chainlesschain 0.166.22 → 0.166.25

package/src/lib/evolution/evolution-workbench-batch-executor.js

@@ -1,175 +1,134 @@
-import { createHash } from "node:crypto";
-
+import { types } from "node:util";
 import {
-  EVOLUTION_WORKBENCH_BATCH_PLAN_SCHEMA,
-  filterEvolutionWorkbenchProjection,
-} from "./evolution-workbench-projection.js";
-import { verifySkillPromotionReviewPacketArtifact } from "./skill-promotion-review.js";
-
-export const EVOLUTION_WORKBENCH_BATCH_ITEM_REQUEST_SCHEMA =
-  "chainlesschain.evolution-workbench-batch-item-request/v1";
-export const EVOLUTION_WORKBENCH_BATCH_EXECUTION_SCHEMA =
-  "chainlesschain.evolution-workbench-batch-execution/v1";
-
-const DIGEST = /^sha256:[a-f0-9]{64}$/u;
-
-function canonical(value) {
-  if (value === null || typeof value !== "object") return JSON.stringify(value);
-  if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
-  return `{${Object.keys(value)
-    .sort()
-    .map((key) => `${JSON.stringify(key)}:${canonical(value[key])}`)
-    .join(",")}}`;
-}
-
-function hash(domain, value) {
-  return `sha256:${createHash("sha256")
-    .update(domain)
-    .update("\0")
-    .update(canonical(value))
-    .digest("hex")}`;
-}
-
-function clone(value) {
-  return value == null ? value : structuredClone(value);
-}
-
-function freeze(value) {
-  if (value && typeof value === "object" && !Object.isFrozen(value)) {
-    Object.freeze(value);
-    for (const child of Object.values(value)) freeze(child);
-  }
-  return value;
-}
-
-function verifyPlan(input, tenantId) {
-  if (
-    input?.schema !== EVOLUTION_WORKBENCH_BATCH_PLAN_SCHEMA ||
-    input.tenantId !== tenantId ||
-    !DIGEST.test(input?.planDigest ?? "")
-  )
-    throw new TypeError("Workbench batch plan is invalid");
-  const core = clone(input);
-  delete core.planDigest;
-  if (hash(EVOLUTION_WORKBENCH_BATCH_PLAN_SCHEMA, core) !== input.planDigest)
-    throw new Error("Workbench batch plan digest is invalid");
-  return freeze(clone(input));
-}
-
-function itemRequest(plan, packet) {
-  const core = {
-    schema: EVOLUTION_WORKBENCH_BATCH_ITEM_REQUEST_SCHEMA,
-    tenantId: plan.tenantId,
-    planDigest: plan.planDigest,
-    sourceProjectionDigest: plan.sourceProjectionDigest,
-    packetDigest: packet.packetDigest,
-    candidateId: packet.candidateId,
-    candidateContentDigest: packet.candidateContentDigest,
-    decision: plan.decision,
-    reason: plan.reason,
-    requestedBy: plan.requestedBy,
-    requiredHumanQuorum: packet.requiredHumanQuorum,
-    contentRiskDigest: packet.contentRisk.contentRiskDigest,
-    contentRiskDetected: packet.contentRisk.detected,
-  };
-  return freeze({
-    ...core,
-    requestDigest: hash(EVOLUTION_WORKBENCH_BATCH_ITEM_REQUEST_SCHEMA, core),
-  });
-}
+  verifyWorkbenchBatchPlan,
+  buildWorkbenchBatchItemRequest,
+  verifyWorkbenchHumanDecisionResponse,
+  buildWorkbenchExecutionItem,
+  buildWorkbenchBatchExecution,
+} from "./evolution-workbench-review-protocol.js";
+import { capturePruningData as captureData } from "./governed-wiki-pruning-journal.js";
+export {
+  EVOLUTION_WORKBENCH_BATCH_ITEM_REQUEST_SCHEMA,
+  EVOLUTION_WORKBENCH_BATCH_EXECUTION_SCHEMA,
+} from "./evolution-workbench-review-protocol.js";
 
 export class EvolutionWorkbenchBatchExecutor {
-  constructor({ tenantId, ports } = {}) {
+  constructor({ tenantId, ports, now = Date.now } = {}) {
     if (typeof tenantId !== "string" || tenantId.trim() === "")
       throw new TypeError("tenantId is required");
+    if (typeof now !== "function" || types.isProxy(now))
+      throw new TypeError("Workbench clock is required");
+    if (!ports || typeof ports !== "object" || types.isProxy(ports))
+      throw new TypeError("Workbench ports must be fixed own methods");
     this.tenantId = tenantId;
+    this._now = now;
     for (const name of [
       "loadProjection",
       "resolvePacket",
+      "loadExecutionItem",
