chainlesschain 0.166.21 → 0.166.24

package/src/lib/evolution/governed-knowledge-wiki-tombstone.js

@@ -0,0 +1,462 @@
+import { types } from "node:util";
+import { captureWikiRevisionReader } from "./wiki-maintainer-ledger-adapter.js";
+import { captureSkillReleaseOperationReader } from "./evolution-ledger-ports.js";
+import { governedKnowledgeSourceRef } from "./governed-knowledge-skill-rollback.js";
+import { deriveWikiTargetTombstoneRevision } from "./wiki-target-tombstone-revision.js";
+import {
+  createGovernedKnowledgeDependencyAuthority,
+  GOVERNED_KNOWLEDGE_DEPENDENCY_RESULT_SCHEMA,
+  digestGovernedKnowledgeDependencyResult,
+} from "./governed-knowledge-dependency-authority.js";
+import {
+  capturePruningData as captureData,
+  pruningCanonical as canonical,
+  pruningDigest as digest,
+} from "./governed-wiki-pruning-journal.js";
+
+const SCHEMA = "chainlesschain.knowledge-wiki-tombstone/v1";
+const HEAD_KEYS = [
+  "epoch",
+  "ledgerId",
+  "identityDigest",
+  "sequence",
+  "headDigest",
+];
+const RULES = Object.freeze({
+  schema: SCHEMA,
+  batchSize: 128,
+  source: "exact-Knowledge-URI-and-content-digest",
+  effect: "target-only-tombstone",
+  unrelatedFacts: "preserve-verbatim",
+  minCorroboratingSources: 2,
+  decayHalfLifeDays: 30,
+  staleConfidenceFloor: 0.2,
+});
+const RULES_DIGEST = digest(SCHEMA, RULES);
+const MULTIHOP_SCHEMA = "chainlesschain.knowledge-wiki-tombstone/v2";
+const MULTIHOP_RULES_DIGEST = digest(MULTIHOP_SCHEMA, {
+  ...RULES,
+  schema: MULTIHOP_SCHEMA,
+  source: "authenticated-pinned-Wiki-exact-Knowledge-ancestry",
+});
+function fail(message) {
+  throw new Error(`Knowledge Wiki tombstone: ${message}`);
+}
+const same = (left, right) => canonical(left) === canonical(right);
+function matchHead(checkpoint, head) {
+  return HEAD_KEYS.every((key) => checkpoint[key] === head[key]);
+}
+function bind(wikiAdapter, transactionLedger, tenantId) {
+  const wiki = captureWikiRevisionReader(wikiAdapter);
+  if (wiki.descriptor.tenantId !== tenantId)
+    throw new TypeError("Knowledge Wiki tenant differs");
+  const operations = captureSkillReleaseOperationReader(transactionLedger);
+  if (!operations.matchesWikiAdapter(wikiAdapter))
+    throw new TypeError(
+      "Wiki disposition requires the same genuine ledger, not matching caller-supplied head metadata",
+    );
+  return Object.freeze({ wiki, operations });
+}
+function partsFor(source, request, provenance) {
+  const sourceRef = governedKnowledgeSourceRef(request);
+  const refs = new Set(
+    Object.values(source.state.evidence)
+      .filter(
+        (entry) =>
+          (entry.ref === sourceRef || entry.artifactRef === sourceRef) &&
+          entry.sourceDigest === request.contentDigest,
+      )
+      .map((entry) => entry.ref),
+  );
+  const directIds = Object.values(source.state.patterns)
+    .filter((pattern) => {
+      const evidence = [
+        ...pattern.positiveEvidence,
+        ...pattern.negativeEvidence,
+      ];
+      if (evidence.some((ref) => !source.state.evidence[ref]))
+        fail("pattern has unresolved source evidence");
+      return evidence.some((ref) => refs.has(ref));
+    })
+    .map((pattern) => pattern.patternId)
+    .sort();
+  const targetIds = provenance.affectedPatternIds;
+  const operations = targetIds.map((patternId) => ({
+    type: "tombstone",
+    patternId,
+    reason: "governed-knowledge-revocation",
+  }));
+  if (!operations.length)
+    fail("Wiki source does not identify the revoked Knowledge");
+  // Existing direct-only preparations retain their exact v1 batch identity and
+  // deterministic revision bytes. Newly discovered ancestry gets a distinct
+  // v2 contract, pinned to the original revision rather than today's head.
