agent-hitch 0.2.6 → 0.2.8

package/dist/scripts/canary-docker-image-observation.js

@@ -0,0 +1,181 @@
+import { createHash, randomBytes } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { dockerOwnershipLabelMap, startDockerResourceObserver } from "../src/evals/index.js";
+import { verifyTrialEnvironmentImageExecution } from "../src/evals/trial-environment-evidence.js";
+const docker = process.env.HITCH_DOCKER_PATH || "docker";
+const base = process.env.HITCH_DOCKER_CANARY_BASE || "ubuntu:24.04";
+const platform = process.env.HITCH_DOCKER_CANARY_PLATFORM || "linux/amd64";
+const nonce = randomBytes(8).toString("hex");
+const temporary = await mkdtemp(path.join(tmpdir(), "hitch-docker-image-canary-"));
+const context = path.join(temporary, "context");
+const roles = ["main", "sidecar", "verifier"];
+const tags = Object.fromEntries(roles.map((role) => [role, `hitch-image-observation-canary-${role}:${nonce}`]));
+const containers = [];
+let exportContainer;
+const ownership = {
+    root_id: randomBytes(12).toString("hex"),
+    provider: "local-docker",
+    eval_id: `eval_${randomBytes(16).toString("hex")}`,
+    work_id: `work_${randomBytes(16).toString("hex")}`,
+    lease_id: `lease_${randomBytes(16).toString("hex")}`,
+    lease_epoch: 1,
+    task_id: "docker-image-observation-canary",
+};
+try {
+    await mkdir(context);
+    const baseInspect = run(["image", "inspect", "--format", "{{.Id}} {{.Os}}/{{.Architecture}}", base]);
+    const [baseIdentity, basePlatform] = baseInspect.stdout.trim().split(" ");
+    if (!baseIdentity || !/^sha256:[a-f0-9]{64}$/.test(baseIdentity) || basePlatform !== platform) {
+        throw new Error(`local canary base platform does not match ${platform}`);
+    }
+    exportContainer = run(["create", "--platform", platform, base]).stdout.trim();
+    if (!/^[a-f0-9]{64}$/.test(exportContainer))
+        throw new Error("Docker returned an invalid temporary container id");
+    run(["export", "--output", path.join(context, "rootfs.tar"), exportContainer]);
+    run(["container", "rm", exportContainer]);
+    exportContainer = undefined;
+    await writeFile(path.join(context, "Dockerfile"), [
+        "FROM scratch",
+        "ADD rootfs.tar /",
+        "ARG HITCH_CANARY_ROLE",
+        "LABEL io.hitch.canary-role=$HITCH_CANARY_ROLE",
+        "ENTRYPOINT [\"/bin/sh\", \"-c\", \"i=0; while [ \\\"$i\\\" -lt 50000 ]; do i=$((i+1)); done; while :; do sleep 1; done\"]",
+        "",
+    ].join("\n"));
+    const expected = new Map();
+    for (const role of roles) {
+        run([
+            "buildx", "build", "--load", "--provenance=false", "--progress", "plain",
+            "--platform", platform,
+            "--build-arg", `HITCH_CANARY_ROLE=${role}`,
+            "--tag", tags[role],
+            context,
+        ]);
+        const digest = run(["image", "inspect", "--format", "{{.Id}}", tags[role]]).stdout.trim();
+        if (!/^sha256:[a-f0-9]{64}$/.test(digest))
+            throw new Error(`Docker returned an invalid ${role} config digest`);
+        expected.set(role, digest);
+    }
+    if (new Set(expected.values()).size !== roles.length)
+        throw new Error("canary role images do not have distinct config digests");
+    const labels = dockerOwnershipLabelMap(ownership);
+    for (const role of roles) {
+        const args = ["container", "run", "--detach", "--name", `hitch-image-canary-${role}-${nonce}`];
+        for (const [name, value] of Object.entries(labels))
+            args.push("--label", `${name}=${value}`);
+        args.push(tags[role]);
+        const id = run(args).stdout.trim();
+        if (!/^[a-f0-9]{64}$/.test(id))
+            throw new Error(`Docker returned an invalid ${role} container id`);
+        containers.push(id);
+    }
+    const observer = startDockerResourceObserver({
+        ownership,
+        workerId: "canary-worker",
+        collisionDomainId: "canary-docker-engine",
+        reservation: { cpu_millis: 1_000, memory_bytes: 128 * 1024 * 1024, container_slots: 3, build_slots: 0 },
+        mainLimits: { cpu_millis: 500, memory_bytes: 64 * 1024 * 1024, container_slots: 1, build_slots: 0 },
+        sidecarLimits: { sidecar: { cpu_millis: 250, memory_bytes: 32 * 1024 * 1024 }, verifier: { cpu_millis: 250, memory_bytes: 32 * 1024 * 1024 } },
