agent-hitch 0.2.6 → 0.2.7

package/README.md

@@ -152,10 +152,23 @@ portability rules.
 Start a queue when you need long-lived execution:
 
 ```bash
-hitch daemon start --max-concurrent 4
+hitch daemon start \
+  --max-concurrent 4 \
+  --capacity-cpu-millis 4000 \
+  --capacity-memory-mib 8192 \
+  --container-slots 4 \
+  --capacity-gpus 1 \
+  --eval-gpus 1
 hitch run --daemon --harness codex@version:0.92.0 --prompt-file task.md
 ```
 
+Windows is covered on Node 22 and 24, including npm/agent `.cmd` shims and the
+packaged-harness cache/integrity path. GPU-backed Harbor trials require a
+Docker host with GPU container support and explicit `--capacity-gpus` plus
+`--eval-gpus`; Hitch never guesses GPU capacity. A repository maintainer can
+run the real NVIDIA gate through the manually dispatched
+`NVIDIA GPU hardware canary` workflow on a compatible self-hosted runner.
+
 ## Documentation
 
 - [Design and architecture](docs/design.md)

package/dist/scripts/canary-buildkit-secrets.js

@@ -0,0 +1,166 @@
+import { randomBytes } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { mkdir, mkdtemp, readFile, readdir, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { gunzipSync, inflateSync, zstdDecompressSync } from "node:zlib";
+const SECRET_NAME = "HITCH_CANARY_SECRET";
+const MAX_SCAN_FILE_BYTES = 256 * 1024 * 1024;
+const docker = process.env.HITCH_DOCKER_PATH || "docker";
+const base = process.env.HITCH_DOCKER_CANARY_BASE || "ubuntu:24.04";
+const platform = process.env.HITCH_DOCKER_CANARY_PLATFORM || "linux/amd64";
+const temporary = await mkdtemp(path.join(tmpdir(), "hitch-buildkit-secret-canary-"));
+const context = path.join(temporary, "context");
+const cacheOne = path.join(temporary, "cache-one");
+const cacheTwo = path.join(temporary, "cache-two");
+const imageTar = path.join(temporary, "image.tar");
+const metadataOne = path.join(temporary, "metadata-one.json");
+const metadataTwo = path.join(temporary, "metadata-two.json");
+const tag = `hitch-buildkit-secret-canary:${randomBytes(8).toString("hex")}`;
+const secretOne = `hitch-canary-a-${randomBytes(24).toString("hex")}`;
+const secretTwo = `hitch-canary-b-${randomBytes(24).toString("hex")}`;
+const cacheMode = selectedBuilderDriver() === "docker" ? "inline" : "local";
+let baseContainer;
+try {
+    await writeFile(path.join(temporary, ".keep"), "");
+    await mkdir(context);
+    const baseInspect = run(["image", "inspect", "--format", "{{.Id}} {{.Os}}/{{.Architecture}}", base]);
+    const [baseIdentity, basePlatform] = baseInspect.stdout.trim().split(" ");
+    if (!baseIdentity || !/^sha256:[a-f0-9]{64}$/.test(baseIdentity) || basePlatform !== platform) {
+        throw new Error(`local canary base platform does not match ${platform}`);
+    }
+    baseContainer = run(["create", "--platform", platform, base]).stdout.trim();
+    if (!/^[a-f0-9]{64}$/.test(baseContainer))
+        throw new Error("Docker returned an invalid temporary container id");
+    run(["export", "--output", path.join(context, "rootfs.tar"), baseContainer]);
+    run(["container", "rm", baseContainer]);
+    baseContainer = undefined;
+    await writeFile(path.join(context, "Dockerfile"), [
+        "FROM scratch",
+        "ADD rootfs.tar /",
+        `RUN --mount=type=secret,id=${SECRET_NAME},required=true test \"$(wc -c < /run/secrets/${SECRET_NAME})\" -ge 32` + " \\",
+        "    && printf 'secret-mounted-not-copied\\n' > /hitch-secret-proof",
+        "",
+    ].join("\n"));
+    const first = build(secretOne, metadataOne, cacheOne);
+    const firstIdentity = imageIdentity(tag);
+    const second = build(secretTwo, metadataTwo, cacheTwo, cacheOne);
+    const secondIdentity = imageIdentity(tag);
+    if (firstIdentity !== secondIdentity)
+        throw new Error("rotating the secret changed the image config digest");
+    if (!/\bCACHED\b/.test(`${second.stdout}\n${second.stderr}`))
+        throw new Error("rotated-secret build did not reuse the exported cache");
+    const proof = run(["run", "--rm", "--entrypoint", "/bin/sh", tag, "-c", "cat /hitch-secret-proof"]);
+    if (proof.stdout.trim() !== "secret-mounted-not-copied")
+        throw new Error("built image did not prove the secret mount was readable");
+    run(["save", "--output", imageTar, tag]);
+    const secrets = [Buffer.from(secretOne), Buffer.from(secretTwo)];
+    assertTextDoesNotContain(first.stdout + first.stderr + second.stdout + second.stderr, secrets, "BuildKit output");
+    await scanTree(temporary, secrets);
+    const metadata = JSON.parse(await readFile(metadataTwo, "utf8"));
+    process.stdout.write(`${JSON.stringify({