       "requestHumanDecision",
+      "verifyHumanDecision",
+      "prepareDecision",
       "retainDecision",
       "commitExecutionItem",
     ]) {
-      if (typeof ports?.[name] !== "function")
+      const method = Object.getOwnPropertyDescriptor(ports, name)?.value;
+      if (typeof method !== "function" || types.isProxy(method))
         throw new TypeError(
           `Workbench batch executor port ${name} is required`,
         );
-      this[`_${name}`] = ports[name].bind(ports);
+      this[`_${name}`] = method.bind(ports);
     }
+    Object.freeze(this);
   }
 
   async execute(input) {
-    const plan = verifyPlan(input, this.tenantId);
-    const projection = await this._loadProjection({
-      tenantId: this.tenantId,
-      projectionDigest: plan.sourceProjectionDigest,
-    });
-    filterEvolutionWorkbenchProjection(projection, { limit: 1 });
-    if (
-      projection.tenantId !== plan.tenantId ||
-      projection.runId !== plan.runId ||
-      projection.skillName !== plan.skillName ||
-      projection.projectionDigest !== plan.sourceProjectionDigest
-    )
-      throw new Error("Workbench batch source projection changed");
+    const plan = verifyWorkbenchBatchPlan(input, this.tenantId);
+    const projection = captureData(
+      await this._loadProjection({
+        tenantId: this.tenantId,
+        projectionDigest: plan.sourceProjectionDigest,
+      }),
+    );
+    verifyWorkbenchBatchPlan(plan, this.tenantId, projection);
     const pending = new Map(
-      projection.candidates
-        .filter(({ status }) => status === "pending")
-        .map((candidate) => [candidate.packetDigest, candidate]),
+      projection.candidates.map((candidate) => [
+        candidate.packetDigest,
+        candidate,
+      ]),
     );
     const items = [];
     for (const packetDigest of plan.packetDigests) {
-      if (!pending.has(packetDigest))
-        throw new Error("Workbench batch packet is no longer pending");
-      const packet = verifySkillPromotionReviewPacketArtifact(
+      const packet = captureData(
         await this._resolvePacket({ tenantId: this.tenantId, packetDigest }),
       );
+      const request = buildWorkbenchBatchItemRequest(plan, packet);
       if (
-        packet.packetDigest !== packetDigest ||
-        packet.candidateId !== pending.get(packetDigest).candidateId
+        packet.candidateId !== pending.get(packetDigest)?.candidateId ||
+        packet.candidateContentDigest !==
+          pending.get(packetDigest)?.candidateContentDigest
       )
         throw new Error("Workbench batch packet was substituted");
-      const request = itemRequest(plan, packet);
-      const decision = await this._requestHumanDecision(request);
-      const expectedDecision =
-        plan.decision === "approve" ? "approved" : "rejected";
+      const stored = captureData(
+        await this._loadExecutionItem({ plan, request }),
+      );
       if (
-        decision?.tenantId !== this.tenantId ||
-        decision.packetDigest !== packetDigest ||
-        decision.candidateId !== packet.candidateId ||
-        decision.decision !== expectedDecision ||
-        decision.automated !== false ||
-        decision.reason !== plan.reason ||
-        decision.requestDigest !== request.requestDigest ||
-        !DIGEST.test(decision.receiptDigest ?? "") ||
-        typeof decision.signature !== "string" ||
-        decision.signature.length < 32
+        stored &&
+        !["prepared", "applied", "committed"].includes(stored.status)
       )
-        throw new Error("Workbench batch human decision is not exactly bound");
+        throw new Error("Workbench execution state is invalid");
+      const raw =
+        stored?.response ?? (await this._requestHumanDecision(request));
+      // Historical freshness is allowed only for an effect the fixed durable
+      // reader has already observed. An unapplied expired approval cannot run.
