software-defence-factory 0.4.2 → 0.4.4

package/factory/image-install.mjs

@@ -0,0 +1,189 @@
+import {
+  existsSync, readFileSync, readdirSync, writeFileSync, renameSync, rmSync,
+} from 'node:fs';
+import { randomBytes } from 'node:crypto';
+import { join } from 'node:path';
+import { configAt, instanceLabel, json, PINS, ROOT, run, stream } from './lib.mjs';
+import { acquireInstallationLock } from './installation-lock.mjs';
+import { VERSION } from './updates.mjs';
+
+const imageIdPattern = /^sha256:[a-f0-9]{64}$/;
+const imageReferencePattern = /^[a-zA-Z0-9][a-zA-Z0-9_./:@-]*$/;
+const missingImage = error => /no such (image|object)/i.test(error.message);
+const alive = pid => {
+  try { process.kill(pid, 0); return true; }
+  catch (error) { if (error.code === 'ESRCH') return false; throw error; }
+};
+
+function docker(args, runner = run) { return runner('docker', args); }
+
+export function inspectLocalImage(reference, runner = run) {
+  if (typeof reference !== 'string' || !imageReferencePattern.test(reference))
+    throw new Error('Invalid Docker image reference');
+  let id;
+  try { id = docker(['image', 'inspect', '--format', '{{.Id}}', reference], runner); }
+  catch (error) {
+    if (missingImage(error)) return null;
+    throw error;
+  }
+  if (!imageIdPattern.test(id)) throw new Error('Docker returned an unexpected image identity');
+  return id;
+}
+
+export function retainImage(image, runner = run) {
+  if (!imageIdPattern.test(image || '')) throw new Error('Expected an immutable Docker image ID');
+  // The shared build tag can move. Keep every selected image reachable by ID.
+  docker(['image', 'tag', image, `software-defence-factory-retained:${image.slice(7)}`], runner);
+  return image;
+}
+
+function retainIfPresent(reference, runner) {
+  const image = inspectLocalImage(reference, runner);
+  if (image) retainImage(image, runner);
+  return image;
+}
+
+export function assertImageChangeSafe(state, { runner = run, isAlive = alive } = {}) {
+  const supervisor = join(state, 'supervisor.json');
+  if (existsSync(supervisor)) {
+    let record;
+    try { record = json(supervisor); }
+    catch { throw new Error('Supervisor state is unreadable; reconcile the installation before changing its image'); }
+    if (!Number.isSafeInteger(record.pid) || record.pid < 1)
+      throw new Error('Supervisor state is unverified; reconcile the installation before changing its image');
+    if (isAlive(record.pid)) throw new Error('Stop the Factory before changing its job image');
+  }
+
+  const jobs = join(state, 'jobs');
+  if (existsSync(jobs)) {
+    for (const job of readdirSync(jobs)) {
+      if (existsSync(join(jobs, job, 'active.json')))
+        throw new Error(`Job ${job} has active or unreconciled execution; reconcile it before changing the image`);
+    }
+  }
+
+  const containers = docker(['ps', '-aq', '--filter', `label=sdf.factory=${instanceLabel(state)}`], runner)
+    .split('\n').filter(Boolean);
+  if (containers.length) throw new Error('Factory job containers remain; stop and reconcile them before changing the image');
+}
+
+function persistInstallation(state, config, metadata, filesystem = undefined) {
+  const fs = filesystem || { readFileSync, writeFileSync, renameSync, rmSync };
+  const configPath = join(state, 'factory.json'), enginePath = join(state, 'engine.json');
+  const previousConfig = fs.readFileSync(configPath);
+  const token = `${process.pid}.${randomBytes(8).toString('hex')}`;
+  const configTemp = `${configPath}.${token}.next`, engineTemp = `${enginePath}.${token}.next`;
+  let configReplaced = false;
+  try {
+    fs.writeFileSync(configTemp, `${JSON.stringify(config, null, 2)}\n`, { flag: 'wx', mode: 0o600 });
+    fs.writeFileSync(engineTemp, `${JSON.stringify(metadata, null, 2)}\n`, { flag: 'wx', mode: 0o600 });
+    fs.renameSync(configTemp, configPath);
+    configReplaced = true;
+    fs.renameSync(engineTemp, enginePath);
+  } catch (error) {
+    if (configReplaced) {
+      const rollback = `${configPath}.${token}.rollback`;
+      try {
+        fs.writeFileSync(rollback, previousConfig, { flag: 'wx', mode: 0o600 });
+        fs.renameSync(rollback, configPath);
+      } catch (rollbackError) {
+        throw new Error(`Image installation metadata could not be completed (${error.message}); restoring factory.json also failed (${rollbackError.message})`);