+        ok: true,
+        docker: run(["version", "--format", "{{.Server.Version}}"]).stdout.trim(),
+        buildx: run(["buildx", "version"]).stdout.trim(),
+        base,
+        platform,
+        image_config_digest: secondIdentity,
+        manifest_digest: metadata["containerimage.digest"],
+        cache_export: cacheMode === "local" ? "local-directory" : "inline-image-metadata",
+        rotated_secret_cache_hit: true,
+        scanned: cacheMode === "local"
+            ? ["docker-save image tar", "first exported local cache", "rotated-secret exported local cache", "BuildKit logs and metadata"]
+            : ["docker-save image tar including inline cache metadata", "BuildKit logs and metadata"],
+    }, null, 2)}\n`);
+}
+finally {
+    if (baseContainer)
+        spawnSync(docker, ["container", "rm", "--force", baseContainer], { encoding: "utf8" });
+    spawnSync(docker, ["image", "rm", tag], { encoding: "utf8" });
+    await rm(temporary, { recursive: true, force: true });
+}
+function build(secret, metadataFile, cacheTo, cacheFrom) {
+    return run([
+        "buildx", "build",
+        "--progress", "plain",
+        "--load",
+        "--provenance=false",
+        "--platform", platform,
+        "--file", path.join(context, "Dockerfile"),
+        "--tag", tag,
+        "--metadata-file", metadataFile,
+        "--secret", `id=${SECRET_NAME},env=${SECRET_NAME}`,
+        ...(cacheMode === "local" && cacheFrom ? ["--cache-from", `type=local,src=${cacheFrom}`] : []),
+        "--cache-to", cacheMode === "local" ? `type=local,dest=${cacheTo},mode=max` : "type=inline",
+        context,
+    ], { [SECRET_NAME]: secret });
+}
+function selectedBuilderDriver() {
+    const inspected = run(["buildx", "inspect"]).stdout;
+    const driver = inspected.match(/^Driver:\s+(\S+)$/m)?.[1];
+    if (!driver)
+        throw new Error("cannot determine the selected Buildx driver");
+    return driver;
+}
+function imageIdentity(reference) {
+    const identity = run(["image", "inspect", "--format", "{{.Id}}", reference]).stdout.trim();
+    if (!/^sha256:[a-f0-9]{64}$/.test(identity))
+        throw new Error("Docker returned an invalid image config digest");
+    return identity;
+}
+function run(args, extraEnv = {}) {
+    const result = spawnSync(docker, args, {
+        encoding: "utf8",
+        env: { ...process.env, ...extraEnv },
+        maxBuffer: 64 * 1024 * 1024,
+    });
+    if (result.status !== 0) {
+        const output = `${result.stderr || ""}\n${result.stdout || ""}`.slice(0, 64 * 1024);
+        if ((secretOne && output.includes(secretOne)) || (secretTwo && output.includes(secretTwo))) {
+            throw new Error(`Docker command failed and exposed ${SECRET_NAME}`);
+        }
+        throw new Error(`Docker command failed (${args.slice(0, 2).join(" ")}): ${output}`);
+    }
+    return { stdout: result.stdout || "", stderr: result.stderr || "" };
+}
+async function scanTree(root, secrets) {
+    for (const entry of await readdir(root, { withFileTypes: true })) {
+        const target = path.join(root, entry.name);
+        if (entry.isDirectory())
+            await scanTree(target, secrets);
+        else if (entry.isFile())
+            await scanFile(target, secrets);
+    }
+}
+async function scanFile(file, secrets) {
+    const raw = await readFile(file);
+    if (raw.byteLength > MAX_SCAN_FILE_BYTES)
+        throw new Error(`canary evidence file is too large to scan safely: ${path.basename(file)}`);
+    assertBufferDoesNotContain(raw, secrets, file);
+    for (const decoded of decodedCandidates(raw))
+        assertBufferDoesNotContain(decoded, secrets, `${file} (decompressed)`);
+}
+function decodedCandidates(value) {
+    const candidates = [];
+    try {
+        if (value[0] === 0x1f && value[1] === 0x8b)
+            candidates.push(gunzipSync(value));
+        else if (value[0] === 0x78)
+            candidates.push(inflateSync(value));
+        else if (value[0] === 0x28 && value[1] === 0xb5 && value[2] === 0x2f && value[3] === 0xfd)
+            candidates.push(zstdDecompressSync(value));
+    }
+    catch {
+        throw new Error("canary could not decompress exported cache evidence");
+    }
+    return candidates;
+}
+function assertTextDoesNotContain(value, secrets, label) {
+    assertBufferDoesNotContain(Buffer.from(value), secrets, label);
+}
+function assertBufferDoesNotContain(value, secrets, label) {
+    for (const secret of secrets)
+        if (value.includes(secret))
+            throw new Error(`${SECRET_NAME} leaked into ${label}`);
+}
+//# sourceMappingURL=canary-buildkit-secrets.js.map

