smol-symphony 0.2.0 → 0.3.0

package/dist/src/shell/adapter/gondolin-image-converter.js

@@ -0,0 +1,233 @@
+// FCIS rewrite — programmatic OCI→gondolin image converter (kind: adapter, issue 206).
+//
+// The programmatic equivalent of `images/agents/build-image-oci.sh` Stage 2: take a
+// normal OCI image reference (a docker/podman repo string), convert it into a
+// content-addressed Gondolin asset bundle (rootfs.ext4 / vmlinuz-virt /
+// initramfs.cpio.lz4 + manifest), and cache it in the local Gondolin image store so
+// a second call for the same image is a no-op. Symphony's reconcile loop calls this
+// on demand (`OrchestratorLoop.ensureImage`) so the operator no longer has to run
+// `npm run build:image` by hand before dispatch can start. The shell script stays as
+// a manual fallback.
+//
+// Caching: the cache key is the resolved OCI digest PLUS the guest-contract overlay
+// version, tagged under a `symphony-oci:<digest>-<overlay>` ref in the Gondolin
+// store. A digest-pinned source (`repo@sha256:…`) caches exactly; a moving tag
+// (`repo:latest`) reconverts when the underlying image's digest changes, because the
+// digest — not the tag string — is the key.
+//
+// Scope (MVP): the golden-image path — a published OCI ref that already satisfies the
+// guest contract (Node ≥ 21 + the ACP CLIs on PATH; the in-VM launcher is staged at
+// dispatch, not baked). The `postBuild.copy`/`.commands` overlay that would project
+// the guest contract onto an ARBITRARY base is a clearly-marked extension point below.
+//
+// Shell rule: this lives in src/shell/adapter (an IO home) so its docker/podman +
+// filesystem + Gondolin-SDK IO is sanctioned. All Gondolin/runtime operations are
+// injectable (`ConverterDeps`) so the cache-hit path is unit-testable without docker.
+import { mkdtempSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import os from 'node:os';
+import path from 'node:path';
+import { buildAssets, getDefaultBuildConfig, importImageFromDirectory, resolveImageSelector, setImageRef, } from '@earendil-works/gondolin';
+/**
+ * Guest-contract overlay version — part of the cache key. The MVP overlays nothing
+ * (the golden base already satisfies the contract), so this is a constant; bump it
+ * when the conversion-time overlay (postBuild) changes so stale assets re-convert.
+ */
+export const GUEST_CONTRACT_OVERLAY_VERSION = 'v1';
+/** The cache ref a converted asset is tagged under (digest + overlay version). */
+export function cacheRefFor(digest, overlayVersion = GUEST_CONTRACT_OVERLAY_VERSION) {
+    const tag = `${digest.replace(/[^a-z0-9]/gi, '-')}-${overlayVersion}`;
+    return `symphony-oci:${tag}`;
+}
+/**
+ * The runtime image selector for a converted asset (issue 206): the content-derived
+ * build id when known (what `npm run build:image` prints + the operator would pin),
+ * else the resolved asset directory (a `path` selector, always present). The
+ * orchestrator boots the cached asset with this when `gondolin.image` is unset.
+ */
+function runtimeSelector(buildId, assetDir) {
+    return buildId.length > 0 ? buildId : assetDir;
+}
+/**
+ * Convert + cache `ociRef` into a Gondolin asset, returning the resolved asset (or a
+ * cache hit). Resolves the OCI digest (pulling per `pullPolicy`), checks the local
+ * store for an already-converted asset at the digest+overlay cache ref, and only
+ * runs `buildAssets` on a miss.
+ */
+export async function ensureConvertedImage(ociRef, opts = {}) {
+    const pullPolicy = opts.pullPolicy ?? 'if-not-present';
+    const runtime = opts.runtime ?? null;
+    const deps = opts.deps ?? defaultConverterDeps();
+    const log = opts.log;
+    // Resolve the immutable OCI digest honoring the FULL pull policy → cache ref. The
+    // policy is preserved (not reduced to a pull/skip boolean) so `always` re-pulls
+    // even when the ref is present locally and the POST-pull digest keys the cache;
+    // otherwise a moving tag (`repo:latest`) under `always` would cache against a stale
+    // local digest.
+    const digest = deps.resolveOciDigest(ociRef, runtime, pullPolicy);
+    const cacheRef = cacheRefFor(digest);
+    // Cache lookup — an already-converted asset tagged at this digest+overlay?
+    const hit = tryResolve(deps, cacheRef);
+    if (hit) {
+        const buildId = hit.buildId ?? '';
+        log?.emit('info', 'gondolin-image-converter: cache hit', { oci_image: ociRef, digest, cacheRef });
+        return {
+            buildId,
+            assetDir: hit.assetDir,
+            selector: runtimeSelector(buildId, hit.assetDir),
+            cached: true,
+        };
+    }
+    return convertAndTag(deps, { ociRef, runtime, digest, cacheRef, log });
+}
+/**
+ * Cache miss: convert the OCI base into a fresh asset bundle, import it, and tag it
+ * under the cache ref so the next call is a no-op. EXTENSION: to support an arbitrary
+ * base that does NOT bake the guest contract, set `postBuild.copy` / `.commands` on
+ * `config` here to project the guest contract at conversion time.