+        intervalMs: 60_000,
+    });
+    const execution = await observer.capture();
+    await observer.stop();
+    if (execution.observed.containers.length !== roles.length)
+        throw new Error("observer did not capture all canary containers");
+    const actual = new Map();
+    const cpuTimes = new Map();
+    const peakMemory = new Map();
+    for (const container of execution.observed.containers) {
+        const role = roles.find((entry) => container.name?.includes(`-${entry}-${nonce}`));
+        if (!role || !container.image_config_digest)
+            throw new Error("observer returned incomplete role image evidence");
+        if (!Number.isSafeInteger(container.cpu_time_ns) || container.cpu_time_ns <= 0)
+            throw new Error(`observer did not record cumulative ${role} CPU time`);
+        if (!Number.isSafeInteger(container.peak_memory_bytes) || container.peak_memory_bytes <= 0)
+            throw new Error(`observer did not record peak ${role} memory`);
+        actual.set(role, container.image_config_digest);
+        cpuTimes.set(role, container.cpu_time_ns);
+        peakMemory.set(role, container.peak_memory_bytes);
+    }
+    for (const role of roles)
+        if (actual.get(role) !== expected.get(role))
+            throw new Error(`observer recorded the wrong ${role} config digest`);
+    const evidence = trialEvidence(expected);
+    verifyTrialEnvironmentImageExecution(execution, evidence);
+    const forged = structuredClone(evidence);
+    const verifier = forged.manifests.find((entry) => entry.output.reference.includes("verifier"));
+    if (!verifier)
+        throw new Error("canary verifier manifest is missing");
+    verifier.output.config_digest = sha256("forged-verifier-config");
+    let rejected = false;
+    try {
+        verifyTrialEnvironmentImageExecution(execution, forged);
+    }
+    catch (error) {
+        rejected = error.code === "environment_image_mismatch";
+    }
+    if (!rejected)
+        throw new Error("forged verifier image digest was not rejected");
+    process.stdout.write(`${JSON.stringify({
+        ok: true,
+        docker: run(["version", "--format", "{{.Server.Version}}"]).stdout.trim(),
+        compose: run(["compose", "version", "--short"]).stdout.trim(),
+        platform,
+        observed_config_digests: Object.fromEntries(roles.map((role) => [role, expected.get(role)])),
+        observed_cpu_time_ns: Object.fromEntries(roles.map((role) => [role, cpuTimes.get(role)])),
+        observed_peak_memory_bytes: Object.fromEntries(roles.map((role) => [role, peakMemory.get(role)])),
+        forged_verifier_digest_rejected: true,
+    }, null, 2)}\n`);
+}
+finally {
+    for (const id of containers)
+        spawnSync(docker, ["container", "rm", "--force", id], { encoding: "utf8" });
+    if (exportContainer)
+        spawnSync(docker, ["container", "rm", "--force", exportContainer], { encoding: "utf8" });
+    for (const role of roles)
+        spawnSync(docker, ["image", "rm", tags[role]], { encoding: "utf8" });
+    await rm(temporary, { recursive: true, force: true });
+}
+function trialEvidence(configs) {
+    const createdAt = new Date().toISOString();
+    const manifests = roles.map((role) => {
+        const manifestDigest = sha256(`manifest:${role}`);
+        return {
+            schema_version: "1",
+            image_id: sha256(`image:${role}`),
+            source: { kind: "registry", benchmark_id: "canary", benchmark_revision: "1", task_id: ownership.task_id },
+            platform,
+            build: { builder: "buildkit", frontend: "registry-resolution", secret_names: [], cache_key: sha256(`cache:${role}`) },
+            output: { reference: `canary/${role}@${manifestDigest}`, manifest_digest: manifestDigest, config_digest: configs.get(role) },
+            base_images: [],
+            created_at: createdAt,
+        };
+    });
+    return {
+        manifests,
+        uses: manifests.map((manifest, index) => ({
+            task_ids: [ownership.task_id],
+            image_id: manifest.image_id,
+            requested_reference: `canary/${roles[index]}:mutable`,
+            reference: manifest.output.reference,
