chainlesschain 0.166.22 → 0.166.24

package/src/lib/evolution/skill-writer-inventory-manifest.js

@@ -981,17 +981,19 @@ export const SKILL_WRITER_INVENTORY = Object.freeze({
       },
     }),
     scopeExclusion({
-      id: "desktop-marketplace-skill-install-metadata",
+      id: "desktop-marketplace-governed-host-delegation",
       surface: "desktop",
-      reasonCode: "marketplace-install-record-without-skill-artifact-mutation",
+      reasonCode:
+        "branded-governed-host-delegation-without-direct-skill-byte-write",
       evidence: {
         file: "desktop-app-vue/src/main/marketplace/skill-marketplace-client.js",
         symbol: "SkillMarketplaceClient.installSkill/uninstallSkill",
         evidence: [
-          "async installSkill(skillId, skillData = {})",
-          "INSERT OR REPLACE INTO skill_marketplace_installs",
-          "async uninstallSkill(skillId)",
-          'prepare("DELETE FROM skill_marketplace_installs WHERE skill_id = ?")',
+          "!isDesktopGovernedSkillMarketplaceHost(governedHost)",
+          "async installSkill(skillId, options = {})",
+          "const result = await host.install({",
+          "async uninstallSkill(skillId, options = {})",
+          "const state = await host.revoke({ skillName: skillId, ...options });",
         ],
       },
     }),

package/src/lib/evolution/statistical-progressive-canary.js

@@ -1,16 +1,19 @@
 import { createHash } from "node:crypto";
 
 export const PROGRESSIVE_CANARY_PLAN_SCHEMA =
-  "chainlesschain.progressive-canary-plan/v1";
+  "chainlesschain.progressive-canary-plan/v2";
 export const PROGRESSIVE_CANARY_ASSIGNMENT_SCHEMA =
-  "chainlesschain.progressive-canary-assignment/v1";
+  "chainlesschain.progressive-canary-assignment/v2";
 export const PROGRESSIVE_CANARY_GATE_REPORT_SCHEMA =
-  "chainlesschain.progressive-canary-gate-report/v1";
+  "chainlesschain.progressive-canary-gate-report/v2";
+export const PROGRESSIVE_CANARY_GATE_RECEIPT_SCHEMA =
+  "chainlesschain.progressive-canary-gate-receipt/v1";
 
 const DIGEST = /^sha256:[a-f0-9]{64}$/u;
 const SAFE_ID = /^[A-Za-z0-9][A-Za-z0-9._:@/-]{0,255}$/u;
 const RISK_TIERS = new Set(["low", "medium", "high"]);
 const AUTHORITIES = new WeakSet();
+const GATE_AUTHORITIES = new WeakSet();
 
 function canonical(value) {
   if (value === null || typeof value !== "object") return JSON.stringify(value);
@@ -70,6 +73,10 @@ function verifyPlan(plan) {
   return plan;
 }
 
+export function verifyProgressiveCanaryPlan(plan) {
+  return verifyPlan(plan);
+}
+
 function normalizeSteps(steps) {
   if (!Array.isArray(steps) || steps.length < 3 || steps.length > 16)
     throw new TypeError("progressive Canary plan requires 3..16 steps");
@@ -160,6 +167,7 @@ export function createProgressiveCanaryPlan(input = {}) {
       "riskTier",
       "assignmentSaltDigest",
       "assignmentAuthority",
+      "gateAuthority",
       "steps",
       "thresholds",
     ],
@@ -172,6 +180,11 @@ export function createProgressiveCanaryPlan(input = {}) {
     ["id", "revision", "handlerDigest"],
     "assignmentAuthority",
   );
+  exact(
+    input.gateAuthority,
+    ["id", "revision", "handlerDigest"],
+    "gateAuthority",
+  );
   exact(
     input.thresholds,
     [
@@ -211,6 +224,20 @@ export function createProgressiveCanaryPlan(input = {}) {
         "assignmentAuthority.handlerDigest",
       ),
     }),
+    gateAuthority: Object.freeze({
+      id: id(input.gateAuthority.id, "gateAuthority.id"),
+      revision: integer(
+        input.gateAuthority.revision,
+        "gateAuthority.revision",
+        {
+          min: 1,
+        },
+      ),
+      handlerDigest: sha(
+        input.gateAuthority.handlerDigest,
+        "gateAuthority.handlerDigest",
+      ),
+    }),
     steps: normalizeSteps(input.steps),
     thresholds: Object.freeze({
       confidence: finite(input.thresholds.confidence, "confidence", {
@@ -337,6 +364,9 @@ export function createProgressiveCanaryAssignmentAuthority({
   }
 