+      const historical =
+        stored?.status === "applied" || stored?.status === "committed";
+      const response = verifyWorkbenchHumanDecisionResponse(
+        raw,
+        request,
+        packet,
+        historical ? Date.parse(raw.decision?.decidedAt) : Number(this._now()),
+      );
+      if ((await this._verifyHumanDecision({ request, response })) !== true)
+        throw new Error(
+          "Workbench human decision signature verification failed",
+        );
+      const item = buildWorkbenchExecutionItem(request, response);
+      if (stored?.status === "committed") {
+        if (stored.item?.itemDigest !== item.itemDigest)
+          throw new Error("Workbench durable execution item differs");
+        items.push(item);
+        continue;
+      }
+      if (!stored) {
+        const prepared = await this._prepareDecision({
+          plan,
+          request,
+          response,
+        });
+        if (
+          prepared?.authenticated !== true ||
+          prepared.durable !== true ||
+          prepared.responseDigest !== response.responseDigest
+        )
+          throw new Error("Workbench human decision was not durably prepared");
+      }
       const retained = await this._retainDecision({
+        plan,
         packetDigest,
-        decision,
+        decision: response.decision,
+        request,
+        response,
       });
       if (
         retained?.persisted !== true ||
-        retained.receiptDigest !== decision.receiptDigest
+        retained.receiptDigest !== response.decision.receiptDigest
       )
         throw new Error("Workbench batch decision was not durably retained");
-      const itemCore = {
-        packetDigest,
-        requestDigest: request.requestDigest,
-        decisionReceiptDigest: decision.receiptDigest,
-      };
-      const item = freeze({
-        ...itemCore,
-        itemDigest: hash(
-          "chainlesschain.evolution-workbench-batch-execution-item/v1",
-          itemCore,
-        ),
-      });
       const committed = await this._commitExecutionItem({
-        tenantId: this.tenantId,
-        planDigest: plan.planDigest,
+        plan,
+        request,
+        response,
         item,
       });
       if (
@@ -178,18 +137,16 @@ export class EvolutionWorkbenchBatchExecutor {
         committed.itemDigest !== item.itemDigest
       )
         throw new Error("Workbench batch execution item was not committed");
+      const readback = await this._loadExecutionItem({ plan, request });
+      if (
+        readback?.status !== "committed" ||
+        readback.item?.itemDigest !== item.itemDigest
+      )
+        throw new Error(
+          "Workbench batch execution item was not durably read back",
+        );
       items.push(item);
     }
-    const core = {
-      schema: EVOLUTION_WORKBENCH_BATCH_EXECUTION_SCHEMA,
-      tenantId: this.tenantId,
-      planDigest: plan.planDigest,
-      sourceProjectionDigest: plan.sourceProjectionDigest,
-      items,
-    };
-    return freeze({
-      ...core,
-      executionDigest: hash(EVOLUTION_WORKBENCH_BATCH_EXECUTION_SCHEMA, core),
-    });
+    return buildWorkbenchBatchExecution(plan, captureData(items));
   }
 }

package/src/lib/evolution/evolution-workbench-control-ports.js

@@ -0,0 +1,203 @@
+import { randomBytes } from "node:crypto";
+import { types } from "node:util";
+import { captureWorkbenchFileResources } from "./evolution-workbench-file-resources.js";
+import { captureSkillCandidateRegistryReader } from "./skill-candidate-registry.js";
+import { captureSkillReleaseRegistryReader } from "./skill-release-registry.js";
+import { SkillPromotionController } from "./skill-promotion-controller.js";
+import {
+  SkillMutationAuthority,