+            manifest_digest: manifest.output.manifest_digest,
+            platform,
+            resolution: "registry",
+            cache_hit: false,
+        })),
+    };
+}
+function sha256(value) {
+    return `sha256:${createHash("sha256").update(value).digest("hex")}`;
+}
+function run(args) {
+    const result = spawnSync(docker, args, { encoding: "utf8", env: process.env, maxBuffer: 64 * 1024 * 1024 });
+    if (result.status !== 0) {
+        throw new Error(`Docker command failed (${args.slice(0, 2).join(" ")}): ${`${result.stderr || ""}\n${result.stdout || ""}`.slice(0, 64 * 1024)}`);
+    }
+    return { stdout: result.stdout || "", stderr: result.stderr || "" };
+}
+//# sourceMappingURL=canary-docker-image-observation.js.map

package/dist/scripts/canary-docker-image-observation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canary-docker-image-observation.js","sourceRoot":"","sources":["../../scripts/canary-docker-image-observation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,uBAAuB,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAC7F,OAAO,EAAE,oCAAoC,EAAE,MAAM,4CAA4C,CAAC;AAElG,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,QAAQ,CAAC;AACzD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,cAAc,CAAC;AACpE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,aAAa,CAAC;AAC3E,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC7C,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,4BAA4B,CAAC,CAAC,CAAC;AACnF,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AAChD,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,CAAU,CAAC;AACvD,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,kCAAkC,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAyC,CAAC;AACxJ,MAAM,UAAU,GAAa,EAAE,CAAC;AAChC,IAAI,eAAmC,CAAC;AAExC,MAAM,SAAS,GAAG;IAChB,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;IACxC,QAAQ,EAAE,cAAuB;IACjC,OAAO,EAAE,QAAQ,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;IAClD,OAAO,EAAE,QAAQ,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;IAClD,QAAQ,EAAE,SAAS,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;IACpD,WAAW,EAAE,CAAC;IACd,OAAO,EAAE,iCAAiC;CAC3C,CAAC;AAEF,IAAI,CAAC;IACH,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;IACrB,MAAM,WAAW,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,mCAAmC,EAAE,IAAI,CAAC,CAAC,CAAC;IACrG,MAAM,CAAC,YAAY,EAAE,YAAY,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1E,IAAI,CAAC,YAAY,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,YAAY,KAAK,QAAQ,EAAE,CAAC;QAC9F,MAAM,IAAI,KAAK,CAAC,6CAA6C,QAAQ,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,eAAe,GAAG,GAAG,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9E,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,eAAe,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IAClH,GAAG,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC;IAC/E,GAAG,CAAC,CAAC,WAAW,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC;IAC1C,eAAe,GAAG,SAAS,CAAC;IAC5B,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE;QAChD,cAAc;QACd,kBAAkB;QAClB,uBAAuB;QACvB,+CAA+C;QAC/C,2HAA2H;QAC3H,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAEd,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,GAAG,CAAC;YACF,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,YAAY,EAAE,OAAO;YACxE,YAAY,EAAE,QAAQ;YACtB,aAAa,EAAE,qBAAqB,IAAI,EAAE;YAC1C,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC;YACnB,OAAO;SACR,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC1F,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,gBAAgB,CAAC,CAAC;QAC/G,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,MAAgB,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAEhI,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAAC,CAAC;IAClD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,sBAAsB,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC;QAC/F,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC;QAC7F,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACtB,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,eAAe,CAAC,CAAC;QACnG,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtB,CAAC;IAED,MAAM,QAAQ,GAAG,2BAA2B,CAAC;QAC3C,SAAS;QACT,QAAQ,EAAE,eAAe;QACzB,iBAAiB,EAAE,sBAAsB;QACzC,WAAW,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI,EAAE,eAAe,