+ */
+async function convertAndTag(deps, ctx) {
+    const { ociRef, runtime, digest, cacheRef, log } = ctx;
+    log?.emit('info', 'gondolin-image-converter: building (one-time)', { oci_image: ociRef, digest, cacheRef });
+    // We already enforced the operator's pull policy when resolving `digest` (above),
+    // so the LOCAL image at `ociRef` now IS that digest. Hand `buildAssets` an
+    // `if-not-present` pull so it converts that exact local image rather than re-pulling
+    // — guaranteeing the digest we keyed the cache on (`cacheRef`) is the digest the
+    // asset is built from, never tagging a freshly re-pulled image under a stale digest.
+    const config = {
+        ...deps.defaultBuildConfig(),
+        oci: { image: ociRef, pullPolicy: 'if-not-present', ...(runtime ? { runtime } : {}) },
+    };
+    const result = await deps.buildAssets(config, { outputDir: deps.mkOutputDir(), verbose: false });
+    const imported = deps.importImageFromDirectory(result.outputDir);
+    deps.setImageRef(cacheRef, imported.buildId, imported.arch);
+    log?.emit('info', 'gondolin-image-converter: converted + cached', {
+        oci_image: ociRef,
+        digest,
+        cacheRef,
+        build_id: imported.buildId,
+    });
+    return {
+        buildId: imported.buildId,
+        assetDir: imported.assetDir,
+        selector: runtimeSelector(imported.buildId, imported.assetDir),
+        cached: false,
+    };
+}
+/**
+ * Probe whether `ociRef` is already converted + locally resolvable, WITHOUT pulling
+ * or building. Used by BOTH the doctor's read-only preflight AND the reconcile loop's
+ * per-tick readiness check (issue 206 rework). It resolves the ref's CURRENT local
+ * digest and looks up the cached asset at that digest, so readiness tracks the live
+ * digest rather than the ref string: a moving tag whose underlying image changed
+ * reports `converted: false` (a stale selector is dropped) until the new digest is
+ * reconverted.
+ *
+ *   - `digest`            — the ref's resolved local OCI digest, or null when it
+ *                           can't be inspected (not pulled yet / pull disabled).
+ *   - `selector`          — the cached asset's runtime image selector for that digest
+ *                           (what dispatch boots), or null when not yet converted.
+ *   - `converted`         — a cached asset for the current digest resolves.
+ *   - `locallyResolvable` — the OCI image's digest is readable from the local store.
+ */
+export function probeConvertedImage(ociRef, opts = {}) {
+    const deps = opts.deps ?? defaultConverterDeps();
+    const runtime = opts.runtime ?? null;
+    let digest = null;
+    try {
+        digest = deps.resolveOciDigest(ociRef, runtime, 'never'); // read-only: never pulls
+    }
+    catch {
+        return { converted: false, locallyResolvable: false, digest: null, selector: null };
+    }
+    const hit = tryResolve(deps, cacheRefFor(digest));
+    if (hit === null)
+        return { converted: false, locallyResolvable: true, digest, selector: null };
+    const buildId = hit.buildId ?? '';
+    return { converted: true, locallyResolvable: true, digest, selector: runtimeSelector(buildId, hit.assetDir) };
+}
+function tryResolve(deps, selector) {
+    try {
+        return deps.resolveImageSelector(selector);
+    }
+    catch {
+        return null;
+    }
+}
+// ─── production wiring (real docker/podman + Gondolin SDK) ─────────────────────
+/** The real Gondolin/runtime ops. Tests inject a stub bundle instead. */
+export function defaultConverterDeps() {
+    return {
+        resolveOciDigest: resolveOciDigestViaRuntime,
+        resolveImageSelector,
+        buildAssets,
+        importImageFromDirectory,
+        setImageRef,
+        defaultBuildConfig: getDefaultBuildConfig,
+        mkOutputDir: () => mkdtempSync(path.join(os.tmpdir(), 'symphony-oci-')),
+    };
+}
+/**
+ * Drive the OCI digest resolution honoring the FULL pull policy, given injected
+ * runtime effects. Pure ordering logic (no spawn), so the policy semantics are
+ * unit-testable without docker:
+ *
+ *   - `always`         — pull FIRST, unconditionally (even when the ref is already
+ *                        present locally), then inspect, so the POST-pull digest wins.
+ *   - `if-not-present` — inspect first; pull only on a local miss, then re-inspect.
+ *   - `never`          — never pull; a missing ref resolves to null (caller errors).
+ *
+ * Returns the resolved local image id, or null when unresolvable.
+ */
+export function resolveDigestForPolicy(pullPolicy, io) {
+    if (pullPolicy === 'always')
+        io.pull();
+    let id = io.inspect();
+    if (id === null && pullPolicy === 'if-not-present') {
+        io.pull();
+        id = io.inspect();
+    }
+    return id;
+}
+/**
+ * Resolve an OCI ref to its immutable local image id (`sha256:…`) via the container
+ * runtime, pulling per `pullPolicy`. Mirrors what Gondolin's own OCI export path does
+ * (the package does not re-export `resolveLocalOciImageDigest`, so we shell out to the
+ * same runtime). Throws a precise, operator-facing error on failure.
