spawnfile 0.1.17 → 0.1.19

package/dist/volume/feedVerify.js

@@ -0,0 +1,104 @@
+// Integrity of a fed volume, judged only against the host's own record and manifest.
+//
+// `drift` is repairable from the source (the tree is gone or its content moved); `relink` and `identity`
+// are repairable in place. A real file or directory where the host's link or tree belongs is NOT
+// repairable without deleting a name the host did not write, which it never does: those findings
+// carry the one command an operator runs to clear them.
+import { lstatSync, readdirSync, readlinkSync } from "node:fs";
+import path from "node:path";
+import { FEED_CURRENT_LINK, FEED_IDENTITY_FILE, FEED_TREES_DIR, assertRealDirectory, auditFeedRoot, feedTreeLink, moveAsideCommand, treeShape } from "./feedLayout.js";
+import { compareFeedManifest, manifestDrift, readFeedManifest, sha256Hex } from "./feedManifest.js";
+import { readFeedIdentityBytes } from "./feedRecord.js";
+const readLink = (file) => {
+    const shape = treeShape(file);
+    if (shape === "missing")
+        return "missing";
+    if (shape !== "symlink")
+        return "not a symlink";
+    try {
+        return readlinkSync(file);
+    }
+    catch {
+        return "missing";
+    }
+};
+const sweepVolume = (target, record) => {
+    const result = { blocked: false, drift: false, failed: false, findings: [], identity: null, planted: false, relink: false, touched: [], unknown: [] };
+    const volume = target.volume;
+    result.unknown.push(...auditFeedRoot(volume));
+    const treesDir = path.join(volume, FEED_TREES_DIR);
+    const treesPresent = assertRealDirectory(treesDir, "the fed volume's trees/ directory");
+    if (treesPresent) {
+        for (const name of readdirSync(treesDir).sort()) {
+            if (!record.trees.includes(name))
+                result.unknown.push(`${FEED_TREES_DIR}/${name} is not a tree this host landed`);
+        }
+    }
+    const treePath = path.join(volume, feedTreeLink(record.tree));
+    const shape = treesPresent ? treeShape(treePath) : "missing";
+    if (shape === "missing") {
+        result.drift = true;
+        result.findings.push(`${feedTreeLink(record.tree)} is gone from the volume; it must be re-landed`);
+    }
+    else if (shape !== "directory") {
+        result.planted = true;
+        result.findings.push(`${feedTreeLink(record.tree)} is a ${shape} where the host's tree belongs; clear it with: ${moveAsideCommand(volume, treePath)}`);
+    }
+    else {
+        const manifest = readFeedManifest(target.stateDir, record.tree);
+        if (!manifest) {
+            result.drift = true;
+            result.findings.push(`no land-time manifest for ${record.revision.slice(0, 12)}, so its content cannot be verified`);
+        }
+        else {
+            const compared = compareFeedManifest(treePath, manifest);
+            const drift = manifestDrift(compared);
+            // The tree root itself is frozen at land; an owner restoring its write bit can add names to it.
+            if ((lstatSync(treePath).mode & 0o777) !== 0o555)
+                drift.push(". changed");
+            if (drift.length) {
+                result.drift = true;
+                result.findings.push(`${feedTreeLink(record.tree).slice(0, 18)} no longer matches what the host landed: ${drift.slice(0, 8).join(", ")}${drift.length > 8 ? ` and ${drift.length - 8} more` : ""}`);
+            }
+            result.touched = compared.touched;
+        }
+    }
+    const live = path.join(volume, FEED_CURRENT_LINK);
+    const link = readLink(live), want = feedTreeLink(record.tree);
+    if (link !== want) {
+        if (link === "not a symlink") {
+            result.blocked = true;
+            result.findings.push(`${FEED_CURRENT_LINK} is a real entry, not the host's link; clear it with: ${moveAsideCommand(volume, live)}`);
+        }
+        else {
+            result.relink = true;
+            result.findings.push(`${FEED_CURRENT_LINK} is ${link === "missing" ? "missing" : `-> ${link}`}, want -> ${want}`);
+        }
+    }
+    const bytes = readFeedIdentityBytes(volume);
+    if (bytes === null) {
+        result.identity = "missing";
+        result.findings.push(`${FEED_IDENTITY_FILE} is gone`);
+    }
+    else if (sha256Hex(bytes) !== record.identity_sha256) {
+        result.identity = "forged";
+        result.findings.push(`${FEED_IDENTITY_FILE} is not the record this host published`);
+    }
+    result.findings.push(...result.unknown);
+    return result;
+};
+/**
+ * NO EXCEPTION LEAVES THIS SWEEP WITHOUT A FINDING. A sweep that throws is a volume nothing verified,
+ * and it must read as "not clean", never as a quiet exit.
+ */
+export const sweepFeed = (target, record) => {
+    try {
+        return sweepVolume(target, record);
+    }
+    catch (error) {
+        return {
+            blocked: false, drift: false, failed: true, identity: null, planted: false, relink: false, touched: [], unknown: [],
+            findings: [`the integrity sweep could not complete, so nothing in this volume is verified: ${String(error.message).split("\n")[0]}`]
+        };
+    }
+};