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE;QACvG,UAAU,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,YAAY,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,eAAe,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE;QACnG,aAAa,EAAE,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,YAAY,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,YAAY,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE;QAC9I,UAAU,EAAE,MAAM;KACnB,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;IAC3C,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACtB,IAAI,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IAE7H,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,KAAK,MAAM,SAAS,IAAI,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;QACtD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,KAAK,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;QACnF,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,mBAAmB;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACjH,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,WAAW,CAAC,IAAK,SAAS,CAAC,WAAsB,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,IAAI,WAAW,CAAC,CAAC;QACnK,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,iBAAiB,CAAC,IAAK,SAAS,CAAC,iBAA4B,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,SAAS,CAAC,CAAC;QACvK,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,mBAAmB,CAAC,CAAC;QAChD,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,WAAqB,CAAC,CAAC;QACpD,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,iBAA2B,CAAC,CAAC;IAC9D,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,gBAAgB,CAAC,CAAC;IAE5I,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACzC,oCAAoC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;IAC/F,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACtE,QAAQ,CAAC,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,wBAAwB,CAAC,CAAC;IACjE,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,CAAC;QAAC,oCAAoC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;IAChE,OAAO,KAAK,EAAE,CAAC;QAAC,QAAQ,GAAI,KAA2B,CAAC,IAAI,KAAK,4BAA4B,CAAC;IAAC,CAAC;IAChG,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAEhF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;QACrC,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,GAAG,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,qBAAqB,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;QACzE,OAAO,EAAE,GAAG,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;QAC7D,QAAQ;QACR,uBAAuB,EAAE,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5F,oBAAoB,EAAE,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzF,0BAA0B,EAAE,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjG,+BAA+B,EAAE,IAAI;KACtC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AACnB,CAAC;QAAS,CAAC;IACT,KAAK,MAAM,EAAE,IAAI,UAAU;QAAE,SAAS,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACzG,IAAI,eAAe;QAAE,SAAS,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9G,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,SAAS,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/F,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,aAAa,CAAC,OAAoC;IACzD,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAA8B,EAAE;QAC/D,MAAM,cAAc,GAAG,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;QAClD,OAAO;YACL,cAAc,EAAE,GAAG;YACnB,QAAQ,EAAE,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;YACjC,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,kBAAkB,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE;YACzG,QAAQ;YACR,KAAK,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,qBAAqB,EAAE,YAAY,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE;YACrH,MAAM,EAAE,EAAE,SAAS,EAAE,UAAU,IAAI,IAAI,cAAc,EAAE,EAAE,eAAe,EAAE,cAAc,EAAE,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAW,EAAE;YACtI,WAAW,EAAE,EAAE;YACf,UAAU,EAAE,SAAS;SACtB,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,OAAO;QACL,SAAS;QACT,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAyB,EAAE,CAAC,CAAC;YAC/D,QAAQ,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC;YAC7B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,mBAAmB,EAAE,UAAU,KAAK,CAAC,KAAK,CAAC,UAAU;YACrD,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS;YACpC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,eAAe;YAChD,QAAQ;YACR,UAAU,EAAE,UAAU;YACtB,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,SAAS,GAAG,CAAC,IAAc;IACzB,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;IAC5G,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,KAAK,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;IACpJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;AACtE,CAAC"}

