harnery 0.45.0 → 0.45.2

package/src/core/workflow/failure-evidence.ts

@@ -1,141 +0,0 @@
-import { createHash } from "node:crypto";
-import type { AdapterRawResult } from "../adapters/types.ts";
-import type { SpawnFailureEvidence, SpawnOutputSource, SpawnResult } from "./types.ts";
-
-export function unknownFailureEvidence(): SpawnFailureEvidence {
-  return {
-    effect: { state: "unknown" },
-    refusal: { state: "unknown" },
-    partial_output: { state: "unknown" },
-  };
-}
-
-/** Built-in subprocess adapters observe output and process-start failures.
- * Their current vendor envelopes do not prove effects or native refusal.
- * In particular, blank output and 429/5xx statuses leave both unknown. */
-export function observeSpawnFailure(
-  raw: Pick<AdapterRawResult, "spawnErrno" | "timedOut"> &
-    Partial<Pick<AdapterRawResult, "stdout" | "resultFileText">>,
-  text: string,
-  source: SpawnOutputSource,
-): SpawnFailureEvidence {
-  const bytes = Buffer.byteLength(text);
-  return {
-    effect:
-      raw.spawnErrno === "ENOENT" &&
-      !raw.timedOut &&
-      bytes === 0 &&
-      !raw.stdout?.trim() &&
-      !raw.resultFileText?.trim()
-        ? { state: "none", source: "spawn_errno", reference: "ENOENT" }
-        : { state: "unknown" },
-    refusal: { state: "unknown" },
-    partial_output:
-      bytes > 0
-        ? {
-            state: "present",
-            source,
-            bytes,
-            sha256: createHash("sha256").update(text).digest("hex"),
-          }
-        : { state: "absent", source },
-  };
-}
-
-function record(value: unknown): value is Record<string, unknown> {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-
-function keys(value: Record<string, unknown>, expected: readonly string[]): boolean {
-  return (
-    Object.keys(value).length === expected.length &&
-    expected.every((key) => Object.hasOwn(value, key))
-  );
-}
-
-function reference(value: unknown): value is string {
-  return typeof value === "string" && value.trim().length > 0 && value.length <= 512;
-}
-
-function validEffect(value: unknown): boolean {
-  if (!record(value)) return false;
-  if (value.state === "unknown") return keys(value, ["state"]);
-  if (!keys(value, ["state", "source", "reference"])) return false;
-  if (value.state === "none" && value.source === "spawn_errno") {
-    return value.reference === "ENOENT";
-  }
-  return (
-    (value.state === "none" || value.state === "observed") &&
-    value.source === "adapter_evidence" &&
-    reference(value.reference)
-  );
-}
-
-function validRefusal(value: unknown): boolean {
-  if (!record(value)) return false;
-  if (value.state === "unknown") return keys(value, ["state"]);
-  return (
-    keys(value, ["state", "source", "reference"]) &&
-    value.state === "refused" &&
-    value.source === "vendor_envelope" &&
-    reference(value.reference)
-  );
-}
-
-function validOutput(value: unknown): boolean {
-  if (!record(value)) return false;
-  if (value.state === "unknown") return keys(value, ["state"]);
-  if (
-    value.source !== "final_message" &&
-    value.source !== "vendor_envelope" &&
-    value.source !== "stdout"
-  ) {
-    return false;
-  }
-  if (value.state === "absent") return keys(value, ["state", "source"]);
-  return (
-    value.state === "present" &&
-    keys(value, ["state", "source", "bytes", "sha256"]) &&
-    Number.isSafeInteger(value.bytes) &&
-    (value.bytes as number) > 0 &&
-    typeof value.sha256 === "string" &&
-    /^[a-f0-9]{64}$/.test(value.sha256)
-  );
-}
-
-export function isSpawnFailureEvidence(value: unknown): value is SpawnFailureEvidence {
-  return (
-    record(value) &&
-    keys(value, ["effect", "refusal", "partial_output"]) &&
-    validEffect(value.effect) &&
-    validRefusal(value.refusal) &&
-    validOutput(value.partial_output)
-  );
-}
-
-/** Missing observations are unknown; malformed positive claims are rejected.
