chati-dev 4.5.28 → 4.5.29

package/src/terminal/run-rail-review.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { withUpgradeMaintenance } from '../upgrade/maintenance.js';
 
 import { fileURLToPath } from 'node:url';
 import { randomUUID } from 'node:crypto';
@@ -8,6 +9,7 @@ import {
   buildSpawnCommand, getTerminalCompletionAuthorityReceipt, getTerminalLaunchAuthorityReceipt,
   isTransientFailure, killTerminal, spawnTerminal, waitForTerminal,
 } from './spawner.js';
+import { waitForObservedRailProcess } from './rail-process-observer.js';
 import { checkProviderReadiness } from './provider-preflight.js';
 import { getRateLimiter } from './rate-limiter.js';
 import { startClaimHeartbeat } from './run-rail-task.js';
@@ -18,7 +20,8 @@ import {
   listRailReviewEvidence, recordRailReview, recordRailReviewDispatch, resolveReviewGitSubject,
 } from '../orchestrator/review-runtime.js';
 import {
-  loadRuntimeInstallationV2, resolveRuntimeExecutableBindingV2, resolveRuntimeRailReviewerV2,
+  assertRuntimeTaskReviewBindingV2, loadRuntimeInstallationV2,
+  resolveRuntimeExecutableBindingV2, resolveRuntimeRailReviewerV2,
 } from '../orchestrator/runtime-installation-v2.js';
 import { buildRailReviewPrompt } from './rail-prompts.js';
 import {
@@ -58,7 +61,11 @@ function parseReviewPayload(text) {
   catch (error) { return fail('RAIL_REVIEW_OUTPUT_INVALID', `reviewer returned invalid JSON: ${error.message}`); }
 }
 
-export async function executeRailReview({
+export async function executeRailReview(options = {}) {
+  return withUpgradeMaintenance(options?.projectDir, () => executeRailReviewUnderMaintenance(options));
+}
+
+async function executeRailReviewUnderMaintenance({
   projectDir,
   handoff_id,
   attempt_id,
@@ -74,7 +81,11 @@ export async function executeRailReview({
     provider_id: context.task.execution_binding.provider_id,
     model_id: context.task.execution_binding.model_id,
   };
-  const selected = resolveRuntimeRailReviewerV2({ artifact, builder_identity });
+  // A v2 execution-design handoff seals its reviewer during planning. Legacy
+  // handoffs retain the prior catalog selection path for compatibility only.
+  const selected = context.task.review_binding
+    ? assertRuntimeTaskReviewBindingV2({ artifact, review_binding: context.task.review_binding, builder_identity })
+    : resolveRuntimeRailReviewerV2({ artifact, builder_identity });
   const providerExecutableBinding = resolveRuntimeExecutableBindingV2({
     artifact, provider_id: selected.provider_id, harness_id: selected.harness_id,
   });
@@ -172,7 +183,7 @@ export async function executeRailReview({
     ({ handle, invocation } = await spawnReviewAttempt(0, () => {
       if (heartbeat.evidence().failure) fail('RAIL_LEASE_HEARTBEAT_FAILED', 'review lost its RAIL claim heartbeat');
     }));
-    await waitForTerminal(handle);
+    await waitForObservedRailProcess({ handle, projectDir, attempt_id });
     assertRailReadOnlyCommitWorkspaceUnchanged({ workspace: reviewWorkspace, label: 'RAIL review' });
     while (handle.exitCode !== 0 && retries < max_retries && isTransientFailure(handle.exitCode, [...handle.stdout, ...handle.stderr])) {
       if (heartbeat.evidence().failure) break;
@@ -182,7 +193,7 @@ export async function executeRailReview({
       ({ handle, invocation } = await spawnReviewAttempt(retries, () => {
         if (heartbeat.evidence().failure) fail('RAIL_LEASE_HEARTBEAT_FAILED', 'review lost its RAIL claim heartbeat');
       }));
-      await waitForTerminal(handle);
+      await waitForObservedRailProcess({ handle, projectDir, attempt_id });
       assertRailReadOnlyCommitWorkspaceUnchanged({ workspace: reviewWorkspace, label: 'RAIL review retry' });
     }
   } finally { heartbeat.stop(); }
@@ -217,13 +228,7 @@ export async function executeRailReview({
     invocation,
     result_commit_ref: reviewSubject.result_commit_ref,
   });
-  const next = {
-    accept: 'rail_completion_required',
-    'normal-rework': 'rail_rework_required',
-    AI_ADJUDICATION: 'rail_adjudication_required',
-    'required-human-decision': 'human_authority_required',
-    blocked: 'rail_blocked',
-  }[recorded.decision.decision] || 'rail_blocked';
+  const next = reviewNextRequiredAction(recorded.decision.decision);
   return Object.freeze({
     ok: recorded.decision.decision === 'accept',
     action: 'rail_review_recorded',
@@ -239,12 +244,22 @@ export async function executeRailReview({
     next_required_action: next,
   });
   } finally {
-    let cleanupProven = !handle;
+    // Darwin's valid group completion permits this readonly invocation to
+    // relinquish its claim, but does not prove that every detached reader died.
+    const retainWorkspace = process.platform === 'darwin';
+    let cleanupProven = !handle && !retainWorkspace;
     try {
-      if (handle) { await killTerminal(handle); cleanupProven = true; }
+      if (handle) {
+        await killTerminal(handle);
+        if (retainWorkspace) {
+          await waitForTerminal(handle);
+          getTerminalCompletionAuthorityReceipt(handle);
+        }
+        cleanupProven = true;
+      }
     } finally {
       try {
-        if (cleanupProven && reviewWorkspace) cleanupRailReadOnlyCommitWorkspace(reviewWorkspace);
+        if (cleanupProven && reviewWorkspace && !retainWorkspace) cleanupRailReadOnlyCommitWorkspace(reviewWorkspace);
       } finally {
         if (cleanupProven) {
           relinquishRailTask({
@@ -288,4 +303,10 @@ async function main() {
   }
 }
 
