chati-dev 4.5.16 → 4.5.28

package/src/orchestrator/rail-adjudication-evidence.js

@@ -0,0 +1,234 @@
+import {
+  closeSync, constants, fstatSync, fsyncSync, linkSync, mkdirSync,
+  openSync, readSync, unlinkSync, writeSync,
+} from 'node:fs';
+import { randomUUID } from 'node:crypto';
+import { basename, dirname, join, parse, resolve, sep } from 'node:path';
+import { canonicalize, sha256 } from '@chati/core';
+
+function fail(code, message) { const error = new Error(message); error.code = code; throw error; }
+const MAX_EVIDENCE_BYTES = 4 * 1024 * 1024;
+
+function sameIdentity(left, right) {
+  return left?.dev === right?.dev && left?.ino === right?.ino;
+}
+
+function sameSnapshot(left, right) {
+  return sameIdentity(left, right)
+    && left?.mode === right?.mode
+    && left?.uid === right?.uid
+    && left?.gid === right?.gid
+    && left?.nlink === right?.nlink
+    && left?.size === right?.size
+    && left?.mtimeMs === right?.mtimeMs
+    && left?.ctimeMs === right?.ctimeMs;
+}
+
+function runSecurityTestHook(name, payload) {
+  const hook = globalThis[Symbol.for('chati.rail-adjudication-evidence.security-test-hooks')]?.[name];
+  if (typeof hook === 'function') hook(payload);
+}
+
+function readDescriptorBounded(descriptor) {
+  const bytes = Buffer.allocUnsafe(MAX_EVIDENCE_BYTES + 1);
+  let offset = 0;
+  while (offset < bytes.length) {
+    const count = readSync(descriptor, bytes, offset, bytes.length - offset, null);
+    if (count === 0) break;
+    offset += count;
+  }
+  return bytes.subarray(0, offset);
+}
+
+function openPinnedEvidenceDirectory(path, { create = true } = {}) {
+  if (process.platform !== 'linux') {
+    fail('UNSUPPORTED_ADJUDICATION_EVIDENCE_PLATFORM', 'RAIL adjudication evidence requires Linux descriptor-relative filesystem operations');
+  }
+  const absolute = resolve(path);
+  const root = parse(absolute).root;
+  const segments = absolute.slice(root.length).split(sep).filter(Boolean);
+  let descriptor = openSync(root, constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0));
+  try {
+    for (const segment of segments) {
+      const childPath = join(`/proc/self/fd/${descriptor}`, segment);
+      let childDescriptor;
+      try {
+        childDescriptor = openSync(childPath, constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0));
+      } catch (error) {
+        if (error?.code !== 'ENOENT' || !create) {
+          if (['ELOOP', 'ENOTDIR'].includes(error?.code)) {
+            fail('UNSAFE_ADJUDICATION_EVIDENCE_DIRECTORY', 'adjudication evidence directory chain must contain only real directories');
+          }
+          throw error;
+        }
+        try { mkdirSync(childPath, { mode: 0o700 }); }
+        catch (mkdirError) { if (mkdirError?.code !== 'EEXIST') throw mkdirError; }
+        childDescriptor = openSync(childPath, constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0));
+      }
+      const stat = fstatSync(childDescriptor);
+      if (!stat.isDirectory()) {
+        closeSync(childDescriptor);
+        fail('UNSAFE_ADJUDICATION_EVIDENCE_DIRECTORY', 'adjudication evidence directory chain must contain only real directories');
+      }
+      closeSync(descriptor);
+      descriptor = childDescriptor;
+    }
+    return Object.freeze({
+      absolute,
+      descriptor,
+      identity: fstatSync(descriptor),
+      reference: `/proc/self/fd/${descriptor}`,
+    });
+  } catch (error) {
+    closeSync(descriptor);
+    throw error;
+  }
+}
+
+function evidenceEntryPath(directory, name) {