package/dist/scripts/canary-buildkit-secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canary-buildkit-secrets.js","sourceRoot":"","sources":["../../scripts/canary-buildkit-secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpF,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAExE,MAAM,WAAW,GAAG,qBAAqB,CAAC;AAC1C,MAAM,mBAAmB,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,QAAQ,CAAC;AACzD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,cAAc,CAAC;AACpE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,aAAa,CAAC;AAC3E,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,+BAA+B,CAAC,CAAC,CAAC;AACtF,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AACnD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;AAC9D,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;AAC9D,MAAM,GAAG,GAAG,gCAAgC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAC7E,MAAM,SAAS,GAAG,kBAAkB,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACtE,MAAM,SAAS,GAAG,kBAAkB,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACtE,MAAM,SAAS,GAAG,qBAAqB,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;AAC5E,IAAI,aAAiC,CAAC;AAEtC,IAAI,CAAC;IACH,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;IACnD,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;IACrB,MAAM,WAAW,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,mCAAmC,EAAE,IAAI,CAAC,CAAC,CAAC;IACrG,MAAM,CAAC,YAAY,EAAE,YAAY,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1E,IAAI,CAAC,YAAY,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,YAAY,KAAK,QAAQ,EAAE,CAAC;QAC9F,MAAM,IAAI,KAAK,CAAC,6CAA6C,QAAQ,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,aAAa,GAAG,GAAG,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC5E,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,aAAa,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IAChH,GAAG,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC;IAC7E,GAAG,CAAC,CAAC,WAAW,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;IACxC,aAAa,GAAG,SAAS,CAAC;IAC1B,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE;QAChD,cAAc;QACd,kBAAkB;QAClB,8BAA8B,WAAW,gDAAgD,WAAW,YAAY,GAAG,KAAK;QACxH,oEAAoE;QACpE,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAEd,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IACtD,MAAM,aAAa,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACjE,MAAM,cAAc,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,aAAa,KAAK,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IAC7G,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAEvI,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,yBAAyB,CAAC,CAAC,CAAC;IACpG,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,2BAA2B;QAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IACpI,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;IAEzC,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACjE,wBAAwB,CAAC,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC;IAClH,MAAM,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAEnC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAA4B,CAAC;IAC5F,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;QACrC,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,GAAG,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,qBAAqB,CAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;QAC1E,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;QAChD,IAAI;QACJ,QAAQ;QACR,mBAAmB,EAAE,cAAc;QACnC,eAAe,EAAE,QAAQ,CAAC,uBAAuB,CAAC;QAClD,YAAY,EAAE,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,uBAAuB;QACjF,wBAAwB,EAAE,IAAI;QAC9B,OAAO,EAAE,SAAS,KAAK,OAAO;YAC5B,CAAC,CAAC,CAAC,uBAAuB,EAAE,4BAA4B,EAAE,qCAAqC,EAAE,4BAA4B,CAAC;YAC9H,CAAC,CAAC,CAAC,uDAAuD,EAAE,4BAA4B,CAAC;KAC5F,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AACnB,CAAC;QAAS,CAAC;IACT,IAAI,aAAa;QAAE,SAAS,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1G,SAAS,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9D,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,KAAK,CAAC,MAAc,EAAE,YAAoB,EAAE,OAAe,EAAE,SAAkB;IACtF,OAAO,GAAG,CAAC;QACT,QAAQ,EAAE,OAAO;QACjB,YAAY,EAAE,OAAO;QACrB,QAAQ;QACR,oBAAoB;QACpB,YAAY,EAAE,QAAQ;QACtB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC;QAC1C,OAAO,EAAE,GAAG;QACZ,iBAAiB,EAAE,YAAY;QAC/B,UAAU,EAAE,MAAM,WAAW,QAAQ,WAAW,EAAE;QAClD,GAAG,CAAC,SAAS,KAAK,OAAO,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,kBAAkB,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9F,YAAY,EAAE,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,mBAAmB,OAAO,WAAW,CAAC,CAAC,CAAC,aAAa;QAC3F,OAAO;KACR,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,qBAAqB;IAC5B,MAAM,SAAS,GAAG,GAAG,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;IACpD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAC5E,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,SAAiB;IACtC,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC3F,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IAC/G,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,GAAG,CAAC,IAAc,EAAE,WAA8B,EAAE;IAC3D,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE;QACrC,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE;QACpC,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;KAC5B,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,KAAK,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;QACpF,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YAC3F,MAAM,IAAI,KAAK,CAAC,qCAAqC,WAAW,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;AACtE,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAE,OAAiB;IACrD,KAAK,MAAM,KAAK,IAAI,MAAM,OAAO,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACjE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,KAAK,CAAC,WAAW,EAAE;YAAE,MAAM,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;aACpD,IAAI,KAAK,CAAC,MAAM,EAAE;YAAE,MAAM,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAE,OAAiB;IACrD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,GAAG,CAAC,UAAU,GAAG,mBAAmB;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtI,0BAA0B,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC/C,KAAK,MAAM,OAAO,IAAI,iBAAiB,CAAC,GAAG,CAAC;QAAE,0BAA0B,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,iBAAiB,CAAC,CAAC;AACvH,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,CAAC;QACH,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;aAC1E,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;aAC3D,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,UAAU,CAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;IACxI,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IAAC,CAAC;IACnF,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAa,EAAE,OAAiB,EAAE,KAAa;IAC/E,0BAA0B,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAa,EAAE,OAAiB,EAAE,KAAa;IACjF,KAAK,MAAM,MAAM,IAAI,OAAO;QAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,WAAW,gBAAgB,KAAK,EAAE,CAAC,CAAC;AACnH,CAAC"}