+  const sourceProofDigest = same(directIds, targetIds)
+    ? null
+    : digest(`${MULTIHOP_SCHEMA}/source`, {
+        revisionId: provenance.revisionId,
+        stateDigest: provenance.stateDigest,
+        checkpoint: provenance.checkpoint,
+        affectedPatternIds: targetIds,
+      });
+  const count = Math.ceil(operations.length / RULES.batchSize);
+  if (count > 128)
+    fail("Wiki disposition exceeds the authenticated history bound");
+  return Array.from({ length: count }, (_, index) => {
+    const batch = operations.slice(
+      index * RULES.batchSize,
+      (index + 1) * RULES.batchSize,
+    );
+    return {
+      operations: batch,
+      ...(sourceProofDigest ? { sourceProofDigest } : {}),
+      requestDigest: digest(
+        `${sourceProofDigest ? MULTIHOP_SCHEMA : SCHEMA}/batch`,
+        {
+          requestDigest: request.requestDigest,
+          index,
+          count,
+          operations: batch,
+          ...(sourceProofDigest ? { sourceProofDigest } : {}),
+        },
+      ),
+    };
+  });
+}
+function derive(reader, source, part, fence) {
+  return deriveWikiTargetTombstoneRevision({
+    source,
+    operations: part.operations,
+    requestDigest: part.requestDigest,
+    effectiveAt: fence.evidence.timestamp,
+    descriptor: {
+      tenantId: reader.wiki.descriptor.tenantId,
+      evolutionRunId: reader.wiki.descriptor.evolutionRunId,
+      maintainerModel: part.sourceProofDigest
+        ? "deterministic:knowledge-wiki-tombstone/v2"
+        : "deterministic:knowledge-wiki-tombstone/v1",
+      rulesDigest: part.sourceProofDigest
+        ? MULTIHOP_RULES_DIGEST
+        : RULES_DIGEST,
+      minCorroboratingSources: RULES.minCorroboratingSources,
+      decayHalfLifeDays: RULES.decayHalfLifeDays,
+      staleConfidenceFloor: RULES.staleConfidenceFloor,
+    },
+  });
+}
+async function prove(reader, request, context, original) {
+  if (
+    request.dependency.kind !== "wiki" ||
+    request.dependency.disposition !== "tombstone"
+  )
+    fail("only an exact wiki / tombstone dependency is supported");
+  const admission = reader.operations.resolveKnowledgeRevocation({
+    tenantId: request.tenantId,
+    operationDigest: request.operationDigest,
+    context,
+  });
+  const fence = admission.fence;
+  if (!fence || fence.record.deviceId !== request.deviceId)
+    fail("missing exact prepared revocation");
+  const knowledge = fence.record.knowledge;
+  for (const key of [
+    "tenantId",
+    "knowledgeId",
+    "action",
+    "contentDigest",
+    "revocationReceiptDigest",
+  ])
+    if (knowledge[key] !== request[key])
+      fail("prepared Knowledge binding differs");
+  if (!knowledge.dependencies.some((entry) => same(entry, request.dependency)))
+    fail("Wiki dependency is not in the prepared operation");
+  // The dependency digest binds the original complete Wiki STATE, not just a
+  // pattern ID, caller-selected evidence subset or latest mutable Wiki label.