+  if (basename(name) !== name || name === '.' || name === '..') {
+    fail('UNSAFE_ADJUDICATION_EVIDENCE_FILE', 'adjudication evidence entry must be one path segment');
+  }
+  return join(directory.reference, name);
+}
+
+function assertPinnedEvidenceDirectory(directory) {
+  const descriptorStat = fstatSync(directory.descriptor);
+  if (!descriptorStat.isDirectory() || !sameIdentity(descriptorStat, directory.identity)) {
+    fail('UNSAFE_ADJUDICATION_EVIDENCE_DIRECTORY', 'pinned adjudication evidence directory changed');
+  }
+  let current;
+  try { current = openPinnedEvidenceDirectory(directory.absolute, { create: false }); }
+  catch (error) {
+    if (error?.code === 'UNSAFE_ADJUDICATION_EVIDENCE_DIRECTORY') throw error;
+    fail('UNSAFE_ADJUDICATION_EVIDENCE_DIRECTORY', 'adjudication evidence directory chain changed during persistence');
+  }
+  try {
+    if (!sameIdentity(current.identity, directory.identity)) {
+      fail('UNSAFE_ADJUDICATION_EVIDENCE_DIRECTORY', 'adjudication evidence directory chain changed during persistence');
+    }
+  } finally { closeSync(current.descriptor); }
+}
+
+function readRegular(path, { allowMissing = false, directory = null } = {}) {
+  let activeDirectory = directory;
+  const ownedDirectory = activeDirectory === null;
+  if (ownedDirectory) {
+    try { activeDirectory = openPinnedEvidenceDirectory(dirname(path), { create: false }); }
+    catch (error) { if (allowMissing && error?.code === 'ENOENT') return null; throw error; }
+  }
+  const entry = evidenceEntryPath(activeDirectory, basename(path));
+  let descriptor;
+  try {
+    descriptor = openSync(entry, constants.O_RDONLY | (constants.O_NOFOLLOW || 0) | (constants.O_NONBLOCK || 0));
+  } catch (error) {
+    if (ownedDirectory) closeSync(activeDirectory.descriptor);
+    if (allowMissing && error?.code === 'ENOENT') return null;
+    if (['ELOOP', 'ENXIO', 'EISDIR'].includes(error?.code)) {
+      fail('UNSAFE_ADJUDICATION_EVIDENCE_FILE', 'adjudication evidence must not be a symlink, FIFO or directory');
+    }
+    throw error;
+  }
+  try {
+    const before = fstatSync(descriptor);
+    if (!before.isFile() || before.nlink !== 1) {
+      fail('UNSAFE_ADJUDICATION_EVIDENCE_FILE', 'adjudication evidence must be a regular single-link file');
+    }
+    if (before.size > MAX_EVIDENCE_BYTES) {
+      fail('ADJUDICATION_EVIDENCE_SIZE_LIMIT', 'adjudication evidence exceeds the 4 MiB safety limit');
+    }
+    runSecurityTestHook('afterEvidenceStat', { path, descriptor });
+    const content = readDescriptorBounded(descriptor);
+    if (content.length > MAX_EVIDENCE_BYTES) {
+      fail('ADJUDICATION_EVIDENCE_SIZE_LIMIT', 'adjudication evidence exceeds the 4 MiB safety limit');
+    }
+    const after = fstatSync(descriptor);
+    if (!after.isFile() || after.nlink !== 1 || !sameSnapshot(before, after)) {
+      fail('ADJUDICATION_EVIDENCE_STORAGE_CONFLICT', 'adjudication evidence changed while it was being read');
+    }
+    assertPinnedEvidenceDirectory(activeDirectory);
+    return { content: content.toString('utf8'), stat: after };
+  } finally {
+    closeSync(descriptor);
+    if (ownedDirectory) closeSync(activeDirectory.descriptor);
+  }
+}
+
+function persistImmutable(path, serialized) {
+  const bytes = Buffer.from(serialized);
+  if (bytes.length > MAX_EVIDENCE_BYTES) {
+    fail('ADJUDICATION_EVIDENCE_SIZE_LIMIT', 'adjudication evidence exceeds the 4 MiB safety limit');
+  }
+  const directory = openPinnedEvidenceDirectory(dirname(path));