- * This is also used when reading persisted workflow proof. */
-export function resolveFailureEvidence(value: unknown): SpawnFailureEvidence {
-  if (value === undefined) return unknownFailureEvidence();
-  if (!isSpawnFailureEvidence(value)) throw new Error("invalid spawn failure evidence");
-  return value;
-}
-
-export function failureEvidenceAllowsUncharged(value: unknown): boolean {
-  const evidence = resolveFailureEvidence(value);
-  return (
-    evidence.effect.state === "none" &&
-    evidence.refusal.state !== "refused" &&
-    evidence.partial_output.state === "absent"
-  );
-}
-
-/** A provider retry requires positive no-effect evidence. A missing binary is
- * known not to have started, but retrying that unchanged environment cannot help. */
-export function canRetryFailedSpawn(result: SpawnResult): boolean {
-  return (
-    !result.ok &&
-    result.class !== "environment" &&
-    failureEvidenceAllowsUncharged(result.failureEvidence)
-  );
-}

package/src/core/workflow/recovery-audit.ts

@@ -1,181 +0,0 @@
-import { randomUUID } from "node:crypto";
-import { existsSync, lstatSync, mkdirSync, readdirSync } from "node:fs";
-import { hostname } from "node:os";
-import { dirname, join } from "node:path";
-import { stateDirMode } from "../storage/modes.ts";
-import { assertWorkflowRunId } from "./approvals.ts";
-import {
-  fsyncParentDirectory,
-  readJsonRecord,
-  stableDigest,
-  writeImmutableJson,
-} from "./durable-record.ts";
-
-export interface WorkflowRecoveryAuthorization {
-  actor: string;
-  reason: string;
-}
-
-export interface WorkflowRecoveryIntent extends WorkflowRecoveryAuthorization {
-  schema_version: 1;
-  operation_id: string;
-  run_id: string;
-  action: "reclaim_unknown_liveness" | "unlock_resume";
-  target_sha256: string;
-  target: Record<string, unknown>;
-  recorded_at: string;
-  pid: number;
-  host: string;
-  outcome: "unknown";
-}
-
-export interface WorkflowRecoveryRecord {
-  intent: WorkflowRecoveryIntent;
-  outcome: "unknown" | "completed";
-}
-
-export function validateWorkflowRecoveryAuthorization(
-  authorization: WorkflowRecoveryAuthorization,
-): void {
-  for (const [field, limit] of [
-    ["actor", 200],
-    ["reason", 2_000],
-  ] as const) {
-    const value = authorization[field];
-    if (
-      typeof value !== "string" ||
-      !value.trim() ||
-      value.length > limit ||
-      Array.from(value).some(
-        (character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127,
-      )
-    ) {
-      throw new Error(
-        `workflow recovery requires a nonempty ${field} of at most ${limit} characters without control characters`,
-      );
-    }
-  }
-}
-
-/** Canonical recovery ledger: immutable intent is durable before effects.
- * Completion cites that exact intent; absence always means unknown. */
-export function beginWorkflowRecovery(
-  coordRoot: string,
-  input: Omit<
-    WorkflowRecoveryIntent,
-    "schema_version" | "operation_id" | "recorded_at" | "pid" | "host" | "outcome"
-  >,
-): { intent: WorkflowRecoveryIntent; assertCurrent(): void; complete(): void } {
-  assertWorkflowRunId(input.run_id);
-  validateWorkflowRecoveryAuthorization(input);
-  if (!/^[a-f0-9]{64}$/.test(input.target_sha256))
-    throw new Error("workflow recovery requires an exact preview digest");
-  const intent: WorkflowRecoveryIntent = {
-    ...input,
-    schema_version: 1,
-    operation_id: `recovery-${randomUUID()}`,
-    recorded_at: new Date().toISOString(),
-    pid: process.pid,
-    host: hostname(),
-    outcome: "unknown",
-  };
-  const directory = join(
-    coordRoot,
-    ".harnery",
-    "workflows",
-    input.run_id,
-    "recovery",
-    intent.operation_id,
-  );
-  // Sync each newly published directory name too. Syncing only the intent's
-  // immediate parent cannot make a newly created ancestor durable.