+export function reviewNextRequiredAction(decision) {
+  return { accept: 'rail_completion_required', 'normal-rework': 'rail_rework_required',
+    AI_ADJUDICATION: 'rail_adjudication_required', 'required-human-decision': 'human_authority_required',
+    blocked: 'rail_blocked' }[decision] || 'rail_blocked';
+}
+
 if (process.argv[1] && resolve(process.argv[1]) === resolve(fileURLToPath(import.meta.url))) await main();

package/src/terminal/run-rail-rework.js

@@ -1,12 +1,14 @@
 #!/usr/bin/env node
+import { withUpgradeMaintenance } from '../upgrade/maintenance.js';
 
 import { randomUUID } from 'node:crypto';
 import { fileURLToPath } from 'node:url';
 import { resolve } from 'node:path';
 import {
   buildSpawnCommand, getTerminalCompletionAuthorityReceipt,
-  getTerminalLaunchAuthorityReceipt, isTransientFailure, killTerminal, spawnTerminal, waitForTerminal,
+  isTransientFailure, killTerminal, spawnTerminal,
 } from './spawner.js';
+import { waitForObservedRailProcess } from './rail-process-observer.js';
 import { checkProviderReadiness } from './provider-preflight.js';
 import { getRateLimiter } from './rate-limiter.js';
 import { startClaimHeartbeat } from './run-rail-task.js';
@@ -70,10 +72,17 @@ function latestReworkAuthorization(context) {
   return fail('RAIL_REWORK_NOT_AUTHORIZED', 'the latest canonical decision does not authorize bounded rework');
 }
 
