kiokuko-dsh 0.2.20 → 0.2.22

package/migrations/046_curator_classification.sql

@@ -0,0 +1,12 @@
+-- Host-owned, content-bound assessments; no source text or authority labels.
+CREATE TABLE curator_classifications (
+  workspace TEXT NOT NULL,
+  entry_id TEXT NOT NULL REFERENCES entries(id) ON DELETE CASCADE,
+  entry_revision INTEGER NOT NULL CHECK(entry_revision > 0),
+  input_digest TEXT NOT NULL,
+  policy_version TEXT NOT NULL,
+  configuration_digest TEXT NOT NULL,
+  result_json TEXT NOT NULL,
+  result_digest TEXT NOT NULL,
+  PRIMARY KEY(workspace,entry_id,entry_revision,input_digest,policy_version,configuration_digest)
+);

package/migrations/047_managed_operation_journal.sql

@@ -0,0 +1,21 @@
+-- Separate from owned execution: covers only plugin-observed managed boundaries.
+CREATE TABLE dsh_managed_journal_keys (id INTEGER PRIMARY KEY CHECK(id=1), secret TEXT NOT NULL);
+CREATE TABLE dsh_managed_scopes (
+ scope_id TEXT PRIMARY KEY, scope_json TEXT NOT NULL, sealed INTEGER NOT NULL DEFAULT 0,
+ collector_complete INTEGER NOT NULL DEFAULT 1, created_at INTEGER NOT NULL
+);
+CREATE TABLE dsh_managed_operations (
+ operation_id TEXT PRIMARY KEY, scope_id TEXT NOT NULL REFERENCES dsh_managed_scopes(scope_id),
+ sequence INTEGER NOT NULL, state TEXT NOT NULL, operation_json TEXT NOT NULL,
+ UNIQUE(scope_id,sequence)
+);
+CREATE TABLE dsh_managed_transitions (
+ operation_id TEXT NOT NULL REFERENCES dsh_managed_operations(operation_id),
+ sequence INTEGER NOT NULL, transition_json TEXT NOT NULL, PRIMARY KEY(operation_id,sequence)
+);
+CREATE TABLE dsh_managed_snapshots (
+ snapshot_id TEXT PRIMARY KEY, scope_id TEXT NOT NULL REFERENCES dsh_managed_scopes(scope_id),
+ snapshot_json TEXT NOT NULL, created_at INTEGER NOT NULL, retained INTEGER NOT NULL DEFAULT 0
+);
+CREATE INDEX dsh_managed_operations_scope ON dsh_managed_operations(scope_id);
+CREATE UNIQUE INDEX dsh_managed_operations_original ON dsh_managed_operations(json_extract(operation_json,'$.originalRef')) WHERE json_extract(operation_json,'$.originalRef') IS NOT NULL;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kiokuko-dsh",
-  "version": "0.2.20",
+  "version": "0.2.22",
   "description": "Kiokuko plugin for DeepSeek Harness",
   "type": "module",
   "license": "MIT",
@@ -346,7 +346,7 @@
   },
   "guardrail": {
     "manifest": "guardrail/manifest.json",
-    "manifestSha256": "8da49d55f6bb7b8ccf2717f6680e439adda3d7347fb77de39f77566dd6a6d2b1",
+    "manifestSha256": "d001ddccda7a8c47abcb6ea2f5b67c1fd4452593e3750c3bd20ffa087a773297",
     "availability": "Bundled Linux x64/arm64 static musl and macOS Apple Silicon (ARM64). Intel Mac is unsupported. Only Linux x64 native smoke was recorded for the bundled release. Missing or invalid host artifact blocks protocol enrollment.",
     "verification": "npm run verify:guardrail validates bundled identities without executing cross-built binaries; npm run check:guardrail checks current host availability."
   }

