chainlesschain 0.166.44 → 0.166.46

package/src/lib/evolution/evolution-deployment-config.js

@@ -1,9 +1,14 @@
 import {
+  assertEvolutionDeploymentActiveTrustRoot,
+  assertEvolutionDeploymentDescriptorNotRevoked,
+  assertEvolutionDeploymentRevisionFloor,
   readEvolutionDeploymentProfile,
   setEvolutionDeploymentProfileEnabled,
-  writeEvolutionDeploymentProfile,
+  updateEvolutionDeploymentProfile,
 } from "./evolution-deployment-profile.js";
 import { verifyEvolutionDeployment } from "./evolution-deployment-loader.js";
+import { verifyEvolutionDeploymentRootRotationSync } from "./evolution-deployment-root-rotation.js";
+import { verifyEvolutionDeploymentDescriptorRevocationsSync } from "./evolution-deployment-descriptor-revocations.js";
 
 function environmentSelection(env) {
   const descriptorPath = env.CHAINLESSCHAIN_EVOLUTION_DEPLOYMENT_DESCRIPTOR;
@@ -12,6 +17,102 @@ function environmentSelection(env) {
   return { descriptorPath, trustRootPath };
 }
 
+/**
+ * Project verified deployment prerequisites without importing the host module.
+ * `ready` describes deployment admission only, never a successful model probe:
+ * the command must still load and validate its composition at execution time.
+ */
+export function assessEvolutionDeploymentReadiness(
+  status,
+  { requiredCommands = ["ask", "agent"] } = {},
+) {
+  if (
+    !Array.isArray(requiredCommands) ||
+    requiredCommands.length === 0 ||
+    requiredCommands.some(
+      (command) =>
+        typeof command !== "string" || !/^[a-z][a-z-]*$/.test(command),
+    )
+  ) {
+    throw new TypeError("deployment readiness requires explicit command names");
+  }
+  const commands = Object.freeze([...new Set(requiredCommands)]);
+  const allowed = Array.isArray(status?.commands) ? status.commands : [];
+  const missingCommands = Object.freeze(
+    commands.filter((command) => !allowed.includes(command)),
+  );
+  const result = (state, code, detail, remediation) => {
+    const ready = state === "admitted";
+    return Object.freeze({
+      scope: "deployment-admission",
+      state,
+      code,
+      ready,
+      requiredCommands: commands,
+      missingCommands,
+      runtimeVerification: "not_checked",
+      taskReady: ready ? null : false,
+      detail,
+      remediation,
+    });
+  };
+  if (
+    status?.error ||
+    (status?.effectiveEnabled === true && status?.verified !== true)
+  ) {
+    return result(
+      "invalid",
+      "EVOLUTION_DEPLOYMENT_NOT_VERIFIED",
+      `configured Evolution deployment is not verified${status?.error ? `: ${status.error}` : ""}`,
+      "repair the signed descriptor or trust root, then run cc evolution deployment status --json",
+    );
+  }
+  if (status?.effectiveEnabled !== true) {
+    const disabled =
+      status?.profileEnabled === false && Boolean(status?.descriptorPath);
+    return result(
+      disabled ? "disabled" : "not_configured",
+      disabled
+        ? "EVOLUTION_DEPLOYMENT_DISABLED"
+        : "EVOLUTION_DEPLOYMENT_NOT_CONFIGURED",
+      disabled
+        ? "signed Evolution deployment is disabled"
+        : "no enabled signed Evolution deployment",
+      disabled
+        ? "review the saved signed deployment, then run cc evolution deployment enable"
+        : "configure a signed descriptor and trust root with cc evolution deployment configure --descriptor <path> --trust-root <path>",
+    );
+  }
+  if (missingCommands.length > 0) {
+    return result(
+      "command_not_allowed",
+      "EVOLUTION_DEPLOYMENT_COMMAND_NOT_ALLOWED",
+      `signed Evolution deployment does not admit commands: ${missingCommands.join(", ")}`,
+      `request a signed deployment that admits ${missingCommands.join(", ")}; do not edit the signed descriptor in place`,
+    );
+  }
+  return result(
+    "admitted",
+    "EVOLUTION_DEPLOYMENT_ADMITTED",
+    `signed Evolution deployment admits ${commands.join(", ")}; runtime composition and model execution are not checked`,
+    null,
+  );
+}
+
+function withDeploymentReadiness(status) {
+  return Object.freeze({
+    ...status,
+    readiness: Object.freeze({
+      ask: assessEvolutionDeploymentReadiness(status, {
+        requiredCommands: ["ask"],
+      }),
+      agent: assessEvolutionDeploymentReadiness(status, {
+        requiredCommands: ["agent"],
+      }),
+    }),
+  });
+}
+
 export async function getEvolutionDeploymentStatus(options = {}) {
   const env = options.env || process.env;
   const saved = await readEvolutionDeploymentProfile(options);
@@ -28,6 +129,7 @@ export async function getEvolutionDeploymentStatus(options = {}) {
     effectiveEnabled: source !== "none",
     profileEnabled: saved.profile?.enabled === true,
     profilePath: saved.filePath,
+    activeTrustRootDigest: saved.profile?.activeTrustRootDigest || null,
     descriptorPath:
       selected?.descriptorPath || saved.profile?.descriptorPath || null,
     trustRootPath:
@@ -36,20 +138,38 @@ export async function getEvolutionDeploymentStatus(options = {}) {
     error: saved.error,
     autoPromotion: "hold",
   };
-  if (!selected || saved.error) return Object.freeze(base);
+  if (!selected || saved.error) return withDeploymentReadiness(base);
   try {
     const verified = await verifyEvolutionDeployment(selected, options);
-    return Object.freeze({
+    if (source === "profile")
+      assertEvolutionDeploymentActiveTrustRoot(
+        saved.profile,
+        verified.descriptor,
+      );
+    if (source === "profile")
+      assertEvolutionDeploymentDescriptorNotRevoked(
+        saved.profile,
+        verified.descriptor,
+      );
+    if (source === "profile")
+      assertEvolutionDeploymentRevisionFloor(
+        saved.profile,
+        verified.descriptor,
+      );
+    return withDeploymentReadiness({
       ...base,
       verified: true,
       error: null,
       revision: verified.descriptor.revision,
+      revisionFloor:
+        saved.profile?.revisionFloors?.[verified.descriptor.trustRootDigest] ||
+        null,
       modulePath: verified.modulePath,
       moduleDigest: verified.descriptor.moduleDigest,
       commands: verified.descriptor.commands,
     });
   } catch (error) {
-    return Object.freeze({
+    return withDeploymentReadiness({
       ...base,
       error: error instanceof Error ? error.message : String(error),
     });
@@ -57,21 +177,77 @@ export async function getEvolutionDeploymentStatus(options = {}) {
 }
 