-export async function executeRailRework({
+export async function executeRailRework(options = {}) {
+  return withUpgradeMaintenance(options?.projectDir, () => executeRailReworkUnderMaintenance(options));
+}
+
+async function executeRailReworkUnderMaintenance({
   projectDir,
   handoff_id,
   attempt_id,
+  operator_id,
+  git_dir = projectDir,
+  expected_attempt_event_id,
   timeout = 30 * 60 * 1000,
   max_retries = 2,
   lease_ttl_ms = 5 * 60 * 1000,
@@ -111,7 +120,7 @@ export async function executeRailRework({
   if (!readiness.ready) fail(readiness.code || 'PROVIDER_NOT_READY', readiness.detail || `${binding.harness_id} is not ready`);
   const base_commit_ref = executionHistory.filter((entry) => typeof entry.result_commit_ref === 'string').at(-1)?.result_commit_ref;
   if (!base_commit_ref) fail('RAIL_REWORK_BASE_COMMIT_REQUIRED', 'latest immutable execution evidence has no result commit');
-  const ownership = acquireRailTaskSupervisor({ projectDir, handoff_id, attempt_id, lease_ttl_ms });
+  const ownership = acquireRailTaskSupervisor({ projectDir, handoff_id, attempt_id, operator_id, git_dir, lease_ttl_ms, expected_attempt_event_id });
   context = ownership.context;
   const renewed = ownership.renewed;
   const reservation_id = `rework-reservation-${randomUUID()}`;
@@ -166,32 +175,34 @@ export async function executeRailRework({
         authority_kind: 'rail_execution', invocation_id: invocation.invocation_id,
         launch_nonce: invocation.launch_nonce, provider_id: invocation.provider_id,
       },
-      beforeAuthoritySpawn: () => {
+      beforeAuthoritySpawn: ({ admission_receipt }) => {
         reserveRailReworkLaunch({
           projectDir, handoff_id, attempt_id,
           source_decision_ref: authorization.source_decision_ref,
           reservation_id,
           invocation,
+          admission_receipt,
         });
         // From the final pre-spawn durable launch intent onward, absence of
         // canonical completion evidence remains unresolved after a crash.
         dispatchAwaitingEvidence = true;
       },
+      afterAuthoritySpawn: (launch_receipt, pendingHandle) => {
+        handle = pendingHandle;
+        return recordRailExecutionDispatch({
+          projectDir, handoff_id, attempt_id, invocation, launch_receipt,
+          prompt, run_kind: 'rework',
+        });
+      },
     };
     const built = buildSpawnCommand(config);
     if (built.actualProvider !== config.provider || built.actualModel !== config.model
       || built.actualReasoningConfiguration !== config.reasoningConfiguration) {
       fail('RAIL_REWORK_ROUTE_MISMATCH', 'terminal adapter changed the sealed rework binding');
     }
-    handle = spawnTerminal(config);
-    try {
-      recordRailExecutionDispatch({
-        projectDir, handoff_id, attempt_id, invocation,
-        launch_receipt: getTerminalLaunchAuthorityReceipt(handle),
-        prompt, run_kind: 'rework',
-      });
-    } catch (error) {
-      await killTerminal(handle);
+    try { handle = spawnTerminal(config); }
+    catch (error) {
+      if (handle) await killTerminal(handle);
       throw error;
     }
     return handle;
@@ -214,7 +225,7 @@ export async function executeRailRework({
     failedAttemptRefs.push(persisted.evidence_ref);
   };
   try {
-    await waitForTerminal(handle);
+    await waitForObservedRailProcess({ handle, projectDir, attempt_id });
     while (handle.exitCode !== 0 && retries < max_retries && isTransientFailure(handle.exitCode, [...handle.stdout, ...handle.stderr])) {
       if (heartbeat.evidence().failure) break;
       recordFailedAttempt();
@@ -224,7 +235,7 @@ export async function executeRailRework({
       await getRateLimiter(binding.harness_id).waitForSlot();
       if (heartbeat.evidence().failure) break;
       await launch();
-      await waitForTerminal(handle);
+      await waitForObservedRailProcess({ handle, projectDir, attempt_id });
     }
   } finally { heartbeat.stop(); }
   const heartbeatEvidence = heartbeat.evidence();

package/src/terminal/run-rail-task.js

@@ -1,12 +1,15 @@
 #!/usr/bin/env node
+import { withUpgradeMaintenance } from '../upgrade/maintenance.js';
 