+  if (
+    !matchHead(context.checkpoint, original.ledgerHead) ||
+    original.checkpoint.sequence >= fence.sequence
+  )
+    fail("Wiki source must precede preparation on this same current ledger");
+  const provenance = reader.wiki.readKnowledgeProvenance({
+    tenantId: request.tenantId,
+    revisionId: original.revisionId,
+    knowledgeId: request.knowledgeId,
+    contentDigest: request.contentDigest,
+  });
+  if (
+    provenance.stateDigest !== original.stateDigest ||
+    !same(provenance.checkpoint, original.checkpoint) ||
+    !matchHead(context.checkpoint, provenance.ledgerHead)
+  )
+    fail("Wiki ancestry does not bind the original state and current ledger");
+  const parts = partsFor(original, request, provenance);
+  const history = reader.wiki.resolveHistory({
+    tenantId: request.tenantId,
+    stateDigest: request.dependency.digest,
+    allowedMaintenanceRequestDigests: parts.map((part) => part.requestDigest),
+  });
+  if (
+    !matchHead(context.checkpoint, history.ledgerHead) ||
+    history.successors.length > parts.length
+  )
+    fail("Wiki disposition history differs from its current authorization");
+  let source = history.source;
+  for (const [index, entry] of history.successors.entries()) {
+    if (entry.predecessorHead.sequence < fence.sequence)
+      fail("Wiki effect predates its prepared Knowledge authorization");
+    const expected = await derive(reader, source, parts[index], fence);
+    if (!same(expected, entry.revision))
+      fail("Wiki successor does not match the exact target-only tombstones");
+    source = {
+      trusted: true,
+      state: expected.state,
+      stateDigest: expected.stateDigest,
+    };
+  }
+  if (
+    !same(source, history.current) ||
+    !same(reader.operations.currentContext(), context)
+  )
+    fail("Wiki or ledger changed during effect verification");
+  return Object.freeze({
+    fence,
+    parts,
+    history,
+    current: source,
+    complete: history.successors.length === parts.length,
+    checkpoint: context.checkpoint,
+  });
+}
+
+export function createGovernedKnowledgeWikiTombstoneAuthority({
+  tenantId,
+  deviceId,
+  wikiLedgerAdapter,
+  transactionLedger,
+  verifierWikiLedgerAdapter,
+  verifierTransactionLedger,
+  providerDescriptor,
+  verifierDescriptor,
+  additionalWikiTargets = [],
+} = {}) {
+  if (
+    wikiLedgerAdapter === verifierWikiLedgerAdapter ||
+    transactionLedger === verifierTransactionLedger
+  )
+    throw new TypeError(
+      "Wiki disposition requires independent genuine readers",
+    );
+  if (
+    types.isProxy(additionalWikiTargets) ||
+    !Array.isArray(additionalWikiTargets) ||
+    Object.getPrototypeOf(additionalWikiTargets) !== Array.prototype ||
+    additionalWikiTargets.length > 63 ||
+    Reflect.ownKeys(additionalWikiTargets).length !==
+      additionalWikiTargets.length + 1
+  )
+    throw new TypeError(
+      "Wiki disposition targets must be a bounded dense array",
+    );
+  const targets = [{ wikiLedgerAdapter, verifierWikiLedgerAdapter }];
+  for (let index = 0; index < additionalWikiTargets.length; index += 1) {
+    const property = Object.getOwnPropertyDescriptor(
+      additionalWikiTargets,
+      String(index),
+    );
+    const target = property?.value;
+    if (
+      !target ||
+      types.isProxy(target) ||
+      ![Object.prototype, null].includes(Object.getPrototypeOf(target)) ||
+      Reflect.ownKeys(target).length !== 2
+    )
+      throw new TypeError(
+        "Wiki disposition target must contain two fixed readers",
+      );
+    const left = Object.getOwnPropertyDescriptor(target, "wikiLedgerAdapter");
+    const right = Object.getOwnPropertyDescriptor(
+      target,
+      "verifierWikiLedgerAdapter",
+    );
+    if (!left || !right || !("value" in left) || !("value" in right))
+      throw new TypeError("Wiki disposition target must not use accessors");
+    targets.push({
+      wikiLedgerAdapter: left.value,
+      verifierWikiLedgerAdapter: right.value,
+    });
+  }
+  const runs = new Set();
+  const bindings = targets.map((target) => {
+    if (target.wikiLedgerAdapter === target.verifierWikiLedgerAdapter)
+      throw new TypeError(
+        "Wiki disposition requires independent genuine readers",
+      );
+    const provider = bind(
+      target.wikiLedgerAdapter,
+      transactionLedger,
+      tenantId,
+    );
+    const verifier = bind(
+      target.verifierWikiLedgerAdapter,
+      verifierTransactionLedger,