+  const name = basename(path);
+  const temporaryName = `${name}.${process.pid}.${randomUUID()}.tmp`;
+  const temporary = evidenceEntryPath(directory, temporaryName);
+  const destination = evidenceEntryPath(directory, name);
+  let temporaryDescriptor;
+  try {
+    const existing = readRegular(path, { allowMissing: true, directory });
+    if (existing !== null) {
+      if (existing.content !== serialized) fail('ADJUDICATION_EVIDENCE_CONFLICT', 'adjudication evidence id already exists with different material');
+      return false;
+    }
+    runSecurityTestHook('beforeEvidenceTempOpen', { path, temporary, directory: directory.absolute });
+    temporaryDescriptor = openSync(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW || 0), 0o600);
+    runSecurityTestHook('afterEvidenceTempOpen', { path, temporary, directory: directory.absolute });
+    let offset = 0;
+    while (offset < bytes.length) offset += writeSync(temporaryDescriptor, bytes, offset, bytes.length - offset);
+    fsyncSync(temporaryDescriptor);
+    closeSync(temporaryDescriptor);
+    temporaryDescriptor = undefined;
+    assertPinnedEvidenceDirectory(directory);
+    runSecurityTestHook('beforeEvidenceCommit', { path, temporary, directory: directory.absolute });
+    try { linkSync(temporary, destination); }
+    catch (error) {
+      if (error?.code !== 'EEXIST') throw error;
+      const raced = readRegular(path, { directory });
+      if (raced.content !== serialized) fail('ADJUDICATION_EVIDENCE_CONFLICT', 'adjudication evidence raced with different material');
+      return false;
+    }
+    runSecurityTestHook('afterEvidenceCommit', { path, temporary, directory: directory.absolute });
+    assertPinnedEvidenceDirectory(directory);
+    fsyncSync(directory.descriptor);
+    return true;
+  } finally {
+    if (temporaryDescriptor !== undefined) closeSync(temporaryDescriptor);
+    try { unlinkSync(temporary); } catch { /* preserve the primary result */ }
+    fsyncSync(directory.descriptor);
+    closeSync(directory.descriptor);
+  }
+}
+function safeId(value, label) {
+  if (typeof value !== 'string' || !/^[A-Za-z0-9._-]+$/.test(value)) fail('INVALID_ADJUDICATION_EVIDENCE_ID', `${label} is not path-safe`);
+  return value;
+}
+
+export function persistRailAdjudicationEvidence({ projectDir, handoff_id, attempt_id, review_ref, rounds, final_decision } = {}) {
+  safeId(handoff_id, 'handoff_id');
+  safeId(attempt_id, 'attempt_id');
+  if (typeof review_ref !== 'string' || !Array.isArray(rounds) || rounds.length === 0 || !final_decision) {
+    fail('INVALID_ADJUDICATION_EVIDENCE', 'review_ref, non-empty rounds and final_decision are required');
+  }
+  const core = canonicalize({
+    schema_version: 1,
+    evidence_type: 'rail-ai-adjudication',
+    handoff_id,
+    attempt_id,
+    review_ref,
+    rounds,
+    final_decision,
+  });
+  const digest = sha256(core);
+  const evidence_id = `adjudication-${digest.slice(0, 24)}`;
+  const record = canonicalize({ ...core, evidence_id, digest });
+  const directory = resolve(projectDir, '.chati/v2/rail/adjudications', attempt_id);
+  const path = join(directory, `${evidence_id}.json`);
+  const serialized = `${JSON.stringify(record, null, 2)}\n`;
+  persistImmutable(path, serialized);
+  return Object.freeze({
+    path,
+    evidence_ref: `rail-adjudication://${handoff_id}/${attempt_id}/${evidence_id}`,
+    record: Object.freeze(record),
+  });
+}

package/src/orchestrator/rail-evidence-authority.js

@@ -0,0 +1,147 @@