+ */
+function resolveOciDigestViaRuntime(ref, runtime, pullPolicy) {
+    const rt = runtime ?? detectRuntime();
+    const id = resolveDigestForPolicy(pullPolicy, {
+        inspect: () => inspectImageId(rt, ref),
+        pull: () => pullImage(rt, ref),
+    });
+    if (id === null) {
+        throw new Error(`cannot resolve OCI image "${ref}" via ${rt}${pullPolicy === 'never' ? ' (not present locally; pull disabled)' : ' (after pull)'}`);
+    }
+    return id;
+}
+/** `<runtime> pull <ref>`; throws a precise, operator-facing error on failure. */
+function pullImage(runtime, ref) {
+    const pulled = spawnSync(runtime, ['pull', ref], { encoding: 'utf8' });
+    if (pulled.status !== 0) {
+        throw new Error(`failed to pull OCI image "${ref}" via ${runtime}: ${(pulled.stderr || pulled.error?.message || '').trim()}`);
+    }
+}
+/** `<runtime> image inspect --format {{.Id}} <ref>` → the local config digest, or null. */
+function inspectImageId(runtime, ref) {
+    const r = spawnSync(runtime, ['image', 'inspect', '--format', '{{.Id}}', ref], { encoding: 'utf8' });
+    if (r.status !== 0)
+        return null;
+    const id = (r.stdout || '').trim();
+    return id.length > 0 ? id : null;
+}
+/** Pick docker, else podman, by which `--version` answers; defaults to docker. */
+function detectRuntime() {
+    for (const rt of ['docker', 'podman']) {
+        const r = spawnSync(rt, ['--version'], { encoding: 'utf8' });
+        if (r.status === 0)
+            return rt;
+    }
+    return 'docker';
+}
+//# sourceMappingURL=gondolin-image-converter.js.map

package/dist/src/shell/adapter/gondolin-image-converter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gondolin-image-converter.js","sourceRoot":"","sources":["../../../../src/shell/adapter/gondolin-image-converter.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,EAAE;AACF,oFAAoF;AACpF,8EAA8E;AAC9E,wEAAwE;AACxE,oFAAoF;AACpF,oFAAoF;AACpF,kFAAkF;AAClF,qFAAqF;AACrF,qBAAqB;AACrB,EAAE;AACF,oFAAoF;AACpF,gFAAgF;AAChF,+EAA+E;AAC/E,qFAAqF;AACrF,4CAA4C;AAC5C,EAAE;AACF,sFAAsF;AACtF,oFAAoF;AACpF,oFAAoF;AACpF,uFAAuF;AACvF,EAAE;AACF,kFAAkF;AAClF,kFAAkF;AAClF,sFAAsF;AAEtF,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,WAAW,EACX,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,EACpB,WAAW,GAKZ,MAAM,0BAA0B,CAAC;AAclC;;;;GAIG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,IAAI,CAAC;AAEnD,kFAAkF;AAClF,MAAM,UAAU,WAAW,CAAC,MAAc,EAAE,cAAc,GAAG,8BAA8B;IACzF,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,IAAI,cAAc,EAAE,CAAC;IACtE,OAAO,gBAAgB,GAAG,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,OAAe,EAAE,QAAgB;IACxD,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAc,EACd,OAAoC,EAAE;IAEtC,MAAM,UAAU,GAAkB,IAAI,CAAC,UAAU,IAAI,gBAAgB,CAAC;IACtE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,oBAAoB,EAAE,CAAC;IACjD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IAErB,kFAAkF;IAClF,gFAAgF;IAChF,gFAAgF;IAChF,oFAAoF;IACpF,gBAAgB;IAChB,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAErC,2EAA2E;IAC3E,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACvC,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;QAClC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,qCAAqC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClG,OAAO;YACL,OAAO;YACP,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,QAAQ,EAAE,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC;YAChD,MAAM,EAAE,IAAI;SACb,CAAC;IACJ,CAAC;IACD,OAAO,aAAa,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;AACzE,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,aAAa,CAC1B,IAAmB,EACnB,GAMC;IAED,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC;IACvD,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,+CAA+C,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC5G,kFAAkF;IAClF,2EAA2E;IAC3E,qFAAqF;IACrF,iFAAiF;IACjF,qFAAqF;IACrF,MAAM,MAAM,GAAgB;QAC1B,GAAG,IAAI,CAAC,kBAAkB,EAAE;QAC5B,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,gBAAgB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;KACtF,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IACjG,MAAM,QAAQ,GAAG,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjE,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5D,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,8CAA8C,EAAE;QAChE,SAAS,EAAE,MAAM;QACjB,MAAM;QACN,QAAQ;QACR,QAAQ,EAAE,QAAQ,CAAC,OAAO;KAC3B,CAAC,CAAC;IACH,OAAO;QACL,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,QAAQ,EAAE,eAAe,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC;QAC9D,MAAM,EAAE,KAAK;KACd,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAc,EACd,OAAoE,EAAE;IAEtE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,oBAAoB,EAAE,CAAC;IACjD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC;IACrC,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,yBAAyB;IACrF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACtF,CAAC;IACD,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;IAClD,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC/F,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;IAClC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;AAChH,CAAC;AAED,SAAS,UAAU,CAAC,IAAmB,EAAE,QAAgB;IACvD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,kFAAkF;AAElF,yEAAyE;AACzE,MAAM,UAAU,oBAAoB;IAClC,OAAO;QACL,gBAAgB,EAAE,0BAA0B;QAC5C,oBAAoB;QACpB,WAAW;QACX,wBAAwB;QACxB,WAAW;QACX,kBAAkB,EAAE,qBAAqB;QACzC,WAAW,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC;KACxE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,sBAAsB,CACpC,UAAyB,EACzB,EAAsD;IAEtD,IAAI,UAAU,KAAK,QAAQ;QAAE,EAAE,CAAC,IAAI,EAAE,CAAC;IACvC,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IACtB,IAAI,EAAE,KAAK,IAAI,IAAI,UAAU,KAAK,gBAAgB,EAAE,CAAC;QACnD,EAAE,CAAC,IAAI,EAAE,CAAC;QACV,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IACpB,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;GAKG;AACH,SAAS,0BAA0B,CACjC,GAAW,EACX,OAAgC,EAChC,UAAyB;IAEzB,MAAM,EAAE,GAAG,OAAO,IAAI,aAAa,EAAE,CAAC;IACtC,MAAM,EAAE,GAAG,sBAAsB,CAAC,UAAU,EAAE;QAC5C,OAAO,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,GAAG,CAAC;QACtC,IAAI,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC;KAC/B,CAAC,CAAC;IACH,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,6BAA6B,GAAG,SAAS,EAAE,GACzC,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,uCAAuC,CAAC,CAAC,CAAC,eACrE,EAAE,CACH,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,kFAAkF;AAClF,SAAS,SAAS,CAAC,OAAyB,EAAE,GAAW;IACvD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACvE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,6BAA6B,GAAG,SAAS,OAAO,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAC7G,CAAC;IACJ,CAAC;AACH,CAAC;AAED,2FAA2F;AAC3F,SAAS,cAAc,CAAC,OAAyB,EAAE,GAAW;IAC5D,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACrG,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACnC,OAAO,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACnC,CAAC;AAED,kFAAkF;AAClF,SAAS,aAAa;IACpB,KAAK,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAU,EAAE,CAAC;QAC/C,MAAM,CAAC,GAAG,SAAS,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;IAChC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/src/shell/adapter/gondolin-image-fetch.js

@@ -0,0 +1,180 @@
+// FCIS rewrite — managed prebuilt-image fetcher (kind: adapter, issue 224 "Rung 2a").
+//
+// The runtime counterpart of `gondolin-image-converter.ts`, but instead of building an
+// asset from a local OCI base it FETCHES a prebuilt Gondolin asset bundle published by
+// CI to smol-symphony's GitHub releases, verifies it against a published `.sha256`,
+// imports it into the local Gondolin store, and tags it under the managed `name:tag`
+// ref. Onboarding becomes `scaffold → run`: no docker, no `npm run build:image`, no
+// local convert. The orchestrator drives this through the SAME `image:ensure` effect +
+// `ImageBuildTracker` readiness path the convert path uses (main-loops routes the
+// managed ref here, every other ref to the converter).
+//
+// The pure half — asset name / store ref / download-URL / arch map / sha256-sidecar
+// parse — lives in `src/core/image/managed-image.ts` and is reused here
+// (`parseSha256Sidecar`). This module is the IO home: network download, sha256, tar/zstd
+// extract, and the Gondolin SDK import/tag. All of it is injectable (`FetchDeps`) so the
+// cache-hit + verify paths are unit-testable without network or a real store.
+import { createHash } from 'node:crypto';
+import { createReadStream, createWriteStream, existsSync, mkdtempSync, mkdirSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import { Readable } from 'node:stream';
+import { finished } from 'node:stream/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { importImageFromDirectory, resolveImageSelector, setImageRef, } from '@earendil-works/gondolin';
+import { parseSha256Sidecar } from '../../core/image/managed-image.js';
+/** Mirrors the converter's `runtimeSelector`: prefer the content-derived build id, else
+ *  the asset dir (a `path` selector). Always non-empty so dispatch never boots empty. */
+function runtimeSelector(buildId, assetDir) {
+    return buildId.length > 0 ? buildId : assetDir;
+}
+/** Resolve a managed ref WITHOUT throwing — null is the cache-miss signal. */
+function tryResolve(deps, ref) {
+    try {
+        return deps.resolveImageSelector(ref);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Probe whether the managed asset is already imported + resolvable, read-only (no
+ * download). The reconcile loop's per-tick readiness check calls this; mirrors the
+ * converter's `probeConvertedImage` shape. `digest` is the resolved build id (a stable
+ * marker the tracker keys failure-suppression on); both null on a miss.
