chainlesschain 0.166.20 → 0.166.22

package/src/lib/evolution/evolution-artifact-ports.js

@@ -71,6 +71,15 @@ export const EVOLUTION_ARTIFACT_LEDGER_RETENTION_TYPES = Object.freeze([
   "skill-registry-transition-request",
   "skill-registry-transition-settlement",
   "evolution-run-event",
+  "evolution-release-train-checkpoint",
+  "evolvable-artifact-candidate",
+  "evolvable-artifact-transition",
+  "evolution-workbench-metrics-receipt-retention",
+  "evolution-workbench-metrics-snapshot",
+  "governed-knowledge-sync-record",
+  "governed-knowledge-merge-operation",
+  "governed-knowledge-dependency-operation",
+  "governed-knowledge-trust-record",
   "structured-memory-authority-receipt",
   "structured-memory-event",
   "structured-memory-snapshot",
@@ -100,6 +109,15 @@ export const EVOLUTION_ARTIFACT_TYPES = Object.freeze([
   "evaluation",
   "evaluation-result",
   "evolution-run-event",
+  "evolution-release-train-checkpoint",
+  "evolvable-artifact-candidate",
+  "evolvable-artifact-transition",
+  "evolution-workbench-metrics-receipt-retention",
+  "evolution-workbench-metrics-snapshot",
+  "governed-knowledge-sync-record",
+  "governed-knowledge-merge-operation",
+  "governed-knowledge-dependency-operation",
+  "governed-knowledge-trust-record",
   "evidence",
   "model-projection",
   "policy",
@@ -307,6 +325,18 @@ const LEDGER_RETENTION_PURPOSES_BY_TYPE = new Map([
   ["skill-registry-transition-request", new Set(["evolution-ledger"])],
   ["skill-registry-transition-settlement", new Set(["evolution-ledger"])],
   ["evolution-run-event", new Set(["evolution-ledger"])],
+  ["evolution-release-train-checkpoint", new Set(["evolution-ledger"])],
+  ["evolvable-artifact-candidate", new Set(["evolution-ledger"])],
+  ["evolvable-artifact-transition", new Set(["evolution-ledger"])],
+  [
+    "evolution-workbench-metrics-receipt-retention",
+    new Set(["evolution-ledger"]),
+  ],
+  ["evolution-workbench-metrics-snapshot", new Set(["evolution-ledger"])],
+  ["governed-knowledge-sync-record", new Set(["evolution-ledger"])],
+  ["governed-knowledge-merge-operation", new Set(["evolution-ledger"])],
+  ["governed-knowledge-dependency-operation", new Set(["evolution-ledger"])],
+  ["governed-knowledge-trust-record", new Set(["evolution-ledger"])],
   ["wiki-revision", new Set(["evolution-ledger"])],
   ["structured-memory-authority-receipt", new Set(["evolution-ledger"])],
   ["structured-memory-event", new Set(["evolution-ledger"])],

package/src/lib/evolution/evolution-deployment-loader.js

@@ -0,0 +1,208 @@
+import { createHash, createPublicKey, verify } from "node:crypto";
+import { readFile, realpath } from "node:fs/promises";
+import { isAbsolute } from "node:path";
+import { types as utilTypes } from "node:util";
+
+export const EVOLUTION_DEPLOYMENT_DESCRIPTOR_SCHEMA =
+  "chainlesschain.evolution-deployment-descriptor/v1";
+
+const DIGEST = /^sha256:[a-f0-9]{64}$/u;
+const SUPPORTED_COMMANDS = new Set(["agent", "evolution", "serve"]);
+
+function canonical(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
+  return `{${Object.keys(value)
+    .sort()
+    .map((key) => `${JSON.stringify(key)}:${canonical(value[key])}`)
+    .join(",")}}`;
+}
+
+function sha256(bytes) {
+  return `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
+}
+
+function exactKeys(value, keys, name) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new TypeError(`${name} must be an object`);
+  if (canonical(Object.keys(value).sort()) !== canonical([...keys].sort()))
+    throw new TypeError(`${name} has unexpected or missing fields`);
+}
+
+function normalizeDescriptor(value) {
+  exactKeys(
+    value,
+    [
+      "schema",
+      "revision",
+      "modulePath",
+      "moduleDigest",
+      "trustRootDigest",
+      "commands",
+      "signature",
+    ],
+    "evolution deployment descriptor",
+  );
+  if (value.schema !== EVOLUTION_DEPLOYMENT_DESCRIPTOR_SCHEMA)
+    throw new TypeError("evolution deployment descriptor schema is invalid");
+  if (!Number.isSafeInteger(value.revision) || value.revision < 1)
+    throw new TypeError("evolution deployment descriptor revision is invalid");
+  if (typeof value.modulePath !== "string" || !isAbsolute(value.modulePath))
+    throw new TypeError("evolution deployment modulePath must be absolute");
+  if (!DIGEST.test(value.moduleDigest ?? ""))
+    throw new TypeError("evolution deployment moduleDigest is invalid");
+  if (!DIGEST.test(value.trustRootDigest ?? ""))
+    throw new TypeError("evolution deployment trustRootDigest is invalid");
+  if (
+    !Array.isArray(value.commands) ||
+    value.commands.length === 0 ||
