loki-mode 10.9.1 → 10.10.1

package/packages/control-plane/src/db/fixture-cleanup.ts

@@ -0,0 +1,47 @@
+// One-time cleanup of fixture runs that earlier test suites leaked into real control DBs (FC-07b).
+// Runs at CP start. A marker audit row makes it run once per DB; every removal is audited first, in the same transaction.
+import { Database } from "bun:sqlite";
+import { realpathSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { sep } from "node:path";
+import { audit } from "./prune.ts";
+
+export const FIXTURE_REPO = "acme/widget";
+const DONE = "fixture.cleanup.done";
+
+const tempRoots = (): string[] => {
+  const roots = new Set<string>(["/tmp", "/private/tmp", "/var/tmp", tmpdir()]);
+  for (const r of [...roots]) { try { roots.add(realpathSync(r)); } catch { /* absent */ } }
+  return [...roots].map((r) => r.replace(/[\\/]+$/, "")).filter((r) => r.length > 1);
+};
+
+const underTemp = (p: string, roots: string[]): boolean => roots.some((r) => p === r || p.startsWith(r + sep) || p.startsWith(r + "/"));
+
+/** Removes leaked fixture runs once per DB. Returns the number of runs removed (0 on every later start). */
+export function cleanupLeakedFixtures(sqlite: Database): number {
+  let removed = 0;
+  sqlite.transaction(() => {
+    if (sqlite.query("select 1 x from audit where action = ?").get(DONE)) return;
+    const roots = tempRoots();
+    const tempSources = new Set(
+      (sqlite.query("select source_id, realpath from local_repos").all() as { source_id: string; realpath: string }[])
+        .filter((r) => underTemp(r.realpath, roots)).map((r) => r.source_id),
+    );
+    const all = sqlite.query("select source_id, run_id, origin_repo from runs").all() as { source_id: string; run_id: string; origin_repo: string | null }[];
+    const doomed = all.filter((r) => r.origin_repo === FIXTURE_REPO || tempSources.has(r.source_id));
+    const touched = new Set<string>();
+    for (const k of doomed) {
+      const ev = (sqlite.query("select count(*) n from events where source_id = ? and run_id = ?").get(k.source_id, k.run_id) as { n: number }).n;
+      audit(sqlite, "fixture.cleanup", "startup", { source_id: k.source_id, run_id: k.run_id, origin_repo: k.origin_repo, events: ev });
+      sqlite.query("delete from events where source_id = ? and run_id = ?").run(k.source_id, k.run_id);
+      sqlite.query("delete from runs where source_id = ? and run_id = ?").run(k.source_id, k.run_id);
+      touched.add(k.source_id);
+      removed++;
+    }
+    for (const id of touched) {
+      sqlite.query("delete from sources where id = ? and not exists (select 1 from runs where source_id = ?) and not exists (select 1 from events where source_id = ?)").run(id, id, id);
+    }
+    audit(sqlite, DONE, "startup", { removed });
+  }).immediate();
+  return removed;
+}

package/packages/control-plane/src/server/app.ts

@@ -1,6 +1,7 @@
 import { existsSync, statSync } from "node:fs";
 import { join, resolve, sep } from "node:path";
 import { Hono, type Context } from "hono";
+import { cleanupLeakedFixtures } from "../db/fixture-cleanup.ts";
 import { openDb } from "../db/migrate.ts";
 import { ingest } from "./ingest.ts";
 import { defaultAnswerDir, writeAnswer } from "./answer.ts";
@@ -22,6 +23,7 @@ const defaultUiDir = () => [join(import.meta.dir, "../../ui/dist"), join(import.
 export function createApp(opts: { dbPath: string; uiDir?: string; answerDir?: string; token?: string; loopbackOnly?: boolean; repoDir?: string; startBin?: string; spawnImpl?: typeof spawnStart }) {
   const uiDir = opts.uiDir ?? defaultUiDir();
   const { db, sqlite } = openDb(opts.dbPath);
+  cleanupLeakedFixtures(sqlite);
   recomputeLegacy(db);
   let ready = true;
   const answerDir = opts.answerDir ?? defaultAnswerDir();

package/packages/control-plane/src/server/integrity.ts

@@ -5,6 +5,8 @@
 // TAMPERED means positive evidence of forgery. A log the CP cannot check (redacted before ingest) is UNVERIFIED, never TAMPERED and never VERIFIED.
 import { createHash, createPublicKey, verify, type KeyObject } from "node:crypto";
 import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
 import type { EventEnvelope } from "../../../../loki-ts/src/engine10/types.ts";
 