+ */
+export function probeFetchedImage(wiring, opts = {}) {
+    const deps = opts.deps ?? defaultFetchDeps();
+    const hit = tryResolve(deps, wiring.ref);
+    if (hit === null)
+        return { digest: null, selector: null };
+    const buildId = hit.buildId ?? '';
+    return {
+        digest: buildId.length > 0 ? buildId : wiring.ref,
+        selector: runtimeSelector(buildId, hit.assetDir),
+    };
+}
+/**
+ * Fetch + import the managed asset, returning the resolved asset (or a cache hit). On a
+ * cache hit (`resolveImageSelector(ref)` succeeds) returns the cached selector with NO
+ * download. On a miss: download the asset + its `.sha256` sidecar (trying each release-tag
+ * candidate), VERIFY the sha256 (a mismatch or a digest-less sidecar THROWS before import),
+ * extract, `importImageFromDirectory`, and `setImageRef` under the managed ref.
+ */
+export async function ensureFetchedImage(wiring, opts = {}) {
+    const deps = opts.deps ?? defaultFetchDeps();
+    const log = opts.log;
+    const hit = tryResolve(deps, wiring.ref);
+    if (hit !== null) {
+        const buildId = hit.buildId ?? '';
+        log?.emit('info', 'gondolin-image-fetch: cache hit', { ref: wiring.ref });
+        return { buildId, assetDir: hit.assetDir, selector: runtimeSelector(buildId, hit.assetDir), cached: true };
+    }
+    const tmp = deps.mkTempDir();
+    const archivePath = path.join(tmp, wiring.assetName);
+    const sidecarPath = `${archivePath}.sha256`;
+    log?.emit('info', 'gondolin-image-fetch: downloading (one-time)', { ref: wiring.ref, asset: wiring.assetName });
+    const chosen = await downloadFirstCandidate(deps, wiring, archivePath, sidecarPath);
+    return verifyExtractImport(deps, wiring, { archivePath, sidecarPath, extractDir: path.join(tmp, 'extracted'), chosen, log });
+}
+/** Verify the downloaded asset against its sidecar, extract, import, and tag it. A
+ *  digest-less sidecar or a sha256 mismatch THROWS before any import. */
+async function verifyExtractImport(deps, wiring, ctx) {
+    const { archivePath, sidecarPath, extractDir, chosen, log } = ctx;
+    // VERIFY before import — a published asset is only trusted against its published digest.
+    const expected = parseSha256Sidecar(deps.readTextFile(sidecarPath));
+    if (expected === null) {
+        throw new Error(`managed image ${wiring.ref}: sha256 sidecar at ${chosen.sha256Url} is missing or malformed; refusing to import unverified asset`);
+    }
+    const actual = (await deps.sha256OfFile(archivePath)).toLowerCase();
+    if (actual !== expected) {
+        throw new Error(`managed image ${wiring.ref}: sha256 mismatch (expected ${expected}, got ${actual}) for ${chosen.assetUrl}; refusing to import`);
+    }
+    const assetDir = await deps.extractAsset(archivePath, extractDir);
+    const imported = deps.importImageFromDirectory(assetDir);
+    deps.setImageRef(wiring.ref, imported.buildId, imported.arch);
+    log?.emit('info', 'gondolin-image-fetch: imported + tagged', { ref: wiring.ref, build_id: imported.buildId, tag: chosen.tag });
+    return {
+        buildId: imported.buildId,
+        assetDir: imported.assetDir,
+        selector: runtimeSelector(imported.buildId, imported.assetDir),
+        cached: false,
+    };
+}
+/**
+ * Download the asset + sidecar, trying each release-tag candidate (`v<version>`, then a
+ * bare `<version>`) until one yields BOTH. Throws an aggregate error when none resolve.
+ */
+async function downloadFirstCandidate(deps, wiring, archivePath, sidecarPath) {
+    const errors = [];
+    for (const candidate of wiring.candidates) {
+        try {
+            await deps.downloadToFile(candidate.assetUrl, archivePath);
+            await deps.downloadToFile(candidate.sha256Url, sidecarPath);
+            return candidate;
+        }
+        catch (err) {
+            errors.push(`${candidate.tag}: ${err.message}`);
+        }
+    }
+    throw new Error(`managed image ${wiring.ref}: no published asset found for ${wiring.assetName} (tried ${wiring.candidates
+        .map((c) => c.tag)
+        .join(', ')}). Publish the release asset, or set gondolin.image / gondolin.oci_image. [${errors.join('; ')}]`);
+}
+// ─── production wiring (real fetch + tar/zstd + Gondolin SDK) ──────────────────
+/** The real network + filesystem + Gondolin SDK ops. Tests inject a stub bundle. */
+export function defaultFetchDeps() {
+    return {
+        resolveImageSelector,
+        importImageFromDirectory,
+        setImageRef,
+        downloadToFile: downloadToFileViaFetch,
+        readTextFile: (p) => readFileSync(p, 'utf8'),
+        sha256OfFile: sha256OfFileStreaming,
+        extractAsset: extractTarZst,
+        mkTempDir: () => mkdtempSync(path.join(os.tmpdir(), 'symphony-managed-')),
+    };
+}
+/** Stream a URL to `destPath`; throws on a non-OK response (so the candidate loop falls
+ *  through to the next release tag). */
+async function downloadToFileViaFetch(url, destPath) {
+    const res = await fetch(url);
+    if (!res.ok || res.body === null) {
+        throw new Error(`GET ${url} → ${res.status} ${res.statusText}`);
+    }
+    const out = createWriteStream(destPath);
+    await finished(Readable.fromWeb(res.body).pipe(out));
+}
+/** Lowercased hex sha256 of a file, streamed (the asset is hundreds of MB). */
+async function sha256OfFileStreaming(filePath) {
+    const hash = createHash('sha256');
+    await finished(createReadStream(filePath).on('data', (chunk) => hash.update(chunk)));
+    return hash.digest('hex');
+}
+/** Extract a `.tar.zst` into `destDir`; return the asset dir (the one holding
+ *  `manifest.json` — `destDir` itself, else a single nested subdir). */
+async function extractTarZst(archivePath, destDir) {
+    mkdirSync(destDir, { recursive: true });
+    const r = spawnSync('tar', ['--use-compress-program=unzstd', '-xf', archivePath, '-C', destDir], {
+        encoding: 'utf8',
+    });
+    if (r.status !== 0) {