+import { createPublicKey, verify as verifySignature } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { canonicalSerialize, sha256 } from '@chati/core';
+import { loadRuntimeInstallationV2 } from './runtime-installation-v2.js';
+import { readSafeInstallationStorageFile } from '../installer-v2/catalog-client.js';
+
+const CAPABILITIES = new WeakMap();
+const CONSTRUCTION_TOKEN = Symbol('chati.rail-evidence.certified-verifier');
+const MAX_CERTIFICATE_BYTES = 32 * 1024;
+const MAX_EVIDENCE_AGE_MS = 24 * 60 * 60 * 1000;
+const FUTURE_SKEW_MS = 5 * 60 * 1000;
+
+function fail(code, message) {
+  throw Object.assign(new Error(message), { code });
+}
+
+function plainObject(value) {
+  return value && typeof value === 'object' && !Array.isArray(value)
+    && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null)
+    && Object.getOwnPropertySymbols(value).length === 0
+    && Object.values(Object.getOwnPropertyDescriptors(value)).every((descriptor) => Object.hasOwn(descriptor, 'value'));
+}
+
+class CertifiedRailEvidenceVerifier {
+  constructor(certificate, token) {
+    if (token !== CONSTRUCTION_TOKEN) fail('UNTRUSTED_RAIL_EVIDENCE_VERIFIER', 'RAIL evidence verifier must be minted from a valid CHATI certificate');
+    let key;
+    try { key = createPublicKey(certificate.public_key); }
+    catch { fail('INVALID_RAIL_EVIDENCE_CERTIFICATE', 'RAIL evidence authority public key is invalid'); }
+    if (key.type !== 'public' || key.asymmetricKeyType !== 'ed25519') fail('INVALID_RAIL_EVIDENCE_CERTIFICATE', 'RAIL evidence authority key must be Ed25519');
+    CAPABILITIES.set(this, Object.freeze({
+      issuer_id: certificate.issuer_id,
+      project_id: certificate.project_id,
+      not_before: certificate.not_before,
+      expires_at: certificate.expires_at,
+      key,
+    }));
+    Object.freeze(this);
+  }
+}
+
+export function railEvidenceAuthorityCertificatePayload(input = {}) {
+  return Object.freeze({
+    schema_version: 1,
+    certificate_type: 'chati-rail-evidence-authority',
+    project_id: input.project_id,
+    issuer_id: input.issuer_id,
+    public_key: input.public_key,
+    not_before: input.not_before,
+    expires_at: input.expires_at,
+  });
+}
+
+export function signedRailEvidencePayload(input = {}) {
+  return Object.freeze({
+    schema_version: 1,
+    purpose: 'rail_evidence',
+    authority_kind: input.authority_kind,
+    issuer_id: input.issuer_id,
+    project_id: input.project_id,
+    attempt_id: input.attempt_id,
+    commit_ref: input.commit_ref,
+    verdict: input.verdict,
+    evidence_digest: input.evidence_digest,
+    observed_at: input.observed_at,
+  });
+}
+
+export function verifyRailEvidenceAuthorityCertificate({ certificate, expected_project_id, root_public_key, clock = () => new Date() } = {}) {
+  const keys = ['certificate_type', 'expires_at', 'issuer_id', 'not_before', 'project_id', 'public_key', 'schema_version', 'signature'];
+  if (!plainObject(certificate) || Object.keys(certificate).sort().join(',') !== keys.join(',')
+    || certificate.schema_version !== 1
+    || certificate.certificate_type !== 'chati-rail-evidence-authority'
+    || certificate.project_id !== expected_project_id
+    || typeof certificate.issuer_id !== 'string' || !certificate.issuer_id.trim()
+    || typeof certificate.public_key !== 'string' || !certificate.public_key.trim()
+    || typeof certificate.signature !== 'string') {
+    fail('INVALID_RAIL_EVIDENCE_CERTIFICATE', 'RAIL evidence authority certificate is invalid or belongs to another project');
+  }
