cursedbelt 2.7.0 → 3.0.0

package/src/verify/stages/v6Storage.ts

@@ -1,348 +0,0 @@
-/**
- * V6 — storage & registry contract (04 §2).
- *
- * The storage tier landed in 01; this stage is what keeps it landed. Every rule
- * here corresponds to a failure that is invisible until it is catastrophic:
- * a table without `tenant_id` leaks across tenants the first time the app is
- * multi-user; a second pragma helper means one database quietly runs without
- * `foreign_keys`; a read-then-write port claim hands two booting servers the
- * same port; a plaintext secret column survives a "vault deletion" refactor by
- * living in a table nobody re-read.
- *
- * The declarations come from the app's storage contract (generated from its DDL
- * and repository code) and — for index coverage — from the live schema of a
- * verify-mode database via `PRAGMA index_list`/`index_info`.
- */
-// `cwip/signed-tables`, not `cwip/guard`: this stage needs the LIST, and the
-// guard barrel re-exports the HMAC/key-custody tier with it. Since D13 the
-// studio canvas runs this pipeline in a browser, where `node:crypto`'s polyfill
-// has no `timingSafeEqual` — importing the barrel here failed the studio's
-// client bundle outright.
-import { CC_SIGNED_TABLES } from 'cwip/signed-tables';
-import { CC_REGISTRY_TABLES } from 'cwip/cc-registry-schema';
-import { CC_MAX_TXN_LIFETIME_MS, CC_PRAGMAS, MIGRATION_NAME_PATTERN } from 'cwip/sqlite';
-import { KNOWLEDGE_PG_MIGRATIONS, MEDIA_PG_MIGRATIONS, SYSTEM_PG_MIGRATIONS } from 'cwip/domains';
-import type { PipelineState } from '../context';
-import { ccError, ccWarning, type DiagnosticBag } from '../diagnostics';
-import type { StorageTableDecl } from '../types';
-
-const REGISTRY_DB = 'cc-registry.db';
-const STAGING_DB = 'staging.db';
-
-/** The per-domain database files whose schema this repo owns in BOTH dialects. */
-const DOMAIN_DATABASES = new Set(['knowledge.db', 'media.db', 'system.db', 'search.db']);
-
-/**
- * The real Postgres chains (03 §2), read here so the saas RLS rule checks the
- * SHIPPED schema instead of a declaration about it.
- *
- * Before this, `rls-policy-missing` compared a fixture string against
- * `undefined` — a check with nothing real to check, while the repository
- * contained zero `ROW LEVEL SECURITY` statements in total.
- */
-const PG_CHAIN = [...KNOWLEDGE_PG_MIGRATIONS, ...MEDIA_PG_MIGRATIONS, ...SYSTEM_PG_MIGRATIONS].flatMap(
-  (migration) => migration.statements,
-);
-
-const PG_CHAIN_TABLES = new Set(
-  PG_CHAIN.flatMap((statement) => /^CREATE TABLE ([a-z_0-9]+)/i.exec(statement.trim())?.[1] ?? []),
-);
-
-const PG_POLICIED_TABLES = new Set(
-  PG_CHAIN.flatMap((statement) => /^CREATE POLICY [a-z_]+ ON ([a-z_0-9]+)/i.exec(statement.trim())?.[1] ?? []),
-);
-
-const columnNames = (table: StorageTableDecl): Set<string> => new Set(table.columns.map((c) => c.name));
-
-export function runV6(state: PipelineState, bag: DiagnosticBag): void {
-  const storage = state.input.storage;
-  if (!storage) return; // an app declaring no storage contract has nothing to check here
-  const saas = state.config?.profile === 'saas';
-
-  /* ------------------------------- tenancy ------------------------------- */
-  for (const table of storage.tables) {
-    const columns = columnNames(table);
-    // Registry rows are app-scoped, not tenant-scoped — the rest of the contract
-    // (signatures, allowlist, indexes) still applies to them.
-    if (table.database !== REGISTRY_DB) {
-      if (!columns.has('tenant_id'))
-        bag.push(
-          ccError(
-            'missing-tenancy-column',
-            `Table '${table.name}' (${table.database}) has no tenant_id column.`,
-            `Add tenant_id NOT NULL (and user_id where the row is user-scoped). Tenancy is a column, not a convention — a query that forgets the filter must not be able to return another tenant's rows.`,
-            { path: `${table.database}#${table.name}` },
-          ),
-        );
-      if (table.userScoped === true && !columns.has('user_id'))
-        bag.push(
-          ccError(
-            'missing-tenancy-column',
-            `User-scoped table '${table.name}' (${table.database}) has no user_id column.`,
-            `Add user_id NOT NULL alongside tenant_id.`,
-            { path: `${table.database}#${table.name}` },
-          ),
-        );
-
-      /* --- RLS: verified against the real pg chain where one exists --------- */
-      if (saas) {
-        if (PG_CHAIN_TABLES.has(table.name)) {
-          // A first-party domain table: the policy is VERIFIED, not declared.