+      } finally { fs.rmSync(rollback, { force: true }); }
+    }
+    throw error;
+  } finally {
+    fs.rmSync(configTemp, { force: true });
+    fs.rmSync(engineTemp, { force: true });
+  }
+}
+
+function metadataFor(image, source, reference, version) {
+  return {
+    runtime: 'native-node',
+    version,
+    image,
+    imageSource: source,
+    imageReference: reference,
+  };
+}
+
+export function installCustomJobImage(state, reference, { runner = run, version = VERSION, isAlive = alive, filesystem } = {}) {
+  const release = acquireInstallationLock(state, 'select image');
+  try {
+    const config = configAt(state);
+    assertImageChangeSafe(state, { runner, isAlive });
+    const image = inspectLocalImage(reference, runner);
+    if (!image) throw new Error(`Docker image ${reference} is not present locally; build or pull it explicitly before selecting it`);
+    retainImage(image, runner);
+    const nextConfig = { ...config, image };
+    const metadata = metadataFor(image, 'custom', reference, version);
+    persistInstallation(state, nextConfig, metadata, filesystem);
+    return { image, reference, config: nextConfig, metadata };
+  } finally { release(); }
+}
+
+export async function installStandardJobImage(state, { runner = run, build = stream, version = VERSION, isAlive = alive, filesystem } = {}) {
+  const release = acquireInstallationLock(state, 'build image');
+  try {
+    const config = configAt(state);
+    assertImageChangeSafe(state, { runner, isAlive });
+    docker(['info', '--format', '{{.ServerVersion}}'], runner);
+    retainIfPresent(config.image, runner);
+    retainIfPresent(PINS.jobImage, runner);
+    await build('docker', ['build', '-t', PINS.jobImage, join(ROOT, 'factory/image')]);
+    const image = inspectLocalImage(PINS.jobImage, runner);
+    if (!image) throw new Error('Built job image is unavailable');
+    retainImage(image, runner);
+    const nextConfig = { ...config, image };
+    const metadata = metadataFor(image, 'standard', PINS.jobImage, version);
+    persistInstallation(state, nextConfig, metadata, filesystem);
+    return { image, config: nextConfig, metadata };
+  } finally { release(); }
+}
+
+function readMetadata(state) {
+  const path = join(state, 'engine.json');
+  if (!existsSync(path)) return null;
+  try { return json(path); } catch { return null; }
+}
+
+export function inspectImageInstallation(state, config = configAt(state), runner = run) {
+  const metadata = readMetadata(state);
+  let image = null;
+  image = inspectLocalImage(config.image, runner);
+
+  const metadataValid = Boolean(metadata
+    && metadata.runtime === 'native-node'
+    && typeof metadata.version === 'string'
+    && imageIdPattern.test(metadata.image || '')
+    && (!metadata.imageSource || ['standard', 'custom'].includes(metadata.imageSource))
+    && (!metadata.imageReference || imageReferencePattern.test(metadata.imageReference)));
+  const imageAvailable = image !== null;
+  const markerMatches = metadataValid && imageAvailable && metadata.image === image;
+  const installed = Boolean(markerMatches);
+  return {
+    installed,
+    image: {
+      reference: config.image,
+      id: image,
+      available: imageAvailable,
+      pinned: imageAvailable && config.image === image,
+      markerImage: metadataValid ? metadata.image : null,
+      source: metadataValid ? (metadata.imageSource || 'legacy') : null,
+      referenceAtInstall: metadataValid ? (metadata.imageReference || null) : null,
+      metadataValid,
+      markerMatches: Boolean(markerMatches),
+      error: imageAvailable ? null : `Selected image ${config.image} is not present locally`,
+    },
+  };
+}
+
+export function assertInstalledJobImage(state, config = configAt(state), runner = run) {
+  const status = inspectImageInstallation(state, config, runner);
+  if (!status.installed) {
+    if (!status.image.available) throw new Error(`Selected job image ${config.image} is not present locally; run install with an available image`);
+    if (!status.image.metadataValid) throw new Error('Runtime image metadata is missing or invalid; run install');
+    throw new Error('Selected job image does not match the installed image metadata; run install');
+  }
+  return status;
+}