 export interface RunIntegrity {
@@ -16,10 +18,10 @@ export interface RunIntegrity {
   sig_checked: boolean;
   reasons: string[];
 }
-export type KeyResolver = ((kid: string) => KeyObject | undefined) & { configured?: boolean; fingerprint?: string };
+export type KeyResolver = ((kid: string) => KeyObject | undefined) & { configured?: boolean; strict?: boolean; reason?: string; fingerprint?: string };
 export interface IntegrityOpts {
   pubkeyFor?: KeyResolver;
-  /** At least one key is configured: an unknown kid is then TAMPERED, as in the engine's checkLogSeal. Defaults to pubkeyFor.configured. */
+  /** Strict key set (LOKI_CP_RECEIPT_PUBKEYS declared): an unknown kid is TAMPERED, as in the engine's checkLogSeal. Defaults to pubkeyFor.strict, else pubkeyFor.configured. */
   keysConfigured?: boolean;
 }
 
@@ -36,14 +38,51 @@ const normVerdict = (v: string | null | undefined): string | null => (typeof v =
 /** Same derivation as loki-ts/src/engine10/stages/seal.ts kidOf (parity-tested). */
 export const kidOf = (pub: KeyObject): string => createHash("sha256").update(`{"crv":"Ed25519","kty":"OKP","x":"${pub.export({ format: "jwk" }).x}"}`).digest("base64url");
 
-/** Public keys from LOKI_CP_RECEIPT_PUBKEYS (colon-separated PEM files, like `loki verify` retired keys), by kid. Unreadable files are skipped. */
-export function pubkeysFromEnv(env: Record<string, string | undefined> = process.env): KeyResolver {
-  const keys = (env["LOKI_CP_RECEIPT_PUBKEYS"] ?? "").split(":").map((f) => f.trim()).filter(Boolean).flatMap((f) => {
-    try { return [createPublicKey(readFileSync(f))]; } catch { return []; }
-  });
+type Env = Record<string, string | undefined>;
+const isEd25519 = (k: KeyObject): boolean => k.asymmetricKeyType === "ed25519";
+
+/** The local signer's PUBLIC half, found in the order seal.ts loadSigningKey uses: inline LOKI_RECEIPT_SIGNING_KEY, then LOKI_RECEIPT_SIGNING_KEY_FILE,
+ *  then $HOME/.loki/keys/receipt-ed25519.pem. There is no separate public file on disk, so the public KeyObject is derived in memory (createPublicKey)
+ *  and only that derived object is kept. Unlike loadSigningKey this never chmods, creates or generates anything, and never retains, logs or returns
+ *  private material. An absent default-path key means no key and no reason; one that is named but unreadable or not Ed25519 is reported in `reason`. */
+export function localKeyInfo(env: Env = process.env): { key?: KeyObject; reason?: string } {
+  const inline = env["LOKI_RECEIPT_SIGNING_KEY"]?.trim();
+  const given = env["LOKI_RECEIPT_SIGNING_KEY_FILE"]?.trim();
+  try {
+    let pub: KeyObject;
+    if (inline) pub = createPublicKey(inline);
+    else {
+      const file = given || join(env["HOME"] || homedir(), ".loki", "keys", "receipt-ed25519.pem");
+      try { pub = createPublicKey(readFileSync(file)); } catch (e) {
+        if (!given && (e as NodeJS.ErrnoException).code === "ENOENT") return {};
+        throw e;
+      }
+    }
+    return isEd25519(pub) ? { key: pub } : { reason: "local signing key is not an Ed25519 key" };
+  } catch (e) {
+    const code = (e as NodeJS.ErrnoException).code;
+    return { reason: `local signing key ${inline ? "(LOKI_RECEIPT_SIGNING_KEY)" : given ? "file" : "default file"} could not be used: ${code ?? "malformed PEM"}` };
+  }
+}
+export const localPublicKey = (env: Env = process.env): KeyObject | undefined => localKeyInfo(env).key;
+
+const pemList = (raw: string | undefined): KeyObject[] => (raw ?? "").split(":").map((f) => f.trim()).filter(Boolean).flatMap((f) => {
+  try { const k = createPublicKey(readFileSync(f)); return isEd25519(k) ? [k] : []; } catch { return []; }
+});
+
+/** Verification keys by kid: the local signer's public half (automatic), LOKI_RECEIPT_RETIRED_PUBKEYS (trusted, as `loki verify` honours them) and
+ *  LOKI_CP_RECEIPT_PUBKEYS (colon-separated Ed25519 public PEM files for remote/team keys). Unreadable or non-Ed25519 files are skipped.
+ *  `strict` is true only when LOKI_CP_RECEIPT_PUBKEYS names at least one usable key: then an unknown kid is TAMPERED (the operator declared the key set).
+ *  With only implicit keys an unknown kid (CI, another machine, a rotation) is NOT CHECKED, as `loki verify` treats it. */
+export function pubkeysFromEnv(env: Env = process.env): KeyResolver {
+  const info = localKeyInfo(env);
+  const explicit = pemList(env["LOKI_CP_RECEIPT_PUBKEYS"]);
+  const keys = [...(info.key ? [info.key] : []), ...pemList(env["LOKI_RECEIPT_RETIRED_PUBKEYS"]), ...explicit];
   const fn: KeyResolver = (kid) => keys.find((k) => kidOf(k) === kid);
   fn.configured = keys.length > 0;
-  fn.fingerprint = createHash("sha256").update(keys.map(kidOf).sort().join(",")).digest("hex").slice(0, 16); // identifies the key set a row was judged under
+  fn.strict = explicit.length > 0;
+  if (info.reason) fn.reason = info.reason;
+  fn.fingerprint = createHash("sha256").update(keys.map(kidOf).sort().join(",") + (fn.strict ? "|strict" : "")).digest("hex").slice(0, 16); // key set and mode a row was judged under
   return fn;
 }
 
