software-defence-factory 0.3.1 → 0.3.3

package/docs/quickstart.md

@@ -54,3 +54,14 @@ ssh -N -L 127.0.0.1:7331:127.0.0.1:7331 your-host
 Open http://127.0.0.1:7331 on the client. Use the same local/remote port because the HTTP service validates its Host header. The SSH connection must remain open. Access also works across different networks when your configured private network connects the hosts.
 
 Use `status`, `cancel JOB_ID`, `retry JOB_ID` and `stop`, always with the selected `--state`. `service` prints a systemd user-service definition; review and install it through the host's normal service management. It is not enabled by printing it. See [recovery](recovery.md).
+
+## Native application builds
+
+Pin an application-specific image with the required toolchains. In `factory.json`,
+`cpus` (1–32, default 2), `pidsLimit` (64–16384, default 256), `memoryMiB` and
+`timeoutSeconds` bound the job's resources. Verification uses a separate
+disk-backed checkout, keeping the candidate read-only. Its private scratch
+directory is removed after container termination is confirmed. Interrupted
+executors may retain scratch under their attempt for recovery; stop/reconcile
+the job before removing it. Ensure the state filesystem has sufficient space.
+No Docker socket, operator credentials or unrelated project caches are mounted.

package/factory/executor.mjs

@@ -1,4 +1,4 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync, rmSync, lstatSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, writeFileSync, rmSync, lstatSync, chmodSync, readdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { spawn } from 'node:child_process';
 import { ROOT, configAt, run, save, json, digest, instanceLabel, stopContainers } from './lib.mjs';
@@ -44,21 +44,35 @@ function safeRead(path) {
   if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 1024 * 1024) throw new Error('Expected a regular report under 1 MiB');
   return readFileSync(path, 'utf8');
 }
+// Called only after the container has stopped. Builds may leave read-only cache
+// directories; make owned directories traversable without following symlinks.
+function removeScratch(path) {
+  if (lstatSync(path).isDirectory()) {
+    chmodSync(path, 0o700);
+    for (const name of readdirSync(path)) removeScratch(join(path, name));
+  }
+  rmSync(path, { recursive: true, force: true });
+}
 async function container(mode, input, command, writable = false, credentials = false) {
   const name = `sdf-${instanceLabel(state)}-${attempt}-${mode}`;
   const reportDir = join(folder, attempt, mode);
   mkdirSync(reportDir, { recursive: true, mode: 0o700 });
+  // Native builds need disk-backed scratch space, not the small temporary RAM disk.
+  // Only this attempt can write here; the candidate and its Git metadata stay read-only.
+  const scratch = mode === 'verify' ? join(folder, attempt, 'check-workspace') : null;
+  if (scratch) mkdirSync(scratch, { mode: 0o700 });
   const uid = process.getuid(), gid = process.getgid();
   const args = ['run','--name',name,'--init','--read-only','--cap-drop=ALL','--security-opt=no-new-privileges',
-    '--pids-limit=256','--memory',`${config.memoryMiB}m`,'--cpus','2', '--user',`${uid}:${gid}`,
+    '--pids-limit',String(config.pidsLimit ?? 256),'--memory',`${config.memoryMiB}m`,'--cpus',String(config.cpus ?? 2), '--user',`${uid}:${gid}`,
     '--network',config.network,'--label',`sdf.factory=${instanceLabel(state)}`,'--label',`sdf.job=${job}`,
     '--label',`sdf.run=${attempt}`,'--label',`sdf.deadline=${Date.now() + config.timeoutSeconds * 1000}`,
-    '--tmpfs','/tmp:rw,nosuid,size=1024m','--env','HOME=/tmp/home','--env',`FACTORY_PHASE=${mode}`,
+    '--tmpfs','/tmp:rw,nosuid,size=1024m','--env',`HOME=${scratch ? '/scratch/home' : '/tmp/home'}`,'--env',`FACTORY_PHASE=${mode}`,
     '--mount',`type=bind,source=${workspace},target=/workspace${writable ? '' : ',readonly'}`,
     '--mount',`type=bind,source=${join(workspace,'.git')},target=/workspace/.git,readonly`,
     '--mount',`type=bind,source=${reportDir},target=/output`,
     '--mount',`type=bind,source=${join(ROOT,'kit')},target=/factory-policy,readonly`,
     '--mount',`type=bind,source=${join(ROOT,'.agents/skills')},target=/factory-skills,readonly`];
+  if (scratch) args.push('--mount',`type=bind,source=${scratch},target=/scratch`);
   if (credentials) args.push('--env-file', join(state,'model.env'));
   args.push('-i',config.image,'timeout','--signal=KILL',`${config.timeoutSeconds}s`,'sh','-c','mkdir -p "$HOME" && exec "$@"','factory',...command);
   console.log(JSON.stringify({ phase: mode, event: 'started', synthetic: config.agent === 'mock' }));
@@ -79,7 +93,10 @@ async function container(mode, input, command, writable = false, credentials = f
     const probe = run('docker',['ps','-aq','--filter',`name=^/${name}$`]);
     if (probe) throw error;
   }
-  if (code !== 0) throw new Error(`${mode} exited ${code}; private log: ${logPath}`);
+  let cleanupError;
+  try { if (scratch) removeScratch(scratch); } catch (error) { cleanupError = error; }
+  if (code !== 0) throw new Error(`${mode} exited ${code}; private log: ${logPath}${cleanupError ? `; scratch cleanup requires recovery: ${cleanupError.message}` : ''}`);
+  if (cleanupError) throw cleanupError;
   return reportDir;
 }
 function brief(instruction) {
@@ -109,7 +126,7 @@ try {
   } else if (phase === 'verify') {
     const meta = candidate();
     if (!config.check?.trim()) throw new Error('Configure an actual app check before software delivery');
-    const check = ['sh','-c','mkdir -p /tmp/check /tmp/home && cp -R /workspace/. /tmp/check/ && cd /tmp/check && exec sh -c "$1"','check',config.check];
+    const check = ['sh','-c','mkdir -p /scratch/check && cp -R /workspace/. /scratch/check/ && cd /scratch/check && exec sh -c "$1"','check',config.check];
     await container('verify', '', check);
     candidate();
     const proof = { head: meta.head, policyHash, command: config.check, passed: true, finishedAt: new Date().toISOString(), synthetic: meta.synthetic };