package/factory/installation-lock.mjs

@@ -0,0 +1,15 @@
+import { writeFileSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+
+// Per installation: managed boot bypasses the CLI's global service-operation
+// lock. Hold this fence until image metadata is complete or the supervisor PID
+// is visible, before any queued work can snapshot an execution profile.
+export function acquireInstallationLock(state, action) {
+  const path = join(state, 'installation.lock');
+  try { writeFileSync(path, JSON.stringify({ pid: process.pid, action }), { flag: 'wx', mode: 0o600 }); }
+  catch (error) {
+    if (error.code === 'EEXIST') throw new Error(`Another installation operation may own ${path}; reconcile its PID before removing the lock`);
+    throw error;
+  }
+  return () => rmSync(path);
+}

package/factory/processes.mjs

@@ -1,11 +1,34 @@
 import { spawn } from 'node:child_process';
-import { existsSync, mkdirSync, openSync, closeSync, readFileSync, renameSync, rmSync } from 'node:fs';
+import { existsSync, mkdirSync, openSync, closeSync, readFileSync, renameSync, rmSync, lstatSync } from 'node:fs';
 import { join } from 'node:path';
-import { ROOT, configAt, run, json, stopContainers, sleep } from './lib.mjs';
+import { ROOT, configAt, run, json, save, stopContainers, sleep } from './lib.mjs';
+import { withRequestedModel, executionProfile } from './execution-profile.mjs';
 