 export async function configureEvolutionDeployment(
-  { descriptorPath, trustRootPath, enabled = true },
+  {
+    descriptorPath,
+    trustRootPath,
+    rootRotationPath = null,
+    revocationPath = null,
+    enabled = true,
+  },
   options = {},
 ) {
   const verified = await verifyEvolutionDeployment(
     { descriptorPath, trustRootPath },
     options,
   );
-  await writeEvolutionDeploymentProfile(
-    {
+  updateEvolutionDeploymentProfile((current) => {
+    if (
+      current?.activeTrustRootDigest &&
+      current.activeTrustRootDigest !== verified.descriptor.trustRootDigest
+    ) {
+      if (typeof rootRotationPath !== "string" || !rootRotationPath) {
+        const error = new Error(
+          "evolution deployment trust root rotation requires a certificate signed by the active root",
+        );
+        error.code = "EVOLUTION_DEPLOYMENT_ROOT_ROTATION_REQUIRED";
+        throw error;
+      }
+      verifyEvolutionDeploymentRootRotationSync({
+        rotationPath: rootRotationPath,
+        fromTrustRootPath: current.trustRootPath,
+        expectedFromTrustRootDigest: current.activeTrustRootDigest,
+        expectedToTrustRootDigest: verified.descriptor.trustRootDigest,
+        destinationRevision: verified.descriptor.revision,
+      });
+    }
+    assertEvolutionDeploymentRevisionFloor(current, verified.descriptor);
+    const receivedRevocations = revocationPath
+      ? verifyEvolutionDeploymentDescriptorRevocationsSync({
+          revocationPath,
+          trustRootPath: verified.trustRootPath,
+          expectedTrustRootDigest: verified.descriptor.trustRootDigest,
+        }).revokedDescriptorRevisions
+      : [];
+    const priorRevocations =
+      current?.revokedDescriptorRevisions?.[
+        verified.descriptor.trustRootDigest
+      ] || [];
+    const revokedDescriptorRevisions = {
+      ...(current?.revokedDescriptorRevisions || {}),
+      [verified.descriptor.trustRootDigest]: [
+        ...new Set([...priorRevocations, ...receivedRevocations]),
+      ].sort((left, right) => left - right),
+    };
+    assertEvolutionDeploymentDescriptorNotRevoked(
+      { revokedDescriptorRevisions },
+      verified.descriptor,
+    );
+    const revisionFloors = {
+      ...(current?.revisionFloors || {}),
+      [verified.descriptor.trustRootDigest]: Math.max(
+        current?.revisionFloors?.[verified.descriptor.trustRootDigest] || 0,
+        verified.descriptor.revision,
+      ),
+    };
+    return {
       enabled: enabled === true,
       descriptorPath: verified.descriptorPath,
       trustRootPath: verified.trustRootPath,
-    },
-    options,
-  );
+      revisionFloors,
+      activeTrustRootDigest: verified.descriptor.trustRootDigest,
+      revokedDescriptorRevisions,
+    };
+  }, options);
   return getEvolutionDeploymentStatus(options);
 }
 