+      tenantId,
+    );
+    if (!same(provider.wiki.descriptor, verifier.wiki.descriptor))
+      throw new TypeError("Wiki disposition reader scopes differ");
+    const run = provider.wiki.descriptor.evolutionRunId;
+    if (runs.has(run))
+      throw new TypeError(
+        "Wiki disposition runs must be unique, not duplicate",
+      );
+    runs.add(run);
+    return Object.freeze({
+      provider,
+      verifier,
+      commit: target.wikiLedgerAdapter.commitRevision,
+    });
+  });
+  const { provider, verifier } = bindings[0];
+  const left = provider.operations.currentContext().checkpoint;
+  const right = verifier.operations.currentContext().checkpoint;
+  if (
+    ["epoch", "ledgerId", "identityDigest"].some(
+      (key) => left[key] !== right[key],
+    )
+  )
+    throw new TypeError("Wiki disposition readers belong to different ledgers");
+  const providerIdentity = captureData(providerDescriptor);
+  const verifierIdentity = captureData(verifierDescriptor);
+  async function proofPair(request) {
+    const context = provider.operations.currentContext();
+    if (!same(context, verifier.operations.currentContext()))
+      fail("independent ledger heads differ");
+    let selected = null;
+    for (const binding of bindings) {
+      const query = {
+        tenantId: request.tenantId,
+        stateDigest: request.dependency.digest,
+      };
+      const original = binding.provider.wiki.findStateRevision(query);
+      const independentOriginal =
+        binding.verifier.wiki.findStateRevision(query);
+      if (!same(original, independentOriginal))
+        fail("independent Wiki target lookup differs");
+      if (original) {
+        if (selected)
+          fail("Wiki target resolves to more than one configured run");
+        selected = { binding, original, independentOriginal };
+      }
+    }
+    if (!selected)
+      fail("Wiki target is absent from the configured authenticated runs");
+    const primary = await prove(
+      selected.binding.provider,
+      request,
+      context,
+      selected.original,
+    );
+    const independent = await prove(
+      selected.binding.verifier,
+      request,
+      context,
+      selected.independentOriginal,
+    );
+    if (!same(primary, independent))
+      fail("independent Wiki effect proof differs");
+    return { proof: primary, binding: selected.binding };
+  }
+  function resultFor(request, proof) {
+    const core = {
+      schema: GOVERNED_KNOWLEDGE_DEPENDENCY_RESULT_SCHEMA,
+      tenantId,
+      deviceId,
+      operationId: request.operationId,
+      requestDigest: request.requestDigest,
+      knowledgeId: request.knowledgeId,
+      revocationReceiptDigest: request.revocationReceiptDigest,
+      dependencyKind: request.dependency.kind,
+      dependencyDigest: request.dependency.digest,
+      dependencyDisposition: request.dependency.disposition,
+      authorityId: providerIdentity.authorityId,
+      authorityRevision: providerIdentity.revision,
+      handlerArtifactDigest: providerIdentity.handlerArtifactDigest,
+      applied: true,
+      durable: true,
+      idempotent: true,
+      appliedAt: proof.fence.evidence.timestamp,
+    };
+    const { algorithm, keyId, value } = proof.fence.evidence.signature;
+    return captureData({
+      ...core,
+      resultDigest: digestGovernedKnowledgeDependencyResult(core),
+      attestation: { algorithm, keyId, value },
+    });
+  }
+  return createGovernedKnowledgeDependencyAuthority({
+    tenantId,
+    deviceId,
+    providerDescriptor: providerIdentity,
+    verifierDescriptor: verifierIdentity,
+    provider: Object.freeze({
+      async apply(request) {
+        let { proof, binding } = await proofPair(request);
+        while (!proof.complete) {
+          const done = proof.history.successors.length;
+          const revision = await derive(
+            binding.provider,
+            proof.current,
+            proof.parts[done],
+            proof.fence,
+          );
+          let commitError = null;
+          try {
+            binding.commit({
+              expectedStateDigest: proof.current.stateDigest,
+              expectedLedgerHead: proof.checkpoint,
+              revision,
+            });
+          } catch (error) {
+            commitError = error;
+          }
+          // Lost acknowledgements are resolved from independently replayed
+          // actual history, never from a provider's success flag.