-          // `rlsPolicy: 'tenant_isolation'` on a table the chain never protects
-          // is exactly the lie a declarative-only check cannot catch.
-          if (columns.has('tenant_id') && !PG_POLICIED_TABLES.has(table.name))
-            bag.push(
-              ccError(
-                'rls-policy-missing',
-                `SaaS profile: '${table.name}' carries tenant_id but the Postgres chain declares no policy for it.`,
-                `Add ENABLE + FORCE ROW LEVEL SECURITY and a tenant_isolation policy to the domain's pg chain (03 §3) — the DATABASE must refuse a cross-tenant read, not the query that remembered its predicate.`,
-                { path: `${table.database}#${table.name}` },
-              ),
-            );
-        } else if (DOMAIN_DATABASES.has(table.database)) {
-          // A domain table with no Postgres twin exists under SQLite only; under
-          // saas its rows would live nowhere or, worse, in an unprotected table
-          // created out of band.
-          bag.push(
-            ccError(
-              'rls-policy-missing',
-              `SaaS profile: domain table '${table.name}' (${table.database}) has no Postgres chain entry.`,
-              `Ship the table in its domain's pg migration chain (03 §2) — or, if the tier is genuinely not a dialect switch (search's FTS5/vector tier), serve it through its provider seam under saas instead of declaring it here.`,
-              { path: `${table.database}#${table.name}` },
-            ),
-          );
-        } else if (table.rlsPolicy === undefined) {
-          bag.push(
-            ccError(
-              'rls-policy-missing',
-              `SaaS profile: table '${table.name}' declares no row-level policy/namespace.`,
-              `Declare an RLS policy (or a per-tenant namespace) for every table in the saas profile (01 §2.5).`,
-              { path: `${table.database}#${table.name}` },
-            ),
-          );
-        }
-      }
-    }
-
-    /* --------------------- declared queries need indexes ------------------ */
-    for (const query of table.declaredQueries ?? []) {
-      const covered = (table.indexes ?? []).some((index) => query.columns.every((column, position) => index.columns[position] === column));
-      if (!covered)
-        bag.push(
-          ccError(
-            'missing-declared-index',
-            `Declared query shape (${query.columns.join(', ')}) on '${table.name}' has no covering index.`,
-            `Add an index whose leading columns are (${query.columns.join(', ')}) — verified against the live schema via PRAGMA index_list/index_info.`,
-            { path: `${table.database}#${table.name}` },
-          ),
-        );
-    }
-
-    /* ----------------------- secrets & row integrity ---------------------- */
-    if ((table.plaintextSecretColumns?.length ?? 0) > 0)
-      bag.push(
-        ccError(
-          'legacy-vault-detected',
-          `Table '${table.name}' declares plaintext secret column(s): ${(table.plaintextSecretColumns ?? []).join(', ')}.`,
-          `Store secrets as SecretEnvelopes in the registry (01 §3.3). One primitive validates — every legacy vault/unlock path is deleted (02 §1.4).`,
-          { path: `${table.database}#${table.name}` },
-        ),
-      );
-
-    if ((CC_SIGNED_TABLES as readonly string[]).includes(table.name) && table.rowSignature !== true)
-      bag.push(
-        ccError(
-          'row-signature-missing',
-          `Table '${table.name}' is a signed table but declares no row_signature write/verify path.`,
-          `Sign rows with createRowSigner and REFUSE any read whose signature fails (01 §2.7) — out-of-band tampering must be detected, not tolerated.`,
-          { path: `${table.database}#${table.name}` },
-        ),
-      );
-
-    if (table.database === REGISTRY_DB && !(CC_REGISTRY_TABLES as readonly string[]).includes(table.name))
-      bag.push(
-        ccError(
-          'telemetry-in-registry',
-          `Table '${table.name}' lives in ${REGISTRY_DB}, which allows only ${CC_REGISTRY_TABLES.join(', ')}.`,
-          `Move it to its own database — every boot reads the registry, so a high-volume table there is a lock contention source (01 §3).`,
-          { path: `${table.database}#${table.name}` },