+  buildSkillMutationRequest,
+  digestSkillMutationTransitionSubject,
+} from "./skill-mutation-authority.js";
+import { consumeWorkbenchRollbackMutationContext } from "./evolution-workbench-rollback-ledger-adapter.js";
+import {
+  capturePruningData as capture,
+  pruningCanonical as canonical,
+} from "./governed-wiki-pruning-journal.js";
+
+const RECEIPTS = [
+  "candidateReceipt",
+  "evalReceipt",
+  "actorReceipt",
+  "parentReceipt",
+  "targetReceipt",
+];
+const TTL_MS = 120_000;
+function record(value, keys, label) {
+  if (
+    !value ||
+    typeof value !== "object" ||
+    Array.isArray(value) ||
+    types.isProxy(value)
+  )
+    throw new TypeError(`${label} must be an own data record`);
+  const fields = Object.getOwnPropertyDescriptors(value);
+  if (
+    Reflect.ownKeys(fields).length !== keys.length ||
+    keys.some((key) => !Object.hasOwn(fields, key))
+  )
+    throw new TypeError(`${label} has missing or replaced fields`);
+  const output = {};
+  for (const key of keys) {
+    if (!Object.hasOwn(fields[key], "value") || !fields[key].enumerable)
+      throw new TypeError(`${label}.${key} must be an own data field`);
+    output[key] = fields[key].value;
+  }
+  return output;
+}
+function fixed(owner, name) {
+  if (!owner || typeof owner !== "object" || types.isProxy(owner))
+    throw new TypeError(`Workbench ${name} port is required`);
+  const fn = Object.getOwnPropertyDescriptor(owner, name)?.value;
+  if (typeof fn !== "function" || types.isProxy(fn))
+    throw new TypeError(`Workbench ${name} fixed own method is required`);
+  return Object.freeze({ [name]: fn.bind(owner) });
+}
+function same(a, b) {
+  return canonical(a) === canonical(b);
+}
+function fail(message) {
+  throw new Error(`Workbench mutation: ${message}`);
+}
+
+/**
+ * Real same-Ledger mutation authority and a rollback-only controller surface.
+ * External receipt sources supply artifacts; independent principal/receipt
+ * verifiers decide authority. No identity, receipt, approval or key is invented.
+ */
+export function createEvolutionWorkbenchControlPorts(input) {
+  const options = record(
+    input,
+    [
+      "descriptor",
+      "fileResources",
+      "candidateRegistry",
+      "principalResolver",
+      "receiptVerifier",
+      "rollbackReceiptSource",
+    ],
+    "Workbench control options",
+  );
+  const { runtimeResources: r, mutationPorts } = captureWorkbenchFileResources(
+    options.fileResources,
+  );
+  const descriptor = capture(options.descriptor);
+  if (!same(descriptor, r.descriptor))
+    fail("descriptor differs from file resources");
+  const candidate = captureSkillCandidateRegistryReader(
+    options.candidateRegistry,
+  );
+  if (candidate.tenantId !== descriptor.tenantId)
+    fail("candidate tenant differs");
+  const primary = captureSkillReleaseRegistryReader(r.releaseRegistry);
+  const verifier = captureSkillReleaseRegistryReader(r.verifierReleaseRegistry);
+  const principalResolver = fixed(options.principalResolver, "resolve");
+  const receiptVerifier = fixed(options.receiptVerifier, "verify");
+  const receiptSource = fixed(options.rollbackReceiptSource, "resolve");
+  if (
+    options.rollbackReceiptSource === options.receiptVerifier ||
+    options.rollbackReceiptSource.resolve === options.receiptVerifier.verify
+  )
+    fail("receipt source and verifier must be independent ports");
+  const authority = new SkillMutationAuthority({
+    principalResolver,
+    receiptVerifier,
+    ...mutationPorts,
+    now: r.now,
+  });
+  const controller = new SkillPromotionController({
+    candidateRegistry: options.candidateRegistry,
+    releaseRegistry: r.releaseRegistry,
+    authority,
+  });
+
+  function current(expected, deadline = expected.expiresAt) {
