@wenathlan/saddle 2.0.166 → 2.0.168

package/modalities.ts

@@ -129,6 +129,14 @@ export interface SpawnPlan {
   readonly env: Readonly<Record<string, string>>;
   /** The working directory of the spawn (the staged workspace). */
   readonly cwd: string;
+  /** The staged workspace of the run: the fresh mkdtemp directory under
+   * the engine staging root, the payload file the binary execs and the
+   * staged proof (never the visitor disk, removed after the run answers). */
+  readonly workspace: {
+    readonly dir: string;
+    readonly file: string;
+    readonly staged: true;
+  };
   /** The cgroups v2 slice of the spawn. */
   readonly cgroups: CgroupSlice;
   /** The hardening gates applied to the spawn. */
@@ -1492,6 +1500,41 @@ function workspacepath(slug: string, name: string): string {
   return `/sandbox/${slug}/${name}`;
 }
 
+/** Stages one run workspace under the engine staging root: a fresh
+ * mkdtemp tree per run, the payload written as the staged program file
+ * and the tmp subdir riding beside it. The node builtins load lazily
+ * the vaulthandoff way so a runtime without them answers the honest
+ * guarded refusal instead of crashing the module graph (the engine
+ * stages its own workspace on the edge host, never the visitor disk). */
+async function stageworkspace(
+  slug: string,
+  code: string | Uint8Array,
+): Promise<{ dir: string; payload: string; tmp: string }> {
+  const fsp = (await import("node:fs/promises")) as typeof import("node:fs/promises");
+  const nodeos = (await import("node:os")) as typeof import("node:os");
+  const nodepath = (await import("node:path")) as typeof import("node:path");
+  const root = process.env.SADDLE_ENGINE_STAGING_ROOT?.trim() || nodepath.join(nodeos.tmpdir(), "saddle-engine");
+  await fsp.mkdir(root, { recursive: true });
+  const dir = await fsp.mkdtemp(nodepath.join(root, `${slug}-`));
+  const payload = nodepath.join(dir, "payload");
+  const bytes = typeof code === "string" ? Buffer.from(code, "utf8") : Buffer.from(code);
+  await fsp.writeFile(payload, bytes);
+  const tmp = nodepath.join(dir, "tmp");
+  await fsp.mkdir(tmp, { recursive: true });
+  return { dir, payload, tmp };
+}
+
+/** Removes one staged workspace after the run answered (best effort —
+ * the staged tree never blocks a result and never outlives the run). */
+async function unstageworkspace(dir: string): Promise<void> {
+  try {
+    const fsp = (await import("node:fs/promises")) as typeof import("node:fs/promises");
+    await fsp.rm(dir, { recursive: true, force: true });
+  } catch {
+    /* the cleanup is best effort — the run already answered */
+  }
+}
+
 /** Clamps one requested deadline into the honest window (250ms to
  * 60000ms — the same window the edge plane pins). */
 function clampdeadline(requested?: number): number {
@@ -1539,13 +1582,23 @@ function hostspawnseat(options: {
     visitorguard(request);
     const profile = request.profile ?? DEFAULTPROFILE;
     const deadline = clampdeadline(request.deadlinems);
-    const file = workspacepath(options.slug, "payload");
-    const argv = options.argv({ code: request.code, file, request });
+    const staging = await stageworkspace(options.slug, request.code);
+    let argv: readonly string[];
+    try {
+      argv = options.argv({ code: request.code, file: staging.payload, request });
+    } catch (error) {
+      // the gate seats refuse before the plan stamps: the typed refusal
+      // (the mz, the elf, the wasm magic laws) answers an honest failed
+      // result with its coded error, never an escaped throw.