package/dist/scripts/canary-eval-scheduler-throughput.js

@@ -0,0 +1,47 @@
+import assert from "node:assert/strict";
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { replaySchedulerTrace } from "../src/evals/index.js";
+const fixturePath = path.resolve("test", "fixtures", "eval-scheduler-throughput-trace.json");
+const fixture = JSON.parse(await readFile(fixturePath, "utf8"));
+assert.equal(fixture.schema_version, "1");
+assert.equal(fixture.source.physical_trials, 142);
+assert.equal(fixture.work.length, fixture.source.physical_trials);
+assert.equal(fixture.work.reduce((sum, work) => sum + work.duration_ms, 0), 154_958_000);
+const phases = ["seed-baseline", "seed-candidate", "heldout-baseline", "heldout-candidate"];
+const replay = (selected, policy, retryScheduling) => replaySchedulerTrace(fixture.work.filter((work) => selected.includes(work.phase)).map((work) => ({
+    ...work,
+    task_id: `${work.phase}:${work.task_id}`,
+})), { slots: fixture.slots, policy, retryScheduling });
+const phaseResults = Object.fromEntries(phases.map((phase) => [phase, {
+        fifo_batch_ms: replay([phase], "fifo-v1", "batch-v1").makespan_ms,
+        critical_path_batch_ms: replay([phase], "critical-path-v1", "batch-v1").makespan_ms,
+        critical_path_immediate_ms: replay([phase], "critical-path-v1", "immediate-v1").makespan_ms,
+    }]));
+const value = (phase, field) => phaseResults[phase][field];
+const fifoBatchMs = fixture.meta_agent_duration_ms + phases.reduce((sum, phase) => sum + value(phase, "fifo_batch_ms"), 0);
+const criticalPathImmediateMs = fixture.meta_agent_duration_ms + phases.reduce((sum, phase) => sum + value(phase, "critical_path_immediate_ms"), 0);
+const firstRunMs = replay(["seed-baseline", "heldout-baseline"], "critical-path-v1", "immediate-v1").makespan_ms
+    + fixture.meta_agent_duration_ms
+    + value("seed-candidate", "critical_path_immediate_ms")
+    + value("heldout-candidate", "critical_path_immediate_ms");
+const candidateOnlyMs = fixture.meta_agent_duration_ms
+    + value("seed-candidate", "critical_path_immediate_ms")
+    + value("heldout-candidate", "critical_path_immediate_ms");
+assert.ok(fifoBatchMs <= 555 * 60_000, `FIFO/barrier baseline exceeded 555 minutes: ${minutes(fifoBatchMs)}`);
+assert.ok(criticalPathImmediateMs <= 475 * 60_000, `critical-path/immediate replay exceeded 475 minutes: ${minutes(criticalPathImmediateMs)}`);
+assert.ok(firstRunMs <= 425 * 60_000, `first-run replay exceeded 425 minutes: ${minutes(firstRunMs)}`);
+assert.ok(candidateOnlyMs <= 240 * 60_000, `Candidate-only replay exceeded 240 minutes: ${minutes(candidateOnlyMs)}`);
+assert.ok(phases.every((phase) => replay([phase], "critical-path-v1", "immediate-v1").runnable_idle_ms === 0));
+process.stdout.write(`${JSON.stringify({
+    schema_version: "1",
+    source: fixture.source,
+    slots: fixture.slots,
+    fifo_batch_minutes: minutes(fifoBatchMs),
+    critical_path_immediate_minutes: minutes(criticalPathImmediateMs),
+    first_run_minutes: minutes(firstRunMs),
+    candidate_only_minutes: minutes(candidateOnlyMs),
+    phase_results: Object.fromEntries(Object.entries(phaseResults).map(([phase, result]) => [phase, Object.fromEntries(Object.entries(result).map(([key, duration]) => [key.replace("_ms", "_minutes"), minutes(duration)]))])),
+}, null, 2)}\n`);
+function minutes(durationMs) { return Math.round(durationMs / 600) / 100; }
+//# sourceMappingURL=canary-eval-scheduler-throughput.js.map