   const authority = Object.freeze({
+    planDigest: plan.planDigest,
+    tenantId: plan.tenantId,
+    pilotId: plan.pilotId,
     async assign({ stepId, subjectDigest: subjectDigestInput } = {}) {
       const step = plan.steps.find(({ id: value }) => value === stepId);
       if (!step) throw new TypeError("Canary assignment step is invalid");
@@ -423,6 +453,138 @@ function verifyGateReport(report, plan) {
   return report;
 }
 
+export function createProgressiveCanaryGateAuthority({
+  plan: planInput,
+  assignmentAuthority,
+  attestor,
+  verifier,
+  now = Date.now,
+} = {}) {
+  const plan = verifyPlan(planInput);
+  if (!AUTHORITIES.has(assignmentAuthority))
+    throw new TypeError("a branded Canary assignment authority is required");
+  if (
+    assignmentAuthority.planDigest !== plan.planDigest ||
+    assignmentAuthority.tenantId !== plan.tenantId ||
+    assignmentAuthority.pilotId !== plan.pilotId
+  )
+    throw new TypeError("Canary assignment authority belongs to another plan");
+  if (typeof attestor !== "function" || typeof verifier !== "function")
+    throw new TypeError("Canary gate attestor and verifier are required");
+  if (typeof now !== "function")
+    throw new TypeError("Canary gate authority clock is required");
+
+  async function verifyReceipt(receipt, { stepId } = {}) {
+    exact(
+      receipt,
+      [
+        "schema",
+        "planDigest",
+        "tenantId",
+        "pilotId",
+        "stepId",
+        "report",
+        "reportDigest",
+        "authorityId",
+        "authorityRevision",
+        "handlerDigest",
+        "issuedAt",
+        "expiresAt",
+        "signature",
+        "receiptDigest",
+      ],
+      "Canary gate receipt",
+    );
+    const report = verifyGateReport(receipt.report, plan);
+    if (
+      receipt.schema !== PROGRESSIVE_CANARY_GATE_RECEIPT_SCHEMA ||
+      receipt.planDigest !== plan.planDigest ||
+      receipt.tenantId !== plan.tenantId ||
+      receipt.pilotId !== plan.pilotId ||
+      receipt.stepId !== stepId ||
+      report.stepId !== stepId ||
+      receipt.reportDigest !== report.reportDigest ||
+      receipt.authorityId !== plan.gateAuthority.id ||
+      receipt.authorityRevision !== plan.gateAuthority.revision ||
+      receipt.handlerDigest !== plan.gateAuthority.handlerDigest ||
+      typeof receipt.issuedAt !== "string" ||
+      typeof receipt.expiresAt !== "string" ||
+      !Number.isFinite(Date.parse(receipt.issuedAt)) ||
+      !Number.isFinite(Date.parse(receipt.expiresAt)) ||
+      Date.parse(receipt.issuedAt) > Number(now()) ||
+      Date.parse(receipt.expiresAt) < Number(now()) ||
+      typeof receipt.signature !== "string" ||
+      receipt.signature.length < 32 ||
+      !DIGEST.test(receipt.receiptDigest ?? "")
+    )
+      throw new Error("Canary gate receipt binding is invalid or expired");
+    const core = structuredClone(receipt);
+    delete core.receiptDigest;
+    if (
+      hash(PROGRESSIVE_CANARY_GATE_RECEIPT_SCHEMA, core) !==
+      receipt.receiptDigest
+    )
+      throw new Error("Canary gate receipt digest mismatch");
+    const payload = structuredClone(core);
+    delete payload.signature;
+    if (!(await verifier({ payload, signature: receipt.signature })))
+      throw new Error("Canary gate receipt signature rejected");
+    return Object.freeze(structuredClone(receipt));
+  }
+
+  const authority = Object.freeze({
+    planDigest: plan.planDigest,
+    tenantId: plan.tenantId,
+    pilotId: plan.pilotId,
+    async evaluate(input = {}) {
+      const report = await evaluateProgressiveCanaryGate({
+        ...input,
+        plan,
+        assignmentAuthority,
+      });
+      const payload = {
+        schema: PROGRESSIVE_CANARY_GATE_RECEIPT_SCHEMA,
+        planDigest: plan.planDigest,
+        tenantId: plan.tenantId,
+        pilotId: plan.pilotId,
+        stepId: report.stepId,
+        report,
+        reportDigest: report.reportDigest,
+        authorityId: plan.gateAuthority.id,
+        authorityRevision: plan.gateAuthority.revision,
+        handlerDigest: plan.gateAuthority.handlerDigest,
+      };
+      const attestation = await attestor(
+        Object.freeze(structuredClone(payload)),
+      );
+      exact(
+        attestation,
+        ["issuedAt", "expiresAt", "signature"],
+        "gate attestation",
+      );
+      const core = { ...payload, ...attestation };
+      return verifyReceipt(
+        Object.freeze({
+          ...core,
+          receiptDigest: hash(PROGRESSIVE_CANARY_GATE_RECEIPT_SCHEMA, core),
+        }),
+        { stepId: report.stepId },
+      );
+    },
+    verify: verifyReceipt,
+  });
+  GATE_AUTHORITIES.add(authority);
+  return authority;
+}
+
+export function isProgressiveCanaryGateAuthority(value) {
+  return GATE_AUTHORITIES.has(value);
+}
+
+export function isProgressiveCanaryAssignmentAuthority(value) {
+  return AUTHORITIES.has(value);
+}
+
 export async function evaluateProgressiveCanaryGate({
   plan: planInput,
   stepId,