+          const next = (await proofPair(request)).proof;
+          if (next.history.successors.length !== done + 1) {
+            if (commitError) throw commitError;
+            fail("Wiki commit did not durably advance the authorized sequence");
+          }
+          proof = next;
+        }
+        return resultFor(request, proof);
+      },
+    }),
+    verifier: Object.freeze({
+      async verify({ request, result }) {
+        const { proof } = await proofPair(request);
+        if (!proof.complete || !same(result, resultFor(request, proof)))
+          fail(
+            "Wiki disposition is not completely and independently confirmed",
+          );
+        return captureData({
+          authenticated: true,
+          durable: true,
+          tenantId,
+          deviceId,
+          operationId: request.operationId,
+          requestDigest: request.requestDigest,
+          resultDigest: result.resultDigest,
+          providerAuthorityId: providerIdentity.authorityId,
+          providerRevision: providerIdentity.revision,
+          verifierAuthorityId: verifierIdentity.authorityId,
+          verifierRevision: verifierIdentity.revision,
+          verificationReceiptDigest: digest(`${SCHEMA}/verification`, {
+            requestDigest: request.requestDigest,
+            resultDigest: result.resultDigest,
+            proof,
+            verifierIdentity,
+          }),
+        });
+      },
+    }),
+  });
+}

package/src/lib/evolution/governed-skill-marketplace-badge.js

@@ -0,0 +1,208 @@
+import { createHash } from "node:crypto";
+import { createServer } from "node:http";
+import { isIP } from "node:net";
+import { isGovernedSkillMarketplaceCliHost } from "./governed-skill-marketplace-cli-host.js";
+
+const STYLE = `:root{color-scheme:light dark;font-family:system-ui,sans-serif;background:#f4f6fa;color:#152238}body{margin:0;padding:32px 16px}main{max-width:880px;margin:auto;background:#fff;padding:28px;border:1px solid #dde3ec;border-radius:16px}h1{margin:8px 0}.eyebrow{letter-spacing:.08em;color:#50627b}.status{display:inline-block;padding:6px 12px;border-radius:20px;background:#e8f5ec;color:#21623b}.revoked{background:#fdebec;color:#952a35}.score{font-size:32px;font-weight:650}.muted{color:#50627b}.notice{padding:14px;background:#f1f4fa;border-radius:8px}dl{display:grid;grid-template-columns:180px minmax(0,1fr);gap:12px;margin:24px 0}dt{font-weight:600}dd{margin:0;overflow-wrap:anywhere}code{font-size:.85em}a{color:#225caa}footer{margin-top:24px;font-size:.9em}@media(max-width:560px){main{padding:18px}dl{grid-template-columns:1fr;gap:6px}dd{margin-bottom:12px}}@media(prefers-color-scheme:dark){:root{background:#101722;color:#e1e8f2}main{background:#172231;border-color:#344154}.muted,.eyebrow{color:#afbed2}.notice{background:#233147}a{color:#96bfff}}`;
+const CSP = `default-src 'none'; style-src 'sha256-${createHash("sha256").update(STYLE).digest("base64")}'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'`;
+
+function escapeHtml(value) {
+  return String(value ?? "").replace(
+    /[&<>"']/g,
+    (character) =>
+      ({
+        "&": "&amp;",
+        "<": "&lt;",
+        ">": "&gt;",
+        '"': "&quot;",
+        "'": "&#39;",
+      })[character],
+  );
+}
+
+export function renderGovernedSkillMarketplaceBadge(badge) {
+  const rows = [
+    [
+      "目标模型 / OS / 工具 / runtime",
+      [
+        badge.target.model,
+        badge.target.os,