+    new Set(value.commands).size !== value.commands.length ||
+    value.commands.some((command) => !SUPPORTED_COMMANDS.has(command))
+  )
+    throw new TypeError("evolution deployment commands are invalid");
+  if (
+    typeof value.signature !== "string" ||
+    value.signature === "" ||
+    !/^[A-Za-z0-9+/]+={0,2}$/u.test(value.signature)
+  )
+    throw new TypeError("evolution deployment signature is invalid");
+  return Object.freeze({
+    ...value,
+    commands: Object.freeze([...value.commands].sort()),
+  });
+}
+
+export function serializeEvolutionDeploymentDescriptorPayload(descriptor) {
+  const value = normalizeDescriptor({ ...descriptor, signature: "AA==" });
+  return canonical({
+    schema: value.schema,
+    revision: value.revision,
+    modulePath: value.modulePath,
+    moduleDigest: value.moduleDigest,
+    trustRootDigest: value.trustRootDigest,
+    commands: value.commands,
+  });
+}
+
+export function computeEvolutionDeploymentDigest(bytes) {
+  return sha256(bytes);
+}
+
+function parseJson(bytes) {
+  try {
+    return JSON.parse(Buffer.from(bytes).toString("utf8"));
+  } catch {
+    throw new Error("evolution deployment descriptor is not valid JSON");
+  }
+}
+
+function dependencies(value, commandName) {
+  if (
+    !value ||
+    typeof value !== "object" ||
+    Array.isArray(value) ||
+    utilTypes.isProxy(value)
+  )
+    throw new TypeError(
+      `evolution deployment returned invalid dependencies for ${commandName}`,
+    );
+  return Object.freeze({ ...value });
+}
+
+async function loadBuiltInFactories(commandName) {
+  const factories = {};
+  if (commandName === "evolution" || commandName === "serve") {
+    const [
+      { createEvolutionWorkbenchCliHost },
+      { createGovernedKnowledgeReviewHost },
+    ] = await Promise.all([
+      import("./evolution-workbench-cli-host.js"),
+      import("./governed-knowledge-review-host.js"),
+    ]);
+    factories.createEvolutionWorkbenchCliHost = createEvolutionWorkbenchCliHost;
+    factories.createGovernedKnowledgeReviewHost =
+      createGovernedKnowledgeReviewHost;
+  }
+  if (commandName === "agent" || commandName === "serve") {
+    const { createAgentEvolutionRuntimeComposition } =
+      await import("./agent-evolution-runtime-composition.js");
+    factories.createAgentEvolutionRuntimeComposition =
+      createAgentEvolutionRuntimeComposition;
+  }
+  return Object.freeze(factories);
+}
+
+export async function loadEvolutionDeploymentCommandDependencies(
+  commandName,
+  {
+    env = process.env,
+    read = readFile,
+    resolveRealPath = realpath,
+    importModule = (url) => import(url),
+  } = {},
+) {
+  if (!SUPPORTED_COMMANDS.has(commandName)) return null;
+  const descriptorPath = env.CHAINLESSCHAIN_EVOLUTION_DEPLOYMENT_DESCRIPTOR;
+  const trustRootPath = env.CHAINLESSCHAIN_EVOLUTION_DEPLOYMENT_TRUST_ROOT;
+  if (!descriptorPath && !trustRootPath) return null;
+  if (!descriptorPath || !trustRootPath)
+    throw new Error(
+      "evolution deployment requires both descriptor and trust root",
+    );
+  if (!isAbsolute(descriptorPath) || !isAbsolute(trustRootPath))
+    throw new Error("evolution deployment paths must be absolute");
+
+  const [descriptorBytes, trustRootBytes] = await Promise.all([
+    read(await resolveRealPath(descriptorPath)),
+    read(await resolveRealPath(trustRootPath)),
+  ]);
+  const descriptor = normalizeDescriptor(parseJson(descriptorBytes));
+  if (sha256(trustRootBytes) !== descriptor.trustRootDigest)
+    throw new Error("evolution deployment trust root digest mismatch");
+  let publicKey;
+  try {
+    publicKey = createPublicKey(trustRootBytes);
+  } catch {
+    throw new Error("evolution deployment trust root is invalid");
+  }
+  const payload = serializeEvolutionDeploymentDescriptorPayload(descriptor);
+  if (
+    !verify(
+      null,
+      Buffer.from(payload, "utf8"),
+      publicKey,
+      Buffer.from(descriptor.signature, "base64"),
+    )
+  )
+    throw new Error("evolution deployment descriptor signature rejected");
+  if (!descriptor.commands.includes(commandName)) return null;
+
+  const modulePath = await resolveRealPath(descriptor.modulePath);
+  const moduleBytes = await read(modulePath);
+  if (moduleBytes.byteLength === 0 || moduleBytes.byteLength > 4 * 1024 * 1024)
+    throw new Error("evolution deployment module size is invalid");
+  if (sha256(moduleBytes) !== descriptor.moduleDigest)
+    throw new Error("evolution deployment module digest mismatch");
+  // Import the exact bytes that were authenticated. Importing modulePath here
+  // would reopen a pathname-replacement window between hashing and execution.