 import { randomUUID } from 'node:crypto';
 import { fileURLToPath } from 'node:url';
 import { resolve } from 'node:path';
+import { attemptExecutionBase } from '@chati/rail';
 import {
   buildSpawnCommand, getTerminalCompletionAuthorityReceipt,
-  getTerminalLaunchAuthorityReceipt, isTransientFailure, killTerminal, spawnTerminal, waitForTerminal,
+  getTerminalLaunchAuthorityReceipt, isTransientFailure, killTerminal, spawnTerminal,
 } from './spawner.js';
+import { waitForObservedRailProcess } from './rail-process-observer.js';
 import { checkProviderReadiness } from './provider-preflight.js';
 import { getRateLimiter } from './rate-limiter.js';
 import {
@@ -139,7 +142,11 @@ export function startClaimHeartbeat({ projectDir, handoff_id, attempt_id, claim_
  * dispatchReadyRailTask and starts the exact selected CLI binding from inside
  * the injected adapter. Retries reuse that same binding and never downgrade.
  */
-export async function executeReadyRailTask({
+export async function executeReadyRailTask(options = {}) {
+  return withUpgradeMaintenance(options?.projectDir, () => executeReadyRailTaskUnderMaintenance(options));
+}
+
+async function executeReadyRailTaskUnderMaintenance({
   projectDir,
   handoff_id,
   task_id,
@@ -149,11 +156,12 @@ export async function executeReadyRailTask({
   git_dir = projectDir,
   lease_ttl_ms,
   recover_expired = false,
+  expected_attempt_event_id,
   timeout = 30 * 60 * 1000,
   max_retries = 2,
 } = {}) {
   if (!projectDir || !handoff_id || !task_id) fail('RAIL_DISPATCH_INPUT_REQUIRED', 'projectDir, handoff_id and task_id are required');
-  const { stored, task } = exactTask({ projectDir, handoff_id, task_id });
+  const { task } = exactTask({ projectDir, handoff_id, task_id });
   const binding = task.execution_binding;
   const providerExecutableBinding = resolveRuntimeExecutableBindingV2({
     artifact: loadRuntimeInstallationV2(projectDir),
@@ -169,13 +177,17 @@ export async function executeReadyRailTask({
   let exactConfig = null;
   const adapter = Object.freeze({
     harness_id: binding.harness_id,
-    invoke({ invocation, prompt, reserve_launch }) {
+    invoke({ attempt, invocation, prompt, reserve_launch, record_dispatch }) {
       exactConfig = Object.freeze({
         ...terminalConfig({
           projectDir, task, invocation, prompt, timeout, providerExecutableBinding,
-          baseCommitRef: stored.handoff.seal.git_commit_ref,
+          baseCommitRef: attemptExecutionBase(attempt),
         }),
         beforeAuthoritySpawn: reserve_launch,
+        afterAuthoritySpawn: (receipt, pendingHandle) => {
+          handle = pendingHandle;
+          return record_dispatch(receipt);
+        },
       });
       assertExactTerminalRoute(exactConfig);
       handle = spawnTerminal(exactConfig);
@@ -191,6 +203,7 @@ export async function executeReadyRailTask({
       projectDir, handoff_id, task_id, attempt_id, operator_id,
       adapter, browser_request, git_dir, lease_ttl_ms: effectiveLeaseTtlMs,
       recover_expired,
+      expected_attempt_event_id,
     });
   } catch (error) {
     if (handle) await killTerminal(handle);
@@ -230,13 +243,13 @@ export async function executeReadyRailTask({
       projectDir, handoff_id, task_id, attempt_id,
       invocation: dispatch.invocation,
       execution: failedExecution,
-      base_commit_ref: dispatch.claim.attempt.git_commit_ref,
+      base_commit_ref: attemptExecutionBase(dispatch.claim.attempt),
       result_commit_ref: null,
     });
     failedAttemptRefs.push(persisted.evidence_ref);
   };
   try {
-    await waitForTerminal(handle);
+    await waitForObservedRailProcess({ handle, projectDir, attempt_id });
     while (handle.exitCode !== 0 && retries < max_retries && isTransientFailure(handle.exitCode, [...handle.stdout, ...handle.stderr])) {
       if (heartbeat.evidence().failure) break;
       recordFailedAttempt();
@@ -253,7 +266,7 @@ export async function executeReadyRailTask({
         if (handle) await killTerminal(handle);
         throw error;
       }
-      await waitForTerminal(handle);
+      await waitForObservedRailProcess({ handle, projectDir, attempt_id });
     }
   } finally {
     heartbeat.stop();
@@ -266,7 +279,7 @@ export async function executeReadyRailTask({
   );
   handle.retryCount = retries;
   const execution = terminalEvidence(handle);
-  const base_commit_ref = dispatch.claim.attempt.git_commit_ref;
+  const base_commit_ref = attemptExecutionBase(dispatch.claim.attempt);
   const invalidOutput = execution.terminal_authority_receipt.execution_result_status === 'invalid_output';
   const envelope = execution.exit_status === 0 && !invalidOutput
     ? parseRailExecutionEnvelope((handle.stdout || []).join(''))