package/dist/scripts/canary-collision-domains.js

@@ -0,0 +1,77 @@
+import { randomBytes } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { runCommand } from "../src/foundation/index.js";
+const docker = process.env.HITCH_DOCKER_PATH || "docker";
+const base = process.env.HITCH_COLLISION_CANARY_BASE || "ubuntu:24.04";
+const endpoints = (process.env.HITCH_COLLISION_DOMAIN_DOCKER_HOSTS ?? "")
+    .split(",").map((value) => value.trim()).filter(Boolean);
+if (endpoints.length !== 2) {
+    process.stdout.write(`${JSON.stringify({
+        schema_version: "1", status: "unsupported", code: "two_docker_endpoints_required",
+        message: "set HITCH_COLLISION_DOMAIN_DOCKER_HOSTS to two comma-separated Docker endpoints",
+    }, null, 2)}\n`);
+    process.exitCode = 3;
+}
+else {
+    await runCanary(endpoints);
+}
+async function runCanary(hosts) {
+    const nonce = randomBytes(8).toString("hex");
+    const name = `hitch-collision-domain-${nonce}`;
+    const containers = new Map();
+    const startedAt = Date.now();
+    try {
+        const engines = await Promise.all(hosts.map(async (host) => {
+            const [id, version] = (await command(host, ["info", "--format", "{{.ID}} {{.ServerVersion}}"])).stdout.trim().split(/\s+/);
+            if (!id || !version)
+                throw new Error(`Docker endpoint did not expose a stable engine identity: ${host}`);
+            return { host, id, version };
+        }));
+        if (engines[0].id === engines[1].id) {
+            process.stdout.write(`${JSON.stringify({
+                schema_version: "1", status: "unsupported", code: "collision_domains_not_independent",
+                engines,
+            }, null, 2)}\n`);
+            process.exitCode = 3;
+            return;
+        }
+        await Promise.all(engines.map((engine) => command(engine.host, ["image", "inspect", base])));
+        const launches = await Promise.all(engines.map(async (engine) => {
+            const id = (await command(engine.host, [
+                "container", "run", "--detach", "--name", name,
+                "--label", "io.hitch.canary=collision-domain-v1",
+                "--label", "io.hitch.task-id=same-task",
+                "--label", `io.hitch.collision-domain-id=${engine.id}`,
+                base, "/bin/sh", "-c", "sleep 3",
+            ])).stdout.trim();
+            if (!/^[a-f0-9]{64}$/.test(id))
+                throw new Error(`Docker endpoint returned an invalid container id: ${engine.host}`);
+            containers.set(engine.host, id);
+            return { ...engine, container_id: id };
+        }));
+        const running = await Promise.all(launches.map(async (entry) => ({
+            ...entry,
+            running: (await command(entry.host, ["container", "inspect", "--format", "{{.State.Running}}", entry.container_id])).stdout.trim() === "true",
+        })));
+        if (running.some((entry) => !entry.running))
+            throw new Error("same-task containers did not overlap across independent collision domains");
+        const exitCodes = await Promise.all(running.map(async (entry) => Number((await command(entry.host, ["container", "wait", entry.container_id], 10_000)).stdout.trim())));
+        if (exitCodes.some((code) => code !== 0))
+            throw new Error(`collision-domain container failed: ${exitCodes.join(",")}`);
+        process.stdout.write(`${JSON.stringify({
+            schema_version: "1", status: "passed", task_id: "same-task", identical_container_name: name,
+            engines: running.map(({ host, id, version, container_id }) => ({ host, collision_domain_id: id, docker_version: version, container_id })),
+            overlap_observed: true, duration_ms: Date.now() - startedAt,
+        }, null, 2)}\n`);
+    }
+    finally {
+        for (const [host, id] of containers)
+            spawnSync(docker, ["--host", host, "container", "rm", "--force", id], { encoding: "utf8" });
+    }
+}
+function command(host, args, timeoutMs = 15_000) {
+    return runCommand(docker, ["--host", host, ...args], {
+        env: process.env, timeoutMs, failureCode: "collision_domain_canary_failed",
+    });
+}
+//# sourceMappingURL=canary-collision-domains.js.map

package/dist/scripts/canary-collision-domains.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canary-collision-domains.js","sourceRoot":"","sources":["../../scripts/canary-collision-domains.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAExD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,QAAQ,CAAC;AACzD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,cAAc,CAAC;AACvE,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,mCAAmC,IAAI,EAAE,CAAC;KACtE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAE3D,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;IAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;QACrC,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,+BAA+B;QACjF,OAAO,EAAE,iFAAiF;KAC3F,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACjB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC;KAAM,CAAC;IACN,MAAM,SAAS,CAAC,SAA6B,CAAC,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,KAAuB;IAC9C,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,0BAA0B,KAAK,EAAE,CAAC;IAC/C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;YACzD,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,4BAA4B,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC3H,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,IAAI,EAAE,CAAC,CAAC;YACzG,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;QAC/B,CAAC,CAAC,CAAC,CAAC;QACJ,IAAI,OAAO,CAAC,CAAC,CAAE,CAAC,EAAE,KAAK,OAAO,CAAC,CAAC,CAAE,CAAC,EAAE,EAAE,CAAC;YACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;gBACrC,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,mCAAmC;gBACrF,OAAO;aACR,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YACjB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7F,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YAC9D,MAAM,EAAE,GAAG,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE;gBACrC,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI;gBAC9C,SAAS,EAAE,qCAAqC;gBAChD,SAAS,EAAE,4BAA4B;gBACvC,SAAS,EAAE,gCAAgC,MAAM,CAAC,EAAE,EAAE;gBACtD,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS;aACjC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAClB,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YACpH,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAChC,OAAO,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;QACzC,CAAC,CAAC,CAAC,CAAC;QACJ,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YAC/D,GAAG,KAAK;YACR,OAAO,EAAE,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,oBAAoB,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,MAAM;SAC9I,CAAC,CAAC,CAAC,CAAC;QACL,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;QAC1I,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACxK,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;YACrC,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,wBAAwB,EAAE,IAAI;YAC3F,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,EAAE,cAAc,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;YACzI,gBAAgB,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SAC5D,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;YAAS,CAAC;QACT,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,UAAU;YAAE,SAAS,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACnI,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,IAAc,EAAE,SAAS,GAAG,MAAM;IAC/D,OAAO,UAAU,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,EAAE;QACnD,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,WAAW,EAAE,gCAAgC;KAC3E,CAAC,CAAC;AACL,CAAC"}

