pi-daddy 0.28.0 → 0.32.0

package/src/check-runner.ts

@@ -1,387 +0,0 @@
-import { createHash, randomUUID } from "node:crypto";
-import { beginExecutionRetention, retentionConfigurationDigest, type RetentionStatus } from "./execution-retention.ts";
-import { chmod, mkdtemp, readFile, realpath, rm, stat, writeFile } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { basename, isAbsolute, join } from "node:path";
-import { normaliseCorrelation, type CorrelationMetadata } from "./correlation.ts";
-import { runWithFinalizers } from "./finalization.ts";
-import {
-  appendLedgerEvent,
-  buildCheckReceiptLedgerEvent,
-  buildWorkspaceLeaseEvent,
-} from "./ledger.ts";
-import { computeGitCandidateIdentity } from "./git-identity.ts";
-import { runChild } from "./run-child.ts";
-import { GovernanceRefusal, refusal } from "./refusals.ts";
-import {
-  acquireWorkspaceLease,
-  defaultWorkspaceLeaseDir,
-  type ValidatedWorkspace,
-  type WorkspaceAccess,
-  leaseAcquisitionOutcome,
-  leaseReleaseLedgerOutcome,
-} from "./workspace.ts";
-import { newExecutionId } from "./execution-id.ts";
-import { isLedgerDisplayIdentifier } from "./ledger-identifiers.ts";
-
-export interface CheckDefinition {
-  /** Absolute operator-owned executable. PATH lookup is deliberately not part of the contract. */
-  executable: string;
-  /** Exact argv elements. Never a shell command string. */
-  argv: string[];
-  /** Fixed non-sensitive environment values. */
-  env?: Record<string, string>;
-  /** Explicit inherited names. Sensitive names are still removed. */
-  inherit_env?: string[];
-  timeout_ms?: number;
-  max_output_bytes?: number;
-  /** Checks are assumed capable of writing unless the operator declares read. */
-  workspace_access?: WorkspaceAccess;
-}
-
-export interface CheckRegistry {
-  version: 1;
-  checks: Record<string, CheckDefinition>;
-}
-
-export interface CheckReceipt {
-  schema_version: "1.0";
-  receipt_id: string;
-  check_id: string;
-  executable: string;
-  executable_sha256: string;
-  argv: string[];
-  argv_sha256: string;
-  cwd: string;
-  cwd_sha256: string;
-  started_at: string;
-  ended_at: string;
-  exit_code: number | null;
-  signal: NodeJS.Signals | null;
-  timed_out: boolean;
-  aborted: boolean;
-  truncated: boolean;
-  output_sha256: string;
-  workspace_id: string;
-  workspace_access: WorkspaceAccess;
-  head_sha: string;
-  tree_sha: string;
-  correlation?: CorrelationMetadata;
-}
-
-const SAFE_ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
-const SENSITIVE_ENV_NAME = /(?:^|_)(?:TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|AUTH|COOKIE|PRIVATE_KEY|API_KEY)(?:_|$)|^PI_GRANTS_|^(?:AWS|GITHUB|GITLAB|AZURE|GOOGLE)_/i;
-
-export function buildCheckEnvironment(
-  definition: CheckDefinition,
-  inherited: NodeJS.ProcessEnv = process.env,
-): NodeJS.ProcessEnv {
-  const env: NodeJS.ProcessEnv = {};
-  for (const name of definition.inherit_env ?? []) {
-    if (!SAFE_ENV_NAME.test(name) || SENSITIVE_ENV_NAME.test(name)) continue;
-    if (inherited[name] !== undefined) env[name] = inherited[name];
-  }
-  for (const [name, value] of Object.entries(definition.env ?? {})) {
-    if (!SAFE_ENV_NAME.test(name) || SENSITIVE_ENV_NAME.test(name)) continue;
-    env[name] = value;
-  }
-  return env;
-}
-
-function validateDefinition(checkId: string, value: CheckDefinition | undefined): CheckDefinition {
-  // `check:<id>:<uuid>` is also the v3 childId, whose closed display-identifier bound is 512 characters.