@@ -79,3 +255,34 @@ export async function setEvolutionDeploymentEnabled(enabled, options = {}) {
   await setEvolutionDeploymentProfileEnabled(enabled, options);
   return getEvolutionDeploymentStatus(options);
 }
+
+export function revokeEvolutionDeploymentDescriptorRevisions(
+  { revocationPath },
+  options = {},
+) {
+  updateEvolutionDeploymentProfile((current) => {
+    if (!current?.activeTrustRootDigest)
+      throw new Error("evolution deployment profile is not configured");
+    const record = verifyEvolutionDeploymentDescriptorRevocationsSync({
+      revocationPath,
+      trustRootPath: current.trustRootPath,
+      expectedTrustRootDigest: current.activeTrustRootDigest,
+    });
+    const prior =
+      current.revokedDescriptorRevisions?.[current.activeTrustRootDigest] || [];
+    return {
+      ...current,
+      // Disabling is conservative: the current descriptor may be one of the
+      // newly revoked revisions, and it must not remain executable while the
+      // caller is recovering or selecting a replacement.
+      enabled: false,
+      revokedDescriptorRevisions: {
+        ...(current.revokedDescriptorRevisions || {}),
+        [current.activeTrustRootDigest]: [
+          ...new Set([...prior, ...record.revokedDescriptorRevisions]),
+        ].sort((left, right) => left - right),
+      },
+    };
+  }, options);
+  return getEvolutionDeploymentStatus(options);
+}