package/dist/volume/index.d.ts

@@ -0,0 +1,13 @@
+export * from "./feedLand.js";
+export * from "./feedLandings.js";
+export * from "./feedLayout.js";
+export * from "./feedLock.js";
+export * from "./feedManifest.js";
+export * from "./feedPrepare.js";
+export * from "./feedProject.js";
+export * from "./feedRecord.js";
+export * from "./feedRef.js";
+export * from "./feedRefresh.js";
+export * from "./feedSource.js";
+export * from "./feedTarget.js";
+export * from "./feedVerify.js";

package/dist/volume/index.js

@@ -0,0 +1,13 @@
+export * from "./feedLand.js";
+export * from "./feedLandings.js";
+export * from "./feedLayout.js";
+export * from "./feedLock.js";
+export * from "./feedManifest.js";
+export * from "./feedPrepare.js";
+export * from "./feedProject.js";
+export * from "./feedRecord.js";
+export * from "./feedRef.js";
+export * from "./feedRefresh.js";
+export * from "./feedSource.js";
+export * from "./feedTarget.js";
+export * from "./feedVerify.js";

package/moltnet-releases.json

@@ -1,7 +1,7 @@
 {
   "version": "spawnfile.moltnet-release-authority.v1",
-  "release_version": "v0.1.18",
-  "source_revision": "988c5284f45705beb3bf59a4a4c0008605ce609e",
+  "release_version": "v0.1.19",
+  "source_revision": "7f9900dfd89166e5ebb46ee82c0dc1492c4a89aa",
   "capabilities": [
     "daimon-bridge",
     "pi-bridge"
@@ -10,12 +10,12 @@
     {
       "architecture": "amd64",
       "asset": "moltnet_linux_amd64.tar.gz",
-      "asset_sha256": "sha256:92d356cd33841e89b6bc56c6e8c2c37d987124f35c896d033e8766eab09da2c5"
+      "asset_sha256": "sha256:e0564bccdf7adb92936f2c39b7491a465ae0799bf3de697fb594ea4244daf9c6"
     },
     {
       "architecture": "arm64",
       "asset": "moltnet_linux_arm64.tar.gz",
-      "asset_sha256": "sha256:40c1fae1c687a59a9e6d804ac28d00e925f318bd4e922accdca4402ceab88548"
+      "asset_sha256": "sha256:f40e9ab6190bb05e8a536baefe5fe0f4f7b7aa58d5475e7b6546abfad3c950a2"
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spawnfile",
-  "version": "0.1.17",
+  "version": "0.1.19",
   "description": "Canonical source compiler for autonomous agents and teams.",
   "license": "MIT",
   "type": "module",
@@ -61,12 +61,12 @@
     "test:product-state-volume": "node --experimental-strip-types scripts/product-state-volume-integration.test.ts",
     "test:boundaries": "vitest run --coverage.enabled=false src/ownership/rootOwnershipBoundary.test.ts src/deployment/providerRuntimeBoundary.test.ts src/ownership/mnemePublicImportBoundary.test.ts src/target/containerBundleArchive.test.ts",
     "test:causal-conformance": "tsx src/ledger/causalConformanceCli.ts",
-    "typecheck": "tsc --project tsconfig.json --noEmit && tsc --project scripts/tsconfig.json",
+    "typecheck": "tsc --project tsconfig.json --noEmit && tsc --project scripts/tsconfig.json && tsc --project .github/scripts/ci/tsconfig.json",
     "test:e2e:distribution-image": "tsx src/e2e/cli.ts distribution-image",
     "test:e2e:distribution-roundtrip": "tsx src/e2e/cli.ts distribution-roundtrip",
     "test:e2e:daimon-org": "tsx src/e2e/cli.ts daimon-org",
     "test:live:grok-lean-worker": "node --experimental-strip-types ./scripts/grok-lean-worker-live-check.ts",