package/scripts/guardrail-artifacts.d.mts

@@ -11,3 +11,6 @@ export interface ResolvedGuardrail {
 }
 /** Verify bundled file identities and format synchronously; no execution or network fallback. */
 export function resolveGuardrail(root: string, options?: GuardrailResolveOptions): ResolvedGuardrail
+
+/** Verify the frozen source and release provenance in a repository checkout. */
+export function verifyGuardrailSource(root: string): string

package/scripts/guardrail-artifacts.mjs

@@ -1,4 +1,4 @@
-import { constants, closeSync, fstatSync, lstatSync, openSync, readFileSync, realpathSync } from 'node:fs'
+import { constants, closeSync, fstatSync, lstatSync, openSync, readFileSync, readdirSync, existsSync, realpathSync } from 'node:fs'
 import { createHash } from 'node:crypto'
 import { dirname, join, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
@@ -93,6 +93,7 @@ function indexAt(root) {
   if (digest(bytes) !== metadata.guardrail.manifestSha256) fail('package manifest digest integrity mismatch')
   const index = json(bytes, 'guardrail manifest')
   if (index.schema !== 1 || index.package !== 'kiokuko-guardrail' || typeof index.version !== 'string' || !/^[0-9]+\.[0-9]+\.[0-9]+(?:[-+][a-zA-Z0-9.-]+)?$/u.test(index.version) || !record(index.targets) || !record(index.protocol) || index.protocol.path !== 'guardrail/protocols/coding-routine.lisp') fail('guardrail manifest identity/schema mismatch')
+  if (!hex(index.sourceSha256) || !record(index.buildRecords) || index.buildRecords.path !== 'guardrail/build-records.json' || !hex(index.buildRecords.sha256)) fail('missing release source/build record identity')
   if (Object.keys(index.targets).length === 0) fail('guardrail manifest declares no bundled targets')
   if (!Array.isArray(index.unavailableTargets) || Object.keys(index.targets).some(target => !Object.values(targets).includes(target)) || index.unavailableTargets.some(target => !Object.values(targets).includes(target) || target in index.targets)) fail('guardrail manifest target declaration mismatch')
   return { index, manifestDigest: digest(bytes) }
@@ -111,15 +112,45 @@ export function resolveGuardrail(root, options = {}) {
   const releaseBytes = regularBytes(root, entry.manifest, 1024 * 1024)
   if (digest(releaseBytes) !== entry.manifestSha256) fail('target manifest digest integrity mismatch')
   const release = json(releaseBytes, 'target manifest')
-  if (release.schema !== 1 || release.package !== index.package || release.target !== target || release.version !== index.version || release.build_inputs?.target !== target || !hex(release.source_sha256)) fail('release manifest identity mismatch')
+  if (release.schema !== 1 || release.package !== index.package || release.target !== target || release.version !== index.version || release.build_inputs?.target !== target || release.source_sha256 !== index.sourceSha256) fail('release manifest identity mismatch')
   const binary = regularBytes(root, entry.binary, 16 * 1024 * 1024, true)
   matches(binary, entry, 'engine'); matches(binary, release.artifacts?.['bin/kiokuko-guardrail'], 'release engine')
   executableHeader(binary, target)
+  const recordsBytes = regularBytes(root, index.buildRecords.path, 1024 * 1024)
+  matches(recordsBytes, index.buildRecords, 'build records')
+  const records = json(recordsBytes, 'build records'), build = records.targets?.[target]
+  if (records.schema !== 1 || records.sourceSha256 !== index.sourceSha256 || !record(build) || build.sourceSha256 !== index.sourceSha256 || build.target !== target || build.binarySha256 !== digest(binary) || build.packageSha256 !== entry.verification?.package_sha256 || build.independentBuildsEqual !== true || !Array.isArray(build.builds) || build.builds.length !== 2 || build.builds.some(run => !record(run) || run.exitCode !== 0 || run.binarySha256 !== digest(binary) || !hex(run.stdoutSha256) || !hex(run.stderrSha256)) || build.nativeSmoke !== entry.verification?.native_smoke || entry.verification?.source_sha256 !== index.sourceSha256 || !hex(build.builderSha256) || !hex(build.linkerSha256) || build.cargoSha256 !== release.build_inputs.cargo_sha256 || build.rustcSha256 !== release.build_inputs.rustc_sha256) fail('build record/source/output integrity mismatch')
   const protocol = regularBytes(root, index.protocol.path, 256 * 1024)
   matches(protocol, index.protocol, 'protocol'); matches(protocol, release.artifacts?.['protocols/coding-routine.lisp'], 'release protocol')
   return { binary: join(root, entry.binary), protocol: join(root, index.protocol.path), engineDigest: digest(binary), protocolFileDigest: digest(protocol), manifestDigest, version: index.version, target }
 }
 