package/src/lib/evolution/evolution-deployment-descriptor-revocations.js

@@ -0,0 +1,131 @@
+import { createHash, createPublicKey, verify } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { isAbsolute } from "node:path";
+
+export const EVOLUTION_DEPLOYMENT_DESCRIPTOR_REVOCATIONS_SCHEMA =
+  "chainlesschain.evolution-deployment-descriptor-revocations/v1";
+
+const DIGEST = /^sha256:[a-f0-9]{64}$/u;
+const MAX_BYTES = 64 * 1024;
+const MAX_REVOKED_REVISIONS = 1024;
+
+function canonical(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
+  return `{${Object.keys(value)
+    .sort()
+    .map((key) => `${JSON.stringify(key)}:${canonical(value[key])}`)
+    .join(",")}}`;
+}
+
+function digest(bytes) {
+  return `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
+}
+
+function normalize(value) {
+  const expected = [
+    "revision",
+    "revokedDescriptorRevisions",
+    "schema",
+    "signature",
+    "trustRootDigest",
+  ];
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new TypeError("evolution deployment revocations must be an object");
+  if (canonical(Object.keys(value).sort()) !== canonical(expected))
+    throw new TypeError("evolution deployment revocations fields are invalid");
+  if (value.schema !== EVOLUTION_DEPLOYMENT_DESCRIPTOR_REVOCATIONS_SCHEMA)
+    throw new TypeError("evolution deployment revocations schema is invalid");
+  if (!DIGEST.test(value.trustRootDigest || ""))
+    throw new TypeError("evolution deployment revocations trust root is invalid");
+  if (!Number.isSafeInteger(value.revision) || value.revision < 1)
+    throw new TypeError("evolution deployment revocations revision is invalid");
+  if (
+    !Array.isArray(value.revokedDescriptorRevisions) ||
+    value.revokedDescriptorRevisions.length > MAX_REVOKED_REVISIONS ||
+    value.revokedDescriptorRevisions.some(
+      (revision) => !Number.isSafeInteger(revision) || revision < 1,
+    ) ||
+    new Set(value.revokedDescriptorRevisions).size !==
+      value.revokedDescriptorRevisions.length
+  ) {
+    throw new TypeError("evolution deployment revoked revisions are invalid");
+  }
+  if (
+    typeof value.signature !== "string" ||
+    value.signature.length === 0 ||
+    !/^[A-Za-z0-9+/]+={0,2}$/u.test(value.signature)
+  ) {
+    throw new TypeError("evolution deployment revocations signature is invalid");
+  }
+  return Object.freeze({
+    ...value,
+    revokedDescriptorRevisions: Object.freeze(
+      [...value.revokedDescriptorRevisions].sort((left, right) => left - right),
+    ),
+  });
+}
+
+export function serializeEvolutionDeploymentDescriptorRevocationsPayload(value) {
+  const revocations = normalize({ ...value, signature: "AA==" });
+  return canonical({
+    schema: revocations.schema,
+    revision: revocations.revision,
+    trustRootDigest: revocations.trustRootDigest,
+    revokedDescriptorRevisions: revocations.revokedDescriptorRevisions,
+  });
+}
+
+export function verifyEvolutionDeploymentDescriptorRevocationsSync({
+  revocationPath,
+  trustRootPath,
+  expectedTrustRootDigest,
+}) {
+  if (
+    typeof revocationPath !== "string" ||
+    !isAbsolute(revocationPath) ||
+    typeof trustRootPath !== "string" ||
+    !isAbsolute(trustRootPath) ||
+    !DIGEST.test(expectedTrustRootDigest || "")
+  ) {
+    throw new Error("evolution deployment revocation inputs are invalid");
+  }
+  let record;
+  let trustRootBytes;
+  try {
+    const bytes = readFileSync(revocationPath);
+    if (bytes.byteLength === 0 || bytes.byteLength > MAX_BYTES)
+      throw new Error("evolution deployment revocations size is invalid");
+    record = normalize(JSON.parse(bytes.toString("utf8")));
+    trustRootBytes = readFileSync(trustRootPath);
+  } catch (error) {
+    throw new Error(
+      "evolution deployment revocations could not be read",
+      error instanceof Error ? { cause: error } : undefined,
+    );
+  }
+  if (digest(trustRootBytes) !== expectedTrustRootDigest)
+    throw new Error("evolution deployment revocation trust root changed");
+  if (record.trustRootDigest !== expectedTrustRootDigest)
+    throw new Error("evolution deployment revocation trust root does not match");
+  let publicKey;
+  try {
+    publicKey = createPublicKey(trustRootBytes);
+  } catch {
+    throw new Error("evolution deployment revocation trust root is invalid");
+  }
+  if (
+    !verify(
+      null,
+      Buffer.from(
+        serializeEvolutionDeploymentDescriptorRevocationsPayload(record),
+        "utf8",
+      ),
+      publicKey,
+      Buffer.from(record.signature, "base64"),
+    )
+  ) {
+    throw new Error("evolution deployment revocation signature rejected");
+  }
+  return record;
+}