+    if (Number(r.now()) >= Date.parse(deadline)) fail("authorization expired");
+    const active = primary.readActive(descriptor.skillName);
+    if (!active || !same(active, verifier.readActive(descriptor.skillName)))
+      fail("independent active states differ");
+    const target = primary.readRelease(expected.targetReleaseDigest);
+    if (!same(target, verifier.readRelease(expected.targetReleaseDigest)))
+      fail("independent target bytes differ");
+    if (
+      expected.tenantId !== descriptor.tenantId ||
+      expected.skillName !== descriptor.skillName ||
+      expected.operation !== "rollback" ||
+      expected.targetScope !== "active" ||
+      active.state.stateDigest !== expected.expectedActiveStateDigest ||
+      active.state.revision !== expected.expectedTargetRevision ||
+      active.release.releaseDigest !== expected.fromReleaseDigest ||
+      active.release.contentDigest !== expected.expectedTargetDigest ||
+      active.state.lastKnownGoodReleaseDigest !==
+        expected.targetReleaseDigest ||
+      target.tenantId !== descriptor.tenantId ||
+      target.skillName !== descriptor.skillName ||
+      target.dependencyLockDigest !== expected.dependencyLockDigest ||
+      digestSkillMutationTransitionSubject({
+        tenantId: descriptor.tenantId,
+        skillName: descriptor.skillName,
+        operation: "rollback",
+        candidateId: null,
+        rollbackTargetReleaseDigest: target.releaseDigest,
+        dependencyLockDigest: target.dependencyLockDigest,
+        expectedActiveContentDigest: active.release.contentDigest,
+        expectedActiveRevision: active.state.revision,
+      }) !== expected.transitionSubjectDigest
+    )
+      fail("current release no longer matches the exact prepared rollback");
+  }
+
+  const authorizationProvider = Object.freeze({
+    async authorizeRollback(input) {
+      const expected = consumeWorkbenchRollbackMutationContext(
+        input,
+        r.releaseRegistry,
+        r.ledger,
+        descriptor,
+      );
+      current(expected);
+      const mutation = capture({
+        tenantId: descriptor.tenantId,
+        audience: descriptor.audience,
+        operationId: expected.operationId,
+        operation: "rollback",
+        skillName: descriptor.skillName,
+        targetScope: "active",
+        expectedTargetDigest: expected.expectedTargetDigest,
+        expectedTargetRevision: expected.expectedTargetRevision,
+        transitionSubjectDigest: expected.transitionSubjectDigest,
+        expiresAt: new Date(
+          Math.min(Number(r.now()) + TTL_MS, Date.parse(expected.expiresAt)),
+        ).toISOString(),
+        nonce: randomBytes(32).toString("hex"),
+      });
+      const supplied = await receiptSource.resolve(
+        capture({
+          mutation,
+          planDigest: expected.planDigest,
+          authorizationReceiptDigest: expected.authorizationReceiptDigest,
+          policyReceipt: expected.policyReceipt,
+          fromReleaseDigest: expected.fromReleaseDigest,
+          targetReleaseDigest: expected.targetReleaseDigest,
+        }),
+      );
+      const receipts = record(
+        supplied,
+        RECEIPTS,
+        "Workbench rollback receipt source",
+      );
+      const request = buildSkillMutationRequest({
+        ...mutation,
+        receipts: { ...receipts, policyReceipt: expected.policyReceipt },
+      });
+      current(expected, request.expiresAt);
+      const capability = await authority.authorize(request);
+      current(expected, request.expiresAt);
+      return Object.freeze({ request, capability });
+    },
+  });
+  return Object.freeze({
+    rollbackProvider: controller.createRollbackProvider(),
+    authorizationProvider,
+  });
+}