@@ -63,7 +102,7 @@ export function verifyRunIntegrity(evs: readonly EventEnvelope[], opts: Integrit
   const sealedAt = evs.map((e, i) => (e.type === "receipt.sealed" ? i : -1)).filter((i) => i >= 0);
   const finalised = doneAt >= 0 || sealedAt.length > 0;
   const lines = evs.map(line);
-  const keysConfigured = opts.keysConfigured ?? opts.pubkeyFor?.configured ?? false;
+  const keysConfigured = opts.keysConfigured ?? opts.pubkeyFor?.strict ?? opts.pubkeyFor?.configured ?? false;
   let sigChecked = false;
 
   if (finalised) { // a live run may still be missing a batch; once it claims an end, every seq must be present

package/packages/control-plane/src/server/routes/stats.ts

@@ -13,12 +13,16 @@ export interface Stats {
   runs_running: number;
   by_verdict: Record<string, number>;
   blocked_waiting: number;
-  /** Plain VERIFIED (attested, signature-checked) over finished runs that carry a verdict; null when there are none. */
+  /** Plain VERIFIED (attested, signature-checked) over the VERIFIABLE finished outcomes (verified, signature-unchecked verified, failed); ALREADY_SATISFIED and other outcomes are not in the denominator. Null when there are none. */
   verified_rate: number | null;
+  /** Finished runs by outcome class: verified (checked), failed (FAILED, PARTIAL, TAMPERED), already_satisfied (either signature state), other (SPEC_CONFLICT, UNVERIFIED, unattested, anything else). Unchecked verified runs are in verified_unchecked. */
+  breakdown: { verified: number; failed: number; already_satisfied: number; other: number };
   /** Finished successes whose signature could not be checked (VERIFIED (signature not checked)); a rate of 0 with these is "not measured", not "failing". */
   verified_unchecked: number;
-  /** At least one receipt verification key is configured (LOKI_CP_RECEIPT_PUBKEYS). */
+  /** At least one receipt verification key is configured (the local signer key or LOKI_CP_RECEIPT_PUBKEYS). */
   keys_configured: boolean;
+  /** Present when a named local signing key could not be used (unreadable, malformed, not Ed25519); keys_configured then reflects the remaining keys. */
+  keys_reason?: string;
   cost: {
     /** Sum over runs whose cost is fully measured; null when no run in the window is. */
     measured_usd: number | null;
@@ -34,7 +38,7 @@ export interface Stats {
 export function computeStats(db: Db, since: string | null): Stats {
   const all = db.select().from(runs).all().filter((r) => !since || (r.startedAt !== null && r.startedAt >= since));
   const by: Record<string, number> = {};
-  let finished = 0, running = 0, blocked = 0, withVerdict = 0, verified = 0, unchecked = 0;
+  let finished = 0, running = 0, blocked = 0, verified = 0, unchecked = 0, failed = 0, satisfied = 0, other = 0;
   let mUsd = 0, mRuns = 0, pUsd = 0, pRuns = 0;
   for (const r of all) {
     if (r.endedAt) finished++; else running++;
@@ -42,7 +46,13 @@ export function computeStats(db: Db, since: string | null): Stats {
     const verdict = r.verdict ? effectiveVerdict({ verdict: r.verdict, tampered: r.tampered === 1, attested: r.attested === 1, sig_checked: r.sigChecked === 1 }) : null;
     if (verdict) {
       by[verdict] = (by[verdict] ?? 0) + 1;
-      if (r.endedAt) { withVerdict++; if (verdict === "VERIFIED") verified++; else if (verdict === "VERIFIED (signature not checked)") unchecked++; }
+      if (r.endedAt) {
+        if (verdict === "VERIFIED") verified++;
+        else if (verdict === "VERIFIED (signature not checked)") unchecked++;
+        else if (verdict === "ALREADY_SATISFIED" || verdict === "ALREADY_SATISFIED (signature not checked)") satisfied++;
+        else if (verdict === "FAILED" || verdict === "PARTIAL" || verdict === "TAMPERED") failed++;
+        else other++;
+      }
     }
     if (r.verdict === "SPEC_CONFLICT") blocked++;
     if (r.costUsd !== null) { mUsd += r.costUsd; mRuns++; }
@@ -58,7 +68,8 @@ export function computeStats(db: Db, since: string | null): Stats {
   const r6 = (n: number): number => Math.round(n * 1e6) / 1e6;
   return {
     since, runs_total: all.length, runs_finished: finished, runs_running: running, by_verdict: by, blocked_waiting: blocked,
-    verified_rate: withVerdict ? verified / withVerdict : null, verified_unchecked: unchecked, keys_configured: pubkeysFromEnv().configured === true,
+    verified_rate: verified + unchecked + failed ? verified / (verified + unchecked + failed) : null,
+    breakdown: { verified, failed, already_satisfied: satisfied, other }, verified_unchecked: unchecked, keys_configured: pubkeysFromEnv().configured === true, ...(pubkeysFromEnv().reason ? { keys_reason: pubkeysFromEnv().reason } : {}),
     cost: {
       measured_usd: mRuns ? r6(mUsd) : null, measured_runs: mRuns, partial_usd: pRuns ? r6(pUsd) : null, partial_runs: pRuns,
       label: pRuns ? "partial" : mRuns ? "measured" : "not measured",