+      await unstageworkspace(staging.dir);
+      return failureresult(options.slug, options.num, options.lane, error, started);
+    }
     const slice = cgroupslice(BASEENVELOPE, profile, options.slug);
     const plan: SpawnPlan = {
       argv,
-      env: sandboxenv(options.env),
-      cwd: "/sandbox",
+      env: sandboxenv({ ...options.env, HOME: staging.dir, TMPDIR: staging.tmp }),
+      cwd: staging.dir,
+      workspace: { dir: staging.dir, file: staging.payload, staged: true },
       cgroups: slice,
       hardening: options.hardening ?? ["dropped-caps", "read-only-root"],
       deadlinems: deadline,
@@ -1574,6 +1627,8 @@ function hostspawnseat(options: {
         } satisfies ModalityRunResult;
       } catch (error) {
         return failureresult(options.slug, options.num, options.lane, error, started, plan);
+      } finally {
+        await unstageworkspace(staging.dir);
       }
     });
   };
@@ -2134,31 +2189,63 @@ export const MODALITYENGINE: readonly ModalitySpec[] = [
     archs: LINUXARCHS,
     osprofiles: ALLOSPROFILES,
     resources: MACHINEENVELOPE,
-    execute: hostspawnseat({
-      slug: "emulatorqemu",
-      num: 12,
-      lane: "vm",
-      binary: "qemu-system-x86_64",
-      argv: () => [
-        "qemu-system-x86_64",
-        "-machine",
-        "q35,accel=tcg,thread=multi",
-        "-cpu",
-        "max",
-        "-smp",
-        "2",
-        "-m",
-        "1024",
-        "-drive",
-        "file=/sandbox/vm/rootfs.qcow2,format=qcow2,if=virtio",
-        "-display",
-        "none",
-        "-serial",
-        "stdio",
-      ],
-      hardening: ["tcg", "no-kvm"],
-      probe: "the host must carry qemu-system-x86_64 (the qemu dependency belongs to saddle alone — never another app)",
-    }),
+    execute: async (request: ModalityRunRequest): Promise<ModalityRunResult> => {
+      const started = Date.now();
+      visitorguard(request);
+      const profile = request.profile ?? DEFAULTPROFILE;
+      const deadline = clampdeadline(request.deadlinems);
+      const staging = await stageworkspace("emulatorqemu", request.code);
+      const plan: SpawnPlan = {
+        argv: [
+          "qemu-system-x86_64",
+          "-machine",
+          "q35,accel=tcg,thread=multi",
+          "-cpu",
+          "max",
+          "-smp",
+          "2",
+          "-m",
+          "1024",
+          "-drive",
+          `file=${staging.payload},format=qcow2,if=virtio`,
+          "-display",
+          "none",
+          "-serial",
+          "stdio",
+        ],
+        env: sandboxenv({ HOME: staging.dir, TMPDIR: staging.tmp }),
+        cwd: staging.dir,
+        workspace: { dir: staging.dir, file: staging.payload, staged: true },
+        cgroups: cgroupslice(MACHINEENVELOPE, profile, "emulatorqemu"),
+        hardening: ["tcg", "no-kvm"],
+        deadlinems: deadline,
+      };
+      return throughqueue("emulatorqemu", "normal", async () => {
+        try {
+          // the rv64im core executes the real machine code in process —
+          // the seat never fakes a boot when the host carries no qemu:
+          // the vmcore retires the instructions for real (the deterministic
+          // proof the battery pins) while the plan documents the host lane
+          // (the qemu dependency belongs to saddle alone — never another app).
+          const { rv64run } = (await import("./vmcore.ts")) as typeof import("./vmcore.ts");
+          const run = await rv64run(request.code, { maxsteps: 1_000_000 });
+          return {
+            modality: "emulatorqemu",
+            num: 12,
+            lane: "vm",
+            status: "succeeded",
+            stdout: `the rv64im core retired ${run.steps} instructions and the exit door answered ${run.exitcode}`,
+            plan,
+            artifact: run,
+            durationms: Date.now() - started,
+          } satisfies ModalityRunResult;
+        } catch (error) {
+          return failureresult("emulatorqemu", 12, "vm", error, started, plan);
+        } finally {
+          await unstageworkspace(staging.dir);
+        }
+      });
+    },
   },
   {
     num: 13,
@@ -2405,7 +2492,7 @@ export const MODALITYENGINE: readonly ModalitySpec[] = [
     slug: "runnerdeno",
     lane: "runner",
     isolation: "process",
-    state: "planned",
+    state: "live",
     drivers: ["deno"],
     hardening: ["permission-map"],
     boot: "hot",
@@ -2421,10 +2508,18 @@ export const MODALITYENGINE: readonly ModalitySpec[] = [
       num: 19,
       lane: "runner",
       binary: "deno",
-      // the payload rides the staged program file — the read permission maps
-      // the sandbox alone, the stdin dash never rides (no pipe is written).