+/** Repository-only source check. Packaged consumers deliberately do not carry Rust source. */
+export function verifyGuardrailSource(root) {
+  root = resolve(root)
+  const { index } = indexAt(root)
+  const crate = join(root, 'crates/guardrail')
+  if (!existsSync(crate)) fail('source verification requires the repository crate')
+  function walk(prefix = '') {
+    return readdirSync(join(crate, prefix), { withFileTypes: true }).flatMap(entry => {
+      const path = prefix ? `${prefix}/${entry.name}` : entry.name
+      if (entry.isSymbolicLink()) fail(`source symlink is forbidden: ${path}`)
+      return entry.isDirectory() ? walk(path) : [path]
+    }).sort()
+  }
+  const source = json(regularBytes(root, 'crates/guardrail-release/source-manifest.json', 1024 * 1024), 'source manifest')
+  const files = Object.fromEntries(walk().map(path => [path, digest(regularBytes(crate, path, 1024 * 1024))]))
+  if (JSON.stringify(files) !== JSON.stringify(source.files) || digest(JSON.stringify(files)) !== source.sourceSha256 || source.sourceSha256 !== index.sourceSha256) fail('current source identity mismatch')
+  const provenance = json(regularBytes(root, 'crates/guardrail-release/release-provenance.json', 1024 * 1024), 'release provenance')
+  if (provenance.source_sha256 !== source.sourceSha256 || provenance.build_records_sha256 !== index.buildRecords.sha256) fail('release provenance source/build record mismatch')
+  if (provenance.build_runner_sha256 !== digest(regularBytes(root, 'crates/guardrail-release/release.py', 1024 * 1024))) fail('build runner identity mismatch')
+  for (const [target, entry] of Object.entries(index.targets)) {
+    const releaseBytes = regularBytes(root, entry.manifest, 1024 * 1024), release = json(releaseBytes, 'target manifest')
+    if (JSON.stringify(release.sources) !== JSON.stringify(files) || release.source_sha256 !== source.sourceSha256 || provenance.package_manifests?.[target]?.sha256 !== digest(releaseBytes)) fail('target current source/provenance mismatch')
+  }
+  return source.sourceSha256
+}
+
 if (process.argv[1] && realpathSync(process.argv[1]) === fileURLToPath(import.meta.url)) {
   try {
     const root = resolve(dirname(fileURLToPath(import.meta.url)), '..')
@@ -128,6 +159,7 @@ if (process.argv[1] && realpathSync(process.argv[1]) === fileURLToPath(import.me
     if (process.argv[2] === '--check-host') console.log(JSON.stringify(resolveGuardrail(root)))
     else {
       const { index } = indexAt(root)
+      if (existsSync(join(root, 'crates/guardrail'))) verifyGuardrailSource(root)
       for (const entry of Object.values(index.targets)) resolveGuardrail(root, { platform: entry.platform, arch: entry.arch })
       if (!quiet) console.log(JSON.stringify({ verifiedTargets: Object.keys(index.targets), unavailableTargets: index.unavailableTargets, nativeExecutionClaim: false, verification: Object.fromEntries(Object.entries(index.targets).map(([target, entry]) => [target, entry.verification])) }))
     }