 const alive = pid => { try { process.kill(pid, 0); return true; } catch (error) { if (error.code === 'ESRCH') return false; throw error; } };
+// Older queues did not retain the verdict. Only recover it from the exact
+// attempt's controller-exported review, bound to its checked candidate/policy.
+export function retainedReviewVerdict(state, job, attempt) {
+  try {
+    const folder = join(state, 'jobs', job.id);
+    const read = path => { const stat = lstatSync(path); if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 1024 * 1024) return null; return json(path); };
+    const review = read(join(folder, 'artifacts', attempt.id, 'review.json'));
+    const candidate = read(join(folder, 'candidate.json')), checks = read(join(folder, 'checks.json'));
+    if (review?.head && review.policyHash && review.head === candidate?.head && checks?.passed === true
+      && checks.head === review.head && checks.policyHash === review.policyHash) return review.verdict;
+  } catch { /* Missing or malformed legacy evidence cannot grant a revision action. */ }
+}
 export function executors(state) {
   const children = new Map();
+  function prepare(job, attempt) {
+    const config = withRequestedModel(configAt(state), job.model);
+    // Resolve tags before admission so the recorded image is the one actually run.
+    config.image = run('docker', ['image', 'inspect', '--format', '{{.Id}}', config.image]);
+    if (!/^sha256:[a-f0-9]{64}$/.test(config.image)) throw new Error('Expected an immutable Docker image ID');
+    const profile = executionProfile(config, attempt.command), folder = join(state, 'jobs', job.id);
+    save(join(folder, attempt.id, 'execution-config.json'), config);
+    save(join(folder, 'artifacts', attempt.id, 'execution.json'), profile);
+    return profile;
+  }
   async function stop(jobId) {
     const running = children.get(jobId);
     if (running) {
@@ -34,11 +57,11 @@ export function executors(state) {
       renameSync(join(folder, 'checkout'), join(folder, `previous-checkout-${Date.now()}`));
   }
   async function execute(job, attempt) {
-    const config = configAt(state), output = join(state, 'jobs', job.id, 'artifacts', attempt.id);
+    const config = json(join(state, 'jobs', job.id, attempt.id, 'execution-config.json')), output = join(state, 'jobs', job.id, 'artifacts', attempt.id);
     mkdirSync(output, { recursive: true, mode: 0o700 });
     const resultPath = join(output, 'result.json'), fd = openSync(join(output, 'executor.log'), 'a', 0o600);
     const child = spawn(process.execPath, [join(ROOT, 'factory/executor.mjs'), state, attempt.command], {
-      detached: true, stdio: ['pipe', fd, fd], env: { ...process.env, SDF_JOB_ID: job.id, SDF_RUN_ID: attempt.id, SDF_MODEL: job.model || '', SDF_OUTPUT_DIR: output, SDF_STEP_RESULT_PATH: resultPath },
+      detached: true, stdio: ['pipe', fd, fd], env: { ...process.env, SDF_JOB_ID: job.id, SDF_RUN_ID: attempt.id, SDF_OUTPUT_DIR: output, SDF_STEP_RESULT_PATH: resultPath },
     }); closeSync(fd);
     let finish;
     const done = new Promise(resolve => { finish = resolve; });
@@ -53,8 +76,8 @@ export function executors(state) {
     if (exit.error) throw exit.error;
     if (!existsSync(resultPath)) throw new Error(`Executor exited ${exit.code} without a result`);
     const outcome = JSON.parse(readFileSync(resultPath, 'utf8'));
-    if (exit.code !== 0 || outcome.outcome !== 'complete') return { outcome: 'blocked', summary: outcome.summary || `Executor exited ${exit.code}` };
+    if (exit.code !== 0 || outcome.outcome !== 'complete') return { outcome: 'blocked', summary: outcome.summary || `Executor exited ${exit.code}`, review_verdict: outcome.review_verdict };
     return outcome;
   }
-  return { execute, stop, reconcile };
+  return { prepare, execute, stop, reconcile, reviewVerdict: (job, attempt) => retainedReviewVerdict(state, job, attempt) };
 }