+  // Deployment entrypoints are therefore single-file ESM bundles; any external
+  // authority adapters they open remain the deployment's own attested boundary.
+  const moduleUrl = `data:text/javascript;base64,${Buffer.from(
+    moduleBytes,
+  ).toString("base64")}#${encodeURIComponent(descriptor.moduleDigest)}`;
+  const loaded = await importModule(moduleUrl);
+  if (typeof loaded?.createChainlessChainCommandDependencies !== "function")
+    throw new Error(
+      "evolution deployment module must export createChainlessChainCommandDependencies",
+    );
+  return dependencies(
+    await loaded.createChainlessChainCommandDependencies(
+      Object.freeze({
+        commandName,
+        descriptor: Object.freeze({ ...descriptor }),
+        factories: await loadBuiltInFactories(commandName),
+      }),
+    ),
+    commandName,
+  );
+}

package/src/lib/evolution/evolution-raw-crypto-shred.js

@@ -0,0 +1,185 @@
+import { createHash } from "node:crypto";
+
+export const EVOLUTION_RAW_CRYPTO_SHRED_SCHEMA =
+  "chainlesschain.evolution-raw-crypto-shred/v1";
+export const EVOLUTION_RAW_DELETION_TOMBSTONE_SCHEMA =
+  "chainlesschain.evolution-raw-deletion-tombstone/v1";
+
+const DIGEST = /^sha256:[a-f0-9]{64}$/u;
+
+function canonical(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
+  return `{${Object.keys(value)
+    .sort()
+    .map((key) => `${JSON.stringify(key)}:${canonical(value[key])}`)
+    .join(",")}}`;
+}
+
+function hash(domain, value) {
+  return `sha256:${createHash("sha256")
+    .update(domain)
+    .update("\0")
+    .update(canonical(value))
+    .digest("hex")}`;
+}
+
+function freeze(value) {
+  if (value && typeof value === "object" && !Object.isFrozen(value)) {
+    Object.freeze(value);
+    for (const child of Object.values(value)) freeze(child);
+  }
+  return value;
+}
+
+function capture(ports, name) {
+  if (typeof ports?.[name] !== "function")
+    throw new TypeError(`Raw crypto-shred port ${name} is required`);
+  return ports[name].bind(ports);
+}
+
+function string(value, name) {
+  if (typeof value !== "string" || value.trim() === "")
+    throw new TypeError(`${name} is required`);
+  return value;
+}
+
+function digest(value, name) {
+  if (!DIGEST.test(value ?? "")) throw new TypeError(`${name} is invalid`);
+  return value;
+}
+
+function verifyPruningCall(call, tenantId) {
+  const request = call?.request;
+  if (
+    request?.tenantId !== tenantId ||
+    request.operation !== "crypto-shred" ||
+    !DIGEST.test(call?.requestDigest ?? "") ||
+    call.requestDigest !==
+      hash("chainlesschain.governed-wiki-pruning-operation/v1", request)
+  )
+    throw new Error("Raw crypto-shred request is not pruning-plan-bound");
+  const payload = request.payload;
+  if (
+    typeof payload?.rawArtifactRef !== "string" ||
+    !payload.rawArtifactRef.startsWith(`artifact://${tenantId}/raw/`) ||
+    typeof payload.keyRef !== "string" ||
+    !payload.keyRef.startsWith(`kms://${tenantId}/`)
+  )
+    throw new Error("Raw crypto-shred target is cross-tenant or incomplete");
+  for (const [value, name] of [
+    [request.planDigest, "planDigest"],
+    [request.wikiStateDigest, "wikiStateDigest"],
+    [payload.sourceDigest, "sourceDigest"],
+    [payload.rawCipherDigest, "rawCipherDigest"],
+    [payload.receiptDigest, "deletionReceiptDigest"],
+  ])
+    digest(value, name);
+  string(payload.evidenceRef, "evidenceRef");
+  string(payload.artifactRef, "artifactRef");
+  return request;
+}
+
+export class EvolutionRawCryptoShred {
+  constructor({ tenantId, ports } = {}) {
+    this.tenantId = string(tenantId, "tenantId");
+    this._verifyDeletionReceipt = capture(ports, "verifyDeletionReceipt");
+    this._destroyKey = capture(ports, "destroyKey");
+    this._confirmKeyDestroyed = capture(ports, "confirmKeyDestroyed");