-  const runDirectory = join(coordRoot, ".harnery", "workflows", input.run_id);
-  ensureDurableDirectory(runDirectory);
-  const ledgerDirectory = join(runDirectory, "recovery");
-  ensureDurableDirectory(ledgerDirectory);
-  fsyncParentDirectory(ledgerDirectory);
-  mkdirSync(directory, { mode: stateDirMode() });
-  fsyncParentDirectory(directory);
-  const intentPath = join(directory, "intent.json");
-  writeImmutableJson(intentPath, intent);
-  const assertCurrent = () => {
-    if (stableDigest(readJsonRecord(intentPath, "recovery intent")) !== stableDigest(intent))
-      throw new Error("workflow recovery audit authority changed");
-  };
-  return {
-    intent,
-    assertCurrent,
-    complete: () => {
-      assertCurrent();
-      writeImmutableJson(join(directory, "completion.json"), {
-        schema_version: 1,
-        operation_id: intent.operation_id,
-        intent_sha256: stableDigest(intent),
-        outcome: "completed",
-        recorded_at: new Date().toISOString(),
-      });
-    },
-  };
-}
-
-function ensureDurableDirectory(path: string): void {
-  if (existsSync(path)) {
-    if (!lstatSync(path).isDirectory())
-      throw new Error("workflow recovery ledger is not a directory");
-    return;
-  }
-  ensureDurableDirectory(dirname(path));
-  try {
-    mkdirSync(path, { mode: stateDirMode() });
-  } catch (error) {
-    if ((error as NodeJS.ErrnoException).code !== "EEXIST" || !lstatSync(path).isDirectory())
-      throw error;
-  }
-  fsyncParentDirectory(path);
-}
-
-export function readWorkflowRecoveryLedger(
-  coordRoot: string,
-  runId: string,
-): WorkflowRecoveryRecord[] {
-  assertWorkflowRunId(runId);
-  const directory = join(coordRoot, ".harnery", "workflows", runId, "recovery");
-  if (!existsSync(directory)) return [];
-  return readdirSync(directory)
-    .sort()
-    .map((entry) => {
-      if (!/^recovery-[a-f0-9-]{36}$/.test(entry))
-        throw new Error("invalid workflow recovery ledger entry");
-      const intent = readJsonRecord<WorkflowRecoveryIntent>(
-        join(directory, entry, "intent.json"),
-        "recovery intent",
-      );
-      if (
-        intent.schema_version !== 1 ||
-        intent.operation_id !== entry ||
-        intent.run_id !== runId ||
-        intent.outcome !== "unknown" ||
-        !["reclaim_unknown_liveness", "unlock_resume"].includes(intent.action) ||
-        !/^[a-f0-9]{64}$/.test(intent.target_sha256)
-      ) {
-        throw new Error("invalid workflow recovery intent authority");
-      }
-      validateWorkflowRecoveryAuthorization(intent);
-      const completionPath = join(directory, entry, "completion.json");
-      if (!existsSync(completionPath)) return { intent, outcome: "unknown" };
-      const completion = readJsonRecord<{
-        schema_version: number;
-        operation_id: string;
-        intent_sha256: string;
-        outcome: string;
-      }>(completionPath, "recovery completion");
-      if (
-        completion.schema_version !== 1 ||
-        completion.operation_id !== entry ||
-        completion.intent_sha256 !== stableDigest(intent) ||
-        completion.outcome !== "completed"
-      )
-        throw new Error("invalid workflow recovery completion authority");
-      return { intent, outcome: "completed" };
-    });
-}