+        throw new Error(`tar extract of ${archivePath} failed: ${(r.stderr || r.error?.message || '').trim()}`);
+    }
+    return locateAssetDir(destDir);
+}
+/** The dir holding `manifest.json`: `destDir` itself, else its single subdir. */
+function locateAssetDir(destDir) {
+    if (existsSync(path.join(destDir, 'manifest.json')))
+        return destDir;
+    const subdirs = readdirSync(destDir).filter((name) => statSync(path.join(destDir, name)).isDirectory());
+    for (const name of subdirs) {
+        const candidate = path.join(destDir, name);
+        if (existsSync(path.join(candidate, 'manifest.json')))
+            return candidate;
+    }
+    // No manifest located — return destDir and let importImageFromDirectory surface the
+    // precise error against the actual contents.
+    return destDir;
+}
+//# sourceMappingURL=gondolin-image-fetch.js.map

package/dist/src/shell/adapter/gondolin-image-fetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gondolin-image-fetch.js","sourceRoot":"","sources":["../../../../src/shell/adapter/gondolin-image-fetch.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,EAAE;AACF,uFAAuF;AACvF,uFAAuF;AACvF,oFAAoF;AACpF,qFAAqF;AACrF,oFAAoF;AACpF,uFAAuF;AACvF,kFAAkF;AAClF,uDAAuD;AACvD,EAAE;AACF,oFAAoF;AACpF,wEAAwE;AACxE,yFAAyF;AACzF,yFAAyF;AACzF,8EAA8E;AAE9E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACvI,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,WAAW,GAEZ,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAevE;yFACyF;AACzF,SAAS,eAAe,CAAC,OAAe,EAAE,QAAgB;IACxD,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;AACjD,CAAC;AAED,8EAA8E;AAC9E,SAAS,UAAU,CAAC,IAAe,EAAE,GAAW;IAC9C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAA0B,EAC1B,OAA6B,EAAE;IAE/B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,gBAAgB,EAAE,CAAC;IAC7C,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1D,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;IAClC,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG;QACjD,QAAQ,EAAE,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC;KACjD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAA0B,EAC1B,OAAkC,EAAE;IAEpC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,gBAAgB,EAAE,CAAC;IAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IAErB,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;QAClC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,iCAAiC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1E,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC7G,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAC7B,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,WAAW,GAAG,GAAG,WAAW,SAAS,CAAC;IAE5C,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,8CAA8C,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAChH,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;IACpF,OAAO,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;AAC/H,CAAC;AAED;yEACyE;AACzE,KAAK,UAAU,mBAAmB,CAChC,IAAe,EACf,MAA0B,EAC1B,GAMC;IAED,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC;IAClE,yFAAyF;IACzF,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC;IACpE,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,iBAAiB,MAAM,CAAC,GAAG,uBAAuB,MAAM,CAAC,SAAS,+DAA+D,CAClI,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACpE,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,iBAAiB,MAAM,CAAC,GAAG,+BAA+B,QAAQ,SAAS,MAAM,SAAS,MAAM,CAAC,QAAQ,sBAAsB,CAChI,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IACzD,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC9D,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,yCAAyC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/H,OAAO;QACL,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,QAAQ,EAAE,eAAe,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC;QAC9D,MAAM,EAAE,KAAK;KACd,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,sBAAsB,CACnC,IAAe,EACf,MAA0B,EAC1B,WAAmB,EACnB,WAAmB;IAEnB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;YAC3D,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YAC5D,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,GAAG,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CACb,iBAAiB,MAAM,CAAC,GAAG,kCAAkC,MAAM,CAAC,SAAS,WAAW,MAAM,CAAC,UAAU;SACtG,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;SACjB,IAAI,CAAC,IAAI,CAAC,8EAA8E,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAChH,CAAC;AACJ,CAAC;AAED,kFAAkF;AAElF,oFAAoF;AACpF,MAAM,UAAU,gBAAgB;IAC9B,OAAO;QACL,oBAAoB;QACpB,wBAAwB;QACxB,WAAW;QACX,cAAc,EAAE,sBAAsB;QACtC,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC;QAC5C,YAAY,EAAE,qBAAqB;QACnC,YAAY,EAAE,aAAa;QAC3B,SAAS,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC;KAC1E,CAAC;AACJ,CAAC;AAED;wCACwC;AACxC,KAAK,UAAU,sBAAsB,CAAC,GAAW,EAAE,QAAgB;IACjE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,GAAG,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAA8C,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACjG,CAAC;AAED,+EAA+E;AAC/E,KAAK,UAAU,qBAAqB,CAAC,QAAgB;IACnD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,QAAQ,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACrF,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED;wEACwE;AACxE,KAAK,UAAU,aAAa,CAAC,WAAmB,EAAE,OAAe;IAC/D,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,+BAA+B,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE;QAC/F,QAAQ,EAAE,MAAM;KACjB,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,kBAAkB,WAAW,YAAY,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC1G,CAAC;IACD,OAAO,cAAc,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AAED,iFAAiF;AACjF,SAAS,cAAc,CAAC,OAAe;IACrC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAAE,OAAO,OAAO,CAAC;IACpE,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IACxG,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC3C,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;IAC1E,CAAC;IACD,oFAAoF;IACpF,6CAA6C;IAC7C,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/src/shell/adapter/launcher-asset.js

@@ -0,0 +1,57 @@
+// FCIS rewrite — in-VM launcher asset loader (shell adapter).