+  const now = clock();
+  const nowMs = (now instanceof Date ? now : new Date(now)).getTime();
+  const notBeforeMs = Date.parse(certificate.not_before);
+  const expiresMs = Date.parse(certificate.expires_at);
+  if (!Number.isFinite(nowMs) || !Number.isFinite(notBeforeMs) || !Number.isFinite(expiresMs)
+    || nowMs < notBeforeMs || nowMs >= expiresMs) fail('RAIL_EVIDENCE_CERTIFICATE_EXPIRED', 'RAIL evidence authority certificate is not currently valid');
+  let rootKey;
+  let signature;
+  try {
+    rootKey = root_public_key?.type === 'public' ? root_public_key : createPublicKey(root_public_key);
+    signature = Buffer.from(certificate.signature, 'base64');
+  } catch { fail('INVALID_RAIL_EVIDENCE_CERTIFICATE', 'RAIL evidence certificate key material is invalid'); }
+  const valid = rootKey.type === 'public' && rootKey.asymmetricKeyType === 'ed25519'
+    && signature.length === 64 && signature.toString('base64') === certificate.signature
+    && verifySignature(null, Buffer.from(canonicalSerialize(railEvidenceAuthorityCertificatePayload(certificate))), rootKey, signature);
+  if (!valid) fail('INVALID_RAIL_EVIDENCE_CERTIFICATE', 'RAIL evidence authority certificate signature is invalid');
+  return new CertifiedRailEvidenceVerifier(certificate, CONSTRUCTION_TOKEN);
+}
+
+export function verifyRailEvidenceReceipt(verifier, receipt, expected = {}, clock = () => new Date()) {
+  const capability = CAPABILITIES.get(verifier);
+  if (!capability || !plainObject(receipt)) return false;
+  const keys = ['attempt_id', 'authority_kind', 'commit_ref', 'evidence_digest', 'issuer_id', 'observed_at', 'project_id', 'purpose', 'schema_version', 'signature', 'verdict'];
+  if (Object.keys(receipt).sort().join(',') !== keys.join(',')
+    || receipt.schema_version !== 1 || receipt.purpose !== 'rail_evidence'
+    || receipt.issuer_id !== capability.issuer_id || receipt.project_id !== capability.project_id
+    || typeof receipt.signature !== 'string') return false;
+  if (!Object.entries(expected).every(([key, value]) => sha256(receipt[key]) === sha256(value))) return false;
+  const now = clock();
+  const nowMs = (now instanceof Date ? now : new Date(now)).getTime();
+  const observedMs = Date.parse(receipt.observed_at);
+  if (!Number.isFinite(nowMs) || !Number.isFinite(observedMs)
+    || nowMs < Date.parse(capability.not_before) || nowMs >= Date.parse(capability.expires_at)
+    || observedMs > nowMs + FUTURE_SKEW_MS || nowMs - observedMs > MAX_EVIDENCE_AGE_MS) return false;
+  let signature;
+  try { signature = Buffer.from(receipt.signature, 'base64'); }
+  catch { return false; }
+  return signature.length === 64 && signature.toString('base64') === receipt.signature
+    && verifySignature(null, Buffer.from(canonicalSerialize(signedRailEvidencePayload(receipt))), capability.key, signature);
+}
+
+export function loadProjectRailEvidenceAuthority({ projectDir, clock = () => new Date() } = {}) {
+  const artifact = loadRuntimeInstallationV2(projectDir, { clock });
+  if (!artifact) fail('V2_INSTALLATION_REQUIRED', 'RAIL evidence authority requires a v2 installation');
+  const path = join(projectDir, '.chati/v2/rail/evidence-authority.json');
+  let source;
+  try {
+    source = readSafeInstallationStorageFile(path, {
+      allowMissing: true,
+      unsafeCode: 'UNSAFE_RAIL_EVIDENCE_CERTIFICATE',
+      sizeCode: 'UNSAFE_RAIL_EVIDENCE_CERTIFICATE',
+      label: 'RAIL evidence certificate',
+      maxBytes: MAX_CERTIFICATE_BYTES,
+    });
+  } catch (error) {
+    if (error?.code) throw error;
+    fail('UNSAFE_RAIL_EVIDENCE_CERTIFICATE', 'RAIL evidence certificate cannot be read safely');
+  }
+  if (source === null) fail('RAIL_EVIDENCE_AUTHORITY_NOT_CONFIGURED', 'install a CHATI-signed RAIL evidence authority certificate before completion');
+  let certificate;
+  try { certificate = JSON.parse(source.content); }
+  catch { fail('INVALID_RAIL_EVIDENCE_CERTIFICATE', 'RAIL evidence authority certificate is not valid JSON'); }
+  const rootPublicKey = readFileSync(new URL('../installer/signing-public-key.pem', import.meta.url), 'utf8');
+  return verifyRailEvidenceAuthorityCertificate({
+    certificate, expected_project_id: artifact.project_id, root_public_key: rootPublicKey, clock,
+  });
+}

package/src/orchestrator/rail-execution-evidence.js

@@ -0,0 +1,45 @@
+import { execFileSync } from 'node:child_process';
+
+function fail(code, message) { const error = new Error(message); error.code = code; throw error; }
+
+function trustedGitEnvironment(source = process.env) {
+  const environment = Object.fromEntries(Object.entries(source).filter(([key]) => !key.startsWith('GIT_')));
+  return {
+    ...environment,
+    GIT_CONFIG_NOSYSTEM: '1',
+    GIT_CONFIG_GLOBAL: process.platform === 'win32' ? 'NUL' : '/dev/null',
+    GIT_TERMINAL_PROMPT: '0',
+  };
+}
+
+export function parseRailExecutionEnvelope(output) {
+  const text = String(output || '');
+  const matches = [...text.matchAll(/<CHATI_RAIL_EXECUTION>\s*([\s\S]*?)\s*<\/CHATI_RAIL_EXECUTION>/g)];
+  if (matches.length !== 1) fail('RAIL_EXECUTION_OUTPUT_INVALID', 'successful execution must return exactly one CHATI_RAIL_EXECUTION envelope');
+  let payload;
+  try { payload = JSON.parse(matches[0][1]); }
+  catch (error) { return fail('RAIL_EXECUTION_OUTPUT_INVALID', `execution returned invalid result JSON: ${error.message}`); }
+  if (!payload || typeof payload !== 'object' || Array.isArray(payload)
+    || typeof payload.result_commit_ref !== 'string'
+    || !/^[a-f0-9]{40,64}$/.test(payload.result_commit_ref)
+    || typeof payload.launch_nonce !== 'string'
+    || !/^[A-Za-z0-9._-]{16,128}$/.test(payload.launch_nonce)) {
+    fail('RAIL_EXECUTION_OUTPUT_INVALID', 'execution must return a full lowercase Git object id and the exact launch_nonce');
+  }
+  return Object.freeze({ result_commit_ref: payload.result_commit_ref, launch_nonce: payload.launch_nonce });
+}
+
+export function verifyRailResultCommit({ git_dir, base_commit_ref, result_commit_ref } = {}) {
+  for (const [label, value] of Object.entries({ git_dir, base_commit_ref, result_commit_ref })) {
+    if (typeof value !== 'string' || !value.trim()) fail('RAIL_RESULT_COMMIT_INVALID', `${label} is required`);
+  }
+  if (base_commit_ref === result_commit_ref) fail('RAIL_RESULT_COMMIT_REQUIRED', 'execution result commit must differ from its bound base commit');
+  try {
+    execFileSync('git', ['-C', git_dir, 'cat-file', '-e', `${base_commit_ref}^{commit}`], { stdio: 'ignore', env: trustedGitEnvironment() });
+    execFileSync('git', ['-C', git_dir, 'cat-file', '-e', `${result_commit_ref}^{commit}`], { stdio: 'ignore', env: trustedGitEnvironment() });
+    execFileSync('git', ['-C', git_dir, 'merge-base', '--is-ancestor', base_commit_ref, result_commit_ref], { stdio: 'ignore', env: trustedGitEnvironment() });
+  } catch {
+    fail('RAIL_RESULT_NOT_DESCENDANT', 'execution result commit must exist locally and descend from its bound base commit');
+  }
+  return Object.freeze({ base_commit_ref, result_commit_ref });
+}