enigma-memory 0.1.17 → 0.1.22

package/scripts/build-hosted-probe-worker.mjs

@@ -27,9 +27,9 @@ export const REQUIRED_WORKER_ENV_REFS = Object.freeze([
 ]);
 
 const WORKER_CLAIM_BOUNDARY = Object.freeze([
-  'This Worker is a hosted public HTTPS probe harness, not the relay/gateway data plane.',
-  'It proves only that the edge route can fail closed and expose /livez and /readyz shape without secrets.',
-  'It must not be used as hosted backend live evidence unless real relay/gateway/storage/KMS/SIEM/backup/operator refs and probes are supplied separately.',
+  'This Worker is a hosted public HTTPS probe harness, not the relay/gateway data plane; hosted_backend_live is always false.',
+  'Its private data plane is closed and non-operational even when /readyz returns 200 after reference checks.',
+  'It must not be used as hosted backend live evidence; operational runtime markers and successful authenticated relay/gateway data-plane proofs must come from the real runtime.',
 ]);
 
 const SECRET_VALUE_RE = /(?:Bearer\s+[A-Za-z0-9._~+/=-]{12,}|Basic\s+[A-Za-z0-9+/=-]{12,}|-----BEGIN [A-Z ]*PRIVATE KEY-----|https?:\/\/[^\s/@]+:[^\s/@]+@|sk-[A-Za-z0-9_-]{16,}|AKIA[0-9A-Z]{16}|raw memory|private prompt|full transcript|decrypted capsule)/iu;
@@ -45,6 +45,12 @@ export function hostedProbeWorkerSource(options = {}) {
   return `const SERVICE_NAME = ${JSON.stringify(serviceName)};
 const REQUIRED_REFS = ${requiredRefs};
 const CLAIM_BOUNDARY = ${boundary};
+const RUNTIME_CAPABILITY = Object.freeze({
+  marker: 'enigma.private_data_plane.runtime.v1',
+  bootstrap_worker: true,
+  private_data_plane_operational: false,
+  authenticated_data_plane_supported: false
+});
 
 function json(body, status = 200) {
   return new Response(JSON.stringify(body, null, 2), {
@@ -70,6 +76,9 @@ function readiness(env) {
     ok: missing.length === 0 && decisionOk,
     service: SERVICE_NAME,
     hosted_probe_only: true,
+    hosted_backend_live: false,
+    private_data_plane_operational: false,
+    runtime_capability: RUNTIME_CAPABILITY,
     missing_evidence_refs: missing,
     checks: [
       { id: 'required_refs', ok: missing.length === 0, missing_count: missing.length, required_count: REQUIRED_REFS.length },
@@ -84,7 +93,7 @@ export default {
     const url = new URL(request.url);
     if (request.method !== 'GET' && request.method !== 'HEAD') return json({ ok: false, error: 'method_not_allowed' }, 405);
     if (url.pathname === '/livez') {
-      return json({ ok: true, service: SERVICE_NAME, hosted_probe_only: true, claim_boundary: CLAIM_BOUNDARY });
+      return json({ ok: true, service: SERVICE_NAME, hosted_probe_only: true, hosted_backend_live: false, private_data_plane_operational: false, runtime_capability: RUNTIME_CAPABILITY, claim_boundary: CLAIM_BOUNDARY });
     }
     if (url.pathname === '/readyz') {
       const body = readiness(env);
@@ -103,6 +112,10 @@ export function validateHostedProbeWorkerSource(source) {
   if (!text.includes("url.pathname === '/readyz'")) blockers.push({ path: 'source', message: 'worker must route /readyz' });
   if (!text.includes('missing_evidence_refs')) blockers.push({ path: 'source', message: 'worker must expose missing evidence refs on /readyz' });
   if (!text.includes('hosted_probe_only: true')) blockers.push({ path: 'source', message: 'worker must mark hosted_probe_only true' });
+  if (!text.includes('hosted_backend_live: false')) blockers.push({ path: 'source', message: 'worker must explicitly declare hosted_backend_live false' });
+  if (!text.includes('private_data_plane_operational: false')) blockers.push({ path: 'source', message: 'worker must explicitly declare the private data plane non-operational' });
+  if (!text.includes('authenticated_data_plane_supported: false')) blockers.push({ path: 'source', message: 'worker must explicitly declare authenticated data-plane support unavailable' });
+  if (/hosted_backend_live\s*:\s*true/u.test(text)) blockers.push({ path: 'source', message: 'probe worker must never declare hosted_backend_live true' });
   if (!text.includes('status,') || !text.includes('body.ok ? 200 : 503')) blockers.push({ path: 'source', message: 'worker readyz must fail closed with 503 until complete' });
   if (SECRET_VALUE_RE.test(text)) blockers.push({ path: 'source', message: 'worker source contains secret-looking literal' });
   for (const ref of REQUIRED_WORKER_ENV_REFS) if (!text.includes(ref)) blockers.push({ path: `source.${ref}`, message: `worker missing required ref ${ref}` });
@@ -129,6 +142,8 @@ export function buildHostedProbeWorkerBundle(options = {}) {
       runtime: 'cloudflare-workers',
       entrypoint: 'worker.mjs',
       default_routes: ['/livez', '/readyz'],
+      hosted_backend_live: false,
+      private_data_plane_operational: false,
       mutates_cloudflare: false,
       command_hint: 'wrangler deploy worker.mjs --name enigma-hosted-probe',
     },