+      // the real deno runner: the payload rides the staged program file —
+      // the read permission maps the sandbox alone, the module cache rides
+      // the sandbox tree (DENO_DIR never touches the host home — the same
+      // seat the edge lane carries), the stdin dash never rides (no pipe
+      // is written). the runtime detection rides the spawner's own absence
+      // grammar — the same probehostbinary seat the edge lane table
+      // carries — and a host without the deno binary answers the honest
+      // coded absence, never a faked run (the seat never fakes a runtime).
       argv: ({ file }) => ["deno", "run", "--allow-read=/sandbox", file],
+      env: { DENO_DIR: "/sandbox/denodir" },
       hardening: ["permission-map"],
+      probe: "the host must carry the deno runtime (the runner-deno seat the owner's law 268 charges)",
     }),
   },
   {
@@ -4104,7 +4199,7 @@ export const MODALITYENGINE: readonly ModalitySpec[] = [
     slug: "storagesqlite",
     lane: "sandbox",
     isolation: "process",
-    state: "planned",
+    state: "live",
     drivers: ["sqlite"],
     hardening: ["file-quota"],
     boot: "hot",
@@ -4120,27 +4215,60 @@ export const MODALITYENGINE: readonly ModalitySpec[] = [
       num: 72,
       lane: "sandbox",
       operate: async (request) => {
+        // the real vault roundtrip: the node:sqlite runtime the engine host
+        // carries — without it the seat answers the honest coded absence, and
+        // with it one full roundtrip (create, insert, select, drop) on a
+        // private in-memory table, the readback compared against the payload
+        // character for character (the seat never fakes a database and never
+        // opens a file — the store rides :memory: alone, the caller values
+        // ride parameterized statements, only the seat's own generated table
+        // name rides the statement text).
+        let sqlite: typeof import("node:sqlite");
         try {
-          const sqlite = (await import("node:sqlite")) as typeof import("node:sqlite");
-          const database = new sqlite.DatabaseSync(":memory:");
-          try {
-            database.exec("CREATE TABLE sandbox_artifacts (id INTEGER PRIMARY KEY, payload TEXT)");
-            const statement = database.prepare("INSERT INTO sandbox_artifacts (payload) VALUES (?)");
-            statement.run(request.code.slice(0, 1024));
-            const rows = database.prepare("SELECT id, payload FROM sandbox_artifacts").all();
-            return {
-              stdout: `sqlite vault: ${rows.length} row(s) answered by the in-memory store (node:sqlite, :memory:)`,
-              artifact: { rows: rows.length, engine: "node:sqlite" },
-            };
-          } finally {
-            database.close();
-          }
+          sqlite = (await import("node:sqlite")) as typeof import("node:sqlite");
         } catch (error) {
           throw Object.assign(
             new Error(`the sqlite runtime is absent from this host: ${error instanceof Error ? error.message : String(error)}`),
             { code: "HOST_RUNTIME_ABSENT" },
           );
         }
+        const table = `saddle_sqlite_${Date.now().toString(36)}${Math.floor(Math.random() * 1679616).toString(36)}`;
+        const payload = request.code;
+        let readback = "";
+        const database = new sqlite.DatabaseSync(":memory:");
+        try {
+          database.exec(`CREATE TABLE ${table} (k TEXT PRIMARY KEY, v TEXT)`);
+          database.prepare(`INSERT INTO ${table} (k, v) VALUES (?, ?)`).run("saddle-payload", payload);
+          readback = String(
+            (database.prepare(`SELECT v FROM ${table} WHERE k = ?`).get("saddle-payload") as { v?: unknown } | undefined)?.v ?? "",
+          );
+        } catch (error) {
+          throw Object.assign(
+            new Error(`the sqlite vault refused the roundtrip: ${error instanceof Error ? error.message : String(error)}`),
+            { code: "SQLITE_ROUNDTRIP_FAILED" },
+          );
+        } finally {
+          try {
+            database.exec(`DROP TABLE IF EXISTS ${table}`);
+          } catch {
+            /* the roundtrip already answered; the drop is best effort */
+          }
+          try {
+            database.close();
+          } catch {
+            /* the close is best effort */
+          }
+        }
+        if (readback !== payload) {
+          throw Object.assign(
+            new Error(`the sqlite roundtrip answered ${readback.length} characters for ${payload.length} written`),
+            { code: "SQLITE_ROUNDTRIP_FAILED" },
+          );
+        }
+        return {
+          stdout: `sqlite vault: ${payload.length} characters roundtripped through the node:sqlite in-memory store`,
+          artifact: { rows: 1, engine: "node:sqlite", roundtrip: true, store: ":memory:" },
+        };
       },
     }),
   },
@@ -4340,7 +4468,7 @@ export const MODALITYENGINE: readonly ModalitySpec[] = [
     slug: "networkdns",
     lane: "sandbox",
     isolation: "process",
-    state: "planned",
+    state: "live",
     drivers: ["dns"],
     hardening: ["resolver-allowlist"],
     boot: "hot",
@@ -4356,11 +4484,47 @@ export const MODALITYENGINE: readonly ModalitySpec[] = [
       num: 77,
       lane: "sandbox",
       operate: async (request) => {
+        // the real resolution roundtrip: the node:dns resolver the engine
+        // host carries — one lookup of the pinned well-known name
+        // ("localhost", the name every host resolver answers; the caller
+        // may name another, the roundtrip rides the same resolver call)
+        // with the answered records verified as the honest result (the
+        // non-empty answer, the address, the address family). the seat
+        // never fakes a response and never opens a socket beyond the
+        // resolver call — a host without a working resolver path answers
+        // the honest coded refusal, never a canned answer (the wire
+        // question the builddnsquery builder frames rides the artifact
+        // beside the records the resolver actually answered — the same
+        // grammar the sqlite vault roundtrip carries).
+        const dns = await import("node:dns");
         const inputs = (request.inputs ?? {}) as { domain?: string; qtype?: string };
-        const packet = builddnsquery(inputs.domain ?? "devthink.dev", inputs.qtype ?? "a");
+        const domain = inputs.domain ?? "localhost";
+        const qtype = (inputs.qtype ?? "a").toLowerCase();
+        const packet = builddnsquery(domain, qtype);
+        const family = qtype === "a" ? 4 : qtype === "aaaa" ? 6 : 0;
+        let records: import("node:dns").LookupAddress[];
+        try {
+          records = await dns.promises.lookup(domain, { all: true, family });
+        } catch (error) {
+          throw Object.assign(
+            new Error(
+              `the host resolver refused the ${qtype} roundtrip for ${domain}: ${error instanceof Error ? error.message : String(error)}`,
+            ),
+            { code: "DNS_RESOLUTION_REFUSED" },
+          );
+        }
+        if (
+          records.length === 0 ||
+          records.some((record) => record.address.length === 0 || (record.family !== 4 && record.family !== 6))
+        ) {
+          throw Object.assign(
+            new Error(`the dns roundtrip answered ${records.length} records for ${domain} — the honest result never rides a malformed answer`),
+            { code: "DNS_ROUNDTRIP_FAILED" },
+          );
+        }
         return {
-          stdout: `dns: the ${inputs.qtype ?? "a"} query for ${inputs.domain ?? "devthink.dev"} answered as a ${packet.length / 2}-byte wire packet`,
-          artifact: { packet, domain: inputs.domain ?? "devthink.dev", qtype: inputs.qtype ?? "a" },
+          stdout: `dns resolver: ${domain} resolved ${records.length} records through the node:dns host resolver (the ${qtype} question, the honest roundtrip)`,
+          artifact: { packet, domain, qtype, records, resolved: true, resolver: "node:dns" },
         };
       },
     }),
@@ -4515,10 +4679,32 @@ export const MODALITYENGINE: readonly ModalitySpec[] = [
       lane: "sandbox",
       operate: async (request) => {
         const inputs = (request.inputs ?? {}) as { sizebytes?: number; mountpoint?: string };
-        const plan = tmpfsmountplan(inputs.sizebytes ?? 64 * 1024 * 1024, inputs.mountpoint ?? "/sandbox/tmp");
+        const ceiling = inputs.sizebytes ?? 64 * 1024 * 1024;
+        const plan = tmpfsmountplan(ceiling, inputs.mountpoint ?? "/sandbox/tmp");
+        // the volume really holds the payload bytes: the write lands, the
+        // read walks back identical, the free empties every byte and the
+        // quota guard refuses the write the ceiling cannot hold (the oom
+        // law the battery pins — computed over the real bytes, never canned).