+    this._retainTombstone = capture(ports, "retainTombstone");
+  }
+
+  async shred(call) {
+    const request = verifyPruningCall(call, this.tenantId);
+    const target = request.payload;
+    const deletion = await this._verifyDeletionReceipt({
+      tenantId: this.tenantId,
+      receiptDigest: target.receiptDigest,
+    });
+    if (
+      deletion?.authenticated !== true ||
+      deletion.decision !== "delete" ||
+      deletion.tenantId !== this.tenantId ||
+      deletion.receiptDigest !== target.receiptDigest ||
+      deletion.evidenceRef !== target.evidenceRef ||
+      deletion.sourceDigest !== target.sourceDigest ||
+      deletion.artifactRef !== target.artifactRef ||
+      deletion.rawArtifactRef !== target.rawArtifactRef ||
+      deletion.rawCipherDigest !== target.rawCipherDigest ||
+      deletion.keyRef !== target.keyRef
+    )
+      throw new Error("Raw deletion receipt was substituted");
+    const destructionCore = {
+      schema: EVOLUTION_RAW_CRYPTO_SHRED_SCHEMA,
+      tenantId: this.tenantId,
+      planDigest: request.planDigest,
+      wikiStateDigest: request.wikiStateDigest,
+      evidenceRef: target.evidenceRef,
+      rawArtifactRef: target.rawArtifactRef,
+      rawCipherDigest: target.rawCipherDigest,
+      keyRef: target.keyRef,
+      deletionReceiptDigest: target.receiptDigest,
+    };
+    const destructionRequest = freeze({
+      ...destructionCore,
+      requestDigest: hash(EVOLUTION_RAW_CRYPTO_SHRED_SCHEMA, destructionCore),
+    });
+    const destroyed = await this._destroyKey(destructionRequest);
+    if (
+      destroyed?.authenticated !== true ||
+      destroyed.durable !== true ||
+      destroyed.destroyed !== true ||
+      destroyed.keyRef !== target.keyRef ||
+      destroyed.requestDigest !== destructionRequest.requestDigest ||
+      !DIGEST.test(destroyed.receiptDigest ?? "")
+    )
+      throw new Error("Raw encryption key destruction was not durable");
+    const confirmation = await this._confirmKeyDestroyed({
+      tenantId: this.tenantId,
+      keyRef: target.keyRef,
+      destructionReceiptDigest: destroyed.receiptDigest,
+    });
+    if (
+      confirmation?.authenticated !== true ||
+      confirmation.destroyed !== true ||
+      confirmation.keyRef !== target.keyRef ||
+      confirmation.destructionReceiptDigest !== destroyed.receiptDigest ||
+      !DIGEST.test(confirmation.receiptDigest ?? "")
+    )
+      throw new Error("Raw encryption key destruction could not be confirmed");
+    const tombstoneCore = {
+      schema: EVOLUTION_RAW_DELETION_TOMBSTONE_SCHEMA,
+      tenantId: this.tenantId,
+      pruningRequestDigest: call.requestDigest,
+      destructionRequestDigest: destructionRequest.requestDigest,
+      destructionReceiptDigest: destroyed.receiptDigest,
+      confirmationReceiptDigest: confirmation.receiptDigest,
+      evidenceRef: target.evidenceRef,
+      rawArtifactRef: target.rawArtifactRef,
+      rawCipherDigest: target.rawCipherDigest,
+      deletionReceiptDigest: target.receiptDigest,
+    };
+    const tombstone = freeze({
+      ...tombstoneCore,
+      tombstoneDigest: hash(
+        EVOLUTION_RAW_DELETION_TOMBSTONE_SCHEMA,
+        tombstoneCore,
+      ),
+    });
+    const retained = await this._retainTombstone({ tombstone });
+    if (
+      retained?.authenticated !== true ||
+      retained.durable !== true ||
+      retained.tombstoneDigest !== tombstone.tombstoneDigest ||
+      !DIGEST.test(retained.receiptDigest ?? "")
+    )
+      throw new Error("Raw deletion tombstone was not durably retained");
+    return freeze({
+      authenticated: true,
+      durable: true,
+      requestDigest: call.requestDigest,
+      receiptDigest: retained.receiptDigest,
+      tombstoneDigest: tombstone.tombstoneDigest,
+    });
+  }
+}