+//
+// Ports the reference `src/agent/launcher-asset.ts`: reads `scripts/vm-agent.mjs`
+// off the orchestrator's OWN disk once at load, returning the UTF-8 source for
+// per-dispatch staging into the guest. Reading the launcher from host disk (rather
+// than baking it into the image) guarantees the staged launcher is byte-identical
+// to the version the running `acp-ws.ts` speaks — eliminating the image⇄host
+// version lock (see project memory: agent image ⇄ host coupling).
+//
+// Resolution is anchored to THIS module via import.meta.url (never cwd) so it works
+// from both `src/shell/adapter` (tsx) and a built `dist/shell/adapter` layout: both
+// sit three levels under a root that holds `scripts/vm-agent.mjs`. A sibling
+// fallback covers a packaging layout that co-locates the launcher next to dist.
+//
+// Fail-fast: a missing/empty asset throws at load (surfacing the packaging miss at
+// boot, not mid-dispatch). Shell rule: node builtins only; no core, no src/types.
+import { readFileSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+/** Guest path the launcher is staged to (mirrors the historical bake path). */
+export const VM_AGENT_GUEST_PATH = '/opt/symphony/vm-agent.mjs';
+/** Candidate on-disk locations of `scripts/vm-agent.mjs`, resolved relative to here. */
+function candidatePaths() {
+    const here = path.dirname(fileURLToPath(import.meta.url));
+    return [
+        path.resolve(here, '../../../scripts/vm-agent.mjs'),
+        path.resolve(here, './vm-agent.mjs'),
+    ];
+}
+/** Read the launcher source from the first candidate that exists; throw if none. */
+function loadLauncherSource() {
+    const candidates = candidatePaths();
+    for (const candidate of candidates) {
+        try {
+            const source = readFileSync(candidate, 'utf8');
+            if (source.length === 0)
+                throw new Error(`in-VM launcher asset is empty at ${candidate}`);
+            return { source, resolvedPath: candidate };
+        }
+        catch (err) {
+            if (err.code !== 'ENOENT')
+                throw err;
+        }
+    }
+    throw new Error(`in-VM launcher asset (scripts/vm-agent.mjs) not found; looked in: ${candidates.join(', ')}.`);
+}
+let cached = null;
+/** Load (once) + return the launcher source + path + sha256. Throws if absent. */
+export function loadLauncherAsset() {
+    if (cached)
+        return cached;
+    const { source, resolvedPath } = loadLauncherSource();
+    cached = { source, resolvedPath, sha256: createHash('sha256').update(source, 'utf8').digest('hex') };
+    return cached;
+}
+//# sourceMappingURL=launcher-asset.js.map

package/dist/src/shell/adapter/launcher-asset.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"launcher-asset.js","sourceRoot":"","sources":["../../../../src/shell/adapter/launcher-asset.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,EAAE;AACF,kFAAkF;AAClF,+EAA+E;AAC/E,mFAAmF;AACnF,kFAAkF;AAClF,6EAA6E;AAC7E,kEAAkE;AAClE,EAAE;AACF,oFAAoF;AACpF,oFAAoF;AACpF,6EAA6E;AAC7E,gFAAgF;AAChF,EAAE;AACF,mFAAmF;AACnF,kFAAkF;AAElF,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,+EAA+E;AAC/E,MAAM,CAAC,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;AAEhE,wFAAwF;AACxF,SAAS,cAAc;IACrB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,OAAO;QACL,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,+BAA+B,CAAC;QACnD,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,gBAAgB,CAAC;KACrC,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,SAAS,kBAAkB;IACzB,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;IACpC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YAC/C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,SAAS,EAAE,CAAC,CAAC;YAC1F,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;QAC7C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAC;QAClE,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CACb,qEAAqE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC9F,CAAC;AACJ,CAAC;AAED,IAAI,MAAM,GAAoE,IAAI,CAAC;AAEnF,kFAAkF;AAClF,MAAM,UAAU,iBAAiB;IAC/B,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,kBAAkB,EAAE,CAAC;IACtD,MAAM,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IACrG,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/src/shell/adapter/mise-config-asset.js

@@ -0,0 +1,65 @@
+// FCIS rewrite — mise SYSTEM config asset loader (shell adapter; issue 209/224).