package/factory/lib.mjs

@@ -33,6 +33,8 @@ export function configAt(state) {
   if (!Number.isInteger(config.port) || config.port < 1024 || config.port > 65535) throw new Error('Invalid port');
   if (!Number.isInteger(config.timeoutSeconds) || config.timeoutSeconds < 1 || config.timeoutSeconds > 7200) throw new Error('timeoutSeconds must be 1–7200');
   if (!Number.isInteger(config.memoryMiB) || config.memoryMiB < 256) throw new Error('Invalid memory limit');
+  if (config.cpus !== undefined && (!Number.isInteger(config.cpus) || config.cpus < 1 || config.cpus > 32)) throw new Error('cpus must be 1–32');
+  if (config.pidsLimit !== undefined && (!Number.isInteger(config.pidsLimit) || config.pidsLimit < 64 || config.pidsLimit > 16384)) throw new Error('pidsLimit must be 64–16384');
   if (!['none','bridge'].includes(config.network)) throw new Error('network must be none or bridge; host networking is not supported');
   if (typeof config.image !== 'string' || !/^[a-zA-Z0-9][a-zA-Z0-9_./:@-]*$/.test(config.image)) throw new Error('Invalid container image');
   if (typeof config.repo !== 'string' || !isAbsolute(config.repo) || [config.repo,state,ROOT].some(p=>/[,\n\r]/.test(p))) throw new Error('Expected absolute paths without commas or line breaks');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "software-defence-factory",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "description": "Scoped software delivery and defence investigations with isolated jobs, evidence and review",
   "type": "module",
   "license": "MIT",

package/scripts/probe-platform.mjs

@@ -32,6 +32,33 @@ try {
   await cli('approve',pass.id);await waitState(pass.id,'succeeded');
   assert.equal(json(join(folder,'accepted.json')).head,candidate.head);record('software: exact revision, isolated checkout, checks, review, approval, handoff');
 