package/dist/scripts/canary-docker-image-observation.js

@@ -0,0 +1,181 @@
+import { createHash, randomBytes } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { dockerOwnershipLabelMap, startDockerResourceObserver } from "../src/evals/index.js";
+import { verifyTrialEnvironmentImageExecution } from "../src/evals/trial-environment-evidence.js";
+const docker = process.env.HITCH_DOCKER_PATH || "docker";
+const base = process.env.HITCH_DOCKER_CANARY_BASE || "ubuntu:24.04";
+const platform = process.env.HITCH_DOCKER_CANARY_PLATFORM || "linux/amd64";
+const nonce = randomBytes(8).toString("hex");
+const temporary = await mkdtemp(path.join(tmpdir(), "hitch-docker-image-canary-"));
+const context = path.join(temporary, "context");
+const roles = ["main", "sidecar", "verifier"];
+const tags = Object.fromEntries(roles.map((role) => [role, `hitch-image-observation-canary-${role}:${nonce}`]));
+const containers = [];
+let exportContainer;
+const ownership = {
+    root_id: randomBytes(12).toString("hex"),
+    provider: "local-docker",
+    eval_id: `eval_${randomBytes(16).toString("hex")}`,
+    work_id: `work_${randomBytes(16).toString("hex")}`,
+    lease_id: `lease_${randomBytes(16).toString("hex")}`,
+    lease_epoch: 1,
+    task_id: "docker-image-observation-canary",
+};
+try {
+    await mkdir(context);
+    const baseInspect = run(["image", "inspect", "--format", "{{.Id}} {{.Os}}/{{.Architecture}}", base]);
+    const [baseIdentity, basePlatform] = baseInspect.stdout.trim().split(" ");
+    if (!baseIdentity || !/^sha256:[a-f0-9]{64}$/.test(baseIdentity) || basePlatform !== platform) {
+        throw new Error(`local canary base platform does not match ${platform}`);
+    }
+    exportContainer = run(["create", "--platform", platform, base]).stdout.trim();
+    if (!/^[a-f0-9]{64}$/.test(exportContainer))
+        throw new Error("Docker returned an invalid temporary container id");
+    run(["export", "--output", path.join(context, "rootfs.tar"), exportContainer]);
+    run(["container", "rm", exportContainer]);
+    exportContainer = undefined;
+    await writeFile(path.join(context, "Dockerfile"), [
+        "FROM scratch",
+        "ADD rootfs.tar /",
+        "ARG HITCH_CANARY_ROLE",
+        "LABEL io.hitch.canary-role=$HITCH_CANARY_ROLE",
+        "ENTRYPOINT [\"/bin/sh\", \"-c\", \"i=0; while [ \\\"$i\\\" -lt 50000 ]; do i=$((i+1)); done; while :; do sleep 1; done\"]",
+        "",
+    ].join("\n"));
+    const expected = new Map();
+    for (const role of roles) {
+        run([
+            "buildx", "build", "--load", "--provenance=false", "--progress", "plain",
+            "--platform", platform,
+            "--build-arg", `HITCH_CANARY_ROLE=${role}`,
+            "--tag", tags[role],
+            context,
+        ]);
+        const digest = run(["image", "inspect", "--format", "{{.Id}}", tags[role]]).stdout.trim();
+        if (!/^sha256:[a-f0-9]{64}$/.test(digest))
+            throw new Error(`Docker returned an invalid ${role} config digest`);
+        expected.set(role, digest);
+    }
+    if (new Set(expected.values()).size !== roles.length)
+        throw new Error("canary role images do not have distinct config digests");
+    const labels = dockerOwnershipLabelMap(ownership);
+    for (const role of roles) {
+        const args = ["container", "run", "--detach", "--name", `hitch-image-canary-${role}-${nonce}`];
+        for (const [name, value] of Object.entries(labels))
+            args.push("--label", `${name}=${value}`);
+        args.push(tags[role]);
+        const id = run(args).stdout.trim();
+        if (!/^[a-f0-9]{64}$/.test(id))
+            throw new Error(`Docker returned an invalid ${role} container id`);
+        containers.push(id);
+    }
+    const observer = startDockerResourceObserver({
+        ownership,
+        workerId: "canary-worker",
+        collisionDomainId: "canary-docker-engine",
+        reservation: { cpu_millis: 1_000, memory_bytes: 128 * 1024 * 1024, container_slots: 3, build_slots: 0 },
+        mainLimits: { cpu_millis: 500, memory_bytes: 64 * 1024 * 1024, container_slots: 1, build_slots: 0 },
+        sidecarLimits: { sidecar: { cpu_millis: 250, memory_bytes: 32 * 1024 * 1024 }, verifier: { cpu_millis: 250, memory_bytes: 32 * 1024 * 1024 } },
+        intervalMs: 60_000,
+    });
+    const execution = await observer.capture();
+    await observer.stop();
+    if (execution.observed.containers.length !== roles.length)
+        throw new Error("observer did not capture all canary containers");
+    const actual = new Map();
+    const cpuTimes = new Map();
+    const peakMemory = new Map();
+    for (const container of execution.observed.containers) {
+        const role = roles.find((entry) => container.name?.includes(`-${entry}-${nonce}`));
+        if (!role || !container.image_config_digest)
+            throw new Error("observer returned incomplete role image evidence");
+        if (!Number.isSafeInteger(container.cpu_time_ns) || container.cpu_time_ns <= 0)
+            throw new Error(`observer did not record cumulative ${role} CPU time`);
+        if (!Number.isSafeInteger(container.peak_memory_bytes) || container.peak_memory_bytes <= 0)
+            throw new Error(`observer did not record peak ${role} memory`);
+        actual.set(role, container.image_config_digest);
+        cpuTimes.set(role, container.cpu_time_ns);
+        peakMemory.set(role, container.peak_memory_bytes);
+    }
+    for (const role of roles)
+        if (actual.get(role) !== expected.get(role))
+            throw new Error(`observer recorded the wrong ${role} config digest`);
+    const evidence = trialEvidence(expected);
+    verifyTrialEnvironmentImageExecution(execution, evidence);
+    const forged = structuredClone(evidence);
+    const verifier = forged.manifests.find((entry) => entry.output.reference.includes("verifier"));
+    if (!verifier)
+        throw new Error("canary verifier manifest is missing");
+    verifier.output.config_digest = sha256("forged-verifier-config");
+    let rejected = false;
+    try {
+        verifyTrialEnvironmentImageExecution(execution, forged);
+    }
+    catch (error) {
+        rejected = error.code === "environment_image_mismatch";
+    }
+    if (!rejected)
+        throw new Error("forged verifier image digest was not rejected");
+    process.stdout.write(`${JSON.stringify({
+        ok: true,
+        docker: run(["version", "--format", "{{.Server.Version}}"]).stdout.trim(),
+        compose: run(["compose", "version", "--short"]).stdout.trim(),
+        platform,
+        observed_config_digests: Object.fromEntries(roles.map((role) => [role, expected.get(role)])),
+        observed_cpu_time_ns: Object.fromEntries(roles.map((role) => [role, cpuTimes.get(role)])),
+        observed_peak_memory_bytes: Object.fromEntries(roles.map((role) => [role, peakMemory.get(role)])),
+        forged_verifier_digest_rejected: true,
+    }, null, 2)}\n`);
+}
+finally {
+    for (const id of containers)
+        spawnSync(docker, ["container", "rm", "--force", id], { encoding: "utf8" });
+    if (exportContainer)
+        spawnSync(docker, ["container", "rm", "--force", exportContainer], { encoding: "utf8" });
+    for (const role of roles)
+        spawnSync(docker, ["image", "rm", tags[role]], { encoding: "utf8" });
+    await rm(temporary, { recursive: true, force: true });
+}
+function trialEvidence(configs) {
+    const createdAt = new Date().toISOString();
+    const manifests = roles.map((role) => {
+        const manifestDigest = sha256(`manifest:${role}`);
+        return {
+            schema_version: "1",
+            image_id: sha256(`image:${role}`),
+            source: { kind: "registry", benchmark_id: "canary", benchmark_revision: "1", task_id: ownership.task_id },
+            platform,
+            build: { builder: "buildkit", frontend: "registry-resolution", secret_names: [], cache_key: sha256(`cache:${role}`) },
+            output: { reference: `canary/${role}@${manifestDigest}`, manifest_digest: manifestDigest, config_digest: configs.get(role) },
+            base_images: [],
+            created_at: createdAt,
+        };
+    });
+    return {
+        manifests,
+        uses: manifests.map((manifest, index) => ({
+            task_ids: [ownership.task_id],
+            image_id: manifest.image_id,
+            requested_reference: `canary/${roles[index]}:mutable`,
+            reference: manifest.output.reference,
+            manifest_digest: manifest.output.manifest_digest,
+            platform,
+            resolution: "registry",
+            cache_hit: false,
+        })),
+    };
+}
+function sha256(value) {
+    return `sha256:${createHash("sha256").update(value).digest("hex")}`;
+}
+function run(args) {
+    const result = spawnSync(docker, args, { encoding: "utf8", env: process.env, maxBuffer: 64 * 1024 * 1024 });
+    if (result.status !== 0) {
+        throw new Error(`Docker command failed (${args.slice(0, 2).join(" ")}): ${`${result.stderr || ""}\n${result.stdout || ""}`.slice(0, 64 * 1024)}`);
+    }
+    return { stdout: result.stdout || "", stderr: result.stderr || "" };
+}
+//# sourceMappingURL=canary-docker-image-observation.js.map