package/src/lib/evolution/evolution-deployment-loader.js

@@ -2,7 +2,12 @@ import { createHash, createPublicKey, verify } from "node:crypto";
 import { readFile, realpath } from "node:fs/promises";
 import { isAbsolute } from "node:path";
 import { types as utilTypes } from "node:util";
-import { readEvolutionDeploymentProfile } from "./evolution-deployment-profile.js";
+import {
+  assertEvolutionDeploymentActiveTrustRoot,
+  assertEvolutionDeploymentDescriptorNotRevoked,
+  assertEvolutionDeploymentRevisionFloor,
+  readEvolutionDeploymentProfile,
+} from "./evolution-deployment-profile.js";
 
 export const EVOLUTION_DEPLOYMENT_DESCRIPTOR_SCHEMA =
   "chainlesschain.evolution-deployment-descriptor/v1";
@@ -126,6 +131,77 @@ function dependencies(value, commandName) {
   return Object.freeze({ ...value });
 }
 
+function deniedAgentDependencies(commandName, code, message, source = null) {
+  if (commandName !== "agent") return null;
+  const evolutionCompositionFactory = Object.freeze(async () => {
+    const error = new Error(message);
+    error.code = code;
+    throw error;
+  });
+  if (
+    source === null ||
+    typeof source !== "object" ||
+    Array.isArray(source) ||
+    utilTypes.isProxy(source)
+  ) {
+    return Object.freeze({ evolutionCompositionFactory });
+  }
+  const descriptors = Object.getOwnPropertyDescriptors(source);
+  const result = {};
+  for (const [name, descriptor] of Object.entries(descriptors)) {
+    if (name === "evolutionCompositionFactory" || !("value" in descriptor)) {
+      continue;
+    }
+    Object.defineProperty(result, name, {
+      value: descriptor.value,
+      enumerable: descriptor.enumerable,
+      configurable: false,
+      writable: false,
+    });
+  }
+  Object.defineProperty(result, "evolutionCompositionFactory", {
+    value: evolutionCompositionFactory,
+    enumerable: true,
+    configurable: false,
+    writable: false,
+  });
+  return Object.freeze(result);
+}
+
+function authenticatedDependencies(value, commandName) {
+  if (commandName !== "agent") return dependencies(value, commandName);
+  if (
+    value === null ||
+    typeof value !== "object" ||
+    Array.isArray(value) ||
+    utilTypes.isProxy(value)
+  ) {
+    return deniedAgentDependencies(
+      commandName,
+      "EVOLUTION_DEPLOYMENT_INVALID_DEPENDENCIES",
+      "Authenticated agent deployment returned invalid dependencies",
+    );
+  }
+  const descriptor = Object.getOwnPropertyDescriptor(
+    value,
+    "evolutionCompositionFactory",
+  );
+  if (
+    !descriptor ||
+    !("value" in descriptor) ||
+    typeof descriptor.value !== "function" ||
+    descriptor.enumerable !== true
+  ) {
+    return deniedAgentDependencies(
+      commandName,
+      "EVOLUTION_DEPLOYMENT_INVALID_DEPENDENCIES",
+      "Authenticated agent deployment did not provide an evolution composition factory",
+      value,
+    );
+  }
+  return dependencies(value, commandName);
+}
+
 async function loadBuiltInFactories(commandName) {
   const factories = {};
   if (commandName === "learning") {
@@ -224,9 +300,7 @@ async function loadBuiltInFactories(commandName) {
       import("./evolution-eval-process-supervisor.js"),
       import("./governed-skill-synthesis-attestor-trust-approval-client.js"),
       import("./governed-skill-synthesis-attestor-trust-operations-client.js"),
-      import(
-        "./governed-skill-synthesis-attestor-trust-operations-cli-host.js"
-      ),
+      import("./governed-skill-synthesis-attestor-trust-operations-cli-host.js"),
     ]);
     factories.createEvolutionWorkbenchCliHost = createEvolutionWorkbenchCliHost;
     factories.createEvolutionWorkbenchReviewRuntime =
@@ -353,9 +427,8 @@ async function loadBuiltInFactories(commandName) {