-    "test:scripts": "node --experimental-strip-types --test scripts/build-local-daimon-runtime.test.ts scripts/grok-lean-worker-live-check.test.ts scripts/build-local-moltnet.test.ts scripts/compile-explicit-test-mcp.test.ts scripts/native-helper-workflows.test.ts scripts/typescript-policy.test.ts scripts/training-image-modes.test.ts",
+    "test:scripts": "node --experimental-strip-types --test scripts/build-local-daimon-runtime.test.ts scripts/daimon-publish-inputs.test.ts scripts/runtime-image-workflows.test.ts scripts/grok-lean-worker-live-check.test.ts scripts/build-local-moltnet.test.ts scripts/compile-explicit-test-mcp.test.ts scripts/native-helper-workflows.test.ts scripts/typescript-policy.test.ts scripts/training-image-modes.test.ts && node --import tsx --test scripts/training-native-image.test.ts",
     "test:unit": "npm run test:vitest; vitest_status=$?; npm run test:verdict; verdict_status=$?; npm run test:coverage-verdict; coverage_status=$?; npm run test:node; node_status=$?; failed_lanes=''; if [ \"$verdict_status\" -eq 2 ]; then failed_lanes='vitest test failures'; fi; if [ \"$node_status\" -eq 2 ]; then if [ -n \"$failed_lanes\" ]; then failed_lanes=\"$failed_lanes; node:test suite\"; else failed_lanes='node:test suite'; fi; fi; result_status=0; if [ -n \"$failed_lanes\" ]; then echo \"FAIL(tests): $failed_lanes\"; result_status=1; fi; if [ \"$verdict_status\" -ne 0 ] && [ \"$verdict_status\" -ne 2 ]; then echo 'FAIL(vitest-verdict): could not determine the vitest result'; result_status=1; fi; if [ \"$node_status\" -ne 0 ] && [ \"$node_status\" -ne 2 ]; then echo 'FAIL(node-lane): could not determine the node:test result'; result_status=1; fi; if [ \"$result_status\" -ne 0 ]; then exit 1; elif [ \"$vitest_status\" -ne 0 ]; then echo \"FAIL(vitest): exited $vitest_status with no test failure\"; exit 1; elif [ \"$coverage_status\" -eq 2 ]; then echo 'FAIL(coverage): thresholds not met (tests all passed)'; exit 2; elif [ \"$coverage_status\" -ne 0 ]; then echo 'FAIL(coverage-verdict): could not evaluate coverage (tests all passed)'; exit 1; else echo 'PASS'; fi",
     "test": "npm run test:unit && npm run test:scripts"
   },

package/runtimes.yaml

@@ -12,16 +12,18 @@
 #
 runtimes:
   daimon:
-    remote: git@github.com:noopolis/daimon.git
-    ref: v0.2.0
+    remote: git@github.com:noopolis/daimon-harness.git
+    ref: 14d0298c00861f949bb6993d1af9751cde53319f
     default_branch: main
     install:
       kind: container_image
       image: noopolis/spawnfile-runtime-daimon
-      tag: 0.2.0
-      digest: sha256:19b671e589ad8c9e8f1b55610ccbf86ee72f16b4cb2f707ec419f5ef0d6942aa
-      capability_receipt: sha256:1a207c0cc5f081b2a8f941d59b74e37f905a1dc7b37a08c7984c6e39123fb4e7
-      contract_manifest_sha256: sha256:95ef6c04f1a757b8cd33498207239aa242d0dd6783308530eadb660285b5f83b
+      tag: 0.2.1-14d0298
+      digest: sha256:2de3bd522ce88202b3295efa4f19c72c350e5e18c25ccba55e5acf3395e8569c
+      capability_receipts:
+        amd64: sha256:26fe7ff328bb45fb6643b0792ab38b2658d5fcc3d2d8bd67d9848ea2987c04cc
+        arm64: sha256:347da7c613ad3430e018de829587a6d686c498c6168ef4be6b8dd501fdb07ebb
+      contract_manifest_sha256: sha256:e39551277c6727c8807b1247e759f57addcee3f17f1405ebc927179647d64de6
     status: active
 
   openclaw: