
+    runner?: CommandRunner;
+}): Promise<{
+    schema: "canopus.submit-result.v1";
+    ok: true;
+    submission_id: string;
+    submission_root: string;
+    registration_record_id: string;
+    registration_record_root: string;
+    proposal_id: string;
+    claim_id: string;
+    route: "pending_review";
+    accepted_event_delta: 0;
+    source_commit_before: string;
+    source_commit_after: string;
+    registration_binary_version: string;
+    registration_binary_sha256: string;
+}>;