package/dist/scripts/canary-eval-scheduler-throughput.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canary-eval-scheduler-throughput.js","sourceRoot":"","sources":["../../scripts/canary-eval-scheduler-throughput.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAA6B,MAAM,uBAAuB,CAAC;AAUxF,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,sCAAsC,CAAC,CAAC;AAC7F,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAmB,CAAC;AAClF,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;AAC1C,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;AAClD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;AAClE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;AAEzF,MAAM,MAAM,GAAG,CAAC,eAAe,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,mBAAmB,CAAU,CAAC;AACrG,MAAM,MAAM,GAAG,CAAC,QAA2B,EAAE,MAAsC,EAAE,eAA4C,EAAE,EAAE,CAAC,oBAAoB,CACxJ,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC1E,GAAG,IAAI;IACP,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE;CACzC,CAAC,CAAC,EACH,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAClD,CAAC;AACF,MAAM,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE;QACpE,aAAa,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,WAAW;QACjE,sBAAsB,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,kBAAkB,EAAE,UAAU,CAAC,CAAC,WAAW;QACnF,0BAA0B,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,kBAAkB,EAAE,cAAc,CAAC,CAAC,WAAW;KAC5F,CAAC,CAAC,CAAC,CAAC;AACL,MAAM,KAAK,GAAG,CAAC,KAA4B,EAAE,KAA0C,EAAU,EAAE,CAAC,YAAY,CAAC,KAAK,CAAE,CAAC,KAAK,CAAC,CAAC;AAChI,MAAM,WAAW,GAAG,OAAO,CAAC,sBAAsB,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,GAAG,KAAK,CAAC,KAAK,EAAE,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC;AAC3H,MAAM,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,GAAG,KAAK,CAAC,KAAK,EAAE,4BAA4B,CAAC,EAAE,CAAC,CAAC,CAAC;AACpJ,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,eAAe,EAAE,kBAAkB,CAAC,EAAE,kBAAkB,EAAE,cAAc,CAAC,CAAC,WAAW;MAC5G,OAAO,CAAC,sBAAsB;MAC9B,KAAK,CAAC,gBAAgB,EAAE,4BAA4B,CAAC;MACrD,KAAK,CAAC,mBAAmB,EAAE,4BAA4B,CAAC,CAAC;AAC7D,MAAM,eAAe,GAAG,OAAO,CAAC,sBAAsB;MAClD,KAAK,CAAC,gBAAgB,EAAE,4BAA4B,CAAC;MACrD,KAAK,CAAC,mBAAmB,EAAE,4BAA4B,CAAC,CAAC;AAE7D,MAAM,CAAC,EAAE,CAAC,WAAW,IAAI,GAAG,GAAG,MAAM,EAAE,+CAA+C,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;AAC9G,MAAM,CAAC,EAAE,CAAC,uBAAuB,IAAI,GAAG,GAAG,MAAM,EAAE,wDAAwD,OAAO,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC;AAC/I,MAAM,CAAC,EAAE,CAAC,UAAU,IAAI,GAAG,GAAG,MAAM,EAAE,0CAA0C,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;AACvG,MAAM,CAAC,EAAE,CAAC,eAAe,IAAI,GAAG,GAAG,MAAM,EAAE,+CAA+C,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;AACtH,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,kBAAkB,EAAE,cAAc,CAAC,CAAC,gBAAgB,KAAK,CAAC,CAAC,CAAC,CAAC;AAE/G,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;IACrC,cAAc,EAAE,GAAG;IACnB,MAAM,EAAE,OAAO,CAAC,MAAM;IACtB,KAAK,EAAE,OAAO,CAAC,KAAK;IACpB,kBAAkB,EAAE,OAAO,CAAC,WAAW,CAAC;IACxC,+BAA+B,EAAE,OAAO,CAAC,uBAAuB,CAAC;IACjE,iBAAiB,EAAE,OAAO,CAAC,UAAU,CAAC;IACtC,sBAAsB,EAAE,OAAO,CAAC,eAAe,CAAC;IAChD,aAAa,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,WAAW,CAChH,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CACrG,CAAC,CAAC,CAAC;CACL,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AAEjB,SAAS,OAAO,CAAC,UAAkB,IAAY,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC"}

package/dist/scripts/canary-gpu-hardware.js

@@ -0,0 +1,95 @@
+import { randomBytes } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { ResourceLedger } from "../src/control-plane/index.js";
+import { runCommand } from "../src/foundation/index.js";
+const docker = process.env.HITCH_DOCKER_PATH || "docker";
+const image = process.env.HITCH_GPU_CANARY_IMAGE;
+if (!image) {
+    process.stdout.write(`${JSON.stringify({
+        schema_version: "1", status: "unsupported", code: "gpu_canary_image_required",
+        message: "set HITCH_GPU_CANARY_IMAGE to a locally available CUDA image containing nvidia-smi",
+    }, null, 2)}\n`);
+    process.exitCode = 3;
+}
+else {
+    await runCanary(image);
+}
+async function runCanary(image) {
+    const nonce = randomBytes(8).toString("hex");
+    const containers = [];
+    const ledger = new ResourceLedger({ cpu_millis: 2_000, memory_bytes: 2 * 1024 ** 3, container_slots: 2, build_slots: 0, gpu_count: 1 });
+    const reports = [];
+    let gpuContentionBlocked = false;
+    try {
+        const imageInspection = JSON.parse((await command(["image", "inspect", "--format", "{{json .}}", image])).stdout);
+        if (typeof imageInspection.Id !== "string" || !/^sha256:[a-f0-9]{64}$/.test(imageInspection.Id))