package/dist/scripts/canary-docker-image-observation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canary-docker-image-observation.js","sourceRoot":"","sources":["../../scripts/canary-docker-image-observation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,uBAAuB,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAC7F,OAAO,EAAE,oCAAoC,EAAE,MAAM,4CAA4C,CAAC;AAElG,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,QAAQ,CAAC;AACzD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,cAAc,CAAC;AACpE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,aAAa,CAAC;AAC3E,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC7C,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,4BAA4B,CAAC,CAAC,CAAC;AACnF,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AAChD,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,CAAU,CAAC;AACvD,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,kCAAkC,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAyC,CAAC;AACxJ,MAAM,UAAU,GAAa,EAAE,CAAC;AAChC,IAAI,eAAmC,CAAC;AAExC,MAAM,SAAS,GAAG;IAChB,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;IACxC,QAAQ,EAAE,cAAuB;IACjC,OAAO,EAAE,QAAQ,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;IAClD,OAAO,EAAE,QAAQ,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;IAClD,QAAQ,EAAE,SAAS,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;IACpD,WAAW,EAAE,CAAC;IACd,OAAO,EAAE,iCAAiC;CAC3C,CAAC;AAEF,IAAI,CAAC;IACH,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;IACrB,MAAM,WAAW,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,mCAAmC,EAAE,IAAI,CAAC,CAAC,CAAC;IACrG,MAAM,CAAC,YAAY,EAAE,YAAY,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1E,IAAI,CAAC,YAAY,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,YAAY,KAAK,QAAQ,EAAE,CAAC;QAC9F,MAAM,IAAI,KAAK,CAAC,6CAA6C,QAAQ,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,eAAe,GAAG,GAAG,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9E,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,eAAe,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IAClH,GAAG,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC;IAC/E,GAAG,CAAC,CAAC,WAAW,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC;IAC1C,eAAe,GAAG,SAAS,CAAC;IAC5B,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE;QAChD,cAAc;QACd,kBAAkB;QAClB,uBAAuB;QACvB,+CAA+C;QAC/C,2HAA2H;QAC3H,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAEd,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,GAAG,CAAC;YACF,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,YAAY,EAAE,OAAO;YACxE,YAAY,EAAE,QAAQ;YACtB,aAAa,EAAE,qBAAqB,IAAI,EAAE;YAC1C,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC;YACnB,OAAO;SACR,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC1F,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,gBAAgB,CAAC,CAAC;QAC/G,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,MAAgB,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAEhI,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAAC,CAAC;IAClD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,sBAAsB,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC;QAC/F,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC;QAC7F,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACtB,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,eAAe,CAAC,CAAC;QACnG,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtB,CAAC;IAED,MAAM,QAAQ,GAAG,2BAA2B,CAAC;QAC3C,SAAS;QACT,QAAQ,EAAE,eAAe;QACzB,iBAAiB,EAAE,sBAAsB;QACzC,WAAW,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI,EAAE,eAAe,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE;QACvG,UAAU,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,YAAY,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,eAAe,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE;QACnG,aAAa,EAAE,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,YAAY,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,YAAY,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE;QAC9I,UAAU,EAAE,MAAM;KACnB,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;IAC3C,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACtB,IAAI,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IAE7H,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,KAAK,MAAM,SAAS,IAAI,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;QACtD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,KAAK,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;QACnF,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,mBAAmB;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACjH,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,WAAW,CAAC,IAAK,SAAS,CAAC,WAAsB,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,IAAI,WAAW,CAAC,CAAC;QACnK,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,iBAAiB,CAAC,IAAK,SAAS,CAAC,iBAA4B,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,SAAS,CAAC,CAAC;QACvK,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,mBAAmB,CAAC,CAAC;QAChD,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,WAAqB,CAAC,CAAC;QACpD,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,iBAA2B,CAAC,CAAC;IAC9D,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,gBAAgB,CAAC,CAAC;IAE5I,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACzC,oCAAoC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;IAC/F,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACtE,QAAQ,CAAC,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,wBAAwB,CAAC,CAAC;IACjE,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,CAAC;QAAC,oCAAoC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;IAChE,OAAO,KAAK,EAAE,CAAC;QAAC,QAAQ,GAAI,KAA2B,CAAC,IAAI,KAAK,4BAA4B,CAAC;IAAC,CAAC;IAChG,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAEhF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;QACrC,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,GAAG,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,qBAAqB,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;QACzE,OAAO,EAAE,GAAG,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;QAC7D,QAAQ;QACR,uBAAuB,EAAE,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5F,oBAAoB,EAAE,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzF,0BAA0B,EAAE,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjG,+BAA+B,EAAE,IAAI;KACtC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AACnB,CAAC;QAAS,CAAC;IACT,KAAK,MAAM,EAAE,IAAI,UAAU;QAAE,SAAS,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACzG,IAAI,eAAe;QAAE,SAAS,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9G,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,SAAS,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/F,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,aAAa,CAAC,OAAoC;IACzD,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAA8B,EAAE;QAC/D,MAAM,cAAc,GAAG,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;QAClD,OAAO;YACL,cAAc,EAAE,GAAG;YACnB,QAAQ,EAAE,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;YACjC,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,kBAAkB,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE;YACzG,QAAQ;YACR,KAAK,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,qBAAqB,EAAE,YAAY,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE;YACrH,MAAM,EAAE,EAAE,SAAS,EAAE,UAAU,IAAI,IAAI,cAAc,EAAE,EAAE,eAAe,EAAE,cAAc,EAAE,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAW,EAAE;YACtI,WAAW,EAAE,EAAE;YACf,UAAU,EAAE,SAAS;SACtB,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,OAAO;QACL,SAAS;QACT,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAyB,EAAE,CAAC,CAAC;YAC/D,QAAQ,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC;YAC7B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,mBAAmB,EAAE,UAAU,KAAK,CAAC,KAAK,CAAC,UAAU;YACrD,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS;YACpC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,eAAe;YAChD,QAAQ;YACR,UAAU,EAAE,UAAU;YACtB,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,SAAS,GAAG,CAAC,IAAc;IACzB,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;IAC5G,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,KAAK,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;IACpJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;AACtE,CAAC"}