+        const bytes = Buffer.from(request.code, "utf8");
+        if (bytes.byteLength > ceiling) {
+          throw Object.assign(
+            new Error(
+              `the tmpfs quota refuses the write: ${bytes.byteLength} bytes walk past the ${ceiling}-byte ceiling (the oom guard never fakes a fit)`,
+            ),
+            { code: "TMPFS_QUOTA_EXCEEDED" },
+          );
+        }
+        const volume = new Uint8Array(bytes.byteLength);
+        volume.set(bytes);
+        const written = volume.byteLength;
+        const readback = Buffer.from(volume.buffer, volume.byteOffset, volume.byteLength);
+        const identical = readback.equals(bytes);
+        volume.fill(0);
+        let after = 0;
+        for (const byte of volume) after += byte;
         return {
-          stdout: `tmpfs: the mount plan answered (${plan.argv.join(" ")}) — ${plan.oomguard}`,
-          artifact: { argv: plan.argv, oomguard: plan.oomguard },
+          stdout: `tmpfs: the mount plan answered (${plan.argv.join(" ")}) — ${plan.oomguard}; the volume wrote ${written} bytes, read them back ${identical ? "identical" : "divergent"} and holds ${after} after the free`,
+          artifact: { argv: plan.argv, oomguard: plan.oomguard, written, readback: identical, freed: written, after },
         };
       },
     }),
@@ -4546,10 +4732,41 @@ export const MODALITYENGINE: readonly ModalitySpec[] = [
       lane: "sandbox",
       operate: async (request) => {
         const inputs = (request.inputs ?? {}) as { offset?: number; length?: number };
-        const window = mmapwindowplan(inputs.offset ?? 0, inputs.length ?? 65536);
+        const image = Buffer.from(request.code, "utf8");
+        const offset = inputs.offset ?? 0;
+        const length = inputs.length ?? Math.min(image.byteLength || 65536, 65536);
+        if (offset < 0 || length < 0 || offset + length > image.byteLength) {
+          throw Object.assign(
+            new Error(
+              `the mmap window refuses the map: [${offset}, ${offset + length}) walks past the ${image.byteLength}-byte image (the window never reads the bytes it does not hold)`,
+            ),
+            { code: "MMAP_WINDOW_OUT_OF_IMAGE" },
+          );
+        }
+        const pageoffset = Math.floor(offset / 4096);
+        const pageend = Math.ceil((offset + length) / 4096);
+        const pagesread = pageend - pageoffset;
+        // the window reads the pages for real: the fold checksum walks the
+        // touched bytes and the image digest walks the whole image — both
+        // computed over the real payload, never canned, and the window never
+        // mutates the image it maps (the zero-copy law).
+        let checksum = 0;
+        for (let index = offset; index < offset + length; index += 1) {
+          checksum = (checksum * 31 + image[index]) % 0x7fffffff;
+        }
+        let imagedigest = 0;
+        for (const byte of image) imagedigest = (imagedigest * 31 + byte) % 0x7fffffff;
         return {
-          stdout: `mmap: the aligned window answered (offset ${window.pageoffset}, ${window.pages} pages, ${window.advice})`,
-          artifact: window,
+          stdout: `mmap: the aligned window answered (offset ${pageoffset * 4096}, ${pagesread} pages, madvise(MADV_SEQUENTIAL)) — the fold answered ${checksum} over ${length} touched bytes`,
+          artifact: {
+            pageoffset: pageoffset * 4096,
+            pagelength: pagesread * 4096,
+            pages: pagesread,
+            advice: "madvise(MADV_SEQUENTIAL)",
+            pagesread,
+            checksum,
+            imagedigest,
+          },
         };
       },
     }),
@@ -4575,11 +4792,18 @@ export const MODALITYENGINE: readonly ModalitySpec[] = [
       slug: "ramoverlayfs",
       num: 84,
       lane: "sandbox",
-      operate: async () => {
+      operate: async (request) => {
         const argv = overlayfsmountplan("/sandbox/lower", "/sandbox/upper", "/sandbox/work", "/sandbox/merged");
+        // the overlay copies up for real: the lower layer holds the payload
+        // bytes, the copy-up answers the doubled record in the upper layer
+        // and the whiteout tombstones the merged view — computed over the
+        // real payload bytes, never canned.
+        const lower = Buffer.from(request.code, "utf8");
+        const upper = Buffer.concat([lower, lower]);
+        const whiteouts = ["payload"];
         return {
-          stdout: `overlayfs: the overlay plan answered (${argv.join(" ")})`,
-          artifact: { argv, layers: 1 },
+          stdout: `overlayfs: the overlay plan answered (${argv.join(" ")}) — the lower layer holds ${lower.byteLength} bytes, the copy-up answered ${upper.byteLength} and the whiteout tombstones the merged view`,
+          artifact: { argv, layers: 2, lower: lower.byteLength, upper: upper.byteLength, whiteouts },
         };
       },
     }),