-        ),
-      );
-  }
-
-  for (const legacyTable of storage.legacyVaultTables ?? [])
-    bag.push(
-      ccError(
-        'legacy-vault-detected',
-        `Legacy vault-era table '${legacyTable}' is still present.`,
-        `Delete it; GuardEngine is the single security primitive and registry secret envelopes are the only at-rest format (02 §4.1).`,
-        { path: legacyTable },
-      ),
-    );
-
-  /* ------------------------------- pragmas ------------------------------- */
-  for (const [name, expected] of Object.entries(CC_PRAGMAS)) {
-    const actual = storage.pragmas[name];
-    if (actual === undefined || String(actual).toUpperCase() !== String(expected).toUpperCase())
-      bag.push(
-        ccError(
-          'pragma-drift',
-          `Pragma '${name}' is ${actual === undefined ? 'not asserted at open' : `asserted as '${actual}'`}, expected '${expected}'.`,
-          `Open every database through the single pragma controller (cwip/sqlite assertCcPragmas). "We set it" is not evidence it took — the controller re-reads.`,
-          { path: `pragma.${name}` },
-        ),
-      );
-  }
-
-  if (storage.transactionLifetimeGuardMs === undefined || storage.transactionLifetimeGuardMs > CC_MAX_TXN_LIFETIME_MS)
-    bag.push(
-      ccError(
-        'wal-checkpoint-starvation',
-        `The Maximum Transaction Lifetime Guard is ${
-          storage.transactionLifetimeGuardMs === undefined ? 'not installed' : `armed at ${storage.transactionLifetimeGuardMs}ms`
-        }; a lock may pin the WAL beyond ${CC_MAX_TXN_LIFETIME_MS}ms.`,
-        `Install the guard at ≤ ${CC_MAX_TXN_LIFETIME_MS}ms (01 §1.2): a long read pins the WAL, checkpoints stop, and -wal grows until the disk fills.`,
-        { path: 'transactionLifetimeGuardMs' },
-      ),
-    );
-
-  /* ------------------------------ migrations ----------------------------- */
-  for (const migration of storage.migrations) {
-    if (!MIGRATION_NAME_PATTERN.test(migration.id))
-      bag.push(
-        ccError(
-          'migration-namespace-missing',
-          `Migration '${migration.id}' is not namespaced <domain>/<nnnn>_<name>.`,
-          `Rename it, e.g. 'knowledge/0001_spine_and_satellites' — two packages shipping 0001_initial otherwise collide and the second is silently marked applied.`,
-          { path: migration.id },
-        ),
-      );
-    if (migration.ddl && migration.targetDatabase === REGISTRY_DB && migration.issuedBy !== 'station')
-      bag.push(
-        ccError(
-          'client-ddl-on-shared-db',
-          `Migration '${migration.id}' issues DDL against ${REGISTRY_DB} from '${migration.issuedBy}'.`,
-          `Only the station migrates the shared registry; app/staging migrations own their own files (01 §3).`,
-          { path: migration.id },
-        ),
-      );
-    if (migration.issuedBy === 'staging' && migration.targetDatabase !== STAGING_DB)
-      bag.push(
-        ccError(
-          'staging-ddl-escape',
-          `Staging migration '${migration.id}' targets '${migration.targetDatabase}' instead of ${STAGING_DB}.`,
-          `Staging repositories are built on StorageProvider against staging.db only (02 §3.2); promotion is what moves data into a domain database.`,
-          { path: migration.id },
-        ),
-      );
-  }
-
-  /* ----------------------- registry / port allocation -------------------- */
-  if (storage.portAllocation === 'read-then-write')
-    bag.push(
-      ccError(
-        'port-toctou-pattern',
-        `Port allocation uses a read-then-write pattern.`,
-        `Probe the OS socket, then claim with an INSERT that relies on the UNIQUE constraint and retry on conflict (01 §3.1) — read-then-write is a race two booting servers both win.`,
-        { path: 'portAllocation' },
-      ),
-    );
-
-  if (storage.keyMaterial === 'string')
-    bag.push(
-      ccError(
-        'key-material-as-string',
-        `Master key material is typed as a string.`,
-        `Hold key bytes in a Uint8Array/Buffer and zero-fill on lock (01 §3.4) — a JS string cannot be wiped and lingers in scrapeable heap memory.`,
-        { path: 'keyMaterial' },
-      ),
-    );
-
-  const aad = storage.envelopeAad ?? [];
-  if (!(aad.includes('app_id') && aad.includes('key')))