+  setConfig({cpus:4,pidsLimit:1024,check:"test \"$(cat value.txt)\" = fixed && dd if=/dev/zero of=large-build-fixture bs=1M count=1100 status=none && sleep 2"});
+  const native=await work('Synthetic disk-backed build verification');
+  const checking=await until(()=>containers(state).find(c=>c.Config.Labels['sdf.job']===native.id&&c.State.Running&&c.Config.Env.includes('FACTORY_PHASE=verify')));
+  assert.equal(checking.HostConfig.NanoCpus,4000000000);assert.equal(checking.HostConfig.PidsLimit,1024);
+  assert(checking.Mounts.some(m=>m.Destination==='/scratch'&&m.RW));
+  assert(checking.Mounts.some(m=>m.Destination==='/workspace'&&!m.RW));
+  await waitState(native.id,'awaiting_approval');
+  const verification=(await snapshot(native.id)).runs.find(r=>r.command==='verify');
+  assert(!existsSync(join(state,'jobs',native.id,verification.id,'check-workspace')));
+  assert(!existsSync(join(state,'jobs',native.id,'checkout/large-build-fixture')));
+  await cli('approve',native.id);await waitState(native.id,'succeeded');setConfig({});
+  record('native build scratch exceeds 1 GiB without changing the candidate; limits and cleanup verified');
+
+  for (const exitCode of [0, 17]) {
+    setConfig({check:`mkdir -p cache/nested && echo cache > cache/nested/value && ln -s /workspace cache/candidate && chmod 000 cache/nested cache && exit ${exitCode}`});
+    const readonly=await work(`Synthetic read-only cache cleanup, exit ${exitCode}`);
+    await waitState(readonly.id,exitCode===0?'awaiting_approval':'failed');
+    const run=(await snapshot(readonly.id)).runs.find(r=>r.command==='verify');
+    assert(!existsSync(join(state,'jobs',readonly.id,run.id,'check-workspace')));
+    assert.equal(readFileSync(join(state,'jobs',readonly.id,'checkout/value.txt'),'utf8'),'fixed\n');
+    assert.equal(readFileSync(join(original.repo,'value.txt'),'utf8'),'broken\n');
+    if(exitCode===0){await cli('approve',readonly.id);await waitState(readonly.id,'succeeded');}
+    else assert.match(run.error,/verify exited 17/);
+    record(`read-only cache cleanup after exit ${exitCode}; candidate symlink not followed and exit preserved`);
+  }
+  setConfig({});
+
   const changed=await work('Synthetic changed revision guard');await waitState(changed.id,'awaiting_approval');
   writeFileSync(join(state,'jobs',changed.id,'checkout/value.txt'),'changed after review\n');
   await cli('approve',changed.id);await waitState(changed.id,'failed');
@@ -44,6 +71,7 @@ try {
   setConfig({check:'exit 17'});
   const fail=await work('Synthetic failing check');await waitState(fail.id,'failed');
   assert.equal((await snapshot(fail.id)).runs.at(-1).command,'verify');
+  assert(!existsSync(join(state,'jobs',fail.id,(await snapshot(fail.id)).runs.at(-1).id,'check-workspace')));
   setConfig({});await cli('retry',fail.id);await waitState(fail.id,'awaiting_approval');
   await cli('approve',fail.id);await waitState(fail.id,'succeeded');record('failed app check blocks delivery; controlled retry rechecks same candidate');