package/src/lib/evolution/structured-memory-agent-control-plane.js

@@ -1,10 +1,12 @@
 import structuredMemory from "@chainlesschain/session-core/structured-evolution-memory";
+import { types as utilTypes } from "node:util";
 import { StructuredMemoryLedgerAdapter } from "./structured-memory-ledger-adapter.js";
 import { StructuredMemoryAuthorityLedgerAdapter } from "./structured-memory-authority-ledger-adapter.js";
 import { captureStructuredMemoryPromotionReceiptWriter } from "./structured-memory-promotion-receipt-writer.js";
 import { captureStructuredMemoryPolicyReceiptWriter } from "./structured-memory-policy-receipt-writer.js";
 import { createStructuredMemorySemanticReviewPipeline } from "./structured-memory-semantic-review-pipeline.js";
 import { createSkillEvaluatedPromotionControlPlane } from "./skill-promotion-controller.js";
+import { SKILL_REVOCATION_DEPENDENCY_RESULT_SCHEMA } from "./skill-revocation-propagation.js";
 
 const { captureStructuredMemoryAuthority } = structuredMemory;
 
@@ -12,6 +14,51 @@ export const STRUCTURED_MEMORY_AGENT_CONTROL_PLANE_SCHEMA =
   "chainlesschain.structured-memory-agent-control-plane/v1";
 
 const CONTROL_PLANES = new WeakSet();
+const REVOCATION_REQUEST_KEYS = new Set([
+  "schema",
+  "tenantId",
+  "streamId",
+  "operationId",
+  "transitionDigest",
+  "candidateId",
+  "skillName",
+  "occurredAt",
+  "sourceReceiptDigest",
+  "resolutionDigest",
+  "dependency",
+  "requestDigest",
+]);
+const REVOCATION_DEPENDENCY_KEYS = new Set([
+  "kind",
+  "ref",
+  "digest",
+  "disposition",
+]);
+
+function exactDataRecord(value, keys, label) {
+  if (
+    !value ||
+    typeof value !== "object" ||
+    Array.isArray(value) ||
+    utilTypes.isProxy(value) ||
+    ![Object.prototype, null].includes(Object.getPrototypeOf(value))
+  ) {
+    throw new TypeError(`${label} must be a plain record`);
+  }
+  const own = Reflect.ownKeys(value);
+  if (
+    own.length !== keys.size ||
+    own.some((key) => typeof key !== "string" || !keys.has(key))
+  ) {
+    throw new TypeError(`${label} has an invalid shape`);
+  }
+  for (const key of own) {
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    if (!descriptor || !("value" in descriptor) || !descriptor.enumerable) {
+      throw new TypeError(`${label}.${String(key)} is not a data field`);
+    }
+  }
+}
 
 function sameStorage(left, right) {
   return (
@@ -143,6 +190,78 @@ export function createStructuredMemoryAgentControlPlane({
       projection: memory.projection(),
     });
   };
+  const quarantineMemory = async (input) => {
+    exactDataRecord(
+      input,
+      REVOCATION_REQUEST_KEYS,
+      "Memory revocation request",
+    );
+    exactDataRecord(
+      input.dependency,
+      REVOCATION_DEPENDENCY_KEYS,