-    bag.push(
-      ccError(
-        'legacy-vault-detected',
-        `Secret envelope AAD binds [${aad.join(', ') || 'nothing'}]; it must bind (app_id, key).`,
-        `Bind app_id and key into the AAD so a ciphertext copied to another app or another key fails authentication (01 §3.3).`,
-        { path: 'envelopeAad' },
-      ),
-    );
-
-  if (saas && storage.saasConnectionPool !== undefined && storage.saasConnectionPool !== 'single-shared-capped')
-    bag.push(
-      ccError(
-        'unpooled-saas-connection',
-        `SaaS profile uses '${storage.saasConnectionPool}' connections instead of the single shared, ceiling-capped pool.`,
-        `Route every tenant query through the one registered pool (01 §2.5) — per-request connections exhaust sockets under concurrency.`,
-        { path: 'saasConnectionPool' },
-      ),
-    );
-
-  /* ------------------------------ telemetry ------------------------------ */
-  if (!storage.telemetry.meterEventsSpillPath)
-    bag.push(
-      ccError(
-        'meter-event-loss-possible',
-        `The meter_events writer declares no durable spill path.`,
-        `Spill billing events to the journal when the telemetry DB is locked and drain on recovery (01 §4.1) — a billing event may never be dropped.`,
-        { path: 'telemetry.meterEventsSpillPath' },
-      ),
-    );
-
-  if (storage.telemetry.apiCallsAwaitedOnRequestPath)
-    bag.push(
-      ccError(
-        'telemetry-blocking-request',
-        `api_calls writes are awaited on a request path.`,
-        `Fire-and-forget the analytics tier behind the split-priority writer (01 §4.1); only billing is durable-critical.`,
-        { path: 'telemetry.apiCallsAwaitedOnRequestPath' },
-      ),
-    );
-
-  /* -------------------------------- backups ------------------------------ */
-  if (storage.backup === 'live-db-tar')
-    bag.push(
-      ccError(
-        'unsafe-live-db-backup',
-        `Backups tar the live database files.`,
-        `Back up with VACUUM INTO against a consistent snapshot (01 §5.3); a tar of an open WAL database restores to a torn state.`,
-        { path: 'backup' },
-      ),
-    );
-
-  if (storage.promotionAgainstLiveDb === true)
-    bag.push(
-      ccError(
-        'promotion-against-live-db',
-        `A promotion/migration is being attempted while a registered app holds the database open.`,
-        `Run the Offline Migration Routine (01 §5.4): stop the app (or refuse), migrate an isolated copy, then swap atomically. DDL never touches a file an app holds open.`,
-        { path: 'promotion' },
-      ),
-    );
-
-  /* ------------------------- precedence & drift -------------------------- */
-  const provenance = state.input.provenance;
-  if (provenance) {
-    const candidates: { source: string; value: number | undefined }[] = [
-      { source: 'registry', value: provenance.registryPort },
-      { source: 'generated .env', value: provenance.envPort },
-      { source: 'config deploy.env', value: provenance.deployEnvPort },
-      { source: 'manifest default', value: provenance.manifestDefaultPort },
-    ];
-    const declared = candidates.filter((c) => c.value !== undefined);
-    const winner = declared[0];
-    const divergent = declared.filter((c) => c.value !== winner?.value);
-    if (winner && divergent.length > 0)
-      bag.push(
-        ccWarning(
-          'config-drift',
-          `Port precedence: '${winner.source}' wins with ${winner.value}; ${divergent
-            .map((c) => `${c.source}=${c.value}`)
-            .join(', ')} diverge${state.config?.ignoreExistingData ? ' (ignoreExistingData bypass is ON)' : ''}.`,
-          { path: 'app.port' },
-          `Reconcile the sources, or accept the registry winner. ignoreExistingData is the only bypass and always logs.`,
-        ),
-      );
-  }
-}

package/src/verify/staging/harvest.spec.ts

@@ -1,102 +0,0 @@
-import { describe, expect, it } from 'bun:test';
-import { readFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { FIXTURES_DIR } from '../fixtures/index';
-import { harvestStagingCatalogs, HARVEST_RETRY_DELAYS_MS, pluginIdFromPath, readStagingFileWithRetry } from './harvest';
-
-const HABITS_ROOT = join(FIXTURES_DIR, 'staging-habits');