+        badge.target.tool,
+        badge.target.runtime,
+      ].join(" / "),
+    ],
+    ["来源模型", badge.sourceModel],
+    ["签名目录摘要", badge.manifestDigest],
+    ["目标评测凭证", badge.evalReceiptDigest],
+    ["Eval badge 摘要", badge.evalBadgeDigest],
+    ["来源 commit 摘要", badge.sourceCommitDigest],
+    [
+      "原始包 / 适配包",
+      `${badge.packageDigest} / ${badge.adaptedOutputDigest}`,
+    ],
+    ["SBOM 摘要", badge.sbomDigest],
+    ["依赖锁摘要", badge.dependencyLockDigest],
+    ["权限清单摘要", badge.permissionManifestDigest],
+    ["兼容矩阵摘要", badge.targetMatrixDigest],
+    ["发布时核验", badge.verifiedAt],
+    ["快照有效至", badge.expiresAt],
+    ["本次状态检查", badge.checkedAt],
+  ];
+  const status = badge.revoked ? "已撤销 · 不可用于安装" : "已核验的评测快照";
+  return `<!doctype html>
+<html lang="zh-CN"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${escapeHtml(badge.skillName)} · Skill 评测凭证</title><style>${STYLE}</style></head>
+<body><main><p class="eyebrow">CHAINLESSCHAIN · EVAL BADGE</p><h1>${escapeHtml(badge.skillName)} <small>@ ${escapeHtml(badge.version)}</small></h1>
+<p class="status${badge.revoked ? " revoked" : ""}">${status}</p><p><span class="score">${escapeHtml((badge.qualityScore * 100).toFixed(1))}%</span> 目标评分 · ${escapeHtml(badge.sampleCount)} 个样本</p>
+<p class="notice">此页展示发布时的目标评测与适配核验结果。目录签名和已记录撤销在每次访问时重新检查；其他 authority 的后续撤销不由此快照证明。页面不代表已安装、已启用或新的运行授权。</p>
+<dl>${rows.map(([label, value]) => `<dt>${escapeHtml(label)}</dt><dd><code>${escapeHtml(value)}</code></dd>`).join("\n")}</dl>
+<p><a href="/badge.json">查看公开 JSON 投影</a></p><footer class="muted">仅公开必要元数据与证据摘要，不公开租户、候选内容、签名原文或私有回执。独立复核和复现需要发布者另行提供原始签名证据及可公开的评测材料。</footer></main></body></html>`;
+}
+
+function integer(value, label, min, max) {
+  if (!Number.isSafeInteger(value) || value < min || value > max)
+    throw new TypeError(`${label} is out of range`);
+}
+
+/** Publish one explicitly selected immutable listing; no browse or mutation API. */
+export async function startGovernedSkillMarketplaceBadgeServer({
+  marketplaceHost,
+  skillName,
+  version,
+  manifestDigest,
+  listen = "127.0.0.1",
+  port = 8321,
+  snapshotTtlMs = 600_000,
+  requestTimeoutMs = 5_000,
+  maxConcurrentRequests = 4,
+  now = Date.now,
+} = {}) {
+  if (!isGovernedSkillMarketplaceCliHost(marketplaceHost))
+    throw new TypeError("public badges require a branded marketplace host");
+  if (!isIP(listen))
+    throw new TypeError("badge listen address must be an IP literal");
+  integer(port, "badge port", 0, 65535);
+  integer(snapshotTtlMs, "badge snapshot TTL", 1_000, 3_600_000);
+  integer(requestTimeoutMs, "badge request timeout", 10, 30_000);
+  integer(maxConcurrentRequests, "badge concurrency", 1, 16);
+  if (typeof now !== "function") throw new TypeError("badge clock is required");
+  const timestamp = () => {
+    const value = now();
+    if (
+      !Number.isSafeInteger(value) ||
+      value < 0 ||
+      value > 8_640_000_000_000_000 - snapshotTtlMs
+    )
+      throw new Error("badge clock is invalid");
+    return value;
+  };
+  const reader = await marketplaceHost.preparePublicBadge({
+    skillName,
+    version,
+    manifestDigest,
+  });
+  await reader.read();
+  const verifiedAt = timestamp();
+  const expiresAt = verifiedAt + snapshotTtlMs;
+  let inFlight = 0;
+  const server = createServer({ maxHeaderSize: 8192 }, (request, response) => {
+    response.setHeader("Cache-Control", "no-store, max-age=0");
+    response.setHeader("Content-Security-Policy", CSP);