+      "Memory revocation dependency",
+    );
+    const request = structuredClone(input);
+    const projection = memory.projection();
+    const active = projection.memories[request?.dependency?.ref];
+    const quarantined = projection.quarantines?.[request?.dependency?.ref];
+    const subject =
+      active ??
+      (quarantined
+        ? {
+            ...quarantined,
+            memoryId: request.dependency.ref,
+            status: "active",
+          }
+        : null);
+    if (!subject) {
+      throw new Error("procedural Memory dependency is missing");
+    }
+    const authorityReceipt = await promotion.retainRevocation(request, subject);
+    if (quarantined) {
+      if (
+        quarantined.metadata?.revocationPropagationRequestDigest !==
+          request.requestDigest ||
+        quarantined.receipts?.revocation !== authorityReceipt.receiptDigest
+      ) {
+        throw new Error("quarantined Memory conflicts with the rollback");
+      }
+    } else {
+      await memory.append({
+        eventId: `revocation-${request.requestDigest.slice("sha256:".length)}`,
+        memoryId: subject.memoryId,
+        layer: "procedural",
+        action: "quarantine",
+        authority: promotionActor,
+        automatic: true,
+        contentDigest: subject.contentDigest,
+        artifactRef: subject.artifactRef,
+        evidenceRefs: authorityReceipt.evidenceRefs,
+        supersedes: [],
+        receiptRefs: { revocation: authorityReceipt.receiptDigest },
+        timestamp: request.occurredAt,
+        metadata: {
+          revocationPropagationRequestDigest: request.requestDigest,
+          transitionDigest: request.transitionDigest,
+        },
+      });
+    }
+    return Object.freeze({
+      schema: SKILL_REVOCATION_DEPENDENCY_RESULT_SCHEMA,
+      authenticated: true,
+      durable: true,
+      applied: true,
+      idempotent: true,
+      tenantId,
+      operationId: request.operationId,
+      requestDigest: request.requestDigest,
+      dependencyKind: request.dependency.kind,
+      dependencyRef: request.dependency.ref,
+      dependencyDigest: request.dependency.digest,
+      disposition: request.dependency.disposition,
+      receiptDigest: memory.projection().projectionDigest,
+    });
+  };
   const controlPlane = Object.freeze({
     schema: STRUCTURED_MEMORY_AGENT_CONTROL_PLANE_SCHEMA,
     tenantId,
@@ -152,6 +271,7 @@ export function createStructuredMemoryAgentControlPlane({
     promotionReceiptWriter: promotion,
     policyReceiptWriter: policy,
     reconcilePromotionMemories: Object.freeze(reconcilePromotionMemories),
+    quarantineMemory: Object.freeze(quarantineMemory),
     createEvaluatedPromotionControlPlane(options = {}) {
       if (
         !options ||