+            throw new Error("GPU canary image identity is invalid");
+        for (const role of ["candidate", "separate-verifier"]) {
+            const allocation = ledger.tryAcquire(`gpu-${role}`, "eval", {
+                cpu_millis: 1_000, memory_bytes: 1024 ** 3, container_slots: 1, build_slots: 0, gpu_count: 1,
+            });
+            if (!allocation)
+                throw new Error(`GPU admission did not reserve ${role}`);
+            try {
+                if (role === "candidate") {
+                    const competing = ledger.tryAcquire("gpu-competing-trial", "eval", {
+                        cpu_millis: 1_000, memory_bytes: 1024 ** 3, container_slots: 1, build_slots: 0, gpu_count: 1,
+                    });
+                    gpuContentionBlocked = competing === null;
+                    competing?.release();
+                    if (!gpuContentionBlocked)
+                        throw new Error("GPU admission allowed two trials to consume one declared device");
+                }
+                const name = `hitch-gpu-${role}-${nonce}`;
+                const id = (await command([
+                    "container", "run", "--detach", "--name", name, "--gpus", "1",
+                    "--label", "io.hitch.canary=gpu-hardware-v1", "--label", `io.hitch.role=${role}`,
+                    image, "/bin/sh", "-c", "nvidia-smi --query-gpu=uuid,name --format=csv,noheader; sleep 1",
+                ], 30_000)).stdout.trim();
+                if (!/^[a-f0-9]{64}$/.test(id))
+                    throw new Error(`Docker returned an invalid ${role} container id`);
+                containers.push(id);
+                const exitCode = Number((await command(["container", "wait", id], 30_000)).stdout.trim());
+                if (exitCode !== 0)
+                    throw new Error(`${role} could not execute nvidia-smi (exit ${exitCode})`);
+                const logs = (await command(["container", "logs", id])).stdout.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+                if (logs.length !== 1 || logs.some((line) => !/^GPU-[A-Fa-f0-9-]+,\s*.+/.test(line)))
+                    throw new Error(`${role} did not receive exactly one usable GPU`);
+                const inspected = JSON.parse((await command(["container", "inspect", "--format", "{{json .HostConfig.DeviceRequests}}", id])).stdout);
+                if (!validSingleGpuDeviceRequest(inspected)) {
+                    throw new Error(`${role} did not receive an explicit Docker GPU device request`);
+                }
+                reports.push({ role, container_id: id, gpu_inventory: logs, device_request: inspected });
+            }
+            finally {
+                allocation.release();
+            }
+        }
+        if (Object.values(ledger.snapshot().allocated).some((value) => value !== 0))
+            throw new Error("GPU canary leaked a scheduler reservation");
+        process.stdout.write(`${JSON.stringify({
+            schema_version: "1", status: "passed", docker: (await command(["version", "--format", "{{.Server.Version}}"])).stdout.trim(),
+            image, image_id: imageInspection.Id, repo_digests: Array.isArray(imageInspection.RepoDigests) ? imageInspection.RepoDigests : [],
+            declared_gpu_capacity: 1, gpu_contention_blocked: gpuContentionBlocked,
+            gpu_count_per_role: reports[0]?.gpu_inventory.length ?? 0, roles: reports, ledger_released: true,
+        }, null, 2)}\n`);
+    }
+    finally {
+        for (const id of containers)
+            spawnSync(docker, ["container", "rm", "--force", id], { encoding: "utf8" });
+    }
+}
+function validSingleGpuDeviceRequest(value) {
+    if (!Array.isArray(value) || value.length !== 1)
+        return false;
+    const request = value[0];
+    if (!request || typeof request !== "object" || Array.isArray(request))
+        return false;
+    const record = request;
+    const exactlyOne = record.Count === 1 || Array.isArray(record.DeviceIDs) && record.DeviceIDs.length === 1;
+    return exactlyOne && JSON.stringify(record.Capabilities).toLowerCase().includes("gpu");
+}
+function command(args, timeoutMs = 15_000) {
+    return runCommand(docker, args, { env: process.env, timeoutMs, failureCode: "gpu_hardware_canary_failed" });
+}