package/dist/scripts/canary-gpu-hardware.js

@@ -0,0 +1,95 @@
+import { randomBytes } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { ResourceLedger } from "../src/control-plane/index.js";
+import { runCommand } from "../src/foundation/index.js";
+const docker = process.env.HITCH_DOCKER_PATH || "docker";
+const image = process.env.HITCH_GPU_CANARY_IMAGE;
+if (!image) {
+    process.stdout.write(`${JSON.stringify({
+        schema_version: "1", status: "unsupported", code: "gpu_canary_image_required",
+        message: "set HITCH_GPU_CANARY_IMAGE to a locally available CUDA image containing nvidia-smi",
+    }, null, 2)}\n`);
+    process.exitCode = 3;
+}
+else {
+    await runCanary(image);
+}
+async function runCanary(image) {
+    const nonce = randomBytes(8).toString("hex");
+    const containers = [];
+    const ledger = new ResourceLedger({ cpu_millis: 2_000, memory_bytes: 2 * 1024 ** 3, container_slots: 2, build_slots: 0, gpu_count: 1 });
+    const reports = [];
+    let gpuContentionBlocked = false;
+    try {
+        const imageInspection = JSON.parse((await command(["image", "inspect", "--format", "{{json .}}", image])).stdout);
+        if (typeof imageInspection.Id !== "string" || !/^sha256:[a-f0-9]{64}$/.test(imageInspection.Id))
+            throw new Error("GPU canary image identity is invalid");
+        for (const role of ["candidate", "separate-verifier"]) {
+            const allocation = ledger.tryAcquire(`gpu-${role}`, "eval", {
+                cpu_millis: 1_000, memory_bytes: 1024 ** 3, container_slots: 1, build_slots: 0, gpu_count: 1,
+            });
+            if (!allocation)
+                throw new Error(`GPU admission did not reserve ${role}`);
+            try {
+                if (role === "candidate") {
+                    const competing = ledger.tryAcquire("gpu-competing-trial", "eval", {
+                        cpu_millis: 1_000, memory_bytes: 1024 ** 3, container_slots: 1, build_slots: 0, gpu_count: 1,
+                    });
+                    gpuContentionBlocked = competing === null;
+                    competing?.release();
+                    if (!gpuContentionBlocked)
+                        throw new Error("GPU admission allowed two trials to consume one declared device");
+                }
+                const name = `hitch-gpu-${role}-${nonce}`;
+                const id = (await command([
+                    "container", "run", "--detach", "--name", name, "--gpus", "1",
+                    "--label", "io.hitch.canary=gpu-hardware-v1", "--label", `io.hitch.role=${role}`,
+                    image, "/bin/sh", "-c", "nvidia-smi --query-gpu=uuid,name --format=csv,noheader; sleep 1",
+                ], 30_000)).stdout.trim();
+                if (!/^[a-f0-9]{64}$/.test(id))
+                    throw new Error(`Docker returned an invalid ${role} container id`);
+                containers.push(id);
+                const exitCode = Number((await command(["container", "wait", id], 30_000)).stdout.trim());
+                if (exitCode !== 0)
+                    throw new Error(`${role} could not execute nvidia-smi (exit ${exitCode})`);
+                const logs = (await command(["container", "logs", id])).stdout.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+                if (logs.length !== 1 || logs.some((line) => !/^GPU-[A-Fa-f0-9-]+,\s*.+/.test(line)))
+                    throw new Error(`${role} did not receive exactly one usable GPU`);
+                const inspected = JSON.parse((await command(["container", "inspect", "--format", "{{json .HostConfig.DeviceRequests}}", id])).stdout);
+                if (!validSingleGpuDeviceRequest(inspected)) {
+                    throw new Error(`${role} did not receive an explicit Docker GPU device request`);
+                }
+                reports.push({ role, container_id: id, gpu_inventory: logs, device_request: inspected });
+            }
+            finally {
+                allocation.release();
+            }
+        }
+        if (Object.values(ledger.snapshot().allocated).some((value) => value !== 0))
+            throw new Error("GPU canary leaked a scheduler reservation");
+        process.stdout.write(`${JSON.stringify({
+            schema_version: "1", status: "passed", docker: (await command(["version", "--format", "{{.Server.Version}}"])).stdout.trim(),
+            image, image_id: imageInspection.Id, repo_digests: Array.isArray(imageInspection.RepoDigests) ? imageInspection.RepoDigests : [],
+            declared_gpu_capacity: 1, gpu_contention_blocked: gpuContentionBlocked,
+            gpu_count_per_role: reports[0]?.gpu_inventory.length ?? 0, roles: reports, ledger_released: true,
+        }, null, 2)}\n`);
+    }
+    finally {
+        for (const id of containers)
+            spawnSync(docker, ["container", "rm", "--force", id], { encoding: "utf8" });
+    }
+}
+function validSingleGpuDeviceRequest(value) {
+    if (!Array.isArray(value) || value.length !== 1)
+        return false;
+    const request = value[0];
+    if (!request || typeof request !== "object" || Array.isArray(request))
+        return false;
+    const record = request;
+    const exactlyOne = record.Count === 1 || Array.isArray(record.DeviceIDs) && record.DeviceIDs.length === 1;
+    return exactlyOne && JSON.stringify(record.Capabilities).toLowerCase().includes("gpu");
+}
+function command(args, timeoutMs = 15_000) {
+    return runCommand(docker, args, { env: process.env, timeoutMs, failureCode: "gpu_hardware_canary_failed" });
+}
+//# sourceMappingURL=canary-gpu-hardware.js.map