package/src/terminal/runtime-native-helper.js

@@ -0,0 +1,85 @@
+/** Read a native helper against the original publisher attestation. Never
+ * execute or derive trust from the helper's current pathname/hash alone. */
+import { createPublicKey } from 'node:crypto';
+import { closeSync, constants, fstatSync, lstatSync, openSync, readSync, realpathSync } from 'node:fs';
+import { basename, dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { PACKAGE_ARTIFACT_MANIFEST, PACKAGE_ARTIFACT_SIGNATURE, verifyPackageArtifactManifest } from '../installer/package-artifact.js';
+import { digestProviderExecutable } from '../installer-v2/provider-executable.js';
+
+const SOURCE_ROOT = dirname(dirname(fileURLToPath(import.meta.url)));
+const INSTALLED = basename(SOURCE_ROOT) === '_cli';
+const ARTIFACT_ROOT = INSTALLED ? SOURCE_ROOT : dirname(SOURCE_ROOT);
+function fail(message) { throw Object.assign(new Error(message), { code: 'RUNTIME_NATIVE_HELPER_UNTRUSTED' }); }
+function same(left, right) {
+  return ['dev', 'ino', 'mode', 'uid', 'gid', 'nlink', 'size', 'mtimeMs', 'ctimeMs']
+    .every((key) => left[key] === right[key]);
+}
+
+function readMetadata(path, maximum) {
+  let descriptor;
+  try {
+    if (realpathSync(path) !== path) fail('runtime attestation must use physical paths');
+    descriptor = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    const before = fstatSync(descriptor);
+    if (!before.isFile() || before.nlink !== 1 || before.size < 1 || before.size > maximum) {
+      fail('runtime attestation must be a bounded single-link regular file');
+    }
+    const buffer = Buffer.alloc(maximum + 1);
+    let offset = 0;
+    while (offset < buffer.length) {
+      const count = readSync(descriptor, buffer, offset, buffer.length - offset, offset);
+      if (count === 0) break;
+      offset += count;
+    }
+    if (offset > maximum || offset !== before.size || !same(before, fstatSync(descriptor))
+      || !same(before, lstatSync(path))) fail('runtime attestation changed while being read');
+    return buffer.subarray(0, offset).toString('utf8');
+  } finally { if (descriptor !== undefined) closeSync(descriptor); }
+}
+
+export function openAttestedRuntimeNativeHelper(name) {
+  let descriptor;
+  try {
+    if (!['src', '_cli'].includes(basename(SOURCE_ROOT))) fail('unknown runtime source layout');
+    if (!['linux', 'darwin'].includes(process.platform) || !['x64', 'arm64'].includes(process.arch)
+      || !['execution-gate', 'darwin-launcher'].includes(name)
+      || (name === 'darwin-launcher' && process.platform !== 'darwin')) fail('unsupported native helper target');
+    const manifest = JSON.parse(readMetadata(join(ARTIFACT_ROOT, PACKAGE_ARTIFACT_MANIFEST), 4 * 1024 * 1024));
+    const signature = readMetadata(join(ARTIFACT_ROOT, PACKAGE_ARTIFACT_SIGNATURE), 4096);
+    // No caller-selected key or environment trust override. The reader belongs
+    // to this runtime, whose own embedded production root is preserved at copy.
+    const key = createPublicKey(readMetadata(join(SOURCE_ROOT, 'installer/signing-public-key.pem'), 16384));
+    const verified = verifyPackageArtifactManifest(manifest, signature, key);
+    if (!verified.valid) fail(`runtime package attestation rejected: ${verified.reason}`);
+    const metadata = JSON.parse(readMetadata(join(ARTIFACT_ROOT, INSTALLED ? 'version.json' : 'package.json'), 65536));
+    const expectedVersion = INSTALLED ? metadata.package_version : metadata.version;
+    if (manifest.package_name !== 'chati-dev' || typeof expectedVersion !== 'string'
+      || !expectedVersion || manifest.version !== expectedVersion
+      || (!INSTALLED && metadata.name !== 'chati-dev')) fail('runtime package attestation version or name mismatch');
+    const entryPath = `node_modules/@chati/core/native/prebuilds/${process.platform}-${process.arch}/${name}`;
+    const entry = manifest.files[entryPath];
+    if (!entry || !/^[a-f0-9]{64}$/.test(entry.hash) || !Number.isSafeInteger(entry.size)
+      || entry.size < 1 || entry.size > 64 * 1024 * 1024 || !Number.isInteger(entry.mode)
+      || entry.mode < 0 || entry.mode > 0o777 || (entry.mode & 0o111) === 0
+      || (entry.mode & 0o022) !== 0) fail('signed native helper entry is missing or invalid');
+    const path = join(ARTIFACT_ROOT, entryPath);
+    if (realpathSync(path) !== path) fail('native helper must use a physical path');
+    descriptor = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    const before = fstatSync(descriptor);
+    if (!before.isFile() || before.nlink !== 1 || before.size !== entry.size
+      || (before.mode & 0o777) !== entry.mode || ![0, process.geteuid()].includes(before.uid)) {
+      fail('native helper file does not match signed shape or safe ownership');
+    }
+    const executable = digestProviderExecutable(descriptor);
+    if (executable.sha256 !== entry.hash || !same(before, fstatSync(descriptor))
+      || !same(before, lstatSync(path))) fail('native helper bytes differ from the publisher attestation');
+    const result = Object.freeze({ descriptor,
+      binding: Object.freeze({ executable_path: path, executable_sha256: entry.hash }), executable });
+    descriptor = undefined;
+    return result;
+  } catch (error) {
+    if (error.code === 'RUNTIME_NATIVE_HELPER_UNTRUSTED') throw error;
+    return fail(`native helper attestation is unavailable or invalid: ${error.code || error.name}`);
+  } finally { if (descriptor !== undefined) closeSync(descriptor); }
+}