package/factory/queue.mjs

@@ -11,10 +11,10 @@ export class QueueError extends Error { constructor(message, status = 409) { sup
 // One controller owns this database and one executor at a time. Each transition
 // is committed before execution starts; a restart never assumes a result.
 export class JobQueue {
-  constructor(state, { execute, stop, reconcile }) {
+  constructor(state, { execute, stop, reconcile, prepare, reviewVerdict = () => undefined }) {
     this.db = new DatabaseSync(join(state, 'jobs.sqlite'));
     this.db.exec('PRAGMA journal_mode=WAL; PRAGMA busy_timeout=5000; CREATE TABLE IF NOT EXISTS jobs(id TEXT PRIMARY KEY, data TEXT NOT NULL);');
-    this.execute = execute; this.stop = stop; this.reconcile = reconcile;
+    this.execute = execute; this.stop = stop; this.reconcile = reconcile; this.prepare = prepare; this.reviewVerdict = reviewVerdict;
     this.maintenanceFile = join(state, 'maintenance.json');
     this.active = null; this.closing = false; this.pumping = false; this.actions = new Set(); this.maintenance = existsSync(this.maintenanceFile);
     for (const job of this.all()) if (['running', 'cancelling'].includes(job.state)) {
@@ -67,12 +67,16 @@ export class JobQueue {
         const started = Date.now(); Object.assign(attempt, { state: 'running', started_at: now() }); job.state = 'running'; this.save(job);
         this.active = { jobId: job.id, runId: attempt.id };
         let outcome;
-        try { outcome = await this.execute(job, attempt); }
+        try {
+          if (this.prepare) { attempt.execution = this.prepare(job, attempt); this.save(job); }
+          outcome = await this.execute(job, attempt);
+        }
         catch (error) { outcome = { outcome: 'blocked', summary: error.message }; }
         job = this.get(job.id); attempt = job.runs.find(run => run.id === attempt.id);
         if (job.state === 'running') {
           const succeeded = outcome?.outcome === 'complete';
           Object.assign(attempt, { state: succeeded ? 'succeeded' : 'failed', outcome: succeeded ? 'complete' : 'blocked', completed_at: now(), duration_millis: Date.now() - started, summary: outcome?.summary || 'No result', exit_code: succeeded ? 0 : 1 });
+          if (phase === 'review' && ['pass', 'changes', 'blocked'].includes(outcome?.review_verdict)) attempt.review_verdict = outcome.review_verdict;
           if (!succeeded) { job.state = 'failed'; attempt.error = attempt.summary; }
           else if (step === job.workflow.steps.length - 1) job.state = 'succeeded';
           else {
@@ -94,6 +98,13 @@ export class JobQueue {
     try { return await perform(); } finally { this.actions.delete(jobId); }
   }
   action(jobId, action, input) { return this.exclusive(jobId, () => this.applyAction(jobId, action, input)); }
+  canRequestChanges(job) {
+    if (job.workflow?.name !== 'software') return false;
+    if (job.state === 'awaiting_approval') return true;
+    const attempt = job.runs.at(-1);
+    return job.state === 'failed' && attempt?.state === 'failed' && attempt.command === 'review'
+      && ['changes', 'blocked'].includes(attempt.review_verdict ?? this.reviewVerdict(job, attempt));
+  }
   async applyAction(jobId, action, input) {
     if (this.closing) throw new QueueError('Controller is stopping');
     const job = this.get(jobId), attempt = job.runs.at(-1);
@@ -102,11 +113,15 @@ export class JobQueue {
       if (job.state !== 'awaiting_approval') throw new QueueError('Job is not awaiting approval');
       job.state = 'queued'; attempt.state = 'queued'; this.save(job); this.schedule();
     } else if (action === 'request_changes') {
-      if (job.state !== 'awaiting_approval' || job.workflow.name !== 'software') throw new QueueError('Only a reviewed software task can be revised');
+      if (!this.canRequestChanges(job)) throw new QueueError('Only a reviewed software task can be revised');
       if (typeof input.feedback !== 'string' || !input.feedback.trim() || input.feedback.length > 4000) throw new QueueError('Provide revision feedback under 4000 characters', 400);
+      const revisedPrompt = job.prompt + `\n\nRequested revision: ${input.feedback}`;
+      if (Buffer.byteLength(revisedPrompt) > 240000) throw new QueueError('Accumulated revision instructions exceed 240 KB; create a bounded continuation task', 400);
       await this.reconcile(jobId, 'build');
-      Object.assign(attempt, { state: 'succeeded', outcome: 'changes_requested', summary: input.feedback, completed_at: now(), duration_millis: 0 });
-      job.prompt += `\n\nRequested revision: ${input.feedback}`;
+      // A failed review stays failed. Revision feedback must not rewrite its result.
+      attempt.revision = { feedback: input.feedback, requested_at: now() };
+      if (job.state === 'awaiting_approval') Object.assign(attempt, { state: 'succeeded', outcome: 'changes_requested', summary: input.feedback, completed_at: now(), duration_millis: 0 });
+      job.prompt = revisedPrompt;
       job.workflow.current_step = 0; job.state = 'queued'; this.save(job); this.schedule();
     } else if (action === 'cancel') {
       if (!['queued', 'running', 'awaiting_approval', 'blocked', 'interrupted'].includes(job.state)) throw new QueueError('Job is already stopped');

package/factory/server.mjs

@@ -7,6 +7,7 @@ import { JobQueue, QueueError } from './queue.mjs';
 import { executors } from './processes.mjs';
 import { configAt, ROOT } from './lib.mjs';
 import { VERSION } from './updates.mjs';
+import { attemptPresentation } from './execution-profile.mjs';
 