+//# sourceMappingURL=canary-gpu-hardware.js.map

package/dist/scripts/canary-gpu-hardware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canary-gpu-hardware.js","sourceRoot":"","sources":["../../scripts/canary-gpu-hardware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAExD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,QAAQ,CAAC;AACzD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;AAEjD,IAAI,CAAC,KAAK,EAAE,CAAC;IACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;QACrC,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,2BAA2B;QAC7E,OAAO,EAAE,oFAAoF;KAC9F,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACjB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC;KAAM,CAAC;IACN,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,KAAa;IACpC,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;IACxI,MAAM,OAAO,GAAoG,EAAE,CAAC;IACpH,IAAI,oBAAoB,GAAG,KAAK,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAA4C,CAAC;QAC7J,IAAI,OAAO,eAAe,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACzJ,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,mBAAmB,CAAU,EAAE,CAAC;YAC/D,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,IAAI,EAAE,EAAE,MAAM,EAAE;gBAC1D,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,IAAI,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC;aAC7F,CAAC,CAAC;YACH,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,EAAE,CAAC,CAAC;YAC1E,IAAI,CAAC;gBACH,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;oBACzB,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,qBAAqB,EAAE,MAAM,EAAE;wBACjE,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,IAAI,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC;qBAC7F,CAAC,CAAC;oBACH,oBAAoB,GAAG,SAAS,KAAK,IAAI,CAAC;oBAC1C,SAAS,EAAE,OAAO,EAAE,CAAC;oBACrB,IAAI,CAAC,oBAAoB;wBAAE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;gBAChH,CAAC;gBACD,MAAM,IAAI,GAAG,aAAa,IAAI,IAAI,KAAK,EAAE,CAAC;gBAC1C,MAAM,EAAE,GAAG,CAAC,MAAM,OAAO,CAAC;oBACxB,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG;oBAC7D,SAAS,EAAE,iCAAiC,EAAE,SAAS,EAAE,iBAAiB,IAAI,EAAE;oBAChF,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,iEAAiE;iBAC1F,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC1B,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,eAAe,CAAC,CAAC;gBACnG,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACpB,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,MAAM,OAAO,CAAC,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC1F,IAAI,QAAQ,KAAK,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,uCAAuC,QAAQ,GAAG,CAAC,CAAC;gBAC/F,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBACzH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,yCAAyC,CAAC,CAAC;gBACxJ,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,CAAC,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,qCAAqC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAY,CAAC;gBACjJ,IAAI,CAAC,2BAA2B,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC5C,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,wDAAwD,CAAC,CAAC;gBACnF,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC;YAC3F,CAAC;oBAAS,CAAC;gBACT,UAAU,CAAC,OAAO,EAAE,CAAC;YACvB,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC1I,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;YACrC,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,MAAM,OAAO,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;YAC5H,KAAK,EAAE,QAAQ,EAAE,eAAe,CAAC,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE;YAChI,qBAAqB,EAAE,CAAC,EAAE,sBAAsB,EAAE,oBAAoB;YACtE,kBAAkB,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,MAAM,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI;SACjG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;YAAS,CAAC;QACT,KAAK,MAAM,EAAE,IAAI,UAAU;YAAE,SAAS,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3G,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B,CAAC,KAAc;IACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACpF,MAAM,MAAM,GAAG,OAAkC,CAAC;IAClD,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC;IAC1G,OAAO,UAAU,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzF,CAAC;AAED,SAAS,OAAO,CAAC,IAAc,EAAE,SAAS,GAAG,MAAM;IACjD,OAAO,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,WAAW,EAAE,4BAA4B,EAAE,CAAC,CAAC;AAC9G,CAAC"}