package/packages/control-plane/src/server/runs.ts

@@ -55,9 +55,16 @@ const parseRun = (r: typeof runs.$inferSelect) => ({
   effective_verdict: effectiveVerdict({ verdict: r.verdict, tampered: r.tampered === 1, attested: r.attested === 1, sig_checked: r.sigChecked === 1 }),
   status: r.endedAt ? "completed" : "running", elapsed_s: elapsedS(r),
 });
+/** The task title the intake stage recorded (its `title`, else the first line of `task`), for sidebar rows of runs that have no issue ref. Null when intake has not completed. */
+export function taskTitle(db: Db, sourceId: string, runId: string): string | null {
+  const d = db.select({ data: events.data }).from(events).where(and(eq(events.sourceId, sourceId), eq(events.runId, runId), eq(events.type, "stage.completed"), eq(events.stage, "intake"))).orderBy(asc(events.seq)).limit(1).get()?.data as Record<string, unknown> | undefined;
+  const raw = str(d?.["title"]) ?? str(d?.["task"]);
+  const t = raw?.split("\n")[0]?.trim();
+  return t ? (t.length > 140 ? `${t.slice(0, 139)}...` : t) : null;
+}
 // A run with no run.completed yet is running: add its live fields (stage, files) from the stored events.
 const withLive = (db: Db, r: typeof runs.$inferSelect) => {
-  const p = parseRun(r);
+  const p = { ...parseRun(r), title: taskTitle(db, r.sourceId, r.runId) };
   return r.endedAt ? { ...p, current_stage: null, files_touched: [] as string[] } : { ...p, ...liveInfo(loadEvents(db, r.sourceId, r.runId)) };
 };
 
@@ -139,13 +146,18 @@ export function runDetail(db: Db, sourceId: string, runId: string) {
   const r = db.select().from(runs).where(and(eq(runs.sourceId, sourceId), eq(runs.runId, runId))).get();
   if (!r) return null;
   const evs = loadEvents(db, sourceId, runId);
-  const stages: { stage: string; started_at: string | null; ended_at: string | null; status: string }[] = [];
+  const stages: { stage: string; started_at: string | null; ended_at: string | null; status: string; reason: string | null }[] = [];
   for (const e of evs) {
     if (e.stage === null || !e.type.startsWith("stage.")) continue;
     let s = stages.find((x) => x.stage === e.stage);
-    if (!s) stages.push((s = { stage: e.stage, started_at: null, ended_at: null, status: "started" }));
+    if (!s) stages.push((s = { stage: e.stage, started_at: null, ended_at: null, status: "started", reason: null }));
     if (e.type === "stage.started") s.started_at = e.ts;
-    else { s.ended_at = e.ts; s.status = e.type.slice("stage.".length); }
+    else {
+      s.ended_at = e.ts; s.status = e.type.slice("stage.".length);
+      // The engine records why a stage was skipped or failed (stage.skipped data.reason); nothing is invented when it did not.
+      const why = (e.data as Record<string, unknown> | null)?.reason;
+      s.reason = typeof why === "string" && why ? why : null;
+    }
   }
   const f = fold(evs);
   const done = f.run.completed?.data;