-  if (!isLedgerDisplayIdentifier(checkId) || checkId.length > 460) {
-    throw new GovernanceRefusal(refusal(
-      "CHECK_CONFIGURATION_INVALID", `check ${JSON.stringify(checkId)} must be an ASCII identifier`, { check_id: checkId },
-    ));
-  }
-  if (!value) {
-    throw new GovernanceRefusal(refusal(
-      "CHECK_NOT_CONFIGURED", `check ${JSON.stringify(checkId)} is not present in operator-owned configuration`, { check_id: checkId },
-    ));
-  }
-  if (!isAbsolute(value.executable) || !Array.isArray(value.argv) || value.argv.some((item) => typeof item !== "string")) {
-    throw new GovernanceRefusal(refusal(
-      "CHECK_CONFIGURATION_INVALID", `check ${JSON.stringify(checkId)} requires an absolute executable and argv string array`,
-      { check_id: checkId },
-    ));
-  }
-  for (const bound of [value.timeout_ms, value.max_output_bytes]) {
-    if (bound !== undefined && (!Number.isInteger(bound) || bound <= 0)) {
-      throw new GovernanceRefusal(refusal(
-        "CHECK_CONFIGURATION_INVALID", `check ${JSON.stringify(checkId)} has a non-positive runtime bound`, { check_id: checkId },
-      ));
-    }
-  }
-  return value;
-}
-
-function receiptId(receipt: Omit<CheckReceipt, "receipt_id">): string {
-  return createHash("sha256").update(JSON.stringify(receipt), "utf8").digest("hex");
-}
-
-export async function runNamedCheck(input: {
-  checkId: string;
-  registry: CheckRegistry;
-  workspace: ValidatedWorkspace;
-  correlation?: CorrelationMetadata;
-  inheritedEnv?: NodeJS.ProcessEnv;
-  signal?: AbortSignal;
-  leaseDir?: string;
-  ledgerPath?: string;
-  /** Explicit host archive boundary; defaults to PI_GRANTS_EXECUTION_ARCHIVE, never correlation. */
-  retentionDirectory?: string;
-  toolCallId?: string;
-}): Promise<{
-  output: string;
-  exitCode: number | null;
-  signal: NodeJS.Signals | null;
-  receipt: CheckReceipt;
-  retention: RetentionStatus;
-}> {
-  if (input.registry?.version !== 1 || !input.registry.checks || typeof input.registry.checks !== "object") {
-    throw new GovernanceRefusal(refusal("CHECK_CONFIGURATION_INVALID", "check registry must contain {version:1, checks:{...}}"));
-  }
-  const definition = validateDefinition(input.checkId, input.registry.checks[input.checkId]);
-  let executable: string;
-  try {
-    executable = await realpath(definition.executable);
-    if (!(await stat(executable)).isFile()) throw new Error("not a file");
-  } catch (error) {
-    throw new GovernanceRefusal(refusal(
-      "CHECK_CONFIGURATION_INVALID", `check ${JSON.stringify(input.checkId)} executable is not a real file (${String(error)})`,
-      { check_id: input.checkId },
-    ));
-  }
-
-  const argvSha256 = createHash("sha256").update(JSON.stringify(definition.argv), "utf8").digest("hex");
-  const cwdSha256 = createHash("sha256").update(input.workspace.root, "utf8").digest("hex");
-  const access = definition.workspace_access ?? "write";
-  // Evidence checks coordinate exclusively so their pre/post candidate identities cannot overlap another
-  // governed writer. `access` still records what the configured executable is intended to do.