+//
+// Reads the symphony-bundled mise SYSTEM config (`assets/symphony-mise.system.toml`)
+// off the orchestrator's OWN disk once at load, returning the UTF-8 source for
+// per-dispatch staging into the guest at /etc/mise/config.toml. Shipping the config
+// from host disk (rather than baking node + the agent CLIs into the image) is the
+// whole point of issue 209: bump a pin in this file → no image rebuild + digest repin.
+// It mirrors launcher-asset.ts exactly (the launcher gets the same treatment).
+//
+// The asset lives under `assets/` (issue 224 Part 5): it is read at RUNTIME and staged
+// per dispatch, so it must NOT live in the CI-build-only `images/agents/` (the image
+// build does not consume it). A back-compat `images/agents/` candidate keeps an older
+// checkout/package working through the transition.
+//
+// Resolution is anchored to THIS module via import.meta.url (never cwd) so it works
+// from both `src/shell/adapter` (tsx) and a built `dist/shell/adapter` layout: both
+// sit three levels under a root that holds `assets/symphony-mise.system.toml`. A
+// sibling fallback covers a packaging layout that co-locates the asset next to dist.
+//
+// Fail-fast: a missing/empty asset throws at load (surfacing the packaging miss at
+// boot, not mid-dispatch). Shell rule: node builtins only; no core, no src/types.
+import { readFileSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+/** Asset filename (kept in sync with the staged guest path in core `runner/mise.ts`). */
+const ASSET_NAME = 'symphony-mise.system.toml';
+/** Candidate on-disk locations of the mise SYSTEM config, resolved relative to here.
+ *  `assets/` is the runtime home (issue 224 Part 5); `images/agents/` is a back-compat
+ *  candidate for an older checkout/package; the sibling covers a co-located layout. */
+function candidatePaths() {
+    const here = path.dirname(fileURLToPath(import.meta.url));
+    return [
+        path.resolve(here, '../../../assets', ASSET_NAME),
+        path.resolve(here, '../../../images/agents', ASSET_NAME),
+        path.resolve(here, ASSET_NAME),
+    ];
+}
+/** Read the config source from the first candidate that exists; throw if none. */
+function loadMiseConfigSource() {
+    const candidates = candidatePaths();
+    for (const candidate of candidates) {
+        try {
+            const source = readFileSync(candidate, 'utf8');
+            if (source.length === 0)
+                throw new Error(`mise SYSTEM config asset is empty at ${candidate}`);
+            return { source, resolvedPath: candidate };
+        }
+        catch (err) {
+            if (err.code !== 'ENOENT')
+                throw err;
+        }
+    }
+    throw new Error(`mise SYSTEM config asset (assets/${ASSET_NAME}) not found; looked in: ${candidates.join(', ')}.`);
+}
+let cached = null;
+/** Load (once) + return the mise SYSTEM config source + path + sha256. Throws if absent. */
+export function loadMiseConfigAsset() {
+    if (cached)
+        return cached;
+    const { source, resolvedPath } = loadMiseConfigSource();
+    cached = { source, resolvedPath, sha256: createHash('sha256').update(source, 'utf8').digest('hex') };
+    return cached;
+}
+//# sourceMappingURL=mise-config-asset.js.map

package/dist/src/shell/adapter/mise-config-asset.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mise-config-asset.js","sourceRoot":"","sources":["../../../../src/shell/adapter/mise-config-asset.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,EAAE;AACF,qFAAqF;AACrF,+EAA+E;AAC/E,oFAAoF;AACpF,kFAAkF;AAClF,uFAAuF;AACvF,+EAA+E;AAC/E,EAAE;AACF,uFAAuF;AACvF,qFAAqF;AACrF,sFAAsF;AACtF,mDAAmD;AACnD,EAAE;AACF,oFAAoF;AACpF,oFAAoF;AACpF,iFAAiF;AACjF,qFAAqF;AACrF,EAAE;AACF,mFAAmF;AACnF,kFAAkF;AAElF,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,yFAAyF;AACzF,MAAM,UAAU,GAAG,2BAA2B,CAAC;AAE/C;;uFAEuF;AACvF,SAAS,cAAc;IACrB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,OAAO;QACL,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,iBAAiB,EAAE,UAAU,CAAC;QACjD,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,wBAAwB,EAAE,UAAU,CAAC;QACxD,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC;KAC/B,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,SAAS,oBAAoB;IAC3B,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;IACpC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YAC/C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,SAAS,EAAE,CAAC,CAAC;YAC9F,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;QAC7C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAC;QAClE,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CACb,oCAAoC,UAAU,2BAA2B,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAClG,CAAC;AACJ,CAAC;AAED,IAAI,MAAM,GAAoE,IAAI,CAAC;AAEnF,4FAA4F;AAC5F,MAAM,UAAU,mBAAmB;IACjC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,oBAAoB,EAAE,CAAC;IACxD,MAAM,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IACrG,OAAO,MAAM,CAAC;AAChB,CAAC"}