     commandName === "stream" ||
     commandName === "ui"
   ) {
-    const { createAgentEvolutionRuntimeComposition } = await import(
-      "./agent-evolution-runtime-composition.js"
-    );
+    const { createAgentEvolutionRuntimeComposition } =
+      await import("./agent-evolution-runtime-composition.js");
     factories.createAgentEvolutionRuntimeComposition =
       createAgentEvolutionRuntimeComposition;
   }
@@ -486,8 +559,23 @@ export async function loadEvolutionDeploymentCommandDependencies(
   let descriptorPath = env.CHAINLESSCHAIN_EVOLUTION_DEPLOYMENT_DESCRIPTOR;
   let trustRootPath = env.CHAINLESSCHAIN_EVOLUTION_DEPLOYMENT_TRUST_ROOT;
   let fromSavedProfile = false;
+  let saved = null;
   if (!descriptorPath && !trustRootPath) {
-    const saved = await readEvolutionDeploymentProfile({ env });
+    saved = await readEvolutionDeploymentProfile({ env });
+    if (saved.error) {
+      return deniedAgentDependencies(
+        commandName,
+        "EVOLUTION_DEPLOYMENT_PROFILE_INVALID",
+        "Saved evolution deployment profile is invalid",
+      );
+    }
+    if (saved.profile && !saved.profile.enabled) {
+      return deniedAgentDependencies(
+        commandName,
+        "EVOLUTION_DEPLOYMENT_DISABLED",
+        "Saved evolution deployment profile is disabled",
+      );
+    }
     if (!saved.error && saved.profile?.enabled) {
       descriptorPath = saved.profile.descriptorPath;
       trustRootPath = saved.profile.trustRootPath;
@@ -505,16 +593,43 @@ export async function loadEvolutionDeploymentCommandDependencies(
       { descriptorPath, trustRootPath },
       { read, resolveRealPath, includeModuleBytes: true },
     );
+    if (fromSavedProfile)
+      assertEvolutionDeploymentActiveTrustRoot(
+        saved.profile,
+        verified.descriptor,
+      );
+    if (fromSavedProfile)
+      assertEvolutionDeploymentDescriptorNotRevoked(
+        saved.profile,
+        verified.descriptor,
+      );
+    if (fromSavedProfile)
+      assertEvolutionDeploymentRevisionFloor(
+        saved.profile,
+        verified.descriptor,
+      );
   } catch (error) {
     // A saved profile may become stale after files are moved or rotated. Keep
     // governed capabilities fail-closed while allowing `deployment status`,
     // `configure`, and `disable` to start so the operator can recover. Explicit
     // environment overrides remain strict and surface the error immediately.
-    if (fromSavedProfile) return null;
+    if (fromSavedProfile) {
+      return deniedAgentDependencies(
+        commandName,
+        error?.code || "EVOLUTION_DEPLOYMENT_NOT_VERIFIED",
+        `Saved evolution deployment could not be verified: ${error?.message || String(error)}`,
+      );
+    }
     throw error;
   }
   const { descriptor, moduleBytes } = verified;
-  if (!descriptor.commands.includes(commandName)) return null;
+  if (!descriptor.commands.includes(commandName)) {
+    return deniedAgentDependencies(
+      commandName,
+      "EVOLUTION_DEPLOYMENT_COMMAND_NOT_ALLOWED",
+      `Signed evolution deployment does not admit command: ${commandName}`,
+    );
+  }
   // Import the exact bytes that were authenticated. Importing modulePath here
   // would reopen a pathname-replacement window between hashing and execution.
   // Deployment entrypoints are therefore single-file ESM bundles; any external
@@ -557,7 +672,7 @@ export async function loadEvolutionDeploymentCommandDependencies(
       "additional evolution deployment factories are invalid",
     );
   }
-  return dependencies(
+  return authenticatedDependencies(
     await loaded.createChainlessChainCommandDependencies(
       Object.freeze({
         commandName,