package/dist/scripts/canary-gpu-hardware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canary-gpu-hardware.js","sourceRoot":"","sources":["../../scripts/canary-gpu-hardware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAExD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,QAAQ,CAAC;AACzD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;AAEjD,IAAI,CAAC,KAAK,EAAE,CAAC;IACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;QACrC,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,2BAA2B;QAC7E,OAAO,EAAE,oFAAoF;KAC9F,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACjB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC;KAAM,CAAC;IACN,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,KAAa;IACpC,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;IACxI,MAAM,OAAO,GAAoG,EAAE,CAAC;IACpH,IAAI,oBAAoB,GAAG,KAAK,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAA4C,CAAC;QAC7J,IAAI,OAAO,eAAe,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACzJ,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,mBAAmB,CAAU,EAAE,CAAC;YAC/D,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,IAAI,EAAE,EAAE,MAAM,EAAE;gBAC1D,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,IAAI,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC;aAC7F,CAAC,CAAC;YACH,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,EAAE,CAAC,CAAC;YAC1E,IAAI,CAAC;gBACH,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;oBACzB,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,qBAAqB,EAAE,MAAM,EAAE;wBACjE,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,IAAI,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC;qBAC7F,CAAC,CAAC;oBACH,oBAAoB,GAAG,SAAS,KAAK,IAAI,CAAC;oBAC1C,SAAS,EAAE,OAAO,EAAE,CAAC;oBACrB,IAAI,CAAC,oBAAoB;wBAAE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;gBAChH,CAAC;gBACD,MAAM,IAAI,GAAG,aAAa,IAAI,IAAI,KAAK,EAAE,CAAC;gBAC1C,MAAM,EAAE,GAAG,CAAC,MAAM,OAAO,CAAC;oBACxB,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG;oBAC7D,SAAS,EAAE,iCAAiC,EAAE,SAAS,EAAE,iBAAiB,IAAI,EAAE;oBAChF,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,iEAAiE;iBAC1F,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC1B,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,eAAe,CAAC,CAAC;gBACnG,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACpB,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,MAAM,OAAO,CAAC,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC1F,IAAI,QAAQ,KAAK,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,uCAAuC,QAAQ,GAAG,CAAC,CAAC;gBAC/F,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBACzH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,yCAAyC,CAAC,CAAC;gBACxJ,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,CAAC,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,qCAAqC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAY,CAAC;gBACjJ,IAAI,CAAC,2BAA2B,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC5C,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,wDAAwD,CAAC,CAAC;gBACnF,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC;YAC3F,CAAC;oBAAS,CAAC;gBACT,UAAU,CAAC,OAAO,EAAE,CAAC;YACvB,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC1I,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;YACrC,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,MAAM,OAAO,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;YAC5H,KAAK,EAAE,QAAQ,EAAE,eAAe,CAAC,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE;YAChI,qBAAqB,EAAE,CAAC,EAAE,sBAAsB,EAAE,oBAAoB;YACtE,kBAAkB,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,MAAM,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI;SACjG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;YAAS,CAAC;QACT,KAAK,MAAM,EAAE,IAAI,UAAU;YAAE,SAAS,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3G,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B,CAAC,KAAc;IACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACpF,MAAM,MAAM,GAAG,OAAkC,CAAC;IAClD,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC;IAC1G,OAAO,UAAU,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzF,CAAC;AAED,SAAS,OAAO,CAAC,IAAc,EAAE,SAAS,GAAG,MAAM;IACjD,OAAO,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,WAAW,EAAE,4BAA4B,EAAE,CAAC,CAAC;AAC9G,CAAC"}