 function equal(a, b) { return typeof a === 'string' && Buffer.byteLength(a) === Buffer.byteLength(b) && timingSafeEqual(Buffer.from(a), Buffer.from(b)); }
 async function body(request) {
@@ -39,10 +40,8 @@ export function createController(state, adapter = executors(state)) {
       const url = new URL(request.url, `http://${request.headers.host}`);
       const authenticated = equal(request.headers.authorization, `Bearer ${token}`) || equal(request.headers['x-factory-session'], csrf);
       if (request.method === 'GET' && url.pathname === '/api/v1/status') {
-        const jobs = queue.all().map(job => ({ ...job, runs: job.runs.map(attempt => ({ ...attempt,
-          outcome: attempt.outcome || (attempt.state === 'succeeded' ? 'complete' : undefined),
-          executor: ['verify','handoff'].includes(attempt.command) ? 'deterministic' : config.agent,
-          worker_name: hostname(), model: job.model || config.model })) }));
+        const jobs = queue.all().map(job => ({ ...job, can_request_changes: queue.canRequestChanges(job), runs: job.runs.map(attempt => attemptPresentation({ ...attempt,
+          outcome: attempt.outcome || (attempt.state === 'succeeded' ? 'complete' : undefined) })) }));
         return send(200, { version: 1, runtime_version: VERSION, maintenance: queue.maintenance, workflows: ['software', 'defence'], commands: [], triggers: [], jobs, csrf_token: csrf,
           workers: [{ name: hostname(), instance_id: 'local-executor', repositories: ['app'], connected: !queue.closing, last_seen_at: new Date().toISOString() }],
           repositories: ['app'], repo: config.repo, agent: config.agent });

package/factory/services.mjs

@@ -5,6 +5,7 @@ import { spawnSync } from 'node:child_process';
 import { createServer } from 'node:net';
 import { ROOT, STATE_HOME, DATA_HOME, SOURCE_CHECKOUT } from './paths.mjs';
 import { configAt, json, save, run, api, sleep, digest } from './lib.mjs';
+import { assertInstalledJobImage } from './image-install.mjs';
 import { VERSION, newer, latestVersion, installRelease, busyInstallations } from './updates.mjs';
 import { serviceId, systemdUnit, launchAgent, tunnelArguments, groupArguments, runtimeLauncher } from './service-files.mjs';
 
@@ -127,9 +128,8 @@ async function install(kind, state, flags) {
     console.log(JSON.stringify(await serviceStatus(previous), null, 2)); return;
   }
   if (kind === 'controller') {
-    if (!existsSync(join(state, 'engine.json'))) throw new Error('Run install for this state before installing its service');
+    assertInstalledJobImage(state, configAt(state));
     if (existsSync(join(state, 'supervisor.json')) && alive(json(join(state, 'supervisor.json')).pid)) throw new Error('Stop the manually started controller before adopting it as a service');
-    run('docker', ['image', 'inspect', configAt(state).image]);
   }
   let argv = kind === 'controller' ? [process.execPath, launcher(), 'serve', '--state', state] : tunnelArguments(flags.host, port);
   if (flags.group) {

package/factory/supervisor.mjs

@@ -2,10 +2,18 @@ import { writeFileSync, rmSync } from 'node:fs';
 import { join } from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { configAt, stopContainers } from './lib.mjs';
+import { acquireInstallationLock } from './installation-lock.mjs';
+import { assertInstalledJobImage } from './image-install.mjs';
 import { createController } from './server.mjs';
 export async function supervise(state) {
-const config = configAt(state), lock = join(state, 'supervisor.json');
-writeFileSync(lock, JSON.stringify({ pid: process.pid }), { flag: 'wx', mode: 0o600 });
+const lock = join(state, 'supervisor.json');
+const release = acquireInstallationLock(state, 'start controller');
+let config;
+try {
+  config = configAt(state);
+  assertInstalledJobImage(state, config);
+  writeFileSync(lock, JSON.stringify({ pid: process.pid }), { flag: 'wx', mode: 0o600 });
+} finally { release(); }
 let controller, stopping = false;
 async function shutdown(code = 0) {
   if (stopping) return; stopping = true;