-const COLLISION_ROOT = join(FIXTURES_DIR, 'staging-collision');
-
-describe('retry-guarded harvest reads (J4-A)', () => {
-  it('succeeds on the first attempt when the file is readable', async () => {
-    const result = await readStagingFileWithRetry('/any/path', async () => 'content');
-    expect(result).toEqual({ content: 'content', attempts: 1 });
-  });
-
-  it('retries a contended file and reports how many attempts it took', async () => {
-    let calls = 0;
-    const result = await readStagingFileWithRetry('/locked', async () => {
-      calls += 1;
-      if (calls <= 2) throw Object.assign(new Error('EBUSY'), { code: 'EBUSY' });
-      return 'content';
-    });
-    expect(result).toEqual({ content: 'content', attempts: 3 });
-  });
-
-  it('gives up after exactly three retries and surfaces the underlying error', async () => {
-    let calls = 0;
-    const result = await readStagingFileWithRetry('/never', async () => {
-      calls += 1;
-      throw new Error('EPERM');
-    });
-    expect(calls).toBe(HARVEST_RETRY_DELAYS_MS.length + 1);
-    expect('error' in result && result.error.message).toBe('EPERM');
-  });
-
-  it('spends under ~150ms of backoff so a keystroke-time compile stays interactive', async () => {
-    const started = performance.now();
-    await readStagingFileWithRetry('/never', async () => {
-      throw new Error('EBUSY');
-    });
-    expect(performance.now() - started).toBeLessThan(400);
-  });
-});
-
-describe('catalog harvesting', () => {
-  it('harvests a plugin catalog with its tokens and grafted ports', async () => {
-    const { catalogs, issues, retriedPaths } = await harvestStagingCatalogs(HABITS_ROOT);
-    expect(issues).toEqual([]);
-    expect(retriedPaths).toEqual([]);
-    expect(catalogs).toHaveLength(1);
-    const catalog = catalogs[0];
-    expect(catalog?.pluginId).toBe('plugin-habits');
-    expect(catalog?.targetEngine).toBe('knowledge');
-    expect(catalog?.featureKey).toBe('habits');
-    expect(catalog?.tokens.map((t) => t.id)).toEqual(['x-habits:mark']);
-    expect(catalog?.ports?.map((p) => p.id)).toEqual(['mark-out']);
-  });
-
-  it('still harvests when a watcher holds the file locked for two attempts', async () => {
-    const attempts = new Map<string, number>();
-    const { catalogs, issues, retriedPaths } = await harvestStagingCatalogs(HABITS_ROOT, async (path) => {
-      const seen = (attempts.get(path) ?? 0) + 1;
-      attempts.set(path, seen);
-      if (seen <= 2) throw Object.assign(new Error('EBUSY'), { code: 'EBUSY' });
-      return readFileSync(path, 'utf8');
-    });
-    expect(issues).toEqual([]);
-    expect(catalogs).toHaveLength(1);
-    expect(retriedPaths).toHaveLength(1);
-  });
-
-  it('reports an unreadable catalog by name instead of crashing the compile', async () => {
-    const { catalogs, issues } = await harvestStagingCatalogs(HABITS_ROOT, async () => {
-      throw new Error('EBUSY: resource busy or locked');
-    });
-    expect(catalogs).toEqual([]);
-    expect(issues).toHaveLength(1);
-    expect(issues[0]?.message).toContain('after 4 attempts');
-    expect(issues[0]?.path).toContain('habits.token-extension.ts');
-  });
-
-  it('treats an empty file as broken, not as absent', async () => {
-    const { issues } = await harvestStagingCatalogs(HABITS_ROOT, async () => '   ');
-    expect(issues.map((i) => i.message)).toEqual(['Staging token catalog is empty.']);
-  });
-
-  it('returns nothing for a staging root that does not exist', async () => {
-    const result = await harvestStagingCatalogs(join(FIXTURES_DIR, 'no-such-staging-root'));
-    expect(result).toEqual({ catalogs: [], issues: [], retriedPaths: [] });
-  });
-
-  it('harvests a catalog that redeclares a core token — V3, not V0, adjudicates it', async () => {
-    const { catalogs, issues } = await harvestStagingCatalogs(COLLISION_ROOT);
-    expect(issues).toEqual([]);
-    expect(catalogs[0]?.tokens.map((t) => t.id)).toEqual(['media:videos']);
-  });
-
-  it('derives the plugin id from the directory layout', () => {
-    expect(pluginIdFromPath('/staging/plugin-habits/src/a.token-extension.ts', '/staging')).toBe('plugin-habits');
-    expect(pluginIdFromPath('/staging/not-a-plugin/a.token-extension.ts', '/staging')).toBeNull();
-  });
-});