+    response.setHeader("X-Content-Type-Options", "nosniff");
+    response.setHeader("X-Frame-Options", "DENY");
+    response.setHeader("Referrer-Policy", "no-referrer");
+    const finish = (status, body, type = "text/plain; charset=utf-8") => {
+      if (response.writableEnded || response.destroyed) return;
+      response.statusCode = status;
+      response.setHeader("Content-Type", type);
+      response.end(request.method === "HEAD" ? undefined : body);
+    };
+    if (!["GET", "HEAD"].includes(request.method)) {
+      response.setHeader("Allow", "GET, HEAD");
+      response.setHeader("Connection", "close");
+      finish(405, "Read-only badge endpoint.");
+      return;
+    }
+    if (
+      request.headers["transfer-encoding"] ||
+      (request.headers["content-length"] &&
+        request.headers["content-length"] !== "0")
+    ) {
+      response.setHeader("Connection", "close");
+      finish(400, "Request bodies are not accepted.");
+      return;
+    }
+    if (request.url !== "/" && request.url !== "/badge.json") {
+      finish(404, "Badge endpoint not found.");
+      return;
+    }
+    if (inFlight >= maxConcurrentRequests) {
+      response.setHeader("Retry-After", "5");
+      finish(429, "Badge verification is busy.");
+      return;
+    }
+    inFlight += 1;
+    const timer = setTimeout(
+      () => finish(503, "Badge verification is unavailable."),
+      requestTimeoutMs,
+    );
+    Promise.resolve()
+      .then(async () => {
+        const before = timestamp();
+        if (before < verifiedAt || before >= expiresAt)
+          throw new Error("snapshot expired");
+        const current = await reader.read();
+        const checkedAt = timestamp();
+        if (checkedAt < before || checkedAt >= expiresAt)
+          throw new Error("snapshot expired");
+        const badge = {
+          ...current,
+          verifiedAt: new Date(verifiedAt).toISOString(),
+          expiresAt: new Date(expiresAt).toISOString(),
+          checkedAt: new Date(checkedAt).toISOString(),
+        };
+        if (request.url === "/badge.json")
+          finish(
+            200,
+            `${JSON.stringify(badge, null, 2)}\n`,
+            "application/json; charset=utf-8",
+          );
+        else
+          finish(
+            200,
+            renderGovernedSkillMarketplaceBadge(badge),
+            "text/html; charset=utf-8",
+          );
+      })
+      .catch(() => finish(503, "Badge verification is unavailable."))
+      .finally(() => {
+        clearTimeout(timer);
+        // A timed-out underlying verifier retains its slot until it settles.
+        inFlight -= 1;
+      });
+  });
+  server.maxConnections = 32;
+  server.maxRequestsPerSocket = 16;
+  server.headersTimeout = 5_000;
+  server.requestTimeout = 5_000;
+  server.keepAliveTimeout = 1_000;
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(port, listen, () => {
+      server.removeListener("error", reject);
+      resolve();
+    });
+  });
+  const address = server.address();
+  const hostname =
+    isIP(address.address) === 6 ? `[${address.address}]` : address.address;
+  let closing;
+  return Object.freeze({
+    server,
+    url: `http://${hostname}:${address.port}/`,
+    close: () =>
+      (closing ??= new Promise((resolve, reject) => {
+        server.close((error) => (error ? reject(error) : resolve()));
+        server.closeAllConnections();
+      })),
+  });
+}