-  const leaseAccess: WorkspaceAccess = "write";
-  const ownerId = `check:${input.checkId}:${randomUUID()}`;
-  const executionId = newExecutionId();
-  const parentExecutionId = null;
-  const correlation = normaliseCorrelation(input.correlation);
-  const retention = beginExecutionRetention({ executionId, parentExecutionId, childId: ownerId,
-    toolCallId: input.toolCallId ?? null, executor: "check", taskDigest: null, definitionDigest: null,
-    configurationDigest: retentionConfigurationDigest({ executable, argv: definition.argv, access,
-      timeoutMs: definition.timeout_ms ?? null, maxOutputBytes: definition.max_output_bytes ?? null }),
-    workspaceId: input.workspace.workspaceId }, input.retentionDirectory);
-  let lease: Awaited<ReturnType<typeof acquireWorkspaceLease>> | undefined;
-  let stagedDir: string | undefined;
-  /** Failures of best-effort RECORDS, reported alongside whatever actually happened — never instead of it. */
-  const notes: string[] = [];
-  let releaseReason = "failed";
-  let observedOutcome = { code: null as number | null, signal: null as string | null, timedOut: false, aborted: false, truncated: false };
-  return runWithFinalizers(async () => {
-    try {
-      try {
-        lease = await acquireWorkspaceLease({
-          workspace: input.workspace, access: leaseAccess, leaseDir: input.leaseDir ?? defaultWorkspaceLeaseDir(),
-          ownerId, signal: input.signal,
-        });
-      } catch (error) {
-        if (input.ledgerPath) await appendLedgerEvent(
-          { path: input.ledgerPath, strict: true },
-          buildWorkspaceLeaseEvent({
-            executionId, parentExecutionId,
-            childId: ownerId, workspaceId: input.workspace.workspaceId, root: input.workspace.root, access: leaseAccess,
-            outcome: "refused",
-            correlation, now: new Date(),
-            ...(error instanceof GovernanceRefusal
-              ? { refusal: { code: error.code, message: error.message, ...(error.details ? { details: error.details } : {}) } }
-              : {}),
-          }),
-        );
-        throw error;
-      }
-    if (input.ledgerPath) {
-      try {
-        await appendLedgerEvent(
-          { path: input.ledgerPath, strict: true },
-          buildWorkspaceLeaseEvent({
-            executionId, parentExecutionId,
-            childId: ownerId, workspaceId: input.workspace.workspaceId, root: input.workspace.root, access: leaseAccess,
-            outcome: leaseAcquisitionOutcome(leaseAccess, lease.recovered), recovered: lease.recovered,
-            correlation, now: new Date(),
-          }),
-        );
-      } catch (error) {
-        await lease.release("ledger-failed");
-        lease = undefined;
-        throw error;
-      }
-    }
-
-    const before = await computeGitCandidateIdentity(input.workspace);
-    for (const [name, supplied, actual] of [
-      ["head_sha", correlation?.head_sha, before.headSha], ["tree_sha", correlation?.tree_sha, before.treeSha],
-    ] as const) {
-      if (supplied && supplied !== actual) throw new GovernanceRefusal(refusal(
-        "CHECK_IDENTITY_MISMATCH", `check ${JSON.stringify(input.checkId)} ${name} does not match the validated workspace`,
-        { check_id: input.checkId, supplied, actual },
-      ));
-    }
-    const executableBytes = await readFile(executable);
-    const executableSha256 = createHash("sha256").update(executableBytes).digest("hex");
-    stagedDir = await mkdtemp(join(tmpdir(), "pi-daddy-check-exec-"));
-    const stagedExecutable = join(stagedDir, basename(executable));
-    await writeFile(stagedExecutable, executableBytes, { mode: 0o700 });
-    await chmod(stagedExecutable, 0o700);
-    const leaseAbort = new AbortController();
-    let leaseLost = false;
-    lease.lost.then(() => { leaseLost = true; leaseAbort.abort(); });
-    const checkSignal = input.signal ? AbortSignal.any([input.signal, leaseAbort.signal]) : leaseAbort.signal;
-    const started = new Date();
-    const result = await runChild({
-      command: "setpriv", args: ["--pdeathsig", "KILL", "--", stagedExecutable, ...definition.argv],
-      env: buildCheckEnvironment(definition, input.inheritedEnv), cwd: input.workspace.root,
-      signal: checkSignal, timeoutMs: definition.timeout_ms, maxOutputBytes: definition.max_output_bytes,
-      onSpawn: (pid) => { lease!.attachProcess(pid); retention.native({ pid }); },
-      onObservation: (stream, bytes) => retention.capture(stream, bytes),
-    });
-    observedOutcome = { code: result.code, signal: result.signal ?? null, timedOut: result.timedOut, aborted: result.aborted, truncated: result.truncated };
-    retention.capture("result", Buffer.from(result.text), true);
-    const ended = new Date();
-    releaseReason = input.signal?.aborted ? "cancelled" : result.timedOut ? "timeout" : result.aborted ? "failed" : "completed";
-    // Every throw below re-stamps this. Without that, a check refused for CHECK_IDENTITY_MISMATCH still
-    // wrote `released / completed` from the `finally` — the LAST lease event for that owner — so the trail
-    // still read like a clean run and `verifyLedger` still counted a clean release. The R-114 fix added a
-    // refusal line beside the misleading one instead of correcting it.