package/src/lib/evolution/structured-memory-authority-ledger-adapter.js

@@ -258,7 +258,11 @@ export class StructuredMemoryAuthorityLedgerAdapter {
   }
 
   async listReceipts(kind) {
-    if (!["critic", "evaluator", "promotion", "policy"].includes(kind)) {
+    if (
+      !["critic", "evaluator", "promotion", "revocation", "policy"].includes(
+        kind,
+      )
+    ) {
       throw new TypeError(
         "a structured memory authority receipt kind is required",
       );

package/src/lib/evolution/structured-memory-promotion-receipt-writer.js

@@ -1,8 +1,13 @@
 import { createHash } from "node:crypto";
+import { types as utilTypes } from "node:util";
 import structuredMemory from "@chainlesschain/session-core/structured-evolution-memory";
 import { buildSkillEvaluatedPromotionReceiptEnvelope } from "./skill-evaluated-promotion.js";
 import { digestSkillMutationReceiptEnvelope } from "./skill-mutation-authority.js";
 import { SKILL_TARGET_MATRIX_EVAL_RECEIPT_SCHEMA } from "./skill-target-matrix-eval.js";
+import {
+  SKILL_REVOCATION_DEPENDENCY_REQUEST_SCHEMA,
+  digestSkillRevocationDependencyRequest,
+} from "./skill-revocation-propagation.js";
 
 const { createStructuredMemoryAuthorityReceipt } = structuredMemory;
 const SKILL_RELEASE_RECEIPT_SCHEMA =
@@ -12,6 +17,26 @@ const SKILL_PROMOTION_REVIEW_ENVELOPE_SCHEMA =
 const RELEASE_RECEIPT_DOMAIN = `${SKILL_RELEASE_RECEIPT_SCHEMA}\0`;
 const DIGEST = /^sha256:[a-f0-9]{64}$/u;
 const WRITERS = new WeakSet();
+const REVOCATION_REQUEST_KEYS = new Set([
+  "schema",
+  "tenantId",
+  "streamId",
+  "operationId",
+  "transitionDigest",
+  "candidateId",
+  "skillName",
+  "occurredAt",
+  "sourceReceiptDigest",
+  "resolutionDigest",
+  "dependency",
+  "requestDigest",
+]);
+const REVOCATION_DEPENDENCY_KEYS = new Set([
+  "kind",
+  "ref",
+  "digest",
+  "disposition",
+]);
 
 function canonical(value) {
   if (value === null || typeof value !== "object") return JSON.stringify(value);
@@ -40,6 +65,31 @@ function requiredDigest(value, name) {
   return value;
 }
 
+function exact(value, keys, label) {
+  if (
+    !value ||
+    typeof value !== "object" ||
+    Array.isArray(value) ||
+    utilTypes.isProxy(value) ||
+    ![Object.prototype, null].includes(Object.getPrototypeOf(value))
+  ) {
+    throw new TypeError(`${label} must be a plain record`);
+  }
+  const own = Reflect.ownKeys(value);
+  if (
+    own.length !== keys.size ||
+    own.some((key) => typeof key !== "string" || !keys.has(key))
+  ) {
+    throw new TypeError(`${label} has an invalid shape`);
+  }
+  for (const key of own) {
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    if (!descriptor || !("value" in descriptor) || !descriptor.enumerable) {
+      throw new TypeError(`${label}.${String(key)} is not a data field`);
+    }
+  }
+}
+
 function capture(owner, name) {
   if (typeof owner?.[name] !== "function") {
     throw new TypeError(`${name} port is required`);
@@ -143,6 +193,45 @@ function verifyPromotion(result, matrixBinding, reviewBinding, tenantId) {
   return { release, receipt, evidenceRefs: [...new Set(evidenceRefs)].sort() };
 }
 