-    if (result.spawnError) throw new GovernanceRefusal(refusal(
-      "EXECUTOR_UNAVAILABLE", `check ${JSON.stringify(input.checkId)} could not start its constrained executor`,
-      { check_id: input.checkId },
-    ));
-    if (leaseLost) throw new GovernanceRefusal(refusal(
-      "WORKSPACE_LEASE_STALE", `check ${JSON.stringify(input.checkId)} lost its workspace lease while running`,
-      { check_id: input.checkId },
-    ));
-    const after = await computeGitCandidateIdentity(input.workspace);
-    if (leaseLost) throw new GovernanceRefusal(refusal(
-      "WORKSPACE_LEASE_STALE", `check ${JSON.stringify(input.checkId)} lost its workspace lease before receipt`,
-      { check_id: input.checkId },
-    ));
-    if (before.headSha !== after.headSha || before.treeSha !== after.treeSha) {
-      throw new GovernanceRefusal(refusal(
-        "CHECK_IDENTITY_MISMATCH", `check ${JSON.stringify(input.checkId)} workspace changed while it ran`,
-        { check_id: input.checkId },
-      ));
-    }
-    // The candidate is now measured and the process is dead. End the lease before writing the receipt so
-    // lease loss cannot race a blocked ledger append and leave behind evidence from an unprotected run.
-    // Record what release actually DID. This asserted `released` unconditionally and threw the outcome
-    // away, so the evidence path reproduced the very defect the outcome union was added to expose: a lost
-    // or unrecorded handover ledgered as a clean one, with `lease = undefined` stopping the `finally` from
-    // ever noticing (R-100/R-103, found while reviewing the fix for R-99).
-    const releaseOutcome = await lease.release(releaseReason);
-    lease = undefined;
-    if (leaseLost) throw new GovernanceRefusal(refusal(
-      "WORKSPACE_LEASE_STALE", `check ${JSON.stringify(input.checkId)} lost its workspace lease before receipt`,
-      { check_id: input.checkId },
-    ));
-    if (input.ledgerPath) await appendLedgerEvent(
-      { path: input.ledgerPath, strict: true },
-      buildWorkspaceLeaseEvent({
-        executionId, parentExecutionId,
-        childId: ownerId, workspaceId: input.workspace.workspaceId, root: input.workspace.root, access: leaseAccess,
-        outcome: leaseReleaseLedgerOutcome(releaseOutcome, releaseReason), releaseReason, correlation, now: new Date(),
-      }),
-    );
-    const body: Omit<CheckReceipt, "receipt_id"> = {
-      schema_version: "1.0", check_id: input.checkId, executable, executable_sha256: executableSha256,
-      argv: [...definition.argv], argv_sha256: argvSha256, cwd: input.workspace.root, cwd_sha256: cwdSha256,
-      started_at: started.toISOString(), ended_at: ended.toISOString(), exit_code: result.code,
-      signal: result.signal ?? null, timed_out: result.timedOut, aborted: result.aborted, truncated: result.truncated,
-      output_sha256: createHash("sha256").update(result.text, "utf8").digest("hex"),
-      workspace_id: input.workspace.workspaceId, workspace_access: access,
-      head_sha: before.headSha, tree_sha: before.treeSha, ...(correlation ? { correlation } : {}),
-    };
-    const receipt: CheckReceipt = { receipt_id: receiptId(body), ...body };
-    retention.capture("checkReceipt", Buffer.from(JSON.stringify(receipt) + "\n"), true);
-    if (input.ledgerPath) {
-      await appendLedgerEvent(
-        { path: input.ledgerPath, strict: true },
-        buildCheckReceiptLedgerEvent({
-          executionId, parentExecutionId,
-          childId: ownerId, receiptId: receipt.receipt_id, workspaceId: input.workspace.workspaceId,
-          checkId: input.checkId, treeSha: receipt.tree_sha, correlation, now: ended,
-        }),
-      );
-    }
-    retention.finish({ code: result.code, signal: result.signal ?? null, timedOut: result.timedOut,
-      aborted: result.aborted, truncated: result.truncated, failed: result.code !== 0 });
-    return { output: result.text, exitCode: result.code, signal: result.signal ?? null, receipt, retention: retention.status() };
-  } catch (error) {
-    retention.finish({ ...observedOutcome, aborted: observedOutcome.aborted || Boolean(input.signal?.aborted), failed: true });
-    // The run did not complete, so the release must not be recorded as if it had. Without this the
-    // `finally` wrote `released / completed` as the LAST lease event for a refused check, so the trail
-    // still read like a clean run and `verifyLedger` still counted a clean release — the R-114 fix put a
-    // refusal line beside the misleading one instead of correcting it.
-    if (releaseReason === "completed") releaseReason = "refused";
-    // The single most important negative result this feature can produce — CHECK_IDENTITY_MISMATCH, "the
-    // workspace changed while the check ran" — used to leave NO ledger evidence at all, while the
-    // `finally` recorded `released, reason: completed`, so the trail read like a clean run (R-114).
-    if (input.ledgerPath) {
-      await appendLedgerEvent(
-        {
-          path: input.ledgerPath,
-          // Best effort, and loud: this records a failure, so it must not replace the failure. A strict
-          // append that threw here would substitute "ledger write failed" for the evidence-integrity
-          // refusal that actually happened (R-115).
-          strict: false,
-          // NOT empty. `onFailure` exists because a non-strict append is a choice not to fail closed and
-          // never a choice to be silent — the comment above says "loud", and an empty callback is the
-          // definition of swallowing. This guards the evidence record itself, so losing it silently is
-          // how a mutated workspace came to leave a trail that read like a clean run.
-          onFailure: (cause) => { notes.push(`check refusal record failed: ${String(cause)}`); },
-        },
-        buildWorkspaceLeaseEvent({
-          executionId, parentExecutionId,
-          childId: ownerId, workspaceId: input.workspace.workspaceId, root: input.workspace.root, access: leaseAccess,
-          outcome: "refused",
-          refusal: error instanceof GovernanceRefusal
-            ? { code: error.code, message: error.message, ...(error.details ? { details: error.details } : {}) }
-            : refusal("CHECK_IDENTITY_UNAVAILABLE", `check ${JSON.stringify(input.checkId)} failed (${String(error)})`),
-          correlation, now: new Date(),
-        }),
-      );
-    }
-    throw error;
-    }
-  }, [
-    {
-      label: "staged check cleanup failed",
-      run: async () => {
-        if (stagedDir) await rm(stagedDir, { recursive: true, force: true });
-      },
-    },
-    {
-      label: "workspace lease finalizer failed",
-      run: async () => {
-        if (!lease) return;
-        // `release()` cannot throw (R-99), and the record of it is best-effort for the same reason as
-        // above: a finalizer must not destroy whatever the caller was already returning or raising.
-        const outcome = await lease.release(releaseReason);
-        if (input.ledgerPath) await appendLedgerEvent(
-          {
-            path: input.ledgerPath,
-            strict: false,
-            onFailure: (cause) => { notes.push(`check lease release record failed: ${String(cause)}`); },
-          },
-          buildWorkspaceLeaseEvent({
-            executionId, parentExecutionId,
-            childId: ownerId, workspaceId: input.workspace.workspaceId, root: input.workspace.root, access: leaseAccess,
-            outcome: outcome === "lost"
-              ? "lost"
-              : outcome === "released-unrecorded"
-                ? "released-unrecorded"
-                : releaseReason === "timeout" ? "timeout" : "released",
-            releaseReason, correlation, now: new Date(),
-          }),
-        );
-      },
-    },
-  ]);
-}

package/src/control-journal.ts

@@ -1,26 +0,0 @@
-import { constants } from "node:fs";
-import { mkdir, open, lstat } from "node:fs/promises";
-import { dirname, join, resolve } from "node:path";
-import { withFileLock } from "./file-lock.ts";
-import { runWithFinalizers } from "./finalization.ts";
-import { ownedDirectory, readExperimentFile } from "./experiment-store.ts";
-import { cloneExperiment, closed, experimentHash } from "./experiment-contract.ts";
-import { freezeWork, parseWorkJson } from "./work-ledger-json.ts";
-export interface ControlBinding<T> {version:"control-journal-v1";directory:string;device:string;inode:string;journalDevice:string;journalInode:string;initial:T}
-export async function createControlJournal<T>(directory:string,input:T):Promise<ControlBinding<T>>{
-  const initial=cloneExperiment(input);if(typeof directory!=="string"||directory!==resolve(directory)||directory.length>1024||directory.split("/").includes(".pi"))throw new Error("explicit control directory required");
-  await ownedDirectory(dirname(directory));await mkdir(directory,{mode:0o700});const root=await ownedDirectory(directory),f=await open(join(directory,"control.jsonl"),"wx",0o600);
-  const b=await runWithFinalizers(async()=>{const s=await f.stat({bigint:true});const b={version:"control-journal-v1" as const,directory,device:String(root.dev),inode:String(root.ino),journalDevice:String(s.dev),journalInode:String(s.ino),initial};await f.writeFile(JSON.stringify(b)+"\n");await f.sync();return b;},[{label:"control creation close failed",run:()=>f.close()}]);
-  const d=await open(directory,constants.O_RDONLY|constants.O_DIRECTORY);await runWithFinalizers(()=>d.sync(),[{label:"control directory close failed",run:()=>d.close()}]);return freezeWork(b) as unknown as ControlBinding<T>;
-}
-export function controlJournal<T>(input:ControlBinding<T>){
-  const b=freezeWork(cloneExperiment(input)) as unknown as ControlBinding<T>;closed(b,["version","directory","device","inode","journalDevice","journalInode","initial"]);
-  if(b.version!=="control-journal-v1"||b.directory!==resolve(b.directory)||b.directory.split("/").includes(".pi")||[b.device,b.inode,b.journalDevice,b.journalInode].some(v=>!/^\d+$/.test(v)))throw new Error("invalid control binding");
-  const path=join(b.directory,"control.jsonl");
-  const check=async()=>{const root=await ownedDirectory(b.directory),file=await lstat(path,{bigint:true});if(String(root.dev)!==b.device||String(root.ino)!==b.inode||String(file.dev)!==b.journalDevice||String(file.ino)!==b.journalInode)throw new Error("control identity changed");};
-  const read=async()=>{await check();const bytes=await readExperimentFile(path,512*1024);await check();const text=new TextDecoder("utf8",{fatal:true}).decode(bytes);if(!text.endsWith("\n"))throw new Error("torn control journal");const lines=text.slice(0,-1).split("\n");if(lines.length>257||experimentHash(parseWorkJson(lines[0]))!==experimentHash(b))throw new Error("control header/limit mismatch");let previous=experimentHash(b);const events:Record<string,unknown>[]=[];
-    for(const line of lines.slice(1)){const r=parseWorkJson(line) as Record<string,unknown>;closed(r,["sequence","previous","event"]);if(r.sequence!==events.length||r.previous!==previous||!r.event||typeof r.event!=="object"||Array.isArray(r.event))throw new Error("invalid control sequence");previous=experimentHash(r);events.push(r.event as Record<string,unknown>);}return{events,previous,size:bytes.length};};
-  return {binding:b,read,async transaction<R>(fn:(events:Record<string,unknown>[],append:(e:unknown)=>Promise<void>)=>Promise<R>){await check();return withFileLock(path,"factory policy",async()=>{const state=await read();return fn(state.events,async event=>{if(state.events.length>=256)throw new Error("control event budget exhausted");const record={sequence:state.events.length,previous:state.previous,event:cloneExperiment(event)},data=Buffer.from(JSON.stringify(record)+"\n");if(state.size+data.length>512*1024||data.length>65536)throw new Error("control byte budget exhausted");await check();const f=await open(path,constants.O_WRONLY|constants.O_APPEND|constants.O_NOFOLLOW|constants.O_NONBLOCK);
-      await runWithFinalizers(async()=>{const s=await f.stat({bigint:true});if(!s.isFile()||s.nlink!==1n||String(s.dev)!==b.journalDevice||String(s.ino)!==b.journalInode||s.size!==BigInt(state.size)||(s.mode&0o077n)!==0n)throw new Error("control journal changed under lock");await f.writeFile(data);await f.sync();},[{label:"control append close failed",run:()=>f.close()}]);await check();state.size+=data.length;state.previous=experimentHash(record);state.events.push(cloneExperiment(event) as Record<string,unknown>);
-    });},{staleRecovery:"disabled"});}};
-}