+function verifyRevocation(request, memory, tenantId) {
+  exact(request, REVOCATION_REQUEST_KEYS, "Memory revocation request");
+  exact(
+    request.dependency,
+    REVOCATION_DEPENDENCY_KEYS,
+    "Memory revocation dependency",
+  );
+  if (
+    request?.schema !== SKILL_REVOCATION_DEPENDENCY_REQUEST_SCHEMA ||
+    request.tenantId !== tenantId ||
+    request.dependency?.kind !== "memory" ||
+    request.dependency.disposition !== "quarantine" ||
+    request.dependency.ref !== memory?.memoryId ||
+    request.dependency.digest !== memory?.contentDigest ||
+    request.requestDigest !== digestSkillRevocationDependencyRequest(request) ||
+    memory.layer !== "procedural" ||
+    !DIGEST.test(request.transitionDigest ?? "") ||
+    !DIGEST.test(request.sourceReceiptDigest ?? "") ||
+    !DIGEST.test(request.resolutionDigest ?? "") ||
+    !Number.isFinite(Date.parse(request.occurredAt ?? "")) ||
+    new Date(request.occurredAt).toISOString() !== request.occurredAt ||
+    typeof memory.artifactRef !== "string" ||
+    !Array.isArray(memory.evidenceRefs)
+  ) {
+    throw new Error("Memory revocation request is not exactly bound");
+  }
+  return {
+    evidenceRefs: [
+      ...new Set([
+        ...memory.evidenceRefs,
+        request.transitionDigest,
+        request.sourceReceiptDigest,
+        request.resolutionDigest,
+        request.requestDigest,
+      ]),
+    ].sort(),
+  };
+}
+
 export function createStructuredMemoryPromotionReceiptWriter({
   descriptor: input,
   authorityStore,
@@ -201,6 +290,42 @@ export function createStructuredMemoryPromotionReceiptWriter({
       }
       return signed;
     },
+    async retainRevocation(request, memory) {
+      const verified = verifyRevocation(request, memory, descriptor.tenantId);
+      const receipt = createStructuredMemoryAuthorityReceipt({
+        tenantId: descriptor.tenantId,
+        kind: "revocation",
+        decision: "accepted",
+        memoryId: memory.memoryId,
+        layer: "procedural",
+        action: "quarantine",
+        contentDigest: memory.contentDigest,
+        artifactRef: memory.artifactRef,
+        evidenceRefs: verified.evidenceRefs,
+        issuerId: descriptor.issuerId,
+        issuerRevision: descriptor.issuerRevision,
+        issuerHandlerDigest: descriptor.issuerHandlerDigest,
+        issuedAt: request.occurredAt,
+      });
+      const attestation = await attest({
+        purpose: "structured-memory-revocation-receipt",
+        payloadDigest: receipt.receiptDigest,
+        receipt,
+        propagationRequestDigest: request.requestDigest,
+      });
+      if (attestation === null || attestation === undefined) {
+        throw new Error("revocation receipt attestor returned no attestation");
+      }
+      const signed = Object.freeze({ ...receipt, attestation });
+      const retained = await retainReceipt(signed);
+      if (
+        retained?.persisted !== true ||
+        retained.receiptDigest !== receipt.receiptDigest
+      ) {
+        throw new Error("revocation receipt was not durably acknowledged");
+      }
+      return signed;
+    },
   });
   WRITERS.add(writer);
   return writer;
@@ -215,6 +340,7 @@ export function captureStructuredMemoryPromotionReceiptWriter(value) {
   const captured = Object.freeze({
     descriptor: value.descriptor,
     retainPromotion: capture(value, "retainPromotion"),
+    retainRevocation: capture(value, "retainRevocation"),
   });
   WRITERS.add(captured);
   return captured;